Better security than SHA1 for signature?
Is using /dev/urandom a good idea on OS X?


Yes. /dev/urandom is the preferred way to get random values on all modern unixes. Arguments that /dev/random are more secure is a complete myth.


  Are there any other problems here? (I will probably generate a 4096-bit or larger key instead of the 2048-bit one.)


2048 bits is considered secure and likely will be until ~2030. 4096 bits is overkill — the next logical step is 3072 bits, which is roughly equivalent to a 128-bit symmetric key.


  Would changing it to [SHA-256] be enough to avoid the weakness in SHA1?


Probably. But SHA-1 collisions are only just now starting to become computationally feasible. It's worth trying to get upstream to migrate onto a more resistant hash function.