fix(security): remediate CVE vulnerabilities

[ulucinar]

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA	Severity	Package	Fixed Version
GHSA-mh2q-q3fh-2475	High	go.opentelemetry.io/otel	v1.41.0

Changes Made

• Updated go.opentelemetry.io/otel from v1.39.0 to v1.41.0 in go.mod
• Updated go.opentelemetry.io/otel/trace from v1.39.0 to v1.41.0 in go.mod
• Ran go mod tidy to update dependencies

References

• GHSA-mh2q-q3fh-2475

Verification

• Rescanned with cve-scan skill after fixes
• All listed vulnerabilities resolved

[ulucinar]

Build Failure Analysis

Check: build (arm64)
Status: Failed
Analyzed: 2026-05-07T10:30:00Z

Summary

The build (arm64) check failed because the Crossplane CLI installation script could not download the requested version.

Root Cause

The workflow is configured to download Crossplane CLI with:

• XP_CHANNEL: master
• XP_VERSION: current

However, the "current" version identifier is not available on the "master" channel. The install script failed with: "Failed to download Crossplane CLI. Please make sure version current exists on channel master."

Error Details

Failed to download Crossplane CLI. Please make sure version current exists on channel master.
##[error]Process completed with exit code 1.

Recommendation

Fix required: Update .github/workflows/ci.yml to use XP_CHANNEL: stable instead of master. The stable channel supports the current version identifier. See the remediation plan for detailed steps.

---

_{This analysis was generated by the build-failure-analyze skill.}