mirror of
https://github.com/headroomlabs-ai/headroom.git
synced 2026-08-27 14:17:10 -04:00
af9e6282f8
CodeQL flagged `compression_store.store()`'s default MD5 cache key as `py/weak-sensitive-data-hashing` after the explicit_hash refactor in PR #395 brought the line into a new diff context. First attempt: `usedforsecurity=False` + `# lgtm[...]` comment to silence the alert without changing the hash. Both failed — CodeQL ignores the hashlib parameter and our LGTM marker, the alert stayed open on the PR. Second attempt (this commit): drop MD5 entirely. The cache key is for deduplication / lookup, not security or integrity, so any deterministic function works. SHA-256[:24] gives the same 96-bit collision space as MD5[:24] (~280 trillion entries for 50% collision under birthday bound), is FIPS-clean, and CodeQL won't flag it. Behaviour impact: zero. The cache is in-memory (no disk persistence), so the same content always hashes deterministically under whichever function is in use — there is no upgrade-time mismatch to manage. Drive-by: pre-commit's sync-plugin-versions hook bumped marketplace + plugin manifests to 0.20.28 since v0.20.27 was tagged on main.
18 lines
466 B
JSON
18 lines
466 B
JSON
{
|
|
"name": "headroom",
|
|
"version": "0.20.28",
|
|
"description": "Headroom startup hooks for Claude Code and GitHub Copilot CLI.",
|
|
"author": {
|
|
"name": "Headroom Contributors",
|
|
"url": "https://github.com/chopratejas/headroom"
|
|
},
|
|
"homepage": "https://github.com/chopratejas/headroom",
|
|
"repository": "https://github.com/chopratejas/headroom",
|
|
"keywords": [
|
|
"headroom",
|
|
"hooks",
|
|
"claude-code",
|
|
"copilot-cli"
|
|
],
|
|
"hooks": "./hooks"
|
|
}
|