chore(deps): bump @prisma/instrumentation from 6.6.0 to 6.17.1

[dependabot]

Bumps @prisma/instrumentation from 6.6.0 to 6.17.1.

Release notes

Sourced from @​prisma/instrumentation's releases.

6.17.1

Today, we are issuing a patch release to address a regression in v6.17.0 that affected diffing of unsupported types, leading to unnecessary or incorrect changes when creating new migrations or running db pull. This update is recommended for all users who have any fields marked as Unsupported in their schema files.

Changes

• prisma/prisma-engines#5633

6.17.0

Today, we are excited to share the 6.17.0 stable release 🎉

🌟 Star this repo for notifications about new releases, bug fixes & features — or follow us on X!

Prisma ORM

Prisma ORM is the most popular ORM in the TypeScript ecosystem. Today's release brings a number of bug fixes and improvements to Prisma ORM.

Bug fixes and improvements

• Added support for Entra ID (ActiveDirectory) authentication parameters for the MS SQL Server driver adapter. For example, you can use the config object to configure DefaultAzureCredential:

  import { PrismaMssql } from '@prisma/adapter-mssql'
  import { PrismaClient } from '@prisma/client'
  const config = {
  server: 'localhost',
  port: 1433,
  database: 'mydb',
  authentication: {
  type: 'azure-active-directory-default',
  },
  options: {
  encrypt: true,
  },
  }
  const adapter = new PrismaMssql(config)
  const prisma = new PrismaClient({ adapter })

  
  Learn more in this PR.
• Relaxed the support package range for @opentelemetry/instrumentation to be compatible with ">=0.52.0 <1". Learn more in this PR.
• Added Codex CLI detection, ensuring dangerous Prisma operations are not executed by Codex without explicit user consent. Learn more in this PR.
• Fixed JSON column handling when using a MariaDB database. Learn more in this PR.
• Restored the original behaviour of group-by aggregations where they would refer to columns with explicit table names which fixes a regression that would result in ambiguous column errors. Learn more in this PR.

Prisma Postgres

Prisma Postgres is our fully managed Postgres service designed with the same philosophy of great DX that has guided Prisma for close to a decade. With this release we are introducing the following improvements:

New usage workspace metrics available in your Console Dashboard

The Dashboard in your Prisma Console account now displays new metrics about your Prisma Postgres usage:

... (truncated)

Commits

• 6169c92 chore(instrumentation): relax opentelemetry version range (#28199)
• 61a87a1 chore(deps): changed @​opentelemetry/instrumentation version (#27805)
• 3409815 chore: convert small packages to vitest (#28009)
• dd823f6 feat(client): drop deprecated middleware feature (#27799)
• 04ebf92 fix(instrumentation): emit missing dist/index.d.ts (#26986)
• 9a93b2b build(instrumentation): Emit ESM (#26918)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
app	Error			Oct 13, 2025 10:02pm

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
portal	Skipped			Oct 13, 2025 10:02pm

[comp-ai-code-review]

🔒 Comp AI - Security Review

🟢 Risk Level: LOW

OSV/npm scan and package.json review found no known vulnerabilities or issues in the changed files.

---

📦 Dependency Vulnerabilities

✅ No known vulnerabilities detected in dependencies.

---

🛡️ Code Security Analysis

✅ No security issues detected in code changes.

---

💡 Recommendations

View 3 recommendation(s)

1. Inspect apps/app/package.json for hardcoded credentials or tokens in fields (scripts, config, publishConfig, or custom fields) and remove/move them to environment-configured values.
2. If any npm scripts in package.json build shell commands from runtime input, avoid interpolating untrusted input into shell commands; validate/escape inputs or implement the logic in a Node script instead.
3. If package.json defines install/postinstall scripts, ensure they do not download or execute remote content based on untrusted data (avoid executing fetched code or commands constructed from external inputs).

---

Powered by Comp AI - AI that handles compliance for you. Reviewed Oct 13, 2025