Update module github.com/google/cel-go to v0.30.0 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/google/cel-go	v0.29.2 → v0.30.0

---

JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go

GHSA-gcjh-h69q-9w9g / GO-2026-6094

More information

Details

JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go

Severity

Unknown

References

• https://github.com/cel-expr/cel-go/security/advisories/GHSA-gcjh-h69q-9w9g

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Release Notes

google/cel-go (github.com/google/cel-go)

v0.30.0

Compare Source

What's Changed

• Add cost tracking for encoders by @​TristonianJones in cel-expr#1354
• Fix syntax error at head by @​stanleyycheung in cel-expr#1362
• Prevent indexing on sentinel json field '-' by @​TristonianJones in cel-expr#1349
• Async function execution internals by @​TristonianJones in cel-expr#1355
• reject non-RFC3339 timestamp strings in timestamp() conversion by @​alhudz in cel-expr#1338
• Add depth validation for ASTs loaded through ParsedExprToAst / Checke... by @​wilyan09007 in cel-expr#1334
• Fix non-determinism in json encoding, add dummy 'infinite' costs by @​TristonianJones in cel-expr#1365
• Update lists library cost computations for improved accuracy by @​TristonianJones in cel-expr#1352
• Cost library for ext/network by @​TristonianJones in cel-expr#1345
• Introduce async DrainStrategy, DrainAction, Observer, and Call types by @​TristonianJones in cel-expr#1364
• Graceful NaN ordering by @​TristonianJones in cel-expr#1370
• Fix constant folding and local variable resolution by @​TristonianJones in cel-expr#1371
• Concurrent Eval with context.Context bound functions by @​TristonianJones in cel-expr#1369
• Async timeout and retry wrappers by @​TristonianJones in cel-expr#1367
• Add runnable examples for all expressions in celbyexample.com by @​TristonianJones in cel-expr#1373
• Ensure logical operator fold expressions are bool by @​TristonianJones in cel-expr#1380
• Fix unsound constant folding of x in [x] for NaN values by @​pranit0808 in cel-expr#1374
• copy operands in Bytes.Add to avoid aliasing the receiver by @​pranit0808 in cel-expr#1381
• Validation of cel.bind() nesting limits by @​TristonianJones in cel-expr#1378
• Allow validators to be reconfigured by @​TristonianJones in cel-expr#1379
• Add cost tracking to ext/math.go by @​TristonianJones in cel-expr#1353
• Expression node limits for parser and checker by @​TristonianJones in cel-expr#1386

New Contributors

• @​stanleyycheung made their first contribution in cel-expr#1362
• @​wilyan09007 made their first contribution in cel-expr#1334
• @​pranit0808 made their first contribution in cel-expr#1374

Full Changelog: cel-expr/cel-go@v0.29.2...v0.29.3

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.