security: add usedforsecurity=False to MD5/SHA1 hashes used for file diffing and filename generation

graphify/detect.py

@@ -736,7 +736,7 @@ def detect(root: Path, *, follow_symlinks: bool = False) -> dict:
 def _md5_file(path: Path) -> str:
     """MD5 of file contents streamed in 64KB chunks — for change detection only."""
     import hashlib as _hl
-    h = _hl.md5()
+    h = _hl.md5(usedforsecurity=False)
     try:
         with path.open("rb") as f:
             for chunk in iter(lambda: f.read(65536), b""):

graphify/transcribe.py

@@ -58,7 +58,7 @@ def download_audio(url: str, output_dir: Path) -> Path:
 
     # yt-dlp uses %(title)s which can be long/weird — use a stable name based on URL hash
     import hashlib
-    url_hash = hashlib.sha1(url.encode()).hexdigest()[:12]
+    url_hash = hashlib.sha1(url.encode(), usedforsecurity=False).hexdigest()[:12]
     out_template = str(output_dir / f"yt_{url_hash}.%(ext)s")
 
     # Check for already-downloaded file