Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: CrossplaneClear ×

Crossplanev1.20.12Orchestration & ManagementYesterdayAug 21, 2026

ACTION 5OTHER 3View full analysis

A maintenance release with security-related dependency and toolchain updates, along with routine dependency and runtime version changes. No advisory identifiers are stated.

Action needed (5)

securityVulnerable dependency fixes
Vulnerable dependencies were updated in the release-1.20 branch.
securityVulnerable dependency updates
Vulnerable dependencies were updated in the release-1.20 branch.
securityThe github.com/go-git/go-git/v5 module update
The github.com/go-git/go-git/v5 module was updated to version v5.19.2 in the release-1.20 branch.
securityThe golang.org/x/mod module update
The golang.org/x/mod module was updated to version v0.40.0 in the release-1.20 branch.
securityThe Go toolchain version 1.25.13
The Go toolchain was updated to version 1.25.13 in the release-1.20 branch.

Source ↗

Crossplanev2.2.5Orchestration & ManagementYesterdayAug 21, 2026

ACTION 1OTHER 2View full analysis

A maintenance release corrects binary checksum generation and deletion-protection indexing, and updates dependencies for upstream CVE fixes. The changes affect release verification, webhook deletion checks, and the dependency set shipped with the release.

Action needed (1)

securityDependency security updates
The release updates cel-go, golang.org/x/mod, sigstore-go, and go-git, along with a combined set of vulnerable dependency updates, to pick up upstream CVE fixes. It also bumps crossplane-runtime to v2.2.4, which carries its own security dependency updates.

Source ↗

Crossplanev2.3.5Orchestration & ManagementYesterdayAug 21, 2026

ACTION 4OTHER 4View full analysis

A maintenance release corrects binary checksum handling and the Usage index key, alongside updates to security-sensitive and build dependencies. The dependency changes require the new release, with no operator configuration migration stated.

Action needed (4)

securityThe golang.org/x/mod dependency update
The release updates golang.org/x/mod as a security-related dependency change.
securityThe github.com/sigstore/sigstore-go dependency, updated to v1.2.1
The release updates github.com/sigstore/sigstore-go to v1.2.1 as a security-related dependency change.
securityThe github.com/google/cel-go dependency, updated to v0.30.0
The release updates github.com/google/cel-go to v0.30.0 as a security-related dependency change.
securityThe crossplane-runtime dependency, bumped to v2.3.4
The release bumps crossplane-runtime to v2.3.4 as a security-related dependency change.

Source ↗

Crossplanev2.4.0Orchestration & ManagementAug 20, 2026

ACTION 15CHECK 4PLAN 1OTHER 33View full analysis

A release with breaking operational changes, new runtime behavior, and correctness fixes. It also updates the Go toolchain and dependencies for security fixes, including changes that affect CLI publication, package operation, and resource deletion.

Action needed (15)

securityGo version and dependency security updates
Crossplane now builds and runs with a newer Go version to include standard library CVE fixes. The release also includes security updates to Crossplane's Go dependencies.
securityGo 1.25.10
Go was updated to 1.25.10 to fix standard library CVEs.
securitygolang.org/x/crypto v0.52.0
The golang.org/x/crypto module was updated to v0.52.0 for security fixes.
securitygolang.org/x/sys v0.44.0
The golang.org/x/sys module was updated to v0.44.0 for security fixes.
securitygolang.org/x/net v0.55.0
The golang.org/x/net module was updated to v0.55.0 for security fixes.
securitygithub.com/sigstore/cosign/v3 v3.0.6
The github.com/sigstore/cosign/v3 module was updated to v3.0.6 for security fixes.
securitygithub.com/sigstore/rekor v1.5.2
The github.com/sigstore/rekor module was updated to v1.5.2 for security fixes.
securitygithub.com/sigstore/timestamp-authority/v2 v2.1.0
The github.com/sigstore/timestamp-authority/v2 module was updated to v2.1.0 for security fixes.
securitygithub.com/sigstore/sigstore-go v1.2.0
The github.com/sigstore/sigstore-go module was updated to v1.2.0 for security fixes.
securityCombined grpc, x/net, and x/text security updates
Combined security updates were applied to grpc, x/net, and x/text.
securitygolang.org/x/net v0.56.0
The golang.org/x/net module was updated to v0.56.0 for security fixes.
securitygolang.org/x/text v0.39.0
The golang.org/x/text module was updated to v0.39.0 for security fixes.
securityVulnerable dependency updates
Vulnerable dependencies were updated for security fixes.
securitygithub.com/sigstore/sigstore-go v1.2.1
The github.com/sigstore/sigstore-go module was updated to v1.2.1 for security fixes.
securitygolang.org/x/mod v0.40.0
The golang.org/x/mod module was updated to v0.40.0 for security fixes.

Check if affected (4)

breakingCrossplane CLI publication location and binary name
Applies if you use the Crossplane CLI.
The Crossplane CLI is no longer published to releases.crossplane.io. New releases are published only to cli.crossplane.io, with the binary name crossplane instead of crank.
breakingspec.replicas behavior in DeploymentRuntimeConfig
Applies if DeploymentRuntimeConfig configures spec.replicas.
Scaling to zero takes precedence over an explicit spec.replicas in a DeploymentRuntimeConfig. The field now specifies how many replicas to run while the runtime is active rather than requiring it to remain running.
breakingNarrowed composed resource garbage collection
Applicability is not stated in the release notes.
The composed resource garbage collector now deletes only resources whose controller reference points back to the XR.
+ 1 more on the release page

Plan ahead (1)

deprecatedCrossplane v1.20 support endremoval planned in v2.5 (Nov 2026)
Applies when v2.5 is released in Nov 2026 and Crossplane v1.20 runs.
When v2.5 is released in Nov 2026, Crossplane v1.20 reaches EOL and no longer receives support or maintenance from the Crossplane project.

Source ↗

Crossplanev2.3.4Orchestration & ManagementJul 23, 2026

ACTION 7OTHER 5View full analysis

This release includes operator-visible defect corrections and an image-build behavior change alongside dependency updates for security fixes. Upgrading incorporates the security fixes in the dependency updates, while the remaining changes require no setup action.

Action needed (7)

securityThe github.com/sigstore/rekor module update to v1.5.2
Crossplane v2.3.4 updates the github.com/sigstore/rekor module to v1.5.2 for security fixes.
securityThe github.com/sigstore/cosign/v3 module update to v3.0.6
Crossplane v2.3.4 updates the github.com/sigstore/cosign/v3 module to v3.0.6 for security fixes.
securityThe github.com/sigstore/timestamp-authority/v2 module update to v2.1.0
Crossplane v2.3.4 updates the github.com/sigstore/timestamp-authority/v2 module to v2.1.0 for security fixes.
securityThe github.com/sigstore/sigstore-go module update to v1.2.0
Crossplane v2.3.4 updates the github.com/sigstore/sigstore-go module to v1.2.0 for security fixes.
securityCombined security dependency updates
Crossplane v2.3.4 includes combined security updates for grpc, golang.org/x/net, and golang.org/x/text.
securityThe golang.org/x/text module update to v0.39.0
Crossplane v2.3.4 updates the golang.org/x/text module to v0.39.0 for security fixes.
securityThe golang.org/x/net module update to v0.56.0
Crossplane v2.3.4 updates the golang.org/x/net module to v0.56.0 for security fixes.

Source ↗

Crossplanev2.2.4Orchestration & ManagementJul 23, 2026

ACTION 5OTHER 2View full analysis

Crossplane v2.2.4 fixes a Usage-controller reconciliation defect and changes image builds to use buildGoModule, so published images can be scanned by standard vulnerability tooling. It also includes security-related dependency updates.

Action needed (5)

securityThe github.com/sigstore/rekor module update to v1.5.2
Crossplane v2.2.4 updates the github.com/sigstore/rekor module to v1.5.2.
securityThe github.com/sigstore/cosign/v3 module update to v3.0.6
Crossplane v2.2.4 updates the github.com/sigstore/cosign/v3 module to v3.0.6.
securityThe github.com/sigstore/timestamp-authority/v2 module update to v2.1.0
Crossplane v2.2.4 updates the github.com/sigstore/timestamp-authority/v2 module to v2.1.0.
securityThe github.com/sigstore/sigstore-go module update to v1.2.0
Crossplane v2.2.4 updates the github.com/sigstore/sigstore-go module to v1.2.0.
securityCombined grpc, x/net, and x/text dependency updates
Crossplane v2.2.4 applies combined security updates to grpc, x/net, and x/text.

Source ↗

Crossplanev2.1.8Orchestration & ManagementJul 23, 2026

ACTION 7OTHER 1View full analysis

Crossplane v2.1.8 is a maintenance release with several security-related dependency and toolchain updates. It also fixes repeated owner updates for composed Usages by checking all owner references instead of only the first.

Action needed (7)

securityThe github.com/sigstore/rekor module at v1.5.2
The github.com/sigstore/rekor module is updated to v1.5.2 in Crossplane v2.1.8.
securityThe github.com/sigstore/timestamp-authority/v2 module at v2.1.0
The github.com/sigstore/timestamp-authority/v2 module is updated to v2.1.0 in Crossplane v2.1.8.
securityThe github.com/sigstore/cosign/v2 module at v2.6.3
The github.com/sigstore/cosign/v2 module is updated to v2.6.3 in Crossplane v2.1.8.
securityThe Go toolchain at 1.25.12
The Go toolchain is updated to 1.25.12 in Crossplane v2.1.8.
securityThe github.com/sigstore/sigstore-go module at v1.2.0
The github.com/sigstore/sigstore-go module is updated to v1.2.0 in Crossplane v2.1.8.
securityCombined grpc, x/net, and x/text dependency updates
Combined security dependency updates cover grpc, x/net, and x/text in Crossplane v2.1.8.
securityThe golang.org/x/text module at v0.39.0
The golang.org/x/text module is updated to v0.39.0 in Crossplane v2.1.8.

Source ↗

Crossplanev1.20.11Orchestration & ManagementJul 23, 2026

ACTION 4OTHER 1View full analysis

A maintenance release fixes repeated owner updates in the Usage controller and includes security-related dependency and toolchain upgrades. It updates the runtime dependency set, Go toolchain, and Alpine base image in the release-1.20 line.

Action needed (4)

securityThe github.com/sigstore/rekor module, updated to v1.5.2
The github.com/sigstore/rekor module is updated to v1.5.2 in the release-1.20 line.
securityThe Go toolchain, updated to 1.25.12
The Go toolchain is updated to 1.25.12 in the release-1.20 line.
securityThe alpine Docker tag, updated to v3.24
The alpine Docker tag is updated to v3.24 in the release-1.20 line.
securitySecurity updates for grpc, x/net, and x/text
Security updates are applied to grpc, x/net, and x/text in the release-1.20 line.

Source ↗

Crossplanev2.3.3Orchestration & ManagementJun 22, 2026

ACTION 2OTHER 1View full analysis

Crossplane v2.3.3 is a maintenance release with security fixes delivered through dependency and toolchain updates. It also corrects namespace handling for injected resource references in crossplane render, so rendered output matches reconciler behavior for cluster-scoped XRs.

Action needed (2)

securityPackage signature verification TOCTOU fix, GHSA-mf7q-r4rv-jv94
The package signature verification TOCTOU flaw identified by GHSA-mf7q-r4rv-jv94 is fixed through the crossplane-runtime v2.3.3 dependency bump. The affected code moved from crossplane to crossplane-runtime during the v2.3 milestone, so this fix ships through that dependency in Crossplane v2.3.3.
securityGo 1.25.11, golang.org/x/net, and golang.org/x/sys updates
The release-2.3 branch bumps Go to 1.25.11 and updates golang.org/x/net and golang.org/x/sys for CVE-related security fixes.

Source ↗

Crossplanev2.2.3Orchestration & ManagementJun 22, 2026

ACTION 1OTHER 3View full analysis

This release includes a security fix for package signature verification and updates to dependencies. It concerns deployments affected by the disclosed package-signature-verification flaw or by the updated dependency versions.

Action needed (1)

securitycriticalPackage signature verification TOCTOU fix, GHSA-wfqx-gjrf-g28r
Crossplane v2.2.3 fixes the package signature verification TOCTOU issue identified by GHSA-wfqx-gjrf-g28r.

Source ↗

Crossplanev2.1.7Orchestration & ManagementJun 22, 2026

ACTION 3OTHER 1View full analysis

Crossplane v2.1.7 is a maintenance release with dependency and Go toolchain updates. The changes affect the software components shipped with this release.

Action needed (3)

securityThe github.com/quic-go/quic-go module update
The github.com/quic-go/quic-go module is updated to v0.59.1 in Crossplane v2.1.7.
securityThe golang.org/x/net module update
The golang.org/x/net module is updated to v0.55.0 in Crossplane v2.1.7.
securityThe Go toolchain at 1.25.11
The Go toolchain is bumped to 1.25.11 in Crossplane v2.1.7.

Source ↗

Crossplanev1.20.10Orchestration & ManagementJun 22, 2026

ACTION 2OTHER 2View full analysis

A dependency maintenance release with security updates to the Go toolchain and MongoDB driver, alongside routine dependency bumps. Cosign and Docker remediation items were not applied and remain limitations.

Action needed (2)

securityhighThe Go toolchain, updated to 1.25.11
The Go toolchain is updated to 1.25.11, the latest Go 1.25 security patch. The change addresses CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.
securityThe go.mongodb.org/mongo-driver module, updated to v1.17.7
The go.mongodb.org/mongo-driver module is updated to v1.17.7 with a security update.

Source ↗

Crossplanev1.20.9Orchestration & ManagementJun 5, 2026

ACTION 1OTHER 2View full analysis

This Crossplane release combines dependency maintenance with a new CLI check for upgrade readiness. The check scans a live v1.x control plane for features removed or changed in Crossplane v2 and reports what would break before an upgrade.

Action needed (1)

securityThe golang.org/x/net module, updated to v0.55.0
The golang.org/x/net module is updated to v0.55.0 in Crossplane v1.20.9. The release note marks this dependency update as security-related, but does not identify a specific vulnerability.

Source ↗

Crossplanev2.3.1Orchestration & ManagementMay 22, 2026

ACTION 1CHECK 13OTHER 1View full analysis

A maintenance release includes dependency updates and security fixes in golang.org/x/crypto. The fixes cover SSH, SSH agent, and known-hosts behavior.

Action needed (1)

securitygolang.org/x/crypto updated to v0.52.0
The release updates the golang.org/x/crypto module to v0.52.0.

Check if affected (13)

securitycriticalUnenforced invoking key constraints in golang.org/x/crypto/ssh/agent
Applies if you use golang.org/x/crypto/ssh/agent.
The release corrects unenforced invoking key constraints in golang.org/x/crypto/ssh/agent. The issue is tracked as CVE-2026-39833 and GO-2026-5005.
securitycriticalDropped invoking agent constraints in golang.org/x/crypto/ssh/agent
Applies if you use golang.org/x/crypto/ssh/agent.
The release corrects dropped invoking agent constraints when forwarding keys in golang.org/x/crypto/ssh/agent. The issue is tracked as CVE-2026-39832 and GO-2026-5006.
securitycriticalServer deadlock on unexpected responses in golang.org/x/crypto/ssh
Applies if you use golang.org/x/crypto/ssh.
The release corrects an invoking client condition that can cause a server deadlock on unexpected responses in golang.org/x/crypto/ssh. The issue is tracked as CVE-2026-39830 and GO-2026-5017.
+ 10 more on the release page

Source ↗

Crossplanev1.20.8Orchestration & ManagementMay 22, 2026

ACTION 7OTHER 1View full analysis

Crossplane v1.20.8 is a dependency and toolchain maintenance release. It updates several modules and the Go version, with the recorded dependency changes addressing security fixes, and also bumps crossplane-runtime to v1.20.8.

Action needed (7)

securityThe github.com/docker/cli module, updated to v29.2.0+incompatible
The github.com/docker/cli module is updated to v29.2.0+incompatible in the release-1.20 branch.
securityThe golang.org/x/net module, updated to v0.53.0
The golang.org/x/net module is updated to v0.53.0 in the release-1.20 branch.
securityThe github.com/in-toto/in-toto-golang module, updated to v0.11.0
The github.com/in-toto/in-toto-golang module is updated to v0.11.0 in the release-1.20 branch.
securityThe github.com/go-git/go-git/v5 module, updated to v5.19.0
The github.com/go-git/go-git/v5 module is updated to v5.19.0 in the release-1.20 branch.
securityThe Go toolchain, updated to 1.25.10
Go is updated to 1.25.10 to fix standard-library CVEs in the release-1.20 branch.
securityThe github.com/go-git/go-git/v5 module, updated to v5.19.1
The github.com/go-git/go-git/v5 module is updated again, to v5.19.1, in the release-1.20 branch.
securityThe golang.org/x/crypto module, updated to v0.52.0
The golang.org/x/crypto module is updated to v0.52.0 in the release-1.20 branch.

Source ↗

Crossplanev2.1.6Orchestration & ManagementMay 22, 2026

ACTION 6CHECK 1OTHER 1View full analysis

A security-focused maintenance release updates Go and several dependencies, including a fix for an HTTP/2 transport infinite-loop vulnerability. The Go and dependency version increases require upgrading; no configuration migration or deprecation is announced.

Action needed (6)

securityThe go.opentelemetry.io/otel module update
The go.opentelemetry.io/otel module is updated to v1.41.0 in this release.
securityThe github.com/in-toto/in-toto-golang module update
The github.com/in-toto/in-toto-golang module is updated to v0.11.0 in this release.
securityThe github.com/go-git/go-git/v5 module update to v5.19.0
The github.com/go-git/go-git/v5 module is updated to v5.19.0 in this release.
securityGo 1.25.10
Go is updated to 1.25.10 to fix standard library CVEs.
securityThe github.com/go-git/go-git/v5 module update to v5.19.1
The github.com/go-git/go-git/v5 module is updated to v5.19.1 in this release.
securityThe golang.org/x/crypto module update
The golang.org/x/crypto module is updated to v0.52.0 in this release.

Check if affected (1)

securityhighThe golang.org/x/net HTTP/2 transport infinite loop
Applicability is not stated in the release notes.
The golang.org/x/net HTTP/2 transport infinite-loop issue caused by an invalid SETTINGS_MAX_FRAME_SIZE is fixed in v0.53.0. The issue is tracked as BIT-golang-2026-33814, CVE-2026-33814, and GO-2026-4918.

Source ↗

Crossplanev2.2.2Orchestration & ManagementMay 22, 2026

ACTION 5OTHER 1View full analysis

Crossplane v2.2.2 is a dependency and toolchain maintenance release with security-focused updates. It concerns deployments and builds that rely on the updated Go toolchain and modules.

Action needed (5)

securitygithub.com/in-toto/in-toto-golang updated to v0.11.0
Crossplane v2.2.2 updates the github.com/in-toto/in-toto-golang module to v0.11.0. The update ships in the release-2.2 line.
securitygithub.com/go-git/go-git/v5 updated to v5.19.0
Crossplane v2.2.2 updates the github.com/go-git/go-git/v5 module to v5.19.0. The update ships in the release-2.2 line.
securityGo 1.25.10 update for standard-library CVEs
Crossplane v2.2.2 updates Go to 1.25.10 to fix standard-library CVEs. The toolchain update ships in the release-2.2 line.
securitygithub.com/go-git/go-git/v5 updated to v5.19.1
Crossplane v2.2.2 updates the github.com/go-git/go-git/v5 module to v5.19.1. The update ships in the release-2.2 line.
securitygolang.org/x/crypto updated to v0.52.0
Crossplane v2.2.2 updates the golang.org/x/crypto module to v0.52.0. The update ships in the release-2.2 line.

Source ↗

Crossplanev2.3.0Orchestration & ManagementMay 21, 2026

ACTION 14CHECK 3OTHER 20View full analysis

Crossplane v2.3.0 combines breaking API naming and path changes with new operator capabilities and correctness fixes. It also updates several Go dependencies and the Go toolchain, which matters to API consumers and builds that depend on the affected packages.

Action needed (14)

securityThe github.com/cloudflare/circl dependency, updated to v1.6.3
The github.com/cloudflare/circl module is updated to v1.6.3 in Crossplane v2.3.0.
securityThe google.golang.org/grpc dependency, updated to v1.79.3
The google.golang.org/grpc module is updated to v1.79.3 in Crossplane v2.3.0.
securityThe go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp dependency, updated to v1.43.0
The go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp module is updated to v1.43.0 in Crossplane v2.3.0.
securityThe github.com/go-git/go-git/v5 dependency, updated to v5.17.1
The github.com/go-git/go-git/v5 module is updated to v5.17.1 in Crossplane v2.3.0.
securityThe github.com/go-jose/go-jose/v4 dependency, updated to v4.1.4
The github.com/go-jose/go-jose/v4 module is updated to v4.1.4 in Crossplane v2.3.0.
securityThe github.com/sigstore/cosign/v3 dependency, updated to v3.0.5
The github.com/sigstore/cosign/v3 module is updated to v3.0.5 in Crossplane v2.3.0.
securityThe github.com/docker/cli dependency, updated to v29.2.0+incompatible
The github.com/docker/cli module is updated to v29.2.0+incompatible in Crossplane v2.3.0.
securityThe github.com/sigstore/timestamp-authority/v2 dependency, updated to v2.0.6
The github.com/sigstore/timestamp-authority/v2 module is updated to v2.0.6 in Crossplane v2.3.0.
securityThe Go toolchain, updated to 1.25.9
The Go toolchain is updated to 1.25.9 in Crossplane v2.3.0.
securityThe github.com/moby/spdystream dependency, updated to v0.5.1
The github.com/moby/spdystream module is updated to v0.5.1 in Crossplane v2.3.0.
securityThe github.com/go-git/go-git/v5 dependency, updated to v5.18.0
The github.com/go-git/go-git/v5 module is updated to v5.18.0 in Crossplane v2.3.0.
securityThe github.com/in-toto/in-toto-golang dependency, updated to v0.11.0
The github.com/in-toto/in-toto-golang module is updated to v0.11.0 in Crossplane v2.3.0.
securityThe golang.org/x/net dependency, updated to v0.53.0
The golang.org/x/net module is updated to v0.53.0 in Crossplane v2.3.0.
securityThe Go toolchain, updated to 1.25.10
The Go toolchain is updated to 1.25.10 in Crossplane v2.3.0 to fix standard library CVEs.

Check if affected (3)

breakingThe Crossplane API dependency path, renamed
Applies if you build external consumers of Crossplane APIs.
External consumers of Crossplane APIs should change the dependency path from github.com/crossplane/crossplane/v2/apis to github.com/crossplane/crossplane/apis/v2 in Crossplane v2.3.0.
breakingThe common API package, moved
Applies if you use the common APIs from crossplane-runtime.
The common APIs previously provided by crossplane-runtime now ship at github.com/crossplane/crossplane/apis/v2/core in Crossplane v2.3.0.
breakingThe v1.Resource* types, renamed
Applies if you use the old v1.Resource* types.
The old v1.Resource* types are now named v2.ClusterManagedResource*, distinguishing them from the namespaced v2.ManagedResource* types in Crossplane v2.3.0.

Source ↗

Crossplanev1.20.7Orchestration & ManagementApr 24, 2026

ACTION 1View full analysis

This release updates the Go toolchain in Crossplane to 1.25.9. The change addresses undisclosed standard-library CVEs.

Action needed (1)

securityThe Go toolchain, updated to 1.25.9
Crossplane v1.20.7 updates the Go toolchain to 1.25.9. The update addresses undisclosed standard-library CVEs.

Source ↗

Crossplanev2.2.1Orchestration & ManagementApr 20, 2026

ACTION 10OTHER 3View full analysis

Crossplane v2.2.1 includes security-focused dependency updates and a move to Go 1.25.9. It also corrects operator-facing behavior around dependency upgrades with ImageConfig prefix rewrites and resource selectors, and bumps Crossplane Runtime to v2.2.1.

Action needed (10)

securityThe github.com/cloudflare/circl module, updated to v1.6.3
Crossplane v2.2.1 updates the github.com/cloudflare/circl module to v1.6.3 as a security dependency change.
securityThe go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp module, updated to v1.43.0
Crossplane v2.2.1 updates the go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp module to v1.43.0 as a security dependency change.
securityThe github.com/go-jose/go-jose/v4 module, updated to v4.1.4
Crossplane v2.2.1 updates the github.com/go-jose/go-jose/v4 module to v4.1.4 as a security dependency change.
securityThe github.com/sigstore/cosign/v3 module, updated to v3.0.5
Crossplane v2.2.1 updates the github.com/sigstore/cosign/v3 module to v3.0.5 as a security dependency change.
securityThe github.com/go-git/go-git/v5 module, updated to v5.17.1
Crossplane v2.2.1 updates the github.com/go-git/go-git/v5 module to v5.17.1 as a security dependency change.
securityThe github.com/docker/cli module, updated to v29.2.0+incompatible
Crossplane v2.2.1 updates the github.com/docker/cli module to v29.2.0+incompatible as a security dependency change.
securityGo 1.25.9
Crossplane v2.2.1 updates Go to 1.25.9 as a security dependency change.
securityThe github.com/moby/spdystream module, updated to v0.5.1
Crossplane v2.2.1 updates the github.com/moby/spdystream module to v0.5.1 as a security dependency change.
securityThe github.com/sigstore/timestamp-authority/v2 module, updated to v2.0.6
Crossplane v2.2.1 updates the github.com/sigstore/timestamp-authority/v2 module to v2.0.6 as a security dependency change.
securityThe github.com/go-git/go-git/v5 module, updated to v5.18.0
Crossplane v2.2.1 updates the github.com/go-git/go-git/v5 module to v5.18.0 as a security dependency change.

Source ↗

Crossplanev2.1.5Orchestration & ManagementApr 20, 2026

ACTION 10OTHER 4View full analysis

Crossplane v2.1.5 combines correctness fixes with dependency and Go toolchain updates. The release includes updated versions of several modules used by Crossplane.

Action needed (10)

securityThe github.com/cloudflare/circl module, updated to v1.6.3
Crossplane v2.1.5 updates the github.com/cloudflare/circl module to v1.6.3.
securityThe google.golang.org/grpc module, updated to v1.79.3
Crossplane v2.1.5 updates the google.golang.org/grpc module to v1.79.3.
securityThe go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp module, updated to v1.43.0
Crossplane v2.1.5 updates the go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp module to v1.43.0.
securityThe github.com/go-jose/go-jose/v4 module, updated to v4.1.4
Crossplane v2.1.5 updates the github.com/go-jose/go-jose/v4 module to v4.1.4.
securityThe Go toolchain, updated to 1.25.9
Crossplane v2.1.5 updates the Go toolchain to 1.25.9.
securityThe github.com/go-git/go-git/v5 module, updated to v5.17.1
Crossplane v2.1.5 updates the github.com/go-git/go-git/v5 module to v5.17.1.
securityThe github.com/moby/spdystream module, updated to v0.5.1
Crossplane v2.1.5 updates the github.com/moby/spdystream module to v0.5.1.
securityThe github.com/sigstore/timestamp-authority/v2 module, updated to v2.0.6
Crossplane v2.1.5 updates the github.com/sigstore/timestamp-authority/v2 module to v2.0.6.
securityThe github.com/docker/cli module, updated to v29.2.0+incompatible
Crossplane v2.1.5 updates the github.com/docker/cli module to v29.2.0+incompatible.
securityThe github.com/go-git/go-git/v5 module, updated to v5.18.0
Crossplane v2.1.5 updates the github.com/go-git/go-git/v5 module to v5.18.0.

Source ↗

Crossplanev2.0.8Orchestration & ManagementApr 20, 2026

ACTION 9OTHER 3View full analysis

Crossplane v2.0.8 corrects two operator-visible defects and updates Go plus several dependencies. The dependency changes are marked for security, but the disclosures identify only the affected components rather than specific advisory IDs.

Action needed (9)

securityThe github.com/cloudflare/circl module update
The github.com/cloudflare/circl module is updated to v1.6.3 in Crossplane v2.0.8.
securityThe OTLP HTTP trace exporter module update
The go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp module is updated to v1.43.0 in Crossplane v2.0.8.
securityThe github.com/go-jose/go-jose/v4 module update
The github.com/go-jose/go-jose/v4 module is updated to v4.1.4 in Crossplane v2.0.8.
securityThe Go version update to 1.25.9
Go is updated to 1.25.9 in Crossplane v2.0.8.
securityThe github.com/go-git/go-git/v5 module update to v5.17.1
The github.com/go-git/go-git/v5 module is updated to v5.17.1 in Crossplane v2.0.8.
securityThe github.com/moby/spdystream module update
The github.com/moby/spdystream module is updated to v0.5.1 in Crossplane v2.0.8.
securityThe github.com/docker/cli module update
The github.com/docker/cli module is updated to v29.2.0+incompatible in Crossplane v2.0.8.
securityThe github.com/sigstore/timestamp-authority/v2 module update
The github.com/sigstore/timestamp-authority/v2 module is updated to v2.0.6 in Crossplane v2.0.8.
securityThe github.com/go-git/go-git/v5 module update to v5.18.0
The github.com/go-git/go-git/v5 module is updated to v5.18.0 in Crossplane v2.0.8.

Source ↗

Crossplanev1.20.6Orchestration & ManagementApr 20, 2026

ACTION 5OTHER 1View full analysis

Crossplane v1.20.6 is a dependency-focused release with updates to several Go modules, including security-marked changes. It also includes an update to crossplane-runtime v1.20.6.

Action needed (5)

securityThe github.com/cloudflare/circl module, updated to v1.6.3
The github.com/cloudflare/circl module is updated to v1.6.3 in Crossplane v1.20.6. The release note marks this dependency update as security-related.
securityThe go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp module, updated to v1.43.0
The go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp module is updated to v1.43.0 in Crossplane v1.20.6. The release note marks this dependency update as security-related.
securityThe github.com/go-git/go-git/v5 module, updated to v5.17.1
The github.com/go-git/go-git/v5 module is updated to v5.17.1 in Crossplane v1.20.6. The release note marks this dependency update as security-related.
securityThe github.com/moby/spdystream module, updated to v0.5.1
The github.com/moby/spdystream module is updated to v0.5.1 in Crossplane v1.20.6. The release note marks this dependency update as security-related.
securityThe github.com/go-git/go-git/v5 module, updated to v5.18.0
The github.com/go-git/go-git/v5 module is updated to v5.18.0 in Crossplane v1.20.6. The release note marks this dependency update as security-related.

Source ↗

Crossplanev2.2.0Orchestration & ManagementFeb 17, 2026

ACTION 7CHECK 2OTHER 41View full analysis

A release with breaking changes to package installation and package-cache side-loading, alongside new operator capabilities and ordinary defect corrections. It also includes security-tagged dependency updates, but no advisory identifiers or vulnerability details are provided.

Action needed (7)

securitySecurity update for golang.org/x/crypto
The golang.org/x/crypto module was updated to v0.45.0 as a security update.
securitySecurity update for github.com/go-chi/chi/v5
The github.com/go-chi/chi/v5 module was updated to v5.2.4 as a security update.
securitySecurity update for github.com/sigstore/cosign/v3
The github.com/sigstore/cosign/v3 module was updated to v3.0.4 as a security update.
securitySecurity update for github.com/theupdateframework/go-tuf/v2
The github.com/theupdateframework/go-tuf/v2 module was updated to v2.4.1 as a security update.
securitySecurity update for github.com/sigstore/rekor
The github.com/sigstore/rekor module was updated to v1.5.0 as a security update.
securitySecurity update for github.com/sigstore/sigstore
The github.com/sigstore/sigstore module was updated to v1.10.4 as a security update.
securitySecurity update for github.com/quic-go/quic-go
The github.com/quic-go/quic-go module was updated to v0.57.0 as a security update.

Check if affected (2)

breakingInput CRD installation from Function packages
Applies if you use Function packages and Input CRDs.
Input CRDs included in Function packages are no longer installed by the package manager.
breakingPackage cache structure
Applicability is not stated in the release notes.
The on-disk structure of the package cache has changed. This breaks the undocumented behavior that allowed packages to be side-loaded into Crossplane.

Source ↗

Crossplanev2.1.4Orchestration & ManagementFeb 3, 2026

ACTION 4OTHER 2View full analysis

Crossplane v2.1.4 is a maintenance release with security-related dependency updates. It also includes corrections for shared transitive dependency upgrades, so the release concerns operators tracking dependency and security fixes.

Action needed (4)

securityThe github.com/quic-go/quic-go module, updated to v0.57.0
The release updates the github.com/quic-go/quic-go module to v0.57.0 as a security-related dependency change.
securitysigstore dependency updates for CVEs
The release updates sigstore dependencies to fix CVEs.
securityThe github.com/theupdateframework/go-tuf/v2 module, updated to v2.4.1
The release updates the github.com/theupdateframework/go-tuf/v2 module to v2.4.1 as a security-related dependency change.
securityThe github.com/go-chi/chi/v5 module, updated to v5.2.4
The release updates the github.com/go-chi/chi/v5 module to v5.2.4 as a security-related dependency change.

Source ↗

Crossplanev2.0.7Orchestration & ManagementFeb 3, 2026

ACTION 1OTHER 2View full analysis

This release updates a security-related dependency and corrects shared transitive dependency upgrades. It also fixes propagation of composite identity through nested XR trees.

Action needed (1)

securityThe github.com/theupdateframework/go-tuf/v2 dependency, updated to v2.4.1
The github.com/theupdateframework/go-tuf/v2 module is updated to v2.4.1 in the release-2.0 branch.

Source ↗

Crossplanev1.20.5Orchestration & ManagementFeb 3, 2026

ACTION 1OTHER 1View full analysis

Crossplane v1.20.5 is a maintenance release focused on dependency updates. It includes a security-related update to sigstore dependencies and addresses a defect in shared transitive dependency upgrades.

Action needed (1)

securityThe sigstore dependencies, updated for CVE fixes
The release-1.20 branch updates sigstore dependencies to fix CVEs.

Source ↗

Browse by month