RATATOSKRATATOSK
Sign in

Crossplane

v2.2.5Orchestration & Management
Aug 21, 2026

ACTION 1OTHER 2

A maintenance release corrects binary checksum generation and deletion-protection indexing, and updates dependencies for upstream CVE fixes. The changes affect release verification, webhook deletion checks, and the dependency set shipped with the release.

Action needed (1)

  • securityDependency security updates

    The release updates cel-go, golang.org/x/mod, sigstore-go, and go-git, along with a combined set of vulnerable dependency updates, to pick up upstream CVE fixes. It also bumps crossplane-runtime to v2.2.4, which carries its own security dependency updates.

All 2 other recorded changesfixes 2

fixes (2)

  • * **Correct crank checksums for amd64 binaries (#7665, originally #7660):** The published .sha256 files for linux_amd64 binaries had not matched the binaries themselves since v2.2.0, so any install script or Dockerfile that verified the amd64 checksum failed. Checksums are now calculated after Nix strips the binary, and the release workflow verifies them before uploading. Fixes #7467.
  • * **Unambiguous Usage index key (#7629, originally #7508):** The deletion protection webhook indexed Usage resources by joining API group, kind, name, and namespace with .. Since groups and names can contain . themselves, two distinct resources could collapse to the same key, causing the webhook to block a deletion that should have been allowed. The key now joins with /, which cannot appear in any of those fields.
Add Crossplane to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Crossplane releases →