Crossplane v2.4.2
security+**!
Crossplane v2.4.2 ships fixes for ServiceAccount ownership when package revisions become active, and a change so that a claim fails closed when it cannot list its XRD. The release also updates the OpenTelemetry OTLP trace exporter module to v1.45.0 to address a security issue in that dependency.
What changes for platform teams
Teams running Crossplane 2.4 get corrected ServiceAccount ownership handover during package revision changes and stricter behavior when XRD listing fails. The security item is a dependency bump, not a fix in Crossplane's own code.
Changes
- Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.45.0 [security] (release-2.4)security
- Fixed a bug where ownership of ServiceAccount s was not correctly transferred to newly active package revisions (#7838). Fixed in #7839 and backported in #7852.added
- Demote old revision controller ownerReference for SAfixed
- Fail closed when a claim cannot list its XRDfixed
1 maintenance lines (dependency bumps, CI, tests, docs)
- Bump crossplane-runtime dependency to v2.4.2maintenance
5 lines1 security1 added2 fixed1 maintenancetyped from the source notes
Full release notes ↗ · all Crossplane releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules