Sha1 was already a questionable idea in 2005 when git came out, because it was then already understood to have fundamental flaws.

https://www.schneier.com/blog/archives/2005/02/cryptanalysis...