@prisma/adapter-neon

7.10.1 · 15 Oct 2026Apache-2.0179.6k / weekRepository npm Atom feed

Latest releases

7.x · latest line
7.10.1
15 Oct 2026
- if the old transaction had committed, the new one failed with P2028;
- if the old transaction was still open, the new one silently ran as a savepoint inside another request's transaction.
Prisma ORM 7.10.1 is a patch release. It fixes a bug where a nested interactive transaction could make later, unrelated transactions run inside the wrong transaction. It also updates dependencies that had security advisories.
Fixes
Prisma Client: nested $transaction no longer changes the options object you pass in
If you passed the same options object to a nested tx.$transaction(...) and later to a top-level prisma.$transaction(...), the nested call wrote the outer transaction's id into that object. Every later top-level transaction that used the object was then treated as nested inside that old transaction:
if the old transaction had committed, the new one failed with P2028;
if the old transaction was still open, the new one silently ran as a savepoint inside another request's transaction.
const TX_OPTIONS = { timeout: 30_000, maxWait: 10_000 } await prisma.$transaction(async (tx) => { await tx.$transaction(async (inner) => { /* ... */ }, TX_OPTIONS) }) // Before 7.10.1, this call could fail with P2028 or join another transaction. await prisma.$transaction(async (tx) => { /* ... */ }, TX_OPTIONS)
Prisma Client no longer modifies the options object. (#30368, thanks @lazerg)
Prisma Migrate: refuse a shadow database that is the main database
Prisma Migrate now refuses to run with error P3025 when the shadow database URL points at the same database as the main database URL. Before, prisma migrate diff --from-migrations with that setup dropped the real schema, rebuilt it from the migrations, and reported an empty diff. (#5851)
MariaDB adapter: updated to mariadb 3.5.4
@prisma/adapter-mariadb now depends on mariadb 3.5.4, which fixes several security advisories in 3.5.3. The adapter no longer rewrites IPv6 hosts in connection strings, because mariadb 3.5.4 accepts them as written. IPv6 connection strings keep working without changes. (#30668)
Dependency updates
Dependencies with security advisories were updated: mysql2, fast-uri, deepmerge-ts, mariadb and source-map-js. (#30314, #30189, #30668)
7.10.0
25 Aug 2026
- security
  Binds explicitly to 127.0.0.1 instead of all network interfaces.
- security
  Rejects browser requests from origins other than the active localhost or 127.0.0.1 Studio URL.
- security
  No longer returns wildcard CORS headers.
Prisma ORM 7.10.0
Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.
Highlights
Run Prisma 7 alongside Prisma 8
This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.
Once 7.10.0 is released, a side-by-side installation can use:
npm install --save-dev prisma@8 @prisma/prisma7@7.10.0 npm install @prisma/client@7.10.0
Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:
npx prisma --version npx prisma7 --version npx prisma7 generate npx prisma7 migrate dev npx prisma7 db push
Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:
// prisma7.config.ts import { defineConfig } from '@prisma/prisma7/config' export default defineConfig({ schema: 'prisma/schema.prisma', migrations: { path: 'prisma/migrations', }, })
Without an explicit --config option, Prisma 7 searches for:
Root-level prisma7.config.* files.
.config/prisma7.* files.
Existing prisma.config.* files as a backwards-compatible fallback.
The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:
npx prisma7 generate --config ./custom/prisma7.config.ts
New projects initialized by the Prisma 7 CLI use prisma7.config.ts. Existing projects containing only prisma.config.* continue to work without migration or additional warnings. If a prisma7.config.* file exists but cannot be loaded, Prisma reports the error rather than silently falling back to another configuration.
The prisma7 identity is carried through CLI help, version output, shell completion, initialization, migration, database, and generation guidance. Stable Prisma concepts such as schema.prisma, Prisma Migrate, @prisma/client, and PRISMA_* environment variables remain unchanged.
Together, the separate executable and configuration namespace make it possible to operate Prisma 7 and Prisma 8 side by side without command or config-file collisions.
#29949, #29969, #29994, #30000, #30002, #30020
Prisma Studio security hardening
Prisma Studio's local HTTP server now:
security
Binds explicitly to 127.0.0.1 instead of all network interfaces.
security
Rejects browser requests from origins other than the active localhost or 127.0.0.1 Studio URL.
security
No longer returns wildcard CORS headers.
security
Applies the same protections across Node.js, Bun, and Deno.
This prevents network clients or malicious websites from accessing Studio's database endpoints while Studio is running.
#29890
Prisma Client
Fixed P2002 errors from nested writes so meta.modelName identifies the model where the unique constraint violation occurred, including models using @@map and @@schema. #29628
Fixed automatically batched findUniqueOrThrow() calls so every missing record rejects with P2025; later misses no longer resolve to undefined. #29654
Parameter-chunked statements are now executed atomically in a transaction and rolled back if a later chunk fails. #29771
Improved interactive transaction cleanup during $disconnect(), including transactions whose driver-level startup is still in progress. #28768
Prevented transaction cleanup failures after a timeout or backend termination from becoming unhandled promise rejections. #29611
Fixed fluent relation queries when relation fields are literally named select or include. #29683
Fixed handling of Date and Uint8Array values created in other JavaScript realms, such as iframes, jsdom, and Node.js vm contexts. #29177
Invalid Date values passed to $queryRaw or $executeRaw now throw PrismaClientValidationError instead of a generic error. #29718
Fixed moduleFormat inference for the prisma-client generator in TypeScript projects using module: "node16" or "nodenext". Generated output now follows the nearest package.json type, defaulting to CommonJS when absent. #29712
Deserialized Bytes values now own standalone ArrayBuffers rather than exposing unrelated contents from Node.js's shared Buffer pool. This applies to both regular and raw query results. #29701
Fixed an incorrect logging context in the remote executor, including Accelerate-backed query execution. #28892
Client extensions and observability
Result-extension compute callbacks now receive the current model name as a typed second argument:
compute(data, modelName) { // ... }
The model name is also preserved when multiple extensions compose the same computed field. #29782
Improved OpenTelemetry context for remotely executed queries:
$on('query') callbacks run within the matching db_query span.
Events from one operation share the same trace.
Error events are recorded as span exceptions.
Log events continue to be emitted when tracing is disabled or their reported span is unavailable.
#28892
Driver adapters
MariaDB
@prisma/adapter-mariadb now accepts an existing mariadb pool. External pools remain caller-owned unless disposeExternalPool: true is supplied. #27992
Fixed pooled connection leaks during commit, rollback, and failed transaction startup. Connections are now returned with release() and transaction-specific listeners are removed before reuse. #29612
Added support for bracketed IPv6 addresses in both mysql:// and mariadb:// connection strings. #29026
Prevented malformed connection strings from exposing embedded passwords in retained debug output and diagnostic reports. #27992
PostgreSQL, Neon, and Prisma Postgres Serverless
PostgreSQL deadlocks using SQLSTATE 40P01 are now reported as P2034 transaction write conflicts. #29717
PostgreSQL RESTRICT violations using SQLSTATE 23001 are now reported as P2003, preserving an available field or constraint name. #29554
@prisma/adapter-pg now preserves database constraint names when reporting unique constraint violations through P2002. #29587
Prisma Postgres Serverless now prefers the named constraint for P2002, falling back to parsed field names when no constraint name is available. #29801
Fixed Neon HTTP adapter serialization for typed parameters such as Bytes and DateTime. #29747
SQLite
@prisma/adapter-better-sqlite3 now converts previously unhandled SQLite result codes into typed database errors instead of exposing raw driver errors.
The complete SQLITE_BUSY family is now mapped to socket timeout errors, with numeric extended result codes preserved where available.
#29794
CLI and Migrate
prisma generate can now offer to install Prisma's agent skills. The opt-in prompt:
Is shown at most once per machine.
Is skipped in CI, containers, Git hooks, npm lifecycle scripts, and watch mode.
Is skipped when --no-hints is used or Prisma skills are already installed.
Times out after 30 seconds.
Never causes generation to fail if installation is unsuccessful.
#29690
A globally installed CLI now warns during prisma generate when its version differs from the project's local prisma or @prisma/client, and recommends running the local CLI. The check is best-effort and does not fail generation. #29593
prisma version and prisma version --json now include the resolved Prisma CLI package path, making global-versus-local installation issues easier to diagnose. #29573
Empty or generator-only schema files now report Schema must contain a datasource block from db pull, db push, and migrate dev, rather than reaching the schema engine and potentially producing inconsistent errors. #29657
CLI commands now tolerate corrupt, unreadable, or unwritable command-state files. Invalid state is reinitialized, writes are atomic, and persistence failures fall back to in-memory state. #29609
Studio now recognizes semicolon-delimited sqlserver:// connection strings before reporting the existing explicit message that SQL Server is not supported by Studio. #29623
The AI-agent safety checkpoint now also covers interactive prisma db push confirmations involving data-loss warnings, rather than only invocations using --accept-data-loss. #29793
Performance and reliability
Optimized query-plan execution by eagerly evaluating plans with one unconditional database operation and synchronously interpreting the remaining pure plan. Cached plans remain immutable. #29004
Prevented call-stack overflows when rendering very large parameter lists or combining chunked results containing hundreds of thousands of rows. #29751
Reduced ordinary query setup overhead by constructing fluent-relation field maps lazily and in linear time. Non-fluent queries no longer build this map. #29752
7.9.1
27 Jul 2026
Today, we're issuing a patch release to resolve a security advisory in a transitive dependency of Prisma CLI (via @prisma/dev).
7.9.0
20 Jul 2026
7.8.0
22 Apr 2026

Notes older than 90 days are read on the Releases tab.

Dependency tracking · free for 3 projects

Know when your own dependencies move

@prisma/adapter-neon shipped a new major in the last 12 months, among 20 releases. Inlinr shows which of your projects are behind, and what the upgrade breaks.

Advisories reach you
An email when a critical or high advisory affects a project, before the next install.
Upgrades checked first
Peer ranges, Node, ESM-only and types changes read before you bump.
Only what matters
Majors and breaking notes stay; patches and sibling bumps fold into one line.

How dependency tracking works

Registry facts last checked 22 Oct 2026. Releases and advisories last read 22 Oct 2026.

Latest releases

7.10.1

7.10.0

7.9.1

7.9.0

7.8.0

Know when your own dependencies move