Latest sequelize-cli installs deprecated [email protected] through js-beautify

Bug Description

Installing the latest sequelize-cli release in a clean npm project produces a deprecation warning for [email protected].

The dependency is introduced through the following runtime dependency path:

[email protected]
└── [email protected]
    └── [email protected]

[email protected] depends on [email protected], which declares glob@^10.4.2. That range currently resolves to the deprecated [email protected] release.

Could sequelize-cli upgrade js-beautify, replace it, or otherwise update this dependency path so that a clean installation no longer includes a deprecated glob version? The current js-beautify release uses a supported major version of glob, although upgrading it may require compatibility testing because it is a major-version change.

Reproducible Example

mkdir sequelize-cli-deprecation-reproduction
cd sequelize-cli-deprecation-reproduction
npm init -y
npm install --save-dev sequelize-cli@latest

No Sequelize configuration, application code, or database connection is required.

What do you expect to happen?

Installing the latest sequelize-cli release should not introduce runtime dependencies that their maintainers have marked as deprecated or unsupported.

What is actually happening?

The clean installation emits:

npm warn deprecated [email protected]: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting [email protected]

Running npm explain glob confirms that it is introduced through js-beautify:

[email protected]
node_modules/glob
  glob@"^10.4.2" from [email protected]
  node_modules/js-beautify
    js-beautify@"1.15.4" from [email protected]

This report concerns the unsupported dependency and installation warning. It is not asserting that [email protected] is affected by a specific unpatched security vulnerability.

Environment

• Sequelize CLI version: 6.6.5
• Node.js version: 24.19.0
• npm version: 12.0.0
• Operating system: macOS
• Database & Version: Not applicable; reproduced during installation

Would you be willing to resolve this issue by submitting a Pull Request?

No. I understand that I will need to wait until someone from the community or the maintainers is interested in resolving the issue.