4.14.77

Manual Override Applied

This release was manually Accepted.

Reason: Accept unresolved, recurring CNI pod-sandbox failure risk to meet the release deadline. The same error signature appears in the source nightly and 4.16.74; deterioration relative to historical builds has not been established, but equivalent impact and harmlessness have not been proven. — https://redhat-internal.slack.com/archives/C0BLKELJMSA/p1793076181455169

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.14.77-x86_64

Qualifiers (status api):

Tests:

Blocking jobs
- upgrade Succeeded (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- upgrade-minor Failed (2 retries) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.14-e2e-aws-ovn-serial
- aws-ovn-upgrade-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.14-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- aws-sdn-upgrade-4.14-micro Failed (1 retry) periodic-ci-openshift-release-main-nightly-4.14-e2e-aws-sdn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- azure-ovn-upgrade-4.14-micro Succeeded (1 retry) periodic-ci-openshift-release-main-ci-4.14-e2e-azure-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.14-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.14-fips-payload-scan
- gcp-ovn-rt-upgrade-4.14-minor Failed (1 retry) periodic-ci-openshift-release-main-ci-4.14-upgrade-from-stable-4.13-e2e-gcp-ovn-rt-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.14-e2e-metal-ipi-ovn-ipv6
- metal-ipi-sdn-ipv4 Succeeded periodic-ci-openshift-release-main-nightly-4.14-e2e-metal-ipi-sdn-ipv4

Upgrades from:

Untested upgrades: 4.13.23, 4.13.24, 4.13.25, 4.13.26, 4.13.27, 4.13.29, 4.13.30, 4.13.31, 4.13.32, 4.13.33, 4.13.34, 4.13.35, 4.13.36, 4.13.37, 4.13.38, 4.13.39, 4.13.40, 4.13.41, 4.13.42, 4.13.43, 4.13.44, 4.13.45, 4.13.46, 4.13.47, 4.13.48, 4.13.50, 4.13.52, 4.13.53, 4.13.54, 4.13.55, 4.13.56, 4.13.57, 4.13.58, 4.13.59, 4.13.60, 4.13.61, 4.13.62, 4.13.63, 4.13.64, 4.13.65, 4.13.66, 4.13.67, 4.13.68, 4.13.69, 4.14.10, 4.14.11, 4.14.12, 4.14.13, 4.14.14, 4.14.15, 4.14.17, 4.14.18, 4.14.19, 4.14.20, 4.14.21, 4.14.22, 4.14.23, 4.14.24, 4.14.25, 4.14.26, 4.14.27, 4.14.28, 4.14.29, 4.14.3, 4.14.30, 4.14.31, 4.14.32, 4.14.33, 4.14.34, 4.14.35, 4.14.36, 4.14.37, 4.14.38, 4.14.39, 4.14.4, 4.14.40, 4.14.41, 4.14.43, 4.14.44, 4.14.45, 4.14.46, 4.14.47, 4.14.48, 4.14.49, 4.14.5, 4.14.50, 4.14.51, 4.14.52, 4.14.53, 4.14.54, 4.14.55, 4.14.56, 4.14.57, 4.14.58, 4.14.59, 4.14.6, 4.14.61, 4.14.62, 4.14.63, 4.14.64, 4.14.65, 4.14.66, 4.14.67, 4.14.68, 4.14.69, 4.14.7, 4.14.70, 4.14.71, 4.14.72, 4.14.73, 4.14.8, 4.14.9

Loading changelog, this may take a while ...

Changes from 4.14.60

Created: 2026-10-26 14:00:43 +0000 UTC

Image Digest: sha256:37f1faf5a14324a24756dd53c07e91e51616110aa5535b0c54471a43a8cf14fa

Components

Kubernetes 1.27.16
Red Hat Enterprise Linux CoreOS upgraded from 414.92.202512031525-0 to 414.92.202610242240-0 (diff)

Removed images

ovirt-csi-driver
ovirt-csi-driver-operator

Rebuilt images without code change

agent-installer-csr-approver git 54aa57eb sha256:17f7060b0479c17b736d80722a243df9ab560013a22d5ee2a56d971a1a0eaaef
agent-installer-orchestrator git 54aa57eb sha256:51954c9789d017f8fa7333e184f910f1381b7fe770e2b098cf392d0251d9e51f
agent-installer-utils git b3fa10c2 sha256:772be5dee5b5781ee1d242ee90e200d62bcf252eaacee1182248bd8283a859ea
alibaba-cloud-csi-driver git 3dc363d3 sha256:d3651409176c41e2f43fdde7cb7edf8a68d96fd4bd3c9d7c55077e17fc348c09
alibaba-disk-csi-driver-operator git 8853e6ef sha256:217796ecc73b3113d2adc281a608fbb63066cd6dd7f52a6cf7d75edf53083cbb
alibaba-machine-controllers git 27f105d3 sha256:b517594ee5cb272ee961d21a0cfbe7266ea372c631750f2d6d47bd6b2d9975f5
apiserver-network-proxy git f56c606a sha256:76e2fc5eb9571c3917df9fbb946816165d31c505463f3d588e8b409c605c8a4a
aws-cloud-controller-manager git 9a7820e8 sha256:8573bd6da7187bff395a4345f30dea176921221f8867ebf3842c59ccc948c0e1
aws-ebs-csi-driver git 4622deec sha256:b869c457e16a8e9593c0c3e1749344f2efce12056aeab72fda9c41c607c14727
aws-machine-controllers git e2bb8297 sha256:7937ed8cfc5842e505236902634c202235f73991c770939a6917e1ec57d34582
aws-pod-identity-webhook git 2c864ca0 sha256:6a8e1a20f6fa7ef80df291eaf2370f4b007d37adfa42e75e83dda7c635b29af1
azure-disk-csi-driver git 6d3558a3 sha256:943e7f4e12968b4f6239071f00fc436c8b2e99a5ef061e2910283ed4179ed9e4
azure-machine-controllers git d526284e sha256:c974d68650d188d415b731ca6f7da2b4d7d6f432aa2e86941780d025bd21c1ab
azure-workload-identity-webhook git 2cb82019 sha256:bd8ca1268591c6656578baefc05d691f949496671663398a22614a2f66717a72
baremetal-runtimecfg git 0ba9e555 sha256:ee074879ff1b63854e2e1b318e93fac3606d475b74e81d78611328b6e812334d
cloud-credential-operator git b491a819 sha256:ac23cdaf203cd1908c471fc94e942e959473553411a2302d0f542a8342fd6d2d
cloud-network-config-controller git 1bd04641 sha256:f3b7f9144f36a593878f52a8bf78e50c44c69e0a067dbbb4648aadc9fd47ba85
cluster-authentication-operator git 9203d4d5 sha256:26188a5e0bac2185232f5416aa9c3043a5e77970b8abd5e9b668ffb449344480
cluster-autoscaler git d030dbaa sha256:9b92abf1a89416f9dd890810ecdf7a0973895cffae087bfc99d4824ddf84cde2
cluster-bootstrap git 93fba13f sha256:6d7bec435e3846efe32232cb82e51d3781cb720af7a249a05b9c4f959606d7af
cluster-cloud-controller-manager-operator git 54dce160 sha256:0f7eca046fa088c78beae2d3ede3112c5fdab2ab7c45f99d4506bee4fdc80062
cluster-config-operator git 2378670a sha256:12ab862290d3f3c74d04a3e9cf0c4a321b241596a65705af385c74cd487d04ab
cluster-control-plane-machine-set-operator git 783d9dd1 sha256:aa2deb682a16fd35d929ba0ba1d30c2d84765a78e24419bab51fd331b9620f41
cluster-dns-operator git 0164e3c4 sha256:964f07917a9c1b89aca719036f18f56f38234ee7204f46c7163506c42c252ded
cluster-kube-cluster-api-operator git b287d08b sha256:b9f1cc86cb43810a5114749265f249d63dec2707e37eea1481f2803681988ebf
cluster-kube-controller-manager-operator git 4e059638 sha256:c44e5e500b510befd34bb57a33dd2cd660db843d9eef662ad2d3a89959e47d79
cluster-machine-approver git 38a758d0 sha256:54e7b2c7327e272f843ef1cab9f50b4125d5362dce84b5ea7fc6d7ec8f5477b1
cluster-node-tuning-operator git 5511c8df sha256:1cecd8fffb60e99b990db9d005e49f8719acc5d4868f335ae81d9a588342e7d0
cluster-platform-operators-manager git 08fb27e7 sha256:23827b0baa84809be82a64ed1b1b4e149030976f02f4cb8e838551f30b423f25
cluster-policy-controller git 219f6f6f sha256:93ec80119dea96fe9d63cbe38d244b039367c09bd2e55072a1571666bdf73489
cluster-update-keys git 1a7a6e22 sha256:f9feefd6fb2d278e7c765b6afb2b421daba5c48a108bc05c3b8b21525569feda
cluster-version-operator git a1bf9301 sha256:651b53fcc7a9103ea6ee30a4e51cafd72291ec1a1702484ac8dfd8577303e63f
configmap-reloader git 716a0c33 sha256:5cefcf7b94a67524f7e61132be94f462d1d301a1dfed82244c565d082666ac52
coredns git d10f7ff3 sha256:f36a91346d452712bda815824bb43aaf4ab695a204ac505fa1967f1c9e0f2309
csi-driver-shared-resource-operator git c273cd52 sha256:dc8d1eae69b4784da46ec2423e24efdad300b043b7ba364ab56c9aa87dbb5154
csi-external-attacher git 06e8ce0d sha256:9f1ba813a7cc0da14c6ec2d657141b4fd8ac45a41b09961a6bba1b3203340602
csi-external-provisioner git e18ed7f0 sha256:d0ddccb615afe6ae5f2490af645a07fb8708af0feec1907650ea46f01c55f8a6
csi-external-resizer git 59a701a4 sha256:004bcd4e41f9d109b74debce5ed85d02768554ccbcb5be047e8447ced30412a9
csi-livenessprobe git a9bcbde1 sha256:9a1d51bbd73254043eb67e74fa5852d90627dc7acd87faa0da6648dcff2c747b
csi-node-driver-registrar git 9dcaa7f5 sha256:f141401cdc0c1c77f64ab7700d8468f1928d6099cdaf32a5fb0931c04ed4c943
docker-registry git ce0483f1 sha256:480d6a8df95169c0fbd16a917711ef825eb57378ff227de1690aa0569e07fdd1
driver-toolkit git cafed17b sha256:12a16c4937201d04f443c45dcf0ce35ea2f51614d127c82dc96b9333ce92f071
egress-router-cni git 96f2f54f sha256:ab21e25b05c4c38dd500cfdef2fafbc63ac089906e371b1339ba2b3f6915188a
etcd git 5ed5044c sha256:0fd66def9f95de69878adbfdbcefc56a05e69cb9afb0e613d043bb470702f7c4
gcp-cloud-controller-manager git 09e96a91 sha256:e8e0c453ff215a73912f1d57856d118693dc9e28d0129518d11f33d85cc3e49a
gcp-pd-csi-driver git 8a626fe5 sha256:7616aeecaa32126546592da2b08ddcd5ccfa9eb530039ed18a31acb33718aa82
gcp-pd-csi-driver-operator git 95d55a04 sha256:09d4962200bc4b1fdb08064a34dc43d9192b726ffa2e82d3d68d9b0bd9956e39
ibm-cloud-controller-manager git f39488c5 sha256:5c7b5c0dc61b4751b90b32d151c587a4f1fd57c783c40322834d086ea314644e
ironic-static-ip-manager git 1b194fd1 sha256:c7c99ab829f895adda08fd50c478633dc74993bb6758ccb5fcbc5df8c1c596e7
k8s-prometheus-adapter git 801a912b sha256:47ed9c3fbd84c16f3cdafd06cba8d0a08a0f272fbf6c64a4fb09ad3ba6c63c57
keepalived-ipfailover git 03e5f407 sha256:92d29421c18d8060a7e67c896a2d95ad7e4ea84b3f161f00ba2eb9861133907c
kube-proxy git 1f611c53 sha256:f76e6cc31fbb77266b522e6a60660dfe7681a36bc8c36e5e9a3190bfaac5e994
kube-rbac-proxy git b8b82595 sha256:1b8674c0a8a995ff20f1ec0602eb3b92e84a717a03ffa37a2c7700b15c8ea0c7
kube-storage-version-migrator git b533e08c sha256:39a94b9d427876f2b9e3db9c79e607dc83ea4d13bd7d0d834fead8d849e9f63e
kuryr-cni git 8926a294 sha256:3f1c0f13c3e69b97dde47a22bd3eae5c56d49dfc3e48e50db819af9a5ec39730
kuryr-controller git 8926a294 sha256:3ed20f519fbbbb09440f51c1cd422a71a79bdc051bfb7862aeefbbe44ed62263
machine-config-operator git 00b2e0b1 sha256:61e1f36148878cf939cf7b602cea571f8d099e405e9b2e76013d6de89fe18e0e
machine-os-content sha256:1c0781020b89d7a429fa667b3591f915a0d875cc13cb9ada63d0b75e9d9a45bf
multus-admission-controller git 75d37a9c sha256:b5f8af35e1f9ee28c1fb7eef1b2caef35b115593ec2e2d1c125bcab3ca1bf8cf
multus-networkpolicy git f670647c sha256:926e2a3f780bc6f30925536d38057b244f9a6f4b971fe7e3c4a4a3c6689bbf96
multus-route-override-cni git 5965fed6 sha256:4c672658dae58972235a0efecde04a494230cd47234e40ae45e11e77a1bc6a68
multus-whereabouts-ipam-cni git f95487b0 sha256:9245418d003661d6a8748205de2d8f979aada4554e70f7d6fa3245072d3a9195
must-gather git b8585ca8 sha256:9757f98c8601552d611b12ebb1803cf1afaec9048f917ffdef1462c8a1cfdd51
network-interface-bond-cni git 29f61f6b sha256:91024c446816564ce1ae68df62cd2c777e15fa33803b03b2477e8cb65e098394
network-metrics-daemon git 84d7ac4e sha256:192344ebddd54ef3f60e64ed68c94626c3ec0fb88b3194bbdc11741c471e137d
network-tools git e79d8173 sha256:0a06ce1fcebb494f67e420717304816316144b6c0b35b3b0fdbe5f7ae01bc460
nutanix-cloud-controller-manager git 8930f295 sha256:e58ea23b1906f7286f7b602f66f10741fdc81d237ef426f3785304efde019fff
nutanix-machine-controllers git c0661680 sha256:1881ad110b4a8f00b5b38f45ace636bc6c865a964ab9c4772979c91dcafda6d7
olm-catalogd git a333cb0b sha256:18e1f4964d754f809de1e1cfd44f703632cd564255e074830ce979f14879addd
olm-operator-controller git fb6fb278 sha256:867896d50a349cbea870cba90f206d977ffd83052d538caf9e0e5ed1ef2fdb43
olm-rukpak git c9409c62 sha256:7a395bbf08d9485632e6a67edbad56c390648b0c871029a75a846eadeb23c710
openshift-controller-manager git 1c76570b sha256:a52bb32a78719b97aadd67a824935dada11fe747b07cf6eaad10c23f707fd07e
operator-marketplace git 63ccdc55 sha256:a3699419f714f8183fe2c0a8792a9c8305f16f97fba26f24d81320ea23d5beb6
ovirt-machine-controllers git 5d708631 sha256:c71c20ba24a88bacf7cae64f55ced9fe47e627b228f46c3673179069baa76c61
powervs-block-csi-driver git 988f7109 sha256:a8811c72085568aa9b7b1314dbf8b4c8d5f0da02d9ddbc132df28e5486d0e111
powervs-cloud-controller-manager git 19cf1d3f sha256:eef771bcaea575b45a32597d0d5d74cdd1c0eee32e4efb50892c3ba4da557867
rhel-coreos sha256:c42eab8e783eadfef758f7dc1cd4342515f5bafef8b31bff0e163be08a81b20a
rhel-coreos-extensions sha256:507058b10f89c99ce1edfc039d5a3596bd1537d4dde8fbe0733e1a5c4994982a
sdn git 1f611c53 sha256:05275caaa2334762d95f149b5d868c000ccb10dce5511c8b33f4a54f32b143b4
service-ca-operator git 3c3f82f7 sha256:68340228cd3923980ccf3028fe18fa6c062884cfe8234b4a03d6eca9b1138381

agent-installer-api-server

OCPBUGS-89787: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.4 #10821
MGMT-23439: Bump Go 1.18 to 1.20 and regenerate code #10042
OCPBUGS-78112: [release-4.14] NO-JIRA: hermetic 4.14 #9955
MGMT-23439: Use archived dnf repositories for CentOS Stream 8 #10018
Full changelog

agent-installer-node-agent

OCPBUGS-102504: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #1614
Full changelog

alibaba-cloud-controller-manager

OCPBUGS-102505: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #64
Full changelog

aws-cluster-api-controllers

🌱 OCPBUGS-123714: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #647
OCPBUGS-78229: [release-4.14] hermetic 4.14 #593
Full changelog

aws-ebs-csi-driver-operator

OCPBUGS-102508: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #316
OCPBUGS-67748: Updated logrus to v1.9.3 #313
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-102497: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #212
OCPBUGS-79820, OCPBUGS-79821: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.64.1-sec.1 [release-4.14] #192
Full changelog

azure-cluster-api-controllers

OCPBUGS-78178: [release-4.14] Hermetic 4.14 #366
Full changelog

azure-disk-csi-driver-operator

OCPBUGS-102495: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #131
Full changelog

azure-file-csi-driver

OCPBUGS-102494: Bump golang.org/x/net to v0.35.0-sec.4 #162
OCPBUGS-79822: Correct grpc-go patch version #169
OCPBUGS-79822: Patching openshift-sustaining/grpc-go@v1.67.3-sec.1 #150
Full changelog

azure-file-csi-driver-operator

OCPBUGS-102503: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #119
OCPBUGS-67753: Bump github.com/sirupsen/logrus to v1.9.3 #114
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-79654: Azure UPI ARM template: use storageAccountId #10435
OCPBUGS-76930: terraform/provider/google: Fixing inconsistencies with service account creation #10324
OCPBUGS-62601: update resolv.conf every time on bootstrap node #9985
Full changelog

baremetal-machine-controllers

OCPBUGS-78101: [release-4.14] fix vendor/ for hermetic migration #245
Full changelog

baremetal-operator

OCPBUGS-102514: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #521
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-102466, OCPBUGS-102524, OCPBUGS-88092, OCPBUGS-88277: Use patched x/net fork v0.35.0-sec.4 #2414
Full changelog

cluster-autoscaler-operator

OCPBUGS-102528: Bump x/net package in release-4.14 #392
Full changelog

cluster-baremetal-operator

OCPBUGS-77449: Bump github.com/go-errors/errors to v1.5.1 #564
Full changelog

cluster-capi-controllers

OCPBUGS-77974: [release-4.14] fix vendor for hermetic #265
Full changelog

cluster-capi-operator

NO-JIRA: Allow sustaining engineering to self serve dependency updates #562
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-102540: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #289
Full changelog

cluster-etcd-operator

OCPBUGS-67770: Update logrus to 1.9.3 to address CVE-2025-65637 #1548
Full changelog

cluster-image-registry-operator

OCPBUGS-67771: Bump logrus to 1.9.1 #1290
Full changelog

cluster-ingress-operator

OCPBUGS-86711: Add configuration override for X-SSL strip #1492
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-67775: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.14.z] #2045
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #626
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-67780: Bump github.com/sirupsen/logrus to v1.9.1 #141
Full changelog

cluster-monitoring-operator

NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #3106
OCPBUGS-76415: test: remove image registry e2e tests #2811
Full changelog

cluster-network-operator

OCPBUGS-113758: Manual feature backport of cert rotation for whereabouts #3139
OCPBUGS-84184: fix(hypershift): use net.JoinHostPort for URL construction #2996
OCPBUGS-78105: fix vendor for hermetic 4.14 #2913
Full changelog

cluster-olm-operator

OCPBUGS-86344: Update grpc-go to v1.64.1-sec.1 to fix CVE-2026-33186 #209
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-76593: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.14] #658
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-102558: Use patched x/net fork v0.35.0-sec.4 #448
Full changelog

cluster-samples-operator

OCPBUGS-63518: references to github.com/sclorg/django-ex.git now also refer to the branch #661
Full changelog

cluster-storage-operator

OCPBUGS-102567: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #729
OCPBUGS-87736: remove oVirt code from CSO 4.14 #711
OCPBUGS-67795: Bump logrus to v1.9.3 #655
Full changelog

console

OCPBUGS-98416: CVE-2026-59869 #16754
OCPBUGS-92716: CVE-2026-46597 openshift4/ose-console: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs [openshift-4.14.z] #16963
OCPBUGS-105794: Fix and re-enable operator-install-single-namespace e2e test #17170
Fix for OCPBUGS-92074: CVE-2026-44990 #16721
OCPBUGS-100511: Bump postcss to fix CVE-2026-45623 #17109
OCPBUGS-105791: Disable failing OLM and pipelines e2e tests to unblock CI #16956
OCPBUGS-90614: Fix JSON annotation parsing to prevent OperatorHub crash #16659
OCPBUGS-87989: [release-4.14] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16597
OCPBUGS-77116: [release-4.14] CVE-2026-26996 Bump minimatch library #16348
Fix for OCPBUGS-81595: CVE-2026-4800 #16568
OCPBUGS-88422: Bump axios to ^0.33.0 Addresses CVE-2026-44486 #16789
OCPBUGS-79434: CVE-2026-29063 Bump immutable #16329
ART-18713: pin fsevents to latest #16473
NO-JIRA: enable multi-architecture yarn builds #16424
OCPBUGS-83297: [release-4.14] openshift4/ose-console: Axios: Remote Code Execution via Prototype Pollution escalation #16311
NO-JIRA: Updating openshift-enterprise-console-container image to be consistent with ART for 4.14 #16168
CONSOLE-5011: migrate to yarn berry #16082
NO-JIRA: Bump builder image to v29 #15991
OCPBUGS-74439: Bump lodash to latest #15971
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

console-operator

OCPBUGS-102556: Use patched x/net fork v0.35.0-sec.4 #1233
OCPBUGS-77994: [release-4.14] hermetic 4.14 #1131
OCPBUGS-77994: [release-4.14] NO-JIRA: update go mod dependency for konflux #1117
Full changelog

container-networking-plugins

OCPBUGS-78286: fix vendor for hermetic 4.14 #225
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-79847: Apply code mitigations for CVE-2026-33186 #399
OCPBUGS-67800: fix CVE-2025-65637 #363
Full changelog

csi-driver-manila-operator

OCPBUGS-67801: Bump logrus #253
Full changelog

csi-driver-nfs

OCPBUGS-84929: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 to avoid go version bump and fix CVE-2026-33186 #184
Full changelog

csi-driver-shared-resource, csi-driver-shared-resource-webhook

OCPBUGS-102559: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #531
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-102570: Replace golang.org/x/net with github.com/openshift-sustaining/net v0.35.0-sec.3 #242
Full changelog

docker-builder

OCPBUGS-89417, OCPBUGS-89800, OCPBUGS-90234, OCPBUGS-92322, OCPBUGS-92552, OCPBUGS-92703: Bump golang.org/x/crypto to fix CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-46597 #545
OCPBUGS-66112: BuildConfig inline Dockerfile fails with heredoc syntax #492
Full changelog

gcp-cluster-api-controllers

OCPBUGS-78282: [release-4.14] update go mod dependency for konflux #269
Full changelog

gcp-machine-controllers

OCPBUGS-102607: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #194
OCPBUGS-79841: Bump google.golang.org/grpc to v1.79.3 #168
OCPBUGS-79841: Fix setup-envtest GCS 401 by downloading binaries directly #178
Full changelog

haproxy-router

OCPBUGS-86711: Strip X-SSL-* headers for plain HTTP #807
OCPBUGS-74947: Adding escapeHAProxySingleQuotes for sanitize [release-4.14] #782
OCPBUGS-86966: Regenerate expired test certificate for unit tests #781
Full changelog

hyperkube, pod

OCPBUGS-59473: UPSTREAM: 130047: adjusting loopback certificate validity in kube-apiserver #2364
OCPBUGS-67736, OCPBUGS-67822: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 [4.14] #2586
NO-JIRA: fix verify job failure #2584
OCPBUGS-74302: Skip E2e: attach on previously attached volumes should work #2570
OCPBUGS-59473: UPSTREAM: <carry>: disable some legacy cloud provider Azure tests #2579
Full changelog

hypershift

[release 4.14] Fix OCPBUGS-99086: CVE-2026-16242 konnectivity agent auth #9131
CNTRLPLANE-3979: Update release-4.14 Konflux pipelines to use shared pipelineRef #9196
OCPBUGS-84184: fix(cno): use brackets only for IPv6 in server URL #8370
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-79836: Bump google.golang.org/grpc to v1.79.3 #156
OCPBUGS-77212: [release-4.14] standardize build paths #126
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-102582: Use patched x/net fork v0.35.0-sec.4 #185
OCPBUGS-67825, OCPBUGS-67826: bump github.com/sirupsen/logrus to v1.9.3 #166
Full changelog

ibm-vpc-node-label-updater

OCPBUGS-102599: Bump golang.org/x/net to v0.35.0-sec.4 #63
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-102592: Replace golang.org/x/net with openshift-sustaining/net #168
OCPBUGS-115546: Fetch envtest assets from the controller-tools releases #179
OCPBUGS-67290: [release-4.14] Fix incomplete vendor/ #136
Full changelog

ibmcloud-machine-controllers

OCPBUGS-102612: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 #108
NO-JIRA: fix unit tests broken by deprecated kubebuilder-tools bucket #111
Full changelog

ironic

OCPBUGS-97989: bump openstack-ironic pin for CVE-2026-44918 fix #920
OCPBUGS-97806: bump openstack-ironic pin for CVE-2026-54423 fix(release-4.14) #879
OCPBUGS-69788: Bump eventlet version to 0.33.1-7 #765
Full changelog

ironic-agent

OCPBUGS-99891: Bump ironic-python-agent pinned commit for CVE-2026-66138 #312
OCPBUGS-96901: Replace individual package removal with a single rpm -e loop #278
OCPBUGS-69779: Bump eventlet version to 0.33.1-7 #234
Full changelog

ironic-machine-os-downloader

OCPBUGS-87171: CI image build root tag and go version in go.mod sync with ART 4.14 config #120
Full changelog

kube-state-metrics

NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #178
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-95080: OWNERS: Update component to Cloud Compute / KubeVirt Provider #81
Full changelog

kubevirt-csi-driver

OCPBUGS-83659: Bump google.golang.org/grpc to v1.79.3 #104
Full changelog

machine-os-images

OCPBUGS-87880: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #104
Full changelog

monitoring-plugin

OU-1589: [release-4.14] sanitize linkified URLs in alert annotations #1376
OCPBUGS-127151: Replace react-linkify to fix CVE-2026-59887 #1315
NO-JIRA: [release-4.14] Sanitize alert runbook URLs #1294
OCPBUGS-74442: [release-4.14] fix: upgrade lodash to remove vulnerable code #906
OCPBUGS-78495: fix for CVE-2025-69873 #851
Full changelog

multus-cni

OCPBUGS-85381: Sanitize bracketed hostnames in kubeconfig server URLs #295
Bump Go to 1.21 and fix CI build root image #293
OCPBUGS-85253: Fix server url in kubeconfig #287
Full changelog

oauth-apiserver

OCPBUGS-74926: bump kubernetes-apiserver to pick up loopback cert expiration update #174
NO-JIRA: (chore): update OWNERS #176
Full changelog

oauth-proxy

OCPBUGS-112093: bugfix: rewrite open redirect strings to ‘/’ #388
Full changelog

oauth-server

OCPBUGS-87064: bugfix: default to english when Accept-Language header contains more than 1000 underscores #276
Full changelog

oc-mirror

OCPBUGS-129616: v1 accept catalog root entries and relative symlink targets #1582
Full changelog

openshift-apiserver

OCPBUGS-82649: Address CVE-2026-35469 #659
OCPBUGS-74924: bump kubernetes-apiserver to pick up loopback cert expiration update #602
OCPBUGS-76483: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.14] #612
Full changelog

openshift-state-metrics

NO-ISSUE: synchronize OWNERS from main branch #148
OCPBUGS-102633: CVE-2026-33814 openshift4/ose-openshift-state-metrics-rhel8:Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.14.z] #136
Full changelog

openstack-cinder-csi-driver-operator

OCPBUGS-67853: Bump logrus #189
Full changelog

openstack-machine-api-provider

OCPBUGS-78172: hermetic 4.14 #165
Full changelog

operator-lifecycle-manager, operator-registry

OCPBUGS-102630: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #1373
OCPBUGS-87896, OCPBUGS-87899: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.64.1-sec.1 [release-4.14] #1326
OCPBUGS-86253: Drop github.com/distribution/distribution dep #1304
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-97816: External gateway: Remove routes for external gateway pods in terminating or not ready state #3286
CORENET-6055, OCPBUGS-78982: [release-4.14] Dockerfile: Unpin OVN and consume the latest from FDP #3073
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-67860: Fix CVE-2025-65637 by bumping logrus to v1.9.1 #100
Full changelog

powervs-machine-controllers

OCPBUGS-78039: hermetic 4.14 #136
Full changelog

prom-label-proxy

NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #405
Full changelog

prometheus

OCPBUGS-102651: Use patched x/net fork v0.35.0-sec.4 #376
NO-ISSUE: synchronize OWNERS from main branch #390
OCPBUGS-88588: remote: validate snappy decoded length before allocation in read endpoint #353
OCPBUGS-86878: Fix the inconsistent vendor directory #336
OCPBUGS-86878: Bump google.golang.org/grpc #323
Full changelog

prometheus-alertmanager

OCPBUGS-98172: bump github.com/hashicorp/memberlist to a forked version to fix CVE-2026-14362 #205
NO-JIRA: synchronize OWNERS with main #200
OCPBUGS-100361: Set testdata CA expiry to 20 years from issue date (#4112) #147
OCPBUGS-77837: Include go-verify-deps expected files in gitignore #121
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

NO-ISSUE: synchronize OWNERS from main branch #417
OCPBUGS-102650: Fix CVE-2026-33814 #406
Full changelog

prometheus-node-exporter

OCPBUGS-102636: Use patched x/net fork v0.35.0-sec.4 #192
NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #204
Full changelog

route-controller-manager

OCPBUGS-86883: [release-4.14] bump google.golang.org/grpc to v1.64.1-sec.1 #94
Full changelog

telemeter

NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #625
Full changelog

tests

OCPBUGS-130860: stage the creation of test pods to minimize etcd impact #31744
OCPBUGS-74302: Skip E2e: attach on previously attached volumes should work #30727
Full changelog

thanos

NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #219
OCPBUGS-67876: CVE-2025-65637 Update sirupsen/logrus to 1.9.3 #167
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-78031: hermetic migration 4.14 #109
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-78023: hermetic migration 4.14 #88
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-79856: Bump Bump google.golang.org/grpc #179
OCPBUGS-67880: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #160
Full changelog

vsphere-csi-driver-operator

OCPBUGS-67879, OCPBUGS-67885: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.9.3 #325
Full changelog

vsphere-problem-detector

OCPBUGS-102657: Bump golang.org/x/net to v0.35.0-sec.4 #237
OCPBUGS-67891: bump github.com/sirupsen/logrus to v1.9.3 #202
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github