Crossplane 2.4.1
security+*!!!!
Crossplane v2.4.1 updates the Go toolchain to 1.26.7, google.golang.org/grpc to v1.83.2, and golang.org/x/crypto to v0.56.0 to pick up upstream CVE fixes, including the gRPC advisory GHSA-2v4p-qf9q-27wj. It also bumps the Crossplane apis module to v2.4.0. The release changes how package revisions take control of established objects, so an incoming revision can take over CRDs from the revision it replaces.
What changes for platform teams
Platform teams upgrading to v2.4.1 get the dependency CVE fixes without changes to their own configuration. Package upgrades that previously could leave a new provider unhealthy with a cannot establish control of object error should now hand off automatically, without deleting the stale revision or editing CRD owner references by hand.
Changes
- Dependency security updates: Bumps the Go toolchain to 1.26.7 (#7803), google.golang.org/grpc to v1.83.2 (#7800, #7826), and golang.org/x/crypto to v0.56.0 (#7810) to pick up upstream CVE fixes — including the gRPC advisory GHSA-2v4p-qf9q-27wj. Also bumps github.com/crossplane/crossplane/apis/v2 to v2.4.0 (#7780) and refreshes the lock file (#7779).security
- Update module google.golang.org/grpc to v1.83.1 [security] (release-2.4)security
- Update module golang.org/x/crypto to v0.56.0 [security] (release-2.4)security
- Update module google.golang.org/grpc to v1.83.2 [security] (release-2.4)security
- Package revisions now take control of established objects from the revision they replace: An outgoing package revision could fail to relinquish control of the package's CRDs, leaving the incoming revision permanently unhealthy with cannot establish control of object. The provider's pod would never be created, so that provider could do no work without manual intervention by someone either deleting the stale revision or editing the CRD's owner reference by hand. Package revisions now directly take control from the revision they replace, so the hand-off succeeds without any intervention. Backported in #7821, originally fixed in #7733.added
- Take control of established objects from replaced revisionsfixed
3 maintenance lines (dependency bumps, CI, tests, docs)
- Lock file maintenance (release-2.4)maintenance
- Update module github.com/crossplane/crossplane/apis/v2 to v2.4.0 (release-2.4)maintenance
- Bump go to 1.26maintenance
Full release notes ↗ · all Crossplane releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules