FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

fix(security): remediate CVE vulnerabilities by upbound-bot · Pull Request #47 · upbound/function-claude · GitHub

/ function-claude Public

fix(security): remediate CVE vulnerabilities - #47

Merged
ulucinar merged 4 commits into
release-0.4from
fix/cve-remediation-release-0.4-20260521-223627
May 22, 2026
ConversationCommits (4)ChecksFiles changed
Merged

fix(security): remediate CVE vulnerabilities#47
ulucinar merged 4 commits into
release-0.4from
fix/cve-remediation-release-0.4-20260521-223627

Conversation

upbound-bot commented May 21, 2026

Copy link
Copy Markdown

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA Severity Package Fixed Version
CVE-2026-39820 High stdlib go1.25.10
CVE-2026-42499 High stdlib go1.25.10
CVE-2026-39836 High stdlib go1.25.10
CVE-2026-33814 High stdlib go1.25.10
CVE-2026-33811 High stdlib go1.25.10
CVE-2026-42501 High stdlib go1.25.10
CVE-2026-39817 Medium stdlib go1.25.10
CVE-2026-39826 Medium stdlib go1.25.10
CVE-2026-39825 Medium stdlib go1.25.10
CVE-2026-39823 Medium stdlib go1.25.10
CVE-2026-39819 Medium stdlib go1.25.10

Changes Made

  • Updated go directive in go.mod from 1.25.9 to 1.25.10
  • Ran go mod tidy to update dependencies
  • Updated GO_VERSION in .github/workflows/ci.yml to 1.25.10

References

Verification

  • Rescanned with cve-scan skill after fixes
  • All listed vulnerabilities resolved

fix(security): remediate CVE vulnerabilities
d566fdf 
- Update Go version to 1.25.10 (fixes CVE-2026-39820, CVE-2026-42499,
  CVE-2026-39836, CVE-2026-33814, CVE-2026-33811, CVE-2026-42501,
  CVE-2026-39817, CVE-2026-39826, CVE-2026-39825, CVE-2026-39823,
  CVE-2026-39819)

Signed-off-by: Alper Rifat Ulucinar <ulucinar@users.noreply.github.com>

upbound-bot commented May 21, 2026

Copy link
Copy Markdown
Author

Build Failure Analysis

Check: build (arm64)
Status: Failed
Analyzed: 2026-05-21T22:40:00Z

Summary

The Crossplane CLI installation failed because version "current" is not available on the "master" channel.

Root Cause

The CI workflow is configured to download the Crossplane CLI using:

  • XP_CHANNEL: master
  • XP_VERSION: current

This version combination is no longer available. The Crossplane project has likely moved to a different versioning scheme or the master channel no longer publishes a "current" version.

Error Details

Failed to download Crossplane CLI. Please make sure version current exists on channel master.
##[error]Process completed with exit code 1.

Recommendation

Update .github/workflows/ci.yml to use the stable channel instead:

XP_CHANNEL: stable
XP_VERSION: stable

This will download the latest stable Crossplane CLI release. A remediation plan has been generated to apply this fix.

This analysis was generated by the build-failure-analyze skill.

fix(ci): update Crossplane CLI to stable channel
1af5173 
The 'current' version is no longer available on the 'master' channel.
Switch to the 'stable' channel with 'stable' version to use the latest
stable Crossplane CLI release.

Signed-off-by: Alper Rifat Ulucinar <ulucinar@users.noreply.github.com>

upbound-bot commented May 21, 2026

Copy link
Copy Markdown
Author

Build Failure Analysis

Check: build (amd64)
Status: Failed
Analyzed: 2026-05-21T23:15:00Z

Summary

The Crossplane CLI installation failed because the version "stable" is not valid on the "stable" channel.

Root Cause

The previous fix attempted to use:

  • XP_CHANNEL: stable
  • XP_VERSION: stable

However, this is also an invalid combination. The "stable" channel does not have a version called "stable". When using the stable channel, XP_VERSION needs to be either:

  1. A specific version number (e.g., "v1.18.2")
  2. Omitted entirely to use the default (latest stable)

The install script does not recognize "stable" as a valid version string.

Error Details

Failed to download Crossplane CLI. Please make sure version stable exists on channel stable.
##[error]Process completed with exit code 1.

Recommendation

Remove the XP_CHANNEL and XP_VERSION environment variables entirely from the CI workflow. The install script will default to the latest stable version when these are not set, which is the desired behavior.

A remediation plan has been generated to apply this fix.

This analysis was generated by the build-failure-analyze skill.

ulucinar added 2 commits May 21, 2026 23:41
fix(ci): remove Crossplane CLI version override
449647b 
Remove XP_CHANNEL and XP_VERSION environment variables to use the
install script's default behavior (latest stable version). The
explicit version specifications were causing failures due to
unavailable version/channel combinations.

Signed-off-by: Alper Rifat Ulucinar <ulucinar@users.noreply.github.com>
Update Crossplane install channel to the stable channel
ec1e4b4 
- Pin Crossplane CLI version to v2.3.0.

Signed-off-by: Alper Rifat Ulucinar <ulucinar@users.noreply.github.com>
sergenyalcin approved these changes May 22, 2026
View reviewed changes

sergenyalcin left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Thanks @ulucinar LGTM!

ulucinar merged commit 15a3047 into release-0.4 May 22, 2026
5 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

sergenyalcin sergenyalcin approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

Back | FazBrowse Home | New Git URL