4.12.103

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.12.103-x86_64

Qualifiers (status api):

Tests:

Blocking jobs
- upgrade Succeeded (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- upgrade-minor Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-sdn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.12-e2e-aws-sdn-serial
- azure-ovn-upgrade-4.12-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.12-e2e-azure-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.12-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.12-fips-payload-scan
- gcp-sdn-upgrade-4.12-micro Succeeded periodic-ci-openshift-release-main-ci-4.12-e2e-gcp-sdn-upgrade
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.12-e2e-metal-ipi-ovn-ipv6
- metal-ipi-sdn-ipv4 Succeeded periodic-ci-openshift-release-main-nightly-4.12-e2e-metal-ipi-sdn-ipv4

Upgrades from:

Untested upgrades: 4.11.14, 4.11.15, 4.11.16, 4.11.17, 4.11.18, 4.11.19, 4.11.20, 4.11.21, 4.11.22, 4.11.23, 4.11.24, 4.11.25, 4.11.26, 4.11.27, 4.11.28, 4.11.29, 4.11.32, 4.11.33, 4.11.34, 4.11.36, 4.11.37, 4.11.38, 4.11.39, 4.11.40, 4.11.41, 4.11.42, 4.11.43, 4.11.44, 4.11.45, 4.11.46, 4.11.47, 4.11.48, 4.11.49, 4.11.50, 4.11.51, 4.11.52, 4.11.53, 4.11.54, 4.11.55, 4.11.56, 4.12.10, 4.12.12, 4.12.13, 4.12.14, 4.12.15, 4.12.16, 4.12.17, 4.12.18, 4.12.19, 4.12.20, 4.12.21, 4.12.23, 4.12.24, 4.12.25, 4.12.26, 4.12.27, 4.12.28, 4.12.29, 4.12.3, 4.12.30, 4.12.31, 4.12.32, 4.12.33, 4.12.34, 4.12.35, 4.12.36, 4.12.37, 4.12.38, 4.12.39, 4.12.4, 4.12.40, 4.12.41, 4.12.42, 4.12.43, 4.12.44, 4.12.45, 4.12.46, 4.12.47, 4.12.48, 4.12.49, 4.12.5, 4.12.50, 4.12.51, 4.12.52, 4.12.53, 4.12.54, 4.12.55, 4.12.56, 4.12.57, 4.12.58, 4.12.59, 4.12.6, 4.12.60, 4.12.61, 4.12.62, 4.12.63, 4.12.64, 4.12.65, 4.12.66, 4.12.67, 4.12.68, 4.12.69, 4.12.7, 4.12.70, 4.12.71, 4.12.73, 4.12.74, 4.12.75, 4.12.76, 4.12.77, 4.12.78, 4.12.79, 4.12.8, 4.12.80, 4.12.81, 4.12.82, 4.12.83, 4.12.84, 4.12.85, 4.12.86, 4.12.87, 4.12.88, 4.12.89, 4.12.9, 4.12.90, 4.12.91, 4.12.92, 4.12.93, 4.12.94, 4.12.95, 4.12.96, 4.12.97, 4.12.98, 4.12.99

Upgrades to:

4.13.73 (changes) - Pending Pending

Loading changelog, this may take a while ...

Changes from 4.12.72

Created: 2026-11-06 10:44:58 +0000 UTC

Image Digest: sha256:8d31fe41fbd8e2065d676840f79ed9287dbdb5630e39c9a7a9b87d7ba874307e

Components

Kubernetes 1.25.16
Red Hat Enterprise Linux CoreOS upgraded from 412.86.202501011408-0 to 412.86.202611041725-0 (diff)

Rebuilt images without code change

alibaba-cloud-csi-driver git 4d3b1125 sha256:17cee3e1d7352cd0c89de2132c310d17aade201c9ae43e8d1895e36d28f2cc8b
alibaba-disk-csi-driver-operator git 99bcda8d sha256:532d86fdea964d72b66ca58de7b9866cc4818e0c472fbcd0e161c067e01a1f5f
apiserver-network-proxy git f56c606a sha256:d88e552200c105157eda12aaf81e8142bdb035af4ff8a7dbe4c438664ead7e38
aws-cloud-controller-manager git f90fb443 sha256:81fdac85fe16e4ddffa11c8f7da650f0268dc6b721195aebd3816698425429e7
aws-ebs-csi-driver git bbab20f9 sha256:8a2367e88e00d8ce1eb7a7c73430b1152a985e8aed6d901ab549e05b98e0de00
aws-pod-identity-webhook git 31917a5f sha256:f2f6b676630ae0fa16e905ea02d59863c1ea83848d3f24a884688a203569d470
baremetal-runtimecfg git 474ed48e sha256:1187b9a55bf4cd33a74e3c02f2dd2100680b9b999c20733c1262b07c95adfc9d
cli git d6912573 sha256:b3043f5cc95e2646a977d72fbea27fb42e76eda177ccc0becf336b32b5fa6055
cli-artifacts git d6912573 sha256:caff8b7230990ff34ddc9e8da39b3a06039c89fcd91434e4ab4a98113bc9c157
cloud-network-config-controller git c086bed7 sha256:0a80241917f1f3d71e848ecb7de1db88eeb5c94a24b00751c8a66b066c46eac6
cluster-authentication-operator git 4f7f6b1a sha256:12808d9116729fe4d7a1449f77132b319a97b32708cedb93640e4466108d23bb
cluster-autoscaler git d16352d9 sha256:9570f951ccfa837f3eb2a9f15bb642d285505423fe5b38bcae7482cc638f0044
cluster-bootstrap git 138a1cf2 sha256:1de6a12b0456553c02442536de3e3d65f2b5b067a44e777f77632725586d2d10
cluster-cloud-controller-manager-operator git 3b1f0843 sha256:0ed3e2b6ed58d6846412110caaf57d54d914f293e3236f59c6926f008a4d9587
cluster-config-operator git 92c3b102 sha256:0bdda109aa8b0a7e58f9ed04f73e02997917b7bdedb712a2d2454ff6872104fb
cluster-control-plane-machine-set-operator git fb7f08a2 sha256:f9a28bf55fb865ed4fab159d199013dc8d4c7cb7f16b661b5cf9c403834f2b3e
cluster-kube-cluster-api-operator git d50f7322 sha256:a1631a0364e6df476f220845bb14a118e47c209c17f1b0c862206a789503555b
cluster-kube-controller-manager-operator git c3c07beb sha256:dcb0e59b6f5f3c3d6f1e67ec6c3ea65fba4d0816c8fae3fe56c2e0657b5dba13
cluster-machine-approver git 7b08a4de sha256:5074ec3b999ce1c18c8d5530b9b89c8d16b4dce15eb18132dfa8545c4bad2e19
cluster-network-operator git 28db40f1 sha256:20f2418607da04fedf734b0a117e87248b01b9b4ca7bf9f325b5ec3c7714ba37
cluster-node-tuning-operator git 20966da9 sha256:f5d97a1d85b011fc6a9b557052899f7fd56a4b8bdbd1e4e3a356108710c399a2
cluster-platform-operators-manager git c930dc74 sha256:f682aa279333b08c07dc279129947f3b37cf62b1cf81b62ce8ff5b6893382f45
cluster-policy-controller git cb8862b0 sha256:79bdd77016e95eddec69b75cef907b90b50d0b4284030b7c90c63af35d0ada16
cluster-update-keys git 2796e173 sha256:0270d05de706183559c5d371399f65ed805e6e2c9a306d090769d98b1ee62ed3
cluster-version-operator git da2578c6 sha256:7847acc4b12b137cd25b1c3151960cc3177aa722aad2aba3cb76f788307ed466
configmap-reloader git e4d9170e sha256:04fc1b1d5a55071ca1f369ba153c2c0066f467d0f1f25af6eb6629507fb21c5c
csi-driver-shared-resource-operator git cc297702 sha256:228a176635e3eef2e3e6410d54a3002f5f3997f59b4c7786f6fbf015f90002c4
csi-external-attacher git fac7b8fd sha256:644f9dc9f34cefe747a3fdf554f59920e39c31691f2f1ab4e48edc7817093f24
csi-external-provisioner git 3aa7c527 sha256:f8db0f4719f58fac624300a0795003d31a07e9400e50b4d6511b21f00aa79ad4
csi-external-resizer git 5b066ba4 sha256:9fa10f22de19e1aa36983634bd6de081dd81ce269136d3494f7e6af2d5830890
csi-livenessprobe git e6545e71 sha256:9d3226e256815f66b8bd18bfa746f7c6904bafb7f6642247bb562894893ac2eb
csi-node-driver-registrar git c316b896 sha256:6828029f1ec15fd78cce521a2ab79afbecdacf286e1a6ad7f4ddd09d987c0b6c
deployer git d6912573 sha256:8baa6f148a7f09a333ff014947999a521cd676a862b682424f959cbf7dd0dcb6
egress-router-cni git a92e4157 sha256:4ef3864e75a8c4f66a3430b396e3ca3dc3ca932599bddb8763983cc8dbf4b34d
etcd git bb82e891 sha256:e33672226fdbcf4381eea3f6fb2556843f209c3a3c231bc9db2d17f0d0474437
gcp-cloud-controller-manager git 8a84952e sha256:cd9c6dc1a3ff883a64730210656d0bd2dcaa97b6a231efbe846a3b48ea3f89a5
gcp-pd-csi-driver git 5dcfd675 sha256:7117a8b08563aadaa8abb6d9eb864b88da9db317fb1ab16efb7c1b9467f1ff3e
gcp-pd-csi-driver-operator git 30e97ba5 sha256:bea4e656d23315b596c6595fc7de861c67f555c916134f19fc5193362216fc85
ibm-cloud-controller-manager git 8bd0ea8f sha256:ea670941edf20b63cd1bfaa533c8dbb05827762863abab0c8814e5f0ac72df57
ironic-static-ip-manager git a8ade8fe sha256:07539be8cebacd1879a4eafd2b421c854db5b641b67fd3c46e6d612050d4005c
k8s-prometheus-adapter git 36c06694 sha256:06ae3fb21b7fdb1786b347571a849b0d64c748276b58ec3077490e8427a14409
keepalived-ipfailover git 7e8a0105 sha256:a99aac4700fef867bb0851eafe02a3a6418dc69e80b497848c4f14499c032eeb
kube-rbac-proxy git c69fae78 sha256:b322ff5740d219a0c2f7ad4a2a315fa876ad4706da8977cde7224404c7d5c2ab
kuryr-cni git 8fd2f8b0 sha256:bb81711d576fdd9df98d0e1f2503d01339f9ee1e838e923bba0f375842dbd5ca
kuryr-controller git 8fd2f8b0 sha256:d23f7460aa51b8baff19f91b4c6bc78a73822f19d90f0c289dfdce2d2a058fb2
libvirt-machine-controllers git a2882f7a sha256:4a913b616243e3ca9d2133afe4b2efa9f23174eeffb22c4867e1447b7626da3b
machine-os-content sha256:dcfa817a551c9bf20b3a86ce979c99890dbcd4571c19bee288929c2a18d183bd
multus-cni git 07d8af54 sha256:c44123ee485aa1d5f976f61c40637f13f53d38591c25598e24b1d2d31f5bb531
multus-networkpolicy git 644461f2 sha256:89f91d738c2f96b02c9f8cf8e42801fe00902059b379697855dde6208ebd4a33
multus-whereabouts-ipam-cni git 5993d022 sha256:80aeb960453a734f0884f826838918953b631370b3b3dd6e3850c59f9220e8aa
network-interface-bond-cni git 30386d6b sha256:7182fba5984b95ce2f803d5968a86c8df056e7143b0fec433c686bba1bd26753
network-tools git c76613c7 sha256:8f5c2e8ab38bcde365431608a9688652a10ab8b274390767887600ef450ffc7f
oauth-apiserver git 1053f142 sha256:698f7a9ffb8d96d8fb31be06db1ec9185c3ece98f67eeacac99112886ea2d095
oauth-server git 0c434f42 sha256:32ce619a55834fedc00f37c0c55f67f2982efb8a2b313886d407ddc99fdb8612
olm-rukpak git bb06dd01 sha256:73478c685d4859e027499f35eb30d6723fad64ff188be009c45687bf48938d2d
openstack-machine-api-provider git 05657663 sha256:18fa19e95180c02edafbe7015a08a1727b995225a5a79b0d4f165fccd3c4f596
openstack-machine-controllers git f13e381e sha256:38b867925c13d48dbb80097ce5b16f25009828de9015d1c569a687d40f757aa4
ovirt-csi-driver git 87ab3789 sha256:34be50c946a211c8a70c67671654812787a461e795590745fb55ac6ea6a82009
ovirt-machine-controllers git 03e8cb50 sha256:aab0ee7caa936b6492cb9c39a225d30937da8f5fde374186f6a8f6977f713bc9
powervs-block-csi-driver git b78e8e78 sha256:48428ce7d63af0b8df4b9b9f7568f0e57fcd4fb7353bbe24f0f9ba83d3c0ae47
powervs-cloud-controller-manager git 4fb4334c sha256:9680c0dc4c0ad2584921536becc4ae0493e2517df3e186577ddf8524fabf72ca
rhel-coreos-8 sha256:8d61187507cb6ab4a78b988f861694854c9da2dc5d0728f8449b3973b65047cf
rhel-coreos-8-extensions sha256:23ac38e10a2865d9957bb3fa184c226e477a3d6662df4338642771370cfc74cc
tools git d6912573 sha256:d3a2db0686d4da3db43557856355b80c2946bde5c6bb9c53797ad1ba8632bde2

agent-installer-api-server

OCPBUGS-89729: Patching golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.24.0-sec.4.1 to address CVE-2026-39829 #11236
OCPBUGS-78114: [release-4.12] NO-JIRA: hermetic 4.12 #9956
OCPBUGS-67386: Bump logrus from 1.9.0 to 19.3 #8768
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-67388: Bump logrus v1.9.0 to v1.9.3 #1465
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-node-agent

OCPBUGS-102069: CVE-2026-33814 - replace golang.org/x/net with openshift-sustaining fork v0.35.0-sec.3 #1629
OCPBUGS-67390: Bump logrus v1.9.0 to v1.9.3 #1287
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

alibaba-cloud-controller-manager

OCPBUGS-102079: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #66
Full changelog

alibaba-machine-controllers

Updating ose-alibaba-machine-controllers images to be consistent with ART #35
Full changelog

aws-cluster-api-controllers

OCPBUGS-78231: [release-4.12] hermetic 4.12 #595
Full changelog

aws-ebs-csi-driver-operator

OCPBUGS-102107: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #318
OCPBUGS-67399: Updated logrus to v1.8.3 #315
Full changelog

aws-machine-controllers

OCPBUGS-78268: hermetic 4.12 #176
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-102109: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #214
Full changelog

azure-cluster-api-controllers

OCPBUGS-78180: [release-4.12] Hermetic 4.12 #368
Full changelog

azure-disk-csi-driver

OCPBUGS-56067: tech debt: rework vendor patches #106
Full changelog

azure-disk-csi-driver-operator

OCPBUGS-102104: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #133
Full changelog

azure-file-csi-driver

OCPBUGS-102098: Bump golang.org/x/net to v0.35.0-sec.4 #164
Full changelog

azure-file-csi-driver-operator

OCPBUGS-102096: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #117
OCPBUGS-67404: Bump github.com/sirupsen/logrus to v1.8.3 #116
Full changelog

azure-machine-controllers

OCPBUGS-78266: hermetic 4.12 #188
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-83750: Azure UPI ARM template: use storageAccountId #10511
OCPBUGS-78352: terraform/providers/google: Fixing inconsistencies with the service account creation #10385
OCPBUGS-66250: Replace terraform-provider-google with Openshift fork #10144
OCPBUGS-62820: Release 4.12 bump terraform provider azurerm #10002
OCPBUGS-55035: IBMCloud: Move to IBM TF openshift fork #9670
Full changelog

baremetal-machine-controllers

OCPBUGS-78103: [release-4.12] fix vendor/ for hermetic migration #247
Full changelog

baremetal-operator

OCPBUGS-102110: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #519
OCPBUGS-53335: CVE-2025-29781 ose-baremetal-operator-container: Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD [openshift-4.12.z] #412
Full changelog

cloud-credential-operator

OCPBUGS-53420: github.com/golang/glog v1.2.4 #847
OCPBUGS-51538: Ignore SNYK-GOLANG-GOLANGORGXOAUTH2JWS-8749594 due to not being affected #832
Full changelog

cluster-autoscaler-operator

OCPBUGS-102115: Bump x/net package in release-4.12 #394
Full changelog

cluster-baremetal-operator

OCPBUGS-77451: Bump github.com/go-errors/errors to v1.5.1 #566
Full changelog

cluster-capi-controllers

OCPBUGS-86891: update CI build root and Dockerfile tags w.r.t ART 4.12 streams #299
OCPBUGS-77976: fix vendor for hermetic #267
Full changelog

cluster-capi-operator

NO-JIRA: Allow sustaining engineering to self serve dependency updates #564
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-102121: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #287
Full changelog

cluster-dns-operator

OCPBUGS-52502: [release-4.12] Add runbook_url for CoreDNSErrorsHigh #435
Full changelog

cluster-etcd-operator

OCPBUGS-67421: Update logrus to 1.9.3 to address CVE-2025-65637 #1550
OCPBUGS-53508: fix CVE-2025-30204 #1416
Full changelog

cluster-image-registry-operator

OCPBUGS-67422: Bump logrus to 1.8.3 #1292
OCPBUGS-53868: Bump github.com/golang-jwt/jwt #1236
OCPBUGS-51594: bump golang.org/x/oauth2 #1223
Full changelog

cluster-ingress-operator

OCPBUGS-86709: Add configuration override for X-SSL strip #1494
Full changelog

cluster-kube-apiserver-operator

NO-JIRA: refactor: Updating go builder in the CI, Dockerfile and go.mod to be consistent with ART 4.12 #2175
OCPBUGS-67424: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.12.z] #2048
OCPBUGS-50880: Increase waitForFallbackDegradedConditionTimeout #1811
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #628
Full changelog

cluster-kube-storage-version-migrator-operator

NO-JIRA: Reconciling the ART and CI go tool chain versions #173
OCPBUGS-67429: Bump github.com/sirupsen/logrus to v1.8.3 #143
Full changelog

cluster-monitoring-operator

OCPBUGS-102148: Use patched x/net fork v0.35.0-sec.4 #3099
NO-ISSUE: synchronize OWNERS from main branch [release-4.12] #3108
OCPBUGS-76642: test: remove image registry e2e tests #2816
OCPBUGS-77403: test/e2e: improve prometheus remote-write test #2819
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-76594: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.12] #660
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-102136: Use patched x/net fork v0.35.0-sec.4 #446
Full changelog

cluster-samples-operator

OCPBUGS-63521: references to github.com/sclorg/django-ex.git now also refer to the branch #663
OCPBUGS-54913: add rhdmalone to owners #629
OCPBUGS-49664: add shannon and aroyoredhat as owners #600
Full changelog

cluster-storage-operator

OCPBUGS-102141: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #731
OCPBUGS-67444: Bump logrus to v1.8.3 #657
Full changelog

console

OCPBUGS-129171, OU-1589: Sanitize URLs in alert annotations #17434
OCPBUGS-133426: Stabilize legacy OperatorHub Cypress waits #17428
OCPBUGS-129171: Sanitize alert runbook URLs #17192
OCPBUGS-77114: [release-4.12] CVE-2026-26996 Bump minimatch library #16489
OCPBUGS-92663: CVE-2026-46597 openshift4/ose-console: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs [openshift-4.12.z] #16983
OCPBUGS-100520: Bump postcss to 8.5.26 to fix CVE-2026-45623 #17110
OCPBUGS-90615: Fix JSON annotation parsing to prevent OperatorHub crash #16660
Fix for OCPBUGS-92077: CVE-2026-44990 #16723
OCPBUGS-98415: CVE-2026-59869 #16756
OCPBUGS-87984: [release-4.12] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16594
OCPBUGS-120132: Fix JSON annotation parsing to prevent OperatorHub crash #17135
Fix for OCPBUGS-81593: CVE-2026-4800 #16570
OCPBUGS-88398, OCPBUGS-88416: Bump Axios to fix CVE-2026-44486. Requires a Patch of axios 0.33.0 types to be compatible with old version of TS #16793
OCPBUGS-79430: CVE-2026-29063 Bump immutable #16331
ART-18753: pin fsevents to latest #16482
NO-JIRA: enable multi-architecture yarn builds #16422
NO-JIRA: Updating openshift-enterprise-console-container image to be consistent with ART for 4.12 #12539
CONSOLE-5011: migrate to yarn berry #16084
NO-JIRA: Bump builder image to v29 #15988
OCPBUGS-74435: Bump lodash to latest #15973
OCPBUGS-44155: bump dompurify to latest #15595
OCPBUGS-57101: Add all files to vendor regardless of gitignore #15137
OCPBUGS-55210: Show Observe section without PROMETHEUS and MONITORING flags #14986
Dockerfile yarn line update #14838
Full changelog

console-operator

OCPBUGS-102152: Use patched x/net fork v0.35.0-sec.4 #1231
Updating openshift-enterprise-console-operator-container image to be consistent with ART for 4.12 #1137
OCPBUGS-77996: [release-4.12] NO-JIRA: update go mod dependency for konflux #1119
Full changelog

container-networking-plugins

ART-13080: Fix Hermeto build issues #198
Full changelog

coredns

OCPBUGS-59711: Bump github.com/golang/glog to v1.2.4 #151
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-79763: Apply code mitigations for CVE-2026-33186 #401
OCPBUGS-67448: CVE-2025-65637 #365
OCPBUGS-58889: CARRY: don’t ignore json files #345
Full changelog

csi-driver-manila-operator

OCPBUGS-102162: Use patched x/net fork v0.35.0-sec.4 #258
OCPBUGS-67449: Bump logrus #255
Full changelog

csi-driver-nfs

OCPBUGS-84927: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 to avoid go version bump and fix CVE-2026-33186 #186
Full changelog

csi-driver-shared-resource, csi-driver-shared-resource-webhook

OCPBUGS-102157: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #529
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-102179: Replace golang.org/x/net with github.com/openshift-sustaining/net v0.35.0-sec.3 #244
Full changelog

docker-builder

OCPBUGS-89733, OCPBUGS-90176, OCPBUGS-92261, OCPBUGS-92553, OCPBUGS-92668: Bump golang.org/x/crypto to fix CVE-2026-39831,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832,CVE-2026-39830 #546
OCPBUGS-43296: Bump buildah to 1.26.9 #449
OCPBUGS-43187: runc library bump to 1.1.12 #440
Full changelog

docker-registry

OCPBUGS-53652: bump jwt and oauth dependencies #442
Full changelog

driver-toolkit

OCPBUGS-63597: Remove realtime kernel from 4.12.z #176
Full changelog

gcp-cluster-api-controllers

OCPBUGS-78284: [release-4.12] hermetic migration 4.12 #278
OCPBUGS-78284: [release-4.12] hermetic migration 4.12 #271
Full changelog

gcp-machine-controllers

OCPBUGS-102202: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #196
OCPBUGS-83657: Address CVE-2026-33186 #174
OCPBUGS-78183: hermetic 4.12 #143
Full changelog

haproxy-router

OCPBUGS-86709: Strip X-SSL-* headers for plain HTTP #809
OCPBUGS-74943: Adding escapeHAProxySingleQuotes for sanitize [release-4.12] #784
OCPBUGS-78110: [release-4.12] hermetic 4.12 #744
Full changelog

hyperkube, pod

OCPBUGS-77661: Skip E2e: attach on previously attached volumes should work #2649
OCPBUGS-77469: hermetic 4.12 #2652
OCPBUGS-67374, OCPBUGS-67472: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 [4.12] #2596
OCPBUGS-78226: UPSTREAM: 133262: Remove permafailing tests using an expired GCP project #2625
Full changelog

hypershift

OCPBUGS-77768: fix vendor for hermetic 4.12 #7823
Updating ose-hypershift-container image to be consistent with ART for 4.12 #6976
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-79756: Bump google.golang.org/grpc to v1.79.3 #158
OCPBUGS-77214: [release-4.12] standardize build paths #128
OCPBUGS-58873: bump github.com/golang/glog to v1.2.4 #111
OCPBUGS-56067: tech debt: rework vendor patches #95
OCPBUGS-53908: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #88
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-102199: Use patched x/net fork v0.35.0-sec.4 #183
OCPBUGS-67476, OCPBUGS-67477: bump github.com/sirupsen/logrus to v1.8.3 #163
OCPBUGS-60058: [IBM VPC] set offlineExpansion to false in e2e test manifest #153
Full changelog

ibm-vpc-node-label-updater

OCPBUGS-56067: tech debt: rework vendor patches #52
OCPBUGS-53540: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #48
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-102194: Replace golang.org/x/net with openshift-sustaining/net #166
OCPBUGS-115549: Fetch envtest assets from the controller-tools releases #177
OCPBUGS-67292: [release-4.12] Fix incomplete vendor/ #134
Full changelog

ibmcloud-machine-controllers

OCPBUGS-102189: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 #110
OCPBUGS-78276: hermetic 4.12 #79
Full changelog

insights-operator

OCPBUGS-102197: Replace golang.org/x/net with github.com/openshift-sustaining/net v0.35.0-sec.3 to mitigate CVE-2026-33814 #1373
Full changelog

ironic

OCPBUGS-97988: bump openstack-ironic RPM for CVE-2026-44918 fix #930
OCPBUGS-69787: Bump eventlet version to 0.30.2-5 #767
Full changelog

ironic-agent

OCPBUGS-96903: Replace individual package removal with a single rpm -e loop #280
OCPBUGS-69778: adding eventlet 0.30.2-5 #236
Full changelog

ironic-machine-os-downloader

OCPBUGS-87168: CI Build root image tag and go version in go.mod sync with ART 4.12 #118
Full changelog

kube-proxy, sdn

OCPBUGS-56130: Handle openshift-host-network namespace as special when it modifies #657
Full changelog

kube-state-metrics

NO-ISSUE: synchronize OWNERS from main branch [release-4.12] #179
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-11). #231
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-95078: OWNERS: Update component to Cloud Compute / KubeVirt Provider #76
Full changelog

kubevirt-csi-driver

OCPBUGS-83660: Bump google.golang.org/grpc to v1.79.3 #110
Full changelog

machine-api-operator

OCPBUGS-102207: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #1551
OCPBUGS-78271: hermetic 4.12 #1470
Full changelog

machine-config-operator

OCPBUGS-77981: hermetic 4.12 #5734
OCPBUGS-58874: [release-4.12] Bump golang/glog to fix CVE-2024-45339 #5174
Full changelog

machine-image-customization-controller

OCPBUGS-102198: Replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #188
OCPBUGS-67478: bumped logrus to v1.9.3 #161
Full changelog

machine-os-images

OCPBUGS-87882: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #106
OCPBUGS-54173: Change rhcos release browser url #61
Full changelog

multus-admission-controller

OCPBUGS-60292: Bump github.com/golang/glog to v1.2.4 #107
OCPBUGS-60850: Update owners #109
Full changelog

multus-route-override-cni

OCPBUGS-78160: hermetic 4.12 #64
Full changelog

must-gather

OCPBUGS-48086: Update owners #477
Full changelog

network-metrics-daemon

-sOCPBUGS-59700:Bump github.com/golang/glog to v1.2.4 (#125) #125
Replace e2e test image (#134) #134
swtich golint install method (#133) #133
Correct 4.16 owners file (#131) #131
Full changelog

nutanix-machine-controllers

OCPBUGS-78158: hermetic 4.12 #132
OCPBUGS-51849: Fixing CVE-2025-22868 #121
OCPBUGS-47263: fixing CVE-2024-45338 #114
Full changelog

oauth-proxy

OCPBUGS-112091: bugfix: rewrite open redirect strings to ‘/’ #390
Full changelog

openshift-apiserver

OCPBUGS-90518: Address CVE-2026-35469 #663
OCPBUGS-76481: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.12] #614
OCPBUGS-79381: Fix image reference in TestImageStreamImportQuayIO #623
Full changelog

openshift-controller-manager

OCPBUGS-58296: Inconsistencies in dependencies are fixed #410
OCPBUGS-58157: Set node-pullsecrets volume to read-only to protect image pull credentials #403
OCPBUGS-57171: Empty proxy variables are causing issues during the build #389
OCPBUGS-49644: Add new team members to the OWNERS file #364
Full changelog

openshift-state-metrics

NO-ISSUE: synchronize OWNERS from main branch #155
OCPBUGS-102220: CVE-2026-33814 openshift4/ose-openshift-state-metrics-rhel8: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.12.z] #138
Full changelog

openstack-cinder-csi-driver-operator

OCPBUGS-67502: Bump logrus #191
Full changelog

operator-lifecycle-manager, operator-registry

OCPBUGS-102215: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #1371
OCPBUGS-87894, OCPBUGS-87897: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.64.1-sec.1 [release-4.12] #1383
OCPBUGS-86254: Drop github.com/distribution/distribution in go.mod #1312
OCPBUGS-61471: [release-4.12] Add NetworkPolicy as a supported kind #1054
OCPBUGS-61392: [4.12] e2e stability fixes #1087
Full changelog

operator-marketplace

OCPBUGS-49426: Upgrade golang.org/x/net [release-4.12] #591
Full changelog

ovirt-csi-driver-operator

OCPBUGS-67542: Bump github.com/sirupsen/logrus to v1.8.3 #148
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

CORENET-6055, OCPBUGS-84636: [release-4.12] Dockerfile: Unpin OVN and consume the latest from FDP #3075
OCPBUGS-59935: Dockerfile: Remove ovs version pinning #2698
NO-JIRA: Updating ose-ovn-kubernetes-container image to be consistent with ART for 4.12 #2092
OCPBUGS-55951: Bump ovn and ovs to latest 23.06 and 3.1 respectively #2554
OCPBUGS-50502: EgressIP: Reload certificates for the grpc heatlhcheck server #2457
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-67511: Fix CVE-2025-65637 by bumping logrus to v1.8.3 #102
Full changelog

powervs-machine-controllers

OCPBUGS-78043: hermetic 4.12 #138
OCPBUGS-54012: Fix for CVE-2025-30204 & CVE-2024-51744 in github.com/golang-jwt/jwt/v4 in release-4.12 #123
Full changelog

prom-label-proxy

NO-ISSUE: synchronize OWNERS from main branch [release-4.12] #408
Full changelog

prometheus

NO-ISSUE: synchronize OWNERS from main branch #388
OCPBUGS-88580: remote: validate snappy decoded length before allocation in read endpoint #356
OCPBUGS-86876: Bump google.golang.org/grpc #325
OCPBUGS-67512: CVE-2025-65637 Update sirupsen/logrus to 1.9.3 #291
Full changelog

prometheus-alertmanager

OCPBUGS-98171: bump github.com/hashicorp/memberlist to a forked version to fix CVE-2026-14362 #207
NO-JIRA: synchronize OWNERS with main #195
OCPBUGS-100365: Set testdata CA expiry to 20 years from issue date (#4112) #154
OCPBUGS-77906: Include go-verify-deps expected files in gitignore #124
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

NO-ISSUE: synchronize OWNERS from main branch #418
Full changelog

prometheus-node-exporter

OCPBUGS-102236: Use patched x/net fork v0.35.0-sec.4 #190
NO-ISSUE: synchronize OWNERS from main branch [release-4.12] #210
Full changelog

route-controller-manager

OCPBUGS-86881: [release-4.12] bump google.golang.org/grpc to v1.64.1-sec.1 #97
Full changelog

service-ca-operator

NO-JIRA: Updating ose-service-ca-operator-container image to be consistent with ART for 4.12 #360
Full changelog

telemeter

NO-ISSUE: synchronize OWNERS from main branch [release-4.12] #624
Full changelog

tests

OCPBUGS-132673: replace centos with ubi8 in build test dockerfile #31758
OCPBUGS-56120: [build] Ensure Git Clone Does Not Run Privileged #29788
OCPBUGS-37799: Disable:Broken for [sig-builds][Feature:Builds][Slow] can use private repositories as build input build using an HTTP token should be able to clone source code via an HTTP token #29621
OCPBUGS-54772: Component Readiness: [Networking / ovn-kubernetes] [EgressFirewall] test regressed #29662
OCPBUGS-54147: Add/remove team members to the OWNERS file for Builds #29622
OCPBUGS-52585: Use payload pullspec for image info test #29593
Full changelog

thanos

NO-ISSUE: synchronize OWNERS from main branch [release-4.12] #218
OCPBUGS-67525: CVE-2025-65637 Update sirupsen/logrus to 1.9.3 #169
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-78036: hermetic migration 4.12 #111
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-78026: hermetic migration 4.12 #90
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-67529: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #162
Full changelog

vsphere-csi-driver-operator

OCPBUGS-102278: Use patched x/net fork v0.35.0-sec.4 #363
OCPBUGS-67528, OCPBUGS-67534: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #327
Full changelog

vsphere-problem-detector

OCPBUGS-102283: Bump golang.org/x/net to v0.35.0-sec.4 #239
OCPBUGS-67540: bump github.com/sirupsen/logrus to v1.9.3 #204
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github