# Crossplane v2.2.3

- Product: Crossplane (https://whatsnew.fyi/product/crossplane)
- Vendor: CNCF
- Date: 2026-06-22
- Version: v2.2.3
- Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.2.3
- Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.2.3

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix package signature verification time-of-check-to-time-of-use flaw that allowed a malicious OCI registry to serve a correctly signed image for verification and then an unsigned image for installation
- **security** — Bump Go toolchain to 1.25.11
- **security** — Bump golang.org/x/net to v0.55.0
- **changed** — Update crossplane-runtime to v2.2.3

`v2.2.3` is a patch release scoped to fixing issues reported by users of Crossplane `v2.2` and fixing security related issues in Crossplane and its dependencies.

#### 🎉 Highlights

* **Fixed package signature verification TOCTOU ([`GHSA-wfqx-gjrf-g28r`](https://github.com/crossplane/crossplane/security/advisories/GHSA-wfqx-gjrf-g28r)):** A time-of-check-to-time-of-use flaw would let a malicious OCI registry serve a correctly signed image for verification and then an unsigned image for installation, because Crossplane resolved tag references separately for each step. Crossplane now resolves a tag to a digest once and uses that same digest for both signature verification and the image pull, so the content that is verified is exactly the content that is installed. This affected only users who enable package signature verification, install packages by tag, and pull from registries they don't control. Installing by digest would avoid this issue. Backported in #7520, and reported independently by @bugbunny-research and @tonghuaroot.
  * Note this fix appears in `crossplane` for v2.2 and `crossplane-runtime` for v2.3 because the affected code was moved from `crossplane` to `crossplane-runtime` during the v2.3 milestone.
* **Dependency security updates:** This release also bumps the Go toolchain to `1.25.11` (#7529), `golang.org/x/net` to `v0.55.0` (#7438), and crossplane-runtime to `v2.2.3` (#7540), picking up security fixes in those upstream dependencies.

##### What's Changed
* chore(deps): update module golang.org/x/net to v0.55.0 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7438
* Backport xpkg signature verification fix to release-2.2 by @adamwg in https://github.com/crossplane/crossplane/pull/7520
* [release-2.2] bump Go to 1.25.11 [security] by @phisco in https://github.com/crossplane/crossplane/pull/7529
* Update crossplane-runtime to v2.2.3 by @lsviben in https://github.com/crossplane/crossplane/pull/7540


**Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.2.2...v2.2.3