Use SHA1 algorithm for generating asset hashes

packages/indiekit/lib/middleware/locals.js

@@ -1,12 +1,12 @@
 import { scripts, styles } from "@indiekit/frontend";
-import { hash } from "hasha";
+import { sha1 } from "@indiekit/util";
 import { getEndpoints } from "../endpoints.js";
 import { getNavigation } from "../navigation.js";
 import { getShortcuts } from "../shortcuts.js";
 import { getUrl } from "../utils.js";
 
-const jsHash = await hash(await scripts(), { algorithm: "md5" });
-const cssHash = await hash(await styles(), { algorithm: "md5" });
+const jsHash = sha1(await scripts());
+const cssHash = sha1(await styles());
 
 /**
  * Expose configuration to frontend templates and plug-ins

packages/indiekit/package.json

@@ -66,7 +66,6 @@
     "express": "^4.17.1",
     "express-fileupload": "^1.4.0",
     "express-rate-limit": "^7.0.0",
-    "hasha": "^6.0.0",
     "i18n": "^0.15.0",
     "keyv": "^5.0.0",
     "lodash": "^4.17.21",

packages/util/index.js

@@ -10,6 +10,6 @@ export {
 } from "./lib/date.js";
 export { sanitise } from "./lib/object.js";
 export { ISO_6709_RE } from "./lib/regex.js";
-export { md5, randomString, slugify, supplant } from "./lib/string.js";
+export { md5, randomString, sha1, slugify, supplant } from "./lib/string.js";
 export { getCanonicalUrl, isSameOrigin } from "./lib/url.js";
 export { isRequired } from "./lib/validation-schema.js";

packages/util/lib/string.js

@@ -8,6 +8,13 @@ import slugifyString from "@sindresorhus/slugify";
  */
 export const md5 = (string) => createHash("md5").update(string).digest("hex");
 
+/**
+ * Generate SHA1 hashed string
+ * @param {string} string - String
+ * @returns {string} SHA1 hashed string
+ */
+export const sha1 = (string) => createHash("sha1").update(string).digest("hex");
+
 /**
  * Generate cryptographically random string
  * @param {number} [length] - Length of string

packages/util/test/unit/string.js

@@ -1,7 +1,13 @@
 import { strict as assert } from "node:assert";
 import { Buffer } from "node:buffer";
 import { describe, it } from "node:test";
-import { md5, randomString, slugify, supplant } from "../../lib/string.js";
+import {
+  md5,
+  randomString,
+  sha1,
+  slugify,
+  supplant,
+} from "../../lib/string.js";
 
 describe("util/lib/string", () => {
   it("Generates MD5 hashed string", () => {
@@ -10,6 +16,12 @@ describe("util/lib/string", () => {
     assert.equal(result, "acbd18db4cc2f85cedef654fccc4a4d8");
   });
 
+  it("Generates SHA1 hashed string", () => {
+    const result = sha1("foo");
+
+    assert.equal(result, "0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33");
+  });
+
   it("Generates cryptographically random string", () => {
     const result = randomString(8);