[crossplane-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/crossplane/crossplane/apis/v2	v2.4.1 → v2.4.3

---

Release Notes

crossplane/crossplane (github.com/crossplane/crossplane/apis/v2)

v2.4.3

Compare Source

v2.4.3 is a patch release scoped to fixing issues reported by users of Crossplane v2.4 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights

• Distrust of compromised eMudhra intermediate CAs: Bumps the Go toolchain to 1.26.10, whose crypto/x509 rejects the compromised eMudhra intermediate certificates (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots they chain to from the image's CA bundle (#​7957).
• Truncated package downloads are no longer cached: A package download that failed partway could be cached as a valid but truncated package.yaml. The package revision then recorded only some of its objects, reported Healthy=True, and the provider's RBAC was rendered from the short list, so the provider could crash-loop. Truncated downloads are now discarded. Fixed via crossplane-runtime v2.4.3 (#​7961), originally crossplane/crossplane-runtime#1189.
• Usage no longer rewrites the in-use label on every reconcile: A leftover ownership check meant the used resource was updated on every reconcile of every Usage/ClusterUsage, causing needless API writes. Backported in #​7877, originally fixed in #​7860.
• XR scale RBAC: Users with crossplane-edit or crossplane-admin access can now kubectl scale XRs and claims whose XRD serves the scale subresource; previously they got Forbidden. Backported in #​7934, originally fixed in #​7922.
• Dependency security updates: A combined set of vulnerable dependency updates (#​7915) to pick up upstream CVE fixes. Also refreshes the lock file (#​7894, #​7909).

What's Changed

• [Backport release-2.4] e2e: Use xpkg.upbound.io for private package pull test by @​github-actions[bot] in #​7873
• [Backport release-2.4] fix: stop rewriting the in-use label on every Usage reconcile by @​github-actions[bot] in #​7877
• chore(deps): lock file maintenance (release-2.4) by @​crossplane-renovate[bot] in #​7894
• chore(deps): update vulnerable dependencies [security] (release-2.4) by @​crossplane-renovate[bot] in #​7915
• chore(deps): lock file maintenance (release-2.4) by @​crossplane-renovate[bot] in #​7909
• [release-2.4] build(deps): bump Go to 1.26.9 [security] by @​lsviben in #​7951
• [release-2.4] build(deps): bump Go to 1.26.10 and distrust compromised eMudhra roots [security] by @​lsviben in #​7957
• [Backport release-2.4] allow users with crossplane-edit and crossplane-admin access to scale XRs that serve it by @​github-actions[bot] in #​7934
• [release-2.4] chore(deps): bump crossplane-runtime to v2.4.3 by @​lsviben in #​7961

Full Changelog: crossplane/crossplane@v2.4.2...v2.4.3

v2.4.2

Compare Source

v2.4.2 is a patch release scoped to fixing issues reported by users of Crossplane v2.4 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights

• Fixed a bug where ownership of ServiceAccounts was not correctly transferred to newly active package revisions (#​7838). Fixed in #​7839 and backported in #​7852.

What's Changed

• [Backport release-2.4] fix: demote old revision controller ownerReference for SA by @​github-actions[bot] in #​7852
• chore(deps): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.45.0 [security] (release-2.4) by @​crossplane-renovate[bot] in #​7847
• [Backport release-2.4] fix: fail closed when a claim cannot list its XRD by @​github-actions[bot] in #​7862
• Bump crossplane-runtime dependency to v2.4.2 by @​adamwg in #​7863

Full Changelog: crossplane/crossplane@v2.4.1...v2.4.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[crossplane-renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 7 additional dependencies were updated

Details:

Package	Change
golang.org/x/mod	v0.40.0 -> v0.41.0
golang.org/x/sync	v0.22.0 -> v0.23.0
golang.org/x/text	v0.41.0 -> v0.42.0
golang.org/x/crypto	v0.56.0 -> v0.57.0
golang.org/x/net	v0.58.0 -> v0.60.0
golang.org/x/sys	v0.47.0 -> v0.48.0
golang.org/x/term	v0.45.0 -> v0.46.0