# Crossplane v2.3.4

- Product: Crossplane (https://whatsnew.fyi/product/crossplane)
- Vendor: CNCF
- Date: 2026-07-23
- Version: v2.3.4
- Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.3.4
- Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.3.4

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Usage controller now checks all owner references instead of only the first one, preventing repeated owner updates for composed Usages that trigger unnecessary composition reconciliation
- **fixed** — crossplane render command no longer overwrites the input XR's UID when one is already set
- **fixed** — crossplane render command now validates observed resources before proceeding with the render
- **changed** — Container images are now built with buildGoModule instead of gomod2nix to enable vulnerability scanning by standard tooling
- **security** — Update grpc to fix upstream CVEs
- **security** — Update golang.org/x/net to v0.56.0 to fix upstream CVEs
- **security** — Update golang.org/x/text to v0.39.0 to fix upstream CVEs
- **security** — Update github.com/sigstore/cosign/v3 to v3.0.6 to fix upstream CVEs
- **security** — Update github.com/sigstore/rekor to v1.5.2 to fix upstream CVEs
- **security** — Update github.com/sigstore/timestamp-authority/v2 to v2.1.0 to fix upstream CVEs
- **security** — Update github.com/sigstore/sigstore-go to v1.2.0 to fix upstream CVEs

`v2.3.4` is a patch release scoped to fixing issues reported by users of Crossplane `v2.3` and fixing security related issues in Crossplane and its dependencies.

#### 🎉 Highlights

* **Fixed repeated owner updates for composed Usages (#7597, originally #7591):** The Usage controller only checked the *first* `ownerReference` when deciding whether the `spec.by` resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so `spec.by` ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.
* **`crossplane render` fixes (#7599, originally #7544):** `render` no longer overwrites the input XR's UID when one is already set, and now validates observed resources before proceeding with the render.
* **Vulnerability-scannable images (#7574):** Container images are now built with `buildGoModule` (replacing `gomod2nix`), so published images can be scanned by standard vulnerability tooling.
* **Dependency security updates:** Bumps `grpc` / `golang.org/x/net` / `golang.org/x/text` (#7618, #7614, #7615) and the sigstore stack — `cosign` (#7559), `rekor` (#7560), `timestamp-authority` (#7570), `sigstore-go` (#7583) — to pick up upstream CVE fixes. See `## What's Changed` for the full list.

##### What's Changed
* chore(deps): update module github.com/sigstore/rekor to v1.5.2 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7560
* chore(deps): update module github.com/sigstore/cosign/v3 to v3.0.6 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7559
* chore(deps): update module github.com/sigstore/timestamp-authority/v2 to v2.1.0 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7570
* [Backport release-2.3] build(nix): build with buildGoModule so images are vulnerability-scannable by @phisco in https://github.com/crossplane/crossplane/pull/7574
* chore(deps): update module github.com/sigstore/sigstore-go to v1.2.0 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7583
* fix(deps): combined security bumps (grpc, x/net, x/text) (release-2.3) by @lsviben in https://github.com/crossplane/crossplane/pull/7618
* [Backport release-2.3] fix: avoid repeated owner updates for composed Usages by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7597
* [Backport release-2.3] render: Don't overwrite the input XR's UID if it has one and validate observed resources by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7599
* chore(deps): update module golang.org/x/text to v0.39.0 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7615
* chore(deps): update module golang.org/x/net to v0.56.0 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7614


**Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.3.3...v2.3.4