chore(deps): update google.golang.org/genproto/googleapis/rpc digest to a57be14

[renovate-sh-app]

This PR contains the following updates:

Package	Type	Update	Change
google.golang.org/genproto/googleapis/rpc	replace	digest	79d6a2a → a57be14

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

---

Note

^{Cursor Bugbot is generating a summary for commit 4223fe8. Configure here.}

[cursor]

Genproto replace directives now use inconsistent snapshot versions

Medium Severity

The comment at lines 162-167 explicitly states these replace directives must use "compatible versions from the same snapshot" to avoid build failures. After this change, google.golang.org/genproto/googleapis/rpc uses snapshot 20251222181119-0a764e51fe1b while the other two genproto modules still use snapshot 20251124214823-79d6a2a48846. This version mismatch violates the documented invariant and could cause the compatibility issues the workaround was designed to prevent.

Additional Locations (2)

• go.mod#L167-L168
• go.mod#L171-L172

 

[renovate-sh-app]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.24.0 -> 1.25.0
google.golang.org/protobuf	v1.36.10 -> v1.36.11

[cursor]

Unintended Go version bump from 1.24 to 1.25

Medium Severity

The go directive was bumped from 1.24.0 (with toolchain go1.24.4) to 1.25.0 (with no toolchain directive). This raises the minimum Go version required to build the module. This change is not mentioned in the PR description, which only intends to update the google.golang.org/genproto/googleapis/rpc digest. This could break downstream consumers or CI environments still using Go 1.24.

 

[cursor]

Bugbot Autofix prepared fixes for 1 of the 1 bugs found in the latest run.

• ✅ Fixed: Unintended Go version bump from 1.24 to 1.25
  • Restored the go directive to 1.24.0 and toolchain directive to go1.24.4, reverting the unintended version bump that occurred during the dependency update.

Or push these changes by commenting:

@cursor push 3e1f315daa

Preview (3e1f315daa)

diff --git a/go.mod b/go.mod
--- a/go.mod
+++ b/go.mod
@@ -1,7 +1,9 @@
 module github.com/grafana/alerting
 
-go 1.25.0
+go 1.24.0
 
+toolchain go1.24.4
+
 require (
 	github.com/Masterminds/sprig/v3 v3.2.1
 	github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Genproto replace directives use mismatched snapshot versions
  • I reverted the googleapis/rpc replace directive to the same 20251124 snapshot as the other genproto replaces and added matching go.sum entries so the build uses a consistent snapshot set.

Or push these changes by commenting:

@cursor push 609c6ea602

Preview (609c6ea602)

diff --git a/go.mod b/go.mod
--- a/go.mod
+++ b/go.mod
@@ -165,6 +165,6 @@
 // the same snapshot. Remove once upstream dependencies (dskit -> gogo/status) are updated.
 replace google.golang.org/genproto => google.golang.org/genproto v0.0.0-20251124214823-79d6a2a48846
 
-replace google.golang.org/genproto/googleapis/rpc => google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171
+replace google.golang.org/genproto/googleapis/rpc => google.golang.org/genproto/googleapis/rpc v0.0.0-20251124214823-79d6a2a48846
 
 replace google.golang.org/genproto/googleapis/api => google.golang.org/genproto/googleapis/api v0.0.0-20251124214823-79d6a2a48846

diff --git a/go.sum b/go.sum
--- a/go.sum
+++ b/go.sum
@@ -2340,6 +2340,8 @@
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20250728155136-f173205681a0/go.mod h1:h6yxum/C2qRb4txaZRLDHK8RyS0H/o2oEDeKY4onY/Y=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20250804133106-a7a43d27e69b/go.mod h1:h6yxum/C2qRb4txaZRLDHK8RyS0H/o2oEDeKY4onY/Y=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20250908214217-97024824d090/go.mod h1:Zm0W1CckZuSE8rNxJRJ0+pbZP3UOe8WQpyr0KGPtjAQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251124214823-79d6a2a48846 h1:Wgl1rcDNThT+Zn47YyCXOXyX/COgMTIdhJ717F0l4xk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251124214823-79d6a2a48846/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.12.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=

[cursor]

Genproto replace directives use mismatched snapshot versions

Medium Severity

The comment on lines 160–165 explicitly states that the three genproto replace directives must use "compatible versions from the same snapshot." After this change, googleapis/rpc is pinned to snapshot 20260226 while genproto and googleapis/api remain on snapshot 20251124, three months apart. This version skew across tightly coupled modules defeats the stated purpose of the workaround and risks type mismatches or build failures.

Additional Locations (1)

• go.mod#L159-L166