# 4.21.39 Created: 2026-10-16 13:22:06 +0000 UTC Image Digest: `sha256:013f4512c7bbbb61f9490824e6997b451f2d4355013d8db4ea21ff4a03d72951` ## Changes from 4.21.19 ### Components * Kubectl 1.34.1 * Kubernetes upgraded from 1.34.8 to 1.34.9 * Kubernetes Tests 1.34.1 * Red Hat Enterprise Linux CoreOS 10.2.20260521-0 ### FeatureGate Changes | FeatureGate | Default
Hypershift | Default
SelfManagedHA | DevPreviewNoUpgrade
Hypershift | DevPreviewNoUpgrade
SelfManagedHA | TechPreviewNoUpgrade
Hypershift | TechPreviewNoUpgrade
SelfManagedHA | | :------ | :---: | :---: | :---: | :---: | :---: | :---: | | GatewayAPIWithoutOLM
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled
(Changed)| Enabled
(Changed)| Enabled
(Changed)| Enabled
(Changed) | | VSphereMultiVCenterDay2
(0 tests)| | | Enabled
(New)| Enabled
(New)| Enabled
(New)| Enabled
(New) | ### Rebuilt images without code change * [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy) git [35ba137a](https://github.com/openshift/apiserver-network-proxy/commit/35ba137ab96d01f0b8df729ff5ad93ac2fdad800) `sha256:c045b4e10cb808624c9b7c93883fd58ba835d7203de8943ef48b779f35143a88` * [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws) git [fdc7f3f1](https://github.com/openshift/cloud-provider-aws/commit/fdc7f3f15c693593cb573b6bef6f0363256b6f52) `sha256:3683ebd47a153bc8f325e5bc5c6d4695f2670e92f58b533bf42064a54a7541ef` * [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver) git [1d8cec7d](https://github.com/openshift/aws-ebs-csi-driver/commit/1d8cec7d0eeedf1497c3ee6c32ee3391ebb13709) `sha256:2bb060b17fe10a656e5ee493130ded35fc81054d15be5593a96a36f06685a8b8` * [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider) git [887615ff](https://github.com/openshift/aws-encryption-provider/commit/887615ffa8a595ee3693e92fa56db4dd30f20f73) `sha256:ba541fa2bc4d7b23041cec947ac3286cb7f42a05470ca2663253e133e65d8630` * [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook) git [5cd42ed1](https://github.com/openshift/aws-pod-identity-webhook/commit/5cd42ed1e5151f45f0134593e9cfebdb6517b385) `sha256:83204bfb272e551d3850f0782aa9e271627d3b90d5df5cd003a4bed022241440` * [azure-service-operator](https://github.com/openshift/azure-service-operator) git [5e84c831](https://github.com/openshift/azure-service-operator/commit/5e84c83176d7630f70802b35cb10cdf2b60fd6d3) `sha256:443672e552c80c984dcdbdd1c3927ace1c40deb4df5dd8394b943f86f8717ee6` * [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3) git [659138fe](https://github.com/openshift/cluster-api-provider-metal3/commit/659138fef3abd4c71b0b01fa1279146745699a5a) `sha256:a7128cd9293090a91e065648ba0d0997ad67e18b4d345336e6083b62fb562dde` * [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal) git [4e6a729c](https://github.com/openshift/cluster-api-provider-baremetal/commit/4e6a729c5ac8fde8859db5830def262dfdee28ea) `sha256:7a03ae1ae67d4b22b786a9a64330085aa98dc0ad82c3b7bfa06a8a0106f859a5` * [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg) git [d7e3fc12](https://github.com/openshift/baremetal-runtimecfg/commit/d7e3fc12bd9dc911f0fac4c9a46b814c7be62b14) `sha256:587466a46211a4dc958e8fd4267e69cbbe11e3f1c452855efcef97020aa763e1` * [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller) git [57db2d05](https://github.com/openshift/cloud-network-config-controller/commit/57db2d05e057dc90bae3dc1b0e806b3259d38fc0) `sha256:1670049d73cf2893ad8c4c91ce08da9568e8402f70ad7f0a2fbef44f7ca66d43` * [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap) git [dc0d4a5c](https://github.com/openshift/cluster-bootstrap/commit/dc0d4a5cdaf8a7477cab584208dc99352f46efe2) `sha256:522800f96de7c67f0434fc1e954341550607314427ac0b828ca629d24611493d` * [cluster-capi-controllers](https://github.com/openshift/cluster-api) git [9dd5eba0](https://github.com/openshift/cluster-api/commit/9dd5eba07922bb84bf1ec2b16cbbedd6ad195874) `sha256:08426fd0bd941f6f745ec49fdcb69fbca3688973590c4a10e9054dfbf3bae739` * [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator) git [41a53fed](https://github.com/openshift/cluster-dns-operator/commit/41a53fed36e6e99c7c9ceb3a699c3547ee5d9bb9) `sha256:a7299594b8eae802e24ede4d4bb8284bc6583a9bfda16157b31f67ae9acc3413` * [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator) git [8a42beeb](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/commit/8a42beebd580bd2e241aa6d93860c09e907f2407) `sha256:ba9832006222fae0926c62619680f58a98068a611bd4707c07bb1a5cac4717a2` * [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver) git [d864813c](https://github.com/openshift/cluster-machine-approver/commit/d864813cd3ab01c0f975b2bf41e9046948f0afa1) `sha256:2e93d6e1800a21a9480121ccd897885f562715c29b7bc7580998683d57a931f5` * [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator) git [2617a201](https://github.com/openshift/cluster-openshift-controller-manager-operator/commit/2617a201bb3607192a9f82faa18384676f611e3c) `sha256:71d1619f7a8683f612ca9d20b43f5dc8f1dc3d7e105598eafb64a3a07c796c0e` * [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator) git [11ed1942](https://github.com/openshift/cluster-samples-operator/commit/11ed1942dbbf7a8334862b3d598a967e9b92aa77) `sha256:bb05ab88b48d883eb9d5377653ca544edc77d0f4ca41876988a76cbf122d3bef` * [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [b3cae8f2](https://github.com/openshift/cluster-update-keys/commit/b3cae8f22b51d9062d0ceb6ac9cf2f7651b4ce8f) `sha256:defdeb81dc867bdbf57eb72601fe65ffda668c2f8ea0c6e3f2d3bef0453c6e31` * [configmap-reloader](https://github.com/openshift/configmap-reload) git [16114b8d](https://github.com/openshift/configmap-reload/commit/16114b8de20278b8f4b7a425ece6d35d53214773) `sha256:515ed784bcc75cc4633120c7e7c1ad7055de692e8aac888049b23d3f82e4d8b0` * [container-networking-plugins](https://github.com/openshift/containernetworking-plugins) git [747ad66c](https://github.com/openshift/containernetworking-plugins/commit/747ad66caa1109b2b490aebad01af42bd2d738f1) `sha256:15b675d4095b978270bc7a6243f7efeb7823b5db2f39a707911673d5e7cfa254` * [containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins) git [747ad66c](https://github.com/openshift/containernetworking-plugins/commit/747ad66caa1109b2b490aebad01af42bd2d738f1) `sha256:6ff8700a13310723f37672994a22ff2a2f957f6984e1415dcb1b735436ba50de` * [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe) git [78dacb7c](https://github.com/openshift/csi-livenessprobe/commit/78dacb7c661a62c78036c2737401afd3eb6fd04d) `sha256:aa1a59d66270abb154a028b887d401d35d28539f07f8e0a1a1b49d4c6297cde4` * [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar) git [d29f3f7a](https://github.com/openshift/csi-node-driver-registrar/commit/d29f3f7a4aed4465e7e40e323bd3c0e0d9871e4c) `sha256:14555aadb84071820b41320c8e8e44f7442c5db7e7349384b49baa830d94426c` * [driver-toolkit](https://github.com/openshift/driver-toolkit) git [f0ae9d12](https://github.com/openshift/driver-toolkit/commit/f0ae9d12ca7e3adf594ae34e394b1ea003daa4ad) `sha256:230fb420fe599519e1b2cb776acadab6efe71d411ba7939398620d145bb43107` * [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp) git [fe230b8a](https://github.com/openshift/cluster-api-provider-gcp/commit/fe230b8a6407a06e1be9d6994a92ac8c5a43237d) `sha256:5cf89919765ebfcf1768f8a6fd712dee5d8e4cc84cff0949caa0c76bbbbb2aa1` * [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook) git [d481e5cb](https://github.com/openshift/gcp-workload-identity-federation-webhook/commit/d481e5cb9323b01964bf143b58403b62fa31e5e7) `sha256:3119b501264a388931457af94ae580612c3b9196d505a87c468e5ae854b99cd1` * [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver) git [f0baa47e](https://github.com/openshift/ibm-vpc-block-csi-driver/commit/f0baa47e75ab0bef0ec56ab48d9a725e00f6b40f) `sha256:3b3eea7d3b70c3338832158c130f0bb2e1cff13e0ff9bc59c4091fc7cd3d4c4a` * [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [707c2262](https://github.com/openshift/ironic-rhcos-downloader/commit/707c226243ac401f2994952fe0e55823511111b0) `sha256:c1705bb3060969bbfc25f55c15626eba669f32903953394d23812939e76fc56f` * [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager) git [b95b05fe](https://github.com/openshift/ironic-static-ip-manager/commit/b95b05fe0ba17255ef61e92d4167ca4c9de789b8) `sha256:4b92421d37aec6a426fb0d084949605146141a24e406a293caa5ffa3b1fa86ec` * [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator) git [ce5ff17e](https://github.com/openshift/kubernetes-kube-storage-version-migrator/commit/ce5ff17e9a81ce754567e6dd5053d13409c251e9) `sha256:d8fada4ab559c763908582bc4392d12aece6897a94a25e939904e26fe8818716` * [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt) git [1e6fdd66](https://github.com/openshift/cloud-provider-kubevirt/commit/1e6fdd6615a55fc449b3e7ad2d6e92a27d30a934) `sha256:4ed97f0cf5c9731d2e2ad73bb519aad4e3799e1519e5023c6974a058b0c7c55f` * [metallb-frr](https://github.com/openshift/frr) git [c82bfaad](https://github.com/openshift/frr/commit/c82bfaad01b196e12f00622a9a609d87e0a56701) `sha256:716b3034a4ff7d32e753b081ece1eed2d702128119b2a239d501358531fa6de6` * [multus-route-override-cni](https://github.com/openshift/route-override-cni) git [08af4127](https://github.com/openshift/route-override-cni/commit/08af4127c77976510cad1c096d9aca977d8ae5af) `sha256:d68751820aaa88d8f5d1b89673b4989de94a0bd3d257742c4a176ec6d83b8a3e` * [must-gather](https://github.com/openshift/must-gather) git [eeb267f4](https://github.com/openshift/must-gather/commit/eeb267f4b7f8016f13d12866013cad43c7403482) `sha256:ec45fc4f94324e06240be2cdbfd13377c75e11841b9da55f659072b1ead8623a` * [network-interface-bond-cni](https://github.com/openshift/bond-cni) git [297eeb43](https://github.com/openshift/bond-cni/commit/297eeb4320e07b18d559bc373b665479c760e8c7) `sha256:a57e63f29a23a67783ffa14cfdcb961fcf233e27825da89b382f3b5be01b1825` * [network-tools](https://github.com/openshift/network-tools) git [d6717e45](https://github.com/openshift/network-tools/commit/d6717e453a098d551c9e2d2868e1f5317c41e688) `sha256:5b6f6efe8433e08814cd09f18e5c8d0d563626251b141963d927422450b4ac45` * [nutanix-cloud-controller-manager](https://github.com/openshift/cloud-provider-nutanix) git [33b7bec6](https://github.com/openshift/cloud-provider-nutanix/commit/33b7bec6fe27b8d126982a70b4579112cd67052b) `sha256:6729bccc6a883d344af22e54239a287d4b1d26eb3c686b27f2394c838287435c` * [nutanix-machine-controllers](https://github.com/openshift/machine-api-provider-nutanix) git [b15a665c](https://github.com/openshift/machine-api-provider-nutanix/commit/b15a665cd9c12c5a7d2ac81b5330b6f446c3a8be) `sha256:9f38de164eb49450a241b9c1a868dde47ed0ea4d197652b8180a805a64a4218e` * [oauth-apiserver](https://github.com/openshift/oauth-apiserver) git [71c41b2d](https://github.com/openshift/oauth-apiserver/commit/71c41b2d8abb0c6ad90dca286baf5d03c1340646) `sha256:439f801974be4efdbab1ce05566096f737af454cb243b94cc8d9fb8408c71eb9` * [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics) git [ab605a4b](https://github.com/openshift/openshift-state-metrics/commit/ab605a4bf1c6cd5a6c58f245fb67ce648caebfa8) `sha256:b64b1b35d006a577cfea26c2ef4335409c2945a43d5b122d5b98988ab85dac56` * [operator-marketplace](https://github.com/operator-framework/operator-marketplace) git [efb1a1ea](https://github.com/operator-framework/operator-marketplace/commit/efb1a1ea40bc1ed3a439812cfdaa3013b80e96ce) `sha256:7bb194ffb63533fd2ac751e8306225a5c0e233a08105b9ee59708bf38048c516` * [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs) git [551974ef](https://github.com/openshift/machine-api-provider-powervs/commit/551974ef93dedb1b9677a778e1533391448e0c56) `sha256:34175f2eb2b99957d1c8454d3490795e69794deddca79ea1bcb667ea2f9686e1` * [rhel-coreos-10](https://github.com/openshift/os) git [10f1a2e7](https://github.com/openshift/os/commit/10f1a2e738aa55fff22dbe0346609e83a5f6eb90) `sha256:1221ac96778474fcb25cabf55ef84c997d59d76b2dcd16e8aec5f0cb8e8890de` * [rhel-coreos-10-extensions](https://github.com/openshift/os) git [10f1a2e7](https://github.com/openshift/os/commit/10f1a2e738aa55fff22dbe0346609e83a5f6eb90) `sha256:b169f85293b1945c4a06895b774891558339d6b6866ec65f068d75012b57d5d5` * [service-ca-operator](https://github.com/openshift/service-ca-operator) git [e9622ba1](https://github.com/openshift/service-ca-operator/commit/e9622ba18c86bf24aceab0c19fdcb87339c14f44) `sha256:2e0b05ec56b9cac7c203f0ea08acd28367390fcbe3c26e649135c5ccac4dc0cb` * [telemeter](https://github.com/openshift/telemeter) git [b79b872a](https://github.com/openshift/telemeter/commit/b79b872a65edd845891db70f6c9a184458a178da) `sha256:a967faeb8dcf905a5a796f3533c40a940206747c0d9a6ed3a0bd59cae605acdf` * [thanos](https://github.com/openshift/thanos) git [afeb1c85](https://github.com/openshift/thanos/commit/afeb1c85ba9ee06676a0e657bfa4f4139ccc47b3) `sha256:be3011ba6d163fd7146f985e8737dbe92d3cfac5daa340e8e17717763966ba97` * [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere) git [f69584d6](https://github.com/openshift/cloud-provider-vsphere/commit/f69584d6ed7411504b0fff77eb36d0fd64f0fd5e) `sha256:7fb3c7cb616b441e3bafb2aa63a9f5c3c3123bf1e8a43c52747e1be192f72dc5` ### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/bddba7290d9b08f7c0ce350e8082364819579525) * [OCPBUGS-89984](https://issues.redhat.com/browse/OCPBUGS-89984): patching golang.org/x/crypto with sustaining/crypto@v0.48.0-sec.2 [#10793](https://github.com/openshift/assisted-service/pull/10793) * [OCPBUGS-105879](https://issues.redhat.com/browse/OCPBUGS-105879): manifest_generator add a label to LUKS root [#10797](https://github.com/openshift/assisted-service/pull/10797) * [OCPBUGS-92012](https://issues.redhat.com/browse/OCPBUGS-92012): Add sourcedir /run/chrony-dhcp to generated chrony.conf [#10510](https://github.com/openshift/assisted-service/pull/10510) * [OCPBUGS-86856](https://issues.redhat.com/browse/OCPBUGS-86856): Fix loki and logging [#10425](https://github.com/openshift/assisted-service/pull/10425) * [Full changelog](https://github.com/openshift/assisted-service/compare/a88966fd44394937c070dd9007e56ab4b4ace922...bddba7290d9b08f7c0ce350e8082364819579525) ### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/c4e448f8e3c3f91d2dac98d846eb3fe400f15232) * [OCPBUGS-104025](https://issues.redhat.com/browse/OCPBUGS-104025): Bump x/net to v0.35.0-sec.4 [#2298](https://github.com/openshift/assisted-installer/pull/2298) * [Full changelog](https://github.com/openshift/assisted-installer/compare/070f654bf5003765d3d00ab1811ef5ad111a5d4a...c4e448f8e3c3f91d2dac98d846eb3fe400f15232) ### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/5bf169cca60bec1ddc1bc5cf6b79b74bcfc16b2e) * [OCPBUGS-104032](https://issues.redhat.com/browse/OCPBUGS-104032): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#1621](https://github.com/openshift/assisted-installer-agent/pull/1621) * [OCPBUGS-85041](https://issues.redhat.com/browse/OCPBUGS-85041): add --copy-network when manual network config is detected [#1446](https://github.com/openshift/assisted-installer-agent/pull/1446) * [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/e57138265957c81b33d3ac13078d35f6ca07069d...5bf169cca60bec1ddc1bc5cf6b79b74bcfc16b2e) ### [agent-installer-ui](https://github.com/openshift-assisted/assisted-installer-ui/tree/e9c2917ad243c175e5376acd85ec148c71cdada3) * [OCPBUGS-113553](https://issues.redhat.com/browse/OCPBUGS-113553): Bump nanoid to >=3.3.17 in 4.21 (#4065) [#4065](https://github.com/openshift-assisted/assisted-installer-ui/pull/4065) * [OCPBUGS-119963](https://issues.redhat.com/browse/OCPBUGS-119963): Bump qs to >=6.16.0 in release-4.21 (#4044) [#4044](https://github.com/openshift-assisted/assisted-installer-ui/pull/4044) * [OCPBUGS-123207](https://issues.redhat.com/browse/OCPBUGS-123207): Remove stale OCM_REFRESH_TOKEN code (#4026) [#4026](https://github.com/openshift-assisted/assisted-installer-ui/pull/4026) * [OCPBUGS-104546](https://issues.redhat.com/browse/OCPBUGS-104546): Bump tmp to ^0.2.6 to address CVE-2026-44705 (#4015) [#4015](https://github.com/openshift-assisted/assisted-installer-ui/pull/4015) * Update OWNERS file (#3991) [#3991](https://github.com/openshift-assisted/assisted-installer-ui/pull/3991) * Bug OCPBUGS-100525,OCPBUGS-103013: Bump ip-address to 10.5.0 to fix CVE-2026-54272 and CVE-2026-69192 (#3986) [#3986](https://github.com/openshift-assisted/assisted-installer-ui/pull/3986) * [OCPBUGS-109782](https://issues.redhat.com/browse/OCPBUGS-109782): Bump tar pkg to ^7.5.21 to address CVE-2026-73566 (#3971) [#3971](https://github.com/openshift-assisted/assisted-installer-ui/pull/3971) * [OCPBUGS-104484](https://issues.redhat.com/browse/OCPBUGS-104484): Pin minimatch to ^10.2.6 and brace-expansion to ^5.0.9 (CVE-2026-14257) (#3960) [#3960](https://github.com/openshift-assisted/assisted-installer-ui/pull/3960) * move @types/react-dom to dependencies to fix Hermeto (#3956) [#3956](https://github.com/openshift-assisted/assisted-installer-ui/pull/3956) * [OCPBUGS-99307](https://issues.redhat.com/browse/OCPBUGS-99307): 4.21 agent-installer OVE installation fails due to custom-manifests (#3914) [#3914](https://github.com/openshift-assisted/assisted-installer-ui/pull/3914) * [OCPBUGS-91632](https://issues.redhat.com/browse/OCPBUGS-91632): Bump ws to 8.21.0 for CVE-2026-45736 (#3905) [#3905](https://github.com/openshift-assisted/assisted-installer-ui/pull/3905) * [OCPBUGS-98269](https://issues.redhat.com/browse/OCPBUGS-98269): Bump tar to 7.5.19 in 4.21 (#3893) [#3893](https://github.com/openshift-assisted/assisted-installer-ui/pull/3893) * [OCPBUGS-98435](https://issues.redhat.com/browse/OCPBUGS-98435): Bump js-yaml to 4.3.0 in 4.21 (#3877) [#3877](https://github.com/openshift-assisted/assisted-installer-ui/pull/3877) * [OCPBUGS-89700](https://issues.redhat.com/browse/OCPBUGS-89700): bump form-data to 2.5.6 and 4.0.6 via scoped resolutions to address CVE-2026-12143 (#3878) [#3878](https://github.com/openshift-assisted/assisted-installer-ui/pull/3878) * Update OWNERS file (#3882) [#3882](https://github.com/openshift-assisted/assisted-installer-ui/pull/3882) * Apply patches (#3875) [#3875](https://github.com/openshift-assisted/assisted-installer-ui/pull/3875) * patch CVE-2026-9277 and CVE-2026-42338 via yarn resolutions (#3853) [#3853](https://github.com/openshift-assisted/assisted-installer-ui/pull/3853) * [OCPBUGS-88390](https://issues.redhat.com/browse/OCPBUGS-88390), [OCPBUGS-88411](https://issues.redhat.com/browse/OCPBUGS-88411): Bump axios to 1.18.1 (#3858) [#3858](https://github.com/openshift-assisted/assisted-installer-ui/pull/3858) * [Full changelog](https://github.com/openshift-assisted/assisted-installer-ui/compare/0b264c7f6c227a2ea4d1392879bce555d087dac0...e9c2917ad243c175e5376acd85ec148c71cdada3) ### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/cc8ca89bc5a0ce79227e8ab0860693950608ca04) * [OCPBUGS-105452](https://issues.redhat.com/browse/OCPBUGS-105452): Update Konflux references [#335](https://github.com/openshift/agent-installer-utils/pull/335) * [OCPBUGS-101761](https://issues.redhat.com/browse/OCPBUGS-101761): Update Konflux references [#330](https://github.com/openshift/agent-installer-utils/pull/330) * [OCPBUGS-100311](https://issues.redhat.com/browse/OCPBUGS-100311): Update Konflux release version to 4.21.27 [#326](https://github.com/openshift/agent-installer-utils/pull/326) * [OCPBUGS-99907](https://issues.redhat.com/browse/OCPBUGS-99907): Update Konflux references [#304](https://github.com/openshift/agent-installer-utils/pull/304) * [OCPBUGS-99647](https://issues.redhat.com/browse/OCPBUGS-99647): Use agent-preinstall-image-builder from quay-proxy [#322](https://github.com/openshift/agent-installer-utils/pull/322) * [OCPBUGS-98628](https://issues.redhat.com/browse/OCPBUGS-98628): Increase time for Konflux on-push job [#318](https://github.com/openshift/agent-installer-utils/pull/318) * [OCPBUGS-98628](https://issues.redhat.com/browse/OCPBUGS-98628): Increase resources for syft [#317](https://github.com/openshift/agent-installer-utils/pull/317) * [OCPBUGS-98628](https://issues.redhat.com/browse/OCPBUGS-98628): Update Konflux version to 4.21.24 [#314](https://github.com/openshift/agent-installer-utils/pull/314) * [Full changelog](https://github.com/openshift/agent-installer-utils/compare/dc0bd0906fc9868a65cc9488a7dbdd0f35ca4a23...cc8ca89bc5a0ce79227e8ab0860693950608ca04) ### [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws/tree/e48a2773a2c884dd4b3a589ee7bf107923414356) * [OCPBUGS-104023](https://issues.redhat.com/browse/OCPBUGS-104023): replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 for CVE-2026-33814 [#649](https://github.com/openshift/cluster-api-provider-aws/pull/649) * πŸ› [release-4.21] OCPBUGS-81976: Bump go-jose/go-jose/v4@v4.1.4 [#609](https://github.com/openshift/cluster-api-provider-aws/pull/609) * πŸ› OCPBUGS-112498: UPSTREAM: 6132: Persist ProviderID immediately after instance creation [#627](https://github.com/openshift/cluster-api-provider-aws/pull/627) * πŸ› OCPBUGS-121766: UPSTREAM: <carry>: Fix unit tests for OpenShift CI environment [#628](https://github.com/openshift/cluster-api-provider-aws/pull/628) * 🌱 [release-4.21] OCPBUGS-120321: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI [#635](https://github.com/openshift/cluster-api-provider-aws/pull/635) * [Full changelog](https://github.com/openshift/cluster-api-provider-aws/compare/10ceef5e6f6d0cb79a3345de4fd8851f6300205c...e48a2773a2c884dd4b3a589ee7bf107923414356) ### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/a52a578c6aea1ac5da131f60b8e359969151d7e1) * [OCPBUGS-104051](https://issues.redhat.com/browse/OCPBUGS-104051): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#613](https://github.com/openshift/csi-operator/pull/613) * [OCPBUGS-109655](https://issues.redhat.com/browse/OCPBUGS-109655): csi-driver-smb: DeleteVolume call fails to mkdir under /tmp [#598](https://github.com/openshift/csi-operator/pull/598) * [Full changelog](https://github.com/openshift/csi-operator/compare/20bb13fab3865444b7a4ae454dd234391c4d7e49...a52a578c6aea1ac5da131f60b8e359969151d7e1) ### [aws-karpenter-provider-aws](https://github.com/openshift/aws-karpenter-provider-aws/tree/f4af9b89aed3a47b2168d7bd5a7dd8b6453f1945) * [OCPBUGS-104008](https://issues.redhat.com/browse/OCPBUGS-104008): Fix CVE-2026-33814 [#36](https://github.com/openshift/aws-karpenter-provider-aws/pull/36) * [Full changelog](https://github.com/openshift/aws-karpenter-provider-aws/compare/ff9c8d4e8fdc55d3e60c6add0942c018826ae870...f4af9b89aed3a47b2168d7bd5a7dd8b6453f1945) ### [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws/tree/e5f0dc03f4dd4db98f635705b8b4fee4ad6c482b) * [OCPBUGS-104122](https://issues.redhat.com/browse/OCPBUGS-104122): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#206](https://github.com/openshift/machine-api-provider-aws/pull/206) * [OCPBUGS-127563](https://issues.redhat.com/browse/OCPBUGS-127563): Add opt-in pprof endpoint to machine-controller-manager [#221](https://github.com/openshift/machine-api-provider-aws/pull/221) * [OCPBUGS-127563](https://issues.redhat.com/browse/OCPBUGS-127563): Cache region validation response and close AWS sessions [#220](https://github.com/openshift/machine-api-provider-aws/pull/220) * [Full changelog](https://github.com/openshift/machine-api-provider-aws/compare/938565c9f796fba385c0978a5ae1cc0a79f0f857...e5f0dc03f4dd4db98f635705b8b4fee4ad6c482b) ### [azure-cloud-controller-manager, azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure/tree/53d73b17f0209026eef63d68e39faf195472adf5) * [OCPBUGS-104016](https://issues.redhat.com/browse/OCPBUGS-104016), [OCPBUGS-104207](https://issues.redhat.com/browse/OCPBUGS-104207): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.3 to address CVE-2026-33814 [#205](https://github.com/openshift/cloud-provider-azure/pull/205) * [OCPBUGS-80738](https://issues.redhat.com/browse/OCPBUGS-80738), [OCPBUGS-80739](https://issues.redhat.com/browse/OCPBUGS-80739): Bump google.golang.org/grpc to v1.79.3 [#178](https://github.com/openshift/cloud-provider-azure/pull/178) * [Full changelog](https://github.com/openshift/cloud-provider-azure/compare/83b3f9ec7df408c3d53d5f8e6fe84e0bdd4398e8...53d73b17f0209026eef63d68e39faf195472adf5) ### [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure/tree/49b9fc9a139c1c7cdcc42ea14b6fcb7f7ffe5610) * [OCPBUGS-104017](https://issues.redhat.com/browse/OCPBUGS-104017): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.3 to address CVE-2026-33814 [#402](https://github.com/openshift/cluster-api-provider-azure/pull/402) * [OCPBUGS-89991](https://issues.redhat.com/browse/OCPBUGS-89991): Address CVE-2026-39829 [#398](https://github.com/openshift/cluster-api-provider-azure/pull/398) * [Full changelog](https://github.com/openshift/cluster-api-provider-azure/compare/ebf58aac3fc6746fe2037f2166f1226b73b424f4...49b9fc9a139c1c7cdcc42ea14b6fcb7f7ffe5610) ### [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver/tree/8318a54892a51c76e3233e2fd60fb5d499afb6dc) * [OCPBUGS-96484](https://issues.redhat.com/browse/OCPBUGS-96484): Bump golang.org/x/net to v0.55.0 [#166](https://github.com/openshift/azure-disk-csi-driver/pull/166) * [Full changelog](https://github.com/openshift/azure-disk-csi-driver/compare/aed3ad0d7780188dbfb7ae67a5d69118b7d74556...8318a54892a51c76e3233e2fd60fb5d499afb6dc) ### [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver/tree/c0415d38bb792e507e0d2346b44d057ab7b2e024) * [OCPBUGS-104045](https://issues.redhat.com/browse/OCPBUGS-104045): Bump golang.org/x/net to v0.50.0-sec.4 [#155](https://github.com/openshift/azure-file-csi-driver/pull/155) * [OCPBUGS-111837](https://issues.redhat.com/browse/OCPBUGS-111837): fix failing unit tests in azure-file-csi-driver [#152](https://github.com/openshift/azure-file-csi-driver/pull/152) * [OCPBUGS-92988](https://issues.redhat.com/browse/OCPBUGS-92988): Bump golang.org/x/crypto to v0.48.0-sec.1 [#145](https://github.com/openshift/azure-file-csi-driver/pull/145) * [Full changelog](https://github.com/openshift/azure-file-csi-driver/compare/45061e97a5e2b20b01cd55fee97e5dac43fd79e4...c0415d38bb792e507e0d2346b44d057ab7b2e024) ### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/97a682d9baff04f7c873ae378dee4afb6b697252) * [OCPBUGS-104007](https://issues.redhat.com/browse/OCPBUGS-104007): [release-4.21] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#58](https://github.com/openshift/azure-kubernetes-kms/pull/58) * [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/21e0a215b7e5b31eaa75027e0df9eee943e48323...97a682d9baff04f7c873ae378dee4afb6b697252) ### [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure/tree/65ba1a8d7133b2947eec2fe16e43de0134921e03) * [OCPBUGS-104120](https://issues.redhat.com/browse/OCPBUGS-104120): replace golang.org/x/net with openshift-sustaining/net@v0.50.0-sec.4 [#210](https://github.com/openshift/machine-api-provider-azure/pull/210) * [PIXAA-7](https://issues.redhat.com/browse/PIXAA-7): Leverage SpotRebalanceRecommendation for instance termination when available [#199](https://github.com/openshift/machine-api-provider-azure/pull/199) * [Full changelog](https://github.com/openshift/machine-api-provider-azure/compare/b8b8cb1c5af7d2a3ef9a4a99a0739a2166a7932c...65ba1a8d7133b2947eec2fe16e43de0134921e03) ### [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity/tree/ae8ffaf0b4a893e9b38fb4007de3cef8492b71f3) * [OCPBUGS-81978](https://issues.redhat.com/browse/OCPBUGS-81978): Bump go-jose/go-jose/v4@v4.1.4 [#50](https://github.com/openshift/azure-workload-identity/pull/50) * [Full changelog](https://github.com/openshift/azure-workload-identity/compare/3f2a6e0d1ea68af321f9674b0b097939be7d2014...ae8ffaf0b4a893e9b38fb4007de3cef8492b71f3) ### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/080653d812dc25b2c624ff2a5b4108046276b0b2) * [SPLAT-2866](https://issues.redhat.com/browse/SPLAT-2866): Add vSphere multi vCenter Day 2 support [#10874](https://github.com/openshift/installer/pull/10874) * [OCPBUGS-90031](https://issues.redhat.com/browse/OCPBUGS-90031), [OCPBUGS-92990](https://issues.redhat.com/browse/OCPBUGS-92990): Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto v0.48.0-sec.2 [#10820](https://github.com/openshift/installer/pull/10820) * [OCPBUGS-100062](https://issues.redhat.com/browse/OCPBUGS-100062): openstack: Reserve addresses for load balancer [#10724](https://github.com/openshift/installer/pull/10724) * [OCPBUGS-112472](https://issues.redhat.com/browse/OCPBUGS-112472): Update timeout in GetMarketplaceImage to 5 minutes [#10785](https://github.com/openshift/installer/pull/10785) * [OCPBUGS-104042](https://issues.redhat.com/browse/OCPBUGS-104042): Bump golang.org/x/net to v0.50.0-sec.4 [#10806](https://github.com/openshift/installer/pull/10806) * [OCPBUGS-113535](https://issues.redhat.com/browse/OCPBUGS-113535): Update RHCOS-release-4.21 bootimage metadata to 9.6.20260815-0 [#10792](https://github.com/openshift/installer/pull/10792) * [OCPBUGS-87813](https://issues.redhat.com/browse/OCPBUGS-87813): [release-4.21] fix: reset associatedVCenter in failure domain validation loop [#10605](https://github.com/openshift/installer/pull/10605) * [OCPBUGS-112029](https://issues.redhat.com/browse/OCPBUGS-112029): Bump google-cloud-cli to 563.0.0-1 [#10769](https://github.com/openshift/installer/pull/10769) * [OCPBUGS-76552](https://issues.redhat.com/browse/OCPBUGS-76552): Revert storage account API version for client [#10296](https://github.com/openshift/installer/pull/10296) * [OCPBUGS-87815](https://issues.redhat.com/browse/OCPBUGS-87815): [release-4.21] Add omitempty to vSphere and Nutanix MachinePool slice fields [#10607](https://github.com/openshift/installer/pull/10607) * [OCPBUGS-88740](https://issues.redhat.com/browse/OCPBUGS-88740): Update RHCOS-release-4.21 data/data/coreos/rhcos.json to 9.6.20260616-0 [#10651](https://github.com/openshift/installer/pull/10651) * [OCPBUGS-81986](https://issues.redhat.com/browse/OCPBUGS-81986): Bump go-jose/v4 to 4.1.4 [#10598](https://github.com/openshift/installer/pull/10598) * [OCPBUGS-77049](https://issues.redhat.com/browse/OCPBUGS-77049): Update RHCOS-release-4.21 bootimage metadata to 9.6.20260520-0 [#10579](https://github.com/openshift/installer/pull/10579) * [Full changelog](https://github.com/openshift/installer/compare/3f855c5bbfa977e040bfe98776299a6afa798674...080653d812dc25b2c624ff2a5b4108046276b0b2) ### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/d5c58b32e71e0e979e190b40a3804d012509d93b) * [OCPBUGS-97982](https://issues.redhat.com/browse/OCPBUGS-97982): Add BMH finalizer on PreprovisioningImage [#506](https://github.com/openshift/baremetal-operator/pull/506) * [OCPBUGS-87964](https://issues.redhat.com/browse/OCPBUGS-87964): Fix preprovisioning network Secret lifecycle during BMH deletion [#492](https://github.com/openshift/baremetal-operator/pull/492) * [Full changelog](https://github.com/openshift/baremetal-operator/compare/0aeba7af56b884fadf7f7209d7557e6214b9f49c...d5c58b32e71e0e979e190b40a3804d012509d93b) ### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/d0bf7cc5959bf8408912e5276f2ea9e269ede24d) * [OCPBUGS-104179](https://issues.redhat.com/browse/OCPBUGS-104179): [release-4.21] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#2379](https://github.com/openshift/oc/pull/2379) * Fix for OCPBUGS-88239: CVE-2026-39821 [#2361](https://github.com/openshift/oc/pull/2361) * [OCPBUGS-98550](https://issues.redhat.com/browse/OCPBUGS-98550): Revert pull request 2310 [#2348](https://github.com/openshift/oc/pull/2348) * [OCPBUGS-98550](https://issues.redhat.com/browse/OCPBUGS-98550): bump x/crypto to the latest version [#2310](https://github.com/openshift/oc/pull/2310) * [Full changelog](https://github.com/openshift/oc/compare/fdf8dabaedf6cf89f60547f57cc5f5f3e8d8798b...d0bf7cc5959bf8408912e5276f2ea9e269ede24d) ### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/3f41e6e1e0540fd5c6d969212a233b120fddc524) * [OCPBUGS-104052](https://issues.redhat.com/browse/OCPBUGS-104052): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#1097](https://github.com/openshift/cloud-credential-operator/pull/1097) * NO-JIRA: Revert "OCPBUGS-87110 Scope minted AWS IAM policies to cluster-owned resources" [#1060](https://github.com/openshift/cloud-credential-operator/pull/1060) * [OCPBUGS-87110](https://issues.redhat.com/browse/OCPBUGS-87110): Scope minted AWS IAM policies to cluster-owned resources [#1046](https://github.com/openshift/cloud-credential-operator/pull/1046) * [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/154ae10f442b7d40f14492c5973cd3459791d00f...3f41e6e1e0540fd5c6d969212a233b120fddc524) ### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/419ef9d44ad0e63927900add4a90fcb9a9fce3d0) * [OCPBUGS-104035](https://issues.redhat.com/browse/OCPBUGS-104035): Bump golang.org/x/net from v0.43.0 to v0.50.0-sec.4 [#980](https://github.com/openshift/cluster-authentication-operator/pull/980) * [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/65eb4b2193d0860c1c1f45b08ea7203694db909f...419ef9d44ad0e63927900add4a90fcb9a9fce3d0) ### [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler/tree/27b401cd08dc567360928f0743326d41951b21dc) * [OCPBUGS-104191](https://issues.redhat.com/browse/OCPBUGS-104191): Replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 for CVE-2026-33814 [#439](https://github.com/openshift/kubernetes-autoscaler/pull/439) * [OCPBUGS-109654](https://issues.redhat.com/browse/OCPBUGS-109654): UPSTREAM: 9458: fix(clusterapi): use kind-aware version discovery for infra references [#436](https://github.com/openshift/kubernetes-autoscaler/pull/436) * [Full changelog](https://github.com/openshift/kubernetes-autoscaler/compare/838a5957d0bebc33c7a0a8a7efd4f5dcb4098286...27b401cd08dc567360928f0743326d41951b21dc) ### [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator/tree/b2423439fe1004bae5e84500cf449d033c1f0378) * [OCPBUGS-104038](https://issues.redhat.com/browse/OCPBUGS-104038): Bump x/net package in release-4.21 [#386](https://github.com/openshift/cluster-autoscaler-operator/pull/386) * [Full changelog](https://github.com/openshift/cluster-autoscaler-operator/compare/dec12ba632a4810b4ff43a9172f462a1dd291e44...b2423439fe1004bae5e84500cf449d033c1f0378) ### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/13af370f526ab7541a8a73aa0d94952496ccca58) * [OCPBUGS-88481](https://issues.redhat.com/browse/OCPBUGS-88481): Fix empty IRONIC_BASE_URL [#614](https://github.com/openshift/cluster-baremetal-operator/pull/614) * [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/18e163a4c14db692938da08b7bec821d483945f9...13af370f526ab7541a8a73aa0d94952496ccca58) ### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/87a6893e678af405043625bc3a209b30836f299f) * [OCPBUGS-104049](https://issues.redhat.com/browse/OCPBUGS-104049): Bump golang.org/x/net to v0.50.0-sec.3 [#662](https://github.com/openshift/cluster-capi-operator/pull/662) * [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/f9513d3255926b63185a5b5203126699925133c3...87a6893e678af405043625bc3a209b30836f299f) ### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/b8d48a22367c2ed142b59782ba804a019679e699) * [SPLAT-2866](https://issues.redhat.com/browse/SPLAT-2866): Added support to manage kube-cloud-config for vSphere in openshift-config-managed [#520](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/520) * [OCPBUGS-104043](https://issues.redhat.com/browse/OCPBUGS-104043): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#510](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/510) * [OCPBUGS-82034](https://issues.redhat.com/browse/OCPBUGS-82034): Add delete permission for Azure load balancers in credentials request [#441](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/441) * [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/6148c0cca626bcf0bfebcc6dd0c77a41944cba87...b8d48a22367c2ed142b59782ba804a019679e699) ### [cluster-config-api](https://github.com/openshift/api/tree/eb96322bf52288bf7931bb6240fd244cc362a68b) * [SPLAT-2866](https://issues.redhat.com/browse/SPLAT-2866): Add vSphere multi vCenter Day 2 [#3036](https://github.com/openshift/api/pull/3036) * [OCPBUGS-98251](https://issues.redhat.com/browse/OCPBUGS-98251): add new serviceAccountToken fs type [#2924](https://github.com/openshift/api/pull/2924) * [OCPBUGS-78330](https://issues.redhat.com/browse/OCPBUGS-78330), [OCPBUGS-82146](https://issues.redhat.com/browse/OCPBUGS-82146), [OCPBUGS-85550](https://issues.redhat.com/browse/OCPBUGS-85550), [OCPBUGS-88295](https://issues.redhat.com/browse/OCPBUGS-88295), [OCPBUGS-88297](https://issues.redhat.com/browse/OCPBUGS-88297): NE-2480: Promote GatewayAPIWithoutOLM feature gate to Default [#2865](https://github.com/openshift/api/pull/2865) * [OCPBUGS-78330](https://issues.redhat.com/browse/OCPBUGS-78330), [OCPBUGS-82146](https://issues.redhat.com/browse/OCPBUGS-82146), [OCPBUGS-85550](https://issues.redhat.com/browse/OCPBUGS-85550), [OCPBUGS-88295](https://issues.redhat.com/browse/OCPBUGS-88295), [OCPBUGS-88297](https://issues.redhat.com/browse/OCPBUGS-88297): Promote GatewayAPIWithoutOLM feature gate to TechPreview [#2873](https://github.com/openshift/api/pull/2873) * [Full changelog](https://github.com/openshift/api/compare/1d79f30d4668393dc34e9b423ec6904645503c58...eb96322bf52288bf7931bb6240fd244cc362a68b) ### [cluster-config-operator](https://github.com/openshift/cluster-config-operator/tree/b4abf3b25f1d5d5994b12f76e1876c152b3965d7) * [SPLAT-2866](https://issues.redhat.com/browse/SPLAT-2866): Migrate vSphere sync of kube-cloud-config to 3CMO [#505](https://github.com/openshift/cluster-config-operator/pull/505) * [Full changelog](https://github.com/openshift/cluster-config-operator/compare/1eb450a3a2456f6e3fe3d727208b5f7b0dd35aba...b4abf3b25f1d5d5994b12f76e1876c152b3965d7) ### [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator/tree/c4fdb41e357280bfa7e8ebbc934007a657168310) * [OCPBUGS-90510](https://issues.redhat.com/browse/OCPBUGS-90510): Fixed issue where nameserver is not set when recreating cpms [#411](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/411) * [Full changelog](https://github.com/openshift/cluster-control-plane-machine-set-operator/compare/2dde33fb94aae47b460a5f6a672d06c9ee4225d8...c4fdb41e357280bfa7e8ebbc934007a657168310) ### [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator/tree/eb43a7a80d1b314eb8bbe63b6b73de91ba8cc7aa) * [OCPBUGS-104057](https://issues.redhat.com/browse/OCPBUGS-104057): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#296](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/296) * [Full changelog](https://github.com/openshift/cluster-csi-snapshot-controller-operator/compare/8c1ebc60a2014ab925cbad6ef255e06ea0bd72b4...eb43a7a80d1b314eb8bbe63b6b73de91ba8cc7aa) ### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/8604405aa000bf68269d91ece282bdfc3433b50a) * [OCPBUGS-104066](https://issues.redhat.com/browse/OCPBUGS-104066): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 [#1692](https://github.com/openshift/cluster-etcd-operator/pull/1692) * [OCPBUGS-100121](https://issues.redhat.com/browse/OCPBUGS-100121): Revert 'OCPBUGS-88490: fix etcd operator deadlock when etcd-endpoints configmap is stale' [#1662](https://github.com/openshift/cluster-etcd-operator/pull/1662) * [OCPBUGS-90543](https://issues.redhat.com/browse/OCPBUGS-90543): fix etcd operator deadlock when etcd-endpoints configmap is stale [#1637](https://github.com/openshift/cluster-etcd-operator/pull/1637) * [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/898d6bd9f6ab96093b8d74e5a7dbfeff9a5cf257...8604405aa000bf68269d91ece282bdfc3433b50a) ### [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator/tree/044fc0bce30bed270732f61213e2895d667ebf87) * [OCPBUGS-75001](https://issues.redhat.com/browse/OCPBUGS-75001): Backport Azure ARM SDK migration and Azure Stack Hub compatibility [#1303](https://github.com/openshift/cluster-image-registry-operator/pull/1303) * [Full changelog](https://github.com/openshift/cluster-image-registry-operator/compare/b2dfc3bba3dfd8dba90918a4a3be74deb3c548dd...044fc0bce30bed270732f61213e2895d667ebf87) ### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/f30c6160c94034639739df5ce940d60d1d7c028a) * [OCPBUGS-93736](https://issues.redhat.com/browse/OCPBUGS-93736): Guard OLM subscription lookup with capability check [#1490](https://github.com/openshift/cluster-ingress-operator/pull/1490) * [OCPBUGS-104065](https://issues.redhat.com/browse/OCPBUGS-104065): Replace golang.org/x/net with github.com/openshift-sustaining/net v0.50.0-sec.3 to mitigate CVE-2026-33814 [#1554](https://github.com/openshift/cluster-ingress-operator/pull/1554) * [OCPBUGS-99453](https://issues.redhat.com/browse/OCPBUGS-99453): Respect proxy configuration on gwapi provisioning [#1518](https://github.com/openshift/cluster-ingress-operator/pull/1518) * [OCPBUGS-99909](https://issues.redhat.com/browse/OCPBUGS-99909): E2E test for internal LoadBalancer Annotations [#1525](https://github.com/openshift/cluster-ingress-operator/pull/1525) * [OCPBUGS-99483](https://issues.redhat.com/browse/OCPBUGS-99483): Add e2e test for Gateway API infrastructure annotations [#1520](https://github.com/openshift/cluster-ingress-operator/pull/1520) * [OCPBUGS-94189](https://issues.redhat.com/browse/OCPBUGS-94189): Add INFO logs alongside event recorder calls [#1489](https://github.com/openshift/cluster-ingress-operator/pull/1489) * [OCPBUGS-98966](https://issues.redhat.com/browse/OCPBUGS-98966): Bump Istio version from v1.27.3 to v1.27.8 [#1509](https://github.com/openshift/cluster-ingress-operator/pull/1509) * [OCPBUGS-78330](https://issues.redhat.com/browse/OCPBUGS-78330), [OCPBUGS-82146](https://issues.redhat.com/browse/OCPBUGS-82146), [OCPBUGS-85550](https://issues.redhat.com/browse/OCPBUGS-85550), [OCPBUGS-88295](https://issues.redhat.com/browse/OCPBUGS-88295), [OCPBUGS-88297](https://issues.redhat.com/browse/OCPBUGS-88297): Remove feature-set annotations from Sail Library RBAC Manifests [#1462](https://github.com/openshift/cluster-ingress-operator/pull/1462) * [OCPBUGS-78330](https://issues.redhat.com/browse/OCPBUGS-78330), [OCPBUGS-82146](https://issues.redhat.com/browse/OCPBUGS-82146), [OCPBUGS-85550](https://issues.redhat.com/browse/OCPBUGS-85550), [OCPBUGS-88295](https://issues.redhat.com/browse/OCPBUGS-88295), [OCPBUGS-88297](https://issues.redhat.com/browse/OCPBUGS-88297): Replace OLM-based Istio install with Sail Library [#1442](https://github.com/openshift/cluster-ingress-operator/pull/1442) * [OCPBUGS-86718](https://issues.redhat.com/browse/OCPBUGS-86718): Add configuration override for X-SSL strip [#1471](https://github.com/openshift/cluster-ingress-operator/pull/1471) * [OCPBUGS-85149](https://issues.redhat.com/browse/OCPBUGS-85149): Fix e2e tests to work on platforms with unmanaged DNS [#1437](https://github.com/openshift/cluster-ingress-operator/pull/1437) * [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/3a861ed50a5755aa9eaf58d4e6c86d02729dd9c0...f30c6160c94034639739df5ce940d60d1d7c028a) ### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/58a7dcc50c07c532f97d1114201bedd4a15cc435) * [OCPBUGS-104074](https://issues.redhat.com/browse/OCPBUGS-104074): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#2296](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2296) * [OCPBUGS-127407](https://issues.redhat.com/browse/OCPBUGS-127407): Bump of library-go [#2326](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2326) * [OCPBUGS-88326](https://issues.redhat.com/browse/OCPBUGS-88326): Fix kube-apiserver-to-kubelet-signer refresh interval [#2192](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2192) * [OCPBUGS-81747](https://issues.redhat.com/browse/OCPBUGS-81747): scc: fix uid{Min,Max}Range for nested-container [#2092](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2092) * [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/424f27c9c415373b7f60756b5a1c24f48f248512...58a7dcc50c07c532f97d1114201bedd4a15cc435) ### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/938fd690c4ed9fbecdf1f712b37481689ca92961) * [OCPBUGS-104058](https://issues.redhat.com/browse/OCPBUGS-104058): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#958](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/958) * [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/395de96705749de9c6a5f25747b9d5c3d5f65a8f...938fd690c4ed9fbecdf1f712b37481689ca92961) ### [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator/tree/9f1b43ce1b85f11aabd3aa49f95b0746485bd14f) * [OCPBUGS-104070](https://issues.redhat.com/browse/OCPBUGS-104070): [release-4.21] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#666](https://github.com/openshift/cluster-kube-scheduler-operator/pull/666) * [Full changelog](https://github.com/openshift/cluster-kube-scheduler-operator/compare/5ef1df3be41d38ddae9b3d22ce51ba486939e9f1...9f1b43ce1b85f11aabd3aa49f95b0746485bd14f) ### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/0fa8ad009fe58e668ae9a758cf8288c0302027f5) * NO-ISSUE: synchronize OWNERS from main branch [release-4.21] [#3114](https://github.com/openshift/cluster-monitoring-operator/pull/3114) * [OCPBUGS-112573](https://issues.redhat.com/browse/OCPBUGS-112573): [release-4.21] Makefile: version-stamp golangci-lint binary to prevent stale linter [#3065](https://github.com/openshift/cluster-monitoring-operator/pull/3065) * [OCPBUGS-104068](https://issues.redhat.com/browse/OCPBUGS-104068): [release-4.21] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#3070](https://github.com/openshift/cluster-monitoring-operator/pull/3070) * [OCPBUGS-105305](https://issues.redhat.com/browse/OCPBUGS-105305): [release-4.21] wrap library-go resourceCache with mutex for thread safety [#3044](https://github.com/openshift/cluster-monitoring-operator/pull/3044) * [OCPBUGS-104537](https://issues.redhat.com/browse/OCPBUGS-104537): Backport e2e stabilization 4.21 [#3027](https://github.com/openshift/cluster-monitoring-operator/pull/3027) * [OCPBUGS-100369](https://issues.redhat.com/browse/OCPBUGS-100369): [release-4.21] fix: watch cluster wide proxy changes and apply changes accordingly [#3021](https://github.com/openshift/cluster-monitoring-operator/pull/3021) * [OCPBUGS-99763](https://issues.redhat.com/browse/OCPBUGS-99763): fall back to kube-system/global-pull-secret for telemeter-client token [#3002](https://github.com/openshift/cluster-monitoring-operator/pull/3002) * [OCPBUGS-92194](https://issues.redhat.com/browse/OCPBUGS-92194): set Prometheus shards value explicitly [#2975](https://github.com/openshift/cluster-monitoring-operator/pull/2975) * [OCPBUGS-94077](https://issues.redhat.com/browse/OCPBUGS-94077): ship collector:node_scrape_collector_success:avg to Telemetry [#2978](https://github.com/openshift/cluster-monitoring-operator/pull/2978) * [OCPBUGS-88323](https://issues.redhat.com/browse/OCPBUGS-88323): [release-4.21] fix(TestDocExamples) flake: use internal registry for test pods [#2980](https://github.com/openshift/cluster-monitoring-operator/pull/2980) * [OCPBUGS-86806](https://issues.redhat.com/browse/OCPBUGS-86806): jsonnet: exclude ReplicationController from catch-all … [#2939](https://github.com/openshift/cluster-monitoring-operator/pull/2939) * [OCPBUGS-86991](https://issues.redhat.com/browse/OCPBUGS-86991): increase lookup interval [#2946](https://github.com/openshift/cluster-monitoring-operator/pull/2946) * [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/c5ffc7afc457f7fc29c2818bb0ca6c9015ed0c39...0fa8ad009fe58e668ae9a758cf8288c0302027f5) ### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/37c23eebf1ae5833fb66c8bff57740f8c0d45603) * [OCPBUGS-130583](https://issues.redhat.com/browse/OCPBUGS-130583): Added global overrides for OVN-Kubernetes [#3192](https://github.com/openshift/cluster-network-operator/pull/3192) * [OCPBUGS-127442](https://issues.redhat.com/browse/OCPBUGS-127442): [release-4.21] Allow per-node OVN encap IP override via env-overrides [#3177](https://github.com/openshift/cluster-network-operator/pull/3177) * [OCPBUGS-126704](https://issues.redhat.com/browse/OCPBUGS-126704): Restart pods when rendering egressIP settings [#3168](https://github.com/openshift/cluster-network-operator/pull/3168) * [OCPBUGS-112789](https://issues.redhat.com/browse/OCPBUGS-112789): [4.21] frr-k8s: use Recreate strategy for statuscleaner deployment [#3135](https://github.com/openshift/cluster-network-operator/pull/3135) * [OCPBUGS-105600](https://issues.redhat.com/browse/OCPBUGS-105600): Remove version-specific CNI binary copy logic [#3117](https://github.com/openshift/cluster-network-operator/pull/3117) * [OCPBUGS-99747](https://issues.redhat.com/browse/OCPBUGS-99747): Bump frr-k8s MAX_FDS from 1024 to 65536 [#3092](https://github.com/openshift/cluster-network-operator/pull/3092) * [OCPBUGS-98747](https://issues.redhat.com/browse/OCPBUGS-98747): Remove --enable-interconnect flag from OVN-K manifests [#3055](https://github.com/openshift/cluster-network-operator/pull/3055) * [OCPBUGS-98548](https://issues.redhat.com/browse/OCPBUGS-98548): Bump github.com/containernetworking/cni v0.8.0 -> v1.3.0 [#3049](https://github.com/openshift/cluster-network-operator/pull/3049) * [Full changelog](https://github.com/openshift/cluster-network-operator/compare/b5955e9ede2128e8558c41ce87c1e8a11e09a515...37c23eebf1ae5833fb66c8bff57740f8c0d45603) ### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/6075cffc70be79fa499558474f135ea244c93fc0) * [OCPBUGS-114931](https://issues.redhat.com/browse/OCPBUGS-114931): Update PPC help description [#1623](https://github.com/openshift/cluster-node-tuning-operator/pull/1623) * [OCPBUGS-112011](https://issues.redhat.com/browse/OCPBUGS-112011): BUG-FIX Latency Test [#1592](https://github.com/openshift/cluster-node-tuning-operator/pull/1592) * [OCPBUGS-114013](https://issues.redhat.com/browse/OCPBUGS-114013): Use Add() instead of AddRateLimited() for routine Profile enqueues [#1616](https://github.com/openshift/cluster-node-tuning-operator/pull/1616) * [OCPBUGS-104586](https://issues.redhat.com/browse/OCPBUGS-104586): e2e: fix: clear hugepages before switching kernelPageSize to 4k [#1576](https://github.com/openshift/cluster-node-tuning-operator/pull/1576) * [OCPBUGS-100540](https://issues.redhat.com/browse/OCPBUGS-100540): e2e: fix broken checks and rework netqueue tests to avoid ARM ethtool blackout flakes [#1573](https://github.com/openshift/cluster-node-tuning-operator/pull/1573) * [OCPBUGS-90529](https://issues.redhat.com/browse/OCPBUGS-90529): perf: latency: compute memory resources dynamically [#1521](https://github.com/openshift/cluster-node-tuning-operator/pull/1521) * [OCPBUGS-82896](https://issues.redhat.com/browse/OCPBUGS-82896): Bump github.com/moby/spdystream from v0.5.0 to v0.5.1 [#1531](https://github.com/openshift/cluster-node-tuning-operator/pull/1531) * [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/d78172d1fffdcd29cb3ca6626c78ebecc8e2ef78...6075cffc70be79fa499558474f135ea244c93fc0) ### [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator/tree/ab9cccbdd1bf065ec0e8afde2f9b960a6e3fcb0d) * [OCPBUGS-104056](https://issues.redhat.com/browse/OCPBUGS-104056): bump golang.org/x/net to v0.50.0-sec.3 to fix CVE-2026-33814 [#242](https://github.com/openshift/cluster-olm-operator/pull/242) * [Full changelog](https://github.com/openshift/cluster-olm-operator/compare/03bedb913bce9c7deabf7868e5cbefc57cf3490b...ab9cccbdd1bf065ec0e8afde2f9b960a6e3fcb0d) ### [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator/tree/810221c4d6f91efae7277224e3022ec5c4778e14) * [OCPBUGS-105475](https://issues.redhat.com/browse/OCPBUGS-105475): Add HostToContainer mountPropagation to node-pullsecrets volume mount [#750](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/750) * [Full changelog](https://github.com/openshift/cluster-openshift-apiserver-operator/compare/52fd1773757b2c3ff497e7db084c3d71cde5478f...810221c4d6f91efae7277224e3022ec5c4778e14) ### [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller/tree/e510507e20f6eb09694c880ecd79fa512a2b3470) * [OCPBUGS-98251](https://issues.redhat.com/browse/OCPBUGS-98251): [4.21] add serviceAccountToken volume type to psalabelsyncer [#193](https://github.com/openshift/cluster-policy-controller/pull/193) * [Full changelog](https://github.com/openshift/cluster-policy-controller/compare/8b775487512fb543bff470ff1042bd3ac31b29be...e510507e20f6eb09694c880ecd79fa512a2b3470) ### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/9e69219d1b6516157423f9d1253d482f80a4bf76) * [OCPBUGS-104089](https://issues.redhat.com/browse/OCPBUGS-104089): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#738](https://github.com/openshift/cluster-storage-operator/pull/738) * [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/e403475164a4de23d358a93106a35353ec29f3d7...9e69219d1b6516157423f9d1253d482f80a4bf76) ### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/d9455dc95aeb63cdc4286e0eb986d2cce5053074) * [OCPBUGS-104076](https://issues.redhat.com/browse/OCPBUGS-104076): Bump golang.org/x/net to v0.50.0-sec.3 [#1456](https://github.com/openshift/cluster-version-operator/pull/1456) * [Full changelog](https://github.com/openshift/cluster-version-operator/compare/d37e5a056d5a9c74c2ac2d5551ef39f573c9824a...d9455dc95aeb63cdc4286e0eb986d2cce5053074) ### [console](https://github.com/openshift/console/tree/2f1997abe650fbe9de360a061360c5fc0a67f6d9) * [OCPBUGS-122212](https://issues.redhat.com/browse/OCPBUGS-122212): Wait for demo plugin deployment readiness [#17160](https://github.com/openshift/console/pull/17160) * [OCPBUGS-116250](https://issues.redhat.com/browse/OCPBUGS-116250): Validate chart URL in /api/helm/verify [#17136](https://github.com/openshift/console/pull/17136) * [OCPBUGS-113468](https://issues.redhat.com/browse/OCPBUGS-113468): Remove unscoped CSV watch from ClusterNotUpgradeableAlert [#17079](https://github.com/openshift/console/pull/17079) * Fix for OCPBUGS-92072: CVE-2026-44990 [#16714](https://github.com/openshift/console/pull/16714) * [OCPBUGS-113732](https://issues.redhat.com/browse/OCPBUGS-113732): make cloud provider fields optional during operator install [#17091](https://github.com/openshift/console/pull/17091) * [OCPBUGS-100518](https://issues.redhat.com/browse/OCPBUGS-100518), [OCPBUGS-101793](https://issues.redhat.com/browse/OCPBUGS-101793): Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss [#17055](https://github.com/openshift/console/pull/17055) * Fix OCPBUGS-99410: CVE-2026-59877 [#16835](https://github.com/openshift/console/pull/16835) * [OCPBUGS-112273](https://issues.redhat.com/browse/OCPBUGS-112273): Fix flaky TestAsyncCache backend test [#17046](https://github.com/openshift/console/pull/17046) * Fix for OCPBUGS-101827: CVE-2026-69152 [#16931](https://github.com/openshift/console/pull/16931) * Fix for OCPBUGS-105892: CVE-2026-73086 [#16966](https://github.com/openshift/console/pull/16966) * [OCPBUGS-105864](https://issues.redhat.com/browse/OCPBUGS-105864): Fix leading whitespace in Quick Start execute code snippets [#16961](https://github.com/openshift/console/pull/16961) * Fix for OCPBUGS-89706: CVE-2026-12143 [#16645](https://github.com/openshift/console/pull/16645) * [OCPBUGS-98434](https://issues.redhat.com/browse/OCPBUGS-98434): CVE-2026-59869 bump js-yaml [#16772](https://github.com/openshift/console/pull/16772) * [OCPBUGS-100058](https://issues.redhat.com/browse/OCPBUGS-100058): quickstart page i18n misses (Fix Quick Starts i18n bundle lookup for zh-CN) [#16868](https://github.com/openshift/console/pull/16868) * [OCPBUGS-100377](https://issues.redhat.com/browse/OCPBUGS-100377): Re-enable Knative Cypress e2e tests [#16896](https://github.com/openshift/console/pull/16896) * [OCPBUGS-99544](https://issues.redhat.com/browse/OCPBUGS-99544): '0 B' is shown on details page when create pvc with 'EiB' unit [#16806](https://github.com/openshift/console/pull/16806) * [OCPBUGS-99546](https://issues.redhat.com/browse/OCPBUGS-99546): Incorrect translations for 'CatalogSources' and 'OperatorGroups' in l… [#16808](https://github.com/openshift/console/pull/16808) * [OCPBUGS-99311](https://issues.redhat.com/browse/OCPBUGS-99311): Disable Knative e2e Cypress tests in CI [#16794](https://github.com/openshift/console/pull/16794) * [OCPBUGS-99163](https://issues.redhat.com/browse/OCPBUGS-99163): fixing severity not showing number of issues [#16618](https://github.com/openshift/console/pull/16618) * [OCPBUGS-84287](https://issues.redhat.com/browse/OCPBUGS-84287): Bump follow-redirects to 1.16.0 to fix CVE-2026-40895 [#16670](https://github.com/openshift/console/pull/16670) * [OCPBUGS-81618](https://issues.redhat.com/browse/OCPBUGS-81618): CVE-2026-4800 [#16572](https://github.com/openshift/console/pull/16572) * [OCPBUGS-90498](https://issues.redhat.com/browse/OCPBUGS-90498): Projects cannot be filtered by display name in the console list view [#16653](https://github.com/openshift/console/pull/16653) * [OCPBUGS-95544](https://issues.redhat.com/browse/OCPBUGS-95544): Fix RoleBindings tab error for non-cluster-admin users [#16695](https://github.com/openshift/console/pull/16695) * [OCPBUGS-86743](https://issues.redhat.com/browse/OCPBUGS-86743), [OCPBUGS-87090](https://issues.redhat.com/browse/OCPBUGS-87090), [OCPBUGS-88749](https://issues.redhat.com/browse/OCPBUGS-88749): [release-4.21] bump package: webpack-dev-server, protobufjs, fast-uri [#16654](https://github.com/openshift/console/pull/16654) * [OCPBUGS-90553](https://issues.redhat.com/browse/OCPBUGS-90553): Backport inventory card filter link fix to release-4.21 [#16678](https://github.com/openshift/console/pull/16678) * [OCPBUGS-86456](https://issues.redhat.com/browse/OCPBUGS-86456): [release-4.21] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators [#16536](https://github.com/openshift/console/pull/16536) * [OCPBUGS-88358](https://issues.redhat.com/browse/OCPBUGS-88358): Allow VolumeSnapshot restore when parent PVC is deleted [#16602](https://github.com/openshift/console/pull/16602) * [OCPBUGS-86581](https://issues.redhat.com/browse/OCPBUGS-86581): Fix macOS Option key in pod terminal [#16505](https://github.com/openshift/console/pull/16505) * And 1 elided commits (e.g. from squash or rebase merges) * [Full changelog](https://github.com/openshift/console/compare/402882702875b34bb4872c051808a35a67880346...2f1997abe650fbe9de360a061360c5fc0a67f6d9) ### [console-operator](https://github.com/openshift/console-operator/tree/f56cb4ac7dcdcb04793f41802c1f15c2ce02a833) * [OCPBUGS-104078](https://issues.redhat.com/browse/OCPBUGS-104078): Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 [#1220](https://github.com/openshift/console-operator/pull/1220) * [OCPBUGS-100111](https://issues.redhat.com/browse/OCPBUGS-100111): Sort plugin list to make them deterministic [#1203](https://github.com/openshift/console-operator/pull/1203) * [OCPBUGS-98987](https://issues.redhat.com/browse/OCPBUGS-98987): [4.21] Stabilize telemetry config to prevent continuous console pod rollouts [#1192](https://github.com/openshift/console-operator/pull/1192) * [Full changelog](https://github.com/openshift/console-operator/compare/aee1a79b48a86e0feaef8ac72b5ec3c124429859...f56cb4ac7dcdcb04793f41802c1f15c2ce02a833) ### [coredns](https://github.com/openshift/coredns/tree/c3f32d7d058c93b17a5ba5d3a82245db7820bfc7) * [OCPBUGS-104084](https://issues.redhat.com/browse/OCPBUGS-104084): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#202](https://github.com/openshift/coredns/pull/202) * [Full changelog](https://github.com/openshift/coredns/compare/7486e9e4330c1e41d9a91e4673b7f2782efc112c...c3f32d7d058c93b17a5ba5d3a82245db7820bfc7) ### [csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/063501a59511f2924cd40222ba0d2cca03af8388) * [OCPBUGS-96550](https://issues.redhat.com/browse/OCPBUGS-96550): Bump golang.org/x/net to v0.50.0-sec.4 [#417](https://github.com/openshift/cloud-provider-openstack/pull/417) * [OCPBUGS-80845](https://issues.redhat.com/browse/OCPBUGS-80845): bump google.golang.org/grpc@v1.79.3 [#384](https://github.com/openshift/cloud-provider-openstack/pull/384) * [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/a123414456212431a2843d4e3a4f7250182402e4...063501a59511f2924cd40222ba0d2cca03af8388) ### [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs/tree/b5e4888ca8e420ba9245805a1a8c976074a8b793) * [OCPBUGS-82899](https://issues.redhat.com/browse/OCPBUGS-82899): Bump github.com/moby/spdystream@v0.5.1 [#191](https://github.com/openshift/csi-driver-nfs/pull/191) * [Full changelog](https://github.com/openshift/csi-driver-nfs/compare/ebfd16d227b3af490f4327a8a040f6c9657a3b01...b5e4888ca8e420ba9245805a1a8c976074a8b793) ### [csi-external-attacher](https://github.com/openshift/csi-external-attacher/tree/c3a5a353da0861670a8452cf7502183aa1c6116f) * UPSTREAM: 110: OCPBUGS-104081: Bump golang.org/x/net to v0.50.0-sec.4 [#112](https://github.com/openshift/csi-external-attacher/pull/112) * [Full changelog](https://github.com/openshift/csi-external-attacher/compare/6a3be10e6795c8149c4bd3c9856f7e2d312108e2...c3a5a353da0861670a8452cf7502183aa1c6116f) ### [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner/tree/a516b58acb562eb512fb6dcd1965cfd634996a12) * [OCPBUGS-93008](https://issues.redhat.com/browse/OCPBUGS-93008): Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.48.0-sec.3 to address CVE-2026-46597 [#159](https://github.com/openshift/csi-external-provisioner/pull/159) * UPSTREAM: 1544: OCPBUGS-96508: Bump golang.org/x/net to v0.50.0-sec.4 [#149](https://github.com/openshift/csi-external-provisioner/pull/149) * [OCPBUGS-82900](https://issues.redhat.com/browse/OCPBUGS-82900): Address CVE-2026-35469 [#139](https://github.com/openshift/csi-external-provisioner/pull/139) * [Full changelog](https://github.com/openshift/csi-external-provisioner/compare/ac55db6fcd6f53ef1c26e3d85c511dbb18bc4d73...a516b58acb562eb512fb6dcd1965cfd634996a12) ### [csi-external-resizer](https://github.com/openshift/csi-external-resizer/tree/d5c2c2b47fbd76677d6060956f309bc675957c31) * [OCPBUGS-104092](https://issues.redhat.com/browse/OCPBUGS-104092): Bump golang.org/x/net to v0.50.0-sec.4 [#210](https://github.com/openshift/csi-external-resizer/pull/210) * [OCPBUGS-80786](https://issues.redhat.com/browse/OCPBUGS-80786): Bump google.golang.org/grpc to v1.79.3 [#200](https://github.com/openshift/csi-external-resizer/pull/200) * [Full changelog](https://github.com/openshift/csi-external-resizer/compare/d880a1ec6da02dbf61600ec7999266185ca9f784...d5c2c2b47fbd76677d6060956f309bc675957c31) ### [csi-external-snapshot-metadata](https://github.com/openshift/csi-external-snapshot-metadata/tree/58ad95f7469d70b97f3152e8b8fba7f2f3556b54) * [OCPBUGS-104088](https://issues.redhat.com/browse/OCPBUGS-104088): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#32](https://github.com/openshift/csi-external-snapshot-metadata/pull/32) * [OCPBUGS-80787](https://issues.redhat.com/browse/OCPBUGS-80787): Bump google.golang.org/grpc to v1.79.3 [release-4.21] [#20](https://github.com/openshift/csi-external-snapshot-metadata/pull/20) * [Full changelog](https://github.com/openshift/csi-external-snapshot-metadata/compare/af250fdbac8af84d9808a2892bfc911c04162115...58ad95f7469d70b97f3152e8b8fba7f2f3556b54) ### [csi-external-snapshotter, csi-snapshot-controller](https://github.com/openshift/csi-external-snapshotter/tree/d5255eb9b32130c684957e258bd1b2f40f0a70fa) * [OCPBUGS-104077](https://issues.redhat.com/browse/OCPBUGS-104077): Replace golang.org/x/net with github.com/openshift-sustaining/net v0.50.0-sec.3 to mitigate CVE-2026-33814 (release-4.21) [#235](https://github.com/openshift/csi-external-snapshotter/pull/235) * [OCPBUGS-89328](https://issues.redhat.com/browse/OCPBUGS-89328): UPSTREAM: 1392: Fix VolumeSnapshotContent deletion [#223](https://github.com/openshift/csi-external-snapshotter/pull/223) * [Full changelog](https://github.com/openshift/csi-external-snapshotter/compare/7503ea30886b6e5565ffa02935cf8d2ca299f281...d5255eb9b32130c684957e258bd1b2f40f0a70fa) ### [docker-builder](https://github.com/openshift/builder/tree/3c27415e6167879dc02bf2fc4388a7d914109b2c) * [OCPBUGS-90033](https://issues.redhat.com/browse/OCPBUGS-90033), [OCPBUGS-90475](https://issues.redhat.com/browse/OCPBUGS-90475), [OCPBUGS-92525](https://issues.redhat.com/browse/OCPBUGS-92525), [OCPBUGS-92654](https://issues.redhat.com/browse/OCPBUGS-92654), [OCPBUGS-92992](https://issues.redhat.com/browse/OCPBUGS-92992): Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 [#547](https://github.com/openshift/builder/pull/547) * [Full changelog](https://github.com/openshift/builder/compare/48fce231bac118a63992f466acc8b29a29e1ddde...3c27415e6167879dc02bf2fc4388a7d914109b2c) ### [docker-registry](https://github.com/openshift/image-registry/tree/42b6cb7c6467083b0805c2515817da7c1038a5d3) * [OCPBUGS-104087](https://issues.redhat.com/browse/OCPBUGS-104087): [release-4.21] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#477](https://github.com/openshift/image-registry/pull/477) * [Full changelog](https://github.com/openshift/image-registry/compare/602f51c795dcdcd71c75f6abfe79dc0424a0476a...42b6cb7c6467083b0805c2515817da7c1038a5d3) ### [egress-router-cni](https://github.com/openshift/egress-router-cni/tree/0ec77dd178e3b0433f01fce5bcce96abcc126deb) * [OCPBUGS-98548](https://issues.redhat.com/browse/OCPBUGS-98548): Bump containernetworking/cni to v1.3.0 github.com/containernetworking/plugins to 1.4.0 [#106](https://github.com/openshift/egress-router-cni/pull/106) * [Full changelog](https://github.com/openshift/egress-router-cni/compare/5e0f8d1b545899fda27c5e1cc8707d33cba1b534...0ec77dd178e3b0433f01fce5bcce96abcc126deb) ### [etcd](https://github.com/openshift/etcd/tree/b6dda5413ec33fc88fc9751d98d3b4bd96ea877d) * [OCPBUGS-100390](https://issues.redhat.com/browse/OCPBUGS-100390): UPSTREAM: 21443: Revert "Reuse events between sync loops" [#394](https://github.com/openshift/etcd/pull/394) * [Full changelog](https://github.com/openshift/etcd/compare/806f690e1f140e0aea2eb05ef5f288b756b62895...b6dda5413ec33fc88fc9751d98d3b4bd96ea877d) ### [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp/tree/f064fc7fcc679e21ff8412f0a1f1d754943a3ae9) * [OCPBUGS-104106](https://issues.redhat.com/browse/OCPBUGS-104106), [OCPBUGS-104202](https://issues.redhat.com/browse/OCPBUGS-104202), [OCPBUGS-88266](https://issues.redhat.com/browse/OCPBUGS-88266): Replace golang.org/x/net with sustaining fork for CVE-2026-33814 and CVE-2026-39821 [#162](https://github.com/openshift/cloud-provider-gcp/pull/162) * NO-JIRA: Update OWNERS [#159](https://github.com/openshift/cloud-provider-gcp/pull/159) * [OCPBUGS-115261](https://issues.redhat.com/browse/OCPBUGS-115261): Fix node.kubernetes.io/exclude-from-external-load-balancers on masters [#142](https://github.com/openshift/cloud-provider-gcp/pull/142) * [Full changelog](https://github.com/openshift/cloud-provider-gcp/compare/e27accef1fa99089410e4b0894db21a392d9bf99...f064fc7fcc679e21ff8412f0a1f1d754943a3ae9) ### [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp/tree/53820aadd2cc313cb0ce54788bb1fceec5b95eed) * [OCPBUGS-104131](https://issues.redhat.com/browse/OCPBUGS-104131): Bump golang.org/x/net to v0.50.0-sec.3 [#186](https://github.com/openshift/machine-api-provider-gcp/pull/186) * [OCPBUGS-105415](https://issues.redhat.com/browse/OCPBUGS-105415): [release-4.21] Add the N4A machine type [#179](https://github.com/openshift/machine-api-provider-gcp/pull/179) * [Full changelog](https://github.com/openshift/machine-api-provider-gcp/compare/49b8eb1bbdd364b8144dee270a88cace41271e4d...53820aadd2cc313cb0ce54788bb1fceec5b95eed) ### [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver/tree/3fc777d39975da87ac32dda3e5e787de64582403) * [OCPBUGS-104100](https://issues.redhat.com/browse/OCPBUGS-104100): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#141](https://github.com/openshift/gcp-pd-csi-driver/pull/141) * [Full changelog](https://github.com/openshift/gcp-pd-csi-driver/compare/1da557fe54562347dbf18bee04fe6564a2697707...3fc777d39975da87ac32dda3e5e787de64582403) ### [gcp-pd-csi-driver-operator](https://github.com/openshift/gcp-pd-csi-driver-operator/tree/6f1c697f3877a7ab51b612c8cf3a69b0351d084b) * [OCPBUGS-104100](https://issues.redhat.com/browse/OCPBUGS-104100): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#211](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/211) * [OCPBUGS-97960](https://issues.redhat.com/browse/OCPBUGS-97960): no-op OWNERS change to trigger postsubmit jobs [#197](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/197) * [Full changelog](https://github.com/openshift/gcp-pd-csi-driver-operator/compare/30853f6a0d50797ad6b32f5db617adda3eb53233...6f1c697f3877a7ab51b612c8cf3a69b0351d084b) ### [haproxy-router](https://github.com/openshift/router/tree/22531cf0bb2435e73437be73c244913de4844812) * [OCPBUGS-86729](https://issues.redhat.com/browse/OCPBUGS-86729): Prevent SSRF via FQDN-typed EndpointSlices [#818](https://github.com/openshift/router/pull/818) * [OCPBUGS-86718](https://issues.redhat.com/browse/OCPBUGS-86718): Strip X-SSL-* headers for plain HTTP [#795](https://github.com/openshift/router/pull/795) * [OCPBUGS-87002](https://issues.redhat.com/browse/OCPBUGS-87002): Replace HTTP backend liveness check with admin socket check [#786](https://github.com/openshift/router/pull/786) * [Full changelog](https://github.com/openshift/router/compare/cffbbab7d26f76620a099ee86d9e5d987de9aa56...22531cf0bb2435e73437be73c244913de4844812) ### [hyperkube, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/601ff80b0459adda2d2c5865bfb8d568a1fa68b7) * UPSTREAM: <carry>: OCPBUGS-99230: Fix ClusterIsIPv6() detection for dual-stack v6-primary clusters [#2722](https://github.com/openshift/kubernetes/pull/2722) * [OCPBUGS-87157](https://issues.redhat.com/browse/OCPBUGS-87157): Fix performance related issues when selinux metrics are emitted [#2678](https://github.com/openshift/kubernetes/pull/2678) * NO-JIRA: Update openshift-hack/rebase.sh [#2745](https://github.com/openshift/kubernetes/pull/2745) * [OCPBUGS-94059](https://issues.redhat.com/browse/OCPBUGS-94059): backport kubernetes/conformance umbrella suite [#2708](https://github.com/openshift/kubernetes/pull/2708) * [OCPBUGS-91759](https://issues.redhat.com/browse/OCPBUGS-91759): Rebase v1.34.9 in release-4.21 [#2702](https://github.com/openshift/kubernetes/pull/2702) * [OCPBUGS-87017](https://issues.redhat.com/browse/OCPBUGS-87017): fix flake race in VAP e2e case [#2677](https://github.com/openshift/kubernetes/pull/2677) * [Full changelog](https://github.com/openshift/kubernetes/compare/eab2218b931d0c20740d6259df59f242abf32ef7...601ff80b0459adda2d2c5865bfb8d568a1fa68b7) ### [hypershift](https://github.com/openshift/hypershift/tree/6ab1920d7d7cd2299f366d5e0133e0902ffd4c9a) * [OCPBUGS-93030](https://issues.redhat.com/browse/OCPBUGS-93030): CVE-2026-46597 openshift4/ose-hypershift-rhel9: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs [openshift-4.21] [#9270](https://github.com/openshift/hypershift/pull/9270) * [OCPBUGS-129535](https://issues.redhat.com/browse/OCPBUGS-129535): filter AWS-reserved tag keys before calling DeleteTags [#9964](https://github.com/openshift/hypershift/pull/9964) * [OCPBUGS-129111](https://issues.redhat.com/browse/OCPBUGS-129111): Count only successful upsert updates [#9901](https://github.com/openshift/hypershift/pull/9901) * [OCPBUGS-81489](https://issues.redhat.com/browse/OCPBUGS-81489): Add MTU override for OVN-Kubernetes on hosted clusters [#8136](https://github.com/openshift/hypershift/pull/8136) * [CNTRLPLANE-4570](https://issues.redhat.com/browse/CNTRLPLANE-4570): add kubeClientQPS and kubeClientBurst to ClusterAutoscaling [#9888](https://github.com/openshift/hypershift/pull/9888) * [OCPBUGS-128933](https://issues.redhat.com/browse/OCPBUGS-128933): [release-4.21] fix: grant cluster-autoscaler watch access [#9855](https://github.com/openshift/hypershift/pull/9855) * [OCPBUGS-120681](https://issues.redhat.com/browse/OCPBUGS-120681): Apply ingress load balancer scope to default IngressController [#9541](https://github.com/openshift/hypershift/pull/9541) * [OCPBUGS-112732](https://issues.redhat.com/browse/OCPBUGS-112732): fix(certs): normalize IP SANs to stop dual-stack KAS cert churn [#9497](https://github.com/openshift/hypershift/pull/9497) * [OCPBUGS-128418](https://issues.redhat.com/browse/OCPBUGS-128418): fix(konnectivity): enable --sync-forever to restore lost agent-server tunnels [#9800](https://github.com/openshift/hypershift/pull/9800) * [OCPBUGS-98327](https://issues.redhat.com/browse/OCPBUGS-98327): fix(kubevirt): use only first MachineInternalIP per family in EndpointSlice endpoints [#8978](https://github.com/openshift/hypershift/pull/8978) * [CNTRLPLANE-4158](https://issues.redhat.com/browse/CNTRLPLANE-4158): Maintain ingress serving cert for HostedCluster ingress [#9744](https://github.com/openshift/hypershift/pull/9744) * [ACM-46124](https://issues.redhat.com/browse/ACM-46124): improve hypershift-rhel9-operator container grade on MCE 2.11 [release-4.21] [#9739](https://github.com/openshift/hypershift/pull/9739) * [OCPBUGS-120751](https://issues.redhat.com/browse/OCPBUGS-120751): update Containerfile.cli runtime base image to floating tag [release-4.21] [#9557](https://github.com/openshift/hypershift/pull/9557) * [OCPBUGS-125792](https://issues.redhat.com/browse/OCPBUGS-125792): hardcode ETCD_METRICS=extensive in etcd StatefulSet template [#9696](https://github.com/openshift/hypershift/pull/9696) * [OCPBUGS-82913](https://issues.redhat.com/browse/OCPBUGS-82913): Address CVE-2026-35469 [#9023](https://github.com/openshift/hypershift/pull/9023) * [OCPBUGS-96712](https://issues.redhat.com/browse/OCPBUGS-96712): Apply MetricsSet relabel configs to KAS ServiceMonitor [#9294](https://github.com/openshift/hypershift/pull/9294) * [OCPBUGS-105505](https://issues.redhat.com/browse/OCPBUGS-105505): fix(upsert): add desired-state hash to detect spec field removals [#9268](https://github.com/openshift/hypershift/pull/9268) * [OCPBUGS-104592](https://issues.redhat.com/browse/OCPBUGS-104592): Add proxy env vars to AWS cloud-controller-manager deployment [#9224](https://github.com/openshift/hypershift/pull/9224) * [OCPBUGS-105434](https://issues.redhat.com/browse/OCPBUGS-105434): [release-4.21] fix router component ordering to prevent missing HAProxy backends [#9263](https://github.com/openshift/hypershift/pull/9263) * [OCPBUGS-94179](https://issues.redhat.com/browse/OCPBUGS-94179): fix registry override matching and propagation to init containers [#8879](https://github.com/openshift/hypershift/pull/8879) * [OCPBUGS-100194](https://issues.redhat.com/browse/OCPBUGS-100194): fix(cpo): set correct --advertise-client-url for etcd grpc-proxy [#9184](https://github.com/openshift/hypershift/pull/9184) * [CNTRLPLANE-3873](https://issues.redhat.com/browse/CNTRLPLANE-3873): Backport controlPlaneVersion status to release-4.21 [#9054](https://github.com/openshift/hypershift/pull/9054) * [OCPBUGS-99646](https://issues.redhat.com/browse/OCPBUGS-99646): OCPBUGS-86296: Propagate management cluster proxy env vars to konnectivity sidecar [#9087](https://github.com/openshift/hypershift/pull/9087) * [OCPBUGS-90087](https://issues.redhat.com/browse/OCPBUGS-90087): [release-4.21] clear stale EtcdRecoveryActive failure condition when etcd is healthy [#8807](https://github.com/openshift/hypershift/pull/8807) * [OCPBUGS-97922](https://issues.redhat.com/browse/OCPBUGS-97922): fix(nodepool): skip CNI-internal IPs in ClusterNetworkCIDRConflict check [#8949](https://github.com/openshift/hypershift/pull/8949) * [OCPBUGS-99100](https://issues.redhat.com/browse/OCPBUGS-99100): fix(backport): konnectivity agent auth [#9093](https://github.com/openshift/hypershift/pull/9093) * [OCPBUGS-91671](https://issues.redhat.com/browse/OCPBUGS-91671): [release-4.21] OCPBUGS-74960: prevent resource leak on deletion and handle DependencyViolation [#8798](https://github.com/openshift/hypershift/pull/8798) * [OCPBUGS-90084](https://issues.redhat.com/browse/OCPBUGS-90084): Fix NodePool reconciliation failure when updating mirrored immutable ConfigMaps [#8812](https://github.com/openshift/hypershift/pull/8812) * [OCPBUGS-93927](https://issues.redhat.com/browse/OCPBUGS-93927): fix(cpo): deduplicate VPC endpoint subnets by AZ to prevent DuplicateSubnetsInSameZone [#8862](https://github.com/openshift/hypershift/pull/8862) * [OCPBUGS-86295](https://issues.redhat.com/browse/OCPBUGS-86295): CAPI image overrides aware of registry config [#8559](https://github.com/openshift/hypershift/pull/8559) * [OCPBUGS-83833](https://issues.redhat.com/browse/OCPBUGS-83833): fix(deps): update dependencies to address CVE-2025-52881 [#8748](https://github.com/openshift/hypershift/pull/8748) * [OCPBUGS-92089](https://issues.redhat.com/browse/OCPBUGS-92089): fix(cpo): prevent informer creation for inaccessible resource types [#8833](https://github.com/openshift/hypershift/pull/8833) * [OCPBUGS-89353](https://issues.redhat.com/browse/OCPBUGS-89353): build(operator): drop hypershift-no-cgo from operator container images [#8757](https://github.com/openshift/hypershift/pull/8757) * [OCPBUGS-80813](https://issues.redhat.com/browse/OCPBUGS-80813): Bump google.golang.org/grpc to v1.79.3 [#8443](https://github.com/openshift/hypershift/pull/8443) * [OCPBUGS-86040](https://issues.redhat.com/browse/OCPBUGS-86040): [release-4.21] Verify cert revocation against all KAS pods [#8539](https://github.com/openshift/hypershift/pull/8539) * NO-JIRA: fix(tekton): remove path filter from control-plane-operator pipelines [#8667](https://github.com/openshift/hypershift/pull/8667) * [Full changelog](https://github.com/openshift/hypershift/compare/d345a6af0fb9c22d2058ac98994afbcb41e24f6f...6ab1920d7d7cd2299f366d5e0133e0902ffd4c9a) ### [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm/tree/ca2f7d03f3ff062e7f40e6a07e571b27d1742a77) * [OCPBUGS-120699](https://issues.redhat.com/browse/OCPBUGS-120699): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#111](https://github.com/openshift/cloud-provider-ibm/pull/111) * [Full changelog](https://github.com/openshift/cloud-provider-ibm/compare/c566572b2cf0120499e81181f1efb1e729e9c418...ca2f7d03f3ff062e7f40e6a07e571b27d1742a77) ### [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/tree/f6ca28cbbde5485f69cfce97c78f2b660c233d4e) * [OCPBUGS-104111](https://issues.redhat.com/browse/OCPBUGS-104111): Use patched x/net fork v0.50.0-sec.4 [#191](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/191) * [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/compare/00bc740728d9f8ec86fe04199884108c2a091b58...f6ca28cbbde5485f69cfce97c78f2b660c233d4e) ### [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud/tree/d2dc1470a6b71312fcfefdf4d334288302b6cfec) * [OCPBUGS-104105](https://issues.redhat.com/browse/OCPBUGS-104105): Replace golang.org/x/net with openshift-sustaining/net [#175](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/175) * [Full changelog](https://github.com/openshift/cluster-api-provider-ibmcloud/compare/f7e3ec30f746add35458fad54dd6bccb97e307bf...d2dc1470a6b71312fcfefdf4d334288302b6cfec) ### [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud/tree/22e131a00d874c240531c40141a8a780fbb48bd5) * [OCPBUGS-104113](https://issues.redhat.com/browse/OCPBUGS-104113): replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 [#101](https://github.com/openshift/machine-api-provider-ibmcloud/pull/101) * [Full changelog](https://github.com/openshift/machine-api-provider-ibmcloud/compare/f80ea3216387639dde6550a70a6e08599fd67f5f...22e131a00d874c240531c40141a8a780fbb48bd5) ### [insights-operator](https://github.com/openshift/insights-operator/tree/a7ed56b781e65b134ff3aaa264e4fa6f162fd943) * [OCPBUGS-127485](https://issues.redhat.com/browse/OCPBUGS-127485): Add multicluster gatherer [#1374](https://github.com/openshift/insights-operator/pull/1374) * [OCPBUGS-123175](https://issues.redhat.com/browse/OCPBUGS-123175): add custom proxy field to insights config [#1365](https://github.com/openshift/insights-operator/pull/1365) * [OCPBUGS-104096](https://issues.redhat.com/browse/OCPBUGS-104096): Bump golang.org/x/net to v0.50.0-sec.3 [#1352](https://github.com/openshift/insights-operator/pull/1352) * [OCPBUGS-109390](https://issues.redhat.com/browse/OCPBUGS-109390): secrets and configmap revisions count gathering [#1342](https://github.com/openshift/insights-operator/pull/1342) * [OCPBUGS-100248](https://issues.redhat.com/browse/OCPBUGS-100248): Fix indentation bug on livenessProbe [#1333](https://github.com/openshift/insights-operator/pull/1333) * [OCPBUGS-99015](https://issues.redhat.com/browse/OCPBUGS-99015): update HyperShift deployment manifest [#1323](https://github.com/openshift/insights-operator/pull/1323) * [OCPBUGS-91985](https://issues.redhat.com/browse/OCPBUGS-91985): fall back to kube-system/global-pull-secret for Insights token [#1310](https://github.com/openshift/insights-operator/pull/1310) * [OCPBUGS-87191](https://issues.redhat.com/browse/OCPBUGS-87191): extractro controller [#1300](https://github.com/openshift/insights-operator/pull/1300) * [OCPBUGS-86805](https://issues.redhat.com/browse/OCPBUGS-86805): add config option to disable runtime extractor [#1295](https://github.com/openshift/insights-operator/pull/1295) * [Full changelog](https://github.com/openshift/insights-operator/compare/2bc8825afccf2456f95d8bfea097a528d072bd11...a7ed56b781e65b134ff3aaa264e4fa6f162fd943) ### [ironic](https://github.com/openshift/ironic-image/tree/d9db7430c1e402239d980e0c10428341f49937de) * [OCPBUGS-115166](https://issues.redhat.com/browse/OCPBUGS-115166): ZTP deployment failed on an iDRAC10 cluster [#919](https://github.com/openshift/ironic-image/pull/919) * [OCPBUGS-105861](https://issues.redhat.com/browse/OCPBUGS-105861): update ironic pin to include CVE-2026-54423 fix (release-4.21) [#890](https://github.com/openshift/ironic-image/pull/890) * [OCPBUGS-88473](https://issues.redhat.com/browse/OCPBUGS-88473): Update openstack-ironic commit hash in requirements.cachito that addresses CVE-2026-43003 [#885](https://github.com/openshift/ironic-image/pull/885) * [OCPBUGS-97991](https://issues.redhat.com/browse/OCPBUGS-97991): Update openstack-ironic commit hash for CVE-2026-44918 [#876](https://github.com/openshift/ironic-image/pull/876) * [OCPBUGS-90554](https://issues.redhat.com/browse/OCPBUGS-90554): [4.21] Fix parallel power concurrency [#856](https://github.com/openshift/ironic-image/pull/856) * [OCPBUGS-82294](https://issues.redhat.com/browse/OCPBUGS-82294), [OCPBUGS-84370](https://issues.redhat.com/browse/OCPBUGS-84370): Update sushy and Ironic to resolve Cisco vMedia Insert and BIOS Settings update issues. [#829](https://github.com/openshift/ironic-image/pull/829) * [Full changelog](https://github.com/openshift/ironic-image/compare/6e93d7a042c96f1db6307549d348da8f6f89b06a...d9db7430c1e402239d980e0c10428341f49937de) ### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/156ef6b4730f01279216d3296349ca0cae29466c) * [OCPBUGS-100051](https://issues.redhat.com/browse/OCPBUGS-100051): Bump ironic-python-agent pinned commit for CVE-2026-66138 [#296](https://github.com/openshift/ironic-agent-image/pull/296) * [OCPBUGS-88473](https://issues.redhat.com/browse/OCPBUGS-88473): Update commit SHA in requirements.cachito to address CVE-2026-43003 [#298](https://github.com/openshift/ironic-agent-image/pull/298) * [OCPBUGS-95062](https://issues.redhat.com/browse/OCPBUGS-95062): Replace individual package removal with a single rpm -e loop [#283](https://github.com/openshift/ironic-agent-image/pull/283) * [OCPBUGS-95062](https://issues.redhat.com/browse/OCPBUGS-95062): Replace dnf remove with rpm -e to prevent dependency removal [#271](https://github.com/openshift/ironic-agent-image/pull/271) * [Full changelog](https://github.com/openshift/ironic-agent-image/compare/ff276c00e345b9cb9298ce9dbdd7f19a8b14dbce...156ef6b4730f01279216d3296349ca0cae29466c) ### [keepalived-ipfailover](https://github.com/openshift/images/tree/f0241a3d2a12a8b2965cc36542babce8a1dffcf8) * [OCPBUGS-99781](https://issues.redhat.com/browse/OCPBUGS-99781): Reinstall tzdata if /usr/share/zoneinfo is missing [#248](https://github.com/openshift/images/pull/248) * [Full changelog](https://github.com/openshift/images/compare/e00f5806587e71188805bab43dad9099524b9059...f0241a3d2a12a8b2965cc36542babce8a1dffcf8) ### [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server/tree/a577f425844d4c95b91dc4eec2a4068e1f6cf443) * NO-ISSUE: synchronize OWNERS from main branch [release-4.21] [#82](https://github.com/openshift/kubernetes-metrics-server/pull/82) * [Full changelog](https://github.com/openshift/kubernetes-metrics-server/compare/ff4f3e2a6d2b0e8a860831b98733cff152cfddd3...a577f425844d4c95b91dc4eec2a4068e1f6cf443) ### [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy/tree/72abb01aca3ca72d1f64328ef07b0cafd34e1f5e) * [OCPBUGS-127955](https://issues.redhat.com/browse/OCPBUGS-127955): Replace golang.org/x/net with sustaining_fork version to resolve CVE-2026-39821 (release-4.21) [#166](https://github.com/openshift/kube-rbac-proxy/pull/166) * [Full changelog](https://github.com/openshift/kube-rbac-proxy/compare/cd636680e06a55395c26570dff0cb37277014388...72abb01aca3ca72d1f64328ef07b0cafd34e1f5e) ### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/10415bfe1d1fd2e951a3655ba6c8230025ab9c0f) * [OCPBUGS-130778](https://issues.redhat.com/browse/OCPBUGS-130778): backport kube-state-metrics 2.18 memory leak fix [#199](https://github.com/openshift/kube-state-metrics/pull/199) * [OCPBUGS-104127](https://issues.redhat.com/browse/OCPBUGS-104127): Use patched x/net fork v0.50.0-sec.4 [#167](https://github.com/openshift/kube-state-metrics/pull/167) * NO-ISSUE: synchronize OWNERS from main branch [release-4.21] [#188](https://github.com/openshift/kube-state-metrics/pull/188) * [OCPBUGS-99400](https://issues.redhat.com/browse/OCPBUGS-99400): fix CronJob timezone panic and embed tzdata in kube-state-metrics [#151](https://github.com/openshift/kube-state-metrics/pull/151) * [Full changelog](https://github.com/openshift/kube-state-metrics/compare/0efd2f822814f9965ef6dc14b68f24eebcaca40d...10415bfe1d1fd2e951a3655ba6c8230025ab9c0f) ### [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver/tree/8a115121952348de9a4e4a73478755258a401a86) * [OCPBUGS-80717](https://issues.redhat.com/browse/OCPBUGS-80717): Bump google.golang.org/grpc to v1.79.3 [#98](https://github.com/openshift/kubevirt-csi-driver/pull/98) * [Full changelog](https://github.com/openshift/kubevirt-csi-driver/compare/4bb70e49c9d05690f3a26edc0a6feaf093169cbb...8a115121952348de9a4e4a73478755258a401a86) ### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/b60c1885ae2cc0dd2caf486596376de04609a58d) * [OCPBUGS-129659](https://issues.redhat.com/browse/OCPBUGS-129659): [release-4.21] Reduce vCenter API load in the vSphere machine controller [#1576](https://github.com/openshift/machine-api-operator/pull/1576) * [OCPBUGS-128567](https://issues.redhat.com/browse/OCPBUGS-128567): vsphere - Cache REST API sessions to prevent excessive vCenter logouts [#1567](https://github.com/openshift/machine-api-operator/pull/1567) * [SPLAT-2866](https://issues.redhat.com/browse/SPLAT-2866): Added multi vCenter Day 2 Support [#1554](https://github.com/openshift/machine-api-operator/pull/1554) * [OCPBUGS-127563](https://issues.redhat.com/browse/OCPBUGS-127563): Add opt-in kube-rbac-proxy sidecar for pprof endpoint (AWS) [#1561](https://github.com/openshift/machine-api-operator/pull/1561) * [OCPBUGS-104125](https://issues.redhat.com/browse/OCPBUGS-104125): replace golang.org/x/net with openshift-sustaining/net@v0.50.0-sec.4 [#1542](https://github.com/openshift/machine-api-operator/pull/1542) * [Full changelog](https://github.com/openshift/machine-api-operator/compare/88f39dc939cceb2c1999f2b0ab99f1118f26358f...b60c1885ae2cc0dd2caf486596376de04609a58d) ### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/2ae316fed5fbfee4cf00f4a96f24e43afe6e7b0e) * [OCPBUGS-129667](https://issues.redhat.com/browse/OCPBUGS-129667): Boot image controller skips MachineSets that don't match any failure domain [#6642](https://github.com/openshift/machine-config-operator/pull/6642) * [OCPBUGS-128598](https://issues.redhat.com/browse/OCPBUGS-128598): wrong early exit during kubelet MCs regeneration [#6599](https://github.com/openshift/machine-config-operator/pull/6599) * [OCPBUGS-127254](https://issues.redhat.com/browse/OCPBUGS-127254): Correctly handle MC deletion in image mode when no new build is required [#6575](https://github.com/openshift/machine-config-operator/pull/6575) * [OCPBUGS-104144](https://issues.redhat.com/browse/OCPBUGS-104144): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#6504](https://github.com/openshift/machine-config-operator/pull/6504) * [OCPBUGS-123140](https://issues.redhat.com/browse/OCPBUGS-123140): limit ContainerRuntimeConfig status condition to 3 [#6539](https://github.com/openshift/machine-config-operator/pull/6539) * [OCPBUGS-120453](https://issues.redhat.com/browse/OCPBUGS-120453): Update message for MachineOSBuildFailed condition [#6493](https://github.com/openshift/machine-config-operator/pull/6493) * [OCPBUGS-116929](https://issues.redhat.com/browse/OCPBUGS-116929): Update AMI Whitelist [#6486](https://github.com/openshift/machine-config-operator/pull/6486) * [OCPBUGS-112469](https://issues.redhat.com/browse/OCPBUGS-112469): Fix SHA idempotency test in nmstate-configuration.sh [#6430](https://github.com/openshift/machine-config-operator/pull/6430) * [OCPBUGS-114391](https://issues.redhat.com/browse/OCPBUGS-114391): Use kubernetes scheme in drain controller event recorder [#6457](https://github.com/openshift/machine-config-operator/pull/6457) * [OCPBUGS-109656](https://issues.redhat.com/browse/OCPBUGS-109656): Fix duplicate template error [#6405](https://github.com/openshift/machine-config-operator/pull/6405) * [OCPBUGS-105303](https://issues.redhat.com/browse/OCPBUGS-105303): Use providerSpec.Template in vSphere machineset reconciliation [#6381](https://github.com/openshift/machine-config-operator/pull/6381) * [OCPBUGS-105214](https://issues.redhat.com/browse/OCPBUGS-105214): Update AMI Whitelist [#6376](https://github.com/openshift/machine-config-operator/pull/6376) * [OCPBUGS-93806](https://issues.redhat.com/browse/OCPBUGS-93806): move cleanUpDuplicatedMC to avoid double reboot on first updated Master node [#6241](https://github.com/openshift/machine-config-operator/pull/6241) * [OCPBUGS-97905](https://issues.redhat.com/browse/OCPBUGS-97905): Inject proxy into MCC deployment [#6276](https://github.com/openshift/machine-config-operator/pull/6276) * [OCPBUGS-88510](https://issues.redhat.com/browse/OCPBUGS-88510): fix: update arbiter crio config [#6189](https://github.com/openshift/machine-config-operator/pull/6189) * [release:4.21] OCPBUGS-89234: In OCB to check when a image is removed the old build is triggered again and the MC should start updating directly and no new MOSB should be triggred [#6196](https://github.com/openshift/machine-config-operator/pull/6196) * [OCPBUGS-95588](https://issues.redhat.com/browse/OCPBUGS-95588): Remove sensitive ControllerConfig logging [#6257](https://github.com/openshift/machine-config-operator/pull/6257) * [OCPBUGS-91971](https://issues.redhat.com/browse/OCPBUGS-91971): Make vsphere template updates atomic [#6229](https://github.com/openshift/machine-config-operator/pull/6229) * [OCPBUGS-94108](https://issues.redhat.com/browse/OCPBUGS-94108): Fix kubelet certificate wait loop in criometricsproxy.yaml [#6248](https://github.com/openshift/machine-config-operator/pull/6248) * [OCPBUGS-96153](https://issues.redhat.com/browse/OCPBUGS-96153): Update AMI Whitelist [#6261](https://github.com/openshift/machine-config-operator/pull/6261) * [OCPBUGS-93937](https://issues.redhat.com/browse/OCPBUGS-93937): Bootstrap MCS logging entire ignition [#6244](https://github.com/openshift/machine-config-operator/pull/6244) * [OCPBUGS-91734](https://issues.redhat.com/browse/OCPBUGS-91734): Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole [#6208](https://github.com/openshift/machine-config-operator/pull/6208) * [OCPBUGS-89243](https://issues.redhat.com/browse/OCPBUGS-89243): Process rebuild annotation on machine-os-builder restart [#6197](https://github.com/openshift/machine-config-operator/pull/6197) * [OCPBUGS-88709](https://issues.redhat.com/browse/OCPBUGS-88709): Update custom containerfile OCB test to work in a disconnected environment [#6193](https://github.com/openshift/machine-config-operator/pull/6193) * [OCPBUGS-88340](https://issues.redhat.com/browse/OCPBUGS-88340): vSphere boot image hot loop detection is non-functional due to stable template names [#6180](https://github.com/openshift/machine-config-operator/pull/6180) * [OCPBUGS-89340](https://issues.redhat.com/browse/OCPBUGS-89340): Remove skopeo-install script [#6202](https://github.com/openshift/machine-config-operator/pull/6202) * [OCPBUGS-88334](https://issues.redhat.com/browse/OCPBUGS-88334): Skip chrony-wait on first node join [#6178](https://github.com/openshift/machine-config-operator/pull/6178) * [OCPBUGS-88335](https://issues.redhat.com/browse/OCPBUGS-88335): daemon: don't pull/extract extensions for all OS updates [#6179](https://github.com/openshift/machine-config-operator/pull/6179) * [OCPBUGS-86998](https://issues.redhat.com/browse/OCPBUGS-86998): configure-ovs: copy lldp mode to br-ex port [#6134](https://github.com/openshift/machine-config-operator/pull/6134) * [OCPBUGS-87008](https://issues.redhat.com/browse/OCPBUGS-87008): Stabilize ocl 4.21 [#6138](https://github.com/openshift/machine-config-operator/pull/6138) * [OCPBUGS-86979](https://issues.redhat.com/browse/OCPBUGS-86979): Update AMI Whitelist [#6129](https://github.com/openshift/machine-config-operator/pull/6129) * [Full changelog](https://github.com/openshift/machine-config-operator/compare/340c3847f293b8914ebef26d1e9b0a8ce2d2abd5...2ae316fed5fbfee4cf00f4a96f24e43afe6e7b0e) ### [machine-image-customization-controller](https://github.com/openshift/image-customization-controller/tree/069c86cef9402077f674302f02061ec16aa5cfa2) * [OCPBUGS-104119](https://issues.redhat.com/browse/OCPBUGS-104119): Replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 for CVE-2026-33814 [#195](https://github.com/openshift/image-customization-controller/pull/195) * [Full changelog](https://github.com/openshift/image-customization-controller/compare/65aeb3607f05dd71ec27a4457945ce1e054ea9e9...069c86cef9402077f674302f02061ec16aa5cfa2) ### [machine-os-images](https://github.com/openshift/machine-os-images/tree/581c9d9e453c73f67a93c44fb6715057c0cc8bf5) * [OCPBUGS-87873](https://issues.redhat.com/browse/OCPBUGS-87873): Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs [#97](https://github.com/openshift/machine-os-images/pull/97) * [OCPBUGS-85478](https://issues.redhat.com/browse/OCPBUGS-85478): Force rebuild for OCP 4.21 [#93](https://github.com/openshift/machine-os-images/pull/93) * [Full changelog](https://github.com/openshift/machine-os-images/compare/e9019e5f819c44726e9ff5e1ec8fdfad9fb314fd...581c9d9e453c73f67a93c44fb6715057c0cc8bf5) ### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/a39d7c998df44b47b48b8a60b593f077b7af489d) * [OCPBUGS-130566](https://issues.redhat.com/browse/OCPBUGS-130566): [release-4.21] escape regex variable values in regex matcher contexts [#1347](https://github.com/openshift/monitoring-plugin/pull/1347) * [OU-1392](https://issues.redhat.com/browse/OU-1392): [release-4.21] fix: parse datetime ranges from the specified format rather than browser specific apis [#1350](https://github.com/openshift/monitoring-plugin/pull/1350) * [OCPBUGS-118236](https://issues.redhat.com/browse/OCPBUGS-118236): [release-4.21] Bump fast-uri to fix CVE-2026-84292 [#1333](https://github.com/openshift/monitoring-plugin/pull/1333) * [OU-1528](https://issues.redhat.com/browse/OU-1528): [release-4.21] Optimize namespace changes in Alerts [#1311](https://github.com/openshift/monitoring-plugin/pull/1311) * NO-JIRA: [release-4.21] Sanitize alert runbook URLs [#1296](https://github.com/openshift/monitoring-plugin/pull/1296) * Fix OCPBUGS-104124: CVE-2026-33814 Replace golang.org/x/net with the patched github.com/openshift-sustaining/net@v0.50.0-sec.4 fork to remediate CVE-2026-33814 [#1201](https://github.com/openshift/monitoring-plugin/pull/1201) * [OCPBUGS-98789](https://issues.redhat.com/browse/OCPBUGS-98789): [release-4.21] replace outdated react-linkify dependency [#1149](https://github.com/openshift/monitoring-plugin/pull/1149) * [OCPBUGS-98425](https://issues.redhat.com/browse/OCPBUGS-98425): fix for CVE-2026-59869 [#1136](https://github.com/openshift/monitoring-plugin/pull/1136) * Fix for OCPBUGS-89702: CVE-2026-12143 [#1090](https://github.com/openshift/monitoring-plugin/pull/1090) * NO-JIRA: [release-4.21] - e2e monitoring stabilization [#919](https://github.com/openshift/monitoring-plugin/pull/919) * [OCPBUGS-99028](https://issues.redhat.com/browse/OCPBUGS-99028): Fix CVE-2026-49978 - bump DOMPurify to >= 3.4.7 [#1086](https://github.com/openshift/monitoring-plugin/pull/1086) * [OU-1240](https://issues.redhat.com/browse/OU-1240): Makefile and package.json to enable test-frontend-ci [#1095](https://github.com/openshift/monitoring-plugin/pull/1095) * [OCPBUGS-99283](https://issues.redhat.com/browse/OCPBUGS-99283): graph redirect query parameter [#1072](https://github.com/openshift/monitoring-plugin/pull/1072) * [OU-651](https://issues.redhat.com/browse/OU-651): Fix AlertRules page to display user defined loki alerts [#1060](https://github.com/openshift/monitoring-plugin/pull/1060) * Fix for OCPBUGS-91631: CVE-2026-45736 [#1024](https://github.com/openshift/monitoring-plugin/pull/1024) * [OU-1396](https://issues.redhat.com/browse/OU-1396): [release-4.21] fix: use replace to set variables to avoid navigation trap [#1033](https://github.com/openshift/monitoring-plugin/pull/1033) * NO-JIRA: fix incidents unit test [#1037](https://github.com/openshift/monitoring-plugin/pull/1037) * Fix for OCPBUGS-94011: CVE-2026-13676 [#1029](https://github.com/openshift/monitoring-plugin/pull/1029) * [OCPBUGS-87088](https://issues.redhat.com/browse/OCPBUGS-87088): [release-4.21] fast-uri: URI authority bypass due to improper delimiter handling [#973](https://github.com/openshift/monitoring-plugin/pull/973) * [OCPBUGS-88396](https://issues.redhat.com/browse/OCPBUGS-88396): CVE-2026-44487 bump axios to 1.16.0 [#999](https://github.com/openshift/monitoring-plugin/pull/999) * [OCPBUGS-84290](https://issues.redhat.com/browse/OCPBUGS-84290): bump follow-redirects to 1.16.0 [#987](https://github.com/openshift/monitoring-plugin/pull/987) * [OCPBUGS-84828](https://issues.redhat.com/browse/OCPBUGS-84828), [OCPBUGS-84991](https://issues.redhat.com/browse/OCPBUGS-84991), [OCPBUGS-85007](https://issues.redhat.com/browse/OCPBUGS-85007), [OCPBUGS-85037](https://issues.redhat.com/browse/OCPBUGS-85037): Update Axios to v1.15.2 [#982](https://github.com/openshift/monitoring-plugin/pull/982) * [Full changelog](https://github.com/openshift/monitoring-plugin/compare/462c78890ffb636e05d91d41ca718bb3c81da4cf...a39d7c998df44b47b48b8a60b593f077b7af489d) ### [multus-admission-controller](https://github.com/openshift/multus-admission-controller/tree/9c8756318c94e2748740b0d75d3a911cdd624bd0) * [OCPBUGS-104135](https://issues.redhat.com/browse/OCPBUGS-104135): bump golang.org/x/net to v0.50.0-sec.3 to fix CVE-2026-33814 [#131](https://github.com/openshift/multus-admission-controller/pull/131) * [Full changelog](https://github.com/openshift/multus-admission-controller/compare/d95feb67adfb97346849c79e36b6a9d404296ae9...9c8756318c94e2748740b0d75d3a911cdd624bd0) ### [multus-cni, multus-cni-microshift](https://github.com/openshift/multus-cni/tree/215643f7207e73eaf4db30d59f8dbf4ff1ef3faf) * [OCPBUGS-104143](https://issues.redhat.com/browse/OCPBUGS-104143): [release-4.21] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#354](https://github.com/openshift/multus-cni/pull/354) * [OCPBUGS-120763](https://issues.redhat.com/browse/OCPBUGS-120763): [Release 4.21] Cherry-pick fix for the issue of stripping delegate datastore config on CNI DEL, leaking IPAM addresses [#351](https://github.com/openshift/multus-cni/pull/351) * [OCPBUGS-80831](https://issues.redhat.com/browse/OCPBUGS-80831): bump grpc to 1.79.3 to address CVE-2026-33186 [#310](https://github.com/openshift/multus-cni/pull/310) * [Full changelog](https://github.com/openshift/multus-cni/compare/4f696e721ac0897a782c2fde3c24d961938feff3...215643f7207e73eaf4db30d59f8dbf4ff1ef3faf) ### [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy/tree/0e4455644aef65657630046fb9d6540ec728a33a) * [OCPBUGS-104136](https://issues.redhat.com/browse/OCPBUGS-104136): [release-4.21] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#125](https://github.com/openshift/multus-networkpolicy/pull/125) * [Full changelog](https://github.com/openshift/multus-networkpolicy/compare/e9f2f3c7e81683af3b8cc9a5a3166434c94e0498...0e4455644aef65657630046fb9d6540ec728a33a) ### [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni/tree/696f6965c938ae0976f33edb97871a5afb9e6d5b) * [OCPBUGS-104139](https://issues.redhat.com/browse/OCPBUGS-104139): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#423](https://github.com/openshift/whereabouts-cni/pull/423) * [Full changelog](https://github.com/openshift/whereabouts-cni/compare/d691040e509bb20c26b5e8366c0d6f3bb45a5e02...696f6965c938ae0976f33edb97871a5afb9e6d5b) ### [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon/tree/9af0359dc73e8489059057a625d53c5293923993) * [OCPBUGS-104121](https://issues.redhat.com/browse/OCPBUGS-104121): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.3 to address CVE-2026-33814 [#150](https://github.com/openshift/network-metrics-daemon/pull/150) * [Full changelog](https://github.com/openshift/network-metrics-daemon/compare/844fa588c4200b8ff768d1916d63f1d4c1db2daf...9af0359dc73e8489059057a625d53c5293923993) ### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/cdf3a58985ac0deb76ef2f23cd78dd2920ada284) * maintenance: Bump the npm group with 20 updates [#597](https://github.com/openshift/networking-console-plugin/pull/597) * [OCPNETUI-156](https://issues.redhat.com/browse/OCPNETUI-156): dependency cleanup [#592](https://github.com/openshift/networking-console-plugin/pull/592) * [OCPNETUI-156](https://issues.redhat.com/browse/OCPNETUI-156): reassign dev and prod dependencies [#585](https://github.com/openshift/networking-console-plugin/pull/585) * maintenance: Bump the npm group with 23 updates [#576](https://github.com/openshift/networking-console-plugin/pull/576) * maintenance: Bump the npm group across 1 directory with 24 updates [#571](https://github.com/openshift/networking-console-plugin/pull/571) * [OCPNETUI-156](https://issues.redhat.com/browse/OCPNETUI-156): Align shared modules with Console [#565](https://github.com/openshift/networking-console-plugin/pull/565) * maintenance: Bump the npm group with 15 updates [#548](https://github.com/openshift/networking-console-plugin/pull/548) * maintenance: Bump the npm group across 1 directory with 20 updates [#536](https://github.com/openshift/networking-console-plugin/pull/536) * maintenance: Bump the npm group with 232 updates [#498](https://github.com/openshift/networking-console-plugin/pull/498) * [OCPNETUI-82](https://issues.redhat.com/browse/OCPNETUI-82): Lower Dockerfile base image versions [#518](https://github.com/openshift/networking-console-plugin/pull/518) * [OCPBUGS-85606](https://issues.redhat.com/browse/OCPBUGS-85606): Fix React error on MultiNetworkPolicies page [#484](https://github.com/openshift/networking-console-plugin/pull/484) * [OCPBUGS-98790](https://issues.redhat.com/browse/OCPBUGS-98790): Updating linkify-it to 5.0.2 to fix CVE-2026-48801 [#463](https://github.com/openshift/networking-console-plugin/pull/463) * [OCPBUGS-74099](https://issues.redhat.com/browse/OCPBUGS-74099): fixed translations of pod column titles [#435](https://github.com/openshift/networking-console-plugin/pull/435) * [OCPBUGS-92375](https://issues.redhat.com/browse/OCPBUGS-92375): Updated doc links based on release [#439](https://github.com/openshift/networking-console-plugin/pull/439) * [OCPBUGS-88313](https://issues.redhat.com/browse/OCPBUGS-88313): Trim subnet input in UDN creation form [#430](https://github.com/openshift/networking-console-plugin/pull/430) * And 1 elided commits (e.g. from squash or rebase merges) * [Full changelog](https://github.com/openshift/networking-console-plugin/compare/268037d76fd97d29f39eae2f25f0a2b2910cb30e...cdf3a58985ac0deb76ef2f23cd78dd2920ada284) ### [oauth-proxy](https://github.com/openshift/oauth-proxy/tree/8b500504e841a146871e361f20ebb6c54c83d2a1) * [OCPBUGS-112097](https://issues.redhat.com/browse/OCPBUGS-112097): bugfix: rewrite open redirect strings to '/' [#381](https://github.com/openshift/oauth-proxy/pull/381) * [Full changelog](https://github.com/openshift/oauth-proxy/compare/7f518c02931f8c5c1c3aa5d2192a905f973b2b34...8b500504e841a146871e361f20ebb6c54c83d2a1) ### [oauth-server](https://github.com/openshift/oauth-server/tree/ae06da6b5bdbeb2bac03126af40bec22833b2104) * [OCPBUGS-87078](https://issues.redhat.com/browse/OCPBUGS-87078): bugfix: default to english when Accept-Language header contains more than 1000 underscores [#269](https://github.com/openshift/oauth-server/pull/269) * [OCPBUGS-81816](https://issues.redhat.com/browse/OCPBUGS-81816): Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 [#234](https://github.com/openshift/oauth-server/pull/234) * [Full changelog](https://github.com/openshift/oauth-server/compare/2b8183592190365c269ca0c92b1955bbad9a0236...ae06da6b5bdbeb2bac03126af40bec22833b2104) ### [oc-mirror](https://github.com/openshift/oc-mirror/tree/aa20150b0dfe6d3c5255570b45f14c8ee18f22b7) * [OCPBUGS-129394](https://issues.redhat.com/browse/OCPBUGS-129394): v1 accept catalog root entries and relative symlink targets [#1575](https://github.com/openshift/oc-mirror/pull/1575) * [OCPBUGS-104022](https://issues.redhat.com/browse/OCPBUGS-104022): Use patched x/net fork v0.50.0-sec.4 [#1555](https://github.com/openshift/oc-mirror/pull/1555) * [OCPBUGS-105785](https://issues.redhat.com/browse/OCPBUGS-105785): fix for CVE-2026-39829 [#1503](https://github.com/openshift/oc-mirror/pull/1503) * [Full changelog](https://github.com/openshift/oc-mirror/compare/f9812811fdc23a9baa72f075afe566caddfe2280...aa20150b0dfe6d3c5255570b45f14c8ee18f22b7) ### [olm-catalogd, olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller/tree/1bd385d08adeae4bd98a902d29f984c00471ec1e) * [OCPBUGS-128986](https://issues.redhat.com/browse/OCPBUGS-128986): [release-4.21] clean up orphaned catalog cache temp dirs [#815](https://github.com/openshift/operator-framework-operator-controller/pull/815) * [OCPBUGS-104166](https://issues.redhat.com/browse/OCPBUGS-104166): [release-4.21] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#801](https://github.com/openshift/operator-framework-operator-controller/pull/801) * [OCPBUGS-100383](https://issues.redhat.com/browse/OCPBUGS-100383): Fix cache path to avoid /var/cache/dnf conflict [#785](https://github.com/openshift/operator-framework-operator-controller/pull/785) * [OCPBUGS-98090](https://issues.redhat.com/browse/OCPBUGS-98090): fix(test): use in-cluster catalog for preflight permission checks [release-4.21] [#778](https://github.com/openshift/operator-framework-operator-controller/pull/778) * [OCPBUGS-99756](https://issues.redhat.com/browse/OCPBUGS-99756): increase catalog HTTP client timeout from 10s to 5m [#774](https://github.com/openshift/operator-framework-operator-controller/pull/774) * [OCPBUGS-86842](https://issues.redhat.com/browse/OCPBUGS-86842): [release-4.21] catalogd: clean up orphaned temp dirs in catalog storage [#742](https://github.com/openshift/operator-framework-operator-controller/pull/742) * [Full changelog](https://github.com/openshift/operator-framework-operator-controller/compare/9bf1d982a091f54597e582c407d61f8ecfbc4f95...1bd385d08adeae4bd98a902d29f984c00471ec1e) ### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/f427de801b98823e486bdd5955468d88e95c2ac4) * [OCPBUGS-82918](https://issues.redhat.com/browse/OCPBUGS-82918): Address CVE-2026-35469 [#646](https://github.com/openshift/openshift-apiserver/pull/646) * [Full changelog](https://github.com/openshift/openshift-apiserver/compare/64dea074d6b457e1fae3598cea0bb72493d2cab8...f427de801b98823e486bdd5955468d88e95c2ac4) ### [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager/tree/be0f1245247b93fd92c4481cbb01a810d4fa368b) * [OCPBUGS-104165](https://issues.redhat.com/browse/OCPBUGS-104165): Use patched x/net fork v0.50.0-sec.4 [#460](https://github.com/openshift/openshift-controller-manager/pull/460) * [Full changelog](https://github.com/openshift/openshift-controller-manager/compare/438d52e79d691e016d66eabfe9a53c84229db40c...be0f1245247b93fd92c4481cbb01a810d4fa368b) ### [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack/tree/d02231d0a92491926666f4f1f5e45a7e2c733cb7) * UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.13 into release-4.21 [#417](https://github.com/openshift/cluster-api-provider-openstack/pull/417) * [Full changelog](https://github.com/openshift/cluster-api-provider-openstack/compare/f4f439d4ce40c1175188c81591284dcc9fe6facf...d02231d0a92491926666f4f1f5e45a7e2c733cb7) ### [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack/tree/b7456a2a12d1e65a5688693a005ad1e18aaee1be) * [OCPBUGS-97825](https://issues.redhat.com/browse/OCPBUGS-97825): Revendor CAPO [#176](https://github.com/openshift/machine-api-provider-openstack/pull/176) * [Full changelog](https://github.com/openshift/machine-api-provider-openstack/compare/b1fdb10f47f3bdb5c2902fac1d53bfa98c3a88ab...b7456a2a12d1e65a5688693a005ad1e18aaee1be) ### [openstack-resource-controller](https://github.com/openshift/openstack-resource-controller/tree/1ff3909142325a184993917fd9447c24cd6ce63f) * [OCPBUGS-104030](https://issues.redhat.com/browse/OCPBUGS-104030): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.3 to address CVE-2026-33814 [#44](https://github.com/openshift/openstack-resource-controller/pull/44) * UPSTREAM-SYNC: Bump envtest version [#47](https://github.com/openshift/openstack-resource-controller/pull/47) * [Full changelog](https://github.com/openshift/openstack-resource-controller/compare/70f5ad34915041c82ad0a8ed6ea64bd8859d1e72...1ff3909142325a184993917fd9447c24cd6ce63f) ### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/e0c18696b033d125090f0af6205ec5cd39eaf9de) * [OCPBUGS-104147](https://issues.redhat.com/browse/OCPBUGS-104147), [OCPBUGS-104152](https://issues.redhat.com/browse/OCPBUGS-104152): CVE-2026-33814: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.3 [#1363](https://github.com/openshift/operator-framework-olm/pull/1363) * [OCPBUGS-95444](https://issues.redhat.com/browse/OCPBUGS-95444), [OCPBUGS-95447](https://issues.redhat.com/browse/OCPBUGS-95447): bumping containerd to v1.7.33 [#1354](https://github.com/openshift/operator-framework-olm/pull/1354) * [Full changelog](https://github.com/openshift/operator-framework-olm/compare/149d553b2057320d761c4d1913098a66787dd09a...e0c18696b033d125090f0af6205ec5cd39eaf9de) ### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/ade3050b01d89ebdbfdfc132f5a3c24b04c27079) * NO-JIRA: REVERT-ME: Precreate CDN gateway topology before NAD/UDN sync [#3519](https://github.com/openshift/ovn-kubernetes/pull/3519) * [OCPBUGS-130569](https://issues.redhat.com/browse/OCPBUGS-130569): Add pperiyasamy to OWNERS for release-4.21 branch [#3528](https://github.com/openshift/ovn-kubernetes/pull/3528) * [OCPBUGS-128910](https://issues.redhat.com/browse/OCPBUGS-128910): NO-JIRA: Branch Sync release-5.0 to release-4.21 [10-01-2026] [#3504](https://github.com/openshift/ovn-kubernetes/pull/3504) * NO-JIRA: Branch Sync release-5.0 to release-4.21 [09-28-2026] [#3477](https://github.com/openshift/ovn-kubernetes/pull/3477) * [OCPBUGS-128245](https://issues.redhat.com/browse/OCPBUGS-128245): Branch Sync release-5.0 to release-4.21 [09-18-2026] [#3462](https://github.com/openshift/ovn-kubernetes/pull/3462) * [OCPBUGS-112513](https://issues.redhat.com/browse/OCPBUGS-112513): NO-JIRA: Branch Sync release-4.22 to release-4.21 [08-21-2026] [#3413](https://github.com/openshift/ovn-kubernetes/pull/3413) * [OCPBUGS-99165](https://issues.redhat.com/browse/OCPBUGS-99165): Branch Sync release-4.22 to release-4.21 [08-13-2026] [#3393](https://github.com/openshift/ovn-kubernetes/pull/3393) * [OCPBUGS-105516](https://issues.redhat.com/browse/OCPBUGS-105516), [OCPBUGS-105605](https://issues.redhat.com/browse/OCPBUGS-105605): Branch Sync release-4.22 to release-4.21 [08-10-2026] [#3374](https://github.com/openshift/ovn-kubernetes/pull/3374) * [OCPBUGS-90029](https://issues.redhat.com/browse/OCPBUGS-90029), [OCPBUGS-90470](https://issues.redhat.com/browse/OCPBUGS-90470), [OCPBUGS-92544](https://issues.redhat.com/browse/OCPBUGS-92544), [OCPBUGS-93018](https://issues.redhat.com/browse/OCPBUGS-93018): Branch Sync release-4.22 to release-4.21 [08-06-2026] [#3365](https://github.com/openshift/ovn-kubernetes/pull/3365) * [OCPBUGS-95075](https://issues.redhat.com/browse/OCPBUGS-95075): Branch Sync release-4.22 to release-4.21 [07-29-2026] [#3337](https://github.com/openshift/ovn-kubernetes/pull/3337) * [OCPBUGS-99276](https://issues.redhat.com/browse/OCPBUGS-99276), [OCPBUGS-99277](https://issues.redhat.com/browse/OCPBUGS-99277): Branch Sync release-4.22 to release-4.21 [07-20-2026] [#3306](https://github.com/openshift/ovn-kubernetes/pull/3306) * [OCPBUGS-99165](https://issues.redhat.com/browse/OCPBUGS-99165): Branch Sync release-4.22 to release-4.21 [07-15-2026] [#3300](https://github.com/openshift/ovn-kubernetes/pull/3300) * [OCPBUGS-98398](https://issues.redhat.com/browse/OCPBUGS-98398): Branch Sync release-4.22 to release-4.21 [06-10-2026] [#3243](https://github.com/openshift/ovn-kubernetes/pull/3243) * [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/d586f851c25d8f7cd04840cda79a0a6a98ea8485...ade3050b01d89ebdbfdfc132f5a3c24b04c27079) ### [powervs-block-csi-driver](https://github.com/openshift/ibm-powervs-block-csi-driver/tree/bd7dd70130c531cce7d9a50138fe4286e4208b69) * [OCPBUGS-104161](https://issues.redhat.com/browse/OCPBUGS-104161), [OCPBUGS-89654](https://issues.redhat.com/browse/OCPBUGS-89654), [OCPBUGS-90028](https://issues.redhat.com/browse/OCPBUGS-90028), [OCPBUGS-90454](https://issues.redhat.com/browse/OCPBUGS-90454), [OCPBUGS-91231](https://issues.redhat.com/browse/OCPBUGS-91231), [OCPBUGS-92545](https://issues.redhat.com/browse/OCPBUGS-92545), [OCPBUGS-93024](https://issues.redhat.com/browse/OCPBUGS-93024), [OCPBUGS-93510](https://issues.redhat.com/browse/OCPBUGS-93510), [OCPBUGS-95008](https://issues.redhat.com/browse/OCPBUGS-95008), [OCPBUGS-96558](https://issues.redhat.com/browse/OCPBUGS-96558): Bump golang.org dependencies [#144](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/144) * [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver/compare/114fe69249450f3bec773cba2956a8c06e7b0da9...bd7dd70130c531cce7d9a50138fe4286e4208b69) ### [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/tree/ac080eb0fe6c3849d2ff8cd8233a6d911f508043) * [OCPBUGS-104163](https://issues.redhat.com/browse/OCPBUGS-104163): Mitigate CVE-2026-33814 by bumping golang.org/x/net to v0.57.0 [#122](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/122) * [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/compare/b714ab87d079db5ef3c4097520db40cd289b025e...ac080eb0fe6c3849d2ff8cd8233a6d911f508043) ### [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs/tree/c393015c7fc110d393aa9f4a32450b3c55d207f8) * [OCPBUGS-101468](https://issues.redhat.com/browse/OCPBUGS-101468), [OCPBUGS-104164](https://issues.redhat.com/browse/OCPBUGS-104164), [OCPBUGS-91239](https://issues.redhat.com/browse/OCPBUGS-91239), [OCPBUGS-96559](https://issues.redhat.com/browse/OCPBUGS-96559): Bump x/net to address CVEs [#116](https://github.com/openshift/cloud-provider-powervs/pull/116) * [Full changelog](https://github.com/openshift/cloud-provider-powervs/compare/40d1c0adfedeca36498a5d93d69aee96831c756d...c393015c7fc110d393aa9f4a32450b3c55d207f8) ### [prom-label-proxy](https://github.com/openshift/prom-label-proxy/tree/b909768250b0d975fb19239281d4fed7ab246a3e) * NO-ISSUE: synchronize OWNERS from main branch [release-4.21] [#406](https://github.com/openshift/prom-label-proxy/pull/406) * [Full changelog](https://github.com/openshift/prom-label-proxy/compare/610c11b59dd17f1d6dc35b62ca1d0602b5c0f494...b909768250b0d975fb19239281d4fed7ab246a3e) ### [prometheus](https://github.com/openshift/prometheus/tree/9234216efb7d1fe93a837b4c3a23f349e2a0cfd9) * NO-ISSUE: synchronize OWNERS from main branch [#389](https://github.com/openshift/prometheus/pull/389) * [OCPBUGS-93729](https://issues.redhat.com/browse/OCPBUGS-93729): fix for CVE-2026-42151 [#357](https://github.com/openshift/prometheus/pull/357) * [OCPBUGS-88670](https://issues.redhat.com/browse/OCPBUGS-88670): remote: validate snappy decoded length before allocation in read endpoint [#331](https://github.com/openshift/prometheus/pull/331) * [OCPBUGS-93920](https://issues.redhat.com/browse/OCPBUGS-93920): fix(tsdb): temporarily ignore Direct IO enablement errors on unsupported filesystems [#340](https://github.com/openshift/prometheus/pull/340) * [Full changelog](https://github.com/openshift/prometheus/compare/77d32a196096e708170b45eecaa37865f620d4ce...9234216efb7d1fe93a837b4c3a23f349e2a0cfd9) ### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/86256406b5750999143f610430a80d1ce8381a6e) * NO-JIRA: synchronize OWNERS with main [#193](https://github.com/openshift/prometheus-alertmanager/pull/193) * [OCPBUGS-104155](https://issues.redhat.com/browse/OCPBUGS-104155): Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 [#169](https://github.com/openshift/prometheus-alertmanager/pull/169) * [OCPBUGS-98182](https://issues.redhat.com/browse/OCPBUGS-98182): build(deps): bump github.com/hashicorp/memberlist to a forked version which fixes CVE-2026-14362 [#158](https://github.com/openshift/prometheus-alertmanager/pull/158) * [OCPBUGS-100352](https://issues.redhat.com/browse/OCPBUGS-100352): Set testdata CA expiry to 20 years from issue date (#4112) [#145](https://github.com/openshift/prometheus-alertmanager/pull/145) * [OCPBUGS-99446](https://issues.redhat.com/browse/OCPBUGS-99446): embed tzdata in the alertmanager binary [#142](https://github.com/openshift/prometheus-alertmanager/pull/142) * [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/3dbe0b64ae3b9439b888be65a32431c7bf0d6806...86256406b5750999143f610430a80d1ce8381a6e) ### [prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator/tree/d392d80ac2194cf33969ec56aed5d624da8053e0) * [OCPBUGS-104160](https://issues.redhat.com/browse/OCPBUGS-104160), [OCPBUGS-104188](https://issues.redhat.com/browse/OCPBUGS-104188): [release-4.21] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#394](https://github.com/openshift/prometheus-operator/pull/394) * [Full changelog](https://github.com/openshift/prometheus-operator/compare/3de9763f36128ffa8b25a63c9447f6d64114c270...d392d80ac2194cf33969ec56aed5d624da8053e0) ### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/45ddb8d5124555a955a239ae02709ca06718e311) * [OCPBUGS-104190](https://issues.redhat.com/browse/OCPBUGS-104190): Use patched x/net fork v0.50.0-sec.4 [#197](https://github.com/openshift/node_exporter/pull/197) * NO-ISSUE: synchronize OWNERS from main branch [release-4.21] [#209](https://github.com/openshift/node_exporter/pull/209) * [Full changelog](https://github.com/openshift/node_exporter/compare/39d728735779afef886bc10a8bc7cf72f54d51a0...45ddb8d5124555a955a239ae02709ca06718e311) ### [rhel-coreos, rhel-coreos-extensions](https://github.com/openshift/os/tree/b3f3bce740fa6b32bf2c06dd8a6f31bdb831915e) * [OCPBUGS-105490](https://issues.redhat.com/browse/OCPBUGS-105490): NetworkManager-ovs has moved to RHCOS [#1957](https://github.com/openshift/os/pull/1957) * [Full changelog](https://github.com/openshift/os/compare/10f1a2e738aa55fff22dbe0346609e83a5f6eb90...b3f3bce740fa6b32bf2c06dd8a6f31bdb831915e) ### [route-controller-manager](https://github.com/openshift/route-controller-manager/tree/1a6da13c2e77f06d8a085184675d8fd13aac14ac) * [OCPBUGS-104024](https://issues.redhat.com/browse/OCPBUGS-104024): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#107](https://github.com/openshift/route-controller-manager/pull/107) * [Full changelog](https://github.com/openshift/route-controller-manager/compare/166a3e96f8151d9e789b3951ae75b03cdede5081...1a6da13c2e77f06d8a085184675d8fd13aac14ac) ### [tests](https://github.com/openshift/origin/tree/19d1c00b91e788ec7aba156a17868cee6e61b199) * [OCPBUGS-130853](https://issues.redhat.com/browse/OCPBUGS-130853): stage the creation of test pods to minimize etcd impact [#31745](https://github.com/openshift/origin/pull/31745) * [OCPBUGS-69943](https://issues.redhat.com/browse/OCPBUGS-69943): feat: render OTE JSON results in spyglass [#30633](https://github.com/openshift/origin/pull/30633) * [OCPBUGS-120726](https://issues.redhat.com/browse/OCPBUGS-120726): fix: skip MCPs with non-ready nodes during MCN property validation [#31524](https://github.com/openshift/origin/pull/31524) * [OCPBUGS-115200](https://issues.redhat.com/browse/OCPBUGS-115200): fix: adjusting DaemonSet test to dynamically compute expected pod count [#31523](https://github.com/openshift/origin/pull/31523) * [OCPBUGS-115282](https://issues.redhat.com/browse/OCPBUGS-115282): Raise status polling timeout and write bound [#31587](https://github.com/openshift/origin/pull/31587) * [OCPBUGS-114439](https://issues.redhat.com/browse/OCPBUGS-114439): Fix probe termination test to use pod status instead of kubelet event text [#31569](https://github.com/openshift/origin/pull/31569) * [OCPBUGS-100439](https://issues.redhat.com/browse/OCPBUGS-100439): retry GetVotingMemberNames on transient etcd client fails [#31507](https://github.com/openshift/origin/pull/31507) * [OCPBUGS-99671](https://issues.redhat.com/browse/OCPBUGS-99671): Backport node_e2e test migrations [#31426](https://github.com/openshift/origin/pull/31426) * [OCPBUGS-99300](https://issues.redhat.com/browse/OCPBUGS-99300): admit and extract non-payload 4.21 [#31386](https://github.com/openshift/origin/pull/31386) * [OCPBUGS-90523](https://issues.redhat.com/browse/OCPBUGS-90523): Use AdminPolicyBasedExternalRoute CR for external gateway test [#31316](https://github.com/openshift/origin/pull/31316) * [OCPBUGS-94114](https://issues.redhat.com/browse/OCPBUGS-94114): support Parents field on origin test suites [#31353](https://github.com/openshift/origin/pull/31353) * [OCPBUGS-88564](https://issues.redhat.com/browse/OCPBUGS-88564): fix CUDN status condition tests for NetworkAllocationSucceeded condition [#31300](https://github.com/openshift/origin/pull/31300) * [OCPBUGS-84252](https://issues.redhat.com/browse/OCPBUGS-84252): Move imagepolicy test to disruptive long-running suite [#31061](https://github.com/openshift/origin/pull/31061) * [OCPBUGS-78330](https://issues.redhat.com/browse/OCPBUGS-78330), [OCPBUGS-82146](https://issues.redhat.com/browse/OCPBUGS-82146), [OCPBUGS-85550](https://issues.redhat.com/browse/OCPBUGS-85550), [OCPBUGS-88295](https://issues.redhat.com/browse/OCPBUGS-88295), [OCPBUGS-88297](https://issues.redhat.com/browse/OCPBUGS-88297), [OCPBUGS-88320](https://issues.redhat.com/browse/OCPBUGS-88320), [OCPBUGS-88322](https://issues.redhat.com/browse/OCPBUGS-88322), [OCPBUGS-88324](https://issues.redhat.com/browse/OCPBUGS-88324): Backport noOLM Gateway API test coverage and upgrade tests [#31232](https://github.com/openshift/origin/pull/31232) * [OCPBUGS-88328](https://issues.redhat.com/browse/OCPBUGS-88328): Fix Pod.Create() to use --local flag for template proc… [#31269](https://github.com/openshift/origin/pull/31269) * [OCPBUGS-85149](https://issues.redhat.com/browse/OCPBUGS-85149): Enable Gateway API tests on vSphere and baremetal [#31139](https://github.com/openshift/origin/pull/31139) * [Full changelog](https://github.com/openshift/origin/compare/c2da98a5a8f0e23886ac536fbeb81140e798fb71...19d1c00b91e788ec7aba156a17868cee6e61b199) ### [volume-data-source-validator](https://github.com/openshift/volume-data-source-validator/tree/f276506ffe92efa62da6a615921f3577c8bc38af) * [OCPBUGS-104198](https://issues.redhat.com/browse/OCPBUGS-104198): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.3 [#21](https://github.com/openshift/volume-data-source-validator/pull/21) * [Full changelog](https://github.com/openshift/volume-data-source-validator/compare/8b9293323cf8fdce93824e37168573ca3f73de3a...f276506ffe92efa62da6a615921f3577c8bc38af) ### [vsphere-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-vsphere/tree/1ac19f4dfc00a4e60c2c38e8944b7a2cb27e6101) * [OCPBUGS-104210](https://issues.redhat.com/browse/OCPBUGS-104210): Bump golang.org/x/net to github.com/openshift-sustaining/net v0.50.0-sec.4 CVE-2026-33814 [release-4.21] [#127](https://github.com/openshift/cluster-api-provider-vsphere/pull/127) * [Full changelog](https://github.com/openshift/cluster-api-provider-vsphere/compare/3adfe2b56b259b2d27906d8772354f817e338da5...1ac19f4dfc00a4e60c2c38e8944b7a2cb27e6101) ### [vsphere-csi-driver, vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver/tree/d163d71ccf646b3c2b36f4f2fd6ef78f3c254ed5) * [OCPBUGS-96573](https://issues.redhat.com/browse/OCPBUGS-96573): Bump golang.org/x/net to v0.50.0-sec.4 [#196](https://github.com/openshift/vmware-vsphere-csi-driver/pull/196) * [OCPBUGS-93031](https://issues.redhat.com/browse/OCPBUGS-93031): Bump golang.org/x/crypto/ssh to v0.48.0-sec.1 [#190](https://github.com/openshift/vmware-vsphere-csi-driver/pull/190) * [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver/compare/69e1c6ed3201efc16bcd320cf558aa8fe869ec69...d163d71ccf646b3c2b36f4f2fd6ef78f3c254ed5) ### [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator/tree/c597eb81e44a80957f84c9f7f4947e3371f6df6d) * [OCPBUGS-104208](https://issues.redhat.com/browse/OCPBUGS-104208): Bump golang.org/x/net to v0.50.0-sec.3 [#353](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/353) * [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver-operator/compare/d6a19449cc5d49541221d48d62c67d7a48142d19...c597eb81e44a80957f84c9f7f4947e3371f6df6d) ### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/dd724c0469fe3b23029a9a3b95e6cdee9cd3c38e) * [OCPBUGS-127130](https://issues.redhat.com/browse/OCPBUGS-127130): Fixed GetVCenter to handle removed FDs better [#241](https://github.com/openshift/vsphere-problem-detector/pull/241) * [OCPBUGS-104206](https://issues.redhat.com/browse/OCPBUGS-104206): Bump golang.org/x/net to v0.50.0-sec.4 [#230](https://github.com/openshift/vsphere-problem-detector/pull/230) * [OCPBUGS-87097](https://issues.redhat.com/browse/OCPBUGS-87097): Fixed compute cluster permission logic for single fd with read-only custom resourcepool [#222](https://github.com/openshift/vsphere-problem-detector/pull/222) * [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/a35d685a88aca94ed1d805c1079ebf14dfb81c9d...dd724c0469fe3b23029a9a3b95e6cdee9cd3c38e)