🤖 chore(deps): update cel-go to 0.30.0 for excluded-field protection - #101
Conversation
Bumps [github.com/google/cel-go](https://github.com/google/cel-go) from 0.26.0 to 0.29.0. - [Commits](google/cel-go@v0.26.0...v0.29.0) --- updated-dependencies: - dependency-name: github.com/google/cel-go dependency-version: 0.29.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Maintainer triage: accept this existing CEL dependency update for bounded validation, separately from the installer work. The affected NativeTypes/ParseStructTag path was not found in inspected callers. That is not proof of non-exploitability or compatibility. Validation will inspect upstream changes, verify the full dependency delta, preserve current main's OpenTelemetry/publishing fixes, and compare a small representative Kubernetes CEL adapter probe on baseline and candidate (compile, allow/reject inputs, invalid-expression rejection). Recorded isolated runtime testing will target the combination with current main. Owner: maintainer desk; private validation is underway. No review or merge readiness is claimed. Any application compatibility change beyond the dependency update requires a separate scope decision. Alert #46 remains open until a fix actually lands and closure is observed; the other advisory follow-ups remain tracked in #100. Generated with |
Correction: proposed CEL version does not resolve the observed behaviorThe upstream repository advisory lists v0.22.0–v0.29.2 as vulnerable and v0.30.0 as patched. Its metadata conflicts with the global/Dependabot advisory, which identifies v0.29.0 as fixed. A private, identical scratch probe against current main (cel-go v0.26.0) and PR101 combined with main (v0.29.0) observed both versions registering a No affected deployment path has been demonstrated in this project. This is a library-behavior reproduction, not a claim of project exploitation. A metadata-driven alert closure would not establish remediation. Maintainer decision: do not deliver v0.29.0 as the advisory fix. Expand the existing #101 version scope narrowly to a private v0.30.0 validation candidate, with explicit red/green nondisclosure assertions, both access forms and public-field controls, Kubernetes CEL compatibility checks, full repository/security gates, and recorded runtime testing of the current-main combination. No application redesign, unrelated upgrades, or new PR. If v0.30.0 fails these gates, stop with that blocker. Owner: maintainer desk. Formal assessments consumed on #101: zero. The public branch is unchanged; the corrected candidate has not been published. This also corrects the CEL follow-up assumptions recorded under #100. Generated with |
Integrates current main (#99 GoReleaser main-channel tag preparation, #104 OpenTelemetry 1.45.0) into the PR101 dependency update (github.com/google/cel-go 0.26.0 -> 0.29.0, github.com/antlr4-go/antlr/v4 4.13.0 -> 4.13.1, github.com/stoewer/go-strcase removed). Conflict-free three-way merge: tree 8ae4553 equals `git merge-tree` of both parents. Precommit gates (verify-vendor, reference docs, build, test, lint, govulncheck, Trivy fs, actionlint, publish-tag tests) passed on the staged merged tree. --- _Generated with [`xum`](https://github.com/coder/xum) • Model: `coder:anthropic/claude-fable-5-1` • Thinking: `xhigh`_ Change-Id: Icf79c67651e68f6f75ff450615572ee43b55f2de Signed-off-by: Thomas Kosiewski <tk@coder.com>
Corrects the PR101 target to cel-go v0.30.0, the first release containing upstream fix 83eed56b0fe697952d3bbae964e5539c16cf3a09 (#1349, "Prevent indexing on sentinel json field '-'") for GHSA-gcjh-h69q-9w9g. The repository advisory lists vulnerable v0.22.0 - v0.29.2 and patched v0.30.0; vendored 0.29.0 still exposed `json:"-"` fields through ext.NativeTypes(ParseStructTag("json")). Only cel-go changes (go get, go mod tidy, go mod vendor); no companion module changes. Tree ea3890e. --- _Generated with [`xum`](https://github.com/coder/xum) • Model: `coder:anthropic/claude-fable-5-1` • Thinking: `xhigh`_ Change-Id: I54277290d87fe979fea037c86a52fb0f1b3bc975 Signed-off-by: Thomas Kosiewski <tk@coder.com>
ThomasK33
changed the title
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Delivery verifiedPR #101 landed through the required queue as
Readiness record: exact source head Remediation evidence is the identical assertion-based probe: v0.26.0 and v0.29.0 disclose excluded fields, while v0.30.0 rejects the tested reads and preserves valid public reads. Alert closure alone did not establish this fix. No project deployment exploitability, JSON-conversion coverage, or arbitrary nested-type coverage is claimed. Remaining baseline advisory follow-ups stay tracked in #100. Generated with |
1 participant
Summary
Update cel-go to v0.30.0, not the originally proposed v0.29.0. The upstream repository advisory identifies v0.30.0 as patched. Global/Dependabot metadata incorrectly names v0.29.0; a scratch regression still reproduced excluded-field disclosure on that version.
The existing Dependabot change supplies the ANTLR 4.13.1 companion update and removes go-strcase. The subsequent correction changes only cel-go 0.29.0→0.30.0 and its generated vendor contents. Current main's OpenTelemetry, publishing, and scanner changes are preserved. Existing PR history is retained.
Validation
Candidate
7c36d15d6129e2310a0b9d41624f448b692e8627, treeea3890e9e92bdc66db7d4f48770a285789cec3d4:dyn(x)["-"]changes from disclosure to evaluation rejection; escaped field access changes from disclosure to compilation rejection. Provider enumeration omits the excluded field. Same-route public-field controls pass throughout.The two unpublished preparation commits had their messages corrected for attribution; source trees stayed identical and final-SHA checks/probe/runtime were rerun. Earlier evidence remains preserved.
e2e-replay-1x.mp4
Limits and review focus
This demonstrates the tested library disclosure routes, not exploitation or non-exploitability of a project deployment. JSON conversion and nested-type graph behavior were not probed. Runtime E2E does not directly exercise cel-go; the separate scratch adapter probe supplies bounded CEL evidence. v0.30.0 also changes strict timestamp handling, parser/checker limits, and some cost/numeric behavior; no blanket backwards-compatibility claim is made.
Normal and separate security reviews, an independent final recommendation, and actual merge-queue checks remain required. Alert closure alone is not proof of remediation. Follow-up context: #100. The original v0.29.0 proposal is superseded by this tested correction.
Generated with
xum• Model:coder:bedrock-mantle-us-west-2/openai.gpt-6-astra• Thinking:xhigh