Crossplane v2.4.0 is available now for your production control planes! 🎉
Watching required resources: composition functions can require resources they don't compose, but Crossplane didn't watch them, so a change didn't reach the XRs until their next regular poll. Crossplane now tracks what each XR depends on and drives watches from that, so a change to a required resource kicks off an XR reconciliation right away.
Scale to Zero for safe-start capable Providers: a provider whose ManagedResourceDefinitions are all inactive now runs with zero replicas, and scales up once its first MRD is activated. Installing a broad set of providers no longer costs you a running pod for each one that has nothing to reconcile yet.
Vulnerability-scannable images: our container images now carry their full Go dependency list, so grype and trivy can see CVEs in our third-party dependencies rather than just the main module and the standard library. No more hidden vulnerabilities!
...and also more reliable package runtime management, hardening across the composition and package paths, version-aware docs search, and security fixes in Crossplane's Go toolchain and dependencies. Lots to be excited about!
🚨 v1.20 EOL: this is the final release cycle where v1.20 is maintained. When v2.5 is released in Nov 2026, v1.20 reaches EOL and no longer receives support or maintenance from the project. This applies to the v1.20 release only - v1 legacy workloads like Claims and cluster scoped resources remain supported in v2 via back compat. Full details are in the release notes.
And a big congratulations to our Release MVP Rafał Jan, who discovered and drove a critical fix for major memory consumption in providers that are safe-start capable. Thank you very much! 🙇
Full release note details: https://lnkd.in/gHbMb-_Y