chore(deps): refresh protobuf and worker types

[steipete]

Summary

• update the Google genproto modules to the 2026-08-10 pseudo-version
• update protobuf from 1.36.11 to 1.36.12
• update Cloudflare Workers types from 5.20260809.1 to 5.20260810.1
• reconcile the existing Unreleased dependency changelog entry

Wrangler 4.120.1 is visible upstream but intentionally remains excluded until it satisfies the worker's 24-hour minimumReleaseAge supply-chain policy.

Proof

• make ci
• make build && ./bin/gog version
• corepack pnpm lint
• corepack pnpm build — Wrangler dry-run completed; 11.06 KiB upload / 3.56 KiB gzip
• corepack pnpm test — 3 files, 15 tests passed
• structured pre-commit review: no accepted/actionable P0/P1 findings

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 10, 2026, 10:40 PM ET / August 11, 2026, 02:40 UTC.

ClawSweeper review

What this changes

Updates indirect Google protobuf/genproto modules and the email-tracking worker’s Cloudflare type declarations, with corresponding Go and pnpm lockfile records.

Merge readiness

⚠️ Ready for maintainer review - 1 item remains

Keep open for normal collaborator review: this is a narrow, policy-aware dependency refresh that is not yet on current main, and the remaining hosted checks should complete on the reviewed head before it lands.

Priority: P3
Reviewed head: e7c7e3bdb257772ccce00a032938824dbaf8c6b1

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A bounded, policy-aware dependency update with matching lockfile changes and stated validation; final hosted-check completion remains the normal landing gate.
Proof confidence	🌊 off-meta tidepool	Not applicable: This collaborator-authored dependency-maintenance PR is exempt from the external-contributor real-behavior-proof gate; the PR body nevertheless reports real build, worker dry-run, and test commands.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This collaborator-authored dependency-maintenance PR is exempt from the external-contributor real-behavior-proof gate; the PR body nevertheless reports real build, worker dry-run, and test commands.
Evidence reviewed	4 items	Focused dependency diff: The branch changes five dependency/changelog files only: three Google indirect modules and protobuf in the Go graph, plus the worker’s Cloudflare type package and its lockfile. Worker supply-chain policy: The worker workspace applies a 1,440-minute minimum package release age and allowlists only expected build-time packages; the updated worker types are declared and integrity-pinned in the branch lockfile. Current-main ownership history: Current main’s immediately preceding dependency refresh is commit 71c6c1e, authored by Peter Steinberger, establishing recent ownership of this dependency and worker surface; this PR’s commit is not contained in current main.
Findings	None	None.
Security	None	None.

How this fits together

The gog CLI builds against Google API libraries whose generated protobuf types are resolved through Go modules. Its email-tracking Worker separately type-checks TypeScript against Cloudflare declarations before Wrangler prepares the deployment bundle.

flowchart LR
  A[Google API libraries] --> B[Go module graph]
  B --> C[gog CLI build]
  D[Worker TypeScript source] --> E[Cloudflare worker type declarations]
  E --> F[Worker typecheck]
  F --> G[Wrangler deployment bundle]

Loading

Before merge

• Resolve merge risk (P1) - Hosted macOS, Windows, and Go test checks were still running in the supplied review state, so their results should gate landing of this exact head.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency refresh scope	5 files affected; 22 added, 22 removed	The symmetric manifest-and-lockfile update is a bounded maintenance change without application-code edits.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Merge the narrowly pinned update after the remaining required checks succeed for the reviewed commit.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Merge the narrowly pinned update after the remaining required checks succeed for the reviewed commit.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates build-time dependency records rather than addressing a reported runtime failure; its body supplies build, lint, dry-run, and test validation.

Is this the best way to solve the issue?

Yes. Updating only the resolved package versions and matching lockfile integrity records is the narrow maintainable path, while retaining the Worker workspace’s minimum-release-age policy.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 71c6c1e63787.

Labels

Label changes:

• add P3: This is a routine, tightly scoped dependency maintenance update with no reported user-facing regression.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This collaborator-authored dependency-maintenance PR is exempt from the external-contributor real-behavior-proof gate; the PR body nevertheless reports real build, worker dry-run, and test commands.

Label justifications:

• P3: This is a routine, tightly scoped dependency maintenance update with no reported user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This collaborator-authored dependency-maintenance PR is exempt from the external-contributor real-behavior-proof gate; the PR body nevertheless reports real build, worker dry-run, and test commands.

Evidence

What I checked:

• Focused dependency diff: The branch changes five dependency/changelog files only: three Google indirect modules and protobuf in the Go graph, plus the worker’s Cloudflare type package and its lockfile. (go.mod:65, e7c7e3bdb257)
• Worker supply-chain policy: The worker workspace applies a 1,440-minute minimum package release age and allowlists only expected build-time packages; the updated worker types are declared and integrity-pinned in the branch lockfile. (internal/tracking/worker/pnpm-workspace.yaml:1, 71c6c1e63787)
• Current-main ownership history: Current main’s immediately preceding dependency refresh is commit 71c6c1e, authored by Peter Steinberger, establishing recent ownership of this dependency and worker surface; this PR’s commit is not contained in current main. (internal/tracking/worker/package.json:16, 71c6c1e63787)
• Current release precedes proposed update: The latest release is v0.35.0 at commit 402def5, while this proposed update is commit e7c7e3b and remains outside current main. (CHANGELOG.md:3, e7c7e3bdb257)

Likely related people:

• Peter Steinberger: Authored current main’s immediately preceding worker dependency refresh and this PR’s commit is attributed to the same contributor identity. (role: recent dependency and worker-surface contributor; confidence: high; commits: 71c6c1e63787, e7c7e3bdb257; files: go.mod, internal/tracking/worker/package.json, internal/tracking/worker/pnpm-lock.yaml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Wait for the remaining required checks to finish successfully on commit e7c7e3b.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.