# 4.21.32

Created: 2026-09-03 10:16:41 +0000 UTC

Image Digest: `sha256:51a2690f608613a1fc11b8b5f8cc5e6e311ae721c6851be6e79dd8f2697ba97f`


## Changes from 4.21.10

### Components

* Kubectl 1.34.1
* Kubernetes upgraded from 1.34.6 to 1.34.9
* Kubernetes Tests 1.34.1
* Red Hat Enterprise Linux CoreOS upgraded from 10.2.20260405-0 to 10.2.20260521-0



### FeatureGate Changes
| FeatureGate | Default<br/>Hypershift | Default<br/>SelfManagedHA | DevPreviewNoUpgrade<br/>Hypershift | DevPreviewNoUpgrade<br/>SelfManagedHA | TechPreviewNoUpgrade<br/>Hypershift | TechPreviewNoUpgrade<br/>SelfManagedHA  |
| :------ | :---: | :---: | :---: | :---: | :---: | :---:  |
| EventTTL <br/> (0 tests)| Enabled<br/>(Changed)| Enabled<br/>(Changed)| Enabled| Enabled| Enabled| Enabled |
| GatewayAPIWithoutOLM <br/> (0 tests)| Enabled<br/>(New)| Enabled<br/>(New)| Enabled<br/>(New)| Enabled<br/>(New)| Enabled<br/>(New)| Enabled<br/>(New) |


### Removed images

* libvirt-machine-controllers


### Rebuilt images without code change

* [agent-installer-csr-approver](https://github.com/openshift/assisted-installer) git [070f654b](https://github.com/openshift/assisted-installer/commit/070f654bf5003765d3d00ab1811ef5ad111a5d4a) `sha256:84ce1335d3200f9bae42582547a2bd039b3bc464425284625d87b24eaf0426ed`
* [agent-installer-orchestrator](https://github.com/openshift/assisted-installer) git [070f654b](https://github.com/openshift/assisted-installer/commit/070f654bf5003765d3d00ab1811ef5ad111a5d4a) `sha256:8270482f1d9f23a5dd934230746d8c98bd10ef5e8f201a35de43198234efa4cf`
* [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy) git [35ba137a](https://github.com/openshift/apiserver-network-proxy/commit/35ba137ab96d01f0b8df729ff5ad93ac2fdad800) `sha256:f24daee8722c23f953d9eb0f79bd54791c87e5c3b5c46eb5d9f04aeabe6c7c5f`
* [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws) git [fdc7f3f1](https://github.com/openshift/cloud-provider-aws/commit/fdc7f3f15c693593cb573b6bef6f0363256b6f52) `sha256:73898f605b992060c98133dc87a2feef04431ba0584c9b2a00c6807d60f32f79`
* [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws) git [10ceef5e](https://github.com/openshift/cluster-api-provider-aws/commit/10ceef5e6f6d0cb79a3345de4fd8851f6300205c) `sha256:e7e9a82c6cc1c294013f27d27e53d70d025a444840b3a235f29c11aa62716614`
* [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws) git [938565c9](https://github.com/openshift/machine-api-provider-aws/commit/938565c9f796fba385c0978a5ae1cc0a79f0f857) `sha256:0420880f89e0d48cdb10147a72b7568c9ffe326900bf0a6f03e4d748cd75c9ee`
* [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook) git [5cd42ed1](https://github.com/openshift/aws-pod-identity-webhook/commit/5cd42ed1e5151f45f0134593e9cfebdb6517b385) `sha256:0b3c97df9c9c92c3961e1764da2e886dec15fc0a8043a75dc7a5a2ce6d84537a`
* [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3) git [659138fe](https://github.com/openshift/cluster-api-provider-metal3/commit/659138fef3abd4c71b0b01fa1279146745699a5a) `sha256:bba7fc20c956230d16bb334da56ca7faeba9ce6dfef11f8fbcc1d7e8a9ec8dc5`
* [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal) git [4e6a729c](https://github.com/openshift/cluster-api-provider-baremetal/commit/4e6a729c5ac8fde8859db5830def262dfdee28ea) `sha256:8ff9835b9e102b854a8c8d74e3eb7a5bdc50df38a59fb4a665914fa2f519d00f`
* [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg) git [d7e3fc12](https://github.com/openshift/baremetal-runtimecfg/commit/d7e3fc12bd9dc911f0fac4c9a46b814c7be62b14) `sha256:949c3d7c98ee3d3df59e685c35ae268ce818fed542daa52243aadb6a025f19fa`
* [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller) git [57db2d05](https://github.com/openshift/cloud-network-config-controller/commit/57db2d05e057dc90bae3dc1b0e806b3259d38fc0) `sha256:abd0f68ecbd281df878fabff2260695d20252b4ea188dba6eaf64aad4b061f2f`
* [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap) git [dc0d4a5c](https://github.com/openshift/cluster-bootstrap/commit/dc0d4a5cdaf8a7477cab584208dc99352f46efe2) `sha256:7ef0b2e9db0d050412a4c5bde201fc2b1a24a6f1bf1d5826a762774f6785853d`
* [cluster-config-operator](https://github.com/openshift/cluster-config-operator) git [1eb450a3](https://github.com/openshift/cluster-config-operator/commit/1eb450a3a2456f6e3fe3d727208b5f7b0dd35aba) `sha256:5d39727eb8409887a23209ec5d5594f4d11dc4f3ac585981d779227a83ad4f74`
* [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator) git [41a53fed](https://github.com/openshift/cluster-dns-operator/commit/41a53fed36e6e99c7c9ceb3a699c3547ee5d9bb9) `sha256:86ca689f6c67e378f66d44a871f845fc63f159eb952e88a94e25f595a1d6eb26`
* [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator) git [395de967](https://github.com/openshift/cluster-kube-controller-manager-operator/commit/395de96705749de9c6a5f25747b9d5c3d5f65a8f) `sha256:4ceed58bcf644528a843424aaeaa91118d262e0b9fffa183318841497027935f`
* [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator) git [8a42beeb](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/commit/8a42beebd580bd2e241aa6d93860c09e907f2407) `sha256:36a47f4ba2b31eb13b4f98d288b11b3fd45c52d2f35d452825d1b335faba7019`
* [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver) git [d864813c](https://github.com/openshift/cluster-machine-approver/commit/d864813cd3ab01c0f975b2bf41e9046948f0afa1) `sha256:18726f9367a83f50e54dfb7d16dc9478d1b2ed43f92b5d3ed85d51a1275e1441`
* [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator) git [2617a201](https://github.com/openshift/cluster-openshift-controller-manager-operator/commit/2617a201bb3607192a9f82faa18384676f611e3c) `sha256:bf48e39cec7264775afc96291ab53a26069496894400ce5e798af11bea565aab`
* [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator) git [11ed1942](https://github.com/openshift/cluster-samples-operator/commit/11ed1942dbbf7a8334862b3d598a967e9b92aa77) `sha256:4ad093232ad26a14063bfbc61c6d9e0c039eb1ef6c0cd6e7e624344f415f58f1`
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [b3cae8f2](https://github.com/openshift/cluster-update-keys/commit/b3cae8f22b51d9062d0ceb6ac9cf2f7651b4ce8f) `sha256:d50957480b593da1176c50c19d2858b5db1905242bd3d19ecb5697e4a366881d`
* [cluster-version-operator](https://github.com/openshift/cluster-version-operator) git [d37e5a05](https://github.com/openshift/cluster-version-operator/commit/d37e5a056d5a9c74c2ac2d5551ef39f573c9824a) `sha256:fd3b39be9f5f6dd323e67ab15ac0161ed260fd5b6d3ab20fec86ced6ac2f1226`
* [configmap-reloader](https://github.com/openshift/configmap-reload) git [16114b8d](https://github.com/openshift/configmap-reload/commit/16114b8de20278b8f4b7a425ece6d35d53214773) `sha256:e69acc76793b952af759e38d44d35ef21ff96e08c4e1cce1cd0a09d0063d5ef8`
* [container-networking-plugins](https://github.com/openshift/containernetworking-plugins) git [747ad66c](https://github.com/openshift/containernetworking-plugins/commit/747ad66caa1109b2b490aebad01af42bd2d738f1) `sha256:34db7d14a3db6337de33719bd3025cda31d8b37717af24b6037967f43a8739f4`
* [containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins) git [747ad66c](https://github.com/openshift/containernetworking-plugins/commit/747ad66caa1109b2b490aebad01af42bd2d738f1) `sha256:32afa61c14072a8268e9631286d5eabeb5dfe8ff963f2280c435ac9b030d26d5`
* [coredns](https://github.com/openshift/coredns) git [7486e9e4](https://github.com/openshift/coredns/commit/7486e9e4330c1e41d9a91e4673b7f2782efc112c) `sha256:9f07372c9659382347c892a0489ee20746fd78a745fc570697fed5635ac94c20`
* [csi-external-snapshot-metadata](https://github.com/openshift/csi-external-snapshot-metadata) git [af250fdb](https://github.com/openshift/csi-external-snapshot-metadata/commit/af250fdbac8af84d9808a2892bfc911c04162115) `sha256:425af758f4ba4aba6c7551ebfd577c4843ffc58e13e9f016460921ffe54c6e7f`
* [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe) git [78dacb7c](https://github.com/openshift/csi-livenessprobe/commit/78dacb7c661a62c78036c2737401afd3eb6fd04d) `sha256:076da7d59107bba89a1430a080176af4f83052296230df56d51b724cf03a169e`
* [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar) git [d29f3f7a](https://github.com/openshift/csi-node-driver-registrar/commit/d29f3f7a4aed4465e7e40e323bd3c0e0d9871e4c) `sha256:ead92f00c83a562232b8feac34089875e63ff76080039dc4c09e8ed9cc22d5fb`
* [docker-builder](https://github.com/openshift/builder) git [48fce231](https://github.com/openshift/builder/commit/48fce231bac118a63992f466acc8b29a29e1ddde) `sha256:b5d9f193121f2ea2097c5cc64c3e8b1a39e876d40be38a5a88f453656a1a9a2d`
* [docker-registry](https://github.com/openshift/image-registry) git [602f51c7](https://github.com/openshift/image-registry/commit/602f51c795dcdcd71c75f6abfe79dc0424a0476a) `sha256:069a7c6581b9d90c26f110eba7bd568c1a63bc4c0c3101b806ee9619b5eff81e`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [f0ae9d12](https://github.com/openshift/driver-toolkit/commit/f0ae9d12ca7e3adf594ae34e394b1ea003daa4ad) `sha256:38c34dd7880fc90da3d8fc8d73bc83471efffaf6459f0a49fcd317282dad1a0d`
* [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook) git [d481e5cb](https://github.com/openshift/gcp-workload-identity-federation-webhook/commit/d481e5cb9323b01964bf143b58403b62fa31e5e7) `sha256:5f8f7358ea326a1ebe2b47e56fa02640986642b4f5c2a4994cbd11b2681b8772`
* [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm) git [c566572b](https://github.com/openshift/cloud-provider-ibm/commit/c566572b2cf0120499e81181f1efb1e729e9c418) `sha256:e09aedb4f44cc2612c5b1a02c2ddf44c6ca93aabd5f297e6e748daf9f568d1b8`
* [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator) git [00bc7407](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/commit/00bc740728d9f8ec86fe04199884108c2a091b58) `sha256:a9c4c51f27d703ae306c7f66215d7f0373c83d3bccfece74122e4a1bc784b3cc`
* [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud) git [f7e3ec30](https://github.com/openshift/cluster-api-provider-ibmcloud/commit/f7e3ec30f746add35458fad54dd6bccb97e307bf) `sha256:b0227a1484aba62ef9cbbfa2af776b5e332e69c0cc5dcc478747820a970ef31f`
* [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [707c2262](https://github.com/openshift/ironic-rhcos-downloader/commit/707c226243ac401f2994952fe0e55823511111b0) `sha256:be5a85ca06d5c5ccf537240399091c49c35b9ffdd90b1be3150e3c23d6df4e3c`
* [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager) git [b95b05fe](https://github.com/openshift/ironic-static-ip-manager/commit/b95b05fe0ba17255ef61e92d4167ca4c9de789b8) `sha256:74c340e0db9f2ef61032853265f181d63633e579e21ed1702351a517373a9181`
* [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy) git [cd636680](https://github.com/openshift/kube-rbac-proxy/commit/cd636680e06a55395c26570dff0cb37277014388) `sha256:2afe1e650f7a2bc2eb7ce312884b1269e46e09583911137ab152cedc3a022511`
* [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator) git [ce5ff17e](https://github.com/openshift/kubernetes-kube-storage-version-migrator/commit/ce5ff17e9a81ce754567e6dd5053d13409c251e9) `sha256:a70be470f96982ba7268063eb7c4fe415449eaf2d606b9e85869953dc2b82606`
* [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt) git [1e6fdd66](https://github.com/openshift/cloud-provider-kubevirt/commit/1e6fdd6615a55fc449b3e7ad2d6e92a27d30a934) `sha256:cb5e9bb12bb7f5cd841fc309bf1c1c627ed3a9bf1e1ffc6258853a87134e7f18`
* [machine-image-customization-controller](https://github.com/openshift/image-customization-controller) git [65aeb360](https://github.com/openshift/image-customization-controller/commit/65aeb3607f05dd71ec27a4457945ce1e054ea9e9) `sha256:ebc01b955eed00d02d1fb9e147e311f7c5f3e37b95cb04751b7e3d44a44ba9fb`
* [metallb-frr](https://github.com/openshift/frr) git [c82bfaad](https://github.com/openshift/frr/commit/c82bfaad01b196e12f00622a9a609d87e0a56701) `sha256:d34a72e0684db752b450d32b6354729ea129533a1967bf29020e1a01ea08a555`
* [multus-admission-controller](https://github.com/openshift/multus-admission-controller) git [d95feb67](https://github.com/openshift/multus-admission-controller/commit/d95feb67adfb97346849c79e36b6a9d404296ae9) `sha256:cdf5faba73232b0f18008ef868054ba183e7890b301c1b1710b123a44f0b209d`
* [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy) git [e9f2f3c7](https://github.com/openshift/multus-networkpolicy/commit/e9f2f3c7e81683af3b8cc9a5a3166434c94e0498) `sha256:15286f60943a90bdad70d5cff5eaef952cdcbcb063b91034a2af664691ff1eba`
* [multus-route-override-cni](https://github.com/openshift/route-override-cni) git [08af4127](https://github.com/openshift/route-override-cni/commit/08af4127c77976510cad1c096d9aca977d8ae5af) `sha256:2ed6cd765c62307186d486139e35584ce657840609d2147d464cae3481404155`
* [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni) git [d691040e](https://github.com/openshift/whereabouts-cni/commit/d691040e509bb20c26b5e8366c0d6f3bb45a5e02) `sha256:526a2ac4ac8a3b16cc43e71f40cd285f79666513fb48205338da74737b4cfc31`
* [network-interface-bond-cni](https://github.com/openshift/bond-cni) git [297eeb43](https://github.com/openshift/bond-cni/commit/297eeb4320e07b18d559bc373b665479c760e8c7) `sha256:e35f17762fc3f961f361749a5e9d544b17011c64187f85e085c763204f33a113`
* [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon) git [844fa588](https://github.com/openshift/network-metrics-daemon/commit/844fa588c4200b8ff768d1916d63f1d4c1db2daf) `sha256:35d1ee61dada1d62dcc613c552ad9918bd7d2a6132a081d53de4775d3d16841c`
* [network-tools](https://github.com/openshift/network-tools) git [d6717e45](https://github.com/openshift/network-tools/commit/d6717e453a098d551c9e2d2868e1f5317c41e688) `sha256:4a572599c92da8b848abf2370d856c274338d8fae91794fe1c2637c3821484cc`
* [nutanix-cloud-controller-manager](https://github.com/openshift/cloud-provider-nutanix) git [33b7bec6](https://github.com/openshift/cloud-provider-nutanix/commit/33b7bec6fe27b8d126982a70b4579112cd67052b) `sha256:364385ab38bf9b077b6a63baf9730d52b75532b7557b7eafcc0d5ff87c1885e6`
* [nutanix-machine-controllers](https://github.com/openshift/machine-api-provider-nutanix) git [b15a665c](https://github.com/openshift/machine-api-provider-nutanix/commit/b15a665cd9c12c5a7d2ac81b5330b6f446c3a8be) `sha256:3540071ae6640cab22f302e96d221c652082b29f971c7eb773d74e00c6bcf97c`
* [oauth-apiserver](https://github.com/openshift/oauth-apiserver) git [71c41b2d](https://github.com/openshift/oauth-apiserver/commit/71c41b2d8abb0c6ad90dca286baf5d03c1340646) `sha256:635cd05557609f17db2a85ee42cd337bfc6e7771c6cac5e1708ddd74a3a41076`
* [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager) git [438d52e7](https://github.com/openshift/openshift-controller-manager/commit/438d52e79d691e016d66eabfe9a53c84229db40c) `sha256:c2fac83c941d042084af1aca86279af5e79b1eec44fc88cd0b79371139492e14`
* [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics) git [ab605a4b](https://github.com/openshift/openshift-state-metrics/commit/ab605a4bf1c6cd5a6c58f245fb67ce648caebfa8) `sha256:3771be49c2be65a1e1929a95d6710da097046eff5df33fa4b4c6ab2ffdb088fc`
* [openstack-resource-controller](https://github.com/openshift/openstack-resource-controller) git [70f5ad34](https://github.com/openshift/openstack-resource-controller/commit/70f5ad34915041c82ad0a8ed6ea64bd8859d1e72) `sha256:409c6272f0bf61886f397cdb18f002dfd89c6f9374b0d53d025f6b72b70d74af`
* [operator-marketplace](https://github.com/operator-framework/operator-marketplace) git [efb1a1ea](https://github.com/operator-framework/operator-marketplace/commit/efb1a1ea40bc1ed3a439812cfdaa3013b80e96ce) `sha256:730acc93ce7aab331d2220b1b715da84d95f41753e58433e819a5eb79e49fe5a`
* [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator) git [b714ab87](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/commit/b714ab87d079db5ef3c4097520db40cd289b025e) `sha256:5c4b6be53048ca3daed42b23ccdc4a59295ee5f9ef60bf36efc489a53f08df6c`
* [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs) git [551974ef](https://github.com/openshift/machine-api-provider-powervs/commit/551974ef93dedb1b9677a778e1533391448e0c56) `sha256:df76abde21dfb52d1f2f397fd7790760a9c908bc3820cca904e55f638023c7e9`
* [prom-label-proxy](https://github.com/openshift/prom-label-proxy) git [610c11b5](https://github.com/openshift/prom-label-proxy/commit/610c11b59dd17f1d6dc35b62ca1d0602b5c0f494) `sha256:e53129eef13d9deaac86d2e0f99a320d5b7b28d8347c5418169db98a679913de`
* [prometheus-config-reloader](https://github.com/openshift/prometheus-operator) git [3de9763f](https://github.com/openshift/prometheus-operator/commit/3de9763f36128ffa8b25a63c9447f6d64114c270) `sha256:32d8ec578bbd6716e84b3f12ae63e637d79aec1b16fb03556784b8ed5fce16d1`
* [prometheus-node-exporter](https://github.com/openshift/node_exporter) git [39d72873](https://github.com/openshift/node_exporter/commit/39d728735779afef886bc10a8bc7cf72f54d51a0) `sha256:015b604a274fa1896122e0e4690585b3a83549f7c8670931a798446eec8963d0`
* [prometheus-operator](https://github.com/openshift/prometheus-operator) git [3de9763f](https://github.com/openshift/prometheus-operator/commit/3de9763f36128ffa8b25a63c9447f6d64114c270) `sha256:41872f8528a5e9d52c4f1acc02682c0f5ebaca4a6ae3c2b175afa117e2b52b9f`
* [prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator) git [3de9763f](https://github.com/openshift/prometheus-operator/commit/3de9763f36128ffa8b25a63c9447f6d64114c270) `sha256:90d2319a9a2c6beea025f4be564f5ce39082fd4d7e74dada5b3012e790942555`
* [service-ca-operator](https://github.com/openshift/service-ca-operator) git [e9622ba1](https://github.com/openshift/service-ca-operator/commit/e9622ba18c86bf24aceab0c19fdcb87339c14f44) `sha256:1f7586513a5097635faee33f4146564c1b0d4edd23c21c2521becba0d402f955`
* [volume-data-source-validator](https://github.com/openshift/volume-data-source-validator) git [8b929332](https://github.com/openshift/volume-data-source-validator/commit/8b9293323cf8fdce93824e37168573ca3f73de3a) `sha256:dd16b208965771f1f4f4110ad261629b00d42c657b83c02f1fd65d2081ada5fe`
* [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere) git [f69584d6](https://github.com/openshift/cloud-provider-vsphere/commit/f69584d6ed7411504b0fff77eb36d0fd64f0fd5e) `sha256:05660177be11cff83ab5eeead870dab47b239dfa78d658f88fb8fa94852a61c4`
* [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator) git [d6a19449](https://github.com/openshift/vmware-vsphere-csi-driver-operator/commit/d6a19449cc5d49541221d48d62c67d7a48142d19) `sha256:b2253b80013505366874f5ae72f49768344fc5b67c9ace427be0ed484bbce02f`


### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/3977af16577a830b9c9c8822fe8f2925b38eac9c)

* [OCPBUGS-105879](https://issues.redhat.com/browse/OCPBUGS-105879): manifest_generator add a label to LUKS root [#10797](https://github.com/openshift/assisted-service/pull/10797)
* [OCPBUGS-92012](https://issues.redhat.com/browse/OCPBUGS-92012): Add sourcedir /run/chrony-dhcp to generated chrony.conf [#10510](https://github.com/openshift/assisted-service/pull/10510)
* [OCPBUGS-86856](https://issues.redhat.com/browse/OCPBUGS-86856): Fix loki and logging [#10425](https://github.com/openshift/assisted-service/pull/10425)
* [OCPBUGS-81843](https://issues.redhat.com/browse/OCPBUGS-81843): Mark raw FC/iSCSI multipath members as ineligible [#10148](https://github.com/openshift/assisted-service/pull/10148)
* [OCPBUGS-81843](https://issues.redhat.com/browse/OCPBUGS-81843): Prefer multipath disk in ABI disk selection [#10112](https://github.com/openshift/assisted-service/pull/10112)
* [Full changelog](https://github.com/openshift/assisted-service/compare/7fe8db1496187a4e30071d117fd847c9eb3761b0...3977af16577a830b9c9c8822fe8f2925b38eac9c)


### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/1d5163811da9ec9eaeea69c252c9495889f624a9)

* [OCPBUGS-85041](https://issues.redhat.com/browse/OCPBUGS-85041): add --copy-network when manual network config is detected [#1446](https://github.com/openshift/assisted-installer-agent/pull/1446)
* [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/e57138265957c81b33d3ac13078d35f6ca07069d...1d5163811da9ec9eaeea69c252c9495889f624a9)


### [agent-installer-ui](https://github.com/openshift-assisted/assisted-installer-ui/tree/ceb80cf713675916334a5d116759805bf6687643)

* Update OWNERS file (#3991) [#3991](https://github.com/openshift-assisted/assisted-installer-ui/pull/3991)
* Bug OCPBUGS-100525,OCPBUGS-103013: Bump ip-address to 10.5.0 to fix CVE-2026-54272 and CVE-2026-69192 (#3986) [#3986](https://github.com/openshift-assisted/assisted-installer-ui/pull/3986)
* [OCPBUGS-109782](https://issues.redhat.com/browse/OCPBUGS-109782): Bump tar pkg to ^7.5.21 to address CVE-2026-73566 (#3971) [#3971](https://github.com/openshift-assisted/assisted-installer-ui/pull/3971)
* [OCPBUGS-104484](https://issues.redhat.com/browse/OCPBUGS-104484): Pin minimatch to ^10.2.6 and brace-expansion to ^5.0.9 (CVE-2026-14257) (#3960) [#3960](https://github.com/openshift-assisted/assisted-installer-ui/pull/3960)
* move @types/react-dom to dependencies to fix Hermeto (#3956) [#3956](https://github.com/openshift-assisted/assisted-installer-ui/pull/3956)
* [OCPBUGS-99307](https://issues.redhat.com/browse/OCPBUGS-99307): 4.21 agent-installer OVE installation fails due to custom-manifests (#3914) [#3914](https://github.com/openshift-assisted/assisted-installer-ui/pull/3914)
* [OCPBUGS-91632](https://issues.redhat.com/browse/OCPBUGS-91632): Bump ws to 8.21.0 for CVE-2026-45736 (#3905) [#3905](https://github.com/openshift-assisted/assisted-installer-ui/pull/3905)
* [OCPBUGS-98269](https://issues.redhat.com/browse/OCPBUGS-98269): Bump tar to 7.5.19 in 4.21 (#3893) [#3893](https://github.com/openshift-assisted/assisted-installer-ui/pull/3893)
* [OCPBUGS-98435](https://issues.redhat.com/browse/OCPBUGS-98435): Bump js-yaml to 4.3.0 in 4.21 (#3877) [#3877](https://github.com/openshift-assisted/assisted-installer-ui/pull/3877)
* [OCPBUGS-89700](https://issues.redhat.com/browse/OCPBUGS-89700): bump form-data to 2.5.6 and 4.0.6 via scoped resolutions to address CVE-2026-12143 (#3878) [#3878](https://github.com/openshift-assisted/assisted-installer-ui/pull/3878)
* Update OWNERS file (#3882) [#3882](https://github.com/openshift-assisted/assisted-installer-ui/pull/3882)
* Apply patches (#3875) [#3875](https://github.com/openshift-assisted/assisted-installer-ui/pull/3875)
* patch CVE-2026-9277 and CVE-2026-42338 via yarn resolutions (#3853) [#3853](https://github.com/openshift-assisted/assisted-installer-ui/pull/3853)
* [OCPBUGS-88390](https://issues.redhat.com/browse/OCPBUGS-88390), [OCPBUGS-88411](https://issues.redhat.com/browse/OCPBUGS-88411): Bump axios to 1.18.1 (#3858) [#3858](https://github.com/openshift-assisted/assisted-installer-ui/pull/3858)
* prefill staticip on ove below the sea (#3769) [#3769](https://github.com/openshift-assisted/assisted-installer-ui/pull/3769)
* Custom manifests are broken in local Assisted UI (#3770) [#3770](https://github.com/openshift-assisted/assisted-installer-ui/pull/3770)
* Operators section should not be displayed on review and installation progress pages when no operators are selected (#3751) [#3751](https://github.com/openshift-assisted/assisted-installer-ui/pull/3751)
* Remove Arbiter button (#3749) [#3749](https://github.com/openshift-assisted/assisted-installer-ui/pull/3749)
* [OCPBUGS-85541](https://issues.redhat.com/browse/OCPBUGS-85541): Bump msw pkg version to 2.13.5 (#3729) [#3729](https://github.com/openshift-assisted/assisted-installer-ui/pull/3729)
* fix monted pull secret parsing (#3727) [#3727](https://github.com/openshift-assisted/assisted-installer-ui/pull/3727)
* [OCPBUGS-84235](https://issues.redhat.com/browse/OCPBUGS-84235): add pull secret auto populate logic to ABI local UI (#3509) [#3509](https://github.com/openshift-assisted/assisted-installer-ui/pull/3509)
* Allow to install SNO topology (#3722) [#3722](https://github.com/openshift-assisted/assisted-installer-ui/pull/3722)
* [OCPBUGS-85261](https://issues.redhat.com/browse/OCPBUGS-85261): [release-4.21] OCPBUGS-84147 | [Below the sea UI] Leaky Abstraction: Transient 500 errors exposed during host binding process (#3684) [#3684](https://github.com/openshift-assisted/assisted-installer-ui/pull/3684)
* Remove 2 node arbiter option from the control plane dropdown option (#3680) [#3680](https://github.com/openshift-assisted/assisted-installer-ui/pull/3680)
* [OCPBUGS-84608](https://issues.redhat.com/browse/OCPBUGS-84608), [OCPBUGS-84830](https://issues.redhat.com/browse/OCPBUGS-84830), [OCPBUGS-84993](https://issues.redhat.com/browse/OCPBUGS-84993), [OCPBUGS-85009](https://issues.redhat.com/browse/OCPBUGS-85009), [OCPBUGS-85039](https://issues.redhat.com/browse/OCPBUGS-85039): Bump axios to ^1.15.1 (#3690) [#3690](https://github.com/openshift-assisted/assisted-installer-ui/pull/3690)
* [MGMT-24152](https://issues.redhat.com/browse/MGMT-24152): UI allows editing pull secret in draft cluster (#3674) [#3674](https://github.com/openshift-assisted/assisted-installer-ui/pull/3674)
* Update OWNERS file (#3654) [#3654](https://github.com/openshift-assisted/assisted-installer-ui/pull/3654)
* Bump happy-dom from 20.0.2 to 20.8.9 (#3525) [#3525](https://github.com/openshift-assisted/assisted-installer-ui/pull/3525)
* fix operators list in ABI below the sea (#3599) [#3599](https://github.com/openshift-assisted/assisted-installer-ui/pull/3599)
* [OCPBUGS-81589](https://issues.redhat.com/browse/OCPBUGS-81589): bump react-router-dom-v5-compat to ^6.30.3 to address CVE-2026-22029 (#3581) [#3581](https://github.com/openshift-assisted/assisted-installer-ui/pull/3581)
* [OCPBUGS-83303](https://issues.redhat.com/browse/OCPBUGS-83303): bump axios to ^1.15.0 for fixing CVE-2026-40175 (#3583) [#3583](https://github.com/openshift-assisted/assisted-installer-ui/pull/3583)
* [OCPBUGS-81587](https://issues.redhat.com/browse/OCPBUGS-81587): upgrade lodash and lodash-es to 4.17.23 to address CVE-2025-13465 (#3535) [#3535](https://github.com/openshift-assisted/assisted-installer-ui/pull/3535)
* [Full changelog](https://github.com/openshift-assisted/assisted-installer-ui/compare/80dfa980e9a6c449a77e973cd17319f38479a689...ceb80cf713675916334a5d116759805bf6687643)


### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/cc8ca89bc5a0ce79227e8ab0860693950608ca04)

* [OCPBUGS-105452](https://issues.redhat.com/browse/OCPBUGS-105452): Update Konflux references [#335](https://github.com/openshift/agent-installer-utils/pull/335)
* [OCPBUGS-101761](https://issues.redhat.com/browse/OCPBUGS-101761): Update Konflux references [#330](https://github.com/openshift/agent-installer-utils/pull/330)
* [OCPBUGS-100311](https://issues.redhat.com/browse/OCPBUGS-100311): Update Konflux release version to 4.21.27 [#326](https://github.com/openshift/agent-installer-utils/pull/326)
* [OCPBUGS-99907](https://issues.redhat.com/browse/OCPBUGS-99907): Update Konflux references [#304](https://github.com/openshift/agent-installer-utils/pull/304)
* [OCPBUGS-99647](https://issues.redhat.com/browse/OCPBUGS-99647): Use agent-preinstall-image-builder from quay-proxy [#322](https://github.com/openshift/agent-installer-utils/pull/322)
* [OCPBUGS-98628](https://issues.redhat.com/browse/OCPBUGS-98628): Increase time for Konflux on-push job [#318](https://github.com/openshift/agent-installer-utils/pull/318)
* [OCPBUGS-98628](https://issues.redhat.com/browse/OCPBUGS-98628): Increase resources for syft [#317](https://github.com/openshift/agent-installer-utils/pull/317)
* [OCPBUGS-98628](https://issues.redhat.com/browse/OCPBUGS-98628): Update Konflux version to 4.21.24 [#314](https://github.com/openshift/agent-installer-utils/pull/314)
* [OCPBUGS-84120](https://issues.redhat.com/browse/OCPBUGS-84120): Update OCP version for Konflux [#301](https://github.com/openshift/agent-installer-utils/pull/301)
* [OCPBUGS-85526](https://issues.redhat.com/browse/OCPBUGS-85526): update konflux references [#287](https://github.com/openshift/agent-installer-utils/pull/287)
* [OCPBUGS-83852](https://issues.redhat.com/browse/OCPBUGS-83852): Pass environment through to podman [#292](https://github.com/openshift/agent-installer-utils/pull/292)
* [OCPBUGS-82588](https://issues.redhat.com/browse/OCPBUGS-82588): Update OCP version in Konflux [#285](https://github.com/openshift/agent-installer-utils/pull/285)
* [OCPBUGS-82539](https://issues.redhat.com/browse/OCPBUGS-82539): Update Konflux references [#265](https://github.com/openshift/agent-installer-utils/pull/265)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/a2d420318e5cf209993acc9d515f55a2c207bc60...cc8ca89bc5a0ce79227e8ab0860693950608ca04)


### [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver/tree/1d8cec7d0eeedf1497c3ee6c32ee3391ebb13709)

* [OCPBUGS-80734](https://issues.redhat.com/browse/OCPBUGS-80734): Bump google.golang.org/grpc to v1.79.3 [#310](https://github.com/openshift/aws-ebs-csi-driver/pull/310)
* [Full changelog](https://github.com/openshift/aws-ebs-csi-driver/compare/57eebffcc8abbbbb6edcf3b536b769d97e31819c...1d8cec7d0eeedf1497c3ee6c32ee3391ebb13709)


### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/5f992443bef481a73eaadca79085b81435a59bdd)

* [OCPBUGS-109655](https://issues.redhat.com/browse/OCPBUGS-109655): csi-driver-smb: DeleteVolume call fails to mkdir under /tmp [#598](https://github.com/openshift/csi-operator/pull/598)
* [OCPBUGS-85572](https://issues.redhat.com/browse/OCPBUGS-85572): Add init container for Manila node daemonset [#554](https://github.com/openshift/csi-operator/pull/554)
* [OCPBUGS-85234](https://issues.redhat.com/browse/OCPBUGS-85234): Mount writable /tmp in SMB CSI driver [#551](https://github.com/openshift/csi-operator/pull/551)
* [OCPBUGS-80844](https://issues.redhat.com/browse/OCPBUGS-80844): Bump google.golang.org/grpc to v1.79.3 [#539](https://github.com/openshift/csi-operator/pull/539)
* [Full changelog](https://github.com/openshift/csi-operator/compare/181ea25a74b12d1641ef2e0021228311e56626de...5f992443bef481a73eaadca79085b81435a59bdd)


### [aws-karpenter-provider-aws](https://github.com/openshift/aws-karpenter-provider-aws/tree/f4af9b89aed3a47b2168d7bd5a7dd8b6453f1945)

* [OCPBUGS-104008](https://issues.redhat.com/browse/OCPBUGS-104008): Fix CVE-2026-33814 [#36](https://github.com/openshift/aws-karpenter-provider-aws/pull/36)
* [Full changelog](https://github.com/openshift/aws-karpenter-provider-aws/compare/ff9c8d4e8fdc55d3e60c6add0942c018826ae870...f4af9b89aed3a47b2168d7bd5a7dd8b6453f1945)


### [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider/tree/887615ffa8a595ee3693e92fa56db4dd30f20f73)

* [OCPBUGS-80711](https://issues.redhat.com/browse/OCPBUGS-80711): Bump google.golang.org/grpc to v1.79.3 [#40](https://github.com/openshift/aws-encryption-provider/pull/40)
* [Full changelog](https://github.com/openshift/aws-encryption-provider/compare/19e7b623429799c9c549690a1b5ab499844411f9...887615ffa8a595ee3693e92fa56db4dd30f20f73)


### [azure-cloud-controller-manager, azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure/tree/c9afac2fda20f18d786271340826c628f5419150)

* [OCPBUGS-80738](https://issues.redhat.com/browse/OCPBUGS-80738), [OCPBUGS-80739](https://issues.redhat.com/browse/OCPBUGS-80739): Bump google.golang.org/grpc to v1.79.3 [#178](https://github.com/openshift/cloud-provider-azure/pull/178)
* [Full changelog](https://github.com/openshift/cloud-provider-azure/compare/83b3f9ec7df408c3d53d5f8e6fe84e0bdd4398e8...c9afac2fda20f18d786271340826c628f5419150)


### [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure/tree/3ae65a465e6da7d92ecec285fe8543acd8bb3dd4)

* [OCPBUGS-89991](https://issues.redhat.com/browse/OCPBUGS-89991): Address CVE-2026-39829 [#398](https://github.com/openshift/cluster-api-provider-azure/pull/398)
* [OCPBUGS-80740](https://issues.redhat.com/browse/OCPBUGS-80740): Bump google.golang.org/grpc to v1.79.3 [#383](https://github.com/openshift/cluster-api-provider-azure/pull/383)
* [Full changelog](https://github.com/openshift/cluster-api-provider-azure/compare/5d6af81d7ab9b289c3def6c0350313118d63923a...3ae65a465e6da7d92ecec285fe8543acd8bb3dd4)


### [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver/tree/8318a54892a51c76e3233e2fd60fb5d499afb6dc)

* [OCPBUGS-96484](https://issues.redhat.com/browse/OCPBUGS-96484): Bump golang.org/x/net to  v0.55.0 [#166](https://github.com/openshift/azure-disk-csi-driver/pull/166)
* [OCPBUGS-85285](https://issues.redhat.com/browse/OCPBUGS-85285): check for node name in waitForDiskManagedByTobeRemoved [#147](https://github.com/openshift/azure-disk-csi-driver/pull/147)
* UPSTREAM: 3569: OCPBUGS-80741: Bump grpc to v1.79.3 [#137](https://github.com/openshift/azure-disk-csi-driver/pull/137)
* [Full changelog](https://github.com/openshift/azure-disk-csi-driver/compare/30e9538b918b1a43ea613832a4be305576dcbae4...8318a54892a51c76e3233e2fd60fb5d499afb6dc)


### [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver/tree/c783955a815aa0ecb5c6e92daf918c365295fa09)

* [OCPBUGS-111837](https://issues.redhat.com/browse/OCPBUGS-111837): fix failing unit tests in azure-file-csi-driver [#152](https://github.com/openshift/azure-file-csi-driver/pull/152)
* [OCPBUGS-92988](https://issues.redhat.com/browse/OCPBUGS-92988): Bump golang.org/x/crypto to v0.48.0-sec.1 [#145](https://github.com/openshift/azure-file-csi-driver/pull/145)
* UPSTREAM: 3023: OCPBUGS-80744: Bump grpc to v1.79.3 [#125](https://github.com/openshift/azure-file-csi-driver/pull/125)
* [Full changelog](https://github.com/openshift/azure-file-csi-driver/compare/c77d75f90b7f84dfc25ba3439bc5eff87c3a2755...c783955a815aa0ecb5c6e92daf918c365295fa09)


### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/97a682d9baff04f7c873ae378dee4afb6b697252)

* [OCPBUGS-104007](https://issues.redhat.com/browse/OCPBUGS-104007): [release-4.21] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#58](https://github.com/openshift/azure-kubernetes-kms/pull/58)
* [OCPBUGS-80712](https://issues.redhat.com/browse/OCPBUGS-80712): Bump google.golang.org/grpc to 1.64.1-sec.1 patch [#34](https://github.com/openshift/azure-kubernetes-kms/pull/34)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/fe1d311ba5aadc40b5f48d47d43175157a73c881...97a682d9baff04f7c873ae378dee4afb6b697252)


### [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure/tree/782f0ab6a2636aef0f699cfe7a49e8fadefb9807)

* [PIXAA-7](https://issues.redhat.com/browse/PIXAA-7): Leverage SpotRebalanceRecommendation for instance termination when available [#199](https://github.com/openshift/machine-api-provider-azure/pull/199)
* [Full changelog](https://github.com/openshift/machine-api-provider-azure/compare/b8b8cb1c5af7d2a3ef9a4a99a0739a2166a7932c...782f0ab6a2636aef0f699cfe7a49e8fadefb9807)


### [azure-service-operator](https://github.com/openshift/azure-service-operator/tree/5e84c83176d7630f70802b35cb10cdf2b60fd6d3)

* [OCPBUGS-80713](https://issues.redhat.com/browse/OCPBUGS-80713): Bump google.golang.org/grpc to v1.79.3 [#28](https://github.com/openshift/azure-service-operator/pull/28)
* [OCPBUGS-83864](https://issues.redhat.com/browse/OCPBUGS-83864): UPSTREAM: &lt;carry&gt;: add openshift/e2e-tests.sh [#24](https://github.com/openshift/azure-service-operator/pull/24)
* [Full changelog](https://github.com/openshift/azure-service-operator/compare/17e574628ee7ef8aa694cfc0ab5e5232b651fbf8...5e84c83176d7630f70802b35cb10cdf2b60fd6d3)


### [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity/tree/ae8ffaf0b4a893e9b38fb4007de3cef8492b71f3)

* [OCPBUGS-81978](https://issues.redhat.com/browse/OCPBUGS-81978): Bump go-jose/go-jose/v4@v4.1.4 [#50](https://github.com/openshift/azure-workload-identity/pull/50)
* [Full changelog](https://github.com/openshift/azure-workload-identity/compare/3f2a6e0d1ea68af321f9674b0b097939be7d2014...ae8ffaf0b4a893e9b38fb4007de3cef8492b71f3)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/8c6b7f3e85ba330aee741b9f719f44d4ecf470d2)

* [OCPBUGS-112472](https://issues.redhat.com/browse/OCPBUGS-112472): Update timeout in GetMarketplaceImage to 5 minutes [#10785](https://github.com/openshift/installer/pull/10785)
* [OCPBUGS-104042](https://issues.redhat.com/browse/OCPBUGS-104042): Bump golang.org/x/net to v0.50.0-sec.4 [#10806](https://github.com/openshift/installer/pull/10806)
* [OCPBUGS-113535](https://issues.redhat.com/browse/OCPBUGS-113535): Update RHCOS-release-4.21 bootimage metadata to 9.6.20260815-0 [#10792](https://github.com/openshift/installer/pull/10792)
* [OCPBUGS-87813](https://issues.redhat.com/browse/OCPBUGS-87813): [release-4.21] fix: reset associatedVCenter in failure domain validation loop [#10605](https://github.com/openshift/installer/pull/10605)
* [OCPBUGS-112029](https://issues.redhat.com/browse/OCPBUGS-112029): Bump google-cloud-cli to 563.0.0-1 [#10769](https://github.com/openshift/installer/pull/10769)
* [OCPBUGS-76552](https://issues.redhat.com/browse/OCPBUGS-76552): Revert storage account API version for client [#10296](https://github.com/openshift/installer/pull/10296)
* [OCPBUGS-87815](https://issues.redhat.com/browse/OCPBUGS-87815): [release-4.21] Add omitempty to vSphere and Nutanix MachinePool slice fields [#10607](https://github.com/openshift/installer/pull/10607)
* [OCPBUGS-88740](https://issues.redhat.com/browse/OCPBUGS-88740): Update RHCOS-release-4.21 data/data/coreos/rhcos.json to 9.6.20260616-0 [#10651](https://github.com/openshift/installer/pull/10651)
* [OCPBUGS-81986](https://issues.redhat.com/browse/OCPBUGS-81986): Bump go-jose/v4 to 4.1.4 [#10598](https://github.com/openshift/installer/pull/10598)
* [OCPBUGS-77049](https://issues.redhat.com/browse/OCPBUGS-77049): Update RHCOS-release-4.21 bootimage metadata to 9.6.20260520-0 [#10579](https://github.com/openshift/installer/pull/10579)
* [OCPBUGS-82068](https://issues.redhat.com/browse/OCPBUGS-82068): Azure: Sign blob container using user delegated creds [#10465](https://github.com/openshift/installer/pull/10465)
* [OCPBUGS-84225](https://issues.redhat.com/browse/OCPBUGS-84225): ibmcloud: bump vpc-go-sdk and capibm [#10514](https://github.com/openshift/installer/pull/10514)
* [OCPBUGS-82439](https://issues.redhat.com/browse/OCPBUGS-82439): [release-4.21] Mount pullsecret manifest to UI container [#10489](https://github.com/openshift/installer/pull/10489)
* [Full changelog](https://github.com/openshift/installer/compare/6285755d199e7aa7bf29db5fe6964ce7f3684ed9...8c6b7f3e85ba330aee741b9f719f44d4ecf470d2)


### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/d5c58b32e71e0e979e190b40a3804d012509d93b)

* [OCPBUGS-97982](https://issues.redhat.com/browse/OCPBUGS-97982): Add BMH finalizer on PreprovisioningImage [#506](https://github.com/openshift/baremetal-operator/pull/506)
* [OCPBUGS-87964](https://issues.redhat.com/browse/OCPBUGS-87964): Fix preprovisioning network Secret lifecycle during BMH deletion [#492](https://github.com/openshift/baremetal-operator/pull/492)
* [OCPBUGS-82141](https://issues.redhat.com/browse/OCPBUGS-82141): Fix PPI for ACM [#476](https://github.com/openshift/baremetal-operator/pull/476)
* [Full changelog](https://github.com/openshift/baremetal-operator/compare/9b3a716e8e4809b40f79627dd2a5deb365e088d9...d5c58b32e71e0e979e190b40a3804d012509d93b)


### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/4717c66ce35180eea2efcd759aeec77bdc611375)

* Fix for OCPBUGS-88239: CVE-2026-39821 [#2361](https://github.com/openshift/oc/pull/2361)
* [OCPBUGS-98550](https://issues.redhat.com/browse/OCPBUGS-98550): Revert pull request 2310 [#2348](https://github.com/openshift/oc/pull/2348)
* [OCPBUGS-98550](https://issues.redhat.com/browse/OCPBUGS-98550): bump x/crypto to the latest version [#2310](https://github.com/openshift/oc/pull/2310)
* [OCPBUGS-81981](https://issues.redhat.com/browse/OCPBUGS-81981): Bump go-jose/go-jose/v4 to v4.1.4 [#2271](https://github.com/openshift/oc/pull/2271)
* [Full changelog](https://github.com/openshift/oc/compare/9d9df34c46c9deba8c291a2a084de5724c0bd820...4717c66ce35180eea2efcd759aeec77bdc611375)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/bd0a5785a37eeccedb3ba357eb4254860acd6ef4)

* NO-JIRA: Revert "OCPBUGS-87110 Scope minted AWS IAM policies to cluster-owned resources" [#1060](https://github.com/openshift/cloud-credential-operator/pull/1060)
* [OCPBUGS-87110](https://issues.redhat.com/browse/OCPBUGS-87110): Scope minted AWS IAM policies to cluster-owned resources [#1046](https://github.com/openshift/cloud-credential-operator/pull/1046)
* [OCPBUGS-81982](https://issues.redhat.com/browse/OCPBUGS-81982): Bump go-jose/go-jose/v4@v4.1.4 [#1027](https://github.com/openshift/cloud-credential-operator/pull/1027)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/693d9f3485b21cf128fa379eabd6787737fa56ad...bd0a5785a37eeccedb3ba357eb4254860acd6ef4)


### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/65eb4b2193d0860c1c1f45b08ea7203694db909f)

* [OCPBUGS-81677](https://issues.redhat.com/browse/OCPBUGS-81677): Do not return error when an IdP returns 500 during a grant check [#868](https://github.com/openshift/cluster-authentication-operator/pull/868)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/d235c0bb7443119e12ec2c8db57035f652f1d871...65eb4b2193d0860c1c1f45b08ea7203694db909f)


### [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler/tree/a921db0077641ab179c3048c9b5d21f54bb36e55)

* [OCPBUGS-109654](https://issues.redhat.com/browse/OCPBUGS-109654): UPSTREAM: 9458: fix(clusterapi): use kind-aware version discovery for infra references [#436](https://github.com/openshift/kubernetes-autoscaler/pull/436)
* [Full changelog](https://github.com/openshift/kubernetes-autoscaler/compare/838a5957d0bebc33c7a0a8a7efd4f5dcb4098286...a921db0077641ab179c3048c9b5d21f54bb36e55)


### [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator/tree/b2423439fe1004bae5e84500cf449d033c1f0378)

* [OCPBUGS-104038](https://issues.redhat.com/browse/OCPBUGS-104038): Bump x/net package in release-4.21 [#386](https://github.com/openshift/cluster-autoscaler-operator/pull/386)
* [Full changelog](https://github.com/openshift/cluster-autoscaler-operator/compare/dec12ba632a4810b4ff43a9172f462a1dd291e44...b2423439fe1004bae5e84500cf449d033c1f0378)


### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/13af370f526ab7541a8a73aa0d94952496ccca58)

* [OCPBUGS-88481](https://issues.redhat.com/browse/OCPBUGS-88481): Fix empty IRONIC_BASE_URL [#614](https://github.com/openshift/cluster-baremetal-operator/pull/614)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/18e163a4c14db692938da08b7bec821d483945f9...13af370f526ab7541a8a73aa0d94952496ccca58)


### [cluster-capi-controllers](https://github.com/openshift/cluster-api/tree/9dd5eba07922bb84bf1ec2b16cbbedd6ad195874)

* [OCPBUGS-80749](https://issues.redhat.com/browse/OCPBUGS-80749): Bump google.golang.org/grpc to v1.79.3 [#293](https://github.com/openshift/cluster-api/pull/293)
* [Full changelog](https://github.com/openshift/cluster-api/compare/a957484acb353220da0d3062867168d24494a2b6...9dd5eba07922bb84bf1ec2b16cbbedd6ad195874)


### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/f9513d3255926b63185a5b5203126699925133c3)

* NO-JIRA: Allow sustaining engineering to self serve dependency updates [#554](https://github.com/openshift/cluster-capi-operator/pull/554)
* [OCPBUGS-80753](https://issues.redhat.com/browse/OCPBUGS-80753): Bump google.golang.org/grpc to v1.79.3 [#550](https://github.com/openshift/cluster-capi-operator/pull/550)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/80728a61725bb6ec7f4515c2ac2b3a249f3c5742...f9513d3255926b63185a5b5203126699925133c3)


### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/c050cf15d939b1456e99caa71a46fb797d7b56c1)

* [OCPBUGS-82034](https://issues.redhat.com/browse/OCPBUGS-82034): Add delete permission for Azure load balancers in credentials request [#441](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/441)
* [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/6148c0cca626bcf0bfebcc6dd0c77a41944cba87...c050cf15d939b1456e99caa71a46fb797d7b56c1)


### [cluster-config-api](https://github.com/openshift/api/tree/1cb630ce7109e6c4780332bb8140c8c4f7157426)

* [OCPBUGS-98251](https://issues.redhat.com/browse/OCPBUGS-98251): add new serviceAccountToken fs type [#2924](https://github.com/openshift/api/pull/2924)
* [OCPBUGS-78330](https://issues.redhat.com/browse/OCPBUGS-78330), [OCPBUGS-82146](https://issues.redhat.com/browse/OCPBUGS-82146), [OCPBUGS-85550](https://issues.redhat.com/browse/OCPBUGS-85550), [OCPBUGS-88295](https://issues.redhat.com/browse/OCPBUGS-88295), [OCPBUGS-88297](https://issues.redhat.com/browse/OCPBUGS-88297): NE-2480: Promote GatewayAPIWithoutOLM feature gate to Default [#2865](https://github.com/openshift/api/pull/2865)
* [OCPBUGS-78330](https://issues.redhat.com/browse/OCPBUGS-78330), [OCPBUGS-82146](https://issues.redhat.com/browse/OCPBUGS-82146), [OCPBUGS-85550](https://issues.redhat.com/browse/OCPBUGS-85550), [OCPBUGS-88295](https://issues.redhat.com/browse/OCPBUGS-88295), [OCPBUGS-88297](https://issues.redhat.com/browse/OCPBUGS-88297): Promote GatewayAPIWithoutOLM feature gate to TechPreview [#2873](https://github.com/openshift/api/pull/2873)
* [OCPBUGS-85149](https://issues.redhat.com/browse/OCPBUGS-85149): Backport GatewayAPIWithoutOLM feature gate as disabled [#2864](https://github.com/openshift/api/pull/2864)
* [OCPBUGS-86493](https://issues.redhat.com/browse/OCPBUGS-86493): Add labelSelector to MachineSet status for scale subresource [#2857](https://github.com/openshift/api/pull/2857)
* [OCPBUGS-83756](https://issues.redhat.com/browse/OCPBUGS-83756): fix(config/v1): define constants for authentication types as typed constants [#2815](https://github.com/openshift/api/pull/2815)
* [CNTRLPLANE-2796](https://issues.redhat.com/browse/CNTRLPLANE-2796): promote the event-ttl feature [#2809](https://github.com/openshift/api/pull/2809)
* [OCPBUGS-82578](https://issues.redhat.com/browse/OCPBUGS-82578): [release-4.21] postpone the removal of the DeploymentConfig API [#2801](https://github.com/openshift/api/pull/2801)
* [Full changelog](https://github.com/openshift/api/compare/b0658d22beea435e3a576165207416842cb2753b...1cb630ce7109e6c4780332bb8140c8c4f7157426)


### [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator/tree/c4fdb41e357280bfa7e8ebbc934007a657168310)

* [OCPBUGS-90510](https://issues.redhat.com/browse/OCPBUGS-90510): Fixed issue where nameserver is not set when recreating cpms [#411](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/411)
* [Full changelog](https://github.com/openshift/cluster-control-plane-machine-set-operator/compare/2dde33fb94aae47b460a5f6a672d06c9ee4225d8...c4fdb41e357280bfa7e8ebbc934007a657168310)


### [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator/tree/8c1ebc60a2014ab925cbad6ef255e06ea0bd72b4)

* [OCPBUGS-82971](https://issues.redhat.com/browse/OCPBUGS-82971): Fix PDB unhealthyPodEvictionPolicy field name [#272](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/272)
* [Full changelog](https://github.com/openshift/cluster-csi-snapshot-controller-operator/compare/43ad01e88038be54792f16f0d692b96da1244404...8c1ebc60a2014ab925cbad6ef255e06ea0bd72b4)


### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/1cad682c3cdb0db2bd19c4cba27098703477734f)

* [OCPBUGS-100121](https://issues.redhat.com/browse/OCPBUGS-100121): Revert 'OCPBUGS-88490: fix etcd operator deadlock when etcd-endpoints configmap is stale' [#1662](https://github.com/openshift/cluster-etcd-operator/pull/1662)
* [OCPBUGS-90543](https://issues.redhat.com/browse/OCPBUGS-90543): fix etcd operator deadlock when etcd-endpoints configmap is stale [#1637](https://github.com/openshift/cluster-etcd-operator/pull/1637)
* [OCPBUGS-84336](https://issues.redhat.com/browse/OCPBUGS-84336): fix(tnf): gate dual-replica setup and keep retrying [#1620](https://github.com/openshift/cluster-etcd-operator/pull/1620)
* [OCPBUGS-84336](https://issues.redhat.com/browse/OCPBUGS-84336): fix(tnf): align Pacemaker kubelet and etcd retry pacing [#1604](https://github.com/openshift/cluster-etcd-operator/pull/1604)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/5c38f917a43058c73479673a05d4e782524a3a41...1cad682c3cdb0db2bd19c4cba27098703477734f)


### [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator/tree/044fc0bce30bed270732f61213e2895d667ebf87)

* [OCPBUGS-75001](https://issues.redhat.com/browse/OCPBUGS-75001): Backport Azure ARM SDK migration and Azure Stack Hub compatibility [#1303](https://github.com/openshift/cluster-image-registry-operator/pull/1303)
* [Full changelog](https://github.com/openshift/cluster-image-registry-operator/compare/b2dfc3bba3dfd8dba90918a4a3be74deb3c548dd...044fc0bce30bed270732f61213e2895d667ebf87)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/e45a96d194a3eea3178c1fe046a9b68220254173)

* [OCPBUGS-104065](https://issues.redhat.com/browse/OCPBUGS-104065): Replace golang.org/x/net with github.com/openshift-sustaining/net v0.50.0-sec.3 to mitigate CVE-2026-33814 [#1554](https://github.com/openshift/cluster-ingress-operator/pull/1554)
* [OCPBUGS-99453](https://issues.redhat.com/browse/OCPBUGS-99453): Respect proxy configuration on gwapi provisioning [#1518](https://github.com/openshift/cluster-ingress-operator/pull/1518)
* [OCPBUGS-99909](https://issues.redhat.com/browse/OCPBUGS-99909): E2E test for internal LoadBalancer Annotations [#1525](https://github.com/openshift/cluster-ingress-operator/pull/1525)
* [OCPBUGS-99483](https://issues.redhat.com/browse/OCPBUGS-99483): Add e2e test for Gateway API infrastructure annotations [#1520](https://github.com/openshift/cluster-ingress-operator/pull/1520)
* [OCPBUGS-94189](https://issues.redhat.com/browse/OCPBUGS-94189): Add INFO logs alongside event recorder calls [#1489](https://github.com/openshift/cluster-ingress-operator/pull/1489)
* [OCPBUGS-98966](https://issues.redhat.com/browse/OCPBUGS-98966): Bump Istio version from v1.27.3 to v1.27.8 [#1509](https://github.com/openshift/cluster-ingress-operator/pull/1509)
* [OCPBUGS-78330](https://issues.redhat.com/browse/OCPBUGS-78330), [OCPBUGS-82146](https://issues.redhat.com/browse/OCPBUGS-82146), [OCPBUGS-85550](https://issues.redhat.com/browse/OCPBUGS-85550), [OCPBUGS-88295](https://issues.redhat.com/browse/OCPBUGS-88295), [OCPBUGS-88297](https://issues.redhat.com/browse/OCPBUGS-88297): Remove feature-set annotations from Sail Library RBAC Manifests [#1462](https://github.com/openshift/cluster-ingress-operator/pull/1462)
* [OCPBUGS-78330](https://issues.redhat.com/browse/OCPBUGS-78330), [OCPBUGS-82146](https://issues.redhat.com/browse/OCPBUGS-82146), [OCPBUGS-85550](https://issues.redhat.com/browse/OCPBUGS-85550), [OCPBUGS-88295](https://issues.redhat.com/browse/OCPBUGS-88295), [OCPBUGS-88297](https://issues.redhat.com/browse/OCPBUGS-88297): Replace OLM-based Istio install with Sail Library [#1442](https://github.com/openshift/cluster-ingress-operator/pull/1442)
* [OCPBUGS-86718](https://issues.redhat.com/browse/OCPBUGS-86718): Add configuration override for X-SSL strip [#1471](https://github.com/openshift/cluster-ingress-operator/pull/1471)
* [OCPBUGS-85149](https://issues.redhat.com/browse/OCPBUGS-85149): Fix e2e tests to work on platforms with unmanaged DNS [#1437](https://github.com/openshift/cluster-ingress-operator/pull/1437)
* [OCPBUGS-74373](https://issues.redhat.com/browse/OCPBUGS-74373): Remove restriction of unmanaged x-k8s.io [#1446](https://github.com/openshift/cluster-ingress-operator/pull/1446)
* [OCPBUGS-86027](https://issues.redhat.com/browse/OCPBUGS-86027): Fix logging for unmanaged controllers [#1448](https://github.com/openshift/cluster-ingress-operator/pull/1448)
* [OCPBUGS-80759](https://issues.redhat.com/browse/OCPBUGS-80759): Authorization bypass due to improper HTTP/2 path validation [#1441](https://github.com/openshift/cluster-ingress-operator/pull/1441)
* [OCPBUGS-82544](https://issues.redhat.com/browse/OCPBUGS-82544): set trustBundleName in Istio global values [#1418](https://github.com/openshift/cluster-ingress-operator/pull/1418)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/c2ed7331f378e499b2092f04ca7aaf8b3a075274...e45a96d194a3eea3178c1fe046a9b68220254173)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/dc1c217c263cd220ddd2ed6fe827a466d47e3ebb)

* [OCPBUGS-81747](https://issues.redhat.com/browse/OCPBUGS-81747): scc: fix uid{Min,Max}Range for nested-container [#2092](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2092)
* [OCPBUGS-85563](https://issues.redhat.com/browse/OCPBUGS-85563): [4.21] operator should not override authentication config serviceAccountIssuer with the default one during the operator initialization [#2151](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2151)
* [OCPBUGS-85270](https://issues.redhat.com/browse/OCPBUGS-85270): fsync static pod cert and manifest writes for crash durability [#2144](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2144)
* [OCPBUGS-83855](https://issues.redhat.com/browse/OCPBUGS-83855): Allow setting the oauthMetadata when auth type is None [#2116](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2116)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/8ee10fb411a0c7f0e91b3e6d9e3bd3843a93e882...dc1c217c263cd220ddd2ed6fe827a466d47e3ebb)


### [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator/tree/5ef1df3be41d38ddae9b3d22ce51ba486939e9f1)

* [OCPBUGS-83737](https://issues.redhat.com/browse/OCPBUGS-83737): add /var/run/kubernetes as emptyDir [#641](https://github.com/openshift/cluster-kube-scheduler-operator/pull/641)
* [Full changelog](https://github.com/openshift/cluster-kube-scheduler-operator/compare/e60e39de9cdd273dadd341d0f56350f504db9623...5ef1df3be41d38ddae9b3d22ce51ba486939e9f1)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/83a70ac38893dfa662e893e8d7b6cae43724ed5d)

* [OCPBUGS-104068](https://issues.redhat.com/browse/OCPBUGS-104068): [release-4.21] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#3070](https://github.com/openshift/cluster-monitoring-operator/pull/3070)
* [OCPBUGS-105305](https://issues.redhat.com/browse/OCPBUGS-105305): [release-4.21] wrap library-go resourceCache with mutex for thread safety [#3044](https://github.com/openshift/cluster-monitoring-operator/pull/3044)
* [OCPBUGS-104537](https://issues.redhat.com/browse/OCPBUGS-104537): Backport e2e stabilization 4.21 [#3027](https://github.com/openshift/cluster-monitoring-operator/pull/3027)
* [OCPBUGS-100369](https://issues.redhat.com/browse/OCPBUGS-100369): [release-4.21] fix: watch cluster wide proxy changes and apply changes accordingly [#3021](https://github.com/openshift/cluster-monitoring-operator/pull/3021)
* [OCPBUGS-99763](https://issues.redhat.com/browse/OCPBUGS-99763): fall back to kube-system/global-pull-secret for telemeter-client token [#3002](https://github.com/openshift/cluster-monitoring-operator/pull/3002)
* [OCPBUGS-92194](https://issues.redhat.com/browse/OCPBUGS-92194): set Prometheus shards value explicitly [#2975](https://github.com/openshift/cluster-monitoring-operator/pull/2975)
* [OCPBUGS-94077](https://issues.redhat.com/browse/OCPBUGS-94077): ship collector:node_scrape_collector_success:avg to Telemetry [#2978](https://github.com/openshift/cluster-monitoring-operator/pull/2978)
* [OCPBUGS-88323](https://issues.redhat.com/browse/OCPBUGS-88323): [release-4.21] fix(TestDocExamples) flake: use internal registry for test pods [#2980](https://github.com/openshift/cluster-monitoring-operator/pull/2980)
* [OCPBUGS-86806](https://issues.redhat.com/browse/OCPBUGS-86806): jsonnet: exclude ReplicationController from catch-all … [#2939](https://github.com/openshift/cluster-monitoring-operator/pull/2939)
* [OCPBUGS-86991](https://issues.redhat.com/browse/OCPBUGS-86991): increase lookup interval [#2946](https://github.com/openshift/cluster-monitoring-operator/pull/2946)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/c5ffc7afc457f7fc29c2818bb0ca6c9015ed0c39...83a70ac38893dfa662e893e8d7b6cae43724ed5d)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/d1d5e0e61459c068cd5024746b54275685279f9f)

* [OCPBUGS-112789](https://issues.redhat.com/browse/OCPBUGS-112789): [4.21] frr-k8s: use Recreate strategy for statuscleaner deployment [#3135](https://github.com/openshift/cluster-network-operator/pull/3135)
* [OCPBUGS-105600](https://issues.redhat.com/browse/OCPBUGS-105600): Remove version-specific CNI binary copy logic [#3117](https://github.com/openshift/cluster-network-operator/pull/3117)
* [OCPBUGS-99747](https://issues.redhat.com/browse/OCPBUGS-99747): Bump frr-k8s MAX_FDS from 1024 to 65536 [#3092](https://github.com/openshift/cluster-network-operator/pull/3092)
* [OCPBUGS-98747](https://issues.redhat.com/browse/OCPBUGS-98747): Remove --enable-interconnect flag from OVN-K manifests [#3055](https://github.com/openshift/cluster-network-operator/pull/3055)
* [OCPBUGS-98548](https://issues.redhat.com/browse/OCPBUGS-98548): Bump github.com/containernetworking/cni v0.8.0 -&gt; v1.3.0 [#3049](https://github.com/openshift/cluster-network-operator/pull/3049)
* [OCPBUGS-84169](https://issues.redhat.com/browse/OCPBUGS-84169): Handle zero-worker HyperShift clusters in daemonset rollout [4.21 backport] [#2972](https://github.com/openshift/cluster-network-operator/pull/2972)
* [OCPBUGS-83422](https://issues.redhat.com/browse/OCPBUGS-83422): wait for patch port to apply drop garp flows [#2946](https://github.com/openshift/cluster-network-operator/pull/2946)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/259ea6b026f6663fa720a1e11c913a61122402f9...d1d5e0e61459c068cd5024746b54275685279f9f)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/6075cffc70be79fa499558474f135ea244c93fc0)

* [OCPBUGS-114931](https://issues.redhat.com/browse/OCPBUGS-114931): Update PPC help description [#1623](https://github.com/openshift/cluster-node-tuning-operator/pull/1623)
* [OCPBUGS-112011](https://issues.redhat.com/browse/OCPBUGS-112011): BUG-FIX Latency Test [#1592](https://github.com/openshift/cluster-node-tuning-operator/pull/1592)
* [OCPBUGS-114013](https://issues.redhat.com/browse/OCPBUGS-114013): Use Add() instead of AddRateLimited() for routine Profile enqueues [#1616](https://github.com/openshift/cluster-node-tuning-operator/pull/1616)
* [OCPBUGS-104586](https://issues.redhat.com/browse/OCPBUGS-104586): e2e: fix: clear hugepages before switching kernelPageSize to 4k [#1576](https://github.com/openshift/cluster-node-tuning-operator/pull/1576)
* [OCPBUGS-100540](https://issues.redhat.com/browse/OCPBUGS-100540): e2e: fix broken checks and rework netqueue tests to avoid ARM ethtool blackout flakes [#1573](https://github.com/openshift/cluster-node-tuning-operator/pull/1573)
* [OCPBUGS-90529](https://issues.redhat.com/browse/OCPBUGS-90529): perf: latency: compute memory resources dynamically [#1521](https://github.com/openshift/cluster-node-tuning-operator/pull/1521)
* [OCPBUGS-82896](https://issues.redhat.com/browse/OCPBUGS-82896): Bump github.com/moby/spdystream from v0.5.0 to v0.5.1 [#1531](https://github.com/openshift/cluster-node-tuning-operator/pull/1531)
* [OCPBUGS-86809](https://issues.redhat.com/browse/OCPBUGS-86809): Requeue PerformanceStatus update when status write fails [#1524](https://github.com/openshift/cluster-node-tuning-operator/pull/1524)
* [OCPBUGS-85016](https://issues.redhat.com/browse/OCPBUGS-85016): e2e: Add irqbalance StartLimitBurst &gt;= 100 config test [#1505](https://github.com/openshift/cluster-node-tuning-operator/pull/1505)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/9782f0fb3824689caeaa9c48a54dd58d39cdedb4...6075cffc70be79fa499558474f135ea244c93fc0)


### [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator/tree/03bedb913bce9c7deabf7868e5cbefc57cf3490b)

* [OCPBUGS-80769](https://issues.redhat.com/browse/OCPBUGS-80769): Bump google.golang.org/grpc to v1.79.3 [#197](https://github.com/openshift/cluster-olm-operator/pull/197)
* [Full changelog](https://github.com/openshift/cluster-olm-operator/compare/e8a985a1cd375c1d83e951a1586d11203a1204e2...03bedb913bce9c7deabf7868e5cbefc57cf3490b)


### [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator/tree/810221c4d6f91efae7277224e3022ec5c4778e14)

* [OCPBUGS-105475](https://issues.redhat.com/browse/OCPBUGS-105475): Add HostToContainer mountPropagation to node-pullsecrets volume mount [#750](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/750)
* [Full changelog](https://github.com/openshift/cluster-openshift-apiserver-operator/compare/52fd1773757b2c3ff497e7db084c3d71cde5478f...810221c4d6f91efae7277224e3022ec5c4778e14)


### [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller/tree/e510507e20f6eb09694c880ecd79fa512a2b3470)

* [OCPBUGS-98251](https://issues.redhat.com/browse/OCPBUGS-98251): [4.21] add serviceAccountToken volume type to psalabelsyncer [#193](https://github.com/openshift/cluster-policy-controller/pull/193)
* [Full changelog](https://github.com/openshift/cluster-policy-controller/compare/8b775487512fb543bff470ff1042bd3ac31b29be...e510507e20f6eb09694c880ecd79fa512a2b3470)


### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/e403475164a4de23d358a93106a35353ec29f3d7)

* [OCPBUGS-79531](https://issues.redhat.com/browse/OCPBUGS-79531): volume-data-source-validator should run on master nodes [#687](https://github.com/openshift/cluster-storage-operator/pull/687)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/dd362d767167a8ac1889d2ee2a719cf68fac0522...e403475164a4de23d358a93106a35353ec29f3d7)


### [console](https://github.com/openshift/console/tree/e37b355bb57fc90e6368c3a3d9c1f0519118b484)

* [OCPBUGS-113468](https://issues.redhat.com/browse/OCPBUGS-113468): Remove unscoped CSV watch from ClusterNotUpgradeableAlert [#17079](https://github.com/openshift/console/pull/17079)
* Fix for OCPBUGS-92072: CVE-2026-44990 [#16714](https://github.com/openshift/console/pull/16714)
* [OCPBUGS-113732](https://issues.redhat.com/browse/OCPBUGS-113732): make cloud provider fields optional during operator install [#17091](https://github.com/openshift/console/pull/17091)
* [OCPBUGS-100518](https://issues.redhat.com/browse/OCPBUGS-100518), [OCPBUGS-101793](https://issues.redhat.com/browse/OCPBUGS-101793): Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss [#17055](https://github.com/openshift/console/pull/17055)
* Fix OCPBUGS-99410: CVE-2026-59877 [#16835](https://github.com/openshift/console/pull/16835)
* [OCPBUGS-112273](https://issues.redhat.com/browse/OCPBUGS-112273): Fix flaky TestAsyncCache backend test [#17046](https://github.com/openshift/console/pull/17046)
* Fix for OCPBUGS-101827: CVE-2026-69152 [#16931](https://github.com/openshift/console/pull/16931)
* Fix for OCPBUGS-105892: CVE-2026-73086 [#16966](https://github.com/openshift/console/pull/16966)
* [OCPBUGS-105864](https://issues.redhat.com/browse/OCPBUGS-105864): Fix leading whitespace in Quick Start execute code snippets [#16961](https://github.com/openshift/console/pull/16961)
* Fix for OCPBUGS-89706: CVE-2026-12143 [#16645](https://github.com/openshift/console/pull/16645)
* [OCPBUGS-98434](https://issues.redhat.com/browse/OCPBUGS-98434): CVE-2026-59869 bump js-yaml [#16772](https://github.com/openshift/console/pull/16772)
* [OCPBUGS-100058](https://issues.redhat.com/browse/OCPBUGS-100058): quickstart page i18n misses (Fix Quick Starts i18n bundle lookup for zh-CN) [#16868](https://github.com/openshift/console/pull/16868)
* [OCPBUGS-100377](https://issues.redhat.com/browse/OCPBUGS-100377): Re-enable Knative Cypress e2e tests [#16896](https://github.com/openshift/console/pull/16896)
* [OCPBUGS-99544](https://issues.redhat.com/browse/OCPBUGS-99544): '0 B' is shown on details page when create pvc with 'EiB' unit [#16806](https://github.com/openshift/console/pull/16806)
* [OCPBUGS-99546](https://issues.redhat.com/browse/OCPBUGS-99546): Incorrect translations for 'CatalogSources' and 'OperatorGroups' in l… [#16808](https://github.com/openshift/console/pull/16808)
* [OCPBUGS-99311](https://issues.redhat.com/browse/OCPBUGS-99311): Disable Knative e2e Cypress tests in CI [#16794](https://github.com/openshift/console/pull/16794)
* [OCPBUGS-99163](https://issues.redhat.com/browse/OCPBUGS-99163): fixing severity not showing number of issues [#16618](https://github.com/openshift/console/pull/16618)
* [OCPBUGS-84287](https://issues.redhat.com/browse/OCPBUGS-84287): Bump follow-redirects to 1.16.0 to fix CVE-2026-40895 [#16670](https://github.com/openshift/console/pull/16670)
* [OCPBUGS-81618](https://issues.redhat.com/browse/OCPBUGS-81618): CVE-2026-4800 [#16572](https://github.com/openshift/console/pull/16572)
* [OCPBUGS-90498](https://issues.redhat.com/browse/OCPBUGS-90498): Projects cannot be filtered by display name in the console list view [#16653](https://github.com/openshift/console/pull/16653)
* [OCPBUGS-95544](https://issues.redhat.com/browse/OCPBUGS-95544): Fix RoleBindings tab error for non-cluster-admin users [#16695](https://github.com/openshift/console/pull/16695)
* [OCPBUGS-86743](https://issues.redhat.com/browse/OCPBUGS-86743), [OCPBUGS-87090](https://issues.redhat.com/browse/OCPBUGS-87090), [OCPBUGS-88749](https://issues.redhat.com/browse/OCPBUGS-88749): [release-4.21] bump package: webpack-dev-server, protobufjs, fast-uri [#16654](https://github.com/openshift/console/pull/16654)
* [OCPBUGS-90553](https://issues.redhat.com/browse/OCPBUGS-90553): Backport inventory card filter link fix to release-4.21 [#16678](https://github.com/openshift/console/pull/16678)
* [OCPBUGS-86456](https://issues.redhat.com/browse/OCPBUGS-86456): [release-4.21] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators [#16536](https://github.com/openshift/console/pull/16536)
* [OCPBUGS-88358](https://issues.redhat.com/browse/OCPBUGS-88358): Allow VolumeSnapshot restore when parent PVC is deleted [#16602](https://github.com/openshift/console/pull/16602)
* [OCPBUGS-86581](https://issues.redhat.com/browse/OCPBUGS-86581): Fix macOS Option key in pod terminal [#16505](https://github.com/openshift/console/pull/16505)
* [OCPBUGS-85674](https://issues.redhat.com/browse/OCPBUGS-85674): Prevent binary secret data corruption when editing [#16448](https://github.com/openshift/console/pull/16448)
* [OCPBUGS-79459](https://issues.redhat.com/browse/OCPBUGS-79459): CVE-2026-29063 Immutable.js: Improperly Controlled Mod… [#16503](https://github.com/openshift/console/pull/16503)
* [OCPBUGS-86427](https://issues.redhat.com/browse/OCPBUGS-86427): Fix Shipwright detail pages crashing with React error #310 [#16487](https://github.com/openshift/console/pull/16487)
* [OCPBUGS-86314](https://issues.redhat.com/browse/OCPBUGS-86314): Show empty state instead of 403 error for users without projects [#16478](https://github.com/openshift/console/pull/16478)
* [OCPBUGS-84967](https://issues.redhat.com/browse/OCPBUGS-84967): Remove DataViewToolbar wrapper from bottom pagination [#16484](https://github.com/openshift/console/pull/16484)
* [OCPBUGS-83287](https://issues.redhat.com/browse/OCPBUGS-83287): [release-4.21] CVE-2026-26996 Bump minimatch library [#16276](https://github.com/openshift/console/pull/16276)
* [OCPBUGS-85520](https://issues.redhat.com/browse/OCPBUGS-85520): Fix create visual connector in Topology [#16439](https://github.com/openshift/console/pull/16439)
* NO-JIRA: enable multi-architecture yarn builds [#16420](https://github.com/openshift/console/pull/16420)
* [OCPBUGS-85040](https://issues.redhat.com/browse/OCPBUGS-85040): Remove PII from events [#16401](https://github.com/openshift/console/pull/16401)
* [OCPBUGS-84967](https://issues.redhat.com/browse/OCPBUGS-84967): Add bottom pagination to ConsoleDataView for mobile responsiveness [#16396](https://github.com/openshift/console/pull/16396)
* [OCPBUGS-84858](https://issues.redhat.com/browse/OCPBUGS-84858): Fix ConsoleDataView filter order: Name and Label shoul… [#16386](https://github.com/openshift/console/pull/16386)
* [OCPBUGS-83494](https://issues.redhat.com/browse/OCPBUGS-83494): remove dev to admin links as dev monitoring views are enabled [#16164](https://github.com/openshift/console/pull/16164)
* [OCPBUGS-83572](https://issues.redhat.com/browse/OCPBUGS-83572): fix Developer Sandbox telemetry [#16286](https://github.com/openshift/console/pull/16286)
* [OCPBUGS-83418](https://issues.redhat.com/browse/OCPBUGS-83418): Fix resource log dropdown TypeError [#16281](https://github.com/openshift/console/pull/16281)
* [OCPBUGS-81517](https://issues.redhat.com/browse/OCPBUGS-81517): Follow up on fixing the remaining issues in the multi-group impersonation feature [#16236](https://github.com/openshift/console/pull/16236)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/console/compare/b28423ddc50e74cd0b3cf43ec2906ac3b829cf71...e37b355bb57fc90e6368c3a3d9c1f0519118b484)


### [console-operator](https://github.com/openshift/console-operator/tree/f730484ce5f2606e7f665d561227c374183fff14)

* [OCPBUGS-100111](https://issues.redhat.com/browse/OCPBUGS-100111): Sort plugin list to make them deterministic [#1203](https://github.com/openshift/console-operator/pull/1203)
* [OCPBUGS-98987](https://issues.redhat.com/browse/OCPBUGS-98987): [4.21] Stabilize telemetry config to prevent continuous console pod rollouts [#1192](https://github.com/openshift/console-operator/pull/1192)
* [NETOBSERV-2296](https://issues.redhat.com/browse/NETOBSERV-2296): add missing annotations on netobserv quickstart [#1096](https://github.com/openshift/console-operator/pull/1096)
* [OCPBUGS-86119](https://issues.redhat.com/browse/OCPBUGS-86119): Add unit and e2e test coverage for cert rotation redeployment [#1162](https://github.com/openshift/console-operator/pull/1162)
* [OCPBUGS-82037](https://issues.redhat.com/browse/OCPBUGS-82037): Redeploy console pods upon cert rotation [#1139](https://github.com/openshift/console-operator/pull/1139)
* [Full changelog](https://github.com/openshift/console-operator/compare/c3ac99413caaa8fb892b597bab18239697476ce5...f730484ce5f2606e7f665d561227c374183fff14)


### [csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/ee321fbd37b2ded41a96004d52a7652b67e28809)

* [OCPBUGS-80845](https://issues.redhat.com/browse/OCPBUGS-80845): bump google.golang.org/grpc@v1.79.3 [#384](https://github.com/openshift/cloud-provider-openstack/pull/384)
* UPSTREAM-SYNC: Sync release-4.21 with upstream release-1.34 [#371](https://github.com/openshift/cloud-provider-openstack/pull/371)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/bf508c062084dc6dec20480f7d173f047ad4f2d6...ee321fbd37b2ded41a96004d52a7652b67e28809)


### [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs/tree/b5e4888ca8e420ba9245805a1a8c976074a8b793)

* [OCPBUGS-82899](https://issues.redhat.com/browse/OCPBUGS-82899): Bump github.com/moby/spdystream@v0.5.1 [#191](https://github.com/openshift/csi-driver-nfs/pull/191)
* [OCPBUGS-80783](https://issues.redhat.com/browse/OCPBUGS-80783): CVE-2026-33186: bump google.golang.org/grpc v1.79.3 [#176](https://github.com/openshift/csi-driver-nfs/pull/176)
* [Full changelog](https://github.com/openshift/csi-driver-nfs/compare/49f2d86fb6172d9d8909ed0f70cb3bc71a4f7c01...b5e4888ca8e420ba9245805a1a8c976074a8b793)


### [csi-external-attacher](https://github.com/openshift/csi-external-attacher/tree/6a3be10e6795c8149c4bd3c9856f7e2d312108e2)

* [OCPBUGS-80784](https://issues.redhat.com/browse/OCPBUGS-80784): Bump google.golang.org/grpc to v1.79.3 [#102](https://github.com/openshift/csi-external-attacher/pull/102)
* [Full changelog](https://github.com/openshift/csi-external-attacher/compare/344669a2189fecdf5471fdc9a1246dd751cb1afb...6a3be10e6795c8149c4bd3c9856f7e2d312108e2)


### [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner/tree/8d29fc4b7cb1f910c4c03e0a63fdd375d6294125)

* UPSTREAM: 1544: OCPBUGS-96508: Bump golang.org/x/net to v0.50.0-sec.4 [#149](https://github.com/openshift/csi-external-provisioner/pull/149)
* [OCPBUGS-82900](https://issues.redhat.com/browse/OCPBUGS-82900): Address CVE-2026-35469 [#139](https://github.com/openshift/csi-external-provisioner/pull/139)
* [OCPBUGS-80785](https://issues.redhat.com/browse/OCPBUGS-80785): Bump google.golang.org/grpc to v1.79.3 [#132](https://github.com/openshift/csi-external-provisioner/pull/132)
* [Full changelog](https://github.com/openshift/csi-external-provisioner/compare/f18190fb8aa26bdcb4ceb57cdd6cf77b5488ed58...8d29fc4b7cb1f910c4c03e0a63fdd375d6294125)


### [csi-external-resizer](https://github.com/openshift/csi-external-resizer/tree/39a0b534c17d6d652e25d2fad8f8949ba1bed9cb)

* [OCPBUGS-80786](https://issues.redhat.com/browse/OCPBUGS-80786): Bump google.golang.org/grpc to v1.79.3 [#200](https://github.com/openshift/csi-external-resizer/pull/200)
* [Full changelog](https://github.com/openshift/csi-external-resizer/compare/d880a1ec6da02dbf61600ec7999266185ca9f784...39a0b534c17d6d652e25d2fad8f8949ba1bed9cb)


### [csi-external-snapshotter, csi-snapshot-controller](https://github.com/openshift/csi-external-snapshotter/tree/2c14afc50a30de62cb00cc8263b061383cfbd3b5)

* [OCPBUGS-89328](https://issues.redhat.com/browse/OCPBUGS-89328): UPSTREAM: 1392: Fix VolumeSnapshotContent deletion [#223](https://github.com/openshift/csi-external-snapshotter/pull/223)
* [OCPBUGS-80788](https://issues.redhat.com/browse/OCPBUGS-80788), [OCPBUGS-80791](https://issues.redhat.com/browse/OCPBUGS-80791): Bump google.golang.org/grpc to v1.79.3 [#208](https://github.com/openshift/csi-external-snapshotter/pull/208)
* [Full changelog](https://github.com/openshift/csi-external-snapshotter/compare/9098db0e434e0d986eeadd2ebe69119540a550d1...2c14afc50a30de62cb00cc8263b061383cfbd3b5)


### [egress-router-cni](https://github.com/openshift/egress-router-cni/tree/0ec77dd178e3b0433f01fce5bcce96abcc126deb)

* [OCPBUGS-98548](https://issues.redhat.com/browse/OCPBUGS-98548): Bump containernetworking/cni to v1.3.0 github.com/containernetworking/plugins to 1.4.0 [#106](https://github.com/openshift/egress-router-cni/pull/106)
* [Full changelog](https://github.com/openshift/egress-router-cni/compare/5e0f8d1b545899fda27c5e1cc8707d33cba1b534...0ec77dd178e3b0433f01fce5bcce96abcc126deb)


### [etcd](https://github.com/openshift/etcd/tree/b6dda5413ec33fc88fc9751d98d3b4bd96ea877d)

* [OCPBUGS-100390](https://issues.redhat.com/browse/OCPBUGS-100390): UPSTREAM: 21443: Revert "Reuse events between sync loops" [#394](https://github.com/openshift/etcd/pull/394)
* [Full changelog](https://github.com/openshift/etcd/compare/806f690e1f140e0aea2eb05ef5f288b756b62895...b6dda5413ec33fc88fc9751d98d3b4bd96ea877d)


### [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp/tree/e27accef1fa99089410e4b0894db21a392d9bf99)

* [OCPBUGS-83615](https://issues.redhat.com/browse/OCPBUGS-83615): Fix OSD ILB bug [#108](https://github.com/openshift/cloud-provider-gcp/pull/108)
* [Full changelog](https://github.com/openshift/cloud-provider-gcp/compare/8732386c3ddcb98dae624f7bb925ed0ef8d077d5...e27accef1fa99089410e4b0894db21a392d9bf99)


### [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp/tree/fe230b8a6407a06e1be9d6994a92ac8c5a43237d)

* [OCPBUGS-80805](https://issues.redhat.com/browse/OCPBUGS-80805): Bump google.golang.org/grpc to v1.79.3 [#287](https://github.com/openshift/cluster-api-provider-gcp/pull/287)
* [Full changelog](https://github.com/openshift/cluster-api-provider-gcp/compare/e2d0c20eab31c513764507a6d8774de2aef3db2c...fe230b8a6407a06e1be9d6994a92ac8c5a43237d)


### [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp/tree/689c32d583d5c0a49de77e0ccc15646a15cae065)

* [OCPBUGS-105415](https://issues.redhat.com/browse/OCPBUGS-105415): [release-4.21] Add the N4A machine type [#179](https://github.com/openshift/machine-api-provider-gcp/pull/179)
* [OCPBUGS-80828](https://issues.redhat.com/browse/OCPBUGS-80828): Bump gRPC-Go package for CVE fix [#154](https://github.com/openshift/machine-api-provider-gcp/pull/154)
* [Full changelog](https://github.com/openshift/machine-api-provider-gcp/compare/91f71c9adfd6b715a6ef340bb43ea5e1a8b44245...689c32d583d5c0a49de77e0ccc15646a15cae065)


### [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver/tree/1da557fe54562347dbf18bee04fe6564a2697707)

* [OCPBUGS-80809](https://issues.redhat.com/browse/OCPBUGS-80809): Bump google.golang.org/grpc to v1.79.3 in release-4.21 [#104](https://github.com/openshift/gcp-pd-csi-driver/pull/104)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver/compare/0660d93fa9545ded2f6a49f4462de3ed68000232...1da557fe54562347dbf18bee04fe6564a2697707)


### [gcp-pd-csi-driver-operator](https://github.com/openshift/gcp-pd-csi-driver-operator/tree/8d9f11a7f2c4e757bfc5e99ba69084d29a28b79b)

* [OCPBUGS-97960](https://issues.redhat.com/browse/OCPBUGS-97960): no-op OWNERS change to trigger postsubmit jobs [#197](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/197)
* [OCPBUGS-80808](https://issues.redhat.com/browse/OCPBUGS-80808): Bump google.golang.org/grpc to v1.79.3 [#184](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/184)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver-operator/compare/ddfc0f93d244d5d9be6d5ab7631f4b1db8bec043...8d9f11a7f2c4e757bfc5e99ba69084d29a28b79b)


### [haproxy-router](https://github.com/openshift/router/tree/22531cf0bb2435e73437be73c244913de4844812)

* [OCPBUGS-86729](https://issues.redhat.com/browse/OCPBUGS-86729): Prevent SSRF via FQDN-typed EndpointSlices [#818](https://github.com/openshift/router/pull/818)
* [OCPBUGS-86718](https://issues.redhat.com/browse/OCPBUGS-86718): Strip X-SSL-* headers for plain HTTP [#795](https://github.com/openshift/router/pull/795)
* [OCPBUGS-87002](https://issues.redhat.com/browse/OCPBUGS-87002): Replace HTTP backend liveness check with admin socket check [#786](https://github.com/openshift/router/pull/786)
* [OCPBUGS-80810](https://issues.redhat.com/browse/OCPBUGS-80810): Bump google.golang.org/grpc to v1.79.3 [#770](https://github.com/openshift/router/pull/770)
* [Full changelog](https://github.com/openshift/router/compare/5949f713517b3cc158cd78b34d71d5a9084d2e1c...22531cf0bb2435e73437be73c244913de4844812)


### [hyperkube, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/7ffd39de9bbb8e3edca8ee7530cf1dab522fbce2)

* NO-JIRA: Update openshift-hack/rebase.sh [#2745](https://github.com/openshift/kubernetes/pull/2745)
* [OCPBUGS-94059](https://issues.redhat.com/browse/OCPBUGS-94059): backport kubernetes/conformance umbrella suite [#2708](https://github.com/openshift/kubernetes/pull/2708)
* [OCPBUGS-91759](https://issues.redhat.com/browse/OCPBUGS-91759): Rebase v1.34.9 in release-4.21 [#2702](https://github.com/openshift/kubernetes/pull/2702)
* [OCPBUGS-87017](https://issues.redhat.com/browse/OCPBUGS-87017): fix flake race in VAP e2e case [#2677](https://github.com/openshift/kubernetes/pull/2677)
* [OCPBUGS-85500](https://issues.redhat.com/browse/OCPBUGS-85500): Bump Kubernetes v1.34.8 to release-4.21 [#2665](https://github.com/openshift/kubernetes/pull/2665)
* "OCPBUGS-83608: Bump to k8s v1.34.7" [#2647](https://github.com/openshift/kubernetes/pull/2647)
* [Full changelog](https://github.com/openshift/kubernetes/compare/dfffacdf0ad6e9aa75664c7b3167dd2ddbfc17ba...7ffd39de9bbb8e3edca8ee7530cf1dab522fbce2)


### [hypershift](https://github.com/openshift/hypershift/tree/db86285f89737b67a53668e42a47ffd6c8cd5170)

* [OCPBUGS-82913](https://issues.redhat.com/browse/OCPBUGS-82913): Address CVE-2026-35469 [#9023](https://github.com/openshift/hypershift/pull/9023)
* [OCPBUGS-96712](https://issues.redhat.com/browse/OCPBUGS-96712): Apply MetricsSet relabel configs to KAS ServiceMonitor [#9294](https://github.com/openshift/hypershift/pull/9294)
* [OCPBUGS-105505](https://issues.redhat.com/browse/OCPBUGS-105505): fix(upsert): add desired-state hash to detect spec field removals [#9268](https://github.com/openshift/hypershift/pull/9268)
* [OCPBUGS-104592](https://issues.redhat.com/browse/OCPBUGS-104592): Add proxy env vars to AWS cloud-controller-manager deployment [#9224](https://github.com/openshift/hypershift/pull/9224)
* [OCPBUGS-105434](https://issues.redhat.com/browse/OCPBUGS-105434): [release-4.21] fix router component ordering to prevent missing HAProxy backends [#9263](https://github.com/openshift/hypershift/pull/9263)
* [OCPBUGS-94179](https://issues.redhat.com/browse/OCPBUGS-94179): fix registry override matching and propagation to init containers [#8879](https://github.com/openshift/hypershift/pull/8879)
* [OCPBUGS-100194](https://issues.redhat.com/browse/OCPBUGS-100194): fix(cpo): set correct --advertise-client-url for etcd grpc-proxy [#9184](https://github.com/openshift/hypershift/pull/9184)
* [CNTRLPLANE-3873](https://issues.redhat.com/browse/CNTRLPLANE-3873): Backport controlPlaneVersion status to release-4.21 [#9054](https://github.com/openshift/hypershift/pull/9054)
* [OCPBUGS-99646](https://issues.redhat.com/browse/OCPBUGS-99646): OCPBUGS-86296: Propagate management cluster proxy env vars to konnectivity sidecar [#9087](https://github.com/openshift/hypershift/pull/9087)
* [OCPBUGS-90087](https://issues.redhat.com/browse/OCPBUGS-90087): [release-4.21] clear stale EtcdRecoveryActive failure condition when etcd is healthy [#8807](https://github.com/openshift/hypershift/pull/8807)
* [OCPBUGS-97922](https://issues.redhat.com/browse/OCPBUGS-97922): fix(nodepool): skip CNI-internal IPs in ClusterNetworkCIDRConflict check [#8949](https://github.com/openshift/hypershift/pull/8949)
* [OCPBUGS-99100](https://issues.redhat.com/browse/OCPBUGS-99100): fix(backport): konnectivity agent auth [#9093](https://github.com/openshift/hypershift/pull/9093)
* [OCPBUGS-91671](https://issues.redhat.com/browse/OCPBUGS-91671): [release-4.21] OCPBUGS-74960: prevent resource leak on deletion and handle DependencyViolation [#8798](https://github.com/openshift/hypershift/pull/8798)
* [OCPBUGS-90084](https://issues.redhat.com/browse/OCPBUGS-90084): Fix NodePool reconciliation failure when updating mirrored immutable ConfigMaps [#8812](https://github.com/openshift/hypershift/pull/8812)
* [OCPBUGS-93927](https://issues.redhat.com/browse/OCPBUGS-93927): fix(cpo): deduplicate VPC endpoint subnets by AZ to prevent DuplicateSubnetsInSameZone [#8862](https://github.com/openshift/hypershift/pull/8862)
* [OCPBUGS-86295](https://issues.redhat.com/browse/OCPBUGS-86295): CAPI image overrides aware of registry config [#8559](https://github.com/openshift/hypershift/pull/8559)
* [OCPBUGS-83833](https://issues.redhat.com/browse/OCPBUGS-83833): fix(deps): update dependencies to address CVE-2025-52881 [#8748](https://github.com/openshift/hypershift/pull/8748)
* [OCPBUGS-92089](https://issues.redhat.com/browse/OCPBUGS-92089): fix(cpo): prevent informer creation for inaccessible resource types [#8833](https://github.com/openshift/hypershift/pull/8833)
* [OCPBUGS-89353](https://issues.redhat.com/browse/OCPBUGS-89353): build(operator): drop hypershift-no-cgo from operator container images [#8757](https://github.com/openshift/hypershift/pull/8757)
* [OCPBUGS-80813](https://issues.redhat.com/browse/OCPBUGS-80813): Bump google.golang.org/grpc to v1.79.3 [#8443](https://github.com/openshift/hypershift/pull/8443)
* [OCPBUGS-86040](https://issues.redhat.com/browse/OCPBUGS-86040): [release-4.21] Verify cert revocation against all KAS pods [#8539](https://github.com/openshift/hypershift/pull/8539)
* NO-JIRA: fix(tekton): remove path filter from control-plane-operator pipelines [#8667](https://github.com/openshift/hypershift/pull/8667)
* [OCPBUGS-86416](https://issues.redhat.com/browse/OCPBUGS-86416): add Konflux pipeline definitions for CPO 4.21 [#8607](https://github.com/openshift/hypershift/pull/8607)
* [OCPBUGS-86477](https://issues.redhat.com/browse/OCPBUGS-86477): [release-4.21] add CP pull-secret watches for in-place propagation [#8583](https://github.com/openshift/hypershift/pull/8583)
* [OCPBUGS-86416](https://issues.redhat.com/browse/OCPBUGS-86416): set limits for aro.openshift.io/swift-nic in request overrides for ARO swift [#8565](https://github.com/openshift/hypershift/pull/8565)
* [OCPBUGS-81671](https://issues.redhat.com/browse/OCPBUGS-81671): Ignition generalize image download errors [#8158](https://github.com/openshift/hypershift/pull/8158)
* [OCPBUGS-85781](https://issues.redhat.com/browse/OCPBUGS-85781): Add AWS ISO domains to konnectivity IsCloudAPI [#8531](https://github.com/openshift/hypershift/pull/8531)
* [OCPBUGS-85621](https://issues.redhat.com/browse/OCPBUGS-85621): fix CVE-2026-33186 by updating grpc-go [#8518](https://github.com/openshift/hypershift/pull/8518)
* [OCPBUGS-83710](https://issues.redhat.com/browse/OCPBUGS-83710): fix(kubevirt): filter link-local addresses from EndpointSlice endpoints [#8270](https://github.com/openshift/hypershift/pull/8270)
* [OCPBUGS-85538](https://issues.redhat.com/browse/OCPBUGS-85538): [release-4.21] Set unhealthyPodEvictionPolicy to AlwaysAllow on all PDBs [#8214](https://github.com/openshift/hypershift/pull/8214)
* [OCPBUGS-85538](https://issues.redhat.com/browse/OCPBUGS-85538): [release-4.21] CNTRLPLANE-2740: Add KAS liveness readiness sidecar to OAS and OAuth API Server [#8213](https://github.com/openshift/hypershift/pull/8213)
* [OCPBUGS-76447](https://issues.redhat.com/browse/OCPBUGS-76447): Add UserAgent telemetry to CPO Azure SDK clients [#7685](https://github.com/openshift/hypershift/pull/7685)
* [OCPBUGS-81745](https://issues.redhat.com/browse/OCPBUGS-81745): [release-4.21] Honor AWS AMI override in NodePool token generation [#8170](https://github.com/openshift/hypershift/pull/8170)
* [Full changelog](https://github.com/openshift/hypershift/compare/a4bc7b0f48c6b470164a1990b44c7eb6a152670c...db86285f89737b67a53668e42a47ffd6c8cd5170)


### [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver/tree/f0baa47e75ab0bef0ec56ab48d9a725e00f6b40f)

* [OCPBUGS-80815](https://issues.redhat.com/browse/OCPBUGS-80815): Bump google.golang.org/grpc to v1.79.3 [#146](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/146)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver/compare/8fe7dafcf238c9416094672e1baf45105622e575...f0baa47e75ab0bef0ec56ab48d9a725e00f6b40f)


### [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud/tree/22e131a00d874c240531c40141a8a780fbb48bd5)

* [OCPBUGS-104113](https://issues.redhat.com/browse/OCPBUGS-104113): replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 [#101](https://github.com/openshift/machine-api-provider-ibmcloud/pull/101)
* [Full changelog](https://github.com/openshift/machine-api-provider-ibmcloud/compare/f80ea3216387639dde6550a70a6e08599fd67f5f...22e131a00d874c240531c40141a8a780fbb48bd5)


### [insights-operator](https://github.com/openshift/insights-operator/tree/a6c3cab2c07793952697511b1dc29d13737ac0a1)

* [OCPBUGS-109390](https://issues.redhat.com/browse/OCPBUGS-109390): secrets and configmap revisions count gathering [#1342](https://github.com/openshift/insights-operator/pull/1342)
* [OCPBUGS-100248](https://issues.redhat.com/browse/OCPBUGS-100248): Fix indentation bug on livenessProbe [#1333](https://github.com/openshift/insights-operator/pull/1333)
* [OCPBUGS-99015](https://issues.redhat.com/browse/OCPBUGS-99015): update HyperShift deployment manifest [#1323](https://github.com/openshift/insights-operator/pull/1323)
* [OCPBUGS-91985](https://issues.redhat.com/browse/OCPBUGS-91985): fall back to kube-system/global-pull-secret for Insights token [#1310](https://github.com/openshift/insights-operator/pull/1310)
* [OCPBUGS-87191](https://issues.redhat.com/browse/OCPBUGS-87191): extractro controller [#1300](https://github.com/openshift/insights-operator/pull/1300)
* [OCPBUGS-86805](https://issues.redhat.com/browse/OCPBUGS-86805): add config option to disable runtime extractor [#1295](https://github.com/openshift/insights-operator/pull/1295)
* [OCPBUGS-80818](https://issues.redhat.com/browse/OCPBUGS-80818): Bump google.golang.org/grpc to v1.79.3 [#1285](https://github.com/openshift/insights-operator/pull/1285)
* [OCPBUGS-81573](https://issues.redhat.com/browse/OCPBUGS-81573): kubeletconfig gatherer [#1266](https://github.com/openshift/insights-operator/pull/1266)
* [OCPBUGS-79534](https://issues.redhat.com/browse/OCPBUGS-79534): [release-4.21] Add OpenTelemetry CR Gatherer [#1258](https://github.com/openshift/insights-operator/pull/1258)
* [Full changelog](https://github.com/openshift/insights-operator/compare/a6cc2a3f799e5cf4ca85e631f6b903999f2b2ad6...a6c3cab2c07793952697511b1dc29d13737ac0a1)


### [insights-runtime-exporter, insights-runtime-extractor](https://github.com/openshift/insights-runtime-extractor/tree/8c41cb8680f29a915d33e4954fc5ff7f5352411b)

* Updating ose-insights-runtime-extractor-container image to be consistent with ART for 4.21 [#78](https://github.com/openshift/insights-runtime-extractor/pull/78)
* [Full changelog](https://github.com/openshift/insights-runtime-extractor/compare/248c1f22bf47fc9ad972ca35f0829f52a1811590...8c41cb8680f29a915d33e4954fc5ff7f5352411b)


### [ironic](https://github.com/openshift/ironic-image/tree/843f55a9276bf03d3cb659de5cb38f189e6e8fcf)

* [OCPBUGS-105861](https://issues.redhat.com/browse/OCPBUGS-105861): update ironic pin to include CVE-2026-54423 fix (release-4.21) [#890](https://github.com/openshift/ironic-image/pull/890)
* [OCPBUGS-88473](https://issues.redhat.com/browse/OCPBUGS-88473): Update openstack-ironic commit hash in requirements.cachito that addresses CVE-2026-43003 [#885](https://github.com/openshift/ironic-image/pull/885)
* [OCPBUGS-97991](https://issues.redhat.com/browse/OCPBUGS-97991): Update openstack-ironic commit hash for CVE-2026-44918 [#876](https://github.com/openshift/ironic-image/pull/876)
* [OCPBUGS-90554](https://issues.redhat.com/browse/OCPBUGS-90554): [4.21] Fix parallel power concurrency [#856](https://github.com/openshift/ironic-image/pull/856)
* [OCPBUGS-82294](https://issues.redhat.com/browse/OCPBUGS-82294), [OCPBUGS-84370](https://issues.redhat.com/browse/OCPBUGS-84370): Update sushy and Ironic to resolve Cisco vMedia Insert and BIOS Settings update issues. [#829](https://github.com/openshift/ironic-image/pull/829)
* [OCPBUGS-84853](https://issues.redhat.com/browse/OCPBUGS-84853): Bump pyasn to 0.5.1-5 [#823](https://github.com/openshift/ironic-image/pull/823)
* [OCPBUGS-82298](https://issues.redhat.com/browse/OCPBUGS-82298): Bump sushy hash to include Supermicro ARS-111GL-NHR fix [#840](https://github.com/openshift/ironic-image/pull/840)
* [Full changelog](https://github.com/openshift/ironic-image/compare/d23a6091f362d46421276749a5faa9871dbc20e7...843f55a9276bf03d3cb659de5cb38f189e6e8fcf)


### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/156ef6b4730f01279216d3296349ca0cae29466c)

* [OCPBUGS-100051](https://issues.redhat.com/browse/OCPBUGS-100051): Bump ironic-python-agent pinned commit for CVE-2026-66138 [#296](https://github.com/openshift/ironic-agent-image/pull/296)
* [OCPBUGS-88473](https://issues.redhat.com/browse/OCPBUGS-88473): Update commit SHA in requirements.cachito to address CVE-2026-43003 [#298](https://github.com/openshift/ironic-agent-image/pull/298)
* [OCPBUGS-95062](https://issues.redhat.com/browse/OCPBUGS-95062): Replace individual package removal with a single rpm -e loop [#283](https://github.com/openshift/ironic-agent-image/pull/283)
* [OCPBUGS-95062](https://issues.redhat.com/browse/OCPBUGS-95062): Replace dnf remove with rpm -e to prevent dependency removal [#271](https://github.com/openshift/ironic-agent-image/pull/271)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/ff276c00e345b9cb9298ce9dbdd7f19a8b14dbce...156ef6b4730f01279216d3296349ca0cae29466c)


### [keepalived-ipfailover](https://github.com/openshift/images/tree/f0241a3d2a12a8b2965cc36542babce8a1dffcf8)

* [OCPBUGS-99781](https://issues.redhat.com/browse/OCPBUGS-99781): Reinstall tzdata if /usr/share/zoneinfo is missing [#248](https://github.com/openshift/images/pull/248)
* [Full changelog](https://github.com/openshift/images/compare/e00f5806587e71188805bab43dad9099524b9059...f0241a3d2a12a8b2965cc36542babce8a1dffcf8)


### [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server/tree/ff4f3e2a6d2b0e8a860831b98733cff152cfddd3)

* [OCPBUGS-80716](https://issues.redhat.com/browse/OCPBUGS-80716): Bump google.golang.org/grpc to v1.79.3 [#61](https://github.com/openshift/kubernetes-metrics-server/pull/61)
* [Full changelog](https://github.com/openshift/kubernetes-metrics-server/compare/ed76a5e8051caae6519342ae189088b8ddd09979...ff4f3e2a6d2b0e8a860831b98733cff152cfddd3)


### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/8406e402ad020185813942842d4914ff7730fdc1)

* [OCPBUGS-99400](https://issues.redhat.com/browse/OCPBUGS-99400): fix CronJob timezone panic and embed tzdata in kube-state-metrics [#151](https://github.com/openshift/kube-state-metrics/pull/151)
* Fix for OCPBUGS-81988: CVE-2026-34986 bump github.com/go-jose/go-jose [#143](https://github.com/openshift/kube-state-metrics/pull/143)
* [OCPBUGS-80823](https://issues.redhat.com/browse/OCPBUGS-80823): Bump google.golang.org/grpc to v1.79.3 [#138](https://github.com/openshift/kube-state-metrics/pull/138)
* [Full changelog](https://github.com/openshift/kube-state-metrics/compare/cb0aa591e89797cc0f45b934b8baeccc3a3b09bf...8406e402ad020185813942842d4914ff7730fdc1)


### [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver/tree/8a115121952348de9a4e4a73478755258a401a86)

* [OCPBUGS-80717](https://issues.redhat.com/browse/OCPBUGS-80717): Bump google.golang.org/grpc to v1.79.3 [#98](https://github.com/openshift/kubevirt-csi-driver/pull/98)
* [Full changelog](https://github.com/openshift/kubevirt-csi-driver/compare/4bb70e49c9d05690f3a26edc0a6feaf093169cbb...8a115121952348de9a4e4a73478755258a401a86)


### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/88f39dc939cceb2c1999f2b0ab99f1118f26358f)

* [OCPBUGS-86493](https://issues.redhat.com/browse/OCPBUGS-86493): Populate status label selector for scale subresource [#1501](https://github.com/openshift/machine-api-operator/pull/1501)
* [OCPBUGS-77943](https://issues.redhat.com/browse/OCPBUGS-77943): Remove cluster-api-provider-libvirt references [#1473](https://github.com/openshift/machine-api-operator/pull/1473)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/83936ddec5de0d3c9e6db44e541e0abac2b60b6c...88f39dc939cceb2c1999f2b0ab99f1118f26358f)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/4e11f4db779899ed2da55452f7c213ee414163a1)

* [OCPBUGS-112469](https://issues.redhat.com/browse/OCPBUGS-112469): Fix SHA idempotency test in nmstate-configuration.sh [#6430](https://github.com/openshift/machine-config-operator/pull/6430)
* [OCPBUGS-114391](https://issues.redhat.com/browse/OCPBUGS-114391): Use kubernetes scheme in drain controller event recorder [#6457](https://github.com/openshift/machine-config-operator/pull/6457)
* [OCPBUGS-109656](https://issues.redhat.com/browse/OCPBUGS-109656): Fix duplicate template error [#6405](https://github.com/openshift/machine-config-operator/pull/6405)
* [OCPBUGS-105303](https://issues.redhat.com/browse/OCPBUGS-105303): Use providerSpec.Template in vSphere machineset reconciliation [#6381](https://github.com/openshift/machine-config-operator/pull/6381)
* [OCPBUGS-105214](https://issues.redhat.com/browse/OCPBUGS-105214): Update AMI Whitelist [#6376](https://github.com/openshift/machine-config-operator/pull/6376)
* [OCPBUGS-93806](https://issues.redhat.com/browse/OCPBUGS-93806): move cleanUpDuplicatedMC to avoid double reboot on first updated Master node [#6241](https://github.com/openshift/machine-config-operator/pull/6241)
* [OCPBUGS-97905](https://issues.redhat.com/browse/OCPBUGS-97905): Inject proxy into MCC deployment [#6276](https://github.com/openshift/machine-config-operator/pull/6276)
* [OCPBUGS-88510](https://issues.redhat.com/browse/OCPBUGS-88510): fix: update arbiter crio config [#6189](https://github.com/openshift/machine-config-operator/pull/6189)
* [release:4.21] OCPBUGS-89234: In OCB to check when a image is removed the old build is triggered again and the MC should start updating directly and no new MOSB should be triggred [#6196](https://github.com/openshift/machine-config-operator/pull/6196)
* [OCPBUGS-95588](https://issues.redhat.com/browse/OCPBUGS-95588): Remove sensitive ControllerConfig logging [#6257](https://github.com/openshift/machine-config-operator/pull/6257)
* [OCPBUGS-91971](https://issues.redhat.com/browse/OCPBUGS-91971): Make vsphere template updates atomic [#6229](https://github.com/openshift/machine-config-operator/pull/6229)
* [OCPBUGS-94108](https://issues.redhat.com/browse/OCPBUGS-94108): Fix kubelet certificate wait loop in criometricsproxy.yaml [#6248](https://github.com/openshift/machine-config-operator/pull/6248)
* [OCPBUGS-96153](https://issues.redhat.com/browse/OCPBUGS-96153): Update AMI Whitelist [#6261](https://github.com/openshift/machine-config-operator/pull/6261)
* [OCPBUGS-93937](https://issues.redhat.com/browse/OCPBUGS-93937): Bootstrap MCS logging entire ignition [#6244](https://github.com/openshift/machine-config-operator/pull/6244)
* [OCPBUGS-91734](https://issues.redhat.com/browse/OCPBUGS-91734): Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole [#6208](https://github.com/openshift/machine-config-operator/pull/6208)
* [OCPBUGS-89243](https://issues.redhat.com/browse/OCPBUGS-89243): Process rebuild annotation on machine-os-builder restart [#6197](https://github.com/openshift/machine-config-operator/pull/6197)
* [OCPBUGS-88709](https://issues.redhat.com/browse/OCPBUGS-88709): Update custom containerfile OCB test to work in a disconnected environment [#6193](https://github.com/openshift/machine-config-operator/pull/6193)
* [OCPBUGS-88340](https://issues.redhat.com/browse/OCPBUGS-88340): vSphere boot image hot loop detection is non-functional due to stable template names [#6180](https://github.com/openshift/machine-config-operator/pull/6180)
* [OCPBUGS-89340](https://issues.redhat.com/browse/OCPBUGS-89340): Remove skopeo-install script [#6202](https://github.com/openshift/machine-config-operator/pull/6202)
* [OCPBUGS-88334](https://issues.redhat.com/browse/OCPBUGS-88334): Skip chrony-wait on first node join [#6178](https://github.com/openshift/machine-config-operator/pull/6178)
* [OCPBUGS-88335](https://issues.redhat.com/browse/OCPBUGS-88335): daemon: don't pull/extract extensions for all OS updates [#6179](https://github.com/openshift/machine-config-operator/pull/6179)
* [OCPBUGS-86998](https://issues.redhat.com/browse/OCPBUGS-86998): configure-ovs: copy lldp mode to br-ex port [#6134](https://github.com/openshift/machine-config-operator/pull/6134)
* [OCPBUGS-87008](https://issues.redhat.com/browse/OCPBUGS-87008): Stabilize ocl 4.21 [#6138](https://github.com/openshift/machine-config-operator/pull/6138)
* [OCPBUGS-86979](https://issues.redhat.com/browse/OCPBUGS-86979): Update AMI Whitelist [#6129](https://github.com/openshift/machine-config-operator/pull/6129)
* [OCPBUGS-86576](https://issues.redhat.com/browse/OCPBUGS-86576): Verify extension packages are installed [#6090](https://github.com/openshift/machine-config-operator/pull/6090)
* [OCPBUGS-84481](https://issues.redhat.com/browse/OCPBUGS-84481): MCS fallback to latest v3 [#5883](https://github.com/openshift/machine-config-operator/pull/5883)
* [OCPBUGS-86216](https://issues.redhat.com/browse/OCPBUGS-86216): Fix re-cordon detection [#6066](https://github.com/openshift/machine-config-operator/pull/6066)
* [OCPBUGS-86232](https://issues.redhat.com/browse/OCPBUGS-86232): Apply password only if changes exist [#6068](https://github.com/openshift/machine-config-operator/pull/6068)
* [OCPBUGS-86037](https://issues.redhat.com/browse/OCPBUGS-86037): use `--delete-if-present` for karg removal [#6058](https://github.com/openshift/machine-config-operator/pull/6058)
* [OCPBUGS-85645](https://issues.redhat.com/browse/OCPBUGS-85645): Add terminationMessagePolicy to build pod containers [#6045](https://github.com/openshift/machine-config-operator/pull/6045)
* [OCPBUGS-85386](https://issues.redhat.com/browse/OCPBUGS-85386): Fix CVE-2026-34986 [#6025](https://github.com/openshift/machine-config-operator/pull/6025)
* [OCPBUGS-85286](https://issues.redhat.com/browse/OCPBUGS-85286): Fix Admin Ack message for azure/vsphere clusters upgrading to 4.22 [#6017](https://github.com/openshift/machine-config-operator/pull/6017)
* [OCPBUGS-85126](https://issues.redhat.com/browse/OCPBUGS-85126): Fix units rollback if update failure [#6008](https://github.com/openshift/machine-config-operator/pull/6008)
* [OCPBUGS-84941](https://issues.redhat.com/browse/OCPBUGS-84941): Fix ssh and password rollbacks [#5987](https://github.com/openshift/machine-config-operator/pull/5987)
* [OCPBUGS-84970](https://issues.redhat.com/browse/OCPBUGS-84970): Fix encapsulated IGN version [#5996](https://github.com/openshift/machine-config-operator/pull/5996)
* [OCPBUGS-84878](https://issues.redhat.com/browse/OCPBUGS-84878): Update AMI Whitelist [#5915](https://github.com/openshift/machine-config-operator/pull/5915)
* [OCPBUGS-84253](https://issues.redhat.com/browse/OCPBUGS-84253): improve JSON unmarshalling for secret decoding [#5877](https://github.com/openshift/machine-config-operator/pull/5877)
* [OCPBUGS-83874](https://issues.redhat.com/browse/OCPBUGS-83874): Allow enablement of systemd units with existing files [#5869](https://github.com/openshift/machine-config-operator/pull/5869)
* [OCPBUGS-83708](https://issues.redhat.com/browse/OCPBUGS-83708): Update AMI Whitelist [#5857](https://github.com/openshift/machine-config-operator/pull/5857)
* [OCPBUGS-83390](https://issues.redhat.com/browse/OCPBUGS-83390): Use HA leader election defaults for MCO on SNO [#5838](https://github.com/openshift/machine-config-operator/pull/5838)
* [OCPBUGS-81711](https://issues.redhat.com/browse/OCPBUGS-81711): When adding new nodes, MCD executes commands after setting the nodes' state as Done [#5836](https://github.com/openshift/machine-config-operator/pull/5836)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/5b0cdfd2162dcd354e4ff9f31286c5b5bff3f1dc...4e11f4db779899ed2da55452f7c213ee414163a1)


### [machine-os-images](https://github.com/openshift/machine-os-images/tree/581c9d9e453c73f67a93c44fb6715057c0cc8bf5)

* [OCPBUGS-87873](https://issues.redhat.com/browse/OCPBUGS-87873): Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs [#97](https://github.com/openshift/machine-os-images/pull/97)
* [OCPBUGS-85478](https://issues.redhat.com/browse/OCPBUGS-85478): Force rebuild for OCP 4.21 [#93](https://github.com/openshift/machine-os-images/pull/93)
* [OCPBUGS-85478](https://issues.redhat.com/browse/OCPBUGS-85478): Force rebuild for OCP 4.21 [#89](https://github.com/openshift/machine-os-images/pull/89)
* [Full changelog](https://github.com/openshift/machine-os-images/compare/9a8e96a60bb6d8e3c86c2780fd4212e80f5d28e5...581c9d9e453c73f67a93c44fb6715057c0cc8bf5)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/563488150549466015299a876981a19e54c22b8b)

* [OCPBUGS-98789](https://issues.redhat.com/browse/OCPBUGS-98789): [release-4.21] replace outdated react-linkify dependency [#1149](https://github.com/openshift/monitoring-plugin/pull/1149)
* [OCPBUGS-98425](https://issues.redhat.com/browse/OCPBUGS-98425): fix for CVE-2026-59869 [#1136](https://github.com/openshift/monitoring-plugin/pull/1136)
* Fix for OCPBUGS-89702: CVE-2026-12143 [#1090](https://github.com/openshift/monitoring-plugin/pull/1090)
* NO-JIRA: [release-4.21] - e2e monitoring stabilization [#919](https://github.com/openshift/monitoring-plugin/pull/919)
* [OCPBUGS-99028](https://issues.redhat.com/browse/OCPBUGS-99028): Fix CVE-2026-49978 - bump DOMPurify to &gt;= 3.4.7 [#1086](https://github.com/openshift/monitoring-plugin/pull/1086)
* [OU-1240](https://issues.redhat.com/browse/OU-1240): Makefile and package.json to enable test-frontend-ci [#1095](https://github.com/openshift/monitoring-plugin/pull/1095)
* [OCPBUGS-99283](https://issues.redhat.com/browse/OCPBUGS-99283): graph redirect query parameter [#1072](https://github.com/openshift/monitoring-plugin/pull/1072)
* [OU-651](https://issues.redhat.com/browse/OU-651): Fix AlertRules page to display user defined loki alerts [#1060](https://github.com/openshift/monitoring-plugin/pull/1060)
* Fix for OCPBUGS-91631: CVE-2026-45736 [#1024](https://github.com/openshift/monitoring-plugin/pull/1024)
* [OU-1396](https://issues.redhat.com/browse/OU-1396): [release-4.21] fix: use replace to set variables to avoid navigation trap [#1033](https://github.com/openshift/monitoring-plugin/pull/1033)
* NO-JIRA: fix incidents unit test [#1037](https://github.com/openshift/monitoring-plugin/pull/1037)
* Fix for OCPBUGS-94011: CVE-2026-13676 [#1029](https://github.com/openshift/monitoring-plugin/pull/1029)
* [OCPBUGS-87088](https://issues.redhat.com/browse/OCPBUGS-87088): [release-4.21] fast-uri: URI authority bypass due to improper delimiter handling [#973](https://github.com/openshift/monitoring-plugin/pull/973)
* [OCPBUGS-88396](https://issues.redhat.com/browse/OCPBUGS-88396): CVE-2026-44487 bump axios to 1.16.0 [#999](https://github.com/openshift/monitoring-plugin/pull/999)
* [OCPBUGS-84290](https://issues.redhat.com/browse/OCPBUGS-84290): bump follow-redirects to 1.16.0 [#987](https://github.com/openshift/monitoring-plugin/pull/987)
* [OCPBUGS-84828](https://issues.redhat.com/browse/OCPBUGS-84828), [OCPBUGS-84991](https://issues.redhat.com/browse/OCPBUGS-84991), [OCPBUGS-85007](https://issues.redhat.com/browse/OCPBUGS-85007), [OCPBUGS-85037](https://issues.redhat.com/browse/OCPBUGS-85037): Update Axios to v1.15.2 [#982](https://github.com/openshift/monitoring-plugin/pull/982)
* [OCPBUGS-79460](https://issues.redhat.com/browse/OCPBUGS-79460): immutable bump: fix for CVE-2026-29063 [4.21] [#947](https://github.com/openshift/monitoring-plugin/pull/947)
* [OU-1368](https://issues.redhat.com/browse/OU-1368): reset queries when namespace changes in dev perspective [#940](https://github.com/openshift/monitoring-plugin/pull/940)
* [OU-1367](https://issues.redhat.com/browse/OU-1367): prevent namespace and project desync [#937](https://github.com/openshift/monitoring-plugin/pull/937)
* NO-JIRA: release-4.21 e2e-monitoring and e2e-coo working [#904](https://github.com/openshift/monitoring-plugin/pull/904)
* [OCPBUGS-83494](https://issues.redhat.com/browse/OCPBUGS-83494): [release-4.21] feat: re enable dev console views [#856](https://github.com/openshift/monitoring-plugin/pull/856)
* [OCPBUGS-83304](https://issues.redhat.com/browse/OCPBUGS-83304): [release-4.21] openshift4/ose-monitoring-plugin-rhel9: Axios: Remote Code Execution via Prototype Pollution escalation [#890](https://github.com/openshift/monitoring-plugin/pull/890)
* [OCPBUGS-82302](https://issues.redhat.com/browse/OCPBUGS-82302): [release-4.21] fix: re encode params when redirecting from graph to query-browser [#871](https://github.com/openshift/monitoring-plugin/pull/871)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/9d65f65fad61b07bc2bc5f69803692f77ff95181...563488150549466015299a876981a19e54c22b8b)


### [multus-cni, multus-cni-microshift](https://github.com/openshift/multus-cni/tree/8f5dd8b1e9f0c2b2404e3c8ddcffb1fd9441003d)

* [OCPBUGS-80831](https://issues.redhat.com/browse/OCPBUGS-80831): bump grpc to 1.79.3 to address CVE-2026-33186 [#310](https://github.com/openshift/multus-cni/pull/310)
* [OCPBUGS-82064](https://issues.redhat.com/browse/OCPBUGS-82064): Bump CNI version to 1.1.0 [#284](https://github.com/openshift/multus-cni/pull/284)
* [Full changelog](https://github.com/openshift/multus-cni/compare/93556f99405e29900c5445f7bbf7c70b8935e339...8f5dd8b1e9f0c2b2404e3c8ddcffb1fd9441003d)


### [must-gather](https://github.com/openshift/must-gather/tree/eeb267f4b7f8016f13d12866013cad43c7403482)

* [OCPBUGS-85050](https://issues.redhat.com/browse/OCPBUGS-85050): Collect object size with the object count [#542](https://github.com/openshift/must-gather/pull/542)
* [Full changelog](https://github.com/openshift/must-gather/compare/b4b434c427ddde3dafd8518d1aa754e49b7bfef1...eeb267f4b7f8016f13d12866013cad43c7403482)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/bb43b26444230a391f36feec1811d1fa9523f703)

* [OCPBUGS-85606](https://issues.redhat.com/browse/OCPBUGS-85606): Fix React error on MultiNetworkPolicies page [#484](https://github.com/openshift/networking-console-plugin/pull/484)
* [OCPBUGS-98790](https://issues.redhat.com/browse/OCPBUGS-98790): Updating linkify-it to 5.0.2 to fix CVE-2026-48801 [#463](https://github.com/openshift/networking-console-plugin/pull/463)
* [OCPBUGS-74099](https://issues.redhat.com/browse/OCPBUGS-74099): fixed translations of pod column titles [#435](https://github.com/openshift/networking-console-plugin/pull/435)
* [OCPBUGS-92375](https://issues.redhat.com/browse/OCPBUGS-92375): Updated doc links based on release [#439](https://github.com/openshift/networking-console-plugin/pull/439)
* [OCPBUGS-88313](https://issues.redhat.com/browse/OCPBUGS-88313): Trim subnet input in UDN creation form [#430](https://github.com/openshift/networking-console-plugin/pull/430)
* [OCPBUGS-81620](https://issues.redhat.com/browse/OCPBUGS-81620): Update lodash to 4.18.1 for CVE-2026-4800 [#372](https://github.com/openshift/networking-console-plugin/pull/372)
* [OCPBUGS-83388](https://issues.redhat.com/browse/OCPBUGS-83388): Fix CVE-2026-34043 in serialize-javascript [#369](https://github.com/openshift/networking-console-plugin/pull/369)
* [OCPBUGS-82161](https://issues.redhat.com/browse/OCPBUGS-82161): Migrate to npm [#359](https://github.com/openshift/networking-console-plugin/pull/359)
* [OCPBUGS-66283](https://issues.redhat.com/browse/OCPBUGS-66283), [OCPBUGS-67252](https://issues.redhat.com/browse/OCPBUGS-67252), [OCPBUGS-70285](https://issues.redhat.com/browse/OCPBUGS-70285), [OCPBUGS-74473](https://issues.redhat.com/browse/OCPBUGS-74473): Fix CVEs via upgrading yarn.lock [#346](https://github.com/openshift/networking-console-plugin/pull/346)
* [CNV-59877](https://issues.redhat.com/browse/CNV-59877): Fix permissions request for NADs [#353](https://github.com/openshift/networking-console-plugin/pull/353)
* [OCPBUGS-77887](https://issues.redhat.com/browse/OCPBUGS-77887): Clean up cruft in /var/cache/dnf [#361](https://github.com/openshift/networking-console-plugin/pull/361)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/0e839893223991122cfb7cf8722ba651727aa9f3...bb43b26444230a391f36feec1811d1fa9523f703)


### [oauth-server](https://github.com/openshift/oauth-server/tree/85a8ae3529821203c39559c4df6231ef3607e64e)

* [OCPBUGS-81816](https://issues.redhat.com/browse/OCPBUGS-81816): Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 [#234](https://github.com/openshift/oauth-server/pull/234)
* [Full changelog](https://github.com/openshift/oauth-server/compare/2b8183592190365c269ca0c92b1955bbad9a0236...85a8ae3529821203c39559c4df6231ef3607e64e)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/9c41c399a30d4e3a6e2f60aae8b4fbee1013c9c2)

* [OCPBUGS-105785](https://issues.redhat.com/browse/OCPBUGS-105785): fix for CVE-2026-39829 [#1503](https://github.com/openshift/oc-mirror/pull/1503)
* Fix for OCPBUGS-81971: CVE-2026-34986 github.com/go-jose/go-jose/v4 [#1426](https://github.com/openshift/oc-mirror/pull/1426)
* [OCPBUGS-82546](https://issues.redhat.com/browse/OCPBUGS-82546): Only print catalog rebuild message if there are catalogs to rebuild [#1388](https://github.com/openshift/oc-mirror/pull/1388)
* [OCPBUGS-82543](https://issues.redhat.com/browse/OCPBUGS-82543): Fix printing collection messages with 0 collection items [#1387](https://github.com/openshift/oc-mirror/pull/1387)
* [OCPBUGS-81743](https://issues.redhat.com/browse/OCPBUGS-81743): Remove status field from CatalogSource, ClusterCatalog... [#1383](https://github.com/openshift/oc-mirror/pull/1383)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/12f1b068e9928aa68e5505fc16fcaaac3dfd27d3...9c41c399a30d4e3a6e2f60aae8b4fbee1013c9c2)


### [olm-catalogd, olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller/tree/92ef079dccfdf08c11d653113d5758827e67616c)

* [OCPBUGS-100383](https://issues.redhat.com/browse/OCPBUGS-100383): Fix cache path to avoid /var/cache/dnf conflict [#785](https://github.com/openshift/operator-framework-operator-controller/pull/785)
* [OCPBUGS-98090](https://issues.redhat.com/browse/OCPBUGS-98090): fix(test): use in-cluster catalog for preflight permission checks [release-4.21] [#778](https://github.com/openshift/operator-framework-operator-controller/pull/778)
* [OCPBUGS-99756](https://issues.redhat.com/browse/OCPBUGS-99756): increase catalog HTTP client timeout from 10s to 5m [#774](https://github.com/openshift/operator-framework-operator-controller/pull/774)
* [OCPBUGS-86842](https://issues.redhat.com/browse/OCPBUGS-86842): [release-4.21] catalogd: clean up orphaned temp dirs in catalog storage [#742](https://github.com/openshift/operator-framework-operator-controller/pull/742)
* [OCPBUGS-81993](https://issues.redhat.com/browse/OCPBUGS-81993), [OCPBUGS-81994](https://issues.redhat.com/browse/OCPBUGS-81994): Bump github.com/go-jose/go-jose/v4 to 4.1.4 [#718](https://github.com/openshift/operator-framework-operator-controller/pull/718)
* [OCPBUGS-80839](https://issues.redhat.com/browse/OCPBUGS-80839), [OCPBUGS-80840](https://issues.redhat.com/browse/OCPBUGS-80840): Bump google.golang.org/grpc to v1.79.3 [#721](https://github.com/openshift/operator-framework-operator-controller/pull/721)
* [Full changelog](https://github.com/openshift/operator-framework-operator-controller/compare/d0f315fc0008290ca7d6d908ba1d2465907fc7de...92ef079dccfdf08c11d653113d5758827e67616c)


### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/f427de801b98823e486bdd5955468d88e95c2ac4)

* [OCPBUGS-82918](https://issues.redhat.com/browse/OCPBUGS-82918): Address CVE-2026-35469 [#646](https://github.com/openshift/openshift-apiserver/pull/646)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/64dea074d6b457e1fae3598cea0bb72493d2cab8...f427de801b98823e486bdd5955468d88e95c2ac4)


### [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack/tree/f4f439d4ce40c1175188c81591284dcc9fe6facf)

* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.13 into release-4.21 [#394](https://github.com/openshift/cluster-api-provider-openstack/pull/394)
* [Full changelog](https://github.com/openshift/cluster-api-provider-openstack/compare/e1c0f2f9e2e70843d5c42dfe3bddf70530a97b0f...f4f439d4ce40c1175188c81591284dcc9fe6facf)


### [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack/tree/b7456a2a12d1e65a5688693a005ad1e18aaee1be)

* [OCPBUGS-97825](https://issues.redhat.com/browse/OCPBUGS-97825): Revendor CAPO [#176](https://github.com/openshift/machine-api-provider-openstack/pull/176)
* [Full changelog](https://github.com/openshift/machine-api-provider-openstack/compare/b1fdb10f47f3bdb5c2902fac1d53bfa98c3a88ab...b7456a2a12d1e65a5688693a005ad1e18aaee1be)


### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/149d553b2057320d761c4d1913098a66787dd09a)

* [OCPBUGS-81995](https://issues.redhat.com/browse/OCPBUGS-81995), [OCPBUGS-81996](https://issues.redhat.com/browse/OCPBUGS-81996), [OCPBUGS-81997](https://issues.redhat.com/browse/OCPBUGS-81997): Bump github.com/go-jose/go-jose/v4 to v4.1.4 [#1294](https://github.com/openshift/operator-framework-olm/pull/1294)
* [OCPBUGS-80847](https://issues.redhat.com/browse/OCPBUGS-80847), [OCPBUGS-80848](https://issues.redhat.com/browse/OCPBUGS-80848), [OCPBUGS-80849](https://issues.redhat.com/browse/OCPBUGS-80849): Bump google.golang.org/grpc to v1.79.3 for CVE-2026-33186[Release-4.21] [#1289](https://github.com/openshift/operator-framework-olm/pull/1289)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/d7462e05f60c0ad13a2dce6ea516cbc624cae203...149d553b2057320d761c4d1913098a66787dd09a)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/e2e61dbe576da162f711394c89068b8067f72343)

* [OCPBUGS-112513](https://issues.redhat.com/browse/OCPBUGS-112513): NO-JIRA: Branch Sync release-4.22 to release-4.21 [08-21-2026] [#3413](https://github.com/openshift/ovn-kubernetes/pull/3413)
* [OCPBUGS-99165](https://issues.redhat.com/browse/OCPBUGS-99165): Branch Sync release-4.22 to release-4.21 [08-13-2026] [#3393](https://github.com/openshift/ovn-kubernetes/pull/3393)
* [OCPBUGS-105516](https://issues.redhat.com/browse/OCPBUGS-105516), [OCPBUGS-105605](https://issues.redhat.com/browse/OCPBUGS-105605): Branch Sync release-4.22 to release-4.21 [08-10-2026] [#3374](https://github.com/openshift/ovn-kubernetes/pull/3374)
* [OCPBUGS-90029](https://issues.redhat.com/browse/OCPBUGS-90029), [OCPBUGS-90470](https://issues.redhat.com/browse/OCPBUGS-90470), [OCPBUGS-92544](https://issues.redhat.com/browse/OCPBUGS-92544), [OCPBUGS-93018](https://issues.redhat.com/browse/OCPBUGS-93018): Branch Sync release-4.22 to release-4.21 [08-06-2026] [#3365](https://github.com/openshift/ovn-kubernetes/pull/3365)
* [OCPBUGS-95075](https://issues.redhat.com/browse/OCPBUGS-95075): Branch Sync release-4.22 to release-4.21 [07-29-2026] [#3337](https://github.com/openshift/ovn-kubernetes/pull/3337)
* [OCPBUGS-99276](https://issues.redhat.com/browse/OCPBUGS-99276), [OCPBUGS-99277](https://issues.redhat.com/browse/OCPBUGS-99277): Branch Sync release-4.22 to release-4.21 [07-20-2026] [#3306](https://github.com/openshift/ovn-kubernetes/pull/3306)
* [OCPBUGS-99165](https://issues.redhat.com/browse/OCPBUGS-99165): Branch Sync release-4.22 to release-4.21 [07-15-2026] [#3300](https://github.com/openshift/ovn-kubernetes/pull/3300)
* [OCPBUGS-98398](https://issues.redhat.com/browse/OCPBUGS-98398): Branch Sync release-4.22 to release-4.21 [06-10-2026] [#3243](https://github.com/openshift/ovn-kubernetes/pull/3243)
* [OCPBUGS-84923](https://issues.redhat.com/browse/OCPBUGS-84923): Branch Sync release-4.22 to release-4.21 [04-27-2026] [#3160](https://github.com/openshift/ovn-kubernetes/pull/3160)
* [OCPBUGS-81634](https://issues.redhat.com/browse/OCPBUGS-81634), [OCPBUGS-83814](https://issues.redhat.com/browse/OCPBUGS-83814): Branch Sync release-4.22 to release-4.21 [04-16-2026] [#3145](https://github.com/openshift/ovn-kubernetes/pull/3145)
* [OCPBUGS-83566](https://issues.redhat.com/browse/OCPBUGS-83566): Branch Sync release-4.22 to release-4.21 [03-25-2026] [#3087](https://github.com/openshift/ovn-kubernetes/pull/3087)
* [OCPBUGS-81475](https://issues.redhat.com/browse/OCPBUGS-81475): node: fix serviceUpdateNotNeeded nil pointer comparison [#3098](https://github.com/openshift/ovn-kubernetes/pull/3098)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/0fd9d309727f67d7648d0fbfa29bdbbdfdf14ae3...e2e61dbe576da162f711394c89068b8067f72343)


### [powervs-block-csi-driver](https://github.com/openshift/ibm-powervs-block-csi-driver/tree/114fe69249450f3bec773cba2956a8c06e7b0da9)

* [OCPBUGS-80852](https://issues.redhat.com/browse/OCPBUGS-80852): Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 [#127](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/127)
* [OCPBUGS-82924](https://issues.redhat.com/browse/OCPBUGS-82924): Fix CVE-2026-35469 by bumping github.com/moby/spdystream to v0.5.1 [#121](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/121)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver/compare/791e12aba9ab7c4fed1e5f9554e5b9ec86342e1a...114fe69249450f3bec773cba2956a8c06e7b0da9)


### [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs/tree/40d1c0adfedeca36498a5d93d69aee96831c756d)

* [OCPBUGS-80854](https://issues.redhat.com/browse/OCPBUGS-80854): bump google.golang.org/grpc to v1.79.3 to fix CVE-2026-33186 [#98](https://github.com/openshift/cloud-provider-powervs/pull/98)
* [Full changelog](https://github.com/openshift/cloud-provider-powervs/compare/969a04e9dcb4cdde10e3038a9e28d2e27548918d...40d1c0adfedeca36498a5d93d69aee96831c756d)


### [prometheus](https://github.com/openshift/prometheus/tree/6e65a831d39940685cf4cfaf6343278c163edede)

* [OCPBUGS-93729](https://issues.redhat.com/browse/OCPBUGS-93729): fix for CVE-2026-42151 [#357](https://github.com/openshift/prometheus/pull/357)
* [OCPBUGS-88670](https://issues.redhat.com/browse/OCPBUGS-88670): remote: validate snappy decoded length before allocation in read endpoint [#331](https://github.com/openshift/prometheus/pull/331)
* [OCPBUGS-93920](https://issues.redhat.com/browse/OCPBUGS-93920): fix(tsdb): temporarily ignore Direct IO enablement errors on unsupported filesystems [#340](https://github.com/openshift/prometheus/pull/340)
* [OCPBUGS-86250](https://issues.redhat.com/browse/OCPBUGS-86250): fix: TLS client cert rotation when no CA is configured [#314](https://github.com/openshift/prometheus/pull/314)
* [OCPBUGS-80855](https://issues.redhat.com/browse/OCPBUGS-80855): Bump google.golang.org/grpc to v1.79.3 [#309](https://github.com/openshift/prometheus/pull/309)
* [Full changelog](https://github.com/openshift/prometheus/compare/59769d912ceab62bf0b7325c505ed463e64ab734...6e65a831d39940685cf4cfaf6343278c163edede)


### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/9b60183df3d2e4aa0e90a7ecf09855e2ee91d39b)

* [OCPBUGS-98182](https://issues.redhat.com/browse/OCPBUGS-98182): build(deps): bump github.com/hashicorp/memberlist to a forked version which fixes CVE-2026-14362 [#158](https://github.com/openshift/prometheus-alertmanager/pull/158)
* [OCPBUGS-100352](https://issues.redhat.com/browse/OCPBUGS-100352): Set testdata CA expiry to 20 years from issue date (#4112) [#145](https://github.com/openshift/prometheus-alertmanager/pull/145)
* [OCPBUGS-99446](https://issues.redhat.com/browse/OCPBUGS-99446): embed tzdata in the alertmanager binary [#142](https://github.com/openshift/prometheus-alertmanager/pull/142)
* [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/3dbe0b64ae3b9439b888be65a32431c7bf0d6806...9b60183df3d2e4aa0e90a7ecf09855e2ee91d39b)


### [rhel-coreos, rhel-coreos-extensions](https://github.com/openshift/os/tree/b3f3bce740fa6b32bf2c06dd8a6f31bdb831915e)

* [OCPBUGS-105490](https://issues.redhat.com/browse/OCPBUGS-105490): NetworkManager-ovs has moved to RHCOS [#1957](https://github.com/openshift/os/pull/1957)
* [OCPBUGS-82523](https://issues.redhat.com/browse/OCPBUGS-82523): post-process: Remove workaround for openvswitch additional group [#1926](https://github.com/openshift/os/pull/1926)
* [Full changelog](https://github.com/openshift/os/compare/83a448067f52b8e70b2fe26d8a1deeab41fe4348...b3f3bce740fa6b32bf2c06dd8a6f31bdb831915e)


### [rhel-coreos-10, rhel-coreos-10-extensions](https://github.com/openshift/os/tree/10f1a2e738aa55fff22dbe0346609e83a5f6eb90)

* [OCPBUGS-82523](https://issues.redhat.com/browse/OCPBUGS-82523): post-process: Remove workaround for openvswitch additional group [#1926](https://github.com/openshift/os/pull/1926)
* [Full changelog](https://github.com/openshift/os/compare/83a448067f52b8e70b2fe26d8a1deeab41fe4348...10f1a2e738aa55fff22dbe0346609e83a5f6eb90)


### [route-controller-manager](https://github.com/openshift/route-controller-manager/tree/166a3e96f8151d9e789b3951ae75b03cdede5081)

* [OCPBUGS-80726](https://issues.redhat.com/browse/OCPBUGS-80726): Bump google.golang.org/grpc to v1.79.3 [#82](https://github.com/openshift/route-controller-manager/pull/82)
* [Full changelog](https://github.com/openshift/route-controller-manager/compare/559b7122d1a0cad4ff475b496c2896b39eed8c08...166a3e96f8151d9e789b3951ae75b03cdede5081)


### [telemeter](https://github.com/openshift/telemeter/tree/b79b872a65edd845891db70f6c9a184458a178da)

* [OCPBUGS-80868](https://issues.redhat.com/browse/OCPBUGS-80868): Bump google.golang.org/grpc to v1.79.3 [#589](https://github.com/openshift/telemeter/pull/589)
* [OCPBUGS-81817](https://issues.redhat.com/browse/OCPBUGS-81817): [release-1.21] Fix CVE-2026-34986 [#593](https://github.com/openshift/telemeter/pull/593)
* [Full changelog](https://github.com/openshift/telemeter/compare/a54acdfeb2d62c79516d099e37f3319205c903a7...b79b872a65edd845891db70f6c9a184458a178da)


### [tests](https://github.com/openshift/origin/tree/5909517e5c1325b035d11d416ae274bd7a3ae9ee)

* [OCPBUGS-114439](https://issues.redhat.com/browse/OCPBUGS-114439): Fix probe termination test to use pod status instead of kubelet event text [#31569](https://github.com/openshift/origin/pull/31569)
* [OCPBUGS-100439](https://issues.redhat.com/browse/OCPBUGS-100439): retry GetVotingMemberNames on transient etcd client fails [#31507](https://github.com/openshift/origin/pull/31507)
* [OCPBUGS-99671](https://issues.redhat.com/browse/OCPBUGS-99671): Backport node_e2e test migrations [#31426](https://github.com/openshift/origin/pull/31426)
* [OCPBUGS-99300](https://issues.redhat.com/browse/OCPBUGS-99300): admit and extract non-payload 4.21 [#31386](https://github.com/openshift/origin/pull/31386)
* [OCPBUGS-90523](https://issues.redhat.com/browse/OCPBUGS-90523): Use AdminPolicyBasedExternalRoute CR for external gateway test [#31316](https://github.com/openshift/origin/pull/31316)
* [OCPBUGS-94114](https://issues.redhat.com/browse/OCPBUGS-94114): support Parents field on origin test suites [#31353](https://github.com/openshift/origin/pull/31353)
* [OCPBUGS-88564](https://issues.redhat.com/browse/OCPBUGS-88564): fix CUDN status condition tests for NetworkAllocationSucceeded condition [#31300](https://github.com/openshift/origin/pull/31300)
* [OCPBUGS-84252](https://issues.redhat.com/browse/OCPBUGS-84252): Move imagepolicy test to disruptive long-running suite [#31061](https://github.com/openshift/origin/pull/31061)
* [OCPBUGS-78330](https://issues.redhat.com/browse/OCPBUGS-78330), [OCPBUGS-82146](https://issues.redhat.com/browse/OCPBUGS-82146), [OCPBUGS-85550](https://issues.redhat.com/browse/OCPBUGS-85550), [OCPBUGS-88295](https://issues.redhat.com/browse/OCPBUGS-88295), [OCPBUGS-88297](https://issues.redhat.com/browse/OCPBUGS-88297), [OCPBUGS-88320](https://issues.redhat.com/browse/OCPBUGS-88320), [OCPBUGS-88322](https://issues.redhat.com/browse/OCPBUGS-88322), [OCPBUGS-88324](https://issues.redhat.com/browse/OCPBUGS-88324): Backport noOLM Gateway API test coverage and upgrade tests [#31232](https://github.com/openshift/origin/pull/31232)
* [OCPBUGS-88328](https://issues.redhat.com/browse/OCPBUGS-88328): Fix Pod.Create() to use --local flag for template proc… [#31269](https://github.com/openshift/origin/pull/31269)
* [OCPBUGS-85149](https://issues.redhat.com/browse/OCPBUGS-85149): Enable Gateway API tests on vSphere and baremetal [#31139](https://github.com/openshift/origin/pull/31139)
* [OCPQE-32041](https://issues.redhat.com/browse/OCPQE-32041): bump(k8s): move docker types into container package [#31169](https://github.com/openshift/origin/pull/31169)
* [OCPBUGS-74373](https://issues.redhat.com/browse/OCPBUGS-74373): Remove restriction of unmanaged x-k8s.io [#30718](https://github.com/openshift/origin/pull/30718)
* [OCPBUGS-84655](https://issues.redhat.com/browse/OCPBUGS-84655): fix openshift/network/third-party suite selecting zero tests [#31091](https://github.com/openshift/origin/pull/31091)
* [OCPBUGS-84978](https://issues.redhat.com/browse/OCPBUGS-84978): Skip image-registry operator tests for Libvirt platform in upgrade jobs. [#31123](https://github.com/openshift/origin/pull/31123)
* [OCPBUGS-84947](https://issues.redhat.com/browse/OCPBUGS-84947): test: add monitortest to detect pods stuck in Pending state [#31117](https://github.com/openshift/origin/pull/31117)
* [OCPBUGS-84947](https://issues.redhat.com/browse/OCPBUGS-84947): Add [Late] test to collect CRI-O goroutine dumps via SIGUSR1 [#31118](https://github.com/openshift/origin/pull/31118)
* [OCPBUGS-81638](https://issues.redhat.com/browse/OCPBUGS-81638): Manual cherry-pick node swap feature testcases to 4.21 [#30973](https://github.com/openshift/origin/pull/30973)
* [OCPBUGS-82064](https://issues.redhat.com/browse/OCPBUGS-82064): Assert CNI version greater than equal to 1.0.0 [#30977](https://github.com/openshift/origin/pull/30977)
* [OCPBUGS-81638](https://issues.redhat.com/browse/OCPBUGS-81638): Add openshift/disruptive-longrunning testsuite in release-4.21 branch [#30976](https://github.com/openshift/origin/pull/30976)
* [Full changelog](https://github.com/openshift/origin/compare/ac4798a0489c3b6ec00f9d02b259f39474bfe0e4...5909517e5c1325b035d11d416ae274bd7a3ae9ee)


### [thanos](https://github.com/openshift/thanos/tree/afeb1c85ba9ee06676a0e657bfa4f4139ccc47b3)

* [OCPBUGS-84492](https://issues.redhat.com/browse/OCPBUGS-84492): Revert "OCPBUGS-80870: CVE-2026-33186 openshift4/ose-thanos-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation [openshift-4.21]" [#180](https://github.com/openshift/thanos/pull/180)
* [OCPBUGS-80870](https://issues.redhat.com/browse/OCPBUGS-80870): CVE-2026-33186 openshift4/ose-thanos-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation [openshift-4.21] [#174](https://github.com/openshift/thanos/pull/174)
* [Full changelog](https://github.com/openshift/thanos/compare/6ea20ffaa35b7b31fe7ef9a99287bdd4a1c1e4e8...afeb1c85ba9ee06676a0e657bfa4f4139ccc47b3)


### [vsphere-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-vsphere/tree/3adfe2b56b259b2d27906d8772354f817e338da5)

* [OCPBUGS-80875](https://issues.redhat.com/browse/OCPBUGS-80875): Bump google.golang.org/grpc to v1.79.3 [#102](https://github.com/openshift/cluster-api-provider-vsphere/pull/102)
* [Full changelog](https://github.com/openshift/cluster-api-provider-vsphere/compare/6626b2998e29189d1ff031c0a589f9c3413feac4...3adfe2b56b259b2d27906d8772354f817e338da5)


### [vsphere-csi-driver, vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver/tree/d163d71ccf646b3c2b36f4f2fd6ef78f3c254ed5)

* [OCPBUGS-96573](https://issues.redhat.com/browse/OCPBUGS-96573): Bump golang.org/x/net to v0.50.0-sec.4 [#196](https://github.com/openshift/vmware-vsphere-csi-driver/pull/196)
* [OCPBUGS-93031](https://issues.redhat.com/browse/OCPBUGS-93031): Bump golang.org/x/crypto/ssh to v0.48.0-sec.1 [#190](https://github.com/openshift/vmware-vsphere-csi-driver/pull/190)
* [OCPBUGS-80878](https://issues.redhat.com/browse/OCPBUGS-80878): Bump google.golang.org/grpc  to 1.79.3 [#171](https://github.com/openshift/vmware-vsphere-csi-driver/pull/171)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver/compare/5e680186a305e1e0a11950630f7addcb1aa19e0e...d163d71ccf646b3c2b36f4f2fd6ef78f3c254ed5)


### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/a644ba6cea8f898ef9a856b8ef955e23a1bf4868)

* [OCPBUGS-104206](https://issues.redhat.com/browse/OCPBUGS-104206): Bump golang.org/x/net to v0.50.0-sec.4 [#230](https://github.com/openshift/vsphere-problem-detector/pull/230)
* [OCPBUGS-87097](https://issues.redhat.com/browse/OCPBUGS-87097): Fixed compute cluster permission logic for single fd with read-only custom resourcepool [#222](https://github.com/openshift/vsphere-problem-detector/pull/222)
* [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/a35d685a88aca94ed1d805c1079ebf14dfb81c9d...a644ba6cea8f898ef9a856b8ef955e23a1bf4868)