Crossplane

v2.4.0Orchestration & Management

Aug 20, 2026

A release with breaking operational changes, new runtime behavior, and correctness fixes. It also updates the Go toolchain and dependencies for security fixes, including changes that affect CLI publication, package operation, and resource deletion.

Action needed (15)

securityGo version and dependency security updates
Crossplane now builds and runs with a newer Go version to include standard library CVE fixes. The release also includes security updates to Crossplane's Go dependencies.
securityGo 1.25.10
Go was updated to 1.25.10 to fix standard library CVEs.
securitygolang.org/x/crypto v0.52.0
The golang.org/x/crypto module was updated to v0.52.0 for security fixes.
securitygolang.org/x/sys v0.44.0
The golang.org/x/sys module was updated to v0.44.0 for security fixes.
securitygolang.org/x/net v0.55.0
The golang.org/x/net module was updated to v0.55.0 for security fixes.
securitygithub.com/sigstore/cosign/v3 v3.0.6
The github.com/sigstore/cosign/v3 module was updated to v3.0.6 for security fixes.
securitygithub.com/sigstore/rekor v1.5.2
The github.com/sigstore/rekor module was updated to v1.5.2 for security fixes.
securitygithub.com/sigstore/timestamp-authority/v2 v2.1.0
The github.com/sigstore/timestamp-authority/v2 module was updated to v2.1.0 for security fixes.
securitygithub.com/sigstore/sigstore-go v1.2.0
The github.com/sigstore/sigstore-go module was updated to v1.2.0 for security fixes.
securityCombined grpc, x/net, and x/text security updates
Combined security updates were applied to grpc, x/net, and x/text.
securitygolang.org/x/net v0.56.0
The golang.org/x/net module was updated to v0.56.0 for security fixes.
securitygolang.org/x/text v0.39.0
The golang.org/x/text module was updated to v0.39.0 for security fixes.
securityVulnerable dependency updates
Vulnerable dependencies were updated for security fixes.
securitygithub.com/sigstore/sigstore-go v1.2.1
The github.com/sigstore/sigstore-go module was updated to v1.2.1 for security fixes.
securitygolang.org/x/mod v0.40.0
The golang.org/x/mod module was updated to v0.40.0 for security fixes.

Check if affected (4)

breakingCrossplane CLI publication location and binary name
Applies if you use the Crossplane CLI.
The Crossplane CLI is no longer published to releases.crossplane.io. New releases are published only to cli.crossplane.io, with the binary name crossplane instead of crank.
breakingspec.replicas behavior in DeploymentRuntimeConfig
Applies if DeploymentRuntimeConfig configures spec.replicas.
Scaling to zero takes precedence over an explicit spec.replicas in a DeploymentRuntimeConfig. The field now specifies how many replicas to run while the runtime is active rather than requiring it to remain running.
breakingNarrowed composed resource garbage collection
Applicability is not stated in the release notes.
The composed resource garbage collector now deletes only resources whose controller reference points back to the XR.
breakingXR machinery fields in claim to XR synchronization
Applies if you run claim to XR syncers.
The claim to XR syncers now remove XR machinery fields such as resourceRefs and the crossplane stanza.

Plan ahead (1)

deprecatedCrossplane v1.20 support endremoval planned in v2.5 (Nov 2026)
Applies when v2.5 is released in Nov 2026 and Crossplane v1.20 runs.
When v2.5 is released in Nov 2026, Crossplane v1.20 reaches EOL and no longer receives support or maintenance from the Crossplane project.

All 33 other recorded changessecurity fixes 1 · value changes 19 · fixes 6 · additions 4 · renames 2 · defaults 1

security fixes (1)

Now Crossplane and its complete set of dependencies are visible to security scanner tools.

value changes (19)

chore(deps): bump crossplane-runtime to …×3
Additions that Crossplane doesn't declare are left alone rather than replaced along with the array that held them, e.g. an injected sidecar container or an extra volume added out of band now survives a reconcile.
The type label on the engine_watches_started_total and engine_watches_stopped_total metrics changed from ComposedResource to Dependency
redact secret stringData before emitting to pipeline inspector
fix(deps): update module github.com/google/go-containerregistry to …×2
fix(deps): update module github.com/alecthomas/kong to …×2
fix(deps): update module github.com/crossplane/crossplane/apis/v2 to …×2
fix(deps): update module github.com/aws/smithy-go to …×2
fix(deps): update module golang.org/x/sync to v0.21.0
fix(deps): update module google.golang.org/grpc to v1.81.1
fix(deps): update module github.com/masterminds/semver/v3 to v3.5.0
Don't overwrite the input XR's UID if it has one and validate observed resources
drop secret last-applied annotation from pipeline inspector output

fixes (6)

a field you remove from a DeploymentRuntimeConfig is now actually removed from the live Deployment instead of lingering (#7563, fixing #4817)
Deactivating a revision also no longer deletes a runtime Deployment that another revision controls
The sha256 files published with release binaries are now calculated after Nix strips the binary, so amd64 checksums match what you download.
A composed Usage no longer gets a redundant owner update on every reconcile
The deletion protection field index now uses a separator that can't appear in a group, kind, name, or namespace
Sorting of spec.resourceRefs now includes the namespace

additions (4)

we have released a v2 readiness checker tool in the v1.20 Crossplane CLI that can be invoked via crossplane beta upgrade check
a new RUNTIME-ACTIVE column was added
A change to a required resource now reconciles the XRs that required it the same way a change to a composed resource does.
A new RuntimeActive condition on ProviderRevision and FunctionRevision makes this visible.

renames (2)

Package revision names are now derived from both the package digest and the package's metadata.generation, so any change to a package's spec produces a new PackageRevision.
The RUNTIME printer column on ProviderRevision and FunctionRevision was renamed to RUNTIME-HEALTHY

defaults (1)

Crossplane now creates such a provider's runtime Deployment with zero replicas and scales it up once its first MRD becomes active

Add Crossplane to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →

Official release note ↗All Crossplane releases →