@prisma/client
>=4.0.0 <8.0.0postconditions68functions24last verified2026-06-23coverage score100%Postconditions: what we check
- create · unique-constraint-violationerrorWhenUnique constraint violation (duplicate key)Throws
PrismaClientKnownRequestError with code 'P2002'Required handlingCaller MUST catch P2002 errors and handle duplicate key violations gracefully. Extract conflicting field from error.meta.target. DO NOT retry without changing the unique field value.costhighin prodimmediate exceptionusers seelost transactionvisibilityvisibleSources[1] - create · foreign-key-constrainterrorWhenForeign key constraint violationThrows
PrismaClientKnownRequestError with code 'P2003'Required handlingCaller MUST verify referenced record exists before creating. This indicates data integrity issue - DO NOT retry.costhighin prodimmediate exceptionusers seelost transactionvisibilityvisibleSources[2] - create · required-field-missingerrorWhenRequired field is missing from dataThrows
PrismaClientValidationErrorRequired handlingValidate data completeness before calling Prisma. This is a client-side error.costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[3] - create · connection-errorerrorWhenDatabase connection failedThrows
PrismaClientInitializationError or PrismaClientRustPanicErrorRequired handlingCaller MUST handle connection errors separately from business logic errors. Implement exponential backoff retry for transient connection issues. Alert operations if connection errors persist.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[4] - update · record-not-founderrorWhenRecord to update does not existThrows
PrismaClientKnownRequestError with code 'P2025'Required handlingCaller MUST handle P2025 (record not found) errors. Decide whether to: 1. Create the record, 2. Return error to user, or 3. Silently ignore. DO NOT retry update on non-existent record.costhighin prodimmediate exceptionusers seelost transactionvisibilityvisibleSources[5] - update · unique-constraint-violationerrorWhenUpdate would violate unique constraintThrows
PrismaClientKnownRequestError with code 'P2002'Required handlingCheck if new value conflicts with existing record. DO NOT retry.costhighin prodimmediate exceptionusers seelost transactionvisibilityvisibleSources[1] - update · foreign-key-constrainterrorWhenUpdate would violate foreign key constraintThrows
PrismaClientKnownRequestError with code 'P2003'Required handlingVerify referenced record exists. This indicates data integrity issue.costmediumin prodimmediate exceptionusers seelost transactionvisibilityvisibleSources[2] - update · connection-errorerrorWhenDatabase connection failedThrows
PrismaClientInitializationErrorRequired handlingImplement retry with exponential backoffcosthighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6] - delete · record-not-founderrorWhenRecord to delete does not existThrows
PrismaClientKnownRequestError with code 'P2025'Required handlingCaller MUST handle P2025 errors. Decide if missing record is acceptable (idempotent delete). DO NOT retry delete on non-existent record.costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[5] - delete · foreign-key-constrainterrorWhenCannot delete because of foreign key constraint (dependent records exist)Throws
PrismaClientKnownRequestError with code 'P2003' or 'P2014'Required handlingCaller MUST either: 1. Delete dependent records first (cascade delete), or 2. Return error to user. Check referencing tables before attempting delete.costhighin prodimmediate exceptionusers seelost transactionvisibilityvisibleSources[7] - delete · connection-errorerrorWhenDatabase connection failedThrows
PrismaClientInitializationErrorRequired handlingImplement retry with exponential backoffcosthighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6] - findUnique · record-not-founderrorWhenRecord with specified ID does not existReturnsnullRequired handlingCaller MUST check if result is null before accessing properties. Code that assumes findUnique always returns a record will crash.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[8]
- findUnique · connection-errorerrorWhenDatabase connection failedThrows
PrismaClientInitializationErrorRequired handlingImplement retry with exponential backoffcosthighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6] - findUniqueOrThrow · record-not-founderrorWhenRecord with specified ID does not existThrows
PrismaClientKnownRequestError with code 'P2025'Required handlingCaller MUST catch P2025 errors when using findUniqueOrThrow. This method throws instead of returning null, requiring explicit error handling.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[9] - findUniqueOrThrow · connection-errorerrorWhenDatabase connection failedThrows
PrismaClientInitializationErrorRequired handlingImplement retry with exponential backoffcosthighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6] - $transaction · transaction-failederrorWhenAny operation in transaction failsThrows
PrismaClientKnownRequestError (various codes) or PrismaClientUnknownRequestErrorRequired handlingCaller MUST handle transaction failures. All operations are rolled back. Identify which operation failed using error.code and error.meta. Consider retry strategy for transient errors (connection issues).costhighin prodimmediate exceptionusers seelost transactionvisibilityvisibleSources[10] - $transaction · deadlock-errorerrorWhenTransaction deadlock detected by databaseThrows
PrismaClientKnownRequestError with code 'P2034'Required handlingCaller SHOULD implement retry logic for deadlock errors. Use exponential backoff with jitter to reduce contention. Consider redesigning transaction to reduce lock duration.costhighin prodimmediate exceptionusers seelost transactionvisibilityvisibleSources[11] - $transaction · connection-error-in-transactionerrorWhenConnection lost during transactionThrows
PrismaClientInitializationErrorRequired handlingTransaction is automatically rolled back. Retry entire transaction. Implement idempotency if retrying critical transactions (payments, etc).costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[12] - $transaction · transaction-timeoutwarningWhenTransaction exceeded max durationThrows
PrismaClientKnownRequestError with code 'P2024'Required handlingBreak transaction into smaller units or increase timeout. Long transactions hold locks and can cause performance issues.costmediumin prodimmediate exceptionusers seelost transactionvisibilityvisibleSources[13] - $connect · connection-failederrorWhenUnable to establish database connectionThrows
PrismaClientInitializationErrorRequired handlingCaller MUST handle connection failures. Common causes: 1. Database server is down 2. Invalid connection string 3. Network issues 4. Database authentication failure Implement retry with exponential backoff for transient errors.costcriticalin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[4] - $disconnect · disconnect-with-pending-querieswarningWhenDisconnecting while queries are pendingThrows
May throw errors for pending queriesRequired handlingCaller SHOULD await all pending queries before calling $disconnect. Use in graceful shutdown handlers (SIGTERM, SIGINT).costmediumin prodimmediate exceptionusers seelost transactionvisibilityvisibleSources[14] - upsert · upsert-race-condition-unique-constrainterrorWhenConcurrent upserts targeting the same non-existent recordThrows
PrismaClientKnownRequestError with code 'P2002'Required handlingWhen multiple upsert operations run concurrently for the same record, one may throw P2002 (unique constraint violation) because another operation created the record first. Caller MUST catch P2002 and retry the upsert to trigger the update branch. DO NOT treat P2002 on upsert as an unrecoverable error.costhighin prodimmediate exceptionusers seelost transactionvisibilityvisible - upsert · upsert-foreign-key-constrainterrorWhenUpsert violates a foreign key constraint (referenced record does not exist)Throws
PrismaClientKnownRequestError with code 'P2003'Required handlingCaller MUST verify all referenced (foreign key) records exist before upserting. A P2003 on upsert indicates referential integrity would be violated. DO NOT retry — fix the data before retrying.costmediumin prodimmediate exceptionusers seelost transactionvisibilityvisibleSources[2] - upsert · upsert-connection-errorerrorWhenDatabase connection failed during upsertThrows
PrismaClientInitializationErrorRequired handlingImplement retry with exponential backoff for transient connection errors.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6] - createMany · createmany-unique-constraint-violationerrorWhenOne or more records in the batch violate a unique constraintThrows
PrismaClientKnownRequestError with code 'P2002'Required handlingCaller MUST either: 1. Use skipDuplicates: true to silently skip conflicting records (where supported), OR 2. Catch P2002 and report which records failed. Note: skipDuplicates is NOT supported on MongoDB, SQL Server, or SQLite — on those databases, a unique violation fails the entire batch.costhighin prodimmediate exceptionusers seelost transactionvisibilityvisible - createMany · createmany-foreign-key-constrainterrorWhenOne or more records reference a non-existent foreign keyThrows
PrismaClientKnownRequestError with code 'P2003'Required handlingEntire batch is rejected on the first foreign key violation. Caller MUST validate all referenced IDs exist before calling createMany.costhighin prodimmediate exceptionusers seelost transactionvisibilityvisibleSources[2] - createMany · createmany-connection-errorerrorWhenDatabase connection failed during batch insertThrows
PrismaClientInitializationErrorRequired handlingEntire batch fails on connection loss. Implement retry with idempotency checks (e.g., use skipDuplicates or pre-check which records were already inserted).costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6] - updateMany · updatemany-unique-constraint-violationerrorWhenUpdate would cause a unique constraint violation across the matched batchThrows
PrismaClientKnownRequestError with code 'P2002'Required handlingIf setting a field to a value that conflicts with existing unique records, updateMany throws P2002. Caller MUST validate uniqueness or catch P2002 and roll back dependent changes.costhighin prodimmediate exceptionusers seelost transactionvisibilityvisibleSources[1] - updateMany · updatemany-zero-rows-affected-not-errorwarningWhenNo records match the where clauseReturns{ count: 0 } — does NOT throwRequired handlingUnlike update(), updateMany does NOT throw P2025 when zero records match. It returns { count: 0 }. Caller MUST check the returned count if zero-match is an unexpected business condition that should be treated as an error.costhighin prodsilent failureusers seelost datavisibilitysilentSources[17]
- updateMany · updatemany-connection-errorerrorWhenDatabase connection failed during bulk updateThrows
PrismaClientInitializationErrorRequired handlingImplement retry with exponential backoff.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6] - deleteMany · deletemany-foreign-key-constrainterrorWhenRecords to delete are referenced by other tables via foreign keysThrows
PrismaClientKnownRequestError with code 'P2003' or 'P2014'Required handlingCaller MUST delete or nullify dependent records before calling deleteMany, OR rely on cascade delete rules configured in the schema. A partial batch failure rolls back all deletes.costhighin prodimmediate exceptionusers seelost transactionvisibilityvisible - deleteMany · deletemany-zero-rows-not-errorwarningWhenNo records match the where clauseReturns{ count: 0 } — does NOT throwRequired handlingUnlike delete(), deleteMany does NOT throw P2025 when zero records match. It returns { count: 0 }. If zero-match indicates a logic error (e.g., deleting a user's data that should exist), caller MUST check the count.costmediumin prodsilent failureusers seelost datavisibilitysilentSources[18]
- deleteMany · deletemany-connection-errorerrorWhenDatabase connection failed during bulk deleteThrows
PrismaClientInitializationErrorRequired handlingImplement retry with idempotency check (verify records still exist before retrying).costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6] - findFirst · findfirst-null-not-checkederrorWhenNo record matches the filterReturnsnullRequired handlingCaller MUST check if result is null before accessing properties. Code that assumes findFirst always returns a record will crash with "Cannot read properties of null" at the property access site, not at the findFirst call — making bugs hard to trace.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[19]
- findFirst · findfirst-connection-errorerrorWhenDatabase connection failedThrows
PrismaClientInitializationErrorRequired handlingImplement retry with exponential backoff.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6] - findFirstOrThrow · findfirstorthrow-record-not-founderrorWhenNo record matches the filterThrows
PrismaClientKnownRequestError with code 'P2025'Required handlingCaller MUST catch P2025 when using findFirstOrThrow. This method is designed for lookups where a missing record is an error condition. Unhandled P2025 crashes the request.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisible - findFirstOrThrow · findfirstorthrow-connection-errorerrorWhenDatabase connection failedThrows
PrismaClientInitializationErrorRequired handlingImplement retry with exponential backoff.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6] - $queryRaw · queryraw-sql-injection-via-unsafe-interpolationerrorWhenUser input interpolated into query using Prisma.raw() or string concatenationThrows
PrismaClientKnownRequestError (malformed query) or silent data exfiltrationRequired handlingALWAYS use tagged template literal syntax: prisma.$queryRaw`SELECT * FROM ...` NEVER use string concatenation or Prisma.raw() with user-supplied input. Unsafe interpolation bypasses Prisma's parameterization and enables SQL injection. Use $queryRawUnsafe ONLY when you control 100% of the query string.costcriticalin prodsilent failureusers seelost datavisibilitysilentSources[21] - $queryRaw · queryraw-type-mismatchwarningWhenSQL return columns do not match the TypeScript generic type TThrows
Runtime type error at property access — TypeScript does not validate raw resultsRequired handlingValidate raw query results at runtime (e.g. with Zod) before using them. TypeScript generics on $queryRaw<T> are not enforced — the cast is unsafe. Extra columns, null columns, or type differences cause runtime errors elsewhere.costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[22] - $queryRaw · queryraw-connection-errorerrorWhenDatabase connection failed during raw queryThrows
PrismaClientInitializationErrorRequired handlingImplement retry with exponential backoff for transient connection failures.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6] - $executeRaw · executeraw-sql-injection-via-unsafe-interpolationerrorWhenUser input interpolated into mutation using Prisma.raw() or string concatenationThrows
Silent data corruption or PrismaClientKnownRequestErrorRequired handlingALWAYS use tagged template literal syntax: prisma.$executeRaw`UPDATE ...` NEVER pass user input through Prisma.raw() or string interpolation. Use $executeRawUnsafe ONLY when the SQL string is fully developer-controlled.costcriticalin prodsilent failureusers seelost datavisibilitysilentSources[21] - $executeRaw · executeraw-zero-rows-not-errorwarningWhenSQL mutation affects zero rowsReturns0 — does NOT throwRequired handling$executeRaw returns the number of affected rows. A return value of 0 is NOT an error condition by default. Caller MUST check the return value if zero-affected rows indicates a business logic failure (e.g., updating a record that should exist).costhighin prodsilent failureusers seelost datavisibilitysilentSources[23]
- $executeRaw · executeraw-prepared-statement-restrictionerrorWhenDDL statements (ALTER TABLE, CREATE TABLE, etc.) attempted via $executeRawThrows
PrismaClientKnownRequestError — database rejects DDL in prepared statement contextRequired handling$executeRaw uses prepared statements which cannot execute DDL statements on most databases. Use $executeRawUnsafe for DDL, or run migrations through Prisma Migrate instead. Never attempt schema changes via $executeRaw in application code.costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[24] - $executeRaw · executeraw-connection-errorerrorWhenDatabase connection failed during raw mutationThrows
PrismaClientInitializationErrorRequired handlingImplement retry with exponential backoff. Ensure idempotency before retrying mutations.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6] - findMany · findmany-empty-array-not-checkedwarningWhenNo records match the filterReturns[] (empty array) — does NOT throwRequired handlingfindMany returns an empty array when no records match — it does NOT throw. Caller MUST check result.length if zero results indicate a business error (e.g. listing a tenant's records that should always have >=1 row). Silent-empty results often manifest as blank UI rather than visible errors.costmediumin prodsilent failureusers seelost datavisibilitysilentSources[25]
- findMany · findmany-connection-errorerrorWhenDatabase connection failed during queryThrows
PrismaClientInitializationErrorRequired handlingImplement retry with exponential backoff for transient connection errors.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6] - findMany · findmany-pagination-unboundedwarningWhenfindMany called without take/skip pagination on large tablesReturnsAll matching rows — can be unboundedRequired handlingWithout `take` and `skip` (or `cursor`-based pagination), findMany loads the entire result set into memory and across the wire. On large tables this can cause OOM in the app process and database client buffer overflows. ALWAYS paginate user-facing queries.costmediumin proddegraded serviceusers seedegraded performancevisibilityvisibleSources[26]
- count · count-zero-result-silentwarningWhenNo records match the where clauseReturns0 — does NOT throwRequired handlingcount() returns 0 silently when no rows match. If zero-count indicates a business condition (e.g. tenant has no records but should), caller MUST treat 0 as an alert condition explicitly. Don't pass count() result directly into business logic without a zero-check.costmediumin prodsilent failureusers seelost datavisibilitysilentSources[27]
- count · count-connection-errorerrorWhenDatabase connection failed during count queryThrows
PrismaClientInitializationErrorRequired handlingImplement retry with exponential backoff for transient connection errors.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6] - aggregate · aggregate-null-when-no-rowserrorWhenNo records match the where clauseReturns{ _min: { field: null }, _max: { field: null }, _avg: { field: null }, _sum: { field: null }, _count: 0 }Required handlingWhen no rows match, aggregate returns null for _min/_max/_avg/_sum fields (not 0, not undefined — null). Code that does `result._sum.amount + tax` will crash with "Cannot read properties of null". Caller MUST null-check every aggregate field before arithmetic or comparison. The _count field returns 0 (not null) when no rows match.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[28]
- aggregate · aggregate-connection-errorerrorWhenDatabase connection failed during aggregationThrows
PrismaClientInitializationErrorRequired handlingImplement retry with exponential backoff for transient connection errors.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6] - groupBy · groupby-empty-array-not-checkedwarningWhenNo records match the filterReturns[] (empty array) — does NOT throwRequired handlinggroupBy returns an empty array when no records match. Code that assumes at least one group exists (e.g. dashboard charts) MUST handle empty arrays. Empty groupBy results often manifest as blank charts rather than visible errors.costmediumin prodsilent failureusers seelost datavisibilitysilentSources[29]
- groupBy · groupby-having-validation-errorerrorWhenhaving clause references field not in by clauseThrows
PrismaClientValidationErrorRequired handlingThe fields used in `having` must also appear in `by` or be aggregations. Dynamic queries that build `having` from user input MUST validate the field list against the `by` list before sending to Prisma.costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[30] - groupBy · groupby-connection-errorerrorWhenDatabase connection failed during groupBy queryThrows
PrismaClientInitializationErrorRequired handlingImplement retry with exponential backoff for transient connection errors.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6] - createManyAndReturn · createmanyandreturn-unsupported-providererrorWhenCalled on MySQL, MongoDB, or SQL ServerThrows
PrismaClientValidationError or runtime error — provider does not support RETURNINGRequired handlingcreateManyAndReturn is supported only on PostgreSQL, CockroachDB, and SQLite. On unsupported providers, calls throw at runtime. Detect the provider via schema introspection or use createMany + a separate findMany on the unique keys when targeting MySQL/MongoDB/SQL Server.costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[31] - createManyAndReturn · createmanyandreturn-unique-constraint-violationerrorWhenOne or more records violate a unique constraintThrows
PrismaClientKnownRequestError with code 'P2002'Required handlingIdentical to createMany: caller MUST either use skipDuplicates: true OR catch P2002. When P2002 fires, the entire batch is rolled back and NO rows are returned. Idempotency requires inspecting which rows were already present before retry.costhighin prodimmediate exceptionusers seelost transactionvisibilityvisibleSources[1] - createManyAndReturn · createmanyandreturn-foreign-key-constrainterrorWhenOne or more records reference a non-existent foreign keyThrows
PrismaClientKnownRequestError with code 'P2003'Required handlingEntire batch is rejected on the first foreign key violation. Caller MUST validate all referenced IDs exist before calling.costhighin prodimmediate exceptionusers seelost transactionvisibilityvisibleSources[2] - createManyAndReturn · createmanyandreturn-connection-errorerrorWhenDatabase connection failed during batch insertThrows
PrismaClientInitializationErrorRequired handlingEntire batch fails on connection loss. Implement retry with idempotency checks.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6] - updateManyAndReturn · updatemanyandreturn-unsupported-providererrorWhenCalled on MySQL, MongoDB, or SQL ServerThrows
PrismaClientValidationError or runtime error — provider does not support RETURNINGRequired handlingupdateManyAndReturn is supported only on PostgreSQL, CockroachDB, and SQLite. On unsupported providers, calls throw at runtime. Use updateMany + a separate findMany when targeting MySQL/MongoDB/SQL Server.costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[32] - updateManyAndReturn · updatemanyandreturn-zero-rows-empty-arraywarningWhenNo records match the where clauseReturns[] (empty array) — does NOT throw P2025Required handlingUnlike update(), updateManyAndReturn does NOT throw when zero records match — it returns []. Caller MUST check result.length if zero-match indicates a business error (e.g. updating a record that should exist).costhighin prodsilent failureusers seelost datavisibilitysilentSources[32]
- updateManyAndReturn · updatemanyandreturn-unique-constraint-violationerrorWhenUpdate would cause a unique constraint violationThrows
PrismaClientKnownRequestError with code 'P2002'Required handlingIf setting a field to a value that conflicts with existing unique records, updateManyAndReturn throws P2002. Caller MUST validate uniqueness or catch P2002.costhighin prodimmediate exceptionusers seelost transactionvisibilityvisibleSources[1] - updateManyAndReturn · updatemanyandreturn-connection-errorerrorWhenDatabase connection failed during bulk updateThrows
PrismaClientInitializationErrorRequired handlingImplement retry with exponential backoff.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6] - $queryRawUnsafe · queryrawunsafe-sql-injectionerrorWhenUser input concatenated into the SQL stringThrows
Silent data exfiltration, data corruption, or PrismaClientKnownRequestError on malformed SQLRequired handling$queryRawUnsafe is documented as UNSAFE and bypasses Prisma's parameterization. NEVER pass user-supplied strings directly. Either: 1. Use $queryRaw with tagged template literals (parameterized), OR 2. Pass values as the second-arg array: $queryRawUnsafe(sql, ...params) — the ...params arguments ARE parameterized; only the SQL string is unsafe. Auditors will flag any $queryRawUnsafe call. Document why it was necessary and prove the SQL string contains no user input.costcriticalin prodsilent failureusers seesecurity breachvisibilitysilent - $queryRawUnsafe · queryrawunsafe-connection-errorerrorWhenDatabase connection failed during raw queryThrows
PrismaClientInitializationErrorRequired handlingImplement retry with exponential backoff for transient connection failures.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6] - $queryRawUnsafe · queryrawunsafe-type-mismatchwarningWhenSQL return columns do not match the TypeScript generic type TThrows
Runtime type error at property access — TypeScript does not validate raw resultsRequired handlingValidate raw query results at runtime (e.g. with Zod) before using them. TypeScript generics on $queryRawUnsafe<T> are not enforced — the cast is unsafe.costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[24] - $executeRawUnsafe · executerawunsafe-sql-injectionerrorWhenUser input concatenated into the SQL stringThrows
Silent data corruption, unauthorized writes, or PrismaClientKnownRequestErrorRequired handling$executeRawUnsafe is documented as UNSAFE for the SQL string. Mutation equivalent of $queryRawUnsafe — same SQL injection risk PLUS write/delete impact. NEVER concatenate user input into the SQL. Either: 1. Use $executeRaw with tagged template literals (parameterized), OR 2. Pass values via the ...params second-arg array: $executeRawUnsafe(sql, ...params). Audit every call site and document why a parameterized $executeRaw is insufficient.costcriticalin prodsilent failureusers seesecurity breachvisibilitysilent - $executeRawUnsafe · executerawunsafe-zero-rows-not-errorwarningWhenSQL mutation affects zero rowsReturns0 — does NOT throwRequired handlingReturns the number of affected rows. 0 is NOT an error condition by default. Caller MUST check the return value if zero-affected rows indicates a business logic failure.costhighin prodsilent failureusers seelost datavisibilitysilentSources[24]
- $executeRawUnsafe · executerawunsafe-connection-errorerrorWhenDatabase connection failed during raw mutationThrows
PrismaClientInitializationErrorRequired handlingImplement retry with exponential backoff. Ensure idempotency before retrying mutations.costhighin prodimmediate exceptionusers seeservice unavailablevisibilityvisibleSources[6]
Sources
Every postcondition cites at least one of these. Grouped by source type; numbered to match the footnotes above.
- [1]prisma.io/docs/reference/api-referenceError Reference
- [2]prisma.io/docs/reference/api-referenceError Reference
- [3]prisma.io/docs/reference/api-referenceError Reference
- [4]prisma.io/docs/reference/api-referenceError Reference
- [5]prisma.io/docs/reference/api-referenceError Reference
- [6]prisma.io/docs/reference/api-referenceError Reference
- [7]prisma.io/docs/reference/api-referenceError Reference
- [8]prisma.io/docs/concepts/componentsCrud
- [9]prisma.io/docs/concepts/componentsCrud
- [10]prisma.io/docs/concepts/componentsTransactions
- [11]prisma.io/docs/reference/api-referenceError Reference
- [12]prisma.io/docs/concepts/componentsTransactions
- [13]prisma.io/docs/reference/api-referenceError Reference
- [14]prisma.io/docs/concepts/componentsConnection Management
- [15]prisma.io/docs/reference/api-referencePrisma Client Reference
- [16]prisma.io/docs/reference/api-referencePrisma Client Reference
- [17]prisma.io/docs/reference/api-referencePrisma Client Reference
- [18]prisma.io/docs/reference/api-referencePrisma Client Reference
- [19]prisma.io/docs/reference/api-referencePrisma Client Reference
- [20]prisma.io/docs/reference/api-referencePrisma Client Reference
- [21]prisma.io/docs/orm/prisma-clientRaw Queries
- [22]prisma.io/docs/orm/prisma-clientRaw Queries
- [23]prisma.io/docs/orm/prisma-clientRaw Queries
- [24]prisma.io/docs/orm/prisma-clientRaw Queries
- [25]prisma.io/docs/orm/referencePrisma Client Reference
- [26]prisma.io/docs/orm/prisma-clientPagination
- [27]prisma.io/docs/orm/referencePrisma Client Reference
- [28]prisma.io/docs/orm/referencePrisma Client Reference
- [29]prisma.io/docs/orm/referencePrisma Client Reference
- [30]prisma.io/docs/orm/prisma-clientAggregation Grouping Summarizing
- [31]prisma.io/docs/orm/referencePrisma Client Reference
- [32]prisma.io/docs/orm/referencePrisma Client Reference
- [33]prisma.io/docs/orm/prisma-clientRaw Queries
- [34]owasp.org/www-community/attacks/SQL_InjectionSQL Injection
- [35]prisma.io/docs/orm/prisma-clientRaw Queries
Research notes
Curator notes from SOURCES.md captured when the profile was written so you can verify the reasoning, not just the rules.
Prisma Nark profile - Sources
Official Documentation
Error Reference
- Main Error Reference: https://www.prisma.io/docs/reference/api-reference/error-reference
- Error Handling Guide: https://www.prisma.io/docs/concepts/components/prisma-client/handling-exceptions-and-errors
- Client API Reference: https://www.prisma.io/docs/reference/api-reference/prisma-client-reference
Core Concepts
- CRUD Operations: https://www.prisma.io/docs/concepts/components/prisma-client/crud
- Transactions: https://www.prisma.io/docs/concepts/components/prisma-client/transactions
- Connection Management: https://www.prisma.io/docs/concepts/components/prisma-client/working-with-prismaclient/connection-management
Error Types
PrismaClientKnownRequestError
Query engine returns a known error with specific error code.
Common Error Codes:
- P2001: Record not found in WHERE condition
- P2002: Unique constraint violation (duplicate key)
- P2003: Foreign key constraint violation
- P2014: Cannot delete record due to dependent records
- P2024: Transaction timeout exceeded
- P2025: Operation failed because required records not found
- P2034: Transaction deadlock detected
Source: https://www.prisma.io/docs/reference/api-reference/error-reference#prismaclientknownrequesterror
PrismaClientUnknownRequestError
Query engine returned an error without a standardized code.
Source: https://www.prisma.io/docs/reference/api-reference/error-reference#prismaclientunknownrequesterror
PrismaClientValidationError
Client-side validation failed before reaching the database (missing fields, type mismatches).
Source: https://www.prisma.io/docs/reference/api-reference/error-reference#prismaclientvalidationerror
PrismaClientInitializationError
Engine startup or database connection failed.
Common Codes:
- P1000: Authentication failed
- P1001: Can't reach database server
- P1002: Database connection timeout
Source: https://www.prisma.io/docs/reference/api-reference/error-reference#prismaclientinitializationerror
Common Production Issues
Connection Pool Timeouts
Severity: High - Very common in production
GitHub Issues:
- Connection pool timeout (#20537)
- Pool timeout with higher connection_limit (#9622)
- Pool timeout but DB pooler never under load (#24846)
- Connections not returned to pool (#12510)
Root Causes:
- Connection Pool Exhaustion: Long-running queries hold connections, exhausting the pool
- Connection Leak: Under error conditions, connections aren't returned to the pool
- Simultaneous Query Limit: More concurrent queries than pool size can handle
Recommended Solutions:
- Increase
connection_limitin datasource configuration - Increase
pool_timeoutto allow queries to wait longer - Use Prisma Client Metrics to diagnose performance issues
- Ensure transactions are properly closed even on error
Transaction Deadlocks
Severity: Medium - Occurs under high concurrency
Issue: Database detects circular lock dependencies (P2034 error)
Recommended Handling:
- Implement retry with exponential backoff + jitter
- Reduce transaction duration and scope
- Order lock acquisition consistently across transactions
Source: https://www.prisma.io/docs/reference/api-reference/error-reference#p2034
Serverless Connection Issues
Severity: Medium - Common in Lambda/Vercel environments
Issue: Each function instance creates its own connection pool, exhausting database connections
Recommended Solutions:
- Use connection pooler (PgBouncer, RDS Proxy)
- DO NOT call
$disconnect()in every invocation - Reuse Prisma Client instance across invocations
Security Advisories
Last Checked: 2026-02-23
No major CVEs found for @prisma/client package itself. The CVEs found were for unrelated products:
- Prisma Cloud by Palo Alto Networks (different product)
- Prisma Access Browser (different product)
Behavioral Gotchas
1. findUnique Returns Null
Unlike findUniqueOrThrow, the standard findUnique returns null when no record is found. Code must null-check before accessing properties.
Source: https://www.prisma.io/docs/concepts/components/prisma-client/crud#findunique
2. Transactions Cannot Be Nested
Prisma does not support nested transactions. All operations must be in a single top-level $transaction() call.
Source: https://www.prisma.io/docs/concepts/components/prisma-client/transactions#nested-transactions
3. Auto-Connect on First Query
Prisma Client automatically connects on the first query. Explicit $connect() is usually unnecessary.
4. Idempotency for Transaction Retries
When retrying transactions (e.g., after deadlock), ensure operations are idempotent to prevent duplicate effects on retry.
Source: https://www.prisma.io/docs/concepts/components/prisma-client/transactions#transaction-timeouts
Verification Process
Best Practices Verified
- ✅ Use
instanceofchecks for type-safe error handling - ✅ Match on
error.codefor specific error conditions - ✅ Handle connection errors separately from business logic errors
- ✅ Implement exponential backoff for transient errors
- ✅ Always null-check
findUniqueresults
Error Handling Pattern
import { Prisma } from "@prisma/client";
try {
const user = await prisma.user.create({ data: { email } });
} catch (e) {
if (e instanceof Prisma.PrismaClientKnownRequestError) {
if (e.code === 'P2002') {
// Unique constraint violation
const target = e.meta?.target; // Field that caused violation
// Handle duplicate key error
}
}
throw e; // Re-throw unexpected errors
}
Source: https://www.prisma.io/docs/concepts/components/prisma-client/handling-exceptions-and-errors
Last Verified
Date: 2026-02-23 Prisma Version Range: 4.0.0 to 6.x Documentation Version: Current as of February 2026