[wongarsu]

There was a practical collision attack on 28 rounds in 2016. Only 3 rounds of progress in 8 years is a pretty good sign for sha256.

For new code it might be better to use blake2b, blake3 or sha3, but at the same time I don't think there is any rush to migrate existing systems away from sha256.

[egberts1]

Better off with SHAKE256: none of that "oops, I went with easier SHA3-224", plus SHAKE256 is faster.

[lifthrasiir]

Indeed. SHA-2 is unexpectedly stronger than the expectation a decade ago.