On 06/10/2026 16:36, Santiago Vila wrote:
Arthur: While we are at it, would you be willing to upgrade the package to >= 0.29.0 in unstable, while I still keep looking at how to backport the fix to trixie? Thanks.Hi Santiago, Still need help here updating the package in unstable?Actually... yes. After updating the package in my private fork, the package does not build in Salsa CI because of some test failures. So, I've just pushed what I have, with UNRELEASED in the changelog, so that you can continue where I left. (Just wait a little until the pipeline finish and you will see the failures). Thanks a lot.
Hi Santiago, Andrew,I've just uploaded golang-github-google-cel-go 0.30.0+ds-2 to unstable, which fixes CVE-2026-83530 (the fix is included upstream since v0.29.0).
This builds on top of the bump Santiago had left as UNRELEASED, now with the Salsa CI test failures resolved.
On 32-bit (i386), TestListsCosts and the common/types integer boundary tests failed because untyped constants defaulted to a 32-bit int and the list cost estimators used math.MaxUint instead of math.MaxUint64.
I added a patch, adapted from the golang-cel-cel-go package, that pins the test literals to int64.
Regards, Arthur Diniz
OpenPGP_signature.asc
Description: OpenPGP digital signature
