fix(deps): update module github.com/crossplane/crossplane/apis/v2 to v2.3.5

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/crossplane/crossplane/apis/v2	v2.3.4 → v2.3.5

---

Release Notes

crossplane/crossplane (github.com/crossplane/crossplane/apis/v2)

v2.3.5

Compare Source

v2.3.5 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane's dependencies.

🎉 Highlights

• Correct crank checksums for amd64 binaries (#​7666, originally #​7660): The published .sha256 files for linux_amd64 binaries had not matched the binaries themselves since v2.2.0, so any install script or Dockerfile that verified the amd64 checksum failed. Checksums are now calculated after Nix strips the binary, and the release workflow verifies them before uploading. Fixes #​7467.
• Unambiguous Usage index key (#​7630, originally #​7508): The deletion protection webhook indexed Usage resources by joining API group, kind, name, and namespace with .. Since groups and names can contain . themselves, two distinct resources could collapse to the same key, causing the webhook to block a deletion that should have been allowed. The key now joins with /, which cannot appear in any of those fields.
• Dependency security updates: Bumps cel-go (#​7761), golang.org/x/mod (#​7743), and sigstore-go (#​7678), plus a combined set of vulnerable dependency updates (#​7650), to pick up upstream CVE fixes. crossplane-runtime is also bumped to v2.3.4 (#​7765), which carries its own set of security dependency updates.

What's Changed

• build: give every Go build its own writable HOME by @​jbw976 in #​7653
• chore(deps): update vulnerable dependencies [security] (release-2.3) by @​crossplane-renovate[bot] in #​7650
• [Backport release-2.3] use unambiguous separator for usage index key by @​github-actions[bot] in #​7630
• Backport #​7660 to release-2.3 by @​adamwg in #​7666
• chore(deps): update module github.com/sigstore/sigstore-go to v1.2.1 [security] (release-2.3) by @​crossplane-renovate[bot] in #​7678
• [Backport release-2.3] build: point docker-client at docker_29 in the nix overlay by @​github-actions[bot] in #​7706
• chore(deps): lock file maintenance (release-2.3) by @​crossplane-renovate[bot] in #​7700
• [Backport release-2.3] build: bump pinned nixpkgs channel from nixos-25.11 to nixos-26.05 by @​jbw976 in #​7720
• chore(deps): update module golang.org/x/mod to v0.40.0 [security] (release-2.3) by @​crossplane-renovate[bot] in #​7743
• [Backport release-2.3] fix(ci): pin create-tag to v2 so apis/ submodule tagging works again by @​jbw976 in #​7748
• chore(deps): lock file maintenance (release-2.3) by @​crossplane-renovate[bot] in #​7753
• chore(deps): update module github.com/google/cel-go to v0.30.0 [security] (release-2.3) by @​crossplane-renovate[bot] in #​7761
• chore(deps): bump crossplane-runtime to v2.3.4 by @​jbw976 in #​7765

Full Changelog: crossplane/crossplane@v2.3.4...v2.3.5

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.