v1.20.14 is a patch release scoped to fixing security related issues in Crossplane's dependencies. 🎉 Highlights Distrust of compromised eMudhra intermediate CAs: Bumps the Go toolchain to 1.26.10 (#7956), whose crypto/x509 rejects the compromised eMudhra intermediate certificates (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots they chain to from the im…
v2.2.7 is a patch release scoped to fixing issues reported by users of Crossplane v2.2 and fixing security related issues in Crossplane and its dependencies. 🎉 Highlights Distrust of compromised eMudhra intermediate CAs: Bumps the Go toolchain to 1.26.10, whose crypto/x509 rejects the compromised eMudhra intermediate certificates (CVE-2026-111943), and removes the AAA Certificate Services and emSi…
v2.3.7 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane and its dependencies. 🎉 Highlights Distrust of compromised eMudhra intermediate CAs: Bumps the Go toolchain to 1.26.10, whose crypto/x509 rejects the compromised eMudhra intermediate certificates (CVE-2026-111943), and removes the AAA Certificate Services and emSi…
v2.4.3 is a patch release scoped to fixing issues reported by users of Crossplane v2.4 and fixing security related issues in Crossplane and its dependencies. 🎉 Highlights Distrust of compromised eMudhra intermediate CAs: Bumps the Go toolchain to 1.26.10, whose crypto/x509 rejects the compromised eMudhra intermediate certificates (CVE-2026-111943), and removes the AAA Certificate Services and emSi…
Release v2.3.7
Release v2.4.3
v2.4.2 is a patch release scoped to fixing issues reported by users of Crossplane v2.4 and fixing security related issues in Crossplane and its dependencies. 🎉 Highlights Fixed a bug where ownership of ServiceAccounts was not correctly transferred to newly active package revisions (#7838). Fixed in #7839 and backported in #7852. What's Changed [Backport release-2.4] fix: demote old revision contro…
Release v2.4.2
v2.4.1 is a patch release scoped to fixing issues reported by users of Crossplane v2.4 and fixing security related issues in Crossplane and its dependencies. 🎉 Highlights Package revisions now take control of established objects from the revision they replace: An outgoing package revision could fail to relinquish control of the package's CRDs, leaving the incoming revision permanently unhealthy wi…
v2.3.6 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane and its dependencies. 🎉 Highlights Package revisions now take control of established objects from the revision they replace: An outgoing package revision could fail to relinquish control of the package's CRDs, leaving the incoming revision permanently unhealthy wi…
v2.2.6 is a patch release scoped to fixing issues reported by users of Crossplane v2.2 and fixing security related issues in Crossplane and its dependencies. 🎉 Highlights Package revisions now take control of established objects from the revision they replace: An outgoing package revision could fail to relinquish control of the package's CRDs, leaving the incoming revision permanently unhealthy wi…
v1.20.13 is a patch release scoped to fixing security related issues in Crossplane's dependencies. 🎉 Highlights Dependency security updates: Bumps the Go toolchain to 1.26.7 (#7816) and google.golang.org/grpc to v1.83.2 (#7823), plus a combined set of vulnerable dependency updates (#7797), to pick up upstream CVE fixes — including the gRPC advisory GHSA-2v4p-qf9q-27wj. What's Changed [Backport rel…
Release v2.3.6
Release v2.4.1
v1.20.12 is a patch release scoped to fixing issues reported by users of Crossplane v1.20 and fixing security related issues in Crossplane's dependencies. 🎉 Highlights Dependency security updates: Bumps the Go toolchain to 1.25.13 (#7755), go-git (#7722), and golang.org/x/mod (#7740), plus two combined sets of vulnerable dependency updates (#7646, #7675), to pick up upstream CVE fixes. crossplane-…
v2.2.5 is a patch release scoped to fixing issues reported by users of Crossplane v2.2 and fixing security related issues in Crossplane's dependencies. 🎉 Highlights Correct crank checksums for amd64 binaries (#7665, originally #7660): The published .sha256 files for linux_amd64 binaries had not matched the binaries themselves since v2.2.0, so any install script or Dockerfile that verified the amd6…
v2.3.5 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane's dependencies. 🎉 Highlights Correct crank checksums for amd64 binaries (#7666, originally #7660): The published .sha256 files for linux_amd64 binaries had not matched the binaries themselves since v2.2.0, so any install script or Dockerfile that verified the amd6…
Release v2.3.5
The v2.4.0 release is a regular quarterly Crossplane release that is focused on maturing a number of key areas of functionality across the project, as Crossplane continues to become more capable, more reliable, and more performant for your production workloads. This release includes the ability to watch required resources and reconcile XRs immediately when they change, scale to zero for safe-start…
Release v2.4.0
❗ Important Crossplane version v2.4.0-rc.1 is a release candidate intended to collect input from the community and offer users an opportunity to experiment with Crossplane in non-production environments before the official release of version v2.4.0. WarningThis is a pre-release; do not use it in production environments! To install Crossplane with this release: helm repo add crossplane-stable https…
Release candidate v2.4.0-rc.1
Release candidate v2.5.0-rc.0
Release candidate v2.5.0-rc.0
v2.3.4 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane and its dependencies. 🎉 Highlights Fixed repeated owner updates for composed Usages (#7597, originally #7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Compo…
v2.2.4 is a patch release scoped to fixing issues reported by users of Crossplane v2.2 and fixing security related issues in Crossplane and its dependencies. 🎉 Highlights Fixed repeated owner updates for composed Usages (#7596, originally #7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Compo…
v2.1.8 is a patch release scoped to fixing issues reported by users of Crossplane v2.1 and fixing security related issues in Crossplane's dependencies. 🎉 Highlights Fixed repeated owner updates for composed Usages (#7622, originally #7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Composition…
v1.20.11 is a patch release scoped to fixing issues reported by users of Crossplane v1.20 and fixing security related issues in Crossplane's dependencies. 🎉 Highlights Fixed repeated owner updates for composed Usages (#7623, originally #7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Composit…
Release v2.3.4
v2.3.3 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane's dependencies. 🎉 Highlights Fixed package signature verification TOCTOU (GHSA-mf7q-r4rv-jv94): A time-of-check-to-time-of-use flaw could let a malicious OCI registry pass signature verification with a signed image and then serve unsigned content for installation.…