:seedling: Update Golang Dependencies group to v0.29.0 [SECURITY] by cluster-stack-bot[bot] · Pull Request #345 · SovereignCloudStack/cluster-stack-operator

cluster-stack-bot · 2026-07-28T12:58:14Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/google/cel-go	`v0.26.1` -> `v0.29.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

GHSA-gcjh-h69q-9w9g

The function ext.NativeTypes(ParseStructTag("json")) does not honour the encoding/json skip directive json:"-". Fields tagged json:"-" are registered in the CEL type system under the literal name "-" and are readable from any user-submitted CEL expression via dyn(obj)["-"].

Additionally, newNativeTypes silently registers every nested struct reachable from the type passed to NativeTypes, including types from third-party dependencies the developer never examined.

Root cause

In fieldNameByTag, the helper used by ParseStructTag("json") to translate Go struct tags into CEL field names.

See at ext/native.go:146:

func fieldNameByTag(structTagToParse string) func(field reflect.StructField) string {
    return func(field reflect.StructField) string {
        tag, found := field.Tag.Lookup(structTagToParse)
        if found {
            splits := strings.Split(tag, ",")
            if len(splits) > 0 {
                // We make the assumption that the leftmost entry in the tag is the name.
                // This seems to be true for most tags that have the concept of a name/key, such as:
                // https://pkg.go.dev/encoding/xml#Marshal
                // https://pkg.go.dev/encoding/json#Marshal
                // https://pkg.go.dev/go.mongodb.org/mongo-driver/bson#hdr-Structs
                // https://pkg.go.dev/go.yaml.in/yaml/v3#Marshal
                name := splits[0]
                return name
            }
        }

        return field.Name
    }
}

For a field tagged json:"-", this code splits the tag into []string{"-"} and returns "-" as the CEL field name. It never checks whether "-" is the JSON skip sentinel.

This contradicts the encoding/json rule that the source comment explicitly points readers to:

As a special case, if the field tag is "-", the field is always omitted. Note
that a field with name "-" can still be generated using the tag "-,".

The public option also documents JSON-style parsing as the intended behavior.
See at ext/native.go:190:

// ParseStructTag configures the struct tag to parse. The 0th item in the tag is used as the name of the CEL field.
// For example:
// If the tag to parse is "cel" and the struct field has tag cel:"foo", the CEL struct field will be "foo".
// If the tag to parse is "json" and the struct field has tag json:"foo,omitempty", the CEL struct field will be "foo".
func ParseStructTag(tag string) NativeTypesOption {
    return func(ntp *nativeTypeOptions) error {
        ntp.fieldNameHandler = fieldNameByTag(tag)
        return nil
    }
}

A developer using ParseStructTag("json") is therefore led to expect encoding/json field-name semantics. Instead, json:"-" is treated as a real field name.

The bad name is accepted during native type construction. newNativeType checks for duplicate field names, but it does not reject or skip empty names or skip sentinels.

See at ext/native.go:663:

if fieldNameHandler != nil {
    fieldNames := make(map[string]struct{})

    for idx := 0; idx < refType.NumField(); idx++ {
        field := refType.Field(idx)
        fieldName := toFieldName(fieldNameHandler, field)

        if _, found := fieldNames[fieldName]; found {
            return nil, fmt.Errorf("invalid field name `%s` in struct `%s`: %w", fieldName, refType.Name(), errDuplicatedFieldName)
        } else {
            fieldNames[fieldName] = struct{}{}
        }
    }
}

Once accepted, the field becomes part of CEL's view of the type. Field enumeration reports it as a normal field name.

See at ext/native.go:286:

func (tp *nativeTypeProvider) FindStructFieldNames(typeName string) ([]string, bool) {
    if t, found := tp.nativeTypes[typeName]; found {
        fieldCount := t.refType.NumField()
        fields := make([]string, fieldCount)
        for i := 0; i < fieldCount; i++ {
            fields[i] = toFieldName(tp.options.fieldNameHandler, t.refType.Field(i))
        }
        return fields, true
    }
    if celTypeFields, found := tp.baseProvider.FindStructFieldNames(typeName); found {
        return celTypeFields, true
    }
    return tp.baseProvider.FindStructFieldNames(typeName)
}

Field lookup also treats the name as valid and returns the underlying Go field value.

See at ext/native.go:303:

func (tp *nativeTypeProvider) FindStructFieldType(typeName, fieldName string) (*types.FieldType, bool) {
    t, found := tp.nativeTypes[typeName]
    if !found {
        return tp.baseProvider.FindStructFieldType(typeName, fieldName)
    }
    refField, isDefined := t.hasField(fieldName)
    if !found || !isDefined {
        return nil, false
    }

    return &types.FieldType{
        IsSet: func(obj any) bool {
            refVal := reflect.Indirect(reflect.ValueOf(obj))
            refField := refVal.FieldByName(refField.Name)
            return !refField.IsZero()
        },
        GetFrom: func(obj any) (any, error) {
            refVal := reflect.Indirect(reflect.ValueOf(obj))
            refField := refVal.FieldByName(refField.Name)
            return getFieldValue(refField), nil
        },
    }, true
}

At runtime, native objects advertise index access.
See at ext/native.go:37:

var (
    nativeObjTraitMask = traits.FieldTesterType | traits.IndexerType
)

Because traits.IndexerType is present, a user expression can bypass ordinary field syntax and read the registered "-" field with bracket access:

dyn(req.auth)["-"]

The same mistaken name is also used when converting native objects to JSON-like CEL values. ConvertToNative(jsonStructType) iterates all Go struct fields, computes the CEL field name, and inserts it into the output map without applying the JSON skip rule.

See at ext/native.go:501:

case jsonStructType:
    refVal := reflect.Indirect(o.refValue)
    refType := refVal.Type()
    fields := make(map[string]*structpb.Value, refVal.NumField())
    for i := 0; i < refVal.NumField(); i++ {
        fieldType := refType.Field(i)
        fieldValue := refVal.Field(i)
        if !fieldValue.IsValid() || fieldValue.IsZero() {
            continue
        }
        fieldName := toFieldName(o.valType.fieldNameHandler, fieldType)
        fieldCELVal := o.NativeToValue(fieldValue.Interface())
        fieldJSONVal, err := fieldCELVal.ConvertToNative(jsonValueType)
        if err != nil {
            return nil, err
        }
        fields[fieldName] = fieldJSONVal.(*structpb.Value)
    }
    return &structpb.Struct{Fields: fields}, nil

This means a json:"-" secret is exposed in two ways: it can be read directly through CEL indexing as dyn(obj)["-"], and it can appear under the key "-" in JSON struct conversion output.

The blast radius is widened by newNativeTypes, which registers not only the type explicitly passed to NativeTypes, but also every nested struct reachable from its fields.

See at ext/native.go:609:

func newNativeTypes(fieldNameHandler NativeTypesFieldNameHandler, rawType reflect.Type) ([]*nativeType, error) {
    nt, err := newNativeType(fieldNameHandler, rawType)
    if err != nil {
        return nil, err
    }
    result := []*nativeType{nt}

    var iterateStructMembers func(reflect.Type)
    iterateStructMembers = func(t reflect.Type) {
        if k := t.Kind(); k == reflect.Pointer || k == reflect.Slice || k == reflect.Array || k == reflect.Map {
            iterateStructMembers(t.Elem())
            return
        }
        if t.Kind() != reflect.Struct {
            return
        }

        nt, ntErr := newNativeType(fieldNameHandler, t)
        if ntErr != nil {
            err = ntErr
            return
        }
        result = append(result, nt)

        for idx := 0; idx < t.NumField(); idx++ {
            iterateStructMembers(t.Field(idx).Type)
        }
    }
    iterateStructMembers(rawType)

    return result, err
}

As a result, a developer can register one apparently safe request type while a nested dependency type is silently registered too. If that nested type contains a json:"-" secret, CEL still receives a readable field named "-" even though the developer never registered or audited that nested type directly.

Reproduction

package main

import (
    "fmt"
    "reflect"

    "github.com/google/cel-go/cel"
    "github.com/google/cel-go/ext"
)

// Simulates a library type; developer never registers this directly.
type AuthCtx struct {
    UserID string `json:"userId"`
    Secret string `json:"-"` // server-internal; never appears in JSON output
}

// Developer registers only this type.
type Req struct{ Auth AuthCtx `json:"auth"` }

func main() {
    env, _ := cel.NewEnv(
        // Only Req is passed; AuthCtx is registered silently by newNativeTypes.
        ext.NativeTypes(reflect.TypeOf(Req{}), ext.ParseStructTag("json")),
        cel.Variable("req", cel.ObjectType("main.Req")),
    )
    ast, _ := env.Compile(`dyn(req.auth)["-"]`)
    prg, _ := env.Program(ast)
    out, _, _ := prg.Eval(map[string]any{
        "req": Req{Auth: AuthCtx{UserID: "alice", Secret: "sk-live-s3cr3t"}},
    })
    fmt.Println(out) // sk-live-s3cr3t
}

Expected: expression compile error or empty result; json:"-" field should not be
accessible.
Actual: sk-live-s3cr3t; the server-injected secret is returned verbatim.

The same field is also included under key "-" in ConvertToNative(jsonStructType)
output, and appears in FindStructFieldNames enumeration.

path 1. CEL indexing

Tested against the released module github.com/google/cel-go v0.28.1
(latest stable release as of 2026-05-12), using the go.mod entry:

require github.com/google/cel-go v0.28.1

Running the PoC above (go run main.go) produces:

sk-live-s3cr3t

The secret value is returned verbatim, with no error at compile time or at runtime.

Path 2. `ConvertToNative(jsonStructType)`

When the nativeObj for the AuthCtx value is converted to a Protobuf Struct
(the representation used whenever CEL output is serialised to JSON), the
json:"-" field appears in the output map under the key "-".

package main

import (
    "encoding/json"
    "fmt"
    "reflect"

    "github.com/google/cel-go/cel"
    "github.com/google/cel-go/ext"

    structpb "google.golang.org/protobuf/types/known/structpb"
)

type AuthCtxConv struct {
    UserID string `json:"userId"`
    Secret string `json:"-"` // should never appear in JSON output
}

type ReqConv struct{ Auth AuthCtxConv `json:"auth"` }

func main() {
    env, _ := cel.NewEnv(
        ext.NativeTypes(reflect.TypeOf(ReqConv{}), ext.ParseStructTag("json")),
        cel.Variable("req", cel.ObjectType("main.ReqConv")),
    )

    ast, _ := env.Compile(`req.auth`)
    prg, _ := env.Program(ast)
    out, _, _ := prg.Eval(map[string]any{
        "req": ReqConv{Auth: AuthCtxConv{UserID: "alice", Secret: "sk-live-s3cr3t"}},
    })

    jsonStructType := reflect.TypeOf(&structpb.Struct{})
    raw, _ := out.ConvertToNative(jsonStructType)

    st := raw.(*structpb.Struct)
    b, _ := json.MarshalIndent(st.AsMap(), "", "  ")
    fmt.Printf("ConvertToNative(jsonStructType) output:\n%s\n", b)
    fmt.Printf("\nDirect field access via \"-\" key present: %v\n", st.Fields["-"] != nil)
    if v, ok := st.Fields["-"]; ok {
        fmt.Printf("Value: %s\n", v.GetStringValue())
    }
}

Running the PoC above produces:

ConvertToNative(jsonStructType) output:
{
  "-": "sk-live-s3cr3t",
  "userId": "alice"
}

Direct field access via "-" key present: true
Value: sk-live-s3cr3t

The "-" key is present in the serialised Protobuf struct alongside userId.
Any system that converts a CEL evaluation result to JSON (e.g. via structpb.Struct) will include the secret in the output, regardless of whether the dyn()["-"] indexing path is used.

Impact

Any user who can submit CEL expressions to an application that uses ext.NativeTypes(ParseStructTag("json")) can read struct fields that the developer explicitly marked json:"-" to keep out of serialised output. By writing dyn(obj)["-"], the attacker retrieves the raw Go field value, typically a secret, internal token, or private identifier, with no compile-time or runtime error. Because newNativeTypes silently registers every nested struct reachable from the root type, the attacker may also reach secrets in dependency types the developer never intended to expose to CEL.

Remediation

Do not treat json:"-" as a CEL field named "-". Model it as an explicit skipped field, not as an empty string field name.

Update the struct-tag parsing path so exact json:"-" returns “skip this field”, while json:"-," continues to mean the literal field name "-", matching encoding/json semantics.

Apply that skip decision consistently anywhere native fields are exposed or resolved:

duplicate-name validation in newNativeType
field enumeration in FindStructFieldNames
field type lookup in FindStructFieldType
runtime lookup in fieldByName / hasField
object construction in NewValue
JSON conversion in ConvertToNative(jsonStructType)

Apply the same omit handling for xml:"-", yaml:"-", and bson:"-" where ParseStructTag is used.

Release Notes

google/cel-go (github.com/google/cel-go)

`v0.29.0`

Compare Source

What's Changed

New Features

Add JSON encoder extension — a new ext library for JSON encoding by @rohan-patnaik in cel-expr#1340
Upstream network.IP/CIDR support from Kubernetes by @tdesrosi in cel-expr#1238
Managed execution frame with async call foundations by @TristonianJones in cel-expr#1316
Execution frame integration with updated InterpretableV2 by @TristonianJones in cel-expr#1344
Add conformance test runner for CEL Policies by @l46kok in cel-expr#1319

Bug Fixes

Fix unintentional unwrapping of optionals at any level of depth by @TristonianJones in cel-expr#1315
Fix has() unknown propagation during partial evaluation by @0xASTRA in cel-expr#1324
Enforce expression size limit before source construction by @thesmartshadow in cel-expr#1302
Policy variable scoping fixes by @jnthntatum in cel-expr#1321
Emit valid CEL for doubles in scientific notation in the parser/unparser by @moraneus in cel-expr#1326
Allow aliases for simple names in containers by @rohan-patnaik in cel-expr#1327
Reject out-of-range minutes in timezone offset parsing by @alhudz in cel-expr#1336
Validate offset on empty-string path in indexOf and lastIndexOf by @alhudz in cel-expr#1335
Guard int32/uint32 map key narrowing in qualifyInternal by @alhudz in cel-expr#1337
Add max size check to genRange() in ext/lists to prevent OOM by @marwan9696 in cel-expr#1310

Cost Tracking

Ensure receiver and global matches cost estimates agree by @TristonianJones in cel-expr#1350
startsWith/endsWith runtime cost agreement with checked cost by @TristonianJones in cel-expr#1351
Avoid repeated construction of cost tracker by @pohly in cel-expr#1357

Testing & Tooling

Test Runner usability improvements by @jnthntatum in cel-expr#1320
Minor updates to test coverage and code quality by @TristonianJones in cel-expr#1318
Remove duplicate policy tests now covered by policy conformance tests by @l46kok in cel-expr#1332
Minor Google3 import fixes by @l46kok in cel-expr#1331

Documentation

Update documentation for nested first-match rules by @jnthntatum in cel-expr#1323
Add migration warning to README by @dmitriplotnikov in cel-expr#1330

`v0.28.1`

Compare Source

What's Changed

fix: deleted IntToDuration overload by @alexsnaps in #1300
Support shorthand types in env yaml and REPL by @jnthntatum in #1301
Preserve operation interrupted in ContextEval error by @dims in #1303
Use shorthand type specifiers in env yaml files by @jnthntatum in #1305
Cost estimation and tracking for strings extension by @TristonianJones in #1307
Update repl type string for doubles by @TristonianJones in #1308

New Contributors

@alexsnaps made their first contribution in #1300
@dims made their first contribution in #1303

Full Changelog: cel-expr/cel-go@v0.28.0...v0.28.1

`v0.28.0`

Compare Source

High-Level Changes

Enhanced JSON Interoperability: New support for JSON names across the checker, AST, and runtime allows for more seamless data handling when working with JSON-native structures.
Improved Developer Tooling: Integration is now smoother thanks to new utilities for converting Go errors into cel.Issues and more descriptive, context-aware error messages.
Greater Environment Flexibility: You can now redeclare variables as constants and export parse limit options, providing finer control over how CEL environments are configured and constrained.
Native Struct Improvements: Support for mixing CEL and native values within native structs simplifies the handling of complex, hybrid data types.

🚀 Features

Add helper method to check whether a function has a singleton binding in #1266
Helper utility for converting a Go error into cel.Issues in #1267
Policy API improvements in #1268
CEL Test usability requirements in #1269
Better context-related error messages in #1271
Sort env.Config values where reasonable in #1273
Support redeclaring variables as constants in NewEnv in #1275
Add support for exporting parse limit options in #1277
Support mixing CEL values and native values in native structs in #1270
Add checker, AST, and type-provider support for JSON names in #1283
JSON field names runtime support in #1286
Optionally include reachable fieldpaths in prompt in #1285
REPL -- cel-spec pb2 and json name support #1294

🐞 Bug Fixes

Fix support for config-based type references in #1265
Check arg kinds in optional.or and .orValue impl in #1276
Bazel fixes for import in #1278
Support zero-value literals in presence test inlining #1280
Cache concatList.Size() to prevent O(N^2) evaluation time #1291
Preserve runtime error node IDs from Resolve #1290
Default enable identifier escaping with backticks #1295
Cap format string precision to prevent memory exhaustion #1292

🛠️ Maintenance & Internal

chore: Migrate gsutil usage to gcloud storage in #1274
Lint fixes for exported function/type comments in #1279
Lint fixes for import in #1287

Full Changelog: https://github.com/google/cel-go/compare/v0.27.0...v0.28.0-alpha

`v0.27.0`

Compare Source

Release Summary

This release focuses on improving developer tooling and stability. Key highlights include significant enhancements to the REPL (YAML configuration support and parse-only evaluation), the addition of cost estimation for regex operations, and improved test coverage reporting.

On the stability front, this release addresses race conditions in reference types, improves namespace resolution, and ensures formatting directives align strictly with the CEL specification.

Note: This release includes a breaking change regarding how types are handled as variables. Please review the "Breaking Changes" section below.

⚠ Breaking Changes

Remove types as variables: The logic for handling types has been relaxed to support safe rollout of feature packages which introduce new types whose names may collide with existing variables. Please review your policies if you relied on types behaving strictly as variables in previous versions. PR #1262

Features & Enhancements

REPL & Tooling

YAML Configuration: The REPL now supports reading and writing YAML environment configurations. PR #1250
Parse-Only Mode: Added parse-only evaluation capabilities to the REPL. PR #1254
Test Coverage: Introduced logic for CEL test coverage calculation and updated the reporter to handle error/unknown scenarios.PR #1209 & PR #1215

Core Library

Regex Costing: Added support for cost estimation and tracking within the regex library. PR #1200
JSON Type Exposure: Exposed CEL JSON types to assist developers in converting to native values. PR #1261
Policy Composition: Source information is now preserved during CEL policy composition, aiding in debugging. PR #1253

Extensibility:

Updated extension option factory to resolve by ID (#1249).
Refactored match output compiling to accept user-defined logic (#1246).
Exposed Match source ID to callers (#1227).

Build & Maintenance

Bazel: Migrated to use Bazel module only and improved configuration for dependent builds. PR #1231 & PR #1228
Cleanup: Removed strcase dependency, removed AppEngine code from REPL, and performed general linting. PR #1230, #1216, #1251

Bug Fixes

Concurrency: Fixed a race condition in the checker regarding reference types. PR #1224
Namespace Resolution: Addressed an issue with namespace resolution. PR #1256
Spec Compliance: Fixed formatting directives to fully support requirements documented in the cel-spec. PR #1232

New Contributors

@catalinadurbala made their first contribution in #1227
@abenea made their first contribution in #1258

Full Changelog: cel-expr/cel-go@v0.26.1...v0.27.0

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

| datasource | package | from | to | | ---------- | ------------------------ | ------- | ------- | | go | github.com/google/cel-go | v0.26.1 | v0.29.0 |

cluster-stack-bot · 2026-07-28T12:58:17Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined

Command failed: BUILD_IMAGE_TOKEN=**redacted** BUILD_IMAGE_USER=kranurag7 CI=true ./hack/upgrade-builder-image.sh
+ set -o errexit
+ set -o nounset
+ set -o pipefail
+++ dirname ./hack/upgrade-builder-image.sh
++ realpath ./hack/..
+ REPO_ROOT=/tmp/renovate/repos/github/SovereignCloudStack/cluster-stack-operator
+ cd /tmp/renovate/repos/github/SovereignCloudStack/cluster-stack-operator
+ source /tmp/renovate/repos/github/SovereignCloudStack/cluster-stack-operator/hack/semver-upgrade.sh
++ set -o errexit
++ set -o nounset
++ set -o pipefail
++ set -x
+ '[' true = true ']'
+ echo **redacted**
+ docker login ghcr.io -u kranurag7 --password-stdin

WARNING! Your credentials are stored unencrypted in '/home/ubuntu/.docker/config.json'.
Configure a credential helper to remove this warning. See
https://docs.docker.com/go/credential-store/

++ git fetch --quiet origin main
++ git show origin/main:.builder-image-version.txt
+ export VERSION=1.1.34
+ VERSION=1.1.34
++ semver_upgrade patch 1.1.34
++ IFS=.
++ read -r version minor patch
++ case "$1" in
++ tag=1.1.35
++ echo 1.1.35
+ export NEW_VERSION=1.1.35
+ NEW_VERSION=1.1.35
+ echo 1.1.35
+ echo 'Wrote new version 1.1.35 to .builder-image-version.txt'
+ docker manifest inspect ghcr.io/sovereigncloudstack/cso-builder:1.1.34
+ echo 0
+ sed -i -e '/^BUILDER_IMAGE_VERSION /s/:=.*$/:= 1.1.35/' Makefile
+ for FILE in ${REPO_ROOT}/.github/workflows/*
+ grep 'image: ghcr.io/sovereigncloudstack/cso-builder' /tmp/renovate/repos/github/SovereignCloudStack/cluster-stack-operator/.github/workflows/build.yml
+ for FILE in ${REPO_ROOT}/.github/workflows/*
+ grep 'image: ghcr.io/sovereigncloudstack/cso-builder' /tmp/renovate/repos/github/SovereignCloudStack/cluster-stack-operator/.github/workflows/kubebuilder-markers-checker.yml
+ for FILE in ${REPO_ROOT}/.github/workflows/*
+ grep 'image: ghcr.io/sovereigncloudstack/cso-builder' /tmp/renovate/repos/github/SovereignCloudStack/cluster-stack-operator/.github/workflows/pr-lint.yml
+ sed -i -e '/image: ghcr\.io\/sovereigncloudstack\/cso-builder:/s/:.*$/: ghcr\.io\/sovereigncloudstack\/cso-builder:1.1.35/' /tmp/renovate/repos/github/SovereignCloudStack/cluster-stack-operator/.github/workflows/pr-lint.yml
+ for FILE in ${REPO_ROOT}/.github/workflows/*
+ grep 'image: ghcr.io/sovereigncloudstack/cso-builder' /tmp/renovate/repos/github/SovereignCloudStack/cluster-stack-operator/.github/workflows/release.yml
+ for FILE in ${REPO_ROOT}/.github/workflows/*
+ grep 'image: ghcr.io/sovereigncloudstack/cso-builder' /tmp/renovate/repos/github/SovereignCloudStack/cluster-stack-operator/.github/workflows/schedule-cache-cleaner-cso-image.yml
+ for FILE in ${REPO_ROOT}/.github/workflows/*
+ grep 'image: ghcr.io/sovereigncloudstack/cso-builder' /tmp/renovate/repos/github/SovereignCloudStack/cluster-stack-operator/.github/workflows/schedule-scan-image.yml
+ sed -i -e '/image: ghcr\.io\/sovereigncloudstack\/cso-builder:/s/:.*$/: ghcr\.io\/sovereigncloudstack\/cso-builder:1.1.35/' /tmp/renovate/repos/github/SovereignCloudStack/cluster-stack-operator/.github/workflows/schedule-scan-image.yml
+ for FILE in ${REPO_ROOT}/.github/workflows/*
+ grep 'image: ghcr.io/sovereigncloudstack/cso-builder' /tmp/renovate/repos/github/SovereignCloudStack/cluster-stack-operator/.github/workflows/schedule-update-bot.yaml
+ for FILE in ${REPO_ROOT}/.github/workflows/*
+ grep 'image: ghcr.io/sovereigncloudstack/cso-builder' /tmp/renovate/repos/github/SovereignCloudStack/cluster-stack-operator/.github/workflows/test.yml
+ for FILE in ${REPO_ROOT}/.github/workflows/*
+ grep 'image: ghcr.io/sovereigncloudstack/cso-builder' /tmp/renovate/repos/github/SovereignCloudStack/cluster-stack-operator/.github/workflows/verifier.yml
+ docker build -t ghcr.io/sovereigncloudstack/cso-builder:1.1.35 ./images/builder
DEPRECATED: The legacy builder is deprecated and will be removed in a future release.
            Install the buildx component to build images with BuildKit:
            https://docs.docker.com/go/buildx/

The command '/bin/sh -c apk add -U --no-cache     curl     clusterctl=~${CLUSTERCTL_VERSION#v}     controller-gen=~${CONTROLLER_GEN_VERSION#v}     helm=~${HELM_VERSION#v}     kind=~${KIND_VERSION#v}     kubectl=~${KUBECTL_VERSION#v}     kustomize=~${KUSTOMIZE_VERSION#v}     trivy=~${TRIVY_VERSION#v}' returned a non-zero code: 4

🌱 Update Golang Dependencies group to v0.29.0 [SECURITY]

210847b

| datasource | package | from | to | | ---------- | ------------------------ | ------- | ------- | | go | github.com/google/cel-go | v0.26.1 | v0.29.0 |

cluster-stack-bot Bot added type/minor update/go labels Jul 28, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

🌱 Update Golang Dependencies group to v0.29.0 [SECURITY] - #345

🌱 Update Golang Dependencies group to v0.29.0 [SECURITY]#345
cluster-stack-bot[bot] wants to merge 1 commit into
mainfrom
renovate/go-github.com-google-cel-go-vulnerability

cluster-stack-bot Bot commented Jul 28, 2026

Uh oh!

cluster-stack-bot Bot commented Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

cluster-stack-bot Bot commented Jul 28, 2026

GitHub Vulnerability Alerts

GHSA-gcjh-h69q-9w9g

Root cause

Reproduction

path 1. CEL indexing

Path 2. ConvertToNative(jsonStructType)

Impact

Remediation

Release Notes

v0.29.0

What's Changed

New Features

Bug Fixes

Cost Tracking

Testing & Tooling

Documentation

v0.28.1

What's Changed

New Contributors

v0.28.0

High-Level Changes

🚀 Features

🐞 Bug Fixes

🛠️ Maintenance & Internal

v0.27.0

Release Summary

⚠ Breaking Changes

Features & Enhancements

REPL & Tooling

Core Library

Extensibility:

Build & Maintenance

Bug Fixes

New Contributors

Configuration

Uh oh!

cluster-stack-bot Bot commented Jul 28, 2026

⚠️ Artifact update problem

File name: undefined

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Path 2. `ConvertToNative(jsonStructType)`

`v0.29.0`

`v0.28.1`

`v0.28.0`

`v0.27.0`