Merge main into prisma-8 by borisno2 · Pull Request #1416 · OpenSaasAU/stack

borisno2 · 2026-09-11T06:49:59Z

Merges main into prisma-8 so the release pull request can follow. Targets prisma-8, not main.

`prisma-8` is an orphan branch

git merge-base origin/main origin/prisma-8 returns nothing — prisma-8's root commit 4e7bd4b3 has no parent. A plain git merge would have refused, and --allow-unrelated-histories would have treated every file prisma-8 deleted as an add.

The content fork point is 93a3736b (spec(prisma-8): the architecture spec handed off from the Wayfinder map (#1119)) — exactly 28 main commits back, matching the brief, and the candidate with the smallest diff to prisma-8's root tree (69 files vs 73 for the next candidate). The merge was therefore computed explicitly against that base with git merge-recursive 93a3736b -- HEAD origin/main, then committed with both real parents.

A side effect worth noting: prisma-8 now contains main's history, so the follow-up prisma-8 → main release PR is an ordinary merge rather than a second unrelated-histories problem.

The real overlap

84 files changed on main since the fork, 855 on prisma-8; 55 overlap. 27 conflicted. The rest auto-merged — and four of those auto-merges were wrong, which is where the damage was.

The access-control judgement (#1385)

Property: a non-sudo caller must not reach rows outside the parent's subtree through a nested relationship write, and must not name a target row it cannot read.

main closed this by gating: refuse nested set/updateMany/deleteMany for non-sudo callers (NestedRelationInputError), and gate disconnect's target-row form behind the target list's operation.query access. sudo() was exempt from all of it.

prisma-8 closed it by deletion: ADR-0050 removes nested relation input from the write payload entirely. packages/core/src/context/relationship-input.ts refuses create, update, delete, connectOrCreate, disconnect, set, updateMany and deleteMany — eight kinds against main's three — and refuseNestedRelationInput has no sudo branch at all.

Verdict: the property survives, strictly stronger. prisma-8 refuses a superset of main's kinds and refuses them unconditionally. main's own commit anticipated this in its docblock, calling its fix "an interim fail-closed fix mirroring ADR-0050's own refusal shape" for work "that major deletes wholesale".

main's disconnect gate is moot, not dropped. disconnect does not exist here; the replacement is assigning null to the relationship field, which lowerRelationInput lowers to a foreign-key column on the row being written. No target row is named, so there is no target-list read to gate — the unlinking carries the enclosing write's own operation and field-level access. The reachability query main's gate reused survives as reachable() and is extended on this line to the direct foreign-key spelling (authorId), closing the probing oracle #1331 that main does not have.

Verified by running, not by reading. In the merged tree secured-write.test.ts drives all eight kinds end-to-end through context.db.Post.create — "nested <kind> is refused, and nothing is written" — and "a sudo payload naming a synthetic back-relation is refused too" pins the sudo half. relationship-input.test.ts, related-actions.test.ts and relation-connect.test.ts pass alongside them (core: 87 files, 1623 tests).

Two structural facts back the "unconditional" claim: refuseNestedRelationInput has no _isSudo branch, and write-pipeline.ts calls it at :182 (the caller's inputData) and :339 (the post-hook resolvedData), neither guarded — so a resolveInput hook that assembles nested relation input is refused too, which main's dispatch-time check did not cover.

packages/core/src/index.test.ts and packages/cli/src/generator/types.test.ts carry negative assertions that the deleted fragment/CustomDB names cannot quietly return; both pass, which is independent evidence the merge did not resurrect the old surface.

main's nested-operations.ts is deleted. Its re-export of NestedRelationInputError from packages/core/src/index.ts had auto-merged into a duplicate export of a deleted module, alongside prisma-8's own export of the same name from relationship-input.ts; the dead one is removed.

The second contested change: the hook context (#1176 / #1179)

The two branches made directly contradictory decisions here, independently.

main's ADR-0066: a hook's context is the full StackContext — sudo(), withSession(), transaction(), serverAction — bound to the write's own transaction.
prisma-8's ADR-0052: StackBaseContext ("nothing that can start a transaction or change who is asking") is what a hook sees; StackContext is for server actions and page components. This is emitted per app by the generator as BaseContext vs Context, baked into the contract and into all twelve converted examples.

Resolved in favour of prisma-8. Reverting the split to satisfy main would be a rewrite of the prisma-8 spec, not a merge resolution. This is a capability reduction, never a security regression — a narrower hook context grants strictly less.

Because this was a deliberate drop rather than a silent one, three documents that asserted main's behaviour and auto-merged into this tree were corrected rather than left to rot:

docs/adr/0066-… is marked superseded by ADR-0050 and ADR-0052, stating what survives (the transaction binding, ADR-0010/0028/0023) and what is withdrawn.
packages/core/CLAUDE.md's "hooks: no transaction-bound elevated context from beforeOperation/afterOperation (hook context has no sudo(); getContext().sudo() opens a separate connection) #1176" section is rewritten to the merged behaviour.
ADR-0052's own #1211 amendment (which auto-merged from main) claimed a hook's context "is the same StackContext<DB, S, PluginServices> the generated Context instantiates". Its keying point is true and satisfied here; the claim about what it carries was false and is corrected.

main's _resolveOutputChain threading through sudo()/withSession() is moot by construction, not dropped: the only contexts exposing those operations are request contexts, whose chain is empty; the contexts carrying a non-empty chain (hook contexts) do not expose them.

The third: `_count` field-level read access (#1120 / #1111)

main added a fieldAccess parameter to resolveCountAccessEntryForList, gating a _count on the counting list's own field-level read access. prisma-8's copy had no such parameter.

Investigated every path by which a relationship count reaches a non-sudo caller here. The property holds, by a different mechanism: secured/include.ts:498-510 omits a denied relation pre-query (return null at :559, so the count is never asked of the database), and for a row-dependent rule field-visibility.ts:353-362 drops the key post-query, with restoreReductions (secured/read.ts:965-968) writing the count back only under keys Field Visibility kept. main's gated function is dead code here — its only caller, buildAccessScopedCountSelect, is unreachable from context.db, which has no findMany and no caller-supplied _count.

Rather than rely on unreachability, main's gate is ported onto prisma-8's function (1ead103) so a future caller cannot reopen #1111 by omitting it, and main's test of it passes.

Four auto-merges that were silently wrong

None of these conflicted. All four compiled or tested green somewhere else.

packages/cli/src/generator/lists.ts — main's Hook args are not generic over the Prisma client, so a hook's context is untypeable in a consumer — AccessControlledDB<any> is assignable to nothing #1211 added prisma: import('./prisma-client/client.ts').PrismaClient and db: import('./types.ts').CustomDB to every list's TypeInfo. Neither module exists on this line. This would have written a bundle that does not type-check into every one of the twelve examples — a generation break the package suites do not see. Reverted.
packages/core/src/index.ts — duplicate NestedRelationInputError export of a deleted module (above).
hook-pipeline.ts / hooks/index.ts — imported StackContext from context/index.js, which does not export it here.
access-filter.ts — called resolveCountAccessEntryForList with main's third argument against a two-parameter signature.

Five main-only CLI test files covering the surface ADR-0052 replaced (#1233, #1287, #1328, #1232) are removed; their subjects are carried by prisma-8's contract-keyed suites.

Other overlapping files

Area	`main` asserted	`prisma-8` asserted	Merged
`access/types.ts`	`Augmented*` trailing overloads (#1287/#1328), `AccessContext<TPrisma, TDb>`	`SecuredQuery`, `OrmClient`, contract-keyed generics	`prisma-8` — surface deleted; `TDb` subsumed by the first-class `DB` parameter
`config/types.ts`	`TypeInfo.prisma` / `.db`	`TypeInfo.output` / `.needs`	`prisma-8`; #1232's property holds structurally (`StackBaseContext<DB,…>`)
`internal.ts`	exports `Fragment`/`FieldSelection`/`ResultOf`	`query/index.js` deleted	`prisma-8`
`cli/generator/{context,types}.ts`, snapshots	Prisma 7 bundle, `CustomDB`, `prisma-client/client.ts`	contract-based bundle	`prisma-8`
`docs/{hooks,context-api,migrate-from-keystone}.md`	old surface	rewritten	`prisma-8`
`docs/concepts/access-control.md`	documented `disconnect` as gated and `sudo` as exempt	eight kinds refused unconditionally	rewritten — `main`'s section auto-merged and was false here (`err.listKey` vs `listName`, `context.db.post` casing, a sudo exemption that does not exist)
9 changesets	consumed by `main`'s Version Packages	present	consumed; content verified present in the CHANGELOGs at 0.42.3

Changes from `main` that this line makes meaningless — stated, not dropped

The disconnect gate (fix(core): refuse unchecked nested set/updateMany/deleteMany, gate disconnect #1385) — the construct it guarded does not exist.
_resolveOutputChain threading through sudo()/withSession() (hooks: no transaction-bound elevated context from beforeOperation/afterOperation (hook context has no sudo(); getContext().sudo() opens a separate connection) #1176) — unreachable from a hook.
pg / @types/pg bump (chore(deps): bump pg and @types/pg #1380) — reverted. @prisma/orm-postgres@8.0.0-rc.8 pins pg: "8.22.0" and @types/pg: "8.20.4" exactly; carrying the bump put two incompatible @types/pg copies in the type graph and broke packages/core/src/testing/context.ts.

Dependency bumps that do apply are carried: @typescript-eslint/parser 8.69.0, globals 17.12.0, @types/react ^19.2.18, and the vitest family aligned on 4.1.11 (main's #1185 bumped @vitest/browser alone, leaving an unmet peer).

ADR-0066 collision

Both branches claimed 0066. main's is the published number and keeps it. prisma-8's 0066-a-plugins-write-of-its-own-column-runs-no-hook.md → 0068, with all 18 references updated across CLAUDE.md, CONTEXT.md, packages/core/{CLAUDE.md,src/extend.ts,src/config/types.ts,src/access/multi-column-read-write.test.ts}, packages/rag/{CLAUDE.md,src/config/plugin.ts,plugin.test.ts,embedding-write.test.ts}, docs/content/how-to/rag-advanced.md and two changesets. One of those 18 was missed on the first pass and caught in review: examples/rag-ollama-demo/README.md still read (ADR-0066) on a sentence about writePluginOwnedField running no hook — a reference that resolved to a real but unrelated record, which is why neither check:adr-duplicates nor the link check flagged it. It now reads ADR-0068. No reference is left at 0066. An earlier revision of this description claimed two were deliberately left there; that was wrong. The two documents that assert main's decision — ADR-0052's #1211 amendment and packages/core/CLAUDE.md's "#1176" section — were rewritten in prose to the merged behaviour and cite no ADR number at all, so there was nothing to leave. grep -rn 'ADR-0066' over the tree now returns nothing. pnpm check:adr-duplicates → 68 numbers checked, no duplicates.

Verified by running

Gate	Result
`pnpm build`	11/11 tasks
Package suites	core 87 files / 1623 tests; cli 43/414; auth 23/505; ui 62/671; all others green
Twelve examples regenerate	no drift (`git diff --exit-code` over the 13 CI paths → 0)
Drift gate still bites	mutated `examples/starter/prisma/contract.ts` → exit 1; restored → exit 0
Examples type-check and build	21/21 tasks
`examples/blog` access-control suite	28 checks passed (real database)
`examples/mcp-demo` suite	10 checks passed (real database)
`check:doc-ts-blocks`	exit 0 — 126 blocks, 89 compile
`check:doc-ts-blocks --self-test`	55 blocks, 0 mismatches
`check:client-side-effect-imports`	exit 0
`check:prisma-error-codes`	exit 0 — 1482 files, 26 literals across 7 allowlisted files
`check:adr-duplicates`	exit 0
`pnpm --filter opensaas-stack-docs link-check`	10 paths, 32 redirects, 34 pages valid
docs build	passes
`pnpm lint`	0 errors (1 pre-existing warning in `migration-generator.ts`, untouched by this merge)
`pnpm format:check`	clean
`pnpm manypkg check`	workspaces valid
Changesets	109 `minor`, 17 `patch`, 0 `major`

No documentation-checker excuse was added, widened or removed — git diff origin/prisma-8 -- scripts/ .github/ is empty, and neither branch touched those paths since the fork.

Flakes observed, neither mine

packages/core/src/db/dev-database.test.ts > two instances in one process take distinct ports fails under parallel turbo, passes standalone. packages/core/src/db/ is byte-identical to origin/prisma-8 — port contention, not this merge.
packages/ui browser-mode suite failed once under turbo with Failed to search relationship options: network error, passed on retry and standalone (62/671).

Not verified

The two database-backed example suites were run against a local Postgres rather than CI's service container, and mcp-demo needed BETTER_AUTH_URL supplied by hand (CI sets it).
pnpm test:e2e (Playwright) was not run.

🤖 Generated with Claude Code

…nship (#1120) A relationship hidden via `access: { read: () => false }` still leaked its true count through both the admin list view's _count path and a caller- supplied `_count.select` — neither ever checked the counting list's own field-level read access, only the related list's operation-level query access. resolveCountAccessEntryForList now takes the counting field's own FieldAccess and denies the count when field-level read access denies it, mirroring the check filterReadableFields already runs for an ordinary include of the same field. A synthetic back-relation has no field of its own and stays exempt. Closes #1111 Claude-Session: https://claude.ai/code/session_01BycBeXShej1q9zyF5EiuhT Co-authored-by: Claude <noreply@anthropic.com>

Bumps [@vercel/blob](https://github.com/vercel/storage/tree/HEAD/packages/blob) from 2.6.1 to 2.8.0. - [Release notes](https://github.com/vercel/storage/releases) - [Changelog](https://github.com/vercel/storage/blob/main/packages/blob/CHANGELOG.md) - [Commits](https://github.com/vercel/storage/commits/@vercel/blob@2.8.0/packages/blob) --- updated-dependencies: - dependency-name: "@vercel/blob" dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…tion's (#1179)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

) The Hook arguments section keyed `item`, `resolvedData` and `needs` but left `context` unparameterised, so the Prisma 8 keying would have re-landed the gap #1211 reports on main: a hook's context resolves over `PrismaClientLike = any`, `AccessControlledDB<any>` is assignable to nothing, and a typo'd delegate type-checks. Records that TypeInfo carries the app's DB and core's hook types read `context` off it, and that main's pre-contract fix establishes the same seam rather than a second mechanism. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

#1214) TypeInfo gains a `prisma` member (defaulted to PrismaClientLike, fully additive) and every list/field hook-args type now types `context` as StackContext<TTypeInfo['prisma']> / AccessContext<TTypeInfo['prisma']> instead of the unparameterised default. Previously context.db resolved through AccessControlledDB<any> - a mapped type over keyof any that contributes no named property - so a hook's context was assignable to nothing app-specific and consumers needed `context as unknown as Context` to use it anywhere typed. The CLI generator emits the new `prisma` member on each list's Lists.<List>.TypeInfo, pointing at the project's own generated PrismaClient, so no config changes are required downstream. Adds a dedicated compile-time regression test (against core's real built types, not a stub) proving context.db is now assignable to the generated CustomDB with no cast and resolves real per-list row types, and extends the #952 large-schema fixture to also generate the Lists namespace and exercise list-level/field-level hooks reading context.db without reintroducing TS2589. Closes #1211 Claude-Session: https://claude.ai/code/session_01UUfo5pf9kkNAYQ54X9EEhp Co-authored-by: Claude <noreply@anthropic.com>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

#1264) context.db.<list>.findUnique/findFirst/findMany (and singleton get) only had the generic *Args-based overload, so passing a query fragment still compiled but the return type stayed the unnarrowed {List}GetPayload<T> instead of ResultOf<fragment> — an unselected field was silently readable with no compile error. These methods now carry the same fragment overload core's AccessControlledDB exposes (AugmentedFindUnique/First/Many), hand- written to match rather than wrapped through core's generics, which reintroduced #952's TS2589-style depth blowup on schemas with cross- referencing GetPayload chains. Full bidirectional assignability between AccessControlledDB and CustomDB (and dropping the `as unknown as` cast in the generated context factory) remains blocked by two narrower, separately-tracked gaps: virtual-field folding (#1232) and singleton get() having no AccessControlledDB counterpart — documented at the cast site. Claude-Session: https://claude.ai/code/session_01KzSpQGvfQCzFrvBJ2cRZAL Co-authored-by: Claude <noreply@anthropic.com>

…1269)

#1277) BaseContext/Context previously re-declared StackContext's extra members (serverAction, sudo, withSession) by hand, and the list was missing `transaction` — so `context.transaction(...)` failed to typecheck even though it works at runtime. BaseContext now omits db/session/serverAction/ transaction/sudo/withSession from StackContext instead of AccessContext, so any future StackContext member reaches the generated Context automatically; the four self-referential members are re-declared on Context to resolve to the generated type. Closes #1261 Claude-Session: https://claude.ai/code/session_01V5k8pivgut8oLJGe8jz5sU Co-authored-by: Claude <noreply@anthropic.com>

Bumps [sharp](https://github.com/lovell/sharp) from 0.35.3 to 0.35.4. - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.3...v0.35.4) --- updated-dependencies: - dependency-name: sharp dependency-version: 0.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…#1275) Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 8.63.0 to 8.69.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.69.0/packages/parser) --- updated-dependencies: - dependency-name: "@typescript-eslint/parser" dependency-version: 8.69.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [tailwind-merge](https://github.com/dcastil/tailwind-merge) from 3.5.0 to 3.6.0. - [Release notes](https://github.com/dcastil/tailwind-merge/releases) - [Commits](dcastil/tailwind-merge@v3.5.0...v3.6.0) --- updated-dependencies: - dependency-name: tailwind-merge dependency-version: 3.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [globals](https://github.com/sindresorhus/globals) from 17.8.0 to 17.12.0. - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.8.0...v17.12.0) --- updated-dependencies: - dependency-name: globals dependency-version: 17.12.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…1287) (#1289) * Fix #1287: generated Crud read methods not assignable to structural seams 0.42.1's fragment overload on findUnique/findFirst/findMany (and singleton get) left a two-member overload set (fragment, then the generic SelectSubset-based member) that TypeScript won't structurally match against a plain seam once SelectSubset carries Prisma's real conditional- intersection shape, and broke Parameters<> (resolves against the last overload, collapsing an unresolved generic T to never). Adds a third, trailing, non-generic overload member over the plain {List}FindXArgs to each method. Verified empirically that its position among the three doesn't affect assignability, and that ordinary calls (bare, or with select/include) still resolve through the generic member first, keeping its T-narrowed return. Closes #1287 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Gxv5F6T184gXxqWd7c8mqf * Restrict the trailing overload member so it can't bypass select+include exclusivity Code review on #1289 caught a regression the first commit introduced: giving the trailing member the full {List}FindXArgs (select/include both present as independently-optional keys) let overload resolution fall through to it for a `{ select, include }` call the generic member's SelectSubset guard correctly rejects — silently accepting a combination Prisma itself forbids. Restrict the trailing member's parameter type to omit select/include/query entirely (Pick<..., 'where'> for findUnique, Omit<..., 'select' | 'include' | 'query'> elsewhere). A literal call naming those keys no longer structurally matches this member at all, so it stays reachable only by the seam-assignability and Parameters<> checks it exists for, never by a real call. Verified empirically that the exclusivity guard, seam assignability, and Parameters<> resolution all hold together. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Gxv5F6T184gXxqWd7c8mqf --------- Co-authored-by: Claude <noreply@anthropic.com>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

… getContext (#1337) * Add trailing overload to core's AugmentedFind* and thread TDb through getContext Core's AugmentedFindUnique/AugmentedFindFirst/AugmentedFindMany now carry the same trailing non-generic overload the generated CustomDB emits (#1287), and getContext gains a third, unconstrained, defaulted TDb type parameter so a caller can ask for StackContext<TPrisma, CustomDB> directly instead of erasing the type with `as unknown as`. The generated context.ts factory uses this to drop to a single, honest `as Context<TSession>` cast. Closes #1328 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0167m3BzYP3jiUABj89QWeoF * Note the Parameters<> resolution change from the trailing overload in the changeset Per review feedback on PR #1337 from the issue author, who verified the fix against a real downstream call site and confirmed TDb is the load-bearing half; documents the trailing overload's effect on Parameters<> as an observable (intentional) side effect. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0167m3BzYP3jiUABj89QWeoF --------- Co-authored-by: Claude <noreply@anthropic.com>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Bumps [@radix-ui/react-popover](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/popover) from 1.1.20 to 1.1.23. - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/popover/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/popover) --- updated-dependencies: - dependency-name: "@radix-ui/react-popover" dependency-version: 1.1.23 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the aws-sdk group with 2 updates: [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) and [@aws-sdk/s3-request-presigner](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages/s3-request-presigner). Updates `@aws-sdk/client-s3` from 3.1121.0 to 3.1127.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1127.0/clients/client-s3) Updates `@aws-sdk/s3-request-presigner` from 3.1126.0 to 3.1127.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages/s3-request-presigner/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1127.0/packages/s3-request-presigner) --- updated-dependencies: - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1127.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: aws-sdk - dependency-name: "@aws-sdk/s3-request-presigner" dependency-version: 3.1127.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: aws-sdk ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [@radix-ui/react-select](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/select) from 2.3.4 to 2.3.7. - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/select/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/select) --- updated-dependencies: - dependency-name: "@radix-ui/react-select" dependency-version: 2.3.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) and [@types/pg](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pg). These dependencies needed to be updated together. Updates `pg` from 8.22.0 to 8.23.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg) Updates `@types/pg` from 8.20.0 to 8.23.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pg) --- updated-dependencies: - dependency-name: pg dependency-version: 8.23.0 dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: "@types/pg" dependency-version: 8.23.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…sconnect (#1385) Nested set/updateMany/deleteMany were a pass-through straight to Prisma with no target-list access check and no hooks. Non-sudo contexts now get a NestedRelationInputError instead; sudo is unaffected. Nested disconnect's target-row form ({ disconnect: { id } }) now requires the target list's operation.query access, reusing the connect reachability check; the to-one boolean form ({ disconnect: true }) is unchanged. Closes #1384 Claude-Session: https://claude.ai/code/session_01HHpw6shZoER4AjaaYg6QC9 Co-authored-by: Claude <noreply@anthropic.com>

prisma-8 is an orphan branch: it shares no git merge-base with main. The content fork point is 93a3736 (#1119), 28 main commits back, so this is a three-way merge computed against that base rather than a merge of unrelated histories. Resolutions of substance: - Nested write access (#1385 on main vs ADR-0050 here). main refused nested set/updateMany/deleteMany for non-sudo callers and gated disconnect's target-row form. prisma-8 removed nested relation input from the payload outright, unconditionally, sudo included. The prisma-8 refusal is the strictly stronger property; main's nested-operations.ts is deleted here and its dead re-export of NestedRelationInputError dropped from core's barrel (it auto-merged into a duplicate export of a deleted module). - Hook context (#1176/#1179, main's ADR-0066). main gave hooks the full StackContext; prisma-8's ADR-0052 split BaseContext (no sudo/withSession/ transaction) from Context, in core, in the generator, and in every emitted bundle. prisma-8's split stands; main's ADR-0066 is marked superseded, and its doc text that auto-merged into packages/core/CLAUDE.md and ADR-0052's #1211 amendment is corrected to the merged behaviour. - _count field-level read access (#1120/#1111). Verified the property still holds: secured/include.ts omits a denied relation pre-query and Field Visibility drops it post-query. main's fieldAccess parameter on resolveCountAccessEntryForList is moot — its only caller is unreachable from context.db here. - The old typed-query/generated-bundle surface (Fragment/ResultOf, AugmentedFind*, AccessContext<TPrisma, TDb>, CustomDB, Prisma.*Args) is taken from prisma-8 throughout; prisma-8 replaced it. - ADR-0066 was claimed by both branches. prisma-8's is renumbered to 0068 and every reference to it updated. - Dependency bumps from main carried forward and aligned monorepo-wide: @types/react ^19.2.18, pg ^8.23.0, @types/pg ^8.23.1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Picks up main's dependabot bumps (@typescript-eslint/parser 8.69.0, globals 17.12.0, @types/react 19.2.18) and the monorepo-wide pg 8.23.0 / @types/pg 8.23.1 alignment the merge settled. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

- access-filter.ts called resolveCountAccessEntryForList with main's third `fieldAccess` argument against prisma-8's two-parameter signature. - hook-pipeline.ts and hooks/index.ts imported StackContext from context/index.js, which does not export it on this line; both carried main's #1179 hook-context typing, reverted to prisma-8's AccessContext. Also reverts the pg/@types/pg bump from main's #1380: @prisma/orm-postgres 8.0.0-rc.8 pins pg 8.22.0 and @types/pg 8.20.4 exactly, and a second copy of @types/pg makes core's testing harness fail to compile. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

prisma-8's resolveCountAccessEntryForList had lost the fieldAccess parameter #1120 added, because the secured read gates the same field one layer up in secured/include.ts and the function's only caller is unreachable from context.db here. Porting the parameter back keeps the gate attached to the entry itself, so a future caller cannot reopen #1111 by omitting it, and restores main's own test of it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…B members main's #1211 added `prisma: import('./prisma-client/client.ts').PrismaClient` and `db: import('./types.ts').CustomDB` to every list's TypeInfo. Both name a module prisma-8 does not emit, so the merge would have written a bundle that does not type-check into every example — a generation break the package type-suites do not see. Reverted to prisma-8's generator, with main's test of the removed member. Also removes five main-only CLI test files covering the generated surface ADR-0052 replaced: the fragment/CustomDB seam (#1233, #1287, #1328) and the hook context.db typing (#1232). Their subjects are carried by prisma-8's own contract-keyed suites. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

main's #1185 bumped @vitest/browser to ^4.1.11 while vitest stayed ^4.1.10, leaving an unmet peer. Every vitest-family specifier moves to ^4.1.11 rather than reverting the bump. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

chatgpt-codex-connector · 2026-09-11T06:50:02Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

changeset-bot · 2026-09-11T06:50:03Z

🦋 Changeset detected

Latest commit: 02c526d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 9 packages

Name	Type
@opensaas/stack-rag	Minor
@opensaas/stack-cli	Minor
@opensaas/stack-core	Minor
@opensaas/stack-auth	Minor
@opensaas/stack-storage	Minor
@opensaas/stack-tiptap	Minor
@opensaas/stack-ui	Minor
@opensaas/stack-storage-s3	Minor
@opensaas/stack-storage-vercel	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel · 2026-09-11T06:50:04Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
stack-docs	Ready	Preview	Sep 11, 2026 7:18am UTC

github-actions · 2026-09-11T07:05:23Z