From d566fdfce743bdba5fd6b67a0c4ba315cadac51b Mon Sep 17 00:00:00 2001 From: Alper Rifat Ulucinar Date: Thu, 21 May 2026 22:36:36 +0000 Subject: [PATCH 1/4] fix(security): remediate CVE vulnerabilities - Update Go version to 1.25.10 (fixes CVE-2026-39820, CVE-2026-42499, CVE-2026-39836, CVE-2026-33814, CVE-2026-33811, CVE-2026-42501, CVE-2026-39817, CVE-2026-39826, CVE-2026-39825, CVE-2026-39823, CVE-2026-39819) Signed-off-by: Alper Rifat Ulucinar --- .github/workflows/ci.yml | 2 +- go.mod | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ec39942..aaadf73 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,7 +14,7 @@ on: env: # Common versions - GO_VERSION: '1.25.9' + GO_VERSION: '1.25.10' GOLANGCI_VERSION: 'v2.11.4' DOCKER_BUILDX_VERSION: 'v0.24.0' diff --git a/go.mod b/go.mod index efe7e1b..eeec180 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/upbound/function-claude -go 1.25.9 +go 1.25.10 require ( github.com/alecthomas/kong v0.9.0 From 1af517387cfb726a3315706b9442ab8db0c6164d Mon Sep 17 00:00:00 2001 From: Alper Rifat Ulucinar Date: Thu, 21 May 2026 23:09:10 +0000 Subject: [PATCH 2/4] fix(ci): update Crossplane CLI to stable channel The 'current' version is no longer available on the 'master' channel. Switch to the 'stable' channel with 'stable' version to use the latest stable Crossplane CLI release. Signed-off-by: Alper Rifat Ulucinar --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index aaadf73..a32bb15 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,8 +20,8 @@ env: # These environment variables are important to the Crossplane CLI install.sh # script. They determine what version it installs. - XP_CHANNEL: master # TODO(negz): Pin to stable once v1.14 is released. - XP_VERSION: current # TODO(negz): Pin to a version once v1.14 is released. + XP_CHANNEL: stable + XP_VERSION: stable # This CI job will automatically push new builds to xpkg.upbound.io if the # XPKG_ACCESS_ID and XPKG_TOKEN secrets are set in the GitHub respository (or From 449647b72b2679c37262a2d09a19aac3e70a0c77 Mon Sep 17 00:00:00 2001 From: Alper Rifat Ulucinar Date: Thu, 21 May 2026 23:41:07 +0000 Subject: [PATCH 3/4] fix(ci): remove Crossplane CLI version override Remove XP_CHANNEL and XP_VERSION environment variables to use the install script's default behavior (latest stable version). The explicit version specifications were causing failures due to unavailable version/channel combinations. Signed-off-by: Alper Rifat Ulucinar --- .github/workflows/ci.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a32bb15..ea54fff 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,11 +18,6 @@ env: GOLANGCI_VERSION: 'v2.11.4' DOCKER_BUILDX_VERSION: 'v0.24.0' - # These environment variables are important to the Crossplane CLI install.sh - # script. They determine what version it installs. - XP_CHANNEL: stable - XP_VERSION: stable - # This CI job will automatically push new builds to xpkg.upbound.io if the # XPKG_ACCESS_ID and XPKG_TOKEN secrets are set in the GitHub respository (or # organization) settings. Create a token at https://accounts.upbound.io. From ec1e4b47a49bdd13f154f484f92d1a03ba70e8a2 Mon Sep 17 00:00:00 2001 From: Alper Rifat Ulucinar Date: Fri, 22 May 2026 11:35:16 +0300 Subject: [PATCH 4/4] Update Crossplane install channel to the stable channel - Pin Crossplane CLI version to v2.3.0. Signed-off-by: Alper Rifat Ulucinar --- .github/workflows/ci.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ea54fff..e7e518d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,6 +18,11 @@ env: GOLANGCI_VERSION: 'v2.11.4' DOCKER_BUILDX_VERSION: 'v0.24.0' + # These environment variables are important to the Crossplane CLI install.sh + # script. They determine what version it installs. + XP_CHANNEL: stable + XP_VERSION: v2.3.0 + # This CI job will automatically push new builds to xpkg.upbound.io if the # XPKG_ACCESS_ID and XPKG_TOKEN secrets are set in the GitHub respository (or # organization) settings. Create a token at https://accounts.upbound.io.