# Crossplane: what changed from 1 to 2

- Product: Crossplane (https://whatsnew.fyi/product/crossplane)
- Vendor: CNCF
- Range: changelog entries numbered after v1.20.12 up to and including v2.4.0, stable releases only
- Entries below: 10 releases (newest first)
- Resolved: 1 is v1.20.12 and 2 is v2.4.0, the newest stable release of each major we track
- Carrying security changes: 9 · CVEs mentioned: 0 · Mentioning breaking changes: 1 · Removing or deprecating something: 1
- Page: https://whatsnew.fyi/product/crossplane/compare/1...2

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (69 changes, grouped by kind)

### Added

#### v2.4.0 (2026-08-20)

- Watch required resources and reconcile XRs immediately when they change
- Scale to zero for safe-start capable providers
- Release artifacts that are vulnerability scannable

### Changed

#### v2.2.5 (2026-08-21)

- Bump `crossplane-runtime` to v2.2.4 for additional security dependency updates

#### v2.3.5 (2026-08-21)

- Bump crossplane-runtime to v2.3.4 which carries security dependency updates

#### v2.4.0 (2026-08-20)

- Package revision names are now derived from both the package digest and the package's metadata.generation, so any change to a package's spec produces a new PackageRevision
- Package runtime objects are now applied with server-side apply under the pkg.crossplane.io/runtime field manager, replacing the previous merge patch applicator
- The RUNTIME printer column on ProviderRevision and FunctionRevision was renamed to RUNTIME-HEALTHY, and a new RUNTIME-ACTIVE column was added
- The type label on the engine_watches_started_total and engine_watches_stopped_total metrics changed from ComposedResource to Dependency

#### v2.3.4 (2026-07-23)

- Container images are now built with buildGoModule instead of gomod2nix to enable vulnerability scanning by standard tooling

#### v2.2.4 (2026-07-23)

- Container images are now built with buildGoModule instead of gomod2nix to support standard vulnerability scanning tools

#### v2.3.3 (2026-06-22)

- Bump Go toolchain to 1.25.11
- Bump golang.org/x/net and golang.org/x/sys dependencies in the apis module for CVE fixes
- Update crossplane-runtime to v2.3.3

#### v2.2.3 (2026-06-22)

- Update crossplane-runtime to v2.2.3

#### v2.1.7 (2026-06-22)

- Update crossplane-runtime to v2.1.7

#### v2.3.2 (2026-06-09)

- bump crossplane-runtime dependency to v2.3.2

### Fixed

#### v2.2.5 (2026-08-21)

- Correct `crank` checksums for `amd64` binaries by calculating checksums after Nix strips the binary and verifying them before uploading
- Use unambiguous `/` separator instead of `.` for `Usage` index key in deletion protection webhook to prevent distinct resources from collapsing to the same key

#### v2.3.5 (2026-08-21)

- Correct crank checksums for amd64 binaries by calculating checksums after Nix strips the binary and verifying them before uploading
- Use unambiguous separator for Usage index key to prevent distinct resources from collapsing to the same key in the deletion protection webhook

#### v2.4.0 (2026-08-20)

- Changing a package's runtimeConfigRef now produces a new PackageRevision instead of reusing the existing revision with stale runtime settings
- A field removed from a DeploymentRuntimeConfig is now removed from the live runtime object rather than lingering
- Additions that Crossplane doesn't declare in runtime objects are left alone rather than replaced

#### v2.3.4 (2026-07-23)

- Usage controller now checks all owner references instead of only the first one, preventing repeated owner updates for composed Usages that trigger unnecessary composition reconciliation
- crossplane render command no longer overwrites the input XR's UID when one is already set
- crossplane render command now validates observed resources before proceeding with the render

#### v2.2.4 (2026-07-23)

- Usage controller now checks all owner references instead of only the first one to prevent repeated owner updates for composed Usages

#### v2.1.8 (2026-07-23)

- Usage controller now checks all owner references instead of only the first one, preventing repeated owner updates for composed Usages and unnecessary composition reconciliation triggering

#### v2.3.3 (2026-06-22)

- Correct namespace on injected resource refs in crossplane render to set namespace only for cluster-scoped XRs, matching the real reconciler behavior

#### v2.3.2 (2026-06-09)

- render command now honors input XR schema
- render command returns requirements even on fatal errors
- add namespace to resourceref stable sort

### Removed

#### v2.4.0 (2026-08-20)

- The Crossplane CLI is no longer published to releases.crossplane.io

### Security

#### v2.2.5 (2026-08-21)

- Update `cel-go` dependency to pick up upstream CVE fixes
- Update `golang.org/x/mod` dependency to pick up upstream CVE fixes
- Update `sigstore-go` dependency to v1.2.1 to pick up upstream CVE fixes
- Update `go-git` dependency to v5.19.2 to pick up upstream CVE fixes
- Update vulnerable dependencies to pick up upstream CVE fixes (also in v2.3.5)

#### v2.3.5 (2026-08-21)

- Bump cel-go to pick up upstream CVE fixes
- Bump golang.org/x/mod to v0.40.0 to pick up upstream CVE fixes
- Bump sigstore-go to v1.2.1 to pick up upstream CVE fixes

#### v2.4.0 (2026-08-20)

- Security fixes in Crossplane's Go toolchain and dependencies

#### v2.3.4 (2026-07-23)

- Update grpc to fix upstream CVEs
- Update golang.org/x/net to v0.56.0 to fix upstream CVEs
- Update golang.org/x/text to v0.39.0 to fix upstream CVEs
- Update github.com/sigstore/cosign/v3 to v3.0.6 to fix upstream CVEs
- Update github.com/sigstore/rekor to v1.5.2 to fix upstream CVEs
- Update github.com/sigstore/timestamp-authority/v2 to v2.1.0 to fix upstream CVEs
- Update github.com/sigstore/sigstore-go to v1.2.0 to fix upstream CVEs

#### v2.2.4 (2026-07-23)

- Updated github.com/sigstore/rekor to v1.5.2 to pick up upstream CVE fixes
- Updated github.com/sigstore/cosign/v3 to v3.0.6 to pick up upstream CVE fixes
- Updated github.com/sigstore/timestamp-authority/v2 to v2.1.0 to pick up upstream CVE fixes
- Updated github.com/sigstore/sigstore-go to v1.2.0 to pick up upstream CVE fixes
- Updated grpc, golang.org/x/net, and golang.org/x/text to pick up upstream CVE fixes

#### v2.1.8 (2026-07-23)

- Bump Go toolchain to 1.25.12 to pick up upstream CVE fixes
- Update github.com/sigstore/rekor to v1.5.2 for security fixes
- Update github.com/sigstore/timestamp-authority to v2.1.0 for security fixes
- Update github.com/sigstore/cosign to v2.6.3 for security fixes
- Update github.com/sigstore/sigstore-go to v1.2.0 for security fixes
- Update grpc, golang.org/x/net, and golang.org/x/text for security fixes
- Update golang.org/x/text to v0.39.0 for security fixes

#### v2.3.3 (2026-06-22)

- Fix package signature verification TOCTOU flaw that could let a malicious OCI registry pass signature verification with a signed image and then serve unsigned content for installation

#### v2.2.3 (2026-06-22)

- Fix package signature verification time-of-check-to-time-of-use flaw that allowed a malicious OCI registry to serve a correctly signed image for verification and then an unsigned image for installation
- Bump Go toolchain to 1.25.11
- Bump golang.org/x/net to v0.55.0

#### v2.1.7 (2026-06-22)

- Update module github.com/quic-go/quic-go to v0.59.1
- Update module golang.org/x/net to v0.55.0
- Bump Go to 1.25.11

## Release notes

### v2.2.5

- Date: 2026-08-21
- Version: v2.2.5
- Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.2.5
- Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.2.5

- **fixed** — Correct `crank` checksums for `amd64` binaries by calculating checksums after Nix strips the binary and verifying them before uploading
- **fixed** — Use unambiguous `/` separator instead of `.` for `Usage` index key in deletion protection webhook to prevent distinct resources from collapsing to the same key
- **security** — Update `cel-go` dependency to pick up upstream CVE fixes
- **security** — Update `golang.org/x/mod` dependency to pick up upstream CVE fixes
- **security** — Update `sigstore-go` dependency to v1.2.1 to pick up upstream CVE fixes
- **security** — Update `go-git` dependency to v5.19.2 to pick up upstream CVE fixes
- **security** — Update vulnerable dependencies to pick up upstream CVE fixes
- **changed** — Bump `crossplane-runtime` to v2.2.4 for additional security dependency updates

`v2.2.5` is a patch release scoped to fixing issues reported by users of Crossplane `v2.2` and fixing security related issues in Crossplane's dependencies.

#### 🎉 Highlights

* **Correct `crank` checksums for `amd64` binaries (#7665, originally #7660):** The published `.sha256` files for `linux_amd64` binaries had not matched the binaries themselves since `v2.2.0`, so any install script or Dockerfile that verified the `amd64` checksum failed. Checksums are now calculated after Nix strips the binary, and the release workflow verifies them before uploading. Fixes #7467.
* **Unambiguous `Usage` index key (#7629, originally #7508):** The deletion protection webhook indexed `Usage` resources by joining API group, kind, name, and namespace with `.`. Since groups and names can contain `.` themselves, two distinct resources could collapse to the same key, causing the webhook to block a deletion that should have been allowed. The key now joins with `/`, which cannot appear in any of those fields.
* **Dependency security updates:** Bumps `cel-go` (#7760), `golang.org/x/mod` (#7742), `sigstore-go` (#7677), and `go-git` (#7724), plus a combined set of vulnerable dependency updates (#7649), to pick up upstream CVE fixes. `crossplane-runtime` is also bumped to `v2.2.4` (#7766), which carries its own set of security dependency updates.

##### What's Changed

* build: give every Go build its own writable HOME by @jbw976 in https://github.com/crossplane/crossplane/pull/7654
* chore(deps): update vulnerable dependencies [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7649
* [Backport release-2.2] use unambiguous separator for usage index key by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7629
* Backport #7660 to release-2.2 by @adamwg in https://github.com/crossplane/crossplane/pull/7665
* chore(deps): update module github.com/sigstore/sigstore-go to v1.2.1 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7677
* build: point docker-client at docker_29 in the nix overlay [release-2.2] by @phisco in https://github.com/crossplane/crossplane/pull/7704
* chore(deps): lock file maintenance (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7699
* [Backport release-2.2] build: bump pinned nixpkgs channel from nixos-25.11 to nixos-26.05 by @jbw976 in https://github.com/crossplane/crossplane/pull/7719
* fix(deps): update module github.com/go-git/go-git/v5 to v5.19.2 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7724
* chore(deps): update module golang.org/x/mod to v0.40.0 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7742
* chore(deps): lock file maintenance (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7752
* chore(deps): update module github.com/google/cel-go to v0.30.0 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7760
* chore(deps): bump crossplane-runtime to v2.2.4 by @jbw976 in https://github.com/crossplane/crossplane/pull/7766


**Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.2.4...v2.2.5

### v2.3.5

- Date: 2026-08-21
- Version: v2.3.5
- Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.3.5
- Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.3.5

- **fixed** — Correct crank checksums for amd64 binaries by calculating checksums after Nix strips the binary and verifying them before uploading
- **fixed** — Use unambiguous separator for Usage index key to prevent distinct resources from collapsing to the same key in the deletion protection webhook
- **security** — Bump cel-go to pick up upstream CVE fixes
- **security** — Bump golang.org/x/mod to v0.40.0 to pick up upstream CVE fixes
- **security** — Bump sigstore-go to v1.2.1 to pick up upstream CVE fixes
- **security** — Update vulnerable dependencies to pick up upstream CVE fixes
- **changed** — Bump crossplane-runtime to v2.3.4 which carries security dependency updates

`v2.3.5` is a patch release scoped to fixing issues reported by users of Crossplane `v2.3` and fixing security related issues in Crossplane's dependencies.

#### 🎉 Highlights

* **Correct `crank` checksums for `amd64` binaries (#7666, originally #7660):** The published `.sha256` files for `linux_amd64` binaries had not matched the binaries themselves since `v2.2.0`, so any install script or Dockerfile that verified the `amd64` checksum failed. Checksums are now calculated after Nix strips the binary, and the release workflow verifies them before uploading. Fixes #7467.
* **Unambiguous `Usage` index key (#7630, originally #7508):** The deletion protection webhook indexed `Usage` resources by joining API group, kind, name, and namespace with `.`. Since groups and names can contain `.` themselves, two distinct resources could collapse to the same key, causing the webhook to block a deletion that should have been allowed. The key now joins with `/`, which cannot appear in any of those fields.
* **Dependency security updates:** Bumps `cel-go` (#7761), `golang.org/x/mod` (#7743), and `sigstore-go` (#7678), plus a combined set of vulnerable dependency updates (#7650), to pick up upstream CVE fixes. `crossplane-runtime` is also bumped to `v2.3.4` (#7765), which carries its own set of security dependency updates.

##### What's Changed

* build: give every Go build its own writable HOME by @jbw976 in https://github.com/crossplane/crossplane/pull/7653
* chore(deps): update vulnerable dependencies [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7650
* [Backport release-2.3] use unambiguous separator for usage index key by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7630
* Backport #7660 to release-2.3 by @adamwg in https://github.com/crossplane/crossplane/pull/7666
* chore(deps): update module github.com/sigstore/sigstore-go to v1.2.1 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7678
* [Backport release-2.3] build: point docker-client at docker_29 in the nix overlay by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7706
* chore(deps): lock file maintenance (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7700
* [Backport release-2.3] build: bump pinned nixpkgs channel from nixos-25.11 to nixos-26.05 by @jbw976 in https://github.com/crossplane/crossplane/pull/7720
* chore(deps): update module golang.org/x/mod to v0.40.0 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7743
* [Backport release-2.3] fix(ci): pin create-tag to v2 so apis/ submodule tagging works again by @jbw976 in https://github.com/crossplane/crossplane/pull/7748
* chore(deps): lock file maintenance (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7753
* chore(deps): update module github.com/google/cel-go to v0.30.0 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7761
* chore(deps): bump crossplane-runtime to v2.3.4 by @jbw976 in https://github.com/crossplane/crossplane/pull/7765


**Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.3.4...v2.3.5

### v2.4.0

- Date: 2026-08-20
- Version: v2.4.0
- Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.4.0
- Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.4.0

- **added** — Watch required resources and reconcile XRs immediately when they change
- **added** — Scale to zero for safe-start capable providers
- **added** — Release artifacts that are vulnerability scannable
- **changed** — Package revision names are now derived from both the package digest and the package's metadata.generation, so any change to a package's spec produces a new PackageRevision
- **changed** — Package runtime objects are now applied with server-side apply under the pkg.crossplane.io/runtime field manager, replacing the previous merge patch applicator
- **changed** — The RUNTIME printer column on ProviderRevision and FunctionRevision was renamed to RUNTIME-HEALTHY, and a new RUNTIME-ACTIVE column was added
- **changed** — The type label on the engine_watches_started_total and engine_watches_stopped_total metrics changed from ComposedResource to Dependency
- **removed** — The Crossplane CLI is no longer published to releases.crossplane.io
- **fixed** — Changing a package's runtimeConfigRef now produces a new PackageRevision instead of reusing the existing revision with stale runtime settings
- **fixed** — A field removed from a DeploymentRuntimeConfig is now removed from the live runtime object rather than lingering
- **fixed** — Additions that Crossplane doesn't declare in runtime objects are left alone rather than replaced
- **security** — Security fixes in Crossplane's Go toolchain and dependencies

The `v2.4.0` release is a regular quarterly Crossplane release that is focused on maturing a number of key areas of functionality across the project, as Crossplane continues to become more capable, more reliable, and more performant for your production workloads. This release includes the ability to watch required resources and reconcile XRs immediately when they change, scale to zero for safe-start capable providers, release artifacts that are vulnerability scannable, and a wide range of fixes and reliability improvements. It also includes security fixes in Crossplane's Go toolchain and dependencies.


#### 🚨 v1.20 end-of-life (EOL) November 2026

This v2.4 release marks the final release cycle where v1.20 will be maintained.

**When v2.5 is released in Nov 2026, v1.20 will reach its EOL and no longer receive any support or maintenance by the Crossplane project**. Until that time, we will continue to provide critical fixes and security related dependency updates to v1.20.

> [!IMPORTANT] 
> This EOL notice applies only to the v1.20 release. v1 legacy workloads like Claims and cluster scoped resources remain supported in Crossplane v2 through extensive [backwards compatibility support](https://docs.crossplane.io/latest/guides/upgrade-to-crossplane-v2/#legacy-resource-behavior).

##### Is your control plane ready for v2?

Upgrading to Crossplane v2 does not require any migration as part of the upgrade process, with the exception of the minimal breaking changes explicitly called out in the [v2 documentation](https://docs.crossplane.io/latest/guides/upgrade-to-crossplane-v2/#removed-features). If your control plane is not affected by those changes, you can simply [upgrade to v2](https://docs.crossplane.io/latest/guides/upgrade-crossplane/) right away.

To better assist Crossplane users in determining if their control planes are affected by any of the breaking changes in v2, we have released a v2 readiness checker tool in the v1.20 Crossplane CLI that can be invoked via `crossplane beta upgrade check`. You can read all about this tool in the following resources:

* blog post: [https://blog.crossplane.io/v2-upgrade-check/](https://blog.crossplane.io/v2-upgrade-check/)   
* docs: [https://docs.crossplane.io/v1.20/cli/command-reference/\#beta-upgrade-check](https://docs.crossplane.io/v1.20/cli/command-reference/#beta-upgrade-check)   
* release notes: [https://github.com/crossplane/crossplane/releases/tag/v1.20.9](https://github.com/crossplane/crossplane/releases/tag/v1.20.9) 

##### Crossplane Downstream Distributions

Downstream distributions are eligible to continue their extended support and maintenance for their releases that are based on upstream Crossplane's v1.20. Check with your [vendor](https://www.crossplane.io/commercial) for more details if you are using a downstream distribution of Crossplane.

#### 🚨 v2.4 Notable and Breaking Changes

* ⚠️ The Crossplane CLI is no longer published to `releases.crossplane.io`. New CLI releases go only to `cli.crossplane.io`, under the binary name `crossplane` rather than `crank`. This completes the CLI's move to https://github.com/crossplane/cli, which was announced in the `v2.3.0` release notes and dual published to both locations for `v2.3.0` to ease the transition.
    * f you are using custom installation scripts or CI steps that download the CLI directly from `releases.crossplane.io`, update them to use `cli.crossplane.io`, and update any firewall or proxy rule that allows `releases.crossplane.io` to now allow `cli.crossplane.io` instead.
        * Users of the [`install.sh`](https://github.com/crossplane/crossplane/blob/main/install.sh) script as their installation procedure are unaffected.
    * The CLI now follows its own release schedule, so a CLI release will not accompany every core Crossplane release and the two version numbers have diverged.
    * Documentation and installation instructions for the Crossplane CLI can be found on https://doc

_[Truncated at 4000 characters — full notes: https://github.com/crossplane/crossplane/releases/tag/v2.4.0]_

### v2.3.4

- Date: 2026-07-23
- Version: v2.3.4
- Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.3.4
- Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.3.4

- **fixed** — Usage controller now checks all owner references instead of only the first one, preventing repeated owner updates for composed Usages that trigger unnecessary composition reconciliation
- **fixed** — crossplane render command no longer overwrites the input XR's UID when one is already set
- **fixed** — crossplane render command now validates observed resources before proceeding with the render
- **changed** — Container images are now built with buildGoModule instead of gomod2nix to enable vulnerability scanning by standard tooling
- **security** — Update grpc to fix upstream CVEs
- **security** — Update golang.org/x/net to v0.56.0 to fix upstream CVEs
- **security** — Update golang.org/x/text to v0.39.0 to fix upstream CVEs
- **security** — Update github.com/sigstore/cosign/v3 to v3.0.6 to fix upstream CVEs
- **security** — Update github.com/sigstore/rekor to v1.5.2 to fix upstream CVEs
- **security** — Update github.com/sigstore/timestamp-authority/v2 to v2.1.0 to fix upstream CVEs
- **security** — Update github.com/sigstore/sigstore-go to v1.2.0 to fix upstream CVEs

`v2.3.4` is a patch release scoped to fixing issues reported by users of Crossplane `v2.3` and fixing security related issues in Crossplane and its dependencies.

#### 🎉 Highlights

* **Fixed repeated owner updates for composed Usages (#7597, originally #7591):** The Usage controller only checked the *first* `ownerReference` when deciding whether the `spec.by` resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so `spec.by` ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.
* **`crossplane render` fixes (#7599, originally #7544):** `render` no longer overwrites the input XR's UID when one is already set, and now validates observed resources before proceeding with the render.
* **Vulnerability-scannable images (#7574):** Container images are now built with `buildGoModule` (replacing `gomod2nix`), so published images can be scanned by standard vulnerability tooling.
* **Dependency security updates:** Bumps `grpc` / `golang.org/x/net` / `golang.org/x/text` (#7618, #7614, #7615) and the sigstore stack — `cosign` (#7559), `rekor` (#7560), `timestamp-authority` (#7570), `sigstore-go` (#7583) — to pick up upstream CVE fixes. See `## What's Changed` for the full list.

##### What's Changed
* chore(deps): update module github.com/sigstore/rekor to v1.5.2 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7560
* chore(deps): update module github.com/sigstore/cosign/v3 to v3.0.6 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7559
* chore(deps): update module github.com/sigstore/timestamp-authority/v2 to v2.1.0 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7570
* [Backport release-2.3] build(nix): build with buildGoModule so images are vulnerability-scannable by @phisco in https://github.com/crossplane/crossplane/pull/7574
* chore(deps): update module github.com/sigstore/sigstore-go to v1.2.0 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7583
* fix(deps): combined security bumps (grpc, x/net, x/text) (release-2.3) by @lsviben in https://github.com/crossplane/crossplane/pull/7618
* [Backport release-2.3] fix: avoid repeated owner updates for composed Usages by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7597
* [Backport release-2.3] render: Don't overwrite the input XR's UID if it has one and validate observed resources by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7599
* chore(deps): update module golang.org/x/text to v0.39.0 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7615
* chore(deps): update module golang.org/x/net to v0.56.0 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7614


**Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.3.3...v2.3.4

### v2.2.4

- Date: 2026-07-23
- Version: v2.2.4
- Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.2.4
- Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.2.4

- **fixed** — Usage controller now checks all owner references instead of only the first one to prevent repeated owner updates for composed Usages
- **changed** — Container images are now built with buildGoModule instead of gomod2nix to support standard vulnerability scanning tools
- **security** — Updated github.com/sigstore/rekor to v1.5.2 to pick up upstream CVE fixes
- **security** — Updated github.com/sigstore/cosign/v3 to v3.0.6 to pick up upstream CVE fixes
- **security** — Updated github.com/sigstore/timestamp-authority/v2 to v2.1.0 to pick up upstream CVE fixes
- **security** — Updated github.com/sigstore/sigstore-go to v1.2.0 to pick up upstream CVE fixes
- **security** — Updated grpc, golang.org/x/net, and golang.org/x/text to pick up upstream CVE fixes

`v2.2.4` is a patch release scoped to fixing issues reported by users of Crossplane `v2.2` and fixing security related issues in Crossplane and its dependencies.

#### 🎉 Highlights

* **Fixed repeated owner updates for composed Usages (#7596, originally #7591):** The Usage controller only checked the *first* `ownerReference` when deciding whether the `spec.by` resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so `spec.by` ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.
* **Vulnerability-scannable images (#7575):** Container images are now built with `buildGoModule` (replacing `gomod2nix`), so published images can be scanned by standard vulnerability tooling.
* **Dependency security updates:** Bumps `grpc` / `golang.org/x/net` / `golang.org/x/text` (#7619) and the sigstore stack — `cosign` (#7558), `rekor` (#7557), `timestamp-authority` (#7569), `sigstore-go` (#7582) — to pick up upstream CVE fixes. See `## What's Changed` for the full list.

##### What's Changed
* chore(deps): update module github.com/sigstore/rekor to v1.5.2 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7557
* fix(deps): update module github.com/sigstore/cosign/v3 to v3.0.6 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7558
* chore(deps): update module github.com/sigstore/timestamp-authority/v2 to v2.1.0 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7569
* [Backport release-2.2] build(nix): build with buildGoModule so images are vulnerability-scannable by @phisco in https://github.com/crossplane/crossplane/pull/7575
* chore(deps): update module github.com/sigstore/sigstore-go to v1.2.0 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7582
* fix(deps): combined security bumps (grpc, x/net, x/text) (release-2.2) by @lsviben in https://github.com/crossplane/crossplane/pull/7619
* [Backport release-2.2] fix: avoid repeated owner updates for composed Usages by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7596


**Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.2.3...v2.2.4

### v2.1.8

- Date: 2026-07-23
- Version: v2.1.8
- Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.1.8
- Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.1.8

- **fixed** — Usage controller now checks all owner references instead of only the first one, preventing repeated owner updates for composed Usages and unnecessary composition reconciliation triggering
- **security** — Bump Go toolchain to 1.25.12 to pick up upstream CVE fixes
- **security** — Update github.com/sigstore/rekor to v1.5.2 for security fixes
- **security** — Update github.com/sigstore/timestamp-authority to v2.1.0 for security fixes
- **security** — Update github.com/sigstore/cosign to v2.6.3 for security fixes
- **security** — Update github.com/sigstore/sigstore-go to v1.2.0 for security fixes
- **security** — Update grpc, golang.org/x/net, and golang.org/x/text for security fixes
- **security** — Update golang.org/x/text to v0.39.0 for security fixes

`v2.1.8` is a patch release scoped to fixing issues reported by users of Crossplane `v2.1` and fixing security related issues in Crossplane's dependencies.

#### 🎉 Highlights

* **Fixed repeated owner updates for composed Usages (#7622, originally #7591):** The Usage controller only checked the *first* `ownerReference` when deciding whether the `spec.by` resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so `spec.by` ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.
* **Dependency security updates:** Bumps the Go toolchain to `1.25.12` (#7577), `grpc` / `golang.org/x/net` / `golang.org/x/text` (#7620, #7609), and the sigstore stack — `cosign` (#7556), `rekor` (#7555), `timestamp-authority` (#7568), `sigstore-go` (#7581) — to pick up upstream CVE fixes. See `## What's Changed` for the full list.

##### What's Changed
* chore(deps): update module github.com/sigstore/rekor to v1.5.2 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7555
* chore(deps): update module github.com/sigstore/timestamp-authority/v2 to v2.1.0 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7568
* fix(deps): update module github.com/sigstore/cosign/v2 to v2.6.3 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7556
* build(deps): bump Go to 1.25.12 [security] [release-2.1] by @phisco in https://github.com/crossplane/crossplane/pull/7577
* chore(deps): update module github.com/sigstore/sigstore-go to v1.2.0 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7581
* fix(deps): combined security bumps (grpc, x/net, x/text) (release-2.1) by @lsviben in https://github.com/crossplane/crossplane/pull/7620
* chore(deps): update module golang.org/x/text to v0.39.0 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7609
* [Backport release-2.1] fix: avoid repeated owner updates for composed Usages by @phisco in https://github.com/crossplane/crossplane/pull/7622


**Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.1.7...v2.1.8

### v2.3.3

- Date: 2026-06-22
- Version: v2.3.3
- Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.3.3
- Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.3.3

- **security** — Fix package signature verification TOCTOU flaw that could let a malicious OCI registry pass signature verification with a signed image and then serve unsigned content for installation
- **fixed** — Correct namespace on injected resource refs in crossplane render to set namespace only for cluster-scoped XRs, matching the real reconciler behavior
- **changed** — Bump Go toolchain to 1.25.11
- **changed** — Bump golang.org/x/net and golang.org/x/sys dependencies in the apis module for CVE fixes
- **changed** — Update crossplane-runtime to v2.3.3

`v2.3.3` is a patch release scoped to fixing issues reported by users of Crossplane `v2.3` and fixing security related issues in Crossplane's dependencies.

#### 🎉 Highlights

* **Fixed package signature verification TOCTOU ([`GHSA-mf7q-r4rv-jv94`](https://github.com/crossplane/crossplane-runtime/security/advisories/GHSA-mf7q-r4rv-jv94)):** A time-of-check-to-time-of-use flaw could let a malicious OCI registry pass signature verification with a signed image and then serve unsigned content for installation. For `v2.3` this fix ships via the crossplane-runtime `v2.3.3` bump in #7541, since the affected code moved from `crossplane` to `crossplane-runtime` during the `v2.3` milestone. See the [crossplane-runtime `v2.3.3` release notes](https://github.com/crossplane/crossplane-runtime/releases/tag/v2.3.3) for the full details.
* **Correct namespace on injected resource refs in `crossplane render`:** `crossplane render` previously set a namespace on every injected resource reference, which is inaccurate for namespaced XRs (whose resource refs are local and carry no namespace) and broke composition functions with strict schemas, such as the generated KCL bindings used in control plane projects. Render now matches the real reconciler and sets the namespace only for cluster-scoped XRs. Backported in #7525, originally fixed in #7523.
* **Dependency security updates:** This release also bumps the Go toolchain to `1.25.11` and `golang.org/x/net` and `golang.org/x/sys` in the `apis` module to pick up CVE fixes (#7530). See `## What's Changed` below for the full list.

##### What's Changed
* [Backport release-2.3] render: Set namespace on injected resource refs only for cluster-scoped XRs by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7525
* [release-2.3] bump Go to 1.25.11 and apis golang.org/x/net, x/sys for CVEs [security] by @phisco in https://github.com/crossplane/crossplane/pull/7530
* Update crossplane-runtime to v2.3.3 by @lsviben in https://github.com/crossplane/crossplane/pull/7541

**Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.3.2...v2.3.3

### v2.2.3

- Date: 2026-06-22
- Version: v2.2.3
- Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.2.3
- Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.2.3

- **security** — Fix package signature verification time-of-check-to-time-of-use flaw that allowed a malicious OCI registry to serve a correctly signed image for verification and then an unsigned image for installation
- **security** — Bump Go toolchain to 1.25.11
- **security** — Bump golang.org/x/net to v0.55.0
- **changed** — Update crossplane-runtime to v2.2.3

`v2.2.3` is a patch release scoped to fixing issues reported by users of Crossplane `v2.2` and fixing security related issues in Crossplane and its dependencies.

#### 🎉 Highlights

* **Fixed package signature verification TOCTOU ([`GHSA-wfqx-gjrf-g28r`](https://github.com/crossplane/crossplane/security/advisories/GHSA-wfqx-gjrf-g28r)):** A time-of-check-to-time-of-use flaw would let a malicious OCI registry serve a correctly signed image for verification and then an unsigned image for installation, because Crossplane resolved tag references separately for each step. Crossplane now resolves a tag to a digest once and uses that same digest for both signature verification and the image pull, so the content that is verified is exactly the content that is installed. This affected only users who enable package signature verification, install packages by tag, and pull from registries they don't control. Installing by digest would avoid this issue. Backported in #7520, and reported independently by @bugbunny-research and @tonghuaroot.
  * Note this fix appears in `crossplane` for v2.2 and `crossplane-runtime` for v2.3 because the affected code was moved from `crossplane` to `crossplane-runtime` during the v2.3 milestone.
* **Dependency security updates:** This release also bumps the Go toolchain to `1.25.11` (#7529), `golang.org/x/net` to `v0.55.0` (#7438), and crossplane-runtime to `v2.2.3` (#7540), picking up security fixes in those upstream dependencies.

##### What's Changed
* chore(deps): update module golang.org/x/net to v0.55.0 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7438
* Backport xpkg signature verification fix to release-2.2 by @adamwg in https://github.com/crossplane/crossplane/pull/7520
* [release-2.2] bump Go to 1.25.11 [security] by @phisco in https://github.com/crossplane/crossplane/pull/7529
* Update crossplane-runtime to v2.2.3 by @lsviben in https://github.com/crossplane/crossplane/pull/7540


**Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.2.2...v2.2.3

### v2.1.7

- Date: 2026-06-22
- Version: v2.1.7
- Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.1.7
- Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.1.7

- **security** — Update module github.com/quic-go/quic-go to v0.59.1
- **security** — Update module golang.org/x/net to v0.55.0
- **security** — Bump Go to 1.25.11
- **changed** — Update crossplane-runtime to v2.1.7

v2.1.7 is a patch release scoped to fixing issues reported by users of Crossplane v2.1 and fixing security related issues in Crossplane's dependencies.

##### What's Changed
* chore(deps): update module github.com/quic-go/quic-go to v0.59.1 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7460
* chore(deps): update module golang.org/x/net to v0.55.0 [security] (release-2.1) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7437
* [release-2.1] bump Go to 1.25.11 [security] by @phisco in https://github.com/crossplane/crossplane/pull/7528
* Update crossplane-runtime to v2.1.7 by @lsviben in https://github.com/crossplane/crossplane/pull/7539


**Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.1.6...v2.1.7

### v2.3.2

- Date: 2026-06-09
- Version: v2.3.2
- Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.3.2
- Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.3.2

- **fixed** — render command now honors input XR schema
- **fixed** — render command returns requirements even on fatal errors
- **fixed** — add namespace to resourceref stable sort
- **changed** — bump crossplane-runtime dependency to v2.3.2

v2.3.2 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane's dependencies. The primary goal of this release is to fix regressions in the Crossplane CLI's `render` commands.

##### What's Changed

* [Backport release-2.3] build: tag the apis/ Go submodule on every release by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7445
* Backport #7452 to release-2.3: render honors input XR schema by @jcogilvie in https://github.com/crossplane/crossplane/pull/7459
* Backport #7455 to release-2.3: return requirements even on fatal errors by @jcogilvie in https://github.com/crossplane/crossplane/pull/7466
* Bump crossplane-runtime dependency to v2.3.2 (release-2.3) by @adamwg in https://github.com/crossplane/crossplane/pull/7474
* [Backport release-2.3] fix: add namespace to resourceref stable sort by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7475


**Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.3.1...v2.3.2