Summary

• Update the placeholder comment generated when creating a slice across the Next, Nuxt, Nuxt 2, and SvelteKit adapters to suggest using your own AI agent with the Prismic CLI (linking to https://prismic.io/docs/ai#create-slices) instead of the Prismic MCP server. Snapshot in adapter-sveltekit updated to match.
• Rename the user-facing "Prismic MCP" sidebar item to "Prismic with AI", rephrase its tooltip, and point the link to the https://prismic.io/docs/ai landing page.
• Update the slice builder promo button copy to "Boost your workflow with Prismic AI" and point it to the same docs landing page.
• Rename the promo link component (McpPromoLink → AIPromoLink) and update its import sites.
• Rename the related telemetry surface: event id mcp:promo-link-clicked → ai:promo-link-clicked, human name "MCP Promo Link Clicked" → "AI Promo Link Clicked", type McpPromoLinkClicked → AiPromoLinkClicked, and the sidebar link_name: "prismic_mcp" → "prismic_ai".
• Update Playwright coverage (locator name + variable + test title) to match the new "Prismic with AI" wording.

Preview

Security fix: defu prototype-pollution vulnerability (GHSA-737v-mqg7-c878)

Problem

The @slicemachine/plugin-kit CI audit step (yarn npm audit --environment production --severity high) was failing with:

└─ defu: 6.1.4
   ├─ ID: 1116102
   ├─ Issue: defu: Prototype pollution via `__proto__` key in defaults argument
   ├─ Severity: high
   ├─ Vulnerable Versions: <=6.1.4
   └─ Patched Versions: >=6.1.5

Root cause

Yarn 3.6.0's npm audit implementation (legacy v1 API) sends all resolved package versions in the entire monorepo to the npm registry's bulk advisory endpoint — not just the workspace's own dependency tree. This means even though plugin-kit itself resolved defu@^6.1.5 → 6.1.7, the audit still flagged defu@6.1.4 (resolved via h3, c12, rc9, etc. in sibling workspaces like @slicemachine/manager).

Fix

1. Bumped defu in packages/plugin-kit/package.json from ^6.1.2 to ^6.1.5
2. Added "defu": "^6.1.5" to the root package.json resolutions field — this forces all defu ranges across the entire monorepo to resolve to 6.1.7 (patched)

Compatibility checks

The resolution override affects consumers that previously required defu@^5.0.0 (→ 5.0.1) and defu@^6.x (→ 6.1.2 / 6.1.4). We verified the following:

The 6.1.5 release contains only the prototype-pollution fix (unjs/defu#156) and "ignore inherited enumerable properties" — no breaking changes. Versions 6.1.6/6.1.7 add a types export fix and mixed-types build fix respectively.

Made with Cursor