# Crossplane v2.4.0

> Orchestration & Management · 2026-08-20

A release with breaking operational changes, new runtime behavior, and correctness fixes. It also updates the Go toolchain and dependencies for security fixes, including changes that affect CLI publication, package operation, and resource deletion.

## Action needed
- **[security]** `Go` version and dependency security updates
  - Crossplane now builds and runs with a newer `Go` version to include standard library CVE fixes. The release also includes security updates to Crossplane's `Go` dependencies.
- **[security]** `Go` `1.25.10`
  - `Go` was updated to `1.25.10` to fix standard library CVEs.
- **[security]** `golang.org/x/crypto` `v0.52.0`
  - The `golang.org/x/crypto` module was updated to `v0.52.0` for security fixes.
- **[security]** `golang.org/x/sys` `v0.44.0`
  - The `golang.org/x/sys` module was updated to `v0.44.0` for security fixes.
- **[security]** `golang.org/x/net` `v0.55.0`
  - The `golang.org/x/net` module was updated to `v0.55.0` for security fixes.
- **[security]** `github.com/sigstore/cosign/v3` `v3.0.6`
  - The `github.com/sigstore/cosign/v3` module was updated to `v3.0.6` for security fixes.
- **[security]** `github.com/sigstore/rekor` `v1.5.2`
  - The `github.com/sigstore/rekor` module was updated to `v1.5.2` for security fixes.
- **[security]** `github.com/sigstore/timestamp-authority/v2` `v2.1.0`
  - The `github.com/sigstore/timestamp-authority/v2` module was updated to `v2.1.0` for security fixes.
- **[security]** `github.com/sigstore/sigstore-go` `v1.2.0`
  - The `github.com/sigstore/sigstore-go` module was updated to `v1.2.0` for security fixes.
- **[security]** Combined `grpc`, `x/net`, and `x/text` security updates
  - Combined security updates were applied to `grpc`, `x/net`, and `x/text`.
- **[security]** `golang.org/x/net` `v0.56.0`
  - The `golang.org/x/net` module was updated to `v0.56.0` for security fixes.
- **[security]** `golang.org/x/text` `v0.39.0`
  - The `golang.org/x/text` module was updated to `v0.39.0` for security fixes.
- **[security]** Vulnerable dependency updates
  - Vulnerable dependencies were updated for security fixes.
- **[security]** `github.com/sigstore/sigstore-go` `v1.2.1`
  - The `github.com/sigstore/sigstore-go` module was updated to `v1.2.1` for security fixes.
- **[security]** `golang.org/x/mod` `v0.40.0`
  - The `golang.org/x/mod` module was updated to `v0.40.0` for security fixes.

## Check if affected
- **[breaking]** `Crossplane CLI` publication location and binary name
  - Applies if you use the `Crossplane CLI`.
  - The `Crossplane CLI` is no longer published to `releases.crossplane.io`. New releases are published only to `cli.crossplane.io`, with the binary name `crossplane` instead of `crank`.
- **[breaking]** `spec.replicas` behavior in `DeploymentRuntimeConfig`
  - Applies if `DeploymentRuntimeConfig` configures `spec.replicas`.
  - Scaling to zero takes precedence over an explicit `spec.replicas` in a `DeploymentRuntimeConfig`. The field now specifies how many replicas to run while the runtime is active rather than requiring it to remain running.
- **[breaking]** Narrowed composed resource garbage collection
  - Applicability is not stated in the release notes.
  - The composed resource garbage collector now deletes only resources whose controller reference points back to the XR.
- **[breaking]** XR machinery fields in claim to XR synchronization
  - Applies if you run claim to XR syncers.
  - The claim to XR syncers now remove XR machinery fields such as `resourceRefs` and the `crossplane` stanza.

## Plan ahead
- **[deprecated]** `Crossplane v1.20` support end
  - Applies when v2.5 is released in Nov 2026 and `Crossplane v1.20` runs.
  - removal planned in v2.5 (Nov 2026)
  - When v2.5 is released in Nov 2026, `Crossplane v1.20` reaches EOL and no longer receives support or maintenance from the Crossplane project.

## Other recorded changes
- 33 (value_changed 19, defect_corrected 6, added 5, renamed 2, default_changed 1)

[Full analysis](https://ratatosk.io/en/releases/crossplane/v2.4.0)

[Original release notes](https://github.com/crossplane/crossplane/releases/tag/v2.4.0)