Skip to content

feat(algolia): add facets based on version for search - #1051

Merged
jbw976 merged 1 commit into
crossplane:masterfrom
haarchri:feature/algolia-search-facets
Aug 13, 2026
Merged

jbw976 merged 1 commit into
crossplane:masterfrom
haarchri:feature/algolia-search-facets

Conversation

@haarchri

@haarchri haarchri commented Jan 28, 2026

Copy link
Copy Markdown
Member

When browsing older documentation versions (for example, v1.20), search results currently all content from latest....
This leads to confusion when users discover features or APIs in search results that don’t actually exist in the version they’re viewing.

This PR introduces version-aware search filtering using Algolia facet filters. https://www.algolia.com/doc/guides/managing-results/refine-results/faceting
Search results will be restricted to the documentation version the user is currently viewing.

  • Added logic to detect the current page version via .Page.Params.version.
  • Configured DocSearch to apply a facetFilters value dynamically:
['version:X.XX']
  • Added special handling for the master version - uses version:0.0.0-master, which matches the existing meta tag convention where master is labeled 0.0.0-master to keep it de-ranked in search

Background

Each page already includes:

which the Algolia crawler indexes.

curl https://docs.crossplane.io/v2.0/composition/  | grep -A 10 "docsearch"
<meta name=docsearch:modified content='August 14, 2025'><meta name=docsearch:version content="2.0">
curl https://docs.crossplane.io/v1.20/concepts/  | grep -A 10 "docsearch"
<meta name=docsearch:modified content='May 21, 2025'><meta name=docsearch:version content="1.20">

Required: Algolia configuration

After this PR is merged, someone with Algolia admin access must enable faceting:

  • Open Algolia Dashboard

  • Go to the crossplane index

  • Navigate to Configuration → Facets

  • Add:
    searchable(version)
    to Attributes for faceting

  • Save

Testing:

curl http://localhost:1313/v2.1/composition/ | grep -A 10 "docsearch"
...
<script>
    docsearch({
    container: '#docSearch',
    appId: 'xxx',
    indexName: 'crossplane',
    apiKey: 'xxxxx',
    placeholder: 'Search the docs',
    searchParameters: {
      facetFilters: ['version:2.1']
    }
    });
</script>

To verify this PR:

  • Open any versioned docs page (for example, /v1.20/concepts/providers/)
  • Open DevTools → Network
  • Perform a search
  • Inspect the request to algolia.net
{"requests":[{"query":"t","indexName":"crossplane","attributesToRetrieve":["hierarchy.lvl0","hierarchy.lvl1","hierarchy.lvl2","hierarchy.lvl3","hierarchy.lvl4","hierarchy.lvl5","hierarchy.lvl6","content","type","url"],"attributesToSnippet":["hierarchy.lvl1:10","hierarchy.lvl2:10","hierarchy.lvl3:10","hierarchy.lvl4:10","hierarchy.lvl5:10","hierarchy.lvl6:10","content:10"],"snippetEllipsisText":"…","highlightPreTag":"<mark>","highlightPostTag":"</mark>","hitsPerPage":20,"clickAnalytics":false,"facetFilters":["version:2.0"]}]}

we see the facetFilters

Fixes: #1008

@netlify

netlify Bot commented Jan 28, 2026

Copy link
Copy Markdown

Deploy Preview for crossplane ready!

Name Link
🔨 Latest commit f28a6d9
🔍 Latest deploy log https://app.netlify.com/projects/crossplane/deploys/6a7dc65a74900d0007965ff8
😎 Deploy Preview https://deploy-preview-1051--crossplane.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
Lighthouse
Lighthouse
1 paths audited
Performance: 90 (🔴 down 4 from production)
Accessibility: 90 (🔴 down 2 from production)
Best Practices: 92 (no change from production)
SEO: 100 (no change from production)
PWA: 70 (no change from production)
View the detailed breakdown and full score reports

To edit notification comments on pull requests, go to your Netlify project configuration.

Comment thread themes/geekboot/layouts/_default/baseof.html

@jbw976 jbw976 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is very interesting @haarchri! Hopefully everything works smoothly after this PR gets merged 😂

One immediate question for you - do you know what the UX is going to be for showing multiple versions in the search? will the search popup make it clear which version each result is from? Will it favor newer versions over older versions? are you able to see this in your local testing, or do we have to merge this, update Algolia config, and see what happens?

@jbw976 jbw976 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

RE: the Algolia config instructions

Add:
filterOnly(docsearch:version)
to Attributes for faceting

Looks like we have a version attribute for faceting already on https://dashboard.algolia.com/apps/9UXKYX61NK/explorer/configuration/crossplane/facets, is that useful?

Image

I was able to do a network inspect on the preview site and when searching it does look like facetFilters are being sent in the request, so that's a good sign 😉

facetFilters=%5B%22docsearch%3Aversion%3A0.0.0-master%22%5D

Comment thread themes/geekboot/layouts/partials/scripts.html
@haarchri

Copy link
Copy Markdown
Member Author

@jbw976 the facet needs to match the tagName ... can you add docsearch:version ? its fine to do this before i guess - if we have an issue we can remove it

@jbw976

jbw976 commented Jan 29, 2026

Copy link
Copy Markdown
Member

added docsearch:version to attributes for faceting as "filter only" and saved it @haarchri!
Screenshot 2026-01-29 at 10 20 11 AM

@jbw976

jbw976 commented Jan 29, 2026

Copy link
Copy Markdown
Member

do you know what the UX is going to be for showing multiple versions in the search?

and i think the answer to this is that we don't show multiple versions in the results - we only show results for the version you're currently on. is that right @haarchri?

@jbw976

jbw976 commented Jan 29, 2026

Copy link
Copy Markdown
Member

by the way, trying to also make sense of this comment in the the netlify_build.sh:

# Search indexing only points to /latest, this prevents broken or out of date
# search results

is this configured somewhere in this docs repo that we need to update? on the algolia side? i haven't found it yet 😇

edit: ah, i think it's controlled by the sitemap.xml: https://docs.crossplane.io/sitemap.xml, which is generated from https://github.com/crossplane/docs/blob/master/themes/geekboot/layouts/_default/sitemap.xml.

Algolia doesn't appear to be configured to only look at latest, our sitemap/canonical/permalinks/etc. make it so any search engine (including Algolia) will only look at /latest and /contribute.

So i think we'd have to update that logic in this PR also for Algolia to start indexing those? If so, does that mean that google etc. will start indexing old versions too? we probably don't want old versions showing up in google results, only having /latest there is probably the right thing to do.

this is starting to get confusing, what do you think @haarchri? 😂

@haarchri
haarchri force-pushed the feature/algolia-search-facets branch from 2f73f76 to 6afdf98 Compare January 30, 2026 12:40
@haarchri

haarchri commented Feb 2, 2026

Copy link
Copy Markdown
Member Author
  • Configured Algolia crawler to index versioned documentation pages by setting ignoreCanonicalTo: true and extracting version from meta tags
  • Added facet filtering to search results based on current page version (e.g., v2.1 searches only show v2.1 results)
  • Displayed version badges on the right side of each search result
  • Added warning banner on old version pages indicating filtered search with link to latest version
  • Excluded version "0" pages (contribute, knowledge-base) from version filtering to allow searching all content
  • Updated release checklist to include Algolia crawler configuration updates before reindexing

Users now see version-specific search results when browsing versioned documentation, with clear visual indicators showing which version each result belongs to.
Screenshot 2026-01-30 at 14 16 19

Screenshot 2026-01-30 at 14 16 27 Screenshot 2026-01-30 at 14 16 09

@haarchri

haarchri commented Feb 2, 2026

Copy link
Copy Markdown
Member Author

updated crawler config - removed appId and appKey for comparison

old:

new Crawler({
  rateLimit: 8,
  maxDepth: 10,
  renderJavaScript: false,
  sitemaps: ["https://docs.crossplane.io/sitemap.xml"],
  ignoreCanonicalTo: false,
  schedule: "at 01:00 am",
  actions: [
    {
      name: "CrossplaneCrawler",
      indexName: "crossplane",
      pathsToMatch: [
        "https://docs.crossplane.io/latest/**",
        "https://docs.crossplane.io/knowledge-base/**",
        "https://docs.crossplane.io/contribute/**",
        "!https://docs.crossplane.io/latest/concepts/composition/",
      ],
      recordExtractor: ({ $, helpers }) => {
        // Strip all the headers out of the content in order to index them outside of the content

        const headlines = $(
          ".DocSearch-content h1, .DocSearch-content h2, .DocSearch-content h3, .DocSearch-content h4,.DocSearch-content h5, .DocSearch-content h6",
        );

        headlines.each(function (i, elem) {
          $(this).remove();
          $(".DocSearch-content").append($(this));
        });

        // Collection of elements to remove from the content
        const removeElems = $(
          ".DocSearch-content .admonition-title, .DocSearch-content .lnlinks, .DocSearch-content table thead",
        );
        removeElems.each(function (i, elem) {
          $(this).remove();
        });

        // Collection of elements to wrap in spaces
        const wrapElems = $(
          ".DocSearch-content .admonition-content, .DocSearch-content p, .DocSearch-content table td",
        );
        wrapElems.each(function (i, elem) {
          var innerText = $(this).text();
          $(this).text(" " + innerText + " ");
        });

        // Collection of elements to add a period and trailing space
        const periodElems = $(".DocSearch-content li");
        periodElems.each(function (i, elem) {
          var innerText = $(this).text();
          $(this).text(innerText + ". ");
        });

        return helpers.docsearch({
          recordProps: {
            lvl0: {
              selectors: [".expansion-link", "h1"],
            },
            lvl1: [".kind", "h2"],
            lvl2: ["h3"],
            lvl3: ["h4"],
            lvl4: ["h5"],
            lvl5: ["h6"],
            content: [".description", ".DocSearch-content"],
          },
          aggregateContent: true,
          recordVersion: "v3",
        });
      },
    },
  ],
  appId: "xxxx",
  apiKey: "xxxx",
});

new:

new Crawler({
  rateLimit: 8,
  maxDepth: 10,
  renderJavaScript: false,
  sitemaps: ["https://docs.crossplane.io/sitemap.xml"],
  ignoreCanonicalTo: true,
  schedule: "at 01:00 am",
  actions: [
    {
      name: "CrossplaneCrawler",
      indexName: "crossplane",
      pathsToMatch: [
        "https://docs.crossplane.io/latest/**",
        "https://docs.crossplane.io/master/**",
        "https://docs.crossplane.io/v2.1/**",
        "https://docs.crossplane.io/v2.0/**",
        "https://docs.crossplane.io/v1.20/**",
        "https://docs.crossplane.io/knowledge-base/**",
        "https://docs.crossplane.io/contribute/**",
        "!https://docs.crossplane.io/latest/concepts/composition/",
      ],
      recordExtractor: ({ $, helpers }) => {
        // Strip all the headers out of the content in order to index them outside of the content

        const headlines = $(
          ".DocSearch-content h1, .DocSearch-content h2, .DocSearch-content h3, .DocSearch-content h4,.DocSearch-content h5, .DocSearch-content h6",
        );

        headlines.each(function (i, elem) {
          $(this).remove();
          $(".DocSearch-content").append($(this));
        });

        // Collection of elements to remove from the content
        const removeElems = $(
          ".DocSearch-content .admonition-title, .DocSearch-content .lnlinks, .DocSearch-content table thead, .DocSearch-content .bd-callout-info",
        );
        removeElems.each(function (i, elem) {
          $(this).remove();
        });

        // Collection of elements to wrap in spaces
        const wrapElems = $(
          ".DocSearch-content .admonition-content, .DocSearch-content p, .DocSearch-content table td",
        );
        wrapElems.each(function (i, elem) {
          var innerText = $(this).text();
          $(this).text(" " + innerText + " ");
        });

        // Collection of elements to add a period and trailing space
        const periodElems = $(".DocSearch-content li");
        periodElems.each(function (i, elem) {
          var innerText = $(this).text();
          $(this).text(innerText + ". ");
        });

        // Extract version from meta tag
        const version =
          $('meta[name="docsearch:version"]').attr("content") || "";
        const records = helpers.docsearch({
          recordProps: {
            lvl0: {
              selectors: [".expansion-link", "h1"],
            },
            lvl1: [".kind", "h2"],
            lvl2: ["h3"],
            lvl3: ["h4"],
            lvl4: ["h5"],
            lvl5: ["h6"],
            content: [".description", ".DocSearch-content"],
          },
          aggregateContent: true,
          recordVersion: "v3",
        });

        return records.map((record) => ({
          ...record,
          version: version,
        }));
      },
    },
  ],
  appId: "xxxx",
  apiKey: "xxxx",
});

@haarchri
haarchri requested a review from jbw976 February 2, 2026 08:43

@jbw976 jbw976 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks to be working correctly when testing it again just now @haarchri, I think the experience is good enough to start with too and if we get feedback or find bugs then we can iterate!

A few questions about the release process to get clarity on (and likely update the release steps to make them more clear), but I'll put an approval on now and you can merge when that's completed.

Thanks @haarchri!! 🙇‍♂️

Comment thread .github/ISSUE_TEMPLATE/new_release.md Outdated
Signed-off-by: Christopher Haar <christopher.haar@upbound.io>
@haarchri
haarchri force-pushed the feature/algolia-search-facets branch from 89a3226 to f28a6d9 Compare August 13, 2026 13:27
@haarchri
haarchri requested a review from jbw976 August 13, 2026 13:28
@jbw976
jbw976 merged commit 0ba34f8 into crossplane:master Aug 13, 2026
6 checks passed
renovate Bot added a commit to blacksd/crd-schemas that referenced this pull request Aug 22, 2026
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
|
[crossplane/crossplane](https://redirect.github.com/crossplane/crossplane)
| minor | `v2.3.4` → `v2.4.0` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/47) for more information.

---

### Release Notes

<details>
<summary>crossplane/crossplane (crossplane/crossplane)</summary>

###
[`v2.4.0`](https://redirect.github.com/crossplane/crossplane/releases/tag/v2.4.0)

[Compare
Source](https://redirect.github.com/crossplane/crossplane/compare/v2.3.5...apis/v2.4.0-rc.1)

The `v2.4.0` release is a regular quarterly Crossplane release that is
focused on maturing a number of key areas of functionality across the
project, as Crossplane continues to become more capable, more reliable,
and more performant for your production workloads. This release includes
the ability to watch required resources and reconcile XRs immediately
when they change, scale to zero for safe-start capable providers,
release artifacts that are vulnerability scannable, and a wide range of
fixes and reliability improvements. It also includes security fixes in
Crossplane's Go toolchain and dependencies.

##### 🚨 v1.20 end-of-life (EOL) November 2026

This v2.4 release marks the final release cycle where v1.20 will be
maintained.

**When v2.5 is released in Nov 2026, v1.20 will reach its EOL and no
longer receive any support or maintenance by the Crossplane project**.
Until that time, we will continue to provide critical fixes and security
related dependency updates to v1.20.

> \[!IMPORTANT]
> This EOL notice applies only to the v1.20 release. v1 legacy workloads
like Claims and cluster scoped resources remain supported in Crossplane
v2 through extensive [backwards compatibility
support](https://docs.crossplane.io/latest/guides/upgrade-to-crossplane-v2/#legacy-resource-behavior).

##### Is your control plane ready for v2?

Upgrading to Crossplane v2 does not require any migration as part of the
upgrade process, with the exception of the minimal breaking changes
explicitly called out in the [v2
documentation](https://docs.crossplane.io/latest/guides/upgrade-to-crossplane-v2/#removed-features).
If your control plane is not affected by those changes, you can simply
[upgrade to
v2](https://docs.crossplane.io/latest/guides/upgrade-crossplane/) right
away.

To better assist Crossplane users in determining if their control planes
are affected by any of the breaking changes in v2, we have released a v2
readiness checker tool in the v1.20 Crossplane CLI that can be invoked
via `crossplane beta upgrade check`. You can read all about this tool in
the following resources:

- blog post: <https://blog.crossplane.io/v2-upgrade-check/>
- docs:
<https://docs.crossplane.io/v1.20/cli/command-reference/#beta-upgrade-check>
- release notes:
<https://github.com/crossplane/crossplane/releases/tag/v1.20.9>

##### Crossplane Downstream Distributions

Downstream distributions are eligible to continue their extended support
and maintenance for their releases that are based on upstream
Crossplane's v1.20. Check with your
[vendor](https://www.crossplane.io/commercial) for more details if you
are using a downstream distribution of Crossplane.

##### 🚨 v2.4 Notable and Breaking Changes

- ⚠️ The Crossplane CLI is no longer published to
`releases.crossplane.io`. New CLI releases go only to
`cli.crossplane.io`, under the binary name `crossplane` rather than
`crank`. This completes the CLI's move to
<https://github.com/crossplane/cli>, which was announced in the `v2.3.0`
release notes and dual published to both locations for `v2.3.0` to ease
the transition.
- f you are using custom installation scripts or CI steps that download
the CLI directly from `releases.crossplane.io`, update them to use
`cli.crossplane.io`, and update any firewall or proxy rule that allows
`releases.crossplane.io` to now allow `cli.crossplane.io` instead.
- Users of the
[`install.sh`](https://redirect.github.com/crossplane/crossplane/blob/main/install.sh)
script as their installation procedure are unaffected.
- The CLI now follows its own release schedule, so a CLI release will
not accompany every core Crossplane release and the two version numbers
have diverged.
- Documentation and installation instructions for the Crossplane CLI can
be found on <https://docs.crossplane.io/cli/latest/>.
- Package revision names are now derived from both the package digest
and the package's `metadata.generation`, so any change to a package's
spec produces a new `PackageRevision`.
[#&#8203;7473](https://redirect.github.com/crossplane/crossplane/issues/7473)
- This fixes the long standing issue where changing a package's
`runtimeConfigRef` reused the existing revision, along with its stale
runtime settings.
[#&#8203;5068](https://redirect.github.com/crossplane/crossplane/issues/5068)
- When upgrading to `v2.4`, every installed package gets a new revision,
with a new name, on its first reconcile.
- ⚠️ The `Pods` for `Providers` and `Functions` will be restarted for
this new revision.
- Package runtime objects (`Deployment`, `ServiceAccount`, `Service`,
and TLS `Secrets`) are now applied with server-side apply under the
`pkg.crossplane.io/runtime` field manager, replacing the previous merge
patch applicator.
[#&#8203;7563](https://redirect.github.com/crossplane/crossplane/issues/7563)
- A field you remove from a `DeploymentRuntimeConfig` is now removed
from the live runtime object, rather than lingering until that object is
replaced.
[#&#8203;4817](https://redirect.github.com/crossplane/crossplane/issues/4817)
- Additions that Crossplane doesn't declare are left alone rather than
replaced along with the array that held them, e.g. an injected sidecar
container or an extra volume added out of band now survives a reconcile.
- The `RUNTIME` printer column on `ProviderRevision` and
`FunctionRevision` was renamed to `RUNTIME-HEALTHY`, and a new
`RUNTIME-ACTIVE` column was added.
[#&#8203;7586](https://redirect.github.com/crossplane/crossplane/issues/7586)
- Update any tooling that reads `kubectl get providerrevision` or
`kubectl get functionrevision` output by column position.
- The `type` label on the `engine_watches_started_total` and
`engine_watches_stopped_total` metrics changed from `ComposedResource`
to `Dependency`, now that a single watch mechanism covers both composed
and required resources.
[#&#8203;7572](https://redirect.github.com/crossplane/crossplane/issues/7572)
  - Update any dashboards or alerts that filter on that label value.

##### 🎉 Highlights

- **Watching required resources**: Composition functions can require
resources they don't compose, but Crossplane didn't watch them, so a
change to a required resource didn't reconcile the XRs that required it
until their next poll. Crossplane now tracks the resources each XR
depends on and drives watches from that. A change to a required resource
now reconciles the XRs that required it the same way a change to a
composed resource does. This works when realtime compositions are
enabled, which is the default. See
[`design/one-pager-watching-required-resources.md`](https://redirect.github.com/crossplane/crossplane/blob/main/design/one-pager-watching-required-resources.md)
and
[#&#8203;7572](https://redirect.github.com/crossplane/crossplane/issues/7572).
- **Safe-start provider runtimes scale to zero until activated**: A
provider with the safe-start capability runs no managed resource
controllers while all of its `ManagedResourceDefinitions` are inactive,
so there is no reason to run its pods. Crossplane now creates such a
provider's runtime `Deployment` with zero replicas and scales it up once
its first MRD becomes active, such as through a matching
`ManagedResourceActivationPolicy`. Installing a broad set of providers
no longer costs you a running pod for each one that has nothing to
reconcile yet.
[#&#8203;7586](https://redirect.github.com/crossplane/crossplane/issues/7586)
- A new `RuntimeActive` condition on `ProviderRevision` and
`FunctionRevision` makes this visible. It is `False` with reason
`AwaitingActivation` while the runtime is intentionally scaled to zero
and `True` once it has been scaled up. `RuntimeHealthy` stays healthy in
both cases, and the package's `Healthy` condition surfaces the awaiting
state with the same reason.
- Scaling to zero takes precedence over an explicit `spec.replicas` in a
`DeploymentRuntimeConfig`, which is now read as how many replicas to run
while running, rather than a demand to always be running.
[#&#8203;7639](https://redirect.github.com/crossplane/crossplane/issues/7639)
- **Vulnerability-scannable container images**: Crossplane container
images are now built with nixpkgs' `buildGoModule`, which includes the
full Go dependency list into the binary. Scanners such as `grype` and
`trivy` previously were only able to discover the Crossplane main module
and the Go standard library, so CVEs in our third-party dependencies
were not visible to them. Now Crossplane and its complete set of
dependencies are visible to security scanner tools.
[#&#8203;7549](https://redirect.github.com/crossplane/crossplane/issues/7549)
- **More reliable package runtime management**: Server-side apply for
package runtime objects means a field you remove from a
`DeploymentRuntimeConfig` is now actually removed from the live
`Deployment` instead of lingering
([#&#8203;7563](https://redirect.github.com/crossplane/crossplane/issues/7563),
fixing
[#&#8203;4817](https://redirect.github.com/crossplane/crossplane/issues/4817)).
Deactivating a revision also no longer deletes a runtime `Deployment`
that another revision controls, which could happen when a
`DeploymentRuntimeConfig` pins a stable
`deploymentTemplate.metadata.name`
([#&#8203;7561](https://redirect.github.com/crossplane/crossplane/issues/7561)).
- **Hardening across composition and package paths**: Several changes
tighten paths where a caller could reach further than intended. The
composed resource garbage collector now only deletes resources whose
controller reference points back to the XR, so `spec.resourceRefs` can
no longer be used to make the composite controller delete arbitrary
resources
([#&#8203;7627](https://redirect.github.com/crossplane/crossplane/issues/7627)).
The claim to XR syncers now strip XR machinery fields such as
`resourceRefs` and the `crossplane` stanza, which a claim could
otherwise smuggle through an XRD schema that sets
`x-kubernetes-preserve-unknown-fields: true`
([#&#8203;7626](https://redirect.github.com/crossplane/crossplane/issues/7626)).
- **Version-aware docs search**: Searching from an older version of the
docs, such as `/v1.20/`, used to return results from all versions,
potentially returning features and APIs that don't exist in the version
you're actually reading. Search is now scoped to the version you're on,
results carry a clearly visible version badge, and pages from older
versions show a banner explaining that, with a link to latest. Thanks to
[@&#8203;haarchri](https://redirect.github.com/haarchri) for this one in
[crossplane/docs#1051](https://redirect.github.com/crossplane/docs/issues/1051),
so give it a try at <https://docs.crossplane.io>.
- **Security fixes in dependencies**: The Go version Crossplane
builds/runs with was bumped to pick up standard library CVE fixes,
alongside a steady stream of security updates to Crossplane's Go
dependencies across this release cycle.
- **Other notable improvements**:
- Several fixes to the render engine that backs `crossplane render`: an
XRD schema can now be supplied to `crossplane internal render`
([#&#8203;7452](https://redirect.github.com/crossplane/crossplane/issues/7452)),
requirements are returned even when a function returns a fatal result
([#&#8203;7455](https://redirect.github.com/crossplane/crossplane/issues/7455)),
a namespace is set on injected resource references only for
cluster-scoped XRs, matching the real reconciler
([#&#8203;7523](https://redirect.github.com/crossplane/crossplane/issues/7523)),
and an input XR fetched from a real cluster keeps its own UID so its
observed resources are read correctly, with clear errors when observed
resources don't line up with the XR
([#&#8203;7544](https://redirect.github.com/crossplane/crossplane/issues/7544)).
- The `sha256` files published with release binaries are now calculated
after Nix strips the binary, so amd64 checksums match what you download.
They didn't for `v2.2.0` through `v2.3.1`, and CI now verifies checksums
before uploading artifacts.
[#&#8203;7660](https://redirect.github.com/crossplane/crossplane/issues/7660)
- A composed `Usage` no longer gets a redundant owner update on every
reconcile, which could repeatedly trigger composition reconciliation and
eventually open the XR circuit breaker.
[#&#8203;7591](https://redirect.github.com/crossplane/crossplane/issues/7591)
- The deletion protection field index now uses a separator that can't
appear in a group, kind, name, or namespace, so two distinct resources
can no longer collide and block a deletion that should be allowed.
[#&#8203;7508](https://redirect.github.com/crossplane/crossplane/issues/7508)
- Sorting of `spec.resourceRefs` now includes the namespace, so
references stay stable when composed resources share a name across
namespaces.
[#&#8203;7341](https://redirect.github.com/crossplane/crossplane/issues/7341)

##### 🏅 Release MVP

For the v2.4 release cycle, we'd like to recognize
[@&#8203;rafal-jan](https://redirect.github.com/rafal-jan) as the
release MVP!

They had an enormous impact in `crossplane-runtime`, first by diagnosing
the root cause in
[crossplane/crossplane-runtime#1056](https://redirect.github.com/crossplane/crossplane-runtime/issues/1056)
of significant memory usage by providers that are safe-start capable
when they essentially watch and cache every CRD in the control plane.
Then [@&#8203;rafal-jan](https://redirect.github.com/rafal-jan) went a
step further and submitted an elegant solution in
[crossplane/crossplane-runtime#1058](https://redirect.github.com/crossplane/crossplane-runtime/pull/1058)
to strip the cached CRDs down to just the fields needed to watch and
respond appropriately to events, drastically reducing the memory
consumption by these providers. Thank you
[@&#8203;rafal-jan](https://redirect.github.com/rafal-jan)!

##### 📖 Full Changelog

- chore(deps): bump crossplane-runtime to v2.4.0-rc.0 by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7393](https://redirect.github.com/crossplane/crossplane/pull/7393)
- build: add release-2.3 to renovate baseBranches by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7395](https://redirect.github.com/crossplane/crossplane/pull/7395)
- ci: Run checks on the apis module by
[@&#8203;adamwg](https://redirect.github.com/adamwg) in
[#&#8203;7396](https://redirect.github.com/crossplane/crossplane/pull/7396)
- Make Renovate security updates bypass throttles by
[@&#8203;phisco](https://redirect.github.com/phisco) in
[#&#8203;7391](https://redirect.github.com/crossplane/crossplane/pull/7391)
- docs: add Stone Payments to ADOPTERS.md by
[@&#8203;gadsilva](https://redirect.github.com/gadsilva) in
[#&#8203;7388](https://redirect.github.com/crossplane/crossplane/pull/7388)
- build: Install Earthly in Renovate container via flake URL by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7404](https://redirect.github.com/crossplane/crossplane/pull/7404)
- build: put Nix profile bin on PATH in Renovate entrypoint by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7405](https://redirect.github.com/crossplane/crossplane/pull/7405)
- chore(deps): Bump Go to 1.25.10 to fix stdlib CVEs (main) by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7414](https://redirect.github.com/crossplane/crossplane/pull/7414)
- chore: bump releases table and renovate baseBranches after v2.3
release by [@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7418](https://redirect.github.com/crossplane/crossplane/pull/7418)
- chore(deps): update module golang.org/x/crypto to v0.52.0 \[security]
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7423](https://redirect.github.com/crossplane/crossplane/pull/7423)
- fix(ci): match release tags only when computing build version by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7431](https://redirect.github.com/crossplane/crossplane/pull/7431)
- build: tag the apis/ Go submodule on every release by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7444](https://redirect.github.com/crossplane/crossplane/pull/7444)
- Update install.sh to point at the new CLI release bucket by
[@&#8203;adamwg](https://redirect.github.com/adamwg) in
[#&#8203;7441](https://redirect.github.com/crossplane/crossplane/pull/7441)
- fix(render): allow xrd schema to be supplied for `internal render` by
[@&#8203;jcogilvie](https://redirect.github.com/jcogilvie) in
[#&#8203;7452](https://redirect.github.com/crossplane/crossplane/pull/7452)
- README: add sig-v2-migration to list of SIGs by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7462](https://redirect.github.com/crossplane/crossplane/pull/7462)
- Move error types from xerrors to relevant packages by
[@&#8203;adamwg](https://redirect.github.com/adamwg) in
[#&#8203;7465](https://redirect.github.com/crossplane/crossplane/pull/7465)
- fix(render): return requirements even on fatal errors by
[@&#8203;jcogilvie](https://redirect.github.com/jcogilvie) in
[#&#8203;7455](https://redirect.github.com/crossplane/crossplane/pull/7455)
- fix: add namespace to resourceref stable sort by
[@&#8203;LorenzBischof](https://redirect.github.com/LorenzBischof) in
[#&#8203;7341](https://redirect.github.com/crossplane/crossplane/pull/7341)
- redact secret stringData before emitting to pipeline inspector by
[@&#8203;netliomax25-code](https://redirect.github.com/netliomax25-code)
in
[#&#8203;7476](https://redirect.github.com/crossplane/crossplane/pull/7476)
- chore(deps): update actions/stale digest to
[`eb5cf3a`](https://redirect.github.com/crossplane/crossplane/commit/eb5cf3a)
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7379](https://redirect.github.com/crossplane/crossplane/pull/7379)
- chore(deps): update actions/create-github-app-token digest to
[`fee1f7d`](https://redirect.github.com/crossplane/crossplane/commit/fee1f7d)
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7310](https://redirect.github.com/crossplane/crossplane/pull/7310)
- chore(deps): update gomod2nix digest to
[`1201ddd`](https://redirect.github.com/crossplane/crossplane/commit/1201ddd)
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7128](https://redirect.github.com/crossplane/crossplane/pull/7128)
- chore(deps): update module golang.org/x/sys to v0.44.0 \[security]
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7435](https://redirect.github.com/crossplane/crossplane/pull/7435)
- chore(deps): update module golang.org/x/net to v0.55.0 \[security]
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7434](https://redirect.github.com/crossplane/crossplane/pull/7434)
- chore(deps): update bufbuild/buf-action digest to
[`fd21066`](https://redirect.github.com/crossplane/crossplane/commit/fd21066)
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7380](https://redirect.github.com/crossplane/crossplane/pull/7380)
- ci(renovate): disable the per-hour PR creation throttle by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7482](https://redirect.github.com/crossplane/crossplane/pull/7482)
- chore(deps): update actions/checkout digest to
[`df4cb1c`](https://redirect.github.com/crossplane/crossplane/commit/df4cb1c)
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7483](https://redirect.github.com/crossplane/crossplane/pull/7483)
- chore(deps): update mheap/require-checklist-action digest to
[`9c8100a`](https://redirect.github.com/crossplane/crossplane/commit/9c8100a)
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7487](https://redirect.github.com/crossplane/crossplane/pull/7487)
- chore(deps): update github/codeql-action digest to
[`8aad20d`](https://redirect.github.com/crossplane/crossplane/commit/8aad20d)
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7486](https://redirect.github.com/crossplane/crossplane/pull/7486)
- chore(deps): update codecov/codecov-action digest to
[`0fb7174`](https://redirect.github.com/crossplane/crossplane/commit/0fb7174)
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7485](https://redirect.github.com/crossplane/crossplane/pull/7485)
- chore(deps): update cachix/install-nix-action digest to
[`8aa0397`](https://redirect.github.com/crossplane/crossplane/commit/8aa0397)
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7484](https://redirect.github.com/crossplane/crossplane/pull/7484)
- chore(deps): update korthout/backport-action action to v4.5.2 (main)
by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7491](https://redirect.github.com/crossplane/crossplane/pull/7491)
- fix(deps): update module github.com/google/go-containerregistry to
v0.21.6 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7490](https://redirect.github.com/crossplane/crossplane/pull/7490)
- chore(deps): update actions/checkout action to v6.0.3 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7489](https://redirect.github.com/crossplane/crossplane/pull/7489)
- chore(deps): update negz/create-tag digest to
[`39bae1e`](https://redirect.github.com/crossplane/crossplane/commit/39bae1e)
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7488](https://redirect.github.com/crossplane/crossplane/pull/7488)
- chore(deps): update renovatebot/github-action action to v46.1.15
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7492](https://redirect.github.com/crossplane/crossplane/pull/7492)
- fix(deps): update module github.com/alecthomas/kong to v1.15.0 (main)
by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7493](https://redirect.github.com/crossplane/crossplane/pull/7493)
- fix(deps): update module github.com/crossplane/crossplane/apis/v2 to
v2.3.2 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7495](https://redirect.github.com/crossplane/crossplane/pull/7495)
- fix(deps): update module github.com/aws/smithy-go to v1.27.2 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7494](https://redirect.github.com/crossplane/crossplane/pull/7494)
- fix(deps): update module golang.org/x/sync to v0.21.0 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7497](https://redirect.github.com/crossplane/crossplane/pull/7497)
- chore(deps): update actions/create-github-app-token action to v3
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7499](https://redirect.github.com/crossplane/crossplane/pull/7499)
- fix(deps): update module google.golang.org/grpc to v1.81.1 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7498](https://redirect.github.com/crossplane/crossplane/pull/7498)
- chore(deps): update cachix/cachix-action action to v17 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7501](https://redirect.github.com/crossplane/crossplane/pull/7501)
- fix(deps): update module github.com/masterminds/semver/v3 to v3.5.0
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7496](https://redirect.github.com/crossplane/crossplane/pull/7496)
- chore(deps): update docker/login-action action to v4 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7504](https://redirect.github.com/crossplane/crossplane/pull/7504)
- chore(deps): update dependency renovate to v43 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7503](https://redirect.github.com/crossplane/crossplane/pull/7503)
- chore(deps): update codecov/codecov-action action to v7 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7502](https://redirect.github.com/crossplane/crossplane/pull/7502)
- chore(deps): update nick-fields/retry action to v4 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7507](https://redirect.github.com/crossplane/crossplane/pull/7507)
- chore(deps): update github artifact actions to v7 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7506](https://redirect.github.com/crossplane/crossplane/pull/7506)
- chore(deps): update dependency renovate to v43.222.0 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7505](https://redirect.github.com/crossplane/crossplane/pull/7505)
- render: Set namespace on injected resource refs only for
cluster-scoped XRs by
[@&#8203;adamwg](https://redirect.github.com/adamwg) in
[#&#8203;7523](https://redirect.github.com/crossplane/crossplane/pull/7523)
- chore(deps): update dependency renovate to v43.230.0 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7509](https://redirect.github.com/crossplane/crossplane/pull/7509)
- pkg: include package generation in revision ID by
[@&#8203;RonaldLePape](https://redirect.github.com/RonaldLePape) in
[#&#8203;7473](https://redirect.github.com/crossplane/crossplane/pull/7473)
- chore(deps): update module github.com/sigstore/cosign/v3 to v3.0.6
\[security] (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7551](https://redirect.github.com/crossplane/crossplane/pull/7551)
- Update ADOPTERS.md by
[@&#8203;cazeaux](https://redirect.github.com/cazeaux) in
[#&#8203;7533](https://redirect.github.com/crossplane/crossplane/pull/7533)
- chore(deps): update module github.com/sigstore/rekor to v1.5.2
\[security] (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7552](https://redirect.github.com/crossplane/crossplane/pull/7552)
- chore(deps): update module github.com/sigstore/timestamp-authority/v2
to v2.1.0 \[security] (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7567](https://redirect.github.com/crossplane/crossplane/pull/7567)
- build(nix): build with buildGoModule so images are
vulnerability-scannable by
[@&#8203;phisco](https://redirect.github.com/phisco) in
[#&#8203;7549](https://redirect.github.com/crossplane/crossplane/pull/7549)
- docs: fix duplicated word in crossplane-v2 proposal by
[@&#8203;s3onghyun](https://redirect.github.com/s3onghyun) in
[#&#8203;7526](https://redirect.github.com/crossplane/crossplane/pull/7526)
- chore(deps): update module github.com/sigstore/sigstore-go to v1.2.0
\[security] (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7580](https://redirect.github.com/crossplane/crossplane/pull/7580)
- chore(deps): update dependency renovate to v43.272.1 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7593](https://redirect.github.com/crossplane/crossplane/pull/7593)
- fix: avoid repeated owner updates for composed Usages by
[@&#8203;youssefcamao](https://redirect.github.com/youssefcamao) in
[#&#8203;7591](https://redirect.github.com/crossplane/crossplane/pull/7591)
- chore(deps): update dependency renovate to v43.272.8 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7595](https://redirect.github.com/crossplane/crossplane/pull/7595)
- render: Don't overwrite the input XR's UID if it has one and validate
observed resources by
[@&#8203;adamwg](https://redirect.github.com/adamwg) in
[#&#8203;7544](https://redirect.github.com/crossplane/crossplane/pull/7544)
- Watch required resources to reconcile the XRs that require them by
[@&#8203;negz](https://redirect.github.com/negz) in
[#&#8203;7572](https://redirect.github.com/crossplane/crossplane/pull/7572)
- fix(deps): combined security bumps (grpc, x/net, x/text) (main) by
[@&#8203;lsviben](https://redirect.github.com/lsviben) in
[#&#8203;7617](https://redirect.github.com/crossplane/crossplane/pull/7617)
- chore(deps): update module golang.org/x/net to v0.56.0 \[security]
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7602](https://redirect.github.com/crossplane/crossplane/pull/7602)
- Do not delete package runtime deployments owned by another revision by
[@&#8203;truongnht](https://redirect.github.com/truongnht) in
[#&#8203;7561](https://redirect.github.com/crossplane/crossplane/pull/7561)
- chore(deps): update module golang.org/x/text to v0.39.0 \[security]
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7603](https://redirect.github.com/crossplane/crossplane/pull/7603)
- Make check-diff CI verify generated files are committed by
[@&#8203;phisco](https://redirect.github.com/phisco) in
[#&#8203;7213](https://redirect.github.com/crossplane/crossplane/pull/7213)
- fix(ci): serialize Nix builds in Renovate entrypoint by
[@&#8203;alliasgher](https://redirect.github.com/alliasgher) in
[#&#8203;7564](https://redirect.github.com/crossplane/crossplane/pull/7564)
- use unambiguous separator for usage index key by
[@&#8203;netliomax25-code](https://redirect.github.com/netliomax25-code)
in
[#&#8203;7508](https://redirect.github.com/crossplane/crossplane/pull/7508)
- test(e2e): use DefaultPollInterval in remaining wait.For calls by
[@&#8203;amarkdotdev](https://redirect.github.com/amarkdotdev) in
[#&#8203;7547](https://redirect.github.com/crossplane/crossplane/pull/7547)
- feat(pkg): scale safe-start provider runtimes to zero until their
first MRD is activated by
[@&#8203;haarchri](https://redirect.github.com/haarchri) in
[#&#8203;7586](https://redirect.github.com/crossplane/crossplane/pull/7586)
- chore(renovate): group security-fix PRs into one per branch by
[@&#8203;phisco](https://redirect.github.com/phisco) in
[#&#8203;7641](https://redirect.github.com/crossplane/crossplane/pull/7641)
- Scale safe-start runtimes to zero even when a DRC sets replicas by
[@&#8203;negz](https://redirect.github.com/negz) in
[#&#8203;7639](https://redirect.github.com/crossplane/crossplane/pull/7639)
- build: give every Go build its own writable HOME by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7652](https://redirect.github.com/crossplane/crossplane/pull/7652)
- chore(deps): update vulnerable dependencies \[security] (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7645](https://redirect.github.com/crossplane/crossplane/pull/7645)
- fix(composite): only garbage collect resources we control by
[@&#8203;phisco](https://redirect.github.com/phisco) in
[#&#8203;7627](https://redirect.github.com/crossplane/crossplane/pull/7627)
- pkg: Use the real DAG in dependency resolver tests by
[@&#8203;adamwg](https://redirect.github.com/adamwg) in
[#&#8203;7655](https://redirect.github.com/crossplane/crossplane/pull/7655)
- chore(deps): update dependency renovate to v43.287.0 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7625](https://redirect.github.com/crossplane/crossplane/pull/7625)
- fix(ci): make the flake.lock schedule reachable and cover release
branches by [@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7661](https://redirect.github.com/crossplane/crossplane/pull/7661)
- build: Calculate checksums after the nix fixup phase by
[@&#8203;adamwg](https://redirect.github.com/adamwg) in
[#&#8203;7660](https://redirect.github.com/crossplane/crossplane/pull/7660)
- chore(deps): update dependency renovate to v43.288.0 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7664](https://redirect.github.com/crossplane/crossplane/pull/7664)
- adopters: add Julius Baer by
[@&#8203;erost](https://redirect.github.com/erost) in
[#&#8203;7657](https://redirect.github.com/crossplane/crossplane/pull/7657)
- chore(deps): update actions/stale digest to
[`1e223db`](https://redirect.github.com/crossplane/crossplane/commit/1e223db)
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7663](https://redirect.github.com/crossplane/crossplane/pull/7663)
- chore(deps): update actions/checkout digest to
[`d23441a`](https://redirect.github.com/crossplane/crossplane/commit/d23441a)
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7662](https://redirect.github.com/crossplane/crossplane/pull/7662)
- lint: Tell the goconst linter to ignore tests by
[@&#8203;adamwg](https://redirect.github.com/adamwg) in
[#&#8203;7669](https://redirect.github.com/crossplane/crossplane/pull/7669)
- chore(deps): update buildpulse/buildpulse-action action to v3 (main)
by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7500](https://redirect.github.com/crossplane/crossplane/pull/7500)
- chore(deps): update module github.com/sigstore/sigstore-go to v1.2.1
\[security] (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7670](https://redirect.github.com/crossplane/crossplane/pull/7670)
- chore(deps): update cachix/install-nix-action digest to
[`630ae54`](https://redirect.github.com/crossplane/crossplane/commit/630ae54)
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7672](https://redirect.github.com/crossplane/crossplane/pull/7672)
- fix(deps): update module github.com/crossplane/crossplane/apis/v2 to
v2.3.4 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7681](https://redirect.github.com/crossplane/crossplane/pull/7681)
- chore(deps): update bufbuild/buf-action digest to
[`8c6a16e`](https://redirect.github.com/crossplane/crossplane/commit/8c6a16e)
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7671](https://redirect.github.com/crossplane/crossplane/pull/7671)
- chore(deps): update docker/login-action digest to
[`dbcb813`](https://redirect.github.com/crossplane/crossplane/commit/dbcb813)
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7673](https://redirect.github.com/crossplane/crossplane/pull/7673)
- chore(deps): update github/codeql-action digest to
[`f205ea1`](https://redirect.github.com/crossplane/crossplane/commit/f205ea1)
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7674](https://redirect.github.com/crossplane/crossplane/pull/7674)
- fix(deps): update module github.com/google/go-containerregistry to
v0.21.8 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7682](https://redirect.github.com/crossplane/crossplane/pull/7682)
- fix(deps): update module github.com/aws/smithy-go to v1.27.6 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7680](https://redirect.github.com/crossplane/crossplane/pull/7680)
- chore(deps): update korthout/backport-action action to v4.6.0 (main)
by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7686](https://redirect.github.com/crossplane/crossplane/pull/7686)
- Fix 4817 runtime ssa deployment by
[@&#8203;RonaldLePape](https://redirect.github.com/RonaldLePape) in
[#&#8203;7563](https://redirect.github.com/crossplane/crossplane/pull/7563)
- ci: skip BuildPulse flake publishing when credentials are absent by
[@&#8203;phisco](https://redirect.github.com/phisco) in
[#&#8203;7691](https://redirect.github.com/crossplane/crossplane/pull/7691)
- fix(ci): prioritize flake.lock maintenance updates by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7695](https://redirect.github.com/crossplane/crossplane/pull/7695)
- chore(deps): update renovatebot/github-action action to v46.2.1 (main)
by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7694](https://redirect.github.com/crossplane/crossplane/pull/7694)
- chore(deps): update github/codeql-action digest to
[`d1ba80a`](https://redirect.github.com/crossplane/crossplane/commit/d1ba80a)
(main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7693](https://redirect.github.com/crossplane/crossplane/pull/7693)
- chore(deps): update actions/checkout action to v7 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7690](https://redirect.github.com/crossplane/crossplane/pull/7690)
- fix(claim): don't propagate XR machinery fields from claims by
[@&#8203;phisco](https://redirect.github.com/phisco) in
[#&#8203;7626](https://redirect.github.com/crossplane/crossplane/pull/7626)
- build: point docker-client at docker\_29 in the nix overlay by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7701](https://redirect.github.com/crossplane/crossplane/pull/7701)
- chore(deps): lock file maintenance (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7696](https://redirect.github.com/crossplane/crossplane/pull/7696)
- fix(ci): pin which Nix Renovate's post-upgrade tasks use by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7709](https://redirect.github.com/crossplane/crossplane/pull/7709)
- fix(deps): update module github.com/alecthomas/kong to v1.16.0 (main)
by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7687](https://redirect.github.com/crossplane/crossplane/pull/7687)
- build: bump pinned nixpkgs channel from nixos-25.11 to nixos-26.05 by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7715](https://redirect.github.com/crossplane/crossplane/pull/7715)
- Update the Netclab adopter entry by
[@&#8203;mbakalarski](https://redirect.github.com/mbakalarski) in
[#&#8203;7718](https://redirect.github.com/crossplane/crossplane/pull/7718)
- pkg: Make deactivated revisions relinquish control of runtime
resources by [@&#8203;adamwg](https://redirect.github.com/adamwg) in
[#&#8203;7714](https://redirect.github.com/crossplane/crossplane/pull/7714)
- chore(deps): update dependency renovate to v44 (main) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7698](https://redirect.github.com/crossplane/crossplane/pull/7698)
- drop secret last-applied annotation from pipeline inspector output by
[@&#8203;phisco](https://redirect.github.com/phisco) in
[#&#8203;7726](https://redirect.github.com/crossplane/crossplane/pull/7726)
- chore(deps): bump crossplane-runtime to v2.4.0-rc.1 by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7735](https://redirect.github.com/crossplane/crossplane/pull/7735)
- chore(deps): update module golang.org/x/mod to v0.40.0 \[security]
(release-2.4) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7744](https://redirect.github.com/crossplane/crossplane/pull/7744)
- \[Backport release-2.4] fix(ci): pin negz/create-tag to v2 so apis/
submodule tagging works again by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in
[#&#8203;7747](https://redirect.github.com/crossplane/crossplane/pull/7747)
- chore(deps): lock file maintenance (release-2.4) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7754](https://redirect.github.com/crossplane/crossplane/pull/7754)
- chore(deps): bump crossplane-runtime to v2.4.0 by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7762](https://redirect.github.com/crossplane/crossplane/pull/7762)

##### New Contributors

- [@&#8203;gadsilva](https://redirect.github.com/gadsilva) made their
first contribution in
[#&#8203;7388](https://redirect.github.com/crossplane/crossplane/pull/7388)
- [@&#8203;LorenzBischof](https://redirect.github.com/LorenzBischof)
made their first contribution in
[#&#8203;7341](https://redirect.github.com/crossplane/crossplane/pull/7341)
-
[@&#8203;netliomax25-code](https://redirect.github.com/netliomax25-code)
made their first contribution in
[#&#8203;7476](https://redirect.github.com/crossplane/crossplane/pull/7476)
- [@&#8203;RonaldLePape](https://redirect.github.com/RonaldLePape) made
their first contribution in
[#&#8203;7473](https://redirect.github.com/crossplane/crossplane/pull/7473)
- [@&#8203;cazeaux](https://redirect.github.com/cazeaux) made their
first contribution in
[#&#8203;7533](https://redirect.github.com/crossplane/crossplane/pull/7533)
- [@&#8203;s3onghyun](https://redirect.github.com/s3onghyun) made their
first contribution in
[#&#8203;7526](https://redirect.github.com/crossplane/crossplane/pull/7526)
- [@&#8203;youssefcamao](https://redirect.github.com/youssefcamao) made
their first contribution in
[#&#8203;7591](https://redirect.github.com/crossplane/crossplane/pull/7591)
- [@&#8203;truongnht](https://redirect.github.com/truongnht) made their
first contribution in
[#&#8203;7561](https://redirect.github.com/crossplane/crossplane/pull/7561)
- [@&#8203;alliasgher](https://redirect.github.com/alliasgher) made
their first contribution in
[#&#8203;7564](https://redirect.github.com/crossplane/crossplane/pull/7564)
- [@&#8203;amarkdotdev](https://redirect.github.com/amarkdotdev) made
their first contribution in
[#&#8203;7547](https://redirect.github.com/crossplane/crossplane/pull/7547)
- [@&#8203;erost](https://redirect.github.com/erost) made their first
contribution in
[#&#8203;7657](https://redirect.github.com/crossplane/crossplane/pull/7657)

**Full Changelog**:
<crossplane/crossplane@v2.3.0...v2.4.0>

###
[`v2.3.5`](https://redirect.github.com/crossplane/crossplane/releases/tag/v2.3.5)

[Compare
Source](https://redirect.github.com/crossplane/crossplane/compare/v2.3.4...v2.3.5)

`v2.3.5` is a patch release scoped to fixing issues reported by users of
Crossplane `v2.3` and fixing security related issues in Crossplane's
dependencies.

##### 🎉 Highlights

- **Correct `crank` checksums for `amd64` binaries
([#&#8203;7666](https://redirect.github.com/crossplane/crossplane/issues/7666),
originally
[#&#8203;7660](https://redirect.github.com/crossplane/crossplane/issues/7660)):**
The published `.sha256` files for `linux_amd64` binaries had not matched
the binaries themselves since `v2.2.0`, so any install script or
Dockerfile that verified the `amd64` checksum failed. Checksums are now
calculated after Nix strips the binary, and the release workflow
verifies them before uploading. Fixes
[#&#8203;7467](https://redirect.github.com/crossplane/crossplane/issues/7467).
- **Unambiguous `Usage` index key
([#&#8203;7630](https://redirect.github.com/crossplane/crossplane/issues/7630),
originally
[#&#8203;7508](https://redirect.github.com/crossplane/crossplane/issues/7508)):**
The deletion protection webhook indexed `Usage` resources by joining API
group, kind, name, and namespace with `.`. Since groups and names can
contain `.` themselves, two distinct resources could collapse to the
same key, causing the webhook to block a deletion that should have been
allowed. The key now joins with `/`, which cannot appear in any of those
fields.
- **Dependency security updates:** Bumps `cel-go`
([#&#8203;7761](https://redirect.github.com/crossplane/crossplane/issues/7761)),
`golang.org/x/mod`
([#&#8203;7743](https://redirect.github.com/crossplane/crossplane/issues/7743)),
and `sigstore-go`
([#&#8203;7678](https://redirect.github.com/crossplane/crossplane/issues/7678)),
plus a combined set of vulnerable dependency updates
([#&#8203;7650](https://redirect.github.com/crossplane/crossplane/issues/7650)),
to pick up upstream CVE fixes. `crossplane-runtime` is also bumped to
`v2.3.4`
([#&#8203;7765](https://redirect.github.com/crossplane/crossplane/issues/7765)),
which carries its own set of security dependency updates.

##### What's Changed

- build: give every Go build its own writable HOME by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7653](https://redirect.github.com/crossplane/crossplane/pull/7653)
- chore(deps): update vulnerable dependencies \[security] (release-2.3)
by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7650](https://redirect.github.com/crossplane/crossplane/pull/7650)
- \[Backport release-2.3] use unambiguous separator for usage index key
by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in
[#&#8203;7630](https://redirect.github.com/crossplane/crossplane/pull/7630)
- Backport
[#&#8203;7660](https://redirect.github.com/crossplane/crossplane/issues/7660)
to release-2.3 by [@&#8203;adamwg](https://redirect.github.com/adamwg)
in
[#&#8203;7666](https://redirect.github.com/crossplane/crossplane/pull/7666)
- chore(deps): update module github.com/sigstore/sigstore-go to v1.2.1
\[security] (release-2.3) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7678](https://redirect.github.com/crossplane/crossplane/pull/7678)
- \[Backport release-2.3] build: point docker-client at docker\_29 in
the nix overlay by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in
[#&#8203;7706](https://redirect.github.com/crossplane/crossplane/pull/7706)
- chore(deps): lock file maintenance (release-2.3) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7700](https://redirect.github.com/crossplane/crossplane/pull/7700)
- \[Backport release-2.3] build: bump pinned nixpkgs channel from
nixos-25.11 to nixos-26.05 by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7720](https://redirect.github.com/crossplane/crossplane/pull/7720)
- chore(deps): update module golang.org/x/mod to v0.40.0 \[security]
(release-2.3) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7743](https://redirect.github.com/crossplane/crossplane/pull/7743)
- \[Backport release-2.3] fix(ci): pin create-tag to v2 so apis/
submodule tagging works again by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7748](https://redirect.github.com/crossplane/crossplane/pull/7748)
- chore(deps): lock file maintenance (release-2.3) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7753](https://redirect.github.com/crossplane/crossplane/pull/7753)
- chore(deps): update module github.com/google/cel-go to v0.30.0
\[security] (release-2.3) by
[@&#8203;crossplane-renovate](https://redirect.github.com/crossplane-renovate)\[bot]
in
[#&#8203;7761](https://redirect.github.com/crossplane/crossplane/pull/7761)
- chore(deps): bump crossplane-runtime to v2.3.4 by
[@&#8203;jbw976](https://redirect.github.com/jbw976) in
[#&#8203;7765](https://redirect.github.com/crossplane/crossplane/pull/7765)

**Full Changelog**:
<crossplane/crossplane@v2.3.4...v2.3.5>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - "before 6am"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/blacksd/crd-schemas).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zNS40IiwidXBkYXRlZEluVmVyIjoiNDQuMzkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
hbjydev pushed a commit to hbjydev/phoebe that referenced this pull request Aug 27, 2026
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [crossplane](https://crossplane.io) ([source](https://github.com/crossplane/crossplane)) | minor | `2.3.4` → `2.4.0` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/141) for more information.

---

### Release Notes

<details>
<summary>crossplane/crossplane (crossplane)</summary>

### [`v2.4.0`](https://github.com/crossplane/crossplane/releases/tag/v2.4.0)

[Compare Source](crossplane/crossplane@v2.3.5...v2.4.0)

The `v2.4.0` release is a regular quarterly Crossplane release that is focused on maturing a number of key areas of functionality across the project, as Crossplane continues to become more capable, more reliable, and more performant for your production workloads. This release includes the ability to watch required resources and reconcile XRs immediately when they change, scale to zero for safe-start capable providers, release artifacts that are vulnerability scannable, and a wide range of fixes and reliability improvements. It also includes security fixes in Crossplane's Go toolchain and dependencies.

### 🚨 v1.20 end-of-life (EOL) November 2026

This v2.4 release marks the final release cycle where v1.20 will be maintained.

**When v2.5 is released in Nov 2026, v1.20 will reach its EOL and no longer receive any support or maintenance by the Crossplane project**. Until that time, we will continue to provide critical fixes and security related dependency updates to v1.20.

> \[!IMPORTANT]
> This EOL notice applies only to the v1.20 release. v1 legacy workloads like Claims and cluster scoped resources remain supported in Crossplane v2 through extensive [backwards compatibility support](https://docs.crossplane.io/latest/guides/upgrade-to-crossplane-v2/#legacy-resource-behavior).

#### Is your control plane ready for v2?

Upgrading to Crossplane v2 does not require any migration as part of the upgrade process, with the exception of the minimal breaking changes explicitly called out in the [v2 documentation](https://docs.crossplane.io/latest/guides/upgrade-to-crossplane-v2/#removed-features). If your control plane is not affected by those changes, you can simply [upgrade to v2](https://docs.crossplane.io/latest/guides/upgrade-crossplane/) right away.

To better assist Crossplane users in determining if their control planes are affected by any of the breaking changes in v2, we have released a v2 readiness checker tool in the v1.20 Crossplane CLI that can be invoked via `crossplane beta upgrade check`. You can read all about this tool in the following resources:

- blog post: <https://blog.crossplane.io/v2-upgrade-check/>
- docs: <https://docs.crossplane.io/v1.20/cli/command-reference/#beta-upgrade-check>
- release notes: <https://github.com/crossplane/crossplane/releases/tag/v1.20.9>

#### Crossplane Downstream Distributions

Downstream distributions are eligible to continue their extended support and maintenance for their releases that are based on upstream Crossplane's v1.20. Check with your [vendor](https://www.crossplane.io/commercial) for more details if you are using a downstream distribution of Crossplane.

### 🚨 v2.4 Notable and Breaking Changes

- ⚠️ The Crossplane CLI is no longer published to `releases.crossplane.io`. New CLI releases go only to `cli.crossplane.io`, under the binary name `crossplane` rather than `crank`. This completes the CLI's move to <https://github.com/crossplane/cli>, which was announced in the `v2.3.0` release notes and dual published to both locations for `v2.3.0` to ease the transition.
  - f you are using custom installation scripts or CI steps that download the CLI directly from `releases.crossplane.io`, update them to use `cli.crossplane.io`, and update any firewall or proxy rule that allows `releases.crossplane.io` to now allow `cli.crossplane.io` instead.
    - Users of the [`install.sh`](https://github.com/crossplane/crossplane/blob/main/install.sh) script as their installation procedure are unaffected.
  - The CLI now follows its own release schedule, so a CLI release will not accompany every core Crossplane release and the two version numbers have diverged.
  - Documentation and installation instructions for the Crossplane CLI can be found on <https://docs.crossplane.io/cli/latest/>.
- Package revision names are now derived from both the package digest and the package's `metadata.generation`, so any change to a package's spec produces a new `PackageRevision`. [#&#8203;7473](crossplane/crossplane#7473)
  - This fixes the long standing issue where changing a package's `runtimeConfigRef` reused the existing revision, along with its stale runtime settings. [#&#8203;5068](crossplane/crossplane#5068)
  - When upgrading to `v2.4`, every installed package gets a new revision, with a new name, on its first reconcile.
  - ⚠️ The `Pods` for `Providers` and `Functions` will be restarted for this new revision.
- Package runtime objects (`Deployment`, `ServiceAccount`, `Service`, and TLS `Secrets`) are now applied with server-side apply under the `pkg.crossplane.io/runtime` field manager, replacing the previous merge patch applicator. [#&#8203;7563](crossplane/crossplane#7563)
  - A field you remove from a `DeploymentRuntimeConfig` is now removed from the live runtime object, rather than lingering until that object is replaced. [#&#8203;4817](crossplane/crossplane#4817)
  - Additions that Crossplane doesn't declare are left alone rather than replaced along with the array that held them, e.g. an injected sidecar container or an extra volume added out of band now survives a reconcile.
- The `RUNTIME` printer column on `ProviderRevision` and `FunctionRevision` was renamed to `RUNTIME-HEALTHY`, and a new `RUNTIME-ACTIVE` column was added. [#&#8203;7586](crossplane/crossplane#7586)
  - Update any tooling that reads `kubectl get providerrevision` or `kubectl get functionrevision` output by column position.
- The `type` label on the `engine_watches_started_total` and `engine_watches_stopped_total` metrics changed from `ComposedResource` to `Dependency`, now that a single watch mechanism covers both composed and required resources. [#&#8203;7572](crossplane/crossplane#7572)
  - Update any dashboards or alerts that filter on that label value.

### 🎉 Highlights

- **Watching required resources**: Composition functions can require resources they don't compose, but Crossplane didn't watch them, so a change to a required resource didn't reconcile the XRs that required it until their next poll. Crossplane now tracks the resources each XR depends on and drives watches from that. A change to a required resource now reconciles the XRs that required it the same way a change to a composed resource does. This works when realtime compositions are enabled, which is the default. See [`design/one-pager-watching-required-resources.md`](https://github.com/crossplane/crossplane/blob/main/design/one-pager-watching-required-resources.md) and [#&#8203;7572](crossplane/crossplane#7572).
- **Safe-start provider runtimes scale to zero until activated**: A provider with the safe-start capability runs no managed resource controllers while all of its `ManagedResourceDefinitions` are inactive, so there is no reason to run its pods. Crossplane now creates such a provider's runtime `Deployment` with zero replicas and scales it up once its first MRD becomes active, such as through a matching `ManagedResourceActivationPolicy`. Installing a broad set of providers no longer costs you a running pod for each one that has nothing to reconcile yet. [#&#8203;7586](crossplane/crossplane#7586)
  - A new `RuntimeActive` condition on `ProviderRevision` and `FunctionRevision` makes this visible. It is `False` with reason `AwaitingActivation` while the runtime is intentionally scaled to zero and `True` once it has been scaled up. `RuntimeHealthy` stays healthy in both cases, and the package's `Healthy` condition surfaces the awaiting state with the same reason.
  - Scaling to zero takes precedence over an explicit `spec.replicas` in a `DeploymentRuntimeConfig`, which is now read as how many replicas to run while running, rather than a demand to always be running. [#&#8203;7639](crossplane/crossplane#7639)
- **Vulnerability-scannable container images**: Crossplane container images are now built with nixpkgs' `buildGoModule`, which includes the full Go dependency list into the binary. Scanners such as `grype` and `trivy` previously were only able to discover the Crossplane main module and the Go standard library, so CVEs in our third-party dependencies were not visible to them. Now Crossplane and its complete set of dependencies are visible to security scanner tools. [#&#8203;7549](crossplane/crossplane#7549)
- **More reliable package runtime management**: Server-side apply for package runtime objects means a field you remove from a `DeploymentRuntimeConfig` is now actually removed from the live `Deployment` instead of lingering ([#&#8203;7563](crossplane/crossplane#7563), fixing [#&#8203;4817](crossplane/crossplane#4817)). Deactivating a revision also no longer deletes a runtime `Deployment` that another revision controls, which could happen when a `DeploymentRuntimeConfig` pins a stable `deploymentTemplate.metadata.name` ([#&#8203;7561](crossplane/crossplane#7561)).
- **Hardening across composition and package paths**: Several changes tighten paths where a caller could reach further than intended. The composed resource garbage collector now only deletes resources whose controller reference points back to the XR, so `spec.resourceRefs` can no longer be used to make the composite controller delete arbitrary resources ([#&#8203;7627](crossplane/crossplane#7627)). The claim to XR syncers now strip XR machinery fields such as `resourceRefs` and the `crossplane` stanza, which a claim could otherwise smuggle through an XRD schema that sets `x-kubernetes-preserve-unknown-fields: true` ([#&#8203;7626](crossplane/crossplane#7626)).
- **Version-aware docs search**: Searching from an older version of the docs, such as `/v1.20/`, used to return results from all versions, potentially returning features and APIs that don't exist in the version you're actually reading. Search is now scoped to the version you're on, results carry a clearly visible version badge, and pages from older versions show a banner explaining that, with a link to latest. Thanks to [@&#8203;haarchri](https://github.com/haarchri) for this one in [crossplane/docs#1051](crossplane/docs#1051), so give it a try at <https://docs.crossplane.io>.
- **Security fixes in dependencies**: The Go version Crossplane builds/runs with was bumped to pick up standard library CVE fixes, alongside a steady stream of security updates to Crossplane's Go dependencies across this release cycle.
- **Other notable improvements**:
  - Several fixes to the render engine that backs `crossplane render`: an XRD schema can now be supplied to `crossplane internal render` ([#&#8203;7452](crossplane/crossplane#7452)), requirements are returned even when a function returns a fatal result ([#&#8203;7455](crossplane/crossplane#7455)), a namespace is set on injected resource references only for cluster-scoped XRs, matching the real reconciler ([#&#8203;7523](crossplane/crossplane#7523)), and an input XR fetched from a real cluster keeps its own UID so its observed resources are read correctly, with clear errors when observed resources don't line up with the XR ([#&#8203;7544](crossplane/crossplane#7544)).
  - The `sha256` files published with release binaries are now calculated after Nix strips the binary, so amd64 checksums match what you download. They didn't for `v2.2.0` through `v2.3.1`, and CI now verifies checksums before uploading artifacts. [#&#8203;7660](crossplane/crossplane#7660)
  - A composed `Usage` no longer gets a redundant owner update on every reconcile, which could repeatedly trigger composition reconciliation and eventually open the XR circuit breaker. [#&#8203;7591](crossplane/crossplane#7591)
  - The deletion protection field index now uses a separator that can't appear in a group, kind, name, or namespace, so two distinct resources can no longer collide and block a deletion that should be allowed. [#&#8203;7508](crossplane/crossplane#7508)
  - Sorting of `spec.resourceRefs` now includes the namespace, so references stay stable when composed resources share a name across namespaces. [#&#8203;7341](crossplane/crossplane#7341)

#### 🏅 Release MVP

For the v2.4 release cycle, we'd like to recognize [@&#8203;rafal-jan](https://github.com/rafal-jan) as the release MVP!

They had an enormous impact in `crossplane-runtime`, first by diagnosing the root cause in [crossplane/crossplane-runtime#1056](crossplane/crossplane-runtime#1056) of significant memory usage by providers that are safe-start capable when they essentially watch and cache every CRD in the control plane. Then [@&#8203;rafal-jan](https://github.com/rafal-jan) went a step further and submitted an elegant solution in [crossplane/crossplane-runtime#1058](crossplane/crossplane-runtime#1058) to strip the cached CRDs down to just the fields needed to watch and respond appropriately to events, drastically reducing the memory consumption by these providers. Thank you [@&#8203;rafal-jan](https://github.com/rafal-jan)!

### 📖 Full Changelog

- chore(deps): bump crossplane-runtime to v2.4.0-rc.0 by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7393](crossplane/crossplane#7393)
- build: add release-2.3 to renovate baseBranches by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7395](crossplane/crossplane#7395)
- ci: Run checks on the apis module by [@&#8203;adamwg](https://github.com/adamwg) in [#&#8203;7396](crossplane/crossplane#7396)
- Make Renovate security updates bypass throttles by [@&#8203;phisco](https://github.com/phisco) in [#&#8203;7391](crossplane/crossplane#7391)
- docs: add Stone Payments to ADOPTERS.md by [@&#8203;gadsilva](https://github.com/gadsilva) in [#&#8203;7388](crossplane/crossplane#7388)
- build: Install Earthly in Renovate container via flake URL by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7404](crossplane/crossplane#7404)
- build: put Nix profile bin on PATH in Renovate entrypoint by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7405](crossplane/crossplane#7405)
- chore(deps): Bump Go to 1.25.10 to fix stdlib CVEs (main) by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7414](crossplane/crossplane#7414)
- chore: bump releases table and renovate baseBranches after v2.3 release by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7418](crossplane/crossplane#7418)
- chore(deps): update module golang.org/x/crypto to v0.52.0 \[security] (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7423](crossplane/crossplane#7423)
- fix(ci): match release tags only when computing build version by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7431](crossplane/crossplane#7431)
- build: tag the apis/ Go submodule on every release by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7444](crossplane/crossplane#7444)
- Update install.sh to point at the new CLI release bucket by [@&#8203;adamwg](https://github.com/adamwg) in [#&#8203;7441](crossplane/crossplane#7441)
- fix(render): allow xrd schema to be supplied for `internal render` by [@&#8203;jcogilvie](https://github.com/jcogilvie) in [#&#8203;7452](crossplane/crossplane#7452)
- README: add sig-v2-migration to list of SIGs by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7462](crossplane/crossplane#7462)
- Move error types from xerrors to relevant packages by [@&#8203;adamwg](https://github.com/adamwg) in [#&#8203;7465](crossplane/crossplane#7465)
- fix(render): return requirements even on fatal errors by [@&#8203;jcogilvie](https://github.com/jcogilvie) in [#&#8203;7455](crossplane/crossplane#7455)
- fix: add namespace to resourceref stable sort by [@&#8203;LorenzBischof](https://github.com/LorenzBischof) in [#&#8203;7341](crossplane/crossplane#7341)
- redact secret stringData before emitting to pipeline inspector by [@&#8203;netliomax25-code](https://github.com/netliomax25-code) in [#&#8203;7476](crossplane/crossplane#7476)
- chore(deps): update actions/stale digest to [`eb5cf3a`](crossplane/crossplane@eb5cf3a) (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7379](crossplane/crossplane#7379)
- chore(deps): update actions/create-github-app-token digest to [`fee1f7d`](crossplane/crossplane@fee1f7d) (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7310](crossplane/crossplane#7310)
- chore(deps): update gomod2nix digest to [`1201ddd`](crossplane/crossplane@1201ddd) (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7128](crossplane/crossplane#7128)
- chore(deps): update module golang.org/x/sys to v0.44.0 \[security] (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7435](crossplane/crossplane#7435)
- chore(deps): update module golang.org/x/net to v0.55.0 \[security] (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7434](crossplane/crossplane#7434)
- chore(deps): update bufbuild/buf-action digest to [`fd21066`](crossplane/crossplane@fd21066) (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7380](crossplane/crossplane#7380)
- ci(renovate): disable the per-hour PR creation throttle by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7482](crossplane/crossplane#7482)
- chore(deps): update actions/checkout digest to [`df4cb1c`](crossplane/crossplane@df4cb1c) (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7483](crossplane/crossplane#7483)
- chore(deps): update mheap/require-checklist-action digest to [`9c8100a`](crossplane/crossplane@9c8100a) (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7487](crossplane/crossplane#7487)
- chore(deps): update github/codeql-action digest to [`8aad20d`](crossplane/crossplane@8aad20d) (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7486](crossplane/crossplane#7486)
- chore(deps): update codecov/codecov-action digest to [`0fb7174`](crossplane/crossplane@0fb7174) (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7485](crossplane/crossplane#7485)
- chore(deps): update cachix/install-nix-action digest to [`8aa0397`](crossplane/crossplane@8aa0397) (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7484](crossplane/crossplane#7484)
- chore(deps): update korthout/backport-action action to v4.5.2 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7491](crossplane/crossplane#7491)
- fix(deps): update module github.com/google/go-containerregistry to v0.21.6 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7490](crossplane/crossplane#7490)
- chore(deps): update actions/checkout action to v6.0.3 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7489](crossplane/crossplane#7489)
- chore(deps): update negz/create-tag digest to [`39bae1e`](crossplane/crossplane@39bae1e) (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7488](crossplane/crossplane#7488)
- chore(deps): update renovatebot/github-action action to v46.1.15 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7492](crossplane/crossplane#7492)
- fix(deps): update module github.com/alecthomas/kong to v1.15.0 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7493](crossplane/crossplane#7493)
- fix(deps): update module github.com/crossplane/crossplane/apis/v2 to v2.3.2 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7495](crossplane/crossplane#7495)
- fix(deps): update module github.com/aws/smithy-go to v1.27.2 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7494](crossplane/crossplane#7494)
- fix(deps): update module golang.org/x/sync to v0.21.0 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7497](crossplane/crossplane#7497)
- chore(deps): update actions/create-github-app-token action to v3 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7499](crossplane/crossplane#7499)
- fix(deps): update module google.golang.org/grpc to v1.81.1 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7498](crossplane/crossplane#7498)
- chore(deps): update cachix/cachix-action action to v17 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7501](crossplane/crossplane#7501)
- fix(deps): update module github.com/masterminds/semver/v3 to v3.5.0 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7496](crossplane/crossplane#7496)
- chore(deps): update docker/login-action action to v4 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7504](crossplane/crossplane#7504)
- chore(deps): update dependency renovate to v43 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7503](crossplane/crossplane#7503)
- chore(deps): update codecov/codecov-action action to v7 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7502](crossplane/crossplane#7502)
- chore(deps): update nick-fields/retry action to v4 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7507](crossplane/crossplane#7507)
- chore(deps): update github artifact actions to v7 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7506](crossplane/crossplane#7506)
- chore(deps): update dependency renovate to v43.222.0 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7505](crossplane/crossplane#7505)
- render: Set namespace on injected resource refs only for cluster-scoped XRs by [@&#8203;adamwg](https://github.com/adamwg) in [#&#8203;7523](crossplane/crossplane#7523)
- chore(deps): update dependency renovate to v43.230.0 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7509](crossplane/crossplane#7509)
- pkg: include package generation in revision ID by [@&#8203;RonaldLePape](https://github.com/RonaldLePape) in [#&#8203;7473](crossplane/crossplane#7473)
- chore(deps): update module github.com/sigstore/cosign/v3 to v3.0.6 \[security] (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7551](crossplane/crossplane#7551)
- Update ADOPTERS.md by [@&#8203;cazeaux](https://github.com/cazeaux) in [#&#8203;7533](crossplane/crossplane#7533)
- chore(deps): update module github.com/sigstore/rekor to v1.5.2 \[security] (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7552](crossplane/crossplane#7552)
- chore(deps): update module github.com/sigstore/timestamp-authority/v2 to v2.1.0 \[security] (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7567](crossplane/crossplane#7567)
- build(nix): build with buildGoModule so images are vulnerability-scannable by [@&#8203;phisco](https://github.com/phisco) in [#&#8203;7549](crossplane/crossplane#7549)
- docs: fix duplicated word in crossplane-v2 proposal by [@&#8203;s3onghyun](https://github.com/s3onghyun) in [#&#8203;7526](crossplane/crossplane#7526)
- chore(deps): update module github.com/sigstore/sigstore-go to v1.2.0 \[security] (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7580](crossplane/crossplane#7580)
- chore(deps): update dependency renovate to v43.272.1 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7593](crossplane/crossplane#7593)
- fix: avoid repeated owner updates for composed Usages by [@&#8203;youssefcamao](https://github.com/youssefcamao) in [#&#8203;7591](crossplane/crossplane#7591)
- chore(deps): update dependency renovate to v43.272.8 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7595](crossplane/crossplane#7595)
- render: Don't overwrite the input XR's UID if it has one and validate observed resources by [@&#8203;adamwg](https://github.com/adamwg) in [#&#8203;7544](crossplane/crossplane#7544)
- Watch required resources to reconcile the XRs that require them by [@&#8203;negz](https://github.com/negz) in [#&#8203;7572](crossplane/crossplane#7572)
- fix(deps): combined security bumps (grpc, x/net, x/text) (main) by [@&#8203;lsviben](https://github.com/lsviben) in [#&#8203;7617](crossplane/crossplane#7617)
- chore(deps): update module golang.org/x/net to v0.56.0 \[security] (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7602](crossplane/crossplane#7602)
- Do not delete package runtime deployments owned by another revision by [@&#8203;truongnht](https://github.com/truongnht) in [#&#8203;7561](crossplane/crossplane#7561)
- chore(deps): update module golang.org/x/text to v0.39.0 \[security] (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7603](crossplane/crossplane#7603)
- Make check-diff CI verify generated files are committed by [@&#8203;phisco](https://github.com/phisco) in [#&#8203;7213](crossplane/crossplane#7213)
- fix(ci): serialize Nix builds in Renovate entrypoint by [@&#8203;alliasgher](https://github.com/alliasgher) in [#&#8203;7564](crossplane/crossplane#7564)
- use unambiguous separator for usage index key by [@&#8203;netliomax25-code](https://github.com/netliomax25-code) in [#&#8203;7508](crossplane/crossplane#7508)
- test(e2e): use DefaultPollInterval in remaining wait.For calls by [@&#8203;amarkdotdev](https://github.com/amarkdotdev) in [#&#8203;7547](crossplane/crossplane#7547)
- feat(pkg): scale safe-start provider runtimes to zero until their first MRD is activated by [@&#8203;haarchri](https://github.com/haarchri) in [#&#8203;7586](crossplane/crossplane#7586)
- chore(renovate): group security-fix PRs into one per branch by [@&#8203;phisco](https://github.com/phisco) in [#&#8203;7641](crossplane/crossplane#7641)
- Scale safe-start runtimes to zero even when a DRC sets replicas by [@&#8203;negz](https://github.com/negz) in [#&#8203;7639](crossplane/crossplane#7639)
- build: give every Go build its own writable HOME by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7652](crossplane/crossplane#7652)
- chore(deps): update vulnerable dependencies \[security] (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7645](crossplane/crossplane#7645)
- fix(composite): only garbage collect resources we control by [@&#8203;phisco](https://github.com/phisco) in [#&#8203;7627](crossplane/crossplane#7627)
- pkg: Use the real DAG in dependency resolver tests by [@&#8203;adamwg](https://github.com/adamwg) in [#&#8203;7655](crossplane/crossplane#7655)
- chore(deps): update dependency renovate to v43.287.0 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7625](crossplane/crossplane#7625)
- fix(ci): make the flake.lock schedule reachable and cover release branches by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7661](crossplane/crossplane#7661)
- build: Calculate checksums after the nix fixup phase by [@&#8203;adamwg](https://github.com/adamwg) in [#&#8203;7660](crossplane/crossplane#7660)
- chore(deps): update dependency renovate to v43.288.0 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7664](crossplane/crossplane#7664)
- adopters: add Julius Baer by [@&#8203;erost](https://github.com/erost) in [#&#8203;7657](crossplane/crossplane#7657)
- chore(deps): update actions/stale digest to [`1e223db`](crossplane/crossplane@1e223db) (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7663](crossplane/crossplane#7663)
- chore(deps): update actions/checkout digest to [`d23441a`](crossplane/crossplane@d23441a) (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7662](crossplane/crossplane#7662)
- lint: Tell the goconst linter to ignore tests by [@&#8203;adamwg](https://github.com/adamwg) in [#&#8203;7669](crossplane/crossplane#7669)
- chore(deps): update buildpulse/buildpulse-action action to v3 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7500](crossplane/crossplane#7500)
- chore(deps): update module github.com/sigstore/sigstore-go to v1.2.1 \[security] (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7670](crossplane/crossplane#7670)
- chore(deps): update cachix/install-nix-action digest to [`630ae54`](crossplane/crossplane@630ae54) (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7672](crossplane/crossplane#7672)
- fix(deps): update module github.com/crossplane/crossplane/apis/v2 to v2.3.4 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7681](crossplane/crossplane#7681)
- chore(deps): update bufbuild/buf-action digest to [`8c6a16e`](crossplane/crossplane@8c6a16e) (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7671](crossplane/crossplane#7671)
- chore(deps): update docker/login-action digest to [`dbcb813`](crossplane/crossplane@dbcb813) (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7673](crossplane/crossplane#7673)
- chore(deps): update github/codeql-action digest to [`f205ea1`](crossplane/crossplane@f205ea1) (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7674](crossplane/crossplane#7674)
- fix(deps): update module github.com/google/go-containerregistry to v0.21.8 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7682](crossplane/crossplane#7682)
- fix(deps): update module github.com/aws/smithy-go to v1.27.6 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7680](crossplane/crossplane#7680)
- chore(deps): update korthout/backport-action action to v4.6.0 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7686](crossplane/crossplane#7686)
- Fix 4817 runtime ssa deployment by [@&#8203;RonaldLePape](https://github.com/RonaldLePape) in [#&#8203;7563](crossplane/crossplane#7563)
- ci: skip BuildPulse flake publishing when credentials are absent by [@&#8203;phisco](https://github.com/phisco) in [#&#8203;7691](crossplane/crossplane#7691)
- fix(ci): prioritize flake.lock maintenance updates by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7695](crossplane/crossplane#7695)
- chore(deps): update renovatebot/github-action action to v46.2.1 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7694](crossplane/crossplane#7694)
- chore(deps): update github/codeql-action digest to [`d1ba80a`](crossplane/crossplane@d1ba80a) (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7693](crossplane/crossplane#7693)
- chore(deps): update actions/checkout action to v7 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7690](crossplane/crossplane#7690)
- fix(claim): don't propagate XR machinery fields from claims by [@&#8203;phisco](https://github.com/phisco) in [#&#8203;7626](crossplane/crossplane#7626)
- build: point docker-client at docker\_29 in the nix overlay by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7701](crossplane/crossplane#7701)
- chore(deps): lock file maintenance (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7696](crossplane/crossplane#7696)
- fix(ci): pin which Nix Renovate's post-upgrade tasks use by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7709](crossplane/crossplane#7709)
- fix(deps): update module github.com/alecthomas/kong to v1.16.0 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7687](crossplane/crossplane#7687)
- build: bump pinned nixpkgs channel from nixos-25.11 to nixos-26.05 by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7715](crossplane/crossplane#7715)
- Update the Netclab adopter entry by [@&#8203;mbakalarski](https://github.com/mbakalarski) in [#&#8203;7718](crossplane/crossplane#7718)
- pkg: Make deactivated revisions relinquish control of runtime resources by [@&#8203;adamwg](https://github.com/adamwg) in [#&#8203;7714](crossplane/crossplane#7714)
- chore(deps): update dependency renovate to v44 (main) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7698](crossplane/crossplane#7698)
- drop secret last-applied annotation from pipeline inspector output by [@&#8203;phisco](https://github.com/phisco) in [#&#8203;7726](crossplane/crossplane#7726)
- chore(deps): bump crossplane-runtime to v2.4.0-rc.1 by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7735](crossplane/crossplane#7735)
- chore(deps): update module golang.org/x/mod to v0.40.0 \[security] (release-2.4) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7744](crossplane/crossplane#7744)
- \[Backport release-2.4] fix(ci): pin negz/create-tag to v2 so apis/ submodule tagging works again by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;7747](crossplane/crossplane#7747)
- chore(deps): lock file maintenance (release-2.4) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7754](crossplane/crossplane#7754)
- chore(deps): bump crossplane-runtime to v2.4.0 by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7762](crossplane/crossplane#7762)

#### New Contributors

- [@&#8203;gadsilva](https://github.com/gadsilva) made their first contribution in [#&#8203;7388](crossplane/crossplane#7388)
- [@&#8203;LorenzBischof](https://github.com/LorenzBischof) made their first contribution in [#&#8203;7341](crossplane/crossplane#7341)
- [@&#8203;netliomax25-code](https://github.com/netliomax25-code) made their first contribution in [#&#8203;7476](crossplane/crossplane#7476)
- [@&#8203;RonaldLePape](https://github.com/RonaldLePape) made their first contribution in [#&#8203;7473](crossplane/crossplane#7473)
- [@&#8203;cazeaux](https://github.com/cazeaux) made their first contribution in [#&#8203;7533](crossplane/crossplane#7533)
- [@&#8203;s3onghyun](https://github.com/s3onghyun) made their first contribution in [#&#8203;7526](crossplane/crossplane#7526)
- [@&#8203;youssefcamao](https://github.com/youssefcamao) made their first contribution in [#&#8203;7591](crossplane/crossplane#7591)
- [@&#8203;truongnht](https://github.com/truongnht) made their first contribution in [#&#8203;7561](crossplane/crossplane#7561)
- [@&#8203;alliasgher](https://github.com/alliasgher) made their first contribution in [#&#8203;7564](crossplane/crossplane#7564)
- [@&#8203;amarkdotdev](https://github.com/amarkdotdev) made their first contribution in [#&#8203;7547](crossplane/crossplane#7547)
- [@&#8203;erost](https://github.com/erost) made their first contribution in [#&#8203;7657](crossplane/crossplane#7657)

**Full Changelog**: <crossplane/crossplane@v2.3.0...v2.4.0>

### [`v2.3.5`](https://github.com/crossplane/crossplane/releases/tag/v2.3.5)

[Compare Source](crossplane/crossplane@v2.3.4...v2.3.5)

`v2.3.5` is a patch release scoped to fixing issues reported by users of Crossplane `v2.3` and fixing security related issues in Crossplane's dependencies.

### 🎉 Highlights

- **Correct `crank` checksums for `amd64` binaries ([#&#8203;7666](crossplane/crossplane#7666), originally [#&#8203;7660](crossplane/crossplane#7660 The published `.sha256` files for `linux_amd64` binaries had not matched the binaries themselves since `v2.2.0`, so any install script or Dockerfile that verified the `amd64` checksum failed. Checksums are now calculated after Nix strips the binary, and the release workflow verifies them before uploading. Fixes [#&#8203;7467](crossplane/crossplane#7467).
- **Unambiguous `Usage` index key ([#&#8203;7630](crossplane/crossplane#7630), originally [#&#8203;7508](crossplane/crossplane#7508 The deletion protection webhook indexed `Usage` resources by joining API group, kind, name, and namespace with `.`. Since groups and names can contain `.` themselves, two distinct resources could collapse to the same key, causing the webhook to block a deletion that should have been allowed. The key now joins with `/`, which cannot appear in any of those fields.
- **Dependency security updates:** Bumps `cel-go` ([#&#8203;7761](crossplane/crossplane#7761)), `golang.org/x/mod` ([#&#8203;7743](crossplane/crossplane#7743)), and `sigstore-go` ([#&#8203;7678](crossplane/crossplane#7678)), plus a combined set of vulnerable dependency updates ([#&#8203;7650](crossplane/crossplane#7650)), to pick up upstream CVE fixes. `crossplane-runtime` is also bumped to `v2.3.4` ([#&#8203;7765](crossplane/crossplane#7765)), which carries its own set of security dependency updates.

#### What's Changed

- build: give every Go build its own writable HOME by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7653](crossplane/crossplane#7653)
- chore(deps): update vulnerable dependencies \[security] (release-2.3) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7650](crossplane/crossplane#7650)
- \[Backport release-2.3] use unambiguous separator for usage index key by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;7630](crossplane/crossplane#7630)
- Backport [#&#8203;7660](crossplane/crossplane#7660) to release-2.3 by [@&#8203;adamwg](https://github.com/adamwg) in [#&#8203;7666](crossplane/crossplane#7666)
- chore(deps): update module github.com/sigstore/sigstore-go to v1.2.1 \[security] (release-2.3) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7678](crossplane/crossplane#7678)
- \[Backport release-2.3] build: point docker-client at docker\_29 in the nix overlay by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;7706](crossplane/crossplane#7706)
- chore(deps): lock file maintenance (release-2.3) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7700](crossplane/crossplane#7700)
- \[Backport release-2.3] build: bump pinned nixpkgs channel from nixos-25.11 to nixos-26.05 by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7720](crossplane/crossplane#7720)
- chore(deps): update module golang.org/x/mod to v0.40.0 \[security] (release-2.3) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7743](crossplane/crossplane#7743)
- \[Backport release-2.3] fix(ci): pin create-tag to v2 so apis/ submodule tagging works again by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7748](crossplane/crossplane#7748)
- chore(deps): lock file maintenance (release-2.3) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7753](https://github.com/crossplane/crossplane/pull/7753)
- chore(deps): update module github.com/google/cel-go to v0.30.0 \[security] (release-2.3) by [@&#8203;crossplane-renovate](https://github.com/crossplane-renovate)\[bot] in [#&#8203;7761](crossplane/crossplane#7761)
- chore(deps): bump crossplane-runtime to v2.3.4 by [@&#8203;jbw976](https://github.com/jbw976) in [#&#8203;7765](crossplane/crossplane#7765)

**Full Changelog**: <crossplane/crossplane@v2.3.4...v2.3.5>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/London)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjAuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI2MC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9oZWxtIiwidHlwZS9taW5vciJdfQ==-->

Reviewed-on: https://forgejo.hayden.moe/hayden/phoebe/pulls/325
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Web Bug] - Algolia Documentation version Facets not set-up.

2 participants