# Crossplane v2.4.3

> Orchestration & Management · 2026-10-22

A security-focused maintenance release updates the Go toolchain and vulnerable dependencies and removes compromised CA roots. It also adds corrective behavior for truncated downloads and expands XR and claim scaling where the XRD serves the scale subresource.

## Action needed
- **[security]** The Go toolchain at `1.26.10`
  - The Go toolchain is bumped to `1.26.10`; its `crypto/x509` rejects the compromised eMudhra intermediate certificates associated with CVE-2026-111943.
- **[security]** The `AAA Certificate Services` and `emSign ECC Root CA - G3` roots, removed
  - The image's CA bundle removes the `AAA Certificate Services` and `emSign ECC Root CA - G3` roots associated with CVE-2026-111943.
- **[security]** Vulnerable dependency updates
  - A combined set of vulnerable dependency updates in pull request `#7915` picks up upstream CVE fixes.
- **[security]** The `Go` `1.26.9` build dependency
  - The `release-2.4` build updates `Go` to `1.26.9` as a security dependency change in pull request `#7951`.

## Other recorded changes
- 2 (value_changed 1, constraint_changed 1)

[Full analysis](https://ratatosk.io/en/releases/crossplane/v2.4.3)

[Original release notes](https://github.com/crossplane/crossplane/releases/tag/v2.4.3)