Update Helm release crossplane to v2.0.8 (main)
This MR contains the following updates:
| Package | Update | Change |
|---|---|---|
| crossplane (source) | patch | 2.0.7 -> 2.0.8 |
⚠️ WarningSome dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
crossplane/crossplane (crossplane)
v2.0.8
v2.0.8 is a patch release scoped to fixing issues reported by users of Crossplane v2.0 and fixing security related issues in Crossplane's dependencies.
🎉 Highlights
-
Dependency upgrades work correctly with
ImageConfigprefix rewriting: Packages installed via anImageConfigprefix rewrite were previously not being upgraded when their dependencies changed, leaving users stuck on stale versions of dependent packages. Dependency upgrades now behave as expected when prefix rewrites are in use. Backported in #7278, originally fixed in #7233. -
Composition functions can now select all resources of a given kind: When a composition function returned a
Requirements.ResourceSelectorwith onlyapiVersionandkindset (nomatchNameormatchLabels), Crossplane previously rejected this as an invalid request. A selector with no match field is now correctly interpreted as "all resources of that kind". Backported in #7248, originally fixed in #7241.
This release also bumps Go to 1.25.9 and pulls in security related updates for a number of Crossplane's upstream dependencies, including go-git, go-jose, cloudflare/circl, moby/spdystream, sigstore/timestamp-authority, docker/cli, and the OpenTelemetry OTLP HTTP trace exporter
What's Changed
- build: mitigate potential script injection in promote workflow (release-2.0) by @jbw976 in #7170
- [Backport release-2.0] fix: adding required permissions to top level and jobs in the workflow by @jbw976 in #7186
- chore(deps): update module github.com/cloudflare/circl to v1.6.3 [security] (release-2.0) by @crossplane-renovate[bot] in #7180
- Backport #7233 to release-2.0 by @adamwg in #7278
- chore(deps): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [security] (release-2.0) by @crossplane-renovate[bot] in #7288
- chore(deps): update module github.com/go-jose/go-jose/v4 to v4.1.4 [security] (release-2.0) by @crossplane-renovate[bot] in #7264
- [Backport release-2.0] ci: drop Trivy vulnerability scanning by @phisco in #7301
- chore(deps): bump Go to 1.25.9 [security] (release-2.0) by @phisco in #7304
- fix(deps): update module github.com/go-git/go-git/v5 to v5.17.1 [security] (release-2.0) by @crossplane-renovate[bot] in #7139
- chore(deps): update module github.com/moby/spdystream to v0.5.1 [security] (release-2.0) by @crossplane-renovate[bot] in #7315
- chore(deps): update module github.com/docker/cli to v29.2.0+incompatible [security] (release-2.0) by @crossplane-renovate[bot] in #7195
- chore(deps): update module github.com/sigstore/timestamp-authority/v2 to v2.0.6 [security] (release-2.0) by @crossplane-renovate[bot] in #7316
- [Backport release-2.0] Support ResourceSelector with no match field by @negz in #7248
- fix(deps): update module github.com/go-git/go-git/v5 to v5.18.0 [security] (release-2.0) by @crossplane-renovate[bot] in #7327
- Bump crossplane-runtime to v2.0.8 by @lsviben in #7330
Full Changelog: https://github.com/crossplane/crossplane/compare/v2.0.7...v2.0.8
Configuration
- If you want to rebase/retry this MR, check this box
This MR has been generated by Renovate Bot Sylva instance.
CI configuration couldn't be handle by MR description. A dedicated comment has been posted to control it.
If no checkbox is checked, a default pipeline will be enabled (capm3, or capo if capo label is set)