Crossplane v1.20.11
security+*!!!!
Changes
- Dependency security updates: Bumps the Go toolchain to 1.25.12 (#7578), grpc / golang.org/x/net / golang.org/x/text (#7621), github.com/sigstore/rekor (#7553), and the alpine base image to v3.24 (#7513) to pick up upstream CVE fixes. See ## What's Changed for the full list.security
- Update module github.com/sigstore/rekor to v1.5.2 [security] (release-1.20)security
- Bump Go to 1.25.12 [security] [release-1.20]security
- Combined security bumps (grpc, x/net, x/text) (release-1.20)security
- Fixed repeated owner updates for composed Usages (#7623, originally #7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so spec.by ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.added
- Avoid repeated owner updates for composed Usagesfixed
1 maintenance lines (dependency bumps, CI, tests, docs)
- Update alpine docker tag to v3.24 (release-1.20)maintenance
7 lines4 security1 added1 fixed1 maintenancetyped from the source notes