matplotlib · tacaswell · Feb 12, 2025 · Feb 12, 2025 · Feb 12, 2025
diff --git a/lib/matplotlib/sphinxext/mathmpl.py b/lib/matplotlib/sphinxext/mathmpl.py
@@ -146,7 +146,10 @@ def latex2html(node, source):
    fontset = node['fontset']
    fontsize = node['fontsize']
    name = 'math-{}'.format(
-        hashlib.md5(f'{latex}{fontset}{fontsize}'.encode()).hexdigest()[-10:])
+        hashlib.sha256(
+            f'{latex}{fontset}{fontsize}'.encode(),
+            usedforsecurity=False,
+        ).hexdigest()[-10:])

    destdir = Path(setup.app.builder.outdir, '_images', 'mathmpl')
    destdir.mkdir(parents=True, exist_ok=True)

diff --git a/lib/matplotlib/testing/compare.py b/lib/matplotlib/testing/compare.py
@@ -46,22 +46,20 @@ def get_cache_dir():


 def get_file_hash(path, block_size=2 ** 20):
-    md5 = hashlib.md5()
+    sha256 = hashlib.sha256(usedforsecurity=False)
    with open(path, 'rb') as fd:
        while True:
            data = fd.read(block_size)
            if not data:
                break
-            md5.update(data)
+            sha256.update(data)

    if Path(path).suffix == '.pdf':
-        md5.update(str(mpl._get_executable_info("gs").version)
-                   .encode('utf-8'))
+        sha256.update(str(mpl._get_executable_info("gs").version).encode('utf-8'))
    elif Path(path).suffix == '.svg':
-        md5.update(str(mpl._get_executable_info("inkscape").version)
-                   .encode('utf-8'))
+        sha256.update(str(mpl._get_executable_info("inkscape").version).encode('utf-8'))

-    return md5.hexdigest()
+    return sha256.hexdigest()


 class _ConverterError(Exception):

diff --git a/lib/matplotlib/texmanager.py b/lib/matplotlib/texmanager.py
@@ -168,7 +168,10 @@ def get_basefile(cls, tex, fontsize, dpi=None):
        Return a filename based on a hash of the string, fontsize, and dpi.
        """
        src = cls._get_tex_source(tex, fontsize) + str(dpi)
-        filehash = hashlib.md5(src.encode('utf-8')).hexdigest()
+        filehash = hashlib.sha256(
+            src.encode('utf-8'),
+            usedforsecurity=False
+        ).hexdigest()
        filepath = Path(cls._texcache)

        num_letters, num_levels = 2, 2