NIST is announcing that SHA-1 should be phased out by Dec. 31, 2030
SHA-1 is still perfectly fine for some applications like detecting duplicate files on a storage medium (and it's less likely to produce a false positive than MD5) but it's been a bad idea for anything security related for a decade.<p>The biggest issue is that git still uses it, which presents a problem if you want to protect a repo from active integrity attacks.