And people were not-so-long-ago concerned that phones are spying after them. Now they just send all the info themselves.

Submodules are not the preferred way to incorporate third-party code for any environment I know. And while web-exposed URLs for management tools like Jira or AzureDevOps will need to adapt before the new default can be used, doing so even with a wholesale re-hashing of every commit isn’t technically difficult.

Well, like it or not, they are used. And not so rarely. Now, rehashing will probably work, but it will require every project to do that. If you use more than one submodule which is not under your control, you have again mixed hashes that you can’t fix easily.

Where do you see that submodules won’t cause headaches?

The root problem is that there is no backward compatibility - you can’t mix the two. Why is that is beyond me.

All praise the Orange’s cybersecurity cuts plus incompetent and corrupt leadership, wcgw, eh…

Super Intelligence at work…