@prisma/adapter-d1

It also updates dependencies that had security advisories.

@prisma/adapter-mariadb now depends on mariadb 3.5.4, which fixes several security advisories in 3.5.3.

Dependencies with security advisories were updated: mysql2, fast-uri, deepmerge-ts, mariadb and source-map-js. (#30314, #30189, #30668)

If the old transaction had committed, the new one failed with P2028;

If the old transaction was still open, the new one silently ran as a savepoint inside another request's transaction.

Binds explicitly to 127.0.0.1 instead of all network interfaces.

Rejects browser requests from origins other than the active localhost or 127.0.0.1 Studio URL.

No longer returns wildcard CORS headers.

Applies the same protections across Node.js, Bun, and Deno.

Today, we're issuing a patch release to resolve a security advisory in a transitive dependency of Prisma CLI (via @prisma/dev).

Resolved the hono security advisories at their source: @prisma/dev was updated to a version that no longer depends on hono at all, so the CLI is no longer exposed to those advisories through that path. We also patched moderate-severity advisories in ajv and uuid across production dependencies (#29514).

Hardened the Prisma Platform credentials file (~/.config/prisma-platform/auth.json) and its directory to 0o600 / 0o700 so OAuth tokens are no longer world-readable, bringing Prisma in line with the GitHub, AWS, and Google Cloud CLIs (#29568, from Jaeyoung Yun).

Bumped the openssl crate in the schema engine binaries from 0.10.74 to 0.10.81 (prisma/prisma-engines#5815).

Broadened agent detection to cover today's landscape — Codex CLI (now on Linux as well as macOS), Qwen Code, GitHub Copilot CLI, OpenCode, Cline, Goose, Amp, Crush, Augment Code, Antigravity, Replit Agent, and Devin — plus generic AI_AGENT / AGENT conventions so future agents are caught without a code change.

Added a queryPlanCacheMaxSize option to the PrismaClient constructor for fine-grained control over the query plan cache. Pass 0 to disable the cache entirely, or omit it to use the default cache size. A larger value can improve performance in applications that execute many unique queries, while a smaller one can reduce memory usage.

Fixed an equality filter panic and incorrect ::jsonb cast when filtering on PostgreSQL JSON list columns. Queries using where: { jsonListField: { equals: [...] } } no longer panic with a type mismatch or emit invalid SQL. (prisma/prisma-engines#5804)

Fixed case-insensitive JSON field filtering (mode: insensitive), allowing where: { jsonField: { equals: "...", mode: "insensitive" } } to work correctly. (prisma/prisma-engines#5806)

Fixed incorrect parameterization of enum values that have a custom database name set via @map.

Init or scaffold — In an empty directory, offers a choice of 10 starter templates (Next.js, Express, Hono, Fastify, Nuxt, SvelteKit, Remix, React Router 7, Astro, NestJS) from prisma-examples. In an existing project without a schema, runs prisma init.

Link — Authenticates via the browser and connects to a Prisma Postgres database. Skips if already linked.

Install dependencies — Detects the package manager and offers to install missing @prisma/client, prisma, and dotenv.

Migrate — Runs prisma migrate dev if the schema contains models.

Generate — Runs prisma generate.

Seed — Runs prisma db seed if a seed script is configured.