Threats affecting pkg:cargo/gix-features

gitoxide uses SHA-1 hash implementations without collision detection, making it vulnerable to SHA-1 collision attacks. Unlike Git, which mitigates this risk by detecting known SHA-1 collisions since version 2.13.0, gitoxide does not implement such protections. This allows an attacker to create two distinct Git objects with the same SHA-1 hash, potentially undermining repository integrity. The vulnerability affects all gitoxide versions before 0.41.0 and has a medium severity rating with a CVSS score of 6.8. A fix is available in version 0.41.0.