Crossplane v1.20.14
security!!!!!!!
Crossplane v1.20.14 ships on the release-1.20 branch. The release updates the Go toolchain to 1.26.10 so crypto/x509 rejects certificates from the compromised eMudhra intermediate CAs, and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image CA bundle by moving to a newer distroless/static base image. It also bumps golang.org/x/net to v0.60.0, OpenTelemetry OTLP trace HTTP exporter to v1.45.0, and crossplane-runtime to v1.20.12 to pick up upstream CVE fixes.
What changes for platform teams
Platform teams running Crossplane 1.20 should upgrade to pick up the CA trust removal and dependency CVE fixes. The release notes do not describe a vulnerability in Crossplane's own code, so the security content is toolchain and dependency updates.
Changes
- Distrust of compromised eMudhra intermediate CAs: Bumps the Go toolchain to 1.26.10 (#7956), whose crypto/x509 rejects the compromised eMudhra intermediate certificates (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots they chain to from the image's CA bundle (#7960, by moving to the latest distroless/static base image).security
- Dependency security updates: Bumps golang.org/x/net to v0.60.0 (#7917) and go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 (#7844), and crossplane-runtime to v1.20.12 (#7964), to pick up upstream CVE fixes.security
- Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 [security] (release-1.20)security
- Update module golang.org/x/net to v0.60.0 [security] (release-1.20)security
- Build(deps) [release 1.20]: bump Go to 1.26.9 [security]security
- [release-1.20] build(deps): bump Go to 1.26.10 [security]security
- [release-1.20] build(deps): bump distroless base image to distrust compromised eMudhra roots [security]security
- E2e: Use xpkg.upbound.io for private package pull testother
- [release-1.20] chore(deps): bump crossplane-runtime to v1.20.12other
1 maintenance lines (dependency bumps, CI, tests, docs)
- Update gcr.io/distroless/static docker digest to 5813399 (release-1.20)maintenance
Full release notes ↗ · all Crossplane releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules