SHA-1 is broken. When you use SHA-1 to verify the signature of your license files then an attacker can generate a license file which will pass your verification algorithm in reasonable time. Anything they need to do that (your verification algorithms and any shared secrets) must be a part of your program, otherwise it couldn't do offline verification.
But there are many other hash algorithms you can use as a simple drop-in replacement. When the hash algorithm has no considerable weakness and your license keys have enough entropy (long enough completely random and unique part) it doesn't even need to be a particularly slow algorithm, because brute-force attacks are unfeasible. You could, for example, use one of the algorithms from the SHA-2 or SHA-3 families. Despite the name they don't have much in common with SHA-1, so the vulnerability does not apply to them.
However, your client should rather be worried about a cracker releasing a patch to remove your license checking code from your programs binary altogether. In practice, copy protection is rarely effective against a determined attacker. When it runs completely on the users machine then it can't be 100% effective, because it runs under the users control. It mostly works by making piracy less convenient than buying, not by making it impossible.
Which brings me to another important consideration: The best copy protection is making the product easy to buy. The more hoops you have your user jump through to get and apply a proper license, the more likely that they will look for "alternative methods" to get it to run. The steps mentioned in the article linked in the question (user tells vendor device-id, vendor replies with license file...) sound far harder than googling "JMA's program crack download".