chore(deps): update module github.com/google/cel-go to v0.32.0

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/google/cel-go	v0.26.0 → v0.32.0

---

Release Notes

google/cel-go (github.com/google/cel-go)

v0.32.0

Compare Source

Summary of Changes

This release of cel-go (v0.32.0) introduces significant library expansions alongside a major infrastructure migration. Key highlights include the addition of native support for JWT and HMAC operations, Go-based JSON handling via NativeToValue, and robust timestamp parsing helpers.

Critical Upgrade: This release changes the module and import paths to cel.dev/cel-go. Users must update their import statements when upgrading to this version.

A variety of concurrency and stability fixes are also included, such as addressing nil pointer panics during native object traversals, and fixing cost observability when combined with state tracking or exhaustive eval

Breaking Changes

Change	PR Link
Switch module and import paths to cel.dev/cel-go	#​1413

Features

Feature	PR Link
JWT data types with Parse and claim helpers	#​1415
HMAC verify / compute library	#​1416
NativeToValue Go-based JSON type support	#​1402
Parsing helper for working with different types and formats of timestamp	#​1414
Support aggregate size computations over list, maps, and structs	#​1404
Aggregate semantics in Policy Compiler	#​1408
Report every evaluation step to every observer	#​1419
Enable list_ext conformance tests	#​1412

Fixes & Performance Improvements

Change / Optimization	PR Link
mem-track: Fix data race for aggregate size computation	#​1423
Fix panic in native object traversal with nil valued struct pointers	#​1417
Fix shorthand type specifier parsing to allow newlines and tab chars	#​1411
Fix agent_tool_execution_governance policy example to match cel-policy conformance test	#​1424
Scale sizes for strings and bytes	#​1421
Consolidate saturating cost arithmetic into common/cost	#​1420
Add parser benchmarks	#​1422

---

Full Changelog: v0.31.0...v0.32.0

v0.31.0

Compare Source

This release introduces critical performance breakthroughs, simplifies integration with native Go structures, and hardens the safety limits of evaluated expressions.

Features

Pull Request	Description and Impact
Env copy on write (#​1405)	Introduces Copy-on-Write (COW) mechanics for environment definitions, dramatically slashing CPU and memory allocation overhead when building child or extended environments.
Optimize NativeToValue call paths (#​1400)	Optimizes reflection-heavy conversion paths, significantly improving evaluation speeds when feeding native Go types directly to the runtime engine.
Support self-describing, self-adapting struct types (#​1395)	Simplifies struct integration by enabling native Go struct types to self-describe and adapt directly to the CEL type system without verbose boilerplate.
Move native type support into the Core CEL library (#​1396)	Moves native Go type mapping utilities directly into the Core CEL package to unify dependency structure and improve native API access.
Regex program plan size controls (#​1383)	Introduces critical compiled size constraints on regex expressions to mitigate CPU/memory exhaustion vectors during evaluation.
Simplify support for native object types (#​1393)	Streamlines setup workflows for mapping standard Go structures inside the CEL compiler environment.
Tag automation for go submodules (#​1401)	Automates the submodule tagging process to streamline multi-module releases.

Fixes

Pull Request	Impact and Technical Details
Respect composed adapter for unregistered structs (#​1384)	Corrects behavior so that unregistered Go structs properly fall back to composed adapter configurations.
reject out-of-range hours in timezone offset parsing (#​1391)	Tightens datetime validation by rejecting invalid out-of-range hour offsets during timezone parsing.
Fix the expression limit node test (#​1390)	Restores stability to environment node test suites verifying size-limit assertions.
Correct documented default max value for lists.range (#​1392)	Resolves documentation drift regarding the default maximum limit for the lists.range function.

Breaking Changes

There are no breaking changes, but all ext.NativeTypes features are now available via cel.NativeTypes

Notes on Performance

This release targets two primary computational bottlenecks in high-throughput CEL environments: environment construction and reflection-based type coercion.

Expected Impact

1. Dynamic Environment Extension: Applications that dynamically extend a base CEL environment per request (e.g., policy validation engines or API gateways adding request-scoped variables) will see near-zero initialization costs. The Copy-on-Write (COW) optimization prevents copying underlying maps of variables, functions, and adapters.
2. Type Coercion Speed: Bypassing heavy reflection paths during NativeToValue conversions significantly cuts down CPU cycle usage and drastically reduces garbage collection overhead in processing hot paths.
3. AST Pruning: Consolidating sequential list concatenations (#​1406) and optimizing optional macros (#​1387) ensures that generated program plans are leaner, reducing both compilation and execution memory footprints.

Go-lang Benchmark Citation (benchstat)

The performance improvements can be verified running the repository's native benchmark harness with benchstat:

name old time/op new time/op delta
BenchmarkEnvExtension/10_vars 3.56µs ± 1% 0.15µs ± 0% -95.79% (p=0.000 n=10+10)
BenchmarkNativeToValue/struct 120ns ± 2% 42ns ± 1% -65.00% (p=0.000 n=10+10)
BenchmarkOptionalMapEvaluation 245ns ± 1% 195ns ± 1% -20.41% (p=0.000 n=10+10)

name old allocs/op new allocs/op delta
BenchmarkEnvExtension/10_vars 32.0 ± 0% 1.0 ± 0% -96.88% (p=0.000 n=10+10)
BenchmarkNativeToValue/struct 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10)

New Contributors

• @​lopster568 made their first contribution in cel-expr#1384

Full Changelog: cel-expr/cel-go@v0.30.0...v0.31.0

v0.30.0

Compare Source

What's Changed

• Add cost tracking for encoders by @​TristonianJones in cel-expr#1354
• Fix syntax error at head by @​stanleyycheung in cel-expr#1362
• Prevent indexing on sentinel json field '-' by @​TristonianJones in cel-expr#1349
• Async function execution internals by @​TristonianJones in cel-expr#1355
• reject non-RFC3339 timestamp strings in timestamp() conversion by @​alhudz in cel-expr#1338
• Add depth validation for ASTs loaded through ParsedExprToAst / Checke... by @​wilyan09007 in cel-expr#1334
• Fix non-determinism in json encoding, add dummy 'infinite' costs by @​TristonianJones in cel-expr#1365
• Update lists library cost computations for improved accuracy by @​TristonianJones in cel-expr#1352
• Cost library for ext/network by @​TristonianJones in cel-expr#1345
• Introduce async DrainStrategy, DrainAction, Observer, and Call types by @​TristonianJones in cel-expr#1364
• Graceful NaN ordering by @​TristonianJones in cel-expr#1370
• Fix constant folding and local variable resolution by @​TristonianJones in cel-expr#1371
• Concurrent Eval with context.Context bound functions by @​TristonianJones in cel-expr#1369
• Async timeout and retry wrappers by @​TristonianJones in cel-expr#1367
• Add runnable examples for all expressions in celbyexample.com by @​TristonianJones in cel-expr#1373
• Ensure logical operator fold expressions are bool by @​TristonianJones in cel-expr#1380
• Fix unsound constant folding of x in [x] for NaN values by @​pranit0808 in cel-expr#1374
• copy operands in Bytes.Add to avoid aliasing the receiver by @​pranit0808 in cel-expr#1381
• Validation of cel.bind() nesting limits by @​TristonianJones in cel-expr#1378
• Allow validators to be reconfigured by @​TristonianJones in cel-expr#1379
• Add cost tracking to ext/math.go by @​TristonianJones in cel-expr#1353
• Expression node limits for parser and checker by @​TristonianJones in cel-expr#1386

New Contributors

• @​stanleyycheung made their first contribution in cel-expr#1362
• @​wilyan09007 made their first contribution in cel-expr#1334
• @​pranit0808 made their first contribution in cel-expr#1374

Full Changelog: cel-expr/cel-go@v0.29.2...v0.29.3

v0.29.2

Compare Source

What's Changed

• Normalize cel/prompt_test.go to LF, add missing newline in prompt.go by @​dims in cel-expr#1361
• Update lists.go runtime cost calculator by @​TristonianJones in cel-expr#1360

Full Changelog: cel-expr/cel-go@v0.29.1...v0.29.2

v0.29.1

Compare Source

What's Changed

• cel/prompt.go: convert CRLF to LF line ending by @​pohly in cel-expr#1359

Full Changelog: cel-expr/cel-go@v0.29.0...v0.29.1

v0.29.0

Compare Source

What's Changed

New Features

• Add JSON encoder extension — a new ext library for JSON encoding by @​rohan-patnaik in cel-expr#1340
• Upstream network.IP/CIDR support from Kubernetes by @​tdesrosi in cel-expr#1238
• Managed execution frame with async call foundations by @​TristonianJones in cel-expr#1316
• Execution frame integration with updated InterpretableV2 by @​TristonianJones in cel-expr#1344
• Add conformance test runner for CEL Policies by @​l46kok in cel-expr#1319

Bug Fixes

• Fix unintentional unwrapping of optionals at any level of depth by @​TristonianJones in cel-expr#1315
• Fix has() unknown propagation during partial evaluation by @​0xASTRA in cel-expr#1324
• Enforce expression size limit before source construction by @​thesmartshadow in cel-expr#1302
• Policy variable scoping fixes by @​jnthntatum in cel-expr#1321
• Emit valid CEL for doubles in scientific notation in the parser/unparser by @​moraneus in cel-expr#1326
• Allow aliases for simple names in containers by @​rohan-patnaik in cel-expr#1327
• Reject out-of-range minutes in timezone offset parsing by @​alhudz in cel-expr#1336
• Validate offset on empty-string path in indexOf and lastIndexOf by @​alhudz in cel-expr#1335
• Guard int32/uint32 map key narrowing in qualifyInternal by @​alhudz in cel-expr#1337
• Add max size check to genRange() in ext/lists to prevent OOM by @​marwan9696 in cel-expr#1310

Cost Tracking

• Ensure receiver and global matches cost estimates agree by @​TristonianJones in cel-expr#1350
• startsWith/endsWith runtime cost agreement with checked cost by @​TristonianJones in cel-expr#1351
• Avoid repeated construction of cost tracker by @​pohly in cel-expr#1357

Testing & Tooling

• Test Runner usability improvements by @​jnthntatum in cel-expr#1320
• Minor updates to test coverage and code quality by @​TristonianJones in cel-expr#1318
• Remove duplicate policy tests now covered by policy conformance tests by @​l46kok in cel-expr#1332
• Minor Google3 import fixes by @​l46kok in cel-expr#1331

Documentation

• Update documentation for nested first-match rules by @​jnthntatum in cel-expr#1323
• Add migration warning to README by @​dmitriplotnikov in cel-expr#1330

v0.28.1

Compare Source

What's Changed

• fix: deleted IntToDuration overload by @​alexsnaps in #​1300
• Support shorthand types in env yaml and REPL by @​jnthntatum in #​1301
• Preserve operation interrupted in ContextEval error by @​dims in #​1303
• Use shorthand type specifiers in env yaml files by @​jnthntatum in #​1305
• Cost estimation and tracking for strings extension by @​TristonianJones in #​1307
• Update repl type string for doubles by @​TristonianJones in #​1308

New Contributors

• @​alexsnaps made their first contribution in #​1300
• @​dims made their first contribution in #​1303

Full Changelog: https://github.com/google/cel-go/compare/v0.28.0...v0.28.1

v0.28.0

Compare Source

High-Level Changes

• Enhanced JSON Interoperability: New support for JSON names across the checker, AST, and runtime allows for more seamless data handling when working with JSON-native structures.
• Improved Developer Tooling: Integration is now smoother thanks to new utilities for converting Go errors into cel.Issues and more descriptive, context-aware error messages.
• Greater Environment Flexibility: You can now redeclare variables as constants and export parse limit options, providing finer control over how CEL environments are configured and constrained.
• Native Struct Improvements: Support for mixing CEL and native values within native structs simplifies the handling of complex, hybrid data types.

---

🚀 Features

• Add helper method to check whether a function has a singleton binding in #​1266
• Helper utility for converting a Go error into cel.Issues in #​1267
• Policy API improvements in #​1268
• CEL Test usability requirements in #​1269
• Better context-related error messages in #​1271
• Sort env.Config values where reasonable in #​1273
• Support redeclaring variables as constants in NewEnv in #​1275
• Add support for exporting parse limit options in #​1277
• Support mixing CEL values and native values in native structs in #​1270
• Add checker, AST, and type-provider support for JSON names in #​1283
• JSON field names runtime support in #​1286
• Optionally include reachable fieldpaths in prompt in #​1285
• REPL -- cel-spec pb2 and json name support #​1294

🐞 Bug Fixes

• Fix support for config-based type references in #​1265
• Check arg kinds in optional.or and .orValue impl in #​1276
• Bazel fixes for import in #​1278
• Support zero-value literals in presence test inlining #​1280
• Cache concatList.Size() to prevent O(N^2) evaluation time #​1291
• Preserve runtime error node IDs from Resolve #​1290
• Default enable identifier escaping with backticks #​1295
• Cap format string precision to prevent memory exhaustion #​1292

🛠️ Maintenance & Internal

• chore: Migrate gsutil usage to gcloud storage in #​1274
• Lint fixes for exported function/type comments in #​1279
• Lint fixes for import in #​1287

---

Full Changelog: https://github.com/google/cel-go/compare/v0.27.0...v0.28.0-alpha

v0.27.0

Compare Source

Release Summary

This release focuses on improving developer tooling and stability. Key highlights include significant enhancements to the REPL (YAML configuration support and parse-only evaluation), the addition of cost estimation for regex operations, and improved test coverage reporting.

On the stability front, this release addresses race conditions in reference types, improves namespace resolution, and ensures formatting directives align strictly with the CEL specification.

Note: This release includes a breaking change regarding how types are handled as variables. Please review the "Breaking Changes" section below.

⚠ Breaking Changes

Remove types as variables: The logic for handling types has been relaxed to support safe rollout of feature packages which introduce new types whose names may collide with existing variables. Please review your policies if you relied on types behaving strictly as variables in previous versions. PR #​1262

Features & Enhancements

REPL & Tooling

• YAML Configuration: The REPL now supports reading and writing YAML environment configurations. PR #​1250

• Parse-Only Mode: Added parse-only evaluation capabilities to the REPL. PR #​1254

• Test Coverage: Introduced logic for CEL test coverage calculation and updated the reporter to handle error/unknown scenarios.PR #​1209 & PR #​1215

Core Library

• Regex Costing: Added support for cost estimation and tracking within the regex library. PR #​1200

• JSON Type Exposure: Exposed CEL JSON types to assist developers in converting to native values. PR #​1261

• Policy Composition: Source information is now preserved during CEL policy composition, aiding in debugging. PR #​1253

Extensibility:

• Updated extension option factory to resolve by ID (#​1249).

• Refactored match output compiling to accept user-defined logic (#​1246).

• Exposed Match source ID to callers (#​1227).

Build & Maintenance

• Bazel: Migrated to use Bazel module only and improved configuration for dependent builds. PR #​1231 & PR #​1228

• Cleanup: Removed strcase dependency, removed AppEngine code from REPL, and performed general linting. PR #​1230, #​1216, #​1251

Bug Fixes

• Concurrency: Fixed a race condition in the checker regarding reference types. PR #​1224

• Namespace Resolution: Addressed an issue with namespace resolution. PR #​1256

• Spec Compliance: Fixed formatting directives to fully support requirements documented in the cel-spec. PR #​1232

New Contributors

• @​catalinadurbala made their first contribution in #​1227
• @​abenea made their first contribution in #​1258

Full Changelog: https://github.com/google/cel-go/compare/v0.26.1...v0.27.0

v0.26.1

Compare Source

What's Changed

• Comprehension nesting limit typo, allow nesting limit validator to accept doubles as limits by @​l46kok in #​1196
• Minor compatibility fixes for google3-import. by @​jnthntatum in #​1198
• Bump the npm_and_yarn group across 1 directory with 2 updates by @​dependabot[bot] in #​1197
• Init function bindings on environment init by @​beldmian in #​1199
• Support variable descriptions in the AI prompt template by @​TristonianJones in #​1205
• Add support for nested element type by @​MisLink in #​1190
• Support unwrapping unknown implementations of proto.Message by @​srikrsna in #​1207

New Contributors

• @​beldmian made their first contribution in #​1199
• @​MisLink made their first contribution in #​1190
• @​srikrsna made their first contribution in #​1207

Full Changelog: https://github.com/google/cel-go/compare/v0.25.1...v0.26.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[red-hat-konflux]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 4 additional dependencies were updated

Details:

Package	Change
cel.dev/expr	v0.24.0 -> v0.25.1
github.com/antlr4-go/antlr/v4	v4.13.0 -> v4.13.1
golang.org/x/exp	v0.0.0-20240719175910-8a7402abbf56 -> v0.0.0-20240823005443-9b4947da3948
google.golang.org/protobuf	v1.36.5 -> v1.36.10

[red-hat-konflux]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
github.com/antlr4-go/antlr/v4	v4.13.0 -> v4.13.1
golang.org/x/exp	v0.0.0-20240719175910-8a7402abbf56 -> v0.0.0-20240823005443-9b4947da3948

[red-hat-konflux]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: github.com/google/cel-go@v0.32.0: parsing go.mod:
	module declares its path as: cel.dev/cel-go
	        but was required as: github.com/google/cel-go