[Bug]: Update to v2.6.0 does not become healthy, rollback not possible

[jwefers]

Is there an existing issue for this?

• I have searched the existing issues

Affected Resource(s)

provider-family-azure v2.6.0
provider-azure-* v2.6.0

Resource MRs required to reproduce the bug

apiVersion: pkg.crossplane.io/v1
kind: Provider
metadata:
  name: provider-family-azure
  annotations:
    argocd.argoproj.io/sync-wave: "1" # before other azure providers!
spec:
  package: xpkg.upbound.io/upbound/provider-family-azure:v2.5.3
  runtimeConfigRef:
    name: provider-family-azure-runtime-config
---
apiVersion: pkg.crossplane.io/v1
kind: Provider
metadata:
  name: provider-azure-keyvault
  annotations:
    argocd.argoproj.io/sync-wave: "2"
spec:
  package: xpkg.upbound.io/upbound/provider-azure-keyvault:v2.5.3
  runtimeConfigRef:
    name: provider-family-azure-runtime-config
---
apiVersion: pkg.crossplane.io/v1
kind: Provider
metadata:
  name: provider-azure-managedidentity
  annotations:
    argocd.argoproj.io/sync-wave: "2"
spec:
  package: xpkg.upbound.io/upbound/provider-azure-managedidentity:v2.5.3
  runtimeConfigRef:
    name: provider-family-azure-runtime-config
---
apiVersion: pkg.crossplane.io/v1
kind: Provider
metadata:
  name: provider-azure-authorization
  annotations:
    argocd.argoproj.io/sync-wave: "2"
spec:
  package: xpkg.upbound.io/upbound/provider-azure-authorization:v2.5.3
  runtimeConfigRef:
    name: provider-family-azure-runtime-config

Steps to Reproduce

• Have provider-family-azure and some dependent providers installed, in our case authorization, keyvault, managedidentity installed in v2.5.3
• bump all to v2.6.0
• see them all become unhealthy
• revert back to v2.5.3
• still unhealthy

What happened?

bumping all providers simultaneously to v2.6.0 resulted in below error message on all of them. Reverting to v2.5.3 does not resolve the condition. We are stuck now:

status:
  conditions:
    - lastTransitionTime: '2026-07-22T15:47:39Z'
      message: >-
        Package revision health is "False" with message: cannot resolve package
        dependencies: cannot initialize dependency graph from the packages in
        the lock: node xpkg.upbound.io/upbound/provider-family-azure already
        exists
      observedGeneration: 6
      reason: UnhealthyPackageRevision
      status: 'False'
      type: Healthy

Relevant Error Output Snippet

Crossplane Version

2.3.3

Provider Version

2.6.0

Kubernetes Version

No response

Kubernetes Distribution

AKS

Additional Info

No response

[jonasz-lasut]

Hi @jwefers thank you for opening the issue. Could you share your Lock?
kubectl get lock lock -oyaml

[jonasz-lasut]

Overall it would be better to track it under crossplane core, there's already an issue related to this locking behavior - crossplane/crossplane#7454

[jonasz-lasut]

Could you also check if you have a pkg called upbound-provider-family-azure that could be created by the pkg manager when your provider-family-azure gets updated to 2.6.0 and the rest of the pkgs on version 2.5.3 rely on family provider in version 2.5.3?

[jwefers]

thank you so much for the reply, i'll deliver tomorrow, done for today.

[jwefers]

yeah that linked bug is probably exactly what happened. child provider raced the family provider on the version bump. Will follow up tomorrow

[jonasz-lasut]

I'll close this issue in favor of upstream crossplane/crossplane#7454