Update dependency sequelize to v4.44.4 [SECURITY]

[renovate[bot]]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
sequelize (source)	4.6.0 -> 4.44.4

GitHub Vulnerability Alerts

CVE-2019-10752

Affected versions of sequelize are vulnerable to SQL Injection. The function sequelize.json() incorrectly formatted sub paths for JSON queries, which allows attackers to inject SQL statements and execute arbitrary SQL queries if user input is passed to the query. Exploitation example:

  where: this.sequelize.json("data.id')) AS DECIMAL) = 1 DELETE YOLO INJECTIONS; -- ", 1)
});```

## Recommendation

If you are using `sequelize` 5.x, upgrade to version 5.15.1 or later.
If you are using `sequelize` 4.x, upgrade to version 4.44.3 or later.

#### [CVE-2019-10748](https://nvd.nist.gov/vuln/detail/CVE-2019-10748)

Affected versions of `sequelize` are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the MariaDB and MySQL dialects,  which may allow attackers to inject SQL statements and execute arbitrary SQL queries.

## Recommendation

If you are using `sequelize` 5.x, upgrade to version 5.8.11 or later.
If you are using `sequelize` 4.x, upgrade to version 4.44.3 or later.
If you are using `sequelize` 3.x, upgrade to version 3.35.1 or later.

#### [GHSA-fw4p-36j9-rrj3](https://togithub.com/sequelize/sequelize/pull/11877)

Versions of `sequelize` prior to 4.44.4 are vulnerable to Denial of Service (DoS). The SQLite dialect fails to catch a `TypeError` exception for the `results` variable. The `results` value may be undefined and trigger the error on a `.map` call. This may allow attackers to submit malicious input that forces the exception and crashes the Node process.  

The following proof-of-concept crashes the Node process:  

const Sequelize = require('sequelize');

const sequelize = new Sequelize({ dialect: 'sqlite', storage: 'database.sqlite' });

const TypeError = sequelize.define('TypeError', { name: Sequelize.STRING, });

TypeError.sync({force: true}).then(() => { return TypeError.create({name: "SELECT tbl_name FROM sqlite_master"}); });

## Recommendation

Upgrade to version 4.44.4 or later.

#### [GHSA-wfp9-vr4j-f49j](https://togithub.com/sequelize/sequelize/issues/7310)

Versions of `sequelize` prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as `$gt` are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection.

## Recommendation

Upgrade to version 4.12.0 or later

---

### Release Notes

<details>
<summary>sequelize/sequelize</summary>

### [`v4.44.4`](https://togithub.com/sequelize/sequelize/releases/v4.44.4)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.44.3...v4.44.4)

##### Bug Fixes

-   **sqlite:** properly catch errors ([#&#8203;11877](https://togithub.com/sequelize/sequelize/issues/11877)) ([8931bf6](https://togithub.com/sequelize/sequelize/commit/8931bf6c567b4cb3b35de8993cf74c82008b4275))

### [`v4.44.3`](https://togithub.com/sequelize/sequelize/releases/v4.44.3)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.44.2...v4.44.3)

##### Security

This release fixes two security issues for MySQL, both affecting same component.

<https://snyk.io/vuln/SNYK-JS-SEQUELIZE-450221>

-   **mysql:** json path security issues ([#&#8203;11332](https://togithub.com/sequelize/sequelize/issues/11332)) ([efd2f40](https://togithub.com/sequelize/sequelize/commit/efd2f40))

### [`v4.44.2`](https://togithub.com/sequelize/sequelize/releases/v4.44.2)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.44.1...v4.44.2)

##### Bug Fixes

-   use files and remove .npmignore ([6674a3c](https://togithub.com/sequelize/sequelize/commit/6674a3c))

### [`v4.44.1`](https://togithub.com/sequelize/sequelize/releases/v4.44.1)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.44.0...v4.44.1)

##### Bug Fixes

-   **pool:** destroy pooled errors properly with replication ([#&#8203;11140](https://togithub.com/sequelize/sequelize/issues/11140)) ([a1ccf04](https://togithub.com/sequelize/sequelize/commit/a1ccf04))

### [`v4.44.0`](https://togithub.com/sequelize/sequelize/releases/v4.44.0)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.43.2...v4.44.0)

##### Bug Fixes

-   **redshift:** allow standard_conforming_strings option ([#&#8203;10816](https://togithub.com/sequelize/sequelize/issues/10816)) ([a32263f](https://togithub.com/sequelize/sequelize/commit/a32263f))

##### Features

-   **postgres:** enable standard conforming strings when required ([#&#8203;10746](https://togithub.com/sequelize/sequelize/issues/10746)) ([c9d3a97](https://togithub.com/sequelize/sequelize/commit/c9d3a97))

### [`v4.43.2`](https://togithub.com/sequelize/sequelize/releases/v4.43.2)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.43.1...v4.43.2)

##### Bug Fixes

-   **mssql:** subquery handling for order ([#&#8203;10769](https://togithub.com/sequelize/sequelize/issues/10769)) ([73d7a65](https://togithub.com/sequelize/sequelize/commit/73d7a65))

### [`v4.43.1`](https://togithub.com/sequelize/sequelize/releases/v4.43.1)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.43.0...v4.43.1)

##### Bug Fixes

-   **mysql:** boolean TINYINT support ([#&#8203;10660](https://togithub.com/sequelize/sequelize/issues/10660)) ([2f92e21](https://togithub.com/sequelize/sequelize/commit/2f92e21))

### [`v4.43.0`](https://togithub.com/sequelize/sequelize/releases/v4.43.0)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.42.1...v4.43.0)

##### Features

-   **datatypes:** handle numbers passed as objects for bigint ([#&#8203;10496](https://togithub.com/sequelize/sequelize/issues/10496)) ([de39cff](https://togithub.com/sequelize/sequelize/commit/de39cff))

### [`v4.42.1`](https://togithub.com/sequelize/sequelize/releases/v4.42.1)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.42.0...v4.42.1)

##### Bug Fixes

-   locking generic-pool to 3.5.0 ([00e4984](https://togithub.com/sequelize/sequelize/commit/00e4984))

### [`v4.42.0`](https://togithub.com/sequelize/sequelize/releases/v4.42.0)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.41.2...v4.42.0)

##### Features

-   **transaction:** afterCommit hook ([#&#8203;10260](https://togithub.com/sequelize/sequelize/issues/10260)) ([d2428dd](https://togithub.com/sequelize/sequelize/commit/d2428dd))

### [`v4.41.2`](https://togithub.com/sequelize/sequelize/releases/v4.41.2)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.41.1...v4.41.2)

##### Bug Fixes

-   **query-generator:** add offset to unioned queries ([#&#8203;10149](https://togithub.com/sequelize/sequelize/issues/10149)) ([34e9fe1](https://togithub.com/sequelize/sequelize/commit/34e9fe1))

### [`v4.41.1`](https://togithub.com/sequelize/sequelize/releases/v4.41.1)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.41.0...v4.41.1)

##### Bug Fixes

-   **syntax:** correct parentheses around union ([#&#8203;9813](https://togithub.com/sequelize/sequelize/issues/9813)) ([#&#8203;10003](https://togithub.com/sequelize/sequelize/issues/10003)) ([#&#8203;10121](https://togithub.com/sequelize/sequelize/issues/10121)) ([4ff79dc](https://togithub.com/sequelize/sequelize/commit/4ff79dc))

### [`v4.41.0`](https://togithub.com/sequelize/sequelize/releases/v4.41.0)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.40.0...v4.41.0)

##### Features

-   deprecate aliases removed from v5.beta ([1bc8b0e](https://togithub.com/sequelize/sequelize/commit/1bc8b0e)) ([c6c2d17](https://togithub.com/sequelize/sequelize/commit/c6c2d17))

### [`v4.40.0`](https://togithub.com/sequelize/sequelize/releases/v4.40.0)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.39.1...v4.40.0)

##### Features

-   **associations:** enable overwrite unique constraint key name ([#&#8203;10045](https://togithub.com/sequelize/sequelize/issues/10045)) ([43ab707](https://togithub.com/sequelize/sequelize/commit/43ab707))

### [`v4.39.1`](https://togithub.com/sequelize/sequelize/releases/v4.39.1)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.39.0...v4.39.1)

##### Bug Fixes

-   **validators:** backport memory leak fix for isImmutable ([#&#8203;9973](https://togithub.com/sequelize/sequelize/issues/9973)) ([#&#8203;10031](https://togithub.com/sequelize/sequelize/issues/10031)) ([8fe475b](https://togithub.com/sequelize/sequelize/commit/8fe475b))

### [`v4.39.0`](https://togithub.com/sequelize/sequelize/releases/v4.39.0)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.38.1...v4.39.0)

##### Features

-   **postgres:** support ignoreDuplicates for postges >= 9.5 ([#&#8203;9954](https://togithub.com/sequelize/sequelize/issues/9954)) ([4e439fa](https://togithub.com/sequelize/sequelize/commit/4e439fa))

### [`v4.38.1`](https://togithub.com/sequelize/sequelize/releases/v4.38.1)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.38.0...v4.38.1)

##### Bug Fixes

-   **count:** duplicate mapping of fields break scopes ([#&#8203;9821](https://togithub.com/sequelize/sequelize/issues/9821)) ([e3bba44](https://togithub.com/sequelize/sequelize/commit/e3bba44))
-   **transaction:** prevent rollback without connection ([#&#8203;9889](https://togithub.com/sequelize/sequelize/issues/9889)) ([e26f62f](https://togithub.com/sequelize/sequelize/commit/e26f62f))

### [`v4.38.0`](https://togithub.com/sequelize/sequelize/releases/v4.38.0)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.37.10...v4.38.0)

##### Features

-   **data-types:** network types for Postgres ([#&#8203;9571](https://togithub.com/sequelize/sequelize/issues/9571)) ([2c3a6e7](https://togithub.com/sequelize/sequelize/commit/2c3a6e7))

### [`v4.37.10`](https://togithub.com/sequelize/sequelize/releases/v4.37.10)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.37.9...v4.37.10)

##### Bug Fixes

-   **transactions:** return patched promise from sequelize.query ([#&#8203;9473](https://togithub.com/sequelize/sequelize/issues/9473)) ([b903384](https://togithub.com/sequelize/sequelize/commit/b903384))

### [`v4.37.9`](https://togithub.com/sequelize/sequelize/releases/v4.37.9)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.37.8...v4.37.9)

##### Bug Fixes

-   set deployment to v4 ([51797c7](https://togithub.com/sequelize/sequelize/commit/51797c7))

### [`v4.37.8`](https://togithub.com/sequelize/sequelize/releases/v4.37.8)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.37.7...v4.37.8)

##### Bug Fixes

-   **query-generator:** regexp operator ([ab1c1e3](https://togithub.com/sequelize/sequelize/commit/ab1c1e3))

### [`v4.37.7`](https://togithub.com/sequelize/sequelize/releases/v4.37.7)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.37.6...v4.37.7)

##### Bug Fixes

-   **postgres/query-generator:** syntax error with auto-increment SMALLINT ([#&#8203;9406](https://togithub.com/sequelize/sequelize/issues/9406)) ([20f7eb4](https://togithub.com/sequelize/sequelize/commit/20f7eb4))

### [`v4.37.6`](https://togithub.com/sequelize/sequelize/releases/v4.37.6)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.37.5...v4.37.6)

##### Bug Fixes

-   **model:** don't add LIMIT in findOne() queries on unique key ([#&#8203;9273](https://togithub.com/sequelize/sequelize/issues/9273)) ([f0ae18d](https://togithub.com/sequelize/sequelize/commit/f0ae18d))

### [`v4.37.5`](https://togithub.com/sequelize/sequelize/releases/v4.37.5)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.37.4...v4.37.5)

##### Bug Fixes

-   **query-generator:** 1-to-many join in subQuery filter missing where clause ([#&#8203;9228](https://togithub.com/sequelize/sequelize/issues/9228)) ([#&#8203;9247](https://togithub.com/sequelize/sequelize/issues/9247)) ([3b623cb](https://togithub.com/sequelize/sequelize/commit/3b623cb))

### [`v4.37.4`](https://togithub.com/sequelize/sequelize/releases/v4.37.4)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.37.3...v4.37.4)

##### Bug Fixes

-   **query-generator:** generate subQuery filter for nested required joins ([#&#8203;9188](https://togithub.com/sequelize/sequelize/issues/9188)) ([20cac7a](https://togithub.com/sequelize/sequelize/commit/20cac7a))

### [`v4.37.3`](https://togithub.com/sequelize/sequelize/releases/v4.37.3)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.37.2...v4.37.3)

##### Bug Fixes

-   **transaction:** only rollback if connection was acquired ([#&#8203;9051](https://togithub.com/sequelize/sequelize/issues/9051)) ([a7e9e2b](https://togithub.com/sequelize/sequelize/commit/a7e9e2b))

### [`v4.37.2`](https://togithub.com/sequelize/sequelize/releases/v4.37.2)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.37.1...v4.37.2)

##### Bug Fixes

-   **query/abstract:** typo in error message ([#&#8203;9201](https://togithub.com/sequelize/sequelize/issues/9201)) ([ec0cb5e](https://togithub.com/sequelize/sequelize/commit/ec0cb5e))

### [`v4.37.1`](https://togithub.com/sequelize/sequelize/releases/v4.37.1)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.37.0...v4.37.1)

##### Bug Fixes

-   **model/aggregate:** inject scope before conforming options ([#&#8203;9190](https://togithub.com/sequelize/sequelize/issues/9190)) ([ba49c7f](https://togithub.com/sequelize/sequelize/commit/ba49c7f))

### [`v4.37.0`](https://togithub.com/sequelize/sequelize/releases/v4.37.0)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.36.1...v4.37.0)

##### Features

-   **mssql/describeTable:** include auto increment flag ([#&#8203;9171](https://togithub.com/sequelize/sequelize/issues/9171)) ([4daf522](https://togithub.com/sequelize/sequelize/commit/4daf522))

### [`v4.36.1`](https://togithub.com/sequelize/sequelize/releases/v4.36.1)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.36.0...v4.36.1)

##### Bug Fixes

-   **bulkCreate:** updateOnDuplicate doesn't map back to fields  ([#&#8203;9162](https://togithub.com/sequelize/sequelize/issues/9162)) ([83dfc5a](https://togithub.com/sequelize/sequelize/commit/83dfc5a))

### [`v4.36.0`](https://togithub.com/sequelize/sequelize/releases/v4.36.0)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.35.5...v4.36.0)

##### Features

-   **model:** decrement method ([7c1eb9b](https://togithub.com/sequelize/sequelize/commit/7c1eb9b))

### [`v4.35.5`](https://togithub.com/sequelize/sequelize/releases/v4.35.5)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.35.4...v4.35.5)

##### Bug Fixes

-   **scope:** include scope on eagerly created associations ([#&#8203;9127](https://togithub.com/sequelize/sequelize/issues/9127)) ([969978d](https://togithub.com/sequelize/sequelize/commit/969978d))

### [`v4.35.4`](https://togithub.com/sequelize/sequelize/releases/v4.35.4)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.35.3...v4.35.4)

##### Bug Fixes

-   **postgresql:** search path with datatypes that use dynamic oids ([#&#8203;9148](https://togithub.com/sequelize/sequelize/issues/9148)) ([2365206](https://togithub.com/sequelize/sequelize/commit/2365206))

### [`v4.35.3`](https://togithub.com/sequelize/sequelize/releases/v4.35.3)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.35.2...v4.35.3)

##### Bug Fixes

-   **model/bulkCreate:** properly pass error instances to AggregateError ([#&#8203;9133](https://togithub.com/sequelize/sequelize/issues/9133)) ([78a1fb6](https://togithub.com/sequelize/sequelize/commit/78a1fb6))

### [`v4.35.2`](https://togithub.com/sequelize/sequelize/releases/v4.35.2)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.35.1...v4.35.2)

##### Bug Fixes

-   escape attributes ([c6cf176](https://togithub.com/sequelize/sequelize/commit/c6cf176))

### [`v4.35.1`](https://togithub.com/sequelize/sequelize/releases/v4.35.1)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.35.0...v4.35.1)

##### Bug Fixes

-   **query-generator:** allow Op as comparator in sequelize.where ([#&#8203;9124](https://togithub.com/sequelize/sequelize/issues/9124)) ([476b08b](https://togithub.com/sequelize/sequelize/commit/476b08b))

### [`v4.35.0`](https://togithub.com/sequelize/sequelize/releases/v4.35.0)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.34.1...v4.35.0)

##### Bug Fixes

-   update validator.js to prevent denial of service ([#&#8203;9112](https://togithub.com/sequelize/sequelize/issues/9112)) ([bee03c1](https://togithub.com/sequelize/sequelize/commit/bee03c1))

##### Features

-   **dropSchema:** support for mssql ([#&#8203;9081](https://togithub.com/sequelize/sequelize/issues/9081)) ([5b6dae7](https://togithub.com/sequelize/sequelize/commit/5b6dae7))

### [`v4.34.1`](https://togithub.com/sequelize/sequelize/releases/v4.34.1)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.34.0...v4.34.1)

##### Bug Fixes

-   **model/upsert:** support options.validation ([#&#8203;8872](https://togithub.com/sequelize/sequelize/issues/8872)) ([191819f](https://togithub.com/sequelize/sequelize/commit/191819f))

### [`v4.34.0`](https://togithub.com/sequelize/sequelize/releases/v4.34.0)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.33.4...v4.34.0)

##### Bug Fixes

-   **sequelize/query:** use hasOwnProperty for keys in query ([#&#8203;9100](https://togithub.com/sequelize/sequelize/issues/9100)) ([#&#8203;9101](https://togithub.com/sequelize/sequelize/issues/9101)) ([222b13f](https://togithub.com/sequelize/sequelize/commit/222b13f))

##### Features

-   **query:** add ability to pass arrays as replacements ([#&#8203;9050](https://togithub.com/sequelize/sequelize/issues/9050)) ([#&#8203;9054](https://togithub.com/sequelize/sequelize/issues/9054)) ([60c04d9](https://togithub.com/sequelize/sequelize/commit/60c04d9))

### [`v4.33.4`](https://togithub.com/sequelize/sequelize/releases/v4.33.4)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.33.3...v4.33.4)

##### Bug Fixes

-   **mssql:** reject if end was called before connect ([#&#8203;9037](https://togithub.com/sequelize/sequelize/issues/9037)) ([e92dc6f](https://togithub.com/sequelize/sequelize/commit/e92dc6f))

### [`v4.33.3`](https://togithub.com/sequelize/sequelize/releases/v4.33.3)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.33.2...v4.33.3)

##### Bug Fixes

-   **indexes:** duplicate unique indexes with sync ([#&#8203;9033](https://togithub.com/sequelize/sequelize/issues/9033)) ([0abea9f](https://togithub.com/sequelize/sequelize/commit/0abea9f))

### [`v4.33.2`](https://togithub.com/sequelize/sequelize/releases/v4.33.2)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.33.1...v4.33.2)

##### Bug Fixes

-   **postgres/connection-manager:** Don't leak OIDs between instances ([#&#8203;9026](https://togithub.com/sequelize/sequelize/issues/9026)) ([d92d0d5](https://togithub.com/sequelize/sequelize/commit/d92d0d5))

### [`v4.33.1`](https://togithub.com/sequelize/sequelize/releases/v4.33.1)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.33.0...v4.33.1)

##### Bug Fixes

-   **escape:** Escape null character in postgres ([#&#8203;9006](https://togithub.com/sequelize/sequelize/issues/9006)) ([7cb7394](https://togithub.com/sequelize/sequelize/commit/7cb7394))

### [`v4.33.0`](https://togithub.com/sequelize/sequelize/releases/v4.33.0)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.32.7...v4.33.0)

##### Features

-   **mysql:** bind parameters ([#&#8203;8861](https://togithub.com/sequelize/sequelize/issues/8861)) ([f8a98a1](https://togithub.com/sequelize/sequelize/commit/f8a98a1))

### [`v4.32.7`](https://togithub.com/sequelize/sequelize/releases/v4.32.7)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.32.6...v4.32.7)

##### Bug Fixes

-   **sequelize/query:** retry entire query ([#&#8203;8991](https://togithub.com/sequelize/sequelize/issues/8991)) ([0cf1911](https://togithub.com/sequelize/sequelize/commit/0cf1911))

### [`v4.32.6`](https://togithub.com/sequelize/sequelize/releases/v4.32.6)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.32.5...v4.32.6)

##### Bug Fixes

-   **model/findOrBuild:** handle includes ([#&#8203;8938](https://togithub.com/sequelize/sequelize/issues/8938)) ([a54a7a5](https://togithub.com/sequelize/sequelize/commit/a54a7a5))

### [`v4.32.5`](https://togithub.com/sequelize/sequelize/releases/v4.32.5)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.32.4...v4.32.5)

##### Bug Fixes

-   remove pg-types from dependencies ([d65a95c](https://togithub.com/sequelize/sequelize/commit/d65a95c))

### [`v4.32.4`](https://togithub.com/sequelize/sequelize/releases/v4.32.4)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.32.3...v4.32.4)

##### Bug Fixes

-   pg@7 incompatibilities ([#&#8203;8979](https://togithub.com/sequelize/sequelize/issues/8979)) ([a9730aa](https://togithub.com/sequelize/sequelize/commit/a9730aa))

### [`v4.32.3`](https://togithub.com/sequelize/sequelize/releases/v4.32.3)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.32.2...v4.32.3)

##### Bug Fixes

-   **model:** omit `offset` in findSeparate ([#&#8203;8987](https://togithub.com/sequelize/sequelize/issues/8987)) ([b545767](https://togithub.com/sequelize/sequelize/commit/b545767))

### [`v4.32.2`](https://togithub.com/sequelize/sequelize/releases/v4.32.2)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.32.1...v4.32.2)

##### Bug Fixes

-   **symbols:** symbols not assigned by lodash.defaults ([#&#8203;8937](https://togithub.com/sequelize/sequelize/issues/8937)) ([0258081](https://togithub.com/sequelize/sequelize/commit/0258081))

### [`v4.32.1`](https://togithub.com/sequelize/sequelize/releases/v4.32.1)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.32.0...v4.32.1)

##### Bug Fixes

-   **selectQuery:** don't add empty HAVING clause ([#&#8203;8931](https://togithub.com/sequelize/sequelize/issues/8931)) ([335efd6](https://togithub.com/sequelize/sequelize/commit/335efd6))

### [`v4.32.0`](https://togithub.com/sequelize/sequelize/releases/v4.32.0)

[Compare Source](https://togithub.com/sequelize/sequelize/compare/v4.31.2...v4.32.0)

##### Features

-   **upsert:** return upserted record with `options.returning=true` ([#&#8203;8924](https://togithub.com/sequelize/sequelize/issues/8924)) ([a4a0f88](https://togithub.com/sequelize/sequelize/commit/a4a0f88))

```js
/**
 * Current behaviour
 */
const created = await Model.upsert(....values....);

/**
 * New feature
 */

// with options.returning = false / undefined
const created = await Model.upsert(....values...., { returning: false });

// with options.returning = true
const [record, created] = await Model.upsert(....values...., { returning: true });

v4.31.2

Compare Source

Bug Fixes

• datatypes: Sequelize.NOW set milliseconds to zero (#​8896) (781d528)

v4.31.1

Compare Source

Bug Fixes

• findAndCount: throws unhandled rejection from findAll (#​8887) (48e8f7b)

v4.31.0

Compare Source

Features

• sequelize.random() (#​8847) (6f32643)

v4.30.2

Compare Source

Bug Fixes

• scopes: scope is injected after checking for options.where (#​8864) (40f7d21)

v4.30.1

Compare Source

Bug Fixes

• scope: symbol operators are ignored (#​8863) (3ed0c08)

v4.30.0

Compare Source

Features

• operators: use global symbol registry (14864d4)

v4.29.3

Compare Source

Bug Fixes

• destroy with paranoid ignores operators (#​8860) (1823f5d)

v4.29.2

Compare Source

Bug Fixes

• remove constraint before alter foreign keys (#​8795) (bb2d0bd)

v4.29.1

Compare Source

Bug Fixes

• base type wont work after ENUM model is synced (#​8851) (d98d8bd)

v4.29.0

Compare Source

Features

• mssql: table hints (#​8843) (11ff776)

v4.28.8

Compare Source

Bug Fixes

• mysql/datatypes: no default null value for some data types (#​8839) (74d2b5f)

v4.28.7

Compare Source

Bug Fixes

• query-generator: Op.ne check with null value is not comparing with comparator (3397b23), closes #​8816

v4.28.6

Compare Source

Bug Fixes

• model: set previous values in instances from bulkCreate (#​8788) (68d729d)

v4.28.5

Compare Source

Bug Fixes

• mysql/json: properly quote JSON path to be valid ECMAScript name (#​8793) (b0bd34d)

v4.28.4

Compare Source

Bug Fixes

• keep pk ids if supplied by users (#​8792) (d4acd7c)

v4.28.3

Compare Source

Bug Fixes

• connection-manager: only use close to shutdown (#​8789) (ca788b7)

v4.28.2

Compare Source

Bug Fixes

• mssql: improper parameter binding in sql generation (#​8782) (3657f32)

v4.28.1

Compare Source

Bug Fixes

• memory-utilization: don't keep bounded reference of connection manager (#​8760) (fea0ca7)

v4.28.0

Compare Source

Features

• postgres: returning option for arithmetic queries (#​8727) (#​8748) (b4fd464)

v4.27.0

Compare Source

Features

• added _scopeName property in instance (#​8753) (438baac)

v4.26.0

Compare Source

Features

• datatypes: array(enum) support for PostgreSQL (#​8738) (fe06b45)

v4.25.2

Compare Source

Bug Fixes

• associations/has-many: use scoped primary field on count to prevent ambiguous column error (#​8732) (f5fcf16)

v4.25.1

Compare Source

Bug Fixes

• model: ordering by renamed sub-query attribute (#​8740) (ae9abbb)

v4.25.0

Compare Source

Features

• query-interface/createFunction: add ability to pass query options and add missing docs (#​8742) (b64e01c)

v4.24.0

Compare Source

Features

• model/update: support paranoid option (#​8735) (ed111c0)

v4.23.4

Compare Source

Bug Fixes

• model: pick own properties for attributes / getters / sanitizors (fix #​8719) (#​8720) (2123ee5)

v4.23.3

Compare Source

Bug Fixes

• mssql/transaction: name is too long when using more than 9 savepoints (#​8717) (5c3b4e3)

v4.23.2

Compare Source

Bug Fixes

• mssql/bulkInsertQuery: handle cases when no autoIncrement field exists, fix #​8645 (ab99e15)

v4.23.1

Compare Source

v4.23.0

Compare Source

v4.22.16

Compare Source

v4.22.15

Compare Source

v4.22.14

Compare Source

v4.22.13

Compare Source

v4.22.12

Compare Source

Bug Fixes

• breaking changes in mysql2, handle null buffer (#​8678) (6931c79)

v4.22.11

Compare Source

v4.22.10

Compare Source

v4.22.9

Compare Source

Bug Fixes

• hook proxies are not added when defined with hooks options (#​8664) (2afd48a)

v4.22.8

Compare Source

v4.22.7

Compare Source

Bug Fixes

• ignore falsy attribute.unique property, fixed #​8620 (#​8625) (0e7ce34)

v4.22.6

Compare Source

v4.22.5

Compare Source

Bug Fixes

• optimistic_locking: increment version attribute with Model.decrement (#​8593) (0047dca)

v4.22.4

Compare Source

v4.22.3

Compare Source

v4.22.2

Compare Source

v4.22.1

Compare Source

v4.22.0

Compare Source

Features

• validation: new properties for ValidationErrorItem class (#​7557) (34d075e)

v4.21.0

Compare Source

Features

• pooling: reuse connections with returnToHead (#​8567) (eff8fb5)

v4.20.3

Compare Source

v4.20.2

Compare Source

v4.20.1

Compare Source

v4.20.0

Compare Source

Features

• increment: support scopes (#​8541) (b9a9ef2)

v4.19.0

Compare Source

Features

• instance-validator: add model name to allowNull messages (#​8500) (089504f)

v4.18.0

Compare Source

Features

• MySQL JSON support (#​7106) (e40f6f4)

v4.17.2

Compare Source

v4.17.1

Compare Source

v4.17.0

Compare Source

Features

• sqlite/query-generator: support delete/destory with limit via rowid for SQLite (#​8494) (bf837ec)

v4.16.2

Compare Source

Bug Fixes

• query: incorrect arguments passed to SQLString.escape (#​8520) (a07fb75)

v4.16.1

Compare Source

Bug Fixes

• abstract/connection-manager/replication: return promise from destroy (#​8519) (1ad7a40)

v4.16.0

Compare Source

Features

• data-types: add TINYINT, SMALLINT, MEDIUMINT (#​8515) (3c19e97)

v4.15.2

Compare Source

Bug Fixes

• abstract-query: properly hash primaryKey for buffers (#​8174) (17b19d9)

v4.15.1

Compare Source

v4.15.0

Compare Source

Features

• sqlite: partial indexes (#​8495) (4a920e9)

v4.14.0

Compare Source

Features

• sqlite/query-generator: sqlite update supporting limit via rowid (#​8450) (1686469)

v4.13.17

Compare Source

Bug Fixes

• paranoid: use Utils.now to query for paranoid records (#​8485) (9558242)

v4.13.16

Compare Source

Bug Fixes

• getForeignKeysForTables: properly parse multiple fk (bf5fa6d)
• queryInterface/getForeignKeysForTables: use FOREIGNKEYS query type (a6c1f8f)

v4.13.15

Compare Source

Bug Fixes

• postgres/createSchema: support for create schema if not exists when postgres version is suitable (#​8484) (c933bed)

v4.13.14

Compare Source

Bug Fixes

• datatypes: DATE/DATEONLY marked as changed when changed from null to null (#​8483) (8862212)

v4.13.13

Compare Source

Bug Fixes

• sequelize/sync: show database name and match condition when sync is rejected (#​8482) (669f09f)

v4.13.12

Compare Source

Bug Fixes

• where: show inspected value for incorrect where conditions (#​8481) (44ad6ba)

v4.13.11

Compare Source

Bug Fixes

• abstract/query-generator: properly escape/stringify IN values as per field definition (#​8480) (4ff6408)

v4.13.10

Compare Source

Bug Fixes

• abstract/query-generator: correctly name indexes that live in custom schemas (#​8151) (321394b)

v4.13.9

Compare Source

v4.13.8

Compare Source

Bug Fixes

• transactions: don't use CLS on manually manged transactions (#​8430) (e2dad2f)

v4.13.7

Compare Source

Bug Fixes

• model: handle Symbol-only where clauses (#​8435) (e695b92)

v4.13.6

Compare Source

v4.13.5

Compare Source

v4.13.4

Compare Source

Bug Fixes

• errors: spurious Bluebird warnings (#​8408) (ea8e631)

v4.13.3

Compare Source

v4.13.2

Compare Source

v4.13.1

Compare Source

Bug Fixes

• model/upsert: doesnt work with Infinity dates (#​8397) (b4ce008)

v4.13.0

Compare Source

Features

• mysql/errors: foreign key errors with more useful information (#​8379) (6b11669)

v4.12.0

Compare Source

Features

• query-generator: change operators to be represented by symbols (#​8240) (ccb99da)

v4.11.7

Compare Source

Bug Fixes

• queryInterface/changeColumn: error when removing a column with unique constraint (#​8386) (9ca86af)

v4.11.6

Compare Source

4.11.6 (2017-09-30)

v4.11.5

Compare Source

Bug Fixes

• model: dont mark value changed by custom setters if there is no change (#​8389) (6adfabf)

v4.11.4

Compare Source

Bug Fixes

• model: properly serialize WHERE attributes in soft delete (#​8383) (ba7aa33)

v4.11.3

Compare Source

4.11.3 (2017-09-28)

v4.11.2

Compare Source

Bug Fixes

• dateonly: set NULL correctly (576e434)

v4.11.1

Compare Source

Bug Fixes

• postgres/date: support for infinity timestamp (#​8357) (e01cc2f)

v4.11.0

Compare Source

Refactor

• use lodash directly (#​8368) (3fedaa4)

v4.10.3

Compare Source

Bug Fixes

• model/increment: properly map fields for attributes in by option (#​8363) (95901ab)

v4.10.2

Compare Source

4.10.2 (2017-09-23)

v4.10.1

Compare Source

Bug Fixes

• query-generator: options.group should be quoted (#​8326) (7229ccb)
• query-generator: Reverted #​8278

v4.10.0

Compare Source

Features

• postgres connection option 'statement_timeout' (#​8342) (30f0774)

v4.9.0

Compare Source

Fixed

• Resource is currently not a part of pool error #​8098
• Pool destroy error #​8185
• Pooled connection exceeded the 'max_user_connections' resource 8076

v4.8.4

Compare Source

Bug Fixes

• abstract/querygenerator: remove duplicated order expression on outer query (#​8278) (a8310bf)
• model/create: doesnot work with custom sourceKey (#​8284) (de0fbff)
• query: does not include primary key when grouping (#​8162) (f00bd96)

v4.8.3

Compare Source

Bug Fixes

• instance/decrement: doesn't work with negative value (#​8267) (8b20a45)
• queryGenerator: createTrigger fails with correct event specs (#​8282) (bde6d50)
• sequelize/query: release connection after all retries (#​8247) (1e0d9a8)

Features

• mysql/addColumn: supports FIRST keyword (#​7943) (e41590a)

v4.8.2

Compare Source

Bug Fixes

• bulkCreate: error with updateOnDuplicate option (#​8259) (fdf3e99)

v4.8.1

Compare Source

Bug Fixes

• findAll/deep-nested-includes: incorrect alias with -> when subquery still using . #​7742 (#​7795) (63978e1)
• findOrCreate: error with unique constraint when complex where is used (#​8093) (8a95e42)

v4.8.0

Compare Source

Bug Fixes

• association/count: use model field in count[Association] (#​8227) (c528f6d)
• datatypes/range: don't stringify infinite and null bounds (fixes: #​8192) (#​8210) (5d2ba05)
• model/findAndCount: no need to check count, its already zero (#​8225) (785383e)

Features

• scopes: allow scope groups to

---

Renovate configuration

:date: Schedule: "" (UTC).

:vertical_traffic_light: Automerge: Disabled by config. Please merge this manually once you are satisfied.

:recycle: Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

:no_bell: Ignore: Close this PR and you won't be reminded about this update again.

---

• [ ] If you want to rebase/retry this PR, check this box

---

This PR has been generated by WhiteSource Renovate. View repository job log here.

[secure-code-warrior-for-github[bot]]

Micro-Learning Topic: SQL Injection (Detected by phrase)

What is this? (2min video)

This is probably one of the two most exploited vulnerabilities in web applications and has led to a number of high profile company breaches. It occurs when an application fails to sanitize or validate input before using it to dynamically construct a statement. An attacker that exploits this vulnerability will be able to gain access to the underlying database and view or modify data without permission.

Examine code which interacts with relational databases and identify how each statement or query is constructed. Check if any statements are built by joining strings with external inputs and trace these data flows to see whether proper filtering or encoding was performed. Determine if special characters (such as single quotes) and keywords (such as SELECT or DROP) supplied in inputs can affect the statement that is constructed.

Try this challenge in Secure Code Warrior

Micro-Learning Topic: SQL Injection (Detected by phrase)

What is this? (2min video)

This is probably one of the two most exploited vulnerabilities in web applications and has led to a number of high profile company breaches. It occurs when an application fails to sanitize or validate input before using it to dynamically construct a statement. An attacker that exploits this vulnerability will be able to gain access to the underlying database and view or modify data without permission.

Examine code which interacts with relational databases and identify how each statement or query is constructed. Check if any statements are built by joining strings with external inputs and trace these data flows to see whether proper filtering or encoding was performed. Determine if special characters (such as single quotes) and keywords (such as SELECT or DROP) supplied in inputs can affect the statement that is constructed.

Try this challenge in Secure Code Warrior

Micro-Learning Topic: Denial of Service (Detected by phrase)

The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others.

_Credits: Denial of Service_

Try this challenge in Secure Code Warrior