chore(deps): update module github.com/crossplane/crossplane to v1.17.2 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/crossplane/crossplane	v1.17.1 -> v1.17.2

GitHub Vulnerability Alerts

GHSA-7h65-4p22-39j6

A critical vulnerability was reported in the versions of golang that Crossplane depends on. Details of the golang vulnerability are included below. Crossplane does not directly use the vulnerable functions from the net/netip package, but the version of golang libraries, runtime, and build tools have still been updated as part of this security advisory nonetheless.

Critical Vulnerabilities
Vulnerability: CVE-2024-24790, golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
Description: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

Affected versions: 1.17.1,1.16.2,1.15.5

See screenshot for more details

Fixed versions: 1.17.2,1.16.3,1.15.6

Release notes:

• https://github.com/crossplane/crossplane/releases/tag/v1.17.2
• https://github.com/crossplane/crossplane/releases/tag/v1.16.3
• https://github.com/crossplane/crossplane/releases/tag/v1.15.6

---

github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

GHSA-7h65-4p22-39j6 / GO-2024-3219

More information

Details

github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

Severity

Unknown

References

• https://github.com/crossplane/crossplane/security/advisories/GHSA-7h65-4p22-39j6

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

GHSA-7h65-4p22-39j6 / GO-2024-3219

More information

Details

A critical vulnerability was reported in the versions of golang that Crossplane depends on. Details of the golang vulnerability are included below. Crossplane does not directly use the vulnerable functions from the net/netip package, but the version of golang libraries, runtime, and build tools have still been updated as part of this security advisory nonetheless.

Critical Vulnerabilities
Vulnerability: CVE-2024-24790, golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
Description: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

Affected versions: 1.17.1,1.16.2,1.15.5

See screenshot for more details

Fixed versions: 1.17.2,1.16.3,1.15.6

Release notes:

• https://github.com/crossplane/crossplane/releases/tag/v1.17.2
• https://github.com/crossplane/crossplane/releases/tag/v1.16.3
• https://github.com/crossplane/crossplane/releases/tag/v1.15.6

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/crossplane/crossplane/security/advisories/GHSA-7h65-4p22-39j6
• https://github.com/crossplane/crossplane

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

crossplane/crossplane (github.com/crossplane/crossplane)

v1.17.2

Compare Source

This is a patch release scoped to fixing issues reported by users of Crossplane v1.17. First, this patch release addresses the below published security advisory that affects the versions of golang that Crossplane depends on.

• GHSA-7h65-4p22-39j6

Thank you @​aditya-mayo for reporting this vulnerability! 🙇‍♂️

This release also addresses an issue (https://github.com/crossplane/crossplane/issues/5971) where users of v1.17 were not able to build or install Functions using v1 package metadata. Now that Functions have matured to v1, this will become much more pervasive throughout the Crossplane Functions ecosystem.

What's Changed

• [Backport release-1.17] Support building and installing Functions with v1 package metadata by @​github-actions in https://github.com/crossplane/crossplane/pull/5974
• [Backport release-1.17] Add contexts to RuntimeFunctionRunner by @​github-actions in https://github.com/crossplane/crossplane/pull/5997
• build: bump golang to 1.22.8 by @​jbw976 in https://github.com/crossplane/crossplane/pull/6027

Full Changelog: crossplane/crossplane@v1.17.1...v1.17.2

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.22.5 -> 1.23.3

[coveralls]

Pull Request Test Coverage Report for Build 11745329229

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 66.746%

---

Totals
Change from base Build 11745310853:	0.0%
Covered Lines:	560
Relevant Lines:	839

---

💛 - Coveralls