# 4.21.40

Created: 2026-10-25 21:25:26 +0000 UTC

Image Digest: `sha256:81e06ac11f83bba175fa3cd1693521c37e67eb343b66c1137c232df6fc32e67d`


## Changes from 4.21.34

### Components

* Kubectl 1.34.1
* Kubernetes 1.34.9
* Kubernetes Tests 1.34.1
* Red Hat Enterprise Linux CoreOS 10.2.20260521-0



### FeatureGate Changes
| FeatureGate | Default<br/>Hypershift | Default<br/>SelfManagedHA | DevPreviewNoUpgrade<br/>Hypershift | DevPreviewNoUpgrade<br/>SelfManagedHA | TechPreviewNoUpgrade<br/>Hypershift | TechPreviewNoUpgrade<br/>SelfManagedHA  |
| :------ | :---: | :---: | :---: | :---: | :---: | :---:  |
| VSphereMultiVCenterDay2 <br/> (0 tests)|  |  | Enabled<br/>(New)| Enabled<br/>(New)| Enabled<br/>(New)| Enabled<br/>(New) |


### Rebuilt images without code change

* [agent-installer-api-server](https://github.com/openshift/assisted-service) git [bddba729](https://github.com/openshift/assisted-service/commit/bddba7290d9b08f7c0ce350e8082364819579525) `sha256:3d347b60b90c3b0e450874a505873c498cda40a277d5b6600e8175ac8923a816`
* [agent-installer-csr-approver](https://github.com/openshift/assisted-installer) git [c4e448f8](https://github.com/openshift/assisted-installer/commit/c4e448f8e3c3f91d2dac98d846eb3fe400f15232) `sha256:b16d1779c729899de0d8ed50518f75c7b8dd3cfd464562acaafe7007420522f4`
* [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent) git [5bf169cc](https://github.com/openshift/assisted-installer-agent/commit/5bf169cca60bec1ddc1bc5cf6b79b74bcfc16b2e) `sha256:268d3b3b722ff869fe89133d03bebde380430ded4c089be6917aa27ede47f2ae`
* [agent-installer-orchestrator](https://github.com/openshift/assisted-installer) git [c4e448f8](https://github.com/openshift/assisted-installer/commit/c4e448f8e3c3f91d2dac98d846eb3fe400f15232) `sha256:37671ddddc59b00158b0d2269e6c9ca69492381b00bedb36260ffa146f1cb42f`
* [agent-installer-utils](https://github.com/openshift/agent-installer-utils) git [cc8ca89b](https://github.com/openshift/agent-installer-utils/commit/cc8ca89bc5a0ce79227e8ab0860693950608ca04) `sha256:f27adf7515f9dd83134d3c6d645d1f5b365a6e396fbefe8f63e4ecde7c5fc3fc`
* [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy) git [35ba137a](https://github.com/openshift/apiserver-network-proxy/commit/35ba137ab96d01f0b8df729ff5ad93ac2fdad800) `sha256:9c849fb27b37cbbea6ad371a4acefd288c52b61e4c611919f402f95b4e93435e`
* [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws) git [fdc7f3f1](https://github.com/openshift/cloud-provider-aws/commit/fdc7f3f15c693593cb573b6bef6f0363256b6f52) `sha256:3ff256d7c66c5e08c9ea0fe34b674edf789c0688e929e801a92d84c60a9a5ba1`
* [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver) git [1d8cec7d](https://github.com/openshift/aws-ebs-csi-driver/commit/1d8cec7d0eeedf1497c3ee6c32ee3391ebb13709) `sha256:d94ed20a12b15a8294aa4df3e0baef422fd863cd830cd8f766c44152752f37ee`
* [aws-ebs-csi-driver-operator](https://github.com/openshift/csi-operator) git [a52a578c](https://github.com/openshift/csi-operator/commit/a52a578c6aea1ac5da131f60b8e359969151d7e1) `sha256:2e75f117241e0349e43321d0ef05834eca39abc4b8d0518e6ef5cd870072b74d`
* [aws-karpenter-provider-aws](https://github.com/openshift/aws-karpenter-provider-aws) git [f4af9b89](https://github.com/openshift/aws-karpenter-provider-aws/commit/f4af9b89aed3a47b2168d7bd5a7dd8b6453f1945) `sha256:c70052c207756d65f781c03a66f0fb4365d8bacc551b1d6e6f20af433597e7b4`
* [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider) git [887615ff](https://github.com/openshift/aws-encryption-provider/commit/887615ffa8a595ee3693e92fa56db4dd30f20f73) `sha256:c81103a7f874eb50e4945905d29eaddc4bb2d47e5c4ae0c0d558ec8465fd49cc`
* [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook) git [5cd42ed1](https://github.com/openshift/aws-pod-identity-webhook/commit/5cd42ed1e5151f45f0134593e9cfebdb6517b385) `sha256:1d6e999b6390013487841c919073c4c95f64a11564cbfc3166079d033049895d`
* [azure-disk-csi-driver-operator](https://github.com/openshift/csi-operator) git [a52a578c](https://github.com/openshift/csi-operator/commit/a52a578c6aea1ac5da131f60b8e359969151d7e1) `sha256:940d3c4cb6fbd652d4975c91b5b5aac6032516dfe1e7c3c30a073dac320138b8`
* [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver) git [c0415d38](https://github.com/openshift/azure-file-csi-driver/commit/c0415d38bb792e507e0d2346b44d057ab7b2e024) `sha256:d81278865b7b4c3a406be02bbd398582f1bc065f62b7ae41ccedbe3d9c0c4199`
* [azure-file-csi-driver-operator](https://github.com/openshift/csi-operator) git [a52a578c](https://github.com/openshift/csi-operator/commit/a52a578c6aea1ac5da131f60b8e359969151d7e1) `sha256:7ad8320361a7b13f080c6f7e4a1f485f0d0733a9fdba2c18115323f499cdc040`
* [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms) git [97a682d9](https://github.com/openshift/azure-kubernetes-kms/commit/97a682d9baff04f7c873ae378dee4afb6b697252) `sha256:9d0f70e4b90d80302692bd5976c078cabcf431f3b942a77ecc1f822873fb66a2`
* [azure-service-operator](https://github.com/openshift/azure-service-operator) git [5e84c831](https://github.com/openshift/azure-service-operator/commit/5e84c83176d7630f70802b35cb10cdf2b60fd6d3) `sha256:0a608f37ee537925b3c9d57c12a4b9c995255492ae159541dcf9067634f840fb`
* [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3) git [659138fe](https://github.com/openshift/cluster-api-provider-metal3/commit/659138fef3abd4c71b0b01fa1279146745699a5a) `sha256:8c1d0cb2f5c115703ac9ec79c38acdcee2f50d0d1f383fe5ba1ca5110adca550`
* [baremetal-operator](https://github.com/openshift/baremetal-operator) git [d5c58b32](https://github.com/openshift/baremetal-operator/commit/d5c58b32e71e0e979e190b40a3804d012509d93b) `sha256:a09ef6be9c3adcaf5fad61be1c6a5b5d85aba8f8ddbf883e97c0fb2b5858a6b4`
* [cli](https://github.com/openshift/oc) git [d0bf7cc5](https://github.com/openshift/oc/commit/d0bf7cc5959bf8408912e5276f2ea9e269ede24d) `sha256:a1da71c6fa9b431c6e1b2d2049d81aaa5cf1eb29c3a79d4b08cb053d9347780d`
* [cli-artifacts](https://github.com/openshift/oc) git [d0bf7cc5](https://github.com/openshift/oc/commit/d0bf7cc5959bf8408912e5276f2ea9e269ede24d) `sha256:a5fa4b2e9ef1ac7d812a85dbf8f2d0f5eddd6863dd0d2c9abed9866a28981dcd`
* [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator) git [b2423439](https://github.com/openshift/cluster-autoscaler-operator/commit/b2423439fe1004bae5e84500cf449d033c1f0378) `sha256:a2337484ce324cb26d508b6923edab90481cdcb1c231162e5615a4dcaf443956`
* [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator) git [13af370f](https://github.com/openshift/cluster-baremetal-operator/commit/13af370f526ab7541a8a73aa0d94952496ccca58) `sha256:c4c716b7b4a0aaa818a9af4c3661b4d14ea48a2dc2433e766413b8c6931796e0`
* [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap) git [dc0d4a5c](https://github.com/openshift/cluster-bootstrap/commit/dc0d4a5cdaf8a7477cab584208dc99352f46efe2) `sha256:36d955c5fcb83f2633bcffd1f6a352d45006ddd5ff1848dc5a95bd674bf44229`
* [cluster-capi-controllers](https://github.com/openshift/cluster-api) git [9dd5eba0](https://github.com/openshift/cluster-api/commit/9dd5eba07922bb84bf1ec2b16cbbedd6ad195874) `sha256:bc5de711a7f9e0e1ee5de35cd1d7a2925f46a207502f4f810a12a740ea4af8ce`
* [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator) git [87a6893e](https://github.com/openshift/cluster-capi-operator/commit/87a6893e678af405043625bc3a209b30836f299f) `sha256:ba5549de8a3a9e32d766a4540db0b833a437e76531d16f9007b6f1e70bbac23a`
* [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator) git [c4fdb41e](https://github.com/openshift/cluster-control-plane-machine-set-operator/commit/c4fdb41e357280bfa7e8ebbc934007a657168310) `sha256:23c2eef22c223633979dd7cfd4c56d919807cf010e2e22deef10029d37f76efc`
* [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator) git [eb43a7a8](https://github.com/openshift/cluster-csi-snapshot-controller-operator/commit/eb43a7a80d1b314eb8bbe63b6b73de91ba8cc7aa) `sha256:697fd429842843aa3660533371b5b41a1ea053aa3d303e8b773d98919cce0835`
* [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator) git [044fc0bc](https://github.com/openshift/cluster-image-registry-operator/commit/044fc0bce30bed270732f61213e2895d667ebf87) `sha256:a271f651644a303cfba11abcc279917f31c871b7617cd42dac16b94033df5400`
* [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator) git [8a42beeb](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/commit/8a42beebd580bd2e241aa6d93860c09e907f2407) `sha256:67ddee2077da364d17499940d53164257a009254cedaa602b47dd423d5b6bcba`
* [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver) git [d864813c](https://github.com/openshift/cluster-machine-approver/commit/d864813cd3ab01c0f975b2bf41e9046948f0afa1) `sha256:774e7df02a75effb10666641aea4b160028983fa8aa9ae31da95dff059dfaa80`
* [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator) git [6075cffc](https://github.com/openshift/cluster-node-tuning-operator/commit/6075cffc70be79fa499558474f135ea244c93fc0) `sha256:c25af177b7dc2221576bbaa6810914a402e1e4ab9bce9eea5537f9dff2ea29b1`
* [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator) git [810221c4](https://github.com/openshift/cluster-openshift-apiserver-operator/commit/810221c4d6f91efae7277224e3022ec5c4778e14) `sha256:8983e1fed5a3e7ed8a15bc86bcc5e69bd72af229dec21040707655859e860a3d`
* [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator) git [2617a201](https://github.com/openshift/cluster-openshift-controller-manager-operator/commit/2617a201bb3607192a9f82faa18384676f611e3c) `sha256:fd6ca26b758466548555c3a5c16a2e51fe28cc565f067ef8940fb688449944c8`
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [b3cae8f2](https://github.com/openshift/cluster-update-keys/commit/b3cae8f22b51d9062d0ceb6ac9cf2f7651b4ce8f) `sha256:58045b6c0fcd1627ed8e99efd769e0da0854ba35f43e06eafaa4eb65cf63ed43`
* [configmap-reloader](https://github.com/openshift/configmap-reload) git [16114b8d](https://github.com/openshift/configmap-reload/commit/16114b8de20278b8f4b7a425ece6d35d53214773) `sha256:66e42e90fde9292a7339fb983aa91603656806622aafc9376d93b9eaa8698b33`
* [container-networking-plugins](https://github.com/openshift/containernetworking-plugins) git [747ad66c](https://github.com/openshift/containernetworking-plugins/commit/747ad66caa1109b2b490aebad01af42bd2d738f1) `sha256:75a88f360ecdb10727d81a45673095855d601af2acf5a1e0dc1f97dbf55be42c`
* [containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins) git [747ad66c](https://github.com/openshift/containernetworking-plugins/commit/747ad66caa1109b2b490aebad01af42bd2d738f1) `sha256:5c912bae1762065fa0da8104ccc240d1818027120f9460ec9c682778c0065b42`
* [csi-driver-manila-operator](https://github.com/openshift/csi-operator) git [a52a578c](https://github.com/openshift/csi-operator/commit/a52a578c6aea1ac5da131f60b8e359969151d7e1) `sha256:2dbf094c6bb8a3eaeb8ae98e1f1f32872268a879c568f1e5854110e2149a4240`
* [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs) git [b5e4888c](https://github.com/openshift/csi-driver-nfs/commit/b5e4888ca8e420ba9245805a1a8c976074a8b793) `sha256:585070fa63fdbe151f9302d426f8d99bc3573c98fe4b011a77f9eb84777c9633`
* [csi-external-resizer](https://github.com/openshift/csi-external-resizer) git [d5c2c2b4](https://github.com/openshift/csi-external-resizer/commit/d5c2c2b47fbd76677d6060956f309bc675957c31) `sha256:37204250ddceccab7a9cca1ded3c49313b443b49022684c6ab7ddee5fe9f50e5`
* [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar) git [d29f3f7a](https://github.com/openshift/csi-node-driver-registrar/commit/d29f3f7a4aed4465e7e40e323bd3c0e0d9871e4c) `sha256:a6e8433f6ce423bda5db8e540bfdf405eeed6fc5eade3ab2b438ac6da343c455`
* [deployer](https://github.com/openshift/oc) git [d0bf7cc5](https://github.com/openshift/oc/commit/d0bf7cc5959bf8408912e5276f2ea9e269ede24d) `sha256:4fa582ad52ae85a60e07e83e4cc27756c3fcdd852d6f66bbd6d9d178ea62778d`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [f0ae9d12](https://github.com/openshift/driver-toolkit/commit/f0ae9d12ca7e3adf594ae34e394b1ea003daa4ad) `sha256:e881923fbe6a73b039835c3f9bd41a472ef97631a997efc89ed9a3bdaeb1aede`
* [egress-router-cni](https://github.com/openshift/egress-router-cni) git [0ec77dd1](https://github.com/openshift/egress-router-cni/commit/0ec77dd178e3b0433f01fce5bcce96abcc126deb) `sha256:84f908319ef61eec801323135069a8454c984130e3f3eec366bf6d2c079bd796`
* [etcd](https://github.com/openshift/etcd) git [b6dda541](https://github.com/openshift/etcd/commit/b6dda5413ec33fc88fc9751d98d3b4bd96ea877d) `sha256:02115f30d516f981b278e00721163dfc5c4a51c951fd03bc636268c892e7338c`
* [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp) git [fe230b8a](https://github.com/openshift/cluster-api-provider-gcp/commit/fe230b8a6407a06e1be9d6994a92ac8c5a43237d) `sha256:7a5b0c6e55258b809a649032718eb741492ee60b5fa5ff3dcfccba7b59a4650a`
* [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp) git [53820aad](https://github.com/openshift/machine-api-provider-gcp/commit/53820aadd2cc313cb0ce54788bb1fceec5b95eed) `sha256:2dca13c09858403f89ea857b9d90e80ea094c403674bbb89abde43313af957cf`
* [haproxy-router](https://github.com/openshift/router) git [22531cf0](https://github.com/openshift/router/commit/22531cf0bb2435e73437be73c244913de4844812) `sha256:9c06c5deacb898167065a97ff657ff9e062bedea509c88fb4ed0d59382882312`
* [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver) git [f0baa47e](https://github.com/openshift/ibm-vpc-block-csi-driver/commit/f0baa47e75ab0bef0ec56ab48d9a725e00f6b40f) `sha256:7cba6c5215e5a1e26290af5a2fd88e69bc853f1b805a1efc5e3f619d5de0bed3`
* [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud) git [d2dc1470](https://github.com/openshift/cluster-api-provider-ibmcloud/commit/d2dc1470a6b71312fcfefdf4d334288302b6cfec) `sha256:3d2b45ae47ac974acaf98facc7cbb6bf2d10c583803e0e9326aa6e09b92c00b5`
* [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud) git [22e131a0](https://github.com/openshift/machine-api-provider-ibmcloud/commit/22e131a00d874c240531c40141a8a780fbb48bd5) `sha256:5a3910b44b200ae2911c4b01bf478522bf73113ef66ee65be4675636a3812156`
* [ironic-agent](https://github.com/openshift/ironic-agent-image) git [156ef6b4](https://github.com/openshift/ironic-agent-image/commit/156ef6b4730f01279216d3296349ca0cae29466c) `sha256:1aef51a8ecd54a057de0863da205bd00163f2fb03a1d57b03768a0f6789141f6`
* [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [707c2262](https://github.com/openshift/ironic-rhcos-downloader/commit/707c226243ac401f2994952fe0e55823511111b0) `sha256:7a27974152e6cdcf0d46ecc63757b29cdbe69f8c80af32f0fd94dd56deb6f7d8`
* [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager) git [b95b05fe](https://github.com/openshift/ironic-static-ip-manager/commit/b95b05fe0ba17255ef61e92d4167ca4c9de789b8) `sha256:0f25a3ed357d8f065aaf7364d63fd36fba8b4615f959b85596b9e703a9100759`
* [keepalived-ipfailover](https://github.com/openshift/images) git [f0241a3d](https://github.com/openshift/images/commit/f0241a3d2a12a8b2965cc36542babce8a1dffcf8) `sha256:b8ee49298b24dc305649fc066f7506740a6a3c78f3edf7fa39dd9a7f6004a37f`
* [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator) git [ce5ff17e](https://github.com/openshift/kubernetes-kube-storage-version-migrator/commit/ce5ff17e9a81ce754567e6dd5053d13409c251e9) `sha256:9982bf6dd27781bad4840a60196a6d7b5574eec49bb0bc18e2e2ca2d1d3150a7`
* [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver) git [8a115121](https://github.com/openshift/kubevirt-csi-driver/commit/8a115121952348de9a4e4a73478755258a401a86) `sha256:542cb0671614c69377d8eeb62e7763656315c021ac1fa2e46beaac7b5b718efd`
* [machine-os-images](https://github.com/openshift/machine-os-images) git [581c9d9e](https://github.com/openshift/machine-os-images/commit/581c9d9e453c73f67a93c44fb6715057c0cc8bf5) `sha256:addf0396b1724a34d4ff44b502fb7c2528ae50effb143bcb56648bc6e4f9ed43`
* [metallb-frr](https://github.com/openshift/frr) git [c82bfaad](https://github.com/openshift/frr/commit/c82bfaad01b196e12f00622a9a609d87e0a56701) `sha256:b71a467e95c9cb07864d3ee8263071d7b72843e28865b4ffccfc355f45770b23`
* [multus-route-override-cni](https://github.com/openshift/route-override-cni) git [08af4127](https://github.com/openshift/route-override-cni/commit/08af4127c77976510cad1c096d9aca977d8ae5af) `sha256:51cd78d2d68f1095988f686f6ea2a7579f152b608dc17df03770fa6d3f0b7ad9`
* [must-gather](https://github.com/openshift/must-gather) git [eeb267f4](https://github.com/openshift/must-gather/commit/eeb267f4b7f8016f13d12866013cad43c7403482) `sha256:4ee75660e64799af8391dfc4d925837e89346b28f35aaaed488219791dc35f53`
* [network-interface-bond-cni](https://github.com/openshift/bond-cni) git [297eeb43](https://github.com/openshift/bond-cni/commit/297eeb4320e07b18d559bc373b665479c760e8c7) `sha256:c56d9ae1d3f72f3c097dd9280fff17059b8b8467d279af4873b2ac901882c59d`
* [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon) git [9af0359d](https://github.com/openshift/network-metrics-daemon/commit/9af0359dc73e8489059057a625d53c5293923993) `sha256:08734d9a0ff94e8b80f657682b532040ac9b4c761131dfa4f5c2ed487e01bf00`
* [network-tools](https://github.com/openshift/network-tools) git [d6717e45](https://github.com/openshift/network-tools/commit/d6717e453a098d551c9e2d2868e1f5317c41e688) `sha256:81361f85ca1ac2a9b02eb2ccc4ffc3ea53f9753629478f4b3b9a9486f3c7ef53`
* [nutanix-machine-controllers](https://github.com/openshift/machine-api-provider-nutanix) git [b15a665c](https://github.com/openshift/machine-api-provider-nutanix/commit/b15a665cd9c12c5a7d2ac81b5330b6f446c3a8be) `sha256:32de64768a3cc692c93d19b4e57858e2f9a5c6c04125fbd06db5f2798e96ae9a`
* [openshift-apiserver](https://github.com/openshift/openshift-apiserver) git [f427de80](https://github.com/openshift/openshift-apiserver/commit/f427de801b98823e486bdd5955468d88e95c2ac4) `sha256:0deedd5dc22417d6d1ba0e0808d4b7239ea44635bdfa2ccd99ebeeae3687fabf`
* [openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator) git [a52a578c](https://github.com/openshift/csi-operator/commit/a52a578c6aea1ac5da131f60b8e359969151d7e1) `sha256:ff862c666b983c38a2772d125f6926729c9fb6767aaf1b56b1b68658152593b5`
* [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack) git [d02231d0](https://github.com/openshift/cluster-api-provider-openstack/commit/d02231d0a92491926666f4f1f5e45a7e2c733cb7) `sha256:bfdd93511c962acc00c13bf94ef285f7ba0a176c64998f3cc19e8020572b3e06`
* [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack) git [b7456a2a](https://github.com/openshift/machine-api-provider-openstack/commit/b7456a2a12d1e65a5688693a005ad1e18aaee1be) `sha256:c1b1bdfe0a7926312b565547f43cd844e01168fa353020c29f236bb9d38306e9`
* [operator-framework-tools](https://github.com/openshift/operator-framework-olm) git [e0c18696](https://github.com/openshift/operator-framework-olm/commit/e0c18696b033d125090f0af6205ec5cd39eaf9de) `sha256:3ddc60ec35b1b01d631685881df0eee0664940dcbdcd094868e8f7f5f595895b`
* [operator-lifecycle-manager](https://github.com/openshift/operator-framework-olm) git [e0c18696](https://github.com/openshift/operator-framework-olm/commit/e0c18696b033d125090f0af6205ec5cd39eaf9de) `sha256:670e4a41b902302cb8a9cd03b16002932f32d37164cb975f786f03ca4ac236ad`
* [operator-marketplace](https://github.com/operator-framework/operator-marketplace) git [efb1a1ea](https://github.com/operator-framework/operator-marketplace/commit/efb1a1ea40bc1ed3a439812cfdaa3013b80e96ce) `sha256:2fbdfdaad1f21f39ed4b88d992ff2915f9b5534fc44f1cd5ea6759316b7e39b8`
* [operator-registry](https://github.com/openshift/operator-framework-olm) git [e0c18696](https://github.com/openshift/operator-framework-olm/commit/e0c18696b033d125090f0af6205ec5cd39eaf9de) `sha256:5c0a2208e5f55a679cdd2205cb6b013967a22d24a7cb17e3eb6abd3e2f56ae10`
* [powervs-block-csi-driver](https://github.com/openshift/ibm-powervs-block-csi-driver) git [bd7dd701](https://github.com/openshift/ibm-powervs-block-csi-driver/commit/bd7dd70130c531cce7d9a50138fe4286e4208b69) `sha256:785dfddce0c8ed215dfb6c4c27279879c35f62f85d8c046b22d4a5c636a4ff77`
* [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator) git [ac080eb0](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/commit/ac080eb0fe6c3849d2ff8cd8233a6d911f508043) `sha256:60e5bad34f23f0c5d013a66c5c3f2c56ec1afafe731563ae904129b4f7cb68f2`
* [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs) git [551974ef](https://github.com/openshift/machine-api-provider-powervs/commit/551974ef93dedb1b9677a778e1533391448e0c56) `sha256:6d5a4efccf7828978dccb12bc60ac19eeec97f9c3daf835215c2cf32ce81acc0`
* [rhel-coreos](https://github.com/openshift/os) git [b3f3bce7](https://github.com/openshift/os/commit/b3f3bce740fa6b32bf2c06dd8a6f31bdb831915e) `sha256:217e69425bb693a10216765a9b6b3b7a85c216b54bcb81224d03b03df4f95d32`
* [rhel-coreos-extensions](https://github.com/openshift/os) git [b3f3bce7](https://github.com/openshift/os/commit/b3f3bce740fa6b32bf2c06dd8a6f31bdb831915e) `sha256:fb7b07c9a32a3807547f4cf48cdd9901b45ae8e03ca47a5229f43d21fd59d24c`
* [service-ca-operator](https://github.com/openshift/service-ca-operator) git [e9622ba1](https://github.com/openshift/service-ca-operator/commit/e9622ba18c86bf24aceab0c19fdcb87339c14f44) `sha256:4fde5350f7508d158d0f8a38b3d13f0f7d70ea726886013aa48a2635324cf4b4`
* [telemeter](https://github.com/openshift/telemeter) git [b79b872a](https://github.com/openshift/telemeter/commit/b79b872a65edd845891db70f6c9a184458a178da) `sha256:a9c99f3c62b8e7b68349736a13cb0ca07197d5501c8d80a9ba7a69d599b849e3`
* [tools](https://github.com/openshift/oc) git [d0bf7cc5](https://github.com/openshift/oc/commit/d0bf7cc5959bf8408912e5276f2ea9e269ede24d) `sha256:0ddc3dc9547c28cc3c60d15a0a306b58f00d72f5fe6544183a2f92476cb04e32`
* [vsphere-csi-driver](https://github.com/openshift/vmware-vsphere-csi-driver) git [d163d71c](https://github.com/openshift/vmware-vsphere-csi-driver/commit/d163d71ccf646b3c2b36f4f2fd6ef78f3c254ed5) `sha256:355430f1c97aebb833917115e509a9dc017d3471f9731408f17986cec34b773d`
* [vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver) git [d163d71c](https://github.com/openshift/vmware-vsphere-csi-driver/commit/d163d71ccf646b3c2b36f4f2fd6ef78f3c254ed5) `sha256:2136807ddaf35ae760c26ba017818b7ed4b3fb068fe60ad883c68f7048f0ad2a`


### [agent-installer-ui](https://github.com/openshift-assisted/assisted-installer-ui/tree/e9c2917ad243c175e5376acd85ec148c71cdada3)

* [OCPBUGS-113553](https://issues.redhat.com/browse/OCPBUGS-113553): Bump nanoid to &gt;=3.3.17 in 4.21 (#4065) [#4065](https://github.com/openshift-assisted/assisted-installer-ui/pull/4065)
* [OCPBUGS-119963](https://issues.redhat.com/browse/OCPBUGS-119963): Bump qs to &gt;=6.16.0 in release-4.21 (#4044) [#4044](https://github.com/openshift-assisted/assisted-installer-ui/pull/4044)
* [Full changelog](https://github.com/openshift-assisted/assisted-installer-ui/compare/ac7876cd44df4a73ea0b7e467557f1ef2d4204a6...e9c2917ad243c175e5376acd85ec148c71cdada3)


### [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws/tree/e48a2773a2c884dd4b3a589ee7bf107923414356)

* [OCPBUGS-104023](https://issues.redhat.com/browse/OCPBUGS-104023): replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 for CVE-2026-33814 [#649](https://github.com/openshift/cluster-api-provider-aws/pull/649)
* 🐛 [release-4.21] OCPBUGS-81976: Bump go-jose/go-jose/v4@v4.1.4 [#609](https://github.com/openshift/cluster-api-provider-aws/pull/609)
* [Full changelog](https://github.com/openshift/cluster-api-provider-aws/compare/68d3742af62df1fb40187c79d1c22015c8e92c7d...e48a2773a2c884dd4b3a589ee7bf107923414356)


### [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws/tree/e5f0dc03f4dd4db98f635705b8b4fee4ad6c482b)

* [OCPBUGS-104122](https://issues.redhat.com/browse/OCPBUGS-104122): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#206](https://github.com/openshift/machine-api-provider-aws/pull/206)
* [OCPBUGS-127563](https://issues.redhat.com/browse/OCPBUGS-127563): Add opt-in pprof endpoint to machine-controller-manager [#221](https://github.com/openshift/machine-api-provider-aws/pull/221)
* [OCPBUGS-127563](https://issues.redhat.com/browse/OCPBUGS-127563): Cache region validation response and close AWS sessions [#220](https://github.com/openshift/machine-api-provider-aws/pull/220)
* [Full changelog](https://github.com/openshift/machine-api-provider-aws/compare/938565c9f796fba385c0978a5ae1cc0a79f0f857...e5f0dc03f4dd4db98f635705b8b4fee4ad6c482b)


### [azure-cloud-controller-manager, azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure/tree/53d73b17f0209026eef63d68e39faf195472adf5)

* [OCPBUGS-104016](https://issues.redhat.com/browse/OCPBUGS-104016), [OCPBUGS-104207](https://issues.redhat.com/browse/OCPBUGS-104207): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.3 to address CVE-2026-33814 [#205](https://github.com/openshift/cloud-provider-azure/pull/205)
* [Full changelog](https://github.com/openshift/cloud-provider-azure/compare/c9afac2fda20f18d786271340826c628f5419150...53d73b17f0209026eef63d68e39faf195472adf5)


### [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure/tree/49b9fc9a139c1c7cdcc42ea14b6fcb7f7ffe5610)

* [OCPBUGS-104017](https://issues.redhat.com/browse/OCPBUGS-104017): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.3 to address CVE-2026-33814 [#402](https://github.com/openshift/cluster-api-provider-azure/pull/402)
* [Full changelog](https://github.com/openshift/cluster-api-provider-azure/compare/3ae65a465e6da7d92ecec285fe8543acd8bb3dd4...49b9fc9a139c1c7cdcc42ea14b6fcb7f7ffe5610)


### [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver/tree/051392d1e0d3b9b5cfad9c6210c0c8ddad7391b4)

* [OCPBUGS-89972](https://issues.redhat.com/browse/OCPBUGS-89972): golang.org/x/crypto bump to v0.52.0 [#160](https://github.com/openshift/azure-disk-csi-driver/pull/160)
* [Full changelog](https://github.com/openshift/azure-disk-csi-driver/compare/8318a54892a51c76e3233e2fd60fb5d499afb6dc...051392d1e0d3b9b5cfad9c6210c0c8ddad7391b4)


### [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure/tree/65ba1a8d7133b2947eec2fe16e43de0134921e03)

* [OCPBUGS-104120](https://issues.redhat.com/browse/OCPBUGS-104120): replace golang.org/x/net with openshift-sustaining/net@v0.50.0-sec.4 [#210](https://github.com/openshift/machine-api-provider-azure/pull/210)
* [Full changelog](https://github.com/openshift/machine-api-provider-azure/compare/782f0ab6a2636aef0f699cfe7a49e8fadefb9807...65ba1a8d7133b2947eec2fe16e43de0134921e03)


### [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity/tree/da99e431dcd230ab0c6cb1ed2f86f564ee72dcac)

* [OCPBUGS-104050](https://issues.redhat.com/browse/OCPBUGS-104050): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#60](https://github.com/openshift/azure-workload-identity/pull/60)
* [Full changelog](https://github.com/openshift/azure-workload-identity/compare/ae8ffaf0b4a893e9b38fb4007de3cef8492b71f3...da99e431dcd230ab0c6cb1ed2f86f564ee72dcac)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/080653d812dc25b2c624ff2a5b4108046276b0b2)

* [SPLAT-2866](https://issues.redhat.com/browse/SPLAT-2866): Add vSphere multi vCenter Day 2 support [#10874](https://github.com/openshift/installer/pull/10874)
* [OCPBUGS-90031](https://issues.redhat.com/browse/OCPBUGS-90031), [OCPBUGS-92990](https://issues.redhat.com/browse/OCPBUGS-92990): Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto v0.48.0-sec.2 [#10820](https://github.com/openshift/installer/pull/10820)
* [Full changelog](https://github.com/openshift/installer/compare/1d6640d424ff59840b59a731fe99bfd9bb742bb5...080653d812dc25b2c624ff2a5b4108046276b0b2)


### [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal/tree/e90abcf920ca920bbb262a04c4bd9024c6e27a3e)

* [OCPBUGS-104034](https://issues.redhat.com/browse/OCPBUGS-104034): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#265](https://github.com/openshift/cluster-api-provider-baremetal/pull/265)
* [Full changelog](https://github.com/openshift/cluster-api-provider-baremetal/compare/4e6a729c5ac8fde8859db5830def262dfdee28ea...e90abcf920ca920bbb262a04c4bd9024c6e27a3e)


### [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg/tree/4a7c9e850d07dd08c9b4eb24ebf67398a6e083d4)

* [OCPBUGS-104053](https://issues.redhat.com/browse/OCPBUGS-104053): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#405](https://github.com/openshift/baremetal-runtimecfg/pull/405)
* [Full changelog](https://github.com/openshift/baremetal-runtimecfg/compare/d7e3fc12bd9dc911f0fac4c9a46b814c7be62b14...4a7c9e850d07dd08c9b4eb24ebf67398a6e083d4)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/3f41e6e1e0540fd5c6d969212a233b120fddc524)

* [OCPBUGS-104052](https://issues.redhat.com/browse/OCPBUGS-104052): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#1097](https://github.com/openshift/cloud-credential-operator/pull/1097)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/bd0a5785a37eeccedb3ba357eb4254860acd6ef4...3f41e6e1e0540fd5c6d969212a233b120fddc524)


### [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller/tree/f142df69804d19552c3968956a036e8fda55f643)

* [OCPBUGS-104000](https://issues.redhat.com/browse/OCPBUGS-104000): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#268](https://github.com/openshift/cloud-network-config-controller/pull/268)
* [Full changelog](https://github.com/openshift/cloud-network-config-controller/compare/57db2d05e057dc90bae3dc1b0e806b3259d38fc0...f142df69804d19552c3968956a036e8fda55f643)


### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/419ef9d44ad0e63927900add4a90fcb9a9fce3d0)

* [OCPBUGS-104035](https://issues.redhat.com/browse/OCPBUGS-104035): Bump golang.org/x/net from v0.43.0 to v0.50.0-sec.4 [#980](https://github.com/openshift/cluster-authentication-operator/pull/980)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/65eb4b2193d0860c1c1f45b08ea7203694db909f...419ef9d44ad0e63927900add4a90fcb9a9fce3d0)


### [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler/tree/27b401cd08dc567360928f0743326d41951b21dc)

* [OCPBUGS-104191](https://issues.redhat.com/browse/OCPBUGS-104191): Replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 for CVE-2026-33814 [#439](https://github.com/openshift/kubernetes-autoscaler/pull/439)
* [Full changelog](https://github.com/openshift/kubernetes-autoscaler/compare/a921db0077641ab179c3048c9b5d21f54bb36e55...27b401cd08dc567360928f0743326d41951b21dc)


### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/b8d48a22367c2ed142b59782ba804a019679e699)

* [SPLAT-2866](https://issues.redhat.com/browse/SPLAT-2866): Added support to manage kube-cloud-config for vSphere in openshift-config-managed [#520](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/520)
* [OCPBUGS-104043](https://issues.redhat.com/browse/OCPBUGS-104043): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#510](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/510)
* [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/c050cf15d939b1456e99caa71a46fb797d7b56c1...b8d48a22367c2ed142b59782ba804a019679e699)


### [cluster-config-api](https://github.com/openshift/api/tree/eb96322bf52288bf7931bb6240fd244cc362a68b)

* [SPLAT-2866](https://issues.redhat.com/browse/SPLAT-2866): Add vSphere multi vCenter Day 2 [#3036](https://github.com/openshift/api/pull/3036)
* [Full changelog](https://github.com/openshift/api/compare/1cb630ce7109e6c4780332bb8140c8c4f7157426...eb96322bf52288bf7931bb6240fd244cc362a68b)


### [cluster-config-operator](https://github.com/openshift/cluster-config-operator/tree/b4abf3b25f1d5d5994b12f76e1876c152b3965d7)

* [SPLAT-2866](https://issues.redhat.com/browse/SPLAT-2866): Migrate vSphere sync of kube-cloud-config to 3CMO [#505](https://github.com/openshift/cluster-config-operator/pull/505)
* [Full changelog](https://github.com/openshift/cluster-config-operator/compare/1eb450a3a2456f6e3fe3d727208b5f7b0dd35aba...b4abf3b25f1d5d5994b12f76e1876c152b3965d7)


### [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator/tree/0792200a88659a9db0394932e711bd3c1005204a)

* [OCPBUGS-104067](https://issues.redhat.com/browse/OCPBUGS-104067): Use patched x/net fork v0.50.0-sec.4 [#498](https://github.com/openshift/cluster-dns-operator/pull/498)
* [Full changelog](https://github.com/openshift/cluster-dns-operator/compare/41a53fed36e6e99c7c9ceb3a699c3547ee5d9bb9...0792200a88659a9db0394932e711bd3c1005204a)


### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/8604405aa000bf68269d91ece282bdfc3433b50a)

* [OCPBUGS-104066](https://issues.redhat.com/browse/OCPBUGS-104066): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 [#1692](https://github.com/openshift/cluster-etcd-operator/pull/1692)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/1cad682c3cdb0db2bd19c4cba27098703477734f...8604405aa000bf68269d91ece282bdfc3433b50a)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/4605c76fc68b288c1007c3424c793088f8b3e9b5)

* [OCPBUGS-98582](https://issues.redhat.com/browse/OCPBUGS-98582): Detect orphaned OSSM subscription after noOLM migration [#1504](https://github.com/openshift/cluster-ingress-operator/pull/1504)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/f30c6160c94034639739df5ce940d60d1d7c028a...4605c76fc68b288c1007c3424c793088f8b3e9b5)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/58a7dcc50c07c532f97d1114201bedd4a15cc435)

* [OCPBUGS-104074](https://issues.redhat.com/browse/OCPBUGS-104074): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#2296](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2296)
* [OCPBUGS-127407](https://issues.redhat.com/browse/OCPBUGS-127407): Bump of library-go [#2326](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2326)
* [OCPBUGS-88326](https://issues.redhat.com/browse/OCPBUGS-88326): Fix kube-apiserver-to-kubelet-signer refresh interval [#2192](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2192)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/dc1c217c263cd220ddd2ed6fe827a466d47e3ebb...58a7dcc50c07c532f97d1114201bedd4a15cc435)


### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/938fd690c4ed9fbecdf1f712b37481689ca92961)

* [OCPBUGS-104058](https://issues.redhat.com/browse/OCPBUGS-104058): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#958](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/958)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/395de96705749de9c6a5f25747b9d5c3d5f65a8f...938fd690c4ed9fbecdf1f712b37481689ca92961)


### [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator/tree/9f1b43ce1b85f11aabd3aa49f95b0746485bd14f)

* [OCPBUGS-104070](https://issues.redhat.com/browse/OCPBUGS-104070): [release-4.21] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#666](https://github.com/openshift/cluster-kube-scheduler-operator/pull/666)
* [Full changelog](https://github.com/openshift/cluster-kube-scheduler-operator/compare/5ef1df3be41d38ddae9b3d22ce51ba486939e9f1...9f1b43ce1b85f11aabd3aa49f95b0746485bd14f)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/15a636e968aa90a9c4817c31891eca1fd547d67e)

* [OCPBUGS-129137](https://issues.redhat.com/browse/OCPBUGS-129137): don't delete admin-owned Alertmanager secrets on destroy [#3139](https://github.com/openshift/cluster-monitoring-operator/pull/3139)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.21] [#3114](https://github.com/openshift/cluster-monitoring-operator/pull/3114)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/9b8c136071a82310b47a9ceab869257378a929c3...15a636e968aa90a9c4817c31891eca1fd547d67e)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/2c97ba0679c4f5988e1b5166384a9e200e7ef635)

* [OCPBUGS-104069](https://issues.redhat.com/browse/OCPBUGS-104069): [release-4.21]  Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#3156](https://github.com/openshift/cluster-network-operator/pull/3156)
* [OCPBUGS-130583](https://issues.redhat.com/browse/OCPBUGS-130583): Added global overrides for OVN-Kubernetes [#3192](https://github.com/openshift/cluster-network-operator/pull/3192)
* [OCPBUGS-127442](https://issues.redhat.com/browse/OCPBUGS-127442): [release-4.21] Allow per-node OVN encap IP override via env-overrides [#3177](https://github.com/openshift/cluster-network-operator/pull/3177)
* [OCPBUGS-126704](https://issues.redhat.com/browse/OCPBUGS-126704): Restart pods when rendering egressIP settings [#3168](https://github.com/openshift/cluster-network-operator/pull/3168)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/d1d5e0e61459c068cd5024746b54275685279f9f...2c97ba0679c4f5988e1b5166384a9e200e7ef635)


### [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator/tree/ab9cccbdd1bf065ec0e8afde2f9b960a6e3fcb0d)

* [OCPBUGS-104056](https://issues.redhat.com/browse/OCPBUGS-104056): bump golang.org/x/net to v0.50.0-sec.3 to fix CVE-2026-33814 [#242](https://github.com/openshift/cluster-olm-operator/pull/242)
* [Full changelog](https://github.com/openshift/cluster-olm-operator/compare/03bedb913bce9c7deabf7868e5cbefc57cf3490b...ab9cccbdd1bf065ec0e8afde2f9b960a6e3fcb0d)


### [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller/tree/518afaed0d2d33607059f1f7cfdb6961cb7d76a6)

* [OCPBUGS-104061](https://issues.redhat.com/browse/OCPBUGS-104061): Bump golang.org/x/net to v0.50.0-sec.3 [#199](https://github.com/openshift/cluster-policy-controller/pull/199)
* [Full changelog](https://github.com/openshift/cluster-policy-controller/compare/e510507e20f6eb09694c880ecd79fa512a2b3470...518afaed0d2d33607059f1f7cfdb6961cb7d76a6)


### [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator/tree/0ddb6080db1419c6d7d3f6d0f5f201e57e52cdf6)

* [OCPBUGS-129483](https://issues.redhat.com/browse/OCPBUGS-129483): Restrict samples operator access to the global pull-secret [#728](https://github.com/openshift/cluster-samples-operator/pull/728)
* [Full changelog](https://github.com/openshift/cluster-samples-operator/compare/11ed1942dbbf7a8334862b3d598a967e9b92aa77...0ddb6080db1419c6d7d3f6d0f5f201e57e52cdf6)


### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/9e69219d1b6516157423f9d1253d482f80a4bf76)

* [OCPBUGS-104089](https://issues.redhat.com/browse/OCPBUGS-104089): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#738](https://github.com/openshift/cluster-storage-operator/pull/738)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/e403475164a4de23d358a93106a35353ec29f3d7...9e69219d1b6516157423f9d1253d482f80a4bf76)


### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/d9455dc95aeb63cdc4286e0eb986d2cce5053074)

* [OCPBUGS-104076](https://issues.redhat.com/browse/OCPBUGS-104076): Bump golang.org/x/net to v0.50.0-sec.3 [#1456](https://github.com/openshift/cluster-version-operator/pull/1456)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/d37e5a056d5a9c74c2ac2d5551ef39f573c9824a...d9455dc95aeb63cdc4286e0eb986d2cce5053074)


### [console](https://github.com/openshift/console/tree/be25e8047c98e9cce689469bd0104cb538d0186f)

* [OCPBUGS-132569](https://issues.redhat.com/browse/OCPBUGS-132569): Fix Namespace column hidden on Node Pods tab with active namespace [#17405](https://github.com/openshift/console/pull/17405)
* [Full changelog](https://github.com/openshift/console/compare/c4707af42ca9f5e17ec9d515d66c5bf0f3b9c8ad...be25e8047c98e9cce689469bd0104cb538d0186f)


### [console-operator](https://github.com/openshift/console-operator/tree/6319405de44497bd5ea57aa486ad8ebf1518a3d5)

* [OCPBUGS-130936](https://issues.redhat.com/browse/OCPBUGS-130936): Handle disabled Ingress capability in HyperShift [#1244](https://github.com/openshift/console-operator/pull/1244)
* [OCPBUGS-104078](https://issues.redhat.com/browse/OCPBUGS-104078): Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 [#1220](https://github.com/openshift/console-operator/pull/1220)
* [Full changelog](https://github.com/openshift/console-operator/compare/f730484ce5f2606e7f665d561227c374183fff14...6319405de44497bd5ea57aa486ad8ebf1518a3d5)


### [coredns](https://github.com/openshift/coredns/tree/c3f32d7d058c93b17a5ba5d3a82245db7820bfc7)

* [OCPBUGS-104084](https://issues.redhat.com/browse/OCPBUGS-104084): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#202](https://github.com/openshift/coredns/pull/202)
* [Full changelog](https://github.com/openshift/coredns/compare/7486e9e4330c1e41d9a91e4673b7f2782efc112c...c3f32d7d058c93b17a5ba5d3a82245db7820bfc7)


### [csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/063501a59511f2924cd40222ba0d2cca03af8388)

* [OCPBUGS-96550](https://issues.redhat.com/browse/OCPBUGS-96550): Bump golang.org/x/net to v0.50.0-sec.4 [#417](https://github.com/openshift/cloud-provider-openstack/pull/417)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/ee321fbd37b2ded41a96004d52a7652b67e28809...063501a59511f2924cd40222ba0d2cca03af8388)


### [csi-external-attacher](https://github.com/openshift/csi-external-attacher/tree/c3a5a353da0861670a8452cf7502183aa1c6116f)

* UPSTREAM: 110: OCPBUGS-104081: Bump golang.org/x/net to v0.50.0-sec.4 [#112](https://github.com/openshift/csi-external-attacher/pull/112)
* [Full changelog](https://github.com/openshift/csi-external-attacher/compare/6a3be10e6795c8149c4bd3c9856f7e2d312108e2...c3a5a353da0861670a8452cf7502183aa1c6116f)


### [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner/tree/a516b58acb562eb512fb6dcd1965cfd634996a12)

* [OCPBUGS-93008](https://issues.redhat.com/browse/OCPBUGS-93008): Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.48.0-sec.3 to address CVE-2026-46597 [#159](https://github.com/openshift/csi-external-provisioner/pull/159)
* [Full changelog](https://github.com/openshift/csi-external-provisioner/compare/8d29fc4b7cb1f910c4c03e0a63fdd375d6294125...a516b58acb562eb512fb6dcd1965cfd634996a12)


### [csi-external-snapshot-metadata](https://github.com/openshift/csi-external-snapshot-metadata/tree/58ad95f7469d70b97f3152e8b8fba7f2f3556b54)

* [OCPBUGS-104088](https://issues.redhat.com/browse/OCPBUGS-104088): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#32](https://github.com/openshift/csi-external-snapshot-metadata/pull/32)
* [OCPBUGS-80787](https://issues.redhat.com/browse/OCPBUGS-80787): Bump google.golang.org/grpc to v1.79.3 [release-4.21] [#20](https://github.com/openshift/csi-external-snapshot-metadata/pull/20)
* [Full changelog](https://github.com/openshift/csi-external-snapshot-metadata/compare/af250fdbac8af84d9808a2892bfc911c04162115...58ad95f7469d70b97f3152e8b8fba7f2f3556b54)


### [csi-external-snapshotter, csi-snapshot-controller](https://github.com/openshift/csi-external-snapshotter/tree/d5255eb9b32130c684957e258bd1b2f40f0a70fa)

* [OCPBUGS-104077](https://issues.redhat.com/browse/OCPBUGS-104077): Replace golang.org/x/net with github.com/openshift-sustaining/net v0.50.0-sec.3 to mitigate CVE-2026-33814 (release-4.21) [#235](https://github.com/openshift/csi-external-snapshotter/pull/235)
* [Full changelog](https://github.com/openshift/csi-external-snapshotter/compare/2c14afc50a30de62cb00cc8263b061383cfbd3b5...d5255eb9b32130c684957e258bd1b2f40f0a70fa)


### [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe/tree/ac14c6e419c8e4165bd1a8d89cb4a215bebe3a26)

* [OCPBUGS-104079](https://issues.redhat.com/browse/OCPBUGS-104079): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#108](https://github.com/openshift/csi-livenessprobe/pull/108)
* [Full changelog](https://github.com/openshift/csi-livenessprobe/compare/78dacb7c661a62c78036c2737401afd3eb6fd04d...ac14c6e419c8e4165bd1a8d89cb4a215bebe3a26)


### [docker-builder](https://github.com/openshift/builder/tree/3c27415e6167879dc02bf2fc4388a7d914109b2c)

* [OCPBUGS-90033](https://issues.redhat.com/browse/OCPBUGS-90033), [OCPBUGS-90475](https://issues.redhat.com/browse/OCPBUGS-90475), [OCPBUGS-92525](https://issues.redhat.com/browse/OCPBUGS-92525), [OCPBUGS-92654](https://issues.redhat.com/browse/OCPBUGS-92654), [OCPBUGS-92992](https://issues.redhat.com/browse/OCPBUGS-92992): Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 [#547](https://github.com/openshift/builder/pull/547)
* [Full changelog](https://github.com/openshift/builder/compare/48fce231bac118a63992f466acc8b29a29e1ddde...3c27415e6167879dc02bf2fc4388a7d914109b2c)


### [docker-registry](https://github.com/openshift/image-registry/tree/42b6cb7c6467083b0805c2515817da7c1038a5d3)

* [OCPBUGS-104087](https://issues.redhat.com/browse/OCPBUGS-104087): [release-4.21] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#477](https://github.com/openshift/image-registry/pull/477)
* [Full changelog](https://github.com/openshift/image-registry/compare/602f51c795dcdcd71c75f6abfe79dc0424a0476a...42b6cb7c6467083b0805c2515817da7c1038a5d3)


### [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp/tree/f064fc7fcc679e21ff8412f0a1f1d754943a3ae9)

* [OCPBUGS-104106](https://issues.redhat.com/browse/OCPBUGS-104106), [OCPBUGS-104202](https://issues.redhat.com/browse/OCPBUGS-104202), [OCPBUGS-88266](https://issues.redhat.com/browse/OCPBUGS-88266): Replace golang.org/x/net with sustaining fork for CVE-2026-33814 and CVE-2026-39821 [#162](https://github.com/openshift/cloud-provider-gcp/pull/162)
* [Full changelog](https://github.com/openshift/cloud-provider-gcp/compare/0b668ce7bac61039537f573ad6d6f7297dd34b05...f064fc7fcc679e21ff8412f0a1f1d754943a3ae9)


### [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver/tree/3fc777d39975da87ac32dda3e5e787de64582403)

* [OCPBUGS-104100](https://issues.redhat.com/browse/OCPBUGS-104100): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#141](https://github.com/openshift/gcp-pd-csi-driver/pull/141)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver/compare/1da557fe54562347dbf18bee04fe6564a2697707...3fc777d39975da87ac32dda3e5e787de64582403)


### [gcp-pd-csi-driver-operator](https://github.com/openshift/gcp-pd-csi-driver-operator/tree/6f1c697f3877a7ab51b612c8cf3a69b0351d084b)

* [OCPBUGS-104100](https://issues.redhat.com/browse/OCPBUGS-104100): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#211](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/211)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver-operator/compare/8d9f11a7f2c4e757bfc5e99ba69084d29a28b79b...6f1c697f3877a7ab51b612c8cf3a69b0351d084b)


### [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook/tree/e4c514aeba99d26c23b5452833460e2bbf855627)

* [OCPBUGS-104095](https://issues.redhat.com/browse/OCPBUGS-104095): Replace golang.org/x/net with github.com/openshift-sustaining/net v0.35.0-sec.4 [#23](https://github.com/openshift/gcp-workload-identity-federation-webhook/pull/23)
* [Full changelog](https://github.com/openshift/gcp-workload-identity-federation-webhook/compare/d481e5cb9323b01964bf143b58403b62fa31e5e7...e4c514aeba99d26c23b5452833460e2bbf855627)


### [hyperkube, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/601ff80b0459adda2d2c5865bfb8d568a1fa68b7)

* UPSTREAM: &lt;carry&gt;: OCPBUGS-99230: Fix ClusterIsIPv6() detection for dual-stack v6-primary clusters [#2722](https://github.com/openshift/kubernetes/pull/2722)
* [Full changelog](https://github.com/openshift/kubernetes/compare/93afd702239e69df4bf4b7e66140455ab8282acd...601ff80b0459adda2d2c5865bfb8d568a1fa68b7)


### [hypershift](https://github.com/openshift/hypershift/tree/3e0b05419671f37c5a15a6e1746439b4fa914d29)

* [OCPBUGS-132161](https://issues.redhat.com/browse/OCPBUGS-132161): use in-cluster service for oauth-server [#10028](https://github.com/openshift/hypershift/pull/10028)
* [CNTRLPLANE-3774](https://issues.redhat.com/browse/CNTRLPLANE-3774): [release-4.21] fix: control-plane-operator: improve opaque conditions [#9344](https://github.com/openshift/hypershift/pull/9344)
* [OCPBUGS-90007](https://issues.redhat.com/browse/OCPBUGS-90007), [OCPBUGS-98642](https://issues.redhat.com/browse/OCPBUGS-98642): Fix CVE-2026-33814, CVE-2026-39830 and CVE-2026-39829 [#9529](https://github.com/openshift/hypershift/pull/9529)
* [OCPBUGS-93030](https://issues.redhat.com/browse/OCPBUGS-93030): CVE-2026-46597 openshift4/ose-hypershift-rhel9: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs [openshift-4.21] [#9270](https://github.com/openshift/hypershift/pull/9270)
* [OCPBUGS-129535](https://issues.redhat.com/browse/OCPBUGS-129535): filter AWS-reserved tag keys before calling DeleteTags [#9964](https://github.com/openshift/hypershift/pull/9964)
* [OCPBUGS-129111](https://issues.redhat.com/browse/OCPBUGS-129111): Count only successful upsert updates [#9901](https://github.com/openshift/hypershift/pull/9901)
* [OCPBUGS-81489](https://issues.redhat.com/browse/OCPBUGS-81489): Add MTU override for OVN-Kubernetes on hosted clusters [#8136](https://github.com/openshift/hypershift/pull/8136)
* [CNTRLPLANE-4570](https://issues.redhat.com/browse/CNTRLPLANE-4570): add kubeClientQPS and kubeClientBurst to ClusterAutoscaling [#9888](https://github.com/openshift/hypershift/pull/9888)
* [OCPBUGS-128933](https://issues.redhat.com/browse/OCPBUGS-128933): [release-4.21] fix: grant cluster-autoscaler watch access [#9855](https://github.com/openshift/hypershift/pull/9855)
* [OCPBUGS-120681](https://issues.redhat.com/browse/OCPBUGS-120681): Apply ingress load balancer scope to default IngressController [#9541](https://github.com/openshift/hypershift/pull/9541)
* [OCPBUGS-112732](https://issues.redhat.com/browse/OCPBUGS-112732): fix(certs): normalize IP SANs to stop dual-stack KAS cert churn [#9497](https://github.com/openshift/hypershift/pull/9497)
* [OCPBUGS-128418](https://issues.redhat.com/browse/OCPBUGS-128418): fix(konnectivity): enable --sync-forever to restore lost agent-server tunnels [#9800](https://github.com/openshift/hypershift/pull/9800)
* [OCPBUGS-98327](https://issues.redhat.com/browse/OCPBUGS-98327): fix(kubevirt): use only first MachineInternalIP per family in EndpointSlice endpoints [#8978](https://github.com/openshift/hypershift/pull/8978)
* [CNTRLPLANE-4158](https://issues.redhat.com/browse/CNTRLPLANE-4158): Maintain ingress serving cert for HostedCluster ingress [#9744](https://github.com/openshift/hypershift/pull/9744)
* [ACM-46124](https://issues.redhat.com/browse/ACM-46124): improve hypershift-rhel9-operator container grade on MCE 2.11 [release-4.21] [#9739](https://github.com/openshift/hypershift/pull/9739)
* [OCPBUGS-120751](https://issues.redhat.com/browse/OCPBUGS-120751): update Containerfile.cli runtime base image to floating tag [release-4.21] [#9557](https://github.com/openshift/hypershift/pull/9557)
* [OCPBUGS-125792](https://issues.redhat.com/browse/OCPBUGS-125792): hardcode ETCD_METRICS=extensive in etcd StatefulSet template [#9696](https://github.com/openshift/hypershift/pull/9696)
* [Full changelog](https://github.com/openshift/hypershift/compare/db86285f89737b67a53668e42a47ffd6c8cd5170...3e0b05419671f37c5a15a6e1746439b4fa914d29)


### [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm/tree/ca2f7d03f3ff062e7f40e6a07e571b27d1742a77)

* [OCPBUGS-120699](https://issues.redhat.com/browse/OCPBUGS-120699): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 [#111](https://github.com/openshift/cloud-provider-ibm/pull/111)
* [Full changelog](https://github.com/openshift/cloud-provider-ibm/compare/c566572b2cf0120499e81181f1efb1e729e9c418...ca2f7d03f3ff062e7f40e6a07e571b27d1742a77)


### [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/tree/f6ca28cbbde5485f69cfce97c78f2b660c233d4e)

* [OCPBUGS-104111](https://issues.redhat.com/browse/OCPBUGS-104111): Use patched x/net fork v0.50.0-sec.4 [#191](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/191)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/compare/00bc740728d9f8ec86fe04199884108c2a091b58...f6ca28cbbde5485f69cfce97c78f2b660c233d4e)


### [insights-operator](https://github.com/openshift/insights-operator/tree/f1439a6fa0561f471d1630db71c102a8326dd4f7)

* [OCPBUGS-129367](https://issues.redhat.com/browse/OCPBUGS-129367): add insights-runtime-extractor-scc missing fields [#1387](https://github.com/openshift/insights-operator/pull/1387)
* [OCPBUGS-127485](https://issues.redhat.com/browse/OCPBUGS-127485): Add multicluster gatherer [#1374](https://github.com/openshift/insights-operator/pull/1374)
* [OCPBUGS-123175](https://issues.redhat.com/browse/OCPBUGS-123175): add custom proxy field to insights config [#1365](https://github.com/openshift/insights-operator/pull/1365)
* [Full changelog](https://github.com/openshift/insights-operator/compare/f113c1d5386eaeaab5acfe68de160defd082bc68...f1439a6fa0561f471d1630db71c102a8326dd4f7)


### [ironic](https://github.com/openshift/ironic-image/tree/d9db7430c1e402239d980e0c10428341f49937de)

* [OCPBUGS-115166](https://issues.redhat.com/browse/OCPBUGS-115166): ZTP deployment failed on an iDRAC10 cluster [#919](https://github.com/openshift/ironic-image/pull/919)
* [Full changelog](https://github.com/openshift/ironic-image/compare/843f55a9276bf03d3cb659de5cb38f189e6e8fcf...d9db7430c1e402239d980e0c10428341f49937de)


### [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server/tree/a577f425844d4c95b91dc4eec2a4068e1f6cf443)

* NO-ISSUE: synchronize OWNERS from main branch [release-4.21] [#82](https://github.com/openshift/kubernetes-metrics-server/pull/82)
* [Full changelog](https://github.com/openshift/kubernetes-metrics-server/compare/ff4f3e2a6d2b0e8a860831b98733cff152cfddd3...a577f425844d4c95b91dc4eec2a4068e1f6cf443)


### [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy/tree/72abb01aca3ca72d1f64328ef07b0cafd34e1f5e)

* [OCPBUGS-127955](https://issues.redhat.com/browse/OCPBUGS-127955): Replace golang.org/x/net with sustaining_fork version to resolve CVE-2026-39821 (release-4.21) [#166](https://github.com/openshift/kube-rbac-proxy/pull/166)
* [Full changelog](https://github.com/openshift/kube-rbac-proxy/compare/cd636680e06a55395c26570dff0cb37277014388...72abb01aca3ca72d1f64328ef07b0cafd34e1f5e)


### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/10415bfe1d1fd2e951a3655ba6c8230025ab9c0f)

* [OCPBUGS-130778](https://issues.redhat.com/browse/OCPBUGS-130778): backport kube-state-metrics 2.18 memory leak fix [#199](https://github.com/openshift/kube-state-metrics/pull/199)
* [OCPBUGS-104127](https://issues.redhat.com/browse/OCPBUGS-104127): Use patched x/net fork v0.50.0-sec.4 [#167](https://github.com/openshift/kube-state-metrics/pull/167)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.21] [#188](https://github.com/openshift/kube-state-metrics/pull/188)
* [Full changelog](https://github.com/openshift/kube-state-metrics/compare/8406e402ad020185813942842d4914ff7730fdc1...10415bfe1d1fd2e951a3655ba6c8230025ab9c0f)


### [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt/tree/b9c1d98fa5fc010386697e75105ff61231d0a442)

* [OCPBUGS-104141](https://issues.redhat.com/browse/OCPBUGS-104141): Use patched x/net fork v0.50.0-sec.4 [#97](https://github.com/openshift/cloud-provider-kubevirt/pull/97)
* [Full changelog](https://github.com/openshift/cloud-provider-kubevirt/compare/1e6fdd6615a55fc449b3e7ad2d6e92a27d30a934...b9c1d98fa5fc010386697e75105ff61231d0a442)


### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/87c174835017c47a1e17e7c4ee4ee914352af64c)

* [OCPBUGS-130594](https://issues.redhat.com/browse/OCPBUGS-130594): fix race in VAP MachineSet e2e test cleanup [#1578](https://github.com/openshift/machine-api-operator/pull/1578)
* [OCPBUGS-129659](https://issues.redhat.com/browse/OCPBUGS-129659): [release-4.21] Reduce vCenter API load in the vSphere machine controller [#1576](https://github.com/openshift/machine-api-operator/pull/1576)
* [OCPBUGS-128567](https://issues.redhat.com/browse/OCPBUGS-128567): vsphere - Cache REST API sessions to prevent excessive vCenter logouts [#1567](https://github.com/openshift/machine-api-operator/pull/1567)
* [SPLAT-2866](https://issues.redhat.com/browse/SPLAT-2866): Added multi vCenter Day 2 Support [#1554](https://github.com/openshift/machine-api-operator/pull/1554)
* [OCPBUGS-127563](https://issues.redhat.com/browse/OCPBUGS-127563): Add opt-in kube-rbac-proxy sidecar for pprof endpoint (AWS) [#1561](https://github.com/openshift/machine-api-operator/pull/1561)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/aac6c87b2ebf762bf049c6a69aedbc6096323e1c...87c174835017c47a1e17e7c4ee4ee914352af64c)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/f6b0da26be75da9f903e2ec2815c0b4cb9a06653)

* [OCPBUGS-132861](https://issues.redhat.com/browse/OCPBUGS-132861): Split wait-for-ipsec-connect into two services to avoid ipsec restart [#6672](https://github.com/openshift/machine-config-operator/pull/6672)
* [OCPBUGS-127129](https://issues.redhat.com/browse/OCPBUGS-127129): Replace wildcard permissions with explicit verbs in MachineConfigServer ClusterRole [#6570](https://github.com/openshift/machine-config-operator/pull/6570)
* [OCPBUGS-129667](https://issues.redhat.com/browse/OCPBUGS-129667): Boot image controller skips MachineSets that don't match any failure domain [#6642](https://github.com/openshift/machine-config-operator/pull/6642)
* [OCPBUGS-128598](https://issues.redhat.com/browse/OCPBUGS-128598): wrong early exit during kubelet MCs regeneration [#6599](https://github.com/openshift/machine-config-operator/pull/6599)
* [OCPBUGS-127254](https://issues.redhat.com/browse/OCPBUGS-127254): Correctly handle MC deletion in image mode when no new build is required [#6575](https://github.com/openshift/machine-config-operator/pull/6575)
* [OCPBUGS-104144](https://issues.redhat.com/browse/OCPBUGS-104144): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#6504](https://github.com/openshift/machine-config-operator/pull/6504)
* [OCPBUGS-123140](https://issues.redhat.com/browse/OCPBUGS-123140): limit ContainerRuntimeConfig status condition to 3 [#6539](https://github.com/openshift/machine-config-operator/pull/6539)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/0c32560860e39c44babcc69692782c63119fb331...f6b0da26be75da9f903e2ec2815c0b4cb9a06653)


### [machine-image-customization-controller](https://github.com/openshift/image-customization-controller/tree/069c86cef9402077f674302f02061ec16aa5cfa2)

* [OCPBUGS-104119](https://issues.redhat.com/browse/OCPBUGS-104119): Replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 for CVE-2026-33814 [#195](https://github.com/openshift/image-customization-controller/pull/195)
* [Full changelog](https://github.com/openshift/image-customization-controller/compare/65aeb3607f05dd71ec27a4457945ce1e054ea9e9...069c86cef9402077f674302f02061ec16aa5cfa2)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/ca8e015ae80f4c148e43f96308d4eb739b1e84cd)

* [OU-1589](https://issues.redhat.com/browse/OU-1589): [release-4.21] sanitize linkified URLs in alert annotations [#1381](https://github.com/openshift/monitoring-plugin/pull/1381)
* [OCPBUGS-130566](https://issues.redhat.com/browse/OCPBUGS-130566): [release-4.21] escape regex variable values in regex matcher contexts [#1347](https://github.com/openshift/monitoring-plugin/pull/1347)
* [OU-1392](https://issues.redhat.com/browse/OU-1392): [release-4.21] fix: parse datetime ranges from the specified format rather than browser specific apis [#1350](https://github.com/openshift/monitoring-plugin/pull/1350)
* [OCPBUGS-118236](https://issues.redhat.com/browse/OCPBUGS-118236): [release-4.21] Bump fast-uri to fix CVE-2026-84292 [#1333](https://github.com/openshift/monitoring-plugin/pull/1333)
* [OU-1528](https://issues.redhat.com/browse/OU-1528): [release-4.21] Optimize namespace changes in Alerts [#1311](https://github.com/openshift/monitoring-plugin/pull/1311)
* NO-JIRA: [release-4.21] Sanitize alert runbook URLs [#1296](https://github.com/openshift/monitoring-plugin/pull/1296)
* Fix OCPBUGS-104124: CVE-2026-33814 Replace golang.org/x/net with the patched github.com/openshift-sustaining/net@v0.50.0-sec.4 fork to remediate CVE-2026-33814 [#1201](https://github.com/openshift/monitoring-plugin/pull/1201)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/563488150549466015299a876981a19e54c22b8b...ca8e015ae80f4c148e43f96308d4eb739b1e84cd)


### [multus-admission-controller](https://github.com/openshift/multus-admission-controller/tree/9c8756318c94e2748740b0d75d3a911cdd624bd0)

* [OCPBUGS-104135](https://issues.redhat.com/browse/OCPBUGS-104135): bump golang.org/x/net to v0.50.0-sec.3 to fix CVE-2026-33814 [#131](https://github.com/openshift/multus-admission-controller/pull/131)
* [Full changelog](https://github.com/openshift/multus-admission-controller/compare/d95feb67adfb97346849c79e36b6a9d404296ae9...9c8756318c94e2748740b0d75d3a911cdd624bd0)


### [multus-cni, multus-cni-microshift](https://github.com/openshift/multus-cni/tree/215643f7207e73eaf4db30d59f8dbf4ff1ef3faf)

* [OCPBUGS-104143](https://issues.redhat.com/browse/OCPBUGS-104143): [release-4.21] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#354](https://github.com/openshift/multus-cni/pull/354)
* [OCPBUGS-120763](https://issues.redhat.com/browse/OCPBUGS-120763): [Release 4.21] Cherry-pick fix for the issue of stripping delegate datastore config on CNI DEL, leaking IPAM addresses [#351](https://github.com/openshift/multus-cni/pull/351)
* [Full changelog](https://github.com/openshift/multus-cni/compare/8f5dd8b1e9f0c2b2404e3c8ddcffb1fd9441003d...215643f7207e73eaf4db30d59f8dbf4ff1ef3faf)


### [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy/tree/0e4455644aef65657630046fb9d6540ec728a33a)

* [OCPBUGS-104136](https://issues.redhat.com/browse/OCPBUGS-104136): [release-4.21] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#125](https://github.com/openshift/multus-networkpolicy/pull/125)
* [Full changelog](https://github.com/openshift/multus-networkpolicy/compare/e9f2f3c7e81683af3b8cc9a5a3166434c94e0498...0e4455644aef65657630046fb9d6540ec728a33a)


### [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni/tree/696f6965c938ae0976f33edb97871a5afb9e6d5b)

* [OCPBUGS-104139](https://issues.redhat.com/browse/OCPBUGS-104139): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#423](https://github.com/openshift/whereabouts-cni/pull/423)
* [Full changelog](https://github.com/openshift/whereabouts-cni/compare/d691040e509bb20c26b5e8366c0d6f3bb45a5e02...696f6965c938ae0976f33edb97871a5afb9e6d5b)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/4227ccd5832ce23c181fc4940c50d2868c8c5dfb)

* maintenance: Bump the npm group with 24 updates [#621](https://github.com/openshift/networking-console-plugin/pull/621)
* [OCPNETUI-186](https://issues.redhat.com/browse/OCPNETUI-186): Sync Dockerfile with Dockerfile.art [#617](https://github.com/openshift/networking-console-plugin/pull/617)
* maintenance: Bump the npm group with 20 updates [#597](https://github.com/openshift/networking-console-plugin/pull/597)
* [OCPNETUI-156](https://issues.redhat.com/browse/OCPNETUI-156): dependency cleanup [#592](https://github.com/openshift/networking-console-plugin/pull/592)
* [OCPNETUI-156](https://issues.redhat.com/browse/OCPNETUI-156): reassign dev and prod dependencies [#585](https://github.com/openshift/networking-console-plugin/pull/585)
* maintenance: Bump the npm group with 23 updates [#576](https://github.com/openshift/networking-console-plugin/pull/576)
* maintenance: Bump the npm group across 1 directory with 24 updates [#571](https://github.com/openshift/networking-console-plugin/pull/571)
* [OCPNETUI-156](https://issues.redhat.com/browse/OCPNETUI-156): Align shared modules with Console [#565](https://github.com/openshift/networking-console-plugin/pull/565)
* maintenance: Bump the npm group with 15 updates [#548](https://github.com/openshift/networking-console-plugin/pull/548)
* maintenance: Bump the npm group across 1 directory with 20 updates [#536](https://github.com/openshift/networking-console-plugin/pull/536)
* maintenance: Bump the npm group with 232 updates [#498](https://github.com/openshift/networking-console-plugin/pull/498)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/7f30aa50c9eb323c94fb07f0f60664fb59b9cbb8...4227ccd5832ce23c181fc4940c50d2868c8c5dfb)


### [nutanix-cloud-controller-manager](https://github.com/openshift/cloud-provider-nutanix/tree/d7da4af2adfc120bf517f47d0908a26a97c9dafb)

* [OCPBUGS-104126](https://issues.redhat.com/browse/OCPBUGS-104126): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 [#74](https://github.com/openshift/cloud-provider-nutanix/pull/74)
* [Full changelog](https://github.com/openshift/cloud-provider-nutanix/compare/33b7bec6fe27b8d126982a70b4579112cd67052b...d7da4af2adfc120bf517f47d0908a26a97c9dafb)


### [oauth-apiserver](https://github.com/openshift/oauth-apiserver/tree/121e23df233c0633f5b42c38a3893e4bdf40cab2)

* [OCPBUGS-104146](https://issues.redhat.com/browse/OCPBUGS-104146): Replace golang.org/x/net with github.com/openshift-sustaining/net v0.50.0-sec.4 [#221](https://github.com/openshift/oauth-apiserver/pull/221)
* [Full changelog](https://github.com/openshift/oauth-apiserver/compare/71c41b2d8abb0c6ad90dca286baf5d03c1340646...121e23df233c0633f5b42c38a3893e4bdf40cab2)


### [oauth-proxy](https://github.com/openshift/oauth-proxy/tree/8b500504e841a146871e361f20ebb6c54c83d2a1)

* [OCPBUGS-112097](https://issues.redhat.com/browse/OCPBUGS-112097): bugfix: rewrite open redirect strings to '/' [#381](https://github.com/openshift/oauth-proxy/pull/381)
* [Full changelog](https://github.com/openshift/oauth-proxy/compare/d4c7cc97754f353d9270de238990c988c85d1c97...8b500504e841a146871e361f20ebb6c54c83d2a1)


### [oauth-server](https://github.com/openshift/oauth-server/tree/937d9c8a28701ea2f6ee0b183a3d2920b6f5932d)

* [OCPBUGS-104169](https://issues.redhat.com/browse/OCPBUGS-104169): Use patched x/net fork v0.50.0-sec.4 [#284](https://github.com/openshift/oauth-server/pull/284)
* [OCPBUGS-87078](https://issues.redhat.com/browse/OCPBUGS-87078): bugfix: default to english when Accept-Language header contains more than 1000 underscores [#269](https://github.com/openshift/oauth-server/pull/269)
* [Full changelog](https://github.com/openshift/oauth-server/compare/85a8ae3529821203c39559c4df6231ef3607e64e...937d9c8a28701ea2f6ee0b183a3d2920b6f5932d)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/aa20150b0dfe6d3c5255570b45f14c8ee18f22b7)

* [OCPBUGS-129394](https://issues.redhat.com/browse/OCPBUGS-129394): v1 accept catalog root entries and relative symlink targets [#1575](https://github.com/openshift/oc-mirror/pull/1575)
* [OCPBUGS-104022](https://issues.redhat.com/browse/OCPBUGS-104022): Use patched x/net fork v0.50.0-sec.4 [#1555](https://github.com/openshift/oc-mirror/pull/1555)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/9c41c399a30d4e3a6e2f60aae8b4fbee1013c9c2...aa20150b0dfe6d3c5255570b45f14c8ee18f22b7)


### [olm-catalogd, olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller/tree/1bd385d08adeae4bd98a902d29f984c00471ec1e)

* [OCPBUGS-128986](https://issues.redhat.com/browse/OCPBUGS-128986): [release-4.21] clean up orphaned catalog cache temp dirs [#815](https://github.com/openshift/operator-framework-operator-controller/pull/815)
* [OCPBUGS-104166](https://issues.redhat.com/browse/OCPBUGS-104166): [release-4.21] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#801](https://github.com/openshift/operator-framework-operator-controller/pull/801)
* [Full changelog](https://github.com/openshift/operator-framework-operator-controller/compare/92ef079dccfdf08c11d653113d5758827e67616c...1bd385d08adeae4bd98a902d29f984c00471ec1e)


### [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager/tree/be0f1245247b93fd92c4481cbb01a810d4fa368b)

* [OCPBUGS-104165](https://issues.redhat.com/browse/OCPBUGS-104165): Use patched x/net fork v0.50.0-sec.4 [#460](https://github.com/openshift/openshift-controller-manager/pull/460)
* [Full changelog](https://github.com/openshift/openshift-controller-manager/compare/438d52e79d691e016d66eabfe9a53c84229db40c...be0f1245247b93fd92c4481cbb01a810d4fa368b)


### [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics/tree/f152f44506424335fb02feaa88c6bb41c7ecc517)

* NO-ISSUE: synchronize OWNERS from main branch [#154](https://github.com/openshift/openshift-state-metrics/pull/154)
* [Full changelog](https://github.com/openshift/openshift-state-metrics/compare/ab605a4bf1c6cd5a6c58f245fb67ce648caebfa8...f152f44506424335fb02feaa88c6bb41c7ecc517)


### [openstack-resource-controller](https://github.com/openshift/openstack-resource-controller/tree/1ff3909142325a184993917fd9447c24cd6ce63f)

* [OCPBUGS-104030](https://issues.redhat.com/browse/OCPBUGS-104030): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.3 to address CVE-2026-33814 [#44](https://github.com/openshift/openstack-resource-controller/pull/44)
* [Full changelog](https://github.com/openshift/openstack-resource-controller/compare/83fb75dff1a6527f4632d8550f269d424e3e598c...1ff3909142325a184993917fd9447c24cd6ce63f)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/ade3050b01d89ebdbfdfc132f5a3c24b04c27079)

* NO-JIRA: REVERT-ME: Precreate CDN gateway topology before NAD/UDN sync [#3519](https://github.com/openshift/ovn-kubernetes/pull/3519)
* [OCPBUGS-130569](https://issues.redhat.com/browse/OCPBUGS-130569): Add pperiyasamy to OWNERS for release-4.21 branch [#3528](https://github.com/openshift/ovn-kubernetes/pull/3528)
* [OCPBUGS-128910](https://issues.redhat.com/browse/OCPBUGS-128910): NO-JIRA: Branch Sync release-5.0 to release-4.21 [10-01-2026] [#3504](https://github.com/openshift/ovn-kubernetes/pull/3504)
* NO-JIRA: Branch Sync release-5.0 to release-4.21 [09-28-2026] [#3477](https://github.com/openshift/ovn-kubernetes/pull/3477)
* [OCPBUGS-128245](https://issues.redhat.com/browse/OCPBUGS-128245): Branch Sync release-5.0 to release-4.21 [09-18-2026] [#3462](https://github.com/openshift/ovn-kubernetes/pull/3462)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/e2e61dbe576da162f711394c89068b8067f72343...ade3050b01d89ebdbfdfc132f5a3c24b04c27079)


### [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs/tree/c393015c7fc110d393aa9f4a32450b3c55d207f8)

* [OCPBUGS-101468](https://issues.redhat.com/browse/OCPBUGS-101468), [OCPBUGS-104164](https://issues.redhat.com/browse/OCPBUGS-104164), [OCPBUGS-91239](https://issues.redhat.com/browse/OCPBUGS-91239), [OCPBUGS-96559](https://issues.redhat.com/browse/OCPBUGS-96559): Bump x/net to address CVEs [#116](https://github.com/openshift/cloud-provider-powervs/pull/116)
* [Full changelog](https://github.com/openshift/cloud-provider-powervs/compare/40d1c0adfedeca36498a5d93d69aee96831c756d...c393015c7fc110d393aa9f4a32450b3c55d207f8)


### [prom-label-proxy](https://github.com/openshift/prom-label-proxy/tree/b909768250b0d975fb19239281d4fed7ab246a3e)

* NO-ISSUE: synchronize OWNERS from main branch [release-4.21] [#406](https://github.com/openshift/prom-label-proxy/pull/406)
* [Full changelog](https://github.com/openshift/prom-label-proxy/compare/610c11b59dd17f1d6dc35b62ca1d0602b5c0f494...b909768250b0d975fb19239281d4fed7ab246a3e)


### [prometheus](https://github.com/openshift/prometheus/tree/9234216efb7d1fe93a837b4c3a23f349e2a0cfd9)

* NO-ISSUE: synchronize OWNERS from main branch [#389](https://github.com/openshift/prometheus/pull/389)
* [Full changelog](https://github.com/openshift/prometheus/compare/6e65a831d39940685cf4cfaf6343278c163edede...9234216efb7d1fe93a837b4c3a23f349e2a0cfd9)


### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/86256406b5750999143f610430a80d1ce8381a6e)

* NO-JIRA: synchronize OWNERS with main [#193](https://github.com/openshift/prometheus-alertmanager/pull/193)
* [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/99c776df40d65fb32f96a09b063d9c159f843f9a...86256406b5750999143f610430a80d1ce8381a6e)


### [prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator/tree/8379c4f158524f7da04f2cdce2bcbb3e9134ccc7)

* NO-ISSUE: synchronize OWNERS from main branch [#413](https://github.com/openshift/prometheus-operator/pull/413)
* [Full changelog](https://github.com/openshift/prometheus-operator/compare/d392d80ac2194cf33969ec56aed5d624da8053e0...8379c4f158524f7da04f2cdce2bcbb3e9134ccc7)


### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/45ddb8d5124555a955a239ae02709ca06718e311)

* [OCPBUGS-104190](https://issues.redhat.com/browse/OCPBUGS-104190): Use patched x/net fork v0.50.0-sec.4 [#197](https://github.com/openshift/node_exporter/pull/197)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.21] [#209](https://github.com/openshift/node_exporter/pull/209)
* [Full changelog](https://github.com/openshift/node_exporter/compare/39d728735779afef886bc10a8bc7cf72f54d51a0...45ddb8d5124555a955a239ae02709ca06718e311)


### [route-controller-manager](https://github.com/openshift/route-controller-manager/tree/1a6da13c2e77f06d8a085184675d8fd13aac14ac)

* [OCPBUGS-104024](https://issues.redhat.com/browse/OCPBUGS-104024): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#107](https://github.com/openshift/route-controller-manager/pull/107)
* [Full changelog](https://github.com/openshift/route-controller-manager/compare/166a3e96f8151d9e789b3951ae75b03cdede5081...1a6da13c2e77f06d8a085184675d8fd13aac14ac)


### [tests](https://github.com/openshift/origin/tree/19d1c00b91e788ec7aba156a17868cee6e61b199)

* [OCPBUGS-130853](https://issues.redhat.com/browse/OCPBUGS-130853): stage the creation of test pods to minimize etcd impact [#31745](https://github.com/openshift/origin/pull/31745)
* [Full changelog](https://github.com/openshift/origin/compare/c941d145e570817f0408dc531c4261eecc21c4e7...19d1c00b91e788ec7aba156a17868cee6e61b199)


### [thanos](https://github.com/openshift/thanos/tree/e70d414d0c0fd13212f3e2fbe9e772464809592d)

* [OCPBUGS-129054](https://issues.redhat.com/browse/OCPBUGS-129054): Bump github.com/klauspost/compress to fix CVE-2026-63209 [#229](https://github.com/openshift/thanos/pull/229)
* [Full changelog](https://github.com/openshift/thanos/compare/afeb1c85ba9ee06676a0e657bfa4f4139ccc47b3...e70d414d0c0fd13212f3e2fbe9e772464809592d)


### [volume-data-source-validator](https://github.com/openshift/volume-data-source-validator/tree/f276506ffe92efa62da6a615921f3577c8bc38af)

* [OCPBUGS-104198](https://issues.redhat.com/browse/OCPBUGS-104198): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.3 [#21](https://github.com/openshift/volume-data-source-validator/pull/21)
* [Full changelog](https://github.com/openshift/volume-data-source-validator/compare/8b9293323cf8fdce93824e37168573ca3f73de3a...f276506ffe92efa62da6a615921f3577c8bc38af)


### [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere/tree/84d50a1094b15c33f9ea028e4b22892850032a79)

* [OCPBUGS-104185](https://issues.redhat.com/browse/OCPBUGS-104185): Replace golang.org/x/net with sustaining fork for CVE-2026-33814 in 4.21 [#132](https://github.com/openshift/cloud-provider-vsphere/pull/132)
* [Full changelog](https://github.com/openshift/cloud-provider-vsphere/compare/f69584d6ed7411504b0fff77eb36d0fd64f0fd5e...84d50a1094b15c33f9ea028e4b22892850032a79)


### [vsphere-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-vsphere/tree/1ac19f4dfc00a4e60c2c38e8944b7a2cb27e6101)

* [OCPBUGS-104210](https://issues.redhat.com/browse/OCPBUGS-104210): Bump golang.org/x/net to github.com/openshift-sustaining/net v0.50.0-sec.4 CVE-2026-33814 [release-4.21] [#127](https://github.com/openshift/cluster-api-provider-vsphere/pull/127)
* [Full changelog](https://github.com/openshift/cluster-api-provider-vsphere/compare/3adfe2b56b259b2d27906d8772354f817e338da5...1ac19f4dfc00a4e60c2c38e8944b7a2cb27e6101)


### [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator/tree/c597eb81e44a80957f84c9f7f4947e3371f6df6d)

* [OCPBUGS-104208](https://issues.redhat.com/browse/OCPBUGS-104208): Bump golang.org/x/net to v0.50.0-sec.3 [#353](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/353)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver-operator/compare/d6a19449cc5d49541221d48d62c67d7a48142d19...c597eb81e44a80957f84c9f7f4947e3371f6df6d)


### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/dd724c0469fe3b23029a9a3b95e6cdee9cd3c38e)

* [OCPBUGS-127130](https://issues.redhat.com/browse/OCPBUGS-127130): Fixed GetVCenter to handle removed FDs better [#241](https://github.com/openshift/vsphere-problem-detector/pull/241)
* [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/a644ba6cea8f898ef9a856b8ef955e23a1bf4868...dd724c0469fe3b23029a9a3b95e6cdee9cd3c38e)