This release backports #7030 to the 2.1 branch to fix one of the issues reported in #3423, where shared transitive dependencies could not be upgraded successfully. It also contains security updates to Crossplane's dependencies.

What's Changed

• chore(deps): update module github.com/quic-go/quic-go to v0.57.0 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/6978
• Backport #7030 to release-2.1 by @adamwg in https://github.com/crossplane/crossplane/pull/7054
• [release-2.1] Update sigstore dependencies to fix CVEs by @negz in https://github.com/crossplane/crossplane/pull/7064
• chore(deps): update module github.com/theupdateframework/go-tuf/v2 to v2.4.1 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7067
• chore(deps): update module github.com/go-chi/chi/v5 to v5.2.4 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7040
• [Backport release-2.1] fix(render): propagate root composite identity through nested XR trees by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/6974

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.1.3...v2.1.4