Moderate security vulnerability reported via npm audit

Node version: v24.11.0
Sails version (sails): 1.5.15
ORM hook version (sails-hook-orm): N/A
Sockets hook version (sails-hook-sockets): N/A
Organics hook version (sails-hook-organics): N/A
Grunt hook version (sails-hook-grunt): N/A
Uploads hook version (sails-hook-uploads): N/A
DB adapter & version (e.g. sails-mysql@5.55.5): N/A
Skipper adapter & version (e.g. skipper-s3@5.55.5): N/A

---

validator <13.15.20
Severity: moderate
validator.js has a URL validation bypass vulnerability in its isURL function - https://github.com/advisories/GHSA-9965-vmph-33xx
fix available via `npm audit fix --force`
Will install sails@0.12.14, which is a breaking change
node_modules/validator
anchor >=0.1.0-1
Depends on vulnerable versions of validator
node_modules/anchor
machine >=15.0.0-1
Depends on vulnerable versions of anchor
node_modules/machine
machine-as-action >=10.0.0-0
Depends on vulnerable versions of machine
node_modules/machine-as-action
sails >=1.0.0-0
Depends on vulnerable versions of machine
Depends on vulnerable versions of machine-as-action
Depends on vulnerable versions of machinepack-process
Depends on vulnerable versions of machinepack-redis
Depends on vulnerable versions of sails-generate
Depends on vulnerable versions of whelk
node_modules/sails
machinepack-fs >=9.0.0-0
Depends on vulnerable versions of machine
node_modules/machinepack-fs
sails-disk >=1.1.2
Depends on vulnerable versions of machinepack-fs
node_modules/sails-disk
sails-hook-orm *
Depends on vulnerable versions of sails-disk
Depends on vulnerable versions of waterline
node_modules/sails-hook-orm
machinepack-postgresql >=1.0.0-1
Depends on vulnerable versions of machine
node_modules/machinepack-postgresql
machinepack-process >=3.0.0-0
Depends on vulnerable versions of machine
node_modules/machinepack-process
sails-generate >=1.16.8
Depends on vulnerable versions of machinepack-process
node_modules/sails-generate
machinepack-redis >=2.0.0
Depends on vulnerable versions of machine
node_modules/machinepack-redis
sails-postgresql >=1.0.0-1
Depends on vulnerable versions of machine
Depends on vulnerable versions of machinepack-postgresql
node_modules/sails-postgresql
whelk *
Depends on vulnerable versions of machine
node_modules/whelk
waterline >=0.9.0
Depends on vulnerable versions of anchor
node_modules/waterline

Start by reproducing npm audit for Sails 1.5.15 and inspect the dependency tree shown in the report, especially validator through anchor, machine, and waterline. Done means the reported vulnerability is addressed without forcing a downgrade to sails@0.12.14, with the project's tests still passing.

Written by the indexing model from the issue text.