prisma / prisma-cli
Repository health
Security, maintenance, dependencies and license for prisma/prisma-cli.
Security
0
Critical
0 direct
0
High
0 direct
0
Moderate
0
Low
4 dependencies checked (4 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
OpenSSF Scorecard · 6.2/10
Checks sorted from strongest to weakest.
- Recent activityLast commit 2d ago10/10
- License filePermissive license: Apache-2.010/10
- Tests run on pull requestsCI configured + tests present10/10
- Security policySECURITY.md present10/10
- Least-privilege CI tokensWorkflows declare explicit, scoped permissions10/10
- Pinned dependenciesAll actions pinned to SHAs10/10
- Code review before mergeOnly 3/20 recent PRs had requested reviewers2/10
- Automated dependency updatesNo Dependabot or Renovate config found0/10
- Static analysis on commitsNo SAST workflow detected0/10
- Branch protectionDefault branch 'main' has no protection rule0/10
Maintenance
17 Oct 2026
Last commit
active
100+
Commits in the last year
10
Contributors
in the last 100 commits
v8.0.0-rc.23
Latest release
~5d cadence
Outside contributions: 55 of 68 external pull requests merged (87% of those decided), median 0.1 days to merge.From the 100 most recently updated pull requests, bots excluded.
Recent releases
- v8.0.0-rc.2315 Oct 2026 · 7 days after previous
- v8.0.0-rc.228 Oct 2026 · 1 day after previous
- v8.0.0-rc.217 Oct 2026 · 2 days after previous
- v8.0.0-rc.205 Oct 2026 · 6 days after previous
- v8.0.0-rc.1929 Sept 2026 · same day as previous
Pull requests
- Open
- 4
- 0 stale (60+ days, no update in 30)
- Merged
- 22
- of the 30 latest
- Median time to merge
- Same day
- From bots
- 0
- not listed below
Open
- #354 feat(service): support custom domains on preview branchessorenbs · opened 3 days ago
- #346 test(cli): cover the @latest package spec in CLI hintsgregory-boch-prisma · opened 7 days ago
- #325 feat(cli): install agent MCP connections and enrollment skillssorenbs · opened 19 days ago
- #322 docs(skills): match the release sanity check to what bump-version writeskristof-siket · opened 20 days ago
Recently merged
- #348 docs(readme): name Prisma Postgres and Prisma Compute in the npm READMEsgregory-boch-prisma · merged 2026-10-16
- #353 feat!: piping a prisma command gives its plain data; JSON needs --jsonwmadden-electric · merged 2026-10-15
- #349 feat(engine): a command can also have subcommands, so prisma dev <entry> and prisma dev url can coexistwmadden-electric · merged 2026-10-15
- #352 Bump to version 8.0.0-rc.23StevenMcClankerton · merged 2026-10-15
- #351 Follow the products' released versions: @prisma/composer-cli 0.29.1 -> 0.30.0; @prisma/composer 0.29.1 -> 0.30.0prisma-bot · merged 2026-10-15
The 30 most recently updated pull requests.
Top contributors
- wmadden-electric62 commits · 62%
- prisma-bot10 commits · 10%
- AmanVarshney019 commits · 9%
- gregory-boch-prisma4 commits · 4%
- kristof-siket4 commits · 4%
Of the 100 most recent commits.
Issues
- Open
- 40
- on the repository
- Median time to close
- 1 day
- from 7 closed of the 32 latest
- Awaiting first reply
- 23
- of 25 open among the 32 latest
- Oldest open
- 94 days
Most wanted
- #347 init: when no Prisma package is installed, say what to run next1 reaction · 1 comment
- #329 prisma 8.0.0-rc.19 cannot emit with @prisma/orm-postgres 8.0.0-rc.14 (bundles orm-toolchain rc.13): please release #3271 reaction · 0 comments
Rates come from the 32 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
4
Packages checked
npm
4
Direct packages checked
listed in the manifest
0
Transitive packages checked
pulled in by other packages
506
External imports
outside packages the code imports
License
Apache-2.0
License
Permissive
Family
Unknown
License conflicts in dependencies
Dependency licenses were not checked
Commercial use: Generally fine for commercial and proprietary use, subject to attribution and notice terms. Apache-2.0 also grants a patent licence.