[Snyk] Security upgrade sequelize from 5.22.5 to 6.37.4

[saumilmac]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	SQL Injection SNYK-JS-SEQUELIZE-18517006	708

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 SQL Injection

[saumilmac]

This is a major version upgrade from Sequelize v5 to v6 which introduces significant breaking changes that require developer action.

Key Breaking Changes:

• Node.js Support: Support for Node.js versions below 10 is dropped.
• Promise Library: Bluebird has been completely removed in favor of native Promises. Sequelize.Promise is no longer available, and all async methods now return native Promises.
• sequelize.import Removed: The sequelize.import method for loading models has been removed. You must now use Node's require or import to load model definitions.
• Operators Must Be Aliased: String-based operators (e.g., $gt, $lt) are no longer supported. You must use Sequelize.Op symbols (e.g., [Op.gt], [Op.lt]). This was a major security and usability improvement.
• Model.upsert Signature Change: The signature and return value for Model.upsert have changed. It now returns a Promise<[Model, boolean | null]>.
• CLS (Continuation Local Storage): The built-in CLS is removed. For transaction management across async calls, you must now use the cls-hooked package and configure it with Sequelize.useCLS(namespace).

Recommendation: This upgrade cannot be completed without significant code modifications. Developers must follow the official migration guide to address the breaking changes, especially the removal of sequelize.import and the mandatory use of Op symbols for all operators.

Source: Upgrade to v6 Guide

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.