fix(deps): update module github.com/crossplane/crossplane/apis/v2 to v2.3.4 (main)

[crossplane-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/crossplane/crossplane/apis/v2	v2.3.3 → v2.3.4

---

Release Notes

crossplane/crossplane (github.com/crossplane/crossplane/apis/v2)

v2.3.4

Compare Source

v2.3.4 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights

• Fixed repeated owner updates for composed Usages (#​7597, originally #​7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so spec.by ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.
• crossplane render fixes (#​7599, originally #​7544): render no longer overwrites the input XR's UID when one is already set, and now validates observed resources before proceeding with the render.
• Vulnerability-scannable images (#​7574): Container images are now built with buildGoModule (replacing gomod2nix), so published images can be scanned by standard vulnerability tooling.
• Dependency security updates: Bumps grpc / golang.org/x/net / golang.org/x/text (#​7618, #​7614, #​7615) and the sigstore stack — cosign (#​7559), rekor (#​7560), timestamp-authority (#​7570), sigstore-go (#​7583) — to pick up upstream CVE fixes. See ## What's Changed for the full list.

What's Changed

• chore(deps): update module github.com/sigstore/rekor to v1.5.2 [security] (release-2.3) by @​crossplane-renovate[bot] in #​7560
• chore(deps): update module github.com/sigstore/cosign/v3 to v3.0.6 [security] (release-2.3) by @​crossplane-renovate[bot] in #​7559
• chore(deps): update module github.com/sigstore/timestamp-authority/v2 to v2.1.0 [security] (release-2.3) by @​crossplane-renovate[bot] in #​7570
• [Backport release-2.3] build(nix): build with buildGoModule so images are vulnerability-scannable by @​phisco in #​7574
• chore(deps): update module github.com/sigstore/sigstore-go to v1.2.0 [security] (release-2.3) by @​crossplane-renovate[bot] in #​7583
• fix(deps): combined security bumps (grpc, x/net, x/text) (release-2.3) by @​lsviben in #​7618
• [Backport release-2.3] fix: avoid repeated owner updates for composed Usages by @​github-actions[bot] in #​7597
• [Backport release-2.3] render: Don't overwrite the input XR's UID if it has one and validate observed resources by @​github-actions[bot] in #​7599
• chore(deps): update module golang.org/x/text to v0.39.0 [security] (release-2.3) by @​crossplane-renovate[bot] in #​7615
• chore(deps): update module golang.org/x/net to v0.56.0 [security] (release-2.3) by @​crossplane-renovate[bot] in #​7614

Full Changelog: crossplane/crossplane@v2.3.3...v2.3.4

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[crossplane-renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
golang.org/x/text	v0.38.0 -> v0.39.0
golang.org/x/tools	v0.46.0 -> v0.47.0