# Crossplane v2.3.3

- Product: Crossplane (https://whatsnew.fyi/product/crossplane)
- Vendor: CNCF
- Date: 2026-06-22
- Version: v2.3.3
- Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.3.3
- Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.3.3

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix package signature verification TOCTOU flaw that could let a malicious OCI registry pass signature verification with a signed image and then serve unsigned content for installation
- **fixed** — Correct namespace on injected resource refs in crossplane render to set namespace only for cluster-scoped XRs, matching the real reconciler behavior
- **changed** — Bump Go toolchain to 1.25.11
- **changed** — Bump golang.org/x/net and golang.org/x/sys dependencies in the apis module for CVE fixes
- **changed** — Update crossplane-runtime to v2.3.3

`v2.3.3` is a patch release scoped to fixing issues reported by users of Crossplane `v2.3` and fixing security related issues in Crossplane's dependencies.

#### 🎉 Highlights

* **Fixed package signature verification TOCTOU ([`GHSA-mf7q-r4rv-jv94`](https://github.com/crossplane/crossplane-runtime/security/advisories/GHSA-mf7q-r4rv-jv94)):** A time-of-check-to-time-of-use flaw could let a malicious OCI registry pass signature verification with a signed image and then serve unsigned content for installation. For `v2.3` this fix ships via the crossplane-runtime `v2.3.3` bump in #7541, since the affected code moved from `crossplane` to `crossplane-runtime` during the `v2.3` milestone. See the [crossplane-runtime `v2.3.3` release notes](https://github.com/crossplane/crossplane-runtime/releases/tag/v2.3.3) for the full details.
* **Correct namespace on injected resource refs in `crossplane render`:** `crossplane render` previously set a namespace on every injected resource reference, which is inaccurate for namespaced XRs (whose resource refs are local and carry no namespace) and broke composition functions with strict schemas, such as the generated KCL bindings used in control plane projects. Render now matches the real reconciler and sets the namespace only for cluster-scoped XRs. Backported in #7525, originally fixed in #7523.
* **Dependency security updates:** This release also bumps the Go toolchain to `1.25.11` and `golang.org/x/net` and `golang.org/x/sys` in the `apis` module to pick up CVE fixes (#7530). See `## What's Changed` below for the full list.

##### What's Changed
* [Backport release-2.3] render: Set namespace on injected resource refs only for cluster-scoped XRs by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7525
* [release-2.3] bump Go to 1.25.11 and apis golang.org/x/net, x/sys for CVEs [security] by @phisco in https://github.com/crossplane/crossplane/pull/7530
* Update crossplane-runtime to v2.3.3 by @lsviben in https://github.com/crossplane/crossplane/pull/7541

**Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.3.2...v2.3.3