fix(security): remediate CVE vulnerabilities

[upbound-bot]

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA	Severity	Package	Fixed Version
CVE-2025-68121	Critical	stdlib	go1.24.13
CVE-2025-61726	High	stdlib	go1.24.13
CVE-2025-61731	High	stdlib	go1.24.13
CVE-2025-61732	High	stdlib	go1.24.13
CVE-2025-61728	Medium	stdlib	go1.24.13
CVE-2025-61730	Medium	stdlib	go1.24.13

Changes Made

• Update Go version from 1.24.11 to 1.24.13 in go.mod

References

• CVE-2025-68121
• CVE-2025-61726
• CVE-2025-61731
• CVE-2025-61732
• CVE-2025-61728
• CVE-2025-61730

Verification

• Rescanned with cve-scan skill after fixes
• All listed vulnerabilities resolved

[upbound-bot]

Build Failure Analysis

Check: build (amd64)
Status: Failed
Analyzed: 2026-02-26T22:58:00Z

Summary

The Docker build step failed because the CI workflow is using Go 1.24.11 while go.mod now requires Go 1.24.13.

Root Cause

The CI workflow (.github/workflows/ci.yml) defines GO_VERSION: '1.24.11' on line 17. This version is passed as a build argument to Docker during the "Build Runtime" step. However, the go.mod file was updated to require Go 1.24.13 as part of CVE remediation.

When Docker runs go mod download, it fails with:

go: go.mod requires go >= 1.24.13 (running go 1.24.11; GOTOOLCHAIN=local)

Error Details

#15 [base 4/4] RUN --mount=type=cache,target=/go/pkg/mod go mod download
#15 0.057 go: go.mod requires go >= 1.24.13 (running go 1.24.11; GOTOOLCHAIN=local)
#15 ERROR: process "/bin/sh -c go mod download" did not complete successfully: exit code: 1

Recommendation

Update the GO_VERSION environment variable in .github/workflows/ci.yml from '1.24.11' to '1.24.13' to match the Go version required by go.mod. This is a CI configuration fix, not a code issue. Do not downgrade go.mod - the Go version was updated for CVE remediation.

---

_{This analysis was generated by the build-failure-analyze skill.}