From 097f54e18d1320b0a37add6fffa0667bf354217c Mon Sep 17 00:00:00 2001 From: Lakhan Samani Date: Fri, 7 Aug 2026 22:14:28 +0530 Subject: [PATCH] chore(deps): bump cel-go to v0.29.2 for GHSA-gcjh-h69q-9w9g MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cel-go >=0.22.0,<=0.28.1 lets ext.NativeTypes(ParseStructTag("json")) expose struct fields marked json:"-" via dyn(obj)["-"]. Fixed in 0.29.0. Not exploitable here — cel-go/ext is linked in (via buf.build/go/protovalidate/cel) but neither protovalidate nor openfga calls NativeTypes or ParseStructTag, and neither does our code. Bumped anyway: the fix is a version change and leaving a flagged advisory in the tree costs more than it saves. Note govulncheck does NOT cover this advisory yet — its only finding is the pre-existing, unfixed GO-2026-5932 (x/crypto/openpgp). Its silence was not evidence of safety here; reachability was checked by hand. --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index c17894c01..d7a59073d 100644 --- a/go.mod +++ b/go.mod @@ -112,7 +112,7 @@ require ( github.com/golang-sql/sqlexp v0.1.0 // indirect github.com/golang/mock v1.6.0 // indirect github.com/golang/snappy v0.0.4 // indirect - github.com/google/cel-go v0.28.1 // indirect + github.com/google/cel-go v0.29.2 // indirect github.com/google/go-tpm v0.9.8 // indirect github.com/google/jsonschema-go v0.4.3 // indirect github.com/gorilla/websocket v1.5.0 // indirect diff --git a/go.sum b/go.sum index cca6bdd9b..233d518e6 100644 --- a/go.sum +++ b/go.sum @@ -264,8 +264,8 @@ github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6 github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q= github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM= github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q= -github.com/google/cel-go v0.28.1 h1:YWIwi77J4xIsYUwAF/iIuS6haffzIHS8yWI8glSbLWM= -github.com/google/cel-go v0.28.1/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8= +github.com/google/cel-go v0.29.2 h1:ZtDxkeiMmz0mxbKDYiNkE5Lk7V5edMRcaaDf2jX002k= +github.com/google/cel-go v0.29.2/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8= github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M= github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=