[Snyk] Fix for 2 vulnerabilities

[ryanmcmorrowsnyk]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Arbitrary Code Injection SNYK-JS-LODASH-15869625	183
	Prototype Pollution SNYK-JS-LODASH-15869619	88

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Arbitrary Code Injection

[ryanmcmorrowsnyk]

sequelize 4.38.0 → 6.1.0

Risk: HIGH

This upgrade spans two major versions (v4 → v5 → v6) and introduces significant breaking changes that require mandatory code refactoring.

Key Breaking Changes:

• Native Promises: Sequelize v6 removes the Bluebird promise library in favor of native JavaScript Promises. All promise-based operations now return native Promises, and Sequelize.Promise is no longer available. Code relying on Bluebird-specific features (like .finally() or .spread()) must be updated. [1]
• Node.js Support: Support for Node.js versions below 10.x has been dropped. [1, 9]
• Model Loading: The sequelize.import() method has been removed. You must now load models directly using require() and pass them to the Sequelize constructor. [1]
• Operators: String-based operator aliases, which were deprecated in v4, are now fully removed in v5+. All queries must use Symbol-based operators (e.g., [Sequelize.Op.eq]). [2]
• Model.upsert(): The method signature has changed. It now returns an array containing the instance and a boolean indicating if it was created: [instance, created]. [1]

Recommendation: This is a major refactoring effort. Developers must carefully review the v5 and v6 migration guides to address the promise library changes, update model loading logic, and ensure all query operators are using the Sequelize.Op syntax.

Source: Sequelize v5 Breaking Changes, Sequelize v6 Upgrade Guide

elasticsearch 14.2.2 → 16.7.3

Risk: MEDIUM

This is a major version upgrade across two versions (v14 → v16). While the official client is designed for forward compatibility with the Elasticsearch server, a jump of this size introduces uncertainty. [19, 21] The primary risk comes from the lack of specific, consolidated breaking change documentation for these older client versions and potential dropped support for older Node.js versions. Verification is required.

Source: Package documentation

lodash 4.17.4 → 4.18.1

Risk: LOW

This is a minor version upgrade that includes security patches and bug fixes. The changes address prototype pollution vulnerabilities. [10, 15] No breaking API changes are documented, and no developer action is required.

Source: Lodash Changelog

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.