v2.2.7 is a patch release scoped to fixing issues reported by users of Crossplane v2.2 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights

• Distrust of compromised eMudhra intermediate CAs: Bumps the Go toolchain to 1.26.10, whose crypto/x509 rejects the compromised eMudhra intermediate certificates (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots they chain to from the image's CA bundle (#7959).
• Truncated package downloads are no longer cached: A package download that failed partway could be cached as a valid but truncated package.yaml. The package revision then recorded only some of its objects, reported Healthy=True, and the provider's RBAC was rendered from the short list, so the provider could crash-loop. Truncated downloads are now discarded. Backported in #7950, originally fixed in crossplane/crossplane-runtime#1189.
• Usage no longer rewrites the in-use label on every reconcile: A leftover ownership check meant the used resource was updated on every reconcile of every Usage/ClusterUsage, causing needless API writes. Backported in #7875, originally fixed in #7860.
• Dependency security updates: Bumps golang.org/x/net to v0.60.0 (#7918) and otlptracehttp to v1.45.0 (#7845), and crossplane-runtime to v2.2.5 (#7963), to pick up upstream CVE fixes. Also refreshes the lock file (#7892, #7907).

What's Changed

• [Backport release-2.2] e2e: Use xpkg.upbound.io for private package pull test by @github-actions[bot] in #7871
• [Backport release-2.2] fix: stop rewriting the in-use label on every Usage reconcile by @github-actions[bot] in #7875
• chore(deps): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 [security] (release-2.2) by @crossplane-renovate[bot] in #7845
• chore(deps): lock file maintenance (release-2.2) by @crossplane-renovate[bot] in #7892
• chore(deps): update module golang.org/x/net to v0.60.0 [security] (release-2.2) by @crossplane-renovate[bot] in #7918
• chore(deps): lock file maintenance (release-2.2) by @crossplane-renovate[bot] in #7907
• [Backport release-2.2] Don't cache truncated package downloads in xpkg by @ezgidemirel in #7950
• [release-2.2] build(deps): bump Go to 1.26.9 [security] by @lsviben in #7953
• [release-2.2] build(deps): bump Go to 1.26.10 and distrust compromised eMudhra roots [security] by @lsviben in #7959
• [release-2.2] chore(deps): bump crossplane-runtime to v2.2.5 by @lsviben in #7963

Full Changelog: v2.2.6...v2.2.7