Skip to content

Commit 085941f

Browse files
committed
fix(security): pin mysql2 to >=3.22.0 to resolve high-severity audit finding
prisma@7.10.0 pulls in mysql2@3.15.3 as an optional driver dependency (unused at runtime — this project only targets Postgres), which is flagged by `npm audit` for GHSA-3f6p-5ww8-9rcr (auth plugin downgrade leaking plaintext credentials). Add an npm override, following the existing pattern used for postcss/sharp/react in this file, to force mysql2 to a patched version. `npm audit --omit=dev --audit-level=high` now reports 0 vulnerabilities.
1 parent b18ae46 commit 085941f

2 files changed

Lines changed: 175 additions & 107 deletions

File tree

0 commit comments

Comments
 (0)