This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) | require | patch | `v1.71.0` -> `v1.71.1` |
| [google.golang.org/protobuf](https://redirect.github.com/protocolbuffers/protobuf-go) | require | patch | `v1.36.5` -> `v1.36.6` |

---

### Release Notes

<details>
<summary>grpc/grpc-go (google.golang.org/grpc)</summary>

### [`v1.71.1`](https://redirect.github.com/grpc/grpc-go/releases/tag/v1.71.1): Release 1.71.1

[Compare Source](https://redirect.github.com/grpc/grpc-go/compare/v1.71.0...v1.71.1)

### Bug Fixes

-   grpc: fix a bug causing an extra Read from the compressor if a compressed message is the same size as the limit.  This could result in a panic with the built-in gzip compressor ([#&#8203;8178](https://redirect.github.com/grpc/grpc-go/issues/8178))
-   xds: restore the behavior of reading the bootstrap config before creating the first xDS client instead of at package init time ([#&#8203;8164](https://redirect.github.com/grpc/grpc-go/issues/8164))
-   stats/opentelemetry: use `TextMapPropagator` and `TracerProvider` from `TraceOptions` instead of OpenTelemetry globals ([#&#8203;8166](https://redirect.github.com/grpc/grpc-go/issues/8166))
-   client: fix races when an http proxy is configured that could lead to deadlocks or panics ([#&#8203;8195](https://redirect.github.com/grpc/grpc-go/issues/8195))
-   client: fix bug causing RPC failures with message "no children to pick from" when using a custom resolver that calls the deprecated `NewAddress` API ([#&#8203;8149](https://redirect.github.com/grpc/grpc-go/issues/8149))
-   wrr: fix slow processing of address updates that could result in problems including RPC failures for servers with a large number of backends ([#&#8203;8179](https://redirect.github.com/grpc/grpc-go/issues/8179))

</details>

<details>
<summary>protocolbuffers/protobuf-go (google.golang.org/protobuf)</summary>

### [`v1.36.6`](https://redirect.github.com/protocolbuffers/protobuf-go/releases/tag/v1.36.6)

[Compare Source](https://redirect.github.com/protocolbuffers/protobuf-go/compare/v1.36.5...v1.36.6)

**Full Changelog**: protocolbuffers/protobuf-go@v1.36.5...v1.36.6

User-visible changes:
[CL/657895](https://go-review.googlesource.com/c/protobuf/+/657895): internal_gengo: generate a const string literal for the raw descriptor
[CL/653536](https://go-review.googlesource.com/c/protobuf/+/653536): proto: Add CloneOf\[M Message]\(m M) M

Maintenance:
[CL/649135](https://go-review.googlesource.com/c/protobuf/+/649135): all: set Go language version to Go 1.22
[CL/654955](https://go-review.googlesource.com/c/protobuf/+/654955): types/descriptorpb: regenerate using latest protobuf v30 release

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 3am on Saturday" (UTC), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yMzMuMyIsInVwZGF0ZWRJblZlciI6IjM5LjIzMy4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJhdXRvbWVyZ2UiXX0=-->

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| golang.org/x/net | indirect | minor | `v0.37.0` -> `v0.38.0` |

### GitHub Vulnerability Alerts

#### [CVE-2025-22872](https://nvd.nist.gov/vuln/detail/CVE-2025-22872)

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNDguMSIsInVwZGF0ZWRJblZlciI6IjM5LjI0OC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJhdXRvbWVyZ2UiLCJzZWN1cml0eSJdfQ==-->

🤖 I have created a release *beep* *boop*
---


## [1.26.10](v1.26.9...v1.26.10) (2025-04-28)


### Bug Fixes

* **deps:** Update Google Golang modules ([#491](#491)) ([7d5e53b](7d5e53b))
* **deps:** Update module golang.org/x/net to v0.38.0 [SECURITY] ([#493](#493)) ([9c3349a](9c3349a))

---
This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).