Crossplane v2.1.8

v2.1.8 is a patch release scoped to fixing issues reported by users of Crossplane v2.1 and fixing security related issues in Crossplane's dependencies.

🎉 Highlights

• Fixed repeated owner updates for composed Usages (#7622, originally #7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so spec.by ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.
• Dependency security updates: Bumps the Go toolchain to 1.25.12 (#7577), grpc / golang.org/x/net / golang.org/x/text (#7620, #7609), and the sigstore stack — cosign (#7556), rekor (#7555), timestamp-authority (#7568), sigstore-go (#7581) — to pick up upstream CVE fixes. See ## What's Changed for the full list.

What's Changed

• chore(deps): update module github.com/sigstore/rekor to v1.5.2 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7555
• chore(deps): update module github.com/sigstore/timestamp-authority/v2 to v2.1.0 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7568
• fix(deps): update module github.com/sigstore/cosign/v2 to v2.6.3 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7556
• build(deps): bump Go to 1.25.12 [security] [release-2.1] by @phisco in https://github.com/crossplane/crossplane/pull/7577
• chore(deps): update module github.com/sigstore/sigstore-go to v1.2.0 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7581
• fix(deps): combined security bumps (grpc, x/net, x/text) (release-2.1) by @lsviben in https://github.com/crossplane/crossplane/pull/7620
• chore(deps): update module golang.org/x/text to v0.39.0 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7609
• [Backport release-2.1] fix: avoid repeated owner updates for composed Usages by @phisco in https://github.com/crossplane/crossplane/pull/7622

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.1.7...v2.1.8