fix(security/unknown/mimir-build-image): update module github.com/google/cel-go to v0.30.0 [security] (main) - abandoned

[renovate-sh-app]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/google/cel-go	v0.29.0 → v0.30.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go

GHSA-gcjh-h69q-9w9g / GO-2026-6094

More information

Details

JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go

Severity

Unknown

References

• https://github.com/cel-expr/cel-go/security/advisories/GHSA-gcjh-h69q-9w9g

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Release Notes

google/cel-go (github.com/google/cel-go)

v0.30.0

Compare Source

What's Changed

• Add cost tracking for encoders by @​TristonianJones in cel-expr#1354
• Fix syntax error at head by @​stanleyycheung in cel-expr#1362
• Prevent indexing on sentinel json field '-' by @​TristonianJones in cel-expr#1349
• Async function execution internals by @​TristonianJones in cel-expr#1355
• reject non-RFC3339 timestamp strings in timestamp() conversion by @​alhudz in cel-expr#1338
• Add depth validation for ASTs loaded through ParsedExprToAst / Checke... by @​wilyan09007 in cel-expr#1334
• Fix non-determinism in json encoding, add dummy 'infinite' costs by @​TristonianJones in cel-expr#1365
• Update lists library cost computations for improved accuracy by @​TristonianJones in cel-expr#1352
• Cost library for ext/network by @​TristonianJones in cel-expr#1345
• Introduce async DrainStrategy, DrainAction, Observer, and Call types by @​TristonianJones in cel-expr#1364
• Graceful NaN ordering by @​TristonianJones in cel-expr#1370
• Fix constant folding and local variable resolution by @​TristonianJones in cel-expr#1371
• Concurrent Eval with context.Context bound functions by @​TristonianJones in cel-expr#1369
• Async timeout and retry wrappers by @​TristonianJones in cel-expr#1367
• Add runnable examples for all expressions in celbyexample.com by @​TristonianJones in cel-expr#1373
• Ensure logical operator fold expressions are bool by @​TristonianJones in cel-expr#1380
• Fix unsound constant folding of x in [x] for NaN values by @​pranit0808 in cel-expr#1374
• copy operands in Bytes.Add to avoid aliasing the receiver by @​pranit0808 in cel-expr#1381
• Validation of cel.bind() nesting limits by @​TristonianJones in cel-expr#1378
• Allow validators to be reconfigured by @​TristonianJones in cel-expr#1379
• Add cost tracking to ext/math.go by @​TristonianJones in cel-expr#1353
• Expression node limits for parser and checker by @​TristonianJones in cel-expr#1386

New Contributors

• @​stanleyycheung made their first contribution in cel-expr#1362
• @​wilyan09007 made their first contribution in cel-expr#1334
• @​pranit0808 made their first contribution in cel-expr#1374

Full Changelog: cel-expr/cel-go@v0.29.2...v0.29.3

v0.29.2

Compare Source

What's Changed

• Normalize cel/prompt_test.go to LF, add missing newline in prompt.go by @​dims in cel-expr#1361
• Update lists.go runtime cost calculator by @​TristonianJones in cel-expr#1360

Full Changelog: cel-expr/cel-go@v0.29.1...v0.29.2

v0.29.1

Compare Source

What's Changed

• cel/prompt.go: convert CRLF to LF line ending by @​pohly in cel-expr#1359

Full Changelog: cel-expr/cel-go@v0.29.0...v0.29.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

[github-actions]

Building new version of mimir-build-image. After image is built and pushed to the registry, a new commit will automatically be added to this PR with new image version us-docker.pkg.dev/grafanalabs-dev/docker-mimir-build-image/mimir-build-image:pr16400-0c50d283cd. This can take a few minutes.

[github-actions]

Not building new version of mimir-build-image. This PR modifies the build image or the build image build workflow, but the image us-docker.pkg.dev/grafanalabs-dev/docker-mimir-build-image/mimir-build-image:pr16400-0c50d283cd already exists.

[renovate-sh-app]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[renovate-sh-app]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.