# Crossplane v2.3.5

- Product: Crossplane (https://whatsnew.fyi/product/crossplane)
- Vendor: CNCF
- Date: 2026-08-21
- Version: v2.3.5
- Original notes: https://github.com/crossplane/crossplane/releases/tag/v2.3.5
- Permalink: https://whatsnew.fyi/product/crossplane/releases/v2.3.5

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Correct crank checksums for amd64 binaries by calculating checksums after Nix strips the binary and verifying them before uploading
- **fixed** — Use unambiguous separator for Usage index key to prevent distinct resources from collapsing to the same key in the deletion protection webhook
- **security** — Bump cel-go to pick up upstream CVE fixes
- **security** — Bump golang.org/x/mod to v0.40.0 to pick up upstream CVE fixes
- **security** — Bump sigstore-go to v1.2.1 to pick up upstream CVE fixes
- **security** — Update vulnerable dependencies to pick up upstream CVE fixes
- **changed** — Bump crossplane-runtime to v2.3.4 which carries security dependency updates

`v2.3.5` is a patch release scoped to fixing issues reported by users of Crossplane `v2.3` and fixing security related issues in Crossplane's dependencies.

#### 🎉 Highlights

* **Correct `crank` checksums for `amd64` binaries (#7666, originally #7660):** The published `.sha256` files for `linux_amd64` binaries had not matched the binaries themselves since `v2.2.0`, so any install script or Dockerfile that verified the `amd64` checksum failed. Checksums are now calculated after Nix strips the binary, and the release workflow verifies them before uploading. Fixes #7467.
* **Unambiguous `Usage` index key (#7630, originally #7508):** The deletion protection webhook indexed `Usage` resources by joining API group, kind, name, and namespace with `.`. Since groups and names can contain `.` themselves, two distinct resources could collapse to the same key, causing the webhook to block a deletion that should have been allowed. The key now joins with `/`, which cannot appear in any of those fields.
* **Dependency security updates:** Bumps `cel-go` (#7761), `golang.org/x/mod` (#7743), and `sigstore-go` (#7678), plus a combined set of vulnerable dependency updates (#7650), to pick up upstream CVE fixes. `crossplane-runtime` is also bumped to `v2.3.4` (#7765), which carries its own set of security dependency updates.

##### What's Changed

* build: give every Go build its own writable HOME by @jbw976 in https://github.com/crossplane/crossplane/pull/7653
* chore(deps): update vulnerable dependencies [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7650
* [Backport release-2.3] use unambiguous separator for usage index key by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7630
* Backport #7660 to release-2.3 by @adamwg in https://github.com/crossplane/crossplane/pull/7666
* chore(deps): update module github.com/sigstore/sigstore-go to v1.2.1 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7678
* [Backport release-2.3] build: point docker-client at docker_29 in the nix overlay by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7706
* chore(deps): lock file maintenance (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7700
* [Backport release-2.3] build: bump pinned nixpkgs channel from nixos-25.11 to nixos-26.05 by @jbw976 in https://github.com/crossplane/crossplane/pull/7720
* chore(deps): update module golang.org/x/mod to v0.40.0 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7743
* [Backport release-2.3] fix(ci): pin create-tag to v2 so apis/ submodule tagging works again by @jbw976 in https://github.com/crossplane/crossplane/pull/7748
* chore(deps): lock file maintenance (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7753
* chore(deps): update module github.com/google/cel-go to v0.30.0 [security] (release-2.3) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7761
* chore(deps): bump crossplane-runtime to v2.3.4 by @jbw976 in https://github.com/crossplane/crossplane/pull/7765


**Full Changelog**: https://github.com/crossplane/crossplane/compare/v2.3.4...v2.3.5