4.16.73

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.16.73-x86_64

Qualifiers (status api): None

Tests:

Blocking jobs
- upgrade Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Pending (2 retries) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-aws-ovn-serial
- aws-ovn-upgrade-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.16-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- aws-sdn-upgrade-4.16-micro Failed (1 retry) periodic-ci-openshift-release-main-nightly-4.16-e2e-aws-sdn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- azure-ovn-upgrade-4.16-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.16-e2e-azure-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.16-fips-payload-scan
- gcp-ovn-rt-upgrade-4.16-minor Succeeded periodic-ci-openshift-release-main-ci-4.16-upgrade-from-stable-4.15-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.16 Succeeded periodic-ci-openshift-hypershift-release-4.16-periodics-e2e-aws-ovn-conformance
- metal-ipi-ovn-ipv4 Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-metal-ipi-ovn-ipv4
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-metal-ipi-ovn-ipv6

Upgrades from:

Untested upgrades: 4.15.21, 4.15.22, 4.15.23, 4.15.24, 4.15.25, 4.15.27, 4.15.28, 4.15.29, 4.15.30, 4.15.31, 4.15.32, 4.15.33, 4.15.35, 4.15.36, 4.15.37, 4.15.38, 4.15.39, 4.15.40, 4.15.41, 4.15.42, 4.15.43, 4.15.44, 4.15.45, 4.15.46, 4.15.47, 4.15.48, 4.15.49, 4.15.50, 4.15.51, 4.15.52, 4.15.53, 4.15.54, 4.15.55, 4.15.57, 4.15.58, 4.15.59, 4.15.60, 4.15.61, 4.15.62, 4.15.63, 4.15.64, 4.15.65, 4.15.66, 4.16.10, 4.16.11, 4.16.12, 4.16.13, 4.16.15, 4.16.16, 4.16.17, 4.16.18, 4.16.19, 4.16.20, 4.16.21, 4.16.22, 4.16.23, 4.16.24, 4.16.25, 4.16.26, 4.16.27, 4.16.28, 4.16.29, 4.16.3, 4.16.30, 4.16.31, 4.16.32, 4.16.33, 4.16.34, 4.16.36, 4.16.37, 4.16.38, 4.16.39, 4.16.4, 4.16.40, 4.16.41, 4.16.43, 4.16.44, 4.16.45, 4.16.46, 4.16.47, 4.16.48, 4.16.49, 4.16.5, 4.16.50, 4.16.51, 4.16.52, 4.16.53, 4.16.54, 4.16.55, 4.16.56, 4.16.57, 4.16.58, 4.16.59, 4.16.6, 4.16.60, 4.16.61, 4.16.62, 4.16.63, 4.16.64, 4.16.65, 4.16.66, 4.16.67, 4.16.68, 4.16.69, 4.16.7, 4.16.8, 4.16.9

4.16.72 (changes) - F F F F F F F S
4.16.71 (changes) - Failed
4.16.70 (changes) - Success
4.16.42 (changes) - Failed
4.16.35 - Success
4.16.14 (changes) - Success
4.16.2 (changes) - Failed
4.16.1 (changes) - Failed
4.16.0 (changes) - Success
4.15.69 (changes) - F F F P
4.15.68 (changes) - Failed
4.15.67 (changes) - Success
4.15.56 (changes) - Failed
4.15.34 (changes) - Failed
4.15.26 (changes) - Success
4.15.20 (changes) - Success
4.15.19 (changes) - Failed
4.15.18 (changes) - Success
4.15.0-0.nightly-2026-09-15-112245 (changes) - Success

Upgrades to:

4.17.59 (changes) - Failed

Loading changelog, this may take a while ...

Changes from 4.16.35

Created: 2026-10-07 15:57:15 +0000 UTC

Image Digest: sha256:61a278c8cb8332bb2a11f65fe8273f449b72d4a0a34301fe7fd931c60faa384d

Components

Kubectl 1.29.7
Kubernetes upgraded from 1.29.11 to 1.29.14
Kubernetes Tests 1.29.0
Red Hat Enterprise Linux CoreOS upgraded from 416.94.202502111330-0 to 416.94.202610010305-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
StreamingCollectionEncodingToJSON (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
StreamingCollectionEncodingToProtobuf (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Removed images

ovirt-csi-driver
ovirt-csi-driver-operator
ovirt-machine-controllers

Rebuilt images without code change

alibaba-machine-controllers git 248372a4 sha256:0c0620025d7a97edfcdee3513ffe643ca4ad0d3e1f180693143f02fcfdb613ed
apiserver-network-proxy git ca81b6a3 sha256:de5b26985974960f7b10a19ccb2396daa82576525e39ac29abd41c1c689b2ef6
aws-ebs-csi-driver git 1d29a74a sha256:08d969cc76ee32a1900218340040d981746ab64af4c097f49566b9f236ec9c59
aws-kms-encryption-provider git c66065de sha256:6fc1917f1fb6c410edadfd768f08e447b331e89f44c9b080a04880f9a66edd9d
azure-disk-csi-driver git 6b55f6fb sha256:127167577b9263b4d0fcff965c48f69385e07692239e9a6f19f0eab226851258
cluster-bootstrap git 27bfb59f sha256:13c41260178d5b3fd9d3809561857abb2d1ef05358feb76d1d892b57219af689
cluster-capi-controllers git 5830a10a sha256:fa55794c9f7cd94a4e8981d33c3215468d5eccd516ea3d76240dd2235f69ca34
cluster-config-operator git 441d29c9 sha256:2f50a2f609a965b7206cd9143a9fd02b172f26370466067e05278e9be2128d67
cluster-control-plane-machine-set-operator git 14571e8a sha256:fb2ff112ffd9ecc9e6bcda669daf9318887cb19d509d6c5f75705ad4db46f76d
cluster-kube-cluster-api-operator git 95ceaa9e sha256:56b4edaf6f7e3924f41bf02f2e72c1609e93d071df6dd63f4666de2955b49e4e
cluster-machine-approver git 7685374f sha256:f73cd18509fc3e9ec36c43adecac5e52550c31e150eb3b534bb84ebb1e0c1fdd
cluster-openshift-controller-manager-operator git 2ed3cf99 sha256:c93ebef10e7eb67a7d6f624722e739fafd5dc1188468c52fcf0a9cdfe633bacc
cluster-policy-controller git eaea543f sha256:9daf1613fd99cc3385cb96c1067752373d8ab8e9852dd3172a0d1c6dc10d2e56
cluster-update-keys git e8478585 sha256:23fddaf071bd7c8d493bd04fd0f796afe389e569049bcee079bd5be20c4a9c5a
configmap-reloader git dc91ddc4 sha256:1b5992fad03fc5154f3dc18dbfcd1670a2faaca86e4e7578a4af374d278cacdf
csi-driver-manila-operator git c25d1ff2 sha256:41285d69e315badee001a6e294323e7fbde6ac1eef77f4a90c6ad75c4c039434
csi-driver-shared-resource git bc125def sha256:1ac46d99ad04046b12f909bb9d16dd6f0f580d99249883832e25c3a742f7cd1e
csi-driver-shared-resource-webhook git bc125def sha256:e0955770dbd5313811cab23306e8d1481dfc64fd9dd296bd9c922011e4bacc7f
csi-external-attacher git 7da80aab sha256:e2e2bf0dd4caebea0852eecc1f2208538da63847eb800051a2675038865942b3
csi-external-provisioner git 9e8af011 sha256:2ff2b25f709c23d4c3939aa45da22c0295d551b82a222f0e82a08e3a6195aaf2
csi-livenessprobe git f5e3ff55 sha256:1e93a15bd2f3a1a45507a81e8c2705b27fba8ddfc9706e72e4b00737a4717dc8
driver-toolkit git 1d5732f0 sha256:dd654817950d0bf88ae988eaf88acddced652f4d193727a8619ffce7bd90a457
egress-router-cni git 7089efe6 sha256:335f2bbb672a6659013f461ae8d468fc04b82ba1a812c918741db499d0bb5f1c
etcd git e7911c0d sha256:00abdf6d1e3dfe5a6a83456bcb8fa095eb1872dc9fa97209eb390cf3fbced38a
gcp-cloud-controller-manager git 26b43dfc sha256:b4fe6357875af3495f82628a277054064bce6131e7ee9863f20dedafe87ef71e
gcp-pd-csi-driver-operator git 799327f7 sha256:9ff1d2ad7af1484f2f497f52db6f5ef3dfff3e8130e8f783b2e33d2fbcbf90af
ibm-cloud-controller-manager git f961f16d sha256:e738b3842b17d47e43d66826a8ee39bdadf2ea4247f4ac4e6a08ffda73d05b13
ironic-machine-os-downloader git 93b8b5fa sha256:d482551a5b772d3d472d7ba2e13cbc46d6150b350c3eb31958d39e01648d1044
ironic-static-ip-manager git f44e8a08 sha256:c21702f8ca6bfc9d9b9de453225be949653e16881d8ebea767e315db5da8fa54
k8s-prometheus-adapter git e4f859be sha256:c4c977c707b130a627a2aa6ddb11dea54413a1fab2ee2bead60bf890315c6818
keepalived-ipfailover git b58673a3 sha256:8ed10b8cd11220c3aac863609a2d1d1cb9a71bad1e4b260ef468d23d2fa4a944
kube-rbac-proxy git c38f4734 sha256:a68435f2290730510f07ef2ad3d176776be81c2d8a460ec4c7de423f18c2c198
multus-networkpolicy git f988f894 sha256:c0168648487b4b1c6689b20335634477411914516f517e8742e9f09f0fd068be
multus-route-override-cni git 73594f77 sha256:1d132ee31020ee045582cff6a18da6302e7fd3e5175f53f40bcfbf0cbc9da262
nutanix-cloud-controller-manager git 28bf5963 sha256:bdfab6904237de9ca554a5f05ec8acdab5810db1e9ee2f29702f9ee3f31352c5
oauth-server git 3739138c sha256:bc869659872b5fda73c3b43c63c36025b9f968e80dfbbadb48693b2d2ad6bb9e
olm-operator-controller git 80b8649c sha256:cceecb5bf2d265e57390465278107676f95f92026075c3c25d4a0805d880de79
olm-rukpak git 282cc84c sha256:37ab499f2dcba1ccc081c1156e2d5c373b5859fb5539dc76e8130b9cda1d872f
openshift-state-metrics git 59b8a0ff sha256:b6e25d8ba946df3c0a907046c6e6b285a16b88587a4c42844550655f0a4d5a63
openstack-cinder-csi-driver-operator git 85b52097 sha256:60ff2d95fa4e6acbf6df99a77a915ff3770a9c3ac8bc4e605e04b2dd30321800
powervs-block-csi-driver-operator git 9c5dd8d1 sha256:9408a9e41f21d47e9329ca9cfb1877487a2820a588536cca4dd580c7c6fc1ac3
powervs-cloud-controller-manager git 20e6dc70 sha256:cb982aa186391cbbd585f7b84c31d022696d4f7844ea1cc9f64b605ecb611001
rhel-coreos sha256:f8e966380923eef6c2f2a72c840aadcec732049f5216c1cadf69721b250362f3
rhel-coreos-extensions sha256:07e7f1877873cdc812cde00787bcf8c249c51a7dfdf6451212afa36f2dbfdc33
service-ca-operator git 538c7b98 sha256:cdb6cee8d299fcc068d59a4495e9fabeddec746283f11a2aeea79bbea5bc7f3a
telemeter git c1ecd105 sha256:b3fde8866cece026591d1767f8af64261540873efb8d1a29028fc0fef348a02e
thanos git 85eee25c sha256:3bfa43e53ea60e1bd97ac0e2c3de46cb9555868ad17e5e4660a23a88cfa6d35b

agent-installer-api-server

OCPBUGS-89848: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.2 #10802
And 4 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-102901: Bump x/net to v0.35.0-sec.4 #2295
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-node-agent

OCPBUGS-102913: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #1616
run go mod tidy / vendor #1019
And 4 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-utils

OCPBUGS-68046: bump github.com/sirupsen/logrus to v1.9.3 #239
Full changelog

alibaba-cloud-controller-manager

OCPBUGS-102906: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #62
Full changelog

aws-cloud-controller-manager

OCPBUGS-88174: replace golang.org/x/net with sustaining fork v0.35.0-sec.4 #180
Full changelog

aws-cluster-api-controllers

🌱 OCPBUGS-123712: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #645
OCPBUGS-78227: [release-4.16] update go mod dependency for konflux #591
OCPBUGS-61942: UPSTREAM <carry>: revert: Only tag NetworkInterfaces in RunInstances if IAM Allows It #572
OCPBUGS-58666, OCPBUGS-58671: bump github.com/golang/glog to v1.2.5 #560
OCPBUGS-53726: Update golang-jwt to v4.5.2 #547
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator

OCPBUGS-102919, OCPBUGS-102939: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #608
OCPBUGS-64831: Use 127.0.0.1 for healtz http-endpoints #467
OCPBUGS-64768: Add RBAC ClusterRole and Binding for driver node #465
OCPBUGS-61253: add ability to control kube rbac proxy container image… #426
OCPBUGS-60598: Bump library-go #423
OCPBUGS-59606: Backport stale conditions fix #407
OCPBUGS-60248: add tag matching to Azure File storage class #414
Full changelog

aws-machine-controllers

OCPBUGS-73903: Fix reconciler consistency checks in Update and Exists #168
OCPBUGS-63140: client: re-use a single file for building the session instead of randomly named files #144
Full changelog

aws-pod-identity-webhook

OCPBUGS-52513: github.com/go-jose/go-jose/v4 v4.0.5 #203
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-79998, OCPBUGS-85635, OCPBUGS-85636: Bump google.golang.org/grpc to v1.79.3 #182
Full changelog

azure-cluster-api-controllers

OCPBUGS-78176: [release-4.16] update go mod dependency for konflux #364
Full changelog

azure-file-csi-driver

OCPBUGS-102923: Bump golang.org/x/net to v0.35.0-sec.4 #160
UPSTREAM: 3221: OCPBUGS-115466: Bump golang.org/x/crypto to v0.33.0-sec.5 #165
OCPBUGS-89335: Address CVE-2026-33186 #139
Full changelog

azure-kms-encryption-provider

OCPBUGS-79927: Bump google.golang.org/grpc to 1.64.1-sec.1 patch #48
OCPBUGS-53494: bump golang-jwt v4 #13
Full changelog

azure-machine-controllers

OCPBUGS-103039: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #215
OCPBUGS-66044: Set updateDomainCount to one when faultDomainCount is one #177
OCPBUGS-52476: Remove unused vnet package #131
OCPBUGS-56169: [release-4.16] Update virtualmachines service to armcompute/v5 SDK #147
OCPBUGS-56656: Fix failure when attempting to modify immutable availabilitySet #151
OCPBUGS-56092: Update eviction policy for Spot VMs from Deallocate to Delete #142
OCPBUGS-54990: Re-reconcile machine on NIC provisioning failure #137
OCPBUGS-50966: dynamically setting the amount of fault domains #129
Full changelog

azure-workload-identity-webhook

OCPBUGS-53798: github.com/golang-jwt/jwt/v4 v4.5.2 #33
OCPBUGS-52510: github.com/go-jose/go-jose/v4 v4.0.5 #29
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-89841, OCPBUGS-89843, OCPBUGS-89847, OCPBUGS-92760: Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.33.0-sec.4 #10924
OCPBUGS-127603: Update gcloud version to one that can be found #10918
OCPBUGS-67206: Update RHCOS-release-4.16 bootimage metadata to 416.94.202608150307-0 #10798
Revert “OCPBUGS-60668: Update RHCOS-release-4.16 bootimage metadata to 416.94.202601221345-0” #10846
OCPBUGS-60668: Update RHCOS-release-4.16 bootimage metadata to 416.94.202601221345-0 #10281
OCPBUGS-74885: Azure UPI ARM template: use storageAccountId #10282
OCPBUGS-76586: terraform/provider/google: Fixing GCP inconsistencies present with the service account creation #10298
OCPBUGS-73879: data/manifests/bootkube/cvo-overrides: Default to eus-4.16 #10226
OCPBUGS-54165: aws: fix NLB creation in secret regions #10031
OCPBUGS-53237: Validation for API and Ingress VIPs when using user-managed load balancer #10048
OCPBUGS-62952: Update the RHCOS 4.16 bootimage metadata #10022
OCPBUGS-62653: Release 4.16 bump terraform provider azurerm #9993
OCPBUGS-59162: vSphere - remove unit tests using nip.io #9835
OCPBUGS-62235: Make swift containers removal not fatal for UPI. #9961
OCPBUGS-58290: sort zone slices extracted from map of byo subnets #9819
OCPBUGS-55807: update resolv.conf every time on bootstrap node #9694
OCPBUGS-57460: vsphere - check if host is powered down or on standby before uploading template #9786
OCPBUGS-36677: Power VS: Enable incoming traffic on port 5000 during installation in a restricted network #8711
OCPBUGS-57498: ensure ctrplane nodes can access bootstrap MCS #9788
OCPBUGS-54240: Update timeout for GCP WaitFor operation #9715
OCPBUGS-35040: Power VS: Add ports needed for private clusters to security group #8546
OCPBUGS-54327: Remove error logging when determining image arch #9610
OCPBUGS-54345: Remove tmp directory used for agent pxe files #9611
OCPBUGS-54263: IBMCloud: Move to IBM TF openshift fork #9604
OCPBUGS-50547: aws/edge/byovpc: tag edge subnets with shared value #9482
OCPBUGS-52191: [release-4.16] capi/aws: bump provider for LB DNS lookup fix #9547
OCPBUGS-51207: Log correct hostname for validation status #9511
OCPBUGS-51111: PowerVS: destroy dhcp hack #9502
OCPBUGS-48762: Update RHCOS-release-4.16 bootimage metadata to 416.94.202501270445-0 #9478
OCPBUGS-43469: pkg/asset/installconfig/azure: send full certifcate chain #9467
Full changelog

baremetal-machine-controllers

OCPBUGS-78099: [release-4.16] fix vendor/ for hermetic migration 4.16 #243
Full changelog

baremetal-operator

OCPBUGS-77278: Unblock BMH direct deletion when detached annotation is present #463
OCPBUGS-53322: BMO can expose any secret via BMCEventSubscription CRD #407
Full changelog

baremetal-runtimecfg

OCPBUGS-60113: Re-add ENABLE_NODEIP_DEBUG env var #362
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-91215, OCPBUGS-91552, OCPBUGS-91589: Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.2 #2346
OCPBUGS-111894: Fix pre-existing unit test failures #2374
OCPBUGS-64616: Help with must-gather scheduling through suggesting preferance of nodes #2151
OCPBUGS-64561: Update go-jose, x/crypto, x/net #2144
OCPBUGS-59938: Adding sos.conf file for default sos config into the tools image #2064
OCPBUGS-60675: Use fedora image in unit tests instead of centos #2079
OCPBUGS-51043: Add HOST env var in oc debug for sos report collects more #1977
Full changelog

cloud-credential-operator

OCPBUGS-81849: Bump go-jose/go-jose/v4@v4.1.4 #1040
OCPBUGS-79941: Bump google.golang.org/grpc to v1.79.3 #1026
OCPBUGS-65802: ccoctl azure: retry custom role creation on consistency errors #952
OCPBUGS-63550: ccoctl: add public-key-file flag to create-all #940
OCPBUGS-55129: snyk to ignore SNYK-GOLANG-GOLANGORGXNETHTML-9572088 #918
OCPBUGS-60973: ccoctl: aws to use proper issuer url on subsequent runs #909
OCPBUGS-60861: ccoctl: only add owned tag to azure resources on create #902
OCPBUGS-58676: github.com/golang/glog v1.2.5 #893
OCPBUGS-56981: Azure: resolve nil pointer exception when role assignment exists #867
OCPBUGS-53416: github.com/golang/glog v1.2.4 #843
OCPBUGS-53822: update github.com/golang-jwt/jwt #839
OCPBUGS-51544: Ignore SNYK-GOLANG-GOLANGORGXOAUTH2JWS-8749594 due to not being affected #829
OCPBUGS-52512: github.com/go-jose/go-jose/v4 v4.0.5 #826
Full changelog

cloud-network-config-controller

OCPBUGS-66346: [release-4.16] Fix capacity calculation #195
OCPBUGS-65567: [release-4.16] Change the capacity struct from int to ptrOfInt #192
OCPBUGS-56359: Increase API call timeout to 30 second #172
Full changelog

cluster-authentication-operator

OCPBUGS-54655: Avoid duplicate OAuth client creation #766
Full changelog

cluster-autoscaler

OCPBUGS-78702: allow clusterapi provider to skip paused resources #415
OCPBUGS-60915: revert openshift replica fix #377
OCPBUGS-59267: Fix cool down status condition to trigger scale down #363
OCPBUGS-60609: fix checkpoint gc of unknown recommenders #372
OCPBUGS-54326: improve replica counting and decrease target size behavior #353
Full changelog

cluster-autoscaler-operator

OCPBUGS-102934: Bump x/net package in release-4.16 #390
OCPBUGS-52329: set max soft bulk taint count to zero #341
Full changelog

cluster-baremetal-operator

OCPBUGS-77447: Bump github.com/go-errors/errors to v1.5.1 #562
OCPBUGS-64741: Always have a service for ironic-api port #524
OCPBUGS-63417: Fix ironic inspector container privileges #513
OCPBUGS-61504: Remove webhookport (9447) as HostPort #506
OCPBUGS-54546: Add missing relatedObjects #470
Full changelog

cluster-capi-operator

OCPBUGS-79943: Bump google.golang.org/grpc to v1.79.3 #573
NO-JIRA: Allow sustaining engineering to self serve dependency updates #560
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-63168: ccm: disable unused secure-serving port and webhook #422
OCPBUGS-60387: Add Service using common resource templating #411
OCPBUGS-60387: Update service selector to match deployment label #410
Full changelog

cluster-config-api

CNTRLPLANE-1982: Promote streaming list encoding to Default #2600
OCPBUGS-71202: Add HTTPKeepAliveTimeout to IngressController API #2640
NO-JIRA: Promote streaming list encoding to Default on Hypershift. #2568
CNTRLPLANE-1611: Add feature gates for StreamingCollectionEncoding #2542
OCPBUGS-58392: Add IPsec API for NAT-T UDP encapsulation support #2393
OCPBUGS-56424: Add IdleConnectionTerminationPolicy field to IngressControllerSpec #2330
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-102965: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #291
Full changelog

cluster-dns-operator

OCPBUGS-52498: [release-4.16] Add runbook_url for CoreDNSErrorsHigh #431
Full changelog

cluster-etcd-operator

OCPBUGS-68058: Update logrus to 1.9.3 to address CVE-2025-65637 #1546
OCPBUGS-61505: Vendor latest mixin, including additional and modified alerts for etcdDatabaseQuotaLowSpace #1482
OCPBUGS-60836: add missing ports to svc and pod spec #1473
OCPBUGS-53510: fix CVE-2025-30204 #1403
Full changelog

cluster-image-registry-operator

OCPBUGS-68059: : Bump github.com/sirupsen/logrus to v1.9.1 #1285
OCPBUGS-53870: bump github.com/golang-jwt/jwt #1219
OCPBUGS-51600: bump golang.org/x/oauth2 #1210
OCPBUGS-51167: ensure that storage names don’t end in dashes #1181
Full changelog

cluster-ingress-operator

OCPBUGS-102952: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1573
OCPBUGS-86713: Add configuration override for X-SSL strip #1487
OCPBUGS-71202: Implement HTTPKeepAliveTimeout tuning option #1337
OCPBUGS-56424: Add e2e tests for IdleConnectionTerminationPolicy #1235
OCPBUGS-56424: Add support for IdleConnectionTerminationPolicy #1234
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-68064: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-rhel9-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.16.z] #2043
OCPBUGS-60467: Add missing service ports to apiserver service #1895
OCPBUGS-50575: Increase waitForFallbackDegradedConditionTimeout #1805
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-60834: Missing endpoint slices for open ports the operator uses #864
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #624
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-68069: Bump github.com/sirupsen/logrus to v1.9.1 #144
Full changelog

cluster-monitoring-operator

NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #3113
OCPBUGS-102945: [release-4.16] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #3090
OCPBUGS-77276: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2831
OCPBUGS-64581: Fix KSM deny-list typo #2733
OCPBUGS-64637: Add mcd_local_unsupported_packages metric from MCO to telemetry 4.16 #2735
OCPBUGS-62765: port metric acm_managed_cluster_worker_cores:max to OCP 4.16 #2719
OCPBUGS-63235: test: remove image registry e2e tests #2727
OCPBUGS-61856: chore(jsonnet): use prometheus_remote_storage_queue_highest_timestamp_seconds in PrometheusRemoteWriteBehind #2676
Full changelog

cluster-network-operator

OCPBUGS-67000: Re-disable metrics server #2855
OCPBUGS-63233: Manual feature backport of cert rotation for whereabouts #3040
OCPBUGS-84182: fix(hypershift): use net.JoinHostPort for URL construction #2981
OCPBUGS-75890: Tweak iptables-alerter to try to avoid crictl bug #2898
: NO-JIRA: Update CNO reviewers/approvers #2768
OCPBUGS-63155: Add drop flows for GARPs #2819
OCPBUGS-57354: block upgrade if a CNI migration is in progress #2760
OCPBUGS-62055: Update CNO reviewers/approvers #2803
OCPBUGS-44443: Add controlplane cli image envar for use with hypershift #2791
OCPBUGS-58392: Add IPsec API for NAT-T UDP encapsulation support #2736
OCPBUGS-56992: iptables-alerter streamlining #2717
OCPBUGS-56195: Fix live migration with feature migration configured explicitly #2710
OCPBUGS-53317: Fix feature migration for EgressIP #2673
OCPBUGS-52952: Unexpected Behavior During Cluster Upgrade for the ovn-ipsec-host pods #2663
[Release 4.16] OCPBUGS-50712: Not update status.migration of the network.config CR to empty #2651
OCPBUGS-51074: Update egressfirewall CRD to be consistent with ovn-kubernetes repo #2650
Full changelog

cluster-node-tuning-operator

OCPBUGS-82675: Bump github.com/moby/spdystream from v0.2.0 to v0.5.1 #1551
OCPBUGS-78766: [4.16] PPC: filter out namespaces dir #1466
Full changelog

cluster-olm-operator

OCPBUGS-86243: Update grpc-go to v1.67.3-sec.1 to fix CVE-2026-33186 #206
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-68072: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.16] #654
Full changelog

cluster-samples-operator

OCPBUGS-63516: references to github.com/sclorg/django-ex.git now also refer to the branch #659
OCPBUGS-55457: Adding mutex to func createSamples on handler.go #633
OCPBUGS-54420: add rhdmalone to owners #620
Full changelog

cluster-storage-operator

OCPBUGS-87613: remove oVirt code from CSO 4.16 #709
OCPBUGS-78769: Add patch permission to provisioner role #685
OCPBUGS-61252: add ability to control kube rbac proxy container image on controlplane #614
OCPBUGS-52353: fix Vsphere cluster Storage operator in Unavailable state #563
Full changelog

cluster-version-operator

OCPBUGS-58452: Failing=Unknown upon long CO updating #1213
OCPBUGS-55156: Fix a panic caused by a data race #1178
OCPBUGS-50590: Set openshift.io/required-scc: privileged annotation in version pods #1153
Full changelog

console

OCPBUGS-98424: CVE-2026-59869 bump js-yaml #17158
Fix for OCPBUGS-92076: CVE-2026-44990 #16719
OCPBUGS-100513, OCPBUGS-101789: Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss #17060
OCPBUGS-114417: Prevent binary secret data corruption when editing #17101
OCPBUGS-105793: Disable failing OLM and other e2e tests to unblock CI #16958
OCPBUGS-105796: Fix operator-hub e2e test by replacing unavailable Red Hat catalog source with Community #17081
OCPBUGS-87987: [release-4.16] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16599
OCPBUGS-81597: CVE-2026-4800 #16566
OCPBUGS-77123: [release-4.16] CVE-2026-26996 Bump minimatch library #16346
OCPBUGS-79439: Bump immutable #16657
OCPBUGS-88027: Fix JSON annotation parsing to prevent OperatorHub crash #16588
OCPBUGS-88377, OCPBUGS-88380, OCPBUGS-88412, OCPBUGS-88419, OCPBUGS-88444: CVE-2026-44495 #16612
OCPBUGS-88554: Stabilize legacy OperatorHub Cypress waits #16608
NO-JIRA: enable multi-architecture yarn builds #16417
OCPBUGS-83299: [release-4.16] openshift4/ose-console-rhel9: Axios: Remote Code Execution via Prototype Pollution escalation #16298
OCPBUGS-78673: Namespace is not persisting when switching to developer view from the topology page of admin page #16161
CONSOLE-5011: migrate to yarn berry #16078
OCPBUGS-76578: Bump axios #16032
NO-JIRA: Bump builder image to v29 #15993
OCPBUGS-74447: Bump lodash to latest #15967
OCPBUGS-69678: Disallowed Pipelines-plugin Pipelines navigation section #15857
OCPBUGS-64884: Remove required flag from ‘console.flag/model’ pipelines-plugin extension #15707
OCPBUGS-64649: /auth/error?error=missing_state&error_type=auth is showing blank page #15675
OCPBUGS-44157: bump dompurify to latest #15591
OCPBUGS-62123: Remove ancient X-XSS-Protection header #15528
OCPBUGS-61057: OpenShift console PVC clone cannot use B as the unit #15450
OCPBUGS-60175: Tolerate unknown fields in Infrastructur… #15368
OCPBUGS-60641: Secret key with binary file changes when edited via Console #15417
OCPBUGS-59869: Not able to launch terminal window from OCP web console due to console plugin conflicts #15334
OCPBUGS-57677: Update the golang.org/x/crypto/ssh to 0.31.0 in the openshift-console image #15328
OCPBUGS-60115: Cannot read properties of undefined (reading ‘node-role.kubernetes.io/master’) error while accessing node logs from console #15358
OCPBUGS-59358: fix bug where / in console.tab/horizontalNav href brea… #15286
OCPBUGS-37603: Manual backport of several incremental fixes for unauthenticated endpoints #15312
OCPBUGS-59274: Add the ability to launch multiple modals with useModal hook #15276
OCPBUGS-59445: Cannot read properties of undefined (reading ‘filter’) error while accessing nodes from console. #15291
OCPBUGS-58407: Add flags in console static plugin for all the components of this epic #15243
OCPBUGS-56838: Fetching taskRuns in PLR details page using PLR UID also #15099
OCPBUGS-58188: Fix TypeError Cannot read properties of null (reading ‘metadata’) #15214
OCPBUGS-57326: Remove logoutOpenShift method call #15172
OCPBUGS-57270: Debug pod logs are not accessible when debugging a node via OpenShift Console #15165
OCPBUGS-57096: Add all files to vendor regardless of gitignore #15133
OCPBUGS-57089: Sample segment sessions #15130
OCPBUGS-56858: remove 60 day alert from cluster update modal #15102
OCPBUGS-56715: update the Deployment pod on change in imageStream #15091
OCPBUGS-56472: Remove the devconsole backend common internet proxy and replace it with dedicated ones #15072
OCPBUGS-55378: Do not load CSRs if user does not have permissions #15000
OCPBUGS-55644: fix bug where operator appears twice #15016
OCPBUGS-45142: Add missing pipelines plugin name to known plugins #14550
OCPBUGS-48628: Added token to proxy header #14693
OCPBUGS-54174: Update the monitoring topic used by the console team #14900
OCPBUGS-52450: fix run time error when no completed version exists #14840
OCPBUGS-52851: Show Observe section without PROMETHEUS and MONITORING flags #14849
OCPBUGS-52288: While upgrading the cluster from UI observed Warning alert:Admission Webhook Warning #14821
OCPBUGS-49409: ERROR in search tool: Cannot read properties of undefined (reading ‘state’) #14703
OCPBUGS-52418: While accessing the node terminal from UI observed ‘Warning alert:Admission Webhook Warning` #14837
OCPBUGS-49979: Set default build option as BUILDS for Builder Image sample #14730
OCPBUGS-49800: Fix Function Import: An error occurred Cannot read properties of undefined (reading ‘filter’) #14715
OCPBUGS-49801: use default StorageClass for ServerlessFunction pipelineVolumeClaimTemplate #14716
OCPBUGS-46388: fix alert rule link #14808
OCPBUGS-52252: Fix alert rule link to alert in dev perspective #14817
OCPBUGS-46441: Do not pass CSV name to operand list page when an exen… #14627
OCPBUGS-36963: Manually create an API token for a ServiceAccount #14057
OCPBUGS-35394: sessions: fix sessions pruning #13969
Full changelog

console-operator

OCPBUGS-102982: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #1225
OCPBUGS-77992: update go mod dependency for konflux #1115
OCPBUGS-60794: Update downloads deployment configuration to use master node selector #1036
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-85669: CI Build root image tag sync with ART #234
OCPBUGS-55648: Check error returned by ipv6 SettleAddresses #188
Full changelog

coredns

OCPBUGS-77463: Modify .gitignore to not exclude vendor build folders #168
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-79978: Bump google.golang.org/grpc #389
OCPBUGS-68080: fix CVE-2025-65637 #361
OCPBUGS-58884: CARRY: don’t ignore json files #341
Full changelog

csi-driver-nfs

OCPBUGS-84931: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.67.3-sec.1 to avoid go version bump and fix CVE-2026-33186 #182
Full changelog

csi-driver-shared-resource-operator

OCPBUGS-102984: Bump golang.org/x/net to v0.35.0-sec.3 #128
Full changelog

csi-external-resizer

OCPBUGS-102985: Bump golang.org/x/net to v0.35.0-sec.4 #215
OCPBUGS-62465: Requeue PVC over PV creation #174
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-60450: UPSTREAM: 1238: Snapshot Controller startup should not LIST all volumesnapshots #186
Full changelog

csi-node-driver-registrar

OCPBUGS-64632: update log level verbosity to not clutter logs #91
Full changelog

docker-builder

OCPBUGS-89824, OCPBUGS-90269, OCPBUGS-92346, OCPBUGS-92576, OCPBUGS-92768: Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 #553
OCPBUGS-65907: BuildConfig inline Dockerfile fails with heredoc syntax #489
OCPBUGS-58074: S2I build cpu limits observed by assemble are limited to 1 cpu #475
OCPBUGS-53076: Upgraded Kubernetes dependency from 1.28.2 to 1.29.0 #468
OCPBUGS-42893, OCPBUGS-42914: buildah dependency bump to fix - Buildah allows arbitrary directory mount and symlink traversal vulnerability in the containers/storage library #450
Full changelog

docker-registry

OCPBUGS-60183: bump openshift/docker-distribution #441
OCPBUGS-53654: bump jwt and oauth dependencies #432
OCPBUGS-49696: bump docker distribution #423
Full changelog

gcp-cluster-api-controllers

OCPBUGS-78280: [release-4.16] update go mod dependency for konflux #267
Full changelog

gcp-machine-controllers

OCPBUGS-103045: Bump golang.org/x/net to v0.35.0-sec.3 #191
OCPBUGS-79970: Bump google.golang.org/grpc to v1.79.3 #167
OCPBUGS-79970: [release-4.16] Fix setup-envtest GCS 401 by downloading binaries directly #176
OCPBUGS-55249: Disable shielded VMs for non-UEFI disks #116
Full changelog

gcp-pd-csi-driver

OCPBUGS-68087: Update logrus to 1.9.3 #92
Full changelog

haproxy-router

OCPBUGS-86713: Strip X-SSL-* headers for plain HTTP #805
OCPBUGS-79960: Bump google.golang.org/grpc to v1.79.3 #769
OCPBUGS-56424: Add support for IdleCloseTerminationPolicy #655
OCPBUGS-49391: Reject All CA-Signed Certs Using SHA1 #651
Full changelog

hyperkube, pod

OCPBUGS-68041, OCPBUGS-68091: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 [4.16] #2582
OCPBUGS-74299: Skip E2e: attach on previously attached volumes should work #2568
OCPBUGS-65694: Fix Concurrentmap Iteration #2519
CNTRLPLANE-1612: Backport StreamingCollectionEncoding for JSON and protobuf #2485
OCPBUGS-61908: UPSTREAM: <carry>: Don’t retry storage calls with side effects. #2470
OCPBUGS-60553: [4.16]: podresources: list: use active pods #2454
4.16: OCPBUGS-60872: UPSTREAM: 127757: scheduler: Improve CSILimits plugin accuracy by using VolumeAttachments #2435
OCPBUGS-60272: Bump nfs server provisioner #2402
OCPBUGS-58054: UPSTREAM: 130047: adjusting loopback certificate validity in kube-apiserver #2342
OCPBUGS-58054: UPSTREAM: <carry>: disable some legacy cloud provider Azure tests #2352
OCPBUGS-57290: UPSTREAM: <carry>: Bump cadvisor version to fix kubelet #2325
OCPBUGS-49906: Bump k8s api to 1.29.14 #2211
Full changelog

hypershift

OCPBUGS-33097: [release-4.16] fix(api): remove deprecated OVNSbDb service type #9820
OCPBUGS-120748: update Containerfile.cli base images to floating tags [release-4.16] #9560
OCPBUGS-99075: fix(backport): konnectivity agent auth #9097
OCPBUGS-84182: fix(cno): use brackets only for IPv6 in server URL #8348
OCPBUGS-76534: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7704
OCPBUGS-74375, OCPBUGS-74376: Support proxy authentication when user/pass is included in URL #7578
OCPBUGS-73118: Fix Konflux EC voilation, update deprecated base … #7459
OCPBUGS-63640: [release-4.16] fix(konnectivity): resolve circular dependency causing DNS timeouts and excessive retries #7113
OCPBUGS-64680: Update DNS names for ovn-kubernetes cp metrics #7158
CNTRLPLANE-1904: Migrate 4.16 pipelines to common pipeline template #7212
CNTRLPLANE-1426: feat(konflux): tag MCE HO images with latest #6839
OCPBUGS-61252: dont use registryOverrides on kube rbac proxy image be… #6756
OCPBUGS-61582: Update KCM node monitor grace period #6797
OCPBUGS-61860: Use the common MCE konflux pipeline #6844
OCPBUGS-60150: Always compress and encode payload in token secret for inplace upgrades #6750
OCPBUGS-60951: MCE 2.6 konflux hcp cli #6701
CNTRLPLANE-1203: HO MCE change to hermetic ta build #6654
CNTRLPLANE-1231: Move CPO pipeline to hermetic builds #6599
OCPBUGS-58505: [release-4.16] Add missing service network DNS entries to KAS cert #6393
OCPBUGS-57494: Add proxy variables for the MCD Pod #6286
OCPBUGS-55697: Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs #6114
CNTRLPLANE-919: Konflux build pipeline service account migration #6087
CNTRLPLANE-919: Konflux build pipeline service account migration #6082
OCPBUGS-51804: Fix golang crypto dependency go.mod replacement #5994
OCPBUGS-54914: Add konnectivity-proxy sidecar to openshift-oauth-apiserver #6026
OCPBUGS-54632: Sync RBAC for attaching volumes on VM level #5998
OCPBUGS-49914: Reconcile proxy CA bundle into hosted cluster #5983
OCPBUGS-53902: bump golang-jwt v4 and v5 #5907
Red Hat Konflux update control-plane-operator-4-16 #5957
ART-11792: update go mod dependency for konflux #5922
OCPBUGS-51733, OCPBUGS-51804: Bump dependencies to OCP fork in backports #5901
OCPBUGS-53308: fix(deps): bump go-jose #5866
OCPBUGS-52506: refactor aws identity health check into new controller #5781
OCPBUGS-52857: Make managed-trust-bundle optional #5809
OCPBUGS-52426: change plaform to platform #5773
OCPBUGS-50993: Honor proxy vars in the util insecure http client #5662
OCPBUGS-46466: Consistently look up and dial cloud API hostnames #5301
OCPBUGS-50698: add region to AWS creds passed to operators managed by CPO #5670
OCPBUGS-51296: 4.17 Add HostedCluster additional trustbundles to konnectivity-https-proxy #5707
NO-JIRA: chore(deps): update dependency mkdocs-material to v9.6.5 #5686
OCPBUGS-50694: OCPBUGS-50692: Fix IsIPv4 function identifying also addresses instead of CIDRs #5620
NO-JIRA: chore(deps): update dependency mkdocs-material to v9 #5635
OCPBUGS-50557: Prevent IgnitionServer from flooding the API server with patch requests #5599
NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1739267472 #5597
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-79964: Bump google.golang.org/grpc to v1.79.3 #145
OCPBUGS-77210: [release-4.16] standardize build paths #124
OCPBUGS-58737: bump github.com/golang/glog to version v1.2.4 #106
OCPBUGS-56063: tech debt: rework vendor patches #91
OCPBUGS-53910: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #84
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-59727: [IBM VPC] set offlineExpansion to false in e2e test manifest #149
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-103009: Replace golang.org/x/net with openshift-sustaining/net #170
OCPBUGS-115544: Fetch envtest assets from the controller-tools releases #181
OCPBUGS-67288: [release-4.16] Fix incomplete vendor/ #138
OCPBUGS-51818: CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork #109
Full changelog

ibmcloud-machine-controllers

OCPBUGS-103003: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 #106
NO-JIRA: fix unit tests broken by deprecated kubebuilder-tools bucket #113
Full changelog

insights-operator

OCPBUGS-68370: Add filtering to add other possible pod status to QEMU gatherer #1200
OCPBUGS-67009: QEMU logs are not gathered if there are pending status virt-launcher pods #1197
And 5 elided commits (e.g. from squash or rebase merges)
Full changelog

ironic

OCPBUGS-85333: update ironic-image commit hash to address CVE-2026-43003 #912
OCPBUGS-100162: bump openstack-ironic pin for CVE-2026-44918 fix #908
OCPBUGS-104459: bump openstack-ironic pin for CVE-2026-54423 fix(release-4.16) #877
OCPBUGS-76457: Bump pyasn1 to 0.5.1-4 #828
OCPBUGS-69789: Bump eventlet version to 0.33.1-7 #763
METAL-1306: Do not use openstack packages #648
Full changelog

ironic-agent

OCPBUGS-85333: Update ironic-python-agent commit hash to address CVE-2026-43003 #316
OCPBUGS-99890: Bump ironic-python-agent pinned commit for CVE-2026-66138 #310
OCPBUGS-95070: Replace individual package removal with a single rpm -e loop #288
OCPBUGS-95070: Replace dnf remove with rpm -e to prevent dependency removal #276
OCPBUGS-61165: netutils: Use ethtool ioctl to get permanent mac address #215
OCPBUGS-69781: Bump eventlet version to 0.33.1-7 #232
METAL-1306: Do not use openstack packages #180
Full changelog

kube-metrics-server

NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #85
OCPBUGS-79929: Bump google.golang.org/grpc to v1.79.3 #66
Full changelog

kube-proxy, sdn

OCPBUGS-54457: Drop SYNACK as well in MCS side #658
OCPBUGS-44674: Handle openshift-host-network namespace as special when it modifies #648
OCPBUGS-46493: Raise the minSyncPeriod for NetworkPolicies to 10s during migration #649
Full changelog

kube-state-metrics

NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #192
OCPBUGS-74875: Deduplicate CRS stores #133
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-16). #227
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-95082: OWNERS: Update component to Cloud Compute / KubeVirt Provider #82
Full changelog

kubevirt-csi-driver

OCPBUGS-79930: Bump google.golang.org/grpc to v1.79.3 #108
OCPBUGS-54632: Ensure volume stays attached through reboots #57
OCPBUGS-44622: During detach don’t return error if VM is not found #49
Full changelog

libvirt-machine-controllers

OCPBUGS-77196: Fix incomplete vendor/ #302
OCPBUGS-26525: Updating ose-libvirt-machine-controllers-container image to be consistent with ART for 4.16 #283
Full changelog

machine-api-operator

OCPBUGS-103044: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #1547
OCPBUGS-98439: Use resource group when generating default Azure image #1516
OCPBUGS-76849: bumped logrus to v1.9.3 #1463
OCPBUGS-57210: Updates GCP CredentialsRequest #1378
OCPBUGS-55248, OCPBUGS-55249: Updates GCP credentials request #1355
OCPBUGS-53045: add image/read permissions #1348
OCPBUGS-52342: Drop oVirt support #1336
Full changelog

machine-config-operator

OCPBUGS-98960: Remove sensitive ControllerConfig logging #6315
OCPBUGS-98253: Bootstrap MCS logging entire ignition #6290
OCPBUGS-62171: Fix - NetworkManager restart or crash renders br-ex unusable #5354
OCPBUGS-60113: Enable debug logging for nodeip-configuration #5218
OCPBUGS-77253: Machine-config controller should not log about non-existent pull-secret changes #5694
OCPBUGS-77184: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5685
OCPBUGS-63155: [release-4.16] Networking: reset ovn-remote config and allow ovnkube controller to set it #5359
OCPBUGS-60773: scope MCD node listers to current node #5260
OCPBUGS-63553: Add control-plane label for master nodes on legacy clusters #5376
OCPBUGS-57423: pkg/operator/status: Drop PoolUpdating as an Upgradeable=False condition #5119
OCPBUGS-63332: Recheck generatedByControllerVersion annotation prior to deleting a degraded MC #5364
OCPBUGS-56753: Support NODEIP_HINT in IPI deployments too #5079
OCPBUGS-62689: Add mcd_local_unsupported_packages recording rule #5328
OCPBUGS-59931, OPNET-681: Support migration to NMState #5205
OCPBUGS-61869: Override NMState service definition #5290
OCPBUGS-60621: Add workaround fix for static pod race #5252
OCPBUGS-56558: Log CRC MC deletion #5178
OCPBUGS-58270: Do not set cpu system reserve below the default value #5163
add missing vendors #4952
OCPBUGS-48283: Do not run resolv-prepender from NM dispatcher #4784
OCPBUGS-56868: daemon: fix ostree-finalize-staged race workaround for package mode RHEL workers #5090
OCPBUGS-56626: error from generateAndValidateRenderedMachineConfig function can be misleading #5075
OCPBUGS-54831: Make mtu-migration run after wait-for-primary-ip #4990
OCPBUGS-55684: MSBIC should not update windows machinesets #5028
OCPBUGS-35921: userCA and cloudCA certfiicates are not removed from nodes and ignition config #4419
OCPBUGS-53248: Enforce VIPs to be collocated at the same host #4923
OCPBUGS-53043: Enable nmstate-configuration on all platforms #4910
OCPBUGS-52952: Add ipsec connect wait service #4931
OCPBUGS-54163: Fixing typos for MachineConfigNode #4942
OCPBUGS-53434: Update ObservedGeneration in KubeletConfig #4935
OCPBUGS-53313: daemon: ensure ostree-finalize-staged is started before rebooting #4928
OCPBUGS-52421: Update format verbs for alert logs #4901
OCPBUGS-51347: Update the storage.conf configuration file template #4881
OCPBUGS-52593: Update cluster-reader ClusterRole permissions #4905
OCPBUGS-52404: create /run/nodeip-configuration before use #4897
OCPBUGS-52310: configure-ovs workaround for ovs-if-br-ex bug #4892
OCPBUGS-50862: Auto-recover from MC with invalid extension #4853
OCPBUGS-43680: Regenerate the rendered MC in use when deleted #4655
Full changelog

machine-image-customization-controller

OCPBUGS-68093: [4.16] uplift logrus #153
Full changelog

machine-os-images

OCPBUGS-87878: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #102
OCPBUGS-54169: Change rhcos release browser url #57
Full changelog

monitoring-plugin

NO-JIRA: [release-4.16] Sanitize alert runbook URLs #1292
Fix for OCPBUGS-113514: CVE-2026-18446 #1184
Fix for OCPBUGS-94001: CVE-2026-13676 #1049
Fix for OCPBUGS-90069 OCPBUGS-90073: CVE-2026-12151 CVE-2026-9697 #1007
OCPBUGS-79441: immutable bump #898
OU-1260: [release-4.16] feat: use npm instead of yarn #813
OCPBUGS-76807: fix for CVE-2025-69873 #849
OCPBUGS-54316: Fix “Export as CSV” #469
Full changelog

multus-admission-controller

OCPBUGS-58767: Update the github.com/golang/glog module to v1.2.4 #103
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-85251: Fix server url in kubeconfig #300
NO-ISSUE: [release-4.16] Bump Go to 1.21 and fix CI build root image #292
OCPBUGS-47472: adds getcontext (backport 4.16) #261
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-70215: Prevent accidental IP deallocation in statefulsets #396
OCPBUGS-55618: Fixes leftover podref issue #365
OCPBUGS-50005: [Release-4.17]Kubeconfig loop #340
Full changelog

must-gather

OCPBUGS-86218: Collect object size with the object count #550
OCPBUGS-66106: Separate resources with comma to fix malformed inspect #515
OCPBUGS-42960: Gather OSUS data #455
OCPBUGS-48082: Update owners #473
Full changelog

network-interface-bond-cni

OCPBUGS-61348: Bump github.com/containernetworking/plugins from to 1.7.1 #95
NO-JIRA: Updating ose-network-interface-bond-cni-container image to be consistent with ART for 4.16 #91
NO-JIRA: Add ci-operator.yaml file on release-4.16 #84
Full changelog

network-metrics-daemon

OCPBUGS-58777: Bump github.com/golang/glog to v1.2.4 (#113) #113
OCPBUGS-60186: Replace e2e test image (#122) #122
swtich golint install method (#123) #123
Full changelog

network-tools

add missing go vendors #140
Full changelog

nutanix-machine-controllers

OCPBUGS-51854: CVE-2025-22868 #110
OCPBUGS-47266: fixing CVE-2024-45338 #93
Full changelog

oauth-apiserver

OCPBUGS-74112: UPSTREAM: <carry>: bump kubernetes-apiserver to pick up loopback cert expiration update #166
NO-JIRA: (chore): update OWNERS file #172
Full changelog

oauth-proxy

OCPBUGS-61446: Update x/crypto to v0.31.0 #335
OCPBUGS-62707: Fix oauth-proxy e2e-component tests #338
Full changelog

olm-catalogd

OCPBUGS-103064: [release-4.16] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #149
Full changelog

openshift-apiserver

OCPBUGS-82682: Address CVE-2026-35469 #649
OCPBUGS-68104: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.16] #610
OCPBUGS-74113: UPSTREAM: <carry>: bump kubernetes-apiserver to pick up loopback cert expiration update #595
OCPBUGS-63394: Wire dry run option to Image API server operations #566
OCPBUGS-61474: Skip blocked registry check for registries with mirrors #552
OCPBUGS-56612: Fix image reference in TestImageStreamImportQuayIO #516
Full changelog

openshift-controller-manager

OCPBUGS-61707: legacy image pull secret rollback controller #416
OCPBUGS-60233: ignore error failing to find pull/push secrets #409
OCPBUGS-57513: Set node-pullsecrets volume to read-only to protect image pull credentials #394
OCPBUGS-56354: Empty proxy variables are causing issues during the build #382
Full changelog

openstack-cluster-api-controllers

OCPBUGS-58028: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.16 #346
Full changelog

openstack-machine-api-provider

OCPBUGS-78170: hermetic 4.16 #163
OCPBUGS-76794: Fix make test #155
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-103065, OCPBUGS-103070, OCPBUGS-103078: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1367
OCPBUGS-79980, OCPBUGS-79981, OCPBUGS-87898: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.67.3-sec.1 [release-4.16] #1318
OCPBUGS-82057: Drop github.com/distribution/distribution dep #1302
OCPBUGS-77959: Remove the collect-profiles info from the microshift kustomization file #1251
OCPBUGS-77169: Remove the collect-profiles job #1235
OCPBUGS-58881: operatorgroup: ensure clusterroleselectors in clusterrole aggregation rules are sorted #1102
OCPBUGS-59647: Reduce Frequency of Update Requests for Copied CSVs (#3597) #1042
OCPBUGS-60847: Add NetworkPolicy as a supported kind #1050
OCPBUGS-61388: [4.16] e2e stability fixes #1083
OCPBUGS-57429: reduce cache expiry frequency [release-4.19] #1022
OCPBUGS-56358: fix(olm): improve error logging for missing olm.managed label (#3558) #1006
OCPBUGS-53395: Ensure that PSA label is latest instead of pinning versions #987
Full changelog

operator-marketplace

OCPBUGS-68108, OCPBUGS-68109: CVE-2025-65637 fixed in logrus v1.9.3+ #722
OCPBUGS-62220: Remove Expect func so that the test case can use the retry logic #671
OCPBUGS-61920: Update memoryTarget on catalog source pods #664
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-128828: node: fix serviceUpdateNotNeeded nil pointer comparison #3497
OCPBUGS-83497: External gateway: Remove routes for external gateway pods in terminating or not ready state #3140
OCPBUGS-78033: Add pperiyasamy to OWNERS for release-4.16 #3047
OCPBUGS-77685: Clear stale conntrack UDP entries for nodePorts #3038
OCPBUGS-77187: Fix conntrack reconciliation to use service port instead of endpoint port #2998
CORENET-6055, OCPBUGS-76277: [release-4.16] Dockerfile: Unpin OVN and consume the latest from FDP #2972
OCPBUGS-71219: [release-4.16] CVE-2025-65637 Bump github.com/sirupsen/logrus to v1.9.1 through indirect dependency conversion (go-controller module) #2906
OCPBUGS-72541: NetPol & MultiNetPol: Process update only when spec fields and/or related annotation are updated #2933
OCPBUGS-68349: Add ricky-rav to OWNERS for release-4.16 #2899
OCPBUGS-66155: Skip Pending pods in EgressIP status updates #2880
OCPBUGS-64944: [release-4.16]: Configure sec nic EIPv6 address with NODAD and maximum lifetime #2853
OCPBUGS-64858: Fix stale EIP assignments during failover and controller restart #2851
OCPBUGS-63155: Fix EgressIP stale GARP post reboot + pod restart #2809
OCPBUGS-63230: Fix dnsnameresolver address set #2812
OCPBUGS-60079: Always enable global IPv6 forwarding #2743
OCPBUGS-60494: Update OWNERS file: Add Patryk/Martin as approvers #2718
OCPBUGS-58161: Unpin OVS patch versions #2648
OCPBUGS-57396: Fix predicate for cluster subnet route to gateway router #2645
OCPBUGS-55282: Fix hybrid overlay node subnets collision with cluster subnets #2621
OCPBUGS-48121: Increase InformerSyncTimeout to 60s #2624
OCPBUGS-56242: Handles unspecified protocol in network policy port #2571
OCPBUGS-56812: egressfirewall: avoid nil dereference on node delete #2591
OCPBUGS-52503: Fixes unexpected mp0 route removal during start up #2479
OCPBUGS-54204: Update OVN to FDP25.A.1 24.03.5-40. #2497
OCPBUGS-50595: kubevirt, localnet: Reduce live migration downtime #2469
OCPBUGS-50594: fixes overzealous deletion of SNAT in egressIP #2456
Full changelog

powervs-block-csi-driver

OCPBUGS-105268: Mitigate CVE-2025-30204 by bumping github.com/golang-jwt/jwt/v4 to v4.5.2 #139
Full changelog

powervs-machine-controllers

OCPBUGS-61511: Use OS_GIT_VERSION in Makefile when found (for Konflux builds) #127
OCPBUGS-54752: Fix for CVE-2024-51744 in github.com/golang-jwt/jwt/v4 in release-4.16 #114
Full changelog

prom-label-proxy

NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #404
Full changelog

prometheus

NO-ISSUE: synchronize OWNERS from main branch #387
OCPBUGS-88616: remote: validate snappy decoded length before allocation in read endpoint #349
OCPBUGS-79985: Bump google.golang.org/grpc #321
OCPBUGS-61856: chore: compute highestTimestamp at queryManager level #270
OCPBUGS-56739: BACKPORT: fix promtool analyze block shows metric name with 0 cardinality #255
OCPBUGS-54942: Scraping: Bump cache iteration after error to avoid false duplicate detection. #250
Full changelog

prometheus-alertmanager

NO-JIRA: synchronize OWNERS with main #188
OCPBUGS-103072: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #174
OCPBUGS-100357: Set testdata CA expiry to 20 years from issue date (#4112) #146
OCPBUGS-76536: Include go-verify-deps expected files in gitignore #116
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-103085, OCPBUGS-103089: [release-4.16] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #401
Full changelog

prometheus-node-exporter

NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #203
Full changelog

route-controller-manager

OCPBUGS-79934: Bump google.golang.org/grpc to v1.79.3 #87
OCPBUGS-56152: Added error event for failed ingress to route conversion #61
OCPBUGS-55201: ingress: Reset metrics when ingress is deleted #58
Full changelog

tests

OCPBUGS-105460: Use tagged version for openshift/kubernetes dependency #31541
OCPBUGS-74299: Update to latest openshift/kubernetes #30825
OCPBUGS-63395: Backport pr 29834 to release-4.18 #30409
OCPBUGS-62934: Fix bearer token exposure in exit condition as well #30365
OCPBUGS-61170: images/tests: Remove rteval #30203
NO-JIRA: Update extended/networking OWNERS #30091
OCPBUGS-60272: Bump kubernetes version to fix NFS ganesha version #30086
OCPBUGS-57311: Replace RunHostCmd with Exec function to censor bearer token being exposed #29908
OCPBUGS-57203: fix: remove un-needed test #29849
OCPBUGS-34163: Fix regex parser for censoring private key #29805
OCPBUGS-56704: aws/edge: prevent test using unschedulable nodes #29847
OCPBUGS-55476: support provider type external #29738
OCPBUGS-55636: [build] Ensure Git Clone Does Not Run Privileged #29746
OCPBUGS-54768: Fix egress firewall tests by updating the URL from docs.openshift.com to redhat.com #29663
OCPBUGS-52581: Use payload pullspec for image info test #29589
OCPBUGS-52343: Try also user CA for getting openshift-tests image #29578
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-78028: hermetic migration 4.16 #107
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-78020: hermetic migration 4.16 #86
OCPBUGS-61653: Fix unit tests #72
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-86874: Bump google.golang.org/grpc #182
OCPBUGS-68119: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #158
Full changelog

vsphere-csi-driver-operator

OCPBUGS-103111: Bump golang.org/x/net to v0.35.0-sec.3 #358
OCPBUGS-51206: Set reconcile-sync to 10 minute for ListVolume #294
Full changelog

vsphere-problem-detector

OCPBUGS-103110: Bump golang.org/x/net to v0.35.0-sec.4 #235
OCPBUGS-86445: fix concurrent map writes #219
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github