chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.1 by dependabot[bot] · Pull Request #1975 · flanksource/duty

dependabot · 2026-05-19T16:12:19Z

Bumps github.com/go-git/go-git/v5 from 5.18.0 to 5.19.1.

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.19.1

What's Changed

v5: plumbing: transport/ssh, Shell-quote path by @hiddeco in go-git/go-git#2068

v5: git: submodule, Fix relative URL resolution by @hiddeco in go-git/go-git#2070

v5: git: submodule, canonical remote for relative URLs by @hiddeco in go-git/go-git#2074

v5: git: submodule, error on remote without URLs by @hiddeco in go-git/go-git#2078

v5: plumbing: format/idxfile, Validate offset64 indices by @hiddeco in go-git/go-git#2084

v5: *: Reject malformed variable-length integers by @hiddeco in go-git/go-git#2092

v5: plumbing: format/packfile, Tighten delta validation by @hiddeco in go-git/go-git#2091

v5: Add worktreeFilesystem wrapper for worktree and hardening by @hiddeco in go-git/go-git#2100

v5: config: validate submodule names by @hiddeco in go-git/go-git#2082

build: Update module github.com/go-git/go-git/v5 to v5.19.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-git#2111

v5: git: Allow MkdirAll on worktree-root paths by @hiddeco in go-git/go-git#2117

v5: git: Stop validating symlink target paths by @pjbgf in go-git/go-git#2116

v5: plumbing: format decoder input bounds and contracts by @hiddeco in go-git/go-git#2125

plumbing: format/packfile, cap delta chain depth in parser by @pjbgf in go-git/go-git#2137

Full Changelog: go-git/go-git@v5.19.0...v5.19.1

v5.19.0

What's Changed

build: Update module github.com/go-git/go-git/v5 to v5.18.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-git#2010

v5: Bump sha1cd and go-billy by @pjbgf in go-git/go-git#2060

v5: Align object encoding with upstream by @pjbgf in go-git/go-git#2065

Full Changelog: go-git/go-git@v5.18.0...v5.19.0

Commits

3c3be60 Merge pull request #2137 from go-git/validate-v5
3fba897 plumbing: format/packfile, cap delta chain depth in parser
a97d660 Merge pull request #2125 from hiddeco/v5/format-input-bounds
aeaa125 plumbing: format/objfile, require Header before Read
1f38e17 plumbing: format/packfile, bound inflate size
f7545a0 plumbing: format/idxfile, bound nr by file size
170b881 Merge pull request #2116 from pjbgf/symlink-v5
7b6d994 Merge pull request #2117 from hiddeco/v5/worktree-fs-mkdirall-root-noop
f0709b3 git: Stop validating symlink target paths
776d00f git: Allow MkdirAll on worktree-root paths
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.18.0 to 5.19.1. - [Release notes](https://github.com/go-git/go-git/releases) - [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md) - [Commits](go-git/go-git@v5.18.0...v5.19.1) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.19.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-05-19T16:12:42Z

Benchstat (Other)

Base: 369727c670ee578eac3e33f0b0294e8938f9873c
Head: 02889f7c9326668ee2202376815e06d2769d51bc

✅ No significant performance changes detected

Full benchstat output

goos: linux
goarch: amd64
pkg: github.com/flanksource/duty/bench
cpu: AMD EPYC 9V74 80-Core Processor                
                                                       │ bench-base.txt │           bench-head.txt            │
                                                       │     sec/op     │    sec/op      vs base              │
InsertionForRowsWithAliases/external_users.aliases-4      534.9µ ±  11%   533.3µ ±  12%       ~ (p=0.589 n=6)
InsertionForRowsWithAliases/config_items.external_id-4    1.049m ±  11%   1.030m ±  12%       ~ (p=1.000 n=6)
InsertionOfConfigsWithProperties-4                        3.351m ±   2%   3.348m ±   4%       ~ (p=0.818 n=6)
UpdateOfConfigsWithProperties-4                           7.179m ±   1%   7.219m ±   5%       ~ (p=0.240 n=6)
ResourceSelectorConfigs/name-4                            197.0µ ±   7%   198.1µ ±   2%       ~ (p=0.699 n=6)
ResourceSelectorConfigs/name_and_type-4                   219.2µ ±   6%   215.5µ ±   3%       ~ (p=0.818 n=6)
ResourceSelectorConfigs/tags-4                            32.70m ± 164%   32.36m ± 172%       ~ (p=0.818 n=6)
ResourceSelectorQueryBuild/name-4                         40.29µ ±   0%   40.50µ ±   1%       ~ (p=0.065 n=6)
ResourceSelectorQueryBuild/name_and_type-4                60.07µ ±   7%   59.18µ ±   1%       ~ (p=0.699 n=6)
ResourceSelectorQueryBuild/tags-4                         16.19µ ±   1%   16.35µ ±   9%       ~ (p=0.394 n=6)
geomean                                                   486.8µ          484.9µ         -0.38%

github-actions · 2026-05-19T16:12:44Z

Benchstat (RLS)

Base: 369727c670ee578eac3e33f0b0294e8938f9873c
Head: 02889f7c9326668ee2202376815e06d2769d51bc

📊 9 minor regression(s) (all within 5% threshold)

Benchmark	Base	Head	Change	p-value
`RLS/Sample-15000/catalog_changes/Without_RLS-4`	4.418m	4.584m	+3.76%	0.002
`RLS/Sample-15000/config_summary/Without_RLS-4`	91.03m	94.18m	+3.46%	0.002
`RLS/Sample-15000/config_classes/Without_RLS-4`	3.542m	3.649m	+3.00%	0.002
`RLS/Sample-15000/config_changes/With_RLS-4`	123.7m	126.4m	+2.13%	0.004
`RLS/Sample-15000/change_types/Without_RLS-4`	4.385m	4.475m	+2.05%	0.009
`RLS/Sample-15000/config_changes/Without_RLS-4`	4.444m	4.519m	+1.70%	0.015
`RLS/Sample-15000/config_detail/With_RLS-4`	119.6m	120.6m	+0.83%	0.004
`RLS/Sample-15000/config_summary/With_RLS-4`	607.5m	610.7m	+0.53%	0.015
`RLS/Sample-15000/config_names/With_RLS-4`	121.0m	121.5m	+0.38%	0.015

✅ 2 improvement(s)

Benchmark	Base	Head	Change	p-value
`RLS/Sample-15000/config_types/With_RLS-4`	120.4m	118.8m	-1.30%	0.009
`RLS/Sample-15000/configs/With_RLS-4`	120.4m	119.5m	-0.76%	0.002

Full benchstat output

goos: linux
goarch: amd64
pkg: github.com/flanksource/duty/bench
cpu: AMD EPYC 9V74 80-Core Processor                
                                               │ bench-base.txt │          bench-head.txt           │
                                               │     sec/op     │   sec/op     vs base              │
RLS/Sample-15000/catalog_changes/Without_RLS-4      4.418m ± 0%   4.584m ± 1%  +3.76% (p=0.002 n=6)
RLS/Sample-15000/catalog_changes/With_RLS-4         125.5m ± 1%   125.1m ± 0%       ~ (p=0.065 n=6)
RLS/Sample-15000/config_changes/Without_RLS-4       4.444m ± 2%   4.519m ± 2%  +1.70% (p=0.015 n=6)
RLS/Sample-15000/config_changes/With_RLS-4          123.7m ± 2%   126.4m ± 1%  +2.13% (p=0.004 n=6)
RLS/Sample-15000/config_detail/Without_RLS-4        4.249m ± 2%   4.225m ± 1%       ~ (p=0.093 n=6)
RLS/Sample-15000/config_detail/With_RLS-4           119.6m ± 0%   120.6m ± 1%  +0.83% (p=0.004 n=6)
RLS/Sample-15000/config_names/Without_RLS-4         12.70m ± 1%   12.67m ± 0%       ~ (p=0.485 n=6)
RLS/Sample-15000/config_names/With_RLS-4            121.0m ± 0%   121.5m ± 2%  +0.38% (p=0.015 n=6)
RLS/Sample-15000/config_summary/Without_RLS-4       91.03m ± 0%   94.18m ± 2%  +3.46% (p=0.002 n=6)
RLS/Sample-15000/config_summary/With_RLS-4          607.5m ± 1%   610.7m ± 2%  +0.53% (p=0.015 n=6)
RLS/Sample-15000/configs/Without_RLS-4              7.332m ± 6%   7.642m ± 9%       ~ (p=0.180 n=6)
RLS/Sample-15000/configs/With_RLS-4                 120.4m ± 0%   119.5m ± 0%  -0.76% (p=0.002 n=6)
RLS/Sample-15000/analysis_types/Without_RLS-4       3.390m ± 0%   3.392m ± 1%       ~ (p=0.589 n=6)
RLS/Sample-15000/analysis_types/With_RLS-4          3.427m ± 2%   3.426m ± 4%       ~ (p=0.818 n=6)
RLS/Sample-15000/analyzer_types/Without_RLS-4       3.231m ± 1%   3.244m ± 1%       ~ (p=0.310 n=6)
RLS/Sample-15000/analyzer_types/With_RLS-4          3.267m ± 1%   3.252m ± 5%       ~ (p=0.485 n=6)
RLS/Sample-15000/change_types/Without_RLS-4         4.385m ± 2%   4.475m ± 2%  +2.05% (p=0.009 n=6)
RLS/Sample-15000/change_types/With_RLS-4            4.418m ± 6%   4.588m ± 2%       ~ (p=0.065 n=6)
RLS/Sample-15000/config_classes/Without_RLS-4       3.542m ± 1%   3.649m ± 1%  +3.00% (p=0.002 n=6)
RLS/Sample-15000/config_classes/With_RLS-4          120.0m ± 1%   119.4m ± 1%       ~ (p=0.065 n=6)
RLS/Sample-15000/config_types/Without_RLS-4         4.292m ± 2%   4.303m ± 1%       ~ (p=0.818 n=6)
RLS/Sample-15000/config_types/With_RLS-4            120.4m ± 0%   118.8m ± 1%  -1.30% (p=0.009 n=6)
geomean                                             18.32m        18.50m       +1.01%

socket-security · 2026-05-19T16:13:18Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/go-git/go-git/v5@v5.18.0 ⏵ v5.19.1		⁺¹⁸
	golang.org/x/exp@v0.0.0-20260218203240-3dfff04db8fa ⏵ v0.0.0-20260410095643-746e56fc9e2f

View full report

github-actions · 2026-05-19T22:13:09Z

Gavel results

Gavel exited with code .

View full results

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels May 19, 2026

dependabot Bot mentioned this pull request May 19, 2026

chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 #1965

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.1#1975

chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.1#1975
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/go-git/go-git/v5-5.19.1

dependabot Bot commented on behalf of github May 19, 2026

Uh oh!

github-actions Bot commented May 19, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 19, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented May 19, 2026

Uh oh!

github-actions Bot commented May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 19, 2026

v5.19.1

What's Changed

v5.19.0

What's Changed

Uh oh!

github-actions Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchstat (Other)

✅ No significant performance changes detected

Uh oh!

github-actions Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchstat (RLS)

📊 9 minor regression(s) (all within 5% threshold)

Uh oh!

socket-security Bot commented May 19, 2026

Uh oh!

github-actions Bot commented May 19, 2026

Gavel results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

github-actions Bot commented May 19, 2026 •

edited

Loading

github-actions Bot commented May 19, 2026 •

edited

Loading