# 4.20.23

Created: 2026-05-14 09:19:37 +0000 UTC

Image Digest: `sha256:4a03c010c9c554dc86066a7130002cc8c0bdd13da6207a7eab299f1013690dbd`


## Changes from 4.20.9

### Components

* Kubectl 1.33.3
* Kubernetes upgraded from 1.33.6 to 1.33.11
* Kubernetes Tests 1.33.4
* Red Hat Enterprise Linux CoreOS upgraded from 9.6.20260107-0 to 9.6.20260512-0


### Removed images

* libvirt-machine-controllers


### Rebuilt images without code change

* [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent) git [637327ec](https://github.com/openshift/assisted-installer-agent/commit/637327ec40cd1f85ac5d7d4f114a2fae89baa8b0) `sha256:1625f489c4371bbcb338d65fbbe4a50601d7501531a22b0260459ef70cb9241b`
* [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy) git [11b24a2c](https://github.com/openshift/apiserver-network-proxy/commit/11b24a2c7452ef683a1d989f1016e6e815f5c112) `sha256:747fb0b2319656741efaffa7d8b1ed382b994846ac52372d3113ede4f1037708`
* [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws) git [bb88da16](https://github.com/openshift/cloud-provider-aws/commit/bb88da16b29d63573861351afc5ca8c4547775d6) `sha256:29ac5a3387b273a163e7384d35d7c324f4a7e28f53656565ef7bdc1b41c1d152`
* [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws) git [300439ea](https://github.com/openshift/cluster-api-provider-aws/commit/300439ea0736444a160c061578b3bd8956d4f7e6) `sha256:374a3113aca8079b686b180a44bff8921159d831a2741e3f9717c4cbcd49ab1d`
* [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver) git [a8ef205c](https://github.com/openshift/aws-ebs-csi-driver/commit/a8ef205c28b7b8c80b0caf1c1a9e12f81f4fdbb9) `sha256:9610ce483e7be277077b838ecb3e76669c2ed38daa62f140f9654e287c1ffb3e`
* [aws-karpenter-provider-aws](https://github.com/openshift/aws-karpenter-provider-aws) git [b37141b0](https://github.com/openshift/aws-karpenter-provider-aws/commit/b37141b051bdf790eb7e8f45b95f6bd7dc8140f4) `sha256:c4980ac2a3f12d809f901513ef0c0854b7738d63297afeab9042f52b21df0bae`
* [azure-cloud-controller-manager](https://github.com/openshift/cloud-provider-azure) git [d469d04e](https://github.com/openshift/cloud-provider-azure/commit/d469d04ed645358d942af442fe21e2c2b44b9b2c) `sha256:09ca2877a1746fbdbbec262eabad9acb6bf68ad8c6a2cf74914fa83d08065263`
* [azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure) git [d469d04e](https://github.com/openshift/cloud-provider-azure/commit/d469d04ed645358d942af442fe21e2c2b44b9b2c) `sha256:a6841a31c87f33aca11b2d2a4bf84099def1314f8999f297ad82a7db04454eb9`
* [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver) git [45d505bc](https://github.com/openshift/azure-file-csi-driver/commit/45d505bc11fedadece5ae27147c9595877e39f2a) `sha256:4245facda4eb4806ebef96f83895729d9c34bc7fe0c29c9f5add723ec791bf06`
* [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure) git [68db9150](https://github.com/openshift/machine-api-provider-azure/commit/68db91507ea47f767ee0dc838c08cc371d2ff69f) `sha256:46fa5a7832987a58d8fd14214e77c2a2145b3dbdd5087509f7dfc92e43a770d8`
* [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity) git [88b18175](https://github.com/openshift/azure-workload-identity/commit/88b18175e46fe305486d172ec0b4e8471c55e30b) `sha256:cedec3f2591d4a1aa2ce2f29e492eb8f957c1db6efc5b3852ee2c54afe52cccc`
* [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3) git [f782ba74](https://github.com/openshift/cluster-api-provider-metal3/commit/f782ba747ed353721c84ceb754ca8403f94adb6a) `sha256:f0d450f021f2d41c5e77d725095aa3c122f5d0407314b33079f383b6cf488b1d`
* [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal) git [fb678fec](https://github.com/openshift/cluster-api-provider-baremetal/commit/fb678fec5f7e08348b281341481f33a848204e50) `sha256:b7b5c8e3edd25b5e7113e0ad3e336600da14c452edaa6ad2f319a025487df8b8`
* [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller) git [d22915bc](https://github.com/openshift/cloud-network-config-controller/commit/d22915bc82993ce11cb3fb97e6ae00602f30549b) `sha256:24b6a6b7aa6170e7fb251a9f8638b4b9889ee94f387d5386f185d2cba2b263b0`
* [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator) git [147e5a7f](https://github.com/openshift/cluster-autoscaler-operator/commit/147e5a7ff20b46ade7dd932b47e06ca82729f5e8) `sha256:115d2fc5ff639b8e849b18a515afb3d52f92908ecaab5e6c12552ad43a2f2da6`
* [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap) git [74abc555](https://github.com/openshift/cluster-bootstrap/commit/74abc555111bac56a67957ef517ef086e4643c50) `sha256:5fcd5757fc9ca83cc789cd807d6d9b71449603ae5722fda06ac250c2b4e30840`
* [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator) git [276696cc](https://github.com/openshift/cluster-cloud-controller-manager-operator/commit/276696ccf679830b25df341edb7aae9bb3f4e763) `sha256:94720a85270dc4ead90c9ad057ab37a55d4c7dc02a7e3ccc223422f0c4b64a27`
* [cluster-config-api](https://github.com/openshift/api) git [50517c6f](https://github.com/openshift/api/commit/50517c6f4bfdbf9fc2cb291fd97cce150a3237ca) `sha256:d88881324b33aeb22411784c56c52f85b404f63601cf78fe101cad1989dea6b2`
* [cluster-config-operator](https://github.com/openshift/cluster-config-operator) git [657754e2](https://github.com/openshift/cluster-config-operator/commit/657754e2beaed6295ff28bb0f7813cb1c9ce35b2) `sha256:6dc05f8261659600e4f1396f25d88142330d45ca6d127bbf3667f4bc634483f2`
* [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator) git [0bbafe24](https://github.com/openshift/cluster-control-plane-machine-set-operator/commit/0bbafe24ade564bc62554251f36de90d524abcde) `sha256:aaaf5904aa32543fe1bdea66bdef48f2a70a4e687335f6eae9afe9a5cb5eaee8`
* [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator) git [82578923](https://github.com/openshift/cluster-dns-operator/commit/82578923164636746e0d74d594ab32d83a660c0b) `sha256:2781d1dfdd0cd28bed927e3fa792c42419b72334da94472e756f893afcf333ec`
* [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator) git [b04c7c12](https://github.com/openshift/cluster-image-registry-operator/commit/b04c7c121851704973a94a50e42af1425045899c) `sha256:ccc652fce82aa643ed0100136ee3f6dafd684e1e00c3a13223b98d5178e59bef`
* [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator) git [438c9dba](https://github.com/openshift/cluster-kube-controller-manager-operator/commit/438c9dba80ddadeabe9efe4a654297a7b550b2b8) `sha256:eb6113dd12a873349855c9039d5c8b1f51fe67c2ca4c28e3e77d5c8f786bbe12`
* [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator) git [5adc1429](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/commit/5adc14299739bc64c8812cbab0b0ff2d12863602) `sha256:e0ed34da98d962988e3f52c0aea2f1a52dbf6d1284d204d04070ca9c0f49ba5e`
* [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver) git [b3c82b2e](https://github.com/openshift/cluster-machine-approver/commit/b3c82b2eec66ae3ae510df0603af1212c34be618) `sha256:23b711df6a698e4b440ba594ff9b8ba2801f29b10c9a688c790330e9ae170704`
* [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator) git [e4917368](https://github.com/openshift/cluster-olm-operator/commit/e4917368b6a547f97a0fb411fea90de246d1417e) `sha256:c8ca53084181b5f8a1888f03cfc68d113b001684a55003af3cf28409fc542684`
* [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator) git [9cfa5679](https://github.com/openshift/cluster-openshift-apiserver-operator/commit/9cfa5679a8ac1e5a68eea32179d9e069da85dfcf) `sha256:6a2b944f4713f5f80650a3306f0994bb333785048e2cac874473207058ea4c79`
* [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator) git [aa455c04](https://github.com/openshift/cluster-openshift-controller-manager-operator/commit/aa455c043152123595c2b4f72e02279aad9dd48a) `sha256:f251a6ec40c6a15e1fcae56752cc90961b4571fff3e8416bbef3e8a30f051bc4`
* [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller) git [47c78310](https://github.com/openshift/cluster-policy-controller/commit/47c783103216aa5e1242632127a5d8f98b8b7455) `sha256:26ed393f9c78a642940aff922d5011ef8c876f621c2008979d78596109b25a98`
* [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator) git [b343f70f](https://github.com/openshift/cluster-samples-operator/commit/b343f70f19ffd559e1a81d3a3e65bd106e634c13) `sha256:19dc9bfd3fc3cbc158152ac33c7a5a0dbd491421eb3fe5e9453cdee1f5cc41e9`
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [c40e7b9b](https://github.com/openshift/cluster-update-keys/commit/c40e7b9b60c62690a25333fc54ae0d3705474afb) `sha256:9252be3e6714421ba45d35d06de493ffcad5aa9fadb5ced7e07458165f9ca82d`
* [configmap-reloader](https://github.com/openshift/configmap-reload) git [2438d7c8](https://github.com/openshift/configmap-reload/commit/2438d7c8e495201361d87da205649bc38fc4822b) `sha256:45bf5a71bb79d315c3e351ea8536d4ebf6866a31b37a6e5110770a66f0e93688`
* [container-networking-plugins](https://github.com/openshift/containernetworking-plugins) git [184a9601](https://github.com/openshift/containernetworking-plugins/commit/184a96011a8cacb72319cdccb904271a99c5928d) `sha256:0953b0a9ee67d5904945db3cb4976ded24fd3897883377d0dc48b442aacc8f8e`
* [containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins) git [184a9601](https://github.com/openshift/containernetworking-plugins/commit/184a96011a8cacb72319cdccb904271a99c5928d) `sha256:1e10432104c6d4fcfb1bf0a8da81d5543c8116cc84eb361d80e03191cde4642c`
* [coredns](https://github.com/openshift/coredns) git [6f39336e](https://github.com/openshift/coredns/commit/6f39336e6da9dc77b2db140a96773c413d50a665) `sha256:fc5bd255ff684119b651b112a23bfc48e610947061c63071091ad47550d7dadb`
* [csi-external-attacher](https://github.com/openshift/csi-external-attacher) git [45239149](https://github.com/openshift/csi-external-attacher/commit/45239149cb387bcc51d944b802db0e804dc02688) `sha256:773eee58a5177aa70bb79cbaa2ca9878383af2df593c7eacaf1f40a8a56995bb`
* [csi-external-resizer](https://github.com/openshift/csi-external-resizer) git [c674bea9](https://github.com/openshift/csi-external-resizer/commit/c674bea9bb6a81e463c7fefa974e2109d829daef) `sha256:0a2e38ed8a1b9ff2f30b3e03baf0fab64f9f9b2b2805cc8e20f8c3416a2075fb`
* [csi-external-snapshot-metadata](https://github.com/openshift/csi-external-snapshot-metadata) git [693a8264](https://github.com/openshift/csi-external-snapshot-metadata/commit/693a826455777eaafc677bb2195dc071d184243b) `sha256:88fdac02c4d0f9900a34da72587f9b87bc192d2cbbeae268a7f7829c6ae3e120`
* [csi-external-snapshotter](https://github.com/openshift/csi-external-snapshotter) git [42604822](https://github.com/openshift/csi-external-snapshotter/commit/42604822c25eb2aa0ecb017c24e328221b238eb9) `sha256:4898af47a83a5f94540db7531b3ada7092642ad76788bd1209e0e0fe79b51c25`
* [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe) git [1d6d6b27](https://github.com/openshift/csi-livenessprobe/commit/1d6d6b27460e58f24110c72ec9c96afe2c1d891d) `sha256:1550364faf6db4553e083164cabbf031abcb79c258fabc1b20682caea17bd0d3`
* [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar) git [6ce4713c](https://github.com/openshift/csi-node-driver-registrar/commit/6ce4713c87b735e2546a65a871bd2c7cfe383c31) `sha256:4ecba3bc31b390aac6c96cd7cd7efeff81c3cc37f027e8d2601b05df25bacb55`
* [csi-snapshot-controller](https://github.com/openshift/csi-external-snapshotter) git [42604822](https://github.com/openshift/csi-external-snapshotter/commit/42604822c25eb2aa0ecb017c24e328221b238eb9) `sha256:e99a10e94f071092a18e3528af5eb3ab05a81fa1a3310c0e3a0ad5b9b5109d8d`
* [egress-router-cni](https://github.com/openshift/egress-router-cni) git [5e0f8d1b](https://github.com/openshift/egress-router-cni/commit/5e0f8d1b545899fda27c5e1cc8707d33cba1b534) `sha256:6acbd46a10f9dd444e17ab736e5445ca941b150a88b34d8efcc4754c651b490a`
* [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp) git [65539c71](https://github.com/openshift/cluster-api-provider-gcp/commit/65539c71b4c292fc0f4eeb572dfe490af63063d9) `sha256:342364ecf6c5ec5706daf40d8af0260c806a149c44d6c15cdacdcb38dc270a4f`
* [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp) git [01515888](https://github.com/openshift/machine-api-provider-gcp/commit/01515888c83526ec235b7bc3a27df6eba3034b00) `sha256:8d48989ce610c85812b293fcff61dd5596b747c19175c2fca9bddf6cd4e0d522`
* [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver) git [500ab5d3](https://github.com/openshift/gcp-pd-csi-driver/commit/500ab5d31ad382805070c8ae329a9a34163ebc99) `sha256:f7db72dee150fa255b96e8447dc358247a772fb2a3c6fd8f9eafd4b16ccd9a80`
* [gcp-pd-csi-driver-operator](https://github.com/openshift/gcp-pd-csi-driver-operator) git [e0ad050a](https://github.com/openshift/gcp-pd-csi-driver-operator/commit/e0ad050a84bab669e0f11e080fc4c388ef417bba) `sha256:5136f16ad7facee22da365f364984c7e7d93cc1e96c4c191ad6b45dc5dfc6432`
* [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook) git [b36788ed](https://github.com/openshift/gcp-workload-identity-federation-webhook/commit/b36788edd4c559cffd5f7f1b2e3e51b98c3e92b8) `sha256:dac872daf5b7ce19e73fd146f068cbea59f1ede083e9ff20fbbfe492eedaba6b`
* [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm) git [36ab30f9](https://github.com/openshift/cloud-provider-ibm/commit/36ab30f90e87de0daa926d20ccda88c41abed191) `sha256:8478db72396d8392af0bb27d9379e4d8134948a4ed85dc92774d289310260fa6`
* [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator) git [21f405cc](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/commit/21f405cce9573eee1c4f1cf95c0eb601ae77ed99) `sha256:03ceee2d3d6221208912fbb5cc1fc7bdb4aa64d4ef52f34ae38f14ddefb837b0`
* [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud) git [8b6396a4](https://github.com/openshift/cluster-api-provider-ibmcloud/commit/8b6396a4c78f4791b7f3c5ec404a78b499f8546b) `sha256:e22cc9101eb952f9d5aac0b3b943ca1d36b5a0ce46bf6532911143936aac38fc`
* [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [6c92e542](https://github.com/openshift/ironic-rhcos-downloader/commit/6c92e5425b58baa9d4dd951a992b7460e8407247) `sha256:2624fa404ad2ee7d5701751d115c19b7f6f6ce827dd57ae4f9ffb06913627ec4`
* [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager) git [fa5b8b8b](https://github.com/openshift/ironic-static-ip-manager/commit/fa5b8b8bb73e509f74205a99a0ed1cb07a843885) `sha256:07f87b3165cdb6945838697849a7740f76b4505a38b9b7c9a85d62ec87cdb298`
* [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy) git [b9134351](https://github.com/openshift/kube-rbac-proxy/commit/b9134351be37c43408334047d8eb85d0ac01fe4e) `sha256:6a7846f0e205ab61f41260c0d77346640c61fb5766093e7fdece5c76f9eae5ab`
* [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator) git [0f8a4eb8](https://github.com/openshift/kubernetes-kube-storage-version-migrator/commit/0f8a4eb84ace9b746cf25d51d80dacf34ca5f953) `sha256:b59f0461faa9bee835f10236ecb3a1ed3e38a6e8f84aad72090c958cb40e8a40`
* [metallb-frr](https://github.com/openshift/frr) git [3ca45c51](https://github.com/openshift/frr/commit/3ca45c517eafe07aac0866e5cbd32a5c08081f22) `sha256:3dfd02a05ab34101e3c6ce5dfe21e31da74ea62b2aa089a40993aa6d7d6fddb6`
* [multus-admission-controller](https://github.com/openshift/multus-admission-controller) git [fc73c803](https://github.com/openshift/multus-admission-controller/commit/fc73c803caa1140e5a9115ceeb0e38504b001722) `sha256:9749ba3e3f57295dde73779179efcd83d02477105badfc9f1308e8a413b8e750`
* [multus-route-override-cni](https://github.com/openshift/route-override-cni) git [391c1b03](https://github.com/openshift/route-override-cni/commit/391c1b0361e17c5718508810f0bdb6ff66ae6e81) `sha256:2bcb4e7d2011f23376971be421283587028c928912af26db85c62721719b2fa3`
* [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni) git [43c89591](https://github.com/openshift/whereabouts-cni/commit/43c8959152a6ca8afdc73eaed624286628c2c22e) `sha256:10cf79f0c196012c4eeebe9122d69b9741df563ab447c9f33fdbb21217219ec8`
* [must-gather](https://github.com/openshift/must-gather) git [f0c64742](https://github.com/openshift/must-gather/commit/f0c64742c79afce5e367ca2c7b830ad448abe1df) `sha256:9a39873bb7737f82772bb8054b795dc21ac90facfbdf52cdfcdc7dadc4f38402`
* [network-interface-bond-cni](https://github.com/openshift/bond-cni) git [dd3c4d0b](https://github.com/openshift/bond-cni/commit/dd3c4d0b886138d974022b963e72f2e90293abfe) `sha256:d91470ccd00a09f9f7591a912dabe16ee26e4e0390a3e3d44fab5b8d1b3580dc`
* [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon) git [b81340a9](https://github.com/openshift/network-metrics-daemon/commit/b81340a9fc6963fa3d64d215a12e8528ca797131) `sha256:519a220a002733600cb0c686e786c4295bbd0b44a216ff12d7fe7ba7ca5162a5`
* [network-tools](https://github.com/openshift/network-tools) git [26d09174](https://github.com/openshift/network-tools/commit/26d09174cbd92386469e777e3bf49bfa95d035d5) `sha256:c729bf1636328c5597c89a045bc0f9df994074eaffe875009263d9bf313a5a4c`
* [nutanix-cloud-controller-manager](https://github.com/openshift/cloud-provider-nutanix) git [b575ef15](https://github.com/openshift/cloud-provider-nutanix/commit/b575ef15f13e1434c793ae50824fd0676480be05) `sha256:05cea60863123a8ca7f3895034a6cb713e9096c956b98629384afb5b8f075a09`
* [nutanix-machine-controllers](https://github.com/openshift/machine-api-provider-nutanix) git [3200ddef](https://github.com/openshift/machine-api-provider-nutanix/commit/3200ddef48a5a8d47b96539419c51f3619cb1fd5) `sha256:7b3bce203f0da69189bf7e7fded611fd349076edc8c6604148ca390f8dd42598`
* [olm-catalogd](https://github.com/openshift/operator-framework-operator-controller) git [3e2401f2](https://github.com/openshift/operator-framework-operator-controller/commit/3e2401f23ef666e8f33789a397d81a7d352b0a33) `sha256:33659509408fb9377687b6d0503708f727c6ae9412008d167f37df7f20be5a29`
* [olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller) git [3e2401f2](https://github.com/openshift/operator-framework-operator-controller/commit/3e2401f23ef666e8f33789a397d81a7d352b0a33) `sha256:4b93319950503841ed5e32b3232a8038d892ad0b94a25e707a15f750792fef05`
* [openshift-apiserver](https://github.com/openshift/openshift-apiserver) git [34cb4762](https://github.com/openshift/openshift-apiserver/commit/34cb4762e1716c1a31a344118b8a3ad00c28d831) `sha256:8deb4e91ba9fa0d2eed689c3116ffa2aa7eececb5de2438ebeb0d59744768bfe`
* [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager) git [d9e543dd](https://github.com/openshift/openshift-controller-manager/commit/d9e543dd31e981f279c447e4f92f0dac3f665f9e) `sha256:def35d5111be3a3e83047e185867cbb3c7552d628660c30e8872616a8eaff2f3`
* [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics) git [b04e2ef0](https://github.com/openshift/openshift-state-metrics/commit/b04e2ef05498c2a4504bd9396a3290c4f263fc37) `sha256:8d0386a23c295fb84ccac97e71f2eab642c8df4f183a5cd340d7256aedf21d01`
* [openstack-resource-controller](https://github.com/openshift/openstack-resource-controller) git [bf0d2c88](https://github.com/openshift/openstack-resource-controller/commit/bf0d2c88d6bf9bd90b24c979ea63dc37606b45fc) `sha256:58e0622824c4027d4f0b31e0733d3cc8233363d03cb92527daaf2de866b9014c`
* [ovirt-csi-driver](https://github.com/openshift/ovirt-csi-driver) git [1db726a9](https://github.com/openshift/ovirt-csi-driver/commit/1db726a940d5ec150fd185a215f1368990653082) `sha256:3a9dd9a934985501b9648bb8307333fb7ebb34fbb28db1cdcca89d9c06485d98`
* [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs) git [2424e8dd](https://github.com/openshift/cloud-provider-powervs/commit/2424e8dd4bf3e19c3e65efebc03bf4942665f7c4) `sha256:acb6ea0eeef9de10e44e4bf8130adfaf52397d05f551680dbfc994d44c77e98d`
* [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs) git [f011b3c7](https://github.com/openshift/machine-api-provider-powervs/commit/f011b3c727c5377302b2ab0a203457490b930a3d) `sha256:1574f3aa732d06ebbde6e4ee146f83dfb4244f74b1a42328ca44ee52983779d8`
* [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager) git [419f2843](https://github.com/openshift/prometheus-alertmanager/commit/419f2843332265d44982920d6fb4db220ec26f91) `sha256:f5ff04ecb8fae776af96d1ebc2daabd57d7bb132f31c13ef03982f29b988342c`
* [prometheus-node-exporter](https://github.com/openshift/node_exporter) git [fa749d65](https://github.com/openshift/node_exporter/commit/fa749d65d8eca1cc937554baab91385a78ec8ce1) `sha256:d379d721a10b07acd1b4789e6f2f557f3ea470c972f0776e75e253c540a84753`
* [service-ca-operator](https://github.com/openshift/service-ca-operator) git [37e0c317](https://github.com/openshift/service-ca-operator/commit/37e0c31790b6a954214817974a56c9a699d0cf78) `sha256:1636cee2ae6526fbc2e0f368b2553b7a29a136fc272fd774e38ebbe6d8fbd10a`
* [thanos](https://github.com/openshift/thanos) git [c0951032](https://github.com/openshift/thanos/commit/c0951032b34b832d0f5467e616999490a284101b) `sha256:954bfaf9d81bdc1c6451f35ee59c3d8aaa811bc15eae670cbeb7d23a43ef1016`
* [volume-data-source-validator](https://github.com/openshift/volume-data-source-validator) git [0e61642f](https://github.com/openshift/volume-data-source-validator/commit/0e61642f8d898ee199e42f37319864851dd3627f) `sha256:cf599b2d61f3473845c7d11c0ea49e33434ebb63452ae7923bdfb23ecc3dfebd`
* [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere) git [b93eb64f](https://github.com/openshift/cloud-provider-vsphere/commit/b93eb64ff72e7c005687813c8b478d694a0f517a) `sha256:33ae3b1e8162e8474c506fe0709c75098019305d014c6c6cf4c08bf54c4b8258`
* [vsphere-csi-driver](https://github.com/openshift/vmware-vsphere-csi-driver) git [61d0d00a](https://github.com/openshift/vmware-vsphere-csi-driver/commit/61d0d00a78ee60ee57fcc99648a8851f0db52e5a) `sha256:d5c7e923ef697dd90d20e1bfcec7a6a9a8d944b00d17ad6a425cbcb00bfd1b19`
* [vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver) git [61d0d00a](https://github.com/openshift/vmware-vsphere-csi-driver/commit/61d0d00a78ee60ee57fcc99648a8851f0db52e5a) `sha256:b80129251547ae24614f5f0905ec1b39a7d0cb5ad06b69d2990202bc2931eeb4`


### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/760626123a57a93bd13a84f31776be8c86e25d81)

* [OCPBUGS-81880](https://issues.redhat.com/browse/OCPBUGS-81880): Prefer multipath disk in ABI disk selection [#10111](https://github.com/openshift/assisted-service/pull/10111)
* [OCPBUGS-70300](https://issues.redhat.com/browse/OCPBUGS-70300): Prevent race in agent-installer kubeconfig generation [#8707](https://github.com/openshift/assisted-service/pull/8707)
* [OCPBUGS-65901](https://issues.redhat.com/browse/OCPBUGS-65901): Retry incomplete cluster registration in ABI [#8429](https://github.com/openshift/assisted-service/pull/8429)
* [Full changelog](https://github.com/openshift/assisted-service/compare/43bfecff9fdba24bfa8ce1ffdcb3a7d72b6e6286...760626123a57a93bd13a84f31776be8c86e25d81)


### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/a26df06f52f1426defcf42c6cebcec5b7a956df3)

* [OCPBUGS-81641](https://issues.redhat.com/browse/OCPBUGS-81641): fix: allow workers to join TNA cluster when 1 master + arbiter are ready [#2070](https://github.com/openshift/assisted-installer/pull/2070)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/3accbb7bd0dd865744e0ef0808b65be5914b157e...a26df06f52f1426defcf42c6cebcec5b7a956df3)


### [agent-installer-ui](https://github.com/openshift-assisted/assisted-installer-ui/tree/e2e118cdf55c418f54b6346d4920b76d664506f7)

* [OCPBUGS-84606](https://issues.redhat.com/browse/OCPBUGS-84606), [OCPBUGS-84829](https://issues.redhat.com/browse/OCPBUGS-84829), [OCPBUGS-84992](https://issues.redhat.com/browse/OCPBUGS-84992), [OCPBUGS-85008](https://issues.redhat.com/browse/OCPBUGS-85008), [OCPBUGS-85010](https://issues.redhat.com/browse/OCPBUGS-85010), [OCPBUGS-85038](https://issues.redhat.com/browse/OCPBUGS-85038): Bump axios to ^1.15.1 (#3691) [#3691](https://github.com/openshift-assisted/assisted-installer-ui/pull/3691)
* Update OWNERS file (#3657) [#3657](https://github.com/openshift-assisted/assisted-installer-ui/pull/3657)
* Bump happy-dom from 20.0.2 to 20.8.9 (#3526) [#3526](https://github.com/openshift-assisted/assisted-installer-ui/pull/3526)
* [OCPBUGS-77793](https://issues.redhat.com/browse/OCPBUGS-77793): bump react-router-dom-v5-compat to ^6.30.3 to address CVE-2026-22029 (#3582) [#3582](https://github.com/openshift-assisted/assisted-installer-ui/pull/3582)
* [OCPBUGS-77794](https://issues.redhat.com/browse/OCPBUGS-77794): upgrade lodash and lodash-es to 4.17.23 to address CVE-2025-13465 (#3546) [#3546](https://github.com/openshift-assisted/assisted-installer-ui/pull/3546)
* [OCPBUGS-83301](https://issues.redhat.com/browse/OCPBUGS-83301): bump axios to ^1.15.0 for fixing CVE-2026-40175 (#3584) [#3584](https://github.com/openshift-assisted/assisted-installer-ui/pull/3584)
* Updating assisted-installer-ui-container image to be consistent with ART for 4.20 (#3458) [#3458](https://github.com/openshift-assisted/assisted-installer-ui/pull/3458)
* Add support for release branches in PR workflow (#3529) [#3529](https://github.com/openshift-assisted/assisted-installer-ui/pull/3529)
* [Full changelog](https://github.com/openshift-assisted/assisted-installer-ui/compare/c0370c199bd9d314d14cdf668f4dddff6d475514...e2e118cdf55c418f54b6346d4920b76d664506f7)


### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/e3e997d9f7b84b134a07186de9bddde21598ae32)

* [OCPBUGS-77238](https://issues.redhat.com/browse/OCPBUGS-77238): Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 2f3015a [#224](https://github.com/openshift/agent-installer-utils/pull/224)
* [OCPBUGS-75868](https://issues.redhat.com/browse/OCPBUGS-75868): Increase Konflux build pipeline memory [#247](https://github.com/openshift/agent-installer-utils/pull/247)
* [OCPBUGS-68324](https://issues.redhat.com/browse/OCPBUGS-68324): bump github.com/sirupsen/logrus to v1.9.3 [#235](https://github.com/openshift/agent-installer-utils/pull/235)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/523e7d76637bd70cec447e7ce4655bf2bfee9272...e3e997d9f7b84b134a07186de9bddde21598ae32)


### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/0170e1e3c05714d016ff4f072a2ba1e17c9c26af)

* [OCPBUGS-80667](https://issues.redhat.com/browse/OCPBUGS-80667): Bump google.golang.org/grpc to v1.79.3 [#540](https://github.com/openshift/csi-operator/pull/540)
* [OCPBUGS-74918](https://issues.redhat.com/browse/OCPBUGS-74918): adds the csi-external-resizer to the image-references [#529](https://github.com/openshift/csi-operator/pull/529)
* [OCPBUGS-72563](https://issues.redhat.com/browse/OCPBUGS-72563): deploy prometheus role and binding on hypershift guest [#491](https://github.com/openshift/csi-operator/pull/491)
* [Full changelog](https://github.com/openshift/csi-operator/compare/878ef6cbe06fabf3cb82ad0ca1c1226e03dfef91...0170e1e3c05714d016ff4f072a2ba1e17c9c26af)


### [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider/tree/a8968d22240748f40c41bdd6c47debbfa16dcd74)

* [OCPBUGS-78426](https://issues.redhat.com/browse/OCPBUGS-78426): Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.20 [#34](https://github.com/openshift/aws-encryption-provider/pull/34)
* [Full changelog](https://github.com/openshift/aws-encryption-provider/compare/088dcaf73f980b977ef4f5d2f99e2a93deb87eef...a8968d22240748f40c41bdd6c47debbfa16dcd74)


### [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws/tree/999f4f76124e66c7b42af678cb19aff4b29f72d4)

* [OCPBUGS-72570](https://issues.redhat.com/browse/OCPBUGS-72570): Fix reconciler consistency checks in Update and Exists [#164](https://github.com/openshift/machine-api-provider-aws/pull/164)
* [Full changelog](https://github.com/openshift/machine-api-provider-aws/compare/f5c125807016b8e0187654e53762532d8c2fe923...999f4f76124e66c7b42af678cb19aff4b29f72d4)


### [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook/tree/8e83772ab8d31b32225744d4f0b0023680692daf)

* [OCPBUGS-74169](https://issues.redhat.com/browse/OCPBUGS-74169): Fix GOTOOLCHAIN env var [#212](https://github.com/openshift/aws-pod-identity-webhook/pull/212)
* [Full changelog](https://github.com/openshift/aws-pod-identity-webhook/compare/a2ecb1502280feb8e82c9cf6f3f77d62797e4445...8e83772ab8d31b32225744d4f0b0023680692daf)


### [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure/tree/c29c68dd2a576f19771dfd0c349b34f890063cdc)

* [OCPBUGS-80568](https://issues.redhat.com/browse/OCPBUGS-80568): Bump google.golang.org/grpc to v1.79.3 [#384](https://github.com/openshift/cluster-api-provider-azure/pull/384)
* [Full changelog](https://github.com/openshift/cluster-api-provider-azure/compare/cb8b5b6a485971a95c5a74508d76ab19b23cbf29...c29c68dd2a576f19771dfd0c349b34f890063cdc)


### [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver/tree/01cd2866d6ca829b553dd9e7388c9c1e4ef59c68)

* [OCPBUGS-85054](https://issues.redhat.com/browse/OCPBUGS-85054): Fix dangling detaches 420 [#145](https://github.com/openshift/azure-disk-csi-driver/pull/145)
* [OCPBUGS-78034](https://issues.redhat.com/browse/OCPBUGS-78034): add instantAccessDurationMinutes parameter to enable IA snapshots for PremiumV2/UltraSSD disks [#128](https://github.com/openshift/azure-disk-csi-driver/pull/128)
* [Full changelog](https://github.com/openshift/azure-disk-csi-driver/compare/0b8e4d2202b0d17942fd745a5e1948f46bdd0350...01cd2866d6ca829b553dd9e7388c9c1e4ef59c68)


### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/b381b8484ed76f9fba0ac993bc03d216e11c254c)

* [OCPBUGS-78423](https://issues.redhat.com/browse/OCPBUGS-78423): Updating azure-kms-encryption-provider-container image to be consistent with ART for 4.20 [#28](https://github.com/openshift/azure-kubernetes-kms/pull/28)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/ea0b9944dddcc7043065a1fab5fca72dd17450da...b381b8484ed76f9fba0ac993bc03d216e11c254c)


### [azure-service-operator](https://github.com/openshift/azure-service-operator/tree/d957de42c2e6255b79fcfe7aedac78eb746d92cc)

* [OCPBUGS-80539](https://issues.redhat.com/browse/OCPBUGS-80539): Bump google.golang.org/grpc to v1.79.3 [#29](https://github.com/openshift/azure-service-operator/pull/29)
* [Full changelog](https://github.com/openshift/azure-service-operator/compare/6e2f362623720f7b6d634fbc424fbc61e4b481ae...d957de42c2e6255b79fcfe7aedac78eb746d92cc)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/13a5f6b91e1636b63bb0956c6fa49fab236e71c1)

* [OCPBUGS-79001](https://issues.redhat.com/browse/OCPBUGS-79001): [release 4.20] - Allow all instance types in the install config for GCP [#10503](https://github.com/openshift/installer/pull/10503)
* [OCPBUGS-78694](https://issues.redhat.com/browse/OCPBUGS-78694): [release-4.20]: openstack: Disable LoadBalancer in cloud config when Octavia is unavailable [#10401](https://github.com/openshift/installer/pull/10401)
* [OCPBUGS-79665](https://issues.redhat.com/browse/OCPBUGS-79665): Use correct Project ID with GCP Shared VPC [#10436](https://github.com/openshift/installer/pull/10436)
* [OCPBUGS-80884](https://issues.redhat.com/browse/OCPBUGS-80884): [release-4.20] Add c8g* to tested_instance_types_aarch64 [#10437](https://github.com/openshift/installer/pull/10437)
* [OCPBUGS-77896](https://issues.redhat.com/browse/OCPBUGS-77896): Increase size of /var/ostreecontainer mount [#10365](https://github.com/openshift/installer/pull/10365)
* [OCPBUGS-78091](https://issues.redhat.com/browse/OCPBUGS-78091): fix wavelength zone name regex [#10373](https://github.com/openshift/installer/pull/10373)
* [OCPBUGS-77050](https://issues.redhat.com/browse/OCPBUGS-77050): Update the RHCOS 4.20 bootimage metadata to 9.6.20260217-1 [#10358](https://github.com/openshift/installer/pull/10358)
* [OCPBUGS-74674](https://issues.redhat.com/browse/OCPBUGS-74674): [release-4.20] GCP: skip AI zones [#10273](https://github.com/openshift/installer/pull/10273)
* [OCPBUGS-74551](https://issues.redhat.com/browse/OCPBUGS-74551): add support for NVIDIA H100 and H200 enabled machine series [#10263](https://github.com/openshift/installer/pull/10263)
* [OCPBUGS-66356](https://issues.redhat.com/browse/OCPBUGS-66356): Update the RHCOS 4.20 bootimage metadata to 9.6.20260112-0 [#10247](https://github.com/openshift/installer/pull/10247)
* [OCPBUGS-73681](https://issues.redhat.com/browse/OCPBUGS-73681): pkg/asset/manifests/azure: save cidr blocks [#10208](https://github.com/openshift/installer/pull/10208)
* [OCPBUGS-73785](https://issues.redhat.com/browse/OCPBUGS-73785): ensure deterministic zone ordering for control plane machines [#10219](https://github.com/openshift/installer/pull/10219)
* [Full changelog](https://github.com/openshift/installer/compare/db608c3e6a8817e3304bf16c2f4d9661d9bb35cb...13a5f6b91e1636b63bb0956c6fa49fab236e71c1)


### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/4e38a27e94679f43d6534c67c98a9353dac137c6)

* [OCPBUGS-78745](https://issues.redhat.com/browse/OCPBUGS-78745): OCPBUGS-78836: PR2774 and PR2793 backports [release-4.20] [#470](https://github.com/openshift/baremetal-operator/pull/470)
* Bug OCPBUGS-76546: BMO fails to start servicing despite updates to HFC spec [#460](https://github.com/openshift/baremetal-operator/pull/460)
* [OCPBUGS-74987](https://issues.redhat.com/browse/OCPBUGS-74987): Abort inspection/cleaning before powering off during deletion [#453](https://github.com/openshift/baremetal-operator/pull/453)
* [OCPBUGS-74084](https://issues.redhat.com/browse/OCPBUGS-74084): Require PreprovisioningImage for deprovisioning when cleaning is enabled [#446](https://github.com/openshift/baremetal-operator/pull/446)
* [OCPBUGS-63538](https://issues.redhat.com/browse/OCPBUGS-63538): Create a PreprovisioningImage for servicing if needed [#435](https://github.com/openshift/baremetal-operator/pull/435)
* [Full changelog](https://github.com/openshift/baremetal-operator/compare/8000d7e910a6c08481beca722074d12419e25edf...4e38a27e94679f43d6534c67c98a9353dac137c6)


### [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg/tree/5e602ba702420d0f30cee175f51fff83e00c1b5b)

* [OCPBUGS-72567](https://issues.redhat.com/browse/OCPBUGS-72567): Fix TNA and TNF dummy ip for ipv6 [#379](https://github.com/openshift/baremetal-runtimecfg/pull/379)
* [OCPBUGS-77170](https://issues.redhat.com/browse/OCPBUGS-77170): Install dbus-tools, needed in pkg/monitor/dnsmasqmonitor.go [#384](https://github.com/openshift/baremetal-runtimecfg/pull/384)
* [Full changelog](https://github.com/openshift/baremetal-runtimecfg/compare/6553765e71c7f8d7db120af94473c9c0cb44d453...5e602ba702420d0f30cee175f51fff83e00c1b5b)


### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/92a3a166a7f710a344a11bda0ad221e54583fccd)

* [OCPBUGS-77170](https://issues.redhat.com/browse/OCPBUGS-77170): Install subscription-manager in required images [#2209](https://github.com/openshift/oc/pull/2209)
* [OCPBUGS-77495](https://issues.redhat.com/browse/OCPBUGS-77495): Makefile: Strip debugging symbols by default [#2212](https://github.com/openshift/oc/pull/2212)
* [OCPBUGS-77145](https://issues.redhat.com/browse/OCPBUGS-77145): oc adm policy: Only initialize UserClient if built-in OAuth is enabled [#2207](https://github.com/openshift/oc/pull/2207)
* [OCPBUGS-74969](https://issues.redhat.com/browse/OCPBUGS-74969): Fix unit test failure by updating ruby version to 3.3 [#2194](https://github.com/openshift/oc/pull/2194)
* [OCPBUGS-74965](https://issues.redhat.com/browse/OCPBUGS-74965): Clear defaultNodeSelector to run on any node [#2193](https://github.com/openshift/oc/pull/2193)
* [Full changelog](https://github.com/openshift/oc/compare/dc61926008ad5333863dd1ae2902b95aed6dceaa...92a3a166a7f710a344a11bda0ad221e54583fccd)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/92d1035606683d4cc715205606a535e7211f4960)

* [OCPBUGS-79368](https://issues.redhat.com/browse/OCPBUGS-79368): google.golang.org/grpc v1.79.3 [#994](https://github.com/openshift/cloud-credential-operator/pull/994)
* [OCPBUGS-78200](https://issues.redhat.com/browse/OCPBUGS-78200): Fix infrastructure resource name filtering in watch predicate [#989](https://github.com/openshift/cloud-credential-operator/pull/989)
* [OCPBUGS-74546](https://issues.redhat.com/browse/OCPBUGS-74546): Resolve nil pointer exception in hasResourceTags [#970](https://github.com/openshift/cloud-credential-operator/pull/970)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/0e03b7a0fa39e7da3a4b5a180915adc44c408d08...92d1035606683d4cc715205606a535e7211f4960)


### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/569ae680cbdf0f78cc0d77278c5178160679fe83)

* [OCPBUGS-81502](https://issues.redhat.com/browse/OCPBUGS-81502): Do not return error when an IdP returns 500 during a grant check [#866](https://github.com/openshift/cluster-authentication-operator/pull/866)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/fb1a9ab21d72903f79a45f916c6443c0709b9b0c...569ae680cbdf0f78cc0d77278c5178160679fe83)


### [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler/tree/6b1d2ef88e19d32143d389de6999c765c7e30cad)

* [OCPBUGS-78690](https://issues.redhat.com/browse/OCPBUGS-78690): allow clusterapi provider to skip paused resources [#411](https://github.com/openshift/kubernetes-autoscaler/pull/411)
* [OCPBUGS-77506](https://issues.redhat.com/browse/OCPBUGS-77506): Pick upstream commits to Fix VPA recommender concurrent access panic [#407](https://github.com/openshift/kubernetes-autoscaler/pull/407)
* [Full changelog](https://github.com/openshift/kubernetes-autoscaler/compare/aaf5a61941b70a3b5792c0541e97356565c9977f...6b1d2ef88e19d32143d389de6999c765c7e30cad)


### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/accfc407194c6ace691f2b38a719a01705519dc9)

* [OCPBUGS-84376](https://issues.redhat.com/browse/OCPBUGS-84376): Fix ironic-proxy service routing for port 6385 [#593](https://github.com/openshift/cluster-baremetal-operator/pull/593)
* [OCPBUGS-81643](https://issues.redhat.com/browse/OCPBUGS-81643): Allow ProvisioningCIDR for unmanaged network [#585](https://github.com/openshift/cluster-baremetal-operator/pull/585)
* [OCPBUGS-76340](https://issues.redhat.com/browse/OCPBUGS-76340): Explicitly set the ReadOnlyRootFilesystem flag to false [#555](https://github.com/openshift/cluster-baremetal-operator/pull/555)
* [OCPBUGS-77488](https://issues.redhat.com/browse/OCPBUGS-77488): Fix NO_PROXY matching for URLs with trailing dots [#567](https://github.com/openshift/cluster-baremetal-operator/pull/567)
* [OCPBUGS-77074](https://issues.redhat.com/browse/OCPBUGS-77074): Update kubebuilder tools to more latest version [#559](https://github.com/openshift/cluster-baremetal-operator/pull/559)
* [OCPBUGS-75933](https://issues.redhat.com/browse/OCPBUGS-75933): Explicitly set ReadOnlyRootFilesystem to false for machine-os-images so that SCC don't end up enforcing it to true [#552](https://github.com/openshift/cluster-baremetal-operator/pull/552)
* [OCPBUGS-73916](https://issues.redhat.com/browse/OCPBUGS-73916): Fix DNS resolution for metal3 service endpoints by adding trailing dots [#548](https://github.com/openshift/cluster-baremetal-operator/pull/548)
* [OCPBUGS-71203](https://issues.redhat.com/browse/OCPBUGS-71203): Mount /etc/pki/ca-trust to machine-os-images & Enable runtime extraction of aarch64 images [#543](https://github.com/openshift/cluster-baremetal-operator/pull/543)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/2c9f77f2a7fe3c7233a50b2ba0acb3155f9d34bb...accfc407194c6ace691f2b38a719a01705519dc9)


### [cluster-capi-controllers](https://github.com/openshift/cluster-api/tree/dfeecf9616e049ac552f91a71b2a50cb0e96042c)

* [OCPBUGS-80577](https://issues.redhat.com/browse/OCPBUGS-80577): Bump google.golang.org/grpc to v1.79.3 [#289](https://github.com/openshift/cluster-api/pull/289)
* [OCPBUGS-78375](https://issues.redhat.com/browse/OCPBUGS-78375): Updating ose-cluster-api-container image to be consistent with ART for 4.20 [#268](https://github.com/openshift/cluster-api/pull/268)
* [Full changelog](https://github.com/openshift/cluster-api/compare/de1db2970e7fede7101e5a8188e74942ab6665e3...dfeecf9616e049ac552f91a71b2a50cb0e96042c)


### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/de6547a997728774b05576178e7cade55d07f827)

* [OCPBUGS-80581](https://issues.redhat.com/browse/OCPBUGS-80581): Bump google.golang.org/grpc to v1.79.3 [#545](https://github.com/openshift/cluster-capi-operator/pull/545)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/acf331446369b5307b6b435af14daabdca9fafbc...de6547a997728774b05576178e7cade55d07f827)


### [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator/tree/a99bd8ffb9aa596fa8d6932d5d93e0613c5d367f)

* [OCPBUGS-83507](https://issues.redhat.com/browse/OCPBUGS-83507): Fix PDB unhealthyPodEvictionPolicy field name [#273](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/273)
* [Full changelog](https://github.com/openshift/cluster-csi-snapshot-controller-operator/compare/019abe0c7671962829eb91269e1d76916966320e...a99bd8ffb9aa596fa8d6932d5d93e0613c5d367f)


### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/9fb46bc7d765da7557e3f46c3b2dc81a387f8f7c)

* [OCPBUGS-77313](https://issues.redhat.com/browse/OCPBUGS-77313): Wait for revision stability before removing etcd members [#1571](https://github.com/openshift/cluster-etcd-operator/pull/1571)
* [OCPBUGS-78047](https://issues.redhat.com/browse/OCPBUGS-78047): Prefer to remove members where they have another healthy machine in the same failure domain index [#1564](https://github.com/openshift/cluster-etcd-operator/pull/1564)
* [OCPBUGS-74624](https://issues.redhat.com/browse/OCPBUGS-74624): Add priority field to prevent early shutdown [#1508](https://github.com/openshift/cluster-etcd-operator/pull/1508)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/c706661bce28d9f2beb0c1c0037f1481160db396...9fb46bc7d765da7557e3f46c3b2dc81a387f8f7c)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/d14c13be1685e74b898b93a3fa7e03e9b75aa174)

* [OCPBUGS-85130](https://issues.redhat.com/browse/OCPBUGS-85130): Add PrometheusRule for Gateway API gathering [#1436](https://github.com/openshift/cluster-ingress-operator/pull/1436)
* [OCPBUGS-84132](https://issues.redhat.com/browse/OCPBUGS-84132): set trustBundleName in Istio global values [#1420](https://github.com/openshift/cluster-ingress-operator/pull/1420)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/24ef5ae121b8f658b649bb555be827f114ead438...d14c13be1685e74b898b93a3fa7e03e9b75aa174)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/43b3cbe3654586ebbff06b942658c6f14aa01796)

* [OCPBUGS-83856](https://issues.redhat.com/browse/OCPBUGS-83856): Allow setting the oauthMetadata when auth type is None [#2117](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2117)
* [OCPBUGS-79419](https://issues.redhat.com/browse/OCPBUGS-79419): : Always set service-account-jwks-uri to LB URL even with custom issuer [#2078](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2078)
* [OCPBUGS-77005](https://issues.redhat.com/browse/OCPBUGS-77005): scc: restricted-v3: Fix runAsUser range [#1948](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1948)
* [OCPBUGS-74229](https://issues.redhat.com/browse/OCPBUGS-74229): SCC: allow image volume type for all SCCs [#2006](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2006)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/974542ae2ef86a631546b3a48fd0da3c2e3b74dd...43b3cbe3654586ebbff06b942658c6f14aa01796)


### [cluster-kube-cluster-api-operator](https://github.com/openshift/cluster-api-operator/tree/adaae0d4e6d7a0e466e7e86af399de0b828c8b81)

* [OCPBUGS-80588](https://issues.redhat.com/browse/OCPBUGS-80588): Bump google.golang.org/grpc to v1.79.3 [#75](https://github.com/openshift/cluster-api-operator/pull/75)
* [Full changelog](https://github.com/openshift/cluster-api-operator/compare/234e218207ec963df04ec1fedad85a421eb7a1ff...adaae0d4e6d7a0e466e7e86af399de0b828c8b81)


### [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator/tree/84eb8c5a73a730d6d08794e51da9c20013ca4304)

* [OCPBUGS-83738](https://issues.redhat.com/browse/OCPBUGS-83738): add /var/run/kubernetes as emptyDir [#642](https://github.com/openshift/cluster-kube-scheduler-operator/pull/642)
* [CNTRLPLANE-2843](https://issues.redhat.com/browse/CNTRLPLANE-2843): chore: update OWNERS [#620](https://github.com/openshift/cluster-kube-scheduler-operator/pull/620)
* [OCPBUGS-74337](https://issues.redhat.com/browse/OCPBUGS-74337): Add OPERATOR_IMAGE_VERSION to recovery container [#604](https://github.com/openshift/cluster-kube-scheduler-operator/pull/604)
* [OCPBUGS-74624](https://issues.redhat.com/browse/OCPBUGS-74624): Add priority field to prevent early shutdown [#586](https://github.com/openshift/cluster-kube-scheduler-operator/pull/586)
* [Full changelog](https://github.com/openshift/cluster-kube-scheduler-operator/compare/58cbd296eecc61c0871739588ae65af9c05e87a6...84eb8c5a73a730d6d08794e51da9c20013ca4304)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/e4800998100765391609d5473a2d8471dc11d920)

* [OCPBUGS-85130](https://issues.redhat.com/browse/OCPBUGS-85130): Enable Gateway API telemetry metrics [#2920](https://github.com/openshift/cluster-monitoring-operator/pull/2920)
* [OCPBUGS-74490](https://issues.redhat.com/browse/OCPBUGS-74490): Include `kube_pod_labels` in minimal profile [#2844](https://github.com/openshift/cluster-monitoring-operator/pull/2844)
* [OCPBUGS-77272](https://issues.redhat.com/browse/OCPBUGS-77272): AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change [#2835](https://github.com/openshift/cluster-monitoring-operator/pull/2835)
* [OCPBUGS-74623](https://issues.redhat.com/browse/OCPBUGS-74623): update expr for AlertmanagerClusterFailedToSendAlerts to exclude value 0 [#2805](https://github.com/openshift/cluster-monitoring-operator/pull/2805)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/47ab4cb2b5bb27718150b82bb3e0a03755200ca3...e4800998100765391609d5473a2d8471dc11d920)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/18558dbf31624b136a7d35b30ef99e551d2738ae)

* [OCPBUGS-83821](https://issues.redhat.com/browse/OCPBUGS-83821): wait for patch port to apply drop garp flows [#2966](https://github.com/openshift/cluster-network-operator/pull/2966)
* [OCPBUGS-77148](https://issues.redhat.com/browse/OCPBUGS-77148): Add config override for openflow-probe [#2918](https://github.com/openshift/cluster-network-operator/pull/2918)
* [OCPBUGS-76349](https://issues.redhat.com/browse/OCPBUGS-76349): Remove duplicated openssl parameter [#2901](https://github.com/openshift/cluster-network-operator/pull/2901)
* [CORENET-6311](https://issues.redhat.com/browse/CORENET-6311), [OCPBUGS-74139](https://issues.redhat.com/browse/OCPBUGS-74139): Skip running _stackmanager for libreswan 5.3+ [#2872](https://github.com/openshift/cluster-network-operator/pull/2872)
* [OCPBUGS-73365](https://issues.redhat.com/browse/OCPBUGS-73365): fix(hypershift): use net.JoinHostPort for URL construction [#2876](https://github.com/openshift/cluster-network-operator/pull/2876)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/dbd9826dbe5373bd3605dfef606d118ffc65b830...18558dbf31624b136a7d35b30ef99e551d2738ae)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/b1a1c39e5bfe62ae62806720874e7da09a30ed7f)

* [OCPBUGS-66364](https://issues.redhat.com/browse/OCPBUGS-66364): Add support for lscpu_check TuneD built-in [#1443](https://github.com/openshift/cluster-node-tuning-operator/pull/1443)
* [OCPBUGS-85372](https://issues.redhat.com/browse/OCPBUGS-85372): e2e: Add irqbalance StartLimitBurst >= 100 [#1513](https://github.com/openshift/cluster-node-tuning-operator/pull/1513)
* [OCPBUGS-78247](https://issues.redhat.com/browse/OCPBUGS-78247): workloadhints: use IsVM to skip BM-only tests [#1482](https://github.com/openshift/cluster-node-tuning-operator/pull/1482)
* [OCPBUGS-70349](https://issues.redhat.com/browse/OCPBUGS-70349): Remove CgroupModeV1 reference from the code [#1437](https://github.com/openshift/cluster-node-tuning-operator/pull/1437)
* [OCPBUGS-62721](https://issues.redhat.com/browse/OCPBUGS-62721): E2E: skip SMT disabled test when L3 cache spans entire NUMA node [#1404](https://github.com/openshift/cluster-node-tuning-operator/pull/1404)
* [OCPBUGS-63751](https://issues.redhat.com/browse/OCPBUGS-63751): PPC: ghw: filter out namespaces dir [#1421](https://github.com/openshift/cluster-node-tuning-operator/pull/1421)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/ae91d95f908377c7852d44249364d59b6f3bd14d...b1a1c39e5bfe62ae62806720874e7da09a30ed7f)


### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/cf9401ae971f7ce7a7e8bcbafaff82968c6579c2)

* [OCPBUGS-79532](https://issues.redhat.com/browse/OCPBUGS-79532): volume-data-source-validator should run on master nodes [#688](https://github.com/openshift/cluster-storage-operator/pull/688)
* [OCPBUGS-75912](https://issues.redhat.com/browse/OCPBUGS-75912): add vsphere permissions for checking if users is authorized to see metrics [#663](https://github.com/openshift/cluster-storage-operator/pull/663)
* [OCPBUGS-70343](https://issues.redhat.com/browse/OCPBUGS-70343): volume-data-source-validator must use IfNotPresent image pull policy [#653](https://github.com/openshift/cluster-storage-operator/pull/653)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/d6b7775e872264a8e53f4bfe3ba884a3888367b7...cf9401ae971f7ce7a7e8bcbafaff82968c6579c2)


### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/ea3fa7695054fc9260936902b33b738bb4c405bc)

* [OCPBUGS-79463](https://issues.redhat.com/browse/OCPBUGS-79463): Implement mTLS authentication and authorization for CVO metrics endpoint [#1374](https://github.com/openshift/cluster-version-operator/pull/1374)
* [OCPBUGS-74177](https://issues.redhat.com/browse/OCPBUGS-74177): lib/resourcemerge/core: Reconcile ConfigMap binaryData too [#1303](https://github.com/openshift/cluster-version-operator/pull/1303)
* [OCPBUGS-64828](https://issues.redhat.com/browse/OCPBUGS-64828): lib/resourcemerge: Add support for hostUsers flag [#1259](https://github.com/openshift/cluster-version-operator/pull/1259)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/73583cd49830e22349b5d8bf25dc2e95f3882692...ea3fa7695054fc9260936902b33b738bb4c405bc)


### [console](https://github.com/openshift/console/tree/65dba12e4f29fdfd850e0ce1066c947d86f28364)

* NO-JIRA: enable multi-architecture yarn builds [#16418](https://github.com/openshift/console/pull/16418)
* [OCPBUGS-83819](https://issues.redhat.com/browse/OCPBUGS-83819): Fix false positive scheduler degradation caused by user workloads [#16308](https://github.com/openshift/console/pull/16308)
* [OCPBUGS-85042](https://issues.redhat.com/browse/OCPBUGS-85042): Remove PII from events [#16402](https://github.com/openshift/console/pull/16402)
* [OCPBUGS-81575](https://issues.redhat.com/browse/OCPBUGS-81575): Add robots.txt policy to console [#16243](https://github.com/openshift/console/pull/16243)
* [OCPBUGS-78439](https://issues.redhat.com/browse/OCPBUGS-78439): Backport OCPBUGS-61536: vsphere settings [#16141](https://github.com/openshift/console/pull/16141)
* [OCPBUGS-83495](https://issues.redhat.com/browse/OCPBUGS-83495): remove dev to admin links as dev monitoring views are enabled [#16173](https://github.com/openshift/console/pull/16173)
* [OCPBUGS-82012](https://issues.redhat.com/browse/OCPBUGS-82012): Fix VolumeSnapshot and VolumeSnapshotContent tables sorting [#16261](https://github.com/openshift/console/pull/16261)
* [OCPBUGS-77037](https://issues.redhat.com/browse/OCPBUGS-77037): Fix QueryBrowser import to use SDK path to avoid circular dependency [#16222](https://github.com/openshift/console/pull/16222)
* [OCPBUGS-83573](https://issues.redhat.com/browse/OCPBUGS-83573): Performance improvements + AsyncComponent refactor [#16300](https://github.com/openshift/console/pull/16300)
* [OCPBUGS-83420](https://issues.redhat.com/browse/OCPBUGS-83420): Fix resource log dropdown TypeError [#16282](https://github.com/openshift/console/pull/16282)
* [OCPBUGS-81678](https://issues.redhat.com/browse/OCPBUGS-81678): Fix useOperatorCatalogCategories hook. [#16251](https://github.com/openshift/console/pull/16251)
* [OCPBUGS-81322](https://issues.redhat.com/browse/OCPBUGS-81322): Migrate InstallPlan components table to PatternFly Table [#16217](https://github.com/openshift/console/pull/16217)
* [OCPBUGS-81439](https://issues.redhat.com/browse/OCPBUGS-81439): Fix TypeError in OLS code import to console [#16221](https://github.com/openshift/console/pull/16221)
* [OCPBUGS-81495](https://issues.redhat.com/browse/OCPBUGS-81495), [OCPBUGS-81496](https://issues.redhat.com/browse/OCPBUGS-81496): OLM prompts for GCP Workload Identity parameters during Kiali Operato… [#16231](https://github.com/openshift/console/pull/16231)
* [OCPBUGS-78295](https://issues.redhat.com/browse/OCPBUGS-78295): Fix editing secrets with mixed text and binary data [#16132](https://github.com/openshift/console/pull/16132)
* [OCPBUGS-78366](https://issues.redhat.com/browse/OCPBUGS-78366): Clean up old session cookies to prevent accumulation [#16136](https://github.com/openshift/console/pull/16136)
* [OCPBUGS-78839](https://issues.redhat.com/browse/OCPBUGS-78839), [OCPBUGS-79465](https://issues.redhat.com/browse/OCPBUGS-79465), [OCPBUGS-79466](https://issues.redhat.com/browse/OCPBUGS-79466): apiVersion is empty on YAML creation page - Runtime error occurs when create MachineConfig with default yaml from… [#16192](https://github.com/openshift/console/pull/16192)
* [OCPBUGS-76951](https://issues.redhat.com/browse/OCPBUGS-76951): “Import from Git” should not force HTTPS/443 for Git providers (GitHub/GitLab/Bitbucket) [#16029](https://github.com/openshift/console/pull/16029)
* [OCPBUGS-77951](https://issues.redhat.com/browse/OCPBUGS-77951): Fix infinite recursion in project access form [#16117](https://github.com/openshift/console/pull/16117)
* [CONSOLE-5011](https://issues.redhat.com/browse/CONSOLE-5011): migrate to yarn berry [#16070](https://github.com/openshift/console/pull/16070)
* [OCPBUGS-76543](https://issues.redhat.com/browse/OCPBUGS-76543): Use Actions button instead of kebab menu on Subscription details page [#16018](https://github.com/openshift/console/pull/16018)
* [OCPBUGS-75880](https://issues.redhat.com/browse/OCPBUGS-75880): Fix referenceFor parameter in SubscriptionDetailsPage [#15987](https://github.com/openshift/console/pull/15987)
* [OCPBUGS-74696](https://issues.redhat.com/browse/OCPBUGS-74696): Bump lodash to latest [#15963](https://github.com/openshift/console/pull/15963)
* [OCPBUGS-74158](https://issues.redhat.com/browse/OCPBUGS-74158): Do not resolve disabled catalog type extensions [#15931](https://github.com/openshift/console/pull/15931)
* [OCPBUGS-72417](https://issues.redhat.com/browse/OCPBUGS-72417): make cloudCredentials optional so operators load when … [#15901](https://github.com/openshift/console/pull/15901)
* [OCPBUGS-67225](https://issues.redhat.com/browse/OCPBUGS-67225): Remove unwanted semicolon from Serverless Channel and Broker list [#15834](https://github.com/openshift/console/pull/15834)
* [OCPBUGS-69917](https://issues.redhat.com/browse/OCPBUGS-69917): There should be no role ARN field as token-auth-aws/azure/gcp=false in csv annotations [#15869](https://github.com/openshift/console/pull/15869)
* [OCPBUGS-73775](https://issues.redhat.com/browse/OCPBUGS-73775): make cloudCredentials optional so operators load when … [#15918](https://github.com/openshift/console/pull/15918)
* [Full changelog](https://github.com/openshift/console/compare/e46a42a6b67699f738fb8854fad3f64d3dbd39a3...65dba12e4f29fdfd850e0ce1066c947d86f28364)


### [console-operator](https://github.com/openshift/console-operator/tree/1bb7f6f4e7851997fd24c5f5aa5be41ea8dd5bd2)

* [OCPBUGS-77771](https://issues.redhat.com/browse/OCPBUGS-77771): Add rhel8 and rhel9 oc binaries for Linux OS in CLI downloads [#1122](https://github.com/openshift/console-operator/pull/1122)
* [OCPBUGS-76267](https://issues.redhat.com/browse/OCPBUGS-76267): Fix PDB blocking node drains during cluster upgrades + update donwloads deployment [#1105](https://github.com/openshift/console-operator/pull/1105)
* [Full changelog](https://github.com/openshift/console-operator/compare/ac81d030ea60351838be670de5ddca92a0320d45...1bb7f6f4e7851997fd24c5f5aa5be41ea8dd5bd2)


### [csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/9996d28ce3163cf9a09d77101e81cede914d6c2f)

* [OCPBUGS-74890](https://issues.redhat.com/browse/OCPBUGS-74890): Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.33 into release-4.20 [#368](https://github.com/openshift/cloud-provider-openstack/pull/368)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/eeae3b042d3de06808d00c7f4e72c014e25ffb1c...9996d28ce3163cf9a09d77101e81cede914d6c2f)


### [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs/tree/20609066e1bd1dbbd107bfca27af67e0a788760e)

* [OCPBUGS-80610](https://issues.redhat.com/browse/OCPBUGS-80610): CVE-2026-33186: bump google.golang.org/grpc v1.79.3 [#177](https://github.com/openshift/csi-driver-nfs/pull/177)
* [Full changelog](https://github.com/openshift/csi-driver-nfs/compare/1abaf84447384a486a9f9da7cd7b9e53784c8a55...20609066e1bd1dbbd107bfca27af67e0a788760e)


### [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner/tree/72fefbe70de332cea29428be202244676a9927fc)

* [OCPBUGS-80612](https://issues.redhat.com/browse/OCPBUGS-80612): Bump google.golang.org/grpc to v1.79.3 [#128](https://github.com/openshift/csi-external-provisioner/pull/128)
* [Full changelog](https://github.com/openshift/csi-external-provisioner/compare/81fca03694bca1bae8606d8970472330e1e4fcad...72fefbe70de332cea29428be202244676a9927fc)


### [docker-builder](https://github.com/openshift/builder/tree/35afa308e2473046721057112d804334fc4b8217)

* [OCPBUGS-66991](https://issues.redhat.com/browse/OCPBUGS-66991): bump buildah to 1.39.7 to fix CVE-2025-52881 [#496](https://github.com/openshift/builder/pull/496)
* [Full changelog](https://github.com/openshift/builder/compare/8c0a564f464540d0e2ffc0ce4c98d90a730bc2d2...35afa308e2473046721057112d804334fc4b8217)


### [docker-registry](https://github.com/openshift/image-registry/tree/0e96a08424d601be55341bc3f4412fde977602c8)

* [OCPBUGS-68327](https://issues.redhat.com/browse/OCPBUGS-68327): update logrus to v1.9.1 [#462](https://github.com/openshift/image-registry/pull/462)
* [Full changelog](https://github.com/openshift/image-registry/compare/0c09647aa2db93a8584dfe8079ed919145c662fb...0e96a08424d601be55341bc3f4412fde977602c8)


### [driver-toolkit](https://github.com/openshift/driver-toolkit/tree/62e1f6040cd297149f5f14e0d20814759ec61354)

* [OCPBUGS-78783](https://issues.redhat.com/browse/OCPBUGS-78783): Support ubi minimal base image [#187](https://github.com/openshift/driver-toolkit/pull/187)
* [Full changelog](https://github.com/openshift/driver-toolkit/compare/9d55fd1aaba05830f857132bd149ee3cf18cc20f...62e1f6040cd297149f5f14e0d20814759ec61354)


### [etcd](https://github.com/openshift/etcd/tree/05bca97760b1cfa1bcef11c0b1f1a5c4dab19709)

* [OCPBUGS-70151](https://issues.redhat.com/browse/OCPBUGS-70151): 4.20 rebase 3.5.26 [#358](https://github.com/openshift/etcd/pull/358)
* [Full changelog](https://github.com/openshift/etcd/compare/eac09c01677bb03daed156d407be27785fd61e0d...05bca97760b1cfa1bcef11c0b1f1a5c4dab19709)


### [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp/tree/d5a5541436d9269006928079fcdc507d0b6d4033)

* [OCPBUGS-83720](https://issues.redhat.com/browse/OCPBUGS-83720): Fix OSD ILB bug [#109](https://github.com/openshift/cloud-provider-gcp/pull/109)
* [OCPBUGS-77152](https://issues.redhat.com/browse/OCPBUGS-77152): Fix ose gcp cloud controller manager hermetic [#97](https://github.com/openshift/cloud-provider-gcp/pull/97)
* [Full changelog](https://github.com/openshift/cloud-provider-gcp/compare/f940e72e7611ce4a96da3e47966ba1befd25c474...d5a5541436d9269006928079fcdc507d0b6d4033)


### [haproxy-router](https://github.com/openshift/router/tree/3c365cad8c7037e4aa64a694994ea393abc4d9a2)

* [OCPBUGS-78435](https://issues.redhat.com/browse/OCPBUGS-78435): Updating openshift-enterprise-haproxy-router-container image to be consistent with ART for 4.20 [#750](https://github.com/openshift/router/pull/750)
* [OCPBUGS-78432](https://issues.redhat.com/browse/OCPBUGS-78432): Updating ose-haproxy-router-base-container image to be consistent with ART for 4.20 [#749](https://github.com/openshift/router/pull/749)
* [OCPBUGS-79529](https://issues.redhat.com/browse/OCPBUGS-79529): Lower verbosity for parseIPList empty list logging [#753](https://github.com/openshift/router/pull/753)
* [Full changelog](https://github.com/openshift/router/compare/db8d384266051ef06b67883aaa83674bc6c9f1ae...3c365cad8c7037e4aa64a694994ea393abc4d9a2)


### [hyperkube, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/ba5f1e63e12c85b7d61d5de4a3bbde39e54d33b2)

* "OCPBUGS-83609: Bump to k8s v1.33.11" [#2648](https://github.com/openshift/kubernetes/pull/2648)
* [OCPBUGS-78993](https://issues.redhat.com/browse/OCPBUGS-78993): Bump v1.33.10 to release-4.20 [#2643](https://github.com/openshift/kubernetes/pull/2643)
* NO-JIRA: UPSTREAM: <carry>: Add jacobsee and jubittajohn to DOWNSTREAM_OWNERS [#2638](https://github.com/openshift/kubernetes/pull/2638)
* [OCPBUGS-77476](https://issues.redhat.com/browse/OCPBUGS-77476): Rebase v1.33.9 to release-4.20 [#2614](https://github.com/openshift/kubernetes/pull/2614)
* [OCPBUGS-76517](https://issues.redhat.com/browse/OCPBUGS-76517): Bump 1.33.8 [#2595](https://github.com/openshift/kubernetes/pull/2595)
* [OCPBUGS-74977](https://issues.redhat.com/browse/OCPBUGS-74977): UPSTREAM: 136595: raise kubelet CSI init backoff to cover ~140s DNS delays [#2581](https://github.com/openshift/kubernetes/pull/2581)
* [Full changelog](https://github.com/openshift/kubernetes/compare/33a825ebe5da727e8ccce0fb3c9d33fce7c6bdd9...ba5f1e63e12c85b7d61d5de4a3bbde39e54d33b2)


### [hypershift](https://github.com/openshift/hypershift/tree/58965feb45f9e7d7190383fcc622434e824c6f06)

* [OCPBUGS-77109](https://issues.redhat.com/browse/OCPBUGS-77109): Add UserAgent telemetry to CPO Azure SDK clients [#8374](https://github.com/openshift/hypershift/pull/8374)
* [OCPBUGS-83663](https://issues.redhat.com/browse/OCPBUGS-83663): fix(cpo): reconcile ClusterIP private router service for ARO HCP [#8140](https://github.com/openshift/hypershift/pull/8140)
* [OCPBUGS-82069](https://issues.redhat.com/browse/OCPBUGS-82069): OCPBUGS-81670: fix(cpo-v2): preserve HCCO modifications to OCM Controllers field [#8177](https://github.com/openshift/hypershift/pull/8177)
* [OCPBUGS-78474](https://issues.redhat.com/browse/OCPBUGS-78474): Fix deadlock when changing release image during initial provisioning [#7953](https://github.com/openshift/hypershift/pull/7953)
* [OCPBUGS-81746](https://issues.redhat.com/browse/OCPBUGS-81746): Honor AWS AMI override in NodePool token generation [#8183](https://github.com/openshift/hypershift/pull/8183)
* [OCPBUGS-80950](https://issues.redhat.com/browse/OCPBUGS-80950): fix(cpo): Don't remove HCP Ingress from routes when CapabilityRoute is disabled [#8083](https://github.com/openshift/hypershift/pull/8083)
* [OCPBUGS-78979](https://issues.redhat.com/browse/OCPBUGS-78979): fix(hostedcluster): Remove referenced resource annotations regardless of hcp status [#8023](https://github.com/openshift/hypershift/pull/8023)
* [CNTRLPLANE-3008](https://issues.redhat.com/browse/CNTRLPLANE-3008): Azure web identity webhook 4.20 [#7998](https://github.com/openshift/hypershift/pull/7998)
* [OCPBUGS-78741](https://issues.redhat.com/browse/OCPBUGS-78741): fix(sync-global-pullsecret): compare content ignoring trailing newlines [#7976](https://github.com/openshift/hypershift/pull/7976)
* [CNTRLPLANE-2814](https://issues.redhat.com/browse/CNTRLPLANE-2814): feat(aro): Swift support [#7885](https://github.com/openshift/hypershift/pull/7885)
* [OCPBUGS-76992](https://issues.redhat.com/browse/OCPBUGS-76992): fix kubevirt, use 100.66.0.0/16 for join subnet [#7733](https://github.com/openshift/hypershift/pull/7733)
* [OCPBUGS-78305](https://issues.redhat.com/browse/OCPBUGS-78305): Fix context cancel accumulation in getMirrorFromICSPOrIDMS [#7890](https://github.com/openshift/hypershift/pull/7890)
* [OCPBUGS-76324](https://issues.redhat.com/browse/OCPBUGS-76324): feat(updates): enable CVO metrics access with RHOBS monitoring flag [#7660](https://github.com/openshift/hypershift/pull/7660)
* [OCPBUGS-77366](https://issues.redhat.com/browse/OCPBUGS-77366): Fix ignition-server pod restarts [#7842](https://github.com/openshift/hypershift/pull/7842)
* [OCPBUGS-75931](https://issues.redhat.com/browse/OCPBUGS-75931): [release-4.20] fix(cpo): Correct route labeling logic for HCP router infrastructure [#7642](https://github.com/openshift/hypershift/pull/7642)
* [OCPBUGS-74105](https://issues.redhat.com/browse/OCPBUGS-74105): Fix CVE-2025-58183 [#7546](https://github.com/openshift/hypershift/pull/7546)
* [CNTRLPLANE-2680](https://issues.redhat.com/browse/CNTRLPLANE-2680): Add support for setting max expiration duration for KAS service account tokens [#7707](https://github.com/openshift/hypershift/pull/7707)
* [OCPBUGS-74775](https://issues.redhat.com/browse/OCPBUGS-74775): feat(cpo): check components are available before setting HostedCluster available [#7616](https://github.com/openshift/hypershift/pull/7616)
* [OCPBUGS-72409](https://issues.redhat.com/browse/OCPBUGS-72409): fix(Portieris): Fix Portieris by mounting emptyDir to './.trust' work dir [#7421](https://github.com/openshift/hypershift/pull/7421)
* [OCPBUGS-73365](https://issues.redhat.com/browse/OCPBUGS-73365): fix(cno): use brackets only for IPv6 in server URL [#7461](https://github.com/openshift/hypershift/pull/7461)
* [OCPBUGS-72405](https://issues.redhat.com/browse/OCPBUGS-72405): Fix Konflux EC voilation, update deprecated base … [#7444](https://github.com/openshift/hypershift/pull/7444)
* [Full changelog](https://github.com/openshift/hypershift/compare/0877ad678ffc7687c02ce8e890d35f2e2206f9eb...58965feb45f9e7d7190383fcc622434e824c6f06)


### [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver/tree/390a1fa872a3a43075ad27d79a260ed3ec1e924f)

* [OCPBUGS-77205](https://issues.redhat.com/browse/OCPBUGS-77205): [release-4.20] standardize build paths [#120](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/120)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver/compare/19801353c97d08b1333177be45c848082af0643c...390a1fa872a3a43075ad27d79a260ed3ec1e924f)


### [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud/tree/e63e7a191ccc1d391b574d713899e307a88b466c)

* [OCPBUGS-81317](https://issues.redhat.com/browse/OCPBUGS-81317): bump vpc go sdk [#89](https://github.com/openshift/machine-api-provider-ibmcloud/pull/89)
* NO-JIRA: Modernize test infrastructure to align with other MAPI providers [#85](https://github.com/openshift/machine-api-provider-ibmcloud/pull/85)
* [Full changelog](https://github.com/openshift/machine-api-provider-ibmcloud/compare/035805df5277c9f9c0cd9d4a44f59a08ab3ce031...e63e7a191ccc1d391b574d713899e307a88b466c)


### [insights-operator](https://github.com/openshift/insights-operator/tree/e5f36a454807808f44456c3588ff869d5ddc2243)

* [OCPBUGS-82970](https://issues.redhat.com/browse/OCPBUGS-82970): kubeletconfig gathere [#1270](https://github.com/openshift/insights-operator/pull/1270)
* [OCPBUGS-80641](https://issues.redhat.com/browse/OCPBUGS-80641): Bump google.golang.org/grpc to v1.79.3 (Revamp #1261) [#1267](https://github.com/openshift/insights-operator/pull/1267)
* [OCPBUGS-76961](https://issues.redhat.com/browse/OCPBUGS-76961): Extends the time for the extractor liveness probe [#1231](https://github.com/openshift/insights-operator/pull/1231)
* [OCPBUGS-74902](https://issues.redhat.com/browse/OCPBUGS-74902): set Progressing condition on cluster update [#1219](https://github.com/openshift/insights-operator/pull/1219)
* [OCPBUGS-75114](https://issues.redhat.com/browse/OCPBUGS-75114): [bugfix] The ConfigMap value for StoragePath is ignored on basic routine [#1222](https://github.com/openshift/insights-operator/pull/1222)
* [OCPBUGS-64107](https://issues.redhat.com/browse/OCPBUGS-64107): [release-4.20] Patch for GO-2025-4014 [#1215](https://github.com/openshift/insights-operator/pull/1215)
* [Full changelog](https://github.com/openshift/insights-operator/compare/d677651537715900907eec88e6f0537c8c94c6e9...e5f36a454807808f44456c3588ff869d5ddc2243)


### [insights-runtime-exporter, insights-runtime-extractor](https://github.com/openshift/insights-runtime-extractor/tree/39e71471d109ed16c336a8e08c2562d837f90029)

* [OCPBUGS-77566](https://issues.redhat.com/browse/OCPBUGS-77566): remove dnf cache from the container images [#66](https://github.com/openshift/insights-runtime-extractor/pull/66)
* [Full changelog](https://github.com/openshift/insights-runtime-extractor/compare/3d3783698b20f5c27e4f35051b1450e47e789068...39e71471d109ed16c336a8e08c2562d837f90029)


### [ironic](https://github.com/openshift/ironic-image/tree/4b0fc45cf7fc14d8095cea3ac96d724f199996d8)

* [OCPBUGS-84854](https://issues.redhat.com/browse/OCPBUGS-84854): Bump pyasn to 0.5.1-5 [#824](https://github.com/openshift/ironic-image/pull/824)
* [OCPBUGS-82299](https://issues.redhat.com/browse/OCPBUGS-82299): Bump sushy hash to include Supermicro ARS-111GL-NHR fix [#841](https://github.com/openshift/ironic-image/pull/841)
* [OCPBUGS-74405](https://issues.redhat.com/browse/OCPBUGS-74405): Update sushy to include DGX B200 credentials fix [#820](https://github.com/openshift/ironic-image/pull/820)
* [OCPBUGS-74117](https://issues.redhat.com/browse/OCPBUGS-74117): Bump keystonemiddleware version to 10.9.0-0.20260216145500.557d173 for CVE-2026-22797 fix [#792](https://github.com/openshift/ironic-image/pull/792)
* [OCPBUGS-77264](https://issues.redhat.com/browse/OCPBUGS-77264): fix for minimal builds [#800](https://github.com/openshift/ironic-image/pull/800)
* [OCPBUGS-76539](https://issues.redhat.com/browse/OCPBUGS-76539): Update ironic hash for 4.20 with heartbeat inspection fix [#788](https://github.com/openshift/ironic-image/pull/788)
* Bug OCPBUGS-76547: Bump 4.20 ironic-image to include firmware update fixes [#787](https://github.com/openshift/ironic-image/pull/787)
* [Full changelog](https://github.com/openshift/ironic-image/compare/c6c2be3dbdedd8ab7c0b9701307c17df7d2bb591...4b0fc45cf7fc14d8095cea3ac96d724f199996d8)


### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/652b8b4dcffda86f61e181b43cda184292372a14)

* [OCPBUGS-77264](https://issues.redhat.com/browse/OCPBUGS-77264): fixes for minimal builds [#244](https://github.com/openshift/ironic-agent-image/pull/244)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/6ae9e9e35571eedf00c240e10f62b56bbac1af07...652b8b4dcffda86f61e181b43cda184292372a14)


### [keepalived-ipfailover](https://github.com/openshift/images/tree/6c1bae0007a21796f1d1235df745c1f5152aa893)

* [OCPBUGS-78076](https://issues.redhat.com/browse/OCPBUGS-78076): openshift-enterprise-base: remove subscription-manager, dbus, systemd [#227](https://github.com/openshift/images/pull/227)
* [Full changelog](https://github.com/openshift/images/compare/bb4535b7069cab2de0174be29bccccde6d623b4f...6c1bae0007a21796f1d1235df745c1f5152aa893)


### [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server/tree/e7379b302a7377c06cf06d54230decd479f92078)

* [OCPBUGS-80542](https://issues.redhat.com/browse/OCPBUGS-80542): Bump google.golang.org/grpc to v1.79.3 [#62](https://github.com/openshift/kubernetes-metrics-server/pull/62)
* [Full changelog](https://github.com/openshift/kubernetes-metrics-server/compare/cfa5ee9f1c94d7faec36de970033b9e329326f38...e7379b302a7377c06cf06d54230decd479f92078)


### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/086a7f21313d6fbc5ea330d46671ce8934b26c56)

* [OCPBUGS-72589](https://issues.redhat.com/browse/OCPBUGS-72589): fix: only close existing channels [#128](https://github.com/openshift/kube-state-metrics/pull/128)
* [Full changelog](https://github.com/openshift/kube-state-metrics/compare/a8c9a5f08f675ae9afbaafdc47d7d2acb4a3709d...086a7f21313d6fbc5ea330d46671ce8934b26c56)


### [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt/tree/a2d607b2f1196ac371074d5fd14df80462de5b8f)

* [OCPBUGS-74100](https://issues.redhat.com/browse/OCPBUGS-74100): [4.20] sync upstream 2026-01-27 [#62](https://github.com/openshift/cloud-provider-kubevirt/pull/62)
* [Full changelog](https://github.com/openshift/cloud-provider-kubevirt/compare/3f4542ecd17fb0e47da4c6d9bceb076b98fb314b...a2d607b2f1196ac371074d5fd14df80462de5b8f)


### [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver/tree/8fb56226aede45e49fb2f362191c6dbcf50897c6)

* [OCPBUGS-79064](https://issues.redhat.com/browse/OCPBUGS-79064): Add annotation-based fallback for infra VM node ID resolution [#84](https://github.com/openshift/kubevirt-csi-driver/pull/84)
* [OCPBUGS-78371](https://issues.redhat.com/browse/OCPBUGS-78371): Updating ose-kubevirt-csi-driver-container image to be consistent with ART for 4.20 [#78](https://github.com/openshift/kubevirt-csi-driver/pull/78)
* [Full changelog](https://github.com/openshift/kubevirt-csi-driver/compare/8b8dd30ecd302e2b260c666702dffb19abf7c1aa...8fb56226aede45e49fb2f362191c6dbcf50897c6)


### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/d4c552a3c5b26748fb04a58de523b23266322665)

* [OCPBUGS-83394](https://issues.redhat.com/browse/OCPBUGS-83394): Remove cluster-api-provider-libvirt references [#1487](https://github.com/openshift/machine-api-operator/pull/1487)
* [OCPBUGS-78424](https://issues.redhat.com/browse/OCPBUGS-78424): [release-4.20] Use resource group when generating default Azure image [#1475](https://github.com/openshift/machine-api-operator/pull/1475)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/4a9b90e306a04ddfacfa408609c98b48a1cdea17...d4c552a3c5b26748fb04a58de523b23266322665)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/2d25c90c0dc60344479c5bcae395a5baa6ef9c77)

* [OCPBUGS-85069](https://issues.redhat.com/browse/OCPBUGS-85069): Fix encapsulated IGN version [#6001](https://github.com/openshift/machine-config-operator/pull/6001)
* [OCPBUGS-84962](https://issues.redhat.com/browse/OCPBUGS-84962): Update AMI Whitelist [#5991](https://github.com/openshift/machine-config-operator/pull/5991)
* [OCPBUGS-84890](https://issues.redhat.com/browse/OCPBUGS-84890): improve JSON unmarshalling for secret decoding [#5916](https://github.com/openshift/machine-config-operator/pull/5916)
* [OCPBUGS-84151](https://issues.redhat.com/browse/OCPBUGS-84151): Allow enablement of systemd units with existing files [#5873](https://github.com/openshift/machine-config-operator/pull/5873)
* [OCPBUGS-83867](https://issues.redhat.com/browse/OCPBUGS-83867): Update AMI Whitelist [#5866](https://github.com/openshift/machine-config-operator/pull/5866)
* [OCPBUGS-83393](https://issues.redhat.com/browse/OCPBUGS-83393): Use HA leader election defaults for MCO on SNO [#5848](https://github.com/openshift/machine-config-operator/pull/5848)
* [OCPBUGS-80947](https://issues.redhat.com/browse/OCPBUGS-80947): Skip boot image updates until cluster is stable [#5812](https://github.com/openshift/machine-config-operator/pull/5812)
* [OCPBUGS-79370](https://issues.redhat.com/browse/OCPBUGS-79370): Re-order logger setting to eliminate race condition [#5791](https://github.com/openshift/machine-config-operator/pull/5791)
* [release 4.20] OCPBUGS-77252: Calculate machine counts in MCP status from node properties [#5692](https://github.com/openshift/machine-config-operator/pull/5692)
* [OCPBUGS-79577](https://issues.redhat.com/browse/OCPBUGS-79577): Update AMI Whitelist [#5806](https://github.com/openshift/machine-config-operator/pull/5806)
* [OCPBUGS-79371](https://issues.redhat.com/browse/OCPBUGS-79371): set default-timeout-stop to 200s globally [#5792](https://github.com/openshift/machine-config-operator/pull/5792)
* [OCPBUGS-78049](https://issues.redhat.com/browse/OCPBUGS-78049): install/0000_80_machine-config_04_kube_rbac_proxy_config: Consistent terminal newline [#5753](https://github.com/openshift/machine-config-operator/pull/5753)
* [OCPBUGS-77883](https://issues.redhat.com/browse/OCPBUGS-77883): Fix failure domain matching during vsphere boot image updates [#5745](https://github.com/openshift/machine-config-operator/pull/5745)
* [OCPBUGS-77950](https://issues.redhat.com/browse/OCPBUGS-77950): Update AMI Whitelist [#5748](https://github.com/openshift/machine-config-operator/pull/5748)
* [OCPBUGS-77665](https://issues.redhat.com/browse/OCPBUGS-77665): Update AMI Whitelist [#5731](https://github.com/openshift/machine-config-operator/pull/5731)
* [OCPBUGS-77064](https://issues.redhat.com/browse/OCPBUGS-77064): reduce MCO image size [#5673](https://github.com/openshift/machine-config-operator/pull/5673)
* [OCPBUGS-77472](https://issues.redhat.com/browse/OCPBUGS-77472): Clean up vsphere login error logging [#5715](https://github.com/openshift/machine-config-operator/pull/5715)
* [OCPBUGS-77369](https://issues.redhat.com/browse/OCPBUGS-77369): Remove MCD liveness probe [#5707](https://github.com/openshift/machine-config-operator/pull/5707)
* [OCPBUGS-77181](https://issues.redhat.com/browse/OCPBUGS-77181): mcd_config_drift not working properly [#5684](https://github.com/openshift/machine-config-operator/pull/5684)
* [OCPBUGS-76921](https://issues.redhat.com/browse/OCPBUGS-76921): Prevent unnecessary systemd unit disable [#5664](https://github.com/openshift/machine-config-operator/pull/5664)
* [OCPBUGS-77008](https://issues.redhat.com/browse/OCPBUGS-77008): Machine-config controller should not log about non-existent pull-secret changes [#5668](https://github.com/openshift/machine-config-operator/pull/5668)
* [OCPBUGS-74433](https://issues.redhat.com/browse/OCPBUGS-74433): Set `NodeDegraded` MCN condition when node state annotation is set to `Degraded` [#5649](https://github.com/openshift/machine-config-operator/pull/5649)
* [OCPBUGS-76339](https://issues.redhat.com/browse/OCPBUGS-76339): machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] [#5631](https://github.com/openshift/machine-config-operator/pull/5631)
* [OCPBUGS-76361](https://issues.redhat.com/browse/OCPBUGS-76361): Update AMI script and list [#5641](https://github.com/openshift/machine-config-operator/pull/5641)
* [OCPBUGS-74146](https://issues.redhat.com/browse/OCPBUGS-74146): enable nodeip-configuration for platform external [#5580](https://github.com/openshift/machine-config-operator/pull/5580)
* [OCPBUGS-74298](https://issues.redhat.com/browse/OCPBUGS-74298): Fix up bootstrap-e2e [#5590](https://github.com/openshift/machine-config-operator/pull/5590)
* [OCPBUGS-73884](https://issues.redhat.com/browse/OCPBUGS-73884): pkg/controller/container-runtime-config: admin_ack handling for 4.20-to-4.21 OCI mirror requirement [#5558](https://github.com/openshift/machine-config-operator/pull/5558)
* [OCPBUGS-73776](https://issues.redhat.com/browse/OCPBUGS-73776): Fix timeout during configMap cleanup [#5557](https://github.com/openshift/machine-config-operator/pull/5557)
* [OCPBUGS-74081](https://issues.redhat.com/browse/OCPBUGS-74081): Enable existing units without content [#5565](https://github.com/openshift/machine-config-operator/pull/5565)
* [OCPBUGS-66260](https://issues.redhat.com/browse/OCPBUGS-66260): Set -fin timeouts in HAProxy config [#5459](https://github.com/openshift/machine-config-operator/pull/5459)
* [OCPBUGS-70201](https://issues.redhat.com/browse/OCPBUGS-70201): ctrcfg: set increase ulimits when upgrading from 4.20 to 4.21 [#5516](https://github.com/openshift/machine-config-operator/pull/5516)
* [OCPBUGS-69706](https://issues.redhat.com/browse/OCPBUGS-69706): Fix keepalived SIGTERM handling [#5507](https://github.com/openshift/machine-config-operator/pull/5507)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/8af0c84e6fcc34c60768b3955366a78a440b7a85...2d25c90c0dc60344479c5bcae395a5baa6ef9c77)


### [machine-image-customization-controller](https://github.com/openshift/image-customization-controller/tree/fe4360da1fe44c0d8a69c0133f846e0cbc36740c)

* [OCPBUGS-81296](https://issues.redhat.com/browse/OCPBUGS-81296): Return error when network data Secret lacks nmstate key [#172](https://github.com/openshift/image-customization-controller/pull/172)
* [OCPBUGS-77496](https://issues.redhat.com/browse/OCPBUGS-77496): Clean up dnf cache to reduce container image size [#165](https://github.com/openshift/image-customization-controller/pull/165)
* [Full changelog](https://github.com/openshift/image-customization-controller/compare/20f6d615c03b9c579037cdcdc327bd2bcefde4e6...fe4360da1fe44c0d8a69c0133f846e0cbc36740c)


### [machine-os-images](https://github.com/openshift/machine-os-images/tree/551bb5d75e782e47b83292d883e41bc57df730a4)

* [OCPBUGS-71203](https://issues.redhat.com/browse/OCPBUGS-71203): Backport multi arch fixes [#77](https://github.com/openshift/machine-os-images/pull/77)
* [Full changelog](https://github.com/openshift/machine-os-images/compare/64bfec79ae03b50b1da5b614a4cca2937ea9927d...551bb5d75e782e47b83292d883e41bc57df730a4)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/61c918dff3f590a19387b8bba18ed3d75e455176)

* [OCPBUGS-83495](https://issues.redhat.com/browse/OCPBUGS-83495): [release-4.20] feat: re enable dev console views [#855](https://github.com/openshift/monitoring-plugin/pull/855)
* [OCPBUGS-83302](https://issues.redhat.com/browse/OCPBUGS-83302): [release-4.20] openshift4/ose-monitoring-plugin-rhel9: Axios: Remote Code Execution via Prototype Pollution escalation [#888](https://github.com/openshift/monitoring-plugin/pull/888)
* [OCPBUGS-82440](https://issues.redhat.com/browse/OCPBUGS-82440): fix: re encode params when redirecting from graph to query-browser [#872](https://github.com/openshift/monitoring-plugin/pull/872)
* [OCPBUGS-77406](https://issues.redhat.com/browse/OCPBUGS-77406): bump koa [#866](https://github.com/openshift/monitoring-plugin/pull/866)
* [OCPBUGS-78359](https://issues.redhat.com/browse/OCPBUGS-78359): fix for CVE-2025-69873 [#846](https://github.com/openshift/monitoring-plugin/pull/846)
* [OCPBUGS-78425](https://issues.redhat.com/browse/OCPBUGS-78425): Updating monitoring-plugin-container image to be consistent with ART for 4.20 [#843](https://github.com/openshift/monitoring-plugin/pull/843)
* [OU-1062](https://issues.redhat.com/browse/OU-1062): [release-4.20] feat: mark alert menu active for incidents tab [#826](https://github.com/openshift/monitoring-plugin/pull/826)
* [OCPBUGS-76581](https://issues.redhat.com/browse/OCPBUGS-76581): [release-4.20] CVE-2026-25639 openshift4/ose-monitoring-plugin-rhel9: Axios affected by Denial of Service via __proto__ Key in mergeConfig [#796](https://github.com/openshift/monitoring-plugin/pull/796)
* NO-JIRA: [release-4.20] e2e-monitoring fixing loop on legacy dashboard [#830](https://github.com/openshift/monitoring-plugin/pull/830)
* NO-JIRA: [release-4.20] simplify dockerfile by removing cachito dependencies [#807](https://github.com/openshift/monitoring-plugin/pull/807)
* revert #780 [#792](https://github.com/openshift/monitoring-plugin/pull/792)
* [OCPBUGS-76581](https://issues.redhat.com/browse/OCPBUGS-76581): [release-4.20] CVE-2026-25639 openshift4/ose-monitoring-plugin-rhel9:Axios affected by Denial of Service via __proto__ Key in mergeConfig [openshift-4.20] [#780](https://github.com/openshift/monitoring-plugin/pull/780)
* [OCPBUGS-76613](https://issues.redhat.com/browse/OCPBUGS-76613): [release-4.20] fix: update vulnerable dependencies [#766](https://github.com/openshift/monitoring-plugin/pull/766)
* [OCPBUGS-73842](https://issues.redhat.com/browse/OCPBUGS-73842): fix: update qs vulnerable dependency [#733](https://github.com/openshift/monitoring-plugin/pull/733)
* NO-JIRA: [release-4.20] fix: remove unnecessary package.lock [#732](https://github.com/openshift/monitoring-plugin/pull/732)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/b0bf464e64bc17bcd2f9d06e8d47d45915115624...61c918dff3f590a19387b8bba18ed3d75e455176)


### [multus-cni, multus-cni-microshift](https://github.com/openshift/multus-cni/tree/b2a2f457824490d93da101d983b25af966f2be1b)

* [OCPBUGS-73737](https://issues.redhat.com/browse/OCPBUGS-73737): Fix server url in kubeconfig [#273](https://github.com/openshift/multus-cni/pull/273)
* [OCPBUGS-73888](https://issues.redhat.com/browse/OCPBUGS-73888): update ci-operator.yaml [#274](https://github.com/openshift/multus-cni/pull/274)
* [Full changelog](https://github.com/openshift/multus-cni/compare/cf0f68ec2b5fe9bc72d0da325e02cf63968747fe...b2a2f457824490d93da101d983b25af966f2be1b)


### [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy/tree/afbdf82505c0d8f212d63e1eee6debced74ef653)

* [OCPBUGS-77548](https://issues.redhat.com/browse/OCPBUGS-77548): Clean up dnf cache [#102](https://github.com/openshift/multus-networkpolicy/pull/102)
* [Full changelog](https://github.com/openshift/multus-networkpolicy/compare/278ec20e795c3a590500e789716be7fcc4d7107b...afbdf82505c0d8f212d63e1eee6debced74ef653)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/c9c1a9f5ca8287d20a0aafab9507478c6f291614)

* [OCPBUGS-81615](https://issues.redhat.com/browse/OCPBUGS-81615): Fix CVE-2026-CVE-2026-4800 in lodash [#399](https://github.com/openshift/networking-console-plugin/pull/399)
* [OCPBUGS-83386](https://issues.redhat.com/browse/OCPBUGS-83386): Fix CVE-2026-34043 in serialize-javascript [#394](https://github.com/openshift/networking-console-plugin/pull/394)
* [OCPBUGS-84124](https://issues.redhat.com/browse/OCPBUGS-84124): Migrate to npm [#387](https://github.com/openshift/networking-console-plugin/pull/387)
* [OCPBUGS-77226](https://issues.redhat.com/browse/OCPBUGS-77226): Fix NAD creation using default namespace instead of selected one [#350](https://github.com/openshift/networking-console-plugin/pull/350)
* [CNV-77540](https://issues.redhat.com/browse/CNV-77540): fix Enable MultiNetworkPolicies lead to invalid URL [#342](https://github.com/openshift/networking-console-plugin/pull/342)
* [CNV-76277](https://issues.redhat.com/browse/CNV-76277): Fix name generator with unprofessional names [#317](https://github.com/openshift/networking-console-plugin/pull/317)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/7df8cc9ca8362fecc840653bba092d02f15a19ed...c9c1a9f5ca8287d20a0aafab9507478c6f291614)


### [oauth-apiserver](https://github.com/openshift/oauth-apiserver/tree/99f27d25cc2853fe44ce6c7f7611637ef1492e42)

* NO-JIRA: (chore): update OWNERS file [#168](https://github.com/openshift/oauth-apiserver/pull/168)
* [Full changelog](https://github.com/openshift/oauth-apiserver/compare/e5ad4f6fdc093595f6d939eb43868ae36ae3fdaa...99f27d25cc2853fe44ce6c7f7611637ef1492e42)


### [oauth-proxy](https://github.com/openshift/oauth-proxy/tree/baba7b55859172b58bd89eea8124eff3c0d64f3a)

* [OCPBUGS-74132](https://issues.redhat.com/browse/OCPBUGS-74132): test/e2e - do not use ambiguous container image short names [#345](https://github.com/openshift/oauth-proxy/pull/345)
* [Full changelog](https://github.com/openshift/oauth-proxy/compare/6649cb8a7c4dd7d1c4e03c9b0bc7594089fba991...baba7b55859172b58bd89eea8124eff3c0d64f3a)


### [oauth-server](https://github.com/openshift/oauth-server/tree/21329625a0f5807af9c61e6cd65904c93d65e48c)

* [OCPBUGS-77500](https://issues.redhat.com/browse/OCPBUGS-77500): groupmapper: avoid mutating original group users slice when removing user [#214](https://github.com/openshift/oauth-server/pull/214)
* [OCPBUGS-68330](https://issues.redhat.com/browse/OCPBUGS-68330): go.mod: bump logrus from v1.9.0 to v1.9.3 to fix CVE-2025-65637 [#209](https://github.com/openshift/oauth-server/pull/209)
* [Full changelog](https://github.com/openshift/oauth-server/compare/81098796234cbe75e656ffddd8a015953e0bb1c7...21329625a0f5807af9c61e6cd65904c93d65e48c)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/cb2b9df9c4295a97b2d4f528b73a32d77df6b3ba)

* [OCPBUGS-85204](https://issues.redhat.com/browse/OCPBUGS-85204): update integration test Dockerfile [#1393](https://github.com/openshift/oc-mirror/pull/1393)
* [OCPBUGS-77416](https://issues.redhat.com/browse/OCPBUGS-77416): Fix registriesd "unknown userid" failure for arbitrary UIDs [#1360](https://github.com/openshift/oc-mirror/pull/1360)
* [OCPBUGS-76630](https://issues.redhat.com/browse/OCPBUGS-76630): Fix reg config detection for explicit false values [#1350](https://github.com/openshift/oc-mirror/pull/1350)
* [OCPBUGS-76949](https://issues.redhat.com/browse/OCPBUGS-76949): fix conversion issue for catalog [#1353](https://github.com/openshift/oc-mirror/pull/1353)
* [OCPBUGS-75007](https://issues.redhat.com/browse/OCPBUGS-75007): [release-4.20] fix duplicated channel bug in filtered catalogs [#1347](https://github.com/openshift/oc-mirror/pull/1347)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/f4775a263f2ddbc9f94c9349231883614dce0193...cb2b9df9c4295a97b2d4f528b73a32d77df6b3ba)


### [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack/tree/c91265ed4f82c0b36fbfc50040b8180f04fcf4cc)

* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.12 into release-4.20 [#392](https://github.com/openshift/cluster-api-provider-openstack/pull/392)
* [Full changelog](https://github.com/openshift/cluster-api-provider-openstack/compare/d1c8e7edf11e78db401bc1672e0f17d551fe09db...c91265ed4f82c0b36fbfc50040b8180f04fcf4cc)


### [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack/tree/7f8ae5007e4299769e25172a821342dc2874567c)

* [OCPBUGS-69645](https://issues.redhat.com/browse/OCPBUGS-69645): Don't record event for every reconcile [#145](https://github.com/openshift/machine-api-provider-openstack/pull/145)
* [OCPBUGS-76790](https://issues.redhat.com/browse/OCPBUGS-76790): Fix make test [#157](https://github.com/openshift/machine-api-provider-openstack/pull/157)
* [OCPBUGS-74226](https://issues.redhat.com/browse/OCPBUGS-74226): Revendor CAPO [#148](https://github.com/openshift/machine-api-provider-openstack/pull/148)
* [Full changelog](https://github.com/openshift/machine-api-provider-openstack/compare/5085f184c7d2ed21f36e5e3fe65bf023b38afe67...7f8ae5007e4299769e25172a821342dc2874567c)


### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/72a01f66530d38330e9442d2238ab30aa90dcb39)

* [OCPBUGS-79681](https://issues.redhat.com/browse/OCPBUGS-79681): Fix nil pointer dereference in sortUnpackJobs when sorting non-failed jobs [#1267](https://github.com/openshift/operator-framework-olm/pull/1267)
* [OCPBUGS-81292](https://issues.redhat.com/browse/OCPBUGS-81292): add jiazha to approvers [#1269](https://github.com/openshift/operator-framework-olm/pull/1269)
* [OCPBUGS-77958](https://issues.redhat.com/browse/OCPBUGS-77958): Update NetworkPolicy egress for HyperShift custom API ports [#1253](https://github.com/openshift/operator-framework-olm/pull/1253)
* [OCPBUGS-77230](https://issues.redhat.com/browse/OCPBUGS-77230): Remove the collect-profiles info from the microshift kustomization file [#1236](https://github.com/openshift/operator-framework-olm/pull/1236)
* [OCPBUGS-76335](https://issues.redhat.com/browse/OCPBUGS-76335): Remove the collect-profiles job [#1223](https://github.com/openshift/operator-framework-olm/pull/1223)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/0d95a7ef5d73153f5593e67bc41c0c7a53567ee6...72a01f66530d38330e9442d2238ab30aa90dcb39)


### [operator-marketplace](https://github.com/operator-framework/operator-marketplace/tree/4ccd56c96839e2389e12bf3f8390a6c062e9b2cf)

* [OCPBUGS-77582](https://issues.redhat.com/browse/OCPBUGS-77582): Update NetworkPolicy egress to support HyperShift custom API ports [#730](https://github.com/operator-framework/operator-marketplace/pull/730)
* [OCPBUGS-73876](https://issues.redhat.com/browse/OCPBUGS-73876): Update default catalog polling interval to 4h (240m) [#708](https://github.com/operator-framework/operator-marketplace/pull/708)
* [Full changelog](https://github.com/operator-framework/operator-marketplace/compare/e88619ea60753b276b2d813e050d8cfbbfce5a41...4ccd56c96839e2389e12bf3f8390a6c062e9b2cf)


### [ovirt-csi-driver-operator](https://github.com/openshift/ovirt-csi-driver-operator/tree/7e1f4a300fc4b212f4e79cd9bcc9deb6d137b9b7)

* [OCPBUGS-68331](https://issues.redhat.com/browse/OCPBUGS-68331): Bump github.com/sirupsen/logrus to v1.9.3 [#145](https://github.com/openshift/ovirt-csi-driver-operator/pull/145)
* [Full changelog](https://github.com/openshift/ovirt-csi-driver-operator/compare/76db379d075fdae94ca604f3fa83b0612b36ef8d...7e1f4a300fc4b212f4e79cd9bcc9deb6d137b9b7)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/dbebe515c05e673ed62083e019e55aaf9bcebeab)

* [OCPBUGS-81484](https://issues.redhat.com/browse/OCPBUGS-81484): CUDN: cleanup NADs in terminating namespaces without pods [#3102](https://github.com/openshift/ovn-kubernetes/pull/3102)
* [OCPBUGS-74395](https://issues.redhat.com/browse/OCPBUGS-74395): kubevirt, Use pod network subnet gateway IP for DHCP router option [#3070](https://github.com/openshift/ovn-kubernetes/pull/3070)
* [OCPBUGS-82115](https://issues.redhat.com/browse/OCPBUGS-82115): egressip: Skip bridge configuration for secondary network IPs [#3120](https://github.com/openshift/ovn-kubernetes/pull/3120)
* [OCPBUGS-84054](https://issues.redhat.com/browse/OCPBUGS-84054): [release 4.20] virt: fix SyncVirtualMachines deleting UDN DHCP options during startup [#3152](https://github.com/openshift/ovn-kubernetes/pull/3152)
* [OCPBUGS-78777](https://issues.redhat.com/browse/OCPBUGS-78777): Fix NAD Controller syncAll for networkID upgrade from node->NAD [#3093](https://github.com/openshift/ovn-kubernetes/pull/3093)
* [OCPBUGS-81477](https://issues.redhat.com/browse/OCPBUGS-81477): node: fix serviceUpdateNotNeeded nil pointer comparison [#3099](https://github.com/openshift/ovn-kubernetes/pull/3099)
* [OCPBUGS-79537](https://issues.redhat.com/browse/OCPBUGS-79537): EgressFirewall: Use exponential backoff to refresh IP addresses for DNS names [#3088](https://github.com/openshift/ovn-kubernetes/pull/3088)
* [OCPBUGS-77148](https://issues.redhat.com/browse/OCPBUGS-77148): Minimize ACLs by combining ipBlocks into single ACL [#2981](https://github.com/openshift/ovn-kubernetes/pull/2981)
* [OCPBUGS-77357](https://issues.redhat.com/browse/OCPBUGS-77357): Clear stale conntrack UDP entries for nodePorts [#3012](https://github.com/openshift/ovn-kubernetes/pull/3012)
* [OCPBUGS-77081](https://issues.redhat.com/browse/OCPBUGS-77081), [OCPBUGS-77094](https://issues.redhat.com/browse/OCPBUGS-77094): [release-4.20] combined backport PR for 2 escalations [#2985](https://github.com/openshift/ovn-kubernetes/pull/2985)
* [OCPBUGS-73788](https://issues.redhat.com/browse/OCPBUGS-73788): Fix service flows for BGP on IPV6 [#2934](https://github.com/openshift/ovn-kubernetes/pull/2934)
* [OCPBUGS-74268](https://issues.redhat.com/browse/OCPBUGS-74268): release-4.20 fix(localnet, ipamless): Prevent LSP deletion on sync [#2941](https://github.com/openshift/ovn-kubernetes/pull/2941)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/1faf1ac5bb2e604f745d93a5fe70bec93024ad7f...dbebe515c05e673ed62083e019e55aaf9bcebeab)


### [powervs-block-csi-driver](https://github.com/openshift/ibm-powervs-block-csi-driver/tree/8faa079fe4ba90ca37e7112e4be8a77ccf221e77)

* [OCPBUGS-80675](https://issues.redhat.com/browse/OCPBUGS-80675): Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 [#128](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/128)
* [OCPBUGS-82873](https://issues.redhat.com/browse/OCPBUGS-82873): Fix CVE-2026-35469 by bumping github.com/moby/spdystream to v0.5.1 [#122](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/122)
* [OCPBUGS-75818](https://issues.redhat.com/browse/OCPBUGS-75818): Mitigate CVE-2025-61726 by bumping golang to 1.24.13 [#113](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/113)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver/compare/0693fe5dcfab224466fba7a19e614de71f727999...8faa079fe4ba90ca37e7112e4be8a77ccf221e77)


### [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/tree/4036cd3b5e45cf4d8c3c34def599657435601661)

* [OCPBUGS-80676](https://issues.redhat.com/browse/OCPBUGS-80676): Fix CVE-2026-33186 by bumping google.golang.org/grpc to v1.79.3 [#108](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/108)
* [OCPBUGS-75820](https://issues.redhat.com/browse/OCPBUGS-75820): Mitigate CVE-2025-61726 by bumping golang to 1.24.13 [#105](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/105)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/compare/319efc99be8cc2603fad1677acee7c4a4a096913...4036cd3b5e45cf4d8c3c34def599657435601661)


### [prom-label-proxy](https://github.com/openshift/prom-label-proxy/tree/3bc94eed432cacc37930aa4b0d8ff375e370cbbe)

* [OCPBUGS-84068](https://issues.redhat.com/browse/OCPBUGS-84068): update to v0.12.1 [#393](https://github.com/openshift/prom-label-proxy/pull/393)
* [Full changelog](https://github.com/openshift/prom-label-proxy/compare/f2529aee3dc2e9065de08b035d53151e007136fd...3bc94eed432cacc37930aa4b0d8ff375e370cbbe)


### [prometheus](https://github.com/openshift/prometheus/tree/72dbf103acd3a59ba6bb6979e255a0c82864956c)

* [OCPBUGS-78582](https://issues.redhat.com/browse/OCPBUGS-78582): [release-4.20] chore(kubernetes): deduplicate warning logs from the API [#299](https://github.com/openshift/prometheus/pull/299)
* [Full changelog](https://github.com/openshift/prometheus/compare/af9b206808f8eaeb4acec7fe74ba6b145bbdc921...72dbf103acd3a59ba6bb6979e255a0c82864956c)


### [prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator/tree/425294dded74054100db465d296b2aa76e7a691e)

* [OCPBUGS-77296](https://issues.redhat.com/browse/OCPBUGS-77296): backport upstream fix to reconcile resources with inconsistent status [#367](https://github.com/openshift/prometheus-operator/pull/367)
* [OCPBUGS-77190](https://issues.redhat.com/browse/OCPBUGS-77190): Validate `webhookURL` secret for `MSTeams` receiver in `AlertmanagerConfig` CRD [#362](https://github.com/openshift/prometheus-operator/pull/362)
* [Full changelog](https://github.com/openshift/prometheus-operator/compare/e2bd260c9d686192a5ed9b85dfd4a9f7a2a03666...425294dded74054100db465d296b2aa76e7a691e)


### [rhel-coreos, rhel-coreos-extensions](https://github.com/openshift/os/tree/49a3e234f2d0381d3a309f10fc29043fcd63592e)

* [OCPBUGS-82524](https://issues.redhat.com/browse/OCPBUGS-82524): post-process: Remove workaround for openvswitch additional group [#1928](https://github.com/openshift/os/pull/1928)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/os/compare/63e9aa4008eb65a02a2d70c9c086cbd8e18e149f...49a3e234f2d0381d3a309f10fc29043fcd63592e)


### [route-controller-manager](https://github.com/openshift/route-controller-manager/tree/ec18e9be0ebcbd7cb262d31f50148f81d0edd48f)

* [OCPBUGS-76957](https://issues.redhat.com/browse/OCPBUGS-76957): filter ingress namespace on UnmanagedRoutes metric [#74](https://github.com/openshift/route-controller-manager/pull/74)
* [Full changelog](https://github.com/openshift/route-controller-manager/compare/bf2fa662f57f233d8541f94c4953e0dcd7a5ab20...ec18e9be0ebcbd7cb262d31f50148f81d0edd48f)


### [telemeter](https://github.com/openshift/telemeter/tree/d07a833015fe91fe2df12589a6877dde15e9a227)

* [OCPBUGS-80691](https://issues.redhat.com/browse/OCPBUGS-80691): Bump google.golang.org/grpc to v1.79.3 [#590](https://github.com/openshift/telemeter/pull/590)
* [OCPBUGS-81814](https://issues.redhat.com/browse/OCPBUGS-81814): [release-1.20] Fix CVE-2026-34986 [#594](https://github.com/openshift/telemeter/pull/594)
* [Full changelog](https://github.com/openshift/telemeter/compare/4c6036eeb851ad6e0e837e214a2d08ffc8f0d1d0...d07a833015fe91fe2df12589a6877dde15e9a227)


### [tests](https://github.com/openshift/origin/tree/a99b27653d2fded28c33e6234878824e9a46ad78)

* : OCPBUGS-77313: Add test for CPMS OnDelete strategy with full master replacement [#30882](https://github.com/openshift/origin/pull/30882)
* [OCPBUGS-78193](https://issues.redhat.com/browse/OCPBUGS-78193): Exclude disruption during NoExecuteTaintManager serial tests [#30858](https://github.com/openshift/origin/pull/30858)
* [OCPBUGS-83447](https://issues.redhat.com/browse/OCPBUGS-83447): Fix PinnedImages test to respect node taints [#30970](https://github.com/openshift/origin/pull/30970)
* : run resource request/limit check early [#30888](https://github.com/openshift/origin/pull/30888)
* [OCPBUGS-78025](https://issues.redhat.com/browse/OCPBUGS-78025): Skip oauth test for external control plane topology [#30848](https://github.com/openshift/origin/pull/30848)
* [OCPBUGS-78084](https://issues.redhat.com/browse/OCPBUGS-78084): Update optimized builds test to use rpm -qa instead of dnf [#30861](https://github.com/openshift/origin/pull/30861)
* [OCPBUGS-78084](https://issues.redhat.com/browse/OCPBUGS-78084): Allow test to tolerate running on minimal images [#30853](https://github.com/openshift/origin/pull/30853)
* [OCPBUGS-77824](https://issues.redhat.com/browse/OCPBUGS-77824): add the missing namespace from managed openshift [#30837](https://github.com/openshift/origin/pull/30837)
* [OCPBUGS-77776](https://issues.redhat.com/browse/OCPBUGS-77776): Update MCN tests to better handle condition transitions through the "Unknown" state [#30829](https://github.com/openshift/origin/pull/30829)
* [OCPBUGS-72395](https://issues.redhat.com/browse/OCPBUGS-72395): Unrevert TLS tests with fixes [#30668](https://github.com/openshift/origin/pull/30668)
* [OCPBUGS-72412](https://issues.redhat.com/browse/OCPBUGS-72412), [OCPBUGS-72413](https://issues.redhat.com/browse/OCPBUGS-72413): only run Netpol two at a time [#30666](https://github.com/openshift/origin/pull/30666)
* [Full changelog](https://github.com/openshift/origin/compare/b3dfe24701b9b592b9c55153974804db7ec76459...a99b27653d2fded28c33e6234878824e9a46ad78)


### [vsphere-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-vsphere/tree/6d0cfe391f8f76211f14f34a23612722603fe56b)

* [OCPBUGS-78436](https://issues.redhat.com/browse/OCPBUGS-78436): Updating ose-vsphere-cluster-api-controllers-container image to be consistent with ART for 4.20 [#92](https://github.com/openshift/cluster-api-provider-vsphere/pull/92)
* [Full changelog](https://github.com/openshift/cluster-api-provider-vsphere/compare/1ff9e11f5a117505d935549b96cd0d129917c015...6d0cfe391f8f76211f14f34a23612722603fe56b)


### [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator/tree/13b68a91a148667d46bd06ad8fcb839be984671e)

* "[release-4.20] OCPBUGS-84891: Fix escaping password" [#340](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/340)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver-operator/compare/5cd04d61c20872edaaa2c3958779ff29ea6e6d82...13b68a91a148667d46bd06ad8fcb839be984671e)


### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/65d066ab0940dc69aa3f7ec6b02e698a6e4f5795)

* [OCPBUGS-74901](https://issues.redhat.com/browse/OCPBUGS-74901): fix concurrent map writes [#208](https://github.com/openshift/vsphere-problem-detector/pull/208)
* [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/a417b217d7f39b02ba0bc1b75aa3bf52602df189...65d066ab0940dc69aa3f7ec6b02e698a6e4f5795)