chore: bump cel.dev/cel-go from 0.32.0 to 0.33.0 - #31694

Sourced from cel.dev/cel-go's releases.

Release v0.33.0

This release introduces a high-performance Pratt parser, a unified declarative cost model (common/cost) with aggregate sizing and peak memory tracking, raw pointer traversal for native Go structs, and JSON/YAML parsing extensions, while eliminating quadratic type-checking bottlenecks.

Features

Pull Request	Description and Impact
Pratt parser and EnablePrattParser option (#1427, #1433, #1442, #1462, #1472, #1497, #1509, #1511, #1521)	Introduces a recursive-descent Pratt parser ported from cel-cpp with iterative parenthesis handling, bounded expression nesting, and escaped function name support, delivering 8x–19x faster single-threaded parsing.
Unified cost model (common/cost), AggregateSizingStrategy, and CostModelVersion (#1430, #1435, #1441, #1474, #1478, #1482, #1512, #1519, #1525, #1537, #1548, #1556, #1558)	Unifies static cost estimation and runtime tracking under a declarative cost.OverloadModel AST with container Key/Elem size propagation, aggregate sizing, value-backed ElemOf/KeyOf/ElemTotal/KeyTotal/Length combinators, and versioned compatibility via cel.CostModelVersion.
Runtime peak memory tracking (#1418, #1429)	Adds runtime memory tracking and scaled string/byte sizing options to observe and bound peak allocation footprints during evaluation.
Native raw pointer traversal, generic containers, and type aliasing (#1463, #1498, #1503, #1515)	Accelerates cel.NativeTypes struct field selection and presence checks via unsafe.Pointer offset traversal, adds generic Go slice/map adapters, and supports native type aliasing.
JSON/YAML parsing and encoding & URL-safe Base64 (#1451, #1461, #1492)	Adds json.parse, yaml.parse, and yaml.encode extensions (returning optional_type with 10MB payload safety limits), alongside base64.encodeUrl and base64.decodeUrl in ext.Encoders.
List presence helpers and versioned optional macros (#1447, #1448, #1487)	Introduces hasOnly, hasAny, hasAll, and hasExactly in ext.Lists, optional.hasValue(val) in OptionalTypesVersion(3), and single-evaluation optMap/optFlatMap macros in OptionalTypesVersion(4).
HMAC digest and constant-time equality (#1450)	Extends ext/security/hmac with hmac.digest and linear-time equality comparisons.
Late-bound functions from Activation (#1483)	Enables resolving cel.FunctionVars bindings dynamically from the runtime Activation or cel.Globals.
Type-check error suggestions and cel.Env JSON serialization (#1500, #1554)	Adds edit-distance spellchecking and library enablement hints for undeclared symbols/types, plus JSON/YAML config serialization for cel.Env.
AST structural equivalence and @block call tagging (#1467, #1544)	Provides format-insensitive AST structural comparison in common/ast and tags cel.@block calls in compiled ASTs.
SLSA + Sigstore artifact signing and OSS-Fuzz consolidation (#1426, #1577)	Signs release artifacts with SLSA/Sigstore provenance and consolidates OSS-Fuzz harnesses under fuzzing/.

Fixes

Pull Request	Impact and Technical Details
Undo failed assignability checks in place (#1575)	Replaces full type-mapping clones during overload resolution with an in-place undo log, eliminating O(N^2) type-checking latency and memory growth on long conjunctions (#1553).
Restore v0.32.0 cost behavior at CostModelVersion(0) and v0.29.2 cost limit error (#1571, #1572, #1573)	Restores EvalCancelledError ("operation cancelled: actual cost limit exceeded") when runtime cost limits are exceeded and replays v0.32.0 static/runtime cost rules when pinned to cel.CostModelVersion(0).
Fix unsafe math and saturation in cost estimation and tracking (#1508, #1541)	Adds SafeSubtract, SafeTrunc, and SafeMultiplyByFactorTrunc in common/cost so uint64 and float-scaled costs saturate cleanly at math.MaxUint64 (including NaN) and clamp negative values to 0.
Nil-safe Program evaluation and concurrent cost tracker race fix (#1480, #1484, #1486, #1488)	Makes Eval, ContextEval, and ConcurrentEval nil-safe, eliminates a data race when capturing cost trackers across goroutines, and removes time-based flakiness in interrupt checks.
Constant folding and partial evaluation AST consistency (#1446, #1453, #1517, #1518)	Prunes folded nodes from reference and type maps, checks unknowns before traversing attribute qualifiers, and fixes custom Foldable two-variable iteration.
Native types embedded json:"-" tags and proto.ReflectMessage dereference (#1452, #1551, #1567)	Respects json:"-" skip tags on embedded Go structs, fixes JSON tag conversion in ConvertToNative, and prevents invalid field dereferences over proto.ReflectMessage.
Fix regex counted repetition sizing panic (#1438)	Prevents a panic when estimating compiled regex program sizes for counted repetitions.

Breaking Changes

There are no module path changes in this release, but callers relying on exact AST expansion shapes, golden cost estimates, or positional SizeEstimate literals should note:

1. Cost Model v1 Default (cel.CostModelVersion): cel.CostModelVersion(1) is now the default and tightens static/runtime cost bounds (propagating optional and container element sizes, charging 1 on absent optional qualifiers, and normalizing rational scale factors). Callers requiring exact v0.32.0 cost compatibility can pin cel.CostModelVersion(0).
2. Optional Types v4 Default (cel.OptionalTypes): Unpinned cel.OptionalTypes() now defaults to OptionalTypesVersion(4), which wraps non-identifier optMap/optFlatMap targets in a single-evaluation comprehension (ComprehensionKind) rather than duplicating the target in a ternary call (CallKind), and includes optional.hasValue(val) from v3. Pin cel.OptionalTypes(cel.OptionalTypesVersion(2)) to preserve legacy AST expansion and cost estimates.
3. cost.SizeEstimate Struct Fields: cost.SizeEstimate (aliased by checker.SizeEstimate) now includes Key *SizeEstimate and Elem *SizeEstimate fields to track container element sizing. Unkeyed positional struct literals (SizeEstimate{0, 10}) must be updated to keyed literals (SizeEstimate{Min: 0, Max: 10}) or cost.FixedSizeEstimate / cost.RangedSizeEstimate.

Notes on Performance

This release delivers major throughput and allocation improvements across all three phases of the CEL pipeline: parsing, type-checking, and evaluation.

Expected Impact

1. Pratt Parsing (cel.EnablePrattParser(true)): Replacing ANTLR's reflection and DFA overhead with a custom recursive-descent Pratt parser and iterative parenthesis scanner (#1433, #1442, #1509) speeds up single-threaded parsing by 7.4x–19.6x (and parallel parsing by 17x–38.7x) while cutting parser memory allocations by 8x–15x.
2. Linear-Time Type Checking on Large Expressions: Rolling back failed type-parameter assignability checks in place (#1575) instead of cloning the full substitution map eliminates quadratic O(N^2) CPU and heap growth when checking large conjunctions of macros or parameterized overloads, reducing 400-term conjunction checking from 1.46s / 882 MB to 7.1ms / 5.8 MB (-99.5%).
3. Zero-Reflection Native Struct & Optional Field Access: Computing field offsets via unsafe.Pointer for cel.NativeTypes (#1515, #1578) and routing optional proto3 field selections through precomputed fieldQualifier plans (#1568) reduces struct access and presence test latency by 57%–78% and eliminates intermediate heap allocations on has() checks.
4. Interpreter Frame, Activation, and Container Hot Paths: Rearchitecting ExecutionFrame as a direct Activation (#1489), flattening dynamicSlotActivation.slotVals from []*slotVal to []slotVal (#1569), lazily initializing standard/extension declarations (#1501, #1502), and using generic slice lists (#1498) reduce per-evaluation allocations across comprehension and block expressions.

... (truncated)

• f99b2fe Fix presence perf regression (#1578)
• 4ab6aed Lint fixes for deprecations, best practices (#1579)
• 73b80a7 Merge pull request #1577 from dmitriplotnikov/fuzzing
• f4595e5 Consolidate OSS-Fuzz and internal fuzz targets in fuzzing package
• da49767 Fix failing BenchmarkCheck cases (#1576)
• 840daca Replay v0.32.0 costs at version 0; fix optional sizing, call floor, and condi...
• e205d7a Restore v0.32.0 cost behavior at ModelVersion(0) (#1573)
• e3e6964 Updates to the 'Length' estimation reasoning (#1570)
• 7aa73b1 Undo failed assignability checks in place (#1575)
• c09f9bf Add a benchmark for checking long conjunctions (#1574)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)