Skip to content

fix(deps): update module github.com/crossplane/crossplane to v2#116

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/github.com-crossplane-crossplane-2.x
Open

fix(deps): update module github.com/crossplane/crossplane to v2#116
renovate[bot] wants to merge 1 commit intomainfrom
renovate/github.com-crossplane-crossplane-2.x

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Sep 30, 2025

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change OpenSSF
github.com/crossplane/crossplane require major v1.20.3v2.2.0 OpenSSF Scorecard

Release Notes

crossplane/crossplane (github.com/crossplane/crossplane)

v2.2.0

Compare Source

The v2.2.0 release is a regular quarterly Crossplane release that is focused on maturing a number of key areas of functionality across the project, as Crossplane continues to become more capable, more reliable, and more performant for your production workloads. This release includes many fixes and reliability improvements, a new alpha feature for debugging (the pipeline inspector), and usability improvements.

ℹ️ Extended support for v1.20

Normally, the release of v2.2 would correspond with the end-of-life for v1.20. However, because v1.20 is the last minor release of the v1 series and major version upgrades require additional planning for users, v1.20 will continue to receive critical fixes. The final EOL date for v1.20 is to be determined.

⚠️ Upgrade from v2.1

It is strongly advised to upgrade to v2.2 from the previous minor version, which is v2.1. Upon upgrade for each minor release, Crossplane performs any necessary migrations of its CRDs to ensure the latest versions are stored in the Kubernetes API server. Therefore, it is important to upgrade sequentially through one minor version at a time as described in the upgrade docs.

🚨 Notable and Breaking Changes

  • Input CRDs included in Function packages are no longer installed by the package manager, following the xpkg specification. Unknown or disallowed resources in a package are now ignored instead of causing package installation to fail. See #​6976.
  • The on-disk structure of the package cache has changed. This breaks an undocumented behavior via which packages could be side-loaded into Crossplane, which was especially useful for testing. See #​6981 for details on the change and #​7147 for discussion of the test changes necessary to accommodate it.

🎉 Highlights

  • ImageConfig can now be used to configure the DeploymentRuntimeConfig used for packages, including those installed as dependencies. Note that a matching ImageConfig takes precedence over the runtimeConfigRef in a package spec if both are present. See #​6382.
  • The MRD controller now uses server-side apply to update CRDs, improving reliability. See #​6934.
  • The pipeline inspector is now available as an alpha feature (disabled by default). When enabled, the inspector forwards function requests and responses to a user-configured gRPC endpoint for debugging or observability. See #​7025 and #​7031.
  • XRDs can now configure x-kubernetes-validations outside of the spec. This allows for validation of metadata such as names and labels. See #​7018.
  • Composition and operation functions can now request OpenAPI schemas for any resource kind in the cluster using the RequiredSchemas field in the function response. Crossplane now advertises capabilities (including required schemas) to functions in a new function request field. See #​7022.
  • The crossplane beta trace CLI command now supports tracing all resources of a given kind, and supports watching resources. See #​6552 and #​7015.
  • New documentation has been added regarding connection details for composite resources and workload identity with Crossplane.

🏅 Release MVP

@​jonasz-lasut is the v2.2 release MVP! Their work driving enhancements, fixing bugs, and maintaining quality across Crossplane and its ecosystem is much appreciated by the Crossplane maintainers. Additionally, @​jonasz-lasut is an active participant on the Crossplane Slack instance, answering questions and providing guidance to many new and experienced members of the community. Thank you for your dedication, @​jonasz-lasut! 🎉

What's Changed

New Contributors

Full Changelog: crossplane/crossplane@v2.1.0...v2.2.0

v2.1.4

Compare Source

This release backports #​7030 to the 2.1 branch to fix one of the issues reported in #​3423, where shared transitive dependencies could not be upgraded successfully. It also contains security updates to Crossplane's dependencies.

What's Changed

Full Changelog: crossplane/crossplane@v2.1.3...v2.1.4

v2.1.3

Compare Source

This release resolves #​6761 - issues when upgrading providers that manifest with errors like these:

cannot establish control of object: addresses.compute.gcp.upbound.io is already controlled by ProviderRevision provider-gcp-compute-a41e4ba551fc (UID 58db5de-38e7-40f9-9d31-669bb25a688e)

What's Changed

  • [Backport release-2.1] Use server-side apply for MRD controller by @​negz in #​6952

Full Changelog: crossplane/crossplane@v2.1.2...v2.1.3

v2.1.2

Compare Source

What's Changed

Full Changelog: crossplane/crossplane@v2.1.1...v2.1.2

v2.1.1

Compare Source

This release backports #​6911, which makes the new XR watch circuit breaker a little more lenient. We noticed sometimes simple XRs were triggering the circuit breaker during initial creation, which usually involves a burst of watch events as resources are created and update to reach a stable state.

What's Changed

Full Changelog: crossplane/crossplane@v2.1.0...v2.1.1

v2.1.0

Compare Source

The v2.1.0 release is a regular quarterly Crossplane release that is focused on maturing a number of key areas of functionality across the project, as Crossplane continues to become more capable, more reliable, and more performant for your production workloads. After the major v2.0 release, we spent time focusing on polishing and hardening the experience with the goal of enhancing core reliability.

⚠️ Upgrade from v2.0

It is strongly advised to upgrade to v2.1 from the previous minor version, which is v2.0. Upon upgrade for each minor release, Crossplane performs any necessary migrations of its CRDs to ensure the latest versions are stored in the Kubernetes API server. Therefore, it is important to upgrade sequentially through one minor version at a time as described in the upgrade docs.

🎉 Highlights

  • XR circuit breaker: A circuit breaker was added to all Composite Resource (XR) controllers in #​6777 to prevent reconciliation thrashing when controllers fight over composed resource state. This addresses a common cause of excessive resource (CPU) usage.
    • Each circuit breaker monitors reconciliation rates for their XR and opens ("breaks the circuit") when thresholds are exceeded (50 burst, 1 every 2s sustained). While open, it blocks most reconcile requests but allows one through every 30 seconds. The circuit stays open for 5 minutes, then automatically closes and returns to normal operation. If thrashing resumes, the circuit will open again.
  • Realtime compositions for namespaced XRs: #​6780 fixes an issue where namespaced XRs were not being reconciled in response to changes in their composed resources.
  • crossplane render for remote Docker daemons: #​6799 fixes an issue that prevented crossplane render from establishing a connection to the remote Docker host.
    • crossplane render now allows function annotations to be passed on the command line with -a/--function-annotations flags. Two new function annotations are now supported:
      • render.crossplane.io/runtime-docker-publish-address controls the host address Docker publishes the container port to (defaults to 127.0.0.1 for security)
      • render.crossplane.io/runtime-docker-target controls the address the CLI connects to (defaults to the publish address)
  • XRD change detection: In previous versions of Crossplane, XRD spec fields could change without the XR controller being restarted automatically. With #​6806, users no longer need to manually restart the Crossplane deployment for some XRD changes to take effect.

🚨 Warnings and breaking changes

  • Crossplane's custom rate limiting implementation as well as client-side rate limiting has been removed in #​6851 as proposed and described in detail in #​6790.
    • Crossplane's reconcilers will rely on a combination of the Kubernetes API Priority and Fairness, the circuit breaker described in the highlights below, and worker pool size configuration to appropriately manage reconciliation load and retries in the control plane.
    • --max-concurrent-reconciles can be set to influence the maximum number of concurrent reconcile operations (worker pool size) that Crossplane will perform.
      • The --max-reconcile-rate flag has been renamed to this new --max-concurrent-reconciles flag to better represent what this flag controls
      • The old --max-reconcile-rate flag is now an alias for the new flag name
    • Providers are unaffected by this change, only core Crossplane reconcilers are affected.

🏅 Release MVP

@​binarycode is the v2.1 release MVP! They discovered a critical issue preventing realtime compositions from functioning correctly for namespaced XRs. Their fix in #​6780 now properly configures an index for each namespaced XR so that events generated from changes in their composed resources correctly result in the XR being enqueued for reconciliation.

Thank you very much to @​binarycode, our latest release MVP! 🙇‍♂️

What's Changed

New Contributors


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Contributor Author

renovate bot commented Sep 30, 2025

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 2 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.47.0 -> v0.47.0
sigs.k8s.io/controller-tools v0.16.5 -> v0.18.0

@renovate renovate bot force-pushed the renovate/github.com-crossplane-crossplane-2.x branch from 8e02748 to f29ae96 Compare October 15, 2025 13:00
@renovate renovate bot force-pushed the renovate/github.com-crossplane-crossplane-2.x branch 6 times, most recently from dd1af84 to 5107653 Compare November 4, 2025 10:15
@renovate renovate bot force-pushed the renovate/github.com-crossplane-crossplane-2.x branch 3 times, most recently from ab202bf to 210c31c Compare November 11, 2025 00:03
@renovate renovate bot force-pushed the renovate/github.com-crossplane-crossplane-2.x branch 5 times, most recently from 4f10e82 to 072b18f Compare December 2, 2025 06:02
@renovate
Copy link
Contributor Author

renovate bot commented Dec 15, 2025

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 94 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.25.4 -> 1.25.6
golang.org/x/text v0.31.0 -> v0.33.0
k8s.io/api v0.34.2 -> v0.35.0
k8s.io/apiextensions-apiserver v0.34.2 -> v0.35.0
k8s.io/apimachinery v0.34.2 -> v0.35.0
k8s.io/client-go v0.34.2 -> v0.35.0
sigs.k8s.io/controller-runtime v0.22.4 -> v0.23.1
cel.dev/expr v0.25.0 -> v0.25.1
cloud.google.com/go/auth v0.17.0 -> v0.18.0
github.com/aws/aws-sdk-go-v2 v1.39.6 -> v1.41.0
github.com/aws/aws-sdk-go-v2/config v1.31.17 -> v1.32.5
github.com/aws/aws-sdk-go-v2/credentials v1.18.21 -> v1.19.5
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.13 -> v1.18.16
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13 -> v1.4.16
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13 -> v2.7.16
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.3 -> v1.13.4
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.13 -> v1.13.16
github.com/aws/aws-sdk-go-v2/service/sso v1.30.1 -> v1.30.7
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.5 -> v1.35.12
github.com/aws/aws-sdk-go-v2/service/sts v1.39.1 -> v1.41.5
github.com/aws/smithy-go v1.23.2 -> v1.24.0
github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.10.1 -> v0.11.0
github.com/coreos/go-oidc/v3 v3.16.0 -> v3.17.0
github.com/docker/cli v28.5.2+incompatible -> v29.0.3+incompatible
github.com/go-chi/chi/v5 v5.2.3 -> v5.2.4
github.com/go-git/go-billy/v5 v5.6.2 -> v5.7.0
github.com/go-git/go-git/v5 v5.16.3 -> v5.16.4
github.com/go-openapi/analysis v0.24.0 -> v0.24.1
github.com/go-openapi/errors v0.22.3 -> v0.22.6
github.com/go-openapi/jsonpointer v0.22.1 -> v0.22.4
github.com/go-openapi/jsonreference v0.21.2 -> v0.21.4
github.com/go-openapi/loads v0.23.1 -> v0.23.2
github.com/go-openapi/runtime v0.29.0 -> v0.29.2
github.com/go-openapi/spec v0.22.0 -> v0.22.3
github.com/go-openapi/strfmt v0.24.0 -> v0.25.0
github.com/go-openapi/swag v0.25.1 -> v0.25.4
github.com/go-openapi/swag/cmdutils v0.25.1 -> v0.25.4
github.com/go-openapi/swag/conv v0.25.1 -> v0.25.4
github.com/go-openapi/swag/fileutils v0.25.1 -> v0.25.4
github.com/go-openapi/swag/jsonname v0.25.1 -> v0.25.4
github.com/go-openapi/swag/jsonutils v0.25.1 -> v0.25.4
github.com/go-openapi/swag/loading v0.25.1 -> v0.25.4
github.com/go-openapi/swag/mangling v0.25.1 -> v0.25.4
github.com/go-openapi/swag/netutils v0.25.1 -> v0.25.4
github.com/go-openapi/swag/stringutils v0.25.1 -> v0.25.4
github.com/go-openapi/swag/typeutils v0.25.1 -> v0.25.4
github.com/go-openapi/swag/yamlutils v0.25.1 -> v0.25.4
github.com/go-openapi/validate v0.25.0 -> v0.25.1
github.com/google/gnostic-models v0.7.0 -> v0.7.1
github.com/google/go-containerregistry v0.20.6 -> v0.20.7
github.com/googleapis/enterprise-certificate-proxy v0.3.7 -> v0.3.9
github.com/googleapis/gax-go/v2 v2.15.0 -> v2.16.0
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 -> v2.27.4
github.com/in-toto/in-toto-golang v0.9.0 -> v0.10.0
github.com/klauspost/compress v1.18.1 -> v1.18.2
github.com/letsencrypt/boulder v0.20251103.0 -> v0.20251110.0
github.com/prometheus/common v0.67.2 -> v0.67.5
github.com/redis/go-redis/v9 v9.16.0 -> v9.17.2
github.com/secure-systems-lab/go-securesystemslib v0.9.1 -> v0.10.0
github.com/sigstore/rekor v1.4.2 -> v1.5.0
github.com/sigstore/sigstore v1.9.6-0.20250729224751-181c5d3339b3 -> v1.10.4
github.com/sigstore/sigstore-go v1.1.3 -> v1.1.4
github.com/sirupsen/logrus v1.9.3 -> v1.9.4
github.com/spf13/cobra v1.10.1 -> v1.10.2
github.com/theupdateframework/go-tuf/v2 v2.3.0 -> v2.4.1
github.com/transparency-dev/tessera v1.0.0 -> v1.0.1-0.20251104110637-ba6c65c4ae73
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 -> v0.64.0
go.opentelemetry.io/otel v1.38.0 -> v1.40.0
go.opentelemetry.io/otel/metric v1.38.0 -> v1.40.0
go.opentelemetry.io/otel/sdk v1.38.0 -> v1.39.0
go.opentelemetry.io/otel/sdk/metric v1.38.0 -> v1.39.0
go.opentelemetry.io/otel/trace v1.38.0 -> v1.40.0
go.uber.org/zap v1.27.0 -> v1.27.1
golang.org/x/crypto v0.45.0 -> v0.47.0
golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 -> v0.0.0-20260112195511-716be5621a96
golang.org/x/mod v0.29.0 -> v0.32.0
golang.org/x/oauth2 v0.32.0 -> v0.34.0
golang.org/x/sync v0.18.0 -> v0.19.0
golang.org/x/sys v0.38.0 -> v0.40.0
golang.org/x/term v0.37.0 -> v0.39.0
golang.org/x/tools v0.38.0 -> v0.41.0
gomodules.xyz/jsonpatch/v2 v2.4.0 -> v2.5.0
google.golang.org/api v0.255.0 -> v0.260.0
google.golang.org/genproto v0.0.0-20251103181224-f26f9409b101 -> v0.0.0-20251202230838-ff82c1b0f217
google.golang.org/genproto/googleapis/api v0.0.0-20251103181224-f26f9409b101 -> v0.0.0-20260114163908-3f89685c29c3
google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101 -> v0.0.0-20260203192932-546029d2fa20
google.golang.org/grpc v1.76.0 -> v1.78.0
google.golang.org/protobuf v1.36.10 -> v1.36.11
gopkg.in/ini.v1 v1.67.0 -> v1.67.1
k8s.io/component-base v0.34.2 -> v0.35.0
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 -> v0.0.0-20260127142750-a19766b6e2d4
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 -> v0.0.0-20260108192941-914a6e750570
sigs.k8s.io/controller-tools v0.16.5 -> v0.20.0
sigs.k8s.io/release-utils v0.12.2 -> v0.12.3
sigs.k8s.io/structured-merge-diff/v6 v6.3.0 -> v6.3.2-0.20260122202528-d9cc6641c482

@renovate renovate bot force-pushed the renovate/github.com-crossplane-crossplane-2.x branch from 072b18f to 1e45a16 Compare February 3, 2026 21:09
@renovate renovate bot force-pushed the renovate/github.com-crossplane-crossplane-2.x branch from 1e45a16 to fcee455 Compare February 17, 2026 23:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants