There's a cautionary note at the end of the article reminding the reader that git still relies on sha1 (with mitigations). Recall that $10k worth of GTX1060's produced a sha1 collision in late 2019.

https://www.usenix.org/conference/usenixsecurity20/presentat...