Bump sequelize from 4.28.0 to 5.15.1

[dependabot[bot]]

Bumps sequelize from 4.28.0 to 5.15.1.

Release notes

Sourced from sequelize's releases.

v5.15.1

5.15.1 (2019-08-18)

Security

• sequelize.json.fn: use common path extraction for mysql/mariadb/sqlite (#11329) (9bd0bc1)

This fixes a security issue with sequelize.json() for MySQL. Old code was still used for formatting sub paths for json queries when used with sequelize.json() helper function

Example of attack vector

return User.findAll({
  where: sequelize.json("data.id')) AS DECIMAL) = 1 DELETE YOLO INJECTIONS; -- ", 1)
});

Thanks to @Kirill89 from Snyk Security Research Team for reporting this issue.

v5.15.0

5.15.0 (2019-08-14)

Features

• associations: source and target key support for belongs-to-many (#11311) (83e263b)

v5.14.0

5.14.0 (2019-08-13)

Features

• support include option in bulkInsert (#11307) (4f09899)

v5.13.1

5.13.1 (2019-08-11)

Bug Fixes

• count: fix null count with includes (#11295) (592099d)

v5.13.0

5.13.0 (2019-08-09)

Bug Fixes

... (truncated)

Commits

• 9bd0bc1 fix(sequelize.json.fn): use common path extraction for mysql/mariadb/sqlite (...
• 83e263b feat(associations): source and target key support for belongs-to-many (#11311)
• 4f09899 feat: support include option in bulkInsert (#11307)
• de06ac3 docs(security): grammar mistakes
• 29eb1c8 docs(security): add responsible disclosure policy (#11300)
• 592099d fix(count): fix null count with includes (#11295)
• 80d3625 docs(query-interface): fix typo with remove-column parameter (#11294)
• a39c63a fix(types): return a usable type when using the sequelize.models lookup (#11293)
• 98a4089 fix(types): use correct this value in getterMethods and setterMethods (#11292)
• dd428a0 refactor(association): name model that association is missing from (#11290)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by sushantdhiman, a new releaser for sequelize since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ashvalejohn/poke-log/network/alerts).