verticadb-operator/25.4.0.0-r1: cve remediation

verticadb-operator.yaml

@@ -1,7 +1,7 @@
 package:
   name: verticadb-operator
   version: "25.4.0.0"
-  epoch: 1
+  epoch: 2 # GHSA-cfpf-hrx2-8rv6
   description: Simple, fast container image builder for Go applications.
   copyright:
     - license: Apache-2.0
@@ -25,6 +25,12 @@ pipeline:
       repository: https://github.com/vertica/vertica-kubernetes
       tag: v${{vars.mangled-package-version}}
 
+  - uses: go/bump
+    with:
+      deps: |-
+        github.com/expr-lang/[email protected]
+      go-version: 1.24
+
   - name: Setup go modroot
     runs: |
       make manifests generate fmt vet
@@ -36,13 +42,6 @@ pipeline:
       cp -r pkg workspace-verticadb-operator/
       cp -r local-libs workspace-verticadb-operator/
 
-  - uses: go/bump
-    with:
-      deps: |-
-        github.com/expr-lang/[email protected]
-      modroot: workspace-verticadb-operator
-      go-version: 1.24
-
   - uses: go/build
     with:
       modroot: workspace-verticadb-operator/