4.18.56

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.18.56-x86_64

Qualifiers (status api):

Tests:

Blocking jobs
- upgrade Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.18-e2e-aws-ovn-serial
- aws-ovn-single-node-upgrade-4.18-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.18-e2e-aws-upgrade-ovn-single-node
  - Attempt 1 Failed
  - Attempt 2 Failed
- aws-ovn-upgrade-4.18-micro Succeeded periodic-ci-openshift-release-main-ci-4.18-e2e-aws-ovn-upgrade
- azure-ovn-upgrade-4.18-micro Succeeded periodic-ci-openshift-release-main-ci-4.18-e2e-azure-ovn-upgrade
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.18-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.18-fips-payload-scan
- gcp-ovn-rt-upgrade-4.18-minor Succeeded periodic-ci-openshift-release-main-ci-4.18-upgrade-from-stable-4.17-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.18 Succeeded periodic-ci-openshift-hypershift-release-4.18-periodics-e2e-aws-ovn-conformance
- metal-ipi-ovn-ipv4 Succeeded (1 retry) periodic-ci-openshift-release-main-nightly-4.18-e2e-metal-ipi-ovn-ipv4
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.18-e2e-metal-ipi-ovn-ipv6
- microshift-ovn-conformance-parallel Succeeded periodic-ci-openshift-microshift-release-4.18-periodics-e2e-aws-ovn-ocp-conformance
- microshift-ovn-conformance-serial Succeeded periodic-ci-openshift-microshift-release-4.18-periodics-e2e-aws-ovn-ocp-conformance-serial

Upgrades from:

Untested upgrades: 4.17.14, 4.17.15, 4.17.16, 4.17.17, 4.17.18, 4.17.19, 4.17.20, 4.17.21, 4.17.22, 4.17.23, 4.17.24, 4.17.25, 4.17.26, 4.17.27, 4.17.28, 4.17.29, 4.17.30, 4.17.33, 4.17.34, 4.17.35, 4.17.36, 4.17.37, 4.17.38, 4.17.39, 4.17.40, 4.17.41, 4.17.42, 4.17.43, 4.17.44, 4.17.45, 4.17.46, 4.17.48, 4.17.49, 4.17.50, 4.17.51, 4.17.52, 4.17.53, 4.17.54, 4.17.55, 4.18.10, 4.18.11, 4.18.12, 4.18.14, 4.18.15, 4.18.17, 4.18.18, 4.18.19, 4.18.20, 4.18.21, 4.18.22, 4.18.23, 4.18.24, 4.18.25, 4.18.26, 4.18.27, 4.18.28, 4.18.29, 4.18.30, 4.18.31, 4.18.32, 4.18.33, 4.18.34, 4.18.35, 4.18.36, 4.18.37, 4.18.38, 4.18.39, 4.18.4, 4.18.41, 4.18.42, 4.18.43, 4.18.44, 4.18.45, 4.18.46, 4.18.47, 4.18.48, 4.18.49, 4.18.5, 4.18.50, 4.18.51, 4.18.52, 4.18.6, 4.18.7, 4.18.8, 4.18.9

Upgrades to:

4.19.49 (changes) - Success
4.19.0-0.ci-2026-09-24-163443 (changes) - Failed Pending

Loading changelog, this may take a while ...

Changes from 4.18.3

Created: 2026-09-24 11:49:13 +0000 UTC

Image Digest: sha256:630c143e63c6024267bf6f66cfc7c84366eb8a9dc022eaf7b411b8e1474ca183

Components

Kubectl 1.31.1
Kubernetes upgraded from 1.31.6 to 1.31.14
Kubernetes Tests upgraded from 1.31.1 to 1.31.12
Red Hat Enterprise Linux CoreOS upgraded from 418.94.202502250906-0 to 418.94.202609171815-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
OnClusterBuild (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
StreamingCollectionEncodingToJSON (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
StreamingCollectionEncodingToProtobuf (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ExternalOIDCWithUIDAndExtraClaimMappings (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Removed images

ovirt-csi-driver
ovirt-csi-driver-operator
ovirt-machine-controllers

Rebuilt images without code change

aws-cloud-controller-manager git c3951906 sha256:5237b161c07608a0a910ea502ac2e3e27dd5b929b8b03274dc183e6ab2ed9fc6
baremetal-machine-controllers git 1ede6c3f sha256:4c9eb3052c75bf720110d2fc0975bb1b10f547c35109738279e811024cb91406
cluster-bootstrap git d1e01954 sha256:af71b643e4bdebabf100c3322582acdf54131910c378a56f4287e653b64c7224
cluster-control-plane-machine-set-operator git d17bf3a1 sha256:db72696f42116b248c4ecad504f0cb02821c6fecc51663904f5a8d016b109419
cluster-csi-snapshot-controller-operator git 6fe70008 sha256:36c654caaeeca54fff2902df48e0f6921ee0e2bcd5af09044b7a95921fc2b2fe
cluster-kube-storage-version-migrator-operator git 59ba356f sha256:faeb660b12e1b9acd399e08fc9311951f73ddeb7810718cde617d2e40da670b3
cluster-machine-approver git 01d5fbbe sha256:f6b51f2e91ece9c565b70a1d132aa6375cb7f691b48a0aeb04f423e98ee6c818
cluster-openshift-apiserver-operator git 0a6f6eb9 sha256:b0a0531f33197215c334d5e7ba1f31a8c61b25a796c8162f70d3bb4ec32d3bcb
cluster-openshift-controller-manager-operator git f1711cf3 sha256:2bdca43bc4e942945f24486f462a7d2d6147280a0d6f6a0149f8b003678fc24b
csi-livenessprobe git 3a977844 sha256:5ee967e6bbb73689bc6cddb1d472004731f5f972a5f890e5e21c2ffa725778fa
driver-toolkit git 2e139edc sha256:f73f16d8bd5ad0f549eb6113dc23bde3b8fd608dc03dbef00ddf4ddaf5ea97b6
gcp-cloud-controller-manager git 6ea23561 sha256:a425ec37ee6d59dd711760af9005f2a3dfc5c1b065ec45d5e3f14e650c4d44f4
gcp-workload-identity-federation-webhook git f0a670c7 sha256:6e4118e3fe9255e72bc6cc86b7c7d98a1166656c47cc52d5bf7b64cc39646c40
ibm-cloud-controller-manager git a33026b1 sha256:6ad04104f92a8c651953dc9111d3ea2ca4d9f19da7bc40b1f38a0b63f5497fcd
ironic-static-ip-manager git cfbae04f sha256:22be9c9c6548fb4d6024ab970e3af746b5461d54cc4dda132b0869caa40eea13
keepalived-ipfailover git 716eb0ef sha256:0ce26a62345c356137307c5cafd436b9745004c5b9cd8c36adae22382b74abc1
multus-route-override-cni git 391c1b03 sha256:717ee27b5abc5298d4d859cc988e1f949026ecaa9771258d3097f71845a77590
nutanix-cloud-controller-manager git d9fe8f38 sha256:4462b88a594a80fb03b6c5ca4e545ea030e23c46fa3ef0181a924f4d58b0ffec
rhel-coreos sha256:d45007bd5e6fcf1c27652d8c69ae2863ea36942c9ebc101b5111f2cb1886a309
rhel-coreos-extensions sha256:e92c4728efed5b348a99625734ecf891911a66ab63b066cf37eafcae7eecf114

agent-installer-api-server

OCPBUGS-89884: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.2 #10800
MGMT-23439: Pin gotestsum to v1.12.2 for Go 1.21 compatibility #10019
OCPBUGS-74898: Retry incomplete cluster registration in ABI #8817
OCPBUGS-74911: Remove root=/dev/disk/by-label/dm-mpath-root from kargs #8820
And 6 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-103348: Bump x/net to v0.35.0-sec.4 #2297
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-node-agent

MGMT-21849: Skip arping for remote IPs not in outgoing NIC’s subnet #1332
And 5 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-utils

OCPBUGS-68243: bump github.com/sirupsen/logrus to v1.9.3 #237
append .0 to go.mod version #109
Full changelog

apiserver-network-proxy

append .0 to go.mod version. #81
Full changelog

aws-cluster-api-controllers

🐛 OCPBUGS-123705: UPSTREAM: <carry>: Fix unit tests for OpenShift CI environment #642
🌱 OCPBUGS-123680: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #641
OCPBUGS-77903: [release-4.18] update go mod dependency for konflux #589
OCPBUGS-61841: UPSTREAM <carry>: revert: Only tag NetworkInterfaces in RunInstances if IAM Allows It #570
OCPBUGS-58670, OCPBUGS-58675: bump github.com/golang/glog to v1.2.5 #556
OCPBUGS-56434: Update manifests to use v1 admissionregistration group #554
OCPBUGS-53729: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.7.2 (9283e64) into release-4.18 #543
Full changelog

aws-ebs-csi-driver

OCPBUGS-82745: Address CVE-2026-35469 #327
OCPBUGS-86167: UPSTREAM: 2367: cleanup: make verify should ignore copyright year #321
OCPBUGS-80206: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.71.3-sec.1 #313
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-103360, OCPBUGS-103371: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #610
OCPBUGS-80308: Bump google.golang.org/grpc #542
OCPBUGS-79429: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.18 #531
OCPBUGS-78299: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.17 #524
OCPBUGS-76582: Fix Cinder, Manila driver metrics #501
OCPBUGS-62664: disable e2e snapshot tests #463
OCPBUGS-63558: Add RBAC ClusterRole and Binding for driver node #454
OCPBUGS-63407: Use 127.0.0.1 for healtz http-endpoints #450
OCPBUGS-62973: Add withCABundleDaemonSetHook() to AWS EFS operator #447
OCPBUGS-55053: Correct ASH driver inject env config #381
OCPBUGS-54453: Enable required driver services #375
OCPBUGS-60596: Bump library-go to fix assignment to nil map issue #421
OCPBUGS-60203: Remove stale conditions #413
OCPBUGS-54383: Disable remove-not-ready-taint for azure disk csi driver #374
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

aws-kms-encryption-provider

OCPBUGS-80184: Bump google.golang.org/grpc to v1.79.3 #43
Full changelog

aws-machine-controllers

OCPBUGS-73789: Fix reconciler consistency checks in Update and Exists #166
OCPBUGS-63138: client: re-use a single file for building the session instead of randomly named files #146
Full changelog

aws-pod-identity-webhook

OCPBUGS-51231: github.com/go-jose/go-jose/v4 v4.0.5 #201
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-80210, OCPBUGS-80211, OCPBUGS-80350: Bump google.golang.org/grpc to v1.79.3 #190
Full changelog

azure-cluster-api-controllers

OCPBUGS-89899: Address CVE-2026-39829 #401
OCPBUGS-80212: Bump google.golang.org/grpc to v1.79.3 #390
OCPBUGS-77905: [release-4.18] update go mod dependency for konflux #362
OCPBUGS-58861: Update manifests to remove reliance on admission registration v1beta1 #348
Full changelog

azure-disk-csi-driver

OCPBUGS-114621: UPSTREAM: 3277: fix: allow . in Azure tags #179
OCPBUGS-80213: Address CVE-2026-33186 #142
OCPBUGS-78037: add instantAccessDurationMinutes parameter to enable IA snapshots for PremiumV2/UltraSSD disks #130
Full changelog

azure-file-csi-driver

OCPBUGS-103366: Bump golang.org/x/net to v0.35.0-sec.4 #158
OCPBUGS-92789: Bump golang.org/x/crypto to v0.33.0-sec.3 #148
OCPBUGS-80216: Address CVE-2026-33186 #133
Full changelog

azure-kms-encryption-provider

OCPBUGS-80185: Bump google.golang.org/grpc to 1.64.1-sec.1 patch #46
OCPBUGS-53497: bump golang-jwt v4 #11
Full changelog

azure-machine-controllers

OCPBUGS-65882: Set updateDomainCount to one when faultDomainCount is one #175
OCPBUGS-63669: Support datadisks on Stack Hub #167
OCPBUGS-56167: [release-4.18] Update virtualmachines service to armcompute/v5 SDK #145
OCPBUGS-56654: Fix failure when attempting to modify immutable availabilitySet #153
OCPBUGS-55373: Update eviction policy for Spot VMs from Deallocate to Delete #139
OCPBUGS-54355: Re-reconcile machine on NIC provisioning failure #135
Full changelog

azure-workload-identity-webhook

OCPBUGS-53801: github.com/golang-jwt/jwt/v4 v4.5.2 #31
OCPBUGS-51233: github.com/go-jose/go-jose/v4 v4.0.5 #27
Full changelog

baremetal-cluster-api-controllers

OCPBUGS-58861: Update manifests to remove reliance on admission registration v1beta1 #51
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-77052: Update RHCOS-release-4.18 bootimage metadata to 418.94.202608142238-0 #10795
OCPBUGS-95616: azure: Add field in installconfig to disallow shared access key #10670
OCPBUGS-78550: fix wavelength zone name regex #10409
OCPBUGS-45579: PowerVS: Listen to machineNetwork #9277
OCPBUGS-73784: pkg/asset/manifests/azure: save cidr blocks #10217
OCPBUGS-76598: Increase agent-installer pre-network-manager timeout #10299
OCPBUGS-67203: Update the RHCOS 4.18 bootimage metadata #10294
OCPBUGS-74676: [release-4.18] GCP: skip AI zones #10275
OCPBUGS-69880: Azure UPI ARM template: use storageAccountId #10179
OCPBUGS-68244: [4.18] uplift logrus #10166
OCPBUGS-57590: Mount the user-ca-bundle into ICC #9794
OCPBUGS-63494: Catch gcp destroy cases where the operation is nil #10030
OCPBUGS-52659: [release-4.18] CORS-3825: pkg/infrastructure/azure: support nvme #9545
OCPBUGS-65588: Update the RHCOS 4.18 bootimage metadata #10113
OCPBUGS-58504: Refactor removing loadbalancer in OpenStack #9831
OCPBUGS-53235: Validation for API and Ingress VIPs when using user-managed load balancer #10046
OCPBUGS-62810: Update the RHCOS 4.18 bootimage metadata #10014
OCPBUGS-59490: Make swift containers removal not fatal for UPI. #9839
OCPBUGS-61529: Use less permissive access for /var/lib/etcd for SNO #9937
OCPBUGS-61178: Refine check for supported SNO platforms #9923
OCPBUGS-60592: baremetal: always set external v6 URL on dualstack #9895
OCPBUGS-54598: Update the RHCOS 4.18 bootimage metadata #9900
OCPBUGS-56177, OCPBUGS-59155, OCPBUGS-59158: Migrate AWS SDK to V2 to support MX-Central Region #9709
OCPBUGS-58321: allow to deploy single nodes with UPI #9824
OCPBUGS-54744: Filter out excess CA certs when adding node #9647
OCPBUGS-58264: vSphere - remove unit tests using nip.io #9813
OCPBUGS-56797: [Nutanix] nil error displayed when setting a not exist value in preloadedOSImageName field #9747
OCPBUGS-57139: ensure ctrplane nodes can access bootstrap MCS #9772
OCPBUGS-57220: sort zone slices extracted from map of byo subnets #9774
OCPBUGS-56864: Update Control Plane replica validation for Single Node OpenShift #9758
OCPBUGS-50690: vsphere - check if host is powered down or on standby before uploading template #9468
OCPBUGS-53142: PowerVS: COS eu-es hack #9626
OCPBUGS-50840: Fix panic when there are no available IPs #9479
OCPBUGS-55794: IBI nmstate unit test fix #9692
OCPBUGS-54947: Fix Load balancer IP setup #9659
OCPBUGS-45564: Align vSphere UPI haproxy config with IPI #9276
OCPBUGS-53453: IBMCloud: Move to IBM TF openshift fork #9592
OCPBUGS-53422: Avoid adding duplicate entries to NO_PROXY #9588
OCPBUGS-52515: Remove error logging when determining image arch #9539
OCPBUGS-52429: Remove tmp directory used for agent pxe files #9536
OCPBUGS-51211: Fixes panic during GCP tags fetch due to unstable network #9513
OCPBUGS-49885: [Nutanix] Install multi-NICs cluster failed with failureDomains #9440
Full changelog

baremetal-operator

OCPBUGS-98321: Add BMH finalizer on PreprovisioningImage #509
OCPBUGS-59259: Fix HFC error handling in actionPreparing #502
OCPBUGS-87967: Fix preprovisioning network Secret lifecycle during BMH deletion #495
OCPBUGS-76988: Unblock BMH direct deletion when detached annotation is present #461
OCPBUGS-56766: Make firmware update handle only a subset of Spec.Updates #421
OCPBUGS-56431: Redfish: correctly handle missing system ID #417
OCPBUGS-53324: BMO can expose any secret via BMCEventSubscription CRD #405
OCPBUGS-45250: Remove dataImage finalizer if BMH is missing #389
Full changelog

baremetal-runtimecfg

OCPBUGS-60111: Re-add ENABLE_NODEIP_DEBUG env var #364
OCPBUGS-59280: Bump logrus version #354
OCPBUGS-57782: iptables: Switch PREROUTING REDIRECT rule to DNAT instead #351
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-91365, OCPBUGS-94688: Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.2 #2344
OCPBUGS-109669: Fix pre-existing unit test failures on release-4.18 #2372
OCPBUGS-83872: pkg/cli/admin/upgrade: Tighten force warnings #2165
OCPBUGS-65707: fix(must-gather): do not set node affinity if nodename is set #2145
OCPBUGS-64608: Help with must-gather scheduling through suggesting preferance of nodes #2127
OCPBUGS-58233: Return error in case of error #2054
OCPBUGS-57507: avoid transfering permissions when copying artifacts from node-joiner pod #2039
OCPBUGS-56240: Adding sos.conf file for default sos config into the tools image #2021
OCPBUGS-55449: Get installer image from configMap for node-image command #2013
OCPBUGS-55647: Use fedora image in unit tests instead of centos #2014
Full changelog

cloud-credential-operator

OCPBUGS-81887: Bump go-jose/go-jose/v4@v4.1.4 #1031
OCPBUGS-80219: Fix CVE-2026-33186 using openshift-sustaining grpc-go fork #1041
OCPBUGS-74548: Resolve nil pointer exception in hasResourceTags #968
OCPBUGS-65800: ccoctl azure: retry custom role creation on consistency errors #950
OCPBUGS-65479: ccoctl: use pagination when listing resources in aws #947
OCPBUGS-63548: ccoctl: add public-key-file flag to create-all #938
OCPBUGS-55127: snyk to ignore SNYK-GOLANG-GOLANGORGXNETHTML-9572088 #915
OCPBUGS-60971: ccoctl: aws to use proper issuer url on subsequent runs #907
OCPBUGS-60618: ccoctl azure dnszone-resource-group-name now optional #899
OCPBUGS-58680: github.com/golang/glog v1.2.5 #891
OCPBUGS-58247: ccoctl: only add owned tag to azure resources on create #882
OCPBUGS-56979: Azure: resolve nil pointer exception when role assignment exists #869
OCPBUGS-54827: Render: configure proxy on bootstrap static pod #862
OCPBUGS-53825: update github.com/golang-jwt/jwt #837
OCPBUGS-53345: github.com/golang/glog v1.2.4 #835
OCPBUGS-51550: Ignore SNYK-GOLANG-GOLANGORGXOAUTH2JWS-8749594 due to not being affected #822
OCPBUGS-51237: github.com/go-jose/go-jose/v4 v4.0.5 #824
Full changelog

cloud-network-config-controller

OCPBUGS-73750: [release-4.18] Fix pointers without ptr.Deref #199
OCPBUGS-65651: [release-4.18] Fix capacity calculation #193
OCPBUGS-64779: [release-4.18] Change the capacity struct from int to ptrOfInt #189
OCPBUGS-56156: Increase API call timeout to 30 second #170
Full changelog

cluster-authentication-operator

OCPBUGS-75897: set appropriate rolling update settings #835
OCPBUGS-49749: Exclude etcd readiness checks from /readyz to ignore temporary etcd hiccups #754
OCPBUGS-54569: Avoid duplicate OAuth client creation #764
Full changelog

cluster-autoscaler

OCPBUGS-78699: allow clusterapi provider to skip paused resources #413
OCPBUGS-75925: Fixes histograms becoming empty after loaded from checkpoints #402
OCPBUGS-60908: revert openshift replica fix #375
OCPBUGS-60235: fix checkpoint gc of unknown recommenders #368
OCPBUGS-59260: Fix cool down status condition to trigger scale down #361
OCPBUGS-53241: improve replica counting and decrease target size behavior #346
Full changelog

cluster-autoscaler-operator

OCPBUGS-103386: Bump x/net package in release-4.18 #388
Full changelog

cluster-baremetal-operator

OCPBUGS-81549: Explicitly set the ReadOnlyRootFilesystem flag to false #584
OCPBUGS-78708: Update kubebuilder tools to more latest version #579
OCPBUGS-57590: Mount the user-ca-bundle into ICC #486
OCPBUGS-63439: Always have a service for ironic-api port #514
OCPBUGS-63469: Allow provisioningIP when network disabled #515
OCPBUGS-60586: Remove webhookport (9447) as HostPort #501
OCPBUGS-58315: Bump github.com/go-errors/errors to v1.5.1 #492
OCPBUGS-53080: Add missing relatedObjects #467
Full changelog

cluster-capi-controllers

OCPBUGS-80220: Bump google.golang.org/grpc to v1.79.3 #297
OCPBUGS-56434: Update manifests to leverage v1 admissionregistration group #241
Full changelog

cluster-capi-operator

OCPBUGS-80224: Bump google.golang.org/grpc to v1.79.3 #566
NO-JIRA: Allow sustaining engineering to self serve dependency updates #558
OCPBUGS-56919: fix: bump openshift/library-go to fix ValidatingAdmissionPolicyV1 apply in capiinstaller #308
OCPBUGS-56434: Should not use v1beta1 of the AdmissionRegistration API group #298
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-63166: ccm: disable unused secure-serving port and webhook #421
OCPBUGS-60015: Add Service using common resource templating #405
OCPBUGS-60015: Update service selector to match deployment label #403
Full changelog

cluster-config-api

OCPBUGS-98486: add new serviceAccountToken fs type #2927
OCPBUGS-70315: Add HTTPKeepAliveTimeout to IngressController API #2638
NO-JIRA: [release-4.18] OWNERS: update approvers/reviewers #2625
OCPBUGS-67214: Introduce ClosedClientConnectionPolicy to IngressController API #2618
CNTRLPLANE-1980: Promote streaming list encoding to Default #2598
NO-JIRA: Promote streaming list encoding to Default on Hypershift. #2562
CNTRLPLANE-1610: Add feature gates for StreamingCollectionEncoding #2528
OCPBUGS-52347: Add CEL validation for RegistrySources in Image API #2218
OCPBUGS-60904: MachineOSConfig name should match MachineConfigPool #2458
Update crd-schema.json to release 1.33 branch #2459
: add OnClusterBuilds to default config #2365
Merge #2316
OCPBUGS-56183: Add IPsec API for NAT-T UDP encapsulation support #2331
OCPBUGS-55792: [release-4.18] config: add uid and extra claim mappings for external OIDC configuration #2311
OCPBUGS-53221: Allow spaces in AWS resource tags #2239
OCPBUGS-54784: [release-4.18] Bump openshift/controller-tools to latest commit #2267
OCPBUGS-51295, OCPBUGS-51380: Reject new NodeStatus with revision set #2215
OCPBUGS-51295: [release-4.18] Add the option to test ratcheting validations within integration tests #2217
Full changelog

cluster-config-operator

OCPBUGS-68249: Update logrus to 1.9.3 to address CVE-2025-65637 #464
Full changelog

cluster-dns-operator

OCPBUGS-52514: [release-4.18] Add runbook_url for CoreDNSErrorsHigh #429
Full changelog

cluster-etcd-operator

OCPBUGS-78776: [release-4.18] : Prefer to remove members where they have another healthy machine in the same failure domain index #1573
OCPBUGS-76284: Add priority field to prevent early shutdown #1545
OCPBUGS-63451: Ensure revision.json persists on ungraceful shutdown #1503
OCPBUGS-58412: bump library-go to bring in revision controller revision-ready annotation fix #1518
OCPBUGS-61235: Vendor latest mixin, including additional and modified alerts for etcdDatabaseQuotaLowSpace #1478
OCPBUGS-59992: fix ordering on bootstrap IP selection #1458
OCPBUGS-59803: add missing ports to svc and pod spec #1455
OCPBUGS-56834: etcd pod containers do not start when tls min version is 1.3 #1428
OCPBUGS-56110: adjust alerts according to platform #1424
OCPBUGS-53513: fix CVE-2025-30204 #1413
OCPBUGS-55066: increase etcdGRPCRequestsSlow duration #1408
Full changelog

cluster-image-registry-operator

OCPBUGS-53873: bump github.com/golang-jwt/jwt #1217
OCPBUGS-51606: bump golang.org/x/oauth2 #1208
Full changelog

cluster-ingress-operator

OCPBUGS-103414: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1571
OCPBUGS-70315: Implement HTTPKeepAliveTimeout tuning option #1333
NO-JIRA: Add new NID team members to OWNERS #1319
OCPBUGS-67214: Implement ClosedClientConnectionPolicy field #1322
NE-1951: Pre-upgrade Admin Gate for Gateway API CRD Management Succession #1196
NE-1952: Pre-upgrade check for Gateway API CRD Management Succession #1193
OCPBUGS-48377: Add e2e tests for IdleConnectionTerminationPolicy #1194
OCPBUGS-48377: Add support for IdleConnectionTerminationPolicy #1188
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-76284: Add priority field to prevent early shutdown #2031
OCPBUGS-58412: bump library-go to bring in revision controller revision-ready annotation fix #1976
OCPBUGS-63119: SCC: add hostmount-anyuid-v2 #1937
OCPBUGS-61039: Set goaway chance to 0.001 #1912
OCPBUGS-60176: Add missing service ports to apiserver service #1888
OCPBUGS-56030: bump library-go to bring in updated audit policies #1843
OCPBUGS-49898: bindata/alerts/slo: improve burnrate calculation #1808
OCPBUGS-53066: Bump library-go #1828
Full changelog

cluster-kube-cluster-api-operator

OCPBUGS-80231: Bump google.golang.org/grpc to v1.79.3 #77
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-76284: Add priority field to prevent early shutdown #906
OCPBUGS-58412: bump library-go to bring in revision controller revision-ready annotation fix #897
OCPBUGS-60131: Missing endpoint slices for open ports the operator uses #852
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #622
OCPBUGS-76284: Add priority field to prevent early shutdown #612
OCPBUGS-58412: bump library-go to bring in revision controller revision-ready annotation fix #590
Full changelog

cluster-monitoring-operator

OCPBUGS-103412: [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #3075
OCPBUGS-105311: [release-4.18] wrap library-go resourceCache with mutex for thread safety #3041
OCPBUGS-104540: Backport e2e stabilization 4.18 #3030
OCPBUGS-100375: [release-4.18] fix: watch cluster wide proxy changes and apply changes accordingly #3024
OCPBUGS-94081: ship collector:node_scrape_collector_success:avg to Telemetry #2992
OCPBUGS-86995: increase lookup interval #2944
OCPBUGS-77274: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2833
OCPBUGS-67168: Add the collection of MTV migration metrics #2774
OCPBUGS-61965: add flag --watch-referenced-objects-in-all-namespaces to prometheus-operator #2723
OCPBUGS-64579: Fix KSM deny-list typo #2731
OCPBUGS-63488: Remove AlertManager endpoints when disabled #2737
OCPBUGS-62852: Add mcd_local_unsupported_packages metric from MCO to telemetry 4.18 #2702
OCPBUGS-63410: [release-4.18] allow using remoteWrite[].oauth2.proxyFromEnvironment for cluster-wide proxy #2724
OCPBUGS-63017: test: remove image registry e2e tests #2711
OCPBUGS-61706: chore(jsonnet): use prometheus_remote_storage_queue_highest_timestamp_seconds in PrometheusRemoteWriteBehind #2669
OCPBUGS-59962: operator: increase wait time till degraded to max 4 times 5m #2633
OCPBUGS-56251: set upgradable false when alertmanager v1 is specified #2591
OCPBUGS-55005: chore: introduce context-rich anb case sensitive unmarshaller for the monitoring and set CMO to Upgradeable=false if errors are found #2592
OCPBUGS-53024: Fix opentelemetry metrics to use regexp on label match #2578
OCPBUGS-52565: Bump prometheus-operator to 0.78.2 #2576
OCPBUGS-50706: Add incidents metric to telemetry #2570
Full changelog

cluster-network-operator

OCPBUGS-100191: Bump github.com/containernetworking/cni v0.8.0 -> v1.3.0 #3096
OCPBUGS-85443: Remove duplicated openssl parameter #3006
OCPBUGS-84869: wait for patch port to apply drop garp flows #2988
OCPBUGS-84180: fix(hypershift): use net.JoinHostPort for URL construction #2977
OCPBUGS-77151: Add config override for openflow-probe #2965
OCPBUGS-78833: Fix whereabouts-token-watcher DaemonSet improvements #2940
OCPBUGS-74154: whereabouts-config is a reserved name for user interaction. #2884
OCPBUGS-73767: Tweak iptables-alerter to try to avoid crictl bug #2877
OCPBUGS-65704, OCPBUGS-65705: Annotate whereabouts-controller #2842
OCPBUGS-62671: Add drop flows for GARP #2810
OCPBUGS-60984: Update CNO reviewers/approvers #2766
OCPBUGS-60795: Add release version annotation to whereabouts-controller/whereabouts-token-watcher #2782
OCPBUGS-47651: Re-disable metrics server #2622
OCPBUGS-58047: Add cert-rotation script into cno #2702
OCPBUGS-56183: Implement IPsec NAT-Traversal encapsulation option #2711
OCPBUGS-54717: Add IPv6 NGINX configuration #2683
OCPBUGS-50582, OCPBUGS-52949: Unexpected Behavior During Cluster Upgrade for the ovn-ipsec-host pods #2644
OCPBUGS-52837: frr-k8s: rename validatingwebhook name #2661
OCPBUGS-48305: frr-k8s: align manifests with operator #2657
OCPBUGS-41178: Updating cluster-network-operator-container image to be consistent with ART for 4.18 #2491
Full changelog

cluster-node-tuning-operator

OCPBUGS-90575: Requeue PerformanceStatus update when status write fails #1552
OCPBUGS-82752: Bump github.com/moby/spdystream from v0.4.0 to v0.5.1 #1544
OCPBUGS-75954: PPC: filter out namespaces dir #1465
OCPBUGS-69947: [release-4.18] E2E: skip stalld test checking sched_fifo #1451
OCPBUGS-63450: Do not cause kubelet failed dependency by ocp-tuned-one-shot.service #1417
And 10 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-olm-operator

OCPBUGS-80239: Bump google.golang.org/grpc to v1.79.3 #200
OCPBUGS-57767: fix olm.maxOpenShiftVersion float parsing #125
OCPBUGS-48478: [release-4.18] Add openshift node selector annotation #116
Full changelog

cluster-policy-controller

OCPBUGS-98486: Backport fs type service account token 4.18 #196
Full changelog

cluster-samples-operator

OCPBUGS-63511: references to github.com/sclorg/django-ex.git now also refer to the branch #657
OCPBUGS-55783: Samples Operator should sort failing image imports #638
OCPBUGS-55782: only update LastTransitionTime if operator status change #637
OCPBUGS-55781: Adding filter to clusterOperatorInformerEventHandler #636
OCPBUGS-54258: Adding mutex to func createSamples on handler.go #615
OCPBUGS-54351: add rhdmalone to owners #617
Full changelog

cluster-storage-operator

OCPBUGS-87556: remove oVirt code from CSO 4.18 #707
OCPBUGS-77627: add vsphere permissions for checking if users is authorized to see metrics #670
OCPBUGS-62666: Move metrics to vsphere driver #632
OCPBUGS-51320: fix Vsphere cluster Storage operator in Unavailable state #558
Full changelog

cluster-update-keys

NO-JIRA: Updating openshift-ci-release-key for 2 years #72
Full changelog

cluster-version-operator

OCPBUGS-70182: Unify capitalization when comparing architectures for available updates #1327
NO-ISSUE: hongkai becomes an approver release-4.18 #1286
OCPBUGS-62869: disable metrics auth for hypershift clusters #1242
OCPBUGS-58450: Failing=Unknown upon long CO updating #1211
OCPBUGS-60222: CVO protects /metrics with authorization #1223
OCPBUGS-55359: install/0000_00_cluster-version-operator_01_admingate_configmap: Add ack-4.18-kube-1.32-api-removals-in-4.19 #1181
Full changelog

configmap-reloader

append .0 to go.mod version #69
Full changelog

console

OCPBUGS-113759: block GraphQL introspection over websocket #17130
Fix for OCPBUGS-92075: CVE-2026-44990 #16717
OCPBUGS-100515, OCPBUGS-101791: Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss #17058
OCPBUGS-98420: [release-4.18] CVE-2026-59869 bump js-yaml #17076
OCPBUGS-81520: Console can only show user name instead of full name as the display name #16238
OCPBUGS-86740, OCPBUGS-87085, OCPBUGS-97763: [release-4.18] bump package: protobufjs, fast-uri #16728
OCPBUGS-100069: quickstart page i18n misses (Fix Quick Starts i18n bundle lookup for zh-CN) #16872
OCPBUGS-91944: Prevent binary secret data corruption when editing #16673
OCPBUGS-99487: Disable Knative e2e Cypress tests in CI #16803
OCPBUGS-99648: Disable shipwright e2e tests to unblock CI #16818
OCPBUGS-86453: [release-4.18] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16511
Fix for OCPBUGS-81604: CVE-2026-4800 #16563
OCPBUGS-84284: Bump follow-redirects to 1.16.0 to fix CVE-2026-40895 #16675
OCPBUGS-77125: [release-4.18] CVE-2026-26996 Bump minimatch library #16344
OCPBUGS-79447: Bump immutable #16325
NO-JIRA: enable multi-architecture yarn builds #16421
CONSOLE-5011: migrate to yarn berry #16073
NO-JIRA: Bump builder image to v29 #15995
OCPBUGS-65808: Fix PatternFly dark theme colors for charts and form inputs #15951
OCPBUGS-74458: Bump lodash to latest #15965
OCPBUGS-73753: Fix Helm chart installation with CA/TLS certificates #15914
OCPBUGS-73662: Namespace is not persisting when switching to developer view from the topology page of admin page #15910
OCPBUGS-69915: PVC shows negative Available space in OpenShift Console on RHOCP 4 #15868
OCPBUGS-69448: Fixes namespace-scoped operators that were not showing as installed when viewing OperatorHub in “All Projects” mode #15855
OCPBUGS-68361: Disallowed Pipelines-plugin Pipelines navigation section #15842
OCPBUGS-65592: HPA Form View in RHOCP Web Console Incorrectly Requires Both CPU and … #15725
OCPBUGS-65932: Preserve query string in perspective switch + remove dev console folks from reviewers #15761
OCPBUGS-65533: Preserve path on perspective switch #15716
OCPBUGS-64735: Expose prometheus tenancy label path as a proxy #15685
OCPBUGS-64682: limit node log length to 1000 lines #15680
OCPBUGS-63657: Remove required flag from ‘console.flag/model’ pipelines-plugin extension #15654
OCPBUGS-63247: fix bug where Roles list was displaying invalid data f… #15619
OCPBUGS-63041: switch to dev perspective for /dev-monitoring #15601
OCPBUGS-44156: bump dompurify to latest #15589
OCPBUGS-62326: /auth/error?error=missing_state&error_type=auth is showing blank page #15544
OCPBUGS-61569: Update CHANGELOG for 4.18 plugin SDK package publish #15516
OCPBUGS-61569: Fix bug with Console provided PatternFly shared modules #15479
OCPBUGS-61697: Remove ancient X-XSS-Protection header #15493
OCPBUGS-60236: Make sure CSP violations are only reported to telemetry once per day per browser #15453
NO-JIRA: Update CHANGELOG for latest 4.18 plugin SDK package publish #15456
OCPBUGS-50983: Store Topology sidebar alert in the localStorage #15431
OCPBUGS-54660: Added patternfly/react-topology to shared module list of dynamic plugin sdk #15371
OCPBUGS-50570: Fix regression where plugins were not tracking CSP violation status a… #14754
OCPBUGS-60140: Recognize Detached BMH status #15362
OCPBUGS-54660: Add BaseNode in topology folder into Dynamic Plugin SDK #15369
: OCPBUGS-60278: Fix i18n string for event stream #15403
OCPBUGS-54660: Expose OdcBaseNode through the dynamic plugin SDK #15370
OCPBUGS-54660: Expose topology components and utils via plugin SDK internal package #14777
OCPBUGS-58364: change ‘/metrics/usage’ endpoint to ‘/api/metrics/usage’ #15272
OCPBUGS-59778: add data-test attrs to console plugins table #15327
OCPBUGS-59786: Update the golang.org/x/crypto/ssh to 0.31.0 in the openshift-console image #15330
OCPBUGS-59501: Add the Origin header to the HeaderBlacklist in the co… #15295
OCPBUGS-59443: Not able to launch terminal window from OCP web console due to console plugin conflicts #15290
OCPBUGS-59446: Cannot read properties of undefined (reading ‘node-role.kubernetes.io/master’) error while accessing node logs from console #15292
OCPBUGS-58457: fix bug where / in console.tab/horizontalNav href brea… #15250
OCPBUGS-58203: OpenShift console PVC clone cannot use B as the unit #15215
OCPBUGS-58317: Implement sessions in openshift authenticator #15237
OCPBUGS-58088: Cannot read properties of undefined (reading ‘filter’) error while accessing nodes from console. #15202
OCPBUGS-58089: Getting “Oh no something went wrong” error message in web console. #15203
OCPBUGS-57931: Add the ability to launch multiple modals with useModal hook #15196
OCPBUGS-57580: Update vSphere configuration form to support CM YAML f… #15191
OCPBUGS-57743: Fix TypeError Cannot read properties of null (reading ‘metadata’) #15188
OCPBUGS-57209: Add flags in console static plugin for all the components of this epic #15160
OCPBUGS-36173: Secret key with binary file changes when edited via Console. #15178
OCPBUGS-57181: Fix ‘/metrics’ endpoint token review to handle interna… #15153
OCPBUGS-57353: fix VirtualizedTable runtime error if sortColumn is no… #15173
OCPBUGS-57093: Add all files to vendor regardless of gitignore #15131
OCPBUGS-56774: [knative] Self-provisioner user can not access or create event sources via ODC #15095
OCPBUGS-56862: Sample segment sessions #15103
OCPBUGS-56757: HorizontalPodAutoscalers via console require CPU resource limit even though HPAs use requests for scaling #15093
OCPBUGS-54337: Debug pod logs are not accessible when debugging a node via OpenShift Console #14942
OCPBUGS-56255: remove 60 day alert from cluster update modal #15055
OCPBUGS-55991: Remove the devconsole backend common internet proxy and replace it with dedicated ones #15043
OCPBUGS-53172: Include init containers in readiness count if ready and started is true #14884
OCPBUGS-54899: Fetching taskRuns in PLR details page using PLR UID also #14961
OCPBUGS-54888: Can’t edit deployment (from the private git repository) in RHOCP 4.15 via console #14959
OCPBUGS-45369: Authenticate user token in openshift Authenticate func #14664
OCPBUGS-55195: fix bug where operator appears twice #14984
OCPBUGS-54269: fix bug where /k8s/all-namespaces/volumesnapshots 404s #14905
OCPBUGS-52372: VolumeSnapshots are not displayed in OpenShift Web Console #14833
OCPBUGS-52406: Retain original path when detecting perspective #14834
OCPBUGS-52371: Update the monitoring topic used by the console team #14832
OCPBUGS-52490: enable clicking outside NodeLogs Selects to close them #14843
OCPBUGS-50501: Updating cypress config to have video enabled for the CI results #14831
OCPBUGS-52511: Remove logoutOpenShift method call #14845
OCPBUGS-50609: update the Deployment pod on change in imageStream #14757
OCPBUGS-50648: add support for “OpenShift Virtualization Engine” valid subscription filter on OperatorHub #14761
OCPBUGS-51086: Show Observe section without PROMETHEUS and MONITORING flags #14784
OCPBUGS-48798: Pipeline visualisation shows all tasks as Failed and after that goes to Running state #14698
OCPBUGS-51180: Linkify OLM operator uninstall message #14789
OCPBUGS-51149: Do not load CSRs if user does not have permissions #14787
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

console-operator

OCPBUGS-98985: [4.18] Stabilize telemetry config to prevent continuous console pod rollouts #1190
OCPBUGS-77861: update go mod dependency for konflux #1113
NETOBSERV-2023, OCPBUGS-60304: Implement a quickstart for netobserv operator #997
OCPBUGS-60081: Fetch synced CM for the CertificateAuthority issuer + Wire synced OIDC Auth CM to Console #1031
OCPBUGS-59786: Update the golang.org/x/crypto/ssh to 0.31.0 in the openshift-console image #1027
OCPBUGS-45869: don’t set current clients when no OIDC providers are configured #948
OCPBUGS-52294: Custom route TLS should be optional when IngressController’s DefaultCertificate is set #966
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-85672: CI Build root image tag sync with ART #236
OCPBUGS-60871: [release-4.18] host-device: Return interface name in result #208
OCPBUGS-56928: bridge: Add option to enable port isolation #203
append .0 to go.mod version #196
: OCPBUGS-56928: Add a new firewall ingress-policy “isolated” #191
OCPBUGS-55354: Fix dhcp #186
OCPBUGS-55346: Check error returned by ipv6 SettleAddresses #185
Full changelog

coredns

OCPBUGS-60462: UPSTREAM: 7083 and 6836: Fix failing TestZoneExternalCNAMELookupWithProxy #152
append .0 to go.mod version #134
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-80309: Bump google.golang.org/grpc #387
OCPBUGS-57800: Rebase release-4.18 onto release-1.31 #322
OCPBUGS-58835: CARRY: don’t ignore json files #339
OCPBUGS-43430: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.31 into release-4.18 #312
Full changelog

csi-driver-nfs

OCPBUGS-82754: Bump github.com/moby/spdystream@v0.5.1 #194
OCPBUGS-80254: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.71.3-sec.1 to avoid go version bump and fix CVE-2026-33186 #180
Full changelog

csi-external-attacher

OCPBUGS-80255: Bump google.golang.org/grpc to v1.79.3 #105
Full changelog

csi-external-provisioner

OCPBUGS-82755: Address CVE-2026-35469 #135
OCPBUGS-80256: Bump google.golang.org/grpc #130
Full changelog

csi-external-resizer

OCPBUGS-103430: Bump golang.org/x/net to v0.35.0-sec.4 #213
OCPBUGS-80257: Bump google.golang.org/grpc to v1.79.3 #203
OCPBUGS-62467: Requeue PVC over PV creation #176
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-80258, OCPBUGS-80261, OCPBUGS-80262: Bump google.golang.org/grpc to v1.79.3 #211
OCPBUGS-63574: UPSTREAM: 1303: Fix requeueing snapshot content after deletion error #190
Full changelog

csi-node-driver-registrar

OCPBUGS-63324: update log level verbosity to not clutter logs #89
Full changelog

docker-builder

OCPBUGS-66990: bump buildah to 1.37.7 to fix CVE-2025-52881 #498
OCPBUGS-65655: BuildConfig inline Dockerfile fails with heredoc syntax #486
OCPBUGS-57758: S2I build cpu limits observed by assemble are limited to 1 cpu #473
OCPBUGS-48071: Upgrade Kubernetes to 1.30.2 and Golang to 1.22 for compatibility #464
OCPBUGS-46580: buildah dependency bump to 1.37.6 #453
Full changelog

docker-registry

OCPBUGS-68253: update logrus to v1.9.1 #464
IR-526: remove AWS region check #437
OCPBUGS-53657: bump jwt and oauth dependencies #430
Full changelog

egress-router-cni

OCPBUGS-100191: Bump containernetworking/cni to v1.3.0 github.com/containernetworking/plugins to 1.4.0 #109
Full changelog

etcd

OCPBUGS-57112: Updating ose-etcd-container image to be consistent with ART for 4.18 #333
Revert “ETCD-727: Rebase etcd 3.5.21 openshift 4.18” #332
ETCD-727: Rebase etcd 3.5.21 openshift 4.18 #325
OCPBUGS-55724: Add configurable option for hardware-related timeout delay #328
DOWNSTREAM: <carry>: OCPBUGS-51971: fix a compaction induce latency issue #312
ETCD-708: Rebase etcd 3.5.18 openshift 4.18 #307
Full changelog

gcp-cluster-api-controllers

OCPBUGS-80270: Bump google.golang.org/grpc to v1.79.3 #290
OCPBUGS-78278: [release-4.18] update go mod dependency for konflux #265
OCPBUGS-58861: Update manifests to remove reliance on admission registration v1beta1 #247
Full changelog

gcp-machine-controllers

OCPBUGS-103482: Bump golang.org/x/net to v0.35.0-sec.3 #189
OCPBUGS-80293: Bump google.golang.org/grpc to v1.79.3 #165
OCPBUGS-59387: Add max-concurrent-reconciles flag to machine actuator #126
OCPBUGS-52495: OCPBUGS-52494: Disable shielded VMs for non-UEFI disks #112
Full changelog

gcp-pd-csi-driver

OCPBUGS-80274: Bump google.golang.org/grpc to v1.71.3-sec.1 in release-4.18 #112
OCPBUGS-68258: UPSTREAM: 2056: bump github.com/sirupsen/logrus to v1.9.3 #89
OCPBUGS-44772: Fix Hyperdisk Resize That Requires Iops/Throughput Adjustment #83
OCPBUGS-44769: Fix RWX mode for hyperdisks #74
Full changelog

gcp-pd-csi-driver-operator

OCPBUGS-80273: Replace google.golang.org/grpc with fork #187
Full changelog

haproxy-router

OCPBUGS-86726: Prevent SSRF via FQDN-typed EndpointSlices #821
OCPBUGS-86715: Strip X-SSL-* headers for plain HTTP #800
OCPBUGS-80275: Bump google.golang.org/grpc to v1.79.3 #768
OCPBUGS-67214: Add option abortonclose to HAProxy configuration template #703
OCPBUGS-48377: Add support for IdleCloseTerminationPolicy #647
Full changelog

hyperkube, kube-proxy, pod

OCPBUGS-54724: Fix implementation of ContainsCIDR to allow non-equal addresses #2267
OCPBUGS-65553: Update to Kubernetes v1.31.14 #2521
OCPBUGS-65494: Fix Concurrentmap Iteration #2512
OCPBUGS-61773: UPSTREAM: <carry>: backporting fix for concurrent map iteration and write #2456 #2475
CNTRLPLANE-1610: Backport StreamingCollectionEncoding for JSON and protobuf #2483
OCPBUGS-61557: Rebase v1.31.13 #2465
Revert “UPSTREAM: revert<carry>: Mark admissionregistration.k8s.io/v1beta1 as deprecated.”” #2448
OCPBUGS-60511: Bump to v1.31.12 #2440
OCPBUGS-60524: podresources: list: use active pods #2413
UPSTREAM: revert<carry>: Mark admissionregistration.k8s.io/v1beta1 as deprecated.” #2422
OCPBUGS-57488: UPSTREAM: <carry>: Mark admissionregistration.k8s.io/v1beta1 as deprecated. #2333
OCPBUGS-57499: UPSTREAM:131579: fix(kubelet): acquire imageRecordsLock when removing image #2399
OCPBUGS-44757: Adjust NodeMonitorGracePeriod to 50s #2385
OCPBUGS-59535: Rebase v1.31.11 to 4.18 #2377
OCPBUGS-57887: Update to Kubernetes v1.31.10 #2348
OCPBUGS-57070: UPSTREAM: <carry>: Bump cadvisor version to fix container_fs metrics #2332
OCPBUGS-57219: kubelet: fix a stall on startup from waiting too long for a stat call #2324
OCPBUGS-56835: UPSTREAM: 130047: adjusting loopback certificate validity in kube-apiserver #2316
OCPBUGS-56384: Propagate error when creating CustomResourceStorage instead of panicking #2303
OCPBUGS-56438: Update to Kubernetes v1.31.9 #2307
OCPBUGS-56192: UPSTREAM: 131236: RWX tests should create RWX volumes #2300
UPSTREAM: 127757 : OCPBUGS-55639: scheduler: Improve CSILimits plugi… #2283
OCPBUGS-55267: Update to Kubernetes v1.31.8 #2278
: OCPBUGS-54807: skip tests on platform type External #2268
OCPBUGS-53015: Update to Kubernetes v1.31.7 #2248
Full changelog

hypershift

fix(deps): OCPBUGS-76288: Update runc, selinux, and their transitive deps to fix CVE-2025-52881 #8289
ACM-37663: Rebase hypershift operator runtime image to RHEL 9.8 ELS #9451
ACM-38044: update Containerfile.cli base images to floating tags [release-4.18] #9044
OCPBUGS-99142: fix(backport): konnectivity agent auth #9096
OCPBUGS-62756: Restart HCP on stale serving certs #8245
OCPBUGS-89356: build(operator): drop hypershift-no-cgo from operator container images #8760
NO-JIRA: remove path filter from control-plane-operator pipelines #8665
OCPBUGS-80278: fix CVE-2026-33186 by replacing grpc-go #8515
OCPBUGS-84180: fix(cno): use brackets only for IPv6 in server URL #8346
OCPBUGS-76532: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7699
OCPBUGS-77368: Fix ignition-server pod restarts #7878
CNTRLPLANE-1708: Backport Customer Global Pull Secret to OpenShift 4.18.z #7354
OCPBUGS-72932: Fix Konflux EC voilation, update deprecated base … #7456
OCPBUGS-69847: test: remove unit tests that depend on network communication [release-4.18] #7406
OCPBUGS-65843: specify SCC annotation for pods in data plane #7267
CNTRLPLANE-1902: Migrate 4.18 pipelines to common pipeline template #7211
OCPBUGS-61700: use csi-resizer image from release provider #7103
OCPBUGS-63638: [release-4.18] fix(konnectivity): resolve circular dependency causing DNS timeouts and excessive retries #7111
OCPBUGS-63034: [release-4.18] Update DNS names for ovn-kubernetes cp metrics #7025
OCPBUGS-63369: Make the hypershift CLI binary FIPS-compliant #7093
OCPBUGS-62808: Fix driver-config ConfigMap content flapping due to random ordering #6944 #6947
CNTRLPLANE-1424: feat(konflux): tag MCE HO images with latest #6837
OCPBUGS-62816: set default goaway-chance to 0.001 #6950
OCPBUGS-61904: resolve MIRRORED_RELEASE_IMAGE flapping #6858
OCPBUGS-61700: Sync RBAC for expansion support in kubevirt CSI driver #6355
OCPBUGS-61568: [release-4.18] fix(proxy): ensure URLs have scheme before proxy resolution #6793
OCPBUGS-61203: ci: konflux multi-arch images #6867
OCPBUGS-61203: Use the common konflux pipeline and update CLI dockerfile #6832
NO-JIRA: chore(deps): update konflux references #6667
OCPBUGS-57142: [release-4.18] HCP payload doesn’t respect multiple mirrors #6672
OCPBUGS-60485: feat(validations): add wildcard support to DNS SAN conflict detection #6649
OCPBUGS-60148: Always compress and encode payload in token secret for inplace upgrades #6721
OCPBUGS-60923: MCE 2.8 konflux for hcp-cli #6700
CNTRLPLANE-1333: New API to support specifying cluster-autoscaler flags #6641
OCPBUGS-60458: Update PSA from v1beta1 to v1 #6644
CNTRLPLANE-1269: chore(deps): update konflux references #6658
CNTRLPLANE-1205: Add missing mce-2.8 pipeline #6656
OCPBUGS-59503: [release-4.18] Support proxy authentication when user/pass is included in URL #6460
CNTRLPLANE-1229: Move CPO pipeline to hermetic builds #6597
OCPBUGS-57818: Reuse hosted cluster release and metadata providers #6301
OCPBUGS-58126: Don’t use /version for haproxy health checks #6323
OCPBUGS-57273: Add proxy variables for the MCD Pod #6247
OCPBUGS-56166, OCPBUGS-56955: Fix CatalogSource images check when unauthorized #6237
OCPBUGS-56166, OCPBUGS-56955: Add support for registry root entry only in the IDMS/ICSP #6163
OCPBUGS-56627: Do not validate OCP API Server SANS if PKI reconciliation is disabled #6186
CNTRLPLANE-917: Konflux build pipeline service account migration #6084
OCPBUGS-56524: switch admissionregistration API to v1 #6172
OCPBUGS-55177: Don’t check if olm images exist if guest cluster #6065
OCPBUGS-55230: Add annotation to configure KAS goaway-chance #6066
OCPBUGS-54865: KAS-Bump audit-webhook-initial-backoff and TerminationGracePeriodSeconds when audit webhook is enabled #6020
OCPBUGS-54737: Bump socks5 proxy, konnectivity proxy, http proxy, token minter memory requests #6052
OCPBUGS-55148: Update OpenShift apiserver liveness and readiness probe endpoints to livez and readyz #6059
OCPBUGS-54946, RHOCPPRIO-433: Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs #6091
OCPBUGS-55146: Use 135 for terminationGracePeriodSeconds for v2 KAS #6057
OCPBUGS-54698: Add missing servicemonitors and prometheusrules permissions for non-OVN #6000
OCPBUGS-53404: Set shutdown watch termination grace period on kube-apiserver #5874
OCPBUGS-51810: Fix golang crypto dependency go.mod replacement #5992
OCPBUGS-54814: [release-4.18] add feature set aware feature gates to HO and CPO #6014
OCPBUGS-54624: Don’t set IgnitionServerTokenExpirationTimestampAnnotation if already set #5980
OCPBUGS-54630: Sync RBAC for attaching volumes on VM level #5988
OCPBUGS-54627: Use system trust bundle in CPO IDP https client #5981
ARO-15695, OCPBUGS-54625: backport capabilities api #5964
OCPBUGS-54411: Backport PR 5876 to release-4.18 #5936
OCPBUGS-54498: Support hypershift-operator scoping for secretJanitor #5961
OCPBUGS-54609: [release-4.18] fix(api): Adjust CRD validation rules to account for ignition server disable #5950
NO-JIRA: Red Hat Konflux update control-plane-operator-4-18 #5963
OCPBUGS-53905: bump golang-jwt v4 and v5 #5905
ART-11792: update go mod dependency for konflux #5919
OCPBUGS-51739, OCPBUGS-51810: Bump dependencies to OCP fork in backports #5898
OCPBUGS-53321: Handle multiple mirror entries for source #5890
OCPBUGS-51239: fix(deps): bump go-jose #5858
OCPBUGS-52982: Fix audit-logs container to properly handle SIGTERM #5774
OCPBUGS-52863: stop using dev mode for loggers #5811
OCPBUGS-52878: Kubernetes API Server apply-bootstrap container does not respect SIGTERM #5780
OCPBUGS-52516: Make managed-trust-bundle optional #5783
OCPBUGS-52417: [release-4.18] refactor aws identity health check into new controller #5770
OCPBUGS-51375: use registryOverrides when automaitcally retrieving catalog images for hosted control plane #5723
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-80280: Bump google.golang.org/grpc to v1.79.3 #143
OCPBUGS-77207: [release-4.18] standardize build paths #122
OCPBUGS-58741: bump github.com/golang/glog to version v1.2.4 #104
append .0 to go.mod version #96
OCPBUGS-55283: tech debt: rework vendor patches #89
OCPBUGS-53913: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #82
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-55297: [IBM VPC] set offlineExpansion to false in e2e test manifest #144
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-103453: Replace golang.org/x/net with openshift-sustaining/net #172
OCPBUGS-115513: Fetch envtest assets from the controller-tools releases #183
OCPBUGS-67286: [release-4.18] Fix incomplete vendor/ #140
OCPBUGS-51825: CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork #120
OCPBUGS-58861: Update manifests to remove reliance on admission registration v1beta1 #119
Full changelog

ibmcloud-machine-controllers

OCPBUGS-103467: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 #104
OCPBUGS-41223: Updating ose-ibmcloud-machine-controllers-container image to be consistent with ART for 4.18 #45
NO-JIRA: vendor golint instead of relying on the CI build root #115
OCPBUGS-81647: bump vpc go sdk #91
NO-JIRA: Modernize test infrastructure to align with other MAPI providers #87
OCPBUGS-47135: CVE-2024-45338 ose-ibmcloud-machine-controllers-container: Non-linear parsing of case-insensitive content in golang.org/x/net/html [openshift-4.18] #69
OCPBUGS-52872: IBMCloud: MAPI replacing unhealthy CP nodes #62
Full changelog

insights-operator

OCPBUGS-80283: Bump google.golang.org/grpc to v1.79.3 #1283
OCPBUGS-76963: Extends the time for the extractor liveness probe #1234
OCPBUGS-76537: [release-4.18] [bugfix] The ConfigMap value for StoragePath is ignored on basic routine #1239
OCPBUGS-68263: Update github.com/sirupsen/logrus to v1.9.3 #1205
OCPBUGS-68263: [release-4.18] golanci-lint version update & corresponding fixes (#1045) #1206
OCPBUGS-66396: Add filtering to add other possible pod status to QEMU gatherer #1195
OCPBUGS-66182: QEMU logs are not gathered if there are pending status virt-launcher pods #1189
OCPBUGS-66181: [bugfix] The archive’s records may include files whose names are out of bounds #1188
OCPBUGS-61972: add missing permissions for replicasets and events #1146
And 6 elided commits (e.g. from squash or rebase merges)
Full changelog

insights-runtime-exporter, insights-runtime-extractor

OCPBUGS-77789: remove dnf cache from the container images #69
Full changelog

ironic

OCPBUGS-88475: Updating openstack-ironic commit that fixes CVE-2026-43003 #903
OCPBUGS-105860: update ironic pin to include CVE-2026-54423 fix (release-4.18) #893
OCPBUGS-100164: Update openstack-ironic commit hash for CVE-2026-44918 #888
OCPBUGS-76459: Bump pyasn1 to 0.5.1-4 #826
OCPBUGS-74407: Update sushy to include DGX B200 credentials fix #832
OCPBUGS-74115: Bump keystonemiddleware version to 10.7.1-0.20260216144200.4c001ba for CVE-2026-22797 fix #795
OCPBUGS-69790: Bump eventlet version to 0.33.1-7 #760
OCPBUGS-65573: Include Handle HTTP 400 and 409 race condition in Redfish power opera… #727
OCPBUGS-62647: Bump sushy to include etag fix #701
OCPBUGS-55938: Extract files one-by-one in logwatch #657
METAL-1302: Do not use openstack packages #646
OCPBUGS-52290: Fix runlogwatch script #642
Full changelog

ironic-agent

OCPBUGS-99888: Correct ironic-python-agent pin to include the CVE-2026-66138 fix #314
OCPBUGS-88475: Update openstack-ironic-python-agent commit hash that address CVE-2026-43003 #313
OCPBUGS-99888: Bump ironic-python-agent pinned commit for CVE-2026-66138 #308
OCPBUGS-95066: Replace individual package removal with a single rpm -e loop #286
OCPBUGS-95066: Replace dnf remove with rpm -e to prevent dependency removal #274
OCPBUGS-69780: Bump eventlet version to 0.33.1-7 #230
OCPBUGS-68360: Include Test advertised ip reachability before assigning it #226
OCPBUGS-62456: netutils: Use ethtool ioctl to get permanent mac address #206
OCPBUGS-56097: collect the entire journal from the host #189
OCPBUGS-55364: Delay determining the hostname to put into ignition #183
METAL-1302: Do not use openstack packages #178
Full changelog

ironic-machine-os-downloader

append .0 to go.mod version #103
Full changelog

kube-metrics-server

OCPBUGS-80190: Bump google.golang.org/grpc to v1.79.3 #64
Full changelog

kube-rbac-proxy

OCPBUGS-39450: Updating kube-rbac-proxy-container image to be consistent with ART for 4.18 #105
OCPBUGS-60930: fix(go.mod): bump golang.org/x/crypto/ssh to 0.31.0 #125
Full changelog

kube-state-metrics

OCPBUGS-74873: Deduplicate CRS stores #131
Full changelog

kube-storage-version-migrator

OCPBUGS-78273: fix /vendor for hermetic 4.18 #239
NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-18). #225
append .0 to go.mod version #216
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-39554: Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 4.18 #45
OCPBUGS-95084: OWNERS: Update component to Cloud Compute / KubeVirt Provider #77
Full changelog

kubevirt-csi-driver

OCPBUGS-80191: Bump google.golang.org/grpc to v1.79.3 #101
OCPBUGS-79362: Add annotation-based fallback for infra VM node ID resolution #86
OCPBUGS-63670: Add awels as an approver in 4.18 branch #73
OCPBUGS-61700: Implement volume expansion #71
OCPBUGS-54630: Ensure volume stays attached through reboots #55
Full changelog

libvirt-machine-controllers

OCPBUGS-77194: Fix incomplete vendor/ #300
Full changelog

machine-api-operator

OCPBUGS-78795: [release-4.18] : correct aws kms permissions #1478
OCPBUGS-78796: [release-4.18] Use resource group when generating default Azure image #1480
OCPBUGS-59387: Enabled 10 concurrent reconciles on GCP #1392
OCPBUGS-57057: Updates GCP CredentialsRequest #1376
OCPBUGS-52494, OCPBUGS-52496: Updates GCP credentials request #1341
OCPBUGS-52567: add image/read permissions #1342
OCPBUGS-51263: Drop oVirt support #1333
Full changelog

machine-config-operator

OCPBUGS-122250: Add missing verb in MCC RBAC #6540
OCPBUGS-105477: Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole #6391
OCPBUGS-94116: move cleanUpDuplicatedMC to avoid double reboot on first updated #6249
OCPBUGS-91747: Verify extension packages are installed #6216
OCPBUGS-98445: Remove sensitive ControllerConfig logging #6294
OCPBUGS-97588: Bootstrap MCS logging entire ignition #6268
OCPBUGS-86845: Apply password only if changes exist #6113
OCPBUGS-86695: use –delete-if-present for karg removal #6102
OCPBUGS-86844: Fix ssh and password rollbacks #6096
OCPBUGS-86692: Fix re-cordon detection #6101
OCPBUGS-86300: Add terminationMessagePolicy to build pod containers #6074
OCPBUGS-86021: Fix units rollback if update failure #6052
OCPBUGS-79483: set default-timeout-stop to 200s globally #5805
OCPBUGS-62692: configure-ovs: work around a Cisco switch issue #5329
OCPBUGS-78056: Prevent unnecessary systemd unit disable #5758
OCPBUGS-74148: enable nodeip-configuration for platform external #5578
OCPBUGS-77777: reduce MCO image size #5738
OCPBUGS-77576: mcd_config_drift not working properly #5726
OCPBUGS-77421: Remove MCD liveness probe #5710
OCPBUGS-74644: After OCL is enabled few phases in MCN are not updating as expected #5605
OCPBUGS-77092: Machine-config controller should not log about non-existent pull-secret changes #5680
OCPBUGS-77041: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5671
OCPBUGS-76560: [release-4.18]: cherry pick to few fixes that needed for missing services and configuration #5653
OCPBUGS-71227: MCP is not correctly degraded when a pivotError happens #5534
OCPBUGS-70336: Remove log exposing kubeconfig #5528
OCPBUGS-62169: Fix - NetworkManager restart or crash renders br-ex unusable #5356
OCPBUGS-65850: Remove –mount directives #5433
OCPBUGS-62294: Make static DNS with DHCP IP work #5311
OCPBUGS-63346: Invalid architecture value found in annotation during 4.19 update #5366
OCPBUGS-60111: Enable debug logging for nodeip-configuration #5220
OCPBUGS-62671: [release-4.18] Networking: reset ovn-remote config and allow ovnkube controller to set it #5325
OCPBUGS-62845: Recheck generatedByControllerVersion annotation prior to deleting a degraded MC #5341
OCPBUGS-62499: Add /etc/docker/certs.d to template #5320
OCPBUGS-62637: Machine-config controller should actively manage cordon while draining #5322
OCPBUGS-62350: Add mcd_local_unsupported_packages recording rule #5315
OCPBUGS-62321: Add control-plane label for master nodes on legacy clusters #5314
OCPBUGS-61840: Override NMState service definition #5288
OCPBUGS-57357: Race in configure-ovs.sh affects bonding interface configuration. #5118
OCPBUGS-59929, OPNET-681: Support migration to NMState #5207
OCPBUGS-60034: Add workaround fix for static pod race #5212
OCPBUGS-56751: Support NODEIP_HINT in IPI deployments too #5081
OCPBUGS-55246: kubelet: readonly mounts for criometricsproxy #4998
OCPBUGS-58067: Ensure the build controller restarts on upgrade #5140
OCPBUGS-57328: Do not set cpu system reserve below the default value #5152
OCPBUGS-56624: Give keepalived container chroot cap #5073
OCPBUGS-58044: Boot image controller should correctly handle marketplace boot images #5138
OCPBUGS-57935: add MachineConfiguration to CO related objects #5134
OCPBUGS-54463: Update desired config in MCN on OCL update #5026
OCPBUGS-57900: MCC complains about v1 MachineOSConfig in default featureset #5131
OCPBUGS-56900: Fix dynamic-system-reserved-calc.sh when only true parameter is used #5095
OCPBUGS-56517: pkg/operator/status: Drop PoolUpdating as an Upgradeable=False condition #5065
OCPBUGS-56585: scope MCD node listers to current node #5068
OCPBUGS-56867: Only update boot disks during GCP boot image updates #5089
OCPBUGS-56823: Boot Image Controller should not degrade when golden configmap is slow to update #5085
OCPBUGS-56703: daemon: fix ostree-finalize-staged race workaround for package mode RHEL workers #5078
Merge #5025
OCPBUGS-56401: Add hot loop detection in the boot image controller #5062
OCPBUGS-55638: OCPBUGS-55637: Add admin_acks handling in the MCO #5027
OCPBUGS-56217: Compare the osImageURLs for OS validation check #5052
OCPBUGS-56170: error from generateAndValidateRenderedMachineConfig function can be misleading #5049
OCPBUGS-55383: Leverage shared node.env for both AWS providerID and hostname units #5008
OCPBUGS-53427: pkg/operator/status: Drop kubelet skew guard, add RHEL guard #4956
[release 4.18] OCPBUGS-55473: In OCL. Usbguard service fails when we install the usbguard extension #5018
OCPBUGS-54765: [release-4.18] kubelet-service: narrow down restorecon path #4978
OCPBUGS-55428: MSBIC should not update windows machinesets #5012
OCPBUGS-55290: MCO should fall back to us-east-1 for AWS bootimages if no region specific-AMI exists #5000
OCPBUGS-55293: Fix PollUntilContextTimeout in syncRenderConfig #5001
Update cluster operator’s status condition message #4993
OCPBUGS-53278: In OCL. Cannot install extensions #4945
OCPBUGS-54817: Make mtu-migration run after wait-for-primary-ip #4979
OKD-239: Consolidate OpenStack and PowerVS hostname handling into mco-hostname script #4955
OCPBUGS-54462: OSUpdateStarted event should only be emitted on actual OS updates #4967
OCPBUGS-51132: [release-4.18] /etc/crio/crio.conf.d/00-default should contain runtime_root for runc #4869
OCPBUGS-52949: Add ipsec connect wait service #4926
OCPBUGS-53306: Fixing typos for MachineConfigNode #4927
OCPNODE-2276: Set Upgradeable=False when cluster is on cgroup v1 #4921
OCPBUGS-53111: daemon: ensure ostree-finalize-staged is started before rebooting #4918
OCPBUGS-53110: Update ObservedGeneration in KubeletConfig #4917
[release 4.18] OCPBUGS-50954: In OCL, MCPs are reporting Updating=false while the image is being built #4859
OCPBUGS-50865: Make resolv-prepender env file optional #4855
OCPBUGS-48809: Enable nmstate-configuration on all platforms #4804
OCPBUGS-48296: Update machine-config-daemon-pull.service to use custom policy for Podman < 4.4.1 #4788
Full changelog

machine-image-customization-controller

OCPBUGS-82149: Return error when network data Secret lacks nmstate key #174
OCPBUGS-77888: Clean up dnf cache to reduce container image size #168
OCPBUGS-68262: [4.18] Uplift logrus #151
append .0 to go.mod version #134
Full changelog

machine-os-images

OCPBUGS-87876: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #100
OCPBUGS-53141: Change rhcos release browser url #55
OCPBUGS-51266: Decompress pxe file only if it’s a valid compressed file #52
Full changelog

metallb-frr

OCPBUGS-74485: Dockerfile: unpin FRR rpm #121
OCPBUGS-55343: OpenShift Only: TEMPORARY: pin FRR version to known working rpm #88
OCPBUGS-48305: Use metrics for readiness/liveness probes #76
Full changelog

monitoring-plugin

NO-JIRA: [release-4.18] Sanitize alert runbook URLs #1297
OCPBUGS-98772: [release-4.18] replace outdated react-linkify dependency #1179
OCPBUGS-74461: CVE-2025-13465 openshift4/ose-monitoring-plugin-rhel9: prototype pollution in _.unset and _.omit functions [openshift-4.18] #1141
OCPBUGS-79448: immutable bump: fix for CVE-2026-29063 #922
OU-1241: unset frontend timeout to use the backend configuration #905
OCPBUGS-83374: fix: re encode params when redirecting from graph to query-browser #878
NO-JIRA: fix: pin http-errors to 2.0.1 for hermetic builds #870
OU-993: adding cypress Dockerfiles #861
OU-876: monitoring automated testing backported and adjusted to pf-5 and diff UI #777
NO-JIRA: simplify dockerfile by removing cachito dependencies [release-4.18] #818
OCPBUGS-70291: fix: update qs vulnerable dependency #739
OCPBUGS-65958: Fix metrics gaps 4.18 #656
OCPBUGS-64735: allow tenancy access to metrics tag #638
OU-1059: add perspective to action injector #632
NO-JIRA: update i18n strings #508
OCPBUGS-60199: feat: add alerting rules tab to dev console #493
OCPBUGS-54314: Fix “Export as CSV” #461
OU-724: remove deleted image #376
Full changelog

multus-admission-controller

OCPBUGS-58771: Update the github.com/golang/glog module to v1.2.4 #101
append .0 to go.mod version #96
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-85249: Fix server url in kubeconfig #298
NO-ISSUE: [release-4.18] Bump Go to 1.22 and fix CI build root image #291
OCPBUGS-77853: hermetic 4.18 #276
OCPBUGS-47470: adds getpodcontext (backport 4.18) #259
Full changelog

multus-networkpolicy

OCPBUGS-54939: [release-4.18]: Support default ports value #68
append .0 to go.mod version #70
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-59697: Prevent accidental IP deallocation in statefulsets #376
OCPBUGS-58360: The node slice controller should only process valid whereabouts confi… #381
OCPBUGS-58360: Add nodeslicecontroller bin to dockerfile #373
append .0 to go.mod version #370
OCPBUGS-55270: Fix whereabouts-reconciler no namespace error #362
Full changelog

must-gather

OCPBUGS-86019: Collect object size with the object count #547
OCPBUGS-46437: Separate resources with comma to fix malformed inspect #470
append .0 to go.mod version #491
Full changelog

network-interface-bond-cni

OCPBUGS-62793: Use netlinksafe instead of netlink to avoid netlink.ErrDumpInterrupted #99
OCPBUGS-58095: Bump github.com/containernetworking/plugins from to 1.7.1 #79
OCPBUGS-57794: Updating ose-network-interface-bond-cni-container image to be consistent with ART for 4.18 #74
NO-JIRA: Add ci-operator yaml file #78
Full changelog

network-metrics-daemon

OCPBUGS-58781: Bump github.com/golang/glog to v1.2.4 (#111) #111
OCPBUGS-60174: Replace e2e test image (#120) #120
Full changelog

network-tools

Fix build error #147
Full changelog

networking-console-plugin

OCPBUGS-98784: Updating linkify-it to 5.0.2 to fix CVE-2026-48801 #460
OCPBUGS-99991: Updating networking-console-plugin-container image to be consistent with ART for 4.18 #454
OCPBUGS-41880: Fix namespace retention between NetworkPolicies tabs when MultiNetworkPolicies are disabled #433
OCPBUGS-41880: Retain namespace selection between network policies tabs #424
OCPBUGS-87000: Update Dockerfile.art to 4.22 build image #426
OCPBUGS-83382: Fix CVE 2026 34043 serialize javascript 4.18 #413
[release-4:18] OCPBUGS-85067: Migration from yarn to npm #412
OCPBUGS-81606: Fix CVE-2026-CVE-2026-4800 in lodash #401
OCPBUGS-79449: Bump immutable #390
CNV-76277: Fix name generator with unprofessional names #319
OCPBUGS-63582: Fixed - Extra semicolon observed before Service IP in OCP Console #306
OCPBUGS-60178: Fix ingress details #264
OCPBUGS-60124: Fix requiremenets with no value #259
OCPBUGS-57286: Fix pod context #251
CNV-60065: fix cudn input name #240
OCPBUGS-49395: Add translations #238
Add translations scripts #234
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

nutanix-machine-controllers

OCPBUGS-51861: fixing CVE-2025-22868 #96
OCPBUGS-54616: Fix link-local addresses being added to machine #101
OCPBUGS-47268: fixing CVE-2024-45338 #91
Full changelog

oauth-apiserver

NO-JIRA: (chore): update OWNERS file #170
OCPBUGS-65841: UPSTREAM: <carry>: bump kubernetes-apiserver to pick up loopback certificate expiration update #155
OCPBUGS-63050: (bugfix): useroauthaccesstokens: cast delete validation object to correct type for admission #149
Full changelog

oauth-proxy

OCPBUGS-61444: Update x/crypto to v0.31.0 #333
OCPBUGS-57172: 4.18 kube 1.31 #317
OCPBUGS-58312: fix e2e tests #325
OCPBUGS-48332: Update dependencies to address CVE-2024-24786 #312
Full changelog

oauth-server

OCPBUGS-81803: Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 #238
OCPBUGS-57300: Updating oauth-server-container image to be consistent with ART for 4.18 #186
append .0 to go.mod version #179
Full changelog

oc-mirror

OCPBUGS-66051: Remove empty status field from generated IDMS/ITMS files (manual 4.18 backport) #1324
OCPBUGS-65510: removes unintended exec permissions #1312
OCPBUGS-62696: v2/cli: show binary version in output #1286
OCPBUGS-62711: generate the archive only after mirroring #1287
OCPBUGS-62432: changes the warning message of 4.21 #1278
And 27 elided commits (e.g. from squash or rebase merges)
Full changelog

olm-catalogd

OCPBUGS-62872: set the SElinux type #139
And 5 elided commits (e.g. from squash or rebase merges)
Full changelog

olm-operator-controller

OCPBUGS-100434: increase catalog HTTP client timeout from 10s to 5m #787
OCPBUGS-87830: [release-4.18] operator-controller: clean up orphaned temp dirs in catalog cache #751
OCPBUGS-80304: Update grpc-go to v1.71.3-sec.1 to fix CVE-2026-33186 #735
OCPBUGS-62872: set the SElinux type #509
And 15 elided commits (e.g. from squash or rebase merges)
Full changelog

openshift-apiserver

OCPBUGS-82769: Address CVE-2026-35469 #657
OCPBUGS-74234: Bump library-go for route path validation fix #603
OCPBUGS-69955: Add ValidatingAdmissionPolicy and check for omissions next time. #589
OCPBUGS-66379: pkg/image: conditionally parse raw image manifest #585
OCPBUGS-65842: UPSTREAM <carry>: bump kubernetes-apiserver to pick up loopback certificate expiration update #581
OCPBUGS-58461: Wire dry run option to Image API server operations #531
OCPBUGS-56609: Fix image reference in TestImageStreamImportQuayIO #514
OCPBUGS-52312: Skip blocked registry check for registries with mirrors #498
Full changelog

openshift-controller-manager

OCPBUGS-61002: legacy image pull secret rollback controller #411
OCPBUGS-57949: ignore error failing to find pull/push secrets #399
OCPBUGS-57344: Set node-pullsecrets volume to read-only to protect image pull credentials #392
OCPBUGS-55699: Empty proxy variables are causing issues during the build #377
OCPBUGS-54304: Intermittent authentication issues when accessing OpenShift registry #369
Full changelog

openshift-state-metrics

append .0 to go.mod version #123
Full changelog

openstack-cluster-api-controllers

OCPBUGS-64816: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.11 into release-4.18 #371
OCPBUGS-44458: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.11 into release-4.18 #365
Full changelog

openstack-machine-api-provider

OCPBUGS-93867: Revendor CAPO #174
OCPBUGS-69648: Don’t record event for every reconcile #143
OCPBUGS-76792: Fix make test #159
OCPBUGS-74986: Revendor CAPO #152
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-103497, OCPBUGS-103502, OCPBUGS-103503: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1366
OCPBUGS-80311, OCPBUGS-80312, OCPBUGS-80313: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.71.3-sec.1 [release-4.18] #1314
OCPBUGS-81473: Fix nil pointer dereference in sortUnpackJobs when sorting non-failed jobs #1273
OCPBUGS-77714: Remove the collect-profiles info from the microshift kustomization file #1245
OCPBUGS-76924: Remove the collect-profiles job #1231
OCPBUGS-65700: Fix TOCTOU race condition in ensureInstallPlan (#3682) #1156
OCPBUGS-61364: [4.18] e2e stability fixes #1080
OCPBUGS-60644: Add NetworkPolicy as a supported kind #1048
OCPBUGS-59421: 🐛 add catalog-operator control-plane-specific tolerations to unpack jobs #1040
OCPBUGS-58882: Reduce Frequency of Update Requests for Copied CSVs (#3597) #1034
OCPBUGS-57427: reduce cache expiry frequency [release-4.19] #1020
OCPBUGS-57314: operatorgroup: ensure clusterroleselectors in clusterrole aggregation rules are sorted #1017
OCPBUGS-56098: fix(olm): improve error logging for missing olm.managed label (#3558) #1001
OCPBUGS-51225, OCPBUGS-51227, OCPBUGS-51245: pin go-jose/v4@v4.0.5 (#3550) #992
OCPBUGS-53108: Ensure that PSA label is latest instead of pinning versions #983
OCPBUGS-53040: add missing pod disruption reasons to isPodDead #981
OCPBUGS-50830, OCPBUGS-50832, OCPBUGS-50836: Bump github.com/distribution/distribution/v3 #965
Full changelog

operator-marketplace

OCPBUGS-73883: Increase default catalog polling interval to 4h (240m) #707
OCPBUGS-68272, OCPBUGS-68273: CVE-2025-65637 fixed in logrus v1.9.3+ #703
OCPBUGS-62218: Remove Expect func so that the test case can use the retry logic #669
ART-13123: append .0 to go.mod version #637
OCPBUGS-53149: Ensure that PSA label is latest instead of pinning versions #601
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-112810, OCPBUGS-113507: Branch Sync release-4.19 to release-4.18 [08-21-2026] #3410
OCPBUGS-105851: Branch Sync release-4.19 to release-4.18 [08-11-2026] #3386
OCPBUGS-82773: Bump github.com/moby/spdystream to v0.5.1 #3321
OCPBUGS-98957: Branch Sync release-4.19 to release-4.18 [07-09-2026] #3290
OCPBUGS-86230: Branch Sync release-4.19 to release-4.18 [05-19-2026] #3197
OCPBUGS-74399, OCPBUGS-85434: Branch Sync release-4.19 to release-4.18 [05-12-2026] #3184
OCPBUGS-77151, OCPBUGS-83567: Branch Sync release-4.19 to release-4.18 [04-16-2026] #3143
OCPBUGS-82148: Branch Sync release-4.19 to release-4.18 [04-05-2026] #3117
OCPBUGS-81479: node: fix serviceUpdateNotNeeded nil pointer comparison #3101
OCPBUGS-78015: Add pperiyasamy to OWNERS for release-4.18 #3045
OCPBUGS-77516: Clear stale conntrack UDP entries for nodePorts #3016
OCPBUGS-77083, OCPBUGS-77106: [release-4.18] combined backport PR for 2 escalations #2987
OCPBUGS-48710: Branch Sync release-4.19 to release-4.18 [02-04-2026] #2970
OCPBUGS-74270: release-4.18 fix(localnet, ipamless): Prevent LSP deletion on sync #2943
OCPBUGS-70346: Branch Sync release-4.19 to release-4.18 [01-07-2026] #2922
OCPBUGS-66140: Branch Sync release-4.19 to release-4.18 [12-31-2025] #2916
CORENET-6055, OCPBUGS-48710, OCPBUGS-66360, OCPBUGS-66381, OCPBUGS-66428: Branch Sync release-4.19 to release-4.18 [12-03-2025] #2895
OCPBUGS-68347: Add ricky-rav to OWNERS for release-4.18 #2897
OCPBUGS-64855: Fix stale EIP assignments during failover and controller restart #2849
OCPBUGS-64780: kubevirt: fix bad release of IPs of live migratable pods #2847
OCPBUGS-63459: Branch Sync release-4.19 to release-4.18 [10-22-2025] #2825
OCPBUGS-63716: Skip Pending pods in EgressIP status updates #2836
OCPBUGS-48710: [release-4.18] DownStream Merge Sync from 4.19 [10-16-2025] #2811
OCPBUGS-62671: Fix EgressIP stale GARP post reboot + pod restart #2775
OCPBUGS-59744, OCPBUGS-61455: [4.18] allow default network -> localnet on the same node for any localnet subnet #2785
OCPBUGS-61748: [release-4.18] DownStream Merge Sync from 4.19 [10-02-2025] #2777
OCPBUGS-59680: [release-4.18] DownStream Merge Sync from 4.19 [09-29-2025] #2768
OCPBUGS-48710: Update OWNERS file: Add Patryk/Martin as approvers #2700
OCPBUGS-59371: EIP OVN controller: stop pod config flap #2703
OCPBUGS-59531: EgressIP: fix startup syncer #2690
OCPBUGS-59623: Revert “unpin libreswan version” #2678
OCPBUGS-57318, OCPBUGS-58159: DownStream Merge Sync from 4.19 [06-26-2025] #2646
OCPBUGS-46401, OCPBUGS-48710, OCPBUGS-55263: DownStream Merge Sync from 4.19 [05-28-2025] #2593
OCPBUGS-57108: Fix hybrid overlay node subnets collision with cluster subnets #2619
OCPBUGS-57106: Increase InformerSyncTimeout to 60s #2622
OCPBUGS-55016: DownStream Merge Sync from 4.19 [05-08-2025] #2555
OCPBUGS-54671: EIP no reroute: allow multiple entries for pod to pod and pod to join #2510
OCPBUGS-54187: Update OVN to FDP25.A.1 24.09.2-41. #2495
OCPBUGS-48710: DownStream Merge Sync from 4.19 [02-13-2025] #2470
Full changelog

powervs-block-csi-driver

OCPBUGS-80317: Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 #130
OCPBUGS-82774: Fix CVE-2026-35469 by bumping github.com/moby/spdystream to v0.5.1 #124
OCPBUGS-51896: Mitigate CVE-2025-22868 by updating golang.org/x/oauth2 #102
OCPBUGS-70002: Update builder image’s golang version to 1.23 #103
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-80318: Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 #111
Full changelog

powervs-cloud-controller-manager

OCPBUGS-80319: Replace google.golang.org/grpc with openshift-sustaining fork v1.71.3-sec.1 to v1.79.3 to fix CVE-2026-33186 #99
Full changelog

powervs-machine-controllers

OCPBUGS-61163: Use OS_GIT_VERSION in Makefile when found (for Konflux builds) #125
OCPBUGS-54243: Fix for CVE-2024-51744 in github.com/golang-jwt/jwt/v4 #111
Full changelog

prom-label-proxy

append .0 to go.mod version #380
Full changelog

prometheus

OCPBUGS-88628: remote: validate snappy decoded length before allocation in read endpoint #346
OCPBUGS-80320: Bump google.golang.org/grpc to v1.79.3 #308
OCPBUGS-61706: chore: compute highestTimestamp at queryManager level #267
OCPBUGS-56732: BACKPORT: fix promtool analyze block shows metric name with 0 cardinality #253
OCPBUGS-54940: Scraping: Bump cache iteration after error to avoid false duplicate detection. #247
Full changelog

prometheus-alertmanager

OCPBUGS-98183: build(deps): hashicorp/memberlist to a forked version #165
OCPBUGS-100355: Set testdata CA expiry to 20 years from issue date (#4112) #148
OCPBUGS-74976: Include go-verify-deps expected files in gitignore #114
append .0 to go.mod version #101
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-103510, OCPBUGS-103513: [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #397
OCPBUGS-77298: backport upstream fix to reconcile resources with inconsistent status #370
OCPBUGS-77398: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #366
OCPBUGS-61965: reconcile workload configurations when a referenced secret/configmap key is updated #347
OCPBUGS-58194: Fix: One Alertmanager Config failing blocks all others #335
OCPBUGS-52565: Bump openshift/prometheus-operator to v0.78.2 #327
Full changelog

prometheus-node-exporter

append .0 to go.mod version #166
Full changelog

route-controller-manager

OCPBUGS-80199: Bump google.golang.org/grpc to v1.79.3 #85
OCPBUGS-55338: Added error event for failed ingress to route conversion #59
Full changelog

service-ca-operator

OCPBUGS-44952: [release-4.18] Bump go to 1.22.0 #253
Full changelog

telemeter

OCPBUGS-80333: Bump google.golang.org/grpc to v1.79.3 #599
OCPBUGS-81804: [release-4.18] Fix CVE-2026-34986 #596
append .0 to go.mod version #561
Full changelog

tests

OCPBUGS-77876: Backport: Remove duplicated graceful termination test from release-4.18 #30702
OCPBUGS-74207: Unrevert TLS tests with fixes #30708
OCPBUGS-69900: Updated the upgrade duration limit to 100 minutes for ppc64le #30628
OCPBUGS-63668: Add imagestream update dryrun test #30436
OCPBUGS-63712: Migrate OCP-32383 to upstream #30443
OCPBUGS-61698: chore(test/extended/prometheus): bump the series limit of total series sent via telemetry from each cluster #30253
OCPBUGS-60511: Bump to latest openshift/kubernetes (v1.31.12) #30230
OCPBUGS-60662: images/tests: Remove rteval #30135
OCPBUGS-60881: Exclude RHEL nodes in verifying that nodes have no unexpected reboots test #30170
OCPBUGS-60881: extended/machines: add –no-pager to journalctl cmds #30180
OCPBUGS-60927: Wait 30s after the upgrade is complete to validate workloads #30179
NO-JIRA: Update extended/networking OWNERS #30089
OCPBUGS-58461: Backport pr 29834 to release-4.18 #29968
OCPBUGS-60066, OCPBUGS-60067: Don’t check for isNoUpgrade #30053
OCPBUGS-60066, OCPBUGS-60067: Tolerate various expected Upgradeable=False conditions #30048
OCPBUGS-57887: Update to Kubernetes v1.31.10 #29941
OCPBUGS-58366: Make EgressIP helper functions more reliable #29950
OCPBUGS-57081: Do not set the MTU when using NetworkAttachementDefinition #29891
OCPBUGS-58044: Boot image controller should correctly handle marketplace boot images #29937
OCPBUGS-57329: Fix failed tests of e2e-aws-ovn-tls-13 #29911
OCPBUGS-56995: Fix bearer token exposure in exit condition as well #29882
OCPBUGS-56438: Update to Kubernetes v1.31.9 #29871
OCPBUGS-56867: Only update boot disks during GCP boot image updates tests #29894
OCPBUGS-55277: backport watch count tracking fixes to 4.18 #29725
OCPBUGS-55667: aws/edge: prevent test using unschedulable nodes #29750
OCPBUGS-55267: Update to Kubernetes v1.31.8 #29765
OCPBUGS-50628: [test: networking] Skip isolation test when cgroupv1 nodes are present #29541
OCPBUGS-55470: [build] Ensure Git Clone Does Not Run Privileged #29736
Revert “OCPBUGS-55277: backport 4.18” #29720
OCPBUGS-55277: backport 4.18 #29645
OCPBUGS-55110: Backport MetricsCollectionProfiles patches to 4.18 #29561
OCPBUGS-54807: support provider type external #29666
OCPBUGS-54725: Fix egress firewall tests by updating the URL from docs.openshift.com to redhat.com #29657
OCPBUGS-53015: bump(k8s): update k8s.io/* dependencies to v1.31.7 #29634
OCPBUGS-52496: use non-fake boot image for patch #29584
OCPBUGS-52579: Use payload pullspec for image info test #29587
OCPBUGS-51295: Rely on unstructured for update status instead of type conversion #29564
OCPBUGS-50929: Update to Kubernetes v1.31.6 #29548
OCPBUGS-48389: move initialization of OC to test instead of package level #29472
OCPBUGS-50921: managed services: add hcp crd to unstable list #29545
OCPBUGS-50930: managed services: add known image check for gcp #29547
Full changelog

thanos

OCPBUGS-80335: Bump google.golang.org/grpc to v1.79.3 #184
OCPBUGS-52945: Update Go version in go.mod to 1.22.0 #159
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-77668: hermetic migration 4.18 #105
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-80340: Bump google.golang.org/grpc to v1.79.3 #104
OCPBUGS-78018: hermetic migration 4.18 #84
OCPBUGS-61651: Fix unit tests #70
OCPBUGS-58861: [release-4.18] Update manifests to remove reliance on admissionregistration v1beta1 #62
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-92888: Bump golang.org/x/crypto/ssh to v0.33.0-sec.3 #193
OCPBUGS-80343: Bump google.golang.org/grpc to v1.79.3 #176
OCPBUGS-68278: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.9.3 #156
Full changelog

vsphere-csi-driver-operator

OCPBUGS-81673: Fix password escaping #342
OCPBUGS-54701: add manifest-topology.yaml for topology related feature and test #303
Full changelog

vsphere-problem-detector

OCPBUGS-103545: Bump golang.org/x/net to v0.35.0-sec.4 #233
OCPBUGS-81556: fix concurrent map writes #215
OCPBUGS-70359: Fixed logic for vSphere compute cluster permission #200
OCPBUGS-60784: Check for number of FailureDomain-s in GetVCenter() #189
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github