RATATOSKRATATOSK
Sign in

Crossplane

v2.4.1Orchestration & Management
Sep 15, 2026

ACTION 3OTHER 2

A maintenance release with a package-revision handoff fix and dependency security updates. It includes the gRPC advisory `GHSA-2v4p-qf9q-27wj` and refreshes the Go toolchain and related dependencies.

Action needed (3)

  • securityhighgoogle.golang.org/grpc update for GHSA-2v4p-qf9q-27wj

    google.golang.org/grpc is updated to v1.83.2 to pick up upstream fixes, including advisory GHSA-2v4p-qf9q-27wj. The update ships with the release's dependency security refresh.

    GHSA-2v4p-qf9q-27wj

  • securityThe Go toolchain update

    The Go toolchain is updated to 1.26.7 as part of the dependency security updates. The release also updates google.golang.org/grpc to v1.83.2, golang.org/x/crypto to v0.56.0, github.com/crossplane/crossplane/apis/v2 to v2.4.0, and refreshes the lock file.

    GHSA-2v4p-qf9q-27wj

  • securitygolang.org/x/crypto update

    golang.org/x/crypto is updated to v0.56.0 as part of the dependency security updates. The same refresh updates the Go toolchain to 1.26.7, google.golang.org/grpc to v1.83.2, and refreshes the lock file.

    GHSA-2v4p-qf9q-27wj

All 2 other recorded changesfixes 1 · value changes 1

fixes (1)

  • * **Package revisions now take control of established objects from the revision they replace:** An outgoing package revision could fail to relinquish control of the package's CRDs, leaving the incoming revision permanently unhealthy with cannot establish control of object. The provider's pod would never be created, so that provider could do no work without manual intervention by someone either deleting the stale revision or editing the CRD's owner reference by hand. Package revisions now directly take control from the revision they replace, so the hand-off succeeds without any intervention. Backported in #7821, originally fixed in #7733.

value changes (1)

  • * **Dependency security updates:** Bumps the Go toolchain to 1.26.7 (#7803), google.golang.org/grpc to v1.83.2 (#7800, #7826), and golang.org/x/crypto to v0.56.0 (#7810) to pick up upstream CVE fixes — including the gRPC advisory [GHSA-2v4p-qf9q-27wj](https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj). Also bumps github.com/crossplane/crossplane/apis/v2 to v2.4.0 (#7780) and refreshes the lock file (#7779).
Add Crossplane to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Crossplane releases →