DEV Community

Amaresh Pelleti
Amaresh Pelleti

Posted on Originally published at devtoolhub.com

Git 3.0: What Actually Breaks (SHA-256, Rust, More)

#opensource #git #programming #devops

Originally published on DevToolHub.

Git 3.0 changes the default hash function, the default reference storage format, the default branch name, and the build toolchain required to compile Git at all. This comes straight from git-scm.com's own BreakingChanges documentation.

New Repositories Default to SHA-256, Not SHA-1

Git 3.0 changes the default hash function for new repositories from SHA-1 to SHA-256. NIST deprecated SHA-1 back in 2011, and Git has supported SHA-256 as an opt-in option since 2018. What's new is that SHA-256 becomes the default.

Existing SHA-1 repositories keep working. This only affects repos created after you upgrade, using git init without an explicit --object-format=sha1 flag. SHA-256 hashes are 64 hex characters instead of 40, so anything parsing commit hashes needs to handle both.

reftable Replaces the Files Backend by Default

New repositories will default to storing references in the reftable format instead of the traditional files-plus-packed-refs layout. This matters most for tools that read .git/refs/ directly instead of using git for-each-ref or similar plumbing.

Rust Becomes Mandatory to Build Git

This is the widest-reaching change. Git has adopted Rust gradually since Git 2.49, with every component staying optional — until now. The rollout has three stages:

  • Git 2.52 — Rust auto-detected by Meson, disabled by default in the Makefile build
  • Git 2.55 — both build systems default-enable Rust (already shipped)
  • Git 3.0 — build options removed, Rust becomes mandatory

Git developer Patrick Steinhardt described the approach to Phoronix as "a test balloon" meant to give the project time to build proper infrastructure and give distributors time to adjust toolchains.

Important: if your CI builds Git from source instead of installing a package, check whether your build image has Rust support before Git 3.0 ships.

Seven Things Git 3.0 Removes Outright

  1. Grafting commits support
  2. git-pack-redundant
  3. Shorthand remote URLs in $GIT_COMMON_DIR/branches/ and /remotes/
  4. The --stdin option on git name-rev
  5. git-whatchanged
  6. core.commentString=auto
  7. core.preferSymlinkRefs=true

safe.bareRepository also changes its default from all to explicit — a real security-relevant change for automation that clones bare repositories.

What to Check Before Git 3.0 Ships

Phoronix reports a target of around end of 2026. Checklist: grep CI configs for the removed commands, confirm build images have Rust if compiling from source, check for direct .git/refs/ reads, and test that hash-parsing tooling handles 64-character hashes.

Quick Summary:

  • Git 3.0 defaults new repos to SHA-256 instead of SHA-1; existing repos are unaffected
  • New repos also default to reftable instead of loose-files ref storage
  • Rust becomes mandatory to build, rolling out across Git 2.52, 2.55, and 3.0
  • Seven features removed outright, including git-whatchanged and grafting
  • safe.bareRepository now defaults to explicit instead of all

Top comments (0)