Skip to content

Update module github.com/crossplane/crossplane-runtime/v2 to v2.3.3 - #9

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-crossplane-crossplane-runtime-v2-2.x
Open

Update module github.com/crossplane/crossplane-runtime/v2 to v2.3.3#9
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-crossplane-crossplane-runtime-v2-2.x

Conversation

@renovate

@renovate renovate Bot commented Mar 14, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/crossplane/crossplane-runtime/v2 v2.0.0v2.3.3 age confidence

Release Notes

crossplane/crossplane-runtime (github.com/crossplane/crossplane-runtime/v2)

v2.3.3

Compare Source

🎉 Highlights

  • Fixed package signature verification TOCTOU (GHSA-mf7q-r4rv-jv94): A time-of-check-to-time-of-use flaw would let a malicious OCI registry serve a correctly signed image for verification and then an unsigned image for installation, because Crossplane resolved tag references separately for each step. Crossplane now resolves a tag to a digest once and uses that same digest for both signature verification and the image pull, so the content that is verified is exactly the content that is installed. This affected only users who enable package signature verification, install packages by tag, and pull from registries they don't control. Installing by digest would avoid this issue. Backported in #​1038, and reported independently by @​bugbunny-research and @​tonghuaroot.
    • Note this fix appears in crossplane for v2.2 and crossplane-runtime for v2.3 because the affected code was moved from crossplane to crossplane-runtime during the v2.3 milestone.

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.3.2...v2.3.3

v2.3.2

Compare Source

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.3.1...v2.3.2

v2.3.1

Compare Source

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.3.0...v2.3.1

v2.3.0

Compare Source

🚨 Notable and Breaking Changes

  • The common APIs from crossplane-runtime have moved to github.com/crossplane/crossplane/apis/v2/core

What's Changed

New Contributors

Full Changelog: crossplane/crossplane-runtime@v2.2.0...v2.3.0

v2.2.3

Compare Source

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.2.2...v2.2.3

v2.2.2

Compare Source

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.2.1...v2.2.2

v2.2.1

Compare Source

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.2.0...v2.2.1

v2.2.0

Compare Source

What's Changed

New Contributors

Full Changelog: crossplane/crossplane-runtime@v2.1.0...v2.2.0

v2.1.7

Compare Source

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.1.6...v2.1.7

v2.1.6

Compare Source

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.1.5...v2.1.6

v2.1.5

Compare Source

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.1.0...v2.1.5

v2.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: crossplane/crossplane-runtime@v2.0.0...v2.1.0

v2.0.9

Compare Source

v2.0.8

Compare Source

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.0.0...v2.0.8


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Mar 14, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 47 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.24.10 -> 1.25.9
google.golang.org/grpc v1.75.1 -> v1.79.3
k8s.io/api v0.33.0 -> v0.35.0
k8s.io/apiextensions-apiserver v0.33.0 -> v0.35.0
k8s.io/apimachinery v0.33.0 -> v0.35.0
k8s.io/client-go v0.33.0 -> v0.35.0
sigs.k8s.io/controller-runtime v0.19.0 -> v0.23.1
sigs.k8s.io/controller-tools v0.18.0 -> v0.20.0
github.com/emicklei/go-restful/v3 v3.12.1 -> v3.13.0
github.com/evanphx/json-patch/v5 v5.9.0 -> v5.9.11
github.com/fsnotify/fsnotify v1.8.0 -> v1.9.0
github.com/fxamacker/cbor/v2 v2.7.0 -> v2.9.0
github.com/go-openapi/jsonpointer v0.21.0 -> v0.22.4
github.com/go-openapi/jsonreference v0.21.0 -> v0.21.4
github.com/go-openapi/swag v0.23.0 -> v0.25.4
github.com/google/gnostic-models v0.6.9 -> v0.7.1
github.com/modern-go/reflect2 v1.0.2 -> v1.0.3-0.20250322232337-35a7c28c31ee
github.com/prometheus/client_golang v1.22.0 -> v1.23.2
github.com/prometheus/client_model v0.6.1 -> v0.6.2
github.com/prometheus/common v0.62.0 -> v0.67.5
github.com/prometheus/procfs v0.15.1 -> v0.19.2
github.com/spf13/afero v1.12.0 -> v1.15.0
github.com/spf13/cobra v1.9.1 -> v1.10.2
github.com/spf13/pflag v1.0.6 -> v1.0.10
go.opentelemetry.io/otel v1.37.0 -> v1.40.0
go.opentelemetry.io/otel/trace v1.37.0 -> v1.40.0
go.uber.org/zap v1.27.0 -> v1.27.1
golang.org/x/crypto v0.41.0 -> v0.47.0
golang.org/x/exp v0.0.0-20250207012021-f9890c6ad9f3 -> v0.0.0-20260112195511-716be5621a96
golang.org/x/mod v0.26.0 -> v0.32.0
golang.org/x/net v0.43.0 -> v0.49.0
golang.org/x/oauth2 v0.30.0 -> v0.34.0
golang.org/x/sync v0.16.0 -> v0.19.0
golang.org/x/sys v0.35.0 -> v0.40.0
golang.org/x/term v0.34.0 -> v0.39.0
golang.org/x/text v0.28.0 -> v0.33.0
gomodules.xyz/jsonpatch/v2 v2.4.0 -> v2.5.0
google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7 -> v0.0.0-20260114163908-3f89685c29c3
google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 -> v0.0.0-20260203192932-546029d2fa20
google.golang.org/protobuf v1.36.9 -> v1.36.11
gopkg.in/evanphx/json-patch.v4 v4.12.0 -> v4.13.0
k8s.io/code-generator v0.33.0 -> v0.35.0
k8s.io/component-base v0.33.0 -> v0.35.0
k8s.io/gengo/v2 v2.0.0-20250207200755-1244d31929d7 -> v2.0.0-20251215205346-5ee0d033ba5b
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff -> v0.0.0-20260127142750-a19766b6e2d4
k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e -> v0.0.0-20260108192941-914a6e750570
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 -> v0.0.0-20250730193827-2d320260d730
sigs.k8s.io/yaml v1.4.0 -> v1.6.0

@renovate renovate Bot changed the title fix(deps): update module github.com/crossplane/crossplane-runtime/v2 to v2.2.0 Update module github.com/crossplane/crossplane-runtime/v2 to v2.2.0 Apr 15, 2026
@renovate
renovate Bot force-pushed the renovate/github.com-crossplane-crossplane-runtime-v2-2.x branch from 8b55708 to 4b3e0e6 Compare May 1, 2026 08:15
@renovate renovate Bot changed the title Update module github.com/crossplane/crossplane-runtime/v2 to v2.2.0 Update module github.com/crossplane/crossplane-runtime/v2 to v2.2.1 May 1, 2026
@renovate
renovate Bot force-pushed the renovate/github.com-crossplane-crossplane-runtime-v2-2.x branch from 4b3e0e6 to 5365699 Compare May 13, 2026 04:13
@renovate
renovate Bot force-pushed the renovate/github.com-crossplane-crossplane-runtime-v2-2.x branch from 5365699 to c2c76b2 Compare May 21, 2026 23:39
@renovate renovate Bot changed the title Update module github.com/crossplane/crossplane-runtime/v2 to v2.2.1 Update module github.com/crossplane/crossplane-runtime/v2 to v2.3.0 May 21, 2026
@renovate

renovate Bot commented May 21, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
Command failed: go get -t ./...
go: module github.com/crossplane/crossplane-runtime/v2@v2.3.3 requires go >= 1.25.9; switching to go1.25.12
go: downloading go1.25.12 (linux/amd64)
go: downloading k8s.io/apimachinery v0.35.1
go: downloading github.com/crossplane/crossplane-runtime/v2 v2.3.3
go: downloading sigs.k8s.io/controller-runtime v0.23.1
go: downloading k8s.io/api v0.35.1
go: downloading k8s.io/apiextensions-apiserver v0.35.0
go: downloading k8s.io/client-go v0.35.1
go: downloading k8s.io/klog/v2 v2.130.1
go: downloading k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4
go: downloading sigs.k8s.io/structured-merge-diff/v6 v6.3.2-0.20260122202528-d9cc6641c482
go: downloading github.com/crossplane/crossplane/apis/v2 v2.0.0-20260424160951-8f231230ebb6
go: downloading github.com/spf13/afero v1.15.0
go: downloading google.golang.org/protobuf v1.36.11
go: downloading k8s.io/utils v0.0.0-20260108192941-914a6e750570
go: downloading github.com/evanphx/json-patch/v5 v5.9.11
go: downloading golang.org/x/tools v0.44.0
go: downloading golang.org/x/time v0.15.0
go: downloading k8s.io/component-base v0.35.0
go: downloading golang.org/x/net v0.55.0
go: downloading gomodules.xyz/jsonpatch/v2 v2.5.0
go: downloading sigs.k8s.io/controller-tools v0.20.0
go: downloading golang.org/x/text v0.37.0
go: downloading golang.org/x/sync v0.20.0
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5
go: downloading golang.org/x/sys v0.45.0
go: downloading github.com/spf13/pflag v1.0.10
go: downloading go.opentelemetry.io/otel/trace v1.42.0
go: downloading go.opentelemetry.io/otel v1.42.0
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5
go: downloading github.com/google/gnostic-models v0.7.1
go: downloading github.com/go-openapi/jsonreference v0.21.5
go: downloading github.com/go-openapi/swag v0.25.5
go: downloading golang.org/x/term v0.43.0
go: downloading golang.org/x/oauth2 v0.36.0
go: downloading golang.org/x/mod v0.35.0
go: downloading github.com/google/btree v1.1.3
go: downloading k8s.io/code-generator v0.35.0
go: downloading k8s.io/gengo/v2 v2.0.0-20251215205346-5ee0d033ba5b
go: downloading github.com/go-openapi/jsonpointer v0.22.5
go: downloading github.com/go-openapi/swag/cmdutils v0.25.5
go: downloading github.com/go-openapi/swag/conv v0.25.5
go: downloading github.com/go-openapi/swag/fileutils v0.25.5
go: downloading github.com/go-openapi/swag/jsonname v0.25.5
go: downloading github.com/go-openapi/swag/jsonutils v0.25.5
go: downloading github.com/go-openapi/swag/loading v0.25.5
go: downloading github.com/go-openapi/swag/mangling v0.25.5
go: downloading github.com/go-openapi/swag/netutils v0.25.5
go: downloading github.com/go-openapi/swag/stringutils v0.25.5
go: downloading github.com/go-openapi/swag/typeutils v0.25.5
go: downloading github.com/go-openapi/swag/yamlutils v0.25.5
go: downloading golang.org/x/exp v0.0.0-20260112195511-716be5621a96
go: downloading golang.org/x/crypto v0.52.0
go: downloading github.com/klauspost/compress v1.18.5
go: downloading github.com/crossplane/crossplane-runtime v1.20.10
go: github.com/crossplane-contrib/provider-redpanda/apis/cluster/redpanda/v1alpha1 imports
	github.com/crossplane/crossplane-runtime/v2/apis/common/v1: cannot find module providing package github.com/crossplane/crossplane-runtime/v2/apis/common/v1
go: github.com/crossplane-contrib/provider-redpanda/apis/namespaced/redpanda/v1alpha1 imports
	github.com/crossplane/crossplane-runtime/v2/apis/common/v2: cannot find module providing package github.com/crossplane/crossplane-runtime/v2/apis/common/v2

@renovate
renovate Bot force-pushed the renovate/github.com-crossplane-crossplane-runtime-v2-2.x branch from c2c76b2 to 5f74e99 Compare May 23, 2026 15:37
@renovate renovate Bot changed the title Update module github.com/crossplane/crossplane-runtime/v2 to v2.3.0 Update module github.com/crossplane/crossplane-runtime/v2 to v2.3.1 May 23, 2026
@renovate
renovate Bot force-pushed the renovate/github.com-crossplane-crossplane-runtime-v2-2.x branch from 5f74e99 to 0a8a9d3 Compare June 12, 2026 15:38
@renovate renovate Bot changed the title Update module github.com/crossplane/crossplane-runtime/v2 to v2.3.1 Update module github.com/crossplane/crossplane-runtime/v2 to v2.3.2 Jun 12, 2026
@renovate
renovate Bot force-pushed the renovate/github.com-crossplane-crossplane-runtime-v2-2.x branch from 0a8a9d3 to eca227a Compare June 24, 2026 08:15
@renovate renovate Bot changed the title Update module github.com/crossplane/crossplane-runtime/v2 to v2.3.2 Update module github.com/crossplane/crossplane-runtime/v2 to v2.3.3 Jun 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants