5.1.0-0.okd-scos-nightly-2026-11-14-075739

Download installer and client with:

oc adm release extract --tools registry.ci.openshift.org/origin/release-scos:5.1.0-0.okd-scos-nightly-2026-11-14-075739

Qualifiers (status api): None

Tests:

Blocking jobs
- aws Failed (2 retries) periodic-ci-openshift-release-main-okd-scos-5.1-e2e-aws-ovn
- aws-upgrade Failed (2 retries) periodic-ci-openshift-release-main-okd-scos-5.1-e2e-aws-ovn-upgrade
Informing jobs
- agent-single-node-ipv6 Failed periodic-ci-openshift-release-main-okd-scos-5.1-e2e-agent-single-node-ipv6
- aws-ovn-techpreview Failed (2 retries) periodic-ci-openshift-release-main-okd-scos-5.1-e2e-aws-ovn-techpreview
- aws-upgrade-minor Failed periodic-ci-openshift-release-main-okd-scos-5.1-upgrade-from-okd-scos-5.0-e2e-aws-ovn-upgrade
- gcp Succeeded periodic-ci-openshift-release-main-okd-scos-5.1-e2e-gcp
- vsphere Failed periodic-ci-openshift-release-main-okd-scos-5.1-e2e-vsphere-ovn
Async jobs
- claude-payload-agent Succeeded periodic-ci-openshift-release-main-claude-payload-agent-okd-scos-no-slack

Upgrades from:

Changes from 5.0.0-0.okd-scos-nightly-2026-11-13-145239

Created: 2026-11-14 07:57:46 +0000 UTC

Image Digest: sha256:09db921c0be4c97ecf6cdc564a1618ec3231f0f7d3525e71bfa1bd0a4a0f57dd

Components

Kubectl upgraded from 1.36.5 to 1.37.1
Kubernetes upgraded from 1.36.6 to 1.37.2
Kubernetes Tests 1.36.2
CentOS Stream CoreOS 10 10.0.20261110-0

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	OKD Hypershift	OKD SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
AWSServiceLBNetworkSecurityGroup (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
AzureWorkloadIdentity (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
BootImageSkewEnforcement (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
DualReplica (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ImageStreamImportMode (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
SELinuxMountGAReadiness (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
SigstoreImageVerification (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
SigstoreImageVerificationPKI (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
UpgradeStatus (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
VSphereMultiDisk (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
VSphereMultiNetworks (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
VolumeGroupSnapshot (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
AzureMultiDisk (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled
CRDCompatibilityRequirementOperator (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled
GatewayAPIManagementMode (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled
KMSEncryption (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled
SELinuxMount (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled
TLSAdherence (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled
AuthenticationComponentProxy (0 tests)	Disabled	Enabled (Changed)	Disabled	Enabled	Disabled	Enabled (Changed)	Disabled	Enabled
OLMLifecycleAndCompatibility (0 tests)	Disabled	Disabled	Disabled	Disabled (Changed)	Disabled	Disabled (Changed)	Disabled	Disabled
AuthenticationComponentProxyExternalOIDC (0 tests)			Enabled (New)	Enabled (New)
BareMetalHostV1Beta1 (0 tests)			Enabled (New)	Enabled (New)
ClusterAPIMachineManagementNutanix (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ClusterAPIOperator (0 tests)				Enabled (New)				Enabled (New)
CompositePodGroup (0 tests)
ControllerManagerConfig (0 tests)				Enabled (New)				Enabled (New)
DRAWorkloadResourceClaims (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
EgressIPNodeSelector (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ExternalOIDCAsWebhook (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
GenericWorkload (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
GomaxprocsInjection (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
IngressControllerLBSecurityGroupsAWS (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
MACSecurity (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
MachineAPIMigrationNutanix (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
ManagedBootImagesAWSCAPI (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
MetalEnrollmentAPI (0 tests)			Enabled (New)	Enabled (New)
MetalHostClaimsAPI (0 tests)			Enabled (New)	Enabled (New)
OVNKubernetesUplinkMode (0 tests)			Enabled (New)	Enabled (New)
OpenStackMaxAllowedAddressPairs (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
StoragePathAlert (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
TNFObservability (0 tests)				Enabled (New)				Enabled (New)
TopologyAwareWorkloadScheduling (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
UnifiedClusterManagedDNSAndLB (0 tests)				Enabled (New)
VSpherePerComponentScopedCredsInstall (0 tests)			Enabled (New)	Enabled (New)

New images

azure-karpenter-provider-azure git bc70c724 sha256:e0916be59beaaae710134556061a9f3e6fb2d0fe0744d1753e5f1508df12adef
csi-volume-device-exporter git 2f805565 sha256:da9d6687716c29e4095affb8d31771400c47e5b8260f6993203779457f10795c
haproxy-router-haproxy34 git ce6dd57b sha256:103aa9ae3faff486aa1939a4c762a76069434a4ff75c59d1900e3511195dfe71

Removed images

cluster-kube-cluster-api-operator
configmap-reloader
haproxy-router-haproxy28
oc-mirror

Rebuilt images without code change

aws-pod-identity-webhook git 0d33a459 sha256:d2a2b342ca8d269336c333c438dc667578d3fc44fba571b014c71798eb6317fb
cluster-openshift-controller-manager-operator git 8da2f1fc sha256:af3f8580414042a55a88065f9b802a0e075dc5bf82c064e6bbae1ca101cc4a3f
cluster-update-keys git 9607604d sha256:34477b0fec38915bc6f16a50a7179a8fb51d6a152a4f0c7d2379f1be0b851d91
driver-toolkit git b63b175a sha256:18425a0208db81494b1decbe13e3b3ae109b0db27000a72d637ce2942d0c9da8
gcp-workload-identity-federation-webhook git 4501ff2f sha256:4e7e2d7ab5a1f759b6606b5e28e6105fd3aa61f33d1020e31c2190ae66b895f6
ironic-machine-os-downloader git f8e41b2e sha256:e9eeb0b1458793c0b7409162a2cdc687b6e41ffed735f3a1771bf3a3c6cf1e5c
ironic-static-ip-manager git 486a0418 sha256:3ad63cd73ae3a7f30bd66d670f73f81a7196b26c025090ff498a524856b1e5d3
service-ca-operator git ed872ba1 sha256:7e271c7cc5ebc76ede6af2736b5e9c15e35fbc75b39d77fef1a912161dbef98a

agent-installer-api-server

MGMT-25660: Compare network CIDRs as sets to prevent reconciliation loops #11501
NO-ISSUE: Disable security PRs from MintMaker #11502
Revert “MGMT-24854: Cilium CNI is not supported on OCP 4.22” #11378
MGMT-25637: Prepare 5.0 stable versions assisted-service upstream #11384
ACM-47237: Add support for TLS groups #11354
NO-ISSUE: [master] Bump OCP versions: 4.20, 4.21, 4.16, 5.0, 4.22, 4.14, 4.19, 4.18 #11372
MGMT-25638: Bump LSO version override to 5.1 #11358
NO-ISSUE: Refresh RPM lockfiles #11362
MGMT-25105: Add arbiter role to preflight-requirements endpoint #11342
ACM-49570: Backfill Day-2 spoke BMH and Machine #11355
MGMT-24988: Allow clearing SSH authorized key via empty string #11353
NO-ISSUE: Add unit test requirement to AGENTS.md #11338
OCPBUGS-136116: Reset a host’s validations_info after re-register/bind/unbind #11337
NO-ISSUE: [master] Bump OCP versions: 4.17, 4.14, 4.13, 4.16, 4.22, 4.18, 4.21, 4.20 #11339
MGMT-25555: Graduate support level from dev-preview to supported for GA operators #11326
NO-ISSUE: [master] Bump OCP versions: 4.19, 5.0 #11336
NO-ISSUE: Refresh RPM lockfiles #11331
NO-ISSUE: [master] Bump OCP versions: 4.14, 4.18, 4.20, 4.16, 4.22, 4.19, 4.21, 5.0 #11323
MGMT-25002: Prevent host event leaks across InfraEnvs #11036
MGMT-25583: CVE-2026-116587 Bump github.com/go-jose/go-jose/v4 to v4.1.6 #11321
NO-ISSUE: Refresh RPM lockfiles #11297
NO-ISSUE: [master] Bump OCP versions: 4.19 #11278
MGMT-25480: Sync NTP sources from CRD spec by comparing to DB #11198
NO-ISSUE: [master] Bump OCP versions: 4.21, 4.20, 4.22 #11270
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #11264
OCPEDGE-3082: Skip dnsmasq for UnifiedClusterManagedDNSAndLB FG + SNO + None platform #11228
ACM-48279: Cilium blocks infrastructure-operator access to the Kubernetes API #11245
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #11254
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #11043
ACM-44934: CVE-2026-88031 Bump go.mongodb.org/mongo-driver to v1.17.10 using replace directive #11220
NO-ISSUE: [master] Bump OCP versions: 4.13, 4.16, 4.17, 4.18, 5.0 #11240
NO-ISSUE: [master] Bump OCP versions: 4.22, 4.19 #11229
NO-ISSUE: [master] Bump OCP versions: 4.20, 4.21 #11205
AGENT-1648: Set fips in install-config for the agent-based installer #11114
NO-ISSUE: [master] Bump OCP versions: 5.0 #11204
MGMT-19216: Add node selector and tolerations to our webhook #11049
ACM-44934: CVE-2026-88031 Bump github.com/go-openapi/loads, github.com/go-openapi/analysis, github.com/go-openapi/validate, github.com/go-openapi/strfmt to fix CVE-2026-88031 through introducers update (models module) #11165
MGMT-25133: Accept OpenSSH authorized_keys options in SSH key validation #10830
ACM-44934: CVE-2026-88031 Bump go.mongodb.org/mongo-driver to v1.17.10 through indirect dependency conversion (api module) #11164
ACM-47334: CVE-2026-63209 Bump github.com/klauspost/compress to v1.18.7 through indirect dependency conversion #11149
NO-ISSUE: upgrade Go to 1.26.7 #11119
NO-ISSUE: [master] Bump OCP versions: 4.16, 4.14, 4.19 #11197
ACM-47458: CVE-2026-84304 Bump google.golang.org/grpc to v1.83.1 using replace directive (api module) #11185
ACM-44934: CVE-2026-88031 Bump go.mongodb.org/mongo-driver to v1.17.10 through indirect dependency conversion (client module) #11195
ACM-47334: CVE-2026-63209 Bump github.com/klauspost/compress to v1.18.7 using replace directive (api module) #11155
ACM-47334: CVE-2026-63209 Bump github.com/klauspost/compress to v1.18.7 using replace directive (models module) #11156
ACM-47334: CVE-2026-63209 Bump github.com/klauspost/compress to v1.18.7 using replace directive (client module) #11157
ACM-47458: CVE-2026-84304 Bump google.golang.org/grpc to v1.83.1 through indirect dependency conversion #11139
NO-ISSUE: [master] Bump OCP versions: 4.22, 4.20, 4.21 #11094
MGMT-25505: moving seaweedfs to our own repo #11085
MGMT-25497: Use OCP version for disconnected iso images #11062
ACM-39262: chain PostgreSQL hops for EUS skip-upgrades #10882
MGMT-24807: OpenShift AI validation message is confusing — doesn’t state role and shows a different (lower) CPU/RAM number than the aggregated worker-role requirement #10969
MGMT-23594: Installation should not be stopped if we can’t pull the must gather image #10935
OCPBUGS-104857: Disk validation falsely reports iSCSI host IP conflict when iBFT initiator uses DHCP (flags=7) on dual-homed host #11007
NO-ISSUE: [master] Bump OCP versions: 4.14, 4.20, 5.0, 4.22, 4.16, 4.21, 4.18, 4.19, 4.17 #11084
MGMT-25505: minio was deprecated #11050
NO-ISSUE: [master] Bump OCP versions: 4.22, 4.19, 4.20, 4.21 #11004
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #10957
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #10958
NO-ISSUE: [master] Bump OCP versions: 5.0, 4.18, 4.19, 4.13 #10980
MGMT-25431: CVE-2026-84445 Bump google.golang.org/grpc to v1.82.2 through indirect dependency conversion #10975
MGMT-24967: Static-IP iSCSI Boot-from-SAN Support in Assisted Installer #10925
OCPBUGS-115550: Allow agent-installer invoker to have a suffix #10968
MGMT-25123: create endpoint for listing OVE images #10933
MGMT-25355: Migrate to harness-agnostic agent configuration layout #10966
ACM-38075: Assisted Service Agent controller does not approve day-2 CSRs for worker nodes provisioned with pre-existing BMHs via ClusterInstance scale-out #10944
NO-ISSUE: [master] Bump OCP versions: 4.21, 5.0, 4.16, 4.14, 4.22, 4.20, 4.19 #10967
MGMT-24854: Cilium CNI is not supported on OCP 4.22 #10819
MGMT-25367: consider imageType when selecting OpenShift version #10917
MGMT-25406: Add OpenShift-compatible CIDR length validation #10948
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #10946
NO-ISSUE: [master] Bump OCP versions: 4.21, 4.22, 4.20 #10942
ACM-41555: Enable PQC in Dockerfiles #10901
MGMT-25131: When getting the release image for a cluster we should always prioritize cluster.OcpReleaseImage if it’s set #10938
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #10941
NO-ISSUE: [master] Bump OCP versions: 5.0 #10937
APPSRE-14688: remove legacy monitoring.coreos.com/v1 ServiceMonitors #10931
NO-ISSUE: [master] Bump OCP versions: 4.17, 5.0 #10924
OCPBUGS-120683: Fix NUMAResourcesOperator CR name so it can be applied #10910
NO-ISSUE: Update operator bundle channel to ocm-5.1 #10867
OCPBUGS-120675: added missing subscription name for lvms-operator #10909
AGENT-1529: Add ovnKubernetesConfig to install-config definition #10430
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #10912
NO-ISSUE: [master] Bump OCP versions: 4.17, 4.19, 4.20, 4.16, 4.21 #10907
NO-ISSUE:Bump go.opentelemetry.io/otel to v1.44.0 in master #10869
MGMT-25130: assisted-service and assisted-image-service NetworkPolicy ingress has no source restriction (any pod in any namespace can reach them directly) #10906
NO-ISSUE: Modify Konflux YAMLs to ocm-5.1 #10874
MGMT-25139: Allow setting os-stream on both clusters and infraenvs #10742
MGMT-20398: Force status on bmh after install #10606
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #10884
MGMT-24877: Improve sensitive credential redaction #10857
OCPBUGS-29975: Allow multiple machine networks for UMN clusters #10817
MGMT-21334: Don’t check ImageSetRef for installed clusters #10854
NO-ISSUE: Add missing Close() #10856
MGMT-24693: fix e2e-ai-operator-disconnected-capi #10806
ACM-42573: Assisted services’ networkpolicy doesn’t work for external image service and local image registry in disconnected environment #10850
MGMT-25066: Add continuous node label reconciliation in InfraEnv controller #10813
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #10829
MGMT-25065: Add InfraEnv to Agent node label propagation #10812
NO-ISSUE: Add same-namespace egress for image-service to assisted-service #10816
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

NO-ISSUE: Update module github.com/sigstore/fulcio to v1.8.6 [SECURITY] #2593
NO-ISSUE: Update module github.com/metal3-io/baremetal-operator/apis to v0.8.1 [SECURITY] #2601
NO-ISSUE: Update go toolchain directive to v1.26.11 [SECURITY] #2582
NO-ISSUE: Update module github.com/opencontainers/runc to v1.3.6 [SECURITY] #2609
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #2575
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #2570
OCPBUGS-136026: Update github.com/klauspost/compress to fix CVE-2026-116591 #2532
MGMT-18684: CVE-2026-19706 validate CSRs during assisted installation #2542
OCPBUGS-132570: Preserve firstboot network config across OS image replacement #2465
NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.15.0 #2477
ACM-44932: CVE-2026-88031 Bump go.mongodb.org/mongo-driver to v1.17.10 through indirect dependency conversion #2443
MGMT-25001: Bump Go to 1.26.7 for stdlib CVEs #2432
NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.14.0 #2389
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #2417
NO-ISSUE: Refresh RPM lockfiles #2418
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #2330
NO-ISSUE: migrate Renovate config #2363
MGMT-25156: Fix CVE-2026-17106 #2328
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #2339
OCPBUGS-115550: Allow agent-installer invoker to have a suffix #2341
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #2326
ACM-41555: Enable PQC in Dockerfiles #2307
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #2309
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #2304
MGMT-24885: Harden command construction and credential handling #2275
NO-ISSUE: Add approver bluesort #2286
NO-ISSUE: Modify Konflux YAMLs to ocm-5.1 #2281
NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.13.2 #2285
NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.13.1 #2273
NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.13.0 #2271
Full changelog

agent-installer-node-agent

NO-ISSUE: Refresh RPM lockfiles [SECURITY] #1789
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #1768
NO-ISSUE: Refresh RPM lockfiles #1774
MGMT-25567: fix(apivip_check): honor HTTPS proxy with custom CA #1737
NO-ISSUE: Refresh RPM lockfiles #1757
NO-ISSUE: Refresh RPM lockfiles #1705
OCPBUGS-130428: Bump golang.org/x/crypto to v0.56.0 to fix CVE-2026-56855 #1718
OCPBUGS-130445: CVE-2026-78662 Bump golang.org/x/crypto to v0.56.0 #1719
ACM-44931: CVE-2026-88031 Bump go.mongodb.org/mongo-driver to v1.17.10 through indirect dependency conversion #1716
MGMT-24979: Bump Go to 1.26.7 for stdlib CVEs #1696
MGMT-25508: Exclude ASPEED 1a03:2000 from GPU inventory #1694
MGMT-23804: GPU inventory incorrectly includes non-GPU PCI devices (DPU/SmartNIC devices) #1670
MGMT-25157: CVE-2026-17106 Bump github.com/moby/go-archive to v0.3.0 through indirect dependency conversion #1630
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #1676
NO-ISSUE: Refresh RPM lockfiles #1684
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #1635
NO-ISSUE: Refresh RPM lockfiles [SECURITY] #1653
NO-ISSUE: Refresh RPM lockfiles #1590
OCPBUGS-106189: Assisted installer fails to disambiguate machines #1625
ACM-41555: Enable PQC in Dockerfiles #1622
MGMT-20398: Don’t start main agent until ironic reports it’s ready #1518
NO-ISSUE: Modify Konflux YAMLs to ocm-5.1 #1602
NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.13.1 #1600
NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.13.0 #1597
Full changelog

agent-installer-ui

Unhide static IP controls (#4153) #4153
Static IP NMState link should lead to OCP documentation (#4152) #4152
OVE above the sea: rework ISO download button, add clipboard copy (#4141) #4141
Bump follow-redirects from 1.16.1 to 1.16.3 (#4155) #4155
OCPBUGS-136500: Bump joi to ^18.3.1 to fix CVE-2026-118772 (#4154) #4154
Bump undici from 7.30.0 to 7.30.1 (#4149) #4149
Bump happy-dom from 20.9.0 to 21.0.4 (#4148) #4148
MGMT-25561: OVE above-the-sea: UI should update additional_ntp_sources instead of ntp_sources (#4118) #4118
Don’t show Static IP steps in OVE below the sea (#4119) #4119
Hide the network type control in OVE (#4129) #4129
Add to OVE custom manifest workaround filter (#4128) #4128
Update GH actions to @v7 (#4127) #4127
Bump vite from 8.0.16 to 8.1.6 (#4121) #4121
Bump follow-redirects from 1.16.0 to 1.16.1 (#4120) #4120
Temporarily hide static IP controls (#4116) #4116
MGMT-25543: OVE above-the-sea: remove proxy fields (#4113) #4113
Remove Assisted Chatbot (#4091) #4091
Red Hat Konflux purge assisted-ui-chatbot-saas-main (#4111) #4111
MGMT-25125: Implement Offline Openshift Versions Dropdown (#4107) #4107
chore(deps): update dependency ip-address to ^10.7.3 (#4109) #4109
chore(deps): update dependency immutable to ^5.1.9 (#4108) #4108
Bump joi from 17.13.7 to 17.13.8 (#4100) #4100
Upgrade Axios to 1.20.0 (#4105) #4105
Bump compression from 1.8.1 to 1.8.2 (#4104) #4104
Bump postcss-selector-parser from 7.1.5 to 7.1.6 (#4103) #4103
Bump source-map-js from 1.2.1 to 1.2.2 (#4102) #4102
Bump proxy-addr from 2.0.7 to 2.0.8 (#4101) #4101
CVE Upgrade (#4099) #4099
MGMT-25084: Upgrade axios to 1.20.0 (#4098) #4098
chore(deps): update dependency dompurify to ^3.4.16 (#4094) #4094
chore(deps): update dependency @types/node to ^24.19.1 (#4093) #4093
Do not show limited support level warning in disconnected flow (#4087) #4087
Update OpenShift version for OVE (#4084) #4084
Bump ip-address from 10.4.0 to 10.5.1 (#4083) #4083
Bump undici from 7.29.0 to 7.30.0 (#4082) #4082
chore(deps): update konflux references (#4072) #4072
remove disconvering word from StaticIP for Disconnected mode (#4079) #4079
chore(deps): update dependency ajv to ^8.20.0 (#4077) #4077
Bump immutable from 3.8.3 to 3.8.4 (#4078) #4078
chore(deps): update dependency @types/node to ^24.13.6 (#4076) #4076
OCPBUGS-123716: [Above the sea UI] The rendezvous IP must match one of the defined static IPs (#4071) #4071
Add Proxy and NTP configurations (#4068) #4068
Above the sea - hide pull secret field when it’s already been set (#4067) #4067
chore(deps): update dependency brace-expansion to ^5.0.12 (#4063) #4063
chore(deps): update konflux references (#4061) #4061
chore(deps): update dependency @types/node to ^24.13.5 (#4062) #4062
Add Single-Stack, Increase ImageSize Label and show LVMS Label (#4054) #4054
fix(deps): update typescript type definitions (non-major) (#4022) #4022
OCPBUGS-121378: Do not show IRI custom manifests in the disconnected UI (#4048) #4048
chore(deps): update dependency axios to ^1.20.0 (#4047) #4047
chore(deps): update dependency dompurify to ^3.4.15 (#4046) #4046
Bump js-yaml from 4.3.1 to 4.3.2 (#4034) #4034
Bump react-router from 7.18.1 to 7.18.2 (#4036) #4036
OCPBUGS-115122: Show IPv6 Technology Preview badge in Subnets dropdown for single-cluster only (#4013) #4013
Bump vitest from 3.2.6 to 4.1.11 (#4035) #4035
Bump joi from 17.13.4 to 17.13.7 (#4033) #4033
OCPBUGS-121366: Move IPv6 Technology Preview badge out of the header (#4027) #4027
Remove stale OCM_REFRESH_TOKEN code (#4012) #4012
chore(deps): update dependency postcss to ^8.5.28 (#4021) #4021
chore(deps): update konflux references (#4020) #4020
Change reuse SSH key label in OVE (#4018) #4018
Bump qs from 6.15.3 to 6.16.0 (#4011) #4011
Bump fflate from 0.4.8 to 0.4.9 (#4017) #4017
MGMT-25128: Assisted Installer UI (above-the-sea) adjustment to 4.22 GA (#3996) #3996
Bump fast-uri from 3.1.5 to 3.1.7 (#4010) #4010
Bump browserslist from 4.28.2 to 4.28.8 (#4007) #4007
Bump postcss-selector-parser from 7.1.1 to 7.1.5 (#4006) #4006
Add LVM as an operator for OVE (#4001) #4001
Allow LSO to be selected as a standalone operator (#4000) #4000
chore(deps): update dependency yup to ^1.7.1 (#3999) #3999
chore(deps): update dependency js-cookie to ^3.0.8 (#3998) #3998
Update OWNERS file (#3989) #3989
NO-ISSUE: Add Yarn resolutions for js-cookie and basic-ftp (#3985) #3985
Tweak boot instructions for disconnected (#3968) #3968
MGMT-24639: Choosing 5 masters on hosts page instead of 3 that was configured on cluster details causing the Hosts page stuck with no error/warning (#3942) #3942
Hardcode OVE openshift version from 4.21 to 4.21.27 (#3976) #3976
Resolve console warnings/errors (#3967) #3967
Add rule for creating/editing forms (#3962) #3962
chore(deps): update dependency ws to ^8.21.3 (#3974) #3974
chore(deps): update dependency dompurify to ^3.4.14 (#3973) #3973
Resolve duplicate ‘useFeature’ issue (#3969) #3969
MGMT-24493: Allow HTTPS proxy for Discovery ISO (#3777) #3777
MGMT-24494: Add exclusive NTP sources to the Add hosts discovery ISO … (#3934) #3934
MGMT-24202 | [Staging] [UI] - Air-gapped -Technology Preview badge placement is inconsistent (should appear at end of line) (#3965) #3965
Fix BasicStep Form import (#3966) #3966
NO-ISSUE: Improve the /ocm folder structure (#3817) #3817
chore(deps): update dependency postcss to ^8.5.26 (#3963) #3963
chore(deps): update dependency sanitize-html to ^2.17.7 (#3964) #3964
Full changelog

agent-installer-utils

OCPBUGS-137688: Update cluster-logging and loki operator version #361
AGENT-1565: Add OVE 4.22 tekton file to agent-installer-utils #320
AGENT-1629: Add –fips flag to the OVE ISO builder script #356
OCPBUGS-111468: prefix-validate URLs used in commands #349
OCPBUGS-111479: Quote variable expansion in skopeo inspect invocation #348
OCPBUGS-63475: Refresh rendezvous IP selection list #345
OCPBUGS-123720: Fix agent TUI timeout #346
AGENT-1577: Use master branch of appliance as image builder #333
OCPBUGS-114020: Use branch 5.1 for Konflux builds #344
AGENT-1573: Add release-5.1 config for ISOBuilder #327
Full changelog

agentic-skills

NO-JIRA: Increase execution step oc wait timeout from 10s to 60s #71
OTA-2133: Update cluster-update-advisor skill and product-lifecycle skill to generate RemediationOptions for cluster upgrade #64
NO-JIRA: cluster-update/OWNERS: add jrangelramos, remove PratikMahajan #68
NO-ISSUE: Gitops skills updated #66
OBSINTA-1732: investigate-alerts skill - initialize Prometheus access on demand and other improvements #59
GITOPS-11460: Add argo team onboard skill #54
GITOPS-11457, GITOPS-11458: Add argo-operations and argo-repo-audit skills #53
GITOPS-11459: Add argo-cluster-debug Skill Knowledge #55
GITOPS-10499: Add Argo knowledge skill #38
NO-JIRA: resolve skill-scanner findings for CI eval job #49
NO-ISSUE: fix: add compatibility attribute to the product-lifecycle skill #50
OBSINTA-1609: cluster-troubleshoot skill rename tools to scripts #46
OTA-2024, OTA-2070: Add eval test cases for cluster-update skills #34
Full changelog

apiserver-network-proxy

CNTRLPLANE-4019: Merge upstream master (4f8517c1) into main #116
Full changelog

aws-cloud-controller-manager

OCPCLOUD-3684: Merge https://github.com/kubernetes/cloud-provider-aws/tree/master (c87c679) into main #191
UPSTREAM-SYNC: Merge https://github.com/kubernetes/cloud-provider-aws:master (853eb04) into main #162
Full changelog

aws-cluster-api-controllers

CNTRLPLANE-3391: UPSTREAM: 6310: Add SourceDestCheck configuration to AWSMachine #672
NO-JIRA: Move JoelSpeed to advisory_approvers #669
UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws/tree/v2.13.1 (6883178) into main #664
OCPBUGS-128249: UPSTREAM: <carry>: remove redundant GitHub summary verification #658
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #636
NO-JIRA: UPSTREAM: <drop>: update manifests-gen #657
NO-JIRA: fix(make): verify generated summary from pull request revision #656
🌱 NO-JIRA: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #632
Full changelog

aws-ebs-csi-driver

STOR-3072: Rebase to upstream v1.65.0 for OCP 5.1 #347
NO-ISSUE: Address CVE-2026-33814 #354
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #331
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, gcp-pd-csi-driver-operator, openstack-cinder-csi-driver-operator

STOR-3155: Add the GCP Hyperdisk Throughput CSI e2e manifest #653
STOR-3210: Enable Online Expansion tests for Azure Disk #650
STOR-3173: Configure TLS groups for OLM-managed operators #654
STOR-3176: Support TLS Groups in operators for kube-rbac-proxy sidecar #651
STOR-3068: Bump all libraries #646
OCPBUGS-120762: restrict azure-file secrets ClusterRole to get and create verbs #639
STOR-3141, STOR-3142: EFS, Samba: Ship Network Policies in the operator bundle #629
OCPBUGS-127462: Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile #638
OCPBUGS-88301: Remove redundant delete role verb #620
OCPBUGS-113538: Enable SELinuxMount tests #605
STOR-3074: Bump OLM metadata to 5.1 #627
OCPBUGS-112272: node ServiceMonitor serverName uses guest namespace on HyperShift #603
OCPBUGS-115269: openstack-manila: Consume CA cert from CCO secret #617
NO-JIRA: Add reference to cluster-storage-operator in AGENTS.md #616
STOR-3090: Enable pod-delete-after-umount CSI suite for driver OCP manifests #596
OCPBUGS-120667: fix(gcp-pd): don’t apply guest-cluster resources against the management cluster on HyperShift #618
OCPBUGS-105410: Remove MutableCSINodeAllocatableCount featuregate #600
GCP-1074: feat(gcp-pd): enable HyperShift support for GCP PD CSI driver operator #601
OCPBUGS-111088: Replace deprecated pod.spec.service account #604
OCPBUGS-105392: Add proxy hook for HyperShift CSI driver controller deployments #594
Full changelog

aws-karpenter-provider-aws

AUTOSCALE-952: aws-karpenter-provider-aws release chores 5.1 #55
NO-JIRA: Update Karpenter owner aliases #50
OCPBUGS-85090: Align simulated with actual allocatable resources #46
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #44
AUTOSCALE-904: Add agentic SDLC artifacts to aws-karpenter-provider-aws #41
OCPBUGS-85085: default max-pods to 250 for Custom AMI family #40
Full changelog

aws-kms-encryption-provider

CNTRLPLANE-3380: Remove enxebre and sjenning from OWNERS #59
OCPBUGS-124534: Bump grpc-go to v1.83.2 #55
Full changelog

aws-machine-controllers

NO-JIRA: Move JoelSpeed to advisory_approvers #231
OCPCLOUD-3661: bump to Kubernetes 1.37 #227
OCPBUGS-126179: Fixed dedicated host tests to check for machineset to exist #217
Full changelog

aws-node-termination-handler

CNTRLPLANE-3380: Rebase onto upstream main and make the repo rebasebot-ready #18
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #15
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPCLOUD-3676: Merge https://github.com/kubernetes-sigs/cloud-provider-azure/tree/release-1.37 (6e6e09b) into main #200
OCPBUGS-105320: skip public ip check for azure stack #203
Full changelog

azure-cluster-api-controllers

NO-JIRA: Move JoelSpeed to advisory_approvers #424
OCPBUGS-129622: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:release-1.27 (8c829ce) into main #420
OCPCLOUD-3690: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.27.0 (3d9e0c3) into main #412
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #413
Full changelog

azure-disk-csi-driver

TRT-3028: UPSTREAM: <drop>: Revert “STOR-3077: Rebase to v1.36.0 for OCP 5.1” #187
STOR-3077: Rebase to v1.36.0 for OCP 5.1 #182
NO-JIRA: Add coderabbit config #183
OCPBUGS-111076: UPSTREAM: 3754: chore: upgrade Azure cloud provider lib- #180
Full changelog

azure-file-csi-driver

OCPBUGS-130452: Bump golang.org/x/crypto to fix CVE-2026-78662 #177
STOR-3082: Rebase to v1.35.10 for OCP 5.1 #170
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #167
Full changelog

azure-kms-encryption-provider

OCPBUGS-124531: Bump grpc-go to v1.83.2 #65
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #64
OCPSTRAT-3549: support sovereign Managed HSM endpoints #54
Full changelog

azure-machine-controllers

NO-JIRA: Move JoelSpeed to advisory_approvers #226
OCPBUGS-127058: Azure DualStack: Update Load Balancer backend pool matching for IPv6 #221
OCPCLOUD-3663: bump Kubernetes dependencies to 1.37 #220
OCPBUGS-105398: refactor: remove AzureWorkloadIdentity feature gate #207
Full changelog

azure-service-operator

OCPBUGS-140491: CVE-2026-33814: bump golang.org/x/net #53
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #47
Full changelog

azure-workload-identity-webhook

OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #69
OCPBUGS-123198: Bump golang.org/x/net to v0.53.0 to address CVE-2026-33814 #70
Full changelog

baremetal-cluster-api-controllers

NO-JIRA: Merge upstream #115
OCPBUGS-135071: fix: preserve standalone remediation CRDs when BareMetal machine management is disabled #117
OCPBUGS-132229: UPSTREAM: 3440: Bump x/net to v0.55.0 #113
OCPBUGS-128431: Go HTTP/2: Denial of Service via malformed PRIORITY_UPDATE frame - CVE-2026-33814 #110
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #107
Full changelog

baremetal-installer, installer, installer-artifacts

MULTIARCH-5990: PowerVS: Staging support endpoints #11063
CORS-4746: CVE-2026-19706 - Update approve-csr service on bootstrap to be more selective on the CSRs it approves #11077
OCPBUGS-140605: Update RHCOS-release-5.1 bootimage metadata to 10.2.20261108-0 / 9.8.20261108-0 #11082
OCPBUGS-136628: Listing Service Accounts Fails out Early #11068
MULTIARCH-6330: PowerVS: DHCP Subnet follow up PR to address lingering coderabbit comments #11067
OCPBUGS-132799: fix MachinePool management field godoc and CRD default #11018
CORS-4541: day-0 nested virtualization enablement for AWS #11050
no-jira: bump envtest binaries version to 1.37.0 #11014
OCPBUGS-131042: agent: scope ICSP/IDMS mutual-exclusivity check to install workflow #10940
CORS-4698: add permission groups for the installer #10997
OPNET-810: baremetal: stop emitting the bgp-vip-config ConfigMap #11073
OCPBUGS-136041: Bump github.com/klauspost/compress to v1.20.2 #11062
no-jira: bump CAPZ for AzureUSSecCloud support #11038
OCPBUGS-56876: gather: collect logs & analyze node-image-pull #9761
OCPBUGS-134587, OCPCLOUD-3725: fix/refactor: validate CAPI capability dependencies, enable konnectivity for it #11047
CORS-4696: Vendor CAPG for firewall service updates #10957
OPNET-810: baremetal: emit the BGPVIPConfig CR and peer password Secrets, validate peers and communities #11026
OCPBUGS-132704: azure: validate securityType per machine pool #11015
OCPBUGS-130952: Check the right resource group for NAT #10995
SPLAT-3025: bump openshift/api for AzureMultiDisk GA #11058
MULTIARCH-6330: Installer: Modify IBMPowerVSCluster manifest to switch to PowerVS DHCP subnet #11030
MULTIARCH-6014: PowerVS: Use PowerVS Stock Catalogue Images #10647
MULTIARCH-6455: Update CAPIBM to v0.15.2, CAPV (vsphere) to 1.17.0 and CAPI to v1.14.0 #10902
SPLAT-2981: drop Azure diskSetup gate test ahead of promotion #11035
OCPBUGS-122924: Default IngressController to Modern TLS #10875
OCPBUGS-133483: PowerVC: fix two issues with cherry-pick 10966 #11027
OCPBUGS-132853: [Azure] Fix nil error wrap in getNextAvailableIPForLoadBalancer #11019
OCPBUGS-129425, OCPBUGS-94441: bump upi-installer base image to RHEL 10 #10715
RFE-8788: Update installer to accept Capacity Group Reservation IDs for Azure #10102
OCPBUGS-127058: Azure DualStack: Rename IPv6 Backend pools #10998
SPLAT-3016: multi-disk: disallow system mount paths for user-defined disks #11021
OCPBUGS-130398: PowerVC: Support non admin user #10966
OCPBUGS-126133: CVE-2026-84445: Bump google.golang.org/grpc to v1.83.2 #10936
OPNET-810: deps: bump openshift/api and Kubernetes packages to 1.37 #10985
OCPBUGS-132573: azure: omit empty machine security profiles #10960
OPNET-810: baremetal: align bgpVIPConfig peer fields with the BGPVIPConfig CRD #10931
OCPBUGS-132208: unconfigured-ignition must include nmstateconfig.yaml when present #11010
OCPBUGS-130604, OCPBUGS-132034: azure: set up data disks via the LUN link and other validation gaps #10975
OKD-507: Update SCOS bootimage metadata to 10.0.20261014-0 #10864
OCPBUGS-131836: support InfraEnv AdditionalNTPSources in unconfigured-ignition #10996
no-jira: lint: define constants for aws subnet scope strings #10984
SPLAT-2981: decouple multidisk gates #10939
OCPBUGS-85811: Add omitzero to the AWS vpc field #10977
OCPBUGS-127102: Add internalJoinSubnet to installConfigOverrides #10963
OCPBUGS-127058: Azure DualStack: Allow IPv6 CIDRs to be provided first #10954
OCPBUGS-129534: golangci: avoid var-naming package-name flake #10953
CORS-4689: aws: update CAPA controller to v2.12.1 #10949
SPLAT-2976: multi-disk close install-config validation gaps #10934
TRT-3001: Revert #10152 “OCPBUGS-76925: Update no_proxy list to include AWS DNS resolver for UserProvisionedDNS” #10951
OCPBUGS-127394: Removed PowerVS InstallConfig debug log statement exposing sensitive information #10898
OCPBUGS-128718: validate AssignIpv6AddressOnCreation on BYO subnets for DualStackIPv4Primary #10933
OCPBUGS-76925: Update no_proxy list to include AWS DNS resolver for UserProvisionedDNS #10152
OCPBUGS-105321: pki: switch to ECDSA defaults and thread PKI profile to leaf certs #10743
OCPBUGS-127240: gcp: restrict global KMS location check to defaultMachinePlatform #10907
OCPBUGS-115159: aws: provision dedicated IAM resources for edge compute pool #10836
OKD-194: Add OKD cincinnati as the default update service for OKD #10834
OCPBUGS-126706: azure: allow isolated Ebdsv5/Ebsv5 VM families #10888
OCPBUGS-115550: use different INSTALL_INVOKER for unconfigured ignition #10848
OCPBUGS-99762: retry Azure bootstrap ignition upload #10835
OCPBUGS-90536: openstack: Guard network resource names on os_net_id being defined #10639
OCPBUGS-123770: Inject the pull-secret as podman secret in the agent-installer-ui container #10882
OCPBUGS-112483: use api-int record for ignition host when using externally managed LB and DNS #10860
no-jira: aws: fetch instance type on demand instead of listing all #10851
OCPBUGS-61892: fix swap disk nil-panic and block swap on control plane #10859
OCPBUGS-59743: azure: reject data disks on Azure Stack Hub #10823
OCPBUGS-86133: dont allow duplicate failure domains and fields #10741
OCPBUGS-91640: Warn about ignored install-config fields in ABI #10646
OCPBUGS-114375: azure: skip AppendVarPartition when DiskSetup provides a user-defined /var mount #10818
OCPBUGS-115187: Gather master only from primary IP on baremetal #10838
OCPBUGS-114882: OCPBUGS-112662: GCD load balancer health-check firewall ranges #10850
SPLAT-2923: vsphere: retry and throttle vCenter lookups during UPI VM creation #10847
OCPBUGS-59521: azure: fixes when setting DiskEncryptionSet on data disks #10776
CORS-4550: bump openshift api for gcd feature gate #10775
OCPBUGS-59520: azure: require storageAccountType when managedDisk is specified #10805
AGENT-626: Allow UserManaged LoadBalancer on baremetal/vsphere platforms #10558
OCPBUGS-59522: azure: reject securityEncryptionType on data disks #10777
OCPBUGS-45804: Update timeout in GetMarketplaceImage to 5 minutes #10767
CORS-4441: Bump Azure Marketplace Images #10764
OCPBUGS-105510: images: add BUILD_VERSION arg #10781
CORS-4308: networking: enforce NetworkObservabilityInstall feature gate #10774
MULTIARCH-6274: agent: Enable platform external s390x #10588
OCPBUGS-54305: Power VS: Get permitted network from user #9607
OSASINFRA-4359: Bump CAPO in openshift/installer #10726
OCPBUGS-60993: Enrich IBI config image proxy NoProxy with cluster networks #10649
CORS-4308: Enable Network Observability during installation #10382
OPNET-781: Add BGP VIP management support #10718
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

baremetal-machine-controllers

OCPCLOUD-3709: feat(tls): support remediation webhook curve preferences #283
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #278
OCPBUGS-123730: Bump golang.org/x/net to v0.58.0 to address CVE-2026-33814 #279
OCPBUGS-112338: Fix race that can provision multiple hosts #275
Full changelog

baremetal-operator

CNF-30124: Merge upstream #540
METAL-1980: Merge upstream #529
OCPBUGS-120721: Test int64 BIOS bounds #528
OCPBUGS-120721: Bump gophercloud to v2.15.0 #527
OCPBUGS-121877: pull in gophercloud fix for fast inspection #525
OCPBUGS-122043, OCPBUGS-91736: Merge upstream #524
NO-ISSUE: Merge upstream 2026-09-03 #523
NO-ISSUE: Restore .golangci.yaml downstream #522
Full changelog

baremetal-runtimecfg

OCPEDGE-3080: Allow no DNS upstreams #420
OCPEDGE-3080: Introduce –discover-node-ip for SNO CoreDNS #417
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #415
OCPBUGS-98258: Cloud Platforms: Filter out node’s own IP from Upstreams #399
OCPBUGS-86571: node-ip: wait for both address families on dual-stack clusters #391
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-133414: keep valid UTF-8 ConfigMap values in data #2450
OCPBUGS-136039: update klauspost/compress to v1.20.2 to fix CVE-2026-116591 #2457
OCPBUGS-100066: skip wildcard sources in IDMS/ICSP image reference parsing #2351
OCPBUGS-137964: Updating ose-cli-artifacts-container image to be consistent with ART for 5.1 #2458
OCPEDGE-3043: feat: extend oc adm transition topology for standalone infrastructure transitions #2436
OCPEDGE-2991: Read topology transition evaluations from API #2449
OCPEDGE-2960: Update topology subcommand to read transition status from infra api #2430
NO-JIRA: Rebase to 1.37 and update other dependencies. #2435
NO-JIRA: Add DS_Store to gitignore file #2441
: NO-JIRA: fix(set volumes): mention configmap in invalid volume type error #2437
OCPBUGS-120725: Return error when markers are not all replaced #2429
OCPBUGS-60768: properly indent multiline node messages in upgrade status output #2341
OCPEDGE-2416: Add oc adm transition topology command for SNO to HA transitions #2295
OCPBUGS-126457: [oc create route edge –help] Typo in WildcardPolicy option description #2409
OCPBUGS-122354: Fix inconsistent terminology in oc set probe help example #2404
OCPBUGS-122036: docs(env): add deployment example for configmap import in oc set env help #2401
NO-JIRA: README: Mention gcc as an oc dependency #2402
OCPBUGS-122005: Add IDMS support to oc image info #2397
OCPBUGS-114015: Added deployment example to oc set env help command #2389
NO-JIRA: Move to openshift/osincli #2386
NO-JIRA: Fix oc builds on Mac OS X Apple Silicon machines #2246
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cloud-credential-operator

OCPBUGS-133744: Raise cloud-credential-operator memory request to 140Mi #1114
NO-JIRA: Fix staticcheck warnings across multiple packages #1109
CCO-772: ccoctl - Add set-upgradeable-to command #1105
CCO-775: ccoctl Create custom roles before identity bindings #1104
CCO-771: Add ccoctl apply secrets command for AWS, Azure and GCP #1095
OCPBUGS-17664: Improve error messages for SCP-denied IAM operations #1084
CCO-849: bump go toolchain to 1.26.5 to resolve snyk complaints #1065
OCPBUGS-112282: In testing skip pod-identity-webhook checks on external platform #1085
Full changelog

cloud-network-config-controller

CORENET-7645: Add minimal AGENTS.md #278
CORENET-7581: Bump Kubernetes dependencies to 1.37.1 #273
OCPBUGS-124549: deps: bump google.golang.org/api and google.golang.org/grpc to v1.84.0 #275
OSASINFRA-4400: make openstack allowed address pairs configurable #230
OCPBUGS-105398: refactor: remove Azure workload identity feature gate #266
OCPBUGS-112564: Fix CVE-2026-41178 - bump go.opentelemetry.io/otel to v1.44.0 #262
Full changelog

cluster-authentication-operator

OCPBUGS-140495: Preserve webhook kubeconfig bytes on upgrade #1061
NO-JIRA: Update library-go to get unprivileged KMS container #1059
NO-JIRA: Update library-go to get new KMS API #1057
CNTRLPLANE-4794: Token review service #1034
NO-JIRA: kms: wait for SNO kube-apiserver rollout before scenarios #1046
NO-JIRA: bump(openshift/library-go): to get retry in preflight check status report #1045
NO-JIRA: Update library-go to run conditional step in KMS #1043
CNTRLPLANE-4787: Make External OIDC proxy handling more robust #1036
NO-JIRA: Fix staticcheck warnings across multiple packages #1025
NO-JIRA: bump(openshift/library-go): to get KMS GA #1041
CNTRLPLANE-4787: Reapply: Add support for External OIDC proxy #1039
NO-JIRA: Update library-go to get KMS changes #1040
TRT-3040: Revert #1001 “CNTRLPLANE-4787: Add support for External OIDC proxy” #1038
CNTRLPLANE-4787: Add support for External OIDC proxy #1001
CNTRLPLANE-4519: External OIDC lib go generator #1018
NO-JIRA: Update library-go #1032
CNTRLPLANE-4731: Add KMSPreflightCycle e2e #1031
NO-JIRA: Update library-go #1028
NO-JIRA: bugfix: external-oidc: omit client-credential TLS generated config when empty #971
NO-JIRA: Update library-go #1027
CNTRLPLANE-4719: deps: Rebase to 1.37 and update other deps #1024
NO-JIRA: bump openshift/api https://github.com/openshift/api/pull/3083 #1022
NO-JIRA: bump library-go https://github.com/openshift/library-go/pull/2518 #1020
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2512 #1016
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2474 #1014
CNTRLPLANE-3237: encryption/assertion: bring back the preflight assertion for CAO and OAS-O #1011
CNTRLPLANE-4402: implement new External OIDC architecture under ExternalOIDCAsWebhook feature gate #1002
OCPBUGS-122888: Add high contrast support to oauth templates #999
CNTRLPLANE-3237: bump library-go to get the new KMS plugin deployment strategy #1004
OCPBUGS-107949: fix CVE-2026-41178 by updating otel to v1.44.0 #978
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2478 #1006
OPRUN-4768: bump openshift/api #1005
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2463 #997
OCPBUGS-114428: Update build-machinery-go vendor dependency #991
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2439 #987
CNTRLPLANE-3237: pick https://github.com/openshift/library-go/pull/2449- #2287 #985
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2451 #984
CNTRLPLANE-3237: kms: wire EncryptionConfigurationComputer into encryption controllers #983
NO-JIRA: Bump library-go #977
CNTRLPLANE-3237: kms: wire preflight deployer #975
NO-JIRA: Update library-go to get latest changes #976
NO-JIRA: bump library-go changes #974
NO-JIRA: update KMS tests with bump library-go changes #969
Full changelog

cluster-autoscaler

OCPBUGS-129089: cache kind version discovery across loop iterations #463
OCPBUGS-135209: charge a pending machine once, not once per autoscaler pass #459
AUTOSCALE-898: Add agentic SDLC files #437
Full changelog

cluster-autoscaler-operator

OCPBUGS-130317: add machinepools to CAPI ClusterRole for autoscaler #406
AUTOSCALE-949: Release chore CAO bump to k8s 1.37 and OCP 5.1 #404
AUTOSCALE-709: implement conditions and authoritative API #402
AUTOSCALE-899: add claude and contributing files #399
OCPBUGS-111092: update version to properly detect errors #395
OCPBUGS-105277: implement startupTaints #383
Full changelog

cluster-baremetal-operator

METAL-1999: Add virtual-media server TLS controls #685
OCPBUGS-135255: fix: avoid FeatureGateWatcher panic on CustomNoUpgrade #684
CNF-22903: Add support for Ironic Networking service #630
METAL-1934: Add support for feature gates #663
OCPBUGS-115068: Validate Provisioning fields passed to containers #653
NO-ISSUE: Add deployment diagrams to README #680
OCPBUGS-127132: Pass WATCH_NAMESPACE to image-customization #666
OCPBUGS-54957: Remove recreate strategy from BMO deployment #640
Metal-1833: Add attach_non_bootable_iso OTE test #617
OCPBUGS-115207: Make HostPath VolumeMounts ReadOnly for image customization container #658
OCPBUGS-86888: Fix IDMS YAML serialization for oc image extract #645
METAL-1833: Add bmo_validations and ncsi_reject_poweroff OTE test #618
OCPBUGS-115067: Use bcrypt DefaultCost for Ironic passwords #650
OCPBUGS-114433: Increase firmware e2e timeouts and add HPE Mellanox NIC bastion mapping #649
OCPQE-32100: Add batched firmware update tests (bmc+bios+nic) #643
OCPBUGS-105610: drop IRONIC_INSECURE from BMO #642
Full changelog

cluster-bootstrap

OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #149
OCPBUGS-114428: Update build-machinery-go vendor dependency #146
CNTRLPLANE-3717: Add Agentic SDLC context files #133
CNF-23048: Migrate away from deprecated ioutil #123
Full changelog

cluster-capi-controllers

OCPCLOUD-3735: Serve IPAM v1beta2 while retaining v1beta1 storage + custom conversion webhook #316
OCPBUGS-133521: Bump manifests-gen and regenerate to remove rules from aggregate ClusterRoles #322
NO-JIRA: Move JoelSpeed to advisory_approvers #320
TRT-3024: UPSTREAM: <drop>: Revert “Rebase OpenShift Cluster API onto upstream v1.14.3” #318
OCPCLOUD-3686: Rebase OpenShift Cluster API onto upstream v1.14.3 #308
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #309
NO-JIRA: UPSTREAM: <carry>: remove redundant GitHub summary verification #313
NO-JIRA: UPSTREAM: <drop>: update manifests-gen #312
OCPCLOUD-1501: allow CAPI manager to patch Nodes #311
OCPCLOUD-1501: add OpenShift CAPI manager local cluster RBAC #310
Full changelog

cluster-capi-operator

OCPBUGS-140680: e2e: Fix upgradeable on metal3 with dev-scripts #725
OCPBUGS-140593: fix(upgradeable): Restrict image-reading pods to control-plane nodes #723
OCPCLOUD-3727: Fix upgradeability controller on arm64 #722
OCPCLOUD-3727: Remove upgradeable e2e inter-test dependencies #721
OCPCLOUD-3726: Implement the upgradeable controller #712
OCPBUGS-138578: crdvalidation: Permit CRD deletion when action = Warn #717
NO-JIRA: Constrain linter resource usage in ci #719
OCPBUGS-138579: Fix OOMKiller running units #718
OCPBUGS-138541: CRD Compatibility: Fix admission when CRD omits webhook port #716
OCPBUGS-133521: manifests-gen: suppress rules on aggregate ClusterRoles #714
NO-JIRA: Resolve AWS migration templates through MachineSet references #713
OCPCLOUD-3727: E2Es for upgradeable controller #709
NO-JIRA: Move JoelSpeed to advisory_approvers #711
NO-JIRA: Bump golangci-lint to v2.15.0 and fix new lints #710
OCPBUGS-135095: Do not wait for ancillary CAPI controllers on unsupported platforms #707
OCPCLOUD-3545: Remove CompatibilityRequirement v1alpha1 references #706
OCPBUGS-135094: Increase installer unit-test cleanup timeout #705
OCPCLOUD-3725: refactor: gate legacy tombstones on ClusterAPIOperator #704
OCPCLOUD-3726: Add scaffolding for Upgradeable controller #703
OCPBUGS-135028: fix: grant installer watch access to cluster configuration #702
OCPCLOUD-3725: refactor: operator manifests to follow the ClusterAPIOperator feature gate #701
OCPBUGS-133479: Run unmanaged CRD handoff as one extension test #700
OCPCLOUD-3545: Consume CompatibilityRequirement v1 #694
OCPBUGS-133479: fix(e2e): remove CRD compatibility gate from handoff test #699
OCPCLOUD-3725: test: separate Cluster API operator health checks from machine management #698
OCPBUGS-133416: fix(openstack): tolerate multiple external networks when no router exists #697
OCPCLOUD-3725: Support operator no-components mode #696
OCPCLOUD-3704: Enable CRD Compatibility Checker e2e tests on External topology #688
OCPCLOUD-3724: Enable proxy injection for capi-controllers #692
OCPCLOUD-3655: bump Kubernetes dependencies to 1.37 #686
OCPCLOUD-3704: Enable CRD Compatibility Checker support on Hosted OpenShift independently of Cluster API #685
OCPCLOUD-3465: feat: implement cluster-wide proxy support #586
OCPCLOUD-3318: Integrate CompatibilityRequirements into the CCAPIO Installer #648
OCPBUGS-98492: Fix orphaned MachineSet sync finalizer cleanup #689
OCPCLOUD-3541: Use feature gates consistently #603
OCPBUGS-127650: openstack: allow to specify UserManaged load balancer #678
OCPBUGS-128384: Extend InfraTemplate reconciliation wait #681
OCPBUGS-123094: Update MongoDB Go driver to v1.17.10 #676
OCPBUGS-128576: add ec2:ModifyInstanceMetadataOptions to AWS CredentialsRequest #682
NO-JIRA: Update actuator testutils builder paths #683
OCPBUGS-128356: Remove unnecessary ClusterOperator test status update #680
OCPBUGS-127467: Pass original TLSProfileSpec to security profile watcher #677
NO-JIRA: use capi 1.13/capv 1.16 imports #675
NO-JIRA: Bump linter to v2.13.2 #674
OCPCLOUD-1501: use projected tokens for management kubeconfig #669
OCPBUGS-100155: fix flaky MachineSet sync test by atomically verifying InfraTemplate #647
OCPBUGS-114670: fix(capi2mapi): normalize empty SSHKeyName to nil for MAPI AWS conversion #659
OCPBUGS-115197: machinesync: preserve Synchronized condition lastTransitionTime in CAPI-to-MAPI sync #656
NO-JIRA: Skip CAPI IPAM test on MicroShift #661
OCPCLOUD-3557: split capi-controllers and machine-api-migration #622
NO-JIRA: port OTP CAPI tests to OTE framework #627
OCPBUGS-105850: skip Cluster API Machine Management tests on External topology #646
NO-JIRA: embed transformer YAML so go mod vendor copies it #657
OCPCLOUD-3442: Migrate four controllers to per-controller condition reporting #577
NO-JIRA: Fix flaky CI unit tests: reduce parallelism #645
Full changelog

cluster-cloud-controller-manager-operator

OCPCLOUD-3670: propagate TLS group preferences #532
OCPBUGS-136178: Preserve legacy vcenters when Infra has no VCenters/FailureDomains #531
SPLAT-2994: resolve AWS region from Infrastructure before environment #529
OCPCLOUD-3673: bump Kubernetes dependencies to 1.37 #523
OCPBUGS-111416: Moved node sync job creation from manifest to operator controller #504
OCPBUGS-105385: Bump cloud-provider-aws to fix NLB e2e occasional timeout failures #503
Full changelog

cluster-config-api

STOR-3259: Promote ControllerManagerConfig to TechPreview #3176
OCPBUGS-140962: Add a feature gate for Metal3 HostClaims API #3179
NO-JIRA: clarify NVMe subsystem collector documentation #3121
OCPBUGS-140724: add a feature gate to guard BareMetalHost v1beta1 #3177
OCPBUGS-134623: accept empty imageStreamImportMode again, keep omitempty #3172
CNTRLPLANE-4788: authentication: AuthenticationConfiguration: Clarify trustedCAFilePath scope #3173
OCPCLOUD-3722: Stop serving CompatibilityRequirement v1alpha1 #3148
OCPCLOUD-3546: Promote CRDCompatibilityRequirementOperator feature gate to Default #2908
OCPBUGS-134623: make ImageSpec.ImageStreamImportMode omitempty and drop “” from the enum #3159
CNTRLPLANE-3745: add api validation cases for AuthenticationComponentProxy #3158
OSDOCS-24092: Correct ImageDigestMirrorSet/ImageTagMirrorSet API documentation #3144
CNTRLPLANE-4318: etcd backups #2952
TRT-3082: Revert #3046 “NE-2389: Promote AWS NLB security groups to default” #3162
OCPBUGS-105406: Remove ImageStreamImportMode feature gate #3086
OCPBUGS-74520: Remove obsolete UpgradeStatus feature gate #3152
MON-4647: increase regex maxLength from 1000 to 8192 #3052
NE-2389: Promote AWS NLB security groups to default #3046
NO-JIRA: Add ClusterVersion CRDs to payload-manifests #3155
CNTRLPLANE-4776: Update PKI API #3060
SPLAT-3020: Rename VSpherePerComponentScopedCreds to VSpherePerComponentScopedCredsInstall #3133
HCCDOC-4522: Rename “Insights Advisor” to “Red Hat Lightspeed Advisor” in API docs #2911
MON-4646: allow bare hostnames in staticConfigs #3051
OCPEDGE-2810: add FencingEnabled condition to PacemakerCluster status #3042
OCPCLOUD-3725: Require ClusterAPI when MachineAPI is selected #3145
OCPEDGE-2979: Add Pacemaker Alert Agents API definitions #3066
NE-2922: Promote GatewayAPIManagementMode to GA #3030
NO-JIRA: Remove PodGroupPreemptionPolicy feature gate #3142
NE-2922: remove override switch for ingress.operator on v1alpha1 #3147
NO-JIRA: make remoteKeyID optional on KMS health reports #3132
OCPEDGE-3170: Add TNFObservability feature gate #3141
SPLAT-2981: promote AzureMultiDisk to GA #3091
MON-4645: allow __ prefixed labels in sourceLabels #3050
OCPSTRAT-3523: Add OpenStack.maxAllowedAddressPairs to Infrastructure API #3098
OCPBUGS-104847: Remove SELinuxMountGAReadiness feature gate #3122
NO-JIRA: Add example of validating an OpenShift release version #3137
feat: register FeatureGateClusterAPIMachineManagementNutanix #3140
MON-4654: allow query parameters in remote write URLs #3124
OCPBUGS-105408: Remove DualReplica feature gate #3123
OCPCLOUD-3725: feat: gate Cluster API configuration on operator availability #3131
Nutanix: featuregate for MachineAPIMigrationNutanix #3125
OPNET-809: ship the BGPVIPConfig CRD in the payload #3127
METAL-1977: add MetalEnrollmentAPI feature gate #3090
OCPCLOUD-3544: Graduate CompatibilityRequirement API to v1 #2905
CNTRLPLANE-4390: Remove OpenShiftPodSecurityAdmission feature gate from Default feature set. #3035
CNTRLPLANE-4771: Graduate KMSEncryption to GA #3100
STOR-3180: Add Feature Gate StoragePathAlert #3105
OCPNODE-4827: Drop v1apha1 CRIOCredentialProviderConfig entirely #3113
OCPCLOUD-3330: Add ClusterAPIOperator feature gate #3109
OCPKUEUE-887: Enable workload scheduling feature gates for DP/TP (except CompositePodGroup) #3112
TRT-3027: Revert #3102 “OCPKUEUE-887: Enable workload scheduling feature gates for DP/TP” #3107
OCPEDGE-2989: OCPEDGE-2958: Add topologyTransitionStatus to Infrastructure status #3029
CNTRLPLANE-4394: Add foundations for AuthenticationComponentProxyExternalOIDC #3037
OCPKUEUE-887: Enable workload scheduling feature gates for DP/TP #3102
OCPBUGS-130730: Remove topology transition immutability validation #3096
NE-2912: Add HAProxy 3.4 as a selectable non-default version #3067
OPNET-809: machineconfiguration/v1alpha1: add BGPVIPConfig CRD #2972
OCPNODE-4730: Add workload scheduling feature gates #3092
NE-2922: Promote Ingress operator API to v1 #3079
OCPBUGS-123649: enable DRADeviceTaintRules feature gate in TPNU #3072
OCPEDGE-3075: feat: add spec.infrastructureTopology to Infrastructure API #3056
Fix CustomNoUpgrade rendering with omitted overrides #3080
NO-JIRA: change KMS preflight result validation #3083
OCPBUGS-129172: Loosen CAPI skew validations #3077
Support Quay CI payloads and add Kubernetes v1.37.1 envtest tools #3082
CNTRLPLANE-4604: promoting AuthenticationComponentProxy feature gate to Default feature set #3075
STOR-2859: Add APIs for disabling force detach in KCM operator #2668
Rename Console ingress helper type to ConsoleIngress #3070
CORENET-7617: features: Add ovn-kuberntes MACSecurity feature gate #3062
CNTRLPLANE-4518: authentication: add v1alpha1 external OIDC configuration API #3061
MCO-2535: add skew enforcement validations for CAPI MachineManagers #3058
OCPSTRAT-3618: Rebase 1.37 #2945
OCPBUGS-126808: Enable OLMLifecycleAndCompatibility by default in version 5+ #3045
NE-2913: Remove HAProxy 2.8 #3048
CNTRLPLANE-4402: add ExternalOIDCAsWebhook feature gate #3043
OCPEDGE-3079: UnifiedClusterManagedDNSAndLB FeatureGate #3054
OCPBUGS-115007: Remove BootImageSkewEnforcement feature gate from Default API #3031
OCPBUGS-120757: Fix misleading certificate chain docs in TLSConfig #3047
CNTRLPLANE-3237: replace KMS config with pluginConfig reference #3028
HPCASE-362: Promote TLSAdherence feature gate to GA #2883
NO-JIRA: Fix codegen diagnostic formatting #3049
operator: Add an option to configure OVN-Kubernetes GatewayConfig without an uplink specified. #3009
OCPBUGS-105398: chore: remove AzureWorkloadIdentity feature gate #3018
OPRUN-4768: Add serving TLS curve preferences #3044
Remove feature gate VolumeGroupSnapshot #3027
STOR-3089: Graduate SELinuxMount to GA #3023
OCPBUGS-112638: register DRADeviceTaintRules in TPNU #3004
Fix validation pattern for machine/vsphereprovider #3033
features: enable TLSAdherence feature gate for OKD featureset #3021
CORENET-7538: Add EgressIPNodeSelector feature gate #3032
SPLAT-2890: Add VSphereScopedCredentials feature gate #2988
MCO-2332: MCO-2333: Introduce CAPI resource types to boot image update API #2990
OCPBUGS-99266: move empty CRIOCredentialProviderConfig CR to run-level 0000_10 #3011
OCPBUGS-105399, OCPBUGS-105400: Remove SigstoreImageVerification and SigstoreImageVerificationPKI feature gates #3000
OCPBUGS-112330: Fix ‘supercede’ typos in machineconfiguration types #2996
SPLAT-2864: Promote VSphereMultiVCenterDay2 to GA #2968
CORS-4550: Promote GCD to Default #2991
OCPBUGS-105407: Remove VSphereMultiNetworks feature gate #2975
config/v1: add IBMCloudServiceTransitGateway and IBMCloudServicePowerVS to IBMCloudServiceName #2959
OCPNODE-4526: Block ‘..’ traversal in StorePath #2999
OCPBUGS-74510: Remove VSphereMultiDisk feature gate #2973
Add printer columns to PodNetworkConnectivityCheck CRD #2977
NE-2387: IngressController AWS NLB Security Group Selection #2914
OCPBUGS-112479: Handle Sippy date-only format in featuregate-test-analyzer #2998
CNTRLPLANE-3871: promote OSStreams feature gate to Default for Hypershift #2993
TRT-2908: Revert “CNTRLPLANE-3871: promote OSStreams feature gate to Default for Hypershift” #2989
OCPBUGS-105409: chore: remove AWSServiceLBNetworkSecurityGroup feature gate #2974
CORS-4529: Azure IL6 Secret Cloud support #2919
CNTRLPLANE-3609: graduate etcdBackendQuota to GA #2946
CNTRLPLANE-3871: promote OSStreams feature gate to Default for Hypershift #2950
OCPNODE-4601: Add {system,container}GomaxprocsBehavior field #2934
Full changelog

cluster-config-operator

OCPBUGS-138331: Publish failing post-transition checks in TopologyTransitionCompleted #534
OCPEDGE-2959: Migrate topology transition tracking from operator’s conditions to infra API #499
OCPEDGE-3021: feat: add infrastructure SingleReplica to HighlyAvailable topology transition #525
OCPBUGS-136631: Filter topology transition discovery by current source #532
OCPEDGE-2990: Report supported topology evaluations #522
NO-JIRA: Update Go to 1.26 and OpenShift API dependencies #528
OCPBUGS-130339: Read OpenShift API server replicas from deployment #524
NO-JIRA: chore: Adding some edge folks as OWNERS in the topology controller #508
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #504
OCPBUGS-114428: Update build-machinery-go vendor dependency #500
OCPEDGE-2747: feat: add topology transition controller for day-2 SNO to HA transitions #495
Full changelog

cluster-control-plane-machine-set-operator

NO-JIRA: Move JoelSpeed to advisory_approvers #427
OCPCLOUD-3658: bump Kubernetes dependencies to 1.37 #423
OCPCLOUD-3707: feat(tls): add support for TLS groups/curve preferences #424
OCPBUGS-65497: Add debug-useful ClusterOperator relatedObjects #404
OCPBUGS-86988: Guard against empty workspace field on vsphere #407
Full changelog

cluster-csi-snapshot-controller-operator

STOR-3068: Bump all libraries #302
OCPBUGS-127462: Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile #298
OCPBUGS-104846: Remove VolumeGroupSnapshot feature gate #297
Full changelog

cluster-dns-operator

OCPBUGS-133753: Raise dns-operator memory request to 80Mi #506
NE-2126: Make the DNS tests extension OTE-compliant #504
NE-2126: Ship tests-ext binary as raw gzip instead of tar.gz #503
NO-JIRA: Add pedjak to OWNERS #490
OCPBUGS-87970: Stop using legacy topology-aware hints for DNS #501
NE-2126: Migrating DNS test cases from QE repo #491
OCPBUGS-53192: Update code reference to use the default branch name ‘main’ #488
ART-23537: Fix hermetic build failure by removing update-bindata from build target #489
NE-2880: Update GitHub issue template URLs #487
NE-2126: Migrating DNS operator test cases from QE repo #485
Full changelog

cluster-etcd-operator

OCPBUGS-136034: Bump klauspost/compress to fix CVE-2026-116591 #1744
CNTRLPLANE-4527: align automated backup E2E tests with policy scheduling #1746
CNTRLPLANE-4423: Add TLSCurve support #1740
CNTRLPLANE-4318: etcd backups #1657
OCPBUGS-138702: Enable etcd lease checkpointing by default #1748
OCPBUGS-136387: accept FQDN node names in TNF recovery #1745
OCPBUGS-79354: Canonicalize all IP Address comparisons #1577
NO-JIRA: bump k8s 1.37 #1733
NO-JIRA: move TNF scripts to bindata/etcd/tnf with TNF OWNERS #1728
NO-JIRA: Update the tests to skip if OCPFeatureGate:AutomatedEtcdBackup is not enabled #1731
OCPBUGS-100304: write force_new_cluster as a claim timestamp #1721
OCPBUGS-112390: [TNF] lifecycle part 2 - update setup deadlock fix & conditions cleanup #1668
NO-JIRA: Add TNF ownership for docs/tnf #1725
OCPBUGS-123169: add static linter for workload partitioning annotations #1707
OCPBUGS-105240: TNF: wait for etcd-bootstrap member removal before setup #1672
OCPBUGS-84650: force installer revision when external-etcd-pod ConfigMap is created #1705
OCPBUGS-126911: fix(tnf): set read-only root filesystems #1715
CNTRLPLANE-4414: allow TLS 1.3 profiles without ciphers #1710
NO-JIRA: refactor: remove unused cert-watcher daemonset manifest #1711
OCPBUGS-123168: fix: add missing workload paritioning annotation on cert-watcher daemonset #1706
OCPBUGS-104851: feat: add cert-watcher DaemonSet to restart etcd on CA bundle rotation #1675
OCPBUGS-94106: fall back to intermediate ciphers during etcd bootstrap #1689
OCPBUGS-80957: Reset node status when UID changes #1687
OCPBUGS-105322: fix etcdSignerCAExpiration* alert description wording #1686
CNTRLPLANE-4131: update to latest api to pull in etcd db ga #1680
OCPBUGS-109740: Fix tnf_cluster_in_service during per-node maintenance #1678
OCPBUGS-109743: Derive console notification docs URL from cluster version #1676
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-image-registry-operator

OCPBUGS-105406: Remove ImageStreamImportMode feature gate #1384
CNTRLPLANE-4447: observe tls groups preferences #1379
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #1368
OCPBUGS-114531: Add 2m degraded inertia to ImagePrunerController #1365
OCPBUGS-112551: imageconfig: Preserve ImageStreamImportMode during upgrade race #1363
OCPBUGS-86308: do not report progressing during cluster scale up #1361
OCPBUGS-113705: CNTRLPLANE-3779: Migrated go standard cases to ote #1343
Full changelog

cluster-ingress-operator

NE-2126: Re-enable migrated ingress operator QE tests #1654
NE-2912: Add non-default HAProxy 3.4 image selection #1660
OCPBUGS-131939: [OSSM 26-20] Bump to OSSM 3.5.0 and Istio v1.30.5-2 for y-stream update prep #1626
OCPBUGS-133736: Increase ingress operator memory request #1647
OCPBUGS-122924: Default IngressController to Modern TLS #1593
NE-2922: Use the featuregate to add Ingress resource #1651
NE-2922: Migrate operator Ingress consumers to v1 #1618
OCPBUGS-121851: Complete zero-worker HyperShift startup without premature router readiness #1631
NE-2938: Bump Kubernetes to 1.37 #1643
NE-2779: Move Gateway API CRD VAP management from CVO to CIO #1627
NE-2913: Remove HAProxy 2.8 reference #1599
TRT-3032: Revert #1607 “OCPBUGS-121851: Report ingress Available=True on zero-worker HyperShift startup” #1630
NE-2901: Document commit conventions in AGENTS.md #1582
OCPBUGS-128105: Allow disabling endpoint address validation #1608
OCPBUGS-118434: Remove obsolete workaround that hardcodes spec.replicas #1581
OCPBUGS-121851: Report ingress Available=True on zero-worker HyperShift startup #1607
TRT-3022: Revert #1556 “NE-2126: Migrating Ingress operator test cases from QE repo” #1623
OCPBUGS-129612: Rebuild fake DNS provider when DNS zones are added #1614
NE-2126: Migrating Ingress operator test cases from QE repo #1556
OCPBUGS-129664: Bump to ossm 3.4.3 and Istio 1.30.5 #1606
OCPBUGS-126999: Support ambient AWS credentials in tests #1602
NE-2922: Remove duplicate operator Ingress CRD from CIO payload #1613
NE-2879: Update GitHub issue template URLs #1578
OCPBUGS-105442: improve Sail RBAC verification diagnostics #1601
NE-2834: Replace deprecated math/rand.Read in e2e test #1533
OCPBUGS-115108: derive ingress Degraded grace #1583
OCPBUGS-125752: discover AWS subnets from CAPI with MAPI fallback #1592
OCPBUGS-128253: Wait for AWS NLB SG baseline #1604
OCPBUGS-53193: Update code references to use the default branch name ‘main’ #1591
NE-2570: Simplify TLS profile validation #1594
OCPBUGS-122346: Fix GatewayClass index registration retries during bootstrap #1588
OCPBUGS-105442: Remove escalate/bind from Sail Library ClusterRole #1548
NE-2909: Address Gateway API management-mode follow-ups #1595
OCPBUGS-105317: Bump to OSSM 3.4.2 and istio 1.30.4 #1576
OCPBUGS-105398: docs: clarify Azure workload identity token file #1586
NO-JIRA: Add pedjak to OWNERS #1596
NE-2388: aws nlb security groups #1500
NE-2779: Implement Gateway API management mode #1547
OCPBUGS-86050: Update ROUTER_CURVES environment variable for go 1.26 #1542
OCPBUGS-6718: minimize wildcard RBAC permissions #1579
OCPBUGS-105398: refactor: remove Azure workload identity feature gate #1575
NE-2491: Delete the CRL controller #1536
WAF-3: Implement extension provider capability for WAF #1555
OCPBUGS-62627: Suppress Progressing during infrastructure-driven ingress unavailability #1496
OCPBUGS-92835: add grace period to Available condition for deployment… #1544
OCPBUGS-109582: Normalize malformed CIDRs to avoid upgrade disruptions #1549
OCPBUGS-91026: Add missing KAS-defaulted fields to ValidatingAdmissionPolicy manifest #1560
OCPBUGS-112280: Preserve server-defaulted fields on init containers and volumes #1557
NE-2856: Fix staticcheck warnings across multiple packages #1553
NE-2032: e2e: Signal service deprovisioning issues during Gateway DNS test #1220
OCPBUGS-101783: reconcile canary certificate on dependency creation #1538
OCPBUGS-100074: Use /healthz for router startup probe #1528
OCPBUGS-86841: Add BackendTLSPolicy and ReferenceGrant e2e test coverage helpers #1467
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-130512: Bump golang.org/x/net to v0.60.0 to fix CVE-2026-78669 #2370
CNTRLPLANE-4864: configobservation/auth: coordinate direct-to-webhook OIDC migration #2383
NO-JIRA: Update library-go to get unprivileged KMS container #2382
NO-JIRA: Update library-go to get new KMS CRD #2380
CNTRLPLANE-4866: bump kms perf e2e #2374
CNTRLPLANE-4424: feat: inject tls groups #2331
NO-JIRA: kms: wait for SNO kube-apiserver rollout before scenarios #2371
NO-JIRA: Move encryption perf DB loader helpers to test/library/encryption #2375
NO-JIRA: bump(openshift/library-go): to get retry in preflight check status report #2368
CNTRLPLANE-4845: Migrate sno disruptive and encryption rotation e2e to ote #2365
OCPBUGS-133759: Raise kube-apiserver operator memory request #2366
NO-JIRA: Update library-go to run conditional step in KMS #2367
NO-JIRA: bump(openshift/library-go): to get KMS GA #2364
NO-JIRA: Update library-go #2362
OCPBUGS-60496: Use BoundServceAccountTokenVolume dy default #1896
NO-JIRA: Update library-go #2354
CNTRLPLANE-4731: Add KMSPreflightCycle e2e #2348
OCPKUEUE-887: Enable workload API versions for feature gates #2332
NO-JIRA: Update library-go #2349
NO-JIRA: Update library-go #2347
TRT-3013: Revert “Use 300s shutdown delay on AWS” #2346
NO-JIRA: bump openshift/api https://github.com/openshift/api/pull/3083 #2339
OCPBUGS-86789: Extend AWS shutdown delay to 300s #2267
CNTRLPLANE-4408: Support the ExternalOIDCAsWebhook feature gate #2325
NO-JIRA: bump library-go https://github.com/openshift/library-go/pull/2518 #2337
CNTRLPLANE-3237: update deprecated API usage alerts for kube 1.37 #2334
OCPSTRAT-3618: Bump to golang-1.26-openshift-5.1 image #2268
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2474 #2327
CNTRLPLANE-3237: encryption/assertion: bring back the preflight assertion for CAO and OAS-O #2320
CNTRLPLANE-4303: Remove old go standard e2e encryption cases #2322
CNTRLPLANE-4303: Migrate e2e-encryption to ote #2290
CNTRLPLANE-3237: bump library-go to get the new KMS plugin deployment strategy #2315
OCPBUGS-112638: apienablement: enable resource.k8s.io/v1beta2 when DeviceTaintRule is enabled #2275
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2478 #2313
OPRUN-4768: bump openshift/api #2316
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2463 #2309
OCPBUGS-114428: Update build-machinery-go vendor dependency #2307
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2439 #2282
CNTRLPLANE-3237: pick https://github.com/openshift/library-go/pull/2449 #2287
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2451 #2289
CNTRLPLANE-3237: kms: wire EncryptionConfigurationComputer into encryption controllers #2292
NO-JIRA: Bump library-go #2286
CNTRLPLANE-3237: kms: wire preflight deployer #2276
NO-JIRA: Update library-go to get latest changes #2280
OCPBUGS-80958: Kube apiserver node replace #2199
NO-JIRA: bump library-go changes #2270
OCPBUGS-38661: Use 10min inertia for GuardControllerDegraded #2273
OCPBUGS-85183: Add kind-aware staleness detection for runtime-config entries #2179
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2430 #2271
NO-JIRA:Remove old perf tests and update Makefile #2269
CNTRLPLANE-4110: Migrate e2e encryption perf cases to ote #2256
Full changelog

cluster-kube-controller-manager-operator

CNTRLPLANE-4778: Turn node cert recovery off 24h after it’s turned on #977
CNTRLPLANE-4488: Add opt-in kubelet client CSR approver to cert-recovery-controller #973
CNTRLPLANE-4441: feat: inject tls groups #974
STOR-2875: wire volumeForceDetach config observer for KCM #975
OCPSTRAT-3618: Rebase 1.37 #953
OCPBUGS-114428: Update build-machinery-go vendor dependency #967
OCPBUGS-107974: fix CVE-2026-41178 #955
OCPBUGS-38662: Use 10min inertia for GuardControllerDegraded #956
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-4418: feat: inject tls groups #679
OCPSTRAT-3618: Rebase 1.37 #660
OCPBUGS-114428: Update build-machinery-go vendor dependency #676
OCPBUGS-107969: bump otel to v1.44.0 to fix CVE-2026-41178 #662
OCPBUGS-38663: Use 10min inertia for GuardControllerDegraded #661
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #183
Full changelog

cluster-machine-approver

OCPBUGS-136132: Remove vendor for cluster-machine-approver-tests-ext #356
NO-JIRA: Move JoelSpeed to advisory_approvers #357
NO-JIRA: Fix inconsistent vendoring #345
OCPBUGS-57437: Add serving cert renewal e2e test #342
OCPBUGS-57437: Always permit asking node name in CSR SANs #344
OCPCLOUD-3659: bump Kubernetes dependencies to 1.37 #340
NO-JIRA: Add OTE #341
NO-JIRA: feat(tls): add support for TLS groups/curve preferences #308
OCPBUGS-99489: Add NetworkPolicy manifests to openshift-cluster-machine-approver namespace #313
OCPBUGS-121194: fix: retry serving CSRs while Machine addresses populate #321
OCPBUGS-57437: Always validate EgressIPs #309
Full changelog

cluster-monitoring-operator

OCPBUGS-123708: exclude secondary pod interfaces from node exporter #3131
NO-JIRA: clarify NVMe subsystem collector documentation #3161
NO-ISSUE: fix hack/go/generate versions.go #3174
MON-4699: allow-list Trainer usage metrics #3170
MON-4653: verify empty remote write source labels serialization and merge #3165
MON-4658: verify integer batch send deadline conversion #3163
MON-4654: verify remote write URL query parameters survive conversion #3166
MON-4659: verify integer remote write backoff conversion #3164
MON-4657: verify integer remote write timeout conversion #3162
MON-4660: verify integer metadata send interval conversion #3152
OU-1306: add monitoring-plugin backend proxy for all non-GET requests #3159
OCPBUGS-132863: remove Prometheus config reloader rules #3169
NO-JIRA: [bot] Synchronize versions of the downstream components #3167
NO-JIRA: [bot] Update jsonnet dependencies #3168
MON-4655: append byte unit to enforced body size limit #3145
NO-JIRA: chore: restrict NetworkPolicy ingress rules for thanos ruler and thanos sidecars on prometheus pods #2926
NO-JIRA: [bot] Synchronize versions of the downstream components #3153
OCPBUGS-35391: separate infra memory capacity from workers #3132
OCPBUGS-99988: amcfg: remove client-side TLS enforcement for additional alertmanager configs #3012
NO-JIRA: configure custom features for monitoring-plugin #3149
OCPBUGS-128640: filter ciphers not supported by Thanos #3134
OCPBUGS-11267, OCPBUGS-123539: tidy up RBAC permissions on secrets and configmaps for Prometheus operators #3053
ART-22049: remove references to configmap-reloader image #3051
NO-JIRA: [bot] Synchronize versions of the downstream components #3118
NO-ISSUE: [bot] Update jsonnet dependencies #3117
OCPBUGS-125779: don’t delete admin-owned Alertmanager secrets on destroy #3133
NO-JIRA: [bot] Synchronize versions of the downstream components #3105
MON-4696: Bump prometheus-operator dependencies to v0.94.1 #3102
OCPBUGS-126689: fix(e2e): use Job with backoffLimit for TestDocExamples #3094
OCPBUGS-123794: Fix flaky TestTelemetryReport/rate_issues #3093
NO-JIRA: [bot] Synchronize versions of the downstream components #3097
MON-4689, OCPBUGS-123539: Bump prometheus-operator jsonnet and libs to v0.94.0 #3083
OCPBUGS-123792: restore node-exporter textfile metrics with read-only rootfs #3088
NO-JIRA: [bot] Synchronize versions of the downstream components #3089
NO-JIRA: Skip flaky TestTelemetryReport/rate_issues subtest #3087
OCPBUGS-83375: Create alerting rule for metrics-server failing to scrape kubelet #2933
MON-4638: align ThanosQueryOverload description with for=1h #3062
MON-4665: wire zoneinfo node-exporter collector from ClusterMonitorin… #3063
NO-JIRA: Makefile: ensure JUnit test name prefix is applied even on test failure #3079
NO-ISSUE: update jsonnet dependencies #3077
NO-JIRA: [bot] Synchronize versions of the downstream components #3076
MON-4560: implement merge logic in CMO for the new field in the ClusterMonitoring CRD #3056
MON-4632, MON-4633: Send metrics ramen:dr_policy_type:max and ramen:dr_protected_apps:max via Telemetry #3074
MON-4617: Update kube-prometheus and add resourceMetricsAPI field #3069
NO-JIRA: [bot] Synchronize versions of the downstream components #3068
NO-JIRA: Fix staticcheck warnings across multiple packages #3059
NO-JIRA: test: produce JUnit XML from e2e runs in CI #3054
NO-JIRA: Makefile: version-stamp golangci-lint binary to prevent stale linter - #3057#3057 #3057
OCPBUGS-99769: wrap library-go resourceCache with mutex for thread safety #3040
NO-JIRA: hack/tools: remove unused vendor directory #3055
Full changelog

cluster-network-operator

OSASINFRA-4400: Add support for max_allowed_address_pairs OpenStack #3058
OCPBUGS-105402: Remove EVPN feature gate #3137
OCPBUGS-76964: ovn-kubernetes: Relax control-plane zone anti-affinity #3215
Merge #3106
OPNET-812: network: consume the BGPVIPConfig CR #3207
NO-JIRA: Align frr-k8s CRDs with AS-Path prepend support #3197
OPNET-812: vendor: bump openshift/api and openshift/client-go to current master #3206
CORENET-7707: Update AdminPolicyBasedExternalRoute CRD to be consistent with upstream #3210
CORENET-6512: [CNO] Setup OTE framework and migrate test cases from tests-private #3015
CNV-97772: ovn-kubernetes, Gate MAC security schemas for Tech Preview #3179
OCPBUGS-123662: Provide clarity on status of NOO installation #3166
OPNET-819: frr-k8s: master-monitor follows platform pod conventions #3202
CORENET-7580: Bump Kubernetes to 1.37.1 #3183
CORENET-6320: fix(workloads): enforce read-only root filesystems #3170
OPNET-783: statusmanager: Treat zero-node DaemonSets as rolled out #3046
NO-ISSUE: Align frr-k8s 5.1 CRDs #3195
OPNET-783: network: Add BGP VIP management support #3047
OCPBUGS-130570: Added global overrides for OVN-Kubernetes #2851
OCPBUGS-123509: multus: Refresh ignored namespaces on namespace changes #3167
CORENET-7399: Expand golangci-lint configuration with comprehensive linter set #3164
OCPBUGS-127174: Fix issues when NetObserv fails to install #3171
NO-JIRA: fix(ovn-kubernetes): disable local DB probes #3163
CORENET-7275: Add AGENTS.md, point CodeRabbit knowledge base at it #3146
CORENET-7479: Add status.vrfName and shortNames to UDN/CUDN CRDs #3145
OCPBUGS-113591: golangci-lint: enable ContextTodo/ContextBackground in usetesting #3138
OCPBUGS-92080: Adds rendering of enable-multi-network-policy in ovnkube-node #3084
OCPBUGS-112562: CVE-2026-41178 - bump go.opentelemetry.io/otel to v1.44.0 #3132
OCPBUGS-112278: Add ConfigMap hash annotation to networking console plugin deployment #3131
CORENET-6714: Install NOO using OLMv0 instead of OLMv1 #3115
OCPBUGS-64582: Drop strategy.rollingUpdate and switch strategy.type to Recreate via pre-patch in frr-k8s-statuscleaner deployments on SNO #3121
OCPBUGS-105887: Filter unsupported cipher suites to prevent ovnkube-identity crash #3119
NO-ISSUE: modernise the codebase using go fix #3113
CORENET-7330: Allow per-node OVN encap IP override via env-overrides #2998
Full changelog

cluster-node-tuning-operator

NO-JIRA: Update cluster-node-tuning-operator-container image to 5.1 #1688
NO-JIRA: chore(deps): bump the catch-all group with 7 updates #1690
NO-JIRA: Add Dependabot config #1689
OCPBUGS-137756: Allow kube-apiserver-operator to reach the webhook server #1684
NO-JIRA: Bump Kubernetes, OpenShift and other dependencies #1680
OCPBUGS-97787: Make the hwlatdetect latency test configurable for targeting all node CPUs #1671
NO-JIRA: tuned: do not panic on truncated sysctl override log line #1673
NO-JIRA: Replace os.ModePerm with explicit 0o755 for directory creation #1674
OCPBUGS-133755: Raise memory request to match observed real usage #1678
CNF-28347: Makefile: fix ARM e2e target and Hypershift ginkgo args #1675
NO-JIRA: fix isolatedCpuFreq doc comment to say maximum frequency #1669
NO-JIRA: Restrict metrics and webhook ingress #1670
NO-JIRA: tuned: restrict profile names #1661
OSDOCS-22738: Fix hexadecimal typos in PerformanceProfile device comments #1640
OCPBUGS-129451: E2E: remove always-skipped IRQ load balance test #1653
OCPBUGS-129613: E2E: Add labels to ovsdpdk tests #1657
NO-JIRA: Update OWNERS file #1655
OCPBUGS-129449: E2E: Fix flaky test_id:64099 reboot assertion #1652
OCPBUGS-115749: Tighten operator RBAC to least privilege #1639
OCPBUGS-66217: PerformanceProfile and Tuned CRDs during bootstrap #1596
OCPBUGS-127113: E2E: Fix no-op Get() assertions in mixedcpus #1571
OCPBUGS-129448: E2E: check against available cpus instead of online cpuset #1645
OCPBUGS-129450: E2E: LLC: Fix assertions of odd cpus allocations #1644
OCPBUGS-129165: Makefile: Modify pao-functests-update-only to run tier-0 and tier-1 tests #1651
OCPBUGS-105474: Prevent offlined CPUs from being re-onlined after reboot by udev hotplug rule #1618
OCPBUGS-126458: E2E: PPC: replace no-op log-on-match with actual assertions (4 sites) #1638
NO-JIRA: Address govulncheck complaints #1637
OCPBUGS-127362: E2E: ovsDpdk remaining cases and consolidate suite #1628
OCPBUGS-116703: E2E: add missing matcher to offlined CPU Expect() calls #1629
OCPBUGS-112336: apis: add missing fields to apis v1 #1597
NO-JIRA: Fix CentOS Stream image build failing in dnf history undo #1633
CNF-23698: e2e: make OVS dynamic pinning tests compatible with ovsDpdk CPUs #1598
CNF-25173: e2e: resolve primary MCP from profile in test 32364 #1624
OCPBUGS-113651: Disable timer.migration on RHCOS 10 #1614
CNF-26060: add optional –ovs-dpdk-cpu-count flag (default 0) #1590
NO-JIRA: Bump Kubernetes, OpenShift and other dependencies #1615
OCPBUGS-113647: E2E: Minor fixes to Memory Manager and hugepages split tests #1578
OCPBUGS-112537: E2E: Fix ovs dynamic pinning, kubelet and mustgather tests #1565
CNF-26497: unconditionally disable fwupd-refresh.timer #1591
OCPBUGS-112025: Bump golang.org/x/net #1593
OCPBUGS-105476: Update PPC help description #1582
OCPBUGS-105458: Use Add() instead of AddRateLimited() for routine Profile enqueues #1584
NO-JIRA: ci: disable smt alignment for ovsDpdk tests #1589
Full changelog

cluster-olm-operator

NO-ISSUE: Bump golang.org/x/text from 0.42.0 to 0.43.0 #258
NO-ISSUE: Align CLI dependencies with Kubernetes 1.37 #262
OCPBUGS-132357: Prevent TLS curve restart loop on FIPS clusters #257
OPRUN-4799: Update OpenShift and Kubernetes libraries #260
NO-ISSUE: Remove SingleOwnNamespaceInstallSupport integration #256
NO-ISSUE: Bump github.com/operator-framework/operator-controller from 1.11.0 to 1.12.0 #253
NO-ISSUE: Support object-controller (ClusterObjectSet) component #255
OPRUN-4768: Apply TLS curve preferences to metrics server #248
OCPBUGS-105876: Wire availableInertia into the olm StatusSyncer #233
OPRUN-4645: observe and apply TLS curve preferences to operand deployments #226
NO-ISSUE: Bump helm.sh/helm/v3 from 3.21.3 to 3.21.4 #235
NO-ISSUE: Bump the k8s-dependencies group across 1 directory with 5 updates #237
NO-ISSUE: Bump golang.org/x/text from 0.40.0 to 0.41.0 #234
NO-ISSUE: Bump github.com/stretchr/testify from 1.11.1 to 1.12.1 #236
NO-ISSUE: Bump the k8s-dependencies group across 1 directory with 5 updates #227
NO-ISSUE: Bump github.com/operator-framework/operator-controller from 1.5.1 to 1.11.0 #228
NO-ISSUE: Update dependabot config with NO-ISSUE prefix #232
NO-ISSUE: Bump github.com/go-logr/logr from 1.4.3 to 1.4.4 #231
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-133763: Raise openshift-apiserver-operator memory request to 210Mi #815
NO-JIRA: Update library-go to get unprivileged KMS container #820
NO-JIRA: Update library-go to get new KMS API #818
NO-JIRA: kms: wait for SNO kube-apiserver rollout before scenarios #813
NO-JIRA: bump(openshift/library-go): to get retry in preflight check status report #812
CNTRLPLANE-4439: feat: inject tls groups #793
NO-JIRA: Update library-go to run conditional step in KMS #811
NO-JIRA: bump(openshift/library-go): to get KMS GA #810
NO-JIRA: Update library-go #809
NO-JIRA: Update library-go #807
CNTRLPLANE-4731: Adding KMS e2e preflight and e2e rotation #806
NO-JIRA: Update library-go #803
NO-JIRA: Update library-go #802
NO-JIRA: bump openshift/api https://github.com/openshift/api/pull/3083 #798
NO-JIRA: Open bump library-go https://github.com/openshift/library-go/pull/2518 #797
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2512 #794
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2474 #792
CNTRLPLANE-3237: encryption/assertion: bring back the preflight assertion for CAO and OAS-O #787
CNTRLPLANE-3237: bump library-go to get the new KMS plugin deployment strategy #781
OCPBUGS-109468: fix CVE-2026-41178 by updating otel to v1.44.0 #761
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2478 #783
OPRUN-4768: bump openshift/api #782
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2463- #2309 #770
OCPBUGS-114428: Update build-machinery-go vendor dependency #768
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2439 #767
CNTRLPLANE-3237: pick https://github.com/openshift/library-go/pull/2449- #2287 #764
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2451 #763
CNTRLPLANE-3237: kms: wire EncryptionConfigurationComputer into encryption controllers #762
NO-JIRA: Bump library-go #760
CNTRLPLANE-3237: kms: wire preflight deployer #758
NO-JIRA: Update library-go to get latest changes #759
NO-JIRA: Update KMS cases and bump library-go #756
CNTRLPLANE-3237: pull https://github.com/openshift/library-go/pull/2430 #754
OCPBUGS-105786: Revert “Revert “NO-JIRA: Disable WatchList feature gate due to the missing support of Project watch”” #751
Full changelog

cluster-policy-controller

OCPSTRAT-3618: bump k8s 1.37 #211
CNTRLPLANE-3731: Add Agentic SDLC context files to cluster-policy-controller #191
Full changelog

cluster-samples-operator

NO-ISSUE: Restrict samples operator access to the global pull-secret #726
CNTRLPLANE-4448: Support for TLS Group Preferences #725
OKD-425: Revert openliberty back to 26.0.0.6 #709
TRT-2905: Fix python:latest and nodejs template references after UBI 8 tag removal #706
Full changelog

cluster-storage-operator

STOR-3187: maxUnavailable fix #777
STOR-3232: Rename device-exporter assets #770
STOR-3232: Add probes to the device exporter Pods #771
STOR-3232: Set loglevel of the device exporter #769
STOR-3187: CSO: csi-volume-device-exporter for storage path alerting #757
OCPBUGS-133757: Update storage and CSI driver operator memory requests #763
STOR-3190: Automate tests for StoragePathAlerting #761
STOR-3187: Add csi-volume-device-exporter to CSO manifests #762
OCPBUGS-104847: Remove SELinuxMountGAReadiness patches #759
STOR-3172: Add TLS group support to CSO #758
STOR-3176: Add featuregates and clusterversions permissions to ClusterRoles #756
STOR-3068: Bump all libraries #755
OCPBUGS-120762: restrict azure-file secrets ClusterRole to get/list/watch/create #750
OCPBUGS-127462: Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile #748
OCPBUGS-127453: Fix the un-upgradeable message #746
OCPBUGS-127453: Use KCS link in the un-upgradeable message #744
GCP-958: re-enable GCP PD CSI driver in HyperShift path #742
GCP-958: temporarily disable GCP PD CSI driver in HyperShift path #739
GCP-1075: feat(gcp-pd): enable HyperShift support for GCP PD CSI driver operator #728
OCPBUGS-112710: clusterrole/openshift-csi-main-snapshotter-role needs volume group snapshot rules #727
OCPBUGS-91027: Add KAS-defaulted fields to storage-operator ValidatingAdmissionPolicy manifests #726
OCPBUGS-105391: Pass management cluster proxy env vars to CSI driver operator deployments #723
Full changelog

cluster-update-console-plugin

NO-JIRA: Remove redundant verification link and improve preview timestamps #37
NO-JIRA: Polish analysis timestamps and live update progress #36
OTA-2135, OTA-2136: Add staged cluster update workflow, readiness, and rollout progress #35
OCPBUGS-128821: Fix analysis timeout stuck in Analyzing state #25
OTA-2140: Add ApprovalPolicy warning banner for non-manual stages #28
OCPBUGS-128825: Re-analyse deletes AgenticRun for fresh cluster data #26
NO-JIRA: Update OWNERS file #27
Full changelog

cluster-version-operator

OCPBUGS-135248: Recreate deleted AgenticRuns promptly #1501
OCPBUGS-133746: Raise CVO memory request to 240Mi #1502
NO-JIRA: Remove CRD COPY lines from Dockerfile #1507
OTA-2132: phase-aware lifecycle for execution step #1478
NO-JIRA: Stop using Fauxinnati in the e2e tests #1493
OCPBUGS-105406: pkg: Drop conditionals around default-enabled ImageStreamImportMode feature gate #1469
OCPBUGS-74520: replace UpgradeStatus with CVOConfiguration #1505
OCPCLOUD-3725: chore(bump): update openshift/api #1506
NO-JIRA: docs: Document the agentic run assessments and the console plugin #1503
OTA-2144: Add a curve preference override for metrics #1500
OCPCLOUD-3725: refactor(capability): use ClusterAPIOperator instead of ClusterAPIMachineManagement #1499
NO-JIRA: test/util: wait for the update service to serve before returning #1498
OTA-2144: TLSGroups support on the /metrics endpoint #1495
CNTRLPLANE-4455: Inject observed TLS Groups into annotated ConfigMaps #1484
NO-JIRA: test/cvo: serve accept-risks graph from in-cluster update service #1476
OTA-2130: add execution step, planner skill, and risk data #1475
OCPBUGS-65558: Cancel payload retrieval pod on upgrade clear #1470
OCPBUGS-8252: pkg/cvo: report unresolvable desired releases #1467
OCPBUGS-129378: skip console plugin deployment on OCP < 5.0 #1482
NO-ISSUE: docs/user/tasks-*by-number-and-component.svg: Update to 5.0 #1485
NO-JIRA: pkg/cvo: add architecture label to cluster_version_payload #1480
NO-ISSUE: test/cvo: set needRecover before mutating cluster resources #1477
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #1471
OKD-194: Add OKD cincinnati as the default update service for OKD #1466
OTA-2109: harden console plugin nginx TLS configuration #1453
OTA-2110: remove cluster_id from LLM-bound readiness payload #1451
OTA-2111: set readOnlyRootFilesystem on console plugin container #1452
OTA-2108: restrict console plugin NetworkPolicy to openshift-console namespace #1450
OTA-2106: drop NetworkCheck (SDN gone, proxy data unused) #1442
NO-ISSUE: pkg/readiness/cluster_conditions: Conditionally include Upgradeable #1463
OCPBUGS-54864: reduce verbosity of skipping metrics log messages #1439
NO-ISSUE: OWNERS: Pratik is no longer at Red Hat :( #1449
OCPBUGS-80925: Remove the CRB for the default openshift-cluster-version SA #1366
OCPBUGS-110322: pkg/agenticrun/controller: Pivot to cluster-update-advisor directory #1446
“OTA-2107: Harden AgenticRun against indirect prompt injection” #1443
Full changelog

console

NO-JIRA: Remove FLAG_OPENSHIFT_5 #17528
OCPBUGS-45525: Expand CSP dev-mode documentation for plugin authors #17430
OCPBUGS-139150, NO-JIRA: e2e cleanup and disable migration specs #17515
OCPBUGS-51368: Disable telemetry when Segment JS host is not configured #17497
OCPBUGS-123211: Persist Segment sampling decision across page reloads #17179
CONSOLE-5065: Update relative path links in plugin SDK docs to use Console repo URLs #17488
NO-JIRA: even more react 19 alignment #17495
OCPBUGS-134567: Fix CSP violation dedup for eval/inline tokens #17492
OCPBUGS-123174: Count app and sidecar restarts in the Pods Restarts column #17435
CONSOLE-5457: Fix remaining react compiler violations #17474
ART-24740: Update to Node.js® v24 #17487
CONSOLE-5065: Refactor shared module code and add validation of shared dynamic modules #17439
GCP-1219: bridge: off-cluster / control-plane-side console fixes (TLS trust, proxy management) #17185
OCPBUGS-35735: Hide upstream plugin resource error pages #17366
NO-JIRA: Update clean.sh to clean demo plugin files #17473
NO-JIRA: switch to OWNERS file-based approach for plugin api changes #17472
CONSOLE-5571: Share react(-dom, /jsx-runtime) as singletons #17462
CONSOLE-5527: Integrate OLMv0 and OLMv1 navigation #17389
OCPBUGS-63688: Remove incorrect msg in maintenance modal #17419
CONSOLE-3958: Replace getting started components with MultiContentCard #17444
CONSOLE-5568: update demo plugin tooling config #17453
CONSOLE-5568: clean up eslint config in vscode #17442
OCPBUGS-132777: Remove the redundant detailsPage wrapper #17413
CONSOLE-5527: Split operator catalog into Classic and Next-Gen types #17355
CONSOLE-5570: Allow blob image sources in the default CSP #17437
OCPBUGS-128928: Preserve ~new route when switching projects #17349
OCPBUGS-132338: Preserve revealed Secret values across page rerenders #17412
CONSOLE-5568: migrate to oxlint #17425
CONSOLE-5479: UI and backend for OLMv0-to-OLMv1 migration #17377
OCPBUGS-132933: Isolate polling test plugin mocks #17421
NO-JIRA: migrate to ESM only + migrate to oxfmt #17408
OCPBUGS-132163: Use “Technology Preview” in preview badge labels #17396
CONSOLE-5477: Support TLS group preferences #17371
CONSOLE-5567: Increase size of annotation, label and taint edit modals #17398
OCPBUGS-114708: Remove early “analytics.page()” on Segment init #17178
OCPBUGS-132032: Restore ConfigMap and BuildConfig form view edit actions #17397
CONSOLE-4824: migrate remaining jsx/js to tsx/ts #17391
CONSOLE-5552: Add Bridge CSP mode flag #17369
NO-JIRA: Console plugin SDK package CHANGELOG update #17392
CONSOLE-5065: Migrate off of deprecated TS types #17140
CONSOLE-5065: Hold back on dynamicModulePatternFlyPackages update #17390
OCPBUGS-125794: Show Software Catalog operators for namespace-scoped users #17327
CONSOLE-5564: ConsoleDataView API improvements #17385
OCPBUGS-130732: Add security response headers #17376
CONSOLE-5065: Update dynamicModulePatternFlyPackages and related imports #17379
HELM-863: Show Helm nav tab regardless of HelmChartRepository/ProjectHelmChartRepository instance existence #17338
CONSOLE-5564: Add rearrangable columns to ConsoleDataView #17370
CONSOLE-5549: Add performance profiling for the dashboards page #17346
CONSOLE-5560: table column extension follow ups #17363
CONSOLE-5560: Add ConsoleDataView table column extensions #17351
OCPBUGS-84497: Cap rendered alerts in notification drawer and dashboards #17324
CONSOLE-5544: Migrate OLM tables to ConsoleDataView #17342
CONSOLE-5540: Migrate metal3, container-security, and shipwright tables to ConsoleDataView #17340
CONSOLE-5099: Add kubeconfig download for ServiceAccounts and current user #17199
OCPBUGS-128719: fix incorrect breakpoint in code editor sidebar #17336
CONSOLE-5539: Migrate knative tables to ConsoleDataView #17326
OCPBUGS-128465: Fix flaky namespace selection and eliminate cross-file contention in OLM Data Grid e2e specs #17329
HELM-859: Guard against null/missing urls in Helm charts #17280
OCPBUGS-127046: provide PatternFly dynamic modules without Console consuming them #17318
NO-JIRA: Document the console.page/resource/list contract #17312
OCPBUGS-71193: Group details page renders a kebab button instead of Actions button #17197
NO-JIRA: small improvements and dep bumps #17219
CONSOLE-5113: Add default namespace warnings #17177
OCPBUGS-126807: Post qa-verify evidence via gh’s native –attach instead of base64 #17193
OCPBUGS-125223: restore some old test-prow-e2e scenarios #17187
OCPBUGS-126219: i18n upload/download routine task - version 4.²³⁄₅.0 (Additional) #17190
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #17176
OCPBUGS-90834: Fix empty vSphere connection details after upgrade #17020
OCPBUGS-123141: i18n upload/download routine task - version 4.²³⁄₅.0 #17165
CONSOLE-4998: Add types for serverless resources #17152
OCPBUGS-121263: bump go-git to 5.19.2 #17148
OCPBUGS-115458: CVE-2026-84375 bump js-yaml to 3.15.²⁄₄.3.2 #17133
OCPBUGS-115318: fix Helm test flake by replacing pkill with PID-file cleanup #17128
OCPBUGS-120684: Update stale comment #17141
NO-JIRA: add prettier to playwright folder #17137
OCPBUGS-115300: Stabilize topology, node-groups, and debug-pod e2e #17134
OCPBUGS-115300: Fix Playwright login helper idempotency and session recovery #17126
HELM-480: Change handler return code #17042
OCPBUGS-115298: Rename e2e scripts so playwright is the main one #17127
CONSOLE-5002: UserPreferenceContextand linting follow up #17124
OCPBUGS-109632: Fix webhook creation in Git for PAC #17078
NO-JIRA: fix session-persistence tests failing due to pre-loaded storageState #17121
CONSOLE-5002: re-render user preferences only when a listened key changes #17104
OCPBUGS-114052: move yarn install to prow scripts #17119
OCPBUGS-115128: Upgrade grpc to v1.83.2 and x/net to v0.58.0 #17120
RFE-9146: Docs followup for service account impersonation #17093
CONSOLE-5000: Remove Redux activeNamespace in favor of NamespaceContext #17102
NO-JIRA: Improve readability of test-frontend output #17080
OCPBUGS-112809: Restore panic on Helm test infrastructure failure #17077
OCPBUGS-85646: display operators in catalog when Tech Preview enabled #16976
OCPBUGS-95590: Hide Builds nav section when Build capability is disabled #16891
CONSOLE-5001: Remove ImmutableJS #17024
OCPBUGS-105603: Strip version tag from OCI chart URL to prevent doubl… #16999
OCPBUGS-99884: Fix “Set as default” StorageClass action #17066
OCPBUGS-112462: Remove empty integration-tests package from CI #17064
OCPBUGS-52186: Show CPU/Memory metrics for non-admin users on Projects page #17001
OCPBUGS-111698: Migrate app/ Cypress e2e tests to Playwright #17015
OCPBUGS-112046: fix Helm test flake by detecting dead processes early #17039
CONSOLE-5463: Turn on react compiler linting rules #17032
OCPBUGS-75963: Fix Edit Machine count action on MachineSet details page #17038
OCPBUGS-95597: Fix UI validation for private Bitbucket repositories #17028
OCPBUGS-111634: Keep OLS cluster-update prompts within OpenAI 32k limit #17018
OCPBUGS-111699: Migrate secrets e2e tests from Cypress to Playwright #17006
CONSOLE-5159, OCPBUGS-95606: Replace deprecated Node10 moduleResolution with Bundler for TS6 compatibility #16259
OCPBUGS-111929: Fix plugin entrypoint failing to load #17027
HELM-827: Add RTL unit tests for 9 critical Helm plugin components #16909
NO-JIRA: add myself to owners and add frontend owners to .claude #17025
OCPBUGS-86298: Fix missing Impersonate action on RoleBinding detail page #16783
OCPBUGS-86294: Fix MachineAutoscaler modal crash when opened from detail page #16781
OCPBUGS-86511: Fix flaky TestAsyncCache backend test #17009
OCPBUGS-111644: Shared Playwright e2e context and test generation skill #16986
CONSOLE-5003: reimplement and enable jest linting #17019
OCPBUGS-95594: make cloud provider fields optional during operator install #16927
OCPBUGS-14473: Guard against undefined data in dashboard charts #16952
And 49 elided commits (e.g. from squash or rebase merges)
Full changelog

console-operator

CONSOLE-5180: Add quick start for configuring additional console routes #1253
TRT-3060: Revert #1158 “CONSOLE-5293: Use console-downloads image instead of cli-artifacts” #1251
CONSOLE-5293: Use console-downloads image instead of cli-artifacts #1158
OCPBUGS-132701: Gate tlsGroups observation on TLSGroupPreferences #1248
CONSOLE-5477: Support TLS group preferences #1240
HELM-850: Address review feedback on Helm CLI download descriptions #1235
RFE-4149: Read only filesystem - temp directory mount #1014
TRT-3005: Revert #1227 “OCPSTRAT-3567: Replace console allow-all NetworkPolicy with scoped policies” #1241
NO-JIRA: Update API and client-go dependencies for Console ingress helper rename #1236
OCPSTRAT-3567: Replace console allow-all NetworkPolicy with scoped policies #1227
OCPBUGS-86719: Use zero-downtime rollout strategy for console pods #1168
CNTRLPLANE-4564: Update to the latest openshift/api and rebase to 1.37 #1237
OCPBUGS-109666: fix the name of the Helm release in EAP 8.1 quickstart #1208
OCPBUGS-121388: Make console status flush cancellation-aware #1228
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #1230
CONSOLE-5405: Update console-operator to Kubernetes 1.36 #1211
OCPBUGS-104500: Use content hash for ConfigMap deployment annotations #1217
OCPBUGS-71237: Generate session-secret for all auth types #1204
OCPBUGS-58422: Handle disabled Ingress capability in HyperShift #1182
OCPBUGS-92204: Clear stale OIDC degraded condition on auth type change #1212
CNF-23047: Migrate away from deprecated ioutil #1072
OCPBUGS-104854: Fix excessive DeploymentUpdated events via content hash #1210
OCPBUGS-109670: Derive documentationBaseURL dynamically from OPERATOR_IMAGE_VERSION #1209
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

CORENET-7231: Update OWNERS file #241
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #248
OCPBUGS-83863: Remove rhel8 build stage #228
Full changelog

coredns

OCPBUGS-126051: bump google.golang.org/grpc to v1.84.0 #223
NE-2790: Update CoreDNS to v1.14.7 #197
OCPBUGS-125770: validate DNS requests before unpacking #217
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #215
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OSASINFRA-4483: UPSTREAM: <carry>: Initial Dockerfile for osbrick-sidecar #447
UPSTREAM-SYNC: Sync main with latest upstream (release-1.37) #446
OCPBUGS-98116: Bump golang.org/x/crypto to v0.52.0 #410
Full changelog

csi-driver-nfs

UPSTREAM-SYNC: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master (f12e133) into main #199
Full changelog

csi-external-attacher

STOR-3085: Rebase to upstream v4.13.0 for OCP 5.1 #123
Full changelog

csi-external-provisioner

STOR-3085: Rebase to upstream v6.4.0 for OCP 5.1 #165
Full changelog

csi-external-resizer

STOR-3085: Rebase to upstream v2.3.0 for OCP 5.1 #217
Full changelog

csi-external-snapshot-metadata

STOR-3085: Rebase to upstream v1.1.0 for OCP 5.1 #35
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #27
NO-ISSUE: Bump golang.org/x/net to v0.53.0 and Go to 1.25.10 #22
Full changelog

csi-external-snapshotter, csi-snapshot-controller

STOR-3085: Rebase to upstream v8.7.0 for OCP 5.1 #260
Full changelog

csi-livenessprobe

STOR-3085: Rebase to upstream v2.20.0 for OCP 5.1 #105
OCPBUGS-122222: Bump go.opentelemetry.io/otel to v1.44.0 to address CVE-2026-41178 #96
Full changelog

csi-node-driver-registrar

STOR-3085: Rebase to upstream v2.18.0 for OCP 5.1 #110
Full changelog

docker-builder

OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #558
NO-JIRA: Bump golang.org/x/crypto, update CI builder images and go directive to go1.26 #555
Full changelog

docker-registry

NO-JIRA: add self to reviewers #500
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #487
CNTRLPLANE-4447: add support for configuring TLS groups #488
OCPBUGS-99398: Fix resolveUpstreamRef to properly propagate not-found errors #475
Full changelog

egress-router-cni

OCPBUGS-55356: Fix invalid IPv6 sysctl key for enabling IP forwarding #112
OCPBUGS-105251: Update Dockerfiles #111
Full changelog

etcd, installer-etcd-artifacts

CNTRLPLANE-4423: Add –listen-curve-preferences to configure TLS curves #430
CNTRLPLANE-4423: Revert “Add –curve-preferences to configure TLS curves” #429
NO-JIRA: Rebase v3.6.16 on main(5.1) #427
CNTRLPLANE-4423: Add –curve-preferences to configure TLS curves #420
NO-JIRA: allow 60s for snapshot member readiness #424
NO-JIRA: allow 180s for retained client reconnect #423
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #415
CNTRLPLANE-3724: add agentic context docs for the openshift/etcd fork #411
Full changelog

gcp-cloud-controller-manager

OCPCLOUD-3677: Merge https://github.com/kubernetes/cloud-provider-gcp/tree/master (4a8ab73) into main- #177 #177
Revert “OCPCLOUD-3677: Merge https://github.com/kubernetes/cloud-provider-gcp/tree/master (05550ad) into main” #175
OCPBUGS-122200, OCPCLOUD-3677: Merge https://github.com/kubernetes/cloud-provider-gcp/tree/master (05550ad) into main #133
Full changelog

gcp-cluster-api-controllers

NO-JIRA: Move JoelSpeed to advisory_approvers #328
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #314
UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.13.1 (8198b8b) into main #302
Full changelog

gcp-machine-controllers

NO-JIRA: Move JoelSpeed to advisory_approvers #208
OCPCLOUD-3662: bump Kubernetes dependencies to 1.37 #197
OCPBUGS-90560: resolve boot disk image at reconcile time #181
OCPBUGS-82191: Wait for RUNNING before providerID; retry stockout #160
Full changelog

gcp-pd-csi-driver

STOR-3069: Rebase gcp-pd-csi-driver to upstream v1.27.1 for OCP 5.1 #140
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #131
Full changelog

haproxy-router, haproxy-router-haproxy32

OCPBUGS-134713: Reuse polled router configuration in template assertions #878
OCPBUGS-126074: bump grpc-go to v1.84.0 #866
NE-2913: Remove obsolete HAProxy 2.8 image definition #880
NE-2126: Bring the Route tests extension in line with the OTE migration guidelines #871
ART-24842: Build router test extension from committed QE fixtures #875
OCPBUGS-77344: enable dcm on route changes #778
NE-2510: Remove unused os_wildcard_domain.map #830
OCPBUGS-128105: Allow disabling endpoint address validation #860
ART-24596: Update openshift/origin to v1.6.2 in tests-extension #868
OCPBUGS-77056: External certificate routes admit slowly at scale #863
NE-2912: Add HAProxy 3.4 standalone image #853
NE-2126: Ship tests-ext binary as raw gzip instead of tar.gz #867
OCPBUGS-88730: Validate positive rate limits #850
NE-2126: Migrating Route test cases from QE repo #848
NO-JIRA: Add pedjak to OWNERS #847
OCPBUGS-84250: Add debug logging when dynamic update fails #836
OCPBUGS-77056: Lock DeleteFunc to stop SARCompleted overwriting rejection #840
Full changelog

hyperkube, installer-kube-apiserver-artifacts, kube-proxy, pod

OCPBUGS-137196: UPSTREAM: 143844: Add parameter for number of parallel clones #2849
NO-JIRA: Rebase v1.37.2 in master #2837
OCPBUGS-135114: UPSTREAM: 142640: do not panic create ingress on extra equals #2833
OCPBUGS-61465: Add a new field Mapped into openshift-test extension Image struct #2598
OCPBUGS-127118: UPSTREAM: <drop>: bump apiserver-library-go #2846
CNTRLPLANE-4424: Add flag to support TLS Curve Preference #2831
OCPBUGS-136120: UPSTREAM: 143558: drop newline from ObjectName #2836
OCPBUGS-136119: UPSTREAM: 143385: match verbosity flag by prefix #2835
OCPBUGS-136118: UPSTREAM: 143586: keep equals in –kuberc= paths #2834
OCPNODE-4850: rpm: this patch preps for kubernetes 1.38 changing to static binaries #2841
OCPBUGS-104847: Revert “UPSTREAM: <carry>: Store SELinuxWarningController upgrade check as a ConfigMap #2827
OCPBUGS-129682: Repair SingleReplica test exclusions #2815
UPSTREAM: <carry>: OCPBUGS-128829: Handle k8s-tests-ext IP family probe failures #2806
OCPBUGS-130922: UPSTREAM: <carry>: Fix vSphere topology test exclusions #2816
STOR-3083: Fix disabled tests for newer test names #2822
OCPBUGS-112749: Deflake pod resize deferred tests #2765
OCPBUGS-129642: UPSTREAM: <carry>: bump cadvisor for statseq fix #2819
OCPSTRAT-3618: Daemonset test has changed names -> needs corrected env selector #2813
: OCPBUGS-123651: UPSTREAM: <carry>: Add needed labels to RHEL pause image #2809
OCPSTRAT-3618: Rebase 1.37 #2738
OCPBUGS-127540: UPSTREAM: 142168: Refuse UNC symlink targets in Windows subPath resolution #2793
NOJIRA: add explicit merge commit message #2788
OCPBUGS-123651: UPSTREAM: <carry>: Use FROM scratch for RHEL pause image #2774
NO-JIRA: Rebase master to Kubernetes v1.36.4 #2777
NO-JIRA: Skip SELinuxMountReadWriteOncePodOnly tests now that SELinuxMount is GA #2782
OCPBUGS-104846: UPSTREAM: 141358: Enable group snapshot tests in all configurations #2747
NO-JIRA: Make graceful-termination-duration flag required for the watch-termination command #2761
Full changelog

hypershift

OSASINFRA-4401: Decouple CAPO and bump it to release-0.15 #10297
OCPBUGS-132731: fix(metrics-proxy): gzip-compress metrics scrape responses #10270
CNTRLPLANE-4737: ignition re-architecture (²⁄₇) — leader-elected payload-generator controller #10267
GCP-961: feat(gcp): default ingress DNS + ingress-operator WIF service account #9958
CNTRLPLANE-4361: Extend HostedClusterConfigurationDeprecated condition to report additional deprecated configuration mechanisms #9610
OSASINFRA-4494: Update CAPO to latest stable release (v0.15.1) #10018
OCPBUGS-140722: fix(e2e/v2): skip event TTL test on control planes before 5.1 #10291
OCPBUGS-140686: fix(control-plane-operator): enable compatibility requirements for default clusters #10288
OCPBUGS-140683: Compare release images by digest #10289
GCP-1228: Add GCP resource label E2E coverage #9697
NO-JIRA: Read ClusterVersion CRDs from /release-manifests #10243
CNTRLPLANE-4736: ignition re-architecture (¹⁄₇) — IgnitionPayload CRD + PayloadStore (gated) #9916
NO-JIRA: ci(deps): bump actions/actions-runner from 2.338.0 to 2.338.2 #10164
CNTRLPLANE-4969: test(e2e): label HostedCluster conditions for external runners #10246
NO-JIRA: ci(e2e-v2-aws): split public sequential group to avoid timeout #10254
NO-JIRA: Update Zensical to v0.0.74 and align docs tooling #10249
NO-JIRA: ci(deps): bump actions/setup-node from 7.0.0 to 7.1.0 #10010
NO-JIRA: ci(deps): bump codecov/codecov-action from 7.1.0 to 7.1.1 #9786
NO-JIRA: ci(deps): bump astral-sh/setup-uv from 10.3.2 to 10.3.3 #10227
NO-JIRA: update dependency zensical to v0.0.74 #9867
NO-JIRA: Allow Jira IDs in commit message bodies #10255
CNTRLPLANE-4417: (feat)make kube-apiserver event-ttl configurable per hosted cluster #9836
NO-JIRA: consolidate v2 e2e execution guidance #10221
CNTRLPLANE-4338: Extract global-configuration ownership with characterization #9920
CNTRLPLANE-3838: telemetry: add CAPI storage migration metrics recording rules #10130
GCP-1292: add –enable-gmp-monitoring plumbing and API-only GMP types #10041
CNTRLPLANE-4165: add E2E test coverage for ETCD Sharding #9702
CNTRLPLANE-4826: Document CAPI UpToDate status for Replace NodePools #10234
NO-JIRA: feat(OWNERS): introduce advisory approvers #10202
AUTOSCALE-970: Integrate karpenterignition for Azure: ignition injection and RHCOS image resolution #10038
NO-JIRA: skip CPU options test based in version #10236
OCPBUGS-137944: fix(cpo): update oauth cert SAN generation #10219
CNTRLPLANE-4522, CNTRLPLANE-4748: Surface persistent infra failures in AllMachinesReady condition #9781
OCPBUGS-135293: test(e2e/v2): poll for cluster-image-registry-operator readiness #10168
TRT-3079: fix(cpo): stop enabling the MachineAPI capability in guest clusters #10224
CNTRLPLANE-4936: Temporarily make deadcode advisory #10223
CNTRLPLANE-4403: External OIDC as webhook #9912
CNTRLPLANE-4797: Document Day 1 deterministic LoadBalancer IP assignment #10207
NO-JIRA: Drop size-based change guidance from CONTRIBUTING #10198
STOR-3187: Add csi-volume-device-exporter to cluster-storage-operator images #10147
NO-JIRA: consolidate v2 guidance to reduce drift #10181
CNTRLPLANE-4852: allow Chai to approve HyperShift PRs #10144
ROSAENG-75441: request HO v0.1.87 tag #10210
CNTRLPLANE-3937: e2e: verify mirror cleanup when imageContentSources is removed #10079
CNTRLPLANE-4862: Use public-only networking for additional AWS e2e v2 profiles #10154
AUTOSCALE-1044: run v2 Karpenter tests on hosted clusters 4.22+ #10183
CNTRLPLANE-4851: Document hosted cluster startup and teardown lifecycles #10149
OCPSTRAT-3686: Describe the HyperShift Operator nightly release stream #9981
OCPBUGS-49691: Include kube-api external trust bundle in service-ca #9983
AUTOSCALE-981: Enable Azure Karpenter identity configuration #10128
CNTRLPLANE-4820: Bump CAPK source pin to the CI controller revision #10174
OCPBUGS-131041: Increase Cluster Autoscaler defaults to 200 QPS and 300 burst #10006
OCPSTRAT-3955: introduce a v1 to v2 test migration procedure #10159
CNTRLPLANE-4576: Validate serviceAnnotations allowlist and size bounds #10142
CNTRLPLANE-4577: CPO passthrough of serviceAnnotations and loadBalancerClass to KAS Service #10133
OCPBUGS-129115: Validate external KubeVirt infrastructure kubeconfigs #9903
CNTRLPLANE-4817: Bump Azure CAPI provider (CAPZ) to v1.27.0 #10078
OCPBUGS-129436: Fix manual HA etcd snapshot recovery documentation #10150
CNTRLPLANE-4850: Bump core Cluster API to v1.14.3 #10143
NO-JIRA: ci(deps): bump astral-sh/setup-uv from 10.1.0 to 10.3.2 #10163
NO-JIRA: docs: direct contributors to #forum-ocp-hypershift #10153
GCP-1240: Add GCP Resource Manager tag API #9735
CNTRLPLANE-4447: Adds support for preferred TLS Groups #10148
OCPBUGS-109628: treat unstarted etcd member as unhealthy instead of aborting recovery #10035
CNTRLPLANE-4826: Stop gating NodePool rollout completion on upToDateReplicas #10084
CNTRLPLANE-4832: cover managed ingress DNS zone deletion #10100
NO-JIRA: chore(deps): update actions/download-artifact action to v8.0.2 (main) #9968
GCP-1315: test(e2e/v2): add GCP multi-cluster lifecycle platform config #9977
CNTRLPLANE-4513: chore(aws): stop writing and prune deprecated aws-load-balancer-subnets annotation #9807
CNTRLPLANE-4732: route kubelet through HAProxy on all public HCPs #9988
CNTRLPLANE-3928: e2e: verify workload pulls through the image mirror #10075
NO-JIRA: fix: remove CustomNoUpgrade HyperShift CRDs during API generation #10136
NO-JIRA: Fix parallel CAPI verification race #10073
CNTRLPLANE-4486: Enforce unit test function structure in hypershiftlinter #9738
NE-2816: update haproxy image #10065
CNTRLPLANE-4816: Bump AWS CAPI provider to v2.13.1 #10064
OCPBUGS-99759: Publish compatible scale-from-zero capacity annotations #10062
OCPBUGS-29551: Document NodePool upgrade defaults in hcp help #10014
AUTOSCALE-1044: detect multi-arch support for Karpenter ARM64 provisioning #10116
OCPBUGS-129580: wait for 0 nodes before subnet configmap cleanup in TestKarpenter #10117
OCPBUGS-59842: Bound etcd defragment RPCs and stop timed-out cycles #10113
CONSOLE-5449: Preserve component route labels in HostedCluster and HostedControlPlane CRDs #9815
OCPBUGS-127549: gate ARO HCP router on backend service ClusterIPs being assigned #9775
OCPBUGS-133784: ensure verify-ci runs lint #10126
OCPBUGS-133387: Sync OSImageStream e2eutilallowlist scopes #10124
OCPBUGS-131937: Fix TLS downgrade restart waits for unsupported operators #10108
CNTRLPLANE-4557: Make restructure-commits model-neutral and enforce component boundaries #9853
NO-JIRA: chore(deps): update module go.mongodb.org/mongo-driver to v1.17.10 (main) #10055
OCPBUGS-100035: Add periodic resync and reduce backoff ceiling for HCCO resources controller #10013
OCPBUGS-129497: Align shared root and API dependencies #9940
NO-JIRA: Update e2e v2 AGENTS.md #10115
NO-JIRA: Deny use of v1 e2e package code in new v2 e2e code #10112
CNTRLPLANE-4843: Update common Konflux task bundles and artifact wiring #10120
CNTRLPLANE-4447: enable TLSGroupPreferences on TechPreviewNoUpgrade #10094
GCP-1220: Reconcile GCP LoadBalancer Service resource-label annotations in HCCO #9644
CNTRLPLANE-4576: Add loadBalancerClass and serviceAnnotations API fields #9913
CNTRLPLANE-4807: Add KubeletHAProxyRouting FeatureGate #10043
CNTRLPLANE-4601: Add a GitHub Actions deadcode gate #10110
CNTRLPLANE-3927: add e2e v2 test for imageContentSources propagation to IDMS and ignition #10029
OCPBUGS-133387: fix(e2e) wait for NodePool version in cross-major OSImageStream specs #10107
OCPBUGS-131838: pass allocated UID to standalone karpenter-operator #10024
CNTRLPLANE-4600: Add reporting-only deadcode command and reports #9902
CNTRLPLANE-4817: Resolve CAPI packages with go list in the provider sync #10083
OCPBUGS-132920: sync CAPK install CRDs with openshift CAPK release-5.1 #10082
NO-JIRA: fix(e2e): skip managed DNS e2e below 5.1 #10063
NO-JIRA: bump google.golang.org/grpc to 1.83.2 in tools #10095
CNTRLPLANE-3632: Predictable NodePool rollout control #9818
OCPBUGS-84499: Etcd recovery on unreachable nodes #9992
NO-JIRA: chore: fixup karpenter reviewers and approvers in OWNERS #10023
NO-JIRA: Fix kube-storage-version-migrator removal assertion #10097
CNTRLPLANE-2042: test(e2e): add cross-cluster backup restore coverage for AWS #9979
NO-JIRA: ci(deps): bump actions/create-github-app-token from 1.12.0 to 3.3.0 #10087
OCPBUGS-132561: Fix Azure role-assignment cleanup in CI #10061
CNTRLPLANE-4662: docs(aws): add managed DNS how-to #9943
OCPBUGS-132796: Filter nonstandard AZ subnets from AWS endpoints #10080
OCPCLOUD-3704: enable CRD compatibility requirements for preview clusters #9871
OCPBUGS-130965: CVO upgrades stuck in Upgradeable=False (ResourceDeletesInProgress) #10037
NO-JIRA: build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.45.0 #9661
GCP-1221: Manage GCP worker firewall rules in CPO #9640
CNTRLPLANE-4193: feat: add initialKMSKeyARN for StorageClass KMS encryption #9147
AUTOSCALE-944: fix(karpenter): defer HCP lifecycle to standalone operator #9930
CNTRLPLANE-3999: Replace e2e v2 Platform.DeleteArgs with declarative ClusterSpec #10033
NO-JIRA: build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.37.0 to 1.45.0 in /hack/tools #9656
OCPBUGS-86668: fix CA rotation race in ReconcileTotalClientCA #8618
GCP-1211: Set PSC and load balancer resource labels #9612
OCPBUGS-85079: Fix global pull-secret label sync on HO upgrade #8650
OCPBUGS-128637: preserve role credentials for shared service accounts #9828
NO-JIRA: chore(deps): update cloudflare/wrangler-action action to v4.1.3 (main) #9907
CNTRLPLANE-3610: Decouple CAPI provider Go module dependencies #8704
CNTRLPLANE-4559: Add OpenShift Kubernetes 1.37.1 envtest coverage #10039
OCPKUEUE-921: feat: enable was in hypershift #10034
CNTRLPLANE-4642: Capture Azure E2E diagnostics #9915
NO-JIRA: chore(deps): update actions/upload-artifact action to v7.0.2 (main) #9969
AUTOSCALE-1068: docs for AutoNode/Karpenter on self-managed azure #10009
CNTRLPLANE-4167: test: port scale-from-zero autoscaling test to v2 framework #9411
ci: sync release branches to community fork #8220
OCPBUGS-74083: encryption condition propagation #10008
OCPBUGS-131937: test(e2e-v2): skip control-plane-pki-operator TLS config tests on older operators #10032
NE-2913: remove HAProxy 2.8 reference #9984
CNTRLPLANE-3999: remove Platform.CreateArgs to make ClusterSpecs more declarative #10005
OCPBUGS-123171: docs(capi-image-overrides): Add new override for versions below 4.19 #9942
CNTRLPLANE-4160, CNTRLPLANE-4161: use newer CPO for azure 4.²⁰⁄₄.21 overrides #9967
NO-JIRA: Document proportionate pre-PR validation #10015
NO-JIRA: clarify NodePool status.osImageStream vs MCO OSImageStream status #10019
CNTRLPLANE-3201: test(backup-restore): wait for manual backup before scheduling #9961
AUTOSCALE-1057: rename standalone karpenter-operator deployment env var #9954
NO-JIRA: Add Dan Mace to core-approvers #9994
OCPBUGS-126895: preserve AWS API error details on AWSEndpointService reconcile #9707
OCPSTRAT-3686: Set creationTimestamp in the operator image-references file #9878
OCPBUGS-129594: Fix IPv6 endpoint authorities in CPO #9982
CNTRLPLANE-4711: feat(azure): add opt-in IP forwarding for NodePools #9966
NO-JIRA: test(e2e): refactor Karpenter v2 test helpers and harden upgrade test #9662
OCPSTRAT-3686: Zero pad the commit distance in derived nightly tags #9980
CNTRLPLANE-4538: correct August report blog attribution #9931
CNTRLPLANE-4102: chore(contrib): remove aws-leaked-resources #9963
OCPBUGS-129581: Preserve supplied Unmanaged etcd credentials #9941
OCPBUGS-114415: intermittent timeouts in TestDialDirectWithProxy #9960
TRT-3008: revert(ingressoperator): restore HAProxy 2.8 wiring #9976
OCPBUGS-129420: Propagate configured NodePool labels and taints with native capacity #9919
OCPBUGS-49661: fix(cpo): report real ValidAWSKMSConfig condition #9953
OCPCLOUD-3708: feat(machine-approver): plumb TLS curve preferences #9743
CNTRLPLANE-3646: enable all platform agnostic and specific e2e v2 tests for AWS #9701
GCP-504: NodePool Platform Conditions #8917
CNTRLPLANE-4575: add DeterministicLBIP feature gate #9898
NE-2913: Remove HAProxy 2.8 reference #9703
OCPBUGS-129006: Converge Azure private DNS network links safely #9896
NO-JIRA: ci(deps): bump actions/actions-runner from 2.337.0 to 2.338.0 #9956
NO-JIRA: Require GCP workload identity mutation on 5.1 and later #9936
NO-JIRA: build(deps): bump the azure-github-dependencies group across 1 directory with 3 updates #9777
OCPBUGS-129491: ensure e2e v1 AWS OIDC providers are tagged with e2e metadata #9933
NO-JIRA: chore(owners): add CI operator config owners #9938
CNTRLPLANE-4480: feat(api): promote HCPUserFacingOperatorLogs feature gate to Default #9724
AUTOSCALE-1008: feat(karpenter-operator): monitor operand rollout status for version tracking #9654
AUTOSCALE-995: implement cpu options #9623
CNTRLPLANE-4600: remove all reported deadcode candidates #9904
CNTRLPLANE-4565: Promote ingress and Azure private OAuth v2 tests to blocking #9918
AUTOSCALE-947: fix(karpenter): defer EC2NodeClass reconcile to standalone operator #9746
OCPBUGS-104597: fix(etcdbackup): correctly classify Azure client-secret credentials from Velero BSL secrets #9321
CNTRLPLANE-4565: Remove duplicated v1 AWS E2E checks #9881
CNTRLPLANE-4337: Extract cluster-foundation ownership with characterization #9905
NO-JIRA: strip DWARF info from linter plugins to fix macOS dyld crash #9909
OCPBUGS-112277: Skip PodDisruptionBudgets for SingleReplica control planes #9394
OCPBUGS-128613: validate Azure HostedCluster subnet ID #9825
OCPBUGS-127429: Enable DeviceTaintRule API for hosted clusters #9518
CNTRLPLANE-550: Refactor HyperShift CLI for cross-platform consistency and testability #9570
GCP-967: Add GCP workload identity webhook support #9549
CNTRLPLANE-4558: Update Dockerfile and Containerfile images for Kubernetes 1.37 #9873
OCPBUGS-126889: preserve wrapped Azure credential reconcile errors #9704
OCPBUGS-129003: Refresh performance-profile conditions at the same generation #9891
MULTIARCH-5567: Added support to create multi-arch (s390x & x86) NodePools with KubeVirt platform on heterogeneous management clusters #9586
OCPBUGS-128975: Count only successful upsert updates #9872
OCPBUGS-109196: fix(nodepool): validate KubeVirt additionalNetworks NAD namespace #9299
NO-JIRA: docs: fix stale N-2 version skew references to N-3 #8999
AUTOSCALE-977: feat(karpenter): defer default NodeClass to standalone operator #9695
CNTRLPLANE-4562: add kubeClientQPS and kubeClientBurst to ClusterAutoscaling #9857
CNTRLPLANE-4548: fix: move combined-pull-secret creation to top-level CPO #9844
CNTRLPLANE-4553: Remove duplicate release trigger and draft mode #9880
CNTRLPLANE-4553: Compact yq JSON output for GITHUB_OUTPUT in tag workflow #9879
CNTRLPLANE-4553: Add workflows permission and manual trigger for tag creation #9877
CNTRLPLANE-4552: request HO v0.1.86 tag #9848
CNTRLPLANE-4553: use runner.temp and detect arch for release workflow tool installs #9851
CNTRLPLANE-4335: Extract RBAC reconciliation into dedicated module #9726
CNTRLPLANE-3890: Add product-cli unit tests for HCP create cluster #9591
CNTRLPLANE-4550: improve HO hotfix documentation and fix template #9845
OCPSTRAT-3686: Emit release-manifests/image-references from the operator build #9854
CNTRLPLANE-4556: Bump Kubernetes dependencies to 1.37 #9568
OCPBUGS-77307: Generate KubeVirt nmstate network config conditionally #9381
CNTRLPLANE-4553: install release workflow binaries to user-writable path #9849
CNTRLPLANE-4465: group MintMaker Go dependency updates by module #9715
CNTRLPLANE-4379: add release automation workflows for PR-based tagging #9566
CNTRLPLANE-3341: Extract support/imageregistry package from support/util #9832
CNTRLPLANE-3901: Add product-cli unit tests for IAM-Infra (Azure) #9180
CCO-848: feat(cloud_credential_operator): inject centralized TLS configuration #9409
OCPBUGS-109641: fix slice bounds out of range panic in getAvailableCandidates #9309
CNTRLPLANE-4090: deduplicate internal constants by migrating consumers to shared packages #9804
ACM-38185: chore(owners): add ACM HyperShift owners for product-cli #9082
CNTRLPLANE-4538: add August 2026 progress report #9839
NO-JIRA: nodepool: log when user-data/token Secrets are deleted #9819
OCPSTRAT-3686: Use git tag for hypershift nightly tag pipeline #9826
NO-JIRA: chore(deps): refresh rpm lockfiles (main) [SECURITY] #9667
OCPBUGS-127651: fix(operator): prevent deadlock when CRD conversion webhook caBundle is missing #9782
NO-JIRA: Remove Claude-powered PR comment workflows #9830
OCPBUGS-99659: reconcile NetworkPolicies for KubeVirt HCP router mode #9619
CNTRLPLANE-3902: Add product-cli unit tests for kubeconfig #9217
GCP-1148: Make zone required for cluster and nodepool creation #9708
CNTRLPLANE-3900: Add shared cmd/ unit tests for destroy cluster #9166
CNTRLPLANE-1053: Validate KAS reachability via SVC URL in KubeAPIDNSName e2e test #9355
NO-JIRA: build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 #9776
CNTRLPLANE-3344: Extract support/reconcilerpolicy package from support/util #9734
OCPBUGS-98099: test(e2e): isolate legacy Karpenter upgrade workload #9806
CNTRLPLANE-4497: add azure-orphaned-role-assignments tool #9745
OCPBUGS-128500: Gate custom ingress strategy E2E coverage to 4.21+ #9814
OCPSTRAT-3686: import nightly release tags #9809
OCPBUGS-114937: Add readiness probe to kube-scheduler control plane deployment #9789
OCPBUGS-128466: reconcile aggregated docs #9808
NO-JIRA: chore(owners): refresh owner aliases #9805
ROSAENG-65607: Adjust regex validation to allow sqs-fips url format (for FEDRAMP support) #9737
NO-JIRA: add serena/headroom files/folders to gitignore #9802
OCPBUGS-126613: fix(api): add missing + prefix to kubebuilder annotation on networkType #9646
CNTRLPLANE-3632: Revert #8698: NodePool rollout control #9797
OCPBUGS-127049: fix(globalps): schedule global-pull-secret-syncer on karpenter nodes #9719
CNTRLPLANE-4508: fix(e2e): detect installer flags supported by target image #9792
NO-JIRA: build(deps): bump compatible sigs-k8s dependencies #9778
OCPBUGS-114936: add PodDisruptionBudget for the HyperShift Operator #9526
OCPBUGS-115085: fix: mount combined-pull-secret in OpenShift API Server #9617
OCPBUGS-109640: fix(cmd/dump): filter resources by cluster platform #9639
NO-JIRA: fix(nodepool) data race in TestReconcileSelectorDropsStaleLabels #9772
OCPBUGS-88757: Align HCCO CatalogSource registryPoll interval with OCP defaults #8745
CNTRLPLANE-4460: refactor(test): chain BeforeApply handlers instead of overwriting #9709
NO-JIRA: ci(deps): bump codecov/codecov-action from 7.0.0 to 7.1.0 #9681
NO-JIRA: ci(deps): bump actions/cache from 4.2.3 to 6.1.0 #9338
OCPSTRAT-3686: Update default ociStorage repository #9770
OCPBUGS-127110: Install HO via Job from operator image in e2e upgrade tests #9736
OCPBUGS-127070: Align .ci-operator.yaml build root tag with Dockerfiles #9723
CNTRLPLANE-4374: bug - gate platform CAPI types behind CRD discovery to fix bulk inspect on limited-CRD clusters #9552
OCPBUGS-98066: fix(nodepool): rebuild CAPI selectors deterministically on reconcile #9698
CNTRLPLANE-3632: Predictable NodePool rollout control #8698
CNTRLPLANE-4090: Move HostedControlPlaneNamespace to shared package #9551
SPLAT-2742: remove inlined SetSecurityGroups IAM permission #9717
CNTRLPLANE-4213: decouple konflux pr pipelines #9413
NO-JIRA: test(e2e): check OS streams for OpenShift 5.0 nightlies #9712
CNTRLPLANE-3755: fix(e2e): gate release-specific fields for version compatibility #9564
CNTRLPLANE-2775: Expose KAS availability and latency metrics from CPO #9244
CNTRLPLANE-4092: Move dump.go to its own package to break transitive dependency on sharedingress #9727
OCPBUGS-125907: fix(aws): use unique Route 53 caller references #9647
OCPBUGS-114723: Decouple user CA bundle reconciliation from resources controller #9458
NO-JIRA: chore(owners): add daniel-rejniak to gcp-reviewers #9700
CNTRLPLANE-4304: fix(ci): validate pending commit messages with gitlint #9710
CNTRLPLANE-4395: Make git commit format skill model and harness agnostic #9625
OCPBUGS-123791: CAPI storage version migration exclude IPAM #9642
CNTRLPLANE-4365: Publish hosted control plane sizing guidance #9532
AUTOSCALE-873: Add sidecar to standalone karpenter-operator #9565
CNTRLPLANE-4090: Move CPO, HCCO and etcd recovery manifest constructors to shared packages #9592
OCPBUGS-113995: classify WebIdentityErr by cause to prevent false invalid creds #9406
OCPBUGS-115468: fix NodePool: truncate oversized machine messages instead of dropping them #9567
feat(kubevirt): OCPBUGS-55974: add CPU model configuration for NodePool VMs #7431
CNTRLPLANE-4209: Consolidate Azure lifecycle test lanes #9572
GCP-510: Implement GCP NodePool CLI Commands #9466
OCPBUGS-84562: Configure AWS CCM region directly #9602
NO-JIRA: ci(deps): bump astral-sh/setup-uv from 6.1.0 to 10.1.0 #9682
NO-JIRA: chore(owners): add core approvers #9651
CNTRLPLANE-4090: Move metric name constants to shared packages #9540
OCPBUGS-125803: skip TLS flag propagation tests for older operator versions #9641
CNTRLPLANE-4453: clarify private Key Vault validation comments #9645
CNTRLPLANE-4209: Update Azure lifecycle test-flow documentation #9573
CNTRLPLANE-4456: Run envtests for release-5.0 #9649
AUTOSCALE-974, AUTOSCALE-980: allow Karpenter to be deployed on Azure #9545
OCPBUGS-123512: fix(e2e): derive node runtimes from upgraded NodePool state #9611
OCPBUGS-122236: stabilize JUnit test identities #9580
chore(renovate): enable supported release branches #9631
CNTRLPLANE-4209: Reject shared variants in concurrent e2e lanes #9571
OCPBUGS-109672: fix(cpo) wait for etcd health, not just DNS #9460
OCPBUGS-123645: add missing Azure v2 matrix coverage #9616
NO-JIRA: fix(e2e): restore Eventually retry for post-upgrade health condition check #9632
OCPBUGS-89689: karpenter control plane upgrade premature drift fix #9234
CNTRLPLANE-3880: Add E2E test for etcd snapshot restore to prevent split brain regression #9356
NO-JIRA: Bump envtest workflow timeout to 20 minutes #9630
CNTRLPLANE-4090: Move labels, taints, scheduler, VAP and misc constants to shared packages #9544
NO-JIRA: Fix CONTRIBUTING.md link path and remove trailing blank lines #9621
OCPBUGS-122011: fix(e2e): Make InstallHyperShiftOperator platform aware #9555
CNTRLPLANE-3532: Enable HC and HCP status-write linting #9563
CNTRLPLANE-3608: Add nested virtualization support for AWS EC2 NodePools #8681
GCP-1122: chore: add pvasant to gcp-reviewers alias #9465
CNTRLPLANE-4393: document CAPI provider image override mechanisms #9482
CNTRLPLANE-3277: Add Azure OAuth LoadBalancer private topology e2e test #8584
OCPBUGS-122232: Gate CAPI API version by management release #9587
CNTRLPLANE-4093: Move shared label constants to api/hypershift/v1beta1 #9415
CNTRLPLANE-4207: document Azure lifecycle test sharding #9504
GCP-958: test(e2e/v2): register gcp-pd-csi-driver control plane workloads #9589
OCPBUGS-97942: fix(cli): add –service-publishing-strategy flag to hcp create cluster agent #8985
NO-JIRA: build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 #9546
CNTRLPLANE-4094: Move ExternalDNSLBPort and KASRouteHostname to support/netutil #9414
NO-JIRA: fix(ci): use –target for pip install on ARC runner #9531
CNTRLPLANE-4150: feat: Maintain ingress serving cert for HostedCluster ingress #9132
CNTRLPLANE-4207: update v2 test flow documentation #9569
CNTRLPLANE-4369: add prow job id tag to e2e v2 aws resources #9542
NO-JIRA: fix(managed-azure): continue resource group cleanup when HC destroy fails #9404
ACM-41684: Switch hypershift-operator runtime to PQC base image #9453
NO-JIRA: fix(install): increase WaitUntilAvailable timeout from 5m to 10m #9306
OCPBUGS-87991: validate additionalNetworks name format in KubeVirt NodePools #8710
NO-JIRA: feat(azure): Add scripts to setup credentials and check resources #9446
CNTRLPLANE-4005: Skip CDI importer pods from custom labels and tolerations checks #9240
OCPBUGS-109724: fix KubeVirt custom baseDomain ingress documentation #9318
NO-JIRA: spread AKS nodes across availability zones #9449
CNTRLPLANE-4370: Revert “Merge pull request #9543 from ironcladlou/e2e-promotion” #9574
OCPBUGS-114415: Increase relay timeouts to prevent intermittent test failures #9459
NO-JIRA: Gate GCP credential validation by control plane version #9562
OCPBUGS-120840: remove TechPreviewNoUpgrade from AWS cluster creation args #9535
OCPBUGS-121208: filter AWS-reserved tag keys before calling DeleteTags #9538
GCP-883: Optimize GCP PSC NAT allocation #9472
CNTRLPLANE-3603: Migrate clients from CAPI v1beta1 to v1beta2 #8717
NO-JIRA: remove duplicate e2e v2 test flow doc #9553
CNTRLPLANE-4370: enforce explicit blocking/informing labels on all v2 e2e tests #9543
NO-JIRA: ci(deps): bump actions/actions-runner from 2.336.0 to 2.337.0- #9513 #9513
CNTRLPLANE-3998: warn when deprecated kube-apiserver verbosity annotation is set #9461
CNTRLPLANE-3532: migrate HCCO/route status patches to statuspatching #9385
OCPBUGS-99534: etcd initialization bugs after etcdctl snapshot restore #9048
CNTRLPLANE-3646: increase e2e v2 control plane upgrade coverage for v1 parity #9491
OCPBUGS-120685: fix(e2e): select a live NodePool for osImageStream node OS verification #9506
ROSAENG-63186: fix(hcco): Add VAP to protect kas-bootstrap RBAC bindings from deletion #9203
NO-JIRA: remove unsafe v1 framework usage from karpenter upgrade test #9522
CNTRLPLANE-2007: KubeVirt default ingress passthrough with HostNetwork endpoint publishing strategy #9514
CNTRLPLANE-4207: Balance Azure v2 lifecycle test shards #9419
CNTRLPLANE-3532: add hcpstatuspatch linter and status-patching AGENTS.md guidance #9388
OCPBUGS-114459: recognize domain-specific test fields #9454
GCP-503: feat(gcp): Implement OrphanDeleter #8884
OCPBUGS-115269: openstack: Start populating cacert in clouds.yaml #9467
CNTRLPLANE-3951: fix(e2e): accept node deletion as success in TestSpotTerminationHandler #9428
OCPBUGS-74960: fix orphaned security group during VPC endpoint deletion #9517
NO-JIRA: test(backuprestore): enable SnapshotMoveData in backup configurations #9429
GCP-958: feat(gcp): complete GCP PD CSI driver wiring in HyperShift #9450
RHOBS-1707: Add OpenTelemetry SDK tracing to hypershift-operator #9390
OCPBUGS-105464: fix(nodepool): inject default worker SG by status ID, not fail-open capability flag #9456
OCPBUGS-84368: add safe-to-evict annotation and remove tolerations to fix autoscaler scale-down and drain loop #8338
AUTOSCALE-998: inject token-minter image to standalone karpenter-operator #9492
OCPBUGS-120685: fix(e2e): label flaking nodepool osImageStream test informing #9505
NO-JIRA: feat(chaibot): add per-platform Slack handle pings to CI health report #9478
build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /hack/tools #9479
build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 #9480
OCPBUGS-114408: fix(api): allow spaces in AWS resource tag keys and values #9425
GCP-1113: retry transient network errors in hypershift create iam gcp #9436
OCPBUGS-115542: fix(e2e): poll for etcd-init completion before reading restore logs #9481
OCPBUGS-114368: Retry Microsoft Graph transport failures #9421
OCPBUGS-86690: fix Azure cluster deletion hanging when resource groups are already deleted #8682
CNTRLPLANE-4041: add new release branches to renovate config #9470
OCPBUGS-77781: fix(certs): normalize IP SANs to stop dual-stack KAS cert churn #9286
CNTRLPLANE-4205: document OSImageStream behaviour deviations #9486
CNTRLPLANE-3755: fix(e2e): add version gating to EnsureCAPIFinalizers tests #9443
CNTRLPLANE-3646: enable e2e v2 aws control plane upgrade tests #9474
OCPBUGS-115403: ensure informing junit files are unique across test groups #9473
ACM-41685: Enable PQC crypto policy in hypershift-cli image #9463
OCPBUGS-113712: preserve immutable AWS load balancer annotations #9469
NO-JIRA: chore(konflux): update Tekton task bundles to latest versions #9483
CNTRLPLANE-4204: reorganize OSImageStream e2e tests after graduation #9418
CNTRLPLANE-3201: feat(e2e): enable etcd snapshot backup test on Azure #9226
CNTRLPLANE-2029: docs(backuprestore): add Agent and KubeVirt platform prerequisites #9072
CNTRLPLANE-3950: fix flaky TestKMSRootVolumeEncryption race condition. #9304
CNTRLPLANE-4208: Right-size Azure v2 e2e worker counts #9426
CNTRLPLANE-3646: port karpenter upgrade test to v2 #9397
NO-JIRA: fix(azure): orphan AzureMachines when capi-provider cannot run #9403
OCPBUGS-99021: Use separate certificate signers for konnectivity #9098
OCPBUGS-99329: avoid cache miss false-negative on credential Secret lookup #9074
NO-JIRA: group ChaiBot health report by OCP version #9447
NO-JIRA: Migrate hypershift-ci-python and contrib/oidc to uv for managing python deps #9442
GCP-421: feat(install): bump external-dns to 1.3.5 and bundle DNSEndpoint CRD #9433
NO-JIRA: test(e2e/v2): add upsert desired-state-hash E2E tests #9257
RFE-9138: feat: label some hosted control plane services #8298
OCPBUGS-109595: use RetryWatcher and TCP keepalive for create-guests watch resilience #9435
OCPBUGS-95614: fix(cpo): include unavailable components in KASLoadBalancerNotReachable message #9232
OCPBUGS-114014: add Agent CAPI pause step to cross-cluster migration #9416
CNTRLPLANE-4216: Migrate Azure VM instance families to Dsv5 #9423
CNTRLPLANE-4006: fix(e2e) disable client-side rate limiting and increase NodePool config timeout #9331
CNTRLPLANE-4004: test(envtest): add CEL validation tests for AWS resource tag types #9375
OCPBUGS-86669: fix(cli): make deleteCLISecrets non-fatal during cluster destroy #8787
CNTRLPLANE-3999: add declarative TestPlan for composing v2 cluster variants and test matrices #9420
NO-JIRA: test(e2e): allow more time for control plane pod restarts #9422
OCPBUGS-113580: Bound NodePool metrics cache reads #9389
NO-JIRA: Makefile: fix PULL_BASE_SHA leading space breaking local verify #9395
OCPBUGS-97811: fix Tenant API downtime during a management worker node #9279
NO-JIRA: Run lint and vet against all build tags #9427
OCPBUGS-114265: Use managemet cluster kubeconfig for CAPI migration test #9412
OCPBUGS-100142: fix(konnectivity): fallback to alternative DNS-resolved IPs on connection failure #9181
CNTRLPLANE-3532: migrate CPO status patches to statuspatching helpers #8966
OCPSTRAT-3686: Add pipeline for nightly release tag process #9371
OCPBUGS-111601: Fix v2 control plane upgrade rollout race #9384
CNTRLPLANE-2883: Migrate ARM64 NodePool creation test to v2 #8926
CNTRLPLANE-4115: fix(ci): report actionable cause when /rebase push hits workflow files #9358
OCPBUGS-113991: Scope forced NodePool cleanup to the target cluster #9398
CNTRLPLANE-1831: address review feedback on DR documentation #9407
OCPBUGS-98467: fix(konnectivity): enable –sync-forever to restore lost agent-server tunnels #9260
CNTRLPLANE-3616: e2e tests for TLS profile change of konnectivity-server #8886
CNTRLPLANE-3626: feat(ignition-server, ignition-server-proxy): inject centralized TLS configuration #8910
OCPBUGS-112450: introduce e2e v2 linting rules and enforcement #9357
CNTRLPLANE-1831: restructure backup/restore disaster recovery documentation #9382
ACM-42704: Add Konflux MCE 5.1 pipelines for hypershift CLI and operator #9396
OCPBUGS-111601: Prevent conversion webhook startup deadlock #9387
ROSAENG-14082: –dump-guest-cluster option can now optionally be supplied with policies #8882
CNTRLPLANE-3646: port core karpenter autonode e2e tests to v2 framework #9292
GCP-916: allow goog-partner-solution label key in GCP resourceLabels #9267
CNTRLPLANE-3871: promote OSStreams feature gate to Default #9328
CNTRLPLANE-3903: Add unit test for hcp version command #9218
OCPBUGS-111985, OCPBUGS-111986: bump haproxy to 3.0.5-6.el10_2.2 to fix CVE-2026-55203 and CVE-2026-55204 #9333
OCPBUGS-112328: Clear SSHKey from HCP and delete synced secret when HC SSHKey is removed #9374
CNTRLPLANE-4169: Add GHA envtest jobs for Kubernetes 1.36 #9353
CNTRLPLANE-3604: Capi v1beta2 storage migration #8938
CNTRLPLANE-3532: migrate HO karpenter status patch to statuspatching helper #8968
no-jira: add karpenter-operator dev image override annotation #9295
CNTRLPLANE-4025: feat(azure): support managed HSM for KMS encryption #9199
OCPBUGS-44164: Fix TestNodePoolReplaceUpgrade flaky timeout on OpenStack #8749
revert: OCPBUGS-112478: fix(cpo): handle service-ca generation errors in CSI serving cert reconciliation #9365
CNTRLPLANE-3954: add kube-scheduler metrics endpoint e2e coverage #9159
NO-JIRA: align aws_test.go test case names with testcasename linter #9367
CNTRLPLANE-4003: Add per-tag override field for AWS resource tag precedence #9152
OCPBUGS-97705: fix(azure): skip KMS validation for private Key Vaults on ARO HCP #8965
chore: add .pi symlink for Claude Code skill discovery #9361
OCPBUGS-85182: Remove MutatingAdmissionPolicy runtime-config from KAS #9350
OCPBUGS-86771: docs(api): document issuerURL immutability and serviceAccountIssuer override #8916
NO-JIRA: chore(owners): add members to core-reviewers #9352
OCPBUGS-85065: Fix repeated CPO Deployment churn due to OPENSHIFT_IMG_OVERRIDES reordering #8656
NO-JIRA: align GCP creds metric test case names with testcasename linter #9351
GCP-959: Add GCP PSC conditions to metrics and add platform-specific gauges #9258
CNTRLPLANE-3899: Add shared cmd/ unit tests for create nodepool agent #9162
CNTRLPLANE-4008: enable hypershiftlinter and fix test naming #9271
OCPBUGS-86670: fix(cpo): handle service-ca generation errors in CSI serving cert reconciliation #8622
OCPBUGS-105194: Add retry with exponential back-off for transient dump errors #9303
CNTRLPLANE-4041: fix(build): bump missed second-stage base image in Dockerfile.e2e to 5.1 #9345
CNTRLPLANE-4026: fix(ci): Enable Dependabot to track and automate GHA runner image updates #9330
CNTRLPLANE-4041: bump base images in dockerfiles to 5.1 #9325
NO-JIRA: fix(ci): update restructure-commits workflow path after skills migration #9335
CNTRLPLANE-4115: Revert invalid workflows permission from rebase.yaml #9329
OCPBUGS-99550: Managed Azure setup_aks_cluster.sh fails to run with “–kubernetes-version 1.33.0” flag #9080
OCPBUGS-105282: Add proxy env vars to cluster-storage-operator deployment #9256
CNTRLPLANE-4115: Fix /rebase workflow: add missing workflows permission #9323
NO-JIRA: Convert Claude commands to agentskills.io skill format for harness portability #9062
CNTRLPLANE-3871: add [FeatureGate:OSStreams] tag for FG promotion tracking #9297
OCPBUGS-83564: Apply registry overrides to release image pullspec before fetching #9108
CNTRLPLANE-4008: feat: add hypershiftlinter golangci-lint plugin #9237
OCPBUGS-105875: fix(hcco): run kas-connection-checker as non-root #9296
ARO-26896: feat: hardcode ETCD_METRICS=extensive in etcd StatefulSet template #9192
OCPBUGS-105802: Use the correct v1 mcfg api for OSImageStream during ignition #9283
CNTRLPLANE-4043: ci(e2e): add CI workflow to verify e2e compilation on PRs #9305
And 6 elided commits (e.g. from squash or rebase merges)
Full changelog

ibm-cloud-controller-manager

OCPCLOUD-3678: Merge https://github.com/IBM-Cloud/cloud-provider-ibm:01595b6d497cc6ec6f807bd7136ac43d147ea042 (01595b6) into main #89
Full changelog

ibm-vpc-block-csi-driver

STOR-3075: Rebase to v5.2.32 for OCP 5.1 #175
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #161
Full changelog

ibm-vpc-block-csi-driver-operator

STOR-3176: Support TLS Groups in operators for kube-rbac-proxy sidecar #203
OCPBUGS-98100: disable snapshot tests for ibm-vpc-block-csi-driver #175
STOR-3068: Bump all libraries #198
OCPBUGS-127462: Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile #194
OCPBUGS-113538: Enable SELinuxMount tests #180
Full changelog

ibmcloud-cluster-api-controllers

NO-JIRA: Move JoelSpeed to advisory_approvers #192
UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-ibmcloud:v0.15.0 (5704e48) into main #184
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #187
OCPBUGS-114006: UPSTREAM: 2933: Bump all go.opentelemetry.io/otel modules to v1.44.0 #165
Full changelog

ibmcloud-machine-controllers

NO-JIRA: Move JoelSpeed to advisory_approvers #122
OCPCLOUD-3666: bump Kubernetes dependencies to 1.37 #117
CNF-23394: mockgen deprecated: use uber-go/mock instead #73
Full changelog

insights-operator

OCPBUGS-129680: lower priorityClass for gathering pods #1400
OCPBUGS-127069: set InsightsOperator readyReplicas from the operator Deployment #1375
OCPBUGS-132789: Gate ingress secret bindings on Ingress capability #1403
CCXDEV-16668: kserve gather servingRuntimes and clusterServingRuntimes CRs #1385
OCPBUGS-132226: add CVO annotations to secret gatherer RBAC #1397
NO-JIRA: Restructure scope of gather SA to specific namespaces (from 5.0) #1392
NO-JIRA: Revert “WIP: how to add gpu node” #1390
CCXDEV-16671: add GPU node topology gatherer #1364
NO-JIRA: add permissions to fetch MaasModelRefs #1388
CCXDEV-16669: gather externalModels #1379
CCXDEV-16670: add MaaSModelRef gatherer #1377
CCXDEV-16666: gather InferenceService from the KServe operator #1345
OCPBUGS-97968: add insights-runtime-extractor-scc missing fields #1359
CCXDEV-16041: multiclusterhub gatherer #1343
NO-JIRA: improve create-gatherer skill #1348
CCXDEV-16040: Add multicluster gatherer #1337
CCXDEV-16594: add custom proxy field to insights config #1329
Full changelog

insights-runtime-exporter, insights-runtime-extractor

OCPBUGS-128853: drop privilege before executing fingerprints. #95
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #92
NO-JIRA: chore: add slashpai to owner list #91
Full changelog

ironic

NO-ISSUE: Update requirements.cachito with latest openshift forks commits #952
METAL-2021: Make Python selection RHEL-aware #957
OCPBUGS-138692: Remove proliantutils and scciclient from ironic image #953
METAL-2005: Switch snmp dependencies to source #951
METAL-1741: Install gunicorn and pynacl from source #948
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #949
NO-ISSUE: Check ironic-prometheus-exporter in check-requirements #950
METAL-1998: Merge upstream 2026 10 30 #945
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #947
METAL-1741: Install oslo.i18n from source #944
METAL-1913: Enable bootc deploy autodetection #911
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #943
NO-ISSUE: Improve Slack notification for existing requirements update PRs #940
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #939
OCPBUGS-130802, OCPBUGS-130834: Bump urllib3 to 2.8.0 #938
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #933
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #931
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #929
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #924
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #923
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #921
METAL-1958: Merge contiguous Dockerfile RUN layers to reduce image size #916
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #917
NO-ISSUE: Update requirements.cachito with latest openshift forks commits #910
NO-ISSUE: Manually sync Ironic - part 2 #909
NO-ISSUE: Manually sync Ironic and Sushy from the forks #906
METAL-1931: Add cargo for bcrypt rust extensions #895
Full changelog

ironic-agent

METAL-2021: Make Python selection RHEL-aware #334
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #333
Fix for OCPBUGS-130832,OCPBUGS-130801: CVE-2026-97689, CVE-2026-97687 #328
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #332
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #330
METAL-1741: Install oslo.i18n from source #331
NO-ISSUE: Improve Slack notification for existing requirements update PRs #329
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #322
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #321
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #320
METAL-1958: Remove OKD build deps in the same layer they are installed #318
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #319
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #317
NO-ISSUE: Update requirements.cachito with latest ironic-python-agent #302
METAL-1931: Add cargo for bcrypt rust extensions #303
Full changelog

karpenter-operator

AUTOSCALE-1069: approve CSRs of Karpenter-provisioned Azure nodes #76
AUTOSCALE-1061: test: add NodeClass CRD schema tests #72
NO-JIRA: test: run operator info metric error cases on synctest time #75
AUTOSCALE-970: fix secret annotations #69
OCPBUGS-133506: satisfy HCP pod requirements #70
AUTOSCALE-1058: Refactor EC2 and Azure NodeClass controllers #65
AUTOSCALE-1062: fix: remove Azure-specific maxPods bounds #66
OCPBUGS-133401: attach HCP pull credentials to operand service account #68
AUTOSCALE-166: improve core karpenter e2es more #67
AUTOSCALE-166: Scope core regression to performance tests #63
OCPBUGS-131838: support karpenter operand UID without scc #61
AUTOSCALE-166: fixup karpenter core e2e script #64
NO-JIRA: chore: allow karpenter operand images to be overriden #58
AUTOSCALE-944: feat: migrate HostedControlPlane lifecycle controller from HyperShift #52
NO-JIRA: docs: clarify explicit test expectations #60
AUTOSCALE-1046: feat: hold Azure NodeClass releases during control plane upgrades #56
AUTOSCALE-166: skip unsupported static capacity regression tests #59
AUTOSCALE-166: constrain regression e2e nodes to amd64 #57
NO-JIRA: add Deployment manifest golden-file testing #53
AUTOSCALE-969: add defaultNodeClass method for azure #54
NO-JIRA: refactor: align controller conventions #55
OCPBUGS-116223: fix: report ClusterOperator status on unsupported platforms #50
AUTOSCALE-1045: feat: add OpenShiftAzureNodeClass API and controller #44
NO-JIRA: update controller and logging guidance in agents.md #51
AUTOSCALE-1057: Implement karpenter operator metric and add test #48
NO-JIRA: fix: require EBS in block device mappings #47
NO-JIRA: fix: align controller logging with controller-runtime guidelines #49
NO-JIRA: chore: enforce consistent import aliases #46
AUTOSCALE-1043: add pod monitor for karpenter and operator #45
NO-JIRA: chore: version local build tool binaries #37
AUTOSCALE-947: feat: migrate EC2NodeClass controller from HyperShift #43
AUTOSCALE-1008: Add label and annotation for MonitorOperandsRolloutStatus tracking #39
AUTOSCALE-977: feat: reconcile default NodeClass #38
AUTOSCALE-856: Add Azure Karpenter provider image reference #41
AUTOSCALE-166: Add minimum instance size requirements #36
NO-JIRA: fixup OWNERS_ALIASES #35
NO-JIRA: chore: update build tool versions #34
AUTOSCALE-873: fix: apply OpenShift Karpenter CRD adjustments #33
AUTOSCALE-974: deploy karpenter-provider-azure on HCP #32
AUTOSCALE-946: migrate approver for node CSRs #29
no-jira: remove aggregate cluster role #30
AUTOSCALE-998: deploy karpenter-provider-aws on HCP #26
AUTOSCALE-968: sync AKSNodeClass CRD and add Azure cloud provider #28
AUTOSCALE-906: add agentic SDLC context files #27
AUTOSCALE-976: enable CRD controller for management cluster mode #24
AUTOSCALE-872: Implement OpenshiftEC2NodeClass objects #25
AUTOSCALE-166: Apply NodeOverlay to hostedcluster during karpenter-core e2e for AWS HCP AutoNode #22
Full changelog

keepalived-ipfailover

OKD-516: Re add /run/lock to OKD 5.1 container base #258
OCPBUGS-137961: Updating openshift-enterprise-base-rhel10-container image to be consistent with ART for 5.1 #250
NE-2126: Bring the ipfailover extension in line with router#871 #259
NE-2126: Make the ipfailover extension safe to register in origin #256
NE-2126: Materialize ipfailover testdata lazily into a temp directory #255
NO-JIRA: Enable CentOS Stream 10 OKD package repositories in base image #254
NE-2126: Migrating Ipfailover test cases to images repo #245
Full changelog

kube-metrics-server

Bump openshift/kubernetes-metrics-server to v0.9.1 #102
NO-JIRA: synchronize OWNERS from cluster-monitoring-operator #80
NO-ISSUE: [bot] Bump openshift/kubernetes-metrics-server to v0.9.0 #72
Full changelog

kube-rbac-proxy

NO-JIRA: Merge upstream v0.23.0 #162
CNTRLPLANE-3685: docs - add Agentic SDLC context files #144
NO-JIRA: update OWNERS #147
NO-JIRA: Merge upstream v0.22.1 #146
Full changelog

kube-state-metrics

NO-JIRA: synchronize OWNERS from cluster-monitoring-operator #169
NO-ISSUE: [bot] Bump openshift/kube-state-metrics to v2.20.0 #155
Full changelog

kube-storage-version-migrator

OCPBUGS-126583: Bump golang.org/x/net to v0.55.0 to address CVE-2026-33814 #266
NO-JIRA: Bump Go builder and CI images from 1.24 to 1.26 for openshift-5.1 #265
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #262
OCPBUGS-114428: Update build-machinery-go vendor dependency #259
Full changelog

kube-vip

NO-JIRA: Merge https://github.com/kube-vip/kube-vip:main (https://github.com/openshift/kube-vip/commit/6cbf5aaeda356be0ee3fc5d8482d483c28bb4103) into main #19
Full changelog

kubevirt-cloud-controller-manager

UPSTREAM: <carry>: OCPBUGS-124587: vendor grpc v1.83.2 #110
NO-ISSUE: Fix CVE-2026-33814 - bump golang.org/x/net to sustaining fork v0.50.0-sec.4 #104
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #87
Full changelog

kubevirt-csi-driver

OCPBUGS-140018: Propagate management-cluster provisioning failures from CreateVolume #126
CNV-56946: Support node volume metrics #118
OCPBUGS-114428: Bump Go builder to 1.26 #123
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #119
Full changelog

machine-api-operator

OCPBUGS-136332: Fix flaky vSphere failure domain VAP e2e tests #1591
OCPBUGS-133742: Raise machine API memory requests #1595
NO-JIRA: Move JoelSpeed to advisory_approvers #1592
OCPCLOUD-3709: feat(tls): add TLS groups and curve preferences #1571
CNF-26431: Allow ironic-networking JSON-RPC port in NetworkPolicy #1530
OCPBUGS-90560: remove GCP boot disk image defaulting from admission webhook #1525
OCPBUGS-90560: add RBAC for GCP boot image resolution #1560
OCPCLOUD-3660: bump to Kubernetes 1.37 #1570
OCPBUGS-129369: fix race in VAP MachineSet e2e test cleanup #1572
SPLAT-2983: Use Machine API vSphere credentials in e2e tests #1568
OCPBUGS-122165: Reduce vCenter API load in the vSphere machine controller #1552
OCPCLOUD-3438: Bump govmomi to 0.53.0 #1498
NO-ISSUE: Add opt-in kube-rbac-proxy sidecar for pprof endpoint (AWS) #1502
OCPBUGS-47508: Set –max-concurrent-reconciles=10 for AWS machine controller #1521
SPLAT-2825: Moved OTE machine tests to openshift/disruptive-longrunning #1539
OCPBUGS-105398: refactor: remove AzureWorkloadIdentity feature gate #1537
SPLAT-2826: Compare against oldObject in vSphere failure-domain VAPs #1536
OCPBUGS-74510: Removed VSphereMultiDisk feature gate #1532
OCPBUGS-105407: Remove VSphereMultiNetworks feature gate from e2e test #1533
Full changelog

machine-config-operator

OCPBUGS-129614: Block RHEL 10 –> RHEL 9 transitions #6683
OCPBUGS-61487: Add timer for Azure VIP routes reconciliation #5455
OCPNODE-4842: Support kubelet tlsCurvePreferences #6695
SPLAT-3023: test/extended: drop the MultiDiskSetup tag, skip on extenal topology #6728
MCO-2573: MCNs should reflect user manual actions #6682
AGENT-1640: re-enable htpasswd auth on IRI registry #6668
OCPBUGS-138569: Update AMI Whitelist #6731
NO-ISSUE: Temporarily skip flaky OS build controller unit tests #6722
OCPBUGS-133750: Raise controller and operator memory requests #6701
TRT-3080: Revert #6689 “SPLAT-3023: test/extended: drop the MultiDiskSetup tag” #6723
NO-JIRA: guide CodeRabbit review of graceful node shutdown #6478
SPLAT-3023: test/extended: drop the MultiDiskSetup tag #6689
MCO-2334: Implement AWS bootimage updates on CAPI #6447
NO-ISSUE: fix OCV boot tests #6715
OPNET-811: operator: source BGP VIP peers from the BGPVIPConfig CR #6686
OCPBUGS-132798: Reduce disk thrashing from keepalived #6690
OCPBUGS-72554: on-prem: redispatch API VIP connections away from unreachable masters #6681
OCPBUGS-113534: Render waits for sub-controllers MCs #6552
OCPBUGS-135256: update automated scale tests for the oldest supported… #6700
OPNET-811: on-prem: propagate BGP VIP peer changes; disable-connected-check for FRR neighbors #6685
OCPBUGS-132697: correctly wait for the cluster to settle after scale … #6691
OCPBUGS-115127: Replace wildcard permissions with explicit verbs in MachineOSBuilder ClusterRole #6471
MCO-2522: implement capi machinesets in E2E tests #6644
OCPBUGS-126565: OCPBUGS-127024: OCPBUGS-127025: Enable readOnlyRootFilesystem: true for machine-os-builder and create-digest-configmap containers #6640
OCPBUGS-132309: Fix MCN stale current config edge case #6676
OCPNODE-4602: implement {system,container}GomaxprocsBehavior field #6332
OCPBUGS-132754: Handle restrictive policies for layered OS updates #6670
OCPBUGS-126565: OCPBUGS-127021: Enable readOnlyRootFilesystem: true for machine-config-controller container #6573
OPNET-818: on-prem: BGP VIP static pods follow platform pod conventions #6673
MCO-2622: Update MCO dependencies to Kubernetes 1.37 #6661
OPNET-782: on-prem: give the frr-k8s static pod reloader writable /tmp and /var/log/frr #6643
OCPBUGS-132308: stabilize test 66436 - disable weak SSH cipher suites #6666
OCPBUGS-131830: stabilise TestAPIServerCiphers unit test #6659
MCO-2475: Simplified the Irreconcilable Differences test to only fetch Ignition contents #6646
OCPBUGS-130604: test/extended: accept the data/by-lun Azure disk path #6650
OCPBUGS-129377: MCD fails to rollback from OCL to stock RHCOS when extensions are installed #6631
OCPBUGS-129536: Update cleanup for test PolarionID:84219 to wait for node to be removed #6648
OCPBUGS-128286: only enable signed policy when testing signed payloads #6611
OCPBUGS-99751: Verify MOSC existence via API before serving layered image #6352
OCPBUGS-124571: Bump version of google.golang.org/grpc #6633
SPLAT-2996: use component-scoped vSphere credentials for boot image updates #6641
OCPBUGS-126565: OCPBUGS-127020: Enable readOnlyRootFilesystem: true for machine-config-operator container #6568
MCO-2522: Adapt all extended e2e test cases to use ManagedMachine… #6621
OCPBUGS-129112: Skip GCP reconcile for unknown arch #6625
OCPBUGS-85519: Add IRI credentials to the internal registry pull secret #6067
OCPBUGS-128811: Remove reverse (rhel10 to rhel9) OSStreams upgrade tests #6638
OCPBUGS-128535: Revert “OCPBUGS-91746: Remove sandboxed-containers (kata-containers) from extended-priv tests” #6613
MCO-1989: Fix RHEL9-specific MCD Logic for RHEL10/CentOS10 for adaptability #6515
OCPBUGS-121959: Make NIC persistence unconditional instead of version-specific #6516
OCPBUGS-128716: logout vCenter clients after use #6629
AGENT-1454: Enforce APIServer TLS profile on IRI registry #6592
OCPBUGS-128457: Fix layered OS updates on older nodes #6630
OCPBUGS-128676: Boot image controller skips MachineSets that don’t match any failure domain #6606
OPNET-782: Render BGP VIP static pods instead of keepalived #6326
OCPBUGS-128659: Filter cosign signature tags from the IRI release lookup #6604
MCO-2522: Create ManagedMachineSet interface #6602
NO-ISSUE: Initial version of the create MCO test plan skill #6560
OCPBUGS-128535: Revert “OCPBUGS-91746: temporarily remove sandboxed-containers from extensions test” #6596
NO-ISSUE: Fix typo in controller #6595
NO-ISSUE: Increase timeout for ImagePulledFromRegistry=Unknown in non-SNO suites #6598
SPLAT-2376: test/extended: add Azure machine pool disk setup tests #6559
OCPBUGS-105412: Updated openshift/api vendor #6586
OCPBUGS-127481: change markdown linter approach #6591
OCPBUGS-127707: check CAPI manager modes for default skew status #6589
MCO-2572: Consider nodes “Updated” when they have been manually set to an unready state but no update is happening #6536
OCPBUGS-127481: Add markdown linter #6582
OCPBUGS-127022: Enable readOnlyRootFilesystem: true for machine-config-server container #6569
OCPBUGS-74136: Split wait-for-ipsec-connect into two services to avoid ipsec restart #6440
NO-ISSUE: Increase timeout for ImagePulledFromRegistry=Unknown in non-SNO suites #6574
OCPBUGS-86768: Nodes created with 4.13 base images cannot join the cluster #6435
MCO-2536: Update operator to populate CAPI bootimage status #6469
OCPBUGS-126899: Add MCN/PIS/MOSC/MOSB/OSImageStream to relatedObjects #6563
OCPBUGS-86571: templates: pass –dual-stack to nodeip-configuration #6105
OCPBUGS-57177: Degrade the MachineConfigPool on PinnedImageSet degrade #6443
OCPBUGS-63048: Kube object asserts do not handle case where object is replaced #6059
OCPBUGS-100366: Re-queue ContainerRuntimeConfig on status update failure #6415
OCPBUGS-90502: Run nmstatectl format in nmstate-configuration #6209
OCPBUGS-115002: Remove BootImageSkewEnforcement references to gate component from MCO #6522
OCPBUGS-114882: drop GCD health-check ranges in openshift-gcp-routes #6501
OPNET-801: Switch on-prem HAProxy pods to haproxy-router-haproxy32 image #6502
OCPBUGS-122237: [TNF] Add infinite retry on untaint systemd unit #6535
OCPBUGS-116491: Correctly handle MC deletion in image mode when no new build is required #6528
OCPBUGS-121353: Pass missing proxy vars to bootstrap MCC #6526
MCO-2575: Refactor verification functions for calculateStatus test cases #6543
MCO-2570: remove poll methods #6532
OCPBUGS-114737: updateLayeredOS deploy-from-self when skopeo < 1.22.2 #6475
OCPBUGS-122209: Fix IsBootImageUpdateSupported to include vSphere and Azure platforms #6523
OCPBUGS-105283: Mount /etc/container in mosb #6451
OCPBUGS-95238: Dump compact cache to CM for persistence #6379
OCPBUGS-114664: Fix CVE-2026-15792: Upgrade BuildKit to v0.31.2 #6472
OCPBUGS-120711: Fix vsphere network absolute paths #6497
OCPBUGS-112721: Retry on conflict in syncMachineConfigNodes #6496
OCPBUGS-116490: remove nft chains before checking the ignition config #6485
NO-ISSUE: check mosb failed message in test 85980 #6500
OCPBUGS-109657: Assert errors in TestGetPrimaryPoolForNode #6482
OCPBUGS-115123: Replace wildcard permissions with explicit verbs in MachineConfigServer ClusterRole #6470
OCPBUGS-112348: Increase TC-74751 Eventually timeout for vSphere OVA upload #6481
OCPBUGS-115158: Update AMI Whitelist #6474
OCPBUGS-115203: Skip vsphere fd-unmatched machinesets for bootimage updates #6477
MCO-2530: Remove unused functions, constants, parameters, and returns throughout the codebase #6403
MCO-2427: Move OCB and OSStreams tests to longduration suite #6454
OCPBUGS-109659: Check conddegraded nil before dereference in TestCalculateStatus #6462
OCPBUGS-69681: limit ContainerRuntimeConfig status condition to 3 #6434
OCPBUGS-111648: crio: drop restore support #6412
OCPBUGS-112043: Preserve proxy environment vars #6424
OPNET-679: grant NET_ADMIN capability to coredns-monitor #6449
OCPEDGE-2984: fix: adjust fencing validator to match MAC-address based credential secrets #6450
OCPBUGS-112465: Update the MachineOSBuild event and condition functionality to more clearly handle pod failures with retries #6431
OCPBUGS-112784: Revert TNF Graceful node shutdown #6442
OCPBUGS-105399: Remove SigstoreImageVerification feature gate references #6445
OCPBUGS-64623: Use kubernetes scheme in drain controller event recorder #6446
OCPNODE-4526: Add ‘..’ block, max-length, and cross-store uniqueness #6433
OCPBUGS-100065: on-prem: tune API VIP haproxy health checks #6400
OCPBUGS-109746: OCPBUGS-112085: CORS-4441: Bootimage controller should gracefully handle Azure gen1 image removal #6404
NO-ISSUE: Extend timeout for waiting for UpdatePrepared MCN condition for SNO resiliency #6428
OCPBUGS-98258: Fix upstreams for CoreDNS pods on Cloud platforms #6383
NO-JIRA: Skip OVN-K VRFs in ofport-request dispatcher script #6398
OCPBUGS-109739: Increase rpm-ostree rebase retry backoff and preserve error #6413
OCPBUGS-112075: skip proxy for OSImageStream discovery in HyperShift #6420
OCPBUGS-65504: machine-config ClusterOperator relatedObjects missing ClusterRoleBinding #6369
AGENT-1570: Remove all NoRegistryClusterInstall feature gate check #6396
MCO-2411: Add AWS marketplace AMI band check target #6365
Full changelog

machine-image-customization-controller

OCPBUGS-112616: Update xz and ignition/v2 with known vulnerabilities #185
OCPBUGS-112617: Stop accepting IRONIC_AGENT_PULL_SECRET from the envi… #186
Full changelog

machine-os-images

OKD-465: Update Dockerfile installer base to ocp/5.1 #120
OCPBUGS-126621: Select bundled CoreOS version when COREOS_VERSION is unset #116
OCPBUGS-112613: Validate aarch64 ISO checksum after cross-arch extraction #113
TRT-2935: Revert machine-os-images PR #110 — fatal aarch64 ISO check crashes metal3 init-container #112
OKD-429: Fix OKD/SCOS builds to use centos CoreOS streams #109
OCPBUGS-112613: Validate aarch64 ISO checksum after cross-arch extraction #110
Full changelog

metallb-frr

OCPBUGS-85711: Sync 2026-10-12 #141
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #138
OKD-453: Dockerfile.openshift: conditionally install frr or frr10 based on OS version #137
Full changelog

monitoring-plugin

OU-1489: remove cors wildcard #1420
OCPBUGS-138695: feat: upgrade vulnerable dependencies #1421
OU-1306: add alert-management-api frontend client based on openapi spec #1417
OU-1306: add state, matcher, and filter openapi definition #1404
OU-1430: make the alert management api components more generic #1412
OU-1429: add alert detail information and chart #1405
OU-1066: feat: use console fetch in perses #1403
NO-JIRA: pre-commit hook moved to pre-push #1413
OU-1601: Merge troubleshooting panel into monitoring plugin #1390
OU-1090: don’t use useActivePerspective to determine perspective #1401
NO-JIRA: fix e2e-monitoring test flakiness #1408
OU-1550: add idempotent test setup commands #1249
OU-1429: add alert detail side panel #1391
NO-JIRA: Add incidents tab to alert management pages #1400
NO-JIRA: add diagnose-pipeline-failure skill and fix monitoring-dev periodic #1402
CNV-87535: address orphan cleanup review feedback #1398
OU-1428: add persistent column selection and sorting #1396
OU-1429: upgrade openshift sdk version #1395
CNV-87535: k8s: add orphan AlertRelabelConfig GC #1174
NO-JIRA: Fix vulnerable dependencies #1394
NO-JIRA: add playwrite component tests #1392
OU-1593: Upgrade perses #1366
OU-1595: merge logging-view into the monitoring console plugin #1360
OU-1428: add missing alert list page tooltips #1387
OU-1428: alert management list page #1345
OCPBUGS-131104, OCPBUGS-131955, OCPBUGS-131960, OCPBUGS-131970, OCPBUGS-131984, OCPBUGS-132028: Upgrade vulnerable dependencies #1328
OCPBUGS-132207: fix metrics series color squares #1368
OU-1488: sanitize linkified URLs in alert annotations #1374
OU-1428: fix prometheus rules api compatibility by removing omitempty’s #1373
NO-JIRA: watch AlertRelabelConfig resource in openshift-monitoring only #1361
NO-JIRA: Add alerting GET endpoints to OpenAPI #1344
NO-JIRA: fix: provide SA token to console bridge to access remote dashboards from local dev env #1351
NO-JIRA: fix: patch vulnerable dependencies #1318
NO-JIRA: Add alert management API #1339
OU-1392: fix: parse datetime ranges from the specified format rather than browser specific apis #1308
OU-1483: automation - perses rbac stability and group permission for all users #1326
OU-1600: fix: sort agentic runs by created to avoid getting stalled runs related to alerts #1325
OU-1436: refactor to prepare for alert management #1324
OU-1212: Create Observability Services landing page #1289
NO-JIRA: update devspace to sync backend and config changes #1322
NO-JIRA: prevent importing feature files in shared files #1323
OU-1528: Swapping namespaces in Alerts optimized #1305
NO-JIRA: Agent skills consolidated #1298
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #1264
NO-JIRA: sanitize runbook_url #1255
OU-1150: more refactors #1286
NO-JIRA: duplicate dashboard creates perses project #1258
OCPBUGS-123668: patch adm-zip vulnerable version #1274
NO-JIRA: feat: migrate to vitest #1237
OU-1220: Add column to display dashboard id in perses dashboard list page #1257
OU-791: hide Export as CSV link on empty Alerts page #1251
NO-JIRA: fix(metrics): sync query-browser URL into Redux after navigation #1238
OU-1344: Add granular permission checks #1185
NO-JIRA: Pin node 22 and migrate deprecated i18next-parser #1235
NO-JIRA: use existing env var as a dashboard project in the OLS show time… #1236
OU-1147: Perses UI Customization. Allow semantic tokens to map correctly with PatternFly themes and modes #1226
OU-1472: refactor variables #1224
OCPBUGS-119714, OCPBUGS-119717: fix: upgrade fast-uri to 3.1.7 #1234
OCPBUGS-115456: fix: upgrade vulnerable dependencies #1233
OU-1472: lint tags #1221
OU-1472: perses version upgrade fixes #1228
OCPBUGS-114786, OCPBUGS-114789, OCPBUGS-114792: fix: upgrade vulnerable fast-uri dependency #1200
NO-JIRA: Add dchromik to observability-ui aliases #1230
NO-JIRA: upgrade webpack #1213
OCPBUGS-114776, OCPBUGS-114795: fix: upgrade vulnerable dompurify dependency #1199
OU-1423: fix: adjust perses mui theme to patternfly glass mode #1195
NO-JIRA: swap perses to ols specific tag for ols testing run #1194
OU-1409: include the legal disclaimer in the alert actions to agentic runs #1188
OU-1417: Fix Perses tooltips background color in OCP 5 #1178
OLS-3921: disable button shrink #1186
OU-1422: feat: update perses dependecies to allow to tag the OLS contributed panels #1045
OU-1472: rename tags to be the same as backend features #1128
OU-1471: don’t throw when listing globaldatasource for fallback #1153
OU-1514: update useFeatures hook to feature driven backend #1151
NO-JIRA: chore: organize dev dependencies and avoid cypress binary install #1148
NO-JIRA: feat: replace outdated react-linkify dependency #1144
OU-1472: remove incidents feature from backend and tests #1127
OU-1107, OU-1108: ACM alerting UI with alerts and perses #1105
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

multus-admission-controller

CORENET-6320: fix(deployment): use read-only root filesystems #138
CORENET-7234: Update OWNERS file #118
NO-JIRA: Bump to Ginkgo v2 2.33.0 #142
CORENET-7567: Add TLS curve preferences configuration support #143
CORENET-7375: d/s merge Bump Kubernetes to 1.36.2 and Go to 1.26 #123
OCPBUGS-112557: Bump golang.org/x/net to 0.57.0 to fix CVE-2026-33814 #125
Full changelog

multus-cni, multus-cni-microshift

CORENET-7619: DS Merge 10/12/26 #370
OCPBUGS-114000: DS Merge 08/27/2026 #344
Full changelog

multus-networkpolicy

NO-JIRA: Downstream merge 20260826 #120
Full changelog

multus-route-override-cni

CORENET-7631: Update the minimum Go version #84
CORENET-7631: Bump Kubernetes to 1.37 and Go to 1.26.8 #83
CORENET-7237: Update OWNERS file #70
OCPBUGS-83863: Remove rhel8 build stage #66
Full changelog

multus-whereabouts-ipam-cni

CORENET-7230: Update OWNERS file #414
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #430
OCPBUGS-112555: Fix for CVE-2026-33814 #418
Full changelog

must-gather

OCPBUGS-137965: Updating ose-must-gather-container image to be consistent with ART for 5.1 #577
OCPBUGS-122049: gather_ppc: collect per-node ethtool channel data #562
WINC-2092: Add windows_exporter log collection #560
OCPBUGS-114428: Update build-machinery-go vendor dependency #563
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

network-interface-bond-cni

OCPBUGS-83863: Remove rhel8 build stage #113
Full changelog

network-metrics-daemon

OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #158
CORENET-7238: Update OWNERS file #145
OCPBUGS-112553, OCPBUGS-112568: Fix CVE for ose-network-metrics-daemon #147
Full changelog

network-tools

CORENET-7641, CORENET-7647: Add AGENTS.md and coderabbit config #192
NO-JIRA: Added iperf3 #189
Full changelog

networking-console-plugin

OCPNETUI-19: Service port builder and pod selector #672
OCPNETUI-212: Add Jest unit tests for topology and a Test workflow #671
OCPNETUI-190: Add port isolation support to LinuxBridge NAD form #670
OCPBUGS-41784: Honor label selectors when searching Services #673
maintenance: bump the npm group with 46 updates #681
NO-JIRA: do not fall back to the raw resource field for empty children #492
OCPNETUI-126: Add configuration topology side drawer #634
OCPNETUI-205: apply the physical networks review feedback #668
OCPNETUI-205: add the physical networks inventory to the networking plugin #654
maintenance: bump the github-actions group with 3 updates #657
maintenance: bump the npm group with 71 updates #663
OCPNETUI-18/31/136-139: Move and split topology E2E tests to ui-tests-cy #666
OCPNETUI-139: Add Cypress E2E tests for topology additional views #665
OCPNETUI-138: Add Cypress E2E tests for topology resource details drawer #664
OCPNETUI-18: Add Cypress E2E tests for topology CUDN/UDN nodes #656
OCPNETUI-31: Add Cypress E2E tests for topology NAD nodes #655
OCPNETUI-56: Split hot-cluster-e2e-run.yml into composite actions #581
OCPBUGS-132373: Removed clearing of spec.selector/ports on switch to ExternalName service type #641
OCPNETUI-168: Update Owners file #644
OCPNETUI-115: Topology toolbar view #643
OCPNETUI-114: Add network topology view #561
OCPNETUI-56: Add custom ARC runner image with pre-installed tools #580
OCPNETUI-136: E2E tests for the topology node view #631
maintenance: bump the npm group with 32 updates #635
OCPNETUI-178: migrate to @kubevirt-ui-ext/kubevirt-api #626
OCPNETUI-137: E2E tests for the topology view toolbar #632
OCPNETUI-56: Hot-cluster CI infrastructure and test fixes #522
maintenance: bump the npm group with 33 updates #619
maintenance: bump cypress-io/github-action from 6 to 7 in the github-actions group #608
OCPNETUI-80: Migrate to eslint v9 #488
maintenance: bump the npm group with 20 updates #598
OCPNETUI-140: dependency cleanup #589
OCPNETUI-140: reassign dev and prod dependencies #582
OCPNETUI-56: Add hot-cluster E2E workflows, composite actions, and Dockerfile.ci #497
OCPBUGS-105361: Create UDN modal now supports secondary UDN creation #579
maintenance: bump the npm group with 26 updates #575
OCPBUGS-98590: Added validation to NAD creation pages #553
maintenance: bump the npm group across 1 directory with 17 updates #563
OCPNETUI-140: Align shared modules with Console #546
OCPNETUI-140: Extend dependabot ignore list #545
maintenance: bump the npm group across 1 directory with 201 updates #544
maintenance: bump the npm-security group across 1 directory with 10 updates #521
OCPNETUI-65: Enable dependabot updates on release-5.0 #524
OCPBUGS-86053: Fix MultiNetworkPolicy list crash when spec is missing #523
OCPNETUI-78: Remove unused Dockerfile.art #516
OCPNETUI-63: Drop unused Helm charts #473
OCPNETUI-14: Add Cypress E2E tests for network-to-VM cross-navigation #493
OCPNETUI-65: Add multi-branch dependabot config #487
CNV-67257: Set physicalNetworkName on OVN localnet NADs created from the console #477
OCPBUGS-105358: Fix NAD config generated in form for OVN K8s secondary localnet networks #496
OCPNETUI-81: Retry fetching from npm registry to unblock OKD build #494
OCPNETUI-56: Add CI scripts for hot-cluster E2E infrastructure #489
OCPNETUI-56: Add ci-env-controller Helm chart for test environment lifecycle #491
OCPNETUI-56: Add ci-test-stack Helm chart for E2E test environments #490
OCPNETUI-22: Add Cypress E2E tests for Service create and edit form #480
OCPNETUI-78: Sync Dockerfile and Dockerfile.art #485
OCPNETUI-59: Add Cypress E2E tests for Service and Route endpoint health #481
OCPNETUI-66: Drop unused devcontainer config #474
OCPNETUI-56: Add Cypress test specs and runner scripts #470
OCPBUGS-113967: Fix 404 error on MultiNetworkPolicy page when “All projects” is selected #483
OCPBUGS-91643: Fixed IP sorting in service overview #482
OCPBUGS-112660: Marked strings for i18n in NetworkPolicies list page #478
OCPBUGS-86249: fixed edit pod selector #476
OCPNETUI-56: Add Cypress E2E framework config and support files #468
OCPNETUI-56: Add Cypress page objects and test constants #469
chore(i18n): update Sprint 1 translations and Memsource CLI skill docs #471
Full changelog

nutanix-cloud-controller-manager

OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #84
OCPBUGS-123772: Bump golang.org/x/net to v0.58.0 to address CVE-2026-33814 #85
Full changelog

nutanix-machine-controllers

NO-JIRA: Move JoelSpeed to advisory_approvers #145
OCPCLOUD-3664: bump Kubernetes dependencies to 1.37 #142
Full changelog

oauth-apiserver

CNTRLPLANE-4602: use shared authentication configuration types #243
CNTRLPLANE-4583: K8s 1.37 rebase #239
OCPBUGS-114428: Update build-machinery-go vendor dependency #228
OCPBUGS-108041: fix CVE-2026-41178 by bumping otel to v1.44.0 #219
CNTRLPLANE-2260: test migration of tokenreview tests to OTE #212
NO-JIRA: Remove cluster profile directory authentication as it is no longer injected in CI #217
Full changelog

oauth-proxy

NO-JIRA: watcher: fix undying goroutine #378
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #377
ACM-37203: Add support for configurable TLS profiles #372
OCPBUGS-115305: bugfix: rewrite open redirect strings to ‘/’ #374
NO-JIRA: Add control-plane-approvers to OWNERS #373
Full changelog

oauth-server

CNTRLPLANE-4583: K8s 1.37 rebase #290
OCPBUGS-130780: Remove ancient deprecated header #196
OCPBUGS-122888: Add high contrast support to oauth templates #262
OCPBUGS-114428: Update build-machinery-go vendor dependency #260
OCPBUGS-115307: bugfix: default to english when Accept-Language header contains more than 1000 underscores #253
Full changelog

olm-catalogd, olm-operator-controller

NO-ISSUE: Migrate OpenShift tooling to go tool and add Dependabot #853
NO-ISSUE: Make OpenShift go-build-local work from either directory #855
OPRUN-4784: Synchronize From Upstream Repositories #856
OPRUN-4784, OPRUN-4794: Synchronize From Upstream Repositories #852
OPRUN-4784: Synchronize From Upstream Repositories #850
OPRUN-4881: Add object-controller downstream packaging #849
NO-ISSUE: Synchronize From Upstream Repositories #848
NO-ISSUE: Synchronize From Upstream Repositories #847
OPRUN-4783, OPRUN-4796: Synchronize From Upstream Repositories #846
NO-ISSUE: Use upstream Kubernetes 1.37 modules for OLMv1 tests #844
NO-ISSUE: Use OpenShift Bingo for catalog consistency lint #842
OPRUN-4785, OPRUN-4796: Synchronize From Upstream Repositories #843
OPRUN-4826: Update OLMv1 test extension to Kubernetes 1.37 #841
OPRUN-4825: Update default-catalog-consistency to Kubernetes 1.37 #840
OPRUN-4791: Synchronize From Upstream Repositories #838
NO-ISSUE: Synchronize From Upstream Repositories #832
NO-ISSUE: Remove NewOLMOwnSingleNamespace OTE tests #833
OPRUN-4802: Synchronize From Upstream Repositories #836
NO-ISSUE: Synchronize From Upstream Repositories #831
OPRUN-4786, OPRUN-4793: Synchronize From Upstream Repositories #830
NO-ISSUE: Synchronize From Upstream Repositories #829
NO-ISSUE: Synchronize From Upstream Repositories #828
NO-ISSUE: Synchronize From Upstream Repositories #826
NO-ISSUE: Synchronize From Upstream Repositories #823
NO-ISSUE: Pin controller-runtime to v0.24.1 in tests-extension #821
OCPBUGS-97746, OPRUN-4738, OPRUN-4774, OPRUN-4775: Synchronize From Upstream Repositories #819
ocpbugs-115274: fix webhook finalizer flake #798
OCPBUGS-121303, OCPBUGS-121304: Bump go-git to v5.19.2 #810
OPRUN-4723: Synchronize From Upstream Repositories #811
NO-ISSUE: Synchronize From Upstream Repositories #791
OCPBUGS-83515: UPSTREAM: <carry>: use internal shell image for catalog FBC curl Job #792
NO-ISSUE: Synchronize From Upstream Repositories #790
Full changelog

openshift-apiserver

OCPBUGS-127118: bump apiserver-library-go #697
OCPBUGS-136964: re-enable watch cache in openshift-apiserver #696
CNTRLPLANE-4583: K8s 1.37 rebase #692
NO-JIRA: route: Use Network Ingress DNS owner aliases #690
OCPBUGS-108032: update otel to 1.44.0 to fix CVE-2026-41178 #684
Full changelog

openshift-controller-manager

CNTRLPLANE-4583: bump(k8s.io): 1.37.1 #462
CNTRLPLANE-3878: bump(k8s.io): 1.36.3 #451
Full changelog

openshift-state-metrics

NO-JIRA: update OWNERS #140
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #139
Full changelog

openstack-cluster-api-controllers

UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack/tree/release-0.14 (d904282) into main #447
Bump manifests-gen for proxy injection annotation #452
OCPBUGS-131040: Replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 for CVE-2026-33814 [main] #451
UPSTREAM-SYNC: Re-baseline main onto clean upstream merge to unblock rebasebot #446
Fix release 0.14 sync: incomplete vendoring in hack/tools #433
Fix rebasebot post-rebase hook helper path lookup #432
Fix rebasebot merge-bot by removing stale API version artifacts #431
Full changelog

openstack-machine-api-provider

NO-JIRA: Address review comments from PR #193 #198
OSASINFRA-4544: Bump CAPO to 0.15 and adopt CAPO API v1beta2 #193
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #187
Full changelog

openstack-resource-controller

NO-JIRA: Update OWNERS_ALIASES #29
UPSTREAM-SYNC: Merge https://github.com/k-orc/openstack-resource-controller:release-2.0 into main #40
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-129618, OCPBUGS-136047, OPRUN-4431: Synchronize From Upstream Repositories #1401
OCPBUGS-115142: use in-process implementation of PSA audit per-scenario to prevent regressions #1396
OPRUN-4828: Update OLMv0 test extension to Kubernetes 1.37 #1397
NO-ISSUE: Synchronize From Upstream Repositories #1398
OPRUN-4798: synchronize OLMv0 TLS curves and update package-server manager #1394
OPRUN-4798: Synchronize From Upstream Repositories #1377
OCPBUGS-126127: test: bump test extension gRPC to v1.83.2 #1382
NO-ISSUE: add per-scenario PSA compliance audit #1374
NO-ISSUE: Synchronize From Upstream Repositories #1361
OCPBUGS-122255: tests-extension: fix PolarionID:68521 and Polarion:27680 #1376
OCPBUGS-83412: set catalogsource spec.grpcpodconfig.scc: restricted for all non-legacy cases #1359
OCPBUGS-104542: force node arch for opm and catalogsource pod for multiarch tests; fix test failure #1357
OCPBUGS-23954, OCPBUGS-78095: Synchronize From Upstream Repositories #1355
Full changelog

operator-marketplace

NO-ISSUE: Bump github.com/onsi/gomega from 1.43.1 to 1.44.0 #797
NO-ISSUE: Bump github.com/onsi/gomega from 1.43.0 to 1.43.1 #795
NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.32.2 to 2.33.0 #796
NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.32.1 to 2.32.2 #794
NO-ISSUE: Bump github.com/onsi/gomega from 1.42.1 to 1.43.0 #781
NO-ISSUE: Bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 #779
NO-ISSUE: Bump github.com/stretchr/testify from 1.12.0 to 1.12.1 #777
NO-ISSUE: Bump the k8s-dependencies group across 1 directory with 3 updates #776
NO-ISSUE: Bump github.com/sirupsen/logrus from 1.10.0 to 1.10.1 #778
NO-ISSUE: Bump github.com/sirupsen/logrus from 1.9.4 to 1.10.0 #774
NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.32.0 to 2.32.1 #773
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-136932: DownStream Merge [11-12-2026] #3630
NO-JIRA: DownStream Merge [11-09-2026] #3621
CNV-99195: openshift: Activate mac-security tests with pods over layer2 topology #3555
NO-JIRA: DownStream Merge [11-03-2026] #3597
NO-JIRA: DownStream Merge [10-30-2026] #3589
CORENET-6748: OTE: Enable EgressFirewall tests #3433
NO-JIRA: DownStream Merge [10-28-2026] #3581
OCPBUGS-127208: DownStream Merge [10-22-2026] #3572
NO-JIRA: Add arkadeepsen, martinkennelly and pperiyasamy to OWNERS file #3570
CORENET-6746: Enable EgressIP E2E tests on baremetal, AWS, Azure and GCP for OTE #3227
[NO-JIRA: DownStream Merge [10-19-2026] #3561
OCPBUGS-120087, OCPBUGS-123556, OCPBUGS-128278: DownStream Merge [10-14-2026] #3543
OCPBUGS-128662: DownStream Merge [10-08-2026] #3517
NO-JIRA: DownStream Merge [09-28-2026] #3479
CORENET-7596, OCPBUGS-123678: DownStream Merge [09-23-2026] #3473
CORENET-7572: DownStream Merge [09-21-2026] #3465
CORENET-7562, OCPBUGS-98726, OCPBUGS-99645: DownStream Merge [09-11-2026] #3439
OCPBUGS-112563, OCPBUGS-99451: DownStream Merge [08-31-2026] #3434
CORENET-7467: run OTE tests only in ovn-kubernetes conformance suites #3416
OCPBUGS-112470: Register test images using tests extension #3363
NO-JIRA: DownStream Merge [08-17-2026] #3402
Full changelog

powervs-block-csi-driver

MULTIARCH-6346: Rebase with upstream - go modules updates and code changes #138
Full changelog

powervs-block-csi-driver-operator

STOR-3176: Support TLS Groups in operators for kube-rbac-proxy sidecar #130
STOR-3068: Bump all libraries #127
OCPBUGS-127462: Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile #124
Full changelog

powervs-cloud-controller-manager

OCPCLOUD-3723: Merge https://github.com/IBM-Cloud/cloud-provider-ibm:01595b6d497cc6ec6f807bd7136ac43d147ea042 (01595b6) into main #124
No-Jira: Update packages in go.mod #125
No-Jira: Update packages in go.mod #114
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #109
No-Jira: Update packages in go.mod #108
Full changelog

powervs-machine-controllers

NO-JIRA: Move JoelSpeed to advisory_approvers #164
NO-JIRA: Update OWNERS_ALIASES to modify approvers and reviewers #145
OCPCLOUD-3665: bump Kubernetes dependencies to 1.37 #152
OCPBUGS-127383: Bump x/net and opentelemetry to address CVEs #150
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #147
OCPBUGS-112023: Update dependencies to k8s 1.36 #146
Full changelog

prom-label-proxy

NO-ISSUE: [bot] Bump openshift/prom-label-proxy to v0.16.2 #417
NO-JIRA: synchronize OWNERS from cluster-monitoring-operator #401
NO-ISSUE: [bot] Bump openshift/prom-label-proxy to v0.15.1 #399
Full changelog

prometheus

OCPBUGS-136048: build: bump klauspost/compress to v1.20.2 #408
NO-ISSUE: [bot] Bump openshift/prometheus to v3.15.1 #405
NO-ISSUE: [bot] Bump openshift/prometheus to v3.15.0 #399
NO-JIRA: update OWNERS #379
NO-JIRA: [bot] Bump openshift/prometheus to v3.14.0 #363
NO-ISSUE: [bot] Bump openshift/prometheus to v3.14.0 #361
Full changelog

prometheus-alertmanager

OCPBUGS-136055: Bump klauspost/compress to v1.20.3 #211
NO-JIRA: synchronize OWNERS from cluster-monitoring-operator #186
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #175
Bump openshift/prometheus-alertmanager to v0.34.1 #177
Bump openshift/prometheus-alertmanager to v0.34.0 #168
NO-ISSUE: Remove unused upstream .github/workflows #167
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-136051, OCPBUGS-136053, OCPBUGS-136054: Bump klauspost/compress to v1.20.2 #424
NO-ISSUE: [bot] Bump openshift/prometheus-operator to v0.94.2 #423
NO-JIRA: synchronize OWNERS from cluster-monitoring-operator #405
MON-4696: Bump openshift/prometheus-operator to v0.94.1 #403
MON-4689: Bump openshift/prometheus-operator to v0.94.0 #400
NO-ISSUE: [bot] Bump openshift/prometheus-operator to v0.93.1 #393
Full changelog

prometheus-node-exporter

OCPBUGS-129592: Test mountinfo parsing beyond 1 MiB #217
NO-JIRA: Update OWNERS #199
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #189
NO-ISSUE: [bot] Bump openshift/node_exporter to v1.12.1 #186
OCPBUGS-100376: cherry-pick 24c6dce279c418bcb911824e8c8be1c81a1e832b - Fix fibrechannel_linux for ppc64le (#3769) #184
Full changelog

route-controller-manager

OCPBUGS-126131: bump grpc-go to v1.84.0 #116
OCPBUGS-104856: clear unmanaged-route metric when the route is removed #102
Full changelog

stream-coreos, stream-coreos-extensions

COS-5251: Nvidia - Add DOCA packages #1982
COS-4569: Add off-layering directory for Nvidia builds #1979
OCPBUGS-123732: Re-enable sandboxed-containers extension for 5.0 #1971
NO-JIRA: Update to track 5.1 #1964
Full changelog

telemeter

NO-JIRA: fix id_primary_host_type metric for baremetal nodes #632
NO-JIRA: split rule tests by recording rule #630
NO-JIRA: format Telemeter rule expressions #628
NO-ISSUE: tidy up tools/go.mod #617
OCPBUGS-122075: don’t log authorization header #614
NO-JIRA: synchronize OWNERS from cluster-monitoring-operator #622
OCPBUGS-114428: Remove generated Telemeter tools vendor tree #618
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #615
OCPBUGS-115550: Add ‘agent-installer-postconfig’ install_type #616
BIZ-794: separte managed and self-managed ACM capacity #612
Full changelog

tests

OPNET-595: Add BGPBasedVIPManagement e2e tests and suites #31893
ROSAENG-65766: Termination message policy grandfather #31731
NO-JIRA: Remove exception OCPBUGS-38663 #31886
CNTRLPLANE-4846: Migrate IR otp cases to e2e #31800
OCPBUGS-136122: commatrix: skip kube-apiserver-proxy haproxy DNS reso… #31874
STOR-2801: add e2e tests for volumeForceDetach ControllerManager config #31833
CONSOLE-5209: Fix IngressComponentRouteLabels e2e tests for HCP compatibility #31483
NO-JIRA: Remove exception OCPBUGS-62629 #31885
NO-JIRA: e2e: move AdminKubeClient() from init to BeforeEach in router config_manager test #31335
OCPBUGS-122213: Sync journal before collecting reboot history in unexpected-reboots test #31630
NO-JIRA: Update security context test to accept unprivileged kms containers #31881
NO-JIRA: Exclude leader-change invariant from etcd certificate rotation #31882
OCPCLOUD-3726: Ignore failed pulls of fake CVO upgrade image #31876
NO-JIRA: Harden etcd certificate rotation stabilization waits #31863
NO-JIRA: fix(security): read FIPS state from HostedCluster on HyperShift #31288
OCPBUGS-122924: Preserve default IngressController TLS profile during upgrade #31647
NO-JIRA: Restoring only changed entries during cleanup activities #31849
OCPBUGS-137966: Updating openshift-enterprise-tests-container image to be consistent with ART for 5.1 #31861
TRT-3011: Increase authentication proxy ScalingReplicaSet event cap to 120 #31842
OCPBUGS-131892: Temporary hack to redistribute operators after install #31832
NO-ISSUE: Automated - Update synthetic test data #31868
OCPNODE-4844: node: add GOMAXPROCS tests #31700
NO-JIRA: Remove deads2k from OWNERS #31865
CNV-100562: Add netshoot v0.16 to test image mappings #31860
CNTRLPLANE-4833: Exclude test-component CRDs from the CRD stability check #31854
OCPBUGS-133950: Create the GCP regional volume for the default StorageClass disk type #31816
NO-JIRA: Bump apm to 0.35.0 and exclude vendor directories #31856
NO-JIRA: Disable legacy kube-apiserver invariants for etcd recovery suite #31855
ROSAENG-64885: skip uncompatible tests for rosa #31672
NE-2126: register CDO, router and images repo to tests extension #31732
OCPBUGS-136187: Bound SNO upgrade pathological-event allowances #31839
OPCT-492: Fix MCN tests to respect node taints #31773
OCPNODE-4851: NodeResource pool CAPI provisioning fixes TP isolated skip #31835
OCPSTRAT-3661: Disable flake mode for RBAC escalation checks #31845
OCPBUGS-136754: Fix IRI deletion test #31840
OCPKUEUE-888: Add CI coverage for workload-aware scheduling gates #31813
OCPBUGS-127006: Intervals for virtio out of puff memory errors #31666
CNTRLPLANE-4402: Adapt external OIDC e2e tests for webhook architecture #31778
OCPBUGS-135024: Retry transient ServerVersion discovery in KubeRebaseTestsFilter #31827
OCPBUGS-134791: skip NetObserv OLM-timeout e2e on HyperShift #31824
NO-ISSUE: Automated - Update synthetic test data #31828
TRT-3011: Wait for OAuth server rollouts in component proxy tests #31779
OCPBUGS-119673, OCPEDGE-2819: Update TNF credential rotation test #31611
OCPCLOUD-3330: Create test/shared module initially containing reusable fake cincinnati server #31804
CORENET-6512: Add CNO test extension binary #31218
OCPBUGS-133466: allow DaemonSet SuccessfulCreate pathological events #31810
AGENT-1654: Add IRI deletion test #31757
NO-JIRA: singleton-placement-collector: collect on single node and two node clusters #31815
TRT-3049: Align NetObserv timeout test with CNO status contract #31814
NO-JIRA: Add ANP/BANP Ready-In-Zone status cleanup e2e #31593
NE-2922: Migrate operator Ingress management-mode tests to v1 #31807
OCPBUGS-82190: Remove etcd preDrain hook strip workaround from node replacement test #31149
CNTRLPLANE-2157: Migrate test cases of KubeAPI server functionality to OTE #31697
NO-JIRA: Improve etcd-scaling job reliability by removing checks that don’t apply to control plane replacement #31797
OCPBUGS-131892: add memory thrashing and CPU saturation intervals #31766
OCPNODE-4674: Split node long-running tests into openshift/nodes/isolated #31586
OCPSTRAT-3618: Rebase 1.37 #31721
OCPSTRAT-3661: Add additional rbac escalation monitortest exceptions #31802
NO-ISSUE: Automated - Update synthetic test data #31799
OCPBUGS-130621: Isolate LDAP group sync test resources #31730
OCPBUGS-132757: Further optimize oc must gather tests to improve efficiency #31282
NO-JIRA: Fix CPU partitioning test isolation #31777
NO-JIRA: add host-network-connection-integrity monitor test #31785
NO-JIRA: cli: accept both error: invalid/Invalid image name casing in oc run tests #31791
OCPBUGS-123644: Allow etcd probe error due to tls config change #31789
OCPBUGS-130780: stop expecting OAuth X-XSS-Protection header #31788
OCPBUGS-126709: Allow VirtPlatformDependencyMissing alert #31787
OCPBUGS-131892: add singleton-placement-collector monitor test #31768
NO-JIRA: Support reusable devcontainer setup and optional OpenCode #31775
OCPEDGE-3027: add TNF metrics e2e coverage #31663
OCPBUGS-132363: Allow prometheus test pods to access NTO metrics port #31781
TRT-3011: Include noProxy login test in OAuth scaling event exception #31780
OCPBUGS-132202: request only supported IP families in kubevirt VM network data #31770
MCO-2626: Remove MCN’s node create and delete test #31771
CNTRLPLANE-3481: (Testing/Functional) Sourcing claims from multiple sources works as expected #31712
NE-2816: Apply HAProxy sidecar on router e2e tests #31589
OCPBUGS-129429: Soften PHC offline assertions #31717
NETOBSERV-2563: skip network observability e2e tests in disconnected env #31767
TRT-3011: Increase AuthenticationComponentProxy scaling event allowance to 70 #31754
NO-JIRA: omit skipped tests from high_cpu_e2e_tests autodl data #31759
TRT-3020: Report audit request violations as flakes #31756
NO-JIRA: Remove exception OCPBUGS-85677 #31734
OCPQUAL-55: remove static.redhat.com disruption monitor #31685
OCPBUGS-129376: Azure dual-stack load balancers should expose public and internal services over IPv4 and IPv6 #31716
OCPNODE-4776: Add Kerberos authentication test plan for OCP 5.1 #31704
NETOBSERV-2563: Add network observability e2e tests #31342
OCPEDGE-2985: Assert PacemakerFencingEvent after real fencing #31703
NE-2913: Update deprecated HAProxy versions in upgrade test #31701
OCPBUGS-130621: Clean up component proxy login resources #31729
OCPBUGS-86789: Revert “Make early request monitor test informing” #31590
OCPBUGS-86789: Move external ip policy test to disruptive-longrunning #31638
NO-ISSUE: Automated - Update synthetic test data #31698
OCPBUGS-123649: allow v1beta2 DRA API in discovery test #31566
OCPBUGS-129615: Allow Prometheus auth test to reach console metrics #31723
NO-JIRA: Document shrink-only retry allowlist policy #31710
OCPBUGS-129175: Handle offline or removed nodes in TNF replacement test #31708
NO-JIRA: Add cluster-machine-approver OTE suite #31706
OCPBUGS-129012: Parallel SSA ClusterOperator test races with sig-arch operator version check #31699
NO-ISSUE: Revert “Add CustomResourcePublishOpenAPI conformance test to retry allowlist” #31694
OCPQUAL-42: Refresh retry allowlist against 5.0 and 5.1 CI data #31551
CNTRLPLANE-3483: Add e2e test Hot reloading changes of the external OIDC configuration #31678
OCPBUGS-122386: e2e-analysis: add –skip-readiness-checks flag for degraded cluster lanes #31635
NO-ISSUE: Automated - Update synthetic test data #31682
OCPSTRAT-3618: Mirror glibc-dns-testing 2.0.0 for the k8s 1.37 rebase(revert in rebase PR) #31683
INTEROP-9204: Add –extension-local-binaries flag for local extension binary loading #31652
trt-2972: use matcher details #31676
OCPBUGS-128397: Skip router verbosity rollout for degraded TNF tests #31680
OPCT-460: Increase timeout for external IP policy test to accommodate in-cluster rollouts #31636
NO-JIRA: Up threshold for mass dns disruption to fail a test based on real world observations #31674
CNTRLPLANE-3851: Oauth server proxy config e2e #31463
CNTRLPLANE-3474: Add tests for external claims source featuregate #31591
OCPBUGS-127184: Redact OAuth tokens from test cleanup logs #31640
STOR-3090: Add CSI storage test for pod delete after host umount of mounted volume #31488
OCPBUGS-111056: Make operator log scraper and monitor tests topology-aware #31597
CNTRLPLANE-4303: Add threshold for ote encryption cases #31658
OCPBUGS-112722: make webhook build resolution wait phase-independent #31655
OCPBUGS-121385: Resolve Additional Storage agnhost image through mirror #31618
NE-2750: implement feature test for GatewayAPIManagementMode #31503
OCPEDGE-3076: Fix TNF kubelet disruption test race condition #31650
OCPSTRAT-3661: Always emit passing cases for found issues in RBAC monitor test #31639
NO-ISSUE: Automated - Update synthetic test data #31607
NO-JIRA: Add a new test for mass DNS disruption #31625
OCPBUGS-114022: Avoid polling skipped Prometheus target namespaces #31563
TRT-2830: add REVIEW.md for agentic review responses #31637
OCPSTRAT-3661: Add Sippy discovered exceptions for RBAC monitor test #31616
OCPBUGS-104846: Filter both [FeatureGate:] and [OCPFeatureGate:] #31623
OCPBUGS-121384: Isolate KubeletEnsureSecretPulledImages test setup #31619
OKD-454: Skip OKD job name check for cluster-bot launch jobs #31628
OCPBUGS-92837: test/router: wait for all per-route metrics before asserting #31344
CORENET-6746: Allow EgressIP NoMatchingNodeFound events to repeat pathologically #31614
OCPBUGS-86789: Bump network config timeout to 25 minutes #31599
CNTRLPLANE-3789: Add e2e tests for authentication component proxy #31446
OCPBUGS-84250: Increase router verbosity in DCM tests #31555
NO-JIRA: test: poll final EgressFirewall DNS deny assertion #31473
OCPBUGS-66213: add link to jira card #31609
NE-2839: Add HAProxy version upgrade tests #31602
CORENET-7243: Add TLS Profile Compliance tests for networking components #31500
OCPSTRAT-3618: Fix check in auth test for 1.37 given new NamedAuthorizer behavior #31574
OCPSTRAT-3618: Update etcd test data for k8s 1.37 release #31605
METAL-1833: Register cluster-baremetal-tests-ext in extension registry #31197
OCPSTRAT-3661: Add monitortest to verify possible Cluster Admin escalation paths #31536
OCPBUGS-66213: image registry single replica exceptions #31544
OCPBUGS-111997: Add Degraded=True exception for authentication operator during upgrade #31535
TRT-2939: Revert “Merge pull request #31495 from jcmoraisjr/NE-2839-haproxy-version-upgrade-tests” #31598
OCPBUGS-77283: bump kubevirt fedora containerDisk to multi-arch v1.8.2 + permanent exception #31284
OCPBUGS-112662: Fix the number of requests in repeated exec #31548
OCPBUGS-115153: Make extension test-binary extraction architecture-aware #31579
NO-ISSUE: Automated - Update synthetic test data #31581
NE-2839: Add HAProxy version upgrade tests #31495
OCPBUGS-111643: Fixed Flakiness of Webhook test - ClusterResourceQuota validation #31531
OCPNODE-4470: Add DRA consumable capacity e2e tests #31448
OCPBUGS-112390: Fix node replacement test timestamp filter and allow job retry #31492
TRT-2930: skip regional-PD e2e on GCP families without pd-standard #31572
ROSAENG-391: Add CustomResourcePublishOpenAPI conformance test to retry allowlist #31552
OCPBUGS-114341: Allow KubeDaemonSetRolloutStuck alert on external platform clusters #31564
OCPBUGS-111581: Fix probe termination test to use pod status instead of kubelet event text #31528
OCPBUGS-112283: Allow KubeDaemonSetMisScheduled alert on external platform clusters #31556
OCPBUGS-99536: Raise status polling timeout and write bound #31534
OCPBUGS-86257: Fix pathological events #31543
OCPBUGS-105399, OCPBUGS-105400: Remove TechPreview skips and event matchers from sigstore imagepolicy tests #31521
CNTRLPLANE-3423: e2e TLS test for service-operator-ca #31480
OCPBUGS-112470: fix duplicate destination tags in openshift-tests images output #31542
OCPBUGS-84517: Remove stale openshift-marketplace terminationMessagePolicy exemption #31355
CONSOLE-5188: remove console exceptions #31280
OCPBUGS-100298: pin internal-lb-monitor pollers to worker nodes #31466
OCPBUGS-84513: remove openshift-cluster-version terminationMessagePolicy exemption #31359
OCPBUGS-105461: allow baremetal to progress while MCO does #31511
OCPBUGS-105874: Avoid TLS port-forward to stale endpoints on degraded TNF clusters. #31502
OCPBUGS-111704: router/metrics: enable proxy protocol for client on AWS clusters #31526
OCPBUGS-109671: monitortests: allow image-registry node-ca Progressing on DualReplica #31517
CNTRLPLANE-1739: e2e additional tests for pki config #31491
OCPBUGS-104561: test: exclude NTO debug pods from best-effort QoS invariant #31472
OCPBUGS-105876: tolerate brief olm Available=False during upgrades #31518
NO-JIRA: Remove exception OCPBUGS-66225 #31471
NO-JIRA: Remove exception OCPBUGS-86009 #31470
OCPCLOUD-3420: Remove exceptions OCPBUGS-42837 and OCPBUGS-64852 #31469
MON-4471: test/extended/prometheus: move alert tests to “Test Framework” #30703
OCPBUGS-106190: Make oc rsh test resilient #31515
TRT-2898: Fix leaked ClusterRoleBinding in pull_secrets test #31514
And 6 elided commits (e.g. from squash or rebase merges)
Full changelog

thanos

OCPBUGS-136049: Bump github.com/klauspost/compress to fix CVE-2026-116591 #234
NO-JIRA: [bot] Bump openshift/thanos to v0.42.5 #233
OCPBUGS-129064: Bump github.com/klauspost/compress to fix CVE-2026-63209 #227
NO-JIRA: synchronize OWNERS from cluster-monitoring-operator #215
Bump openshift/thanos to v0.42.4 #203
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #206
OCPBUGS-120744: bump go.opentelemetry.io/otel to fix CVE-2026-41178 #204
Full changelog

volume-data-source-validator

STOR-3071: Rebase to v1.8.0 for OCP 5.1 #22
NO-JIRA: Add coderabbit config #23
OCPBUGS-127004: Bump golang.org/x/net to version 0.57.0 that fixes CVE-2026-33814 #17
Full changelog

vsphere-cloud-controller-manager

OCPCLOUD-3680: Merge https://github.com/kubernetes/cloud-provider-vsphere/tree/master (cd8a5b0) into main #130
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-133521: Bump manifests-gen and regenerate to remove rules from aggregate ClusterRoles #133
NO-JIRA: Move JoelSpeed to advisory_approvers #131
OCPCLOUD-3691: Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.17.0 (2509b8e) into main #116
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #117
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-130434: Bump golang.org/x/crypto to fix CVE-2026-56855 #219
OCPBUGS-132044: Fix build without boringcrypto #229
STOR-3083: Rebase v3.7.3 #214
OCPBUGS-114428: Bump google.golang.org/protobuf to v1.36.12 #200
OCPBUGS-122179: Fix credential exposure in logs (CWE-532) #199
OCPBUGS-114884: UPSTREAM: 4272: Fix crash in syncer when node can’t be found #201
Full changelog

vsphere-csi-driver-operator

STOR-3176: Support TLS Groups in operators for kube-rbac-proxy sidecar #373
STOR-3068: Bump all libraries #370
OCPBUGS-127462: Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile #367
OCPBUGS-113538: Enable SELinuxMount tests #362
Full changelog

vsphere-problem-detector

OCPBUGS-130729: Skip node checks for non-vSphere nodes #247
STOR-3068: Bump all libraries #249
Full changelog

Node Image Info

Loading node image info, this may take a while ...

CentOS Stream CoreOS 10 (`stream-coreos`)

Package List

cri-o-1.37.2-1.el10s
kernel-6.12.0-281.el10
openshift-kubelet-5.1.0-202611110714.p2.g90b87c7.assembly.stream.el10
systemd-257-35.el10

Full list (521 packages)

NetworkManager-1:1.58.0-1.el10
NetworkManager-cloud-setup-1:1.58.0-1.el10
NetworkManager-libnm-1:1.58.0-1.el10
NetworkManager-ovs-1:1.58.0-1.el10
NetworkManager-tui-1:1.58.0-1.el10
WALinuxAgent-udev-2.14.0.1-3.el10
aardvark-dns-4:2.1.0-1.el10
acl-2.4.0-2.el10
afterburn-5.11.0-1.el10
afterburn-dracut-5.11.0-1.el10
alternatives-1.30-2.el10
amd-gpu-firmware-20260812-27.el10
amd-ucode-firmware-20260812-27.el10
attr-2.6.0-2.el10
audit-4.2.1-3.el10
audit-libs-4.2.1-3.el10
audit-rules-4.2.1-3.el10
authselect-1.5.3-1.el10
authselect-libs-1.5.3-1.el10
azure-vm-utils-0.7.0-1.el10
basesystem-11-22.el10
bash-5.2.26-6.el10
bash-completion-1:2.11-16.el10
bind-libs-32:9.18.33-31.el10
bind-license-32:9.18.33-31.el10
bind-utils-32:9.18.33-31.el10
bootc-1.17.1-1.el10
bootupd-0.2.35-2.el10
bsdtar-3.7.7-11.el10
bubblewrap-0.10.0-3.el10
bzip2-1.0.8-25.el10
bzip2-libs-1.0.8-25.el10
c-ares-1.34.9-1.el10
ca-certificates-2026.2.92_v9.0.319-100.3.el10
catatonit-5:0.2.1-4.el10
centos-gpg-keys-10.0-23.el10
centos-release-cloud-1-1.el10s
centos-release-nfv-common-1-5.el10s
centos-release-virt-common-1-1.el10s
centos-stream-release-10.0-23.el10
centos-stream-repos-10.0-23.el10
checkpolicy-3.11-2.el10
chrony-4.9-1.el10
cifs-utils-7.9-1.el10
clevis-23-2.el10
clevis-dracut-23-2.el10
clevis-luks-23-2.el10
clevis-pin-tpm2-0.5.5-1.el10
clevis-systemd-23-2.el10
cloud-utils-growpart-0.33-11.el10
composefs-1.0.8-1.el10
composefs-libs-1.0.8-1.el10
conmon-3:2.2.1-4.el10
conmon-rs-0.6.6-2.el10s
console-login-helper-messages-0.21.3-10.el10
console-login-helper-messages-issuegen-0.21.3-10.el10
console-login-helper-messages-profile-0.21.3-10.el10
container-selinux-4:2.250.0-1.el10
containers-common-6:6.0-3.el10
containers-common-extra-6:6.0-3.el10
coreos-installer-0.27.0-2.el10
coreos-installer-bootinfra-0.27.0-2.el10
coreutils-9.5-14.el10
coreutils-common-9.5-14.el10
cpio-2.15-3.el10
cracklib-2.9.11-8.el10
cracklib-dicts-2.9.11-8.el10
cri-o-1.37.2-1.el10s
cri-tools-1.37.0-1.el10s
criu-4.2-9.el10
criu-libs-4.2-9.el10
crun-1.30.1-1.el10
crypto-policies-20260811-1.git4dcd294.el10
crypto-policies-scripts-20260811-1.git4dcd294.el10
cryptsetup-2.8.6-2.el10
cryptsetup-libs-2.8.6-2.el10
curl-8.12.1-9.el10
cyrus-sasl-gssapi-2.1.28-27.el10
cyrus-sasl-lib-2.1.28-27.el10
dbus-1:1.14.10-6.el10
dbus-broker-36-5.el10
dbus-common-1:1.14.10-6.el10
dbus-libs-1:1.14.10-6.el10
dbus-tools-1:1.14.10-6.el10
device-mapper-10:1.02.217-1.el10
device-mapper-event-10:1.02.217-1.el10
device-mapper-event-libs-10:1.02.217-1.el10
device-mapper-libs-10:1.02.217-1.el10
device-mapper-multipath-0.9.9-20.el10
device-mapper-multipath-libs-0.9.9-20.el10
device-mapper-persistent-data-1.3.4-1.el10
diffutils-3.10-8.el10
dmidecode-1:3.6-5.el10
dnf-4.20.0-29.el10
dnf-data-4.20.0-29.el10
dnsmasq-2.90-8.el10
dosfstools-4.2-12.el10
dracut-107-11.el10
dracut-network-107-11.el10
dracut-squash-107-11.el10
duktape-2.7.0-10.el10
e2fsprogs-1.47.1-5.el10
e2fsprogs-libs-1.47.1-5.el10
efi-filesystem-6-8.el10
efibootmgr-18-9.el10
efivar-libs-39-3.el10
elfutils-default-yama-scope-0.197-1.el10
elfutils-libelf-0.197-1.el10
elfutils-libs-0.197-1.el10
erofs-utils-1.8.10-1.el10
ethtool-2:7.2-1.el10
expat-2.7.3-4.el10
fcoe-utils-1.0.34-11.gitb233050.el10
file-5.45-12.el10
file-libs-5.45-12.el10
filesystem-3.18-17.el10
findutils-1:4.10.0-5.el10
firewalld-filesystem-2.4.3-4.el10
flatpak-session-helper-1.18.0-2.el10
fstrm-0.6.1-12.el10
fuse-common-3.16.2-5.el10
fuse-libs-2.9.9-25.el10
fuse3-3.16.2-5.el10
fuse3-libs-3.16.2-5.el10
fwupd-2.1.6-1.el10
gawk-5.3.0-7.el10
gdbm-1:1.26-15.el10
gdbm-libs-1:1.26-15.el10
gettext-envsubst-0.22.5-6.el10
gettext-libs-0.22.5-6.el10
gettext-runtime-0.22.5-6.el10
git-core-2.52.0-1.el10
glib2-2.80.4-22.el10
glibc-2.39-148.el10
glibc-common-2.39-148.el10
glibc-gconv-extra-2.39-148.el10
glibc-minimal-langpack-2.39-148.el10
gmp-1:6.2.1-12.el10
gnupg2-2.4.5-5.el10
gnutls-3.8.10-5.el10
gobject-introspection-1.79.1-7.el10
gpgme-1.23.2-6.el10
grep-3.11-10.el10
grub2-common-1:2.12-58.el10
grub2-efi-x64-1:2.12-58.el10
grub2-pc-1:2.12-58.el10
grub2-pc-modules-1:2.12-58.el10
grub2-tools-1:2.12-58.el10
grub2-tools-minimal-1:2.12-58.el10
gssproxy-0.9.2-10.el10
gzip-1.13-4.el10
hostname-3.23-14.el10
hwdata-0.379-10.10.el10
ignition-2.28.0-1.el10
ignition-grub-2.28.0-1.el10
ima-evm-utils-1.6.2-6.el10
info-7.1-6.el10
inih-58-3.el10
intel-gpu-firmware-20260812-27.el10
ipcalc-1.0.3-12.el10
iproute-7.0.0-2.el10
iproute-tc-7.0.0-2.el10
iptables-libs-1.8.11-16.el10
iptables-nft-1.8.11-16.el10
iputils-20240905-5.el10
irqbalance-2:1.9.4-7.el10
iscsi-initiator-utils-6.2.1.11-4.git4b3e853.el10
iscsi-initiator-utils-iscsiuio-6.2.1.11-4.git4b3e853.el10
isns-utils-libs-0.103-2.el10
jansson-2.14-3.el10
jose-14-102.el10
jq-1.7.1-13.el10
json-c-0.18-3.el10
json-glib-1.8.0-5.el10
kbd-2.6.4-8.el10
kbd-legacy-2.6.4-8.el10
kbd-misc-2.6.4-8.el10
kdump-utils-1.0.61-2.el10
kernel-6.12.0-281.el10
kernel-core-6.12.0-281.el10
kernel-modules-6.12.0-281.el10
kernel-modules-core-6.12.0-281.el10
kernel-modules-extra-6.12.0-281.el10
kexec-tools-2.0.32-3.el10
keyutils-1.6.3-5.el10
keyutils-libs-1.6.3-5.el10
kmod-31-14.el10
kmod-libs-31-14.el10
kpartx-0.9.9-20.el10
krb5-libs-1.21.3-11.el10
less-661-3.el10
libacl-2.4.0-2.el10
libaio-0.3.112-1.el10
libarchive-3.7.7-11.el10
libassuan-2.5.6-6.el10
libatasmart-0.19-30.el10
libattr-2.6.0-2.el10
libbasicobjects-0.1.1-58.el10
libblkid-2.40.2-23.el10
libblockdev-3.4.0-3.el10
libblockdev-crypto-3.4.0-3.el10
libblockdev-fs-3.4.0-3.el10
libblockdev-loop-3.4.0-3.el10
libblockdev-mdraid-3.4.0-3.el10
libblockdev-nvme-3.4.0-3.el10
libblockdev-part-3.4.0-3.el10
libblockdev-smart-3.4.0-3.el10
libblockdev-swap-3.4.0-3.el10
libblockdev-utils-3.4.0-3.el10
libbpf-2:1.7.0-2.el10
libbrotli-1.1.0-9.el10
libbytesize-2.10-5.el10
libcap-2.69-7.el10
libcap-ng-0.9.3-2.el10
libcbor-0.11.0-3.el10
libcollection-0.7.0-58.el10
libcom_err-1.47.1-5.el10
libcomps-0.1.21-3.el10
libconfig-1.7.3-10.el10
libcurl-8.12.1-9.el10
libdhash-0.5.0-58.el10
libdnf-0.73.1-17.el10
libdnf-plugin-subscription-manager-1.30.16-1.el10
libdrm-2.4.128-1.el10
libeconf-0.6.2-4.el10
libedit-3.1-52.20230828cvs.el10
libev-4.33-15.el10
libevent-2.1.13-1.el10
libfdisk-2.40.2-23.el10
libffi-3.4.4-10.el10
libfido2-1.14.0-7.el10
libgcc-14.4.1-4.el10
libgcrypt-1.11.0-7.el10
libgomp-14.4.1-4.el10
libgpg-error-1.50-2.el10
libgudev-238-7.el10
libibverbs-62.0-3.el10
libicu-74.2-5.el10
libidn2-2.3.7-3.el10
libini_config-1.3.1-58.el10
libipa_hbac-2.13.1-3.el10
libjcat-0.2.2-2.el10
libjose-14-102.el10
libkcapi-1.5.1-1.el10
libkcapi-hasher-1.5.1-1.el10
libkcapi-hmaccalc-1.5.1-1.el10
libksba-1.6.7-2.el10
libldb-4.24.5-101.el10
libluksmeta-10-1.el10
libmaxminddb-1.9.1-4.el10
libmicrohttpd-1:1.0.0-3.el10
libmnl-1.0.5-7.el10
libmodulemd-2.15.0-12.el10
libmount-2.40.2-23.el10
libmspack-0.10.1-0.14.alpha.el10
libndp-1.9-2.el10
libnet-1.3-7.el10
libnetfilter_conntrack-1.0.9-12.el10
libnfnetlink-1.0.2-3.el10
libnfsidmap-1:2.8.3-10.el10
libnftnl-1.3.0-3.el10
libnghttp2-1.68.0-6.el10
libnl3-3.11.0-1.el10
libnvme-1.16.2-1.el10
libpath_utils-0.2.1-58.el10
libpcap-14:1.10.4-8.el10
libpciaccess-0.16-16.el10
libpkgconf-2.1.0-3.el10
libpsl-0.21.5-6.el10
libpwquality-1.4.5-13.el10
libref_array-0.1.5-58.el10
librepo-1.19.0-1.el10
libseccomp-2.5.6-1.el10
libselinux-3.11-3.el10
libselinux-utils-3.11-3.el10
libsemanage-3.11-3.el10
libsepol-3.11-2.el10
libsmartcols-2.40.2-23.el10
libsmbclient-4.24.5-101.el10
libsolv-0.7.33-7.el10
libss-1.47.1-5.el10
libssh-0.12.2-2.el10
libssh-config-0.12.2-2.el10
libsss_certmap-2.13.1-3.el10
libsss_idmap-2.13.1-3.el10
libsss_nss_idmap-2.13.1-3.el10
libsss_sudo-2.13.1-3.el10
libstdc++-14.4.1-4.el10
libtalloc-2.4.4-100.el10
libtasn1-4.20.0-5.el10
libtdb-1.4.15-100.el10
libtevent-0.17.1-100.el10
libtirpc-1.3.5-2.el10
libtool-ltdl-2.4.7-14.el10
libudisks2-2.11.1-2.el10
libunistring-1.1-10.el10
liburing-2.12-1.el10
libusb1-1.0.30-1.el10
libutempter-1.2.1-15.el10
libuuid-2.40.2-23.el10
libuv-1:1.52.1-1.el10
libverto-0.3.2-10.el10
libverto-libev-0.3.2-10.el10
libwbclient-4.24.5-101.el10
libxcrypt-4.4.36-10.el10
libxml2-2.12.5-15.el10
libxmlb-0.3.28-1.el10
libxslt-1.1.39-10.el10
libyaml-0.2.5-16.el10
libzstd-1.5.5-9.el10
linux-firmware-20260812-27.el10
linux-firmware-whence-20260812-27.el10
lldpad-1.1.1-4.gitf1dd9eb.el10
lmdb-libs-0.9.32-4.el10
logrotate-3.22.0-5.el10
lsof-4.98.0-7.el10
lua-libs-5.4.8-1.el10
luksmeta-10-1.el10
lvm2-10:2.03.43-1.el10
lvm2-libs-10:2.03.43-1.el10
lz4-libs-1.9.4-8.el10
lzo-2.10-14.el10
makedumpfile-1.7.8-2.el10
mdadm-4.6-2.el10
microcode_ctl-4:20260812-1.el10
mokutil-2:0.7.2-8.el10
mpdecimal-2.5.1-12.el10
mpfr-4.2.1-8.el10
nano-8.1-3.el10
ncurses-base-6.4-15.20240127.el10
ncurses-libs-6.4-15.20240127.el10
net-tools-2.0-0.73.20160912git.el10
netavark-4:2.1.0-1.el10
nettle-3.10.1-1.el10
newt-0.52.24-5.el10
nfs-utils-1:2.8.3-10.el10
nftables-1:1.1.5-6.el10
nmap-ncat-4:7.92-5.el10
nmstate-2.2.62-4.el10
npth-1.6-21.el10
nspr-4.39.0-5.el10
nss-3.124.0-5.el10
nss-altfiles-2.23.0-6.el10
nss-softokn-3.124.0-5.el10
nss-softokn-freebl-3.124.0-5.el10
nss-sysinit-3.124.0-5.el10
nss-util-3.124.0-5.el10
numactl-2.0.19-3.el10
numactl-libs-2.0.19-3.el10
numad-0.5-50.20251104git.el10
nvidia-gpu-firmware-20260812-27.el10
nvme-cli-2.16-3.el10
oniguruma-6.9.9-7.el10
open-vm-tools-13.1.0-1.el10
openldap-2.6.13-1.el10
openshift-clients-5.1.0-202611132012.p2.ge9d9390.assembly.stream.el10
openshift-kubelet-5.1.0-202611110714.p2.g90b87c7.assembly.stream.el10
openssh-9.9p1-34.el10
openssh-clients-9.9p1-34.el10
openssh-server-9.9p1-34.el10
openssl-1:3.5.9-1.el10
openssl-fips-provider-1:3.5.9-1.el10
openssl-libs-1:3.5.9-1.el10
openvswitch-selinux-extra-policy-1.0-36.el10s
openvswitch3.5-3.5.3-5.el10s
os-prober-1.81-9.el10
ose-aws-ecr-image-credential-provider-5.1.0-202610201708.p2.g6951d70.assembly.stream.el10
ose-azure-acr-image-credential-provider-5.1.0-202610260236.p2.gc66a908.assembly.stream.el10
ose-crio-credential-provider-5.1.0-202610051813.p2.g83d4961.assembly.stream.el10
ose-gcp-gcr-image-credential-provider-5.1.0-202611040658.p2.g3e67bea.assembly.stream.el10
ostree-2026.4-1.el10
ostree-grub2-2026.4-1.el10
ostree-libs-2026.4-1.el10
p11-kit-0.26.4-1.el10
p11-kit-trust-0.26.4-1.el10
pam-1.6.1-11.el10
pam-libs-1.6.1-11.el10
passt-0^20260728.gf8df3f1-1.el10
passt-selinux-0^20260728.gf8df3f1-1.el10
pciutils-3.13.0-6.el10
pciutils-libs-3.13.0-6.el10
pcre2-10.44-1.4.el10
pcre2-syntax-10.44-1.4.el10
pkgconf-2.1.0-3.el10
pkgconf-m4-2.1.0-3.el10
pkgconf-pkg-config-2.1.0-3.el10
podman-7:6.1.0-3.el10
podman-sequoia-0.4.0~pqc.3-1.el10
policycoreutils-3.11-1.el10
policycoreutils-python-utils-3.11-1.el10
polkit-125-6.el10
polkit-libs-125-6.el10
popt-1.19-9.el10
procps-ng-4.0.4-13.el10
protobuf-c-1.5.0-6.el10
psmisc-23.6-8.el10
publicsuffix-list-dafsa-20240107-5.el10
python3-3.12.15-1.el10
python3-audit-4.2.1-3.el10
python3-charset-normalizer-3.4.2-1.el10
python3-cloud-what-1.30.16-1.el10
python3-dateutil-1:2.9.0.post0-1.el10
python3-dbus-1.3.2-8.el10
python3-decorator-5.1.1-12.el10
python3-distro-1.9.0-5.el10
python3-dnf-4.20.0-29.el10
python3-dnf-plugin-versionlock-4.7.0-12.el10
python3-dnf-plugins-core-4.7.0-12.el10
python3-file-magic-5.45-12.el10
python3-gobject-base-3.46.0-7.el10
python3-gobject-base-noarch-3.46.0-7.el10
python3-hawkey-0.73.1-17.el10
python3-idna-3.7-6.el10
python3-iniparse-0.5.3-1.el10
python3-inotify-0.9.6-36.el10
python3-libcomps-0.1.21-3.el10
python3-libdnf-0.73.1-17.el10
python3-librepo-1.19.0-1.el10
python3-libs-3.12.15-1.el10
python3-libselinux-3.11-3.el10
python3-libsemanage-3.11-3.el10
python3-packaging-24.2-2.el10
python3-pexpect-4.9.0-6.el10
python3-pip-wheel-23.3.2-11.el10
python3-policycoreutils-3.11-1.el10
python3-ptyprocess-0.7.0-9.el10
python3-pyyaml-6.0.1-19.el10
python3-requests-2.32.4-1.el10
python3-rpm-4.19.1.1-28.el10
python3-setools-4.7.1-1.1.el10
python3-setuptools-69.0.3-12.el10
python3-six-1.16.0-16.el10
python3-subscription-manager-rhsm-1.30.16-1.el10
python3-systemd-235-11.el10
python3-urllib3-1.26.19-4.el10
qemu-guest-agent-18:11.1.0-3.el10
quota-1:4.09-10.el10
quota-nls-1:4.09-10.el10
rdma-core-62.0-3.el10
readline-8.2-11.el10
rpcbind-1.2.9-2.el10
rpm-4.19.1.1-28.el10
rpm-build-libs-4.19.1.1-28.el10
rpm-libs-4.19.1.1-28.el10
rpm-ostree-2026.3-2.el10
rpm-ostree-libs-2026.3-2.el10
rpm-plugin-audit-4.19.1.1-28.el10
rpm-plugin-selinux-4.19.1.1-28.el10
rpm-plugin-syslog-4.19.1.1-28.el10
rpm-sequoia-1.10.2.3-1.el10
rpm-sign-libs-4.19.1.1-28.el10
rsync-3.5.0-1.el10
samba-client-libs-4.24.5-101.el10
samba-common-4.24.5-101.el10
samba-core-libs-4.24.5-101.el10
samba-ndr-libs-4.24.5-101.el10
sed-4.9-5.el10
selinux-policy-42.1.28-1.el10
selinux-policy-targeted-42.1.28-1.el10
sequoia-sq-1.4.0.2-3.el10
setup-2.14.5-7.el10
sg3_utils-1.48-11.el10
sg3_utils-libs-1.48-11.el10
shadow-utils-2:4.15.0-13.el10
shadow-utils-subid-2:4.15.0-13.el10
shared-mime-info-2.3-8.el10
shim-x64-16.1-1.el10
skopeo-3:1.24.0-3.el10
slang-2.3.3-8.el10
snappy-1.1.10-7.el10
socat-1.7.4.4-10.el10
sos-4.11.2-8.el10
sqlite-libs-3.46.1-6.el10
ssh-key-dir-0.1.4-9.el10
sssd-2.13.1-3.el10
sssd-ad-2.13.1-3.el10
sssd-client-2.13.1-3.el10
sssd-common-2.13.1-3.el10
sssd-common-pac-2.13.1-3.el10
sssd-ipa-2.13.1-3.el10
sssd-krb5-2.13.1-3.el10
sssd-krb5-common-2.13.1-3.el10
sssd-ldap-2.13.1-3.el10
sssd-nfs-idmap-2.13.1-3.el10
sssd-proxy-2.13.1-3.el10
stalld-1.26.3-1.el10
strace-6.12-3.el10
subscription-manager-1.30.16-1.el10
subscription-manager-rhsm-certificates-20220623-6.el10
sudo-1.9.17-13.p2.el10
systemd-257-35.el10
systemd-journal-remote-257-35.el10
systemd-libs-257-35.el10
systemd-pam-257-35.el10
systemd-udev-257-35.el10
tar-2:1.35-13.el10
tmux-3.3a-14.20230918gitb202a2f.el10
toolbox-0.3-3.el10
tpm2-tools-5.7-6.el10
tpm2-tss-4.1.3-6.el10
tpm2-tss-fapi-4.1.3-6.el10
tzdata-2026f-1.el10
udisks2-2.11.1-2.el10
unbound-anchor-1.26.1-2.el10
unbound-libs-1.26.1-2.el10
userspace-rcu-0.14.0-7.el10
util-linux-2.40.2-23.el10
util-linux-core-2.40.2-23.el10
vim-data-2:9.1.083-25.el10
vim-minimal-2:9.1.083-25.el10
virt-what-1.27-3.el10
volume_key-libs-0.3.12-27.el10
which-2.21-44.el10
xfsprogs-6.16.0-1.el10
xmlsec1-1:1.2.39-3.el10
xmlsec1-openssl-1:1.2.39-3.el10
xz-1:5.6.2-5.el10
xz-libs-1:5.6.2-5.el10
zlib-ng-compat-2.2.3-3.el10
zram-generator-1.1.2-14.el10
zstd-1.5.5-9.el10

Changed:

cri-o 1.36.4-1.el10s → 1.37.2-1.el10s
cri-tools 1.36.0-1.el10s → 1.37.0-1.el10s
openshift-clients 5.0.0-202611101007.p2.g6b40d97.assembly.stream.el10 → 5.1.0-202611132012.p2.ge9d9390.assembly.stream.el10
openshift-kubelet 5.0.0-202611100601.p2.g4608138.assembly.stream.el10 → 5.1.0-202611110714.p2.g90b87c7.assembly.stream.el10
ose-aws-ecr-image-credential-provider 5.0.0-202610221550.p2.g278e8c0.assembly.stream.el10 → 5.1.0-202610201708.p2.g6951d70.assembly.stream.el10
ose-azure-acr-image-credential-provider 5.0.0-202610221550.p2.g95f0a12.assembly.stream.el10 → 5.1.0-202610260236.p2.gc66a908.assembly.stream.el10
ose-crio-credential-provider 5.0.0-202610221550.p2.g83d4961.assembly.stream.el10 → 5.1.0-202610051813.p2.g83d4961.assembly.stream.el10
ose-gcp-gcr-image-credential-provider 5.0.0-202610221550.p2.g51c3264.assembly.stream.el10 → 5.1.0-202611040658.p2.g3e67bea.assembly.stream.el10

Extensions

Full list (108 packages)

NetworkManager-libreswan-1.2.31-1.el10.x86_64
binutils-2.41-66.el10.x86_64
binutils-gold-2.41-66.el10.x86_64
bison-3.8.2-9.el10.x86_64
cmake-filesystem-3.31.8-1.el10.x86_64
cpp-14.4.1-4.el10.x86_64
elfutils-debuginfod-client-0.197-1.el10.x86_64
elfutils-libelf-devel-0.197-1.el10.x86_64
flex-2.6.4-19.el10.x86_64
gcc-14.4.1-4.el10.x86_64
glibc-devel-2.39-148.el10.x86_64
groff-base-1.23.0-10.el10.x86_64
kernel-6.12.0-281.el10.x86_64
kernel-core-6.12.0-281.el10.x86_64
kernel-devel-6.12.0-281.el10.x86_64
kernel-headers-6.12.0-281.el10.x86_64
kernel-modules-6.12.0-281.el10.x86_64
kernel-modules-core-6.12.0-281.el10.x86_64
kernel-modules-extra-6.12.0-281.el10.x86_64
kernel-rt-core-6.12.0-281.el10.x86_64
kernel-rt-devel-6.12.0-281.el10.x86_64
kernel-rt-modules-6.12.0-281.el10.x86_64
kernel-rt-modules-core-6.12.0-281.el10.x86_64
kernel-rt-modules-extra-6.12.0-281.el10.x86_64
krb5-pkinit-1.21.3-11.el10.x86_64
krb5-workstation-1.21.3-11.el10.x86_64
ldns-1.8.3-19.el10.x86_64
libkadm5-1.21.3-11.el10.x86_64
libmpc-1.3.1-7.el10.x86_64
libqb-2.0.8-6.el10.x86_64
libreswan-5.4.1-1.el10.x86_64
libreswan-minimal-5.4.1-1.el10.x86_64
libxcrypt-devel-4.4.36-10.el10.x86_64
libzstd-devel-1.5.5-9.el10.x86_64
lm_sensors-libs-3.6.0-20.el10.x86_64
m4-1.4.19-11.el10.x86_64
make-1:4.4.1-9.el10.x86_64
ncurses-6.4-15.20240127.el10.x86_64
nss-tools-3.124.0-5.el10.x86_64
openssl-devel-1:3.5.9-1.el10.x86_64
openvswitch3.5-ipsec-3.5.3-5.el10s.x86_64
pcp-conf-7.1.5-6.el10.x86_64
pcp-libs-7.1.5-6.el10.x86_64
perl-AutoLoader-5.74-515.el10.noarch
perl-B-1.89-515.el10.x86_64
perl-Carp-1.54-511.el10.noarch
perl-Class-Struct-0.68-515.el10.noarch
perl-Data-Dumper-2.189-512.el10.x86_64
perl-Digest-1.20-511.el10.noarch
perl-Digest-MD5-2.59-6.el10.x86_64
perl-DynaLoader-1.56-515.el10.x86_64
perl-Encode-4:3.21-511.el10.x86_64
perl-Errno-1.38-515.el10.x86_64
perl-Exporter-5.78-511.el10.noarch
perl-Fcntl-1.18-515.el10.x86_64
perl-File-Basename-2.86-515.el10.noarch
perl-File-Path-2.18-512.el10.noarch
perl-File-Temp-1:0.231.100-512.el10.noarch
perl-File-stat-1.14-515.el10.noarch
perl-FileHandle-2.05-515.el10.noarch
perl-Getopt-Long-1:2.58-3.el10.noarch
perl-Getopt-Std-1.14-515.el10.noarch
perl-HTTP-Tiny-0.088-512.el10.noarch
perl-IO-1.55-515.el10.x86_64
perl-IO-Socket-IP-0.42-512.el10.noarch
perl-IO-Socket-SSL-2.085-3.el10.noarch
perl-IPC-Open3-1.22-515.el10.noarch
perl-MIME-Base64-3.16-511.el10.x86_64
perl-Mozilla-CA-20231213-5.el10.noarch
perl-NDBM_File-1.17-515.el10.x86_64
perl-Net-SSLeay-1.94-9.el10.x86_64
perl-POSIX-2.20-515.el10.x86_64
perl-PathTools-3.91-512.el10.x86_64
perl-Pod-Escapes-1:1.07-511.el10.noarch
perl-Pod-Perldoc-3.28.01-512.el10.noarch
perl-Pod-Simple-1:3.45-511.el10.noarch
perl-Pod-Usage-4:2.03-511.el10.noarch
perl-Scalar-List-Utils-5:1.63-511.el10.x86_64
perl-SelectSaver-1.02-515.el10.noarch
perl-Socket-4:2.038-511.el10.x86_64
perl-Storable-1:3.32-511.el10.x86_64
perl-Symbol-1.09-515.el10.noarch
perl-Term-ANSIColor-5.01-512.el10.noarch
perl-Term-Cap-1.18-511.el10.noarch
perl-Text-ParseWords-3.31-511.el10.noarch
perl-Text-Tabs+Wrap-2024.001-511.el10.noarch
perl-Time-Local-2:1.350-511.el10.noarch
perl-URI-5.27-4.el10.noarch
perl-Unicode-Normalize-1.32-511.el10.x86_64
perl-base-2.27-515.el10.noarch
perl-constant-1.33-512.el10.noarch
perl-if-0.61.000-515.el10.noarch
perl-interpreter-4:5.40.2-515.el10.x86_64
perl-libnet-3.15-512.el10.noarch
perl-libs-4:5.40.2-515.el10.x86_64
perl-locale-1.12-515.el10.noarch
perl-mro-1.29-515.el10.x86_64
perl-overload-1.37-515.el10.noarch
perl-overloading-0.02-515.el10.noarch
perl-parent-1:0.241-512.el10.noarch
perl-podlators-1:5.01-511.el10.noarch
perl-vars-1.05-515.el10.noarch
protobuf-3.19.6-15.el10.x86_64
python3-openvswitch3.5-3.5.3-5.el10s.x86_64
sysstat-12.7.6-4.el10.x86_64
usbguard-1.1.4-2.el10.x86_64
usbguard-selinux-1.1.4-2.el10.noarch
zlib-ng-compat-devel-2.2.3-3.el10.x86_64

CentOS Stream CoreOS base layer: 10 10.0.20261110-0

OCPBUGS-126621: Select bundled CoreOS base layer: version when COREOS_VERSION is unset #116

OKD-429: Fix OKD/SCOS builds to use centos CoreOS base layer: streams #109

View changelog in Markdown or change previous release:

Source code for this page located on github