[dependabot]

Bumps github.com/zclconf/go-cty from 1.19.0 to 1.20.0.

Changelog

Sourced from github.com/zclconf/go-cty's changelog.

1.20.0

This release introduces a new concept called provenance marks, which is a subcategory of marks that get more conservative treatment in how they are propagated through operations involving unknown values.

Alongside that, it's now possible for an unknown value to track both direct marks (as before) and an approximation of what marks could be nested inside a final known value in the same position. This means that for unknown values it's now possible for Value.UnmarkDeep to return a larger set of marks than Value.Unmark, just as for known collection and structural values. This is an approximation, though: it tracks only that a certain mark could potentially appear anywhere within the final object, not a specific path where it will appear. This is just enough complexity to preserve the presence of nested provenance marks, at the expense of being more conservative in how marks might propagate in subsequent operations.

The development of the functionality related to provenance marks was sponsored by Spacelift on behalf of the OpenTofu Project, which is intending to make more extensive use of marks to track dependencies by dynamic analysis instead of by simply searching for syntactic references to other objects. That mechanism relies on the assumption that an operation involving unknown values will produce an unknown result that has the superset of all possible dependency marks that could appear on a subsequent re-run of the same operation with known operands, which is what the more conservative treatment of provenance marks is intended to achieve.

Other smaller changes in this release:

• The new cty.Value.GetAttrByValue is like cty.Value.GetAttr except that it takes the attribute name as cty.Value instead of string, and can therefore implement a reasonable reaction to the attribute name being unknown for calling applications that support dynamically-chosen attribute names.
• numeric refinement now correctly rejects combinations of exclusive bounds with equal values that effectively exclude the entire range of number values. (#228)
• cty.Object, cty.ObjectVal, and cty.MapVal now all require the caller to ensure that no two attribute names or keys normalize to the same cty string, whereas before they all just nondeterministically selected any one of the conflicting attribute types. (#225)
• stdlib: SignumFunc now works with any number cty can represent, whereas before it was unnecessarily limited only to numbers that could be converted to Go's int type. (#218)
• json: Unmarshal no longer panics when a JSON array being decoded into a tuple type has too few elements. (#230)

Commits

• 84874ac Prepare for v1.20.0 release
• 10d8b1a cty: Deal with some more nested-marks-related cases
• 18f27de cty: Discard refinements that turn out to be useless
• 067b731 cty: Detect and reject conflicting attribute/key names
• 9a1f940 cty: numeric refinement now correctly rejects invalid exclusive bounds
• 0ea9692 json: Don't panic when there aren't enough tuple elements
• f3c1f4b CHANGELOG entry for provenance marks and nested marks in unknown vals
• e2a5974 Provenance marks, unknown values with nested marks, etc
• 3f9ace7 Documentation for "Provenance Marks"
• 1658b7a cty: MarkWithPaths only applies provenance marks inside unknown values
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.