fix(security): remediate CVE vulnerabilities

[upbound-bot]

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA	Severity	Package	Fixed Version
CVE-2026-25679	High	stdlib	go1.25.8
CVE-2026-27142	High	stdlib	go1.25.8
CVE-2026-27139	Low	stdlib	go1.25.8

Changes Made

• Updated Go version from 1.24.13 to 1.25.8 in go.mod
• Updated GO_VERSION in .github/workflows/ci.yml to 1.25.8
• Updated GOLANGCI_VERSION from v1.64.8 to v2.1.6 for Go 1.25 compatibility
• Added .golangci.yml with v2 format configuration

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-25679
• https://nvd.nist.gov/vuln/detail/CVE-2026-27142
• https://nvd.nist.gov/vuln/detail/CVE-2026-27139

Verification

• Rescanned with cve-scan skill after fixes
• All listed vulnerabilities resolved

[upbound-bot]

Build Failure Analysis

Check: lint
Status: Failed
Analyzed: 2026-03-16T19:40:00Z

Summary

The lint check failed because golangci-lint-action v6 does not support golangci-lint v2.x.

Root Cause

The CI workflow is using golangci/golangci-lint-action@v6 but specifying GOLANGCI_VERSION: 'v2.1.6'. The golangci-lint-action v6 only supports golangci-lint v1.x versions. To use golangci-lint v2.x, the workflow must be updated to use golangci/golangci-lint-action@v7.

Error Details

##[error]Failed to run: Error: invalid version string 'v2.1.6', golangci-lint v2 is not supported by golangci-lint-action v6, you must update to golangci-lint-action v7.

Recommendation

Update .github/workflows/ci.yml to use golangci/golangci-lint-action@v7 instead of @v6. This is required for compatibility with golangci-lint v2.x.

---

_{This analysis was generated by the build-failure-analyze skill.}

[upbound-bot]

Build Failure Analysis

Check: lint
Status: Failed
Analyzed: 2026-03-16T19:52:00Z

Summary

The lint check failed because golangci-lint v2.1.6 was built with Go 1.24, but the project targets Go 1.25.8.

Root Cause

golangci-lint requires the linter binary to be built with a Go version equal to or greater than the target Go version specified in go.mod. The golangci-lint v2.1.6 binary was compiled with Go 1.24, but go.mod specifies go 1.25.8.

Error Details

Error: can't load config: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.25.8)

Recommendation

Update GOLANGCI_VERSION in .github/workflows/ci.yml from v2.1.6 to v2.2.0 (or later), which is built with Go 1.25+.

---

_{This analysis was generated by the build-failure-analyze skill.}

[upbound-bot]

Build Failure Analysis

Check: lint
Status: Failed
Analyzed: 2026-03-16T20:14:29Z

Summary

The lint check failed because golangci-lint v2.2.0 was built with Go 1.24, but the project targets Go 1.25.8.

Root Cause

golangci-lint requires the linter binary to be built with a Go version equal to or greater than the target Go version specified in go.mod. Go 1.25 support was added in golangci-lint v2.4.0, so v2.2.0 (built with Go 1.24) cannot lint Go 1.25.x projects.

Error Details

Error: can't load config: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.25.8)

Recommendation

Update GOLANGCI_VERSION in .github/workflows/ci.yml from v2.2.0 to v2.11.3 (current stable), which is built with Go 1.25+.

---

_{This analysis was generated by the build-failure-analyze skill.}

[upbound-bot]

Build Failure Analysis

Check: lint
Status: Failed
Analyzed: 2026-03-16T20:26:30Z

Summary

The lint check found 3 staticcheck QF1008 warnings in claimconditions.go.

Root Cause

golangci-lint v2.11.3 with stricter staticcheck rules detected that embedded struct fields are being accessed with redundant selector prefixes. The TargetedCondition struct embeds xpv1.Condition, so its fields can be accessed directly without the .Condition prefix.

Error Details

claimconditions.go:46:21: QF1008: could remove embedded field "Condition" from selector
claimconditions.go:47:21: QF1008: could remove embedded field "Condition" from selector
claimconditions.go:51:12: QF1008: could remove embedded field "Condition" from selector

Recommendation

Simplify embedded field access in transformCondition function:

• tc.Condition.Type → tc.Type
• tc.Condition.Reason → tc.Reason
• tc.Condition.Status → tc.Status

---

_{This analysis was generated by the build-failure-analyze skill.}

[ulucinar]

Thank you @bobh66.