Update dependency @prisma/sdk to 2.20.0 [SECURITY] - abandoned

[renovate]

This PR contains the following updates:

Package	Change
@​prisma/sdk	2.7.0 -> 2.20.0

GitHub Vulnerability Alerts

CVE-2021-21414

Impact

As of today, we are not aware of any Prisma users or external consumers of the @prisma/sdk package who are affected by this security vulnerability.

This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.

It only affects the getPackedPackage function and this function is not advertised and only used for tests & building our CLI, no malicious code was found after checking our codebase.

Patches

Fixed in

• @​prisma/sdk@2.20.0 (latest channel)
• @​prisma/sdk@2.20.0-dev.29 (dev channel)

Pull Request closing this vulnerability https://github.com/prisma/prisma/pull/6245

Acknowledgements

This issue was discovered and reported by GitHub Engineer @​erik-krogh (Erik Krogh Kristensen).

For more information

If you have any questions or comments about this advisory:

• Create a discussion in the Prisma repository
• Email us at security@prisma.io

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[renovate]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.