Crossplane v2.4.2 ships fixes for ServiceAccount ownership when package revisions become active, and a change so that a claim fails closed when it cannot list its XRD. The release also updates the OpenTelemetry OTLP trace exporter module to v1.45.0 to address a security issue in that dependency.
platform teams Teams running Crossplane 2.4 get corrected ServiceAccount ownership handover during package revision changes and stricter behavior when XRD listing fails. The security item is a dependency bump, not a fix in Crossplane's own code.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
- !Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.45.0 [security] (release-2.4)security
- +Fixed a bug where ownership of ServiceAccount s was not correctly transferred to newly active package revisions (#7838). Fixed in #7839 and backported in #7852.added
- *Demote old revision controller ownerReference for SAfixed
- *Fail closed when a claim cannot list its XRDfixed
1 maintenance lines (dependency bumps, CI, tests, docs)
- ·Bump crossplane-runtime dependency to v2.4.2maintenance
5 lines1 security1 added2 fixed1 maintenancetyped from the source notes
Crossplane v2.4.1 updates the Go toolchain to 1.26.7, google.golang.org/grpc to v1.83.2, and golang.org/x/crypto to v0.56.0 to pick up upstream CVE fixes, including the gRPC advisory GHSA-2v4p-qf9q-27wj. It also bumps the Crossplane apis module to v2.4.0. The release changes how package revisions take control of established objects, so an incoming revision can take over CRDs from the revision it replaces.
platform teams Platform teams upgrading to v2.4.1 get the dependency CVE fixes without changes to their own configuration. Package upgrades that previously could leave a new provider unhealthy with a cannot establish control of object error should now hand off automatically, without deleting the stale revision or editing CRD owner references by hand.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
- !Dependency security updates: Bumps the Go toolchain to 1.26.7 (#7803), google.golang.org/grpc to v1.83.2 (#7800, #7826), and golang.org/x/crypto to v0.56.0 (#7810) to pick up upstream CVE fixes — including the gRPC advisory GHSA-2v4p-qf9q-27wj. Also bumps github.com/crossplane/crossplane/apis/v2 to v2.4.0 (#7780) and refreshes the lock file (#7779).security
- !Update module google.golang.org/grpc to v1.83.1 [security] (release-2.4)security
- !Update module golang.org/x/crypto to v0.56.0 [security] (release-2.4)security
- !Update module google.golang.org/grpc to v1.83.2 [security] (release-2.4)security
- +Package revisions now take control of established objects from the revision they replace: An outgoing package revision could fail to relinquish control of the package's CRDs, leaving the incoming revision permanently unhealthy with cannot establish control of object. The provider's pod would never be created, so that provider could do no work without manual intervention by someone either deleting the stale revision or editing the CRD's owner reference by hand. Package revisions now directly take control from the revision they replace, so the hand-off succeeds without any intervention. Backported in #7821, originally fixed in #7733.added
- *Take control of established objects from replaced revisionsfixed
3 maintenance lines (dependency bumps, CI, tests, docs)
- ·Lock file maintenance (release-2.4)maintenance
- ·Update module github.com/crossplane/crossplane/apis/v2 to v2.4.0 (release-2.4)maintenance
- ·Bump go to 1.26maintenance
9 lines4 security1 added1 fixed3 maintenancetyped from the source notes
Crossplane v2.3.6 updates the Go toolchain to 1.26.7 and bumps google.golang.org/grpc to v1.83.2 and golang.org/x/crypto to v0.56.0, which the release notes say pick up upstream CVE fixes, including a gRPC advisory. It also fixes a package revision hand-off bug where an outgoing revision could fail to release CRD control, leaving the incoming provider stuck with cannot establish control of object and no pod created.
platform teams Platform teams running Crossplane packages should pick up this patch, since providers stuck on a replaced revision previously needed manual CRD owner-reference edits or deletion of the stale revision. The security content is dependency bumps only, not a vulnerability in Crossplane's own code.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
- !Dependency security updates: Bumps the Go toolchain to 1.26.7 (#7815), google.golang.org/grpc to v1.83.2 (#7799, #7825), and golang.org/x/crypto to v0.56.0 (#7809) to pick up upstream CVE fixes — including the gRPC advisory GHSA-2v4p-qf9q-27wj. Also refreshes the lock file (#7778).security
- !Update module google.golang.org/grpc to v1.83.1 [security] (release-2.3)security
- !Update module golang.org/x/crypto to v0.56.0 [security] (release-2.3)security
- !Update module google.golang.org/grpc to v1.83.2 [security] (release-2.3)security
- +Package revisions now take control of established objects from the revision they replace: An outgoing package revision could fail to relinquish control of the package's CRDs, leaving the incoming revision permanently unhealthy with cannot establish control of object. The provider's pod would never be created, so that provider could do no work without manual intervention by someone either deleting the stale revision or editing the CRD's owner reference by hand. Package revisions now directly take control from the revision they replace, so the hand-off succeeds without any intervention. Backported in #7827, originally fixed in #7733.added
- *Take control of established objects from replaced revisionsfixed
2 maintenance lines (dependency bumps, CI, tests, docs)
- ·Lock file maintenance (release-2.3)maintenance
- ·Bump go to 1.26maintenance
8 lines4 security1 added1 fixed2 maintenancetyped from the source notes
Crossplane v2.2.6 updates the Go toolchain to 1.26.7 and bumps google.golang.org/grpc to v1.83.2 and golang.org/x/crypto to v0.56.0, including a gRPC advisory fix. It also changes package revision handoff so a new revision takes control of CRDs from the revision it replaces, fixing a case where the incoming provider's pod was never created and needed manual cleanup.
platform teams Platform teams upgrading to v2.2.6 get dependency CVE fixes, and provider package upgrades no longer stall with a cannot establish control of object error that previously required deleting the stale revision or editing CRD owner references by hand. The security content is dependency bumps only, not a vulnerability in Crossplane's own code.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
- !Dependency security updates: Bumps the Go toolchain to 1.26.7 (#7814), google.golang.org/grpc to v1.83.2 (#7798, #7824), and golang.org/x/crypto to v0.56.0 (#7808) to pick up upstream CVE fixes — including the gRPC advisory GHSA-2v4p-qf9q-27wj. Also refreshes the lock file (#7777).security
- !Update module google.golang.org/grpc to v1.83.1 [security] (release-2.2)security
- !Update module golang.org/x/crypto to v0.56.0 [security] (release-2.2)security
- !Update module google.golang.org/grpc to v1.83.2 [security] (release-2.2)security
- +Package revisions now take control of established objects from the revision they replace: An outgoing package revision could fail to relinquish control of the package's CRDs, leaving the incoming revision permanently unhealthy with cannot establish control of object. The provider's pod would never be created, so that provider could do no work without manual intervention by someone either deleting the stale revision or editing the CRD's owner reference by hand. Package revisions now directly take control from the revision they replace, so the hand-off succeeds without any intervention. Backported in #7828, originally fixed in #7733.added
- *Take control of established objects from replaced revisionsfixed
2 maintenance lines (dependency bumps, CI, tests, docs)
- ·Lock file maintenance (release-2.2)maintenance
- ·Bump go to 1.26maintenance
8 lines4 security1 added1 fixed2 maintenancetyped from the source notes
Crossplane v1.20.13 was released with four changes, three of them security-related. The security content is dependency updates: the Go toolchain is bumped to 1.26.7, google.golang.org/grpc is updated to v1.83.2, and a set of vulnerable dependencies is updated, including the gRPC advisory GHSA-2v4p-qf9q-27wj.
platform teams Platform teams running Crossplane 1.20 should plan to pick up this patch release, since it carries upstream CVE fixes. The changes are dependency and toolchain updates with no vulnerability in Crossplane's own code described in the source.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
- !Dependency security updates: Bumps the Go toolchain to 1.26.7 (#7816) and google.golang.org/grpc to v1.83.2 (#7823), plus a combined set of vulnerable dependency updates (#7797), to pick up upstream CVE fixes — including the gRPC advisory GHSA-2v4p-qf9q-27wj.security
- !Update vulnerable dependencies [security] (release-1.20)security
- !Update module google.golang.org/grpc to v1.83.2 [security] (release-1.20)security
1 maintenance lines (dependency bumps, CI, tests, docs)
- ·Bump go to 1.26maintenance
4 lines3 security1 maintenancetyped from the source notes
- !Dependency security updates: Bumps cel-go (#7761), golang.org/x/mod (#7743), and sigstore-go (#7678), plus a combined set of vulnerable dependency updates (#7650), to pick up upstream CVE fixes. crossplane-runtime is also bumped to v2.3.4 (#7765), which carries its own set of security dependency updates.security
- !Update vulnerable dependencies [security] (release-2.3)security
- !Update module github.com/sigstore/sigstore-go to v1.2.1 [security] (release-2.3)security
- !Update module golang.org/x/mod to v0.40.0 [security] (release-2.3)security
- !Update module github.com/google/cel-go to v0.30.0 [security] (release-2.3)security
- +Correct crank checksums for amd64 binaries (#7666, originally #7660): The published .sha256 files for linux_amd64 binaries had not matched the binaries themselves since v2.2.0, so any install script or Dockerfile that verified the amd64 checksum failed. Checksums are now calculated after Nix strips the binary, and the release workflow verifies them before uploading. Fixes #7467.added
- +Unambiguous Usage index key (#7630, originally #7508): The deletion protection webhook indexed Usage resources by joining API group, kind, name, and namespace with .. Since groups and names can contain . themselves, two distinct resources could collapse to the same key, causing the webhook to block a deletion that should have been allowed. The key now joins with /, which cannot appear in any of those fields.added
- *Pin create-tag to v2 so apis/ submodule tagging works againfixed
- ·Use unambiguous separator for usage index keyother
- ·Backport #7660 to release-2.3other
6 maintenance lines (dependency bumps, CI, tests, docs)
- ·Give every Go build its own writable HOMEmaintenance
- ·Point docker-client at docker_29 in the nix overlaymaintenance
- ·Lock file maintenance (release-2.3)maintenance
- ·Bump pinned nixpkgs channel from nixos-25.11 to nixos-26.05maintenance
- ·Lock file maintenance (release-2.3)maintenance
- ·Bump crossplane-runtime to v2.3.4maintenance
16 lines5 security2 added1 fixed2 other6 maintenancetyped from the source notes
- !Dependency security updates: Bumps cel-go (#7760), golang.org/x/mod (#7742), sigstore-go (#7677), and go-git (#7724), plus a combined set of vulnerable dependency updates (#7649), to pick up upstream CVE fixes. crossplane-runtime is also bumped to v2.2.4 (#7766), which carries its own set of security dependency updates.security
- !Update vulnerable dependencies [security] (release-2.2)security
- !Update module github.com/sigstore/sigstore-go to v1.2.1 [security] (release-2.2)security
- !Update module github.com/go-git/go-git/v5 to v5.19.2 [security] (release-2.2)security
- !Update module golang.org/x/mod to v0.40.0 [security] (release-2.2)security
- !Update module github.com/google/cel-go to v0.30.0 [security] (release-2.2)security
- +Correct crank checksums for amd64 binaries (#7665, originally #7660): The published .sha256 files for linux_amd64 binaries had not matched the binaries themselves since v2.2.0, so any install script or Dockerfile that verified the amd64 checksum failed. Checksums are now calculated after Nix strips the binary, and the release workflow verifies them before uploading. Fixes #7467.added
- +Unambiguous Usage index key (#7629, originally #7508): The deletion protection webhook indexed Usage resources by joining API group, kind, name, and namespace with .. Since groups and names can contain . themselves, two distinct resources could collapse to the same key, causing the webhook to block a deletion that should have been allowed. The key now joins with /, which cannot appear in any of those fields.added
- ·Use unambiguous separator for usage index keyother
- ·Backport #7660 to release-2.2other
6 maintenance lines (dependency bumps, CI, tests, docs)
- ·Give every Go build its own writable HOMEmaintenance
- ·Point docker-client at docker_29 in the nix overlay [release-2.2]maintenance
- ·Lock file maintenance (release-2.2)maintenance
- ·Bump pinned nixpkgs channel from nixos-25.11 to nixos-26.05maintenance
- ·Lock file maintenance (release-2.2)maintenance
- ·Bump crossplane-runtime to v2.2.4maintenance
16 lines6 security2 added2 other6 maintenancetyped from the source notes
- !Dependency security updates: Bumps the Go toolchain to 1.25.13 (#7755), go-git (#7722), and golang.org/x/mod (#7740), plus two combined sets of vulnerable dependency updates (#7646, #7675), to pick up upstream CVE fixes. crossplane-runtime is also bumped to v1.20.11 (#7767), which carries its own set of security dependency updates.security
- !Update vulnerable dependencies [security] (release-1.20)security
- !Update vulnerable dependencies [security] (release-1.20)security
- !Update module github.com/go-git/go-git/v5 to v5.19.2 [security] (release-1.20)security
- !Update module golang.org/x/mod to v0.40.0 [security] (release-1.20)security
- !Bump Go to 1.25.13 [security] [release-1.20]security
3 maintenance lines (dependency bumps, CI, tests, docs)
- ·Update amazon/aws-cli docker tag to v2.36.13 (release-1.20)maintenance
- ·Update gcr.io/distroless/static docker digest to 9197324 (release-1.20)maintenance
- ·Bump crossplane-runtime to v1.20.11maintenance
9 lines6 security3 maintenancetyped from the source notes
v2.4.02026-08-20minorbreakingsecurity+++++++++++++!!sharesource - !·⚠️ The Crossplane CLI is no longer published to releases.crossplane.io. New CLI releases go only to cli.crossplane.io, under the binary name crossplane rather than crank. This completes the CLI's move to which was announced in the v2.3.0 release notes and dual published to both locations for v2.3.0 to ease the transition.other / breaking
- !·F you are using custom installation scripts or CI steps that download the CLI directly from releases.crossplane.io, update them to use cli.crossplane.io, and update any firewall or proxy rule that allows releases.crossplane.io to now allow cli.crossplane.io instead.other / breaking
- !·Users of the install.sh script as their installation procedure are unaffected.other / breaking
- !·The CLI now follows its own release schedule, so a CLI release will not accompany every core Crossplane release and the two version numbers have diverged.other / breaking
- !·Documentation and installation instructions for the Crossplane CLI can be found onother / breaking
- !·Package revision names are now derived from both the package digest and the package's metadata.generation, so any change to a package's spec produces a new PackageRevision.other / breaking
- !·This fixes the long standing issue where changing a package's runtimeConfigRef reused the existing revision, along with its stale runtime settings.other / breaking
- !·When upgrading to v2.4, every installed package gets a new revision, with a new name, on its first reconcile.other / breaking
- !·⚠️ The Pods for Providers and Functions will be restarted for this new revision.other / breaking
- !·Package runtime objects (Deployment, ServiceAccount, Service, and TLS Secrets) are now applied with server-side apply under the pkg.crossplane.io/runtime field manager, replacing the previous merge patch applicator.other / breaking
- !·A field you remove from a DeploymentRuntimeConfig is now removed from the live runtime object, rather than lingering until that object is replaced.other / breaking
- !·Additions that Crossplane doesn't declare are left alone rather than replaced along with the array that held them, e.g. an injected sidecar container or an extra volume added out of band now survives a reconcile.other / breaking
21 more lines
- !·The RUNTIME printer column on ProviderRevision and FunctionRevision was renamed to RUNTIME-HEALTHY, and a new RUNTIME-ACTIVE column was added.other / breaking
- !·Update any tooling that reads kubectl get providerrevision or kubectl get functionrevision output by column position.other / breaking
- !·The type label on the engine_watches_started_total and engine_watches_stopped_total metrics changed from ComposedResource to Dependency, now that a single watch mechanism covers both composed and required resources.other / breaking
- !·Update any dashboards or alerts that filter on that label value.other / breaking
- !Vulnerability-scannable container images: Crossplane container images are now built with nixpkgs' buildGoModule, which includes the full Go dependency list into the binary. Scanners such as grype and trivy previously were only able to discover the Crossplane main module and the Go standard library, so CVEs in our third-party dependencies were not visible to them. Now Crossplane and its complete set of dependencies are visible to security scanner tools.security
- !Security fixes in dependencies: The Go version Crossplane builds/runs with was bumped to pick up standard library CVE fixes, alongside a steady stream of security updates to Crossplane's Go dependencies across this release cycle.security
- +Watching required resources: Composition functions can require resources they don't compose, but Crossplane didn't watch them, so a change to a required resource didn't reconcile the XRs that required it until their next poll. Crossplane now tracks the resources each XR depends on and drives watches from that. A change to a required resource now reconciles the XRs that required it the same way a change to a composed resource does. This works when realtime compositions are enabled, which is the default. See design/one-pager-watching-required-resources.md and #7572.added
- +Safe-start provider runtimes scale to zero until activated: A provider with the safe-start capability runs no managed resource controllers while all of its ManagedResourceDefinitions are inactive, so there is no reason to run its pods. Crossplane now creates such a provider's runtime Deployment with zero replicas and scales it up once its first MRD becomes active, such as through a matching ManagedResourceActivationPolicy. Installing a broad set of providers no longer costs you a running pod for each one that has nothing to reconcile yet.added
- +A new RuntimeActive condition on ProviderRevision and FunctionRevision makes this visible. It is False with reason AwaitingActivation while the runtime is intentionally scaled to zero and True once it has been scaled up. RuntimeHealthy stays healthy in both cases, and the package's Healthy condition surfaces the awaiting state with the same reason.added
- +Scaling to zero takes precedence over an explicit spec.replicas in a DeploymentRuntimeConfig, which is now read as how many replicas to run while running, rather than a demand to always be running.added
- +More reliable package runtime management: Server-side apply for package runtime objects means a field you remove from a DeploymentRuntimeConfig is now actually removed from the live Deployment instead of lingering (#7563, fixing #4817). Deactivating a revision also no longer deletes a runtime Deployment that another revision controls, which could happen when a DeploymentRuntimeConfig pins a stable deploymentTemplate.metadata.name (#7561).added
- +Hardening across composition and package paths: Several changes tighten paths where a caller could reach further than intended. The composed resource garbage collector now only deletes resources whose controller reference points back to the XR, so spec.resourceRefs can no longer be used to make the composite controller delete arbitrary resources (#7627). The claim to XR syncers now strip XR machinery fields such as resourceRefs and the crossplane stanza, which a claim could otherwise smuggle through an XRD schema that sets x-kubernetes-preserve-unknown-fields: true (#7626).added
- +Version-aware docs search: Searching from an older version of the docs, such as /v1.20/, used to return results from all versions, potentially returning features and APIs that don't exist in the version you're actually reading. Search is now scoped to the version you're on, results carry a clearly visible version badge, and pages from older versions show a banner explaining that, with a link to latest. Thanks to @haarchri for this one in crossplane/docs#1051, so give it a try atadded
- +Other notable improvements:added
- +Several fixes to the render engine that backs crossplane render: an XRD schema can now be supplied to crossplane internal render (#7452), requirements are returned even when a function returns a fatal result (#7455), a namespace is set on injected resource references only for cluster-scoped XRs, matching the real reconciler (#7523), and an input XR fetched from a real cluster keeps its own UID so its observed resources are read correctly, with clear errors when observed resources don't line up with the XR (#7544).added
- +The sha256 files published with release binaries are now calculated after Nix strips the binary, so amd64 checksums match what you download. They didn't for v2.2.0 through v2.3.1, and CI now verifies checksums before uploading artifacts.added
- +A composed Usage no longer gets a redundant owner update on every reconcile, which could repeatedly trigger composition reconciliation and eventually open the XR circuit breaker.added
- +The deletion protection field index now uses a separator that can't appear in a group, kind, name, or namespace, so two distinct resources can no longer collide and block a deletion that should be allowed.added
- +Sorting of spec.resourceRefs now includes the namespace, so references stay stable when composed resources share a name across namespaces.added
- ·Blog post:other
- ·Release notes:other
33 lines2 security13 added18 othertyped from the source notes
- !Vulnerability-scannable images (#7574): Container images are now built with buildGoModule (replacing gomod2nix), so published images can be scanned by standard vulnerability tooling.security
- !Dependency security updates: Bumps grpc / golang.org/x/net / golang.org/x/text (#7618, #7614, #7615) and the sigstore stack — cosign (#7559), rekor (#7560), timestamp-authority (#7570), sigstore-go (#7583) — to pick up upstream CVE fixes. See ## What's Changed for the full list.security
- !Update module github.com/sigstore/rekor to v1.5.2 [security] (release-2.3)security
- !Update module github.com/sigstore/cosign/v3 to v3.0.6 [security] (release-2.3)security
- !Update module github.com/sigstore/timestamp-authority/v2 to v2.1.0 [security] (release-2.3)security
- !Build with buildGoModule so images are vulnerability-scannablesecurity
- !Update module github.com/sigstore/sigstore-go to v1.2.0 [security] (release-2.3)security
- !Combined security bumps (grpc, x/net, x/text) (release-2.3)security
- !Update module golang.org/x/text to v0.39.0 [security] (release-2.3)security
- !Update module golang.org/x/net to v0.56.0 [security] (release-2.3)security
- +Fixed repeated owner updates for composed Usages (#7597, originally #7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so spec.by ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.added
- +Crossplane render fixes (#7599, originally #7544): render no longer overwrites the input XR's UID when one is already set, and now validates observed resources before proceeding with the render.added
2 more lines
- *Avoid repeated owner updates for composed Usagesfixed
- ·Render: Don't overwrite the input XR's UID if it has one and validate observed resourcesother
14 lines10 security2 added1 fixed1 othertyped from the source notes
- !Vulnerability-scannable images (#7575): Container images are now built with buildGoModule (replacing gomod2nix), so published images can be scanned by standard vulnerability tooling.security
- !Dependency security updates: Bumps grpc / golang.org/x/net / golang.org/x/text (#7619) and the sigstore stack — cosign (#7558), rekor (#7557), timestamp-authority (#7569), sigstore-go (#7582) — to pick up upstream CVE fixes. See ## What's Changed for the full list.security
- !Update module github.com/sigstore/rekor to v1.5.2 [security] (release-2.2)security
- !Update module github.com/sigstore/cosign/v3 to v3.0.6 [security] (release-2.2)security
- !Update module github.com/sigstore/timestamp-authority/v2 to v2.1.0 [security] (release-2.2)security
- !Build with buildGoModule so images are vulnerability-scannablesecurity
- !Update module github.com/sigstore/sigstore-go to v1.2.0 [security] (release-2.2)security
- !Combined security bumps (grpc, x/net, x/text) (release-2.2)security
- +Fixed repeated owner updates for composed Usages (#7596, originally #7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so spec.by ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.added
- *Avoid repeated owner updates for composed Usagesfixed
10 lines8 security1 added1 fixedtyped from the source notes
- !Dependency security updates: Bumps the Go toolchain to 1.25.12 (#7577), grpc / golang.org/x/net / golang.org/x/text (#7620, #7609), and the sigstore stack — cosign (#7556), rekor (#7555), timestamp-authority (#7568), sigstore-go (#7581) — to pick up upstream CVE fixes. See ## What's Changed for the full list.security
- !Update module github.com/sigstore/rekor to v1.5.2 [security] (release-2.1)security
- !Update module github.com/sigstore/timestamp-authority/v2 to v2.1.0 [security] (release-2.1)security
- !Update module github.com/sigstore/cosign/v2 to v2.6.3 [security] (release-2.1)security
- !Bump Go to 1.25.12 [security] [release-2.1]security
- !Update module github.com/sigstore/sigstore-go to v1.2.0 [security] (release-2.1)security
- !Combined security bumps (grpc, x/net, x/text) (release-2.1)security
- !Update module golang.org/x/text to v0.39.0 [security] (release-2.1)security
- +Fixed repeated owner updates for composed Usages (#7622, originally #7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so spec.by ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.added
- *Avoid repeated owner updates for composed Usagesfixed
10 lines8 security1 added1 fixedtyped from the source notes
16 older releases
| v1.20.11 | 2026-07-23 | patch | security +*!!!! 7 lines |
| v2.3.3 | 2026-06-22 | patch | security +!!! 6 lines |
| v2.2.3 | 2026-06-22 | patch | security +!!!! 7 lines |
| v2.1.7 | 2026-06-22 | patch | security !!! 4 lines |
| v1.20.10 | 2026-06-22 | patch | security !! 4 lines |
| v2.3.2 | 2026-06-09 | patch | * 5 lines |
| v1.20.9 | 2026-06-05 | patch | security ++++++! 8 lines |
| v2.3.1 | 2026-05-22 | patch | security *! 3 lines |
| v2.2.2 | 2026-05-22 | patch | security !!!! 6 lines |
| v2.1.6 | 2026-05-22 | patch | security !!!!!! 8 lines |
| v1.20.8 | 2026-05-22 | patch | security !!!!!! 8 lines |
| v2.3.0 | 2026-05-21 | minor | breakingsecurity +++++++++~-***!!!!! 92 lines |
| v1.20.7 | 2026-04-24 | patch | security ! 2 lines |
| v2.2.1 | 2026-04-20 | minor | security +++**!!!!!!!!!! 20 lines |
| v2.1.5 | 2026-04-20 | minor | security +++*!!!!!!!!!! 19 lines |
| v2.0.8 | 2026-04-20 | major | security +++*!!!!!!!!! 17 lines |