chore(deps): update google.golang.org/genproto digest to afd174a

[renovate-sh-app]

This PR contains the following updates:

Package	Type	Update	Change
google.golang.org/genproto	replace	digest	79d6a2a → afd174a

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

[renovate-sh-app]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 23 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.24.0 -> 1.25.0
github.com/stretchr/testify	v1.10.0 -> v1.11.1
go.opentelemetry.io/otel	v1.37.0 -> v1.43.0
go.opentelemetry.io/otel/trace	v1.37.0 -> v1.43.0
golang.org/x/net	v0.44.0 -> v0.52.0
golang.org/x/oauth2	v0.31.0 -> v0.36.0
golang.org/x/sync	v0.17.0 -> v0.20.0
github.com/grpc-ecosystem/grpc-gateway/v2	v2.26.3 -> v2.27.2
go.opentelemetry.io/auto/sdk	v1.1.0 -> v1.2.1
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.61.0 -> v0.67.0
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric	v1.36.0 -> v1.42.0
go.opentelemetry.io/otel/metric	v1.37.0 -> v1.43.0
go.opentelemetry.io/otel/sdk	v1.37.0 -> v1.43.0
go.opentelemetry.io/otel/sdk/metric	v1.37.0 -> v1.43.0
go.opentelemetry.io/proto/otlp	v1.6.0 -> v1.9.0
golang.org/x/crypto	v0.42.0 -> v0.49.0
golang.org/x/mod	v0.27.0 -> v0.33.0
golang.org/x/sys	v0.36.0 -> v0.42.0
golang.org/x/text	v0.29.0 -> v0.35.0
golang.org/x/tools	v0.36.0 -> v0.42.0
google.golang.org/genproto/googleapis/api	v0.0.0-20251111163417-95abcf5c77ba -> v0.0.0-20260406210006-6f92a3bedf2d
google.golang.org/genproto/googleapis/rpc	v0.0.0-20251111163417-95abcf5c77ba -> v0.0.0-20260406210006-6f92a3bedf2d
google.golang.org/grpc	v1.75.1 -> v1.80.0
google.golang.org/protobuf	v1.36.10 -> v1.36.11

[cursor]

Inconsistent genproto replace directives break same-snapshot requirement

Medium Severity

The replace directive for google.golang.org/genproto is updated to snapshot 0a764e51fe1b (December 22, 2025), but the replace directives for google.golang.org/genproto/googleapis/rpc and google.golang.org/genproto/googleapis/api remain pinned to snapshot 79d6a2a48846 (November 24, 2025). The comment above these directives explicitly states they should use "compatible versions from the same snapshot" to avoid build failures. This inconsistency could cause interface mismatches or compatibility issues between the genproto modules.

 

[cursor]

Go version bump may break builds

Medium Severity

The module go version is bumped from 1.24.0 to 1.25.0 and the toolchain go1.24.4 line is removed. This can break consumers/CI environments that rely on the pinned toolchain or don’t have Go 1.25 available yet, even though the PR’s stated intent is only a genproto digest update.

 

[cursor]

Bugbot Autofix prepared fixes for 1 of the 1 bugs found in the latest run.

• ✅ Fixed: Go version bump may break builds
  • Restored the Go version to 1.24.0 and re-added the toolchain go1.24.4 directive that were accidentally changed during the genproto digest update.

Or push these changes by commenting:

@cursor push 24f74275b7

Preview (24f74275b7)

diff --git a/go.mod b/go.mod
--- a/go.mod
+++ b/go.mod
@@ -1,7 +1,9 @@
 module github.com/grafana/alerting
 
-go 1.25.0
+go 1.24.0
 
+toolchain go1.24.4
+
 require (
 	github.com/Masterminds/sprig/v3 v3.2.1
 	github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Genproto replace directives use mismatched snapshot versions
  • Updated the googleapis/rpc and googleapis/api replace directives in go.mod to the same 20260223185530-2f722ef697dc snapshot as google.golang.org/genproto to restore snapshot compatibility.

Or push these changes by commenting:

@cursor push 37697bf8e0

Preview (37697bf8e0)

diff --git a/go.mod b/go.mod
--- a/go.mod
+++ b/go.mod
@@ -166,6 +166,6 @@
 // the same snapshot. Remove once upstream dependencies (dskit -> gogo/status) are updated.
 replace google.golang.org/genproto => google.golang.org/genproto v0.0.0-20260223185530-2f722ef697dc
 
-replace google.golang.org/genproto/googleapis/rpc => google.golang.org/genproto/googleapis/rpc v0.0.0-20251124214823-79d6a2a48846
+replace google.golang.org/genproto/googleapis/rpc => google.golang.org/genproto/googleapis/rpc v0.0.0-20260223185530-2f722ef697dc
 
-replace google.golang.org/genproto/googleapis/api => google.golang.org/genproto/googleapis/api v0.0.0-20251124214823-79d6a2a48846
+replace google.golang.org/genproto/googleapis/api => google.golang.org/genproto/googleapis/api v0.0.0-20260223185530-2f722ef697dc

[cursor]

Genproto replace directives use mismatched snapshot versions

Medium Severity

The comment on line 165 explicitly states these replace directives must use "compatible versions from the same snapshot." The google.golang.org/genproto replace was updated to snapshot 20260223185530-2f722ef697dc, but the googleapis/rpc and googleapis/api replacements still point to the old snapshot 20251124214823-79d6a2a48846. This version skew between the monolithic module and its sub-modules breaks the stated invariant and could cause incompatibilities if protobuf definitions changed between the two snapshots (~3 months apart).

Additional Locations (1)

• go.mod#L168-L171

 

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Go version in go.mod conflicts with go.work
  • Updated go.work to go 1.25.0 so the workspace version is no longer lower than the module go directive.

Or push these changes by commenting:

@cursor push 7190d1b5b1

Preview (7190d1b5b1)

diff --git a/go.work b/go.work
--- a/go.work
+++ b/go.work
@@ -1,4 +1,4 @@
-go 1.24.4
+go 1.25.0
 
 use (
 	.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: go.mod and go.work have mismatched Go versions
  • I restored go.mod to go 1.24.0 and re-added toolchain go1.24.4, aligning it with go.work and avoiding an unintended minimum Go version bump.

Or push these changes by commenting:

@cursor push be43d11612

Preview (be43d11612)

diff --git a/go.mod b/go.mod
--- a/go.mod
+++ b/go.mod
@@ -1,7 +1,9 @@
 module github.com/grafana/alerting
 
-go 1.25.0
+go 1.24.0
 
+toolchain go1.24.4
+
 require (
 	github.com/Masterminds/sprig/v3 v3.2.1
 	github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b