chore(deps): update dependency crossplane/crossplane to v2.4.2

[renovate]

This PR contains the following updates:

Package	Update	Change
crossplane/crossplane	patch	v2.4.0 → v2.4.2

---

Release Notes

crossplane/crossplane (crossplane/crossplane)

v2.4.2

Compare Source

v2.4.2 is a patch release scoped to fixing issues reported by users of Crossplane v2.4 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights

• Fixed a bug where ownership of ServiceAccounts was not correctly transferred to newly active package revisions (#​7838). Fixed in #​7839 and backported in #​7852.

What's Changed

• [Backport release-2.4] fix: demote old revision controller ownerReference for SA by @​github-actions[bot] in #​7852
• chore(deps): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.45.0 [security] (release-2.4) by @​crossplane-renovate[bot] in #​7847
• [Backport release-2.4] fix: fail closed when a claim cannot list its XRD by @​github-actions[bot] in #​7862
• Bump crossplane-runtime dependency to v2.4.2 by @​adamwg in #​7863

Full Changelog: crossplane/crossplane@v2.4.1...v2.4.2

v2.4.1

Compare Source

v2.4.1 is a patch release scoped to fixing issues reported by users of Crossplane v2.4 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights

• Package revisions now take control of established objects from the revision they replace: An outgoing package revision could fail to relinquish control of the package's CRDs, leaving the incoming revision permanently unhealthy with cannot establish control of object. The provider's pod would never be created, so that provider could do no work without manual intervention by someone either deleting the stale revision or editing the CRD's owner reference by hand. Package revisions now directly take control from the revision they replace, so the hand-off succeeds without any intervention. Backported in #​7821, originally fixed in #​7733.
• Dependency security updates: Bumps the Go toolchain to 1.26.7 (#​7803), google.golang.org/grpc to v1.83.2 (#​7800, #​7826), and golang.org/x/crypto to v0.56.0 (#​7810) to pick up upstream CVE fixes — including the gRPC advisory GHSA-2v4p-qf9q-27wj. Also bumps github.com/crossplane/crossplane/apis/v2 to v2.4.0 (#​7780) and refreshes the lock file (#​7779).

What's Changed

• chore(deps): lock file maintenance (release-2.4) by @​crossplane-renovate[bot] in #​7779
• fix(deps): update module github.com/crossplane/crossplane/apis/v2 to v2.4.0 (release-2.4) by @​phisco in #​7780
• fix(deps): update module google.golang.org/grpc to v1.83.1 [security] (release-2.4) by @​crossplane-renovate[bot] in #​7800
• [Backport release-2.4] Bump go to 1.26 by @​github-actions[bot] in #​7803
• chore(deps): update module golang.org/x/crypto to v0.56.0 [security] (release-2.4) by @​crossplane-renovate[bot] in #​7810
• [Backport release-2.4] fix(pkg): take control of established objects from replaced revisions by @​github-actions[bot] in #​7821
• fix(deps): update module google.golang.org/grpc to v1.83.2 [security] (release-2.4) by @​crossplane-renovate[bot] in #​7826

Full Changelog: crossplane/crossplane@v2.4.0...v2.4.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.