4.16.75

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.16.75-x86_64

Qualifiers (status api): None

Tests:

Blocking jobs
- upgrade Pending periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Pending periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial Pending periodic-ci-openshift-release-main-nightly-4.16-e2e-aws-ovn-serial
- aws-ovn-upgrade-micro Pending periodic-ci-openshift-release-main-ci-4.16-e2e-aws-ovn-upgrade
- aws-sdn-upgrade-4.16-micro Pending periodic-ci-openshift-release-main-nightly-4.16-e2e-aws-sdn-upgrade
- azure-ovn-upgrade-4.16-micro Pending periodic-ci-openshift-release-main-ci-4.16-e2e-azure-ovn-upgrade
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.16-fips-payload-scan
- gcp-ovn-rt-upgrade-4.16-minor Pending (1 retry) periodic-ci-openshift-release-main-ci-4.16-upgrade-from-stable-4.15-e2e-gcp-ovn-rt-upgrade
  - Attempt 1 Failed
  - Attempt 2 Pending
- metal-ipi-ovn-ipv4 Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-metal-ipi-ovn-ipv4
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-metal-ipi-ovn-ipv6

Upgrades from:

Untested upgrades: 4.15.21, 4.15.22, 4.15.23, 4.15.24, 4.15.25, 4.15.26, 4.15.27, 4.15.28, 4.15.29, 4.15.30, 4.15.31, 4.15.32, 4.15.33, 4.15.34, 4.15.35, 4.15.36, 4.15.37, 4.15.38, 4.15.40, 4.15.41, 4.15.42, 4.15.43, 4.15.44, 4.15.45, 4.15.46, 4.15.47, 4.15.49, 4.15.50, 4.15.51, 4.15.52, 4.15.53, 4.15.54, 4.15.56, 4.15.57, 4.15.58, 4.15.59, 4.15.60, 4.15.61, 4.15.62, 4.15.63, 4.15.64, 4.15.65, 4.15.66, 4.15.67, 4.15.68, 4.16.10, 4.16.11, 4.16.12, 4.16.13, 4.16.14, 4.16.15, 4.16.16, 4.16.17, 4.16.18, 4.16.19, 4.16.20, 4.16.21, 4.16.22, 4.16.23, 4.16.24, 4.16.25, 4.16.26, 4.16.27, 4.16.28, 4.16.29, 4.16.3, 4.16.30, 4.16.31, 4.16.32, 4.16.33, 4.16.34, 4.16.35, 4.16.36, 4.16.37, 4.16.38, 4.16.39, 4.16.4, 4.16.40, 4.16.41, 4.16.42, 4.16.43, 4.16.44, 4.16.45, 4.16.46, 4.16.47, 4.16.48, 4.16.49, 4.16.5, 4.16.50, 4.16.51, 4.16.52, 4.16.53, 4.16.55, 4.16.56, 4.16.57, 4.16.58, 4.16.59, 4.16.6, 4.16.60, 4.16.61, 4.16.62, 4.16.63, 4.16.64, 4.16.65, 4.16.66, 4.16.69, 4.16.7, 4.16.70, 4.16.71, 4.16.8, 4.16.9

4.16.74 (changes) - P P P P P
4.16.73 (changes) - Pending
4.16.72 (changes) - Pending
4.16.68 (changes) - Pending
4.16.67 (changes) - Pending
4.16.54 - Pending
4.16.2 (changes) - Pending
4.16.1 (changes) - Failed
4.16.0 (changes) - Pending
4.15.71 (changes) - Failed
4.15.70 (changes) - Pending Pending
4.15.69 (changes) - Pending
4.15.55 (changes) - Pending
4.15.48 (changes) - Pending
4.15.39 (changes) - Failed
4.15.20 (changes) - Pending
4.15.19 (changes) - Failed
4.15.18 (changes) - Pending
4.15.0-0.nightly-2026-10-18-234511 (changes) - Failed Pending

Loading changelog, this may take a while ...

Changes from 4.16.54

Created: 2026-11-05 10:31:37 +0000 UTC

Image Digest: sha256:4eda35319bd4f1cf62676d74e2ca48c772e55114f81c373fc09d01f75f83b4ce

Components

Kubectl 1.29.7
Kubernetes 1.29.14
Kubernetes Tests 1.29.0
Red Hat Enterprise Linux CoreOS upgraded from 416.94.202512030118-0 to 416.94.202611031928-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
StreamingCollectionEncodingToJSON (0 tests)	Enabled	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
StreamingCollectionEncodingToProtobuf (0 tests)	Enabled	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled

Removed images

ovirt-csi-driver
ovirt-csi-driver-operator

Rebuilt images without code change

alibaba-machine-controllers git 248372a4 sha256:f78374d567304f21ad852cde6550d9e8180a42f34ae78d028ba3272afc567a7d
apiserver-network-proxy git ca81b6a3 sha256:2537164fb1d3baaa3eee137d445a2ce4d1a25c4f91c0a467823c592e8c0ed178
aws-ebs-csi-driver git 1d29a74a sha256:9b9a2c996f5eee57cd61ccec7bf5b9926aa0a673ba014eb77d01263761a1cf7c
aws-kms-encryption-provider git c66065de sha256:333e7b82b7062f0dd97b9e04b6f85cbd3156ca91e6057b5ce01a6dfbf176c6de
aws-pod-identity-webhook git 459c5314 sha256:eb6f2ec7e35f2e42a75352da7c0f13c11ea683e8f33c2751df421dcf9fa08f74
cluster-bootstrap git 27bfb59f sha256:a7d2bae00dcc68b7138771b174c448f11866a0c9b2c6e5c3f29c5fd57fdc4b42
cluster-capi-controllers git 5830a10a sha256:22d1f5ca68cd4973671a1bcac6f1609720844a38217ba12b16415e23aa7339af
cluster-config-operator git 441d29c9 sha256:70787175d3edd319b39206b5f2e3067d53d7103316557d0469dc1b558fc201f1
cluster-control-plane-machine-set-operator git 14571e8a sha256:5515bd1124a1b91ead8a7a09af4cb955b1c3fd45f78579a584c00a4ecb67b939
cluster-kube-cluster-api-operator git 95ceaa9e sha256:762d372eb4d893fa02ca423c290cfa7f233a0e5b50858626a098fbf2c82b14e6
cluster-machine-approver git 7685374f sha256:1c058f73a86c478c05a2ec346e8a2962f2b1acac331e0a1c53c36e358a9c2290
cluster-openshift-controller-manager-operator git 2ed3cf99 sha256:2f20f6428b2ae4a25bde89cd59e3f97666ee8460d3a8a5802b26767f59acd43d
cluster-policy-controller git eaea543f sha256:8e1c649643d248eb9e776b25200563c9fddcd6e3bf38d8bc0ed11a8e6ad387f5
cluster-samples-operator git f9a02d5c sha256:e265732cac3d736f2aebe460f267b28571240a3c81a96f4544d41ee82cd9266f
cluster-update-keys git e8478585 sha256:21b2dd99056f75dd73e643c1af8481d3cb08bcbdde46c9424b53bb11857aaf9a
configmap-reloader git dc91ddc4 sha256:c0261fb56b4e6153c9fa19c82811cb009267fa7e7002e04e2f2fd9c4892534b7
csi-driver-shared-resource git bc125def sha256:f08949776c0da652bda712b6464be99603c6c18e84f060a61d3c5e1c875fafc1
csi-driver-shared-resource-webhook git bc125def sha256:de572ffd2ba9ab6527aa54c959a672626a3dc882aec5d1c0feed1eed07d3e969
csi-external-provisioner git 9e8af011 sha256:e6b0c3823f83b07c05d25edc75f63c550b8e09a64b9e4f970c3942228a480856
csi-node-driver-registrar git d1a2105b sha256:c7a42318f31344ba91beac9594e53bcbad0e99dca7adca770719f7655c10a388
driver-toolkit git 1d5732f0 sha256:b603860a28bcd4394bb93ee79230dfaa810d38c9b62210090dbb69f304818716
egress-router-cni git 7089efe6 sha256:f7208f1b55357d616002941db2a011ee8b193af6aed3fc0e2b343cef7f8cadcf
etcd git e7911c0d sha256:70d53c8a8b6ef42183d3ef83c27bcaf512f8eeb44f3ce598571eb7d891808b8c
gcp-cloud-controller-manager git 26b43dfc sha256:bf455758878c2b337b76dd1736550dfaf12f181f90a21b3ef61a1c97f18f6dee
gcp-pd-csi-driver-operator git 799327f7 sha256:d979a5deb3f72eca40d08a4b22fd3b6915a37c390e325d37dabc17bddeb22edc
ironic-machine-os-downloader git 93b8b5fa sha256:0f4c56d61808f25b299b23b37020efe68f4c92e720c626581a12b0e9a64ba3eb
ironic-static-ip-manager git f44e8a08 sha256:1d32f886034daba483dbed0831013d7aa1c1eb09aa97ba41fc2f7af0162e3683
k8s-prometheus-adapter git e4f859be sha256:283b532fe7fd1213296647690b93cba4dc1b2d6062e2a173d9a063977d7fd0c3
keepalived-ipfailover git b58673a3 sha256:9f001785867f3b8d9d1cb99911a9cc580c909f25bafde867c4d5e138abcc6c71
kube-proxy git 53fea06b sha256:d337a77f476ca258474a4ac42ca7ec5a5743ef7fd2ddf73b11a389b275da6971
kube-rbac-proxy git c38f4734 sha256:34b361d65ba030921bf33473ae195df8a4327fcc1fea9a0f1d34a985a1a1280a
kube-storage-version-migrator git 6f213320 sha256:cde05f51c462953e51a72f9a405582e4a0f027d748877d179d82b323e3c95d2d
multus-admission-controller git a15bf454 sha256:0e5951909c40a70d9e6a49278024060d8f3a8958c9100bdc885774d20e0263f0
multus-networkpolicy git f988f894 sha256:f4945a13f7d47e2f4defbb1af256b38947c5fe9e0ea8420b22b29af73a504fdc
multus-route-override-cni git 73594f77 sha256:105bac2d1c74422eeeaf68f79f4051d35cda48f4aa51d41cde9b55ffdb4abfb0
network-interface-bond-cni git e6880659 sha256:900df84036f696072fc816445eee814a9d356d5e209e2244df22670b1878f607
network-tools git 234ed43e sha256:65192e608077752f2f58804ec5025697d166257e0e39cd51163294659c0fda2e
nutanix-cloud-controller-manager git 28bf5963 sha256:cdb698f0008ba9f3d2ab47d6dd843e9cad97d45531b81710836e0d2814d62ec3
nutanix-machine-controllers git 2f2e121b sha256:bbd6cd727e168cd16074cd73c477b5ecf768ac7c89fa2cb7845758c2bec536d9
olm-rukpak git 282cc84c sha256:1bbdee4a0de16bd4a9f15030fb733c475345591d10dbb83826decec9d4326008
openshift-controller-manager git 90f73f7e sha256:b6450d4040052edf47bd7c0ecfd20518d98fe717152217fb25355748bfec992d
openstack-cluster-api-controllers git 3b972b2b sha256:ade12728831d104b78e76b6b04e826de8d0099f01313ead54dcaa318a8c9f4ab
powervs-block-csi-driver-operator git 9c5dd8d1 sha256:2b35affc31891fa300d60e62f0348ba637a2920e3a3bb254e55216034f617490
powervs-cloud-controller-manager git 20e6dc70 sha256:06804cdf0a6391d197ab4a49cfb9d16917d0f29701f0b354b889b339b511d2d0
powervs-machine-controllers git 2bfcc0f8 sha256:a631fdcbf3a41dedeadd8ccaaec4de9b104ae0a8a50f34067a02bc3d70b07a9b
rhel-coreos sha256:b5ba1caa664a9f55c732bbf03665af3685c22479c7449dceb7234160607a9582
rhel-coreos-extensions sha256:9fe08c99482c15e533c0002d0eb33d8938e62df7e37ddfa9381dfacb78c99d27
sdn git 53fea06b sha256:a6701f12fd4e88f41f73c827d22b3fe588818f9ec53f00b63cac505f2e36a38a
service-ca-operator git 538c7b98 sha256:14febd47961a785d03b537965fe9557a73a9bcf25be38c9f10115fafc2756b6b
telemeter git c1ecd105 sha256:a39fc28233540408bf28871fb2ee120f18ef046f19edafcf807eed28c774756d
thanos git 85eee25c sha256:b393c971c75a054b8ba5ddf3ec485fc81dfe0eeda0a65df377f7cff693653d94

agent-installer-api-server

OCPBUGS-89848: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.2 #10802
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-102901: Bump x/net to v0.35.0-sec.4 #2295
Full changelog

agent-installer-node-agent

OCPBUGS-102913: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #1616
Full changelog

agent-installer-utils

OCPBUGS-68046: bump github.com/sirupsen/logrus to v1.9.3 #239
Full changelog

alibaba-cloud-controller-manager

OCPBUGS-102906: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #62
Full changelog

aws-cloud-controller-manager

OCPBUGS-103119: Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #177
OCPBUGS-88174: replace golang.org/x/net with sustaining fork v0.35.0-sec.4 #180
Full changelog

aws-cluster-api-controllers

OCPBUGS-102914: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #654
🌱 OCPBUGS-123712: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #645
OCPBUGS-78227: [release-4.16] update go mod dependency for konflux #591
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator

OCPBUGS-102919, OCPBUGS-102939: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #608
Full changelog

aws-machine-controllers

OCPBUGS-73903: Fix reconciler consistency checks in Update and Exists #168
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-102933, OCPBUGS-103121: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #210
OCPBUGS-79998, OCPBUGS-85635, OCPBUGS-85636: Bump google.golang.org/grpc to v1.79.3 #182
Full changelog

azure-cluster-api-controllers

OCPBUGS-78176: [release-4.16] update go mod dependency for konflux #364
Full changelog

azure-disk-csi-driver

OCPBUGS-102930: Bump golang.org/x/net to v0.35.0-sec.4 #174
Full changelog

azure-file-csi-driver

OCPBUGS-102923: Bump golang.org/x/net to v0.35.0-sec.4 #160
UPSTREAM: 3221: OCPBUGS-115466: Bump golang.org/x/crypto to v0.33.0-sec.5 #165
OCPBUGS-89335: Address CVE-2026-33186 #139
Full changelog

azure-kms-encryption-provider

OCPBUGS-79927: Bump google.golang.org/grpc to 1.64.1-sec.1 patch #48
Full changelog

azure-machine-controllers

OCPBUGS-103039: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #215
Full changelog

azure-workload-identity-webhook

OCPBUGS-102932: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #65
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-134633: Update RHCOS-release-4.16 bootimage metadata to 416.94.202610242150-0 #11042
OCPBUGS-102938: Bump golang.org/x/net to v0.35.0-sec.4 #10973
OCPBUGS-89841, OCPBUGS-89843, OCPBUGS-89847, OCPBUGS-92760: Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.33.0-sec.4 #10924
OCPBUGS-127603: Update gcloud version to one that can be found #10918
OCPBUGS-67206: Update RHCOS-release-4.16 bootimage metadata to 416.94.202608150307-0 #10798
Revert “OCPBUGS-60668: Update RHCOS-release-4.16 bootimage metadata to 416.94.202601221345-0” #10846
OCPBUGS-60668: Update RHCOS-release-4.16 bootimage metadata to 416.94.202601221345-0 #10281
OCPBUGS-74885: Azure UPI ARM template: use storageAccountId #10282
OCPBUGS-76586: terraform/provider/google: Fixing GCP inconsistencies present with the service account creation #10298
OCPBUGS-73879: data/manifests/bootkube/cvo-overrides: Default to eus-4.16 #10226
Full changelog

baremetal-machine-controllers

OCPBUGS-78099: [release-4.16] fix vendor/ for hermetic migration 4.16 #243
Full changelog

baremetal-operator

OCPBUGS-77278: Unblock BMH direct deletion when detached annotation is present #463
Full changelog

baremetal-runtimecfg

OCPBUGS-60113: Re-add ENABLE_NODEIP_DEBUG env var #362
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-102912, OCPBUGS-102935, OCPBUGS-103104: Use patched x/net fork v0.35.0-sec.4 #2416
OCPBUGS-91215, OCPBUGS-91552, OCPBUGS-91589: Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.2 #2346
OCPBUGS-111894: Fix pre-existing unit test failures #2374
Full changelog

cloud-credential-operator

OCPBUGS-81849: Bump go-jose/go-jose/v4@v4.1.4 #1040
OCPBUGS-79941: Bump google.golang.org/grpc to v1.79.3 #1026
Full changelog

cloud-network-config-controller

OCPBUGS-66346: [release-4.16] Fix capacity calculation #195
Full changelog

cluster-authentication-operator

OCPBUGS-102924: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #990
Full changelog

cluster-autoscaler

OCPBUGS-78702: allow clusterapi provider to skip paused resources #415
Full changelog

cluster-autoscaler-operator

OCPBUGS-102934: Bump x/net package in release-4.16 #390
Full changelog

cluster-baremetal-operator

OCPBUGS-77447: Bump github.com/go-errors/errors to v1.5.1 #562
Full changelog

cluster-capi-operator

OCPBUGS-79943: Bump google.golang.org/grpc to v1.79.3 #573
NO-JIRA: Allow sustaining engineering to self serve dependency updates #560
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-102954: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #515
Full changelog

cluster-config-api

CNTRLPLANE-1982: Promote streaming list encoding to Default #2600
OCPBUGS-71202: Add HTTPKeepAliveTimeout to IngressController API #2640
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-102965: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #291
Full changelog

cluster-dns-operator

OCPBUGS-102964: Use patched x/net fork v0.35.0-sec.4 #493
Full changelog

cluster-etcd-operator

OCPBUGS-102962: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #1697
OCPBUGS-68058: Update logrus to 1.9.3 to address CVE-2025-65637 #1546
Full changelog

cluster-image-registry-operator

OCPBUGS-68059: : Bump github.com/sirupsen/logrus to v1.9.1 #1285
Full changelog

cluster-ingress-operator

OCPBUGS-102952: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1573
OCPBUGS-86713: Add configuration override for X-SSL strip #1487
OCPBUGS-71202: Implement HTTPKeepAliveTimeout tuning option #1337
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-68064: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-rhel9-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.16.z] #2043
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-102957: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #963
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #624
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-68069: Bump github.com/sirupsen/logrus to v1.9.1 #144
Full changelog

cluster-monitoring-operator

NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #3113
OCPBUGS-102945: [release-4.16] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #3090
OCPBUGS-77276: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2831
Full changelog

cluster-network-operator

OCPBUGS-67000: Re-disable metrics server #2855
OCPBUGS-63233: Manual feature backport of cert rotation for whereabouts #3040
OCPBUGS-84182: fix(hypershift): use net.JoinHostPort for URL construction #2981
OCPBUGS-75890: Tweak iptables-alerter to try to avoid crictl bug #2898
: NO-JIRA: Update CNO reviewers/approvers #2768
Full changelog

cluster-node-tuning-operator

OCPBUGS-82675: Bump github.com/moby/spdystream from v0.2.0 to v0.5.1 #1551
OCPBUGS-78766: [4.16] PPC: filter out namespaces dir #1466
Full changelog

cluster-olm-operator

OCPBUGS-86243: Update grpc-go to v1.67.3-sec.1 to fix CVE-2026-33186 #206
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-68072: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.16] #654
Full changelog

cluster-storage-operator

OCPBUGS-102969: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #733
OCPBUGS-87613: remove oVirt code from CSO 4.16 #709
OCPBUGS-78769: Add patch permission to provisioner role #685
Full changelog

cluster-version-operator

OCPBUGS-102971: Bump golang.org/x/net to v0.35.0-sec.3 #1461
Full changelog

console

OCPBUGS-98424: CVE-2026-59869 bump js-yaml #17158
Fix for OCPBUGS-92076: CVE-2026-44990 #16719
OCPBUGS-100513, OCPBUGS-101789: Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss #17060
OCPBUGS-114417: Prevent binary secret data corruption when editing #17101
OCPBUGS-105793: Disable failing OLM and other e2e tests to unblock CI #16958
OCPBUGS-105796: Fix operator-hub e2e test by replacing unavailable Red Hat catalog source with Community #17081
OCPBUGS-87987: [release-4.16] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16599
OCPBUGS-81597: CVE-2026-4800 #16566
OCPBUGS-77123: [release-4.16] CVE-2026-26996 Bump minimatch library #16346
OCPBUGS-79439: Bump immutable #16657
OCPBUGS-88027: Fix JSON annotation parsing to prevent OperatorHub crash #16588
OCPBUGS-88377, OCPBUGS-88380, OCPBUGS-88412, OCPBUGS-88419, OCPBUGS-88444: CVE-2026-44495 #16612
OCPBUGS-88554: Stabilize legacy OperatorHub Cypress waits #16608
NO-JIRA: enable multi-architecture yarn builds #16417
OCPBUGS-83299: [release-4.16] openshift4/ose-console-rhel9: Axios: Remote Code Execution via Prototype Pollution escalation #16298
OCPBUGS-78673: Namespace is not persisting when switching to developer view from the topology page of admin page #16161
CONSOLE-5011: migrate to yarn berry #16078
OCPBUGS-76578: Bump axios #16032
NO-JIRA: Bump builder image to v29 #15993
OCPBUGS-74447: Bump lodash to latest #15967
OCPBUGS-69678: Disallowed Pipelines-plugin Pipelines navigation section #15857
Full changelog

console-operator

OCPBUGS-102982: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #1225
OCPBUGS-77992: update go mod dependency for konflux #1115
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-85669: CI Build root image tag sync with ART #234
Full changelog

coredns

OCPBUGS-77463: Modify .gitignore to not exclude vendor build folders #168
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-103061: CVE-2026-33814,OCPBUGS-103068: replace golang.org/x/net with openshift-sustaining fork #420
OCPBUGS-79978: Bump google.golang.org/grpc #389
OCPBUGS-68080: fix CVE-2025-65637 #361
Full changelog

csi-driver-manila-operator

OCPBUGS-102975: Use patched x/net fork v0.35.0-sec.4 #262
Full changelog

csi-driver-nfs

OCPBUGS-84931: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.67.3-sec.1 to avoid go version bump and fix CVE-2026-33186 #182
Full changelog

csi-driver-shared-resource-operator

OCPBUGS-102984: Bump golang.org/x/net to v0.35.0-sec.3 #128
Full changelog

csi-external-attacher

OCPBUGS-102988: Bump golang.org/x/net to v0.35.0-sec.4 #117
Full changelog

csi-external-resizer

OCPBUGS-102985: Bump golang.org/x/net to v0.35.0-sec.4 #215
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-102978, OCPBUGS-102990: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #230
Full changelog

csi-livenessprobe

OCPBUGS-102974: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #111
Full changelog

docker-builder

OCPBUGS-89824, OCPBUGS-90269, OCPBUGS-92346, OCPBUGS-92576, OCPBUGS-92768: Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 #553
Full changelog

docker-registry

OCPBUGS-102994: [release-4.16] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #482
Full changelog

gcp-cluster-api-controllers

OCPBUGS-78280: [release-4.16] update go mod dependency for konflux #267
Full changelog

gcp-machine-controllers

OCPBUGS-103045: Bump golang.org/x/net to v0.35.0-sec.3 #191
OCPBUGS-79970: Bump google.golang.org/grpc to v1.79.3 #167
OCPBUGS-79970: [release-4.16] Fix setup-envtest GCS 401 by downloading binaries directly #176
Full changelog

gcp-pd-csi-driver

OCPBUGS-103000: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #143
OCPBUGS-68087: Update logrus to 1.9.3 #92
Full changelog

haproxy-router

OCPBUGS-103005: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #844
OCPBUGS-86713: Strip X-SSL-* headers for plain HTTP #805
OCPBUGS-79960: Bump google.golang.org/grpc to v1.79.3 #769
Full changelog

hyperkube, pod

OCPBUGS-68041, OCPBUGS-68091: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 [4.16] #2582
OCPBUGS-74299: Skip E2e: attach on previously attached volumes should work #2568
Full changelog

hypershift

Sync approver aliases with main for release-4.16 #10196
ACM-45149: Migrate Go builder for hypershift-cli, hypershift-release #10067
OCPBUGS-33097: [release-4.16] fix(api): remove deprecated OVNSbDb service type #9820
OCPBUGS-120748: update Containerfile.cli base images to floating tags [release-4.16] #9560
OCPBUGS-99075: fix(backport): konnectivity agent auth #9097
OCPBUGS-84182: fix(cno): use brackets only for IPv6 in server URL #8348
OCPBUGS-76534: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7704
OCPBUGS-74375, OCPBUGS-74376: Support proxy authentication when user/pass is included in URL #7578
OCPBUGS-73118: Fix Konflux EC voilation, update deprecated base … #7459
Full changelog

ibm-cloud-controller-manager

OCPBUGS-120701: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #116
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-79964: Bump google.golang.org/grpc to v1.79.3 #145
OCPBUGS-77210: [release-4.16] standardize build paths #124
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-102992: Use patched x/net fork v0.35.0-sec.4 #187
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-103009: Replace golang.org/x/net with openshift-sustaining/net #170
OCPBUGS-115544: Fetch envtest assets from the controller-tools releases #181
OCPBUGS-67288: [release-4.16] Fix incomplete vendor/ #138
Full changelog

ibmcloud-machine-controllers

OCPBUGS-103003: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 #106
NO-JIRA: fix unit tests broken by deprecated kubebuilder-tools bucket #113
Full changelog

insights-operator

OCPBUGS-102999: Bump golang.org/x/net to v0.35.0-sec.3 #1357
OCPBUGS-68370: Add filtering to add other possible pod status to QEMU gatherer #1200
OCPBUGS-67009: QEMU logs are not gathered if there are pending status virt-launcher pods #1197
Full changelog

ironic

OCPBUGS-85333: update ironic-image commit hash to address CVE-2026-43003 #912
OCPBUGS-100162: bump openstack-ironic pin for CVE-2026-44918 fix #908
OCPBUGS-104459: bump openstack-ironic pin for CVE-2026-54423 fix(release-4.16) #877
OCPBUGS-76457: Bump pyasn1 to 0.5.1-4 #828
OCPBUGS-69789: Bump eventlet version to 0.33.1-7 #763
Full changelog

ironic-agent

OCPBUGS-85333: Update ironic-python-agent commit hash to address CVE-2026-43003 #316
OCPBUGS-99890: Bump ironic-python-agent pinned commit for CVE-2026-66138 #310
OCPBUGS-95070: Replace individual package removal with a single rpm -e loop #288
OCPBUGS-95070: Replace dnf remove with rpm -e to prevent dependency removal #276
OCPBUGS-61165: netutils: Use ethtool ioctl to get permanent mac address #215
OCPBUGS-69781: Bump eventlet version to 0.33.1-7 #232
Full changelog

kube-metrics-server

NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #85
OCPBUGS-79929: Bump google.golang.org/grpc to v1.79.3 #66
Full changelog

kube-state-metrics

OCPBUGS-103043: Use patched x/net fork v0.35.0-sec.4 #162
NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #192
OCPBUGS-74875: Deduplicate CRS stores #133
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-95082: OWNERS: Update component to Cloud Compute / KubeVirt Provider #82
Full changelog

kubevirt-csi-driver

OCPBUGS-79930: Bump google.golang.org/grpc to v1.79.3 #108
Full changelog

libvirt-machine-controllers

OCPBUGS-77196: Fix incomplete vendor/ #302
Full changelog

machine-api-operator

OCPBUGS-103044: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #1547
OCPBUGS-98439: Use resource group when generating default Azure image #1516
OCPBUGS-76849: bumped logrus to v1.9.3 #1463
Full changelog

machine-config-operator

OCPBUGS-98960: Remove sensitive ControllerConfig logging #6315
OCPBUGS-98253: Bootstrap MCS logging entire ignition #6290
OCPBUGS-62171: Fix - NetworkManager restart or crash renders br-ex unusable #5354
OCPBUGS-60113: Enable debug logging for nodeip-configuration #5218
OCPBUGS-77253: Machine-config controller should not log about non-existent pull-secret changes #5694
OCPBUGS-77184: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5685
Full changelog

machine-image-customization-controller

OCPBUGS-103007: Use patched x/net fork v0.35.0-sec.4 #191
OCPBUGS-68093: [4.16] uplift logrus #153
Full changelog

machine-os-images

OCPBUGS-87878: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #102
Full changelog

monitoring-plugin

OU-1589: [release-4.16] sanitize linkified URLs in alert annotations #1377
OCPBUGS-118240: [release-4.16] Bump fast-uri to 3.1.7 to fix CVE-2026-84292 #1337
OCPBUGS-127152: Replace react-linkify with linkify-react to fix CVE-2026-59887 #1356
NO-JIRA: [release-4.16] Sanitize alert runbook URLs #1292
Fix for OCPBUGS-113514: CVE-2026-18446 #1184
Fix for OCPBUGS-94001: CVE-2026-13676 #1049
Fix for OCPBUGS-90069 OCPBUGS-90073: CVE-2026-12151 CVE-2026-9697 #1007
OCPBUGS-79441: immutable bump #898
OU-1260: [release-4.16] feat: use npm instead of yarn #813
OCPBUGS-76807: fix for CVE-2025-69873 #849
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-85251: Fix server url in kubeconfig #300
NO-ISSUE: [release-4.16] Bump Go to 1.21 and fix CI build root image #292
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-70215: Prevent accidental IP deallocation in statefulsets #396
Full changelog

must-gather

OCPBUGS-86218: Collect object size with the object count #550
OCPBUGS-66106: Separate resources with comma to fix malformed inspect #515
Full changelog

network-metrics-daemon

OCPBUGS-130599: add ./bin to PATH in check_golint.sh #163
Full changelog

oauth-apiserver

OCPBUGS-74112: UPSTREAM: <carry>: bump kubernetes-apiserver to pick up loopback cert expiration update #166
NO-JIRA: (chore): update OWNERS file #172
Full changelog

oauth-proxy

OCPBUGS-112100: bugfix: rewrite open redirect strings to ‘/’ #386
Full changelog

oauth-server

OCPBUGS-103063: Replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #279
OCPBUGS-87068: bugfix: default to english when Accept-Language header contains more than 1000 underscores #274
Full changelog

oc-mirror

OCPBUGS-129584: v1 accept catalog root entries and relative symlink targets #1581
Full changelog

olm-catalogd

OCPBUGS-103064: [release-4.16] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #149
Full changelog

olm-operator-controller

OCPBUGS-131845: Fix test-unit target: download envtest binaries from GitHub releases [release-4.16] #834
Full changelog

openshift-apiserver

OCPBUGS-82682: Address CVE-2026-35469 #649
OCPBUGS-68104: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.16] #610
OCPBUGS-74113: UPSTREAM: <carry>: bump kubernetes-apiserver to pick up loopback cert expiration update #595
Full changelog

openshift-state-metrics

NO-ISSUE: synchronize OWNERS from main branch #144
Full changelog

openstack-cinder-csi-driver-operator

OCPBUGS-103055: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #195
Full changelog

openstack-machine-api-provider

OCPBUGS-78170: hermetic 4.16 #163
OCPBUGS-76794: Fix make test #155
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-103065, OCPBUGS-103070, OCPBUGS-103078: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1367
OCPBUGS-79980, OCPBUGS-79981, OCPBUGS-87898: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.67.3-sec.1 [release-4.16] #1318
OCPBUGS-82057: Drop github.com/distribution/distribution dep #1302
OCPBUGS-77959: Remove the collect-profiles info from the microshift kustomization file #1251
OCPBUGS-77169: Remove the collect-profiles job #1235
Full changelog

operator-marketplace

OCPBUGS-68108, OCPBUGS-68109: CVE-2025-65637 fixed in logrus v1.9.3+ #722
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-128828: node: fix serviceUpdateNotNeeded nil pointer comparison #3497
OCPBUGS-83497: External gateway: Remove routes for external gateway pods in terminating or not ready state #3140
OCPBUGS-78033: Add pperiyasamy to OWNERS for release-4.16 #3047
OCPBUGS-77685: Clear stale conntrack UDP entries for nodePorts #3038
OCPBUGS-77187: Fix conntrack reconciliation to use service port instead of endpoint port #2998
CORENET-6055, OCPBUGS-76277: [release-4.16] Dockerfile: Unpin OVN and consume the latest from FDP #2972
OCPBUGS-71219: [release-4.16] CVE-2025-65637 Bump github.com/sirupsen/logrus to v1.9.1 through indirect dependency conversion (go-controller module) #2906
OCPBUGS-72541: NetPol & MultiNetPol: Process update only when spec fields and/or related annotation are updated #2933
OCPBUGS-68349: Add ricky-rav to OWNERS for release-4.16 #2899
OCPBUGS-66155: Skip Pending pods in EgressIP status updates #2880
Full changelog

powervs-block-csi-driver

OCPBUGS-105268: Mitigate CVE-2025-30204 by bumping github.com/golang-jwt/jwt/v4 to v4.5.2 #139
Full changelog

prom-label-proxy

NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #404
Full changelog

prometheus

OCPBUGS-93677: fix for CVE-2026-42151 #395
NO-ISSUE: synchronize OWNERS from main branch #387
OCPBUGS-88616: remote: validate snappy decoded length before allocation in read endpoint #349
OCPBUGS-79985: Bump google.golang.org/grpc #321
Full changelog

prometheus-alertmanager

OCPBUGS-98169: bump github.com/hashicorp/memberlist to a forked version to fix CVE-2026-14362 #203
NO-JIRA: synchronize OWNERS with main #188
OCPBUGS-103072: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #174
OCPBUGS-100357: Set testdata CA expiry to 20 years from issue date (#4112) #146
OCPBUGS-76536: Include go-verify-deps expected files in gitignore #116
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

NO-ISSUE: synchronize OWNERS from main branch #420
OCPBUGS-103085, OCPBUGS-103089: [release-4.16] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #401
Full changelog

prometheus-node-exporter

OCPBUGS-103088: Use patched x/net fork v0.35.0-sec.4 #194
NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #203
Full changelog

route-controller-manager

OCPBUGS-102896: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #112
OCPBUGS-79934: Bump google.golang.org/grpc to v1.79.3 #87
Full changelog

tests

OCPBUGS-130858: stage the creation of test pods to minimize etcd impact #31742
OCPBUGS-105460: Use tagged version for openshift/kubernetes dependency #31541
OCPBUGS-74299: Update to latest openshift/kubernetes #30825
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-103096: Replace golang.org/x/net with sustaining fork for CVE-2026-33814 in 4.16 #137
OCPBUGS-78028: hermetic migration 4.16 #107
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-78020: hermetic migration 4.16 #86
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-86874: Bump google.golang.org/grpc #182
OCPBUGS-68119: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #158
Full changelog

vsphere-csi-driver-operator

OCPBUGS-103111: Bump golang.org/x/net to v0.35.0-sec.3 #358
Full changelog

vsphere-problem-detector

OCPBUGS-103110: Bump golang.org/x/net to v0.35.0-sec.4 #235
OCPBUGS-86445: fix concurrent map writes #219
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github