chore: bump github.com/zclconf/go-cty from 1.16.3 to 1.19.0

[dependabot]

Bumps github.com/zclconf/go-cty from 1.16.3 to 1.19.0.

Release notes

Sourced from github.com/zclconf/go-cty's releases.

v1.17.0

cty now requires Go 1.23 or later.

• cty.Value.Elements offers a modern iter.Seq2-based equivalent of cty.Value.ElementIterator.

• cty.DeepValues offers a modern iter.Seq2-based equivalent of cty.Walk.

• cty.Value.WrangleMarksDeep allows inspecting and modifying individual marks throughout a possibly-nested data structure.

  Having now got some experience using marks more extensively in some callers, it's become clear that it's often necessary for different subsystems to be able to collaborate using independent marks without upsetting each other's assumptions. Today that tends to be achieved using hand-written transforms either with cty.Transform or cty.Value.UnmarkDeepWithPaths/cty.Value.MarkWithPaths, both of which can be pretty expensive even in the common case where there are no marks present at all.

  This new function allows inspecting and transforming marks with far less overhead, by creating new values only for parts of a structure that actually need to change and by reusing (rather than recreating) the "payloads" of the values being modified when we know that only the marks have changed.

• cty.ValueMarksOfType and cty.ValueMarksOfTypeDeep make it easier to use type-based rather than value-based mark schemes, where different values of a common type are used to track a specific kind of relationship with multiple external values.

• cty.Value.HasMarkDeep provides a "deep" version of the existing cty.Value.HasMark, searching throughout a possibly-nested structure for any values that have the given mark.

• cty.Value.UnmarkDeep and cty.Value.UnmarkDeepWithPaths are now implemented in terms of cty.Value.WrangleMarksDeep, so they benefit from its reduced overhead. In particular they avoid reconstructing a data structure that contains no marked values at all.

• cty.Value.MarkWithPaths now has a fast path when it's given a zero-length PathValueMarks, in which case it just returns the value it was given with no modifications.

Changelog

Sourced from github.com/zclconf/go-cty's changelog.

1.19.0 (July 6, 2026)

• When building with Go 1.27 or later, the various string operations that are defined in terms of UAX#29 grapheme cluster segmentation will now use the Unicode 17 character properties and rules. For older versions of Go, Unicode 15 is still used.
• The cty.ValueMarks type, which represents a set of value marks separately from any value, now has method Has for concisely testing if a specific mark is present, and Insert for inserting elements from an iter.Seq[any] into an existing set of marks for easier gradual construction without creating any temporary mark sets.

1.18.1 (April 16, 2026)

• stdlib: ContainsFunc now allows its second argument to be null, to test whether the given collection contains any null elements.
• stdlib: MergeFunc no longer panics if all of its arguments are null values of the same object type with at least one attribute.

1.18.0 (February 23, 2026)

cty now requires Go 1.25 or later.

• cty.Value.Equals now has a special case where if a null value is compared with a non-null value then only top-level marks from the non-null value will transfer to the boolean result.

  This is a limited introduction of the idea that only the parts of a nested data structure that were actually relevant to the comparison should transfer to the result. The more general form of that idea might follow in a later release, but that would require some more severe refactoring of this method's implementation that would be far riskier and so this is a pragmatic compromise to support just the relatively-common case of comparing with null in callers like HCL where an equality test is the canonical way to test a value for "null-ness".

• cty.IndexStep.Apply now works for traversing through a set.

  Although cty.Value.Index does not allow looking up a set element due to set elements not having indices, we often use cty.Path to describe a specific location in a nested structure and have a convention of handling traversal through a set as a cty.IndexStep whose "key" is the set element's value.

  To make that work a little better with code that uses cty.Path.Apply on such paths, cty.IndexStep now has a special case where if the given value is a set then it checks whether the index step's key is a member of the set and returns that value if so. If unknown values mean that it's not decidable whether there is a matching element then the result is an unknown value of the set's element type, so that traversal can continue and presumably eventually return an unknown value of the appropriate leaf type.

1.17.0 (September 5, 2025)

cty now requires Go 1.23 or later.

• cty.Value.Elements offers a modern iter.Seq2-based equivalent of cty.Value.ElementIterator.

• cty.DeepValues offers a modern iter.Seq2-based equivalent of cty.Walk.

• cty.Value.WrangleMarksDeep allows inspecting and modifying individual marks throughout a possibly-nested data structure.

  Having now got some experience using marks more extensively in some callers, it's become clear that it's often necessary for different subsystems to be able to collaborate using independent marks without upsetting each other's assumptions. Today that tends to be achieved using hand-written transforms either with cty.Transform or cty.Value.UnmarkDeepWithPaths/cty.Value.MarkWithPaths, both of which can be pretty expensive even in the common case where there are no marks present at all.

  This new function allows inspecting and transforming marks with far less overhead, by creating new values only for parts of a structure that actually need to change and by reusing (rather than recreating) the "payloads" of the values being modified when we know that only the marks have changed.

• cty.ValueMarksOfType and cty.ValueMarksOfTypeDeep make it easier to use type-based rather than value-based mark schemes, where different values of a common type are used to track a specific kind of relationship with multiple external values.

• cty.Value.HasMarkDeep provides a "deep" version of the existing cty.Value.HasMark, searching throughout a possibly-nested structure for any values that have the given mark.

• cty.Value.UnmarkDeep and cty.Value.UnmarkDeepWithPaths are now implemented in terms of cty.Value.WrangleMarksDeep, so they benefit from its reduced overhead. In particular they avoid reconstructing a data structure that contains no marked values at all.

• cty.Value.MarkWithPaths now has a fast path when it's given a zero-length PathValueMarks, in which case it just returns the value it was given with no modifications.

1.16.4 (August 20, 2025)

• cty.UnknownAsNull now accepts marked values and preserves the given marks in its result. Previously it had no direct support for marks and so would either panic or return incorrect results when given marked values.

Commits

• 749fb01 v1.19.0
• f6d59fa ValueMarks.Has and ValueMarks.Insert
• db1a410 Use Unicode 17 text segmentation rules on Go 1.27
• c8df667 json: Compensate for different JSON error message in Go1.27
• 9d8f06e convert: Fix incorrect format string in TestSortTypes
• dcb5db6 v1.18.1
• 77d87c2 stdlib: no MergeFunc crash with null values of object type
• 6854da9 stdlib: ContainsFunc allows testing for presence of null value
• ddb73de Begin development of v1.18.1
• e0c742b v1.18.0 release
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​zclconf/​go-cty@​v1.16.3 ⏵ v1.19.0	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: golang github.com/apparentlymart/go-textseg/v17 is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → golang/github.com/zclconf/go-cty@v1.19.0 → golang/github.com/apparentlymart/go-textseg/v17@v17.0.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/apparentlymart/go-textseg/v17@v17.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report