[dependabot]

Bumps cel.dev/cel-go from 0.32.0 to 0.33.2.

Release notes

Sourced from cel.dev/cel-go's releases.

Release v0.33.2

What's Changed

• Changes to the fast-path list and map accessors to ensure graceful degradation for custom adaptors.

Full Changelog: cel-expr/cel-go@v0.33.1...v0.33.2

Release v0.33.1

Cherry-picks for backwards compatibility with legacy timestamp and timezone formats, and support for google.protobuf.Value types as comprehension keys.

What's Changed

• Release v0.33.1 cherry-picks by @​TristonianJones in cel-expr/cel-go#1590

Full Changelog: cel-expr/cel-go@v0.33.0...v0.33.1

Release v0.33.0

This release introduces a high-performance Pratt parser, a unified declarative cost model (common/cost) with aggregate sizing and peak memory tracking, raw pointer traversal for native Go structs, and JSON/YAML parsing extensions, while eliminating quadratic type-checking bottlenecks.

Features

Pull Request	Description and Impact
Pratt parser and EnablePrattParser option (#1427, #1433, #1442, #1462, #1472, #1497, #1509, #1511, #1521)	Introduces a recursive-descent Pratt parser ported from cel-cpp with iterative parenthesis handling, bounded expression nesting, and escaped function name support, delivering 8x–19x faster single-threaded parsing.
Unified cost model (common/cost), AggregateSizingStrategy, and CostModelVersion (#1430, #1435, #1441, #1474, #1478, #1482, #1512, #1519, #1525, #1537, #1548, #1556, #1558)	Unifies static cost estimation and runtime tracking under a declarative cost.OverloadModel AST with container Key/Elem size propagation, aggregate sizing, value-backed ElemOf/KeyOf/ElemTotal/KeyTotal/Length combinators, and versioned compatibility via cel.CostModelVersion.
Runtime peak memory tracking (#1418, #1429)	Adds runtime memory tracking and scaled string/byte sizing options to observe and bound peak allocation footprints during evaluation.
Native raw pointer traversal, generic containers, and type aliasing (#1463, #1498, #1503, #1515)	Accelerates cel.NativeTypes struct field selection and presence checks via unsafe.Pointer offset traversal, adds generic Go slice/map adapters, and supports native type aliasing.
JSON/YAML parsing and encoding & URL-safe Base64 (#1451, #1461, #1492)	Adds json.parse, yaml.parse, and yaml.encode extensions (returning optional_type with 10MB payload safety limits), alongside base64.encodeUrl and base64.decodeUrl in ext.Encoders.
List presence helpers and versioned optional macros (#1447, #1448, #1487)	Introduces hasOnly, hasAny, hasAll, and hasExactly in ext.Lists, optional.hasValue(val) in OptionalTypesVersion(3), and single-evaluation optMap/optFlatMap macros in OptionalTypesVersion(4).
HMAC digest and constant-time equality (#1450)	Extends ext/security/hmac with hmac.digest and linear-time equality comparisons.
Late-bound functions from Activation (#1483)	Enables resolving cel.FunctionVars bindings dynamically from the runtime Activation or cel.Globals.
Type-check error suggestions and cel.Env JSON serialization (#1500, #1554)	Adds edit-distance spellchecking and library enablement hints for undeclared symbols/types, plus JSON/YAML config serialization for cel.Env.
AST structural equivalence and @block call tagging (#1467, #1544)	Provides format-insensitive AST structural comparison in common/ast and tags cel.@block calls in compiled ASTs.
SLSA + Sigstore artifact signing and OSS-Fuzz consolidation (#1426, #1577)	Signs release artifacts with SLSA/Sigstore provenance and consolidates OSS-Fuzz harnesses under fuzzing/.

Fixes

Pull Request	Impact and Technical Details
Undo failed assignability checks in place (#1575)	Replaces full type-mapping clones during overload resolution with an in-place undo log, eliminating O(N^2) type-checking latency and memory growth on long conjunctions (#1553).
Restore v0.32.0 cost behavior at CostModelVersion(0) and v0.29.2 cost limit error (#1571, #1572, #1573)	Restores EvalCancelledError ("operation cancelled: actual cost limit exceeded") when runtime cost limits are exceeded and replays v0.32.0 static/runtime cost rules when pinned to cel.CostModelVersion(0).
Fix unsafe math and saturation in cost estimation and tracking (#1508, #1541)	Adds SafeSubtract, SafeTrunc, and SafeMultiplyByFactorTrunc in common/cost so uint64 and float-scaled costs saturate cleanly at math.MaxUint64 (including NaN) and clamp negative values to 0.
Nil-safe Program evaluation and concurrent cost tracker race fix (#1480, #1484, #1486, #1488)	Makes Eval, ContextEval, and ConcurrentEval nil-safe, eliminates a data race when capturing cost trackers across goroutines, and removes time-based flakiness in interrupt checks.
Constant folding and partial evaluation AST consistency (#1446, #1453, #1517, #1518)	Prunes folded nodes from reference and type maps, checks unknowns before traversing attribute qualifiers, and fixes custom Foldable two-variable iteration.
Native types embedded json:"-" tags and proto.ReflectMessage dereference (#1452, #1551, #1567)	Respects json:"-" skip tags on embedded Go structs, fixes JSON tag conversion in ConvertToNative, and prevents invalid field dereferences over proto.ReflectMessage.
Fix regex counted repetition sizing panic (#1438)	Prevents a panic when estimating compiled regex program sizes for counted repetitions.

Breaking Changes

... (truncated)

Commits

• c8b1865 Changes to the fast-path list and map accessors to ensure that object travers...
• fd8eb23 Release v0.33.1 cherry-picks (#1590)
• f99b2fe Fix presence perf regression (#1578)
• 4ab6aed Lint fixes for deprecations, best practices (#1579)
• 73b80a7 Merge pull request #1577 from dmitriplotnikov/fuzzing
• f4595e5 Consolidate OSS-Fuzz and internal fuzz targets in fuzzing package
• da49767 Fix failing BenchmarkCheck cases (#1576)
• 840daca Replay v0.32.0 costs at version 0; fix optional sizing, call floor, and condi...
• e205d7a Restore v0.32.0 cost behavior at ModelVersion(0) (#1573)
• e3e6964 Updates to the 'Length' estimation reasoning (#1570)
• Additional commits viewable in compare view