tl;dr: Git 3.0 will default new repositories to SHA-256 instead of SHA-1, forcing an ecosystem-wide migration that breaks interoperability between repos, submodules, tooling, libraries, and existing URLs/signatures — with no clean path for mixing formats. The author argues this is solving a largely theoretical problem, since real-world attacks exploit social engineering and compromised maintainers, not hash collisions. A better approach would be adding a secondary independent content hash (like SHA-256 or BLAKE3) into signed object headers, preserving SHA-1 for addressing while providing stronger verification where it matters.