# 5.0.0-ec.5
Created: 2026-07-30 15:45:08 +0000 UTC
Image Digest: `sha256:cc0eae9544d40aadbac7e0ce1a9beb23056faf5e022620a03eaf50a41b118e61`
## Changes from 4.22.0-rc.0
### Components
* Kubectl upgraded from 1.35.2 to 1.36.2
* Kubernetes upgraded from 1.35.3 to 1.36.2
* Kubernetes Tests 1.35.1
* Red Hat Enterprise Linux CoreOS 10.2 upgraded from 10.2.20260408-0 to 10.2.20260724-0
### FeatureGate Changes
| FeatureGate | Default
Hypershift | Default
SelfManagedHA | DevPreviewNoUpgrade
Hypershift | DevPreviewNoUpgrade
SelfManagedHA | OKD
Hypershift | OKD
SelfManagedHA | TechPreviewNoUpgrade
Hypershift | TechPreviewNoUpgrade
SelfManagedHA |
| :------ | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: |
| AzureClusterHostedDNSInstall
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| ConsolePluginContentSecurityPolicy
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| DRAPartitionableDevices
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| KMSEncryptionProvider
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| UserNamespacesPodSecurityStandards
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| UserNamespacesSupport
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| AWSClusterHostedDNSInstall
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| EVPN
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| IngressControllerDynamicConfigurationManager
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| MutatingAdmissionPolicy
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| OpenShiftPodSecurityAdmission
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| VSphereMixedNodeEnv
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| AWSServiceLBNetworkSecurityGroup
(0 tests)| Enabled
(Changed)| Enabled| Enabled| Enabled| Enabled
(Changed)| Enabled| Enabled| Enabled |
| OSStreams
(0 tests)| Disabled| Enabled
(Changed)| Enabled| Enabled| Disabled| Enabled
(Changed)| Enabled| Enabled |
| ExternalOIDCExternalClaimsSourcing
(0 tests)| Disabled| Disabled| Enabled| Enabled| Disabled| Disabled| Enabled
(Changed)| Enabled
(Changed) |
| ExternalSnapshotMetadata
(0 tests)| Disabled| Disabled| Enabled| Enabled| Disabled| Disabled| Enabled
(Changed)| Enabled
(Changed) |
| VSphereMultiVCenterDay2
(0 tests)| Disabled| Disabled| Enabled| Enabled| Disabled| Disabled| Enabled
(Changed)| Enabled
(Changed) |
| OLMLifecycleAndCompatibility
(0 tests)| | Enabled
(New)| | Enabled
(New)| | Enabled
(New)| | Enabled
(New) |
| AuthenticationComponentProxy
(0 tests)| | | | Enabled
(New)| | | | Enabled
(New) |
| BGPBasedVIPManagement
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | | |
| GCPSovereignCloudInstall
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | | |
| IngressComponentRouteLabels
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| IngressControllerMultipleHAProxyVersions
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| KarpenterOperator
(0 tests)| | | | Enabled
(New)| | | | |
| MachineAPIMigrationAzure
(0 tests)| | | | | | | | |
| MachineAPIMigrationBareMetal
(0 tests)| | | | | | | | |
| MachineAPIMigrationGCP
(0 tests)| | | | | | | | |
| MachineAPIMigrationPowerVS
(0 tests)| | | | | | | | |
| MutableTopology
(0 tests)| | | | Enabled
(New)| | | | |
| NetworkObservabilityInstall
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| SELinuxMountGAReadiness
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| TLSGroupPreferences
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
### New images
* [cluster-update-console-plugin](https://github.com/openshift/cluster-update-console-plugin) git [e222a514](https://github.com/openshift/cluster-update-console-plugin/commit/e222a514a3f1977cdc99bbf41d405729aba2d910) `sha256:299349c1622e962e9ec3f398744302769ff9efea5799e42280cec1b80f0763d2`
* [driver-toolkit-10](https://github.com/openshift/driver-toolkit) git [7ec03cbb](https://github.com/openshift/driver-toolkit/commit/7ec03cbba69b4dc86ee33e313bad32ae2ea2924e) `sha256:f0b9136cf83a99ec81c00302b22d268c13f164382512737a0eac668b672d9bb5`
* [haproxy-router-haproxy28](https://github.com/openshift/router) git [682319a1](https://github.com/openshift/router/commit/682319a1bb432f0203951c33336d0f55947e1099) `sha256:7bcf781876036c5f83ddcf34e7bed57b09f78fd74ff5800d49b19c74159624e5`
* [haproxy-router-haproxy32](https://github.com/openshift/router) git [682319a1](https://github.com/openshift/router/commit/682319a1bb432f0203951c33336d0f55947e1099) `sha256:d32f1eef829e19c5571f269cb74e34ba7a57bcf164178f091833a8506f9105c6`
* [karpenter-operator](https://github.com/openshift/karpenter-operator) git [79a93d5b](https://github.com/openshift/karpenter-operator/commit/79a93d5b4221424832a247a618e20b8177ec71ed) `sha256:30cf99f18da57a40d78760fb79378e2c438639623cdcaba0c3657f0cf7bf9600`
### Removed images
* oc-mirror
### Rebuilt images without code change
* [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator) git [72835e43](https://github.com/openshift/kubernetes-kube-storage-version-migrator/commit/72835e43c7754356645e41031f3a99926b4d42e6) `sha256:7419469843d25f28bcd0a90b363a0c9b6766f77c99f0f791da9a5700b532cbaa`
* [multus-route-override-cni](https://github.com/openshift/route-override-cni) git [08af4127](https://github.com/openshift/route-override-cni/commit/08af4127c77976510cad1c096d9aca977d8ae5af) `sha256:62b3fc7e004dfa88ccf3c39ba26cb3b51419cffc80578d58bbbed0ba9cb2d3e3`
* [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs) git [e88cf81d](https://github.com/openshift/machine-api-provider-powervs/commit/e88cf81dd9ad174f395b86f9cdc40fa30cb06bf4) `sha256:d65c678ea35016ab45b46d0053ca4cef2c64f7cd72934571117ff521485a3c71`
### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/f46558c1df1388bc21448ae7fd3b249febb29798)
* NO-ISSUE: [master] Bump OCP versions: 4.13, 4.18, 4.19 [#10710](https://github.com/openshift/assisted-service/pull/10710)
* [ACM-35865](https://issues.redhat.com/browse/ACM-35865): CVE-2026-39828 Bump golang.org/x/crypto to v0.52.0 using replace directive (client module) [#10617](https://github.com/openshift/assisted-service/pull/10617)
* [MGMT-23744](https://issues.redhat.com/browse/MGMT-23744): CVE-2026-33997 Bump docker/docker to v28.5.2 [#10685](https://github.com/openshift/assisted-service/pull/10685)
* NO-ISSUE: [master] Bump OCP versions: 4.16, 4.14, 4.22, 4.21, 4.19, 4.20, 4.18 [#10692](https://github.com/openshift/assisted-service/pull/10692)
* [MGMT-24667](https://issues.redhat.com/browse/MGMT-24667): Fix disconnected ZTP spoke installs for OCP 5.0 OSImageStream images [#10527](https://github.com/openshift/assisted-service/pull/10527)
* [MGMT-24699](https://issues.redhat.com/browse/MGMT-24699): Assisted Service IPv6 CIDR comparison may fail with non-normalized CIDRs [#10569](https://github.com/openshift/assisted-service/pull/10569)
* [MGMT-24327](https://issues.redhat.com/browse/MGMT-24327): upgrade assisted-service postgresql from 15 to 16 [#10519](https://github.com/openshift/assisted-service/pull/10519)
* [ACM-35865](https://issues.redhat.com/browse/ACM-35865): CVE-2026-39828 Bump golang.org/x/crypto to v0.52.0 using replace directive (api module) [#10618](https://github.com/openshift/assisted-service/pull/10618)
* [ACM-35865](https://issues.redhat.com/browse/ACM-35865): CVE-2026-39828 Bump golang.org/x/crypto to v0.52.0 using replace directive (models module) [#10616](https://github.com/openshift/assisted-service/pull/10616)
* NO-ISSUE: [master] Bump OCP versions: 4.18, 5.0, 4.20, 4.16, 4.22, 4.19, 4.21, 4.14, 4.17 [#10622](https://github.com/openshift/assisted-service/pull/10622)
* [MGMT-24786](https://issues.redhat.com/browse/MGMT-24786): Add resource-scoped authorization for local auth tokens [#10603](https://github.com/openshift/assisted-service/pull/10603)
* NO-ISSUE: Refresh RPM lockfiles RPM lockfile refresh [#10581](https://github.com/openshift/assisted-service/pull/10581)
* [MGMT-18886](https://issues.redhat.com/browse/MGMT-18886): OS Streams [#10428](https://github.com/openshift/assisted-service/pull/10428)
* NO-ISSUE: hive-operator was migrated from community-operators to upstream-community-operators [#10600](https://github.com/openshift/assisted-service/pull/10600)
* [MGMT-24682](https://issues.redhat.com/browse/MGMT-24682): Remove LSO and LVMS as CNV operator dependencies [#10541](https://github.com/openshift/assisted-service/pull/10541)
* [MGMT-24705](https://issues.redhat.com/browse/MGMT-24705): CVE-2026-53488 Bump github.com/containerd/containerd to v1.7.33 through indirect dependency conversion [#10572](https://github.com/openshift/assisted-service/pull/10572)
* [ACM-36420](https://issues.redhat.com/browse/ACM-36420): CVE-2026-39821 Bump golang.org/x/net to v0.55.0 [#10548](https://github.com/openshift/assisted-service/pull/10548)
* NO-ISSUE: [master] Bump OCP versions: 4.21, 4.22, 4.20 [#10568](https://github.com/openshift/assisted-service/pull/10568)
* [MGMT-24400](https://issues.redhat.com/browse/MGMT-24400): Document TestVersion API and usage guidance [#10426](https://github.com/openshift/assisted-service/pull/10426)
* NO-ISSUE: [master] Bump OCP versions: 4.20, 4.21, 4.18, 4.19, 4.13, 4.22, 4.16, 5.0 [#10546](https://github.com/openshift/assisted-service/pull/10546)
* [MGMT-24673](https://issues.redhat.com/browse/MGMT-24673): PATCH /v2/clusters/{id} does not return updated operator_bundles [#10536](https://github.com/openshift/assisted-service/pull/10536)
* NO-ISSUE: Update linter version [#10509](https://github.com/openshift/assisted-service/pull/10509)
* [APPSRE-14691](https://issues.redhat.com/browse/APPSRE-14691): add monitoring.rhobs/v1 ServiceMonitors for COO compatibility [#10540](https://github.com/openshift/assisted-service/pull/10540)
* [OCPBUGS-93368](https://issues.redhat.com/browse/OCPBUGS-93368): Simplify IRI api dependency [#10528](https://github.com/openshift/assisted-service/pull/10528)
* NO-ISSUE: Refresh RPM lockfiles RPM lockfile refresh [SECURITY] [#10523](https://github.com/openshift/assisted-service/pull/10523)
* [MGMT-24443](https://issues.redhat.com/browse/MGMT-24443): watch configmap for CNI config update [#10384](https://github.com/openshift/assisted-service/pull/10384)
* [OCPBUGS-91974](https://issues.redhat.com/browse/OCPBUGS-91974): Stop setting DevPreviewNoUpgrade for TNF clusters [#10507](https://github.com/openshift/assisted-service/pull/10507)
* [MGMT-24635](https://issues.redhat.com/browse/MGMT-24635): Incorrect grammar in OpenShift AI GPU validation message [#10511](https://github.com/openshift/assisted-service/pull/10511)
* [ACM-35864](https://issues.redhat.com/browse/ACM-35864): CVE-2026-39828/39829/39830 Bump golang.org/x/crypto to v0.52.0 [#10495](https://github.com/openshift/assisted-service/pull/10495)
* [MGMT-24453](https://issues.redhat.com/browse/MGMT-24453): upgrade to golang 1.26 for assisted-service [#10396](https://github.com/openshift/assisted-service/pull/10396)
* [MGMT-24610](https://issues.redhat.com/browse/MGMT-24610): Get OCP lifecycle data via api/v2 and update the product's name [#10478](https://github.com/openshift/assisted-service/pull/10478)
* [ACM-34978](https://issues.redhat.com/browse/ACM-34978): apply disk encryption defaults on cluster create and update [#10442](https://github.com/openshift/assisted-service/pull/10442)
* [OCPBUGS-87099](https://issues.redhat.com/browse/OCPBUGS-87099): Add sourcedir /run/chrony-dhcp to generated chrony.conf [#10479](https://github.com/openshift/assisted-service/pull/10479)
* [MGMT-21368](https://issues.redhat.com/browse/MGMT-21368): Log slow queries gorm [#10457](https://github.com/openshift/assisted-service/pull/10457)
* [MGMT-23234](https://issues.redhat.com/browse/MGMT-23234): [BE] Improve the UX around the amd/nvidia operators selection - add profile to selection [#10387](https://github.com/openshift/assisted-service/pull/10387)
* [MGMT-24398](https://issues.redhat.com/browse/MGMT-24398), [MGMT-24399](https://issues.redhat.com/browse/MGMT-24399): Migrate test versions to OCP version builder [#10412](https://github.com/openshift/assisted-service/pull/10412)
* [MGMT-22787](https://issues.redhat.com/browse/MGMT-22787): Limit inventory output [#10374](https://github.com/openshift/assisted-service/pull/10374)
* [ACM-35140](https://issues.redhat.com/browse/ACM-35140): CVE-2025-58058 Bump github.com/ulikunitz/xz to v0.5.15 [#10450](https://github.com/openshift/assisted-service/pull/10450)
* NO-ISSUE: [master] Bump OCP versions: 5.0, 4.21 [#10472](https://github.com/openshift/assisted-service/pull/10472)
* [ACM-35141](https://issues.redhat.com/browse/ACM-35141): CVE-2025-58058 Bump github.com/ulikunitz/xz to v0.5.15 through indirect dependency conversion [#10461](https://github.com/openshift/assisted-service/pull/10461)
* [MGMT-24571](https://issues.redhat.com/browse/MGMT-24571): Fix initrd PPI reboot loop by comparing correct image URL [#10456](https://github.com/openshift/assisted-service/pull/10456)
* NO-ISSUE: [master] Bump OCP versions: 4.19 [#10449](https://github.com/openshift/assisted-service/pull/10449)
* [MGMT-24551](https://issues.redhat.com/browse/MGMT-24551): Add vNIC NFD rule and refine NIC subsystem matchers [#10448](https://github.com/openshift/assisted-service/pull/10448)
* [MGMT-24336](https://issues.redhat.com/browse/MGMT-24336): Bump LSO catalog fallback to v4.22 for OCP 5.0 [#10437](https://github.com/openshift/assisted-service/pull/10437)
* [MGMT-24410](https://issues.redhat.com/browse/MGMT-24410): Fixes for installer cache [#10397](https://github.com/openshift/assisted-service/pull/10397)
* [MGMT-24550](https://issues.redhat.com/browse/MGMT-24550): Migrate NFD NodeFeatureRule apiVersion to nfd.k8s-sigs.io [#10444](https://github.com/openshift/assisted-service/pull/10444)
* [OCPEDGE-2692](https://issues.redhat.com/browse/OCPEDGE-2692): feat: support MAC address fencing credentials in ABI flow [#10385](https://github.com/openshift/assisted-service/pull/10385)
* [MGMT-24339](https://issues.redhat.com/browse/MGMT-24339): Prepare 4.22 stable versions assisted-service upstream [#10440](https://github.com/openshift/assisted-service/pull/10440)
* NO-ISSUE: [master] Bump OCP versions: 4.22 [#10445](https://github.com/openshift/assisted-service/pull/10445)
* NO-ISSUE: Update OCP 5.0 OS images to use released 4.22 RHCOS [#10441](https://github.com/openshift/assisted-service/pull/10441)
* [MGMT-24495](https://issues.redhat.com/browse/MGMT-24495): Fix S3 additional_name and file_name [#10432](https://github.com/openshift/assisted-service/pull/10432)
* [MGMT-24496](https://issues.redhat.com/browse/MGMT-24496): Allow spaces between the value and unit for installcache [#10433](https://github.com/openshift/assisted-service/pull/10433)
* NO-ISSUE: [master] Bump OCP versions: 4.18, 4.22, 4.20, 4.13 [#10436](https://github.com/openshift/assisted-service/pull/10436)
* [MGMT-22787](https://issues.redhat.com/browse/MGMT-22787): Add enhancement doc to limit inventory size [#10410](https://github.com/openshift/assisted-service/pull/10410)
* NO-ISSUE: [master] Bump OCP versions: 4.22, 4.21 [#10427](https://github.com/openshift/assisted-service/pull/10427)
* [MGMT-24397](https://issues.redhat.com/browse/MGMT-24397): Add OCP test version builder & PoC [#10321](https://github.com/openshift/assisted-service/pull/10321)
* [MGMT-23738](https://issues.redhat.com/browse/MGMT-23738): Flaky test: "Move Agent to another infraenv" fails with Kubernetes conflict error [#10319](https://github.com/openshift/assisted-service/pull/10319)
* NO-ISSUE: [master] Bump OCP versions: 4.16 [#10423](https://github.com/openshift/assisted-service/pull/10423)
* [MGMT-19732](https://issues.redhat.com/browse/MGMT-19732): Add ntp_sources field for exclusive NTP configuration [#10408](https://github.com/openshift/assisted-service/pull/10408)
* [MGMT-22370](https://issues.redhat.com/browse/MGMT-22370): Add exponential backoff to agent image pull [#10337](https://github.com/openshift/assisted-service/pull/10337)
* [MGMT-24243](https://issues.redhat.com/browse/MGMT-24243): Add option for a delay when applying static network config on minimal ISO [#10373](https://github.com/openshift/assisted-service/pull/10373)
* NO-ISSUE: [master] Bump OCP versions: 4.19, 4.22 [#10402](https://github.com/openshift/assisted-service/pull/10402)
* NO-ISSUE: add Assisted-by commit trailer convention to CLAUDE.md [#10400](https://github.com/openshift/assisted-service/pull/10400)
* NO-ISSUE: [master] Bump OCP versions: 4.21, 5.0 [#10392](https://github.com/openshift/assisted-service/pull/10392)
* [MGMT-21836](https://issues.redhat.com/browse/MGMT-21836): Allow external platform with non-standard HA control plane [#10286](https://github.com/openshift/assisted-service/pull/10286)
* [MGMT-23230](https://issues.redhat.com/browse/MGMT-23230): Add MachineConfig for AMD GPU kernel module blacklist [#9920](https://github.com/openshift/assisted-service/pull/9920)
* [MGMT-24457](https://issues.redhat.com/browse/MGMT-24457): Add MI350P PCI device IDs to NFD NodeFeatureRule [#10388](https://github.com/openshift/assisted-service/pull/10388)
* [MGMT-24393](https://issues.redhat.com/browse/MGMT-24393): Assisted Service IPv6 checks fails comparative [#10340](https://github.com/openshift/assisted-service/pull/10340)
* NO-ISSUE: [master] Bump OCP versions: 4.17, 4.20, 4.18 [#10383](https://github.com/openshift/assisted-service/pull/10383)
* NO-ISSUE: [master] Bump OCP versions: 4.21, 4.22 [#10348](https://github.com/openshift/assisted-service/pull/10348)
* NO-ISSUE: Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26 [#10354](https://github.com/openshift/assisted-service/pull/10354)
* NO-ISSUE: Fix resource leak and inconsistency in manifest download [#10322](https://github.com/openshift/assisted-service/pull/10322)
* [MGMT-21834](https://issues.redhat.com/browse/MGMT-21834): deprecate supported-platforms endpoint [#10122](https://github.com/openshift/assisted-service/pull/10122)
* NO-ISSUE: [master] Bump OCP versions: 4.14, 4.19, 4.18, 4.21, 4.20, 4.16 [#10342](https://github.com/openshift/assisted-service/pull/10342)
* NO-ISSUE: fix typo: 'occured' -> 'occurred' in main.go error wraps [#10316](https://github.com/openshift/assisted-service/pull/10316)
* NO-ISSUE: increase the timout waiting for assisted-image-service [#10327](https://github.com/openshift/assisted-service/pull/10327)
* [MGMT-20634](https://issues.redhat.com/browse/MGMT-20634): Revert mac-identifier and global DNS workarounds as RHEL-91250 and RHEL-72440 resolved [#10318](https://github.com/openshift/assisted-service/pull/10318)
* [ACM-33836](https://issues.redhat.com/browse/ACM-33836): CVE-2026-35469 bump github.com/moby/spdystream [#10314](https://github.com/openshift/assisted-service/pull/10314)
* NO-ISSUE: [master] Bump OCP versions: 4.22, 4.13, 4.16, 4.17 [#10296](https://github.com/openshift/assisted-service/pull/10296)
* NO-ISSUE: [master] Bump OCP versions: 4.21, 4.20, 4.18, 4.19 [#10287](https://github.com/openshift/assisted-service/pull/10287)
* [MGMT-19930](https://issues.redhat.com/browse/MGMT-19930): upgrade PostgreSQL stack to pgx v5 and ocm-sdk-go v0.1.499 [#10230](https://github.com/openshift/assisted-service/pull/10230)
* NO-ISSUE: [master] Bump OCP versions: 4.21 [#10284](https://github.com/openshift/assisted-service/pull/10284)
* [MGMT-24236](https://issues.redhat.com/browse/MGMT-24236): Exclude post-installation hosts from pending-user-action timeout [#10266](https://github.com/openshift/assisted-service/pull/10266)
* [MGMT-24138](https://issues.redhat.com/browse/MGMT-24138): Order network by bootstrap host [#10257](https://github.com/openshift/assisted-service/pull/10257)
* NO-ISSUE: Remove unused RegisterAddHostsOCPCluster functions [#10265](https://github.com/openshift/assisted-service/pull/10265)
* NO-ISSUE: [master] Bump OCP versions: 4.16, 5.0, 4.22 [#10272](https://github.com/openshift/assisted-service/pull/10272)
* [MGMT-24119](https://issues.redhat.com/browse/MGMT-24119): Correct the namespace to install Loki Operator as "openshift-operators-redhat" instead of "openshift-loki" [#10209](https://github.com/openshift/assisted-service/pull/10209)
* [MGMT-23755](https://issues.redhat.com/browse/MGMT-23755): Validate & trim MCS certificates when adding to ignition override [#10262](https://github.com/openshift/assisted-service/pull/10262)
* NO-ISSUE: [master] Bump OCP versions: 4.21, 4.19 [#10263](https://github.com/openshift/assisted-service/pull/10263)
* [MGMT-23680](https://issues.redhat.com/browse/MGMT-23680): CVE-2026-32285 Bump github.com/buger/jsonparser to v1.1.2 [#10240](https://github.com/openshift/assisted-service/pull/10240)
* NO-ISSUE: Update operator bundle channel to backplane-5.0 [#10215](https://github.com/openshift/assisted-service/pull/10215)
* [MGMT-24115](https://issues.redhat.com/browse/MGMT-24115): allow empty image checksum/url in getChecksumAndURL [#10246](https://github.com/openshift/assisted-service/pull/10246)
* [MGMT-23971](https://issues.redhat.com/browse/MGMT-23971): Add a timeout for installing-pending-user-action [#10202](https://github.com/openshift/assisted-service/pull/10202)
* NO-ISSUE: Modify Konflux YAMLs to backplane-5.0 [#10237](https://github.com/openshift/assisted-service/pull/10237)
* [MGMT-23802](https://issues.redhat.com/browse/MGMT-23802): Fix manifest format in log bundles [#10121](https://github.com/openshift/assisted-service/pull/10121)
* [MGMT-23861](https://issues.redhat.com/browse/MGMT-23861): Fix oci detection for day2 clusters [#10231](https://github.com/openshift/assisted-service/pull/10231)
* NO-ISSUE: [master] Bump OCP versions: 4.22 [#10220](https://github.com/openshift/assisted-service/pull/10220)
* [ACM-33186](https://issues.redhat.com/browse/ACM-33186): Revert Renovate configuration for Hive updates [#10203](https://github.com/openshift/assisted-service/pull/10203)
* [MGMT-23553](https://issues.redhat.com/browse/MGMT-23553): Automate events table bloat cleanup [#10140](https://github.com/openshift/assisted-service/pull/10140)
* [MGMT-23665](https://issues.redhat.com/browse/MGMT-23665): fixing CVE-2026-33186 [#10173](https://github.com/openshift/assisted-service/pull/10173)
* NO-ISSUE: Allow restoring soft deleted hosts [#10185](https://github.com/openshift/assisted-service/pull/10185)
* NO-ISSUE: [master] Bump OCP versions: 4.20, 4.21, 4.22, 4.18 [#10201](https://github.com/openshift/assisted-service/pull/10201)
* NO-ISSUE: Bump go modules and linters [#10181](https://github.com/openshift/assisted-service/pull/10181)
* [MGMT-23861](https://issues.redhat.com/browse/MGMT-23861): Revert MGMT-22385 for oci iscsi day2 [#10170](https://github.com/openshift/assisted-service/pull/10170)
* [ACM-32996](https://issues.redhat.com/browse/ACM-32996): Missing nil check in BMACReconciler causes controller panic [#10164](https://github.com/openshift/assisted-service/pull/10164)
* [MGMT-23920](https://issues.redhat.com/browse/MGMT-23920): 4.22 SNO doesn't support 4 cpu cores node [#10153](https://github.com/openshift/assisted-service/pull/10153)
* NO-ISSUE: add shay23bra to owners [#10163](https://github.com/openshift/assisted-service/pull/10163)
* NO-ISSUE: [master] Bump OCP versions: 4.13, 4.19 [#10162](https://github.com/openshift/assisted-service/pull/10162)
* NO-ISSUE: Remove urlAuth from credentials endpoint [#10161](https://github.com/openshift/assisted-service/pull/10161)
* [MCO-2223](https://issues.redhat.com/browse/MCO-2223): Add osImageStream install-config overrides [#10156](https://github.com/openshift/assisted-service/pull/10156)
* NO-ISSUE: [master] Bump OCP versions: 4.21 [#10152](https://github.com/openshift/assisted-service/pull/10152)
* NO-ISSUE: [master] Bump OCP versions: 4.22, 4.18, 4.20 [#10146](https://github.com/openshift/assisted-service/pull/10146)
* [OCPBUGS-79576](https://issues.redhat.com/browse/OCPBUGS-79576): Mark raw FC/iSCSI multipath members as ineligible [#10142](https://github.com/openshift/assisted-service/pull/10142)
* [OCPBUGS-83401](https://issues.redhat.com/browse/OCPBUGS-83401): Fix IRI patcher feature check [#10141](https://github.com/openshift/assisted-service/pull/10141)
* [MGMT-23227](https://issues.redhat.com/browse/MGMT-23227): Skip host operator validation for day2 clusters [#10029](https://github.com/openshift/assisted-service/pull/10029)
* [ACM-32735](https://issues.redhat.com/browse/ACM-32735): Add better API docs to CRDs [#10124](https://github.com/openshift/assisted-service/pull/10124)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/assisted-service/compare/aed50cb7f9a7dd63dd865dfae9afb6844a2dd787...f46558c1df1388bc21448ae7fd3b249febb29798)
### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/e4afa401ce7d4f8a24a857fd2edf3338fef1556e)
* [MGMT-24702](https://issues.redhat.com/browse/MGMT-24702): CVE-2026-53488 Bump github.com/containerd/containerd to v1.7.33 [#2204](https://github.com/openshift/assisted-installer/pull/2204)
* NO-ISSUE: Bump linter [#2199](https://github.com/openshift/assisted-installer/pull/2199)
* [MGMT-24453](https://issues.redhat.com/browse/MGMT-24453): upgrade to golang 1.26 [#2171](https://github.com/openshift/assisted-installer/pull/2171)
* NO-ISSUE: Refresh RPM lockfiles [#2182](https://github.com/openshift/assisted-installer/pull/2182)
* NO-ISSUE: Refresh RPM lockfiles [#2160](https://github.com/openshift/assisted-installer/pull/2160)
* [MGMT-23784](https://issues.redhat.com/browse/MGMT-23784): CVE-2026-34986 Bump github.com/go-jose/go-jose/v3 to v3.0.5 using replace directive [#2121](https://github.com/openshift/assisted-installer/pull/2121)
* NO-ISSUE: Modify Konflux YAMLs to backplane-5.0 [#2119](https://github.com/openshift/assisted-installer/pull/2119)
* [ACM-33186](https://issues.redhat.com/browse/ACM-33186): Revert Renovate configuration for Hive updates [#2107](https://github.com/openshift/assisted-installer/pull/2107)
* NO-ISSUE: upgrade go.opentelemetry.io/otel/sdk to … [#2097](https://github.com/openshift/assisted-installer/pull/2097)
* [MGMT-23789](https://issues.redhat.com/browse/MGMT-23789): CVE-2026-34986 Bump github.com/go-jose/go-jose/v4 to v4.1.4 through indirect dependency conversion [#2081](https://github.com/openshift/assisted-installer/pull/2081)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/a9bfcccdade3dec5e6d71dbbc6e03fe137a1660b...e4afa401ce7d4f8a24a857fd2edf3338fef1556e)
### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/bfa655c8a4905031aab68000b84535674413f3b4)
* NO-ISSUE: Refresh RPM lockfiles RPM lockfile refresh [#1555](https://github.com/openshift/assisted-installer-agent/pull/1555)
* [MGMT-24703](https://issues.redhat.com/browse/MGMT-24703): CVE-2026-53488 Bump github.com/containerd/containerd to v1.7.33 through indirect dependency conversion [#1531](https://github.com/openshift/assisted-installer-agent/pull/1531)
* NO-ISSUE: Refresh RPM lockfiles RPM lockfile refresh [SECURITY] [#1520](https://github.com/openshift/assisted-installer-agent/pull/1520)
* NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.12.2 [#1515](https://github.com/openshift/assisted-installer-agent/pull/1515)
* [MGMT-24453](https://issues.redhat.com/browse/MGMT-24453): upgrade to golang 1.26 [#1509](https://github.com/openshift/assisted-installer-agent/pull/1509)
* [MGMT-22787](https://issues.redhat.com/browse/MGMT-22787): Log inventory when it's too big [#1510](https://github.com/openshift/assisted-installer-agent/pull/1510)
* [MGMT-22787](https://issues.redhat.com/browse/MGMT-22787): Limit inventory output [#1474](https://github.com/openshift/assisted-installer-agent/pull/1474)
* [MGMT-24376](https://issues.redhat.com/browse/MGMT-24376): Report InfiniBand NIC speed from HCA sysfs path [#1492](https://github.com/openshift/assisted-installer-agent/pull/1492)
* NO-ISSUE: Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26 [#1461](https://github.com/openshift/assisted-installer-agent/pull/1461)
* NO-ISSUE: Upgrade linter [#1453](https://github.com/openshift/assisted-installer-agent/pull/1453)
* NO-ISSUE: Modify Konflux YAMLs to backplane-5.0 [#1431](https://github.com/openshift/assisted-installer-agent/pull/1431)
* [ACM-31642](https://issues.redhat.com/browse/ACM-31642): fix CVE-2026-33186 [#1417](https://github.com/openshift/assisted-installer-agent/pull/1417)
* [OCPBUGS-63472](https://issues.redhat.com/browse/OCPBUGS-63472): add --copy-network when manual network config is detected [#1374](https://github.com/openshift/assisted-installer-agent/pull/1374)
* [MGMT-23790](https://issues.redhat.com/browse/MGMT-23790): CVE-2026-34986 Bump github.com/go-jose/go-jose/v4 to v4.1.4 through indirect dependency conversion [#1404](https://github.com/openshift/assisted-installer-agent/pull/1404)
* NO-ISSUE: Refactor flag Parsing to avoid multiple calls [#1401](https://github.com/openshift/assisted-installer-agent/pull/1401)
* NO-ISSUE: Refresh RPM lockfiles [#1389](https://github.com/openshift/assisted-installer-agent/pull/1389)
* [MGMT-23300](https://issues.redhat.com/browse/MGMT-23300): Ensure /boot dir has enough space during reclaim [#1316](https://github.com/openshift/assisted-installer-agent/pull/1316)
* [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/008935c33fb03bb246c22f8873da7599ec30aa2c...bfa655c8a4905031aab68000b84535674413f3b4)
### [agent-installer-ui](https://github.com/openshift-assisted/assisted-installer-ui/tree/149443766b2bc3f3106bd2496de746303d829b7f)
* Bump shell-quote from 1.8.4 to 1.10.0 (#3909) [#3909](https://github.com/openshift-assisted/assisted-installer-ui/pull/3909)
* Bump body-parser from 1.20.4 to 1.20.6 (#3911) [#3911](https://github.com/openshift-assisted/assisted-installer-ui/pull/3911)
* Bump fast-uri from 3.1.2 to 3.1.4 (#3910) [#3910](https://github.com/openshift-assisted/assisted-installer-ui/pull/3910)
* [OCPBUGS-99039](https://issues.redhat.com/browse/OCPBUGS-99039): Bump dompurify to 3.4.7+ in 5.0 (#3894) [#3894](https://github.com/openshift-assisted/assisted-installer-ui/pull/3894)
* Update build_tools (#3901) [#3901](https://github.com/openshift-assisted/assisted-installer-ui/pull/3901)
* Fix operator Learn more documentation links and remove duplicates (#3899) [#3899](https://github.com/openshift-assisted/assisted-installer-ui/pull/3899)
* chore(deps): update dependency sanitize-html to ^2.17.6 (#3897) [#3897](https://github.com/openshift-assisted/assisted-installer-ui/pull/3897)
* Bump websocket-driver from 0.7.4 to 0.7.5 (#3891) [#3891](https://github.com/openshift-assisted/assisted-installer-ui/pull/3891)
* chore(deps): update dependency tar to ^7.5.20 (#3898) [#3898](https://github.com/openshift-assisted/assisted-installer-ui/pull/3898)
* chore(deps): update konflux references (#3896) [#3896](https://github.com/openshift-assisted/assisted-installer-ui/pull/3896)
* Upgrade node version in Containerfile (#3872) [#3872](https://github.com/openshift-assisted/assisted-installer-ui/pull/3872)
* Apply patches (#3819) [#3819](https://github.com/openshift-assisted/assisted-installer-ui/pull/3819)
* Upgrade path-to-regexp to ^8.4.2 (#3862) [#3862](https://github.com/openshift-assisted/assisted-installer-ui/pull/3862)
* Upgrade sanitize-html to ^2.17.4 (#3861) [#3861](https://github.com/openshift-assisted/assisted-installer-ui/pull/3861)
* Dedupe yarn.lock (#3863) [#3863](https://github.com/openshift-assisted/assisted-installer-ui/pull/3863)
* Upgrade terser-webpack-plugin to ^5.6.1 (#3818) [#3818](https://github.com/openshift-assisted/assisted-installer-ui/pull/3818)
* chore(deps): update typescript type definitions (non-major) (#3867) [#3867](https://github.com/openshift-assisted/assisted-installer-ui/pull/3867)
* chore(deps): update dependency axios to ^1.18.1 (#3868) [#3868](https://github.com/openshift-assisted/assisted-installer-ui/pull/3868)
* chore(deps): update konflux references (#3866) [#3866](https://github.com/openshift-assisted/assisted-installer-ui/pull/3866)
* Upgrade brace-expansion to ^5.0.8 (#3855) [#3855](https://github.com/openshift-assisted/assisted-installer-ui/pull/3855)
* [OCPBUGS-96781](https://issues.redhat.com/browse/OCPBUGS-96781): Bump webpack-dev-server to 5.2.5 (#3822) [#3822](https://github.com/openshift-assisted/assisted-installer-ui/pull/3822)
* chore(deps): update dependency tar to ^7.5.19 (#3826) [#3826](https://github.com/openshift-assisted/assisted-installer-ui/pull/3826)
* no-jira: Bump axios to latest (1.18.1) (#3856) [#3856](https://github.com/openshift-assisted/assisted-installer-ui/pull/3856)
* [OCPBUGS-97734](https://issues.redhat.com/browse/OCPBUGS-97734): Increase default imageStorage to 100Gi and raise minimum to 50Gi (#3820) [#3820](https://github.com/openshift-assisted/assisted-installer-ui/pull/3820)
* Show all operators on cluster installation page (#3849) [#3849](https://github.com/openshift-assisted/assisted-installer-ui/pull/3849)
* Update OWNERS file (#3850) [#3850](https://github.com/openshift-assisted/assisted-installer-ui/pull/3850)
* chore(deps): update dependency serialize-javascript to ^7.0.7 (#3825) [#3825](https://github.com/openshift-assisted/assisted-installer-ui/pull/3825)
* chore(deps): update konflux references (#3824) [#3824](https://github.com/openshift-assisted/assisted-installer-ui/pull/3824)
* Bump js-yaml from 3.14.1 to 4.3.0 (#3814) [#3814](https://github.com/openshift-assisted/assisted-installer-ui/pull/3814)
* Fix dependency ordering (#3812) [#3812](https://github.com/openshift-assisted/assisted-installer-ui/pull/3812)
* Fix machine network autoselect to work with IPv6 only clusters (#3813) [#3813](https://github.com/openshift-assisted/assisted-installer-ui/pull/3813)
* Upgrade shell-quote to ^1.8.4 (#3800) [#3800](https://github.com/openshift-assisted/assisted-installer-ui/pull/3800)
* [ACM-35000](https://issues.redhat.com/browse/ACM-35000): Update @openshift-assisted/ui-lib for dynamic plugin SDK 4.22 and react-router 7 compatibility (#3804) [#3804](https://github.com/openshift-assisted/assisted-installer-ui/pull/3804)
* Reflect selected operators correctly (#3805) [#3805](https://github.com/openshift-assisted/assisted-installer-ui/pull/3805)
* chore(deps): update dependency qs to ^6.15.3 (#3809) [#3809](https://github.com/openshift-assisted/assisted-installer-ui/pull/3809)
* [MGMT-24431](https://issues.redhat.com/browse/MGMT-24431): Add inventory truncation validation handling to Assisted Installer UI (#3807) [#3807](https://github.com/openshift-assisted/assisted-installer-ui/pull/3807)
* chore(deps): update konflux references (#3794) [#3794](https://github.com/openshift-assisted/assisted-installer-ui/pull/3794)
* chore(deps): update dependency ip-address to ^10.2.0 (#3808) [#3808](https://github.com/openshift-assisted/assisted-installer-ui/pull/3808)
* Upgrade ip-address to ^10.1.1 (#3802) [#3802](https://github.com/openshift-assisted/assisted-installer-ui/pull/3802)
* Upgrade ws to ^8.21.0 (#3803) [#3803](https://github.com/openshift-assisted/assisted-installer-ui/pull/3803)
* Upgade tar to ^7.5.11 (#3801) [#3801](https://github.com/openshift-assisted/assisted-installer-ui/pull/3801)
* AGENT-1519 | [Below-the-sea UI] Allow the user to select IPv6 in the Networking Stack Type field (#3732) [#3732](https://github.com/openshift-assisted/assisted-installer-ui/pull/3732)
* Bump http-proxy-middleware from 2.0.9 to 2.0.10 (#3799) [#3799](https://github.com/openshift-assisted/assisted-installer-ui/pull/3799)
* chore(deps): update dependency serialize-javascript to ^7.0.6 (#3797) [#3797](https://github.com/openshift-assisted/assisted-installer-ui/pull/3797)
* Fix nested expandable sections (#3793) [#3793](https://github.com/openshift-assisted/assisted-installer-ui/pull/3793)
* [MGMT-23172](https://issues.redhat.com/browse/MGMT-23172): Improve the UX of the operators tab (#3780) [#3780](https://github.com/openshift-assisted/assisted-installer-ui/pull/3780)
* Tweak discovery ISO modal sizing (#3792) [#3792](https://github.com/openshift-assisted/assisted-installer-ui/pull/3792)
* Bump undici from 7.24.7 to 7.28.0 (#3795) [#3795](https://github.com/openshift-assisted/assisted-installer-ui/pull/3795)
* Upgrade glob to ^11.1.0 (#3774) [#3774](https://github.com/openshift-assisted/assisted-installer-ui/pull/3774)
* chore(deps): update dependency minimatch to ^10.2.5 (#3796) [#3796](https://github.com/openshift-assisted/assisted-installer-ui/pull/3796)
* Bump form-data from 4.0.5 to 4.0.6 (#3788) [#3788](https://github.com/openshift-assisted/assisted-installer-ui/pull/3788)
* Bump @babel/core from 7.29.0 to 7.29.7 (#3790) [#3790](https://github.com/openshift-assisted/assisted-installer-ui/pull/3790)
* Bump launch-editor from 2.12.0 to 2.14.1 (#3789) [#3789](https://github.com/openshift-assisted/assisted-installer-ui/pull/3789)
* Bump js-yaml from 4.1.1 to 4.2.0 (#3786) [#3786](https://github.com/openshift-assisted/assisted-installer-ui/pull/3786)
* Bump vite from 8.0.10 to 8.0.16 (#3787) [#3787](https://github.com/openshift-assisted/assisted-installer-ui/pull/3787)
* Bump tmp from 0.2.6 to 0.2.7 (#3785) [#3785](https://github.com/openshift-assisted/assisted-installer-ui/pull/3785)
* Bump joi from 17.13.0 to 17.13.4 (#3783) [#3783](https://github.com/openshift-assisted/assisted-installer-ui/pull/3783)
* Upgrade ajv to ^8.18.0 (#3778) [#3778](https://github.com/openshift-assisted/assisted-installer-ui/pull/3778)
* Upgrade minimatch to ^10.2.3 (#3779) [#3779](https://github.com/openshift-assisted/assisted-installer-ui/pull/3779)
* Upgrade axios to ^1.17.0 (#3773) [#3773](https://github.com/openshift-assisted/assisted-installer-ui/pull/3773)
* fix(deps): update typescript type definitions (non-major) (#3764) [#3764](https://github.com/openshift-assisted/assisted-installer-ui/pull/3764)
* Fix FeedbackCard types (#3776) [#3776](https://github.com/openshift-assisted/assisted-installer-ui/pull/3776)
* Upgrade serialize_javascript to ^7.0.5 (#3775) [#3775](https://github.com/openshift-assisted/assisted-installer-ui/pull/3775)
* Updating assisted-installer-ui-container image to be consistent with ART for 5.0 (#3771) [#3771](https://github.com/openshift-assisted/assisted-installer-ui/pull/3771)
* Bump vitest from 0.34.6 to 3.2.6 (#3772) [#3772](https://github.com/openshift-assisted/assisted-installer-ui/pull/3772)
* [OCPBUGS-72598](https://issues.redhat.com/browse/OCPBUGS-72598): Custom manifests are broken in local assisted UI (#3766) [#3766](https://github.com/openshift-assisted/assisted-installer-ui/pull/3766)
* [OCPBUGS-85310](https://issues.redhat.com/browse/OCPBUGS-85310): Static ip prefill for ove below the sea (#3733) [#3733](https://github.com/openshift-assisted/assisted-installer-ui/pull/3733)
* [MGMT-24099](https://issues.redhat.com/browse/MGMT-24099): UI redirects to Custom Manifest page before host discovery when cluster is OCI platform (#3739) [#3739](https://github.com/openshift-assisted/assisted-installer-ui/pull/3739)
* chore(deps): update konflux references (#3762) [#3762](https://github.com/openshift-assisted/assisted-installer-ui/pull/3762)
* [MGMT-24304](https://issues.redhat.com/browse/MGMT-24304): On disconnected environment no Openshift version is set by default on standalone cluster details page and no version is shown in the dropdown till Show all available are shown (#3723) [#3723](https://github.com/openshift-assisted/assisted-installer-ui/pull/3723)
* Bump tmp from 0.2.5 to 0.2.6 (#3760) [#3760](https://github.com/openshift-assisted/assisted-installer-ui/pull/3760)
* chore(deps): update testing packages (#3742) [#3742](https://github.com/openshift-assisted/assisted-installer-ui/pull/3742)
* Revert "OCPBUGS-84038 | [Below the sea UI] Lack of visual feedback (spinner) …" (#3757) [#3757](https://github.com/openshift-assisted/assisted-installer-ui/pull/3757)
* Fix disk encryption parsing for cluster details (#3737) [#3737](https://github.com/openshift-assisted/assisted-installer-ui/pull/3737)
* Reset search field on 'Clear all filters' (#3736) [#3736](https://github.com/openshift-assisted/assisted-installer-ui/pull/3736)
* [MGMT-24444](https://issues.redhat.com/browse/MGMT-24444): Apply sentence case to networking management type labels … (#3747) [#3747](https://github.com/openshift-assisted/assisted-installer-ui/pull/3747)
* Operators section should not be displayed on review and installation progress pages when no operators are selected (#3745) [#3745](https://github.com/openshift-assisted/assisted-installer-ui/pull/3745)
* Remove Arbiter button (#3744) [#3744](https://github.com/openshift-assisted/assisted-installer-ui/pull/3744)
* chore(deps): update typescript (#3743) [#3743](https://github.com/openshift-assisted/assisted-installer-ui/pull/3743)
* chore(deps): update konflux references (#3741) [#3741](https://github.com/openshift-assisted/assisted-installer-ui/pull/3741)
* Update Konflux Quay image address (#3740) [#3740](https://github.com/openshift-assisted/assisted-installer-ui/pull/3740)
* Bump ws from 8.18.3 to 8.20.1 (#3726) [#3726](https://github.com/openshift-assisted/assisted-installer-ui/pull/3726)
* fix monted pull secret parsing (#3692) [#3692](https://github.com/openshift-assisted/assisted-installer-ui/pull/3692)
* chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.9-1778675823 (#3720) [#3720](https://github.com/openshift-assisted/assisted-installer-ui/pull/3720)
* chore(deps): update dependency qs to ^6.15.2 (#3719) [#3719](https://github.com/openshift-assisted/assisted-installer-ui/pull/3719)
* chore(deps): update konflux references (#3718) [#3718](https://github.com/openshift-assisted/assisted-installer-ui/pull/3718)
* chore(deps): update dependency dpdm to v4 (#3555) [#3555](https://github.com/openshift-assisted/assisted-installer-ui/pull/3555)
* Implement useAgents hook for the CIM wizard (#3711) [#3711](https://github.com/openshift-assisted/assisted-installer-ui/pull/3711)
* Ugrade axios to 1.15.2 (#3710) [#3710](https://github.com/openshift-assisted/assisted-installer-ui/pull/3710)
* chore(deps): update dependency qs to ^6.15.1 (#3678) [#3678](https://github.com/openshift-assisted/assisted-installer-ui/pull/3678)
* chore(deps): update dependency eslint to ^8.57.1 (#3677) [#3677](https://github.com/openshift-assisted/assisted-installer-ui/pull/3677)
* chore(deps): update konflux references (#3707) [#3707](https://github.com/openshift-assisted/assisted-installer-ui/pull/3707)
* chore(deps): update dependency redux to ^4.2.1 (#3708) [#3708](https://github.com/openshift-assisted/assisted-installer-ui/pull/3708)
* chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.9-1778171507 (#3709) [#3709](https://github.com/openshift-assisted/assisted-installer-ui/pull/3709)
* Bump fast-uri from 3.1.0 to 3.1.2 (#3706) [#3706](https://github.com/openshift-assisted/assisted-installer-ui/pull/3706)
* OCPBUGS-84038 | [Below the sea UI] Lack of visual feedback (spinner) on disabled "Next" button during background validation (#3687) [#3687](https://github.com/openshift-assisted/assisted-installer-ui/pull/3687)
* [MGMT-23490](https://issues.redhat.com/browse/MGMT-23490): Refactor Troubleshooting Web Console (#3688) [#3688](https://github.com/openshift-assisted/assisted-installer-ui/pull/3688)
* Bump basic-ftp from 5.3.0 to 5.3.1 (#3698) [#3698](https://github.com/openshift-assisted/assisted-installer-ui/pull/3698)
* Bump ip-address from 7.1.0 to 10.1.1 (#3689) [#3689](https://github.com/openshift-assisted/assisted-installer-ui/pull/3689)
* Read from aipVIPs and ingressVIPs in getClusterProperties function (#3661) [#3661](https://github.com/openshift-assisted/assisted-installer-ui/pull/3661)
* Memoize the wizard footer on CIM Review step (#3686) [#3686](https://github.com/openshift-assisted/assisted-installer-ui/pull/3686)
* [MGMT-19002](https://issues.redhat.com/browse/MGMT-19002): [nmstate] UI form view missing autoconf field for ipv6 (#3681) [#3681](https://github.com/openshift-assisted/assisted-installer-ui/pull/3681)
* Add custom-manifests-requirements-satisfied to soft validations on networking wizard step (#3682) [#3682](https://github.com/openshift-assisted/assisted-installer-ui/pull/3682)
* OCPBUGS-84147 | [Below the sea UI] Leaky Abstraction: Transient 500 errors exposed during host binding process (#3672) [#3672](https://github.com/openshift-assisted/assisted-installer-ui/pull/3672)
* [MGMT-21857](https://issues.redhat.com/browse/MGMT-21857): [UI] - Missing "No Matching Clusters" Message (#3667) [#3667](https://github.com/openshift-assisted/assisted-installer-ui/pull/3667)
* Hide internally generated custom manifests on the Cluster Review page (#3646) [#3646](https://github.com/openshift-assisted/assisted-installer-ui/pull/3646)
* chore(deps): update konflux references (#3675) [#3675](https://github.com/openshift-assisted/assisted-installer-ui/pull/3675)
* [MGMT-23950](https://issues.redhat.com/browse/MGMT-23950): [Staging] [UI] - Cluster name missing in page header for draft clusters (#3669) [#3669](https://github.com/openshift-assisted/assisted-installer-ui/pull/3669)
* chore(deps): update dependency @reduxjs/toolkit to ^1.9.7 (#3647) [#3647](https://github.com/openshift-assisted/assisted-installer-ui/pull/3647)
* chore(deps): update dependency axios to ^1.15.2 (#3648) [#3648](https://github.com/openshift-assisted/assisted-installer-ui/pull/3648)
* [MGMT-24152](https://issues.redhat.com/browse/MGMT-24152): UI allows editing pull secret in draft cluster (#3662) [#3662](https://github.com/openshift-assisted/assisted-installer-ui/pull/3662)
* Remove 2 node arbiter option from the control plane dropdown option (#3644) [#3644](https://github.com/openshift-assisted/assisted-installer-ui/pull/3644)
* Bump postcss from 8.5.6 to 8.5.10 (#3641) [#3641](https://github.com/openshift-assisted/assisted-installer-ui/pull/3641)
* Update OWNERS file (#3643) [#3643](https://github.com/openshift-assisted/assisted-installer-ui/pull/3643)
* chore(deps): update konflux references (#3640) [#3640](https://github.com/openshift-assisted/assisted-installer-ui/pull/3640)
* chore(config): migrate config renovate.json (#3639) [#3639](https://github.com/openshift-assisted/assisted-installer-ui/pull/3639)
* [MGMT-23800](https://issues.redhat.com/browse/MGMT-23800): Upgrade Vite (#3589) [#3589](https://github.com/openshift-assisted/assisted-installer-ui/pull/3589)
* chore(deps): update dependency msw to v2.13.5 (#3587) [#3587](https://github.com/openshift-assisted/assisted-installer-ui/pull/3587)
* chore(deps): update dependency @vitejs/plugin-react-swc to v4 (#3553) [#3553](https://github.com/openshift-assisted/assisted-installer-ui/pull/3553)
* chore(deps): update dependency happy-dom to v20.9.0 (#3591) [#3591](https://github.com/openshift-assisted/assisted-installer-ui/pull/3591)
* Add renovate.json (#3637) [#3637](https://github.com/openshift-assisted/assisted-installer-ui/pull/3637)
* chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.8-1776962329 (#3588) [#3588](https://github.com/openshift-assisted/assisted-installer-ui/pull/3588)
* chore(deps): update dependency @redhat-cloud-services/eslint-config-redhat-cloud-services to v3.1.0 (#3577) [#3577](https://github.com/openshift-assisted/assisted-installer-ui/pull/3577)
* chore(deps): update dependency @types/uuid to v11 (#3544) [#3544](https://github.com/openshift-assisted/assisted-installer-ui/pull/3544)
* chore(deps): update yarn to v3.8.7 (#3495) [#3495](https://github.com/openshift-assisted/assisted-installer-ui/pull/3495)
* Add cursor rules for imports (#3595) [#3595](https://github.com/openshift-assisted/assisted-installer-ui/pull/3595)
* NO-ISSUE: Cursor rules for comments and variables (#3592) [#3592](https://github.com/openshift-assisted/assisted-installer-ui/pull/3592)
* Add CLAUDE.md (#3632) [#3632](https://github.com/openshift-assisted/assisted-installer-ui/pull/3632)
* Bump uuid from 8.3.2 to 14.0.0 (#3629) [#3629](https://github.com/openshift-assisted/assisted-installer-ui/pull/3629)
* Bump follow-redirects from 1.15.11 to 1.16.0 (#3586) [#3586](https://github.com/openshift-assisted/assisted-installer-ui/pull/3586)
* [ACM-30344](https://issues.redhat.com/browse/ACM-30344): ACM Console should support ClusterImageSets with by-digest pullspecs (#3609) [#3609](https://github.com/openshift-assisted/assisted-installer-ui/pull/3609)
* Allow to install SNO topology (#3578) [#3578](https://github.com/openshift-assisted/assisted-installer-ui/pull/3578)
* Support third party CNI in CIM (#3600) [#3600](https://github.com/openshift-assisted/assisted-installer-ui/pull/3600)
* Fix Cisco Intersight editing (#3523) [#3523](https://github.com/openshift-assisted/assisted-installer-ui/pull/3523)
* Pull secret appears editable in draft cluster but changes are not applied (#3597) [#3597](https://github.com/openshift-assisted/assisted-installer-ui/pull/3597)
* fix operators list in ABI below the sea (#3590) [#3590](https://github.com/openshift-assisted/assisted-installer-ui/pull/3590)
* [MGMT-23913](https://issues.redhat.com/browse/MGMT-23913): Missing breadcrumbs in on-prem Assisted Installer (#3598) [#3598](https://github.com/openshift-assisted/assisted-installer-ui/pull/3598)
* Update build-tools (#3593) [#3593](https://github.com/openshift-assisted/assisted-installer-ui/pull/3593)
* Upgrade lodash to 4.18.1 (#3566) [#3566](https://github.com/openshift-assisted/assisted-installer-ui/pull/3566)
* Bump basic-ftp from 5.2.1 to 5.3.0 (#3594) [#3594](https://github.com/openshift-assisted/assisted-installer-ui/pull/3594)
* [OCPBUGS-83428](https://issues.redhat.com/browse/OCPBUGS-83428): bump axios to ^1.15.0 for fixing CVE-2026-40175 (#3585) [#3585](https://github.com/openshift-assisted/assisted-installer-ui/pull/3585)
* chore(deps): update dependency @redhat-cloud-services/frontend-components to v7.3.1 (#3568) [#3568](https://github.com/openshift-assisted/assisted-installer-ui/pull/3568)
* chore(deps): update dependency @redhat-cloud-services/tsc-transform-imports to v1.0.58 (#3570) [#3570](https://github.com/openshift-assisted/assisted-installer-ui/pull/3570)
* chore(deps): update dependency @redhat-cloud-services/frontend-components-config to v6.8.4 (#3569) [#3569](https://github.com/openshift-assisted/assisted-installer-ui/pull/3569)
* [MGMT-23090](https://issues.redhat.com/browse/MGMT-23090): Support single stack IPv6 (#3414) [#3414](https://github.com/openshift-assisted/assisted-installer-ui/pull/3414)
* NO-ISSUE: Remove orphan files (#3460) [#3460](https://github.com/openshift-assisted/assisted-installer-ui/pull/3460)
* [MGMT-23328](https://issues.redhat.com/browse/MGMT-23328): remove breadcrumbs for OCM and use logo as a link (#3510) [#3510](https://github.com/openshift-assisted/assisted-installer-ui/pull/3510)
* NO-ISSUE: Update translation files to match new i18next format (#3567) [#3567](https://github.com/openshift-assisted/assisted-installer-ui/pull/3567)
* [Full changelog](https://github.com/openshift-assisted/assisted-installer-ui/compare/72477b8616cffcd9abe7e3a32b93b83f60761b06...149443766b2bc3f3106bd2496de746303d829b7f)
### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/4c1ca15266d79b638bb0bc376b9536522f302025)
* [OCPBUGS-99425](https://issues.redhat.com/browse/OCPBUGS-99425): Use agent-preinstall-image-builder from quay-proxy [#319](https://github.com/openshift/agent-installer-utils/pull/319)
* [OCPBUGS-98692](https://issues.redhat.com/browse/OCPBUGS-98692): Update cluster-logging and loki operator versions [#315](https://github.com/openshift/agent-installer-utils/pull/315)
* [AGENT-1552](https://issues.redhat.com/browse/AGENT-1552): Add lvms-operator to config [#311](https://github.com/openshift/agent-installer-utils/pull/311)
* [OCPBUGS-98101](https://issues.redhat.com/browse/OCPBUGS-98101): Use build platform with more disk space [#312](https://github.com/openshift/agent-installer-utils/pull/312)
* [AGENT-1536](https://issues.redhat.com/browse/AGENT-1536): bump mtv-operator channel to release-v2.12 [#309](https://github.com/openshift/agent-installer-utils/pull/309)
* [OCPBUGS-86036](https://issues.redhat.com/browse/OCPBUGS-86036): Filter out link-local IPv6 addresses [#305](https://github.com/openshift/agent-installer-utils/pull/305)
* [OCPBUGS-85524](https://issues.redhat.com/browse/OCPBUGS-85524): update konflux references [#286](https://github.com/openshift/agent-installer-utils/pull/286)
* [AGENT-1476](https://issues.redhat.com/browse/AGENT-1476): Configure CI integration and add Prow e2e test to Konflux [#245](https://github.com/openshift/agent-installer-utils/pull/245)
* [AGENT-1193](https://issues.redhat.com/browse/AGENT-1193): Add mirror-path and registry-cert support for OVE ISO builder [#218](https://github.com/openshift/agent-installer-utils/pull/218)
* [OCPBUGS-83575](https://issues.redhat.com/browse/OCPBUGS-83575): Remove Konflux cert-preflight test [#290](https://github.com/openshift/agent-installer-utils/pull/290)
* NO-JIRA: Add 4.23 appliance-config [#289](https://github.com/openshift/agent-installer-utils/pull/289)
* NO-JIRA: Add 5.0 appliance-config.yaml for iso_builder [#288](https://github.com/openshift/agent-installer-utils/pull/288)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/1f7abf3147e6ba2f9d29ae469fdde2c4240d6de5...4c1ca15266d79b638bb0bc376b9536522f302025)
### [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy/tree/8264c02deda9abb6cd9a6a5c23305428431473c2)
* NO-JIRA: Merge https://github.com/kubernetes-sigs/apiserver-network-proxy:master (6eff182) into main [#111](https://github.com/openshift/apiserver-network-proxy/pull/111)
* NO-JIRA: Update OpenShift carry patches for Go 1.26 / OpenShift 5.0 [#113](https://github.com/openshift/apiserver-network-proxy/pull/113)
* [CNTRLPLANE-3380](https://issues.redhat.com/browse/CNTRLPLANE-3380): Merge https://github.com/kubernetes-sigs/apiserver-network-proxy:master (588e629) into main [#109](https://github.com/openshift/apiserver-network-proxy/pull/109)
* [CNTRLPLANE-3380](https://issues.redhat.com/browse/CNTRLPLANE-3380): Update OWNERS with HyperShift core team [#107](https://github.com/openshift/apiserver-network-proxy/pull/107)
* [CNTRLPLANE-3359](https://issues.redhat.com/browse/CNTRLPLANE-3359): Rebase to v0.34.0 for OCP 4.23 [#102](https://github.com/openshift/apiserver-network-proxy/pull/102)
* [Full changelog](https://github.com/openshift/apiserver-network-proxy/compare/5e33c22867d59ddd9392a2c6b3194d2f3c6bdfc7...8264c02deda9abb6cd9a6a5c23305428431473c2)
### [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws/tree/5060934bc9ff325acf4bd0728bf37166255a501f)
* UPSTREAM-SYNC: Fix merge https://github.com/kubernetes/cloud-provider-aws:master (c34d66e) into main [#158](https://github.com/openshift/cloud-provider-aws/pull/158)
* [OCPBUGS-87372](https://issues.redhat.com/browse/OCPBUGS-87372): Updating ose-aws-cloud-controller-manager-container image to be consistent with ART for 5.0 [#157](https://github.com/openshift/cloud-provider-aws/pull/157)
* [OCPBUGS-85643](https://issues.redhat.com/browse/OCPBUGS-85643): UPSTREAM: <drop>: bump google.golang.org/grpc to v1.79.3 [#154](https://github.com/openshift/cloud-provider-aws/pull/154)
* NO-JIRA: Update OWNERS [#145](https://github.com/openshift/cloud-provider-aws/pull/145)
* [Full changelog](https://github.com/openshift/cloud-provider-aws/compare/e73d6a3821655afc6fb19d88a66907078e6854f2...5060934bc9ff325acf4bd0728bf37166255a501f)
### [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws/tree/902df006f6c3a37aaeed7e09fa6f892788e36d00)
* :rocket: UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.12.1 (13af066) into main [#621](https://github.com/openshift/cluster-api-provider-aws/pull/621)
* 🐛 OCPBUGS-85337: set imagePullPolicy IfNotPresent on provider workloads [#619](https://github.com/openshift/cluster-api-provider-aws/pull/619)
* :bug: OCPBUGS-87525: Updating ose-aws-cluster-api-controllers-container image to be consistent with ART for 5.0 [#612](https://github.com/openshift/cluster-api-provider-aws/pull/612)
* [OCPBUGS-85567](https://issues.redhat.com/browse/OCPBUGS-85567): Bump github.com/go-jose/go-jose/v4 to 4.1.4 [#607](https://github.com/openshift/cluster-api-provider-aws/pull/607)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#605](https://github.com/openshift/cluster-api-provider-aws/pull/605)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#598](https://github.com/openshift/cluster-api-provider-aws/pull/598)
* NO-JIRA: Update manifests generator [#604](https://github.com/openshift/cluster-api-provider-aws/pull/604)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.11.1 (eaa4c99) into main [#602](https://github.com/openshift/cluster-api-provider-aws/pull/602)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.11.0 (815a1b0) into main [#600](https://github.com/openshift/cluster-api-provider-aws/pull/600)
* NO-JIRA: Update OWNERS [#599](https://github.com/openshift/cluster-api-provider-aws/pull/599)
* [Full changelog](https://github.com/openshift/cluster-api-provider-aws/compare/2d7aa679a7847b8831f4a14e84154170d33574ed...902df006f6c3a37aaeed7e09fa6f892788e36d00)
### [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver/tree/8b8c4cef02ec9b670e2709f2aacc0ed72420be90)
* [OCPBUGS-87394](https://issues.redhat.com/browse/OCPBUGS-87394): Updating ose-aws-ebs-csi-driver-container image to be consistent with ART for 5.0 [#324](https://github.com/openshift/aws-ebs-csi-driver/pull/324)
* [OCPBUGS-87394](https://issues.redhat.com/browse/OCPBUGS-87394): UPSTREAM: <carry>: Updating ose-aws-ebs-csi-driver-container image [#326](https://github.com/openshift/aws-ebs-csi-driver/pull/326)
* NO-ISSUE: UPSTREAM: 2911: CVE-2026-33186: bump google.golang.org/grpc v1.80.0 [#315](https://github.com/openshift/aws-ebs-csi-driver/pull/315)
* [Full changelog](https://github.com/openshift/aws-ebs-csi-driver/compare/0927af1c1397b6f3c7545c715e1a87e0263ae2bf...8b8c4cef02ec9b670e2709f2aacc0ed72420be90)
### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/50f79e773ab432a91299a06003191a1fc2535746)
* [OCPBUGS-99200](https://issues.redhat.com/browse/OCPBUGS-99200): Add networking.k8s.io group policy [#581](https://github.com/openshift/csi-operator/pull/581)
* [OCPBUGS-99490](https://issues.redhat.com/browse/OCPBUGS-99490): Apply some static assets earlier, before starting controllers [#584](https://github.com/openshift/csi-operator/pull/584)
* [STOR-2997](https://issues.redhat.com/browse/STOR-2997): Minimal implementation of GCP PD CSI driver operator [#576](https://github.com/openshift/csi-operator/pull/576)
* [STOR-3030](https://issues.redhat.com/browse/STOR-3030): feat(operator): detect GCP Dedicated and use hyperdisk-balanced StorageClass [#573](https://github.com/openshift/csi-operator/pull/573)
* [STOR-2996](https://issues.redhat.com/browse/STOR-2996): Sync gcp pd csi driver operator to legacy subdir (2) [#575](https://github.com/openshift/csi-operator/pull/575)
* [STOR-2996](https://issues.redhat.com/browse/STOR-2996): Run unit-tests in /legacy subdir [#574](https://github.com/openshift/csi-operator/pull/574)
* [OCPBUGS-85106](https://issues.redhat.com/browse/OCPBUGS-85106): Add required-scc annotation to EFS and SMB operator deployments [#569](https://github.com/openshift/csi-operator/pull/569)
* [OCPBUGS-90151](https://issues.redhat.com/browse/OCPBUGS-90151): hack/update-metadata.sh: allow MAX_OCP_VERSION override [#571](https://github.com/openshift/csi-operator/pull/571)
* [STOR-2996](https://issues.redhat.com/browse/STOR-2996): Sync gcp pd csi driver operator to legacy subdir [#570](https://github.com/openshift/csi-operator/pull/570)
* [OCPBUGS-87449](https://issues.redhat.com/browse/OCPBUGS-87449): Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 5.0 [#566](https://github.com/openshift/csi-operator/pull/566)
* [STOR-2920](https://issues.redhat.com/browse/STOR-2920): Bump OLM metadata to 5.0 [#568](https://github.com/openshift/csi-operator/pull/568)
* [STOR-2996](https://issues.redhat.com/browse/STOR-2996): Add gcp pd csi driver operator to legacy subdir [#562](https://github.com/openshift/csi-operator/pull/562)
* [OCPBUGS-87270](https://issues.redhat.com/browse/OCPBUGS-87270): Updating csi-driver-manila-operator-container image to be consistent with ART for 5.0 [#563](https://github.com/openshift/csi-operator/pull/563)
* [OCPBUGS-87236](https://issues.redhat.com/browse/OCPBUGS-87236): Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 5.0 [#561](https://github.com/openshift/csi-operator/pull/561)
* [OCPBUGS-87387](https://issues.redhat.com/browse/OCPBUGS-87387): Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 5.0 [#565](https://github.com/openshift/csi-operator/pull/565)
* [OCPBUGS-87368](https://issues.redhat.com/browse/OCPBUGS-87368): Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 5.0 [#564](https://github.com/openshift/csi-operator/pull/564)
* [OCPBUGS-87470](https://issues.redhat.com/browse/OCPBUGS-87470): Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 5.0 [#567](https://github.com/openshift/csi-operator/pull/567)
* [OCPBUGS-87219](https://issues.redhat.com/browse/OCPBUGS-87219): Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 5.0 [#560](https://github.com/openshift/csi-operator/pull/560)
* [OCPBUGS-42363](https://issues.redhat.com/browse/OCPBUGS-42363): Re-enable Azure Disk load test [#558](https://github.com/openshift/csi-operator/pull/558)
* [OCPBUGS-86023](https://issues.redhat.com/browse/OCPBUGS-86023): Add memory limits to SMB CSI sidecar containers [#557](https://github.com/openshift/csi-operator/pull/557)
* [OCPBUGS-85457](https://issues.redhat.com/browse/OCPBUGS-85457): Add init container for Manila node daemonset [#552](https://github.com/openshift/csi-operator/pull/552)
* [OCPBUGS-84052](https://issues.redhat.com/browse/OCPBUGS-84052): Mount writable /tmp in SMB CSI driver [#545](https://github.com/openshift/csi-operator/pull/545)
* [OSASINFRA-3675](https://issues.redhat.com/browse/OSASINFRA-3675): Rework authentication in Manila CSI Driver Operator [#373](https://github.com/openshift/csi-operator/pull/373)
* [OCPBUGS-80930](https://issues.redhat.com/browse/OCPBUGS-80930): Add VolumeAttributesClass e2e test manifests for Azure disk [#538](https://github.com/openshift/csi-operator/pull/538)
* [Full changelog](https://github.com/openshift/csi-operator/compare/8253452c39841b626cedd0b42dc0449943ccf938...50f79e773ab432a91299a06003191a1fc2535746)
### [aws-karpenter-provider-aws](https://github.com/openshift/aws-karpenter-provider-aws/tree/abcf7d1e34173037a13fc47317f313cb6ac2f667)
* [AUTOSCALE-644](https://issues.redhat.com/browse/AUTOSCALE-644): Release chores 5.0 for Karpenter [#33](https://github.com/openshift/aws-karpenter-provider-aws/pull/33)
* NO-JIRA: add finalizers resources to chart rbac [#31](https://github.com/openshift/aws-karpenter-provider-aws/pull/31)
* [OCPBUGS-87402](https://issues.redhat.com/browse/OCPBUGS-87402): Updating aws-karpenter-provider-aws-container image to be consistent with ART for 5.0 [#30](https://github.com/openshift/aws-karpenter-provider-aws/pull/30)
* [Full changelog](https://github.com/openshift/aws-karpenter-provider-aws/compare/f0be9c72e5bf25caeb2ca45c14e67e4d397a52cb...abcf7d1e34173037a13fc47317f313cb6ac2f667)
### [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider/tree/6ca6eea2f3a9d0b090ff63ba5b8e342d5686c9a8)
* [CNTRLPLANE-3380](https://issues.redhat.com/browse/CNTRLPLANE-3380): Update OWNERS with HyperShift core team [#45](https://github.com/openshift/aws-encryption-provider/pull/45)
* [Full changelog](https://github.com/openshift/aws-encryption-provider/compare/19e7b623429799c9c549690a1b5ab499844411f9...6ca6eea2f3a9d0b090ff63ba5b8e342d5686c9a8)
### [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws/tree/10718580c265686b6af85caab68eed263eee2a41)
* NO-JIRA: Cache region validation response and close AWS sessions [#190](https://github.com/openshift/machine-api-provider-aws/pull/190)
* [OCPBUGS-87410](https://issues.redhat.com/browse/OCPBUGS-87410): Updating ose-machine-api-provider-aws-container image to be consistent with ART for 5.0 [#193](https://github.com/openshift/machine-api-provider-aws/pull/193)
* NO-ISSUE: Add opt-in pprof endpoint to machine-controller-manager [#189](https://github.com/openshift/machine-api-provider-aws/pull/189)
* [OCPBUGS-83873](https://issues.redhat.com/browse/OCPBUGS-83873): Changed timeout for node ready logic in OTE [#185](https://github.com/openshift/machine-api-provider-aws/pull/185)
* [SPLAT-2715](https://issues.redhat.com/browse/SPLAT-2715): Fixed broken test and simplified some logic [#182](https://github.com/openshift/machine-api-provider-aws/pull/182)
* NO-JIRA: Update OWNERS [#183](https://github.com/openshift/machine-api-provider-aws/pull/183)
* [Full changelog](https://github.com/openshift/machine-api-provider-aws/compare/37a067230cbad4997dcf1d2c16685e36b6991c9e...10718580c265686b6af85caab68eed263eee2a41)
### [aws-node-termination-handler](https://github.com/openshift/aws-node-termination-handler/tree/e4ff2aaec292db42de9f3eef4908ba1c421a2a6c)
* [CNTRLPLANE-3380](https://issues.redhat.com/browse/CNTRLPLANE-3380): Update OWNERS with HyperShift core team [#7](https://github.com/openshift/aws-node-termination-handler/pull/7)
* [Full changelog](https://github.com/openshift/aws-node-termination-handler/compare/341ed3a086925b17671c5349343fedf988a1139e...e4ff2aaec292db42de9f3eef4908ba1c421a2a6c)
### [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook/tree/0d33a4596e2a22d188fe74c4a6497c37c2528c1f)
* [OCPCLOUD-3583](https://issues.redhat.com/browse/OCPCLOUD-3583): Update aws-pod-identity-webhook to k8s 1.36 [#220](https://github.com/openshift/aws-pod-identity-webhook/pull/220)
* [OCPBUGS-87337](https://issues.redhat.com/browse/OCPBUGS-87337): Updating ose-aws-pod-identity-webhook-container image to be consistent with ART for 5.0 [#218](https://github.com/openshift/aws-pod-identity-webhook/pull/218)
* NO-ISSUE: Update OWNERS: remove 2uasimojo, suhanime, lleshchi [#219](https://github.com/openshift/aws-pod-identity-webhook/pull/219)
* [Full changelog](https://github.com/openshift/aws-pod-identity-webhook/compare/8208828799b6c4f91fd9b80128668f7765599e84...0d33a4596e2a22d188fe74c4a6497c37c2528c1f)
### [azure-cloud-controller-manager, azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure/tree/d04449b95a54a9f41669d701ed63153575cced1e)
* [OCPBUGS-87408](https://issues.redhat.com/browse/OCPBUGS-87408), [OCPBUGS-87500](https://issues.redhat.com/browse/OCPBUGS-87500): Art consistency openshift 5.0 azure fix [#194](https://github.com/openshift/cloud-provider-azure/pull/194)
* [OCPBUGS-88486](https://issues.redhat.com/browse/OCPBUGS-88486): UPSTREAM: 10458: CVE-2026-39821: x/net v0.55.0 [#191](https://github.com/openshift/cloud-provider-azure/pull/191)
* [OCPBUGS-85641](https://issues.redhat.com/browse/OCPBUGS-85641), [OCPBUGS-85642](https://issues.redhat.com/browse/OCPBUGS-85642): UPSTREAM: <drop>: bump google.golang.org/grpc to v1.79.3 [#184](https://github.com/openshift/cloud-provider-azure/pull/184)
* NO-JIRA: Update OWNERS [#174](https://github.com/openshift/cloud-provider-azure/pull/174)
* [Full changelog](https://github.com/openshift/cloud-provider-azure/compare/4c7a764630c621d5e1700649fc056800d35bb6d1...d04449b95a54a9f41669d701ed63153575cced1e)
### [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure/tree/63731729974bff3be90ae2206c53d760572499d1)
* 🚀 OCPCLOUD-3600: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.26.0 (19ff821) into main [#388](https://github.com/openshift/cluster-api-provider-azure/pull/388)
* 🐛 OCPBUGS-85337: set imagePullPolicy IfNotPresent on provider workloads [#393](https://github.com/openshift/cluster-api-provider-azure/pull/393)
* NO-JIRA: Don't specify rules in aggregated cluster role [#392](https://github.com/openshift/cluster-api-provider-azure/pull/392)
* [OCPBUGS-87401](https://issues.redhat.com/browse/OCPBUGS-87401): Updating ose-azure-cluster-api-controllers-container image to be consistent with ART for 5.0 [#391](https://github.com/openshift/cluster-api-provider-azure/pull/391)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#387](https://github.com/openshift/cluster-api-provider-azure/pull/387)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#379](https://github.com/openshift/cluster-api-provider-azure/pull/379)
* NO-JIRA: Update manifests generator [#382](https://github.com/openshift/cluster-api-provider-azure/pull/382)
* [OCPBUGS-84694](https://issues.redhat.com/browse/OCPBUGS-84694): Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.23.1 (dbeb413) into main [#380](https://github.com/openshift/cluster-api-provider-azure/pull/380)
* NO-JIRA: Update OWNERS [#376](https://github.com/openshift/cluster-api-provider-azure/pull/376)
* [Full changelog](https://github.com/openshift/cluster-api-provider-azure/compare/de16e88406265ae154e18bc06e973579ef249cfa...63731729974bff3be90ae2206c53d760572499d1)
### [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver/tree/e87f776402d402a3e291e24fa737fe4e5e9617aa)
* [STOR-2923](https://issues.redhat.com/browse/STOR-2923): Rebase to upstream v1.34.4 for OCP 4.23/5.0 [#149](https://github.com/openshift/azure-disk-csi-driver/pull/149)
* NO-ISSUE: Bump spdystream to v0.5.1 [#151](https://github.com/openshift/azure-disk-csi-driver/pull/151)
* [OCPBUGS-87284](https://issues.redhat.com/browse/OCPBUGS-87284): Updating ose-azure-disk-csi-driver-container image to be consistent with ART for 5.0 [#152](https://github.com/openshift/azure-disk-csi-driver/pull/152)
* [OCPBUGS-78197](https://issues.redhat.com/browse/OCPBUGS-78197): check for node name in waitForDiskManagedByTobeRemoved [#144](https://github.com/openshift/azure-disk-csi-driver/pull/144)
* UPSTREAM: 3569: OCPBUGS-83733: Bump grpc to v1.79.3 [#135](https://github.com/openshift/azure-disk-csi-driver/pull/135)
* [Full changelog](https://github.com/openshift/azure-disk-csi-driver/compare/a995719b8666626dbffe09c03f039611feb48612...e87f776402d402a3e291e24fa737fe4e5e9617aa)
### [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver/tree/f7724fbf3ad694f957bd99fafa2fa7b658462624)
* [OCPBUGS-93742](https://issues.redhat.com/browse/OCPBUGS-93742): Bump golang.org/x/crypto/ssh to v0.53.0 [#141](https://github.com/openshift/azure-file-csi-driver/pull/141)
* [OCPBUGS-89331](https://issues.redhat.com/browse/OCPBUGS-89331): Bump github.com/kata-containers/kata-containers/src/runtime to address CVE-2026-41326 [#138](https://github.com/openshift/azure-file-csi-driver/pull/138)
* [OCPBUGS-87533](https://issues.redhat.com/browse/OCPBUGS-87533): Updating ose-azure-file-csi-driver-container image to be consistent with ART for 5.0 [#136](https://github.com/openshift/azure-file-csi-driver/pull/136)
* NO-ISSUE: Bump spdystream to v0.5.1 [#135](https://github.com/openshift/azure-file-csi-driver/pull/135)
* UPSTREAM: 3023: OCPBUGS-83329: Bump grpc to v1.79.3 [#124](https://github.com/openshift/azure-file-csi-driver/pull/124)
* [Full changelog](https://github.com/openshift/azure-file-csi-driver/compare/c481e92ba74550bbd3134a9ae92ccef31de7f60c...f7724fbf3ad694f957bd99fafa2fa7b658462624)
### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/ca3d747de321b88a2c606e546851d1841d2fab9f)
* [CNTRLPLANE-3660](https://issues.redhat.com/browse/CNTRLPLANE-3660): Add AGENTS.md, ARCHITECTURE.md, CLAUDE.md, update CONTRIBUTING.md [#49](https://github.com/openshift/azure-kubernetes-kms/pull/49)
* [CNTRLPLANE-3380](https://issues.redhat.com/browse/CNTRLPLANE-3380): Merge https://github.com/Azure/kubernetes-kms:master (126fb87) into main [#42](https://github.com/openshift/azure-kubernetes-kms/pull/42)
* [CNTRLPLANE-3380](https://issues.redhat.com/browse/CNTRLPLANE-3380): Add rebasebot-compatible commit prefixes [#41](https://github.com/openshift/azure-kubernetes-kms/pull/41)
* [CNTRLPLANE-3380](https://issues.redhat.com/browse/CNTRLPLANE-3380): Update OWNERS with HyperShift core team [#35](https://github.com/openshift/azure-kubernetes-kms/pull/35)
* [CNTRLPLANE-3204](https://issues.redhat.com/browse/CNTRLPLANE-3204): feat: add workload identity support to Azure KMS plugin [#33](https://github.com/openshift/azure-kubernetes-kms/pull/33)
* [CNTRLPLANE-3358](https://issues.redhat.com/browse/CNTRLPLANE-3358): Sync with upstream Azure/kubernetes-kms [#32](https://github.com/openshift/azure-kubernetes-kms/pull/32)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/99b9a3a33d8edfd0a2d2876aa7ef1382b2c75a39...ca3d747de321b88a2c606e546851d1841d2fab9f)
### [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure/tree/bb01d0dfee4abfe7274ff96cba280ad81ad99936)
* [CORS-4501](https://issues.redhat.com/browse/CORS-4501): azure: Detach frontend count from backend [#192](https://github.com/openshift/machine-api-provider-azure/pull/192)
* [OCPBUGS-87361](https://issues.redhat.com/browse/OCPBUGS-87361): Updating ose-machine-api-provider-azure-container image to be consistent with ART for 5.0 [#197](https://github.com/openshift/machine-api-provider-azure/pull/197)
* [PIXAA-7](https://issues.redhat.com/browse/PIXAA-7): Leverage SpotRebalanceRecommendation for instance termination when available [#196](https://github.com/openshift/machine-api-provider-azure/pull/196)
* [OCPBUGS-85416](https://issues.redhat.com/browse/OCPBUGS-85416): Don't permanently fail Machines after provisioning [#193](https://github.com/openshift/machine-api-provider-azure/pull/193)
* NO-JIRA: Update OWNERS [#190](https://github.com/openshift/machine-api-provider-azure/pull/190)
* [Full changelog](https://github.com/openshift/machine-api-provider-azure/compare/69d049094ee36ad9c706d65694a8cd42e9a64800...bb01d0dfee4abfe7274ff96cba280ad81ad99936)
### [azure-service-operator](https://github.com/openshift/azure-service-operator/tree/0611cd27b9eaa4a1fa8e0ab8ddc85352a61903e0)
* [OCPBUGS-87382](https://issues.redhat.com/browse/OCPBUGS-87382): Updating ose-azure-service-operator-container image to be consistent with ART for 5.0 [#33](https://github.com/openshift/azure-service-operator/pull/33)
* [OCPBUGS-83613](https://issues.redhat.com/browse/OCPBUGS-83613): Bump grpc package for CVE fix [#21](https://github.com/openshift/azure-service-operator/pull/21)
* [OCPBUGS-69898](https://issues.redhat.com/browse/OCPBUGS-69898): Updating ose-azure-service-operator-container image to be consistent with ART for 4.22 [#16](https://github.com/openshift/azure-service-operator/pull/16)
* NO-JIRA: UPSTREAM: <carry>: add openshift/e2e-tests.sh [#22](https://github.com/openshift/azure-service-operator/pull/22)
* NO-JIRA: Update OWNERS [#20](https://github.com/openshift/azure-service-operator/pull/20)
* [Full changelog](https://github.com/openshift/azure-service-operator/compare/17e574628ee7ef8aa694cfc0ab5e5232b651fbf8...0611cd27b9eaa4a1fa8e0ab8ddc85352a61903e0)
### [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity/tree/2b4705c5d999339ce17d47a9b2a637d238891dae)
* [OCPBUGS-87379](https://issues.redhat.com/browse/OCPBUGS-87379): Updating ose-azure-workload-identity-webhook-container image to be consistent with ART for 5.0 [#56](https://github.com/openshift/azure-workload-identity/pull/56)
* NO-ISSUE: Update OWNERS: remove 2uasimojo, suhanime, lleshchi [#57](https://github.com/openshift/azure-workload-identity/pull/57)
* [OCPBUGS-84709](https://issues.redhat.com/browse/OCPBUGS-84709): github.com/go-jose/go-jose/v4 v4.1.4 [#46](https://github.com/openshift/azure-workload-identity/pull/46)
* [Full changelog](https://github.com/openshift/azure-workload-identity/compare/81a256e668a054385d4a27a393afd77148f268b0...2b4705c5d999339ce17d47a9b2a637d238891dae)
### [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3/tree/0afcbf370086fe550560784f9cbf7182a9e8b72e)
* 🐛 OCPBUGS-85337: set imagePullPolicy IfNotPresent on provider workloads [#85](https://github.com/openshift/cluster-api-provider-metal3/pull/85)
* [OCPBUGS-98329](https://issues.redhat.com/browse/OCPBUGS-98329): Grant capi-installer permission on ConfigMap [#86](https://github.com/openshift/cluster-api-provider-metal3/pull/86)
* [OCPBUGS-87254](https://issues.redhat.com/browse/OCPBUGS-87254): Updating ose-baremetal-cluster-api-controllers-container image to be consistent with ART for 5.0 [#84](https://github.com/openshift/cluster-api-provider-metal3/pull/84)
* [OCPBUGS-86476](https://issues.redhat.com/browse/OCPBUGS-86476): Adopt existing Metal3 Remediation CRDs on upgrade [#82](https://github.com/openshift/cluster-api-provider-metal3/pull/82)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#79](https://github.com/openshift/cluster-api-provider-metal3/pull/79)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#74](https://github.com/openshift/cluster-api-provider-metal3/pull/74)
* NO-JIRA: Update manifests generator [#75](https://github.com/openshift/cluster-api-provider-metal3/pull/75)
* [Full changelog](https://github.com/openshift/cluster-api-provider-metal3/compare/ad4eb8a5e67dc08c0686f006641847df4370d599...0afcbf370086fe550560784f9cbf7182a9e8b72e)
### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/d8f6a96a1c18ee540099ff73789fde54cc9b12cd)
* [CORS-4514](https://issues.redhat.com/browse/CORS-4514): Set sovereign cloud defaults for machine types [#10706](https://github.com/openshift/installer/pull/10706)
* [CORS-4537](https://issues.redhat.com/browse/CORS-4537): Add API-backed disk type availability validation [#10687](https://github.com/openshift/installer/pull/10687)
* no-jira: azure: Disable shared access key by default [#10574](https://github.com/openshift/installer/pull/10574)
* [CORS-4507](https://issues.redhat.com/browse/CORS-4507): aws: support edge machine pool management with ClusterAPI [#10625](https://github.com/openshift/installer/pull/10625)
* [CNTRLPLANE-2847](https://issues.redhat.com/browse/CNTRLPLANE-2847): bootstrap: pass rendered manifests and payload version to etcd render [#10679](https://github.com/openshift/installer/pull/10679)
* [CORS-3997](https://issues.redhat.com/browse/CORS-3997): azure: update default instance types from v3 to AMD Dasv5 [#10565](https://github.com/openshift/installer/pull/10565)
* [OCPBUGS-98141](https://issues.redhat.com/browse/OCPBUGS-98141), [OCPBUGS-99018](https://issues.redhat.com/browse/OCPBUGS-99018): bump golang.org/x/crypto to v0.52.0 [#10690](https://github.com/openshift/installer/pull/10690)
* [CORS-4539](https://issues.redhat.com/browse/CORS-4539): Support sovereign cloud service account email format for gcp/gcd [#10691](https://github.com/openshift/installer/pull/10691)
* [CORS-4538](https://issues.redhat.com/browse/CORS-4538): Use metadata project ID for sovereign cloud gather [#10688](https://github.com/openshift/installer/pull/10688)
* NO-ISSUE: Remove workaround for boot image version mismatch [#10665](https://github.com/openshift/installer/pull/10665)
* [OCPBUGS-98586](https://issues.redhat.com/browse/OCPBUGS-98586): Don't wait on oc delete in konnectivity_cleanup [#10682](https://github.com/openshift/installer/pull/10682)
* [OCPBUGS-98529](https://issues.redhat.com/browse/OCPBUGS-98529): cluster-api: disable diagnostics endpoint for local CAPI controllers [#10681](https://github.com/openshift/installer/pull/10681)
* [CORS-4423](https://issues.redhat.com/browse/CORS-4423): GCP: Use WithCredentialsJSON when Possible [#10624](https://github.com/openshift/installer/pull/10624)
* [OCPBUGS-98157](https://issues.redhat.com/browse/OCPBUGS-98157): redact machineconfigs.json from "gather bootstrap" [#10678](https://github.com/openshift/installer/pull/10678)
* [CORS-4518](https://issues.redhat.com/browse/CORS-4518): Migrate containers libs to new mono repo [#10599](https://github.com/openshift/installer/pull/10599)
* [CNTRLPLANE-2012](https://issues.redhat.com/browse/CNTRLPLANE-2012): Refactor TLS cert generation to support configurable key algorithms [#10594](https://github.com/openshift/installer/pull/10594)
* [CORS-4334](https://issues.redhat.com/browse/CORS-4334): konnectivity: remove hostNetwork from konnectivity agent [#10662](https://github.com/openshift/installer/pull/10662)
* [OCPCLOUD-3368](https://issues.redhat.com/browse/OCPCLOUD-3368): bumping o/api for new crdcompatibilitychecker and capi capabilities [#10618](https://github.com/openshift/installer/pull/10618)
* [CORS-4528](https://issues.redhat.com/browse/CORS-4528): Remove OPENSHIFT_INSTALL_EXPERIMENTAL_DUAL_STACK [#10654](https://github.com/openshift/installer/pull/10654)
* no-jira: fix vCenter validation error to use correct field name [#10663](https://github.com/openshift/installer/pull/10663)
* [OCPBUGS-92792](https://issues.redhat.com/browse/OCPBUGS-92792): vsphere - fix CNS volume destroy to aggregate errors [#10658](https://github.com/openshift/installer/pull/10658)
* [CORS-4466](https://issues.redhat.com/browse/CORS-4466): aws: expand public subnet CIDR in public-only mode [#10542](https://github.com/openshift/installer/pull/10542)
* [CNTRLPLANE-2012](https://issues.redhat.com/browse/CNTRLPLANE-2012): Add PKI config types, validation, and CR manifest generation [#10593](https://github.com/openshift/installer/pull/10593)
* [OCPBUGS-87841](https://issues.redhat.com/browse/OCPBUGS-87841): gather: redact pull-secret auth tokens from machineconfigs.json [#10660](https://github.com/openshift/installer/pull/10660)
* [OCPBUGS-93627](https://issues.redhat.com/browse/OCPBUGS-93627): destroy/aws: delete vpc endpoints earlier [#10661](https://github.com/openshift/installer/pull/10661)
* [OCPBUGS-91975](https://issues.redhat.com/browse/OCPBUGS-91975), [OCPBUGS-91976](https://issues.redhat.com/browse/OCPBUGS-91976): Include bootstrap gather in agent-gather archive [#10501](https://github.com/openshift/installer/pull/10501)
* no-jira: dynamically set CVO upgrade version [#10655](https://github.com/openshift/installer/pull/10655)
* [CORS-4334](https://issues.redhat.com/browse/CORS-4334): Konnectivity [#10344](https://github.com/openshift/installer/pull/10344)
* [OCPBUGS-88303](https://issues.redhat.com/browse/OCPBUGS-88303): pkg/types/gcp: apply defaultMachinePlatform values [#10617](https://github.com/openshift/installer/pull/10617)
* NO-ISSUE: Add AI skill for modifying install-config [#10645](https://github.com/openshift/installer/pull/10645)
* [OCPBUGS-90537](https://issues.redhat.com/browse/OCPBUGS-90537): allow agent TUI to be shown also for rhcos10 base ISO [#10640](https://github.com/openshift/installer/pull/10640)
* [OCPBUGS-43501](https://issues.redhat.com/browse/OCPBUGS-43501): fix kargs handling in ABI Minimal ISO [#10578](https://github.com/openshift/installer/pull/10578)
* [OCPBUGS-88562](https://issues.redhat.com/browse/OCPBUGS-88562): Use yum install vs yum update tzdata [#10623](https://github.com/openshift/installer/pull/10623)
* [OCPBUGS-89645](https://issues.redhat.com/browse/OCPBUGS-89645): Revert: Ensure ssh keys strict permissions after bootstrap pivot [#10633](https://github.com/openshift/installer/pull/10633)
* [OCPBUGS-89645](https://issues.redhat.com/browse/OCPBUGS-89645): Ensure ssh keys strict permissions after bootstrap pivot [#10631](https://github.com/openshift/installer/pull/10631)
* [OCPBUGS-88701](https://issues.redhat.com/browse/OCPBUGS-88701): Exclude bind-mounted crypto policies from rsync [#10627](https://github.com/openshift/installer/pull/10627)
* no-jira: add rochacbruno to owners file [#10619](https://github.com/openshift/installer/pull/10619)
* [CORS-3893](https://issues.redhat.com/browse/CORS-3893): Create nat rule and associate to NIC [#10361](https://github.com/openshift/installer/pull/10361)
* [MCO-2181](https://issues.redhat.com/browse/MCO-2181): Fix linter error [#10622](https://github.com/openshift/installer/pull/10622)
* [MCO-2181](https://issues.redhat.com/browse/MCO-2181): Fix ART build version parsing panic in removeGoVersionPrefix [#10621](https://github.com/openshift/installer/pull/10621)
* [MCO-2181](https://issues.redhat.com/browse/MCO-2181): Default version switchover [#10533](https://github.com/openshift/installer/pull/10533)
* [OCPBUGS-86498](https://issues.redhat.com/browse/OCPBUGS-86498): openstack: add tzdata dependency to CI image [#10573](https://github.com/openshift/installer/pull/10573)
* [SPLAT-2795](https://issues.redhat.com/browse/SPLAT-2795): Enhanced vSphere cloud config to include node network cidr information [#10614](https://github.com/openshift/installer/pull/10614)
* no-jira: coderabbit: fix tools format [#10616](https://github.com/openshift/installer/pull/10616)
* [OCPBUGS-87493](https://issues.redhat.com/browse/OCPBUGS-87493): Updating ose-baremetal-installer-container image to be consistent with ART for 5.0 [#10602](https://github.com/openshift/installer/pull/10602)
* [CORS-4503](https://issues.redhat.com/browse/CORS-4503): bump cluster-api to v1.12.8 [#10587](https://github.com/openshift/installer/pull/10587)
* [OCPBUGS-87484](https://issues.redhat.com/browse/OCPBUGS-87484): Updating ose-installer-container image to be consistent with ART for 5.0 [#10601](https://github.com/openshift/installer/pull/10601)
* [CORS-3898](https://issues.redhat.com/browse/CORS-3898): Add IPv6 DNS records for dual-stack [#10330](https://github.com/openshift/installer/pull/10330)
* [OCPBUGS-87519](https://issues.redhat.com/browse/OCPBUGS-87519): Updating ose-installer-artifacts-container image to be consistent with ART for 5.0 [#10603](https://github.com/openshift/installer/pull/10603)
* [CORS-4404](https://issues.redhat.com/browse/CORS-4404): pkg/quota: GCP, allow unauthenticated [#10611](https://github.com/openshift/installer/pull/10611)
* [CORS-3895](https://issues.redhat.com/browse/CORS-3895): Add IPv6 backend pools and load balancing rules for dual-stack [#10329](https://github.com/openshift/installer/pull/10329)
* [CORS-4236](https://issues.redhat.com/browse/CORS-4236): aws: support worker machine pool management with ClusterAPI [#10577](https://github.com/openshift/installer/pull/10577)
* [OCPBUGS-76928](https://issues.redhat.com/browse/OCPBUGS-76928): Remove workaround to normalize ISO files extensions [#10315](https://github.com/openshift/installer/pull/10315)
* [OCPBUGS-86471](https://issues.redhat.com/browse/OCPBUGS-86471): baremetal: fix hostSelector for default stream [#10571](https://github.com/openshift/installer/pull/10571)
* [OCPBUGS-85509](https://issues.redhat.com/browse/OCPBUGS-85509): Add omitempty to vSphere and Nutanix MachinePool slice fields [#10551](https://github.com/openshift/installer/pull/10551)
* fix: OCPBUGS-86012: reset associatedVCenter in failure domain validation loop [#10559](https://github.com/openshift/installer/pull/10559)
* [OCPBUGS-87169](https://issues.redhat.com/browse/OCPBUGS-87169): CVE-2026-34986: Bump go-jose/v4 to 4.1.4 [#10596](https://github.com/openshift/installer/pull/10596)
* [MCO-2296](https://issues.redhat.com/browse/MCO-2296): Remove OSImageStreams v1 replace [#10592](https://github.com/openshift/installer/pull/10592)
* [MCO-2296](https://issues.redhat.com/browse/MCO-2296): OSImageStreams v1 promotion [#10566](https://github.com/openshift/installer/pull/10566)
* no-jira: remove reference to altinfra [#10585](https://github.com/openshift/installer/pull/10585)
* no-jira: improve AI agent readiness with guidelines and AGENTS.md [#10474](https://github.com/openshift/installer/pull/10474)
* [OCPBUGS-85352](https://issues.redhat.com/browse/OCPBUGS-85352): aws: fix Route 53 resource leak during cluster destroy in China regions [#10544](https://github.com/openshift/installer/pull/10544)
* [MCO-2200](https://issues.redhat.com/browse/MCO-2200): Add day-0 dual streams support for ABI install flow [#10481](https://github.com/openshift/installer/pull/10481)
* no-jira: logging: log invoked openshift-install command [#10490](https://github.com/openshift/installer/pull/10490)
* NO-ISSUE: Use types.OSImageStreamValues for validation [#10576](https://github.com/openshift/installer/pull/10576)
* [CORS-4495](https://issues.redhat.com/browse/CORS-4495): Populate RHCOS10 Marketplace Stream [#10556](https://github.com/openshift/installer/pull/10556)
* [MCO-2181](https://issues.redhat.com/browse/MCO-2181): Set OSImageStream default in install-config [#10570](https://github.com/openshift/installer/pull/10570)
* [OCPBUGS-84656](https://issues.redhat.com/browse/OCPBUGS-84656): Update RHCOS-release-4.22 bootimage metadata to 10.2.20260423-0 / 9.8.20260428-0 [#10524](https://github.com/openshift/installer/pull/10524)
* no-jira: PowerVS: Remove unrequired logging [#10552](https://github.com/openshift/installer/pull/10552)
* [CORS-4005](https://issues.redhat.com/browse/CORS-4005): refactor worker manifest serialization [#10407](https://github.com/openshift/installer/pull/10407)
* [OCPEDGE-2115](https://issues.redhat.com/browse/OCPEDGE-2115): types: support MAC address as alternative identifier for fencing credential [#10513](https://github.com/openshift/installer/pull/10513)
* [METAL-1731](https://issues.redhat.com/browse/METAL-1731): baremetal: Add coreos.openshift.io/stream label to BMH and hostSelector [#10502](https://github.com/openshift/installer/pull/10502)
* [OCPBUGS-78126](https://issues.redhat.com/browse/OCPBUGS-78126): baremetal: fix gather bootstrap failing with provisioningNetwork Disabled [#10395](https://github.com/openshift/installer/pull/10395)
* [SPLAT-2452](https://issues.redhat.com/browse/SPLAT-2452): Add SetSecurityGroups IAM permission to master nodes for BYO SG support for AWS NLBs [#10512](https://github.com/openshift/installer/pull/10512)
* [MCO-2164](https://issues.redhat.com/browse/MCO-2164): use machine-config-osimagestream to avoid hard-coding image tag names [#10416](https://github.com/openshift/installer/pull/10416)
* no-jira: images: bump UPI image dependencies to 4.22 [#10538](https://github.com/openshift/installer/pull/10538)
* [MCO-2200](https://issues.redhat.com/browse/MCO-2200): refactored node-joiner to use embedded rhcos data [#10537](https://github.com/openshift/installer/pull/10537)
* [OCPBUGS-79536](https://issues.redhat.com/browse/OCPBUGS-79536): Removing AWS security group OVNDB ports as they are no longer used [#10441](https://github.com/openshift/installer/pull/10441)
* [OCPBUGS-85232](https://issues.redhat.com/browse/OCPBUGS-85232): PowerVS: Add port 80 security group rule [#10541](https://github.com/openshift/installer/pull/10541)
* no-jira: tests: verify AWS instance type minimum cpu and mem requirement tests [#10536](https://github.com/openshift/installer/pull/10536)
* NO-JIRA: pkg/types/nutanix: warn about unused context [#10430](https://github.com/openshift/installer/pull/10430)
* [SPLAT-2710](https://issues.redhat.com/browse/SPLAT-2710): Added vSphere day 2 support [#10529](https://github.com/openshift/installer/pull/10529)
* [OCPBUGS-67159](https://issues.redhat.com/browse/OCPBUGS-67159): openstack: Reserve addresses for load balancer [#10375](https://github.com/openshift/installer/pull/10375)
* [OCPBUGS-77760](https://issues.redhat.com/browse/OCPBUGS-77760): verify FIPS mode after installation completes [#10348](https://github.com/openshift/installer/pull/10348)
* [OCPBUGS-84873](https://issues.redhat.com/browse/OCPBUGS-84873): Fix to agent integration test finding agent-tui files [#10530](https://github.com/openshift/installer/pull/10530)
* [OCPBUGS-84335](https://issues.redhat.com/browse/OCPBUGS-84335): vSphere - Missing unit tests to cover polarion workitems [#10516](https://github.com/openshift/installer/pull/10516)
* [OCPBUGS-84548](https://issues.redhat.com/browse/OCPBUGS-84548): add unit tests for Nutanix to replace polarion workitems [#10520](https://github.com/openshift/installer/pull/10520)
* no-jira: update to Google Cloud SDK 563.0.0 [#10460](https://github.com/openshift/installer/pull/10460)
* [MULTIARCH-5824](https://issues.redhat.com/browse/MULTIARCH-5824): PowerVS: Fix supported system types retrieval for PowerVS regions [#10268](https://github.com/openshift/installer/pull/10268)
* [CORS-3933](https://issues.redhat.com/browse/CORS-3933): Add a retry backoff for checking storage in progress [#10463](https://github.com/openshift/installer/pull/10463)
* [SPLAT-2719](https://issues.redhat.com/browse/SPLAT-2719): vsphere - remove HostGroup zonal feature gate checks [#10497](https://github.com/openshift/installer/pull/10497)
* [OCPEDGE-2255](https://issues.redhat.com/browse/OCPEDGE-2255): baremetal: reject SNO installation on baremetal platform [#10420](https://github.com/openshift/installer/pull/10420)
* [OCPBUGS-78932](https://issues.redhat.com/browse/OCPBUGS-78932): Improved DHCP network deletion reliability by proactively cleaning up attached network interfaces before retrying deletion [#10325](https://github.com/openshift/installer/pull/10325)
* [OCPBUGS-83327](https://issues.redhat.com/browse/OCPBUGS-83327): PowerVS: update CAPI to v0.12.2 [#10488](https://github.com/openshift/installer/pull/10488)
* [OCPBUGS-83335](https://issues.redhat.com/browse/OCPBUGS-83335): dont save CAPI secrets [#10498](https://github.com/openshift/installer/pull/10498)
* [AGENT-1417](https://issues.redhat.com/browse/AGENT-1417): Add kind verification in InternalReleaseImage check [#10332](https://github.com/openshift/installer/pull/10332)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/installer/compare/dfb58c0c74c7a27a9859c5b84d5d087e70f5f6a3...d8f6a96a1c18ee540099ff73789fde54cc9b12cd)
### [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal/tree/f2b0db1919fff1344bc68948894c6775c0bf24a3)
* [OCPBUGS-87380](https://issues.redhat.com/browse/OCPBUGS-87380): Updating baremetal-machine-controller-container image to be consistent with ART for 5.0 [#256](https://github.com/openshift/cluster-api-provider-baremetal/pull/256)
* [Full changelog](https://github.com/openshift/cluster-api-provider-baremetal/compare/8d863b9505a5cfc0b01e33f985a3edf9d3c69f4b...f2b0db1919fff1344bc68948894c6775c0bf24a3)
### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/775d84f5afecf432c7a0330bfaadd669b4a68ab0)
* [METAL-1900](https://issues.redhat.com/browse/METAL-1900): Merge upstream [#510](https://github.com/openshift/baremetal-operator/pull/510)
* [OCPBUGS-64617](https://issues.redhat.com/browse/OCPBUGS-64617): Merge upstream [#499](https://github.com/openshift/baremetal-operator/pull/499)
* NO-ISSUE: Merge upstream [#489](https://github.com/openshift/baremetal-operator/pull/489)
* [OCPBUGS-87490](https://issues.redhat.com/browse/OCPBUGS-87490): Updating ose-baremetal-operator-container image to be consistent with ART for 5.0 [#488](https://github.com/openshift/baremetal-operator/pull/488)
* NO-ISSUE: Merge upstream [#483](https://github.com/openshift/baremetal-operator/pull/483)
* [Full changelog](https://github.com/openshift/baremetal-operator/compare/c5e5048987427f58d3ca76238537e74bd3175e0f...775d84f5afecf432c7a0330bfaadd669b4a68ab0)
### [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg/tree/660073616802e3d1258a036f2e57ca18a7baafa0)
* [OCPBUGS-99496](https://issues.redhat.com/browse/OCPBUGS-99496): Detect bootstrap apiserver shutdown via /readyz [#396](https://github.com/openshift/baremetal-runtimecfg/pull/396)
* [OCPBUGS-87329](https://issues.redhat.com/browse/OCPBUGS-87329): Updating ose-baremetal-runtimecfg-container image to be consistent with ART for 5.0 [#393](https://github.com/openshift/baremetal-runtimecfg/pull/393)
* NO-ISSUE: Bump go to 1.25.10 and x/net to v0.55.0 to fix CVE-2026-33814 [#392](https://github.com/openshift/baremetal-runtimecfg/pull/392)
* NO-ISSUE: Bump go to fix security vulnerabilities [#389](https://github.com/openshift/baremetal-runtimecfg/pull/389)
* [Full changelog](https://github.com/openshift/baremetal-runtimecfg/compare/dca8cb1be0cce1ce404dfd407ead1326a3c8bb40...660073616802e3d1258a036f2e57ca18a7baafa0)
### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/a88e785e90aa96ac96da93359bacf3ea5c174733)
* [TRT-2817](https://issues.redhat.com/browse/TRT-2817): Revert "Merge pull request #2279 from nbottari9/1814-duplicate-warning" [#2320](https://github.com/openshift/oc/pull/2320)
* NO-JIRA: Bump k8s dependencies to 1.36 along with openshift [#2318](https://github.com/openshift/oc/pull/2318)
* [OTA-1814](https://issues.redhat.com/browse/OTA-1814): fix(alerts): Remove duplicate information in the recommend command [#2279](https://github.com/openshift/oc/pull/2279)
* NO-JIRA: Handle wrapped ENOTSUP error [#2311](https://github.com/openshift/oc/pull/2311)
* NO-JIRA: First try newer iotop-c and fallback to older one [#2317](https://github.com/openshift/oc/pull/2317)
* NO-JIRA: Register the e2e tests for accept in the subfolder [#2300](https://github.com/openshift/oc/pull/2300)
* NO-JIRA: Fix staticcheck warnings in pkg/cli/admin/mustgather [#2306](https://github.com/openshift/oc/pull/2306)
* NO-JIRA: Fix go vet warning in process.go [#2304](https://github.com/openshift/oc/pull/2304)
* NO-JIRA: Bump gitignore dependency [#2303](https://github.com/openshift/oc/pull/2303)
* [CNTRLPLANE-3786](https://issues.redhat.com/browse/CNTRLPLANE-3786): bump x/crypto to the latest version [#2301](https://github.com/openshift/oc/pull/2301)
* NO-JIRA: Move test/e2e/accept.go to its own folder [#2294](https://github.com/openshift/oc/pull/2294)
* [CNTRLPLANE-3665](https://issues.redhat.com/browse/CNTRLPLANE-3665): Add ARCHITECTURE.md, adopt shared CONTRIBUTING.md, slim README [#2293](https://github.com/openshift/oc/pull/2293)
* NO-JIRA: Fix tar slip path traversal in codesign archive extraction [#2291](https://github.com/openshift/oc/pull/2291)
* NO-JIRA: accept risks e2e becomes blocking [#2280](https://github.com/openshift/oc/pull/2280)
* [OTA-1956](https://issues.redhat.com/browse/OTA-1956): oc adm release new: Include base image's image-references in pruning [#2287](https://github.com/openshift/oc/pull/2287)
* [OCPBUGS-88342](https://issues.redhat.com/browse/OCPBUGS-88342): openshift-clients RPM has a hard dependency on bash-completion [#2289](https://github.com/openshift/oc/pull/2289)
* [OCPBUGS-87534](https://issues.redhat.com/browse/OCPBUGS-87534): Updating openshift-enterprise-deployer-container image to be consistent with ART for 5.0 [#2284](https://github.com/openshift/oc/pull/2284)
* [OCPBUGS-87198](https://issues.redhat.com/browse/OCPBUGS-87198): Fix windows builds of oc rpm [#2281](https://github.com/openshift/oc/pull/2281)
* NO-JIRA: Switch container dependencies to Podman monorepo [#2277](https://github.com/openshift/oc/pull/2277)
* NO-JIRA: Bump go-jose dependency [#2269](https://github.com/openshift/oc/pull/2269)
* NO-JIRA: Making oc cli case blocking [#2260](https://github.com/openshift/oc/pull/2260)
* [OCPBUGS-62799](https://issues.redhat.com/browse/OCPBUGS-62799): Add required-scc annotation to node-joiner pod [#2230](https://github.com/openshift/oc/pull/2230)
* [OTA-1817](https://issues.redhat.com/browse/OTA-1817): Adding unit tests for the extend recommended alerts [#2262](https://github.com/openshift/oc/pull/2262)
* [OCPBUGS-78768](https://issues.redhat.com/browse/OCPBUGS-78768): Skip filter validation for RFC2307 group query when groupUIDAttribute is "dn" [#2259](https://github.com/openshift/oc/pull/2259)
* [RFE-3594](https://issues.redhat.com/browse/RFE-3594): Add group membership info [#2255](https://github.com/openshift/oc/pull/2255)
* NO-JIRA: claude: Change learn-* agents into skills [#2257](https://github.com/openshift/oc/pull/2257)
* NO-JIRA: claude: Improve AGENTS.md and add agents for storing project knowledge [#2251](https://github.com/openshift/oc/pull/2251)
* And 3 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/oc/compare/66dee73f66c4f048c333c6a77d76871872027896...a88e785e90aa96ac96da93359bacf3ea5c174733)
### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/672b790022dbea667460b1a0467b6a0bc39c544b)
* [MULTIARCH-5990](https://issues.redhat.com/browse/MULTIARCH-5990): IBM Cloud Staging Endpoint Support for `ccoctl` [#1062](https://github.com/openshift/cloud-credential-operator/pull/1062)
* [CCO-847](https://issues.redhat.com/browse/CCO-847): Resolve ci/prow/security job failures [#1048](https://github.com/openshift/cloud-credential-operator/pull/1048)
* [OCPBUGS-96892](https://issues.redhat.com/browse/OCPBUGS-96892): Revert "OCPBUGS-87829: Scope minted AWS IAM policies to cluster-owned resources" [#1057](https://github.com/openshift/cloud-credential-operator/pull/1057)
* [OCPBUGS-95187](https://issues.redhat.com/browse/OCPBUGS-95187): Reclassify ec2:ModifyNetworkInterfaceAttribute as unscoped [#1053](https://github.com/openshift/cloud-credential-operator/pull/1053)
* [OCPBUGS-33994](https://issues.redhat.com/browse/OCPBUGS-33994): Don't unnecessarily re-reconcile when secrets are externally managed [#1042](https://github.com/openshift/cloud-credential-operator/pull/1042)
* [OCPBUGS-87505](https://issues.redhat.com/browse/OCPBUGS-87505): Updating ose-cloud-credential-operator-container image to be consistent with ART for 5.0 [#1037](https://github.com/openshift/cloud-credential-operator/pull/1037)
* [OCPBUGS-87829](https://issues.redhat.com/browse/OCPBUGS-87829): Scope minted AWS IAM policies to cluster-owned resources [#1043](https://github.com/openshift/cloud-credential-operator/pull/1043)
* [OCPBUGS-87029](https://issues.redhat.com/browse/OCPBUGS-87029): nutanix: fix ccoctl to accept directory for --credentials-source-filepath [#1036](https://github.com/openshift/cloud-credential-operator/pull/1036)
* NO-ISSUE: Update OWNERS: remove 2uasimojo, suhanime [#1038](https://github.com/openshift/cloud-credential-operator/pull/1038)
* [OCPBUGS-82165](https://issues.redhat.com/browse/OCPBUGS-82165): Add retry logic for concurrent IAM policy changes in GCP [#1014](https://github.com/openshift/cloud-credential-operator/pull/1014)
* [OCPBUGS-58181](https://issues.redhat.com/browse/OCPBUGS-58181): Fix nil pointer dereference in ensureRolesAssignedToManagedIdentity [#987](https://github.com/openshift/cloud-credential-operator/pull/987)
* [CCO-683](https://issues.redhat.com/browse/CCO-683): Remove go-autorest dependency for Azure Stack Cloud configuration [#1024](https://github.com/openshift/cloud-credential-operator/pull/1024)
* [CCO-845](https://issues.redhat.com/browse/CCO-845): use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs [#1019](https://github.com/openshift/cloud-credential-operator/pull/1019)
* [CCO-770](https://issues.redhat.com/browse/CCO-770): Docs: consolidate and simplify short-term token workflows [#986](https://github.com/openshift/cloud-credential-operator/pull/986)
* [CCO-711](https://issues.redhat.com/browse/CCO-711): docs: improve the filter when getting the capi pod [#1016](https://github.com/openshift/cloud-credential-operator/pull/1016)
* [OCPBUGS-84712](https://issues.redhat.com/browse/OCPBUGS-84712): github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 [#1021](https://github.com/openshift/cloud-credential-operator/pull/1021)
* [OCPBUGS-84043](https://issues.redhat.com/browse/OCPBUGS-84043): go.opentelemetry.io/otel v1.43.0 [#1011](https://github.com/openshift/cloud-credential-operator/pull/1011)
* [OCPBUGS-84044](https://issues.redhat.com/browse/OCPBUGS-84044): github.com/go-jose/go-jose/v4 v4.1.4 [#1012](https://github.com/openshift/cloud-credential-operator/pull/1012)
* [OCPBUGS-83449](https://issues.redhat.com/browse/OCPBUGS-83449): test-ext: hypershift skip CCO metrics endpoint validation [#1010](https://github.com/openshift/cloud-credential-operator/pull/1010)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/c50292310b1070ff8bfe842ca7424bf5ae2c9346...672b790022dbea667460b1a0467b6a0bc39c544b)
### [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller/tree/0b49df2bc4b10110463f1aa2a5fc475ebaeef9ab)
* [CORENET-7297](https://issues.redhat.com/browse/CORENET-7297): Add CodeRabbit AI review configuration [#227](https://github.com/openshift/cloud-network-config-controller/pull/227)
* [OCPBUGS-87475](https://issues.redhat.com/browse/OCPBUGS-87475): Updating ose-cloud-network-config-controller-container image to be consistent with ART for 5.0 [#224](https://github.com/openshift/cloud-network-config-controller/pull/224)
* [Full changelog](https://github.com/openshift/cloud-network-config-controller/compare/2d69ad953cfaa419e9b6221da9edb152ded91e0b...0b49df2bc4b10110463f1aa2a5fc475ebaeef9ab)
### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/482d82f81fc7b460eb3f4024c7fcb4c4a841aecd)
* [CNTRLPLANE-3361](https://issues.redhat.com/browse/CNTRLPLANE-3361): Update openshift/* [#957](https://github.com/openshift/cluster-authentication-operator/pull/957)
* NO-JIRA: Automatic agentic rebase: Update library-go to d8f45c2 [#954](https://github.com/openshift/cluster-authentication-operator/pull/954)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): encryptionstatusprovider: implement UpdateKMSEncryptionStatus [#953](https://github.com/openshift/cluster-authentication-operator/pull/953)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): encryptionstatusprovider: use AuthenticationInterface instead of Clientset [#952](https://github.com/openshift/cluster-authentication-operator/pull/952)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): intro authenticationEncryptionStatusProvider [#951](https://github.com/openshift/cluster-authentication-operator/pull/951)
* NO-JIRA: kms to kms key identifier check [#941](https://github.com/openshift/cluster-authentication-operator/pull/941)
* NO-JIRA: Bump library-go to sync [#948](https://github.com/openshift/cluster-authentication-operator/pull/948)
* [CNTRLPLANE-3234](https://issues.redhat.com/browse/CNTRLPLANE-3234): wire KMS health reporter status writer [#947](https://github.com/openshift/cluster-authentication-operator/pull/947)
* [OCPBUGS-87480](https://issues.redhat.com/browse/OCPBUGS-87480): Updating ose-cluster-authentication-operator-container image to be consistent with ART for 5.0 [#934](https://github.com/openshift/cluster-authentication-operator/pull/934)
* [CNTRLPLANE-2589](https://issues.redhat.com/browse/CNTRLPLANE-2589): Migrate test/e2e-encryption to OpenShift Tests Extension framework [#944](https://github.com/openshift/cluster-authentication-operator/pull/944)
* [CNTRLPLANE-2589](https://issues.redhat.com/browse/CNTRLPLANE-2589): Migrate test/e2e-encryption-rotation to OpenShift Tests Extension framework [#943](https://github.com/openshift/cluster-authentication-operator/pull/943)
* NO-JIRA: Automatic agentic rebase: Update library-go to fd74bb5 [#940](https://github.com/openshift/cluster-authentication-operator/pull/940)
* [CNTRLPLANE-2589](https://issues.redhat.com/browse/CNTRLPLANE-2589): Migrate test/e2e-encryption-perf to OpenShift Tests Extension framework [#926](https://github.com/openshift/cluster-authentication-operator/pull/926)
* NO-JIRA: bump library-go funcs [#935](https://github.com/openshift/cluster-authentication-operator/pull/935)
* NO-JIRA: Add test for KMS to KMS migration [#938](https://github.com/openshift/cluster-authentication-operator/pull/938)
* NO-JIRA: Bump library-go for sync [#936](https://github.com/openshift/cluster-authentication-operator/pull/936)
* [CNTRLPLANE-3720](https://issues.redhat.com/browse/CNTRLPLANE-3720): Add human and agent context files [#933](https://github.com/openshift/cluster-authentication-operator/pull/933)
* NO-JIRA: Bump library-go [#932](https://github.com/openshift/cluster-authentication-operator/pull/932)
* NO-JIRA: Update openshift dependencies [#931](https://github.com/openshift/cluster-authentication-operator/pull/931)
* NO-JIRA: add kms preflight to NP to allow egress [#928](https://github.com/openshift/cluster-authentication-operator/pull/928)
* NO-JIRA: Store authentication-operator image as OPERATOR_IMAGE [#927](https://github.com/openshift/cluster-authentication-operator/pull/927)
* NO-JIRA: Automatic agentic rebase: Update library-go to b0f5231 [#923](https://github.com/openshift/cluster-authentication-operator/pull/923)
* [CNTRLPLANE-3210](https://issues.redhat.com/browse/CNTRLPLANE-3210): Update external OIDC config generation to support external claims sourcing [#880](https://github.com/openshift/cluster-authentication-operator/pull/880)
* NO-JIRA: add preflight command [#920](https://github.com/openshift/cluster-authentication-operator/pull/920)
* [CNTRLPLANE-3363](https://issues.redhat.com/browse/CNTRLPLANE-3363): Register health monitor as command [#918](https://github.com/openshift/cluster-authentication-operator/pull/918)
* NO-JIRA: kms: bump library-go to get KMS plugin security context [#916](https://github.com/openshift/cluster-authentication-operator/pull/916)
* [CNTRLPLANE-3545](https://issues.redhat.com/browse/CNTRLPLANE-3545): bump library-go to get CA bundle wiring [#913](https://github.com/openshift/cluster-authentication-operator/pull/913)
* NO-JIRA: Automatic agentic rebase: Update library-go to 7fd5f33 [#915](https://github.com/openshift/cluster-authentication-operator/pull/915)
* NO-JIRA: Automatic agentic rebase: Update library-go to 0469313 [#912](https://github.com/openshift/cluster-authentication-operator/pull/912)
* [OCPBUGS-86221](https://issues.redhat.com/browse/OCPBUGS-86221): Update the well-known readiness controller to properly set cluster-operator conditions [#901](https://github.com/openshift/cluster-authentication-operator/pull/901)
* [CNTRLPLANE-3226](https://issues.redhat.com/browse/CNTRLPLANE-3226): switch to real Vault KMS plugin in CI [#909](https://github.com/openshift/cluster-authentication-operator/pull/909)
* [CNTRLPLANE-3226](https://issues.redhat.com/browse/CNTRLPLANE-3226): bump library-go to get KMS plugin credentials [#903](https://github.com/openshift/cluster-authentication-operator/pull/903)
* NO-JIRA: Automatic agentic rebase: Update library-go to d8750ed [#908](https://github.com/openshift/cluster-authentication-operator/pull/908)
* NO-JIRA: Automatic agentic rebase: Update library-go to 0cf249e [#907](https://github.com/openshift/cluster-authentication-operator/pull/907)
* [CNTRLPLANE-3364](https://issues.redhat.com/browse/CNTRLPLANE-3364): remove the old go lib std tests [#906](https://github.com/openshift/cluster-authentication-operator/pull/906)
* NO-JIRA: bump latest library-go changes [#904](https://github.com/openshift/cluster-authentication-operator/pull/904)
* NO-JIRA: remove old mock plugin deployment [#902](https://github.com/openshift/cluster-authentication-operator/pull/902)
* [CNTRLPLANE-3236](https://issues.redhat.com/browse/CNTRLPLANE-3236): support deploying Vault mock KMS plugin [#899](https://github.com/openshift/cluster-authentication-operator/pull/899)
* [CNTRLPLANE-3431](https://issues.redhat.com/browse/CNTRLPLANE-3431): restart operator upon config change [#897](https://github.com/openshift/cluster-authentication-operator/pull/897)
* NO-JIRA: Bump auth with latest library-go changes [#900](https://github.com/openshift/cluster-authentication-operator/pull/900)
* [CNTRLPLANE-3210](https://issues.redhat.com/browse/CNTRLPLANE-3210): Refactor `externaloidc` controller to support different configuration generation logic [#893](https://github.com/openshift/cluster-authentication-operator/pull/893)
* [CNTRLPLANE-3364](https://issues.redhat.com/browse/CNTRLPLANE-3364): add the kms suite and migrate the kms tests of auth-o to ote [#895](https://github.com/openshift/cluster-authentication-operator/pull/895)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): Bump library-go and sync plugin changes [#896](https://github.com/openshift/cluster-authentication-operator/pull/896)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): Bump library-go and sync encryption tests with APIServerEncryption struct change [#894](https://github.com/openshift/cluster-authentication-operator/pull/894)
* [CNTRLPLANE-3431](https://issues.redhat.com/browse/CNTRLPLANE-3431): enable tls config injection [#892](https://github.com/openshift/cluster-authentication-operator/pull/892)
* NO-JIRA: Bump latest library-go changes [#890](https://github.com/openshift/cluster-authentication-operator/pull/890)
* [OCPBUGS-69977](https://issues.redhat.com/browse/OCPBUGS-69977): Fix OAuth page showing OKD branding instead of OpenShift [#887](https://github.com/openshift/cluster-authentication-operator/pull/887)
* [OCPBUGS-84951](https://issues.redhat.com/browse/OCPBUGS-84951): Fix terminationMessagePolicy on network policy e2e test pods [#882](https://github.com/openshift/cluster-authentication-operator/pull/882)
* NO-JIRA: Update library-go for latest changes [#873](https://github.com/openshift/cluster-authentication-operator/pull/873)
* [CNTRLPLANE-2523](https://issues.redhat.com/browse/CNTRLPLANE-2523): deploy oauth-apiserver in new OIDC mode when authentication type is OIDC [#858](https://github.com/openshift/cluster-authentication-operator/pull/858)
* NO-JIRA: Add control-plane-approvers to OWNERS [#871](https://github.com/openshift/cluster-authentication-operator/pull/871)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/51ea6cdc877f997cc9b376aa26820e8e83d8c1c7...482d82f81fc7b460eb3f4024c7fcb4c4a841aecd)
### [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler/tree/70920d3c6f5ff55d0eb72368767a81aea1a62abb)
* [OCPBUGS-92799](https://issues.redhat.com/browse/OCPBUGS-92799): UPSTREAM: 10001: chore(clusterapi): add machine phase check for failed machines [#430](https://github.com/openshift/kubernetes-autoscaler/pull/430)
* [AUTOSCALE-637](https://issues.redhat.com/browse/AUTOSCALE-637): Fix VPA E2E vendoring [#429](https://github.com/openshift/kubernetes-autoscaler/pull/429)
* [AUTOSCALE-555](https://issues.redhat.com/browse/AUTOSCALE-555): adding openshift provider [#417](https://github.com/openshift/kubernetes-autoscaler/pull/417)
* NO-JIRA: add coderabbit configuration file [#422](https://github.com/openshift/kubernetes-autoscaler/pull/422)
* [OCPBUGS-84130](https://issues.redhat.com/browse/OCPBUGS-84130): UPSTREAM: 9458: fix(clusterapi): use kind-aware version discovery for infra references [#418](https://github.com/openshift/kubernetes-autoscaler/pull/418)
* [Full changelog](https://github.com/openshift/kubernetes-autoscaler/compare/05bcec5a83ea3d9afc3a342a1b8878e30c19ef94...70920d3c6f5ff55d0eb72368767a81aea1a62abb)
### [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator/tree/4eba1788615dcaf77498d063f51812d5d4b2281a)
* [AUTOSCALE-642](https://issues.redhat.com/browse/AUTOSCALE-642): Release chores 5.0 [#380](https://github.com/openshift/cluster-autoscaler-operator/pull/380)
* NO-JIRA: add coderabbit configuration file [#375](https://github.com/openshift/cluster-autoscaler-operator/pull/375)
* NO-JIRA: update owners file with autoscale team members [#379](https://github.com/openshift/cluster-autoscaler-operator/pull/379)
* [AUTOSCALE-555](https://issues.redhat.com/browse/AUTOSCALE-555): change default cloud provider to openshift [#368](https://github.com/openshift/cluster-autoscaler-operator/pull/368)
* [OCPBUGS-87827](https://issues.redhat.com/browse/OCPBUGS-87827): only use central TLS profile when the cluster says to [#378](https://github.com/openshift/cluster-autoscaler-operator/pull/378)
* [OCPBUGS-87339](https://issues.redhat.com/browse/OCPBUGS-87339): Updating ose-cluster-autoscaler-operator-container image to be consistent with ART for 5.0 [#377](https://github.com/openshift/cluster-autoscaler-operator/pull/377)
* [OCPBUGS-52155](https://issues.redhat.com/browse/OCPBUGS-52155): Add machinesets to cluster operator related objects [#369](https://github.com/openshift/cluster-autoscaler-operator/pull/369)
* [AUTOSCALE-660](https://issues.redhat.com/browse/AUTOSCALE-660): add enforce node group min size flag [#374](https://github.com/openshift/cluster-autoscaler-operator/pull/374)
* [Full changelog](https://github.com/openshift/cluster-autoscaler-operator/compare/260ea1b5967f47768a0727e8c84d451dc9de5ced...4eba1788615dcaf77498d063f51812d5d4b2281a)
### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/fd483524f88dd685d663aa46b21803b7a24c5c69)
* [METAL-1795](https://issues.redhat.com/browse/METAL-1795): Add TLS group/curve support [#632](https://github.com/openshift/cluster-baremetal-operator/pull/632)
* [OCPBUGS-99278](https://issues.redhat.com/browse/OCPBUGS-99278): Apply cluster TLS profile to ironic-proxy container [#633](https://github.com/openshift/cluster-baremetal-operator/pull/633)
* [OCPBUGS-99220](https://issues.redhat.com/browse/OCPBUGS-99220): static-ip-manager should be optional [#631](https://github.com/openshift/cluster-baremetal-operator/pull/631)
* [OCPBUGS-66101](https://issues.redhat.com/browse/OCPBUGS-66101): Set Progressing=True during cluster update [#629](https://github.com/openshift/cluster-baremetal-operator/pull/629)
* [METAL-1833](https://issues.redhat.com/browse/METAL-1833): Add nic_validation OTE test [#627](https://github.com/openshift/cluster-baremetal-operator/pull/627)
* [METAL-1833](https://issues.redhat.com/browse/METAL-1833): Add multi_arch_worker OTE test [#625](https://github.com/openshift/cluster-baremetal-operator/pull/625)
* [METAL-1833](https://issues.redhat.com/browse/METAL-1833): Add cbo OTE test [#619](https://github.com/openshift/cluster-baremetal-operator/pull/619)
* [METAL-1833](https://issues.redhat.com/browse/METAL-1833): Fix ironic auth tests to run inside metal3-ironic pod [#626](https://github.com/openshift/cluster-baremetal-operator/pull/626)
* [METAL-1833](https://issues.redhat.com/browse/METAL-1833): Fix hermetic build compatibility for go-bindata [#623](https://github.com/openshift/cluster-baremetal-operator/pull/623)
* Bug OCPBUGS-90496: Remove metadata.namespace from cluster-scoped ClusterRoleBinding [#616](https://github.com/openshift/cluster-baremetal-operator/pull/616)
* [METAL-1833](https://issues.redhat.com/browse/METAL-1833): Add otp tags to ironic tests [#624](https://github.com/openshift/cluster-baremetal-operator/pull/624)
* [METAL-1833](https://issues.redhat.com/browse/METAL-1833): Remove openshift-tests-private from vendor directory [#621](https://github.com/openshift/cluster-baremetal-operator/pull/621)
* [METAL-1833](https://issues.redhat.com/browse/METAL-1833): Add ironic_* tests to CBO test extension [#615](https://github.com/openshift/cluster-baremetal-operator/pull/615)
* [METAL-1833](https://issues.redhat.com/browse/METAL-1833): Add self-contained OTE tests [#612](https://github.com/openshift/cluster-baremetal-operator/pull/612)
* [METAL-1833](https://issues.redhat.com/browse/METAL-1833): Add OTE framework and deployment_sanity tests [#609](https://github.com/openshift/cluster-baremetal-operator/pull/609)
* [METAL-1730](https://issues.redhat.com/browse/METAL-1730): Pass IMAGE_SHARED_DIR to image-customization-controller [#590](https://github.com/openshift/cluster-baremetal-operator/pull/590)
* [OCPBUGS-87290](https://issues.redhat.com/browse/OCPBUGS-87290): Updating ose-cluster-baremetal-operator-container image to be consistent with ART for 5.0 [#611](https://github.com/openshift/cluster-baremetal-operator/pull/611)
* [OCPBUGS-84934](https://issues.redhat.com/browse/OCPBUGS-84934): Add watcher for both TLS Adherence policy and profile changes [#597](https://github.com/openshift/cluster-baremetal-operator/pull/597)
* [OCPBUGS-85824](https://issues.redhat.com/browse/OCPBUGS-85824): Fix empty IRONIC_BASE_URL [#603](https://github.com/openshift/cluster-baremetal-operator/pull/603)
* [OCPBUGS-85496](https://issues.redhat.com/browse/OCPBUGS-85496): Fix webhook to validate the actual admission request object [#601](https://github.com/openshift/cluster-baremetal-operator/pull/601)
* [OCPBUGS-82526](https://issues.redhat.com/browse/OCPBUGS-82526): Fix webhook server not starting due to missing WithValidator [#587](https://github.com/openshift/cluster-baremetal-operator/pull/587)
* [OCPBUGS-82531](https://issues.redhat.com/browse/OCPBUGS-82531): Bind the plain HTTP 8080 metrics port to localhost [#586](https://github.com/openshift/cluster-baremetal-operator/pull/586)
* [OCPBUGS-83612](https://issues.redhat.com/browse/OCPBUGS-83612): Fix image-cache to use HTTPS for metal3-state downloads [#592](https://github.com/openshift/cluster-baremetal-operator/pull/592)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/e4f3cd50b6a33337b723beb682c4fdcf5cdd820c...fd483524f88dd685d663aa46b21803b7a24c5c69)
### [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap/tree/7b1593a47898b6a97dc457efaca464624e9f2afa)
* [OCPBUGS-73886](https://issues.redhat.com/browse/OCPBUGS-73886): Fix typo in logs [#125](https://github.com/openshift/cluster-bootstrap/pull/125)
* NO-JIRA: Add control-plane-approvers to OWNERS [#127](https://github.com/openshift/cluster-bootstrap/pull/127)
* [Full changelog](https://github.com/openshift/cluster-bootstrap/compare/e6be0fdfbf43883e2301dbf2d0eb3ab4a4f93383...7b1593a47898b6a97dc457efaca464624e9f2afa)
### [cluster-capi-controllers](https://github.com/openshift/cluster-api/tree/16b6909b3c73d84fe1fbda0d12f9be80aaae00db)
* 🚀 OCPCLOUD-3598: Merge https://github.com/kubernetes-sigs/cluster-api:v1.13.4 (27f4644) into main [#298](https://github.com/openshift/cluster-api/pull/298)
* [CORS-4534](https://issues.redhat.com/browse/CORS-4534): UPSTREAM: <carry>: Enable MachineTaintPropagation feature gate [#303](https://github.com/openshift/cluster-api/pull/303)
* [OCPBUGS-85337](https://issues.redhat.com/browse/OCPBUGS-85337): set imagePullPolicy IfNotPresent on provider workloads [#302](https://github.com/openshift/cluster-api/pull/302)
* [OCPBUGS-87327](https://issues.redhat.com/browse/OCPBUGS-87327): Updating ose-cluster-api-container image to be consistent with ART for 5.0 [#301](https://github.com/openshift/cluster-api/pull/301)
* [OCPBUGS-53005](https://issues.redhat.com/browse/OCPBUGS-53005): Remove references to master branch [#235](https://github.com/openshift/cluster-api/pull/235)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#292](https://github.com/openshift/cluster-api/pull/292)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#290](https://github.com/openshift/cluster-api/pull/290)
* NO-JIRA: Update manifests generator [#287](https://github.com/openshift/cluster-api/pull/287)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api:v1.12.7 (b5fa593) into master [#286](https://github.com/openshift/cluster-api/pull/286)
* [OCPCLOUD-3419](https://issues.redhat.com/browse/OCPCLOUD-3419): Adopt IPAM CRDs on upgrade [#274](https://github.com/openshift/cluster-api/pull/274)
* [OCPBUGS-83513](https://issues.redhat.com/browse/OCPBUGS-83513): Merge https://github.com/kubernetes-sigs/cluster-api:v1.12.5 (efc7142) into master [#275](https://github.com/openshift/cluster-api/pull/275)
* NO-JIRA: Update OWNERS [#278](https://github.com/openshift/cluster-api/pull/278)
* [Full changelog](https://github.com/openshift/cluster-api/compare/c11cf5d40d83b88479be4e8dd121801a71b3f0e0...16b6909b3c73d84fe1fbda0d12f9be80aaae00db)
### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/5767be9caecedf9dbbd2bdfd04633514b34b408f)
* [CORS-4512](https://issues.redhat.com/browse/CORS-4512): aws: allow privateDNSName and assignPrimaryIPv6 field on CAPI machines in dual-stack clusters [#592](https://github.com/openshift/cluster-capi-operator/pull/592)
* [CORS-4512](https://issues.redhat.com/browse/CORS-4512): aws: set IPv6 block on AWSCluster in dual-stack clusters [#593](https://github.com/openshift/cluster-capi-operator/pull/593)
* [OCPCLOUD-3607](https://issues.redhat.com/browse/OCPCLOUD-3607): Bump K8S to 1.36 [#628](https://github.com/openshift/cluster-capi-operator/pull/628)
* [OCPCLOUD-3368](https://issues.redhat.com/browse/OCPCLOUD-3368): Adding annotations to manifests for CVO to identify [#588](https://github.com/openshift/cluster-capi-operator/pull/588)
* [OCPCLOUD-3366](https://issues.redhat.com/browse/OCPCLOUD-3366): crdcompatibility: add validation for CRDData.Type field [#625](https://github.com/openshift/cluster-capi-operator/pull/625)
* [OCPCLOUD-3542](https://issues.redhat.com/browse/OCPCLOUD-3542): Add CRD Compatibility Checker OTE e2e tests [#599](https://github.com/openshift/cluster-capi-operator/pull/599)
* [OCPBUGS-98329](https://issues.redhat.com/browse/OCPBUGS-98329): Add aggregated cluster role for extended per-provider RBAC [#623](https://github.com/openshift/cluster-capi-operator/pull/623)
* [OCPCLOUD-3539](https://issues.redhat.com/browse/OCPCLOUD-3539): add topology-aware operator for CRD Compatibility Checker [#600](https://github.com/openshift/cluster-capi-operator/pull/600)
* [OCPCLOUD-3553](https://issues.redhat.com/browse/OCPCLOUD-3553): change webhook failurePolicy to Fail [#620](https://github.com/openshift/cluster-capi-operator/pull/620)
* [OCPCLOUD-1645](https://issues.redhat.com/browse/OCPCLOUD-1645): Scope capi-controllers RBAC to least-privilege [#585](https://github.com/openshift/cluster-capi-operator/pull/585)
* [OCPCLOUD-3451](https://issues.redhat.com/browse/OCPCLOUD-3451): Scope capi-operator and capi-installer RBAC to least-privilege [#607](https://github.com/openshift/cluster-capi-operator/pull/607)
* [OCPBUGS-88035](https://issues.redhat.com/browse/OCPBUGS-88035): Add e2e test verifying CAPI EC2 instance ownership tag [#594](https://github.com/openshift/cluster-capi-operator/pull/594)
* [OCPBUGS-92817](https://issues.redhat.com/browse/OCPBUGS-92817): delete MAPI MachineSets before CAPI in e2e cleanup [#611](https://github.com/openshift/cluster-capi-operator/pull/611)
* NO-JIRA: Bump golang.org/x/net to 0.56.0 to fix CVE [#617](https://github.com/openshift/cluster-capi-operator/pull/617)
* [OCPBUGS-85337](https://issues.redhat.com/browse/OCPBUGS-85337): fix(manifests-gen): set imagePullPolicy IfNotPresent on provider workloads [#618](https://github.com/openshift/cluster-capi-operator/pull/618)
* [OCPBUGS-87268](https://issues.redhat.com/browse/OCPBUGS-87268): Updating ose-cluster-capi-operator-container image to be consistent with ART for 5.0 [#582](https://github.com/openshift/cluster-capi-operator/pull/582)
* NO-JIRA: fix machine sync e2e test flake [#612](https://github.com/openshift/cluster-capi-operator/pull/612)
* [OCPCLOUD-3569](https://issues.redhat.com/browse/OCPCLOUD-3569): Initial import of rough provider tooling documentation [#609](https://github.com/openshift/cluster-capi-operator/pull/609)
* [OCPCLOUD-3570](https://issues.redhat.com/browse/OCPCLOUD-3570): e2e skip Cluster API authoritative MachineSets in GetFirstMAPIMachineSet [#610](https://github.com/openshift/cluster-capi-operator/pull/610)
* NO-JIRA: Fix races in machineset sync units [#551](https://github.com/openshift/cluster-capi-operator/pull/551)
* NO-JIRA: Fix a race in MachineSet e2es [#605](https://github.com/openshift/cluster-capi-operator/pull/605)
* [OCPCLOUD-3455](https://issues.redhat.com/browse/OCPCLOUD-3455): refine AWS CredentialsRequest permissions [#601](https://github.com/openshift/cluster-capi-operator/pull/601)
* [OCPBUGS-91667](https://issues.redhat.com/browse/OCPBUGS-91667): Bump capi-installer resync to 12 hours [#608](https://github.com/openshift/cluster-capi-operator/pull/608)
* [OCPCLOUD-3009](https://issues.redhat.com/browse/OCPCLOUD-3009): Bootstrap OTE framework [#597](https://github.com/openshift/cluster-capi-operator/pull/597)
* NO-JIRA: Bump cluster-api-actuator-pkg to fix MachineSet scale tests [#598](https://github.com/openshift/cluster-capi-operator/pull/598)
* [OCPBUGS-87001](https://issues.redhat.com/browse/OCPBUGS-87001): Move installer and revision controllers to their own deployment [#576](https://github.com/openshift/cluster-capi-operator/pull/576)
* NO-JIRA: Fix continous reconciliation of VAPs due to server-side defaulting [#581](https://github.com/openshift/cluster-capi-operator/pull/581)
* [OCPBUGS-86770](https://issues.redhat.com/browse/OCPBUGS-86770): Fix OpenStack identityRef conversion and add e2e test [#575](https://github.com/openshift/cluster-capi-operator/pull/575)
* NO-JIRA: build: add podman support to container image targets [#580](https://github.com/openshift/cluster-capi-operator/pull/580)
* NO-JIRA: Fix flake in infracluster test [#578](https://github.com/openshift/cluster-capi-operator/pull/578)
* NO-JIRA: fix shell compatibility in Makefile [#572](https://github.com/openshift/cluster-capi-operator/pull/572)
* [OCPBUGS-85530](https://issues.redhat.com/browse/OCPBUGS-85530): Fix failure to start on arm64 [#571](https://github.com/openshift/cluster-capi-operator/pull/571)
* NO-JIRA: Remove stale TODO comment for HostPlacement conversion [#569](https://github.com/openshift/cluster-capi-operator/pull/569)
* NO-JIRA: Allow sustaining engineering to self serve dependency updates [#553](https://github.com/openshift/cluster-capi-operator/pull/553)
* [OCPBUGS-84815](https://issues.redhat.com/browse/OCPBUGS-84815): fix: scope webhook to capi namespace, remove unused webhook endpoints [#543](https://github.com/openshift/cluster-capi-operator/pull/543)
* [OCPCLOUD-2664](https://issues.redhat.com/browse/OCPCLOUD-2664): Update operatorstatus to write correct sub-Conditions [#552](https://github.com/openshift/cluster-capi-operator/pull/552)
* [OCPCLOUD-3429](https://issues.redhat.com/browse/OCPCLOUD-3429): Mount provider images with image volumes [#527](https://github.com/openshift/cluster-capi-operator/pull/527)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#544](https://github.com/openshift/cluster-capi-operator/pull/544)
* [OCPBUGS-84673](https://issues.redhat.com/browse/OCPBUGS-84673): fix: remove retired Microsoft.ClassicStorage permission [#547](https://github.com/openshift/cluster-capi-operator/pull/547)
* NO-JIRA: bump controller-runtime-common to latest main [#540](https://github.com/openshift/cluster-capi-operator/pull/540)
* NO-JIRA: Updates gemini powered skills / agents [#542](https://github.com/openshift/cluster-capi-operator/pull/542)
* NO-JIRA: manifests-gen: set scc annotation in providers Deployments spec [#524](https://github.com/openshift/cluster-capi-operator/pull/524)
* NO-JIRA: Adds deep review skill [#541](https://github.com/openshift/cluster-capi-operator/pull/541)
* NO-JIRA: fix: re-enable setting/diffing httpProtocolIpv6, CAPA now supports it [#537](https://github.com/openshift/cluster-capi-operator/pull/537)
* NO-JIRA: fix: conversion: handle HTTPProtocolIPv6, temporarily disable its diffing [#531](https://github.com/openshift/cluster-capi-operator/pull/531)
* [OCPBUGS-84378](https://issues.redhat.com/browse/OCPBUGS-84378): Refactor e2e newAWSMachineTemplate to use mapi2capi [#532](https://github.com/openshift/cluster-capi-operator/pull/532)
* [OCPBUGS-84340](https://issues.redhat.com/browse/OCPBUGS-84340): Fix e2e flake when workers are in us-west-2b [#529](https://github.com/openshift/cluster-capi-operator/pull/529)
* NO-JIRA: fix: tolerate not-found upon infra machine deletion [#528](https://github.com/openshift/cluster-capi-operator/pull/528)
* NO-JIRA: Update e2e diagnostics [#488](https://github.com/openshift/cluster-capi-operator/pull/488)
* [OCPCLOUD-3345](https://issues.redhat.com/browse/OCPCLOUD-3345), [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add support for TLS envsubst substitution [#519](https://github.com/openshift/cluster-capi-operator/pull/519)
* [OCPBUGS-83601](https://issues.redhat.com/browse/OCPBUGS-83601): Bump grpc package for CVE fix [#523](https://github.com/openshift/cluster-capi-operator/pull/523)
* NO-JIRA: Fix crdcompatibility flakes after webhook creation [#525](https://github.com/openshift/cluster-capi-operator/pull/525)
* NO-JIRA: Update OWNERS [#522](https://github.com/openshift/cluster-capi-operator/pull/522)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/807bdc323f2f042961bcd783bd999bb3d03bda4b...5767be9caecedf9dbbd2bdfd04633514b34b408f)
### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/38f5e00cbd0085f6b62b98cd9ed044f54c89ad07)
* [SPLAT-2713](https://issues.redhat.com/browse/SPLAT-2713): Reapply "Merge pull request #476" to bring in e2e for BYO SG for AWS NLB [#492](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/492)
* [OCPBUGS-98617](https://issues.redhat.com/browse/OCPBUGS-98617): Fixes daemonset Progressing=True logic [#490](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/490)
* Revert #476 "SPLAT-2713: Update AWS CCM e2e test module version" [#491](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/491)
* [SPLAT-2713](https://issues.redhat.com/browse/SPLAT-2713): Update AWS CCM e2e test module version [#476](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/476)
* [OCPBUGS-64852](https://issues.redhat.com/browse/OCPBUGS-64852): Fixes progressing=True condition reporting [#488](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/488)
* [TRT-2777](https://issues.redhat.com/browse/TRT-2777): Revert #479 "Revert 'TRT-2754: Revert Updates clusteroperator_controller progressing'" [#487](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/487)
* [OCPBUGS-64852](https://issues.redhat.com/browse/OCPBUGS-64852): Revert "TRT-2754: Revert "Updates clusteroperator_controller progressing"" [#479](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/479)
* [OCPBUGS-87334](https://issues.redhat.com/browse/OCPBUGS-87334): update Dockerfile base image to ocp/5.0 [#483](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/483)
* NO-JIRA: manifests: Shift operator Deployment and ClusterOperator after CredentialsRequests [#478](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/478)
* [TRT-2754](https://issues.redhat.com/browse/TRT-2754): Revert "Updates clusteroperator_controller progressing" [#477](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/477)
* [OCPBUGS-64852](https://issues.redhat.com/browse/OCPBUGS-64852): Updates clusteroperator_controller progressing [#473](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/473)
* [OCPBUGS-64852](https://issues.redhat.com/browse/OCPBUGS-64852): Progressing fix [#467](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/467)
* [SPLAT-2792](https://issues.redhat.com/browse/SPLAT-2792): Fixed issue where old vCenters not removed from new cloud config [#469](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/469)
* [OCPBUGS-86303](https://issues.redhat.com/browse/OCPBUGS-86303): e2e/ote-ccm-aws: enhance tests to run hybrid in hypershift HC [#464](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/464)
* NO-JIRA: update owners for CCM-AWS OTE path for SPLAT teeam [#468](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/468)
* [OCPBUGS-42837](https://issues.redhat.com/browse/OCPBUGS-42837): Do not set Degraded=True on transient errors [#436](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/436)
* [OCPBUGS-86299](https://issues.redhat.com/browse/OCPBUGS-86299): e2e/ccm-aws-ote: support to dual-stack IPv6 primary [#466](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/466)
* [OCPBUGS-85414](https://issues.redhat.com/browse/OCPBUGS-85414): fix ote ccm aws e2e resiliency on HCP [#462](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/462)
* [OCPCLOUD-3436](https://issues.redhat.com/browse/OCPCLOUD-3436): use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs [#457](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/457)
* [SPLAT-2651](https://issues.redhat.com/browse/SPLAT-2651): Added support to manage kube-cloud-config for vSphere in openshift-config-managed [#442](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/442)
* NO-JIRA: fix: add pod annotation: openshift.io/required-scc: hostaccess [#450](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/450)
* NO-JIRA: bump controller-runtime-common to latest main [#456](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/456)
* [SPLAT-2562](https://issues.redhat.com/browse/SPLAT-2562): Refactored OTE and added new 3CMO OTE binary [#446](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/446)
* [OCPBUGS-83399](https://issues.redhat.com/browse/OCPBUGS-83399): e2e/ote/ccm-aws fix hairpin traffic on NLB and CLB in EUSC [#449](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/449)
* NO-JIRA: Update OWNERS [#448](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/448)
* [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/1eccfe33d83686e74769ea196660b8d09d249b04...38f5e00cbd0085f6b62b98cd9ed044f54c89ad07)
### [cluster-config-api](https://github.com/openshift/api/tree/9bcaa16cb258e544dd76b78ff2dc3f89af840f76)
* Check all hypershift variants when the featuregate is not platform specific [#2951](https://github.com/openshift/api/pull/2951)
* [OCPBUGS-80958](https://issues.redhat.com/browse/OCPBUGS-80958): NodeUID in status to detect replaced node with same name [#2821](https://github.com/openshift/api/pull/2821)
* [OPRUN-4691](https://issues.redhat.com/browse/OPRUN-4691): Promote OLMLifecycleAndCompatibility feature gate to Default [#2920](https://github.com/openshift/api/pull/2920)
* [OPNET-780](https://issues.redhat.com/browse/OPNET-780): Add BGPBasedVIPManagement feature gate and BGP VIP management fields [#2923](https://github.com/openshift/api/pull/2923)
* [CNTRLPLANE-3361](https://issues.redhat.com/browse/CNTRLPLANE-3361): Align with latest beta API of Vault [#2936](https://github.com/openshift/api/pull/2936)
* Update KAL to latest [#2939](https://github.com/openshift/api/pull/2939)
* [NE-2569](https://issues.redhat.com/browse/NE-2569): Promote Dynamic Configuration Manager to Default [#2788](https://github.com/openshift/api/pull/2788)
* Adapt publish kubebuilder tools to ocp5 + publish k8s v1.36 kubebuilder tools [#2941](https://github.com/openshift/api/pull/2941)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): Add KMS preflight check API to operator/v1 [#2916](https://github.com/openshift/api/pull/2916)
* [CORS-4435](https://issues.redhat.com/browse/CORS-4435): GCP Sovereign Cloud Feature Gate [#2810](https://github.com/openshift/api/pull/2810)
* [OCPSTRAT-3036](https://issues.redhat.com/browse/OCPSTRAT-3036): Rebase 1.36.2 [#2813](https://github.com/openshift/api/pull/2813)
* [OCPBUGS-91634](https://issues.redhat.com/browse/OCPBUGS-91634): CAPI: Fix ImageDigestFormat validation to allow deep registry paths [#2918](https://github.com/openshift/api/pull/2918)
* Sippy timestamp filter should use Millisecond unix timestamp for proper filtering [#2928](https://github.com/openshift/api/pull/2928)
* Remove AzureClusterHostedDNSInstall Featuregate [#2902](https://github.com/openshift/api/pull/2902)
* [OCPNODE-4604](https://issues.redhat.com/browse/OCPNODE-4604): Upgrade v1 criocp payload resource [#2900](https://github.com/openshift/api/pull/2900)
* [CONSOLE-5163](https://issues.redhat.com/browse/CONSOLE-5163): Add labels field to Ingress componentRoutes [#2845](https://github.com/openshift/api/pull/2845)
* tooling: Update `verify-feature-promotion` logic for installer-focused features [#2903](https://github.com/openshift/api/pull/2903)
* [CNTRLPLANE-3751](https://issues.redhat.com/browse/CNTRLPLANE-3751): osin: Add ProxyTrustedCA field to OAuthConfig [#2917](https://github.com/openshift/api/pull/2917)
* Integrate models-schema into codegen and fix openapi verify issues [#2904](https://github.com/openshift/api/pull/2904)
* [CNTRLPLANE-3629](https://issues.redhat.com/browse/CNTRLPLANE-3629): features: promote ExternalOIDCExternalClaimsSourcing to TechPreviewNoUpgrade [#2893](https://github.com/openshift/api/pull/2893)
* [CNTRLPLANE-3745](https://issues.redhat.com/browse/CNTRLPLANE-3745): Add AuthenticationComponentProxy API for component-scoped proxy [#2909](https://github.com/openshift/api/pull/2909)
* [NE-2217](https://issues.redhat.com/browse/NE-2217): Add haproxyVersion in IngressController API [#2895](https://github.com/openshift/api/pull/2895)
* [SSCSI-245](https://issues.redhat.com/browse/SSCSI-245): Rename rotationPollIntervalSeconds to minimumRefreshAge [#2906](https://github.com/openshift/api/pull/2906)
* [OCPBUGS-94869](https://issues.redhat.com/browse/OCPBUGS-94869): fix(crd): adjust storage settings for CRIOCredentialProviderConfig [#2913](https://github.com/openshift/api/pull/2913)
* [AGENT-1522](https://issues.redhat.com/browse/AGENT-1522): Graduate InternalReleaseImage from v1alpha1 to v1 [#2880](https://github.com/openshift/api/pull/2880)
* [PIXAA-16](https://issues.redhat.com/browse/PIXAA-16): Updates API review skill [#2910](https://github.com/openshift/api/pull/2910)
* [NE-2729](https://issues.redhat.com/browse/NE-2729): Add feature gate for multiple HAProxy versions [#2852](https://github.com/openshift/api/pull/2852)
* CORENET-6714 Adding documentation [#2907](https://github.com/openshift/api/pull/2907)
* MON: rename remote write SafeAuthorization to Authorization [#2901](https://github.com/openshift/api/pull/2901)
* [AUTOSCALE-827](https://issues.redhat.com/browse/AUTOSCALE-827): add KarpenterOperator feature gate [#2898](https://github.com/openshift/api/pull/2898)
* Add Protobuf generation to the codegen utility [#1385](https://github.com/openshift/api/pull/1385)
* [SPLAT-2718](https://issues.redhat.com/browse/SPLAT-2718): Promote VSphereMixedNodeEnv to GA [#2798](https://github.com/openshift/api/pull/2798)
* [SPLAT-2588](https://issues.redhat.com/browse/SPLAT-2588): Promoting AWSServiceLBNetworkSecurityGroup on hypershift [#2838](https://github.com/openshift/api/pull/2838)
* [STOR-2771](https://issues.redhat.com/browse/STOR-2771): Add SELinuxMountGAReadiness FG [#2882](https://github.com/openshift/api/pull/2882)
* [OCPEDGE-2746](https://issues.redhat.com/browse/OCPEDGE-2746): Add MutableTopology feature gated infra spec.controlPlaneTopology [#2891](https://github.com/openshift/api/pull/2891)
* [OCPNODE-4125](https://issues.redhat.com/browse/OCPNODE-4125): Introduce to v1 CRIOCredentialProviderConfig [#2725](https://github.com/openshift/api/pull/2725)
* [STOR-2966](https://issues.redhat.com/browse/STOR-2966): Promote ExternalSnapshotMetadata feature gate to TechPreviewNoUpgrade [#2887](https://github.com/openshift/api/pull/2887)
* [OCPBUGS-63219](https://issues.redhat.com/browse/OCPBUGS-63219): Add protocol to AWS NLB parameters [#2661](https://github.com/openshift/api/pull/2661)
* [SSCSI-245](https://issues.redhat.com/browse/SSCSI-245): Add Secrets Store CSI driver configuration to ClusterCSIDriver API [#2846](https://github.com/openshift/api/pull/2846)
* [OCPCLOUD-3368](https://issues.redhat.com/browse/OCPCLOUD-3368): Adding cabilities for crdcompatibilitychecker and capi CRs [#2884](https://github.com/openshift/api/pull/2884)
* [SPLAT-2588](https://issues.redhat.com/browse/SPLAT-2588): fix hypershift topology variant to match Sippy classification [#2899](https://github.com/openshift/api/pull/2899)
* [CNTRLPLANE-2449](https://issues.redhat.com/browse/CNTRLPLANE-2449): feat: implement OpenAPIModelNamer interface [#2856](https://github.com/openshift/api/pull/2856)
* [OCPBUGS-90053](https://issues.redhat.com/browse/OCPBUGS-90053): add new serviceAccountToken fs type [#2894](https://github.com/openshift/api/pull/2894)
* operator/v1: replace anyOf with CEL XValidation for maxConnections [#2861](https://github.com/openshift/api/pull/2861)
* [CNTRLPLANE-3513](https://issues.redhat.com/browse/CNTRLPLANE-3513): add kms health reports [#2881](https://github.com/openshift/api/pull/2881)
* [NE-2278](https://issues.redhat.com/browse/NE-2278): Move ingresscontroller api file to proper name [#2892](https://github.com/openshift/api/pull/2892)
* [CORS-4029](https://issues.redhat.com/browse/CORS-4029): Promote AWS ClusterHostedDNSInstall to Default [#2775](https://github.com/openshift/api/pull/2775)
* Revert "TRT-2701: Revert "SPLAT-2793: Promoted VSphereMultiVCenterDay2 feature gate to TP"" [#2886](https://github.com/openshift/api/pull/2886)
* NO-JIRA: tools: fix verify-codegen in git worktrees [#2888](https://github.com/openshift/api/pull/2888)
* [OCPCLOUD-3540](https://issues.redhat.com/browse/OCPCLOUD-3540): Add MachineAPIMigration platform-specific featuregates for Azure, BareMetal, GCP, and PowerVS [#2889](https://github.com/openshift/api/pull/2889)
* [PIXAA-13](https://issues.redhat.com/browse/PIXAA-13): evals for api review command [#2606](https://github.com/openshift/api/pull/2606)
* [MCO-2294](https://issues.redhat.com/browse/MCO-2294): promote OSStreams to GA in self-managed clusters [#2849](https://github.com/openshift/api/pull/2849)
* [TRT-2701](https://issues.redhat.com/browse/TRT-2701): Revert "SPLAT-2793: Promoted VSphereMultiVCenterDay2 feature gate to TP" [#2885](https://github.com/openshift/api/pull/2885)
* Monitoring API: remove maximum retention days prometheus [#2851](https://github.com/openshift/api/pull/2851)
* [SPLAT-2793](https://issues.redhat.com/browse/SPLAT-2793): Promoted VSphereMultiVCenterDay2 feature gate to TP [#2879](https://github.com/openshift/api/pull/2879)
* [OCPBUGS-87497](https://issues.redhat.com/browse/OCPBUGS-87497): Updating ose-cluster-config-api-container image to be consistent with ART for 5.0 [#2878](https://github.com/openshift/api/pull/2878)
* [CNTRLPLANE-3395](https://issues.redhat.com/browse/CNTRLPLANE-3395): Lower maximum allowed etcd quota from 32 to 16GiB [#2840](https://github.com/openshift/api/pull/2840)
* [OCPEDGE-2410](https://issues.redhat.com/browse/OCPEDGE-2410): feat: add mutable topology featuregate [#2872](https://github.com/openshift/api/pull/2872)
* Add KubeletConfigAccepted const in 'machineconfiguration/v1/types.go' [#2853](https://github.com/openshift/api/pull/2853)
* [MON-4029](https://issues.redhat.com/browse/MON-4029): Add KubeStateMetricsConfig to ClusterMonitoring API [#2778](https://github.com/openshift/api/pull/2778)
* [MCO-2296](https://issues.redhat.com/browse/MCO-2296): Promote OSImageStreams to v1 [#2854](https://github.com/openshift/api/pull/2854)
* [MON-4565](https://issues.redhat.com/browse/MON-4565): Add enableUserAlertmanagerConfig to ClusterMonitoring API [#2855](https://github.com/openshift/api/pull/2855)
* Update getLatestReleases to ignore non OCP releases [#2868](https://github.com/openshift/api/pull/2868)
* [NE-2334](https://issues.redhat.com/browse/NE-2334): Implement enhancement in OpenShift API to support for TLS curves in TLSProfile [#2583](https://github.com/openshift/api/pull/2583)
* Revert "Merge pull request #2693 from jcmoraisjr/OCPBUGS-74511-remove… [#2862](https://github.com/openshift/api/pull/2862)
* [CNTRLPLANE-2521](https://issues.redhat.com/browse/CNTRLPLANE-2521): feat: configv1/authentication: add fields for sourcing claims from external sources [#2827](https://github.com/openshift/api/pull/2827)
* [MON-4578](https://issues.redhat.com/browse/MON-4578): Add new fields to ThanosQuerierConfig [#2835](https://github.com/openshift/api/pull/2835)
* [CNTRLPLANE-3361](https://issues.redhat.com/browse/CNTRLPLANE-3361): make transitMount required [#2847](https://github.com/openshift/api/pull/2847)
* [MON-4579](https://issues.redhat.com/browse/MON-4579): Remove NodeSelector and Tolerations from NodeExporterConfig [#2837](https://github.com/openshift/api/pull/2837)
* [CORENET-6714](https://issues.redhat.com/browse/CORENET-6714): Enable Network Observability on Day 0 [#2752](https://github.com/openshift/api/pull/2752)
* [OCPBUGS-74511](https://issues.redhat.com/browse/OCPBUGS-74511): remove RouteExternalCertificate feature gate [#2693](https://github.com/openshift/api/pull/2693)
* [CNTRLPLANE-3361](https://issues.redhat.com/browse/CNTRLPLANE-3361): update vault kms plugin validation [#2836](https://github.com/openshift/api/pull/2836)
* [OCPSTRAT-3036](https://issues.redhat.com/browse/OCPSTRAT-3036): Promote MutatingAdmissionPolicy feature to Default [#2832](https://github.com/openshift/api/pull/2832)
* [OPRUN-4590](https://issues.redhat.com/browse/OPRUN-4590): Add OLMLifecycleAndCompatibility feature gate [#2824](https://github.com/openshift/api/pull/2824)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): Rename KMSConfig Struct to KMSPluginConfig [#2833](https://github.com/openshift/api/pull/2833)
* [SRVKP-11558](https://issues.redhat.com/browse/SRVKP-11558): remove deprecated k8s.io/api packages removed in v0.36.0 [#2834](https://github.com/openshift/api/pull/2834)
* [CORENET-6861](https://issues.redhat.com/browse/CORENET-6861): Promote EVPN Feature Gate [#2799](https://github.com/openshift/api/pull/2799)
* Revert "OCPBUGS-83492: Allow :ref suffix in additionalLayerStores path for stargz-store to support lazy image pulling" [#2823](https://github.com/openshift/api/pull/2823)
* [MON-4561](https://issues.redhat.com/browse/MON-4561): API: Add softirqs node-exporter collector to ClusterMonitoring CRD [#2825](https://github.com/openshift/api/pull/2825)
* Clarify cluster operator Progressing condition [#2829](https://github.com/openshift/api/pull/2829)
* [OCPNODE-4498](https://issues.redhat.com/browse/OCPNODE-4498): features: drop DRAPartitionableDevices awareness [#2828](https://github.com/openshift/api/pull/2828)
* [OCPBUGS-43353](https://issues.redhat.com/browse/OCPBUGS-43353): Add pattern validation for registry entries in image config [#2787](https://github.com/openshift/api/pull/2787)
* [SPLAT-2649](https://issues.redhat.com/browse/SPLAT-2649): Added vSphere Day 2 logic to CRDs [#2784](https://github.com/openshift/api/pull/2784)
* [OCPBUGS-74506](https://issues.redhat.com/browse/OCPBUGS-74506): Remove ConsolePluginSecurityPolicy featuregate [#2683](https://github.com/openshift/api/pull/2683)
* [CNTRLPLANE-2711](https://issues.redhat.com/browse/CNTRLPLANE-2711): add vault kms plug configuration api [#2805](https://github.com/openshift/api/pull/2805)
* [OCPBUGS-74525](https://issues.redhat.com/browse/OCPBUGS-74525): OCPBUGS-74526: Remove UserNamespacesPodSecurityStandards and UserNamespacesSupport [#2762](https://github.com/openshift/api/pull/2762)
* [OCPBUGS-82584](https://issues.redhat.com/browse/OCPBUGS-82584): Add labelSelector to MachineSet status for scale subresource [#2807](https://github.com/openshift/api/pull/2807)
* [OCPBUGS-83754](https://issues.redhat.com/browse/OCPBUGS-83754): fix(config/v1): define constants for authentication types as typed constants [#2814](https://github.com/openshift/api/pull/2814)
* [OCPBUGS-83492](https://issues.redhat.com/browse/OCPBUGS-83492): Allow :ref suffix in additionalLayerStores path for stargz-store to support lazy image pulling [#2806](https://github.com/openshift/api/pull/2806)
* [MON-4037](https://issues.redhat.com/browse/MON-4037): Add MonitoringPluginConfig to ClusterMonitoring API [#2768](https://github.com/openshift/api/pull/2768)
* fix: small typos in comments in types.go [#2804](https://github.com/openshift/api/pull/2804)
* [OCPBUGS-82292](https://issues.redhat.com/browse/OCPBUGS-82292): extend supported values for MCN IRI image status field [#2800](https://github.com/openshift/api/pull/2800)
* [MON-4036](https://issues.redhat.com/browse/MON-4036): Add NodeExporterConfig to ClusterMonitoring API [#2744](https://github.com/openshift/api/pull/2744)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add component names, manifestSubstitutions, and observedGeneration to CAPI revisions [#2786](https://github.com/openshift/api/pull/2786)
* [Full changelog](https://github.com/openshift/api/compare/b37d107c490a35659457ed38f9f5b109f85448da...9bcaa16cb258e544dd76b78ff2dc3f89af840f76)
### [cluster-config-operator](https://github.com/openshift/cluster-config-operator/tree/a02c879931c6108326c0a514df0ce2e390f3536c)
* [CNTRLPLANE-2270](https://issues.redhat.com/browse/CNTRLPLANE-2270): Update README with operator responsibilities [#496](https://github.com/openshift/cluster-config-operator/pull/496)
* [CNTRLPLANE-2270](https://issues.redhat.com/browse/CNTRLPLANE-2270): OTE scaffolding and E2E tests [#492](https://github.com/openshift/cluster-config-operator/pull/492)
* [CNTRLPLANE-3423](https://issues.redhat.com/browse/CNTRLPLANE-3423): feat: have CVO inject the centralized TLS configuration into the operator's config [#491](https://github.com/openshift/cluster-config-operator/pull/491)
* [SPLAT-2747](https://issues.redhat.com/browse/SPLAT-2747): Updated kube cloud config controller to react to feature gate updates [#489](https://github.com/openshift/cluster-config-operator/pull/489)
* [SPLAT-2717](https://issues.redhat.com/browse/SPLAT-2717): Migrate vSphere sync of kube-cloud-config to 3CMO [#481](https://github.com/openshift/cluster-config-operator/pull/481)
* [CNTRLPLANE-1544](https://issues.redhat.com/browse/CNTRLPLANE-1544): manifests: Use restricted-v3 scc for deployment [#451](https://github.com/openshift/cluster-config-operator/pull/451)
* [Full changelog](https://github.com/openshift/cluster-config-operator/compare/e0c2428e4618493ad9db0681e3b91444746ddf2c...a02c879931c6108326c0a514df0ce2e390f3536c)
### [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator/tree/452cee8c1f4efb683fb6bcb15b61366695d98e1e)
* [OCPBUGS-87338](https://issues.redhat.com/browse/OCPBUGS-87338): Updating ose-cluster-control-plane-machine-set-operator-container image to be consistent with ART for 5.0 [#408](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/408)
* [OCPBUGS-86860](https://issues.redhat.com/browse/OCPBUGS-86860): Fixed issue where nameserver is not set when recreating cpms [#406](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/406)
* NO-JIRA: bump controller-runtime-common to latest main [#403](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/403)
* NO-JIRA: Update OWNERS [#399](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/399)
* [Full changelog](https://github.com/openshift/cluster-control-plane-machine-set-operator/compare/b2e26b937e7f6dab36b63ace9c8453ba9654011c...452cee8c1f4efb683fb6bcb15b61366695d98e1e)
### [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator/tree/67648d56d6b312e661714f8e7bf0e9be1d532c1c)
* [STOR-2914](https://issues.redhat.com/browse/STOR-2914): Bump all deps for 5.0.0 [#285](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/285)
* [STOR-2967](https://issues.redhat.com/browse/STOR-2967): Update SnapshotMetadataService CRD asset from v1alpha1 to v1beta1 [#279](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/279)
* [STOR-2954](https://issues.redhat.com/browse/STOR-2954): feat: have CVO inject the centralized TLS configuration into the operator's config [#276](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/276)
* [STOR-3003](https://issues.redhat.com/browse/STOR-3003): Update group snapshot CRDs to support both v1 and v1beta2 APIs [#282](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/282)
* [OCPBUGS-87354](https://issues.redhat.com/browse/OCPBUGS-87354): Updating ose-cluster-csi-snapshot-controller-operator-container image to be consistent with ART for 5.0 [#277](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/277)
* [OCPBUGS-87252](https://issues.redhat.com/browse/OCPBUGS-87252): Fix group snapshots on HyperShift [#278](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/278)
* [Full changelog](https://github.com/openshift/cluster-csi-snapshot-controller-operator/compare/108f37f0e378accc322cbeb68136ec500ec35b94...67648d56d6b312e661714f8e7bf0e9be1d532c1c)
### [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator/tree/4b8ae49940eefc50fa48da5179e735dd6ccd42d9)
* [NE-2765](https://issues.redhat.com/browse/NE-2765): Bump Kubernetes to 1.36.2 and Go to 1.26 [#483](https://github.com/openshift/cluster-dns-operator/pull/483)
* [NE-2743](https://issues.redhat.com/browse/NE-2743): Support centralized TLS security profiles for CDO metrics [#482](https://github.com/openshift/cluster-dns-operator/pull/482)
* NO-JIRA: Add aswinsuryan (asuryana@redhat.com) to OWNERS [#479](https://github.com/openshift/cluster-dns-operator/pull/479)
* [OCPBUGS-87391](https://issues.redhat.com/browse/OCPBUGS-87391): Updating ose-cluster-dns-operator-container image to be consistent with ART for 5.0 [#478](https://github.com/openshift/cluster-dns-operator/pull/478)
* [NE-2391](https://issues.redhat.com/browse/NE-2391): Add progressive disclosure AI agent context [#471](https://github.com/openshift/cluster-dns-operator/pull/471)
* [OCPBUGS-77532](https://issues.redhat.com/browse/OCPBUGS-77532): Fix premature node schedulability marking in taint checking [#470](https://github.com/openshift/cluster-dns-operator/pull/470)
* [Full changelog](https://github.com/openshift/cluster-dns-operator/compare/3d2141182243cde1ec6417bd005c76d29aa88a01...4b8ae49940eefc50fa48da5179e735dd6ccd42d9)
### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/ebea15aeb57ecaca4ff8e8fdf5aa28d5a4469d12)
* [OCPEDGE-2707](https://issues.redhat.com/browse/OCPEDGE-2707): Add TNF Pacemaker PrometheusRule alerts [#1650](https://github.com/openshift/cluster-etcd-operator/pull/1650)
* [CNTRLPLANE-2847](https://issues.redhat.com/browse/CNTRLPLANE-2847): render: Read FeatureGate CR from rendered manifests [#1648](https://github.com/openshift/cluster-etcd-operator/pull/1648)
* [OCPEDGE-2705](https://issues.redhat.com/browse/OCPEDGE-2705): Add TNF Pacemaker metrics controller [#1634](https://github.com/openshift/cluster-etcd-operator/pull/1634)
* [CNTRLPLANE-2847](https://issues.redhat.com/browse/CNTRLPLANE-2847): Support PKI customization [#1593](https://github.com/openshift/cluster-etcd-operator/pull/1593)
* [CNTRLPLANE-3727](https://issues.redhat.com/browse/CNTRLPLANE-3727): Agentic context docs and contributing guide [#1639](https://github.com/openshift/cluster-etcd-operator/pull/1639)
* [OCPBUGS-66334](https://issues.redhat.com/browse/OCPBUGS-66334): remove version check from guard precheck [#1520](https://github.com/openshift/cluster-etcd-operator/pull/1520)
* [OCPBUGS-87522](https://issues.redhat.com/browse/OCPBUGS-87522): Updating cluster-etcd-operator-container image to be consistent with ART for 5.0 [#1629](https://github.com/openshift/cluster-etcd-operator/pull/1629)
* NO-JIRA: update build-machinery-go to pull in updated verify [#1642](https://github.com/openshift/cluster-etcd-operator/pull/1642)
* NO-JIRA: quote bootstrap IP in bootkube etcd endpoints manifest [#1640](https://github.com/openshift/cluster-etcd-operator/pull/1640)
* [OCPEDGE-2770](https://issues.redhat.com/browse/OCPEDGE-2770): fix: handle default-port BMC URLs in Phase 3 address matching [#1638](https://github.com/openshift/cluster-etcd-operator/pull/1638)
* [OCPBUGS-88318](https://issues.redhat.com/browse/OCPBUGS-88318): fix cluster-restore-tnf.sh IP auto-detection when hostname diverges from node name [#1633](https://github.com/openshift/cluster-etcd-operator/pull/1633)
* [OCPBUGS-88490](https://issues.redhat.com/browse/OCPBUGS-88490): fix etcd operator deadlock when etcd-endpoints configmap is stale [#1631](https://github.com/openshift/cluster-etcd-operator/pull/1631)
* [OCPEDGE-2736](https://issues.redhat.com/browse/OCPEDGE-2736): feat: support MAC-based fencing secrets in update-fencing-credentials.sh [#1630](https://github.com/openshift/cluster-etcd-operator/pull/1630)
* NO-JIRA: Update vendored openshift/api and test for backendQuotaGiB max=16 [#1635](https://github.com/openshift/cluster-etcd-operator/pull/1635)
* [ETCD-704](https://issues.redhat.com/browse/ETCD-704): cluster-restore.sh: move extra /var/lib/etcd files to backup [#1628](https://github.com/openshift/cluster-etcd-operator/pull/1628)
* [OCPBUGS-77345](https://issues.redhat.com/browse/OCPBUGS-77345): validate snapshot before destructive operations in cluster-restore-tnf.sh [#1626](https://github.com/openshift/cluster-etcd-operator/pull/1626)
* [OCPEDGE-2116](https://issues.redhat.com/browse/OCPEDGE-2116): feat: support MAC-address based fencing credentials lookup [#1600](https://github.com/openshift/cluster-etcd-operator/pull/1600)
* [OCPBUGS-83332](https://issues.redhat.com/browse/OCPBUGS-83332): fix cluster-restore-tnf.sh for FQDN hostnames [#1622](https://github.com/openshift/cluster-etcd-operator/pull/1622)
* NO-JIRA: Fixed spelling in files and file names [#1624](https://github.com/openshift/cluster-etcd-operator/pull/1624)
* [OCPEDGE-2604](https://issues.redhat.com/browse/OCPEDGE-2604), [OCPEDGE-2605](https://issues.redhat.com/browse/OCPEDGE-2605): feat: add update-fencing-credentials.sh script for TNF fencing credentials rotation [#1611](https://github.com/openshift/cluster-etcd-operator/pull/1611)
* [CNTRLPLANE-3392](https://issues.redhat.com/browse/CNTRLPLANE-3392): Migrating etcd otp cases to ote [#1612](https://github.com/openshift/cluster-etcd-operator/pull/1612)
* NO-JIRA: Replace bash env var validator with go implementation [#1606](https://github.com/openshift/cluster-etcd-operator/pull/1606)
* NO-JIRA: separate grpc from http server [#1598](https://github.com/openshift/cluster-etcd-operator/pull/1598)
* NO-JIRA: fix CI failure [#1599](https://github.com/openshift/cluster-etcd-operator/pull/1599)
* NO-JIRA: Refactor render test validation [#1597](https://github.com/openshift/cluster-etcd-operator/pull/1597)
* NO-JIRA: Add control-plane-approvers to OWNERS [#1594](https://github.com/openshift/cluster-etcd-operator/pull/1594)
* And 2 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/3698b93d071f8b279b1721f90ced478f0b90b426...ebea15aeb57ecaca4ff8e8fdf5aa28d5a4469d12)
### [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator/tree/02bb5c2cd4d5f4d277cf987d6f65e58a732aefee)
* [OCPBUGS-99257](https://issues.redhat.com/browse/OCPBUGS-99257): Improve GCS KMS encryption error handling and documentation [#1344](https://github.com/openshift/cluster-image-registry-operator/pull/1344)
* [CORENET-7355](https://issues.redhat.com/browse/CORENET-7355): Remove redundant ingress rule from image-registry netpol [#1354](https://github.com/openshift/cluster-image-registry-operator/pull/1354)
* [OCPBUGS-96818](https://issues.redhat.com/browse/OCPBUGS-96818): bump golang.org/x/net [#1353](https://github.com/openshift/cluster-image-registry-operator/pull/1353)
* [OCPBUGS-85107](https://issues.redhat.com/browse/OCPBUGS-85107): fix required-scc annotation on image-pruner pods [#1351](https://github.com/openshift/cluster-image-registry-operator/pull/1351)
* [CNTRLPLANE-3658](https://issues.redhat.com/browse/CNTRLPLANE-3658): Add AGENTS.md, ARCHITECTURE.md, CLAUDE.md, update CONTRIBUTING.md [#1352](https://github.com/openshift/cluster-image-registry-operator/pull/1352)
* [OCPBUGS-66225](https://issues.redhat.com/browse/OCPBUGS-66225): Fix image-registry Degraded=True blips during upgrades [#1350](https://github.com/openshift/cluster-image-registry-operator/pull/1350)
* [OCPBUGS-73768](https://issues.redhat.com/browse/OCPBUGS-73768): bugfix: podtemplatespec: update topology spread constraints [#1347](https://github.com/openshift/cluster-image-registry-operator/pull/1347)
* NO-JIRA: fix flaky TestGlobalTLSCopy unit test [#1341](https://github.com/openshift/cluster-image-registry-operator/pull/1341)
* [OCPBUGS-84725](https://issues.redhat.com/browse/OCPBUGS-84725): Fix stale config cache causing incorrect deployment [#1329](https://github.com/openshift/cluster-image-registry-operator/pull/1329)
* [OCPBUGS-63691](https://issues.redhat.com/browse/OCPBUGS-63691): replace node-ca shell script with go implementation [#1325](https://github.com/openshift/cluster-image-registry-operator/pull/1325)
* [IR-486](https://issues.redhat.com/browse/IR-486): use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs [#1326](https://github.com/openshift/cluster-image-registry-operator/pull/1326)
* NO-JIRA: Add control-plane-approvers to OWNERS [#1324](https://github.com/openshift/cluster-image-registry-operator/pull/1324)
* [OCPBUGS-83282](https://issues.redhat.com/browse/OCPBUGS-83282): Allow longer window before going Degraded [#1318](https://github.com/openshift/cluster-image-registry-operator/pull/1318)
* [CNTRLPLANE-2660](https://issues.redhat.com/browse/CNTRLPLANE-2660): e2e testing automation: Image Registry network policy [#1320](https://github.com/openshift/cluster-image-registry-operator/pull/1320)
* [OCPBUGS-66225](https://issues.redhat.com/browse/OCPBUGS-66225): ImageConfigController: add inertia before ImageConfigC… [#1319](https://github.com/openshift/cluster-image-registry-operator/pull/1319)
* [Full changelog](https://github.com/openshift/cluster-image-registry-operator/compare/3a32428c3d183a0c6011359d2c6cf87d05736472...02bb5c2cd4d5f4d277cf987d6f65e58a732aefee)
### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/d7aafd957d1c126f5241ab716ad55ad0d160c042)
* [OCPBUGS-90616](https://issues.redhat.com/browse/OCPBUGS-90616): Add GRPCRoute to Gateway API e2e CRD test coverage [#1482](https://github.com/openshift/cluster-ingress-operator/pull/1482)
* [NE-2737](https://issues.redhat.com/browse/NE-2737): Add support for TLS curves in router deployment configuration [#1478](https://github.com/openshift/cluster-ingress-operator/pull/1478)
* [NE-2764](https://issues.redhat.com/browse/NE-2764): Bump Kubernetes to 1.36.2 and Go to 1.26 [#1505](https://github.com/openshift/cluster-ingress-operator/pull/1505)
* [OCPBUGS-98310](https://issues.redhat.com/browse/OCPBUGS-98310): Bump sail-operator install library to OSSM 3.4.0 [#1508](https://github.com/openshift/cluster-ingress-operator/pull/1508)
* [NE-2219](https://issues.redhat.com/browse/NE-2219): Select HAProxy version from IngressController API [#1498](https://github.com/openshift/cluster-ingress-operator/pull/1498)
* [TRT-2793](https://issues.redhat.com/browse/TRT-2793): Revert Bump sail-operator install library to OSSM 3.4.0 [#1507](https://github.com/openshift/cluster-ingress-operator/pull/1507)
* [OCPBUGS-98310](https://issues.redhat.com/browse/OCPBUGS-98310): vendor sail-operator install library from OSSM 3.4 [#1456](https://github.com/openshift/cluster-ingress-operator/pull/1456)
* [NE-2218](https://issues.redhat.com/browse/NE-2218): Add new HAProxy 2.8 and 3.2 image references [#1499](https://github.com/openshift/cluster-ingress-operator/pull/1499)
* [NE-2664](https://issues.redhat.com/browse/NE-2664): deploy haproxy as sidecar [#1484](https://github.com/openshift/cluster-ingress-operator/pull/1484)
* [OCPBUGS-86833](https://issues.redhat.com/browse/OCPBUGS-86833): Detect orphaned OSSM subscription after noOLM migration [#1475](https://github.com/openshift/cluster-ingress-operator/pull/1475)
* Revert "NE-2664: deploy haproxy as sidecar (#1439)" [#1483](https://github.com/openshift/cluster-ingress-operator/pull/1483)
* [NE-2664](https://issues.redhat.com/browse/NE-2664): deploy haproxy as sidecar [#1439](https://github.com/openshift/cluster-ingress-operator/pull/1439)
* [OCPBUGS-90505](https://issues.redhat.com/browse/OCPBUGS-90505): Guard OLM watches with capability check in gatewayclass controller [#1479](https://github.com/openshift/cluster-ingress-operator/pull/1479)
* [OCPBUGS-65476](https://issues.redhat.com/browse/OCPBUGS-65476): Add openshift-ingress-operator ClusterRole to ClusterO… [#1313](https://github.com/openshift/cluster-ingress-operator/pull/1313)
* [OCPBUGS-87445](https://issues.redhat.com/browse/OCPBUGS-87445): Updating ose-cluster-ingress-operator-container image to be consistent with ART for 5.0 [#1463](https://github.com/openshift/cluster-ingress-operator/pull/1463)
* NO-JIRA: Add aswinsuryan (asuryana@redhat.com) to OWNERS [#1466](https://github.com/openshift/cluster-ingress-operator/pull/1466)
* [OCPBUGS-87205](https://issues.redhat.com/browse/OCPBUGS-87205): Add configuration override for X-SSL strip [#1465](https://github.com/openshift/cluster-ingress-operator/pull/1465)
* [NE-2692](https://issues.redhat.com/browse/NE-2692): Replace iptables with nftables in TestConnectTimeout e2e test [#1443](https://github.com/openshift/cluster-ingress-operator/pull/1443)
* [OCPBUGS-36723](https://issues.redhat.com/browse/OCPBUGS-36723): Add missing include annotations to IBM Cloud and PowerVS ingress CredentialsRequests [#1457](https://github.com/openshift/cluster-ingress-operator/pull/1457)
* [NE-2723](https://issues.redhat.com/browse/NE-2723): Migrate to aws-sdk-go-v2 [#1445](https://github.com/openshift/cluster-ingress-operator/pull/1445)
* [OCPBUGS-85679](https://issues.redhat.com/browse/OCPBUGS-85679): Improve e2e tests reliability [#1434](https://github.com/openshift/cluster-ingress-operator/pull/1434)
* [OCPBUGS-85676](https://issues.redhat.com/browse/OCPBUGS-85676): Harden CRD permission RBAC in operator ClusterRole [#1454](https://github.com/openshift/cluster-ingress-operator/pull/1454)
* [OCPBUGS-74497](https://issues.redhat.com/browse/OCPBUGS-74497): Add UserAgent to Azure SDK client telemetry options [#1400](https://github.com/openshift/cluster-ingress-operator/pull/1400)
* [OCPBUGS-85690](https://issues.redhat.com/browse/OCPBUGS-85690): Add referencegrants and backendtlspolicies to Gateway API RBAC [#1453](https://github.com/openshift/cluster-ingress-operator/pull/1453)
* [OCPBUGS-84491](https://issues.redhat.com/browse/OCPBUGS-84491): Set terminationMessagePolicy on gateway proxy containers [#1428](https://github.com/openshift/cluster-ingress-operator/pull/1428)
* [OCPBUGS-83923](https://issues.redhat.com/browse/OCPBUGS-83923): Update grpc-go and x/net [#1447](https://github.com/openshift/cluster-ingress-operator/pull/1447)
* [NE-2662](https://issues.redhat.com/browse/NE-2662): use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs [#1431](https://github.com/openshift/cluster-ingress-operator/pull/1431)
* [OCPBUGS-80966](https://issues.redhat.com/browse/OCPBUGS-80966): Fix malformed PEM bundle when tls.crt lacks trailing newline [#1405](https://github.com/openshift/cluster-ingress-operator/pull/1405)
* [OCPBUGS-84773](https://issues.redhat.com/browse/OCPBUGS-84773): Allow host network connections to the ingress canary [#1430](https://github.com/openshift/cluster-ingress-operator/pull/1430)
* [OCPBUGS-81442](https://issues.redhat.com/browse/OCPBUGS-81442): TestUnsupportedConfigOverride: Ignore featuregate and defaults [#1408](https://github.com/openshift/cluster-ingress-operator/pull/1408)
* [OCPBUGS-84551](https://issues.redhat.com/browse/OCPBUGS-84551): isFIPSEnabled: Check FIPS_ENABLED env. var. first [#1427](https://github.com/openshift/cluster-ingress-operator/pull/1427)
* [OCPBUGS-54702](https://issues.redhat.com/browse/OCPBUGS-54702): change default timeout tunnel if using AWS NLB [#1349](https://github.com/openshift/cluster-ingress-operator/pull/1349)
* [OCPBUGS-81192](https://issues.redhat.com/browse/OCPBUGS-81192): Fix race condition in internal-to-external LB migration test [#1407](https://github.com/openshift/cluster-ingress-operator/pull/1407)
* [NE-2390](https://issues.redhat.com/browse/NE-2390): Adding AGENTS.md file [#1341](https://github.com/openshift/cluster-ingress-operator/pull/1341)
* [OCPBUGS-25739](https://issues.redhat.com/browse/OCPBUGS-25739): Fix PDB MaxUnavailable for 2-replica ingress controllers [#1380](https://github.com/openshift/cluster-ingress-operator/pull/1380)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/2c5b4ef0021db96ba6fecf630c53a15c12134578...d7aafd957d1c126f5241ab716ad55ad0d160c042)
### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/dab04ebace1a4b36bb40e8f4f87804754b69760b)
* [CNTRLPLANE-3361](https://issues.redhat.com/browse/CNTRLPLANE-3361): Update openshift/* [#2247](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2247)
* [CNTRLPLANE-3861](https://issues.redhat.com/browse/CNTRLPLANE-3861): Add KMS plugin sidecar revision readiness check [#2220](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2220)
* NO-JIRA: Automatic agentic rebase: Update library-go to d8f45c2 [#2238](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2238)
* NO-JIRA: Add KMS key ID identifier [#2237](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2237)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): encryptionstatusprovider: use KubeAPIServersGetter instead of Clientset [#2235](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2235)
* NO-JIRA: Refactor KMS cases [#2229](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2229)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): intro kubeAPIServerEncryptionStatusProvider [#2230](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2230)
* NO-JIRA: Remove old test files [#2232](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2232)
* [OCPSTRAT-3036](https://issues.redhat.com/browse/OCPSTRAT-3036): Rebase 1.36.2 [#2129](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2129)
* NO-JIRA: Bump library-go to sync [#2227](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2227)
* NO-JIRA: Remove old helper and assertion func [#2223](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2223)
* [OCPBUGS-38661](https://issues.redhat.com/browse/OCPBUGS-38661): Add 10-minute degraded inertia for StaticPodsDegraded [#2221](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2221)
* [CNTRLPLANE-3234](https://issues.redhat.com/browse/CNTRLPLANE-3234): wire KMS health reporter status writer [#2224](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2224)
* [OCPBUGS-38661](https://issues.redhat.com/browse/OCPBUGS-38661): Add 10-minute degraded inertia for NodeControllerDegraded [#2219](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2219)
* NO-JIRA: Automatic agentic rebase: Update library-go to fd74bb5 [#2216](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2216)
* [CNTRLPLANE-3721](https://issues.redhat.com/browse/CNTRLPLANE-3721): Add developer/agent documentation: CONTRIBUTING.md, AGENTS.md, ARCHITECTURE.md [#2213](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2213)
* [API-1768](https://issues.redhat.com/browse/API-1768): e2e network policy tests [#2097](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2097)
* NO-JIRA: Add test for kms to kms migration [#2215](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2215)
* NO-JIRA: Bump library-go for sync [#2214](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2214)
* NO-JIRA: Bump library-go [#2212](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2212)
* NO-JIRA: Update openshift dependencies [#2211](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2211)
* NO-JIRA: add kms preflight to NP to allow egress [#2209](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2209)
* [CNTRLPLANE-3518](https://issues.redhat.com/browse/CNTRLPLANE-3518): add openshift/kms parent to kms test suites [#2195](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2195)
* NO-JIRA: Automatic agentic rebase: Update library-go to b0f5231 [#2205](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2205)
* NO-JIRA: add preflight command [#2201](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2201)
* [CNTRLPLANE-3363](https://issues.redhat.com/browse/CNTRLPLANE-3363): Register health monitor as command [#2198](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2198)
* NO-JIRA: kms: bump library-go to get KMS plugin security context [#2188](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2188)
* [CNTRLPLANE-3545](https://issues.redhat.com/browse/CNTRLPLANE-3545): bump library-go to get CA bundle wiring [#2189](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2189)
* NO-JIRA: Automatic agentic rebase: Update library-go to 7fd5f33 [#2191](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2191)
* [OCPBUGS-86699](https://issues.redhat.com/browse/OCPBUGS-86699): Fix kube-apiserver-to-kubelet-signer refresh interval [#2174](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2174)
* NO-JIRA: Automatic agentic rebase: Update library-go to 0469313 [#2184](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2184)
* [CNTRLPLANE-3226](https://issues.redhat.com/browse/CNTRLPLANE-3226): switch to real Vault KMS plugin in CI [#2180](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2180)
* [CNTRLPLANE-3226](https://issues.redhat.com/browse/CNTRLPLANE-3226): bump library-go to get KMS plugin credentials [#2169](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2169)
* NO-JIRA: Automatic agentic rebase: Update library-go to d8750ed [#2177](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2177)
* NO-JIRA: Automatic agentic rebase: Update library-go to 0cf249e [#2176](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2176)
* NO-JIRA: Bump latest libray-go changes [#2173](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2173)
* NO-JIRA: remove old mock plugin deployment [#2168](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2168)
* NO-JIRA: kms: use DefaultFakeVaultEncryptionProvider to ensure AppRole secret setup [#2167](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2167)
* [OCPBUGS-86057](https://issues.redhat.com/browse/OCPBUGS-86057): render: fall back to Authentication CR [#2166](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2166)
* [CNTRLPLANE-3236](https://issues.redhat.com/browse/CNTRLPLANE-3236): support deploying Vault mock KMS plugin [#2146](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2146)
* NO-JIRA: Add KMS dummy case [#2161](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2161)
* NO-JIRA: Bump latest library-go changes [#2160](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2160)
* [CNTRLPLANE-3238](https://issues.redhat.com/browse/CNTRLPLANE-3238): Add New kms suite [#2156](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2156)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): Bump library-go and sync plugin changes [#2155](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2155)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2220 [#2150](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2150)
* [OCPSTRAT-3036](https://issues.redhat.com/browse/OCPSTRAT-3036): Temporarily extend MutatingAdmissionPolicy runtime-config range to <1.37.0 [#2148](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2148)
* [CNTRLPLANE-3347](https://issues.redhat.com/browse/CNTRLPLANE-3347): Migrate testKMSEncryptionOnOff to ote [#2127](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2127)
* [OCPBUGS-78016](https://issues.redhat.com/browse/OCPBUGS-78016): Use SkipInClusterAuthenticationLookup in check-endpoints [#2113](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2113)
* NO-JIRA: Removal of unuse suites [#2132](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2132)
* [OCPBUGS-76588](https://issues.redhat.com/browse/OCPBUGS-76588): operator should not override authentication config serviceAccountIssuer with the default one during the operator initialization [#2062](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2062)
* [CNTRLPLANE-3327](https://issues.redhat.com/browse/CNTRLPLANE-3327): Migrate TestEncryptionTypeAESCBC to OTE [#2122](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2122)
* NO-JIRA: Add control-plane-approvers to OWNERS [#2110](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2110)
* [CNTRLPLANE-3326](https://issues.redhat.com/browse/CNTRLPLANE-3326): Remove unstable TestBoundTokenOperatorSecretDeletion [#2123](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2123)
* NO-JIRA: Update library-go changes [#2107](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2107)
* [OCPBUGS-79663](https://issues.redhat.com/browse/OCPBUGS-79663): Allow setting the oauthMetadata when auth type is None [#2105](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2105)
* [CNTRLPLANE-3228](https://issues.redhat.com/browse/CNTRLPLANE-3228): Implement 5.0 EUS schedule in KAS-O [#2101](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2101)
* [CNTRLPLANE-2991](https://issues.redhat.com/browse/CNTRLPLANE-2991): Do not configure KAS with Structured Authentication when authentication type is OIDC [#2075](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2075)
* [CNTRLPLANE-2935](https://issues.redhat.com/browse/CNTRLPLANE-2935): Enable configurable PKI for managed certificate rotation [#2051](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2051)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/ebd723168d8bac16ce678a01c3ea7a7467030169...dab04ebace1a4b36bb40e8f4f87804754b69760b)
### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/4e72164b8bc505033ad565ab01d57963e7c9688e)
* [OCPSTRAT-3036](https://issues.redhat.com/browse/OCPSTRAT-3036): Rebase 1.36.2 [#930](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/930)
* [OCPBUGS-38662](https://issues.redhat.com/browse/OCPBUGS-38662): Add 10-minute degraded inertia for StaticPodsDegraded [#948](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/948)
* [OCPBUGS-38662](https://issues.redhat.com/browse/OCPBUGS-38662): Add 10-minute degraded inertia for NodeControllerDegraded [#947](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/947)
* NO-JIRA: Use %w for error wrapping consistently [#946](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/946)
* NO-JIRA: fix lock failure cases [#939](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/939)
* [CNTRLPLANE-3349](https://issues.redhat.com/browse/CNTRLPLANE-3349): Migrate KCM-O cases to ote [#935](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/935)
* [CNTRLPLANE-3107](https://issues.redhat.com/browse/CNTRLPLANE-3107): e2e testing automation Create network network policy test cases [#924](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/924)
* NO-JIRA: Add control-plane-approvers to OWNERS [#926](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/926)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/e2d54f2da0346309b329c34552d9896476683fc8...4e72164b8bc505033ad565ab01d57963e7c9688e)
### [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator/tree/56fa325466a1f2a2d41435ba3a58b2bf8fdab2f3)
* [OCPSTRAT-3036](https://issues.redhat.com/browse/OCPSTRAT-3036): Rebase 1.36.2 [#646](https://github.com/openshift/cluster-kube-scheduler-operator/pull/646)
* [OCPBUGS-38663](https://issues.redhat.com/browse/OCPBUGS-38663): Add 10-minute degraded inertia for StaticPodsDegraded [#655](https://github.com/openshift/cluster-kube-scheduler-operator/pull/655)
* [OCPBUGS-38663](https://issues.redhat.com/browse/OCPBUGS-38663): Add 10-minute degraded inertia for NodeControllerDegraded [#654](https://github.com/openshift/cluster-kube-scheduler-operator/pull/654)
* [WRKLDS-1126](https://issues.redhat.com/browse/WRKLDS-1126): e2e network policy tests [#637](https://github.com/openshift/cluster-kube-scheduler-operator/pull/637)
* NO-JIRA: Add control-plane-approvers to OWNERS [#639](https://github.com/openshift/cluster-kube-scheduler-operator/pull/639)
* [OCPBUGS-82503](https://issues.redhat.com/browse/OCPBUGS-82503): add /var/run/kubernetes as emptyDir [#638](https://github.com/openshift/cluster-kube-scheduler-operator/pull/638)
* [Full changelog](https://github.com/openshift/cluster-kube-scheduler-operator/compare/b80850a15da8485c52c486de30cec79600782206...56fa325466a1f2a2d41435ba3a58b2bf8fdab2f3)
### [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/tree/f5d3bfe64bda67ffb8299af01ebf2722287edf04)
* [STOR-2954](https://issues.redhat.com/browse/STOR-2954): feat: have CVO inject the centralized TLS configuration into the operator's config [#176](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/176)
* [OCPBUGS-65984](https://issues.redhat.com/browse/OCPBUGS-65984): add PodDisruptionBudget for migrator deployment [#172](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/172)
* [OCPBUGS-62629](https://issues.redhat.com/browse/OCPBUGS-62629): update library-go for deployment controller updates [#159](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/159)
* NO-JIRA: Add control-plane-approvers to OWNERS [#158](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/158)
* [OCPBUGS-51091](https://issues.redhat.com/browse/OCPBUGS-51091): schedule migrator pods on control-plane nodes [#157](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/157)
* [Full changelog](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/compare/e4e983adfde0ccf999efca551fc07b9e28562a10...f5d3bfe64bda67ffb8299af01ebf2722287edf04)
### [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver/tree/1ae3f157b88c167a7dbe06c36d6e55a82f7fd4f0)
* [OCPBUGS-87331](https://issues.redhat.com/browse/OCPBUGS-87331): Updating ose-cluster-machine-approver-container image to be consistent with ART for 5.0 [#306](https://github.com/openshift/cluster-machine-approver/pull/306)
* NO-JIRA: fix: use feature-gate annotation for CAPI manifests [#304](https://github.com/openshift/cluster-machine-approver/pull/304)
* NO-JIRA: fix: add pod annotation: openshift.io/required-scc: restricted-v2 [#297](https://github.com/openshift/cluster-machine-approver/pull/297)
* NO-JIRA: bump controller-runtime-common to latest main [#302](https://github.com/openshift/cluster-machine-approver/pull/302)
* NO-JIRA: Deploy cluster-machine-approver without host networking [#301](https://github.com/openshift/cluster-machine-approver/pull/301)
* NO-JIRA: Migrate away from deprecated ioutil [#284](https://github.com/openshift/cluster-machine-approver/pull/284)
* [OCPCLOUD-3347](https://issues.redhat.com/browse/OCPCLOUD-3347): tls: use centralized TLS profile (unrevert) [#292](https://github.com/openshift/cluster-machine-approver/pull/292)
* NO-JIRA: Update OWNERS [#296](https://github.com/openshift/cluster-machine-approver/pull/296)
* [Full changelog](https://github.com/openshift/cluster-machine-approver/compare/a9edd695aca56fb58e739b774670a01428360dd8...1ae3f157b88c167a7dbe06c36d6e55a82f7fd4f0)
### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/5042b52541130c3856028e29c7142d477c3f7d7d)
* NO-JIRA: Revert "MON-3697: use maximumStartupDurationSeconds instead of container patch" [#2982](https://github.com/openshift/cluster-monitoring-operator/pull/2982)
* [MON-4558](https://issues.redhat.com/browse/MON-4558): enable zoneinfo node-exporter collector via config [#2986](https://github.com/openshift/cluster-monitoring-operator/pull/2986)
* [OCPBUGS-98450](https://issues.redhat.com/browse/OCPBUGS-98450): fall back to kube-system/global-pull-secret for telemeter-client token [#2985](https://github.com/openshift/cluster-monitoring-operator/pull/2985)
* NO-ISSUE: Update prometheus-operator dependencies [#2966](https://github.com/openshift/cluster-monitoring-operator/pull/2966)
* [OU-1389](https://issues.redhat.com/browse/OU-1389): manually pass features to monitoring plugin [#2987](https://github.com/openshift/cluster-monitoring-operator/pull/2987)
* [OCPBUGS-99019](https://issues.redhat.com/browse/OCPBUGS-99019): jsonnet: exclude AlertmanagerClusterFailedPeers from shipped rules [#2993](https://github.com/openshift/cluster-monitoring-operator/pull/2993)
* [MON-4523](https://issues.redhat.com/browse/MON-4523): ClusterMonitoring prometheusConfig [#2953](https://github.com/openshift/cluster-monitoring-operator/pull/2953)
* [OU-1389](https://issues.redhat.com/browse/OU-1389): config path to point to correct directory [#2981](https://github.com/openshift/cluster-monitoring-operator/pull/2981)
* [OCPBUGS-93756](https://issues.redhat.com/browse/OCPBUGS-93756): update github.com/prometheus/prometheus [#2979](https://github.com/openshift/cluster-monitoring-operator/pull/2979)
* [OCPBUGS-92085](https://issues.redhat.com/browse/OCPBUGS-92085): set Prometheus shards value explicitly [#2972](https://github.com/openshift/cluster-monitoring-operator/pull/2972)
* [MON-4527](https://issues.redhat.com/browse/MON-4527): ClusterMonitoring NodeExporterConfig logic [#2919](https://github.com/openshift/cluster-monitoring-operator/pull/2919)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2971](https://github.com/openshift/cluster-monitoring-operator/pull/2971)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2967](https://github.com/openshift/cluster-monitoring-operator/pull/2967)
* NO-JIRA: test: add alertmanager test to catch broken UI embeds during automated bumps [#2968](https://github.com/openshift/cluster-monitoring-operator/pull/2968)
* NO-JIRA: test: merge UWM tests and improve resilience [#2964](https://github.com/openshift/cluster-monitoring-operator/pull/2964)
* [OCPBUGS-90089](https://issues.redhat.com/browse/OCPBUGS-90089): chore(test): clean up remote write config in TestPrometheusRemoteWrite [#2962](https://github.com/openshift/cluster-monitoring-operator/pull/2962)
* [OCPBUGS-90090](https://issues.redhat.com/browse/OCPBUGS-90090): chore(test): wait for full config restore in TestTelemeterRemoteWrite cleanup [#2961](https://github.com/openshift/cluster-monitoring-operator/pull/2961)
* [OCPBUGS-90100](https://issues.redhat.com/browse/OCPBUGS-90100): chore(TestPrometheusMetrics): use targets API instead of promQL [#2963](https://github.com/openshift/cluster-monitoring-operator/pull/2963)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2960](https://github.com/openshift/cluster-monitoring-operator/pull/2960)
* [OCPBUGS-87800](https://issues.redhat.com/browse/OCPBUGS-87800): fix(TestDocExamples) flake: use internal registry for test pods [#2957](https://github.com/openshift/cluster-monitoring-operator/pull/2957)
* [OCPBUGS-87799](https://issues.redhat.com/browse/OCPBUGS-87799): fix TestTelemetryReport flake by waiting for rate() on raw metrics [#2958](https://github.com/openshift/cluster-monitoring-operator/pull/2958)
* [MON-4485](https://issues.redhat.com/browse/MON-4485): Use EndpointSlices SD for KSM [#2879](https://github.com/openshift/cluster-monitoring-operator/pull/2879)
* [OCPBUGS-86782](https://issues.redhat.com/browse/OCPBUGS-86782): fix: wait for SCC use before creating Alertmanager operands [#2938](https://github.com/openshift/cluster-monitoring-operator/pull/2938)
* [MON-4486](https://issues.redhat.com/browse/MON-4486): Use EndpointSlices SD for OSM [#2880](https://github.com/openshift/cluster-monitoring-operator/pull/2880)
* [MON-4581](https://issues.redhat.com/browse/MON-4581): Update component minimal profiles [#2950](https://github.com/openshift/cluster-monitoring-operator/pull/2950)
* [MON-4522](https://issues.redhat.com/browse/MON-4522): manifests: merge KubeStateMetricsConfig from ClusterMonitoring CRD [#2951](https://github.com/openshift/cluster-monitoring-operator/pull/2951)
* NO-ISSUE: Fix typo in KubeDeploymentReplicasMismatch alert description [#2955](https://github.com/openshift/cluster-monitoring-operator/pull/2955)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2954](https://github.com/openshift/cluster-monitoring-operator/pull/2954)
* [MON-4524](https://issues.redhat.com/browse/MON-4524): manifests: merge OpenShiftStateMetricsConfig from ClusterMonitoring CRD [#2952](https://github.com/openshift/cluster-monitoring-operator/pull/2952)
* [OCPBUGS-87267](https://issues.redhat.com/browse/OCPBUGS-87267): Updating cluster-monitoring-operator-container image to be consistent with ART for 5.0 [#2949](https://github.com/openshift/cluster-monitoring-operator/pull/2949)
* NO-ISSUE: Update golangci-lint version [#2941](https://github.com/openshift/cluster-monitoring-operator/pull/2941)
* [OCPBUGS-86989](https://issues.redhat.com/browse/OCPBUGS-86989): increase lookup interval [#2943](https://github.com/openshift/cluster-monitoring-operator/pull/2943)
* [MON-4583](https://issues.redhat.com/browse/MON-4583): adding NVIDIA H200 GPU device to accelerators configmap [#2942](https://github.com/openshift/cluster-monitoring-operator/pull/2942)
* [MON-4555](https://issues.redhat.com/browse/MON-4555): migrate federate tests to e2e suite [#2902](https://github.com/openshift/cluster-monitoring-operator/pull/2902)
* NO-ISSUE: improve logging for doc example tests [#2936](https://github.com/openshift/cluster-monitoring-operator/pull/2936)
* [MON-4526](https://issues.redhat.com/browse/MON-4526): manifests: merge ThanosQuerierConfig from ClusterMonitoring CRD [#2924](https://github.com/openshift/cluster-monitoring-operator/pull/2924)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2937](https://github.com/openshift/cluster-monitoring-operator/pull/2937)
* Update jsonnet dependencies [#2927](https://github.com/openshift/cluster-monitoring-operator/pull/2927)
* NO-ISSUE: manifests: remove unused NewConfigMapList method [#2935](https://github.com/openshift/cluster-monitoring-operator/pull/2935)
* [OCPBUGS-86352](https://issues.redhat.com/browse/OCPBUGS-86352): jsonnet: exclude ReplicationController from catch-all … [#2932](https://github.com/openshift/cluster-monitoring-operator/pull/2932)
* NO-ISSUE: chore: remove unused function [#2934](https://github.com/openshift/cluster-monitoring-operator/pull/2934)
* [MON-4525](https://issues.redhat.com/browse/MON-4525): manifests: merge TelemeterClientConfig from ClusterMonitoring CRD [#2928](https://github.com/openshift/cluster-monitoring-operator/pull/2928)
* [MON-4566](https://issues.redhat.com/browse/MON-4566): chore: add telemetry_report tool to help with telemetry change review [#2885](https://github.com/openshift/cluster-monitoring-operator/pull/2885)
* [MON-4529](https://issues.redhat.com/browse/MON-4529): manifests: merge PrometheusOperatorAdmissionWebhookConfig from ClusterMonitoring CRD [#2923](https://github.com/openshift/cluster-monitoring-operator/pull/2923)
* [OCPBUGS-85709](https://issues.redhat.com/browse/OCPBUGS-85709): fix: use numeric ports in NetworkPolicies and add enforcement e2e test [#2925](https://github.com/openshift/cluster-monitoring-operator/pull/2925)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2921](https://github.com/openshift/cluster-monitoring-operator/pull/2921)
* [OCPBUGS-83284](https://issues.redhat.com/browse/OCPBUGS-83284): validate more CMO configmap fields [#2877](https://github.com/openshift/cluster-monitoring-operator/pull/2877)
* [MON-4524](https://issues.redhat.com/browse/MON-4524): MetricsServerConfig resources merge [#2907](https://github.com/openshift/cluster-monitoring-operator/pull/2907)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2918](https://github.com/openshift/cluster-monitoring-operator/pull/2918)
* [MON-4528](https://issues.redhat.com/browse/MON-4528): merge monitoringPluginConfig [#2908](https://github.com/openshift/cluster-monitoring-operator/pull/2908)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2893](https://github.com/openshift/cluster-monitoring-operator/pull/2893)
* [MON-4520](https://issues.redhat.com/browse/MON-4520): follow up AlertManagerConfig and PrometheusOp PR changes [#2900](https://github.com/openshift/cluster-monitoring-operator/pull/2900)
* [TRT-2649](https://issues.redhat.com/browse/TRT-2649): Revert "MON-4558: enable zoneinfo node-exporter collector via config" [#2910](https://github.com/openshift/cluster-monitoring-operator/pull/2910)
* NO-ISSUE: chore(e2e): verify Prometheus Mantine UI is served on port 9090 and refactor ForwardPort helpers [#2905](https://github.com/openshift/cluster-monitoring-operator/pull/2905)
* NO-ISSUE: Update AGENTS.md [#2899](https://github.com/openshift/cluster-monitoring-operator/pull/2899)
* [MON-4563](https://issues.redhat.com/browse/MON-4563): use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs [#2892](https://github.com/openshift/cluster-monitoring-operator/pull/2892)
* [MON-4558](https://issues.redhat.com/browse/MON-4558): enable zoneinfo node-exporter collector via config [#2886](https://github.com/openshift/cluster-monitoring-operator/pull/2886)
* [TRT-2644](https://issues.redhat.com/browse/TRT-2644): Revert "MON-4517: Minimal and telemetry CP monitors" [#2901](https://github.com/openshift/cluster-monitoring-operator/pull/2901)
* NO-ISSUE: [bot] Update jsonnet dependencies [#2894](https://github.com/openshift/cluster-monitoring-operator/pull/2894)
* [MON-4492](https://issues.redhat.com/browse/MON-4492): ClusterMonitoring alertmanagerConfig logic [#2889](https://github.com/openshift/cluster-monitoring-operator/pull/2889)
* [MON-4517](https://issues.redhat.com/browse/MON-4517): Minimal and telemetry CP monitors [#2814](https://github.com/openshift/cluster-monitoring-operator/pull/2814)
* [MON-4560](https://issues.redhat.com/browse/MON-4560): enable softirqs node-exporter collector via config [#2887](https://github.com/openshift/cluster-monitoring-operator/pull/2887)
* NO-JIRA: refactor config merging [#2890](https://github.com/openshift/cluster-monitoring-operator/pull/2890)
* [OCPBUGS-54806](https://issues.redhat.com/browse/OCPBUGS-54806): Add telemetry for user-defined networks [#2596](https://github.com/openshift/cluster-monitoring-operator/pull/2596)
* [CNTRLPLANE-3217](https://issues.redhat.com/browse/CNTRLPLANE-3217): Enable configurable PKI for GRPC TLS certificates [#2882](https://github.com/openshift/cluster-monitoring-operator/pull/2882)
* NO-ISSUE: [bot] Update jsonnet dependencies [#2878](https://github.com/openshift/cluster-monitoring-operator/pull/2878)
* [MON-4115](https://issues.redhat.com/browse/MON-4115): expose label metrics for jobs and cronjobs [#2553](https://github.com/openshift/cluster-monitoring-operator/pull/2553)
* [MON-4480](https://issues.redhat.com/browse/MON-4480): set minimum TLS version for Thanos ruler [#2862](https://github.com/openshift/cluster-monitoring-operator/pull/2862)
* [MON-4442](https://issues.redhat.com/browse/MON-4442): Add AGENTS.md to CMO [#2761](https://github.com/openshift/cluster-monitoring-operator/pull/2761)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2884](https://github.com/openshift/cluster-monitoring-operator/pull/2884)
* [MON-4493](https://issues.redhat.com/browse/MON-4493): add MetricsServerConfig support to ClusterMonitoring CRD [#2809](https://github.com/openshift/cluster-monitoring-operator/pull/2809)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/f6a7969c5c070e4deb6136c3561af60ab44780e1...5042b52541130c3856028e29c7142d477c3f7d7d)
### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/00e6cc59b92af5c8f73f9c3908ed3b0ef591bf63)
* [OCPBUGS-88063](https://issues.redhat.com/browse/OCPBUGS-88063): ovn-kubernetes: Move MNP from ConfigMap to CLI flags [#3072](https://github.com/openshift/cluster-network-operator/pull/3072)
* [CNTRLPLANE-3213](https://issues.redhat.com/browse/CNTRLPLANE-3213): Enable configurable PKI for managed certificate rotation [#2958](https://github.com/openshift/cluster-network-operator/pull/2958)
* [CORENET-6581](https://issues.redhat.com/browse/CORENET-6581): Add transport label to CUDN telemetry recording rule [#2978](https://github.com/openshift/cluster-network-operator/pull/2978)
* [OCPBUGS-98619](https://issues.redhat.com/browse/OCPBUGS-98619): Bump frr-k8s MAX_FDS from 1024 to 65536 [#3054](https://github.com/openshift/cluster-network-operator/pull/3054)
* Revert "Enable Network Observability on Day 0" (#2925) [#3086](https://github.com/openshift/cluster-network-operator/pull/3086)
* [CORENET-6714](https://issues.redhat.com/browse/CORENET-6714): Enable Network Observability on Day 0 [#2925](https://github.com/openshift/cluster-network-operator/pull/2925)
* [OCPBUGS-99074](https://issues.redhat.com/browse/OCPBUGS-99074): Align frr-k8s 5.0 CRDs [#3070](https://github.com/openshift/cluster-network-operator/pull/3070)
* [CORENET-7046](https://issues.redhat.com/browse/CORENET-7046): Bump Kubernetes to 1.36.2 and OCP to 5.0 [#3017](https://github.com/openshift/cluster-network-operator/pull/3017)
* [CORENET-7125](https://issues.redhat.com/browse/CORENET-7125): iptables to nftables [#3038](https://github.com/openshift/cluster-network-operator/pull/3038)
* NO-JIRA: Refresh Reviewers & Approvers lists [#3048](https://github.com/openshift/cluster-network-operator/pull/3048)
* [OCPBUGS-62144](https://issues.redhat.com/browse/OCPBUGS-62144): Makes sure rendering for egress IP reachabilityTimeout triggers restart of ovnkube (node/control) pods [#2955](https://github.com/openshift/cluster-network-operator/pull/2955)
* [CORENET-7267](https://issues.redhat.com/browse/CORENET-7267): Add pre-merge and custom checks to CodeRabbit configuration [#3037](https://github.com/openshift/cluster-network-operator/pull/3037)
* [NVIDIA-882](https://issues.redhat.com/browse/NVIDIA-882): DPU host: add configurable mgmt-port-resource-count [#3024](https://github.com/openshift/cluster-network-operator/pull/3024)
* [OCPBUGS-88531](https://issues.redhat.com/browse/OCPBUGS-88531): Propagate restart-date annotation to CNO operand pod templates [#3030](https://github.com/openshift/cluster-network-operator/pull/3030)
* NO-JIRA: Update OWNERS file [#3045](https://github.com/openshift/cluster-network-operator/pull/3045)
* [OCPBUGS-87977](https://issues.redhat.com/browse/OCPBUGS-87977): Bump github.com/containernetworking/cni v0.8.0 -> v1.3.0 [#3031](https://github.com/openshift/cluster-network-operator/pull/3031)
* [CORENET-7114](https://issues.redhat.com/browse/CORENET-7114): Add OCP centralized TLS profile support [#3014](https://github.com/openshift/cluster-network-operator/pull/3014)
* [CORENET-7266](https://issues.redhat.com/browse/CORENET-7266): Add path-specific review instructions to CodeRabbit config [#3039](https://github.com/openshift/cluster-network-operator/pull/3039)
* [OCPBUGS-83800](https://issues.redhat.com/browse/OCPBUGS-83800): add remaining CNO NetworkPolicies [take 2] [#3001](https://github.com/openshift/cluster-network-operator/pull/3001)
* [OCPBUGS-81741](https://issues.redhat.com/browse/OCPBUGS-81741): Watch Network and Infrastructure in proxyconfig controller [#2968](https://github.com/openshift/cluster-network-operator/pull/2968)
* [CORENET-7297](https://issues.redhat.com/browse/CORENET-7297): Add CodeRabbit configuration for automated PR reviews [#3035](https://github.com/openshift/cluster-network-operator/pull/3035)
* NO-JIRA: Update openshift/api and openshift/client-go to latest [#3023](https://github.com/openshift/cluster-network-operator/pull/3023)
* [CORENET-7116](https://issues.redhat.com/browse/CORENET-7116): Fix security job - exclude vendor and upgrade to SHA256 [#3019](https://github.com/openshift/cluster-network-operator/pull/3019)
* [OCPBUGS-66159](https://issues.redhat.com/browse/OCPBUGS-66159): Add `openshift.io/node-selector` annotation to `openshift-network-console` namespace [#2848](https://github.com/openshift/cluster-network-operator/pull/2848)
* [CORENET-7154](https://issues.redhat.com/browse/CORENET-7154): Fix debounce timer for OperatorConfig level being incorrectly cleared [#3011](https://github.com/openshift/cluster-network-operator/pull/3011)
* NO-JIRA: Remove --enable-interconnect flag from OVN-K manifests [#3008](https://github.com/openshift/cluster-network-operator/pull/3008)
* [OCPBUGS-83863](https://issues.redhat.com/browse/OCPBUGS-83863): Remove version-specific CNI binary copy logic [#2967](https://github.com/openshift/cluster-network-operator/pull/2967)
* [OCPBUGS-84519](https://issues.redhat.com/browse/OCPBUGS-84519): Add terminationMessagePolicy to missing ovn-kubernetes containers [#3004](https://github.com/openshift/cluster-network-operator/pull/3004)
* [NVIDIA-596](https://issues.redhat.com/browse/NVIDIA-596): Enable dpu healthcheck [#2941](https://github.com/openshift/cluster-network-operator/pull/2941)
* [TRT-2657](https://issues.redhat.com/browse/TRT-2657): Revert "add remaining CNO NetworkPolicies" (#2959) [#2999](https://github.com/openshift/cluster-network-operator/pull/2999)
* [OCPBUGS-83800](https://issues.redhat.com/browse/OCPBUGS-83800): add remaining CNO NetworkPolicies [#2959](https://github.com/openshift/cluster-network-operator/pull/2959)
* [NVIDIA-554](https://issues.redhat.com/browse/NVIDIA-554): DPU-host mode: use ConfigMap for OVN feature enablement instead of per-node script gating [#2944](https://github.com/openshift/cluster-network-operator/pull/2944)
* [OCPBUGS-83406](https://issues.redhat.com/browse/OCPBUGS-83406), [OCPBUGS-83407](https://issues.redhat.com/browse/OCPBUGS-83407): fix issue for managed mode of no-overlay [#2960](https://github.com/openshift/cluster-network-operator/pull/2960)
* [OCPBUGS-53187](https://issues.redhat.com/browse/OCPBUGS-53187): Update self-referencing URLs from master to main [#2984](https://github.com/openshift/cluster-network-operator/pull/2984)
* [GCP-430](https://issues.redhat.com/browse/GCP-430): Wire GCP WIF credentials for CNCC in HyperShift HCP mode [#2915](https://github.com/openshift/cluster-network-operator/pull/2915)
* [OCPBUGS-65631](https://issues.redhat.com/browse/OCPBUGS-65631): Use dedicated service accounts for multus pods [#2961](https://github.com/openshift/cluster-network-operator/pull/2961)
* NO-JIRA: cleanup unused code and refactor for allowlist controller [#2846](https://github.com/openshift/cluster-network-operator/pull/2846)
* [CORS-4332](https://issues.redhat.com/browse/CORS-4332): Add GCP to the allowed platforms for dual stack [#2894](https://github.com/openshift/cluster-network-operator/pull/2894)
* [OCPBUGS-82973](https://issues.redhat.com/browse/OCPBUGS-82973): Frrk8s tls manifests [#2963](https://github.com/openshift/cluster-network-operator/pull/2963)
* [KONFLUX-11591](https://issues.redhat.com/browse/KONFLUX-11591): Fix ovn-acl-logging CrashLoopBackOff due to startup race condition [#2923](https://github.com/openshift/cluster-network-operator/pull/2923)
* [CORENET-6572](https://issues.redhat.com/browse/CORENET-6572): only report Progressing for active network rollouts [#2937](https://github.com/openshift/cluster-network-operator/pull/2937)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/bc5af87f8957262a504b225591593c92db1c8bc2...00e6cc59b92af5c8f73f9c3908ed3b0ef591bf63)
### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/a9d25d502ca894272f88753f1bd7ecef82fb188e)
* [OCPBUGS-97809](https://issues.redhat.com/browse/OCPBUGS-97809): e2e: fix broken checks and rework netqueue tests to avoid ARM ethtool blackout flakes [#1557](https://github.com/openshift/cluster-node-tuning-operator/pull/1557)
* [OCPBUGS-98915](https://issues.redhat.com/browse/OCPBUGS-98915): E2E: LLC: Pass fresh ctx variable to DeferCleanup functions [#1562](https://github.com/openshift/cluster-node-tuning-operator/pull/1562)
* [CNF-23471](https://issues.redhat.com/browse/CNF-23471): Dedicate cpus for dpdk vswitch [#1546](https://github.com/openshift/cluster-node-tuning-operator/pull/1546)
* [OCPBUGS-98399](https://issues.redhat.com/browse/OCPBUGS-98399): E2E: Add functional test cases checking GOMAXPROCS [#1556](https://github.com/openshift/cluster-node-tuning-operator/pull/1556)
* [OCPBUGS-93863](https://issues.redhat.com/browse/OCPBUGS-93863): E2E: Fix tuned active profile check for wrapped performance profiles [#1549](https://github.com/openshift/cluster-node-tuning-operator/pull/1549)
* [CNF-24293](https://issues.redhat.com/browse/CNF-24293): Let cri-o manage the GOMAXPROC for burstable pods [#1547](https://github.com/openshift/cluster-node-tuning-operator/pull/1547)
* NO-JIRA: cleanup: remove utils/errors [#1536](https://github.com/openshift/cluster-node-tuning-operator/pull/1536)
* [OCPBUGS-91745](https://issues.redhat.com/browse/OCPBUGS-91745): e2e: fix: clear hugepages before switching kernelPageSize to 4k [#1550](https://github.com/openshift/cluster-node-tuning-operator/pull/1550)
* NO-JIRA: E2E: Remove checking of container runtime since crun is default [#1545](https://github.com/openshift/cluster-node-tuning-operator/pull/1545)
* [OCPBUGS-83863](https://issues.redhat.com/browse/OCPBUGS-83863): Strip debug symbols from Go binaries [#1525](https://github.com/openshift/cluster-node-tuning-operator/pull/1525)
* NO-JIRA: Update upstream build image [#1541](https://github.com/openshift/cluster-node-tuning-operator/pull/1541)
* [OCPBUGS-87293](https://issues.redhat.com/browse/OCPBUGS-87293): Updating cluster-node-tuning-operator-container image to be consistent with ART for 5.0 [#1540](https://github.com/openshift/cluster-node-tuning-operator/pull/1540)
* [OCPBUGS-86541](https://issues.redhat.com/browse/OCPBUGS-86541): Enable timer migrations for all use-cases [#1534](https://github.com/openshift/cluster-node-tuning-operator/pull/1534)
* [OCPBUGS-87132](https://issues.redhat.com/browse/OCPBUGS-87132): E2E: Remove ovs-vswitchd from platform services [#1526](https://github.com/openshift/cluster-node-tuning-operator/pull/1526)
* [OCPBUGS-86803](https://issues.redhat.com/browse/OCPBUGS-86803): e2e: Remove unnecessary len(numa) < 2 skip gates [#1528](https://github.com/openshift/cluster-node-tuning-operator/pull/1528)
* NO-JIRA: Bump github.com/moby/spdystream from v0.5.0 to v0.5.1 [#1527](https://github.com/openshift/cluster-node-tuning-operator/pull/1527)
* [OCPBUGS-86480](https://issues.redhat.com/browse/OCPBUGS-86480): E2E: Refactor OVS affinity tests into shared helpers and add new workload-partitioning and control-plane reboot test cases. [#1509](https://github.com/openshift/cluster-node-tuning-operator/pull/1509)
* [OCPBUGS-83865](https://issues.redhat.com/browse/OCPBUGS-83865): Revert stalld backend to sched_debug [#1515](https://github.com/openshift/cluster-node-tuning-operator/pull/1515)
* NO-JIRA: E2E: remove obsolete ContainerRuntimeConfig runtime-switch test [#1510](https://github.com/openshift/cluster-node-tuning-operator/pull/1510)
* [OCPBUGS-80952](https://issues.redhat.com/browse/OCPBUGS-80952): perf: latency: compute memory resources dynamically [#1517](https://github.com/openshift/cluster-node-tuning-operator/pull/1517)
* [OCPBUGS-62277](https://issues.redhat.com/browse/OCPBUGS-62277): Requeue PerformanceStatus update when status write fails [#1495](https://github.com/openshift/cluster-node-tuning-operator/pull/1495)
* NO-JIRA: ote: embed extended testdata in cluster-node-tuning-operator-test-ext binary [#1512](https://github.com/openshift/cluster-node-tuning-operator/pull/1512)
* [TRT-2659](https://issues.redhat.com/browse/TRT-2659): Revert #1499 "NO-JIRA: ote: embed extended testdata in cluster-node-tuning-operator-test-ext binary" [#1511](https://github.com/openshift/cluster-node-tuning-operator/pull/1511)
* NO-JIRA: e2e: fix tuned deferred tests on Hypershift [#1494](https://github.com/openshift/cluster-node-tuning-operator/pull/1494)
* NO-JIRA: test/extended: scope oc process to NTO namespace [#1508](https://github.com/openshift/cluster-node-tuning-operator/pull/1508)
* NO-JIRA: ote: embed extended testdata in cluster-node-tuning-operator-test-ext binary [#1499](https://github.com/openshift/cluster-node-tuning-operator/pull/1499)
* [OCPBUGS-84938](https://issues.redhat.com/browse/OCPBUGS-84938): e2e: Add irqbalance StartLimitBurst >= 100 config test [#1493](https://github.com/openshift/cluster-node-tuning-operator/pull/1493)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/3d98f7ee7fe0651d182b8a780956512eb407a963...a9d25d502ca894272f88753f1bd7ecef82fb188e)
### [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator/tree/9983877dbed43c0ae050ad4646e31b9cfbd41329)
* [OCPBUGS-95475](https://issues.redhat.com/browse/OCPBUGS-95475): chore: bump containerd to 1.7.33 [#223](https://github.com/openshift/cluster-olm-operator/pull/223)
* [OPRUN-4676](https://issues.redhat.com/browse/OPRUN-4676): support service account deprecation for OCP 5.0 [#222](https://github.com/openshift/cluster-olm-operator/pull/222)
* [OPRUN-4696](https://issues.redhat.com/browse/OPRUN-4696): fix upgrade block message and add 5.0 cluster unit tests [#216](https://github.com/openshift/cluster-olm-operator/pull/216)
* NO-ISSUE: Remove stale reviewers/approvers, add trgeiger [#220](https://github.com/openshift/cluster-olm-operator/pull/220)
* [OCPBUGS-88736](https://issues.redhat.com/browse/OCPBUGS-88736): Apply cluster TLS security profile to the metrics server [#214](https://github.com/openshift/cluster-olm-operator/pull/214)
* [OCPBUGS-87296](https://issues.redhat.com/browse/OCPBUGS-87296): Updating ose-cluster-olm-operator-container image to be consistent with ART for 5.0 [#212](https://github.com/openshift/cluster-olm-operator/pull/212)
* [OPRUN-4640](https://issues.redhat.com/browse/OPRUN-4640): Update to golang 1.26.3 and openshift-4.23 builders [#211](https://github.com/openshift/cluster-olm-operator/pull/211)
* [OPRUN-4627](https://issues.redhat.com/browse/OPRUN-4627): override catalog tag to 4.x when RELEASE_VERSION is 4.x and catalogd.yaml pins v5.0 [#210](https://github.com/openshift/cluster-olm-operator/pull/210)
* [OPRUN-4599](https://issues.redhat.com/browse/OPRUN-4599): dynamically resolve catalog image tag from OCP release version [#203](https://github.com/openshift/cluster-olm-operator/pull/203)
* [OCPBUGS-62517](https://issues.redhat.com/browse/OCPBUGS-62517): Scale to replicas=2 and enable PDB on HighlyAvailable topology [#202](https://github.com/openshift/cluster-olm-operator/pull/202)
* [Full changelog](https://github.com/openshift/cluster-olm-operator/compare/d131450b2645623089b26353a309015c95c8871c...9983877dbed43c0ae050ad4646e31b9cfbd41329)
### [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator/tree/7bac3548875ec36a6c4967df818ccae533dcce7c)
* [CNTRLPLANE-3361](https://issues.redhat.com/browse/CNTRLPLANE-3361): Update openshift/* [#740](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/740)
* NO-JIRA: Automatic agentic rebase: Update library-go to d8f45c2 [#737](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/737)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): encryptionstatusprovider: implement UpdateKMSEncryptionStatus [#736](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/736)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): encryptionstatusprovider: use OpenShiftAPIServerInterface instead of Clientset [#735](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/735)
* NO-JIRA: kms to kms key identifier check [#728](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/728)
* [OCPBUGS-87507](https://issues.redhat.com/browse/OCPBUGS-87507): Updating ose-cluster-openshift-apiserver-operator-container image to be consistent with ART for 5.0 [#705](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/705)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): intro openShiftAPIServerEncryptionStatusProvider [#734](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/734)
* NO-JIRA: Bump library-go to sync [#732](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/732)
* [CNTRLPLANE-3234](https://issues.redhat.com/browse/CNTRLPLANE-3234): wire KMS health reporter status writer [#730](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/730)
* [OCPBUGS-86583](https://issues.redhat.com/browse/OCPBUGS-86583): Allow Prometheus to scrape check-endpoints metrics on port 17698 [#729](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/729)
* NO-JIRA: Automatic agentic rebase: Update library-go to fd74bb5 [#727](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/727)
* NO-JIRA: update func from library-go [#724](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/724)
* NO-JIRA: Add test for KMS to KMS migration [#726](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/726)
* NO-JIRA: Bump library-go for sync [#725](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/725)
* NO-JIRA: Bump library-go [#723](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/723)
* NO-JIRA: Update openshift dependencies [#722](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/722)
* NO-JIRA: add preflight command [#714](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/714)
* NO-JIRA: add kms preflight to NP to allow egress [#720](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/720)
* NO-JIRA: Automatic agentic rebase: Update library-go to b0f5231 [#716](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/716)
* [CNTRLPLANE-3363](https://issues.redhat.com/browse/CNTRLPLANE-3363): Register health monitor as command [#713](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/713)
* NO-JIRA: kms: bump library-go to get KMS plugin security context [#711](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/711)
* [CNTRLPLANE-3545](https://issues.redhat.com/browse/CNTRLPLANE-3545): bump library-go to get CA bundle wiring [#709](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/709)
* NO-JIRA: Automatic agentic rebase: Update library-go to 7fd5f33 [#710](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/710)
* NO-JIRA: Automatic agentic rebase: Update library-go to 0469313 [#707](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/707)
* [CNTRLPLANE-3226](https://issues.redhat.com/browse/CNTRLPLANE-3226): switch to real Vault KMS plugin in CI [#704](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/704)
* [CNTRLPLANE-3226](https://issues.redhat.com/browse/CNTRLPLANE-3226): bump library-go to get KMS plugin credentials [#699](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/699)
* [CNTRLPLANE-3364](https://issues.redhat.com/browse/CNTRLPLANE-3364): remove old go std tests [#703](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/703)
* NO-JIRA: Automatic agentic rebase: Update library-go to d8750ed [#702](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/702)
* NO-JIRA: Automatic agentic rebase: Update library-go to 0cf249e [#701](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/701)
* NO-JIRA: bump latest library-go changes [#700](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/700)
* NO-jIRA: Remove old mock plugin deployment [#698](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/698)
* NO-JIRA: kms: use DefaultFakeVaultEncryptionProvider to ensure AppRole secre setup [#697](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/697)
* [CNTRLPLANE-3236](https://issues.redhat.com/browse/CNTRLPLANE-3236): support deploying Vault mock KMS plugin [#693](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/693)
* NO-JIRA: Bump latest library-go changes [#692](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/692)
* [CNTRLPLANE-3364](https://issues.redhat.com/browse/CNTRLPLANE-3364): add the kms suite and migrate the kms tests of oas-o to ote [#690](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/690)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): Bump library-go and sync encryption tests with APIServerEncryption struct change [#689](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/689)
* NO-JIRA: Bump latest library-go changes [#688](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/688)
* [API-1768](https://issues.redhat.com/browse/API-1768): e2e network policy tests [#675](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/675)
* NO-JIRA: Add control-plane-approvers to OWNERS [#677](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/677)
* NO-JIRA: Update library-go for latest changes [#678](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/678)
* [Full changelog](https://github.com/openshift/cluster-openshift-apiserver-operator/compare/e6a55cd55c867bf9e26e7ec0ba5accc959b0c27c...7bac3548875ec36a6c4967df818ccae533dcce7c)
### [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator/tree/34f95b07f4afbc47558e54e4fa2710fd692e615e)
* [CNTRLPLANE-2907](https://issues.redhat.com/browse/CNTRLPLANE-2907): e2e network policy tests [#428](https://github.com/openshift/cluster-openshift-controller-manager-operator/pull/428)
* NO-JIRA: Add control-plane-approvers to OWNERS [#427](https://github.com/openshift/cluster-openshift-controller-manager-operator/pull/427)
* [Full changelog](https://github.com/openshift/cluster-openshift-controller-manager-operator/compare/e1c3674198c6c1274fd3fd3c3108eb4cade4eb0a...34f95b07f4afbc47558e54e4fa2710fd692e615e)
### [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller/tree/01afc4aac71a8e8be26383a0421bed7673391750)
* [OCPSTRAT-3036](https://issues.redhat.com/browse/OCPSTRAT-3036): Bump to Kube v1.36.2 [#197](https://github.com/openshift/cluster-policy-controller/pull/197)
* NO-JIRA: update OWNERS file [#190](https://github.com/openshift/cluster-policy-controller/pull/190)
* [OCPBUGS-90053](https://issues.redhat.com/browse/OCPBUGS-90053): add serviceAccountToken volume type to psalabelsyncer [#189](https://github.com/openshift/cluster-policy-controller/pull/189)
* NO-JIRA: Add control-plane-approvers to OWNERS [#179](https://github.com/openshift/cluster-policy-controller/pull/179)
* [Full changelog](https://github.com/openshift/cluster-policy-controller/compare/44985a1306411101c84dd5081598fc928b432321...01afc4aac71a8e8be26383a0421bed7673391750)
### [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator/tree/eee95babd52053191e29355108f7daf149dfbf8f)
* [OCPBUGS-87454](https://issues.redhat.com/browse/OCPBUGS-87454): Updating ose-cluster-samples-operator-container image to be consistent with ART for 5.0 [#700](https://github.com/openshift/cluster-samples-operator/pull/700)
* [CNF-23044](https://issues.redhat.com/browse/CNF-23044): Migrate away from deprecated ioutil [#668](https://github.com/openshift/cluster-samples-operator/pull/668)
* [CNTRLPLANE-3176](https://issues.redhat.com/browse/CNTRLPLANE-3176): implements operator tls config compliance [#684](https://github.com/openshift/cluster-samples-operator/pull/684)
* [Full changelog](https://github.com/openshift/cluster-samples-operator/compare/eeac6ba8ddbe5cc6d3a403293581648affdf6566...eee95babd52053191e29355108f7daf149dfbf8f)
### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/8ac48254009fb4987bee1f3e00cbb8e4d730f545)
* [STOR-3011](https://issues.redhat.com/browse/STOR-3011): Implement CSO upgrade check and Prometheus alerts for SELinuxMount readiness [#714](https://github.com/openshift/cluster-storage-operator/pull/714)
* [STOR-2954](https://issues.redhat.com/browse/STOR-2954): Inject TLS from CVO to operators, update hypershift TLS based on CVO [#712](https://github.com/openshift/cluster-storage-operator/pull/712)
* [OCPBUGS-88299](https://issues.redhat.com/browse/OCPBUGS-88299): Let gcp-pd csi driver operator to use SCC `hostnetwork-v2` [#713](https://github.com/openshift/cluster-storage-operator/pull/713)
* [STOR-2954](https://issues.redhat.com/browse/STOR-2954): feat: have CVO inject the centralized TLS configuration into the operator's config [#703](https://github.com/openshift/cluster-storage-operator/pull/703)
* [OCPBUGS-87464](https://issues.redhat.com/browse/OCPBUGS-87464): Updating ose-cluster-storage-operator-container image to be consistent with ART for 5.0 [#706](https://github.com/openshift/cluster-storage-operator/pull/706)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/8dfdf2ef3310358f3559a5481df43b98b2294791...8ac48254009fb4987bee1f3e00cbb8e4d730f545)
### [cluster-update-keys](https://github.com/openshift/cluster-update-keys/tree/9607604d35acee234051bd0da8a14321b4edd38e)
* [OCPBUGS-87492](https://issues.redhat.com/browse/OCPBUGS-87492): Updating ose-cluster-update-keys-container image to be consistent with ART for 5.0 [#101](https://github.com/openshift/cluster-update-keys/pull/101)
* [Full changelog](https://github.com/openshift/cluster-update-keys/compare/3b5c59cc6461663751bc510b4f9f1954ed8c9b50...9607604d35acee234051bd0da8a14321b4edd38e)
### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/70bafacd988182acbc5160d61088a6d1ddad785a)
* [TRT-2842](https://issues.redhat.com/browse/TRT-2842): Revert #1427 "OTA-1997: Allow the CVO to use the agentic-skills payload image when creating proposals." [#1431](https://github.com/openshift/cluster-version-operator/pull/1431)
* [OTA-1997](https://issues.redhat.com/browse/OTA-1997): Allow the CVO to use the agentic-skills payload image when creating proposals. [#1427](https://github.com/openshift/cluster-version-operator/pull/1427)
* [OTA-2084](https://issues.redhat.com/browse/OTA-2084), [OTA-2097](https://issues.redhat.com/browse/OTA-2097): pkg/agenticrun/controller: Additional logging to AgenticRun CRD detection [#1428](https://github.com/openshift/cluster-version-operator/pull/1428)
* [OTA-2084](https://issues.redhat.com/browse/OTA-2084): Conditionally deploy console plugin when AgenticRun CRD is present [#1425](https://github.com/openshift/cluster-version-operator/pull/1425)
* NO-JIRA: Fix make build target cd issue [#1404](https://github.com/openshift/cluster-version-operator/pull/1404)
* [OTA-2064](https://issues.redhat.com/browse/OTA-2064): Rename Proposal API to AgenticRun [#1422](https://github.com/openshift/cluster-version-operator/pull/1422)
* [OTA-1967](https://issues.redhat.com/browse/OTA-1967): install: Drop Lightspeed CustomResourceDefinitions (Proposal, etc.) [#1412](https://github.com/openshift/cluster-version-operator/pull/1412)
* [OTA-1956](https://issues.redhat.com/browse/OTA-1956): install: Split multi-document YAML and add missing annotations [#1423](https://github.com/openshift/cluster-version-operator/pull/1423)
* [OCPCLOUD-3368](https://issues.redhat.com/browse/OCPCLOUD-3368): bumping with o/api changes to reflect new capabilities (crdcompatibilitychecker+capi) [#1403](https://github.com/openshift/cluster-version-operator/pull/1403)
* [TRT-2776](https://issues.redhat.com/browse/TRT-2776): Revert #1398 "install: Split multi-document YAML and add missing annotations" [#1420](https://github.com/openshift/cluster-version-operator/pull/1420)
* [OTA-1956](https://issues.redhat.com/browse/OTA-1956): install: Split multi-document YAML and add missing annotations [#1398](https://github.com/openshift/cluster-version-operator/pull/1398)
* [OTA-1966](https://issues.redhat.com/browse/OTA-1966): AGENTS: Drop 'Deploying CVO with Lightspeed Proposals' section [#1414](https://github.com/openshift/cluster-version-operator/pull/1414)
* [OTA-1836](https://issues.redhat.com/browse/OTA-1836): Fix empty lister for API server (simplified a bit) [#1397](https://github.com/openshift/cluster-version-operator/pull/1397)
* [OCPBUGS-84513](https://issues.redhat.com/browse/OCPBUGS-84513): set terminationMessagePolicy on update-payload pods [#1417](https://github.com/openshift/cluster-version-operator/pull/1417)
* NO-JIRA: CONTRIBUTING.md: Improve the review process wording [#1419](https://github.com/openshift/cluster-version-operator/pull/1419)
* [OTA-1966](https://issues.redhat.com/browse/OTA-1966): pkg/readiness/crd_compat: Drop unnecessary CustomResourceDefinition check [#1415](https://github.com/openshift/cluster-version-operator/pull/1415)
* NO-JIRA: Handle the tests on Microshift environment [#1416](https://github.com/openshift/cluster-version-operator/pull/1416)
* [OCPBUGS-87461](https://issues.redhat.com/browse/OCPBUGS-87461): Updating cluster-version-operator-container image to be consistent with ART for 5.0 [#1400](https://github.com/openshift/cluster-version-operator/pull/1400)
* [CNTRLPLANE-3429](https://issues.redhat.com/browse/CNTRLPLANE-3429): Respect configured cipher order for inject-tls [#1386](https://github.com/openshift/cluster-version-operator/pull/1386)
* [OTA-1966](https://issues.redhat.com/browse/OTA-1966): Add readiness checks and wire into proposal controller [#1395](https://github.com/openshift/cluster-version-operator/pull/1395)
* [OCPBUGS-60579](https://issues.redhat.com/browse/OCPBUGS-60579): install: Remove manual BoundServiceAccountTokenVolume configuration [#1411](https://github.com/openshift/cluster-version-operator/pull/1411)
* [OTA-1956](https://issues.redhat.com/browse/OTA-1956): pkg/payload: Add Images map and tolerate unknown template fields during upgrades [#1410](https://github.com/openshift/cluster-version-operator/pull/1410)
* [OCPBUGS-36246](https://issues.redhat.com/browse/OCPBUGS-36246): Improve resource merge diffs [#1409](https://github.com/openshift/cluster-version-operator/pull/1409)
* NO-JIRA: Add coverage for syncAvailableUpdates [#1375](https://github.com/openshift/cluster-version-operator/pull/1375)
* NO-JIRA: Add thread-safe AddSchemes() to fix concurrent map writes [#1401](https://github.com/openshift/cluster-version-operator/pull/1401)
* [OTA-1996](https://issues.redhat.com/browse/OTA-1996): Add e2e tests for TLS profile update [#1393](https://github.com/openshift/cluster-version-operator/pull/1393)
* NO-JIRA: Risk from alert e2e blocking [#1399](https://github.com/openshift/cluster-version-operator/pull/1399)
* NO-JIRA: chore: exclude e2e tests from make test unconditionally [#1321](https://github.com/openshift/cluster-version-operator/pull/1321)
* [OTA-1836](https://issues.redhat.com/browse/OTA-1836): Honor the centralized TLS configuration [#1338](https://github.com/openshift/cluster-version-operator/pull/1338)
* NO-JIRA: refactor: simplify redundant error checking conditions [#1320](https://github.com/openshift/cluster-version-operator/pull/1320)
* [OTA-1966](https://issues.redhat.com/browse/OTA-1966): Install namespace/openshift-lightspeed only when TechPreview is enabled [#1394](https://github.com/openshift/cluster-version-operator/pull/1394)
* [OTA-1966](https://issues.redhat.com/browse/OTA-1966): Manage proposals [#1382](https://github.com/openshift/cluster-version-operator/pull/1382)
* [OTA-1935](https://issues.redhat.com/browse/OTA-1935): pkg: Use risk.Source framework to feed Upgradeable [#1368](https://github.com/openshift/cluster-version-operator/pull/1368)
* [OTA-1967](https://issues.redhat.com/browse/OTA-1967): Take official CRDs from the OpenShift Lightspeed operator [#1387](https://github.com/openshift/cluster-version-operator/pull/1387)
* [MON-4477](https://issues.redhat.com/browse/MON-4477): chore: add permissions on endpointslice to Prometheus Role and use serviceDiscoveryRole: EndpointSlice in ServiceMonitors [#1305](https://github.com/openshift/cluster-version-operator/pull/1305)
* [OTA-1966](https://issues.redhat.com/browse/OTA-1966): Init the Proprosal Lifecycle Controller [#1381](https://github.com/openshift/cluster-version-operator/pull/1381)
* NO-JIRA: OpenShiftUpdateRiskMightApply: bump pending to 15m from 10m [#1372](https://github.com/openshift/cluster-version-operator/pull/1372)
* [OTA-1836](https://issues.redhat.com/browse/OTA-1836): chore(deps): Bump general OpenShift dependencies [#1377](https://github.com/openshift/cluster-version-operator/pull/1377)
* [OTA-1979](https://issues.redhat.com/browse/OTA-1979): Revert "lightspeed: Add a new image holding Lightspeed skills" [#1378](https://github.com/openshift/cluster-version-operator/pull/1378)
* NO-JIRA: how-to: troubleshoot bootstrap CVO [#1369](https://github.com/openshift/cluster-version-operator/pull/1369)
* [OTA-1965](https://issues.redhat.com/browse/OTA-1965): Add Lightspeed CustomResourceDefinitions [#1380](https://github.com/openshift/cluster-version-operator/pull/1380)
* NO-ISSUE: Fix TestOperator_upgradeableSync [#1373](https://github.com/openshift/cluster-version-operator/pull/1373)
* [OTA-1962](https://issues.redhat.com/browse/OTA-1962): lightspeed: Add a new image holding Lightspeed skills [#1376](https://github.com/openshift/cluster-version-operator/pull/1376)
* [OTA-1813](https://issues.redhat.com/browse/OTA-1813): Extend alert risk e2e [#1371](https://github.com/openshift/cluster-version-operator/pull/1371)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/e9c1c39e21ec353ff5993d386c42bc1b15063dbf...70bafacd988182acbc5160d61088a6d1ddad785a)
### [configmap-reloader](https://github.com/openshift/configmap-reload/tree/ce80869a83b55ebbdc21a5550ec5747645203bd2)
* [OCPBUGS-87510](https://issues.redhat.com/browse/OCPBUGS-87510): Updating configmap-reload-container image to be consistent with ART for 5.0 [#83](https://github.com/openshift/configmap-reload/pull/83)
* [Full changelog](https://github.com/openshift/configmap-reload/compare/94e41c4c6a5832dfd19750173d6544784ba235ec...ce80869a83b55ebbdc21a5550ec5747645203bd2)
### [console](https://github.com/openshift/console/tree/6d0dcf1d76337e46d95ea1b546d5ffe692d7918d)
* [OCPBUGS-99226](https://issues.redhat.com/browse/OCPBUGS-99226): Disable Knative e2e cypress test [#16782](https://github.com/openshift/console/pull/16782)
* [OCPBUGS-99052](https://issues.redhat.com/browse/OCPBUGS-99052): recover from reverse proxy panic on browser disconnect [#16776](https://github.com/openshift/console/pull/16776)
* [OTA-2066](https://issues.redhat.com/browse/OTA-2066): AIA mitigations [#16763](https://github.com/openshift/console/pull/16763)
* [CONSOLE-5065](https://issues.redhat.com/browse/CONSOLE-5065): Clean up Console extension code reference processing [#16115](https://github.com/openshift/console/pull/16115)
* [CONSOLE-5426](https://issues.redhat.com/browse/CONSOLE-5426): remove GraphQL proxy endpoint [#16769](https://github.com/openshift/console/pull/16769)
* [OCPBUGS-79520](https://issues.redhat.com/browse/OCPBUGS-79520): Fix kebab actions on Installed Operators list page [#16682](https://github.com/openshift/console/pull/16682)
* [HELM-731](https://issues.redhat.com/browse/HELM-731): Upgrade helm in console [#16607](https://github.com/openshift/console/pull/16607)
* [OCPBUGS-98489](https://issues.redhat.com/browse/OCPBUGS-98489): CVE-2026-59869 bump js-yaml [#16760](https://github.com/openshift/console/pull/16760)
* [CONSOLE-5415](https://issues.redhat.com/browse/CONSOLE-5415), [OCPBUGS-94037](https://issues.redhat.com/browse/OCPBUGS-94037): Bump react-router to ~7.18.1 [#16726](https://github.com/openshift/console/pull/16726)
* NO-ISSUE: Add empty Prow techPreview e2e entrypoint scripts [#16766](https://github.com/openshift/console/pull/16766)
* NO-ISSUE: Match operator lifecycle versions by major.minor only [#16698](https://github.com/openshift/console/pull/16698)
* [CONSOLE-3956](https://issues.redhat.com/browse/CONSOLE-3956): Replace custom Shortcut components with PF ShortcutGrid [#16207](https://github.com/openshift/console/pull/16207)
* NO-ISSUE: Skip OLMv0-specific e2e tests when techPreview is enabled [#16759](https://github.com/openshift/console/pull/16759)
* [CONSOLE-5423](https://issues.redhat.com/browse/CONSOLE-5423): Add rspack support for dynamic plugins [#16752](https://github.com/openshift/console/pull/16752)
* [CONSOLE-5421](https://issues.redhat.com/browse/CONSOLE-5421): Rename "Self-support" to "Unsupported" and stack support phase date [#16742](https://github.com/openshift/console/pull/16742)
* [CONSOLE-5196](https://issues.redhat.com/browse/CONSOLE-5196): Fix flaky Playwright e2e tests caused by OAuth redirect timing [#16740](https://github.com/openshift/console/pull/16740)
* [CONSOLE-5306](https://issues.redhat.com/browse/CONSOLE-5306): Surface Playwright report link in Prow Spyglass [#16743](https://github.com/openshift/console/pull/16743)
* [OCPBUGS-50016](https://issues.redhat.com/browse/OCPBUGS-50016), [OCPBUGS-86587](https://issues.redhat.com/browse/OCPBUGS-86587): Bump to PF 6.6.0 [#16750](https://github.com/openshift/console/pull/16750)
* [OCPBUGS-88715](https://issues.redhat.com/browse/OCPBUGS-88715): Bump follow-redirects from 1.15.3 to 1.16.0 to remediate CVE-2026-40895 [#16590](https://github.com/openshift/console/pull/16590)
* [CONSOLE-5356](https://issues.redhat.com/browse/CONSOLE-5356): Add optional onSubmit parameter to useLabelsModal hook [#16560](https://github.com/openshift/console/pull/16560)
* [CONSOLE-5124](https://issues.redhat.com/browse/CONSOLE-5124): Multi-domain console backend support [#16686](https://github.com/openshift/console/pull/16686)
* NO-ISSUE: Return self-support when date is before all lifecycle phases [#16699](https://github.com/openshift/console/pull/16699)
* [CONSOLE-5398](https://issues.redhat.com/browse/CONSOLE-5398): Remove events card from node overview dashboard [#16697](https://github.com/openshift/console/pull/16697)
* [OCPBUGS-84721](https://issues.redhat.com/browse/OCPBUGS-84721): Fix WebSocket InvalidStateError in pod terminal [#16377](https://github.com/openshift/console/pull/16377)
* [CONSOLE-5306](https://issues.redhat.com/browse/CONSOLE-5306): Add Prow-compatible JUnit reporter for Playwright e2e tests [#16501](https://github.com/openshift/console/pull/16501)
* NO-JIRA: Prepare for publishing new 4.23 prerelease plugin SDK packages [#16713](https://github.com/openshift/console/pull/16713)
* [OCPBUGS-78980](https://issues.redhat.com/browse/OCPBUGS-78980): Update @graphql-codegen packages for Node.js 25 compatibility [#16240](https://github.com/openshift/console/pull/16240)
* [CONSOLE-5271](https://issues.redhat.com/browse/CONSOLE-5271): Gate lifecycle metadata on server-side OLM lifecycle flag [#16668](https://github.com/openshift/console/pull/16668)
* [OCPBUGS-94089](https://issues.redhat.com/browse/OCPBUGS-94089): Fix helm backend test setup reliability [#16687](https://github.com/openshift/console/pull/16687)
* [CONSOLE-5361](https://issues.redhat.com/browse/CONSOLE-5361): Add toast overflow and notification drawer integration [#16636](https://github.com/openshift/console/pull/16636)
* [CONSOLE-5183](https://issues.redhat.com/browse/CONSOLE-5183): Add persistent pod terminal sessions to Cloud Shell drawer [#16269](https://github.com/openshift/console/pull/16269)
* [OCPBUGS-83817](https://issues.redhat.com/browse/OCPBUGS-83817): Fix orphaned shell processes in pod terminal on WebSocket disconnect [#16307](https://github.com/openshift/console/pull/16307)
* [CONSOLE-5238](https://issues.redhat.com/browse/CONSOLE-5238): Remove unused telemetry Cypress integration tests [#16685](https://github.com/openshift/console/pull/16685)
* [CONSOLE-5283](https://issues.redhat.com/browse/CONSOLE-5283): Migrate dashboard Cypress tests to Playwright [#16669](https://github.com/openshift/console/pull/16669)
* [CONSOLE-5158](https://issues.redhat.com/browse/CONSOLE-5158): Add filter by group for nodes [#16253](https://github.com/openshift/console/pull/16253)
* [OCPBUGS-83799](https://issues.redhat.com/browse/OCPBUGS-83799): Fix Workloads sidebar ordering when DeploymentConfig capability is disabled [#16351](https://github.com/openshift/console/pull/16351)
* [CONSOLE-4954](https://issues.redhat.com/browse/CONSOLE-4954): Add Workload tab to Node view [#16574](https://github.com/openshift/console/pull/16574)
* [OCPBUGS-87353](https://issues.redhat.com/browse/OCPBUGS-87353): Updating openshift-enterprise-console-container image to be consistent with ART for 5.0 [#16558](https://github.com/openshift/console/pull/16558)
* [CONSOLE-5235](https://issues.redhat.com/browse/CONSOLE-5235): Migrate basic app Cypress e2e tests to Playwright [#16431](https://github.com/openshift/console/pull/16431)
* [CONSOLE-4951](https://issues.redhat.com/browse/CONSOLE-4951): Add Health tab to Node View, remove events tab [#16581](https://github.com/openshift/console/pull/16581)
* [CONSOLE-5271](https://issues.redhat.com/browse/CONSOLE-5271): Address docs review feedback from PR #16551 [#16655](https://github.com/openshift/console/pull/16655)
* [OCPBUGS-85485](https://issues.redhat.com/browse/OCPBUGS-85485): Append id_token_hint to OIDC logout redirect URL [#16548](https://github.com/openshift/console/pull/16548)
* [CONSOLE-5315](https://issues.redhat.com/browse/CONSOLE-5315): Get Node inventory card items from extensions [#16582](https://github.com/openshift/console/pull/16582)
* [OCPBUGS-90555](https://issues.redhat.com/browse/OCPBUGS-90555): [release-5.0] webpack-dev-server: Information disclosure and denial of service via improper proxy configuration [#16667](https://github.com/openshift/console/pull/16667)
* [OCPBUGS-81749](https://issues.redhat.com/browse/OCPBUGS-81749): Add SSAR checks to gate OLM actions [#16554](https://github.com/openshift/console/pull/16554)
* [HELM-728](https://issues.redhat.com/browse/HELM-728): Persist secrets for Helm upgrade [#16432](https://github.com/openshift/console/pull/16432)
* [CONSOLE-4950](https://issues.redhat.com/browse/CONSOLE-4950): Add high availability section to Configuration [#16555](https://github.com/openshift/console/pull/16555)
* [CONSOLE-5277](https://issues.redhat.com/browse/CONSOLE-5277): Improve ResourceName data-test uniqueness and fix e2e test patterns [#16679](https://github.com/openshift/console/pull/16679)
* [CONSOLE-5277](https://issues.redhat.com/browse/CONSOLE-5277): Migrate console e2e CRUD tests to Playwright [#16556](https://github.com/openshift/console/pull/16556)
* [OCPBUGS-91965](https://issues.redhat.com/browse/OCPBUGS-91965): Add catalog item-type for OLMv1 operator catalog [#16666](https://github.com/openshift/console/pull/16666)
* [OCPBUGS-59569](https://issues.redhat.com/browse/OCPBUGS-59569): Disable create button until CRD is available [#16633](https://github.com/openshift/console/pull/16633)
* [OCPBUGS-87201](https://issues.redhat.com/browse/OCPBUGS-87201): Fix RoleBindings tab error for non-cluster-admin users [#16639](https://github.com/openshift/console/pull/16639)
* [CONSOLE-5271](https://issues.redhat.com/browse/CONSOLE-5271), [CONSOLE-5272](https://issues.redhat.com/browse/CONSOLE-5272): Improve operator lifecycle UI [#16551](https://github.com/openshift/console/pull/16551)
* [CONSOLE-5118](https://issues.redhat.com/browse/CONSOLE-5118): Add OLS integration for cluster update workflows [#16131](https://github.com/openshift/console/pull/16131)
* NO-JIRA: Small updates post #16585 changes [#16624](https://github.com/openshift/console/pull/16624)
* [OCPBUGS-88739](https://issues.redhat.com/browse/OCPBUGS-88739): Projects cannot be filtered by display name [#16632](https://github.com/openshift/console/pull/16632)
* [OCPBUGS-69920](https://issues.redhat.com/browse/OCPBUGS-69920): use RFC 5737 documentation IP in PV template [#16641](https://github.com/openshift/console/pull/16641)
* [OCPBUGS-86182](https://issues.redhat.com/browse/OCPBUGS-86182): Fix ColumnManagementModal not showing NamespaceColumnHelpText [#16637](https://github.com/openshift/console/pull/16637)
* [OCPBUGS-88450](https://issues.redhat.com/browse/OCPBUGS-88450): Use fixed artifacts directory to prevent stale temp dir accumulation [#16606](https://github.com/openshift/console/pull/16606)
* [OCPBUGS-89230](https://issues.redhat.com/browse/OCPBUGS-89230): Fix sidebar not toggling at small viewport widths [#16634](https://github.com/openshift/console/pull/16634)
* [OCPBUGS-87864](https://issues.redhat.com/browse/OCPBUGS-87864): CVE-2026-4800 [#16595](https://github.com/openshift/console/pull/16595)
* [OCPBUGS-88451](https://issues.redhat.com/browse/OCPBUGS-88451): Remove redundant waitFor calls in Playwright e2e tests, re-enable flaking tests after getting started fix [#16583](https://github.com/openshift/console/pull/16583)
* [CONSOLE-5037](https://issues.redhat.com/browse/CONSOLE-5037), [CONSOLE-5354](https://issues.redhat.com/browse/CONSOLE-5354): Migrate useTranslation to pass namespace explicitly [#16609](https://github.com/openshift/console/pull/16609)
* [OCPBUGS-87996](https://issues.redhat.com/browse/OCPBUGS-87996): Bump fast-uri to 3.1.2 to fix CVE-2026-6322 [#16604](https://github.com/openshift/console/pull/16604)
* [CONSOLE-5355](https://issues.redhat.com/browse/CONSOLE-5355), [OCPBUGS-88319](https://issues.redhat.com/browse/OCPBUGS-88319): Allow customizing skipImportPrefixes when building Console plugins and begin adoption of api types package [#16585](https://github.com/openshift/console/pull/16585)
* [OCPBUGS-87930](https://issues.redhat.com/browse/OCPBUGS-87930), [OCPBUGS-87982](https://issues.redhat.com/browse/OCPBUGS-87982): Bump protobufjs and shell-quote [#16586](https://github.com/openshift/console/pull/16586)
* [OCPBUGS-85545](https://issues.redhat.com/browse/OCPBUGS-85545): Fix guided tour modal flash on page reload [#16462](https://github.com/openshift/console/pull/16462)
* [OCPBUGS-87969](https://issues.redhat.com/browse/OCPBUGS-87969): Directly use RhUi icons where possible [#16591](https://github.com/openshift/console/pull/16591)
* [OCPBUGS-87904](https://issues.redhat.com/browse/OCPBUGS-87904): Good faith application of docs reviews [#16584](https://github.com/openshift/console/pull/16584)
* [OCPBUGS-86894](https://issues.redhat.com/browse/OCPBUGS-86894): reduce startup API calls and prioritize critical fetches [#16533](https://github.com/openshift/console/pull/16533)
* [CONSOLE-5271](https://issues.redhat.com/browse/CONSOLE-5271), [CONSOLE-5272](https://issues.redhat.com/browse/CONSOLE-5272): Add operator lifecycle metadata to installed operators table [#16428](https://github.com/openshift/console/pull/16428)
* [OCPBUGS-86338](https://issues.redhat.com/browse/OCPBUGS-86338): Bump immutable.js to v3.8.3 [#16480](https://github.com/openshift/console/pull/16480)
* [CONSOLE-5336](https://issues.redhat.com/browse/CONSOLE-5336): Add CreateContainerError filter to pod list status filters [#16559](https://github.com/openshift/console/pull/16559)
* [CONSOLE-5242](https://issues.redhat.com/browse/CONSOLE-5242): Remove shipwright-plugin Cypress integration tests [#16553](https://github.com/openshift/console/pull/16553)
* [CONSOLE-4946](https://issues.redhat.com/browse/CONSOLE-4946): Add Configuration tab to Node view [#16124](https://github.com/openshift/console/pull/16124)
* NO-JIRA: Improve cypress-migration skill [#16550](https://github.com/openshift/console/pull/16550)
* [OCPBUGS-82506](https://issues.redhat.com/browse/OCPBUGS-82506), [OCPBUGS-82507](https://issues.redhat.com/browse/OCPBUGS-82507): Re-enable OLM Cypress tests disabled for createRoot [#16531](https://github.com/openshift/console/pull/16531)
* [OCPBUGS-86564](https://issues.redhat.com/browse/OCPBUGS-86564): Use stable username hash for user-settings ConfigMap names [#16512](https://github.com/openshift/console/pull/16512)
* [OCPBUGS-86875](https://issues.redhat.com/browse/OCPBUGS-86875): Always use RHUI icons [#16528](https://github.com/openshift/console/pull/16528)
* [OCPBUGS-86755](https://issues.redhat.com/browse/OCPBUGS-86755): use a clip path instead of overlapping triangles [#16520](https://github.com/openshift/console/pull/16520)
* [CONSOLE-5037](https://issues.redhat.com/browse/CONSOLE-5037): Add knip-based dead code detection in CI [#16523](https://github.com/openshift/console/pull/16523)
* [CONSOLE-5284](https://issues.redhat.com/browse/CONSOLE-5284): Put new node inventory items behind tech-preview [#16414](https://github.com/openshift/console/pull/16414)
* [CONSOLE-5307](https://issues.redhat.com/browse/CONSOLE-5307): Remove dead code 2: electric boogaloo [#16513](https://github.com/openshift/console/pull/16513)
* NO-JIRA: Update Console 4.23 plugin SDK CHANGELOG [#16516](https://github.com/openshift/console/pull/16516)
* [CONSOLE-5091](https://issues.redhat.com/browse/CONSOLE-5091): Add bulk selection and schedulable actions to Nodes page [#16203](https://github.com/openshift/console/pull/16203)
* [CONSOLE-5296](https://issues.redhat.com/browse/CONSOLE-5296): Add non-scalable image warning when scaling workloads [#16436](https://github.com/openshift/console/pull/16436)
* [OCPBUGS-82508](https://issues.redhat.com/browse/OCPBUGS-82508), [OCPBUGS-82509](https://issues.redhat.com/browse/OCPBUGS-82509): Fix and re-enable operator e2e tests disabled for createRoot [#16517](https://github.com/openshift/console/pull/16517)
* [OCPBUGS-86614](https://issues.redhat.com/browse/OCPBUGS-86614): prep for 4.22 GA SDK publish [#16507](https://github.com/openshift/console/pull/16507)
* [CONSOLE-5308](https://issues.redhat.com/browse/CONSOLE-5308): Centralize ResizeObserver polyfill in Jest setup for unit tests [#16506](https://github.com/openshift/console/pull/16506)
* [CONSOLE-5286](https://issues.redhat.com/browse/CONSOLE-5286): Block snapshot tests via ESLint and migrate existing tests to explicit assertions [#16427](https://github.com/openshift/console/pull/16427)
* [CONSOLE-5307](https://issues.redhat.com/browse/CONSOLE-5307): Remove unused exports and dead code [#16502](https://github.com/openshift/console/pull/16502)
* NO-JIRA: Update plugin SDK core package CHANGELOG [#16496](https://github.com/openshift/console/pull/16496)
* NO-JIRA: Capitalize "Basic" in secret dropdown label [#16490](https://github.com/openshift/console/pull/16490)
* [OCPBUGS-83767](https://issues.redhat.com/browse/OCPBUGS-83767): Helm upgrade — preserve release values when changing chart version [#16364](https://github.com/openshift/console/pull/16364)
* [OCPBUGS-86491](https://issues.redhat.com/browse/OCPBUGS-86491): Fix macOS Option key in pod terminal [#16492](https://github.com/openshift/console/pull/16492)
* [CONSOLE-5293](https://issues.redhat.com/browse/CONSOLE-5293): Update Dockerfile.downloads for 4.22 and add RHEL 8/9 oc binaries [#16455](https://github.com/openshift/console/pull/16455)
* [CONSOLE-5298](https://issues.redhat.com/browse/CONSOLE-5298): enable http2 on the backend [#16471](https://github.com/openshift/console/pull/16471)
* [CONSOLE-5253](https://issues.redhat.com/browse/CONSOLE-5253): Extend Unit Tests: Console-App - Core Navigation & Orchestration [#16452](https://github.com/openshift/console/pull/16452)
* [OCPBUGS-86488](https://issues.redhat.com/browse/OCPBUGS-86488): Bump to PatternFly 6.5.1 [#16491](https://github.com/openshift/console/pull/16491)
* [CONSOLE-5244](https://issues.redhat.com/browse/CONSOLE-5244): Migrate webterminal-plugin Cypress tests to Playwright [#16461](https://github.com/openshift/console/pull/16461)
* [CONSOLE-5110](https://issues.redhat.com/browse/CONSOLE-5110): update to PatternFly 6.5.0 [#16172](https://github.com/openshift/console/pull/16172)
* [OCPBUGS-82512](https://issues.redhat.com/browse/OCPBUGS-82512): Fix knative e2e test failures caused by createRoot timing [#16289](https://github.com/openshift/console/pull/16289)
* [CONSOLE-5300](https://issues.redhat.com/browse/CONSOLE-5300): Parallelize context detection to reduce initial load time [#16477](https://github.com/openshift/console/pull/16477)
* [HELM-703](https://issues.redhat.com/browse/HELM-703): Add authentication for Helm chart URLs [#16360](https://github.com/openshift/console/pull/16360)
* [CONSOLE-5194](https://issues.redhat.com/browse/CONSOLE-5194): Audit and fix Claude Code skills for accuracy [#16316](https://github.com/openshift/console/pull/16316)
* [OCPBUGS-84876](https://issues.redhat.com/browse/OCPBUGS-84876): Remove DataViewToolbar wrapper from bottom pagination [#16479](https://github.com/openshift/console/pull/16479)
* NO-JIRA: Add `eslint-plugin-no-barrel-files` [#16476](https://github.com/openshift/console/pull/16476)
* [OCPBUGS-84214](https://issues.redhat.com/browse/OCPBUGS-84214): Fix Shipwright detail pages crashing with React error #310 [#16474](https://github.com/openshift/console/pull/16474)
* [CONSOLE-5197](https://issues.redhat.com/browse/CONSOLE-5197): Improve Playwright artifact collection and add safety checks [#16463](https://github.com/openshift/console/pull/16463)
* [OCPBUGS-71878](https://issues.redhat.com/browse/OCPBUGS-71878): Show empty state instead of 403 error for users without projects [#16464](https://github.com/openshift/console/pull/16464)
* [OCPBUGS-82505](https://issues.redhat.com/browse/OCPBUGS-82505): Re-enable add-flow-ci.feature e2e tests disabled for createRoot adoption [#16285](https://github.com/openshift/console/pull/16285)
* NO-JIRA: Update Console plugin SDK CHANGELOG files [#16465](https://github.com/openshift/console/pull/16465)
* [CONSOLE-5280](https://issues.redhat.com/browse/CONSOLE-5280): Migrate cluster-settings Cypress tests to Playwright [#16444](https://github.com/openshift/console/pull/16444)
* [OCPBUGS-81521](https://issues.redhat.com/browse/OCPBUGS-81521): Adapt dashboard Prometheus polling interval based on query response time [#16441](https://github.com/openshift/console/pull/16441)
* [CONSOLE-5245](https://issues.redhat.com/browse/CONSOLE-5245): Install and configure eslint-plugin-playwright for e2e directory [#16433](https://github.com/openshift/console/pull/16433)
* [CONSOLE-5197](https://issues.redhat.com/browse/CONSOLE-5197): Collect Playwright test artifacts for Prow CI [#16453](https://github.com/openshift/console/pull/16453)
* [OCPBUGS-85649](https://issues.redhat.com/browse/OCPBUGS-85649): bump gRPC-Go package [#16442](https://github.com/openshift/console/pull/16442)
* [OCPBUGS-82513](https://issues.redhat.com/browse/OCPBUGS-82513): Enable Topology e2e tests [#16273](https://github.com/openshift/console/pull/16273)
* [CONSOLE-5200](https://issues.redhat.com/browse/CONSOLE-5200): add qa-verify skill for automated PR visual verification [#16429](https://github.com/openshift/console/pull/16429)
* [OCPBUGS-84669](https://issues.redhat.com/browse/OCPBUGS-84669): Fix ProjectLink to update active namespace in Redux [#16430](https://github.com/openshift/console/pull/16430)
* [CONSOLE-5212](https://issues.redhat.com/browse/CONSOLE-5212): Fix ESM compatibility for Playwright e2e tests [#16445](https://github.com/openshift/console/pull/16445)
* [OCPBUGS-79521](https://issues.redhat.com/browse/OCPBUGS-79521): Restore list page text and row filter functionality [#16440](https://github.com/openshift/console/pull/16440)
* [OCPBUGS-59404](https://issues.redhat.com/browse/OCPBUGS-59404): Allow VolumeSnapshot restore when parent PVC is deleted [#16447](https://github.com/openshift/console/pull/16447)
* [OCPBUGS-83569](https://issues.redhat.com/browse/OCPBUGS-83569): [main] CVE-2026-26996 Bump minimatch library [#16301](https://github.com/openshift/console/pull/16301)
* [CONSOLE-5211](https://issues.redhat.com/browse/CONSOLE-5211): Add Cypress-to-Playwright migration skills and context [#16315](https://github.com/openshift/console/pull/16315)
* [CONSOLE-5229](https://issues.redhat.com/browse/CONSOLE-5229): Enable RTL ESLint rules in Knative tests by removing file-level no-container / no-node-access suppressions [#16405](https://github.com/openshift/console/pull/16405)
* [CONSOLE-5197](https://issues.redhat.com/browse/CONSOLE-5197): Add Playwright E2E test infrastructure for Prow/CI [#16374](https://github.com/openshift/console/pull/16374)
* [CONSOLE-5034](https://issues.redhat.com/browse/CONSOLE-5034): Migrate tile-view-page and value-from-pair to TypeScript [#16412](https://github.com/openshift/console/pull/16412)
* [OCPBUGS-85242](https://issues.redhat.com/browse/OCPBUGS-85242): Add Suspense boundary to LazyRoutePage for plugin routes [#16409](https://github.com/openshift/console/pull/16409)
* [OCPBUGS-77952](https://issues.redhat.com/browse/OCPBUGS-77952): Fix devfile sample import by adding fallback for parent resolution failures [#16149](https://github.com/openshift/console/pull/16149)
* [OCPBUGS-70273](https://issues.redhat.com/browse/OCPBUGS-70273): Prevent binary secret data corruption when editing [#16053](https://github.com/openshift/console/pull/16053)
* [OCPBUGS-65950](https://issues.redhat.com/browse/OCPBUGS-65950): Update template whenever settings are updated [#16143](https://github.com/openshift/console/pull/16143)
* [CONSOLE-5212](https://issues.redhat.com/browse/CONSOLE-5212): Migrate Playwright setup to project dependencies [#16408](https://github.com/openshift/console/pull/16408)
* [CONSOLE-5285](https://issues.redhat.com/browse/CONSOLE-5285): remove corepack dep for build-(frontend/demos), bump yarn [#16426](https://github.com/openshift/console/pull/16426)
* [OCPBUGS-81518](https://issues.redhat.com/browse/OCPBUGS-81518): Increase Resource Dropdown visible items cap to 250. [#16398](https://github.com/openshift/console/pull/16398)
* [CONSOLE-5273](https://issues.redhat.com/browse/CONSOLE-5273): Expose `useToast` in the SDK [#16400](https://github.com/openshift/console/pull/16400)
* [OCPBUGS-59353](https://issues.redhat.com/browse/OCPBUGS-59353): Fix authentication redirect loop on repeated 401 responses [#15814](https://github.com/openshift/console/pull/15814)
* [CONSOLE-5015](https://issues.redhat.com/browse/CONSOLE-5015): Migrate NameValueEditor to TypeScript and PatternFly drag-drop [#16406](https://github.com/openshift/console/pull/16406)
* NO-JIRA: Add approvers and reviewers to helm-plugin OWNERS [#16361](https://github.com/openshift/console/pull/16361)
* [OCPBUGS-85043](https://issues.redhat.com/browse/OCPBUGS-85043): Remove `@console` imports from SDK dist [#16399](https://github.com/openshift/console/pull/16399)
* [OCPBUGS-77931](https://issues.redhat.com/browse/OCPBUGS-77931): Loosen default `img-src` CSP [#16388](https://github.com/openshift/console/pull/16388)
* [OCPBUGS-84324](https://issues.redhat.com/browse/OCPBUGS-84324): Update outdated documentation links and references [#16362](https://github.com/openshift/console/pull/16362)
* [CONSOLE-5212](https://issues.redhat.com/browse/CONSOLE-5212): Set up Playwright e2e test infrastructure [#16320](https://github.com/openshift/console/pull/16320)
* [OCPBUGS-84844](https://issues.redhat.com/browse/OCPBUGS-84844): VSphere plugin changes broke i18n translations - missing strings in locales/en/ [#16384](https://github.com/openshift/console/pull/16384)
* [OCPBUGS-80940](https://issues.redhat.com/browse/OCPBUGS-80940): Fix SDK publish workflow for Yarn Berry [#16392](https://github.com/openshift/console/pull/16392)
* [HELM-613](https://issues.redhat.com/browse/HELM-613): Reject basic auth over non-HTTPS for Helm chart repositories [#16317](https://github.com/openshift/console/pull/16317)
* [OCPBUGS-81519](https://issues.redhat.com/browse/OCPBUGS-81519): Fix Search page state mutation and unnecessary component remounts [#16266](https://github.com/openshift/console/pull/16266)
* [OCPBUGS-84876](https://issues.redhat.com/browse/OCPBUGS-84876): Add bottom pagination to ConsoleDataView for mobile responsiveness [#16391](https://github.com/openshift/console/pull/16391)
* [OCPBUGS-84856](https://issues.redhat.com/browse/OCPBUGS-84856): Fix ESLint Testing Library plugin PR review feedback [#16387](https://github.com/openshift/console/pull/16387)
* [OCPBUGS-82140](https://issues.redhat.com/browse/OCPBUGS-82140): Remove PII from events [#16365](https://github.com/openshift/console/pull/16365)
* NO-JIRA: Align Dockerfile.dev with multi-arch Dockerfile structure [#16390](https://github.com/openshift/console/pull/16390)
* [OCPBUGS-79363](https://issues.redhat.com/browse/OCPBUGS-79363): Move xterm to its own chunk [#16370](https://github.com/openshift/console/pull/16370)
* NO-JIRA: zsh compatibility for microcopy-review [#16389](https://github.com/openshift/console/pull/16389)
* NO-JIRA: Add fsgreco to frontend reviewers [#16381](https://github.com/openshift/console/pull/16381)
* [CONSOLE-5184](https://issues.redhat.com/browse/CONSOLE-5184): Enable ESLint Plugins for React Testing Library [#16270](https://github.com/openshift/console/pull/16270)
* [OCPBUGS-84710](https://issues.redhat.com/browse/OCPBUGS-84710): Fix ConsoleDataView filter order: Name and Label should appear first [#16375](https://github.com/openshift/console/pull/16375)
* [OCPBUGS-84227](https://issues.redhat.com/browse/OCPBUGS-84227): i18n upload/download routine task - version 4.22 [#16318](https://github.com/openshift/console/pull/16318)
* [OCPBUGS-84230](https://issues.redhat.com/browse/OCPBUGS-84230): [release-4.22] - Re-enable cluster-settings/update-modal.cy.ts e2e test disabled for createRoot adoption [#16319](https://github.com/openshift/console/pull/16319)
* [OCPBUGS-81522](https://issues.redhat.com/browse/OCPBUGS-81522): Reduce dashboard re-renders by memoizing cards and stabilizing prop references [#16367](https://github.com/openshift/console/pull/16367)
* [CONSOLE-5203](https://issues.redhat.com/browse/CONSOLE-5203): Remove old QE team from our repos [#16312](https://github.com/openshift/console/pull/16312)
* [OCPBUGS-81518](https://issues.redhat.com/browse/OCPBUGS-81518): Fix ResourceListDropdown performance on large clusters [#16252](https://github.com/openshift/console/pull/16252)
* [OCPBUGS-79067](https://issues.redhat.com/browse/OCPBUGS-79067): Fix crash when switching language to English [#16366](https://github.com/openshift/console/pull/16366)
* NO-JIRA: Remove broken entrypoints and unused packages [#16357](https://github.com/openshift/console/pull/16357)
* [OCPBUGS-82511](https://issues.redhat.com/browse/OCPBUGS-82511): re-enable helm-release.feature [#16274](https://github.com/openshift/console/pull/16274)
* [CONSOLE-5227](https://issues.redhat.com/browse/CONSOLE-5227): Upgrade ESLint from v6 to v8 and @typescript-eslint to v8 [#16353](https://github.com/openshift/console/pull/16353)
* [OCPBUGS-84338](https://issues.redhat.com/browse/OCPBUGS-84338): Update resolveDynamicModuleMaps to skip unavailable packages [#16340](https://github.com/openshift/console/pull/16340)
* [OCPBUGS-84320](https://issues.redhat.com/browse/OCPBUGS-84320): Use popover token in QS modal [#16339](https://github.com/openshift/console/pull/16339)
* [OCPBUGS-84296](https://issues.redhat.com/browse/OCPBUGS-84296): fix Helm list page redirect after upgrade/rollback [#16336](https://github.com/openshift/console/pull/16336)
* NO-JIRA: prepare for 4.22-prerelease.3 sdk publish [#16338](https://github.com/openshift/console/pull/16338)
* [CONSOLE-5144](https://issues.redhat.com/browse/CONSOLE-5144), [OCPBUGS-81319](https://issues.redhat.com/browse/OCPBUGS-81319), [OCPBUGS-83823](https://issues.redhat.com/browse/OCPBUGS-83823): 4.22 SDK fixes [#15655](https://github.com/openshift/console/pull/15655)
* [OCPBUGS-83812](https://issues.redhat.com/browse/OCPBUGS-83812): Fix race conditions in OLM descriptors Cypress test [#16304](https://github.com/openshift/console/pull/16304)
* [OCPBUGS-83816](https://issues.redhat.com/browse/OCPBUGS-83816): Fix race conditions in create-namespace Cypress tests [#16306](https://github.com/openshift/console/pull/16306)
* NO-JIRA: enable multi-architecture yarn builds [#16228](https://github.com/openshift/console/pull/16228)
* [OCPBUGS-83813](https://issues.redhat.com/browse/OCPBUGS-83813): Fix race conditions in debug pod Cypress tests [#16305](https://github.com/openshift/console/pull/16305)
* [OCPBUGS-81668](https://issues.redhat.com/browse/OCPBUGS-81668): Fix User Preferences responsive breakpoints bug [#16279](https://github.com/openshift/console/pull/16279)
* [OCPBUGS-77864](https://issues.redhat.com/browse/OCPBUGS-77864): Add gRPC probe support to container details view [#16245](https://github.com/openshift/console/pull/16245)
* [CONSOLE-5176](https://issues.redhat.com/browse/CONSOLE-5176): Refactor RTL Tests from fireEvent to userEvent [#16294](https://github.com/openshift/console/pull/16294)
* [OCPBUGS-82504](https://issues.redhat.com/browse/OCPBUGS-82504): Re-enable cluster-settings/update-modal.cy.ts e2e test disabled for createRoot adoption [#16283](https://github.com/openshift/console/pull/16283)
* NO-JIRA: Replace deprecated io/ioutil pkg [#15902](https://github.com/openshift/console/pull/15902)
* [OCPBUGS-81630](https://issues.redhat.com/browse/OCPBUGS-81630): Fix unnecessary error on Node Terminal tab [#16263](https://github.com/openshift/console/pull/16263)
* [OCPBUGS-78365](https://issues.redhat.com/browse/OCPBUGS-78365): Fix create visual connector in Topology [#16241](https://github.com/openshift/console/pull/16241)
* [OCPBUGS-83532](https://issues.redhat.com/browse/OCPBUGS-83532): Add empty state visibility check to CRD test [#16303](https://github.com/openshift/console/pull/16303)
* [CONSOLE-5204](https://issues.redhat.com/browse/CONSOLE-5204): Merge PR templates [#16287](https://github.com/openshift/console/pull/16287)
* [OCPBUGS-82510](https://issues.redhat.com/browse/OCPBUGS-82510): Fix web-terminal-adminuser e2e tests broken by createRoot [#16284](https://github.com/openshift/console/pull/16284)
* [OCPBUGS-83446](https://issues.redhat.com/browse/OCPBUGS-83446): Fix Cypress test timeouts by using correct timeout option [#16280](https://github.com/openshift/console/pull/16280)
* [OCPBUGS-83532](https://issues.redhat.com/browse/OCPBUGS-83532): Fix race condition in CRD Cypress test [#16288](https://github.com/openshift/console/pull/16288)
* NO-JIRA: enable Cypress Cloud in CI [#16277](https://github.com/openshift/console/pull/16277)
* And 13 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/console/compare/52099b4a905e210e1a30f54727ca3d214d130902...6d0dcf1d76337e46d95ea1b546d5ffe692d7918d)
### [console-operator](https://github.com/openshift/console-operator/tree/694a2de9e7d36a7453de16c5a7f29ce39e0d5ce3)
* NO-JIRA: Revert "Merge pull request #1170 from logonoff/http2" [#1194](https://github.com/openshift/console-operator/pull/1194)
* [CONSOLE-5433](https://issues.redhat.com/browse/CONSOLE-5433): Add default-deny NetworkPolicy for openshift-console-user-settings namespace [#1195](https://github.com/openshift/console-operator/pull/1195)
* [OCPBUGS-93982](https://issues.redhat.com/browse/OCPBUGS-93982): gate Progressing on version transition and operand rollout status [#1188](https://github.com/openshift/console-operator/pull/1188)
* [HELM-639](https://issues.redhat.com/browse/HELM-639): Update Helm download manifests for Helm 3 and Helm 4. [#1175](https://github.com/openshift/console-operator/pull/1175)
* [CONSOLE-5122](https://issues.redhat.com/browse/CONSOLE-5122): Multi-domain console route, ConfigMap, and OAuth support [#1184](https://github.com/openshift/console-operator/pull/1184)
* [OCPBUGS-67134](https://issues.redhat.com/browse/OCPBUGS-67134): add grace period before reporting Available=False [#1179](https://github.com/openshift/console-operator/pull/1179)
* [TRT-2780](https://issues.redhat.com/browse/TRT-2780): Revert #1178 [#1186](https://github.com/openshift/console-operator/pull/1186)
* [OCPBUGS-93982](https://issues.redhat.com/browse/OCPBUGS-93982): skip generation check when deployment was just updated [#1178](https://github.com/openshift/console-operator/pull/1178)
* [CONSOLE-5271](https://issues.redhat.com/browse/CONSOLE-5271): Set olmLifecycleEnabled based on OLMLifecycleAndCompatibility FeatureGate [#1174](https://github.com/openshift/console-operator/pull/1174)
* [OCPBUGS-87517](https://issues.redhat.com/browse/OCPBUGS-87517): Updating openshift-enterprise-console-operator-container image to be consistent with ART for 5.0 [#1171](https://github.com/openshift/console-operator/pull/1171)
* [OCPBUGS-91663](https://issues.redhat.com/browse/OCPBUGS-91663): Clean up old temp directories in downloads pod [#1176](https://github.com/openshift/console-operator/pull/1176)
* [OCPBUGS-64688](https://issues.redhat.com/browse/OCPBUGS-64688): use ObservedGeneration to determine Progressing status [#1169](https://github.com/openshift/console-operator/pull/1169)
* [OCPBUGS-38676](https://issues.redhat.com/browse/OCPBUGS-38676): Add retry for transient API errors to prevent Degraded blips [#1164](https://github.com/openshift/console-operator/pull/1164)
* [CONSOLE-5298](https://issues.redhat.com/browse/CONSOLE-5298): Auto-generate throwaway TLS cert for HTTP/2 support [#1170](https://github.com/openshift/console-operator/pull/1170)
* NO-JIRA: feat: have CVO inject the centralized TLS configuration into the operator's config [#1167](https://github.com/openshift/console-operator/pull/1167)
* [OCPBUGS-74872](https://issues.redhat.com/browse/OCPBUGS-74872): Sort plugin list to make them deterministic [#1107](https://github.com/openshift/console-operator/pull/1107)
* [OCPBUGS-86117](https://issues.redhat.com/browse/OCPBUGS-86117): Add unit and e2e test coverage for cert rotation redeployment [#1160](https://github.com/openshift/console-operator/pull/1160)
* [OCPBUGS-85650](https://issues.redhat.com/browse/OCPBUGS-85650): bump gRPC-Go package [#1156](https://github.com/openshift/console-operator/pull/1156)
* [MON-4510](https://issues.redhat.com/browse/MON-4510): Migrate Prometheus targets discovering from Endpoints to EndpointSlices [#1106](https://github.com/openshift/console-operator/pull/1106)
* [OCPBUGS-85060](https://issues.redhat.com/browse/OCPBUGS-85060): feat: use 2 replicas for console on tnf [#1151](https://github.com/openshift/console-operator/pull/1151)
* [CONSOLE-5204](https://issues.redhat.com/browse/CONSOLE-5204): Add PR template [#1141](https://github.com/openshift/console-operator/pull/1141)
* And 2 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/console-operator/compare/f0619391890c61e1a4ebdf5c1c0b247b30f81248...694a2de9e7d36a7453de16c5a7f29ce39e0d5ce3)
### [container-networking-plugins, containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins/tree/d6f73950658d258e0ddbf2a4ac92e13ac840158b)
* [OCPBUGS-85826](https://issues.redhat.com/browse/OCPBUGS-85826): rebase to pick up dependency updates [#237](https://github.com/openshift/containernetworking-plugins/pull/237)
* [Full changelog](https://github.com/openshift/containernetworking-plugins/compare/747ad66caa1109b2b490aebad01af42bd2d738f1...d6f73950658d258e0ddbf2a4ac92e13ac840158b)
### [coredns](https://github.com/openshift/coredns/tree/37aaba896e97f4b9a091aab6d36f2213b8854474)
* [NE-2744](https://issues.redhat.com/browse/NE-2744): UPSTREAM: 8227: fix(tls): use Go TLS defaults [#194](https://github.com/openshift/coredns/pull/194)
* [OCPBUGS-87352](https://issues.redhat.com/browse/OCPBUGS-87352): Updating coredns-container image to be consistent with ART for 5.0 [#189](https://github.com/openshift/coredns/pull/189)
* NO-JIRA: Add aswinsuryan (asuryana@redhat.com) to OWNERS [#188](https://github.com/openshift/coredns/pull/188)
* [OCPBUGS-83943](https://issues.redhat.com/browse/OCPBUGS-83943): Bump gRPC to v1.79.3 to resolve CVE-2026-33186 [#183](https://github.com/openshift/coredns/pull/183)
* [Full changelog](https://github.com/openshift/coredns/compare/0dded2d232dab43c107b1dab9d0d9fdfd8259622...37aaba896e97f4b9a091aab6d36f2213b8854474)
### [csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/f8bb5994f3cee8ee2bb5cca25e3e9783ad7dd57c)
* UPSTREAM-SYNC: Sync main with latest upstream (release-1.36) [#393](https://github.com/openshift/cloud-provider-openstack/pull/393)
* UPSTREAM-SYNC: Sync main with latest upstream (release-1.35) [#370](https://github.com/openshift/cloud-provider-openstack/pull/370)
* [OCPBUGS-77578](https://issues.redhat.com/browse/OCPBUGS-77578): Updating ose-openstack-cinder-csi-driver-container image to be consistent with ART for 4.22 [#374](https://github.com/openshift/cloud-provider-openstack/pull/374)
* [OCPBUGS-77755](https://issues.redhat.com/browse/OCPBUGS-77755): Updating ose-openstack-cloud-controller-manager-container image to be consistent with ART for 4.22 [#376](https://github.com/openshift/cloud-provider-openstack/pull/376)
* [OCPBUGS-77592](https://issues.redhat.com/browse/OCPBUGS-77592): Updating csi-driver-manila-container image to be consistent with ART for 4.22 [#375](https://github.com/openshift/cloud-provider-openstack/pull/375)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/fd31b5da11d75a7a80e7c4a6c7a56acf304e2661...f8bb5994f3cee8ee2bb5cca25e3e9783ad7dd57c)
### [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs/tree/beb9567b4ef15656a88c1c71e0b08e7bf2e96aaa)
* [OCPBUGS-97795](https://issues.redhat.com/browse/OCPBUGS-97795): Bump golang.org/x/crypto to v0.53.0 [#197](https://github.com/openshift/csi-driver-nfs/pull/197)
* [OCPBUGS-87515](https://issues.redhat.com/browse/OCPBUGS-87515): Updating csi-driver-nfs-container image to be consistent with ART for 5.0 [#196](https://github.com/openshift/csi-driver-nfs/pull/196)
* NO-JIRA: CVE-2026-35469: Bump github.com/moby/spdystream@v0.5.1 [#189](https://github.com/openshift/csi-driver-nfs/pull/189)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master into main [#179](https://github.com/openshift/csi-driver-nfs/pull/179)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master into main [#175](https://github.com/openshift/csi-driver-nfs/pull/175)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master into main [#170](https://github.com/openshift/csi-driver-nfs/pull/170)
* [Full changelog](https://github.com/openshift/csi-driver-nfs/compare/e9f249405ad2bced3d1805dd5beda368d7f3d564...beb9567b4ef15656a88c1c71e0b08e7bf2e96aaa)
### [csi-external-attacher](https://github.com/openshift/csi-external-attacher/tree/96ebfa733c06c3398555d164c788e310908fecf6)
* [OCPBUGS-87274](https://issues.redhat.com/browse/OCPBUGS-87274): Updating csi-attacher-container image to be consistent with ART for 5.0 [#109](https://github.com/openshift/csi-external-attacher/pull/109)
* [Full changelog](https://github.com/openshift/csi-external-attacher/compare/98b1f4acf9c004687ef55e9f187703768933bb56...96ebfa733c06c3398555d164c788e310908fecf6)
### [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner/tree/bdf440fab8a48e4b76cf0902ad5ba17a20881a8b)
* NO-ISSUE: Bump github.com/moby/spdystream to v0.5.1 [#138](https://github.com/openshift/csi-external-provisioner/pull/138)
* [OCPBUGS-87526](https://issues.redhat.com/browse/OCPBUGS-87526): Updating csi-provisioner-container image to be consistent with ART for 5.0 [#137](https://github.com/openshift/csi-external-provisioner/pull/137)
* NO-JIRA: OCPBUGS-82033: Bump google.golang.org/grpc to 1.79.3 [#124](https://github.com/openshift/csi-external-provisioner/pull/124)
* [Full changelog](https://github.com/openshift/csi-external-provisioner/compare/f90c06a3113696cdb757e4b7c9dcfeb0e9dddb81...bdf440fab8a48e4b76cf0902ad5ba17a20881a8b)
### [csi-external-resizer](https://github.com/openshift/csi-external-resizer/tree/c608adfc7e82c7c59221bb9d22642a1902cace43)
* [OCPBUGS-87511](https://issues.redhat.com/browse/OCPBUGS-87511): Updating ose-csi-external-resizer-container image to be consistent with ART for 5.0 [#197](https://github.com/openshift/csi-external-resizer/pull/197)
* [Full changelog](https://github.com/openshift/csi-external-resizer/compare/4e74a4aa52a2046d6b97a47dff7a60ddb73d0bbd...c608adfc7e82c7c59221bb9d22642a1902cace43)
### [csi-external-snapshot-metadata](https://github.com/openshift/csi-external-snapshot-metadata/tree/239703c637e005cf785892d214d219add70e3533)
* [STOR-2965](https://issues.redhat.com/browse/STOR-2965): Rebase to v1.0.0 for OCP 5.0 [#18](https://github.com/openshift/csi-external-snapshot-metadata/pull/18)
* [OCPBUGS-87248](https://issues.redhat.com/browse/OCPBUGS-87248): Updating csi-external-snapshot-metadata-container image to be consistent with ART for 5.0 [#17](https://github.com/openshift/csi-external-snapshot-metadata/pull/17)
* [Full changelog](https://github.com/openshift/csi-external-snapshot-metadata/compare/7652318579a38838931a5be492cee3573c7c8ecf...239703c637e005cf785892d214d219add70e3533)
### [csi-external-snapshotter, csi-snapshot-controller](https://github.com/openshift/csi-external-snapshotter/tree/b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8)
* [STOR-3004](https://issues.redhat.com/browse/STOR-3004): Rebase external-snapshotter to v8.6.0 [#224](https://github.com/openshift/csi-external-snapshotter/pull/224)
* [TRT-2702](https://issues.redhat.com/browse/TRT-2702): Revert "STOR-3004: Rebase external-snapshotter to v8.6.0" [#220](https://github.com/openshift/csi-external-snapshotter/pull/220)
* [STOR-3004](https://issues.redhat.com/browse/STOR-3004): Rebase external-snapshotter to v8.6.0 [#219](https://github.com/openshift/csi-external-snapshotter/pull/219)
* [OCPBUGS-87250](https://issues.redhat.com/browse/OCPBUGS-87250): Updating ose-csi-external-snapshotter-container image to be consistent with ART for 5.0 [#217](https://github.com/openshift/csi-external-snapshotter/pull/217)
* [OCPBUGS-87466](https://issues.redhat.com/browse/OCPBUGS-87466): Updating ose-csi-snapshot-controller-container image to be consistent with ART for 5.0 [#218](https://github.com/openshift/csi-external-snapshotter/pull/218)
* NO-JIRA: Bump google.golang.org/grpc to v1.79.3 [#215](https://github.com/openshift/csi-external-snapshotter/pull/215)
* [OCPBUGS-77492](https://issues.redhat.com/browse/OCPBUGS-77492): UPSTREAM: 1392: Fix VolumeSnapshotContent deletion [#207](https://github.com/openshift/csi-external-snapshotter/pull/207)
* [Full changelog](https://github.com/openshift/csi-external-snapshotter/compare/d1bc3ffaa9759c13a06c2ec61c541342e71bd109...b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8)
### [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe/tree/f649d2c76f2484b73c70007801eb81ab4be63635)
* [OCPBUGS-87448](https://issues.redhat.com/browse/OCPBUGS-87448): Updating csi-livenessprobe-container image to be consistent with ART for 5.0 [#93](https://github.com/openshift/csi-livenessprobe/pull/93)
* [Full changelog](https://github.com/openshift/csi-livenessprobe/compare/4d5e959a182b4db70dc52302bd89eebfec40d5a5...f649d2c76f2484b73c70007801eb81ab4be63635)
### [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar/tree/02d5345005aeb6aac2277818937501cdd1a3a88e)
* NO-ISSUE: Bump github.com/moby/spdystream to v0.5.1 [#107](https://github.com/openshift/csi-node-driver-registrar/pull/107)
* [OCPBUGS-87513](https://issues.redhat.com/browse/OCPBUGS-87513): Updating csi-node-driver-registrar-container image to be consistent with ART for 5.0 [#106](https://github.com/openshift/csi-node-driver-registrar/pull/106)
* [Full changelog](https://github.com/openshift/csi-node-driver-registrar/compare/cf174b30fad107d354afb0f0b09030a7c97fd296...02d5345005aeb6aac2277818937501cdd1a3a88e)
### [docker-builder](https://github.com/openshift/builder/tree/2cda03a93696d4620703848471b3b873b0b2fa1e)
* [OCPBUGS-77610](https://issues.redhat.com/browse/OCPBUGS-77610): Updating openshift-enterprise-builder-container image to be consistent with ART for 4.22 [#503](https://github.com/openshift/builder/pull/503)
* [Full changelog](https://github.com/openshift/builder/compare/fcd4ce2d96613a27bd1ab7f53ff47225976c4ba9...2cda03a93696d4620703848471b3b873b0b2fa1e)
### [docker-registry](https://github.com/openshift/image-registry/tree/eb1b09dc465a8d53c5683da40f5d5fd306fd945a)
* [OCPBUGS-96818](https://issues.redhat.com/browse/OCPBUGS-96818): bump golang.com/x/crypto [#473](https://github.com/openshift/image-registry/pull/473)
* [OCPBUGS-84680](https://issues.redhat.com/browse/OCPBUGS-84680): pin cloud.google.com/go/storage to v1.30.1 to fix blob deletion [#469](https://github.com/openshift/image-registry/pull/469)
* [Full changelog](https://github.com/openshift/image-registry/compare/c3fa7db05e878e35ff95fcff896f716e82fdd170...eb1b09dc465a8d53c5683da40f5d5fd306fd945a)
### [driver-toolkit](https://github.com/openshift/driver-toolkit/tree/7ec03cbba69b4dc86ee33e313bad32ae2ea2924e)
* [MGMT-24788](https://issues.redhat.com/browse/MGMT-24788): Fix pod deletion message contaminating RHCOS kernel version string [#197](https://github.com/openshift/driver-toolkit/pull/197)
* [OCPBUGS-69851](https://issues.redhat.com/browse/OCPBUGS-69851): Fix e2e test failure caused by TTY carriage returns in oc run output [#196](https://github.com/openshift/driver-toolkit/pull/196)
* [OCPBUGS-69851](https://issues.redhat.com/browse/OCPBUGS-69851): Updating Dockerfile.rhel10 base image from base-rhel9 to base-rhel10. [#195](https://github.com/openshift/driver-toolkit/pull/195)
* [OCPBUGS-69851](https://issues.redhat.com/browse/OCPBUGS-69851): Adding driver-toolkit-10 as a new payload component for RHEL 10. [#193](https://github.com/openshift/driver-toolkit/pull/193)
* [OCPBUGS-69851](https://issues.redhat.com/browse/OCPBUGS-69851): Parameterizing the e2e test to validate both DTK and DTK-10. [#194](https://github.com/openshift/driver-toolkit/pull/194)
* [OCPBUGS-69851](https://issues.redhat.com/browse/OCPBUGS-69851): Updating the e2e job to also work on Openshift-5 payloads. [#192](https://github.com/openshift/driver-toolkit/pull/192)
* [OCPBUGS-87225](https://issues.redhat.com/browse/OCPBUGS-87225): Updating driver-toolkit-container image to be consistent with ART for 5.0 [#191](https://github.com/openshift/driver-toolkit/pull/191)
* [OCPBUGS-69851](https://issues.redhat.com/browse/OCPBUGS-69851): Adding support for payload multiple-stream. [#180](https://github.com/openshift/driver-toolkit/pull/180)
* [Full changelog](https://github.com/openshift/driver-toolkit/compare/7aa4007a8601bf4bb23b696f580c022f58877223...7ec03cbba69b4dc86ee33e313bad32ae2ea2924e)
### [egress-router-cni](https://github.com/openshift/egress-router-cni/tree/a923d37cfe033853603240f862cb907ba997cb68)
* [OCPBUGS-87977](https://issues.redhat.com/browse/OCPBUGS-87977): bump containernetworking/cni to v1.3.0 [#102](https://github.com/openshift/egress-router-cni/pull/102)
* [OCPBUGS-83286](https://issues.redhat.com/browse/OCPBUGS-83286): Fix swallowed errors in cmdAdd/cmdDel causing empty CNI result [#95](https://github.com/openshift/egress-router-cni/pull/95)
* NO-JIRA: Update OWNERs file [#96](https://github.com/openshift/egress-router-cni/pull/96)
* [Full changelog](https://github.com/openshift/egress-router-cni/compare/5e0f8d1b545899fda27c5e1cc8707d33cba1b534...a923d37cfe033853603240f862cb907ba997cb68)
### [etcd](https://github.com/openshift/etcd/tree/64f8851a001f7e102d47bfe51ca0dac23951879a)
* [OCPBUGS-94014](https://issues.redhat.com/browse/OCPBUGS-94014): Rebase v3.6.13 on main (5.0/4.23) [#392](https://github.com/openshift/etcd/pull/392)
* [OCPBUGS-87363](https://issues.redhat.com/browse/OCPBUGS-87363): Updating ose-etcd-container image to be consistent with ART for 5.0 [#384](https://github.com/openshift/etcd/pull/384)
* [OCPBUGS-85258](https://issues.redhat.com/browse/OCPBUGS-85258): 5.0 rebase 3.6.11 [#375](https://github.com/openshift/etcd/pull/375)
* [OCPBUGS-82495](https://issues.redhat.com/browse/OCPBUGS-82495): 5.0/4.23 rebase 3.6.10 [#368](https://github.com/openshift/etcd/pull/368)
* [Full changelog](https://github.com/openshift/etcd/compare/d8d67b8ce849f816d6d23c904098336632e2348f...64f8851a001f7e102d47bfe51ca0dac23951879a)
### [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp/tree/30cc04797f50e78e91f8e47cc6c36c0da84eee2c)
* [OCPBUGS-84569](https://issues.redhat.com/browse/OCPBUGS-84569): Fix node.kubernetes.io/exclude-from-external-load-balancers on masters [#121](https://github.com/openshift/cloud-provider-gcp/pull/121)
* [OCPBUGS-87279](https://issues.redhat.com/browse/OCPBUGS-87279): Updating ose-gcp-cloud-controller-manager-container image to be consistent with ART for 5.0 [#120](https://github.com/openshift/cloud-provider-gcp/pull/120)
* [OCPBUGS-85551](https://issues.redhat.com/browse/OCPBUGS-85551), [OCPBUGS-85552](https://issues.redhat.com/browse/OCPBUGS-85552): Upgrade spdystream and grpc to fix CVEs [#115](https://github.com/openshift/cloud-provider-gcp/pull/115)
* NO-JIRA: Remove custom vendor scripts in favour of standard tooling [#111](https://github.com/openshift/cloud-provider-gcp/pull/111)
* NO-JIRA: Update OWNERS [#105](https://github.com/openshift/cloud-provider-gcp/pull/105)
* [Full changelog](https://github.com/openshift/cloud-provider-gcp/compare/4d9707e182c4f8734d83ebf21e3ffcc4c38d04e9...30cc04797f50e78e91f8e47cc6c36c0da84eee2c)
### [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp/tree/194befaa927c8e6ca56526218f2d4f5e2d4bd431)
* 🐛 OCPBUGS-85337: set imagePullPolicy IfNotPresent on provider workloads [#299](https://github.com/openshift/cluster-api-provider-gcp/pull/299)
* [OCPBUGS-87462](https://issues.redhat.com/browse/OCPBUGS-87462): Updating ose-gcp-cluster-api-controllers-container image to be consistent with ART for 5.0 [#298](https://github.com/openshift/cluster-api-provider-gcp/pull/298)
* [OCPBUGS-53005](https://issues.redhat.com/browse/OCPBUGS-53005): Remove references to master branch [#297](https://github.com/openshift/cluster-api-provider-gcp/pull/297)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.12.0 (b9b055d) into master [#295](https://github.com/openshift/cluster-api-provider-gcp/pull/295)
* [OCPBUGS-85101](https://issues.redhat.com/browse/OCPBUGS-85101): Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.11.2 (14609a0) into master [#273](https://github.com/openshift/cluster-api-provider-gcp/pull/273)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#292](https://github.com/openshift/cluster-api-provider-gcp/pull/292)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#284](https://github.com/openshift/cluster-api-provider-gcp/pull/284)
* NO-JIRA: Update manifests generator [#285](https://github.com/openshift/cluster-api-provider-gcp/pull/285)
* [OCPBUGS-77684](https://issues.redhat.com/browse/OCPBUGS-77684): Updating ose-gcp-cluster-api-controllers-container image to be consistent with ART for 4.22 [#272](https://github.com/openshift/cluster-api-provider-gcp/pull/272)
* NO-JIRA: Update OWNERS [#280](https://github.com/openshift/cluster-api-provider-gcp/pull/280)
* [Full changelog](https://github.com/openshift/cluster-api-provider-gcp/compare/37085d5287031ee68f58b165256d4104bba99886...194befaa927c8e6ca56526218f2d4f5e2d4bd431)
### [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp/tree/1d098131fa7123b9793e01dcdac4d0b18b9ef1ae)
* [OCPBUGS-91738](https://issues.redhat.com/browse/OCPBUGS-91738): golang.org/x/net bumped from v0.51.0 to v0.55.0 [#172](https://github.com/openshift/machine-api-provider-gcp/pull/172)
* [OCPBUGS-87524](https://issues.redhat.com/browse/OCPBUGS-87524): Updating ose-machine-api-provider-gcp-container image to be consistent with ART for 5.0 [#170](https://github.com/openshift/machine-api-provider-gcp/pull/170)
* NO-JIRA: Update OWNERS [#157](https://github.com/openshift/machine-api-provider-gcp/pull/157)
* [Full changelog](https://github.com/openshift/machine-api-provider-gcp/compare/0073bd1187c07febc963fc67f0df67cd33c8f218...1d098131fa7123b9793e01dcdac4d0b18b9ef1ae)
### [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver/tree/2dad9ff88511cc4e82a777c49ec55cbed2e3a057)
* [STOR-2915](https://issues.redhat.com/browse/STOR-2915): Update go.opentelemetry.io/otel and otel/sdk to v1.43.0 [#125](https://github.com/openshift/gcp-pd-csi-driver/pull/125)
* [STOR-2915](https://issues.redhat.com/browse/STOR-2915): Rebase to upstream v1.26.0 for OCP 5.0 [#124](https://github.com/openshift/gcp-pd-csi-driver/pull/124)
* [OCPBUGS-87399](https://issues.redhat.com/browse/OCPBUGS-87399): Updating ose-gcp-pd-csi-driver-container image to be consistent with ART for 5.0 [#123](https://github.com/openshift/gcp-pd-csi-driver/pull/123)
* UPSTREAM: 2297: OCPBUGS-83423: Bump google.golang.org/grpc to v1.79.3 [#121](https://github.com/openshift/gcp-pd-csi-driver/pull/121)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver/compare/2ba117405ff1cee765d42491f5863b06a1c9a2da...2dad9ff88511cc4e82a777c49ec55cbed2e3a057)
### [gcp-pd-csi-driver-operator](https://github.com/openshift/csi-operator/tree/50f79e773ab432a91299a06003191a1fc2535746)
* [OCPBUGS-99200](https://issues.redhat.com/browse/OCPBUGS-99200): Add networking.k8s.io group policy [#581](https://github.com/openshift/csi-operator/pull/581)
* [OCPBUGS-99490](https://issues.redhat.com/browse/OCPBUGS-99490): Apply some static assets earlier, before starting controllers [#584](https://github.com/openshift/csi-operator/pull/584)
* [STOR-2997](https://issues.redhat.com/browse/STOR-2997): Minimal implementation of GCP PD CSI driver operator [#576](https://github.com/openshift/csi-operator/pull/576)
* [STOR-3030](https://issues.redhat.com/browse/STOR-3030): feat(operator): detect GCP Dedicated and use hyperdisk-balanced StorageClass [#573](https://github.com/openshift/csi-operator/pull/573)
* [STOR-2996](https://issues.redhat.com/browse/STOR-2996): Sync gcp pd csi driver operator to legacy subdir (2) [#575](https://github.com/openshift/csi-operator/pull/575)
* [STOR-2996](https://issues.redhat.com/browse/STOR-2996): Run unit-tests in /legacy subdir [#574](https://github.com/openshift/csi-operator/pull/574)
* [OCPBUGS-85106](https://issues.redhat.com/browse/OCPBUGS-85106): Add required-scc annotation to EFS and SMB operator deployments [#569](https://github.com/openshift/csi-operator/pull/569)
* [OCPBUGS-90151](https://issues.redhat.com/browse/OCPBUGS-90151): hack/update-metadata.sh: allow MAX_OCP_VERSION override [#571](https://github.com/openshift/csi-operator/pull/571)
* [STOR-2996](https://issues.redhat.com/browse/STOR-2996): Sync gcp pd csi driver operator to legacy subdir [#570](https://github.com/openshift/csi-operator/pull/570)
* [OCPBUGS-87449](https://issues.redhat.com/browse/OCPBUGS-87449): Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 5.0 [#566](https://github.com/openshift/csi-operator/pull/566)
* [STOR-2920](https://issues.redhat.com/browse/STOR-2920): Bump OLM metadata to 5.0 [#568](https://github.com/openshift/csi-operator/pull/568)
* [STOR-2996](https://issues.redhat.com/browse/STOR-2996): Add gcp pd csi driver operator to legacy subdir [#562](https://github.com/openshift/csi-operator/pull/562)
* [OCPBUGS-87270](https://issues.redhat.com/browse/OCPBUGS-87270): Updating csi-driver-manila-operator-container image to be consistent with ART for 5.0 [#563](https://github.com/openshift/csi-operator/pull/563)
* [OCPBUGS-87236](https://issues.redhat.com/browse/OCPBUGS-87236): Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 5.0 [#561](https://github.com/openshift/csi-operator/pull/561)
* [OCPBUGS-87387](https://issues.redhat.com/browse/OCPBUGS-87387): Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 5.0 [#565](https://github.com/openshift/csi-operator/pull/565)
* [OCPBUGS-87368](https://issues.redhat.com/browse/OCPBUGS-87368): Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 5.0 [#564](https://github.com/openshift/csi-operator/pull/564)
* [OCPBUGS-87470](https://issues.redhat.com/browse/OCPBUGS-87470): Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 5.0 [#567](https://github.com/openshift/csi-operator/pull/567)
* [OCPBUGS-87219](https://issues.redhat.com/browse/OCPBUGS-87219): Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 5.0 [#560](https://github.com/openshift/csi-operator/pull/560)
* [OCPBUGS-42363](https://issues.redhat.com/browse/OCPBUGS-42363): Re-enable Azure Disk load test [#558](https://github.com/openshift/csi-operator/pull/558)
* [OCPBUGS-86023](https://issues.redhat.com/browse/OCPBUGS-86023): Add memory limits to SMB CSI sidecar containers [#557](https://github.com/openshift/csi-operator/pull/557)
* [OCPBUGS-85457](https://issues.redhat.com/browse/OCPBUGS-85457): Add init container for Manila node daemonset [#552](https://github.com/openshift/csi-operator/pull/552)
* [OCPBUGS-84052](https://issues.redhat.com/browse/OCPBUGS-84052): Mount writable /tmp in SMB CSI driver [#545](https://github.com/openshift/csi-operator/pull/545)
* [OSASINFRA-3675](https://issues.redhat.com/browse/OSASINFRA-3675): Rework authentication in Manila CSI Driver Operator [#373](https://github.com/openshift/csi-operator/pull/373)
* [OCPBUGS-80930](https://issues.redhat.com/browse/OCPBUGS-80930): Add VolumeAttributesClass e2e test manifests for Azure disk [#538](https://github.com/openshift/csi-operator/pull/538)
* [OCPBUGS-78291](https://issues.redhat.com/browse/OCPBUGS-78291): Allow azure-disk sidecars to read VolumeAttributeClasses [#525](https://github.com/openshift/csi-operator/pull/525)
* [STOR-2762](https://issues.redhat.com/browse/STOR-2762): Bump all deps for 4.22 [#526](https://github.com/openshift/csi-operator/pull/526)
* [OCPBUGS-77674](https://issues.redhat.com/browse/OCPBUGS-77674): Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 4.22 [#516](https://github.com/openshift/csi-operator/pull/516)
* [OCPBUGS-77553](https://issues.redhat.com/browse/OCPBUGS-77553): Updating csi-driver-manila-operator-container image to be consistent with ART for 4.22 [#513](https://github.com/openshift/csi-operator/pull/513)
* [OCPBUGS-77612](https://issues.redhat.com/browse/OCPBUGS-77612): Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.22 [#514](https://github.com/openshift/csi-operator/pull/514)
* [STOR-2884](https://issues.redhat.com/browse/STOR-2884): Add service to generate a TLS cert for EFS operator [#522](https://github.com/openshift/csi-operator/pull/522)
* [STOR-2884](https://issues.redhat.com/browse/STOR-2884): Add service to generate a TLS cert for SMB operator [#520](https://github.com/openshift/csi-operator/pull/520)
* NO-JIRA: Inherit any OpenShift global CodeRabbit setting [#519](https://github.com/openshift/csi-operator/pull/519)
* [OCPBUGS-77623](https://issues.redhat.com/browse/OCPBUGS-77623): Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.22 [#515](https://github.com/openshift/csi-operator/pull/515)
* [OCPBUGS-77571](https://issues.redhat.com/browse/OCPBUGS-77571): Add only to tags to volume object, if volume is not already tagged [#518](https://github.com/openshift/csi-operator/pull/518)
* [OCPBUGS-77497](https://issues.redhat.com/browse/OCPBUGS-77497): Fix readonly root fs in Azure init containers [#512](https://github.com/openshift/csi-operator/pull/512)
* NO-JIRA: Add coderabbit, including instructions [#509](https://github.com/openshift/csi-operator/pull/509)
* [STOR-2752](https://issues.redhat.com/browse/STOR-2752): Early chore: update OCP version in OLM metadata [#505](https://github.com/openshift/csi-operator/pull/505)
* Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.22 [#517](https://github.com/openshift/csi-operator/pull/517)
* [OCPBUGS-77378](https://issues.redhat.com/browse/OCPBUGS-77378): Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 4.22 [#510](https://github.com/openshift/csi-operator/pull/510)
* [OCPBUGS-77405](https://issues.redhat.com/browse/OCPBUGS-77405): Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.22 [#511](https://github.com/openshift/csi-operator/pull/511)
* [OCPBUGS-76298](https://issues.redhat.com/browse/OCPBUGS-76298): missing readOnlyRootFilesystem in AWS init containers [#506](https://github.com/openshift/csi-operator/pull/506)
* [OCPBUGS-74971](https://issues.redhat.com/browse/OCPBUGS-74971): Fix azure-disk secret namespace/name args [#502](https://github.com/openshift/csi-operator/pull/502)
* [OCPBUGS-74521](https://issues.redhat.com/browse/OCPBUGS-74521): Remove VolumeAttributesClass FeatureGate [#503](https://github.com/openshift/csi-operator/pull/503)
* [STOR-2523](https://issues.redhat.com/browse/STOR-2523): hypershift: Add desired-version annotation to controller Deployments and use DeploymentVersionController in csi driver operators [#457](https://github.com/openshift/csi-operator/pull/457)
* [OCPBUGS-70304](https://issues.redhat.com/browse/OCPBUGS-70304): Fix azure-file secret namespace/name [#500](https://github.com/openshift/csi-operator/pull/500)
* [OCPBUGS-66113](https://issues.redhat.com/browse/OCPBUGS-66113): Some containers do not have readOnlyRootFilesystem [#476](https://github.com/openshift/csi-operator/pull/476)
* [OCPBUGS-70085](https://issues.redhat.com/browse/OCPBUGS-70085): Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 4.22 [#483](https://github.com/openshift/csi-operator/pull/483)
* [OCPBUGS-70339](https://issues.redhat.com/browse/OCPBUGS-70339): deploy prometheus role and binding on hypershift guest [#488](https://github.com/openshift/csi-operator/pull/488)
* [OCPBUGS-63698](https://issues.redhat.com/browse/OCPBUGS-63698): fix(azure): add token-minter for self-managed hosted clusters [#461](https://github.com/openshift/csi-operator/pull/461)
* [OCPBUGS-69739](https://issues.redhat.com/browse/OCPBUGS-69739): Updating csi-driver-manila-operator-container image to be consistent with ART for 4.22 [#480](https://github.com/openshift/csi-operator/pull/480)
* [OCPBUGS-69907](https://issues.redhat.com/browse/OCPBUGS-69907): Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.22 [#482](https://github.com/openshift/csi-operator/pull/482)
* [OCPBUGS-69710](https://issues.redhat.com/browse/OCPBUGS-69710): Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.22 [#479](https://github.com/openshift/csi-operator/pull/479)
* NO-JIRA: Add /sniff-test claude command [#486](https://github.com/openshift/csi-operator/pull/486)
* [OCPBUGS-69883](https://issues.redhat.com/browse/OCPBUGS-69883): Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.22 [#481](https://github.com/openshift/csi-operator/pull/481)
* [OCPBUGS-69982](https://issues.redhat.com/browse/OCPBUGS-69982): Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.22 [#484](https://github.com/openshift/csi-operator/pull/484)
* [OCPBUGS-69695](https://issues.redhat.com/browse/OCPBUGS-69695): Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 4.22 [#478](https://github.com/openshift/csi-operator/pull/478)
* [STOR-2543](https://issues.redhat.com/browse/STOR-2543): add VAC manifest for tests in AWS EBS [#475](https://github.com/openshift/csi-operator/pull/475)
* [STOR-1945](https://issues.redhat.com/browse/STOR-1945): STOR-2056: Add SupportedSizeRange for azurefile-nfs [#477](https://github.com/openshift/csi-operator/pull/477)
* NO-JIRA: Migrate away from deprecated ioutil [#474](https://github.com/openshift/csi-operator/pull/474)
* [CNTRLPLANE-1285](https://issues.redhat.com/browse/CNTRLPLANE-1285): enable readOnlyRootFilesystem [#419](https://github.com/openshift/csi-operator/pull/419)
* [OCPBUGS-65858](https://issues.redhat.com/browse/OCPBUGS-65858): allow all-egress for efs operator [#472](https://github.com/openshift/csi-operator/pull/472)
* [STOR-2538](https://issues.redhat.com/browse/STOR-2538): Migrate aws sdk to v2 [#442](https://github.com/openshift/csi-operator/pull/442)
* No-JIRA: Update owners [#471](https://github.com/openshift/csi-operator/pull/471)
* [STOR-2627](https://issues.redhat.com/browse/STOR-2627): Enable nodeAllocatableUpdatePeriodSeconds in AWS EBS [#435](https://github.com/openshift/csi-operator/pull/435)
* [OCPBUGS-65606](https://issues.redhat.com/browse/OCPBUGS-65606): adds the csi-external-resizer to the image-references [#469](https://github.com/openshift/csi-operator/pull/469)
* [STOR-2592](https://issues.redhat.com/browse/STOR-2592): Bump all deps for 4.21 and remove hypershift client [#468](https://github.com/openshift/csi-operator/pull/468)
* [STOR-2523](https://issues.redhat.com/browse/STOR-2523): Add hypershift managed-by labels for csi driver operators [#446](https://github.com/openshift/csi-operator/pull/446)
* [OCPBUGS-62802](https://issues.redhat.com/browse/OCPBUGS-62802): Add RBAC ClusterRole and Binding for driver node [#443](https://github.com/openshift/csi-operator/pull/443)
* NO-JIRA: add ai-helpers claude marketplace [#451](https://github.com/openshift/csi-operator/pull/451)
* NO-JIRA: Normalize generation of driver metrics RBAC proxy sidecar [#380](https://github.com/openshift/csi-operator/pull/380)
* [OCPBUGS-61436](https://issues.redhat.com/browse/OCPBUGS-61436), [OCPBUGS-61450](https://issues.redhat.com/browse/OCPBUGS-61450), [STOR-2600](https://issues.redhat.com/browse/STOR-2600): Bump OLM metadata to 4.21 [#430](https://github.com/openshift/csi-operator/pull/430)
* [OCPBUGS-62404](https://issues.redhat.com/browse/OCPBUGS-62404): Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 4.21 [#438](https://github.com/openshift/csi-operator/pull/438)
* [STOR-1945](https://issues.redhat.com/browse/STOR-1945): STOR-2056: add Azure File NFS test manifest [#445](https://github.com/openshift/csi-operator/pull/445)
* [OCPBUGS-62374](https://issues.redhat.com/browse/OCPBUGS-62374): Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.21 [#437](https://github.com/openshift/csi-operator/pull/437)
* [MULTIARCH-5554](https://issues.redhat.com/browse/MULTIARCH-5554): update smb-csi-driver-operator support to add ppc64le [#428](https://github.com/openshift/csi-operator/pull/428)
* [OCPBUGS-62427](https://issues.redhat.com/browse/OCPBUGS-62427): Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.21 [#439](https://github.com/openshift/csi-operator/pull/439)
* [OCPBUGS-62348](https://issues.redhat.com/browse/OCPBUGS-62348): Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.21 [#436](https://github.com/openshift/csi-operator/pull/436)
* [OCPBUGS-61955](https://issues.redhat.com/browse/OCPBUGS-61955): Add withCABundleDaemonSetHook() to AWS EFS operator [#433](https://github.com/openshift/csi-operator/pull/433)
* [OCPBUGS-60637](https://issues.redhat.com/browse/OCPBUGS-60637): add runAsUser hook for operator deployment controller [#431](https://github.com/openshift/csi-operator/pull/431)
* NO-JIRA: Centralize injection of hosted-kubeconfig volume [#311](https://github.com/openshift/csi-operator/pull/311)
* NO-JIRA: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.21 [#429](https://github.com/openshift/csi-operator/pull/429)
* [OCPBUGS-54385](https://issues.redhat.com/browse/OCPBUGS-54385): Avoid informer resync [#432](https://github.com/openshift/csi-operator/pull/432)
* NO-JIRA: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.21 [#427](https://github.com/openshift/csi-operator/pull/427)
* NO-JIRA: Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 4.21 [#425](https://github.com/openshift/csi-operator/pull/425)
* NO-JIRA: azure-disk, azure-file sync code de-duplication [#303](https://github.com/openshift/csi-operator/pull/303)
* [STOR-2477](https://issues.redhat.com/browse/STOR-2477): Correct efs single-zone storageclass [#404](https://github.com/openshift/csi-operator/pull/404)
* [OCPBUGS-60655](https://issues.redhat.com/browse/OCPBUGS-60655): Disable LUN stress test for azure-file [#418](https://github.com/openshift/csi-operator/pull/418)
* [OCPBUGS-60464](https://issues.redhat.com/browse/OCPBUGS-60464): Bump library-go to fix panic [#417](https://github.com/openshift/csi-operator/pull/417)
* [STOR-2394](https://issues.redhat.com/browse/STOR-2394): Bump all deps for 4.20 [#408](https://github.com/openshift/csi-operator/pull/408)
* [STOR-2479](https://issues.redhat.com/browse/STOR-2479): Add CredentialsRequest for the EFS node DaemonSet [#389](https://github.com/openshift/csi-operator/pull/389)
* [STOR-2330](https://issues.redhat.com/browse/STOR-2330): Add labels to subscribe openstack cinder and manila CSI driver controllers to NPs [#409](https://github.com/openshift/csi-operator/pull/409)
* [OCPBUGS-57395](https://issues.redhat.com/browse/OCPBUGS-57395): Remove stale conditions [#406](https://github.com/openshift/csi-operator/pull/406)
* [OCPBUGS-58254](https://issues.redhat.com/browse/OCPBUGS-58254): Bump library-go [#405](https://github.com/openshift/csi-operator/pull/405)
* [STOR-2331](https://issues.redhat.com/browse/STOR-2331): Add labels to subscribe SMB CSI driver operator and controller to NPs [#400](https://github.com/openshift/csi-operator/pull/400)
* [STOR-2330](https://issues.redhat.com/browse/STOR-2330): Add labels to subscribe Azure disk and file CSI driver controllers to NPs [#396](https://github.com/openshift/csi-operator/pull/396)
* [OCPBUGS-57768](https://issues.redhat.com/browse/OCPBUGS-57768): Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.20 [#399](https://github.com/openshift/csi-operator/pull/399)
* [OCPBUGS-57739](https://issues.redhat.com/browse/OCPBUGS-57739): Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 4.20 [#398](https://github.com/openshift/csi-operator/pull/398)
* [OCPBUGS-57700](https://issues.redhat.com/browse/OCPBUGS-57700): Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.20 [#397](https://github.com/openshift/csi-operator/pull/397)
* [OCPBUGS-57565](https://issues.redhat.com/browse/OCPBUGS-57565): Updating csi-driver-manila-operator-container image to be consistent with ART for 4.20 [#394](https://github.com/openshift/csi-operator/pull/394)
* [STOR-2331](https://issues.redhat.com/browse/STOR-2331): Add labels to subscribe AWS-EFS CSI driver operator to NPs [#391](https://github.com/openshift/csi-operator/pull/391)
* [OCPBUGS-57680](https://issues.redhat.com/browse/OCPBUGS-57680): Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.20 [#395](https://github.com/openshift/csi-operator/pull/395)
* [STOR-2477](https://issues.redhat.com/browse/STOR-2477): create-efs-volume: add single-zone support [#390](https://github.com/openshift/csi-operator/pull/390)
* [OCPBUGS-57545](https://issues.redhat.com/browse/OCPBUGS-57545): Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.20 [#393](https://github.com/openshift/csi-operator/pull/393)
* Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 4.20 [#392](https://github.com/openshift/csi-operator/pull/392)
* [STOR-2330](https://issues.redhat.com/browse/STOR-2330): Add labels to subscribe AWS-EBS CSI driver controller to NPs [#387](https://github.com/openshift/csi-operator/pull/387)
* NO-JIRA: create-efs-volume: print files to log as a fallback [#388](https://github.com/openshift/csi-operator/pull/388)
* NO-JIRA: Update openstack approvers [#385](https://github.com/openshift/csi-operator/pull/385)
* [OCPBUGS-54975](https://issues.redhat.com/browse/OCPBUGS-54975): Fix Cinder, Manila driver metrics [#379](https://github.com/openshift/csi-operator/pull/379)
* [OCPBUGS-56128](https://issues.redhat.com/browse/OCPBUGS-56128): openstack-cinder: Set --with-topology flag for node driver also [#383](https://github.com/openshift/csi-operator/pull/383)
* [STOR-2408](https://issues.redhat.com/browse/STOR-2408): Bump OLM metadata to 4.20 [#382](https://github.com/openshift/csi-operator/pull/382)
* [OCPBUGS-50493](https://issues.redhat.com/browse/OCPBUGS-50493): Use 127.0.0.1 for healtz http-endpoints [#364](https://github.com/openshift/csi-operator/pull/364)
* NO-JIRA: build only needed cmd in container image [#329](https://github.com/openshift/csi-operator/pull/329)
* [OCPBUGS-54382](https://issues.redhat.com/browse/OCPBUGS-54382): Correct ASH driver inject env config [#376](https://github.com/openshift/csi-operator/pull/376)
* [OSASINFRA-3652](https://issues.redhat.com/browse/OSASINFRA-3652): openstack-cinder: Use new --with-topology flag [#345](https://github.com/openshift/csi-operator/pull/345)
* [STOR-2126](https://issues.redhat.com/browse/STOR-2126): Enable readOnlyFileSystem [#370](https://github.com/openshift/csi-operator/pull/370)
* [OCPBUGS-54447](https://issues.redhat.com/browse/OCPBUGS-54447): Enable required driver services [#369](https://github.com/openshift/csi-operator/pull/369)
* [OCPBUGS-54180](https://issues.redhat.com/browse/OCPBUGS-54180): Disable remove-not-ready-taint for azure disk csi driver [#371](https://github.com/openshift/csi-operator/pull/371)
* [OCPBUGS-54230](https://issues.redhat.com/browse/OCPBUGS-54230): Bump library-go [#372](https://github.com/openshift/csi-operator/pull/372)
* [STOR-1877](https://issues.redhat.com/browse/STOR-1877): Run operators without root user control [#368](https://github.com/openshift/csi-operator/pull/368)
* [STOR-1880](https://issues.redhat.com/browse/STOR-1880): Role and ClusterRole with too wide permissions [#367](https://github.com/openshift/csi-operator/pull/367)
* [OCPBUGS-41827](https://issues.redhat.com/browse/OCPBUGS-41827): update injector to use a secret rather than an environment variable [#357](https://github.com/openshift/csi-operator/pull/357)
* NO-JIRA: Fixed typo in README.md [#348](https://github.com/openshift/csi-operator/pull/348)
* [STOR-2252](https://issues.redhat.com/browse/STOR-2252): Bump all deps [#361](https://github.com/openshift/csi-operator/pull/361)
* NO-JIRA: NO-JIRA: Remove bertinatto from OWNERS [#363](https://github.com/openshift/csi-operator/pull/363)
* [CFE-1132](https://issues.redhat.com/browse/CFE-1132): EFS Access Point Tags Update DAY2 [#313](https://github.com/openshift/csi-operator/pull/313)
* [CFE-1131](https://issues.redhat.com/browse/CFE-1131): AWS Tags DAY2 Update [#297](https://github.com/openshift/csi-operator/pull/297)
* [STOR-2263](https://issues.redhat.com/browse/STOR-2263): correct smb csi driver test manifest [#360](https://github.com/openshift/csi-operator/pull/360)
* NO-JIRA: Remove `inject-proxy` annotations for aws-ebs, aws-efs node daemonsets [#308](https://github.com/openshift/csi-operator/pull/308)
* [OCPBUGS-48507](https://issues.redhat.com/browse/OCPBUGS-48507): openstack-manila: update PodDisruptionBudget name [#353](https://github.com/openshift/csi-operator/pull/353)
* [STOR-2078](https://issues.redhat.com/browse/STOR-2078): Enable VolumeAttributesClass on AWS EBS for resizer + provisioner [#314](https://github.com/openshift/csi-operator/pull/314)
* NO-JIRA: Update golang.org/x/net to v0.34.0 [#352](https://github.com/openshift/csi-operator/pull/352)
* [OCPBUGS-45073](https://issues.redhat.com/browse/OCPBUGS-45073): Support HCP labels [#332](https://github.com/openshift/csi-operator/pull/332)
* [STOR-2260](https://issues.redhat.com/browse/STOR-2260): Bump OLM metadata to 4.19 [#351](https://github.com/openshift/csi-operator/pull/351)
* [OCPBUGS-45591](https://issues.redhat.com/browse/OCPBUGS-45591): Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 4.19 [#342](https://github.com/openshift/csi-operator/pull/342)
* [OCPBUGS-44723](https://issues.redhat.com/browse/OCPBUGS-44723): remove EFS driver metrics [#330](https://github.com/openshift/csi-operator/pull/330)
* [OCPBUGS-45374](https://issues.redhat.com/browse/OCPBUGS-45374): Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.19 [#337](https://github.com/openshift/csi-operator/pull/337)
* [OCPBUGS-45622](https://issues.redhat.com/browse/OCPBUGS-45622): Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.19 [#343](https://github.com/openshift/csi-operator/pull/343)
* Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.19 [#341](https://github.com/openshift/csi-operator/pull/341)
* [OCPBUGS-45508](https://issues.redhat.com/browse/OCPBUGS-45508): Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.19 [#340](https://github.com/openshift/csi-operator/pull/340)
* [OCPBUGS-45395](https://issues.redhat.com/browse/OCPBUGS-45395): Updating csi-driver-manila-operator-container image to be consistent with ART for 4.19 [#339](https://github.com/openshift/csi-operator/pull/339)
* [OCPBUGS-45352](https://issues.redhat.com/browse/OCPBUGS-45352): Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 4.19 [#336](https://github.com/openshift/csi-operator/pull/336)
* [OCPBUGS-45267](https://issues.redhat.com/browse/OCPBUGS-45267): openstack-manila: modify assets selectors [#335](https://github.com/openshift/csi-operator/pull/335)
* [OCPBUGS-43357](https://issues.redhat.com/browse/OCPBUGS-43357): support hcp tolerations [#326](https://github.com/openshift/csi-operator/pull/326)
* [OSASINFRA-3626](https://issues.redhat.com/browse/OSASINFRA-3626): Resize support with the OpenStack Manila CSI Driver [#322](https://github.com/openshift/csi-operator/pull/322)
* [STOR-2017](https://issues.redhat.com/browse/STOR-2017): Bump library-go and API [#325](https://github.com/openshift/csi-operator/pull/325)
* [AUTH-482](https://issues.redhat.com/browse/AUTH-482): set required-scc for openshift workloads [#306](https://github.com/openshift/csi-operator/pull/306)
* NO-JIRA: ignore cmd/generator/main.go in .snyk [#295](https://github.com/openshift/csi-operator/pull/295)
* [OSASINFRA-3535](https://issues.redhat.com/browse/OSASINFRA-3535): openstack-cinder: Watch management cluster for cloud-provider config [#321](https://github.com/openshift/csi-operator/pull/321)
* [OCPBUGS-44340](https://issues.redhat.com/browse/OCPBUGS-44340): Fix error handling for starter controller [#318](https://github.com/openshift/csi-operator/pull/318)
* [OSASINFRA-3638](https://issues.redhat.com/browse/OSASINFRA-3638): Add support for Hypershift to Manila CSI [#312](https://github.com/openshift/csi-operator/pull/312)
* [OSASINFRA-3535](https://issues.redhat.com/browse/OSASINFRA-3535): Add support for Hypershift to Cinder CSI [#302](https://github.com/openshift/csi-operator/pull/302)
* NO-JIRA: Add openstack-approvers to root OWNERS [#315](https://github.com/openshift/csi-operator/pull/315)
* [OSASINFRA-3621](https://issues.redhat.com/browse/OSASINFRA-3621): Remove legacy csi-driver-manila-operator [#317](https://github.com/openshift/csi-operator/pull/317)
* [OSASINFRA-3618](https://issues.redhat.com/browse/OSASINFRA-3618): Add Cinder CSI support (part 3) [#298](https://github.com/openshift/csi-operator/pull/298)
* [OSASINFRA-3654](https://issues.redhat.com/browse/OSASINFRA-3654): Include OpenStack test manifest to test/e2e [#316](https://github.com/openshift/csi-operator/pull/316)
* [OSASINFRA-3620](https://issues.redhat.com/browse/OSASINFRA-3620): Add manila csi [#288](https://github.com/openshift/csi-operator/pull/288)
* NO-JIRA: Add OWNERS files for OpenStack-specific components/assets [#299](https://github.com/openshift/csi-operator/pull/299)
* [HOSTEDCP-2032](https://issues.redhat.com/browse/HOSTEDCP-2032): Set azure disk & file Secrets Store CSI Volume [#309](https://github.com/openshift/csi-operator/pull/309)
* [STOR-1844](https://issues.redhat.com/browse/STOR-1844): remove config/samba/manifests/preview symlink [#305](https://github.com/openshift/csi-operator/pull/305)
* [OCPBUGS-42325](https://issues.redhat.com/browse/OCPBUGS-42325): Set separate secrets for file and disk config on HyperShift [#290](https://github.com/openshift/csi-operator/pull/290)
* [OCPBUGS-43562](https://issues.redhat.com/browse/OCPBUGS-43562): Add missing proxy hook for `openstack-cinder` driver [#304](https://github.com/openshift/csi-operator/pull/304)
* [OCPBUGS-43653](https://issues.redhat.com/browse/OCPBUGS-43653): Add missing credentials secret hook [#307](https://github.com/openshift/csi-operator/pull/307)
* [OSASINFRA-3628](https://issues.redhat.com/browse/OSASINFRA-3628): Make guest namespace configurable [#294](https://github.com/openshift/csi-operator/pull/294)
* [STOR-1844](https://issues.redhat.com/browse/STOR-1844): update OLM manifests to use stable channel [#300](https://github.com/openshift/csi-operator/pull/300)
* [OSASINFRA-3618](https://issues.redhat.com/browse/OSASINFRA-3618): Add Cinder CSI support (part 2) [#275](https://github.com/openshift/csi-operator/pull/275)
* [OCPBUGS-42939](https://issues.redhat.com/browse/OCPBUGS-42939): Correct aws efs csi driver config as removable [#293](https://github.com/openshift/csi-operator/pull/293)
* [OCPBUGS-38922](https://issues.redhat.com/browse/OCPBUGS-38922): add tag matching to Azure File storage class [#272](https://github.com/openshift/csi-operator/pull/272)
* [OCPBUGS-41365](https://issues.redhat.com/browse/OCPBUGS-41365): add ability to control kube rbac proxy container image… [#289](https://github.com/openshift/csi-operator/pull/289)
* NO-JIRA: Add SidecarConfig.WithPatches [#285](https://github.com/openshift/csi-operator/pull/285)
* NO-JIRA: Remove generated assets before generation [#287](https://github.com/openshift/csi-operator/pull/287)
* NO-JIRA: List all supported operators in README [#277](https://github.com/openshift/csi-operator/pull/277)
* [OSASINFRA-3611](https://issues.redhat.com/browse/OSASINFRA-3611): Add legacy csi-driver-manila-operator [#280](https://github.com/openshift/csi-operator/pull/280)
* NO-JIRA: Move doc on migrating CSI Driver in-tree [#279](https://github.com/openshift/csi-operator/pull/279)
* [OCPBUGS-41265](https://issues.redhat.com/browse/OCPBUGS-41265): Disable LUN stress test for azure-disk [#282](https://github.com/openshift/csi-operator/pull/282)
* [OSASINFRA-3609](https://issues.redhat.com/browse/OSASINFRA-3609): Update legacy/openstack-cinder-csi-driver-operator [#281](https://github.com/openshift/csi-operator/pull/281)
* [OSASINFRA-3609](https://issues.redhat.com/browse/OSASINFRA-3609): Add Cinder CSI support (part 1) [#278](https://github.com/openshift/csi-operator/pull/278)
* [STOR-1422](https://issues.redhat.com/browse/STOR-1422): Bump(openshift/api): to get EFS volume metrics GA [#273](https://github.com/openshift/csi-operator/pull/273)
* [OCPBUGS-40526](https://issues.redhat.com/browse/OCPBUGS-40526): Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.18 [#270](https://github.com/openshift/csi-operator/pull/270)
* [OCPBUGS-41149](https://issues.redhat.com/browse/OCPBUGS-41149): Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.18 [#271](https://github.com/openshift/csi-operator/pull/271)
* [OCPBUGS-39591](https://issues.redhat.com/browse/OCPBUGS-39591): Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.18 [#269](https://github.com/openshift/csi-operator/pull/269)
* [OCPBUGS-39445](https://issues.redhat.com/browse/OCPBUGS-39445): Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.18 [#268](https://github.com/openshift/csi-operator/pull/268)
* Updating ose-aws-efs-csi-driver-operator-container image to be consistent with ART for 4.18 [#267](https://github.com/openshift/csi-operator/pull/267)
* [OCPBUGS-38578](https://issues.redhat.com/browse/OCPBUGS-38578): Update aws-efs-csi-driver-operator image-references name [#264](https://github.com/openshift/csi-operator/pull/264)
* [STOR-1819](https://issues.redhat.com/browse/STOR-1819): Distribute OCP specific test manifest with create-efs-volume [#260](https://github.com/openshift/csi-operator/pull/260)
* [OCPBUGS-38620](https://issues.redhat.com/browse/OCPBUGS-38620): Some CSI driver containers missing terminationMessagePolicy [#262](https://github.com/openshift/csi-operator/pull/262)
* [STOR-2009](https://issues.redhat.com/browse/STOR-2009): Bump OLM metadata to 4.18 [#259](https://github.com/openshift/csi-operator/pull/259)
* [OCPBUGS-38578](https://issues.redhat.com/browse/OCPBUGS-38578): efs: fix tools image reference [#261](https://github.com/openshift/csi-operator/pull/261)
* [STOR-1993](https://issues.redhat.com/browse/STOR-1993): add init container in EFS CSI controller pod [#252](https://github.com/openshift/csi-operator/pull/252)
* [STOR-1819](https://issues.redhat.com/browse/STOR-1819): Add manifest with OCP specific test config [#258](https://github.com/openshift/csi-operator/pull/258)
* [STOR-1422](https://issues.redhat.com/browse/STOR-1422): Volume Metrics for EFS CSI Driver [#255](https://github.com/openshift/csi-operator/pull/255)
* [STOR-1819](https://issues.redhat.com/browse/STOR-1819): Add manifest with OCP specific test config [#254](https://github.com/openshift/csi-operator/pull/254)
* NO-JIRA: use service account namespace placeholder for smb role bindings [#250](https://github.com/openshift/csi-operator/pull/250)
* [STOR-2002](https://issues.redhat.com/browse/STOR-2002): add Azure File snapshot support [#253](https://github.com/openshift/csi-operator/pull/253)
* [OCPBUGS-37488](https://issues.redhat.com/browse/OCPBUGS-37488): add init container in EBS CSI controller pod [#248](https://github.com/openshift/csi-operator/pull/248)
* [STOR-1856](https://issues.redhat.com/browse/STOR-1856): add STS hook for EFS credentials request controller [#251](https://github.com/openshift/csi-operator/pull/251)
* [STOR-1874](https://issues.redhat.com/browse/STOR-1874): Use real HyperShift API [#236](https://github.com/openshift/csi-operator/pull/236)
* [OCPBUGS-37274](https://issues.redhat.com/browse/OCPBUGS-37274): Add FIPS_ENABLED to env vars for aws-efs-csi-driver (2) [#249](https://github.com/openshift/csi-operator/pull/249)
* [STOR-1856](https://issues.redhat.com/browse/STOR-1856): remove aws efs operator legacy dir [#244](https://github.com/openshift/csi-operator/pull/244)
* [STOR-1596](https://issues.redhat.com/browse/STOR-1596): Bump all deps for 4.17 [#240](https://github.com/openshift/csi-operator/pull/240)
* [STOR-1856](https://issues.redhat.com/browse/STOR-1856): STOR-1606: migrate legacy AWS EFS operator code to csi-operator [#237](https://github.com/openshift/csi-operator/pull/237)
* [OCPBUGS-36936](https://issues.redhat.com/browse/OCPBUGS-36936): Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.17 [#241](https://github.com/openshift/csi-operator/pull/241)
* [OCPBUGS-36948](https://issues.redhat.com/browse/OCPBUGS-36948): Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.17 [#243](https://github.com/openshift/csi-operator/pull/243)
* [OCPBUGS-36942](https://issues.redhat.com/browse/OCPBUGS-36942): Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.17 [#242](https://github.com/openshift/csi-operator/pull/242)
* [STOR-1606](https://issues.redhat.com/browse/STOR-1606): Bump OLM metadata to 4.17 [#239](https://github.com/openshift/csi-operator/pull/239)
* [OCPBUGS-34451](https://issues.redhat.com/browse/OCPBUGS-34451): Bump go version to be consistent with ART [#238](https://github.com/openshift/csi-operator/pull/238)
* [STOR-1290](https://issues.redhat.com/browse/STOR-1290): don't pass credentials via environment variables in AWS EBS [#202](https://github.com/openshift/csi-operator/pull/202)
* [STOR-1856](https://issues.redhat.com/browse/STOR-1856): migrate AWS EFS operator to csi-operator [#232](https://github.com/openshift/csi-operator/pull/232)
* NO-JIRA: keep smb test storageclass consistent with official doc [#234](https://github.com/openshift/csi-operator/pull/234)
* [OCPBUGS-34667](https://issues.redhat.com/browse/OCPBUGS-34667): Ensure Node Metric Service is created in the openshift-cluster-csi-drivers namespace for both OpenShift and Hypershift [#233](https://github.com/openshift/csi-operator/pull/233)
* [OCPBUGS-34189](https://issues.redhat.com/browse/OCPBUGS-34189): Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.17 [#227](https://github.com/openshift/csi-operator/pull/227)
* [OCPBUGS-32370](https://issues.redhat.com/browse/OCPBUGS-32370): Configure scraping of node metrics [#223](https://github.com/openshift/csi-operator/pull/223)
* [OCPBUGS-33776](https://issues.redhat.com/browse/OCPBUGS-33776): Adjust port for registrar sidecar in aws-ebs csi driver container [#225](https://github.com/openshift/csi-operator/pull/225)
* [OCPBUGS-32785](https://issues.redhat.com/browse/OCPBUGS-32785): add token audience for Azure File [#224](https://github.com/openshift/csi-operator/pull/224)
* [STOR-1726](https://issues.redhat.com/browse/STOR-1726): auto-generate assets for CIFS/Samba driver [#217](https://github.com/openshift/csi-operator/pull/217)
* [OCPBUGS-28230](https://issues.redhat.com/browse/OCPBUGS-28230): Add terminationMessagePolicy to all containers [#216](https://github.com/openshift/csi-operator/pull/216)
* [STOR-1726](https://issues.redhat.com/browse/STOR-1726): Delete static resources when ClusterCSIDriver is removed [#215](https://github.com/openshift/csi-operator/pull/215)
* [AUTH-482](https://issues.redhat.com/browse/AUTH-482): set required-scc for openshift workloads [#170](https://github.com/openshift/csi-operator/pull/170)
* NO-JIRA: Remove unused assests for __azure-file__ [#213](https://github.com/openshift/csi-operator/pull/213)
* [OCPBUGS-31044](https://issues.redhat.com/browse/OCPBUGS-31044): Add cluster-wide proxy in the azure-file driver node container [#207](https://github.com/openshift/csi-operator/pull/207)
* [OCPBUGS-31306](https://issues.redhat.com/browse/OCPBUGS-31306): Azure Disk: Add cluster-wide proxy in the driver container in the node [#206](https://github.com/openshift/csi-operator/pull/206)
* [OCPBUGS-28230](https://issues.redhat.com/browse/OCPBUGS-28230): enforce termination message policy on all platform pods [#214](https://github.com/openshift/csi-operator/pull/214)
* [STOR-1726](https://issues.redhat.com/browse/STOR-1726): Add OLM metadata for SMB operator [#210](https://github.com/openshift/csi-operator/pull/210)
* [STOR-1726](https://issues.redhat.com/browse/STOR-1726): Add test manifest for SMB CSI driver [#212](https://github.com/openshift/csi-operator/pull/212)
* [STOR-1818](https://issues.redhat.com/browse/STOR-1818): enable pvcDataSource capability for tests [#204](https://github.com/openshift/csi-operator/pull/204)
* [STOR-1726](https://issues.redhat.com/browse/STOR-1726): Simple rename of objects in `assets/overlays/samba/generated/standalone/` [#211](https://github.com/openshift/csi-operator/pull/211)
* [STOR-1726](https://issues.redhat.com/browse/STOR-1726): Add Dockerfile for Samba operator [#209](https://github.com/openshift/csi-operator/pull/209)
* Bump github.com/prometheus/client_model from 0.5.0 to 0.6.0 [#168](https://github.com/openshift/csi-operator/pull/168)
* [STOR-1726](https://issues.redhat.com/browse/STOR-1726): Minimal implementation of CIFS/Samba CSI driver operator [#205](https://github.com/openshift/csi-operator/pull/205)
* Bump google.golang.org/grpc from 1.61.0 to 1.62.1 [#190](https://github.com/openshift/csi-operator/pull/190)
* Bump github.com/go-openapi/swag from 0.22.9 to 0.23.0 [#198](https://github.com/openshift/csi-operator/pull/198)
* Bump github.com/emicklei/go-restful/v3 from 3.11.2 to 3.12.0 [#203](https://github.com/openshift/csi-operator/pull/203)
* Bump github.com/felixge/fgprof from 0.9.3 to 0.9.4 [#185](https://github.com/openshift/csi-operator/pull/185)
* [STOR-1794](https://issues.redhat.com/browse/STOR-1794): add location for azcopy logs [#200](https://github.com/openshift/csi-operator/pull/200)
* [OCPBUGS-23260](https://issues.redhat.com/browse/OCPBUGS-23260): Explicitly reserve 1 attachment for the root disk [#199](https://github.com/openshift/csi-operator/pull/199)
* Bump go.uber.org/zap from 1.26.0 to 1.27.0 [#173](https://github.com/openshift/csi-operator/pull/173)
* Bump the opentelemetry-dependencies group with 8 updates [#177](https://github.com/openshift/csi-operator/pull/177)
* Bump the golang-dependencies group with 6 updates [#191](https://github.com/openshift/csi-operator/pull/191)
* [OCPBUGS-30620](https://issues.redhat.com/browse/OCPBUGS-30620): remove legacy directory and duplicate Dockerfile.*.test files [#196](https://github.com/openshift/csi-operator/pull/196)
* [OCPBUGS-30469](https://issues.redhat.com/browse/OCPBUGS-30469): CVE-2024-24786: bump google.golang.org/protobuf to v1.33.0 [#197](https://github.com/openshift/csi-operator/pull/197)
* NO-JIRA: Configure dependabot for security updates only [#174](https://github.com/openshift/csi-operator/pull/174)
* [OCPBUGS-30620](https://issues.redhat.com/browse/OCPBUGS-30620): move test manifests to top-level directory [#194](https://github.com/openshift/csi-operator/pull/194)
* [STOR-1464](https://issues.redhat.com/browse/STOR-1464): Enable RWOP tests in CI [#187](https://github.com/openshift/csi-operator/pull/187)
* [STOR-1762](https://issues.redhat.com/browse/STOR-1762): Add azure file hypershift [#163](https://github.com/openshift/csi-operator/pull/163)
* Bump the k8s-dependencies group with 6 updates [#172](https://github.com/openshift/csi-operator/pull/172)
* [STOR-1726](https://issues.redhat.com/browse/STOR-1726): Bump `openshift/api` dependency [#169](https://github.com/openshift/csi-operator/pull/169)
* [STOR-1750](https://issues.redhat.com/browse/STOR-1750): Build image from legacy folder [#162](https://github.com/openshift/csi-operator/pull/162)
* Bump the opentelemetry-dependencies group with 8 updates [#161](https://github.com/openshift/csi-operator/pull/161)
* [STOR-1574](https://issues.redhat.com/browse/STOR-1574): Bump all deps [#156](https://github.com/openshift/csi-operator/pull/156)
* [OCPBUGS-26924](https://issues.redhat.com/browse/OCPBUGS-26924): Add healthcheck for node-driver-registrar container [#155](https://github.com/openshift/csi-operator/pull/155)
* Bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.19.0 to 2.19.1 [#149](https://github.com/openshift/csi-operator/pull/149)
* [STOR-1750](https://issues.redhat.com/browse/STOR-1750): Add legacy azure file driver [#154](https://github.com/openshift/csi-operator/pull/154)
* Bump go.etcd.io/etcd/client/v3 from 3.5.11 to 3.5.12 [#150](https://github.com/openshift/csi-operator/pull/150)
* Bump github.com/evanphx/json-patch from 5.8.1+incompatible to 5.9.0+incompatible [#148](https://github.com/openshift/csi-operator/pull/148)
* Bump github.com/go-openapi/swag from 0.22.8 to 0.22.9 [#147](https://github.com/openshift/csi-operator/pull/147)
* Bump github.com/google/uuid from 1.5.0 to 1.6.0 [#144](https://github.com/openshift/csi-operator/pull/144)
* Bump google.golang.org/grpc from 1.60.1 to 1.61.0 [#145](https://github.com/openshift/csi-operator/pull/145)
* Bump the k8s-dependencies group with 3 updates [#146](https://github.com/openshift/csi-operator/pull/146)
* [STOR-1574](https://issues.redhat.com/browse/STOR-1574): Bump library-go [#137](https://github.com/openshift/csi-operator/pull/137)
* Bump github.com/go-openapi/swag from 0.22.7 to 0.22.8 [#142](https://github.com/openshift/csi-operator/pull/142)
* Bump github.com/pkg/profile from 1.3.0 to 1.7.0 [#138](https://github.com/openshift/csi-operator/pull/138)
* Bump github.com/emicklei/go-restful/v3 from 3.11.0 to 3.11.2 [#141](https://github.com/openshift/csi-operator/pull/141)
* Bump go.uber.org/zap from 1.24.0 to 1.26.0 [#139](https://github.com/openshift/csi-operator/pull/139)
* Bump github.com/go-openapi/jsonreference from 0.20.2 to 0.20.4 [#140](https://github.com/openshift/csi-operator/pull/140)
* Bump github.com/go-openapi/swag from 0.22.4 to 0.22.7 [#136](https://github.com/openshift/csi-operator/pull/136)
* Bump github.com/prometheus/common from 0.45.0 to 0.46.0 [#135](https://github.com/openshift/csi-operator/pull/135)
* Bump the opentelemetry-dependencies group with 4 updates [#134](https://github.com/openshift/csi-operator/pull/134)
* Bump github.com/go-openapi/jsonpointer from 0.19.6 to 0.20.2 [#128](https://github.com/openshift/csi-operator/pull/128)
* Bump github.com/evanphx/json-patch from 5.6.0+incompatible to 5.8.1+incompatible [#125](https://github.com/openshift/csi-operator/pull/125)
* Bump the k8s-dependencies group with 5 updates [#133](https://github.com/openshift/csi-operator/pull/133)
* Bump go.etcd.io/etcd/client/v3 from 3.5.9 to 3.5.11 [#124](https://github.com/openshift/csi-operator/pull/124)
* [STOR-1722](https://issues.redhat.com/browse/STOR-1722): Add support hypershift for azure-disk [#73](https://github.com/openshift/csi-operator/pull/73)
* Bump github.com/go-logr/logr from 1.3.0 to 1.4.1 [#129](https://github.com/openshift/csi-operator/pull/129)
* [OCPBUGS-27267](https://issues.redhat.com/browse/OCPBUGS-27267): Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.16 [#132](https://github.com/openshift/csi-operator/pull/132)
* Bump the opentelemetry-dependencies group with 2 updates [#122](https://github.com/openshift/csi-operator/pull/122)
* Bump github.com/sirupsen/logrus from 1.9.0 to 1.9.3 [#123](https://github.com/openshift/csi-operator/pull/123)
* Bump go.etcd.io/etcd/client/pkg/v3 from 3.5.9 to 3.5.11 [#119](https://github.com/openshift/csi-operator/pull/119)
* Bump github.com/fsnotify/fsnotify from 1.6.0 to 1.7.0 [#120](https://github.com/openshift/csi-operator/pull/120)
* NO-JIRA: Bump github.com/go-errors/errors from 1.4.2 to 1.5.1 [#106](https://github.com/openshift/csi-operator/pull/106)
* NO-JIRA: Bump google.golang.org/grpc from 1.59.0 to 1.60.1 [#104](https://github.com/openshift/csi-operator/pull/104)
* NO-JIRA: Bump github.com/spf13/cobra from 1.7.0 to 1.8.0 [#103](https://github.com/openshift/csi-operator/pull/103)
* NO-JIRA: Bump github.com/google/uuid from 1.3.1 to 1.5.0 [#101](https://github.com/openshift/csi-operator/pull/101)
* [OCPBUGS-27056](https://issues.redhat.com/browse/OCPBUGS-27056): Update to RHEL9 and go 1.21 [#117](https://github.com/openshift/csi-operator/pull/117)
* NO-JIRA: Bump the golang-dependencies group with 5 updates [#109](https://github.com/openshift/csi-operator/pull/109)
* NO-JIRA: Bump github.com/prometheus/client_golang from 1.17.0 to 1.18.0 [#108](https://github.com/openshift/csi-operator/pull/108)
* [STOR-1714](https://issues.redhat.com/browse/STOR-1714): AWS EBS operator: Release leadership on SIGTERM [#94](https://github.com/openshift/csi-operator/pull/94)
* NO-JIRA: Bump google.golang.org/protobuf from 1.31.0 to 1.32.0 [#107](https://github.com/openshift/csi-operator/pull/107)
* NO-JIRA: Add valid-reference label to dependabot PRs [#116](https://github.com/openshift/csi-operator/pull/116)
* [OCPBUGS-27050](https://issues.redhat.com/browse/OCPBUGS-27050): Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.16 [#114](https://github.com/openshift/csi-operator/pull/114)
* [STOR-1713](https://issues.redhat.com/browse/STOR-1713): Don't ignore azure-disk-csi-driver-operator [#110](https://github.com/openshift/csi-operator/pull/110)
* NO-JIRA: Add dependabot configuration [#97](https://github.com/openshift/csi-operator/pull/97)
* [STOR-1696](https://issues.redhat.com/browse/STOR-1696): Add legacy azure disk [#88](https://github.com/openshift/csi-operator/pull/88)
* [OCPBUGS-24245](https://issues.redhat.com/browse/OCPBUGS-24245): Add selinux [#89](https://github.com/openshift/csi-operator/pull/89)
* [OCPBUGS-25125](https://issues.redhat.com/browse/OCPBUGS-25125): Add test AssetOrderer [#86](https://github.com/openshift/csi-operator/pull/86)
* [OCPBUGS-25557](https://issues.redhat.com/browse/OCPBUGS-25557): Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART [#87](https://github.com/openshift/csi-operator/pull/87)
* [OCPBUGS-25125](https://issues.redhat.com/browse/OCPBUGS-25125): Create RBAC objects first [#84](https://github.com/openshift/csi-operator/pull/84)
* [OCPBUGS-24226](https://issues.redhat.com/browse/OCPBUGS-24226): setting TLSSecurityProfile with no minTLSVersion crashes controller [#76](https://github.com/openshift/csi-operator/pull/76)
* NO-JIRA: Add "Quick start" section to `README.md` [#80](https://github.com/openshift/csi-operator/pull/80)
* [STOR-1688](https://issues.redhat.com/browse/STOR-1688): Chore: add .snyk file to ignore false positives [#85](https://github.com/openshift/csi-operator/pull/85)
* [OCPBUGS-25147](https://issues.redhat.com/browse/OCPBUGS-25147): Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART [#81](https://github.com/openshift/csi-operator/pull/81)
* [OCPBUGS-23827](https://issues.redhat.com/browse/OCPBUGS-23827): CVE-2023-47108: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.46 [#77](https://github.com/openshift/csi-operator/pull/77)
* [OCPBUGS-23306](https://issues.redhat.com/browse/OCPBUGS-23306): Add annotation to CSI driver Pod preventing eviction from the cluster-autoscaler [#79](https://github.com/openshift/csi-operator/pull/79)
* [OCPBUGS-24905](https://issues.redhat.com/browse/OCPBUGS-24905): Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART [#78](https://github.com/openshift/csi-operator/pull/78)
* [STOR-1500](https://issues.redhat.com/browse/STOR-1500): Switch to the new operator [#69](https://github.com/openshift/csi-operator/pull/69)
* Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART [#75](https://github.com/openshift/csi-operator/pull/75)
* [STOR-1402](https://issues.redhat.com/browse/STOR-1402), [STOR-1453](https://issues.redhat.com/browse/STOR-1453): update libraries and specify TLS_MIN_VERSION [#71](https://github.com/openshift/csi-operator/pull/71)
* [STOR-1400](https://issues.redhat.com/browse/STOR-1400): Add support for Batch DescribeVolume [#74](https://github.com/openshift/csi-operator/pull/74)
* [STOR-1400](https://issues.redhat.com/browse/STOR-1400): Sync sidecar arguments with upstream [#72](https://github.com/openshift/csi-operator/pull/72)
* [STOR-1500](https://issues.redhat.com/browse/STOR-1500): Add log for the new operator [#70](https://github.com/openshift/csi-operator/pull/70)
* Pull the latest AWS EBS operator [#67](https://github.com/openshift/csi-operator/pull/67)
* Fix vendoring of golang.org/x/net [#68](https://github.com/openshift/csi-operator/pull/68)
* hack: remove existing path from .gitignore [#65](https://github.com/openshift/csi-operator/pull/65)
* Drop Guest prefix from client names [#64](https://github.com/openshift/csi-operator/pull/64)
* Update all generated assets in a single run [#63](https://github.com/openshift/csi-operator/pull/63)
* Verify generated assets in `make verify` [#62](https://github.com/openshift/csi-operator/pull/62)
* Move operator config into pkg/drivers [#61](https://github.com/openshift/csi-operator/pull/61)
* Add AWS EBS CSI driver operator starter [#58](https://github.com/openshift/csi-operator/pull/58)
* [OCPBUGS-21593](https://issues.redhat.com/browse/OCPBUGS-21593): CVE-2023-44487: bump golang.org/x/net to v0.17.0 [#59](https://github.com/openshift/csi-operator/pull/59)
* [STOR-1455](https://issues.redhat.com/browse/STOR-1455): Add asset generator [#53](https://github.com/openshift/csi-operator/pull/53)
* Delegate to aws-ebs-csi-driver-operator for tests and verify [#57](https://github.com/openshift/csi-operator/pull/57)
* Add aws ebs operator legacy [#56](https://github.com/openshift/csi-operator/pull/56)
* Add ci-operator config [#54](https://github.com/openshift/csi-operator/pull/54)
* Clean the repository, it will be reused for all CSI driver operators [#52](https://github.com/openshift/csi-operator/pull/52)
* Obsolete the operator [#51](https://github.com/openshift/csi-operator/pull/51)
* Fix hostpath image sample to support dynamic registration [#47](https://github.com/openshift/csi-operator/pull/47)
* Add kubelet-registration-path flag to csi-driver-registrar [#44](https://github.com/openshift/csi-operator/pull/44)
* Fix golint error [#45](https://github.com/openshift/csi-operator/pull/45)
* Output error message when failed to get CSIDriverDeployment and requeued [#46](https://github.com/openshift/csi-operator/pull/46)
* Add -nometadata to go-bindata to stop updating generated files by every build [#43](https://github.com/openshift/csi-operator/pull/43)
* Disable automatic installation of the operator in OpenShift [#41](https://github.com/openshift/csi-operator/pull/41)
* Pass SecurityContext to sidecar containers [#40](https://github.com/openshift/csi-operator/pull/40)
* Move EBS deployment sample to the right place [#39](https://github.com/openshift/csi-operator/pull/39)
* Use correct context timeouts [#38](https://github.com/openshift/csi-operator/pull/38)
* Add EBS sample deployment file [#37](https://github.com/openshift/csi-operator/pull/37)
* Add leader election to the operator [#36](https://github.com/openshift/csi-operator/pull/36)
* Embed git version into the operator binary [#35](https://github.com/openshift/csi-operator/pull/35)
* Generate bindata during build [#34](https://github.com/openshift/csi-operator/pull/34)
* Add more unit tests [#33](https://github.com/openshift/csi-operator/pull/33)
* Add controller unit tests [#32](https://github.com/openshift/csi-operator/pull/32)
* Fix deletion of non-namespaced objects [#31](https://github.com/openshift/csi-operator/pull/31)
* Fix e2e test [#30](https://github.com/openshift/csi-operator/pull/30)
* Add e2e test [#29](https://github.com/openshift/csi-operator/pull/29)
* Update to operator-sdk 0.1.1 [#28](https://github.com/openshift/csi-operator/pull/28)
* Fix liveness probe version [#27](https://github.com/openshift/csi-operator/pull/27)
* ADd a RHEL7 dockerfile and standardize format [#26](https://github.com/openshift/csi-operator/pull/26)
* Documentation update [#23](https://github.com/openshift/csi-operator/pull/23)
* Add unit test for validation [#14](https://github.com/openshift/csi-operator/pull/14)
* Fix status.conditions json name [#11](https://github.com/openshift/csi-operator/pull/11)
* Add CRD printer columns [#12](https://github.com/openshift/csi-operator/pull/12)
* Add configuration of liveness probe. [#9](https://github.com/openshift/csi-operator/pull/9)
* Increase resync period [#10](https://github.com/openshift/csi-operator/pull/10)
* Add /var/lib/kubelet HostPath directory to node drivers [#8](https://github.com/openshift/csi-operator/pull/8)
* Fix role bindings [#7](https://github.com/openshift/csi-operator/pull/7)
* Add liveness probe. [#6](https://github.com/openshift/csi-operator/pull/6)
* Fix operator images [#5](https://github.com/openshift/csi-operator/pull/5)
* Add OpenShift manifests to operator image [#4](https://github.com/openshift/csi-operator/pull/4)
* Use label selector for informers. [#3](https://github.com/openshift/csi-operator/pull/3)
* Use constants where appropriate [#2](https://github.com/openshift/csi-operator/pull/2)
* Add initial operator [#1](https://github.com/openshift/csi-operator/pull/1)
* And 27 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/csi-operator/compare/6b00096f4a84203a69467802b846f215b4e04888...50f79e773ab432a91299a06003191a1fc2535746)
### [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook/tree/a8f16141e4234fa2c9f6aeb8498622af6e4a080d)
* [OCPBUGS-87344](https://issues.redhat.com/browse/OCPBUGS-87344): Updating gcp-workload-identity-federation-webhook-container image to be consistent with ART for 5.0 [#19](https://github.com/openshift/gcp-workload-identity-federation-webhook/pull/19)
* NO-ISSUE: Update OWNERS: remove 2uasimojo, suhanime, lleshchi [#20](https://github.com/openshift/gcp-workload-identity-federation-webhook/pull/20)
* [Full changelog](https://github.com/openshift/gcp-workload-identity-federation-webhook/compare/d7675f312ffdc8501032ff8217776cd7172b6bb0...a8f16141e4234fa2c9f6aeb8498622af6e4a080d)
### [haproxy-router](https://github.com/openshift/router/tree/682319a1bb432f0203951c33336d0f55947e1099)
* NO-JIRA: Add default coderabbit for the repo [#798](https://github.com/openshift/router/pull/798)
* [TRT-2841](https://issues.redhat.com/browse/TRT-2841): Revert "OCPBUGS-77056: Make external cert validation asynchronous (Resurrection)" [#824](https://github.com/openshift/router/pull/824)
* [OCPBUGS-77056](https://issues.redhat.com/browse/OCPBUGS-77056): Make external cert validation asynchronous (Resurrection) [#822](https://github.com/openshift/router/pull/822)
* [NE-2220](https://issues.redhat.com/browse/NE-2220): Update HAProxy RPM in the router container to 3.2.19 [#792](https://github.com/openshift/router/pull/792)
* [NE-2741](https://issues.redhat.com/browse/NE-2741): Implement TLS Curves Support for Metrics Endpoints [#811](https://github.com/openshift/router/pull/811)
* [TRT-2813](https://issues.redhat.com/browse/TRT-2813): Revert "Make external cert validation asynchronous" [#817](https://github.com/openshift/router/pull/817)
* [NE-2766](https://issues.redhat.com/browse/NE-2766): Bump Kubernetes to 1.36.2 and Go to 1.26 [#814](https://github.com/openshift/router/pull/814)
* [OCPBUGS-77056](https://issues.redhat.com/browse/OCPBUGS-77056): Make external cert validation asynchronous [#745](https://github.com/openshift/router/pull/745)
* [OCPBUGS-87204](https://issues.redhat.com/browse/OCPBUGS-87204): Prevent SSRF via FQDN-typed EndpointSlices [#812](https://github.com/openshift/router/pull/812)
* [NE-2218](https://issues.redhat.com/browse/NE-2218): Add HAProxy standalone images for 2.8 and 3.2 [#780](https://github.com/openshift/router/pull/780)
* [OCPBUGS-87552](https://issues.redhat.com/browse/OCPBUGS-87552): Updating openshift-enterprise-haproxy-router-container image to be consistent with ART for 5.0 [#791](https://github.com/openshift/router/pull/791)
* [NE-2664](https://issues.redhat.com/browse/NE-2664): add option to separate router and haproxy containers [#772](https://github.com/openshift/router/pull/772)
* [OCPBUGS-87508](https://issues.redhat.com/browse/OCPBUGS-87508): Updating ose-haproxy-router-base-container image to be consistent with ART for 5.0 [#790](https://github.com/openshift/router/pull/790)
* [OCPBUGS-87205](https://issues.redhat.com/browse/OCPBUGS-87205): Strip X-SSL-Client-* headers for plain HTTP [#787](https://github.com/openshift/router/pull/787)
* [OCPBUGS-87208](https://issues.redhat.com/browse/OCPBUGS-87208): Adding escapeHAProxySingleQuotes for sanitize [#785](https://github.com/openshift/router/pull/785)
* [NE-2572](https://issues.redhat.com/browse/NE-2572): use add/del haproxy api calls [#763](https://github.com/openshift/router/pull/763)
* [OCPBUGS-86168](https://issues.redhat.com/browse/OCPBUGS-86168): Bump google.golang.org/grpc to v1.79.3 [#777](https://github.com/openshift/router/pull/777)
* Reapply "OCPBUGS-55506: Prevent startup failures due to name resolution" [#677](https://github.com/openshift/router/pull/677)
* [OCPBUGS-77263](https://issues.redhat.com/browse/OCPBUGS-77263): create self-signed crt if failing to read default [#740](https://github.com/openshift/router/pull/740)
* [OCPBUGS-62267](https://issues.redhat.com/browse/OCPBUGS-62267): fix forwarded header for IPv6 on IPv4 stack [#713](https://github.com/openshift/router/pull/713)
* [OCPBUGS-49738](https://issues.redhat.com/browse/OCPBUGS-49738): fix handling of host conflict [#736](https://github.com/openshift/router/pull/736)
* [Full changelog](https://github.com/openshift/router/compare/896390778ebe15f57f87e6ca78f11c96e64c2652...682319a1bb432f0203951c33336d0f55947e1099)
### [hyperkube, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/63ee93dac28329fd9d81e91b21ea8d8c43105d01)
* [OCPBUGS-92836](https://issues.redhat.com/browse/OCPBUGS-92836): UPSTREAM: <carry>: upkeep cpu partitioning admission webhook [#2713](https://github.com/openshift/kubernetes/pull/2713)
* [STOR-2963](https://issues.redhat.com/browse/STOR-2963): Save SELinuxWarningController upgradeability to a ConfigMap [#2720](https://github.com/openshift/kubernetes/pull/2720)
* [OCPBUGS-90520](https://issues.redhat.com/browse/OCPBUGS-90520): UPSTREAM: 140211: Promote regression-issue-74839 to 1.5 [#2709](https://github.com/openshift/kubernetes/pull/2709)
* [OCPBUGS-99058](https://issues.redhat.com/browse/OCPBUGS-99058): Disable DRA extended resource test that requires dedicated DRA infrastructure [#2721](https://github.com/openshift/kubernetes/pull/2721)
* [OCPSTRAT-3036](https://issues.redhat.com/browse/OCPSTRAT-3036): Rebase 1.36.2 [#2653](https://github.com/openshift/kubernetes/pull/2653)
* [OCPBUGS-84961](https://issues.redhat.com/browse/OCPBUGS-84961): UPSTREAM: <carry>: fix kubernetes/conformance to filter on [Conformance] label [#2694](https://github.com/openshift/kubernetes/pull/2694)
* [AUTOSCALE-812](https://issues.redhat.com/browse/AUTOSCALE-812): Add NodeSelectorAdjuster admission plugin for standalone clusters [#2695](https://github.com/openshift/kubernetes/pull/2695)
* [OCPBUGS-84961](https://issues.redhat.com/browse/OCPBUGS-84961): add kubernetes/conformance umbrella suite [#2682](https://github.com/openshift/kubernetes/pull/2682)
* [OCPBUGS-85410](https://issues.redhat.com/browse/OCPBUGS-85410): Fix performance related issues when selinux metrics are emitted [#2668](https://github.com/openshift/kubernetes/pull/2668)
* [OCPBUGS-86229](https://issues.redhat.com/browse/OCPBUGS-86229): apiserver: cache etcd storage monitors to avoid recreating clients on each metrics scrape [#2674](https://github.com/openshift/kubernetes/pull/2674)
* [OCPBUGS-74511](https://issues.redhat.com/browse/OCPBUGS-74511): remove RouteExternalCertificate feature gate [#2585](https://github.com/openshift/kubernetes/pull/2585)
* [OCPBUGS-77243](https://issues.redhat.com/browse/OCPBUGS-77243): test: skip private registry test [#2621](https://github.com/openshift/kubernetes/pull/2621)
* [OCPBUGS-78044](https://issues.redhat.com/browse/OCPBUGS-78044): Improve WatchList test robustness [#2622](https://github.com/openshift/kubernetes/pull/2622)
* [CNTRLPLANE-2553](https://issues.redhat.com/browse/CNTRLPLANE-2553): Update the KAS admission plugin for fields to be compilable at admission time [#2627](https://github.com/openshift/kubernetes/pull/2627)
* [OCPBUGS-83502](https://issues.redhat.com/browse/OCPBUGS-83502): devicemanager: constrain topology hints to device NUMA nodes [#2645](https://github.com/openshift/kubernetes/pull/2645)
* [OCPBUGS-78576](https://issues.redhat.com/browse/OCPBUGS-78576): Update the csi-driver-host-path version to 1.17.1 [#2641](https://github.com/openshift/kubernetes/pull/2641)
* [OCPBUGS-81740](https://issues.redhat.com/browse/OCPBUGS-81740): UPSTREAM: 138259: Filter out unschedulable nodes in kubectl describe test [#2640](https://github.com/openshift/kubernetes/pull/2640)
* [Full changelog](https://github.com/openshift/kubernetes/compare/9193b12ab88e006723c8605bea1659bfcbe7d638...63ee93dac28329fd9d81e91b21ea8d8c43105d01)
### [hypershift](https://github.com/openshift/hypershift/tree/872a7e821c3fe01b2f866ceada3749a899e3d64f)
* [CNTRLPLANE-3910](https://issues.redhat.com/browse/CNTRLPLANE-3910): Fix e2e test reliability for mirroring tests and test-changed target [#9086](https://github.com/openshift/hypershift/pull/9086)
* [CNTRLPLANE-3919](https://issues.redhat.com/browse/CNTRLPLANE-3919): data race in TestEnqueueNodePoolsForCloudConfig [#9095](https://github.com/openshift/hypershift/pull/9095)
* NO-JIRA: chore(konflux): update Tekton task bundles to latest versions [#9081](https://github.com/openshift/hypershift/pull/9081)
* [NE-2815](https://issues.redhat.com/browse/NE-2815): feat: configure HAProxy version selection [#9040](https://github.com/openshift/hypershift/pull/9040)
* [CNTRLPLANE-3791](https://issues.redhat.com/browse/CNTRLPLANE-3791): fix: revert api-lint --whole-files to avoid surfacing pre-existing violations [#9071](https://github.com/openshift/hypershift/pull/9071)
* [OCPBUGS-99014](https://issues.redhat.com/browse/OCPBUGS-99014): Authenticate Konnectivity agents with cluster CA [#9031](https://github.com/openshift/hypershift/pull/9031)
* [CNTRLPLANE-3032](https://issues.redhat.com/browse/CNTRLPLANE-3032): test: add e2e v2 tests for NodePool OSImageStream [#9033](https://github.com/openshift/hypershift/pull/9033)
* [OCPBUGS-98744](https://issues.redhat.com/browse/OCPBUGS-98744): compare post-upgrade RHCOS version against pre-upgrade instead of release metadata [#9014](https://github.com/openshift/hypershift/pull/9014)
* [OCPBUGS-98462](https://issues.redhat.com/browse/OCPBUGS-98462): add jitter to AWS endpoint service requeue delay [#8996](https://github.com/openshift/hypershift/pull/8996)
* [OCPBUGS-98465](https://issues.redhat.com/browse/OCPBUGS-98465): prevent DS crash in pull secret verifier and add propagation diagnostics [#8991](https://github.com/openshift/hypershift/pull/8991)
* [OCPBUGS-99289](https://issues.redhat.com/browse/OCPBUGS-99289): Exclude aggregated docs page from search index [#9043](https://github.com/openshift/hypershift/pull/9043)
* [CNTRLPLANE-3199](https://issues.redhat.com/browse/CNTRLPLANE-3199): add etcd backup infrastructure and docs for self-managed Azure [#8785](https://github.com/openshift/hypershift/pull/8785)
* [CNTRLPLANE-3862](https://issues.redhat.com/browse/CNTRLPLANE-3862): fix(ci): reintroduce verify-ci make target for GHA verify workflow [#9045](https://github.com/openshift/hypershift/pull/9045)
* [CNTRLPLANE-3859](https://issues.redhat.com/browse/CNTRLPLANE-3859): Restructure pre-commit push hooks for faster local feedback [#9042](https://github.com/openshift/hypershift/pull/9042)
* [CNTRLPLANE-3434](https://issues.redhat.com/browse/CNTRLPLANE-3434): add ho-release-gate pipeline for nightly promotion [#8602](https://github.com/openshift/hypershift/pull/8602)
* NO-JIRA: fix(cpo): regenerate stale ModernTLS test fixtures [#9041](https://github.com/openshift/hypershift/pull/9041)
* [CNTRLPLANE-647](https://issues.redhat.com/browse/CNTRLPLANE-647): Expose v4/v6InternalSubnet OVN-Kubernetes configuration in HostedCluster API [#8249](https://github.com/openshift/hypershift/pull/8249)
* [ARO-27360](https://issues.redhat.com/browse/ARO-27360): Add ACR pull identity configured metric [#8840](https://github.com/openshift/hypershift/pull/8840)
* [ARO-24037](https://issues.redhat.com/browse/ARO-24037): gate cloud config on hash to prevent serving stale content [#8946](https://github.com/openshift/hypershift/pull/8946)
* [CNTRLPLANE-3615](https://issues.redhat.com/browse/CNTRLPLANE-3615): add tls security profile configuration for the etcd [#8871](https://github.com/openshift/hypershift/pull/8871)
* [OCPBUGS-88312](https://issues.redhat.com/browse/OCPBUGS-88312): use in-cluster service for oauth-server [#8772](https://github.com/openshift/hypershift/pull/8772)
* [CNTRLPLANE-3791](https://issues.redhat.com/browse/CNTRLPLANE-3791): make pre-commit hooks resilient to mock generation failures [#9016](https://github.com/openshift/hypershift/pull/9016)
* NO-JIRA: update Tekton task bundles to latest versions [#9038](https://github.com/openshift/hypershift/pull/9038)
* [OCPBUGS-98384](https://issues.redhat.com/browse/OCPBUGS-98384): fix bastion cleanup KeyPair leak by capturing infraID/region eagerly [#8982](https://github.com/openshift/hypershift/pull/8982)
* [CNTRLPLANE-3674](https://issues.redhat.com/browse/CNTRLPLANE-3674): Add Jira Agent onboarding guide [#8814](https://github.com/openshift/hypershift/pull/8814)
* [CNTRLPLANE-3825](https://issues.redhat.com/browse/CNTRLPLANE-3825): move test conventions to TESTING.md [#9036](https://github.com/openshift/hypershift/pull/9036)
* [OCPSTRAT-3150](https://issues.redhat.com/browse/OCPSTRAT-3150): Add etcd sharding by resource kind support [#8705](https://github.com/openshift/hypershift/pull/8705)
* [OCPBUGS-98695](https://issues.redhat.com/browse/OCPBUGS-98695): add Azure CPO overrides for 4.22 [#9010](https://github.com/openshift/hypershift/pull/9010)
* NO-JIRA: ci(deps): bump actions/setup-node from 6.4.0 to 7.0.0 [#9030](https://github.com/openshift/hypershift/pull/9030)
* [CNTRLPLANE-3763](https://issues.redhat.com/browse/CNTRLPLANE-3763): tag bastion resources with e2e provenance [#9022](https://github.com/openshift/hypershift/pull/9022)
* [OCPBUGS-98575](https://issues.redhat.com/browse/OCPBUGS-98575): feat: inject hosted cluster TLS security profile into packageserver [#9001](https://github.com/openshift/hypershift/pull/9001)
* [AUTOSCALE-870](https://issues.redhat.com/browse/AUTOSCALE-870): add KarpenterOperator tech-preview FeatureGate [#8976](https://github.com/openshift/hypershift/pull/8976)
* [CNTRLPLANE-3774](https://issues.redhat.com/browse/CNTRLPLANE-3774): fix: control-plane-operator: improve opaque conditions [#8804](https://github.com/openshift/hypershift/pull/8804)
* [CNTRLPLANE-3695](https://issues.redhat.com/browse/CNTRLPLANE-3695): refactor(hcco): extract machine-config-daemon pod name format to constant [#8988](https://github.com/openshift/hypershift/pull/8988)
* [CNTRLPLANE-3820](https://issues.redhat.com/browse/CNTRLPLANE-3820): add cleanleaked tool for AWS leaked resource cleanup [#8964](https://github.com/openshift/hypershift/pull/8964)
* [SPLAT-2743](https://issues.redhat.com/browse/SPLAT-2743): aws/ccm - remove inline iam policy patch [#8835](https://github.com/openshift/hypershift/pull/8835)
* NO-JIRA: Add validateOnUpdateTableInput to envtest and fix test specs [#9015](https://github.com/openshift/hypershift/pull/9015)
* [OCPBUGS-98461](https://issues.redhat.com/browse/OCPBUGS-98461): requeue CRR on transiently unavailable resources [#8997](https://github.com/openshift/hypershift/pull/8997)
* [OCPBUGS-98718](https://issues.redhat.com/browse/OCPBUGS-98718): retry CreateVpcEndpoint on AWS throttle errors [#9012](https://github.com/openshift/hypershift/pull/9012)
* [CNTRLPLANE-3030](https://issues.redhat.com/browse/CNTRLPLANE-3030): feat(nodepool,ignition-server): consume os-stream and add ValidOSImageStream condition [#8792](https://github.com/openshift/hypershift/pull/8792)
* [OCPBUGS-88738](https://issues.redhat.com/browse/OCPBUGS-88738): clean up orphaned mirrored ConfigMaps on NodePool deletion [#8890](https://github.com/openshift/hypershift/pull/8890)
* [OCPBUGS-97830](https://issues.redhat.com/browse/OCPBUGS-97830): Add wait-for-etcd init container to oauth-apiserver [#8940](https://github.com/openshift/hypershift/pull/8940)
* fix(ci): make race detection opt-out for pre-push hook [#9003](https://github.com/openshift/hypershift/pull/9003)
* [CNTRLPLANE-3763](https://issues.redhat.com/browse/CNTRLPLANE-3763): tag CLI and e2e AWS resources with infra-id, cluster-name, and source [#8909](https://github.com/openshift/hypershift/pull/8909)
* [OCPBUGS-93462](https://issues.redhat.com/browse/OCPBUGS-93462): Fix stale resourceVersion in HCCO patchHCPStatusCondition [#8902](https://github.com/openshift/hypershift/pull/8902)
* [OCPBUGS-98466](https://issues.redhat.com/browse/OCPBUGS-98466): retry Prometheus query exec on transient konnectivity 502 [#8995](https://github.com/openshift/hypershift/pull/8995)
* [OCPBUGS-98464](https://issues.redhat.com/browse/OCPBUGS-98464): handle stale DaemonSet in GlobalPullSecret test [#8990](https://github.com/openshift/hypershift/pull/8990)
* [SPLAT-2741](https://issues.redhat.com/browse/SPLAT-2741): Add SetSecurityGroups perms for AWS CCM for BYO SG on AWS NLB [#8401](https://github.com/openshift/hypershift/pull/8401)
* [OCPBUGS-98571](https://issues.redhat.com/browse/OCPBUGS-98571): Skip Azure topology LB scope override for ARO HCP IngressController [#8992](https://github.com/openshift/hypershift/pull/8992)
* [CNTRLPLANE-3553](https://issues.redhat.com/browse/CNTRLPLANE-3553): Wire usesRunc detection into RHEL stream resolution [#8832](https://github.com/openshift/hypershift/pull/8832)
* [OCPBUGS-88531](https://issues.redhat.com/browse/OCPBUGS-88531): Remove CPO-side restart logic for CNO operands [#8751](https://github.com/openshift/hypershift/pull/8751)
* [CNTRLPLANE-3831](https://issues.redhat.com/browse/CNTRLPLANE-3831): skip UpstreamParity OIDC tests on releases before 4.23 [#8987](https://github.com/openshift/hypershift/pull/8987)
* [OCPBUGS-98086](https://issues.redhat.com/browse/OCPBUGS-98086): fix(cpo,hcco): prevent premature KAS convergence during KMS key rotation [#8970](https://github.com/openshift/hypershift/pull/8970)
* [OCPBUGS-78310](https://issues.redhat.com/browse/OCPBUGS-78310): fix(cli): initialize controller-runtime logger in product-cli [#8955](https://github.com/openshift/hypershift/pull/8955)
* [OCPBUGS-63720](https://issues.redhat.com/browse/OCPBUGS-63720): orphan machines when managed identity is invalid on clus… [#8296](https://github.com/openshift/hypershift/pull/8296)
* [OCPBUGS-98387](https://issues.redhat.com/browse/OCPBUGS-98387): Add retry logic to fix Azure self-managed e2e presubmit failures [#8983](https://github.com/openshift/hypershift/pull/8983)
* [OCPBUGS-93785](https://issues.redhat.com/browse/OCPBUGS-93785): fix(cpo): initialize nil resource requests map before applying overrides [#8924](https://github.com/openshift/hypershift/pull/8924)
* [OCPBUGS-91650](https://issues.redhat.com/browse/OCPBUGS-91650): disable consolidation in karpenter upgrade test [#8874](https://github.com/openshift/hypershift/pull/8874)
* [CNTRLPLANE-3553](https://issues.redhat.com/browse/CNTRLPLANE-3553): Wire osImageStream into NodePool controller (hash, token, status, validation) [#8730](https://github.com/openshift/hypershift/pull/8730)
* NO-JIRA: chore: Resolve git SHA for PULL_BASE_SHA in makefile [#8980](https://github.com/openshift/hypershift/pull/8980)
* [OCPBUGS-95615](https://issues.redhat.com/browse/OCPBUGS-95615): fix(kubevirt): use only first MachineInternalIP per family in EndpointSlice endpoints [#8892](https://github.com/openshift/hypershift/pull/8892)
* [CNTRLPLANE-3824](https://issues.redhat.com/browse/CNTRLPLANE-3824): Fix verify-crd-schema in git worktrees [#8975](https://github.com/openshift/hypershift/pull/8975)
* [GCP-859](https://issues.redhat.com/browse/GCP-859): scope PSC NAT subnet discovery to the management cluster VPC [#8927](https://github.com/openshift/hypershift/pull/8927)
* [CNTRLPLANE-3761](https://issues.redhat.com/browse/CNTRLPLANE-3761): replace git clean with find for mock cleanup [#8973](https://github.com/openshift/hypershift/pull/8973)
* NO-JIRA: chore: update core-reviewers membership [#8967](https://github.com/openshift/hypershift/pull/8967)
* [OTA-1764](https://issues.redhat.com/browse/OTA-1764): feat(cvo): add TLS cipher suites and minimum version flags [#8013](https://github.com/openshift/hypershift/pull/8013)
* [AROSLSRE-1158](https://issues.redhat.com/browse/AROSLSRE-1158): add --install-scope flag to hypershift install [#8725](https://github.com/openshift/hypershift/pull/8725)
* NO-JIRA: chore(deps): weekly dependabot consolidation [#8849](https://github.com/openshift/hypershift/pull/8849)
* [CNTRLPLANE-3616](https://issues.redhat.com/browse/CNTRLPLANE-3616): setting min-tls-version for the konnectivity-server container [#8866](https://github.com/openshift/hypershift/pull/8866)
* [CNTRLPLANE-3766](https://issues.redhat.com/browse/CNTRLPLANE-3766): add chai-bot CI daily health report instructions [#8918](https://github.com/openshift/hypershift/pull/8918)
* NO-JIRA: Remove address-review-comments GHA workflow [#8943](https://github.com/openshift/hypershift/pull/8943)
* [CNTRLPLANE-3698](https://issues.redhat.com/browse/CNTRLPLANE-3698): fix(install): replace context.TODO() with proper ctx parameter [#8932](https://github.com/openshift/hypershift/pull/8932)
* [CNTRLPLANE-3771](https://issues.redhat.com/browse/CNTRLPLANE-3771): fix /rebase GHA workflow for fork PRs [#8934](https://github.com/openshift/hypershift/pull/8934)
* NO-JIRA: chore: update github actions runner image to go 1.26.4 [#8888](https://github.com/openshift/hypershift/pull/8888)
* [AROSLSRE-830](https://issues.redhat.com/browse/AROSLSRE-830): Add etcd EndpointSlice self-registration to fix DNS resolution delays [#8613](https://github.com/openshift/hypershift/pull/8613)
* [OCPBUGS-92086](https://issues.redhat.com/browse/OCPBUGS-92086): GetVnetID is empty when running setup_all.sh in Managed AKS [#8830](https://github.com/openshift/hypershift/pull/8830)
* [OCPBUGS-84269](https://issues.redhat.com/browse/OCPBUGS-84269): fix(nodepool): skip CNI-internal IPs in ClusterNetworkCIDRConflict check [#8230](https://github.com/openshift/hypershift/pull/8230)
* [CNTRLPLANE-3619](https://issues.redhat.com/browse/CNTRLPLANE-3619): add azure CPO overrides for 4.22.0-4.22.3 [#8908](https://github.com/openshift/hypershift/pull/8908)
* [CNTRLPLANE-3696](https://issues.redhat.com/browse/CNTRLPLANE-3696): Remove stale TODO about ImagePullPolicy in DNS operator [#8923](https://github.com/openshift/hypershift/pull/8923)
* NO-JIRA: Fall back to AWS SDK default credential chain when no explicit credentials provided [#8889](https://github.com/openshift/hypershift/pull/8889)
* [CNTRLPLANE-3697](https://issues.redhat.com/browse/CNTRLPLANE-3697): Expand unit test coverage for KAS config params [#8922](https://github.com/openshift/hypershift/pull/8922)
* [CNTRLPLANE-3306](https://issues.redhat.com/browse/CNTRLPLANE-3306): add ExternalOIDCWithUpstreamParity e2e tests [#8287](https://github.com/openshift/hypershift/pull/8287)
* [CNTRLPLANE-3624](https://issues.redhat.com/browse/CNTRLPLANE-3624): e2e v2 test for control-plane-pki-operator TLS configuration [#8793](https://github.com/openshift/hypershift/pull/8793)
* [OCPBUGS-94238](https://issues.redhat.com/browse/OCPBUGS-94238): Add missing CLI IAM role policy entry [#8883](https://github.com/openshift/hypershift/pull/8883)
* NO-JIRA: Add missing verify targets to GitHub Actions workflow [#8870](https://github.com/openshift/hypershift/pull/8870)
* NO-JIRA: fix(e2e-v2): gate ConfigOperatorReconciliationSucceeded on 4.23+ [#8875](https://github.com/openshift/hypershift/pull/8875)
* [CNTRLPLANE-3532](https://issues.redhat.com/browse/CNTRLPLANE-3532): Add shared status patching helpers with optimistic locking [#8782](https://github.com/openshift/hypershift/pull/8782)
* [OCPBUGS-94178](https://issues.redhat.com/browse/OCPBUGS-94178): Remove --skip-crd-migration-phases flags from CAPI deployment [#8881](https://github.com/openshift/hypershift/pull/8881)
* NO-JIRA: add Konflux CI scripts reference and document validate-pr-override-images [#8852](https://github.com/openshift/hypershift/pull/8852)
* [CNTRLPLANE-3529](https://issues.redhat.com/browse/CNTRLPLANE-3529): Add operator IAM role creation command and install role ARN flags [#8636](https://github.com/openshift/hypershift/pull/8636)
* [CNTRLPLANE-3737](https://issues.redhat.com/browse/CNTRLPLANE-3737): Add find-push-pipelinerun script [#8851](https://github.com/openshift/hypershift/pull/8851)
* [GCP-841](https://issues.redhat.com/browse/GCP-841): remove ClusterResourceSet feature gate from CAPG manager args [#8795](https://github.com/openshift/hypershift/pull/8795)
* [GCP-866](https://issues.redhat.com/browse/GCP-866): chore(owners): add floresroger to gcp-reviewers [#8863](https://github.com/openshift/hypershift/pull/8863)
* [CNTRLPLANE-3733](https://issues.redhat.com/browse/CNTRLPLANE-3733): add --blog flag to /pr-report skill [#8848](https://github.com/openshift/hypershift/pull/8848)
* [CNTRLPLANE-3577](https://issues.redhat.com/browse/CNTRLPLANE-3577): test(nodepool): add NodeDrainTimeout propagation tests [#8737](https://github.com/openshift/hypershift/pull/8737)
* [CNTRLPLANE-3576](https://issues.redhat.com/browse/CNTRLPLANE-3576): add RestartDateAnnotation propagation tests [#8733](https://github.com/openshift/hypershift/pull/8733)
* [CNTRLPLANE-3565](https://issues.redhat.com/browse/CNTRLPLANE-3565): test and fix destroy grace period lifecycle [#8789](https://github.com/openshift/hypershift/pull/8789)
* [OTA-1956](https://issues.redhat.com/browse/OTA-1956): Skip ConsolePlugin manifests during CVO bootstrap [#8839](https://github.com/openshift/hypershift/pull/8839)
* [OCPBUGS-92791](https://issues.redhat.com/browse/OCPBUGS-92791): fix(configrefs): exclude componentRoutes secrets from management cluster sync [#8838](https://github.com/openshift/hypershift/pull/8838)
* [CNTRLPLANE-3624](https://issues.redhat.com/browse/CNTRLPLANE-3624): add tls security profile configuration for the control-plane-pki-operator [#8768](https://github.com/openshift/hypershift/pull/8768)
* [CNTRLPLANE-3686](https://issues.redhat.com/browse/CNTRLPLANE-3686): feat(api,cpo): add observedGeneration to ControlPlaneComponentStatus [#8819](https://github.com/openshift/hypershift/pull/8819)
* [OCPBUGS-86025](https://issues.redhat.com/browse/OCPBUGS-86025): Close HTTP response bodies to prevent goroutine and connection leaks [#8560](https://github.com/openshift/hypershift/pull/8560)
* [OCPBUGS-92206](https://issues.redhat.com/browse/OCPBUGS-92206): bump catalog image version cap from 4.21 to 4.22 [#8836](https://github.com/openshift/hypershift/pull/8836)
* [OCPBUGS-86648](https://issues.redhat.com/browse/OCPBUGS-86648): move IP addresses from dnsNames to ips in etcd peer cert [#8847](https://github.com/openshift/hypershift/pull/8847)
* NO-JIRA: docs: add required pod-security annotation for GCP hosted clusters [#8850](https://github.com/openshift/hypershift/pull/8850)
* [CNTRLPLANE-3716](https://issues.redhat.com/browse/CNTRLPLANE-3716): Update GitHub Actions docs with slash-command workflows [#8822](https://github.com/openshift/hypershift/pull/8822)
* [OSDOCS-19432](https://issues.redhat.com/browse/OSDOCS-19432): docs: add cluster capabilities how-to and contributor guide [#8371](https://github.com/openshift/hypershift/pull/8371)
* [OCPBUGS-76530](https://issues.redhat.com/browse/OCPBUGS-76530): Fix intermittent etcd peer communication failures [#8479](https://github.com/openshift/hypershift/pull/8479)
* [OCPBUGS-81312](https://issues.redhat.com/browse/OCPBUGS-81312): fix(cpo): use KubeAPIServerDNSName for OAuth LoginURL when set [#8433](https://github.com/openshift/hypershift/pull/8433)
* [OCPBUGS-84114](https://issues.redhat.com/browse/OCPBUGS-84114), [OSASINFRA-4368](https://issues.redhat.com/browse/OSASINFRA-4368): Update CAPO to latest stable release [#8687](https://github.com/openshift/hypershift/pull/8687)
* [CNTRLPLANE-597](https://issues.redhat.com/browse/CNTRLPLANE-597): Surface HCCO reconciliation failures in HostedCluster status [#8340](https://github.com/openshift/hypershift/pull/8340)
* [OCPBUGS-92013](https://issues.redhat.com/browse/OCPBUGS-92013): fix NodePool stuck in UpdatingVersion/UpdatingConfig due to stale conversion-data annotation [#8821](https://github.com/openshift/hypershift/pull/8821)
* [CNTRLPLANE-3526](https://issues.redhat.com/browse/CNTRLPLANE-3526): Add spec.monitoring API for metrics forwarding [#8626](https://github.com/openshift/hypershift/pull/8626)
* NO-JIRA: add blog section with June 2026 progress report [#8816](https://github.com/openshift/hypershift/pull/8816)
* [OCPBUGS-91656](https://issues.redhat.com/browse/OCPBUGS-91656): fix(test): add retry logic to GetLogs in Karpenter kubelet propagatio… [#8805](https://github.com/openshift/hypershift/pull/8805)
* [OCPBUGS-86415](https://issues.redhat.com/browse/OCPBUGS-86415): Use canonical image for kube-apiserver-proxy static pod [#8742](https://github.com/openshift/hypershift/pull/8742)
* [OCPBUGS-92034](https://issues.redhat.com/browse/OCPBUGS-92034): fix registry override matching for digest and tag separators [#8824](https://github.com/openshift/hypershift/pull/8824)
* [OCPBUGS-91997](https://issues.redhat.com/browse/OCPBUGS-91997): Apply MetricsSet relabel configs to KAS ServiceMonitor [#8715](https://github.com/openshift/hypershift/pull/8715)
* [OCPBUGS-91650](https://issues.redhat.com/browse/OCPBUGS-91650): bump consolidateAfter to 60s in karpenter e2e base NodePool [#8820](https://github.com/openshift/hypershift/pull/8820)
* [CNTRLPLANE-596](https://issues.redhat.com/browse/CNTRLPLANE-596): Add --kubeconfig flag to HyperShift and HCP CLI [#8402](https://github.com/openshift/hypershift/pull/8402)
* NO-JIRA: Exclude generated delegating client from codecov [#8825](https://github.com/openshift/hypershift/pull/8825)
* [CNTRLPLANE-3276](https://issues.redhat.com/browse/CNTRLPLANE-3276): Add Azure ExternalPrivateService and endpoint access transition test [#8718](https://github.com/openshift/hypershift/pull/8718)
* [OCPBUGS-57453](https://issues.redhat.com/browse/OCPBUGS-57453): fix(cpo): use Status.DNSZoneID before querying AWS Route53 [#8615](https://github.com/openshift/hypershift/pull/8615)
* [CNTRLPLANE-2916](https://issues.redhat.com/browse/CNTRLPLANE-2916): restore conditional deletion of openshift-ingress NetworkPolicy [#8754](https://github.com/openshift/hypershift/pull/8754)
* [CNTRLPLANE-3352](https://issues.redhat.com/browse/CNTRLPLANE-3352): fix GHA reusable workflow for fork PRs [#8818](https://github.com/openshift/hypershift/pull/8818)
* [CNTRLPLANE-502](https://issues.redhat.com/browse/CNTRLPLANE-502): Add CRD breaking changes validation to HyperShift CI [#8535](https://github.com/openshift/hypershift/pull/8535)
* NO-JIRA: chore(deps): weekly dependabot consolidation [#8784](https://github.com/openshift/hypershift/pull/8784)
* [CNTRLPLANE-3352](https://issues.redhat.com/browse/CNTRLPLANE-3352): force HTTPS for GHA plugin dependency clones [#8815](https://github.com/openshift/hypershift/pull/8815)
* [OCPBUGS-90663](https://issues.redhat.com/browse/OCPBUGS-90663): fix(test): use Eventually for auth-config ConfigMap assertions [#8799](https://github.com/openshift/hypershift/pull/8799)
* NO-JIRA: docs: Add private topology DNS architecture documentation [#8803](https://github.com/openshift/hypershift/pull/8803)
* [CNTRLPLANE-3145](https://issues.redhat.com/browse/CNTRLPLANE-3145): refactor(hostedcluster): segregate reconcile loop into error-collecting blocks [#7908](https://github.com/openshift/hypershift/pull/7908)
* [OCPBUGS-86949](https://issues.redhat.com/browse/OCPBUGS-86949): Guard HCCO KubeletConfig CM deletion against transient source absence [#8672](https://github.com/openshift/hypershift/pull/8672)
* NO-JIRA: fix(ci): switch to openshift-developer plugin bundle for GHA workflows [#8809](https://github.com/openshift/hypershift/pull/8809)
* [CNTRLPLANE-3611](https://issues.redhat.com/browse/CNTRLPLANE-3611): propagate tls profile to aws-pod-identity-webhook [#8713](https://github.com/openshift/hypershift/pull/8713)
* NO-JIRA: fix(ci): increase reusable workflow timeout to 90 minutes [#8797](https://github.com/openshift/hypershift/pull/8797)
* [OCPBUGS-55621](https://issues.redhat.com/browse/OCPBUGS-55621): Replace konnectivity Dial with DialContext in konnectivity-https-proxy/cmd.go [#8550](https://github.com/openshift/hypershift/pull/8550)
* [OCPBUGS-85585](https://issues.redhat.com/browse/OCPBUGS-85585): tighten registry override matching to strict longest-prefix across release-image consumers [#8509](https://github.com/openshift/hypershift/pull/8509)
* NO-JIRA: fix(ci): add --verbose flag required by stream-json output format [#8796](https://github.com/openshift/hypershift/pull/8796)
* [CNTRLPLANE-3568](https://issues.redhat.com/browse/CNTRLPLANE-3568): test(e2e): verify AWS additional-tags propagation to guest infrastruc… [#8712](https://github.com/openshift/hypershift/pull/8712)
* ci: stream Claude output in GHA workflow logs [#8778](https://github.com/openshift/hypershift/pull/8778)
* [OCPBUGS-88685](https://issues.redhat.com/browse/OCPBUGS-88685): Fix metrics-proxy unbounded memory growth [#8740](https://github.com/openshift/hypershift/pull/8740)
* [CNTRLPLANE-3584](https://issues.redhat.com/browse/CNTRLPLANE-3584): Enable resource metrics for kube-scheduler endpoints [#8680](https://github.com/openshift/hypershift/pull/8680)
* [CNTRLPLANE-3645](https://issues.redhat.com/browse/CNTRLPLANE-3645): docs: add retrospective guidelines [#8777](https://github.com/openshift/hypershift/pull/8777)
* [CNTRLPLANE-3093](https://issues.redhat.com/browse/CNTRLPLANE-3093), [CNTRLPLANE-3095](https://issues.redhat.com/browse/CNTRLPLANE-3095), [CNTRLPLANE-3096](https://issues.redhat.com/browse/CNTRLPLANE-3096), [CNTRLPLANE-3098](https://issues.redhat.com/browse/CNTRLPLANE-3098): lower Azure WI webhook test version gate to 4.20 [#8323](https://github.com/openshift/hypershift/pull/8323)
* [CNTRLPLANE-3641](https://issues.redhat.com/browse/CNTRLPLANE-3641): ci: replace COMMUNITY_FORK_TOKEN PAT with GitHub App token [#8776](https://github.com/openshift/hypershift/pull/8776)
* [AROSLSRE-687](https://issues.redhat.com/browse/AROSLSRE-687): propagate HCP Azure resource ID annotation to control plane namespace [#8312](https://github.com/openshift/hypershift/pull/8312)
* [ARO-24037](https://issues.redhat.com/browse/ARO-24037), [OCPBUGS-86616](https://issues.redhat.com/browse/OCPBUGS-86616): feat(azure): add ACR pull identity to worker cloud.conf and VMSS [#8472](https://github.com/openshift/hypershift/pull/8472)
* NO-JIRA: chore(deps): weekly dependabot consolidation [#8684](https://github.com/openshift/hypershift/pull/8684)
* [CNTRLPLANE-3641](https://issues.redhat.com/browse/CNTRLPLANE-3641): fix restructure-commits GHA to force push without confirmation [#8771](https://github.com/openshift/hypershift/pull/8771)
* [CNTRLPLANE-3023](https://issues.redhat.com/browse/CNTRLPLANE-3023): Add CEL rule to prevent osImageStream removal [#8719](https://github.com/openshift/hypershift/pull/8719)
* [CNTRLPLANE-3641](https://issues.redhat.com/browse/CNTRLPLANE-3641): add restructure-commits and rebase GHA workflows [#8770](https://github.com/openshift/hypershift/pull/8770)
* [CNTRLPLANE-3636](https://issues.redhat.com/browse/CNTRLPLANE-3636): Add upgrade-from-.0 periodic jobs to OCP branching checklist [#8764](https://github.com/openshift/hypershift/pull/8764)
* [CNTRLPLANE-3640](https://issues.redhat.com/browse/CNTRLPLANE-3640): Fix address-review-comments GHA credential file deleted during run [#8769](https://github.com/openshift/hypershift/pull/8769)
* [CNTRLPLANE-3026](https://issues.redhat.com/browse/CNTRLPLANE-3026): Decouple AWS AMI resolution for dual-stream support [#8699](https://github.com/openshift/hypershift/pull/8699)
* [CNTRLPLANE-3332](https://issues.redhat.com/browse/CNTRLPLANE-3332), [CNTRLPLANE-3333](https://issues.redhat.com/browse/CNTRLPLANE-3333): Add control plane metrics forwarding recipe and Grafana dashboard [#8332](https://github.com/openshift/hypershift/pull/8332)
* [ROSAENG-8224](https://issues.redhat.com/browse/ROSAENG-8224): feat(operator): add --hcp-egress-block-cidrs flag to stabilize NetworkPolicy egress exceptions [#8689](https://github.com/openshift/hypershift/pull/8689)
* [CNTRLPLANE-3633](https://issues.redhat.com/browse/CNTRLPLANE-3633): docs: add presubmit e2e triage guide [#8741](https://github.com/openshift/hypershift/pull/8741)
* [OCPBUGS-89231](https://issues.redhat.com/browse/OCPBUGS-89231): version-gate TestPullSecretUnavailable to 4.23+ [#8744](https://github.com/openshift/hypershift/pull/8744)
* [CNTRLPLANE-3552](https://issues.redhat.com/browse/CNTRLPLANE-3552): Multi-stream CoreOS metadata parsing and stream resolution [#8669](https://github.com/openshift/hypershift/pull/8669)
* [ACM-34234](https://issues.redhat.com/browse/ACM-34234): build(cli): rename hcp archives to include OS and arch in filename [#8649](https://github.com/openshift/hypershift/pull/8649)
* [CNTRLPLANE-3515](https://issues.redhat.com/browse/CNTRLPLANE-3515): test(e2e): add day-2 label/taint no-rollout verification [#8595](https://github.com/openshift/hypershift/pull/8595)
* NO-JIRA: Add Sippy/CR test name annotations to v2 e2e tests [#8739](https://github.com/openshift/hypershift/pull/8739)
* [OCPBUGS-54790](https://issues.redhat.com/browse/OCPBUGS-54790): Move packageserver PDB from guest cluster to management cluster [#8459](https://github.com/openshift/hypershift/pull/8459)
* [OCPBUGS-84577](https://issues.redhat.com/browse/OCPBUGS-84577): clear stale EtcdRecoveryActive failure condition when etcd is healthy [#8406](https://github.com/openshift/hypershift/pull/8406)
* [CNTRLPLANE-3575](https://issues.redhat.com/browse/CNTRLPLANE-3575): test(controlplane-component): verify setDefaultOptions preserves exis… [#8731](https://github.com/openshift/hypershift/pull/8731)
* NO-JIRA: docs: improve AGENTS.md and DEVELOPMENT.md guidance for AI agents [#8703](https://github.com/openshift/hypershift/pull/8703)
* [OCPBUGS-85778](https://issues.redhat.com/browse/OCPBUGS-85778): Fix NodePool reconciliation failure when updating mirrored immutable ConfigMaps [#8543](https://github.com/openshift/hypershift/pull/8543)
* [OCPBUGS-86662](https://issues.redhat.com/browse/OCPBUGS-86662): Optimize CPO deployment polling interval in tests of additional trust bundle propagation [#8617](https://github.com/openshift/hypershift/pull/8617)
* NO-JIRA: ci(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 [#8727](https://github.com/openshift/hypershift/pull/8727)
* [CNTRLPLANE-3271](https://issues.redhat.com/browse/CNTRLPLANE-3271): add External OIDC e2e tests for v2 framework [#8674](https://github.com/openshift/hypershift/pull/8674)
* [OCPBUGS-84555](https://issues.redhat.com/browse/OCPBUGS-84555): fix(cpo): include serving cert CAs in bootstrap and external admin kubeconfigs [#8311](https://github.com/openshift/hypershift/pull/8311)
* NO-JIRA: chore: add unit test naming and placement conventions [#8722](https://github.com/openshift/hypershift/pull/8722)
* NO-JIRA: build(operator): drop hypershift-no-cgo from operator container images [#8601](https://github.com/openshift/hypershift/pull/8601)
* [CNTRLPLANE-3617](https://issues.redhat.com/browse/CNTRLPLANE-3617): Increase address-review-comments max turns to 200 [#8723](https://github.com/openshift/hypershift/pull/8723)
* [CNTRLPLANE-3617](https://issues.redhat.com/browse/CNTRLPLANE-3617): Increase address-review-comments timeout to 45 minutes [#8720](https://github.com/openshift/hypershift/pull/8720)
* [OCPBUGS-82443](https://issues.redhat.com/browse/OCPBUGS-82443): fix(cpo): deduplicate VPC endpoint subnets by AZ [#8651](https://github.com/openshift/hypershift/pull/8651)
* [CNTRLPLANE-3020](https://issues.redhat.com/browse/CNTRLPLANE-3020): Adopt coreos/stream-metadata-go upstream library [#8673](https://github.com/openshift/hypershift/pull/8673)
* NO-JIRA: ci: add gopls and pre-commit plugins to address-review workflow [#8702](https://github.com/openshift/hypershift/pull/8702)
* NO-JIRA: fix address-review-comments workflow for fork PRs [#8706](https://github.com/openshift/hypershift/pull/8706)
* NO-JIRA: Add gitlint to pre-commit hooks [#8701](https://github.com/openshift/hypershift/pull/8701)
* [CNTRLPLANE-3584](https://issues.redhat.com/browse/CNTRLPLANE-3584): Add kube-scheduler ServiceMonitor with CA-signed serving certs [#8489](https://github.com/openshift/hypershift/pull/8489)
* NO-JIRA: Improve AI skill quality and restructure AGENTS.md [#8690](https://github.com/openshift/hypershift/pull/8690)
* [CNTRLPLANE-3555](https://issues.redhat.com/browse/CNTRLPLANE-3555): Add ARCHITECTURE.md to repository root [#8668](https://github.com/openshift/hypershift/pull/8668)
* [OCPBUGS-84308](https://issues.redhat.com/browse/OCPBUGS-84308): fix(cpo) delete terminated MCD pods to retry in-place upgrades [#8434](https://github.com/openshift/hypershift/pull/8434)
* [OCPBUGS-87217](https://issues.redhat.com/browse/OCPBUGS-87217): fix: add CPU partitioning workload annotation to control-plane-metrics-forwarder [#8686](https://github.com/openshift/hypershift/pull/8686)
* [CNTRLPLANE-3599](https://issues.redhat.com/browse/CNTRLPLANE-3599): Remove controller-runtime v0.19.7 pin for k8s 1.36 bump [#8683](https://github.com/openshift/hypershift/pull/8683)
* [CNTRLPLANE-3550](https://issues.redhat.com/browse/CNTRLPLANE-3550): Add missing v2 test suites to Azure self-managed test matrix [#8658](https://github.com/openshift/hypershift/pull/8658)
* NO-JIRA: chore(deps): weekly dependabot consolidation [#8634](https://github.com/openshift/hypershift/pull/8634)
* NO-JIRA: test(e2e/v2): sweep AGENTS.md conformance violations [#8659](https://github.com/openshift/hypershift/pull/8659)
* [OCPBUGS-87018](https://issues.redhat.com/browse/OCPBUGS-87018): Revert conditional deletion of openshift-ingress NetworkPolicy [#8662](https://github.com/openshift/hypershift/pull/8662)
* NO-JIRA: move CONTRIBUTING.md to repo root and update CI guidance [#8329](https://github.com/openshift/hypershift/pull/8329)
* [CNTRLPLANE-3548](https://issues.redhat.com/browse/CNTRLPLANE-3548): Add v2 e2e test framework documentation [#8641](https://github.com/openshift/hypershift/pull/8641)
* [OCPBUGS-86008](https://issues.redhat.com/browse/OCPBUGS-86008): Gate Route watch on management cluster capability [#8484](https://github.com/openshift/hypershift/pull/8484)
* Revert "OCPBUGS-86774: Pin azure-cli to 2.72.0 in e2e Dockerfile" [#8652](https://github.com/openshift/hypershift/pull/8652)
* [OCPBUGS-77268](https://issues.redhat.com/browse/OCPBUGS-77268): reconcile HCP when pull secret is unavailable [#8352](https://github.com/openshift/hypershift/pull/8352)
* [GCP-298](https://issues.redhat.com/browse/GCP-298): Add GCP e2e v2 test artifacts directory structure documentation [#8446](https://github.com/openshift/hypershift/pull/8446)
* [CNTRLPLANE-2207](https://issues.redhat.com/browse/CNTRLPLANE-2207): Upgrade to CAPI 1.11 [#8594](https://github.com/openshift/hypershift/pull/8594)
* NO-JIRA: chore(ci): enforce v2 e2e AGENTS.md standards via CodeRabbit [#8660](https://github.com/openshift/hypershift/pull/8660)
* [CNTRLPLANE-1357](https://issues.redhat.com/browse/CNTRLPLANE-1357): add KMSv2 secret encryption e2e v2 test for Self Managed Azure [#8653](https://github.com/openshift/hypershift/pull/8653)
* [CNTRLPLANE-3167](https://issues.redhat.com/browse/CNTRLPLANE-3167): Auto-detect credential type for HCPEtcdBackup [#8368](https://github.com/openshift/hypershift/pull/8368)
* NO-JIRA: Fix Azure private/topology CEL validation rules [#8490](https://github.com/openshift/hypershift/pull/8490)
* [GCP-688](https://issues.redhat.com/browse/GCP-688): Port remaining v1 TestCreateCluster gaps to v2 e2e [#8590](https://github.com/openshift/hypershift/pull/8590)
* NO-JIRA: feat(skills): add validate-pr-override-images skill [#8616](https://github.com/openshift/hypershift/pull/8616)
* [OCPSTRAT-1677](https://issues.redhat.com/browse/OCPSTRAT-1677): Add Spot instances documentation [#8485](https://github.com/openshift/hypershift/pull/8485)
* [OCPBUGS-43444](https://issues.redhat.com/browse/OCPBUGS-43444): Allow kubevirt-csi storageclass default to be changed by user [#8597](https://github.com/openshift/hypershift/pull/8597)
* [CNTRLPLANE-3510](https://issues.redhat.com/browse/CNTRLPLANE-3510): Enable additional golangci-lint linters [#8567](https://github.com/openshift/hypershift/pull/8567)
* [OCPBUGS-86306](https://issues.redhat.com/browse/OCPBUGS-86306): Stop controllers fighting over HCP status [#8562](https://github.com/openshift/hypershift/pull/8562)
* [CNTRLPLANE-3535](https://issues.redhat.com/browse/CNTRLPLANE-3535): Add codecov carryforward flags to stabilize project coverage checks [#8642](https://github.com/openshift/hypershift/pull/8642)
* [OCPSTRAT-1677](https://issues.redhat.com/browse/OCPSTRAT-1677): fix(cpo): increase NTH default workers from 10 to 20 [#8500](https://github.com/openshift/hypershift/pull/8500)
* NO-JIRA: feat(ci): add skopeo and gh CLI to ARC runner image [#8627](https://github.com/openshift/hypershift/pull/8627)
* [OCPBUGS-85584](https://issues.redhat.com/browse/OCPBUGS-85584): Fix stale api.openshift.com labels on HostedControlPlane [#8507](https://github.com/openshift/hypershift/pull/8507)
* NO-JIRA: ci(runner): update base image to actions-runner v2.334.0 [#8643](https://github.com/openshift/hypershift/pull/8643)
* [CNTRLPLANE-3533](https://issues.redhat.com/browse/CNTRLPLANE-3533): Add Dockerfiles to codecov ignore list [#8640](https://github.com/openshift/hypershift/pull/8640)
* [OCPBUGS-86774](https://issues.redhat.com/browse/OCPBUGS-86774): Pin azure-cli to 2.72.0 in e2e Dockerfile [#8638](https://github.com/openshift/hypershift/pull/8638)
* NO-JIRA: ci(deps): bump google-github-actions/auth from 2.1.13 to 3.0.0 [#8630](https://github.com/openshift/hypershift/pull/8630)
* NO-JIRA: ci(deps): bump actions/checkout from 4.3.1 to 6.0.2 [#8631](https://github.com/openshift/hypershift/pull/8631)
* NO-JIRA: Fix HCCO deployment location in AGENTS.md [#8635](https://github.com/openshift/hypershift/pull/8635)
* [CNTRLPLANE-3534](https://issues.redhat.com/browse/CNTRLPLANE-3534): ci: add --allowedTools to address-review-comments workflow [#8639](https://github.com/openshift/hypershift/pull/8639)
* [OCPBUGS-86238](https://issues.redhat.com/browse/OCPBUGS-86238): add CPO overrides for ARO swift-nic resource limits [#8610](https://github.com/openshift/hypershift/pull/8610)
* [OCPBUGS-81544](https://issues.redhat.com/browse/OCPBUGS-81544): requeue when AutoNodeEnabled is progressing [#8497](https://github.com/openshift/hypershift/pull/8497)
* NO-JIRA: add address-review-comments workflow [#8621](https://github.com/openshift/hypershift/pull/8621)
* NO-JIRA: De-duplicate Azure self-managed documentation [#8566](https://github.com/openshift/hypershift/pull/8566)
* [CNTRLPLANE-3531](https://issues.redhat.com/browse/CNTRLPLANE-3531): Remove EFS-backed Go build cache from CI runners [#8637](https://github.com/openshift/hypershift/pull/8637)
* [CNTRLPLANE-3329](https://issues.redhat.com/browse/CNTRLPLANE-3329): Rebuild runner image on gocacheprog and pipeline changes [#8633](https://github.com/openshift/hypershift/pull/8633)
* [CNTRLPLANE-3329](https://issues.redhat.com/browse/CNTRLPLANE-3329): Fix gocacheprog cache corruption with atomic writes [#8624](https://github.com/openshift/hypershift/pull/8624)
* NO-JIRA: fix(karpenter): start node cleanup when CAPI Cluster is deleted [#8589](https://github.com/openshift/hypershift/pull/8589)
* [OCPBUGS-85151](https://issues.redhat.com/browse/OCPBUGS-85151): Re-enable serviceaccount-pull-secrets controller when registry managementState changes from Removed [#8522](https://github.com/openshift/hypershift/pull/8522)
* [OCPBUGS-85243](https://issues.redhat.com/browse/OCPBUGS-85243): Set aws-load-balancer-scheme on public HCP router service [#8458](https://github.com/openshift/hypershift/pull/8458)
* [OCPBUGS-38898](https://issues.redhat.com/browse/OCPBUGS-38898): fix kubeadmin password hash reconciliation to compare password against stored hash [#8358](https://github.com/openshift/hypershift/pull/8358)
* [OCPBUGS-84303](https://issues.redhat.com/browse/OCPBUGS-84303): fix(api): add IPv6 OVN join subnet config to prevent dual-stack routing collision [#8421](https://github.com/openshift/hypershift/pull/8421)
* NO-JIRA: clone ai-helpers into workspace for plugin file access [#8620](https://github.com/openshift/hypershift/pull/8620)
* NO-JIRA: bump claude max-turns to 50 in WIF test [#8619](https://github.com/openshift/hypershift/pull/8619)
* NO-JIRA: test ai-sbom plugin and verify plugin loading [#8614](https://github.com/openshift/hypershift/pull/8614)
* [CNTRLPLANE-3329](https://issues.redhat.com/browse/CNTRLPLANE-3329): Use GOCACHEPROG for zero-copy EFS build cache [#8576](https://github.com/openshift/hypershift/pull/8576)
* NO-JIRA: replace container image with workflow-step plugin setup [#8611](https://github.com/openshift/hypershift/pull/8611)
* NO-JIRA: use ai-helpers container image for Claude WIF test [#8609](https://github.com/openshift/hypershift/pull/8609)
* NO-JIRA: fix Claude WIF test workflow HOME for ARC runners [#8600](https://github.com/openshift/hypershift/pull/8600)
* NO-JIRA: fix Claude WIF test workflow for ARC runners [#8598](https://github.com/openshift/hypershift/pull/8598)
* NO-JIRA: test Claude Code WIF auth in GitHub Actions [#8588](https://github.com/openshift/hypershift/pull/8588)
* [OCPBUGS-86296](https://issues.redhat.com/browse/OCPBUGS-86296): Propagate management cluster proxy env vars to konnectivity sidecar [#8569](https://github.com/openshift/hypershift/pull/8569)
* [OCPBUGS-65730](https://issues.redhat.com/browse/OCPBUGS-65730): add --tls-cipher-suites to oauth-apiserver deployment [#8554](https://github.com/openshift/hypershift/pull/8554)
* [OCPBUGS-85351](https://issues.redhat.com/browse/OCPBUGS-85351): Revert "fix(azure): prevent externalDNSDomain from shadowing cluster apps domain" [#8585](https://github.com/openshift/hypershift/pull/8585)
* [OCPBUGS-84955](https://issues.redhat.com/browse/OCPBUGS-84955): bootstrap serving certs at hypershift operator startup [#8545](https://github.com/openshift/hypershift/pull/8545)
* ci(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 [#8574](https://github.com/openshift/hypershift/pull/8574)
* [CNTRLPLANE-3040](https://issues.redhat.com/browse/CNTRLPLANE-3040): add regression tests for CAS pause/unpause replica clamping [#8262](https://github.com/openshift/hypershift/pull/8262)
* NO-JIRA: chore(deps): weekly dependabot consolidation [#8578](https://github.com/openshift/hypershift/pull/8578)
* [GCP-688](https://issues.redhat.com/browse/GCP-688): Port v1 E2E validations to envtest, unit tests, and v2 Ginkgo specs [#8511](https://github.com/openshift/hypershift/pull/8511)
* NO-JIRA: fix(e2e): lower pull secret in-place propagation test gate to 4.22 [#8553](https://github.com/openshift/hypershift/pull/8553)
* [OCPBUGS-86075](https://issues.redhat.com/browse/OCPBUGS-86075): docs(nodepool): fixing incomplete stuck node drain documentation in section Scaling To Zero [#8544](https://github.com/openshift/hypershift/pull/8544)
* [CNTRLPLANE-3222](https://issues.redhat.com/browse/CNTRLPLANE-3222): Port v1 lifecycle tests to v2 Ginkgo framework [#8527](https://github.com/openshift/hypershift/pull/8527)
* [AUTOSCALE-692](https://issues.redhat.com/browse/AUTOSCALE-692): remove default debug log level from karpenter container [#8561](https://github.com/openshift/hypershift/pull/8561)
* [OCPBUGS-86310](https://issues.redhat.com/browse/OCPBUGS-86310): Handle CA bundle aggregation delay by requeuing revocation [#8563](https://github.com/openshift/hypershift/pull/8563)
* [CNTRLPLANE-3329](https://issues.redhat.com/browse/CNTRLPLANE-3329): Use fuse-overlayfs for build cache instead of full copy [#8568](https://github.com/openshift/hypershift/pull/8568)
* NO-JIRA: fix(e2e): use public multi-arch image for ARM64 karpenter test [#8532](https://github.com/openshift/hypershift/pull/8532)
* [OCPBUGS-86238](https://issues.redhat.com/browse/OCPBUGS-86238): set limits for aro.openshift.io/swift-nic in request overrides for ARO swift [#8552](https://github.com/openshift/hypershift/pull/8552)
* [OCPBUGS-85351](https://issues.redhat.com/browse/OCPBUGS-85351): fix(azure): prevent externalDNSDomain from shadowing cluster apps domain [#8480](https://github.com/openshift/hypershift/pull/8480)
* [CNTRLPLANE-3371](https://issues.redhat.com/browse/CNTRLPLANE-3371): Fix AllowedCIDRs e2e test for Route-based KAS [#8469](https://github.com/openshift/hypershift/pull/8469)
* NO-JIRA: build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 in /hack/tools [#8547](https://github.com/openshift/hypershift/pull/8547)
* NO-JIRA: Update Konflux Tekton task bundles [#8557](https://github.com/openshift/hypershift/pull/8557)
* NO-JIRA: chore(deps): weekly dependabot consolidation [#8464](https://github.com/openshift/hypershift/pull/8464)
* [CNTRLPLANE-3070](https://issues.redhat.com/browse/CNTRLPLANE-3070): Support KMS on self-managed Azure without affecting ARO HCP [#8088](https://github.com/openshift/hypershift/pull/8088)
* [OCPBUGS-59142](https://issues.redhat.com/browse/OCPBUGS-59142): fix ValidReleaseImage condition message to show minor version [#8519](https://github.com/openshift/hypershift/pull/8519)
* NO-JIRA: Add onboarding guide for new HCP team members [#8132](https://github.com/openshift/hypershift/pull/8132)
* [OCPBUGS-85011](https://issues.redhat.com/browse/OCPBUGS-85011): fix(cpo): use check-first pattern for EBS CSI operator serving cert [#8418](https://github.com/openshift/hypershift/pull/8418)
* [CNTRLPLANE-3329](https://issues.redhat.com/browse/CNTRLPLANE-3329): Extend EFS-backed build cache to lint, verify, and envtest workflows [#8495](https://github.com/openshift/hypershift/pull/8495)
* NO-JIRA: ci(deps): bump cloudflare/wrangler-action from 3.15.0 to 4.0.0 [#8524](https://github.com/openshift/hypershift/pull/8524)
* [OCPBUGS-85763](https://issues.redhat.com/browse/OCPBUGS-85763): Fix metrics-proxy deployment failure due to dots in volume names [#8530](https://github.com/openshift/hypershift/pull/8530)
* [GCP-636](https://issues.redhat.com/browse/GCP-636): feat(gcp): support for managing GCP OIDC discovery documents [#8413](https://github.com/openshift/hypershift/pull/8413)
* [OCPBUGS-84307](https://issues.redhat.com/browse/OCPBUGS-84307): Clarify --base-domain flag default behavior [#8381](https://github.com/openshift/hypershift/pull/8381)
* [AUTOSCALE-681](https://issues.redhat.com/browse/AUTOSCALE-681): various karpenter and karpenterupgrade test fixes [#8510](https://github.com/openshift/hypershift/pull/8510)
* [CNTRLPLANE-3329](https://issues.redhat.com/browse/CNTRLPLANE-3329): Replace actions/cache with EFS-backed build cache in unit tests [#8494](https://github.com/openshift/hypershift/pull/8494)
* [OCPBUGS-85577](https://issues.redhat.com/browse/OCPBUGS-85577): Update external-dns image from 1.1.0-3 to 1.2.1 [#8506](https://github.com/openshift/hypershift/pull/8506)
* [OCPBUGS-77827](https://issues.redhat.com/browse/OCPBUGS-77827): fix(api): add missing has() guards to servingCerts CEL validation rule [#8331](https://github.com/openshift/hypershift/pull/8331)
* [CNTRLPLANE-3380](https://issues.redhat.com/browse/CNTRLPLANE-3380): docs: add aws-node-termination-handler to repositories list [#8514](https://github.com/openshift/hypershift/pull/8514)
* [OCPBUGS-85580](https://issues.redhat.com/browse/OCPBUGS-85580): Fix webhook TLS failure after service-ca to self-managed cert migration [#8504](https://github.com/openshift/hypershift/pull/8504)
* build(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 in /hack/tools [#8481](https://github.com/openshift/hypershift/pull/8481)
* [OCPBUGS-85344](https://issues.redhat.com/browse/OCPBUGS-85344): Add version gates for 4.22 backward compatibility in e2e tests [#8466](https://github.com/openshift/hypershift/pull/8466)
* [AUTOSCALE-681](https://issues.redhat.com/browse/AUTOSCALE-681): remove TechPreviewNoUpgrade gate from karpenter upgrade test [#8498](https://github.com/openshift/hypershift/pull/8498)
* [CNTRLPLANE-3329](https://issues.redhat.com/browse/CNTRLPLANE-3329): Mount EFS-backed Go build cache PV on ARC runner pods [#8493](https://github.com/openshift/hypershift/pull/8493)
* NO-JIRA: docs: add repositories page listing team-owned repos [#8505](https://github.com/openshift/hypershift/pull/8505)
* [CNTRLPLANE-3329](https://issues.redhat.com/browse/CNTRLPLANE-3329): Add nightly CronJob to warm EFS-backed Go build cache [#8496](https://github.com/openshift/hypershift/pull/8496)
* [CNTRLPLANE-3324](https://issues.redhat.com/browse/CNTRLPLANE-3324): Restore non-obvious comments after gocyclo refactor [#8487](https://github.com/openshift/hypershift/pull/8487)
* [AUTOSCALE-558](https://issues.redhat.com/browse/AUTOSCALE-558): Expose KubeletConfig on OpenShiftEC2Nodeclass as structured fields + preserveunknown/overflow [#8192](https://github.com/openshift/hypershift/pull/8192)
* NO-JIRA: Fix docs deploy preview by replacing gh CLI with curl [#8488](https://github.com/openshift/hypershift/pull/8488)
* [CNTRLPLANE-2946](https://issues.redhat.com/browse/CNTRLPLANE-2946): Move AWS NLB annotation inside LoadBalancer strategy block [#7993](https://github.com/openshift/hypershift/pull/7993)
* [OCPBUGS-78539](https://issues.redhat.com/browse/OCPBUGS-78539): re-add crash toleration for dns-operator during upgrades [#8483](https://github.com/openshift/hypershift/pull/8483)
* [CNTRLPLANE-3384](https://issues.redhat.com/browse/CNTRLPLANE-3384): Remove unconditional low-quality log messages from controllers [#8428](https://github.com/openshift/hypershift/pull/8428)
* [OCPBUGS-84971](https://issues.redhat.com/browse/OCPBUGS-84971): Gate AWSDefaultSecurityGroupDeleted condition to AWS platform [#8415](https://github.com/openshift/hypershift/pull/8415)
* [CNTRLPLANE-3324](https://issues.redhat.com/browse/CNTRLPLANE-3324): Enable gocyclo linter and reduce cyclomatic complexity [#8309](https://github.com/openshift/hypershift/pull/8309)
* NO-JIRA: fix(karpenter): resolve HCP karpenter finalizer when AutoNode is disabled [#8404](https://github.com/openshift/hypershift/pull/8404)
* [OCPBUGS-62177](https://issues.redhat.com/browse/OCPBUGS-62177): verify cert revocation against all KAS pods [#8263](https://github.com/openshift/hypershift/pull/8263)
* NO-JIRA: Document CEL over webhooks policy for AI agents [#8478](https://github.com/openshift/hypershift/pull/8478)
* NO-JIRA: docs(kubevirt): add how-to for configuring VMs with JSON patches [#8473](https://github.com/openshift/hypershift/pull/8473)
* [CNTRLPLANE-1741](https://issues.redhat.com/browse/CNTRLPLANE-1741): Migrate gomaxprocs-webhook pipelines to use common-operator-build [#7122](https://github.com/openshift/hypershift/pull/7122)
* NO-JIRA: docs: update api-sme agent and api/AGENTS.md conventions [#8477](https://github.com/openshift/hypershift/pull/8477)
* [OCPBUGS-81686](https://issues.redhat.com/browse/OCPBUGS-81686): fix(authentication): use v2 auth validation for CEL and expression support. [#8246](https://github.com/openshift/hypershift/pull/8246)
* [OCPBUGS-85084](https://issues.redhat.com/browse/OCPBUGS-85084): fix(ci): use explicit lease in dependabot commit fix push [#8476](https://github.com/openshift/hypershift/pull/8476)
* [OCPBUGS-75887](https://issues.redhat.com/browse/OCPBUGS-75887): fix(inplaceupgrader): include node name in degraded upgrade error message [#8244](https://github.com/openshift/hypershift/pull/8244)
* NO-JIRA: fix(e2e): prevent agent unbinding and node reboots during backup/restore [#8356](https://github.com/openshift/hypershift/pull/8356)
* NO-JIRA: Update GHA docs for reusable workflow pattern [#8453](https://github.com/openshift/hypershift/pull/8453)
* [GCP-413](https://issues.redhat.com/browse/GCP-413): add image registry v2 e2e tests for hosted clusters [#8412](https://github.com/openshift/hypershift/pull/8412)
* NO-JIRA: docs: make CLAUDE.md a symlink to AGENTS.md across the repo [#8444](https://github.com/openshift/hypershift/pull/8444)
* [CNTRLPLANE-2778](https://issues.redhat.com/browse/CNTRLPLANE-2778): feat(tooling): overhaul pr-report skill and Python script [#7754](https://github.com/openshift/hypershift/pull/7754)
* [ACM-33601](https://issues.redhat.com/browse/ACM-33601): use the latest ubi9 nginx image [#8432](https://github.com/openshift/hypershift/pull/8432)
* [GCP-414](https://issues.redhat.com/browse/GCP-414): add image registry operational guide [#8455](https://github.com/openshift/hypershift/pull/8455)
* [OCPBUGS-84528](https://issues.redhat.com/browse/OCPBUGS-84528): clarify pull secret in-place update behavior and add CP watches [#8327](https://github.com/openshift/hypershift/pull/8327)
* [OCPBUGS-84955](https://issues.redhat.com/browse/OCPBUGS-84955): Add render-sensitive flag to `hypershift install render` [#8436](https://github.com/openshift/hypershift/pull/8436)
* [OCPBUGS-84857](https://issues.redhat.com/browse/OCPBUGS-84857): bump go builder and ubi images [#8437](https://github.com/openshift/hypershift/pull/8437)
* [GCP-410](https://issues.redhat.com/browse/GCP-410): fix(gcp): add registry SA WIF binding for image registry GCS access [#8445](https://github.com/openshift/hypershift/pull/8445)
* [CNTRLPLANE-3381](https://issues.redhat.com/browse/CNTRLPLANE-3381): CPO: Surface cloud resource deletion timeout as a status condition [#8426](https://github.com/openshift/hypershift/pull/8426)
* [OCPBUGS-85084](https://issues.redhat.com/browse/OCPBUGS-85084): fix(ci): rewrite dependabot commit messages to pass gitlint [#8435](https://github.com/openshift/hypershift/pull/8435)
* NO-JIRA: docs: detail release branch e2e config steps in branch-process guide [#8441](https://github.com/openshift/hypershift/pull/8441)
* [CNTRLPLANE-3222](https://issues.redhat.com/browse/CNTRLPLANE-3222): Migrate self-managed Azure e2e tests to v2 Ginkgo framework [#8204](https://github.com/openshift/hypershift/pull/8204)
* [GCP-412](https://issues.redhat.com/browse/GCP-412): add envtest cases for GCP imageRegistry CEL validation [#8411](https://github.com/openshift/hypershift/pull/8411)
* [CNTRLPLANE-2939](https://issues.redhat.com/browse/CNTRLPLANE-2939): Coordinate CRD lifecycle with Cluster CAPI Operator [#7996](https://github.com/openshift/hypershift/pull/7996)
* [OCPBUGS-77040](https://issues.redhat.com/browse/OCPBUGS-77040): Add AWS ISO domains to konnectivity IsCloudAPI [#8251](https://github.com/openshift/hypershift/pull/8251)
* [OCPBUGS-83328](https://issues.redhat.com/browse/OCPBUGS-83328): fix skipProxyForKAS to use standard NO_PROXY matching [#8254](https://github.com/openshift/hypershift/pull/8254)
* [OCPBUGS-84969](https://issues.redhat.com/browse/OCPBUGS-84969): fix(e2e): wait for Karpenter node cleanup in parallel tests to prevent vCPU flake [#8414](https://github.com/openshift/hypershift/pull/8414)
* [CNTRLPLANE-3343](https://issues.redhat.com/browse/CNTRLPLANE-3343): Extract support/k8sutil package from support/util [#8396](https://github.com/openshift/hypershift/pull/8396)
* [TRT-2653](https://issues.redhat.com/browse/TRT-2653): Revert #8357 "OCPBUGS-84572: fix(cpo): generate EBS CSI driver operator serving cert in CPO" [#8417](https://github.com/openshift/hypershift/pull/8417)
* NO-JIRA: chore(deps): weekly dependabot consolidation [#8410](https://github.com/openshift/hypershift/pull/8410)
* NO-JIRA: Skip TestKarpenter for releases < 4.22 [#8409](https://github.com/openshift/hypershift/pull/8409)
* [CNTRLPLANE-3351](https://issues.redhat.com/browse/CNTRLPLANE-3351): e2e: add opt-in CPU resource request overrides for control plane components [#8385](https://github.com/openshift/hypershift/pull/8385)
* [OCPBUGS-84509](https://issues.redhat.com/browse/OCPBUGS-84509): Add AWS LB Controller cross-zone load balancing annotation [#8344](https://github.com/openshift/hypershift/pull/8344)
* [OCPBUGS-84572](https://issues.redhat.com/browse/OCPBUGS-84572): fix(cpo): generate EBS CSI driver operator serving cert in CPO [#8357](https://github.com/openshift/hypershift/pull/8357)
* [OCPBUGS-81631](https://issues.redhat.com/browse/OCPBUGS-81631): fix(metrics): remove noisy vCPU log for non-AWS platforms [#8169](https://github.com/openshift/hypershift/pull/8169)
* NO-JIRA: Extend timeout for CRD removal during integration tests [#8366](https://github.com/openshift/hypershift/pull/8366)
* NO-JIRA: chore(deps): weekly dependabot consolidation [#8395](https://github.com/openshift/hypershift/pull/8395)
* [OCPBUGS-83868](https://issues.redhat.com/browse/OCPBUGS-83868): prevent IAM resource leaks during cluster destroy [#8303](https://github.com/openshift/hypershift/pull/8303)
* [GCP-635](https://issues.redhat.com/browse/GCP-635): feat(gcp): make JWKS file optional when OIDC issuer URL is provided [#8339](https://github.com/openshift/hypershift/pull/8339)
* [OCPBUGS-83757](https://issues.redhat.com/browse/OCPBUGS-83757): Remove network dependencies from unit tests [#8277](https://github.com/openshift/hypershift/pull/8277)
* ci(deps): bump actions/setup-go from 5.6.0 to 6.4.0 [#8393](https://github.com/openshift/hypershift/pull/8393)
* [OCPBUGS-84508](https://issues.redhat.com/browse/OCPBUGS-84508): Fix NLB name parsing for EKS Auto Mode hostnames [#8343](https://github.com/openshift/hypershift/pull/8343)
* [AUTOSCALE-615](https://issues.redhat.com/browse/AUTOSCALE-615): include Karpenter node vCPUs in billing metric [#8265](https://github.com/openshift/hypershift/pull/8265)
* [CNTRLPLANE-3352](https://issues.redhat.com/browse/CNTRLPLANE-3352): Convert GHA callers to use reusable workflows @main [#8387](https://github.com/openshift/hypershift/pull/8387)
* [CNTRLPLANE-3342](https://issues.redhat.com/browse/CNTRLPLANE-3342): Extract support/netutil package from support/util [#8360](https://github.com/openshift/hypershift/pull/8360)
* [CNTRLPLANE-3352](https://issues.redhat.com/browse/CNTRLPLANE-3352): Add reusable GHA workflow definitions [#8386](https://github.com/openshift/hypershift/pull/8386)
* [GCP-410](https://issues.redhat.com/browse/GCP-410): feat(gcp): add HCCO credential propagation for GCP image registry [#7896](https://github.com/openshift/hypershift/pull/7896)
* [OCPBUGS-84551](https://issues.redhat.com/browse/OCPBUGS-84551): fix(ingress): set FIPS_ENABLED env var on ingress operator [#8375](https://github.com/openshift/hypershift/pull/8375)
* [CNTRLPLANE-3307](https://issues.redhat.com/browse/CNTRLPLANE-3307): add unit tests for Azure Private Link Service controllers [#8285](https://github.com/openshift/hypershift/pull/8285)
* [CNTRLPLANE-3160](https://issues.redhat.com/browse/CNTRLPLANE-3160): Drop AutoNodeKarpenter feature gate and promote EC2NodeClass to v1 [#8166](https://github.com/openshift/hypershift/pull/8166)
* NO-JIRA: Improve commit and PR guidance in AGENTS.md [#8373](https://github.com/openshift/hypershift/pull/8373)
* [OCPBUGS-83790](https://issues.redhat.com/browse/OCPBUGS-83790): change Azure workload identity webhook FailurePolicy from Fail to Ignore [#8288](https://github.com/openshift/hypershift/pull/8288)
* NO-JIRA: chore(deps): weekly dependabot consolidation [#8334](https://github.com/openshift/hypershift/pull/8334)
* NO-JIRA: Add API dependency import restriction tool [#8364](https://github.com/openshift/hypershift/pull/8364)
* [SPLAT-2587](https://issues.redhat.com/browse/SPLAT-2587): aws/ccm: introduce configuration to CCM managed Security Groups for NLB [#7460](https://github.com/openshift/hypershift/pull/7460)
* NO-JIRA: add --max-depth flag to nav order verification [#8372](https://github.com/openshift/hypershift/pull/8372)
* NO-JIRA: Do not import external dependencies into API packages [#8355](https://github.com/openshift/hypershift/pull/8355)
* [CNTRLPLANE-3340](https://issues.redhat.com/browse/CNTRLPLANE-3340): Extract support/podspec package from support/util [#8354](https://github.com/openshift/hypershift/pull/8354)
* [OCPBUGS-84251](https://issues.redhat.com/browse/OCPBUGS-84251): fix(azure): detect and replace stale role assignments on cluster re-creation [#8322](https://github.com/openshift/hypershift/pull/8322)
* [OCPBUGS-84236](https://issues.redhat.com/browse/OCPBUGS-84236): Guard Infrastructure CR lookup in AWSEndpointServiceReconciler [#8315](https://github.com/openshift/hypershift/pull/8315)
* fix: OCPBUGS-78575: create virt-launcher NetworkPolicy on external infra cluster [#8056](https://github.com/openshift/hypershift/pull/8056)
* [CNTRLPLANE-3330](https://issues.redhat.com/browse/CNTRLPLANE-3330): ci: improve unit test speed with sharding and parallelism [#8330](https://github.com/openshift/hypershift/pull/8330)
* [CNTRLPLANE-3313](https://issues.redhat.com/browse/CNTRLPLANE-3313): add Etcd Snapshot Backup (Tech Preview) DR documentation [#8299](https://github.com/openshift/hypershift/pull/8299)
* [CNTRLPLANE-2834](https://issues.redhat.com/browse/CNTRLPLANE-2834): add e2e test for etcd snapshot backup method on AWS [#8231](https://github.com/openshift/hypershift/pull/8231)
* docs: NO-JIRA: clarify serialization tag behaviour in api/AGENTS.md [#8328](https://github.com/openshift/hypershift/pull/8328)
* [OCPBUGS-84248](https://issues.redhat.com/browse/OCPBUGS-84248): Remove hardcoded quay.io credentials from EnsureGlobalPullSecret test [#8320](https://github.com/openshift/hypershift/pull/8320)
* NO-JIRA: ci(deps): bump GitHub Actions dependencies [#8333](https://github.com/openshift/hypershift/pull/8333)
* [OCPBUGS-77529](https://issues.redhat.com/browse/OCPBUGS-77529): clean stale mock files before make generate function [#8237](https://github.com/openshift/hypershift/pull/8237)
* [OCPBUGS-79471](https://issues.redhat.com/browse/OCPBUGS-79471): fix(test): reduce e2e autorepair flakes from unhealthy node conditions [#8278](https://github.com/openshift/hypershift/pull/8278)
* NO-JIRA: docs: clarify that control plane downgrades are not supported [#8314](https://github.com/openshift/hypershift/pull/8314)
* [CNTRLPLANE-2204](https://issues.redhat.com/browse/CNTRLPLANE-2204): improve AllNodesHealthy and AllMachinesReady conditions [#8247](https://github.com/openshift/hypershift/pull/8247)
* [GCP-431](https://issues.redhat.com/browse/GCP-431): feat: Add CNCC support for GCP WIF in HyperShift [#7824](https://github.com/openshift/hypershift/pull/7824)
* [OCPBUGS-83410](https://issues.redhat.com/browse/OCPBUGS-83410): fix, cno, skip cloud-network-config-controller check on non-cloud platforms [#8238](https://github.com/openshift/hypershift/pull/8238)
* Revert "OCPBUGS-83730: Add *.apps wildcard to base domain Private DNS zone for Azure private clusters" [#8301](https://github.com/openshift/hypershift/pull/8301)
* NO-JIRA: docs: add jira:ready-to-solve to agentic SDLC workflow [#8304](https://github.com/openshift/hypershift/pull/8304)
* [OCPBUGS-83397](https://issues.redhat.com/browse/OCPBUGS-83397): Fix concurrent CRD reconciliation race [#8266](https://github.com/openshift/hypershift/pull/8266)
* NO-JIRA: MCE 5.0 branch cut [#8290](https://github.com/openshift/hypershift/pull/8290)
* [OCPBUGS-83751](https://issues.redhat.com/browse/OCPBUGS-83751): add missing RBAC for webhook configurations [#8276](https://github.com/openshift/hypershift/pull/8276)
* [OCPBUGS-83730](https://issues.redhat.com/browse/OCPBUGS-83730): Add *.apps wildcard to base domain Private DNS zone for Azure private clusters [#8273](https://github.com/openshift/hypershift/pull/8273)
* NO-JIRA: chore: pass COMMIT_HASH build arg to support git worktrees [#8279](https://github.com/openshift/hypershift/pull/8279)
* [OCPBUGS-78539](https://issues.redhat.com/browse/OCPBUGS-78539): revert temporary crash toleration for dns-operator [#7994](https://github.com/openshift/hypershift/pull/7994)
* [CNTRLPLANE-3296](https://issues.redhat.com/browse/CNTRLPLANE-3296): fix: auto-create python venv in Makefile for verify targets [#8269](https://github.com/openshift/hypershift/pull/8269)
* [OCPSTRAT-2499](https://issues.redhat.com/browse/OCPSTRAT-2499): docs(e2e): add AI agent guidance for v2 test framework [#8207](https://github.com/openshift/hypershift/pull/8207)
* [AUTOSCALE-490](https://issues.redhat.com/browse/AUTOSCALE-490): increase autonode test coverage [#7979](https://github.com/openshift/hypershift/pull/7979)
* [OCPBUGS-83604](https://issues.redhat.com/browse/OCPBUGS-83604): fix(kubevirt): filter link-local addresses from EndpointSlice endpoints [#8264](https://github.com/openshift/hypershift/pull/8264)
* NO-JIRA: fix(test): set 1h time limit on e2e capacity reservations [#8208](https://github.com/openshift/hypershift/pull/8208)
* NO-JIRA: docs(agents): add CRD API machinery fundamentals and envtest docs [#8236](https://github.com/openshift/hypershift/pull/8236)
* [OCPBUGS-83585](https://issues.redhat.com/browse/OCPBUGS-83585): Wait for CRD removal in GenerateCRDInstallTest to fix flaky envtest [#8261](https://github.com/openshift/hypershift/pull/8261)
* NO-JIRA: drop redundant api_ux_validation e2e test [#8210](https://github.com/openshift/hypershift/pull/8210)
* [CNTRLPLANE-3255](https://issues.redhat.com/browse/CNTRLPLANE-3255): enable CodeRabbit reviews on draft PRs [#8250](https://github.com/openshift/hypershift/pull/8250)
* [CNTRLPLANE-635](https://issues.redhat.com/browse/CNTRLPLANE-635): Enable nilness and unparam checks in golangci-lint [#8258](https://github.com/openshift/hypershift/pull/8258)
* [AUTOSCALE-590](https://issues.redhat.com/browse/AUTOSCALE-590): karpenter version logging verification [#8058](https://github.com/openshift/hypershift/pull/8058)
* [CNTRLPLANE-3259](https://issues.redhat.com/browse/CNTRLPLANE-3259): Add sdminonne, clebs, and Nirshal to core-reviewers [#8252](https://github.com/openshift/hypershift/pull/8252)
* ci(claude): add konflux-build command for manual non-expiring builds [#7964](https://github.com/openshift/hypershift/pull/7964)
* NO-JIRA: fix(e2e): handle uint64 underflow in karpenter version computation for 5.x [#8227](https://github.com/openshift/hypershift/pull/8227)
* [CNTRLPLANE-3174](https://issues.redhat.com/browse/CNTRLPLANE-3174): Add unit tests for v2 CPO controller packages [#8215](https://github.com/openshift/hypershift/pull/8215)
* [OCPBUGS-83538](https://issues.redhat.com/browse/OCPBUGS-83538): fix(metrics-proxy): resolve ports from pods instead of deployments [#8221](https://github.com/openshift/hypershift/pull/8221)
* [CNTRLPLANE-3260](https://issues.redhat.com/browse/CNTRLPLANE-3260): fix(ci): split docs-preview into build+deploy to eliminate pwn request [#8256](https://github.com/openshift/hypershift/pull/8256)
* [CNTRLPLANE-3203](https://issues.redhat.com/browse/CNTRLPLANE-3203): Add autoscaling documentation for self-managed Azure [#8239](https://github.com/openshift/hypershift/pull/8239)
* NO-JIRA: add ENVTEST_JOBS knob for parallel envtest execution [#8243](https://github.com/openshift/hypershift/pull/8243)
* [CNTRLPLANE-3260](https://issues.redhat.com/browse/CNTRLPLANE-3260): ci: harden GitHub Actions workflows [#8253](https://github.com/openshift/hypershift/pull/8253)
* [CNTRLPLANE-3214](https://issues.redhat.com/browse/CNTRLPLANE-3214): add envtest suites for HCPEtcdBackup CRD validation [#8199](https://github.com/openshift/hypershift/pull/8199)
* [CNTRLPLANE-3254](https://issues.redhat.com/browse/CNTRLPLANE-3254): Sort how-to guides alphabetically and add CI enforcement [#8248](https://github.com/openshift/hypershift/pull/8248)
* [OCPBUGS-67228](https://issues.redhat.com/browse/OCPBUGS-67228): fix(shared-ingress): bump haproxy to 3.0.5-4.el10_1.1 [#7370](https://github.com/openshift/hypershift/pull/7370)
* [CNTRLPLANE-3065](https://issues.redhat.com/browse/CNTRLPLANE-3065): docs: add Agentic Software Development Life Cycle page [#8235](https://github.com/openshift/hypershift/pull/8235)
* [OCPCLOUD-3347](https://issues.redhat.com/browse/OCPCLOUD-3347): feat(machine-approver): add TLS configuration options to deployment manifests [#8019](https://github.com/openshift/hypershift/pull/8019)
* [OCPBUGS-83389](https://issues.redhat.com/browse/OCPBUGS-83389): fix(supportedversion): normalize OCP 5.x versions for skew and release validation [#8225](https://github.com/openshift/hypershift/pull/8225)
* [SREP-4438](https://issues.redhat.com/browse/SREP-4438): refactor(karpenter): tidy Cincinnati version resolution [#8206](https://github.com/openshift/hypershift/pull/8206)
* NO-JIRA: revert: remove .git/ from .dockerignore [#8201](https://github.com/openshift/hypershift/pull/8201)
* [CNTRLPLANE-3197](https://issues.redhat.com/browse/CNTRLPLANE-3197): add release-4.22 branch to renovate configuration [#8196](https://github.com/openshift/hypershift/pull/8196)
* [CNTRLPLANE-3197](https://issues.redhat.com/browse/CNTRLPLANE-3197): update builder images from 4.22 to 4.23 [#8194](https://github.com/openshift/hypershift/pull/8194)
* [CNTRLPLANE-3216](https://issues.redhat.com/browse/CNTRLPLANE-3216): Add codecov.yml validation to make verify [#8202](https://github.com/openshift/hypershift/pull/8202)
* [GCP-368](https://issues.redhat.com/browse/GCP-368): add GCP CCM v2 e2e tests [#7840](https://github.com/openshift/hypershift/pull/7840)
* [CNTRLPLANE-3233](https://issues.redhat.com/browse/CNTRLPLANE-3233): ci(gha): add release-4.22 branch to GitHub Actions workflows [#8217](https://github.com/openshift/hypershift/pull/8217)
* And 12 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/hypershift/compare/5431b93cee3c5096ea1b72eecbccb47581bac200...872a7e821c3fe01b2f866ceada3749a899e3d64f)
### [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm/tree/ef8fcc288d9248cd149f181e7f5c896f4a10eb3b)
* [OCPBUGS-87366](https://issues.redhat.com/browse/OCPBUGS-87366): Updating ose-ibm-cloud-controller-manager-container image to be consistent with ART for 5.0 [#108](https://github.com/openshift/cloud-provider-ibm/pull/108)
* [OCPBUGS-83587](https://issues.redhat.com/browse/OCPBUGS-83587): bump google.golang.org grpc v1.79.3 [#106](https://github.com/openshift/cloud-provider-ibm/pull/106)
* NO-JIRA: Update OWNERS [#95](https://github.com/openshift/cloud-provider-ibm/pull/95)
* [Full changelog](https://github.com/openshift/cloud-provider-ibm/compare/d9222a1c00c37d635da02b65606fde1e54b2ec03...ef8fcc288d9248cd149f181e7f5c896f4a10eb3b)
### [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver/tree/f78abbb3502a875b7ddf769cf6b7c1b8e3ebba29)
* [OCPBUGS-87350](https://issues.redhat.com/browse/OCPBUGS-87350): Updating ose-ibm-vpc-block-csi-driver-container image to be consistent with ART for 5.0 [#153](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/153)
* NO-JIRA: Bump gRPC library to v1.79.3 and replace golang.org/x/net/context with context [#149](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/149)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver/compare/aa40cd7e1a37e2f48f238fc8d293b0546d5d4caf...f78abbb3502a875b7ddf769cf6b7c1b8e3ebba29)
### [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/tree/be4fd01725ce5ab0b47f846c905a349aeee8ab53)
* [STOR-2914](https://issues.redhat.com/browse/STOR-2914): Bump all deps for 5.0.0 [#176](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/176)
* [STOR-2921](https://issues.redhat.com/browse/STOR-2921): update deployment manifests from upstream [#174](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/174)
* [OCPBUGS-87388](https://issues.redhat.com/browse/OCPBUGS-87388): Updating ose-ibm-vpc-block-csi-driver-operator-container image to be consistent with ART for 5.0 [#173](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/173)
* NO-ISSUE: Bump google.golang.org/grpc to v1.79.3 [#172](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/172)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/compare/f859eac9612d8fff52013b809840b015cee6742d...be4fd01725ce5ab0b47f846c905a349aeee8ab53)
### [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud/tree/be3192e4c05659282c3d1f1720f8cd93b59b399a)
* 🐛 OCPBUGS-85337: set imagePullPolicy IfNotPresent on provider workloads [#164](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/164)
* [OCPBUGS-87499](https://issues.redhat.com/browse/OCPBUGS-87499): Updating ose-ibmcloud-cluster-api-controllers-container image to be consistent with ART for 5.0 [#163](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/163)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#160](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/160)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#158](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/158)
* NO-JIRA: Update manifests generator [#159](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/159)
* NO-JIRA: Update OWNERS [#156](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/156)
* [Full changelog](https://github.com/openshift/cluster-api-provider-ibmcloud/compare/03b143d588768a18fd8afa1534ea7d7a04b4d1f3...be3192e4c05659282c3d1f1720f8cd93b59b399a)
### [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud/tree/a31f65a766150264daac38fcebe1d111c5ad79a0)
* [OCPCLOUD-3641](https://issues.redhat.com/browse/OCPCLOUD-3641): Support configurable boot volume profile, size, IOPS and bandwidth [#97](https://github.com/openshift/machine-api-provider-ibmcloud/pull/97)
* [OCPBUGS-87502](https://issues.redhat.com/browse/OCPBUGS-87502): Updating ose-ibmcloud-machine-controllers-container image to be consistent with ART for 5.0 [#96](https://github.com/openshift/machine-api-provider-ibmcloud/pull/96)
* NO-JIRA: Update OWNERS [#93](https://github.com/openshift/machine-api-provider-ibmcloud/pull/93)
* [Full changelog](https://github.com/openshift/machine-api-provider-ibmcloud/compare/46b8c72c675770295f5c2c8f85f5f705ca35787c...a31f65a766150264daac38fcebe1d111c5ad79a0)
### [insights-operator](https://github.com/openshift/insights-operator/tree/46db2e2ca9b0b7576e0b66f4521a2cf83aad8893)
* [CCXDEV-16524](https://issues.redhat.com/browse/CCXDEV-16524): gather alertmanager configuration [#1322](https://github.com/openshift/insights-operator/pull/1322)
* NO-JIRA: Update misleading docs on the QEMU gatherer [#1319](https://github.com/openshift/insights-operator/pull/1319)
* [OCPBUGS-78774](https://issues.redhat.com/browse/OCPBUGS-78774): kube-rbac-proxy must honor Central TLS configuration [#1299](https://github.com/openshift/insights-operator/pull/1299)
* [OCPBUGS-85109](https://issues.redhat.com/browse/OCPBUGS-85109): move required-scc annotation to pod template in gathering job [#1309](https://github.com/openshift/insights-operator/pull/1309)
* [OCPBUGS-93805](https://issues.redhat.com/browse/OCPBUGS-93805): update HyperShift deployment manifest [#1313](https://github.com/openshift/insights-operator/pull/1313)
* [CCXDEV-1560](https://issues.redhat.com/browse/CCXDEV-1560): Optimize the CPU usage of insights-runtime-extractor [#1220](https://github.com/openshift/insights-operator/pull/1220)
* [CCXDEV-16159](https://issues.redhat.com/browse/CCXDEV-16159): controlplanemachinesets gatherer [#1294](https://github.com/openshift/insights-operator/pull/1294)
* [CCXDEV-16450](https://issues.redhat.com/browse/CCXDEV-16450): document disableRuntimeExtractor config option [#1312](https://github.com/openshift/insights-operator/pull/1312)
* Bug OCPBUGS-90497: Remove metadata.namespace from cluster-scoped resources [#1307](https://github.com/openshift/insights-operator/pull/1307)
* [OCPBUGS-87889](https://issues.redhat.com/browse/OCPBUGS-87889): fall back to kube-system/global-pull-secret for Insights token [#1302](https://github.com/openshift/insights-operator/pull/1302)
* [OCPBUGS-87289](https://issues.redhat.com/browse/OCPBUGS-87289): Updating ose-insights-operator-container image to be consistent with ART for 5.0 [#1301](https://github.com/openshift/insights-operator/pull/1301)
* [CCXDEV-15790](https://issues.redhat.com/browse/CCXDEV-15790): extractor controller [#1280](https://github.com/openshift/insights-operator/pull/1280)
* [OCPBUGS-85710](https://issues.redhat.com/browse/OCPBUGS-85710): add trusted-ca-bundle to gatherin job [#1289](https://github.com/openshift/insights-operator/pull/1289)
* [CCXDEV-16348](https://issues.redhat.com/browse/CCXDEV-16348): tls metrics [#1275](https://github.com/openshift/insights-operator/pull/1275)
* [OCPBUGS-77351](https://issues.redhat.com/browse/OCPBUGS-77351): fix: add terminationMessagePolicy to runtime extractor containers [#1286](https://github.com/openshift/insights-operator/pull/1286)
* NO-JIRA: remove BaiyangZhou from OWNERS [#1273](https://github.com/openshift/insights-operator/pull/1273)
* [OCPBUGS-85201](https://issues.redhat.com/browse/OCPBUGS-85201): Bump google.golang.org/grpc to v1.79.3 [#1288](https://github.com/openshift/insights-operator/pull/1288)
* NO-JIRA: Update golang version [#1277](https://github.com/openshift/insights-operator/pull/1277)
* NO-JIRA: add write-test claude skill [#1274](https://github.com/openshift/insights-operator/pull/1274)
* [CCXDEV-15561](https://issues.redhat.com/browse/CCXDEV-15561): Improve test coverage 4 [#1226](https://github.com/openshift/insights-operator/pull/1226)
* [Full changelog](https://github.com/openshift/insights-operator/compare/d7b9c77e6565d4452ff79cd346f3ee6b8535698c...46db2e2ca9b0b7576e0b66f4521a2cf83aad8893)
### [insights-runtime-exporter, insights-runtime-extractor](https://github.com/openshift/insights-runtime-extractor/tree/ce30b4f9bc3ec867b976886a5207d36c50a396d9)
* [OCPBUGS-87370](https://issues.redhat.com/browse/OCPBUGS-87370): Updating ose-insights-runtime-exporter-container image to be consistent with ART for 5.0 [#84](https://github.com/openshift/insights-runtime-extractor/pull/84)
* [OCPBUGS-87473](https://issues.redhat.com/browse/OCPBUGS-87473): Updating ose-insights-runtime-extractor-container image to be consistent with ART for 5.0 [#85](https://github.com/openshift/insights-runtime-extractor/pull/85)
* [Full changelog](https://github.com/openshift/insights-runtime-extractor/compare/70256457b507ec09737800ee7ea022143ed6c3c2...ce30b4f9bc3ec867b976886a5207d36c50a396d9)
### [ironic](https://github.com/openshift/ironic-image/tree/e9478ec49dd508f74234582a8247f9186f584500)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#867](https://github.com/openshift/ironic-image/pull/867)
* [METAL-1898](https://issues.redhat.com/browse/METAL-1898): Add ironic-prometheus-exporter to update-requirements workflow [#866](https://github.com/openshift/ironic-image/pull/866)
* [METAL-1878](https://issues.redhat.com/browse/METAL-1878): [s2i] Move direct dependencies from packages to source [#749](https://github.com/openshift/ironic-image/pull/749)
* NO-ISSUE: Merge upstream 2026 06 11 [#854](https://github.com/openshift/ironic-image/pull/854)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#864](https://github.com/openshift/ironic-image/pull/864)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#862](https://github.com/openshift/ironic-image/pull/862)
* NO-ISSUE: Add --no-index back and remove pip at the end [#853](https://github.com/openshift/ironic-image/pull/853)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#855](https://github.com/openshift/ironic-image/pull/855)
* [METAL-1865](https://issues.redhat.com/browse/METAL-1865): Extract wheel-builder build deps to build-packages-list.ocp [#852](https://github.com/openshift/ironic-image/pull/852)
* [OCPBUGS-44902](https://issues.redhat.com/browse/OCPBUGS-44902): Bump python packaging version and update commit hashes [#850](https://github.com/openshift/ironic-image/pull/850)
* [OCPBUGS-87478](https://issues.redhat.com/browse/OCPBUGS-87478): Updating ironic-container image to be consistent with ART for 5.0 [#851](https://github.com/openshift/ironic-image/pull/851)
* [METAL-1838](https://issues.redhat.com/browse/METAL-1838): Bump setuptools version to align with latest ironic requirements [#847](https://github.com/openshift/ironic-image/pull/847)
* [METAL-1844](https://issues.redhat.com/browse/METAL-1844): Add Slack notification to update-requirements workflow [#849](https://github.com/openshift/ironic-image/pull/849)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#821](https://github.com/openshift/ironic-image/pull/821)
* [OCPBUGS-83618](https://issues.redhat.com/browse/OCPBUGS-83618): Bump sushy to latest [#838](https://github.com/openshift/ironic-image/pull/838)
* NO-ISSUE: Fix update requirements workflow [#842](https://github.com/openshift/ironic-image/pull/842)
* NO-ISSUE: Document how to use gerrit change hash for testing [#839](https://github.com/openshift/ironic-image/pull/839)
* [OKD-362](https://issues.redhat.com/browse/OKD-362): Add watchdog to python-requirements.okd [#837](https://github.com/openshift/ironic-image/pull/837)
* [Full changelog](https://github.com/openshift/ironic-image/compare/208ccd1666573f55b608475e53f9072175f9562f...e9478ec49dd508f74234582a8247f9186f584500)
### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/f0ff570e26f0312dbb02058a092887c276bf0706)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#291](https://github.com/openshift/ironic-agent-image/pull/291)
* [METAL-1878](https://issues.redhat.com/browse/METAL-1878): [s2i] Move direct dependencies from packages to source [#290](https://github.com/openshift/ironic-agent-image/pull/290)
* [OCPBUGS-94115](https://issues.redhat.com/browse/OCPBUGS-94115): Replace individual package removal with a single rpm -e loop [#281](https://github.com/openshift/ironic-agent-image/pull/281)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#267](https://github.com/openshift/ironic-agent-image/pull/267)
* [OCPBUGS-94115](https://issues.redhat.com/browse/OCPBUGS-94115): Replace dnf remove with rpm -e to prevent dependency removal [#269](https://github.com/openshift/ironic-agent-image/pull/269)
* NO-ISSUE: Add forgotten --no-index [#265](https://github.com/openshift/ironic-agent-image/pull/265)
* [METAL-1870](https://issues.redhat.com/browse/METAL-1870): Split OCP build into multi-stage with wheel-builder [#263](https://github.com/openshift/ironic-agent-image/pull/263)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#264](https://github.com/openshift/ironic-agent-image/pull/264)
* [METAL-1865](https://issues.redhat.com/browse/METAL-1865): Extract OCP build deps to build-packages-list.ocp [#262](https://github.com/openshift/ironic-agent-image/pull/262)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#259](https://github.com/openshift/ironic-agent-image/pull/259)
* [OCPBUGS-87357](https://issues.redhat.com/browse/OCPBUGS-87357): Updating ironic-agent-container image to be consistent with ART for 5.0 [#261](https://github.com/openshift/ironic-agent-image/pull/261)
* [METAL-1838](https://issues.redhat.com/browse/METAL-1838): Bump setuptools version to align with latest ironic requirements [#257](https://github.com/openshift/ironic-agent-image/pull/257)
* [METAL-1844](https://issues.redhat.com/browse/METAL-1844): Add Slack notification to update-requirements workflow [#260](https://github.com/openshift/ironic-agent-image/pull/260)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#255](https://github.com/openshift/ironic-agent-image/pull/255)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#254](https://github.com/openshift/ironic-agent-image/pull/254)
* NO-ISSUE: Remove openstack repo workaround [#249](https://github.com/openshift/ironic-agent-image/pull/249)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#253](https://github.com/openshift/ironic-agent-image/pull/253)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#248](https://github.com/openshift/ironic-agent-image/pull/248)
* [METAL-1779](https://issues.redhat.com/browse/METAL-1779): Add podman package for bootc deploy [#247](https://github.com/openshift/ironic-agent-image/pull/247)
* NO-ISSUE: Fix update requirements workflow [#252](https://github.com/openshift/ironic-agent-image/pull/252)
* NO-ISSUE: Document how to use gerrit change hash for testing [#250](https://github.com/openshift/ironic-agent-image/pull/250)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#246](https://github.com/openshift/ironic-agent-image/pull/246)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/0336e6383c98f4f0c6b35c71e00116d3c3160c43...f0ff570e26f0312dbb02058a092887c276bf0706)
### [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader/tree/f8e41b2ed8915474a99e3eb34b54692afb0611da)
* [OCPBUGS-87375](https://issues.redhat.com/browse/OCPBUGS-87375): Updating ironic-rhcos-downloader-container image to be consistent with ART for 5.0 [#122](https://github.com/openshift/ironic-rhcos-downloader/pull/122)
* [Full changelog](https://github.com/openshift/ironic-rhcos-downloader/compare/9953d2b77da077c28f9486a5d965a43149ce30c1...f8e41b2ed8915474a99e3eb34b54692afb0611da)
### [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager/tree/486a041897d703d55ef59c98e2b20a01588a0b4c)
* [OCPBUGS-87516](https://issues.redhat.com/browse/OCPBUGS-87516): Updating ironic-static-ip-manager-container image to be consistent with ART for 5.0 [#60](https://github.com/openshift/ironic-static-ip-manager/pull/60)
* [Full changelog](https://github.com/openshift/ironic-static-ip-manager/compare/a379d09f228d93f2beab1c73d67764c64b21e3cb...486a041897d703d55ef59c98e2b20a01588a0b4c)
### [keepalived-ipfailover](https://github.com/openshift/images/tree/13118bff15103b31a6528bf8de2d0d6de05f4742)
* [OCPBUGS-99649](https://issues.redhat.com/browse/OCPBUGS-99649): Reinstall tzdata if /usr/share/zoneinfo is missing [#246](https://github.com/openshift/images/pull/246)
* [NE-2223](https://issues.redhat.com/browse/NE-2223): Bump HAProxy to 3.2 in egress DNS proxy [#244](https://github.com/openshift/images/pull/244)
* [NE-2716](https://issues.redhat.com/browse/NE-2716): Replace iptables with nftables in origin-egress-router [#242](https://github.com/openshift/images/pull/242)
* [NE-2715](https://issues.redhat.com/browse/NE-2715): Update keepalived-ipfailover to replace iptables with nftables [#235](https://github.com/openshift/images/pull/235)
* NO-JIRA: Update ipfailover/OWNERS to reflect current NID team [#240](https://github.com/openshift/images/pull/240)
* [ART-20722](https://issues.redhat.com/browse/ART-20722): Skip PQ crypto-policies setup for CentOS/OKD builds [#241](https://github.com/openshift/images/pull/241)
* [ART-19728](https://issues.redhat.com/browse/ART-19728): Add Dockerfile.rhel10 [#239](https://github.com/openshift/images/pull/239)
* [OCPBUGS-86911](https://issues.redhat.com/browse/OCPBUGS-86911): Updating openshift-enterprise-base-rhel9-container image to be consistent with ART for 5.0 [#236](https://github.com/openshift/images/pull/236)
* [OCPSTRAT-3113](https://issues.redhat.com/browse/OCPSTRAT-3113): Set DEFAULT:PQ crypto-policies to RHEL9 base image [#230](https://github.com/openshift/images/pull/230)
* Revert "OCPBUGS-84344: yum.conf: omit docs, weak deps" [#234](https://github.com/openshift/images/pull/234)
* [OCPBUGS-84344](https://issues.redhat.com/browse/OCPBUGS-84344): yum.conf: omit docs, weak deps [#231](https://github.com/openshift/images/pull/231)
* [Full changelog](https://github.com/openshift/images/compare/edb8b1e6c5e949c0b470b2bdf7a32f17e53d2f71...13118bff15103b31a6528bf8de2d0d6de05f4742)
### [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server/tree/e24eb97b02b3d39095c70675f5594ae5bc98d238)
* [OCPBUGS-87412](https://issues.redhat.com/browse/OCPBUGS-87412): Updating ose-kube-metrics-server-container image to be consistent with ART for 5.0 [#69](https://github.com/openshift/kubernetes-metrics-server/pull/69)
* NO-JIRA: Cleanup OWNERS list [#68](https://github.com/openshift/kubernetes-metrics-server/pull/68)
* [Full changelog](https://github.com/openshift/kubernetes-metrics-server/compare/38c16c4698d131ab0e2da0d4b4b76d5322a89bab...e24eb97b02b3d39095c70675f5594ae5bc98d238)
### [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy/tree/43c114bc124f59e2fc3223dea8e0a8f4cdeed18d)
* [OCPBUGS-87245](https://issues.redhat.com/browse/OCPBUGS-87245): Updating kube-rbac-proxy-container image to be consistent with ART for 5.0 [#143](https://github.com/openshift/kube-rbac-proxy/pull/143)
* [Full changelog](https://github.com/openshift/kube-rbac-proxy/compare/d12e274605248f6c59373240a7eae7a7a357dcb3...43c114bc124f59e2fc3223dea8e0a8f4cdeed18d)
### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/019ecc7d533333dfd3bf8893e78cd7ec6e282f01)
* [OCPBUGS-99282](https://issues.redhat.com/browse/OCPBUGS-99282): embed a copy of the timezone database [#148](https://github.com/openshift/kube-state-metrics/pull/148)
* NO-ISSUE: [bot] Bump openshift/kube-state-metrics to v2.19.1 [#146](https://github.com/openshift/kube-state-metrics/pull/146)
* [OCPBUGS-87374](https://issues.redhat.com/browse/OCPBUGS-87374): Updating kube-state-metrics-container image to be consistent with ART for 5.0 [#145](https://github.com/openshift/kube-state-metrics/pull/145)
* [OCPBUGS-85098](https://issues.redhat.com/browse/OCPBUGS-85098): [bot] Bump openshift/kube-state-metrics to v2.19.0 [#141](https://github.com/openshift/kube-state-metrics/pull/141)
* [Full changelog](https://github.com/openshift/kube-state-metrics/compare/6fa06eac4c3942ba64bff18ca93b5a019ea5c976...019ecc7d533333dfd3bf8893e78cd7ec6e282f01)
### [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt/tree/5eb884abcd2ff17ae8d7b2691ca12494597c08a6)
* [OCPBUGS-87345](https://issues.redhat.com/browse/OCPBUGS-87345): Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 5.0 [#75](https://github.com/openshift/cloud-provider-kubevirt/pull/75)
* [Full changelog](https://github.com/openshift/cloud-provider-kubevirt/compare/76dd5a6fa9e86573bf3dfb79be17edf832e3bae1...5eb884abcd2ff17ae8d7b2691ca12494597c08a6)
### [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver/tree/7ff99994ecc3a675fac6f9aa7fa418cdb0dca32b)
* [OCPBUGS-92795](https://issues.redhat.com/browse/OCPBUGS-92795): Sync upstream 04/30/2026 [#97](https://github.com/openshift/kubevirt-csi-driver/pull/97)
* [Full changelog](https://github.com/openshift/kubevirt-csi-driver/compare/771b562d4875296007850a4d3709a7ae1c6ed3e2...7ff99994ecc3a675fac6f9aa7fa418cdb0dca32b)
### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/3be0a58b3e9d168eb2dd746c58d79e9081f10c73)
* [SPLAT-2854](https://issues.redhat.com/browse/SPLAT-2854): Fixing issue related to unintended VAP interactions [#1518](https://github.com/openshift/machine-api-operator/pull/1518)
* [SPLAT-2858](https://issues.redhat.com/browse/SPLAT-2858): Fixing test issue where error result was for other resource type [#1522](https://github.com/openshift/machine-api-operator/pull/1522)
* [SPLAT-2813](https://issues.redhat.com/browse/SPLAT-2813): Create VAP E2Es [#1517](https://github.com/openshift/machine-api-operator/pull/1517)
* NO-JIRA: Bump golang.org/x/net to 0.56.0 to fix CVE [#1514](https://github.com/openshift/machine-api-operator/pull/1514)
* [OCPBUGS-87360](https://issues.redhat.com/browse/OCPBUGS-87360): Updating ose-machine-api-operator-container image to be consistent with ART for 5.0 [#1507](https://github.com/openshift/machine-api-operator/pull/1507)
* [SPLAT-2790](https://issues.redhat.com/browse/SPLAT-2790): Added new VAP for vSphere infra validation against current cpms and machines [#1510](https://github.com/openshift/machine-api-operator/pull/1510)
* NO-JIRA: fix: honor --stderrthreshold flag when --logtostderr is enabled [#1485](https://github.com/openshift/machine-api-operator/pull/1485)
* [OCPBUGS-66940](https://issues.redhat.com/browse/OCPBUGS-66940): fix default image for confidential VMs [#1443](https://github.com/openshift/machine-api-operator/pull/1443)
* [OCPBUGS-85416](https://issues.redhat.com/browse/OCPBUGS-85416): Enable actuators to set terminal failure on Exists and Update [#1499](https://github.com/openshift/machine-api-operator/pull/1499)
* [SPLAT-2745](https://issues.redhat.com/browse/SPLAT-2745): Changed vSphere cloud config to be read from openshift-config-managed [#1495](https://github.com/openshift/machine-api-operator/pull/1495)
* [OCPBUGS-82584](https://issues.redhat.com/browse/OCPBUGS-82584): Populate status label selector for scale subresource. [#1490](https://github.com/openshift/machine-api-operator/pull/1490)
* NO-JIRA: machine-api-termination-handler: add scc annotation, terminationMessage: FallbackToLogsOnError [#1494](https://github.com/openshift/machine-api-operator/pull/1494)
* NO-JIRA: bump controller-runtime-common to latest main [#1493](https://github.com/openshift/machine-api-operator/pull/1493)
* NO-JIRA: fix: importing nutanix test to in the binary [#1491](https://github.com/openshift/machine-api-operator/pull/1491)
* NO-JIRA: Update OWNERS [#1486](https://github.com/openshift/machine-api-operator/pull/1486)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/33cb2da02d57004711bd09dd8f288ed6174f48fc...3be0a58b3e9d168eb2dd746c58d79e9081f10c73)
### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/3b4a5c7d9fa127981c57efac6fa29bc76eac019d)
* [OCPNODE-4518](https://issues.redhat.com/browse/OCPNODE-4518): Block runc on RHEL 10 via OSImageURL stream class inspection [#6238](https://github.com/openshift/machine-config-operator/pull/6238)
* [MCO-2380](https://issues.redhat.com/browse/MCO-2380): MCO-2381: Expose MachineOSBuild Status Conditions on Paused MachineConfigPools and add E2E Tests for Paused Pool Builds [#6282](https://github.com/openshift/machine-config-operator/pull/6282)
* [MCO-2414](https://issues.redhat.com/browse/MCO-2414): Add unit tests for osImageStream [#6312](https://github.com/openshift/machine-config-operator/pull/6312)
* NO-ISSUE: extended tests, restore initial maxUnavailable when modified [#6336](https://github.com/openshift/machine-config-operator/pull/6336)
* [OCPBUGS-99695](https://issues.redhat.com/browse/OCPBUGS-99695): Add TC 88940- Apply password only if changes exist [#6328](https://github.com/openshift/machine-config-operator/pull/6328)
* NO-ISSUE: add AWS marketplace polarion ID test [#6330](https://github.com/openshift/machine-config-operator/pull/6330)
* [MCO-2184](https://issues.redhat.com/browse/MCO-2184): Adapt scale extended tests to support osstreams [#6299](https://github.com/openshift/machine-config-operator/pull/6299)
* [CNTRLPLANE-3840](https://issues.redhat.com/browse/CNTRLPLANE-3840): Remove ExternalTopologyMode guard from OSImageStream bootstrap [#6308](https://github.com/openshift/machine-config-operator/pull/6308)
* [MCO-2450](https://issues.redhat.com/browse/MCO-2450): Enable OS ImageStreams in OKD [#6314](https://github.com/openshift/machine-config-operator/pull/6314)
* [MCO-1333](https://issues.redhat.com/browse/MCO-1333): Validate OCL Containerfiles [#6187](https://github.com/openshift/machine-config-operator/pull/6187)
* NO-ISSUE: Add reusable utilities for image inspection [#6327](https://github.com/openshift/machine-config-operator/pull/6327)
* [MCO-1944](https://issues.redhat.com/browse/MCO-1944): Add NetworkPolicy Test case [#6283](https://github.com/openshift/machine-config-operator/pull/6283)
* [MCO-2413](https://issues.redhat.com/browse/MCO-2413): Image inspection cache [#6306](https://github.com/openshift/machine-config-operator/pull/6306)
* [MCO-1847](https://issues.redhat.com/browse/MCO-1847): adapt tc 52373 to new AWS marketplace feature [#6324](https://github.com/openshift/machine-config-operator/pull/6324)
* [MCO-1847](https://issues.redhat.com/browse/MCO-1847): update AWS backdated images in extended tests [#6320](https://github.com/openshift/machine-config-operator/pull/6320)
* [CORENET-5972](https://issues.redhat.com/browse/CORENET-5972): Add openvswitch-ipsec package into ipsec plugin [#4878](https://github.com/openshift/machine-config-operator/pull/4878)
* [MCO-2408](https://issues.redhat.com/browse/MCO-2408): Improve/Reduce code/duplicated logic in OsImageBuilderInNode [#6270](https://github.com/openshift/machine-config-operator/pull/6270)
* [MCO-2424](https://issues.redhat.com/browse/MCO-2424): Fix cert rotation timeout [#6309](https://github.com/openshift/machine-config-operator/pull/6309)
* [MCO-1990](https://issues.redhat.com/browse/MCO-1990): Irreconcilable configs test suite [#6085](https://github.com/openshift/machine-config-operator/pull/6085)
* [OCPBUGS-98745](https://issues.redhat.com/browse/OCPBUGS-98745): MCO-2424: add missing RBAC for pkis resource in MCC ClusterRole [#6307](https://github.com/openshift/machine-config-operator/pull/6307)
* [MCO-2301](https://issues.redhat.com/browse/MCO-2301): AWS Marketplace bootimage update support [#6015](https://github.com/openshift/machine-config-operator/pull/6015)
* [MCO-2407](https://issues.redhat.com/browse/MCO-2407): Move OSImageStream sync to MCC [#6278](https://github.com/openshift/machine-config-operator/pull/6278)
* [MCO-2427](https://issues.redhat.com/browse/MCO-2427): move password, bootimages and cpms suites to longduration suite [#6302](https://github.com/openshift/machine-config-operator/pull/6302)
* [OCPNODE-4604](https://issues.redhat.com/browse/OCPNODE-4604): upgrade CRIOCredentialProviderConfig to v1 [#6220](https://github.com/openshift/machine-config-operator/pull/6220)
* [OCPBUGS-98210](https://issues.redhat.com/browse/OCPBUGS-98210): Fix imagestream detection with extra guard [#6296](https://github.com/openshift/machine-config-operator/pull/6296)
* [MCO-1997](https://issues.redhat.com/browse/MCO-1997): MCO-2297: Add test for osImageStream [#5881](https://github.com/openshift/machine-config-operator/pull/5881)
* [AGENT-1522](https://issues.redhat.com/browse/AGENT-1522): bump InternalReleaseImage to v1 (and simply version dependency) [#6280](https://github.com/openshift/machine-config-operator/pull/6280)
* [OCPBUGS-98210](https://issues.redhat.com/browse/OCPBUGS-98210): Use release payload image for OSImageStream rebuild detection [#6284](https://github.com/openshift/machine-config-operator/pull/6284)
* [OCPBUGS-98040](https://issues.redhat.com/browse/OCPBUGS-98040): Bump golang.org/x/crypto to v0.54.0 [#6286](https://github.com/openshift/machine-config-operator/pull/6286)
* [OCPBUGS-10431](https://issues.redhat.com/browse/OCPBUGS-10431): allow worker pools to set staticPodPath by relaxing validation to only block control plane pools [#5724](https://github.com/openshift/machine-config-operator/pull/5724)
* [CNTRLPLANE-3212](https://issues.redhat.com/browse/CNTRLPLANE-3212): Enable configurable PKI for cert rotation [#5842](https://github.com/openshift/machine-config-operator/pull/5842)
* NO-ISSUE: Improve osimagestream pkg API [#6271](https://github.com/openshift/machine-config-operator/pull/6271)
* [OCPBUGS-92811](https://issues.redhat.com/browse/OCPBUGS-92811): Inject proxy into MCC deployment [#6237](https://github.com/openshift/machine-config-operator/pull/6237)
* [MCO-2152](https://issues.redhat.com/browse/MCO-2152): MCO-2153: MCO-2154: Create MCO network policies for pods [#6151](https://github.com/openshift/machine-config-operator/pull/6151)
* [OCPBUGS-57473](https://issues.redhat.com/browse/OCPBUGS-57473): create digest configmap without oc binary [#5794](https://github.com/openshift/machine-config-operator/pull/5794)
* [OCPBUGS-95030](https://issues.redhat.com/browse/OCPBUGS-95030): Update AMI Whitelist [#6253](https://github.com/openshift/machine-config-operator/pull/6253)
* [OCPBUGS-94000](https://issues.redhat.com/browse/OCPBUGS-94000): Remove sensitive ControllerConfig logging [#6245](https://github.com/openshift/machine-config-operator/pull/6245)
* NO-ISSUE: Remove dead code [#6203](https://github.com/openshift/machine-config-operator/pull/6203)
* [MCO-2393](https://issues.redhat.com/browse/MCO-2393): Use /proc/sys/crypto/fips_enabled for FIPS check in tests [#6233](https://github.com/openshift/machine-config-operator/pull/6233)
* [OCPBUGS-59958](https://issues.redhat.com/browse/OCPBUGS-59958): move cleanUpDuplicatedMC to avoid double reboot on first updated Master node [#6201](https://github.com/openshift/machine-config-operator/pull/6201)
* [OCPBUGS-88333](https://issues.redhat.com/browse/OCPBUGS-88333): Fix bootupd workaround in old nodes [#6199](https://github.com/openshift/machine-config-operator/pull/6199)
* [OCPBUGS-91982](https://issues.redhat.com/browse/OCPBUGS-91982): Bootstrap MCS logging entire ignition [#6231](https://github.com/openshift/machine-config-operator/pull/6231)
* [OCPNODE-4443](https://issues.redhat.com/browse/OCPNODE-4443): Add runc upgradeable guard to block upgrades on RHEL 10 streams [#5891](https://github.com/openshift/machine-config-operator/pull/5891)
* NO-ISSUE: Remove stub upgrade test [#6224](https://github.com/openshift/machine-config-operator/pull/6224)
* [OCPBUGS-86448](https://issues.redhat.com/browse/OCPBUGS-86448): Skip no-op MCN SSA calls [#6217](https://github.com/openshift/machine-config-operator/pull/6217)
* [OCPBUGS-87962](https://issues.redhat.com/browse/OCPBUGS-87962): Boot image skew check silently passes when MachineSets are reconcile-skipped [#6162](https://github.com/openshift/machine-config-operator/pull/6162)
* [OCPBUGS-86826](https://issues.redhat.com/browse/OCPBUGS-86826): Make vsphere template updates atomic [#6117](https://github.com/openshift/machine-config-operator/pull/6117)
* [OKD-305](https://issues.redhat.com/browse/OKD-305): Remove migration code(for runc->crun) [#5682](https://github.com/openshift/machine-config-operator/pull/5682)
* [OCPBUGS-91746](https://issues.redhat.com/browse/OCPBUGS-91746): temporarily remove sandboxed-containers from extensions test [#6213](https://github.com/openshift/machine-config-operator/pull/6213)
* [OCPBUGS-91746](https://issues.redhat.com/browse/OCPBUGS-91746): Remove sandboxed-containers (kata-containers) from extended-priv tests [#6221](https://github.com/openshift/machine-config-operator/pull/6221)
* [MCO-2275](https://issues.redhat.com/browse/MCO-2275): Migrate OS layering tests from openshift-tests-private [#6081](https://github.com/openshift/machine-config-operator/pull/6081)
* [MCO-2257](https://issues.redhat.com/browse/MCO-2257): ensure MCO tests pass in both RHEL9 and RHEL10 [#6055](https://github.com/openshift/machine-config-operator/pull/6055)
* [OCPBUGS-90092](https://issues.redhat.com/browse/OCPBUGS-90092): remove runc from containerruntimeconfig test [#6206](https://github.com/openshift/machine-config-operator/pull/6206)
* [OCPBUGS-86181](https://issues.redhat.com/browse/OCPBUGS-86181): Update ImageModeStatusReporting MCN property and condition transition tests to be resilient on SNO topology [#6107](https://github.com/openshift/machine-config-operator/pull/6107)
* [OCPBUGS-89325](https://issues.redhat.com/browse/OCPBUGS-89325): fix test 74644 so that it pass in rhel10 [#6198](https://github.com/openshift/machine-config-operator/pull/6198)
* [OCPBUGS-88726](https://issues.redhat.com/browse/OCPBUGS-88726): Fix streams in imagemode tests [#6195](https://github.com/openshift/machine-config-operator/pull/6195)
* [OCPBUGS-86978](https://issues.redhat.com/browse/OCPBUGS-86978): modify tests to use rhel10 as the default stream [#6167](https://github.com/openshift/machine-config-operator/pull/6167)
* [MCO-1972](https://issues.redhat.com/browse/MCO-1972): Add test OCP-88202: off-cluster and on-cluster layering implementation [#6043](https://github.com/openshift/machine-config-operator/pull/6043)
* [OCPBUGS-87905](https://issues.redhat.com/browse/OCPBUGS-87905): Process rebuild annotation on machine-os-builder restart [#6160](https://github.com/openshift/machine-config-operator/pull/6160)
* [MCO-2344](https://issues.redhat.com/browse/MCO-2344): Revert MCO-2343 [#6185](https://github.com/openshift/machine-config-operator/pull/6185)
* [OCPBUGS-61583](https://issues.redhat.com/browse/OCPBUGS-61583): Update custom containerfile OCB test to work in a disconnected environment [#6161](https://github.com/openshift/machine-config-operator/pull/6161)
* [OCPBUGS-88315](https://issues.redhat.com/browse/OCPBUGS-88315): Automation fix- Add fix for TC 59424 [#6173](https://github.com/openshift/machine-config-operator/pull/6173)
* [AGENT-1517](https://issues.redhat.com/browse/AGENT-1517): move helpers in iri e2e main test [#6159](https://github.com/openshift/machine-config-operator/pull/6159)
* [MCO-2207](https://issues.redhat.com/browse/MCO-2207), [MCO-2209](https://issues.redhat.com/browse/MCO-2209), [MCO-2213](https://issues.redhat.com/browse/MCO-2213): Migrate security, daemon, and kernel TCs from mco.go [#6021](https://github.com/openshift/machine-config-operator/pull/6021)
* [OCPBUGS-68350](https://issues.redhat.com/browse/OCPBUGS-68350): In OCB to check when a image is removed the old build is triggered again and the MC should start updating directly and no new MOSB should be triggred [#6150](https://github.com/openshift/machine-config-operator/pull/6150)
* [OCPBUGS-74970](https://issues.redhat.com/browse/OCPBUGS-74970): Fix kubelet certificate wait loop in criometricsproxy.yaml [#6125](https://github.com/openshift/machine-config-operator/pull/6125)
* [OCPNODE-4487](https://issues.redhat.com/browse/OCPNODE-4487): replace --system-reserved flags with config drop-in [#6044](https://github.com/openshift/machine-config-operator/pull/6044)
* OWNERS: update current MCO team members [#6165](https://github.com/openshift/machine-config-operator/pull/6165)
* [OCPBUGS-87389](https://issues.redhat.com/browse/OCPBUGS-87389): Updating ose-machine-config-operator-container image to be consistent with ART for 5.0 [#6152](https://github.com/openshift/machine-config-operator/pull/6152)
* [OCPBUGS-87635](https://issues.redhat.com/browse/OCPBUGS-87635): Fix MCP.status.osImageStream [#6154](https://github.com/openshift/machine-config-operator/pull/6154)
* [OCPBUGS-87192](https://issues.redhat.com/browse/OCPBUGS-87192): Add mco_extensions.go e2e test suite for MCO extension install, enable, and validation [#6034](https://github.com/openshift/machine-config-operator/pull/6034)
* [MCO-2343](https://issues.redhat.com/browse/MCO-2343): Temporary make MCO default to rhel-9 [#6156](https://github.com/openshift/machine-config-operator/pull/6156)
* [OCPBUGS-86588](https://issues.redhat.com/browse/OCPBUGS-86588): vSphere boot image hot loop detection is non-functional due to stable template names [#6094](https://github.com/openshift/machine-config-operator/pull/6094)
* [OCPBUGS-85428](https://issues.redhat.com/browse/OCPBUGS-85428): Lowercase the start of all error messages [#6106](https://github.com/openshift/machine-config-operator/pull/6106)
* [MCO-2208](https://issues.redhat.com/browse/MCO-2208): MCO-2125: Migrate mco registry units [#6079](https://github.com/openshift/machine-config-operator/pull/6079)
* [OCPBUGS-86978](https://issues.redhat.com/browse/OCPBUGS-86978): adapt osimagestream tests to handle clusters defaulting to rhel-10 [#6099](https://github.com/openshift/machine-config-operator/pull/6099)
* [AGENT-1517](https://issues.redhat.com/browse/AGENT-1517): avoid running IRI deletion tests for standard e2e IRI tests [#6145](https://github.com/openshift/machine-config-operator/pull/6145)
* [AGENT-1531](https://issues.redhat.com/browse/AGENT-1531): Remove localhost.localdomain workaround for MCN IRI image field [#6146](https://github.com/openshift/machine-config-operator/pull/6146)
* Fixes OCPBUGS-77140: increase LRU cache and prefetch timeout for PinnedImageSet [#6046](https://github.com/openshift/machine-config-operator/pull/6046)
* [OCPBUGS-87014](https://issues.redhat.com/browse/OCPBUGS-87014): Remove skopeo-install script [#6141](https://github.com/openshift/machine-config-operator/pull/6141)
* [OCPBUGS-86965](https://issues.redhat.com/browse/OCPBUGS-86965): make test 69755 more stable [#6127](https://github.com/openshift/machine-config-operator/pull/6127)
* [OCPBUGS-86554](https://issues.redhat.com/browse/OCPBUGS-86554): Wait for operators after removing master machine [#6091](https://github.com/openshift/machine-config-operator/pull/6091)
* [OCPBUGS-85427](https://issues.redhat.com/browse/OCPBUGS-85427): Remove trailing newline (\n) characters in klog message strings [#6112](https://github.com/openshift/machine-config-operator/pull/6112)
* [MCO-2211](https://issues.redhat.com/browse/MCO-2211): MCO-2210: MCO-2234 MCO-Migrate MCO tests from openshift-tests-private [#5902](https://github.com/openshift/machine-config-operator/pull/5902)
* [OCPBUGS-86890](https://issues.redhat.com/browse/OCPBUGS-86890): fix: update arbiter crio config [#6120](https://github.com/openshift/machine-config-operator/pull/6120)
* [MCO-2296](https://issues.redhat.com/browse/MCO-2296): Remove OSImageStreams v1 replace [#6133](https://github.com/openshift/machine-config-operator/pull/6133)
* [MCO-2296](https://issues.redhat.com/browse/MCO-2296): OSImageStreams v1 promotion [#6076](https://github.com/openshift/machine-config-operator/pull/6076)
* [AGENT-1526](https://issues.redhat.com/browse/AGENT-1526): disable htpasswd auth on IRI registry, keep read-only [#6109](https://github.com/openshift/machine-config-operator/pull/6109)
* NO-ISSUE: Add -L flag to curl to follow redirects automatically [#6121](https://github.com/openshift/machine-config-operator/pull/6121)
* [OCPBUGS-86041](https://issues.redhat.com/browse/OCPBUGS-86041): update IsSNO helper function to correctly access the cluster's topology [#6110](https://github.com/openshift/machine-config-operator/pull/6110)
* [OCPBUGS-83619](https://issues.redhat.com/browse/OCPBUGS-83619): Add version guard for OSStream rendering [#6111](https://github.com/openshift/machine-config-operator/pull/6111)
* NO-ISSUE: Lower IRI deletion log verbosity [#6119](https://github.com/openshift/machine-config-operator/pull/6119)
* [OCPBUGS-86179](https://issues.redhat.com/browse/OCPBUGS-86179): Update ImageModeStatusReporting MCP machine count tests to be resilient on SNO topology [#6089](https://github.com/openshift/machine-config-operator/pull/6089)
* [OCPBUGS-86800](https://issues.redhat.com/browse/OCPBUGS-86800): Update AMI Whitelist [#6108](https://github.com/openshift/machine-config-operator/pull/6108)
* [OCPBUGS-86671](https://issues.redhat.com/browse/OCPBUGS-86671): Fix InternalReleaseImage URL transform [#6100](https://github.com/openshift/machine-config-operator/pull/6100)
* [AGENT-1488](https://issues.redhat.com/browse/AGENT-1488): Aggregate IRI status from MachineConfigNodes [#5841](https://github.com/openshift/machine-config-operator/pull/5841)
* [OCPBUGS-63750](https://issues.redhat.com/browse/OCPBUGS-63750): fix Go build tag behavior [#5494](https://github.com/openshift/machine-config-operator/pull/5494)
* [OCPBUGS-86474](https://issues.redhat.com/browse/OCPBUGS-86474): Tests using realtime kernel should not be limited to a… [#6084](https://github.com/openshift/machine-config-operator/pull/6084)
* [OCPBUGS-86332](https://issues.redhat.com/browse/OCPBUGS-86332): remove tests using base images older than 4.13 [#6077](https://github.com/openshift/machine-config-operator/pull/6077)
* NO-ISSUE: Update TC-88366 to check osImageStream status after update completes [#6078](https://github.com/openshift/machine-config-operator/pull/6078)
* [AGENT-1491](https://issues.redhat.com/browse/AGENT-1491): reclaim disk space from the node when IRI resource is deleted [#5988](https://github.com/openshift/machine-config-operator/pull/5988)
* [OCPBUGS-86035](https://issues.redhat.com/browse/OCPBUGS-86035): Adapt test '54922 - daemon: add check before updating kerne… [#6056](https://github.com/openshift/machine-config-operator/pull/6056)
* [AGENT-1517](https://issues.redhat.com/browse/AGENT-1517): fix iri deletion test [#6070](https://github.com/openshift/machine-config-operator/pull/6070)
* [OCPBUGS-83987](https://issues.redhat.com/browse/OCPBUGS-83987): Fix CVE-2026-33186 [#6065](https://github.com/openshift/machine-config-operator/pull/6065)
* [OCPBUGS-84814](https://issues.redhat.com/browse/OCPBUGS-84814): Skip chrony-wait on first node join [#5990](https://github.com/openshift/machine-config-operator/pull/5990)
* [MCO-2273](https://issues.redhat.com/browse/MCO-2273): MCO-2215: MCO-2183: Migrate remaining TCs from mco.go to MCO, units, kublet suite [#6024](https://github.com/openshift/machine-config-operator/pull/6024)
* [AGENT-1517](https://issues.redhat.com/browse/AGENT-1517): disable iri-registry service on IRI delete [#6041](https://github.com/openshift/machine-config-operator/pull/6041)
* [OCPBUGS-85237](https://issues.redhat.com/browse/OCPBUGS-85237): Manually uncordoned nodes are not automatically re-cordoned [#6028](https://github.com/openshift/machine-config-operator/pull/6028)
* [OCPBUGS-15157](https://issues.redhat.com/browse/OCPBUGS-15157): Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole [#6000](https://github.com/openshift/machine-config-operator/pull/6000)
* [OCPBUGS-65645](https://issues.redhat.com/browse/OCPBUGS-65645): Verify extension packages are installed [#6010](https://github.com/openshift/machine-config-operator/pull/6010)
* [OCPBUGS-79502](https://issues.redhat.com/browse/OCPBUGS-79502): Enable AutoSizingReserved for Hypershift workers [#5847](https://github.com/openshift/machine-config-operator/pull/5847)
* NO-JIRA: daemon: expand os image presence check [#6005](https://github.com/openshift/machine-config-operator/pull/6005)
* [MCO-2212](https://issues.redhat.com/browse/MCO-2212): MCO-2213: Migrate mco_observability and mco_daemon test-suite [#5875](https://github.com/openshift/machine-config-operator/pull/5875)
* [OCPBUGS-63650](https://issues.redhat.com/browse/OCPBUGS-63650): configure-ovs: copy lldp mode to br-ex port [#5698](https://github.com/openshift/machine-config-operator/pull/5698)
* [OCPBUGS-85498](https://issues.redhat.com/browse/OCPBUGS-85498): BareMetal skew e2e fails patching provisioning CR after CBO webhook fix [#6031](https://github.com/openshift/machine-config-operator/pull/6031)
* [OCPBUGS-85497](https://issues.redhat.com/browse/OCPBUGS-85497): only check password hash in /etc/shadow [#6030](https://github.com/openshift/machine-config-operator/pull/6030)
* NO-JIRA: Add fix for ossImagestream status [#6018](https://github.com/openshift/machine-config-operator/pull/6018)
* [MCO-2025](https://issues.redhat.com/browse/MCO-2025): OCP-88366 and add OCP-88814 for osImageStream with osImageURL [#6014](https://github.com/openshift/machine-config-operator/pull/6014)
* [OCPBUGS-83830](https://issues.redhat.com/browse/OCPBUGS-83830): Apply password only if changes exist [#5889](https://github.com/openshift/machine-config-operator/pull/5889)
* [AGENT-1514](https://issues.redhat.com/browse/AGENT-1514): Add ML-KEM verification test for IRI registry [#6003](https://github.com/openshift/machine-config-operator/pull/6003)
* [OCPBUGS-84516](https://issues.redhat.com/browse/OCPBUGS-84516): Add `terminationMessagePolicy` to build pod containers [#5993](https://github.com/openshift/machine-config-operator/pull/5993)
* [OCPBUGS-85117](https://issues.redhat.com/browse/OCPBUGS-85117): Fix 2 flakes happening in the ocl test suite [#6004](https://github.com/openshift/machine-config-operator/pull/6004)
* [OCPBUGS-84842](https://issues.redhat.com/browse/OCPBUGS-84842): Bootloader update attempt should be conditional [#5907](https://github.com/openshift/machine-config-operator/pull/5907)
* [OCPBUGS-75894](https://issues.redhat.com/browse/OCPBUGS-75894): use `--delete-if-present` for karg removal [#5914](https://github.com/openshift/machine-config-operator/pull/5914)
* [OCPBUGS-84661](https://issues.redhat.com/browse/OCPBUGS-84661): Fix wrong early exit during kubelet MCs regeneration [#5898](https://github.com/openshift/machine-config-operator/pull/5898)
* [AGENT-1443](https://issues.redhat.com/browse/AGENT-1443): IRI Add certificate regeneration to MCS cert rotation controller [#5721](https://github.com/openshift/machine-config-operator/pull/5721)
* [OCPBUGS-84691](https://issues.redhat.com/browse/OCPBUGS-84691): prom rules: add alert for nodes using runc [#5874](https://github.com/openshift/machine-config-operator/pull/5874)
* [MCO-1908](https://issues.redhat.com/browse/MCO-1908), [MCO-2213](https://issues.redhat.com/browse/MCO-2213): Migrate MCD related MCO test-cases [#5843](https://github.com/openshift/machine-config-operator/pull/5843)
* [OCPBUGS-84867](https://issues.redhat.com/browse/OCPBUGS-84867): Fix OCL test to handle temporarily empty current-machine-os-build annotation [#5913](https://github.com/openshift/machine-config-operator/pull/5913)
* [OCPBUGS-84832](https://issues.redhat.com/browse/OCPBUGS-84832): daemon: don't pull/extract extensions for all OS updates [#5905](https://github.com/openshift/machine-config-operator/pull/5905)
* [OCPBUGS-84852](https://issues.redhat.com/browse/OCPBUGS-84852): Update AMI Whitelist [#5910](https://github.com/openshift/machine-config-operator/pull/5910)
* [OCPBUGS-84150](https://issues.redhat.com/browse/OCPBUGS-84150): MachineOSConfig "build was not found" error [#5878](https://github.com/openshift/machine-config-operator/pull/5878)
* [OCPBUGS-84699](https://issues.redhat.com/browse/OCPBUGS-84699): Custom pool booting must handle matchExpressions in nodeSelector [#5899](https://github.com/openshift/machine-config-operator/pull/5899)
* [OCPBUGS-84565](https://issues.redhat.com/browse/OCPBUGS-84565): Fix CVE-2026-34986 [#5890](https://github.com/openshift/machine-config-operator/pull/5890)
* [OCPBUGS-83871](https://issues.redhat.com/browse/OCPBUGS-83871): Support bootloader update [#5868](https://github.com/openshift/machine-config-operator/pull/5868)
* [OCPBUGS-84332](https://issues.redhat.com/browse/OCPBUGS-84332): Fix ssh and password rollbacks [#5884](https://github.com/openshift/machine-config-operator/pull/5884)
* [MCO-2222](https://issues.redhat.com/browse/MCO-2222): /automate-test skill for generating e2e tests from specifications [#5864](https://github.com/openshift/machine-config-operator/pull/5864)
* [OCPBUGS-84652](https://issues.redhat.com/browse/OCPBUGS-84652): Include RootCA in the temporal CC [#5896](https://github.com/openshift/machine-config-operator/pull/5896)
* [OCPBUGS-83492](https://issues.redhat.com/browse/OCPBUGS-83492): Auto-append :ref suffix to additionalLayerStores in storage.conf [#5888](https://github.com/openshift/machine-config-operator/pull/5888)
* [OCPBUGS-83826](https://issues.redhat.com/browse/OCPBUGS-83826): deploy-from-self when skopeo < 1.22.2 [#5867](https://github.com/openshift/machine-config-operator/pull/5867)
* [OCPBUGS-84490](https://issues.redhat.com/browse/OCPBUGS-84490): Bump image build timeout for status reporting test [#5886](https://github.com/openshift/machine-config-operator/pull/5886)
* [MCO-2201](https://issues.redhat.com/browse/MCO-2201): Improve /migrate-tests skill: default labels and ordering verification [#5879](https://github.com/openshift/machine-config-operator/pull/5879)
* [OCPBUGS-83859](https://issues.redhat.com/browse/OCPBUGS-83859): Fix encapsulated IGN version [#5872](https://github.com/openshift/machine-config-operator/pull/5872)
* [MCO-1494](https://issues.redhat.com/browse/MCO-1494): Remove monolithic e2e-ocl test suite [#5880](https://github.com/openshift/machine-config-operator/pull/5880)
* [AGENT-1449](https://issues.redhat.com/browse/AGENT-1449): Add IRI registry authentication support to MCO [#5765](https://github.com/openshift/machine-config-operator/pull/5765)
* [OCPBUGS-84218](https://issues.redhat.com/browse/OCPBUGS-84218): Fix units rollback if update failure [#5876](https://github.com/openshift/machine-config-operator/pull/5876)
* [OCPBUGS-79425](https://issues.redhat.com/browse/OCPBUGS-79425): improve JSON unmarshalling for secret decoding [#5813](https://github.com/openshift/machine-config-operator/pull/5813)
* [OCPBUGS-83401](https://issues.redhat.com/browse/OCPBUGS-83401): add RootCA cert to the sysContextBuilder certs [#5861](https://github.com/openshift/machine-config-operator/pull/5861)
* [OCPBUGS-82500](https://issues.redhat.com/browse/OCPBUGS-82500): ClusterHostedDNS on AWS/Azure/GCP: Modify Corefile template to better handle empty record types [#5844](https://github.com/openshift/machine-config-operator/pull/5844)
* [MCO-2201](https://issues.redhat.com/browse/MCO-2201): Add Claude /migrate-tests command for MCO test migration [#5837](https://github.com/openshift/machine-config-operator/pull/5837)
* [MCO-1908](https://issues.redhat.com/browse/MCO-1908): Migrate Kernel related MCO test-cases [#5827](https://github.com/openshift/machine-config-operator/pull/5827)
* [OCPBUGS-83539](https://issues.redhat.com/browse/OCPBUGS-83539): Update AMI Whitelist [#5851](https://github.com/openshift/machine-config-operator/pull/5851)
* [OCPBUGS-78524](https://issues.redhat.com/browse/OCPBUGS-78524): Allow enablement of systemd units with existing files [#5846](https://github.com/openshift/machine-config-operator/pull/5846)
* [OCPBUGS-82974](https://issues.redhat.com/browse/OCPBUGS-82974): Make IRI registry read-only via environment variable [#5845](https://github.com/openshift/machine-config-operator/pull/5845)
* [OCPBUGS-81572](https://issues.redhat.com/browse/OCPBUGS-81572): order corosync after OVS configuration on TNF clusters [#5834](https://github.com/openshift/machine-config-operator/pull/5834)
* [OCPBUGS-83517](https://issues.redhat.com/browse/OCPBUGS-83517): Revert ovs increase CPU priority for Open vSwitch Forwarding Unit [#5849](https://github.com/openshift/machine-config-operator/pull/5849)
* [OCPBUGS-63152](https://issues.redhat.com/browse/OCPBUGS-63152): Fail wait-for-node-ip if primary IP(s) disappear [#5350](https://github.com/openshift/machine-config-operator/pull/5350)
* And 3 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/eadf8329c93aba9b187de7668ec3e469bc6d168e...3b4a5c7d9fa127981c57efac6fa29bc76eac019d)
### [machine-image-customization-controller](https://github.com/openshift/image-customization-controller/tree/7a348422137de33a9bfa6368b3797686ff4e8f98)
* [OCPBUGS-87512](https://issues.redhat.com/browse/OCPBUGS-87512): Updating ose-image-customization-controller-container image to be consistent with ART for 5.0 [#178](https://github.com/openshift/image-customization-controller/pull/178)
* [METAL-1730](https://issues.redhat.com/browse/METAL-1730): Add stream selection for multi-version support [#175](https://github.com/openshift/image-customization-controller/pull/175)
* [Full changelog](https://github.com/openshift/image-customization-controller/compare/a43d9c977f6332577efcd383cf173a2ff5805a4d...7a348422137de33a9bfa6368b3797686ff4e8f98)
### [machine-os-images](https://github.com/openshift/machine-os-images/tree/7e514b05e0825994d858d0a142e255abdd0e8f2d)
* NO-ISSUE: OWNERS: Remove me [#78](https://github.com/openshift/machine-os-images/pull/78)
* [OCPBUGS-87871](https://issues.redhat.com/browse/OCPBUGS-87871): Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs [#95](https://github.com/openshift/machine-os-images/pull/95)
* [OCPBUGS-87356](https://issues.redhat.com/browse/OCPBUGS-87356): Updating ose-machine-os-images-container image to be consistent with ART for 5.0 [#91](https://github.com/openshift/machine-os-images/pull/91)
* [METAL-1730](https://issues.redhat.com/browse/METAL-1730): Add stream symlinks for multi-stream support [#83](https://github.com/openshift/machine-os-images/pull/83)
* [OCPBUGS-85476](https://issues.redhat.com/browse/OCPBUGS-85476): Force rebuild for OCP 5.0 [#87](https://github.com/openshift/machine-os-images/pull/87)
* [METAL-1786](https://issues.redhat.com/browse/METAL-1786): Include RHEL10 in image [#82](https://github.com/openshift/machine-os-images/pull/82)
* [Full changelog](https://github.com/openshift/machine-os-images/compare/df9a652cb1572172e404655bb021525be2e3d8ab...7e514b05e0825994d858d0a142e255abdd0e8f2d)
### [metallb-frr](https://github.com/openshift/frr/tree/5d3b12b6ce0a7def4a7a4d1df7ff9e88deb430f5)
* [OCPBUGS-87384](https://issues.redhat.com/browse/OCPBUGS-87384): Updating ose-frr-container image to be consistent with ART for 5.0 [#134](https://github.com/openshift/frr/pull/134)
* [OCPBUGS-85711](https://issues.redhat.com/browse/OCPBUGS-85711): Sync 2026-05-27 [#132](https://github.com/openshift/frr/pull/132)
* Bump to frr 10 [#127](https://github.com/openshift/frr/pull/127)
* [OCPBUGS-82973](https://issues.redhat.com/browse/OCPBUGS-82973): Sync 25-3-2026 [#128](https://github.com/openshift/frr/pull/128)
* [Full changelog](https://github.com/openshift/frr/compare/5ccdd521dd93522575c172dac86d0b6f301fb3ef...5d3b12b6ce0a7def4a7a4d1df7ff9e88deb430f5)
### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/9fbf9a64cdd3659c677452193e9afbc3d87ad702)
* [OU-1240](https://issues.redhat.com/browse/OU-1240): Makefile and package.json to enable test-frontend-ci [#1091](https://github.com/openshift/monitoring-plugin/pull/1091)
* [OU-1389](https://issues.redhat.com/browse/OU-1389): add OWNERS_ALIAS and feature based OWNERS files [#1083](https://github.com/openshift/monitoring-plugin/pull/1083)
* [OU-1389](https://issues.redhat.com/browse/OU-1389): update devspace setup [#1073](https://github.com/openshift/monitoring-plugin/pull/1073)
* NO-JIRA: build(deps-dev): bump websocket-driver from 0.7.4 to 0.7.5 in /web [#1084](https://github.com/openshift/monitoring-plugin/pull/1084)
* [OU-1389](https://issues.redhat.com/browse/OU-1389): Remove Shared Dashbaords Components [#1077](https://github.com/openshift/monitoring-plugin/pull/1077)
* [OBSINTA-1290](https://issues.redhat.com/browse/OBSINTA-1290): fix incident detection test selectors [#1022](https://github.com/openshift/monitoring-plugin/pull/1022)
* [OU-1240](https://issues.redhat.com/browse/OU-1240): Dockerfile.test permission [#1076](https://github.com/openshift/monitoring-plugin/pull/1076)
* [OU-1240](https://issues.redhat.com/browse/OU-1240): increasing node options memory [#1069](https://github.com/openshift/monitoring-plugin/pull/1069)
* [OCPBUGS-92067](https://issues.redhat.com/browse/OCPBUGS-92067): graph redirect query parameter [#1067](https://github.com/openshift/monitoring-plugin/pull/1067)
* [OU-1389](https://issues.redhat.com/browse/OU-1389): add styleguide and file-naming rules [#1065](https://github.com/openshift/monitoring-plugin/pull/1065)
* [OU-1389](https://issues.redhat.com/browse/OU-1389): Update Import Linting [#1062](https://github.com/openshift/monitoring-plugin/pull/1062)
* [OU-1389](https://issues.redhat.com/browse/OU-1389): move components and utils into shared locations [#1056](https://github.com/openshift/monitoring-plugin/pull/1056)
* [OU-1389](https://issues.redhat.com/browse/OU-1389): don't match on feature_* webpack bundles [#1061](https://github.com/openshift/monitoring-plugin/pull/1061)
* [OU-1389](https://issues.redhat.com/browse/OU-1389): update documentation with new frontend folder structure [#1055](https://github.com/openshift/monitoring-plugin/pull/1055)
* [OU-651](https://issues.redhat.com/browse/OU-651): Fix AlertRules page to display user defined loki alerts [#1054](https://github.com/openshift/monitoring-plugin/pull/1054)
* [OU-1389](https://issues.redhat.com/browse/OU-1389): restructure folders [#1038](https://github.com/openshift/monitoring-plugin/pull/1038)
* [OU-1409](https://issues.redhat.com/browse/OU-1409): Match new ols routing and names [#1052](https://github.com/openshift/monitoring-plugin/pull/1052)
* [OU-1409](https://issues.redhat.com/browse/OU-1409): feat: align proposal url with ols detail view, check multiple namespaces for proposals [#1044](https://github.com/openshift/monitoring-plugin/pull/1044)
* [OU-1389](https://issues.redhat.com/browse/OU-1389): swap monitoring-plugin to be feature driven [#1034](https://github.com/openshift/monitoring-plugin/pull/1034)
* [OBSINTA-1006](https://issues.redhat.com/browse/OBSINTA-1006): Add UI performance benchmarks for Incidents page [#873](https://github.com/openshift/monitoring-plugin/pull/873)
* NO-JIRA: fixing unit-test severity sort, variable template regex, and test corrections. [#1035](https://github.com/openshift/monitoring-plugin/pull/1035)
* Fix for OCPBUGS-94056: CVE-2026-13676 [#1032](https://github.com/openshift/monitoring-plugin/pull/1032)
* NO-JIRA: feat: keep current data while loading new data in perses dashboards [#1020](https://github.com/openshift/monitoring-plugin/pull/1020)
* NO-JIRA: enable coderabbit on main-alerts-management-api [#1021](https://github.com/openshift/monitoring-plugin/pull/1021)
* [OU-1409](https://issues.redhat.com/browse/OU-1409): feat: fetch lazily ai proposal for each row in the alert list [#1014](https://github.com/openshift/monitoring-plugin/pull/1014)
* NO-JIRA: perses and monitoring automation testing - stabilization [#924](https://github.com/openshift/monitoring-plugin/pull/924)
* NO-JIRA: fix: update vulnerable dependencies [#1015](https://github.com/openshift/monitoring-plugin/pull/1015)
* [OU-1396](https://issues.redhat.com/browse/OU-1396): fix: use replace to set variables to avoid navigation trap [#1013](https://github.com/openshift/monitoring-plugin/pull/1013)
* [OCPBUGS-85473](https://issues.redhat.com/browse/OCPBUGS-85473): fix: escape regex variable values in regex matcher contexts [#1010](https://github.com/openshift/monitoring-plugin/pull/1010)
* [OBSINTA-1290](https://issues.redhat.com/browse/OBSINTA-1290): Incident Tests Stability [#887](https://github.com/openshift/monitoring-plugin/pull/887)
* [OBSINTA-1358](https://issues.redhat.com/browse/OBSINTA-1358): Fix COO_BUNDLE_IMAGE install path in Cypress Tests. [#994](https://github.com/openshift/monitoring-plugin/pull/994)
* [OU-1384](https://issues.redhat.com/browse/OU-1384): Add missing prop types [#1004](https://github.com/openshift/monitoring-plugin/pull/1004)
* [OU-1384](https://issues.redhat.com/browse/OU-1384): allow test cases to log to console [#1002](https://github.com/openshift/monitoring-plugin/pull/1002)
* [OBSINTA-1397](https://issues.redhat.com/browse/OBSINTA-1397): fix(perses): fall back to metadata.name when dashboard display name is missing [#998](https://github.com/openshift/monitoring-plugin/pull/998)
* [OU-1384](https://issues.redhat.com/browse/OU-1384): add displayNames to components missing them [#1003](https://github.com/openshift/monitoring-plugin/pull/1003)
* [OU-1384](https://issues.redhat.com/browse/OU-1384): remove global eslint disables [#995](https://github.com/openshift/monitoring-plugin/pull/995)
* [OCPBUGS-87980](https://issues.redhat.com/browse/OCPBUGS-87980): build: fix fast-uri vulnerable dependency [#971](https://github.com/openshift/monitoring-plugin/pull/971)
* [OBSINTA-1387](https://issues.redhat.com/browse/OBSINTA-1387): add OLS add-to-dashboard e2e test [#996](https://github.com/openshift/monitoring-plugin/pull/996)
* [OBSINTA-1387](https://issues.redhat.com/browse/OBSINTA-1387): add COO-LightSpeed show_timeseries e2e test [#985](https://github.com/openshift/monitoring-plugin/pull/985)
* [OU-1404](https://issues.redhat.com/browse/OU-1404): prevent re-entrant effect loop in ExternalPanelAddition [#991](https://github.com/openshift/monitoring-plugin/pull/991)
* [OCPBUGS-87485](https://issues.redhat.com/browse/OCPBUGS-87485): Updating monitoring-plugin-container image to be consistent with ART for 5.0 [#972](https://github.com/openshift/monitoring-plugin/pull/972)
* [OBSINTA-1358](https://issues.redhat.com/browse/OBSINTA-1358): add operator-sdk to Cypress test runner image [#966](https://github.com/openshift/monitoring-plugin/pull/966)
* [OU-1399](https://issues.redhat.com/browse/OU-1399): pass ISO string to Timestamp component for valid date rendering [#968](https://github.com/openshift/monitoring-plugin/pull/968)
* [OU-1275](https://issues.redhat.com/browse/OU-1275): remove byte order mark from dashboard text [#960](https://github.com/openshift/monitoring-plugin/pull/960)
* [COO-1776](https://issues.redhat.com/browse/COO-1776): fix: throw error for unsupported dashboard level datasources [#948](https://github.com/openshift/monitoring-plugin/pull/948)
* [OU-1269](https://issues.redhat.com/browse/OU-1269): Update monitoring-console-plugin for 4.22 [#923](https://github.com/openshift/monitoring-plugin/pull/923)
* [OU-1281](https://issues.redhat.com/browse/OU-1281): show disabled project bar while loading [#936](https://github.com/openshift/monitoring-plugin/pull/936)
* [OU-1351](https://issues.redhat.com/browse/OU-1351): prevent namespace and project desync [#933](https://github.com/openshift/monitoring-plugin/pull/933)
* [OU-1315](https://issues.redhat.com/browse/OU-1315): reset queries when namespace changes in dev perspective [#932](https://github.com/openshift/monitoring-plugin/pull/932)
* [OU-1348](https://issues.redhat.com/browse/OU-1348): fix: panel actions index so they are visible on click [#928](https://github.com/openshift/monitoring-plugin/pull/928)
* [OU-1347](https://issues.redhat.com/browse/OU-1347): fix: avoid throwing error to fallback to global datasource [#920](https://github.com/openshift/monitoring-plugin/pull/920)
* [OU-1203](https://issues.redhat.com/browse/OU-1203): upgrade perses dependencies [#914](https://github.com/openshift/monitoring-plugin/pull/914)
* NO-JIRA: Revert "NO-JIRA: Bump to 4.22.0-prerelease.3 SDK" [#915](https://github.com/openshift/monitoring-plugin/pull/915)
* NO-JIRA: Bump to 4.22.0-prerelease.3 SDK [#903](https://github.com/openshift/monitoring-plugin/pull/903)
* [OU-1323](https://issues.redhat.com/browse/OU-1323): Refactor dashboards state to prevent desync [#912](https://github.com/openshift/monitoring-plugin/pull/912)
* [OU-1341](https://issues.redhat.com/browse/OU-1341): pass label values to the filter [#913](https://github.com/openshift/monitoring-plugin/pull/913)
* [OU-1091](https://issues.redhat.com/browse/OU-1091): swap monitoring-plugin to use DataView [#911](https://github.com/openshift/monitoring-plugin/pull/911)
* NO-JIRA: update perses and fix vulnerable dependencies [#900](https://github.com/openshift/monitoring-plugin/pull/900)
* [TRACING-6030](https://issues.redhat.com/browse/TRACING-6030): add RouterProvider to support links in Panels [#891](https://github.com/openshift/monitoring-plugin/pull/891)
* [OU-1217](https://issues.redhat.com/browse/OU-1217): perses customizable dashboards with perses global datasources for tempo and loki [#877](https://github.com/openshift/monitoring-plugin/pull/877)
* [OU-1307](https://issues.redhat.com/browse/OU-1307): don't fight console to setActiveNamespace [#880](https://github.com/openshift/monitoring-plugin/pull/880)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/c43889fdf60b85fe43dc45417be3f644586e7cc4...9fbf9a64cdd3659c677452193e9afbc3d87ad702)
### [multus-admission-controller](https://github.com/openshift/multus-admission-controller/tree/4bb2e2069c3e4f11fbc4c1befd6dc1c41fa802b7)
* [CORENET-7103](https://issues.redhat.com/browse/CORENET-7103): Add TLS configuration CLI flags [#121](https://github.com/openshift/multus-admission-controller/pull/121)
* [OCPBUGS-87456](https://issues.redhat.com/browse/OCPBUGS-87456): Updating ose-multus-admission-controller-container image to be consistent with ART for 5.0 [#119](https://github.com/openshift/multus-admission-controller/pull/119)
* [OCPBUGS-85053](https://issues.redhat.com/browse/OCPBUGS-85053): Bump Go version to 1.25.0 for ML-KEM/PQC support [#115](https://github.com/openshift/multus-admission-controller/pull/115)
* [Full changelog](https://github.com/openshift/multus-admission-controller/compare/16ba7ef8026f5b6d0d08b19c707648d82b1ac592...4bb2e2069c3e4f11fbc4c1befd6dc1c41fa802b7)
### [multus-cni, multus-cni-microshift](https://github.com/openshift/multus-cni/tree/15a47271dcfda5c0e57a0a79720bab4e0baabdd8)
* [OCPBUGS-83863](https://issues.redhat.com/browse/OCPBUGS-83863): Simplify Dockerfile to rhel9-only build [#285](https://github.com/openshift/multus-cni/pull/285)
* [Full changelog](https://github.com/openshift/multus-cni/compare/b4ec7d8239ce4bd3ed949bce9816a013377b44c7...15a47271dcfda5c0e57a0a79720bab4e0baabdd8)
### [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy/tree/932bdaa4250d0a1db41a1a1fcac8192f2757211c)
* [OCPBUGS-87264](https://issues.redhat.com/browse/OCPBUGS-87264): Updating ose-multus-networkpolicy-container image to be consistent with ART for 5.0 [#117](https://github.com/openshift/multus-networkpolicy/pull/117)
* [CNF-21001](https://issues.redhat.com/browse/CNF-21001): Remove iptables compatibility commits [#108](https://github.com/openshift/multus-networkpolicy/pull/108)
* [Full changelog](https://github.com/openshift/multus-networkpolicy/compare/834a093f693e521b8dc4ec7168d03cfba2c1cba1...932bdaa4250d0a1db41a1a1fcac8192f2757211c)
### [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni/tree/d918bda28ad3d0200b6e4f2ef2801556764762e5)
* [OCPBUGS-83863](https://issues.redhat.com/browse/OCPBUGS-83863): Drop rhel8 builds, strip debug info [#405](https://github.com/openshift/whereabouts-cni/pull/405)
* [Full changelog](https://github.com/openshift/whereabouts-cni/compare/d691040e509bb20c26b5e8366c0d6f3bb45a5e02...d918bda28ad3d0200b6e4f2ef2801556764762e5)
### [must-gather](https://github.com/openshift/must-gather/tree/9bb48fe05db060476f9a380b9d6ea16f1e94a98b)
* [OCPBUGS-87538](https://issues.redhat.com/browse/OCPBUGS-87538): Updating ose-must-gather-container image to be consistent with ART for 5.0 [#553](https://github.com/openshift/must-gather/pull/553)
* [MG-247](https://issues.redhat.com/browse/MG-247): collect imagedigestmirrorsets and imagetagmirrorset resources [#538](https://github.com/openshift/must-gather/pull/538)
* [OCPBUGS-85052](https://issues.redhat.com/browse/OCPBUGS-85052): feat: add pacemaker resource to mustgather [#556](https://github.com/openshift/must-gather/pull/556)
* [OCPBUGS-86136](https://issues.redhat.com/browse/OCPBUGS-86136): Add InternalReleaseImage to gather [#552](https://github.com/openshift/must-gather/pull/552)
* no-jira: collect OS Image Stream resource [#533](https://github.com/openshift/must-gather/pull/533)
* [CNV-41714](https://issues.redhat.com/browse/CNV-41714): Add a collector for basic virt related data [#539](https://github.com/openshift/must-gather/pull/539)
* no-jira: chore: address the linting issues in the scripts [#525](https://github.com/openshift/must-gather/pull/525)
* [MG-246](https://issues.redhat.com/browse/MG-246): remove redundant oc inspect command and unused resources [#537](https://github.com/openshift/must-gather/pull/537)
* [Full changelog](https://github.com/openshift/must-gather/compare/8554213fa214e8e165e7bedaf8d892bb824d83ef...9bb48fe05db060476f9a380b9d6ea16f1e94a98b)
### [network-interface-bond-cni](https://github.com/openshift/bond-cni/tree/19d390fd4d353619fdfb5e0070962d2ddf54b5bb)
* NO-JIRA: Sync from k8snetworkplumbingwg/bond-cni master (2026-07-07) [#121](https://github.com/openshift/bond-cni/pull/121)
* NO-JIRA: Update OWNERS: remove zshi-redhat [#120](https://github.com/openshift/bond-cni/pull/120)
* [OCPBUGS-87460](https://issues.redhat.com/browse/OCPBUGS-87460): Updating ose-network-interface-bond-cni-container image to be consistent with ART for 5.0 [#118](https://github.com/openshift/bond-cni/pull/118)
* NO-JIRA: Sync upstream k8snetworkplumbingwg/master (2026-05-19) [#117](https://github.com/openshift/bond-cni/pull/117)
* NO-JIRA: Openshift Only - update owners file [#111](https://github.com/openshift/bond-cni/pull/111)
* NO-JIRA: Fix diverged git histories via upstream merge [#108](https://github.com/openshift/bond-cni/pull/108)
* [Full changelog](https://github.com/openshift/bond-cni/compare/297eeb4320e07b18d559bc373b665479c760e8c7...19d390fd4d353619fdfb5e0070962d2ddf54b5bb)
### [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon/tree/e0fc86dadfa62716b69d2ed9e084f9dcd0fc8844)
* [OCPBUGS-87459](https://issues.redhat.com/browse/OCPBUGS-87459): Updating ose-network-metrics-daemon-container image to be consistent with ART for 5.0 [#144](https://github.com/openshift/network-metrics-daemon/pull/144)
* [Full changelog](https://github.com/openshift/network-metrics-daemon/compare/5b233ea1d80733c1b00c6bad65dec0620dbf783a...e0fc86dadfa62716b69d2ed9e084f9dcd0fc8844)
### [network-tools](https://github.com/openshift/network-tools/tree/0b53ac3dccf59cd169555bf18c207122374bf003)
* NO-JIRA: Add members to script [#183](https://github.com/openshift/network-tools/pull/183)
* [OCPBUGS-87549](https://issues.redhat.com/browse/OCPBUGS-87549): Updating ose-network-tools-container image to be consistent with ART for 5.0 [#182](https://github.com/openshift/network-tools/pull/182)
* NO-JIRA: Add new member [#179](https://github.com/openshift/network-tools/pull/179)
* NO-ISSUE: Add myself back to the bug script [#177](https://github.com/openshift/network-tools/pull/177)
* NO-JIRA: Add mattedallo, marty-power, taanyas as reviewers [#172](https://github.com/openshift/network-tools/pull/172)
* NO-JIRA: Refresh list of team members [#176](https://github.com/openshift/network-tools/pull/176)
* NO-JIRA: Updates to handle changes after migrating to Atlasian cloud [#174](https://github.com/openshift/network-tools/pull/174)
* [Full changelog](https://github.com/openshift/network-tools/compare/5c4b905c09ccd6edadb2ff359f45b70ed334f948...0b53ac3dccf59cd169555bf18c207122374bf003)
### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/2d8f85d257952c1a90467b6ee397334d49b7820e)
* [OCPBUGS-92033](https://issues.redhat.com/browse/OCPBUGS-92033): fixed translations of pod column titles [#436](https://github.com/openshift/networking-console-plugin/pull/436)
* [OCPBUGS-42124](https://issues.redhat.com/browse/OCPBUGS-42124): Fix 'model does not exist' error when enabling MultiNetworkPolicies [#434](https://github.com/openshift/networking-console-plugin/pull/434)
* [OCPBUGS-87477](https://issues.redhat.com/browse/OCPBUGS-87477): Updating networking-console-plugin-container image to be consistent with ART for 5.0 [#427](https://github.com/openshift/networking-console-plugin/pull/427)
* [OCPBUGS-81271](https://issues.redhat.com/browse/OCPBUGS-81271): Trim subnet input in UDN creation form [#425](https://github.com/openshift/networking-console-plugin/pull/425)
* [OCPBUGS-54248](https://issues.redhat.com/browse/OCPBUGS-54248): Fix empty state Create button links [#423](https://github.com/openshift/networking-console-plugin/pull/423)
* [CNV-61064](https://issues.redhat.com/browse/CNV-61064): [UDN] Add condition column to the list page [#421](https://github.com/openshift/networking-console-plugin/pull/421)
* Align PatternFly dependencies with resolutions in Console main branch [#420](https://github.com/openshift/networking-console-plugin/pull/420)
* [CONSOLE-5218](https://issues.redhat.com/browse/CONSOLE-5218): Add project documentation and rewrite README [#417](https://github.com/openshift/networking-console-plugin/pull/417)
* [CNV-74110](https://issues.redhat.com/browse/CNV-74110): new translations [#404](https://github.com/openshift/networking-console-plugin/pull/404)
* Update dependencies for upcoming Console 4.22 release [#371](https://github.com/openshift/networking-console-plugin/pull/371)
* [OCPBUGS-83638](https://issues.redhat.com/browse/OCPBUGS-83638): CVE dependency remediation [#379](https://github.com/openshift/networking-console-plugin/pull/379)
* And 3 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/5422f79693a1f8625db4e2a23c3048e75b59c092...2d8f85d257952c1a90467b6ee397334d49b7820e)
### [nutanix-cloud-controller-manager](https://github.com/openshift/cloud-provider-nutanix/tree/dc584c6b2e895a6217f9e2dbed765209af1898a1)
* [OCPBUGS-87463](https://issues.redhat.com/browse/OCPBUGS-87463): Updating ose-nutanix-cloud-controller-manager-container image to be consistent with ART for 5.0 [#69](https://github.com/openshift/cloud-provider-nutanix/pull/69)
* NO-JIRA: Update OWNERS [#61](https://github.com/openshift/cloud-provider-nutanix/pull/61)
* [Full changelog](https://github.com/openshift/cloud-provider-nutanix/compare/8e75679a965b80fee0332f8758471a7d3a75a4e8...dc584c6b2e895a6217f9e2dbed765209af1898a1)
### [nutanix-machine-controllers](https://github.com/openshift/machine-api-provider-nutanix/tree/b8b84ebcda147113477af9a4edbcdfb03e22875c)
* [SPLAT-2797](https://issues.redhat.com/browse/SPLAT-2797): Changing API calls to v4 [#135](https://github.com/openshift/machine-api-provider-nutanix/pull/135)
* [OCPBUGS-87392](https://issues.redhat.com/browse/OCPBUGS-87392): Updating ose-nutanix-machine-controllers-container image to be consistent with ART for 5.0 [#138](https://github.com/openshift/machine-api-provider-nutanix/pull/138)
* NO-JIRA: Update OWNERS [#136](https://github.com/openshift/machine-api-provider-nutanix/pull/136)
* [Full changelog](https://github.com/openshift/machine-api-provider-nutanix/compare/60559fdd7092dd29aa1c72797c49279aa2da39ee...b8b84ebcda147113477af9a4edbcdfb03e22875c)
### [oauth-apiserver](https://github.com/openshift/oauth-apiserver/tree/688f57b5af12182644b33b770151352b1d54df3a)
* [CNTRLPLANE-2445](https://issues.redhat.com/browse/CNTRLPLANE-2445): K8s 1.35 rebase [#179](https://github.com/openshift/oauth-apiserver/pull/179)
* [CNTRLPLANE-2449](https://issues.redhat.com/browse/CNTRLPLANE-2449): feat: generate OpenAPI schemas from a running oauth-apiserver instance [#211](https://github.com/openshift/oauth-apiserver/pull/211)
* [CNTRLPLANE-3715](https://issues.redhat.com/browse/CNTRLPLANE-3715): Agentic-SDLC: Add human and agent context files [#210](https://github.com/openshift/oauth-apiserver/pull/210)
* [CNTRLPLANE-2518](https://issues.redhat.com/browse/CNTRLPLANE-2518): Add support for sourcing external claims from a source that requires client credential authentication [#197](https://github.com/openshift/oauth-apiserver/pull/197)
* [CNTRLPLANE-2516](https://issues.redhat.com/browse/CNTRLPLANE-2516): feat: externaloidc: add support for externally sourcing claims [#195](https://github.com/openshift/oauth-apiserver/pull/195)
* [CNTRLPLANE-2516](https://issues.redhat.com/browse/CNTRLPLANE-2516): Add local configuration API for external oidc mode [#194](https://github.com/openshift/oauth-apiserver/pull/194)
* NO-JIRA: Add control-plane-approvers to OWNERS [#192](https://github.com/openshift/oauth-apiserver/pull/192)
* [CNTRLPLANE-3226](https://issues.redhat.com/browse/CNTRLPLANE-3226): chore: sync with openshift repositories [#189](https://github.com/openshift/oauth-apiserver/pull/189)
* [Full changelog](https://github.com/openshift/oauth-apiserver/compare/29215dddf12f5b0f549125c22cebe56f14596529...688f57b5af12182644b33b770151352b1d54df3a)
### [oauth-proxy](https://github.com/openshift/oauth-proxy/tree/2b9ee007290b0e1cb85737f3b37075343f9f4857)
* [OCPBUGS-92053](https://issues.redhat.com/browse/OCPBUGS-92053): update x/crypto to v0.52.0 and x/net to v0.55.0 [#368](https://github.com/openshift/oauth-proxy/pull/368)
* [OCPBUGS-69836](https://issues.redhat.com/browse/OCPBUGS-69836): Updating golang-github-openshift-oauth-proxy-container image to be consistent with ART for 4.22 [#341](https://github.com/openshift/oauth-proxy/pull/341)
* [Full changelog](https://github.com/openshift/oauth-proxy/compare/714292f5478e6c12da6a31710f72bc8fbe6fb925...2b9ee007290b0e1cb85737f3b37075343f9f4857)
### [oauth-server](https://github.com/openshift/oauth-server/tree/af32a04e7a91c538afe3808d51a5d28cf3480b22)
* [CNTRLPLANE-2446](https://issues.redhat.com/browse/CNTRLPLANE-2446): K8s 1.35 rebase [#215](https://github.com/openshift/oauth-server/pull/215)
* [CNTRLPLANE-3751](https://issues.redhat.com/browse/CNTRLPLANE-3751): Add dynamic proxy CA reload for outbound IdP transports [#244](https://github.com/openshift/oauth-server/pull/244)
* [CNTRLPLANE-3751](https://issues.redhat.com/browse/CNTRLPLANE-3751): Rebase onto 1.35 to be able to update openshift/api [#247](https://github.com/openshift/oauth-server/pull/247)
* [OCPBUGS-87407](https://issues.redhat.com/browse/OCPBUGS-87407): Updating oauth-server-container image to be consistent with ART for 5.0 [#246](https://github.com/openshift/oauth-server/pull/246)
* [CNTRLPLANE-3687](https://issues.redhat.com/browse/CNTRLPLANE-3687): contextification files [#241](https://github.com/openshift/oauth-server/pull/241)
* NO-JIRA: chore: update OWNERS file to align with other control plane repos [#242](https://github.com/openshift/oauth-server/pull/242)
* NO-JIRA: Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 [#232](https://github.com/openshift/oauth-server/pull/232)
* [CNTRLPLANE-3226](https://issues.redhat.com/browse/CNTRLPLANE-3226): chore: sync with openshift repositories [#221](https://github.com/openshift/oauth-server/pull/221)
* [Full changelog](https://github.com/openshift/oauth-server/compare/69bdf8bc63e094815d07aa16fc2537df5c045489...af32a04e7a91c538afe3808d51a5d28cf3480b22)
### [olm-catalogd, olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller/tree/be80e0c78d4e2ff3d29fd89df29dff79b00b15f6)
* [OPRUN-4436](https://issues.redhat.com/browse/OPRUN-4436): fix(test): update PolarionID:87224 for 4.23/5.0 upgrade boundary [#766](https://github.com/openshift/operator-framework-operator-controller/pull/766)
* [OPRUN-4659](https://issues.redhat.com/browse/OPRUN-4659), [OPRUN-4666](https://issues.redhat.com/browse/OPRUN-4666), [OPRUN-4671](https://issues.redhat.com/browse/OPRUN-4671), [OPRUN-4672](https://issues.redhat.com/browse/OPRUN-4672), [OPRUN-4673](https://issues.redhat.com/browse/OPRUN-4673), [OPRUN-4674](https://issues.redhat.com/browse/OPRUN-4674): Synchronize From Upstream Repositories + Remove spec.serviceAccount tests [#767](https://github.com/openshift/operator-framework-operator-controller/pull/767)
* NO-ISSUE: Remove stale reviewers/approvers, add trgeiger [#769](https://github.com/openshift/operator-framework-operator-controller/pull/769)
* [OPRUN-4392](https://issues.redhat.com/browse/OPRUN-4392), [OPRUN-4393](https://issues.redhat.com/browse/OPRUN-4393): Add OLMv1 progress deadline QE tests + fixes [#755](https://github.com/openshift/operator-framework-operator-controller/pull/755)
* [OPRUN-4437](https://issues.redhat.com/browse/OPRUN-4437): test: add allow-case for operator maxOCPVersion > cluster version [#765](https://github.com/openshift/operator-framework-operator-controller/pull/765)
* NO-ISSUE: Remove HelmChartSupport feature gate from experimental manifests [#764](https://github.com/openshift/operator-framework-operator-controller/pull/764)
* NO-ISSUE: Synchronize From Upstream Repositories [#760](https://github.com/openshift/operator-framework-operator-controller/pull/760)
* NO-ISSUE: Synchronize From Upstream Repositories [#759](https://github.com/openshift/operator-framework-operator-controller/pull/759)
* [OCPBUGS-92037](https://issues.redhat.com/browse/OCPBUGS-92037): Synchronize From Upstream Repositories [#757](https://github.com/openshift/operator-framework-operator-controller/pull/757)
* NO-ISSUE: Synchronize From Upstream Repositories [#754](https://github.com/openshift/operator-framework-operator-controller/pull/754)
* NO-ISSUE: Synchronize From Upstream Repositories [#752](https://github.com/openshift/operator-framework-operator-controller/pull/752)
* [OCPBUGS-85828](https://issues.redhat.com/browse/OCPBUGS-85828): Update catalogs for 4.23/5.0 [#734](https://github.com/openshift/operator-framework-operator-controller/pull/734)
* [OCPBUGS-86797](https://issues.redhat.com/browse/OCPBUGS-86797), [OPRUN-4415](https://issues.redhat.com/browse/OPRUN-4415): Synchronize From Upstream Repositories [#743](https://github.com/openshift/operator-framework-operator-controller/pull/743)
* [OCPBUGS-87383](https://issues.redhat.com/browse/OCPBUGS-87383): Updating ose-olm-operator-controller-container image to be consistent with ART for 5.0 [#749](https://github.com/openshift/operator-framework-operator-controller/pull/749)
* [OCPBUGS-87385](https://issues.redhat.com/browse/OCPBUGS-87385): Updating ose-olm-catalogd-container image to be consistent with ART for 5.0 [#750](https://github.com/openshift/operator-framework-operator-controller/pull/750)
* [OPRUN-4637](https://issues.redhat.com/browse/OPRUN-4637): Update dockerfiles to use golang-1.26-release-4.23 builders [#746](https://github.com/openshift/operator-framework-operator-controller/pull/746)
* NO-ISSUE: Synchronize From Upstream Repositories [#741](https://github.com/openshift/operator-framework-operator-controller/pull/741)
* [OPRUN-4571](https://issues.redhat.com/browse/OPRUN-4571): add OLMv1 topology-based deployment scaling e2e test [#737](https://github.com/openshift/operator-framework-operator-controller/pull/737)
* [OPRUN-4625](https://issues.redhat.com/browse/OPRUN-4625): Synchronize from Upstream Repositories [#738](https://github.com/openshift/operator-framework-operator-controller/pull/738)
* [OPRUN-4617](https://issues.redhat.com/browse/OPRUN-4617): Update readme Default Catalog Tests [#739](https://github.com/openshift/operator-framework-operator-controller/pull/739)
* [OPRUN-4607](https://issues.redhat.com/browse/OPRUN-4607): Remove test-experimenal-e2e [#732](https://github.com/openshift/operator-framework-operator-controller/pull/732)
* NO-ISSUE: Synchronize From Upstream Repositories [#733](https://github.com/openshift/operator-framework-operator-controller/pull/733)
* NO-ISSUE: Synchronize From Upstream Repositories [#730](https://github.com/openshift/operator-framework-operator-controller/pull/730)
* [OPRUN-4608](https://issues.redhat.com/browse/OPRUN-4608): UPSTREAM: <carry>: Delete openshift/registry.Dockerfile [#729](https://github.com/openshift/operator-framework-operator-controller/pull/729)
* NO-ISSUE: Synchronize From Upstream Repositories [#726](https://github.com/openshift/operator-framework-operator-controller/pull/726)
* [OPRUN-4607](https://issues.redhat.com/browse/OPRUN-4607): Fix flags passed to test-experimental-e2e [#723](https://github.com/openshift/operator-framework-operator-controller/pull/723)
* [OCPBUGS-85508](https://issues.redhat.com/browse/OCPBUGS-85508): Synchronize From Upstream Repositories [#725](https://github.com/openshift/operator-framework-operator-controller/pull/725)
* NO-ISSUE: Synchronize From Upstream Repositories [#724](https://github.com/openshift/operator-framework-operator-controller/pull/724)
* NO-ISSUE: Synchronize From Upstream Repositories [#722](https://github.com/openshift/operator-framework-operator-controller/pull/722)
* [OCPBUGS-62517](https://issues.redhat.com/browse/OCPBUGS-62517): Set replicas=1, PDB, and pod anti-affinity for HA topology [#709](https://github.com/openshift/operator-framework-operator-controller/pull/709)
* [OCPBUGS-84943](https://issues.redhat.com/browse/OCPBUGS-84943): fix(test): drop blocking namespace-deletion wait between both-watch-modes scenarios [#712](https://github.com/openshift/operator-framework-operator-controller/pull/712)
* [OCPBUGS-62517](https://issues.redhat.com/browse/OCPBUGS-62517): Synchronize from Upstream Repositories [#710](https://github.com/openshift/operator-framework-operator-controller/pull/710)
* NO-ISSUE: UPSTREAM: <carry>: remove dead e2e registry push job and related variables [#711](https://github.com/openshift/operator-framework-operator-controller/pull/711)
* [OPRUN-4587](https://issues.redhat.com/browse/OPRUN-4587): Make OTE local output easier to read [#704](https://github.com/openshift/operator-framework-operator-controller/pull/704)
* NO-ISSUE: Synchronize From Upstream Repositories [#707](https://github.com/openshift/operator-framework-operator-controller/pull/707)
* NO-ISSUE: Synchronize From Upstream Repositories [#706](https://github.com/openshift/operator-framework-operator-controller/pull/706)
* NO-ISSUE: Synchronize From Upstream Repositories [#701](https://github.com/openshift/operator-framework-operator-controller/pull/701)
* [OPRUN-4574](https://issues.redhat.com/browse/OPRUN-4574): UPSTREAM: <carry>: Disable upstream TLSProfile tests [#702](https://github.com/openshift/operator-framework-operator-controller/pull/702)
* [OPRUN-4577](https://issues.redhat.com/browse/OPRUN-4577): OTE: Simplify by remove option to configure tests to run outside of OCP [#703](https://github.com/openshift/operator-framework-operator-controller/pull/703)
* [OPRUN-4572](https://issues.redhat.com/browse/OPRUN-4572): Expand OTE docs with more comprehensive details [#697](https://github.com/openshift/operator-framework-operator-controller/pull/697)
* [OCPBUGS-77972](https://issues.redhat.com/browse/OCPBUGS-77972), [OCPBUGS-81452](https://issues.redhat.com/browse/OCPBUGS-81452): Synchronize From Upstream Repositories [#696](https://github.com/openshift/operator-framework-operator-controller/pull/696)
* [Full changelog](https://github.com/openshift/operator-framework-operator-controller/compare/a3e5b4ff3745e6e6f0371fc14c124089a7289e7c...be80e0c78d4e2ff3d29fd89df29dff79b00b15f6)
### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/3725a4aafba556cc24626541f5121ccbab54916a)
* [CNTRLPLANE-2449](https://issues.redhat.com/browse/CNTRLPLANE-2449): K8s 1.35 rebase [#616](https://github.com/openshift/openshift-apiserver/pull/616)
* [CNTRLPLANE-2449](https://issues.redhat.com/browse/CNTRLPLANE-2449): feat: generate OpenAPI schemas from a running openshift-apiserver instance [#645](https://github.com/openshift/openshift-apiserver/pull/645)
* [OCPBUGS-78480](https://issues.redhat.com/browse/OCPBUGS-78480): add watchlist new semantic support to project watcher [#661](https://github.com/openshift/openshift-apiserver/pull/661)
* [OCPBUGS-79070](https://issues.redhat.com/browse/OCPBUGS-79070): Fix: Preserve annotations when creating ImageStreamTag [#656](https://github.com/openshift/openshift-apiserver/pull/656)
* [OCPBUGS-84534](https://issues.redhat.com/browse/OCPBUGS-84534): fix concurrent map race in project authorization cache [#642](https://github.com/openshift/openshift-apiserver/pull/642)
* NO-ISSUE: bump github.com/moby/spdystream v0.5.0 to v0.5.1 to fix CVE-2026-35469 [#650](https://github.com/openshift/openshift-apiserver/pull/650)
* [OCPBUGS-38120](https://issues.redhat.com/browse/OCPBUGS-38120): Ensure Project delete requests are passed through admission [#632](https://github.com/openshift/openshift-apiserver/pull/632)
* NO-JIRA: Add control-plane-approvers to OWNERS [#630](https://github.com/openshift/openshift-apiserver/pull/630)
* [OCPBUGS-74511](https://issues.redhat.com/browse/OCPBUGS-74511): remove RouteExternalCertificate feature gate [#604](https://github.com/openshift/openshift-apiserver/pull/604)
* [CNTRLPLANE-3226](https://issues.redhat.com/browse/CNTRLPLANE-3226): Sync with openshift apiserver 4.22 kubernetes 1.34.1 [#629](https://github.com/openshift/openshift-apiserver/pull/629)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/56aa2d96edd725e44ddd7ff13f23e53e6c509828...3725a4aafba556cc24626541f5121ccbab54916a)
### [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager/tree/5631cf493b006cbc72a8600a7435813272d71940)
* [CNF-23051](https://issues.redhat.com/browse/CNF-23051): Migrate away from deprecated ioutil [#422](https://github.com/openshift/openshift-controller-manager/pull/422)
* NO-JIRA: Add control-plane-approvers to OWNERS [#438](https://github.com/openshift/openshift-controller-manager/pull/438)
* [Full changelog](https://github.com/openshift/openshift-controller-manager/compare/26d20feae8892f648f5b06ed3f5492fe6ffb4532...5631cf493b006cbc72a8600a7435813272d71940)
### [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics/tree/0e12f5d6df02b37b0353a747d144e8069c3d0c2a)
* [OCPBUGS-87472](https://issues.redhat.com/browse/OCPBUGS-87472): Updating openshift-state-metrics-container image to be consistent with ART for 5.0 [#134](https://github.com/openshift/openshift-state-metrics/pull/134)
* [Full changelog](https://github.com/openshift/openshift-state-metrics/compare/e71e09969f11a47c87b87c43b762ad1d01f6b04f...0e12f5d6df02b37b0353a747d144e8069c3d0c2a)
### [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack/tree/51bafa8bfb18064eae0ca9502fb4bb6c6963ff61)
* 🐛 OCPBUGS-85337: set imagePullPolicy IfNotPresent on provider workloads [#424](https://github.com/openshift/cluster-api-provider-openstack/pull/424)
* [OCPBUGS-87266](https://issues.redhat.com/browse/OCPBUGS-87266): Updating openstack-cluster-api-controllers-container image to be consistent with ART for 5.0 [#422](https://github.com/openshift/cluster-api-provider-openstack/pull/422)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#416](https://github.com/openshift/cluster-api-provider-openstack/pull/416)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#408](https://github.com/openshift/cluster-api-provider-openstack/pull/408)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.14 into main [#390](https://github.com/openshift/cluster-api-provider-openstack/pull/390)
* NO-JIRA: Update manifests generator [#411](https://github.com/openshift/cluster-api-provider-openstack/pull/411)
* [OCPBUGS-77542](https://issues.redhat.com/browse/OCPBUGS-77542): Updating openstack-cluster-api-controllers-container image to be consistent with ART for 4.22 [#399](https://github.com/openshift/cluster-api-provider-openstack/pull/399)
* [Full changelog](https://github.com/openshift/cluster-api-provider-openstack/compare/74cb5b085a21fdec9f0f8c5c1dfa3933075fb1dc...51bafa8bfb18064eae0ca9502fb4bb6c6963ff61)
### [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack/tree/6b30092b0a1196b016f4300b79c895f0e7f2e9a8)
* [OCPBUGS-77061](https://issues.redhat.com/browse/OCPBUGS-77061): Vendor Downstream CAPO [#170](https://github.com/openshift/machine-api-provider-openstack/pull/170)
* [OCPBUGS-87494](https://issues.redhat.com/browse/OCPBUGS-87494): Updating ose-machine-api-provider-openstack-container image to be consistent with ART for 5.0 [#169](https://github.com/openshift/machine-api-provider-openstack/pull/169)
* [Full changelog](https://github.com/openshift/machine-api-provider-openstack/compare/8a8c354b99ce83e3c05a91358aadec09944c2fce...6b30092b0a1196b016f4300b79c895f0e7f2e9a8)
### [openstack-resource-controller](https://github.com/openshift/openstack-resource-controller/tree/58dbc0482c144c21effee2476947889122a518eb)
* [OCPBUGS-87486](https://issues.redhat.com/browse/OCPBUGS-87486): Updating openstack-resource-controller-container image to be consistent with ART for 5.0 [#39](https://github.com/openshift/openstack-resource-controller/pull/39)
* UPSTREAM-SYNC: Merge https://github.com/k-orc/openstack-resource-controller:release-2.0 into main [#38](https://github.com/openshift/openstack-resource-controller/pull/38)
* UPSTREAM-SYNC: Sync main with latest upstream (release-2.0) [#36](https://github.com/openshift/openstack-resource-controller/pull/36)
* UPSTREAM-SYNC:Merge https://github.com/k-orc/openstack-resource-controller:release-1.0 into main [#20](https://github.com/openshift/openstack-resource-controller/pull/20)
* [Full changelog](https://github.com/openshift/openstack-resource-controller/compare/cbea7a9cab145c32e2f347be69996b649893cc22...58dbc0482c144c21effee2476947889122a518eb)
### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/56b3931de4636f7e0d212001f2074b9dddb45a8f)
* NO-ISSUE: Remove stale reviewers/approvers, add trgeiger [#1339](https://github.com/openshift/operator-framework-olm/pull/1339)
* NO-ISSUE: Synchronize From Upstream Repositories [#1337](https://github.com/openshift/operator-framework-olm/pull/1337)
* NO-ISSUE: Synchronize From Upstream Repositories [#1336](https://github.com/openshift/operator-framework-olm/pull/1336)
* [OCPBUGS-88737](https://issues.redhat.com/browse/OCPBUGS-88737): Update PSM/package server to support TLS profiles [#1328](https://github.com/openshift/operator-framework-olm/pull/1328)
* [OPRUN-4612](https://issues.redhat.com/browse/OPRUN-4612): Add E2E tests for ExperimentalListPackageCustomSchemas gRPC endpoint [#1327](https://github.com/openshift/operator-framework-olm/pull/1327)
* [TRT-2761](https://issues.redhat.com/browse/TRT-2761): Undo revert and fix applyClusterTLSProfile() [#1335](https://github.com/openshift/operator-framework-olm/pull/1335)
* [TRT-2761](https://issues.redhat.com/browse/TRT-2761): Revert #1330 "NO-ISSUE: Synchronize From Upstream Repositories" [#1334](https://github.com/openshift/operator-framework-olm/pull/1334)
* NO-ISSUE: Synchronize From Upstream Repositories [#1330](https://github.com/openshift/operator-framework-olm/pull/1330)
* NO-ISSUE: Synchronize From Upstream Repositories [#1316](https://github.com/openshift/operator-framework-olm/pull/1316)
* [OCPBUGS-88013](https://issues.redhat.com/browse/OCPBUGS-88013): Updating operator-lifecycle-manager-container image to be consistent with ART for 5.0 [#1323](https://github.com/openshift/operator-framework-olm/pull/1323)
* [OCPBUGS-88012](https://issues.redhat.com/browse/OCPBUGS-88012): Updating ose-operator-framework-tools-container image to be consistent with ART for 5.0 [#1322](https://github.com/openshift/operator-framework-olm/pull/1322)
* [OCPBUGS-88014](https://issues.redhat.com/browse/OCPBUGS-88014): Updating operator-registry-container image to be consistent with ART for 5.0 [#1324](https://github.com/openshift/operator-framework-olm/pull/1324)
* [OPRUN-4639](https://issues.redhat.com/browse/OPRUN-4639): Update to golang 1.26.3 and openshift-4.23 builders [#1317](https://github.com/openshift/operator-framework-olm/pull/1317)
* NO-ISSUE: Synchronize From Upstream Repositories [#1313](https://github.com/openshift/operator-framework-olm/pull/1313)
* NO-ISSUE: Synchronize From Upstream Repositories [#1311](https://github.com/openshift/operator-framework-olm/pull/1311)
* NO-ISSUE: Synchronize From Upstream Repositories [#1308](https://github.com/openshift/operator-framework-olm/pull/1308)
* NO-ISSUE: Synchronize From Upstream Repositories [#1307](https://github.com/openshift/operator-framework-olm/pull/1307)
* NO-ISSUE: Synchronize From Upstream Repositories [#1306](https://github.com/openshift/operator-framework-olm/pull/1306)
* NO-ISSUE: Synchronize From Upstream Repositories [#1299](https://github.com/openshift/operator-framework-olm/pull/1299)
* [OPRUN-4610](https://issues.redhat.com/browse/OPRUN-4610): Revert lifecycle server changes [#1300](https://github.com/openshift/operator-framework-olm/pull/1300)
* [OCPBUGS-54790](https://issues.redhat.com/browse/OCPBUGS-54790): Fix packageserver PDB annotation for HyperShift [#1297](https://github.com/openshift/operator-framework-olm/pull/1297)
* [OPRUN-4588](https://issues.redhat.com/browse/OPRUN-4588): use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs [#1280](https://github.com/openshift/operator-framework-olm/pull/1280)
* NO-ISSUE: Synchronize From Upstream Repositories [#1298](https://github.com/openshift/operator-framework-olm/pull/1298)
* [OPRUN-4601](https://issues.redhat.com/browse/OPRUN-4601): use resource-based RBAC for lifecycle-server auth [#1290](https://github.com/openshift/operator-framework-olm/pull/1290)
* [OCPBUGS-84642](https://issues.redhat.com/browse/OCPBUGS-84642): Synchronize From Upstream Repositories [#1291](https://github.com/openshift/operator-framework-olm/pull/1291)
* [OPRUN-4597](https://issues.redhat.com/browse/OPRUN-4597): Fix lifecycle-server readiness probe to allow empty index [#1288](https://github.com/openshift/operator-framework-olm/pull/1288)
* [OPRUN-4541](https://issues.redhat.com/browse/OPRUN-4541), [OPRUN-4544](https://issues.redhat.com/browse/OPRUN-4544): add lifecycle-server for serving FBC catalog lifecycle metadata [#1284](https://github.com/openshift/operator-framework-olm/pull/1284)
* NO-ISSUE: Synchronize From Upstream Repositories [#1286](https://github.com/openshift/operator-framework-olm/pull/1286)
* NO-ISSUE: Synchronize From Upstream Repositories [#1282](https://github.com/openshift/operator-framework-olm/pull/1282)
* NO-ISSUE: Synchronize From Upstream Repositories [#1279](https://github.com/openshift/operator-framework-olm/pull/1279)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/e627823c743797da91b4ae8a318d2420a511b752...56b3931de4636f7e0d212001f2074b9dddb45a8f)
### [operator-marketplace](https://github.com/operator-framework/operator-marketplace/tree/1b7ac84cc2c8bdef32807efa5650752a46bca96c)
* NO-ISSUE: Bump github.com/operator-framework/operator-lifecycle-manager from 0.43.0 to 0.45.0 [#761](https://github.com/operator-framework/operator-marketplace/pull/761)
* NO-ISSUE: Bump dependencies to kube 1.36 [#766](https://github.com/operator-framework/operator-marketplace/pull/766)
* [OCPBUGS-85829](https://issues.redhat.com/browse/OCPBUGS-85829): bump catalog versions to 5.0 [#756](https://github.com/operator-framework/operator-marketplace/pull/756)
* NO-ISSUE: Bump github.com/onsi/gomega from 1.42.0 to 1.42.1 [#765](https://github.com/operator-framework/operator-marketplace/pull/765)
* NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.31.0 to 2.32.0 [#764](https://github.com/operator-framework/operator-marketplace/pull/764)
* NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.29.0 to 2.31.0 [#760](https://github.com/operator-framework/operator-marketplace/pull/760)
* NO-ISSUE: Bump github.com/onsi/gomega from 1.41.0 to 1.42.0 [#763](https://github.com/operator-framework/operator-marketplace/pull/763)
* NO-ISSUE: Bump github.com/operator-framework/operator-lifecycle-manager from 0.42.0 to 0.43.0 [#755](https://github.com/operator-framework/operator-marketplace/pull/755)
* [OCPBUGS-87398](https://issues.redhat.com/browse/OCPBUGS-87398): Updating marketplace-operator-container image to be consistent with ART for 5.0 [#758](https://github.com/operator-framework/operator-marketplace/pull/758)
* [OPRUN-4642](https://issues.redhat.com/browse/OPRUN-4642): Update to golang-1.26-release-4.23 [#757](https://github.com/operator-framework/operator-marketplace/pull/757)
* [OPRUN-4628](https://issues.redhat.com/browse/OPRUN-4628): restrict dynamic version selection for default catalogsources to only apply to v5.0->v4.y [#754](https://github.com/operator-framework/operator-marketplace/pull/754)
* [OPRUN-4598](https://issues.redhat.com/browse/OPRUN-4598): dynamically resolve catalog image tag from OCP release version [#750](https://github.com/operator-framework/operator-marketplace/pull/750)
* NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.28.3 to 2.29.0 [#751](https://github.com/operator-framework/operator-marketplace/pull/751)
* NO-ISSUE: Bump github.com/onsi/gomega from 1.40.0 to 1.41.0 [#752](https://github.com/operator-framework/operator-marketplace/pull/752)
* NO-ISSUE: Bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1 [#747](https://github.com/operator-framework/operator-marketplace/pull/747)
* NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.28.1 to 2.28.3 [#746](https://github.com/operator-framework/operator-marketplace/pull/746)
* NO-ISSUE: Bump the k8s-dependencies group across 1 directory with 3 updates [#741](https://github.com/operator-framework/operator-marketplace/pull/741)
* NO-ISSUE: Bump github.com/operator-framework/operator-lifecycle-manager from 0.41.0 to 0.42.0 [#740](https://github.com/operator-framework/operator-marketplace/pull/740)
* [Full changelog](https://github.com/operator-framework/operator-marketplace/compare/38da2ef78cc429f67aea7fb4e589df21ac1ed327...1b7ac84cc2c8bdef32807efa5650752a46bca96c)
### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/88e9f0f146784e8525f6304a1f6f7c986eba2319)
* NO-JIRA: Update OWNERS File [#3288](https://github.com/openshift/ovn-kubernetes/pull/3288)
* NO-JIRA: DownStream Merge [07-02-2026] [#3279](https://github.com/openshift/ovn-kubernetes/pull/3279)
* [OCPBUGS-86223](https://issues.redhat.com/browse/OCPBUGS-86223): DownStream Merge [06-15-2026] [#3249](https://github.com/openshift/ovn-kubernetes/pull/3249)
* [CORENET-6688](https://issues.redhat.com/browse/CORENET-6688): Bump the downstream OVN package to 26.03 [#3258](https://github.com/openshift/ovn-kubernetes/pull/3258)
* [CORENET-6592](https://issues.redhat.com/browse/CORENET-6592): Promote EVPN E2Es from informing to blocking tests [#3178](https://github.com/openshift/ovn-kubernetes/pull/3178)
* [CORENET-7116](https://issues.redhat.com/browse/CORENET-7116): Fix perma-failing security presubmit job [#3218](https://github.com/openshift/ovn-kubernetes/pull/3218)
* [OCPBUGS-79408](https://issues.redhat.com/browse/OCPBUGS-79408), [OCPBUGS-86503](https://issues.redhat.com/browse/OCPBUGS-86503): DownStream Merge [06-11-2026] [#3247](https://github.com/openshift/ovn-kubernetes/pull/3247)
* NO-JIRA: Sync informing EVPN E2Es with upstream naming [#3220](https://github.com/openshift/ovn-kubernetes/pull/3220)
* [OCPBUGS-81326](https://issues.redhat.com/browse/OCPBUGS-81326), [OCPBUGS-84917](https://issues.redhat.com/browse/OCPBUGS-84917): DownStream Merge [05-19-2026] [#3195](https://github.com/openshift/ovn-kubernetes/pull/3195)
* NO-JIRA: Revert "OCPBUGS-61065: Adding ovndb-raft-functions.sh to ovnk image" [#3192](https://github.com/openshift/ovn-kubernetes/pull/3192)
* NO-JIRA: DownStream Merge [05-07-2026] [#3177](https://github.com/openshift/ovn-kubernetes/pull/3177)
* [TRT-2652](https://issues.redhat.com/browse/TRT-2652): Allow OTE info and list tests commands to work without KUBECONFIG [#3170](https://github.com/openshift/ovn-kubernetes/pull/3170)
* NO-JIRA: DownStream Merge [04-30-2026] [#3169](https://github.com/openshift/ovn-kubernetes/pull/3169)
* NO-JIRA: DownStream Merge [04-27-2026] [#3159](https://github.com/openshift/ovn-kubernetes/pull/3159)
* NO-JIRA: OTE: run EVPN external traffic tests which use random subnet for VTEP [#3148](https://github.com/openshift/ovn-kubernetes/pull/3148)
* [OCPBUGS-84037](https://issues.redhat.com/browse/OCPBUGS-84037): OTE: tolerate missing OpenShift CRDs on MicroShift [#3150](https://github.com/openshift/ovn-kubernetes/pull/3150)
* [CORENET-6537](https://issues.redhat.com/browse/CORENET-6537): OTE: Add external container support to infra provider [#2975](https://github.com/openshift/ovn-kubernetes/pull/2975)
* NO-JIRA: openshift tests: demote to informing [#3131](https://github.com/openshift/ovn-kubernetes/pull/3131)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/14b5022bad5b21334e3ad9d500763474016b2a9c...88e9f0f146784e8525f6304a1f6f7c986eba2319)
### [powervs-block-csi-driver](https://github.com/openshift/ibm-powervs-block-csi-driver/tree/e7c2c09bd0507f8bd5a6dc3921024a379f4a8af0)
* NO-JIRA: Update OWNERS_ALIASES to modify approvers and reviewers [#137](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/137)
* [OCPBUGS-87294](https://issues.redhat.com/browse/OCPBUGS-87294): Updating ose-powervs-block-csi-driver-container image to be consistent with ART for 5.0 [#136](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/136)
* [MULTIARCH-6066](https://issues.redhat.com/browse/MULTIARCH-6066): Rebase branch with upstream [#126](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/126)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver/compare/c208095b1f3ff79e2d9eed7f8045d330a8e15c08...e7c2c09bd0507f8bd5a6dc3921024a379f4a8af0)
### [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/tree/f90431bfe8ca93850450b2b24fae152d2385ca08)
* [STOR-2914](https://issues.redhat.com/browse/STOR-2914): Bump all deps for 5.0.0 [#119](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/119)
* NO-JIRA: Update OWNERS to modify approvers and reviewers [#118](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/118)
* [OCPBUGS-87386](https://issues.redhat.com/browse/OCPBUGS-87386): Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART for 5.0 [#117](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/117)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/compare/a56f9e95588f656435e2cc3b256d9782213a7813...f90431bfe8ca93850450b2b24fae152d2385ca08)
### [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs/tree/626c77c1b8c4b81b2d2f775f98f740dc09648061)
* NO-JIRA: Update OWNERS_ALIASES to modify approvers and reviewers [#105](https://github.com/openshift/cloud-provider-powervs/pull/105)
* No-Jira: Bump golang.org/x/crypto and golang.org/x/net to address security vulnerabilities [#106](https://github.com/openshift/cloud-provider-powervs/pull/106)
* [OCPBUGS-87520](https://issues.redhat.com/browse/OCPBUGS-87520): Updating ose-powervs-cloud-controller-manager-container image to be consistent with ART for 5.0 [#104](https://github.com/openshift/cloud-provider-powervs/pull/104)
* [OCPBUGS-83391](https://issues.redhat.com/browse/OCPBUGS-83391): Merge https://github.com/IBM-Cloud/cloud-provider-ibm:release-1.35 (e48649f) into main [#83](https://github.com/openshift/cloud-provider-powervs/pull/83)
* [Full changelog](https://github.com/openshift/cloud-provider-powervs/compare/766c0952fd19f8225fe59b2be8e8c8932b24ebd7...626c77c1b8c4b81b2d2f775f98f740dc09648061)
### [prom-label-proxy](https://github.com/openshift/prom-label-proxy/tree/4ab9ff73c665319352288fe0b9b9e1df71832525)
* NO-ISSUE: [bot] Bump openshift/prom-label-proxy to v0.14.0 [#398](https://github.com/openshift/prom-label-proxy/pull/398)
* [OCPBUGS-87514](https://issues.redhat.com/browse/OCPBUGS-87514): Updating prom-label-proxy-container image to be consistent with ART for 5.0 [#397](https://github.com/openshift/prom-label-proxy/pull/397)
* NO-ISSUE: [bot] Bump openshift/prom-label-proxy to v0.13.0 [#394](https://github.com/openshift/prom-label-proxy/pull/394)
* [Full changelog](https://github.com/openshift/prom-label-proxy/compare/c4c99a3071808f466ee6c3d7b7fa87108b457feb...4ab9ff73c665319352288fe0b9b9e1df71832525)
### [prometheus](https://github.com/openshift/prometheus/tree/52ee2d3abf00f3c31611cd9fff36e97cdfd28dcc)
* Bump openshift/prometheus to v3.13.1 [#347](https://github.com/openshift/prometheus/pull/347)
* NO-JIRA: [bot] Bump openshift/prometheus to v3.13.1 [#345](https://github.com/openshift/prometheus/pull/345)
* NO-JIRA: chore: revert narrow selectors detection for le/quantile labels [#344](https://github.com/openshift/prometheus/pull/344)
* [OCPBUGS-92191](https://issues.redhat.com/browse/OCPBUGS-92191): fix(tsdb): temporarily ignore Direct IO enablement errors on unsupported filesystems [#338](https://github.com/openshift/prometheus/pull/338)
* [OCPBUGS-92815](https://issues.redhat.com/browse/OCPBUGS-92815): bump golang.org/x/crypto to v0.53.0 [#334](https://github.com/openshift/prometheus/pull/334)
* Bump openshift/prometheus to v3.12.0 [#332](https://github.com/openshift/prometheus/pull/332)
* NO-JIRA: bump prometheus to v3.12.0 [#329](https://github.com/openshift/prometheus/pull/329)
* [OCPBUGS-87446](https://issues.redhat.com/browse/OCPBUGS-87446): Updating golang-github-prometheus-prometheus-container image to be consistent with ART for 5.0 [#326](https://github.com/openshift/prometheus/pull/326)
* NO-ISSUE: [bot] Bump openshift/prometheus to v3.11.3 [#318](https://github.com/openshift/prometheus/pull/318)
* NO-ISSUE: [bot] Bump openshift/prometheus to v3.11.3 [#317](https://github.com/openshift/prometheus/pull/317)
* [OCPBUGS-62118](https://issues.redhat.com/browse/OCPBUGS-62118): fix TLS client cert rotation when no CA is configured [#312](https://github.com/openshift/prometheus/pull/312)
* NO-JIRA: Upgrade Prometheus to 3.11.2 [#305](https://github.com/openshift/prometheus/pull/305)
* [Full changelog](https://github.com/openshift/prometheus/compare/e1e355916c789607fe98c8832920e2218de4bad5...52ee2d3abf00f3c31611cd9fff36e97cdfd28dcc)
### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/5434dc397b4590f2906a9cd774d711113fc9f25b)
* [OCPBUGS-99435](https://issues.redhat.com/browse/OCPBUGS-99435): embed tzdata in the alertmanager binary [#140](https://github.com/openshift/prometheus-alertmanager/pull/140)
* Bump openshift/prometheus-alertmanager to v0.33.1 [#139](https://github.com/openshift/prometheus-alertmanager/pull/139)
* NO-JIRA: bump to 0.33.0 [#138](https://github.com/openshift/prometheus-alertmanager/pull/138)
* NO-ISSUE: [bot] Bump openshift/prometheus-alertmanager to v0.32.2 [#135](https://github.com/openshift/prometheus-alertmanager/pull/135)
* [OCPBUGS-87471](https://issues.redhat.com/browse/OCPBUGS-87471): Updating golang-github-prometheus-alertmanager-container image to be consistent with ART for 5.0 [#136](https://github.com/openshift/prometheus-alertmanager/pull/136)
* NO-ISSUE: remove ui/app/dist/.build_stamp [#133](https://github.com/openshift/prometheus-alertmanager/pull/133)
* NO-ISSUE: [bot] Bump openshift/prometheus-alertmanager to v0.32.1 [#132](https://github.com/openshift/prometheus-alertmanager/pull/132)
* NO-ISSUE: Bump openshift/prometheus-alertmanager to v0.32.0 [#129](https://github.com/openshift/prometheus-alertmanager/pull/129)
* NO-ISSUE: update OWNERS [#130](https://github.com/openshift/prometheus-alertmanager/pull/130)
* [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/02dc3e9e55cf7fa0279e22762d6ace19bbc65fde...5434dc397b4590f2906a9cd774d711113fc9f25b)
### [prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator/tree/6a36acbd5ecd5a308bc81267f3b0567f93377247)
* [OCPBUGS-87481](https://issues.redhat.com/browse/OCPBUGS-87481): Updating prometheus-config-reloader-container image to be consistent with ART for 5.0 [#383](https://github.com/openshift/prometheus-operator/pull/383)
* [OCPBUGS-87527](https://issues.redhat.com/browse/OCPBUGS-87527): Updating prometheus-operator-container image to be consistent with ART for 5.0 [#384](https://github.com/openshift/prometheus-operator/pull/384)
* [OCPBUGS-87341](https://issues.redhat.com/browse/OCPBUGS-87341): Updating prometheus-operator-admission-webhook-container image to be consistent with ART for 5.0 [#382](https://github.com/openshift/prometheus-operator/pull/382)
* NO-ISSUE: [bot] Bump openshift/prometheus-operator to v0.91.0 [#380](https://github.com/openshift/prometheus-operator/pull/380)
* [Full changelog](https://github.com/openshift/prometheus-operator/compare/70e38466b9b9143f48283dab8bd0c227f35efe69...6a36acbd5ecd5a308bc81267f3b0567f93377247)
### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/6241c74e49baed25b1479c1786a6fc69b57b5a5b)
* [MON-4614](https://issues.redhat.com/browse/MON-4614): [bot] Bump openshift/node_exporter to v1.12.1 [#182](https://github.com/openshift/node_exporter/pull/182)
* [OCPBUGS-87295](https://issues.redhat.com/browse/OCPBUGS-87295): Updating golang-github-prometheus-node_exporter-container image to be consistent with ART for 5.0 [#181](https://github.com/openshift/node_exporter/pull/181)
* [OCPBUGS-83863](https://issues.redhat.com/browse/OCPBUGS-83863): Strip debug symbols from Go binaries [#180](https://github.com/openshift/node_exporter/pull/180)
* NO-JIRA: [bot] Bump openshift/node_exporter to v1.11.1 [#177](https://github.com/openshift/node_exporter/pull/177)
* [Full changelog](https://github.com/openshift/node_exporter/compare/6c4fc0126407c8404b8604faa2f1230f385b9f44...6241c74e49baed25b1479c1786a6fc69b57b5a5b)
### [rhel-coreos, rhel-coreos-10, rhel-coreos-10-extensions, rhel-coreos-extensions](https://github.com/openshift/os/tree/5ffc1da076e834332482544182c22d984dbf76d2)
* [ART-19543](https://issues.redhat.com/browse/ART-19543): Refactor extensions build to use dnf download instead of rpm-ostree compose [#1945](https://github.com/openshift/os/pull/1945)
* NO-JIRA: extensions: templatize OCP version in repo names; drop kata from extensions [#1942](https://github.com/openshift/os/pull/1942)
* NO-JIRA: Add configs for 4.23; update build-args file naming [#1941](https://github.com/openshift/os/pull/1941)
* NO-JIRA: Set io.openshift.os.streamclass label on built images [#1940](https://github.com/openshift/os/pull/1940)
* [ART-14453](https://issues.redhat.com/browse/ART-14453): Use rpm-ostree install directly in legacy build pipeline [#1935](https://github.com/openshift/os/pull/1935)
* NO-JIRA: Make build-args files use 5.0 version and revert repo names change [#1936](https://github.com/openshift/os/pull/1936)
* NO-JIRA: Update to track 5.0 [#1930](https://github.com/openshift/os/pull/1930)
* [COS-4051](https://issues.redhat.com/browse/COS-4051): tree: add `labels.json` and security OCI labels for Clair scanning [#1919](https://github.com/openshift/os/pull/1919)
* NO-JIRA: FAQ: add a composeFS entry [#1931](https://github.com/openshift/os/pull/1931)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/os/compare/f41264dc5f1c1f0a389787ecc5aaec573d485b8e...5ffc1da076e834332482544182c22d984dbf76d2)
### [route-controller-manager](https://github.com/openshift/route-controller-manager/tree/59697cf7af4517dd44e28179a57f7f35b6ea0e22)
* [NE-2767](https://issues.redhat.com/browse/NE-2767): Bump Kubernetes to 1.36.2 [#100](https://github.com/openshift/route-controller-manager/pull/100)
* [OCPBUGS-92032](https://issues.redhat.com/browse/OCPBUGS-92032): Dockerfile: Copy only build-required files in builder stage [#99](https://github.com/openshift/route-controller-manager/pull/99)
* [OCPBUGS-87336](https://issues.redhat.com/browse/OCPBUGS-87336): Updating ose-route-controller-manager-container image to be consistent with ART for 5.0 [#98](https://github.com/openshift/route-controller-manager/pull/98)
* [OCPBUGS-86886](https://issues.redhat.com/browse/OCPBUGS-86886): modernize dependency of k8s imports [#92](https://github.com/openshift/route-controller-manager/pull/92)
* [OCPBUGS-39598](https://issues.redhat.com/browse/OCPBUGS-39598): Remove all duplicate ingress IP addresses in clearPersistedAllocation [#91](https://github.com/openshift/route-controller-manager/pull/91)
* [OCPBUGS-83892](https://issues.redhat.com/browse/OCPBUGS-83892): Update grpc-go and x/net [#88](https://github.com/openshift/route-controller-manager/pull/88)
* [Full changelog](https://github.com/openshift/route-controller-manager/compare/624742d93f3a7885cf7f70985f1e23ff60da580d...59697cf7af4517dd44e28179a57f7f35b6ea0e22)
### [service-ca-operator](https://github.com/openshift/service-ca-operator/tree/e260be2b3710137012814ce9ca48f155f24f0b02)
* [OCPBUGS-87390](https://issues.redhat.com/browse/OCPBUGS-87390): Updating ose-service-ca-operator-container image to be consistent with ART for 5.0 [#361](https://github.com/openshift/service-ca-operator/pull/361)
* NO-JIRA: Bump github.com/openshift/build-machinery-go [#367](https://github.com/openshift/service-ca-operator/pull/367)
* [CNTRLPLANE-3423](https://issues.redhat.com/browse/CNTRLPLANE-3423): feat: inject centralized TLS into service-ca operand [#365](https://github.com/openshift/service-ca-operator/pull/365)
* [CNTRLPLANE-3423](https://issues.redhat.com/browse/CNTRLPLANE-3423): feat: have CVO inject the centralized TLS configuration into the operator's config [#359](https://github.com/openshift/service-ca-operator/pull/359)
* [CNTRLPLANE-3718](https://issues.redhat.com/browse/CNTRLPLANE-3718): Add AI SDLC context files [#362](https://github.com/openshift/service-ca-operator/pull/362)
* [OCPBUGS-73938](https://issues.redhat.com/browse/OCPBUGS-73938): Watch CA bundle files for changes and reload dynamically [#329](https://github.com/openshift/service-ca-operator/pull/329)
* [CNTRLPLANE-2894](https://issues.redhat.com/browse/CNTRLPLANE-2894): e2e network policy test cases [#338](https://github.com/openshift/service-ca-operator/pull/338)
* NO-JIRA: Add control-plane-approvers to OWNERS [#345](https://github.com/openshift/service-ca-operator/pull/345)
* NO-JIRA: controller/servingcerts: Align log verbosity [#323](https://github.com/openshift/service-ca-operator/pull/323)
* [Full changelog](https://github.com/openshift/service-ca-operator/compare/7b3033bba87d7b40684b66f8f44a3525433d1ac7...e260be2b3710137012814ce9ca48f155f24f0b02)
### [telemeter](https://github.com/openshift/telemeter/tree/22ba1701333f3fd26490cc15b89ddf21df3f67f6)
* [OCPBUGS-93760](https://issues.redhat.com/browse/OCPBUGS-93760): bump github.com/prometheus/prometheus [#611](https://github.com/openshift/telemeter/pull/611)
* [OCPBUGS-87222](https://issues.redhat.com/browse/OCPBUGS-87222): Updating telemeter-container image to be consistent with ART for 5.0 [#607](https://github.com/openshift/telemeter/pull/607)
* [OCPBUGS-85082](https://issues.redhat.com/browse/OCPBUGS-85082): update google.golang.org/grpc [#601](https://github.com/openshift/telemeter/pull/601)
* NO-ISSUE: add .coderabbit.yaml [#603](https://github.com/openshift/telemeter/pull/603)
* NO-ISSUE: bump golangci-lint to v2.11.3 [#602](https://github.com/openshift/telemeter/pull/602)
* NO-ISSUE: update OWNERS [#604](https://github.com/openshift/telemeter/pull/604)
* [OCPBUGS-84383](https://issues.redhat.com/browse/OCPBUGS-84383): fix(deps): bump go-jose/v3 to v3.0.5 for JWE unwrap DoS [#588](https://github.com/openshift/telemeter/pull/588)
* [Full changelog](https://github.com/openshift/telemeter/compare/d6c7dd499f7106df78aa8bfd9dee332121ab2f09...22ba1701333f3fd26490cc15b89ddf21df3f67f6)
### [tests](https://github.com/openshift/origin/tree/a7b3bba9780389699e8426c6d3f1afee8464a5ad)
* [NE-2789](https://issues.redhat.com/browse/NE-2789): Add a guard to skip IngressControllerMultipleHAProxyVersions tests if IngressController CRD lacks haproxyVersion field [#31424](https://github.com/openshift/origin/pull/31424)
* NO-JIRA: chore(extended/prometheus): reduce targets-auth skip list and handle mTLS [#31372](https://github.com/openshift/origin/pull/31372)
* NO-JIRA: Ensure Platform Prometheus targets are not scraped with insecure_skip_verify [#31373](https://github.com/openshift/origin/pull/31373)
* NO-JIRA: Add e2e test to detect named ports in NetworkPolicies [#31375](https://github.com/openshift/origin/pull/31375)
* [OCPQUAL-20](https://issues.redhat.com/browse/OCPQUAL-20): Regenerate retry allowlist from 5.0 CI data [#31411](https://github.com/openshift/origin/pull/31411)
* [OCPBUGS-87079](https://issues.redhat.com/browse/OCPBUGS-87079): Add polling and longer waits in the EgressFirewall tests to avoid flakiness [#31376](https://github.com/openshift/origin/pull/31376)
* [NE-2789](https://issues.redhat.com/browse/NE-2789): Create 5 e2e test cases to help graduate the featuregate: IngressControllerMultipleHAProxyVersions [#31392](https://github.com/openshift/origin/pull/31392)
* [OCPBUGS-85696](https://issues.redhat.com/browse/OCPBUGS-85696): Adding logs and exponential backoff on execPod [#31352](https://github.com/openshift/origin/pull/31352)
* NO-JIRA: .devcontainer: bump Fedora base image to 44 for Go 1.26 [#31413](https://github.com/openshift/origin/pull/31413)
* [CONSOLE-5209](https://issues.redhat.com/browse/CONSOLE-5209): Add e2e tests for IngressComponentRouteLabels feature gate [#31385](https://github.com/openshift/origin/pull/31385)
* [OCPNODE-4538](https://issues.redhat.com/browse/OCPNODE-4538): Add e2e tests for DRA Partitionable Devices (KEP-4815) [#31230](https://github.com/openshift/origin/pull/31230)
* [TRT-2689](https://issues.redhat.com/browse/TRT-2689): Add `verify-apm` to the `verify` target [#31379](https://github.com/openshift/origin/pull/31379)
* [OCPBUGS-99166](https://issues.redhat.com/browse/OCPBUGS-99166): wait for default ServiceAccount before creating IRI test pod [#31401](https://github.com/openshift/origin/pull/31401)
* [MCO-2371](https://issues.redhat.com/browse/MCO-2371): Add back "should match os version" test [#31301](https://github.com/openshift/origin/pull/31301)
* [AGENT-1522](https://issues.redhat.com/browse/AGENT-1522): bump InternalReleaseImage to v1 [#31294](https://github.com/openshift/origin/pull/31294)
* NO-ISSUE: Fix longrunning suite for node test cases [#31339](https://github.com/openshift/origin/pull/31339)
* NO-ISSUE: Always emit precondition validation synthetic test entry [#31388](https://github.com/openshift/origin/pull/31388)
* [OCPBUGS-98956](https://issues.redhat.com/browse/OCPBUGS-98956): use admin-client namespace creation for IRI workload test [#31394](https://github.com/openshift/origin/pull/31394)
* [OCPNODE-4055](https://issues.redhat.com/browse/OCPNODE-4055): Add Additional Storage Support - API validation test cases [#31384](https://github.com/openshift/origin/pull/31384)
* NO-ISSUE: Remove Feature:NodeSwap tag and update README selectors [#31389](https://github.com/openshift/origin/pull/31389)
* [OCPNODE-4604](https://issues.redhat.com/browse/OCPNODE-4604): allow registry.redhat.io reboot requried test [#31383](https://github.com/openshift/origin/pull/31383)
* [OCPNODE-4604](https://issues.redhat.com/browse/OCPNODE-4604): upgrade to test v1 CRIOCredentialProviderConfig [#31324](https://github.com/openshift/origin/pull/31324)
* [TRT-2689](https://issues.redhat.com/browse/TRT-2689): Add devcontainer, APM config, and agentic CI scaffolding [#31371](https://github.com/openshift/origin/pull/31371)
* [OCPBUGS-97603](https://issues.redhat.com/browse/OCPBUGS-97603): Use framework-managed namespace for workload test [#31366](https://github.com/openshift/origin/pull/31366)
* [OCPBUGS-84512](https://issues.redhat.com/browse/OCPBUGS-84512): Remove exception terminationMessagePolicy=TerminationMessageFallbackToLogsOnError [#31327](https://github.com/openshift/origin/pull/31327)
* [OCPNODE-4494](https://issues.redhat.com/browse/OCPNODE-4494): Testcase to test runc Upgrade case [#31266](https://github.com/openshift/origin/pull/31266)
* [OCPBUGS-97822](https://issues.redhat.com/browse/OCPBUGS-97822): Wait for DNS before running http2 tests [#31368](https://github.com/openshift/origin/pull/31368)
* [CNTRLPLANE-2157](https://issues.redhat.com/browse/CNTRLPLANE-2157): Migrate test cases to Project API testing KubeAPI server functionality [#31310](https://github.com/openshift/origin/pull/31310)
* [OCPNODE-4554](https://issues.redhat.com/browse/OCPNODE-4554): Automate OCP-70203: ICSP and IDMS/ITMS can coexist in cluster [#31229](https://github.com/openshift/origin/pull/31229)
* NO-JIRA: e2e: extracting fencing credentials rotation into standalone test [#31340](https://github.com/openshift/origin/pull/31340)
* NO-JIRA: Fix Flaky e2e tests - Update the Cleanup order [#31347](https://github.com/openshift/origin/pull/31347)
* [OCPNODE-4604](https://issues.redhat.com/browse/OCPNODE-4604): add quay-proxy.ci.openshift.org as alllowed to reboot requried test [#31356](https://github.com/openshift/origin/pull/31356)
* [OCPBUGS-84521](https://issues.redhat.com/browse/OCPBUGS-84521): remove openshift/cluster-machine-approver `terminationMessagePolicy` exemption [#31362](https://github.com/openshift/origin/pull/31362)
* [OCPBUGS-88742](https://issues.redhat.com/browse/OCPBUGS-88742): Fix nested container test mount check for BusyBox [#31361](https://github.com/openshift/origin/pull/31361)
* NO-ISSUE: Remove exception for OCPBUGS-45921 [#31346](https://github.com/openshift/origin/pull/31346)
* [OCPCLOUD-3010](https://issues.redhat.com/browse/OCPCLOUD-3010): Enable OTE for Cluster CAPI Operator [#31307](https://github.com/openshift/origin/pull/31307)
* [OCPNODE-4560](https://issues.redhat.com/browse/OCPNODE-4560): Migrate OCP-56266 verify kubelet/crio deletes netns when pod deleted [#31242](https://github.com/openshift/origin/pull/31242)
* [OCPBUGS-85426](https://issues.redhat.com/browse/OCPBUGS-85426): improve DCM tests to reduce flakiness in endpoints [#31173](https://github.com/openshift/origin/pull/31173)
* NO-ISSUE: monitor/haproxy: treat all-apiservers-down test as flake [#31343](https://github.com/openshift/origin/pull/31343)
* [OCPBUGS-90507](https://issues.redhat.com/browse/OCPBUGS-90507): Update CNV swap tests for mandatory drop-in directory [#31318](https://github.com/openshift/origin/pull/31318)
* [OCPQE-32077](https://issues.redhat.com/browse/OCPQE-32077): Add a monitortest for cluster region/zone/instance type autodl data [#31305](https://github.com/openshift/origin/pull/31305)
* [OCPBUGS-91825](https://issues.redhat.com/browse/OCPBUGS-91825): monitor/haproxy: tolerate install-phase apiserver bounces in all-down test [#31326](https://github.com/openshift/origin/pull/31326)
* [CNTRLPLANE-3629](https://issues.redhat.com/browse/CNTRLPLANE-3629): authentication: skip external oidc kube-apiserver configuration check when new architecture gate is enabled [#31314](https://github.com/openshift/origin/pull/31314)
* [OCPBUGS-91956](https://issues.redhat.com/browse/OCPBUGS-91956): Fix isNoOLMFeatureGateEnabled to check only the current cluster version [#31329](https://github.com/openshift/origin/pull/31329)
* [OCPBUGS-86789](https://issues.redhat.com/browse/OCPBUGS-86789): Make early request monitor test informing [#31323](https://github.com/openshift/origin/pull/31323)
* [OCPBUGS-85782](https://issues.redhat.com/browse/OCPBUGS-85782): Add extra wait after mco and cvo considers upgrade complete [#31289](https://github.com/openshift/origin/pull/31289)
* [OCPEDGE-2606](https://issues.redhat.com/browse/OCPEDGE-2606): e2e: add fencing credentials update and validation tests for dual-replica etcd [#31199](https://github.com/openshift/origin/pull/31199)
* NO-JIRA: Fix interval filtering bug in watchnodes tests [#31320](https://github.com/openshift/origin/pull/31320)
* [CNTRLPLANE-3540](https://issues.redhat.com/browse/CNTRLPLANE-3540): refactor(test/extended/tls): simplify the testing and remove duplication [#31277](https://github.com/openshift/origin/pull/31277)
* NO-JIRA:Added penetration tests important to Telco partners/customers [#31283](https://github.com/openshift/origin/pull/31283)
* [OCPBUGS-89351](https://issues.redhat.com/browse/OCPBUGS-89351): Fix flake in best-effort QoS test due to debug pods [#31312](https://github.com/openshift/origin/pull/31312)
* [TRT-2723](https://issues.redhat.com/browse/TRT-2723): Ignore NodeReady=False during a CNI rollout [#31319](https://github.com/openshift/origin/pull/31319)
* [OCPBUGS-84846](https://issues.redhat.com/browse/OCPBUGS-84846): Fix NetworkNotReady pathological event regex case mismatch [#31088](https://github.com/openshift/origin/pull/31088)
* [OCPBUGS-88719](https://issues.redhat.com/browse/OCPBUGS-88719): Use AdminPolicyBasedExternalRoute CR for external gateway test [#31293](https://github.com/openshift/origin/pull/31293)
* [OPNET-602](https://issues.redhat.com/browse/OPNET-602): Fail haproxy monitor test when log collection fails [#31292](https://github.com/openshift/origin/pull/31292)
* [OPNET-603](https://issues.redhat.com/browse/OPNET-603): Fail haproxy test when all kubeapi servers are down simultaneously [#31291](https://github.com/openshift/origin/pull/31291)
* [OPNET-601](https://issues.redhat.com/browse/OPNET-601): Add on-prem haproxy timeline to e2e interval chart [#31290](https://github.com/openshift/origin/pull/31290)
* [OCPBUGS-84500](https://issues.redhat.com/browse/OCPBUGS-84500): Update ocdebug to ssh [#31216](https://github.com/openshift/origin/pull/31216)
* [OCPNODE-4529](https://issues.redhat.com/browse/OCPNODE-4529): Migrate test case 44493 - configurable terminationGracePeriodSeconds for probes [#31170](https://github.com/openshift/origin/pull/31170)
* [AGENT-1535](https://issues.redhat.com/browse/AGENT-1535): Increase the time checking for IRI SCC uid-range [#31275](https://github.com/openshift/origin/pull/31275)
* [OCPSTRAT-3036](https://issues.redhat.com/browse/OCPSTRAT-3036): Open Deduplicate and use the jessie image [#31281](https://github.com/openshift/origin/pull/31281)
* NO-JIRA: Add Jacob and Jubitta as image approvers [#31279](https://github.com/openshift/origin/pull/31279)
* NO-JIRA: Adding minio image to allowed image [#31241](https://github.com/openshift/origin/pull/31241)
* [OCPBUGS-87001](https://issues.redhat.com/browse/OCPBUGS-87001): Update source of CAPI ImageVolumeAlreadyPresent events [#31286](https://github.com/openshift/origin/pull/31286)
* Use e2eskipper.Skipf to disable os version test until RHEL-10 switchover [#31297](https://github.com/openshift/origin/pull/31297)
* [TRT-2704](https://issues.redhat.com/browse/TRT-2704): Revert "MCO-2370: Temporarily disable the stream test" [#31295](https://github.com/openshift/origin/pull/31295)
* [MCO-2370](https://issues.redhat.com/browse/MCO-2370): Temporarily disable the stream test [#31287](https://github.com/openshift/origin/pull/31287)
* [OCPBUGS-87541](https://issues.redhat.com/browse/OCPBUGS-87541): Updating openshift-enterprise-tests-container image to be consistent with ART for 5.0 [#31265](https://github.com/openshift/origin/pull/31265)
* "OCPSTRAT-3036: Temporary 1.36 image fixes (revert in rebase PR)" [#31263](https://github.com/openshift/origin/pull/31263)
* [OCPNODE-4506](https://issues.redhat.com/browse/OCPNODE-4506), [OCPNODE-4539](https://issues.redhat.com/browse/OCPNODE-4539): Migrate ContainerRuntimeConfig tests (OCP-45351, OCP-46313) [#31153](https://github.com/openshift/origin/pull/31153)
* [OCPNODE-4516](https://issues.redhat.com/browse/OCPNODE-4516): PDB configured with 100% minAvailable - Migrate - 67564 [#31161](https://github.com/openshift/origin/pull/31161)
* [OCPBUGS-84961](https://issues.redhat.com/browse/OCPBUGS-84961): support Parents field on origin test suites [#31261](https://github.com/openshift/origin/pull/31261)
* NO-JIRA: Update hello-openshift base images from 4.16/4.17 to 4.22 [#31264](https://github.com/openshift/origin/pull/31264)
* no-jira: refactor(test/extended/tls): simplify the workflow, reduce code duplication [#31246](https://github.com/openshift/origin/pull/31246)
* [OCPBUGS-85486](https://issues.redhat.com/browse/OCPBUGS-85486): Add client retry to critical monitor test setup to avoid transient et… [#31249](https://github.com/openshift/origin/pull/31249)
* NO-JIRA: upkeep: add exception for expected disruption during tnf upgrade [#31206](https://github.com/openshift/origin/pull/31206)
* [OCPEDGE-2436](https://issues.redhat.com/browse/OCPEDGE-2436): Add is_standalone learner check test for two-node etcd disruption suite [#30950](https://github.com/openshift/origin/pull/30950)
* [OCPBUGS-86044](https://issues.redhat.com/browse/OCPBUGS-86044): Use generated names in oc adm policy SCC test [#31221](https://github.com/openshift/origin/pull/31221)
* NO-ISSUE: Automated - Update synthetic test data [#31233](https://github.com/openshift/origin/pull/31233)
* [OCPBUGS-86473](https://issues.redhat.com/browse/OCPBUGS-86473): Consolidate audit log must-gather tests to reduce parallel downloads and master node CPU pressure [#31200](https://github.com/openshift/origin/pull/31200)
* [MCO-2296](https://issues.redhat.com/browse/MCO-2296): Remove OSImageStreams v1 replace [#31256](https://github.com/openshift/origin/pull/31256)
* [TRT-2617](https://issues.redhat.com/browse/TRT-2617): Fix CPU metrics monitor node role lookup [#31252](https://github.com/openshift/origin/pull/31252)
* [MCO-2296](https://issues.redhat.com/browse/MCO-2296): OSImageStreams v1 promotion [#31211](https://github.com/openshift/origin/pull/31211)
* NO-JIRA: Clarify why Envoy pods have no CPU or memory limit [#31145](https://github.com/openshift/origin/pull/31145)
* [TRT-2673](https://issues.redhat.com/browse/TRT-2673): Filter NoExecuteTaintManager disruption from backend-disruption.json [#31248](https://github.com/openshift/origin/pull/31248)
* [OCPBUGS-86221](https://issues.redhat.com/browse/OCPBUGS-86221): update authentication operator conditions to no longer expect WellKnownReadyProgressing [#31236](https://github.com/openshift/origin/pull/31236)
* NO-JIRA: Remove fixed bugs on CO conditions (2) - 2nd try [#31207](https://github.com/openshift/origin/pull/31207)
* [AGENT-1527](https://issues.redhat.com/browse/AGENT-1527): Fix comparison of InternalReleaseImage to mirror [#31250](https://github.com/openshift/origin/pull/31250)
* Revert "CLID-589: add oc-mirror to extensionBinaries" [#31238](https://github.com/openshift/origin/pull/31238)
* [OCPBUGS-86017](https://issues.redhat.com/browse/OCPBUGS-86017): Extend image-registry single replica exception to s390x architecture [#31190](https://github.com/openshift/origin/pull/31190)
* [OCPBUGS-82501](https://issues.redhat.com/browse/OCPBUGS-82501): Fix AWS DualStack CI jobs consistently encounter 2 EgressFirewall Test Failures [#31147](https://github.com/openshift/origin/pull/31147)
* [OCPBUGS-84519](https://issues.redhat.com/browse/OCPBUGS-84519): Remove openshift-ovn-kubernetes terminationMessagePolicy exemption [#31159](https://github.com/openshift/origin/pull/31159)
* NO-ISSUE: Restrict test retries to an allowlist of test names [#31222](https://github.com/openshift/origin/pull/31222)
* [OCPBUGS-86611](https://issues.redhat.com/browse/OCPBUGS-86611): Wait for namespace initialization before creating pod [#31225](https://github.com/openshift/origin/pull/31225)
* [CNTRLPLANE-3238](https://issues.redhat.com/browse/CNTRLPLANE-3238): pathological events: bump KMS ScalingReplicaSet threshold to 120 [#31209](https://github.com/openshift/origin/pull/31209)
* NO-JIRA: Skip CO condition tests on SNO [#30775](https://github.com/openshift/origin/pull/30775)
* [CLID-589](https://issues.redhat.com/browse/CLID-589): add oc-mirror to extensionBinaries [#31006](https://github.com/openshift/origin/pull/31006)
* [OCPBUGS-59500](https://issues.redhat.com/browse/OCPBUGS-59500): pathologicalevents: fix HPA FailedGetResourceMetric allowlist [#31213](https://github.com/openshift/origin/pull/31213)
* [OCPBUGS-86225](https://issues.redhat.com/browse/OCPBUGS-86225): fix PDB AlwaysAllow test failure on IPv6-primary dualstack clusters [#31196](https://github.com/openshift/origin/pull/31196)
* [CNTRLPLANE-3428](https://issues.redhat.com/browse/CNTRLPLANE-3428): tls: add cluster-authentication-operator and operands to tested compo… [#31208](https://github.com/openshift/origin/pull/31208)
* NO-ISSUE: Automated - Update synthetic test data [#31192](https://github.com/openshift/origin/pull/31192)
* [OCPBUGS-86328](https://issues.redhat.com/browse/OCPBUGS-86328): if rhcos9-10 in the job name,update jobname test [#31198](https://github.com/openshift/origin/pull/31198)
* [OCPNODE-4535](https://issues.redhat.com/browse/OCPNODE-4535): Automate OCP-44820 change container registry config [#31182](https://github.com/openshift/origin/pull/31182)
* [OCPBUGS-85363](https://issues.redhat.com/browse/OCPBUGS-85363): Fixed flakiness of oc set image E2E tests [#31191](https://github.com/openshift/origin/pull/31191)
* [OCPNODE-4125](https://issues.redhat.com/browse/OCPNODE-4125): fix imagepolicy image config testcase [#31185](https://github.com/openshift/origin/pull/31185)
* [CNTRLPLANE-3428](https://issues.redhat.com/browse/CNTRLPLANE-3428): tls fix HyperShift guest-side CO wait and Custom profile handling [#31194](https://github.com/openshift/origin/pull/31194)
* [TRT-2669](https://issues.redhat.com/browse/TRT-2669): Revert #31112 "NO-JIRA: Remove fixed bugs on CO conditions (2)" [#31201](https://github.com/openshift/origin/pull/31201)
* [AGENT-1517](https://issues.redhat.com/browse/AGENT-1517): refactored the logic to filter IRI related MachineConfigs [#31179](https://github.com/openshift/origin/pull/31179)
* [OPRUN-4569](https://issues.redhat.com/browse/OPRUN-4569): test: remove OLMv1 OTE exceptions; scope OLMv0 exceptions to SNO [#31172](https://github.com/openshift/origin/pull/31172)
* NO-JIRA: Remove fixed bugs on CO conditions (2) [#31112](https://github.com/openshift/origin/pull/31112)
* [OCPBUGS-85378](https://issues.redhat.com/browse/OCPBUGS-85378): Fix OCP E2E test - Object count when exceed openshift.io/image-tags will ban to create new image references in the project [#31155](https://github.com/openshift/origin/pull/31155)
* NO-ISSUE: Automated - Update synthetic test data [#31181](https://github.com/openshift/origin/pull/31181)
* NO-JIRA: Fix flaky storage-admin e2e test [#31180](https://github.com/openshift/origin/pull/31180)
* [CNTRLPLANE-3428](https://issues.redhat.com/browse/CNTRLPLANE-3428): tls: introduce narrow target types and migrate test functions [#31160](https://github.com/openshift/origin/pull/31160)
* Revert "OCPBUGS-85363: Fixed flakiness of oc set image E2E tests" [#31188](https://github.com/openshift/origin/pull/31188)
* [OCPBUGS-85370](https://issues.redhat.com/browse/OCPBUGS-85370): Raise OpenStack operator watch limits [#31154](https://github.com/openshift/origin/pull/31154)
* [OCPBUGS-85363](https://issues.redhat.com/browse/OCPBUGS-85363): Fixed flakiness of oc set image E2E tests [#31152](https://github.com/openshift/origin/pull/31152)
* [OCPBUGS-85058](https://issues.redhat.com/browse/OCPBUGS-85058): monitortests: allow etcd CO blips during TNF jobs on two-node upgrades [#31138](https://github.com/openshift/origin/pull/31138)
* [OCPBUGS-85486](https://issues.redhat.com/browse/OCPBUGS-85486): stage the creation of test pods to minimize etcd impact [#31164](https://github.com/openshift/origin/pull/31164)
* [OCPNODE-4505](https://issues.redhat.com/browse/OCPNODE-4505): Automation creation of OCP-57401 [#31142](https://github.com/openshift/origin/pull/31142)
* [OCPBUGS-83623](https://issues.redhat.com/browse/OCPBUGS-83623): fix: add distruption tolerance for DualReplica (two-node) topology [#31127](https://github.com/openshift/origin/pull/31127)
* [OCPBUGS-85531](https://issues.redhat.com/browse/OCPBUGS-85531): Fixed flakiness in OCP E2E tests - oc debug image stream [#31168](https://github.com/openshift/origin/pull/31168)
* Revert "OPRUN-4569: test: remove OTE exceptions for OLM" [#31171](https://github.com/openshift/origin/pull/31171)
* [OCPNODE-4108](https://issues.redhat.com/browse/OCPNODE-4108): add E2E tests for upstream dra-example-driver [#31064](https://github.com/openshift/origin/pull/31064)
* [OPRUN-4569](https://issues.redhat.com/browse/OPRUN-4569): test: remove OTE exceptions for OLM [#31150](https://github.com/openshift/origin/pull/31150)
* [OCPEDGE-2386](https://issues.redhat.com/browse/OCPEDGE-2386): Add tnf_etcd_disruption test with 5 new etcd resilience tests. [#30880](https://github.com/openshift/origin/pull/30880)
* NO-JIRA: Improve graceful shutdown LB test output with more details of late requests [#31158](https://github.com/openshift/origin/pull/31158)
* [OCPNODE-4047](https://issues.redhat.com/browse/OCPNODE-4047): Implement kubelet TLS 1.3 via KubeletConfig on workers [#31016](https://github.com/openshift/origin/pull/31016)
* NO-ISSUE: Automated - Update synthetic test data [#31146](https://github.com/openshift/origin/pull/31146)
* [CNTRLPLANE-3374](https://issues.redhat.com/browse/CNTRLPLANE-3374): remove multus exception from monitor test [#31130](https://github.com/openshift/origin/pull/31130)
* [CNTRLPLANE-3428](https://issues.redhat.com/browse/CNTRLPLANE-3428): tls: extract annotation and ConfigMap update helpers [#31156](https://github.com/openshift/origin/pull/31156)
* [OCPBUGS-83580](https://issues.redhat.com/browse/OCPBUGS-83580): Skip dev fuse test on runc runtime [#31140](https://github.com/openshift/origin/pull/31140)
* [OCPBUGS-84516](https://issues.redhat.com/browse/OCPBUGS-84516): remove openshift-machine-config-operator exemption from terminationMessagePolicy monitor [#31120](https://github.com/openshift/origin/pull/31120)
* [CNTRLPLANE-3387](https://issues.redhat.com/browse/CNTRLPLANE-3387): Update list of pending namespaces in the required-scc monitor test [#31135](https://github.com/openshift/origin/pull/31135)
* NO-ISSUE: improve error reporting in cpumetriccollector [#31132](https://github.com/openshift/origin/pull/31132)
* no-jira: tls: deduplicate ConfigMap helpers into standalone functions [#31136](https://github.com/openshift/origin/pull/31136)
* [OCPBUGS-84500](https://issues.redhat.com/browse/OCPBUGS-84500): Verify dynamic revision bump for etcd during kernel crash [#30915](https://github.com/openshift/origin/pull/30915)
* [OCPNODE-3983](https://issues.redhat.com/browse/OCPNODE-3983): Add e2e tests for KubeletEnsureSecretPulledImages feature gate [#31102](https://github.com/openshift/origin/pull/31102)
* [OCPNODE-4381](https://issues.redhat.com/browse/OCPNODE-4381): Migrate OCP-38271 from openshift-tests-private [#30960](https://github.com/openshift/origin/pull/30960)
* [OCPBUGS-85087](https://issues.redhat.com/browse/OCPBUGS-85087): Allow OVN-Kubernetes CIDROverlap pathological events [#31131](https://github.com/openshift/origin/pull/31131)
* NO-JIRA: Increase pathological event thresholds for API server rollout scenarios [#31122](https://github.com/openshift/origin/pull/31122)
* [CNTRLPLANE-2554](https://issues.redhat.com/browse/CNTRLPLANE-2554): Add ExternalOIDCWithUpstreamParity e2e tests [#31028](https://github.com/openshift/origin/pull/31028)
* : no-jira: tls: extract injectTLSAnnotation constant [#31125](https://github.com/openshift/origin/pull/31125)
* [OCPSTRAT-3036](https://issues.redhat.com/browse/OCPSTRAT-3036): Update etcd test data for k8s 1.36 release [#31113](https://github.com/openshift/origin/pull/31113)
* [OCPNODE-4043](https://issues.redhat.com/browse/OCPNODE-4043): Fix NVIDIA DRA driver helm repo configuration [#31104](https://github.com/openshift/origin/pull/31104)
* [TRT-2644](https://issues.redhat.com/browse/TRT-2644): Run CP tests everywhere [#31094](https://github.com/openshift/origin/pull/31094)
* NO-JIRA: Remove fixed bugs on CO conditions [#31081](https://github.com/openshift/origin/pull/31081)
* [OCPBUGS-84831](https://issues.redhat.com/browse/OCPBUGS-84831): Optimize NetworkPolicy reconciliation test to reduce timeout [#31114](https://github.com/openshift/origin/pull/31114)
* NO-ISSUE: Automated - Update synthetic test data [#31109](https://github.com/openshift/origin/pull/31109)
* [OCPBUGS-84809](https://issues.redhat.com/browse/OCPBUGS-84809): Disable particular CSI tests if CSI driver is removed [#31107](https://github.com/openshift/origin/pull/31107)
* NO-JIRA: check jobname for upgrade [#31106](https://github.com/openshift/origin/pull/31106)
* [OCPBUGS-84520](https://issues.redhat.com/browse/OCPBUGS-84520): remove openshift-catalogd exemption from terminationMessagePolicy monitor [#31100](https://github.com/openshift/origin/pull/31100)
* [OCPNODE-2994](https://issues.redhat.com/browse/OCPNODE-2994): Add ArtifactVolume tests and register artifact image [#31017](https://github.com/openshift/origin/pull/31017)
* NO-ISSUE: add QSEs as approvers [#31087](https://github.com/openshift/origin/pull/31087)
* [SPLAT-2562](https://issues.redhat.com/browse/SPLAT-2562): Added 3CMO OTE binary to extensionBinary list [#31004](https://github.com/openshift/origin/pull/31004)
* [OCPCLOUD-3429](https://issues.redhat.com/browse/OCPCLOUD-3429): Ignore excessive image volume events from CAPI operator [#31093](https://github.com/openshift/origin/pull/31093)
* [TRT-2622](https://issues.redhat.com/browse/TRT-2622): copy OTE attrs to junit properties [#31052](https://github.com/openshift/origin/pull/31052)
* [OCPBUGS-83580](https://issues.redhat.com/browse/OCPBUGS-83580): Skip dev fuse test on runc runtime [#31044](https://github.com/openshift/origin/pull/31044)
* [SREP-4676](https://issues.redhat.com/browse/SREP-4676): add exception for managed cluster namespaces [#31082](https://github.com/openshift/origin/pull/31082)
* [OCPBUGS-84257](https://issues.redhat.com/browse/OCPBUGS-84257): fix openshift/network/third-party suite selecting zero tests [#31084](https://github.com/openshift/origin/pull/31084)
* [TRT-2084](https://issues.redhat.com/browse/TRT-2084): comment bugs filed for terminationMessage exemptions [#31079](https://github.com/openshift/origin/pull/31079)
* [OCPBUGS-84504](https://issues.redhat.com/browse/OCPBUGS-84504): retry transient kubeconfig read failures in GetClientConfig [#31080](https://github.com/openshift/origin/pull/31080)
* [TRT-2565](https://issues.redhat.com/browse/TRT-2565): Add simple benchmark for risk analysis HTTP requests [#30965](https://github.com/openshift/origin/pull/30965)
* NO-JIRA: Fix ListImages JSON parsing when extension binaries emit log lines [#31009](https://github.com/openshift/origin/pull/31009)
* [OCPBUGS-84255](https://issues.redhat.com/browse/OCPBUGS-84255): Fix project name error during wait [#31062](https://github.com/openshift/origin/pull/31062)
* NO-JIRA: Skip network policy cases on microshift and hypershift [#31075](https://github.com/openshift/origin/pull/31075)
* [OCPBUGS-79544](https://issues.redhat.com/browse/OCPBUGS-79544): test: add monitortest to detect pods stuck in Pending state [#31045](https://github.com/openshift/origin/pull/31045)
* [OCPBUGS-79544](https://issues.redhat.com/browse/OCPBUGS-79544): Add [Late] test to collect CRI-O goroutine dumps via SIGUSR1 [#31013](https://github.com/openshift/origin/pull/31013)
* NO-ISSUE: Automated - Update synthetic test data [#31063](https://github.com/openshift/origin/pull/31063)
* [OCPBUGS-82072](https://issues.redhat.com/browse/OCPBUGS-82072), [OCPBUGS-82077](https://issues.redhat.com/browse/OCPBUGS-82077): fix: skip unused tests for two node [#30998](https://github.com/openshift/origin/pull/30998)
* [OCPBUGS-82144](https://issues.redhat.com/browse/OCPBUGS-82144): Remove EnsureMemberRemoved from graceful shutdown test [#30981](https://github.com/openshift/origin/pull/30981)
* [OCPEDGE-2381](https://issues.redhat.com/browse/OCPEDGE-2381): Validate no WAL corruption when both nodes shutdown gracefully [#30925](https://github.com/openshift/origin/pull/30925)
* [SPLAT-2562](https://issues.redhat.com/browse/SPLAT-2562): Added VVCDO OTE binary to extensionBinary list [#31014](https://github.com/openshift/origin/pull/31014)
* NO-JIRA: harden watch loop to prevent thread exhaustion [#30956](https://github.com/openshift/origin/pull/30956)
* [OCPBUGS-84244](https://issues.redhat.com/browse/OCPBUGS-84244): cache kube client instance [#30997](https://github.com/openshift/origin/pull/30997)
* [OCPBUGS-83281](https://issues.redhat.com/browse/OCPBUGS-83281): Fix Gateway cleanup in parallel e2e test workers [#31023](https://github.com/openshift/origin/pull/31023)
* [OCPBUGS-84237](https://issues.redhat.com/browse/OCPBUGS-84237): skip on BM which has insufficient host [#31002](https://github.com/openshift/origin/pull/31002)
* [OCPBUGS-83405](https://issues.redhat.com/browse/OCPBUGS-83405): remove unnecessary exceptions from monitoring test [#30924](https://github.com/openshift/origin/pull/30924)
* NO-ISSUE: baremetal: update OWNERS [#31055](https://github.com/openshift/origin/pull/31055)
* [OTA-1977](https://issues.redhat.com/browse/OTA-1977): Skip test case updateLifecycle if the worker pool is paused [#31040](https://github.com/openshift/origin/pull/31040)
* [OCPBUGS-82160](https://issues.redhat.com/browse/OCPBUGS-82160): Skip image-registry operator tests for Libvirt platform in upgrade jobs. [#31001](https://github.com/openshift/origin/pull/31001)
* [OCPEDGE-2284](https://issues.redhat.com/browse/OCPEDGE-2284): Rename two_node directory to edge_topologies [#30623](https://github.com/openshift/origin/pull/30623)
* [OCPBUGS-83402](https://issues.redhat.com/browse/OCPBUGS-83402): Bump oc request-timeout to deflake tests [#31008](https://github.com/openshift/origin/pull/31008)
* [OCPBUGS-82304](https://issues.redhat.com/browse/OCPBUGS-82304): Add sleep to give cvo time to reconcile [#30988](https://github.com/openshift/origin/pull/30988)
* [OCPBUGS-63307](https://issues.redhat.com/browse/OCPBUGS-63307): Move imagepolicy test to disruptive long-running suite [#31043](https://github.com/openshift/origin/pull/31043)
* NO-JIRA: OVNK BGP: allow max unavailability for NNCPs on VRF-Lite test case [#31037](https://github.com/openshift/origin/pull/31037)
* [OCPBUGS-83801](https://issues.redhat.com/browse/OCPBUGS-83801): skip serial and disruptive cases from suite [#31042](https://github.com/openshift/origin/pull/31042)
* [TRT-2635](https://issues.redhat.com/browse/TRT-2635): coderabbit: enable request changes workflow [#31047](https://github.com/openshift/origin/pull/31047)
* [TRT-2084](https://issues.redhat.com/browse/TRT-2084): terminationmessagepolicy: correctly fail on violations [#30993](https://github.com/openshift/origin/pull/30993)
* [OCPBUGS-84036](https://issues.redhat.com/browse/OCPBUGS-84036): CNTRLPLANE-2751:Adding e2e network policy cases for config-operator [#30995](https://github.com/openshift/origin/pull/30995)
* [OCPEDGE-2510](https://issues.redhat.com/browse/OCPEDGE-2510): fix(two-node): bump node replacement timeouts for new node installer pods [#31005](https://github.com/openshift/origin/pull/31005)
* [OCPBUGS-81476](https://issues.redhat.com/browse/OCPBUGS-81476): Fix timeout in PinnedImages GC test [#30962](https://github.com/openshift/origin/pull/30962)
* [OCPBUGS-63307](https://issues.redhat.com/browse/OCPBUGS-63307): honor firstTimestamp annotation value [#31021](https://github.com/openshift/origin/pull/31021)
* no-jira: test/monitoring: increase load balancer readiness and curl connection timeout [#30994](https://github.com/openshift/origin/pull/30994)
* NO-JIRA: Fix UpgradeTargetPayloadImagePullSpec [#31025](https://github.com/openshift/origin/pull/31025)
* [OCPSTRAT-3082](https://issues.redhat.com/browse/OCPSTRAT-3082): TLS propagation test [#30801](https://github.com/openshift/origin/pull/30801)
* NO-JIRA: OVNK BGP: improve debug and increase NNCP timeout for VRF-Lite test case [#31022](https://github.com/openshift/origin/pull/31022)
* [OCPBUGS-83286](https://issues.redhat.com/browse/OCPBUGS-83286): Fix case-sensitive error matching in Whereabouts IP allocation test [#31012](https://github.com/openshift/origin/pull/31012)
* [OCPBUGS-83267](https://issues.redhat.com/browse/OCPBUGS-83267): Use upgrades.Skippable for Gateway API upgrade test skip logic [#31000](https://github.com/openshift/origin/pull/31000)
* [OCPEDGE-2381](https://issues.redhat.com/browse/OCPEDGE-2381): Add test to verify for backup container exists when etcd crashes [#30922](https://github.com/openshift/origin/pull/30922)
* [STOR-2807](https://issues.redhat.com/browse/STOR-2807): Add e2e test to verify CSI driver operators use service CA signed certificates [#30980](https://github.com/openshift/origin/pull/30980)
* [OCPEDGE-2381](https://issues.redhat.com/browse/OCPEDGE-2381): Verify etc pod should start with oom_score_adj as system-node-critical [#30982](https://github.com/openshift/origin/pull/30982)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/origin/compare/1a93dad027b5135d67388b359c2b12d87beae0b0...a7b3bba9780389699e8426c6d3f1afee8464a5ad)
### [thanos](https://github.com/openshift/thanos/tree/7923992496585d7471b26abbd15bfa7aaa745755)
* [OCPBUGS-97627](https://issues.redhat.com/browse/OCPBUGS-97627): [bot] Bump openshift/thanos to v0.42.2 [#194](https://github.com/openshift/thanos/pull/194)
* NO-JIRA: chore: revert narrow selectors detection for le/quantile labels [#193](https://github.com/openshift/thanos/pull/193)
* [OCPBUGS-92812](https://issues.redhat.com/browse/OCPBUGS-92812): Fix CVE-2026-39882 [#190](https://github.com/openshift/thanos/pull/190)
* [OCPBUGS-87269](https://issues.redhat.com/browse/OCPBUGS-87269): Updating ose-thanos-container image to be consistent with ART for 5.0 [#189](https://github.com/openshift/thanos/pull/189)
* [Full changelog](https://github.com/openshift/thanos/compare/5d9d0f387e5cc651470f27352b28674103bfdd77...7923992496585d7471b26abbd15bfa7aaa745755)
### [volume-data-source-validator](https://github.com/openshift/volume-data-source-validator/tree/a6c21eee63d1fae58b63d8493aeb0fd662d1c91e)
* [OCPBUGS-87381](https://issues.redhat.com/browse/OCPBUGS-87381): Updating volume-data-source-validator-container image to be consistent with ART for 5.0 [#15](https://github.com/openshift/volume-data-source-validator/pull/15)
* [Full changelog](https://github.com/openshift/volume-data-source-validator/compare/8e176cec394709cac728423cbbb6c3c914be8485...a6c21eee63d1fae58b63d8493aeb0fd662d1c91e)
### [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere/tree/a15538776eb26d20ab2969740cee25f9b4442302)
* [OCPBUGS-87278](https://issues.redhat.com/browse/OCPBUGS-87278): Updating ose-vsphere-cloud-controller-manager-container image to be consistent with ART for 5.0 [#128](https://github.com/openshift/cloud-provider-vsphere/pull/128)
* NO-JIRA: Update OWNERS [#119](https://github.com/openshift/cloud-provider-vsphere/pull/119)
* [Full changelog](https://github.com/openshift/cloud-provider-vsphere/compare/39008107b1463e3299b0d60c3ac1f7e71ad3e014...a15538776eb26d20ab2969740cee25f9b4442302)
### [vsphere-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-vsphere/tree/557fdf1a9a3540d9aa8f3a81e4a950673a416a80)
* 🚀 OCPCLOUD-3604: Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.16.1 (5b57d1d) into main [#112](https://github.com/openshift/cluster-api-provider-vsphere/pull/112)
* 🐛 OCPBUGS-85337: set imagePullPolicy IfNotPresent on provider workloads [#114](https://github.com/openshift/cluster-api-provider-vsphere/pull/114)
* [OCPBUGS-87359](https://issues.redhat.com/browse/OCPBUGS-87359): Updating ose-vsphere-cluster-api-controllers-container image to be consistent with ART for 5.0 [#113](https://github.com/openshift/cluster-api-provider-vsphere/pull/113)
* [OCPBUGS-53005](https://issues.redhat.com/browse/OCPBUGS-53005): Remove references to master branch [#111](https://github.com/openshift/cluster-api-provider-vsphere/pull/111)
* [OCPBUGS-83600](https://issues.redhat.com/browse/OCPBUGS-83600): Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.15.3 (e917f8e) into master [#107](https://github.com/openshift/cluster-api-provider-vsphere/pull/107)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#106](https://github.com/openshift/cluster-api-provider-vsphere/pull/106)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#99](https://github.com/openshift/cluster-api-provider-vsphere/pull/99)
* NO-JIRA: Update manifests generator [#100](https://github.com/openshift/cluster-api-provider-vsphere/pull/100)
* NO-JIRA: Update OWNERS [#96](https://github.com/openshift/cluster-api-provider-vsphere/pull/96)
* [Full changelog](https://github.com/openshift/cluster-api-provider-vsphere/compare/f12e50512efa829a2df97c897862c3f45c201300...557fdf1a9a3540d9aa8f3a81e4a950673a416a80)
### [vsphere-csi-driver, vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver/tree/6b18bb29fc45383c21aa6c7513d151e443aa305e)
* [STOR-2929](https://issues.redhat.com/browse/STOR-2929): Rebase openshift v3.7.1 [#187](https://github.com/openshift/vmware-vsphere-csi-driver/pull/187)
* [OCPBUGS-87286](https://issues.redhat.com/browse/OCPBUGS-87286): Updating vmware-vsphere-syncer-container image to be consistent with ART for 5.0 [#185](https://github.com/openshift/vmware-vsphere-csi-driver/pull/185)
* [OCPBUGS-87275](https://issues.redhat.com/browse/OCPBUGS-87275): Updating ose-vmware-vsphere-csi-driver-container image to be consistent with ART for 5.0 [#184](https://github.com/openshift/vmware-vsphere-csi-driver/pull/184)
* NO-ISSUE: Bump spdystream to v0.5.1 [#181](https://github.com/openshift/vmware-vsphere-csi-driver/pull/181)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver/compare/cf21e1211225e3cf6baa27bdb12ae86c5c13db39...6b18bb29fc45383c21aa6c7513d151e443aa305e)
### [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator/tree/9bf3f85fde177dc4b65ea92d08b472f6573633f8)
* [STOR-2914](https://issues.redhat.com/browse/STOR-2914): Bump all deps for 5.0.0 [#350](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/350)
* [OCPBUGS-85345](https://issues.redhat.com/browse/OCPBUGS-85345): Fixed hybrid env test to use disruptive / serial labels in title [#344](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/344)
* [OCPBUGS-87395](https://issues.redhat.com/browse/OCPBUGS-87395): Updating ose-vmware-vsphere-csi-driver-operator-container image to be consistent with ART for 5.0 [#346](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/346)
* [SPLAT-2562](https://issues.redhat.com/browse/SPLAT-2562): Created OTE extension with tests for hybrid env [#335](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/335)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver-operator/compare/d3668c9a9510f189604343e817cc79ab23367f40...9bf3f85fde177dc4b65ea92d08b472f6573633f8)
### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/b2f09a5b559ddb0a114892889f88dcff1037b2c3)
* [STOR-2914](https://issues.redhat.com/browse/STOR-2914): Bump all deps for 5.0.0 [#226](https://github.com/openshift/vsphere-problem-detector/pull/226)
* [OCPBUGS-87355](https://issues.redhat.com/browse/OCPBUGS-87355): Updating ose-vsphere-problem-detector-container image to be consistent with ART for 5.0 [#223](https://github.com/openshift/vsphere-problem-detector/pull/223)
* [CNF-23389](https://issues.redhat.com/browse/CNF-23389): mockgen deprecated: use uber-go/mock instead [#194](https://github.com/openshift/vsphere-problem-detector/pull/194)
* [OCPBUGS-79057](https://issues.redhat.com/browse/OCPBUGS-79057): Fixed compute cluster permission logic for single fd with read-only custom resourcepool [#220](https://github.com/openshift/vsphere-problem-detector/pull/220)
* [OCPBUGS-56274](https://issues.redhat.com/browse/OCPBUGS-56274): add datacenter consistency check [#212](https://github.com/openshift/vsphere-problem-detector/pull/212)
* [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/842aed3df97005839ef5deaf560abbe6486b9daf...b2f09a5b559ddb0a114892889f88dcff1037b2c3)