chore: upgrade go-git to v5.19.2 to address CVE-2026-71556, CVE-2026-71557

[claude]

Summary

Upgrades github.com/go-git/go-git/v5 from v5.19.1 to v5.19.2, the patched floor for two advisories reported by Dependabot. Both affect filesystem-backed repositories, which is how zoekt uses go-git (gitindex operates on on-disk clones), so both apply here.

Advisory	Severity	Issue
CVE-2026-71556 — go-git: Worktree operations may follow symlinks	HIGH	SOU-1910
CVE-2026-71557 — go-git: Malicious reference names may modify files outside the reference storage	MEDIUM	SOU-1911

• CVE-2026-71556: the worktreeFilesystem wrapper rejected dangerous path strings, but did not stop operations from following symlinks already present in the worktree, so a string-safe path could resolve into .git. Fixed by making the worktree filesystem wrapper a symlink-safe boundary.
• CVE-2026-71557: loose reference names were used as filesystem paths without verifying the resolved path stayed inside the reference storage, so a name such as refs/heads/../../config could reach unrelated repository metadata. Fixed by validating reference names at the dotgit storage entry points.

Changes

Only go.mod and go.sum are touched — no source changes were needed, as the fixes are internal to go-git.

golang.org/x/crypto (v0.52.0 → v0.53.0), golang.org/x/net (v0.55.0 → v0.56.0), and golang.org/x/sys (v0.45.0 → v0.46.0) move up because those versions are go-git v5.19.2's own required minimums, not discretionary upgrades. No other dependencies changed.

Verification

• go list -m github.com/go-git/go-git/v5 resolves to v5.19.2; go.sum retains no v5.19.1 entry, so no affected version remains in the graph.
• govulncheck ./... reports no go-git findings in its symbol, package, or module results. It does still report three findings in unrelated modules (go.opentelemetry.io/otel GO-2026-5158, golang.org/x/crypto/openpgp GO-2026-5932, github.com/klauspost/compress GO-2026-5841); those are outside the scope of these two issues and are intentionally left alone.
• go build ./... and go build ./cmd/... pass.
• go test ./... -short passes except internal/e2e, which fails identically on unmodified main in this environment because universal-ctags/scip-ctags are not installed (universal-ctags is missing, scip-ctags not available). Verified as a pre-existing baseline failure, unrelated to this change. ./gitindex/... and ./index/... — the packages that consume go-git — pass.
• go vet ./... output is byte-identical to the main baseline.

Fixes SOU-1910
Fixes SOU-1911

🤖 Generated with Claude Code

---

Note

Low Risk
Dependency-only security patch with no zoekt source changes; risk is limited to go-git behavior changes in v5.19.2, which is the intended remediation path.

Overview
Bumps github.com/go-git/go-git/v5 from v5.19.1 to v5.19.2 to pick up fixes for two filesystem-related advisories (symlink traversal in worktree operations and malicious reference names escaping reference storage). Zoekt uses go-git against on-disk repos via gitindex and related tooling, so these CVEs are relevant even though this PR does not change application code.

go.mod and go.sum only. Transitive minimums move with go-git: golang.org/x/crypto v0.52.0 → v0.53.0, golang.org/x/net v0.55.0 → v0.56.0, and golang.org/x/sys v0.45.0 → v0.46.0.

^{Reviewed by Cursor Bugbot for commit a516d1d. Bugbot is set up for automated code reviews on this repo. Configure here.}