Bump valibot and prisma

[dependabot]

Bumps valibot to 1.4.2 and updates ancestor dependency prisma. These dependencies need to be updated together.

Updates valibot from 1.2.0 to 1.4.2

Release notes

Sourced from valibot's releases.

v1.4.2

Many thanks to @​Faze-up and @​chatman-media for contributing to this release.

• Fix word count actions to cache the Intl.Segmenter for non-primitive locales, preventing it from being recreated on every words, minWords, maxWords and notWords validation (pull request #1521)
• Fix flatten method to handle issue path keys that collide with Object.prototype members like toString instead of throwing a TypeError (pull request #1522)
• Fix intersect schema to merge object keys that collide with Object.prototype members like toString instead of failing to merge them (pull request #1522)

v1.4.1

• Fix intersect schema to infer correct input and output types for non-tuple array options instead of never (pull request #1478)

v1.4.0

Many thanks to @​ksaurav24, @​heiwen, @​compulim, @​ysknsid25, @​alaycock-stripe, @​IlyaSemenov, @​wszgrcy, @​LMGO, @​yslpn, @​EltonLobo07 and @​Eronmmer for contributing to this release.

Read the release notes on our website for a quick overview of the most exciting new features in this release.

• Add isoDateTimeSecond validation action to validate ISO date times with seconds (pull request #1418)
• Add toCamelCase, toKebabCase, toPascalCase and toSnakeCase transformation actions to convert strings between common naming conventions (pull request #1457)
• Change internal ReadonlyOutputKeys and OutputWithReadonly types of object schemas and WithReadonly type of record schemas to improve TypeScript type performance (pull request #1442)
• Change hot paths to reduce object allocations and improve runtime performance (pull request #1437)
• Change build target to ES2020 so distributed output stays compatible with environments that lack support for newer syntax (pull request #1455)
• Change internal _LruCache to use a TypeScript private method instead of a #private class field to avoid runtime helpers in the transpiled output (pull request #1455)
• Change internal _isValidObjectKey to use Object.prototype.hasOwnProperty.call instead of Object.hasOwn so the distributed output stays compatible with runtimes that lack the ES2022 Object.hasOwn builtin (pull request #1421)
• Change flatten method to accept readonly issue arrays (pull request #1269)
• Fix potential RangeError caused by spreading large issue arrays (pull request #1437)
• Fix creditCard validation action to reject Mastercard numbers with invalid lengths (pull request #1462)
• Fix intersect schema to no longer mutate input values, allowing frozen objects and arrays to be merged (pull request #1463)

v1.4.0 (to-json-schema)

Many thanks to @​stefanprobst, @​sruenwg and @​cruzdanilo for contributing to this release.

• Add support for examples action
• Add support for integer when used with minValue and maxValue actions (pull request #1367)
• Change Valibot peer dependency to v1.2.0
• Fix conversion of exactOptional object properties (pull request #1220)
• Fix conversion of variant to use oneOf instead of anyOf (pull request #1193)

v1.3.1

• Change MAC48_REGEX, MAC64_REGEX and MAC_REGEX to drop the i flag for better JSON Schema compatibility (pull request #1430)
• Change hash action to use case-expanded character classes instead of the i flag (pull request #1430)

v1.3.0

Many thanks to @​EskiMojo14, @​yslpn, @​alexilyaev, @​idleberg, @​BerkliumBirb and @​frenzzy for contributing to this release.

Read the release notes on our website for a quick overview of the most exciting new features in this release.

• Add guard transformation action to narrow types using type predicates (pull request #1204)
• Add parseBoolean transformation action to parse boolean values from strings and other types (pull request #1251)
• Add isrc validation action to validate ISRC codes (pull request #1373)
• Add cache method for caching schema output by input (pull request #1170)
• Add domain validation action to validate domain names (pull request #1284)

... (truncated)

Commits

• 0dc26ea Bump library version to 1.4.2
• 1bd01c3 fix: handle keys that collide with Object.prototype in flatten and merge (#1522)
• 752c636 docs: clarify string length semantics (#1505)
• a3beff9 fix: cache word-count segmenter for non-primitive locales (#1521)
• 1f9b183 Update FUNDING.yml in fabvor of Open Collective
• 2c63b2a Update logos of partners in README
• 09616b2 Add CodeRabbit as partner and remove Stainless
• 92bcf55 Add Cloudflare to privacy policy page
• 9bb6617 Add Cloudflare as a deploy target to our website (#1508)
• c05bf95 Bump to-json-schema version to 1.7.1
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for valibot since your current version.

Updates prisma from 7.8.0 to 7.9.1

Release notes

Sourced from prisma's releases.

7.9.1

Today, we're issuing a patch release to resolve a security advisory in a transitive dependency of Prisma CLI (via @prisma/dev).

This fixes prisma/prisma#29780.

It does not actually affect @prisma/dev or Prisma CLI so no urgent action is required, but it is recommended to upgrade nevertheless to avoid false positives from security scanners.

7.9.0

Today, we are excited to share the 7.9.0 stable release 🎉

🌟 Star this repo for notifications about new releases, bug fixes & features — or follow us on X!

Highlights

ORM

Tab completions for the Prisma CLI

Typing out CLI commands from memory is now optional. Prisma ships shell tab completions for bash, zsh, fish, and PowerShell, covering commands, subcommands, options, flags, and even option values.

Setting it up. Most projects run Prisma through a package manager, so completions are enabled through @bomb.sh/tab's package-manager integration — install it once, then source the completion for your package manager and shell:

# 1. Install @bomb.sh/tab globally
npm install -g @bomb.sh/tab
2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):
echo 'source <(tab pnpm zsh)'  >> ~/.zshrc            # zsh
echo 'source <(tab pnpm bash)' >> ~/.bashrc           # bash
tab pnpm fish > ~/.config/fish/completions/pnpm.fish  # fish
tab pnpm powershell > ~/.tab-pnpm.ps1                 # PowerShell (then dot-source it from $PROFILE)

@bomb.sh/tab delegates to any locally-installed CLI that ships completions, so pnpm prisma <TAB>, pnpm exec prisma <TAB>, yarn prisma <TAB>, and bun x prisma <TAB> all complete Prisma's commands, options, and values — no per-project setup. (npx and bunx don't support completion themselves; use npm exec and bun x.)

If instead you have Prisma installed globally on your PATH, source its own completion directly: source <(prisma complete zsh) (or the bash / fish / powershell variant).

This is built on @bomb.sh/tab, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from @​AmirSa12 (#28351) — thank you!

prisma.mp4

Prisma ORM, ready for AI agents

Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.

Agent skills installed with prisma init (#29689)

prisma init now installs the prisma/skills catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with --no-skills.

</tr></table> 

... (truncated)

Commits

• 3f492ab chore(deps): update @​prisma/dev to 0.24.17 (7.9.x backport) (#29795)
• 537583c feat(cli): add @bomb.sh/tab completions (#28351)
• bf7c40f fix(cli): update Studio to 0.33.0 and suppress aborted response errors (#29720)
• 9acd8dc feat(cli): install Prisma agent skills during prisma init (#29689)
• aef8cb5 fix(cli): remove the migrate-reset tool from the MCP server (#29691)
• cdca333 chore(deps): update @​prisma/dev to 0.24.14 (#29686)
• fda8fbc chore(deps): bump @​prisma/dev to 0.24.9 (resolves hono GHSA-92pp-h63x-v22m) (...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	prisma@​7.8.0 ⏵ 7.9.1				+2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm robust-predicates is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/prisma@7.9.1 → npm/robust-predicates@3.0.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/robust-predicates@3.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report