chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0

[dependabot]

Bumps github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0.

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.19.0

What's Changed

• build: Update module github.com/go-git/go-git/v5 to v5.18.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2010
• v5: Bump sha1cd and go-billy by @​pjbgf in go-git/go-git#2060
• v5: Align object encoding with upstream by @​pjbgf in go-git/go-git#2065

Full Changelog: go-git/go-git@v5.18.0...v5.19.0

Commits

• bc930f4 Merge pull request #2065 from go-git/commit-v5
• d315264 plumbing: object, Reset object before decode
• 6e1d348 plumbing: object, Align Tree handling with upstream
• e134ba3 tests: Skip double checks in Git v2.11
• 1971422 tests: Add git conformance tests for signing verification
• a387aa8 plumbing: object, Add ErrMalformedTag
• f415670 plumbing: object, Decode Tag headers via a state machine
• 5b0cd38 plumbing: object, Reject multi-signature commits at Verify
• fe8ed62 plumbing: object, Align Tag.EncodeWithoutSignature with Commit
• 98e337d plumbing: object, Add support for Tag.SignatureSHA256
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Benchstat (RLS)

Base: 617b11d4451d2f93ce8aa22f89b34eebcdc8686d
Head: c7d7fd03ed1579a422528a1d960ce17105e929b4

📊 7 minor regression(s) (all within 5% threshold)

Benchmark	Base	Head	Change	p-value
RLS/Sample-15000/change_types/Without_RLS-4	4.406m	4.559m	+3.48%	0.002
RLS/Sample-15000/config_changes/With_RLS-4	124.1m	126.2m	+1.71%	0.002
RLS/Sample-15000/configs/With_RLS-4	119.1m	120.6m	+1.26%	0.002
RLS/Sample-15000/config_names/Without_RLS-4	12.45m	12.60m	+1.19%	0.002
RLS/Sample-15000/config_summary/With_RLS-4	599.8m	606.7m	+1.15%	0.002
RLS/Sample-15000/change_types/With_RLS-4	4.423m	4.456m	+0.74%	0.026
RLS/Sample-15000/config_detail/With_RLS-4	119.1m	119.9m	+0.65%	0.002

✅ 4 improvement(s)

Benchmark	Base	Head	Change	p-value
RLS/Sample-15000/config_names/With_RLS-4	122.0m	120.1m	-1.52%	0.002
RLS/Sample-15000/config_detail/Without_RLS-4	4.263m	4.201m	-1.45%	0.002
RLS/Sample-15000/config_changes/Without_RLS-4	4.461m	4.401m	-1.36%	0.009
RLS/Sample-15000/config_summary/Without_RLS-4	90.65m	89.79m	-0.94%	0.004

Full benchstat output

goos: linux
goarch: amd64
pkg: github.com/flanksource/duty/bench
cpu: AMD EPYC 9V74 80-Core Processor                
                                               │ bench-base.txt │          bench-head.txt           │
                                               │     sec/op     │   sec/op     vs base              │
RLS/Sample-15000/catalog_changes/Without_RLS-4      4.457m ± 2%   4.420m ± 1%       ~ (p=0.132 n=6)
RLS/Sample-15000/catalog_changes/With_RLS-4         124.1m ± 1%   125.4m ± 0%       ~ (p=0.240 n=6)
RLS/Sample-15000/config_changes/Without_RLS-4       4.461m ± 1%   4.401m ± 1%  -1.36% (p=0.009 n=6)
RLS/Sample-15000/config_changes/With_RLS-4          124.1m ± 1%   126.2m ± 1%  +1.71% (p=0.002 n=6)
RLS/Sample-15000/config_detail/Without_RLS-4        4.263m ± 1%   4.201m ± 0%  -1.45% (p=0.002 n=6)
RLS/Sample-15000/config_detail/With_RLS-4           119.1m ± 0%   119.9m ± 1%  +0.65% (p=0.002 n=6)
RLS/Sample-15000/config_names/Without_RLS-4         12.45m ± 0%   12.60m ± 0%  +1.19% (p=0.002 n=6)
RLS/Sample-15000/config_names/With_RLS-4            122.0m ± 3%   120.1m ± 1%  -1.52% (p=0.002 n=6)
RLS/Sample-15000/config_summary/Without_RLS-4       90.65m ± 1%   89.79m ± 1%  -0.94% (p=0.004 n=6)
RLS/Sample-15000/config_summary/With_RLS-4          599.8m ± 1%   606.7m ± 0%  +1.15% (p=0.002 n=6)
RLS/Sample-15000/configs/Without_RLS-4              7.195m ± 3%   7.221m ± 2%       ~ (p=0.485 n=6)
RLS/Sample-15000/configs/With_RLS-4                 119.1m ± 1%   120.6m ± 0%  +1.26% (p=0.002 n=6)
RLS/Sample-15000/analysis_types/Without_RLS-4       3.392m ± 1%   3.399m ± 1%       ~ (p=0.818 n=6)
RLS/Sample-15000/analysis_types/With_RLS-4          3.382m ± 2%   3.393m ± 0%       ~ (p=0.065 n=6)
RLS/Sample-15000/analyzer_types/Without_RLS-4       3.219m ± 1%   3.204m ± 2%       ~ (p=0.310 n=6)
RLS/Sample-15000/analyzer_types/With_RLS-4          3.219m ± 1%   3.233m ± 4%       ~ (p=0.132 n=6)
RLS/Sample-15000/change_types/Without_RLS-4         4.406m ± 1%   4.559m ± 1%  +3.48% (p=0.002 n=6)
RLS/Sample-15000/change_types/With_RLS-4            4.423m ± 1%   4.456m ± 2%  +0.74% (p=0.026 n=6)
RLS/Sample-15000/config_classes/Without_RLS-4       3.527m ± 2%   3.521m ± 1%       ~ (p=0.485 n=6)
RLS/Sample-15000/config_classes/With_RLS-4          118.8m ± 0%   118.6m ± 0%       ~ (p=0.065 n=6)
RLS/Sample-15000/config_types/Without_RLS-4         4.191m ± 2%   4.229m ± 2%       ~ (p=0.065 n=6)
RLS/Sample-15000/config_types/With_RLS-4            119.4m ± 0%   119.7m ± 0%       ~ (p=0.093 n=6)
geomean                                             18.21m        18.27m       +0.31%

[github-actions]

Benchstat (Other)

Base: 617b11d4451d2f93ce8aa22f89b34eebcdc8686d
Head: c7d7fd03ed1579a422528a1d960ce17105e929b4

✅ No significant performance changes detected

Full benchstat output

goos: linux
goarch: amd64
pkg: github.com/flanksource/duty/bench
cpu: AMD EPYC 7763 64-Core Processor                
                                                       │ bench-base.txt │           bench-head.txt           │
                                                       │     sec/op     │    sec/op     vs base              │
InsertionForRowsWithAliases/external_users.aliases-4       583.3µ ±  2%   581.8µ ±  1%       ~ (p=0.937 n=6)
InsertionForRowsWithAliases/config_items.external_id-4     1.101m ± 10%   1.078m ± 13%       ~ (p=0.818 n=6)
InsertionOfConfigsWithProperties-4                         3.810m ±  1%   3.763m ±  3%       ~ (p=0.132 n=6)
UpdateOfConfigsWithProperties-4                            7.647m ±  2%   7.606m ±  2%       ~ (p=1.000 n=6)
ResourceSelectorConfigs/name-4                             213.1µ ±  2%   211.7µ ±  4%       ~ (p=0.132 n=6)
ResourceSelectorConfigs/name_and_type-4                    231.1µ ±  3%   234.5µ ±  5%       ~ (p=0.240 n=6)
ResourceSelectorConfigs/tags-4                             29.86m ±  4%   30.28m ±  5%       ~ (p=0.180 n=6)
ResourceSelectorQueryBuild/name-4                          44.20µ ±  1%   44.21µ ±  2%       ~ (p=1.000 n=6)
ResourceSelectorQueryBuild/name_and_type-4                 64.31µ ±  2%   64.23µ ±  1%       ~ (p=0.818 n=6)
ResourceSelectorQueryBuild/tags-4                          17.56µ ±  1%   17.73µ ±  6%       ~ (p=0.065 n=6)
geomean                                                    517.4µ         516.8µ        -0.12%

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​go-git/​go-git/​v5@​v5.18.0 ⏵ v5.19.0		+16
	golang.org/​x/​exp@​v0.0.0-20260218203240-3dfff04db8fa ⏵ v0.0.0-20260410095643-746e56fc9e2f

View full report

[dependabot]

Superseded by #1975.