@prisma/adapter-d1

It also updates dependencies that had security advisories.

@prisma/adapter-mariadb now depends on mariadb 3.5.4, which fixes several security advisories in 3.5.3.

Dependencies with security advisories were updated: mysql2, fast-uri, deepmerge-ts, mariadb and source-map-js. (#30314, #30189, #30668)

If the old transaction had committed, the new one failed with P2028;

If the old transaction was still open, the new one silently ran as a savepoint inside another request's transaction.

Binds explicitly to 127.0.0.1 instead of all network interfaces.

Rejects browser requests from origins other than the active localhost or 127.0.0.1 Studio URL.

No longer returns wildcard CORS headers.

Applies the same protections across Node.js, Bun, and Deno.

Today, we're issuing a patch release to resolve a security advisory in a transitive dependency of Prisma CLI (via @prisma/dev).

Resolved the hono security advisories at their source: @prisma/dev was updated to a version that no longer depends on hono at all, so the CLI is no longer exposed to those advisories through that path. We also patched moderate-severity advisories in ajv and uuid across production dependencies (#29514).

Hardened the Prisma Platform credentials file (~/.config/prisma-platform/auth.json) and its directory to 0o600 / 0o700 so OAuth tokens are no longer world-readable, bringing Prisma in line with the GitHub, AWS, and Google Cloud CLIs (#29568, from Jaeyoung Yun).

Bumped the openssl crate in the schema engine binaries from 0.10.74 to 0.10.81 (prisma/prisma-engines#5815).

Broadened agent detection to cover today's landscape — Codex CLI (now on Linux as well as macOS), Qwen Code, GitHub Copilot CLI, OpenCode, Cline, Goose, Amp, Crush, Augment Code, Antigravity, Replit Agent, and Devin — plus generic AI_AGENT / AGENT conventions so future agents are caught without a code change.

Added a queryPlanCacheMaxSize option to the PrismaClient constructor for fine-grained control over the query plan cache. Pass 0 to disable the cache entirely, or omit it to use the default cache size. A larger value can improve performance in applications that execute many unique queries, while a smaller one can reduce memory usage.

Fixed an equality filter panic and incorrect ::jsonb cast when filtering on PostgreSQL JSON list columns. Queries using where: { jsonListField: { equals: [...] } } no longer panic with a type mismatch or emit invalid SQL. (prisma/prisma-engines#5804)

Fixed case-insensitive JSON field filtering (mode: insensitive), allowing where: { jsonField: { equals: "...", mode: "insensitive" } } to work correctly. (prisma/prisma-engines#5806)

Fixed incorrect parameterization of enum values that have a custom database name set via @map.

Init or scaffold — In an empty directory, offers a choice of 10 starter templates (Next.js, Express, Hono, Fastify, Nuxt, SvelteKit, Remix, React Router 7, Astro, NestJS) from prisma-examples. In an existing project without a schema, runs prisma init.

Link — Authenticates via the browser and connects to a Prisma Postgres database. Skips if already linked.

Install dependencies — Detects the package manager and offers to install missing @prisma/client, prisma, and dotenv.

Migrate — Runs prisma migrate dev if the schema contains models.

Generate — Runs prisma generate.

Seed — Runs prisma db seed if a seed script is configured.

Added a prisma postgres link command that connects a local project to a Prisma Postgres database. This is the first command in a new prisma postgres command group for managing Prisma Postgres databases directly from the CLI.

@prisma/adapter-pg: Added a statementNameGenerator option that accepts a custom prepared statement name generator to allow users to leverage pg statement caching

@prisma/adapter-pg: Added support for usage of connection strings directly in the constructor for improved ergonomics

@prisma/adapter-mariadb: Added a useTextProtocol option in the constructor to toggle between text and binary protocols

Added support for nested transaction rollbacks via savepoints (#21678)

Made the adapter-mariadb use the binary MySQL protocol to fix an issue with lossy number conversions

Made @types/pg a direct dependency of adapter-pg for better TypeScript experience out-of-the-box

Resolved Prisma.DbNull serializing as empty object in some bundled environments like Next.js