chore(deps): bump github.com/google/cel-go from 0.28.1 to 0.29.0

[dependabot]

Bumps github.com/google/cel-go from 0.28.1 to 0.29.0.

Release notes

Sourced from github.com/google/cel-go's releases.

Release v0.29.0

What's Changed

New Features

• Add JSON encoder extension — a new ext library for JSON encoding by @​rohan-patnaik in cel-expr/cel-go#1340
• Upstream network.IP/CIDR support from Kubernetes by @​tdesrosi in cel-expr/cel-go#1238
• Managed execution frame with async call foundations by @​TristonianJones in cel-expr/cel-go#1316
• Execution frame integration with updated InterpretableV2 by @​TristonianJones in cel-expr/cel-go#1344
• Add conformance test runner for CEL Policies by @​l46kok in cel-expr/cel-go#1319

Bug Fixes

• Fix unintentional unwrapping of optionals at any level of depth by @​TristonianJones in cel-expr/cel-go#1315
• Fix has() unknown propagation during partial evaluation by @​0xASTRA in cel-expr/cel-go#1324
• Enforce expression size limit before source construction by @​thesmartshadow in cel-expr/cel-go#1302
• Policy variable scoping fixes by @​jnthntatum in cel-expr/cel-go#1321
• Emit valid CEL for doubles in scientific notation in the parser/unparser by @​moraneus in cel-expr/cel-go#1326
• Allow aliases for simple names in containers by @​rohan-patnaik in cel-expr/cel-go#1327
• Reject out-of-range minutes in timezone offset parsing by @​alhudz in cel-expr/cel-go#1336
• Validate offset on empty-string path in indexOf and lastIndexOf by @​alhudz in cel-expr/cel-go#1335
• Guard int32/uint32 map key narrowing in qualifyInternal by @​alhudz in cel-expr/cel-go#1337
• Add max size check to genRange() in ext/lists to prevent OOM by @​marwan9696 in cel-expr/cel-go#1310

Cost Tracking

• Ensure receiver and global matches cost estimates agree by @​TristonianJones in cel-expr/cel-go#1350
• startsWith/endsWith runtime cost agreement with checked cost by @​TristonianJones in cel-expr/cel-go#1351
• Avoid repeated construction of cost tracker by @​pohly in cel-expr/cel-go#1357

Testing & Tooling

• Test Runner usability improvements by @​jnthntatum in cel-expr/cel-go#1320
• Minor updates to test coverage and code quality by @​TristonianJones in cel-expr/cel-go#1318
• Remove duplicate policy tests now covered by policy conformance tests by @​l46kok in cel-expr/cel-go#1332
• Minor Google3 import fixes by @​l46kok in cel-expr/cel-go#1331

Documentation

• Update documentation for nested first-match rules by @​jnthntatum in cel-expr/cel-go#1323
• Add migration warning to README by @​dmitriplotnikov in cel-expr/cel-go#1330

Commits

• fa16799 avoid repeated construction of cost tracker (#1357)
• ea3d5c0 feat(ext): add json encoder (#1340)
• a4d0d64 startsWith / endsWith runtime cost agreement with checked cost (#1351)
• d4efa77 Ensure receiver and global matches cost estimates agree (#1350)
• 13cff33 ext/lists: add max size check to genRange() to prevent OOM (#1310)
• f0ffa7e Execution frame integration with updated IntepretableV2 (#1344)
• f1ec2f6 guard int32/uint32 map key narrowing in qualifyInternal (#1337)
• 258e7c8 Managed execution frame with async call foundations (#1316)
• 14f6746 validate offset on empty-string path in indexOf and lastIndexOf (#1335)
• 783267d reject out-of-range minutes in timezone offset parsing (#1336)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[mescon]

cel-go 0.29.0 does not compile against caddy v2.11.4 (celmatcher.go: interpreter.Interpretable vs InterpretableV2 in interpreter.NewCall), and 2.11.4 is the newest caddy release. Verified locally. The advisory's vulnerable paths are not reachable from this codebase per govulncheck (we do not use CEL matchers), so this waits until caddy ships cel-go 0.29 support -- the bump will be picked up with that caddy upgrade.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.