Upgrade to cel-rust 0.14.5, refresh dependencies, bump CI actions (#42)

## Why

cel-rust 0.14.4/0.14.5 change behaviour the wrapper has to follow, and the Python and Actions dependencies had drifted.

## Upstream behaviour now reflected

- **Reserved CEL words are rejected as identifiers** (`var`, `let`, `if`, ...). Spec-correct, but user-visible: `var == "x"` is now a parse-time `ValueError` even if the context defines `var`. Tests that used `var` are renamed; a parametrised test pins all 17 words. Called out first in the CHANGELOG.
- **`type()` is native** and returns a first-class type value, so `type(1u) == uint` and `type(null) == null_type` work inside expressions. Upstream converts a type value to its name when returning it, so Python receives `"int"`. The string-returning `type()` and identity `dyn()` shims are removed from `cel.stdlib` (built-ins already shadowed them). Visible differences: `uint` reports `"uint"` not `"int"`, `null` reports `"null_type"`.
- **`int()`/`uint()` reject out-of-range conversions.** Mapped to `OverflowError`, matching the existing arithmetic overflow mapping.
- Pinned: negative hex literals, stacked unary operators, bytes-literal escape rules, optional equality by content.

## Dependencies

- cel 0.14.3 → 0.14.5 (minimum now 0.14.5) plus in-range transitive bumps. 83 crates checked against OSV: no advisories.
- `tool.uv.dev-dependencies` → `dependency-groups.dev` (deprecation warning); `uv.lock` refreshed (ruff 0.16.6 stays inside the 0.16 pin).
- Actions: checkout v7, setup-python v7, upload-artifact v7, download-artifact v8 (digest mismatch now fails the job), setup-uv v10 (cache disabled on fork PRs and Dependabot rollups).

## Verification

`cargo fmt --check`, `cargo clippy -D warnings`, `cargo test`, pytest (510 passed, 1 skipped, 5 xfailed; was 482/6 xfailed), ruff format/check, mypy, `ty` probe, and the executed doc snippets all pass locally.

Author: hardbyte

.github/workflows/ci.yml

@@ -26,10 +26,10 @@ jobs:
       matrix:
         python-version: ["3.11", "3.12", "3.13", "3.14"]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@v10.0.1
         with:
           version: "latest"
 
@@ -56,10 +56,10 @@ jobs:
     name: Code Quality & Type Checking
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@v10.0.1
         with:
           version: "latest"
 
@@ -119,8 +119,8 @@ jobs:
           - runner: ubuntu-latest
             target: ppc64le
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.11'
       - name: Build wheels
@@ -131,7 +131,7 @@ jobs:
           sccache: 'true'
           manylinux: auto
       - name: Upload wheels
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-linux-${{ matrix.platform.target }}
           path: dist
@@ -147,8 +147,8 @@ jobs:
           - runner: windows-latest
             target: x86
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.11'
           architecture: ${{ matrix.platform.target }}
@@ -159,7 +159,7 @@ jobs:
           args: --release --out dist --find-interpreter
           sccache: 'true'
       - name: Upload wheels
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-windows-${{ matrix.platform.target }}
           path: dist
@@ -175,8 +175,8 @@ jobs:
           - runner: macos-14
             target: aarch64
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.11'
       - name: Build wheels
@@ -186,7 +186,7 @@ jobs:
           args: --release --out dist --find-interpreter
           sccache: 'true'
       - name: Upload wheels
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-macos-${{ matrix.platform.target }}
           path: dist
@@ -195,14 +195,14 @@ jobs:
     runs-on: ubuntu-latest
     needs: [test, lint]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Build sdist
         uses: PyO3/maturin-action@v1
         with:
           command: sdist
           args: --out dist
       - name: Upload sdist
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-sdist
           path: dist
@@ -222,10 +222,10 @@ jobs:
       # contents: write lets the last step create the GitHub release for the tag.
       contents: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Collect wheels and sdist
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v8
         with:
           pattern: wheels-*
           merge-multiple: true

.github/workflows/claude.yml

@@ -25,7 +25,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 

.github/workflows/security.yml

@@ -23,15 +23,15 @@ jobs:
       issues: write
       checks: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Run Rust security audit
         uses: rustsec/audit-check@v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@v10.0.1
         with:
           version: "latest"
 
@@ -56,7 +56,7 @@ jobs:
       security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3

CHANGELOG.md

@@ -7,6 +7,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- **CEL reserved words are now rejected as identifiers.** cel-rust 0.14.4 enforces the
+  specification's reserved word list (`as`, `break`, `const`, `continue`, `else`, `for`,
+  `function`, `if`, `import`, `let`, `loop`, `package`, `namespace`, `return`, `var`,
+  `void`, `while`), so an expression such as `var == "x"` now raises `ValueError` at
+  parse time even if the context defines `var`. Names that merely contain a reserved
+  word (`var_2`) and map keys (`{"var": 1}["var"]`) are unaffected. Rename such
+  variables before upgrading.
+- `type()` is now provided natively by cel-rust 0.14.5 and returns a first-class CEL
+  type value, so `type(x) == int`, `type(1u) == uint` and `type(null) == null_type`
+  work inside expressions. Returned to Python, a type value arrives as its name. The
+  string-returning `type()` shim and the identity `dyn()` shim have been removed from
+  `cel.stdlib`'s `core` library because the native functions take precedence anyway;
+  the only visible differences are that `uint` is now reported as `"uint"` rather than
+  `"int"` and `null` as `"null_type"` rather than `"null"`.
+- `int()` and `uint()` reject conversions that do not fit the target type (for example
+  `int(9223372036854775808u)`, `uint(-1)`, `int(1e300)` and `int(double("NaN"))`),
+  raising `OverflowError` instead of silently wrapping or saturating.
+- `duration` and `timestamp` values report their spec type names from `type()`:
+  `google.protobuf.Duration` and `google.protobuf.Timestamp`.
+
+### Fixed
+
+- Negative hexadecimal literals (`-0x10`) parse; stacked unary operators (`--1`,
+  `!!true`) cancel; `\u` escapes inside bytes literals are rejected per the spec;
+  and `optional.of(1) == optional.of(1)` compares by content (all from cel-rust
+  0.14.4/0.14.5).
+
+### Updated
+
+- cel-rust 0.14.3 to 0.14.5 (the minimum is now 0.14.5), plus in-range transitive
+  bumps (log 0.4.34, uuid 1.26.0, smallvec 1.16.0, cc 1.4.5, syn 3.0.5).
+- Python dev dependencies moved from the deprecated `tool.uv.dev-dependencies` to
+  `dependency-groups.dev`; `uv.lock` refreshed (ruff 0.16.6, typer 0.27.2,
+  maturin 1.15.0).
+- GitHub Actions: `actions/checkout` v7, `actions/setup-python` v7,
+  `actions/upload-artifact` v7, `actions/download-artifact` v8 (digest mismatches
+  now fail the job), `astral-sh/setup-uv` v10 (cache disabled on pull requests
+  from forks and on Dependabot rollups, to guard against cache poisoning).
 ### Updated
 
 - Releases publish to PyPI with

Cargo.lock

@@ -10,7 +10,7 @@ crate-type = ["cdylib"]
 
 [dependencies]
 pyo3 = { version = "0.29", features = ["chrono", "py-clone"]}
-cel = { version = "0.14.0", features = ["chrono", "json", "regex", "bytes"] }
+cel = { version = "0.14.5", features = ["chrono", "json", "regex", "bytes"] }
 log = "0.4.27"
 pyo3-log = "0.13.4"
 chrono = { version = "0.4.42", features = ["serde"] }

Cargo.toml

@@ -6,7 +6,7 @@
 
 **Fast, Safe, and Expressive evaluation of Google's Common Expression Language (CEL) in Python, powered by Rust.**
 
-The Common Expression Language (CEL) is a non-Turing complete language designed for simplicity, speed, and safety. This Python package wraps the Rust implementation [cel](https://crates.io/crates/cel) v0.14.0, providing microsecond-level expression evaluation with seamless Python integration.
+The Common Expression Language (CEL) is a non-Turing complete language designed for simplicity, speed, and safety. This Python package wraps the Rust implementation [cel](https://crates.io/crates/cel) v0.14.5, providing microsecond-level expression evaluation with seamless Python integration.
 
 ## 🚀 Use Cases
 

README.md

@@ -158,7 +158,6 @@ def test_lower_ascii_expected_behavior(self):
 | Category | Status | Impact |
 |----------|--------|---------|
 | **String Functions** (`lowerAscii`, `upperAscii`, `indexOf`, etc.) | 8 functions monitored | Medium - String processing |
-| **Type Introspection** (`type()` function) | Ready to detect | Medium - Dynamic typing |
 | **Mixed Arithmetic** (`int + uint` operations) | Comprehensive detection | Medium - Type safety |
 | **Optional Values** (`optional.of()`, `?.` chaining) | Future feature detection | Low - Advanced use cases |
 | **🚨 OR Operator** (CEL spec compliance) | **Critical behavioral difference** | **High - Logic errors** |