It will not be an issue for existing commits, at least not yet. Practically possible are collision attacks, which means someone with google-level hardware can

It will not be an issue for existing commits, at least not yet. Practically possible are collision attacks, which means someone with google-level hardware can craft 2 commits (one malicious) and keep the later for later. Technically, the fix is for git to move to SHA256 or higher, and I'm sure there'll be discussions around this shortly in the git community.