Bump the production-dependencies group with 3 updates

[dependabot]

Bumps the production-dependencies group with 3 updates: @prisma/client, dockerode and next.

Updates @prisma/client from 6.19.3 to 7.9.0

Release notes

Sourced from @​prisma/client's releases.

7.9.0

Today, we are excited to share the 7.9.0 stable release 🎉

🌟 Star this repo for notifications about new releases, bug fixes & features — or follow us on X!

Highlights

ORM

Tab completions for the Prisma CLI

Typing out CLI commands from memory is now optional. Prisma ships shell tab completions for bash, zsh, fish, and PowerShell, covering commands, subcommands, options, flags, and even option values.

Setting it up. Most projects run Prisma through a package manager, so completions are enabled through @bomb.sh/tab's package-manager integration — install it once, then source the completion for your package manager and shell:

# 1. Install @bomb.sh/tab globally
npm install -g @bomb.sh/tab
2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):
echo 'source <(tab pnpm zsh)'  >> ~/.zshrc            # zsh
echo 'source <(tab pnpm bash)' >> ~/.bashrc           # bash
tab pnpm fish > ~/.config/fish/completions/pnpm.fish  # fish
tab pnpm powershell > ~/.tab-pnpm.ps1                 # PowerShell (then dot-source it from $PROFILE)

@bomb.sh/tab delegates to any locally-installed CLI that ships completions, so pnpm prisma <TAB>, pnpm exec prisma <TAB>, yarn prisma <TAB>, and bun x prisma <TAB> all complete Prisma's commands, options, and values — no per-project setup. (npx and bunx don't support completion themselves; use npm exec and bun x.)

If instead you have Prisma installed globally on your PATH, source its own completion directly: source <(prisma complete zsh) (or the bash / fish / powershell variant).

This is built on @bomb.sh/tab, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from @​AmirSa12 (#28351) — thank you!

prisma.mp4

Prisma ORM, ready for AI agents

Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.

Agent skills installed with prisma init (#29689)

prisma init now installs the prisma/skills catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with --no-skills.

npx prisma@latest init

A safer default around destructive commands (#29684, #29691, #29713)

... (truncated)

Commits

• b829850 ci: upgrade pnpm to 11 to restore pnpm audit (#29725)
• 280fd56 fix(client): mask each quoted string in maskQuery independently (#29723)
• 4da3774 fix(client): reject invalid raw dates (#29697)
• a7cec97 chore(deps): update engines to 7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6...
• 58f8439 fix(client): pin pg-protocol in prisma-client-imports-postgres e2e test (#29687)
• 918cf5d fix(client): improve adapter-related Prisma 7 error messages (#29624)
• 93da6ea ci(e2e): shard client e2e suite across 3 jobs to fix chronic timeouts (#29619)
• 3937779 fix: remove duplicate 'the the' in test comments (#29610)
• fda8fbc chore(deps): bump @​prisma/dev to 0.24.9 (resolves hono GHSA-92pp-h63x-v22m) (...
• 0036baf fix(client-engine-runtime): surface unmapped driver errors as user-facing P20...
• Additional commits viewable in compare view

Updates dockerode from 4.0.12 to 5.0.1

Release notes

Sourced from dockerode's releases.

v5.0.1

What's Changed

• build(deps): bump @​protobufjs/utf8 from 1.1.0 to 1.1.1 by @​dependabot[bot] in apocas/dockerode#832
• build(deps): bump protobufjs from 7.5.5 to 7.6.1 by @​dependabot[bot] in apocas/dockerode#834
• build(deps): bump @​grpc/grpc-js from 1.11.1 to 1.11.4 by @​dependabot[bot] in apocas/dockerode#837
• build(deps): bump protobufjs from 7.6.1 to 7.6.3 by @​dependabot[bot] in apocas/dockerode#838
• build(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 by @​dependabot[bot] in apocas/dockerode#839

Full Changelog: apocas/dockerode@v5.0.0...v5.0.1

v5.0.0

What's Changed

• Bump picomatch from 2.3.1 to 2.3.2 by @​dependabot[bot] in apocas/dockerode#826
• Bump protobufjs from 7.3.2 to 7.5.5 by @​dependabot[bot] in apocas/dockerode#828
• Dropped uuid package, bumped minimum node version requirement.

Full Changelog: apocas/dockerode@v4.0.10...v5.0.0

Commits

• See full diff in compare view

Updates next from 15.5.21 to 16.2.12

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

• Backport/docs fixes 16.2 - July round by @​icyJoseph in vercel/next.js#96031
• [Backport] Fixes to support TypeScript 7 by @​lukesandberg in vercel/next.js#95831

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Backport documentation fixes for v16.2 (#93804)
• [backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)
• [backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)
• [backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)
• [backport] Encode non-ASCII characters in cache tags at construction (#93918)
• [backport] Fix server action forwarding loop with middleware rewrites (#93919)
• [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
• [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)

... (truncated)

Commits

• 2234717 v16.2.12
• 957f5ed [Backport] Fixes to support TypeScript 7 (#95831)
• b56eb16 Backport/docs fixes 16.2 - July round (#96031)
• 9beca08 v16.2.11
• 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
• ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
• 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
• b512063 [16.x] Set correct origin for internal redirects in custom server
• d303326 [16.x] Ensure exotic rewrite param values are properly encoded
• 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions