Skip to content

fix(deps): update module github.com/crossplane/crossplane/apis/v2 to v2.4.0-rc.1 - #427

Merged
renovate[bot] merged 1 commit into
mainfrom
renovate/github.com-crossplane-crossplane-apis-v2-2.x
Aug 16, 2026
Merged

fix(deps): update module github.com/crossplane/crossplane/apis/v2 to v2.4.0-rc.1#427
renovate[bot] merged 1 commit into
mainfrom
renovate/github.com-crossplane-crossplane-apis-v2-2.x

Conversation

@renovate

@renovate renovate Bot commented Aug 15, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/crossplane/crossplane/apis/v2 v2.4.0-rc.0 → v2.4.0-rc.1 age confidence

Release Notes

crossplane/crossplane (github.com/crossplane/crossplane/apis/v2)

v2.4.0-rc.1

Compare Source

❗ Important

Crossplane version v2.4.0-rc.1 is a release candidate intended to collect input from the community and offer users an opportunity to experiment with Crossplane in non-production environments before the official release of version v2.4.0.

[!WARNING]
This is a pre-release; do not use it in production environments!

To install Crossplane with this release:

helm repo add crossplane-stable https://charts.crossplane.io/stable --force-update
helm install crossplane --namespace crossplane-system --create-namespace crossplane-stable/crossplane --devel

🚨 Notable and Breaking Changes

  • ⚠️ The Crossplane CLI is no longer published to releases.crossplane.io. New CLI releases go only to cli.crossplane.io, under the binary name crossplane rather than crank. This completes the CLI's move to https://github.com/crossplane/cli, which was announced in the v2.3.0 release notes and dual published to both locations for v2.3.0 to ease the transition.
    • f you are using custom installation scripts or CI steps that download the CLI directly from releases.crossplane.io, update them to use cli.crossplane.io, and update any firewall or proxy rule that allows releases.crossplane.io to now allow cli.crossplane.io instead.
      • Users of the install.sh script as their installation procedure are unaffected.
    • The CLI now follows its own release schedule, so a CLI release will not accompany every core Crossplane release and the two version numbers have diverged.
    • Documentation and installation instructions for the Crossplane CLI can be found on https://docs.crossplane.io/cli/latest/.
  • Package revision names are now derived from both the package digest and the package's metadata.generation, so any change to a package's spec produces a new PackageRevision. #​7473
    • This fixes the long standing issue where changing a package's runtimeConfigRef reused the existing revision, along with its stale runtime settings. #​5068
    • When upgrading to v2.4, every installed package gets a new revision, with a new name, on its first reconcile.
    • ⚠️ The Pods for Providers and Functions will be restarted for this new revision.
  • Package runtime objects (Deployment, ServiceAccount, Service, and TLS Secrets) are now applied with server-side apply under the pkg.crossplane.io/runtime field manager, replacing the previous merge patch applicator. #​7563
    • A field you remove from a DeploymentRuntimeConfig is now removed from the live runtime object, rather than lingering until that object is replaced. #​4817
    • Additions that Crossplane doesn't declare are left alone rather than replaced along with the array that held them, e.g. an injected sidecar container or an extra volume added out of band now survives a reconcile.
  • The RUNTIME printer column on ProviderRevision and FunctionRevision was renamed to RUNTIME-HEALTHY, and a new RUNTIME-ACTIVE column was added. #​7586
    • Update any tooling that reads kubectl get providerrevision or kubectl get functionrevision output by column position.
  • The type label on the engine_watches_started_total and engine_watches_stopped_total metrics changed from ComposedResource to Dependency, now that a single watch mechanism covers both composed and required resources. #​7572
    • Update any dashboards or alerts that filter on that label value.

🎉 Highlights

  • Watching required resources: Composition functions can require resources they don't compose, but Crossplane didn't watch them, so a change to a required resource didn't reconcile the XRs that required it until their next poll. Crossplane now tracks the resources each XR depends on and drives watches from that. A change to a required resource now reconciles the XRs that required it the same way a change to a composed resource does. This works when realtime compositions are enabled, which is the default. See design/one-pager-watching-required-resources.md and #​7572.
  • Safe-start provider runtimes scale to zero until activated: A provider with the safe-start capability runs no managed resource controllers while all of its ManagedResourceDefinitions are inactive, so there is no reason to run its pods. Crossplane now creates such a provider's runtime Deployment with zero replicas and scales it up once its first MRD becomes active, such as through a matching ManagedResourceActivationPolicy. Installing a broad set of providers no longer costs you a running pod for each one that has nothing to reconcile yet. #​7586
    • A new RuntimeActive condition on ProviderRevision and FunctionRevision makes this visible. It is False with reason AwaitingActivation while the runtime is intentionally scaled to zero and True once it has been scaled up. RuntimeHealthy stays healthy in both cases, and the package's Healthy condition surfaces the awaiting state with the same reason.
    • Scaling to zero takes precedence over an explicit spec.replicas in a DeploymentRuntimeConfig, which is now read as how many replicas to run while running, rather than a demand to always be running. #​7639
  • Vulnerability-scannable container images: Crossplane container images are now built with nixpkgs' buildGoModule, which includes the full Go dependency list into the binary. Scanners such as grype and trivy previously were only able to discover the Crossplane main module and the Go standard library, so CVEs in our third-party dependencies were not visible to them. Now Crossplane and its complete set of dependencies are visible to security scanner tools. #​7549
  • More reliable package runtime management: Server-side apply for package runtime objects means a field you remove from a DeploymentRuntimeConfig is now actually removed from the live Deployment instead of lingering (#​7563, fixing #​4817). Deactivating a revision also no longer deletes a runtime Deployment that another revision controls, which could happen when a DeploymentRuntimeConfig pins a stable deploymentTemplate.metadata.name (#​7561).
  • Hardening across composition and package paths: Several changes tighten paths where a caller could reach further than intended. The composed resource garbage collector now only deletes resources whose controller reference points back to the XR, so spec.resourceRefs can no longer be used to make the composite controller delete arbitrary resources (#​7627). The claim to XR syncers now strip XR machinery fields such as resourceRefs and the crossplane stanza, which a claim could otherwise smuggle through an XRD schema that sets x-kubernetes-preserve-unknown-fields: true (#​7626).
  • Version-aware docs search: Searching from an older version of the docs, such as /v1.20/, used to return results from all versions, potentially returning features and APIs that don't exist in the version you're actually reading. Search is now scoped to the version you're on, results carry a clearly visible version badge, and pages from older versions show a banner explaining that, with a link to latest. Thanks to @​haarchri for this one in crossplane/docs#1051, so give it a try at https://docs.crossplane.io.
  • Security fixes in dependencies: The Go version Crossplane builds/runs with was bumped to pick up standard library CVE fixes, alongside a steady stream of security updates to Crossplane's Go dependencies across this release cycle.
  • Other notable improvements:
    • Several fixes to the render engine that backs crossplane render: an XRD schema can now be supplied to crossplane internal render (#​7452), requirements are returned even when a function returns a fatal result (#​7455), a namespace is set on injected resource references only for cluster-scoped XRs, matching the real reconciler (#​7523), and an input XR fetched from a real cluster keeps its own UID so its observed resources are read correctly, with clear errors when observed resources don't line up with the XR (#​7544).
    • The sha256 files published with release binaries are now calculated after Nix strips the binary, so amd64 checksums match what you download. They didn't for v2.2.0 through v2.3.1, and CI now verifies checksums before uploading artifacts. #​7660
    • A composed Usage no longer gets a redundant owner update on every reconcile, which could repeatedly trigger composition reconciliation and eventually open the XR circuit breaker. #​7591
    • The deletion protection field index now uses a separator that can't appear in a group, kind, name, or namespace, so two distinct resources can no longer collide and block a deletion that should be allowed. #​7508
    • Sorting of spec.resourceRefs now includes the namespace, so references stay stable when composed resources share a name across namespaces. #​7341

📖 Full Changelog

New Contributors

Full Changelog: crossplane/crossplane@v2.3.0...v2.4.0-rc.1

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from jcogilvie as a code owner August 15, 2026 20:24
@renovate renovate Bot added the automated label Aug 15, 2026
@renovate
renovate Bot requested a review from tampakrap as a code owner August 15, 2026 20:24
@renovate renovate Bot added the automated label Aug 15, 2026
@renovate
renovate Bot enabled auto-merge (squash) August 15, 2026 20:24
github-actions[bot]
github-actions Bot approved these changes Aug 15, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automatically approved: Renovate dependency update. Merge is gated on required status checks.

@renovate
renovate Bot force-pushed the renovate/github.com-crossplane-crossplane-apis-v2-2.x branch from 31704e2 to e0f082d Compare August 16, 2026 01:56
@renovate
renovate Bot force-pushed the renovate/github.com-crossplane-crossplane-apis-v2-2.x branch from e0f082d to a6e3777 Compare August 16, 2026 06:14
@renovate
renovate Bot merged commit 7f89596 into main Aug 16, 2026
14 checks passed
@renovate
renovate Bot deleted the renovate/github.com-crossplane-crossplane-apis-v2-2.x branch August 16, 2026 06:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes
@jcogilvie jcogilvie Awaiting requested review from jcogilvie jcogilvie is a code owner
@tampakrap tampakrap Awaiting requested review from tampakrap tampakrap is a code owner

Assignees

No one assigned

Labels

automated

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants