fix: bump go-git to v5.19.1

[plural-copilot]

Summary

• fix the vulnerability surfaced in the console service image by upgrading github.com/go-git/go-git/v5 in plural-cli
• update the exact package version from v5.19.0 to v5.19.1
• keep the change minimal to remediate the root cause in the owned binary source

Details

The actionable finding reported that ghcr.io/pluralsh/console contains a vulnerable github.com/go-git/go-git/v5 v5.19.0 inside /usr/local/bin/plural. That binary is built from this repository, so the root-cause fix belongs here in plural-cli.

Exact package/version changes:

• github.com/go-git/go-git/v5: v5.19.0 -> v5.19.1

Verification

• confirmed github.com/go-git/go-git/v5 is a direct dependency in go.mod
• confirmed repository usage under pkg/utils/git/
• confirmed the final diff only updates go.mod and go.sum
• environment limitation: Docker API access was denied in the sandbox and no local go binary was installed, so no runtime module resolution test could be executed here

Follow-up

• console image consumers should rebuild or update to a console image that includes a plural-cli binary built from this fix after merge

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create the minimum root-cause PR needed in plural-cli to remediate the actionable console-image vulnerability....
🔗 Run history	View run history

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​go-git/​go-git/​v5@​v5.19.0 ⏵ v5.19.1	+1	+3

View full report