Cut v1.19.3-up.2 on 2026-04-22

[lsviben]

Note: This is a security-only bump of the -up.K suffix on top of the existing v1.19.3-up.1. Upstream Crossplane v1.19.3 is unchanged — the fork sync from upstream was done when v1.19.3-up.1 was cut (Feb 2026) and the release-1.19 branch already contains it. The first checkbox (sync) is therefore not applicable.

This issue can be closed when we have completed the following steps (in order).
Please ensure all artifacts (PRs, workflow runs, Tweets, etc) are linked from
this issue for posterity. Assuming v1.19.3-up.2 is being cut, after upstream
crossplane/crossplane v1.19.3 has been released
according to the declared schedule, you should have:

• Synced the release-1.19 release branch — already done for v1.19.3-up.1 (Feb 2026).
• Tagged upbound/crossplane v1.19.3-up.2 from the release-1.19 branch by:
  • Running the Tag workflow on the release-1.19 branch with the proper release version, v1.19.3-up.2. Use Release v1.19.3-up.2 as message (FYI: the format suggested is only for consistency, there is no actual dependency on it).
  • Running the CI workflow on the release-1.19 branch to build and publish the latest tagged artifacts.
  • Confirm the image has been successfully published using: docker buildx imagetools inspect docker.io/upbound/crossplane:v1.19.3-up.2
• Created and merged a PR for upbound/universal-crossplane to either the main branch, if cutting a patch for the latest supported release, taking care to label it backport release-1.19, or directly to the release-1.19 branch, if cutting a patch for an older supported release. With the following changes:
  • Update any reference to the old latest release to v1.19.3-up.2, such as CROSSPLANE_TAG and CROSSPLANE_COMMIT in the Makefile.
  • Run make generate to import any changes in the upstream Helm chart.
• Cut UXP v1.19.3-up.2 release from the release-1.19 branch by:
  • Running the Tag workflow on the release-1.19 branch with the proper release version, v1.19.3-up.2. Use Release v1.19.3-up.2 as message (FYI: the format suggested is only for consistency, there is no actual dependency on it).
  • Running the CI workflow on the release-1.19 branch to build and publish the latest tagged artifacts.
  • Verify that the tagged build version exists on the releases.upbound.io build channel, e.g. build/release-1.19/v1.19.3-up.2/...
• Verify the produced helm chart available in the build channnel at build/release-1.19/v1.19.3-up.2/charts by doing some sanity checks:
  • Installs on a cluster properly with helm -n upbound-system upgrade --install universal-crossplane <path-to-chart.tgz> --create-namespace.
  • Uses the correct image versions of upbound/crossplane, e.g. kubectl -n upbound-system get pods -o yaml | grep image:
  • Verify at least one of the above reference platforms works end to end by configuring and creating a claim, e.g. using https://github.com/upbound/platform-ref-gcp/blob/main/examples/cluster-claim.yaml:
    • https://marketplace.upbound.io/configurations/upbound/platform-ref-aws
    • https://marketplace.upbound.io/configurations/upbound/platform-ref-azure
    • https://marketplace.upbound.io/configurations/upbound/platform-ref-gcp
  • Upgrading from the latest supported version works, for example run:
    • create a kind cluster: kind create cluster
    • install the current stable version: up uxp install
    • install one of the above reference platforms
    • upgrade to this new version as above: helm -n upbound-system upgrade --install universal-crossplane <path-to-chart.tgz> --create-namespace
• Run the Promote workflow from the release-1.19 branch, to promote v1.19.3-up.2 to stable, here you should find universal-crossplane-1.19.3-up.2.tgz. Verify everything is correctly working by running up uxp install against an empty Kubernetes cluster, e.g. kind create cluster, which should result in an healthy UXP installation with expected image versions.
• Drafted, validated with the rest of the team and then published well authored release notes for UXP v1.19.3-up.2. See the previous release for an example, these should at least:
  • enumerate relevant updates that were merged in u/xp and u/uxp.
  • mention the xp/xp version it refers to.
  • list new contributors to u/uxp.
  • have the links to the full changelog of u/xp and u/uxp.
• Ensured that users have been notified of the release on all communitcation channels:
  • Slack: crossposting on Crossplane's Slack workspace channels #announcements, #upbound and #squad-crossplane on Upbound's Slack.
  • Twitter: ask #marketing on Upbound's Slack to do so.

[lsviben]

Pre-step — Security bumps PR opened against release-1.19 in upbound/crossplane: https://github.com/upbound/crossplane/pull/219

This needs to merge (and a new v1.19.3-up.2 tag cut) before we bump CROSSPLANE_TAG in this repo.