chore(deps): bump github.com/google/cel-go from 0.27.0 to 0.29.0

[dependabot]

Bumps github.com/google/cel-go from 0.27.0 to 0.29.0.

Release notes

Sourced from github.com/google/cel-go's releases.

Release v0.29.0

What's Changed

New Features

• Add JSON encoder extension — a new ext library for JSON encoding by @​rohan-patnaik in cel-expr/cel-go#1340
• Upstream network.IP/CIDR support from Kubernetes by @​tdesrosi in cel-expr/cel-go#1238
• Managed execution frame with async call foundations by @​TristonianJones in cel-expr/cel-go#1316
• Execution frame integration with updated InterpretableV2 by @​TristonianJones in cel-expr/cel-go#1344
• Add conformance test runner for CEL Policies by @​l46kok in cel-expr/cel-go#1319

Bug Fixes

• Fix unintentional unwrapping of optionals at any level of depth by @​TristonianJones in cel-expr/cel-go#1315
• Fix has() unknown propagation during partial evaluation by @​0xASTRA in cel-expr/cel-go#1324
• Enforce expression size limit before source construction by @​thesmartshadow in cel-expr/cel-go#1302
• Policy variable scoping fixes by @​jnthntatum in cel-expr/cel-go#1321
• Emit valid CEL for doubles in scientific notation in the parser/unparser by @​moraneus in cel-expr/cel-go#1326
• Allow aliases for simple names in containers by @​rohan-patnaik in cel-expr/cel-go#1327
• Reject out-of-range minutes in timezone offset parsing by @​alhudz in cel-expr/cel-go#1336
• Validate offset on empty-string path in indexOf and lastIndexOf by @​alhudz in cel-expr/cel-go#1335
• Guard int32/uint32 map key narrowing in qualifyInternal by @​alhudz in cel-expr/cel-go#1337
• Add max size check to genRange() in ext/lists to prevent OOM by @​marwan9696 in cel-expr/cel-go#1310

Cost Tracking

• Ensure receiver and global matches cost estimates agree by @​TristonianJones in cel-expr/cel-go#1350
• startsWith/endsWith runtime cost agreement with checked cost by @​TristonianJones in cel-expr/cel-go#1351
• Avoid repeated construction of cost tracker by @​pohly in cel-expr/cel-go#1357

Testing & Tooling

• Test Runner usability improvements by @​jnthntatum in cel-expr/cel-go#1320
• Minor updates to test coverage and code quality by @​TristonianJones in cel-expr/cel-go#1318
• Remove duplicate policy tests now covered by policy conformance tests by @​l46kok in cel-expr/cel-go#1332
• Minor Google3 import fixes by @​l46kok in cel-expr/cel-go#1331

Documentation

• Update documentation for nested first-match rules by @​jnthntatum in cel-expr/cel-go#1323
• Add migration warning to README by @​dmitriplotnikov in cel-expr/cel-go#1330

Release v0.28.1

What's Changed

• fix: deleted IntToDuration overload by @​alexsnaps in google/cel-go#1300
• Support shorthand types in env yaml and REPL by @​jnthntatum in google/cel-go#1301
• Preserve operation interrupted in ContextEval error by @​dims in google/cel-go#1303
• Use shorthand type specifiers in env yaml files by @​jnthntatum in google/cel-go#1305
• Cost estimation and tracking for strings extension by @​TristonianJones in google/cel-go#1307
• Update repl type string for doubles by @​TristonianJones in google/cel-go#1308

New Contributors

• @​alexsnaps made their first contribution in google/cel-go#1300
• @​dims made their first contribution in google/cel-go#1303

... (truncated)

Commits

• fa16799 avoid repeated construction of cost tracker (#1357)
• ea3d5c0 feat(ext): add json encoder (#1340)
• a4d0d64 startsWith / endsWith runtime cost agreement with checked cost (#1351)
• d4efa77 Ensure receiver and global matches cost estimates agree (#1350)
• 13cff33 ext/lists: add max size check to genRange() to prevent OOM (#1310)
• f0ffa7e Execution frame integration with updated IntepretableV2 (#1344)
• f1ec2f6 guard int32/uint32 map key narrowing in qualifyInternal (#1337)
• 258e7c8 Managed execution frame with async call foundations (#1316)
• 14f6746 validate offset on empty-string path in indexOf and lastIndexOf (#1335)
• 783267d reject out-of-range minutes in timezone offset parsing (#1336)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[claude]

Claude finished @dependabot[bot]'s task in 1m 11s —— View job

---

Dependency review: github.com/google/cel-go 0.27.0 → 0.29.0

• Identify changed dependencies
• Determine direct vs. indirect usage
• Assess breaking/behavioral changes across v0.28 → v0.29
• Flag any at-risk usage in this repo
• Post review summary

Summary — ✅ Low risk

What changed: Only go.mod / go.sum. cel-go is bumped two minor versions (0.27.0 → 0.28.x → 0.29.0).

How it's used here: It is an // indirect dependency — there are zero direct imports of cel-go anywhere in the repo's Go code (grep -rn "cel-go" --include="*.go" → none). It's pulled in transitively through the Kubernetes stack (k8s.io/apiserver / k8s.io/apiextensions-apiserver at go.mod:239,238, used by the internal/kube integration for K8s environment snapshots). CEL is used inside those libraries for CRD validation / admission expressions, not by any Kosli code path.

Because nothing in this repo calls the cel-go API directly, the API-surface changes in these releases cannot affect this codebase. For reference, the notable upstream changes are all additive or internal:

• New features: JSON encoder ext lib, network.IP/CIDR support, managed execution frame / InterpretableV2.
• Bug fixes / hardening: OOM guard in ext/lists.genRange(), expression size limit enforced earlier, optional-unwrapping fix, timezone/offset validation, int32/uint32 map-key narrowing guard.
• Cost-tracking refinements (startsWith/endsWith, receiver/global cost agreement).

Since pre-0.x semver offers no compatibility guarantee, the only real consumer of these changes is the vendored k8s.io/apiserver@v0.36.0, which is pinned via replace directives and already expects a compatible CEL version.

Recommendation

Safe to merge once CI is green. No code changes needed. Suggested checks (all covered by existing CI):

• go build ./... compiles — confirms the module graph resolves. (I could not run the build/go mod why here — those commands were blocked by the sandbox permission prompt, so I'm relying on CI to confirm compilation.)
• The internal/kube test suite passes, since that's the only subsystem transitively touching CEL.