fix(security): remediate CVE vulnerabilities (#200)

* fix(security): remediate CVE vulnerabilities

- Update Go version to 1.25.10 (fixes CVE-2026-39820, CVE-2026-42499,
  CVE-2026-39836, CVE-2026-33814, CVE-2026-33811, CVE-2026-42501,
  CVE-2026-39817, CVE-2026-39826, CVE-2026-39825, CVE-2026-39823,
  CVE-2026-39819)
- Update GO_VERSION in CI workflow to match

Signed-off-by: Alper Rifat Ulucinar <ulucinar@users.noreply.github.com>

* fix(ci): update Crossplane CLI to stable channel

The 'current' version is no longer available on the 'master' channel.
Update to use the 'stable' channel with 'stable' version to get the
latest stable Crossplane CLI release.

Signed-off-by: Alper Rifat Ulucinar <ulucinar@users.noreply.github.com>

* fix(ci): use empty XP_VERSION for latest stable

The value 'stable' is not a valid version. Use an empty string to get
the latest version from the stable channel.

Signed-off-by: Alper Rifat Ulucinar <ulucinar@users.noreply.github.com>

---------

Signed-off-by: Alper Rifat Ulucinar <ulucinar@users.noreply.github.com>

Author: ulucinar

.github/workflows/ci.yml

@@ -14,14 +14,14 @@ on:
 
 env:
   # Common versions
-  GO_VERSION: '1.25.9'
+  GO_VERSION: '1.25.10'
   GOLANGCI_VERSION: 'v2.11.3'
   DOCKER_BUILDX_VERSION: 'v0.23.0'
 
   # These environment variables are important to the Crossplane CLI install.sh
   # script. They determine what version it installs.
-  XP_CHANNEL: master   # TODO(negz): Pin to stable once v1.14 is released.
-  XP_VERSION: current  # TODO(negz): Pin to a version once v1.14 is released.
+  XP_CHANNEL: stable
+  XP_VERSION: ''
 
   # This CI job will automatically push new builds to xpkg.upbound.io if the
   # XPKG_ACCESS_ID and XPKG_TOKEN secrets are set in the GitHub respository (or

go.mod

@@ -1,6 +1,6 @@
 module github.com/crossplane/function-auto-ready
 
-go 1.25.9
+go 1.25.10
 
 require (
 	github.com/alecthomas/kong v1.12.0