chopratejas af9e6282f8 fix(crusher): switch compression_store cache key from MD5 to SHA-256 (CodeQL #395) ... CodeQL flagged `compression_store.store()`'s default MD5 cache key as `py/weak-sensitive-data-hashing` after the explicit_hash refactor in PR #395 brought the line into a new diff context. First attempt: `usedforsecurity=False` + `# lgtm[...]` comment to silence the alert without changing the hash. Both failed — CodeQL ignores the hashlib parameter and our LGTM marker, the alert stayed open on the PR. Second attempt (this commit): drop MD5 entirely. The cache key is for deduplication / lookup, not security or integrity, so any deterministic function works. SHA-256[:24] gives the same 96-bit collision space as MD5[:24] (~280 trillion entries for 50% collision under birthday bound), is FIPS-clean, and CodeQL won't flag it. Behaviour impact: zero. The cache is in-memory (no disk persistence), so the same content always hashes deterministically under whichever function is in use — there is no upgrade-time mismatch to manage. Drive-by: pre-commit's sync-plugin-versions hook bumped marketplace + plugin manifests to 0.20.28 since v0.20.27 was tagged on main.		2026-05-05 12:44:02 -07:00
..
marketplace.json	fix(crusher): switch compression_store cache key from MD5 to SHA-256 (CodeQL #395)	2026-05-05 12:44:02 -07:00