# 4.18.60

Created: 2026-11-05 05:35:29 +0000 UTC

Image Digest: `sha256:d0253567dd0d96590d441b63c50cc410eb1ca8bd997116d4dc6717efa6527cdd`


## Changes from 4.18.48

### Components

* Kubectl 1.31.1
* Kubernetes 1.31.14
* Kubernetes Tests 1.31.12
* Red Hat Enterprise Linux CoreOS upgraded from 418.94.202607020219-0 to 418.94.202611030931-0


### Rebuilt images without code change

* [agent-installer-utils](https://github.com/openshift/agent-installer-utils) git [63b87f06](https://github.com/openshift/agent-installer-utils/commit/63b87f06c5586b59ca99d7a4546d4c82b2aa0268) `sha256:0a554420bf16a91a58de520f11a7d230b1778e641bb97c239db6779f9c1febed`
* [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy) git [2f62712d](https://github.com/openshift/apiserver-network-proxy/commit/2f62712d5db70df25490361749e93a552ffb5a24) `sha256:eacd26fad46427dedf2a8049cc73a1cc358f05ee5d025023b0fe0182b3757f75`
* [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws) git [c3951906](https://github.com/openshift/cloud-provider-aws/commit/c395190655cbb92689a572dcd71c4e2a6c5744b5) `sha256:177966042b2df9ad720e729b39e778ea9f695d73992cb47a4573c945c324fa2f`
* [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver) git [96ae9d03](https://github.com/openshift/aws-ebs-csi-driver/commit/96ae9d03d19036e55e33b5935b6caf1ed4de2c73) `sha256:45d09d8efeba3905ccb23df64844c66e4100244a2c303f2a06610e454ffea9a1`
* [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider) git [075d56fd](https://github.com/openshift/aws-encryption-provider/commit/075d56fd8589620b045de0a5a6bb726dd34e380c) `sha256:167ab3fca65dfc163c578b81ef7b9f07fe272c8209a278a89a54fa6f92310053`
* [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws) git [7b6bfc74](https://github.com/openshift/machine-api-provider-aws/commit/7b6bfc7421d1cc700ddbcbf150beccd0ab586183) `sha256:1af8a0148124e8ffdb2804696718cec28ce5578276638a8ad3b7a9d536dd683e`
* [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook) git [f54f9a19](https://github.com/openshift/aws-pod-identity-webhook/commit/f54f9a19adb43b395a880ca046aed0841466c28d) `sha256:91fd48ce4d51acc146ae997ad499e4d74cecdf2136c87b0b654b3b0a8d7665ef`
* [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3) git [80c3a063](https://github.com/openshift/cluster-api-provider-metal3/commit/80c3a0638eacd65c0d6f54fbd3f4c593085528e8) `sha256:37eb4a361b8fe1d7d68ce1f235c61606591c6015792a8e6ece022d1cee2f1d89`
* [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal) git [1ede6c3f](https://github.com/openshift/cluster-api-provider-baremetal/commit/1ede6c3f08d4a3955bfa1ea5cbbd92f9831c78e7) `sha256:dae1a0c07347a992f7c83eeb4eda48017c6a6059d23c3894b2cd8607a3fead9f`
* [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller) git [f892b915](https://github.com/openshift/cloud-network-config-controller/commit/f892b9152672d963b667d6d644e65576946133a3) `sha256:546eaf1c0bed1808e5edc5b2f2bdeb329711e2f6a071b3b71a0cae3e9504418f`
* [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler) git [34730793](https://github.com/openshift/kubernetes-autoscaler/commit/34730793bf4057072ed97b421e6b3af57166cc14) `sha256:fd8753a447ab1e7baca81724bb5ef2581b4972d0b5fc007ac4635547952f48af`
* [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator) git [3e6d1ab1](https://github.com/openshift/cluster-baremetal-operator/commit/3e6d1ab1617c0ec1b5872f258a0c7ec1eb55e079) `sha256:227e908993d76d68bb9df46b06e5c21d285c170d5bf2fb041985112126d5fd4d`
* [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap) git [d1e01954](https://github.com/openshift/cluster-bootstrap/commit/d1e019545aee3250920a01a5f5c465c570de573c) `sha256:4fdc4a82c7a55d85f989e63937c59a33d767e3209f6ed3d882b2a14090b64604`
* [cluster-capi-controllers](https://github.com/openshift/cluster-api) git [c4c8799b](https://github.com/openshift/cluster-api/commit/c4c8799ba15d9a4b7ef8d2fb98fdee351fbae027) `sha256:af669dc1c7ea197bef96975dfbdb50f9c2f13c832ab0f8adfe678ed960cb317f`
* [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator) git [b5b89440](https://github.com/openshift/cluster-capi-operator/commit/b5b89440b706f8760fb0e26938cdbafff265c6bc) `sha256:073ffc76993a1b6e84cf8b473adafc6a2c4ac3d1d961aef7c720a51c15b21450`
* [cluster-config-operator](https://github.com/openshift/cluster-config-operator) git [fe5e9286](https://github.com/openshift/cluster-config-operator/commit/fe5e928628200b49a07aa50e4dfa634fb9452607) `sha256:3c3b53f201fa29f9463fb04d785f9bb7051e70d37310e48027d24c871bb7609d`
* [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator) git [d17bf3a1](https://github.com/openshift/cluster-control-plane-machine-set-operator/commit/d17bf3a1b14e5bc6a8dff6569bfb02d523320990) `sha256:bf2609e9f1d12c7b5dd96799bb5bdc93bb4c5b1467e2c61d93c5ec8fd59f884a`
* [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator) git [1e3caa4b](https://github.com/openshift/cluster-image-registry-operator/commit/1e3caa4b5abe4e3dad914a337f87408d060b1fb2) `sha256:191ab0e5a7993d29e7e9fd8b801d13bac44809cc94a70af4a0029c0f906b1e72`
* [cluster-kube-cluster-api-operator](https://github.com/openshift/cluster-api-operator) git [efe651a9](https://github.com/openshift/cluster-api-operator/commit/efe651a9d382e5e41e480823c12f06e51b5b50d0) `sha256:cf39ee7495fd7ce002f6efe5c43a4476723211f1d8d429a9101732bb6f836183`
* [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator) git [59ba356f](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/commit/59ba356f50ea3128905ffdb7137f868aa0588bab) `sha256:d5ce4fb9ddf85324aa0aae664700e363e465aeb3442c7c1911b1f2df9f34e6cb`
* [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver) git [01d5fbbe](https://github.com/openshift/cluster-machine-approver/commit/01d5fbbe0bb798db32e5168dde46e6ed0c873b36) `sha256:07c4407b8cd091721e488de2505151f376694e2922dd278b4f759d9dcb73e392`
* [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator) git [fa9d9ab4](https://github.com/openshift/cluster-olm-operator/commit/fa9d9ab4f994caca680f0edf3563b03c2e74020c) `sha256:eff95ef6120c83a2350a08d1868172a68f88038cb85c5f652ba34466ea45f08b`
* [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator) git [0a6f6eb9](https://github.com/openshift/cluster-openshift-apiserver-operator/commit/0a6f6eb9efec43dfd3c8570b7a08a3d00afc5534) `sha256:a8390df6931dae6ae0ab651b360ed2c7e7743e22bb1bc2e6a3aedc0aec18ea72`
* [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator) git [f1711cf3](https://github.com/openshift/cluster-openshift-controller-manager-operator/commit/f1711cf30f683ec0eaa187cd5168caae9e8c1254) `sha256:6f13a185385ca7c318fd88df97cd4579b2dd519e22cf8a57d590d4ff347591b5`
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [8caab452](https://github.com/openshift/cluster-update-keys/commit/8caab452b91df0d77ab052b1833a4d54a1374634) `sha256:6844deccbf3156bf1a71fe597103dd43477b497721362fd8f8685ded1bd87df8`
* [configmap-reloader](https://github.com/openshift/configmap-reload) git [e2aaf00a](https://github.com/openshift/configmap-reload/commit/e2aaf00a381b57874178a4272f3bc5257cf8dd98) `sha256:2847361b634b9e7db7dd7808f13e67af4860af54002da9212bed84c80dc2d8c6`
* [container-networking-plugins](https://github.com/openshift/containernetworking-plugins) git [090b88ce](https://github.com/openshift/containernetworking-plugins/commit/090b88ce1854b21afacd8302ab03c7d8aa667070) `sha256:900bc582f49ec28f88acdfc32f2c79a61ff599834559dfafdcacbdc487bfd466`
* [containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins) git [090b88ce](https://github.com/openshift/containernetworking-plugins/commit/090b88ce1854b21afacd8302ab03c7d8aa667070) `sha256:83d0a201cd3b923c12a750a2aa11f5a1cc91433e360435b1d818e287a5bb0049`
* [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar) git [ef93f0be](https://github.com/openshift/csi-node-driver-registrar/commit/ef93f0be8c1056f8ed3b2bd2efc1264e3dc2fb3c) `sha256:3bf1e8c4feabc6d0fda241802f01050afe948322750675d9acedca29554ea68f`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [2e139edc](https://github.com/openshift/driver-toolkit/commit/2e139edc4aeefbbc41536eeeedc91f317f0835fd) `sha256:3d083dee6d7e07d466d2a86acc14567bf7cdbde6a78c357306bc471e42753825`
* [etcd](https://github.com/openshift/etcd) git [b5a4f8d0](https://github.com/openshift/etcd/commit/b5a4f8d079fbb04200251d5a6bc7c56f79d9d1e3) `sha256:3fd5814e01a661e4235482db7199fd67b01c700c8f9da554cdcd63657be04c1a`
* [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp) git [6ea23561](https://github.com/openshift/cloud-provider-gcp/commit/6ea235614f445951c7a4b5525f64f51548461a0d) `sha256:381e62e05672409fc38414aecad33fc51f1562c3fb3399de592e60c466bb6552`
* [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp) git [6d453944](https://github.com/openshift/cluster-api-provider-gcp/commit/6d4539447313cc3ede325e58433b3f8c450e208a) `sha256:525853b7045f31b9cfe57d8600445c7dd9fed897debfcb73060f4aa414611621`
* [gcp-pd-csi-driver-operator](https://github.com/openshift/gcp-pd-csi-driver-operator) git [4432976a](https://github.com/openshift/gcp-pd-csi-driver-operator/commit/4432976ac44305e5f34e97e759728cedd44e8b85) `sha256:31676c1a5d7637df6e0b81691ad971a08487160699f9bea621e63f56d8a30257`
* [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver) git [4f6a6d3b](https://github.com/openshift/ibm-vpc-block-csi-driver/commit/4f6a6d3b806def06b0d1a5a2632bc3ea014687c3) `sha256:6d9650840e03f9957059b124a4d73679b3cd3215bc4eff52189df13de752ab6f`
* [insights-runtime-exporter](https://github.com/openshift/insights-runtime-extractor) git [3d444833](https://github.com/openshift/insights-runtime-extractor/commit/3d444833113258a5606cddc55192c9183d520968) `sha256:2e9fdf56e9bfa37b980a91b6ae7b33a0a45ae5b6c0ddcf0104306281cce886b8`
* [insights-runtime-extractor](https://github.com/openshift/insights-runtime-extractor) git [3d444833](https://github.com/openshift/insights-runtime-extractor/commit/3d444833113258a5606cddc55192c9183d520968) `sha256:a90711f5216e256c27a0023ea3d5d5dd3765712b942dad093a6fbff482c3c15f`
* [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [50ca44fd](https://github.com/openshift/ironic-rhcos-downloader/commit/50ca44fd48943433d502e8bcff3804f5cac7cb5a) `sha256:a3d8786ea9d1b8344d10498d3725a330f92d2275ca9f8bc1be79176da0a976c5`
* [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager) git [cfbae04f](https://github.com/openshift/ironic-static-ip-manager/commit/cfbae04f288d79c123ee8f817d88562948bc6e5c) `sha256:7df378abcc5e0e27b94dec54f1aa6780dbf4c34bf820ecedcb6137ac57d28ce9`
* [keepalived-ipfailover](https://github.com/openshift/images) git [716eb0ef](https://github.com/openshift/images/commit/716eb0efe8473796868c0d5a5574349f15129a6a) `sha256:ab1f5a751baadac984c4d4d13b7edbedf3acbc682a32a5a64d69f56ecd7044d1`
* [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator) git [815b43b7](https://github.com/openshift/kubernetes-kube-storage-version-migrator/commit/815b43b7f7288da76dd314553e113aefe2a5897d) `sha256:85d9d03066f28f40a2e3bfed2d432bc09fb15b5d8a7ea5708e7e1c40415369f5`
* [libvirt-machine-controllers](https://github.com/openshift/cluster-api-provider-libvirt) git [875b03bd](https://github.com/openshift/cluster-api-provider-libvirt/commit/875b03bd28f1104af74413c3bc72e4546a428bf4) `sha256:9d12d4ab58a87f529f943ad7adeb8708f436f31770ee6c82e6280b837bcbfb88`
* [machine-os-images](https://github.com/openshift/machine-os-images) git [b2321b2c](https://github.com/openshift/machine-os-images/commit/b2321b2c9fac3424087f71a1e2cf7b5ce4ccd772) `sha256:b506cc21c0f679047463f86a5c190aacf22461938175461d1869020cf4fdf901`
* [metallb-frr](https://github.com/openshift/frr) git [760c6639](https://github.com/openshift/frr/commit/760c6639a0c4825745d69b389b50689ebc2b8052) `sha256:08f462013020a13e57f014c54d0cf774641bf604d053ab7d17efdbf5d593a780`
* [multus-route-override-cni](https://github.com/openshift/route-override-cni) git [391c1b03](https://github.com/openshift/route-override-cni/commit/391c1b0361e17c5718508810f0bdb6ff66ae6e81) `sha256:c2fa4ace580986852f6dc92bd1d194e6a749d62191475be7e3b861a099e73d3f`
* [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni) git [86191ded](https://github.com/openshift/whereabouts-cni/commit/86191ded510a5ec05f05b77ae847b86f50673258) `sha256:c2efae8d9edc3d7720787b81cda9f04bdf098f098786aaa3d91e4c09db3df451`
* [must-gather](https://github.com/openshift/must-gather) git [bfba924c](https://github.com/openshift/must-gather/commit/bfba924cb4cbb19f4c72d27b7ea5990df60cbc30) `sha256:bb719475a2c45af9a1857926926256d09a2151d85cd01bbfb347d17836284c28`
* [network-interface-bond-cni](https://github.com/openshift/bond-cni) git [e2de9255](https://github.com/openshift/bond-cni/commit/e2de925552f2444fb3b4fac37d36ff7b5fbf58eb) `sha256:9a3992359db920131386e64b191ac9ab1a3b7e71b3416c9be470d7ae06fef479`
* [network-tools](https://github.com/openshift/network-tools) git [47b13549](https://github.com/openshift/network-tools/commit/47b13549115a59d82dbf4c61f9160432608cb9d8) `sha256:f7522ebe3f8f80c75cf2a3041c26dc678325af93d6574bb2a2d7ce3ab59af72d`
* [nutanix-machine-controllers](https://github.com/openshift/machine-api-provider-nutanix) git [afe324bf](https://github.com/openshift/machine-api-provider-nutanix/commit/afe324bf56e0348fb45e5fbb9c832c1587482153) `sha256:c501b7146cd62ab46d91c435f7629e972bea09f84c63042d5262db1ff028deeb`
* [olm-catalogd](https://github.com/openshift/operator-framework-catalogd) git [180aa92c](https://github.com/openshift/operator-framework-catalogd/commit/180aa92c13fda1aa1ae35205c9b380a4ead41e8b) `sha256:2f99f5d53ff8dd8d7e63709667b1587a09ecba436c71dc2c62a4d1e3d9f79507`
* [openshift-apiserver](https://github.com/openshift/openshift-apiserver) git [0185e4bf](https://github.com/openshift/openshift-apiserver/commit/0185e4bf19acafdc9b56984458a1ec5867b11470) `sha256:0a68e7a4e5c70b092b99e584a994b236c2e729908f0081a57ad84deca4c52785`
* [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack) git [d5e6ff9f](https://github.com/openshift/cluster-api-provider-openstack/commit/d5e6ff9f4baf4f306374f894d7b5e3e36ef52520) `sha256:7a40db26292851a3a426b2c3eb92f953ed921191843c4d32ed56b0bad4e83e54`
* [operator-marketplace](https://github.com/operator-framework/operator-marketplace) git [34521c26](https://github.com/operator-framework/operator-marketplace/commit/34521c26450e93eea0379e52f86b02c69fbacb49) `sha256:18b179692f4c1d3a5b77ff4ade13c1fe824906bcfd2386434409dd9698359612`
* [powervs-block-csi-driver](https://github.com/openshift/ibm-powervs-block-csi-driver) git [e8700dfa](https://github.com/openshift/ibm-powervs-block-csi-driver/commit/e8700dfa4d7b191acd1c12a0ed1d54f1c9ac5b3a) `sha256:a563cf328d85c9d82b13cd6e015a41d3f7682cf6c0d3dded0f4b3cb102bac5e7`
* [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator) git [9c9131b7](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/commit/9c9131b7deb794eb8b220c70d4ca6ac245623761) `sha256:a47e5bd6f21980d7aaccd9fde460d3ced339574ef18eb348835c5a9444bb0b41`
* [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs) git [601c30ff](https://github.com/openshift/cloud-provider-powervs/commit/601c30ffc7d3f7303a654aa4bbd4242c8b5ac8ad) `sha256:aa8b0767e2c40ec4980006c829a51c614ea61210de63959ac287c94f66409818`
* [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs) git [74e3ece7](https://github.com/openshift/machine-api-provider-powervs/commit/74e3ece7ce84bef0f21bd1bab775f7e6dabb676b) `sha256:7577bed5ff482e8df14ea8b0bc02bb98c077768c91b7cd19c539f24d2612c4c1`
* rhel-coreos `sha256:63da6a5aea88f89765030e691345ddea3d85442178766cc61cffd37d3ddc3e1f`
* rhel-coreos-extensions `sha256:ad3a45c10fb1a52706e0fde3ea8c892c350c08f4f8fce471a4d7a12bd595fd94`
* [service-ca-operator](https://github.com/openshift/service-ca-operator) git [30efb529](https://github.com/openshift/service-ca-operator/commit/30efb529a5b7db5d6f352f6ac0470d8385268539) `sha256:1d3afef5cb5ad00189db25df6eeed88b93da8c758260c8d221402c2e9b2a1a94`
* [telemeter](https://github.com/openshift/telemeter) git [999cdb5f](https://github.com/openshift/telemeter/commit/999cdb5f7cde3beb8dcf45fe13ba34d0fb5837c4) `sha256:17f4a5dad8c1c3ec5ae68a0c76224f083c64e0edfc8856718a1441bddb1c8b0d`
* [thanos](https://github.com/openshift/thanos) git [265d24eb](https://github.com/openshift/thanos/commit/265d24eb9566214073f08694c2ed8131d35cb53a) `sha256:f3ea5b6a3929672fd16285c026b44860127a9b24c05640801e4b6eb1d8787d24`
* [vsphere-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-vsphere) git [afae9545](https://github.com/openshift/cluster-api-provider-vsphere/commit/afae9545a3b5c205968da051a2ea28126ecba913) `sha256:c54dcb4a52a91f6476baf318d33d1b375d3b2973c4e51bb3d0e34a87d4a4fc50`


### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/da4f7aef264d30604310f9a09271aeecf9a3f767)

* [OCPBUGS-89884](https://issues.redhat.com/browse/OCPBUGS-89884): patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.2 [#10800](https://github.com/openshift/assisted-service/pull/10800)
* [Full changelog](https://github.com/openshift/assisted-service/compare/73206081d00ddfc1a2d9b385b1560564642b79ee...da4f7aef264d30604310f9a09271aeecf9a3f767)


### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/5e9dbe59ccc89ba07bb3d04acc0693700185875c)

* [OCPBUGS-103348](https://issues.redhat.com/browse/OCPBUGS-103348): Bump x/net to v0.35.0-sec.4 [#2297](https://github.com/openshift/assisted-installer/pull/2297)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/81d6bc2771d3d34de3c364e349ca7f2983e454a2...5e9dbe59ccc89ba07bb3d04acc0693700185875c)


### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/1e5183da7dbcde058f44f35771f4ecc471dd7eac)

* [OCPBUGS-103362](https://issues.redhat.com/browse/OCPBUGS-103362): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#1618](https://github.com/openshift/assisted-installer-agent/pull/1618)
* [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/81c09fb75bccd35b2e909537b93e5aa431eeed1a...1e5183da7dbcde058f44f35771f4ecc471dd7eac)


### [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws/tree/f2127465de4e8c3c6fb6cb0c0d3541841a8b8751)

* 🐛 OCPBUGS-134667: UPSTREAM: 6132: Persist ProviderID immediately after instance creation [#668](https://github.com/openshift/cluster-api-provider-aws/pull/668)
* [OCPBUGS-103372](https://issues.redhat.com/browse/OCPBUGS-103372): replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 [#652](https://github.com/openshift/cluster-api-provider-aws/pull/652)
* 🐛 OCPBUGS-123705: UPSTREAM: <carry>: Fix unit tests for OpenShift CI environment [#642](https://github.com/openshift/cluster-api-provider-aws/pull/642)
* 🌱 OCPBUGS-123680: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI [#641](https://github.com/openshift/cluster-api-provider-aws/pull/641)
* [Full changelog](https://github.com/openshift/cluster-api-provider-aws/compare/ed55fc2df3f3bab15f03306df692112f6f109fe4...f2127465de4e8c3c6fb6cb0c0d3541841a8b8751)


### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/14fb0852e9a2c68aca971e9c106d38c3c2301c66)

* [OCPBUGS-103431](https://issues.redhat.com/browse/OCPBUGS-103431), [OCPBUGS-103496](https://issues.redhat.com/browse/OCPBUGS-103496), [OCPBUGS-103518](https://issues.redhat.com/browse/OCPBUGS-103518): Use patched x/net fork v0.35.0-sec.4 [#632](https://github.com/openshift/csi-operator/pull/632)
* [OCPBUGS-103360](https://issues.redhat.com/browse/OCPBUGS-103360), [OCPBUGS-103371](https://issues.redhat.com/browse/OCPBUGS-103371): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#610](https://github.com/openshift/csi-operator/pull/610)
* [Full changelog](https://github.com/openshift/csi-operator/compare/894ba4a33023caa182bce1aeb773b971c3c55209...14fb0852e9a2c68aca971e9c106d38c3c2301c66)


### [azure-cloud-controller-manager, azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure/tree/6902de45abe8ec88980d3eb4621574cae5ab8f1b)

* [OCPBUGS-103373](https://issues.redhat.com/browse/OCPBUGS-103373), [OCPBUGS-103550](https://issues.redhat.com/browse/OCPBUGS-103550): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#208](https://github.com/openshift/cloud-provider-azure/pull/208)
* [Full changelog](https://github.com/openshift/cloud-provider-azure/compare/9795abdcb8f4e643bd1c1cc5b379af8b8962abed...6902de45abe8ec88980d3eb4621574cae5ab8f1b)


### [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure/tree/7e24d10b27c632a28f66a57469fb63c25b68e0c1)

* [OCPBUGS-89899](https://issues.redhat.com/browse/OCPBUGS-89899): Address CVE-2026-39829 [#401](https://github.com/openshift/cluster-api-provider-azure/pull/401)
* [Full changelog](https://github.com/openshift/cluster-api-provider-azure/compare/5206d4fe5b564ca3be17d3f4b41707f796c2ddb9...7e24d10b27c632a28f66a57469fb63c25b68e0c1)


### [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver/tree/9736d81a70d1aecc1ecdeb154106694d627b5754)

* UPSTREAM: 3635: OCPBUGS-103367: Bump golang.org/x/net to v0.43.0-sec.4 [#172](https://github.com/openshift/azure-disk-csi-driver/pull/172)
* [OCPBUGS-114621](https://issues.redhat.com/browse/OCPBUGS-114621): UPSTREAM: 3277: fix: allow `.` in Azure tags [#179](https://github.com/openshift/azure-disk-csi-driver/pull/179)
* [Full changelog](https://github.com/openshift/azure-disk-csi-driver/compare/a16bfa27ab21ad4e663e9802cd9a36d8e1b858fe...9736d81a70d1aecc1ecdeb154106694d627b5754)


### [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver/tree/8acb2cde0a4a2f88aceb91710ea4f63b5778dcd1)

* [OCPBUGS-103366](https://issues.redhat.com/browse/OCPBUGS-103366): Bump golang.org/x/net to v0.35.0-sec.4 [#158](https://github.com/openshift/azure-file-csi-driver/pull/158)
* [OCPBUGS-92789](https://issues.redhat.com/browse/OCPBUGS-92789): Bump golang.org/x/crypto to v0.33.0-sec.3 [#148](https://github.com/openshift/azure-file-csi-driver/pull/148)
* [Full changelog](https://github.com/openshift/azure-file-csi-driver/compare/e45f39e505975f837db08b0644b0ca90ef74f059...8acb2cde0a4a2f88aceb91710ea4f63b5778dcd1)


### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/baf90faf2bdc3d26e571fbcf0266efcb48c58d97)

* [OCPBUGS-80185](https://issues.redhat.com/browse/OCPBUGS-80185): Bump google.golang.org/grpc to 1.64.1-sec.1 patch [#46](https://github.com/openshift/azure-kubernetes-kms/pull/46)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/c937080f51cec58650daa15805be548d09310c64...baf90faf2bdc3d26e571fbcf0266efcb48c58d97)


### [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure/tree/87fd6f710298c181ec6e857925824bd647d4294f)

* [OCPBUGS-103471](https://issues.redhat.com/browse/OCPBUGS-103471): replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 [#213](https://github.com/openshift/machine-api-provider-azure/pull/213)
* [Full changelog](https://github.com/openshift/machine-api-provider-azure/compare/2fdaa544160658c3c4535c167960e4f3e2e70727...87fd6f710298c181ec6e857925824bd647d4294f)


### [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity/tree/63221a401f95f338e198fa9c267d6fba0c50fb09)

* [OCPBUGS-103390](https://issues.redhat.com/browse/OCPBUGS-103390): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#63](https://github.com/openshift/azure-workload-identity/pull/63)
* [Full changelog](https://github.com/openshift/azure-workload-identity/compare/f60e4029d64de202e81d2cd114f8a90dc0a1878e...63221a401f95f338e198fa9c267d6fba0c50fb09)


### [baremetal-installer, installer, installer-altinfra, installer-artifacts](https://github.com/openshift/installer/tree/81f41a3c3b006df3b0db3d70d575027b5aef4c92)

* [OCPBUGS-134631](https://issues.redhat.com/browse/OCPBUGS-134631): Update RHCOS-release-4.18 bootimage metadata to 418.94.202610242013-0 [#11036](https://github.com/openshift/installer/pull/11036)
* NO-JIRA: data/manifests/bootkube/cvo-overrides: Default to eus-4.18 [#11004](https://github.com/openshift/installer/pull/11004)
* [OCPBUGS-103391](https://issues.redhat.com/browse/OCPBUGS-103391), [OCPBUGS-103464](https://issues.redhat.com/browse/OCPBUGS-103464): Bump golang.org/x/net to v0.35.0-sec.4 [#10970](https://github.com/openshift/installer/pull/10970)
* [OCPBUGS-89882](https://issues.redhat.com/browse/OCPBUGS-89882), [OCPBUGS-89888](https://issues.redhat.com/browse/OCPBUGS-89888), [OCPBUGS-89919](https://issues.redhat.com/browse/OCPBUGS-89919), [OCPBUGS-92878](https://issues.redhat.com/browse/OCPBUGS-92878): Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.33.0-sec.4 [#10901](https://github.com/openshift/installer/pull/10901)
* [OCPBUGS-121872](https://issues.redhat.com/browse/OCPBUGS-121872): Update gcloud version to one that can be found [#10857](https://github.com/openshift/installer/pull/10857)
* [OCPBUGS-77052](https://issues.redhat.com/browse/OCPBUGS-77052): Update RHCOS-release-4.18 bootimage metadata to 418.94.202608142238-0 [#10795](https://github.com/openshift/installer/pull/10795)
* [Full changelog](https://github.com/openshift/installer/compare/01812b66eb92aefc97907166e741d41961116eea...81f41a3c3b006df3b0db3d70d575027b5aef4c92)


### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/c138c6f1bd35dc189039a8246eeaf0a83ee5e4b7)

* [OCPBUGS-98321](https://issues.redhat.com/browse/OCPBUGS-98321): Add BMH finalizer on PreprovisioningImage [#509](https://github.com/openshift/baremetal-operator/pull/509)
* [OCPBUGS-59259](https://issues.redhat.com/browse/OCPBUGS-59259): Fix HFC error handling in actionPreparing [#502](https://github.com/openshift/baremetal-operator/pull/502)
* [Full changelog](https://github.com/openshift/baremetal-operator/compare/875fd70126781e84ca950bef17d36a80ca56777b...c138c6f1bd35dc189039a8246eeaf0a83ee5e4b7)


### [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg/tree/16b1030d48c3ec5e5a4f465be9ceb8aded7633a5)

* [OCPBUGS-103376](https://issues.redhat.com/browse/OCPBUGS-103376): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#408](https://github.com/openshift/baremetal-runtimecfg/pull/408)
* [Full changelog](https://github.com/openshift/baremetal-runtimecfg/compare/353410688340dadb583668215e13e2d6cc90e272...16b1030d48c3ec5e5a4f465be9ceb8aded7633a5)


### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/ccb0ad5375f159d7039b291ac2351bcb56daebe1)

* [OCPBUGS-78501](https://issues.redhat.com/browse/OCPBUGS-78501): Makefile: Strip debugging symbols by default [#2227](https://github.com/openshift/oc/pull/2227)
* [OCPBUGS-103346](https://issues.redhat.com/browse/OCPBUGS-103346), [OCPBUGS-103383](https://issues.redhat.com/browse/OCPBUGS-103383): Use patched x/net fork v0.35.0-sec.4 [#2418](https://github.com/openshift/oc/pull/2418)
* [OCPBUGS-91365](https://issues.redhat.com/browse/OCPBUGS-91365), [OCPBUGS-94688](https://issues.redhat.com/browse/OCPBUGS-94688): Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.2 [#2344](https://github.com/openshift/oc/pull/2344)
* [OCPBUGS-109669](https://issues.redhat.com/browse/OCPBUGS-109669): Fix pre-existing unit test failures on release-4.18 [#2372](https://github.com/openshift/oc/pull/2372)
* [Full changelog](https://github.com/openshift/oc/compare/6febe61977471b066f08d513424b226b82ee518f...ccb0ad5375f159d7039b291ac2351bcb56daebe1)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/793d2011d04c81afdcd0176bebd6ad9cd5e9b3a7)

* [OCPBUGS-103387](https://issues.redhat.com/browse/OCPBUGS-103387): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#1100](https://github.com/openshift/cloud-credential-operator/pull/1100)
* [OCPBUGS-81887](https://issues.redhat.com/browse/OCPBUGS-81887): Bump go-jose/go-jose/v4@v4.1.4 [#1031](https://github.com/openshift/cloud-credential-operator/pull/1031)
* [OCPBUGS-80219](https://issues.redhat.com/browse/OCPBUGS-80219): Fix CVE-2026-33186 using openshift-sustaining grpc-go fork [#1041](https://github.com/openshift/cloud-credential-operator/pull/1041)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/363e98bd7ca3872072a8aad152525c61388b10a5...793d2011d04c81afdcd0176bebd6ad9cd5e9b3a7)


### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/86d9846f91c627043128f4854bb6fc34a605b8ce)

* [OCPBUGS-103378](https://issues.redhat.com/browse/OCPBUGS-103378): replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 [#988](https://github.com/openshift/cluster-authentication-operator/pull/988)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/c3be8cbcf52ff107f74fd363bd667d8681e1a0f6...86d9846f91c627043128f4854bb6fc34a605b8ce)


### [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator/tree/6daa3e93947e8a74958a8a747946c060def5e3c7)

* [OCPBUGS-103386](https://issues.redhat.com/browse/OCPBUGS-103386): Bump x/net package in release-4.18 [#388](https://github.com/openshift/cluster-autoscaler-operator/pull/388)
* [Full changelog](https://github.com/openshift/cluster-autoscaler-operator/compare/474ad65cde3d965a565d41cac5bfd96a92f880fa...6daa3e93947e8a74958a8a747946c060def5e3c7)


### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/84a08c1a1d1502b6c03ce53f2d8f5c94a8b2828b)

* [OCPBUGS-103380](https://issues.redhat.com/browse/OCPBUGS-103380): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#513](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/513)
* [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/8abb067318de3cc68967a0f24627c26912242524...84a08c1a1d1502b6c03ce53f2d8f5c94a8b2828b)


### [cluster-config-api](https://github.com/openshift/api/tree/f9b2d1ae30ebf759bc287c38474b41f246852cae)

* [OCPBUGS-98486](https://issues.redhat.com/browse/OCPBUGS-98486): add new serviceAccountToken fs type [#2927](https://github.com/openshift/api/pull/2927)
* [Full changelog](https://github.com/openshift/api/compare/319dc2e492034aab82d4820dd8d8e9a84e31b459...f9b2d1ae30ebf759bc287c38474b41f246852cae)


### [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator/tree/54a9349e3d46979dd943c4b4b7eb4fd4e9b2b494)

* [OCPBUGS-103405](https://issues.redhat.com/browse/OCPBUGS-103405): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#293](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/293)
* [Full changelog](https://github.com/openshift/cluster-csi-snapshot-controller-operator/compare/6fe700087e8be6513285edd18f461790fecc65c3...54a9349e3d46979dd943c4b4b7eb4fd4e9b2b494)


### [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator/tree/d825bd8f39cfd8d10ab9c206ef9a86c88bb68b5f)

* [OCPBUGS-103403](https://issues.redhat.com/browse/OCPBUGS-103403): Use patched x/net fork v0.35.0-sec.4 [#495](https://github.com/openshift/cluster-dns-operator/pull/495)
* [Full changelog](https://github.com/openshift/cluster-dns-operator/compare/7cafd0c7dca2edb154b8444602b600b5901afeba...d825bd8f39cfd8d10ab9c206ef9a86c88bb68b5f)


### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/f3a37e434b476fe7da5d3cdc2c893d1f594a5480)

* [OCPBUGS-103410](https://issues.redhat.com/browse/OCPBUGS-103410): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#1695](https://github.com/openshift/cluster-etcd-operator/pull/1695)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/3af8b9d6ceb707462af67ebbda92ec4c2b341d81...f3a37e434b476fe7da5d3cdc2c893d1f594a5480)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/fdaf5248a73ea29dbfd104fa4583e0461f6ad03a)

* [OCPBUGS-103414](https://issues.redhat.com/browse/OCPBUGS-103414): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 [#1571](https://github.com/openshift/cluster-ingress-operator/pull/1571)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/7ec6093b5e31b50a57eab3653dca09b1bd174fee...fdaf5248a73ea29dbfd104fa4583e0461f6ad03a)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/c7f615ba375151e412bb5d4ac79f3fe5bf6747a8)

* [OCPBUGS-103402](https://issues.redhat.com/browse/OCPBUGS-103402): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#2299](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2299)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/e9bc90906c726823f154c78d3e568c98ff77b6a5...c7f615ba375151e412bb5d4ac79f3fe5bf6747a8)


### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/1bab093a303a38f2a6c8ad14c7e3cecaa412079c)

* [OCPBUGS-103404](https://issues.redhat.com/browse/OCPBUGS-103404): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#961](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/961)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/6347fc8179b2a04d51c99432ae612bf4df595dc0...1bab093a303a38f2a6c8ad14c7e3cecaa412079c)


### [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator/tree/9955cdf445bc69dcd28ca977eb01f77bd0fcca86)

* [OCPBUGS-103397](https://issues.redhat.com/browse/OCPBUGS-103397): [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#669](https://github.com/openshift/cluster-kube-scheduler-operator/pull/669)
* [Full changelog](https://github.com/openshift/cluster-kube-scheduler-operator/compare/4e99db62cea1d2ca48765230c6f5663d1f2c2702...9955cdf445bc69dcd28ca977eb01f77bd0fcca86)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/87b50fc0c80f75b974d1400c8fbcb0a0885d8d66)

* [OCPBUGS-129140](https://issues.redhat.com/browse/OCPBUGS-129140): don't delete admin-owned Alertmanager secrets on destroy [#3142](https://github.com/openshift/cluster-monitoring-operator/pull/3142)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.18] [#3116](https://github.com/openshift/cluster-monitoring-operator/pull/3116)
* [OCPBUGS-103412](https://issues.redhat.com/browse/OCPBUGS-103412): [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#3075](https://github.com/openshift/cluster-monitoring-operator/pull/3075)
* [OCPBUGS-105311](https://issues.redhat.com/browse/OCPBUGS-105311): [release-4.18] wrap library-go resourceCache with mutex for thread safety [#3041](https://github.com/openshift/cluster-monitoring-operator/pull/3041)
* [OCPBUGS-104540](https://issues.redhat.com/browse/OCPBUGS-104540): Backport e2e stabilization 4.18 [#3030](https://github.com/openshift/cluster-monitoring-operator/pull/3030)
* [OCPBUGS-100375](https://issues.redhat.com/browse/OCPBUGS-100375): [release-4.18] fix: watch cluster wide proxy changes and apply changes accordingly [#3024](https://github.com/openshift/cluster-monitoring-operator/pull/3024)
* [OCPBUGS-94081](https://issues.redhat.com/browse/OCPBUGS-94081): ship collector:node_scrape_collector_success:avg to Telemetry [#2992](https://github.com/openshift/cluster-monitoring-operator/pull/2992)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/a5d9f9365333774a287b9a9704e5eed2cd403624...87b50fc0c80f75b974d1400c8fbcb0a0885d8d66)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/bb2b3f7e6f3d628ddde0a17a107f01ce9db34afb)

* [OCPBUGS-100191](https://issues.redhat.com/browse/OCPBUGS-100191): Bump github.com/containernetworking/cni v0.8.0 -> v1.3.0 [#3096](https://github.com/openshift/cluster-network-operator/pull/3096)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/bd2181ac81fe75f9ad611d99ec0a932624a63eaa...bb2b3f7e6f3d628ddde0a17a107f01ce9db34afb)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/0b814c0884a2a0c951dcaf4fe8bb4b5c51038e50)

* [OCPBUGS-69395](https://issues.redhat.com/browse/OCPBUGS-69395): E2E add test to verify guaranteed pod is running after kubelet restart [#1448](https://github.com/openshift/cluster-node-tuning-operator/pull/1448)
* [OCPBUGS-90575](https://issues.redhat.com/browse/OCPBUGS-90575): Requeue PerformanceStatus update when status write fails [#1552](https://github.com/openshift/cluster-node-tuning-operator/pull/1552)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/06b60fc3356f7adf0ba824bbdee7f5951d334b7a...0b814c0884a2a0c951dcaf4fe8bb4b5c51038e50)


### [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller/tree/3b44245d8fe9d9b1083998d8d956c7bc4d96a066)

* [OCPBUGS-98486](https://issues.redhat.com/browse/OCPBUGS-98486): Backport fs type service account token 4.18 [#196](https://github.com/openshift/cluster-policy-controller/pull/196)
* [Full changelog](https://github.com/openshift/cluster-policy-controller/compare/5fd852525909ce6eab52972ba9ce8fcf56528eb9...3b44245d8fe9d9b1083998d8d956c7bc4d96a066)


### [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator/tree/26421cef7240ea338a6d2d7ac4da449e416b22fe)

* [OCPBUGS-133349](https://issues.redhat.com/browse/OCPBUGS-133349): Restrict samples operator access to the global pull-secret- #731 [#731](https://github.com/openshift/cluster-samples-operator/pull/731)
* [Full changelog](https://github.com/openshift/cluster-samples-operator/compare/bc725fd43d29758ad8f704044ccc8abb6926ad84...26421cef7240ea338a6d2d7ac4da449e416b22fe)


### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/475bca99da31d4bb0479affe03f841bbce565c1e)

* [OCPBUGS-103401](https://issues.redhat.com/browse/OCPBUGS-103401): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#735](https://github.com/openshift/cluster-storage-operator/pull/735)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/fe353404924ac4646b18b8312fd213dad2efce4f...475bca99da31d4bb0479affe03f841bbce565c1e)


### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/ad2a48af8a20fb593c8c076db319f5df67497a58)

* [OCPBUGS-103432](https://issues.redhat.com/browse/OCPBUGS-103432): Bump golang.org/x/net to v0.35.0-sec.3 [#1459](https://github.com/openshift/cluster-version-operator/pull/1459)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/f72d7e2c7dc8f5e0bb8687f9b9fd0c918952cbda...ad2a48af8a20fb593c8c076db319f5df67497a58)


### [console](https://github.com/openshift/console/tree/f84a7e9b5009d8f984857a70487c72e0f1fafe64)

* [OCPBUGS-127158](https://issues.redhat.com/browse/OCPBUGS-127158): [release:4.18] linkify-it: Denial of Service via crafted mailto: links [#17381](https://github.com/openshift/console/pull/17381)
* [OCPBUGS-127183](https://issues.redhat.com/browse/OCPBUGS-127183): Re-enable Knative Cypress e2e tests [#16907](https://github.com/openshift/console/pull/16907)
* [OCPBUGS-113759](https://issues.redhat.com/browse/OCPBUGS-113759): block GraphQL introspection over websocket [#17130](https://github.com/openshift/console/pull/17130)
* Fix for OCPBUGS-92075: CVE-2026-44990 [#16717](https://github.com/openshift/console/pull/16717)
* [OCPBUGS-100515](https://issues.redhat.com/browse/OCPBUGS-100515), [OCPBUGS-101791](https://issues.redhat.com/browse/OCPBUGS-101791): Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss [#17058](https://github.com/openshift/console/pull/17058)
* [OCPBUGS-98420](https://issues.redhat.com/browse/OCPBUGS-98420): [release-4.18] CVE-2026-59869 bump js-yaml [#17076](https://github.com/openshift/console/pull/17076)
* [OCPBUGS-81520](https://issues.redhat.com/browse/OCPBUGS-81520): Console can only show user name instead of full name as the display name [#16238](https://github.com/openshift/console/pull/16238)
* [OCPBUGS-86740](https://issues.redhat.com/browse/OCPBUGS-86740), [OCPBUGS-87085](https://issues.redhat.com/browse/OCPBUGS-87085), [OCPBUGS-97763](https://issues.redhat.com/browse/OCPBUGS-97763): [release-4.18] bump package: protobufjs, fast-uri [#16728](https://github.com/openshift/console/pull/16728)
* [OCPBUGS-100069](https://issues.redhat.com/browse/OCPBUGS-100069): quickstart page i18n misses (Fix Quick Starts i18n bundle lookup for zh-CN) [#16872](https://github.com/openshift/console/pull/16872)
* [OCPBUGS-91944](https://issues.redhat.com/browse/OCPBUGS-91944): Prevent binary secret data corruption when editing [#16673](https://github.com/openshift/console/pull/16673)
* [OCPBUGS-99487](https://issues.redhat.com/browse/OCPBUGS-99487): Disable Knative e2e Cypress tests in CI [#16803](https://github.com/openshift/console/pull/16803)
* [OCPBUGS-99648](https://issues.redhat.com/browse/OCPBUGS-99648): Disable shipwright e2e tests to unblock CI [#16818](https://github.com/openshift/console/pull/16818)
* [OCPBUGS-86453](https://issues.redhat.com/browse/OCPBUGS-86453): [release-4.18] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators [#16511](https://github.com/openshift/console/pull/16511)
* Fix for OCPBUGS-81604: CVE-2026-4800 [#16563](https://github.com/openshift/console/pull/16563)
* [OCPBUGS-84284](https://issues.redhat.com/browse/OCPBUGS-84284): Bump follow-redirects to 1.16.0 to fix CVE-2026-40895 [#16675](https://github.com/openshift/console/pull/16675)
* [Full changelog](https://github.com/openshift/console/compare/be41863583f78b652b706ea665e8990213ac7299...f84a7e9b5009d8f984857a70487c72e0f1fafe64)


### [console-operator](https://github.com/openshift/console-operator/tree/2a0ef19e3ec9f8bfaba5cc758ffe36047ba2f57d)

* [OCPBUGS-103424](https://issues.redhat.com/browse/OCPBUGS-103424): Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 [#1223](https://github.com/openshift/console-operator/pull/1223)
* [OCPBUGS-98985](https://issues.redhat.com/browse/OCPBUGS-98985): [4.18] Stabilize telemetry config to prevent continuous console pod rollouts [#1190](https://github.com/openshift/console-operator/pull/1190)
* [Full changelog](https://github.com/openshift/console-operator/compare/3f78ddd562b8a901ad30cb7b18b4c27e703561bd...2a0ef19e3ec9f8bfaba5cc758ffe36047ba2f57d)


### [coredns](https://github.com/openshift/coredns/tree/7733e9afa9d33e83e9ab29b96388db049995b6b0)

* [OCPBUGS-103421](https://issues.redhat.com/browse/OCPBUGS-103421): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#205](https://github.com/openshift/coredns/pull/205)
* [Full changelog](https://github.com/openshift/coredns/compare/8ca7f02b8becb40f7a9919243000e2620d7036d4...7733e9afa9d33e83e9ab29b96388db049995b6b0)


### [csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/7b121515d0ff61b5d2458c999c3c8fc8c1b41b9b)

* [OCPBUGS-103493](https://issues.redhat.com/browse/OCPBUGS-103493), [OCPBUGS-103494](https://issues.redhat.com/browse/OCPBUGS-103494): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#422](https://github.com/openshift/cloud-provider-openstack/pull/422)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/a34070f9a9880fcbc3ac3d0d81c04f932a7afabf...7b121515d0ff61b5d2458c999c3c8fc8c1b41b9b)


### [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs/tree/a651acb2e777e4738869e108dc73a5555f8a79cc)

* [OCPBUGS-82754](https://issues.redhat.com/browse/OCPBUGS-82754): Bump github.com/moby/spdystream@v0.5.1 [#194](https://github.com/openshift/csi-driver-nfs/pull/194)
* [Full changelog](https://github.com/openshift/csi-driver-nfs/compare/810e0dc1c2a876dfdc04a67117031823a5f428c4...a651acb2e777e4738869e108dc73a5555f8a79cc)


### [csi-external-attacher](https://github.com/openshift/csi-external-attacher/tree/0348cc3dc6afbff8eddbdc85aadf599117d8c82d)

* UPSTREAM: 110: OCPBUGS-103429: Bump golang.org/x/net to v0.35.0-sec.4 [#115](https://github.com/openshift/csi-external-attacher/pull/115)
* [Full changelog](https://github.com/openshift/csi-external-attacher/compare/e3557783bfedc72893bffe0a9dcb8550e47b77b6...0348cc3dc6afbff8eddbdc85aadf599117d8c82d)


### [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner/tree/5945a3a19bc358904dd16bdc1f172dce6e2d256b)

* [OCPBUGS-92883](https://issues.redhat.com/browse/OCPBUGS-92883): Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.33.0-sec.5 to address CVE-2026-46597 [#163](https://github.com/openshift/csi-external-provisioner/pull/163)
* [Full changelog](https://github.com/openshift/csi-external-provisioner/compare/c5e3a50d14d92b5e3bc155fe91837640c0b9dec2...5945a3a19bc358904dd16bdc1f172dce6e2d256b)


### [csi-external-resizer](https://github.com/openshift/csi-external-resizer/tree/7e33709d63c9f22c6aeeb2137708c8aba512e711)

* [OCPBUGS-103430](https://issues.redhat.com/browse/OCPBUGS-103430): Bump golang.org/x/net to v0.35.0-sec.4 [#213](https://github.com/openshift/csi-external-resizer/pull/213)
* [OCPBUGS-80257](https://issues.redhat.com/browse/OCPBUGS-80257): Bump google.golang.org/grpc to v1.79.3 [#203](https://github.com/openshift/csi-external-resizer/pull/203)
* [Full changelog](https://github.com/openshift/csi-external-resizer/compare/a14236907d2e7f3f0342d399f01ad38ee66b3346...7e33709d63c9f22c6aeeb2137708c8aba512e711)


### [csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook](https://github.com/openshift/csi-external-snapshotter/tree/df7707f06925800ea55ff8038665a3191867c163)

* [OCPBUGS-127502](https://issues.redhat.com/browse/OCPBUGS-127502): [release-4.18] OCPBUGS-127500: UPSTREAM: 1392: Fix VolumeSnapshotContent deletion [#257](https://github.com/openshift/csi-external-snapshotter/pull/257)
* [OCPBUGS-103427](https://issues.redhat.com/browse/OCPBUGS-103427), [OCPBUGS-103428](https://issues.redhat.com/browse/OCPBUGS-103428): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 [#228](https://github.com/openshift/csi-external-snapshotter/pull/228)
* [Full changelog](https://github.com/openshift/csi-external-snapshotter/compare/70500bf5ddedfc38ce3010e8007e07ac98569c56...df7707f06925800ea55ff8038665a3191867c163)


### [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe/tree/0f1aff4017cda59d2b1130bc69f7412e5e85b25a)

* [OCPBUGS-103425](https://issues.redhat.com/browse/OCPBUGS-103425): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#103](https://github.com/openshift/csi-livenessprobe/pull/103)
* [Full changelog](https://github.com/openshift/csi-livenessprobe/compare/3a977844a9373d9b330fa923994a4c800e2cc745...0f1aff4017cda59d2b1130bc69f7412e5e85b25a)


### [docker-builder](https://github.com/openshift/builder/tree/c79e9bd005935182ea2b7631b68778a8ffc28d3d)

* [OCPBUGS-89907](https://issues.redhat.com/browse/OCPBUGS-89907), [OCPBUGS-90327](https://issues.redhat.com/browse/OCPBUGS-90327), [OCPBUGS-92414](https://issues.redhat.com/browse/OCPBUGS-92414), [OCPBUGS-92621](https://issues.redhat.com/browse/OCPBUGS-92621), [OCPBUGS-92892](https://issues.redhat.com/browse/OCPBUGS-92892): Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 [#549](https://github.com/openshift/builder/pull/549)
* [Full changelog](https://github.com/openshift/builder/compare/529c96880ce41820700cf38ed8b6619697b71de9...c79e9bd005935182ea2b7631b68778a8ffc28d3d)


### [docker-registry](https://github.com/openshift/image-registry/tree/2047e0a3849170b035bd7079c533c1eaa871dd8b)

* [OCPBUGS-103437](https://issues.redhat.com/browse/OCPBUGS-103437): [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#480](https://github.com/openshift/image-registry/pull/480)
* [Full changelog](https://github.com/openshift/image-registry/compare/5c3675514f52b485e7e369757aa9d4f7358bbd4f...2047e0a3849170b035bd7079c533c1eaa871dd8b)


### [egress-router-cni](https://github.com/openshift/egress-router-cni/tree/632b6ad446da77c12005c6b2e4da5086ce84e6e4)

* [OCPBUGS-100191](https://issues.redhat.com/browse/OCPBUGS-100191): Bump containernetworking/cni to v1.3.0 github.com/containernetworking/plugins to 1.4.0 [#109](https://github.com/openshift/egress-router-cni/pull/109)
* [Full changelog](https://github.com/openshift/egress-router-cni/compare/3193a756d60e14f7139992e2e42b7036955652e7...632b6ad446da77c12005c6b2e4da5086ce84e6e4)


### [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp/tree/f15d4a247196831c454e1b3824e7eb9193df83a4)

* [OCPBUGS-103482](https://issues.redhat.com/browse/OCPBUGS-103482): Bump golang.org/x/net to v0.35.0-sec.3 [#189](https://github.com/openshift/machine-api-provider-gcp/pull/189)
* [Full changelog](https://github.com/openshift/machine-api-provider-gcp/compare/626437394792d7e7cb1aa65fe5906b3459b55f25...f15d4a247196831c454e1b3824e7eb9193df83a4)


### [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver/tree/5b3b9a6d4131fa538721d7db0a17a64dac9f79ae)

* [OCPBUGS-103438](https://issues.redhat.com/browse/OCPBUGS-103438): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#145](https://github.com/openshift/gcp-pd-csi-driver/pull/145)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver/compare/96f27ae38782a2c62cfd6ec08406eeb3e7dfbbc6...5b3b9a6d4131fa538721d7db0a17a64dac9f79ae)


### [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook/tree/baa06e916eb935cb65c93b2b7167e245f4ab170b)

* [OCPBUGS-103450](https://issues.redhat.com/browse/OCPBUGS-103450): Replace golang.org/x/net with github.com/openshift-sustaining/net v0.35.0-sec.4 [#26](https://github.com/openshift/gcp-workload-identity-federation-webhook/pull/26)
* [Full changelog](https://github.com/openshift/gcp-workload-identity-federation-webhook/compare/f0a670c7ad8f3694c87f2e3d9e6e7c024f49b411...baa06e916eb935cb65c93b2b7167e245f4ab170b)


### [haproxy-router](https://github.com/openshift/router/tree/347f03e9d6caaf6bf249bf1d2075965112eab228)

* [OCPBUGS-86726](https://issues.redhat.com/browse/OCPBUGS-86726): Prevent SSRF via FQDN-typed EndpointSlices [#821](https://github.com/openshift/router/pull/821)
* [OCPBUGS-86715](https://issues.redhat.com/browse/OCPBUGS-86715): Strip X-SSL-* headers for plain HTTP [#800](https://github.com/openshift/router/pull/800)
* [Full changelog](https://github.com/openshift/router/compare/8f68a7349a85ac34dc9de9c88767c60000713575...347f03e9d6caaf6bf249bf1d2075965112eab228)


### [hyperkube, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/b930000f05a24910f41ea92fa881d3ab4f3d966c)

* [OCPBUGS-82737](https://issues.redhat.com/browse/OCPBUGS-82737), [OCPBUGS-82761](https://issues.redhat.com/browse/OCPBUGS-82761): Address CVE-2026-35469 [#2689](https://github.com/openshift/kubernetes/pull/2689)
* [Full changelog](https://github.com/openshift/kubernetes/compare/91c24081f468e7636c824f4f5a2eb68660b81012...b930000f05a24910f41ea92fa881d3ab4f3d966c)


### [hypershift](https://github.com/openshift/hypershift/tree/1c158a12a213776691886dbf74fd9401532bc63c)

* [ACM-45149](https://issues.redhat.com/browse/ACM-45149): Migrate Go builder for hypershift-cli, hypershift-release [#10068](https://github.com/openshift/hypershift/pull/10068)
* [OCPBUGS-131922](https://issues.redhat.com/browse/OCPBUGS-131922): Router publish strategy related changes for IBM Cloud platform [#10007](https://github.com/openshift/hypershift/pull/10007)
* fix(deps): OCPBUGS-76288: Update runc, selinux, and their transitive deps to fix CVE-2025-52881 [#8289](https://github.com/openshift/hypershift/pull/8289)
* [ACM-37663](https://issues.redhat.com/browse/ACM-37663): Rebase hypershift operator runtime image to RHEL 9.8 ELS [#9451](https://github.com/openshift/hypershift/pull/9451)
* [ACM-38044](https://issues.redhat.com/browse/ACM-38044): update Containerfile.cli base images to floating tags [release-4.18] [#9044](https://github.com/openshift/hypershift/pull/9044)
* [OCPBUGS-99142](https://issues.redhat.com/browse/OCPBUGS-99142): fix(backport): konnectivity agent auth [#9096](https://github.com/openshift/hypershift/pull/9096)
* [OCPBUGS-62756](https://issues.redhat.com/browse/OCPBUGS-62756): Restart HCP on stale serving certs [#8245](https://github.com/openshift/hypershift/pull/8245)
* [Full changelog](https://github.com/openshift/hypershift/compare/f0bf6ce67467130fafbb7775a43564912e2c8fae...1c158a12a213776691886dbf74fd9401532bc63c)


### [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm/tree/b801da5863cfbf9891c96b123a58e11c4e1e5091)

* [OCPBUGS-120695](https://issues.redhat.com/browse/OCPBUGS-120695): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#114](https://github.com/openshift/cloud-provider-ibm/pull/114)
* [Full changelog](https://github.com/openshift/cloud-provider-ibm/compare/a33026b12f204a9fe2580fcce13d52b11cfb1b1c...b801da5863cfbf9891c96b123a58e11c4e1e5091)


### [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/tree/8bad5372aed998a1505b15a9d4826c26d9c44ff6)

* [OCPBUGS-103440](https://issues.redhat.com/browse/OCPBUGS-103440): Use patched x/net fork v0.35.0-sec.4 [#189](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/189)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/compare/1c7bc07e69c1e74a36b39b31f878da6391fdeefe...8bad5372aed998a1505b15a9d4826c26d9c44ff6)


### [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud/tree/2394335b884bd08f6d7f0017a537aeef4663addb)

* [OCPBUGS-103453](https://issues.redhat.com/browse/OCPBUGS-103453): Replace golang.org/x/net with openshift-sustaining/net [#172](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/172)
* [OCPBUGS-115513](https://issues.redhat.com/browse/OCPBUGS-115513): Fetch envtest assets from the controller-tools releases [#183](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/183)
* [Full changelog](https://github.com/openshift/cluster-api-provider-ibmcloud/compare/4a0c35b0464d5c0ae9d61b656b4d0d51c3085b7c...2394335b884bd08f6d7f0017a537aeef4663addb)


### [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud/tree/f2a7a281512de89371799b269aadd8af5419ae37)

* [OCPBUGS-103467](https://issues.redhat.com/browse/OCPBUGS-103467): replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 [#104](https://github.com/openshift/machine-api-provider-ibmcloud/pull/104)
* [OCPBUGS-41223](https://issues.redhat.com/browse/OCPBUGS-41223): Updating ose-ibmcloud-machine-controllers-container image to be consistent with ART for 4.18 [#45](https://github.com/openshift/machine-api-provider-ibmcloud/pull/45)
* NO-JIRA: vendor golint instead of relying on the CI build root [#115](https://github.com/openshift/machine-api-provider-ibmcloud/pull/115)
* [Full changelog](https://github.com/openshift/machine-api-provider-ibmcloud/compare/6cc2b5e0cf0c8c36e0db6580797a8b09a5793020...f2a7a281512de89371799b269aadd8af5419ae37)


### [insights-operator](https://github.com/openshift/insights-operator/tree/1a2a4c25f94ca12851d665501b52e946ecede82a)

* [OCPBUGS-103459](https://issues.redhat.com/browse/OCPBUGS-103459): Bump golang.org/x/net to v0.35.0-sec.3 [#1355](https://github.com/openshift/insights-operator/pull/1355)
* [Full changelog](https://github.com/openshift/insights-operator/compare/f91e85afe7b21ca5f37ea1934b46f385b3fcb19c...1a2a4c25f94ca12851d665501b52e946ecede82a)


### [ironic](https://github.com/openshift/ironic-image/tree/3b9ae090705e9013364e489e8b4a6065aa43a94e)

* [OCPBUGS-88475](https://issues.redhat.com/browse/OCPBUGS-88475): Updating openstack-ironic commit that fixes CVE-2026-43003 [#903](https://github.com/openshift/ironic-image/pull/903)
* [OCPBUGS-105860](https://issues.redhat.com/browse/OCPBUGS-105860): update ironic pin to include CVE-2026-54423 fix (release-4.18) [#893](https://github.com/openshift/ironic-image/pull/893)
* [OCPBUGS-100164](https://issues.redhat.com/browse/OCPBUGS-100164): Update openstack-ironic commit hash for CVE-2026-44918 [#888](https://github.com/openshift/ironic-image/pull/888)
* [Full changelog](https://github.com/openshift/ironic-image/compare/75856ee3e738e9941b57881e31a307c1d79a4ee8...3b9ae090705e9013364e489e8b4a6065aa43a94e)


### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/00262e5c67e6c7f2f2d6ef761fb28bef983bd0d7)

* [OCPBUGS-99888](https://issues.redhat.com/browse/OCPBUGS-99888): Correct ironic-python-agent pin to include the CVE-2026-66138 fix [#314](https://github.com/openshift/ironic-agent-image/pull/314)
* [OCPBUGS-88475](https://issues.redhat.com/browse/OCPBUGS-88475): Update openstack-ironic-python-agent commit hash that address CVE-2026-43003 [#313](https://github.com/openshift/ironic-agent-image/pull/313)
* [OCPBUGS-99888](https://issues.redhat.com/browse/OCPBUGS-99888): Bump ironic-python-agent pinned commit for CVE-2026-66138 [#308](https://github.com/openshift/ironic-agent-image/pull/308)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/d55339babb392bc6b8e2a3998a3c77b3d47429f1...00262e5c67e6c7f2f2d6ef761fb28bef983bd0d7)


### [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server/tree/4e8a8ef4478a20adb21ad2a494caca9bd2561e1d)

* NO-ISSUE: synchronize OWNERS from main branch [release-4.18] [#81](https://github.com/openshift/kubernetes-metrics-server/pull/81)
* [Full changelog](https://github.com/openshift/kubernetes-metrics-server/compare/db0d060061c610ec87a6583aff0c8e4ba9e4fa07...4e8a8ef4478a20adb21ad2a494caca9bd2561e1d)


### [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy/tree/f72b2ec69dc82611820dff33470c73cc0254415e)

* [OCPBUGS-39450](https://issues.redhat.com/browse/OCPBUGS-39450): Updating kube-rbac-proxy-container image to be consistent with ART for 4.18 [#105](https://github.com/openshift/kube-rbac-proxy/pull/105)
* [Full changelog](https://github.com/openshift/kube-rbac-proxy/compare/5a14ea9d338b2582c7c2a8f89f351a0c30f56371...f72b2ec69dc82611820dff33470c73cc0254415e)


### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/822eb88a279b48089914eac3faa3db160383adcd)

* [OCPBUGS-103452](https://issues.redhat.com/browse/OCPBUGS-103452): Use patched x/net fork v0.35.0-sec.4 [#164](https://github.com/openshift/kube-state-metrics/pull/164)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.18] [#172](https://github.com/openshift/kube-state-metrics/pull/172)
* [Full changelog](https://github.com/openshift/kube-state-metrics/compare/046193a8872c145150c28160577002bfd453b2f5...822eb88a279b48089914eac3faa3db160383adcd)


### [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt/tree/1d880a29214ba93d2246cbd6658f40d4c533309b)

* [OCPBUGS-39554](https://issues.redhat.com/browse/OCPBUGS-39554): Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 4.18 [#45](https://github.com/openshift/cloud-provider-kubevirt/pull/45)
* [Full changelog](https://github.com/openshift/cloud-provider-kubevirt/compare/cf24ee44a188fd3c77c3d61b1d77de0cc9734133...1d880a29214ba93d2246cbd6658f40d4c533309b)


### [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver/tree/140f6dfca3393bfb69842c558cabdcd2d6082667)

* [OCPBUGS-80191](https://issues.redhat.com/browse/OCPBUGS-80191): Bump google.golang.org/grpc to v1.79.3 [#101](https://github.com/openshift/kubevirt-csi-driver/pull/101)
* [Full changelog](https://github.com/openshift/kubevirt-csi-driver/compare/c323ecc7e44eec1ac2f5da97e1579df29f78cd1f...140f6dfca3393bfb69842c558cabdcd2d6082667)


### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/bdfe53f860aea1a4f18ed97bf4b026168baff669)

* [OCPBUGS-103469](https://issues.redhat.com/browse/OCPBUGS-103469): replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 [#1545](https://github.com/openshift/machine-api-operator/pull/1545)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/b3a96a466d238ecc73238f57b7fc14a6d9929d9a...bdfe53f860aea1a4f18ed97bf4b026168baff669)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/f6da18fbc1ae60c86633f5737e80ebbbaa329eae)

* [OCPBUGS-103483](https://issues.redhat.com/browse/OCPBUGS-103483): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#6507](https://github.com/openshift/machine-config-operator/pull/6507)
* [OCPBUGS-129117](https://issues.redhat.com/browse/OCPBUGS-129117): Degraded MCP as generated-kubelet is generated with an old controller version [#6624](https://github.com/openshift/machine-config-operator/pull/6624)
* [OCPBUGS-127017](https://issues.redhat.com/browse/OCPBUGS-127017): Update message for MachineOSBuildFailed condition [#6566](https://github.com/openshift/machine-config-operator/pull/6566)
* [OCPBUGS-122250](https://issues.redhat.com/browse/OCPBUGS-122250): Add missing verb in MCC RBAC [#6540](https://github.com/openshift/machine-config-operator/pull/6540)
* [OCPBUGS-105477](https://issues.redhat.com/browse/OCPBUGS-105477): Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole [#6391](https://github.com/openshift/machine-config-operator/pull/6391)
* [OCPBUGS-94116](https://issues.redhat.com/browse/OCPBUGS-94116): move cleanUpDuplicatedMC to avoid double reboot on first updated  [#6249](https://github.com/openshift/machine-config-operator/pull/6249)
* [OCPBUGS-91747](https://issues.redhat.com/browse/OCPBUGS-91747): Verify extension packages are installed [#6216](https://github.com/openshift/machine-config-operator/pull/6216)
* [OCPBUGS-98445](https://issues.redhat.com/browse/OCPBUGS-98445): Remove sensitive ControllerConfig logging [#6294](https://github.com/openshift/machine-config-operator/pull/6294)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/8850344945a77a0361f34c5cbe9891429128e1f4...f6da18fbc1ae60c86633f5737e80ebbbaa329eae)


### [machine-image-customization-controller](https://github.com/openshift/image-customization-controller/tree/f973472f152090aae86e189271fdff66926b75c3)

* [OCPBUGS-103463](https://issues.redhat.com/browse/OCPBUGS-103463): Replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 [#193](https://github.com/openshift/image-customization-controller/pull/193)
* [Full changelog](https://github.com/openshift/image-customization-controller/compare/c8569da6694004a87851b5d7cd0878e964f954a6...f973472f152090aae86e189271fdff66926b75c3)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/2a04ad9d00250b82f93f6c360a8f1487a4c02b17)

* [OU-1589](https://issues.redhat.com/browse/OU-1589): [release-4.18] sanitize linkified URLs in alert annotations [#1378](https://github.com/openshift/monitoring-plugin/pull/1378)
* NO-JIRA: [release-4.18] fix: reduce flakiness by assert charts existence and scroll into view before clicking [#1365](https://github.com/openshift/monitoring-plugin/pull/1365)
* [OU-1241](https://issues.redhat.com/browse/OU-1241): [release-4.18] feat: unset query timeouts so they are defined in the backend [#1359](https://github.com/openshift/monitoring-plugin/pull/1359)
* [OCPBUGS-103481](https://issues.redhat.com/browse/OCPBUGS-103481): CVE-2026-33814-4-18 openshift4/ose-monitoring-plugin-rhel9: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.18] [#1217](https://github.com/openshift/monitoring-plugin/pull/1217)
* NO-JIRA: [release-4.18] Sanitize alert runbook URLs [#1297](https://github.com/openshift/monitoring-plugin/pull/1297)
* [OCPBUGS-98772](https://issues.redhat.com/browse/OCPBUGS-98772): [release-4.18] replace outdated react-linkify dependency [#1179](https://github.com/openshift/monitoring-plugin/pull/1179)
* [OCPBUGS-74461](https://issues.redhat.com/browse/OCPBUGS-74461): CVE-2025-13465 openshift4/ose-monitoring-plugin-rhel9: prototype pollution in _.unset and _.omit functions [openshift-4.18] [#1141](https://github.com/openshift/monitoring-plugin/pull/1141)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/01882e9e933c81141b22d0095827ec5f0ec44ccf...2a04ad9d00250b82f93f6c360a8f1487a4c02b17)


### [multus-admission-controller](https://github.com/openshift/multus-admission-controller/tree/05f3356fb4be70676413675ea488e47781fe0592)

* [OCPBUGS-103470](https://issues.redhat.com/browse/OCPBUGS-103470): bump golang.org/x/net to v0.35.0-sec.3 to fix CVE-2026-33814 [#134](https://github.com/openshift/multus-admission-controller/pull/134)
* [Full changelog](https://github.com/openshift/multus-admission-controller/compare/0d7ea6c766349243ade17707af7bd2b43c3b4b8e...05f3356fb4be70676413675ea488e47781fe0592)


### [multus-cni, multus-cni-microshift](https://github.com/openshift/multus-cni/tree/21aaaf6819c9b2857da2b60d3a29f422dd4c199b)

* [OCPBUGS-103476](https://issues.redhat.com/browse/OCPBUGS-103476), [OCPBUGS-103477](https://issues.redhat.com/browse/OCPBUGS-103477): [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#357](https://github.com/openshift/multus-cni/pull/357)
* [Full changelog](https://github.com/openshift/multus-cni/compare/c5fd5666c4b85bd4b7bcf0a34feedebc05b14827...21aaaf6819c9b2857da2b60d3a29f422dd4c199b)


### [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy/tree/17377e20e5ae6af51e20df9f0713ed9d228e3c2a)

* [OCPBUGS-103473](https://issues.redhat.com/browse/OCPBUGS-103473): [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#128](https://github.com/openshift/multus-networkpolicy/pull/128)
* [Full changelog](https://github.com/openshift/multus-networkpolicy/compare/3362bbc4c47ad7aec4f9551355e32870c30ab7c8...17377e20e5ae6af51e20df9f0713ed9d228e3c2a)


### [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon/tree/0c680e85c5e9361228dfb52e6828fb657d83cf99)

* [OCPBUGS-103472](https://issues.redhat.com/browse/OCPBUGS-103472): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 [#153](https://github.com/openshift/network-metrics-daemon/pull/153)
* [OCPBUGS-130596](https://issues.redhat.com/browse/OCPBUGS-130596): fix golint not found on Go 1.22 CI builder [#156](https://github.com/openshift/network-metrics-daemon/pull/156)
* [Full changelog](https://github.com/openshift/network-metrics-daemon/compare/11e2dec958aa2adcad07b9eecaf8f50479e0880a...0c680e85c5e9361228dfb52e6828fb657d83cf99)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/fefa6cf8efee8e978fe929488e15cff482094fdf)

* [OCPNETUI-168](https://issues.redhat.com/browse/OCPNETUI-168): Update Owners file [#647](https://github.com/openshift/networking-console-plugin/pull/647)
* [OCPBUGS-98784](https://issues.redhat.com/browse/OCPBUGS-98784): Updating linkify-it to 5.0.2 to fix CVE-2026-48801 [#460](https://github.com/openshift/networking-console-plugin/pull/460)
* [OCPBUGS-99991](https://issues.redhat.com/browse/OCPBUGS-99991): Updating networking-console-plugin-container image to be consistent with ART for 4.18 [#454](https://github.com/openshift/networking-console-plugin/pull/454)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/bdabc5fea60d03a276454d2c23cae5b06e4dd07b...fefa6cf8efee8e978fe929488e15cff482094fdf)


### [nutanix-cloud-controller-manager](https://github.com/openshift/cloud-provider-nutanix/tree/1b7075005af65bfa263addeda877e36ba88c49fb)

* [OCPBUGS-103479](https://issues.redhat.com/browse/OCPBUGS-103479): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#77](https://github.com/openshift/cloud-provider-nutanix/pull/77)
* [Full changelog](https://github.com/openshift/cloud-provider-nutanix/compare/d9fe8f38811ca81c23191f0048a70e88b5ccaa04...1b7075005af65bfa263addeda877e36ba88c49fb)


### [oauth-apiserver](https://github.com/openshift/oauth-apiserver/tree/570ffec8aefc28c1e228158b705650f6812cbcfa)

* [OCPBUGS-103486](https://issues.redhat.com/browse/OCPBUGS-103486): Replace golang.org/x/net with github.com/openshift-sustaining/net v0.35.0-sec.4 [#224](https://github.com/openshift/oauth-apiserver/pull/224)
* [Full changelog](https://github.com/openshift/oauth-apiserver/compare/1078b191784c375d31008aef9ee2b8484ca5fe7f...570ffec8aefc28c1e228158b705650f6812cbcfa)


### [oauth-proxy](https://github.com/openshift/oauth-proxy/tree/6f4260c0afab7a8e2f7e911cb32debaa24824957)

* [OCPBUGS-112094](https://issues.redhat.com/browse/OCPBUGS-112094): bugfix: rewrite open redirect strings to '/' [#384](https://github.com/openshift/oauth-proxy/pull/384)
* [Full changelog](https://github.com/openshift/oauth-proxy/compare/9225edb9821cab67ffa628b05e0eed67973436f0...6f4260c0afab7a8e2f7e911cb32debaa24824957)


### [oauth-server](https://github.com/openshift/oauth-server/tree/482941a4cc156f2aa4cb52fa79f7b65ccc8de6b3)

* [OCPBUGS-103490](https://issues.redhat.com/browse/OCPBUGS-103490): Replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 [#281](https://github.com/openshift/oauth-server/pull/281)
* [OCPBUGS-87072](https://issues.redhat.com/browse/OCPBUGS-87072): bugfix: default to english when Accept-Language header contains more than 1000 underscores [#272](https://github.com/openshift/oauth-server/pull/272)
* [Full changelog](https://github.com/openshift/oauth-server/compare/5bb2bc9fd45da4b4291d16e3d615c2beca46f943...482941a4cc156f2aa4cb52fa79f7b65ccc8de6b3)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/a75bd023e2cdcd61b3ad0b09ac1bf250bb4665a1)

* [OCPBUGS-129488](https://issues.redhat.com/browse/OCPBUGS-129488): v1 accept catalog root entries and relative symlink targets [#1578](https://github.com/openshift/oc-mirror/pull/1578)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/22a9fb8772753a2a56aa061b80bdc22ba4b2c992...a75bd023e2cdcd61b3ad0b09ac1bf250bb4665a1)


### [olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller/tree/ec807165b1a8c6c4eff30388ee81ff02ed19a8ef)

* [OCPBUGS-103488](https://issues.redhat.com/browse/OCPBUGS-103488): [release-4.18]  Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#804](https://github.com/openshift/operator-framework-operator-controller/pull/804)
* [OCPBUGS-100434](https://issues.redhat.com/browse/OCPBUGS-100434): increase catalog HTTP client timeout from 10s to 5m [#787](https://github.com/openshift/operator-framework-operator-controller/pull/787)
* [Full changelog](https://github.com/openshift/operator-framework-operator-controller/compare/4ad0b45a9a19025bd724283859b5c1c2df497109...ec807165b1a8c6c4eff30388ee81ff02ed19a8ef)


### [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager/tree/6a1bf7e388dc0f05436651e3bb8d0b44d8845a29)

* [OCPBUGS-103487](https://issues.redhat.com/browse/OCPBUGS-103487): Use patched x/net fork v0.35.0-sec.4 [#457](https://github.com/openshift/openshift-controller-manager/pull/457)
* [Full changelog](https://github.com/openshift/openshift-controller-manager/compare/8ee744063ed12b249f1a2b89e9af4f53b2f1daf7...6a1bf7e388dc0f05436651e3bb8d0b44d8845a29)


### [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics/tree/24f256fe2b9814bfb47d7c5f9934ecfb51707990)

* NO-ISSUE: synchronize OWNERS from main branch [#153](https://github.com/openshift/openshift-state-metrics/pull/153)
* [Full changelog](https://github.com/openshift/openshift-state-metrics/compare/3cca6feee0d646331bdbc9d49732fbdf49448d41...24f256fe2b9814bfb47d7c5f9934ecfb51707990)


### [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack/tree/b8e611fcdd9db2e20e99ac860633078ad0f9313b)

* [OCPBUGS-93867](https://issues.redhat.com/browse/OCPBUGS-93867): Revendor CAPO [#174](https://github.com/openshift/machine-api-provider-openstack/pull/174)
* [Full changelog](https://github.com/openshift/machine-api-provider-openstack/compare/c43dba2c4d9edb0ffc62b71cb26815da31c8b9c8...b8e611fcdd9db2e20e99ac860633078ad0f9313b)


### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/b3573251315be79aa5bbe6a1cb0b5606b5371835)

* [OCPBUGS-103497](https://issues.redhat.com/browse/OCPBUGS-103497), [OCPBUGS-103502](https://issues.redhat.com/browse/OCPBUGS-103502), [OCPBUGS-103503](https://issues.redhat.com/browse/OCPBUGS-103503): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 [#1366](https://github.com/openshift/operator-framework-olm/pull/1366)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/f3a32b076b409a9be12ca8082ef758f4ddffd41e...b3573251315be79aa5bbe6a1cb0b5606b5371835)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/2b8fc771fbcdc1a7c5c4926d38caa4bc021c20ac)

* [OCPBUGS-132721](https://issues.redhat.com/browse/OCPBUGS-132721): Branch Sync release-4.20 to release-4.18 [10-16-2026] [#3553](https://github.com/openshift/ovn-kubernetes/pull/3553)
* [OCPBUGS-129152](https://issues.redhat.com/browse/OCPBUGS-129152): Branch Sync release-4.20 to release-4.18 [10-05-2026] [#3511](https://github.com/openshift/ovn-kubernetes/pull/3511)
* [OCPBUGS-112810](https://issues.redhat.com/browse/OCPBUGS-112810), [OCPBUGS-113507](https://issues.redhat.com/browse/OCPBUGS-113507): Branch Sync release-4.19 to release-4.18 [08-21-2026] [#3410](https://github.com/openshift/ovn-kubernetes/pull/3410)
* [OCPBUGS-105851](https://issues.redhat.com/browse/OCPBUGS-105851): Branch Sync release-4.19 to release-4.18 [08-11-2026] [#3386](https://github.com/openshift/ovn-kubernetes/pull/3386)
* [OCPBUGS-82773](https://issues.redhat.com/browse/OCPBUGS-82773): Bump github.com/moby/spdystream to v0.5.1 [#3321](https://github.com/openshift/ovn-kubernetes/pull/3321)
* [OCPBUGS-98957](https://issues.redhat.com/browse/OCPBUGS-98957): Branch Sync release-4.19 to release-4.18 [07-09-2026] [#3290](https://github.com/openshift/ovn-kubernetes/pull/3290)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/7e6b238838bc25c546022ba4ef3316fa98926d79...2b8fc771fbcdc1a7c5c4926d38caa4bc021c20ac)


### [prom-label-proxy](https://github.com/openshift/prom-label-proxy/tree/0a8af65bb5313067643abe13c0cd3e40a5f078f9)

* NO-ISSUE: synchronize OWNERS from main branch [release-4.18] [#409](https://github.com/openshift/prom-label-proxy/pull/409)
* [Full changelog](https://github.com/openshift/prom-label-proxy/compare/35c1136915f7a6896dfcb479e1f686fd18542856...0a8af65bb5313067643abe13c0cd3e40a5f078f9)


### [prometheus](https://github.com/openshift/prometheus/tree/b22830578f2ea08d5d3fddf846ec9090415ffed1)

* NO-ISSUE: synchronize OWNERS from main branch [#386](https://github.com/openshift/prometheus/pull/386)
* [OCPBUGS-93696](https://issues.redhat.com/browse/OCPBUGS-93696): fix for CVE-2026-42151 [#368](https://github.com/openshift/prometheus/pull/368)
* [OCPBUGS-88628](https://issues.redhat.com/browse/OCPBUGS-88628): remote: validate snappy decoded length before allocation in read endpoint [#346](https://github.com/openshift/prometheus/pull/346)
* [Full changelog](https://github.com/openshift/prometheus/compare/988ce8bbdcaea76028aa84c6bbd2f6a1f08fd1a4...b22830578f2ea08d5d3fddf846ec9090415ffed1)


### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/bf14b2e6ee92f5ef23ffe7e7d152664b1824518b)

* NO-JIRA: synchronize OWNERS with main [#189](https://github.com/openshift/prometheus-alertmanager/pull/189)
* [OCPBUGS-103512](https://issues.redhat.com/browse/OCPBUGS-103512): Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 [#172](https://github.com/openshift/prometheus-alertmanager/pull/172)
* [OCPBUGS-98183](https://issues.redhat.com/browse/OCPBUGS-98183): build(deps): hashicorp/memberlist to a forked version [#165](https://github.com/openshift/prometheus-alertmanager/pull/165)
* [OCPBUGS-100355](https://issues.redhat.com/browse/OCPBUGS-100355): Set testdata CA expiry to 20 years from issue date (#4112) [#148](https://github.com/openshift/prometheus-alertmanager/pull/148)
* [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/2e844270ca5c4fc6d444a77b01d2b79a93405538...bf14b2e6ee92f5ef23ffe7e7d152664b1824518b)


### [prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator/tree/f61f2c8a94852307cdc3a7c3a98604b0d628b40f)

* NO-ISSUE: synchronize OWNERS from main branch [#412](https://github.com/openshift/prometheus-operator/pull/412)
* [OCPBUGS-103510](https://issues.redhat.com/browse/OCPBUGS-103510), [OCPBUGS-103513](https://issues.redhat.com/browse/OCPBUGS-103513): [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#397](https://github.com/openshift/prometheus-operator/pull/397)
* [Full changelog](https://github.com/openshift/prometheus-operator/compare/9bbce0b88e6b5aa4f9069aa202ea1eab1315df82...f61f2c8a94852307cdc3a7c3a98604b0d628b40f)


### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/a990ab3849532fe8ed1523fb4b3ac2d636e460f6)

* [OCPBUGS-103506](https://issues.redhat.com/browse/OCPBUGS-103506): Use patched x/net fork v0.35.0-sec.4 [#196](https://github.com/openshift/node_exporter/pull/196)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.18] [#202](https://github.com/openshift/node_exporter/pull/202)
* [Full changelog](https://github.com/openshift/node_exporter/compare/92e17ff5c45807198adc8b59f5b3f63a9b7f1726...a990ab3849532fe8ed1523fb4b3ac2d636e460f6)


### [route-controller-manager](https://github.com/openshift/route-controller-manager/tree/4c126441740eac46b0153b280f13d9ed54195249)

* [OCPBUGS-103349](https://issues.redhat.com/browse/OCPBUGS-103349): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#110](https://github.com/openshift/route-controller-manager/pull/110)
* [Full changelog](https://github.com/openshift/route-controller-manager/compare/2484b3e8e7fbb8bf14f930a71f56781289276dfa...4c126441740eac46b0153b280f13d9ed54195249)


### [tests](https://github.com/openshift/origin/tree/ccfc4e70bbdb64e2a747f8c86427595c6e6bc09b)

* [OCPBUGS-130856](https://issues.redhat.com/browse/OCPBUGS-130856): stage the creation of test pods to minimize etcd impact [#31740](https://github.com/openshift/origin/pull/31740)
* [Full changelog](https://github.com/openshift/origin/compare/43c5124437fdc7a91708070434fb6beb7d86b92c...ccfc4e70bbdb64e2a747f8c86427595c6e6bc09b)


### [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere/tree/6c0359b9ab45d57ffdebbbba6cf4437b29830459)

* [OCPBUGS-103524](https://issues.redhat.com/browse/OCPBUGS-103524): Replace golang.org/x/net with sustaining fork for CVE-2026-33814 in 4.18 [#135](https://github.com/openshift/cloud-provider-vsphere/pull/135)
* [Full changelog](https://github.com/openshift/cloud-provider-vsphere/compare/b4dbf34a16f6f1f269b7e3ab9409c7e888b822ab...6c0359b9ab45d57ffdebbbba6cf4437b29830459)


### [vsphere-csi-driver, vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver/tree/21d598fe3af8c29c2ed5976c472c5df0f5ba3052)

* [OCPBUGS-92888](https://issues.redhat.com/browse/OCPBUGS-92888): Bump golang.org/x/crypto/ssh to v0.33.0-sec.3 [#193](https://github.com/openshift/vmware-vsphere-csi-driver/pull/193)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver/compare/350463aa3b27dcdddbddde8bb3def350e211078f...21d598fe3af8c29c2ed5976c472c5df0f5ba3052)


### [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator/tree/97f1161c902d0237320719fa41294373a0d97b07)

* [OCPBUGS-103531](https://issues.redhat.com/browse/OCPBUGS-103531): Bump golang.org/x/net to v0.35.0-sec.3 [#356](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/356)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver-operator/compare/e64f4d7f42a14b1e710313b91c16c2c263b1204e...97f1161c902d0237320719fa41294373a0d97b07)


### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/521d379ac390b82dc2904bee4776c26481c6d0e7)

* [OCPBUGS-129532](https://issues.redhat.com/browse/OCPBUGS-129532): Fixed compute cluster permission logic for single fd with read-only custom resourcepool [#245](https://github.com/openshift/vsphere-problem-detector/pull/245)
* [OCPBUGS-103545](https://issues.redhat.com/browse/OCPBUGS-103545): Bump golang.org/x/net to v0.35.0-sec.4 [#233](https://github.com/openshift/vsphere-problem-detector/pull/233)
* [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/60e2b91fa2ce44076d30bc9f41b1a9d0e9113f29...521d379ac390b82dc2904bee4776c26481c6d0e7)