Summary
This release includes security fixes, new AWS resources, bug fixes, and dependency updates.
Security Fixes
- Remediated critical vulnerabilities in golang.org/x/crypto (GO-2026-5006, GO-2026-5023, GO-2026-5017, GO-2026-5020, GO-2026-5005, GO-2026-5021, GO-2026-5019, GO-2026-5013, GO-2026-5018, GO-2026-5033, GO-2026-5014, GO-2026-5015, GO-2026-5016)
- Remediated vulnerabilities in golang.org/x/net (GO-2026-5026, GO-2026-4559, GO-2026-4918, GO-2026-5028, GO-2026-5025, GO-2026-5027, GO-2026-5029, GO-2026-5030)
- Remediated vulnerability in golang.org/x/sys (GO-2026-5024)
- Updated google.golang.org/grpc for security fixes
- Updated AWS SDK dependencies for security patches
- Updated go.opentelemetry.io/otel to v1.41.0
New Resources
- Capability.eks - EKS cluster capability management
- VPCConnection.kafka - MSK VPC connection support
- BucketAbac.s3 - S3 Bucket Attribute-Based Access Control
- VectorBucket.s3 - S3 vector database support
- VPCIPv6CidrBlockAssociation.ec2 - IPv6 CIDR block management for VPCs
- MultiRegionCluster.memorydb - MemoryDB multi-region cluster support
- MalwareProtectionPlan.guardduty - GuardDuty malware protection
- DBCluster.timestreaminfluxdb - Timestream for InfluxDB database cluster
- Monitor, Probe.networkmonitor - Network monitoring resources
- CapacityBlockReservation.ec2 - EC2 capacity block reservations
Enhancements
- Added ProviderConfig ReconciliationPolicy API for configurable exponential failure rate limiting
- Added reference fields for kmsKeyArn in Table.dynamodb
- Bumped Upjet to support Terraform Plugin Framework resources with Identity
- Updated to Crossplane Runtime v2.2.0 and controller-runtime v0.23.3
- Added API conversion roundtrip tests
- Bumped storage controller versions for multi-version CRDs
Bug Fixes
- Fixed update loop for route53.Record resource
- Fixed update loop for Table.dynamodb by adding CustomDiff
- Fixed airflowConfigurationOptions parameter in Environment.mwaa
- Fixed Function.lambda reconciliation loop when CodeSha256 is omitted
- Fixed ECS TaskDefinition cold-start observe with managementPolicies
- Fixed clustermode field backport for v1beta1 ReplicationGroup.elasticache
- Fixed data race on managed resource status
Dependency Updates
- Go: v1.25.9 → v1.25.11
- Alpine base image: v3.23.4
- Crossplane: v2.2.1
- Various GitHub Actions updates