In the middle of vacuous complaints about slightly late tools and debatable threat models, I see one legitimate-looking concern in this article: submodules require either hashing algorithm and therefore force inconvenient upgrades.

Is it true? Where exactly the parent repository references hashes from the submodule repositories, and how could these links be generalized for compatibility?