Collision concerns make sense. If you manage to get two different files with the same hash, that will cause issues for your repo - the concerns over a collision justify the move to SHA-256 though.