Crossplane v1.20.13
security!!!
Crossplane v1.20.13 was released with four changes, three of them security-related. The security content is dependency updates: the Go toolchain is bumped to 1.26.7, google.golang.org/grpc is updated to v1.83.2, and a set of vulnerable dependencies is updated, including the gRPC advisory GHSA-2v4p-qf9q-27wj.
What changes for platform teams
Platform teams running Crossplane 1.20 should plan to pick up this patch release, since it carries upstream CVE fixes. The changes are dependency and toolchain updates with no vulnerability in Crossplane's own code described in the source.
Changes
- Dependency security updates: Bumps the Go toolchain to 1.26.7 (#7816) and google.golang.org/grpc to v1.83.2 (#7823), plus a combined set of vulnerable dependency updates (#7797), to pick up upstream CVE fixes — including the gRPC advisory GHSA-2v4p-qf9q-27wj.security
- Update vulnerable dependencies [security] (release-1.20)security
- Update module google.golang.org/grpc to v1.83.2 [security] (release-1.20)security
1 maintenance lines (dependency bumps, CI, tests, docs)
- Bump go to 1.26maintenance
4 lines3 security1 maintenancetyped from the source notes
Full release notes ↗ · all Crossplane releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules