Crossplane v2.2.3

Changes

• !Fixed package signature verification TOCTOU (GHSA-wfqx-gjrf-g28r): A time-of-check-to-time-of-use flaw would let a malicious OCI registry serve a correctly signed image for verification and then an unsigned image for installation, because Crossplane resolved tag references separately for each step. Crossplane now resolves a tag to a digest once and uses that same digest for both signature verification and the image pull, so the content that is verified is exactly the content that is installed. This affected only users who enable package signature verification, install packages by tag, and pull from registries they don't control. Installing by digest would avoid this issue. Backported in #7520, and reported independently by @bugbunny-research and @tonghuaroot.security
• !Dependency security updates: This release also bumps the Go toolchain to 1.25.11 (#7529), golang.org/x/net to v0.55.0 (#7438), and crossplane-runtime to v2.2.3 (#7540), picking up security fixes in those upstream dependencies.security
• !Update module golang.org/x/net to v0.55.0 [security] (release-2.2)security
• ![release-2.2] bump Go to 1.25.11 [security]security
• +Note this fix appears in crossplane for v2.2 and crossplane-runtime for v2.3 because the affected code was moved from crossplane to crossplane-runtime during the v2.3 milestone.added
• ·Backport xpkg signature verification fix to release-2.2other