chore(deps): bump google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12

[dependabot]

Bumps google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

Claude finished @dependabot[bot]'s task in 34s —— View job

---

Dependency review: google.golang.org/protobuf

• Identify changed dependencies
• Assess semver / breaking changes
• Check repo usage of the dependency
• Report risks & follow-ups

Change: google.golang.org/protobuf 1.36.12-0.20260120151049-f2248ac996af → 1.36.12 (go.mod, go.sum only)

Assessment: ✅ Safe

This is effectively a pseudo-version → tagged-release swap, not a real version jump:

• The "from" version 1.36.12-0.20260120151049-f2248ac996af is a Go pseudo-version pinned to a specific commit that predates the v1.36.12 tag. The "to" version is the final released v1.36.12.
• In go.sum, the /go.mod hash is identical for both (h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=). Only the module content hash changed, which is expected between a snapshot and its release tag. This means no dependency-graph changes are introduced.
• Dependabot classifies it as version-update:semver-patch — no breaking changes.

Repo usage

The only non-generated use of protobuf in the codebase is:

• internal/cloudrun/cloudrun_test.go:11 — imports google.golang.org/protobuf/types/known/timestamppb (test-only).

timestamppb is a long-stable, well-frozen API; a patch-level release carries no risk to it. protobuf is otherwise pulled in transitively via google.golang.org/api and grpc.

Follow-ups

None required. A green make build / make vet on CI is sufficient confirmation. Safe to merge.
· dependabot/go_modules/google.golang.org/protobuf-1.36.12