Summary of Security Findings:

Multiple files in the dojo/tools directory were updated with a consistent pattern of adding usedforsecurity=False to hashlib.md5() method calls. This is a security-conscious annotation indicating MD5 hashes are used for non-cryptographic purposes like deduplication.

Security Vulnerabilities:

No direct security vulnerabilities were found in the reviewed patches. The changes were primarily defensive coding practices that:

• Explicitly mark MD5 hash usage as non-security critical
• Provide clarity about hash generation intent
• Help static analysis tools understand hash purpose

Specific Files Modified:

• dojo/tools/blackduck/parser.py
• dojo/tools/bugcrowd/parser.py
• dojo/tools/bundler_audit/parser.py
• dojo/tools/cobalt/parser.py
• dojo/tools/ggshield/parser.py
• dojo/tools/gitleaks/parser.py
• dojo/tools/h1/parser.py
• dojo/tools/huskyci/parser.py
• dojo/tools/ibm_app/parser.py
• dojo/tools/immuniweb/parser.py
• dojo/tools/kiuwan/parser.py
• dojo/tools/mend/parser.py
• dojo/tools/neuvector_compliance/parser.py
• dojo/tools/noseyparker/parser.py
• dojo/tools/ort/parser.py
• dojo/tools/retirejs/parser.py
• dojo/tools/scantist/parser.py
• dojo/tools/sslyze/parser_xml.py
• dojo/tools/talisman/parser.py
• dojo/tools/trufflehog/parser.py
• dojo/tools/trufflehog3/parser.py
• dojo/tools/twistlock/parser.py
• dojo/tools/vcg/parser.py
• dojo/tools/whitehat_sentinel/parser.py

Additionally, the ruff.toml file was updated to add the security rule S324, indicating an expansion of security linting capabilities.