v1.20.14 is a patch release scoped to fixing security related issues in Crossplane's dependencies.
🎉 Highlights
- Distrust of compromised eMudhra intermediate CAs: Bumps the Go toolchain to
1.26.10(#7956), whosecrypto/x509rejects the compromised eMudhra intermediate certificates (CVE-2026-111943), and removes theAAA Certificate ServicesandemSign ECC Root CA - G3roots they chain to from the image's CA bundle (#7960, by moving to the latestdistroless/staticbase image). - Dependency security updates: Bumps
golang.org/x/nettov0.60.0(#7917) andgo.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttptov1.45.0(#7844), andcrossplane-runtimetov1.20.12(#7964), to pick up upstream CVE fixes.
What's Changed
- [Backport release-1.20] e2e: Use xpkg.upbound.io for private package pull test by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7869
- chore(deps): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 [security] (release-1.20) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7844
- chore(deps): update gcr.io/distroless/static docker digest to 5813399 (release-1.20) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7899
- chore(deps): update module golang.org/x/net to v0.60.0 [security] (release-1.20) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7917
- build(deps) [release 1.20]: bump Go to 1.26.9 [security] by @lsviben in https://github.com/crossplane/crossplane/pull/7924
- [release-1.20] build(deps): bump Go to 1.26.10 [security] by @lsviben in https://github.com/crossplane/crossplane/pull/7956
- [release-1.20] build(deps): bump distroless base image to distrust compromised eMudhra roots [security] by @lsviben in https://github.com/crossplane/crossplane/pull/7960
- [release-1.20] chore(deps): bump crossplane-runtime to v1.20.12 by @lsviben in https://github.com/crossplane/crossplane/pull/7964
Full Changelog: https://github.com/crossplane/crossplane/compare/v1.20.13...v1.20.14
