# Crossplane v1.20.11

- Product: Crossplane (https://whatsnew.fyi/product/crossplane)
- Vendor: CNCF
- Date: 2026-07-23
- Version: v1.20.11
- Original notes: https://github.com/crossplane/crossplane/releases/tag/v1.20.11
- Permalink: https://whatsnew.fyi/product/crossplane/releases/v1.20.11

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Usage controller now checks all owner references instead of only the first one when deciding whether the spec.by resource already owns the Usage, preventing repeated unnecessary updates during reconciliation
- **security** — Bumped Go toolchain to 1.25.12 to pick up upstream CVE fixes
- **security** — Updated github.com/sigstore/rekor to v1.5.2
- **security** — Updated grpc, golang.org/x/net, and golang.org/x/text dependencies for security fixes
- **security** — Bumped alpine base image to v3.24 to pick up upstream CVE fixes

`v1.20.11` is a patch release scoped to fixing issues reported by users of Crossplane `v1.20` and fixing security related issues in Crossplane's dependencies.

#### 🎉 Highlights

* **Fixed repeated owner updates for composed Usages (#7623, originally #7591):** The Usage controller only checked the *first* `ownerReference` when deciding whether the `spec.by` resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so `spec.by` ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.
* **Dependency security updates:** Bumps the Go toolchain to `1.25.12` (#7578), `grpc` / `golang.org/x/net` / `golang.org/x/text` (#7621), `github.com/sigstore/rekor` (#7553), and the `alpine` base image to `v3.24` (#7513) to pick up upstream CVE fixes. See `## What's Changed` for the full list.

##### What's Changed
* chore(deps): update module github.com/sigstore/rekor to v1.5.2 [security] (release-1.20) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7553
* build(deps): bump Go to 1.25.12 [security] [release-1.20] by @phisco in https://github.com/crossplane/crossplane/pull/7578
* chore(deps): update alpine docker tag to v3.24 (release-1.20) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7513
* fix(deps): combined security bumps (grpc, x/net, x/text) (release-1.20) by @lsviben in https://github.com/crossplane/crossplane/pull/7621
* [Backport release-1.20] fix: avoid repeated owner updates for composed Usages by @phisco in https://github.com/crossplane/crossplane/pull/7623


**Full Changelog**: https://github.com/crossplane/crossplane/compare/v1.20.10...v1.20.11