Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Jun 2026Clear ×Project: CrossplaneClear ×

Crossplanev2.3.3Orchestration & ManagementJun 22, 2026

ACTION 2OTHER 1View full analysis

Crossplane v2.3.3 is a maintenance release with security fixes delivered through dependency and toolchain updates. It also corrects namespace handling for injected resource references in crossplane render, so rendered output matches reconciler behavior for cluster-scoped XRs.

Action needed (2)

securityPackage signature verification TOCTOU fix, GHSA-mf7q-r4rv-jv94
The package signature verification TOCTOU flaw identified by GHSA-mf7q-r4rv-jv94 is fixed through the crossplane-runtime v2.3.3 dependency bump. The affected code moved from crossplane to crossplane-runtime during the v2.3 milestone, so this fix ships through that dependency in Crossplane v2.3.3.
securityGo 1.25.11, golang.org/x/net, and golang.org/x/sys updates
The release-2.3 branch bumps Go to 1.25.11 and updates golang.org/x/net and golang.org/x/sys for CVE-related security fixes.

Source ↗

Crossplanev2.2.3Orchestration & ManagementJun 22, 2026

ACTION 1OTHER 3View full analysis

This release includes a security fix for package signature verification and updates to dependencies. It concerns deployments affected by the disclosed package-signature-verification flaw or by the updated dependency versions.

Action needed (1)

securitycriticalPackage signature verification TOCTOU fix, GHSA-wfqx-gjrf-g28r
Crossplane v2.2.3 fixes the package signature verification TOCTOU issue identified by GHSA-wfqx-gjrf-g28r.

Source ↗

Crossplanev2.1.7Orchestration & ManagementJun 22, 2026

ACTION 3OTHER 1View full analysis

Crossplane v2.1.7 is a maintenance release with dependency and Go toolchain updates. The changes affect the software components shipped with this release.

Action needed (3)

securityThe github.com/quic-go/quic-go module update
The github.com/quic-go/quic-go module is updated to v0.59.1 in Crossplane v2.1.7.
securityThe golang.org/x/net module update
The golang.org/x/net module is updated to v0.55.0 in Crossplane v2.1.7.
securityThe Go toolchain at 1.25.11
The Go toolchain is bumped to 1.25.11 in Crossplane v2.1.7.

Source ↗

Crossplanev1.20.10Orchestration & ManagementJun 22, 2026

ACTION 2OTHER 2View full analysis

A dependency maintenance release with security updates to the Go toolchain and MongoDB driver, alongside routine dependency bumps. Cosign and Docker remediation items were not applied and remain limitations.

Action needed (2)

securityhighThe Go toolchain, updated to 1.25.11
The Go toolchain is updated to 1.25.11, the latest Go 1.25 security patch. The change addresses CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.
securityThe go.mongodb.org/mongo-driver module, updated to v1.17.7
The go.mongodb.org/mongo-driver module is updated to v1.17.7 with a security update.

Source ↗

Crossplanev1.20.9Orchestration & ManagementJun 5, 2026

ACTION 1OTHER 2View full analysis

This Crossplane release combines dependency maintenance with a new CLI check for upgrade readiness. The check scans a live v1.x control plane for features removed or changed in Crossplane v2 and reports what would break before an upgrade.

Action needed (1)

securityThe golang.org/x/net module, updated to v0.55.0
The golang.org/x/net module is updated to v0.55.0 in Crossplane v1.20.9. The release note marks this dependency update as security-related, but does not identify a specific vulnerability.

Source ↗

Browse by month