# Crossplane v1.20.12

- Product: Crossplane (https://whatsnew.fyi/product/crossplane)
- Vendor: CNCF
- Date: 2026-08-21
- Version: v1.20.12
- Original notes: https://github.com/crossplane/crossplane/releases/tag/v1.20.12
- Permalink: https://whatsnew.fyi/product/crossplane/releases/v1.20.12

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Update vulnerable dependencies to pick up upstream CVE fixes
- **security** — Update go-git to v5.19.2
- **security** — Update golang.org/x/mod to v0.40.0
- **security** — Bump Go toolchain to 1.25.13
- **security** — Bump crossplane-runtime to v1.20.11 which carries security dependency updates
- **changed** — Update amazon/aws-cli docker tag to v2.36.13
- **changed** — Update gcr.io/distroless/static docker digest to 9197324

`v1.20.12` is a patch release scoped to fixing issues reported by users of Crossplane `v1.20` and fixing security related issues in Crossplane's dependencies.

#### 🎉 Highlights

  * **Dependency security updates:** Bumps the Go toolchain to `1.25.13` (#7755), `go-git` (#7722), and `golang.org/x/mod` (#7740), plus two combined sets of vulnerable dependency updates (#7646, #7675), to pick up upstream CVE fixes. `crossplane-runtime` is also bumped to `v1.20.11` (#7767), which carries its own set of security dependency updates.

##### What's Changed

* fix(deps): update vulnerable dependencies [security] (release-1.20) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7646
* chore(deps): update amazon/aws-cli docker tag to v2.36.13 (release-1.20) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7514
* chore(deps): update gcr.io/distroless/static docker digest to 9197324 (release-1.20) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7512
* chore(deps): update vulnerable dependencies [security] (release-1.20) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7675
* fix(deps): update module github.com/go-git/go-git/v5 to v5.19.2 [security] (release-1.20) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7722
* chore(deps): update module golang.org/x/mod to v0.40.0 [security] (release-1.20) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7740
* build(deps): bump Go to 1.25.13 [security] [release-1.20] by @phisco in https://github.com/crossplane/crossplane/pull/7755
* chore(deps): bump crossplane-runtime to v1.20.11 by @jbw976 in https://github.com/crossplane/crossplane/pull/7767


**Full Changelog**: https://github.com/crossplane/crossplane/compare/v1.20.11...v1.20.12