fix: [npm] Upgrade sha.js from 2.4.11 to 2.4.12 to resolve CVE-2025-9288

[hannahhuh-cog]

Summary

Snyk SCA flagged sha.js@2.4.11 (transitive via typeorm@0.2.24) with Critical SNYK-JS-SHAJS-12089400 / CVE-2025-9288 — missing input type checks (CWE-20) allow hash-rewind / hash-collision when non-Buffer/non-string input is passed to update(). Fixed in 2.4.12.

Change: lockfile-only. typeorm already declares sha.js: ^2.4.11, so no manifest edit is needed; npm update sha.js --package-lock-only re-resolves node_modules/sha.js to 2.4.12. The extra lockfile churn is (a) 2.4.12's new to-buffer dependency, which pulls in the call-bind/get-intrinsic/es-* helper chain, and (b) npm deduping several nested readable-stream/string_decoder/isarray copies while relocking. No version of an existing top-level package regressed.

Snyk reference: SNYK-JS-SHAJS-12089400, severity critical, introduced through typeorm@0.2.24 > sha.js@2.4.11.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/178f11f2b5e94e8f93f691287e1f1d60
Open in Devin Desktop: https://app.devin.ai/desktop/session/178f11f2b5e94e8f93f691287e1f1d60?variant=devin
Requested by: @hannahhuh-cog

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.