deps(go): bump github.com/google/cel-go from 0.30.0 to 0.31.0

[dependabot]

Bumps github.com/google/cel-go from 0.30.0 to 0.31.0.

Release notes

Sourced from github.com/google/cel-go's releases.

Release v0.31.0

This release introduces critical performance breakthroughs, simplifies integration with native Go structures, and hardens the safety limits of evaluated expressions.

Features

Pull Request	Description and Impact
Env copy on write (#1405)	Introduces Copy-on-Write (COW) mechanics for environment definitions, dramatically slashing CPU and memory allocation overhead when building child or extended environments.
Optimize NativeToValue call paths (#1400)	Optimizes reflection-heavy conversion paths, significantly improving evaluation speeds when feeding native Go types directly to the runtime engine.
Support self-describing, self-adapting struct types (#1395)	Simplifies struct integration by enabling native Go struct types to self-describe and adapt directly to the CEL type system without verbose boilerplate.
Move native type support into the Core CEL library (#1396)	Moves native Go type mapping utilities directly into the Core CEL package to unify dependency structure and improve native API access.
Regex program plan size controls (#1383)	Introduces critical compiled size constraints on regex expressions to mitigate CPU/memory exhaustion vectors during evaluation.
Simplify support for native object types (#1393)	Streamlines setup workflows for mapping standard Go structures inside the CEL compiler environment.
Tag automation for go submodules (#1401)	Automates the submodule tagging process to streamline multi-module releases.

Fixes

Pull Request	Impact and Technical Details
Respect composed adapter for unregistered structs (#1384)	Corrects behavior so that unregistered Go structs properly fall back to composed adapter configurations.
reject out-of-range hours in timezone offset parsing (#1391)	Tightens datetime validation by rejecting invalid out-of-range hour offsets during timezone parsing.
Fix the expression limit node test (#1390)	Restores stability to environment node test suites verifying size-limit assertions.
Correct documented default max value for lists.range (#1392)	Resolves documentation drift regarding the default maximum limit for the lists.range function.

Breaking Changes

There are no breaking changes, but all ext.NativeTypes features are now available via cel.NativeTypes

Notes on Performance

This release targets two primary computational bottlenecks in high-throughput CEL environments: environment construction and reflection-based type coercion.

Expected Impact

1. Dynamic Environment Extension: Applications that dynamically extend a base CEL environment per request (e.g., policy validation engines or API gateways adding request-scoped variables) will see near-zero initialization costs. The Copy-on-Write (COW) optimization prevents copying underlying maps of variables, functions, and adapters.
2. Type Coercion Speed: Bypassing heavy reflection paths during NativeToValue conversions significantly cuts down CPU cycle usage and drastically reduces garbage collection overhead in processing hot paths.
3. AST Pruning: Consolidating sequential list concatenations (#1406) and optimizing optional macros (#1387) ensures that generated program plans are leaner, reducing both compilation and execution memory footprints.

Go-lang Benchmark Citation (benchstat)

The performance improvements can be verified running the repository's native benchmark harness with benchstat:

name old time/op new time/op delta
BenchmarkEnvExtension/10_vars 3.56µs ± 1% 0.15µs ± 0% -95.79% (p=0.000 n=10+10)
BenchmarkNativeToValue/struct 120ns ± 2% 42ns ± 1% -65.00% (p=0.000 n=10+10)
BenchmarkOptionalMapEvaluation 245ns ± 1% 195ns ± 1% -20.41% (p=0.000 n=10+10)

name old allocs/op new allocs/op delta
BenchmarkEnvExtension/10_vars 32.0 ± 0% 1.0 ± 0% -96.88% (p=0.000 n=10+10)
BenchmarkNativeToValue/struct 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10)

... (truncated)

Commits

• 2cf1626 Env copy on write (#1405)
• b74d303 Fold list concat expressions together (#1406)
• 9d5baaf Program plan optimizations (#1399)
• 1a53cb7 Release Tag Automation for go submodules (#1401)
• f10a2e6 Optimize NativeToValue call paths (#1400)
• ab72257 Move native type support into the Core CEL library (#1396)
• ba6c27e Support self-describing, self-adapting struct types (#1395)
• 7c1df6b reject out-of-range hours in timezone offset parsing (#1391)
• c15365a Simplify support for native object types (#1393)
• 8c1485e Correct documented default max value for range (#1392)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Routine minor dependency bump with no local code changes and no claimed breaking API changes. CEL remains on the filter evaluation path, but this is a version-only update.

Overview
Bumps github.com/google/cel-go from 0.30.0 to 0.31.0 (Dependabot).

No application code changes. The library is used by internal/filter to compile and evaluate CEL predicates for search/issues APIs. Upstream notes performance improvements (env copy-on-write, NativeToValue), regex plan size limits, and no breaking API changes.

^{Reviewed by Cursor Bugbot for commit 8968870. Bugbot is set up for automated code reviews on this repo. Configure here.}

[nadaverell]

Superseded by #1460, which combines this bump with the other soaked Dependabot PRs.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.