fix: [sha.js] Upgrade sha.js from 2.4.11 to 2.4.12 to resolve CVE-2025-9288 (Missing Type Checks)

[devin-ai-integration]

Summary

Fixes the Function Call With Incorrect Argument Type vulnerability in sha.js@2.4.11 (CVSS 9.1, CVE-2025-9288). sha.js does not validate input types, so passing a non-string/non-Buffer can corrupt the internal hashing state and produce incorrect/forgeable digests (hash bypass).

sha.js@2.4.11 is transitive (typeorm > ... > sha.js). To avoid a typeorm major upgrade, this pins it via an npm overrides entry to the patched release:

+"overrides": {
+  "sha.js": "2.4.12"
+}

2.4.12 is the patch release that adds the missing type checks; it is a drop-in for 2.4.11. package-lock.json regenerated → single sha.js@2.4.12 resolution.

Verified locally: snyk test parses the lockfile and reports 0 remaining sha.js vulnerabilities.

• Severity: Critical (CVSS 9.1) · CWE-1287 (Improper Validation of Specified Type of Input)
• CVE: https://nvd.nist.gov/vuln/detail/CVE-2025-9288
• Advisory: https://security.snyk.io/vuln/SNYK-JS-SHAJS-12089400
• Snyk scan: org 9e26acce-22c7-4efc-b470-21d9587f49fe, project goof (npm)

One vulnerability per PR; part of a set of 5 fix PRs for the top findings.

Link to Devin session: https://app.devin.ai/sessions/d6b18d8e5ad94506b760971485ceb694
Requested by: @hannahhuh-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring