# Crossplane v2.2.5

- Product: Crossplane (https://whatsnew.fyi/product/crossplane)
- Vendor: CNCF
- Date: 2026-08-21
- Version: v2.2.5
- Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.2.5
- Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.2.5

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Correct `crank` checksums for `amd64` binaries by calculating checksums after Nix strips the binary and verifying them before uploading
- **fixed** — Use unambiguous `/` separator instead of `.` for `Usage` index key in deletion protection webhook to prevent distinct resources from collapsing to the same key
- **security** — Update `cel-go` dependency to pick up upstream CVE fixes
- **security** — Update `golang.org/x/mod` dependency to pick up upstream CVE fixes
- **security** — Update `sigstore-go` dependency to v1.2.1 to pick up upstream CVE fixes
- **security** — Update `go-git` dependency to v5.19.2 to pick up upstream CVE fixes
- **security** — Update vulnerable dependencies to pick up upstream CVE fixes
- **changed** — Bump `crossplane-runtime` to v2.2.4 for additional security dependency updates

`v2.2.5` is a patch release scoped to fixing issues reported by users of Crossplane `v2.2` and fixing security related issues in Crossplane's dependencies.

#### 🎉 Highlights

* **Correct `crank` checksums for `amd64` binaries (#7665, originally #7660):** The published `.sha256` files for `linux_amd64` binaries had not matched the binaries themselves since `v2.2.0`, so any install script or Dockerfile that verified the `amd64` checksum failed. Checksums are now calculated after Nix strips the binary, and the release workflow verifies them before uploading. Fixes #7467.
* **Unambiguous `Usage` index key (#7629, originally #7508):** The deletion protection webhook indexed `Usage` resources by joining API group, kind, name, and namespace with `.`. Since groups and names can contain `.` themselves, two distinct resources could collapse to the same key, causing the webhook to block a deletion that should have been allowed. The key now joins with `/`, which cannot appear in any of those fields.
* **Dependency security updates:** Bumps `cel-go` (#7760), `golang.org/x/mod` (#7742), `sigstore-go` (#7677), and `go-git` (#7724), plus a combined set of vulnerable dependency updates (#7649), to pick up upstream CVE fixes. `crossplane-runtime` is also bumped to `v2.2.4` (#7766), which carries its own set of security dependency updates.

##### What's Changed

* build: give every Go build its own writable HOME by @jbw976 in https://github.com/crossplane/crossplane/pull/7654
* chore(deps): update vulnerable dependencies [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7649
* [Backport release-2.2] use unambiguous separator for usage index key by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7629
* Backport #7660 to release-2.2 by @adamwg in https://github.com/crossplane/crossplane/pull/7665
* chore(deps): update module github.com/sigstore/sigstore-go to v1.2.1 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7677
* build: point docker-client at docker_29 in the nix overlay [release-2.2] by @phisco in https://github.com/crossplane/crossplane/pull/7704
* chore(deps): lock file maintenance (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7699
* [Backport release-2.2] build: bump pinned nixpkgs channel from nixos-25.11 to nixos-26.05 by @jbw976 in https://github.com/crossplane/crossplane/pull/7719
* fix(deps): update module github.com/go-git/go-git/v5 to v5.19.2 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7724
* chore(deps): update module golang.org/x/mod to v0.40.0 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7742
* chore(deps): lock file maintenance (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7752
* chore(deps): update module github.com/google/cel-go to v0.30.0 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7760
* chore(deps): bump crossplane-runtime to v2.2.4 by @jbw976 in https://github.com/crossplane/crossplane/pull/7766


**Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.2.4...v2.2.5