There are some security fixes... mostly things that don't let you use features in ways that could lead to security holes, not actually fixing security holes in sequelize itself. Would be good to update though, as the API for some methods has changed slightly.