From 877fdc3fbac82f550e0f7a791d99ceccbcbd79ca Mon Sep 17 00:00:00 2001 From: Arnaud Besnier Date: Fri, 24 Feb 2023 15:12:33 +0100 Subject: [PATCH] fix(security): patch sequelize dependency vulnerabilities --- package.json | 2 +- yarn.lock | 136 +++++++++++++++++++++++---------------------------- 2 files changed, 63 insertions(+), 75 deletions(-) diff --git a/package.json b/package.json index 8c3e4a3a7..184cae84d 100644 --- a/package.json +++ b/package.json @@ -47,7 +47,7 @@ "pluralize": "8.0.0", "progress": "2.0.3", "saslprep": "1.0.3", - "sequelize": "5.22.5", + "sequelize": "6.29.0", "spinnies": "0.5.1", "stdout-stderr": "0.1.13", "superagent": "5.1.0", diff --git a/yarn.lock b/yarn.lock index 6ea951d16..db11f26e5 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1759,6 +1759,13 @@ "@types/node" "*" "@types/responselike" "*" +"@types/debug@^4.1.7": + version "4.1.7" + resolved "https://registry.yarnpkg.com/@types/debug/-/debug-4.1.7.tgz#7cc0ea761509124709b8b2d1090d8f6c17aadb82" + integrity sha512-9AonUzyTjXXhEOa0DnqpzZi6VHlqKMswga9EXjpXnnqxwLtdvPPtlO8evrI5D9S6asFRCQ6v+wpiUKbw+vKqyg== + dependencies: + "@types/ms" "*" + "@types/glob@^7.1.1": version "7.2.0" resolved "https://registry.npmjs.org/@types/glob/-/glob-7.2.0.tgz" @@ -1845,6 +1852,11 @@ resolved "https://registry.npmjs.org/@types/minimist/-/minimist-1.2.2.tgz" integrity sha512-jhuKLIRrhvCPLqwPcx6INqmKeiA5EWrsCOPhrlFSrbrmU4ZMPjj5Ul/oLCMDO98XRUIwVm78xICz4EPCektzeQ== +"@types/ms@*": + version "0.7.31" + resolved "https://registry.yarnpkg.com/@types/ms/-/ms-0.7.31.tgz#31b7ca6407128a3d2bbc27fe2d21b345397f6197" + integrity sha512-iiUgKzV9AuaEkZqkOLDIvlQiL6ltuZd9tGcW3gwpnX8JbuiuhFlEGmmFXEXkN50Cvq7Os88IY2v0dkDqXYWVgA== + "@types/node@*": version "16.10.3" resolved "https://registry.npmjs.org/@types/node/-/node-16.10.3.tgz" @@ -1899,6 +1911,11 @@ resolved "https://registry.npmjs.org/@types/unist/-/unist-2.0.6.tgz" integrity sha512-PBjIUxZHOuj0R15/xuwJYjFi+KZdNFrehocChv4g5hu6aFroHue8m0lBP0POdK2nKzbw0cgV1mws8+V/JAcEkQ== +"@types/validator@^13.7.1": + version "13.7.14" + resolved "https://registry.yarnpkg.com/@types/validator/-/validator-13.7.14.tgz#5512aef43ba353ea2fe2d0d8c7ce71c75c2ad9e6" + integrity sha512-J6OAed6rhN6zyqL9Of6ZMamhlsOEU/poBVvbHr/dKOYKTeuYYMlDkMv+b6UUV0o2i0tw73cgyv/97WTWaUl0/g== + "@types/yargs-parser@*": version "21.0.0" resolved "https://registry.npmjs.org/@types/yargs-parser/-/yargs-parser-21.0.0.tgz" @@ -2228,11 +2245,6 @@ ansicolors@~0.3.2: resolved "https://registry.npmjs.org/ansicolors/-/ansicolors-0.3.2.tgz" integrity sha1-ZlWX3oap/+Oqm/vmyuXG6kJrSXk= -any-promise@^1.3.0: - version "1.3.0" - resolved "https://registry.npmjs.org/any-promise/-/any-promise-1.3.0.tgz" - integrity sha512-7UvmKalWRt1wgjL1RrGxoSJW/0QZFIegpeGvZG9kjp8vrRu55XTHbwnqq2GpXm9uLbcuhxm3IqX9OB4MZR1b2A== - anymatch@^3.0.3: version "3.1.3" resolved "https://registry.npmjs.org/anymatch/-/anymatch-3.1.3.tgz" @@ -2505,11 +2517,6 @@ bluebird@3.5.2: resolved "https://registry.npmjs.org/bluebird/-/bluebird-3.5.2.tgz" integrity sha512-dhHTWMI7kMx5whMQntl7Vr9C6BvV10lFXDAasnqnrMYhXVCzzk6IO9Fo2L75jXHT07WrOngL1WDXOp+yYS91Yg== -bluebird@^3.5.0: - version "3.7.2" - resolved "https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz" - integrity sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg== - bottleneck@^2.18.1: version "2.19.5" resolved "https://registry.npmjs.org/bottleneck/-/bottleneck-2.19.5.tgz" @@ -2980,14 +2987,6 @@ clone@^1.0.2: resolved "https://registry.npmjs.org/clone/-/clone-1.0.4.tgz" integrity sha512-JQHZ2QMW6l3aH/j6xCqQThY/9OH4D/9ls34cgkUBiEeocRTU04tHfKPBsUK1PqZCUQM7GiA0IIXJSuXHI64Kbg== -cls-bluebird@^2.1.0: - version "2.1.0" - resolved "https://registry.npmjs.org/cls-bluebird/-/cls-bluebird-2.1.0.tgz" - integrity sha512-XVb0RPmHQyy35Tz9z34gvtUcBKUK8A/1xkGCyeFc9B0C7Zr5SysgFaswRVdwI5NEMcO+3JKlIDGIOgERSn9NdA== - dependencies: - is-bluebird "^1.0.2" - shimmer "^1.1.0" - cmd-shim@^5.0.0: version "5.0.0" resolved "https://registry.npmjs.org/cmd-shim/-/cmd-shim-5.0.0.tgz" @@ -3492,10 +3491,10 @@ dotenv@8.2.0: resolved "https://registry.npmjs.org/dotenv/-/dotenv-8.2.0.tgz" integrity sha512-8sJ78ElpbDJBHNeBzUbUVLsqKdccaa/BXF1uPTw3GrvQTBgrQrtObr2mUrE38vzYd8cEv+m/JBfDLioYcfXoaw== -dottie@^2.0.0: - version "2.0.2" - resolved "https://registry.npmjs.org/dottie/-/dottie-2.0.2.tgz" - integrity sha512-fmrwR04lsniq/uSr8yikThDTrM7epXHBAAjH9TbeH3rEA8tdCO7mRzB9hdmdGyJCxF8KERo9CITcm3kGuoyMhg== +dottie@^2.0.2: + version "2.0.3" + resolved "https://registry.yarnpkg.com/dottie/-/dottie-2.0.3.tgz#797a4f4c92a9a65499806be4051b9d9dcd5a5d77" + integrity sha512-4liA0PuRkZWQFQjwBypdxPfZaRWiv5tkhMXY2hzsa2pNf5s7U3m9cwUchfNKe8wZQxdGPQQzO6Rm2uGe0rvohQ== dreamopt@~0.8.0: version "0.8.0" @@ -4974,10 +4973,10 @@ inflected@^1.1.6: resolved "https://registry.npmjs.org/inflected/-/inflected-1.1.7.tgz" integrity sha1-w5PfbihHLQ13swguw6ogkfS8lvk= -inflection@1.12.0: - version "1.12.0" - resolved "https://registry.npmjs.org/inflection/-/inflection-1.12.0.tgz" - integrity sha512-lRy4DxuIFWXlJU7ed8UiTJOSTqStqYdEb4CEbtXfNbkdj3nH1L+reUWiE10VWcJS2yR7tge8Z74pJjtBjNwj0w== +inflection@^1.13.2: + version "1.13.4" + resolved "https://registry.yarnpkg.com/inflection/-/inflection-1.13.4.tgz#65aa696c4e2da6225b148d7a154c449366633a32" + integrity sha512-6I/HUDeYFfuNCVS3td055BaXBwKYuzw7K3ExVMStBowKo9oOAMJIXIHvdyR3iboTCp1b+1i5DSkIZTcwIktuDw== inflight@^1.0.4: version "1.0.6" @@ -5100,11 +5099,6 @@ is-bigint@^1.0.1: dependencies: has-bigints "^1.0.1" -is-bluebird@^1.0.2: - version "1.0.2" - resolved "https://registry.npmjs.org/is-bluebird/-/is-bluebird-1.0.2.tgz" - integrity sha512-PDRu1vVip5dGQg5tfn2qVCCyxbBYu5MhYUJwSfL/RoGBI97n1fxvilVazxzptZW0gcmsMH17H4EVZZI5E/RSeA== - is-boolean-object@^1.1.0: version "1.1.2" resolved "https://registry.npmjs.org/is-boolean-object/-/is-boolean-object-1.1.2.tgz" @@ -6952,16 +6946,16 @@ modify-values@^1.0.0: resolved "https://registry.npmjs.org/modify-values/-/modify-values-1.0.1.tgz" integrity sha512-xV2bxeN6F7oYjZWTe/YPAy6MN2M+sL4u/Rlm2AHCIVGfo2p1yGmBHQ6vHehl4bRTZBdHu3TSkWdYgkwpYzAGSw== -moment-timezone@^0.5.21: - version "0.5.40" - resolved "https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.5.40.tgz" - integrity sha512-tWfmNkRYmBkPJz5mr9GVDn9vRlVZOTe6yqY92rFxiOdWXbjaR0+9LwQnZGGuNR63X456NqmEkbskte8tWL5ePg== +moment-timezone@^0.5.35: + version "0.5.42" + resolved "https://registry.yarnpkg.com/moment-timezone/-/moment-timezone-0.5.42.tgz#c59f2aa00442d0dcd1d258d2182873d637b4e17b" + integrity sha512-tjI9goqwzkflKSTxJo+jC/W8riTFwEjjunssmFvAWlvNVApjbkJM7UHggyKO0q1Fd/kZVKY77H7C9A0XKhhAFw== dependencies: - moment ">= 2.9.0" + moment "^2.29.4" -"moment@>= 2.9.0", moment@^2.24.0: +moment@^2.29.1, moment@^2.29.4: version "2.29.4" - resolved "https://registry.npmjs.org/moment/-/moment-2.29.4.tgz" + resolved "https://registry.yarnpkg.com/moment/-/moment-2.29.4.tgz#3dbe052889fe7c1b2ed966fcb3a77328964ef108" integrity sha512-5LC9SOxjSc2HF6vO2CyuTDNivEdoz2IvyJJGj6X8DJ0eFyfszE0QiEd+iXmBvUP3WHxSjFH/vIsA0EN00cgr8w== mongodb@3.6.3: @@ -7797,7 +7791,7 @@ pause-stream@0.0.11: dependencies: through "~2.3" -pg-connection-string@^2.2.3: +pg-connection-string@^2.2.3, pg-connection-string@^2.5.0: version "2.5.0" resolved "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.5.0.tgz" integrity sha512-r5o/V/ORTA6TmUnyWZR9nCj1klXCO2CEKNRlVuJptZe85QuhFayC7WeMic7ndayT5IRIR0S0xFxFi2ousartlQ== @@ -8395,12 +8389,10 @@ ret@~0.1.10: resolved "https://registry.npmjs.org/ret/-/ret-0.1.15.tgz" integrity sha512-TTlYpa+OL+vMMNG24xSlQGEJ3B/RzEfUlLct7b5G/ytav+wPrplCpVMFuwzXbkecJrb6IYo1iFb0S9v37754mg== -retry-as-promised@^3.2.0: - version "3.2.0" - resolved "https://registry.npmjs.org/retry-as-promised/-/retry-as-promised-3.2.0.tgz" - integrity sha512-CybGs60B7oYU/qSQ6kuaFmRd9sTZ6oXSc0toqePvV74Ac6/IFZSI1ReFQmtCN+uvW1Mtqdwpvt/LGOiCBAY2Mg== - dependencies: - any-promise "^1.3.0" +retry-as-promised@^7.0.3: + version "7.0.4" + resolved "https://registry.yarnpkg.com/retry-as-promised/-/retry-as-promised-7.0.4.tgz#9df73adaeea08cb2948b9d34990549dc13d800a2" + integrity sha512-XgmCoxKWkDofwH8WddD0w85ZfqYz+ZHlr5yo+3YUCfycWawU56T5ckWXsScsj5B8tqUcIG67DxXByo3VUgiAdA== retry@^0.12.0: version "0.12.0" @@ -8609,31 +8601,32 @@ seq-queue@^0.0.5: resolved "https://registry.npmjs.org/seq-queue/-/seq-queue-0.0.5.tgz" integrity sha1-1WgS4cAXpuTnw+Ojeh2m143TyT4= -sequelize-pool@^2.3.0: - version "2.3.0" - resolved "https://registry.npmjs.org/sequelize-pool/-/sequelize-pool-2.3.0.tgz" - integrity sha512-Ibz08vnXvkZ8LJTiUOxRcj1Ckdn7qafNZ2t59jYHMX1VIebTAOYefWdRYFt6z6+hy52WGthAHAoLc9hvk3onqA== +sequelize-pool@^7.1.0: + version "7.1.0" + resolved "https://registry.yarnpkg.com/sequelize-pool/-/sequelize-pool-7.1.0.tgz#210b391af4002762f823188fd6ecfc7413020768" + integrity sha512-G9c0qlIWQSK29pR/5U2JF5dDQeqqHRragoyahj/Nx4KOOQ3CPPfzxnfqFPCSB7x5UgjOgnZ61nSxz+fjDpRlJg== -sequelize@5.22.5: - version "5.22.5" - resolved "https://registry.npmjs.org/sequelize/-/sequelize-5.22.5.tgz" - integrity sha512-ySIHof18sJbeVG4zjEvsDL490cd9S14/IhkCrZR/g0C/FPlZq1AzEJVeSAo++9/sgJH2eERltAIGqYQNgVqX/A== +sequelize@6.29.0: + version "6.29.0" + resolved "https://registry.yarnpkg.com/sequelize/-/sequelize-6.29.0.tgz#7b8750487adb7502ce8a7005b460d50c8ccc58b7" + integrity sha512-m8Wi90rs3NZP9coXE52c7PL4Q078nwYZXqt1IxPvgki7nOFn0p/F0eKsYDBXCPw9G8/BCEa6zZNk0DQUAT4ypA== dependencies: - bluebird "^3.5.0" - cls-bluebird "^2.1.0" - debug "^4.1.1" - dottie "^2.0.0" - inflection "1.12.0" - lodash "^4.17.15" - moment "^2.24.0" - moment-timezone "^0.5.21" - retry-as-promised "^3.2.0" - semver "^6.3.0" - sequelize-pool "^2.3.0" + "@types/debug" "^4.1.7" + "@types/validator" "^13.7.1" + debug "^4.3.3" + dottie "^2.0.2" + inflection "^1.13.2" + lodash "^4.17.21" + moment "^2.29.1" + moment-timezone "^0.5.35" + pg-connection-string "^2.5.0" + retry-as-promised "^7.0.3" + semver "^7.3.5" + sequelize-pool "^7.1.0" toposort-class "^1.0.1" uuid "^8.3.2" validator "^13.7.0" - wkx "^0.4.8" + wkx "^0.5.0" set-blocking@^2.0.0: version "2.0.0" @@ -8664,11 +8657,6 @@ shebang-regex@^3.0.0: resolved "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz" integrity sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A== -shimmer@^1.1.0: - version "1.2.1" - resolved "https://registry.npmjs.org/shimmer/-/shimmer-1.2.1.tgz" - integrity sha512-sQTKC1Re/rM6XyFM6fIAGHRPVGvyXfgzIDvzoq608vM+jeyVD0Tu1E6Np0Kc2zAIFWIj963V2800iF/9LPieQw== - side-channel@^1.0.4: version "1.0.4" resolved "https://registry.npmjs.org/side-channel/-/side-channel-1.0.4.tgz" @@ -9892,10 +9880,10 @@ widest-line@^3.1.0: dependencies: string-width "^4.0.0" -wkx@^0.4.8: - version "0.4.8" - resolved "https://registry.npmjs.org/wkx/-/wkx-0.4.8.tgz" - integrity sha512-ikPXMM9IR/gy/LwiOSqWlSL3X/J5uk9EO2hHNRXS41eTLXaUFEVw9fn/593jW/tE5tedNg8YjT5HkCa4FqQZyQ== +wkx@^0.5.0: + version "0.5.0" + resolved "https://registry.yarnpkg.com/wkx/-/wkx-0.5.0.tgz#c6c37019acf40e517cc6b94657a25a3d4aa33e8c" + integrity sha512-Xng/d4Ichh8uN4l0FToV/258EjMGU9MGcA0HV2d9B/ZpZB3lqQm7nkOdZdm5GhKtLLhAE7PiVQwN4eN+2YJJUg== dependencies: "@types/node" "*"