Crossplane
v2.3.5Orchestration & ManagementA maintenance release corrects binary checksum handling and the `Usage` index key, alongside updates to security-sensitive and build dependencies. The dependency changes require the new release, with no operator configuration migration stated.
Action needed (4)
securityThe
golang.dependency updateorg/x/mod The release updates
golang.as a security-related dependency change.org/x/mod securityThe
github.dependency, updated tocom/sigstore/sigstore-go v1.2. 1 The release updates
github.tocom/sigstore/sigstore-go v1.as a security-related dependency change.2. 1 securityThe
github.dependency, updated tocom/google/cel-go v0.30. 0 The release updates
github.tocom/google/cel-go v0.as a security-related dependency change.30. 0 securityThe
crossplane-runtimedependency, bumped tov2.3. 4 The release bumps
crossplane-runtimetov2.as a security-related dependency change.3. 4
All 4 other recorded changesfixes 2 · value changes 2
fixes (2)
- **Correct
crankchecksums foramd64binaries (#7666, originally #7660):** The published.files forsha256 linux_amd64binaries had not matched the binaries themselves sincev2., so any install script or Dockerfile that verified the2. 0 amd64checksum failed. Checksums are now calculated after Nix strips the binary, and the release workflow verifies them before uploading. Fixes #7467. - **Unambiguous
Usageindex key (#7630, originally #7508):** The deletion protection webhook indexedUsageresources by joining API group, kind, name, and namespace with.. Since groups and names can contain.themselves, two distinct resources could collapse to the same key, causing the webhook to block a deletion that should have been allowed. The key now joins with/, which cannot appear in any of those fields.
value changes (2)
- [Backport release-2.3] build: point docker-client at docker_29 in the nix overlay
- [Backport release-2.3] build: bump pinned nixpkgs channel from nixos-25.11 to nixos-26.05
A weekly email arrives when a release needs action. Like the security patches in this release.