Back to index

Download installer and client with:

oc adm release extract --tools quay.io/okd/scos-release:4.22.0-okd-scos.9

Qualifiers (status api): None

Tests:

• Blocking jobs
  • upgrade Succeeded release-openshift-okd-scos-installer-e2e-aws-upgrade-from-scos-stable
  • upgrade-minor Succeeded release-openshift-okd-scos-installer-e2e-aws-upgrade-from-scos-stable

Upgrades from:

• 4.22.0-okd-scos.ec.16 (changes) - Success
• 4.22.0-okd-scos.8 (changes) - Success
• 4.22.0-okd-scos.7 (changes) - Failed
• 4.22.0-okd-scos.6 (changes) - Failed
• 4.22.0-okd-scos.5 (changes) - Failed
• 4.22.0-okd-scos.4 (changes) - Failed
• 4.22.0-okd-scos.3 (changes) - Success
• 4.22.0-okd-scos.2 - Success
• 4.22.0-okd-scos.1 (changes) - Success
• 4.22.0-okd-scos.0 (changes) - Success
• 4.21.0-okd-scos.ec.19 (changes) - Success
• 4.21.0-okd-scos.11 (changes) - Success

---

Loading changelog, this may take a while ...

Changes from 4.22.0-okd-scos.2

Created: 2026-09-01 06:09:04 +0000 UTC

Image Digest: sha256:ec8d6dc47890317f33f435200bd7b2de7746c84f2c3d3c39d38510fd9aec6833

Release 4.22.0-okd-scos.9 was created from registry.ci.openshift.org/origin/release-scos:4.22.0-0.okd-scos-nightly-2026-09-01-011446

Components

• Kubectl 1.35.2
• Kubernetes upgraded from 1.35.5 to 1.35.6
• Kubernetes Tests 1.35.1
• CentOS Stream CoreOS 10 upgraded from 10.0.20260526-0 to 10.0.20260806-0

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	OKD Hypershift	OKD SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
VSphereMixedNodeEnv (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled
NoRegistryClusterInstall (0 tests)	Disabled	Enabled (Changed)	Disabled	Enabled	Disabled	Enabled (Changed)	Disabled	Enabled

New images

• installer-etcd-artifacts git 6bd01267 sha256:2beb598a04266824a82f184a3beb982d6532e7e1e70d93985bd3ceabdeaa66ef
• installer-kube-apiserver-artifacts git 05744abb sha256:abb5ff518ebf51d632d7189d3d482daf0cc99c7d221f41cfde57772486477241

Rebuilt images without code change

• apiserver-network-proxy git 5e33c228 sha256:a6b42aee9e42440e06868827e80092ba44d4a93853a56c649eedbf4eab698f92
• aws-cloud-controller-manager git b4bad3f8 sha256:ed8690d47c63347997e7e36ef0f0f17f6342fb0822965a583a05d1e6fbc373c4
• aws-ebs-csi-driver git 51d6bc76 sha256:6af01f954e6f22c93eab3b7d0010af341782ee3565b379c41973f0eebf079815
• aws-kms-encryption-provider git 19e7b623 sha256:23fd2244ecc9180213df99704404c587bed00a4eaf8e60610ce8495e31fbe29d
• aws-machine-controllers git 1a0ccbcf sha256:0e441f19b2cb61467a202cec4cc0ee794c8ab092b4174145f7a460b6b204575e
• aws-node-termination-handler git 341ed3a0 sha256:334d6be2ceb1be0cbbae43eeeefce7b4b8468280e881adc51d5f0db20c46dd92
• aws-pod-identity-webhook git 82088287 sha256:f0f0b4dcdef482695a805c061903e5fbf8bbc6644621d72c8cd223553356c8db
• azure-service-operator git b44d4444 sha256:759bbde1d0748e0aa4ff920515619b0fdff1eef7fceb31aa4a24a3549d54815f
• azure-workload-identity-webhook git a8fb3bf1 sha256:c643fceba4fefddb517ade8e7d462f3c9c46849d14b164f43f9b1b9c58eb9d9c
• baremetal-cluster-api-controllers git 6481b520 sha256:07b43c836c902832bf88250ba9a6b7b6c98ed25a32a3e826013adc2ac709bb6c
• baremetal-machine-controllers git 8d863b95 sha256:fa173d2dedfe22de460d6039fbbbc7c664d34be469ffe37287ac3642e3ea9961
• baremetal-runtimecfg git dca8cb1b sha256:c22ab3e7fd03ae1fc8f25576c2e1d4e391d5c6be4bcae767cbaecf3327839027
• cloud-network-config-controller git 2d69ad95 sha256:41e431f50c6388de94227c4b7b20dcc7166f0a04ace295ad89cecaa0161d9085
• cluster-authentication-operator git 5a44cc2a sha256:5da9cb9c0f3b7d9e3535a077265081717aeaa1834bc012dbaa350b3f9a5e6f59
• cluster-bootstrap git e6be0fdf sha256:36d7475e98b1a8ab880deed404fdd073a7bf25163627f95683418321ad28daba
• cluster-capi-controllers git f1718df9 sha256:6e5a73c2b18b65f86476a0a6be93549cf43357100b1933408f62aff447265237
• cluster-config-operator git e0c2428e sha256:fd5daba610587c5505663510a12b0bdeeeded0eabbe9bf09f6a27b9110b2829f
• cluster-dns-operator git 3d214118 sha256:70db71d2e37ad3a9c855db30ba7923616745c76359ee67c9c2b7b5b5e1476919
• cluster-kube-controller-manager-operator git 95150ed5 sha256:bc057469aabbbd7c676b499449a80ab23e6a51af7df325d7cd7b41f741a069a2
• cluster-kube-scheduler-operator git 51ea59ab sha256:bf45485e03580ad084852e99cae9e3f111c47c979dabbcb976704f9fec19e107
• cluster-kube-storage-version-migrator-operator git 9afe6687 sha256:17b22c3c13887613b51a0fc53c3825cac2258b61621c3884e5b17e9da3efa1ef
• cluster-machine-approver git fa7bb022 sha256:e3eeec7bedef1e4a249e47117e6ebe8ca5f02a79c8e95507852bb55b9d9bf921
• cluster-openshift-controller-manager-operator git 2d2699e4 sha256:740a4a77ccae162cf8af20b4cd5eff91105d9bd3024b9af44b209a93d25fe288
• cluster-update-keys git 3b5c59cc sha256:779704ec7ee18798d72a5852dbc4f9a009a962ac9e73cef4b5ceaaf7a94f74d7
• configmap-reloader git 94e41c4c sha256:3e0d16f7d78154e7ae38674b9be321b999801b67d67674e17fcf40f90d8d208d
• coredns git 9a71d9a6 sha256:c95d2386e3374c0190dce64c9b777110d798486615c945668f5f0d1ec8900af4
• csi-driver-nfs git b6911553 sha256:336dbee008c14f46367a66c07970ad60de6cafccc9bf81119fe081d5745d3320
• csi-external-attacher git 95a19797 sha256:245c01445be8aee30ab6f9ac3d616b66cc0233a0cbe3b1804b7d106891a0df49
• csi-livenessprobe git 4d5e959a sha256:4729637476c183482f09cf40e6d0a058888fa4d99ff69df96bae1f9946683949
• docker-builder git fcd4ce2d sha256:339ed54188eeaad3526683dd0d8a4c4d43c2422bcb22a20b5ebfc3c974486c39
• docker-registry git 9eae44fc sha256:28858514c3478f437576a3e10a7e361720c0c9cb607931e16bc682cd87f7e975
• driver-toolkit git 7aa4007a sha256:10c2f165ad619577e924bf49f579fea9c7ba227b3552c1ad1cba9a826f9ec9a9
• gcp-cloud-controller-manager git ea31ab85 sha256:509811f673fc760d31b30204b64c5a59e8d49ef3dfd2dc10cc48790ca6e72ccd
• gcp-cluster-api-controllers git e7674ede sha256:83fa70b7a62396b87081d6d7bf86934d2e14ce8d408ece798612e73272586cdd
• gcp-machine-controllers git 0073bd11 sha256:b95045d062775d7a3f99f234256bd8d6a4efa3911cb69a9e54ac52ed5f840ec7
• gcp-pd-csi-driver git 48a7a1aa sha256:33b61eb9019e27fd0dfa55bc13c92d9bcecd28dacaa69a12533a1e8846e2c344
• gcp-workload-identity-federation-webhook git d7675f31 sha256:c28f4395a8e101d01e9613cc9b201673de9c05727e4cf971576a1153d5e12b8d
• ibm-cloud-controller-manager git 24cff9a6 sha256:7ca97e14d4532a16c5e6bc668173a18c61a112304ba4ed17c8adb80248abce62
• ibm-vpc-block-csi-driver git d362aef2 sha256:38151286e876b1a6b48992e757a312d372e4d6bfcda0eea01a7a5f9f215cb4dd
• ibmcloud-cluster-api-controllers git 03b143d5 sha256:b66d436ffbe138e4dc5cf2e2681dc2be49ab194eea268c5fca877944209e0f41
• insights-runtime-exporter git 70256457 sha256:7fac51f505998d94aff8854785b2b2039ff305892c726c3ba8f20bab76e609fd
• insights-runtime-extractor git 70256457 sha256:1b4c4d289ab5d7a265b11ae1a3d25660a0d5d88c00da46ee420d2a8cd5bf37fc
• ironic-machine-os-downloader git 9953d2b7 sha256:67ae19dd3bf87b8611a0c5c11a1e0bac7a3820e787a1159de643cf1b86221203
• ironic-static-ip-manager git a379d09f sha256:3b5eeab00b02b8285934f6e377a36fd363901fcb7512c57a7a8ba332ac13c976
• kube-metrics-server git 38c16c46 sha256:df0683a03138917e81b25b3c040c4236b441bbbeaa6c8567b017daf04fc111c8
• kube-rbac-proxy git d12e2746 sha256:2c6a39b6d5ab21703f69eecd5bd0ef89e6317f4c5eb0c03f68bafe0d506ea07d
• kube-storage-version-migrator git 72835e43 sha256:94a828d1d28f0c4f8a9b8913e9ace0b248044d134c9a59944572dc6157ccfad9
• machine-api-operator git 78c5104d sha256:c34378981882588b0832121999526fc0b90a72f586c5836329395375a8ae5ab2
• machine-image-customization-controller git a43d9c97 sha256:b1584d7f2d8873e126fcbbb7997acc224ae75caecbd0472f32424627d732066b
• multus-admission-controller git d4dd42ba sha256:dc163b8403f441f8c67e3f14810f0c0c861dbbff4b6f6f472145a46576ae4acd
• multus-cni git b4ec7d82 sha256:d5a9566594589727d4f530ba12d1c313008708d54aad0dfc9ca16a9d94c8be39
• multus-cni-microshift git b4ec7d82 sha256:319b183dda6503334a9ee4f77b264359f37cb0cc6cd606f896513e195143aee7
• multus-networkpolicy git 834a093f sha256:d6b2a589c59695dc661160ced2cf8c070326dc45d6135182b8c940eb0771ff57
• multus-route-override-cni git 08af4127 sha256:a5648cf0472e7dfc2fb09e527646413450b48af2d3439422d3b6157ad39cee7a
• multus-whereabouts-ipam-cni git d691040e sha256:dcc0ddb19ab9c81881036ecb2e89fc462273bbdea94cd3ac66f20a8472b67f25
• must-gather git 8554213f sha256:843c5c350d019dc96c0a802aa77242fc7ffca93515646c9c318eb8dea3f909db
• network-metrics-daemon git 5b233ea1 sha256:bd20228ad385803fa3609e4de002b235c94b9507121c04afbfda642480b3fcdf
• network-tools git 5c4b905c sha256:4feba1f55b5adc472673d37c0d82038a149ae66c907ad49d635f5a417542c802
• nutanix-cloud-controller-manager git 8e75679a sha256:5025869ac26d997cc9465fde625a68cc65ba774d3c1e008c6466a464c5ff1aaf
• nutanix-machine-controllers git 60559fdd sha256:67b225fa6ce0f9a0d51aef51739ee86d06ea5a7ca29843673ce987d56828008f
• oauth-apiserver git 4c002a91 sha256:3e847bfe853562c95747694b24e8d347869254650e103c273a2e503fc614b1e9
• openshift-controller-manager git 26d20fea sha256:a468be1560f68d8f6b835683a84d91260885108e8b231b7e523c2dbc374970eb
• openshift-state-metrics git e71e0996 sha256:9f7b6bfcabc9934ad250e0a8286ba58cd6b1cdef71f8d6dd615e5b9929e717bd
• openstack-cluster-api-controllers git 06d95461 sha256:cd22ec97c6e76546f41d829a8b1afc0b4e54c16e937e3c970ab3c7240ddb196f
• openstack-resource-controller git cbea7a9c sha256:d18600e81bc4e9f7107d2e234478922b0c1474211fbc2b034dbdf4dc02844535
• operator-marketplace git 38da2ef7 sha256:f420b3e1f0e996931626b62e791199637a57aa210b25b988ef54a99c1df50a20
• powervs-block-csi-driver git 02959a8d sha256:df3cbbe43265c9fc85ba18d0dc7a29dfb45b74b8ce87ba811dffd01019016b84
• powervs-block-csi-driver-operator git 27747821 sha256:d76083aa037d6894bd89a44c8d4d2af8fd963669dac17fdb4262a8710f9b0236
• powervs-cloud-controller-manager git 766c0952 sha256:0386705de3748b8a76fe8b8fb63e6e2d56ba13e189049cb5de5048878b3acbd9
• powervs-machine-controllers git e88cf81d sha256:19bd2ff22ec5ae52dfe6641c5e8daa2619b1e10525bba76ba74097e45bbbf1af
• prom-label-proxy git c4c99a30 sha256:1736ab51c528598cbd54c8070d5400930dbcb82ecace10771718a0d94654365e
• prometheus-config-reloader git 70e38466 sha256:cfa79a5d08539bcd4e3763a1fdefe2a2a17e4adcc6a8368d8932ef0ab6b41ab9
• prometheus-node-exporter git 6c4fc012 sha256:1e334c828b88e689c449d211345637bbe54657fdf81910504fdc8d4f1f8d2bf9
• prometheus-operator git 70e38466 sha256:351363e52538168647a76dec5dd0ccc7b16cffee0e45774f0ba8c92969f29700
• prometheus-operator-admission-webhook git 70e38466 sha256:fee29b9cf9a57e65d95d36ab640381df2814714e717ade96aa0088e895c7baf8
• route-controller-manager git 55f77ca4 sha256:68a5168524b10faf3e29758c76ddfe807e1bc3f64be0a8e58a4c68e5fd6503ae
• service-ca-operator git 9fff46a5 sha256:0f5013246e2dbf48bb070e45e83404a8a7779c2c7505718de25ead29190e9668
• telemeter git c2ffb0a7 sha256:13638478bf80692cfe9ce1a23b531422f08d288af95ef63d8aeddb266c2d8fe8
• volume-data-source-validator git 8e176cec sha256:daa025ec874cd69090007bf5fc909a431e2165c61365fd1d8bd6a3bcbed43d6a
• vsphere-cloud-controller-manager git 39008107 sha256:5804b546d595e534ad34e52e74f58416ba47f2d68c93d94cfb77fcd79956b77e
• vsphere-cluster-api-controllers git ac542b5a sha256:d8aa59b5464eef27ecd4c445167d62170d9e6b4ad88c48a0f90b661a37d836d2

agent-installer-api-server

• OCPBUGS-105805: golang.org/x/crypto bump to v0.52.0 #10796
• OCPBUGS-104521: manifest_generator add a label to LUKS root #10755
• AGENT-1559: Remove LSO and LVMS as CNV operator dependencies #10666
• OCPBUGS-98693: PATCH /v2/clusters/{id} does not return updated operator_bundles #10608
• OCPBUGS-93786: Simplify IRI api dependency #10539
• OCPBUGS-92056: Stop setting DevPreviewNoUpgrade for TNF clusters #10516
• OCPBUGS-90638: Add sourcedir /run/chrony-dhcp to generated chrony.conf #10488
• Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

• OCPBUGS-96592: Bump golang.org/x/net to v0.55.0 #2250
• OCPBUGS-104498: Wait for all nodes to join before exiting for ABI #2245
• OCPBUGS-69953: Updating ose-agent-installer-csr-approver-container image to be consistent with ART for 4.22 #1406
• Full changelog

agent-installer-node-agent

• OCPBUGS-84392: Bump go-jose in v4.22 #1488
• Full changelog

agent-installer-ui

• NoRegistryClusterInstall has been promoted to default in the OpenShift API, (#3984) #3984
• Update OWNERS file (#3990) #3990
• OCPBUGS-100526, OCPBUGS-103014: Bump ip-address to 10.5.0 to fix CVE-2026-54272 and CVE-2026-69192 (#3987) #3987
• OCPBUGS-109783: Bump tar pkg to version ^7.5.21 to address CVE-2026-73566 (#3970) #3970
• OCPBUGS-104483: Pin minimatch to ^10.2.6 and brace-expansion to ^5.0.9 (CVE-2026-14257) (#3959) #3959
• CVE-2026: 9595: Bumped webpack-dev-server to 5.2.5 (#3924) #3924
• OCPBUGS-99025: Bump dompurify to 3.4.7+ in 4.22 (#3895) #3895
• OCPBUGS-91629: Bump ws to 8.21.0 for CVE-2026-45736 (#3906) #3906
• OCPBUGS-96710: Bump basic-ftp to 5.3.1 for CVE-2026-44240 (#3823) #3823
• CVE-2026: 59873 openshift4/ose-agent-installer-ui-rhel9: node-tar: Denial of Service via crafted gzip bomb openshift-4.22 #3890
• Update OWNERS file (#3883) #3883
• OCPBUGS-98431: Bump js-yaml to 4.3.0 in 4.22 (#3865) #3865
• Apply patches (#3873) #3873
• MGMT-24444: Apply sentence case to networking management type labels … (#3747) (#3871) #3747
• MGMT-24152: UI allows editing pull secret in draft cluster (#3662) (#3870) #3662
• OCPBUGD-89707: bump form-data from 4.0.5 to 4.0.6 to address CVE-2026-12143 (#3869) #3869
• patch CVE-2026-9277 and CVE-2026-42338 via yarn resolutions (#3851) #3851
• AGENT-1519 | [Below-the-sea UI] Allow the user to select IPv6 in the Networking Stack Type field (#3806) #3806
• MGMT-23950: [Staging] [UI] - Cluster name missing in page header for draft clusters (#3669) (#3835) #3669
• Fix disk encryption parsing for cluster details (#3737) (#3843) #3737
• MGMT-19002: [nmstate] UI form view missing autoconf field for ipv6 (#3681) (#3836) #3681
• Tweak discovery ISO modal sizing (#3792) (#3846) #3792
• MGMT-23490: Refactor Troubleshooting Web Console (#3688) (#3839) #3688
• OCPBUGS-88249, OCPBUGS-88400: Ensure axios version is resolved to 1.18.1 (#3857) #3857
• Pull secret appears editable in draft cluster but changes are not applied (#3597) (#3831) #3597
• MGMT-24099: UI redirects to Custom Manifest page before host discovery when cluster is OCI platform (#3739) (#3844) #3739
• Fix machine network autoselect to work with IPv6 only clusters (#3813) (#3848) #3813
• Fix nested expandable sections (#3798) #3798
• OCPBUGS-86813: Custom manifests are broken in local assisted UI (#3768) #3768
• OCPBUGS-86258: Static ip prefill for ove below the sea (#3767) #3767
• Full changelog

agent-installer-utils

• OCPBUGS-105451: Update Konflux references #337
• OCPBUGS-101760: Update Konflux references #329
• OCPBUGS-100105: Use Operator catalog in 4.22 for OVE #325
• AGENT-1568: Add lvms-operator to config #324
• OCPBUGS-99906: Update Konflux references #302
• OCPBUGS-99556: Use agent-preinstall-image-builder from quay-proxy #321
• OCPBUGS-98743: Update cluster-logging and loki operator versions #316
• OCPBUGS-89320: bump mtv-operator to release-v2.12 #310
• Full changelog

aws-cluster-api-controllers

• 🐛 [release-4.22] OCPBUGS-112305: UPSTREAM: 6132: Persist ProviderID immediately after instance creation #626
• Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

• OCPBUGS-101882, OCPBUGS-101889, OCPBUGS-101890, OCPBUGS-102000: Bump golang.org/x/net to v0.53.0 #602
• OCPBUGS-109635: csi-driver-smb: DeleteVolume call fails to mkdir under /tmp #597
• OCPBUGS-91947: maxOpenShiftVersion should be bumped to 5.0 #572
• Full changelog

aws-karpenter-provider-aws

• OCPBUGS-101842: Fix CVE-2026-33814 #35
• Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

• OCPBUGS-88485: Bump golang.org/x/net from v0.49.0 to v0.55.0 #193
• Full changelog

azure-cluster-api-controllers

• OCPBUGS-105465: Address CVE-2026-39829 #396
• Full changelog

azure-disk-csi-driver

• UPSTREAM: 3635: OCPBUGS-96598: Bump golang.org/x/net to v0.55.0 #165
• OCPBUGS-106152: UPSTREAM: 3756: fix: optionally skip reading the config from the API server #163
• OCPBUGS-83633: Bump spdystream to v0.5.1 #150
• Full changelog

azure-file-csi-driver

• OCPBUGS-95536: Bump golang.org/x/crypto to v0.48.0-sec.1 #144
• Full changelog

azure-kms-encryption-provider

• CNTRLPLANE-4024: support sovereign Managed HSM endpoints- #56 #56
• OCPBUGS-101846: [release-4.22] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #57
• CNTRLPLANE-4024: [release-4.22]: Correct Managed HSM endpoints #53
• Full changelog

azure-machine-controllers

• OCPBUGS-98074: Bump golang.org/x/crypto from v0.47.0 to v0.54.0 #205
• OCPBUGS-86996: Don’t permanently fail Machines after provisioning #195
• PIXAA-7: Leverage SpotRebalanceRecommendation for instance termination when available #198
• Full changelog

baremetal-installer, installer, installer-artifacts

• AGENT-1583: post-feature promotion (NoRegistryClusterInstall) openshift/api dependencies bump #10817
• OCPBUGS-112471: Update timeout in GetMarketplaceImage to 5 minutes #10784
• OCPBUGS-111885: pin argcomplete for yq on Python 3.9 (release-4.22) #10766
• Bug OCPBUGS-99399: baremetal: fix provisioning ISO kernel arguments #10703
• AGENT-1546: Backport NoRegistryClusterInstall feature to release-4.22 #10683
• OCPBUGS-87814: [release-4.22] Add omitempty to vSphere and Nutanix MachinePool slice fields #10606
• OCPBUGS-95555, OCPBUGS-99017: bump golang.org/x/crypto to 0.52.0 #10695
• OCPBUGS-98982: Update RHCOS-release-4.22 bootimage metadata to 9.8.20260715-1 / 10.2.20260715-0 #10692
• OCPBUGS-98701: cluster-api: disable diagnostics endpoint for local CAPI controllers #10685
• OCPBUGS-87812: [release-4.22] fix: reset associatedVCenter in failure domain validation loop #10604
• OCPBUGS-97964: destroy/aws: delete vpc endpoints earlier #10674
• no-jira: images: bump UPI image dependencies to 4.22 #10582
• OCPBUGS-84402: Bump go-jose/v4 to 4.1.4 #10597
• Full changelog

baremetal-operator

• OCPBUGS-90570: Reject non-empty checksum for OCI images #501
• OCPBUGS-99420: Create ports if they are already inspected and machine is re-registering #518
• OCPBUGS-83866: Include image URL and checksum in provisioning error message #500
• OCPBUGS-94109: cherry-pick reconciler optimizations #503
• OCPBUGS-97940: Add BMH finalizer on PreprovisioningImage #505
• OCPBUGS-87963: Fix preprovisioning network Secret lifecycle during BMH deletion #491
• Full changelog

cli, cli-artifacts, deployer, tools

• OCPBUGS-98547: bump x/crypto to the latest version #2309
• Full changelog

cloud-credential-operator

• NO-JIRA: Revert “OCPBUGS-87828: Scope minted AWS IAM policies to cluster-owned resources” #1059
• OCPBUGS-87828: Scope minted AWS IAM policies to cluster-owned resources #1045
• Full changelog

cluster-autoscaler

• OCPBUGS-102038: [4.22] Fix OCPBUGS-102038 #434
• OCPBUGS-99551: [release-4.22] UPSTREAM: 10001: chore(clusterapi): add machine phase check for failed machines #431
• Full changelog

cluster-autoscaler-operator

• OCPBUGS-101883: Bump x/net package in release-4.22 #387
• Full changelog

cluster-baremetal-operator

• OCPBUGS-99390: Cluster Operator baremetal did not report Progressing=True during a cluster update #634
• OCPBUGS-99501: Apply cluster TLS profile to ironic-proxy container #635
• OCPBUGS-87212: Add watcher for both TLS Adherence policy and profile changes #610
• OCPBUGS-86226: Fix empty IRONIC_BASE_URL #606
• Full changelog

cluster-capi-operator

• OCPBUGS-96609: Bump golang.org/x/net to v0.56.0 to fix CVE-2026-27136 #624
• Full changelog

cluster-cloud-controller-manager-operator

• OCPBUGS-112665: Moved node sync job creation from manifest to operator controller #507
• OCPBUGS-105883: Created new job to update vSphere nodes to have vsphere label #501
• OCPBUGS-94184: OCPBUGS-65582: [release-4.22] OCPBUGS-65582: manifests: Shift operator Deployment and ClusterOperator after CredentialsRequests #484
• SPLAT-2794: Create OTE Binary and add vSphere hybrid e2e tests #471
• OCPBUGS-92656: e2e/ccm-aws-ote: support to dual-stack IPv6 primary #480
• Full changelog

cluster-config-api

• OCPBUGS-113639: move empty CRIOCredentialProviderConfig CR to run-level 0000_10 #3010
• SPLAT-2718: Promote FeatureGateVSphereMixedNodeEnv to GA #2949
• OCPBUGS-113600: [release-4.22] OCPBUGS-112479: Handle Sippy date-only format in featuregate-test-analyzer #3008
• OCPBUGS-105168: Add haproxyVersion in IngressController API #2971
• AGENT-1578: Promote NoRegistryClusterInstall feature to default #2979
• AGENT-1544: Backport NoRegistryClusterInstall feature to release-4.22 #2930
• OCPBUGS-98222: add new serviceAccountToken fs type #2922
• Full changelog

cluster-control-plane-machine-set-operator

• OCPBUGS-87968: Fixed issue where nameserver is not set when recreating cpms #409
• Full changelog

cluster-csi-snapshot-controller-operator

• OCPBUGS-88472: Fix group snapshots on HyperShift #280
• Full changelog

cluster-etcd-operator

• OCPBUGS-100120: Revert ‘OCPBUGS-88490: fix etcd operator deadlock when etcd-endpoints configmap is stale’ #1661
• OCPBUGS-90542: fix etcd operator deadlock when etcd-endpoints configmap is stale #1636
• OCPBUGS-86960: validate snapshot before destructive operations in cluster-restore-tnf.sh #1627
• And 2 elided commits (e.g. from squash or rebase merges)
• Full changelog

cluster-image-registry-operator

• OCPBUGS-96612: Bump golang.org/x/net from v0.47.0 to v0.55.0 #1355
• Full changelog

cluster-ingress-operator

• OCPBUGS-105168: Bump openshift/api which adds HAProxy version API #1545
• OCPBUGS-98728: Add missing include annotations to IBM Cloud and PowerVS ingress CredentialsRequests #1506
• OCPBUGS-97563: Detect orphaned OSSM subscription after noOLM migration #1495
• OCPBUGS-91967: Guard OLM watches with capability check in gatewayclass controller #1481
• OCPBUGS-87164: Add referencegrants and backendtlspolicies to Gateway API RBAC #1461
• OCPBUGS-87167: Add configuration override for X-SSL strip #1468
• Full changelog

cluster-kube-apiserver-operator

• OCPBUGS-87844: Fix kube-apiserver-to-kubelet-signer refresh interval #2187
• Full changelog

cluster-monitoring-operator

• OCPBUGS-105304: [release-4.22] wrap library-go resourceCache with mutex for thread safety #3045
• OCPBUGS-104852: [release-4.22] e2e: scale down CVO and MCO to prevent node reboots during proxy config watch test #3052
• OCPBUGS-104536: Backport e2e stabilization 4.22 #3026
• OCPBUGS-100367: [release-4.22] fix: watch cluster wide proxy changes and apply changes accordingly #3020
• OCPBUGS-99748: fall back to kube-system/global-pull-secret for telemeter-client token #3001
• OCPBUGS-93722: [release-4.22] Prometheus: Information disclosure of Azure OAuth client secret via config API #2976
• OCPBUGS-92193: set Prometheus shards value explicitly #2974
• OCPBUGS-88321: fix(TestDocExamples) flake: use internal registry for test pods #2965
• OCPBUGS-86807: jsonnet: exclude ReplicationController from catch-all … #2940
• OCPBUGS-86990: increase lookup interval #2945
• Full changelog

cluster-network-operator

• OCPBUGS-105556: [4.22] frr-k8s: use Recreate strategy for statuscleaner deployment #3130
• OCPBUGS-105512: Remove version-specific CNI binary copy logic #3114
• OCPBUGS-99744: Bump frr-k8s MAX_FDS from 1024 to 65536 #3090
• OCPBUGS-97939: bump containernetworking/cni v0.8.0 -> v1.3.0 #3044
• OCPBUGS-86033: Revert “[release-4.22] OCPBUGS-90721: NVIDIA-596: Enable dpu healthcheck” #3042
• OCPBUGS-84739: Use dedicated service accounts for multus pods #2985
• OCPBUGS-90721: NVIDIA-596: Enable dpu healthcheck #3009
• OCPBUGS-89244: NVIDIA-554: DPU-host mode: use ConfigMap for OVN feature enablement instead of per-node script gating #3029
• OCPBUGS-88307: Remove –enable-interconnect flag from OVN-K manifests #3028
• Full changelog

cluster-node-tuning-operator

• OCPBUGS-113579: Update PPC help description #1613
• OCPBUGS-112554: Use Add() instead of AddRateLimited() for routine Profile enqueues #1601
• OCPBUGS-104615: E2E: LLC: Restore uncore cache annotation to true #1577
• OCPBUGS-105873: BUG-FIX Latency Test #1583
• OCPBUGS-105535: Add missing annotations to NetworkPolicy manifests #1580
• OCPBUGS-99265: E2E: LLC: Pass fresh ctx variable to DeferCleanup functions #1567
• OCPBUGS-92011: e2e: fix: clear hugepages before switching kernelPageSize to 4k #1554
• OCPBUGS-99290: e2e: fix broken checks and rework netqueue tests to avoid ARM ethtool blackout flakes #1568
• OCPBUGS-98400: E2E: Add functional test cases checking GOMAXPROCS #1561
• OCPBUGS-98062: E2E: Fix tuned active profile check for wrapped performance profiles #1559
• OCPBUGS-87153: E2E: Refactor OVS affinity tests into shared helpers and add new workload-partitioning and control-plane reboot test cases. #1537
• OCPBUGS-93924: Let cri-o manage the GOMAXPROC for burstable pods #1555
• OCPBUGS-86071: perf: latency: compute memory resources dynamically #1520
• OCPBUGS-87891: Enable timer migrations for all use-cases #1542
• OCPBUGS-87158: e2e: Remove unnecessary len(numa) < 2 skip gates #1538
• OCPBUGS-84431: Bump github.com/moby/spdystream from v0.5.0 to v0.5.1 #1529
• Full changelog

cluster-olm-operator

• OCPBUGS-94187: Scale to replicas=2 and enable PDB on HighlyAvailable topology [release-4.22] #215
• Full changelog

cluster-openshift-apiserver-operator

• OCPBUGS-100168: Allow Prometheus to scrape check-endpoints metrics on port 17698 #743
• OCPBUGS-105443: Add HostToContainer mountPropagation to node-pullsecrets volume mount #748
• Full changelog

cluster-policy-controller

• OCPBUGS-98222: add serviceAccountToken volume type to psalabelsyncer #192
• Full changelog

cluster-samples-operator

• OKD-379: Fix missing namespace in database template image triggers #701
• Full changelog

cluster-storage-operator

• OCPBUGS-96622: Bump golang.org/x/net to v0.55.0 #722
• Full changelog

cluster-version-operator

• OCPBUGS-104545: pkg/cvo/egress: Disable Proxy respect on HyperShift #1438
• OCPBUGS-98572: Tolerate unknown template fields during payload loading #1421
• OCPBUGS-77681: Updating cluster-version-operator-container image to be consistent with ART for 4.22 #1331
• Full changelog

console

• OCPBUGS-114725: display operators in catalog when Tech Preview enabled #17114
• OCPBUGS-111417: make cloud provider fields optional during operator install #17014
• OCPBUGS-109521: Remove unscoped CSV watch from ClusterNotUpgradeableAlert #17013
• OCPBUGS-100519, OCPBUGS-101795: Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss #17054
• OCPBUGS-112271: Fix flaky TestAsyncCache backend test #17045
• OCPBUGS-105478: [release-4.22] OCPBUGS-83799: Fix Workloads sidebar ordering when DeploymentConfig is unavailable #16928
• Fix OCPBUGS-99414: CVE-2026-59877 #16834
• OCPBUGS-95402: Fix orphaned shell processes in pod terminal on WebSocket disconnect #16694
• Fix for OCPBUGS-101812: CVE-2026-69152 #16930
• Fix for OCPBUGS-105894: CVE-2026-73086 #16965
• OCPBUGS-87832: Use stable username hash for user-settings ConfigMap names #16565
• OCPBUGS-105611: [release-4.22] Fix leading whitespace in Quick Start execute code snippets #16951
• OCPBUGS-89705: Fix CVE-2026-12143 form-data CRLF injection #16644
• OCPBUGS-100059: quickstart page i18n misses (Fix Quick Starts i18n bundle lookup for zh-CN) #16869
• OCPBUGS-100317: Fix pod terminal not rendering until resize #16892
• OCPBUGS-100307: Re-enable Knative Cypress e2e tests #16889
• Fix OCPBUGS-98791: CVE-2026-48801 #16852
• OCPBUGS-99545: ‘0 B’ is shown on details page when create pvc with ‘EiB’ unit #16807
• OCPBUGS-99548: Incorrect translations for ‘CatalogSources’ and ‘OperatorGroups’ in l… #16809
• OCPBUGS-99259: Disable Knative e2e Cypress tests in CI #16784
• OCPBUGS-98437: CVE-2026-59869 bump js-yaml #16768
• OCPBUGS-97600: Fix devfile sample import by adding fallback for parent resolution failures #16706
• OCPBUGS-88028: Bump follow-redirects from 1.15.3 to 1.16.0 to fix CVE-2026-40895 #16665
• OCPBUGS-95580: Fix unnecessary error on Node Terminal tab #16696
• OCPBUGS-88748: [release-4.22] webpack-dev-server: Information disclosure and denial of service via improper proxy configuration #16656
• OCPBUGS-89337: Use fixed artifacts directory to prevent stale temp dir accumulation #16638
• OCPBUGS-90636: Fix RoleBindings tab error for non-cluster-admin users #16662
• OCPBUGS-90495: Projects cannot be filtered by display name #16652
• OCPBUGS-90110: Fix ColumnManagementModal not showing NamespaceColumnHelpText #16643
• Fix for OCPBUGS-84470: CVE-2026-4800 #16573
• OCPBUGS-87933, OCPBUGS-87985: Bump protobufjs and shell-quote #16619
• OCPBUGS-87997: Bump fast-uri to 3.1.2 to fix CVE-2026-6322 #16605
• OCPBUGS-88304: Allow VolumeSnapshot restore when parent PVC is deleted #16592
• OCPBUGS-87096: fixing severity not showing number of issues #16575
• OCPBUGS-86580: Fix macOS Option key in pod terminal #16504
• And 3 elided commits (e.g. from squash or rebase merges)
• Full changelog

console-operator

• OCPBUGS-81121: clone bump documentation base url #1154
• OCPBUGS-100387: Sort plugin list to make them deterministic #1165
• OCPBUGS-97828, OCPBUGS-97829: Stabilize telemetry config to prevent continuous console pod rollouts #1183
• OCPBUGS-94186: Add retry for transient API errors to prevent Degraded blips #1181
• OCPBUGS-94188: use ObservedGeneration to determine Progressing status #1180
• OCPBUGS-92829: Clean up old temp directories in downloads pod #1177
• OCPBUGS-86118: Add unit and e2e test coverage for cert rotation redeployment #1161
• Full changelog

container-networking-plugins, containernetworking-plugins-microshift

• OCPBUGS-83942: Bump grpc to 1.79.3 to address CVE-2026-33186 #243
• OCPBUGS-87165: CI build root image tag sync with ART 4.22 #240
• Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

• OCPBUGS-83552: Bump google.golang.org/grpc to 1.79.3 #395
• Full changelog

csi-external-provisioner

• OCPBUGS-96626: Bump golang.org/x/net to v0.57.0 #148
• OCPBUGS-84435: Bump github.com/moby/spdystream to v0.5.1 in 4.22 #136
• Full changelog

csi-external-resizer

• OCPBUGS-82031: Bump google.golang.org/grpc to v1.79.3 #199
• Full changelog

csi-external-snapshot-metadata

• OCPBUGS-83948: Bump google.golang.org/grpc to v1.79.3 #19
• Full changelog

csi-external-snapshotter, csi-snapshot-controller

• OCPBUGS-88723: UPSTREAM: 1392: Fix VolumeSnapshotContent deletion #222
• Full changelog

csi-node-driver-registrar

• OCPBUGS-84436: Bump github.com/moby/spdystream to v0.5.1 #105
• Full changelog

egress-router-cni

• OCPBUGS-97939: bump containernetworking/cni to v1.3.0 #103
• Full changelog

etcd

• OCPBUGS-82497: Rebase v3.6.13 for openshift-4.22 #393
• Full changelog

gcp-pd-csi-driver-operator

• OCPBUGS-86574: VolumeSnapshot snapshot-c9v52 is not ready within 5m0s… #193
• Full changelog

haproxy-router

• OCPBUGS-101956: Bump golang.org/x/net from v0.48.0 to v0.53.0 #834
• OCPBUGS-87166: Prevent SSRF via FQDN-typed EndpointSlices #813
• OCPBUGS-87167: Strip X-SSL-* headers for plain HTTP #793
• Full changelog

hyperkube, kube-proxy, pod

• OCPBUGS-98604: Add NodeSelectorAdjuster admission plugin for HCP clusters #2718
• NO-JIRA: Update openshift-hack/rebase.sh #2733
• OCPBUGS-96637: Bump golang.org/x/net from v0.47.0 to v0.55.0 #2737
• OCPBUGS-91744, OCPBUGS-93526, OCPBUGS-93551, OCPBUGS-95549, OCPBUGS-95556: Bump golang.org/x/crypto/ssh to v0.52.0 #2725
• OCPBUGS-99766: UPSTREAM: <carry>: upkeep cpu partitioning admission webhook #2724
• OCPBUGS-90148: Rebase v1.35.6 in release-4.22 #2707
• OCPBUGS-93787: backport kubernetes/conformance umbrella suite #2705
• OCPBUGS-86898: Fix performance related issues when selinux metrics are emitted #2676
• Full changelog

hypershift

• OCPBUGS-98328: fix(kubevirt): use only first MachineInternalIP per family in EndpointSlice endpoints #8979
• CNTRLPLANE-3774: [release-4.22] fix: control-plane-operator: improve opaque conditions #9058
• OCPBUGS-111083: fix(hcco): run kas-connection-checker as non-root #9320
• OCPBUGS-105866: remove redhat-marketplace catalog from HyperShift #9289
• OCPBUGS-105591: [release-4.22] use in-cluster service for oauth-server #9127
• OCPBUGS-96711: Apply MetricsSet relabel configs to KAS ServiceMonitor #8901
• OCPBUGS-105421: fix(upsert): add desired-state hash to detect spec field removals #9259
• OCPBUGS-101964: [release-4.22] OCPBUGS-98213: fix router component ordering to prevent missing HAProxy backends #9212
• OCPBUGS-100332: fix(konnectivity): conditionally prefer IPv4 based on HCP network config [release-4.22] #9191
• OCPBUGS-100141: Add proxy env vars to AWS cloud-controller-manager deployment #9156
• OCPBUGS-94518: add ACR pull identity to worker cloud.conf and VMSS #8865
• OCPBUGS-100299: Avoid printing errors twice #9183
• OCPBUGS-94170: fix registry override matching and propagation to init containers #8877
• OCPBUGS-100176: Remove hardcoded quay.io credentials from EnsureGlobalPullSecret test #9169
• OCPBUGS-90086: [release-4.22] clear stale EtcdRecoveryActive failure condition when etcd is healthy #8806
• OCPBUGS-99554: fix(backport): konnectivity agent auth to 4.22 #9077
• OCPBUGS-99299: [release-4.22] OCPBUGS-86296: Propagate management cluster proxy env vars to konnectivity sidecar #8592
• CNTRLPLANE-3884: Add spec.monitoring API for metrics forwarding #8872
• OCPBUGS-97921: fix(nodepool): skip CNI-internal IPs in ClusterNetworkCIDRConflict check #8948
• OCPBUGS-98627: Skip Azure topology LB scope override for ARO HCP IngressController #8998
• OCPBUGS-98220: fix(cpo,hcco): prevent premature KAS convergence during KMS key rotation [release-4.22] #8972
• OCPBUGS-90083: Fix NodePool reconciliation failure when updating mirrored immutable ConfigMaps #8811
• OCPBUGS-89236: Handle CA bundle aggregation delay by requeuing revocation #8746
• CNTRLPLANE-3749: feat(api,cpo): add observedGeneration to ControlPlaneComponentStatus #8868
• OCPBUGS-93921: bump catalog image version cap from 4.21 to 4.22 #8861
• OCPBUGS-88325: fix(cpo) delete terminated MCD pods to retry in-place upgrades #8729
• OCPBUGS-87364: Gate Route watch on management cluster capability #8692
• CNTRLPLANE-3661: add etcd data re-encryption after encryption key rotation (#8219) #8790
• OCPBUGS-88356: fix(cpo): deduplicate VPC endpoint subnets by AZ #8724
• CNTRLPLANE-3619: backport API-driven Azure topology and private connectivity (Phase 1) #8721
• OCPBUGS-90563: Fix metrics-proxy unbounded memory growth #8788
• OCPBUGS-89352: build(operator): drop hypershift-no-cgo from operator container images #8756
• OCPBUGS-86912: [release-4.22] Stop controllers fighting over HCP status #8632
• OCPBUGS-86039: OCPBUGS-62177: [release-4.22] Verify cert revocation against all KAS pods #8538
• Full changelog

ibm-vpc-block-csi-driver-operator

• OCPBUGS-83774: Bump google.golang.org/grpc to v1.79.3 #171
• Full changelog

ibmcloud-machine-controllers

• OCPBUGS-96641: bump golang.org/x/net to v0.57.0 #99
• Full changelog

insights-operator

• OCPBUGS-105227: secrets and configmap revisions count gathering #1339
• OCPBUGS-100173: Update installer dependency to use tagged version #1332
• OCPBUGS-100154: [release-4.22] Fix indentation bug on livenessProbe #1330
• OCPBUGS-96642: [release-4.22] Upgrade Golang and net library #1327
• OCPBUGS-98383: controlplanemachinesets gatherer #1318
• OCPBUGS-98153: update HyperShift deployment manifest #1315
• OCPBUGS-98381: Optimize the CPU usage of insights-runtime-extractor #1317
• OCPBUGS-88026: fall back to kube-system/global-pull-secret for Insights token #1305
• OCPBUGS-86818: extractor controller #1296
• Full changelog

ironic

• OCPBUGS-105863: update ironic pin to include CVE-2026-54423 fix (release-4.22) #889
• OCPBUGS-100167: Update openstack-ironic commit hash for CVE-2026-44918 #874
• OCPBUGS-88478: Update openstack-ironic commit hash in requirements.cachito that addresses CVE-2026-43003 #860
• OCPBUGS-98873: Selectively backport Redfish firmware update fix to 4.22 #870
• OCPBUGS-84369: selectively backport servicing patches to 4.22 #848
• Full changelog

ironic-agent

• OCPBUGS-99897: Bump ironic-python-agent pinned commit for CVE-2026-66138 #294
• OCPBUGS-88478: Update commit SHA in requirements.cachito to address CVE-2026-43003 #266
• OCPBUGS-95061: Replace individual package removal with a single rpm -e loop #282
• OCPBUGS-95061: Replace dnf remove with rpm -e to prevent dependency removal #270
• Full changelog

keepalived-ipfailover

• OCPBUGS-99767: Reinstall tzdata if /usr/share/zoneinfo is missing #247
• Updating openshift-enterprise-base-rhel9-container image to be consistent with ART for 4.22 #229
• OCPBUGS-72552: Updating openshift-enterprise-base-rhel9-minimal-container image to be consistent with ART for 4.22 #220
• Full changelog

kube-state-metrics

• OCPBUGS-87957: embed timezone data in kube-state-metrics binary #150
• OCPBUGS-87957: fix: don’t panic on CronJobs with unparseable schedules #147
• Full changelog

kubevirt-cloud-controller-manager

• OCPBUGS-69842: Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 4.22 #59
• Full changelog

kubevirt-csi-driver

• OCPBUGS-83883: Bump google.golang.org/grpc to v1.79.3 #107
• Full changelog

machine-config-operator

• OCPBUGS-112785: Revert TNF Graceful node shutdown #6461
• OCPBUGS-114418: [release-4.22] OCPBUGS-113615: Azure confidential clusters should be flagged by skew enforcement #6459
• OCPBUGS-114392: Use kubernetes scheme in drain controller event recorder #6458
• AGENT-1583: post-feature promotion (NoRegistryClusterInstall) openshift/api dependencies bump #6418
• OCPBUGS-112618: Fix upstreams for CoreDNS pods on Cloud platforms #6438
• OCPBUGS-112614: OCPBUGS-109739: Increase rpm-ostree rebase retry backoff and preserve error #6436
• OCPBUGS-105521: Fix SHA idempotency test in nmstate-configuration.sh #6392
• OCPBUGS-105929: Fix duplicate template error and e2es #6397
• Fixes OCPBUGS-105190: increase LRU cache and prefetch timeout for PinnedImageSet #6372
• OCPBUGS-105447: fix nil pointer panic in IRI controller informer race #6390
• OCPBUGS-105212: [release-4.22] Part2 Migrate OCB test-case #6374
• OCPBUGS-105213: Update AMI Whitelist #6375
• OCPBUGS-104563: Use providerSpec.Template in vSphere machineset reconciliation #6370
• OCPBUGS-100583: [release-4.22] Part 1 Migrate OCB test cases from openshift-tests-private #6361
• OCPBUGS-104576: [release-4.22] Add extension verification failure test cases OCP-89090 and OCP-89095 #6367
• OCPBUGS-104451: [release-4.22] fix fencing_validator ocdebug fence dispatch race condition #6360
• OCPBUGS-100293: Fix TC 43278 failing when release payload has no MCO commit info #6351
• AGENT-1548: Backport NoRegistryClusterInstall feature to release-4.22 #6323
• OCPBUGS-99712: Add TC 88940- Apply password only if changes exist #6339
• OCPBUGS-98962: [release4.22] MCO-1997: MCO-2297: MCO-2440 Add osImagestream test-cases #6301
• OCPBUGS-93804: move cleanUpDuplicatedMC to avoid double reboot on first updated Master node #6240
• OCPBUGS-97904: Inject proxy into MCC deployment #6275
• OCPBUGS-96145: Update AMI Whitelist #6260
• OCPBUGS-89329: Fix kubelet certificate wait loop in criometricsproxy.yaml #6200
• OCPBUGS-93743: Fix bootupd workaround in old nodes #6239
• OCPBUGS-92026: OCPEDGE-2474: TNF - Add fencing taint/untaint alert agent scripts #6230
• OCPBUGS-92022: MCO-2275: Migrate OS layering tests from openshift-tests-private #6218
• [release:4.22] OCPBUGS-88330: MCO-2209 MCO-2213 MCO-2207: Migrate security, daemon, and kernel TCs from mco.go #6171
• OCPBUGS-91958: Boot image skew check silently passes when MachineSets are reconcile-skipped #6227
• OCPBUGS-91954: Make vsphere template updates atomic #6226
• OCPBUGS-88184: Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole #6170
• OCPBUGS-88683: Process rebuild annotation on machine-os-builder restart #6190
• OCPBUGS-87981: Fix MCP.status.osImageStream #6164
• OCPBUGS-88496: Update custom containerfile OCB test to work in a disconnected environment #6188
• OCPBUGS-88001: Add mco_extensions.go e2e test suite for MCO extension install, enable, and validation #6184
• OCPBUGS-88329: In OCB to check when a image is removed the old build is triggered again and the MC should start updating directly and no new MOSB should be triggred #6175
• OCPBUGS-87019: fix: update arbiter crio config #6142
• OCPBUGS-88487: make test 69755 more stable #6186
• OCPBUGS-88331: [release-4.22] Remove skopeo-install script #6176
• OCPBUGS-84679: add RootCA cert to the sysContextBuilder certs #5897
• OCPBUGS-87840: vSphere boot image hot loop detection is non-functional due to stable template names #6157
• OCPBUGS-87900: [release-4.22] OCPBUGS-87181: MCO-2211: MCO-2210: MCO-2234 MCO-Migrate MCO tests from openshift-tests-private #6148
• OCPBUGS-88114: Skip chrony-wait on first node join #6168
• OCPBUGS-88120: daemon: don’t pull/extract extensions for all OS updates #6169
• OCPBUGS-87811: [release-4.22] OCPBUGS-87550: Update TC-88366 to check osImageStream status after update completes #6153
• OCPBUGS-87161: [release-4.22] OCPBUGS-87027: MCO-2212: MCO-2213: Migrate mco_observability and mco_daemon test-suite #6143
• OCPBUGS-86865: Stabilize ocl 4.22 #6115
• OCPBUGS-86985: MCO-2297: Add OCP-88366 and OCP-88814 for osImageStream with osImageURL #6083
• OCPBUGS-87163: Remove trailing newline (\n) characters in klog message strings #6147
• OCPBUGS-86893: Add version guard for OSStream rendering #6123
• OCPBUGS-86997: [release-4.22] OCPBUGS-86984: MCO-2273: MCO-2215: MCO-2183: Migrate remaining TCs from mco.go to MCO, units, kublet suite #6126
• OCPBUGS-86297: configure-ovs: copy lldp mode to br-ex port #6073
• OCPBUGS-86870: Update AMI Whitelist #6116
• OCPBUGS-86732: remove tests using base images older than 4.13 #6104
• And 1 elided commits (e.g. from squash or rebase merges)
• Full changelog

machine-os-images

• OCPBUGS-87872: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #96
• Full changelog

metallb-frr

• OCPBUGS-86568: Generate fallback BGP router-id on IPv6-only nodes #133
• Full changelog

monitoring-plugin

• OLS-3921: disable button shrink #1189
• OCPBUGS-98787: replace outdated react-linkify dependency #1150
• OCPBUGS-98787: replace outdated react-linkify dependency #1145
• OCPBUGS-98432: fix for CVE-2026-59869 #1114
• OU-1240: Makefile and package.json to enable test-frontend-ci #1094
• OCPBUGS-99032: Fix CVE-2026-49978 - bump DOMPurify to >= 3.4.7 #1085
• OCPBUGS-99234: graph redirect query parameter #1070
• OU-651: Fix AlertRules page to display user defined loki alerts #1057
• Fix for OCPBUGS-89698: CVE-2026-12143 #1053
• Fix for OCPBUGS-91628: CVE-2026-45736 #1023
• NO-JIRA: fix unit test severitySort and incidents #1036
• Fix for OCPBUGS-94005: CVE-2026-13676 #1028
• OU-1396: [release-4.22] fix: use replace to set variables to avoid navigation trap #1019
• OCPBUGS-87979: [release-4.22] fast-uri: URI authority bypass due to improper delimiter handling #989
• OCPBUGS-88413: [release-4.22] Fix CVE-2026-44494: bump axios to ^1.16.0 via overrides #997
• Full changelog

network-interface-bond-cni

• OCPBUGS-97943: Update OWNERS for release-4.22 #119
• Full changelog

networking-console-plugin

• OCPBUGS-82108: Marked strings for i18n in NetworkPolicies list page #475
• OCPBUGS-98788: Updating linkify-it to 5.0.2 to fix CVE-2026-48801 #464
• OCPBUGS-92205: Updated doc links based on release #438
• OCPBUGS-92196: fixed translations of pod column titles #437
• OCPBUGS-88314: Trim subnet input in UDN creation form #431
• CNV-90049: [UDN] Add condition column to the list page #432
• OCPBUGS-88025: Fix empty state Create button links #429
• And 1 elided commits (e.g. from squash or rebase merges)
• Full changelog

oauth-proxy

• OCPBUGS-93565: update x/crypto to v0.52.0 and x/net to v0.55.0 #369
• Full changelog

oauth-server

• OCPBUGS-84381: Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 #233
• Full changelog

oc-mirror

• OCPBUGS-105777: fix for CVE-2026-39829 #1501
• OCPBUGS-98716: Include index image sub-digests in dry run mapping.txt #1474
• OCPBUGS-93773: Make dry-run also generate cluster-resources #1457
• OCPBUGS-97946: skip manifest list signatures #1469
• OCPBUGS-88484: Include tag+digest images in both IDMS and ITMS #1442
• OCPBUGS-87806: fixes race condition when mirroring operator catalogs #1434
• Full changelog

olm-catalogd, olm-operator-controller

• OCPBUGS-102011: Bump golang.org/x/net to v0.53.0 to address CVE-2026-33814 #793
• OCPBUGS-100305: Fix cache path to avoid /var/cache/dnf conflict #783
• OCPBUGS-99298: increase catalog HTTP client timeout from 10s to 5m #768
• OCPBUGS-94187: enable OLMv1 topology-based deployment scaling e2e test #761
• OCPBUGS-94187: Backport HA topology deployment scaling to release-4.22 #758
• Full changelog

openshift-apiserver

• OCPBUGS-87022: fix concurrent map race in project authorization cache #653
• OCPBUGS-84454: Address CVE-2026-35469 #651
• Full changelog

openstack-machine-api-provider

• OCPBUGS-97826: Revendor CAPO #175
• Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

• OCPBUGS-101995: Bump golang.org/x/net to v0.53.0 to address CVE-2026-33814 #1362
• OCPBUGS-95441, OCPBUGS-95458: bumping containerd to v1.7.33 #1353
• Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

• OCPBUGS-112496: NO-JIRA: Branch Sync main to release-4.22 [08-18-2026] #3406
• OCPBUGS-99043: Branch Sync main to release-4.22 [08-13-2026] #3394
• OCPBUGS-105515, OCPBUGS-105604: Branch Sync main to release-4.22 [08-10-2026] #3373
• OCPBUGS-95560: Branch Sync main to release-4.22 [08-04-2026] #3358
• OCPBUGS-100119, OCPBUGS-95064: Branch Sync main to release-4.22 [07-28-2026] #3333
• OCPBUGS-99043: Branch Sync main to release-4.22 [07-16-2026] #3304
• OCPBUGS-88733, OCPBUGS-88734: Branch Sync main to release-4.22 [06-16-2026] #3252
• OCPBUGS-88718: Branch Sync main to release-4.22 [06-10-2026] #3244
• OCPBUGS-87214: Branch Sync main to release-4.22 [06-05-2026] #3232
• Full changelog

prometheus

• OCPBUGS-93732: fix for CVE-2026-42151 #355
• OCPBUGS-93919: fix(tsdb): temporarily ignore Direct IO enablement errors on unsupported filesystems #339
• OCPBUGS-92818: bump x/crypto, x/net, and otel dependencies to fix CVEs #337
• OCPBUGS-88666: remote: validate snappy decoded length before allocation in read endpoint #330
• Full changelog

prometheus-alertmanager

• OCPBUGS-98185: build(deps): bump github.com/hashicorp/memberlist from 0.5.4 to 0.6.0 #157
• OCPBUGS-99442: embed tzdata in the alertmanager binary #141
• Full changelog

stream-coreos, stream-coreos-extensions

• OCPBUGS-105444: NetworkManager-ovs has moved to RHCOS #1956
• NO-JIRA: Containerfile: restore meta.json as last layer in image #1950
• And 7 elided commits (e.g. from squash or rebase merges)
• Full changelog

tests

• AGENT-1583: post-feature promotion (NoRegistryClusterInstall) openshift/api dependencies bump #31565
• OCPBUGS-111831: tolerate one NotReady CP node in EnsureNodesReady for degraded TNF #31527
• OCPBUGS-100438: retry GetVotingMemberNames on transient etcd client fails #31506
• OCPBUGS-88711: Backport node_e2e test migrations #31306
• AGENT-1549: Backport NoRegistryClusterInstall feature to release-4.22 #31406
• SPLAT-2802: Added VVCDO OTE binary to extensionBinary list #31321
• SPLAT-2794: Added 3CMO OTE binary to extensionBinary list #31303
• OCPBUGS-90522: Use AdminPolicyBasedExternalRoute CR for external gateway test #31317
• OCPBUGS-87838: support Parents field on origin test suites #31270
• OCPBUGS-92656: bump openshift-tests-extension to fix klog stdout parsing on 4.22 #31349
• OCPBUGS-92048: fix PDB AlwaysAllow test failure on IPv6-primary dualstack clusters #31337
• OCPBUGS-92047: Fix AWS DualStack CI jobs consistently encounter 2 EgressFirewall Test Failures #31336
• Full changelog

thanos

• OCPBUGS-105471: UPSTREAM: <carry>: bump google.golang.org/grpc to v1.82.1 (GHSA-hrxh-6v49-42gf) #199
• COO-2034, OCPBUGS-105219, OCPBUGS-105223, OCPBUGS-105224: [release-4.22] vendor: bump vulnerable Go dependencies for GovCloud CVE remediation #197
• OCPBUGS-96898: Address CVE-2026-39882 #192
• OCPBUGS-92813: Fix CVE-2026-39883 #191
• Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

• UPSTREAM: 187: OCPBUGS-96686: Bump golang.org/x/net to v0.50.0-sec.4 #195
• OCPBUGS-95573: Bump golang.org/x/crypto/ssh to v0.48.0-sec.1 #189
• OCPBUGS-92190: Rebase 3.6.2 on 422 #188
• OCPBUGS-83636: Bump spdystream to v0.5.1 #180
• Full changelog

vsphere-csi-driver-operator

• SPLAT-2802: Port vSphere hybrid OTE to release-4.22 #349
• Full changelog

vsphere-problem-detector

• OCPBUGS-102050: Bump golang.org/x/net to 0.53.0 #229
• OCPBUGS-86866: Fixed compute cluster permission logic for single fd with read-only custom resourcepool #221
• Full changelog

---

Node Image Info

Loading node image info, this may take a while ...

Unable to show node image info: failed to fetch RPM diff for stream stream-coreos: could not generate RPM diff for quay.io/okd/scos-release@sha256:be199cd105e876d43de410e34ea953b67851cea185c25046e5a93e1084eac6a0 to quay.io/okd/scos-release@sha256:ec8d6dc47890317f33f435200bd7b2de7746c84f2c3d3c39d38510fd9aec6833 (rpmdb-image stream-coreos): could not run oc command: error: unable to read image quay.io/okd/scos-release@sha256:ec8d6dc47890317f33f435200bd7b2de7746c84f2c3d3c39d38510fd9aec6833: endpoint "https://quay.io" does not support v2 API (got 502 Bad Gateway)

View changelog in Markdown or change previous release: 4.22.0-okd-scos.84.22.0-okd-scos.74.22.0-okd-scos.64.22.0-okd-scos.54.22.0-okd-scos.44.22.0-okd-scos.34.22.0-okd-scos.24.22.0-okd-scos.14.22.0-okd-scos.04.21.0-okd-scos.114.21.0-okd-scos.104.21.0-okd-scos.94.21.0-okd-scos.84.21.0-okd-scos.74.21.0-okd-scos.64.21.0-okd-scos.54.21.0-okd-scos.44.21.0-okd-scos.34.21.0-okd-scos.24.21.0-okd-scos.14.21.0-okd-scos.04.20.0-okd-scos.174.20.0-okd-scos.164.20.0-okd-scos.154.20.0-okd-scos.144.20.0-okd-scos.134.20.0-okd-scos.124.20.0-okd-scos.114.20.0-okd-scos.104.20.0-okd-scos.94.20.0-okd-scos.84.20.0-okd-scos.74.20.0-okd-scos.64.20.0-okd-scos.54.20.0-okd-scos.44.20.0-okd-scos.34.20.0-okd-scos.24.20.0-okd-scos.14.20.0-okd-scos.04.19.0-okd-scos.194.19.0-okd-scos.184.19.0-okd-scos.174.19.0-okd-scos.164.19.0-okd-scos.154.19.0-okd-scos.144.19.0-okd-scos.134.19.0-okd-scos.124.19.0-okd-scos.114.19.0-okd-scos.104.19.0-okd-scos.94.19.0-okd-scos.84.19.0-okd-scos.74.19.0-okd-scos.64.19.0-okd-scos.54.19.0-okd-scos.44.19.0-okd-scos.34.19.0-okd-scos.24.19.0-okd-scos.14.19.0-okd-scos.04.18.0-okd-scos.104.18.0-okd-scos.94.18.0-okd-scos.84.18.0-okd-scos.74.18.0-okd-scos.64.18.0-okd-scos.54.18.0-okd-scos.44.18.0-okd-scos.34.18.0-okd-scos.24.18.0-okd-scos.14.18.0-okd-scos.04.17.0-okd-scos.34.17.0-okd-scos.24.17.0-okd-scos.14.17.0-okd-scos.04.16.0-okd-scos.14.16.0-okd-scos.0───5.1.0-0.okd-scos-nightly-2026-09-01-1341515.1.0-0.okd-scos-nightly-2026-09-01-0141515.1.0-0.okd-scos-nightly-2026-08-31-1341515.1.0-0.okd-scos-nightly-2026-08-31-0137135.1.0-0.okd-scos-nightly-2026-08-30-1337135.1.0-0.okd-scos-nightly-2026-08-30-013713───5.1.0-0.okd-scos-2026-09-02-0454405.1.0-0.okd-scos-2026-08-06-182818───5.0.0-0.okd-scos-nightly-2026-09-01-1724245.0.0-0.okd-scos-nightly-2026-09-01-0524245.0.0-0.okd-scos-nightly-2026-08-28-0753255.0.0-0.okd-scos-nightly-2026-08-27-1953255.0.0-0.okd-scos-nightly-2026-08-27-0753255.0.0-0.okd-scos-nightly-2026-08-26-1953255.0.0-0.okd-scos-nightly-2026-08-26-0753255.0.0-0.okd-scos-nightly-2026-08-25-195325───5.0.0-0.okd-scos-2026-09-02-0537405.0.0-0.okd-scos-2026-09-01-1737405.0.0-0.okd-scos-2026-09-01-0537405.0.0-0.okd-scos-2026-08-31-1737405.0.0-0.okd-scos-2026-08-31-0537405.0.0-0.okd-scos-2026-08-30-173740───4.23.0-0.okd-scos-nightly-2026-08-22-0639414.23.0-0.okd-scos-nightly-2026-08-21-1839414.23.0-0.okd-scos-nightly-2026-06-19-2121094.23.0-0.okd-scos-nightly-2026-06-19-0921094.23.0-0.okd-scos-nightly-2026-03-09-153314───4.23.0-0.okd-scos-2026-08-01-0343024.23.0-0.okd-scos-2026-07-31-1543024.23.0-0.okd-scos-2026-07-29-1405184.23.0-0.okd-scos-2026-03-09-153314───4.22.0-0.okd-scos-nightly-2026-09-02-0114464.22.0-0.okd-scos-nightly-2026-09-01-1314464.22.0-0.okd-scos-nightly-2026-09-01-0114464.22.0-0.okd-scos-nightly-2026-08-31-1314464.22.0-0.okd-scos-nightly-2026-08-28-1359114.22.0-0.okd-scos-nightly-2026-08-28-015911───4.22.0-0.okd-scos-2026-09-02-0258504.22.0-0.okd-scos-2026-09-01-1458504.22.0-0.okd-scos-2026-09-01-0258504.22.0-0.okd-scos-2026-08-31-1458504.22.0-0.okd-scos-2026-08-31-025700───4.21.0-0.okd-scos-nightly-2026-09-02-0100554.21.0-0.okd-scos-nightly-2026-09-01-1300554.21.0-0.okd-scos-nightly-2026-09-01-0100554.21.0-0.okd-scos-nightly-2026-08-29-1242044.21.0-0.okd-scos-nightly-2026-08-28-180713───4.21.0-0.okd-scos-2026-07-29-0152434.21.0-0.okd-scos-2026-07-28-1352434.21.0-0.okd-scos-2026-07-27-2036484.21.0-0.okd-scos-2026-07-22-1643374.21.0-0.okd-scos-2026-07-22-0443374.21.0-0.okd-scos-2026-07-21-1643374.21.0-0.okd-scos-2026-07-21-0443374.21.0-0.okd-scos-2026-07-20-1643374.21.0-0.okd-scos-2026-07-14-1808504.21.0-0.okd-scos-2026-07-14-012503───4.20.0-0.okd-scos-2026-02-10-1309514.20.0-0.okd-scos-2026-02-07-0016394.20.0-0.okd-scos-2026-02-06-1216394.20.0-0.okd-scos-2026-02-06-0016394.20.0-0.okd-scos-2026-02-05-1216384.20.0-0.okd-scos-2026-02-05-001637───4.19.0-0.okd-scos-2025-10-25-0018304.19.0-0.okd-scos-2025-10-24-1218294.19.0-0.okd-scos-2025-10-24-0018284.19.0-0.okd-scos-2025-10-23-1218284.19.0-0.okd-scos-2025-10-23-001828───4.18.0-0.okd-scos-2025-05-27-0825374.18.0-0.okd-scos-2025-05-26-2025374.18.0-0.okd-scos-2025-05-26-0825374.18.0-0.okd-scos-2025-05-23-0333574.18.0-0.okd-scos-2025-05-22-153357───4.17.0-0.okd-scos-2025-02-25-0904554.17.0-0.okd-scos-2025-02-24-2104554.17.0-0.okd-scos-2025-02-24-0904544.17.0-0.okd-scos-2025-02-23-2104544.17.0-0.okd-scos-2025-02-22-211215───4.16.0-0.okd-scos-2025-01-06-1432414.16.0-0.okd-scos-2025-01-04-1456004.16.0-0.okd-scos-2025-01-04-0142364.16.0-0.okd-scos-2025-01-03-1342364.16.0-0.okd-scos-2025-01-03-0142364.16.0-0.okd-scos-2024-12-17-0222464.16.0-0.okd-scos-2024-11-24-1100454.16.0-0.okd-scos-2024-11-23-1818454.16.0-0.okd-scos-2024-11-23-0618454.16.0-0.okd-scos-2024-11-22-1818454.16.0-0.okd-scos-2024-11-22-061845───4.15.0-0.okd-scos-2024-12-16-1913164.15.0-0.okd-scos-2024-01-18-1035224.15.0-0.okd-scos-2024-01-17-2235214.15.0-0.okd-scos-2024-01-17-1035204.15.0-0.okd-scos-2024-01-16-223519───4.15.0-0.okd-2025-06-27-1341344.15.0-0.okd-2025-06-17-1652194.15.0-0.okd-2025-05-02-1402244.15.0-0.okd-2025-04-03-2126204.15.0-0.okd-2025-04-02-1800124.15.0-0.okd-2024-03-27-1109014.15.0-0.okd-2024-03-26-2309014.15.0-0.okd-2024-03-23-1640104.15.0-0.okd-2024-03-23-0440104.15.0-0.okd-2024-03-22-164010───4.22.0-okd-scos.ec.164.22.0-okd-scos.ec.154.22.0-okd-scos.ec.144.22.0-okd-scos.ec.134.22.0-okd-scos.ec.124.22.0-okd-scos.ec.114.22.0-okd-scos.ec.104.22.0-okd-scos.ec.94.22.0-okd-scos.ec.84.22.0-okd-scos.ec.74.22.0-okd-scos.ec.64.22.0-okd-scos.ec.54.22.0-okd-scos.ec.44.22.0-okd-scos.ec.34.22.0-okd-scos.ec.24.22.0-okd-scos.ec.14.22.0-okd-scos.ec.04.21.0-okd-scos.ec.194.21.0-okd-scos.ec.184.21.0-okd-scos.ec.174.21.0-okd-scos.ec.164.21.0-okd-scos.ec.154.21.0-okd-scos.ec.144.21.0-okd-scos.ec.134.21.0-okd-scos.ec.124.21.0-okd-scos.ec.114.21.0-okd-scos.ec.104.21.0-okd-scos.ec.94.21.0-okd-scos.ec.84.21.0-okd-scos.ec.74.21.0-okd-scos.ec.64.21.0-okd-scos.ec.54.21.0-okd-scos.ec.44.21.0-okd-scos.ec.34.21.0-okd-scos.ec.24.21.0-okd-scos.ec.14.21.0-okd-scos.ec.0───4.15.0-0.okd-2024-03-10-0101164.15.0-0.okd-2024-02-23-1634104.15.0-0.okd-2024-02-10-0355344.15.0-0.okd-2024-01-27-070424───5.0.0-okd-scos.ec.85.0.0-okd-scos.ec.75.0.0-okd-scos.ec.65.0.0-okd-scos.ec.55.0.0-okd-scos.ec.45.0.0-okd-scos.ec.35.0.0-okd-scos.ec.25.0.0-okd-scos.ec.15.0.0-okd-scos.ec.0

Source code for this page located on github