Update go and protobuf tooling

[janezpodhostnik]

Closes: #???

Description

---

For contributor use:

• Targeted PR against master branch
• Linked to Github issue with discussion and accepted design OR link to spec that describes this work.
• Updated relevant documentation
• Re-reviewed Files changed in the Github PR explorer
• Added appropriate labels

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
gomod/golang.org/x/net	0.49.0	Unknown	Unknown
gomod/golang.org/x/sys	0.40.0	Unknown	Unknown
gomod/golang.org/x/text	0.33.0	Unknown	Unknown
gomod/google.golang.org/genproto/googleapis/rpc	0.0.0-20251029180050-ab9386a59fda	🟢 6.7	Details Check Score Reason Maintained 🟢 10 16 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy 🟢 10 security policy file detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 2 SAST tool is not run on all commits -- score normalized to 2 Vulnerabilities 🟢 10 0 existing vulnerabilities detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0
gomod/google.golang.org/grpc	1.78.0	🟢 7.9	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 9 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 10 all changesets reviewed CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Vulnerabilities 🟢 10 0 existing vulnerabilities detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 SAST 🟢 7 SAST tool detected but not run on all commits
gomod/google.golang.org/protobuf	1.36.11	Unknown	Unknown

Scanned Files

• protobuf/go.mod
• protobuf/go/flow/go.mod

[github-actions]

⚠️ Security Dependency Review Failed ⚠️

This pull request introduces dependencies with security vulnerabilities of moderate severity or higher.

Vulnerable Dependencies:

📦 golang.org/x/net@0.34.0

What to do next?

1. Review the vulnerability details in the Dependency Review Comment above, specifically the "Vulnerabilities" section
2. Click on the links in the "Vulnerability" section to see the details of the vulnerability
3. If multiple versions of the same package are vulnerable, please update to the common latest non-vulnerable version
4. If you are unsure about the vulnerability, please contact the security engineer
5. If the vulnerability cannot be avoided (can't upgrade, or need to keep), contact #security on slack to get it added to the allowlist

Security Engineering contact: #security on slack

[janezpodhostnik]

⚠️ Security Dependency Review Failed ⚠️

This pull request introduces dependencies with security vulnerabilities of moderate severity or higher.

Vulnerable Dependencies:

📦 golang.org/x/net@0.34.0

What to do next?

1. Review the vulnerability details in the Dependency Review Comment above, specifically the "Vulnerabilities" section
2. Click on the links in the "Vulnerability" section to see the details of the vulnerability
3. If multiple versions of the same package are vulnerable, please update to the common latest non-vulnerable version
4. If you are unsure about the vulnerability, please contact the security engineer
5. If the vulnerability cannot be avoided (can't upgrade, or need to keep), contact #security on slack to get it added to the allowlist

Security Engineering contact: #security on slack

Updated, but the comment wont go away...