[alaudaa-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/google/cel-go	v0.29.0 -> v0.30.0

---

JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go

GHSA-gcjh-h69q-9w9g / GO-2026-6094

More information

Details

JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go

Severity

Unknown

References

• https://github.com/cel-expr/cel-go/security/advisories/GHSA-gcjh-h69q-9w9g

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Release Notes

google/cel-go (github.com/google/cel-go)

v0.30.0

Compare Source

What's Changed

• Add cost tracking for encoders by @​TristonianJones in https://github.com/cel-expr/cel-go/pull/1354
• Fix syntax error at head by @​stanleyycheung in https://github.com/cel-expr/cel-go/pull/1362
• Prevent indexing on sentinel json field '-' by @​TristonianJones in https://github.com/cel-expr/cel-go/pull/1349
• Async function execution internals by @​TristonianJones in https://github.com/cel-expr/cel-go/pull/1355
• reject non-RFC3339 timestamp strings in timestamp() conversion by @​alhudz in https://github.com/cel-expr/cel-go/pull/1338
• Add depth validation for ASTs loaded through ParsedExprToAst / Checke... by @​wilyan09007 in https://github.com/cel-expr/cel-go/pull/1334
• Fix non-determinism in json encoding, add dummy 'infinite' costs by @​TristonianJones in https://github.com/cel-expr/cel-go/pull/1365
• Update lists library cost computations for improved accuracy by @​TristonianJones in https://github.com/cel-expr/cel-go/pull/1352
• Cost library for ext/network by @​TristonianJones in https://github.com/cel-expr/cel-go/pull/1345
• Introduce async DrainStrategy, DrainAction, Observer, and Call types by @​TristonianJones in https://github.com/cel-expr/cel-go/pull/1364
• Graceful NaN ordering by @​TristonianJones in https://github.com/cel-expr/cel-go/pull/1370
• Fix constant folding and local variable resolution by @​TristonianJones in https://github.com/cel-expr/cel-go/pull/1371
• Concurrent Eval with context.Context bound functions by @​TristonianJones in https://github.com/cel-expr/cel-go/pull/1369
• Async timeout and retry wrappers by @​TristonianJones in https://github.com/cel-expr/cel-go/pull/1367
• Add runnable examples for all expressions in celbyexample.com by @​TristonianJones in https://github.com/cel-expr/cel-go/pull/1373
• Ensure logical operator fold expressions are bool by @​TristonianJones in https://github.com/cel-expr/cel-go/pull/1380
• Fix unsound constant folding of x in [x] for NaN values by @​pranit0808 in https://github.com/cel-expr/cel-go/pull/1374
• copy operands in Bytes.Add to avoid aliasing the receiver by @​pranit0808 in https://github.com/cel-expr/cel-go/pull/1381
• Validation of cel.bind() nesting limits by @​TristonianJones in https://github.com/cel-expr/cel-go/pull/1378
• Allow validators to be reconfigured by @​TristonianJones in https://github.com/cel-expr/cel-go/pull/1379
• Add cost tracking to ext/math.go by @​TristonianJones in https://github.com/cel-expr/cel-go/pull/1353
• Expression node limits for parser and checker by @​TristonianJones in https://github.com/cel-expr/cel-go/pull/1386

New Contributors

• @​stanleyycheung made their first contribution in https://github.com/cel-expr/cel-go/pull/1362
• @​wilyan09007 made their first contribution in https://github.com/cel-expr/cel-go/pull/1334
• @​pranit0808 made their first contribution in https://github.com/cel-expr/cel-go/pull/1374

Full Changelog: cel-expr/cel-go@v0.29.2...v0.29.3

v0.29.2

Compare Source

What's Changed

• Normalize cel/prompt_test.go to LF, add missing newline in prompt.go by @​dims in https://github.com/cel-expr/cel-go/pull/1361
• Update lists.go runtime cost calculator by @​TristonianJones in https://github.com/cel-expr/cel-go/pull/1360

Full Changelog: cel-expr/cel-go@v0.29.1...v0.29.2

v0.29.1

Compare Source

What's Changed

• cel/prompt.go: convert CRLF to LF line ending by @​pohly in https://github.com/cel-expr/cel-go/pull/1359

Full Changelog: cel-expr/cel-go@v0.29.0...v0.29.1

---

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[alaudaa-renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -d -t ./...
go: -d flag is deprecated. -d=true is a no-op
go: downloading github.com/moby/go-archive v0.3.0
go: github.com/aquasecurity/trivy/internal/testutil imports
	github.com/testcontainers/testcontainers-go imports
	github.com/moby/go-archive: github.com/moby/go-archive@v0.3.0: Get "https://build-nexus.alauda.cn/repository/golang/github.com/moby/go-archive/@v/v0.3.0.zip": dial tcp: lookup build-nexus.alauda.cn: i/o timeout