Crossplane v2.4.3
security++++*!!!!!
Crossplane v2.4.3 updates the Go toolchain to 1.26.10, which rejects certificates from compromised eMudhra intermediate CAs (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image CA bundle. The release also bundles dependency security updates and fixes a bug where a failed, partial package download could be cached as a valid package. Users with crossplane-edit or crossplane-admin access can now kubectl scale XRs and claims whose XRD serves the scale subresource.
What changes for platform teams
Platform teams running Crossplane should upgrade to pick up the Go toolchain and dependency CVE fixes and the discarded-truncated-download fix, which could otherwise leave providers in a crash loop. Teams relying on the scale subresource need to note that edit and admin roles can now scale XRs and claims.
Changes
- Distrust of compromised eMudhra intermediate CAs: Bumps the Go toolchain to 1.26.10, whose crypto/x509 rejects the compromised eMudhra intermediate certificates (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots they chain to from the image's CA bundle (#7957).security
- Dependency security updates: A combined set of vulnerable dependency updates (#7915) to pick up upstream CVE fixes. Also refreshes the lock file (#7894, #7909).security
- Update vulnerable dependencies [security] (release-2.4)security
- [release-2.4] build(deps): bump Go to 1.26.9 [security]security
- [release-2.4] build(deps): bump Go to 1.26.10 and distrust compromised eMudhra roots [security]security
- Truncated package downloads are no longer cached: A package download that failed partway could be cached as a valid but truncated package.yaml. The package revision then recorded only some of its objects, reported Healthy=True, and the provider's RBAC was rendered from the short list, so the provider could crash-loop. Truncated downloads are now discarded. Fixed via crossplane-runtime v2.4.3 (#7961), originally crossplane/crossplane-runtime#1189.added
- Usage no longer rewrites the in-use label on every reconcile: A leftover ownership check meant the used resource was updated on every reconcile of every Usage/ClusterUsage, causing needless API writes. Backported in #7877, originally fixed in #7860.added
- XR scale RBAC: Users with crossplane-edit or crossplane-admin access can now kubectl scale XRs and claims whose XRD serves the scale subresource; previously they got Forbidden. Backported in #7934, originally fixed in #7922.added
- Allow users with crossplane-edit and crossplane-admin access to scale XRs that serve itadded
- Stop rewriting the in-use label on every Usage reconcilefixed
- E2e: Use xpkg.upbound.io for private package pull testother
- [release-2.4] chore(deps): bump crossplane-runtime to v2.4.3other
2 maintenance lines (dependency bumps, CI, tests, docs)
- Lock file maintenance (release-2.4)maintenance
- Lock file maintenance (release-2.4)maintenance
Full release notes ↗ · all Crossplane releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules