fix(security): remediate CVE vulnerabilities

[upbound-bot]

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA	Severity	Package	Fixed Version
CVE-2025-61723	High	stdlib	go1.24.11
CVE-2025-61725	High	stdlib	go1.24.11
CVE-2025-58188	High	stdlib	go1.24.11
CVE-2025-61729	High	stdlib	go1.24.11
CVE-2025-58187	High	stdlib	go1.24.11
CVE-2025-58185	Medium	stdlib	go1.24.11
CVE-2025-47912	Medium	stdlib	go1.24.11
CVE-2025-58186	Medium	stdlib	go1.24.11
CVE-2025-61724	Medium	stdlib	go1.24.11
CVE-2025-58189	Medium	stdlib	go1.24.11
CVE-2025-58183	Medium	stdlib	go1.24.11
CVE-2025-61727	Medium	stdlib	go1.24.11
GHSA-j5w8-q4qc-rx2x	Medium	golang.org/x/crypto	v0.45.0
GHSA-f6x5-jh6r-wrfv	Medium	golang.org/x/crypto	v0.45.0

Changes Made

• Updated go directive in go.mod from 1.24 to 1.24.11
• Updated golang.org/x/crypto from v0.39.0 to v0.45.0
• Ran go mod tidy to update dependencies

References

• CVE-2025-61723
• CVE-2025-61725
• CVE-2025-58188
• CVE-2025-61729
• CVE-2025-58187
• CVE-2025-58185
• CVE-2025-47912
• CVE-2025-58186
• CVE-2025-61724
• CVE-2025-58189
• CVE-2025-58183
• CVE-2025-61727
• GHSA-j5w8-q4qc-rx2x
• GHSA-f6x5-jh6r-wrfv

Verification

• Rescanned with cve-scan skill after fixes
• All listed vulnerabilities resolved

[upbound-bot]

Build Failure Analysis

Check: build (amd64)
Status: Failed
Analyzed: 2026-01-22T20:15:00Z

Summary

The Docker build failed because the Go version in CI (1.24.4) is lower than what go.mod requires (1.24.11).

Root Cause

The CVE remediation updated go.mod to require Go 1.24.11 to fix security vulnerabilities. However, the CI workflow (.github/workflows/ci.yml) is still configured with GO_VERSION: '1.24.4'. When Docker builds the image using Go 1.24.4, it fails because go.mod requires a higher version.

Error Details

go: go.mod requires go >= 1.24.11 (running go 1.24.4; GOTOOLCHAIN=local)

Recommendation

Update GO_VERSION in .github/workflows/ci.yml from '1.24.4' to '1.24.11' to match the go.mod requirement. This is a required fix - retry will not help.

---

_{This analysis was generated by the build-failure-analyze skill.}

[upbound-bot]

Build Failure Analysis

Check: push
Status: Failed
Analyzed: 2026-01-22T17:30:00Z

Summary

The push check failed with HTTP 404 when trying to install the up CLI version v0.39.0-384.g0a0c8634.

Root Cause

The workflow file .github/workflows/ci.yml specifies a commit-based pseudo-version v0.39.0-384.g0a0c8634 for the up CLI. This version is not available at the download endpoint, resulting in a 404 error.

Error Details

##[error]Unexpected HTTP response: 404

The error occurred during the "Install up" step at line 188-193 of the workflow file.

Recommendation

A fix is needed. Update the workflow to use the stable channel instead of specifying an unavailable commit-based version. Remove the version parameter and change channel from main to stable.

---

_{This analysis was generated by the build-failure-analyze skill.}

[upbound-bot]

Build Failure Analysis

Check: push
Status: Failed
Analyzed: 2026-01-22T18:05:00Z

Summary

The composition tests failed because the OpenAI agent did not complete within the allowed maximum iterations.

Root Cause

The push check failed during up test run tests/*. The OpenAI function's composition test invokes the OpenAI API through the "make-gpt-do-it" pipeline step. The agent did not reach a final answer within the iteration limit, causing the test to fail.

This is an external API behavior issue - the OpenAI API response pattern did not lead to completion within the max iterations threshold. This is unrelated to the CVE fix changes in this PR.

Error Details

cannot render composite resource: cannot run pipeline step "make-gpt-do-it": rpc error: code = Unknown desc = agent not finished before max iterations
up: error: unable to execute composition tests: cannot render composite resource: cannot run pipeline step "make-gpt-do-it": rpc error: code = Unknown desc = agent not finished before max iterations

Recommendation

This failure requires human review. The composition test depends on OpenAI API behavior which is outside the scope of CVE remediation. Options:

1. Retry the workflow - the OpenAI API may succeed on subsequent attempts
2. Skip or adjust the composition test for the CVE fix PR
3. Investigate if the test needs updated iteration limits or prompts

---

_{This analysis was generated by the build-failure-analyze skill.}