[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/crossplane/crossplane/v2	v2.4.2 → v2.4.3

---

Release Notes

crossplane/crossplane (github.com/crossplane/crossplane/v2)

v2.4.3

Compare Source

v2.4.3 is a patch release scoped to fixing issues reported by users of Crossplane v2.4 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights

• Distrust of compromised eMudhra intermediate CAs: Bumps the Go toolchain to 1.26.10, whose crypto/x509 rejects the compromised eMudhra intermediate certificates (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots they chain to from the image's CA bundle (#​7957).
• Truncated package downloads are no longer cached: A package download that failed partway could be cached as a valid but truncated package.yaml. The package revision then recorded only some of its objects, reported Healthy=True, and the provider's RBAC was rendered from the short list, so the provider could crash-loop. Truncated downloads are now discarded. Fixed via crossplane-runtime v2.4.3 (#​7961), originally crossplane/crossplane-runtime#1189.
• Usage no longer rewrites the in-use label on every reconcile: A leftover ownership check meant the used resource was updated on every reconcile of every Usage/ClusterUsage, causing needless API writes. Backported in #​7877, originally fixed in #​7860.
• XR scale RBAC: Users with crossplane-edit or crossplane-admin access can now kubectl scale XRs and claims whose XRD serves the scale subresource; previously they got Forbidden. Backported in #​7934, originally fixed in #​7922.
• Dependency security updates: A combined set of vulnerable dependency updates (#​7915) to pick up upstream CVE fixes. Also refreshes the lock file (#​7894, #​7909).

What's Changed

• [Backport release-2.4] e2e: Use xpkg.upbound.io for private package pull test by @​github-actions[bot] in #​7873
• [Backport release-2.4] fix: stop rewriting the in-use label on every Usage reconcile by @​github-actions[bot] in #​7877
• chore(deps): lock file maintenance (release-2.4) by @​crossplane-renovate[bot] in #​7894
• chore(deps): update vulnerable dependencies [security] (release-2.4) by @​crossplane-renovate[bot] in #​7915
• chore(deps): lock file maintenance (release-2.4) by @​crossplane-renovate[bot] in #​7909
• [release-2.4] build(deps): bump Go to 1.26.9 [security] by @​lsviben in #​7951
• [release-2.4] build(deps): bump Go to 1.26.10 and distrust compromised eMudhra roots [security] by @​lsviben in #​7957
• [Backport release-2.4] allow users with crossplane-edit and crossplane-admin access to scale XRs that serve it by @​github-actions[bot] in #​7934
• [release-2.4] chore(deps): bump crossplane-runtime to v2.4.3 by @​lsviben in #​7961

Full Changelog: crossplane/crossplane@v2.4.2...v2.4.3

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• The go directive was updated for compatibility reasons

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=2 days

Details:

Package	Change
go	1.26.7 -> 1.26.10

[github-actions]

Automatically approved: Renovate dependency update. Merge is gated on required status checks.