From 47ca9228c372f593ebd0ab1e5133ca8cf632e493 Mon Sep 17 00:00:00 2001 From: Safi Date: Sat, 2 May 2026 14:32:16 +0100 Subject: [PATCH] security: add usedforsecurity=False to MD5/SHA1 hashes used for file diffing and filename generation --- graphify/detect.py | 2 +- graphify/transcribe.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/graphify/detect.py b/graphify/detect.py index 419fc5c9f..30de00e9a 100644 --- a/graphify/detect.py +++ b/graphify/detect.py @@ -736,7 +736,7 @@ def detect(root: Path, *, follow_symlinks: bool = False) -> dict: def _md5_file(path: Path) -> str: """MD5 of file contents streamed in 64KB chunks — for change detection only.""" import hashlib as _hl - h = _hl.md5() + h = _hl.md5(usedforsecurity=False) try: with path.open("rb") as f: for chunk in iter(lambda: f.read(65536), b""): diff --git a/graphify/transcribe.py b/graphify/transcribe.py index 701fdb4c5..6d21038f3 100644 --- a/graphify/transcribe.py +++ b/graphify/transcribe.py @@ -58,7 +58,7 @@ def download_audio(url: str, output_dir: Path) -> Path: # yt-dlp uses %(title)s which can be long/weird — use a stable name based on URL hash import hashlib - url_hash = hashlib.sha1(url.encode()).hexdigest()[:12] + url_hash = hashlib.sha1(url.encode(), usedforsecurity=False).hexdigest()[:12] out_template = str(output_dir / f"yt_{url_hash}.%(ext)s") # Check for already-downloaded file