4.22.0-0.okd-scos-2026-08-22-092248

Download installer and client with:

oc adm release extract --tools quay-proxy.ci.openshift.org/openshift/ci:rc_payload__4.22.0-0.okd-scos-2026-08-22-092248

Qualifiers (status api): None

Tests:

Blocking jobs
- aws Succeeded periodic-ci-openshift-release-main-okd-scos-4.22-e2e-aws-ovn
Informing jobs
- aws-upgrade Failed periodic-ci-openshift-release-main-okd-scos-4.22-e2e-aws-ovn-upgrade
- aws-upgrade-minor Succeeded periodic-ci-openshift-release-main-okd-scos-4.22-upgrade-from-okd-scos-4.21-e2e-aws-ovn-upgrade
Async jobs
- claude-payload-agent Succeeded periodic-ci-openshift-release-main-claude-payload-agent-okd-scos-no-slack

Upgrades from:

Upgrades to:

Changes from 4.22.0-0.okd-scos-2026-08-19-092248

Created: 2026-08-22 09:32:31 +0000 UTC

Image Digest: sha256:d9c798167364d4476dbd1fee8b7d70a4e2379ae83d06e2a15728757b9f7db8e9

Components

Kubectl 1.35.2
Kubernetes upgraded from 1.35.3 to 1.35.6
Kubernetes Tests 1.35.1
CentOS Stream CoreOS 10 upgraded from 10.0.20260729-0 to 10.0.20260819-0

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	OKD Hypershift	OKD SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
AuthenticationComponentProxy (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
IngressControllerMultipleHAProxyVersions (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
KarpenterOperator (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
MachineAPIMigrationAzure (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
MachineAPIMigrationBareMetal (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
MachineAPIMigrationGCP (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
MachineAPIMigrationPowerVS (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
MutableTopology (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
NetworkObservabilityInstall (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
OLMLifecycleAndCompatibility (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
SELinuxMountGAReadiness (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
TLSGroupPreferences (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
AWSClusterHostedDNSInstall (0 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled
MutatingAdmissionPolicy (0 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled
OpenShiftPodSecurityAdmission (0 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled
VSphereMixedNodeEnv (0 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled
AWSServiceLBNetworkSecurityGroup (0 tests)	Disabled (Changed)	Enabled	Enabled	Enabled	Disabled (Changed)	Enabled	Enabled	Enabled
NoRegistryClusterInstall (0 tests)	Disabled	Enabled (Changed)	Disabled	Enabled	Disabled	Enabled (Changed)	Disabled	Enabled
OSStreams (0 tests)	Disabled	Disabled (Changed)	Enabled	Enabled	Disabled	Disabled (Changed)	Enabled	Enabled
ConsolePluginContentSecurityPolicy (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
UserNamespacesPodSecurityStandards (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
UserNamespacesSupport (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ExternalOIDCExternalClaimsSourcing (0 tests)	Disabled	Disabled	Enabled	Enabled	Disabled	Disabled	Disabled (Changed)	Disabled (Changed)
ExternalSnapshotMetadata (0 tests)	Disabled	Disabled	Enabled	Enabled	Disabled	Disabled	Disabled (Changed)	Disabled (Changed)
VSphereMultiVCenterDay2 (0 tests)	Disabled	Disabled	Enabled	Enabled	Disabled	Disabled	Disabled (Changed)	Disabled (Changed)
DRAPartitionableDevices (0 tests)			Enabled (New)	Enabled (New)			Enabled (New)	Enabled (New)
KMSEncryptionProvider (0 tests)			Enabled (New)	Enabled (New)

New images

oc-mirror git 88debf38 sha256:1b9fa80f262bc98ee1cd892fc7edb717a17b57bbea3a6d4682d51297a0d7390f

Rebuilt images without code change

kube-rbac-proxy git d12e2746 sha256:db67c8ce9b732192d322d401d70e471da138046cad8ecd72f1ce37f7cc29da02
kube-storage-version-migrator git 72835e43 sha256:27f6733239e8d66723049dcf251ea495d51f43431feaa6c47f17f8ae66e593ae
multus-cni git b4ec7d82 sha256:a2d5f56c1ded655e4b7a9b4f435d38ce4997deffb1384146eb965f331591cc3f
multus-cni-microshift git b4ec7d82 sha256:7c38f13bddc61198e018ee8b2178b89cd5d1c25248ff3843558825f0eda17285
multus-route-override-cni git 08af4127 sha256:a7fc45d496a2fb74660f3f7398fea4791c09c3de15831f002bf33b4b8a599103
multus-whereabouts-ipam-cni git d691040e sha256:f183e51544c39826a703f33b154f82b92c658036b0c69d33a6c7144cd812635a
network-metrics-daemon git 5b233ea1 sha256:09812c1d11f931120e7748c3bb5de32b6f627f207c4418cfb3e0716cef4b0da1
powervs-machine-controllers git e88cf81d sha256:59b3d3bbae0a1539ef9fce75da2467a3dd153480f785775210f02926580c8979

agent-installer-api-server

OCPBUGS-104521: manifest_generator add a label to LUKS root #10755
AGENT-1559: Remove LSO and LVMS as CNV operator dependencies #10666
OCPBUGS-98693: PATCH /v2/clusters/{id} does not return updated operator_bundles #10608
OCPBUGS-93786: Simplify IRI api dependency #10539
OCPBUGS-92056: Stop setting DevPreviewNoUpgrade for TNF clusters #10516
OCPBUGS-90638: Add sourcedir /run/chrony-dhcp to generated chrony.conf #10488
OCPBUGS-83542: Mark raw FC/iSCSI multipath members as ineligible #10150
OCPBUGS-83511: Fix IRI patcher feature check #10147
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-96592: Bump golang.org/x/net to v0.55.0 #2250
OCPBUGS-104498: Wait for all nodes to join before exiting for ABI #2245
OCPBUGS-69953: Updating ose-agent-installer-csr-approver-container image to be consistent with ART for 4.22 #1406
Full changelog

agent-installer-node-agent

OCPBUGS-84392: Bump go-jose in v4.22 #1488
OCPBUGS-84129: add –copy-network when manual network config is detected #1416
Full changelog

agent-installer-ui

OCPBUGS-104483: Pin minimatch to ^10.2.6 and brace-expansion to ^5.0.9 (CVE-2026-14257) (#3959) #3959
CVE-2026: 9595: Bumped webpack-dev-server to 5.2.5 (#3924) #3924
OCPBUGS-99025: Bump dompurify to 3.4.7+ in 4.22 (#3895) #3895
OCPBUGS-91629: Bump ws to 8.21.0 for CVE-2026-45736 (#3906) #3906
OCPBUGS-96710: Bump basic-ftp to 5.3.1 for CVE-2026-44240 (#3823) #3823
CVE-2026: 59873 openshift4/ose-agent-installer-ui-rhel9: node-tar: Denial of Service via crafted gzip bomb openshift-4.22 #3890
Update OWNERS file (#3883) #3883
OCPBUGS-98431: Bump js-yaml to 4.3.0 in 4.22 (#3865) #3865
Apply patches (#3873) #3873
MGMT-24444: Apply sentence case to networking management type labels … (#3747) (#3871) #3747
MGMT-24152: UI allows editing pull secret in draft cluster (#3662) (#3870) #3662
OCPBUGD-89707: bump form-data from 4.0.5 to 4.0.6 to address CVE-2026-12143 (#3869) #3869
patch CVE-2026-9277 and CVE-2026-42338 via yarn resolutions (#3851) #3851
AGENT-1519 | [Below-the-sea UI] Allow the user to select IPv6 in the Networking Stack Type field (#3806) #3806
MGMT-23950: [Staging] [UI] - Cluster name missing in page header for draft clusters (#3669) (#3835) #3669
Fix disk encryption parsing for cluster details (#3737) (#3843) #3737
MGMT-19002: [nmstate] UI form view missing autoconf field for ipv6 (#3681) (#3836) #3681
Tweak discovery ISO modal sizing (#3792) (#3846) #3792
MGMT-23490: Refactor Troubleshooting Web Console (#3688) (#3839) #3688
OCPBUGS-88249, OCPBUGS-88400: Ensure axios version is resolved to 1.18.1 (#3857) #3857
Pull secret appears editable in draft cluster but changes are not applied (#3597) (#3831) #3597
MGMT-24099: UI redirects to Custom Manifest page before host discovery when cluster is OCI platform (#3739) (#3844) #3739
Fix machine network autoselect to work with IPv6 only clusters (#3813) (#3848) #3813
Fix nested expandable sections (#3798) #3798
OCPBUGS-86813: Custom manifests are broken in local assisted UI (#3768) #3768
OCPBUGS-86258: Static ip prefill for ove below the sea (#3767) #3767
Operators section should not be displayed on review and installation progress pages when no operators are selected (#3750) #3750
Remove Arbiter button (#3748) #3748
fix monted pull secret parsing (#3724) #3724
Allow to install SNO topology (#3721) #3721
OCPBUGS-85230: Ensure follow-redirects pkg resolves to ^1.16.0 (#3705) #3705
OCPBUGS-85265: [release-4.22] OCPBUGS-84038 | [Below the sea UI] Lack of visual feedback (spinner) on disabled “Next” button during background validation (#3703) #3703
OCPBUGS-84318: fix operators list in ABI below the sea (#3645) #3645
Hide internally generated custom manifests on the Cluster Review page (#3700) #3700
OCPBUGS-85199: [release-4.22] OCPBUGS-84147 | [Below the sea UI] Leaky Abstraction: Transient 500 errors exposed during host binding process (#3683) #3683
Remove 2 node arbiter option from the control plane dropdown option (#3702) #3702
OCPBUGS-85220, OCPBUGS-85222, OCPBUGS-85224, OCPBUGS-85226, OCPBUGS-85228: Bump axios to ^1.15.1 (#3693) #3693
OCPBUGS-84272: bump axios to ^1.15.0 for fixing CVE-2026-40175 (#3638) #3638
Update OWNERS file (#3660) #3660
NO-ISSUE: Update translation files to match new i18next format (#3658) #3658
Full changelog

agent-installer-utils

OCPBUGS-105451: Update Konflux references #337
OCPBUGS-101760: Update Konflux references #329
OCPBUGS-100105: Use Operator catalog in 4.22 for OVE #325
AGENT-1568: Add lvms-operator to config #324
OCPBUGS-99906: Update Konflux references #302
OCPBUGS-99556: Use agent-preinstall-image-builder from quay-proxy #321
OCPBUGS-98743: Update cluster-logging and loki operator versions #316
OCPBUGS-89320: bump mtv-operator to release-v2.12 #310
OCPBUGS-86042: Filter out link-local IPv6 addresses #306
OCPBUGS-85525: update konflux references #296
OCPBUGS-84141: Update 4.22 Konflux files #295
OCPBUGS-83734: Red Hat Konflux kflux-prd-rh02 update ove-ui-iso-4-22 #291
Full changelog

aws-cloud-controller-manager

OCPBUGS-83898: UPSTREAM: <drop>: bump google.golang.org/grpc to v1.79.3 #155
Full changelog

aws-cluster-api-controllers

🐛 [release-4.22] OCPBUGS-112305: UPSTREAM: 6132: Persist ProviderID immediately after instance creation #626
OCPBUGS-84393: Bump github.com/go-jose/go-jose/v4 to 4.1.4 #606
OCPBUGS-83899,UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.10.3 into release-4.22 #603
Full changelog

aws-ebs-csi-driver

OCPBUGS-83900: UPSTREAM: 2911: bump google.golang.org/grpc v1.80.0 to fix CVE-2026-33186 #316
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-101882, OCPBUGS-101889, OCPBUGS-101890, OCPBUGS-102000: Bump golang.org/x/net to v0.53.0 #602
OCPBUGS-109635: csi-driver-smb: DeleteVolume call fails to mkdir under /tmp #597
OCPBUGS-91947: maxOpenShiftVersion should be bumped to 5.0 #572
OCPBUGS-85532: Add init container for Manila node daemonset #555
OCPBUGS-85116: Mount writable /tmp in SMB CSI driver #550
OCPBUGS-84243: [release-4.22] Add VolumeAttributesClass e2e test manifests for Azure disk #544
Full changelog

aws-karpenter-provider-aws

OCPBUGS-101842: Fix CVE-2026-33814 #35
Full changelog

aws-machine-controllers

OCPBUGS-85125: Fixed broken test and simplified some logic #184
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-88485: Bump golang.org/x/net from v0.49.0 to v0.55.0 #193
OCPBUGS-85706, OCPBUGS-85707: UPSTREAM: <drop>: bump google.golang.org/grpc to v1.79.3 #185
Full changelog

azure-cluster-api-controllers

OCPBUGS-105465: Address CVE-2026-39829 #396
OCPBUGS-83906: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.23.1 (dbeb413) into release-4.22 #381
Full changelog

azure-disk-csi-driver

UPSTREAM: 3635: OCPBUGS-96598: Bump golang.org/x/net to v0.55.0 #165
OCPBUGS-106152: UPSTREAM: 3756: fix: optionally skip reading the config from the API server #163
OCPBUGS-83633: Bump spdystream to v0.5.1 #150
OCPBUGS-85193: check for node name in waitForDiskManagedByTobeRemoved #146
UPSTREAM: 3569: OCPBUGS-83425: Bump grpc to v1.79.3 #136
Full changelog

azure-file-csi-driver

OCPBUGS-95536: Bump golang.org/x/crypto to v0.48.0-sec.1 #144
UPSTREAM: 3023: OCPBUGS-83329: Bump grpc to v1.79.3 #126
Full changelog

azure-kms-encryption-provider

CNTRLPLANE-4024: [release-4.22]: Correct Managed HSM endpoints #53
Full changelog

azure-machine-controllers

OCPBUGS-98074: Bump golang.org/x/crypto from v0.47.0 to v0.54.0 #205
OCPBUGS-86996: Don’t permanently fail Machines after provisioning #195
PIXAA-7: Leverage SpotRebalanceRecommendation for instance termination when available #198
Full changelog

azure-service-operator

OCPBUGS-83879: Bump grpc package for CVE fix in 4.22 #27
OCPBUGS-84333: Updating ose-azure-service-operator-container image to be consistent with ART for 4.22 #25
OCPBUGS-83835: UPSTREAM: <carry>: add openshift/e2e-tests.sh #23
Full changelog

baremetal-cluster-api-controllers

OCPBUGS-86688: Adopt existing Metal3 Remediation CRDs on upgrade #83
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-111885: pin argcomplete for yq on Python 3.9 (release-4.22) #10766
Bug OCPBUGS-99399: baremetal: fix provisioning ISO kernel arguments #10703
AGENT-1546: Backport NoRegistryClusterInstall feature to release-4.22 #10683
OCPBUGS-87814: [release-4.22] Add omitempty to vSphere and Nutanix MachinePool slice fields #10606
OCPBUGS-95555, OCPBUGS-99017: bump golang.org/x/crypto to 0.52.0 #10695
OCPBUGS-98982: Update RHCOS-release-4.22 bootimage metadata to 9.8.20260715-1 / 10.2.20260715-0 #10692
OCPBUGS-98701: cluster-api: disable diagnostics endpoint for local CAPI controllers #10685
OCPBUGS-87812: [release-4.22] fix: reset associatedVCenter in failure domain validation loop #10604
OCPBUGS-97964: destroy/aws: delete vpc endpoints earlier #10674
no-jira: images: bump UPI image dependencies to 4.22 #10582
OCPBUGS-84402: Bump go-jose/v4 to 4.1.4 #10597
OCPBUGS-84643: Update RHCOS-release-4.22 bootimage metadata to 10.2.20260521-0 / 9.8.20260520-0 #10572
OCPBUGS-85407: PowerVS: Add port 80 security group rule #10548
OCPBUGS-85503: PowerVS: Fix supported system types retrieval #10521
OCPBUGS-84701: vSphere - Missing unit tests to cover polarion workitems #10526
OCPBUGS-84663: add unit tests for Nutanix to replace polarion workitems #10525
OCPBUGS-84643: Update RHCOS-release-4.22 bootimage metadata to 10.2.20260423-0 / 9.8.20260428-0 #10523
OCPBUGS-83611: PowerVS: update release 4.22 CAPI to v0.12.2 #10509
Full changelog

baremetal-operator

OCPBUGS-83866: Include image URL and checksum in provisioning error message #500
OCPBUGS-94109: cherry-pick reconciler optimizations #503
OCPBUGS-97940: Add BMH finalizer on PreprovisioningImage #505
OCPBUGS-87963: Fix preprovisioning network Secret lifecycle during BMH deletion #491
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-98547: bump x/crypto to the latest version #2309
OCPBUGS-85066: Add required-scc annotation to node-joiner pod #2266
Full changelog

cloud-credential-operator

NO-JIRA: Revert “OCPBUGS-87828: Scope minted AWS IAM policies to cluster-owned resources” #1059
OCPBUGS-87828: Scope minted AWS IAM policies to cluster-owned resources #1045
OCPBUGS-84398: github.com/go-jose/go-jose/v4 v4.1.4 #1020
OCPBUGS-83625: test-ext: hypershift skip CCO metrics endpoint validation #1013
Full changelog

cluster-authentication-operator

OCPBUGS-85105: Fix OAuth page showing OKD branding instead of OpenShift #888
OCPBUGS-84954: Fix terminationMessagePolicy on network policy e2e test pods #884
Full changelog

cluster-autoscaler

OCPBUGS-102038: [4.22] Fix OCPBUGS-102038 #434
OCPBUGS-99551: [release-4.22] UPSTREAM: 10001: chore(clusterapi): add machine phase check for failed machines #431
OCPBUGS-84131: [release-4.22] UPSTREAM: 9458: fix(clusterapi): use kind-aware version discovery for infra references #419
Full changelog

cluster-baremetal-operator

OCPBUGS-99390: Cluster Operator baremetal did not report Progressing=True during a cluster update #634
OCPBUGS-99501: Apply cluster TLS profile to ironic-proxy container #635
OCPBUGS-87212: Add watcher for both TLS Adherence policy and profile changes #610
OCPBUGS-86226: Fix empty IRONIC_BASE_URL #606
OCPBUGS-85640: Fix webhook to validate the actual admission request object #602
OCPBUGS-84936: Fix webhook server not starting due to missing WithValidator #598
OCPBUGS-84924: Bind the plain HTTP 8080 metrics port to localhost #596
Full changelog

cluster-capi-controllers

OCPBUGS-83913,UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api:v1.12.7 (b5fa593) into release-4.22 #285
OCPBUGS-83759, OCPCLOUD-3419: Adopt IPAM CRDs on upgrade #280
Full changelog

cluster-capi-operator

OCPBUGS-96609: Bump golang.org/x/net to v0.56.0 to fix CVE-2026-27136 #624
OCPBUGS-86353: fix: scope webhook to capi namespace, remove unused webhook endpoints #568
NO-JIRA: Allow sustaining engineering to self serve dependency updates #555
OCPBUGS-84942: fix: remove retired Microsoft.ClassicStorage permission #548
OCPBUGS-83917: Bump grpc package for CVE fix in 4.22 #539
OCPBUGS-84365: Fix e2e flake when workers are in us-west-2b #530
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-105883: Created new job to update vSphere nodes to have vsphere label #501
OCPBUGS-94184: OCPBUGS-65582: [release-4.22] OCPBUGS-65582: manifests: Shift operator Deployment and ClusterOperator after CredentialsRequests #484
SPLAT-2794: Create OTE Binary and add vSphere hybrid e2e tests #471
OCPBUGS-92656: e2e/ccm-aws-ote: support to dual-stack IPv6 primary #480
Full changelog

cluster-config-api

OCPBUGS-105168: Add haproxyVersion in IngressController API #2971
AGENT-1578: Promote NoRegistryClusterInstall feature to default #2979
AGENT-1544: Backport NoRegistryClusterInstall feature to release-4.22 #2930
OCPBUGS-98222: add new serviceAccountToken fs type #2922
Promote EVPN Feature Gate to GA #2826
OCPBUGS-85102: Add labelSelector to MachineSet status for scale subresource #2831
OCPBUGS-83846: Add component names, manifestSubstitutions, and observedGeneration to CAPI revisions #2819
OCPBUGS-83768: extend supported values for MCN IRI image status field #2817
OCPBUGS-83755: fix(config/v1): define constants for authentication types as typed constants #2816
OCPBUGS-68358: Disable PSA for 4.22 #2802
Full changelog

cluster-control-plane-machine-set-operator

OCPBUGS-87968: Fixed issue where nameserver is not set when recreating cpms #409
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-88472: Fix group snapshots on HyperShift #280
Full changelog

cluster-etcd-operator

OCPBUGS-100120: Revert ‘OCPBUGS-88490: fix etcd operator deadlock when etcd-endpoints configmap is stale’ #1661
OCPBUGS-90542: fix etcd operator deadlock when etcd-endpoints configmap is stale #1636
OCPBUGS-86960: validate snapshot before destructive operations in cluster-restore-tnf.sh #1627
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-image-registry-operator

OCPBUGS-96612: Bump golang.org/x/net from v0.47.0 to v0.55.0 #1355
OCPBUGS-85342: Fix stale config cache causing incorrect deployment #1342
OCPBUGS-83692: Allow longer window before going Degraded #1323
OCPBUGS-83650: CNTRLPLANE-2660:e2e testing automation: Image Registry network policy #1322
OCPBUGS-83265: ImageConfigController: add inertia before ImageConfigControllerDegraded #1321
Full changelog

cluster-ingress-operator

OCPBUGS-105168: Bump openshift/api which adds HAProxy version API #1545
OCPBUGS-98728: Add missing include annotations to IBM Cloud and PowerVS ingress CredentialsRequests #1506
OCPBUGS-97563: Detect orphaned OSSM subscription after noOLM migration #1495
OCPBUGS-91967: Guard OLM watches with capability check in gatewayclass controller #1481
OCPBUGS-87164: Add referencegrants and backendtlspolicies to Gateway API RBAC #1461
OCPBUGS-87167: Add configuration override for X-SSL strip #1468
OCPBUGS-86074: Update grpc-go and x/net #1449
OCPBUGS-85024: TestUnsupportedConfigOverride: Ignore featuregate and defaults #1432
OCPBUGS-85064: Allow host network connections to the ingress canary #1433
OCPBUGS-84841: isFIPSEnabled: Check FIPS_ENABLED env. var. first #1429
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-87844: Fix kube-apiserver-to-kubelet-signer refresh interval #2187
OCPBUGS-85269: fsync static pod cert and manifest writes for crash durability #2143
OCPBUGS-85260: operator should not override authentication config serviceAccountIssuer with the default one during the operator initialization #2142
OCPBUGS-84536: Bump library-go #2131
OCPBUGS-83770: Allow setting the oauthMetadata when auth type is None #2112
OCPBUGS-68365: revert dev cert rotation #2017
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-84560: CNTRLPLANE-3107: e2e testing automation Create network network policy test cases #931
Full changelog

cluster-kube-scheduler-operator

OCPBUGS-83736: add /var/run/kubernetes as emptyDir #640
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-85570: add PodDisruptionBudget for migrator deployment #174
OCPBUGS-84312: schedule migrator pods on control-plane nodes #162
Full changelog

cluster-machine-approver

OCPBUGS-86773: fix: use feature-gate annotation for CAPI manifests #305
Full changelog

cluster-monitoring-operator

OCPBUGS-104852: [release-4.22] e2e: scale down CVO and MCO to prevent node reboots during proxy config watch test #3052
OCPBUGS-104536: Backport e2e stabilization 4.22 #3026
OCPBUGS-100367: [release-4.22] fix: watch cluster wide proxy changes and apply changes accordingly #3020
OCPBUGS-99748: fall back to kube-system/global-pull-secret for telemeter-client token #3001
OCPBUGS-93722: [release-4.22] Prometheus: Information disclosure of Azure OAuth client secret via config API #2976
OCPBUGS-92193: set Prometheus shards value explicitly #2974
OCPBUGS-88321: fix(TestDocExamples) flake: use internal registry for test pods #2965
OCPBUGS-86807: jsonnet: exclude ReplicationController from catch-all … #2940
OCPBUGS-86990: increase lookup interval #2945
OCPBUGS-86034: fix: use numeric ports in NetworkPolicies and add enforcement e2e test #2929
Full changelog

cluster-network-operator

OCPBUGS-105512: Remove version-specific CNI binary copy logic #3114
OCPBUGS-99744: Bump frr-k8s MAX_FDS from 1024 to 65536 #3090
OCPBUGS-97939: bump containernetworking/cni v0.8.0 -> v1.3.0 #3044
OCPBUGS-86033: Revert “[release-4.22] OCPBUGS-90721: NVIDIA-596: Enable dpu healthcheck” #3042
OCPBUGS-84739: Use dedicated service accounts for multus pods #2985
OCPBUGS-90721: NVIDIA-596: Enable dpu healthcheck #3009
OCPBUGS-89244: NVIDIA-554: DPU-host mode: use ConfigMap for OVN feature enablement instead of per-node script gating #3029
OCPBUGS-88307: Remove –enable-interconnect flag from OVN-K manifests #3028
OCPBUGS-83637: only report Progressing for active network rollouts #2962
Full changelog

cluster-node-tuning-operator

OCPBUGS-104615: E2E: LLC: Restore uncore cache annotation to true #1577
OCPBUGS-105873: BUG-FIX Latency Test #1583
OCPBUGS-105535: Add missing annotations to NetworkPolicy manifests #1580
OCPBUGS-99265: E2E: LLC: Pass fresh ctx variable to DeferCleanup functions #1567
OCPBUGS-92011: e2e: fix: clear hugepages before switching kernelPageSize to 4k #1554
OCPBUGS-99290: e2e: fix broken checks and rework netqueue tests to avoid ARM ethtool blackout flakes #1568
OCPBUGS-98400: E2E: Add functional test cases checking GOMAXPROCS #1561
OCPBUGS-98062: E2E: Fix tuned active profile check for wrapped performance profiles #1559
OCPBUGS-87153: E2E: Refactor OVS affinity tests into shared helpers and add new workload-partitioning and control-plane reboot test cases. #1537
OCPBUGS-93924: Let cri-o manage the GOMAXPROC for burstable pods #1555
OCPBUGS-86071: perf: latency: compute memory resources dynamically #1520
OCPBUGS-87891: Enable timer migrations for all use-cases #1542
OCPBUGS-87158: e2e: Remove unnecessary len(numa) < 2 skip gates #1538
OCPBUGS-84431: Bump github.com/moby/spdystream from v0.5.0 to v0.5.1 #1529
OCPBUGS-86247: Revert stalld backend to sched_debug #1523
OCPBUGS-86024: Requeue PerformanceStatus update when status write fails #1518
OCPBUGS-85020: e2e: Add irqbalance StartLimitBurst >= 100 config test #1506
Full changelog

cluster-olm-operator

OCPBUGS-94187: Scale to replicas=2 and enable PDB on HighlyAvailable topology [release-4.22] #215
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-100168: Allow Prometheus to scrape check-endpoints metrics on port 17698 #743
OCPBUGS-105443: Add HostToContainer mountPropagation to node-pullsecrets volume mount #748
OCPBUGS-85097: e2e network policy tests #687
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-86054: e2e network policy tests #436
Full changelog

cluster-policy-controller

OCPBUGS-98222: add serviceAccountToken volume type to psalabelsyncer #192
Full changelog

cluster-samples-operator

OKD-379: Fix missing namespace in database template image triggers #701
CNTRLPLANE-3176: implements operator tls config compliance #688
Full changelog

cluster-storage-operator

OCPBUGS-96622: Bump golang.org/x/net to v0.55.0 #722
Full changelog

cluster-version-operator

OCPBUGS-104545: pkg/cvo/egress: Disable Proxy respect on HyperShift #1438
OCPBUGS-98572: Tolerate unknown template fields during payload loading #1421
OCPBUGS-77681: Updating cluster-version-operator-container image to be consistent with ART for 4.22 #1331
Full changelog

console

OCPBUGS-100519, OCPBUGS-101795: Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss #17054
OCPBUGS-112271: Fix flaky TestAsyncCache backend test #17045
OCPBUGS-105478: [release-4.22] OCPBUGS-83799: Fix Workloads sidebar ordering when DeploymentConfig is unavailable #16928
Fix OCPBUGS-99414: CVE-2026-59877 #16834
OCPBUGS-95402: Fix orphaned shell processes in pod terminal on WebSocket disconnect #16694
Fix for OCPBUGS-101812: CVE-2026-69152 #16930
Fix for OCPBUGS-105894: CVE-2026-73086 #16965
OCPBUGS-87832: Use stable username hash for user-settings ConfigMap names #16565
OCPBUGS-105611: [release-4.22] Fix leading whitespace in Quick Start execute code snippets #16951
OCPBUGS-89705: Fix CVE-2026-12143 form-data CRLF injection #16644
OCPBUGS-100059: quickstart page i18n misses (Fix Quick Starts i18n bundle lookup for zh-CN) #16869
OCPBUGS-100317: Fix pod terminal not rendering until resize #16892
OCPBUGS-100307: Re-enable Knative Cypress e2e tests #16889
Fix OCPBUGS-98791: CVE-2026-48801 #16852
OCPBUGS-99545: ‘0 B’ is shown on details page when create pvc with ‘EiB’ unit #16807
OCPBUGS-99548: Incorrect translations for ‘CatalogSources’ and ‘OperatorGroups’ in l… #16809
OCPBUGS-99259: Disable Knative e2e Cypress tests in CI #16784
OCPBUGS-98437: CVE-2026-59869 bump js-yaml #16768
OCPBUGS-97600: Fix devfile sample import by adding fallback for parent resolution failures #16706
OCPBUGS-88028: Bump follow-redirects from 1.15.3 to 1.16.0 to fix CVE-2026-40895 #16665
OCPBUGS-95580: Fix unnecessary error on Node Terminal tab #16696
OCPBUGS-88748: [release-4.22] webpack-dev-server: Information disclosure and denial of service via improper proxy configuration #16656
OCPBUGS-89337: Use fixed artifacts directory to prevent stale temp dir accumulation #16638
OCPBUGS-90636: Fix RoleBindings tab error for non-cluster-admin users #16662
OCPBUGS-90495: Projects cannot be filtered by display name #16652
OCPBUGS-90110: Fix ColumnManagementModal not showing NamespaceColumnHelpText #16643
Fix for OCPBUGS-84470: CVE-2026-4800 #16573
OCPBUGS-87933, OCPBUGS-87985: Bump protobufjs and shell-quote #16619
OCPBUGS-87997: Bump fast-uri to 3.1.2 to fix CVE-2026-6322 #16605
OCPBUGS-88304: Allow VolumeSnapshot restore when parent PVC is deleted #16592
OCPBUGS-87096: fixing severity not showing number of issues #16575
OCPBUGS-86580: Fix macOS Option key in pod terminal #16504
OCPBUGS-77804: Update Console 4.22 plugin SDK CHANGELOG #16521
OCPBUGS-86700: Fix and re-enable operator e2e tests disabled for createRoot #16518
OCPBUGS-77804: prep for 4.22 GA SDK publish #16508
OCPBUGS-86410: Fix Shipwright detail pages crashing with React error #310 #16485
OCPBUGS-86239: Adapt dashboard Prometheus polling interval based on query response time #16469
OCPBUGS-84963: Remove DataViewToolbar wrapper from bottom pagination #16483
OCPBUGS-86227: Show empty state instead of 403 error for users without projects #16467
OCPBUGS-86222: Use ETag conditional requests for OpenAPI v2 fetching #16466
OCPBUGS-86228: Re-enable add-flow-ci.feature e2e tests disabled for createRoot adoption #16468
OCPBUGS-86064: Enable Topology e2e tests #16458
OCPBUGS-83940: bump gRPC-Go to v1.79.3 #16443
OCPBUGS-83416: [release-4.22] CVE-2026-26996 Bump minimatch library #16278
OCPBUGS-85505: Add Suspense boundary to LazyRoutePage for plugin routes #16438
OCPBUGS-85494: Prevent binary secret data corruption when editing #16435
NO-JIRA: enable multi-architecture yarn builds #16415
OCPBUGS-85196: Remove @console imports from SDK dist #16407
OCPBUGS-84843: i18n upload/download routine task - version 4.22 #16382
OCPBUGS-85114: Fix SDK publish workflow for Yarn Berry #16403
OCPBUGS-84963: Add bottom pagination to ConsoleDataView for mobile responsiveness #16394
OCPBUGS-84556: re-enable helm-release.feature #16358
OCPBUGS-84916: Remove PII from events #16393
OCPBUGS-84811: fix Helm list page redirect after upgrade/rollback #16380
OCPBUGS-84848: Fix ConsoleDataView filter order: Name and Label should appear first #16383
OCPBUGS-84807: Fix race conditions in create-namespace Cypress tests #16379
OCPBUGS-84681: Fix crash when switching language to English #16373
OCPBUGS-84216: Fix create visual connector in Topology #16314
OCPBUGS-84345: Update resolveDynamicModuleMaps to skip unavailable packages #16342
OCPBUGS-83546: Fix Cypress test timeouts by using correct timeout option #16292
OCPBUGS-84246: prepare for 4.22-prerelease.3 sdk publish #16337
OCPBUGS-84246: 4.22 SDK fixes #16321
OCPBUGS-83543: Add empty state visibility check to CRD test #16309
OCPBUGS-83543: Fix race condition in CRD Cypress test #16290
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

console-operator

OCPBUGS-81121: clone bump documentation base url #1154
OCPBUGS-100387: Sort plugin list to make them deterministic #1165
OCPBUGS-97828, OCPBUGS-97829: Stabilize telemetry config to prevent continuous console pod rollouts #1183
OCPBUGS-94186: Add retry for transient API errors to prevent Degraded blips #1181
OCPBUGS-94188: use ObservedGeneration to determine Progressing status #1180
OCPBUGS-92829: Clean up old temp directories in downloads pod #1177
OCPBUGS-86118: Add unit and e2e test coverage for cert rotation redeployment #1161
OCPBUGS-83941: bump gRPC-Go package #1157
NETOBSERV-2296: add missing annotations on netobserv quickstart #1097
OCPBUGS-85507: feat: use 2 replicas for console on tnf #1155
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-83942: Bump grpc to 1.79.3 to address CVE-2026-33186 #243
OCPBUGS-87165: CI build root image tag sync with ART 4.22 #240
Full changelog

coredns

OCPBUGS-86189: [release-4.22] OCPBUGS-83943: Bump gRPC to v1.79.3 to resolve CVE-2026-33186 #185
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-83552: Bump google.golang.org/grpc to 1.79.3 #395
UPSTREAM-SYNC: Sync release-4.22 with upstream release-1.35 #381
OCPBUGS-85241: Updating ose-openstack-cloud-controller-manager-container image to be consistent with ART for 4.22 #392
OCPBUGS-85239: Updating ose-openstack-cinder-csi-driver-container image to be consistent with ART for 4.22 #390
OCPBUGS-85240: Updating csi-driver-manila-container image to be consistent with ART for 4.22 #391
Full changelog

csi-driver-nfs

OCPBUGS-84434: Bump github.com/moby/spdystream@v0.5.1 #190
OCPBUGS-83946: CVE-2026-33186: bump google.golang.org/grpc to v1.79.3 #174
Full changelog

csi-external-attacher

OCPBUGS-83947: Bump google.golang.org/grpc to v1.79.3 #107
Full changelog

csi-external-provisioner

OCPBUGS-96626: Bump golang.org/x/net to v0.57.0 #148
OCPBUGS-84435: Bump github.com/moby/spdystream to v0.5.1 in 4.22 #136
OCPBUGS-82033: Bump google.golang.org/grpc to 1.79.3 #133
Full changelog

csi-external-resizer

OCPBUGS-82031: Bump google.golang.org/grpc to v1.79.3 #199
Full changelog

csi-external-snapshot-metadata

OCPBUGS-83948: Bump google.golang.org/grpc to v1.79.3 #19
Full changelog

csi-external-snapshotter, csi-snapshot-controller

OCPBUGS-88723: UPSTREAM: 1392: Fix VolumeSnapshotContent deletion #222
OCPBUGS-83949, OCPBUGS-83952: Bump google.golang.org/grpc to v1.79.3 #216
Full changelog

csi-node-driver-registrar

OCPBUGS-84436: Bump github.com/moby/spdystream to v0.5.1 #105
Full changelog

docker-registry

OCPBUGS-84738: pin cloud.google.com/go/storage to v1.30.1 to fix blob deletion #470
Full changelog

egress-router-cni

OCPBUGS-97939: bump containernetworking/cni to v1.3.0 #103
Full changelog

gcp-cloud-controller-manager

OCPBUGS-83965, OCPBUGS-84447: Update grpc and spdy dependencies #117
Full changelog

gcp-cluster-api-controllers

UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.12.0 (b9b055d) into release-4.22 #294
OCPBUGS-83966: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.11.2 (14609a0) into release-4.22 #293
OCPBUGS-84862: Updating ose-gcp-cluster-api-controllers-container image to be consistent with ART for 4.22 #286
Full changelog

gcp-pd-csi-driver

OCPBUGS-81649: Bump google.golang.org/grpc to v1.79.3 in release 4.22 #108
Full changelog

haproxy-router

OCPBUGS-87166: Prevent SSRF via FQDN-typed EndpointSlices #813
OCPBUGS-87167: Strip X-SSL-* headers for plain HTTP #793
OCPBUGS-83969: Bump google.golang.org/grpc to v1.79.3 #776
Full changelog

hyperkube, installer-kube-apiserver-artifacts, kube-proxy, pod

OCPBUGS-98604: Add NodeSelectorAdjuster admission plugin for HCP clusters #2718
NO-JIRA: Update openshift-hack/rebase.sh #2733
OCPBUGS-96637: Bump golang.org/x/net from v0.47.0 to v0.55.0 #2737
OCPBUGS-91744, OCPBUGS-93526, OCPBUGS-93551, OCPBUGS-95549, OCPBUGS-95556: Bump golang.org/x/crypto/ssh to v0.52.0 #2725
OCPBUGS-99766: UPSTREAM: <carry>: upkeep cpu partitioning admission webhook #2724
OCPBUGS-90148: Rebase v1.35.6 in release-4.22 #2707
OCPBUGS-93787: backport kubernetes/conformance umbrella suite #2705
OCPBUGS-86898: Fix performance related issues when selinux metrics are emitted #2676
OCPBUGS-85499: Bump Kubernetes v1.35.5 to release-4.22 #2664
OCPBUGS-85415: [release-4.22] Improve WatchList test robustness #2663
OCPBUGS-84640: devicemanager: constrain topology hints to device NUMA nodes #2656
OCPBUGS-83607: Bump to k8s v1.35.4 #2646
OCPBUGS-84055: Update the csi-driver-host-path version to 1.17.1 #2650
Full changelog

hypershift

OCPBUGS-98328: fix(kubevirt): use only first MachineInternalIP per family in EndpointSlice endpoints #8979
CNTRLPLANE-3774: [release-4.22] fix: control-plane-operator: improve opaque conditions #9058
OCPBUGS-111083: fix(hcco): run kas-connection-checker as non-root #9320
OCPBUGS-105866: remove redhat-marketplace catalog from HyperShift #9289
OCPBUGS-105591: [release-4.22] use in-cluster service for oauth-server #9127
OCPBUGS-96711: Apply MetricsSet relabel configs to KAS ServiceMonitor #8901
OCPBUGS-105421: fix(upsert): add desired-state hash to detect spec field removals #9259
OCPBUGS-101964: [release-4.22] OCPBUGS-98213: fix router component ordering to prevent missing HAProxy backends #9212
OCPBUGS-100332: fix(konnectivity): conditionally prefer IPv4 based on HCP network config [release-4.22] #9191
OCPBUGS-100141: Add proxy env vars to AWS cloud-controller-manager deployment #9156
OCPBUGS-94518: add ACR pull identity to worker cloud.conf and VMSS #8865
OCPBUGS-100299: Avoid printing errors twice #9183
OCPBUGS-94170: fix registry override matching and propagation to init containers #8877
OCPBUGS-100176: Remove hardcoded quay.io credentials from EnsureGlobalPullSecret test #9169
OCPBUGS-90086: [release-4.22] clear stale EtcdRecoveryActive failure condition when etcd is healthy #8806
OCPBUGS-99554: fix(backport): konnectivity agent auth to 4.22 #9077
OCPBUGS-99299: [release-4.22] OCPBUGS-86296: Propagate management cluster proxy env vars to konnectivity sidecar #8592
CNTRLPLANE-3884: Add spec.monitoring API for metrics forwarding #8872
OCPBUGS-97921: fix(nodepool): skip CNI-internal IPs in ClusterNetworkCIDRConflict check #8948
OCPBUGS-98627: Skip Azure topology LB scope override for ARO HCP IngressController #8998
OCPBUGS-98220: fix(cpo,hcco): prevent premature KAS convergence during KMS key rotation [release-4.22] #8972
OCPBUGS-90083: Fix NodePool reconciliation failure when updating mirrored immutable ConfigMaps #8811
OCPBUGS-89236: Handle CA bundle aggregation delay by requeuing revocation #8746
CNTRLPLANE-3749: feat(api,cpo): add observedGeneration to ControlPlaneComponentStatus #8868
OCPBUGS-93921: bump catalog image version cap from 4.21 to 4.22 #8861
OCPBUGS-88325: fix(cpo) delete terminated MCD pods to retry in-place upgrades #8729
OCPBUGS-87364: Gate Route watch on management cluster capability #8692
CNTRLPLANE-3661: add etcd data re-encryption after encryption key rotation (#8219) #8790
OCPBUGS-88356: fix(cpo): deduplicate VPC endpoint subnets by AZ #8724
CNTRLPLANE-3619: backport API-driven Azure topology and private connectivity (Phase 1) #8721
OCPBUGS-90563: Fix metrics-proxy unbounded memory growth #8788
OCPBUGS-89352: build(operator): drop hypershift-no-cgo from operator container images #8756
OCPBUGS-86912: [release-4.22] Stop controllers fighting over HCP status #8632
OCPBUGS-86039: OCPBUGS-62177: [release-4.22] Verify cert revocation against all KAS pods #8538
OCPBUGS-86578: bootstrap serving certs at hypershift operator startup #8599
OCPBUGS-86354: add Konflux pipeline definitions for CPO 4.22 #8608
OCPBUGS-86354: set limits for aro.openshift.io/swift-nic in request overrides for ARO swift #8564
OCPBUGS-85620: Fix webhook TLS failure after service-ca to self-managed cert migration #8513
OCPBUGS-83836: add missing RBAC for webhook configurations #8295
OCPBUGS-84939: [release-4.22] add CP pull-secret watches for in-place propagation #8408
OCPBUGS-86026: Fix metrics-proxy deployment failure due to dots in volume names #8534
OCPBUGS-85779: Add AWS ISO domains to konnectivity IsCloudAPI #8447
OCPBUGS-85659: Clarify –base-domain flag default behavior #8525
ACM-33601: use the latest ubi9 nginx image #8465
OCPBUGS-78988: bump go builder and ubi images #8457
CNTRLPLANE-2939: Coordinate CRD lifecycle with Cluster CAPI Operator #8442
OCPBUGS-85104: fix, cno, skip cloud-network-config-controller check on non-cloud platforms #8438
NO-JIRA: fix(ci): use PR base SHA for api-lint diff in GHA #8430
OCPBUGS-84841: fix(ingress): set FIPS_ENABLED env var on ingress operator #8388
OCPBUGS-83709: fix(kubevirt): filter link-local addresses from EndpointSlice endpoints #8272
OCPBUGS-78988: chore(deps): weekly dependabot consolidation #8383
OCPBUGS-84632: fix(azure): detect and replace stale role assignments on cluster re-creation #8359
OCPBUGS-83576: fix(metrics-proxy): resolve ports from pods instead of deployments #8260
NO-JIRA: revert: remove .git/ from .dockerignore #8234
OCPBUGS-83285: revert 5.0 supported version from release-4.22 #8216
CNTRLPLANE-3233: ci(gha): add release-4.22 branch to GitHub Actions workflows #8218
CNTRLPLANE-3197: update latest supported version from 4.22 to 4.23 #8193
CNTRLPLANE-3174: Add unit tests for CPO controller packages #8184
CNTRLPLANE-3215: fix envtest GHA workflow path filters for CRD test suites #8200
CNTRLPLANE-2078: add unit tests for AWS Route53 and IAM #8079
OCPBUGS-82301: fix(catalogs): use semver comparison for catalog version cap to handle OCP 5.0 #8195
NO-JIRA: control-plane-pki-operator: fix Event emission logic, format #8190
OCPBUGS-82192: fix(webhookcerts): handle upgrade from service-ca managed certs #8189
OCPBUGS-82159: fix(ignition-server): use major+minor version comparison for OCP 5.0 payloads #8182
CNTRLPLANE-2511: refactor(cpo): move OAuth internal LB annotation into ReconcileService #8185
CNTRLPLANE-2511: Support OAuth LoadBalancer with Azure Private Link Service #8149
OCPBUGS-81644: fix(cli): fix Azure destroy cluster leaving vnet/nsg resource groups for private topology #8151
OCPBUGS-33097: Remove deprecated OVNSbDb service type from default strategy mappings #8164
CNTRLPLANE-3174: test: Add unit tests for product-cli, token-minter, and sync-fg-configmap #8178
CNTRLPLANE-3050: feat(ci): use Konflux-built image for GitHub Actions runners #8092
CNTRLPLANE-2841: test(e2e): add metrics-forwarder e2e test verifying data-plane scraping #8147
CNTRLPLANE-3037: Create separate assets package specifically for CRD management #8150
GCP-462: Add GCP hosted cluster documentation #8027
NO-JIRA: docs(ci): add sync-community-fork token rotation guide #8173
CNTRLPLANE-2841: feat(HCCO): reintroduce guest cluster metrics forwarder for control plane metrics #8146
NO-JIRA: fix(e2e): handle rate limiter context deadline error during cleanup #8137
NO-JIRA: fix(ci): remove catch-all pattern from codecov ignore list #8171
CNTRLPLANE-2511: Allow LoadBalancer publishing strategy for OAuthServer on self-managed Azure #8148
NO-JIRA: chore(ci): add client/ to codecov ignore list #8167
NO-JIRA: feat(e2e): add Azure platform support for backup/restore tests #8144
OCPBUGS-74960: prevent resource leak on deletion and handle DependencyViolation #7868
NO-JIRA: docs: expand custom images guide with Dockerfile.dev and CPO override #8155
CNTRLPLANE-3042: Parallelize make verify targets for faster local development #8051
NO-JIRA: ci: fix codecov ignore patterns for docs and nested files #8156
OCPBUGS-81270: fix(external-dns): mitigate Azure DNS API throttling #8098
NO-JIRA: ci: ignore non-Go files in codecov coverage analysis #8154
OCPBUGS-67240: Ignition generalize image download errors #7673
NO-JIRA: fix(Makefile): auto-detect upstream remote for lint #8152
OCPBUGS-79539: fix(cpo-v2): preserve HCCO modifications to OCM Controllers field #8072
AUTOSCALE-582: wire CRD sync and CEL adjustments into karpenter-api target #8119
CNTRLPLANE-3111: docs: add service publishing strategies reference documentation #8107
NO-JIRA: ci: make docs deploy preview non-blocking #8145
Revert “CNTRLPLANE-2841: feat(HCCO): add guest cluster metrics forwarder for control plane metrics” #8141
NO-JIRA: fix(e2e): handle dual RHCOS payloads in Karpenter drift OS image check #8128
OCPBUGS-50003: add ConfigMap fallback and EC2 error caching for vCPU metrics resolution #6723
CNTRLPLANE-2172: feat(azure): add private endpoint access topology for self-managed HostedClusters #7821
CNTRLPLANE-2841: feat(HCCO): add guest cluster metrics forwarder for control plane metrics #7790
CNTRLPLANE-2797: hypershift-operator webhooks port 9443 respect cluster TLS security profile #8078
OCPBUGS-50603: Create dedicated identity for KAS bootstrap container #6827
Revert “NO-JIRA: test(e2e): extend AWS guest resource cleanup timeout” #8138
NO-JIRA: ci: improve CI efficiency and codecov configuration #8113
NO-JIRA: test(e2e): add KubeVirt platform to backup/restore e2e test #8131
OCPBUGS-81162: fix(cpo): skip router LB services for ARO HCP #8087
NO-JIRA: ci: enable paths filter on envtest workflows #8125
NO-JIRA: test(e2e): extend AWS guest resource cleanup timeout #8124
NO-JIRA: fix(test): deep copy CRDs inside envtest retry loop #8127
NO-JIRA: chore(docs-agg): remove document count from aggregated file #8126
NO-JIRA: ci: separate envtest from unit tests in CI workflow #8120
OCPBUGS-80926: consolidate disaster-recovery prerequisites into dedicated page #8080
CNTRLPLANE-3116: fix(ci): drop pip cache from docs-preview workflow #8116
NO-JIRA: fix(api): regenerate feature gate manifests for ExternalOIDCWithUpstreamParity #8117
OCPBUGS-78763: fix: global-pull-secret daemonset node labeling race condition causes pods not to be scheduled on Replace upgrade strategy nodes in time #7981
CNTRLPLANE-3037: Introduce envtest for integration tests alternative #8089
CNTRLPLANE-3116: ci(docs): migrate docs-preview job to GitHub Actions #8109
CNTRLPLANE-244: fix(ci): configure Codecov PR comments and add unit tests #8085
NO-JIRA: chore(deps): weekly dependabot consolidation #8077
OCPBUGS-78931: add KubeVirt-specific backup settings #8022
OCPBUGS-81284: fix(release): allow multiple machine-os component versions #8101
NO-JIRA: fix(aws): load credentials from –aws-creds file using SDK v2 #8095
NO-JIRA: chore(ci): update hypershift-ci-2 manifests #8062
CNTRLPLANE-2678: Adapt etcd-backup command and add HO namespace manifests #8040
CNTRLPLANE-2551: Hypershift integration for API Auth Config changes #7774
GCP-447: inject token-minter as native sidecar init container #7965
AUTOSCALE-538, AUTOSCALE-539: Add Autonode status node counts + enabled condition to HostedCluster API #7794
CNTRLPLANE-244: ci: add Codecov integration to unit test workflow #8060
CNTRLPLANE-3050: Pre-build lint tools and fix Konflux pipeline triggers #8052
CNTRLPLANE-2838: feat(CPO): add metrics-proxy control plane component #7752
CNTRLPLANE-2787: Introduce BASE_DOMAIN env var for E2E test configuration #7930
CNTRLPLANE-2786: Extend controller architecture diagram with consumes relationship #8029
IR-350: add tls security profile configuration for the image registry operator #8011
AUTOSCALE-571: fix(karpenter): don’t associate public IP addresses for the default OpenshiftEC2NodeClass #7853
NO-JIRA: feat(e2e): skip SupportedVersionSkew condition on OCP < 4.21 in backup/restore tests #8067
CNTRLPLANE-2076: remove v2 import aliases left from SDK migration #8063
AUTOSCALE-559: PrivateLink plumbing for karpenter ec2nodeclass subnets #7791
STOR-2770: Generate Azure Disk and File CSI Driver Operator metrics serving certs by HCP controller #7970
CNTRLPLANE-2678: Add fetch-etcd-certs CPO subcommand for HCPEtcdBackup #8010
NO-JIRA: revert(api): remove APIServer Route CEL validation for Azure #8074
CNTRLPLANE-2172: feat(api): add Azure private endpoint access and PrivateLinkService CRD #8055
OCPSTRAT-2831: chore(owners): add cblecker to core-reviewers and core-approvers #8018
OCPBUGS-79428: Add recipe for ACM/MCE HyperShift Operator overrides #8057
CNTRLPLANE-2076: complete SDK v1 removal and post-migration cleanup #8038
CNTRLPLANE-2049: update GCP validation error expectations in TestOnCreateAPIUX #8037
CNTRLPLANE-3046: feat(ci): add monitoring and alerting for ARC runners #8044
CNTRLPLANE-3049: split verify checks into individual GitHub Actions workflows #8049
OCPBUGS-79352: fix(oapi): force WatchList feature gate to disabled for openshift-apiserver #8035
OCPBUGS-79071: Fix AWSEndpointService private-router teardown stuck on active VPC Endpoint connections #8030
CNTRLPLANE-3041: Override ARO/HCP 4.20 CPO with Azure Pod Identity backport #8025
CNTRLPLANE-3054: Apply init task 0.3 migration to fix broken Konflux pipelines #8053
OCPBUGS-70301: force-remove karpenter finalizer when guest KAS is down #7939
CNTRLPLANE-3047: fix(ci): use community fork token for checkout credential helper #8050
CNTRLPLANE-2788: validate memory quantity in KubeVirt nodepool create #7884
NO-JIRA: chore(ci): update Konflux Tekton tasks to latest versions #8048
CNTRLPLANE-3048: refactor gh-actions-runner pipelines and improve CEL triggers #8045
OCPBUGS-79369: Add Konflux archived PipelineRun skill and update task discovery #8043
CNTRLPLANE-3047: add workflow to sync hypershift-community fork #8042
NO-JIRA: chore(claude): add restructure-commits plugin command #7927
CNTRLPLANE-2986: feat(ci): Add self-hosted GitHub Actions runners for HyperShift #7980
NO-JIRA: fix(ci): pass –upgrade-versions to konflux task update skill #8036
CNTRLPLANE-2998: Migrate SQS to AWS SDK v2 #8015
NO-JIRA: refactor(oadp): unify backup/restore e2e test with platform auto-detection #7971
OCPBUGS-78996: fix(test): create SQS queue dynamically in spot termination handler e2e test #8007
CNTRLPLANE-2049: fix(api): audit and improve GCP API validation rules #8003
CNTRLPLANE-2081: Migrate RAM and ARN to AWS SDK v2 #7986
OCPBUGS-78778: fix(cpo): Don’t remove HCP Ingress from routes when CapabilityRoute is disabled #8001
NO-JIRA: Disable parent ownership for api subdir #8009
NO-JIRA: fix(api): replace CEL url() validators with regex to fix CRD cost budget #8004
OCPBUGS-78544: Update base images to address multiple CVEs flagged by MSFT security scans #7983
OCPBUGS-78705: Bootstrap CVO manifests should be filtered based on feature-set annotation #7984
NO-JIRA: fix(api): extend kubeapilinter scope to all non-vendor API types #8002
NO-JIRA: build(e2e): include hypershift binary in Dockerfile.e2e #7919
CNTRLPLANE-2925: add NodePool.Status.NodesInfo for node version distribution #7917
OCPSTRAT-2336: Adjust karpenter API to OpenShift conventions #7952
OCPBUGS-78539: chore(e2e): add temporary crash toleration for dns-operator #7978
CNTRLPLANE-2172: fix(e2e): register Azure private platform e2e flags #7977
NO-JIRA: chore(owners): require api-approvers approval for api/ changes #7972
Update Kube API Linter config for new APIs #7982
NO-JIRA: add .gitattributes to collapse generated files in PR diffs #7918
CNTRLPLANE-2910: feat(cpo): add Azure workload identity webhook as KAS sidecar #7867
CNTRLPLANE-2077: refactor(cleanzones): migrate AWS SDK from v1 to v2 #7960
CNTRLPLANE-2219: feat(aws): migrate ec2 to AWS SDK v2 #7871
GCP-440: Fix GCP boot image discovery from CoreOS stream metadata #7881
NO-JIRA: fix(oadp): correct Agent platform API group in backup/restore resources #7974
OCPBUGS-78356: fix(sharedingress): coalesce HAProxy reloads to prevent reload storms #7945
CNTRLPLANE-2172: fix(operator): accept Azure as valid private-platform value #7968
NO-JIRA: Rename cilium directory to v1.15.1 #7888
OCPBUGS-70354: add serviceAccount to global-pull-secret-syncer #7439
NO-JIRA: feat(e2e): add OIDC IAM fix and NodePool validation to backup/restore #7837
CNTRLPLANE-2172: feat(install): register Azure private platform flags #7912
CNTRLPLANE-2978: Add Azure CPO override for OCP 4.20 #7955
OCPBUGS-65687: fix(cpo): prevent informer creation for inaccessible resource types #7819
GCP-441: correct CCM crash toleration key to match pod label #7926
CNTRLPLANE-2916: conditionally create openshift-ingress network policy based on route labeling #7872
NO-JIRA: chore: add .git/ to .dockerignore #7944
NO-JIRA: fix(test): add aws-node-termination-handler to safe-evict audited list #7816
NO-JIRA: test(scheduler): add pair loss recovery unit coverage #7848
OCPBUGS-67262: fix(e2e): Use NodePool replicas as authoritative source for expected node count instead of CountAvailableNodes #7378
OCPBUGS-77160: include NMStateConfig in Agent platform OADP backup resources #7847
AUTOSCALE-571: fix(karpenter): select existing private subnets for default OpenshiftEC2NodeClass #7933
OCPBUGS-78198: fix(catalogs): update catalog image version cap to 4.21 #7915
OCPBUGS-78184: fix(hostedcluster): Remove referenced resource annotations regardless of hcp status #7913
CNTRLPLANE-2203: reintroduce ControlPlaneConnectionAvailable condition with conformance fix #7746
OCPBUGS-78185: Fix deadlock when changing release image during initial provisioning #7910
CNTRLPLANE-634: Make external-dns interval and AWS zones cache duration configurable #7931
OCPBUGS-78045: allow autonode provisioned arm instances #7893
OCPBUGS-78329: fix(releaseinfo): allow periods in version display name regex #7940
OCPBUGS-78223: add NodePool Rollouts reference documentation #7923
NO-JIRA: chore(gitignore): add .claude/worktrees/ to .gitignore #7938
OCPBUGS-78189: fix(e2e): fix nil deref in validateAWSGuestResourcesDeletedFunc #7911
OCPBUGS-77514: E2E filter rolling upgrade verification to current MachineSet #7864
OCPBUGS-77703: fix(api): add omitempty to NodePoolAutoScaling.Min for N-1 compatibility #7849
GCP-411: Add comprehensive unit tests for ReconcileInfrastructure #7895
NO-JIRA: fix KubeVirtAdvancedMultinetTest IPv6 and apk errors #7860
NO-JIRA: chore(e2e): increase nodepool condition check timeout #7906
CNTRLPLANE-2789: add StatefulSet test case to controlplane-component reconcile tests #7764
NO-JIRA: Add CodeRabbit config to exclude autogenerated files #7905
CNTRLPLANE-2933: add docs recipe for SPO configuration in HCP environments #7886
CNTRLPLANE-2031: test(e2e): add comprehensive backup and restore test suite #7745
CNTRLPLANE-2588: docs: add dependabot triage agent to AI CI jobs documentation #7889
CNTRLPLANE-2793: Cache MCS TLS certificate generation in ignition provider #7841
ROSAENG-132: fix(karpenter): Set Ready condition to False when version resolution fails #7866
NO-JIRA: api: fix AutoNode types to comply with OpenShift API conventions #7859
NO-JIRA: chore(deps): weekly dependabot consolidation #7876
OCPBUGS-39604: Include shared ingress resources in render output for proper uninstall cleanup #7836
OCPBUGS-76645: Make generated container names k8s compliant #7711
OCPBUGS-77254: fix(globalps): watch Machine updates to fix node labeling race condition #7803
GCP-441: tolerate 1 restart for GCP CCM token-minter race condition #7865
NO-JIRA: chore(deps): weekly dependabot consolidation #7863
OCPBUGS-77477: fix(awsutil): handle smithy errors in AWSErrorCode #7827
SREP-3855: unpause leaked child objects on deleting clusters (OCPBUGS-77530) #7861
CNTRLPLANE-2218: feat(aws): migrate ELB/ELBV2 to AWS SDK v2 #7825
OCPBUGS-77621: fix(nodepool): preserve ignition-reached annotation on token secret after restore #7851
OCPBUGS-76337: feat(scale-from-zero): add DescribeInstanceTypes IAM permission #7648
GCP-391: Add ImageRegistry GSA field and IAM binding for Image Registry Operator #7828
CNTRLPLANE-2801: fix(router): deploy router services for private ARO and remove KAS/OAPI dependencies #7845
CNTRLPLANE-2842: Fix context cancel accumulation in getMirrorFromICSPOrIDMS #7846
CNTRLPLANE-2801: api: remove redundant kubebuilder enum marker from KeyVaultAccess field #7835
NO-JIRA: bug(metrics): fix typo in hypershift_cluster_waiting_initial_availability_duration_seconds metric #7730
CNTRLPLANE-2840: fix(endpoint-resolver): sort pods by name for deterministic ordering #7854
CNTRLPLANE-2808: bump golang.org/x dependencies in / and /api modules #7818
CNTRLPLANE-2840: feat(CPO): add endpoint-resolver control plane component #7786
CNTRLPLANE-2794: Re-add TestGetDigest and TestGetManifest with mockgen mocks #7777
OCPBUGS-77034: fix(ho): add nil guard for Platform.AWS in metrics collector #7747
GCP-295: Add GCP platform support to E2E test framework #7697
OCPBUGS-76997: remove resource limits from Agent CAPI provider #7812
OCPBUGS-60936: fix(hccp): remove immutable field from kubeletconfigmap #6726
OCPBUGS-77311: handle HostedCluster deletion in secretJanitor to prevent stuck cluster deletions #7779
OCPBUGS-60185: Remove non-deterministic registry override computation from ignition-server #7811
CNTRLPLANE-2784: Document IAM policies for PowerVS credential fields #7778
CNTRLPLANE-2801: add Key Vault private endpoint TCP relay via private router #7701
CNTRLPLANE-2217: feat(aws): migrate kms and Resource Tagging to AWS SDK v2 #7795
CNTRLPLANE-2807: Fix version showing <unknown> in git worktree builds #7814
OCPBUGS-65636: add service account to konnectivity-agent #7309
NO-JIRA: docs(pki): add CA hierarchy diagram and trust distribution details #7799
CNTRLPLANE-2799: Unit test HCP availability and Ready flag reconciliation #7796
OCPBUGS-67262: fix(sync-global-pullsecret): compare content ignoring trailing newlines #7638
GCP-386: scope externaldns RBAC to GCP platform only #7781
OCPBUGS-76350: Honor AWS AMI override in NodePool token generation #7675
OCPBUGS-60185: Fix ignition-server pod restarts due to MIRRORED_RELEASE_IMAGE flapping #7588
NO-JIRA: docs(agents): add multi-module structure guidance to AGENTS.md #7797
OCPBUGS-76452: update OAuth certificate configuration doc #7785
GCP-402: Add gcp-project and gcp-region flags to hypershift install #7710
GCP-376: Add service account for storage #7676
GCP-367: enable multizone support in CCM cloud config #7731
OCPBUGS-77224: fix(routing): add Azure platform to LabelHCPRoutes() switch #7789
CNTRLPLANE-2220: feat(aws): migrate iam to AWS SDK v2 #7765
NO-JIRA: Skip ./dev directory in codespell checks #7775
NO-JIRA: MCE 2.17 konflux pipielines #7736
NO-JIRA: chore: add powervs-reviewers to OWNERS_ALIASES and OWNERS #7782
OCPBUGS-59876: feat: implement CLI-based OIDC disaster recovery command #7210
OCPBUGS-62177: revert CRR controller changes #7784
OCPBUGS-65824: Add dynamic NodePort range validation to prevent cluster creation failures #7652
CNTRLPLANE-2740: Set unhealthyPodEvictionPolicy to AlwaysAllow on all PDBs #7721
OCPBUGS-32770: fix(kubevirt): require CAPK image to be explicitly specified #7615
OCPBUGS-62177: fix(pki): use pod container port instead of kubeconfig service port #7744
CNTRLPLANE-1987: Ensure Azure HCP CLI infra commands work correctly #7436
NO-JIRA: fix(e2e): retry guest cluster API calls in EnsureFeatureGateStatus #7723
OCPBUGS-70152: Correct route labeling logic for HCP router infratructure #7605
CNTRLPLANE-2216: feat(aws): migrate route53 to AWS SDK v2 #7726
OCPBUGS-43449: Remove UltraSSD_LRS from DiskStorageAccountType for OS Disks #7727
CNTRLPLANE-644: Unify Validate/Complete Function Signatures Across Providers #7577
OCPBUGS-65879: Fix image-overrides annotation removal propagation to HCP #7533
CNTRLPLANE-2740: Add KAS liveness readiness sidecar to OAS and OAuth API Server #7722
OCPBUGS-34662: Manage AWS EBS CSI driver metrics serving certificates via CPO #7538
OCPBUGS-73915: Use openshift golang builder for MCE builds #7735
NO-JIRA: Remove .claude/settings.json #7751
OCPBUGS-62177: Fix certificate revocation validation across all KAS pods #7405
CNTRLPLANE-2696: docs(azure): add managed Azure control plane authentication documentation #7653
NO-JIRA: test(e2e): add CloudController field to GCP ServiceAccountsEmails structs #7739
AUTOSCALE-485: bump karpenter-aws dependencies to 1.8.6 #7611
TRT-2554: Revert #7489 “CNTRLPLANE-2203: add ControlPlaneConnectionAvailable condition” #7734
GCP-367: Implement GCP Cloud Controller Manager component #7677
OCPBUGS-72596: Fix node-tuning-operator metrics port configuration #7468
CNTRLPLANE-2203: add ControlPlaneConnectionAvailable condition #7489
GCP-386: feat(gcp): enable DNS delegation for hosted cluster ingress via DNSEndpoint #7702
NO-JIRA: ci: fix bug in leader election detection #7696
GCP-308: test: verify control plane workloads have resource requests #7623
OCPBUGS-60707: Fix user-ca-bundle cleanup when additionalTrustBundle is removed #6900
CNTRLPLANE-2736: Rename review-agent-single-pr to address-review-comments #7709
CNTRLPLANE-2215: feat(aws): migrate S3 to AWS SDK v2 #7678
NO-JIRA: test(nodepool): add unit tests for scale-from-zero annotations #7688
OCPBUGS-55151: Move proxy certificate validation from metrics collector to reconcile loop #7536
CNTRLPLANE-418: Aro swift private #7613
CNTRLPLANE-2700: docs: add HCP networking requirements documentation #7654
CNTRLPLANE-2675: chore(cpo): move infrastructure reconciliation to infra package #7658
GCP-216: feat(nodepool): add GCP platform support #7631
GCP-199: add DNS management to Control Plane Operator #7639
AUTOSCALE-492: karpenter-ignition controller #7582
OCPBUGS-66966: loop over node-pool conditions updating in order #7325
SREP-715: New option to dump data plane content through the kube API server service exposed in HCP namespaces #6533
OCPBUGS-74620: test(e2e): increase default node ready timeout to 45 minutes #7629
OCPBUGS-74498: Add UserAgent telemetry to CPO Azure SDK clients #7620
OCPBUGS-74931: fix(hcco): gate image registry workaround to pre-4.20 releases #7634
NO-JIRA: docs(aws): add AWS PrivateLink architecture documentation #7645
NO-JIRA: chore(ai): Add skills for dev workflow #7636
CNTRLPLANE-2709: Update Dependabot to use conventional commits #7672
CNTRLPLANE-2703: Disable Renovate dependency updates #7657
OCPBUGS-74988: fix(test): resolve E2E flakes in global-pull-secret-syncer DaemonSet readiness checks #7627
CNTRLPLANE-2214: Migrate STS to AWS SDK v2 #7386
NO-JIRA:Docs: update documentation URL from netlify to pages.dev #7622
GCP-366: add CloudController service account for CCM #7617
NO-JIRA: ci: Improves the isLeaderElectionFailure function: #7589
NO-JIRA: Fix teardown flag timing in e2e tests #7586
CNTRLPLANE-2548: add direct Jira REST API integration to pr-report #7532
OCPSTRAT-2437: add unit test for custom HAProxy image annotation #7458
CNTRLPLANE-1708: Enable EnsureGlobalPullSecret AtLeast Version418 #7624
CNTRLPLANE-418: fix shared ingress AllowedCIDRs to use fc_src for PROXY protocol #7587
AUTOSCALE-535: default block device mappings #7583
OCPBUGS-69447: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7399
GCP-198: add PSC endpoint controller for customer-side management #7603
CNTRLPLANE-2650: docs(ci): add security requirement for Jira agent issues #7626
CNTRLPLANE-2650: docs: add AI-assisted CI jobs documentation #7598
OCPBUGS-62760: Pre-pull images to avoid startup delays and flaky e2e #7382
OCPBUGS-74247: CAPI image overrides aware of registry config #7575
CNTRLPLANE-1137: Add support for external CNI provider Cilium #7423
GCP-176: feat(gcp): add WIF credentials support for control plane op… #7600
NO-JIRA: test(assets): add unit test for CAPI resources file paths #7601
CNTRLPLANE-2580: feat(claude): update /update-konflux-tasks to work without log file #7591
GCP-213: feat(platform): add Google Cloud Platform support with CAPG Deployment #7305
OCPBUGS-62944: forceful termination of instances during HCP AutoNode deletion #7281
NO-JIRA: build: bump Go version to 1.25.3 #7592
CNTRLPLANE-1388: Spot with termination handler #7567
CNTRLPLANE-1892: chore(e2ev2): fixup GCP API checks #7555
NO-JIRA: ci: update build root image to Go 1.25 #7584
CNTRLPLANE-1988: Add Azure support to product CLI for self-managed customers #7407
AUTOSCALE-373: Proper ROSA instance tagging for AutoNode #6939
OCPBUGS-63345: AWS credential metric to distinguish unknown from invalid status #7075
OCPBUGS-74336: feat(cpo): check components have rolled out before setting available #7434
NO-JIRA: chore(deps): weekly dependabot consolidation #7563
OCPBUGS-64576: fix(dump): Fix dump command failure when EC2NodeClass resource is not registered #7147
CNTRLPLANE-2559: feat(contrib): add request serving setup utility #7534
CNV-76520: ci: allow restart of kubevirt-cloud-controller-manager #7469
NO-JIRA: fix(test): shorten scale-from-zero test name to avoid IAM role length limit #7558
OTA-1833: Adopt a new FeatureSet OKD #7557
OCPBUGS-62761: chore(e2e): remove KAS check from capi pod #7485
OCPBUGS-73817: fix: add hypershift.openshift.io/nodepool-globalps-enabled label to be ignored in cluster-autoscaler deployment #7480
OCPBUGS-65885: added 1.34 required ELBv2 perms to CCM role #7339
API-1835: Scaffold dynamic informers #7477
CNTRLPLANE-2579: feat(konflux): add script to update pipeline task bundles to latest trusted versions #7553
OCPBUGS-58397: feat(KubeVirt): configure External evictionStrategy on VMs #6380
GCP-197: add GCPPrivateServiceConnect controller for managing Service Attachments for Private Service Connect #7302
NO-JIRA: fix(e2e): TestNodePoolAutoscalingScaleFromZero for 4.20 and later only #7556
CNTRLPLANE-2291: feat(claude): add fix-hypershift-repo-robot-pr command #7438
CNTRLPLANE-2568: Update Konflux Tekton tasks to latest versions #7551
NO-JIRA: test(ingress): add test for clearing LoadBalancerSourceRanges #7544
NO-JIRA: fix(claude): fix Claude Code subagents frontmatter #7550
NO-JIRA: chore(deps): bump github.com/opencontainers/selinux from 1.11.0 to 1.13.0 #7462
OCPBUGS-55399: Add NTO Service and ServiceMonitor #7355
NO-JIRA: test(autoscaling): make GPU annotation optional in scale-from-zero test #7484
OCPBUGS-73914: Update Tekton tasks to pass enterprise contract validation #7535
NO-JIRA: chore(deps): bump github.com/cloudflare/circl from 1.3.7 to 1.6.1 in /hack/tools #7463
NO-JIRA: Add karpenter approvers and reviewers #7488
NO-JIRA: chore(ho): update lower bound version checks for OCP 5 #7472
NO-JIRA: fix(docs): strip markdown links from aggregated documentation #7487
NO-JIRA: chore(deps): bump github-dependencies group with 17 updates #7455
OCPBUGS-73847: fix(cli): use /tags endpoint for all release streams to enable RC filtering #7483
OCPBUGS-67234: fix(hostedcluster): unpause CAPI cluster when deleting paused HostedCluster #7389
OCPBUGS-72258: use InfraStatus.APIPort for custom DNS kubeconfig #7470
API-1835: Scaffold OpenShiftManager controller #7445
CNTRLPLANE-1768: feat(api): add support for graceful service account signing key rotation #7324
OCPBUGS-66205: [kubevirt] Make L3 migration labeling conditional #7308
NO-JIRA: chore(deps): bump Azure SDK and misc-dependencies groups #7464
NO-JIRA: chore(tekton): update Konflux task digests to latest versions #7465
OCPBUGS-70320: enable scale-up from zero with InPlace upgrade #7427
NO-JIRA: Add review process docs to CONTRIBUTING.md #7426
CNTRLPLANE-208: Document needed Azure infrastructure #7361
NO-JIRA: fix(deps): update k8s.io/utils digest to 914a6e7 #7450
NO-JIRA: chore(deps): bump misc-dependencies group with 11 updates #7437
OCPBUGS-72411: fix(cno): use brackets only for IPv6 in server URL #7447
NO-JIRA: chore(konflux): update Tekton tasks to latest versions #7451
OCPBUGS-72397: Fix Konflux EC voilation, update deprecated base … #7442
NO-JIRA: docs(konflux): add IMAGE_RELEASE_PROCESS.md #7432
NO-JIRA: test(e2e): fix AKS e2e test flakiness #7410
CNTRLPLANE-1978: add e2e tests for DataPlaneConnectionAvailable condition #7291
AUTOSCALE-473: Add HostedCluster annotation for karpenter ec2nodeclass instanceProfile #7392
NO-JIRA: fix(awseps): cache local zone ID in non-shared VPC case #7409
OCPBUGS-66211: fix(azure): preserve defaulted values in Infrastructure status #7393
OCPBUGS-69761: fix(ingress): clear LoadBalancerSourceRanges when AllowedCIDRBlocks is removed #7425
GCP-258: Use PullAlways for :latest image tags in control plane components #7313
OCPBUGS-63698: fix(azure): remove CSI secret ownership from hypershift-operator #7157
OCPBUGS-66154: add OAuth certificate configuration doc #7351
OCPBUGS-67224: fix(Portieris): Fix Portieris by mounting emptyDir to ‘./.trust’ work dir #7368
CNTRLPLANE-1622: Enable nodepool autoscaling min zero #6975
And 17 elided commits (e.g. from squash or rebase merges)
Full changelog

ibm-cloud-controller-manager

OCPBUGS-83973: Upgrade grpc for CVE-2026-33186 #105
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-83974: Bump google.golang.org/grpc to v1.79.3 #147
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-83774: Bump google.golang.org/grpc to v1.79.3 #171
Full changelog

ibmcloud-machine-controllers

OCPBUGS-96641: bump golang.org/x/net to v0.57.0 #99
Full changelog

insights-operator

OCPBUGS-105227: secrets and configmap revisions count gathering #1339
OCPBUGS-100173: Update installer dependency to use tagged version #1332
OCPBUGS-100154: [release-4.22] Fix indentation bug on livenessProbe #1330
OCPBUGS-96642: [release-4.22] Upgrade Golang and net library #1327
OCPBUGS-98383: controlplanemachinesets gatherer #1318
OCPBUGS-98153: update HyperShift deployment manifest #1315
OCPBUGS-98381: Optimize the CPU usage of insights-runtime-extractor #1317
OCPBUGS-88026: fall back to kube-system/global-pull-secret for Insights token #1305
OCPBUGS-86818: extractor controller #1296
OCPBUGS-86013: add trusted-ca-bundle to gatherin job #1290
OCPBUGS-83976: Bump google.golang.org/grpc to v1.79.3 #1287
Full changelog

ironic

OCPBUGS-105863: update ironic pin to include CVE-2026-54423 fix (release-4.22) #889
OCPBUGS-100167: Update openstack-ironic commit hash for CVE-2026-44918 #874
OCPBUGS-88478: Update openstack-ironic commit hash in requirements.cachito that addresses CVE-2026-43003 #860
OCPBUGS-98873: Selectively backport Redfish firmware update fix to 4.22 #870
OCPBUGS-84369: selectively backport servicing patches to 4.22 #848
OKD-362: Add watchdog to python-requirements.okd #844
OCPBUGS-84651: Bump sushy #843
Full changelog

ironic-agent

OCPBUGS-99897: Bump ironic-python-agent pinned commit for CVE-2026-66138 #294
OCPBUGS-88478: Update commit SHA in requirements.cachito to address CVE-2026-43003 #266
OCPBUGS-95061: Replace individual package removal with a single rpm -e loop #282
OCPBUGS-95061: Replace dnf remove with rpm -e to prevent dependency removal #270
Full changelog

keepalived-ipfailover

OCPBUGS-99767: Reinstall tzdata if /usr/share/zoneinfo is missing #247
Full changelog

kube-state-metrics

OCPBUGS-87957: embed timezone data in kube-state-metrics binary #150
OCPBUGS-87957: fix: don’t panic on CronJobs with unparseable schedules #147
OCPBUGS-86653: [Backport] Handle DeletedFinalStateUnknown panic #142
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-69842: Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 4.22 #59
Full changelog

kubevirt-csi-driver

OCPBUGS-83883: Bump google.golang.org/grpc to v1.79.3 #107
Full changelog

machine-api-operator

OCPBUGS-85102: Populate status label selector for scale subresource #1497
Full changelog

machine-config-operator

OCPBUGS-112614: OCPBUGS-109739: Increase rpm-ostree rebase retry backoff and preserve error #6436
OCPBUGS-105521: Fix SHA idempotency test in nmstate-configuration.sh #6392
OCPBUGS-105929: Fix duplicate template error and e2es #6397
Fixes OCPBUGS-105190: increase LRU cache and prefetch timeout for PinnedImageSet #6372
OCPBUGS-105447: fix nil pointer panic in IRI controller informer race #6390
OCPBUGS-105212: [release-4.22] Part2 Migrate OCB test-case #6374
OCPBUGS-105213: Update AMI Whitelist #6375
OCPBUGS-104563: Use providerSpec.Template in vSphere machineset reconciliation #6370
OCPBUGS-100583: [release-4.22] Part 1 Migrate OCB test cases from openshift-tests-private #6361
OCPBUGS-104576: [release-4.22] Add extension verification failure test cases OCP-89090 and OCP-89095 #6367
OCPBUGS-104451: [release-4.22] fix fencing_validator ocdebug fence dispatch race condition #6360
OCPBUGS-100293: Fix TC 43278 failing when release payload has no MCO commit info #6351
AGENT-1548: Backport NoRegistryClusterInstall feature to release-4.22 #6323
OCPBUGS-99712: Add TC 88940- Apply password only if changes exist #6339
OCPBUGS-98962: [release4.22] MCO-1997: MCO-2297: MCO-2440 Add osImagestream test-cases #6301
OCPBUGS-93804: move cleanUpDuplicatedMC to avoid double reboot on first updated Master node #6240
OCPBUGS-97904: Inject proxy into MCC deployment #6275
OCPBUGS-96145: Update AMI Whitelist #6260
OCPBUGS-89329: Fix kubelet certificate wait loop in criometricsproxy.yaml #6200
OCPBUGS-93743: Fix bootupd workaround in old nodes #6239
OCPBUGS-92026: OCPEDGE-2474: TNF - Add fencing taint/untaint alert agent scripts #6230
OCPBUGS-92022: MCO-2275: Migrate OS layering tests from openshift-tests-private #6218
[release:4.22] OCPBUGS-88330: MCO-2209 MCO-2213 MCO-2207: Migrate security, daemon, and kernel TCs from mco.go #6171
OCPBUGS-91958: Boot image skew check silently passes when MachineSets are reconcile-skipped #6227
OCPBUGS-91954: Make vsphere template updates atomic #6226
OCPBUGS-88184: Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole #6170
OCPBUGS-88683: Process rebuild annotation on machine-os-builder restart #6190
OCPBUGS-87981: Fix MCP.status.osImageStream #6164
OCPBUGS-88496: Update custom containerfile OCB test to work in a disconnected environment #6188
OCPBUGS-88001: Add mco_extensions.go e2e test suite for MCO extension install, enable, and validation #6184
OCPBUGS-88329: In OCB to check when a image is removed the old build is triggered again and the MC should start updating directly and no new MOSB should be triggred #6175
OCPBUGS-87019: fix: update arbiter crio config #6142
OCPBUGS-88487: make test 69755 more stable #6186
OCPBUGS-88331: [release-4.22] Remove skopeo-install script #6176
OCPBUGS-84679: add RootCA cert to the sysContextBuilder certs #5897
OCPBUGS-87840: vSphere boot image hot loop detection is non-functional due to stable template names #6157
OCPBUGS-87900: [release-4.22] OCPBUGS-87181: MCO-2211: MCO-2210: MCO-2234 MCO-Migrate MCO tests from openshift-tests-private #6148
OCPBUGS-88114: Skip chrony-wait on first node join #6168
OCPBUGS-88120: daemon: don’t pull/extract extensions for all OS updates #6169
OCPBUGS-87811: [release-4.22] OCPBUGS-87550: Update TC-88366 to check osImageStream status after update completes #6153
OCPBUGS-87161: [release-4.22] OCPBUGS-87027: MCO-2212: MCO-2213: Migrate mco_observability and mco_daemon test-suite #6143
OCPBUGS-86865: Stabilize ocl 4.22 #6115
OCPBUGS-86985: MCO-2297: Add OCP-88366 and OCP-88814 for osImageStream with osImageURL #6083
OCPBUGS-87163: Remove trailing newline (\n) characters in klog message strings #6147
OCPBUGS-86893: Add version guard for OSStream rendering #6123
OCPBUGS-86997: [release-4.22] OCPBUGS-86984: MCO-2273: MCO-2215: MCO-2183: Migrate remaining TCs from mco.go to MCO, units, kublet suite #6126
OCPBUGS-86297: configure-ovs: copy lldp mode to br-ex port #6073
OCPBUGS-86870: Update AMI Whitelist #6116
OCPBUGS-86732: remove tests using base images older than 4.13 #6104
OCPBUGS-86769: Adapt test ‘54922 - daemon: add check before updating kernel #6103
MCO-2233: Migrate Kernel related MCO test-cases #5860
OCPBUGS-86262: Verify extension packages are installed #6071
OCPBUGS-85127: Fix wrong early exit during kubelet MCs regeneration #6009
OCPBUGS-86267: Fix CVE-2026-33186 #6072
OCPBUGS-85341: Apply password only if changes exist #6053
OCPBUGS-86047: Manually uncordoned nodes are not automatically re-cordoned #6060
OCPBUGS-85124: use --delete-if-present for karg removal #6007
OCPBUGS-85626: only check password hash in /etc/shadow #6042
OCPBUGS-85651: BareMetal skew e2e fails patching provisioning CR after CBO webhook fix #6047
OCPBUGS-85198: Add terminationMessagePolicy to build pod containers #6012
OCPBUGS-85481: Add fix for ossImagestream status #6026
OCPBUGS-84813: Include RootCA in the temporal CC #5904
OCPBUGS-84406: Fix CVE-2026-34986 #5986
OCPBUGS-85156: Bootloader update attempt should be conditional #6011
OCPBUGS-84693: prom rules: add alert for nodes using runc #5998
OCPBUGS-84667: Fix encapsulated IGN version #5895
OCPBUGS-84480: Fix units rollback if update failure #5882
OCPBUGS-84949: Fix OCL test to handle temporarily empty current-machine-os-build annotation #5989
OCPBUGS-84840: Fix ssh and password rollbacks #5906
OCPBUGS-84865: MachineOSConfig “build was not found” error #5912
OCPBUGS-83779: Auto-append :ref suffix to additionalLayerStores in storage.conf #5903
OCPBUGS-84861: Update AMI Whitelist #5911
OCPBUGS-84850: Custom pool booting must handle matchExpressions in nodeSelector #5909
OCPBUGS-84849: Support bootloader update #5908
OCPBUGS-84719: deploy-from-self when skopeo < 1.22.2 #5901
OCPBUGS-84700: Bump image build timeout for status reporting test #5900
OCPBUGS-83818: ClusterHostedDNS on AWS/Azure/GCP: Modify Corefile template to better handle empty record types #5862
OCPBUGS-83771: Make IRI registry read-only via environment variable #5859
OCPBUGS-83577: Allow enablement of systemd units with existing files #5855
OCPBUGS-83559: Update AMI Whitelist #5853
OCPBUGS-83540: order corosync after OVS configuration on TNF clusters] #5852
Revert “OCPBUGS-69936: ovs: increase CPU priority for Open vSwitch Forwarding Unit” #5850
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

metallb-frr

OCPBUGS-86568: Generate fallback BGP router-id on IPv6-only nodes #133
OCPBUGS-84960: [release-4.22]: Bump to frr10 #130
Full changelog

monitoring-plugin

OCPBUGS-98787: replace outdated react-linkify dependency #1150
OCPBUGS-98787: replace outdated react-linkify dependency #1145
OCPBUGS-98432: fix for CVE-2026-59869 #1114
OU-1240: Makefile and package.json to enable test-frontend-ci #1094
OCPBUGS-99032: Fix CVE-2026-49978 - bump DOMPurify to >= 3.4.7 #1085
OCPBUGS-99234: graph redirect query parameter #1070
OU-651: Fix AlertRules page to display user defined loki alerts #1057
Fix for OCPBUGS-89698: CVE-2026-12143 #1053
Fix for OCPBUGS-91628: CVE-2026-45736 #1023
NO-JIRA: fix unit test severitySort and incidents #1036
Fix for OCPBUGS-94005: CVE-2026-13676 #1028
OU-1396: [release-4.22] fix: use replace to set variables to avoid navigation trap #1019
OCPBUGS-87979: [release-4.22] fast-uri: URI authority bypass due to improper delimiter handling #989
OCPBUGS-88413: [release-4.22] Fix CVE-2026-44494: bump axios to ^1.16.0 via overrides #997
OU-1360: reset queries when namespace changes in dev perspective #934
OU-1366: prevent namespace and project desync #935
OCPBUGS-85088: Sync Main to 4.22 #916
OU-1307: [release-4.22] don’t fight console to setActiveNamespace #881
Full changelog

multus-admission-controller

OCPBUGS-85569: Bump Go version to 1.25.0 for ML-KEM/PQC support #116
Full changelog

network-interface-bond-cni

OCPBUGS-97943: Update OWNERS for release-4.22 #119
Full changelog

networking-console-plugin

OCPBUGS-98788: Updating linkify-it to 5.0.2 to fix CVE-2026-48801 #464
OCPBUGS-92205: Updated doc links based on release #438
OCPBUGS-92196: fixed translations of pod column titles #437
OCPBUGS-88314: Trim subnet input in UDN creation form #431
CNV-90049: [UDN] Add condition column to the list page #432
OCPBUGS-88025: Fix empty state Create button links #429
CNV-74110: new translations #407
OCPBUGS-84204: CVE dependency remediation #381
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

oauth-apiserver

OCPBUGS-82579: [release-4.22]: chore: sync with openshift repositories #191
Full changelog

oauth-proxy

OCPBUGS-93565: update x/crypto to v0.52.0 and x/net to v0.55.0 #369
OCPBUGS-86213: Updating golang-github-openshift-oauth-proxy-container image to be consistent with ART for 4.22 #366
Full changelog

oauth-server

OCPBUGS-84381: Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 #233
OCPBUGS-82579: [release-4.22]: chore: sync with openshift repositories #222
Full changelog

olm-catalogd, olm-operator-controller

OCPBUGS-100305: Fix cache path to avoid /var/cache/dnf conflict #783
OCPBUGS-99298: increase catalog HTTP client timeout from 10s to 5m #768
OCPBUGS-94187: enable OLMv1 topology-based deployment scaling e2e test #761
OCPBUGS-94187: Backport HA topology deployment scaling to release-4.22 #758
OCPBUGS-85059: fix(test): drop blocking namespace-deletion wait between both-watch-modes scenarios #714
Full changelog

openshift-apiserver

OCPBUGS-87022: fix concurrent map race in project authorization cache #653
OCPBUGS-84454: Address CVE-2026-35469 #651
OCPBUGS-82579: [release-4.22] CNTRLPLANE-3226: Sync with openshift apiserver 4.22 kubernetes 1.34.1 #631
Full changelog

openstack-cluster-api-controllers

UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.14 into release-4.22 #409
OCPBUGS-84994: Updating openstack-cluster-api-controllers-container image to be consistent with ART for 4.22 #410
Full changelog

openstack-machine-api-provider

OCPBUGS-97826: Revendor CAPO #175
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-84411, OCPBUGS-84412: Update github.com/go-jose/go-jose/v4 to v4.1.4 [release-4.22] #1292
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-112496: NO-JIRA: Branch Sync main to release-4.22 [08-18-2026] #3406
OCPBUGS-99043: Branch Sync main to release-4.22 [08-13-2026] #3394
OCPBUGS-105515, OCPBUGS-105604: Branch Sync main to release-4.22 [08-10-2026] #3373
OCPBUGS-95560: Branch Sync main to release-4.22 [08-04-2026] #3358
OCPBUGS-100119, OCPBUGS-95064: Branch Sync main to release-4.22 [07-28-2026] #3333
OCPBUGS-99043: Branch Sync main to release-4.22 [07-16-2026] #3304
OCPBUGS-88733, OCPBUGS-88734: Branch Sync main to release-4.22 [06-16-2026] #3252
OCPBUGS-88718: Branch Sync main to release-4.22 [06-10-2026] #3244
OCPBUGS-87214: Branch Sync main to release-4.22 [06-05-2026] #3232
OCPBUGS-84384: CORENET-6537: OTE: Add external container support to infra provider #3147
OCPBUGS-83535: CARRY: skip ote tests 4.22 #3139
Full changelog

powervs-block-csi-driver

OCPBUGS-84007: Mitigate CVE-2026-33186 by bumping grpc-go to v1.79.3 #132
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-84008: Mitigate CVE-2026-33186 by bumping grpc-go to v1.79.3 #113
Full changelog

powervs-cloud-controller-manager

OCPBUGS-83398: Merge https://github.com/IBM-Cloud/cloud-provider-ibm:release-1.35 (e48649f) into release-4.22 #95
Full changelog

prometheus

OCPBUGS-93732: fix for CVE-2026-42151 #355
OCPBUGS-93919: fix(tsdb): temporarily ignore Direct IO enablement errors on unsupported filesystems #339
OCPBUGS-92818: bump x/crypto, x/net, and otel dependencies to fix CVEs #337
OCPBUGS-88666: remote: validate snappy decoded length before allocation in read endpoint #330
OCPBUGS-86248: fix: TLS client cert rotation when no CA is configured #313
OCPBUGS-84010: bump google.golang.org/grpc to v1.79.3 [release-4.22] #310
Full changelog

prometheus-alertmanager

OCPBUGS-98185: build(deps): bump github.com/hashicorp/memberlist from 0.5.4 to 0.6.0 #157
OCPBUGS-99442: embed tzdata in the alertmanager binary #141
Full changelog

route-controller-manager

OCPBUGS-86184: OCPBUGS-83892: Update grpc-go and x/net #90
Full changelog

service-ca-operator

OCPBUGS-84953: e2e network policy tests #353
Full changelog

stream-coreos, stream-coreos-extensions

OCPBUGS-105444: NetworkManager-ovs has moved to RHCOS #1956
Full changelog

telemeter

OCPBUGS-84021: update google.golang.org/grpc #605
OCPBUGS-84937: fix(deps): bump go-jose/v3 to v3.0.5 for JWE unwrap DoS #598
Full changelog

tests

OCPBUGS-111831: tolerate one NotReady CP node in EnsureNodesReady for degraded TNF #31527
OCPBUGS-100438: retry GetVotingMemberNames on transient etcd client fails #31506
OCPBUGS-88711: Backport node_e2e test migrations #31306
AGENT-1549: Backport NoRegistryClusterInstall feature to release-4.22 #31406
SPLAT-2802: Added VVCDO OTE binary to extensionBinary list #31321
SPLAT-2794: Added 3CMO OTE binary to extensionBinary list #31303
OCPBUGS-90522: Use AdminPolicyBasedExternalRoute CR for external gateway test #31317
OCPBUGS-87838: support Parents field on origin test suites #31270
OCPBUGS-92656: bump openshift-tests-extension to fix klog stdout parsing on 4.22 #31349
OCPBUGS-92048: fix PDB AlwaysAllow test failure on IPv6-primary dualstack clusters #31337
OCPBUGS-92047: Fix AWS DualStack CI jobs consistently encounter 2 EgressFirewall Test Failures #31336
OCPBUGS-85708: Raise OpenStack operator watch limits #31183
OCPBUGS-85655: Validate no WAL corruption when both nodes shutdown gracefully #31174
OCPBUGS-85515: Verify dynamic revision bump for etcd during kernel crash #31166
OCPBUGS-85339: Add e2e tests for KubeletEnsureSecretPulledImages feature gate #31148
OCPBUGS-85089: Allow OVN-Kubernetes CIDROverlap pathological events #31141
OCPBUGS-85122: Add ArtifactVolume tests and register artifact image #31108
OCPBUGS-84944: Fix timeout in PinnedImages GC test #31115
OCPBUGS-84946: skip on BM which has insufficient host #31116
OCPBUGS-84958: Optimize NetworkPolicy reconciliation test to reduce timeout #31119
OCPBUGS-84382: Add [Late] test to collect CRI-O goroutine dumps via SIGUSR1 #31074
OCPBUGS-84382: test: add monitortest to detect pods stuck in Pending state #31073
OCPBUGS-84888: Disable particular CSI tests if CSI driver is removed #31111
OCPBUGS-84654: fix openshift/network/third-party suite selecting zero tests #31090
SREP-4676: skipping namespaces are using default sa #31101
OCPBUGS-84362, OCPBUGS-84363: fix: skip unused tests for two node #31069
OCPBUGS-84706: Skip dev fuse test on runc runtime #31099
OCPBUGS-84628: Fix project name error during wait #31085
OCPBUGS-84674: retry transient kubeconfig read failures in GetClientConfig #31096
OCPBUGS-84676: Add sleep to give cvo time to reconcile #31097
OCPBUGS-84231: Skip image-registry operator tests for Libvirt platform in upgrade jobs. #31060
OCPBUGS-84322: Fix Gateway cleanup in parallel e2e test workers #31068
OCPBUGS-84049: [CNTRLPLANE-2751]:Adding e2e network policy cases for config-operator #31076
“OCPBUGS-84206: [release-4.22] STOR-2807: Add e2e test to verify CSI driver operators use service CA signed certificates” #31048
OCPBUGS-84210: skip serial and disruptive cases from suite #31057
OCPBUGS-84319: cache kube client instance #31067
OCPBUGS-84298: Skip test case updateLifecycle if the worker pool is paused #31065
OCPBUGS-84222: OVNK BGP: Improve VRF-Lite test stability #31058
OCPBUGS-83803: Move imagepolicy test to disruptive long-running suite #31056
OCPBUGS-83783: Add test to verify for backup container exists when etcd crashes #31035
OCPBUGS-83778: Verify etc pod should start with oom_score_adj as system-node-critical #31034
OCPBUGS-83712: Use upgrades.Skippable for Gateway API upgrade test skip logic #31030
OCPBUGS-83787: OCPSTRAT-3082:TLS propagation test #31038
Full changelog

thanos

OCPBUGS-105471: UPSTREAM: <carry>: bump google.golang.org/grpc to v1.82.1 (GHSA-hrxh-6v49-42gf) #199
COO-2034, OCPBUGS-105219, OCPBUGS-105223, OCPBUGS-105224: [release-4.22] vendor: bump vulnerable Go dependencies for GovCloud CVE remediation #197
OCPBUGS-96898: Address CVE-2026-39882 #192
OCPBUGS-92813: Fix CVE-2026-39883 #191
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-84028: Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.15.3 (e917f8e) into release-4.22 #108
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

UPSTREAM: 187: OCPBUGS-96686: Bump golang.org/x/net to v0.50.0-sec.4 #195
OCPBUGS-95573: Bump golang.org/x/crypto/ssh to v0.48.0-sec.1 #189
OCPBUGS-92190: Rebase 3.6.2 on 422 #188
OCPBUGS-83636: Bump spdystream to v0.5.1 #180
Full changelog

vsphere-csi-driver-operator

SPLAT-2802: Port vSphere hybrid OTE to release-4.22 #349
Full changelog

vsphere-problem-detector

OCPBUGS-86866: Fixed compute cluster permission logic for single fd with read-only custom resourcepool #221
Full changelog

Node Image Info

Loading node image info, this may take a while ...

CentOS Stream CoreOS 10 (`stream-coreos`)

Package List

cri-o-1.35.5-1.el10s
kernel-6.12.0-260.el10
openshift-kubelet-4.22.0-202606041959.p2.g7250fd5.assembly.stream.el9
systemd-257-32.el10

Full list (493 packages)

NetworkManager-1:1.58.0-1.el10
NetworkManager-cloud-setup-1:1.58.0-1.el10
NetworkManager-libnm-1:1.58.0-1.el10
NetworkManager-ovs-1:1.58.0-1.el10
NetworkManager-tui-1:1.58.0-1.el10
WALinuxAgent-udev-2.14.0.1-3.el10
aardvark-dns-4:2.1.0-1.el10
acl-2.4.0-2.el10
afterburn-5.10.0-2.el10
afterburn-dracut-5.10.0-2.el10
alternatives-1.30-2.el10
amd-gpu-firmware-20260812-26.el10
amd-ucode-firmware-20260812-26.el10
attr-2.6.0-2.el10
audit-4.2.1-3.el10
audit-libs-4.2.1-3.el10
audit-rules-4.2.1-3.el10
authselect-1.5.3-1.el10
authselect-libs-1.5.3-1.el10
azure-vm-utils-0.7.0-1.el10
basesystem-11-22.el10
bash-5.2.26-6.el10
bash-completion-1:2.11-16.el10
bind-libs-32:9.18.33-19.el10
bind-license-32:9.18.33-19.el10
bind-utils-32:9.18.33-19.el10
bootc-1.16.7-1.el10
bootupd-0.2.35-1.el10
bsdtar-3.7.7-10.el10
bubblewrap-0.10.0-3.el10
bzip2-1.0.8-25.el10
bzip2-libs-1.0.8-25.el10
c-ares-1.34.6-4.el10
ca-certificates-2026.2.90_v9.0.316-100.0.el10
catatonit-5:0.2.1-4.el10
centos-gpg-keys-10.0-23.el10
centos-release-cloud-1-1.el10s
centos-release-nfv-common-1-5.el10s
centos-release-virt-common-1-1.el10s
centos-stream-release-10.0-23.el10
centos-stream-repos-10.0-23.el10
checkpolicy-3.11-1.el10
chrony-4.8-2.el10
cifs-utils-7.6-2.el10
clevis-23-2.el10
clevis-dracut-23-2.el10
clevis-luks-23-2.el10
clevis-pin-tpm2-0.5.5-1.el10
clevis-systemd-23-2.el10
cloud-utils-growpart-0.33-11.el10
composefs-1.0.8-1.el10
composefs-libs-1.0.8-1.el10
conmon-3:2.2.1-4.el10
conmon-rs-0.6.6-2.el10s
console-login-helper-messages-0.21.3-10.el10
console-login-helper-messages-issuegen-0.21.3-10.el10
console-login-helper-messages-profile-0.21.3-10.el10
container-selinux-4:2.250.0-1.el10
containers-common-6:6.0-2.el10
containers-common-extra-6:6.0-2.el10
coreos-installer-0.26.0-1.el10
coreos-installer-bootinfra-0.26.0-1.el10
coreutils-9.5-13.el10
coreutils-common-9.5-13.el10
cpio-2.15-3.el10
cracklib-2.9.11-8.el10
cracklib-dicts-2.9.11-8.el10
cri-o-1.35.5-1.el10s
cri-tools-1.35.0-1.el10s
criu-4.2-9.el10
criu-libs-4.2-9.el10
crun-1.29.1-1.el10
crypto-policies-20260811-1.git4dcd294.el10
crypto-policies-scripts-20260811-1.git4dcd294.el10
cryptsetup-2.8.6-2.el10
cryptsetup-libs-2.8.6-2.el10
curl-8.12.1-6.el10
cyrus-sasl-gssapi-2.1.28-27.el10
cyrus-sasl-lib-2.1.28-27.el10
dbus-1:1.14.10-6.el10
dbus-broker-36-4.el10
dbus-common-1:1.14.10-6.el10
dbus-libs-1:1.14.10-6.el10
dbus-tools-1:1.14.10-6.el10
device-mapper-10:1.02.215-3.el10
device-mapper-event-10:1.02.215-3.el10
device-mapper-event-libs-10:1.02.215-3.el10
device-mapper-libs-10:1.02.215-3.el10
device-mapper-multipath-0.9.9-19.el10
device-mapper-multipath-libs-0.9.9-19.el10
device-mapper-persistent-data-1.3.2-1.el10
diffutils-3.10-8.el10
dmidecode-1:3.6-5.el10
dnf-4.20.0-27.el10
dnf-data-4.20.0-27.el10
dnsmasq-2.90-7.el10
dosfstools-4.2-12.el10
dracut-107-10.el10
dracut-network-107-10.el10
dracut-squash-107-10.el10
duktape-2.7.0-10.el10
e2fsprogs-1.47.1-5.el10
e2fsprogs-libs-1.47.1-5.el10
efi-filesystem-6-8.el10
efibootmgr-18-9.el10
efivar-libs-39-3.el10
elfutils-default-yama-scope-0.195-1.el10
elfutils-libelf-0.195-1.el10
elfutils-libs-0.195-1.el10
erofs-utils-1.8.10-1.el10
ethtool-2:6.19-1.el10
expat-2.7.3-2.el10
fcoe-utils-1.0.34-11.gitb233050.el10
file-5.45-12.el10
file-libs-5.45-12.el10
filesystem-3.18-17.el10
findutils-1:4.10.0-5.el10
firewalld-filesystem-2.4.3-4.el10
flatpak-session-helper-1.18.0-2.el10
fstrm-0.6.1-12.el10
fuse-common-3.16.2-5.el10
fuse-libs-2.9.9-25.el10
fuse3-3.16.2-5.el10
fuse3-libs-3.16.2-5.el10
fwupd-2.1.6-1.el10
gawk-5.3.0-6.el10
gdbm-1:1.23-14.el10
gdbm-libs-1:1.23-14.el10
gettext-envsubst-0.22.5-6.el10
gettext-libs-0.22.5-6.el10
gettext-runtime-0.22.5-6.el10
git-core-2.52.0-1.el10
glib2-2.80.4-15.el10
glibc-2.39-136.el10
glibc-common-2.39-136.el10
glibc-gconv-extra-2.39-136.el10
glibc-minimal-langpack-2.39-136.el10
gmp-1:6.2.1-12.el10
gnupg2-2.4.5-5.el10
gnutls-3.8.10-4.el10
gobject-introspection-1.79.1-7.el10
gpgme-1.23.2-6.el10
grep-3.11-10.el10
grub2-common-1:2.12-55.el10
grub2-efi-x64-1:2.12-55.el10
grub2-pc-1:2.12-55.el10
grub2-pc-modules-1:2.12-55.el10
grub2-tools-1:2.12-55.el10
grub2-tools-minimal-1:2.12-55.el10
gssproxy-0.9.2-10.el10
gzip-1.13-3.el10
hostname-3.23-14.el10
hwdata-0.379-10.10.el10
ignition-2.26.0-4.el10
ignition-grub-2.26.0-4.el10
ima-evm-utils-1.6.2-6.el10
info-7.1-6.el10
inih-58-3.el10
intel-gpu-firmware-20260812-26.el10
ipcalc-1.0.3-12.el10
iproute-7.0.0-2.el10
iproute-tc-7.0.0-2.el10
iptables-libs-1.8.11-16.el10
iptables-nft-1.8.11-16.el10
iputils-20240905-5.el10
irqbalance-2:1.9.4-6.el10
iscsi-initiator-utils-6.2.1.11-4.git4b3e853.el10
iscsi-initiator-utils-iscsiuio-6.2.1.11-4.git4b3e853.el10
isns-utils-libs-0.103-2.el10
jansson-2.14-3.el10
jose-14-102.el10
jq-1.7.1-13.el10
json-c-0.18-3.el10
json-glib-1.8.0-5.el10
kbd-2.6.4-7.el10
kbd-legacy-2.6.4-7.el10
kbd-misc-2.6.4-7.el10
kdump-utils-1.0.61-2.el10
kernel-6.12.0-260.el10
kernel-core-6.12.0-260.el10
kernel-modules-6.12.0-260.el10
kernel-modules-core-6.12.0-260.el10
kernel-modules-extra-6.12.0-260.el10
kexec-tools-2.0.32-3.el10
keyutils-1.6.3-5.el10
keyutils-libs-1.6.3-5.el10
kmod-31-13.el10
kmod-libs-31-13.el10
kpartx-0.9.9-19.el10
krb5-libs-1.21.3-11.el10
less-661-3.el10
libacl-2.4.0-2.el10
libaio-0.3.112-1.el10
libarchive-3.7.7-10.el10
libassuan-2.5.6-6.el10
libattr-2.6.0-2.el10
libbasicobjects-0.1.1-58.el10
libblkid-2.40.2-20.el10
libbpf-2:1.7.0-2.el10
libcap-2.69-7.el10
libcap-ng-0.9.3-2.el10
libcbor-0.11.0-3.el10
libcollection-0.7.0-58.el10
libcom_err-1.47.1-5.el10
libcomps-0.1.21-3.el10
libconfig-1.7.3-10.el10
libcurl-minimal-8.12.1-6.el10
libdhash-0.5.0-58.el10
libdnf-0.73.1-17.el10
libdnf-plugin-subscription-manager-1.30.15-1.el10
libdrm-2.4.128-1.el10
libeconf-0.6.2-4.el10
libedit-3.1-52.20230828cvs.el10
libev-4.33-15.el10
libevent-2.1.12-16.el10
libfdisk-2.40.2-20.el10
libffi-3.4.4-10.el10
libfido2-1.14.0-7.el10
libgcc-14.4.1-2.el10
libgcrypt-1.11.0-7.el10
libgomp-14.4.1-2.el10
libgpg-error-1.50-2.el10
libibverbs-62.0-3.el10
libicu-74.2-5.el10
libidn2-2.3.7-3.el10
libini_config-1.3.1-58.el10
libipa_hbac-2.13.1-2.el10
libjcat-0.2.2-2.el10
libjose-14-102.el10
libkcapi-1.5.0-3.el10
libkcapi-hasher-1.5.0-3.el10
libkcapi-hmaccalc-1.5.0-3.el10
libksba-1.6.7-2.el10
libldb-4.24.5-101.el10
libluksmeta-10-1.el10
libmaxminddb-1.9.1-4.el10
libmicrohttpd-1:1.0.0-3.el10
libmnl-1.0.5-7.el10
libmodulemd-2.15.0-12.el10
libmount-2.40.2-20.el10
libmspack-0.10.1-0.14.alpha.el10
libndp-1.9-2.el10
libnet-1.3-7.el10
libnetfilter_conntrack-1.0.9-12.el10
libnfnetlink-1.0.2-3.el10
libnfsidmap-1:2.8.3-9.el10
libnftnl-1.3.0-3.el10
libnghttp2-1.68.0-6.el10
libnl3-3.11.0-1.el10
libnvme-1.16.2-1.el10
libpath_utils-0.2.1-58.el10
libpcap-14:1.10.4-7.el10
libpciaccess-0.16-16.el10
libpkgconf-2.1.0-3.el10
libpwquality-1.4.5-13.el10
libref_array-0.1.5-58.el10
librepo-1.19.0-1.el10
libseccomp-2.5.6-1.el10
libselinux-3.11-1.el10
libselinux-utils-3.11-1.el10
libsemanage-3.11-1.el10
libsepol-3.11-1.el10
libsmartcols-2.40.2-20.el10
libsmbclient-4.24.5-101.el10
libsolv-0.7.33-6.el10
libss-1.47.1-5.el10
libsss_certmap-2.13.1-2.el10
libsss_idmap-2.13.1-2.el10
libsss_nss_idmap-2.13.1-2.el10
libsss_sudo-2.13.1-2.el10
libstdc++-14.4.1-2.el10
libtalloc-2.4.4-100.el10
libtasn1-4.20.0-5.el10
libtdb-1.4.15-100.el10
libtevent-0.17.1-100.el10
libtirpc-1.3.5-1.el10
libtool-ltdl-2.4.7-14.el10
libunistring-1.1-10.el10
liburing-2.12-1.el10
libusb1-1.0.30-1.el10
libutempter-1.2.1-15.el10
libuuid-2.40.2-20.el10
libuv-1:1.52.1-1.el10
libverto-0.3.2-10.el10
libverto-libev-0.3.2-10.el10
libwbclient-4.24.5-101.el10
libxcrypt-4.4.36-10.el10
libxml2-2.12.5-15.el10
libxmlb-0.3.28-1.el10
libxslt-1.1.39-10.el10
libyaml-0.2.5-16.el10
libzstd-1.5.5-9.el10
linux-firmware-20260812-26.el10
linux-firmware-whence-20260812-26.el10
lldpad-1.1.1-4.gitf1dd9eb.el10
lmdb-libs-0.9.32-4.el10
logrotate-3.22.0-5.el10
lsof-4.98.0-7.el10
lua-libs-5.4.8-1.el10
luksmeta-10-1.el10
lvm2-10:2.03.41-3.el10
lvm2-libs-10:2.03.41-3.el10
lz4-libs-1.9.4-8.el10
lzo-2.10-14.el10
makedumpfile-1.7.8-1.el10
mdadm-4.4-4.el10
microcode_ctl-4:20260210-1.el10
mokutil-2:0.7.2-5.el10
mpdecimal-2.5.1-12.el10
mpfr-4.2.1-8.el10
nano-8.1-3.el10
ncurses-base-6.4-15.20240127.el10
ncurses-libs-6.4-15.20240127.el10
net-tools-2.0-0.73.20160912git.el10
netavark-4:2.0.0-2.el10
nettle-3.10.1-1.el10
newt-0.52.24-5.el10
nfs-utils-1:2.8.3-9.el10
nftables-1:1.1.5-6.el10
nmap-ncat-4:7.92-5.el10
nmstate-2.2.61-2.el10
npth-1.6-21.el10
nss-altfiles-2.23.0-6.el10
numactl-2.0.19-3.el10
numactl-libs-2.0.19-3.el10
numad-0.5-50.20251104git.el10
nvidia-gpu-firmware-20260812-26.el10
nvme-cli-2.16-2.el10
oniguruma-6.9.9-7.el10
open-vm-tools-13.1.0-1.el10
openldap-2.6.13-1.el10
openshift-clients-4.22.0-202605222252.p2.g062bc54.assembly.stream.el9
openshift-kubelet-4.22.0-202606041959.p2.g7250fd5.assembly.stream.el9
openssh-9.9p1-29.el10
openssh-clients-9.9p1-29.el10
openssh-server-9.9p1-29.el10
openssl-1:3.5.7-3.el10
openssl-fips-provider-1:3.5.7-3.el10
openssl-libs-1:3.5.7-3.el10
openvswitch-selinux-extra-policy-1.0-36.el10s
openvswitch3.5-3.5.3-5.el10s
os-prober-1.81-9.el10
ose-aws-ecr-image-credential-provider-4.22.0-202605191551.p2.gb4bad3f.assembly.stream.el9
ose-azure-acr-image-credential-provider-4.22.0-202605292128.p2.g0e3fc8d.assembly.stream.el9
ose-crio-credential-provider-4.22.0-202602261640.p2.g83d4961.assembly.stream.el9
ose-gcp-gcr-image-credential-provider-4.22.0-202605192117.p2.gea31ab8.assembly.stream.el9
ostree-2026.3-1.el10
ostree-grub2-2026.3-1.el10
ostree-libs-2026.3-1.el10
p11-kit-0.26.4-1.el10
p11-kit-trust-0.26.4-1.el10
pam-1.6.1-11.el10
pam-libs-1.6.1-11.el10
passt-0^20260728.gf8df3f1-1.el10
passt-selinux-0^20260728.gf8df3f1-1.el10
pciutils-3.13.0-6.el10
pciutils-libs-3.13.0-6.el10
pcre2-10.44-1.el10.3
pcre2-syntax-10.44-1.el10.3
pkgconf-2.1.0-3.el10
pkgconf-m4-2.1.0-3.el10
pkgconf-pkg-config-2.1.0-3.el10
podman-7:6.1.0-1.el10
podman-sequoia-0.4.0~pqc.3-1.el10
policycoreutils-3.11-1.el10
policycoreutils-python-utils-3.11-1.el10
polkit-125-6.el10
polkit-libs-125-6.el10
popt-1.19-8.el10
procps-ng-4.0.4-13.el10
protobuf-c-1.5.0-6.el10
psmisc-23.6-8.el10
python3-3.12.13-3.el10
python3-audit-4.2.1-3.el10
python3-charset-normalizer-3.4.2-1.el10
python3-cloud-what-1.30.15-1.el10
python3-dateutil-1:2.9.0.post0-1.el10
python3-dbus-1.3.2-8.el10
python3-decorator-5.1.1-12.el10
python3-distro-1.9.0-5.el10
python3-dnf-4.20.0-27.el10
python3-dnf-plugin-versionlock-4.7.0-12.el10
python3-dnf-plugins-core-4.7.0-12.el10
python3-file-magic-5.45-12.el10
python3-gobject-base-3.46.0-7.el10
python3-gobject-base-noarch-3.46.0-7.el10
python3-hawkey-0.73.1-17.el10
python3-idna-3.7-6.el10
python3-iniparse-0.5-10.el10
python3-inotify-0.9.6-36.el10
python3-libcomps-0.1.21-3.el10
python3-libdnf-0.73.1-17.el10
python3-librepo-1.19.0-1.el10
python3-libs-3.12.13-3.el10
python3-libselinux-3.11-1.el10
python3-libsemanage-3.11-1.el10
python3-packaging-24.2-2.el10
python3-pexpect-4.9.0-6.el10
python3-pip-wheel-23.3.2-11.el10
python3-policycoreutils-3.11-1.el10
python3-ptyprocess-0.7.0-9.el10
python3-pyyaml-6.0.1-19.el10
python3-requests-2.32.4-1.el10
python3-rpm-4.19.1.1-25.el10
python3-setools-4.7.0-1.el10
python3-setuptools-69.0.3-12.el10
python3-six-1.16.0-16.el10
python3-subscription-manager-rhsm-1.30.15-1.el10
python3-systemd-235-11.el10
python3-urllib3-1.26.19-4.el10
qemu-guest-agent-18:10.1.0-26.el10
quota-1:4.09-10.el10
quota-nls-1:4.09-10.el10
rdma-core-62.0-3.el10
readline-8.2-11.el10
rpcbind-1.2.9-0.el10
rpm-4.19.1.1-25.el10
rpm-build-libs-4.19.1.1-25.el10
rpm-libs-4.19.1.1-25.el10
rpm-ostree-2026.2-2.el10
rpm-ostree-libs-2026.2-2.el10
rpm-plugin-audit-4.19.1.1-25.el10
rpm-plugin-selinux-4.19.1.1-25.el10
rpm-plugin-syslog-4.19.1.1-25.el10
rpm-sequoia-1.10.2.3-1.el10
rpm-sign-libs-4.19.1.1-25.el10
rsync-3.4.4-1.el10
samba-client-libs-4.24.5-101.el10
samba-common-4.24.5-101.el10
samba-core-libs-4.24.5-101.el10
samba-ndr-libs-4.24.5-101.el10
sed-4.9-5.el10
selinux-policy-42.1.26-1.el10
selinux-policy-targeted-42.1.26-1.el10
setup-2.14.5-7.el10
sg3_utils-1.48-10.el10
sg3_utils-libs-1.48-10.el10
shadow-utils-2:4.15.0-13.el10
shadow-utils-subid-2:4.15.0-13.el10
shared-mime-info-2.3-8.el10
shim-x64-16.1-1.el10
skopeo-3:1.24.0-1.el10
slang-2.3.3-8.el10
snappy-1.1.10-7.el10
socat-1.7.4.4-9.el10
sos-4.11.2-5.el10
sqlite-libs-3.46.1-6.el10
ssh-key-dir-0.1.4-9.el10
sssd-2.13.1-2.el10
sssd-ad-2.13.1-2.el10
sssd-client-2.13.1-2.el10
sssd-common-2.13.1-2.el10
sssd-common-pac-2.13.1-2.el10
sssd-ipa-2.13.1-2.el10
sssd-krb5-2.13.1-2.el10
sssd-krb5-common-2.13.1-2.el10
sssd-ldap-2.13.1-2.el10
sssd-nfs-idmap-2.13.1-2.el10
sssd-proxy-2.13.1-2.el10
stalld-1.26.3-1.el10
strace-6.12-3.el10
subscription-manager-1.30.15-1.el10
subscription-manager-rhsm-certificates-20220623-6.el10
sudo-1.9.17-9.p2.el10
systemd-257-32.el10
systemd-journal-remote-257-32.el10
systemd-libs-257-32.el10
systemd-pam-257-32.el10
systemd-udev-257-32.el10
tar-2:1.35-11.el10
tmux-3.3a-14.20230918gitb202a2f.el10
toolbox-0.3-3.el10
tpm2-tools-5.7-6.el10
tpm2-tss-4.1.3-6.el10
tpm2-tss-fapi-4.1.3-6.el10
tzdata-2026c-1.el10
unbound-anchor-1.26.0-1.el10
unbound-libs-1.26.0-1.el10
userspace-rcu-0.14.0-7.el10
util-linux-2.40.2-20.el10
util-linux-core-2.40.2-20.el10
vim-data-2:9.1.083-22.el10
vim-minimal-2:9.1.083-22.el10
virt-what-1.27-3.el10
which-2.21-44.el10
xfsprogs-6.16.0-1.el10
xmlsec1-1:1.2.39-3.el10
xmlsec1-openssl-1:1.2.39-3.el10
xz-1:5.6.2-4.el10
xz-libs-1:5.6.2-4.el10
zlib-ng-compat-2.2.3-3.el10
zram-generator-1.1.2-14.el10
zstd-1.5.5-9.el10

Changed:

NetworkManager 1:1.58~rc1-1.el10 → 1:1.58.0-1.el10
NetworkManager-cloud-setup 1:1.58~rc1-1.el10 → 1:1.58.0-1.el10
NetworkManager-libnm 1:1.58~rc1-1.el10 → 1:1.58.0-1.el10
NetworkManager-ovs 1:1.58~rc1-1.el10 → 1:1.58.0-1.el10
NetworkManager-tui 1:1.58~rc1-1.el10 → 1:1.58.0-1.el10
aardvark-dns 4:2.0.0-2.el10 → 4:2.1.0-1.el10
acl 2.3.2-4.el10 → 2.4.0-2.el10
amd-gpu-firmware 20260722-25.el10 → 20260812-26.el10
amd-ucode-firmware 20260722-25.el10 → 20260812-26.el10
audit 4.0.3-5.el10 → 4.2.1-3.el10
audit-libs 4.0.3-5.el10 → 4.2.1-3.el10
audit-rules 4.0.3-5.el10 → 4.2.1-3.el10
bootc 1.16.2-1.el10 → 1.16.7-1.el10
bsdtar 3.7.7-8.el10 → 3.7.7-10.el10
ca-certificates 2025.2.80_v9.0.305-102.el10 → 2026.2.90_v9.0.316-100.0.el10
coreutils 9.5-12.el10 → 9.5-13.el10
coreutils-common 9.5-12.el10 → 9.5-13.el10
criu 4.2-8.el10 → 4.2-9.el10
criu-libs 4.2-8.el10 → 4.2-9.el10
crun 1.28-1.el10 → 1.29.1-1.el10
crypto-policies 20260708-1.git988eb15.el10 → 20260811-1.git4dcd294.el10
crypto-policies-scripts 20260708-1.git988eb15.el10 → 20260811-1.git4dcd294.el10
cryptsetup 2.8.6-1.el10 → 2.8.6-2.el10
cryptsetup-libs 2.8.6-1.el10 → 2.8.6-2.el10
dnf 4.20.0-26.el10 → 4.20.0-27.el10
dnf-data 4.20.0-26.el10 → 4.20.0-27.el10
dracut 107-9.el10 → 107-10.el10
dracut-network 107-9.el10 → 107-10.el10
dracut-squash 107-9.el10 → 107-10.el10
firewalld-filesystem 2.4.3-2.el10 → 2.4.3-4.el10
flatpak-session-helper 1.18.0-1.el10 → 1.18.0-2.el10
glib2 2.80.4-14.el10 → 2.80.4-15.el10
glibc 2.39-131.el10 → 2.39-136.el10
glibc-common 2.39-131.el10 → 2.39-136.el10
glibc-gconv-extra 2.39-131.el10 → 2.39-136.el10
glibc-minimal-langpack 2.39-131.el10 → 2.39-136.el10
grub2-common 1:2.12-53.el10 → 1:2.12-55.el10
grub2-efi-x64 1:2.12-53.el10 → 1:2.12-55.el10
grub2-pc 1:2.12-53.el10 → 1:2.12-55.el10
grub2-pc-modules 1:2.12-53.el10 → 1:2.12-55.el10
grub2-tools 1:2.12-53.el10 → 1:2.12-55.el10
grub2-tools-minimal 1:2.12-53.el10 → 1:2.12-55.el10
hwdata 0.379-10.9.el10 → 0.379-10.10.el10
intel-gpu-firmware 20260722-25.el10 → 20260812-26.el10
iptables-libs 1.8.11-15.el10 → 1.8.11-16.el10
iptables-nft 1.8.11-15.el10 → 1.8.11-16.el10
iscsi-initiator-utils 6.2.1.11-2.git4b3e853.el10 → 6.2.1.11-4.git4b3e853.el10
iscsi-initiator-utils-iscsiuio 6.2.1.11-2.git4b3e853.el10 → 6.2.1.11-4.git4b3e853.el10
isns-utils-libs 0.103-1.el10 → 0.103-2.el10
kdump-utils 1.0.58-15.el10 → 1.0.61-2.el10
kernel 6.12.0-251.el10 → 6.12.0-260.el10
kernel-core 6.12.0-251.el10 → 6.12.0-260.el10
kernel-modules 6.12.0-251.el10 → 6.12.0-260.el10
kernel-modules-core 6.12.0-251.el10 → 6.12.0-260.el10
kernel-modules-extra 6.12.0-251.el10 → 6.12.0-260.el10
libacl 2.3.2-4.el10 → 2.4.0-2.el10
libarchive 3.7.7-8.el10 → 3.7.7-10.el10
libgcc 14.4.1-1.el10 → 14.4.1-2.el10
libgomp 14.4.1-1.el10 → 14.4.1-2.el10
libibverbs 62.0-2.el10 → 62.0-3.el10
libldb 4.24.3-100.el10 → 4.24.5-101.el10
libnfsidmap 1:2.8.3-8.el10 → 1:2.8.3-9.el10
libnghttp2 1.68.0-5.el10 → 1.68.0-6.el10
libsmbclient 4.24.3-100.el10 → 4.24.5-101.el10
libsolv 0.7.33-5.el10 → 0.7.33-6.el10
libstdc++ 14.4.1-1.el10 → 14.4.1-2.el10
libwbclient 4.24.3-100.el10 → 4.24.5-101.el10
linux-firmware 20260722-25.el10 → 20260812-26.el10
linux-firmware-whence 20260722-25.el10 → 20260812-26.el10
nfs-utils 1:2.8.3-8.el10 → 1:2.8.3-9.el10
nftables 1:1.1.5-5.el10 → 1:1.1.5-6.el10
nmstate 2.2.61-1.el10 → 2.2.61-2.el10
nvidia-gpu-firmware 20260722-25.el10 → 20260812-26.el10
open-vm-tools 13.0.10-1.el10 → 13.1.0-1.el10
openssh 9.9p1-28.el10 → 9.9p1-29.el10
openssh-clients 9.9p1-28.el10 → 9.9p1-29.el10
openssh-server 9.9p1-28.el10 → 9.9p1-29.el10
openssl 1:3.5.7-2.el10 → 1:3.5.7-3.el10
openssl-fips-provider 1:3.5.7-2.el10 → 1:3.5.7-3.el10
openssl-libs 1:3.5.7-2.el10 → 1:3.5.7-3.el10
ostree 2026.2-1.el10 → 2026.3-1.el10
ostree-grub2 2026.2-1.el10 → 2026.3-1.el10
ostree-libs 2026.2-1.el10 → 2026.3-1.el10
passt 0^20260611.ga9c61ff-1.el10 → 0^20260728.gf8df3f1-1.el10
passt-selinux 0^20260611.ga9c61ff-1.el10 → 0^20260728.gf8df3f1-1.el10
podman 7:6.0.2-1.el10 → 7:6.1.0-1.el10
python3-audit 4.0.3-5.el10 → 4.2.1-3.el10
python3-dnf 4.20.0-26.el10 → 4.20.0-27.el10
python3-dnf-plugin-versionlock 4.7.0-11.el10 → 4.7.0-12.el10
python3-dnf-plugins-core 4.7.0-11.el10 → 4.7.0-12.el10
python3-idna 3.7-4.el10 → 3.7-6.el10
qemu-guest-agent 18:10.1.0-24.el10 → 18:10.1.0-26.el10
rdma-core 62.0-2.el10 → 62.0-3.el10
rpm-ostree 2026.2-1.el10 → 2026.2-2.el10
rpm-ostree-libs 2026.2-1.el10 → 2026.2-2.el10
samba-client-libs 4.24.3-100.el10 → 4.24.5-101.el10
samba-common 4.24.3-100.el10 → 4.24.5-101.el10
samba-core-libs 4.24.3-100.el10 → 4.24.5-101.el10
samba-ndr-libs 4.24.3-100.el10 → 4.24.5-101.el10
skopeo 2:1.23.0-1.el10 → 3:1.24.0-1.el10
sos 4.11.2-3.el10 → 4.11.2-5.el10
sqlite-libs 3.46.1-5.el10 → 3.46.1-6.el10
systemd 257-30.el10 → 257-32.el10
systemd-journal-remote 257-30.el10 → 257-32.el10
systemd-libs 257-30.el10 → 257-32.el10
systemd-pam 257-30.el10 → 257-32.el10
systemd-udev 257-30.el10 → 257-32.el10
tpm2-tools 5.7-5.el10 → 5.7-6.el10
unbound-anchor 1.25.1-1.el10 → 1.26.0-1.el10
unbound-libs 1.25.1-1.el10 → 1.26.0-1.el10
vim-data 2:9.1.083-15.el10 → 2:9.1.083-22.el10
vim-minimal 2:9.1.083-15.el10 → 2:9.1.083-22.el10

Extensions

Full list (112 packages)

NetworkManager-libreswan-1.2.30-2.el10.x86_64
binutils-2.41-65.el10.x86_64
binutils-gold-2.41-65.el10.x86_64
bison-3.8.2-9.el10.x86_64
cmake-filesystem-3.31.8-1.el10.x86_64
cpp-14.4.1-2.el10.x86_64
elfutils-debuginfod-client-0.195-1.el10.x86_64
elfutils-libelf-devel-0.195-1.el10.x86_64
flex-2.6.4-19.el10.x86_64
gcc-14.4.1-2.el10.x86_64
glibc-devel-2.39-136.el10.x86_64
groff-base-1.23.0-10.el10.x86_64
kernel-6.12.0-260.el10.x86_64
kernel-core-6.12.0-260.el10.x86_64
kernel-devel-6.12.0-260.el10.x86_64
kernel-headers-6.12.0-260.el10.x86_64
kernel-modules-6.12.0-260.el10.x86_64
kernel-modules-extra-6.12.0-260.el10.x86_64
kernel-rt-core-6.12.0-260.el10.x86_64
kernel-rt-devel-6.12.0-260.el10.x86_64
kernel-rt-modules-6.12.0-260.el10.x86_64
kernel-rt-modules-core-6.12.0-260.el10.x86_64
kernel-rt-modules-extra-6.12.0-260.el10.x86_64
krb5-pkinit-1.21.3-11.el10.x86_64
krb5-workstation-1.21.3-11.el10.x86_64
ldns-1.8.3-19.el10.x86_64
libkadm5-1.21.3-11.el10.x86_64
libmpc-1.3.1-7.el10.x86_64
libqb-2.0.8-6.el10.x86_64
libreswan-5.4-1.el10.x86_64
libreswan-minimal-5.4-1.el10.x86_64
libxcrypt-devel-4.4.36-10.el10.x86_64
libzstd-devel-1.5.5-9.el10.x86_64
lm_sensors-libs-3.6.0-20.el10.x86_64
m4-1.4.19-11.el10.x86_64
make-1:4.4.1-9.el10.x86_64
ncurses-6.4-15.20240127.el10.x86_64
nspr-4.39.0-5.el10.x86_64
nss-3.124.0-5.el10.x86_64
nss-softokn-3.124.0-5.el10.x86_64
nss-softokn-freebl-3.124.0-5.el10.x86_64
nss-sysinit-3.124.0-5.el10.x86_64
nss-tools-3.124.0-5.el10.x86_64
nss-util-3.124.0-5.el10.x86_64
openssl-devel-1:3.5.7-3.el10.x86_64
openvswitch3.5-ipsec-3.5.3-5.el10s.x86_64
pcp-conf-7.1.5-6.el10.x86_64
pcp-libs-7.1.5-6.el10.x86_64
perl-AutoLoader-5.74-514.el10.noarch
perl-B-1.89-514.el10.x86_64
perl-Carp-1.54-511.el10.noarch
perl-Class-Struct-0.68-514.el10.noarch
perl-Data-Dumper-2.189-512.el10.x86_64
perl-Digest-1.20-511.el10.noarch
perl-Digest-MD5-2.59-6.el10.x86_64
perl-DynaLoader-1.56-514.el10.x86_64
perl-Encode-4:3.21-511.el10.x86_64
perl-Errno-1.38-514.el10.x86_64
perl-Exporter-5.78-511.el10.noarch
perl-Fcntl-1.18-514.el10.x86_64
perl-File-Basename-2.86-514.el10.noarch
perl-File-Path-2.18-512.el10.noarch
perl-File-Temp-1:0.231.100-512.el10.noarch
perl-File-stat-1.14-514.el10.noarch
perl-FileHandle-2.05-514.el10.noarch
perl-Getopt-Long-1:2.58-3.el10.noarch
perl-Getopt-Std-1.14-514.el10.noarch
perl-HTTP-Tiny-0.088-512.el10.noarch
perl-IO-1.55-514.el10.x86_64
perl-IO-Socket-IP-0.42-512.el10.noarch
perl-IO-Socket-SSL-2.085-3.el10.noarch
perl-IPC-Open3-1.22-514.el10.noarch
perl-MIME-Base64-3.16-511.el10.x86_64
perl-Mozilla-CA-20231213-5.el10.noarch
perl-NDBM_File-1.17-514.el10.x86_64
perl-Net-SSLeay-1.94-9.el10.x86_64
perl-POSIX-2.20-514.el10.x86_64
perl-PathTools-3.91-512.el10.x86_64
perl-Pod-Escapes-1:1.07-511.el10.noarch
perl-Pod-Perldoc-3.28.01-512.el10.noarch
perl-Pod-Simple-1:3.45-511.el10.noarch
perl-Pod-Usage-4:2.03-511.el10.noarch
perl-Scalar-List-Utils-5:1.63-511.el10.x86_64
perl-SelectSaver-1.02-514.el10.noarch
perl-Socket-4:2.038-511.el10.x86_64
perl-Storable-1:3.32-511.el10.x86_64
perl-Symbol-1.09-514.el10.noarch
perl-Term-ANSIColor-5.01-512.el10.noarch
perl-Term-Cap-1.18-511.el10.noarch
perl-Text-ParseWords-3.31-511.el10.noarch
perl-Text-Tabs+Wrap-2024.001-511.el10.noarch
perl-Time-Local-2:1.350-511.el10.noarch
perl-URI-5.27-3.el10.noarch
perl-base-2.27-514.el10.noarch
perl-constant-1.33-512.el10.noarch
perl-if-0.61.000-514.el10.noarch
perl-interpreter-4:5.40.2-514.el10.x86_64
perl-libnet-3.15-512.el10.noarch
perl-libs-4:5.40.2-514.el10.x86_64
perl-locale-1.12-514.el10.noarch
perl-mro-1.29-514.el10.x86_64
perl-overload-1.37-514.el10.noarch
perl-overloading-0.02-514.el10.noarch
perl-parent-1:0.241-512.el10.noarch
perl-podlators-1:5.01-511.el10.noarch
perl-vars-1.05-514.el10.noarch
protobuf-3.19.6-15.el10.x86_64
python3-openvswitch3.5-3.5.3-5.el10s.x86_64
sysstat-12.7.6-4.el10.x86_64
usbguard-1.1.4-2.el10.x86_64
usbguard-selinux-1.1.4-2.el10.noarch
zlib-ng-compat-devel-2.2.3-3.el10.x86_64

CentOS Stream CoreOS base layer: 10 upgraded from 10.0.20260729-0 to 10.0.20260819-0

GCP-440: Fix GCP boot image discovery from CoreOS base layer: stream metadata #7881

View changelog in Markdown or change previous release:

Source code for this page located on github