Even if git didn't have protection against the known attack, it's still safe in practice. The SHA-1 collision attack can only work if you take a specially-craf

Even if git didn't have protection against the known attack, it's still safe in practice. The SHA-1 collision attack can only work if you take a specially-crafted file from the attacker and commit it to your repository. The file needs to have a specific structure, and will contain binary data that looks like junk. It can't look like innocent source code. If you execute unintelligible binary blobs from strangers, you're in trouble anyway. There is no preimage weakness in SHA-1, so nobody is able to change or inject new data to an arbitrary repo/commit that doesn't already contain their colliding file.