4.18.59

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.18.59-x86_64

Qualifiers (status api): None

Tests:

Blocking jobs
- upgrade Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.18-e2e-aws-ovn-serial
- aws-ovn-single-node-upgrade-4.18-micro Pending (1 retry) periodic-ci-openshift-release-main-ci-4.18-e2e-aws-upgrade-ovn-single-node
  - Attempt 1 Failed
  - Attempt 2 Pending
- aws-ovn-upgrade-4.18-micro Succeeded periodic-ci-openshift-release-main-ci-4.18-e2e-aws-ovn-upgrade
- azure-ovn-upgrade-4.18-micro Succeeded periodic-ci-openshift-release-main-ci-4.18-e2e-azure-ovn-upgrade
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.18-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.18-fips-payload-scan
- gcp-ovn-rt-upgrade-4.18-minor Succeeded (1 retry) periodic-ci-openshift-release-main-ci-4.18-upgrade-from-stable-4.17-e2e-gcp-ovn-rt-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- hypershift-ovn-conformance-4.18 Succeeded periodic-ci-openshift-hypershift-release-4.18-periodics-e2e-aws-ovn-conformance
- metal-ipi-ovn-ipv4 Succeeded periodic-ci-openshift-release-main-nightly-4.18-e2e-metal-ipi-ovn-ipv4
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.18-e2e-metal-ipi-ovn-ipv6
- microshift-ovn-conformance-parallel Succeeded periodic-ci-openshift-microshift-release-4.18-periodics-e2e-aws-ovn-ocp-conformance
- microshift-ovn-conformance-serial Succeeded periodic-ci-openshift-microshift-release-4.18-periodics-e2e-aws-ovn-ocp-conformance-serial

Upgrades from:

Untested upgrades: 4.17.14, 4.17.15, 4.17.16, 4.17.18, 4.17.19, 4.17.20, 4.17.22, 4.17.23, 4.17.24, 4.17.25, 4.17.26, 4.17.27, 4.17.28, 4.17.29, 4.17.30, 4.17.31, 4.17.32, 4.17.33, 4.17.34, 4.17.35, 4.17.36, 4.17.37, 4.17.38, 4.17.39, 4.17.40, 4.17.41, 4.17.42, 4.17.43, 4.17.44, 4.17.45, 4.17.46, 4.17.48, 4.17.49, 4.17.50, 4.17.51, 4.17.52, 4.17.53, 4.17.54, 4.17.55, 4.17.56, 4.18.10, 4.18.11, 4.18.12, 4.18.13, 4.18.14, 4.18.15, 4.18.16, 4.18.17, 4.18.18, 4.18.20, 4.18.21, 4.18.22, 4.18.23, 4.18.24, 4.18.25, 4.18.26, 4.18.27, 4.18.29, 4.18.30, 4.18.31, 4.18.32, 4.18.33, 4.18.34, 4.18.35, 4.18.36, 4.18.37, 4.18.38, 4.18.39, 4.18.4, 4.18.40, 4.18.41, 4.18.42, 4.18.43, 4.18.44, 4.18.45, 4.18.46, 4.18.47, 4.18.48, 4.18.49, 4.18.5, 4.18.50, 4.18.51, 4.18.52, 4.18.53, 4.18.54, 4.18.55, 4.18.7, 4.18.8, 4.18.9

Upgrades to:

4.19.0-0.ci-2026-10-26-102249 (changes) - Pending

Loading changelog, this may take a while ...

Changes from 4.18.28

Created: 2026-10-26 05:49:12 +0000 UTC

Image Digest: sha256:dabe7545163af58a2538c645725556acea531fdcfb83fd5aea9b7f28cd112c06

Components

Kubectl 1.31.1
Kubernetes upgraded from 1.31.13 to 1.31.14
Kubernetes Tests 1.31.12
Red Hat Enterprise Linux CoreOS upgraded from 418.94.202511041748-0 to 418.94.202610242013-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
StreamingCollectionEncodingToJSON (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
StreamingCollectionEncodingToProtobuf (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled

Removed images

ovirt-csi-driver
ovirt-csi-driver-operator

Rebuilt images without code change

apiserver-network-proxy git 2f62712d sha256:424f5652d9abad080c387a50963b03b41ca9d7220aada48046265e4fabaecd87
aws-cloud-controller-manager git c3951906 sha256:3e53ca99692292be55da9ae64cb5031038577a0782bc90cc8d42b283984bf02c
aws-pod-identity-webhook git f54f9a19 sha256:2757e2730c516f63b8bf07d6fffe803c34e7cf52ea9023bd2bf3aa087310c65b
baremetal-cluster-api-controllers git 80c3a063 sha256:dc1f3739ae8368796b3a0d6a10ec69161df5c15b71abed061620a717e174f0b6
baremetal-machine-controllers git 1ede6c3f sha256:5d347788bf83dd867b1bd6482719971c5b285a1f1a1a074de4136e84dca9e32e
baremetal-runtimecfg git 35341068 sha256:17c95f476ee8cb23690a22e2606f3d8cd8ea829909f1d5ded515fb4d2603b5ed
cluster-bootstrap git d1e01954 sha256:64ba4d8157d4326292b231f9c25f640b8602e731d908a8aa2112d6ad2693c420
cluster-control-plane-machine-set-operator git d17bf3a1 sha256:88165c68abddcd1834e8810634980b17f4d940672cb251f32cbfbf614a88da48
cluster-dns-operator git 7cafd0c7 sha256:00ac340266bc8b31ebcabbf2c3dea1ff24e8fb037dc5970791d6f5fac2088f4e
cluster-image-registry-operator git 1e3caa4b sha256:92b26b124fc8b478c647160c10f8d74b40602eede14768733f85ca975ae5007d
cluster-kube-storage-version-migrator-operator git 59ba356f sha256:57df22ca6faa7c2e9c9fa3708f8adbfefeb4e20d7736da99886e0c7d857b6848
cluster-machine-approver git 01d5fbbe sha256:88b44dbd753a65aa31d2c0ba419da4c19e5d9edc968dff5360ab5237a55e1855
cluster-openshift-apiserver-operator git 0a6f6eb9 sha256:e673e2f65cc6bd6235984a107e4aafc945129453f0d79214c6c2122394054ded
cluster-openshift-controller-manager-operator git f1711cf3 sha256:722ed48bbb2b3617b353f7a80aba02dceb92eea49877449440deb50cfb8a8fbc
cluster-samples-operator git bc725fd4 sha256:805f8f7ad7571c3580040f45fd8087baf10b0fea7ed48361f376c31f0590d86f
cluster-update-keys git 8caab452 sha256:62ad0d5c439dcc98a216c5a1b97092f3065257174ed81961148a11a6ea76c3ca
configmap-reloader git e2aaf00a sha256:4f469f9a8ecbe48a775f7831ba9f873b68be683c0572f8fced66ada54911134f
coredns git 8ca7f02b sha256:aabde61be89389c1936a14e2f7f011e774645b11f48ee9043220bb1f07bb0c99
csi-node-driver-registrar git ef93f0be sha256:5c7db397dde87f9b0e127516c1104556bc5031338ba7071e82e42eeb0f3d6f5a
driver-toolkit git 2e139edc sha256:593aed143f324d339133224f1f209283bd00ab8c1aea6a184f5e5343af73ede4
etcd git b5a4f8d0 sha256:c5af34391c0a3f6202f5875d38639612adc98a5e54eff98e2d19640312eff780
gcp-cloud-controller-manager git 6ea23561 sha256:71109373e83ee98fe6667a61031a38482147e7bbfccbe298336554bd0ba7a684
gcp-workload-identity-federation-webhook git f0a670c7 sha256:9a040e0a59b38153929e5a27f2ed7d644480c4ab69f9366dab142373efd8804d
ironic-machine-os-downloader git 50ca44fd sha256:00860a27eb793493ab221ab9823f665a7a51c82bb2263c8772ce98ffab0c7fca
ironic-static-ip-manager git cfbae04f sha256:55109f2b4b299afeb2379ef4d2fb202d32885b78437aa4214dbe691e63b15a15
keepalived-ipfailover git 716eb0ef sha256:400c6da5cca8bb489501fe52174fe70f5697efe30e987a6f10199de50a038583
multus-admission-controller git 0d7ea6c7 sha256:30306688db0cab05fdadf4a093265e1d41e6b3c75933f5933e28abb923d82026
multus-networkpolicy git 3362bbc4 sha256:eff162f9c30e949698de3dc3620c92e21385545ab046e86afadbb4faa5de35e6
multus-route-override-cni git 391c1b03 sha256:e7889d69c6d8ebf00446216223a32768cfe0a73256a19683735ee63e6278ede0
multus-whereabouts-ipam-cni git 86191ded sha256:3b031c8206b11574b14629bb18064b37d743b432c842e598b6ee01ac3f48ec86
network-interface-bond-cni git e2de9255 sha256:4ffcc7ee4870716adf88816bcea85492048365099820b24c334b1ac83021f85f
network-tools git 47b13549 sha256:4e1b2459893e5a28e682fc3c13c215722c5e7700c746350419868cf44bf0d0ac
nutanix-cloud-controller-manager git d9fe8f38 sha256:e814c09d304dd714588b63024cd993121096aa951586ab15654c0c8a1ecf90d7
nutanix-machine-controllers git afe324bf sha256:c765a1412cb75ee98d1bfee8e1fabd339f9ff69ba1d3d16eaa8c7073780cd137
olm-catalogd git 180aa92c sha256:646071f761c5002baf90963d0a258e92e936210d3d46c5c1a79d822b431102f9
openshift-controller-manager git 8ee74406 sha256:ffd0e9cadb9d7e9a4eeb15054e88f0ce8b49420c92adaf34955732cddb18f691
powervs-machine-controllers git 74e3ece7 sha256:debe2934d213c14712c2f9a64190750141f55f340ffd35aa1ec33990a5438275
rhel-coreos sha256:b55adb0436a75ecce57436342d0692553b3274079c031d4122483d0130226a6b
rhel-coreos-extensions sha256:cdebfd8a38969096004c5b63deacb723aa8260fa09eb66c7c6919bea25d8a23f
service-ca-operator git 30efb529 sha256:82b42548e3733da729555db2773059e9d3a663ea4a95db3b41c0325ddbd21a4a

agent-installer-api-server

OCPBUGS-89884: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.2 #10800
MGMT-23439: Pin gotestsum to v1.12.2 for Go 1.21 compatibility #10019
OCPBUGS-74898: Retry incomplete cluster registration in ABI #8817
OCPBUGS-74911: Remove root=/dev/disk/by-label/dm-mpath-root from kargs #8820
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-103348: Bump x/net to v0.35.0-sec.4 #2297
Full changelog

agent-installer-node-agent

OCPBUGS-103362: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #1618
MGMT-21849: Skip arping for remote IPs not in outgoing NIC’s subnet #1332
Full changelog

agent-installer-utils

OCPBUGS-68243: bump github.com/sirupsen/logrus to v1.9.3 #237
Full changelog

aws-cluster-api-controllers

OCPBUGS-103372: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #652
🐛 OCPBUGS-123705: UPSTREAM: <carry>: Fix unit tests for OpenShift CI environment #642
🌱 OCPBUGS-123680: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #641
OCPBUGS-77903: [release-4.18] update go mod dependency for konflux #589
Full changelog

aws-ebs-csi-driver

OCPBUGS-82745: Address CVE-2026-35469 #327
OCPBUGS-86167: UPSTREAM: 2367: cleanup: make verify should ignore copyright year #321
OCPBUGS-80206: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.71.3-sec.1 #313
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-103360, OCPBUGS-103371: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #610
OCPBUGS-80308: Bump google.golang.org/grpc #542
OCPBUGS-79429: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.18 #531
OCPBUGS-78299: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.17 #524
OCPBUGS-76582: Fix Cinder, Manila driver metrics #501
OCPBUGS-62664: disable e2e snapshot tests #463
OCPBUGS-63558: Add RBAC ClusterRole and Binding for driver node #454
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

aws-kms-encryption-provider

OCPBUGS-80184: Bump google.golang.org/grpc to v1.79.3 #43
Full changelog

aws-machine-controllers

OCPBUGS-73789: Fix reconciler consistency checks in Update and Exists #166
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-103373, OCPBUGS-103550: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #208
OCPBUGS-80210, OCPBUGS-80211, OCPBUGS-80350: Bump google.golang.org/grpc to v1.79.3 #190
Full changelog

azure-cluster-api-controllers

OCPBUGS-89899: Address CVE-2026-39829 #401
OCPBUGS-80212: Bump google.golang.org/grpc to v1.79.3 #390
OCPBUGS-77905: [release-4.18] update go mod dependency for konflux #362
Full changelog

azure-disk-csi-driver

UPSTREAM: 3635: OCPBUGS-103367: Bump golang.org/x/net to v0.43.0-sec.4 #172
OCPBUGS-114621: UPSTREAM: 3277: fix: allow . in Azure tags #179
OCPBUGS-80213: Address CVE-2026-33186 #142
OCPBUGS-78037: add instantAccessDurationMinutes parameter to enable IA snapshots for PremiumV2/UltraSSD disks #130
Full changelog

azure-file-csi-driver

OCPBUGS-103366: Bump golang.org/x/net to v0.35.0-sec.4 #158
OCPBUGS-92789: Bump golang.org/x/crypto to v0.33.0-sec.3 #148
OCPBUGS-80216: Address CVE-2026-33186 #133
Full changelog

azure-kms-encryption-provider

OCPBUGS-80185: Bump google.golang.org/grpc to 1.64.1-sec.1 patch #46
Full changelog

azure-machine-controllers

OCPBUGS-103471: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #213
OCPBUGS-65882: Set updateDomainCount to one when faultDomainCount is one #175
Full changelog

azure-workload-identity-webhook

OCPBUGS-103390: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #63
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

NO-JIRA: data/manifests/bootkube/cvo-overrides: Default to eus-4.18 #11004
OCPBUGS-103391, OCPBUGS-103464: Bump golang.org/x/net to v0.35.0-sec.4 #10970
OCPBUGS-89882, OCPBUGS-89888, OCPBUGS-89919, OCPBUGS-92878: Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.33.0-sec.4 #10901
OCPBUGS-121872: Update gcloud version to one that can be found #10857
OCPBUGS-77052: Update RHCOS-release-4.18 bootimage metadata to 418.94.202608142238-0 #10795
OCPBUGS-95616: azure: Add field in installconfig to disallow shared access key #10670
OCPBUGS-78550: fix wavelength zone name regex #10409
OCPBUGS-45579: PowerVS: Listen to machineNetwork #9277
OCPBUGS-73784: pkg/asset/manifests/azure: save cidr blocks #10217
OCPBUGS-76598: Increase agent-installer pre-network-manager timeout #10299
OCPBUGS-67203: Update the RHCOS 4.18 bootimage metadata #10294
OCPBUGS-74676: [release-4.18] GCP: skip AI zones #10275
OCPBUGS-69880: Azure UPI ARM template: use storageAccountId #10179
OCPBUGS-68244: [4.18] uplift logrus #10166
OCPBUGS-57590: Mount the user-ca-bundle into ICC #9794
OCPBUGS-63494: Catch gcp destroy cases where the operation is nil #10030
OCPBUGS-52659: [release-4.18] CORS-3825: pkg/infrastructure/azure: support nvme #9545
OCPBUGS-65588: Update the RHCOS 4.18 bootimage metadata #10113
OCPBUGS-58504: Refactor removing loadbalancer in OpenStack #9831
Full changelog

baremetal-operator

OCPBUGS-98321: Add BMH finalizer on PreprovisioningImage #509
OCPBUGS-59259: Fix HFC error handling in actionPreparing #502
OCPBUGS-87967: Fix preprovisioning network Secret lifecycle during BMH deletion #495
OCPBUGS-76988: Unblock BMH direct deletion when detached annotation is present #461
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-103346, OCPBUGS-103383: Use patched x/net fork v0.35.0-sec.4 #2418
OCPBUGS-91365, OCPBUGS-94688: Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.2 #2344
OCPBUGS-109669: Fix pre-existing unit test failures on release-4.18 #2372
OCPBUGS-83872: pkg/cli/admin/upgrade: Tighten force warnings #2165
OCPBUGS-65707: fix(must-gather): do not set node affinity if nodename is set #2145
OCPBUGS-64608: Help with must-gather scheduling through suggesting preferance of nodes #2127
Full changelog

cloud-credential-operator

OCPBUGS-81887: Bump go-jose/go-jose/v4@v4.1.4 #1031
OCPBUGS-80219: Fix CVE-2026-33186 using openshift-sustaining grpc-go fork #1041
OCPBUGS-74548: Resolve nil pointer exception in hasResourceTags #968
OCPBUGS-65800: ccoctl azure: retry custom role creation on consistency errors #950
OCPBUGS-65479: ccoctl: use pagination when listing resources in aws #947
OCPBUGS-63548: ccoctl: add public-key-file flag to create-all #938
Full changelog

cloud-network-config-controller

OCPBUGS-73750: [release-4.18] Fix pointers without ptr.Deref #199
OCPBUGS-65651: [release-4.18] Fix capacity calculation #193
OCPBUGS-64779: [release-4.18] Change the capacity struct from int to ptrOfInt #189
Full changelog

cluster-authentication-operator

OCPBUGS-103378: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #988
OCPBUGS-75897: set appropriate rolling update settings #835
Full changelog

cluster-autoscaler

OCPBUGS-78699: allow clusterapi provider to skip paused resources #413
OCPBUGS-75925: Fixes histograms becoming empty after loaded from checkpoints #402
Full changelog

cluster-autoscaler-operator

OCPBUGS-103386: Bump x/net package in release-4.18 #388
Full changelog

cluster-baremetal-operator

OCPBUGS-81549: Explicitly set the ReadOnlyRootFilesystem flag to false #584
OCPBUGS-78708: Update kubebuilder tools to more latest version #579
OCPBUGS-57590: Mount the user-ca-bundle into ICC #486
Full changelog

cluster-capi-controllers

OCPBUGS-80220: Bump google.golang.org/grpc to v1.79.3 #297
Full changelog

cluster-capi-operator

OCPBUGS-80224: Bump google.golang.org/grpc to v1.79.3 #566
NO-JIRA: Allow sustaining engineering to self serve dependency updates #558
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-103380: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #513
Full changelog

cluster-config-api

OCPBUGS-98486: add new serviceAccountToken fs type #2927
OCPBUGS-70315: Add HTTPKeepAliveTimeout to IngressController API #2638
NO-JIRA: [release-4.18] OWNERS: update approvers/reviewers #2625
OCPBUGS-67214: Introduce ClosedClientConnectionPolicy to IngressController API #2618
CNTRLPLANE-1980: Promote streaming list encoding to Default #2598
NO-JIRA: Promote streaming list encoding to Default on Hypershift. #2562
Full changelog

cluster-config-operator

OCPBUGS-68249: Update logrus to 1.9.3 to address CVE-2025-65637 #464
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-103405: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #293
Full changelog

cluster-etcd-operator

OCPBUGS-103410: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #1695
OCPBUGS-78776: [release-4.18] : Prefer to remove members where they have another healthy machine in the same failure domain index #1573
OCPBUGS-76284: Add priority field to prevent early shutdown #1545
OCPBUGS-63451: Ensure revision.json persists on ungraceful shutdown #1503
OCPBUGS-58412: bump library-go to bring in revision controller revision-ready annotation fix #1518
Full changelog

cluster-ingress-operator

OCPBUGS-103414: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1571
OCPBUGS-70315: Implement HTTPKeepAliveTimeout tuning option #1333
NO-JIRA: Add new NID team members to OWNERS #1319
OCPBUGS-67214: Implement ClosedClientConnectionPolicy field #1322
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-103402: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #2299
OCPBUGS-76284: Add priority field to prevent early shutdown #2031
OCPBUGS-58412: bump library-go to bring in revision controller revision-ready annotation fix #1976
Full changelog

cluster-kube-cluster-api-operator

OCPBUGS-80231: Bump google.golang.org/grpc to v1.79.3 #77
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-103404: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #961
OCPBUGS-76284: Add priority field to prevent early shutdown #906
OCPBUGS-58412: bump library-go to bring in revision controller revision-ready annotation fix #897
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #622
OCPBUGS-76284: Add priority field to prevent early shutdown #612
OCPBUGS-58412: bump library-go to bring in revision controller revision-ready annotation fix #590
Full changelog

cluster-monitoring-operator

OCPBUGS-129140: don’t delete admin-owned Alertmanager secrets on destroy #3142
NO-ISSUE: synchronize OWNERS from main branch [release-4.18] #3116
OCPBUGS-103412: [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #3075
OCPBUGS-105311: [release-4.18] wrap library-go resourceCache with mutex for thread safety #3041
OCPBUGS-104540: Backport e2e stabilization 4.18 #3030
OCPBUGS-100375: [release-4.18] fix: watch cluster wide proxy changes and apply changes accordingly #3024
OCPBUGS-94081: ship collector:node_scrape_collector_success:avg to Telemetry #2992
OCPBUGS-86995: increase lookup interval #2944
OCPBUGS-77274: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2833
OCPBUGS-67168: Add the collection of MTV migration metrics #2774
OCPBUGS-61965: add flag --watch-referenced-objects-in-all-namespaces to prometheus-operator #2723
OCPBUGS-64579: Fix KSM deny-list typo #2731
OCPBUGS-63488: Remove AlertManager endpoints when disabled #2737
Full changelog

cluster-network-operator

OCPBUGS-100191: Bump github.com/containernetworking/cni v0.8.0 -> v1.3.0 #3096
OCPBUGS-85443: Remove duplicated openssl parameter #3006
OCPBUGS-84869: wait for patch port to apply drop garp flows #2988
OCPBUGS-84180: fix(hypershift): use net.JoinHostPort for URL construction #2977
OCPBUGS-77151: Add config override for openflow-probe #2965
OCPBUGS-78833: Fix whereabouts-token-watcher DaemonSet improvements #2940
OCPBUGS-74154: whereabouts-config is a reserved name for user interaction. #2884
OCPBUGS-73767: Tweak iptables-alerter to try to avoid crictl bug #2877
OCPBUGS-65704, OCPBUGS-65705: Annotate whereabouts-controller #2842
Full changelog

cluster-node-tuning-operator

OCPBUGS-90575: Requeue PerformanceStatus update when status write fails #1552
OCPBUGS-82752: Bump github.com/moby/spdystream from v0.4.0 to v0.5.1 #1544
OCPBUGS-75954: PPC: filter out namespaces dir #1465
OCPBUGS-69947: [release-4.18] E2E: skip stalld test checking sched_fifo #1451
Full changelog

cluster-olm-operator

OCPBUGS-80239: Bump google.golang.org/grpc to v1.79.3 #200
Full changelog

cluster-policy-controller

OCPBUGS-98486: Backport fs type service account token 4.18 #196
Full changelog

cluster-storage-operator

OCPBUGS-103401: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #735
OCPBUGS-87556: remove oVirt code from CSO 4.18 #707
OCPBUGS-77627: add vsphere permissions for checking if users is authorized to see metrics #670
Full changelog

cluster-version-operator

OCPBUGS-103432: Bump golang.org/x/net to v0.35.0-sec.3 #1459
OCPBUGS-70182: Unify capitalization when comparing architectures for available updates #1327
NO-ISSUE: hongkai becomes an approver release-4.18 #1286
Full changelog

console

OCPBUGS-127183: Re-enable Knative Cypress e2e tests #16907
OCPBUGS-113759: block GraphQL introspection over websocket #17130
Fix for OCPBUGS-92075: CVE-2026-44990 #16717
OCPBUGS-100515, OCPBUGS-101791: Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss #17058
OCPBUGS-98420: [release-4.18] CVE-2026-59869 bump js-yaml #17076
OCPBUGS-81520: Console can only show user name instead of full name as the display name #16238
OCPBUGS-86740, OCPBUGS-87085, OCPBUGS-97763: [release-4.18] bump package: protobufjs, fast-uri #16728
OCPBUGS-100069: quickstart page i18n misses (Fix Quick Starts i18n bundle lookup for zh-CN) #16872
OCPBUGS-91944: Prevent binary secret data corruption when editing #16673
OCPBUGS-99487: Disable Knative e2e Cypress tests in CI #16803
OCPBUGS-99648: Disable shipwright e2e tests to unblock CI #16818
OCPBUGS-86453: [release-4.18] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16511
Fix for OCPBUGS-81604: CVE-2026-4800 #16563
OCPBUGS-84284: Bump follow-redirects to 1.16.0 to fix CVE-2026-40895 #16675
OCPBUGS-77125: [release-4.18] CVE-2026-26996 Bump minimatch library #16344
OCPBUGS-79447: Bump immutable #16325
NO-JIRA: enable multi-architecture yarn builds #16421
CONSOLE-5011: migrate to yarn berry #16073
NO-JIRA: Bump builder image to v29 #15995
OCPBUGS-65808: Fix PatternFly dark theme colors for charts and form inputs #15951
OCPBUGS-74458: Bump lodash to latest #15965
OCPBUGS-73753: Fix Helm chart installation with CA/TLS certificates #15914
OCPBUGS-73662: Namespace is not persisting when switching to developer view from the topology page of admin page #15910
OCPBUGS-69915: PVC shows negative Available space in OpenShift Console on RHOCP 4 #15868
OCPBUGS-69448: Fixes namespace-scoped operators that were not showing as installed when viewing OperatorHub in “All Projects” mode #15855
OCPBUGS-68361: Disallowed Pipelines-plugin Pipelines navigation section #15842
OCPBUGS-65592: HPA Form View in RHOCP Web Console Incorrectly Requires Both CPU and … #15725
OCPBUGS-65932: Preserve query string in perspective switch + remove dev console folks from reviewers #15761
OCPBUGS-65533: Preserve path on perspective switch #15716
OCPBUGS-64735: Expose prometheus tenancy label path as a proxy #15685
OCPBUGS-64682: limit node log length to 1000 lines #15680
Full changelog

console-operator

OCPBUGS-103424: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #1223
OCPBUGS-98985: [4.18] Stabilize telemetry config to prevent continuous console pod rollouts #1190
OCPBUGS-77861: update go mod dependency for konflux #1113
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-85672: CI Build root image tag sync with ART #236
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-80309: Bump google.golang.org/grpc #387
Full changelog

csi-driver-nfs

OCPBUGS-82754: Bump github.com/moby/spdystream@v0.5.1 #194
OCPBUGS-80254: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.71.3-sec.1 to avoid go version bump and fix CVE-2026-33186 #180
Full changelog

csi-external-attacher

UPSTREAM: 110: OCPBUGS-103429: Bump golang.org/x/net to v0.35.0-sec.4 #115
OCPBUGS-80255: Bump google.golang.org/grpc to v1.79.3 #105
Full changelog

csi-external-provisioner

OCPBUGS-92883: Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.33.0-sec.5 to address CVE-2026-46597 #163
OCPBUGS-82755: Address CVE-2026-35469 #135
OCPBUGS-80256: Bump google.golang.org/grpc #130
Full changelog

csi-external-resizer

OCPBUGS-103430: Bump golang.org/x/net to v0.35.0-sec.4 #213
OCPBUGS-80257: Bump google.golang.org/grpc to v1.79.3 #203
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-127502: [release-4.18] OCPBUGS-127500: UPSTREAM: 1392: Fix VolumeSnapshotContent deletion #257
OCPBUGS-103427, OCPBUGS-103428: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #228
OCPBUGS-80258, OCPBUGS-80261, OCPBUGS-80262: Bump google.golang.org/grpc to v1.79.3 #211
Full changelog

csi-livenessprobe

OCPBUGS-103425: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #103
Full changelog

docker-builder

OCPBUGS-89907, OCPBUGS-90327, OCPBUGS-92414, OCPBUGS-92621, OCPBUGS-92892: Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 #549
OCPBUGS-66990: bump buildah to 1.37.7 to fix CVE-2025-52881 #498
OCPBUGS-65655: BuildConfig inline Dockerfile fails with heredoc syntax #486
Full changelog

docker-registry

OCPBUGS-103437: [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #480
OCPBUGS-68253: update logrus to v1.9.1 #464
Full changelog

egress-router-cni

OCPBUGS-100191: Bump containernetworking/cni to v1.3.0 github.com/containernetworking/plugins to 1.4.0 #109
Full changelog

gcp-cluster-api-controllers

OCPBUGS-80270: Bump google.golang.org/grpc to v1.79.3 #290
OCPBUGS-78278: [release-4.18] update go mod dependency for konflux #265
Full changelog

gcp-machine-controllers

OCPBUGS-103482: Bump golang.org/x/net to v0.35.0-sec.3 #189
OCPBUGS-80293: Bump google.golang.org/grpc to v1.79.3 #165
Full changelog

gcp-pd-csi-driver

OCPBUGS-103438: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #145
OCPBUGS-80274: Bump google.golang.org/grpc to v1.71.3-sec.1 in release-4.18 #112
OCPBUGS-68258: UPSTREAM: 2056: bump github.com/sirupsen/logrus to v1.9.3 #89
OCPBUGS-44772: Fix Hyperdisk Resize That Requires Iops/Throughput Adjustment #83
Full changelog

gcp-pd-csi-driver-operator

OCPBUGS-80273: Replace google.golang.org/grpc with fork #187
Full changelog

haproxy-router

OCPBUGS-86726: Prevent SSRF via FQDN-typed EndpointSlices #821
OCPBUGS-86715: Strip X-SSL-* headers for plain HTTP #800
OCPBUGS-80275: Bump google.golang.org/grpc to v1.79.3 #768
OCPBUGS-67214: Add option abortonclose to HAProxy configuration template #703
Full changelog

hyperkube, kube-proxy, pod

OCPBUGS-54724: Fix implementation of ContainsCIDR to allow non-equal addresses #2267
OCPBUGS-65553: Update to Kubernetes v1.31.14 #2521
OCPBUGS-65494: Fix Concurrentmap Iteration #2512
Full changelog

hypershift

OCPBUGS-131922: Router publish strategy related changes for IBM Cloud platform #10007
fix(deps): OCPBUGS-76288: Update runc, selinux, and their transitive deps to fix CVE-2025-52881 #8289
ACM-37663: Rebase hypershift operator runtime image to RHEL 9.8 ELS #9451
ACM-38044: update Containerfile.cli base images to floating tags [release-4.18] #9044
OCPBUGS-99142: fix(backport): konnectivity agent auth #9096
OCPBUGS-62756: Restart HCP on stale serving certs #8245
OCPBUGS-89356: build(operator): drop hypershift-no-cgo from operator container images #8760
NO-JIRA: remove path filter from control-plane-operator pipelines #8665
OCPBUGS-80278: fix CVE-2026-33186 by replacing grpc-go #8515
OCPBUGS-84180: fix(cno): use brackets only for IPv6 in server URL #8346
OCPBUGS-76532: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7699
OCPBUGS-77368: Fix ignition-server pod restarts #7878
CNTRLPLANE-1708: Backport Customer Global Pull Secret to OpenShift 4.18.z #7354
OCPBUGS-72932: Fix Konflux EC voilation, update deprecated base … #7456
OCPBUGS-69847: test: remove unit tests that depend on network communication [release-4.18] #7406
OCPBUGS-65843: specify SCC annotation for pods in data plane #7267
CNTRLPLANE-1902: Migrate 4.18 pipelines to common pipeline template #7211
OCPBUGS-61700: use csi-resizer image from release provider #7103
OCPBUGS-63638: [release-4.18] fix(konnectivity): resolve circular dependency causing DNS timeouts and excessive retries #7111
Full changelog

ibm-cloud-controller-manager

OCPBUGS-120695: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #114
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-80280: Bump google.golang.org/grpc to v1.79.3 #143
OCPBUGS-77207: [release-4.18] standardize build paths #122
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-103440: Use patched x/net fork v0.35.0-sec.4 #189
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-103453: Replace golang.org/x/net with openshift-sustaining/net #172
OCPBUGS-115513: Fetch envtest assets from the controller-tools releases #183
OCPBUGS-67286: [release-4.18] Fix incomplete vendor/ #140
Full changelog

ibmcloud-machine-controllers

OCPBUGS-103467: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 #104
OCPBUGS-41223: Updating ose-ibmcloud-machine-controllers-container image to be consistent with ART for 4.18 #45
NO-JIRA: vendor golint instead of relying on the CI build root #115
OCPBUGS-81647: bump vpc go sdk #91
NO-JIRA: Modernize test infrastructure to align with other MAPI providers #87
Full changelog

insights-operator

OCPBUGS-103459: Bump golang.org/x/net to v0.35.0-sec.3 #1355
OCPBUGS-80283: Bump google.golang.org/grpc to v1.79.3 #1283
OCPBUGS-76963: Extends the time for the extractor liveness probe #1234
OCPBUGS-76537: [release-4.18] [bugfix] The ConfigMap value for StoragePath is ignored on basic routine #1239
OCPBUGS-68263: Update github.com/sirupsen/logrus to v1.9.3 #1205
OCPBUGS-68263: [release-4.18] golanci-lint version update & corresponding fixes (#1045) #1206
OCPBUGS-66396: Add filtering to add other possible pod status to QEMU gatherer #1195
OCPBUGS-66182: QEMU logs are not gathered if there are pending status virt-launcher pods #1189
OCPBUGS-66181: [bugfix] The archive’s records may include files whose names are out of bounds #1188
Full changelog

insights-runtime-exporter, insights-runtime-extractor

OCPBUGS-77789: remove dnf cache from the container images #69
Full changelog

ironic

OCPBUGS-88475: Updating openstack-ironic commit that fixes CVE-2026-43003 #903
OCPBUGS-105860: update ironic pin to include CVE-2026-54423 fix (release-4.18) #893
OCPBUGS-100164: Update openstack-ironic commit hash for CVE-2026-44918 #888
OCPBUGS-76459: Bump pyasn1 to 0.5.1-4 #826
OCPBUGS-74407: Update sushy to include DGX B200 credentials fix #832
OCPBUGS-74115: Bump keystonemiddleware version to 10.7.1-0.20260216144200.4c001ba for CVE-2026-22797 fix #795
OCPBUGS-69790: Bump eventlet version to 0.33.1-7 #760
OCPBUGS-65573: Include Handle HTTP 400 and 409 race condition in Redfish power opera… #727
Full changelog

ironic-agent

OCPBUGS-99888: Correct ironic-python-agent pin to include the CVE-2026-66138 fix #314
OCPBUGS-88475: Update openstack-ironic-python-agent commit hash that address CVE-2026-43003 #313
OCPBUGS-99888: Bump ironic-python-agent pinned commit for CVE-2026-66138 #308
OCPBUGS-95066: Replace individual package removal with a single rpm -e loop #286
OCPBUGS-95066: Replace dnf remove with rpm -e to prevent dependency removal #274
OCPBUGS-69780: Bump eventlet version to 0.33.1-7 #230
OCPBUGS-68360: Include Test advertised ip reachability before assigning it #226
OCPBUGS-62456: netutils: Use ethtool ioctl to get permanent mac address #206
Full changelog

kube-metrics-server

NO-ISSUE: synchronize OWNERS from main branch [release-4.18] #81
OCPBUGS-80190: Bump google.golang.org/grpc to v1.79.3 #64
Full changelog

kube-rbac-proxy

OCPBUGS-39450: Updating kube-rbac-proxy-container image to be consistent with ART for 4.18 #105
Full changelog

kube-state-metrics

OCPBUGS-103452: Use patched x/net fork v0.35.0-sec.4 #164
NO-ISSUE: synchronize OWNERS from main branch [release-4.18] #172
OCPBUGS-74873: Deduplicate CRS stores #131
Full changelog

kube-storage-version-migrator

OCPBUGS-78273: fix /vendor for hermetic 4.18 #239
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-39554: Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 4.18 #45
OCPBUGS-95084: OWNERS: Update component to Cloud Compute / KubeVirt Provider #77
Full changelog

kubevirt-csi-driver

OCPBUGS-80191: Bump google.golang.org/grpc to v1.79.3 #101
OCPBUGS-79362: Add annotation-based fallback for infra VM node ID resolution #86
Full changelog

libvirt-machine-controllers

OCPBUGS-77194: Fix incomplete vendor/ #300
Full changelog

machine-api-operator

OCPBUGS-103469: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #1545
OCPBUGS-78795: [release-4.18] : correct aws kms permissions #1478
OCPBUGS-78796: [release-4.18] Use resource group when generating default Azure image #1480
Full changelog

machine-config-operator

OCPBUGS-103483: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #6507
OCPBUGS-129117: Degraded MCP as generated-kubelet is generated with an old controller version #6624
OCPBUGS-127017: Update message for MachineOSBuildFailed condition #6566
OCPBUGS-122250: Add missing verb in MCC RBAC #6540
OCPBUGS-105477: Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole #6391
OCPBUGS-94116: move cleanUpDuplicatedMC to avoid double reboot on first updated #6249
OCPBUGS-91747: Verify extension packages are installed #6216
OCPBUGS-98445: Remove sensitive ControllerConfig logging #6294
OCPBUGS-97588: Bootstrap MCS logging entire ignition #6268
OCPBUGS-86845: Apply password only if changes exist #6113
OCPBUGS-86695: use –delete-if-present for karg removal #6102
OCPBUGS-86844: Fix ssh and password rollbacks #6096
OCPBUGS-86692: Fix re-cordon detection #6101
OCPBUGS-86300: Add terminationMessagePolicy to build pod containers #6074
OCPBUGS-86021: Fix units rollback if update failure #6052
OCPBUGS-79483: set default-timeout-stop to 200s globally #5805
OCPBUGS-62692: configure-ovs: work around a Cisco switch issue #5329
OCPBUGS-78056: Prevent unnecessary systemd unit disable #5758
OCPBUGS-74148: enable nodeip-configuration for platform external #5578
OCPBUGS-77777: reduce MCO image size #5738
OCPBUGS-77576: mcd_config_drift not working properly #5726
OCPBUGS-77421: Remove MCD liveness probe #5710
OCPBUGS-74644: After OCL is enabled few phases in MCN are not updating as expected #5605
OCPBUGS-77092: Machine-config controller should not log about non-existent pull-secret changes #5680
OCPBUGS-77041: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5671
OCPBUGS-76560: [release-4.18]: cherry pick to few fixes that needed for missing services and configuration #5653
OCPBUGS-71227: MCP is not correctly degraded when a pivotError happens #5534
OCPBUGS-70336: Remove log exposing kubeconfig #5528
OCPBUGS-62169: Fix - NetworkManager restart or crash renders br-ex unusable #5356
OCPBUGS-65850: Remove –mount directives #5433
Full changelog

machine-image-customization-controller

OCPBUGS-103463: Replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #193
OCPBUGS-82149: Return error when network data Secret lacks nmstate key #174
OCPBUGS-77888: Clean up dnf cache to reduce container image size #168
OCPBUGS-68262: [4.18] Uplift logrus #151
Full changelog

machine-os-images

OCPBUGS-87876: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #100
Full changelog

metallb-frr

OCPBUGS-74485: Dockerfile: unpin FRR rpm #121
Full changelog

monitoring-plugin

OU-1589: [release-4.18] sanitize linkified URLs in alert annotations #1378
NO-JIRA: [release-4.18] fix: reduce flakiness by assert charts existence and scroll into view before clicking #1365
OU-1241: [release-4.18] feat: unset query timeouts so they are defined in the backend #1359
OCPBUGS-103481: CVE-2026-33814-4-18 openshift4/ose-monitoring-plugin-rhel9: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.18] #1217
NO-JIRA: [release-4.18] Sanitize alert runbook URLs #1297
OCPBUGS-98772: [release-4.18] replace outdated react-linkify dependency #1179
OCPBUGS-74461: CVE-2025-13465 openshift4/ose-monitoring-plugin-rhel9: prototype pollution in _.unset and _.omit functions [openshift-4.18] #1141
OCPBUGS-79448: immutable bump: fix for CVE-2026-29063 #922
OU-1241: unset frontend timeout to use the backend configuration #905
OCPBUGS-83374: fix: re encode params when redirecting from graph to query-browser #878
NO-JIRA: fix: pin http-errors to 2.0.1 for hermetic builds #870
OU-993: adding cypress Dockerfiles #861
OU-876: monitoring automated testing backported and adjusted to pf-5 and diff UI #777
NO-JIRA: simplify dockerfile by removing cachito dependencies [release-4.18] #818
OCPBUGS-70291: fix: update qs vulnerable dependency #739
OCPBUGS-65958: Fix metrics gaps 4.18 #656
OCPBUGS-64735: allow tenancy access to metrics tag #638
OU-1059: add perspective to action injector #632
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-85249: Fix server url in kubeconfig #298
NO-ISSUE: [release-4.18] Bump Go to 1.22 and fix CI build root image #291
OCPBUGS-77853: hermetic 4.18 #276
Full changelog

must-gather

OCPBUGS-86019: Collect object size with the object count #547
Full changelog

network-metrics-daemon

OCPBUGS-103472: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #153
OCPBUGS-130596: fix golint not found on Go 1.22 CI builder #156
Full changelog

networking-console-plugin

OCPBUGS-98784: Updating linkify-it to 5.0.2 to fix CVE-2026-48801 #460
OCPBUGS-99991: Updating networking-console-plugin-container image to be consistent with ART for 4.18 #454
OCPBUGS-41880: Fix namespace retention between NetworkPolicies tabs when MultiNetworkPolicies are disabled #433
OCPBUGS-41880: Retain namespace selection between network policies tabs #424
OCPBUGS-87000: Update Dockerfile.art to 4.22 build image #426
OCPBUGS-83382: Fix CVE 2026 34043 serialize javascript 4.18 #413
[release-4:18] OCPBUGS-85067: Migration from yarn to npm #412
OCPBUGS-81606: Fix CVE-2026-CVE-2026-4800 in lodash #401
OCPBUGS-79449: Bump immutable #390
CNV-76277: Fix name generator with unprofessional names #319
OCPBUGS-63582: Fixed - Extra semicolon observed before Service IP in OCP Console #306
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

oauth-apiserver

NO-JIRA: (chore): update OWNERS file #170
OCPBUGS-65841: UPSTREAM: <carry>: bump kubernetes-apiserver to pick up loopback certificate expiration update #155
Full changelog

oauth-proxy

OCPBUGS-112094: bugfix: rewrite open redirect strings to ‘/’ #384
Full changelog

oauth-server

OCPBUGS-87072: bugfix: default to english when Accept-Language header contains more than 1000 underscores #272
OCPBUGS-81803: Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 #238
Full changelog

oc-mirror

OCPBUGS-129488: v1 accept catalog root entries and relative symlink targets #1578
OCPBUGS-66051: Remove empty status field from generated IDMS/ITMS files (manual 4.18 backport) #1324
OCPBUGS-65510: removes unintended exec permissions #1312
Full changelog

olm-operator-controller

OCPBUGS-103488: [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #804
OCPBUGS-100434: increase catalog HTTP client timeout from 10s to 5m #787
OCPBUGS-87830: [release-4.18] operator-controller: clean up orphaned temp dirs in catalog cache #751
OCPBUGS-80304: Update grpc-go to v1.71.3-sec.1 to fix CVE-2026-33186 #735
Full changelog

openshift-apiserver

OCPBUGS-82769: Address CVE-2026-35469 #657
OCPBUGS-74234: Bump library-go for route path validation fix #603
OCPBUGS-69955: Add ValidatingAdmissionPolicy and check for omissions next time. #589
OCPBUGS-66379: pkg/image: conditionally parse raw image manifest #585
OCPBUGS-65842: UPSTREAM <carry>: bump kubernetes-apiserver to pick up loopback certificate expiration update #581
Full changelog

openshift-state-metrics

NO-ISSUE: synchronize OWNERS from main branch #153
Full changelog

openstack-cluster-api-controllers

OCPBUGS-64816: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.11 into release-4.18 #371
Full changelog

openstack-machine-api-provider

OCPBUGS-93867: Revendor CAPO #174
OCPBUGS-69648: Don’t record event for every reconcile #143
OCPBUGS-76792: Fix make test #159
OCPBUGS-74986: Revendor CAPO #152
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-103497, OCPBUGS-103502, OCPBUGS-103503: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1366
OCPBUGS-80311, OCPBUGS-80312, OCPBUGS-80313: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.71.3-sec.1 [release-4.18] #1314
OCPBUGS-81473: Fix nil pointer dereference in sortUnpackJobs when sorting non-failed jobs #1273
OCPBUGS-77714: Remove the collect-profiles info from the microshift kustomization file #1245
OCPBUGS-76924: Remove the collect-profiles job #1231
OCPBUGS-65700: Fix TOCTOU race condition in ensureInstallPlan (#3682) #1156
Full changelog

operator-marketplace

OCPBUGS-73883: Increase default catalog polling interval to 4h (240m) #707
OCPBUGS-68272, OCPBUGS-68273: CVE-2025-65637 fixed in logrus v1.9.3+ #703
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-129152: Branch Sync release-4.20 to release-4.18 [10-05-2026] #3511
OCPBUGS-112810, OCPBUGS-113507: Branch Sync release-4.19 to release-4.18 [08-21-2026] #3410
OCPBUGS-105851: Branch Sync release-4.19 to release-4.18 [08-11-2026] #3386
OCPBUGS-82773: Bump github.com/moby/spdystream to v0.5.1 #3321
OCPBUGS-98957: Branch Sync release-4.19 to release-4.18 [07-09-2026] #3290
OCPBUGS-86230: Branch Sync release-4.19 to release-4.18 [05-19-2026] #3197
OCPBUGS-74399, OCPBUGS-85434: Branch Sync release-4.19 to release-4.18 [05-12-2026] #3184
OCPBUGS-77151, OCPBUGS-83567: Branch Sync release-4.19 to release-4.18 [04-16-2026] #3143
OCPBUGS-82148: Branch Sync release-4.19 to release-4.18 [04-05-2026] #3117
OCPBUGS-81479: node: fix serviceUpdateNotNeeded nil pointer comparison #3101
OCPBUGS-78015: Add pperiyasamy to OWNERS for release-4.18 #3045
OCPBUGS-77516: Clear stale conntrack UDP entries for nodePorts #3016
OCPBUGS-77083, OCPBUGS-77106: [release-4.18] combined backport PR for 2 escalations #2987
OCPBUGS-48710: Branch Sync release-4.19 to release-4.18 [02-04-2026] #2970
OCPBUGS-74270: release-4.18 fix(localnet, ipamless): Prevent LSP deletion on sync #2943
OCPBUGS-70346: Branch Sync release-4.19 to release-4.18 [01-07-2026] #2922
OCPBUGS-66140: Branch Sync release-4.19 to release-4.18 [12-31-2025] #2916
CORENET-6055, OCPBUGS-48710, OCPBUGS-66360, OCPBUGS-66381, OCPBUGS-66428: Branch Sync release-4.19 to release-4.18 [12-03-2025] #2895
OCPBUGS-68347: Add ricky-rav to OWNERS for release-4.18 #2897
OCPBUGS-64855: Fix stale EIP assignments during failover and controller restart #2849
OCPBUGS-64780: kubevirt: fix bad release of IPs of live migratable pods #2847
Full changelog

powervs-block-csi-driver

OCPBUGS-80317: Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 #130
OCPBUGS-82774: Fix CVE-2026-35469 by bumping github.com/moby/spdystream to v0.5.1 #124
OCPBUGS-51896: Mitigate CVE-2025-22868 by updating golang.org/x/oauth2 #102
OCPBUGS-70002: Update builder image’s golang version to 1.23 #103
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-80318: Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 #111
Full changelog

powervs-cloud-controller-manager

OCPBUGS-80319: Replace google.golang.org/grpc with openshift-sustaining fork v1.71.3-sec.1 to v1.79.3 to fix CVE-2026-33186 #99
Full changelog

prom-label-proxy

NO-ISSUE: synchronize OWNERS from main branch [release-4.18] #409
Full changelog

prometheus

NO-ISSUE: synchronize OWNERS from main branch #386
OCPBUGS-93696: fix for CVE-2026-42151 #368
OCPBUGS-88628: remote: validate snappy decoded length before allocation in read endpoint #346
OCPBUGS-80320: Bump google.golang.org/grpc to v1.79.3 #308
Full changelog

prometheus-alertmanager

NO-JIRA: synchronize OWNERS with main #189
OCPBUGS-103512: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #172
OCPBUGS-98183: build(deps): hashicorp/memberlist to a forked version #165
OCPBUGS-100355: Set testdata CA expiry to 20 years from issue date (#4112) #148
OCPBUGS-74976: Include go-verify-deps expected files in gitignore #114
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

NO-ISSUE: synchronize OWNERS from main branch #412
OCPBUGS-103510, OCPBUGS-103513: [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #397
OCPBUGS-77298: backport upstream fix to reconcile resources with inconsistent status #370
OCPBUGS-77398: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #366
OCPBUGS-61965: reconcile workload configurations when a referenced secret/configmap key is updated #347
Full changelog

prometheus-node-exporter

OCPBUGS-103506: Use patched x/net fork v0.35.0-sec.4 #196
NO-ISSUE: synchronize OWNERS from main branch [release-4.18] #202
Full changelog

route-controller-manager

OCPBUGS-103349: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #110
OCPBUGS-80199: Bump google.golang.org/grpc to v1.79.3 #85
Full changelog

telemeter

OCPBUGS-80333: Bump google.golang.org/grpc to v1.79.3 #599
OCPBUGS-81804: [release-4.18] Fix CVE-2026-34986 #596
Full changelog

tests

OCPBUGS-130856: stage the creation of test pods to minimize etcd impact #31740
OCPBUGS-77876: Backport: Remove duplicated graceful termination test from release-4.18 #30702
OCPBUGS-74207: Unrevert TLS tests with fixes #30708
OCPBUGS-69900: Updated the upgrade duration limit to 100 minutes for ppc64le #30628
OCPBUGS-63668: Add imagestream update dryrun test #30436
Full changelog

thanos

OCPBUGS-80335: Bump google.golang.org/grpc to v1.79.3 #184
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-77668: hermetic migration 4.18 #105
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-80340: Bump google.golang.org/grpc to v1.79.3 #104
OCPBUGS-78018: hermetic migration 4.18 #84
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-92888: Bump golang.org/x/crypto/ssh to v0.33.0-sec.3 #193
OCPBUGS-80343: Bump google.golang.org/grpc to v1.79.3 #176
OCPBUGS-68278: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.9.3 #156
Full changelog

vsphere-csi-driver-operator

OCPBUGS-103531: Bump golang.org/x/net to v0.35.0-sec.3 #356
OCPBUGS-81673: Fix password escaping #342
Full changelog

vsphere-problem-detector

OCPBUGS-129532: Fixed compute cluster permission logic for single fd with read-only custom resourcepool #245
OCPBUGS-103545: Bump golang.org/x/net to v0.35.0-sec.4 #233
OCPBUGS-81556: fix concurrent map writes #215
OCPBUGS-70359: Fixed logic for vSphere compute cluster permission #200
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github