Skip to content

Update module github.com/crossplane/crossplane-runtime/v2 to v2.3.3#164

Open
renovate[bot] wants to merge 4 commits into
mainfrom
renovate/github.com-crossplane-crossplane-runtime-v2-2.x
Open

Update module github.com/crossplane/crossplane-runtime/v2 to v2.3.3#164
renovate[bot] wants to merge 4 commits into
mainfrom
renovate/github.com-crossplane-crossplane-runtime-v2-2.x

Conversation

@renovate

@renovate renovate Bot commented Jun 24, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/crossplane/crossplane-runtime/v2 v2.0.0v2.3.3 age confidence

Release Notes

crossplane/crossplane-runtime (github.com/crossplane/crossplane-runtime/v2)

v2.3.3

Compare Source

🎉 Highlights

  • Fixed package signature verification TOCTOU (GHSA-mf7q-r4rv-jv94): A time-of-check-to-time-of-use flaw would let a malicious OCI registry serve a correctly signed image for verification and then an unsigned image for installation, because Crossplane resolved tag references separately for each step. Crossplane now resolves a tag to a digest once and uses that same digest for both signature verification and the image pull, so the content that is verified is exactly the content that is installed. This affected only users who enable package signature verification, install packages by tag, and pull from registries they don't control. Installing by digest would avoid this issue. Backported in #​1038, and reported independently by @​bugbunny-research and @​tonghuaroot.
    • Note this fix appears in crossplane for v2.2 and crossplane-runtime for v2.3 because the affected code was moved from crossplane to crossplane-runtime during the v2.3 milestone.

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.3.2...v2.3.3

v2.3.2

Compare Source

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.3.1...v2.3.2

v2.3.1

Compare Source

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.3.0...v2.3.1

v2.3.0

Compare Source

🚨 Notable and Breaking Changes

  • The common APIs from crossplane-runtime have moved to github.com/crossplane/crossplane/apis/v2/core

What's Changed

New Contributors

Full Changelog: crossplane/crossplane-runtime@v2.2.0...v2.3.0

v2.2.3

Compare Source

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.2.2...v2.2.3

v2.2.2

Compare Source

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.2.1...v2.2.2

v2.2.1

Compare Source

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.2.0...v2.2.1

v2.2.0

Compare Source

What's Changed

New Contributors

Full Changelog: crossplane/crossplane-runtime@v2.1.0...v2.2.0

v2.1.7

Compare Source

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.1.6...v2.1.7

v2.1.6

Compare Source

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.1.5...v2.1.6

v2.1.5

Compare Source

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.1.0...v2.1.5

v2.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: crossplane/crossplane-runtime@v2.0.0...v2.1.0

v2.0.9

Compare Source

v2.0.8

Compare Source

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.0.0...v2.0.8


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Jun 24, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
Command failed: go get -t ./...
go: module github.com/crossplane/crossplane-runtime/v2@v2.3.3 requires go >= 1.25.9; switching to go1.25.11
go: downloading go1.25.11 (linux/amd64)
go: downloading k8s.io/apimachinery v0.35.1
go: downloading github.com/crossplane/crossplane-runtime/v2 v2.3.3
go: downloading sigs.k8s.io/controller-runtime v0.23.1
go: downloading github.com/alecthomas/kingpin/v2 v2.4.0
go: downloading google.golang.org/grpc v1.79.3
go: downloading k8s.io/apiextensions-apiserver v0.35.0
go: downloading k8s.io/client-go v0.35.1
go: downloading github.com/google/go-cmp v0.7.0
go: downloading k8s.io/klog/v2 v2.130.1
go: downloading k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4
go: downloading sigs.k8s.io/structured-merge-diff/v6 v6.3.2-0.20260122202528-d9cc6641c482
go: downloading github.com/crossplane/crossplane/apis/v2 v2.0.0-20260424160951-8f231230ebb6
go: downloading github.com/spf13/afero v1.15.0
go: downloading google.golang.org/protobuf v1.36.11
go: downloading k8s.io/api v0.35.1
go: downloading k8s.io/utils v0.0.0-20260108192941-914a6e750570
go: downloading sigs.k8s.io/randfill v1.0.0
go: downloading github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b
go: downloading github.com/xhit/go-str2duration/v2 v2.1.0
go: downloading github.com/go-logr/logr v1.4.3
go: downloading golang.org/x/time v0.15.0
go: downloading github.com/evanphx/json-patch v5.9.11+incompatible
go: downloading github.com/prometheus/client_golang v1.23.2
go: downloading k8s.io/component-base v0.35.0
go: downloading golang.org/x/net v0.55.0
go: downloading github.com/go-logr/zapr v1.3.0
go: downloading go.uber.org/zap v1.27.1
go: downloading github.com/evanphx/json-patch/v5 v5.9.11
go: downloading sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730
go: downloading github.com/json-iterator/go v1.1.12
go: downloading go.yaml.in/yaml/v2 v2.4.3
go: downloading sigs.k8s.io/controller-tools v0.20.0
go: downloading golang.org/x/text v0.37.0
go: downloading gopkg.in/inf.v0 v0.9.1
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5
go: downloading github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822
go: downloading github.com/beorn7/perks v1.0.1
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading github.com/prometheus/client_model v0.6.2
go: downloading github.com/prometheus/common v0.67.5
go: downloading github.com/prometheus/procfs v0.19.2
go: downloading golang.org/x/sys v0.45.0
go: downloading github.com/blang/semver/v4 v4.0.0
go: downloading github.com/spf13/pflag v1.0.10
go: downloading go.opentelemetry.io/otel/trace v1.42.0
go: downloading go.opentelemetry.io/otel v1.42.0
go: downloading go.uber.org/multierr v1.11.0
go: downloading github.com/fxamacker/cbor/v2 v2.9.0
go: downloading github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
go: downloading github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee
go: downloading github.com/spf13/cobra v1.10.2
go: downloading golang.org/x/tools v0.44.0
go: downloading github.com/google/btree v1.1.3
go: downloading golang.org/x/sync v0.20.0
go: downloading golang.org/x/term v0.43.0
go: downloading golang.org/x/oauth2 v0.36.0
go: downloading gomodules.xyz/jsonpatch/v2 v2.5.0
go: downloading github.com/google/gnostic-models v0.7.1
go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
go: downloading github.com/google/uuid v1.6.0
go: downloading sigs.k8s.io/yaml v1.6.0
go: downloading go.yaml.in/yaml/v3 v3.0.4
go: downloading github.com/go-openapi/jsonreference v0.21.5
go: downloading github.com/go-openapi/swag v0.25.5
go: downloading github.com/x448/float16 v0.8.4
go: downloading github.com/inconshreveable/mousetrap v1.1.0
go: downloading k8s.io/code-generator v0.35.0
go: downloading k8s.io/gengo/v2 v2.0.0-20251215205346-5ee0d033ba5b
go: downloading github.com/gobuffalo/flect v1.0.3
go: downloading gopkg.in/yaml.v2 v2.4.0
go: downloading github.com/fatih/color v1.18.0
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
go: downloading github.com/fsnotify/fsnotify v1.9.0
go: downloading gopkg.in/evanphx/json-patch.v4 v4.13.0
go: downloading github.com/go-openapi/jsonpointer v0.22.5
go: downloading github.com/go-openapi/swag/cmdutils v0.25.5
go: downloading github.com/go-openapi/swag/conv v0.25.5
go: downloading github.com/go-openapi/swag/fileutils v0.25.5
go: downloading github.com/go-openapi/swag/jsonname v0.25.5
go: downloading github.com/go-openapi/swag/jsonutils v0.25.5
go: downloading github.com/go-openapi/swag/loading v0.25.5
go: downloading github.com/go-openapi/swag/mangling v0.25.5
go: downloading github.com/go-openapi/swag/netutils v0.25.5
go: downloading github.com/go-openapi/swag/stringutils v0.25.5
go: downloading github.com/go-openapi/swag/typeutils v0.25.5
go: downloading github.com/go-openapi/swag/yamlutils v0.25.5
go: downloading golang.org/x/mod v0.35.0
go: downloading github.com/mattn/go-colorable v0.1.14
go: downloading github.com/mattn/go-isatty v0.0.20
go: downloading github.com/emicklei/go-restful/v3 v3.13.0
go: downloading github.com/crossplane/crossplane-runtime v1.20.10
go: github.com/crossplane/provider-template/apis/sample/v1alpha1 imports
	github.com/crossplane/crossplane-runtime/v2/apis/common/v1: cannot find module providing package github.com/crossplane/crossplane-runtime/v2/apis/common/v1
go: github.com/crossplane/provider-template/apis/sample/v1alpha1 imports
	github.com/crossplane/crossplane-runtime/v2/apis/common/v2: cannot find module providing package github.com/crossplane/crossplane-runtime/v2/apis/common/v2

@renovate renovate Bot changed the title Update module github.com/crossplane/crossplane-runtime/v2 to v2.3.3 Update module github.com/crossplane/crossplane-runtime/v2 to v2.3.3 - autoclosed Jun 29, 2026
@renovate renovate Bot closed this Jun 29, 2026
@renovate renovate Bot deleted the renovate/github.com-crossplane-crossplane-runtime-v2-2.x branch June 29, 2026 12:55
@renovate renovate Bot changed the title Update module github.com/crossplane/crossplane-runtime/v2 to v2.3.3 - autoclosed Update module github.com/crossplane/crossplane-runtime/v2 to v2.3.3 Jul 6, 2026
@renovate renovate Bot reopened this Jul 6, 2026
@renovate renovate Bot force-pushed the renovate/github.com-crossplane-crossplane-runtime-v2-2.x branch 2 times, most recently from 75efd73 to b8370d3 Compare July 6, 2026 02:32
jbw976 added 3 commits July 7, 2026 18:29
Adds the github.com/crossplane/crossplane/apis/v2 module and a temporary
replace directive pointing crossplane-tools at the floric/crossplane-tools fork
which is under test in crossplane/crossplane-tools#128.
That PR updates angryget method set generation for the new modules/names location
of crossplane APIs and core v2 types.

Also bumps Go 1.24 to 1.25, golangci-lint to 2.12.2, the Kubernetes
libraries to 0.35, controller-runtime to 0.23.1, controller-tools to
0.20.0, and the transitive dependency tail.

Signed-off-by: Jared Watts <jbw976@gmail.com>
Replaces the crossplane-runtime common/v1 and common/v2 types with the
Crossplane core v2 types from github.com/crossplane/crossplane/apis/v2/
core/v2 across the API types, controllers, and code-generation
templates, then regenerates the deepcopy/managed methods and CRDs. The
managed resource status moves from xpv1.ResourceStatus to
xpv2.ManagedResourceStatus, which adds the lastHandledReconcileAt field
to the MyType CRD.

This also picks up two crossplane-runtime v2.3.3 API changes on the same
files: EnqueueRequestForProviderConfig now takes an explicit Kind, and
event.NewAPIRecorder is deprecated pending the new events API
(crossplane/crossplane#7152), silenced with //nolint:staticcheck until
Crossplane migrates.

Signed-off-by: Jared Watts <jbw976@gmail.com>
Adds compile-time interface checks confirming MyType is a ModernManaged
resource and the ProviderConfig types satisfy the runtime's
ProviderConfig and TypedProviderConfigUsage interfaces after the core-v2
migration.

Signed-off-by: Jared Watts <jbw976@gmail.com>
@renovate

renovate Bot commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Comment thread go.mod

tool github.com/crossplane/crossplane-tools/cmd/angryjet

replace github.com/crossplane/crossplane-tools => github.com/floric/crossplane-tools v0.0.0-20260707061205-9b37924a929d

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

DON'T MERGE: this is temporary for testing the work being done in crossplane/crossplane-tools#128. We will need to wait for that PR to be merged, then remove this replace statement, rerun code generation and testing, and then this PR should be mergable.

@jbw976

jbw976 commented Jul 8, 2026

Copy link
Copy Markdown
Member

@cychiang FYI - I've pushed three commits on top of Renovate's runtime v2.3.3 bump that finish moving the template onto the Crossplane core v2 APIs in their new home from the refactor called out in https://github.com/crossplane/crossplane/releases/tag/v2.3.0:

  • build: refresh dependencies and Go toolchain - adds the github.com/crossplane/crossplane/apis/v2 module and a temporary replace pointing crossplane-tools at the floric/crossplane-tools fork, under test in feat: support crossplane 2.3 api types crossplane-tools#128 (updates angryjet's method-set generation for the new location of the Crossplane core v2 types). Also bumps Go 1.24 -> 1.25, golangci-lint 2.1.2 -> 2.12.2, the k8s libraries to 0.35, controller-runtime to 0.23.1, and controller-tools to 0.20.0.
  • feat: migrate to Crossplane core v2 APIs - swaps crossplane-runtime/v2/apis/common/{v1,v2} for crossplane/apis/v2/core/v2 across the API types, controllers, and codegen templates, then regenerates the deepcopy/managed methods and CRDs. The managed resource status moves from xpv1.ResourceStatus to xpv2.ManagedResourceStatus, which adds lastHandledReconcileAt to the MyType CRD.
  • test: assert types satisfy crossplane-runtime interfaces - compile-time interface checks that MyType is a ModernManaged resource and the ProviderConfig types satisfy the runtime's ProviderConfig / TypedProviderConfigUsage interfaces.

For reviewers: the crossplane-tools replace is temporary and should come out once crossplane/crossplane-tools#128 merges and tags. event.NewAPIRecorder is deprecated now too, so I've silenced it with //nolint:staticcheck in the controllers and template pending the new events API (crossplane/crossplane#7152).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant