fix vulnerability

Author: jiangpengcheng

.github/workflows/bundle-release.yml

@@ -49,10 +49,10 @@ jobs:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Set up GO 1.25.12
+      - name: Set up GO 1.25.13
         uses: actions/setup-go@v5
         with:
-          go-version: 1.25.12
+          go-version: 1.25.13
         id: go
 
       - name: InstallKubebuilder
@@ -180,10 +180,10 @@ jobs:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Set up GO 1.25.12
+      - name: Set up GO 1.25.13
         uses: actions/setup-go@v5
         with:
-          go-version: 1.25.12
+          go-version: 1.25.13
         id: go
 
       - name: InstallKubebuilder

.github/workflows/olm-verify.yml

@@ -34,10 +34,10 @@ jobs:
       - name: checkout
         uses: actions/checkout@v2
 
-      - name: Set up GO 1.25.12
+      - name: Set up GO 1.25.13
         uses: actions/setup-go@v5
         with:
-          go-version: 1.25.12
+          go-version: 1.25.13
         id: go
 
       - name: InstallKubebuilder

.github/workflows/project.yml

@@ -18,7 +18,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go-version: [1.25.12]
+        go-version: [1.25.13]
     steps:
       - name: Free Disk Space (Ubuntu)
         uses: jlumbroso/free-disk-space@v1.3.0

.github/workflows/release.yml

@@ -40,10 +40,10 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Set up GO 1.25.12
+      - name: Set up GO 1.25.13
         uses: actions/setup-go@v5
         with:
-          go-version: 1.25.12
+          go-version: 1.25.13
         id: go
 
       - name: InstallKubebuilder

.github/workflows/test-helm-charts.yml

@@ -83,11 +83,11 @@ jobs:
         run: hack/kind-cluster-build.sh --name chart-testing -c 1 -v 10 --k8sVersion v1.23.17
         if: steps.list-changed.outputs.changed == 'true'
 
-      - name: Set up GO 1.25.12
+      - name: Set up GO 1.25.13
         if: steps.list-changed.outputs.changed == 'true'
         uses: actions/setup-go@v5
         with:
-          go-version: 1.25.12
+          go-version: 1.25.13
         id: go
 
       - name: setup kubebuilder 3.6.0

.github/workflows/test-integration-skywalking-e2e.yml

@@ -64,10 +64,10 @@ jobs:
       - name: Report disk usage
         run: df -h
 
-      - name: Set up GO 1.25.12
+      - name: Set up GO 1.25.13
         uses: actions/setup-go@v5
         with:
-          go-version: 1.25.12
+          go-version: 1.25.13
 
       - name: Checkout
         uses: actions/checkout@v3

.github/workflows/trivy.yml

@@ -57,10 +57,10 @@ jobs:
           repository: ${{github.event.pull_request.head.repo.full_name}}
           ref: ${{ github.event.pull_request.head.sha }}
 
-      - name: Set up GO 1.25.12
+      - name: Set up GO 1.25.13
         uses: actions/setup-go@v5
         with:
-          go-version: 1.25.12
+          go-version: 1.25.13
         id: go
 
       - name: InstallKubebuilder

.github/workflows/trivy_scheduled_master.yml

@@ -67,10 +67,10 @@ jobs:
           repository: ${{github.event.pull_request.head.repo.full_name}}
           ref: ${{ github.event.pull_request.head.sha }}
 
-      - name: Set up GO 1.25.12
+      - name: Set up GO 1.25.13
         uses: actions/setup-go@v5
         with:
-          go-version: 1.25.12
+          go-version: 1.25.13
         id: go
 
       - name: InstallKubebuilder

Dockerfile

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM --platform=$BUILDPLATFORM golang:1.25.12-trixie AS builder
+FROM --platform=$BUILDPLATFORM golang:1.25.13-trixie AS builder
 
 ARG TARGETOS
 ARG TARGETARCH

go.mod

@@ -12,7 +12,7 @@ require (
 	github.com/streamnative/function-mesh/api v0.29.0
 	github.com/streamnative/pulsarctl v0.6.0
 	github.com/stretchr/testify v1.11.1
-	google.golang.org/protobuf v1.36.10
+	google.golang.org/protobuf v1.36.11
 	gotest.tools v2.2.0+incompatible
 	k8s.io/api v0.32.3
 	k8s.io/apimachinery v0.32.3
@@ -95,17 +95,17 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e // indirect
-	golang.org/x/net v0.55.0 // indirect
-	golang.org/x/oauth2 v0.34.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/term v0.43.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sync v0.21.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/term v0.44.0 // indirect
+	golang.org/x/text v0.39.0 // indirect
 	golang.org/x/time v0.10.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
-	google.golang.org/grpc v1.79.3 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
+	google.golang.org/grpc v1.82.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect