chore(deps): bump deepmerge-ts and mariadb past audited vulnerabilities

[tensordreams]

Summary

pnpm audit --prod (the "Run pnpm audit (production dependencies only)" step of the Lint job) fails on every PR to this branch with four advisories:

• deepmerge-ts < 8.0.0 — stack exhaustion on recursive object graphs (GHSA-ggr8-5vv4-36mx), high
• mariadb >= 3.4.0 < 3.4.6 — cleartext password leak to a MitM despite ssl: true (GHSA-cqhc-2h57-wpxf, high), cleartext transmission of sensitive information (GHSA-42r5-vhpq-m858, moderate), and possible SQL injection in Buffer parameter escaping under multibyte client charsets (GHSA-g5xc-5w98-jfvm, moderate)

This PR bumps:

• deepmerge-ts 7.1.5 → 8.0.2 in packages/config. The v8 breaking changes are Map deep-merging and a deepmergeInto mutation fix; @prisma/config uses neither — it only calls the basic deepmerge export on plain config objects (loadConfigFromFile.ts). v8 still ships dual CJS/ESM.
• mariadb 3.4.5 → 3.5.3 in packages/adapter-mariadb. The advisories say "patched >= 3.4.6", but npm has no 3.4.6 — the 3.4.x line ends at 3.4.5; 3.5.3 is the current release satisfying the range.

Lockfile updated with the repo-pinned pnpm 11.13.1.

Testing performed

• pnpm audit --prod against the updated lockfile: "No known vulnerabilities found".
• pnpm --filter @prisma/config test: 4 files, 142 passed, 2 skipped — includes the config-merge tests that exercise deepmerge.
• pnpm --filter @prisma/adapter-mariadb test: 45 passed.

Notes for the reviewer

• After this merges, the Lint job on this branch should go fully green again (its other failure mode, prettier-check, is unaffected here).
• Related branch-health PRs: ci: update github.repository checks for the rename to prisma/orm #30180 (rename guards), test(e2e): run prisma init from the local tarball in the corepack test #30183 (corepack e2e test).

Summary by CodeRabbit

• Chores
  • Updated the MariaDB integration dependency to a newer version.
  • Updated the configuration merge dependency to a newer version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: ASSERTIVE

Plan: Team

Run ID: c9a7ed49-c1dd-4047-88bf-1a03c4e546f4

📥 Commits

Reviewing files that changed from the base of the PR and between 9028ed8 and a69c38f.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• packages/adapter-mariadb/package.json
• packages/config/package.json

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

Two package manifests update the mariadb and deepmerge-ts dependency versions. No public declarations change.

Changes

Dependency updates

Layer / File(s)	Summary
Update package dependencies packages/adapter-mariadb/package.json, packages/config/package.json	Updates mariadb from 3.4.5 to 3.5.3 and deepmerge-ts from 7.1.5 to 8.0.2.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to a69c3

This PR updates two vulnerable dependencies and the lockfile without any supplied merge-blocking concerns; no actionable risk remains beyond normal checks and review.

Suggested reviewers: aqrln, stevenmcclankerton

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the dependency updates and their purpose: resolving audited vulnerabilities in deepmerge-ts and mariadb.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch v7-audit-deepmerge-mariadb

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

size-limit report 📦

Path	Size
packages/client/runtime/index-browser.js	2.29 KB (0%)
packages/client/runtime/index-browser.d.ts	3.37 KB (0%)
packages/cli/build/index.js	110 B (0%)
packages/client/prisma-client-0.0.0.tgz	25.59 MB (+0.01% 🔺)
packages/cli/prisma-0.0.0.tgz	13.52 MB (0%)
packages/bundle-size/da-workers-libsql/output.tgz	1.28 MB (0%)
packages/bundle-size/da-workers-neon/output.tgz	1.35 MB (0%)
packages/bundle-size/da-workers-pg/output.tgz	1.34 MB (0%)
packages/bundle-size/da-workers-planetscale/output.tgz	1.28 MB (0%)
packages/bundle-size/da-workers-d1/output.tgz	1.26 MB (0%)