Bump cloud.google.com/go/bigquery from 1.77.0 to 1.78.0 in /function/loader in the loader-minor-updates group

[dependabot]

Bumps the loader-minor-updates group in /function/loader with 1 update: cloud.google.com/go/bigquery.

Updates cloud.google.com/go/bigquery from 1.77.0 to 1.78.0

Commits

• b6c2b32 chore(main): release spanner 1.78.0 (#11763)
• 57a62c0 feat(aiplatform): Enable force deletion in ReasoningEngine v1beta1 (#11901)
• 3fec6ad chore(bigtable): Refactor tests and update emulator (#11892)
• ac1855b chore(storage): Allow non-default SAs for GCS. (#11878)
• b139cd1 chore(all): update deps (#11849)
• a1a2292 fix(storage): force first message on next sendBuffer when nothing sent on cur...
• 41ef5f0 fix(spanner): snapshot EnableOpenTelemetryMetrics value on client creation (#...
• 427f448 feat(aiplatform): Update multimodal evaluation (content_map_instance), rubric...
• 2019ab2 bugfix(bigtable): fix update LV function (#11896)
• d7af8c5 chore: add row key schema to table info and some more tests. (#11894)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[kusari-inspector]

Kusari Analysis Results:

Caution

Flagged Issues Detected
These changes contain flagged issues that may introduce security risks.

The code analysis found zero issues across the scanned files (go.mod, go.sum), which is a positive signal. However, the dependency analysis identified two HIGH-severity vulnerabilities with available fixes that we strongly recommend addressing before merging. First, google.golang.org/grpc v1.82.0 carries GHSA-hrxh-6v49-42gf, which includes an xDS RBAC Authorization Bypass (CVSS 8.2, fail-open behavior allowing unauthorized access), an HTTP/2 Rapid Reset DoS Bypass (CVSS 7.5), and an xDS RBAC Engine Server Panic (CVSS 5.9). The fix is available at v1.82.1 — run: go get google.golang.org/grpc@v1.82.1. Second, golang.org/x/text v0.38.0 carries GO-2026-5970 (CVE-2026-56852), where a norm.Iter can enter an infinite loop on invalid UTF-8 input, causing denial of service. The fix is available at v0.40.0 — run: go get golang.org/x/text@v0.40.0. Additionally, golang.org/x/crypto v0.53.0 includes the unmaintained openpgp sub-package (GO-2026-5932) with no fix available; if openpgp is not used in this codebase, the risk is limited, but migration to github.com/ProtonMail/go-crypto/openpgp is recommended if it is in use. The authorization bypass in gRPC poses a direct business risk by potentially allowing unauthenticated or unauthorized access to protected services, and the DoS vectors in both gRPC and x/text could impact service availability. Both critical issues have simple, low-risk version bumps available and should be resolved before merging.

Note

View full detailed analysis result for more information on the output and the checks that were run.

Required Dependency Mitigations

• CRITICAL: google.golang.org/grpc upgraded to v1.82.0 but GHSA-hrxh-6v49-42gf is still present in this version. This advisory covers three vulnerabilities: xDS RBAC Authorization Bypass (CVSS 8.2 — fail-open allowing unauthorized access), HTTP/2 Rapid Reset DoS Bypass (CVSS 7.5 — high CPU / denial of service), and xDS RBAC Engine Server Panic (CVSS 5.9 — process crash). The fix is available in v1.82.1. We strongly recommend addressing this before merging. Run the following fix command verbatim: go get google.golang.org/grpc@v1.82.1
• HIGH: golang.org/x/text upgraded to v0.38.0 but GO-2026-5970 (CVE-2026-56852) is still present in this version. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes, resulting in denial of service. The fix is available at v0.40.0. We strongly recommend addressing this before merging. Run the following fix command verbatim: go get golang.org/x/text@v0.40.0
• ADVISORY (No Fix Available): golang.org/x/crypto v0.53.0 carries advisory GO-2026-5932 — the golang.org/x/crypto/openpgp sub-package is unmaintained, unsafe by design, and has known security issues. The vulnerability fix report indicates fix_status is NO_FIX. If the openpgp sub-package is used anywhere in this codebase, consider migrating to github.com/ProtonMail/go-crypto/openpgp as the maintained drop-in replacement. If openpgp is not used, the risk is limited to the presence of the unmaintained sub-package in the dependency tree.

---

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: ddf77b5, performed at: 2026-07-24T22:43:29Z

Found this helpful? Give it a 👍 or 👎 reaction!