Crossplane
v2.2.6Orchestration & ManagementA security-focused maintenance release with updates to the Go toolchain and dependencies for upstream CV fixes. Package-revision handoffs are also corrected so incoming revisions can take control of established objects without manual intervention.
Action needed (3)
securityhighThe
google.update for GHSA-2v4p-qf9q-27wjgolang. org/grpc google.is updated togolang. org/grpc v1.to pick up upstream CVE fixes, including advisory GHSA-2v4p-qf9q-27wj. The updated dependency ships in this release.83. 2 securityThe Go toolchain security update
The Go toolchain is updated to
1.to pick up upstream CVE fixes. The lock file is also refreshed.26. 7 securityThe
golang.security updateorg/x/crypto golang.is updated toorg/x/crypto v0.to pick up upstream CVE fixes. The updated dependency ships in this release.56. 0
All 1 other recorded changesfixes 1
fixes (1)
- * **Package revisions now take control of established objects from the revision they replace:** An outgoing package revision could fail to relinquish control of the package's CRDs, leaving the incoming revision permanently unhealthy with
cannot establish control of object. The provider's pod would never be created, so that provider could do no work without manual intervention by someone either deleting the stale revision or editing the CRD's owner reference by hand. Package revisions now directly take control from the revision they replace, so the hand-off succeeds without any intervention. Backported in #7828, originally fixed in #7733.
A weekly email arrives when a release needs action. Like the security patches in this release.