fix(deps): update module google.golang.org/protobuf to v1.36.12

[renovate-fullsend]

This PR contains the following updates:

Package	Change	Age	Confidence
google.golang.org/protobuf	v1.36.11 → v1.36.12

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[renovate-fullsend]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
github.com/spf13/pflag	v1.0.9 -> v1.0.9

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:35 PM UTC · Completed 3:50 PM UTC

Commit: a0a22ed · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Looks good to me

Previous run

Looks good to me

Previous run (2)

Looks good to me

Previous run (3)

Looks good to me

Previous run (4)

Looks good to me

Previous run (5)

Looks good to me

Previous run (6)

Looks good to me

Previous run (7)

Looks good to me

Previous run (8)

Looks good to me

Previous run (9)

Looks good to me

Previous run (10)

Looks good to me

Previous run (11)

Looks good to me

Previous run (12)

Looks good to me

---

Labels: Renovate bot dependency update PR (go.mod/go.sum changes)

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:54 AM UTC · Completed 4:05 AM UTC

Commit: 87dee1b · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:34 PM UTC · Completed 3:41 PM UTC

Commit: 72501ca · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:57 AM UTC · Completed 4:05 AM UTC

Commit: 537b918 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:35 PM UTC · Completed 3:44 PM UTC

Commit: efbf288 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:54 AM UTC · Completed 4:02 AM UTC

Commit: 8974c54 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:30 PM UTC · Completed 3:38 PM UTC

Commit: 7fc2fdb · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:27 AM UTC · Completed 3:36 AM UTC

Commit: 1e217c7 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:22 PM UTC · Completed 3:29 PM UTC

Commit: fcd25d8 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:33 AM UTC · Completed 3:40 AM UTC

Commit: 7ea7d51 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:22 PM UTC · Completed 3:29 PM UTC

Commit: fe2718e · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:32 AM UTC · Completed 3:41 AM UTC

Commit: 54ed588 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:29 AM UTC · Completed 3:37 AM UTC

Commit: 1f53023 · View workflow run →

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 1:03 PM UTC · Completed 1:08 PM UTC

Commit: 1f53023 · View workflow run →

[fullsend-ai-retro]

Retro: PR #6107 — Renovate protobuf bump reviewed 13 times

What happened: Renovate opened PR #6107 on Aug 11 to bump google.golang.org/protobuf from v1.36.11 to v1.36.12. Over the next 7 days, Renovate rebased the single-commit branch 13 times (roughly twice daily) as main advanced. Each rebase fired a pull_request_target/synchronize event, which dispatched a full review agent run via fullsend-ai/.fullsend. All 13 runs produced identical "Looks good to me" approvals. A human (rh-hemartin) approved on Aug 18 and the PR merged minutes later.

Token and compute waste: 13 review agent runs on a trivial go.mod/go.sum version bump, each running the full review pipeline (~17 steps). The agent resolved from fullsend-ai/agents at commit 6bdcab69. Every run produced the same verdict with no new information.

Root causes: Two independent factors compound:

1. Renovate's default rebaseWhen: "behind-base-branch" causes frequent rebases on active repos, even when the PR has no merge conflicts.
2. The review dispatch path has no skip condition for bot-authored dependency PRs — the [bot]$ regex carve-out added by #5706 enables bot PRs to reach review (which is correct for code agent PRs) but doesn't distinguish dependency bots from code agent bots.

No new proposals filed. This pattern is extensively covered by existing open issues. PR #6107 provides additional evidence for:

• #6278 — Set Renovate rebaseWhen to conflicted for lockfile-only patch updates. This would eliminate the root trigger: unnecessary rebases. PR fix(deps): update module google.golang.org/protobuf to v1.36.12 #6107 is a direct additional example (13 rebases vs. 4 on chore(deps): update dependency svelte to v5.56.9 #6249).
• #4401 — Review agent should detect rebase-only force-pushes and skip re-review when diff is unchanged. Would have prevented 12 of the 13 runs.
• #5360 — Skip review and retro stages for bot-authored dependency update PRs. Would have prevented all 13 runs.
• #2587 / #2599 — Per-PR review budget cap as a backstop. Would have limited the damage to a configurable maximum.

Any one of these existing proposals, if implemented, would have prevented or significantly reduced the waste observed on this PR.