This is a patch release scoped to fixing issues reported by users of Crossplane v1.17 and fixing security related issues in Crossplane's dependencies.

Users of v1.18.x reported that they were no longer able to downgrade a Crossplane installation from v1.18.x to a previous v1.17.x version. This was fixed in #6157 and we expect downgrades from v1.18.2 to be working once again.

The way Usage objects are managed within a Composition has been updated in #6155 to prevent orphaned Usage objects from remaining in the control plane when a Composition that creates a Usage is updated. The change is described below:

• When the Usage itself deleted, the usage controller will wait for using resource before removing the finalizer, only if the Usage is part of a composite (i.e has crossplane.io/composite label).
• When a resource removed from a composition (i.e. decomposed), the composition controllers (both PT and function) will remove the composed resource labels before deleting the resource.
• This behavior is visually summarized in #5880 (comment)

What's Changed

• [Backport release-1.18] fix(environmentConfigs): revert to v1alpha1 as storageversion to fix rollback issues by @github-actions in #6168
• [Backport release-1.18] Usages: decomposed usages should be deleted properly by @github-actions in #6169
• chore(deps): update module golang.org/x/crypto to v0.31.0 [security] (release-1.18) by @crossplane-renovate in #6180

Full Changelog: v1.18.1...v1.18.2

This is a patch release scoped to fixing security related issues in Crossplane's dependencies, as well as improving E2E test reliability.

What's Changed

• [release-1.17] fix(e2e): install prior version to upgrade fixing lifecycle tests on older branches by @turkenh in #6093
• chore(deps): update module golang.org/x/crypto to v0.31.0 [security] (release-1.17) by @crossplane-renovate in #6179

Full Changelog: v1.17.3...v1.17.4

This is a patch release scoped to fixing security related issues in Crossplane's dependencies, as well as improving E2E test reliability.

What's Changed

• [release-1.16] fix(e2e): install prior version to upgrade fixing lifecycle tests on older branches by @turkenh in #6092
• chore(deps): update module golang.org/x/crypto to v0.31.0 [security] (release-1.16) by @crossplane-renovate in #6178

Full Changelog: v1.16.4...v1.16.5

What's Changed

• [Backport release-1.18] fix(crank): add function as input for extensions in cli for validate by @github-actions in #6091
• [release-1.18] fix(e2e): install prior version to upgrade fixing lifecycle tests on older branches by @turkenh in #6094
• [Backport release-1.18] fix downloading all schemas for validation by @github-actions in #6098
• chore(deps): update e2e-manifests (release-1.18) by @crossplane-renovate in #6108
• [Backport release-1.18] Wait for functions to become ready by @github-actions in #6145

Full Changelog: v1.18.0...v1.18.1

🚨 Breaking Changes

• While the EnvironmentConfig API was matured to Beta in this release, it's important to note that native support for EnvironmentConfig within a Composition was removed in #5938.
  • Users that enabled Alpha Composition Environments (--enable-environment-configs) and leveraged the native functionality (spec.environment.patches, spec.environment.environmentConfigs and *Environment patches), will have to migrate to Composition Functions to continue doing so.
  • We have built automated migration tooling to help with this migration/transition.
  • Further information, including migration instructions, can be found in the Crossplane docs.

❗ Notable Changes

A forthcoming change to Crossplane's default xpkg.upbound.io package registry may require you to authenticate to pull packages. In this release we've introduced a new ImageConfig API that makes it easier to configure registry credentials.

In order to minimize disruption to the community, we're making an exception to Crossplane's feature maturity process. We've introduced the new ImageConfig API as a beta feature that is enabled by default. We've also back ported the new ImageConfig API to the latest v1.16 and v1.17 patch releases.

🎉 Highlights

• Package Manager Improvements:
  • Support for package installation with digests.
  • Alpha feature for dependency version upgrades support. Need to be enabled via --enable-dependency-version-upgrades.
• New API: Package ImageConfig
  • Support for authenticating private registries.
  • Alpha feature for package image signature verification with cosign. Needs to be enabled via --enable-signature-verification.
• Promote EnvironmentConfig to v1beta1. See the Breaking Changes above.
• CLI improvements:
  • Support for converting to function-environment-configs.
  • Support for passing credentials to functions in render function.
  • beta validate improvements that enable the validation of more built-in Crossplane types like Compositions, as well as validate the inputs to each Functions in the pipeline.

Release MVP

We'd like to thank @cychiang for their multiple contributions within this release. Of particular note, they implemented #5976 which enabled passing credentials to functions from the render command. We are also looking forward to including their contribution from #5963 in the next milestone. Thanks @cychiang!! 🙇‍♂️

📖 Full Changelog

• chore(deps): bump crossplane-runtime to v1.18.0-rc.0 by @phisco in #5896
• chore: add 1.17 release branch to renovate by @phisco in #5898
• ci: docker login to right registry when promoting by @phisco in #5899
• Add secrets.crossplane.io grant rules to RBAC manager roles, even though the feature is alpha. by @luxas in #5884
• ci: --push on promote by @phisco in #5901
• Omit docker login registry arg when promoting tag in Docker Hub by @negz in #5907
• fix: ensure x-kubernetes-preserve-unknown-fields is copied from xrd to crd spec by @vibe in #5908
• docs: changing gympass adopters to wellhub company by @caiofralmeida in #5887
• chore: drop 1.14 and update 1.17 date from release table by @phisco in #5919
• Code updates after renaming master → main by @jeanduplessis in #5930
• Update e2e tests by adding a description for features.New calls by @jeanduplessis in #5931
• chore(deps): update actions/checkout digest to 692973e (main) by @crossplane-renovate in #5935
• Make composition revision numbers mutable by @negz in #5939
• fix(ga): remove beta for CompositionModePipeline by @haarchri in #5948
• Fix "Missing node in tree error" after updating a package source by @jdillet in #5946
• Retry on conflict during CRD dry-run updates in XRD validation webhook by @ulucinar in #5868
• Update ADOPTERS.md by @DE-Wizard in #5958
• feat(pkg-mgr): Support package installation with digests by @ezgidemirel in #5965
• Support building and installing Functions with v1 package metadata by @negz in #5972
• fix(pkg-mgr): Fix improper constraint error for digests by @ezgidemirel in #5973
• feat: support pass credentials to functions in render function by @cychiang in #5976
• fix(Earthfile): set the correct timestamps when building the go binaries by @tampakrap in #5786
• feat(Earthfile): Add checksums and tarballs for crank by @tampakrap in #5779
• Add Jove to ADOPTERS.md by @jbw976 in #5980
• feat: make package installation concurrency configurable by @jake-ciolek in #5968
• Add contexts to RuntimeFunctionRunner by @bobh66 in #5996
• Reduce crank and crossplane binary size by @Moulick in #5987
• Add one pager for package ImageConfig API proposal by @turkenh in #5993
• feat(crank): beta validate, get crossplane schemas, extract function pipeline step input by @haarchri in #5890
• Authentication with pull secrets via ImageConfig API by @turkenh in #6000
• Promote EnvironmentConfig to v1beta1, but remove native support by @negz in #5938
• Added the options to define revisionHistoryLimit for Crossplane and RBAC manager by @pierluigilenoci in #6013
• feat(pkg-mgr): Support dependency version upgrades by @ezgidemirel in #6017
• build: bump golang to 1.22.8 by @jbw976 in #6024
• feat(Compositions): drop spec.environmentConfigRefs by @phisco in #6029
• test(e2e): Update test packages and add more tests to dependency update by @ezgidemirel in #6023
• docs: update contributing guide with new contributor getting started info by @jbw976 in #6015
• feat(crank): convert supporting function-environment-configs by @phisco in #6016
• Package signature verification with Cosign via ImageConfig API by @turkenh in #6022
• chore(deps): update actions/create-github-app-token digest to 5d869da (main) by @crossplane-renovate in #5936
• chore(deps): update actions/upload-artifact digest to b4b15b8 (main) by @crossplane-renovate in #5941
• chore(deps): update codecov/codecov-action digest to b9fd7d1 (main) by @crossplane-renovate in #5942
• chore(deps): update docker/login-action digest to 9780b0c (main) by @crossplane-renovate in #5944
• [Backport release-1.18] fix(crank): convert pipeline-composition skip if no environment defined at all by @github-actions in #6034
• [Backport release-1.18] feat(pkg-mgr): Add condition to lock object by @github-actions in #6035
• [Backport release-1.18] feat(xfn): Consider composite ready state in function response by @github-actions in #6039
• [release-1.18] Bump runtime v1.18.0 rc.1 by @turkenh in #6037
• fix(deps): update module github.com/docker/docker to v27.1.1+incompatible [security] (release-1.18) by @crossplane-renovate in #6050
• chore(deps): update module github.com/open-policy-agent/opa to v0.68.0 [security] (release-1.18) by @crossplane-renovate in #6049
• [Backport release-1.18] fix(crank): beta validate properly pulling crossplane image by @github-actions in #6061
• [Backport release-1.18] Have the resolver (Lock) controller watch package revisions by @github-actions in #6065
• chore(deps): update module github.com/golang-jw...

Notable Changes

A forthcoming change to Crossplane's default http://xpkg.upbound.io/ package registry may require you to authenticate to pull packages. In this release we've introduced a new ImageConfig API that makes it easier to configure registry credentials.

In order to minimize disruption to the community, we're making an exception to Crossplane's feature maturity process. We introduced the new ImageConfig API in Crossplane v1.18 as a beta feature that is enabled by default. We've also back ported the new ImageConfig API to this patch release, to make it available without needing to upgrade to v1.18.

What's Changed

• fix(deps): update module github.com/docker/docker to v27 [security] (release-1.17) by @crossplane-renovate in #6048
• [release-1.17] Backport ImageConfig API for auth support by @turkenh in #6062
• chore(deps): update module github.com/golang-jwt/jwt/v4 to v4.5.1 [security] (release-1.17) by @crossplane-renovate in #6069

Full Changelog: v1.17.2...v1.17.3

Notable Changes

A forthcoming change to Crossplane's default http://xpkg.upbound.io/ package registry may require you to authenticate to pull packages. In this release we've introduced a new ImageConfig API that makes it easier to configure registry credentials.

In order to minimize disruption to the community, we're making an exception to Crossplane's feature maturity process. We introduced the new ImageConfig API in Crossplane v1.18 as a beta feature that is enabled by default. We've also back ported the new ImageConfig API to this patch release, to make it available without needing to upgrade to v1.18.

What's Changed

• [release-1.16] Backport ImageConfig API for auth support by @turkenh in #6052
• chore(deps): update module github.com/golang-jwt/jwt/v4 to v4.5.1 [security] (release-1.16) by @crossplane-renovate in #6068

Full Changelog: v1.16.3...v1.16.4

❗ Important

Crossplane version v1.18.0-rc.1 is a release candidate intended to collect input from the community and offer users an opportunity to experiment with Crossplane in non-production environments before the official release of version v1.18.0.

To install Crossplane with this release:

helm repo add crossplane-stable https://charts.crossplane.io/stable --force-update
helm install crossplane --namespace crossplane-system --create-namespace crossplane-stable/crossplane --devel

To install the Crossplane CLI with this release:

curl -sL https://raw.githubusercontent.com/crossplane/crossplane/v1.18.0-rc.1/install.sh | XP_VERSION=v1.18.0-rc.1 sh

🚨 Breaking Changes

• Native support for EnvironmentConfig removed in #5938
  • Migration instructions in https://github.com/crossplane-contrib/function-environment-configs?tab=readme-ov-file#migration-from-native-composition-environment

🎉 Highlights

• Package Manager Improvements:
  • Support for package installation with digests.
  • Alpha feature for dependency version upgrades support. Need to be enabled via --enable-dependency-version-upgrades.
• New API: Package ImageConfig
  • Support for authenticating private registries.
  • Alpha feature for package image signature verification with cosign. Needs to be enabled via --enable-signature-verification.
• Promote EnvironmentConfig to v1beta1. See the Breaking Changes above.
• CLI improvements:
  • Support for converting to function-environment-configs.
  • Support for passing credentials to functions in render function.
  • beta validate improvements.

📖 Full Changelog

• chore(deps): bump crossplane-runtime to v1.18.0-rc.0 by @phisco in #5896
• chore: add 1.17 release branch to renovate by @phisco in #5898
• ci: docker login to right registry when promoting by @phisco in #5899
• Add secrets.crossplane.io grant rules to RBAC manager roles, even though the feature is alpha. by @luxas in #5884
• ci: --push on promote by @phisco in #5901
• Omit docker login registry arg when promoting tag in Docker Hub by @negz in #5907
• fix: ensure x-kubernetes-preserve-unknown-fields is copied from xrd to crd spec by @vibe in #5908
• docs: changing gympass adopters to wellhub company by @caiofralmeida in #5887
• chore: drop 1.14 and update 1.17 date from release table by @phisco in #5919
• Code updates after renaming master → main by @jeanduplessis in #5930
• Update e2e tests by adding a description for features.New calls by @jeanduplessis in #5931
• chore(deps): update actions/checkout digest to 692973e (main) by @crossplane-renovate in #5935
• Make composition revision numbers mutable by @negz in #5939
• fix(ga): remove beta for CompositionModePipeline by @haarchri in #5948
• Fix "Missing node in tree error" after updating a package source by @jdillet in #5946
• Retry on conflict during CRD dry-run updates in XRD validation webhook by @ulucinar in #5868
• Update ADOPTERS.md by @DE-Wizard in #5958
• feat(pkg-mgr): Support package installation with digests by @ezgidemirel in #5965
• Support building and installing Functions with v1 package metadata by @negz in #5972
• fix(pkg-mgr): Fix improper constraint error for digests by @ezgidemirel in #5973
• feat: support pass credentials to functions in render function by @cychiang in #5976
• fix(Earthfile): set the correct timestamps when building the go binaries by @tampakrap in #5786
• feat(Earthfile): Add checksums and tarballs for crank by @tampakrap in #5779
• Add Jove to ADOPTERS.md by @jbw976 in #5980
• feat: make package installation concurrency configurable by @jake-ciolek in #5968
• Add contexts to RuntimeFunctionRunner by @bobh66 in #5996
• Reduce crank and crossplane binary size by @Moulick in #5987
• Add one pager for package ImageConfig API proposal by @turkenh in #5993
• feat(crank): beta validate, get crossplane schemas, extract function pipeline step input by @haarchri in #5890
• Authentication with pull secrets via ImageConfig API by @turkenh in #6000
• Promote EnvironmentConfig to v1beta1, but remove native support by @negz in #5938
• Added the options to define revisionHistoryLimit for Crossplane and RBAC manager by @pierluigilenoci in #6013
• feat(pkg-mgr): Support dependency version upgrades by @ezgidemirel in #6017
• build: bump golang to 1.22.8 by @jbw976 in #6024
• feat(Compositions): drop spec.environmentConfigRefs by @phisco in #6029
• test(e2e): Update test packages and add more tests to dependency update by @ezgidemirel in #6023
• docs: update contributing guide with new contributor getting started info by @jbw976 in #6015
• feat(crank): convert supporting function-environment-configs by @phisco in #6016
• Package signature verification with Cosign via ImageConfig API by @turkenh in #6022
• chore(deps): update actions/create-github-app-token digest to 5d869da (main) by @crossplane-renovate in #5936
• chore(deps): update actions/upload-artifact digest to b4b15b8 (main) by @crossplane-renovate in #5941
• chore(deps): update codecov/codecov-action digest to b9fd7d1 (main) by @crossplane-renovate in #5942
• chore(deps): update docker/login-action digest to 9780b0c (main) by @crossplane-renovate in #5944
• [Backport release-1.18] fix(crank): convert pipeline-composition skip if no environment defined at all by @github-actions in #6034
• [Backport release-1.18] feat(pkg-mgr): Add condition to lock object by @github-actions in #6035
• [Backport release-1.18] feat(xfn): Consider composite ready state in function response by @github-actions in #6039
• [release-1.18] Bump runtime v1.18.0 rc.1 by @turkenh in #6037

New Contributors

• @luxas made their first contribution in #5884
• @vibe made their first contribution in #5908
• @jdillet made their first contribution in #5946
• @DE-Wizard made their first contribution in #5958
• @jake-ciolek made their first contribution in #5968
• @Moulick made their first contribution in #5987

Full Changelog: v1.17.0...v1.18.0-rc.1

This is a patch release scoped to fixing issues reported by users of Crossplane v1.17. First, this patch release addresses the below published security advisory that affects the versions of golang that Crossplane depends on.

• GHSA-7h65-4p22-39j6

Thank you @aditya-mayo for reporting this vulnerability! 🙇‍♂️

This release also addresses an issue (#5971) where users of v1.17 were not able to build or install Functions using v1 package metadata. Now that Functions have matured to v1, this will become much more pervasive throughout the Crossplane Functions ecosystem.

What's Changed

• [Backport release-1.17] Support building and installing Functions with v1 package metadata by @github-actions in #5974
• [Backport release-1.17] Add contexts to RuntimeFunctionRunner by @github-actions in #5997
• build: bump golang to 1.22.8 by @jbw976 in #6027

Full Changelog: v1.17.1...v1.17.2

This is a patch release scoped to fixing issues reported by users of Crossplane v1.16. Specifically, this patch release addresses the below published security advisory that affects the versions of golang that Crossplane depends on.

• GHSA-7h65-4p22-39j6

Thank you @aditya-mayo for reporting this vulnerability! 🙇‍♂️

What's Changed

• build: bump golang to 1.21.13, 1.22.8 by @jbw976 in #6025

Full Changelog: v1.16.2...v1.16.3