4.12.102

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.12.102-x86_64

Qualifiers (status api):

Tests:

Blocking jobs
- upgrade Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-sdn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.12-e2e-aws-sdn-serial
- azure-ovn-upgrade-4.12-micro Failed periodic-ci-openshift-release-main-ci-4.12-e2e-azure-ovn-upgrade
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.12-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.12-fips-payload-scan
- gcp-sdn-upgrade-4.12-micro Succeeded periodic-ci-openshift-release-main-ci-4.12-e2e-gcp-sdn-upgrade
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.12-e2e-metal-ipi-ovn-ipv6
- metal-ipi-sdn-ipv4 Succeeded periodic-ci-openshift-release-main-nightly-4.12-e2e-metal-ipi-sdn-ipv4

Upgrades from:

Untested upgrades: 4.11.14, 4.11.15, 4.11.16, 4.11.17, 4.11.18, 4.11.19, 4.11.20, 4.11.21, 4.11.22, 4.11.23, 4.11.25, 4.11.26, 4.11.28, 4.11.29, 4.11.30, 4.11.31, 4.11.32, 4.11.33, 4.11.34, 4.11.35, 4.11.36, 4.11.37, 4.11.38, 4.11.39, 4.11.40, 4.11.41, 4.11.42, 4.11.43, 4.11.44, 4.11.45, 4.11.46, 4.11.48, 4.11.49, 4.11.50, 4.11.51, 4.11.52, 4.11.53, 4.11.54, 4.11.55, 4.11.56, 4.12.10, 4.12.11, 4.12.12, 4.12.13, 4.12.14, 4.12.15, 4.12.16, 4.12.17, 4.12.18, 4.12.19, 4.12.20, 4.12.21, 4.12.22, 4.12.23, 4.12.24, 4.12.25, 4.12.26, 4.12.27, 4.12.28, 4.12.29, 4.12.3, 4.12.30, 4.12.31, 4.12.32, 4.12.33, 4.12.34, 4.12.35, 4.12.36, 4.12.37, 4.12.38, 4.12.39, 4.12.4, 4.12.40, 4.12.41, 4.12.42, 4.12.43, 4.12.44, 4.12.45, 4.12.46, 4.12.47, 4.12.48, 4.12.5, 4.12.50, 4.12.51, 4.12.52, 4.12.53, 4.12.54, 4.12.55, 4.12.56, 4.12.57, 4.12.58, 4.12.59, 4.12.6, 4.12.60, 4.12.61, 4.12.62, 4.12.63, 4.12.65, 4.12.66, 4.12.67, 4.12.68, 4.12.69, 4.12.7, 4.12.70, 4.12.71, 4.12.72, 4.12.73, 4.12.74, 4.12.75, 4.12.76, 4.12.77, 4.12.78, 4.12.79, 4.12.8, 4.12.80, 4.12.81, 4.12.82, 4.12.83, 4.12.85, 4.12.86, 4.12.87, 4.12.88, 4.12.89, 4.12.9, 4.12.90, 4.12.91, 4.12.92, 4.12.93, 4.12.94, 4.12.95, 4.12.96, 4.12.97, 4.12.98

Upgrades to:

4.13.0-0.ci-2026-10-27-090804 (changes) - S F F
4.13.0-0.ci-2026-10-26-210804 (changes) - F S F F

Loading changelog, this may take a while ...

Changes from 4.12.84

Created: 2026-10-26 17:01:35 +0000 UTC

Image Digest: sha256:3c8e5084a9c3a8e2e8ff8ef2d5c653a003f8d25f5db569e0d2b865af5443f076

Components

Kubernetes 1.25.16
Red Hat Enterprise Linux CoreOS upgraded from 412.86.202601061735-0 to 412.86.202610250235-0 (diff)

Rebuilt images without code change

alibaba-cloud-csi-driver git 4d3b1125 sha256:8930998ef218b94b30f864a3a1f1762991ec967c52c778bdfebafa08498a5dd0
alibaba-disk-csi-driver-operator git 99bcda8d sha256:a48adf5104cf40e902e1863b85db8ee62edbd1b55e7acddb7755a461d260399e
alibaba-machine-controllers git 871dac7e sha256:08f416e1c373635a68d061f788959d4cf8f2d55d71e5c08e4e82b956900ab73f
apiserver-network-proxy git f56c606a sha256:3c9a2a2af5311e2e05aa6037cb9a4e06484433e96c92204b1d6d62ad6dabd59b
aws-cloud-controller-manager git f90fb443 sha256:748b69d083dec0a08472eb801aae167e14a138807519a3799f8773aec9183e44
aws-ebs-csi-driver git bbab20f9 sha256:2d59c7cee076dc7d86301253b0abbb87bc3714928efdf8f24e69139f3bf47342
aws-pod-identity-webhook git 31917a5f sha256:d1556a726fd45c33144000dbb112bb385849267ed5b91dbea96f31339ea23e17
azure-cloud-controller-manager git 2193ccfa sha256:6a8aa724be3817a641af8a319a51e3de6694b6e4d83ae9c20ce77457f0fdd365
azure-cloud-node-manager git 2193ccfa sha256:73696795ee87c3a1c184ac9d153e76c071a78e5fc5a7cca08ac882e6f26fa2ff
azure-disk-csi-driver git eaff7399 sha256:4b6c6f0d94a7a638a9d36fbedc68e2f845de4bb8599432c74a623df72c5fdae5
baremetal-runtimecfg git 474ed48e sha256:148952c298cdef52c9dcb141a3c10f3b61d25d5d13d1d46b320351580d88c1f0
cli git d6912573 sha256:c5023c70c8c320f6199b6049426ba37c7ff9ce9b5eaf839495864e74457abb86
cli-artifacts git d6912573 sha256:2d9a0c22883b2314b478cd0cb8be43c247faa03ea1e0611b27d9312fa8c6b02e
cloud-credential-operator git 5a4483cd sha256:ad23dd4bb6b3640838db752d68034e56ac830abdde38e1fa9281f53c9450b7ab
cloud-network-config-controller git c086bed7 sha256:6b9cb446c336c29831c1600b4790a4e1124e753626255d0d75a1a6853972dc48
cluster-authentication-operator git 4f7f6b1a sha256:42d5e7ad593c41aaf7d01a8e3d5f3d43046bd4d917a0a3fa36b69b3d226c722b
cluster-autoscaler git d16352d9 sha256:5b7712331a84d3fa2e44603a52925d8800a11e3d3cf2b0a08d414ea68494738a
cluster-bootstrap git 138a1cf2 sha256:c65416350075c840492a74cbc14924fef2c8d37abf9fca55fab370b33b0036e2
cluster-cloud-controller-manager-operator git 3b1f0843 sha256:0c52adbe1f1dd52beded0758b7028ed63b4402f6527296cc0c616d09ff1b1118
cluster-config-operator git 92c3b102 sha256:74d7dbbe2cc3e3da72cf4fcd4ea20a90c19fa9c75cc99431ac2c2179385ec5eb
cluster-control-plane-machine-set-operator git fb7f08a2 sha256:12bb95354641e6a444856e1b93c408ff94c184636831d324b3cda5a7454ff7cd
cluster-dns-operator git 09a1de9f sha256:eeb2dfed32f44592d96173af4680ad7ffcb97a5ebd4e9768f27f70798b681a37
cluster-kube-cluster-api-operator git d50f7322 sha256:20e58bfa031c4436ada38c53b73d3cd654e9e7eeb32504fca929db03926ded26
cluster-kube-controller-manager-operator git c3c07beb sha256:8248afbf8dfa45d3d8a2c56e697f8a161a465467e571a9f376cefef82efe2c1f
cluster-machine-approver git 7b08a4de sha256:7db2fa6adb97ada426ff6bce42ea162db9b7daa4ee42249fc8c7691448df8e83
cluster-network-operator git 28db40f1 sha256:ee9e96c148bcf320b01364de404d4bd28624984f0b378ebba06ddf9120d59be4
cluster-node-tuning-operator git 20966da9 sha256:aaf56cbddc3c8781d21001fa56332f5ab9287027ec106d5c6fdec68f467c22ba
cluster-platform-operators-manager git c930dc74 sha256:c9fc2edeff17d28cd0e5c9ee4aa4b520ebe863444b83ff0aeddcf68c4eabc50d
cluster-policy-controller git cb8862b0 sha256:a7e0def21e33d33e60dba6864eba0d8a3cb95ff75768e7e3868d6da13408273a
cluster-samples-operator git 24b10d41 sha256:88d3ec0bcaedc60e290b0bbe67cd493d938629f2c4223b5f3f91f7134dd092f1
cluster-update-keys git 2796e173 sha256:bb4a58aee80c512db69321c7803694c40e753700f929310ff1568c971daacb49
cluster-version-operator git da2578c6 sha256:da1936b1f4e6d35e8b40e7e7f69b2415cb288d6699716f8dd72942213403167f
configmap-reloader git e4d9170e sha256:b1dbc733088c83cd0f7dac3bed5f62c939c3769f67b27b631b8eb537ea3ea2d7
container-networking-plugins git cd87d3d3 sha256:13ab7a6e6ad664c30c998c537e3608376db173288f1e56e1d25d5a7c293d1add
coredns git 95d00296 sha256:818f78e7ffd3a3bad11f040d74fa0776b580a808107c1472a1e5ca70bb0a1801
csi-driver-shared-resource-operator git cc297702 sha256:e2ab85cfe8ceec25c4783fcec84f7d7d61be0a4d754836f8e7e5ce59c603dcd6
csi-external-attacher git fac7b8fd sha256:48e111e6740675eeab6a0c62cc3fcb42086e8e17ae5fd96914c02d1af6bf54a3
csi-external-provisioner git 3aa7c527 sha256:b904682bbc5ad4d010c3af9c42d4f6321be9f8c8981f0245bbee497a27d8390f
csi-external-resizer git 5b066ba4 sha256:325771408425b679c1d79436c7d5dfa9ede1430e12d617a664eeaec9ade057de
csi-external-snapshotter git 6fdb648f sha256:fed676f92801d3e6334e0c833fa6fdfe210515eb0c88a4ec39e4a7d36d27f68a
csi-livenessprobe git e6545e71 sha256:9d8c7000cda488c6c0743c610002a9c399e40c75996e3452366ce53fe8692cfa
csi-node-driver-registrar git c316b896 sha256:8fc2eef2a164062ba023c1e52469e7adfd22bbf2040da45cccb9cbf47c74fbda
csi-snapshot-controller git 6fdb648f sha256:3409d8048a2fd6aa15155fbc9d95a68aaabbf34c85e40cc59855c8090ac240dd
csi-snapshot-validation-webhook git 6fdb648f sha256:c0c608525ea3bf17d4af46546ffa63b9b7178b2a81815e2a24271af51abe98d8
deployer git d6912573 sha256:b156901214f84dc9b621d16d5a691d6cea828c7f30166124ead2866b77d9954e
docker-registry git e96baf4b sha256:91cff795e21c6b14fa05c7c5b660c56e37ae7b6b14216881d7938065ec6bac57
driver-toolkit git 8ab7a753 sha256:5709e2e2da28b6caf11060fc9697a5293f5040e29c2ce02ad92121ab71cc17c2
egress-router-cni git a92e4157 sha256:7888205ac96bcf8a6d0a8a114a99ecd6e41819f8f724721d30752dfdf8e602a5
etcd git bb82e891 sha256:28c0ab4fe8f55916817e5710fcb093d2cb3f1b1904740c430d7e7cbdab759c14
gcp-cloud-controller-manager git 8a84952e sha256:e54be7330d0ced17ce73201a8dc9ee30f154eafae460337ba6de21d349111e6a
gcp-pd-csi-driver git 5dcfd675 sha256:0620fccaa6c2cebb8b9c8575ca908302b08be1cf9f39f0b0190e99344b653c81
gcp-pd-csi-driver-operator git 30e97ba5 sha256:66f8e0146d681bd76889c59437c8c5c5f946d00095f4012ed40c12fc9f1aba0c
ibm-cloud-controller-manager git 8bd0ea8f sha256:55bbc389292b74a1f998b06c7b02cf19f66c43d89815d426615a877dd0eba3b2
ibm-vpc-node-label-updater git 3cca5da2 sha256:995aae96db731e4aed63bab2d4969aedeb544139b91477761a5fabfd5f47a230
ironic-static-ip-manager git a8ade8fe sha256:9c4ff9e7a2bcca99e4d2b4d865bfa2523e15e74ac813e80521f26c2d43f91bbb
k8s-prometheus-adapter git 36c06694 sha256:e687d0b78e9f47f86a2029f9eebaf095607a088c6b8263db692039de2df483b0
keepalived-ipfailover git 7e8a0105 sha256:468790995353072b894501207c4cf7ef44fa4a7c29dff450a92f0f406fa69851
kube-proxy git 5fe565c4 sha256:0de2d5a0b0f832a64e86825d2c075a1df75dcdefd4e5f9ddfb96d2d0f15e8682
kube-rbac-proxy git c69fae78 sha256:d51e38cbcfc2c27376e6c7dca282220732486ed057860a4507d4fff132f9eb70
kube-storage-version-migrator git 74ce8d51 sha256:f7170bc2ec5b585c7a9f9de2f68093af2ff97bcf7a74acd9ce430014dc77b750
kuryr-cni git 8fd2f8b0 sha256:c1be912d1512856ec18e4ff7906d035c3f431328981ff05f5c8245e6e4af2de6
kuryr-controller git 8fd2f8b0 sha256:e68710351df49333a980a9c5fff6fde5863f2239e24ca097a2a005b41bca73d7
libvirt-machine-controllers git a2882f7a sha256:721fe58268f1b04b0a9d33744bab26eb5d81551e7b1444f292b2bd099af49b9c
machine-os-content sha256:7b7b6492ac5d1c20c912dcd5788e03fc9b393a80158611a51e68f3957ada453d
multus-admission-controller git 0a12d741 sha256:d5f93092a7c918b4afeea2a0746fc402ff2d01477ea5240c5fb9210d49deae83
multus-cni git 07d8af54 sha256:b917048c957ea247326569c43d0c5119dc588802dc34666093964e5378bbd8bb
multus-networkpolicy git 644461f2 sha256:59807a82fa703ca0d4f3d9530ecba56ce520b641fb7bf36dc9eb02d4393f7d23
multus-whereabouts-ipam-cni git 5993d022 sha256:2d552a3c9c1f974303f7f9946cb1c8f65938af580b6205718c261293af6996f7
must-gather git a4db96b0 sha256:3298102a06e4a2477d515a253a0762fc17cd199a65f78238d2cfed0f97f53787
network-interface-bond-cni git 30386d6b sha256:e7c12ce4c094fe9216c54fcaff072b4d28ca5a6f5934d3e15a0b6713b751bbba
network-metrics-daemon git 98d9349d sha256:9b1aa26368cf91d95f3a5c7dcba6fcccd2cdc1cd1682ae7b14f492be9db2c958
network-tools git c76613c7 sha256:2c53fde5060a21d117e64b18dc0182deed4d7263c7773bc91f0a141087a28b34
oauth-apiserver git 1053f142 sha256:12bb6334b1e5fd6b164bf5d600325568be2c132f8ff60db6ac1a55228ed93266
oauth-server git 0c434f42 sha256:4ea299006811816a130dd43b7f3e0abad276c5d8435aab5babb75c993ab468ab
olm-rukpak git bb06dd01 sha256:13c5d3f3fc0716d1eefb4dae44e3dc0caba8b68adb25c17e0c26803351f047a8
openshift-controller-manager git d32006c1 sha256:3dbaba960d9c9f69c105a59f1a74c0781e448b41fa6b7d904adf3fabdfab990f
openstack-machine-api-provider git 05657663 sha256:701d5f5c35ea7dfa8cfdb9e0927ce86aded64ef90618b13bb3bf016ae5533cb5
openstack-machine-controllers git f13e381e sha256:7956cc952aea8a9592f4e5ecd9f5e4b0d6d6c67306bff18e56f86c3ad804c9bc
operator-marketplace git a3aeac97 sha256:1ffbd47456c2ec36affa6ce3595d4db4ffa011fb3fd3c619cdfd70242533db86
ovirt-csi-driver git 87ab3789 sha256:e9ed5a5d92487ce0088fb7742b7b543910725ed4c54d59d4c62fbdec3ed67489
ovirt-machine-controllers git 03e8cb50 sha256:e89f41520b2dfc02a020be3ddf2f44e75953b39f3ee1650a7284c4b2b923a630
powervs-block-csi-driver git b78e8e78 sha256:2ef11c2c1dcaf14a6ad9be6c2c841a0bd222cecf8d6c6910e2d30270df5ebba3
powervs-cloud-controller-manager git 4fb4334c sha256:71655f512f5d089db0baf7dec414002f0ff27345c33d1176f15acc935f481b0a
rhel-coreos-8 sha256:367e718d1bf627f5956bb785ba62d39118daf706b3c67f816ad43af269383646
rhel-coreos-8-extensions sha256:21864e4ba95d23185f4f80e49db667c90b8f8c78b4d817a0973df0f09d7683ab
sdn git 5fe565c4 sha256:22420e1ac3988a2685c2fa8c012dabd4a0fb674442229dd08c12f490179ed57b
tools git d6912573 sha256:2d2f70e301ef56e389236398e42b24176e11b58792deb69e9d7b16c990fddc8a

agent-installer-api-server

OCPBUGS-78114: [release-4.12] NO-JIRA: hermetic 4.12 #9956
OCPBUGS-67386: Bump logrus from 1.9.0 to 19.3 #8768
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-67388: Bump logrus v1.9.0 to v1.9.3 #1465
Full changelog

agent-installer-node-agent

OCPBUGS-67390: Bump logrus v1.9.0 to v1.9.3 #1287
Full changelog

alibaba-cloud-controller-manager

OCPBUGS-102079: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #66
Full changelog

aws-cluster-api-controllers

OCPBUGS-78231: [release-4.12] hermetic 4.12 #595
Full changelog

aws-ebs-csi-driver-operator

OCPBUGS-102107: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #318
OCPBUGS-67399: Updated logrus to v1.8.3 #315
Full changelog

aws-machine-controllers

OCPBUGS-78268: hermetic 4.12 #176
Full changelog

azure-cluster-api-controllers

OCPBUGS-78180: [release-4.12] Hermetic 4.12 #368
Full changelog

azure-disk-csi-driver-operator

OCPBUGS-102104: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #133
Full changelog

azure-file-csi-driver

OCPBUGS-102098: Bump golang.org/x/net to v0.35.0-sec.4 #164
Full changelog

azure-file-csi-driver-operator

OCPBUGS-102096: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #117
OCPBUGS-67404: Bump github.com/sirupsen/logrus to v1.8.3 #116
Full changelog

azure-machine-controllers

OCPBUGS-78266: hermetic 4.12 #188
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-83750: Azure UPI ARM template: use storageAccountId #10511
OCPBUGS-78352: terraform/providers/google: Fixing inconsistencies with the service account creation #10385
Full changelog

baremetal-machine-controllers

OCPBUGS-78103: [release-4.12] fix vendor/ for hermetic migration #247
Full changelog

baremetal-operator

OCPBUGS-102110: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #519
Full changelog

cluster-autoscaler-operator

OCPBUGS-102115: Bump x/net package in release-4.12 #394
Full changelog

cluster-baremetal-operator

OCPBUGS-77451: Bump github.com/go-errors/errors to v1.5.1 #566
Full changelog

cluster-capi-controllers

OCPBUGS-86891: update CI build root and Dockerfile tags w.r.t ART 4.12 streams #299
OCPBUGS-77976: fix vendor for hermetic #267
Full changelog

cluster-capi-operator

NO-JIRA: Allow sustaining engineering to self serve dependency updates #564
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-102121: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #287
Full changelog

cluster-etcd-operator

OCPBUGS-67421: Update logrus to 1.9.3 to address CVE-2025-65637 #1550
Full changelog

cluster-image-registry-operator

OCPBUGS-67422: Bump logrus to 1.8.3 #1292
Full changelog

cluster-ingress-operator

OCPBUGS-86709: Add configuration override for X-SSL strip #1494
Full changelog

cluster-kube-apiserver-operator

NO-JIRA: refactor: Updating go builder in the CI, Dockerfile and go.mod to be consistent with ART 4.12 #2175
OCPBUGS-67424: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.12.z] #2048
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #628
Full changelog

cluster-kube-storage-version-migrator-operator

NO-JIRA: Reconciling the ART and CI go tool chain versions #173
OCPBUGS-67429: Bump github.com/sirupsen/logrus to v1.8.3 #143
Full changelog

cluster-monitoring-operator

NO-ISSUE: synchronize OWNERS from main branch [release-4.12] #3108
OCPBUGS-76642: test: remove image registry e2e tests #2816
OCPBUGS-77403: test/e2e: improve prometheus remote-write test #2819
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-76594: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.12] #660
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-102136: Use patched x/net fork v0.35.0-sec.4 #446
Full changelog

cluster-storage-operator

OCPBUGS-67444: Bump logrus to v1.8.3 #657
Full changelog

console

OCPBUGS-129171: Sanitize alert runbook URLs #17192
OCPBUGS-77114: [release-4.12] CVE-2026-26996 Bump minimatch library #16489
OCPBUGS-92663: CVE-2026-46597 openshift4/ose-console: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs [openshift-4.12.z] #16983
OCPBUGS-100520: Bump postcss to 8.5.26 to fix CVE-2026-45623 #17110
OCPBUGS-90615: Fix JSON annotation parsing to prevent OperatorHub crash #16660
Fix for OCPBUGS-92077: CVE-2026-44990 #16723
OCPBUGS-98415: CVE-2026-59869 #16756
OCPBUGS-87984: [release-4.12] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16594
OCPBUGS-120132: Fix JSON annotation parsing to prevent OperatorHub crash #17135
Fix for OCPBUGS-81593: CVE-2026-4800 #16570
OCPBUGS-88398, OCPBUGS-88416: Bump Axios to fix CVE-2026-44486. Requires a Patch of axios 0.33.0 types to be compatible with old version of TS #16793
OCPBUGS-79430: CVE-2026-29063 Bump immutable #16331
ART-18753: pin fsevents to latest #16482
NO-JIRA: enable multi-architecture yarn builds #16422
NO-JIRA: Updating openshift-enterprise-console-container image to be consistent with ART for 4.12 #12539
CONSOLE-5011: migrate to yarn berry #16084
NO-JIRA: Bump builder image to v29 #15988
OCPBUGS-74435: Bump lodash to latest #15973
Full changelog

console-operator

OCPBUGS-102152: Use patched x/net fork v0.35.0-sec.4 #1231
Updating openshift-enterprise-console-operator-container image to be consistent with ART for 4.12 #1137
OCPBUGS-77996: [release-4.12] NO-JIRA: update go mod dependency for konflux #1119
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-79763: Apply code mitigations for CVE-2026-33186 #401
OCPBUGS-67448: CVE-2025-65637 #365
Full changelog

csi-driver-manila-operator

OCPBUGS-67449: Bump logrus #255
Full changelog

csi-driver-nfs

OCPBUGS-84927: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 to avoid go version bump and fix CVE-2026-33186 #186
Full changelog

csi-driver-shared-resource, csi-driver-shared-resource-webhook

OCPBUGS-102157: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #529
Full changelog

docker-builder

OCPBUGS-89733, OCPBUGS-90176, OCPBUGS-92261, OCPBUGS-92553, OCPBUGS-92668: Bump golang.org/x/crypto to fix CVE-2026-39831,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832,CVE-2026-39830 #546
Full changelog

gcp-cluster-api-controllers

OCPBUGS-78284: [release-4.12] hermetic migration 4.12 #278
OCPBUGS-78284: [release-4.12] hermetic migration 4.12 #271
Full changelog

gcp-machine-controllers

OCPBUGS-102202: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #196
OCPBUGS-83657: Address CVE-2026-33186 #174
OCPBUGS-78183: hermetic 4.12 #143
Full changelog

haproxy-router

OCPBUGS-86709: Strip X-SSL-* headers for plain HTTP #809
OCPBUGS-74943: Adding escapeHAProxySingleQuotes for sanitize [release-4.12] #784
OCPBUGS-78110: [release-4.12] hermetic 4.12 #744
Full changelog

hyperkube, pod

OCPBUGS-77661: Skip E2e: attach on previously attached volumes should work #2649
OCPBUGS-77469: hermetic 4.12 #2652
OCPBUGS-67374, OCPBUGS-67472: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 [4.12] #2596
OCPBUGS-78226: UPSTREAM: 133262: Remove permafailing tests using an expired GCP project #2625
Full changelog

hypershift

OCPBUGS-77768: fix vendor for hermetic 4.12 #7823
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-79756: Bump google.golang.org/grpc to v1.79.3 #158
OCPBUGS-77214: [release-4.12] standardize build paths #128
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-102199: Use patched x/net fork v0.35.0-sec.4 #183
OCPBUGS-67476, OCPBUGS-67477: bump github.com/sirupsen/logrus to v1.8.3 #163
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-102194: Replace golang.org/x/net with openshift-sustaining/net #166
OCPBUGS-115549: Fetch envtest assets from the controller-tools releases #177
OCPBUGS-67292: [release-4.12] Fix incomplete vendor/ #134
Full changelog

ibmcloud-machine-controllers

OCPBUGS-102189: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 #110
OCPBUGS-78276: hermetic 4.12 #79
Full changelog

ironic

OCPBUGS-97988: bump openstack-ironic RPM for CVE-2026-44918 fix #930
OCPBUGS-69787: Bump eventlet version to 0.30.2-5 #767
Full changelog

ironic-agent

OCPBUGS-96903: Replace individual package removal with a single rpm -e loop #280
OCPBUGS-69778: adding eventlet 0.30.2-5 #236
Full changelog

ironic-machine-os-downloader

OCPBUGS-87168: CI Build root image tag and go version in go.mod sync with ART 4.12 #118
Full changelog

kube-state-metrics

NO-ISSUE: synchronize OWNERS from main branch [release-4.12] #179
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-95078: OWNERS: Update component to Cloud Compute / KubeVirt Provider #76
Full changelog

kubevirt-csi-driver

OCPBUGS-83660: Bump google.golang.org/grpc to v1.79.3 #110
Full changelog

machine-os-images

OCPBUGS-87882: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #106
Full changelog

multus-route-override-cni

OCPBUGS-78160: hermetic 4.12 #64
Full changelog

nutanix-machine-controllers

OCPBUGS-78158: hermetic 4.12 #132
Full changelog

oauth-proxy

OCPBUGS-112091: bugfix: rewrite open redirect strings to ‘/’ #390
Full changelog

openshift-apiserver

OCPBUGS-90518: Address CVE-2026-35469 #663
OCPBUGS-76481: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.12] #614
OCPBUGS-79381: Fix image reference in TestImageStreamImportQuayIO #623
Full changelog

openshift-state-metrics

NO-ISSUE: synchronize OWNERS from main branch #155
OCPBUGS-102220: CVE-2026-33814 openshift4/ose-openshift-state-metrics-rhel8: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.12.z] #138
Full changelog

openstack-cinder-csi-driver-operator

OCPBUGS-67502: Bump logrus #191
Full changelog

operator-lifecycle-manager, operator-registry

OCPBUGS-102215: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #1371
OCPBUGS-87894, OCPBUGS-87897: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.64.1-sec.1 [release-4.12] #1383
OCPBUGS-86254: Drop github.com/distribution/distribution in go.mod #1312
Full changelog

ovirt-csi-driver-operator

OCPBUGS-67542: Bump github.com/sirupsen/logrus to v1.8.3 #148
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

CORENET-6055, OCPBUGS-84636: [release-4.12] Dockerfile: Unpin OVN and consume the latest from FDP #3075
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-67511: Fix CVE-2025-65637 by bumping logrus to v1.8.3 #102
Full changelog

powervs-machine-controllers

OCPBUGS-78043: hermetic 4.12 #138
Full changelog

prom-label-proxy

NO-ISSUE: synchronize OWNERS from main branch [release-4.12] #408
Full changelog

prometheus

NO-ISSUE: synchronize OWNERS from main branch #388
OCPBUGS-88580: remote: validate snappy decoded length before allocation in read endpoint #356
OCPBUGS-86876: Bump google.golang.org/grpc #325
OCPBUGS-67512: CVE-2025-65637 Update sirupsen/logrus to 1.9.3 #291
Full changelog