The engine pin lives in two manifests, and only one ever moved

[ankur-arch]

The bug

prisma@8.0.0-rc.4 crashes on import (#202) because it was published pinning @prisma/cli-engine@0.1.1, an engine missing readActiveAccessToken and the other exports the CLI was built against. The engine bump that repaired this (#200) moved packages/cli to workspace:0.2.0 — but packages/prisma carries its own pin and was left at workspace:0.1.1.

That makes the open rc.5 release PR (#207) re-ship the crash: pnpm publish strips the workspace: prefix verbatim, so the bare prisma package — the one npx prisma@next resolves — would again publish depending on the broken 0.1.1. Verified by packing packages/prisma at main:

$ pnpm pack   # in packages/prisma
$ tar -xzOf prisma-*.tgz package/package.json | grep cli-engine
    "@prisma/cli-engine": "0.1.1",

Root cause

scripts/bump-cli-engine-version.ts rewrites the engine pin in exactly one manifest (packages/cli). packages/prisma gained the same pin later (17f3f78) and nothing — not the bump script, not check-engine-version.mjs, not conformance — watches it. PR #207 passed every check with the stale pin in place.

What changed

• packages/prisma/package.json: workspace:0.1.1 → workspace:0.2.0 (+ lockfile).

• bump-cli-engine-version.ts rewrites the pin in every consumer manifest (packages/cli, packages/prisma), so the next bump cannot leave one behind. Verified by running pnpm bump-cli-engine-version 0.2.1 locally: both manifests moved.

• The tarball conformance check gains the missing invariant: every packed sibling that depends on the engine must pin exactly the engine version packed beside it. With the stale pin, PUBLISH_CHANNEL=release pnpm check:conformance now fails:

  ✘ [tarball/engine-pin-mismatch] prisma: prisma pins @prisma/cli-engine@0.1.1 while this release packs @prisma/cli-engine@0.2.0 — the published package would resolve a different engine than the one shipping
  

  With the fix: 0 failing, 3 allowed, 5 subject(s) checked.

This is the smallest change that both repairs the release and closes the class: no new files, no new check kinds — the guard reuses engine-pin-mismatch inside the existing tarball check, and the bump script goes from one hardcoded manifest to the list of consumers.

Testing

• New regression test in packages/cli-conformance/tests/tarball.test.ts (a packed sibling pinning a different engine version than the packed engine is a finding) — fails before the tarball.ts change, passes after.
• pnpm --filter @repo/cli-conformance test: 59 passing.
• pnpm test:scripts: 80 passing.
• pnpm lint, tsc --noEmit (cli-conformance): clean.
• Release-channel conformance run both ways as above.

Unblocks #207; together with it, fixes #202.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 281603d2-8ed4-4500-bf58-d19362a0aed7

📥 Commits

Reviewing files that changed from the base of the PR and between eda6a28 and 6dde5a8.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (5)

• docs/oss/versioning.md
• packages/cli-conformance/src/checks/tarball.ts
• packages/cli-conformance/tests/tarball.test.ts
• packages/prisma/package.json
• scripts/bump-cli-engine-version.ts

Included review availability: 3 reviews are currently available. Based on recent review activity, included reviews refill at 5 per hour.

---

Summary by CodeRabbit

• Bug Fixes

  • Improved package validation to detect mismatches between declared engine versions and packed engine versions.
  • Added coverage to ensure mismatched engine pins are reported while matching pins pass validation.

• Chores

  • Updated the CLI engine version consistently across supported packages.
  • Improved version-bump automation to update all relevant engine references.

• Documentation

  • Clarified independent CLI engine versioning and dependency pin maintenance.

Walkthrough

The CLI engine bump script now updates exact workspace: pins in both packages/cli and packages/prisma. The Prisma pin is updated to 0.2.0, and the versioning documentation names both consumer manifests. Tarball conformance now reports mismatches between packed engine dependencies and the packed engine version. A regression test covers mismatched sibling packages and correctly pinned shell packages.

Merge Risk: ⚪ Minimal · up to 6dde5

The change aligns the Prisma package with the updated engine version and adds a guard against future mismatches; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main defect: the engine version pin exists in two manifests but only one was updated.
Description check	✅ Passed	The description explains the stale pin, its release impact, and the code and test changes that correct and prevent the issue.
Linked Issues check	✅ Passed	The PR updates the stale prisma engine pin and adds automated safeguards that prevent future published CLI artifacts from using incompatible engine versions.
Out of Scope Changes check	✅ Passed	All changes support engine pin consistency, release safety, documentation, or regression coverage for the linked issue.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/prisma-package-engine-pin

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/prisma-package-engine-pin

---

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

npx https://pkg.pr.new/@prisma/cli@210

npx https://pkg.pr.new/@prisma/cli-engine@210

commit: 6dde5a8