Skip to content

Commit 95c0d71

Browse files
committed
fix(security): pin mysql2 to >=3.22.0 to resolve high-severity audit finding
prisma@7.10.0 pulls in mysql2@3.15.3 as an optional driver dependency (unused at runtime — this project only targets Postgres), which is flagged by `npm audit` for GHSA-3f6p-5ww8-9rcr (auth plugin downgrade leaking plaintext credentials). Add an npm override, following the existing pattern used for postcss/sharp/react in this file, to force mysql2 to a patched version. `npm audit --omit=dev --audit-level=high` now reports 0 vulnerabilities.
1 parent 2f6d9a0 commit 95c0d71

2 files changed

Lines changed: 175 additions & 107 deletions

File tree

0 commit comments

Comments
 (0)