Security Vulnerability: Critical CVE in sha.js dependency

# Security Vulnerability: Critical CVE in sha.js dependency

## Summary
The package `@apollo/utils.createhash@3.0.1` depends on `sha.js@2.4.11`, which contains a **critical security vulnerability** (CVE-2025-9288).

## Vulnerability Details
- **CVE ID**: CVE-2025-9288
- **Severity**: Critical
- **Affected Component**: `sha.js@2.4.11`
- **GHSA**: [GHSA-95m3-7q98-8xr5](https://github.com/browserify/sha.js/security/advisories/GHSA-95m3-7q98-8xr5)
- **NVD Reference**: [CVE-2025-9288](https://nvd.nist.gov/vuln/detail/CVE-2025-9288)

## Affected Package
- **Package**: `@apollo/utils.createhash`
- **Version**: `3.0.1`
- **Dependency**: `sha.js@^2.4.11`
- **Package.json**: [Link](https://github.com/apollographql/apollo-utils/blob/52758b47d62ef088c2d1f9de7156b4bbd20a73fe/packages/createHash/package.json#L25)

## Evidence
The vulnerable dependency is declared in the package.json:
```json
{
"dependencies": {
"@apollo/utils.isnodelike": "^3.0.0",
"sha.js": "^2.4.11"
}
}
```

Requested Action
Please update the sha.js dependency to a patched version that addresses CVE-2025-9288, or consider migrating to an alternative hashing library if no patch is available.

Start with packages/createHash/package.json at the referenced dependency declaration and inspect the available patched sha.js release for CVE-2025-9288. Update the dependency or evaluate the stated alternative, then verify that the package no longer resolves sha.js@2.4.11 and that the vulnerability is addressed.

Written by the indexing model from the issue text.