4.15.71

Manual Override Applied

This release was manually Accepted.

Reason: Operator approved delivery of critical fixes: exact AWS 4.14.78-to-4.15.71 upgrade and GCP upgrades succeeded; no new regression established. API and machine-config availability failures remain acknowledged residual risk. — https://redhat-internal.slack.com/archives/C0BLKELJMSA/p1794211371469279

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.15.71-x86_64

Qualifiers (status api):

Tests:

Blocking jobs
- upgrade Failed (2 retries) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Failed (2 retries) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial Succeeded (1 retry) periodic-ci-openshift-release-main-nightly-4.15-e2e-aws-ovn-serial
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- aws-ovn-upgrade-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.15-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- aws-sdn-upgrade-4.15-micro Failed (1 retry) periodic-ci-openshift-release-main-nightly-4.15-e2e-aws-sdn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- azure-ovn-upgrade-4.15-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.15-e2e-azure-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- driver-toolkit Succeeded (1 retry) periodic-ci-openshift-release-main-nightly-4.15-e2e-aws-driver-toolkit
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- fips-scan Succeeded (1 retry) periodic-ci-openshift-release-main-nightly-4.15-fips-payload-scan
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- gcp-ovn-rt-upgrade-4.15-minor Succeeded (1 retry) periodic-ci-openshift-release-main-ci-4.15-upgrade-from-stable-4.14-e2e-gcp-ovn-rt-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- metal-ipi-ovn-dualstack Succeeded (1 retry) periodic-ci-openshift-release-main-nightly-4.15-e2e-metal-ipi-ovn-dualstack
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- metal-ipi-ovn-ipv6 Failed (1 retry) periodic-ci-openshift-release-main-nightly-4.15-e2e-metal-ipi-ovn-ipv6
  - Attempt 1 Failed
  - Attempt 2 Failed
- metal-ipi-sdn-ipv4 Failed (1 retry) periodic-ci-openshift-release-main-nightly-4.15-e2e-metal-ipi-sdn-ipv4
  - Attempt 1 Failed
  - Attempt 2 Failed

Upgrades from:

Untested upgrades: 4.14.19, 4.14.20, 4.14.21, 4.14.23, 4.14.24, 4.14.25, 4.14.26, 4.14.27, 4.14.28, 4.14.29, 4.14.30, 4.14.31, 4.14.32, 4.14.33, 4.14.34, 4.14.35, 4.14.36, 4.14.37, 4.14.39, 4.14.40, 4.14.41, 4.14.42, 4.14.43, 4.14.44, 4.14.45, 4.14.46, 4.14.47, 4.14.48, 4.14.49, 4.14.50, 4.14.51, 4.14.52, 4.14.53, 4.14.54, 4.14.55, 4.14.56, 4.14.57, 4.14.58, 4.14.59, 4.14.60, 4.14.61, 4.14.62, 4.14.63, 4.14.64, 4.14.66, 4.14.67, 4.14.68, 4.14.69, 4.14.70, 4.14.71, 4.14.72, 4.14.73, 4.14.74, 4.14.75, 4.15.10, 4.15.11, 4.15.12, 4.15.13, 4.15.14, 4.15.15, 4.15.16, 4.15.17, 4.15.18, 4.15.19, 4.15.20, 4.15.21, 4.15.22, 4.15.23, 4.15.24, 4.15.25, 4.15.26, 4.15.27, 4.15.28, 4.15.29, 4.15.3, 4.15.30, 4.15.31, 4.15.32, 4.15.33, 4.15.34, 4.15.35, 4.15.36, 4.15.37, 4.15.38, 4.15.4, 4.15.40, 4.15.41, 4.15.42, 4.15.44, 4.15.45, 4.15.46, 4.15.47, 4.15.48, 4.15.5, 4.15.50, 4.15.51, 4.15.52, 4.15.53, 4.15.54, 4.15.55, 4.15.56, 4.15.57, 4.15.58, 4.15.59, 4.15.6, 4.15.60, 4.15.61, 4.15.62, 4.15.63, 4.15.64, 4.15.65, 4.15.66, 4.15.67, 4.15.7, 4.15.8, 4.15.9

4.15.70 (changes) - F F F F F F F F F S
4.15.69 (changes) - Failed
4.15.68 (changes) - Failed
4.15.49 (changes) - Success
4.15.43 (changes) - Failed
4.15.39 - Failed
4.15.2 (changes) - Success
4.15.1 (changes) - Failed
4.15.0 (changes) - Failed
4.14.78 (changes) - F F F F F
4.14.77 (changes) - Failed
4.14.76 (changes) - Failed
4.14.65 (changes) - Failed
4.14.38 (changes) - Failed
4.14.22 (changes) - Failed
4.14.18 (changes) - Failed
4.14.17 (changes) - Failed
4.14.16 (changes) - Failed
4.14.0-0.nightly-2026-11-07-203210 (changes) - Failed Success

Upgrades to:

4.16.75 (changes) - Failed

Loading changelog, this may take a while ...

Changes from 4.15.39

Created: 2026-11-08 23:57:22 +0000 UTC

Image Digest: sha256:f38b4b30160584e04166a69480438f34538cb8ad2dbc2db5a0efb0fa34e99af0

Components

Kubernetes upgraded from 1.28.14 to 1.28.15
Red Hat Enterprise Linux CoreOS upgraded from 415.92.202411201723-0 to 415.92.202611051005-0 (diff)

Removed images

ovirt-csi-driver
ovirt-csi-driver-operator
ovirt-machine-controllers

Rebuilt images without code change

agent-installer-utils git 33b7d855 sha256:6ea822ced093386e9cab8bb20052775630fad30c33d3107729336d56b984af9c
alibaba-disk-csi-driver-operator git 41b367ae sha256:5807b98ba550a228bae4cb3eb81ce2352d1d3c6744a76450e913f38345cd451a
alibaba-machine-controllers git f7f5eed8 sha256:fc5f0391564f79e78ba7783b5775479811383cce937300a3a80c8bcb07cec6b0
apiserver-network-proxy git adccbd5c sha256:a7dc0ad378a85d5aa4e4debc3bececd0675c69a70c19349340a47b0834f21068
aws-ebs-csi-driver git 7043c1cc sha256:3e12654286e12b5c05ae3fa8b3f0b0f3f45e3be34e9d91c08fd59d9128ccd35f
aws-pod-identity-webhook git 13385034 sha256:0e1b1f216a90ace8721d0ac64416134027704f1b39b5e5b5ebfa1dd38d5c5d16
azure-disk-csi-driver git dcb7e1c7 sha256:9a52a7c67af6fa5de53ab368412cdabe74a72cb07ebc19e6c3eab73c68bbcb30
baremetal-runtimecfg git 1fbb2c0c sha256:4005b970da93c0144bae6e921761f814c3200b5224efcf6f82e1eaa923c64f7e
cloud-network-config-controller git 6864da06 sha256:8b428083a0ab8e3ed0de3dbb6d997b22721537953aa50d8db63133490cda569a
cluster-bootstrap git 0849c462 sha256:fc33204cbdde8a47f74c48a6183ffcd67ff3c17a68f4f5b69a5fab8b5852cf89
cluster-capi-controllers git 2053e13c sha256:ceb31067f7d13a3b3115c839850cc8242f9a22cfbadebb6c4adf6c2ef7b22810
cluster-config-api git 0a58f8c3 sha256:ee11e86048a832887d49711298853442a3bdaad5aa7a8757f824f060a3842a36
cluster-config-operator git 0b4c69fd sha256:ea0e0514a6cd3296d52b41437096c5705a6c0f12da68b6768bafce8fd6845c76
cluster-kube-cluster-api-operator git 128d8e08 sha256:e888a1b0e601e4b47f6202721fa31aa8d0929331dbbb03165106fcb85fa6dc2f
cluster-platform-operators-manager git 37a0a919 sha256:85db24ab428e888254b975ea729808badf0be470d108d6f7a999e278238084bc
cluster-policy-controller git cc48f315 sha256:e30557be670bd6a685feeebc18789795fe8a1ad0291045247e330648ba54d94c
cluster-update-keys git 802233d8 sha256:f6a80728169ee801a6db1291c56fc4c59feb90dc3bf4cb373710bd7887a882c1
configmap-reloader git 617398f5 sha256:95b40a4edc518ea7864f11f7590ed78a0b1b135714371a7c80d2f4f1ff71158e
csi-driver-shared-resource git 260a085a sha256:bd5db4288c45b14c8e040d576858b93b0bf4336ca3e6348b274e51f8f02d6c97
csi-driver-shared-resource-operator git 8d017b7f sha256:3df4be424029358662fd5640cafe98e8a4218f3925cbcd4386bf455e52acfeef
csi-driver-shared-resource-webhook git 260a085a sha256:6f9529dcf0c09a7a639ad8099f2ab3d02f558cf9c087acf3f197dfc9cfb03f02
csi-external-provisioner git ce5a1a33 sha256:cd17c4e1cfb90215cacdc7e074beb9e507de8f2f63f916e97b2acbd294e0613f
csi-livenessprobe git 240bb8c0 sha256:0a3e479529bf3704c256dd2f81039b068f1d4b74a505a7debcea38474a9a366f
csi-node-driver-registrar git 9005584e sha256:1aaf9ef5aee46a848e6d442fe11d28ba31bc47ebe408c8a63d993ceca58f1b65
driver-toolkit git 7a448c2e sha256:f18c5bde512dddb75b35dc9534cf6c81d9f2436a182927da643cd6aeca0c64bb
egress-router-cni git f8ec690b sha256:9e7c9b7c655e4191b9e6a871a80493d4644933f3604433d3dd2ef4d441732e2c
etcd git a7005ef1 sha256:648dd59754d18097f32d7e21c7a62c292aeff553503c5a35ff536ab20e73219b
gcp-cloud-controller-manager git fc50272a sha256:5368af186ba1ccdc2ca5f2fb889f23c021fb4b7d941dfe415582704da1fce34f
keepalived-ipfailover git 87c23b5a sha256:b14bcbfe21bb0849e747dec542b04ce4e3ff6984b71ac764cbf41fd94d59a315
kube-rbac-proxy git 9308e7f2 sha256:ef471676dc66764f5cdf30a1547260c5271cc241154b4af70adae5040abab9bb
machine-os-content sha256:3aa5693113e6db09400a9ac2506963ded33da9eb4bea93db87141ee7ba915af6
multus-networkpolicy git b377b4b5 sha256:1f21d5458c808ed6a25df5d6cdc9de935634471c570513e9988782b74129adad
multus-route-override-cni git 1ccafc34 sha256:3bf9616a5e115503fc48449b89bb3a21784b0bdb59e9247da5643695cbd07368
network-interface-bond-cni git f91decaa sha256:18ec1ce73b758997c6a1a19c2714cd6e4bf1a0355f98db9045c9777acd21d8eb
network-tools git 17536c8d sha256:760d01bbdb64a0ae6c9e8aff985a4838ef0d6f0a6b89db8d1f33df9c0203f895
nutanix-cloud-controller-manager git 040d4e01 sha256:b1558b7aba6f3134f414017d5c7fce7eaff8b1e43366a1e7cb6b74a605d4dae1
olm-catalogd git 035d3835 sha256:4ae266fba861cfb08bbb3b0afe35a3df3726c7e9d4e908fa83954a9d597ccb36
olm-operator-controller git 303b954f sha256:7b2309e652deff79e3805d15c2f8a85e1f3c231842550bc5ec671c6427d30513
olm-rukpak git 5b09cd44 sha256:e5d4a1f8049bdbdafc987489736e8b8552a9d954679ee42cebc712b9eb8d81c0
openstack-cluster-api-controllers git 232472ea sha256:db1e381844bcfb5f01161dc5e3279306138ee7bddbb4676f0b50c96fb10cfc33
powervs-cloud-controller-manager git 1d6a7ed9 sha256:3e56562c01a833e2b12cc898d4f7b8331837db3e70b41c788c423f35de1c58cf
rhel-coreos sha256:3c7f91a44117a3045c9d5d4b774cdeefec690dd6721ff2eb456173ce05b10c35
rhel-coreos-extensions sha256:00d5f4ae0c741166eb0dbdcfdb8a30993a5ed0418bd8466930ba8620fc4ad7e6
telemeter git 14489f7d sha256:bd84baa9f5b30d159f6673df242d97242f554427c86aac1ac6a3fd435ebb7394
thanos git 66161ad4 sha256:aa2668606184952be40720b82c63df51414849576676759eb62509aa78920f92

agent-installer-api-server

OCPBUGS-89785: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.4 #10820
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-102698: Use patched x/net fork v0.35.0-sec.4 #2367
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-node-agent

OCPBUGS-102685: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #1615
run go mod tidy / vendor #1020
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

alibaba-cloud-controller-manager

OCPBUGS-102693: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #63
Full changelog

alibaba-cloud-csi-driver

OCPBUGS-67910: Bump github.com/sirupsen/logrus to v1.8.3 #47
Full changelog

aws-cloud-controller-manager

OCPBUGS-102874: Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #176
OCPBUGS-88139: replace golang.org/x/net with sustaining fork v0.35.0-sec.4 #179
Full changelog

aws-cluster-api-controllers

OCPBUGS-102702: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #655
🌱 OCPBUGS-123713: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #646
OCPBUGS-78228: [release-4.15] hermetic 4.15 #592
OCPBUGS-61943: UPSTREAM <carry>: revert: Only tag NetworkInterfaces in RunInstances if IAM Allows It #573
OCPBUGS-58668, OCPBUGS-58673: bump github.com/golang/glog to v1.2.5 #562
Full changelog

aws-ebs-csi-driver-operator

OCPBUGS-102714: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #614
OCPBUGS-67913: Bumped logrus to 1.9.3 #492
Full changelog

aws-machine-controllers

OCPBUGS-63141: client: re-use a single file for building the session instead of randomly named files #153
OCPBUGS-63141: revert: client: re-use a single file for building the session instead of randomly named files #150
OCPBUGS-63141: client: re-use a single file for building the session instead of randomly named files #143
OCPBUGS-47680: fix Associate*IpAddress flag on launch EC2 #122
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-88144: Replace golang.org/x/net with sustaining fork v0.35.0-sec.4 to address CVE-2026-39821 #217
OCPBUGS-102708, OCPBUGS-102879: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #211
OCPBUGS-79916, OCPBUGS-85634, OCPBUGS-85637: Bump google.golang.org/grpc to v1.79.3 #187
Full changelog

azure-cluster-api-controllers

OCPBUGS-78177: [release-4.15] update go mod dependency for konflux #365
Full changelog

azure-disk-csi-driver-operator

OCPBUGS-102724: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #130
Full changelog

azure-file-csi-driver

OCPBUGS-102709: Bump golang.org/x/net to v0.35.0-sec.4 #161
UPSTREAM: 3221: OCPBUGS-92749: Bump golang.org/x/crypto to v0.33.0-sec.5 #166
OCPBUGS-79874: Bump google.golang.org/grpc to v1.79.3 #131
ART-13080: Regenerate go.mod to fix build failure #94
Full changelog

azure-file-csi-driver-operator

OCPBUGS-102716: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #120
OCPBUGS-67918: Bump github.com/sirupsen/logrus to v1.9.3 #113
OCPBUGS-60544: add tag matching to Azure File storage class #110
Full changelog

azure-machine-controllers

OCPBUGS-102803: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #216
OCPBUGS-130942: Fix unit tests #224
OCPBUGS-56657: Fix failure when attempting to modify immutable availabilitySet #150
OCPBUGS-53226: dynamically setting the amount of fault domains #134
Full changelog

azure-workload-identity-webhook

OCPBUGS-53794: github.com/golang-jwt/jwt/v4 v4.5.2 #34
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

no-jira: upi: install gcloud 447.0.0 from versioned archive #10999
OCPBUGS-102719: Bump golang.org/x/net to v0.35.0-sec.4 #11011
OCPBUGS-89836, OCPBUGS-92734: Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.33.0-sec.5 to address CVE-2026-39829, CVE-2026-46597 #10952
OCPBUGS-127709: Update gcloud version to one that can be found #10920
OCPBUGS-79036: Azure UPI ARM template: use storageAccountId #10418
OCPBUGS-76929: terraform/provider/google: Fixing GCP inconsistencies present with the service account creation #10316
OCPBUGS-42554: only allow a single network in failure domain topology #9060
OCPBUGS-62849: Release 4.15 bump terraform provider azurerm #10007
OCPBUGS-62410: Make swift containers removal not fatal for UPI. #9978
OCPBUGS-60497: update resolv.conf every time on bootstrap node #9885
OCPBUGS-39416: OpenStack: Install CI dependencies from rpm #9103
OCPBUGS-54353: aws/edge/byovpc: tag edge subnets with shared value #9612
OCPBUGS-54367: IBMCloud: Move to IBM TF openshift fork #9614
OCPBUGS-45961: Update upi references to api-internal #9298
OCPBUGS-50994: Bump terraform-provider-google version to v5.37.0 to fix consistent issues during cluster creation #9509
OCPBUGS-41815: Validate MTU for custom network #9294
OCPBUGS-28706: [azure] update tested x86 instance type on 4.15 #7966
OCPBUGS-47716: [release-4.15] Power VS: Create region-zone-sysType hierarchy #9340
OCPBUGS-44259: IBMCloud: Ignore failed VPC regions #9183
ARO-12457: Include bootstrap docker config file in go module #9260
OCPBUGS-45207: add chrony.conf file when additional NTP sources are configured #9251
CORS-3753: Allow mocking of the Azure client everywhere #9221
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

baremetal-machine-controllers

OCPBUGS-78100: [release-4.15] fix vendor/ for hermetic migration #244
OCPBUGS-46641: Bump x/net to 0.33.0 #227
Full changelog

baremetal-operator

OCPBUGS-53336: BMO can expose any secret via BMCEventSubscription CRD #408
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-102683, OCPBUGS-102721, OCPBUGS-88167, OCPBUGS-88282, OCPBUGS-90959: Use patched x/net fork v0.35.0-sec.4 #2415
Full changelog

cloud-credential-operator

OCPBUGS-60974: ccoctl: aws to use proper issuer url on subsequent runs #910
OCPBUGS-58678: github.com/golang/glog v1.2.5 #894
OCPBUGS-53417: github.com/golang/glog v1.2.4 #844
OCPBUGS-53818: update github.com/golang-jwt/jwt #840
OCPBUGS-51540: Ignore SNYK-GOLANG-GOLANGORGXOAUTH2JWS-8749594 due to not being affected #833
OCPBUGS-47068: golang.org/x/net v0.33.0 #806
OCPBUGS-45940: Add AWS region to aws-pod-identity-webhook #802
OCPBUGS-45008: Add retry to ccoctl gcp create functions #795
OCPBUGS-45003: github.com/golang-jwt/jwt/v4 v4.5.1 #784
Full changelog

cluster-authentication-operator

OCPBUGS-102735: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #992
OCPBUGS-132017: test/e2e: pin Keycloak IdP test image to 24.0 #1033
Full changelog

cluster-autoscaler

OCPBUGS-45149: [release-4.15] VPA: Update OWNERS file #326
Full changelog

cluster-autoscaler-operator

OCPBUGS-102738: Bump x/net package in release-4.15 #391
Full changelog

cluster-baremetal-operator

OCPBUGS-77448: Bump github.com/go-errors/errors to v1.5.1 #563
OCPBUGS-44046: SCC-pinning for metal3-baremetal-operator #454
Full changelog

cluster-capi-operator

NO-JIRA: Allow sustaining engineering to self serve dependency updates #561
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-102730: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #516
OCPBUGS-63169: ccm: disable unused secure-serving port and webhook #424
Full changelog

cluster-control-plane-machine-set-operator

OCPBUGS-45839: relax validation on delete and if failureDomains not configured #336
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-102745: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #290
Full changelog

cluster-dns-operator

OCPBUGS-102734: Use patched x/net fork v0.35.0-sec.4 #492
OCPBUGS-52499: [release-4.15] Add runbook_url for CoreDNSErrorsHigh #432
Full changelog

cluster-etcd-operator

OCPBUGS-102736: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #1698
OCPBUGS-67931: Update logrus to 1.9.3 to address CVE-2025-65637 #1547
OCPBUGS-53506: fix CVE-2025-30204 #1404
Full changelog

cluster-image-registry-operator

OCPBUGS-67932: Bump logrus to 1.9.1 #1289
OCPBUGS-53866: bump github.com/golang-jwt/jwt #1220
OCPBUGS-51596: bump golang.org/x/oauth2 #1211
OCPBUGS-51264: ensure that storage names don’t end in dashes #1183
Full changelog

cluster-ingress-operator

OCPBUGS-102733: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1574
OCPBUGS-86712: Add configuration override for X-SSL strip #1491
OCPBUGS-49392: Block Upgrades in release 4.15 for CA-Signed Certs Using SHA1 #1172
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-67937: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-rhel9-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.15.z] #2044
OCPBUGS-50661: Increase waitForFallbackDegradedConditionTimeout #1806
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-102747: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #964
OCPBUGS-67987: CVE-2025-65637 openshift4/ose-kube-proxy-rhel9: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.15.z] #910
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #625
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-67942: Bump github.com/sirupsen/logrus to v1.9.1 #145
Full changelog

cluster-machine-approver

OCPBUGS-46034: Ensure trailing dots on DNS names do not block serving cert auth #258
OCPBUGS-46034: Client internal DNS checks should ignore trailing dot #252
Full changelog

cluster-monitoring-operator

OCPBUGS-102754: [release-4.15] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame- #3090 #3091
NO-ISSUE: synchronize OWNERS from main branch [release-4.15] #3109
OCPBUGS-66047: test: remove image registry e2e tests #2757
OCPBUGS-46570: Add new metrics for OpenShift logging telemetry #2541
Full changelog

cluster-network-operator

OCPBUGS-51287: Manual feature backport of cert rotation for whereabouts #3122
OCPBUGS-84183: fix(hypershift): use net.JoinHostPort for URL construction #2995
OCPBUGS-62980: Update CNO reviewers/approvers #2817
OCPBUGS-56649: Fix live migration with feature migration configured explicitly #2715
OCPBUGS-36688, OCPBUGS-43099: Unexpected Behavior During Cluster Upgrade for the ovn-ipsec-host pods #2658
OCPBUGS-53282: Not update status.migration of the network.config CR to empty #2669
[Release 4.15] OCPBUGS-51208: Use applyconfigurations for updating network.oprerator status #2653
OCPBUGS-47633: Prevent live migration process from flapping between step-2 and step-3 #2609
OCPBUGS-45890: Pass transit_switch_subnet options in ovnkube-node pod #2587
OCPBUGS-43716: Skip including default crypto policies to avoid authby issue #2599
OCPBUGS-46149: Remove ip xfrm state when IPsec is disabled #2596
OCPBUGS-43605: OCPBUGS-42244: Exporting environment varialbe NODE_CNI for live migration #2539
OCPBUGS-44973, SDN-5436: Provide support for user owned IPsec machine configs #2576
Full changelog

cluster-node-tuning-operator

e2e:performance: decode to valid kubeletconfig object (#1275) #1275
Fix context deadlines in ExecCommandOnPod() (#1265) #1265
Full changelog

cluster-olm-operator

OCPBUGS-86345: Update grpc-go to v1.64.1-sec.1 to fix CVE-2026-33186 #208
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-67946: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.15] #655
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-48832: Add new team members to the OWNERS file #379
Full changelog

cluster-samples-operator

OCPBUGS-63517: references to github.com/sclorg/django-ex.git now also refer to the branch #660
OCPBUGS-55475: Adding mutex to func createSamples on handler.go #634
OCPBUGS-54481: add rhdmalone to owners #623
OCPBUGS-49369: add shannon and aroyoredhat as owners #597
Full changelog

cluster-storage-operator

OCPBUGS-102758: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #732
OCPBUGS-87726: remove oVirt code from CSO 4.15 #710
OCPBUGS-67955: bump github.com/sirupsen/logrus to v1.9.3 #654
Full changelog

cluster-version-operator

OCPBUGS-102770: Bump golang.org/x/net to v0.35.0-sec.3 #1462
OCPBUGS-50591: Set openshift.io/required-scc: privileged annotation in version pods #1152
OCPBUGS-45330: deps: bump golang.org/x/net to 0.31.0 #1119
Full changelog

console

OCPBUGS-105795: Fix operator-hub e2e test by replacing unavailable Red Hat catalog source with Community #17460
OCPBUGS-133310: Stabilize legacy OperatorHub Cypress waits #17422
OCPBUGS-101788: Bump postcss to fix CVE-2026-69153 #17113
OCPBUGS-98421: CVE-2026-59869 #16753
Fix for OCPBUGS-92070: CVE-2026-44990 #16720
OCPBUGS-100512: Bump postcss to fix CVE-2026-45623 #17034
OCPBUGS-92747: CVE-2026-46597 openshift4/ose-console: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs [openshift-4.15.z] #16962
OCPBUGS-105792: Disable operator-hub e2e tests to unblock CI #16957
OCPBUGS-112512: Fix JSON annotation parsing to prevent OperatorHub crash #17070
OCPBUGS-87983: [release-4.15] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16598
OCPBUGS-77117: [release-4.15] CVE-2026-26996 Bump minimatch library #16347
Fix for OCPBUGS-81596: CVE-2026-4800 #16567
OCPBUGS-88366, OCPBUGS-88379, OCPBUGS-88395, OCPBUGS-88402, OCPBUGS-88415, OCPBUGS-88427, OCPBUGS-88445: CVE-2026-44495 #16611
OCPBUGS-79436: CVE-2026-29063 Bump immutable #16328
NO-JIRA: enable multi-architecture yarn builds #16425
OCPBUGS-83298: [release-4.15] openshift4/ose-console: Axios: Remote Code Execution via Prototype Pollution escalation #16302
OCPBUGS-76575: Bump axios #16033
CONSOLE-5011: migrate to yarn berry #16081
NO-JIRA: Bump builder image to v29 #15992
OCPBUGS-74443: Bump lodash to latest #15970
OCPBUGS-69767: Disallowed Pipelines-plugin Pipelines navigation section #15864
OCPBUGS-65822: Remove required flag from ‘console.flag/model’ pipelines-plugin extension #15749
OCPBUGS-65601: /auth/error?error=missing_state&error_type=auth is showing blank page #15727
OCPBUGS-44159: bump dompurify to latest #15592
OCPBUGS-60672: Secret key with binary file changes when edited via Console #15422
OCPBUGS-59997: Remove the devconsole backend common internet proxy and replace it with dedicated ones #15359
OCPBUGS-59564: Add flags in console static plugin for all the components of this epic #15306
OCPBUGS-60029: fix bug where / in console.tab/horizontalNav href brea… #15353
OCPBUGS-57521: Debug pod logs are not accessible when debugging a node via OpenShift Console #15181
OCPBUGS-58223: Fix TypeError Cannot read properties of null (reading ‘metadata’) #15221
OCPBUGS-57097: Add all files to vendor regardless of gitignore #15134
OCPBUGS-45257: Enabling topology e2e tests on CI #14721
OCPBUGS-55733: fix bug where operator appears twice #15021
OCPBUGS-55174: Add missing pipelines plugin name to known plugins #14982
OCPBUGS-54673: Added token to proxy header #14943
OCPBUGS-54252: Update the monitoring topic used by the console team #14904
OCPBUGS-53138: fix run time error when no completed version exists #14879
OCPBUGS-53055: Show Observe section without PROMETHEUS and MONITORING flags #14867
OCPBUGS-52344: fix alert rule link #14828
OCPBUGS-51332: Do not pass CSV name to operand list page when an exen… #14800
OCPBUGS-49849: include external labels so silenced alerts not displayed in notifications #14718
OCPBUGS-48593: ReRun of Resolver based PipelineRuns fails from UI #14689
OCPBUGS-48592: ImagePullSecret getting duplicated when editing DeploymentConfig in Form View #14688
OCPBUGS-48048: Update vendor imports to include all PatternFly components #14662
OCPBUGS-47646: fix table combination #14649
OCPBUGS-46430: Plugins that use very old PF4 dropdown or menu components with grouped items have bullets and padding that needs to be removed. #14626
OCPBUGS-45950: Unable to remove finally tasks in pipeline builder mode #14606
OCPBUGS-46389: use TaskRuns results.tekton.dev/record annotation to get the logs #14622
OCPBUGS-45248: Remove ClusterTask dependency in console from Pipelines 1.17 #14564
OCPBUGS-44979: Don’t request user settings configmap if no user has been loaded. #14534
OCPBUGS-37397: RWOP accessMode is not available on OpenShift console UI #14078
OCPBUGS-44998: Add IBM Block Storage CSI driver support for RWX #14536
OCPBUGS-44738: Add flag to hide the pipelines-plugin pipeline builder extensions #14513
Full changelog

console-operator

OCPBUGS-102761: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #1226
OCPBUGS-77993: [release-4.15] hermetic 4.15 #1130
OCPBUGS-77993: [release-4.15] NO-JIRA: update go mod dependency for konflux #1116
OCPBUGS-46482: Dont disable console when authConfig type is set to None #953
Full changelog

container-networking-plugins

OCPBUGS-85668: CI Build root image tag sync with ART #233
OCPBUGS-55948: Check error returned by ipv6 SettleAddresses #190
OCPBUGS-37732: Update owners #167
Full changelog

coredns

OCPBUGS-77512: Modify .gitignore to not exclude vendor build folders #169
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-102846, OCPBUGS-102852: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork- #419 #419
OCPBUGS-79905: Bump google.golang.org/grpc #398
OCPBUGS-67958: fix CVE-2025-65637 #362
OCPBUGS-58885: CARRY: don’t ignore json files #342
OCPBUGS-43375: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.28 into release-4.15 #297
Full changelog

csi-driver-manila-operator

OCPBUGS-102769: Use patched x/net fork v0.35.0-sec.4 #261
OCPBUGS-67959: Bump logrus #252
Full changelog

csi-driver-nfs

OCPBUGS-84930: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 to avoid go version bump and fix CVE-2026-33186 #183
Full changelog

csi-external-attacher

OCPBUGS-102764: Bump golang.org/x/net to v0.35.0-sec.4 #118
Full changelog

csi-external-resizer

OCPBUGS-102768: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #205
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-102760, OCPBUGS-102784: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #231
Full changelog

docker-builder

OCPBUGS-89799, OCPBUGS-90277, OCPBUGS-92299, OCPBUGS-92583, OCPBUGS-92728: Bump golang.org/x/crypto to fix CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-46597 #544
OCPBUGS-65960: BuildConfig inline Dockerfile fails with heredoc syntax #491
OCPBUGS-58141: S2I build cpu limits observed by assemble are limited to 1 cpu #477
OCPBUGS-42917, OCPBUGS-43294: Bump buildah to 1.33.12 #442
OCPBUGS-43188: runc library bump to 1.1.12 #436
OCPBUGS-48298: skipping some unit tests to avoid failures as they are duplicate #428
OCPBUGS-48281: Add team members to the OWNERS file #427
Full changelog

docker-registry

OCPBUGS-53650: bump jwt and oauth dependencies #433
Full changelog

gcp-cluster-api-controllers

OCPBUGS-78281: [release-4.15] update go mod dependency for konflux #268
Full changelog

gcp-machine-controllers

OCPBUGS-102832: Bump golang.org/x/net to v0.35.0-sec.3 #192
OCPBUGS-79899: Address CVE-2026-33186 #175
OCPBUGS-79899: Fix setup-envtest GCS 401 by downloading binaries directly #177
OCPBUGS-55410, OCPBUGS-55411: Disable shielded VMs for non-UEFI disks #117
Full changelog

gcp-pd-csi-driver

OCPBUGS-102786: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #142
OCPBUGS-67973: Update logrus to v1.9.3 #93
Full changelog

gcp-pd-csi-driver-operator

OCPBUGS-67971: bump github.com/sirupsen/logrus to v1.9.3 #161
Full changelog

haproxy-router

OCPBUGS-102779: Use patched x/net fork v0.35.0-sec.4 #857
OCPBUGS-86712: Strip X-SSL-* headers for plain HTTP #806
OCPBUGS-49392: Block Upgrades for CA-Signed Certs Using SHA1 #641
Full changelog

hyperkube, pod

OCPBUGS-67902, OCPBUGS-67977: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 [4.15] #2583
OCPBUGS-74300: Skip E2e: attach on previously attached volumes should work #2569
OCPBUGS-59147: UPSTREAM: 130047: adjusting loopback certificate validity in kube-apiserver #2358
OCPBUGS-59147: UPSTREAM: <carry>: disable some legacy cloud provider Azure tests #2359
OCPBUGS-52183: UPSTREAM: <carry>: kubelet/cm: fix bug where kubelet restarts from missing cpuset cgroup #2227
OCPBUGS-53139: UPSTREAM: 129180: prevent unnecessary resolving of iscsi/fc devices to dm #2244
OCPBUGS-44514: Bump k8s api to 1.28.15 #2132
Full changelog

hypershift

Sync approver aliases with main for release-4.15 #10197
[release 4.15] Fix OCPBUGS-99080: CVE-2026-16242 konnectivity agent auth #9130
OCPBUGS-84183: fix(cno): use brackets only for IPv6 in server URL #8308
OCPBUGS-74670, OCPBUGS-74671: Support proxy authentication when user/pass is included in URL #7606
CNTRLPLANE-1266: Drop extinct mce-2.5 pipeline #6655
CNTRLPLANE-1232: Move CPO pipeline to hermetic builds #6601
OCPBUGS-58506: [release-4.15] Add missing service network DNS entries to KAS cert #6394
OCPBUGS-57553: Add proxy variables for the MCD Pod #6293
OCPBUGS-57121: Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs #6231
OCPBUGS-46467: Consistently look up and dial cloud API hostnames #5300
OCPBUGS-52590: Honor proxy vars in the util insecure http client #5791
CNTRLPLANE-920: Konflux build pipeline service account migration #6086
CNTRLPLANE-920: Konflux build pipeline service account migration #6081
OCPBUGS-55266: [release-4.15] Add konnectivity-proxy sidecar to openshift-oauth-apiserver #6070
OCPBUGS-51800: Fix golang crypto dependency go.mod replacement #5995
OCPBUGS-53898: bump golang-jwt v4 and v5 #5908
Red Hat Konflux update control-plane-operator-4-15 #5955
ART-11792: update go mod dependency for konflux #5923
OCPBUGS-51729, OCPBUGS-51800: Bump dependencies to OCP fork in backports #5902
OCPBUGS-50867: Prevent IgnitionServer from flooding the API server with patch requests #5633
OCPBUGS-52992: [release-4.15] OCPBUGS-52506: refactor aws identity health check into new controller #5815
OCPBUGS-52896: Make managed-trust-bundle optional #5813
OCPBUGS-50699: add region to AWS creds passed to operators managed by CPO #5669
NO-JIRA: chore(deps): update dependency mkdocs-material to v9.6.6 #5729
OCPBUGS-51253: OCPBUGS-50692: Fix IsIPv4 function identifying also addresses instead of CIDRs #5701
OCPBUGS-52172: [release-4.15] Add HostedCluster additional trustbundles to konnectivity-https-proxy #5722
NO-JIRA: chore(deps): update dependency mkdocs-material to v9.6.5 #5683
chore(deps): update registry.access.redhat.com/ubi9-minimal docker tag to v9.5-1739420147 #5624
NO-JIRA: chore(deps): update dependency mkdocs-material to v9 #5642
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9-minimal docker tag to v9.5-1738816775 #5576
NO-JIRA: chore(deps): update konflux references #5588
NO-JIRA: Red Hat Konflux update control-plane-operator-4-15 #5338
NO-JIRA: chore(deps): update dependency mkdocs-mermaid2-plugin to v0.6.0 #5589
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.6.3 #5586
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.6.2 #5577
OCPBUGS-49668: fix overwriting PKI operator HCP conditions #5512
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1737480393 #5486
NO-JIRA: chore(deps): update konflux references (release-4.15) #5480
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.50 (release-4.15) #5434
NO-JIRA: Update dependency mkdocs-material to v8.5.11 (release-4.15) #5429
NO-JIRA: chore(deps): update konflux references (release-4.15) #5425
NO-JIRA: chore(deps): update konflux references (release-4.15) #5386
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1736729788 (release-4.15) - abandoned #5380
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9-minimal docker tag to v9.5-1736404155 (release-4.15) #5379
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.49 (release-4.15) #5385
NO-JIRA: [release-4.15] Bump golang.org/x/crypto and golang.org/x/net #5371
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1734626445 (release-4.15) - abandoned #5344
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9-minimal docker tag to v9.5-1734497536 (release-4.15) #5343
OCPBUGS-46075: Do not send traffic to local audit-webhook through konnectivity #5274
NO-JIRA: Update dependency mkdocs-glightbox to v0.4.0 (release-4.15) #5327
NO-JIRA: Update Konflux references (release-4.15) #5326
OCPBUGS-47545: Separate CPO containerfiles #5334
NO-JIRA: chore(deps): update dependency mkdocs to v1.6.1 (release-4.15) #5292
NO-JIRA: chore(deps): update konflux references (release-4.15) #5291
NO-JIRA: chore(deps): update konflux references (release-4.15) #5251
OCPBUGS-44522: Add network policies for konnectivity server and ignition server proxy #5120
OCPBUGS-43931: Return the right tagReference on Catalogs ImageStream #5187
NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.47 (release-4.15) #5210
NO-JIRA: chore(deps): update konflux references (release-4.15) #5208
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.46 (release-4.15) #5190
NO-JIRA: chore(deps): update konflux references to 7779f9e (release-4.15) #5182
OCPBUGS-44278: Configure OAuth https proxy to dial cloud endpoints directly #5068
Full changelog

ibm-cloud-controller-manager

OCPBUGS-102785: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #117
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-79893: Bump google.golang.org/grpc to v1.79.3 #148
OCPBUGS-77211: [release-4.15] standardize build paths #125
OCPBUGS-58739: bump github.com/golang/glog to version v1.2.4 #107
OCPBUGS-56064: tech debt: rework vendor patches #92
OCPBUGS-53906: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #85
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-102790: Use patched x/net fork v0.35.0-sec.4 #186
OCPBUGS-67980, OCPBUGS-67981: bump github.com/sirupsen/logrus to v1.9.3 #165
OCPBUGS-59775: [IBM VPC] set offlineExpansion to false in e2e test manifest #150
Full changelog

ibm-vpc-node-label-updater

OCPBUGS-102789: Bump golang.org/x/net to v0.35.0-sec.4 #62
OCPBUGS-56064: tech debt: rework vendor patches #49
OCPBUGS-53538: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #45
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-102817: Replace golang.org/x/net with openshift-sustaining/net #169
OCPBUGS-115545: Fetch envtest assets from the controller-tools releases #180
OCPBUGS-67289: [release-4.15] Fix incomplete vendor/ #137
OCPBUGS-51814: CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork #122
Full changelog

ibmcloud-machine-controllers

OCPBUGS-102807: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 #107
NO-JIRA: fix unit tests broken by deprecated kubebuilder-tools bucket #112
OCPBUGS-36084: Bump dependency for CVE #54
OCPBUGS-43675: IBMCloud: Handle pagination for subnets #48
Full changelog

insights-operator

OCPBUGS-102804: Bump golang.org/x/net to v0.35.0-sec.3 #1358
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

ironic

OCPBUGS-97990: bump openstack-ironic pin for CVE-2026-44918 fix #913
OCPBUGS-97807: bump openstack-ironic pin for CVE-2026-54423 fix(release-4.15) #878
OCPBUGS-69784: Bump eventlet version to 0.33.1-7 #764
OCPBUGS-48148, OCPBUGS-48597: Bump jinja2 to 3.0.1-6.el9.2 #624
Full changelog

ironic-agent

OCPBUGS-99889: Bump ironic-python-agent pinned commit for CVE-2026-66138 #311
OCPBUGS-95071: Replace individual package removal with a single rpm -e loop #289
OCPBUGS-95071: Replace dnf remove with rpm -e to prevent dependency removal #277
OCPBUGS-69782: Bump eventlet version to 0.33.1-7 #233
Full changelog

ironic-machine-os-downloader

OCPBUGS-87172: CI build root image tag and go version in go.mod sync with ART 4.15 #121
Full changelog

ironic-static-ip-manager

OCPBUGS-49836: Fix subnet validation #49
Full changelog

k8s-prometheus-adapter

OCPBUGS-102809: [release-4.15] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #112
Full changelog

kube-metrics-server

NO-ISSUE: synchronize OWNERS from main branch [release-4.15] #86
OCPBUGS-102707: CVE-2026-33814 openshift4/kube-metrics-server-rhel8:… #73
Full changelog

kube-proxy, sdn

OCPBUGS-54868: Handle openshift-host-network namespace as special when it modifies #654
OCPBUGS-46576: Get rid of deps.diff so it doesn’t keep causing problems [4.15] #646
OCPBUGS-45955: Stop checking ruleVersion [4.16] #644
OCPBUGS-43605: backport fix for network policy during live migration #642
Full changelog

kube-state-metrics

OCPBUGS-102811: Use patched x/net fork v0.35.0-sec.4 #161
NO-ISSUE: synchronize OWNERS from main branch [release-4.15] #190
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-15). #228
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-95081: OWNERS: Update component to Cloud Compute / KubeVirt Provider #83
Full changelog

kubevirt-csi-driver

OCPBUGS-83658: Bump google.golang.org/grpc to v1.79.3 #103
fix for OCPBUGS-58587: CVE-2024-45339 openshift4/kubevirt-csi-driver #69
Full changelog

libvirt-machine-controllers

OCPBUGS-77197: Fix incomplete vendor #303
OCPBUGS-26506: Updating ose-libvirt-machine-controllers-container image to be consistent with ART for 4.15 #282
Full changelog

machine-api-operator

OCPBUGS-102825: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #1548
OCPBUGS-130682: Fix unit and vsphere namespace tests #1580
OCPBUGS-67989: bumped logrus to v1.9.3 #1460
OCPBUGS-59861: Updates GCP CredentialsRequest #1397
OCPBUGS-55410, OCPBUGS-55411: Updates GCP credentials request #1356
OCPBUGS-53251: add image/read permissions #1349
OCPBUGS-52481: Drop oVirt support #1340
OCPBUGS-48105: Vsphere: Handle cloned instance with lost taskID #1321
OCPBUGS-46080: Ensure deletion annotation takes priority and oldestPolicy can distinguish longer ages #1314
Full changelog

machine-config-operator

OCPBUGS-99046: Remove sensitive ControllerConfig logging #6318
OCPBUGS-77636: Machine-config controller should not log about non-existent pull-secret changes #5573
OCPBUGS-60214: [release-4.15] OCPBUGS-53248: Enforce VIPs to be collocated at the same host #4988
OCPBUGS-59737: Remove MachineConfigNode CRD from manifests #5188
OCPBUGS-48284: Do not run resolv-prepender from NM dispatcher #4783
OCPBUGS-57340: Do not enable on-prem-resolv-prepender.path for UPI #5115
OCPBUGS-36688: Add ipsec connect wait service #4937
OCPBUGS-54206: Update format verbs for alert logs #4943
OCPBUGS-54176: Update ObservedGeneration in KubeletConfig #4944
OCPBUGS-43742: Soften haproxy timeout for kubeapi probe #4663
OCPBUGS-50526: Add clarification to invalid maxUnavailable alert #4842
OCPBUGS-48583: trying to wait for sub-contorllers #4796
OCPBUGS-46034: Remove trailing periods from AWS provided hostnames #4745
OCPBUGS-44565: Post upgrading from 4.14 to 4.15.36, the observedGeneration count increased tremendously #4702
Full changelog

machine-image-customization-controller

OCPBUGS-102816: Replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #197
OCPBUGS-67983: [4.15] uplift logrus #154
Full changelog

machine-os-images

OCPBUGS-87879: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #103
OCPBUGS-54170: Change rhcos release browser url #58
Full changelog

monitoring-plugin

NO-JIRA: Updating monitoring-plugin-container image to be consistent with ART for 4.15 #1399
OCPBUGS-127147: Replace react-linkify with linkify-react to fix CVE-2026-59887 #1355
OCPBUGS-74446: [release-4.15] fix: upgrade lodash to remove vulnerable code #907
OCPBUGS-78493: fix for CVE-2025-69873 #850
OCPBUGS-44393: Manual cherry pick cross spawn 4.15 #277
Full changelog

multus-admission-controller

OCPBUGS-58769: Update the github.com/golang/glog module to v1.2.4 #104
Full changelog

multus-cni

OCPBUGS-85252: Fix server url in kubeconfig #301
no-issue: [release-4.15] Bump Go to 1.20 and fix CI build root image #294
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-55619: Fixes leftover podref issue #366
Full changelog

must-gather

OCPBUGS-36371: Run ppc node collection in parallel #430
OCPBUGS-42970: Collect etcd object count #456
OCPBUGS-48083: Update owners #474
OCPBUGS-46451: Support gathering IPsec data #471
Full changelog

network-metrics-daemon

OCPBUGS-58779: Bump github.com/golang/glog to v1.2.4 (#114) #114
OCPBUGS-60374: Replace e2e test image (#126) #126
swtich golint install method (#124) #124
Full changelog

nutanix-machine-controllers

OCPBUGS-47264: fixing CVE-2024-45338 #117
OCPBUGS-51850: CVE-2025-22868 #109
Full changelog

oauth-apiserver

OCPBUGS-74925: bump kubernetes-apiserver to pick up loopback cert expiration update #173
NO-JIRA: (chore): update OWNERS #175
Full changelog

oauth-proxy

OCPBUGS-136606: [release-4.15] Sync OWNERS and OWNERS_ALIASES with master #400
OCPBUGS-112089: bugfix: rewrite open redirect strings to ‘/’ #387
OCPBUGS-61447: Update x/crypto to v0.31.0 #336
Full changelog

oauth-server

OCPBUGS-102830: Replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #292
OCPBUGS-87066: bugfix: default to english when Accept-Language header contains more than 1000 underscores #275
Full changelog

oc-mirror

OCPBUGS-130909: v1 accept catalog root entries and relative symlink targets #1597
OCPBUGS-77858: fix vendor for hermetic 4.15 #1361
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

openshift-apiserver

OCPBUGS-82665: Address CVE-2026-35469 #648
OCPBUGS-67998: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.15] #611
OCPBUGS-74923: bump kubernetes-apiserver to pick up loopback cert expiration update #600
OCPBUGS-58822: Fix image reference in TestImageStreamImportQuayIO #517
OCPBUGS-47766: Pass expected type to deploymentconfig/scale object validation. #466
Full changelog

openshift-controller-manager

OCPBUGS-57761: Set node-pullsecrets volume to read-only to protect image pull credentials #396
OCPBUGS-56474: Empty proxy variables are causing issues during the build #383
OCPBUGS-54344: Unable to look up the service account secrets for build #370
OCPBUGS-48280: Add team members to the OWNERS file #359
Full changelog

openshift-state-metrics

NO-ISSUE: synchronize OWNERS from main branch #149
Full changelog

openstack-cinder-csi-driver-operator

OCPBUGS-102841: Use patched x/net fork v0.35.0-sec.4 #200
OCPBUGS-68000: CVE-2025-65637 openshift4/ose-openstack-cinder-csi-driver-rhel8-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.15.z] #192
Full changelog

openstack-machine-api-provider

OCPBUGS-78171: hermetic 4.15 #164
Full changelog

operator-lifecycle-manager, operator-registry

OCPBUGS-102858: Use patched x/net fork v0.35.0-sec.4 #1381
OCPBUGS-102857: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #1375
OCPBUGS-79906, OCPBUGS-87895: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.64.1-sec.1 [release-4.15] #1325
OCPBUGS-82056: Drop github.com/distribution/distribution dep #1303
OCPBUGS-61466: [release-4.15] Add NetworkPolicy as a supported kind #1051
OCPBUGS-61389: [4.15] e2e stability fixes #1084
OCPBUGS-57430: reduce cache expiry frequency [release-4.19] #1023
OCPBUGS-56463: fix(olm): improve error logging for missing olm.managed label (#3558) #1010
OCPBUGS-48662: Fix concurrent namespace resolution #948
OCPBUGS-48697: Fix excessive catalog source snapshots cause severe performance regression #958
OCPBUGS-46926, OCPBUGS-46933, OCPBUGS-47313: x/net bump to v0.34.0 [release-4.15] #940
OCPBUGS-46479: CRD upgrade existing CR validation fix #917
Full changelog

operator-marketplace

OCPBUGS-68005: CVE-2025-65637 fixed in logrus v1.9.3+ #733
OCPBUGS-62221: Remove Expect func so that the test case can use the retry logic #672
OCPBUGS-62119: Update memoryTarget on catalog source pods #666
OCPBUGS-49428: Upgrade golang.org/x/net [release-4.15] #588
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-97815: External gateway: Remove routes for external gateway pods in terminating or not ready state #3285
CORENET-6055, OCPBUGS-76403: [release-4.15] Dockerfile: Unpin OVN and consume the latest from FDP #2974
OCPBUGS-56660, OCPBUGS-58162: Unpin OVS patch versions #2649 #2649
OCPBUGS-56419: Update to FDP25.A.1 24.03.5-40. #2573
OCPBUGS-50583: Bump OVN to 23.09.6-12 to consume fix for FDP-905 #2454
OCPBUGS-53384: [release-4.15] Dockerfile.base: bump OVS version to 3.3 #2492
OCPBUGS-43605: Add SDN node subnet gateway IP to host-network address_set #2419
OCPBUGS-46403: Add static route to the hairpin masquerade IPs to pod #2396
OCPBUGS-47799: Let OVN-northd bind remote ports #2407
OCPBUGS-44708: Add hybird overlay pod IPs to the namespace address_set #2399
OCPBUGS-45097: pin libreswan to 4.6-3.el9_0.3 #2374
OCPBUGS-44782: Bump ovs to 3.1.0-137 #2359
Full changelog

powervs-block-csi-driver

OCPBUGS-105269: Mitigate CVE-2025-30204 by bumping github.com/golang-jwt/jwt/v4 to v4.5.2 #140
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-68006: Fix CVE-2025-65637 by bumping logrus to v1.9.1 #99
Full changelog

powervs-machine-controllers

OCPBUGS-61702: Use OS_GIT_VERSION in Makefile when found (for Konflux builds) #128
OCPBUGS-54753: Fix for CVE-2024-51744 in github.com/golang-jwt/jwt/v4 in release-4.15 #115
Full changelog

prom-label-proxy

NO-ISSUE: synchronize OWNERS from main branch [release-4.15] #402
Full changelog

prometheus

OCPBUGS-129665: fix for CVE-2026-42151 #397
OCPBUGS-93655: remote/azuread: use Secret type for OAuth client_secret [release-4.15] #362
OCPBUGS-102853: Use patched x/net fork v0.35.0-sec.4 #377
NO-ISSUE: synchronize OWNERS from main branch #385
OCPBUGS-88592: remote: validate snappy decoded length before allocation in read endpoint #352
OCPBUGS-79907: Bump google.golang.org/grpc #322
OCPBUGS-56740: BACKPORT: fix promtool analyze block shows metric name with 0 cardinality #256
OCPBUGS-43669: fix(discovery): Handle cache.DeletedFinalStateUnknown in node informers’ DeleteFunc #233
Full changelog

prometheus-alertmanager

OCPBUGS-98170: bump github.com/hashicorp/memberlist to a forked version to fix CVE-2026-14362 #204
NO-JIRA: synchronize OWNERS with main #199
OCPBUGS-100359: Set testdata CA expiry to 20 years from issue date (#4112) #153
OCPBUGS-77058: Include go-verify-deps expected files in gitignore #117
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

NO-ISSUE: synchronize OWNERS from main branch #421
OCPBUGS-102842, OCPBUGS-102845: release-4.15] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #402
Full changelog

prometheus-node-exporter

NO-ISSUE: synchronize OWNERS from main branch [release-4.15] #206
OCPBUGS-102844: Use patched x/net fork v0.35.0-sec.4 #193
Full changelog

route-controller-manager

OCPBUGS-102695: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #106
OCPBUGS-86882: [release-4.15] bump google.golang.org/grpc to v1.64.1-sec.1 #93
Full changelog

service-ca-operator

OCPBUGS-68019: update logrus to v1.9.1 #321
Full changelog

tests

OCPBUGS-130859: stage the creation of test pods to minimize etcd impact #31743
OCPBUGS-74300: Skip E2e: attach on previously attached volumes should work #30725
OCPBUGS-66329: Replace RunHostCmd with Exec function to censor bearer token being exposed #30528
OCPBUGS-57335: Fix regex parser for censoring private key #29913
OCPBUGS-61229: images/tests: Remove rteval #30207
OCPBUGS-57136: aws/edge: prevent test using unschedulable nodes #29897
OCPBUGS-55477: support provider type external #29739
NO-JIRA: Sync OWNERS from main branch #29856
OCPBUGS-55695: [build] Ensure Git Clone Does Not Run Privileged #29752
OCPBUGS-54769: Fix egress firewall tests by updating the URL from docs.openshift.com to redhat.com #29664
OCPBUGS-52582: Use payload pullspec for image info test #29590
OCPBUGS-41614: Disable:Broken for [sig-builds][Feature:Builds][Slow] can use private repositories as build input build using an HTTP token should be able to clone source code via an HTTP token #29502
OCPBUGS-49647: Fixing build s2i ruby test data inline with latest ruby version(>=3.0) #29503
OCPBUGS-48749: Add/remove team members to the OWNERS file for Builds #29551
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-102888: Replace golang.org/x/net with sustaining fork for CVE-2026-33814 in 4.15 #138
OCPBUGS-78030: hermetic migration 4.15 #108
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-78021: hermetic migration 4.15 #87
OCPBUGS-61654: Fix unit tests #73
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-86873: Bump google.golang.org/grpc #183
OCPBUGS-68022: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #159
Full changelog

vsphere-csi-driver-operator

OCPBUGS-102873: Use patched x/net fork v0.35.0-sec.4 #366
OCPBUGS-68020, OCPBUGS-68024: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.9.3 #323
Full changelog

vsphere-problem-detector

OCPBUGS-102889: Bump golang.org/x/net to v0.35.0-sec.4 #236
OCPBUGS-68031: bump github.com/sirupsen/logrus to v1.9.3 #201
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github