Git version 2.51: Getting ready for the future by incorporating SHA-256.
Git 2.51 has been released, continuing the ongoing effort to modernise the version control system. This update introduces several technical enhancements, with a significant focus on bolstering cryptographic security through the support of SHA-256. Since its inception in 2005, Git has relied on SHA-1, which has become increasingly vulnerable to collision attacks, rendering it unsuitable for long-term use. The transition to SHA-256 is complex, as Git repositories are built around object IDs that depend on the hash function. While repositories still default to SHA-1, the 2.51 release enhances internal support for SHA-256, particularly in the transport layer and object verification processes. Developers experimenting with SHA-256 repositories will find that the ecosystem is gradually adapting, facilitating easier testing and issue reporting.
The release also includes improvements beyond SHA-256, such as more efficient handling of cruft packs, which reduces storage bloat from unreachable objects. Updates to stash handling provide better support for stashing files outside the index, while ongoing performance tweaks reflect Git’s commitment to speed and scalability. For developers, the key takeaway from Git 2.51 is that foundational changes are being implemented for the future. Those maintaining tools that interact closely with Git objects or transport are encouraged to experiment with SHA-256 repositories to identify potential edge cases before the algorithm becomes the default. The Git project remains dedicated to durability, ensuring data integrity through its distributed model and object store, making the shift from SHA-1 to SHA-256 a crucial step in maintaining robust security as threats evolve.
