The interesting thing about your comment is that you view password hashing as needing more security but git commit hashes to be less of an issue. I couldn't disagree more.

First, for a password hash function to matter, the hashed password must be compromised. If you don't have the hash it doesn't really matter all that much. Yes, hashed passwords do get compromised but many don't.

Second, I can't think of many bigger security threats than intentionally creating an SHA1 collision for a git repository. Poisoning a Linux git repo could be truly disastrous. Remember too that if you can poison a git repo, you can also make the binary output have the same size and hash too. I mean that's much more difficult but not impossible and it wouldn't surprise me if state actors have dedicated a lot of computing power to this.

And "is it possible?" is by definition always "yes".