Update dependency sequelize to v4.44.4 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
sequelize (source)	4.43.0 -> 4.44.4

GitHub Vulnerability Alerts

GHSA-fw4p-36j9-rrj3

Versions of sequelize prior to 4.44.4 are vulnerable to Denial of Service (DoS). The SQLite dialect fails to catch a TypeError exception for the results variable. The results value may be undefined and trigger the error on a .map call. This may allow attackers to submit malicious input that forces the exception and crashes the Node process.

The following proof-of-concept crashes the Node process:

const Sequelize = require('sequelize');

const sequelize = new Sequelize({
	dialect: 'sqlite',
	storage: 'database.sqlite'
});

const TypeError = sequelize.define('TypeError', {
	name: Sequelize.STRING,
});

TypeError.sync({force: true}).then(() => {
	return TypeError.create({name: "SELECT tbl_name FROM sqlite_master"});
});

Recommendation

Upgrade to version 4.44.4 or later.

---

Release Notes

sequelize/sequelize (sequelize)

v4.44.4

Compare Source

Bug Fixes

• sqlite: properly catch errors (#​11877) (8931bf6)

v4.44.3

Compare Source

Security

This release fixes two security issues for MySQL, both affecting same component.

https://snyk.io/vuln/SNYK-JS-SEQUELIZE-450221

• mysql: json path security issues (#​11332) (efd2f40)

v4.44.2

Compare Source

Bug Fixes

• use files and remove .npmignore (6674a3c)

v4.44.1

Compare Source

Bug Fixes

• pool: destroy pooled errors properly with replication (#​11140) (a1ccf04)

v4.44.0

Compare Source

Bug Fixes

• redshift: allow standard_conforming_strings option (#​10816) (a32263f)

Features

• postgres: enable standard conforming strings when required (#​10746) (c9d3a97)

v4.43.2

Compare Source

Bug Fixes

• mssql: subquery handling for order (#​10769) (73d7a65)

v4.43.1

Compare Source

Bug Fixes

• mysql: boolean TINYINT support (#​10660) (2f92e21)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.