fix(security): remediate CVE vulnerabilities

[upbound-bot]

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA	Severity	Package	Fixed Version
CVE-2026-39820	High	stdlib	go1.25.10
CVE-2026-42499	High	stdlib	go1.25.10
CVE-2026-39836	High	stdlib	go1.25.10
CVE-2026-33814	High	stdlib	go1.25.10
CVE-2026-33811	High	stdlib	go1.25.10
CVE-2026-42501	High	stdlib	go1.25.10
CVE-2026-39817	Medium	stdlib	go1.25.10
CVE-2026-39826	Medium	stdlib	go1.25.10
CVE-2026-39825	Medium	stdlib	go1.25.10
CVE-2026-39823	Medium	stdlib	go1.25.10
CVE-2026-39819	Medium	stdlib	go1.25.10

Changes Made

• Updated go directive in go.mod from 1.25.9 to 1.25.10
• Ran go mod tidy to update dependencies
• Updated GO_VERSION in .github/workflows/ci.yml to 1.25.10

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-39820
• https://nvd.nist.gov/vuln/detail/CVE-2026-42499
• https://nvd.nist.gov/vuln/detail/CVE-2026-39836
• https://nvd.nist.gov/vuln/detail/CVE-2026-33814
• https://nvd.nist.gov/vuln/detail/CVE-2026-33811
• https://nvd.nist.gov/vuln/detail/CVE-2026-42501
• https://nvd.nist.gov/vuln/detail/CVE-2026-39817
• https://nvd.nist.gov/vuln/detail/CVE-2026-39826
• https://nvd.nist.gov/vuln/detail/CVE-2026-39825
• https://nvd.nist.gov/vuln/detail/CVE-2026-39823
• https://nvd.nist.gov/vuln/detail/CVE-2026-39819

Verification

• Rescanned with cve-scan skill after fixes
• All listed vulnerabilities resolved

[upbound-bot]

Build Failure Analysis

Check: build (arm64)
Status: Failed
Analyzed: 2026-05-21T22:40:00Z

Summary

The Crossplane CLI installation failed because version "current" is not available on the "master" channel.

Root Cause

The CI workflow is configured to download the Crossplane CLI using:

• XP_CHANNEL: master
• XP_VERSION: current

This version combination is no longer available. The Crossplane project has likely moved to a different versioning scheme or the master channel no longer publishes a "current" version.

Error Details

Failed to download Crossplane CLI. Please make sure version current exists on channel master.
##[error]Process completed with exit code 1.

Recommendation

Update .github/workflows/ci.yml to use the stable channel instead:

XP_CHANNEL: stable
XP_VERSION: stable

This will download the latest stable Crossplane CLI release. A remediation plan has been generated to apply this fix.

---

_{This analysis was generated by the build-failure-analyze skill.}

[upbound-bot]

Build Failure Analysis

Check: build (amd64)
Status: Failed
Analyzed: 2026-05-21T23:15:00Z

Summary

The Crossplane CLI installation failed because the version "stable" is not valid on the "stable" channel.

Root Cause

The previous fix attempted to use:

• XP_CHANNEL: stable
• XP_VERSION: stable

However, this is also an invalid combination. The "stable" channel does not have a version called "stable". When using the stable channel, XP_VERSION needs to be either:

1. A specific version number (e.g., "v1.18.2")
2. Omitted entirely to use the default (latest stable)

The install script does not recognize "stable" as a valid version string.

Error Details

Failed to download Crossplane CLI. Please make sure version stable exists on channel stable.
##[error]Process completed with exit code 1.

Recommendation

Remove the XP_CHANNEL and XP_VERSION environment variables entirely from the CI workflow. The install script will default to the latest stable version when these are not set, which is the desired behavior.

A remediation plan has been generated to apply this fix.

---

_{This analysis was generated by the build-failure-analyze skill.}

[sergenyalcin]

Thanks @ulucinar LGTM!