chore(deps): weekly safe go updates · 1 package

[mendral-app]

Packages bumped

Package	Old	New	Type
google.golang.org/protobuf	v1.36.11	v1.36.12	indirect

Per-package details

google.golang.org/protobuf v1.36.11 → v1.36.12

Patch release (published 2026-08-10). Highlights:

• Fix google.protobuf.Empty JSON serialization
• Implement recursion limit in encoding/prototext
• Error out in encoding/protodelim when size exceeds math.MaxInt
• Reject non-numeric ints/floats in encoding/protojson
• Support hex and octal default values for numeric fields
• Add missing IsProto3Optional initialization in reflect/protodesc
• Fix dead code elimination with Go 1.26 by removing MethodByName usage

Impact on this codebase: Indirect dependency pulled in by github.com/moby/buildkit (via github.com/planetscale/vtprotobuf). godolint does not use protobuf serialization directly — buildkit's Dockerfile parser has no protobuf surface area. No code changes required.

Additional cleanup

go mod tidy removed the unused indirect dependency github.com/gogo/protobuf v1.3.2.

Files modified

• go.mod
• go.sum

Skipped this ecosystem

Package	Current	Reason
github.com/moby/buildkit	v0.31.1	Open PR #12 already bumps to v0.32.0
github.com/mattn/go-isatty	v0.0.22	Open PR #12 already bumps to v0.0.24
golang.org/x/sys	v0.46.0	Open PR #12 already bumps to v0.47.0
github.com/urfave/cli/v3	v3.10.1	v3.11.0 published 2026-08-16, under 7-day cooldown
github.com/rs/zerolog	v1.35.1	Already at latest
mvdan.cc/sh/v3	v3.13.1	Already at latest
github.com/containerd/typeurl/v2	v2.3.0	Already at latest
github.com/mattn/go-colorable	v0.1.15	Already at latest
github.com/planetscale/vtprotobuf	v0.6.1-…-0393e58bdf10	Pseudo-version; no newer tagged release
github.com/pkg/errors	v0.9.1	Already at latest (archived)

---

Note

Created by Mendral. Tag @mendral-app with feedback or questions.

• View implementation session