v2.3.4 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights

• Fixed repeated owner updates for composed Usages (#7597, originally #7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so spec.by ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.
• crossplane render fixes (#7599, originally #7544): render no longer overwrites the input XR's UID when one is already set, and now validates observed resources before proceeding with the render.
• Vulnerability-scannable images (#7574): Container images are now built with buildGoModule (replacing gomod2nix), so published images can be scanned by standard vulnerability tooling.
• Dependency security updates: Bumps grpc / golang.org/x/net / golang.org/x/text (#7618, #7614, #7615) and the sigstore stack — cosign (#7559), rekor (#7560), timestamp-authority (#7570), sigstore-go (#7583) — to pick up upstream CVE fixes. See ## What's Changed for the full list.

What's Changed

• chore(deps): update module github.com/sigstore/rekor to v1.5.2 [security] (release-2.3) by @crossplane-renovate[bot] in #7560
• chore(deps): update module github.com/sigstore/cosign/v3 to v3.0.6 [security] (release-2.3) by @crossplane-renovate[bot] in #7559
• chore(deps): update module github.com/sigstore/timestamp-authority/v2 to v2.1.0 [security] (release-2.3) by @crossplane-renovate[bot] in #7570
• [Backport release-2.3] build(nix): build with buildGoModule so images are vulnerability-scannable by @phisco in #7574
• chore(deps): update module github.com/sigstore/sigstore-go to v1.2.0 [security] (release-2.3) by @crossplane-renovate[bot] in #7583
• fix(deps): combined security bumps (grpc, x/net, x/text) (release-2.3) by @lsviben in #7618
• [Backport release-2.3] fix: avoid repeated owner updates for composed Usages by @github-actions[bot] in #7597
• [Backport release-2.3] render: Don't overwrite the input XR's UID if it has one and validate observed resources by @github-actions[bot] in #7599
• chore(deps): update module golang.org/x/text to v0.39.0 [security] (release-2.3) by @crossplane-renovate[bot] in #7615
• chore(deps): update module golang.org/x/net to v0.56.0 [security] (release-2.3) by @crossplane-renovate[bot] in #7614

Full Changelog: v2.3.3...v2.3.4