Whatever happened to SHA-256 support in Git?

Well, md5 has a (somewhat computationally theoretical) full preimage attack, and it's chosen prefix attacks and general collision attack algorithms are somewhat faster than those for SHA-1. I kinda suspect it's cheaper to social engineer code into most git repos than it is to try and find a SHA-1 collision (not to mention simply finding and inserting the colliding object may not be enough to cause the modified code to spread).

It is about time to start switching over to sha-256, but of all the overdue migrations away from harmful stuff in the world SHA-1 git repos are .... not that harmful.