Does this have any implications for the urgency of replacing SHA-1 in git? I recently asked a question on the pip issue tracker[1] about whether it would make

Does this have any implications for the urgency of replacing SHA-1 in git? I recently asked a question on the pip issue tracker[1] about whether it would make sense for pip to start accepting sha-1 git refspecs when running in --require-hashes mode, on the grounds that there's more upside to encouraging use of --require-hashes than there is downside risk of sha-1 collision attacks. This surely doesn't help that argument, but I'm not sure if it hurts it either. [1] https://github.com/pypa/pip/issues/6469 https://github.com/pypa/pip/issues/6469