[Snyk] Upgrade: pg, sequelize, sequelize-cli

[GustavoEGPerez]

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

pg
from 8.8.0 to 8.12.0 | 10 versions ahead of your current version | 3 months ago
on 2024-06-04
sequelize
from 6.27.0 to 6.37.3 | 22 versions ahead of your current version | 5 months ago
on 2024-04-13
sequelize-cli
from 6.5.2 to 6.6.2 | 3 versions ahead of your current version | a year ago
on 2023-11-03

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Prototype Pollution SNYK-JS-DOTTIE-3332763	696	Proof of Concept
	Improper Filtering of Special Elements SNYK-JS-SEQUELIZE-3324088	696	No Known Exploit
	Information Exposure SNYK-JS-SEQUELIZE-3324089	696	No Known Exploit
	Access of Resource Using Incompatible Type ('Type Confusion') SNYK-JS-SEQUELIZE-3324090	696	No Known Exploit

Release notes

Package name: pg

• 8.12.0 - 2024-06-04
• 8.11.6 - 2024-06-04
• 8.11.5 - 2024-04-02
• 8.11.4 - 2024-03-30
• 8.11.3 - 2023-08-16
• 8.11.2 - 2023-08-01
• 8.11.1 - 2023-06-26
• 8.11.0 - 2023-05-15
• 8.10.0 - 2023-03-06
• 8.9.0 - 2023-01-27
• 8.8.0 - 2022-08-23

from pg GitHub release notes

Package name: sequelize

• 6.37.3 - 2024-04-13
  

  6.37.3 (2024-04-13)

  Bug Fixes

  • postgres: use schema for foreign key constrains of a table (#17099) (6aba382)
• 6.37.2 - 2024-03-29
  

  6.37.2 (2024-03-29)

  Bug Fixes

  • add readOnly to the transaction options types and docs (#17226) (7c8972f)
• 6.37.1 - 2024-02-18
  

  6.37.1 (2024-02-18)

  Bug Fixes

  • types: Add definition of returning in SaveOptions. (#16954) (505467b)
• 6.37.0 - 2024-02-11
  

  6.37.0 (2024-02-11)

  Features

  • postgres: support connectionTimeoutMillis dialectOption (#14119) (e81200e)
• 6.36.0 - 2024-02-02
• 6.35.2 - 2023-12-11
• 6.35.1 - 2023-11-19
• 6.35.0 - 2023-11-12
• 6.34.0 - 2023-11-03
• 6.33.0 - 2023-09-08
• 6.32.1 - 2023-06-17
• 6.32.0 - 2023-06-01
• 6.31.1 - 2023-05-01
• 6.31.0 - 2023-04-09
• 6.30.0 - 2023-03-24
• 6.29.3 - 2023-03-10
• 6.29.2 - 2023-03-09
• 6.29.1 - 2023-03-07
• 6.29.0 - 2023-02-23
• 6.28.2 - 2023-02-22
• 6.28.1 - 2023-02-21
• 6.28.0 - 2022-12-20
• 6.27.0 - 2022-12-12

from sequelize GitHub release notes

Package name: sequelize-cli

• 6.6.2 - 2023-11-03
  

  6.6.2 (2023-11-03)

  Bug Fixes

  • allow : to be used in password (#1390) (a52f8bd)
• 6.6.1 - 2023-06-05
  

  6.6.1 (2023-06-05)

  Bug Fixes

  • include .cts files when discovering migrations (#1273) (4ddb8d4)
• 6.6.0 - 2023-01-25
  

  6.6.0 (2023-01-25)

  Bug Fixes

  • only show error detail when error.original is defined (#1241) (8ba4748)

  Features

  • add support for test files colocated with models (#1187) (6ba32e1)
• 6.5.2 - 2022-10-26
  

  6.5.2 (2022-10-26)

  Bug Fixes

  • types: add type declarations to package (#1185) (5dc5df3)

from sequelize-cli GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"pg","from":"8.8.0","to":"8.12.0"},{"name":"sequelize","from":"6.27.0","to":"6.37.3"},{"name":"sequelize-cli","from":"6.5.2","to":"6.6.2"}],"env":"prod","hasFixes":true,"isBreakingChange":false,"isMajorUpgrade":false,"issuesToFix":[{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-DOTTIE-3332763","issue_id":"SNYK-JS-DOTTIE-3332763","priority_score":696,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-SEQUELIZE-3324088","issue_id":"SNYK-JS-SEQUELIZE-3324088","priority_score":629,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.3","score":415},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Improper Filtering of Special Elements"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-SEQUELIZE-3324089","issue_id":"SNYK-JS-SEQUELIZE-3324089","priority_score":479,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Information Exposure"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-SEQUELIZE-3324090","issue_id":"SNYK-JS-SEQUELIZE-3324090","priority_score":529,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.3","score":315},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Access of Resource Using Incompatible Type ('Type Confusion')"}],"prId":"88da70df-e0bf-4825-8579-9cf566298366","prPublicId":"88da70df-e0bf-4825-8579-9cf566298366","packageManager":"npm","priorityScoreList":[696,629,479,529],"projectPublicId":"542654c3-8139-40e8-b9e1-c4859a75c5f6","projectUrl":"https://app.snyk.io/org/gustavoperezyssy/project/542654c3-8139-40e8-b9e1-c4859a75c5f6?utm_source=github&utm_medium=referral&page=upgrade-pr","prType":"upgrade","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["priorityScore"],"type":"auto","upgrade":["SNYK-JS-DOTTIE-3332763","SNYK-JS-SEQUELIZE-3324088","SNYK-JS-SEQUELIZE-3324089","SNYK-JS-SEQUELIZE-3324090"],"upgradeInfo":{"versionsDiff":10,"publishedDate":"2024-06-04T16:19:48.985Z"},"vulns":["SNYK-JS-DOTTIE-3332763","SNYK-JS-SEQUELIZE-3324088","SNYK-JS-SEQUELIZE-3324089","SNYK-JS-SEQUELIZE-3324090"]}'