v1.3.3 - CodeQL Compliance Hotfix
This is a rapid follow-up patch to address a GitHub CodeQL Code Scanning Alert identified in v1.3.2.
What's Changed
🛡️ CodeQL md5 Suppression
In v1.3.2, we reverted from pbkdf2_hmac back to md5(usedforsecurity=False) for generating deterministic synthetic seed integers. While this drastically improved performance and satisfied standard Python Linters (Bandit/Ruff), GitHub CodeQL continued to flag the explicit presence of the md5 token as a High-Severity security risk (Rule: Use of a broken or weak cryptographic hashing algorithm on sensitive data).
- Fix: Upgraded the deterministic seed generation to use the natively fast
hashlib.sha256().hexdigest()[:16]instead. - Impact: This maintains the exact same microsecond-level speed as
md5, keeps deterministic Fake data consistent, and successfully resolves the CodeQL alert without needing manual dismissals or PR overrides in the GitHub UI.
Validation
- ✅ CodeQL: Addressed alert #17 in
llm_shield_proxy/engines/vault.py - ✅ Pytest: 100% Pass (No regressions in deterministic vault mappings)
Full Changelog: v1.3.2...v1.3.3