[deps] Update google.golang.org/protobuf from v1.36.8 to v1.36.11

[github-actions]

Summary

Update the indirect dependency google.golang.org/protobuf from v1.36.8 to v1.36.11. This is a foundational package used for Protocol Buffers serialization across multiple dependencies.

Current State

• Package: google.golang.org/protobuf
• Current Version: v1.36.8
• Proposed Version: v1.36.11
• Dependency Type: Indirect (// indirect in go.mod)
• Update Type: Multi-version patch jump (v1.36.8 → v1.36.11, skips v1.36.9, v1.36.10)

Why Separate Issue

⚠️ Multi-version patch jump requires testing

• Jumps 3 patch versions (v1.36.8 → v1.36.11)
• Skips intermediate releases v1.36.9 and v1.36.10
• Foundational protobuf library used by many indirect dependencies (gRPC, Google APIs)
• Changes to text format parsing may affect serialization behavior

Safety Assessment

⚠️ Requires careful review

• Multi-version patch jump (3 versions skipped) increases cumulative risk
• encoding/prototext: Added support for URL chars in type URLs in text-format
• internal/impl: Additional internal checks (details from v1.36.11)
• Changes to protobuf encoding/decoding should be tested carefully
• Review all intermediate patch notes (v1.36.9, v1.36.10, v1.36.11)

Changes (v1.36.11)

• encoding/prototext: Support URL chars in type URLs in text-format
• internal/impl: Internal implementation improvements

Links

• v1.36.11 Release Notes
• Package Repository
• [Go Package]((pkg.go.dev/redacted)

Recommended Action

go get google.golang.org/protobuf@v1.36.11
go mod tidy

Testing Notes

• Run all tests: make test-unit
• Test any workflow that uses Google APIs or gRPC
• Verify MCP server communication is unaffected
• Check protobuf serialization in any Google Cloud integrations

Generated by Dependabot Dependency Checker

• expires on Feb 25, 2026, 9:28 AM UTC