Crossplane v2.1.5

Changes

• !Update module github.com/cloudflare/circl to v1.6.3 [security] (release-2.1)security
• !Update module google.golang.org/grpc to v1.79.3 [security] (release-2.1)security
• !Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [security] (release-2.1)security
• !Update module github.com/go-jose/go-jose/v4 to v4.1.4 [security] (release-2.1)security
• !Bump Go to 1.25.9 [security] (release-2.1)security
• !Update module github.com/go-git/go-git/v5 to v5.17.1 [security] (release-2.1)security
• !Update module github.com/moby/spdystream to v0.5.1 [security] (release-2.1)security
• !Update module github.com/sigstore/timestamp-authority/v2 to v2.0.6 [security] (release-2.1)security
• !Update module github.com/docker/cli to v29.2.0+incompatible [security] (release-2.1)security
• !Update module github.com/go-git/go-git/v5 to v5.18.0 [security] (release-2.1)security
• +Dependency upgrades work correctly with ImageConfig prefix rewriting: Packages installed via an ImageConfig prefix rewrite were previously not being upgraded when their dependencies changed, leaving users stuck on stale versions of dependent packages. Dependency upgrades now behave as expected when prefix rewrites are in use. Backported in #7279, originally fixed in #7233.added
• +Composition functions can now select all resources of a given kind: When a composition function returned a Requirements.ResourceSelector with only apiVersion and kind set (no matchName or matchLabels), Crossplane previously rejected this as an invalid request. A selector with no match field is now correctly interpreted as "all resources of that kind". Backported in #7246, originally fixed in #7241.added