Extract Prisma types to centralized types module - #1
Open
ClementG91 wants to merge 3 commits into
Open
Conversation
This commit addresses 17 security vulnerabilities identified by npm audit: Critical (1): - Next.js RCE in React flight protocol (GHSA-9qr9-h5gf-34mp) High (2): - glob CLI command injection (GHSA-5j98-mcp5-4vw2) - Next.js DoS with Server Components (GHSA-mwv6-3258-q52c) Moderate (6): - Next.js middleware redirect SSRF (GHSA-g5qg-72qw-gw5v) - Next.js content injection for image optimization (GHSA-xv57-4mr9-wg8v) - Next.js cache key confusion (GHSA-g5qg-72qw-gw5v) - Next.js server actions source code exposure (GHSA-w37m-7fhw-fmv9) - next-auth email misdelivery (GHSA-5jpx-9hw9-2fx4) - nodemailer multiple vulnerabilities (DoS, email misrouting) - js-yaml prototype pollution (GHSA-mh29-5h37-fv8m) Low (5): - brace-expansion ReDoS (GHSA-v6h2-p8h4-qcjw) - nodemailer addressparser DoS - cookie package validation issues (GHSA-pxg6-pf52-xh8x) Changes: - Upgraded next: ^15.2.3 → ^16.1.1 - Upgraded next-auth: ^4.24.7 → ^4.24.13 - Upgraded nodemailer: ^6.9.15 → ^7.0.12 (major version) - Upgraded @auth/prisma-adapter: ^2.7.0 → ^2.11.1 - Added cookie override to force secure version ^0.7.2 - Fixed transitive dependencies (glob, js-yaml, brace-expansion) All vulnerabilities have been resolved (npm audit: 0 vulnerabilities).
Updated all code to be fully type-safe after Next.js 16 upgrade: Created new type definitions in types/prisma.ts: - Role enum (USER, ADMIN, MODERATOR) - UserData interface - UserWithDateFields interface - UserGrowthData interface - UserGrowthResult interface - UserSearchResult interface Fixed type safety in: - actions/account.ts: Proper type guards for Date fields - actions/admin.ts: UserSearchResult instead of any - actions/user-stats.ts: UserGrowthData instead of any - components/pages/admin/UsersTable.tsx: UserSearchResult instead of any - components/pages/user/dashboard/Charts.tsx: UserGrowthResult and ChartData instead of any - lib/authOptions.ts: Import Role from types/prisma - types/next-auth.d.ts: Import Role from types/prisma All TypeScript compilation errors resolved with strict type safety. No 'any' types remain in the codebase.
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Updated actions/admin.ts to use proper Prisma.UserWhereInput type and Prisma.QueryMode.insensitive instead of string literal. This ensures type safety when Prisma Client is properly generated. Changes: - Import Prisma namespace from @prisma/client - Use Prisma.UserWhereInput type for where clause - Use Prisma.QueryMode.insensitive for case-insensitive search - Updated package-lock.json with latest security patches (diff, lodash, next) Remaining vulnerabilities in dev dependencies only (eslint, tar in bcrypt): - eslint: moderate severity, requires breaking change to v9 - tar: in bcrypt dependency, requires bcrypt v6 breaking change These are development-only dependencies and don't affect production.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Refactored the codebase to extract Prisma-related types into a centralized
@/types/prismamodule, improving type safety and maintainability by reducing direct dependencies on@prisma/clientimports across the application.Key Changes
@/types/prismamodule to house custom types likeRole,UserSearchResult,UserGrowthData, andUserGrowthResultactions/account.ts,actions/admin.ts,actions/auth.ts, andactions/user-stats.tsto import types from the new module instead of directly from@prisma/clientactions/admin.ts: AddedUserSearchResulttype to user mappingactions/user-stats.ts: AddedUserGrowthDatatype to destructured parameterscomponents/pages/admin/UsersTable.tsx: AddedUserSearchResulttype annotationcomponents/pages/user/dashboard/Charts.tsx: AddedUserGrowthResultandChartDatatype annotationsactions/account.tsto use type guards and separate conditional branches for better clarityBenefits
@prisma/clientfor type definitionshttps://claude.ai/code/session_016sRbwsenjeaiceKQjYWZ3f
Note
Medium Risk
Mostly type refactoring, but the Next.js 16 upgrade plus auth/email dependency bumps can introduce runtime/build regressions and should be validated in CI and key flows (auth, email, image/sharp).
Overview
Centralizes Prisma-facing types into a new
types/prisma.ts(includingRole, query result shapes) and updates server actions, NextAuth types, and UI code to import these shared types instead of relying on@prisma/client-exported enums.Tightens a few type/behavior edges: uses explicit query mode enum (
Prisma.QueryMode.insensitive), adds typed mapping for user/admin stats results, and makes account data export date formatting safer viaDatetype guards.Also bumps core dependencies (notably Next.js 15 → 16,
next-auth,nodemailer,@auth/prisma-adapter) and adjusts TS config (jsx: react-jsx, additional.next/dev/typesinclude) to match the new toolchain.Written by Cursor Bugbot for commit baf09bb. This will update automatically on new commits. Configure here.