build(deps): bump the migrator-prod group across 1 directory with 2 updates

[dependabot]

Bumps the migrator-prod group with 2 updates in the /migrator directory: cassandra-driver and umzug.

Updates cassandra-driver from 4.8.0 to 4.9.0

Changelog

Sourced from cassandra-driver's changelog.

4.9.0

2026-04-23

This release marks the first release of the driver under the Apache Software
Foundation, following its donation from DataStax.

Features

• [NODEJS-692] - Add Node.js v24 support
• [CASSNODEJS-2] - Update CONTRIBUTING.md after ASF donation, drop Node.js 18 support
• [CASSNODEJS-4] - Update DRIVER_NAME after donation to ASF
• [CASSNODEJS-3] - Public CI after Donation

Bug fixes

• [PR #432] - Fix retry on socket error
• [NODEJS-693] - Remove broken jsdoc from 4.8.0
• [NODEJS-691] - Fix generated timestamp on retry

Commits

• 1c0a7df ninja-fix: Changelog and version bump for 4.9.0
• e5957d6 CASSNODEJS-3: Public CI after Donation
• d3ddcbf CASSNODEJS-4 Update DRIVER_NAME after donation to ASF
• 65507c5 Bump picomatch from 2.3.1 to 2.3.2
• b0a6b61 Bump serialize-javascript and mocha
• 8fa4399 Bump tar-fs from 2.1.2 to 2.1.4
• 6c70446 CASSNODEJS-2 Update CONTRIBUTING.md after ASF donation (#453)
• 3b4ce72 Donation to Apache Cassandra and ASF
• acea0b9 NODEJS-691 Fix generated timestamp on retry (#438)
• c0a6c5f Added NPM badge to README.md (#437)
• Additional commits viewable in compare view

Updates umzug from 3.8.2 to 3.8.3

Release notes

Sourced from umzug's releases.

v3.8.3

mostly just a security patch update

pnpm audit --prod output before 4272daa25ac2fed4e71973f04253f8219f42c26c:

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ Validator is Vulnerable to Incomplete Filtering of One │
│                     │ or More Instances of Special Elements                  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ validator                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <13.15.22                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=13.15.22                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ . > @rushstack/ts-command-line@4.19.1 >                │
│                     │ @rushstack/terminal@0.10.0 >                           │
│                     │ @rushstack/node-core-library@4.0.2 > z-schema@5.0.5 >  │
│                     │ validator@13.11.0                                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-vghf-hv5q-vc2g      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ Picomatch has a ReDoS vulnerability via extglob        │
│                     │ quantifiers                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ picomatch                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=4.0.0 <4.0.4                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.0.4                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ . > tinyglobby@0.2.13 > fdir@6.4.4 > picomatch@4.0.2   │
│                     │                                                        │
│                     │ . > tinyglobby@0.2.13 > picomatch@4.0.2                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-c2c7-rcm5-vvqj      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ validator.js has a URL validation bypass vulnerability │
│                     │ in its isURL function                                  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ validator                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <13.15.20                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=13.15.20                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ . > @rushstack/ts-command-line@4.19.1 >                │
</tr></table> 

... (truncated)

Commits

• d79c19f 3.8.3
• b70ce38 Merge branch 'main' of https://github.com/sequelize/umzug
• 4272daa Clear production dependency audit findings
• abda313 chore(deps): update dependency uuid to v14 [security] (#719)
• 61d255d chore(deps): update dependency lodash to v4.18.1 [security] (#721)
• fed3a8d bump test timeout? (#711)
• 165efc6 update vitest coverage package
• 9c7e96f no output in tests
• 8bce216 bump sqlite3 and vitest
• 317623c lint fix
• Additional commits viewable in compare view