Update module github.com/crossplane/crossplane/apis/v2 to v2.3.5 - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/crossplane/crossplane/apis/v2	v2.3.3 → v2.3.5

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

crossplane/crossplane (github.com/crossplane/crossplane/apis/v2)

v2.3.5

Compare Source

v2.3.5 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane's dependencies.

🎉 Highlights

• Correct crank checksums for amd64 binaries (#​7666, originally #​7660): The published .sha256 files for linux_amd64 binaries had not matched the binaries themselves since v2.2.0, so any install script or Dockerfile that verified the amd64 checksum failed. Checksums are now calculated after Nix strips the binary, and the release workflow verifies them before uploading. Fixes #​7467.
• Unambiguous Usage index key (#​7630, originally #​7508): The deletion protection webhook indexed Usage resources by joining API group, kind, name, and namespace with .. Since groups and names can contain . themselves, two distinct resources could collapse to the same key, causing the webhook to block a deletion that should have been allowed. The key now joins with /, which cannot appear in any of those fields.
• Dependency security updates: Bumps cel-go (#​7761), golang.org/x/mod (#​7743), and sigstore-go (#​7678), plus a combined set of vulnerable dependency updates (#​7650), to pick up upstream CVE fixes. crossplane-runtime is also bumped to v2.3.4 (#​7765), which carries its own set of security dependency updates.

What's Changed

• build: give every Go build its own writable HOME by @​jbw976 in #​7653
• chore(deps): update vulnerable dependencies [security] (release-2.3) by @​crossplane-renovate[bot] in #​7650
• [Backport release-2.3] use unambiguous separator for usage index key by @​github-actions[bot] in #​7630
• Backport #​7660 to release-2.3 by @​adamwg in #​7666
• chore(deps): update module github.com/sigstore/sigstore-go to v1.2.1 [security] (release-2.3) by @​crossplane-renovate[bot] in #​7678
• [Backport release-2.3] build: point docker-client at docker_29 in the nix overlay by @​github-actions[bot] in #​7706
• chore(deps): lock file maintenance (release-2.3) by @​crossplane-renovate[bot] in #​7700
• [Backport release-2.3] build: bump pinned nixpkgs channel from nixos-25.11 to nixos-26.05 by @​jbw976 in #​7720
• chore(deps): update module golang.org/x/mod to v0.40.0 [security] (release-2.3) by @​crossplane-renovate[bot] in #​7743
• [Backport release-2.3] fix(ci): pin create-tag to v2 so apis/ submodule tagging works again by @​jbw976 in #​7748
• chore(deps): lock file maintenance (release-2.3) by @​crossplane-renovate[bot] in #​7753
• chore(deps): update module github.com/google/cel-go to v0.30.0 [security] (release-2.3) by @​crossplane-renovate[bot] in #​7761
• chore(deps): bump crossplane-runtime to v2.3.4 by @​jbw976 in #​7765

Full Changelog: crossplane/crossplane@v2.3.4...v2.3.5

v2.3.4

Compare Source

v2.3.4 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights

• Fixed repeated owner updates for composed Usages (#​7597, originally #​7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so spec.by ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.
• crossplane render fixes (#​7599, originally #​7544): render no longer overwrites the input XR's UID when one is already set, and now validates observed resources before proceeding with the render.
• Vulnerability-scannable images (#​7574): Container images are now built with buildGoModule (replacing gomod2nix), so published images can be scanned by standard vulnerability tooling.
• Dependency security updates: Bumps grpc / golang.org/x/net / golang.org/x/text (#​7618, #​7614, #​7615) and the sigstore stack — cosign (#​7559), rekor (#​7560), timestamp-authority (#​7570), sigstore-go (#​7583) — to pick up upstream CVE fixes. See ## What's Changed for the full list.

What's Changed

• chore(deps): update module github.com/sigstore/rekor to v1.5.2 [security] (release-2.3) by @​crossplane-renovate[bot] in #​7560
• chore(deps): update module github.com/sigstore/cosign/v3 to v3.0.6 [security] (release-2.3) by @​crossplane-renovate[bot] in #​7559
• chore(deps): update module github.com/sigstore/timestamp-authority/v2 to v2.1.0 [security] (release-2.3) by @​crossplane-renovate[bot] in #​7570
• [Backport release-2.3] build(nix): build with buildGoModule so images are vulnerability-scannable by @​phisco in #​7574
• chore(deps): update module github.com/sigstore/sigstore-go to v1.2.0 [security] (release-2.3) by @​crossplane-renovate[bot] in #​7583
• fix(deps): combined security bumps (grpc, x/net, x/text) (release-2.3) by @​lsviben in #​7618
• [Backport release-2.3] fix: avoid repeated owner updates for composed Usages by @​github-actions[bot] in #​7597
• [Backport release-2.3] render: Don't overwrite the input XR's UID if it has one and validate observed resources by @​github-actions[bot] in #​7599
• chore(deps): update module golang.org/x/text to v0.39.0 [security] (release-2.3) by @​crossplane-renovate[bot] in #​7615
• chore(deps): update module golang.org/x/net to v0.56.0 [security] (release-2.3) by @​crossplane-renovate[bot] in #​7614

Full Changelog: crossplane/crossplane@v2.3.3...v2.3.4

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 7 additional dependencies were updated

Details:

Package	Change
golang.org/x/net	v0.55.0 -> v0.56.0
golang.org/x/tools	v0.44.0 -> v0.47.0
golang.org/x/mod	v0.35.0 -> v0.37.0
golang.org/x/sync	v0.20.0 -> v0.21.0
golang.org/x/sys	v0.45.0 -> v0.46.0
golang.org/x/term	v0.43.0 -> v0.44.0
golang.org/x/text	v0.37.0 -> v0.39.0