# 4.20.44

Created: 2026-10-25 22:29:21 +0000 UTC

Image Digest: `sha256:437514ee0f768d8116c19f527be1eaa239ce26ccef6abbf0cb7ebf0056ec6e15`


## Changes from 4.20.34

### Components

* Kubectl 1.33.3
* Kubernetes 1.33.13
* Kubernetes Tests 1.33.4
* Red Hat Enterprise Linux CoreOS upgraded from 9.6.20260811-0 to 9.6.20261023-1



### FeatureGate Changes
| FeatureGate | Default<br/>Hypershift | Default<br/>SelfManagedHA | DevPreviewNoUpgrade<br/>Hypershift | DevPreviewNoUpgrade<br/>SelfManagedHA | TechPreviewNoUpgrade<br/>Hypershift | TechPreviewNoUpgrade<br/>SelfManagedHA  |
| :------ | :---: | :---: | :---: | :---: | :---: | :---:  |
| VSphereMultiVCenterDay2 <br/> (0 tests)|  |  | Enabled<br/>(New)| Enabled<br/>(New)| Enabled<br/>(New)| Enabled<br/>(New) |


### Rebuilt images without code change

* [agent-installer-utils](https://github.com/openshift/agent-installer-utils) git [e3e997d9](https://github.com/openshift/agent-installer-utils/commit/e3e997d9f7b84b134a07186de9bddde21598ae32) `sha256:f73374f2fd047db34d5fed64c703eb59acc08b8fbff7d7d21836aab057ddcbe1`
* [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy) git [11b24a2c](https://github.com/openshift/apiserver-network-proxy/commit/11b24a2c7452ef683a1d989f1016e6e815f5c112) `sha256:983e8c9c5dc06c4d702432e70e954434c1ade50f1e36bfe8c537e76af9636247`
* [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws) git [bb88da16](https://github.com/openshift/cloud-provider-aws/commit/bb88da16b29d63573861351afc5ca8c4547775d6) `sha256:c33c9c516efacba8165107fe4556bc6cc880b2d2ec401bd2d34cb64e5182a90a`
* [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver) git [6c99b973](https://github.com/openshift/aws-ebs-csi-driver/commit/6c99b973a6a5ca0202d56b87119714b9ec4a5365) `sha256:a56b3406691ce3c5325e2116253803a4bdd5a9baa1fc0508a4190ae790ca73be`
* [aws-karpenter-provider-aws](https://github.com/openshift/aws-karpenter-provider-aws) git [b37141b0](https://github.com/openshift/aws-karpenter-provider-aws/commit/b37141b051bdf790eb7e8f45b95f6bd7dc8140f4) `sha256:2d6f31c8ef825ee635096afd9c25b6f0f7d9febc6e5403f47b3437302901a934`
* [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider) git [0000b76a](https://github.com/openshift/aws-encryption-provider/commit/0000b76a838f6b56efcfecfa110bc6795d0f7746) `sha256:55619dd5db989644d9a9a355ff8c8d07a385d56586945e7de673e27617fec078`
* [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook) git [8e83772a](https://github.com/openshift/aws-pod-identity-webhook/commit/8e83772ab8d31b32225744d4f0b0023680692daf) `sha256:5aa8656fc27ba60f5f7d40f0916b4dd297b04715b83804bb1df2a854e2159a4b`
* [azure-service-operator](https://github.com/openshift/azure-service-operator) git [d957de42](https://github.com/openshift/azure-service-operator/commit/d957de42c2e6255b79fcfe7aedac78eb746d92cc) `sha256:e3142ee1f203c428cee03987e30d30b9f94398412119d0d8f295269ab76de8f1`
* [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3) git [f782ba74](https://github.com/openshift/cluster-api-provider-metal3/commit/f782ba747ed353721c84ceb754ca8403f94adb6a) `sha256:5c9fa81124c31a9d7c2f30fd57e6071c736f71a3daed25a2a1177e3a38a68793`
* [baremetal-operator](https://github.com/openshift/baremetal-operator) git [f74f7d4c](https://github.com/openshift/baremetal-operator/commit/f74f7d4c30cb936e84c79bbc60a9f57660058e98) `sha256:827c7d74a7789234394f190ac346937645dbb426615b3c5fb7e877dd7d47fb4c`
* [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator) git [17181f99](https://github.com/openshift/cluster-baremetal-operator/commit/17181f99343a5b1fb08af8a7994ad3e9eecc6c1e) `sha256:ed2f5dea203f46db9ab91eda4c339bce17e7eec7b6dddedb87cc88b8c2638d04`
* [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap) git [74abc555](https://github.com/openshift/cluster-bootstrap/commit/74abc555111bac56a67957ef517ef086e4643c50) `sha256:303ebd49ca1249f9b72f80dedbd868e97224d3b760afacf1fb3971fe7597e558`
* [cluster-capi-controllers](https://github.com/openshift/cluster-api) git [dfeecf96](https://github.com/openshift/cluster-api/commit/dfeecf9616e049ac552f91a71b2a50cb0e96042c) `sha256:5c53bc3176642950c863e6affaa56fade63b552922fd67838a386490a7beec1b`
* [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator) git [4bd6d82d](https://github.com/openshift/cluster-capi-operator/commit/4bd6d82d21a2d201d9857ca1e26b21c70a648bf5) `sha256:1993bf3ff349bc7fd941f8426f3820ff32f954c3ef453f8266efc69252da4fc1`
* [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator) git [82578923](https://github.com/openshift/cluster-dns-operator/commit/82578923164636746e0d74d594ab32d83a660c0b) `sha256:f9d571e4dc59a4d95fa085b5ce8decdadef6ac5164088d1d280c2d28d4bdf30f`
* [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator) git [b04c7c12](https://github.com/openshift/cluster-image-registry-operator/commit/b04c7c121851704973a94a50e42af1425045899c) `sha256:0ac7e72a46804413eed94b6e624c51d0088047d99a59500ebb3293d5a7da505a`
* [cluster-kube-cluster-api-operator](https://github.com/openshift/cluster-api-operator) git [adaae0d4](https://github.com/openshift/cluster-api-operator/commit/adaae0d4e6d7a0e466e7e86af399de0b828c8b81) `sha256:ea22405da2eded888eee6436f57bf0c69627352b7dec0b0bad6b6b7521235d51`
* [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator) git [5adc1429](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/commit/5adc14299739bc64c8812cbab0b0ff2d12863602) `sha256:602c59086ad87084db9c6ecb8d3382eeb2ee32003eba5e190f7535306d6a76c9`
* [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver) git [b3c82b2e](https://github.com/openshift/cluster-machine-approver/commit/b3c82b2eec66ae3ae510df0603af1212c34be618) `sha256:f668043bada8eabce5e0b9492731635ff639cc64a4f7c43ea61c2ac7cb31ec58`
* [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator) git [d01cc083](https://github.com/openshift/cluster-olm-operator/commit/d01cc083748864e3c8dcc72fb75516492dec3555) `sha256:46b8735d7772d3a47ee5fec9521d42897f0f0ff6c0b13768bf355aea69a38d15`
* [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator) git [9cfa5679](https://github.com/openshift/cluster-openshift-apiserver-operator/commit/9cfa5679a8ac1e5a68eea32179d9e069da85dfcf) `sha256:ced7c1089bd92caddced44c66042f2a19f0990e8593534c9f92be82aaba4bfc1`
* [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator) git [aa455c04](https://github.com/openshift/cluster-openshift-controller-manager-operator/commit/aa455c043152123595c2b4f72e02279aad9dd48a) `sha256:4a22b1d3d20d0ea8de27bedc933acf20b26460d63479654bfcd8a77e842617cf`
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [c40e7b9b](https://github.com/openshift/cluster-update-keys/commit/c40e7b9b60c62690a25333fc54ae0d3705474afb) `sha256:bfa6ec042919622ea0398df2faae1da8ac24404ef2624e115874cf40c062c34f`
* [configmap-reloader](https://github.com/openshift/configmap-reload) git [2438d7c8](https://github.com/openshift/configmap-reload/commit/2438d7c8e495201361d87da205649bc38fc4822b) `sha256:c3ed87ae6635ab69fc7309b08ae2ac5aa4597fa75e544112fbe7c3841963a173`
* [container-networking-plugins](https://github.com/openshift/containernetworking-plugins) git [184a9601](https://github.com/openshift/containernetworking-plugins/commit/184a96011a8cacb72319cdccb904271a99c5928d) `sha256:5115943e6f64169d79556ac410200709a28eb64a1fac51d7df2cea6f78cd0260`
* [containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins) git [184a9601](https://github.com/openshift/containernetworking-plugins/commit/184a96011a8cacb72319cdccb904271a99c5928d) `sha256:47a9f403f0e707cfe48b7e6612d4d135a682bf4ec64f539e5d671e098b6484d0`
* [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs) git [c4cdae44](https://github.com/openshift/csi-driver-nfs/commit/c4cdae44ef7c33e4b7ce06a3b599a8bc0707bff7) `sha256:38cbd0a51089068e5cb60797202bd039f82363eddaa387186232b992d5982272`
* [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar) git [6ce4713c](https://github.com/openshift/csi-node-driver-registrar/commit/6ce4713c87b735e2546a65a871bd2c7cfe383c31) `sha256:8305acc3dcaa08d2265c16373af5e022d0ac6af23fbdd1eedf165a795764b10c`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [62e1f604](https://github.com/openshift/driver-toolkit/commit/62e1f6040cd297149f5f14e0d20814759ec61354) `sha256:ab665433f2e3a134303204ef51d0e05b85c6aa2b89af39c36252b34ea0c1600e`
* [egress-router-cni](https://github.com/openshift/egress-router-cni) git [cfcc6c44](https://github.com/openshift/egress-router-cni/commit/cfcc6c44a9aacf48585dbe6618e5561f6c55666a) `sha256:2883f807b61df77e13abdbfa9849aa88095bf867ee0bf40a8a3e87132cac5f62`
* [etcd](https://github.com/openshift/etcd) git [05bca977](https://github.com/openshift/etcd/commit/05bca97760b1cfa1bcef11c0b1f1a5c4dab19709) `sha256:d76192906b3d1417d0f115cfb734ecadfb2a7d24f0ee47323517147d6cf56a05`
* [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp) git [74e23890](https://github.com/openshift/cluster-api-provider-gcp/commit/74e2389011d640a371c0acb6ff71b1582cab23a1) `sha256:996b96c382834994cf5a494f2ead5c9f137e9c996315492cddc59df8819b7f6a`
* [haproxy-router](https://github.com/openshift/router) git [0fec034e](https://github.com/openshift/router/commit/0fec034e28f1f44ed75dcc1ab96f7135fd9beb49) `sha256:85d2b88c030ccc096e03dbbe9297c57209d4817abc28fd7524b846a1705112e8`
* [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver) git [0d2143b7](https://github.com/openshift/ibm-vpc-block-csi-driver/commit/0d2143b7aaaf2047e9578fb3ae41f89267d4b1bc) `sha256:a9e58d26fb1d5bbb443ac618bfbab17a542cad8ac6760c55c2a204ec08a7c6e2`
* [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [6c92e542](https://github.com/openshift/ironic-rhcos-downloader/commit/6c92e5425b58baa9d4dd951a992b7460e8407247) `sha256:5749fd114854807d092c8e1f73a67e8e6d81c945231e4937616ad0e92890e857`
* [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager) git [fa5b8b8b](https://github.com/openshift/ironic-static-ip-manager/commit/fa5b8b8bb73e509f74205a99a0ed1cb07a843885) `sha256:81252d2329e60250b4bd1b0696f8e616fb4b4225e4e1a6a0a03e74753ab099fb`
* [keepalived-ipfailover](https://github.com/openshift/images) git [41114715](https://github.com/openshift/images/commit/4111471533cb072b6aab4a1ac4d523915f8abef1) `sha256:c5a6c03b08edd33fe4af76a391a555be32e405f44cf42abe40110661e167f0f7`
* [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator) git [0f8a4eb8](https://github.com/openshift/kubernetes-kube-storage-version-migrator/commit/0f8a4eb84ace9b746cf25d51d80dacf34ca5f953) `sha256:72686a177b6ef206787f3d6adbcb0216dfe3eb23ee41540a5108309958985543`
* [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt) git [d9a04bd9](https://github.com/openshift/cloud-provider-kubevirt/commit/d9a04bd9046ab1418d83c7bfb7891f49d8429d20) `sha256:fe11b51d72b2d04a4fce538ecd3180e936bf53b1dc683967b48178296471dd93`
* [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver) git [6c353bb1](https://github.com/openshift/kubevirt-csi-driver/commit/6c353bb1eb5a021c9e845eac839ce85e95a9fede) `sha256:a3a24d32adbdc131821675d35f4b4ef614567e7c44aa84f0e6795351ef79ec6b`
* [machine-os-images](https://github.com/openshift/machine-os-images) git [5da52107](https://github.com/openshift/machine-os-images/commit/5da52107b36e002d56e5e82f4b2cd496b1c4ec7a) `sha256:d0a6d608cb0819211fd043a7124292bc6de871f18ec8841ad95b2ad3d96eb385`
* [metallb-frr](https://github.com/openshift/frr) git [3ca45c51](https://github.com/openshift/frr/commit/3ca45c517eafe07aac0866e5cbd32a5c08081f22) `sha256:0ef906699a4d8ff690175f15f49c3b7913f25d0278ec2df5d1ea0ef44e6bcfe2`
* [multus-route-override-cni](https://github.com/openshift/route-override-cni) git [391c1b03](https://github.com/openshift/route-override-cni/commit/391c1b0361e17c5718508810f0bdb6ff66ae6e81) `sha256:bbc2d2baaa5dd196a69e6b3e9f49b676d77279e6301609061c777f85b5a352d0`
* [must-gather](https://github.com/openshift/must-gather) git [6b2eea0d](https://github.com/openshift/must-gather/commit/6b2eea0d83ca1f05f9032d66be1c2ee80cfa1459) `sha256:ec648a771e20b1131e51e7a25dd86eaf89f6448b3e34053abc166c8da5a2dfc3`
* [network-interface-bond-cni](https://github.com/openshift/bond-cni) git [dd3c4d0b](https://github.com/openshift/bond-cni/commit/dd3c4d0b886138d974022b963e72f2e90293abfe) `sha256:b959ca15a6b645b5069b0e7b06ee1e7e38a3e913582c9b73d7648355fdd4920a`
* [network-tools](https://github.com/openshift/network-tools) git [26d09174](https://github.com/openshift/network-tools/commit/26d09174cbd92386469e777e3bf49bfa95d035d5) `sha256:7a97b982f7a33773e0c5c2a047ed67d6becb88a3f688f27f52d0ae5b74cd5f1c`
* [nutanix-machine-controllers](https://github.com/openshift/machine-api-provider-nutanix) git [3200ddef](https://github.com/openshift/machine-api-provider-nutanix/commit/3200ddef48a5a8d47b96539419c51f3619cb1fd5) `sha256:e69cca4cb21adc889ab0d863ea5837dba0392123f0b1f9c2b29af1eb5c3e2627`
* [openshift-apiserver](https://github.com/openshift/openshift-apiserver) git [eda815e0](https://github.com/openshift/openshift-apiserver/commit/eda815e0515550890354dda41e65f8dd35e15ad5) `sha256:37c16406e52b6cef15d1d6d1528a625ac3047bb06a6f55ec3af5b716b771ea91`
* [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack) git [c91265ed](https://github.com/openshift/cluster-api-provider-openstack/commit/c91265ed4f82c0b36fbfc50040b8180f04fcf4cc) `sha256:a1f9ebd9b1f7314d0fdced95f80ce8494f63cb5c8df505ce515e1b134547a9e8`
* [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack) git [02e56026](https://github.com/openshift/machine-api-provider-openstack/commit/02e56026c3a2628c8a5115f4f5bc2bb3514ef6c3) `sha256:596ff693869c2d275e573aef53261fd0c8fd72834d7c4809574e1d85b1324e67`
* [operator-marketplace](https://github.com/operator-framework/operator-marketplace) git [4ccd56c9](https://github.com/operator-framework/operator-marketplace/commit/4ccd56c96839e2389e12bf3f8390a6c062e9b2cf) `sha256:5404a31c44e070e5d214cbabd748030e93393f6c50357cdb25fedb6f4e618eb0`
* [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator) git [4036cd3b](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/commit/4036cd3b5e45cf4d8c3c34def599657435601661) `sha256:d91020c8f6403f5485d12b3c70a72de6e2b878f5a20a621468821047ed4f945d`
* [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs) git [d634e80b](https://github.com/openshift/cloud-provider-powervs/commit/d634e80b52e7ecb087163eb5927450dc884e24df) `sha256:1d2d49e0e496aefc616897b066b8c1c2e609f3659cee50be103d3e2c9b673e7f`
* [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs) git [f011b3c7](https://github.com/openshift/machine-api-provider-powervs/commit/f011b3c727c5377302b2ab0a203457490b930a3d) `sha256:60ece3a5e93bb1540ea88850685af7f1e75a9305657a3e8fa0387bc7bbc503ee`
* [service-ca-operator](https://github.com/openshift/service-ca-operator) git [37e0c317](https://github.com/openshift/service-ca-operator/commit/37e0c31790b6a954214817974a56c9a699d0cf78) `sha256:a1359a0bac3def299d5c5d2922a83521b539df57dcbdef31ad1369d179dd5cfe`
* [telemeter](https://github.com/openshift/telemeter) git [d07a8330](https://github.com/openshift/telemeter/commit/d07a833015fe91fe2df12589a6877dde15e9a227) `sha256:1b2707c33c5738f235c7e9395e4ceb322ca3750bd2d8ba06321faab6cabc0c4f`
* [thanos](https://github.com/openshift/thanos) git [e09de117](https://github.com/openshift/thanos/commit/e09de117035d272a18dbd94d0bc8c8e29346026e) `sha256:534c00233134d5f7206723293fa84e58640c9f95edf21954e1c5245300605ff9`


### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/b22ad07bac5979e1691ccb19ded93a5bde8ef570)

* [OCPBUGS-89951](https://issues.redhat.com/browse/OCPBUGS-89951): patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.2 [#10798](https://github.com/openshift/assisted-service/pull/10798)
* [OCPBUGS-105890](https://issues.redhat.com/browse/OCPBUGS-105890): manifest_generator add a label to LUKS root [#10803](https://github.com/openshift/assisted-service/pull/10803)
* [Full changelog](https://github.com/openshift/assisted-service/compare/257fad749a2424b44eae30b0b72360e1e246880e...b22ad07bac5979e1691ccb19ded93a5bde8ef570)


### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/6b65bbfaa7224f7c314fb946acac0cc236f90fe5)

* [OCPBUGS-103794](https://issues.redhat.com/browse/OCPBUGS-103794): Bump x/net to v0.35.0-sec.4 [#2291](https://github.com/openshift/assisted-installer/pull/2291)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/a26df06f52f1426defcf42c6cebcec5b7a956df3...6b65bbfaa7224f7c314fb946acac0cc236f90fe5)


### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/522bb593b74550ecf61fc26fbcce5e35e72bf0b1)

* [OCPBUGS-103797](https://issues.redhat.com/browse/OCPBUGS-103797): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#1620](https://github.com/openshift/assisted-installer-agent/pull/1620)
* [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/637327ec40cd1f85ac5d7d4f114a2fae89baa8b0...522bb593b74550ecf61fc26fbcce5e35e72bf0b1)


### [agent-installer-ui](https://github.com/openshift-assisted/assisted-installer-ui/tree/614fe44d7efeb390de35ecada97a1a9b1739c069)

* [OCPBUGS-113552](https://issues.redhat.com/browse/OCPBUGS-113552): Bump nanoid to &gt;=3.3.17 in 4.20 (#4066) [#4066](https://github.com/openshift-assisted/assisted-installer-ui/pull/4066)
* [OCPBUGS-119962](https://issues.redhat.com/browse/OCPBUGS-119962): Bump qs to &gt;=6.16.0 in release-4.20 (#4045) [#4045](https://github.com/openshift-assisted/assisted-installer-ui/pull/4045)
* [OCPBUGS-104550](https://issues.redhat.com/browse/OCPBUGS-104550): Bump tmp to ^0.2.6 to address CVE-2026-44705 (#4016) [#4016](https://github.com/openshift-assisted/assisted-installer-ui/pull/4016)
* Update OWNERS file (#3992) [#3992](https://github.com/openshift-assisted/assisted-installer-ui/pull/3992)
* [OCPBUGS-100524](https://issues.redhat.com/browse/OCPBUGS-100524), [OCPBUGS-103012](https://issues.redhat.com/browse/OCPBUGS-103012): Bump ip-address to fix CVE-2026-54272 and CVE-2026-69192 (#3988) [#3988](https://github.com/openshift-assisted/assisted-installer-ui/pull/3988)
* [OCPBUGS-109781](https://issues.redhat.com/browse/OCPBUGS-109781): Bump tar pkg version to ^7.5.21 to address CVE-2026-73566 (#3972) [#3972](https://github.com/openshift-assisted/assisted-installer-ui/pull/3972)
* [ART-22057](https://issues.redhat.com/browse/ART-22057): Move @types/react-dom to dependencies in chatbot (#3958) [#3958](https://github.com/openshift-assisted/assisted-installer-ui/pull/3958)
* [OCPBUGS-104460](https://issues.redhat.com/browse/OCPBUGS-104460): Pin minimatch to ^10.2.6 and brace-expansion to ^5.0.9 (CVE-2026-14257) (#3961) [#3961](https://github.com/openshift-assisted/assisted-installer-ui/pull/3961)
* [Full changelog](https://github.com/openshift-assisted/assisted-installer-ui/compare/52f3224b8e67de6c926e10dc72ac55a79ca7cc66...614fe44d7efeb390de35ecada97a1a9b1739c069)


### [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws/tree/d39d9bf005fea11c016258bbef05b35361cfd7b5)

* [OCPBUGS-81942](https://issues.redhat.com/browse/OCPBUGS-81942): Bump go-jose/go-jose/v4@v4.1.4 [#611](https://github.com/openshift/cluster-api-provider-aws/pull/611)
* [OCPBUGS-103806](https://issues.redhat.com/browse/OCPBUGS-103806): replace golang.org/x/net with openshift-sustaining/net v0.43.0-sec.4 for CVE-2026-33814 [#650](https://github.com/openshift/cluster-api-provider-aws/pull/650)
* 🐛 OCPBUGS-123528: UPSTREAM: &lt;carry&gt;: Fix unit tests for OpenShift CI environment [#638](https://github.com/openshift/cluster-api-provider-aws/pull/638)
* 🌱 [release-4.20] OCPBUGS-123527: UPSTREAM: &lt;carry&gt;: Remove upstream .github files unused in OpenShift CI [#637](https://github.com/openshift/cluster-api-provider-aws/pull/637)
* [Full changelog](https://github.com/openshift/cluster-api-provider-aws/compare/300439ea0736444a160c061578b3bd8956d4f7e6...d39d9bf005fea11c016258bbef05b35361cfd7b5)


### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/1a773c6c2789fcd3a89f1c057eadc095ffd79495)

* [OCPBUGS-103853](https://issues.redhat.com/browse/OCPBUGS-103853), [OCPBUGS-103932](https://issues.redhat.com/browse/OCPBUGS-103932), [OCPBUGS-103973](https://issues.redhat.com/browse/OCPBUGS-103973): replace golang.org/x/net with openshift-sustaining fork [#634](https://github.com/openshift/csi-operator/pull/634)
* [OCPBUGS-103805](https://issues.redhat.com/browse/OCPBUGS-103805), [OCPBUGS-103816](https://issues.redhat.com/browse/OCPBUGS-103816): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#612](https://github.com/openshift/csi-operator/pull/612)
* [Full changelog](https://github.com/openshift/csi-operator/compare/910424793d59d291a9e6addaccbd2facf53e2bff...1a773c6c2789fcd3a89f1c057eadc095ffd79495)


### [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws/tree/34e9d303809d439300cddbb78c135b00d3287a48)

* [OCPBUGS-103908](https://issues.redhat.com/browse/OCPBUGS-103908): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#207](https://github.com/openshift/machine-api-provider-aws/pull/207)
* [Full changelog](https://github.com/openshift/machine-api-provider-aws/compare/999f4f76124e66c7b42af678cb19aff4b29f72d4...34e9d303809d439300cddbb78c135b00d3287a48)


### [azure-cloud-controller-manager, azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure/tree/5e418608ed55a11c32042f2a2049fc6381fbdecc)

* [OCPBUGS-103808](https://issues.redhat.com/browse/OCPBUGS-103808), [OCPBUGS-103983](https://issues.redhat.com/browse/OCPBUGS-103983): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.3 to address CVE-2026-33814 [#206](https://github.com/openshift/cloud-provider-azure/pull/206)
* [Full changelog](https://github.com/openshift/cloud-provider-azure/compare/fbf11126955608076cd568c22be0d630c5db0d84...5e418608ed55a11c32042f2a2049fc6381fbdecc)


### [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure/tree/07fa62a58c8d2f7f1c961f1d71fe2fa6b1d50a1e)

* [OCPBUGS-103801](https://issues.redhat.com/browse/OCPBUGS-103801): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#403](https://github.com/openshift/cluster-api-provider-azure/pull/403)
* [OCPBUGS-89962](https://issues.redhat.com/browse/OCPBUGS-89962): Address CVE-2026-39829 [#399](https://github.com/openshift/cluster-api-provider-azure/pull/399)
* [Full changelog](https://github.com/openshift/cluster-api-provider-azure/compare/c29c68dd2a576f19771dfd0c349b34f890063cdc...07fa62a58c8d2f7f1c961f1d71fe2fa6b1d50a1e)


### [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver/tree/b772189f1cf2f881052e7ff8d65d7338f16a72ac)

* UPSTREAM: 3635: OCPBUGS-96365: Bump golang.org/x/net to  v0.50.0-sec.4 [#167](https://github.com/openshift/azure-disk-csi-driver/pull/167)
* [OCPBUGS-106191](https://issues.redhat.com/browse/OCPBUGS-106191): UPSTREAM: 3277: fix: allow `.` in Azure tags [#169](https://github.com/openshift/azure-disk-csi-driver/pull/169)
* [Full changelog](https://github.com/openshift/azure-disk-csi-driver/compare/e1ea4e929c51a3fe6823ffb5fd17fb07971ca86d...b772189f1cf2f881052e7ff8d65d7338f16a72ac)


### [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver/tree/bdffa74f61bbdaefccdd984541c0fd303810209e)

* [OCPBUGS-103813](https://issues.redhat.com/browse/OCPBUGS-103813): Bump golang.org/x/net to v0.50.0-sec.4 [#156](https://github.com/openshift/azure-file-csi-driver/pull/156)
* [OCPBUGS-111841](https://issues.redhat.com/browse/OCPBUGS-111841): always chmod expected setgid bit in TestChmodIfPermissionMismatch [#153](https://github.com/openshift/azure-file-csi-driver/pull/153)
* [OCPBUGS-92939](https://issues.redhat.com/browse/OCPBUGS-92939): Bump golang.org/x/crypto to v0.48.0-sec.1 [#146](https://github.com/openshift/azure-file-csi-driver/pull/146)
* [Full changelog](https://github.com/openshift/azure-file-csi-driver/compare/c7bce6e96df8f14b61ead343b901087a44736513...bdffa74f61bbdaefccdd984541c0fd303810209e)


### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/93423109b69567eaef489f262d5c2b103dea9219)

* [OCPBUGS-103785](https://issues.redhat.com/browse/OCPBUGS-103785): [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#59](https://github.com/openshift/azure-kubernetes-kms/pull/59)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/1d6fb8798544b0d0ff60582f82f885e5a6a776ba...93423109b69567eaef489f262d5c2b103dea9219)


### [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure/tree/a5949a16a99f5ec42c4e24ca13b67ef44de07535)

* [OCPBUGS-103905](https://issues.redhat.com/browse/OCPBUGS-103905): replace golang.org/x/net with openshift-sustaining/net@v0.50.0-sec.4 [#211](https://github.com/openshift/machine-api-provider-azure/pull/211)
* [Full changelog](https://github.com/openshift/machine-api-provider-azure/compare/68db91507ea47f767ee0dc838c08cc371d2ff69f...a5949a16a99f5ec42c4e24ca13b67ef44de07535)


### [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity/tree/9c6d9c55952705d21f12a2d5e3d1585c1e70a7b3)

* [OCPBUGS-103815](https://issues.redhat.com/browse/OCPBUGS-103815): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#61](https://github.com/openshift/azure-workload-identity/pull/61)
* [Full changelog](https://github.com/openshift/azure-workload-identity/compare/357712a65437ea3329a8d8a62cf64d27a70dda12...9c6d9c55952705d21f12a2d5e3d1585c1e70a7b3)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/62e3556dc8a4836160b94845e11dad3ded73cc8f)

* [SPLAT-2867](https://issues.redhat.com/browse/SPLAT-2867): Add vSphere multi vCenter Day 2 support [#10880](https://github.com/openshift/installer/pull/10880)
* [OCPBUGS-103817](https://issues.redhat.com/browse/OCPBUGS-103817): Bump golang.org/x/net to v0.50.0-sec.4 [#10942](https://github.com/openshift/installer/pull/10942)
* [OCPBUGS-89997](https://issues.redhat.com/browse/OCPBUGS-89997), [OCPBUGS-92937](https://issues.redhat.com/browse/OCPBUGS-92937): Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.48.0-sec.2 [#10821](https://github.com/openshift/installer/pull/10821)
* [OCPBUGS-100063](https://issues.redhat.com/browse/OCPBUGS-100063): openstack: Reserve addresses for load balancer [#10723](https://github.com/openshift/installer/pull/10723)
* [OCPBUGS-112324](https://issues.redhat.com/browse/OCPBUGS-112324): [release-4.20]: Enrich IBI config image proxy NoProxy with cluster networks [#10779](https://github.com/openshift/installer/pull/10779)
* [OCPBUGS-114414](https://issues.redhat.com/browse/OCPBUGS-114414): Update gcloud version to one that can be found [#10816](https://github.com/openshift/installer/pull/10816)
* [OCPBUGS-113536](https://issues.redhat.com/browse/OCPBUGS-113536): Update RHCOS-release-4.20 bootimage metadata to 9.6.20260818-0 [#10799](https://github.com/openshift/installer/pull/10799)
* [Full changelog](https://github.com/openshift/installer/compare/349feecf1e7597a0a62cf93c97e0870ac7cff2e3...62e3556dc8a4836160b94845e11dad3ded73cc8f)


### [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal/tree/d7df35a05f9e345f3662105453b50d9c9fac5732)

* [OCPBUGS-103820](https://issues.redhat.com/browse/OCPBUGS-103820): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#266](https://github.com/openshift/cluster-api-provider-baremetal/pull/266)
* [Full changelog](https://github.com/openshift/cluster-api-provider-baremetal/compare/fb678fec5f7e08348b281341481f33a848204e50...d7df35a05f9e345f3662105453b50d9c9fac5732)


### [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg/tree/90df78abccd30bbe649c4d59ff7ebd500b6bee33)

* [OCPBUGS-103819](https://issues.redhat.com/browse/OCPBUGS-103819): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#406](https://github.com/openshift/baremetal-runtimecfg/pull/406)
* [Full changelog](https://github.com/openshift/baremetal-runtimecfg/compare/5e602ba702420d0f30cee175f51fff83e00c1b5b...90df78abccd30bbe649c4d59ff7ebd500b6bee33)


### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/ef515cfbef680d4040becc4a180afb7a195270a4)

* [OCPBUGS-103964](https://issues.redhat.com/browse/OCPBUGS-103964): [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#2381](https://github.com/openshift/oc/pull/2381)
* [Full changelog](https://github.com/openshift/oc/compare/1367d50cf3740bc3a6a68ba6c74f6ad5e3ef7cb7...ef515cfbef680d4040becc4a180afb7a195270a4)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/ae7b348cef0c8869db96875033bd84bfa4f9bab2)

* [OCPBUGS-103822](https://issues.redhat.com/browse/OCPBUGS-103822): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#1098](https://github.com/openshift/cloud-credential-operator/pull/1098)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/c6a7e1a6b84b964531d6c842f362f664dd777746...ae7b348cef0c8869db96875033bd84bfa4f9bab2)


### [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller/tree/3094ce06fdd0a210eae42a615673cb34ad82825c)

* [OCPBUGS-103779](https://issues.redhat.com/browse/OCPBUGS-103779): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#269](https://github.com/openshift/cloud-network-config-controller/pull/269)
* [OCPBUGS-88310](https://issues.redhat.com/browse/OCPBUGS-88310): Retrieve subnet from vnet subnets.addressPrefixes field [#226](https://github.com/openshift/cloud-network-config-controller/pull/226)
* [Full changelog](https://github.com/openshift/cloud-network-config-controller/compare/d22915bc82993ce11cb3fb97e6ae00602f30549b...3094ce06fdd0a210eae42a615673cb34ad82825c)


### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/104d5d413a4d473b1bf280ffe546bf5c83bb8eda)

* [OCPBUGS-103829](https://issues.redhat.com/browse/OCPBUGS-103829): Bump golang.org/x/net from v0.38.0 to v0.50.0-sec.4 [#981](https://github.com/openshift/cluster-authentication-operator/pull/981)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/569ae680cbdf0f78cc0d77278c5178160679fe83...104d5d413a4d473b1bf280ffe546bf5c83bb8eda)


### [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler/tree/e1745071d014cc54749c1305b6698c744c447b91)

* [OCPBUGS-103955](https://issues.redhat.com/browse/OCPBUGS-103955): Replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 for CVE-2026-33814 [#440](https://github.com/openshift/kubernetes-autoscaler/pull/440)
* [OCPBUGS-109662](https://issues.redhat.com/browse/OCPBUGS-109662): UPSTREAM: 9458: fix(clusterapi): use kind-aware version discovery for infra references [#435](https://github.com/openshift/kubernetes-autoscaler/pull/435)
* [Full changelog](https://github.com/openshift/kubernetes-autoscaler/compare/6b1d2ef88e19d32143d389de6999c765c7e30cad...e1745071d014cc54749c1305b6698c744c447b91)


### [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator/tree/d1311e1f6a6c61c86c80e978681822156c6441fb)

* [OCPBUGS-103824](https://issues.redhat.com/browse/OCPBUGS-103824): Bump x/net package in release-4.20 [#384](https://github.com/openshift/cluster-autoscaler-operator/pull/384)
* [Full changelog](https://github.com/openshift/cluster-autoscaler-operator/compare/147e5a7ff20b46ade7dd932b47e06ca82729f5e8...d1311e1f6a6c61c86c80e978681822156c6441fb)


### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/186f75cc7762080a0f327efe9dbad0d7a93ba442)

* [SPLAT-2867](https://issues.redhat.com/browse/SPLAT-2867): Added support to manage kube-cloud-config for vSphere in openshift-config-managed [#521](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/521)
* [OCPBUGS-103842](https://issues.redhat.com/browse/OCPBUGS-103842): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#511](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/511)
* [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/276696ccf679830b25df341edb7aae9bb3f4e763...186f75cc7762080a0f327efe9dbad0d7a93ba442)


### [cluster-config-api](https://github.com/openshift/api/tree/b32f49f8a70985c6ad9abb2dc579abc18d143051)

* [SPLAT-2867](https://issues.redhat.com/browse/SPLAT-2867): Add vSphere multi vCenter Day 2 [#3038](https://github.com/openshift/api/pull/3038)
* [Full changelog](https://github.com/openshift/api/compare/05da40ea98557f8351483a39db3d0e7d9076bc8f...b32f49f8a70985c6ad9abb2dc579abc18d143051)


### [cluster-config-operator](https://github.com/openshift/cluster-config-operator/tree/e98c33756e5f023f3244cb58c3fb878b87ba2781)

* [SPLAT-2867](https://issues.redhat.com/browse/SPLAT-2867): Migrate vSphere sync of kube-cloud-config to 3CMO [#506](https://github.com/openshift/cluster-config-operator/pull/506)
* [Full changelog](https://github.com/openshift/cluster-config-operator/compare/657754e2beaed6295ff28bb0f7813cb1c9ce35b2...e98c33756e5f023f3244cb58c3fb878b87ba2781)


### [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator/tree/32546df9054ebbec1055344f8cad25254049df50)

* [OCPBUGS-114721](https://issues.redhat.com/browse/OCPBUGS-114721): Fixed issue where nameserver is not set when recreating cpms [#418](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/418)
* [Full changelog](https://github.com/openshift/cluster-control-plane-machine-set-operator/compare/0bbafe24ade564bc62554251f36de90d524abcde...32546df9054ebbec1055344f8cad25254049df50)


### [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator/tree/8b96b8d58079376b3e56062e724581d1714e2a50)

* [OCPBUGS-103839](https://issues.redhat.com/browse/OCPBUGS-103839): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#295](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/295)
* [Full changelog](https://github.com/openshift/cluster-csi-snapshot-controller-operator/compare/a99bd8ffb9aa596fa8d6932d5d93e0613c5d367f...8b96b8d58079376b3e56062e724581d1714e2a50)


### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/19e381df1b5b98ce714247c7feb18954c815fa06)

* [OCPBUGS-103831](https://issues.redhat.com/browse/OCPBUGS-103831): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 [#1693](https://github.com/openshift/cluster-etcd-operator/pull/1693)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/9acf049b2985339275796f69a2a8acad47726a29...19e381df1b5b98ce714247c7feb18954c815fa06)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/8e4c40f161d8341d640659ca2779a4294960c183)

* [OCPBUGS-103834](https://issues.redhat.com/browse/OCPBUGS-103834): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.3 [#1569](https://github.com/openshift/cluster-ingress-operator/pull/1569)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/f86aaea4136dfea16e62290bd50ecdd1a8b22b3f...8e4c40f161d8341d640659ca2779a4294960c183)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/3915db668832c6d730f0ba4fe87604564204ff46)

* [OCPBUGS-103840](https://issues.redhat.com/browse/OCPBUGS-103840): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#2297](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2297)
* [OCPBUGS-127411](https://issues.redhat.com/browse/OCPBUGS-127411): Bump of library-go [#2342](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2342)
* [OCPBUGS-128037](https://issues.redhat.com/browse/OCPBUGS-128037): Fix kube-apiserver-to-kubelet-signer refresh interval [#2323](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2323)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/e9accf887ef1182f0a96e3086d54441ba8bcae40...3915db668832c6d730f0ba4fe87604564204ff46)


### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/da4be9f7565b625c60ceb7a95b1e14ada78fbd1f)

* [OCPBUGS-103841](https://issues.redhat.com/browse/OCPBUGS-103841): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#959](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/959)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/438c9dba80ddadeabe9efe4a654297a7b550b2b8...da4be9f7565b625c60ceb7a95b1e14ada78fbd1f)


### [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator/tree/6a8f72baf4f6cce052fed660343de13854197cd2)

* [OCPBUGS-103846](https://issues.redhat.com/browse/OCPBUGS-103846): [release-4.20]  Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#667](https://github.com/openshift/cluster-kube-scheduler-operator/pull/667)
* [Full changelog](https://github.com/openshift/cluster-kube-scheduler-operator/compare/84eb8c5a73a730d6d08794e51da9c20013ca4304...6a8f72baf4f6cce052fed660343de13854197cd2)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/258e23985f0293e644ecaba76559745ecdead997)

* [OCPBUGS-129138](https://issues.redhat.com/browse/OCPBUGS-129138): don't delete admin-owned Alertmanager secrets on destroy [#3140](https://github.com/openshift/cluster-monitoring-operator/pull/3140)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.20] [#3115](https://github.com/openshift/cluster-monitoring-operator/pull/3115)
* [OCPBUGS-112574](https://issues.redhat.com/browse/OCPBUGS-112574): [release-4.20] Makefile: version-stamp golangci-lint binary to prevent stale linter [#3066](https://github.com/openshift/cluster-monitoring-operator/pull/3066)
* [OCPBUGS-103845](https://issues.redhat.com/browse/OCPBUGS-103845): [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#3072](https://github.com/openshift/cluster-monitoring-operator/pull/3072)
* [OCPBUGS-105309](https://issues.redhat.com/browse/OCPBUGS-105309): [release-4.20] wrap library-go resourceCache with mutex for thread safety [#3043](https://github.com/openshift/cluster-monitoring-operator/pull/3043)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/81547ca56764b50b6cacc17cadfab43b025d5b68...258e23985f0293e644ecaba76559745ecdead997)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/8186dacc5fe87d25dd90351375e37aabb13f8b00)

* [OCPBUGS-103851](https://issues.redhat.com/browse/OCPBUGS-103851): [release-4.20]  Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#3157](https://github.com/openshift/cluster-network-operator/pull/3157)
* [OCPBUGS-128652](https://issues.redhat.com/browse/OCPBUGS-128652): Allow per-node OVN encap IP override via env-overrides [#3180](https://github.com/openshift/cluster-network-operator/pull/3180)
* [OCPBUGS-127390](https://issues.redhat.com/browse/OCPBUGS-127390): Restart pods when rendering egressIP settings [#3173](https://github.com/openshift/cluster-network-operator/pull/3173)
* [OCPBUGS-113989](https://issues.redhat.com/browse/OCPBUGS-113989): frr-k8s: use Recreate strategy for webhook server deployment on SNO [#3142](https://github.com/openshift/cluster-network-operator/pull/3142)
* [OCPBUGS-105852](https://issues.redhat.com/browse/OCPBUGS-105852): Remove version-specific CNI binary copy logic [#3118](https://github.com/openshift/cluster-network-operator/pull/3118)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/4fa59bf99729215d7eb5e91ad406898b4f87cf41...8186dacc5fe87d25dd90351375e37aabb13f8b00)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/c491d1ae719221fdb0031fe7f071a787274f7883)

* [OCPBUGS-115719](https://issues.redhat.com/browse/OCPBUGS-115719): Update PPC help description [#1627](https://github.com/openshift/cluster-node-tuning-operator/pull/1627)
* [OCPBUGS-112026](https://issues.redhat.com/browse/OCPBUGS-112026): BUG-FIX Latency Test [#1594](https://github.com/openshift/cluster-node-tuning-operator/pull/1594)
* [OCPBUGS-111091](https://issues.redhat.com/browse/OCPBUGS-111091): e2e: fix: clear hugepages before switching kernelPageSize to 4k [#1588](https://github.com/openshift/cluster-node-tuning-operator/pull/1588)
* [OCPBUGS-114730](https://issues.redhat.com/browse/OCPBUGS-114730): Use Add() instead of AddRateLimited() for routine Profile enqueues [#1620](https://github.com/openshift/cluster-node-tuning-operator/pull/1620)
* [OCPBUGS-105509](https://issues.redhat.com/browse/OCPBUGS-105509): e2e: fix broken checks and rework netqueue tests to avoid ARM ethtool blackout flakes [#1581](https://github.com/openshift/cluster-node-tuning-operator/pull/1581)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/6401d7f3b34ee63da83a1f9917e9f3e35ff35ed6...c491d1ae719221fdb0031fe7f071a787274f7883)


### [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller/tree/debe523c1edc20e080a44afc9e8699ce3ab15599)

* [OCPBUGS-103864](https://issues.redhat.com/browse/OCPBUGS-103864): Bump golang.org/x/net to v0.50.0-sec.3 [#200](https://github.com/openshift/cluster-policy-controller/pull/200)
* [Full changelog](https://github.com/openshift/cluster-policy-controller/compare/67083fab6cea4dde724efd5be5a22bda1f8437d1...debe523c1edc20e080a44afc9e8699ce3ab15599)


### [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator/tree/675e7a9c4d9695107ff64f78425def5ced9d5b76)

* [OCPBUGS-129478](https://issues.redhat.com/browse/OCPBUGS-129478): Restrict samples operator access to the global pull-secret [#729](https://github.com/openshift/cluster-samples-operator/pull/729)
* [Full changelog](https://github.com/openshift/cluster-samples-operator/compare/b343f70f19ffd559e1a81d3a3e65bd106e634c13...675e7a9c4d9695107ff64f78425def5ced9d5b76)


### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/747d5cbd21adc965a33b1c262195788b05aa0005)

* [OCPBUGS-103858](https://issues.redhat.com/browse/OCPBUGS-103858): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#737](https://github.com/openshift/cluster-storage-operator/pull/737)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/e8e9de4345ce79aafbdcf31eb4d4ce3682cfd6b7...747d5cbd21adc965a33b1c262195788b05aa0005)


### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/2470ccb013067b6e40575f858866e60ed650337f)

* [OCPBUGS-103852](https://issues.redhat.com/browse/OCPBUGS-103852): Bump golang.org/x/net to v0.50.0-sec.3 [#1457](https://github.com/openshift/cluster-version-operator/pull/1457)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/ea3fa7695054fc9260936902b33b738bb4c405bc...2470ccb013067b6e40575f858866e60ed650337f)


### [console](https://github.com/openshift/console/tree/6f1b8f5cf267bfc1ca41d1c8fa7ab23d0699701f)

* [OCPBUGS-122351](https://issues.redhat.com/browse/OCPBUGS-122351): Wait for demo plugin deployment readiness [#17168](https://github.com/openshift/console/pull/17168)
* [OCPBUGS-60136](https://issues.redhat.com/browse/OCPBUGS-60136): Fix Operator Backed catalog empty on disconnected clusters [#17184](https://github.com/openshift/console/pull/17184)
* [release-4.20 ]OCPBUGS-84041: Fix template placeholder {{name}} not resolved and runtime error on Group details page [#16313](https://github.com/openshift/console/pull/16313)
* [OCPBUGS-121663](https://issues.redhat.com/browse/OCPBUGS-121663): Validate chart URL in /api/helm/verify [#17147](https://github.com/openshift/console/pull/17147)
* [OCPBUGS-114054](https://issues.redhat.com/browse/OCPBUGS-114054): make cloud provider fields optional during operator install [#17098](https://github.com/openshift/console/pull/17098)
* [OCPBUGS-100517](https://issues.redhat.com/browse/OCPBUGS-100517), [OCPBUGS-101794](https://issues.redhat.com/browse/OCPBUGS-101794): Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss [#17056](https://github.com/openshift/console/pull/17056)
* [OCPBUGS-112274](https://issues.redhat.com/browse/OCPBUGS-112274): Fix flaky TestAsyncCache backend test [#17047](https://github.com/openshift/console/pull/17047)
* Fix OCPBUGS-98785: CVE-2026-48801 [#16854](https://github.com/openshift/console/pull/16854)
* Fix for OCPBUGS-105903: CVE-2026-73086 [#16967](https://github.com/openshift/console/pull/16967)
* [OCPBUGS-109132](https://issues.redhat.com/browse/OCPBUGS-109132): Fix leading whitespace in Quick Start execute code snippets [#17003](https://github.com/openshift/console/pull/17003)
* Fix for OCPBUGS-89701: CVE-2026-12143 [#16646](https://github.com/openshift/console/pull/16646)
* [OCPBUGS-104530](https://issues.redhat.com/browse/OCPBUGS-104530): Re-enable-knative [#16908](https://github.com/openshift/console/pull/16908)
* [OCPBUGS-98436](https://issues.redhat.com/browse/OCPBUGS-98436): [release-4.20] CVE-2026-59869 bump js-yaml [#16916](https://github.com/openshift/console/pull/16916)
* [Full changelog](https://github.com/openshift/console/compare/b80e7d8b86b568758e8501978ebf47eb630112ad...6f1b8f5cf267bfc1ca41d1c8fa7ab23d0699701f)


### [console-operator](https://github.com/openshift/console-operator/tree/1bf2540012b038b39560b6d86f4595664a41f7bb)

* [OCPBUGS-103860](https://issues.redhat.com/browse/OCPBUGS-103860): Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 [#1221](https://github.com/openshift/console-operator/pull/1221)
* [Full changelog](https://github.com/openshift/console-operator/compare/75a6c0644907549642dd9d05ac451810f034385c...1bf2540012b038b39560b6d86f4595664a41f7bb)


### [coredns](https://github.com/openshift/coredns/tree/6c72c97daf9c64684998a255ae03bec0981c4ab8)

* [OCPBUGS-103861](https://issues.redhat.com/browse/OCPBUGS-103861): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#203](https://github.com/openshift/coredns/pull/203)
* [Full changelog](https://github.com/openshift/coredns/compare/6f39336e6da9dc77b2db140a96773c413d50a665...6c72c97daf9c64684998a255ae03bec0981c4ab8)


### [csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/f204d3ac38736d82a1b832624aa760b9a5d70288)

* [OCPBUGS-96434](https://issues.redhat.com/browse/OCPBUGS-96434): Bump golang.org/x/net to v0.50.0-sec.4 [#418](https://github.com/openshift/cloud-provider-openstack/pull/418)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/649398c2a16731984e65719f6b8b323df79f3ff1...f204d3ac38736d82a1b832624aa760b9a5d70288)


### [csi-external-attacher](https://github.com/openshift/csi-external-attacher/tree/2a474861e4db0c9af08d0c0da2f3ffd2a92a27c2)

* UPSTREAM: 110: OCPBUGS-103856: Bump golang.org/x/net to v0.50.0-sec.4 [#113](https://github.com/openshift/csi-external-attacher/pull/113)
* [Full changelog](https://github.com/openshift/csi-external-attacher/compare/935f1e1f7f9f07c03116e37e760a66e2a58c63c0...2a474861e4db0c9af08d0c0da2f3ffd2a92a27c2)


### [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner/tree/e94a54eab40ad4d4ead75953358fb1970429eb4c)

* [OCPBUGS-92946](https://issues.redhat.com/browse/OCPBUGS-92946): Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.48.0-sec.3 to address CVE-2026-46597 [#160](https://github.com/openshift/csi-external-provisioner/pull/160)
* [OCPBUGS-96392](https://issues.redhat.com/browse/OCPBUGS-96392): Bump golang.org/x/net to v0.50.0-sec.4 [#150](https://github.com/openshift/csi-external-provisioner/pull/150)
* [Full changelog](https://github.com/openshift/csi-external-provisioner/compare/eb1e4ac9c60067568674269961b46e7d9c974fe4...e94a54eab40ad4d4ead75953358fb1970429eb4c)


### [csi-external-resizer](https://github.com/openshift/csi-external-resizer/tree/4835292fe73b956b6a350373a45fb0877dd705b7)

* [OCPBUGS-103867](https://issues.redhat.com/browse/OCPBUGS-103867): Bump golang.org/x/net to v0.50.0-sec.4 [#211](https://github.com/openshift/csi-external-resizer/pull/211)
* [OCPBUGS-80613](https://issues.redhat.com/browse/OCPBUGS-80613): Bump google.golang.org/grpc to v1.79.3 [#201](https://github.com/openshift/csi-external-resizer/pull/201)
* [Full changelog](https://github.com/openshift/csi-external-resizer/compare/c674bea9bb6a81e463c7fefa974e2109d829daef...4835292fe73b956b6a350373a45fb0877dd705b7)


### [csi-external-snapshot-metadata](https://github.com/openshift/csi-external-snapshot-metadata/tree/cb58afc56702353526ec106f7700fa8cc1b173aa)

* [OCPBUGS-80614](https://issues.redhat.com/browse/OCPBUGS-80614): Bump google.golang.org/grpc to v1.79.3 [#21](https://github.com/openshift/csi-external-snapshot-metadata/pull/21)
* [OCPBUGS-103868](https://issues.redhat.com/browse/OCPBUGS-103868): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#34](https://github.com/openshift/csi-external-snapshot-metadata/pull/34)
* [Full changelog](https://github.com/openshift/csi-external-snapshot-metadata/compare/693a826455777eaafc677bb2195dc071d184243b...cb58afc56702353526ec106f7700fa8cc1b173aa)


### [csi-external-snapshotter, csi-snapshot-controller](https://github.com/openshift/csi-external-snapshotter/tree/3dd8a0f87f86529682b449a6b9e19e9ee8d2d5d4)

* [OCPBUGS-103869](https://issues.redhat.com/browse/OCPBUGS-103869): Replace golang.org/x/net with github.com/openshift-sustaining/net v0.50.0-sec.3 [#236](https://github.com/openshift/csi-external-snapshotter/pull/236)
* [OCPBUGS-92084](https://issues.redhat.com/browse/OCPBUGS-92084): UPSTREAM: 1392: Fix VolumeSnapshotContent deletion [#225](https://github.com/openshift/csi-external-snapshotter/pull/225)
* [Full changelog](https://github.com/openshift/csi-external-snapshotter/compare/433cf89b4e4d1b437a8a446ece28b217ccf9bd06...3dd8a0f87f86529682b449a6b9e19e9ee8d2d5d4)


### [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe/tree/b750dbd3cff8806e10e6752896e969b37ab1f1c9)

* [OCPBUGS-103865](https://issues.redhat.com/browse/OCPBUGS-103865): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#109](https://github.com/openshift/csi-livenessprobe/pull/109)
* [Full changelog](https://github.com/openshift/csi-livenessprobe/compare/1d6d6b27460e58f24110c72ec9c96afe2c1d891d...b750dbd3cff8806e10e6752896e969b37ab1f1c9)


### [docker-builder](https://github.com/openshift/builder/tree/18885748e09ecf986d8ab0fc3a0fd2440cb7b51f)

* [OCPBUGS-89994](https://issues.redhat.com/browse/OCPBUGS-89994), [OCPBUGS-90424](https://issues.redhat.com/browse/OCPBUGS-90424), [OCPBUGS-92486](https://issues.redhat.com/browse/OCPBUGS-92486), [OCPBUGS-92631](https://issues.redhat.com/browse/OCPBUGS-92631), [OCPBUGS-92790](https://issues.redhat.com/browse/OCPBUGS-92790): Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 [#554](https://github.com/openshift/builder/pull/554)
* [Full changelog](https://github.com/openshift/builder/compare/35afa308e2473046721057112d804334fc4b8217...18885748e09ecf986d8ab0fc3a0fd2440cb7b51f)


### [docker-registry](https://github.com/openshift/image-registry/tree/5098eb6e0004b9be26770925a42bc51bc47cf485)

* [OCPBUGS-103870](https://issues.redhat.com/browse/OCPBUGS-103870): [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#478](https://github.com/openshift/image-registry/pull/478)
* [Full changelog](https://github.com/openshift/image-registry/compare/0e96a08424d601be55341bc3f4412fde977602c8...5098eb6e0004b9be26770925a42bc51bc47cf485)


### [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp/tree/d4bfe3cf78550cf6eabde8714d44b7c69a6a0652)

* [OCPBUGS-99227](https://issues.redhat.com/browse/OCPBUGS-99227): Fix node.kubernetes.io/exclude-from-external-load-balancers on masters [#129](https://github.com/openshift/cloud-provider-gcp/pull/129)
* NO-JIRA: Update OWNERS [#158](https://github.com/openshift/cloud-provider-gcp/pull/158)
* [Full changelog](https://github.com/openshift/cloud-provider-gcp/compare/d5a5541436d9269006928079fcdc507d0b6d4033...d4bfe3cf78550cf6eabde8714d44b7c69a6a0652)


### [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp/tree/430124471dc855f135f8e9d4256ee3930c0037a0)

* [OCPBUGS-103902](https://issues.redhat.com/browse/OCPBUGS-103902): Bump golang.org/x/net to v0.50.0-sec.3 [#187](https://github.com/openshift/machine-api-provider-gcp/pull/187)
* [Full changelog](https://github.com/openshift/machine-api-provider-gcp/compare/b998cf2532b52ce574c42e93c63965b31b9c6c8b...430124471dc855f135f8e9d4256ee3930c0037a0)


### [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver/tree/e68f2e86578ecca315686574959f9d10087a06da)

* [OCPBUGS-103880](https://issues.redhat.com/browse/OCPBUGS-103880): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#147](https://github.com/openshift/gcp-pd-csi-driver/pull/147)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver/compare/49e54581328a46f6aee3f7842d401681d34b2104...e68f2e86578ecca315686574959f9d10087a06da)


### [gcp-pd-csi-driver-operator](https://github.com/openshift/gcp-pd-csi-driver-operator/tree/fc495ba97cccd2901ac29dc7d0922fa8dd4f4e21)

* [OCPBUGS-103880](https://issues.redhat.com/browse/OCPBUGS-103880): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#210](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/210)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver-operator/compare/9fb0e78b4db18f763f7144ca5c13ee380da07460...fc495ba97cccd2901ac29dc7d0922fa8dd4f4e21)


### [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook/tree/d0793256ac4fb2f249ad78f4873d44d4ea0079fa)

* [OCPBUGS-103888](https://issues.redhat.com/browse/OCPBUGS-103888): Replace golang.org/x/net with github.com/openshift-sustaining/net v0.35.0-sec.4 [#24](https://github.com/openshift/gcp-workload-identity-federation-webhook/pull/24)
* [Full changelog](https://github.com/openshift/gcp-workload-identity-federation-webhook/compare/b36788edd4c559cffd5f7f1b2e3e51b98c3e92b8...d0793256ac4fb2f249ad78f4873d44d4ea0079fa)


### [hyperkube, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/8008e652cb56e8fb34e76d0736973b3e99816fb0)

* UPSTREAM: &lt;carry&gt;: OCPBUGS-125759: Fix ClusterIsIPv6() detection for dual-stack v6-primary clusters [#2780](https://github.com/openshift/kubernetes/pull/2780)
* [OCPBUGS-105592](https://issues.redhat.com/browse/OCPBUGS-105592): backport kubernetes/conformance umbrella suite [#2741](https://github.com/openshift/kubernetes/pull/2741)
* [OCPBUGS-117657](https://issues.redhat.com/browse/OCPBUGS-117657): Fix performance related issues when selinux metrics are emitted [#2768](https://github.com/openshift/kubernetes/pull/2768)
* [Full changelog](https://github.com/openshift/kubernetes/compare/2df3632e823a813f64218dfc6f5c2e70d28ecdf0...8008e652cb56e8fb34e76d0736973b3e99816fb0)


### [hypershift](https://github.com/openshift/hypershift/tree/97ac8e340286b9661c5a2e3891c14f7d158f0a9a)

* [OCPBUGS-130864](https://issues.redhat.com/browse/OCPBUGS-130864): filter AWS-reserved tag keys before calling DeleteTags [#9985](https://github.com/openshift/hypershift/pull/9985)
* [OCPBUGS-92954](https://issues.redhat.com/browse/OCPBUGS-92954): CVE-2026-46597 openshift4/ose-hypershift-rhel9: golan.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs [openshift-4.20] [#9273](https://github.com/openshift/hypershift/pull/9273)
* [OCPBUGS-96899](https://issues.redhat.com/browse/OCPBUGS-96899): Bump go-toolset to 1.25.9 to address CVE-2025-61729 [#9101](https://github.com/openshift/hypershift/pull/9101)
* [OCPBUGS-100104](https://issues.redhat.com/browse/OCPBUGS-100104): OCPBUGS-86296: Propagate management cluster proxy env vars to konnectivity sidecar [#9149](https://github.com/openshift/hypershift/pull/9149)
* [OCPBUGS-122206](https://issues.redhat.com/browse/OCPBUGS-122206): fix(kubevirt): use only first MachineInternalIP per family in EndpointSlice endpoints [#9798](https://github.com/openshift/hypershift/pull/9798)
* [OCPBUGS-128419](https://issues.redhat.com/browse/OCPBUGS-128419): fix(konnectivity): enable --sync-forever to restore lost agent-server tunnels [#9801](https://github.com/openshift/hypershift/pull/9801)
* [OCPBUGS-129370](https://issues.redhat.com/browse/OCPBUGS-129370): Add MTU override for OVN-Kubernetes on hosted clusters [#9911](https://github.com/openshift/hypershift/pull/9911)
* [OCPBUGS-112733](https://issues.redhat.com/browse/OCPBUGS-112733): fix(certs): normalize IP SANs to stop dual-stack KAS cert churn [#9498](https://github.com/openshift/hypershift/pull/9498)
* [OCPBUGS-82862](https://issues.redhat.com/browse/OCPBUGS-82862), [OCPBUGS-83593](https://issues.redhat.com/browse/OCPBUGS-83593): Address CVE-2026-35469 [#9024](https://github.com/openshift/hypershift/pull/9024)
* [CNTRLPLANE-4571](https://issues.redhat.com/browse/CNTRLPLANE-4571): add kubeClientQPS and kubeClientBurst to ClusterAutoscaling [#9890](https://github.com/openshift/hypershift/pull/9890)
* [OCPBUGS-129090](https://issues.redhat.com/browse/OCPBUGS-129090): [release-4.20] fix: grant cluster-autoscaler watch access [#9882](https://github.com/openshift/hypershift/pull/9882)
* [OCPBUGS-128386](https://issues.redhat.com/browse/OCPBUGS-128386): Apply ingress load balancer scope to default IngressController [#9539](https://github.com/openshift/hypershift/pull/9539)
* [OCPBUGS-113993](https://issues.redhat.com/browse/OCPBUGS-113993): [release-4.20] fix router component ordering to prevent missing HAProxy backends [#9399](https://github.com/openshift/hypershift/pull/9399)
* [CNTRLPLANE-4211](https://issues.redhat.com/browse/CNTRLPLANE-4211): Backport ConfigurationStatus API for external authentication [#9410](https://github.com/openshift/hypershift/pull/9410)
* [CNTRLPLANE-4161](https://issues.redhat.com/browse/CNTRLPLANE-4161): Maintain ingress serving cert for HostedCluster ingress [#9780](https://github.com/openshift/hypershift/pull/9780)
* [OCPBUGS-127054](https://issues.redhat.com/browse/OCPBUGS-127054): hardcode ETCD_METRICS=extensive in etcd StatefulSet template [#9720](https://github.com/openshift/hypershift/pull/9720)
* [OCPBUGS-120750](https://issues.redhat.com/browse/OCPBUGS-120750): update Containerfile.cli runtime base image to floating tag [release-4.20] [#9558](https://github.com/openshift/hypershift/pull/9558)
* [OCPBUGS-94180](https://issues.redhat.com/browse/OCPBUGS-94180): fix registry override matching and propagation to init containers [#8880](https://github.com/openshift/hypershift/pull/8880)
* [OCPBUGS-106185](https://issues.redhat.com/browse/OCPBUGS-106185): fix(upsert): add desired-state hash to detect spec field removals [#9291](https://github.com/openshift/hypershift/pull/9291)
* [OCPBUGS-105812](https://issues.redhat.com/browse/OCPBUGS-105812): Add proxy env vars to AWS cloud-controller-manager deployment [#9284](https://github.com/openshift/hypershift/pull/9284)
* [OCPBUGS-105211](https://issues.redhat.com/browse/OCPBUGS-105211): Apply MetricsSet relabel configs to KAS ServiceMonitor [#9235](https://github.com/openshift/hypershift/pull/9235)
* [Full changelog](https://github.com/openshift/hypershift/compare/09b41084c55897949dabc80cfe89c8326e9aa288...97ac8e340286b9661c5a2e3891c14f7d158f0a9a)


### [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm/tree/15617bf4c124e55a75bccd4a4ce329a48011780e)

* [OCPBUGS-120697](https://issues.redhat.com/browse/OCPBUGS-120697): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 [#112](https://github.com/openshift/cloud-provider-ibm/pull/112)
* [Full changelog](https://github.com/openshift/cloud-provider-ibm/compare/36ab30f90e87de0daa926d20ccda88c41abed191...15617bf4c124e55a75bccd4a4ce329a48011780e)


### [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/tree/8918d86f8ec63f27a8c0ceec94c467a553f498a4)

* [OCPBUGS-103890](https://issues.redhat.com/browse/OCPBUGS-103890): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#197](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/197)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/compare/21f405cce9573eee1c4f1cf95c0eb601ae77ed99...8918d86f8ec63f27a8c0ceec94c467a553f498a4)


### [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud/tree/734ed88aef0de0c76f14aed7866f934d4a24e645)

* [OCPBUGS-86916](https://issues.redhat.com/browse/OCPBUGS-86916): Updating ose-ibmcloud-cluster-api-controllers-container image to be consistent with ART for 4.20 [#154](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/154)
* [OCPBUGS-103886](https://issues.redhat.com/browse/OCPBUGS-103886): Replace golang.org/x/net with openshift-sustaining/net [#174](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/174)
* [Full changelog](https://github.com/openshift/cluster-api-provider-ibmcloud/compare/8b6396a4c78f4791b7f3c5ec404a78b499f8546b...734ed88aef0de0c76f14aed7866f934d4a24e645)


### [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud/tree/4bccd47c2a10f319bae4e1666767d02b40cb604f)

* [OCPBUGS-103892](https://issues.redhat.com/browse/OCPBUGS-103892): replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 [#102](https://github.com/openshift/machine-api-provider-ibmcloud/pull/102)
* [Full changelog](https://github.com/openshift/machine-api-provider-ibmcloud/compare/e63e7a191ccc1d391b574d713899e307a88b466c...4bccd47c2a10f319bae4e1666767d02b40cb604f)


### [insights-operator](https://github.com/openshift/insights-operator/tree/2d32023bd1531271d5571c4283236148f56e006b)

* [OCPBUGS-126912](https://issues.redhat.com/browse/OCPBUGS-126912): add custom proxy field to insights config [#1370](https://github.com/openshift/insights-operator/pull/1370)
* [OCPBUGS-103898](https://issues.redhat.com/browse/OCPBUGS-103898): Bump golang.org/x/net to v0.50.0-sec.3 [#1353](https://github.com/openshift/insights-operator/pull/1353)
* [OCPBUGS-111834](https://issues.redhat.com/browse/OCPBUGS-111834): secrets and configmap revisions count gathering [#1344](https://github.com/openshift/insights-operator/pull/1344)
* [Full changelog](https://github.com/openshift/insights-operator/compare/1b99e6213f4cf8925a4728a58e45f07a262444b2...2d32023bd1531271d5571c4283236148f56e006b)


### [ironic](https://github.com/openshift/ironic-image/tree/af9e8fdf1c6aee2a3d4ee3c83f7692a0e63b70e9)

* [OCPBUGS-114410](https://issues.redhat.com/browse/OCPBUGS-114410): ZTP deployment failed on an iDRAC10 cluster [#922](https://github.com/openshift/ironic-image/pull/922)
* [OCPBUGS-105862](https://issues.redhat.com/browse/OCPBUGS-105862): update ironic pin to include CVE-2026-54423 fix (release-4.20) [#891](https://github.com/openshift/ironic-image/pull/891)
* [OCPBUGS-88477](https://issues.redhat.com/browse/OCPBUGS-88477): Updating openstack-ironic commit in requirements.cachito that addresses CVE-2026-43003 [#887](https://github.com/openshift/ironic-image/pull/887)
* [Full changelog](https://github.com/openshift/ironic-image/compare/77de3c1948adc2c8c94301fce6ce9b43f5940c2b...af9e8fdf1c6aee2a3d4ee3c83f7692a0e63b70e9)


### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/5cceaa3796a6a83b56b83942fede7ba4859cc16f)

* [OCPBUGS-99887](https://issues.redhat.com/browse/OCPBUGS-99887): Bump ironic-python-agent pinned commit for CVE-2026-66138 [#306](https://github.com/openshift/ironic-agent-image/pull/306)
* [OCPBUGS-88477](https://issues.redhat.com/browse/OCPBUGS-88477): Updating ironic-python-agent commit hash that fixes CVE-2026-43003 [#301](https://github.com/openshift/ironic-agent-image/pull/301)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/c179298deb0b3b7817a3e049405b7617c9d5a4f5...5cceaa3796a6a83b56b83942fede7ba4859cc16f)


### [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server/tree/fe7f9ad72976fc21363f2cf4fa511c8a4ec868af)

* NO-ISSUE: synchronize OWNERS from main branch [release-4.20] [#88](https://github.com/openshift/kubernetes-metrics-server/pull/88)
* [Full changelog](https://github.com/openshift/kubernetes-metrics-server/compare/e7379b302a7377c06cf06d54230decd479f92078...fe7f9ad72976fc21363f2cf4fa511c8a4ec868af)


### [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy/tree/414ba4c4e22eef44eb99feec10b833f9aa0ea7e1)

* [OCPBUGS-127952](https://issues.redhat.com/browse/OCPBUGS-127952): Replace golang.org/x/net with sustaining_fork version to resolve CVE-2026-39821 (release-4.20) [#167](https://github.com/openshift/kube-rbac-proxy/pull/167)
* [Full changelog](https://github.com/openshift/kube-rbac-proxy/compare/b9134351be37c43408334047d8eb85d0ac01fe4e...414ba4c4e22eef44eb99feec10b833f9aa0ea7e1)


### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/941ff20d63e30d97d62b1d3d293840a462c9483a)

* [OCPBUGS-130943](https://issues.redhat.com/browse/OCPBUGS-130943): backport kube-state-metrics 2.18 memory leak fix [#200](https://github.com/openshift/kube-state-metrics/pull/200)
* [OCPBUGS-103899](https://issues.redhat.com/browse/OCPBUGS-103899): Use patched x/net fork v0.50.0-sec.4 [#166](https://github.com/openshift/kube-state-metrics/pull/166)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.20] [#173](https://github.com/openshift/kube-state-metrics/pull/173)
* [Full changelog](https://github.com/openshift/kube-state-metrics/compare/358d786274fe81017f7d17cc7310117dca127146...941ff20d63e30d97d62b1d3d293840a462c9483a)


### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/17904d3f450bc912dd9882c95152c6070eb4fb7a)

* [OCPBUGS-130608](https://issues.redhat.com/browse/OCPBUGS-130608): [release-4.20] Reduce vCenter API load in the vSphere machine controller [#1579](https://github.com/openshift/machine-api-operator/pull/1579)
* [SPLAT-2867](https://issues.redhat.com/browse/SPLAT-2867): Added multi vCenter Day 2 Support [#1555](https://github.com/openshift/machine-api-operator/pull/1555)
* [OCPBUGS-129422](https://issues.redhat.com/browse/OCPBUGS-129422): vsphere - Cache REST API sessions to prevent excessive vCenter logouts [#1573](https://github.com/openshift/machine-api-operator/pull/1573)
* [OCPBUGS-103915](https://issues.redhat.com/browse/OCPBUGS-103915): replace golang.org/x/net with openshift-sustaining/net@v0.50.0-sec.4 [#1543](https://github.com/openshift/machine-api-operator/pull/1543)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/de0171b9abf99cde11e789dd0d103cb69e7c6684...17904d3f450bc912dd9882c95152c6070eb4fb7a)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/55a94a504b858fd1484d55def8191d327b6a16bf)

* [OCPBUGS-127495](https://issues.redhat.com/browse/OCPBUGS-127495): limit ContainerRuntimeConfig status condition to 3 [#6584](https://github.com/openshift/machine-config-operator/pull/6584)
* [OCPBUGS-128460](https://issues.redhat.com/browse/OCPBUGS-128460): Correctly handle MC deletion in image mode when no new build is required [#6594](https://github.com/openshift/machine-config-operator/pull/6594)
* [OCPBUGS-128658](https://issues.redhat.com/browse/OCPBUGS-128658): wrong early exit during kubelet MCs regeneration [#6603](https://github.com/openshift/machine-config-operator/pull/6603)
* [OCPBUGS-103920](https://issues.redhat.com/browse/OCPBUGS-103920): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#6505](https://github.com/openshift/machine-config-operator/pull/6505)
* [OCPBUGS-115436](https://issues.redhat.com/browse/OCPBUGS-115436): Fix SHA idempotency test in nmstate-configuration.sh [#6480](https://github.com/openshift/machine-config-operator/pull/6480)
* [OCPBUGS-122109](https://issues.redhat.com/browse/OCPBUGS-122109): Update message for MachineOSBuildFailed condition [#6518](https://github.com/openshift/machine-config-operator/pull/6518)
* [OCPBUGS-116934](https://issues.redhat.com/browse/OCPBUGS-116934): Update AMI Whitelist [#6487](https://github.com/openshift/machine-config-operator/pull/6487)
* [OCPBUGS-114390](https://issues.redhat.com/browse/OCPBUGS-114390): Use kubernetes scheme in drain controller event recorder [#6456](https://github.com/openshift/machine-config-operator/pull/6456)
* [OCPBUGS-111311](https://issues.redhat.com/browse/OCPBUGS-111311): Fix duplicate template error [#6411](https://github.com/openshift/machine-config-operator/pull/6411)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/acca836821a48b58f669c64c8f8a29ca734d5ba3...55a94a504b858fd1484d55def8191d327b6a16bf)


### [machine-image-customization-controller](https://github.com/openshift/image-customization-controller/tree/146f6c59031e5e1108bdb82706d317407f78fae4)

* [OCPBUGS-103894](https://issues.redhat.com/browse/OCPBUGS-103894): Replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 for CVE-2026-33814 [#194](https://github.com/openshift/image-customization-controller/pull/194)
* [Full changelog](https://github.com/openshift/image-customization-controller/compare/fe4360da1fe44c0d8a69c0133f846e0cbc36740c...146f6c59031e5e1108bdb82706d317407f78fae4)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/e37e1a307fbc671f4d71163d437808273b3e93b3)

* [OU-1589](https://issues.redhat.com/browse/OU-1589): [release-4.20] sanitize linkified URLs in alert annotations [#1380](https://github.com/openshift/monitoring-plugin/pull/1380)
* [OCPBUGS-130565](https://issues.redhat.com/browse/OCPBUGS-130565): [release-4.20] escape regex variable values in regex matcher contexts [#1346](https://github.com/openshift/monitoring-plugin/pull/1346)
* [OU-1392](https://issues.redhat.com/browse/OU-1392): [release-4.20]  fix: parse datetime ranges from the specified format rather than browser specific apis- #1352 [#1352](https://github.com/openshift/monitoring-plugin/pull/1352)
* [OCPBUGS-118235](https://issues.redhat.com/browse/OCPBUGS-118235): [release-4.20] Bump fast-uri to 3.1.7 to fix CVE-2026-84292 [#1334](https://github.com/openshift/monitoring-plugin/pull/1334)
* [OU-1528](https://issues.redhat.com/browse/OU-1528): [release-4.20] Optimize namespace changes in Alerts [#1310](https://github.com/openshift/monitoring-plugin/pull/1310)
* [OCPBUGS-103912](https://issues.redhat.com/browse/OCPBUGS-103912): CVE-2026-33814-4-20 openshift4/ose-monitoring-plugin-rhel9: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.20] [#1215](https://github.com/openshift/monitoring-plugin/pull/1215)
* NO-JIRA: [release-4.20] Sanitize alert runbook URLs [#1293](https://github.com/openshift/monitoring-plugin/pull/1293)
* [OCPBUGS-98433](https://issues.redhat.com/browse/OCPBUGS-98433): fix for CVE-2026-59869 [#1183](https://github.com/openshift/monitoring-plugin/pull/1183)
* [OCPBUGS-98773](https://issues.redhat.com/browse/OCPBUGS-98773): [release-4.20] replace outdated react-linkify dependency [#1166](https://github.com/openshift/monitoring-plugin/pull/1166)
* NO-JIRA: Fix for OCPBUGS-89697 CVE-2026-12143 [#1138](https://github.com/openshift/monitoring-plugin/pull/1138)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/95dcfc2c40ff850a5ce766bf8842a132d834be03...e37e1a307fbc671f4d71163d437808273b3e93b3)


### [multus-admission-controller](https://github.com/openshift/multus-admission-controller/tree/ebfa14aacee2b064040b6e81d26a40ae65a6b376)

* [OCPBUGS-103909](https://issues.redhat.com/browse/OCPBUGS-103909): bump golang.org/x/net to v0.35.0-sec.3 to fix CVE-2026-33814 [#132](https://github.com/openshift/multus-admission-controller/pull/132)
* [Full changelog](https://github.com/openshift/multus-admission-controller/compare/fc73c803caa1140e5a9115ceeb0e38504b001722...ebfa14aacee2b064040b6e81d26a40ae65a6b376)


### [multus-cni, multus-cni-microshift](https://github.com/openshift/multus-cni/tree/ff2e64e16f3729c0dc370d570295f8ab5cc8c576)

* [OCPBUGS-103910](https://issues.redhat.com/browse/OCPBUGS-103910), [OCPBUGS-103913](https://issues.redhat.com/browse/OCPBUGS-103913): [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#355](https://github.com/openshift/multus-cni/pull/355)
* [OCPBUGS-120774](https://issues.redhat.com/browse/OCPBUGS-120774): [Release 4.20] Cherry-pick fix for the issue of stripping delegate datastore config on CNI DEL, leaking IPAM addresses- #350 [#352](https://github.com/openshift/multus-cni/pull/352)
* [Full changelog](https://github.com/openshift/multus-cni/compare/b2a2f457824490d93da101d983b25af966f2be1b...ff2e64e16f3729c0dc370d570295f8ab5cc8c576)


### [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy/tree/2f395cd7f78805195dc1e97e86f264173a8ede8f)

* [OCPBUGS-103918](https://issues.redhat.com/browse/OCPBUGS-103918): [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#126](https://github.com/openshift/multus-networkpolicy/pull/126)
* [Full changelog](https://github.com/openshift/multus-networkpolicy/compare/afbdf82505c0d8f212d63e1eee6debced74ef653...2f395cd7f78805195dc1e97e86f264173a8ede8f)


### [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni/tree/a36aafcb6328c54c8af707ad89ae01ee00778d87)

* [OCPBUGS-103917](https://issues.redhat.com/browse/OCPBUGS-103917): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#424](https://github.com/openshift/whereabouts-cni/pull/424)
* [Full changelog](https://github.com/openshift/whereabouts-cni/compare/43c8959152a6ca8afdc73eaed624286628c2c22e...a36aafcb6328c54c8af707ad89ae01ee00778d87)


### [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon/tree/356bd40b74ec289b7052267a9848c91c80a32708)

* [OCPBUGS-103914](https://issues.redhat.com/browse/OCPBUGS-103914): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 [#151](https://github.com/openshift/network-metrics-daemon/pull/151)
* [Full changelog](https://github.com/openshift/network-metrics-daemon/compare/b81340a9fc6963fa3d64d215a12e8528ca797131...356bd40b74ec289b7052267a9848c91c80a32708)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/9a5482b8d742f67be57f4472b251a974eb7d932a)

* maintenance: Bump the npm group with 24 updates [#623](https://github.com/openshift/networking-console-plugin/pull/623)
* [OCPNETUI-185](https://issues.redhat.com/browse/OCPNETUI-185): Sync Dockerfile with Dockerfile.art [#616](https://github.com/openshift/networking-console-plugin/pull/616)
* maintenance: Bump the npm group with 20 updates [#601](https://github.com/openshift/networking-console-plugin/pull/601)
* [OCPNETUI-157](https://issues.redhat.com/browse/OCPNETUI-157): dependency cleanup [#593](https://github.com/openshift/networking-console-plugin/pull/593)
* [OCPNETUI-157](https://issues.redhat.com/browse/OCPNETUI-157): reassign dev and prod dependencies [#586](https://github.com/openshift/networking-console-plugin/pull/586)
* maintenance: Bump the npm group with 23 updates [#574](https://github.com/openshift/networking-console-plugin/pull/574)
* maintenance: Bump the npm group across 1 directory with 24 updates [#572](https://github.com/openshift/networking-console-plugin/pull/572)
* [OCPNETUI-157](https://issues.redhat.com/browse/OCPNETUI-157): Align shared modules with Console [#567](https://github.com/openshift/networking-console-plugin/pull/567)
* maintenance: Bump the npm group with 15 updates [#550](https://github.com/openshift/networking-console-plugin/pull/550)
* maintenance: Bump the npm group across 1 directory with 20 updates [#533](https://github.com/openshift/networking-console-plugin/pull/533)
* maintenance: Bump the npm group with 227 updates [#508](https://github.com/openshift/networking-console-plugin/pull/508)
* [OCPNETUI-82](https://issues.redhat.com/browse/OCPNETUI-82): Lower Dockerfile base image versions [#519](https://github.com/openshift/networking-console-plugin/pull/519)
* [OCPBUGS-98776](https://issues.redhat.com/browse/OCPBUGS-98776): Updating linkify-it to 5.0.2 to fix CVE-2026-48801 [#462](https://github.com/openshift/networking-console-plugin/pull/462)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/da01518cc01abf023337e6cc26e3b6503797a7f8...9a5482b8d742f67be57f4472b251a974eb7d932a)


### [nutanix-cloud-controller-manager](https://github.com/openshift/cloud-provider-nutanix/tree/e62b30ec9e7f6328c974dc4e4ea757f1b70d4771)

* [OCPBUGS-103916](https://issues.redhat.com/browse/OCPBUGS-103916): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 [#75](https://github.com/openshift/cloud-provider-nutanix/pull/75)
* [Full changelog](https://github.com/openshift/cloud-provider-nutanix/compare/b575ef15f13e1434c793ae50824fd0676480be05...e62b30ec9e7f6328c974dc4e4ea757f1b70d4771)


### [oauth-apiserver](https://github.com/openshift/oauth-apiserver/tree/2f4712b8ae6c6c4f637919ad7535cd6425fb9272)

* [OCPBUGS-103931](https://issues.redhat.com/browse/OCPBUGS-103931): Replace golang.org/x/net with github.com/openshift-sustaining/net v0.50.0-sec.4 [#222](https://github.com/openshift/oauth-apiserver/pull/222)
* [Full changelog](https://github.com/openshift/oauth-apiserver/compare/99f27d25cc2853fe44ce6c7f7611637ef1492e42...2f4712b8ae6c6c4f637919ad7535cd6425fb9272)


### [oauth-proxy](https://github.com/openshift/oauth-proxy/tree/2b10b7895a5f16e216c5eaea6dbe8f830f9b69c0)

* [OCPBUGS-112095](https://issues.redhat.com/browse/OCPBUGS-112095): bugfix: rewrite open redirect strings to '/' [#382](https://github.com/openshift/oauth-proxy/pull/382)
* [Full changelog](https://github.com/openshift/oauth-proxy/compare/f6193d8afa72a6ac470f8a4b5a8c6a15de41e32b...2b10b7895a5f16e216c5eaea6dbe8f830f9b69c0)


### [oauth-server](https://github.com/openshift/oauth-server/tree/fe6832cd709a43a1470e2cafdd51d3030a4f1214)

* [OCPBUGS-103923](https://issues.redhat.com/browse/OCPBUGS-103923): Replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 for CVE-2026-33814 [#283](https://github.com/openshift/oauth-server/pull/283)
* [OCPBUGS-87076](https://issues.redhat.com/browse/OCPBUGS-87076): bugfix: default to english when Accept-Language header contains more than 1000 underscores [#270](https://github.com/openshift/oauth-server/pull/270)
* [Full changelog](https://github.com/openshift/oauth-server/compare/715ae668b8765b029cb7851a509b9948b8cc57a0...fe6832cd709a43a1470e2cafdd51d3030a4f1214)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/9786cf2e90c1dbf504b528d83142e946339f9d5d)

* [OCPBUGS-129447](https://issues.redhat.com/browse/OCPBUGS-129447): v1 accept catalog root entries and relative symlink targets [#1576](https://github.com/openshift/oc-mirror/pull/1576)
* [OCPBUGS-105780](https://issues.redhat.com/browse/OCPBUGS-105780): fix for CVE-2026-39829 [#1506](https://github.com/openshift/oc-mirror/pull/1506)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/9b186403c88394b54ab491871a158a124df39a02...9786cf2e90c1dbf504b528d83142e946339f9d5d)


### [olm-catalogd, olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller/tree/30b46d6cf509fe0f6879cc2699acd51f940068b6)

* [OCPBUGS-129017](https://issues.redhat.com/browse/OCPBUGS-129017): [release-4.20] clean up orphaned catalog cache temp dirs [#816](https://github.com/openshift/operator-framework-operator-controller/pull/816)
* [OCPBUGS-103922](https://issues.redhat.com/browse/OCPBUGS-103922), [OCPBUGS-103927](https://issues.redhat.com/browse/OCPBUGS-103927): Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#802](https://github.com/openshift/operator-framework-operator-controller/pull/802)
* [Full changelog](https://github.com/openshift/operator-framework-operator-controller/compare/39c3a80d919cafc207f5f208a5f88b23e468cd8d...30b46d6cf509fe0f6879cc2699acd51f940068b6)


### [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager/tree/b1b4e785fbcf66f86c5a99974fb2bad9d96ccb65)

* [OCPBUGS-103921](https://issues.redhat.com/browse/OCPBUGS-103921): Use patched x/net fork v0.50.0-sec.4 [#459](https://github.com/openshift/openshift-controller-manager/pull/459)
* [Full changelog](https://github.com/openshift/openshift-controller-manager/compare/d9e543dd31e981f279c447e4f92f0dac3f665f9e...b1b4e785fbcf66f86c5a99974fb2bad9d96ccb65)


### [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics/tree/9b00710613c3dc2bc800acf91e2e022f3fc3aeff)

* NO-ISSUE: synchronize OWNERS from main branch [#151](https://github.com/openshift/openshift-state-metrics/pull/151)
* [Full changelog](https://github.com/openshift/openshift-state-metrics/compare/b04e2ef05498c2a4504bd9396a3290c4f263fc37...9b00710613c3dc2bc800acf91e2e022f3fc3aeff)


### [openstack-resource-controller](https://github.com/openshift/openstack-resource-controller/tree/410e166761baffc21be3df02fff49933a3c9b5e2)

* [OCPBUGS-103790](https://issues.redhat.com/browse/OCPBUGS-103790): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 [#45](https://github.com/openshift/openstack-resource-controller/pull/45)
* [Full changelog](https://github.com/openshift/openstack-resource-controller/compare/bf0d2c88d6bf9bd90b24c979ea63dc37606b45fc...410e166761baffc21be3df02fff49933a3c9b5e2)


### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/e1d090d165aa3e31de614b18da7cf4dd2f6976f6)

* [OCPBUGS-103940](https://issues.redhat.com/browse/OCPBUGS-103940), [OCPBUGS-103947](https://issues.redhat.com/browse/OCPBUGS-103947), [OCPBUGS-103949](https://issues.redhat.com/browse/OCPBUGS-103949): Replace golang.org/x/net with githubcom/openshift-sustaining/net@v0.50.0-sec.3- #1364 [#1364](https://github.com/openshift/operator-framework-olm/pull/1364)
* [OCPBUGS-95400](https://issues.redhat.com/browse/OCPBUGS-95400), [OCPBUGS-95403](https://issues.redhat.com/browse/OCPBUGS-95403): bumping containerd to v1.7.33 [#1352](https://github.com/openshift/operator-framework-olm/pull/1352)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/1628e53777871f6c264d41a870cc4ee7248106f2...e1d090d165aa3e31de614b18da7cf4dd2f6976f6)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/8608e797c1b08e75fead3c12b53d4fd5b3b50462)

* [OCPBUGS-128426](https://issues.redhat.com/browse/OCPBUGS-128426): egressip: set IFA_PROTO on EgressIP addresses to prevent nmstate persistence- #3437 [#3507](https://github.com/openshift/ovn-kubernetes/pull/3507)
* [OCPBUGS-129457](https://issues.redhat.com/browse/OCPBUGS-129457): egressip: fix duplicate IP assignment on control-plane restart [#3485](https://github.com/openshift/ovn-kubernetes/pull/3485)
* [OCPBUGS-41830](https://issues.redhat.com/browse/OCPBUGS-41830): add ability to skip tests that require root [#3309](https://github.com/openshift/ovn-kubernetes/pull/3309)
* [OCPBUGS-128980](https://issues.redhat.com/browse/OCPBUGS-128980): EIP duplicate MAC race during node shutdown [#3506](https://github.com/openshift/ovn-kubernetes/pull/3506)
* [OCPBUGS-99642](https://issues.redhat.com/browse/OCPBUGS-99642): EgressIP: add route policies for east-west traffic between networks [#3324](https://github.com/openshift/ovn-kubernetes/pull/3324)
* [OCPBUGS-105423](https://issues.redhat.com/browse/OCPBUGS-105423): Fix traffic leak in egress IP on secondary interface [#3376](https://github.com/openshift/ovn-kubernetes/pull/3376)
* [OCPBUGS-105557](https://issues.redhat.com/browse/OCPBUGS-105557): Broadcast traffic fan-out across UDNs hits OVS resubmit limit [#3377](https://github.com/openshift/ovn-kubernetes/pull/3377)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/8ed3b22d6ffda40908d82183f5b7301a747b1ca3...8608e797c1b08e75fead3c12b53d4fd5b3b50462)


### [powervs-block-csi-driver](https://github.com/openshift/ibm-powervs-block-csi-driver/tree/22cfe3971df6bbe0bad8f2074b342c199e4de0f3)

* [OCPBUGS-101351](https://issues.redhat.com/browse/OCPBUGS-101351), [OCPBUGS-103945](https://issues.redhat.com/browse/OCPBUGS-103945), [OCPBUGS-89652](https://issues.redhat.com/browse/OCPBUGS-89652), [OCPBUGS-89986](https://issues.redhat.com/browse/OCPBUGS-89986), [OCPBUGS-90451](https://issues.redhat.com/browse/OCPBUGS-90451), [OCPBUGS-91082](https://issues.redhat.com/browse/OCPBUGS-91082), [OCPBUGS-92501](https://issues.redhat.com/browse/OCPBUGS-92501), [OCPBUGS-92964](https://issues.redhat.com/browse/OCPBUGS-92964), [OCPBUGS-93471](https://issues.redhat.com/browse/OCPBUGS-93471), [OCPBUGS-94893](https://issues.redhat.com/browse/OCPBUGS-94893), [OCPBUGS-96442](https://issues.redhat.com/browse/OCPBUGS-96442): Bump golang.org dependencies [#146](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/146)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver/compare/8faa079fe4ba90ca37e7112e4be8a77ccf221e77...22cfe3971df6bbe0bad8f2074b342c199e4de0f3)


### [prom-label-proxy](https://github.com/openshift/prom-label-proxy/tree/88f96c0e76c9724f3bfff13115fcf563e5bb7c61)

* NO-ISSUE: synchronize OWNERS from main branch [release-4.20] [#407](https://github.com/openshift/prom-label-proxy/pull/407)
* [Full changelog](https://github.com/openshift/prom-label-proxy/compare/3bc94eed432cacc37930aa4b0d8ff375e370cbbe...88f96c0e76c9724f3bfff13115fcf563e5bb7c61)


### [prometheus](https://github.com/openshift/prometheus/tree/4e4e87975898859c82c898ce40474990c86016aa)

* NO-ISSUE: synchronize OWNERS from main branch [#381](https://github.com/openshift/prometheus/pull/381)
* [OCPBUGS-93713](https://issues.redhat.com/browse/OCPBUGS-93713): fix for CVE-2026-42151- #358 [#358](https://github.com/openshift/prometheus/pull/358)
* [Full changelog](https://github.com/openshift/prometheus/compare/f226aee2d4de01bd0f3a85b16308f9e22514111c...4e4e87975898859c82c898ce40474990c86016aa)


### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/6cca226e4a93d8850b7533cae491820483e2e635)

* NO-JIRA: synchronize OWNERS with main [#197](https://github.com/openshift/prometheus-alertmanager/pull/197)
* [OCPBUGS-103946](https://issues.redhat.com/browse/OCPBUGS-103946): Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 [#170](https://github.com/openshift/prometheus-alertmanager/pull/170)
* [OCPBUGS-98175](https://issues.redhat.com/browse/OCPBUGS-98175): build(deps): bump github.com/hashicorp/memberlist to a… [#160](https://github.com/openshift/prometheus-alertmanager/pull/160)
* [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/09e48f08f017bf247c37480531e264d266375694...6cca226e4a93d8850b7533cae491820483e2e635)


### [prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator/tree/f2c83ec5b797c61f95b9fe5c7b59315f30e84b3c)

* NO-ISSUE: synchronize OWNERS from main branch [#414](https://github.com/openshift/prometheus-operator/pull/414)
* [OCPBUGS-103950](https://issues.redhat.com/browse/OCPBUGS-103950), [OCPBUGS-103952](https://issues.redhat.com/browse/OCPBUGS-103952): [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#395](https://github.com/openshift/prometheus-operator/pull/395)
* [Full changelog](https://github.com/openshift/prometheus-operator/compare/425294dded74054100db465d296b2aa76e7a691e...f2c83ec5b797c61f95b9fe5c7b59315f30e84b3c)


### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/15349697650c543d855812152ca0d598b7e2f324)

* [OCPBUGS-103944](https://issues.redhat.com/browse/OCPBUGS-103944): CVE-2026-33814 openshift4/ose-prometheus-node-exporter-rhel9: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.20] [#214](https://github.com/openshift/node_exporter/pull/214)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.20] [#205](https://github.com/openshift/node_exporter/pull/205)
* [Full changelog](https://github.com/openshift/node_exporter/compare/fa749d65d8eca1cc937554baab91385a78ec8ce1...15349697650c543d855812152ca0d598b7e2f324)


### [rhel-coreos, rhel-coreos-extensions](https://github.com/openshift/os/tree/847b7d8c3b60f60e86f1de0b7efebb746c75d1bc)

* [OCPBUGS-105533](https://issues.redhat.com/browse/OCPBUGS-105533): NetworkManager-ovs has moved to RHCOS [#1959](https://github.com/openshift/os/pull/1959)
* [Full changelog](https://github.com/openshift/os/compare/ee943c37e640fcc5812d4a2a20ac66d57984e79c...847b7d8c3b60f60e86f1de0b7efebb746c75d1bc)


### [route-controller-manager](https://github.com/openshift/route-controller-manager/tree/f41c08505753958be4f829526e5a1a1b3eb9bbda)

* [OCPBUGS-103792](https://issues.redhat.com/browse/OCPBUGS-103792): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#108](https://github.com/openshift/route-controller-manager/pull/108)
* [Full changelog](https://github.com/openshift/route-controller-manager/compare/1a0229e40e5c569c6c59f6b10c26584bccd084b5...f41c08505753958be4f829526e5a1a1b3eb9bbda)


### [tests](https://github.com/openshift/origin/tree/19943752c85ac692bcd067c87562b133d2aa5f8e)

* [OCPBUGS-130854](https://issues.redhat.com/browse/OCPBUGS-130854): stage the creation of test pods to minimize etcd impact [#31746](https://github.com/openshift/origin/pull/31746)
* [OCPBUGS-117011](https://issues.redhat.com/browse/OCPBUGS-117011): Raise status polling timeout and write bound [#31596](https://github.com/openshift/origin/pull/31596)
* [OCPBUGS-114440](https://issues.redhat.com/browse/OCPBUGS-114440): Fix probe termination test to use pod status instead of kubelet event text [#31570](https://github.com/openshift/origin/pull/31570)
* [OCPBUGS-100440](https://issues.redhat.com/browse/OCPBUGS-100440): retry GetVotingMemberNames on transient etcd client fails [#31508](https://github.com/openshift/origin/pull/31508)
* [Full changelog](https://github.com/openshift/origin/compare/de6e1933b7c69ffa2f7833a7a238089165e8ee8b...19943752c85ac692bcd067c87562b133d2aa5f8e)


### [volume-data-source-validator](https://github.com/openshift/volume-data-source-validator/tree/751e25a535d3dfcac9b82c853d83ba1d9c158139)

* [OCPBUGS-103985](https://issues.redhat.com/browse/OCPBUGS-103985): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.3 [#20](https://github.com/openshift/volume-data-source-validator/pull/20)
* [Full changelog](https://github.com/openshift/volume-data-source-validator/compare/0e61642f8d898ee199e42f37319864851dd3627f...751e25a535d3dfcac9b82c853d83ba1d9c158139)


### [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere/tree/435940937cd5e9a41b11e0bb5fb29ca963318299)

* [OCPBUGS-103963](https://issues.redhat.com/browse/OCPBUGS-103963): Replace golang.org/x/net with sustaining fork for CVE-2026-33814 in 4.20 [#133](https://github.com/openshift/cloud-provider-vsphere/pull/133)
* [Full changelog](https://github.com/openshift/cloud-provider-vsphere/compare/b93eb64ff72e7c005687813c8b478d694a0f517a...435940937cd5e9a41b11e0bb5fb29ca963318299)


### [vsphere-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-vsphere/tree/c8cec71c7470b6cde4b71eccce895e3da95798f8)

* [OCPBUGS-103968](https://issues.redhat.com/browse/OCPBUGS-103968): Bump golang.org/x/net to github.com/openshift-sustaining/net v0.50.0-sec.4 CVE-2026-33814 [release-4.20] [#126](https://github.com/openshift/cluster-api-provider-vsphere/pull/126)
* [Full changelog](https://github.com/openshift/cluster-api-provider-vsphere/compare/769d0fb781dfb53df5d533b917c363a553185fd6...c8cec71c7470b6cde4b71eccce895e3da95798f8)


### [vsphere-csi-driver, vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver/tree/6db4d0b24f3e5f2dda79b19db4ba2f5c220b5943)

* [OCPBUGS-96458](https://issues.redhat.com/browse/OCPBUGS-96458): Bump golang.org/x/net to v0.50.0-sec.4 [#197](https://github.com/openshift/vmware-vsphere-csi-driver/pull/197)
* [OCPBUGS-92959](https://issues.redhat.com/browse/OCPBUGS-92959): Bump golang.org/x/crypto/ssh to v0.48.0-sec.1 [#191](https://github.com/openshift/vmware-vsphere-csi-driver/pull/191)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver/compare/0363addf5f2c19322d24a3f61c7b2684da16ead1...6db4d0b24f3e5f2dda79b19db4ba2f5c220b5943)


### [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator/tree/338db9fd11bd1300c5b6a891b0566cb3a9d92ce8)

* [OCPBUGS-103996](https://issues.redhat.com/browse/OCPBUGS-103996): Bump golang.org/x/net to v0.50.0-sec.3 [#354](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/354)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver-operator/compare/13b68a91a148667d46bd06ad8fcb839be984671e...338db9fd11bd1300c5b6a891b0566cb3a9d92ce8)


### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/308961eba90be48f2699bb2eea7352e7f911f973)

* [OCPBUGS-130578](https://issues.redhat.com/browse/OCPBUGS-130578): Fixed GetVCenter to handle removed FDs better [#246](https://github.com/openshift/vsphere-problem-detector/pull/246)
* [OCPBUGS-88024](https://issues.redhat.com/browse/OCPBUGS-88024): Fixed compute cluster permission logic for single fd with read-only custom resourcepool [#225](https://github.com/openshift/vsphere-problem-detector/pull/225)
* [OCPBUGS-103980](https://issues.redhat.com/browse/OCPBUGS-103980): Bump golang.org/x/net to v0.50.0-sec.4 [#231](https://github.com/openshift/vsphere-problem-detector/pull/231)
* [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/65d066ab0940dc69aa3f7ec6b02e698a6e4f5795...308961eba90be48f2699bb2eea7352e7f911f973)