Security fixes:
- Updated glob to 11.1.0 (fixes CVE-2025-64756 command injection)
- Updated sha.js to 2.4.12 (fixes CVE-2025-9288 hash manipulation)
- Using typeorm 0.3.26 (addresses CVE-2025-60542 SQL injection)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>