Crossplane v2.2.4

This patch release focuses on stabilizing the Usage controller to prevent reconciliation loops and significantly improving the security posture of the project through scannable images and critical dependency updates.

Prevent infinite reconciliation loops for composed Usages — This fixes a critical loop where Composition reconciliations were being triggered unnecessarily. By correctly identifying owner references, Crossplane prevents the XR circuit breaker from tripping, ensuring stable infrastructure provisioning and reducing API pressure on your Kubernetes cluster.

Enable vulnerability scanning for container images — Users can now reliably use automated container scanning tools (like Trivy or Grype) to audit Crossplane images. This transition ensures that platform teams can meet internal compliance and security requirements by providing transparency into the Go modules used within the distribution.

Security patches for gRPC and sigstore dependencies — This update mitigates known vulnerabilities in core networking and signing libraries. By patching gRPC and the sigstore stack, the control plane remains resilient against upstream exploits, maintaining the integrity of your infrastructure orchestration.