Crossplane 2.3.7
security+++++**!!!!!!
Crossplane v2.3.7 bumps the Go toolchain to 1.26.10 so that crypto/x509 rejects the compromised eMudhra intermediate certificates (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image's CA bundle. The release also updates vulnerable dependencies, including otlptrace v1.45.0. Fixes include discarding truncated package downloads, failing claims closed when their XRD cannot be listed, and stopping repeated in-use label writes on Usage reconciles.
What changes for platform teams
Platform teams running Crossplane should upgrade to pick up the trust store change and the fix for truncated package downloads, which could leave a provider crash-looping. Claims that cannot list their XRD now report ReconcileError instead of honoring a compositionRef.
Changes
- Distrust of compromised eMudhra intermediate CAs: Bumps the Go toolchain to 1.26.10, whose crypto/x509 rejects the compromised eMudhra intermediate certificates (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots they chain to from the image's CA bundle (#7958).security
- Dependency security updates: A combined set of vulnerable dependency updates (#7914) and otlptrace v1.45.0 (#7846) to pick up upstream CVE fixes. Also refreshes the lock file (#7893, #7908).security
- Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.45.0 [security] (release-2.3)security
- Update vulnerable dependencies [security] (release-2.3)security
- [release-2.3] build(deps): bump Go to 1.26.9 [security]security
- [release-2.3] build(deps): bump Go to 1.26.10 and distrust compromised eMudhra roots [security]security
- Truncated package downloads are no longer cached: A package download that failed partway could be cached as a valid but truncated package.yaml. The package revision then recorded only some of its objects, reported Healthy=True, and the provider's RBAC was rendered from the short list, so the provider could crash-loop. Truncated downloads are now discarded. Fixed via crossplane-runtime v2.3.5 (#7962), originally crossplane/crossplane-runtime#1189.added
- Claims fail closed when they cannot list their XRD: A List error when looking up the XRD was treated as "no enforced composition", so a claim's compositionRef could be honored even when the XRD forbids it. The claim now reports ReconcileError instead. Backported in #7861, originally fixed in #7789.added
- Usage no longer rewrites the in-use label on every reconcile: A leftover ownership check meant the used resource was updated on every reconcile of every Usage/ClusterUsage, causing needless API writes. Backported in #7876, originally fixed in #7860.added
- XR scale RBAC: Users with crossplane-edit or crossplane-admin access can now kubectl scale XRs and claims whose XRD serves the scale subresource; previously they got Forbidden. Backported in #7933, originally fixed in #7922.added
- Allow users with crossplane-edit and crossplane-admin access to scale XRs that serve itadded
- Fail closed when a claim cannot list its XRDfixed
3 more lines
- Stop rewriting the in-use label on every Usage reconcilefixed
- E2e: Use xpkg.upbound.io for private package pull testother
- [release-2.3] chore(deps): bump crossplane-runtime to v2.3.5other
2 maintenance lines (dependency bumps, CI, tests, docs)
- Lock file maintenance (release-2.3)maintenance
- Lock file maintenance (release-2.3)maintenance
Full release notes ↗ · all Crossplane releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules