Use crypto/sha256 instead of crypto/md5 for FIPS compliance.

[BillBuilt]

Use crypto/sha256 instead of crypto/md5 for FIPS compliance.

Update deps

[smithcoin]

Not only for fips, many linters now suggest avoiding md5 for any reason.

[moorereason]

The comment in line 374 should be updated to not reference md5.

What are the implications of this change? From what I can see, the machine ID is only used here:

resty/util.go

Line 375 in 66256ef

b[4], b[5], b[6] = machineID[0], machineID[1], machineID[2]

Which is only called from here:

resty/request.go

Line 1385 in 66256ef

r.RetryTraceID = newGUID()

[BillBuilt]

When running go code using GOFIPS140=v1.0.0 GODEBUG=fips140=only, if any package is not compliant (MD5), it will fail to build regardless of how it is used.

https://go.dev/doc/security/fips140

I will update the comment. Thanks!

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.85%. Comparing base (66256ef) to head (ba9898e).
⚠️ Report is 7 commits behind head on v3.

Additional details and impacted files

@@            Coverage Diff             @@
##               v3    #1056      +/-   ##
==========================================
+ Coverage   99.82%   99.85%   +0.03%     
==========================================
  Files          18       18              
  Lines        3919     3371     -548     
==========================================
- Hits         3912     3366     -546     
+ Misses          5        3       -2     
  Partials        2        2              

Flag	Coverage Δ
unittests	99.85% <100.00%> (+0.03%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jeevatkm]

@BillBuilt Thanks for the PR. I'm sorry for the delayed response, I was occupied with my personal stuff.

Can you please revert the go.{mod, sum} file changes?

[BillBuilt]

@BillBuilt Thanks for the PR. I'm sorry for the delayed response, I was occupied with my personal stuff.

Can you please revert the go.{mod, sum} file changes?

No worries. I reverted the version changes. I did get this warning so maybe consider updating any dependencies when you get a chance.

Warning:(5, 9) Dependency go:golang.org/x/net:v0.33.0 is vulnerable CVE-2025-22870 4.4

Thanks again!

[jeevatkm]

@BillBuilt Thanks for updating the PR.

[jeevatkm]

@BillBuilt Sure, I usually update the go.mod during the release.