Crossplane

Developer Tools

A control plane framework that provisions cloud infrastructure through the Kubernetes API.

Latest v2.3.4 · by CNCFWebsitecrossplane/crossplane

Release activity

Release activity — 10 releases across 4 days since Jun 5, 2026. Each cell is one day; darker means more releases that day. Nothing is recorded before Jun 5, 2026. Older weeks are hidden at this screen width.
MayJunJulAug
SundayNo releases on Jun 7, 2026No releases on Jun 14, 2026No releases on Jun 21, 2026No releases on Jun 28, 2026No releases on Jul 5, 2026No releases on Jul 12, 2026No releases on Jul 19, 2026No releases on Jul 26, 2026No releases on Aug 2, 2026No releases on Aug 9, 2026
MondayNo releases on Jun 8, 2026No releases on Jun 15, 20264 releases on Jun 22, 2026No releases on Jun 29, 2026No releases on Jul 6, 2026No releases on Jul 13, 2026No releases on Jul 20, 2026No releases on Jul 27, 2026No releases on Aug 3, 2026No releases on Aug 10, 2026
Tuesday1 release on Jun 9, 2026No releases on Jun 16, 2026No releases on Jun 23, 2026No releases on Jun 30, 2026No releases on Jul 7, 2026No releases on Jul 14, 2026No releases on Jul 21, 2026No releases on Jul 28, 2026No releases on Aug 4, 2026No releases on Aug 11, 2026
WednesdayNo releases on Jun 10, 2026No releases on Jun 17, 2026No releases on Jun 24, 2026No releases on Jul 1, 2026No releases on Jul 8, 2026No releases on Jul 15, 2026No releases on Jul 22, 2026No releases on Jul 29, 2026No releases on Aug 5, 2026
ThursdayNo releases on Jun 11, 2026No releases on Jun 18, 2026No releases on Jun 25, 2026No releases on Jul 2, 2026No releases on Jul 9, 2026No releases on Jul 16, 20264 releases on Jul 23, 2026No releases on Jul 30, 2026No releases on Aug 6, 2026
Friday1 release on Jun 5, 2026No releases on Jun 12, 2026No releases on Jun 19, 2026No releases on Jun 26, 2026No releases on Jul 3, 2026No releases on Jul 10, 2026No releases on Jul 17, 2026No releases on Jul 24, 2026No releases on Jul 31, 2026No releases on Aug 7, 2026
SaturdayNo releases on Jun 6, 2026No releases on Jun 13, 2026No releases on Jun 20, 2026No releases on Jun 27, 2026No releases on Jul 4, 2026No releases on Jul 11, 2026No releases on Jul 18, 2026No releases on Jul 25, 2026No releases on Aug 1, 2026No releases on Aug 8, 2026

10 releases since Jun 5, 2026, busiest day 4

Changelog

v2.3.4

Changed 1
  • Container images are now built with buildGoModule instead of gomod2nix to enable vulnerability scanning by standard tooling
Fixed 3
  • Usage controller now checks all owner references instead of only the first one, preventing repeated owner updates for composed Usages that trigger unnecessary composition reconciliation
  • crossplane render command no longer overwrites the input XR's UID when one is already set
  • crossplane render command now validates observed resources before proceeding with the render
Security 7
  • Update grpc to fix upstream CVEs
  • Update golang.org/x/net to v0.56.0 to fix upstream CVEs
  • Update golang.org/x/text to v0.39.0 to fix upstream CVEs
  • Update github.com/sigstore/cosign/v3 to v3.0.6 to fix upstream CVEs
  • Update github.com/sigstore/rekor to v1.5.2 to fix upstream CVEs
  • Update github.com/sigstore/timestamp-authority/v2 to v2.1.0 to fix upstream CVEs
  • Update github.com/sigstore/sigstore-go to v1.2.0 to fix upstream CVEs

v2.3.4 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights

  • Fixed repeated owner updates for composed Usages (#7597, originally #7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so spec.by ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.
  • crossplane render fixes (#7599, originally #7544): render no longer overwrites the input XR's UID when one is already set, and now validates observed resources before proceeding with the render.
  • Vulnerability-scannable images (#7574): Container images are now built with buildGoModule (replacing gomod2nix), so published images can be scanned by standard vulnerability tooling.
  • Dependency security updates: Bumps grpc / golang.org/x/net / golang.org/x/text (#7618, #7614, #7615) and the sigstore stack — cosign (#7559), rekor (#7560), timestamp-authority (#7570), sigstore-go (#7583) — to pick up upstream CVE fixes. See ## What's Changed for the full list.
What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.3.3...v2.3.4

View originalPermalink
How v2.3.4 went

v2.2.4

Changed 1
  • Container images are now built with buildGoModule instead of gomod2nix to support standard vulnerability scanning tools
Fixed 1
  • Usage controller now checks all owner references instead of only the first one to prevent repeated owner updates for composed Usages
Security 5
  • Updated github.com/sigstore/rekor to v1.5.2 to pick up upstream CVE fixes
  • Updated github.com/sigstore/cosign/v3 to v3.0.6 to pick up upstream CVE fixes
  • Updated github.com/sigstore/timestamp-authority/v2 to v2.1.0 to pick up upstream CVE fixes
  • Updated github.com/sigstore/sigstore-go to v1.2.0 to pick up upstream CVE fixes
  • Updated grpc, golang.org/x/net, and golang.org/x/text to pick up upstream CVE fixes

v2.2.4 is a patch release scoped to fixing issues reported by users of Crossplane v2.2 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights

  • Fixed repeated owner updates for composed Usages (#7596, originally #7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so spec.by ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.
  • Vulnerability-scannable images (#7575): Container images are now built with buildGoModule (replacing gomod2nix), so published images can be scanned by standard vulnerability tooling.
  • Dependency security updates: Bumps grpc / golang.org/x/net / golang.org/x/text (#7619) and the sigstore stack — cosign (#7558), rekor (#7557), timestamp-authority (#7569), sigstore-go (#7582) — to pick up upstream CVE fixes. See ## What's Changed for the full list.
What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.2.3...v2.2.4

View originalPermalink
How v2.2.4 went

v2.1.8

Fixed 1
  • Usage controller now checks all owner references instead of only the first one, preventing repeated owner updates for composed Usages and unnecessary composition reconciliation triggering
Security 7
  • Bump Go toolchain to 1.25.12 to pick up upstream CVE fixes
  • Update github.com/sigstore/rekor to v1.5.2 for security fixes
  • Update github.com/sigstore/timestamp-authority to v2.1.0 for security fixes
  • Update github.com/sigstore/cosign to v2.6.3 for security fixes
  • Update github.com/sigstore/sigstore-go to v1.2.0 for security fixes
  • Update grpc, golang.org/x/net, and golang.org/x/text for security fixes
  • Update golang.org/x/text to v0.39.0 for security fixes

v2.1.8 is a patch release scoped to fixing issues reported by users of Crossplane v2.1 and fixing security related issues in Crossplane's dependencies.

🎉 Highlights

  • Fixed repeated owner updates for composed Usages (#7622, originally #7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so spec.by ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.
  • Dependency security updates: Bumps the Go toolchain to 1.25.12 (#7577), grpc / golang.org/x/net / golang.org/x/text (#7620, #7609), and the sigstore stack — cosign (#7556), rekor (#7555), timestamp-authority (#7568), sigstore-go (#7581) — to pick up upstream CVE fixes. See ## What's Changed for the full list.
What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.1.7...v2.1.8

View originalPermalink
How v2.1.8 went

v1.20.11

Fixed 1
  • Usage controller now checks all owner references instead of only the first one when deciding whether the spec.by resource already owns the Usage, preventing repeated unnecessary updates during reconciliation
Security 4
  • Bumped Go toolchain to 1.25.12 to pick up upstream CVE fixes
  • Updated github.com/sigstore/rekor to v1.5.2
  • Updated grpc, golang.org/x/net, and golang.org/x/text dependencies for security fixes
  • Bumped alpine base image to v3.24 to pick up upstream CVE fixes

v1.20.11 is a patch release scoped to fixing issues reported by users of Crossplane v1.20 and fixing security related issues in Crossplane's dependencies.

🎉 Highlights

  • Fixed repeated owner updates for composed Usages (#7623, originally #7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so spec.by ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.
  • Dependency security updates: Bumps the Go toolchain to 1.25.12 (#7578), grpc / golang.org/x/net / golang.org/x/text (#7621), github.com/sigstore/rekor (#7553), and the alpine base image to v3.24 (#7513) to pick up upstream CVE fixes. See ## What's Changed for the full list.
What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v1.20.10...v1.20.11

View originalPermalink
How v1.20.11 went

v2.3.3

Changed 3
  • Bump Go toolchain to 1.25.11
  • Bump golang.org/x/net and golang.org/x/sys dependencies in the apis module for CVE fixes
  • Update crossplane-runtime to v2.3.3
Fixed 1
  • Correct namespace on injected resource refs in crossplane render to set namespace only for cluster-scoped XRs, matching the real reconciler behavior
Security 1
  • Fix package signature verification TOCTOU flaw that could let a malicious OCI registry pass signature verification with a signed image and then serve unsigned content for installation

v2.3.3 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane's dependencies.

🎉 Highlights

  • Fixed package signature verification TOCTOU (GHSA-mf7q-r4rv-jv94): A time-of-check-to-time-of-use flaw could let a malicious OCI registry pass signature verification with a signed image and then serve unsigned content for installation. For v2.3 this fix ships via the crossplane-runtime v2.3.3 bump in #7541, since the affected code moved from crossplane to crossplane-runtime during the v2.3 milestone. See the crossplane-runtime v2.3.3 release notes for the full details.
  • Correct namespace on injected resource refs in crossplane render: crossplane render previously set a namespace on every injected resource reference, which is inaccurate for namespaced XRs (whose resource refs are local and carry no namespace) and broke composition functions with strict schemas, such as the generated KCL bindings used in control plane projects. Render now matches the real reconciler and sets the namespace only for cluster-scoped XRs. Backported in #7525, originally fixed in #7523.
  • Dependency security updates: This release also bumps the Go toolchain to 1.25.11 and golang.org/x/net and golang.org/x/sys in the apis module to pick up CVE fixes (#7530). See ## What's Changed below for the full list.
What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.3.2...v2.3.3

View originalPermalink
How v2.3.3 went

v2.2.3

Changed 1
  • Update crossplane-runtime to v2.2.3
Security 3
  • Fix package signature verification time-of-check-to-time-of-use flaw that allowed a malicious OCI registry to serve a correctly signed image for verification and then an unsigned image for installation
  • Bump Go toolchain to 1.25.11
  • Bump golang.org/x/net to v0.55.0

v2.2.3 is a patch release scoped to fixing issues reported by users of Crossplane v2.2 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights

  • Fixed package signature verification TOCTOU (GHSA-wfqx-gjrf-g28r): A time-of-check-to-time-of-use flaw would let a malicious OCI registry serve a correctly signed image for verification and then an unsigned image for installation, because Crossplane resolved tag references separately for each step. Crossplane now resolves a tag to a digest once and uses that same digest for both signature verification and the image pull, so the content that is verified is exactly the content that is installed. This affected only users who enable package signature verification, install packages by tag, and pull from registries they don't control. Installing by digest would avoid this issue. Backported in #7520, and reported independently by @bugbunny-research and @tonghuaroot.
    • Note this fix appears in crossplane for v2.2 and crossplane-runtime for v2.3 because the affected code was moved from crossplane to crossplane-runtime during the v2.3 milestone.
  • Dependency security updates: This release also bumps the Go toolchain to 1.25.11 (#7529), golang.org/x/net to v0.55.0 (#7438), and crossplane-runtime to v2.2.3 (#7540), picking up security fixes in those upstream dependencies.
What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.2.2...v2.2.3

View originalPermalink
How v2.2.3 went

v2.1.7

Changed 1
  • Update crossplane-runtime to v2.1.7
Security 3
  • Update module github.com/quic-go/quic-go to v0.59.1
  • Update module golang.org/x/net to v0.55.0
  • Bump Go to 1.25.11

v2.1.7 is a patch release scoped to fixing issues reported by users of Crossplane v2.1 and fixing security related issues in Crossplane's dependencies.

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.1.6...v2.1.7

View originalPermalink
How v2.1.7 went

v1.20.10

Changed 2
  • Update crossplane-runtime to v1.20.10
  • Update curlimages/curl docker tag to v8.20.0
Security 2
  • Bump Go to 1.25.11
  • Update go.mongodb.org/mongo-driver to v1.17.7

v1.20.10 is a patch release scoped to fixing issues reported by users of Crossplane v1.20 and fixing security related issues in Crossplane's dependencies.

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v1.20.9...v1.20.10

View originalPermalink
How v1.20.10 went

v2.3.2

Changed 1
  • bump crossplane-runtime dependency to v2.3.2
Fixed 3
  • render command now honors input XR schema
  • render command returns requirements even on fatal errors
  • add namespace to resourceref stable sort

v2.3.2 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane's dependencies. The primary goal of this release is to fix regressions in the Crossplane CLI's render commands.

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.3.1...v2.3.2

View originalPermalink
How v2.3.2 went

v1.20.9

Added 1
  • Add crossplane beta upgrade check command to analyze a control plane for v2 upgrade readiness, checking for breaking changes including native patch-and-transform Compositions, ControllerConfig usage, external secret stores, and unqualified package sources
Security 1
  • Update golang.org/x/net to v0.55.0

v1.20.9 is a patch release scoped to fixing issues reported by users of Crossplane v1.20 and fixing security related issues in Crossplane's dependencies. It also ships a notable new crossplane beta upgrade check command to help you more easily prepare for Crossplane v2.

🎉 Highlights

  • Check your control plane's v2 upgrade readiness: The new crossplane beta upgrade check command connects to a live v1.x control plane and scans it for usage of features that are removed or have breaking changes in Crossplane v2, then reports exactly what would break before you upgrade. No more manually digging through every Composition, package, and resource to guess whether you're ready. Added in #7451.
    • It checks for all documented breaking changes in v2, i.e., native patch-and-transform Compositions, ControllerConfig usage, external secret stores, and unqualified package sources, plus an informational check for composite resource connection details.
    • Each finding links to the relevant migration guides, docs, and other commands like crossplane beta convert where one exists.
    • Output is human-readable text by default or JSON via -o json, and the command exits non-zero when it finds blockers, so you can gate an upgrade on a clean report in CI.
    • See the announcement blog post for more details.
What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v1.20.8...v1.20.9

View originalPermalink
How v1.20.9 went

More in Developer Tools

View all
yt-dlp

A feature-rich command-line audio/video downloader

yt-dlp
tmux

tmux release notes.

tmux
GitHub CLI

GitHub command-line tool

GitHub
Claude Code

Anthropic's agentic coding tool for the terminal, IDE and web.

Anthropic
Shadowrocket

Rule based proxy utility client for iPhone/iPad.

Shadow Launch Technology Limited
AWS CLI

One tool to manage every AWS service from the command line, and script them.

Amazon Web Services

Discussion