fix(cli): pin @prisma/composer-cli 0.18.0 so npm installs terminate

[wmadden-electric]

Summary

Every npm install of @prisma/cli and prisma has hung since 2026-09-11 03:55 UTC, and the conformance step in CI runs until cancelled (for example https://github.com/prisma/prisma-cli/actions/runs/34586396643/job/103242148710 on #256). The cause is two levels down: @prisma/composer@0.17.0 left alchemy's floating @effect/vitest dependency unpinned for consumers, the @effect/* adapters published 4.0.0-rc.114 ahead of effect itself, and npm backtracks for hours over an effect peer that no published version satisfies instead of failing.

composer 0.18.0 pins that dependency (prisma/composer#287). This moves both shells to it, and the @prisma/composer dev dependency with them so the tree holds one composer version. No CLI behaviour changes: composer-cli 0.18.0 declares the same @prisma/cli-engine@0.3.0 peer.

Testing

• PUBLISH_CHANNEL=dev pnpm check:conformance and PUBLISH_CHANNEL=release pnpm check:conformance: 5 subjects checked, nothing to report, about 50 s each. Before this change the sandbox install never finished.
• pnpm typecheck clean. pnpm --filter @prisma/cli test: 964 passed, 2 skipped.
• pnpm lint clean on tracked files.

After merge

#256 and any other open PR need main merged in, or a rerun on top of it, for their conformance check to pass. The already-published 8.0.0-rc.13 still pins composer-cli 0.17.0 and cannot be installed until the next release ships this pin, unless effect@4.0.0-rc.114 lands upstream first.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 5e5da646-7c61-4e16-8911-1143ed3a1ea5

📥 Commits

Reviewing files that changed from the base of the PR and between 3a97d2c and 55be804.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• packages/cli/package.json
• packages/prisma/package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Summary by CodeRabbit

• Chores
  • Updated internal tooling components to newer versions.
  • No user-facing features or behavior changes are included in this update.

Walkthrough

The pull request updates Composer dependencies from version 0.17.0 to 0.18.0. It updates both runtime and development dependencies in packages/cli/package.json and the runtime dependency in packages/prisma/package.json.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 55be8

The dependency-only update is ready to merge; reported installation and validation checks pass.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the dependency pin to version 0.18.0 and the install-hang issue it addresses.
Description check	✅ Passed	The description directly explains the dependency resolution issue, the affected packages, the fix, and the validation results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/bump-composer-cli-0.18.0

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/bump-composer-cli-0.18.0

---

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

npx https://pkg.pr.new/@prisma/cli@258

npx https://pkg.pr.new/@prisma/cli-engine@258

commit: 55be804