Latest stable Sequelize installs deprecated dottie@2.0.7 and uuid@8.3.2 #18317

Issue Creation Checklist

• I understand that my issue will be automatically closed if I don't fill in the requested information
• I have read the contribution guidelines

Bug Description

Installing the latest stable Sequelize release in a clean npm project produces deprecation warnings for two direct runtime dependencies:

• dottie@2.0.7 is no longer supported.
• uuid@8.3.2 is no longer supported by its maintainers.

Because Sequelize declares both dependencies directly, applications cannot remove these warnings by updating their own dependencies. An npm override would also risk installing versions that have not been validated with Sequelize.

Could Sequelize upgrade uuid to a supported version and replace or internalize the functionality provided by dottie? If these changes cannot be made in Sequelize 6, please document the intended resolution or target release.

Reproducible Example

mkdir sequelize-deprecation-reproduction
cd sequelize-deprecation-reproduction
npm init -y
npm install sequelize@latest

No application code or database connection is required.

What do you expect to happen?

Installing the latest stable Sequelize release should not introduce direct dependencies that their maintainers have marked as deprecated or unsupported.

What is actually happening?

The clean installation emits:

npm warn deprecated dottie@2.0.7: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
npm warn deprecated uuid@8.3.2: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11.

Running npm explain dottie and npm explain uuid confirms that both are direct dependencies of sequelize@6.37.8:

sequelize@6.37.8
├── dottie@2.0.7
└── uuid@8.3.2

Environment

• Sequelize version: 6.37.8
• Node.js version: 24.19.0
• npm version: 12.0.0
• TypeScript version: Not applicable
• Database & Version: Not applicable; reproduced during installation
• Connector library & Version: Not applicable

Would you be willing to resolve this issue by submitting a Pull Request?

• No, I don't have the time, and I understand that I will need to wait until someone from the community or maintainers is interested in resolving my issue.