Crossplane v2.2.7
security++*!!!!!!
Crossplane v2.2.7 ships a Go toolchain bump to 1.26.10, which makes crypto/x509 reject certificates from compromised eMudhra intermediate CAs (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image's CA bundle. It also updates golang.org/x/net to v0.60.0, the OpenTelemetry OTLP trace exporter to v1.45.0, and crossplane-runtime to v2.2.5 to pick up upstream CVE fixes. Two fixes stop truncated package downloads from being cached and stop the in-use label from being rewritten on every Usage reconcile.
What changes for platform teams
Platform teams running Crossplane should upgrade to pick up the dependency CVE fixes and the fix that prevents truncated provider packages from being cached and crash-looping providers. The Usage change reduces needless API writes on every reconcile.
Changes
- Distrust of compromised eMudhra intermediate CAs: Bumps the Go toolchain to 1.26.10, whose crypto/x509 rejects the compromised eMudhra intermediate certificates (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots they chain to from the image's CA bundle (#7959).security
- Dependency security updates: Bumps golang.org/x/net to v0.60.0 (#7918) and otlptracehttp to v1.45.0 (#7845), and crossplane-runtime to v2.2.5 (#7963), to pick up upstream CVE fixes. Also refreshes the lock file (#7892, #7907).security
- Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 [security] (release-2.2)security
- Update module golang.org/x/net to v0.60.0 [security] (release-2.2)security
- [release-2.2] build(deps): bump Go to 1.26.9 [security]security
- [release-2.2] build(deps): bump Go to 1.26.10 and distrust compromised eMudhra roots [security]security
- Truncated package downloads are no longer cached: A package download that failed partway could be cached as a valid but truncated package.yaml. The package revision then recorded only some of its objects, reported Healthy=True, and the provider's RBAC was rendered from the short list, so the provider could crash-loop. Truncated downloads are now discarded. Backported in #7950, originally fixed in crossplane/crossplane-runtime#1189.added
- Usage no longer rewrites the in-use label on every reconcile: A leftover ownership check meant the used resource was updated on every reconcile of every Usage/ClusterUsage, causing needless API writes. Backported in #7875, originally fixed in #7860.added
- Stop rewriting the in-use label on every Usage reconcilefixed
- E2e: Use xpkg.upbound.io for private package pull testother
- Don't cache truncated package downloads in xpkgother
- [release-2.2] chore(deps): bump crossplane-runtime to v2.2.5other
2 maintenance lines (dependency bumps, CI, tests, docs)
- Lock file maintenance (release-2.2)maintenance
- Lock file maintenance (release-2.2)maintenance
Full release notes ↗ · all Crossplane releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules