fix: [npm] Upgrade typeorm from 0.2.24 to 0.2.25 to resolve CVE-2020-8158

[hannahhuh-cog]

Summary

Snyk SCA flagged typeorm@0.2.24 with High SNYK-JS-TYPEORM-590152 / CVE-2020-8158 — Prototype Pollution (CWE-1321, CVSS 9.8) in EntityManager/Repository query handling. routes/users.js and typeorm-db.js use the MySQL connection with request-derived input.

Change: package.json "typeorm": "^0.2.24" → "^0.2.25", lockfile pinned to typeorm@0.2.25 (Snyk's minimum fixed version; deliberately not jumping to 0.2.45/0.3.x to keep this a patch-level change). The lockfile diff is larger than the one-line manifest change because npm relocked typeorm's transitive tree (yargs, mkdirp, chalk, etc.) during the --package-lock-only install.

Snyk reference: SNYK-JS-TYPEORM-590152, severity high, direct dependency.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/178f11f2b5e94e8f93f691287e1f1d60
Open in Devin Desktop: https://app.devin.ai/desktop/session/178f11f2b5e94e8f93f691287e1f1d60?variant=devin
Requested by: @hannahhuh-cog

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 0 potential issues.