

md5 for example is already vulnerable. People have figured out how to manipulate data into having a pre-specified hash. Meaning someone could engineer deliberate hash collisions and serve you any file they like.
SHA-256 doesn’t (i think) have this issue, so far hah.
do you mean github or do you actually mean git?