chore(deps): update module github.com/google/cel-go to v0.32.0

[red-hat-konflux-kflux-prd-rh02]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/google/cel-go	v0.31.0 → v0.32.0

---

Release Notes

google/cel-go (github.com/google/cel-go)

v0.32.0

Compare Source

Summary of Changes

This release of cel-go (v0.32.0) introduces significant library expansions alongside a major infrastructure migration. Key highlights include the addition of native support for JWT and HMAC operations, Go-based JSON handling via NativeToValue, and robust timestamp parsing helpers.

Critical Upgrade: This release changes the module and import paths to cel.dev/cel-go. Users must update their import statements when upgrading to this version.

A variety of concurrency and stability fixes are also included, such as addressing nil pointer panics during native object traversals, and fixing cost observability when combined with state tracking or exhaustive eval

Breaking Changes

Change	PR Link
Switch module and import paths to cel.dev/cel-go	#​1413

Features

Feature	PR Link
JWT data types with Parse and claim helpers	#​1415
HMAC verify / compute library	#​1416
NativeToValue Go-based JSON type support	#​1402
Parsing helper for working with different types and formats of timestamp	#​1414
Support aggregate size computations over list, maps, and structs	#​1404
Aggregate semantics in Policy Compiler	#​1408
Report every evaluation step to every observer	#​1419
Enable list_ext conformance tests	#​1412

Fixes & Performance Improvements

Change / Optimization	PR Link
mem-track: Fix data race for aggregate size computation	#​1423
Fix panic in native object traversal with nil valued struct pointers	#​1417
Fix shorthand type specifier parsing to allow newlines and tab chars	#​1411
Fix agent_tool_execution_governance policy example to match cel-policy conformance test	#​1424
Scale sizes for strings and bytes	#​1421
Consolidate saturating cost arithmetic into common/cost	#​1420
Add parser benchmarks	#​1422

---

Full Changelog: v0.31.0...v0.32.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[red-hat-konflux-kflux-prd-rh02]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: github.com/google/cel-go@v0.32.0: parsing go.mod:
	module declares its path as: cel.dev/cel-go
	        but was required as: github.com/google/cel-go

[ambient-code]

Automated PR Check Summary

1. go.mod sub-project audit

There is only one go.mod in this repository (no Go sub-modules). No additional go.mod updates needed.

2. CI Failures — Breaking Module Path Change

All CI checks are failing. The root cause is NOT a vendor sync issue per se — it is a breaking upstream change:

cel-go v0.32.0 migrated its module path from github.com/google/cel-go to cel.dev/cel-go (cel-go PR #1413).

The CI errors confirm this:

go: inconsistent vendoring:
  github.com/google/cel-go@v0.32.0: is explicitly required in go.mod,
    but not marked as explicit in vendor/modules.txt
  github.com/google/cel-go@v0.31.0: is marked as explicit in vendor/modules.txt,
    but not explicitly required in go.mod

This PR only bumps the version string in go.mod but:

1. Does not run go mod vendor to sync the vendor directory
2. More critically, the v0.32.0 module no longer lives at github.com/google/cel-go — it lives at cel.dev/cel-go. The go module system cannot simply swap these.
3. Our transitive dependency k8s.io/apiserver@v0.35.7 (and all k8s vendored code) imports via github.com/google/cel-go — those vendored files cannot be changed without also bumping the entire k8s stack.

3. k8s version analysis

This PR does NOT bump k8s versions directly. However, adopting cel.dev/cel-go (v0.32.0+) would require coordinating with a k8s upgrade since k8s.io/apiserver v0.35.x still imports from github.com/google/cel-go.

Recommendation: Close this PR

This update is not safe to apply in its current form. The renovate bot has incorrectly assumed a simple patch bump; this is a major breaking change requiring:

• Waiting for k8s.io packages to migrate to cel.dev/cel-go import paths
• Or keeping github.com/google/cel-go pinned at v0.31.0 (the last release on the old module path) until the ecosystem catches up

No fix commit is being added — the correct action is to close/skip this update until the k8s ecosystem adopts the new cel.dev/cel-go module path.