Because people already have two decades of SHA-1 hashes in their database and a rewrite + rescan is completely pointless? Hell, I have such a system using md5. So you produced a hash collision, cool, now fool my follow-on byte-by-byte comparison.

Edit: Before anyone lecture me on SHA-1 being slow, yes, I use BLAKE2 for new projects.

because it's shorter, dealing with long hashes is annoying (I use md5, not sha1)

You could just discard half the sha256 hash. Using the first 16 bytes of sha256 is a lot more secure than using just md5, in which case you might as well just use crc32.

thanks for the reply that did not answer the question asked.

Your question is irrelevant. If you don't care about security, SHA1 is a bad choice because there are faster hash functions out there. If you do care about security, SHA1 is a bad choice because it has known flaws and there exist other algorithms that don't. The only valid reason to use SHA1 is if there is a historical requirement to use it that you can't reasonably change.

Any analysis about how hard it is for an attacker to get a file on your local file system via a cloned got repo, cached file, email attachment, image download, shared drive, etc is just a distraction.

You would be right, except that there are no faster hash functions (on all modern Intel, AMD and ARM CPUs, which have hardware SHA-1).

BLAKE 3 is faster only in wall clock time, on an otherwise idle computer, because it fully uses all CPU cores, but it does not do less work.

BLAKE 3 is preferable only when the computer does nothing else but hashing.

Uh no.

On a modern intel CPU, one core of SHA1 does about 500MB/s worth of hashing. Blake3 on the same core is 1.5GB/s or faster.

On the ThinkPad I'm typing this on, the single-threaded BLAKE3 benchmarks hit 8.8 GB/s :)