Comment by bawolff

in fairness, git switched to sha1-DC in may 2017, so they were only a few months late in mitigating it.