What crossplane/crossplane shipped
Written by FoxPlug from the repository's own releases; not affiliated with Crossplane. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/crossplane/crossplane; Crossplane did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Added function-controlled deletion of composite resources behind a new alpha enable-function-controlled-deletion flag. Pull request #8000
- Added an --enable-function-controlled-deletion flag to crossplane internal render and made render able to show a deleted XR. Pull request #8012
- Composition function pipelines now support optional credentials, so functions can run when referenced secrets do not exist. Pull request #6994
- Stripped CRD OpenAPI schemas from the ControllerEngine cache, which only needs the CRDs for garbage collection and discovery cache invalidation. Pull request #7955
- Skipped no-op status writes in the MRD, MRAP and PackageRevision reconcilers. Pull request #7851
- Added the drc short name to DeploymentRuntimeConfig, matching short names already available for other Crossplane types. Pull request #8006
- Updated CI to the new location of the free-disk-space action, which had moved and was causing jobs to fail. Pull request #8015
Why it matters
This week adds an alpha path for function-controlled deletion of composite resources and the render support to preview it, so compositions can control how XRs are removed. Composition functions can now run with optional credentials, which helps during initial setup when secrets are not yet present. The cache and status write changes reduce unnecessary work, and CI is unblocked after the moved action.
Changelog entry
- Add function-controlled deletion of composite resources behind the alpha --enable-function-controlled-deletion flag. Pull request #8000
- Add --enable-function-controlled-deletion to crossplane internal render and support rendering a deleted XR. Pull request #8012
- Add optional credentials for composition functions so they can run when referenced secrets do not exist. Pull request #6994
- Strip CRD schemas from the ControllerEngine cache. Pull request #7955
- Skip no-op status writes in MRD, MRAP and PackageRevision reconcilers. Pull request #7851
- Add the drc shortName to DeploymentRuntimeConfig. Pull request #8006
- Fix CI by updating the free-disk-space action to its new repository location. Pull request #8015
Function-controlled deletion of composite resources is here as an alpha feature, with a matching render flag to preview XR deletion. Composition functions now accept optional credentials, and the engine cache no longer holds CRD schemas.
This week in Crossplane: function-controlled deletion of composite resources landed behind a new alpha --enable-function-controlled-deletion flag, and crossplane internal render gained the same flag so you can preview how an XR is deleted. Composition function pipelines now support optional credentials, letting functions run when referenced secrets do not exist. The ControllerEngine cache no longer keeps CRD OpenAPI schemas, no-op status writes are skipped in MRD, MRAP and PackageRevision, DeploymentRuntimeConfig gets the drc short name, and CI is fixed by pointing the free-disk-space action at its new location.
Week of October 26, 2026
What shipped
- Compositions gained a spec.revisionHistoryLimit field that controls how many unused CompositionRevisions are kept and garbage collected. Pull request #7916
- Composition and CompositionRevision now accept an alpha spec.deletionPolicy field with Background, Foreground and Pipeline options for function-controlled deletion. Pull request #7992
- ImageConfigs that only set spec.runtime.configRef now enqueue matching package revisions instead of returning early. Pull request #7970
- A backport to release-2.2 makes the package manager reuse a cached package with PullAlways when the digest is unchanged. Pull request #7997
- Non-major Go dependency updates are now grouped into a single update to avoid vendor hash conflicts. Pull request #7977
- Wordfully was added to the adopters list for using Crossplane to manage production backend infrastructure. Pull request #7971
Why it matters
This week adds two composition controls that change how revisions and deletions are handled, so users managing many compositions should review the new alpha deletion policy and revision history limit. It also fixes package revision enqueueing for runtime-only ImageConfigs and improves the package cache behavior on release-2.2. The dependency grouping reduces update churn for maintainers.
Changelog entry
- Add spec.revisionHistoryLimit to Compositions to control how many unused CompositionRevisions are retained. Pull request #7916
- Add alpha spec.deletionPolicy to Compositions and CompositionRevisions with Background, Foreground and Pipeline options. Pull request #7992
- Enqueue package revisions for ImageConfigs that only set spec.runtime.configRef. Pull request #7970
- Backport to release-2.2: use the cached package with PullAlways when the digest is unchanged. Pull request #7997
- Group non-major Go dependency updates to avoid vendor hash conflicts. Pull request #7977
- Add Wordfully to the adopters list. Pull request #7971
This week in Crossplane: Compositions get spec.revisionHistoryLimit for garbage collecting unused revisions and an alpha spec.deletionPolicy with Background, Foreground and Pipeline options. Also a fix for runtime-only ImageConfigs enqueueing package revisions.
This week in Crossplane: Compositions gained a spec.revisionHistoryLimit field to garbage collect unused CompositionRevisions, and an alpha spec.deletionPolicy field (Background, Foreground or Pipeline) for function-controlled deletion. ImageConfigs that only set spec.runtime.configRef now enqueue matching package revisions, fixing a case where creating or editing them had no effect. On release-2.2, the package manager reuses a cached package with PullAlways when the digest is unchanged, and non-major Go dependency updates are now grouped into a single update to avoid vendor hash conflicts.
Week of October 19, 2026
What shipped
- Crossplane v2.3.7 was released as a patch release fixing user-reported issues and security issues in Crossplane and its dependencies. Release
- Crossplane v2.4.3 was released as a patch release fixing user-reported issues and security issues in Crossplane and its dependencies. Release
- Crossplane v2.2.7 was released as a patch release fixing user-reported issues and security issues in Crossplane and its dependencies. Release
- Crossplane v1.20.14 was released as a patch release scoped to security fixes in its dependencies. Release
- The release-2.2 branch bumped Go to 1.26.10 and distrusted the compromised eMudhra roots as a security mitigation. Pull request #7959
- The release-2.3 branch bumped Go to 1.26.10 and distrusted the compromised eMudhra roots as a security mitigation. Pull request #7958
- The release-2.4 branch bumped Go to 1.26.10 and distrusted the compromised eMudhra roots as a security mitigation. Pull request #7957
- The release-1.20 branch bumped the Go toolchain to 1.26.10 for the crypto/x509 fix that rejects known-compromised intermediate certificates. Pull request #7956
- The release-1.20 branch bumped the distroless static base image to a digest whose CA bundle drops the compromised roots. Pull request #7960
- A backport to release-2.2 stopped truncated package downloads from being cached in xpkg. Pull request #7950
Why it matters
This week was mostly security maintenance: four patch releases shipped across the 1.20, 2.2, 2.3 and 2.4 lines, all centered on distrusting compromised eMudhra intermediate CAs. The Go toolchain moved to 1.26.10 so crypto/x509 rejects those certificates, and the distroless base image CA bundle was updated as well. Users on any of these lines should upgrade to get the fix.
Changelog entry
- Release v1.20.14, a patch release for security issues in dependencies. Release
- Release v2.2.7, a patch release with user-reported fixes and security fixes. Release
- Release v2.3.7, a patch release with user-reported fixes and security fixes. Release
- Release v2.4.3, a patch release with user-reported fixes and security fixes. Release
- Release apis/v2.3.7. Release
- Release apis/v2.4.3. Release
- Bump crossplane-runtime to v1.20.12 on release-1.20. Pull request #7964
- Bump crossplane-runtime to v2.2.5 on release-2.2. Pull request #7963
- Bump crossplane-runtime to v2.3.5 on release-2.3. Pull request #7962
- Bump crossplane-runtime to v2.4.3 on release-2.4. Pull request #7961
- Bump Go to 1.26.10 on release-1.20 for the crypto/x509 security fix. Pull request #7956
- Backport to release-2.2: don't cache truncated package downloads in xpkg. Pull request #7950
Crossplane patch releases are out: v1.20.14, v2.2.7, v2.3.7 and v2.4.3. They bump Go to 1.26.10 so crypto/x509 rejects the compromised eMudhra intermediate CAs, and update the distroless base image CA bundle. Upgrade to pick up the fix.
Crossplane patch releases are out this week: v1.20.14, v2.2.7, v2.3.7 and v2.4.3. The main theme is security. The Go toolchain moves to 1.26.10, whose crypto/x509 rejects the compromised eMudhra intermediate certificates, and the distroless static base image was bumped to a digest whose CA bundle drops the affected roots. The 2.2, 2.3 and 2.4 releases also include fixes for issues reported by users. Upgrade to one of these patch releases to pick up the changes.
Week of September 21, 2026
What shipped
- Crossplane v2.4.2 patch release fixes a bug where ownership of ServiceAccounts was not correctly transferred to newly active package revisions. Release
- Fixed issue where old revision controller ownerReferences for ServiceAccounts were not properly demoted during upgrades. Pull request #7839
- Usage webhook failurePolicy is now configurable and gated on Usages to prevent AKS stop/start failures on clusters running Crossplane. Pull request #7784
- Fixed claim reconciler to fail closed when unable to list its XRD instead of incorrectly treating list errors as no enforced composition. Pull request #7789
- Fixed e2e tests broken by provider-nop v0.5.0 bump that made NopResource namespaced and moved cluster-scoped kind to ClusterNopResource. Pull request #7865
- Updated e2e test TestConfigurationPullFromPrivateRegistry to use xpkg.upbound.io registry instead of GCR with expired credentials. Pull request #7866
Why it matters
V2.4.2 addresses critical upgrade and reconciliation issues affecting production users. The ServiceAccount ownership fix and webhook configuration improvements prevent cluster disruptions during upgrades and cloud platform operations.
Changelog entry
- Fixed bug where ownership of ServiceAccounts was not correctly transferred to newly active package revisions Release
- Fixed demote of old revision controller ownerReference for ServiceAccounts during upgrades Pull request #7839
- Made Usage webhook failurePolicy configurable and gated it on Usages to prevent AKS conflicts Pull request #7784
- Fixed claim reconciler to fail closed when unable to list its XRD instead of assuming no enforced composition Pull request #7789
Crossplane v2.4.2 is out with fixes for ServiceAccount ownership transfer during upgrades and configurable webhook policies to prevent AKS stop/start failures.
Crossplane v2.4.2 patch release is available. This release fixes a bug where ServiceAccount ownership was not correctly transferred to newly active package revisions during upgrades. It also makes the Usage webhook failurePolicy configurable to prevent issues with AKS stop/start operations, and fixes the claim reconciler to properly fail when unable to list its XRD.
Week of September 14, 2026
What shipped
- Crossplane v2.4.1 patch release fixes user-reported issues and security vulnerabilities in Crossplane and its dependencies, with package revisions now taking control of established objects from replaced revisions. Release
- Crossplane v2.3.6 patch release addresses user-reported issues and security vulnerabilities in Crossplane and its dependencies, with package revisions now taking control of established objects from replaced revisions. Release
- Crossplane v2.2.6 patch release fixes user-reported issues and security vulnerabilities in Crossplane and its dependencies, with package revisions now taking control of established objects from replaced revisions. Release
- Crossplane v1.20.13 patch release updates Go toolchain to 1.26.7 and google.golang.org/grpc to v1.83.2 plus other vulnerable dependency updates to address security issues. Release
- Crossplane APIs v2.4.1 release published. Release
- Crossplane APIs v2.3.6 release published. Release
Why it matters
Multiple patch releases across supported versions address security vulnerabilities in dependencies and fix issues reported by users. The package revision control improvement ensures smoother transitions when updating package revisions.
Changelog entry
- V2.4.1: patch release for bug fixes and security updates Release
- V2.3.6: patch release for bug fixes and security updates Release
- V2.2.6: patch release for bug fixes and security updates Release
- V1.20.13: Go toolchain bumped to 1.26.7, google.golang.org/grpc updated to v1.83.2 Release
Crossplane v2.4.1, v2.3.6, v2.2.6, and v1.20.13 are now available. These patch releases include security updates and dependency fixes. v2.4.1, v2.3.6, and v2.2.6 improve package revision control handling.
We've released patch versions across multiple Crossplane lines: v2.4.1, v2.3.6, v2.2.6, and v1.20.13. These releases address security vulnerabilities in dependencies and fix issues from user reports. A key improvement in v2.4.1, v2.3.6, and v2.2.6 enhances how package revisions take control of established objects during upgrades.