[renovate]

This PR contains the following updates:

Package	Update	Change
crossplane/crossplane	patch	v2.4.2 → v2.4.3

---

Release Notes

crossplane/crossplane

v2.4.3

Compare Source

v2.4.3 is a patch release scoped to fixing issues reported by users of Crossplane v2.4 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights

• Distrust of compromised eMudhra intermediate CAs: Bumps the Go toolchain to 1.26.10, whose crypto/x509 rejects the compromised eMudhra intermediate certificates (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots they chain to from the image's CA bundle (#​7957).
• Truncated package downloads are no longer cached: A package download that failed partway could be cached as a valid but truncated package.yaml. The package revision then recorded only some of its objects, reported Healthy=True, and the provider's RBAC was rendered from the short list, so the provider could crash-loop. Truncated downloads are now discarded. Fixed via crossplane-runtime v2.4.3 (#​7961), originally crossplane/crossplane-runtime#1189.
• Usage no longer rewrites the in-use label on every reconcile: A leftover ownership check meant the used resource was updated on every reconcile of every Usage/ClusterUsage, causing needless API writes. Backported in #​7877, originally fixed in #​7860.
• XR scale RBAC: Users with crossplane-edit or crossplane-admin access can now kubectl scale XRs and claims whose XRD serves the scale subresource; previously they got Forbidden. Backported in #​7934, originally fixed in #​7922.
• Dependency security updates: A combined set of vulnerable dependency updates (#​7915) to pick up upstream CVE fixes. Also refreshes the lock file (#​7894, #​7909).

What's Changed

• [Backport release-2.4] e2e: Use xpkg.upbound.io for private package pull test by @​github-actions[bot] in #​7873
• [Backport release-2.4] fix: stop rewriting the in-use label on every Usage reconcile by @​github-actions[bot] in #​7877
• chore(deps): lock file maintenance (release-2.4) by @​crossplane-renovate[bot] in #​7894
• chore(deps): update vulnerable dependencies [security] (release-2.4) by @​crossplane-renovate[bot] in #​7915
• chore(deps): lock file maintenance (release-2.4) by @​crossplane-renovate[bot] in #​7909
• [release-2.4] build(deps): bump Go to 1.26.9 [security] by @​lsviben in #​7951
• [release-2.4] build(deps): bump Go to 1.26.10 and distrust compromised eMudhra roots [security] by @​lsviben in #​7957
• [Backport release-2.4] allow users with crossplane-edit and crossplane-admin access to scale XRs that serve it by @​github-actions[bot] in #​7934
• [release-2.4] chore(deps): bump crossplane-runtime to v2.4.3 by @​lsviben in #​7961

Full Changelog: crossplane/crossplane@v2.4.2...v2.4.3

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.