Bump cloud.google.com/go/bigquery from 1.65.0 to 1.77.0 in /function/loader in the loader-minor-updates group across 1 directory

[dependabot]

Bumps the loader-minor-updates group with 1 update in the /function/loader directory: cloud.google.com/go/bigquery.

Updates cloud.google.com/go/bigquery from 1.65.0 to 1.77.0

Commits

• 7cd2512 chore(main): release spanner 1.77.0 (#11634)
• 28f0030 chore(all): fix out-of-sync version.go files (#11684)
• 655de36 feat(spanner): Support REPEATABLE_READ for RW transaction (#11654)
• 60dc167 fix(aiplatform): remove VertexAISearch.engine option (#11681)
• 3f23a91 fix(aiplatform): An existing google.api.http annotation http_uri is changed...
• e87cedc chore: remove resourcesettings (#11678)
• d662a45 feat(spanner): add option for LastStatement in transaction (#11638)
• 9e508d0 chore: release main (#11623)
• 601e742 feat(bigquery/reservation): Add a new field replication_status to `.google....
• 1eb601e chore(firestore): expose the Firestore.executePipeline API to the preview bra...
• Additional commits viewable in compare view

[calebbrown]

@dependabot rebase

[calebbrown]

@dependabot rebase

[kusari-inspector]

Kusari Analysis Results:

✅ No Flagged Issues Detected
All values appear to be within acceptable risk parameters.

Both independent analyses unanimously recommend proceeding. The dependency analysis confirms all 20 changes (19 updates, 1 removal) are clean with zero risk scores, no advisories, no vulnerabilities, and permissive licenses (Apache-2.0, BSD-3-Clause) across well-maintained Google Cloud, OpenTelemetry, gRPC, and genproto libraries. The removal of github.com/golang/groupcache further reduces attack surface. The code analysis confirms zero findings across all categories — no code issues, no exposed secrets, and no workflow concerns. Critically, this PR actively remediates two HIGH severity vulnerabilities: CVE-2026-33186 in google.golang.org/grpc and CVE-2025-22868 in golang.org/x/oauth2, with no new risks introduced on any updated version. The combined risk profile is strictly positive — merging this PR reduces the repository's vulnerability exposure with no offsetting security concerns.

Note

View full detailed analysis result for more information on the output and the checks that were run.

---

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: b061bda, performed at: 2026-05-15T01:07:09Z

Found this helpful? Give it a 👍 or 👎 reaction!

[kusari-inspector]

Kusari PR Analysis rerun based on - b061bda performed at: 2026-05-15T01:07:29Z - link to updated analysis