# 4.20.35

Created: 2026-08-20 20:03:01 +0000 UTC

Image Digest: `sha256:ffb9ee7de8d13bce19d67ce5c6c13c56ad8e9e1906341fccc7c5d12e2fb6d97e`


## Changes from 4.20.23

### Components

* Kubectl 1.33.3
* Kubernetes upgraded from 1.33.11 to 1.33.13
* Kubernetes Tests 1.33.4
* Red Hat Enterprise Linux CoreOS upgraded from 9.6.20260512-0 to 9.6.20260818-0



### FeatureGate Changes
| FeatureGate | Default<br/>Hypershift | Default<br/>SelfManagedHA | DevPreviewNoUpgrade<br/>Hypershift | DevPreviewNoUpgrade<br/>SelfManagedHA | TechPreviewNoUpgrade<br/>Hypershift | TechPreviewNoUpgrade<br/>SelfManagedHA  |
| :------ | :---: | :---: | :---: | :---: | :---: | :---:  |
| GatewayAPIWithoutOLM <br/> (5 tests)| Enabled<br/>(New)| Enabled<br/>(New)| Enabled<br/>(New)| Enabled<br/>(New)| Enabled<br/>(New)| Enabled<br/>(New) |


### Removed images

* ovirt-csi-driver
* ovirt-csi-driver-operator


### Rebuilt images without code change

* [agent-installer-csr-approver](https://github.com/openshift/assisted-installer) git [a26df06f](https://github.com/openshift/assisted-installer/commit/a26df06f52f1426defcf42c6cebcec5b7a956df3) `sha256:42f0065eddf7e684de251434040da1dee228e6a6e1ccea6c45e538d983bbeab2`
* [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent) git [637327ec](https://github.com/openshift/assisted-installer-agent/commit/637327ec40cd1f85ac5d7d4f114a2fae89baa8b0) `sha256:31a16e294c2ec642e569b7fd396e2c95b3eaadbcfcb910cd34a89482d8c745c3`
* [agent-installer-orchestrator](https://github.com/openshift/assisted-installer) git [a26df06f](https://github.com/openshift/assisted-installer/commit/a26df06f52f1426defcf42c6cebcec5b7a956df3) `sha256:4d2f609cf8f6680aecc6212938b122e008ad8a06a335a9204a344bc0543d3267`
* [agent-installer-utils](https://github.com/openshift/agent-installer-utils) git [e3e997d9](https://github.com/openshift/agent-installer-utils/commit/e3e997d9f7b84b134a07186de9bddde21598ae32) `sha256:dcf0ad88938496e1e5d96c359d0bfbc35e73db4e04ca8f06c92db71ff0d8ee33`
* [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy) git [11b24a2c](https://github.com/openshift/apiserver-network-proxy/commit/11b24a2c7452ef683a1d989f1016e6e815f5c112) `sha256:b09a5c170f7f9f447ddc1d9008f66d8954debdbcda01d435eff57209dc8ac5be`
* [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws) git [bb88da16](https://github.com/openshift/cloud-provider-aws/commit/bb88da16b29d63573861351afc5ca8c4547775d6) `sha256:187b8bf974febc3b69debefd3439f2adb8bba4b5aaf5763368306748c0b36ed6`
* [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws) git [300439ea](https://github.com/openshift/cluster-api-provider-aws/commit/300439ea0736444a160c061578b3bd8956d4f7e6) `sha256:3db68f5174ff36951e7c90dc1352bfb9e0a0cd8c5d2f414b2741914a1cd58706`
* [aws-karpenter-provider-aws](https://github.com/openshift/aws-karpenter-provider-aws) git [b37141b0](https://github.com/openshift/aws-karpenter-provider-aws/commit/b37141b051bdf790eb7e8f45b95f6bd7dc8140f4) `sha256:30165782ff4612ec2745a4fcd3041192e14a0519517ee05aa7bfac9f726b1fc3`
* [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws) git [999f4f76](https://github.com/openshift/machine-api-provider-aws/commit/999f4f76124e66c7b42af678cb19aff4b29f72d4) `sha256:fcdecb391c423796f02b099232c756a632fcc150c611769016b9369b422fdff7`
* [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook) git [8e83772a](https://github.com/openshift/aws-pod-identity-webhook/commit/8e83772ab8d31b32225744d4f0b0023680692daf) `sha256:dba1b2806dfa7d61186b8707e843a170ce920a7775d975ef03f169bbd5eebc11`
* [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure) git [c29c68dd](https://github.com/openshift/cluster-api-provider-azure/commit/c29c68dd2a576f19771dfd0c349b34f890063cdc) `sha256:4cdc479a8c06f2df60f1c8a6195a14895d3a5cffddc9edeeb6907fb420ff4266`
* [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure) git [68db9150](https://github.com/openshift/machine-api-provider-azure/commit/68db91507ea47f767ee0dc838c08cc371d2ff69f) `sha256:fc753cf0ba9efb3a798e055b5fba628256bb60c82e2dee21162774c5624c4dc0`
* [azure-service-operator](https://github.com/openshift/azure-service-operator) git [d957de42](https://github.com/openshift/azure-service-operator/commit/d957de42c2e6255b79fcfe7aedac78eb746d92cc) `sha256:bbc46313fce4190b996c7be7c96aa4dbe17645ebd83089c882fa9b0c2921cc0b`
* [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3) git [f782ba74](https://github.com/openshift/cluster-api-provider-metal3/commit/f782ba747ed353721c84ceb754ca8403f94adb6a) `sha256:d38ebf2e26d593267958592925ea7078191e5cd1f2cdde75b401a08a912dfac6`
* [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal) git [fb678fec](https://github.com/openshift/cluster-api-provider-baremetal/commit/fb678fec5f7e08348b281341481f33a848204e50) `sha256:fd8aab438654ceb4f2dc7c8a94a010aa39785bee2dcc70e6ddbefbae4ceced76`
* [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg) git [5e602ba7](https://github.com/openshift/baremetal-runtimecfg/commit/5e602ba702420d0f30cee175f51fff83e00c1b5b) `sha256:b1016327a9991a1459cab3233215777ba1ab5459f33a97e8744c266eb1faff32`
* [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller) git [d22915bc](https://github.com/openshift/cloud-network-config-controller/commit/d22915bc82993ce11cb3fb97e6ae00602f30549b) `sha256:92d69cb4f1003ca43cf8bd2d2debdc10baebe96012733ab7a3101909892ede5f`
* [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator) git [569ae680](https://github.com/openshift/cluster-authentication-operator/commit/569ae680cbdf0f78cc0d77278c5178160679fe83) `sha256:93d899a4b57ea4045db5366038e5e5a2122867ca17b1d3d33c37f0ff8b3b84a9`
* [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator) git [147e5a7f](https://github.com/openshift/cluster-autoscaler-operator/commit/147e5a7ff20b46ade7dd932b47e06ca82729f5e8) `sha256:bd0eeaa9240c14f1122a2d24ff82e6bed52c99a724fbf91122016f1b0b9737f2`
* [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap) git [74abc555](https://github.com/openshift/cluster-bootstrap/commit/74abc555111bac56a67957ef517ef086e4643c50) `sha256:83af3fab5e46db27ef03b5c4e098425c89ebe57111bf8352a26ff34a32fd7538`
* [cluster-capi-controllers](https://github.com/openshift/cluster-api) git [dfeecf96](https://github.com/openshift/cluster-api/commit/dfeecf9616e049ac552f91a71b2a50cb0e96042c) `sha256:175f3cfb08ea890565ece567dfa524b5443d03cf0554765f1906231abeeb3d16`
* [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator) git [276696cc](https://github.com/openshift/cluster-cloud-controller-manager-operator/commit/276696ccf679830b25df341edb7aae9bb3f4e763) `sha256:e4f54827f43d91b7be435877e89f455d7100eea5765b62f45b68b6bfd6b3d8db`
* [cluster-config-operator](https://github.com/openshift/cluster-config-operator) git [657754e2](https://github.com/openshift/cluster-config-operator/commit/657754e2beaed6295ff28bb0f7813cb1c9ce35b2) `sha256:12eb76a94007c2fd9077cd989a70536e25dadb31ac042d3e88d868c9707d973d`
* [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator) git [0bbafe24](https://github.com/openshift/cluster-control-plane-machine-set-operator/commit/0bbafe24ade564bc62554251f36de90d524abcde) `sha256:cdd25f060787490316a57377d3388f1f8141f2cf39cd5d0a7925ba7386785f19`
* [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator) git [a99bd8ff](https://github.com/openshift/cluster-csi-snapshot-controller-operator/commit/a99bd8ffb9aa596fa8d6932d5d93e0613c5d367f) `sha256:f090687a982f4743985ed0111edebc360838a80ac0869ebdd0378da2af569d92`
* [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator) git [82578923](https://github.com/openshift/cluster-dns-operator/commit/82578923164636746e0d74d594ab32d83a660c0b) `sha256:a0d0d60747cf374c682f47fae0789505e828292a51f746cff2c0c85eac18e963`
* [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator) git [b04c7c12](https://github.com/openshift/cluster-image-registry-operator/commit/b04c7c121851704973a94a50e42af1425045899c) `sha256:3a311b69b1d085b5b8578028ecb437f3ea0e7f4dd05c58afb374c0d84f9c0425`
* [cluster-kube-cluster-api-operator](https://github.com/openshift/cluster-api-operator) git [adaae0d4](https://github.com/openshift/cluster-api-operator/commit/adaae0d4e6d7a0e466e7e86af399de0b828c8b81) `sha256:f7aa8c3877593a02ce0e04ed9820254128e11ba46af64bd23eb7180d949452c8`
* [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator) git [438c9dba](https://github.com/openshift/cluster-kube-controller-manager-operator/commit/438c9dba80ddadeabe9efe4a654297a7b550b2b8) `sha256:35bae54326644b902fd1a87e94c45e180bb74a75a95bc8824c7709a2c390e396`
* [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator) git [84eb8c5a](https://github.com/openshift/cluster-kube-scheduler-operator/commit/84eb8c5a73a730d6d08794e51da9c20013ca4304) `sha256:f2ce9e9507930a3784dba4b021461780b96692b43ee7496f6a533ff3dbe1c66b`
* [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator) git [5adc1429](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/commit/5adc14299739bc64c8812cbab0b0ff2d12863602) `sha256:3e5db4bdc2920eb1149a919ffe0b8f0885c6b2f2d51ed19b0b5e048ae08f12a0`
* [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver) git [b3c82b2e](https://github.com/openshift/cluster-machine-approver/commit/b3c82b2eec66ae3ae510df0603af1212c34be618) `sha256:e1662ba5a3e220c4e3fd191feda82df8cb42b2478b69234034612f609e87438c`
* [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator) git [9cfa5679](https://github.com/openshift/cluster-openshift-apiserver-operator/commit/9cfa5679a8ac1e5a68eea32179d9e069da85dfcf) `sha256:9340b5111a33b116c3b394cbedd2a5a1e4bcefca3500eb62d8c4ac4288cfabb5`
* [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator) git [aa455c04](https://github.com/openshift/cluster-openshift-controller-manager-operator/commit/aa455c043152123595c2b4f72e02279aad9dd48a) `sha256:84cdc2e2e9bc34d2cbe0c956b3516dc0a23e650ed472c6f4c28268320d637bc8`
* [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator) git [b343f70f](https://github.com/openshift/cluster-samples-operator/commit/b343f70f19ffd559e1a81d3a3e65bd106e634c13) `sha256:d5601404d1803a394d78b922420e9260b11b4169786f7bd59ff814dc606f9306`
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [c40e7b9b](https://github.com/openshift/cluster-update-keys/commit/c40e7b9b60c62690a25333fc54ae0d3705474afb) `sha256:dee68affa7db19c64e907c02b8763f8cfab992da0a13e20674aed3eb95d78832`
* [cluster-version-operator](https://github.com/openshift/cluster-version-operator) git [ea3fa769](https://github.com/openshift/cluster-version-operator/commit/ea3fa7695054fc9260936902b33b738bb4c405bc) `sha256:f9dea8c5a755ebad00dd9507fbc39b01ac698264bd4cf16f53c1f08f5a6962d3`
* [configmap-reloader](https://github.com/openshift/configmap-reload) git [2438d7c8](https://github.com/openshift/configmap-reload/commit/2438d7c8e495201361d87da205649bc38fc4822b) `sha256:5648addd8da54e4988a10deb12f59d1fd39a63311b0b3e36a98561ae6a7c3153`
* [container-networking-plugins](https://github.com/openshift/containernetworking-plugins) git [184a9601](https://github.com/openshift/containernetworking-plugins/commit/184a96011a8cacb72319cdccb904271a99c5928d) `sha256:41a40f9a398d7372ca6316384f2d851a14c4fd02582ad209eb5357468c16f7c0`
* [containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins) git [184a9601](https://github.com/openshift/containernetworking-plugins/commit/184a96011a8cacb72319cdccb904271a99c5928d) `sha256:a6dd5a9db95565cbf22f10e55353720d5db5636ffba765685bd459aead6456fe`
* [coredns](https://github.com/openshift/coredns) git [6f39336e](https://github.com/openshift/coredns/commit/6f39336e6da9dc77b2db140a96773c413d50a665) `sha256:dd8ddc4dbb86ea49c15a5749548ce469d45ea2bd3d56e816bd98cca7e206e0e0`
* [csi-external-snapshot-metadata](https://github.com/openshift/csi-external-snapshot-metadata) git [693a8264](https://github.com/openshift/csi-external-snapshot-metadata/commit/693a826455777eaafc677bb2195dc071d184243b) `sha256:35c9b1ed5e08a2829d47f36bd3430fded325e016fb545866bb2d8f8aae36d426`
* [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe) git [1d6d6b27](https://github.com/openshift/csi-livenessprobe/commit/1d6d6b27460e58f24110c72ec9c96afe2c1d891d) `sha256:77feb42a6c777115ac2dd4215d37244110fc20d179fe2e3bc132da4f957f20d7`
* [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar) git [6ce4713c](https://github.com/openshift/csi-node-driver-registrar/commit/6ce4713c87b735e2546a65a871bd2c7cfe383c31) `sha256:d4ffb7ac29c5d76e6940f5a8eec02f3599fb7f9e36503d1eee8b3fe14c4ae342`
* [docker-builder](https://github.com/openshift/builder) git [35afa308](https://github.com/openshift/builder/commit/35afa308e2473046721057112d804334fc4b8217) `sha256:5d634dbdf58458b7bc99092ab58675b08059d492de7d84ce44481bd6f8b0d2e7`
* [docker-registry](https://github.com/openshift/image-registry) git [0e96a084](https://github.com/openshift/image-registry/commit/0e96a08424d601be55341bc3f4412fde977602c8) `sha256:301733db26c035394d0a5922d1e85c9175652775e403762f98fcc301fa523c70`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [62e1f604](https://github.com/openshift/driver-toolkit/commit/62e1f6040cd297149f5f14e0d20814759ec61354) `sha256:ef2ff8771d7a3e40807b853e1ae830004b78fbe330d61b01645803c86b328249`
* [etcd](https://github.com/openshift/etcd) git [05bca977](https://github.com/openshift/etcd/commit/05bca97760b1cfa1bcef11c0b1f1a5c4dab19709) `sha256:be5275b636985c7e98f8c5af11968ff59a105e3d6b97c254b020315c52f08e61`
* [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp) git [d5a55414](https://github.com/openshift/cloud-provider-gcp/commit/d5a5541436d9269006928079fcdc507d0b6d4033) `sha256:4eca776ad5452427748edeadbbb43a7ebe9fa520f9234321889e231e0794c8f9`
* [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook) git [b36788ed](https://github.com/openshift/gcp-workload-identity-federation-webhook/commit/b36788edd4c559cffd5f7f1b2e3e51b98c3e92b8) `sha256:560cbe8d6b964af34e9c1a7d21811abe5d9b630cbb7e3280bc8311c8ab489c72`
* [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm) git [36ab30f9](https://github.com/openshift/cloud-provider-ibm/commit/36ab30f90e87de0daa926d20ccda88c41abed191) `sha256:54db6b86e5c896a7d12bfcfbfbd27881777173c26f5c457354a84f877a9fe6fa`
* [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator) git [21f405cc](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/commit/21f405cce9573eee1c4f1cf95c0eb601ae77ed99) `sha256:a2d0a83d89eb00a293f8390a5d808dd942ca0bb982607df90e42dd3cc1f34f07`
* [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud) git [8b6396a4](https://github.com/openshift/cluster-api-provider-ibmcloud/commit/8b6396a4c78f4791b7f3c5ec404a78b499f8546b) `sha256:095fcc353be15935819f06972a6c4864b7dc38f9505fc6327e961c36b9eb33d6`
* [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud) git [e63e7a19](https://github.com/openshift/machine-api-provider-ibmcloud/commit/e63e7a191ccc1d391b574d713899e307a88b466c) `sha256:6c11dfdc705f841df0461f89dbdf49573cd5f3cbcdf01c3d9f594a355ae923c3`
* [insights-runtime-exporter](https://github.com/openshift/insights-runtime-extractor) git [39e71471](https://github.com/openshift/insights-runtime-extractor/commit/39e71471d109ed16c336a8e08c2562d837f90029) `sha256:91aed78f2ec8c89235826e6164a341081e7e9e5b092c31e8d6b8bf45f025bc9e`
* [insights-runtime-extractor](https://github.com/openshift/insights-runtime-extractor) git [39e71471](https://github.com/openshift/insights-runtime-extractor/commit/39e71471d109ed16c336a8e08c2562d837f90029) `sha256:47c623b86f443f0678ad59b05d54f4ae5177e363d54169b72b18c3dd7664e53f`
* [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [6c92e542](https://github.com/openshift/ironic-rhcos-downloader/commit/6c92e5425b58baa9d4dd951a992b7460e8407247) `sha256:e8cc2310bb05c00003b43ab6c5315c28cc0dcd55653e044440ee36b1697852f0`
* [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager) git [fa5b8b8b](https://github.com/openshift/ironic-static-ip-manager/commit/fa5b8b8bb73e509f74205a99a0ed1cb07a843885) `sha256:8601c76e56eee0aee5dfadb3ba3b32c24e6503096f584ee4572923e5e5dd9467`
* [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server) git [e7379b30](https://github.com/openshift/kubernetes-metrics-server/commit/e7379b302a7377c06cf06d54230decd479f92078) `sha256:3ce0ea52c242c5d3d3621940b540680b3160c920587965f7de6cd7c7af542377`
* [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy) git [b9134351](https://github.com/openshift/kube-rbac-proxy/commit/b9134351be37c43408334047d8eb85d0ac01fe4e) `sha256:4f2a90f96bb600942e04e778fc5af41119a66fee2acd574bfebb56fe1e0c44a6`
* [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator) git [0f8a4eb8](https://github.com/openshift/kubernetes-kube-storage-version-migrator/commit/0f8a4eb84ace9b746cf25d51d80dacf34ca5f953) `sha256:64f9faa218102942b866b0c315519b824106a452f25161e23ec8363623c2426c`
* [machine-image-customization-controller](https://github.com/openshift/image-customization-controller) git [fe4360da](https://github.com/openshift/image-customization-controller/commit/fe4360da1fe44c0d8a69c0133f846e0cbc36740c) `sha256:49f6adf2459232b35e6b5568600743801f89b14fc1e26481499111bb8af884af`
* [metallb-frr](https://github.com/openshift/frr) git [3ca45c51](https://github.com/openshift/frr/commit/3ca45c517eafe07aac0866e5cbd32a5c08081f22) `sha256:62571e8058085d593bf7df30065c0ff5115585552951b0b5d828b34f2cedae1f`
* [multus-admission-controller](https://github.com/openshift/multus-admission-controller) git [fc73c803](https://github.com/openshift/multus-admission-controller/commit/fc73c803caa1140e5a9115ceeb0e38504b001722) `sha256:6807c72e1ef7b5fb561c185a4416ee7d2ab88342dac7873ed21b25961de99def`
* [multus-cni](https://github.com/openshift/multus-cni) git [b2a2f457](https://github.com/openshift/multus-cni/commit/b2a2f457824490d93da101d983b25af966f2be1b) `sha256:e91df5829ade3bc73df1122c61a57f2323e57d46c7057fbd71668e69c0ded6c5`
* [multus-cni-microshift](https://github.com/openshift/multus-cni) git [b2a2f457](https://github.com/openshift/multus-cni/commit/b2a2f457824490d93da101d983b25af966f2be1b) `sha256:cb34126e08a2f14eccabd235410db55bfde24fc353280e197558a037317e1520`
* [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy) git [afbdf825](https://github.com/openshift/multus-networkpolicy/commit/afbdf82505c0d8f212d63e1eee6debced74ef653) `sha256:3f181b24eb8e4c0e2262236203e624dd4821b97b364390865207e965004e3a62`
* [multus-route-override-cni](https://github.com/openshift/route-override-cni) git [391c1b03](https://github.com/openshift/route-override-cni/commit/391c1b0361e17c5718508810f0bdb6ff66ae6e81) `sha256:8d35a4a310668b769d51f3c21cc016e1f32efeca2dffa1251ed673695cb1b3f6`
* [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni) git [43c89591](https://github.com/openshift/whereabouts-cni/commit/43c8959152a6ca8afdc73eaed624286628c2c22e) `sha256:c59005e3cacfe11213810beedc791c705b3333cdd78c6cde1532efa06f16d325`
* [network-interface-bond-cni](https://github.com/openshift/bond-cni) git [dd3c4d0b](https://github.com/openshift/bond-cni/commit/dd3c4d0b886138d974022b963e72f2e90293abfe) `sha256:3b046f9f085bbe388e28b3966dc65dd1191c17b79fcbaacd7d6f75bd0a23a00e`
* [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon) git [b81340a9](https://github.com/openshift/network-metrics-daemon/commit/b81340a9fc6963fa3d64d215a12e8528ca797131) `sha256:19eaabd82bd0dad377690b675476191ec4131da2e8963b4e092498dd7ce43fe8`
* [network-tools](https://github.com/openshift/network-tools) git [26d09174](https://github.com/openshift/network-tools/commit/26d09174cbd92386469e777e3bf49bfa95d035d5) `sha256:1658d25d245e1cf93c341905aa983c12a54e3fdb7ad6c087bc5e3ec6b442165f`
* [nutanix-cloud-controller-manager](https://github.com/openshift/cloud-provider-nutanix) git [b575ef15](https://github.com/openshift/cloud-provider-nutanix/commit/b575ef15f13e1434c793ae50824fd0676480be05) `sha256:371069500fae6c2be029a08c04a6b861befdb3d960182f72be4aef97e17a3bc6`
* [nutanix-machine-controllers](https://github.com/openshift/machine-api-provider-nutanix) git [3200ddef](https://github.com/openshift/machine-api-provider-nutanix/commit/3200ddef48a5a8d47b96539419c51f3619cb1fd5) `sha256:b03918cfd8bd6d3bbe57deb1e0ed229fac03a3067bc3645c6fcb00e2066df329`
* [oauth-apiserver](https://github.com/openshift/oauth-apiserver) git [99f27d25](https://github.com/openshift/oauth-apiserver/commit/99f27d25cc2853fe44ce6c7f7611637ef1492e42) `sha256:9b077bbd9f690f607f7854edf9f6dcb8177fd191fc95f15986bc0776715b72d4`
* [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager) git [d9e543dd](https://github.com/openshift/openshift-controller-manager/commit/d9e543dd31e981f279c447e4f92f0dac3f665f9e) `sha256:253bb8e0c3588d13cc050013f0311a86f8ec5729885df6d83196bdf3bc653caf`
* [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics) git [b04e2ef0](https://github.com/openshift/openshift-state-metrics/commit/b04e2ef05498c2a4504bd9396a3290c4f263fc37) `sha256:4328ea2f12d80bdaca2ad2c19e70da11659093b377dd201dd982e7f6c6d70c44`
* [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack) git [c91265ed](https://github.com/openshift/cluster-api-provider-openstack/commit/c91265ed4f82c0b36fbfc50040b8180f04fcf4cc) `sha256:04a8286530f9674756a16add1e76ee7a273f56ef965a1b358223ff879e34086c`
* [openstack-resource-controller](https://github.com/openshift/openstack-resource-controller) git [bf0d2c88](https://github.com/openshift/openstack-resource-controller/commit/bf0d2c88d6bf9bd90b24c979ea63dc37606b45fc) `sha256:23859244f9e15fea3f503e89ce1ac56346a88d6938d4289ce368b60e92ad129f`
* [operator-marketplace](https://github.com/operator-framework/operator-marketplace) git [4ccd56c9](https://github.com/operator-framework/operator-marketplace/commit/4ccd56c96839e2389e12bf3f8390a6c062e9b2cf) `sha256:de92a6f191f03797848c7a301ca0603f33353514f4702126b1d982688de0dd63`
* [powervs-block-csi-driver](https://github.com/openshift/ibm-powervs-block-csi-driver) git [8faa079f](https://github.com/openshift/ibm-powervs-block-csi-driver/commit/8faa079fe4ba90ca37e7112e4be8a77ccf221e77) `sha256:a324ef85408f40642f47de85c163ed369b5cbc5a683407206ae7b2411a1c7985`
* [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator) git [4036cd3b](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/commit/4036cd3b5e45cf4d8c3c34def599657435601661) `sha256:795bf5fb38310a280a1ddcac9b331e5ca737ed94e93365e3362b836871c6d9b8`
* [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs) git [f011b3c7](https://github.com/openshift/machine-api-provider-powervs/commit/f011b3c727c5377302b2ab0a203457490b930a3d) `sha256:72c8bfcdfafdc244a2e9f8612ca04c2f1134f6628e0a9dd11fd23aafd4c628f0`
* [prom-label-proxy](https://github.com/openshift/prom-label-proxy) git [3bc94eed](https://github.com/openshift/prom-label-proxy/commit/3bc94eed432cacc37930aa4b0d8ff375e370cbbe) `sha256:1b873bd593186f7ace31364f6e2634062bc05419f004627e21d02763c5189c4c`
* [prometheus-config-reloader](https://github.com/openshift/prometheus-operator) git [425294dd](https://github.com/openshift/prometheus-operator/commit/425294dded74054100db465d296b2aa76e7a691e) `sha256:79a4013805d32daf22af8bdafe4fdad43a1b62f602417a29a91d684cde67d95b`
* [prometheus-node-exporter](https://github.com/openshift/node_exporter) git [fa749d65](https://github.com/openshift/node_exporter/commit/fa749d65d8eca1cc937554baab91385a78ec8ce1) `sha256:29fe823f1de85d2a4b0f3ff16a717c0b5d2c9639d8f7a1b30946d343fd8188fc`
* [prometheus-operator](https://github.com/openshift/prometheus-operator) git [425294dd](https://github.com/openshift/prometheus-operator/commit/425294dded74054100db465d296b2aa76e7a691e) `sha256:3fd8b127e0f9daee7b272f79df64f8b75b38102f6872e501f0a25902c1711395`
* [prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator) git [425294dd](https://github.com/openshift/prometheus-operator/commit/425294dded74054100db465d296b2aa76e7a691e) `sha256:f3f11ed416802b22bc0f980b26c3d99bfbc3141a62ae274a632feb340b5202e5`
* [service-ca-operator](https://github.com/openshift/service-ca-operator) git [37e0c317](https://github.com/openshift/service-ca-operator/commit/37e0c31790b6a954214817974a56c9a699d0cf78) `sha256:98b39cfea87bb4b6a878eb7d40cb5c36848b5a0f479d6ac36993428319ab71ad`
* [telemeter](https://github.com/openshift/telemeter) git [d07a8330](https://github.com/openshift/telemeter/commit/d07a833015fe91fe2df12589a6877dde15e9a227) `sha256:bdb4962cc56d3233efe7209ae4a8b0b83c44710de7216b6637a3e538ce91e0e6`
* [volume-data-source-validator](https://github.com/openshift/volume-data-source-validator) git [0e61642f](https://github.com/openshift/volume-data-source-validator/commit/0e61642f8d898ee199e42f37319864851dd3627f) `sha256:12d4e2088ba2ddf280bb19a244688b1601f1a0766a74ffc766919d1a19d3e20d`
* [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere) git [b93eb64f](https://github.com/openshift/cloud-provider-vsphere/commit/b93eb64ff72e7c005687813c8b478d694a0f517a) `sha256:efa182d7b335e2e258edaf4acae2c4fde9b171e3f819690fe3fa9909909f6ba7`
* [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator) git [13b68a91](https://github.com/openshift/vmware-vsphere-csi-driver-operator/commit/13b68a91a148667d46bd06ad8fcb839be984671e) `sha256:bb460c41a3184770c1097a6965d67449f6355dd9a6359d16c0a9814364c07d5f`
* [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector) git [65d066ab](https://github.com/openshift/vsphere-problem-detector/commit/65d066ab0940dc69aa3f7ec6b02e698a6e4f5795) `sha256:182f05142c6b3fe0c019f0275b67e2f061405f25872e469ec7b7ca3297e9af9e`


### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/4e399454ffb97a17837bb2362518f5442f7dd086)

* [OCPBUGS-105890](https://issues.redhat.com/browse/OCPBUGS-105890): manifest_generator add a label to LUKS root [#10803](https://github.com/openshift/assisted-service/pull/10803)
* [OCPBUGS-93748](https://issues.redhat.com/browse/OCPBUGS-93748): Add sourcedir /run/chrony-dhcp to generated chrony.conf [#10537](https://github.com/openshift/assisted-service/pull/10537)
* [OCPBUGS-81880](https://issues.redhat.com/browse/OCPBUGS-81880): Mark raw FC/iSCSI multipath members as ineligible [#10149](https://github.com/openshift/assisted-service/pull/10149)
* [Full changelog](https://github.com/openshift/assisted-service/compare/760626123a57a93bd13a84f31776be8c86e25d81...4e399454ffb97a17837bb2362518f5442f7dd086)


### [agent-installer-ui](https://github.com/openshift-assisted/assisted-installer-ui/tree/7b9198f02fcf494a02458703872ad9a091397755)

* [ART-22057](https://issues.redhat.com/browse/ART-22057): Move @types/react-dom to dependencies in chatbot (#3958) [#3958](https://github.com/openshift-assisted/assisted-installer-ui/pull/3958)
* [OCPBUGS-104460](https://issues.redhat.com/browse/OCPBUGS-104460): Pin minimatch to ^10.2.6 and brace-expansion to ^5.0.9 (CVE-2026-14257) (#3961) [#3961](https://github.com/openshift-assisted/assisted-installer-ui/pull/3961)
* [OCPBUGS-91623](https://issues.redhat.com/browse/OCPBUGS-91623): Bump ws to 8.21.0 for CVE-2026-45736 (#3907) [#3907](https://github.com/openshift-assisted/assisted-installer-ui/pull/3907)
* [OCPBUGS-98265](https://issues.redhat.com/browse/OCPBUGS-98265): Bump tar to 7.5.19 in 4.20 (#3892) [#3892](https://github.com/openshift-assisted/assisted-installer-ui/pull/3892)
* Apply patches (#3876) [#3876](https://github.com/openshift-assisted/assisted-installer-ui/pull/3876)
* Update OWNERS file (#3881) [#3881](https://github.com/openshift-assisted/assisted-installer-ui/pull/3881)
* [OCPBUGS-98429](https://issues.redhat.com/browse/OCPBUGS-98429): Bump js-yaml to 4.3.0 in 4.20 (#3864) [#3864](https://github.com/openshift-assisted/assisted-installer-ui/pull/3864)
* [OCPBUGS-89699](https://issues.redhat.com/browse/OCPBUGS-89699): bump form-data to 2.5.6 and 4.0.6 via yarn.lock patch and scoped resolution to address CVE-2026-12143 (#3879) [#3879](https://github.com/openshift-assisted/assisted-installer-ui/pull/3879)
* patch CVE-2026-9277 and CVE-2026-42338 via yarn resolutions (#3854) [#3854](https://github.com/openshift-assisted/assisted-installer-ui/pull/3854)
* [OCPBUGS-88394](https://issues.redhat.com/browse/OCPBUGS-88394), [OCPBUGS-88407](https://issues.redhat.com/browse/OCPBUGS-88407): Bump axios to 1.18.1 (#3859) [#3859](https://github.com/openshift-assisted/assisted-installer-ui/pull/3859)
* [OCPBUGS-85542](https://issues.redhat.com/browse/OCPBUGS-85542): Bump msw pkg version to 2.13.5 (#3730) [#3730](https://github.com/openshift-assisted/assisted-installer-ui/pull/3730)
* [Full changelog](https://github.com/openshift-assisted/assisted-installer-ui/compare/e2e118cdf55c418f54b6346d4920b76d664506f7...7b9198f02fcf494a02458703872ad9a091397755)


### [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver/tree/6c99b973a6a5ca0202d56b87119714b9ec4a5365)

* [OCPBUGS-80562](https://issues.redhat.com/browse/OCPBUGS-80562): Bump google.golang.org/grpc to v1.79.3 [#311](https://github.com/openshift/aws-ebs-csi-driver/pull/311)
* [Full changelog](https://github.com/openshift/aws-ebs-csi-driver/compare/a8ef205c28b7b8c80b0caf1c1a9e12f81f4fdbb9...6c99b973a6a5ca0202d56b87119714b9ec4a5365)


### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/910424793d59d291a9e6addaccbd2facf53e2bff)

* [OCPBUGS-85573](https://issues.redhat.com/browse/OCPBUGS-85573): Add init container for Manila node daemonset [#553](https://github.com/openshift/csi-operator/pull/553)
* [Full changelog](https://github.com/openshift/csi-operator/compare/0170e1e3c05714d016ff4f072a2ba1e17c9c26af...910424793d59d291a9e6addaccbd2facf53e2bff)


### [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider/tree/0000b76a838f6b56efcfecfa110bc6795d0f7746)

* [OCPBUGS-80537](https://issues.redhat.com/browse/OCPBUGS-80537): Bump google.golang.org/grpc to v1.79.3 [#41](https://github.com/openshift/aws-encryption-provider/pull/41)
* [Full changelog](https://github.com/openshift/aws-encryption-provider/compare/a8968d22240748f40c41bdd6c47debbfa16dcd74...0000b76a838f6b56efcfecfa110bc6795d0f7746)


### [azure-cloud-controller-manager, azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure/tree/fbf11126955608076cd568c22be0d630c5db0d84)

* [OCPBUGS-80566](https://issues.redhat.com/browse/OCPBUGS-80566), [OCPBUGS-80567](https://issues.redhat.com/browse/OCPBUGS-80567): Bump google.golang.org/grpc to v1.79.3 [#179](https://github.com/openshift/cloud-provider-azure/pull/179)
* [Full changelog](https://github.com/openshift/cloud-provider-azure/compare/d469d04ed645358d942af442fe21e2c2b44b9b2c...fbf11126955608076cd568c22be0d630c5db0d84)


### [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver/tree/e1ea4e929c51a3fe6823ffb5fd17fb07971ca86d)

* [OCPBUGS-80569](https://issues.redhat.com/browse/OCPBUGS-80569): Bump google.golang.org/grpc to v1.79.3 [#140](https://github.com/openshift/azure-disk-csi-driver/pull/140)
* [Full changelog](https://github.com/openshift/azure-disk-csi-driver/compare/01cd2866d6ca829b553dd9e7388c9c1e4ef59c68...e1ea4e929c51a3fe6823ffb5fd17fb07971ca86d)


### [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver/tree/c7bce6e96df8f14b61ead343b901087a44736513)

* [OCPBUGS-80572](https://issues.redhat.com/browse/OCPBUGS-80572): Bump google.golang.org/grpc to v1.79.3 [#128](https://github.com/openshift/azure-file-csi-driver/pull/128)
* [Full changelog](https://github.com/openshift/azure-file-csi-driver/compare/45d505bc11fedadece5ae27147c9595877e39f2a...c7bce6e96df8f14b61ead343b901087a44736513)


### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/1d6fb8798544b0d0ff60582f82f885e5a6a776ba)

* [OCPBUGS-80538](https://issues.redhat.com/browse/OCPBUGS-80538): Bump google.golang.org/grpc to 1.64.1-sec.1 patch [#44](https://github.com/openshift/azure-kubernetes-kms/pull/44)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/b381b8484ed76f9fba0ac993bc03d216e11c254c...1d6fb8798544b0d0ff60582f82f885e5a6a776ba)


### [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity/tree/357712a65437ea3329a8d8a62cf64d27a70dda12)

* [OCPBUGS-81944](https://issues.redhat.com/browse/OCPBUGS-81944): Bump go-jose/go-jose/v4@v4.1.4 [#51](https://github.com/openshift/azure-workload-identity/pull/51)
* [OCPBUGS-86846](https://issues.redhat.com/browse/OCPBUGS-86846): [release-4.20] filter out "remove" patches [#49](https://github.com/openshift/azure-workload-identity/pull/49)
* [Full changelog](https://github.com/openshift/azure-workload-identity/compare/88b18175e46fe305486d172ec0b4e8471c55e30b...357712a65437ea3329a8d8a62cf64d27a70dda12)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/349feecf1e7597a0a62cf93c97e0870ac7cff2e3)

* [OCPBUGS-89242](https://issues.redhat.com/browse/OCPBUGS-89242): Update RHCOS-release-4.20 data/data/coreos/rhcos.json to 9.6.20260616-0 [#10650](https://github.com/openshift/installer/pull/10650)
* [OCPBUGS-86552](https://issues.redhat.com/browse/OCPBUGS-86552): azure: Add field in installconfig to disallow shared access key [#10575](https://github.com/openshift/installer/pull/10575)
* [OCPBUGS-77834](https://issues.redhat.com/browse/OCPBUGS-77834): Update RHCOS-release-4.20 bootimage metadata to 9.6.20260512-0 [#10580](https://github.com/openshift/installer/pull/10580)
* [Full changelog](https://github.com/openshift/installer/compare/13a5f6b91e1636b63bb0956c6fa49fab236e71c1...349feecf1e7597a0a62cf93c97e0870ac7cff2e3)


### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/f74f7d4c30cb936e84c79bbc60a9f57660058e98)

* [OCPBUGS-98095](https://issues.redhat.com/browse/OCPBUGS-98095): Add BMH finalizer on PreprovisioningImage [#507](https://github.com/openshift/baremetal-operator/pull/507)
* [OCPBUGS-87965](https://issues.redhat.com/browse/OCPBUGS-87965): Fix preprovisioning network Secret lifecycle during BMH deletion [#493](https://github.com/openshift/baremetal-operator/pull/493)
* [OCPBUGS-82008](https://issues.redhat.com/browse/OCPBUGS-82008): Fix PPI for ACM [#486](https://github.com/openshift/baremetal-operator/pull/486)
* [Full changelog](https://github.com/openshift/baremetal-operator/compare/4e38a27e94679f43d6534c67c98a9353dac137c6...f74f7d4c30cb936e84c79bbc60a9f57660058e98)


### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/1367d50cf3740bc3a6a68ba6c74f6ad5e3ef7cb7)

* [OCPBUGS-91324](https://issues.redhat.com/browse/OCPBUGS-91324), [OCPBUGS-94907](https://issues.redhat.com/browse/OCPBUGS-94907): Bump golang.org/x/net to openshift-sustaining/net v0.50.0-sec.2 [#2342](https://github.com/openshift/oc/pull/2342)
* [OCPBUGS-81946](https://issues.redhat.com/browse/OCPBUGS-81946): Bump go-jose/go-jose/v4 to v4.1.4 [#2274](https://github.com/openshift/oc/pull/2274)
* [Full changelog](https://github.com/openshift/oc/compare/92a3a166a7f710a344a11bda0ad221e54583fccd...1367d50cf3740bc3a6a68ba6c74f6ad5e3ef7cb7)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/c6a7e1a6b84b964531d6c842f362f664dd777746)

* NO-JIRA: Revert "OCPBUGS-87109 Scope minted AWS IAM policies to cluster-owned resources" [#1061](https://github.com/openshift/cloud-credential-operator/pull/1061)
* [OCPBUGS-87109](https://issues.redhat.com/browse/OCPBUGS-87109): Scope minted AWS IAM policies to cluster-owned resources [#1047](https://github.com/openshift/cloud-credential-operator/pull/1047)
* [OCPBUGS-81947](https://issues.redhat.com/browse/OCPBUGS-81947): Bump go-jose/go-jose/v4@v4.1.4 [#1029](https://github.com/openshift/cloud-credential-operator/pull/1029)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/92d1035606683d4cc715205606a535e7211f4960...c6a7e1a6b84b964531d6c842f362f664dd777746)


### [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler/tree/5789322ed3215955ce39c75c185eef9b16ee987f)

* [OCPBUGS-109662](https://issues.redhat.com/browse/OCPBUGS-109662): UPSTREAM: 9458: fix(clusterapi): use kind-aware version discovery for infra references [#435](https://github.com/openshift/kubernetes-autoscaler/pull/435)
* [Full changelog](https://github.com/openshift/kubernetes-autoscaler/compare/6b1d2ef88e19d32143d389de6999c765c7e30cad...5789322ed3215955ce39c75c185eef9b16ee987f)


### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/17181f99343a5b1fb08af8a7994ad3e9eecc6c1e)

* [OCPBUGS-86555](https://issues.redhat.com/browse/OCPBUGS-86555): Remove trailing dot from BMO Ironic endpoint [#608](https://github.com/openshift/cluster-baremetal-operator/pull/608)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/accfc407194c6ace691f2b38a719a01705519dc9...17181f99343a5b1fb08af8a7994ad3e9eecc6c1e)


### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/4bd6d82d21a2d201d9857ca1e26b21c70a648bf5)

* NO-JIRA: Allow sustaining engineering to self serve dependency updates [#556](https://github.com/openshift/cluster-capi-operator/pull/556)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/de6547a997728774b05576178e7cade55d07f827...4bd6d82d21a2d201d9857ca1e26b21c70a648bf5)


### [cluster-config-api](https://github.com/openshift/api/tree/05da40ea98557f8351483a39db3d0e7d9076bc8f)

* [OCPBUGS-82147](https://issues.redhat.com/browse/OCPBUGS-82147), [OCPBUGS-92038](https://issues.redhat.com/browse/OCPBUGS-92038), [OCPBUGS-92039](https://issues.redhat.com/browse/OCPBUGS-92039), [OCPBUGS-92041](https://issues.redhat.com/browse/OCPBUGS-92041), [OCPBUGS-92042](https://issues.redhat.com/browse/OCPBUGS-92042): Promote GatewayAPIWithoutOLM feature gate to Default [#2869](https://github.com/openshift/api/pull/2869)
* [OCPBUGS-98332](https://issues.redhat.com/browse/OCPBUGS-98332): add new serviceAccountToken fs type [#2925](https://github.com/openshift/api/pull/2925)
* [OCPBUGS-82147](https://issues.redhat.com/browse/OCPBUGS-82147), [OCPBUGS-92038](https://issues.redhat.com/browse/OCPBUGS-92038), [OCPBUGS-92039](https://issues.redhat.com/browse/OCPBUGS-92039), [OCPBUGS-92041](https://issues.redhat.com/browse/OCPBUGS-92041), [OCPBUGS-92042](https://issues.redhat.com/browse/OCPBUGS-92042): Promote GatewayAPIWithoutOLM feature gate to TechPreview [#2874](https://github.com/openshift/api/pull/2874)
* [OCPBUGS-85155](https://issues.redhat.com/browse/OCPBUGS-85155): Backport GatewayAPIWithoutOLM feature gate as disabled [#2871](https://github.com/openshift/api/pull/2871)
* [OCPBUGS-86849](https://issues.redhat.com/browse/OCPBUGS-86849): Add labelSelector to MachineSet status for scale subresource [#2867](https://github.com/openshift/api/pull/2867)
* [Full changelog](https://github.com/openshift/api/compare/50517c6f4bfdbf9fc2cb291fd97cce150a3237ca...05da40ea98557f8351483a39db3d0e7d9076bc8f)


### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/9acf049b2985339275796f69a2a8acad47726a29)

* [OCPBUGS-85412](https://issues.redhat.com/browse/OCPBUGS-85412): fix(tnf): align Pacemaker kubelet and etcd retry pacing [#1616](https://github.com/openshift/cluster-etcd-operator/pull/1616)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/9fb46bc7d765da7557e3f46c3b2dc81a387f8f7c...9acf049b2985339275796f69a2a8acad47726a29)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/f86aaea4136dfea16e62290bd50ecdd1a8b22b3f)

* [OCPBUGS-99476](https://issues.redhat.com/browse/OCPBUGS-99476): Respect proxy configuration on gwapi provisioning [#1519](https://github.com/openshift/cluster-ingress-operator/pull/1519)
* [OCPBUGS-99910](https://issues.redhat.com/browse/OCPBUGS-99910): E2E test for internal LoadBalancer Annotations [#1526](https://github.com/openshift/cluster-ingress-operator/pull/1526)
* [OCPBUGS-99484](https://issues.redhat.com/browse/OCPBUGS-99484): Add e2e test for Gateway API infrastructure annotations [#1521](https://github.com/openshift/cluster-ingress-operator/pull/1521)
* [OCPBUGS-98968](https://issues.redhat.com/browse/OCPBUGS-98968): Bump Istio version from v1.26.2 to v1.26.8 [#1510](https://github.com/openshift/cluster-ingress-operator/pull/1510)
* [OCPBUGS-85155](https://issues.redhat.com/browse/OCPBUGS-85155): Fix e2e tests to work on platforms with unmanaged DNS [#1514](https://github.com/openshift/cluster-ingress-operator/pull/1514)
* [OCPBUGS-99225](https://issues.redhat.com/browse/OCPBUGS-99225): Fix logic on gatewayapi test cleanup [#1512](https://github.com/openshift/cluster-ingress-operator/pull/1512)
* [OCPBUGS-88353](https://issues.redhat.com/browse/OCPBUGS-88353), [OCPBUGS-88354](https://issues.redhat.com/browse/OCPBUGS-88354): Ensure canary cert matches the default ingress controller's cert [#1469](https://github.com/openshift/cluster-ingress-operator/pull/1469)
* [OCPBUGS-82147](https://issues.redhat.com/browse/OCPBUGS-82147), [OCPBUGS-92038](https://issues.redhat.com/browse/OCPBUGS-92038), [OCPBUGS-92039](https://issues.redhat.com/browse/OCPBUGS-92039), [OCPBUGS-92041](https://issues.redhat.com/browse/OCPBUGS-92041), [OCPBUGS-92042](https://issues.redhat.com/browse/OCPBUGS-92042): Remove feature-set annotations from Sail Library RBAC Manifests [#1497](https://github.com/openshift/cluster-ingress-operator/pull/1497)
* [OCPBUGS-82147](https://issues.redhat.com/browse/OCPBUGS-82147), [OCPBUGS-92038](https://issues.redhat.com/browse/OCPBUGS-92038), [OCPBUGS-92039](https://issues.redhat.com/browse/OCPBUGS-92039), [OCPBUGS-92041](https://issues.redhat.com/browse/OCPBUGS-92041), [OCPBUGS-92042](https://issues.redhat.com/browse/OCPBUGS-92042): Replace OLM-based Istio install with Sail Library [#1459](https://github.com/openshift/cluster-ingress-operator/pull/1459)
* [OCPBUGS-85523](https://issues.redhat.com/browse/OCPBUGS-85523): Remove restriction of unmanaged x-k8s.io [#1488](https://github.com/openshift/cluster-ingress-operator/pull/1488)
* [OCPBUGS-86717](https://issues.redhat.com/browse/OCPBUGS-86717): Add configuration override for X-SSL strip [#1472](https://github.com/openshift/cluster-ingress-operator/pull/1472)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/d14c13be1685e74b898b93a3fa7e03e9b75aa174...f86aaea4136dfea16e62290bd50ecdd1a8b22b3f)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/e9accf887ef1182f0a96e3086d54441ba8bcae40)

* [OCPBUGS-98555](https://issues.redhat.com/browse/OCPBUGS-98555): scc: fix uid{Min,Max}Range for nested-container [#2226](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2226)
* [OCPBUGS-87902](https://issues.redhat.com/browse/OCPBUGS-87902): scc: Grant authenticated users use of restricted-v3 [#1950](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1950)
* [OCPBUGS-85271](https://issues.redhat.com/browse/OCPBUGS-85271): fsync static pod cert and manifest writes for crash durability [#2145](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2145)
* [OCPBUGS-85564](https://issues.redhat.com/browse/OCPBUGS-85564): [4.20] operator should not override authentication config serviceAccountIssuer with the default one during the operator initialization [#2152](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2152)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/43b3cbe3654586ebbff06b942658c6f14aa01796...e9accf887ef1182f0a96e3086d54441ba8bcae40)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/81547ca56764b50b6cacc17cadfab43b025d5b68)

* [OCPBUGS-104538](https://issues.redhat.com/browse/OCPBUGS-104538): Backport e2e stabilization 4.20 [#3028](https://github.com/openshift/cluster-monitoring-operator/pull/3028)
* [OCPBUGS-100371](https://issues.redhat.com/browse/OCPBUGS-100371): [release-4.20] fix: watch cluster wide proxy changes and apply changes accordingly [#3022](https://github.com/openshift/cluster-monitoring-operator/pull/3022)
* [OCPBUGS-99764](https://issues.redhat.com/browse/OCPBUGS-99764): fall back to kube-system/global-pull-secret for telemeter-client token [#3003](https://github.com/openshift/cluster-monitoring-operator/pull/3003)
* [OCPBUGS-92195](https://issues.redhat.com/browse/OCPBUGS-92195): set Prometheus shards value explicitly [#2973](https://github.com/openshift/cluster-monitoring-operator/pull/2973)
* [OCPBUGS-94078](https://issues.redhat.com/browse/OCPBUGS-94078): ship collector:node_scrape_collector_success:avg to Telemetry [#2990](https://github.com/openshift/cluster-monitoring-operator/pull/2990)
* [OCPBUGS-86992](https://issues.redhat.com/browse/OCPBUGS-86992): increase lookup interval [#2947](https://github.com/openshift/cluster-monitoring-operator/pull/2947)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/e4800998100765391609d5473a2d8471dc11d920...81547ca56764b50b6cacc17cadfab43b025d5b68)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/e39d57bde3ff15efdd63cc8567e91b2c2c2d45b3)

* [OCPBUGS-105852](https://issues.redhat.com/browse/OCPBUGS-105852): Remove version-specific CNI binary copy logic [#3118](https://github.com/openshift/cluster-network-operator/pull/3118)
* [OCPBUGS-99749](https://issues.redhat.com/browse/OCPBUGS-99749): Bump frr-k8s MAX_FDS from 1024 to 65536 [#3091](https://github.com/openshift/cluster-network-operator/pull/3091)
* [OCPBUGS-98796](https://issues.redhat.com/browse/OCPBUGS-98796): Bump github.com/containernetworking/cni v0.8.0 -&gt; v1.3.0 [#3071](https://github.com/openshift/cluster-network-operator/pull/3071)
* [OCPBUGS-84176](https://issues.redhat.com/browse/OCPBUGS-84176): Handle zero-worker HyperShift clusters in daemonset rollout [4.20 backport] [#2973](https://github.com/openshift/cluster-network-operator/pull/2973)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/18558dbf31624b136a7d35b30ef99e551d2738ae...e39d57bde3ff15efdd63cc8567e91b2c2c2d45b3)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/e09eb8eaaea4a0aacc66a0f28c5252a60cf443dd)

* [OCPBUGS-105509](https://issues.redhat.com/browse/OCPBUGS-105509): e2e: fix broken checks and rework netqueue tests to avoid ARM ethtool blackout flakes [#1581](https://github.com/openshift/cluster-node-tuning-operator/pull/1581)
* [OCPBUGS-90598](https://issues.redhat.com/browse/OCPBUGS-90598): perf: latency: compute memory resources dynamically [#1553](https://github.com/openshift/cluster-node-tuning-operator/pull/1553)
* [OCPBUGS-86815](https://issues.redhat.com/browse/OCPBUGS-86815): Requeue PerformanceStatus update when status write fails [#1530](https://github.com/openshift/cluster-node-tuning-operator/pull/1530)
* [OCPBUGS-82850](https://issues.redhat.com/browse/OCPBUGS-82850): Bump github.com/moby/spdystream from v0.5.0 to v0.5.1 [#1532](https://github.com/openshift/cluster-node-tuning-operator/pull/1532)
* [OCPBUGS-65773](https://issues.redhat.com/browse/OCPBUGS-65773): Watch MCP changes including spec and labels [#1434](https://github.com/openshift/cluster-node-tuning-operator/pull/1434)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/b1a1c39e5bfe62ae62806720874e7da09a30ed7f...e09eb8eaaea4a0aacc66a0f28c5252a60cf443dd)


### [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator/tree/d01cc083748864e3c8dcc72fb75516492dec3555)

* [OCPBUGS-80596](https://issues.redhat.com/browse/OCPBUGS-80596): Bump google.golang.org/grpc to v1.79.3 [#198](https://github.com/openshift/cluster-olm-operator/pull/198)
* [Full changelog](https://github.com/openshift/cluster-olm-operator/compare/e4917368b6a547f97a0fb411fea90de246d1417e...d01cc083748864e3c8dcc72fb75516492dec3555)


### [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller/tree/67083fab6cea4dde724efd5be5a22bda1f8437d1)

* [OCPBUGS-98332](https://issues.redhat.com/browse/OCPBUGS-98332): [4.20] add serviceAccountToken volume type to psalabelsyncer [#194](https://github.com/openshift/cluster-policy-controller/pull/194)
* [Full changelog](https://github.com/openshift/cluster-policy-controller/compare/47c783103216aa5e1242632127a5d8f98b8b7455...67083fab6cea4dde724efd5be5a22bda1f8437d1)


### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/e8e9de4345ce79aafbdcf31eb4d4ce3682cfd6b7)

* [OCPBUGS-77519](https://issues.redhat.com/browse/OCPBUGS-77519): remove oVirt code from CSO [#704](https://github.com/openshift/cluster-storage-operator/pull/704)
* [OCPBUGS-86121](https://issues.redhat.com/browse/OCPBUGS-86121): add Azure Disk CSI driver SA name to CredentialsRequest [#702](https://github.com/openshift/cluster-storage-operator/pull/702)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/cf9401ae971f7ce7a7e8bcbafaff82968c6579c2...e8e9de4345ce79aafbdcf31eb4d4ce3682cfd6b7)


### [console](https://github.com/openshift/console/tree/43d45bcecef86581a3801fce31be3e5732cc2669)

* [OCPBUGS-109132](https://issues.redhat.com/browse/OCPBUGS-109132): Fix leading whitespace in Quick Start execute code snippets [#17003](https://github.com/openshift/console/pull/17003)
* Fix for OCPBUGS-89701: CVE-2026-12143 [#16646](https://github.com/openshift/console/pull/16646)
* [OCPBUGS-104530](https://issues.redhat.com/browse/OCPBUGS-104530): Re-enable-knative [#16908](https://github.com/openshift/console/pull/16908)
* [OCPBUGS-98436](https://issues.redhat.com/browse/OCPBUGS-98436): [release-4.20] CVE-2026-59869 bump js-yaml [#16916](https://github.com/openshift/console/pull/16916)
* [OCPBUGS-100057](https://issues.redhat.com/browse/OCPBUGS-100057): quickstart page i18n misses (Fix Quick Starts i18n bundle lookup for zh-CN) [#16867](https://github.com/openshift/console/pull/16867)
* [OCPBUGS-99312](https://issues.redhat.com/browse/OCPBUGS-99312): Disable Knative e2e Cypress tests in CI [#16795](https://github.com/openshift/console/pull/16795)
* [OCPBUGS-99167](https://issues.redhat.com/browse/OCPBUGS-99167): fixing severity not showing number of issues [#16620](https://github.com/openshift/console/pull/16620)
* [OCPBUGS-84286](https://issues.redhat.com/browse/OCPBUGS-84286): Bump follow-redirects to 1.16.0 to fix CVE-2026-40895 [#16671](https://github.com/openshift/console/pull/16671)
* Fix for OCPBUGS-81613: CVE-2026-4800 [#16561](https://github.com/openshift/console/pull/16561)
* [OCPBUGS-86746](https://issues.redhat.com/browse/OCPBUGS-86746), [OCPBUGS-87089](https://issues.redhat.com/browse/OCPBUGS-87089), [OCPBUGS-88753](https://issues.redhat.com/browse/OCPBUGS-88753): [release-4.20] bump package: webpack-dev-server, protobufjs, fast-uri [#16674](https://github.com/openshift/console/pull/16674)
* [OCPBUGS-86455](https://issues.redhat.com/browse/OCPBUGS-86455): [release-4.20] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators [#16509](https://github.com/openshift/console/pull/16509)
* [OCPBUGS-89235](https://issues.redhat.com/browse/OCPBUGS-89235): Allow VolumeSnapshot restore when parent PVC is deleted [#16635](https://github.com/openshift/console/pull/16635)
* [OCPBUGS-87835](https://issues.redhat.com/browse/OCPBUGS-87835): Prevent binary secret data corruption when editing [#16571](https://github.com/openshift/console/pull/16571)
* [OCPBUGS-79455](https://issues.redhat.com/browse/OCPBUGS-79455): Bump immutable [#16323](https://github.com/openshift/console/pull/16323)
* [OCPBUGS-86582](https://issues.redhat.com/browse/OCPBUGS-86582): Fix macOS Option key in pod terminal [#16557](https://github.com/openshift/console/pull/16557)
* [OCPBUGS-86872](https://issues.redhat.com/browse/OCPBUGS-86872): Fix Shipwright detail pages crashing with React error #310 [#16527](https://github.com/openshift/console/pull/16527)
* [OCPBUGS-87100](https://issues.redhat.com/browse/OCPBUGS-87100): fix trailing quote in prometheus query [#16552](https://github.com/openshift/console/pull/16552)
* [OCPBUGS-77127](https://issues.redhat.com/browse/OCPBUGS-77127): [release-4.20] CVE-2026-26996 Bump minimatch library [#16272](https://github.com/openshift/console/pull/16272)
* [Full changelog](https://github.com/openshift/console/compare/65dba12e4f29fdfd850e0ce1066c947d86f28364...43d45bcecef86581a3801fce31be3e5732cc2669)


### [console-operator](https://github.com/openshift/console-operator/tree/75a6c0644907549642dd9d05ac451810f034385c)

* [NETOBSERV-2296](https://issues.redhat.com/browse/NETOBSERV-2296): add missing annotations on netobserv quickstart [#1095](https://github.com/openshift/console-operator/pull/1095)
* [OCPBUGS-100112](https://issues.redhat.com/browse/OCPBUGS-100112): Sort plugin list to make them deterministic [#1202](https://github.com/openshift/console-operator/pull/1202)
* [OCPBUGS-98986](https://issues.redhat.com/browse/OCPBUGS-98986): [4.20] Stabilize telemetry config to prevent continuous console pod rollouts [#1191](https://github.com/openshift/console-operator/pull/1191)
* [OCPBUGS-84254](https://issues.redhat.com/browse/OCPBUGS-84254): Redeploy console pods upon cert rotation [#1142](https://github.com/openshift/console-operator/pull/1142)
* [Full changelog](https://github.com/openshift/console-operator/compare/1bb7f6f4e7851997fd24c5f5aa5be41ea8dd5bd2...75a6c0644907549642dd9d05ac451810f034385c)


### [csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/649398c2a16731984e65719f6b8b323df79f3ff1)

* [OCPBUGS-80668](https://issues.redhat.com/browse/OCPBUGS-80668): bump google.golang.org/grpc@v1.79.3 [#385](https://github.com/openshift/cloud-provider-openstack/pull/385)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/9996d28ce3163cf9a09d77101e81cede914d6c2f...649398c2a16731984e65719f6b8b323df79f3ff1)


### [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs/tree/c4cdae44ef7c33e4b7ce06a3b599a8bc0707bff7)

* [OCPBUGS-82853](https://issues.redhat.com/browse/OCPBUGS-82853): Bump github.com/moby/spdystream@v0.5.1 [#192](https://github.com/openshift/csi-driver-nfs/pull/192)
* [Full changelog](https://github.com/openshift/csi-driver-nfs/compare/20609066e1bd1dbbd107bfca27af67e0a788760e...c4cdae44ef7c33e4b7ce06a3b599a8bc0707bff7)


### [csi-external-attacher](https://github.com/openshift/csi-external-attacher/tree/935f1e1f7f9f07c03116e37e760a66e2a58c63c0)

* [OCPBUGS-80611](https://issues.redhat.com/browse/OCPBUGS-80611): Bump google.golang.org/grpc to v1.79.3 [#103](https://github.com/openshift/csi-external-attacher/pull/103)
* [Full changelog](https://github.com/openshift/csi-external-attacher/compare/45239149cb387bcc51d944b802db0e804dc02688...935f1e1f7f9f07c03116e37e760a66e2a58c63c0)


### [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner/tree/eb1e4ac9c60067568674269961b46e7d9c974fe4)

* [OCPBUGS-82854](https://issues.redhat.com/browse/OCPBUGS-82854): Address CVE-2026-35469 [#141](https://github.com/openshift/csi-external-provisioner/pull/141)
* [Full changelog](https://github.com/openshift/csi-external-provisioner/compare/72fefbe70de332cea29428be202244676a9927fc...eb1e4ac9c60067568674269961b46e7d9c974fe4)


### [csi-external-resizer](https://github.com/openshift/csi-external-resizer/tree/5a19cdc10656fe090fb003584fd2db260df2c762)

* [OCPBUGS-80613](https://issues.redhat.com/browse/OCPBUGS-80613): Bump google.golang.org/grpc to v1.79.3 [#201](https://github.com/openshift/csi-external-resizer/pull/201)
* [Full changelog](https://github.com/openshift/csi-external-resizer/compare/c674bea9bb6a81e463c7fefa974e2109d829daef...5a19cdc10656fe090fb003584fd2db260df2c762)


### [csi-external-snapshotter, csi-snapshot-controller](https://github.com/openshift/csi-external-snapshotter/tree/d123f362cc13d9b14459af7b9e91eb2a9361d3cd)

* [OCPBUGS-92084](https://issues.redhat.com/browse/OCPBUGS-92084): UPSTREAM: 1392: Fix VolumeSnapshotContent deletion [#225](https://github.com/openshift/csi-external-snapshotter/pull/225)
* [OCPBUGS-80615](https://issues.redhat.com/browse/OCPBUGS-80615), [OCPBUGS-80618](https://issues.redhat.com/browse/OCPBUGS-80618): Bump google.golang.org/grpc to v1.79.3 [#209](https://github.com/openshift/csi-external-snapshotter/pull/209)
* [Full changelog](https://github.com/openshift/csi-external-snapshotter/compare/42604822c25eb2aa0ecb017c24e328221b238eb9...d123f362cc13d9b14459af7b9e91eb2a9361d3cd)


### [egress-router-cni](https://github.com/openshift/egress-router-cni/tree/cfcc6c44a9aacf48585dbe6618e5561f6c55666a)

* [OCPBUGS-98796](https://issues.redhat.com/browse/OCPBUGS-98796): Bump containernetworking/cni to v1.3.0 github.com/containernetworking/plugins to 1.4.0 [#107](https://github.com/openshift/egress-router-cni/pull/107)
* [Full changelog](https://github.com/openshift/egress-router-cni/compare/5e0f8d1b545899fda27c5e1cc8707d33cba1b534...cfcc6c44a9aacf48585dbe6618e5561f6c55666a)


### [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp/tree/74e2389011d640a371c0acb6ff71b1582cab23a1)

* [OCPBUGS-80628](https://issues.redhat.com/browse/OCPBUGS-80628): Bump google.golang.org/grpc to v1.79.3 [#288](https://github.com/openshift/cluster-api-provider-gcp/pull/288)
* [Full changelog](https://github.com/openshift/cluster-api-provider-gcp/compare/65539c71b4c292fc0f4eeb572dfe490af63063d9...74e2389011d640a371c0acb6ff71b1582cab23a1)


### [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp/tree/b998cf2532b52ce574c42e93c63965b31b9c6c8b)

* [OCPBUGS-80651](https://issues.redhat.com/browse/OCPBUGS-80651): Bump google.golang.org/grpc to v1.79.3 [#163](https://github.com/openshift/machine-api-provider-gcp/pull/163)
* [Full changelog](https://github.com/openshift/machine-api-provider-gcp/compare/01515888c83526ec235b7bc3a27df6eba3034b00...b998cf2532b52ce574c42e93c63965b31b9c6c8b)


### [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver/tree/49e54581328a46f6aee3f7842d401681d34b2104)

* [OCPBUGS-80632](https://issues.redhat.com/browse/OCPBUGS-80632): Bump google.golang.org/grpc to v1.79.3 in release 4.20 [#103](https://github.com/openshift/gcp-pd-csi-driver/pull/103)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver/compare/500ab5d31ad382805070c8ae329a9a34163ebc99...49e54581328a46f6aee3f7842d401681d34b2104)


### [gcp-pd-csi-driver-operator](https://github.com/openshift/gcp-pd-csi-driver-operator/tree/9fb0e78b4db18f763f7144ca5c13ee380da07460)

* [OCPBUGS-97961](https://issues.redhat.com/browse/OCPBUGS-97961): no-op OWNERS change to trigger postsubmit jobs [#198](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/198)
* [OCPBUGS-80631](https://issues.redhat.com/browse/OCPBUGS-80631): Bump google.golang.org/grpc to v1.79.3 [#185](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/185)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver-operator/compare/e0ad050a84bab669e0f11e080fc4c388ef417bba...9fb0e78b4db18f763f7144ca5c13ee380da07460)


### [haproxy-router](https://github.com/openshift/router/tree/0fec034e28f1f44ed75dcc1ab96f7135fd9beb49)

* [OCPBUGS-86728](https://issues.redhat.com/browse/OCPBUGS-86728): Prevent SSRF via FQDN-typed EndpointSlices [#819](https://github.com/openshift/router/pull/819)
* [OCPBUGS-86717](https://issues.redhat.com/browse/OCPBUGS-86717): Strip X-SSL-* headers for plain HTTP [#797](https://github.com/openshift/router/pull/797)
* [OCPBUGS-87220](https://issues.redhat.com/browse/OCPBUGS-87220): Replace HTTP backend liveness check with admin socket check [#789](https://github.com/openshift/router/pull/789)
* [OCPBUGS-80633](https://issues.redhat.com/browse/OCPBUGS-80633): Bump google.golang.org/grpc to v1.79.3 [#766](https://github.com/openshift/router/pull/766)
* [Full changelog](https://github.com/openshift/router/compare/3c365cad8c7037e4aa64a694994ea393abc4d9a2...0fec034e28f1f44ed75dcc1ab96f7135fd9beb49)


### [hyperkube, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/2df3632e823a813f64218dfc6f5c2e70d28ecdf0)

* [OCPBUGS-93896](https://issues.redhat.com/browse/OCPBUGS-93896): Rebase v1.33.13 in release-4.20 [#2706](https://github.com/openshift/kubernetes/pull/2706)
* [OCPBUGS-87173](https://issues.redhat.com/browse/OCPBUGS-87173): fix flake race in VAP e2e case [#2679](https://github.com/openshift/kubernetes/pull/2679)
* [OCPBUGS-85501](https://issues.redhat.com/browse/OCPBUGS-85501): Bump Kubernetes v1.33.12 to release-4.20 [#2666](https://github.com/openshift/kubernetes/pull/2666)
* [Full changelog](https://github.com/openshift/kubernetes/compare/ba5f1e63e12c85b7d61d5de4a3bbde39e54d33b2...2df3632e823a813f64218dfc6f5c2e70d28ecdf0)


### [hypershift](https://github.com/openshift/hypershift/tree/917164ce6017c5ea6f0e54d40211443ad5d739bb)

* [OCPBUGS-105812](https://issues.redhat.com/browse/OCPBUGS-105812): Add proxy env vars to AWS cloud-controller-manager deployment [#9284](https://github.com/openshift/hypershift/pull/9284)
* [OCPBUGS-105211](https://issues.redhat.com/browse/OCPBUGS-105211): Apply MetricsSet relabel configs to KAS ServiceMonitor [#9235](https://github.com/openshift/hypershift/pull/9235)
* [OCPBUGS-97923](https://issues.redhat.com/browse/OCPBUGS-97923): fix(nodepool): skip CNI-internal IPs in ClusterNetworkCIDRConflict check [release-4.20] [#8950](https://github.com/openshift/hypershift/pull/8950)
* [OCPBUGS-90085](https://issues.redhat.com/browse/OCPBUGS-90085): Fix NodePool reconciliation failure when updating mirrored immutable ConfigMaps [#8813](https://github.com/openshift/hypershift/pull/8813)
* fix(deps): OCPBUGS-83829: Update runc, selinux, and their transitive deps to fix CVE-2025-52881 [#8750](https://github.com/openshift/hypershift/pull/8750)
* [CNTRLPLANE-3874](https://issues.redhat.com/browse/CNTRLPLANE-3874): Backport controlPlaneVersion status to release-4.20 [#9055](https://github.com/openshift/hypershift/pull/9055)
* [OCPBUGS-90088](https://issues.redhat.com/browse/OCPBUGS-90088): [release-4.20] clear stale EtcdRecoveryActive failure condition when etcd is healthy [#8808](https://github.com/openshift/hypershift/pull/8808)
* [OCPBUGS-99143](https://issues.redhat.com/browse/OCPBUGS-99143): fix(backport): konnectivity agent auth [#9092](https://github.com/openshift/hypershift/pull/9092)
* [OCPBUGS-98574](https://issues.redhat.com/browse/OCPBUGS-98574): [release-4.20] fix(cpo): deduplicate VPC endpoint subnets by AZ to prevent DuplicateSubnetsInSameZone [#8994](https://github.com/openshift/hypershift/pull/8994)
* [OCPBUGS-78400](https://issues.redhat.com/browse/OCPBUGS-78400): remove resource limits from Agent CAPI provider [#7947](https://github.com/openshift/hypershift/pull/7947)
* [OCPBUGS-94175](https://issues.redhat.com/browse/OCPBUGS-94175): fix(cpo): prevent informer creation for inaccessible resource types [#8876](https://github.com/openshift/hypershift/pull/8876)
* [OCPBUGS-89354](https://issues.redhat.com/browse/OCPBUGS-89354): build(operator): drop hypershift-no-cgo from operator container images [#8758](https://github.com/openshift/hypershift/pull/8758)
* [OCPBUGS-86020](https://issues.redhat.com/browse/OCPBUGS-86020): OCPBUGS-62177: [release 4-20] verify cert revocation against all KAS pods [#8536](https://github.com/openshift/hypershift/pull/8536)
* [OCPBUGS-77967](https://issues.redhat.com/browse/OCPBUGS-77967): fix: global-pull-secret-syncer pod ~15-minute delay scheduling on new nodes [#8716](https://github.com/openshift/hypershift/pull/8716)
* [OCPBUGS-86780](https://issues.redhat.com/browse/OCPBUGS-86780): [release-4.20] OCPBUGS-81671: Ignition generalize image download errors [#8573](https://github.com/openshift/hypershift/pull/8573)
* [OCPBUGS-85825](https://issues.redhat.com/browse/OCPBUGS-85825): [release-4.20] Add KAS readiness sidecar to OAS, OAuth API Server, and OLM packageserver [#8529](https://github.com/openshift/hypershift/pull/8529)
* [OCPBUGS-85825](https://issues.redhat.com/browse/OCPBUGS-85825): [release-4.20] Set unhealthyPodEvictionPolicy to AlwaysAllow on all PDBs [#8528](https://github.com/openshift/hypershift/pull/8528)
* NO-JIRA: remove path filter from control-plane-operator pipelines [#8666](https://github.com/openshift/hypershift/pull/8666)
* [OCPBUGS-86573](https://issues.redhat.com/browse/OCPBUGS-86573): [release-4.20] add CP pull-secret watches for in-place propagation [#8596](https://github.com/openshift/hypershift/pull/8596)
* [OCPBUGS-86567](https://issues.redhat.com/browse/OCPBUGS-86567): fix Konflux application label for CPO 4.20 pipelines [#8603](https://github.com/openshift/hypershift/pull/8603)
* [OCPBUGS-86567](https://issues.redhat.com/browse/OCPBUGS-86567): [release-4.20] set limits for aro.openshift.io/swift-nic in request overrides for ARO swift [#8593](https://github.com/openshift/hypershift/pull/8593)
* [OCPBUGS-83711](https://issues.redhat.com/browse/OCPBUGS-83711): fix(kubevirt): filter link-local addresses from EndpointSlice endpoints [#8271](https://github.com/openshift/hypershift/pull/8271)
* [OCPBUGS-85622](https://issues.redhat.com/browse/OCPBUGS-85622): fix CVE-2026-33186 by updating grpc-go [#8517](https://github.com/openshift/hypershift/pull/8517)
* [Full changelog](https://github.com/openshift/hypershift/compare/58965feb45f9e7d7190383fcc622434e824c6f06...917164ce6017c5ea6f0e54d40211443ad5d739bb)


### [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver/tree/0d2143b7aaaf2047e9578fb3ae41f89267d4b1bc)

* [OCPBUGS-80638](https://issues.redhat.com/browse/OCPBUGS-80638): Bump google.golang.org/grpc to v1.79.3 [#141](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/141)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver/compare/390a1fa872a3a43075ad27d79a260ed3ec1e924f...0d2143b7aaaf2047e9578fb3ae41f89267d4b1bc)


### [insights-operator](https://github.com/openshift/insights-operator/tree/1b99e6213f4cf8925a4728a58e45f07a262444b2)

* [OCPBUGS-104608](https://issues.redhat.com/browse/OCPBUGS-104608): Fix indentation bug on livenessProbe [#1338](https://github.com/openshift/insights-operator/pull/1338)
* [OCPBUGS-92001](https://issues.redhat.com/browse/OCPBUGS-92001): fall back to kube-system/global-pull-secret for Insights token [#1311](https://github.com/openshift/insights-operator/pull/1311)
* [OCPBUGS-99788](https://issues.redhat.com/browse/OCPBUGS-99788): update HyperShift deployment manifest [#1326](https://github.com/openshift/insights-operator/pull/1326)
* [OCPBUGS-87870](https://issues.redhat.com/browse/OCPBUGS-87870): extractor controller [#1304](https://github.com/openshift/insights-operator/pull/1304)
* [OCPBUGS-86948](https://issues.redhat.com/browse/OCPBUGS-86948): add config option to disable runtime extractor [#1298](https://github.com/openshift/insights-operator/pull/1298)
* [OCPBUGS-86235](https://issues.redhat.com/browse/OCPBUGS-86235): [release-4.20] Add OpenTelemetry CR Gatherer [#1293](https://github.com/openshift/insights-operator/pull/1293)
* [Full changelog](https://github.com/openshift/insights-operator/compare/e5f36a454807808f44456c3588ff869d5ddc2243...1b99e6213f4cf8925a4728a58e45f07a262444b2)


### [ironic](https://github.com/openshift/ironic-image/tree/77de3c1948adc2c8c94301fce6ce9b43f5940c2b)

* [OCPBUGS-100166](https://issues.redhat.com/browse/OCPBUGS-100166): Update openstack-ironic commit hash for CVE-2026-44918 [#881](https://github.com/openshift/ironic-image/pull/881)
* [OCPBUGS-90559](https://issues.redhat.com/browse/OCPBUGS-90559): [4.20] Fix parallel power concurrency [#857](https://github.com/openshift/ironic-image/pull/857)
* Bugs OCPBUGS-82295 OCPBUGS-84371: Update sushy and Ironic to resolve ARM SuperMicro boot, Cisco vMedia Insert and BIOS Settings update issues. [#830](https://github.com/openshift/ironic-image/pull/830)
* [Full changelog](https://github.com/openshift/ironic-image/compare/4b0fc45cf7fc14d8095cea3ac96d724f199996d8...77de3c1948adc2c8c94301fce6ce9b43f5940c2b)


### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/ca46ed5c50779e0a2a7eb43f4f187954d136d717)

* [OCPBUGS-88477](https://issues.redhat.com/browse/OCPBUGS-88477): Updating ironic-python-agent commit hash that fixes CVE-2026-43003 [#301](https://github.com/openshift/ironic-agent-image/pull/301)
* [OCPBUGS-95063](https://issues.redhat.com/browse/OCPBUGS-95063): Replace individual package removal with a single rpm -e loop [#284](https://github.com/openshift/ironic-agent-image/pull/284)
* [OCPBUGS-95063](https://issues.redhat.com/browse/OCPBUGS-95063): Replace dnf remove with rpm -e to prevent dependency removal [#272](https://github.com/openshift/ironic-agent-image/pull/272)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/652b8b4dcffda86f61e181b43cda184292372a14...ca46ed5c50779e0a2a7eb43f4f187954d136d717)


### [keepalived-ipfailover](https://github.com/openshift/images/tree/4111471533cb072b6aab4a1ac4d523915f8abef1)

* [OCPBUGS-99902](https://issues.redhat.com/browse/OCPBUGS-99902): Reinstall tzdata if /usr/share/zoneinfo is missing [#249](https://github.com/openshift/images/pull/249)
* [Full changelog](https://github.com/openshift/images/compare/6c1bae0007a21796f1d1235df745c1f5152aa893...4111471533cb072b6aab4a1ac4d523915f8abef1)


### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/358d786274fe81017f7d17cc7310117dca127146)

* [OCPBUGS-99402](https://issues.redhat.com/browse/OCPBUGS-99402): fix CronJob timezone panic and embed tzdata in kube-state-metrics [#152](https://github.com/openshift/kube-state-metrics/pull/152)
* Fix for OCPBUGS-81951:  CVE-2026-34986 bump github.com/go-jose/go-jose/v4 [#144](https://github.com/openshift/kube-state-metrics/pull/144)
* [OCPBUGS-80646](https://issues.redhat.com/browse/OCPBUGS-80646): Bump google.golang.org/grpc to v1.79.3 [#139](https://github.com/openshift/kube-state-metrics/pull/139)
* [Full changelog](https://github.com/openshift/kube-state-metrics/compare/086a7f21313d6fbc5ea330d46671ce8934b26c56...358d786274fe81017f7d17cc7310117dca127146)


### [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt/tree/d9a04bd9046ab1418d83c7bfb7891f49d8429d20)

* [OCPBUGS-95086](https://issues.redhat.com/browse/OCPBUGS-95086): OWNERS: Update component to Cloud Compute / KubeVirt Provider [#80](https://github.com/openshift/cloud-provider-kubevirt/pull/80)
* [Full changelog](https://github.com/openshift/cloud-provider-kubevirt/compare/a2d607b2f1196ac371074d5fd14df80462de5b8f...d9a04bd9046ab1418d83c7bfb7891f49d8429d20)


### [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver/tree/6c353bb1eb5a021c9e845eac839ce85e95a9fede)

* [OCPBUGS-80543](https://issues.redhat.com/browse/OCPBUGS-80543): Bump google.golang.org/grpc to v1.79.3 [#99](https://github.com/openshift/kubevirt-csi-driver/pull/99)
* [Full changelog](https://github.com/openshift/kubevirt-csi-driver/compare/8fb56226aede45e49fb2f362191c6dbcf50897c6...6c353bb1eb5a021c9e845eac839ce85e95a9fede)


### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/de0171b9abf99cde11e789dd0d103cb69e7c6684)

* [OCPBUGS-86849](https://issues.redhat.com/browse/OCPBUGS-86849): Populate status label selector for scale subresource [#1504](https://github.com/openshift/machine-api-operator/pull/1504)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/d4c552a3c5b26748fb04a58de523b23266322665...de0171b9abf99cde11e789dd0d103cb69e7c6684)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/acca836821a48b58f669c64c8f8a29ca734d5ba3)

* [OCPBUGS-105436](https://issues.redhat.com/browse/OCPBUGS-105436): Use providerSpec.Template in vSphere machineset reconciliation [#6386](https://github.com/openshift/machine-config-operator/pull/6386)
* [OCPBUGS-95577](https://issues.redhat.com/browse/OCPBUGS-95577): Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole [#6256](https://github.com/openshift/machine-config-operator/pull/6256)
* [OCPBUGS-105215](https://issues.redhat.com/browse/OCPBUGS-105215): Update AMI Whitelist [#6377](https://github.com/openshift/machine-config-operator/pull/6377)
* [OCPBUGS-99650](https://issues.redhat.com/browse/OCPBUGS-99650): Delete stale auto-sizing MachineConfigs for non-default (custom) pools 4.20 [#6335](https://github.com/openshift/machine-config-operator/pull/6335)
* [release:4.20] OCPBUGS-98096: In OCB to check when a image is removed the old build is triggered again and the MC should start updating directly and no new MOSB should be triggred [#6285](https://github.com/openshift/machine-config-operator/pull/6285)
* [OCPBUGS-92029](https://issues.redhat.com/browse/OCPBUGS-92029), [OCPBUGS-98746](https://issues.redhat.com/browse/OCPBUGS-98746): [release-4.20] Backport ocl test fixes and shard the test suite [#6305](https://github.com/openshift/machine-config-operator/pull/6305)
* [OCPBUGS-93807](https://issues.redhat.com/browse/OCPBUGS-93807): move cleanUpDuplicatedMC to avoid double reboot on first updated Master node [#6242](https://github.com/openshift/machine-config-operator/pull/6242)
* [OCPBUGS-97906](https://issues.redhat.com/browse/OCPBUGS-97906): Inject proxy into MCC deployment [#6277](https://github.com/openshift/machine-config-operator/pull/6277)
* [OCPBUGS-98214](https://issues.redhat.com/browse/OCPBUGS-98214): fix: update arbiter crio config [#6288](https://github.com/openshift/machine-config-operator/pull/6288)
* [OCPBUGS-97824](https://issues.redhat.com/browse/OCPBUGS-97824): Make vsphere template updates atomic [#6272](https://github.com/openshift/machine-config-operator/pull/6272)
* [OCPBUGS-97844](https://issues.redhat.com/browse/OCPBUGS-97844): Remove sensitive ControllerConfig logging [#6273](https://github.com/openshift/machine-config-operator/pull/6273)
* [OCPBUGS-97586](https://issues.redhat.com/browse/OCPBUGS-97586): Fix kubelet certificate wait loop in criometricsproxy.yaml [#6267](https://github.com/openshift/machine-config-operator/pull/6267)
* [OCPBUGS-96160](https://issues.redhat.com/browse/OCPBUGS-96160): Update AMI Whitelist [#6262](https://github.com/openshift/machine-config-operator/pull/6262)
* [OCPBUGS-94227](https://issues.redhat.com/browse/OCPBUGS-94227): Bootstrap MCS logging entire ignition [#6251](https://github.com/openshift/machine-config-operator/pull/6251)
* [OCPBUGS-91732](https://issues.redhat.com/browse/OCPBUGS-91732): Update custom containerfile OCB test to work in a disconnected environment [#6222](https://github.com/openshift/machine-config-operator/pull/6222)
* [OCPBUGS-90969](https://issues.redhat.com/browse/OCPBUGS-90969): Process rebuild annotation on machine-os-builder restart [#6215](https://github.com/openshift/machine-config-operator/pull/6215)
* [OCPBUGS-91635](https://issues.redhat.com/browse/OCPBUGS-91635): daemon: don't pull/extract extensions for all OS updates [#6214](https://github.com/openshift/machine-config-operator/pull/6214)
* [OCPBUGS-88689](https://issues.redhat.com/browse/OCPBUGS-88689): Skip chrony-wait on first node join [#6191](https://github.com/openshift/machine-config-operator/pull/6191)
* [OCPBUGS-90133](https://issues.redhat.com/browse/OCPBUGS-90133): vSphere boot image hot loop detection is non-functional due to stable template names [#6207](https://github.com/openshift/machine-config-operator/pull/6207)
* [OCPBUGS-88360](https://issues.redhat.com/browse/OCPBUGS-88360): configure-ovs: copy lldp mode to br-ex port [#6181](https://github.com/openshift/machine-config-operator/pull/6181)
* [OCPBUGS-86864](https://issues.redhat.com/browse/OCPBUGS-86864): Verify extension packages are installed [#6114](https://github.com/openshift/machine-config-operator/pull/6114)
* [OCPBUGS-86987](https://issues.redhat.com/browse/OCPBUGS-86987): Update AMI Whitelist [#6132](https://github.com/openshift/machine-config-operator/pull/6132)
* [OCPBUGS-83862](https://issues.redhat.com/browse/OCPBUGS-83862): Generate autosizing-disabled machineconfig only for master and worker nodes on OCP 4.20 [#5885](https://github.com/openshift/machine-config-operator/pull/5885)
* [OCPBUGS-81953](https://issues.redhat.com/browse/OCPBUGS-81953): Fix CVE-2026-34986 [#6033](https://github.com/openshift/machine-config-operator/pull/6033)
* [OCPBUGS-86577](https://issues.redhat.com/browse/OCPBUGS-86577): Fix re-cordon detection [#6086](https://github.com/openshift/machine-config-operator/pull/6086)
* [OCPBUGS-86134](https://issues.redhat.com/browse/OCPBUGS-86134): use `--delete-if-present` for karg removal [#6063](https://github.com/openshift/machine-config-operator/pull/6063)
* [OCPBUGS-86313](https://issues.redhat.com/browse/OCPBUGS-86313): Apply password only if changes exist [#6075](https://github.com/openshift/machine-config-operator/pull/6075)
* [OCPBUGS-86032](https://issues.redhat.com/browse/OCPBUGS-86032): Add terminationMessagePolicy to build pod containers [#6057](https://github.com/openshift/machine-config-operator/pull/6057)
* [OCPBUGS-85078](https://issues.redhat.com/browse/OCPBUGS-85078): Fix ssh and password rollbacks [#6002](https://github.com/openshift/machine-config-operator/pull/6002)
* [OCPBUGS-85336](https://issues.redhat.com/browse/OCPBUGS-85336): Fix units rollback if update failure [#6022](https://github.com/openshift/machine-config-operator/pull/6022)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/2d25c90c0dc60344479c5bcae395a5baa6ef9c77...acca836821a48b58f669c64c8f8a29ca734d5ba3)


### [machine-os-images](https://github.com/openshift/machine-os-images/tree/5da52107b36e002d56e5e82f4b2cd496b1c4ec7a)

* [OCPBUGS-87874](https://issues.redhat.com/browse/OCPBUGS-87874): Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs [#98](https://github.com/openshift/machine-os-images/pull/98)
* [OCPBUGS-85480](https://issues.redhat.com/browse/OCPBUGS-85480): Force rebuild for OCP 4.20 [#94](https://github.com/openshift/machine-os-images/pull/94)
* [OCPBUGS-85480](https://issues.redhat.com/browse/OCPBUGS-85480): Force rebuild for OCP 4.20 [#86](https://github.com/openshift/machine-os-images/pull/86)
* [Full changelog](https://github.com/openshift/machine-os-images/compare/551bb5d75e782e47b83292d883e41bc57df730a4...5da52107b36e002d56e5e82f4b2cd496b1c4ec7a)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/903e9005bfb0bbf544eb528e930b98a5ea85e777)

* NO-JIRA: Fix for OCPBUGS-89697 CVE-2026-12143 [#1138](https://github.com/openshift/monitoring-plugin/pull/1138)
* [OCPBUGS-99027](https://issues.redhat.com/browse/OCPBUGS-99027): Fix CVE-2026-49978 - bump DOMPurify to &gt;= 3.4.7 [#1087](https://github.com/openshift/monitoring-plugin/pull/1087)
* [OU-1240](https://issues.redhat.com/browse/OU-1240): Makefile and package.json to enable test-frontend-ci [#1096](https://github.com/openshift/monitoring-plugin/pull/1096)
* [OU-1240](https://issues.redhat.com/browse/OU-1240): Dockerfile.test permission [#1079](https://github.com/openshift/monitoring-plugin/pull/1079)
* [OCPBUGS-99297](https://issues.redhat.com/browse/OCPBUGS-99297): graph redirect query parameter [#1074](https://github.com/openshift/monitoring-plugin/pull/1074)
* [OU-651](https://issues.redhat.com/browse/OU-651): Fix AlertRules page to display user defined loki alerts [#1058](https://github.com/openshift/monitoring-plugin/pull/1058)
* Fix for OCPBUGS-91621: CVE-2026-45736 [#1025](https://github.com/openshift/monitoring-plugin/pull/1025)
* NO-JIRA: fix incidents unit test [#1039](https://github.com/openshift/monitoring-plugin/pull/1039)
* Fix for OCPBUGS-94012: CVE-2026-13676 [#1030](https://github.com/openshift/monitoring-plugin/pull/1030)
* [OCPBUGS-87091](https://issues.redhat.com/browse/OCPBUGS-87091): [release-4.20] fast-uri: URI authority bypass due to improper delimiter handling [#974](https://github.com/openshift/monitoring-plugin/pull/974)
* [OCPBUGS-88372](https://issues.redhat.com/browse/OCPBUGS-88372), [OCPBUGS-88383](https://issues.redhat.com/browse/OCPBUGS-88383), [OCPBUGS-88392](https://issues.redhat.com/browse/OCPBUGS-88392), [OCPBUGS-88428](https://issues.redhat.com/browse/OCPBUGS-88428), [OCPBUGS-88430](https://issues.redhat.com/browse/OCPBUGS-88430), [OCPBUGS-88446](https://issues.redhat.com/browse/OCPBUGS-88446): CVE-2026-44487 bump axios to 1.16.0 [#1000](https://github.com/openshift/monitoring-plugin/pull/1000)
* [OCPBUGS-84289](https://issues.redhat.com/browse/OCPBUGS-84289): bump follow-redirects to 1.16.0 [#986](https://github.com/openshift/monitoring-plugin/pull/986)
* [OCPBUGS-79456](https://issues.redhat.com/browse/OCPBUGS-79456): immutable bump: fix for CVE-2026-29063 [4.20] [#951](https://github.com/openshift/monitoring-plugin/pull/951)
* [OU-1371](https://issues.redhat.com/browse/OU-1371): reset queries when namespace changes in dev perspective [#945](https://github.com/openshift/monitoring-plugin/pull/945)
* [OU-1369](https://issues.redhat.com/browse/OU-1369): prevent namespace and project desync [#941](https://github.com/openshift/monitoring-plugin/pull/941)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/61c918dff3f590a19387b8bba18ed3d75e455176...903e9005bfb0bbf544eb528e930b98a5ea85e777)


### [must-gather](https://github.com/openshift/must-gather/tree/6b2eea0d83ca1f05f9032d66be1c2ee80cfa1459)

* [OCPBUGS-87215](https://issues.redhat.com/browse/OCPBUGS-87215): Add Istio/Gateway API gather scripts to OCP 4.20.z [#555](https://github.com/openshift/must-gather/pull/555)
* [OCPBUGS-85488](https://issues.redhat.com/browse/OCPBUGS-85488): Collect object size with the object count [#545](https://github.com/openshift/must-gather/pull/545)
* [Full changelog](https://github.com/openshift/must-gather/compare/f0c64742c79afce5e367ca2c7b830ad448abe1df...6b2eea0d83ca1f05f9032d66be1c2ee80cfa1459)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/da01518cc01abf023337e6cc26e3b6503797a7f8)

* [OCPBUGS-92706](https://issues.redhat.com/browse/OCPBUGS-92706): Updated doc links based on release [#440](https://github.com/openshift/networking-console-plugin/pull/440)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/c9c1a9f5ca8287d20a0aafab9507478c6f291614...da01518cc01abf023337e6cc26e3b6503797a7f8)


### [oauth-server](https://github.com/openshift/oauth-server/tree/715ae668b8765b029cb7851a509b9948b8cc57a0)

* [OCPBUGS-81813](https://issues.redhat.com/browse/OCPBUGS-81813): Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 [#236](https://github.com/openshift/oauth-server/pull/236)
* [Full changelog](https://github.com/openshift/oauth-server/compare/21329625a0f5807af9c61e6cd65904c93d65e48c...715ae668b8765b029cb7851a509b9948b8cc57a0)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/9b186403c88394b54ab491871a158a124df39a02)

* Fix for OCPBUGS-81937: CVE-2026-34986 github.com/go-jose/go-jose/v4 [#1427](https://github.com/openshift/oc-mirror/pull/1427)
* [OCPBUGS-84064](https://issues.redhat.com/browse/OCPBUGS-84064): Remove status field from CatalogSource, ClusterCatalog... [#1392](https://github.com/openshift/oc-mirror/pull/1392)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/cb2b9df9c4295a97b2d4f528b73a32d77df6b3ba...9b186403c88394b54ab491871a158a124df39a02)


### [olm-catalogd, olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller/tree/39c3a80d919cafc207f5f208a5f88b23e468cd8d)

* [OCPBUGS-100431](https://issues.redhat.com/browse/OCPBUGS-100431): Fix cache path to avoid /var/cache/dnf conflict [#786](https://github.com/openshift/operator-framework-operator-controller/pull/786)
* [OCPBUGS-100075](https://issues.redhat.com/browse/OCPBUGS-100075): increase catalog HTTP client timeout from 10s to 5m [#777](https://github.com/openshift/operator-framework-operator-controller/pull/777)
* [OCPBUGS-86968](https://issues.redhat.com/browse/OCPBUGS-86968): catalogd: clean up orphaned temp dirs in catalog storage [#744](https://github.com/openshift/operator-framework-operator-controller/pull/744)
* [OCPBUGS-80662](https://issues.redhat.com/browse/OCPBUGS-80662), [OCPBUGS-80663](https://issues.redhat.com/browse/OCPBUGS-80663): Bump google.golang.org/grpc to v1.79.3 [#727](https://github.com/openshift/operator-framework-operator-controller/pull/727)
* [OCPBUGS-81956](https://issues.redhat.com/browse/OCPBUGS-81956), [OCPBUGS-81957](https://issues.redhat.com/browse/OCPBUGS-81957): Bump github.com/go-jose/go-jose/v4@4.1.1 to 4.1.4 [#719](https://github.com/openshift/operator-framework-operator-controller/pull/719)
* [Full changelog](https://github.com/openshift/operator-framework-operator-controller/compare/3e2401f23ef666e8f33789a397d81a7d352b0a33...39c3a80d919cafc207f5f208a5f88b23e468cd8d)


### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/eda815e0515550890354dda41e65f8dd35e15ad5)

* [OCPBUGS-82867](https://issues.redhat.com/browse/OCPBUGS-82867): Address CVE-2026-35469 [#652](https://github.com/openshift/openshift-apiserver/pull/652)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/34cb4762e1716c1a31a344118b8a3ad00c28d831...eda815e0515550890354dda41e65f8dd35e15ad5)


### [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack/tree/02e56026c3a2628c8a5115f4f5bc2bb3514ef6c3)

* [OCPBUGS-94016](https://issues.redhat.com/browse/OCPBUGS-94016): Revendor CAPO [#172](https://github.com/openshift/machine-api-provider-openstack/pull/172)
* [Full changelog](https://github.com/openshift/machine-api-provider-openstack/compare/7f8ae5007e4299769e25172a821342dc2874567c...02e56026c3a2628c8a5115f4f5bc2bb3514ef6c3)


### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/1628e53777871f6c264d41a870cc4ee7248106f2)

* [OCPBUGS-80670](https://issues.redhat.com/browse/OCPBUGS-80670), [OCPBUGS-80671](https://issues.redhat.com/browse/OCPBUGS-80671), [OCPBUGS-80672](https://issues.redhat.com/browse/OCPBUGS-80672): Bump google.golang.org/grpc to v1.79.3 for CVE-2026-33186[Release-4.20] [#1293](https://github.com/openshift/operator-framework-olm/pull/1293)
* [OCPBUGS-81958](https://issues.redhat.com/browse/OCPBUGS-81958), [OCPBUGS-81959](https://issues.redhat.com/browse/OCPBUGS-81959), [OCPBUGS-81960](https://issues.redhat.com/browse/OCPBUGS-81960): Bump github.com/go-jose/go-jose/v4 to v4.1.4 [#1295](https://github.com/openshift/operator-framework-olm/pull/1295)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/72a01f66530d38330e9442d2238ab30aa90dcb39...1628e53777871f6c264d41a870cc4ee7248106f2)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/c28f7669a9ef8e28a47163b1656c5647ea8a725c)

* [OCPBUGS-105423](https://issues.redhat.com/browse/OCPBUGS-105423): Fix traffic leak in egress IP on secondary interface [#3376](https://github.com/openshift/ovn-kubernetes/pull/3376)
* [OCPBUGS-105557](https://issues.redhat.com/browse/OCPBUGS-105557): Broadcast traffic fan-out across UDNs hits OVS resubmit limit [#3377](https://github.com/openshift/ovn-kubernetes/pull/3377)
* [OCPBUGS-99643](https://issues.redhat.com/browse/OCPBUGS-99643): Migrate ovs external_ids bash ovs-vsctl calls to libovsdb [#3326](https://github.com/openshift/ovn-kubernetes/pull/3326)
* [OCPBUGS-95076](https://issues.redhat.com/browse/OCPBUGS-95076): prevent duplicate logical_router_static_route [#3275](https://github.com/openshift/ovn-kubernetes/pull/3275)
* [OCPBUGS-99542](https://issues.redhat.com/browse/OCPBUGS-99542): kubevirt: skip source LSP re-enable when source pod is not local [#3318](https://github.com/openshift/ovn-kubernetes/pull/3318)
* [OCPBUGS-99543](https://issues.redhat.com/browse/OCPBUGS-99543): kubevirt: Support handling vm hostname field [#3319](https://github.com/openshift/ovn-kubernetes/pull/3319)
* [OCPBUGS-82872](https://issues.redhat.com/browse/OCPBUGS-82872): Bump github.com/moby/spdystream to v0.5.1 [#3316](https://github.com/openshift/ovn-kubernetes/pull/3316)
* [OCPBUGS-85366](https://issues.redhat.com/browse/OCPBUGS-85366): ANP-Skip redundant status updates to reduce API server load [#3183](https://github.com/openshift/ovn-kubernetes/pull/3183)
* [OCPBUGS-76473](https://issues.redhat.com/browse/OCPBUGS-76473): Remove forced V(5) logging during startup [#2919](https://github.com/openshift/ovn-kubernetes/pull/2919)
* [OCPBUGS-72401](https://issues.redhat.com/browse/OCPBUGS-72401), [OCPBUGS-72402](https://issues.redhat.com/browse/OCPBUGS-72402): manual backport bug fixes [#2927](https://github.com/openshift/ovn-kubernetes/pull/2927)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/dbebe515c05e673ed62083e019e55aaf9bcebeab...c28f7669a9ef8e28a47163b1656c5647ea8a725c)


### [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs/tree/d634e80b52e7ecb087163eb5927450dc884e24df)

* [OCPBUGS-80677](https://issues.redhat.com/browse/OCPBUGS-80677): bump google.golang.org/grpc to v1.79.3 [#97](https://github.com/openshift/cloud-provider-powervs/pull/97)
* [Full changelog](https://github.com/openshift/cloud-provider-powervs/compare/2424e8dd4bf3e19c3e65efebc03bf4942665f7c4...d634e80b52e7ecb087163eb5927450dc884e24df)


### [prometheus](https://github.com/openshift/prometheus/tree/f226aee2d4de01bd0f3a85b16308f9e22514111c)

* [OCPBUGS-88682](https://issues.redhat.com/browse/OCPBUGS-88682): remote: validate snappy decoded length before allocation in read endpoint [#342](https://github.com/openshift/prometheus/pull/342)
* [OCPBUGS-80678](https://issues.redhat.com/browse/OCPBUGS-80678): Bump google.golang.org/grpc to v1.79.3 [#319](https://github.com/openshift/prometheus/pull/319)
* [OCPBUGS-86251](https://issues.redhat.com/browse/OCPBUGS-86251): fix: TLS client cert rotation when no CA is configured [#315](https://github.com/openshift/prometheus/pull/315)
* [Full changelog](https://github.com/openshift/prometheus/compare/72dbf103acd3a59ba6bb6979e255a0c82864956c...f226aee2d4de01bd0f3a85b16308f9e22514111c)


### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/0bafd4edf6a8e758c8d6c2725554fa79fa9f94da)

* [OCPBUGS-98175](https://issues.redhat.com/browse/OCPBUGS-98175): build(deps): bump github.com/hashicorp/memberlist to a… [#160](https://github.com/openshift/prometheus-alertmanager/pull/160)
* [OCPBUGS-100353](https://issues.redhat.com/browse/OCPBUGS-100353): Set testdata CA expiry to 20 years from issue date (#4112) [#149](https://github.com/openshift/prometheus-alertmanager/pull/149)
* [OCPBUGS-99449](https://issues.redhat.com/browse/OCPBUGS-99449): embed tzdata in the alertmanager binary [#143](https://github.com/openshift/prometheus-alertmanager/pull/143)
* [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/419f2843332265d44982920d6fb4db220ec26f91...0bafd4edf6a8e758c8d6c2725554fa79fa9f94da)


### [rhel-coreos, rhel-coreos-extensions](https://github.com/openshift/os/tree/847b7d8c3b60f60e86f1de0b7efebb746c75d1bc)

* [OCPBUGS-105533](https://issues.redhat.com/browse/OCPBUGS-105533): NetworkManager-ovs has moved to RHCOS [#1959](https://github.com/openshift/os/pull/1959)
* NO-JIRA: rhaos-pkgs-match-openshift: exclude known package mismatches [#1920](https://github.com/openshift/os/pull/1920)
* [Full changelog](https://github.com/openshift/os/compare/49a3e234f2d0381d3a309f10fc29043fcd63592e...847b7d8c3b60f60e86f1de0b7efebb746c75d1bc)


### [route-controller-manager](https://github.com/openshift/route-controller-manager/tree/1a0229e40e5c569c6c59f6b10c26584bccd084b5)

* [OCPBUGS-80554](https://issues.redhat.com/browse/OCPBUGS-80554): Bump google.golang.org/grpc to v1.79.3 [#83](https://github.com/openshift/route-controller-manager/pull/83)
* [Full changelog](https://github.com/openshift/route-controller-manager/compare/ec18e9be0ebcbd7cb262d31f50148f81d0edd48f...1a0229e40e5c569c6c59f6b10c26584bccd084b5)


### [tests](https://github.com/openshift/origin/tree/255943c156e587ab50b5917d87f91348b35348a1)

* [OCPBUGS-100440](https://issues.redhat.com/browse/OCPBUGS-100440): retry GetVotingMemberNames on transient etcd client fails [#31508](https://github.com/openshift/origin/pull/31508)
* [OCPBUGS-99782](https://issues.redhat.com/browse/OCPBUGS-99782): Backport node_e2e test migrations [#31430](https://github.com/openshift/origin/pull/31430)
* [OCPBUGS-99301](https://issues.redhat.com/browse/OCPBUGS-99301): admit and extract non-payload 4.20 [#31387](https://github.com/openshift/origin/pull/31387)
* [OCPBUGS-85523](https://issues.redhat.com/browse/OCPBUGS-85523): Remove restriction of unmanaged x-k8s.io [#31351](https://github.com/openshift/origin/pull/31351)
* [OCPBUGS-91996](https://issues.redhat.com/browse/OCPBUGS-91996): Add openshift/disruptive-longrunning testsuite in release-4.20 branch [#31334](https://github.com/openshift/origin/pull/31334)
* [OCPBUGS-82147](https://issues.redhat.com/browse/OCPBUGS-82147), [OCPBUGS-92038](https://issues.redhat.com/browse/OCPBUGS-92038), [OCPBUGS-92039](https://issues.redhat.com/browse/OCPBUGS-92039), [OCPBUGS-92041](https://issues.redhat.com/browse/OCPBUGS-92041), [OCPBUGS-92042](https://issues.redhat.com/browse/OCPBUGS-92042), [OCPBUGS-92043](https://issues.redhat.com/browse/OCPBUGS-92043), [OCPBUGS-92044](https://issues.redhat.com/browse/OCPBUGS-92044), [OCPBUGS-92045](https://issues.redhat.com/browse/OCPBUGS-92045): Backport noOLM Gateway API test coverage and upgrade tests [#31322](https://github.com/openshift/origin/pull/31322)
* [OCPBUGS-87902](https://issues.redhat.com/browse/OCPBUGS-87902): tests: authorization/rbac: Align restricted-v3 rule [#31285](https://github.com/openshift/origin/pull/31285)
* [OCPBUGS-85155](https://issues.redhat.com/browse/OCPBUGS-85155), [OCPBUGS-87207](https://issues.redhat.com/browse/OCPBUGS-87207): Enable Gateway API tests on vSphere and baremetal [#31262](https://github.com/openshift/origin/pull/31262)
* [OCPBUGS-87902](https://issues.redhat.com/browse/OCPBUGS-87902): tests: authorization/rbac: Add restricted-v3 scc [#30502](https://github.com/openshift/origin/pull/30502)
* [Full changelog](https://github.com/openshift/origin/compare/a99b27653d2fded28c33e6234878824e9a46ad78...255943c156e587ab50b5917d87f91348b35348a1)


### [thanos](https://github.com/openshift/thanos/tree/e09de117035d272a18dbd94d0bc8c8e29346026e)

* [OCPBUGS-80693](https://issues.redhat.com/browse/OCPBUGS-80693): Bump google.golang.org/grpc to v1.79.3 [#182](https://github.com/openshift/thanos/pull/182)
* [Full changelog](https://github.com/openshift/thanos/compare/c0951032b34b832d0f5467e616999490a284101b...e09de117035d272a18dbd94d0bc8c8e29346026e)


### [vsphere-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-vsphere/tree/769d0fb781dfb53df5d533b917c363a553185fd6)

* [OCPBUGS-80698](https://issues.redhat.com/browse/OCPBUGS-80698): Bump google.golang.org/grpc to v1.79.3 [#109](https://github.com/openshift/cluster-api-provider-vsphere/pull/109)
* [Full changelog](https://github.com/openshift/cluster-api-provider-vsphere/compare/6d0cfe391f8f76211f14f34a23612722603fe56b...769d0fb781dfb53df5d533b917c363a553185fd6)


### [vsphere-csi-driver, vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver/tree/a13af75662e0a1e16488f13424413585ef848692)

* [OCPBUGS-92959](https://issues.redhat.com/browse/OCPBUGS-92959): Bump golang.org/x/crypto/ssh to v0.48.0-sec.1 [#191](https://github.com/openshift/vmware-vsphere-csi-driver/pull/191)
* [OCPBUGS-80701](https://issues.redhat.com/browse/OCPBUGS-80701): Bump google.golang.org/grpc to v1.79.3 [#174](https://github.com/openshift/vmware-vsphere-csi-driver/pull/174)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver/compare/61d0d00a78ee60ee57fcc99648a8851f0db52e5a...a13af75662e0a1e16488f13424413585ef848692)