No, your process of tracking plugins is reasonable, but didn't cover the scenario which the git plugin is currently managing.
The git plugin delivered a major release (3.0.0) which added submodule authentication. However, the changes needed for submodule authentication were broad enough that they broke compatibility with authentication at some git plugin installations. There are several bugs authentication bugs which have been reported that indicate the changes introduced incompatibilities.
This change was applied (and released) in git plugin 2.6.1 in order to retain compatibility with the git plugin 2.x line. It will also be released in the near future as a git plugin 3.0.1.
If you need it immediately in released form, and don't need the features added in git plugin 3.0.0, you can download and install 2.6.1 and use it. Otherwise, you can wait a few days and I'll have released the git plugin 3.0.1 version which also includes the fix.