Infrastructure as code

Crossplane: what changed

In the last 90 days, 11 summarized changes: 1 breaking changes, 3 security advisories, 5 releases, 2 fixes. Stackdiff reads Crossplane's own feeds (crossplane.io) and writes two sentences per change with a link to the source; it never republishes release notes. Sources last checked .

Needs attention

Breaking changes, security advisories, end-of-life and license changes from the last 90 days, worst first.

2.4.0-rc.1Breakinghigh
v2.4.0-rc.1
1.20.12Securitymedium
v1.20.12
2.4.0Securitymedium
v2.4.0
Securitymedium
GHSA-wfqx-gjrf-g28r: Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag

Latest changes

Newest first, every type. Releases and fixes sit below anything that can hurt you in the weekly brief; here they are in order.

1.20.12Securitymedium
v1.20.12
2.2.5Fix
v2.2.5
2.3.5Fix
v2.3.5
2.3.5Release
apis/v2.3.5
2.4.0Securitymedium
v2.4.0
2.4.0Release
apis/v2.4.0
2.4.0-rc.1Breakinghigh
v2.4.0-rc.1
2.4.0-rc.1Release
apis/v2.4.0-rc.1
2.5.0-rc.0Release
apis/v2.5.0-rc.0
2.5.0-rc.0Release
v2.5.0-rc.0
News
Building Modelplane on Crossplane
Securitymedium
GHSA-wfqx-gjrf-g28r: Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag
News
Is your control plane ready for Crossplane v2?
News
Introducing function-kro: YAML+CEL Composition Meets Crossplane
Keynote
Meet Crossplane in Amsterdam for KubeCon EU 2026!
2.2News
Crossplane v2.2 — More Capable, More Reliable, More Observable
News
Crossplane & AI: The Case for API-First Infrastructure
Keynote
Announcing Crossplane’s CNCF Graduation
2.0Keynote
Announcing Crossplane 2.0
News
Introducing function-python
News
Strengthening Crossplane's Community-Driven Ecosystem
News
Crossplane v2: A More Intuitive Way to Manage Applications
News
My Experience as a Mentee in the LFX Mentorship Program with Crossplane
1.16News
Crossplane v1.16 - a Community Driven Success
News
Go deeper with control planes at Level Up with Crossplane, presented by Upbound
Keynote
KubeCon Europe 2024: Watch these 8+ Crossplane-y talks
1.11.5Securityhigh
GHSA-68p4-95xf-7gx8: Denial of service from large image
1.11.5Securitymedium
GHSA-pj4x-2xr5-w87m: Possible image tampering from missing image validation for Packages
1.10.3Securitymedium
GHSA-v829-x6hh-cqfq: Crossplane-runtime contains Improper Input Validation via Compositions

Where Stackdiff reads Crossplane

Only what the vendor publishes for machines. Excerpts are capped, summaries are our own two sentences, and every line links back.

Get Crossplane changes in your Monday brief

Add Crossplane and the rest of your stack; breaking changes and CVEs go out the moment they're seen, everything else on Monday.

Get your first brief

Other infrastructure as code tools