Crossplane v2.2.5

v2.2.5 is a patch release scoped to fixing issues reported by users of Crossplane v2.2 and fixing security related issues in Crossplane's dependencies.

🎉 Highlights

• Correct crank checksums for amd64 binaries (#7665, originally #7660): The published .sha256 files for linux_amd64 binaries had not matched the binaries themselves since v2.2.0, so any install script or Dockerfile that verified the amd64 checksum failed. Checksums are now calculated after Nix strips the binary, and the release workflow verifies them before uploading. Fixes #7467.
• Unambiguous Usage index key (#7629, originally #7508): The deletion protection webhook indexed Usage resources by joining API group, kind, name, and namespace with .. Since groups and names can contain . themselves, two distinct resources could collapse to the same key, causing the webhook to block a deletion that should have been allowed. The key now joins with /, which cannot appear in any of those fields.
• Dependency security updates: Bumps cel-go (#7760), golang.org/x/mod (#7742), sigstore-go (#7677), and go-git (#7724), plus a combined set of vulnerable dependency updates (#7649), to pick up upstream CVE fixes. crossplane-runtime is also bumped to v2.2.4 (#7766), which carries its own set of security dependency updates.

What's Changed

• build: give every Go build its own writable HOME by @jbw976 in https://github.com/crossplane/crossplane/pull/7654
• chore(deps): update vulnerable dependencies [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7649
• [Backport release-2.2] use unambiguous separator for usage index key by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7629
• Backport #7660 to release-2.2 by @adamwg in https://github.com/crossplane/crossplane/pull/7665
• chore(deps): update module github.com/sigstore/sigstore-go to v1.2.1 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7677
• build: point docker-client at docker_29 in the nix overlay [release-2.2] by @phisco in https://github.com/crossplane/crossplane/pull/7704
• chore(deps): lock file maintenance (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7699
• [Backport release-2.2] build: bump pinned nixpkgs channel from nixos-25.11 to nixos-26.05 by @jbw976 in https://github.com/crossplane/crossplane/pull/7719
• fix(deps): update module github.com/go-git/go-git/v5 to v5.19.2 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7724
• chore(deps): update module golang.org/x/mod to v0.40.0 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7742
• chore(deps): lock file maintenance (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7752
• chore(deps): update module github.com/google/cel-go to v0.30.0 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7760
• chore(deps): bump crossplane-runtime to v2.2.4 by @jbw976 in https://github.com/crossplane/crossplane/pull/7766

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.2.4...v2.2.5