chore(ci): extend the release branch dependency freezes

[krancour]

Four freezes, batched into one change because every edit to this file draws a fresh flurry of update PRs.

google.golang.org/api, on all four release branches. This is the one that matters. Every go-minor group PR on every release branch — #7162, #7167, #7169, #7170 — moved google.golang.org/grpc from 1.82.1 to 1.83.2 and google.golang.org/protobuf from 1.36.11 to 1.36.12, and neither was among the listed updates. They came along for the ride: google.golang.org/[email protected] requires exactly those two versions in its own go.mod, so minimum version selection raises the root module. Ignoring grpc and protobuf stops Dependabot proposing them and does nothing about the module graph dragging them, which is why those PRs were unmergeable however many ignore lines we added. None of the other subjects in those PRs requires anything newer, so this is the only dependency that needed to move. The cost is that GCP client library patches no longer reach the release branches.

connectrpc.com/*, widened from connectrpc.com/connect. connectrpc.com/grpchealth was a subject in every one of those group PRs and the exact name did not cover it.

github.com/bufbuild/buf, on all four branches, for the same reason gRPC and protobuf are frozen: buf drives protobuf code generation, and moving it on a branch whose protobuf story is deliberately pinned invites a regeneration we don't want. It lives in /hack/tools on release-1.8 through release-1.10 and in the root module — as a tool directive — on release-1.11.

github.com/golangci/golangci-lint, on release-1.8, release-1.9 and release-1.10 — the branches that still have a hack/tools module. Nothing is built from that module: hack/tools.mk greps hack/tools/go.mod for the version of the prebuilt linter binary to install. Raising the linter on a stable branch therefore changes what CI enforces, and can only turn up new findings in code that is already frozen. release-1.11 and main pin the version directly in hack/tools.mk, so Dependabot never sees it there.

As with the freezes already in this file, each ignore line goes on every gomod entry for the branches it applies to, rather than only the entry whose module currently has the dependency.

Follow-ups, not in this PR

• The three /hack/tools gomod entries could be dropped outright. Everything in that module is a version pin for a dev or CI tool, none of it ships to users, and most of what remains unfrozen there — go-swagger, swag, golang.org/x/tools — regenerates checked-in code.
• chore(deps/client): bump the go-patch group in /pkg/client/generated with 4 updates #7151 bumped github.com/go-openapi/validate from 0.26.5 to 1.0.0 inside the go-patch group. A 0.x to 1.0 jump reached a branch that ignores version-update:semver-major, because Dependabot classified it as a patch. That applies to every 0.x dependency on these branches.

🤖 Generated with Claude Code

[netlify]

✅ Deploy Preview for docs-kargo-io ready!

Name	Link
🔨 Latest commit	7ea27e9
🔍 Latest deploy log	https://app.netlify.com/projects/docs-kargo-io/deploys/6aa2f658383ab5000843da47
😎 Deploy Preview	https://deploy-preview-7185.docs.kargo.io
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 35.29%. Comparing base (bb84b56) to head (7ea27e9).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7185      +/-   ##
==========================================
+ Coverage   35.24%   35.29%   +0.04%     
==========================================
  Files         858      859       +1     
  Lines       70677    70737      +60     
==========================================
+ Hits        24910    24964      +54     
- Misses      45767    45773       +6     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.