Fix possible fix(deps): google.golang.org/protobuf v1.31.0 → 1.33.0 (CVE-2024-24786) in go.mod

[begininvoke]

Proposing a fix for something flagged in go.mod. It is around line 1.

The project pins google.golang.org/protobuf at v1.31.0. In this version, protojson.Unmarshal may enter an infinite loop when processing malformed JSON (e.g., messages containing a google.protobuf.Any field or when UnmarshalOptions.DiscardUnknown is enabled). An attacker can cause a denial‑of‑service by supplying crafted JSON that never returns, leading to high availability risk. The vulnerability is classified as CVE‑2024‑24786 with a MEDIUM severity in the scanner but effectively a high risk due to the potential DoS. Updating to version 1.33.0 (or later) resolves the loop bug.

Upgrade google.golang.org/protobuf to v1.33.0 to address CVE-2024-24786.

For reference: rule CVE-2024-24786. Rated high.

I do not know the codebase, so please check the change fits how the rest of it works. Happy to adjust it or close this if the reasoning is off.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.