Bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2

[dependabot]

Bumps github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2.

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.19.2

What's Changed

• build: Update module golang.org/x/crypto to v0.52.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2150
• build: Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2141
• build: Update module golang.org/x/net to v0.55.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2152
• git: Worktree: Add stores index entires with backslashes on Windows by @​joshblum in go-git/go-git#2262
• storage: dotgit, reject path traversal in reference names by @​pjbgf in go-git/go-git#2254
• build: Update module golang.org/x/net to v0.56.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2267
• build: Update module golang.org/x/text to v0.39.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2268
• [v5] git: worktree, make the filesystem wrapper a symlink-safe boundary by @​pjbgf in go-git/go-git#2277

Full Changelog: go-git/go-git@v5.19.1...v5.19.2

Commits

• 3eeb238 Merge pull request #2277 from go-git/checkout-v5
• 008a78f git: worktree, make the filesystem wrapper a symlink-safe boundary
• 2263fb5 Merge pull request #2268 from go-git/renovate/releases/v5.x-go-golang.org-x-t...
• 77b7625 build: Update module golang.org/x/text to v0.39.0 [SECURITY]
• 85ea767 Merge pull request #2267 from go-git/renovate/releases/v5.x-go-golang.org-x-n...
• 198675a build: Update module golang.org/x/net to v0.56.0 [SECURITY]
• 4a0e66d Merge pull request #2254 from pjbgf/v5-dotgit-ref-name-containment
• 3b306ef storage: dotgit, align reference-name safety with refname_is_safe
• f3d0cc1 storage: dotgit, reject path traversal in reference names
• 979cfe9 Merge pull request #2262 from joshblum/joshblum/to-slash-v5
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[github-actions]

View full scan results in JFrog Platform

📗 Scan Summary

• Frogbot scanned for vulnerabilities and found 3 issues

Scan Category	Status	Security Issues
Software Composition Analysis	✅ Done	3 Issues Found 3 High
Contextual Analysis	✅ Done	-
Static Application Security Testing (SAST)	✅ Done	Not Found
Secrets	✅ Done	Not Found
Services	✅ Done	Not Found
Infrastructure as Code (IaC)	✅ Done	Not Found

📦 Vulnerable Dependencies

Severity	ID	Contextual Analysis	Dependency Path
High	CVE-2026-78662	Not Applicable	1 Direct golang.org/x/crypto:0.53.0 1 Transitive golang.org/x/crypto:0.53.0
High	CVE-2026-56855	Not Applicable	1 Direct golang.org/x/crypto:0.53.0 1 Transitive golang.org/x/crypto:0.53.0
High	CVE-2026-56854	Not Applicable	1 Direct golang.org/x/crypto:0.53.0 1 Transitive golang.org/x/crypto:0.53.0

🔖 Details

[ CVE-2026-78662 ] golang.org/x/crypto 0.53.0

Vulnerability Details

Contextual Analysis:	Not Applicable
CVSS V3:	7.5
Dependency Path:	golang.org/x/crypto: 0.53.0 (Transitive)

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection.

Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

[ CVE-2026-56855 ] golang.org/x/crypto 0.53.0

Vulnerability Details

Contextual Analysis:	Not Applicable
CVSS V3:	7.5
Dependency Path:	golang.org/x/crypto: 0.53.0 (Transitive)

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection.

Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

[ CVE-2026-56854 ] golang.org/x/crypto 0.53.0

Vulnerability Details

Contextual Analysis:	Not Applicable
CVSS V3:	7.5
Dependency Path:	golang.org/x/crypto: 0.53.0 (Transitive)

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

---

🐸 JFrog Frogbot