Skip to content

[Snyk] Security upgrade sequelize from 3.35.1 to 6.6.5 #106

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
saurabharch wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Security upgrade sequelize from 3.35.1 to 6.6.5 #106

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,7 @@
"redux-thunk": "^2.1.0",
"run-sequence": "^1.0.2",
"sass-loader": "^3.2.1",
"sequelize": "^3.23.3",
"sequelize": "^6.6.5",
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Oct 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

Upgrading Sequelize directly from v3.x to v6.x introduces significant breaking changes that will cause the application to fail. The codebase uses several patterns and APIs that were removed in versions 4 and 5.

Here are the main issues that need to be addressed:

  • Incompatible Dependencies: Other packages have a dependency on Sequelize and need to be updated.
    • connect-session-sequelize (currently ^3.0.0) needs to be upgraded to a version compatible with Sequelize v6 (likely v7+).
    • sequelize-handlers (currently ^0.1.7) appears to be unmaintained and is incompatible. It will need to be replaced or removed.
  • Removed Sequelize.Promise: seed.js and clearDb.js use require('sequelize').Promise, which was removed in Sequelize v4. You should switch to native Promise or another promise library like bluebird (which is already a dependency).
  • Removed Model Definition Options: All model definitions use classMethods and instanceMethods, which were removed in Sequelize v5. These models need to be refactored.
  • Deprecated Query Operators: seed.js uses string-based operators (e.g., $ne). These are deprecated and disabled by default in v5+. They must be replaced with symbol-based operators (e.g., [Op.ne]).

Given the extent of the required changes, I recommend treating this upgrade as a larger refactoring task rather than a simple dependency bump.

"sequelize-handlers": "^0.1.7",
"serve-favicon": "^2.2.0",
"socket.io": "^1.3.4",
Expand Down