deps: Bump vgi from 0.24.0 to 0.36.1

[dependabot]

Bumps vgi from 0.24.0 to 0.36.1.

Release notes

Sourced from vgi's releases.

v0.36.1

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

v0.36.0

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

v0.35.1

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

v0.35.0

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

v0.34.0 — the wire name is now vgi.v2

Breaking: the wire protocol name is now vgi.v2

The transports require a vgi_rpc.protocol routing key, and this port never called SetServiceName — so it hosted the framework's default literal Service and answered ProtocolNotSupportedError to any client sending a real name. Six implementations had four different answers. The canonical name is now vgi.v2, declared here as the exported constant vgi.ProtocolName and passed to SetServiceName on every transport the worker builds.

POST /Service/bind   -> does not host protocol "Service". Hosted: [vgi.v2]
POST /bogus.v1/bind  -> does not host protocol "bogus.v1". Hosted: [vgi.v2]
POST /vgi.v2/bind    -> routes

The major is in the name deliberately. An incompatible major becomes a different name, so a mismatched client gets a routing 404 that any proxy, gateway or log already understands, rather than a mysterious deserialization failure deep in a stream. It also means vgi.v2 can be served beside a future vgi.v3 while clients migrate.

What you must do to upgrade. Nothing in your worker code — the name is set by the SDK. But the client has to send it: the DuckDB extension must be new enough to send the vgi_rpc.protocol routing key (Query-farm/vgi 5d45bb4 and later). A build carrying that is published to the community channel, so FORCE INSTALL vgi FROM community; is the upgrade path. An older extension paired with this release — or this release's predecessor paired with a current extension — fails at bind, not at first data.

This port does not host the secret protocol (vgi.secret.v1); secrets travel as fields inside the vgi protocol's own requests.

Transport: vgi-rpc-go v0.28.0

go.mod moves from vgi-rpc-go v0.27.0 to v0.28.0, which carries wire-breaking transport changes of its own: __describe__ is retired in favour of the vgi_rpc.Reflection.v1 protocol, raw transports now require the

... (truncated)

Commits

• 850651a release: v0.36.1 — secret-dependent cacheable fixtures, trailing_partition_sales
• f9b527d fixtures: trailing_partition_sales — a partition column that is NOT first, al...
• 272f889 fixtures: secret-dependent cacheable fixtures, one per cache path
• 1c25fdd release: v0.36.0 — a BOOLEAN column is a predicate on its own
• 08ca681 A BOOLEAN column is a predicate on its own
• 5f7b6a8 CI: clippy the whole workspace, and every feature of vgi and vgi-client
• 0647661 Gate the HTTP-only tests on the features they need
• 10859a9 release: v0.35.1 — vgi-client builds warning-free without the iroh feature
• c1e9a8e vgi-client: build StreamTransport::new_owned only with the iroh feature
• 4ac36cd release: v0.35.0 — linear dynamic-filter replay, cached function listings
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)