vanilla-extract still used the deprecated md5 hash function

[raj-gh-altana]

Hello,

vanilla-extract uses the deprecated md5 hash function. This makes it impossible to be fips compliant when using vanilla-extract. I'd like to update the has function to a more modern secure function that is fips compliant such as sha256

[kasper573]

Could you explain how vanilla extract breaks fips compliance? Afaik a build tool using md5 just to generate consistent class names is not security use case and therefore not a violation of fips.

[raj-gh-altana]

Sure, the problem arises when you attempt to build an application in a fips compliant environment or container. In my case, I am building our FE app in a fips docker container and MD5 is not available so the yarn build fails.

[kasper573]

Could you not use a multi stage docker build then? Surely the build step does not need the fips docker image, only the final image