# Crossplane changelog > A control plane framework that provisions cloud infrastructure through the Kubernetes API. - Vendor: CNCF - Category: Developer Tools - Official site: https://www.crossplane.io - Tracked by: What's New (https://whatsnew.fyi/product/crossplane) - Harvested from: GitHub (crossplane/crossplane) - Entries below: 10 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. ## Releases ### v2.3.4 - Date: 2026-07-23 - Version: v2.3.4 - Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.3.4 - Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.3.4 - **fixed** — Usage controller now checks all owner references instead of only the first one, preventing repeated owner updates for composed Usages that trigger unnecessary composition reconciliation - **fixed** — crossplane render command no longer overwrites the input XR's UID when one is already set - **fixed** — crossplane render command now validates observed resources before proceeding with the render - **changed** — Container images are now built with buildGoModule instead of gomod2nix to enable vulnerability scanning by standard tooling - **security** — Update grpc to fix upstream CVEs - **security** — Update golang.org/x/net to v0.56.0 to fix upstream CVEs - **security** — Update golang.org/x/text to v0.39.0 to fix upstream CVEs - **security** — Update github.com/sigstore/cosign/v3 to v3.0.6 to fix upstream CVEs - **security** — Update github.com/sigstore/rekor to v1.5.2 to fix upstream CVEs - **security** — Update github.com/sigstore/timestamp-authority/v2 to v2.1.0 to fix upstream CVEs - **security** — Update github.com/sigstore/sigstore-go to v1.2.0 to fix upstream CVEs `v2.3.4` is a patch release scoped to fixing issues reported by users of Crossplane `v2.3` and fixing security related issues in Crossplane and its dependencies. #### 🎉 Highlights * **Fixed repeated owner updates for composed Usages (#7597, originally #7591):** The Usage controller only checked the *first* `ownerReference` when deciding whether the `spec.by` resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so `spec.by` ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references. * **`crossplane render` fixes (#7599, originally #7544):** `render` no longer overwrites the input XR's UID when one is already set, and now validates observed resources before proceeding with the render. * **Vulnerability-scannable images (#7574):** Container images are now built with `buildGoModule` (replacing `gomod2nix`), so published images can be scanned by standard vulnerability tooling. * **Dependency security updates:** Bumps `grpc` / `golang.org/x/net` / `golang.org/x/text` (#7618, #7614, #7615) and the sigstore stack — `cosign` (#7559), `rekor` (#7560), `timestamp-authority` (#7570), `sigstore-go` (#7583) — to pick up upstream CVE fixes. See `## What's Changed` for the full list. ##### What's Changed * chore(deps): update module github.com/sigstore/rekor to v1.5.2 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7560 * chore(deps): update module github.com/sigstore/cosign/v3 to v3.0.6 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7559 * chore(deps): update module github.com/sigstore/timestamp-authority/v2 to v2.1.0 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7570 * [Backport release-2.3] build(nix): build with buildGoModule so images are vulnerability-scannable by @phisco in https://github.com/crossplane/crossplane/pull/7574 * chore(deps): update module github.com/sigstore/sigstore-go to v1.2.0 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7583 * fix(deps): combined security bumps (grpc, x/net, x/text) (release-2.3) by @lsviben in https://github.com/crossplane/crossplane/pull/7618 * [Backport release-2.3] fix: avoid repeated owner updates for composed Usages by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7597 * [Backport release-2.3] render: Don't overwrite the input XR's UID if it has one and validate observed resources by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7599 * chore(deps): update module golang.org/x/text to v0.39.0 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7615 * chore(deps): update module golang.org/x/net to v0.56.0 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7614 **Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.3.3...v2.3.4 ### v2.2.4 - Date: 2026-07-23 - Version: v2.2.4 - Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.2.4 - Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.2.4 - **fixed** — Usage controller now checks all owner references instead of only the first one to prevent repeated owner updates for composed Usages - **changed** — Container images are now built with buildGoModule instead of gomod2nix to support standard vulnerability scanning tools - **security** — Updated github.com/sigstore/rekor to v1.5.2 to pick up upstream CVE fixes - **security** — Updated github.com/sigstore/cosign/v3 to v3.0.6 to pick up upstream CVE fixes - **security** — Updated github.com/sigstore/timestamp-authority/v2 to v2.1.0 to pick up upstream CVE fixes - **security** — Updated github.com/sigstore/sigstore-go to v1.2.0 to pick up upstream CVE fixes - **security** — Updated grpc, golang.org/x/net, and golang.org/x/text to pick up upstream CVE fixes `v2.2.4` is a patch release scoped to fixing issues reported by users of Crossplane `v2.2` and fixing security related issues in Crossplane and its dependencies. #### 🎉 Highlights * **Fixed repeated owner updates for composed Usages (#7596, originally #7591):** The Usage controller only checked the *first* `ownerReference` when deciding whether the `spec.by` resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so `spec.by` ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references. * **Vulnerability-scannable images (#7575):** Container images are now built with `buildGoModule` (replacing `gomod2nix`), so published images can be scanned by standard vulnerability tooling. * **Dependency security updates:** Bumps `grpc` / `golang.org/x/net` / `golang.org/x/text` (#7619) and the sigstore stack — `cosign` (#7558), `rekor` (#7557), `timestamp-authority` (#7569), `sigstore-go` (#7582) — to pick up upstream CVE fixes. See `## What's Changed` for the full list. ##### What's Changed * chore(deps): update module github.com/sigstore/rekor to v1.5.2 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7557 * fix(deps): update module github.com/sigstore/cosign/v3 to v3.0.6 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7558 * chore(deps): update module github.com/sigstore/timestamp-authority/v2 to v2.1.0 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7569 * [Backport release-2.2] build(nix): build with buildGoModule so images are vulnerability-scannable by @phisco in https://github.com/crossplane/crossplane/pull/7575 * chore(deps): update module github.com/sigstore/sigstore-go to v1.2.0 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7582 * fix(deps): combined security bumps (grpc, x/net, x/text) (release-2.2) by @lsviben in https://github.com/crossplane/crossplane/pull/7619 * [Backport release-2.2] fix: avoid repeated owner updates for composed Usages by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7596 **Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.2.3...v2.2.4 ### v2.1.8 - Date: 2026-07-23 - Version: v2.1.8 - Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.1.8 - Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.1.8 - **fixed** — Usage controller now checks all owner references instead of only the first one, preventing repeated owner updates for composed Usages and unnecessary composition reconciliation triggering - **security** — Bump Go toolchain to 1.25.12 to pick up upstream CVE fixes - **security** — Update github.com/sigstore/rekor to v1.5.2 for security fixes - **security** — Update github.com/sigstore/timestamp-authority to v2.1.0 for security fixes - **security** — Update github.com/sigstore/cosign to v2.6.3 for security fixes - **security** — Update github.com/sigstore/sigstore-go to v1.2.0 for security fixes - **security** — Update grpc, golang.org/x/net, and golang.org/x/text for security fixes - **security** — Update golang.org/x/text to v0.39.0 for security fixes `v2.1.8` is a patch release scoped to fixing issues reported by users of Crossplane `v2.1` and fixing security related issues in Crossplane's dependencies. #### 🎉 Highlights * **Fixed repeated owner updates for composed Usages (#7622, originally #7591):** The Usage controller only checked the *first* `ownerReference` when deciding whether the `spec.by` resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so `spec.by` ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references. * **Dependency security updates:** Bumps the Go toolchain to `1.25.12` (#7577), `grpc` / `golang.org/x/net` / `golang.org/x/text` (#7620, #7609), and the sigstore stack — `cosign` (#7556), `rekor` (#7555), `timestamp-authority` (#7568), `sigstore-go` (#7581) — to pick up upstream CVE fixes. See `## What's Changed` for the full list. ##### What's Changed * chore(deps): update module github.com/sigstore/rekor to v1.5.2 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7555 * chore(deps): update module github.com/sigstore/timestamp-authority/v2 to v2.1.0 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7568 * fix(deps): update module github.com/sigstore/cosign/v2 to v2.6.3 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7556 * build(deps): bump Go to 1.25.12 [security] [release-2.1] by @phisco in https://github.com/crossplane/crossplane/pull/7577 * chore(deps): update module github.com/sigstore/sigstore-go to v1.2.0 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7581 * fix(deps): combined security bumps (grpc, x/net, x/text) (release-2.1) by @lsviben in https://github.com/crossplane/crossplane/pull/7620 * chore(deps): update module golang.org/x/text to v0.39.0 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7609 * [Backport release-2.1] fix: avoid repeated owner updates for composed Usages by @phisco in https://github.com/crossplane/crossplane/pull/7622 **Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.1.7...v2.1.8 ### v1.20.11 - Date: 2026-07-23 - Version: v1.20.11 - Original notes: https://github.com/crossplane/crossplane/releases/tag/v1.20.11 - Permalink: https://whatsnew.fyi/product/crossplane/releases/v1.20.11 - **fixed** — Usage controller now checks all owner references instead of only the first one when deciding whether the spec.by resource already owns the Usage, preventing repeated unnecessary updates during reconciliation - **security** — Bumped Go toolchain to 1.25.12 to pick up upstream CVE fixes - **security** — Updated github.com/sigstore/rekor to v1.5.2 - **security** — Updated grpc, golang.org/x/net, and golang.org/x/text dependencies for security fixes - **security** — Bumped alpine base image to v3.24 to pick up upstream CVE fixes `v1.20.11` is a patch release scoped to fixing issues reported by users of Crossplane `v1.20` and fixing security related issues in Crossplane's dependencies. #### 🎉 Highlights * **Fixed repeated owner updates for composed Usages (#7623, originally #7591):** The Usage controller only checked the *first* `ownerReference` when deciding whether the `spec.by` resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so `spec.by` ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references. * **Dependency security updates:** Bumps the Go toolchain to `1.25.12` (#7578), `grpc` / `golang.org/x/net` / `golang.org/x/text` (#7621), `github.com/sigstore/rekor` (#7553), and the `alpine` base image to `v3.24` (#7513) to pick up upstream CVE fixes. See `## What's Changed` for the full list. ##### What's Changed * chore(deps): update module github.com/sigstore/rekor to v1.5.2 [security] (release-1.20) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7553 * build(deps): bump Go to 1.25.12 [security] [release-1.20] by @phisco in https://github.com/crossplane/crossplane/pull/7578 * chore(deps): update alpine docker tag to v3.24 (release-1.20) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7513 * fix(deps): combined security bumps (grpc, x/net, x/text) (release-1.20) by @lsviben in https://github.com/crossplane/crossplane/pull/7621 * [Backport release-1.20] fix: avoid repeated owner updates for composed Usages by @phisco in https://github.com/crossplane/crossplane/pull/7623 **Full Changelog**: https://github.com/crossplane/crossplane/compare/v1.20.10...v1.20.11 ### v2.3.3 - Date: 2026-06-22 - Version: v2.3.3 - Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.3.3 - Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.3.3 - **security** — Fix package signature verification TOCTOU flaw that could let a malicious OCI registry pass signature verification with a signed image and then serve unsigned content for installation - **fixed** — Correct namespace on injected resource refs in crossplane render to set namespace only for cluster-scoped XRs, matching the real reconciler behavior - **changed** — Bump Go toolchain to 1.25.11 - **changed** — Bump golang.org/x/net and golang.org/x/sys dependencies in the apis module for CVE fixes - **changed** — Update crossplane-runtime to v2.3.3 `v2.3.3` is a patch release scoped to fixing issues reported by users of Crossplane `v2.3` and fixing security related issues in Crossplane's dependencies. #### 🎉 Highlights * **Fixed package signature verification TOCTOU ([`GHSA-mf7q-r4rv-jv94`](https://github.com/crossplane/crossplane-runtime/security/advisories/GHSA-mf7q-r4rv-jv94)):** A time-of-check-to-time-of-use flaw could let a malicious OCI registry pass signature verification with a signed image and then serve unsigned content for installation. For `v2.3` this fix ships via the crossplane-runtime `v2.3.3` bump in #7541, since the affected code moved from `crossplane` to `crossplane-runtime` during the `v2.3` milestone. See the [crossplane-runtime `v2.3.3` release notes](https://github.com/crossplane/crossplane-runtime/releases/tag/v2.3.3) for the full details. * **Correct namespace on injected resource refs in `crossplane render`:** `crossplane render` previously set a namespace on every injected resource reference, which is inaccurate for namespaced XRs (whose resource refs are local and carry no namespace) and broke composition functions with strict schemas, such as the generated KCL bindings used in control plane projects. Render now matches the real reconciler and sets the namespace only for cluster-scoped XRs. Backported in #7525, originally fixed in #7523. * **Dependency security updates:** This release also bumps the Go toolchain to `1.25.11` and `golang.org/x/net` and `golang.org/x/sys` in the `apis` module to pick up CVE fixes (#7530). See `## What's Changed` below for the full list. ##### What's Changed * [Backport release-2.3] render: Set namespace on injected resource refs only for cluster-scoped XRs by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7525 * [release-2.3] bump Go to 1.25.11 and apis golang.org/x/net, x/sys for CVEs [security] by @phisco in https://github.com/crossplane/crossplane/pull/7530 * Update crossplane-runtime to v2.3.3 by @lsviben in https://github.com/crossplane/crossplane/pull/7541 **Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.3.2...v2.3.3 ### v2.2.3 - Date: 2026-06-22 - Version: v2.2.3 - Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.2.3 - Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.2.3 - **security** — Fix package signature verification time-of-check-to-time-of-use flaw that allowed a malicious OCI registry to serve a correctly signed image for verification and then an unsigned image for installation - **security** — Bump Go toolchain to 1.25.11 - **security** — Bump golang.org/x/net to v0.55.0 - **changed** — Update crossplane-runtime to v2.2.3 `v2.2.3` is a patch release scoped to fixing issues reported by users of Crossplane `v2.2` and fixing security related issues in Crossplane and its dependencies. #### 🎉 Highlights * **Fixed package signature verification TOCTOU ([`GHSA-wfqx-gjrf-g28r`](https://github.com/crossplane/crossplane/security/advisories/GHSA-wfqx-gjrf-g28r)):** A time-of-check-to-time-of-use flaw would let a malicious OCI registry serve a correctly signed image for verification and then an unsigned image for installation, because Crossplane resolved tag references separately for each step. Crossplane now resolves a tag to a digest once and uses that same digest for both signature verification and the image pull, so the content that is verified is exactly the content that is installed. This affected only users who enable package signature verification, install packages by tag, and pull from registries they don't control. Installing by digest would avoid this issue. Backported in #7520, and reported independently by @bugbunny-research and @tonghuaroot. * Note this fix appears in `crossplane` for v2.2 and `crossplane-runtime` for v2.3 because the affected code was moved from `crossplane` to `crossplane-runtime` during the v2.3 milestone. * **Dependency security updates:** This release also bumps the Go toolchain to `1.25.11` (#7529), `golang.org/x/net` to `v0.55.0` (#7438), and crossplane-runtime to `v2.2.3` (#7540), picking up security fixes in those upstream dependencies. ##### What's Changed * chore(deps): update module golang.org/x/net to v0.55.0 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7438 * Backport xpkg signature verification fix to release-2.2 by @adamwg in https://github.com/crossplane/crossplane/pull/7520 * [release-2.2] bump Go to 1.25.11 [security] by @phisco in https://github.com/crossplane/crossplane/pull/7529 * Update crossplane-runtime to v2.2.3 by @lsviben in https://github.com/crossplane/crossplane/pull/7540 **Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.2.2...v2.2.3 ### v2.1.7 - Date: 2026-06-22 - Version: v2.1.7 - Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.1.7 - Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.1.7 - **security** — Update module github.com/quic-go/quic-go to v0.59.1 - **security** — Update module golang.org/x/net to v0.55.0 - **security** — Bump Go to 1.25.11 - **changed** — Update crossplane-runtime to v2.1.7 v2.1.7 is a patch release scoped to fixing issues reported by users of Crossplane v2.1 and fixing security related issues in Crossplane's dependencies. ##### What's Changed * chore(deps): update module github.com/quic-go/quic-go to v0.59.1 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7460 * chore(deps): update module golang.org/x/net to v0.55.0 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7437 * [release-2.1] bump Go to 1.25.11 [security] by @phisco in https://github.com/crossplane/crossplane/pull/7528 * Update crossplane-runtime to v2.1.7 by @lsviben in https://github.com/crossplane/crossplane/pull/7539 **Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.1.6...v2.1.7 ### v1.20.10 - Date: 2026-06-22 - Version: v1.20.10 - Original notes: https://github.com/crossplane/crossplane/releases/tag/v1.20.10 - Permalink: https://whatsnew.fyi/product/crossplane/releases/v1.20.10 - **security** — Bump Go to 1.25.11 - **security** — Update go.mongodb.org/mongo-driver to v1.17.7 - **changed** — Update crossplane-runtime to v1.20.10 - **changed** — Update curlimages/curl docker tag to v8.20.0 v1.20.10 is a patch release scoped to fixing issues reported by users of Crossplane v1.20 and fixing security related issues in Crossplane's dependencies. ##### What's Changed * [release-1.20] bump Go to 1.25.11 [security] by @phisco in https://github.com/crossplane/crossplane/pull/7527 * chore(deps): update module go.mongodb.org/mongo-driver to v1.17.7 [security] (release-1.20) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7534 * Update crossplane-runtime to v1.20.10 by @lsviben in https://github.com/crossplane/crossplane/pull/7538 * chore(deps): update curlimages/curl docker tag to v8.20.0 (release-1.20) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7515 **Full Changelog**: https://github.com/crossplane/crossplane/compare/v1.20.9...v1.20.10 ### v2.3.2 - Date: 2026-06-09 - Version: v2.3.2 - Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.3.2 - Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.3.2 - **fixed** — render command now honors input XR schema - **fixed** — render command returns requirements even on fatal errors - **fixed** — add namespace to resourceref stable sort - **changed** — bump crossplane-runtime dependency to v2.3.2 v2.3.2 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane's dependencies. The primary goal of this release is to fix regressions in the Crossplane CLI's `render` commands. ##### What's Changed * [Backport release-2.3] build: tag the apis/ Go submodule on every release by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7445 * Backport #7452 to release-2.3: render honors input XR schema by @jcogilvie in https://github.com/crossplane/crossplane/pull/7459 * Backport #7455 to release-2.3: return requirements even on fatal errors by @jcogilvie in https://github.com/crossplane/crossplane/pull/7466 * Bump crossplane-runtime dependency to v2.3.2 (release-2.3) by @adamwg in https://github.com/crossplane/crossplane/pull/7474 * [Backport release-2.3] fix: add namespace to resourceref stable sort by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7475 **Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.3.1...v2.3.2 ### v1.20.9 - Date: 2026-06-05 - Version: v1.20.9 - Original notes: https://github.com/crossplane/crossplane/releases/tag/v1.20.9 - Permalink: https://whatsnew.fyi/product/crossplane/releases/v1.20.9 - **added** — Add crossplane beta upgrade check command to analyze a control plane for v2 upgrade readiness, checking for breaking changes including native patch-and-transform Compositions, ControllerConfig usage, external secret stores, and unqualified package sources - **security** — Update golang.org/x/net to v0.55.0 `v1.20.9` is a patch release scoped to fixing issues reported by users of Crossplane `v1.20` and fixing security related issues in Crossplane's dependencies. It also ships a notable new `crossplane beta upgrade check` command to help you more easily prepare for Crossplane v2. #### 🎉 Highlights * **Check your control plane's v2 upgrade readiness:** The new `crossplane beta upgrade check` command connects to a live v1.x control plane and scans it for usage of features that are removed or have breaking changes in Crossplane v2, then reports exactly what would break before you upgrade. No more manually digging through every Composition, package, and resource to guess whether you're ready. Added in #7451. * It checks for all documented [breaking changes](https://docs.crossplane.io/latest/whats-new/#backward-compatibility) in v2, i.e., native patch-and-transform Compositions, `ControllerConfig` usage, external secret stores, and unqualified package sources, plus an informational check for composite resource connection details. * Each finding links to the relevant [migration guides](https://docs.crossplane.io/latest/guides/upgrade-to-crossplane-v2/), docs, and other commands like `crossplane beta convert` where one exists. * Output is human-readable text by default or JSON via `-o json`, and the command exits non-zero when it finds blockers, so you can gate an upgrade on a clean report in CI. * See the [announcement blog post](https://blog.crossplane.io/v2-upgrade-check/) for more details. ##### What's Changed * feat(cli): `upgrade check` command to analyze a control plane for v2 upgrade readiness by @jbw976 in https://github.com/crossplane/crossplane/pull/7451 * chore(deps): update module golang.org/x/net to v0.55.0 [security] (release-1.20) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7436 * chore(deps): bump crossplane-runtime to v1.20.9 by @jbw976 in https://github.com/crossplane/crossplane/pull/7468 **Full Changelog**: https://github.com/crossplane/crossplane/compare/v1.20.8...v1.20.9