fix: [sha.js] Pin sha.js to 2.4.12 to resolve CVE-2025-9288 (missing input type check)

[devin-ai-integration]

Summary

Resolves a Critical (CVSS 9.1) vulnerability in sha.js, surfaced by a Snyk SCA scan.

sha.js@2.4.11 performs a hash update without validating the argument type — CVE-2025-9288 / SNYK-JS-SHAJS-12089400 ("Function Call With Incorrect Argument Type"), which can lead to hash-rewind / incorrect digest behaviour. It is pulled in transitively via a direct dependency:

goof > typeorm@0.2.24 > sha.js@2.4.11

typeorm requires sha.js@^2.4.11, so the patched 2.4.12 is a drop-in (same major.minor). An npm overrides scoped to typeorm forces it:

"overrides": { "typeorm": { "sha.js": "2.4.12" } }

Verification

After the change, snyk test reports sha.js@2.4.12 and 0 remaining sha.js issues.

One vulnerability per PR (Scheduled Snyk MCP scan, remediation phase).

Link to Devin session: https://app.devin.ai/sessions/3de7e286bad14ebb88618cf08a9489ab
Requested by: @hannahhuh-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring