v2.2.1 is a patch release scoped to fixing issues reported by users of Crossplane v2.2 and fixing security related issues in Crossplane's dependencies.

🎉 Highlights

• Dependency upgrades work correctly with ImageConfig prefix rewriting: Packages installed via an ImageConfig prefix rewrite were previously not being upgraded when their dependencies changed, leaving users stuck on stale versions of dependent packages. Dependency upgrades now behave as expected when prefix rewrites are in use. Backported in [#7277], originally fixed in [#7233].

• Composition functions can now select all resources of a given kind: When a composition function returned a Requirements.ResourceSelector with only apiVersion and kind set (no matchName or matchLabels), Crossplane previously rejected this as an invalid request. A selector with no match field is now correctly interpreted as "all resources of that kind". Backported in [#7247], originally fixed in [#7241].

This release also bumps Go to 1.25.9 and pulls in security related updates for a number of Crossplane's upstream dependencies, including cosign, go-git, go-jose, cloudflare/circl, moby/spdystream, sigstore/timestamp-authority, docker/cli, and the OpenTelemetry OTLP HTTP trace exporter

What's Changed

• [Backport release-2.2] build: mitigate potential script injection in promote workflow by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7168
• [Backport release-2.2] fix: adding required permissions to top level and jobs in the workflow by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7175
• chore(deps): update module github.com/cloudflare/circl to v1.6.3 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7182
• [Backport release-2.2] ci: drop Trivy vulnerability scanning by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7238
• chore(deps): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7290
• chore(deps): update module github.com/go-jose/go-jose/v4 to v4.1.4 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7266
• fix(deps): update module github.com/sigstore/cosign/v3 to v3.0.5 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7184
• fix(deps): update module github.com/go-git/go-git/v5 to v5.17.1 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7183
• chore(deps): update module github.com/docker/cli to v29.2.0+incompatible [security] (release-2.2) - autoclosed by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7197
• chore(deps): bump Go to 1.25.9 [security] (release-2.2) by @phisco in https://github.com/crossplane/crossplane/pull/7307
• [Backport release-2.2] pkg: Correctly handle dependency upgrades with ImageConfig prefix rewriting by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7277
• chore(deps): update module github.com/moby/spdystream to v0.5.1 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7319
• chore(deps): update module github.com/sigstore/timestamp-authority/v2 to v2.0.6 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7320
• [Backport release-2.2] Fix nix lint errors by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7322
• Backport [#7323] to release-2.2 by @adamwg in https://github.com/crossplane/crossplane/pull/7324
• [Backport release-2.2] Support ResourceSelector with no match field by @github-actions[bot] in https://github.com/crossplane/crossplane/pull/7247
• fix(deps): update module github.com/go-git/go-git/v5 to v5.18.0 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7329
• Bump crossplane-runtime to v2.2.1 by @lsviben in https://github.com/crossplane/crossplane/pull/7333

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.2.0...v2.2.1