v2.2.3 is a patch release scoped to fixing issues reported by users of Crossplane v2.2 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights

• Fixed package signature verification TOCTOU (GHSA-wfqx-gjrf-g28r): A time-of-check-to-time-of-use flaw would let a malicious OCI registry serve a correctly signed image for verification and then an unsigned image for installation, because Crossplane resolved tag references separately for each step. Crossplane now resolves a tag to a digest once and uses that same digest for both signature verification and the image pull, so the content that is verified is exactly the content that is installed. This affected only users who enable package signature verification, install packages by tag, and pull from registries they don't control. Installing by digest would avoid this issue. Backported in [#7520], and reported independently by @bugbunny-research and @tonghuaroot.
• Note this fix appears in crossplane for v2.2 and crossplane-runtime for v2.3 because the affected code was moved from crossplane to crossplane-runtime during the v2.3 milestone.
• Dependency security updates: This release also bumps the Go toolchain to 1.25.11 (#7529), golang.org/x/net to v0.55.0 (#7438), and crossplane-runtime to v2.2.3 (#7540), picking up security fixes in those upstream dependencies.

What's Changed

• chore(deps): update module golang.org/x/net to v0.55.0 [security] (release-2.2) by @crossplane-renovate[bot] in https://github.com/crossplane/crossplane/pull/7438
• Backport xpkg signature verification fix to release-2.2 by @adamwg in https://github.com/crossplane/crossplane/pull/7520
• [release-2.2] bump Go to 1.25.11 [security] by @phisco in https://github.com/crossplane/crossplane/pull/7529
• Update crossplane-runtime to v2.2.3 by @lsviben in https://github.com/crossplane/crossplane/pull/7540

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.2.2...v2.2.3