fix(security): remediate CVE vulnerabilities

[ulucinar]

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA	Severity	Package	Fixed Version
CVE-2025-61723	High	stdlib	go1.24.11
CVE-2025-61725	High	stdlib	go1.24.11
CVE-2025-61729	High	stdlib	go1.24.11
CVE-2025-58187	High	stdlib	go1.24.11
CVE-2025-58188	High	stdlib	go1.24.11
CVE-2025-58185	Medium	stdlib	go1.24.11
CVE-2025-47912	Medium	stdlib	go1.24.11
CVE-2025-58186	Medium	stdlib	go1.24.11
CVE-2025-61724	Medium	stdlib	go1.24.11
CVE-2025-58189	Medium	stdlib	go1.24.11
CVE-2025-58183	Medium	stdlib	go1.24.11
CVE-2025-61727	Medium	stdlib	go1.24.11
GHSA-j5w8-q4qc-rx2x	Medium	golang.org/x/crypto	v0.45.0
GHSA-f6x5-jh6r-wrfv	Medium	golang.org/x/crypto	v0.45.0

Changes Made

• Updated Go toolchain from go1.24.4 to go1.24.11 in go.mod
• Updated golang.org/x/crypto from v0.39.0 to v0.45.0 in go.mod
• Ran go mod tidy to update dependencies

References

• CVE-2025-61723
• CVE-2025-61725
• CVE-2025-61729
• CVE-2025-58187
• CVE-2025-58188
• CVE-2025-58185
• CVE-2025-47912
• CVE-2025-58186
• CVE-2025-61724
• CVE-2025-58189
• CVE-2025-58183
• CVE-2025-61727
• GHSA-j5w8-q4qc-rx2x
• GHSA-f6x5-jh6r-wrfv

Verification

• Rescanned with cve-scan skill after fixes
• All listed vulnerabilities resolved

[ulucinar]

Build Failure Analysis

Check: push
Status: Failed
Analyzed: 2026-01-22T09:12:00Z

Summary

The push check failed due to a 404 error when the upbound/action-up@v1 GitHub Action tried to download the up CLI version v0.39.0-384.g0a0c8634 from the CDN.

Root Cause

The upbound/action-up@v1 action is configured to download up CLI version v0.39.0-384.g0a0c8634 from https://cli.upbound.io, but this version is not available at the expected location, resulting in an HTTP 404 Not Found error.

This is a CI infrastructure issue, NOT related to the code changes in this PR. The actual package build and push to xpkg.upbound.io completed successfully before this failure occurred.

Error Details

##[error]Unexpected HTTP response: 404

The error occurs in the upbound/action-up@v1 step with:

• Channel: main
• Version: v0.39.0-384.g0a0c8634
• Endpoint: https://cli.upbound.io

Recommendation

Re-run the failed workflow. This is a transient infrastructure issue. If the problem persists, the workflow configuration may need to be updated to use an available version of the up CLI.

Note: All core build steps succeeded:

• Build (amd64) ✓
• Build (arm64) ✓
• Unit tests ✓
• Lint ✓
• Package push to xpkg.upbound.io ✓

---

_{This analysis was generated by the build-failure-analyze skill.}