Commit 085941f
committed
fix(security): pin mysql2 to >=3.22.0 to resolve high-severity audit finding
prisma@7.10.0 pulls in mysql2@3.15.3 as an optional driver dependency
(unused at runtime — this project only targets Postgres), which is
flagged by `npm audit` for GHSA-3f6p-5ww8-9rcr (auth plugin downgrade
leaking plaintext credentials). Add an npm override, following the
existing pattern used for postcss/sharp/react in this file, to force
mysql2 to a patched version.
`npm audit --omit=dev --audit-level=high` now reports 0 vulnerabilities.1 parent b18ae46 commit 085941f
2 files changed
Lines changed: 175 additions & 107 deletions
0 commit comments