fix(security): remediate CVE vulnerabilities

[ulucinar]

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA	Severity	Package	Fixed Version
CVE-2025-61723	High	stdlib	go1.24.11
CVE-2025-61725	High	stdlib	go1.24.11
CVE-2025-61729	High	stdlib	go1.24.11
CVE-2025-58187	High	stdlib	go1.24.11
CVE-2025-58188	High	stdlib	go1.24.11
CVE-2025-58185	Medium	stdlib	go1.24.11
CVE-2025-47912	Medium	stdlib	go1.24.11
CVE-2025-58186	Medium	stdlib	go1.24.11
CVE-2025-61724	Medium	stdlib	go1.24.11
CVE-2025-58189	Medium	stdlib	go1.24.11
CVE-2025-58183	Medium	stdlib	go1.24.11
CVE-2025-61727	Medium	stdlib	go1.24.11
GHSA-j5w8-q4qc-rx2x	Medium	golang.org/x/crypto	v0.45.0
GHSA-f6x5-jh6r-wrfv	Medium	golang.org/x/crypto	v0.45.0

Changes Made

• Updated Go version from 1.24.4 to 1.24.11 in go.mod
• Updated golang.org/x/crypto from v0.41.0 to v0.45.0
• Ran go mod tidy to update go.sum

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-61723
• https://nvd.nist.gov/vuln/detail/CVE-2025-61725
• https://nvd.nist.gov/vuln/detail/CVE-2025-61729
• https://nvd.nist.gov/vuln/detail/CVE-2025-58187
• https://nvd.nist.gov/vuln/detail/CVE-2025-58188
• https://nvd.nist.gov/vuln/detail/CVE-2025-58185
• https://nvd.nist.gov/vuln/detail/CVE-2025-47912
• https://nvd.nist.gov/vuln/detail/CVE-2025-58186
• https://nvd.nist.gov/vuln/detail/CVE-2025-61724
• https://nvd.nist.gov/vuln/detail/CVE-2025-58189
• https://nvd.nist.gov/vuln/detail/CVE-2025-58183
• https://nvd.nist.gov/vuln/detail/CVE-2025-61727
• GHSA-j5w8-q4qc-rx2x
• GHSA-f6x5-jh6r-wrfv

Verification

• Rescanned with cve-scan skill after fixes
• All listed vulnerabilities resolved

[ulucinar]

Build Failure Analysis

Check: build (amd64)
Status: Failed
Analyzed: 2026-01-22T09:08:37Z

Summary

The Docker build failed due to a Go version mismatch. The go.mod file requires Go >= 1.24.11, but the CI workflow is using Go 1.24.4.

Root Cause

The CVE fix PR updated go.mod to require Go 1.24.11 (to fix stdlib CVEs), but the CI workflow file (.github/workflows/ci.yml) still defines GO_VERSION: '1.24.4'. When the Dockerfile runs go mod download, it fails because Go 1.24.4 cannot satisfy the go.mod requirement.

Error Details

go: go.mod requires go >= 1.24.11 (running go 1.24.4; GOTOOLCHAIN=local)

Recommendation

Update the GO_VERSION environment variable in .github/workflows/ci.yml from '1.24.4' to '1.24.11' to match the Go version required by go.mod.

---

_{This analysis was generated by the build-failure-analyze skill.}