chore: bump gomplate to v3.24.88

[flankbot]

Automated changes by create-pull-request GitHub action

[coderabbitai]

Walkthrough

go.mod now targets Go 1.26.0 and updates flanksource, Kubernetes, klog, kube-openapi, and protobuf dependencies.

Changes

Dependency and Go version updates

Layer / File(s)	Summary
Go directive and all dependency bumps go.mod	The Go directive changed from 1.25.1 to 1.26.0. github.com/flanksource/gomplate/v3 changed to v3.24.86, and github.com/flanksource/is-healthy changed to v1.0.88. Kubernetes indirect dependencies moved from the v0.35.2 release set to v0.36.1, with newer klog and kube-openapi revisions. google.golang.org/protobuf changed to v1.36.12-0.20260120151049-f2248ac996af.

Possibly related PRs

• flanksource/commons#303: Updates the same gomplate dependency.
• flanksource/commons#307: Updates the same gomplate dependency.
• flanksource/commons#315: Updates the same gomplate dependency.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title identifies the gomplate dependency bump but specifies v3.24.88, while the changes update gomplate to v3.24.86.	Change the title to “chore: bump gomplate to v3.24.86” so it matches the dependency version in the changeset.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bump-gomplate-auto-pr

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch bump-gomplate-auto-pr

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Gavel crashed before producing results

Exit code: 1
Error: gavel exited 1 before writing results

Last lines of gavel.log

go: downloading github.com/tidwall/match v1.2.0 go: downloading github.com/tidwall/pretty v1.2.1 go: downloading k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 go: downloading sigs.k8s.io/randfill...

Full gavel.log, JSON stub, and HTML stub are in the workflow artifact.

View full results

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: golang k8s.io/client-go is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → golang/github.com/flanksource/clicky@v1.21.1 → golang/k8s.io/client-go@v0.36.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/k8s.io/client-go@v0.36.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Line 191: In the go.mod file, locate the google.golang.org/protobuf dependency
which is currently pinned to the pseudo-version
v1.36.12-0.20260120151049-f2248ac996af. Replace this pseudo-version with the
stable release version v1.36.11, which is the latest officially released version
available. Pseudo-versions representing development snapshots should not be used
in production dependencies unless absolutely necessary for a specific unreleased
fix.
- Line 3: Update the Go directive to 1.26.0 and then verify the codebase is
compatible with that toolchain. Check build tags and any platform-specific code
paths for removed 32-bit windows/arm support, scan for dependencies on removed
tools like cmd/doc, and review any reverse proxy logic that may still rely on
ReverseProxy.Director or permissive URL parsing with colons in paths. Use the
relevant build-constraint files and any reverse proxy or URL parsing symbols in
the diff to locate and confirm the affected code, then run the test suite under
Go 1.26.0.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a18a2620-8fb6-487a-a153-d9897589759b

📥 Commits

Reviewing files that changed from the base of the PR and between 340276a and 8cbd173.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

[coderabbitai]

🩺 Stability & Availability | 🟠 Major

🧩 Analysis chain

🌐 Web query:

What is the latest released version of google.golang.org/protobuf?

💡 Result:

The latest released version of the google.golang.org/protobuf module is v1.36.11 [1][2][3]. This version was published on December 12, 2025 [1][3].

Citations:

• 1: https://pkg.go.dev/google.golang.org/protobuf
• 2: https://github.com/protocolbuffers/protobuf-go/releases
• 3: https://github.com/protocolbuffers/protobuf-go/releases/tag/v1.36.11

---

🌐 Web query:

google.golang.org/protobuf v1.36.12 release status 2026

💡 Result:

As of June 23, 2026, there is no official release of google.golang.org/protobuf version v1.36.12 [1]. While various pseudo-versions (e.g., v1.36.12-0.20260120151049-f2248ac996af) exist in the Go module proxy ecosystem, these are development snapshots or commit-based tags rather than an official stable release [2][3][4]. The most recent official stable release listed in the project's repository is v1.36.11, published on December 12, 2025 [4][1]. The lack of an official v1.36.12 release has been noted by the community, with inquiries regarding its status appearing in official issue trackers as recently as April 2026 [5].

Citations:

• 1: https://github.com/protocolbuffers/protobuf-go/releases
• 2: https://pkg.go.dev/google.golang.org/protobuf@v1.36.12-0.20260120151049-f2248ac996af
• 3: https://deps.dev/go/google.golang.org%2Fprotobuf/v1.36.11/versions
• 4: https://pkg.go.dev/google.golang.org/protobuf
• 5: New release for google.golang.org/protobuf - v1.36.12? 🙏🏾 golang/protobuf#1711

---

Use the stable release v1.36.11 instead of the pseudo-version for google.golang.org/protobuf.

Line 191 pins google.golang.org/protobuf to v1.36.12-0.20260120151049-f2248ac996af, a pseudo-version representing an unreleased development snapshot. No official v1.36.12 release exists; the latest stable version is v1.36.11 (released December 12, 2025). Pseudo-versions should be avoided in production dependencies unless there is a specific fix required from the development code that is not available in a stable release. Replace with v1.36.11 or the actual release version needed.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 191, In the go.mod file, locate the
google.golang.org/protobuf dependency which is currently pinned to the
pseudo-version v1.36.12-0.20260120151049-f2248ac996af. Replace this
pseudo-version with the stable release version v1.36.11, which is the latest
officially released version available. Pseudo-versions representing development
snapshots should not be used in production dependencies unless absolutely
necessary for a specific unreleased fix.