Skip to content

chore(deps-dev): bump the dev-dependencies group with 9 updates#525

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-7fd4cde7cd
Open

chore(deps-dev): bump the dev-dependencies group with 9 updates#525
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-7fd4cde7cd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 9 updates:

Package From To
@biomejs/biome 2.4.15 2.5.0
@types/node 22.19.19 22.19.21
js-yaml 4.1.1 4.2.0
turbo 2.9.14 2.9.18
@prisma-next/cli 0.8.0 0.13.0
@prisma-next/psl-parser 0.8.0 0.13.0
@prisma-next/sql-contract-ts 0.8.0 0.13.0
@prisma-next/sql-schema-ir 0.8.0 0.13.0
@supabase/supabase-js 2.105.4 2.108.1

Updates @biomejs/biome from 2.4.15 to 2.5.0

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.0

2.5.0

Minor Changes

  • #9539 f0615fd Thanks @​ematipico! - Added a new reporter called concise. When --reporter=concise is passed the commands format, lint, check and ci, the diagnostics are printed in a compact manner:

    ! index.ts:2:10: lint/correctness/noUnusedImports: Several of these imports are unused.
! main.ts:9:7: lint/correctness/noUnusedVariables: This variable f is unused.
× index.ts:8:5: lint/suspicious/noImplicitAnyLet: This variable implicitly has the any type.
× main.ts:2:10: lint/suspicious/noRedeclare: Shouldn't redeclare 'z'. Consider to delete it or rename it.

  • #9495 2056b23 Thanks @​aviraldua93! - Added the useKeyWithClickEvents a11y lint rule for HTML files (.html, .vue, .svelte, .astro). This is a port of the existing JSX rule. The rule enforces that elements with an onclick handler also have at least one keyboard event handler (onkeydown, onkeyup, or onkeypress) to ensure keyboard accessibility.

    Inherently keyboard-accessible elements (<a>, <button>, <input>, <select>, <textarea>, <option>) are excluded, as are elements hidden from assistive technologies (aria-hidden) or with role="presentation" / role="none".

    <!-- Invalid: no keyboard handler -->
<div onclick="handleClick()">Click me</div>
<!-- Valid: has keyboard handler -->
<div onclick="handleClick()" onkeydown="handleKeyDown()">Click me</div>
<!-- Valid: inherently keyboard-accessible -->
<button onclick="handleClick()">Submit</button>

  • #9152 9ec8500 Thanks @​ematipico! - Added new nursery lint rule noUndeclaredClasses for HTML, JSX, and SFC files (Vue, Astro, Svelte). The rule detects CSS class names used in class="..." (or className) attributes that are not defined in any <style> block or linked stylesheet reachable from the file.

    <!-- .typo is used but never defined -->
<html>
  <head>
    <style>
      .button {
        color: blue;
      }
    </style>
  </head>
  <body>
    <div class="button typo"></div>
  </body>
</html>

  • #9152 9ec8500 Thanks @​ematipico! - Added new nursery lint rule noUnusedClasses for CSS. The rule detects CSS class selectors that are never referenced in any HTML or JSX file that imports the stylesheet. This is a project-domain rule that requires the module graph.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.0

Minor Changes

  • #9539 f0615fd Thanks @​ematipico! - Added a new reporter called concise. When --reporter=concise is passed the commands format, lint, check and ci, the diagnostics are printed in a compact manner:

    ! index.ts:2:10: lint/correctness/noUnusedImports: Several of these imports are unused.
! main.ts:9:7: lint/correctness/noUnusedVariables: This variable f is unused.
× index.ts:8:5: lint/suspicious/noImplicitAnyLet: This variable implicitly has the any type.
× main.ts:2:10: lint/suspicious/noRedeclare: Shouldn't redeclare 'z'. Consider to delete it or rename it.

  • #9495 2056b23 Thanks @​aviraldua93! - Added the useKeyWithClickEvents a11y lint rule for HTML files (.html, .vue, .svelte, .astro). This is a port of the existing JSX rule. The rule enforces that elements with an onclick handler also have at least one keyboard event handler (onkeydown, onkeyup, or onkeypress) to ensure keyboard accessibility.

    Inherently keyboard-accessible elements (<a>, <button>, <input>, <select>, <textarea>, <option>) are excluded, as are elements hidden from assistive technologies (aria-hidden) or with role="presentation" / role="none".

    <!-- Invalid: no keyboard handler -->
<div onclick="handleClick()">Click me</div>
<!-- Valid: has keyboard handler -->
<div onclick="handleClick()" onkeydown="handleKeyDown()">Click me</div>
<!-- Valid: inherently keyboard-accessible -->
<button onclick="handleClick()">Submit</button>

  • #9152 9ec8500 Thanks @​ematipico! - Added new nursery lint rule noUndeclaredClasses for HTML, JSX, and SFC files (Vue, Astro, Svelte). The rule detects CSS class names used in class="..." (or className) attributes that are not defined in any <style> block or linked stylesheet reachable from the file.

    <!-- .typo is used but never defined -->
<html>
  <head>
    <style>
      .button {
        color: blue;
      }
    </style>
  </head>
  <body>
    <div class="button typo"></div>
  </body>
</html>

  • #9152 9ec8500 Thanks @​ematipico! - Added new nursery lint rule noUnusedClasses for CSS. The rule detects CSS class selectors that are never referenced in any HTML or JSX file that imports the stylesheet. This is a project-domain rule that requires the module graph.

    /* styles.css — .ghost is never used in any importing file */

... (truncated)

Commits

Updates @types/node from 22.19.19 to 22.19.21

Commits

Updates js-yaml from 4.1.1 to 4.2.0

Changelog

Sourced from js-yaml's changelog.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.
  • Fix digits in YAML named tag handles.

Security

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

  • Backported v4.1.1 fix to v3
Commits

Updates turbo from 2.9.14 to 2.9.18

Release notes

Sourced from turbo's releases.

Turborepo v2.9.18

What's Changed

Changelog

New Contributors

Full Changelog: vercel/turborepo@v2.9.17...v2.9.18

Turborepo v2.9.17

What's Changed

Changelog

... (truncated)

Commits

Updates @prisma-next/cli from 0.8.0 to 0.13.0

Release notes

Sourced from @​prisma-next/cli's releases.

v0.13.0

This release makes namespaces a first-class part of the query surface, adds cross-contract foreign keys to the SQL ORM, makes many-to-many a validatable contract shape, introduces a per-object control policy (@@control) that decides what Prisma manages, ships domain enums backed by storage value-sets, and gives the migration CLI a unified graph-tree view across list / log / status / show. Telemetry also flips from opt-in to opt-out. A few changes require a one-time contract re-emit — all are covered by the linked upgrade recipes.

Breaking changes

  • Telemetry is now opt-out — anonymous CLI telemetry is collected by default and you opt out, where previously you opted in. Set PRISMA_NEXT_DISABLE_TELEMETRY=1 (or DO_NOT_TRACK=1) to turn it off. See docs/Telemetry.md for what is collected and every opt-out signal. (#676)

  • MTI variant tables materialize a base-PK link column — a PSL @@base(Parent, "tag") variant that carries its own @@map (and is therefore stored in its own table) now emits a base-PK link column in storage: the variant table gains a copy of the base table's primary-key column(s), a primary key over them, and a cascading foreign key (ON DELETE CASCADE) referencing the base table's primary key. Previously the variant table held only the variant-specific columns with no primary key and no link to its base. This changes the emitted contract.json / contract.d.ts and the contract's storageHash. Re-emit your contract, then plan and apply the matching migration. Variants that share the base table (no own @@map) are unaffected. See the 0.12→0.13 upgrade recipe. (#669)

    Before (emitted contract.json, variant table bug):

    "bug": {
  "columns": {
    "severity": { "codecId": "pg/text@1", "nullable": false }
  }
}

    After:

    "bug": {
  "columns": {
    "id": { "codecId": "sql/char@1", "nullable": false },
    "severity": { "codecId": "pg/text@1", "nullable": false }
  },
  "primaryKey": { "columns": ["id"] },
  "foreignKeys": [
    {
      "name": "bug_id_fkey",
      "columns": ["id"],
      "references": { "table": "task", "columns": ["id"] },
      "onDelete": "cascade"
    }
  ]
}

  • Contract storage IR moved to a namespace envelope — the SQL/Mongo storage IR is now keyed by namespace (storage.namespaces.<ns>.entries.<kind>), and cross-references are explicit { namespace, model } objects in domain. Consumer impact is mechanical: re-emit with prisma-next contract emit to pick up the new shape. No codemod or source change is required, but the contract's storageHash changes, so plan and apply a migration afterward. (#715)

  • Extension authors: codec-resolution SPI takes a leading namespaceId — CodecDescriptorRegistry.codecRefForColumn(table, column) is now codecRefForColumn(namespaceId, table, column), and the free codecRefForStorageColumn(storage, table, column) is now codecRefForStorageColumn(storage, namespaceId, table, column) (both in @prisma-next/sql-relational-core). Thread the namespace the table lives in through every call site that stamps codec onto AST nodes. There is no codemod — the right namespace is call-site-specific. See the 0.12→0.13 extension-author recipe. (#715)

    Before:

    const ref = descriptors.codecRefForColumn('document', 'embedding');

... (truncated)

Changelog

Sourced from @​prisma-next/cli's changelog.

v0.13.0

This release makes namespaces a first-class part of the query surface, adds cross-contract foreign keys to the SQL ORM, makes many-to-many a validatable contract shape, introduces a per-object control policy (@@control) that decides what Prisma manages, ships domain enums backed by storage value-sets, and gives the migration CLI a unified graph-tree view across list / log / status / show. Telemetry also flips from opt-in to opt-out. A few changes require a one-time contract re-emit — all are covered by the linked upgrade recipes.

Breaking changes

  • Telemetry is now opt-out — anonymous CLI telemetry is collected by default and you opt out, where previously you opted in. Set PRISMA_NEXT_DISABLE_TELEMETRY=1 (or DO_NOT_TRACK=1) to turn it off. See docs/Telemetry.md for what is collected and every opt-out signal. (#676)

  • MTI variant tables materialize a base-PK link column — a PSL @@base(Parent, "tag") variant that carries its own @@map (and is therefore stored in its own table) now emits a base-PK link column in storage: the variant table gains a copy of the base table's primary-key column(s), a primary key over them, and a cascading foreign key (ON DELETE CASCADE) referencing the base table's primary key. Previously the variant table held only the variant-specific columns with no primary key and no link to its base. This changes the emitted contract.json / contract.d.ts and the contract's storageHash. Re-emit your contract, then plan and apply the matching migration. Variants that share the base table (no own @@map) are unaffected. See the 0.12→0.13 upgrade recipe. (#669)

    Before (emitted contract.json, variant table bug):

    "bug": {
  "columns": {
    "severity": { "codecId": "pg/text@1", "nullable": false }
  }
}

    After:

    "bug": {
  "columns": {
    "id": { "codecId": "sql/char@1", "nullable": false },
    "severity": { "codecId": "pg/text@1", "nullable": false }
  },
  "primaryKey": { "columns": ["id"] },
  "foreignKeys": [
    {
      "name": "bug_id_fkey",
      "columns": ["id"],
      "references": { "table": "task", "columns": ["id"] },
      "onDelete": "cascade"
    }
  ]
}

  • Contract storage IR moved to a namespace envelope — the SQL/Mongo storage IR is now keyed by namespace (storage.namespaces.<ns>.entries.<kind>), and cross-references are explicit { namespace, model } objects in domain. Consumer impact is mechanical: re-emit with prisma-next contract emit to pick up the new shape. No codemod or source change is required, but the contract's storageHash changes, so plan and apply a migration afterward. (#715)

  • Extension authors: codec-resolution SPI takes a leading namespaceId — CodecDescriptorRegistry.codecRefForColumn(table, column) is now codecRefForColumn(namespaceId, table, column), and the free codecRefForStorageColumn(storage, table, column) is now codecRefForStorageColumn(storage, namespaceId, table, column) (both in @prisma-next/sql-relational-core). Thread the namespace the table lives in through every call site that stamps codec onto AST nodes. There is no codemod — the right namespace is call-site-specific. See the 0.12→0.13 extension-author recipe. (#715)

    Before:

    const ref = descriptors.codecRefForColumn('document', 'embedding');

... (truncated)

Commits

Updates @prisma-next/psl-parser from 0.8.0 to 0.13.0

Release notes

Sourced from @​prisma-next/psl-parser's releases.

v0.13.0

This release makes namespaces a first-class part of the query surface, adds cross-contract foreign keys to the SQL ORM, makes many-to-many a validatable contract shape, introduces a per-object control policy (@@control) that decides what Prisma manages, ships domain enums backed by storage value-sets, and gives the migration CLI a unified graph-tree view across list / log / status / show. Telemetry also flips from opt-in to opt-out. A few changes require a one-time contract re-emit — all are covered by the linked upgrade recipes.

Breaking changes

  • Telemetry is now opt-out — anonymous CLI telemetry is collected by default and you opt out, where previously you opted in. Set PRISMA_NEXT_DISABLE_TELEMETRY=1 (or DO_NOT_TRACK=1) to turn it off. See docs/Telemetry.md for what is collected and every opt-out signal. (#676)

  • MTI variant tables materialize a base-PK link column — a PSL @@base(Parent, "tag") variant that carries its own @@map (and is therefore stored in its own table) now emits a base-PK link column in storage: the variant table gains a copy of the base table's primary-key column(s), a primary key over them, and a cascading foreign key (ON DELETE CASCADE) referencing the base table's primary key. Previously the variant table held only the variant-specific columns with no primary key and no link to its base. This changes the emitted contract.json / contract.d.ts and the contract's storageHash. Re-emit your contract, then plan and apply the matching migration. Variants that share the base table (no own @@map) are unaffected. See the 0.12→0.13 upgrade recipe. (#669)

    Before (emitted contract.json, variant table bug):

    "bug": {
  "columns": {
    "severity": { "codecId": "pg/text@1", "nullable": false }
  }
}

    After:

    "bug": {
  "columns": {
    "id": { "codecId": "sql/char@1", "nullable": false },
    "severity": { "codecId": "pg/text@1", "nullable": false }
  },
  "primaryKey": { "columns": ["id"] },
  "foreignKeys": [
    {
      "name": "bug_id_fkey",
      "columns": ["id"],
      "references": { "table": "task", "columns": ["id"] },
      "onDelete": "cascade"
    }
  ]
}

  • Contract storage IR moved to a namespace envelope — the SQL/Mongo storage IR is now keyed by namespace (storage.namespaces.<ns>.entries.<kind>), and cross-references are explicit { namespace, model } objects in domain. Consumer impact is mechanical: re-emit with prisma-next contract emit to pick up the new shape. No codemod or source change is required, but the contract's storageHash changes, so plan and apply a migration afterward. (#715)

  • Extension authors: codec-resolution SPI takes a leading namespaceId — CodecDescriptorRegistry.codecRefForColumn(table, column) is now codecRefForColumn(namespaceId, table, column), and the free codecRefForStorageColumn(storage, table, column) is now codecRefForStorageColumn(storage, namespaceId, table, column) (both in @prisma-next/sql-relational-core). Thread the namespace the table lives in through every call site that stamps codec onto AST nodes. There is no codemod — the right namespace is call-site-specific. See the 0.12→0.13 extension-author recipe. (#715)

    Before:

    const ref = descriptors.codecRefForColumn('document', 'embedding');

... (truncated)

Changelog

Sourced from @​prisma-next/psl-parser's changelog.

v0.13.0

This release makes namespaces a first-class part of the query surface, adds cross-contract foreign keys to the SQL ORM, makes many-to-many a validatable contract shape, introduces a per-object control policy (@@control) that decides what Prisma manages, ships domain enums backed by storage value-sets, and gives the migration CLI a unified graph-tree view across list / log / status / show. Telemetry also flips from opt-in to opt-out. A few changes require a one-time contract re-emit — all are covered by the linked upgrade recipes.

Breaking changes

  • Telemetry is now opt-out — anonymous CLI telemetry is collected by default and you opt out, where previously you opted in. Set PRISMA_NEXT_DISABLE_TELEMETRY=1 (or DO_NOT_TRACK=1) to turn it off. See docs/Telemetry.md for what is collected and every opt-out signal. (#676)

  • MTI variant tables materialize a base-PK link column — a PSL @@base(Parent, "tag") variant that carries its own @@map (and is therefore stored in its own table) now emits a base-PK link column in storage: the variant table gains a copy of the base table's primary-key column(s), a primary key over them, and a cascading foreign key (ON DELETE CASCADE) referencing the base table's primary key. Previously the variant table held only the variant-specific columns with no primary key and no link to its base. This changes the emitted contract.json / contract.d.ts and the contract's storageHash. Re-emit your contract, then plan and apply the matching migration. Variants that share the base table (no own @@map) are unaffected. See the 0.12→0.13 upgrade recipe. (#669)

    Before (emitted contract.json, variant table bug):

    "bug": {
  "columns": {
    "severity": { "codecId": "pg/text@1", "nullable": false }
  }
}

    After:

    "bug": {
  "columns": {
    "id": { "codecId": "sql/char@1", "nullable": false },
    "severity": { "codecId": "pg/text@1", "nullable": false }
  },
  "primaryKey": { "columns": ["id"] },
  "foreignKeys": [
    {
      "name": "bug_id_fkey",
      "columns": ["id"],
      "references": { "table": "task", "columns": ["id"] },
      "onDelete": "cascade"
    }
  ]
}

  • Contract storage IR moved to a namespace envelope — the SQL/Mongo storage IR is now keyed by namespace (storage.namespaces.<ns>.entries.<kind>), and cross-references are explicit { namespace, model } objects in domain. Consumer impact is mechanical: re-emit with prisma-next contract emit to pick up the new shape. No codemod or source change is required, but the contract's storageHash changes, so plan and apply a migration afterward. (#715)

  • Extension authors: codec-resolution SPI takes a leading namespaceId — CodecDescriptorRegistry.codecRefForColumn(table, column) is now codecRefForColumn(namespaceId, table, column), and the free codecRefForStorageColumn(storage, table, column) is now codecRefForStorageColumn(storage, namespaceId, table, column) (both in @prisma-next/sql-relational-core). Thread the namespace the table lives in through every call site that stamps codec onto AST nodes. There is no codemod — the right namespace is call-site-specific. See the 0.12→0.13 extension-author recipe. (#715)

    Before:

    const ref = descriptors.codecRefForColumn('document', 'embedding');

... (truncated)

Commits

Updates @prisma-next/sql-contract-ts from 0.8.0 to 0.13.0

Release notes

Sourced from @​prisma-next/sql-contract-ts's releases.

v0.13.0

This release makes namespaces a first-class part of the query surface, adds cross-contract foreign keys to the SQL ORM, makes many-to-many a validatable contract shape, introduces a per-object control policy (@@control) that decides what Prisma manages, ships domain enums backed by storage value-sets, and gives the migration CLI a unified graph-tree view across list / log / status / show. Telemetry also flips from opt-in to opt-out. A few changes require a one-time contract re-emit — all are covered by the linked upgrade recipes.

Breaking changes

  • Telemetry is now opt-out — anonymous CLI telemetry is collected by default and you opt out, where previously you opted in. Set PRISMA_NEXT_DISABLE_TELEMETRY=1 (or DO_NOT_TRACK=1) to turn it off. See docs/Telemetry.md for what is collected and every opt-out signal. (#676)

  • MTI variant tables materialize a base-PK link column — a PSL @@base(Parent, "tag") variant that carries its own @@map (and is therefore stored in its own table) now emits a base-PK link column in storage: the variant table gains a copy of the base table's primary-key column(s), a primary key over them, and a cascading foreign key (ON DELETE CASCADE) referencing the base table's primary key. Previously the variant table held only the variant-specific columns with no primary key and no link to its base. This changes the emitted contract.json / contract.d.ts and the contract's storageHash. Re-emit your contract, then plan and apply the matching migration. Variants that share the base table (no own @@map) are unaffected. See the 0.12→0.13 upgrade recipe. (#669)

    Before (emitted contract.json, variant table bug):

    "bug": {
  "columns": {
    "severity": { "codecId": "pg/text@1", "nullable": false }
  }
}

    After:

    "bug": {
  "columns": {
    "id": { "codecId": "sql/char@1", "nullable": false },
    "severity": { "codecId": "pg/text@1", "nullable": false }
  },
  "primaryKey": { "columns": ["id"] },
  "foreignKeys": [
    {
      "name": "bug_id_fkey",
      "columns": ["id"],
      "references": { "table": "task", "columns": ["id"] },
      "onDelete": "cascade"
    }
  ]
}

  • Contract storage IR moved to a namespace envelope — the SQL/Mongo storage IR is now keyed by namespace (storage.namespaces.<ns>.entries.<kind>), and cross-references are explicit { namespace, model } objects in domain. Consumer impact is mechanical: re-emit with prisma-next contract emit to pick up the new shape. No codemod or source change is required, but the contract's storageHash changes, so plan and apply a migration afterward. (#715)

  • Extension authors: codec-resolution SPI takes a leading namespaceId — CodecDescriptorRegistry.codecRefForColumn(table, column) is now codecRefForColumn(namespaceId, table, column), and the free codecRefForStorageColumn(storage, table, column) is now codecRefForStorageColumn(storage, namespaceId, table, column) (both in @prisma-next/sql-relational-core). Thread the namespace the table lives in through every call site that stamps codec onto AST nodes. There is no codemod — the right namespace is call-site-specific. See the 0.12→0.13 extension-author recipe. (#715)

    Before:

    const ref = descriptors.codecRefForColumn('document', 'embedding');

... (truncated)

Changelog

Sourced from @​prisma-next/sql-contract-ts's changelog.

v0.13.0

This release makes namespaces a first-class part of the query surface, adds cross-contract foreign keys to the SQL ORM, makes many-to-many a validatable contract shape, introduces a per-object control policy (@@control) that decides what Prisma manages, ships domain enums backed by storage value-sets, and gives the migration CLI a unified graph-tree view across list / log / status / show. Telemetry also flips from opt-in to opt-out. A few changes require a one-time contract re-emit — all are covered by the linked upgrade recipes.

Breaking changes

  • Telemetry is now opt-out — anonymous CLI telemetry is collected by default and you opt out, where previously you opted in. Set PRISMA_NEXT_DISABLE_TELEMETRY=1 (or DO_NOT_TRACK=1) to turn it off. See docs/Telemetry.md for what is collected and every opt-out signal. (#676)

  • MTI variant tables materialize a base-PK link column — a PSL @@base(Parent, "tag") variant that carries its own @@map (and is therefore stored in its own table) now emits a base-PK link column in storage: the variant table gains a copy of the base table's primary-key column(s), a primary key over them, and a cascading foreign key (ON DELETE CASCADE) referencing the base table's primary key. Previously the variant table held only the variant-specific columns with no primary key and no link to its base. This changes the emitted contract.json / contract.d.ts and the contract's storageHash. Re-emit your contract, then plan and apply the matching migration. Variants that share the base table (no own @@map) are unaffected. See the 0.12→0.13 upgrade recipe. (#669)

    Before (emitted contract.json, variant table bug):

    "bug": {
  "columns": {
    "severity": { "codecId": "pg/text@1", "nullable": false }
  }
}

    After:

    "bug": {
  "columns": {
    "id": { "codecId": "sql/char@1", "nullable": false },
    "severity": { "codecId": "pg/text@1", "nullable": false }
  },
  "primaryKey": { "columns": ["id"] },
  "foreignKeys": [
    {
      "name": "bug_id_fkey",
      "columns": ["id"],
      "references": { "table": "task", "columns": ["id"] },
      "onDelete": "cascade"
    }
  ]
}

  • Contract storage IR moved to a namespace envelope — the SQL/Mongo storage IR is now keyed by namespace (storage.namespaces.<ns>.entries.<kind>), and cross-references are explicit { namespace, model } objects in domain. Consumer impact is mechanical: re-emit with prisma-next contract emit to pick up the new shape. No codemod or source change is required, but the contract's storageHash changes, so plan and apply a migration afterward. (#715)

  • Extension authors: codec-resolution SPI takes a leading namespaceId — CodecDescriptorRegistry.codecRefForColumn(table, column) is now codecRefForColumn(namespaceId, table, column), and the free codecRefForStorageColumn(storage, table, column) is now codecRefForStorageColumn(storage, namespaceId, table, column) (both in @prisma-next/sql-relational-core). Thread the namespace the table lives in through every call site that stamps codec onto AST nodes. There is no codemod — the right namespace is call-site-specific. See the 0.12→0.13 extension-author recipe. (#715)

    Before:

    const ref = descriptors.codecRefForColumn('document', 'embedding');

... (truncated)

Commits

Updates @prisma-next/sql-schema-ir from 0.8.0 to 0.13.0

Release notes

Sourced from @​prisma-next/sql-schema-ir's releases.

v0.13.0

This release makes namespaces a first-class part of the query surface, adds cross-contract foreign keys to the SQL ORM, makes many-to-many a validatable contract shape, introduces a per-object control policy (@@control) that decides what Prisma manages, ships domain enums backed by storage value-sets, and gives the migration CLI a unified graph-tree view across list / log / status / show. Telemetry also flips from opt-in to opt-out. A few changes require a one-time contract re-emit — all are covered by the linked upgrade recipes.

Breaking changes

  • Telemetry is now opt-out — anonymous CLI telemetry is collected by default and you opt out, where previously you opted in. Set PRISMA_NEXT_DISABLE_TELEMETRY=1 (or DO_NOT_TRACK=1) to turn it off. See docs/Telemetry.md for what is collected and every opt-out signal. (#676)

  • MTI variant tables materialize a base-PK link column — a PSL @@base(Parent, "tag") variant that carries its own @@map (and is therefore stored in its own table) now emits a base-PK link column in storage: the variant table gains a copy of the base table's primary-key column(s), a primary key over them, and a cascading foreign key (ON DELETE CASCADE) referencing the base table's primary key. Previously the variant table held only the variant-specific columns with no primary key and no link to its base. This changes the emitted contract.json / contract.d.ts and the contract's storageHash. Re-emit your contract, then plan and apply the matching migration. Variants that share the base table (no own @@map) are unaffected. See the 0.12→0.13 upgrade recipe. (#669)

    Before (emitted contract.json, variant table bug):

    "bug": {
  "columns": {
    "severity": { "codecId": "pg/text@1", "nullable": false }
  }
}

    After:

    "bug": {
  "columns": {
    "id": { "codecId": "sql/char@1", "nullable": false },
    "severity": { "codecId": "pg/text@1", "nullable": false }
  },
  "primaryKey": { "columns": ["id"] },
  "foreignKeys": [
    {
      "name": "bug_id_fkey",
      "columns": ["id"],
      "references": { "table": "task", "columns": ["id"] },
      "onDelete": "cascade"
    }
  ]
}

  • Contract storage IR moved to a namespace envelope — the SQL/Mongo storage IR is now keyed by namespace (storage.namespaces.<ns>.entries.<kind>), and cross-references are explicit { namespace, model } objects in domain. Consumer impact is mechanical: re-emit with prisma-next contract emit to pick up the new shape. No codemod or source change is required, but the contract's storageHash changes, so plan and apply a migration afterward. (#715)

  • Extension authors: codec-resolution SPI takes a leading namespaceId — CodecDescriptorRegistry.codecRefForColumn(table, column) is now codecRefForColumn(namespaceId, table, column), and the free codecRefForStorageColumn(storage, table, column) is now codecRefForStorageColumn(storage, namespaceId, table, column) (both in @prisma-next/sql-relational-core). Thread the namespace the table lives in through every call site that stamps codec onto AST nodes. There is no codemod — the right namespace is call-site-specific. See the 0.12→0.13 extension-author recipe. (#715)

    Before:

    const ref = descriptors.codecRefForColumn('document', 'embedding');

... (truncated)

Changelog

Sourced from @​prisma-next/sql-schema-ir's changelog.

v0.13.0

This release makes namespaces a first-class part of the query surface, adds cross-contract foreign keys to the SQL ORM, makes many-to-many a validatable contract sha...

Description has been truncated

@dependabot
chore(deps-dev): bump the dev-dependencies group with 9 updates
a299c45 
Bumps the dev-dependencies group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.15` | `2.5.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.19.19` | `22.19.21` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.2.0` |
| [turbo](https://github.com/vercel/turborepo) | `2.9.14` | `2.9.18` |
| [@prisma-next/cli](https://github.com/prisma/prisma-next/tree/HEAD/packages/1-framework/3-tooling/cli) | `0.8.0` | `0.13.0` |
| [@prisma-next/psl-parser](https://github.com/prisma/prisma-next/tree/HEAD/packages/1-framework/2-authoring/psl-parser) | `0.8.0` | `0.13.0` |
| [@prisma-next/sql-contract-ts](https://github.com/prisma/prisma-next/tree/HEAD/packages/2-sql/2-authoring/contract-ts) | `0.8.0` | `0.13.0` |
| [@prisma-next/sql-schema-ir](https://github.com/prisma/prisma-next/tree/HEAD/packages/2-sql/1-core/schema-ir) | `0.8.0` | `0.13.0` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.105.4` | `2.108.1` |


Updates `@biomejs/biome` from 2.4.15 to 2.5.0
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.0/packages/@biomejs/biome)

Updates `@types/node` from 22.19.19 to 22.19.21
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.1...4.2.0)

Updates `turbo` from 2.9.14 to 2.9.18
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.9.14...v2.9.18)

Updates `@prisma-next/cli` from 0.8.0 to 0.13.0
- [Release notes](https://github.com/prisma/prisma-next/releases)
- [Changelog](https://github.com/prisma/prisma-next/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prisma/prisma-next/commits/v0.13.0/packages/1-framework/3-tooling/cli)

Updates `@prisma-next/psl-parser` from 0.8.0 to 0.13.0
- [Release notes](https://github.com/prisma/prisma-next/releases)
- [Changelog](https://github.com/prisma/prisma-next/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prisma/prisma-next/commits/v0.13.0/packages/1-framework/2-authoring/psl-parser)

Updates `@prisma-next/sql-contract-ts` from 0.8.0 to 0.13.0
- [Release notes](https://github.com/prisma/prisma-next/releases)
- [Changelog](https://github.com/prisma/prisma-next/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prisma/prisma-next/commits/v0.13.0/packages/2-sql/2-authoring/contract-ts)

Updates `@prisma-next/sql-schema-ir` from 0.8.0 to 0.13.0
- [Release notes](https://github.com/prisma/prisma-next/releases)
- [Changelog](https://github.com/prisma/prisma-next/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prisma/prisma-next/commits/v0.13.0/packages/2-sql/1-core/schema-ir)

Updates `@supabase/supabase-js` from 2.105.4 to 2.108.1
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.108.1/packages/core/supabase-js)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@types/node"
  dependency-version: 22.19.21
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: js-yaml
  dependency-version: 4.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: turbo
  dependency-version: 2.9.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@prisma-next/cli"
  dependency-version: 0.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@prisma-next/psl-parser"
  dependency-version: 0.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@prisma-next/sql-contract-ts"
  dependency-version: 0.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@prisma-next/sql-schema-ir"
  dependency-version: 0.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.108.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jun 21, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 21, 2026
@dependabot dependabot Bot requested a review from a team as a code owner June 21, 2026 22:07
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 21, 2026
@changeset-bot

changeset-bot Bot commented Jun 21, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: a299c45

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants