Skip to content

fix(deps): update module github.com/crossplane/crossplane/v2 to v2.3.0 [security]#129

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-github.com-crossplane-crossplane-v2-vulnerability
Open

fix(deps): update module github.com/crossplane/crossplane/v2 to v2.3.0 [security]#129
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-github.com-crossplane-crossplane-v2-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Jun 20, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/crossplane/crossplane/v2 v2.2.1 → v2.3.0 age confidence

Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag

GHSA-wfqx-gjrf-g28r

More information

Details

Summary

Crossplane allows package signature verification to be configured via the ImageConfig mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them.

When a package is installed using a tag reference (e.g., a semantic version), a malicious OCI registry could serve a correctly signed image for verification, then subsequently serve an unsigned image for installation. This is possible because Crossplane resolves the tag reference separately for each step.

This vulnerability is relevant only for users who do all three of the following:

  1. Configure signature verification for packages,
  2. Install packages using tag references rather than digests, and
  3. Install packages from registries they do not control.
Mitigation

Installing packages by image digest rather than using tags avoids this issue.

Fix

The package manager has been updated to resolve tag references once and use the resulting digest for both signature verification and image fetching. This ensures that Crossplane pulls the same content that had its signature verified. The fix has been applied to Crossplane's main branch and backported to the v2.3 and v2.2 release branches; it will be released in v2.3.3 and v2.2.3.

Credits

This issue was reported, independently, by @​bugbunny-research and @​tonghuaroot.

Severity

  • CVSS Score: 9.0 / 10 (Critical)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

crossplane/crossplane (github.com/crossplane/crossplane/v2)

v2.3.0

Compare Source

The v2.3.0 release is a regular quarterly Crossplane release that is focused on maturing a number of key areas of functionality across the project, as Crossplane continues to become more capable, more reliable, and more performant for your production workloads. This release includes a new high-fidelity local rendering engine, finer-grained reconciliation control for both XRs and managed resources, new alpha deletion protection for Provider packages, and a wide range of fixes and reliability improvements. It also includes security fixes in Crossplane's Go toolchain and dependencies.

ℹ️ Extended support for v1.20

Because v1.20 is the last minor release of the v1 series and major version upgrades require additional planning for users, v1.20 will continue to receive critical fixes. The final EOL date for v1.20 is to be determined.

⚠️ Upgrade from v2.2

It is strongly advised to upgrade to v2.3 from the previous minor version, which is v2.2. Upon upgrade for each minor release, Crossplane performs any necessary migrations of its CRDs to ensure the latest versions are stored in the Kubernetes API server. Therefore, it is important to upgrade sequentially through one minor version at a time as described in the upgrade docs.

🚨 Notable and Breaking Changes

  • github.com/crossplane/crossplane/apis/v2 is now a separate Go module from the rest of Crossplane. #​7019
    • External consumers of Crossplane APIs should update their dependencies from github.com/crossplane/crossplane/v2/apis to github.com/crossplane/crossplane/apis/v2.
    • The common APIs from crossplane-runtime have moved to github.com/crossplane/crossplane/apis/v2/core.
    • v1 and v2 of the common APIs have been collapsed into a single v2 package. The old v1.Resource* types are now v2.ClusterManagedResource* to differentiate them from v2.ManagedResource*, which are the namespaced versions.
  • The Crossplane CLI (formerly crank) has moved into its own repository, https://github.com/crossplane/cli, and will be released separately from Crossplane core going forward. #​7355
    • A v2.3.0 release of the CLI coincides with this Crossplane core v2.3.0 release and has been dual published to the typical release location on releases.crossplane.io to help ease the transition. After the v2.3.0 release, version numbers and release schedules will diverge as the Crossplane CLI will have its own independent release schedule. Learn more and provide feedback in #​7350.
    • Commands have been re-organized into a noun-first tree.
    • Alpha and beta commands that previously lived in the crossplane alpha and crossplane beta trees have moved into the main tree.
    • Example: crossplane beta trace is now crossplane resource trace
    • See full release CLI notes (including full details on these breaking changes): https://github.com/crossplane/cli/releases/tag/v2.3.0

🎉 Highlights

  • High-fidelity render engine: crossplane render now drives the real composite reconciler via a new hidden crossplane internal render subcommand, instead of maintaining a parallel reimplementation. The output of crossplane render (and downstream tools like crossplane-diff) now matches what would actually happen in-cluster, eliminating differences between local rendering and real reconciliation. By default it pulls the Crossplane container image to run the reconcile, so a separate controller binary is not required. See #​7280 and #​7339.
  • Provider deletion protection: A new alpha feature automatically protects Provider packages from accidental deletion while instances of their managed resources still exist. When --enable-provider-deletion-protection is set, Crossplane will automatically create ClusterUsage resources that block Provider deletion through the existing Usage webhook. #​7362
  • Per-resource reconciliation control: Two new annotations give users fine-grained control over when individual resources reconcile. crossplane.io/poll-interval overrides the controller-level poll interval for a specific resource (e.g. "24h", "30m"), and crossplane.io/reconcile-requested-at triggers an immediate reconciliation when its value changes. This works immediately for XRs, but requires providers to release a new version based on crossplane-runtime v.2.3.0 to gain this behavior for their managed resources #​7239
  • Composition functions can now select all resources of a given kind: When a composition function returned a Requirements.ResourceSelector with only apiVersion and kind set (no matchName or matchLabels), Crossplane previously rejected this as an invalid request. A selector with no match field is now correctly interpreted as "all resources of that kind". #​7241
  • Scale subresource for XRs: CompositeResourceDefinition can now configure the scale subresource on the XRs it defines, so composite resources can be scaled with kubectl scale and other standard tooling. #​7004
  • Other notable improvements:
    • Improved docker network configuration support for crank render: A new render.crossplane.io/runtime-docker-network annotation on Function resources tells the Docker runtime which network function containers should join. This makes crossplane render work inside container jobs (such as GitHub Actions container jobs) where the default bridge network is unreachable from the caller. #​7216
    • commonAnnotations in compositions: Compositions can now propagate a set of common annotations to every composed resource, mirroring the existing commonLabels behavior. #​7211
    • crossplane beta validate now correctly resolves and caches dependencies that use semantic version ranges (e.g. ">=v0.6.0,<v1.0.0"), and adds an --update-cache flag to always check upstream for newer matching versions. #​7050
    • crossplane beta trace adds a YAML output format. #​7275
    • The XR circuit breaker now resets its state when the XR is deleted, so a new resource with the same name starts fresh instead of inheriting an open circuit. #​7201
    • CompositionRevision and composite reconcilers now skip no-op status updates, eliminating an unnecessary reconcile loop that prevented steady state convergence. #​7283

🏅 Release MVP

For the v2.3 release cycle, we'd like to recognize two amazing community members for their contributions and name them the v2.3 release MVPs! 🎉

  • @​yordis delivered one of this release's headline features in #​7239 as a first-time contributor to core Crossplane (but long time contributor to the Crossplane ecosystem 😉) : the per-resource reconciliation control. This work gives operators fine-grained control over when individual resources reconcile, and required coordinated changes across both the core composite reconciler and the managed reconciler in crossplane-runtime. Thank you @​yordis!
  • @​fernandezcuesta has had a sustained impact on the broader Crossplane ecosystem, contributing to and releasing a steady stream of community providers and extensions that expand what users can build on Crossplane, e.g. provider-kafka, provider-mongodbatlas, and provider-pagerduty. To top that off, they also landed new support in core Crossplane for commonAnnotations for compositions in #​7211. Thank you, @​fernandezcuesta!

What's Changed

New Contributors

Full Changelog: crossplane/crossplane@v2.2.0...v2.3.0

v2.2.2

Compare Source

v2.2.2 is a patch release scoped to fixing issues reported by users of Crossplane v2.2 and fixing security related issues in Crossplane's dependencies.

What's Changed

Full Changelog: crossplane/crossplane@v2.2.1...v2.2.2

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the automated label Jun 20, 2026
@renovate renovate Bot requested a review from tampakrap as a code owner June 20, 2026 02:10
@renovate

renovate Bot commented Jun 20, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
Command failed: go get -t ./...
go: downloading github.com/invopop/jsonschema v0.14.0
go: downloading github.com/alecthomas/kong v1.15.0
go: downloading github.com/spf13/afero v1.15.0
go: downloading github.com/gonvenience/bunt v1.4.3
go: downloading github.com/stretchr/testify v1.11.1
go: downloading github.com/crossplane/crossplane-runtime/v2 v2.3.0
go: downloading github.com/crossplane/crossplane/v2 v2.3.0
go: downloading k8s.io/apimachinery v0.35.3
go: downloading k8s.io/apiserver v0.35.0
go: downloading sigs.k8s.io/yaml v1.6.0
go: downloading github.com/google/go-cmp v0.7.0
go: downloading github.com/google/uuid v1.6.0
go: downloading k8s.io/apiextensions-apiserver v0.35.0
go: downloading github.com/go-git/go-git/v5 v5.18.0
go: downloading github.com/gertd/go-pluralize v0.2.1
go: downloading github.com/gonvenience/ytbx v1.5.0
go: downloading github.com/homeport/dyff v1.12.0
go: downloading github.com/otiai10/copy v1.14.1
go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
go: downloading github.com/alecthomas/assert/v2 v2.11.0
go: downloading github.com/pb33f/ordered-map/v2 v2.3.1
go: downloading golang.org/x/text v0.36.0
go: downloading github.com/gonvenience/term v1.0.5
go: downloading github.com/lucasb-eyer/go-colorful v1.4.0
go: downloading github.com/mattn/go-ciede2000 v0.0.0-20170301095244-782e8c62fec3
go: downloading github.com/mattn/go-isatty v0.0.21
go: downloading github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
go: downloading sigs.k8s.io/controller-runtime v0.23.1
go: downloading dario.cat/mergo v1.0.2
go: downloading github.com/crossplane/crossplane/apis/v2 v2.0.0-20260424160951-8f231230ebb6
go: downloading k8s.io/api v0.35.3
go: downloading k8s.io/utils v0.0.0-20260319190234-28399d86e0b5
go: downloading k8s.io/klog/v2 v2.130.1
go: downloading go.yaml.in/yaml/v2 v2.4.4
go: downloading k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4
go: downloading github.com/ProtonMail/go-crypto v1.1.6
go: downloading github.com/go-git/go-billy/v5 v5.8.0
go: downloading github.com/sergi/go-diff v1.4.0
go: downloading github.com/BurntSushi/toml v1.6.0
go: downloading github.com/gonvenience/text v1.0.10
go: downloading github.com/virtuald/go-ordered-json v0.0.0-20170621173500-b18e6e673d74
go: downloading go.yaml.in/yaml/v3 v3.0.4
go: downloading github.com/gonvenience/idem v0.0.3
go: downloading github.com/gonvenience/neat v1.3.20
go: downloading github.com/mitchellh/hashstructure/v2 v2.0.2
go: downloading github.com/texttheater/golang-levenshtein v1.0.1
go: downloading github.com/otiai10/mint v1.6.3
go: downloading golang.org/x/sync v0.20.0
go: downloading golang.org/x/sys v0.43.0
go: downloading github.com/emirpasic/gods v1.18.1
go: downloading github.com/alecthomas/repr v0.5.2
go: downloading github.com/hexops/gotextdiff v1.0.3
go: downloading github.com/bahlo/generic-list-go v0.2.0
go: downloading github.com/buger/jsonparser v1.1.2
go: downloading go.yaml.in/yaml/v4 v4.0.0-rc.2
go: downloading github.com/mitchellh/go-ps v1.0.0
go: downloading golang.org/x/term v0.42.0
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading sigs.k8s.io/structured-merge-diff/v6 v6.3.2-0.20260122202528-d9cc6641c482
go: downloading sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730
go: downloading sigs.k8s.io/randfill v1.0.0
go: downloading github.com/go-logr/logr v1.4.3
go: downloading github.com/evanphx/json-patch/v5 v5.9.11
go: downloading github.com/evanphx/json-patch v5.9.11+incompatible
go: downloading k8s.io/client-go v0.35.1
go: downloading github.com/go-openapi/jsonreference v0.21.5
go: downloading github.com/go-openapi/swag v0.25.5
go: downloading github.com/google/gnostic-models v0.7.1
go: downloading github.com/google/cel-go v0.27.0
go: downloading k8s.io/component-base v0.35.0
go: downloading golang.org/x/crypto v0.50.0
go: downloading github.com/cyphar/filepath-securejoin v0.4.1
go: downloading github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376
go: downloading github.com/pjbgf/sha1cd v0.3.2
go: downloading github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99
go: downloading github.com/json-iterator/go v1.1.12
go: downloading gopkg.in/inf.v0 v0.9.1
go: downloading github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822
go: downloading golang.org/x/net v0.53.0
go: downloading github.com/fxamacker/cbor/v2 v2.9.0
go: downloading github.com/go-openapi/jsonpointer v0.22.5
go: downloading github.com/go-openapi/swag/cmdutils v0.25.5
go: downloading github.com/go-openapi/swag/conv v0.25.5
go: downloading github.com/go-openapi/swag/fileutils v0.25.5
go: downloading github.com/go-openapi/swag/jsonname v0.25.5
go: downloading github.com/go-openapi/swag/jsonutils v0.25.5
go: downloading github.com/go-openapi/swag/loading v0.25.5
go: downloading github.com/go-openapi/swag/mangling v0.25.5
go: downloading github.com/go-openapi/swag/netutils v0.25.5
go: downloading github.com/go-openapi/swag/stringutils v0.25.5
go: downloading github.com/go-openapi/swag/typeutils v0.25.5
go: downloading github.com/go-openapi/swag/yamlutils v0.25.5
go: downloading google.golang.org/protobuf v1.36.11
go: downloading cel.dev/expr v0.25.1
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9
go: downloading github.com/blang/semver/v4 v4.0.0
go: downloading github.com/prometheus/client_golang v1.23.2
go: downloading github.com/prometheus/client_model v0.6.2
go: downloading github.com/prometheus/procfs v0.19.2
go: downloading github.com/spf13/pflag v1.0.10
go: downloading go.opentelemetry.io/otel/trace v1.43.0
go: downloading go.opentelemetry.io/otel v1.43.0
go: downloading github.com/cloudflare/circl v1.6.3
go: downloading gopkg.in/warnings.v0 v0.1.2
go: downloading github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8
go: downloading github.com/kevinburke/ssh_config v1.2.0
go: downloading github.com/skeema/knownhosts v1.3.1
go: downloading github.com/xanzy/ssh-agent v0.3.3
go: downloading github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
go: downloading github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee
go: downloading golang.org/x/oauth2 v0.36.0
go: downloading golang.org/x/time v0.15.0
go: downloading github.com/x448/float16 v0.8.4
go: downloading github.com/antlr4-go/antlr/v4 v4.13.1
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9
go: downloading github.com/beorn7/perks v1.0.1
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading github.com/prometheus/common v0.67.5
go: downloading github.com/Microsoft/go-winio v0.6.2
go: downloading golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa
go: downloading github.com/spf13/cobra v1.10.2
go: downloading github.com/inconshreveable/mousetrap v1.1.0
go: downloading github.com/emicklei/go-restful/v3 v3.13.0
go: downloading github.com/crossplane/crossplane/v2 v2.3.2
go: downloading github.com/crossplane/crossplane v1.20.9
go: github.com/crossplane-contrib/xprin/cmd/xprin-helpers/claimtoxr imports
	github.com/crossplane/crossplane/v2/cmd/crank/beta/convert/io: cannot find module providing package github.com/crossplane/crossplane/v2/cmd/crank/beta/convert/io
go: github.com/crossplane-contrib/xprin/cmd/xprin-helpers/patchxr imports
	github.com/crossplane/crossplane/v2/apis/apiextensions/v1: cannot find module providing package github.com/crossplane/crossplane/v2/apis/apiextensions/v1
go: github.com/crossplane-contrib/xprin/cmd/xprin-helpers/patchxr imports
	github.com/crossplane/crossplane/v2/cmd/crank/render: cannot find module providing package github.com/crossplane/crossplane/v2/cmd/crank/render

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tampakrap tampakrap Awaiting requested review from tampakrap tampakrap is a code owner

Assignees

No one assigned

Labels

automated

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants