build(deps): bump the production-dependencies group across 1 directory with 5 updates

[dependabot]

Bumps the production-dependencies group with 3 updates in the / directory: cuelang.org/go, github.com/klauspost/compress and golang.org/x/crypto.

Updates cuelang.org/go from 0.16.1 to 0.17.0

Release notes

Sourced from cuelang.org/go's releases.

v0.17.0

Changes which may break some users are marked below with: ⚠️

Language

The active try experiment renames the new fallback keyword, used with for comprehensions, to otherwise. fallback continues to be accepted for now, but is rewritten to the new form.

The active aliasv2 experiment now allows ~(X) as an alternative to ~X for the single postfix alias form. ~X is also rewritten as ~(X) for the sake of consistency and clarity.

Language versions v0.17.0 and later allow omitting commas in multi-line lists. Just like a newline after a struct field implies a comma, a newline after a list element now implies a comma as well.

Language versions v0.17.0 and later allow a newline or a comma before the closing bracket of an index expression, matching how lists and func arguments allow omitting trailing commas.

The language spec is tweaked to make $ a valid identifier, which was already allowed by the parser and evaluator.

⚠️ Support for the infix div, mod, quo, and rem operators has been removed. Since late 2020, these infix forms have been undocumented and rewritten by cue fix to the new function calls.

The new shortcircuit experiment

This release introduces the shortcircuit experiment, which changes the && and || operators to not evaluate the right operand if the left operand alone determines the result.

This matches the behavior already documented in the CUE spec and is consistent with most mainstream languages, but for the sake of a smooth transition for end users, we are rolling out this change via an experiment.

You can try this experiment via the @experiment(shortcircuit) file attribute. To mimic the old behavior with the experiment, you can use a hidden field:

_y: Y
if X && _y {}

Evaluator

Comprehensions

The comprehension algorithm now waits to run a comprehension's body until the fields it reads have a concrete value, rather than trying to produce its fields up front. This resolves a number of long-standing bugs, most notably the last known regressions from evalv2, where a comprehension that should have resolved instead failed as an incomplete value or a cycle.

This design also greatly simplifies upcoming evaluator work, such as introducing new builtins to replace comparing values to bottom, as well as the design of evalv4.

Other changes

The evaluator no longer deduplicates errors just by position, which was causing some useful errors from disjunctions or standard library calls to be dropped incorrectly.

Several long-standing cycle-detection bugs have been fixed, such as self-referential uses of matchN and matchIf, self-feeding disjunctions, and comprehensions that read a let binding which refers back to the comprehension's own fields.

Fixed a bug where the same package imported via different qualified import paths (e.g. foo.com/bar@v0 or foo.com/bar:baz) did not share the same hidden field namespace.

Resolving an unversioned import from a dependency module now respects that module's own default major version, instead of always using the main module's default.

Fix a number of issues where cue def could produce invalid CUE output, such as due to name conflicts.

... (truncated)

Commits

• 0fc639b [release-branch.v0.17] internal/mod: resolve module replacements via minimum-...
• e73658d cue/format: revert #4296 regression test
• c3f08a1 cue/format: revert manual-AST field alignment fix
• 60e1bb7 cue/format: revert issue #1006 test cases
• 3f7aafe cue/format: revert list and call argument column alignment fix
• e2eb7f5 cue/format: revert spurious empty line fix
• 0fa6c09 cue/format: revert Option-behavior test
• 1e07f16 cue/format: revert default tab width change from 8 to 4
• 7190842 cue/format: revert multiline string interpolation indentation fix
• 8d2db9d internal/cueexperiment: teach v0.17 about the formatv2 experiment
• Additional commits viewable in compare view

Updates github.com/klauspost/compress from 1.18.6 to 1.19.0

Release notes

Sourced from github.com/klauspost/compress's releases.

v1.19.0

What's Changed

• zstd: Add true concurrent stream encoding by @​klauspost in klauspost/compress#1136
• zstd: arm64 decoder asm by @​lizthegrey in klauspost/compress#1160
• zstd: avoid unused BuildDict encoder allocation by @​snissn in klauspost/compress#1147
• flate: Add inflate checkpoints by @​klauspost in klauspost/compress#1154
• snappy/s2: Limit length of varint in decodedLen by @​eustas in klauspost/compress#1148
• gzhttp: match qvalue parameter case-insensitively (RFC 7231) by @​z9z in klauspost/compress#1149
• zip: add NameDecoder callback for legacy encoding rewrite by @​SAY-5 in klauspost/compress#1150
• huff0: Allow building tables from histogram. by @​klauspost in klauspost/compress#1155
• huff0: Allow building table from oversized histogram. by @​klauspost in klauspost/compress#1156
• s2sx: Clean symlink targets by @​klauspost in klauspost/compress#1163

New Contributors

• @​snissn made their first contribution in klauspost/compress#1147
• @​eustas made their first contribution in klauspost/compress#1148
• @​z9z made their first contribution in klauspost/compress#1149
• @​SAY-5 made their first contribution in klauspost/compress#1150
• @​HNO3Miracle made their first contribution in klauspost/compress#1165

Full Changelog: klauspost/compress@v1.18.6...v1.19.0

v1.18.7

• Fix s2.NewDict OOB read.

Security release without other changes.

Full Changelog: klauspost/compress@v1.18.6...v1.18.7

Commits

• f0953f9 flate: fix buffer formatting in tests (#1165)
• ab2e3cc zstd: Add arm64 decoder asm (#1160)
• bb2723d Merge commit from fork
• 539243b s2sx: Clean symlink targets (#1163)
• bd9228c Apply go fix and check in CI (#1158)
• 4cc176c zstd: Add true concurrent stream encoding (#1136)
• 4705fcb build(deps): bump the github-actions group with 3 updates (#1157)
• e9c2e56 huff0: Allow building table from oversized histogram. (#1156)
• ecdb779 huff0: Allow building tables from histogram. (#1155)
• 38efa45 zip: add NameDecoder callback for legacy encoding rewrite (#1150)
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.53.0 to 0.54.0

Commits

• cdce021 go.mod: update golang.org/x dependencies
• d9474cc openpgp: make the deprecation message more explicit
• 7626c50 ssh: verify declared key type matches decoded key in authorized_keys
• 0471e79 ssh/agent: enforce strict limits on DSA key parameters
• 6435c37 ssh: sanitize client disconnect messages
• 7d695da ssh/agent: drain channel stderr in agent forwarders
• 5b7f841 acme/autocert: fix data race in Manager.createCert
• 0b316e7 argon2: update RFC 9106 parameter recommendations
• 55aec0a x509roots/fallback: update bundle
• 5f2de1a internal: remove wycheproof tests
• See full diff in compare view

Updates golang.org/x/sync from 0.21.0 to 0.22.0

Commits

• 1eb64d4 semaphore: panic on negative weights
• See full diff in compare view

Updates golang.org/x/text from 0.38.0 to 0.40.0

Commits

• 724af9c go.mod: update golang.org/x dependencies
• bf5b9d6 internal/export/idna: always treat Punycode encoding pure ASCII as an error
• b326f3d go.mod: update golang.org/x dependencies
• 5ae8e57 unicode/norm: avoid infinite loop on invalid input
• 0dc94a2 all: fix some comments
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions