Hacker News Reader

This is nearly beside the point, but why include SHA-1 as a default hash algorihtm in a greenfield project?

It's not exactly green-field: SPDX is over ten years old now, and browsers only started removing SHA-1 in the last five years.

As other commenters have said, it’s not greenfield, but is there a valid attack vector on a collision here?