Skip to content

go.mod: bump the most-deps group across 1 directory with 6 updates - #171

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/most-deps-850dbf967b
Open

go.mod: bump the most-deps group across 1 directory with 6 updates#171
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/most-deps-850dbf967b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the most-deps group with 5 updates in the / directory:

Package From To
github.com/google/cel-go 0.30.0 0.31.0
github.com/rogpeppe/go-internal 1.15.0 1.16.0
github.com/stretchr/testify 1.11.1 1.12.0
golang.org/x/crypto 0.54.0 0.55.0
google.golang.org/protobuf 1.36.11 1.36.12

Updates github.com/google/cel-go from 0.30.0 to 0.31.0

Release notes

Sourced from github.com/google/cel-go's releases.

Release v0.31.0

This release introduces critical performance breakthroughs, simplifies integration with native Go structures, and hardens the safety limits of evaluated expressions.

Features

Pull Request Description and Impact
Env copy on write (#1405) Introduces Copy-on-Write (COW) mechanics for environment definitions, dramatically slashing CPU and memory allocation overhead when building child or extended environments.
Optimize NativeToValue call paths (#1400) Optimizes reflection-heavy conversion paths, significantly improving evaluation speeds when feeding native Go types directly to the runtime engine.
Support self-describing, self-adapting struct types (#1395) Simplifies struct integration by enabling native Go struct types to self-describe and adapt directly to the CEL type system without verbose boilerplate.
Move native type support into the Core CEL library (#1396) Moves native Go type mapping utilities directly into the Core CEL package to unify dependency structure and improve native API access.
Regex program plan size controls (#1383) Introduces critical compiled size constraints on regex expressions to mitigate CPU/memory exhaustion vectors during evaluation.
Simplify support for native object types (#1393) Streamlines setup workflows for mapping standard Go structures inside the CEL compiler environment.
Tag automation for go submodules (#1401) Automates the submodule tagging process to streamline multi-module releases.

Fixes

Pull Request Impact and Technical Details
Respect composed adapter for unregistered structs (#1384) Corrects behavior so that unregistered Go structs properly fall back to composed adapter configurations.
reject out-of-range hours in timezone offset parsing (#1391) Tightens datetime validation by rejecting invalid out-of-range hour offsets during timezone parsing.
Fix the expression limit node test (#1390) Restores stability to environment node test suites verifying size-limit assertions.
Correct documented default max value for lists.range (#1392) Resolves documentation drift regarding the default maximum limit for the lists.range function.

Breaking Changes

There are no breaking changes, but all ext.NativeTypes features are now available via cel.NativeTypes

Notes on Performance

This release targets two primary computational bottlenecks in high-throughput CEL environments: environment construction and reflection-based type coercion.

Expected Impact

  1. Dynamic Environment Extension: Applications that dynamically extend a base CEL environment per request (e.g., policy validation engines or API gateways adding request-scoped variables) will see near-zero initialization costs. The Copy-on-Write (COW) optimization prevents copying underlying maps of variables, functions, and adapters.
  2. Type Coercion Speed: Bypassing heavy reflection paths during NativeToValue conversions significantly cuts down CPU cycle usage and drastically reduces garbage collection overhead in processing hot paths.
  3. AST Pruning: Consolidating sequential list concatenations (#1406) and optimizing optional macros (#1387) ensures that generated program plans are leaner, reducing both compilation and execution memory footprints.

Go-lang Benchmark Citation (benchstat)

The performance improvements can be verified running the repository's native benchmark harness with benchstat:

name old time/op new time/op delta
BenchmarkEnvExtension/10_vars 3.56µs ± 1% 0.15µs ± 0% -95.79% (p=0.000 n=10+10)
BenchmarkNativeToValue/struct 120ns ± 2% 42ns ± 1% -65.00% (p=0.000 n=10+10)
BenchmarkOptionalMapEvaluation 245ns ± 1% 195ns ± 1% -20.41% (p=0.000 n=10+10)

name old allocs/op new allocs/op delta
BenchmarkEnvExtension/10_vars 32.0 ± 0% 1.0 ± 0% -96.88% (p=0.000 n=10+10)
BenchmarkNativeToValue/struct 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10)

... (truncated)

Commits

Updates github.com/rogpeppe/go-internal from 1.15.0 to 1.16.0

Commits

Updates github.com/stretchr/testify from 1.11.1 to 1.12.0

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

New Contributors

... (truncated)

Commits
  • 001eb79 Merge pull request #1905 from Kentzo/patch-1
  • ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
  • 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
  • f8c01f3 mock: Mock.Return does not exist anymore
  • 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
  • a11649e assert: make *AssertionFunc type just aliases
  • dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
  • 098f8d7 _codegen: use strings.Builder
  • d2699be _codegen: modernize
  • a463c8c Merge pull request #1885 from stretchr/dolmen/ci-check-ghactions-hashes
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.54.0 to 0.55.0

Commits
  • f44d03d go.mod: update golang.org/x dependencies
  • 5ed4944 crypto/internal/poly1305: provide optimised assembly for riscv64
  • b07833c ssh: return window credit for discarded extended data
  • d701c51 acme: fix nil pointer dereference in pebble test error reporting
  • 999d053 ssh: fix parsing of GSSAPI payloads offering multiple mechanisms
  • 90f76b8 ssh: reject certificate signature keys before recursing
  • b53964a ssh: permit empty but non-nil HostKeyAlgorithms, KeyExchanges, Ciphers, MACs
  • 626e40f ssh: drain stderr on forwarded TCP and Unix channels
  • 31914c6 x509roots/fallback: update bundle
  • f2135b8 all: clean up minor issues found by staticcheck
  • Additional commits viewable in compare view

Updates golang.org/x/text from 0.40.0 to 0.41.0

Commits
  • acdba66 go.mod: update golang.org/x dependencies
  • 02aa981 secure/precis: fix short destination buffer handling in Nickname profile
  • See full diff in compare view

Updates google.golang.org/protobuf from 1.36.11 to 1.36.12

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
go.mod: bump the most-deps group across 1 directory with 6 updates
b9d927b 
Bumps the most-deps group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/google/cel-go](https://github.com/google/cel-go) | `0.30.0` | `0.31.0` |
| [github.com/rogpeppe/go-internal](https://github.com/rogpeppe/go-internal) | `1.15.0` | `1.16.0` |
| [github.com/stretchr/testify](https://github.com/stretchr/testify) | `1.11.1` | `1.12.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.54.0` | `0.55.0` |
| google.golang.org/protobuf | `1.36.11` | `1.36.12` |



Updates `github.com/google/cel-go` from 0.30.0 to 0.31.0
- [Release notes](https://github.com/google/cel-go/releases)
- [Commits](cel-expr/cel-go@v0.30.0...v0.31.0)

Updates `github.com/rogpeppe/go-internal` from 1.15.0 to 1.16.0
- [Release notes](https://github.com/rogpeppe/go-internal/releases)
- [Commits](rogpeppe/go-internal@v1.15.0...v1.16.0)

Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.0
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.11.1...v1.12.0)

Updates `golang.org/x/crypto` from 0.54.0 to 0.55.0
- [Commits](golang/crypto@v0.54.0...v0.55.0)

Updates `golang.org/x/text` from 0.40.0 to 0.41.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.40.0...v0.41.0)

Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12

---
updated-dependencies:
- dependency-name: github.com/google/cel-go
  dependency-version: 0.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: most-deps
- dependency-name: github.com/rogpeppe/go-internal
  dependency-version: 1.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: most-deps
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: most-deps
- dependency-name: golang.org/x/crypto
  dependency-version: 0.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: most-deps
- dependency-name: golang.org/x/text
  dependency-version: 0.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: most-deps
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: most-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants