Hacker News Reader

Hmm. If this is a security issue that matters, would you not be expected to migrate?

Not talking about archived code, but active projects that pre-date git 3.0

His point is keep an archived sha1 version of the repo and an active sha256 version.

That way an old commit with a message having a sha1 can reference the archived version, and new commits reference the active version.

Some companies survive longer than five years. So old repos are also active ones.

If we don't need to migrate repos to sha256 them why do we need to change git to use sha256?

You keep the old repo for archival purposes and work with the new one.