fix(security): remediate CVE vulnerabilities

[upbound-bot]

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA	Severity	Package	Fixed Version
CVE-2025-68121	Critical	stdlib	go1.24.13
CVE-2025-61726	High	stdlib	go1.24.13
CVE-2025-61731	High	stdlib	go1.24.13
CVE-2025-61732	High	stdlib	go1.24.13
CVE-2025-61728	Medium	stdlib	go1.24.13
CVE-2025-61730	Medium	stdlib	go1.24.13

Changes Made

• Updated Go version from 1.24.11 to 1.24.13 in go.mod

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-68121
• https://nvd.nist.gov/vuln/detail/CVE-2025-61726
• https://nvd.nist.gov/vuln/detail/CVE-2025-61731
• https://nvd.nist.gov/vuln/detail/CVE-2025-61732
• https://nvd.nist.gov/vuln/detail/CVE-2025-61728
• https://nvd.nist.gov/vuln/detail/CVE-2025-61730

Verification

• Rescanned with cve-scan skill after fixes
• All listed vulnerabilities resolved

[upbound-bot]

Build Failure Analysis

Check: build (amd64)
Status: Failed
Analyzed: 2026-02-26T20:00:00Z

Summary

The Docker build failed during go mod download because the Go version in the CI workflow (1.24.11) is older than what go.mod requires (1.24.13).

Root Cause

The go.mod file specifies go 1.24.13 as the minimum required Go version. However, the CI workflow (.github/workflows/ci.yaml) is configured with GO_VERSION: 1.24.11. When Docker runs the build with --build-arg GO_VERSION=1.24.11, the go mod download command fails because the Go toolchain version is insufficient.

The container environment has GOTOOLCHAIN=local set, which prevents automatic toolchain downloading and enforces strict version checking.

Error Details

go: go.mod requires go >= 1.24.13 (running go 1.24.11; GOTOOLCHAIN=local)
ERROR: process "/bin/sh -c go mod download" did not complete successfully: exit code: 1

Recommendation

Update the GO_VERSION environment variable in .github/workflows/ci.yaml from 1.24.11 to 1.24.13 to match the Go version requirement in go.mod. This is a CI configuration issue, not a code issue.

---

_{This analysis was generated by the build-failure-analyze skill.}