weak hashing algorithm used

[amitagarwal-dev]

Mysql2 version: 3.11.0

We saw that a weak hashing algorithm (SHA1) used in the mysql2 code. Can anybody tell the purpose of this code and can we replace this with sha256?
Please provide your comment on this!

CODE

path: mysql2/lib/auth_41.js

function sha1(msg, msg1, msg2) {
  const hash = crypto.createHash('sha1');
  hash.update(msg);
  if (msg1) {
    hash.update(msg1);
  }

  if (msg2) {
    hash.update(msg2);
  }

  return hash.digest();
}

[dougwilson]

Because any server using mysql_native_password for authentication needs this, since that plugin, which was standard for a very long time, uses sha-1

[sidorares]

If this is a concern the fix should be on the server config side: disallow mysql_native_password auth method and enable caching_sha2_password or similar. Most modern mysql server setups have caching_sha2_password enabled by default

[EricCarey286]

does mysql2 support caching_sha2_password now?