# 5.0.0-ec.2
Created: 2026-05-26 17:04:00 +0000 UTC
Image Digest: `sha256:895c32b0edf279081a551fc2bce516d7a0cc25d56897a06da8c4a7b8f1496c28`
## Changes from 5.0.0-ec.1
### Components
* Kubectl 1.35.2
* Kubernetes 1.35.3
* Kubernetes Tests 1.35.1
* Red Hat Enterprise Linux CoreOS 10.2 upgraded from 10.2.20260423-0 to 10.2.20260513-0
### FeatureGate Changes
| FeatureGate | Default
Hypershift | Default
SelfManagedHA | DevPreviewNoUpgrade
Hypershift | DevPreviewNoUpgrade
SelfManagedHA | OKD
Hypershift | OKD
SelfManagedHA | TechPreviewNoUpgrade
Hypershift | TechPreviewNoUpgrade
SelfManagedHA |
| :------ | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: |
| ConsolePluginContentSecurityPolicy
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| DRAPartitionableDevices
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| KMSEncryptionProvider
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| RouteExternalCertificate
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| EVPN
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| MutatingAdmissionPolicy
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| OLMLifecycleAndCompatibility
(0 tests)| | | | Enabled
(New)| | | | Enabled
(New) |
### New images
* [aws-node-termination-handler](https://github.com/openshift/aws-node-termination-handler) git [341ed3a0](https://github.com/openshift/aws-node-termination-handler/commit/341ed3a086925b17671c5349343fedf988a1139e) `sha256:bef5260e2c3658a8a31ecb9ced13d4c98834747c3943f74e63679662a02006d6`
### Rebuilt images without code change
* [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws) git [43906c28](https://github.com/openshift/cloud-provider-aws/commit/43906c280e2abaf3f182ff178ef73d554cbd98cf) `sha256:ce46d60e2fe489fd98afd96e0eba05c48f16595f1799c97fb0ab7b9c7271fd29`
* [aws-karpenter-provider-aws](https://github.com/openshift/aws-karpenter-provider-aws) git [f0be9c72](https://github.com/openshift/aws-karpenter-provider-aws/commit/f0be9c72e5bf25caeb2ca45c14e67e4d397a52cb) `sha256:a45d3edcb8ac9851a00ae58f065a1ebd6bbf8c7a853a399f609fe960576952ee`
* [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook) git [82088287](https://github.com/openshift/aws-pod-identity-webhook/commit/8208828799b6c4f91fd9b80128668f7765599e84) `sha256:0ee66b71b1c832a6e06fd8f0615cd1d708a8505ce749e66f0af95722e0a846ac`
* [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver) git [b66940c2](https://github.com/openshift/azure-file-csi-driver/commit/b66940c2459bdd503270d758e92057c89b798c6d) `sha256:46d4ed17c72362d15bbcc2b64fb385977b3b0ee1cd7ec49aa036a623c5e942cf`
* [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure) git [db9b10d2](https://github.com/openshift/machine-api-provider-azure/commit/db9b10d2674def615be44d4bf385acb699c47ad2) `sha256:559b2dd64a6914ed60faabbf94ba4ceaa9efda576c35a332840ee6dd25503ccf`
* [azure-service-operator](https://github.com/openshift/azure-service-operator) git [0827c1fb](https://github.com/openshift/azure-service-operator/commit/0827c1fb110ea136fc7abb7b3ac8be062335d00d) `sha256:1e2f9159160d28155d6ca0067f91c066e9673c10cf5383157a9a50eff1170dfe`
* [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal) git [8d863b95](https://github.com/openshift/cluster-api-provider-baremetal/commit/8d863b9505a5cfc0b01e33f985a3edf9d3c69f4b) `sha256:cba17c638eeebc68b557be007dc6241be73d44db73256817bf04fbc44c0c0169`
* [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller) git [2d69ad95](https://github.com/openshift/cloud-network-config-controller/commit/2d69ad953cfaa419e9b6221da9edb152ded91e0b) `sha256:49915e0294719255bd783b2ed67f6b4821790389a5f3870de31b3aed9079c7d1`
* [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator) git [260ea1b5](https://github.com/openshift/cluster-autoscaler-operator/commit/260ea1b5967f47768a0727e8c84d451dc9de5ced) `sha256:e52076c36ba70ea134e7a7682b085d48ca87299fd59ea2d5da69c6dee37f1c5b`
* [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator) git [108f37f0](https://github.com/openshift/cluster-csi-snapshot-controller-operator/commit/108f37f0e378accc322cbeb68136ec500ec35b94) `sha256:d8cd8cf263f142c1653ff3bc18f6ad807db6dcae35759cdaacba907838048c44`
* [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator) git [3d214118](https://github.com/openshift/cluster-dns-operator/commit/3d2141182243cde1ec6417bd005c76d29aa88a01) `sha256:50df1969df8ebcfb9733ac4683051f9a4dae3b3742a0073962cd0994c7f2ffcf`
* [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator) git [a0495853](https://github.com/openshift/cluster-kube-scheduler-operator/commit/a0495853f80d38e19d07b98a225e1aa0e7972ac9) `sha256:df95a5c6ec0c42704a51a7d70a56a2641fa3533f5c7bfa985af396a37d8acfde`
* [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator) git [c941a99d](https://github.com/openshift/cluster-openshift-controller-manager-operator/commit/c941a99dd2b9200c0de23606c4372d33d656a756) `sha256:3c33a999c73255632fddf55a47a473f77db44dcac6b1c2e3c26af33882b6e454`
* [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller) git [bb429f5b](https://github.com/openshift/cluster-policy-controller/commit/bb429f5b2a7d77791110b06d8ec5c017183e3ab9) `sha256:334c62d8ce8d8da7789a3367c235d4cbfab29bf25246e47c47e1fa93cd1de53b`
* [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator) git [0bfb6b3c](https://github.com/openshift/cluster-samples-operator/commit/0bfb6b3c2f558c9098c438082bffb44eb8f07099) `sha256:0fd5df7a7a2f2c365e59c44d0b3b46e42d827cff0f614fd1b072335a7f223965`
* [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator) git [8dfdf2ef](https://github.com/openshift/cluster-storage-operator/commit/8dfdf2ef3310358f3559a5481df43b98b2294791) `sha256:181755ceaabe80215c2e1b973d032132feaaddb7cff4d3832c4afaa1332cead7`
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [3b5c59cc](https://github.com/openshift/cluster-update-keys/commit/3b5c59cc6461663751bc510b4f9f1954ed8c9b50) `sha256:807199b29b07811100f953fe50abae0499da7492f00459ecb4d43728aceb97c2`
* [configmap-reloader](https://github.com/openshift/configmap-reload) git [94e41c4c](https://github.com/openshift/configmap-reload/commit/94e41c4c6a5832dfd19750173d6544784ba235ec) `sha256:7cc7ce408e19de47595596f1e7ee9de8dff6112c1242a8e2e23e287ba7504be5`
* [container-networking-plugins](https://github.com/openshift/containernetworking-plugins) git [747ad66c](https://github.com/openshift/containernetworking-plugins/commit/747ad66caa1109b2b490aebad01af42bd2d738f1) `sha256:1db1cc8f5535dddb7843578256b0f7acecc0d01331f4002ff4dbd5343d4a4bcf`
* [containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins) git [747ad66c](https://github.com/openshift/containernetworking-plugins/commit/747ad66caa1109b2b490aebad01af42bd2d738f1) `sha256:07a060bd86ada655d2d1872528ee67779b9f11fb05c45eb7e2b760f7ce1c6f6b`
* [coredns](https://github.com/openshift/coredns) git [0dded2d2](https://github.com/openshift/coredns/commit/0dded2d232dab43c107b1dab9d0d9fdfd8259622) `sha256:b0ba4204d533ef88359e60d61a4e42ecd07c4bfa0d256572c5bebb131708245b`
* [csi-external-attacher](https://github.com/openshift/csi-external-attacher) git [98b1f4ac](https://github.com/openshift/csi-external-attacher/commit/98b1f4acf9c004687ef55e9f187703768933bb56) `sha256:d9b7c2ead4e2c07cfe0a62beddfc33c72df0b22c91adbd94663f0fbd03ccbfc7`
* [csi-external-resizer](https://github.com/openshift/csi-external-resizer) git [4e74a4aa](https://github.com/openshift/csi-external-resizer/commit/4e74a4aa52a2046d6b97a47dff7a60ddb73d0bbd) `sha256:8bfd5d44089ce06694225c160965c31f1ec16a4df579573396136a1ed1331e74`
* [csi-external-snapshot-metadata](https://github.com/openshift/csi-external-snapshot-metadata) git [76523185](https://github.com/openshift/csi-external-snapshot-metadata/commit/7652318579a38838931a5be492cee3573c7c8ecf) `sha256:99b6edcb31e01969b3faf39c1592556205b7931afd30aeebe530f4d894faa4f8`
* [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe) git [4d5e959a](https://github.com/openshift/csi-livenessprobe/commit/4d5e959a182b4db70dc52302bd89eebfec40d5a5) `sha256:509d7a8ec1af159fb21c1774400dfd3cc739c00e8df41b6587d21f8de795bd60`
* [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar) git [cf174b30](https://github.com/openshift/csi-node-driver-registrar/commit/cf174b30fad107d354afb0f0b09030a7c97fd296) `sha256:fbe866baf0feb1d0d1cce365812c91260bbba600fe24ba52785a27961bef7424`
* [docker-builder](https://github.com/openshift/builder) git [fcd4ce2d](https://github.com/openshift/builder/commit/fcd4ce2d96613a27bd1ab7f53ff47225976c4ba9) `sha256:cb276a90fb2938bc7bac5716fcf51ed13ac27ffb14758e2072f026a8fcb41703`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [7aa4007a](https://github.com/openshift/driver-toolkit/commit/7aa4007a8601bf4bb23b696f580c022f58877223) `sha256:3a46d2aa5a5b28fdb6f14a1a497010e7dd81d10e60513cda81a45bafaf315a94`
* [egress-router-cni](https://github.com/openshift/egress-router-cni) git [d37f51e0](https://github.com/openshift/egress-router-cni/commit/d37f51e057620bdee564f68dcfde955acf033d3e) `sha256:ab823c6aeb3022e393309093c1a3cd957beaf21e4d9b2bb926e6d139898eec6e`
* [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp) git [065e2b60](https://github.com/openshift/machine-api-provider-gcp/commit/065e2b608a027ba47fce02aaabb986e6c650e6d6) `sha256:fc0be9ce80a7ab086bed4bb602dbba5c3ef3efb8baa1128945f5f8409626c427`
* [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook) git [d7675f31](https://github.com/openshift/gcp-workload-identity-federation-webhook/commit/d7675f312ffdc8501032ff8217776cd7172b6bb0) `sha256:4cd49db2d5a19f9c650cc2fe752dc7d5b044162bc81a7d6f541c6db6431c1515`
* [insights-runtime-exporter](https://github.com/openshift/insights-runtime-extractor) git [70256457](https://github.com/openshift/insights-runtime-extractor/commit/70256457b507ec09737800ee7ea022143ed6c3c2) `sha256:03f92983f3474641967334c90c7abff41f27bdd8e99e86433b7d0aff23206d0f`
* [insights-runtime-extractor](https://github.com/openshift/insights-runtime-extractor) git [70256457](https://github.com/openshift/insights-runtime-extractor/commit/70256457b507ec09737800ee7ea022143ed6c3c2) `sha256:8f0b26a14db013b1517f4e5df33ea7527df697799981151b2cee070b157e11cd`
* [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [9953d2b7](https://github.com/openshift/ironic-rhcos-downloader/commit/9953d2b77da077c28f9486a5d965a43149ce30c1) `sha256:88f2c05bdc347c034d5ebe4b1c4e20f822b830a24202bc23e1e92f9f51ad48ea`
* [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager) git [a379d09f](https://github.com/openshift/ironic-static-ip-manager/commit/a379d09f228d93f2beab1c73d67764c64b21e3cb) `sha256:7f8bfe532ba9941861826e92fd9ce730f9f6b5028b181865eec91bf067f4591b`
* [keepalived-ipfailover](https://github.com/openshift/images) git [edb8b1e6](https://github.com/openshift/images/commit/edb8b1e6c5e949c0b470b2bdf7a32f17e53d2f71) `sha256:d861fd360eeddb9bb9a08c499209522c885cfdc4cd7fd89a1f718826ea025d0f`
* [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server) git [38c16c46](https://github.com/openshift/kubernetes-metrics-server/commit/38c16c4698d131ab0e2da0d4b4b76d5322a89bab) `sha256:35daed97a2d279f2543334cfb209f81be440e423042cc7dae6784985d71f2f8d`
* [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy) git [d12e2746](https://github.com/openshift/kube-rbac-proxy/commit/d12e274605248f6c59373240a7eae7a7a357dcb3) `sha256:0d6a1c6ebba722e09ff2850010cb8114a8d097ccee1198c1f59680c8c7581d48`
* [kube-state-metrics](https://github.com/openshift/kube-state-metrics) git [6fa06eac](https://github.com/openshift/kube-state-metrics/commit/6fa06eac4c3942ba64bff18ca93b5a019ea5c976) `sha256:ad7ae7a3c499ed390a36ae17acd5251aa2a5a3833cd4144d1976f4d2b968b654`
* [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator) git [72835e43](https://github.com/openshift/kubernetes-kube-storage-version-migrator/commit/72835e43c7754356645e41031f3a99926b4d42e6) `sha256:dc781a7a52c12bda5feebaedc9e0e705666c7e8e5520342e0c2f3d0bf4b0ba2c`
* [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt) git [76dd5a6f](https://github.com/openshift/cloud-provider-kubevirt/commit/76dd5a6fa9e86573bf3dfb79be17edf832e3bae1) `sha256:eeb410e2af9c743505a4cf904b7296f851c8ab8d00cfb7795213446a951687d0`
* [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver) git [771b562d](https://github.com/openshift/kubevirt-csi-driver/commit/771b562d4875296007850a4d3709a7ae1c6ed3e2) `sha256:dde909ccd162e61ea68bae1104fd47756387b300ce955801e059bcffdaeb594b`
* [machine-image-customization-controller](https://github.com/openshift/image-customization-controller) git [a43d9c97](https://github.com/openshift/image-customization-controller/commit/a43d9c977f6332577efcd383cf173a2ff5805a4d) `sha256:72af4105ea106bec420a8e5d62968a2165d3c36a8441e549cbcda8f9e9cd84ec`
* [multus-cni](https://github.com/openshift/multus-cni) git [b4ec7d82](https://github.com/openshift/multus-cni/commit/b4ec7d8239ce4bd3ed949bce9816a013377b44c7) `sha256:50465a05c60d3e1bee7fc9b80c9188d29772d00f83b5a0951545f26b7facb733`
* [multus-cni-microshift](https://github.com/openshift/multus-cni) git [b4ec7d82](https://github.com/openshift/multus-cni/commit/b4ec7d8239ce4bd3ed949bce9816a013377b44c7) `sha256:93dbdd59d85e2231e196d72da79450a884eb12d324fa81dc25b59a3869e8d24d`
* [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy) git [43b16450](https://github.com/openshift/multus-networkpolicy/commit/43b16450b76093cd33da339fd9b9c246a619d340) `sha256:b83d21ab01df5c7e86b03731efc569b09618a58e2956ddc8c0724a738e61ebd6`
* [multus-route-override-cni](https://github.com/openshift/route-override-cni) git [08af4127](https://github.com/openshift/route-override-cni/commit/08af4127c77976510cad1c096d9aca977d8ae5af) `sha256:14d752fbbcdac7c8f1a1da446814bf088fa84bb8c82139d0dfe3dc7afd346be8`
* [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni) git [d691040e](https://github.com/openshift/whereabouts-cni/commit/d691040e509bb20c26b5e8366c0d6f3bb45a5e02) `sha256:57e000a57a6cd8b9a7a5331b83de64c1da95b0ff25d45bf101979bc6ddfabcaf`
* [network-interface-bond-cni](https://github.com/openshift/bond-cni) git [297eeb43](https://github.com/openshift/bond-cni/commit/297eeb4320e07b18d559bc373b665479c760e8c7) `sha256:39bb71be0913b8633b1b100be4a04c3fe35a0d721e443ace9bfd517063203701`
* [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon) git [5b233ea1](https://github.com/openshift/network-metrics-daemon/commit/5b233ea1d80733c1b00c6bad65dec0620dbf783a) `sha256:af731f36e1120cf31505dabe68ef9f0d44870e81479d190a36e5198c5a9c3169`
* [oauth-proxy](https://github.com/openshift/oauth-proxy) git [714292f5](https://github.com/openshift/oauth-proxy/commit/714292f5478e6c12da6a31710f72bc8fbe6fb925) `sha256:44f67040e9fdec4e3de546c9de80b2dd0f0560b5253eeee392d0c6b5cd3c7372`
* [oauth-server](https://github.com/openshift/oauth-server) git [3aa95c07](https://github.com/openshift/oauth-server/commit/3aa95c0715e812e17378bd78b223287ea6fb41f0) `sha256:bf08c7a05913805d5659283840cd48a90647fd2885203bb06c17c71b25b0fd62`
* [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics) git [e71e0996](https://github.com/openshift/openshift-state-metrics/commit/e71e09969f11a47c87b87c43b762ad1d01f6b04f) `sha256:d929032320fbd48942ffb7be3149aaa085b9ee9c1d253ee7ceeeacb6c6f46773`
* [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack) git [8a8c354b](https://github.com/openshift/machine-api-provider-openstack/commit/8a8c354b99ce83e3c05a91358aadec09944c2fce) `sha256:ddfe15f0826050902d78b1793d838b9773bf62d5e86efd697c1d6ab27feb0362`
* [prometheus-node-exporter](https://github.com/openshift/node_exporter) git [b1b5423f](https://github.com/openshift/node_exporter/commit/b1b5423ff3cea86d7f7be9e5f739aaf61df75cdc) `sha256:acec7a35ba736689009c0e1cca62af79f798881559863d18ce4852dca3fb346f`
* [rhel-coreos](https://github.com/openshift/os) git [f41264dc](https://github.com/openshift/os/commit/f41264dc5f1c1f0a389787ecc5aaec573d485b8e) `sha256:6ab9e6f018c1c80b305b458e1fb2332b2d4915a69ba3fa9b152611f9e9f30de3`
* [rhel-coreos-extensions](https://github.com/openshift/os) git [f41264dc](https://github.com/openshift/os/commit/f41264dc5f1c1f0a389787ecc5aaec573d485b8e) `sha256:ce31d167d3a748dea9f7a2123f3b907b86ac09695e3e0a310aa707b52e56d93e`
* [route-controller-manager](https://github.com/openshift/route-controller-manager) git [624742d9](https://github.com/openshift/route-controller-manager/commit/624742d93f3a7885cf7f70985f1e23ff60da580d) `sha256:fd6ff7bd02e0710990e4f9905e09a77405e5df84843356fe10d9d679f7a272df`
* [thanos](https://github.com/openshift/thanos) git [5d9d0f38](https://github.com/openshift/thanos/commit/5d9d0f387e5cc651470f27352b28674103bfdd77) `sha256:2fccecc05848fe02d19c5a93f290d09c88d15c1e41f7e92955b837dba2aae720`
* [volume-data-source-validator](https://github.com/openshift/volume-data-source-validator) git [8e176cec](https://github.com/openshift/volume-data-source-validator/commit/8e176cec394709cac728423cbbb6c3c914be8485) `sha256:7e856c368341444816faa10d3aabce48d8b155aae44c61b8b35d79281ef20649`
### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/963e8a7fb9f6941969fab42a72e7197b3b636a3c)
* NO-ISSUE: increase the timout waiting for assisted-image-service [#10327](https://github.com/openshift/assisted-service/pull/10327)
* [MGMT-20634](https://issues.redhat.com/browse/MGMT-20634): Revert mac-identifier and global DNS workarounds as RHEL-91250 and RHEL-72440 resolved [#10318](https://github.com/openshift/assisted-service/pull/10318)
* [ACM-33836](https://issues.redhat.com/browse/ACM-33836): CVE-2026-35469 bump github.com/moby/spdystream [#10314](https://github.com/openshift/assisted-service/pull/10314)
* NO-ISSUE: [master] Bump OCP versions: 4.22, 4.13, 4.16, 4.17 [#10296](https://github.com/openshift/assisted-service/pull/10296)
* NO-ISSUE: [master] Bump OCP versions: 4.21, 4.20, 4.18, 4.19 [#10287](https://github.com/openshift/assisted-service/pull/10287)
* [MGMT-19930](https://issues.redhat.com/browse/MGMT-19930): upgrade PostgreSQL stack to pgx v5 and ocm-sdk-go v0.1.499 [#10230](https://github.com/openshift/assisted-service/pull/10230)
* NO-ISSUE: [master] Bump OCP versions: 4.21 [#10284](https://github.com/openshift/assisted-service/pull/10284)
* [MGMT-24236](https://issues.redhat.com/browse/MGMT-24236): Exclude post-installation hosts from pending-user-action timeout [#10266](https://github.com/openshift/assisted-service/pull/10266)
* [MGMT-24138](https://issues.redhat.com/browse/MGMT-24138): Order network by bootstrap host [#10257](https://github.com/openshift/assisted-service/pull/10257)
* NO-ISSUE: Remove unused RegisterAddHostsOCPCluster functions [#10265](https://github.com/openshift/assisted-service/pull/10265)
* NO-ISSUE: [master] Bump OCP versions: 4.16, 5.0, 4.22 [#10272](https://github.com/openshift/assisted-service/pull/10272)
* [MGMT-24119](https://issues.redhat.com/browse/MGMT-24119): Correct the namespace to install Loki Operator as "openshift-operators-redhat" instead of "openshift-loki" [#10209](https://github.com/openshift/assisted-service/pull/10209)
* [MGMT-23755](https://issues.redhat.com/browse/MGMT-23755): Validate & trim MCS certificates when adding to ignition override [#10262](https://github.com/openshift/assisted-service/pull/10262)
* NO-ISSUE: [master] Bump OCP versions: 4.21, 4.19 [#10263](https://github.com/openshift/assisted-service/pull/10263)
* [MGMT-23680](https://issues.redhat.com/browse/MGMT-23680): CVE-2026-32285 Bump github.com/buger/jsonparser to v1.1.2 [#10240](https://github.com/openshift/assisted-service/pull/10240)
* NO-ISSUE: Update operator bundle channel to backplane-5.0 [#10215](https://github.com/openshift/assisted-service/pull/10215)
* [MGMT-24115](https://issues.redhat.com/browse/MGMT-24115): allow empty image checksum/url in getChecksumAndURL [#10246](https://github.com/openshift/assisted-service/pull/10246)
* [MGMT-23971](https://issues.redhat.com/browse/MGMT-23971): Add a timeout for installing-pending-user-action [#10202](https://github.com/openshift/assisted-service/pull/10202)
* NO-ISSUE: Modify Konflux YAMLs to backplane-5.0 [#10237](https://github.com/openshift/assisted-service/pull/10237)
* [MGMT-23802](https://issues.redhat.com/browse/MGMT-23802): Fix manifest format in log bundles [#10121](https://github.com/openshift/assisted-service/pull/10121)
* [MGMT-23861](https://issues.redhat.com/browse/MGMT-23861): Fix oci detection for day2 clusters [#10231](https://github.com/openshift/assisted-service/pull/10231)
* NO-ISSUE: [master] Bump OCP versions: 4.22 [#10220](https://github.com/openshift/assisted-service/pull/10220)
* [ACM-33186](https://issues.redhat.com/browse/ACM-33186): Revert Renovate configuration for Hive updates [#10203](https://github.com/openshift/assisted-service/pull/10203)
* [MGMT-23553](https://issues.redhat.com/browse/MGMT-23553): Automate events table bloat cleanup [#10140](https://github.com/openshift/assisted-service/pull/10140)
* [MGMT-23665](https://issues.redhat.com/browse/MGMT-23665): fixing CVE-2026-33186 [#10173](https://github.com/openshift/assisted-service/pull/10173)
* NO-ISSUE: Allow restoring soft deleted hosts [#10185](https://github.com/openshift/assisted-service/pull/10185)
* NO-ISSUE: [master] Bump OCP versions: 4.20, 4.21, 4.22, 4.18 [#10201](https://github.com/openshift/assisted-service/pull/10201)
* NO-ISSUE: Bump go modules and linters [#10181](https://github.com/openshift/assisted-service/pull/10181)
* [MGMT-23861](https://issues.redhat.com/browse/MGMT-23861): Revert MGMT-22385 for oci iscsi day2 [#10170](https://github.com/openshift/assisted-service/pull/10170)
* [ACM-32996](https://issues.redhat.com/browse/ACM-32996): Missing nil check in BMACReconciler causes controller panic [#10164](https://github.com/openshift/assisted-service/pull/10164)
* [MGMT-23920](https://issues.redhat.com/browse/MGMT-23920): 4.22 SNO doesn't support 4 cpu cores node [#10153](https://github.com/openshift/assisted-service/pull/10153)
* NO-ISSUE: add shay23bra to owners [#10163](https://github.com/openshift/assisted-service/pull/10163)
* NO-ISSUE: [master] Bump OCP versions: 4.13, 4.19 [#10162](https://github.com/openshift/assisted-service/pull/10162)
* NO-ISSUE: Remove urlAuth from credentials endpoint [#10161](https://github.com/openshift/assisted-service/pull/10161)
* [MCO-2223](https://issues.redhat.com/browse/MCO-2223): Add osImageStream install-config overrides [#10156](https://github.com/openshift/assisted-service/pull/10156)
* NO-ISSUE: [master] Bump OCP versions: 4.21 [#10152](https://github.com/openshift/assisted-service/pull/10152)
* NO-ISSUE: [master] Bump OCP versions: 4.22, 4.18, 4.20 [#10146](https://github.com/openshift/assisted-service/pull/10146)
* [OCPBUGS-79576](https://issues.redhat.com/browse/OCPBUGS-79576): Mark raw FC/iSCSI multipath members as ineligible [#10142](https://github.com/openshift/assisted-service/pull/10142)
* [OCPBUGS-83401](https://issues.redhat.com/browse/OCPBUGS-83401): Fix IRI patcher feature check [#10141](https://github.com/openshift/assisted-service/pull/10141)
* [MGMT-23227](https://issues.redhat.com/browse/MGMT-23227): Skip host operator validation for day2 clusters [#10029](https://github.com/openshift/assisted-service/pull/10029)
* [ACM-32735](https://issues.redhat.com/browse/ACM-32735): Add better API docs to CRDs [#10124](https://github.com/openshift/assisted-service/pull/10124)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/assisted-service/compare/aed50cb7f9a7dd63dd865dfae9afb6844a2dd787...963e8a7fb9f6941969fab42a72e7197b3b636a3c)
### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/28bc267a6a5fce13f43126fde48df3427a838e11)
* [MGMT-23784](https://issues.redhat.com/browse/MGMT-23784): CVE-2026-34986 Bump github.com/go-jose/go-jose/v3 to v3.0.5 using replace directive [#2121](https://github.com/openshift/assisted-installer/pull/2121)
* NO-ISSUE: Modify Konflux YAMLs to backplane-5.0 [#2119](https://github.com/openshift/assisted-installer/pull/2119)
* [ACM-33186](https://issues.redhat.com/browse/ACM-33186): Revert Renovate configuration for Hive updates [#2107](https://github.com/openshift/assisted-installer/pull/2107)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/25a3eed7bd6649a73ca7c3c54d897eb656837d0c...28bc267a6a5fce13f43126fde48df3427a838e11)
### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/c64bacd536b2d79c8e54bbdf184ec8385f408f29)
* NO-ISSUE: Modify Konflux YAMLs to backplane-5.0 [#1431](https://github.com/openshift/assisted-installer-agent/pull/1431)
* [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/1d8f70bbfd57b2b11fe6558edbe7df7675e0ed6d...c64bacd536b2d79c8e54bbdf184ec8385f408f29)
### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/2ef405f56aec6459310d63b3fa8b035d6fd040f6)
* [OCPBUGS-85524](https://issues.redhat.com/browse/OCPBUGS-85524): update konflux references [#286](https://github.com/openshift/agent-installer-utils/pull/286)
* [AGENT-1476](https://issues.redhat.com/browse/AGENT-1476): Configure CI integration and add Prow e2e test to Konflux [#245](https://github.com/openshift/agent-installer-utils/pull/245)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/210b2959d50f0e65bc1d21578a2d35d4844a5a18...2ef405f56aec6459310d63b3fa8b035d6fd040f6)
### [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy/tree/5c263ca1bc10b7b8ace1a23b1220dc629a625b23)
* [CNTRLPLANE-3380](https://issues.redhat.com/browse/CNTRLPLANE-3380): Update OWNERS with HyperShift core team [#107](https://github.com/openshift/apiserver-network-proxy/pull/107)
* [CNTRLPLANE-3359](https://issues.redhat.com/browse/CNTRLPLANE-3359): Rebase to v0.34.0 for OCP 4.23 [#102](https://github.com/openshift/apiserver-network-proxy/pull/102)
* [Full changelog](https://github.com/openshift/apiserver-network-proxy/compare/5e33c22867d59ddd9392a2c6b3194d2f3c6bdfc7...5c263ca1bc10b7b8ace1a23b1220dc629a625b23)
### [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws/tree/77b3287fd6d469dc4fe8f57ad6db25fa30a4ad45)
* [OCPBUGS-85567](https://issues.redhat.com/browse/OCPBUGS-85567): Bump github.com/go-jose/go-jose/v4 to 4.1.4 [#607](https://github.com/openshift/cluster-api-provider-aws/pull/607)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#605](https://github.com/openshift/cluster-api-provider-aws/pull/605)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#598](https://github.com/openshift/cluster-api-provider-aws/pull/598)
* NO-JIRA: Update manifests generator [#604](https://github.com/openshift/cluster-api-provider-aws/pull/604)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.11.1 (eaa4c99) into main [#602](https://github.com/openshift/cluster-api-provider-aws/pull/602)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.11.0 (815a1b0) into main [#600](https://github.com/openshift/cluster-api-provider-aws/pull/600)
* [Full changelog](https://github.com/openshift/cluster-api-provider-aws/compare/32d5f1fc5c7d30072da7eba9e583290340171d7a...77b3287fd6d469dc4fe8f57ad6db25fa30a4ad45)
### [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver/tree/0dc99489474b344fd8363d4ff1e2d91b4da1a312)
* NO-ISSUE: UPSTREAM: 2911: CVE-2026-33186: bump google.golang.org/grpc v1.80.0 [#315](https://github.com/openshift/aws-ebs-csi-driver/pull/315)
* [Full changelog](https://github.com/openshift/aws-ebs-csi-driver/compare/0927af1c1397b6f3c7545c715e1a87e0263ae2bf...0dc99489474b344fd8363d4ff1e2d91b4da1a312)
### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/5027bfc7aeb18c7b9c61617172fc5136fe274c14)
* [OCPBUGS-85457](https://issues.redhat.com/browse/OCPBUGS-85457): Add init container for Manila node daemonset [#552](https://github.com/openshift/csi-operator/pull/552)
* [OCPBUGS-84052](https://issues.redhat.com/browse/OCPBUGS-84052): Mount writable /tmp in SMB CSI driver [#545](https://github.com/openshift/csi-operator/pull/545)
* [OSASINFRA-3675](https://issues.redhat.com/browse/OSASINFRA-3675): Rework authentication in Manila CSI Driver Operator [#373](https://github.com/openshift/csi-operator/pull/373)
* [Full changelog](https://github.com/openshift/csi-operator/compare/9b5dbf99ab2f15d7908454fd2f75b3edf7525256...5027bfc7aeb18c7b9c61617172fc5136fe274c14)
### [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider/tree/6ca6eea2f3a9d0b090ff63ba5b8e342d5686c9a8)
* [CNTRLPLANE-3380](https://issues.redhat.com/browse/CNTRLPLANE-3380): Update OWNERS with HyperShift core team [#45](https://github.com/openshift/aws-encryption-provider/pull/45)
* [Full changelog](https://github.com/openshift/aws-encryption-provider/compare/19e7b623429799c9c549690a1b5ab499844411f9...6ca6eea2f3a9d0b090ff63ba5b8e342d5686c9a8)
### [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws/tree/2e4196b65473ae99bc9bbedc0bc7168ed3da3914)
* [OCPBUGS-83873](https://issues.redhat.com/browse/OCPBUGS-83873): Changed timeout for node ready logic in OTE [#185](https://github.com/openshift/machine-api-provider-aws/pull/185)
* [Full changelog](https://github.com/openshift/machine-api-provider-aws/compare/cba0ea71f8aad552d9373f86c571db5f8ffd33c7...2e4196b65473ae99bc9bbedc0bc7168ed3da3914)
### [azure-cloud-controller-manager, azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure/tree/f10dd9c791c0204da9a4e7620f7998e1c20de449)
* [OCPBUGS-85641](https://issues.redhat.com/browse/OCPBUGS-85641), [OCPBUGS-85642](https://issues.redhat.com/browse/OCPBUGS-85642): UPSTREAM: <drop>: bump google.golang.org/grpc to v1.79.3 [#184](https://github.com/openshift/cloud-provider-azure/pull/184)
* [Full changelog](https://github.com/openshift/cloud-provider-azure/compare/92dac5fb40ac662b46f95df6e3b86a935da0414b...f10dd9c791c0204da9a4e7620f7998e1c20de449)
### [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure/tree/28bd11f05b5bb1164b3a6aec3327b666e73887a9)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#387](https://github.com/openshift/cluster-api-provider-azure/pull/387)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#379](https://github.com/openshift/cluster-api-provider-azure/pull/379)
* NO-JIRA: Update manifests generator [#382](https://github.com/openshift/cluster-api-provider-azure/pull/382)
* [OCPBUGS-84694](https://issues.redhat.com/browse/OCPBUGS-84694): Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.23.1 (dbeb413) into main [#380](https://github.com/openshift/cluster-api-provider-azure/pull/380)
* [Full changelog](https://github.com/openshift/cluster-api-provider-azure/compare/1364ec134b266b2f5fb1f6c6dacf0e440cb357ad...28bd11f05b5bb1164b3a6aec3327b666e73887a9)
### [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver/tree/72a8648ad5afe04b815361335bb4873d2ce40d99)
* [OCPBUGS-78197](https://issues.redhat.com/browse/OCPBUGS-78197): check for node name in waitForDiskManagedByTobeRemoved [#144](https://github.com/openshift/azure-disk-csi-driver/pull/144)
* [Full changelog](https://github.com/openshift/azure-disk-csi-driver/compare/4f6cc08d2180430239e67067920e850c26387699...72a8648ad5afe04b815361335bb4873d2ce40d99)
### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/044aeaaf9e2390b7033d5738758a00dc02f6b9f8)
* [CNTRLPLANE-3380](https://issues.redhat.com/browse/CNTRLPLANE-3380): Update OWNERS with HyperShift core team [#35](https://github.com/openshift/azure-kubernetes-kms/pull/35)
* [CNTRLPLANE-3204](https://issues.redhat.com/browse/CNTRLPLANE-3204): feat: add workload identity support to Azure KMS plugin [#33](https://github.com/openshift/azure-kubernetes-kms/pull/33)
* [CNTRLPLANE-3358](https://issues.redhat.com/browse/CNTRLPLANE-3358): Sync with upstream Azure/kubernetes-kms [#32](https://github.com/openshift/azure-kubernetes-kms/pull/32)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/99b9a3a33d8edfd0a2d2876aa7ef1382b2c75a39...044aeaaf9e2390b7033d5738758a00dc02f6b9f8)
### [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity/tree/7b44f75681bf053805a9cff468149b0fe7cf1e33)
* [OCPBUGS-84709](https://issues.redhat.com/browse/OCPBUGS-84709): github.com/go-jose/go-jose/v4 v4.1.4 [#46](https://github.com/openshift/azure-workload-identity/pull/46)
* [Full changelog](https://github.com/openshift/azure-workload-identity/compare/81a256e668a054385d4a27a393afd77148f268b0...7b44f75681bf053805a9cff468149b0fe7cf1e33)
### [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3/tree/bc0350fe3a236f498f9be26b1cd61ef555678098)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#79](https://github.com/openshift/cluster-api-provider-metal3/pull/79)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#74](https://github.com/openshift/cluster-api-provider-metal3/pull/74)
* NO-JIRA: Update manifests generator [#75](https://github.com/openshift/cluster-api-provider-metal3/pull/75)
* [Full changelog](https://github.com/openshift/cluster-api-provider-metal3/compare/ad4eb8a5e67dc08c0686f006641847df4370d599...bc0350fe3a236f498f9be26b1cd61ef555678098)
### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/0d798da669ce651af4ae3b8770940c56b4bedc0d)
* [SPLAT-2452](https://issues.redhat.com/browse/SPLAT-2452): Add SetSecurityGroups IAM permission to master nodes for BYO SG support for AWS NLBs [#10512](https://github.com/openshift/installer/pull/10512)
* [MCO-2164](https://issues.redhat.com/browse/MCO-2164): use machine-config-osimagestream to avoid hard-coding image tag names [#10416](https://github.com/openshift/installer/pull/10416)
* no-jira: images: bump UPI image dependencies to 4.22 [#10538](https://github.com/openshift/installer/pull/10538)
* [MCO-2200](https://issues.redhat.com/browse/MCO-2200): refactored node-joiner to use embedded rhcos data [#10537](https://github.com/openshift/installer/pull/10537)
* [OCPBUGS-79536](https://issues.redhat.com/browse/OCPBUGS-79536): Removing AWS security group OVNDB ports as they are no longer used [#10441](https://github.com/openshift/installer/pull/10441)
* [OCPBUGS-85232](https://issues.redhat.com/browse/OCPBUGS-85232): PowerVS: Add port 80 security group rule [#10541](https://github.com/openshift/installer/pull/10541)
* no-jira: tests: verify AWS instance type minimum cpu and mem requirement tests [#10536](https://github.com/openshift/installer/pull/10536)
* NO-JIRA: pkg/types/nutanix: warn about unused context [#10430](https://github.com/openshift/installer/pull/10430)
* [SPLAT-2710](https://issues.redhat.com/browse/SPLAT-2710): Added vSphere day 2 support [#10529](https://github.com/openshift/installer/pull/10529)
* [OCPBUGS-67159](https://issues.redhat.com/browse/OCPBUGS-67159): openstack: Reserve addresses for load balancer [#10375](https://github.com/openshift/installer/pull/10375)
* [OCPBUGS-77760](https://issues.redhat.com/browse/OCPBUGS-77760): verify FIPS mode after installation completes [#10348](https://github.com/openshift/installer/pull/10348)
* [OCPBUGS-84873](https://issues.redhat.com/browse/OCPBUGS-84873): Fix to agent integration test finding agent-tui files [#10530](https://github.com/openshift/installer/pull/10530)
* [OCPBUGS-84335](https://issues.redhat.com/browse/OCPBUGS-84335): vSphere - Missing unit tests to cover polarion workitems [#10516](https://github.com/openshift/installer/pull/10516)
* [OCPBUGS-84548](https://issues.redhat.com/browse/OCPBUGS-84548): add unit tests for Nutanix to replace polarion workitems [#10520](https://github.com/openshift/installer/pull/10520)
* [Full changelog](https://github.com/openshift/installer/compare/0bd82bcf655ac45ef86432b5370d6dbf9e9fedcf...0d798da669ce651af4ae3b8770940c56b4bedc0d)
### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/7a005472c3461a960aa983a325eddc504f836365)
* NO-ISSUE: Merge upstream [#483](https://github.com/openshift/baremetal-operator/pull/483)
* [Full changelog](https://github.com/openshift/baremetal-operator/compare/c5e5048987427f58d3ca76238537e74bd3175e0f...7a005472c3461a960aa983a325eddc504f836365)
### [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg/tree/cf62f8c7ac7494096e99997a53ceb48e997c1273)
* NO-ISSUE: Bump go to fix security vulnerabilities [#389](https://github.com/openshift/baremetal-runtimecfg/pull/389)
* [Full changelog](https://github.com/openshift/baremetal-runtimecfg/compare/dca8cb1be0cce1ce404dfd407ead1326a3c8bb40...cf62f8c7ac7494096e99997a53ceb48e997c1273)
### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/a052bd4018333201e48f7370b2263db2dc6a5c99)
* NO-JIRA: Bump go-jose dependency [#2269](https://github.com/openshift/oc/pull/2269)
* NO-JIRA: Making oc cli case blocking [#2260](https://github.com/openshift/oc/pull/2260)
* [OCPBUGS-62799](https://issues.redhat.com/browse/OCPBUGS-62799): Add required-scc annotation to node-joiner pod [#2230](https://github.com/openshift/oc/pull/2230)
* [OTA-1817](https://issues.redhat.com/browse/OTA-1817): Adding unit tests for the extend recommended alerts [#2262](https://github.com/openshift/oc/pull/2262)
* [OCPBUGS-78768](https://issues.redhat.com/browse/OCPBUGS-78768): Skip filter validation for RFC2307 group query when groupUIDAttribute is "dn" [#2259](https://github.com/openshift/oc/pull/2259)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/oc/compare/6b8e30c5b39aa742147846341a203905e04834f3...a052bd4018333201e48f7370b2263db2dc6a5c99)
### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/5d4f9597196a985faaea1bd9bc92bfa79acc2f7d)
* [CCO-683](https://issues.redhat.com/browse/CCO-683): Remove go-autorest dependency for Azure Stack Cloud configuration [#1024](https://github.com/openshift/cloud-credential-operator/pull/1024)
* [CCO-845](https://issues.redhat.com/browse/CCO-845): use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs [#1019](https://github.com/openshift/cloud-credential-operator/pull/1019)
* [CCO-770](https://issues.redhat.com/browse/CCO-770): Docs: consolidate and simplify short-term token workflows [#986](https://github.com/openshift/cloud-credential-operator/pull/986)
* [CCO-711](https://issues.redhat.com/browse/CCO-711): docs: improve the filter when getting the capi pod [#1016](https://github.com/openshift/cloud-credential-operator/pull/1016)
* [OCPBUGS-84712](https://issues.redhat.com/browse/OCPBUGS-84712): github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 [#1021](https://github.com/openshift/cloud-credential-operator/pull/1021)
* [OCPBUGS-84043](https://issues.redhat.com/browse/OCPBUGS-84043): go.opentelemetry.io/otel v1.43.0 [#1011](https://github.com/openshift/cloud-credential-operator/pull/1011)
* [OCPBUGS-84044](https://issues.redhat.com/browse/OCPBUGS-84044): github.com/go-jose/go-jose/v4 v4.1.4 [#1012](https://github.com/openshift/cloud-credential-operator/pull/1012)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/374560dea0d04ab3802ab6360de4440bbd956650...5d4f9597196a985faaea1bd9bc92bfa79acc2f7d)
### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/35eb6f519025b05208b335d94d720e03fc3eed19)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): Bump library-go and sync plugin changes [#896](https://github.com/openshift/cluster-authentication-operator/pull/896)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): Bump library-go and sync encryption tests with APIServerEncryption struct change [#894](https://github.com/openshift/cluster-authentication-operator/pull/894)
* [CNTRLPLANE-3431](https://issues.redhat.com/browse/CNTRLPLANE-3431): enable tls config injection [#892](https://github.com/openshift/cluster-authentication-operator/pull/892)
* NO-JIRA: Bump latest library-go changes [#890](https://github.com/openshift/cluster-authentication-operator/pull/890)
* [OCPBUGS-69977](https://issues.redhat.com/browse/OCPBUGS-69977): Fix OAuth page showing OKD branding instead of OpenShift [#887](https://github.com/openshift/cluster-authentication-operator/pull/887)
* [OCPBUGS-84951](https://issues.redhat.com/browse/OCPBUGS-84951): Fix terminationMessagePolicy on network policy e2e test pods [#882](https://github.com/openshift/cluster-authentication-operator/pull/882)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/24dab9f9f2429dbdff93846fce599ecd1d047e51...35eb6f519025b05208b335d94d720e03fc3eed19)
### [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler/tree/02af1a9fd6bcb87745979980fbbf9a2b0671dddb)
* [OCPBUGS-84130](https://issues.redhat.com/browse/OCPBUGS-84130): UPSTREAM: 9458: fix(clusterapi): use kind-aware version discovery for infra references [#418](https://github.com/openshift/kubernetes-autoscaler/pull/418)
* [Full changelog](https://github.com/openshift/kubernetes-autoscaler/compare/05bcec5a83ea3d9afc3a342a1b8878e30c19ef94...02af1a9fd6bcb87745979980fbbf9a2b0671dddb)
### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/c81a51f40f7bd2045a187a3cc4978afc52a79408)
* [OCPBUGS-85496](https://issues.redhat.com/browse/OCPBUGS-85496): Fix webhook to validate the actual admission request object [#601](https://github.com/openshift/cluster-baremetal-operator/pull/601)
* [OCPBUGS-82526](https://issues.redhat.com/browse/OCPBUGS-82526): Fix webhook server not starting due to missing WithValidator [#587](https://github.com/openshift/cluster-baremetal-operator/pull/587)
* [OCPBUGS-82531](https://issues.redhat.com/browse/OCPBUGS-82531): Bind the plain HTTP 8080 metrics port to localhost [#586](https://github.com/openshift/cluster-baremetal-operator/pull/586)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/26b8679bcb334623e607187d8a7d7d5c7311ec1c...c81a51f40f7bd2045a187a3cc4978afc52a79408)
### [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap/tree/96db8575e287c71b5099ee52be1193c15bb91957)
* NO-JIRA: Add control-plane-approvers to OWNERS [#127](https://github.com/openshift/cluster-bootstrap/pull/127)
* [Full changelog](https://github.com/openshift/cluster-bootstrap/compare/e6be0fdfbf43883e2301dbf2d0eb3ab4a4f93383...96db8575e287c71b5099ee52be1193c15bb91957)
### [cluster-capi-controllers](https://github.com/openshift/cluster-api/tree/1e1b540925a8f1c8aecbf7ac876d2465299b5a98)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#292](https://github.com/openshift/cluster-api/pull/292)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#290](https://github.com/openshift/cluster-api/pull/290)
* NO-JIRA: Update manifests generator [#287](https://github.com/openshift/cluster-api/pull/287)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api:v1.12.7 (b5fa593) into master [#286](https://github.com/openshift/cluster-api/pull/286)
* [Full changelog](https://github.com/openshift/cluster-api/compare/e9e01a1c5ed4786ab138291846932816aa1eaa5a...1e1b540925a8f1c8aecbf7ac876d2465299b5a98)
### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/c585235ee71f6f5ada2edebec2961c2093905659)
* NO-JIRA: Allow sustaining engineering to self serve dependency updates [#553](https://github.com/openshift/cluster-capi-operator/pull/553)
* [OCPBUGS-84815](https://issues.redhat.com/browse/OCPBUGS-84815): fix: scope webhook to capi namespace, remove unused webhook endpoints [#543](https://github.com/openshift/cluster-capi-operator/pull/543)
* [OCPCLOUD-2664](https://issues.redhat.com/browse/OCPCLOUD-2664): Update operatorstatus to write correct sub-Conditions [#552](https://github.com/openshift/cluster-capi-operator/pull/552)
* [OCPCLOUD-3429](https://issues.redhat.com/browse/OCPCLOUD-3429): Mount provider images with image volumes [#527](https://github.com/openshift/cluster-capi-operator/pull/527)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#544](https://github.com/openshift/cluster-capi-operator/pull/544)
* [OCPBUGS-84673](https://issues.redhat.com/browse/OCPBUGS-84673): fix: remove retired Microsoft.ClassicStorage permission [#547](https://github.com/openshift/cluster-capi-operator/pull/547)
* NO-JIRA: bump controller-runtime-common to latest main [#540](https://github.com/openshift/cluster-capi-operator/pull/540)
* NO-JIRA: Updates gemini powered skills / agents [#542](https://github.com/openshift/cluster-capi-operator/pull/542)
* NO-JIRA: manifests-gen: set scc annotation in providers Deployments spec [#524](https://github.com/openshift/cluster-capi-operator/pull/524)
* NO-JIRA: Adds deep review skill [#541](https://github.com/openshift/cluster-capi-operator/pull/541)
* NO-JIRA: fix: re-enable setting/diffing httpProtocolIpv6, CAPA now supports it [#537](https://github.com/openshift/cluster-capi-operator/pull/537)
* NO-JIRA: fix: conversion: handle HTTPProtocolIPv6, temporarily disable its diffing [#531](https://github.com/openshift/cluster-capi-operator/pull/531)
* [OCPBUGS-84378](https://issues.redhat.com/browse/OCPBUGS-84378): Refactor e2e newAWSMachineTemplate to use mapi2capi [#532](https://github.com/openshift/cluster-capi-operator/pull/532)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/89a8af46df2a07a4a7d26e70a960f6b63371b2cd...c585235ee71f6f5ada2edebec2961c2093905659)
### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/8b9dc8c3937a200042444a1acded57cf006504db)
* [OCPCLOUD-3436](https://issues.redhat.com/browse/OCPCLOUD-3436): use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs [#457](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/457)
* [SPLAT-2651](https://issues.redhat.com/browse/SPLAT-2651): Added support to manage kube-cloud-config for vSphere in openshift-config-managed [#442](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/442)
* NO-JIRA: fix: add pod annotation: openshift.io/required-scc: hostaccess [#450](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/450)
* NO-JIRA: bump controller-runtime-common to latest main [#456](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/456)
* [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/06a87c332f0b812ad1b78a37d8375af807fdb55d...8b9dc8c3937a200042444a1acded57cf006504db)
### [cluster-config-api](https://github.com/openshift/api/tree/73d7ca93df6d0a1b02f5533ce20f68d27869a1fe)
* [OCPBUGS-74511](https://issues.redhat.com/browse/OCPBUGS-74511): remove RouteExternalCertificate feature gate [#2693](https://github.com/openshift/api/pull/2693)
* [CNTRLPLANE-3361](https://issues.redhat.com/browse/CNTRLPLANE-3361): update vault kms plugin validation [#2836](https://github.com/openshift/api/pull/2836)
* [OCPSTRAT-3036](https://issues.redhat.com/browse/OCPSTRAT-3036): Promote MutatingAdmissionPolicy feature to Default [#2832](https://github.com/openshift/api/pull/2832)
* [OPRUN-4590](https://issues.redhat.com/browse/OPRUN-4590): Add OLMLifecycleAndCompatibility feature gate [#2824](https://github.com/openshift/api/pull/2824)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): Rename KMSConfig Struct to KMSPluginConfig [#2833](https://github.com/openshift/api/pull/2833)
* [SRVKP-11558](https://issues.redhat.com/browse/SRVKP-11558): remove deprecated k8s.io/api packages removed in v0.36.0 [#2834](https://github.com/openshift/api/pull/2834)
* [CORENET-6861](https://issues.redhat.com/browse/CORENET-6861): Promote EVPN Feature Gate [#2799](https://github.com/openshift/api/pull/2799)
* Revert "OCPBUGS-83492: Allow :ref suffix in additionalLayerStores path for stargz-store to support lazy image pulling" [#2823](https://github.com/openshift/api/pull/2823)
* [MON-4561](https://issues.redhat.com/browse/MON-4561): API: Add softirqs node-exporter collector to ClusterMonitoring CRD [#2825](https://github.com/openshift/api/pull/2825)
* Clarify cluster operator Progressing condition [#2829](https://github.com/openshift/api/pull/2829)
* [OCPNODE-4498](https://issues.redhat.com/browse/OCPNODE-4498): features: drop DRAPartitionableDevices awareness [#2828](https://github.com/openshift/api/pull/2828)
* [OCPBUGS-43353](https://issues.redhat.com/browse/OCPBUGS-43353): Add pattern validation for registry entries in image config [#2787](https://github.com/openshift/api/pull/2787)
* [SPLAT-2649](https://issues.redhat.com/browse/SPLAT-2649): Added vSphere Day 2 logic to CRDs [#2784](https://github.com/openshift/api/pull/2784)
* [OCPBUGS-74506](https://issues.redhat.com/browse/OCPBUGS-74506): Remove ConsolePluginSecurityPolicy featuregate [#2683](https://github.com/openshift/api/pull/2683)
* [CNTRLPLANE-2711](https://issues.redhat.com/browse/CNTRLPLANE-2711): add vault kms plug configuration api [#2805](https://github.com/openshift/api/pull/2805)
* [Full changelog](https://github.com/openshift/api/compare/4f63a40a2970d8bcc2f3767bc6b57e09880544fb...73d7ca93df6d0a1b02f5533ce20f68d27869a1fe)
### [cluster-config-operator](https://github.com/openshift/cluster-config-operator/tree/15a09d1fa8e370ef0b840ba9cc58647e4eea3a29)
* [SPLAT-2717](https://issues.redhat.com/browse/SPLAT-2717): Migrate vSphere sync of kube-cloud-config to 3CMO [#481](https://github.com/openshift/cluster-config-operator/pull/481)
* [Full changelog](https://github.com/openshift/cluster-config-operator/compare/cd73ceffccbdf1510968237ea038877a16cefe6d...15a09d1fa8e370ef0b840ba9cc58647e4eea3a29)
### [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator/tree/85f92f79174d6df783f631eb3187f0e11e89cc96)
* NO-JIRA: bump controller-runtime-common to latest main [#403](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/403)
* [Full changelog](https://github.com/openshift/cluster-control-plane-machine-set-operator/compare/84528cc6063cd4c30613bce281a46015a96b6d9c...85f92f79174d6df783f631eb3187f0e11e89cc96)
### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/25efce1c7e783ac8cbcb3748b08bdcffb67f7263)
* [OCPEDGE-2604](https://issues.redhat.com/browse/OCPEDGE-2604), [OCPEDGE-2605](https://issues.redhat.com/browse/OCPEDGE-2605): feat: add update-fencing-credentials.sh script for TNF fencing credentials rotation [#1611](https://github.com/openshift/cluster-etcd-operator/pull/1611)
* [CNTRLPLANE-3392](https://issues.redhat.com/browse/CNTRLPLANE-3392): Migrating etcd otp cases to ote [#1612](https://github.com/openshift/cluster-etcd-operator/pull/1612)
* NO-JIRA: Replace bash env var validator with go implementation [#1606](https://github.com/openshift/cluster-etcd-operator/pull/1606)
* NO-JIRA: separate grpc from http server [#1598](https://github.com/openshift/cluster-etcd-operator/pull/1598)
* NO-JIRA: fix CI failure [#1599](https://github.com/openshift/cluster-etcd-operator/pull/1599)
* NO-JIRA: Refactor render test validation [#1597](https://github.com/openshift/cluster-etcd-operator/pull/1597)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/653c09ffd218f46c4b990a11a3ec43d2d8241001...25efce1c7e783ac8cbcb3748b08bdcffb67f7263)
### [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator/tree/d9cb7cc7f0863b12f0686f288b6317ac6a0178c2)
* NO-JIRA: fix flaky TestGlobalTLSCopy unit test [#1341](https://github.com/openshift/cluster-image-registry-operator/pull/1341)
* [OCPBUGS-84725](https://issues.redhat.com/browse/OCPBUGS-84725): Fix stale config cache causing incorrect deployment [#1329](https://github.com/openshift/cluster-image-registry-operator/pull/1329)
* [OCPBUGS-63691](https://issues.redhat.com/browse/OCPBUGS-63691): replace node-ca shell script with go implementation [#1325](https://github.com/openshift/cluster-image-registry-operator/pull/1325)
* [IR-486](https://issues.redhat.com/browse/IR-486): use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs [#1326](https://github.com/openshift/cluster-image-registry-operator/pull/1326)
* [Full changelog](https://github.com/openshift/cluster-image-registry-operator/compare/6c19deb7c480f3915dd6a8c742a9533d15df9dd5...d9cb7cc7f0863b12f0686f288b6317ac6a0178c2)
### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/10bbe5fa42c1203acd516e8f090df4954121c224)
* [NE-2662](https://issues.redhat.com/browse/NE-2662): use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs [#1431](https://github.com/openshift/cluster-ingress-operator/pull/1431)
* [OCPBUGS-80966](https://issues.redhat.com/browse/OCPBUGS-80966): Fix malformed PEM bundle when tls.crt lacks trailing newline [#1405](https://github.com/openshift/cluster-ingress-operator/pull/1405)
* [OCPBUGS-84773](https://issues.redhat.com/browse/OCPBUGS-84773): Allow host network connections to the ingress canary [#1430](https://github.com/openshift/cluster-ingress-operator/pull/1430)
* [OCPBUGS-81442](https://issues.redhat.com/browse/OCPBUGS-81442): TestUnsupportedConfigOverride: Ignore featuregate and defaults [#1408](https://github.com/openshift/cluster-ingress-operator/pull/1408)
* [OCPBUGS-84551](https://issues.redhat.com/browse/OCPBUGS-84551): isFIPSEnabled: Check FIPS_ENABLED env. var. first [#1427](https://github.com/openshift/cluster-ingress-operator/pull/1427)
* [OCPBUGS-54702](https://issues.redhat.com/browse/OCPBUGS-54702): change default timeout tunnel if using AWS NLB [#1349](https://github.com/openshift/cluster-ingress-operator/pull/1349)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/961ac218364fb5f6de970ade1161ece3b8195aed...10bbe5fa42c1203acd516e8f090df4954121c224)
### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/167ca3228ab415157eeca5de6cef451c0bfe4db2)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): Bump library-go and sync plugin changes [#2155](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2155)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2220 [#2150](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2150)
* [OCPSTRAT-3036](https://issues.redhat.com/browse/OCPSTRAT-3036): Temporarily extend MutatingAdmissionPolicy runtime-config range to <1.37.0 [#2148](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2148)
* [CNTRLPLANE-3347](https://issues.redhat.com/browse/CNTRLPLANE-3347): Migrate testKMSEncryptionOnOff to ote [#2127](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2127)
* [OCPBUGS-78016](https://issues.redhat.com/browse/OCPBUGS-78016): Use SkipInClusterAuthenticationLookup in check-endpoints [#2113](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2113)
* NO-JIRA: Removal of unuse suites [#2132](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2132)
* [OCPBUGS-76588](https://issues.redhat.com/browse/OCPBUGS-76588): operator should not override authentication config serviceAccountIssuer with the default one during the operator initialization [#2062](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2062)
* [CNTRLPLANE-3327](https://issues.redhat.com/browse/CNTRLPLANE-3327): Migrate TestEncryptionTypeAESCBC to OTE [#2122](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2122)
* NO-JIRA: Add control-plane-approvers to OWNERS [#2110](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2110)
* [CNTRLPLANE-3326](https://issues.redhat.com/browse/CNTRLPLANE-3326): Remove unstable TestBoundTokenOperatorSecretDeletion [#2123](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2123)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/df4cff15fcd9cb3eb6643dc52309f5b93230b3ce...167ca3228ab415157eeca5de6cef451c0bfe4db2)
### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/ca150c42a7982509b8bba34080308cff00c09310)
* [CNTRLPLANE-3107](https://issues.redhat.com/browse/CNTRLPLANE-3107): e2e testing automation Create network network policy test cases [#924](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/924)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/f66ec606970c59461a174d789a5cccbe231c9b32...ca150c42a7982509b8bba34080308cff00c09310)
### [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/tree/42647ceeb54e36b5f7c827302f443c10788407ec)
* [OCPBUGS-65984](https://issues.redhat.com/browse/OCPBUGS-65984): add PodDisruptionBudget for migrator deployment [#172](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/172)
* [OCPBUGS-62629](https://issues.redhat.com/browse/OCPBUGS-62629): update library-go for deployment controller updates [#159](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/159)
* NO-JIRA: Add control-plane-approvers to OWNERS [#158](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/158)
* [Full changelog](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/compare/a206d23192f51b8c1aa4a37b5cf20cac544befeb...42647ceeb54e36b5f7c827302f443c10788407ec)
### [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver/tree/077692a84f2b84185be4bf60263cfa45577b7751)
* NO-JIRA: fix: add pod annotation: openshift.io/required-scc: restricted-v2 [#297](https://github.com/openshift/cluster-machine-approver/pull/297)
* NO-JIRA: bump controller-runtime-common to latest main [#302](https://github.com/openshift/cluster-machine-approver/pull/302)
* NO-JIRA: Deploy cluster-machine-approver without host networking [#301](https://github.com/openshift/cluster-machine-approver/pull/301)
* NO-JIRA: Migrate away from deprecated ioutil [#284](https://github.com/openshift/cluster-machine-approver/pull/284)
* [Full changelog](https://github.com/openshift/cluster-machine-approver/compare/bb63edca04140fb64260f8da35e445031356ac97...077692a84f2b84185be4bf60263cfa45577b7751)
### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/c9f25136c1cc6f9f7facbf1d4f128849fbb8e0f1)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2921](https://github.com/openshift/cluster-monitoring-operator/pull/2921)
* [OCPBUGS-83284](https://issues.redhat.com/browse/OCPBUGS-83284): validate more CMO configmap fields [#2877](https://github.com/openshift/cluster-monitoring-operator/pull/2877)
* [MON-4524](https://issues.redhat.com/browse/MON-4524): MetricsServerConfig resources merge [#2907](https://github.com/openshift/cluster-monitoring-operator/pull/2907)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2918](https://github.com/openshift/cluster-monitoring-operator/pull/2918)
* [MON-4528](https://issues.redhat.com/browse/MON-4528): merge monitoringPluginConfig [#2908](https://github.com/openshift/cluster-monitoring-operator/pull/2908)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2893](https://github.com/openshift/cluster-monitoring-operator/pull/2893)
* [MON-4520](https://issues.redhat.com/browse/MON-4520): follow up AlertManagerConfig and PrometheusOp PR changes [#2900](https://github.com/openshift/cluster-monitoring-operator/pull/2900)
* [TRT-2649](https://issues.redhat.com/browse/TRT-2649): Revert "MON-4558: enable zoneinfo node-exporter collector via config" [#2910](https://github.com/openshift/cluster-monitoring-operator/pull/2910)
* NO-ISSUE: chore(e2e): verify Prometheus Mantine UI is served on port 9090 and refactor ForwardPort helpers [#2905](https://github.com/openshift/cluster-monitoring-operator/pull/2905)
* NO-ISSUE: Update AGENTS.md [#2899](https://github.com/openshift/cluster-monitoring-operator/pull/2899)
* [MON-4563](https://issues.redhat.com/browse/MON-4563): use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs [#2892](https://github.com/openshift/cluster-monitoring-operator/pull/2892)
* [MON-4558](https://issues.redhat.com/browse/MON-4558): enable zoneinfo node-exporter collector via config [#2886](https://github.com/openshift/cluster-monitoring-operator/pull/2886)
* [TRT-2644](https://issues.redhat.com/browse/TRT-2644): Revert "MON-4517: Minimal and telemetry CP monitors" [#2901](https://github.com/openshift/cluster-monitoring-operator/pull/2901)
* NO-ISSUE: [bot] Update jsonnet dependencies [#2894](https://github.com/openshift/cluster-monitoring-operator/pull/2894)
* [MON-4492](https://issues.redhat.com/browse/MON-4492): ClusterMonitoring alertmanagerConfig logic [#2889](https://github.com/openshift/cluster-monitoring-operator/pull/2889)
* [MON-4517](https://issues.redhat.com/browse/MON-4517): Minimal and telemetry CP monitors [#2814](https://github.com/openshift/cluster-monitoring-operator/pull/2814)
* [MON-4560](https://issues.redhat.com/browse/MON-4560): enable softirqs node-exporter collector via config [#2887](https://github.com/openshift/cluster-monitoring-operator/pull/2887)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/890e5fb783f7db0b89ffebd8120168ceb9ee7d7f...c9f25136c1cc6f9f7facbf1d4f128849fbb8e0f1)
### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/6f47993888c3e88153028f22023ad5b36f710b9b)
* [NVIDIA-596](https://issues.redhat.com/browse/NVIDIA-596): Enable dpu healthcheck [#2941](https://github.com/openshift/cluster-network-operator/pull/2941)
* [TRT-2657](https://issues.redhat.com/browse/TRT-2657): Revert "add remaining CNO NetworkPolicies" (#2959) [#2999](https://github.com/openshift/cluster-network-operator/pull/2999)
* [OCPBUGS-83800](https://issues.redhat.com/browse/OCPBUGS-83800): add remaining CNO NetworkPolicies [#2959](https://github.com/openshift/cluster-network-operator/pull/2959)
* [NVIDIA-554](https://issues.redhat.com/browse/NVIDIA-554): DPU-host mode: use ConfigMap for OVN feature enablement instead of per-node script gating [#2944](https://github.com/openshift/cluster-network-operator/pull/2944)
* [OCPBUGS-83406](https://issues.redhat.com/browse/OCPBUGS-83406), [OCPBUGS-83407](https://issues.redhat.com/browse/OCPBUGS-83407): fix issue for managed mode of no-overlay [#2960](https://github.com/openshift/cluster-network-operator/pull/2960)
* [OCPBUGS-53187](https://issues.redhat.com/browse/OCPBUGS-53187): Update self-referencing URLs from master to main [#2984](https://github.com/openshift/cluster-network-operator/pull/2984)
* [GCP-430](https://issues.redhat.com/browse/GCP-430): Wire GCP WIF credentials for CNCC in HyperShift HCP mode [#2915](https://github.com/openshift/cluster-network-operator/pull/2915)
* [OCPBUGS-65631](https://issues.redhat.com/browse/OCPBUGS-65631): Use dedicated service accounts for multus pods [#2961](https://github.com/openshift/cluster-network-operator/pull/2961)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/142432afacfb9cd11a9bd4e5e333bd6a4cdcd555...6f47993888c3e88153028f22023ad5b36f710b9b)
### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/ce1afe57245e0701cabf776b3d05fac8dde30cbe)
* [OCPBUGS-62277](https://issues.redhat.com/browse/OCPBUGS-62277): Requeue PerformanceStatus update when status write fails [#1495](https://github.com/openshift/cluster-node-tuning-operator/pull/1495)
* NO-JIRA: ote: embed extended testdata in cluster-node-tuning-operator-test-ext binary [#1512](https://github.com/openshift/cluster-node-tuning-operator/pull/1512)
* [TRT-2659](https://issues.redhat.com/browse/TRT-2659): Revert #1499 "NO-JIRA: ote: embed extended testdata in cluster-node-tuning-operator-test-ext binary" [#1511](https://github.com/openshift/cluster-node-tuning-operator/pull/1511)
* NO-JIRA: e2e: fix tuned deferred tests on Hypershift [#1494](https://github.com/openshift/cluster-node-tuning-operator/pull/1494)
* NO-JIRA: test/extended: scope oc process to NTO namespace [#1508](https://github.com/openshift/cluster-node-tuning-operator/pull/1508)
* NO-JIRA: ote: embed extended testdata in cluster-node-tuning-operator-test-ext binary [#1499](https://github.com/openshift/cluster-node-tuning-operator/pull/1499)
* [OCPBUGS-84938](https://issues.redhat.com/browse/OCPBUGS-84938): e2e: Add irqbalance StartLimitBurst >= 100 config test [#1493](https://github.com/openshift/cluster-node-tuning-operator/pull/1493)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/3d98f7ee7fe0651d182b8a780956512eb407a963...ce1afe57245e0701cabf776b3d05fac8dde30cbe)
### [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator/tree/f563a1d98a25f5f77af89cafee889604c211a724)
* [OPRUN-4599](https://issues.redhat.com/browse/OPRUN-4599): dynamically resolve catalog image tag from OCP release version [#203](https://github.com/openshift/cluster-olm-operator/pull/203)
* [OCPBUGS-62517](https://issues.redhat.com/browse/OCPBUGS-62517): Scale to replicas=2 and enable PDB on HighlyAvailable topology [#202](https://github.com/openshift/cluster-olm-operator/pull/202)
* [Full changelog](https://github.com/openshift/cluster-olm-operator/compare/d131450b2645623089b26353a309015c95c8871c...f563a1d98a25f5f77af89cafee889604c211a724)
### [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator/tree/c7332945d1bc4887a2afce2cfbc27c00d55a66bb)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): Bump library-go and sync encryption tests with APIServerEncryption struct change [#689](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/689)
* NO-JIRA: Bump latest library-go changes [#688](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/688)
* [API-1768](https://issues.redhat.com/browse/API-1768): e2e network policy tests [#675](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/675)
* NO-JIRA: Add control-plane-approvers to OWNERS [#677](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/677)
* [Full changelog](https://github.com/openshift/cluster-openshift-apiserver-operator/compare/a4712a95da2d42dd05fbdbbf4225c4f6a1f1958d...c7332945d1bc4887a2afce2cfbc27c00d55a66bb)
### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/e75b70ae091198eff7ea2307c0af94ca83ce0e5c)
* [OTA-1967](https://issues.redhat.com/browse/OTA-1967): Take official CRDs from the OpenShift Lightspeed operator [#1387](https://github.com/openshift/cluster-version-operator/pull/1387)
* [MON-4477](https://issues.redhat.com/browse/MON-4477): chore: add permissions on endpointslice to Prometheus Role and use serviceDiscoveryRole: EndpointSlice in ServiceMonitors [#1305](https://github.com/openshift/cluster-version-operator/pull/1305)
* [OTA-1966](https://issues.redhat.com/browse/OTA-1966): Init the Proprosal Lifecycle Controller [#1381](https://github.com/openshift/cluster-version-operator/pull/1381)
* NO-JIRA: OpenShiftUpdateRiskMightApply: bump pending to 15m from 10m [#1372](https://github.com/openshift/cluster-version-operator/pull/1372)
* [OTA-1836](https://issues.redhat.com/browse/OTA-1836): chore(deps): Bump general OpenShift dependencies [#1377](https://github.com/openshift/cluster-version-operator/pull/1377)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/39733befaa0ec6c98ff8b9c2bfe48f87f1fc086d...e75b70ae091198eff7ea2307c0af94ca83ce0e5c)
### [console](https://github.com/openshift/console/tree/9af8cbd256ab90ceb5d746b20e63a9744cbe9cb6)
* [OCPBUGS-82513](https://issues.redhat.com/browse/OCPBUGS-82513): Enable Topology e2e tests [#16273](https://github.com/openshift/console/pull/16273)
* [CONSOLE-5200](https://issues.redhat.com/browse/CONSOLE-5200): add qa-verify skill for automated PR visual verification [#16429](https://github.com/openshift/console/pull/16429)
* [OCPBUGS-84669](https://issues.redhat.com/browse/OCPBUGS-84669): Fix ProjectLink to update active namespace in Redux [#16430](https://github.com/openshift/console/pull/16430)
* [CONSOLE-5212](https://issues.redhat.com/browse/CONSOLE-5212): Fix ESM compatibility for Playwright e2e tests [#16445](https://github.com/openshift/console/pull/16445)
* [OCPBUGS-79521](https://issues.redhat.com/browse/OCPBUGS-79521): Restore list page text and row filter functionality [#16440](https://github.com/openshift/console/pull/16440)
* [OCPBUGS-59404](https://issues.redhat.com/browse/OCPBUGS-59404): Allow VolumeSnapshot restore when parent PVC is deleted [#16447](https://github.com/openshift/console/pull/16447)
* [OCPBUGS-83569](https://issues.redhat.com/browse/OCPBUGS-83569): [main] CVE-2026-26996 Bump minimatch library [#16301](https://github.com/openshift/console/pull/16301)
* [CONSOLE-5211](https://issues.redhat.com/browse/CONSOLE-5211): Add Cypress-to-Playwright migration skills and context [#16315](https://github.com/openshift/console/pull/16315)
* [CONSOLE-5229](https://issues.redhat.com/browse/CONSOLE-5229): Enable RTL ESLint rules in Knative tests by removing file-level no-container / no-node-access suppressions [#16405](https://github.com/openshift/console/pull/16405)
* [CONSOLE-5197](https://issues.redhat.com/browse/CONSOLE-5197): Add Playwright E2E test infrastructure for Prow/CI [#16374](https://github.com/openshift/console/pull/16374)
* [CONSOLE-5034](https://issues.redhat.com/browse/CONSOLE-5034): Migrate tile-view-page and value-from-pair to TypeScript [#16412](https://github.com/openshift/console/pull/16412)
* [OCPBUGS-85242](https://issues.redhat.com/browse/OCPBUGS-85242): Add Suspense boundary to LazyRoutePage for plugin routes [#16409](https://github.com/openshift/console/pull/16409)
* [OCPBUGS-77952](https://issues.redhat.com/browse/OCPBUGS-77952): Fix devfile sample import by adding fallback for parent resolution failures [#16149](https://github.com/openshift/console/pull/16149)
* [OCPBUGS-70273](https://issues.redhat.com/browse/OCPBUGS-70273): Prevent binary secret data corruption when editing [#16053](https://github.com/openshift/console/pull/16053)
* [OCPBUGS-65950](https://issues.redhat.com/browse/OCPBUGS-65950): Update template whenever settings are updated [#16143](https://github.com/openshift/console/pull/16143)
* [CONSOLE-5212](https://issues.redhat.com/browse/CONSOLE-5212): Migrate Playwright setup to project dependencies [#16408](https://github.com/openshift/console/pull/16408)
* [CONSOLE-5285](https://issues.redhat.com/browse/CONSOLE-5285): remove corepack dep for build-(frontend/demos), bump yarn [#16426](https://github.com/openshift/console/pull/16426)
* [OCPBUGS-81518](https://issues.redhat.com/browse/OCPBUGS-81518): Increase Resource Dropdown visible items cap to 250. [#16398](https://github.com/openshift/console/pull/16398)
* [CONSOLE-5273](https://issues.redhat.com/browse/CONSOLE-5273): Expose `useToast` in the SDK [#16400](https://github.com/openshift/console/pull/16400)
* [OCPBUGS-59353](https://issues.redhat.com/browse/OCPBUGS-59353): Fix authentication redirect loop on repeated 401 responses [#15814](https://github.com/openshift/console/pull/15814)
* [CONSOLE-5015](https://issues.redhat.com/browse/CONSOLE-5015): Migrate NameValueEditor to TypeScript and PatternFly drag-drop [#16406](https://github.com/openshift/console/pull/16406)
* NO-JIRA: Add approvers and reviewers to helm-plugin OWNERS [#16361](https://github.com/openshift/console/pull/16361)
* [OCPBUGS-85043](https://issues.redhat.com/browse/OCPBUGS-85043): Remove `@console` imports from SDK dist [#16399](https://github.com/openshift/console/pull/16399)
* [OCPBUGS-77931](https://issues.redhat.com/browse/OCPBUGS-77931): Loosen default `img-src` CSP [#16388](https://github.com/openshift/console/pull/16388)
* [OCPBUGS-84324](https://issues.redhat.com/browse/OCPBUGS-84324): Update outdated documentation links and references [#16362](https://github.com/openshift/console/pull/16362)
* [CONSOLE-5212](https://issues.redhat.com/browse/CONSOLE-5212): Set up Playwright e2e test infrastructure [#16320](https://github.com/openshift/console/pull/16320)
* [OCPBUGS-84844](https://issues.redhat.com/browse/OCPBUGS-84844): VSphere plugin changes broke i18n translations - missing strings in locales/en/ [#16384](https://github.com/openshift/console/pull/16384)
* [OCPBUGS-80940](https://issues.redhat.com/browse/OCPBUGS-80940): Fix SDK publish workflow for Yarn Berry [#16392](https://github.com/openshift/console/pull/16392)
* [HELM-613](https://issues.redhat.com/browse/HELM-613): Reject basic auth over non-HTTPS for Helm chart repositories [#16317](https://github.com/openshift/console/pull/16317)
* [OCPBUGS-81519](https://issues.redhat.com/browse/OCPBUGS-81519): Fix Search page state mutation and unnecessary component remounts [#16266](https://github.com/openshift/console/pull/16266)
* [OCPBUGS-84876](https://issues.redhat.com/browse/OCPBUGS-84876): Add bottom pagination to ConsoleDataView for mobile responsiveness [#16391](https://github.com/openshift/console/pull/16391)
* [OCPBUGS-84856](https://issues.redhat.com/browse/OCPBUGS-84856): Fix ESLint Testing Library plugin PR review feedback [#16387](https://github.com/openshift/console/pull/16387)
* [OCPBUGS-82140](https://issues.redhat.com/browse/OCPBUGS-82140): Remove PII from events [#16365](https://github.com/openshift/console/pull/16365)
* NO-JIRA: Align Dockerfile.dev with multi-arch Dockerfile structure [#16390](https://github.com/openshift/console/pull/16390)
* [OCPBUGS-79363](https://issues.redhat.com/browse/OCPBUGS-79363): Move xterm to its own chunk [#16370](https://github.com/openshift/console/pull/16370)
* NO-JIRA: zsh compatibility for microcopy-review [#16389](https://github.com/openshift/console/pull/16389)
* NO-JIRA: Add fsgreco to frontend reviewers [#16381](https://github.com/openshift/console/pull/16381)
* [CONSOLE-5184](https://issues.redhat.com/browse/CONSOLE-5184): Enable ESLint Plugins for React Testing Library [#16270](https://github.com/openshift/console/pull/16270)
* [OCPBUGS-84710](https://issues.redhat.com/browse/OCPBUGS-84710): Fix ConsoleDataView filter order: Name and Label should appear first [#16375](https://github.com/openshift/console/pull/16375)
* [OCPBUGS-84227](https://issues.redhat.com/browse/OCPBUGS-84227): i18n upload/download routine task - version 4.22 [#16318](https://github.com/openshift/console/pull/16318)
* [OCPBUGS-84230](https://issues.redhat.com/browse/OCPBUGS-84230): [release-4.22] - Re-enable cluster-settings/update-modal.cy.ts e2e test disabled for createRoot adoption [#16319](https://github.com/openshift/console/pull/16319)
* [OCPBUGS-81522](https://issues.redhat.com/browse/OCPBUGS-81522): Reduce dashboard re-renders by memoizing cards and stabilizing prop references [#16367](https://github.com/openshift/console/pull/16367)
* [CONSOLE-5203](https://issues.redhat.com/browse/CONSOLE-5203): Remove old QE team from our repos [#16312](https://github.com/openshift/console/pull/16312)
* [OCPBUGS-81518](https://issues.redhat.com/browse/OCPBUGS-81518): Fix ResourceListDropdown performance on large clusters [#16252](https://github.com/openshift/console/pull/16252)
* [OCPBUGS-79067](https://issues.redhat.com/browse/OCPBUGS-79067): Fix crash when switching language to English [#16366](https://github.com/openshift/console/pull/16366)
* NO-JIRA: Remove broken entrypoints and unused packages [#16357](https://github.com/openshift/console/pull/16357)
* [OCPBUGS-82511](https://issues.redhat.com/browse/OCPBUGS-82511): re-enable helm-release.feature [#16274](https://github.com/openshift/console/pull/16274)
* [CONSOLE-5227](https://issues.redhat.com/browse/CONSOLE-5227): Upgrade ESLint from v6 to v8 and @typescript-eslint to v8 [#16353](https://github.com/openshift/console/pull/16353)
* [OCPBUGS-84338](https://issues.redhat.com/browse/OCPBUGS-84338): Update resolveDynamicModuleMaps to skip unavailable packages [#16340](https://github.com/openshift/console/pull/16340)
* [OCPBUGS-84320](https://issues.redhat.com/browse/OCPBUGS-84320): Use popover token in QS modal [#16339](https://github.com/openshift/console/pull/16339)
* [OCPBUGS-84296](https://issues.redhat.com/browse/OCPBUGS-84296): fix Helm list page redirect after upgrade/rollback [#16336](https://github.com/openshift/console/pull/16336)
* NO-JIRA: prepare for 4.22-prerelease.3 sdk publish [#16338](https://github.com/openshift/console/pull/16338)
* [CONSOLE-5144](https://issues.redhat.com/browse/CONSOLE-5144), [OCPBUGS-81319](https://issues.redhat.com/browse/OCPBUGS-81319), [OCPBUGS-83823](https://issues.redhat.com/browse/OCPBUGS-83823): 4.22 SDK fixes [#15655](https://github.com/openshift/console/pull/15655)
* [OCPBUGS-83812](https://issues.redhat.com/browse/OCPBUGS-83812): Fix race conditions in OLM descriptors Cypress test [#16304](https://github.com/openshift/console/pull/16304)
* [OCPBUGS-83816](https://issues.redhat.com/browse/OCPBUGS-83816): Fix race conditions in create-namespace Cypress tests [#16306](https://github.com/openshift/console/pull/16306)
* NO-JIRA: enable multi-architecture yarn builds [#16228](https://github.com/openshift/console/pull/16228)
* [OCPBUGS-83813](https://issues.redhat.com/browse/OCPBUGS-83813): Fix race conditions in debug pod Cypress tests [#16305](https://github.com/openshift/console/pull/16305)
* [OCPBUGS-81668](https://issues.redhat.com/browse/OCPBUGS-81668): Fix User Preferences responsive breakpoints bug [#16279](https://github.com/openshift/console/pull/16279)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/console/compare/516850e18af087e51d6c574a8d576f120b32f3e7...9af8cbd256ab90ceb5d746b20e63a9744cbe9cb6)
### [console-operator](https://github.com/openshift/console-operator/tree/2d71a12328fb08b7e5f80bfdc7a0324048bf0e74)
* [OCPBUGS-85650](https://issues.redhat.com/browse/OCPBUGS-85650): bump gRPC-Go package [#1156](https://github.com/openshift/console-operator/pull/1156)
* [MON-4510](https://issues.redhat.com/browse/MON-4510): Migrate Prometheus targets discovering from Endpoints to EndpointSlices [#1106](https://github.com/openshift/console-operator/pull/1106)
* [OCPBUGS-85060](https://issues.redhat.com/browse/OCPBUGS-85060): feat: use 2 replicas for console on tnf [#1151](https://github.com/openshift/console-operator/pull/1151)
* [Full changelog](https://github.com/openshift/console-operator/compare/5ced247355e1f55a05f2e2e6a022f4427b04c5b2...2d71a12328fb08b7e5f80bfdc7a0324048bf0e74)
### [csi-driver-manila, csi-driver-manila-operator, csi-driver-nfs, hyperkube, ibm-cloud-controller-manager, ibm-vpc-block-csi-driver, ibm-vpc-block-csi-driver-operator, ibmcloud-cluster-api-controllers, ibmcloud-machine-controllers, kube-proxy, nutanix-cloud-controller-manager, nutanix-machine-controllers, pod, powervs-block-csi-driver, powervs-block-csi-driver-operator, powervs-cloud-controller-manager, powervs-machine-controllers, vsphere-cloud-controller-manager, vsphere-cluster-api-controllers, vsphere-csi-driver, vsphere-csi-driver-operator, vsphere-csi-driver-syncer, vsphere-problem-detector](https://github.com/openshift/kubernetes/tree/f9b62a69d4a05e10b2b7cf8d40afa37f9dcd0938)
* [OCPBUGS-78044](https://issues.redhat.com/browse/OCPBUGS-78044): Improve WatchList test robustness [#2622](https://github.com/openshift/kubernetes/pull/2622)
* [CNTRLPLANE-2553](https://issues.redhat.com/browse/CNTRLPLANE-2553): Update the KAS admission plugin for fields to be compilable at admission time [#2627](https://github.com/openshift/kubernetes/pull/2627)
* [OCPBUGS-83502](https://issues.redhat.com/browse/OCPBUGS-83502): devicemanager: constrain topology hints to device NUMA nodes [#2645](https://github.com/openshift/kubernetes/pull/2645)
* [Full changelog](https://github.com/openshift/kubernetes/compare/757ccdfcf9a1f89059acaba311c3625c495a6732...f9b62a69d4a05e10b2b7cf8d40afa37f9dcd0938)
### [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner/tree/2ccbf8c35aa2e5b851116706c018ff44f0bb7d08)
* NO-JIRA: OCPBUGS-82033: Bump google.golang.org/grpc to 1.79.3 [#124](https://github.com/openshift/csi-external-provisioner/pull/124)
* [Full changelog](https://github.com/openshift/csi-external-provisioner/compare/f90c06a3113696cdb757e4b7c9dcfeb0e9dddb81...2ccbf8c35aa2e5b851116706c018ff44f0bb7d08)
### [csi-external-snapshotter, csi-snapshot-controller](https://github.com/openshift/csi-external-snapshotter/tree/3219da7dcbb14fa762704746d21fb38131beb1f4)
* [OCPBUGS-77492](https://issues.redhat.com/browse/OCPBUGS-77492): UPSTREAM: 1392: Fix VolumeSnapshotContent deletion [#207](https://github.com/openshift/csi-external-snapshotter/pull/207)
* [Full changelog](https://github.com/openshift/csi-external-snapshotter/compare/d1bc3ffaa9759c13a06c2ec61c541342e71bd109...3219da7dcbb14fa762704746d21fb38131beb1f4)
### [docker-registry](https://github.com/openshift/image-registry/tree/57039cd2d9c87547cdf9a8d1dc7cb94f1ca089f7)
* [OCPBUGS-84680](https://issues.redhat.com/browse/OCPBUGS-84680): pin cloud.google.com/go/storage to v1.30.1 to fix blob deletion [#469](https://github.com/openshift/image-registry/pull/469)
* [Full changelog](https://github.com/openshift/image-registry/compare/c3fa7db05e878e35ff95fcff896f716e82fdd170...57039cd2d9c87547cdf9a8d1dc7cb94f1ca089f7)
### [etcd](https://github.com/openshift/etcd/tree/c543fe15324510d13e896c31232ecd5d100d9de5)
* [OCPBUGS-85258](https://issues.redhat.com/browse/OCPBUGS-85258): 5.0 rebase 3.6.11 [#375](https://github.com/openshift/etcd/pull/375)
* [OCPBUGS-82495](https://issues.redhat.com/browse/OCPBUGS-82495): 5.0/4.23 rebase 3.6.10 [#368](https://github.com/openshift/etcd/pull/368)
* [Full changelog](https://github.com/openshift/etcd/compare/d8d67b8ce849f816d6d23c904098336632e2348f...c543fe15324510d13e896c31232ecd5d100d9de5)
### [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp/tree/808c2a2d59dc0584d31484fe49085ba1de7bed74)
* [OCPBUGS-85551](https://issues.redhat.com/browse/OCPBUGS-85551), [OCPBUGS-85552](https://issues.redhat.com/browse/OCPBUGS-85552): Upgrade spdystream and grpc to fix CVEs [#115](https://github.com/openshift/cloud-provider-gcp/pull/115)
* NO-JIRA: Remove custom vendor scripts in favour of standard tooling [#111](https://github.com/openshift/cloud-provider-gcp/pull/111)
* [Full changelog](https://github.com/openshift/cloud-provider-gcp/compare/ff49d7cfc3364b2e75a8ce603310d4a585e1fc06...808c2a2d59dc0584d31484fe49085ba1de7bed74)
### [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp/tree/196e2c06afdb893dbe113ec1259203b8f4654fd4)
* [OCPBUGS-85101](https://issues.redhat.com/browse/OCPBUGS-85101): Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.11.2 (14609a0) into master [#273](https://github.com/openshift/cluster-api-provider-gcp/pull/273)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#292](https://github.com/openshift/cluster-api-provider-gcp/pull/292)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#284](https://github.com/openshift/cluster-api-provider-gcp/pull/284)
* NO-JIRA: Update manifests generator [#285](https://github.com/openshift/cluster-api-provider-gcp/pull/285)
* [OCPBUGS-77684](https://issues.redhat.com/browse/OCPBUGS-77684): Updating ose-gcp-cluster-api-controllers-container image to be consistent with ART for 4.22 [#272](https://github.com/openshift/cluster-api-provider-gcp/pull/272)
* [Full changelog](https://github.com/openshift/cluster-api-provider-gcp/compare/1ecb08eabba67eac57747572e1eec92382b851aa...196e2c06afdb893dbe113ec1259203b8f4654fd4)
### [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver/tree/c58c624fef4cbac80e0efa1d40e8c359d257a1cd)
* UPSTREAM: 2297: OCPBUGS-83423: Bump google.golang.org/grpc to v1.79.3 [#121](https://github.com/openshift/gcp-pd-csi-driver/pull/121)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver/compare/2ba117405ff1cee765d42491f5863b06a1c9a2da...c58c624fef4cbac80e0efa1d40e8c359d257a1cd)
### [gcp-pd-csi-driver-operator](https://github.com/openshift/gcp-pd-csi-driver-operator/tree/f2427fae9f2115a920a5d8cf8c645afa3ff827d9)
* [STOR-2798](https://issues.redhat.com/browse/STOR-2798): Update image-snapshot CSI manifest to use operator provided imageVolumeSnapshotClass [#179](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/179)
* [STOR-2798](https://issues.redhat.com/browse/STOR-2798): Add test e2e manifest and VolumeSnapshotClass for image volumeSnapshotClass CSI tests [#178](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/178)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver-operator/compare/6b00096f4a84203a69467802b846f215b4e04888...f2427fae9f2115a920a5d8cf8c645afa3ff827d9)
### [haproxy-router](https://github.com/openshift/router/tree/b75bab261392d5eacb115db408f121618a23e41d)
* Reapply "OCPBUGS-55506: Prevent startup failures due to name resolution" [#677](https://github.com/openshift/router/pull/677)
* [OCPBUGS-77263](https://issues.redhat.com/browse/OCPBUGS-77263): create self-signed crt if failing to read default [#740](https://github.com/openshift/router/pull/740)
* [OCPBUGS-62267](https://issues.redhat.com/browse/OCPBUGS-62267): fix forwarded header for IPv6 on IPv4 stack [#713](https://github.com/openshift/router/pull/713)
* [OCPBUGS-49738](https://issues.redhat.com/browse/OCPBUGS-49738): fix handling of host conflict [#736](https://github.com/openshift/router/pull/736)
* [Full changelog](https://github.com/openshift/router/compare/896390778ebe15f57f87e6ca78f11c96e64c2652...b75bab261392d5eacb115db408f121618a23e41d)
### [hypershift](https://github.com/openshift/hypershift/tree/f76be88237e1ae0c1c4df2e34d8b0f9eb8ec7953)
* NO-JIRA: ci(deps): bump cloudflare/wrangler-action from 3.15.0 to 4.0.0 [#8524](https://github.com/openshift/hypershift/pull/8524)
* [OCPBUGS-85763](https://issues.redhat.com/browse/OCPBUGS-85763): Fix metrics-proxy deployment failure due to dots in volume names [#8530](https://github.com/openshift/hypershift/pull/8530)
* [GCP-636](https://issues.redhat.com/browse/GCP-636): feat(gcp): support for managing GCP OIDC discovery documents [#8413](https://github.com/openshift/hypershift/pull/8413)
* [OCPBUGS-84307](https://issues.redhat.com/browse/OCPBUGS-84307): Clarify --base-domain flag default behavior [#8381](https://github.com/openshift/hypershift/pull/8381)
* [AUTOSCALE-681](https://issues.redhat.com/browse/AUTOSCALE-681): various karpenter and karpenterupgrade test fixes [#8510](https://github.com/openshift/hypershift/pull/8510)
* [CNTRLPLANE-3329](https://issues.redhat.com/browse/CNTRLPLANE-3329): Replace actions/cache with EFS-backed build cache in unit tests [#8494](https://github.com/openshift/hypershift/pull/8494)
* [OCPBUGS-85577](https://issues.redhat.com/browse/OCPBUGS-85577): Update external-dns image from 1.1.0-3 to 1.2.1 [#8506](https://github.com/openshift/hypershift/pull/8506)
* [OCPBUGS-77827](https://issues.redhat.com/browse/OCPBUGS-77827): fix(api): add missing has() guards to servingCerts CEL validation rule [#8331](https://github.com/openshift/hypershift/pull/8331)
* [CNTRLPLANE-3380](https://issues.redhat.com/browse/CNTRLPLANE-3380): docs: add aws-node-termination-handler to repositories list [#8514](https://github.com/openshift/hypershift/pull/8514)
* [OCPBUGS-85580](https://issues.redhat.com/browse/OCPBUGS-85580): Fix webhook TLS failure after service-ca to self-managed cert migration [#8504](https://github.com/openshift/hypershift/pull/8504)
* build(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 in /hack/tools [#8481](https://github.com/openshift/hypershift/pull/8481)
* [OCPBUGS-85344](https://issues.redhat.com/browse/OCPBUGS-85344): Add version gates for 4.22 backward compatibility in e2e tests [#8466](https://github.com/openshift/hypershift/pull/8466)
* [AUTOSCALE-681](https://issues.redhat.com/browse/AUTOSCALE-681): remove TechPreviewNoUpgrade gate from karpenter upgrade test [#8498](https://github.com/openshift/hypershift/pull/8498)
* [CNTRLPLANE-3329](https://issues.redhat.com/browse/CNTRLPLANE-3329): Mount EFS-backed Go build cache PV on ARC runner pods [#8493](https://github.com/openshift/hypershift/pull/8493)
* NO-JIRA: docs: add repositories page listing team-owned repos [#8505](https://github.com/openshift/hypershift/pull/8505)
* [CNTRLPLANE-3329](https://issues.redhat.com/browse/CNTRLPLANE-3329): Add nightly CronJob to warm EFS-backed Go build cache [#8496](https://github.com/openshift/hypershift/pull/8496)
* [CNTRLPLANE-3324](https://issues.redhat.com/browse/CNTRLPLANE-3324): Restore non-obvious comments after gocyclo refactor [#8487](https://github.com/openshift/hypershift/pull/8487)
* [AUTOSCALE-558](https://issues.redhat.com/browse/AUTOSCALE-558): Expose KubeletConfig on OpenShiftEC2Nodeclass as structured fields + preserveunknown/overflow [#8192](https://github.com/openshift/hypershift/pull/8192)
* NO-JIRA: Fix docs deploy preview by replacing gh CLI with curl [#8488](https://github.com/openshift/hypershift/pull/8488)
* [CNTRLPLANE-2946](https://issues.redhat.com/browse/CNTRLPLANE-2946): Move AWS NLB annotation inside LoadBalancer strategy block [#7993](https://github.com/openshift/hypershift/pull/7993)
* [OCPBUGS-78539](https://issues.redhat.com/browse/OCPBUGS-78539): re-add crash toleration for dns-operator during upgrades [#8483](https://github.com/openshift/hypershift/pull/8483)
* [CNTRLPLANE-3384](https://issues.redhat.com/browse/CNTRLPLANE-3384): Remove unconditional low-quality log messages from controllers [#8428](https://github.com/openshift/hypershift/pull/8428)
* [OCPBUGS-84971](https://issues.redhat.com/browse/OCPBUGS-84971): Gate AWSDefaultSecurityGroupDeleted condition to AWS platform [#8415](https://github.com/openshift/hypershift/pull/8415)
* [CNTRLPLANE-3324](https://issues.redhat.com/browse/CNTRLPLANE-3324): Enable gocyclo linter and reduce cyclomatic complexity [#8309](https://github.com/openshift/hypershift/pull/8309)
* NO-JIRA: fix(karpenter): resolve HCP karpenter finalizer when AutoNode is disabled [#8404](https://github.com/openshift/hypershift/pull/8404)
* [OCPBUGS-62177](https://issues.redhat.com/browse/OCPBUGS-62177): verify cert revocation against all KAS pods [#8263](https://github.com/openshift/hypershift/pull/8263)
* NO-JIRA: Document CEL over webhooks policy for AI agents [#8478](https://github.com/openshift/hypershift/pull/8478)
* NO-JIRA: docs(kubevirt): add how-to for configuring VMs with JSON patches [#8473](https://github.com/openshift/hypershift/pull/8473)
* [CNTRLPLANE-1741](https://issues.redhat.com/browse/CNTRLPLANE-1741): Migrate gomaxprocs-webhook pipelines to use common-operator-build [#7122](https://github.com/openshift/hypershift/pull/7122)
* NO-JIRA: docs: update api-sme agent and api/AGENTS.md conventions [#8477](https://github.com/openshift/hypershift/pull/8477)
* [OCPBUGS-81686](https://issues.redhat.com/browse/OCPBUGS-81686): fix(authentication): use v2 auth validation for CEL and expression support. [#8246](https://github.com/openshift/hypershift/pull/8246)
* [OCPBUGS-85084](https://issues.redhat.com/browse/OCPBUGS-85084): fix(ci): use explicit lease in dependabot commit fix push [#8476](https://github.com/openshift/hypershift/pull/8476)
* [OCPBUGS-75887](https://issues.redhat.com/browse/OCPBUGS-75887): fix(inplaceupgrader): include node name in degraded upgrade error message [#8244](https://github.com/openshift/hypershift/pull/8244)
* NO-JIRA: fix(e2e): prevent agent unbinding and node reboots during backup/restore [#8356](https://github.com/openshift/hypershift/pull/8356)
* NO-JIRA: Update GHA docs for reusable workflow pattern [#8453](https://github.com/openshift/hypershift/pull/8453)
* [GCP-413](https://issues.redhat.com/browse/GCP-413): add image registry v2 e2e tests for hosted clusters [#8412](https://github.com/openshift/hypershift/pull/8412)
* NO-JIRA: docs: make CLAUDE.md a symlink to AGENTS.md across the repo [#8444](https://github.com/openshift/hypershift/pull/8444)
* [CNTRLPLANE-2778](https://issues.redhat.com/browse/CNTRLPLANE-2778): feat(tooling): overhaul pr-report skill and Python script [#7754](https://github.com/openshift/hypershift/pull/7754)
* [ACM-33601](https://issues.redhat.com/browse/ACM-33601): use the latest ubi9 nginx image [#8432](https://github.com/openshift/hypershift/pull/8432)
* [GCP-414](https://issues.redhat.com/browse/GCP-414): add image registry operational guide [#8455](https://github.com/openshift/hypershift/pull/8455)
* [OCPBUGS-84528](https://issues.redhat.com/browse/OCPBUGS-84528): clarify pull secret in-place update behavior and add CP watches [#8327](https://github.com/openshift/hypershift/pull/8327)
* [OCPBUGS-84955](https://issues.redhat.com/browse/OCPBUGS-84955): Add render-sensitive flag to `hypershift install render` [#8436](https://github.com/openshift/hypershift/pull/8436)
* [OCPBUGS-84857](https://issues.redhat.com/browse/OCPBUGS-84857): bump go builder and ubi images [#8437](https://github.com/openshift/hypershift/pull/8437)
* [GCP-410](https://issues.redhat.com/browse/GCP-410): fix(gcp): add registry SA WIF binding for image registry GCS access [#8445](https://github.com/openshift/hypershift/pull/8445)
* [CNTRLPLANE-3381](https://issues.redhat.com/browse/CNTRLPLANE-3381): CPO: Surface cloud resource deletion timeout as a status condition [#8426](https://github.com/openshift/hypershift/pull/8426)
* [OCPBUGS-85084](https://issues.redhat.com/browse/OCPBUGS-85084): fix(ci): rewrite dependabot commit messages to pass gitlint [#8435](https://github.com/openshift/hypershift/pull/8435)
* NO-JIRA: docs: detail release branch e2e config steps in branch-process guide [#8441](https://github.com/openshift/hypershift/pull/8441)
* [CNTRLPLANE-3222](https://issues.redhat.com/browse/CNTRLPLANE-3222): Migrate self-managed Azure e2e tests to v2 Ginkgo framework [#8204](https://github.com/openshift/hypershift/pull/8204)
* [GCP-412](https://issues.redhat.com/browse/GCP-412): add envtest cases for GCP imageRegistry CEL validation [#8411](https://github.com/openshift/hypershift/pull/8411)
* [CNTRLPLANE-2939](https://issues.redhat.com/browse/CNTRLPLANE-2939): Coordinate CRD lifecycle with Cluster CAPI Operator [#7996](https://github.com/openshift/hypershift/pull/7996)
* [OCPBUGS-77040](https://issues.redhat.com/browse/OCPBUGS-77040): Add AWS ISO domains to konnectivity IsCloudAPI [#8251](https://github.com/openshift/hypershift/pull/8251)
* [OCPBUGS-83328](https://issues.redhat.com/browse/OCPBUGS-83328): fix skipProxyForKAS to use standard NO_PROXY matching [#8254](https://github.com/openshift/hypershift/pull/8254)
* [OCPBUGS-84969](https://issues.redhat.com/browse/OCPBUGS-84969): fix(e2e): wait for Karpenter node cleanup in parallel tests to prevent vCPU flake [#8414](https://github.com/openshift/hypershift/pull/8414)
* [CNTRLPLANE-3343](https://issues.redhat.com/browse/CNTRLPLANE-3343): Extract support/k8sutil package from support/util [#8396](https://github.com/openshift/hypershift/pull/8396)
* [TRT-2653](https://issues.redhat.com/browse/TRT-2653): Revert #8357 "OCPBUGS-84572: fix(cpo): generate EBS CSI driver operator serving cert in CPO" [#8417](https://github.com/openshift/hypershift/pull/8417)
* NO-JIRA: chore(deps): weekly dependabot consolidation [#8410](https://github.com/openshift/hypershift/pull/8410)
* NO-JIRA: Skip TestKarpenter for releases < 4.22 [#8409](https://github.com/openshift/hypershift/pull/8409)
* [CNTRLPLANE-3351](https://issues.redhat.com/browse/CNTRLPLANE-3351): e2e: add opt-in CPU resource request overrides for control plane components [#8385](https://github.com/openshift/hypershift/pull/8385)
* [OCPBUGS-84509](https://issues.redhat.com/browse/OCPBUGS-84509): Add AWS LB Controller cross-zone load balancing annotation [#8344](https://github.com/openshift/hypershift/pull/8344)
* [OCPBUGS-84572](https://issues.redhat.com/browse/OCPBUGS-84572): fix(cpo): generate EBS CSI driver operator serving cert in CPO [#8357](https://github.com/openshift/hypershift/pull/8357)
* [OCPBUGS-81631](https://issues.redhat.com/browse/OCPBUGS-81631): fix(metrics): remove noisy vCPU log for non-AWS platforms [#8169](https://github.com/openshift/hypershift/pull/8169)
* NO-JIRA: Extend timeout for CRD removal during integration tests [#8366](https://github.com/openshift/hypershift/pull/8366)
* NO-JIRA: chore(deps): weekly dependabot consolidation [#8395](https://github.com/openshift/hypershift/pull/8395)
* [OCPBUGS-83868](https://issues.redhat.com/browse/OCPBUGS-83868): prevent IAM resource leaks during cluster destroy [#8303](https://github.com/openshift/hypershift/pull/8303)
* [GCP-635](https://issues.redhat.com/browse/GCP-635): feat(gcp): make JWKS file optional when OIDC issuer URL is provided [#8339](https://github.com/openshift/hypershift/pull/8339)
* [OCPBUGS-83757](https://issues.redhat.com/browse/OCPBUGS-83757): Remove network dependencies from unit tests [#8277](https://github.com/openshift/hypershift/pull/8277)
* ci(deps): bump actions/setup-go from 5.6.0 to 6.4.0 [#8393](https://github.com/openshift/hypershift/pull/8393)
* [OCPBUGS-84508](https://issues.redhat.com/browse/OCPBUGS-84508): Fix NLB name parsing for EKS Auto Mode hostnames [#8343](https://github.com/openshift/hypershift/pull/8343)
* [AUTOSCALE-615](https://issues.redhat.com/browse/AUTOSCALE-615): include Karpenter node vCPUs in billing metric [#8265](https://github.com/openshift/hypershift/pull/8265)
* [CNTRLPLANE-3352](https://issues.redhat.com/browse/CNTRLPLANE-3352): Convert GHA callers to use reusable workflows @main [#8387](https://github.com/openshift/hypershift/pull/8387)
* [CNTRLPLANE-3342](https://issues.redhat.com/browse/CNTRLPLANE-3342): Extract support/netutil package from support/util [#8360](https://github.com/openshift/hypershift/pull/8360)
* [CNTRLPLANE-3352](https://issues.redhat.com/browse/CNTRLPLANE-3352): Add reusable GHA workflow definitions [#8386](https://github.com/openshift/hypershift/pull/8386)
* [GCP-410](https://issues.redhat.com/browse/GCP-410): feat(gcp): add HCCO credential propagation for GCP image registry [#7896](https://github.com/openshift/hypershift/pull/7896)
* [OCPBUGS-84551](https://issues.redhat.com/browse/OCPBUGS-84551): fix(ingress): set FIPS_ENABLED env var on ingress operator [#8375](https://github.com/openshift/hypershift/pull/8375)
* [CNTRLPLANE-3307](https://issues.redhat.com/browse/CNTRLPLANE-3307): add unit tests for Azure Private Link Service controllers [#8285](https://github.com/openshift/hypershift/pull/8285)
* [CNTRLPLANE-3160](https://issues.redhat.com/browse/CNTRLPLANE-3160): Drop AutoNodeKarpenter feature gate and promote EC2NodeClass to v1 [#8166](https://github.com/openshift/hypershift/pull/8166)
* NO-JIRA: Improve commit and PR guidance in AGENTS.md [#8373](https://github.com/openshift/hypershift/pull/8373)
* [OCPBUGS-83790](https://issues.redhat.com/browse/OCPBUGS-83790): change Azure workload identity webhook FailurePolicy from Fail to Ignore [#8288](https://github.com/openshift/hypershift/pull/8288)
* NO-JIRA: chore(deps): weekly dependabot consolidation [#8334](https://github.com/openshift/hypershift/pull/8334)
* NO-JIRA: Add API dependency import restriction tool [#8364](https://github.com/openshift/hypershift/pull/8364)
* [SPLAT-2587](https://issues.redhat.com/browse/SPLAT-2587): aws/ccm: introduce configuration to CCM managed Security Groups for NLB [#7460](https://github.com/openshift/hypershift/pull/7460)
* NO-JIRA: add --max-depth flag to nav order verification [#8372](https://github.com/openshift/hypershift/pull/8372)
* NO-JIRA: Do not import external dependencies into API packages [#8355](https://github.com/openshift/hypershift/pull/8355)
* [CNTRLPLANE-3340](https://issues.redhat.com/browse/CNTRLPLANE-3340): Extract support/podspec package from support/util [#8354](https://github.com/openshift/hypershift/pull/8354)
* [OCPBUGS-84251](https://issues.redhat.com/browse/OCPBUGS-84251): fix(azure): detect and replace stale role assignments on cluster re-creation [#8322](https://github.com/openshift/hypershift/pull/8322)
* [OCPBUGS-84236](https://issues.redhat.com/browse/OCPBUGS-84236): Guard Infrastructure CR lookup in AWSEndpointServiceReconciler [#8315](https://github.com/openshift/hypershift/pull/8315)
* fix: OCPBUGS-78575: create virt-launcher NetworkPolicy on external infra cluster [#8056](https://github.com/openshift/hypershift/pull/8056)
* [CNTRLPLANE-3330](https://issues.redhat.com/browse/CNTRLPLANE-3330): ci: improve unit test speed with sharding and parallelism [#8330](https://github.com/openshift/hypershift/pull/8330)
* [CNTRLPLANE-3313](https://issues.redhat.com/browse/CNTRLPLANE-3313): add Etcd Snapshot Backup (Tech Preview) DR documentation [#8299](https://github.com/openshift/hypershift/pull/8299)
* [CNTRLPLANE-2834](https://issues.redhat.com/browse/CNTRLPLANE-2834): add e2e test for etcd snapshot backup method on AWS [#8231](https://github.com/openshift/hypershift/pull/8231)
* docs: NO-JIRA: clarify serialization tag behaviour in api/AGENTS.md [#8328](https://github.com/openshift/hypershift/pull/8328)
* And 2 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/hypershift/compare/c1a8bb61ff1472dda59c87bff202f1154976c6b7...f76be88237e1ae0c1c4df2e34d8b0f9eb8ec7953)
### [insights-operator](https://github.com/openshift/insights-operator/tree/0a21a2a7b8307657dee68faefb0d88db897da131)
* [OCPBUGS-85710](https://issues.redhat.com/browse/OCPBUGS-85710): add trusted-ca-bundle to gatherin job [#1289](https://github.com/openshift/insights-operator/pull/1289)
* [CCXDEV-16348](https://issues.redhat.com/browse/CCXDEV-16348): tls metrics [#1275](https://github.com/openshift/insights-operator/pull/1275)
* [OCPBUGS-77351](https://issues.redhat.com/browse/OCPBUGS-77351): fix: add terminationMessagePolicy to runtime extractor containers [#1286](https://github.com/openshift/insights-operator/pull/1286)
* NO-JIRA: remove BaiyangZhou from OWNERS [#1273](https://github.com/openshift/insights-operator/pull/1273)
* [OCPBUGS-85201](https://issues.redhat.com/browse/OCPBUGS-85201): Bump google.golang.org/grpc to v1.79.3 [#1288](https://github.com/openshift/insights-operator/pull/1288)
* NO-JIRA: Update golang version [#1277](https://github.com/openshift/insights-operator/pull/1277)
* NO-JIRA: add write-test claude skill [#1274](https://github.com/openshift/insights-operator/pull/1274)
* [Full changelog](https://github.com/openshift/insights-operator/compare/50525baf35e03113eae27e24ddfa6604fc0fd264...0a21a2a7b8307657dee68faefb0d88db897da131)
### [ironic](https://github.com/openshift/ironic-image/tree/323974b0aadc149d0dc29ca352b4be6c53b395d2)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#821](https://github.com/openshift/ironic-image/pull/821)
* [OCPBUGS-83618](https://issues.redhat.com/browse/OCPBUGS-83618): Bump sushy to latest [#838](https://github.com/openshift/ironic-image/pull/838)
* NO-ISSUE: Fix update requirements workflow [#842](https://github.com/openshift/ironic-image/pull/842)
* NO-ISSUE: Document how to use gerrit change hash for testing [#839](https://github.com/openshift/ironic-image/pull/839)
* [OKD-362](https://issues.redhat.com/browse/OKD-362): Add watchdog to python-requirements.okd [#837](https://github.com/openshift/ironic-image/pull/837)
* [Full changelog](https://github.com/openshift/ironic-image/compare/208ccd1666573f55b608475e53f9072175f9562f...323974b0aadc149d0dc29ca352b4be6c53b395d2)
### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/1e607137ca2e6f51a6f91c3402b0cd56f5d9bbe2)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#254](https://github.com/openshift/ironic-agent-image/pull/254)
* NO-ISSUE: Remove openstack repo workaround [#249](https://github.com/openshift/ironic-agent-image/pull/249)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#253](https://github.com/openshift/ironic-agent-image/pull/253)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#248](https://github.com/openshift/ironic-agent-image/pull/248)
* [METAL-1779](https://issues.redhat.com/browse/METAL-1779): Add podman package for bootc deploy [#247](https://github.com/openshift/ironic-agent-image/pull/247)
* NO-ISSUE: Fix update requirements workflow [#252](https://github.com/openshift/ironic-agent-image/pull/252)
* NO-ISSUE: Document how to use gerrit change hash for testing [#250](https://github.com/openshift/ironic-agent-image/pull/250)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/a4fe0c6bc7cbd63ced8b7dae96b6e90c160a3621...1e607137ca2e6f51a6f91c3402b0cd56f5d9bbe2)
### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/d7772c62914781cd312b5e6db24532d694a8a140)
* [OCPBUGS-85416](https://issues.redhat.com/browse/OCPBUGS-85416): Enable actuators to set terminal failure on Exists and Update [#1499](https://github.com/openshift/machine-api-operator/pull/1499)
* [SPLAT-2745](https://issues.redhat.com/browse/SPLAT-2745): Changed vSphere cloud config to be read from openshift-config-managed [#1495](https://github.com/openshift/machine-api-operator/pull/1495)
* [OCPBUGS-82584](https://issues.redhat.com/browse/OCPBUGS-82584): Populate status label selector for scale subresource. [#1490](https://github.com/openshift/machine-api-operator/pull/1490)
* NO-JIRA: machine-api-termination-handler: add scc annotation, terminationMessage: FallbackToLogsOnError [#1494](https://github.com/openshift/machine-api-operator/pull/1494)
* NO-JIRA: bump controller-runtime-common to latest main [#1493](https://github.com/openshift/machine-api-operator/pull/1493)
* NO-JIRA: fix: importing nutanix test to in the binary [#1491](https://github.com/openshift/machine-api-operator/pull/1491)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/498bb598ee6754b9aab51a5e731fc723bc3f60fe...d7772c62914781cd312b5e6db24532d694a8a140)
### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/61fdd56c3fa546cee22d4420f330e68956f61fd8)
* [OCPBUGS-79502](https://issues.redhat.com/browse/OCPBUGS-79502): Enable AutoSizingReserved for Hypershift workers [#5847](https://github.com/openshift/machine-config-operator/pull/5847)
* NO-JIRA: daemon: expand os image presence check [#6005](https://github.com/openshift/machine-config-operator/pull/6005)
* [MCO-2212](https://issues.redhat.com/browse/MCO-2212): MCO-2213: Migrate mco_observability and mco_daemon test-suite [#5875](https://github.com/openshift/machine-config-operator/pull/5875)
* [OCPBUGS-63650](https://issues.redhat.com/browse/OCPBUGS-63650): configure-ovs: copy lldp mode to br-ex port [#5698](https://github.com/openshift/machine-config-operator/pull/5698)
* [OCPBUGS-85498](https://issues.redhat.com/browse/OCPBUGS-85498): BareMetal skew e2e fails patching provisioning CR after CBO webhook fix [#6031](https://github.com/openshift/machine-config-operator/pull/6031)
* [OCPBUGS-85497](https://issues.redhat.com/browse/OCPBUGS-85497): only check password hash in /etc/shadow [#6030](https://github.com/openshift/machine-config-operator/pull/6030)
* NO-JIRA: Add fix for ossImagestream status [#6018](https://github.com/openshift/machine-config-operator/pull/6018)
* [MCO-2025](https://issues.redhat.com/browse/MCO-2025): OCP-88366 and add OCP-88814 for osImageStream with osImageURL [#6014](https://github.com/openshift/machine-config-operator/pull/6014)
* [OCPBUGS-83830](https://issues.redhat.com/browse/OCPBUGS-83830): Apply password only if changes exist [#5889](https://github.com/openshift/machine-config-operator/pull/5889)
* [AGENT-1514](https://issues.redhat.com/browse/AGENT-1514): Add ML-KEM verification test for IRI registry [#6003](https://github.com/openshift/machine-config-operator/pull/6003)
* [OCPBUGS-84516](https://issues.redhat.com/browse/OCPBUGS-84516): Add `terminationMessagePolicy` to build pod containers [#5993](https://github.com/openshift/machine-config-operator/pull/5993)
* [OCPBUGS-85117](https://issues.redhat.com/browse/OCPBUGS-85117): Fix 2 flakes happening in the ocl test suite [#6004](https://github.com/openshift/machine-config-operator/pull/6004)
* [OCPBUGS-84842](https://issues.redhat.com/browse/OCPBUGS-84842): Bootloader update attempt should be conditional [#5907](https://github.com/openshift/machine-config-operator/pull/5907)
* [OCPBUGS-75894](https://issues.redhat.com/browse/OCPBUGS-75894): use `--delete-if-present` for karg removal [#5914](https://github.com/openshift/machine-config-operator/pull/5914)
* [OCPBUGS-84661](https://issues.redhat.com/browse/OCPBUGS-84661): Fix wrong early exit during kubelet MCs regeneration [#5898](https://github.com/openshift/machine-config-operator/pull/5898)
* [AGENT-1443](https://issues.redhat.com/browse/AGENT-1443): IRI Add certificate regeneration to MCS cert rotation controller [#5721](https://github.com/openshift/machine-config-operator/pull/5721)
* [OCPBUGS-84691](https://issues.redhat.com/browse/OCPBUGS-84691): prom rules: add alert for nodes using runc [#5874](https://github.com/openshift/machine-config-operator/pull/5874)
* [MCO-1908](https://issues.redhat.com/browse/MCO-1908), [MCO-2213](https://issues.redhat.com/browse/MCO-2213): Migrate MCD related MCO test-cases [#5843](https://github.com/openshift/machine-config-operator/pull/5843)
* [OCPBUGS-84867](https://issues.redhat.com/browse/OCPBUGS-84867): Fix OCL test to handle temporarily empty current-machine-os-build annotation [#5913](https://github.com/openshift/machine-config-operator/pull/5913)
* [OCPBUGS-84832](https://issues.redhat.com/browse/OCPBUGS-84832): daemon: don't pull/extract extensions for all OS updates [#5905](https://github.com/openshift/machine-config-operator/pull/5905)
* [OCPBUGS-84852](https://issues.redhat.com/browse/OCPBUGS-84852): Update AMI Whitelist [#5910](https://github.com/openshift/machine-config-operator/pull/5910)
* [OCPBUGS-84150](https://issues.redhat.com/browse/OCPBUGS-84150): MachineOSConfig "build was not found" error [#5878](https://github.com/openshift/machine-config-operator/pull/5878)
* [OCPBUGS-84699](https://issues.redhat.com/browse/OCPBUGS-84699): Custom pool booting must handle matchExpressions in nodeSelector [#5899](https://github.com/openshift/machine-config-operator/pull/5899)
* [OCPBUGS-84565](https://issues.redhat.com/browse/OCPBUGS-84565): Fix CVE-2026-34986 [#5890](https://github.com/openshift/machine-config-operator/pull/5890)
* [OCPBUGS-83871](https://issues.redhat.com/browse/OCPBUGS-83871): Support bootloader update [#5868](https://github.com/openshift/machine-config-operator/pull/5868)
* [OCPBUGS-84332](https://issues.redhat.com/browse/OCPBUGS-84332): Fix ssh and password rollbacks [#5884](https://github.com/openshift/machine-config-operator/pull/5884)
* [MCO-2222](https://issues.redhat.com/browse/MCO-2222): /automate-test skill for generating e2e tests from specifications [#5864](https://github.com/openshift/machine-config-operator/pull/5864)
* [OCPBUGS-84652](https://issues.redhat.com/browse/OCPBUGS-84652): Include RootCA in the temporal CC [#5896](https://github.com/openshift/machine-config-operator/pull/5896)
* [OCPBUGS-83492](https://issues.redhat.com/browse/OCPBUGS-83492): Auto-append :ref suffix to additionalLayerStores in storage.conf [#5888](https://github.com/openshift/machine-config-operator/pull/5888)
* [OCPBUGS-83826](https://issues.redhat.com/browse/OCPBUGS-83826): deploy-from-self when skopeo < 1.22.2 [#5867](https://github.com/openshift/machine-config-operator/pull/5867)
* [OCPBUGS-84490](https://issues.redhat.com/browse/OCPBUGS-84490): Bump image build timeout for status reporting test [#5886](https://github.com/openshift/machine-config-operator/pull/5886)
* [MCO-2201](https://issues.redhat.com/browse/MCO-2201): Improve /migrate-tests skill: default labels and ordering verification [#5879](https://github.com/openshift/machine-config-operator/pull/5879)
* [OCPBUGS-83859](https://issues.redhat.com/browse/OCPBUGS-83859): Fix encapsulated IGN version [#5872](https://github.com/openshift/machine-config-operator/pull/5872)
* [MCO-1494](https://issues.redhat.com/browse/MCO-1494): Remove monolithic e2e-ocl test suite [#5880](https://github.com/openshift/machine-config-operator/pull/5880)
* [AGENT-1449](https://issues.redhat.com/browse/AGENT-1449): Add IRI registry authentication support to MCO [#5765](https://github.com/openshift/machine-config-operator/pull/5765)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/b5d168576877cda02f8c8764b49a98fda23df825...61fdd56c3fa546cee22d4420f330e68956f61fd8)
### [machine-os-images](https://github.com/openshift/machine-os-images/tree/ef8f5dd772cf24201b6e308eee0fa3e7b1860c32)
* [OCPBUGS-85476](https://issues.redhat.com/browse/OCPBUGS-85476): Force rebuild for OCP 5.0 [#87](https://github.com/openshift/machine-os-images/pull/87)
* [METAL-1786](https://issues.redhat.com/browse/METAL-1786): Include RHEL10 in image [#82](https://github.com/openshift/machine-os-images/pull/82)
* [Full changelog](https://github.com/openshift/machine-os-images/compare/df9a652cb1572172e404655bb021525be2e3d8ab...ef8f5dd772cf24201b6e308eee0fa3e7b1860c32)
### [metallb-frr](https://github.com/openshift/frr/tree/3aee1774c5a84410362b5f79039a7ca2b0281ab4)
* Bump to frr 10 [#127](https://github.com/openshift/frr/pull/127)
* [Full changelog](https://github.com/openshift/frr/compare/210c63f7ec61bd3377796518a755d617d8f6ca04...3aee1774c5a84410362b5f79039a7ca2b0281ab4)
### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/095e06580abfc4487ef9f2969fd1d7693c7e6b40)
* [OU-1269](https://issues.redhat.com/browse/OU-1269): Update monitoring-console-plugin for 4.22 [#923](https://github.com/openshift/monitoring-plugin/pull/923)
* [OU-1281](https://issues.redhat.com/browse/OU-1281): show disabled project bar while loading [#936](https://github.com/openshift/monitoring-plugin/pull/936)
* [OU-1351](https://issues.redhat.com/browse/OU-1351): prevent namespace and project desync [#933](https://github.com/openshift/monitoring-plugin/pull/933)
* [OU-1315](https://issues.redhat.com/browse/OU-1315): reset queries when namespace changes in dev perspective [#932](https://github.com/openshift/monitoring-plugin/pull/932)
* [OU-1348](https://issues.redhat.com/browse/OU-1348): fix: panel actions index so they are visible on click [#928](https://github.com/openshift/monitoring-plugin/pull/928)
* [OU-1347](https://issues.redhat.com/browse/OU-1347): fix: avoid throwing error to fallback to global datasource [#920](https://github.com/openshift/monitoring-plugin/pull/920)
* [OU-1203](https://issues.redhat.com/browse/OU-1203): upgrade perses dependencies [#914](https://github.com/openshift/monitoring-plugin/pull/914)
* NO-JIRA: Revert "NO-JIRA: Bump to 4.22.0-prerelease.3 SDK" [#915](https://github.com/openshift/monitoring-plugin/pull/915)
* NO-JIRA: Bump to 4.22.0-prerelease.3 SDK [#903](https://github.com/openshift/monitoring-plugin/pull/903)
* [OU-1323](https://issues.redhat.com/browse/OU-1323): Refactor dashboards state to prevent desync [#912](https://github.com/openshift/monitoring-plugin/pull/912)
* [OU-1341](https://issues.redhat.com/browse/OU-1341): pass label values to the filter [#913](https://github.com/openshift/monitoring-plugin/pull/913)
* [OU-1091](https://issues.redhat.com/browse/OU-1091): swap monitoring-plugin to use DataView [#911](https://github.com/openshift/monitoring-plugin/pull/911)
* NO-JIRA: update perses and fix vulnerable dependencies [#900](https://github.com/openshift/monitoring-plugin/pull/900)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/be776a65f83ca87750eacbd932850ee9d79c9ec9...095e06580abfc4487ef9f2969fd1d7693c7e6b40)
### [multus-admission-controller](https://github.com/openshift/multus-admission-controller/tree/12d99f3f29fe38f900d0c6400889e3d58c588f45)
* [OCPBUGS-85053](https://issues.redhat.com/browse/OCPBUGS-85053): Bump Go version to 1.25.0 for ML-KEM/PQC support [#115](https://github.com/openshift/multus-admission-controller/pull/115)
* [Full changelog](https://github.com/openshift/multus-admission-controller/compare/16ba7ef8026f5b6d0d08b19c707648d82b1ac592...12d99f3f29fe38f900d0c6400889e3d58c588f45)
### [must-gather](https://github.com/openshift/must-gather/tree/56f0500399d17002c0d00d5d785b153cb876a8af)
* no-jira: chore: address the linting issues in the scripts [#525](https://github.com/openshift/must-gather/pull/525)
* [Full changelog](https://github.com/openshift/must-gather/compare/eacc65630bea5c7711c2e3be00987634563f0ce5...56f0500399d17002c0d00d5d785b153cb876a8af)
### [network-tools](https://github.com/openshift/network-tools/tree/4ce8439203bef4c64c11151f57818e8df370c103)
* NO-JIRA: Add mattedallo, marty-power, taanyas as reviewers [#172](https://github.com/openshift/network-tools/pull/172)
* NO-JIRA: Refresh list of team members [#176](https://github.com/openshift/network-tools/pull/176)
* NO-JIRA: Updates to handle changes after migrating to Atlasian cloud [#174](https://github.com/openshift/network-tools/pull/174)
* [Full changelog](https://github.com/openshift/network-tools/compare/5c4b905c09ccd6edadb2ff359f45b70ed334f948...4ce8439203bef4c64c11151f57818e8df370c103)
### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/068135467727be49b9fc1e8be569e0017bcb131c)
* [CONSOLE-5218](https://issues.redhat.com/browse/CONSOLE-5218): Add project documentation and rewrite README [#417](https://github.com/openshift/networking-console-plugin/pull/417)
* [CNV-74110](https://issues.redhat.com/browse/CNV-74110): new translations [#404](https://github.com/openshift/networking-console-plugin/pull/404)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/3c14efddf24733090d189ce679e24030c104bfba...068135467727be49b9fc1e8be569e0017bcb131c)
### [oauth-apiserver](https://github.com/openshift/oauth-apiserver/tree/28a74a705787bb1e1ba6445397a8805ae878f326)
* [CNTRLPLANE-2516](https://issues.redhat.com/browse/CNTRLPLANE-2516): feat: externaloidc: add support for externally sourcing claims [#195](https://github.com/openshift/oauth-apiserver/pull/195)
* [CNTRLPLANE-2516](https://issues.redhat.com/browse/CNTRLPLANE-2516): Add local configuration API for external oidc mode [#194](https://github.com/openshift/oauth-apiserver/pull/194)
* NO-JIRA: Add control-plane-approvers to OWNERS [#192](https://github.com/openshift/oauth-apiserver/pull/192)
* [Full changelog](https://github.com/openshift/oauth-apiserver/compare/044a0eef2cad62b7050616df64cc94012cc3016a...28a74a705787bb1e1ba6445397a8805ae878f326)
### [oc-mirror](https://github.com/openshift/oc-mirror/tree/2412d1aa75f5115ca2c013502209a8a427998b29)
* [CLID-623](https://issues.redhat.com/browse/CLID-623): Encapsulate unit test data into tests/unit [#1407](https://github.com/openshift/oc-mirror/pull/1407)
* [CLID-479](https://issues.redhat.com/browse/CLID-479): OTE migration [#1375](https://github.com/openshift/oc-mirror/pull/1375)
* NO-JIRA: Update README.md for Enclave Support link [#1404](https://github.com/openshift/oc-mirror/pull/1404)
* [CLID-612](https://issues.redhat.com/browse/CLID-612): Move integration tests within oc-mirror [#1400](https://github.com/openshift/oc-mirror/pull/1400)
* [CLID-592](https://issues.redhat.com/browse/CLID-592): pkg/cli: add unit tests for environment setup [#1391](https://github.com/openshift/oc-mirror/pull/1391)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/ca5eebdcecf9650248f15fe6009b22788ba0c434...2412d1aa75f5115ca2c013502209a8a427998b29)
### [olm-catalogd, olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller/tree/1675d191d56bb4bca0f7b1112aa4199df1c3c67e)
* [OCPBUGS-85508](https://issues.redhat.com/browse/OCPBUGS-85508): Synchronize From Upstream Repositories [#725](https://github.com/openshift/operator-framework-operator-controller/pull/725)
* NO-ISSUE: Synchronize From Upstream Repositories [#724](https://github.com/openshift/operator-framework-operator-controller/pull/724)
* NO-ISSUE: Synchronize From Upstream Repositories [#722](https://github.com/openshift/operator-framework-operator-controller/pull/722)
* [OCPBUGS-62517](https://issues.redhat.com/browse/OCPBUGS-62517): Set replicas=1, PDB, and pod anti-affinity for HA topology [#709](https://github.com/openshift/operator-framework-operator-controller/pull/709)
* [OCPBUGS-84943](https://issues.redhat.com/browse/OCPBUGS-84943): fix(test): drop blocking namespace-deletion wait between both-watch-modes scenarios [#712](https://github.com/openshift/operator-framework-operator-controller/pull/712)
* [OCPBUGS-62517](https://issues.redhat.com/browse/OCPBUGS-62517): Synchronize from Upstream Repositories [#710](https://github.com/openshift/operator-framework-operator-controller/pull/710)
* NO-ISSUE: UPSTREAM: <carry>: remove dead e2e registry push job and related variables [#711](https://github.com/openshift/operator-framework-operator-controller/pull/711)
* [OPRUN-4587](https://issues.redhat.com/browse/OPRUN-4587): Make OTE local output easier to read [#704](https://github.com/openshift/operator-framework-operator-controller/pull/704)
* NO-ISSUE: Synchronize From Upstream Repositories [#707](https://github.com/openshift/operator-framework-operator-controller/pull/707)
* [Full changelog](https://github.com/openshift/operator-framework-operator-controller/compare/9b9eb03268722fe2c05e05f9c96a11ac8079bb87...1675d191d56bb4bca0f7b1112aa4199df1c3c67e)
### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/999dd5aefb3efef7ff26105b3208f7fc04ff5b06)
* [OCPBUGS-38120](https://issues.redhat.com/browse/OCPBUGS-38120): Ensure Project delete requests are passed through admission [#632](https://github.com/openshift/openshift-apiserver/pull/632)
* NO-JIRA: Add control-plane-approvers to OWNERS [#630](https://github.com/openshift/openshift-apiserver/pull/630)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/8afd81a2db634c552a0842721d218a75eadae4d6...999dd5aefb3efef7ff26105b3208f7fc04ff5b06)
### [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager/tree/731d7429a788e0d70e3556e40f82c1ba9d55abe7)
* NO-JIRA: Add control-plane-approvers to OWNERS [#438](https://github.com/openshift/openshift-controller-manager/pull/438)
* [Full changelog](https://github.com/openshift/openshift-controller-manager/compare/26d20feae8892f648f5b06ed3f5492fe6ffb4532...731d7429a788e0d70e3556e40f82c1ba9d55abe7)
### [openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/3e411dcd9507ad2ad63362b44f7140b1db6ed243)
* UPSTREAM-SYNC: Sync main with latest upstream (release-1.35) [#370](https://github.com/openshift/cloud-provider-openstack/pull/370)
* [OCPBUGS-77578](https://issues.redhat.com/browse/OCPBUGS-77578): Updating ose-openstack-cinder-csi-driver-container image to be consistent with ART for 4.22 [#374](https://github.com/openshift/cloud-provider-openstack/pull/374)
* [OCPBUGS-77755](https://issues.redhat.com/browse/OCPBUGS-77755): Updating ose-openstack-cloud-controller-manager-container image to be consistent with ART for 4.22 [#376](https://github.com/openshift/cloud-provider-openstack/pull/376)
* [OCPBUGS-77592](https://issues.redhat.com/browse/OCPBUGS-77592): Updating csi-driver-manila-container image to be consistent with ART for 4.22 [#375](https://github.com/openshift/cloud-provider-openstack/pull/375)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/fd31b5da11d75a7a80e7c4a6c7a56acf304e2661...3e411dcd9507ad2ad63362b44f7140b1db6ed243)
### [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack/tree/4bc7bc64a57f67992ad074c55d4e8e57fe5ec2ea)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#416](https://github.com/openshift/cluster-api-provider-openstack/pull/416)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#408](https://github.com/openshift/cluster-api-provider-openstack/pull/408)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.14 into main [#390](https://github.com/openshift/cluster-api-provider-openstack/pull/390)
* NO-JIRA: Update manifests generator [#411](https://github.com/openshift/cluster-api-provider-openstack/pull/411)
* [OCPBUGS-77542](https://issues.redhat.com/browse/OCPBUGS-77542): Updating openstack-cluster-api-controllers-container image to be consistent with ART for 4.22 [#399](https://github.com/openshift/cluster-api-provider-openstack/pull/399)
* [Full changelog](https://github.com/openshift/cluster-api-provider-openstack/compare/74cb5b085a21fdec9f0f8c5c1dfa3933075fb1dc...4bc7bc64a57f67992ad074c55d4e8e57fe5ec2ea)
### [openstack-resource-controller](https://github.com/openshift/openstack-resource-controller/tree/e49b431fe3ab045c9a37f3f0f9ecb625ab699dd2)
* UPSTREAM-SYNC:Merge https://github.com/k-orc/openstack-resource-controller:release-1.0 into main [#20](https://github.com/openshift/openstack-resource-controller/pull/20)
* [Full changelog](https://github.com/openshift/openstack-resource-controller/compare/cbea7a9cab145c32e2f347be69996b649893cc22...e49b431fe3ab045c9a37f3f0f9ecb625ab699dd2)
### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/754d45a5855c46aad0842bedbca0780bb5184f68)
* NO-ISSUE: Synchronize From Upstream Repositories [#1298](https://github.com/openshift/operator-framework-olm/pull/1298)
* [OPRUN-4601](https://issues.redhat.com/browse/OPRUN-4601): use resource-based RBAC for lifecycle-server auth [#1290](https://github.com/openshift/operator-framework-olm/pull/1290)
* [OCPBUGS-84642](https://issues.redhat.com/browse/OCPBUGS-84642): Synchronize From Upstream Repositories [#1291](https://github.com/openshift/operator-framework-olm/pull/1291)
* [OPRUN-4597](https://issues.redhat.com/browse/OPRUN-4597): Fix lifecycle-server readiness probe to allow empty index [#1288](https://github.com/openshift/operator-framework-olm/pull/1288)
* [OPRUN-4541](https://issues.redhat.com/browse/OPRUN-4541), [OPRUN-4544](https://issues.redhat.com/browse/OPRUN-4544): add lifecycle-server for serving FBC catalog lifecycle metadata [#1284](https://github.com/openshift/operator-framework-olm/pull/1284)
* NO-ISSUE: Synchronize From Upstream Repositories [#1286](https://github.com/openshift/operator-framework-olm/pull/1286)
* NO-ISSUE: Synchronize From Upstream Repositories [#1282](https://github.com/openshift/operator-framework-olm/pull/1282)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/122728c856e9436ea5ab763bf57977047691bb90...754d45a5855c46aad0842bedbca0780bb5184f68)
### [operator-marketplace](https://github.com/operator-framework/operator-marketplace/tree/4ff8a12f5885e93ffdbd8039f78c7725492f6ffa)
* NO-ISSUE: Bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1 [#747](https://github.com/operator-framework/operator-marketplace/pull/747)
* NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.28.1 to 2.28.3 [#746](https://github.com/operator-framework/operator-marketplace/pull/746)
* [Full changelog](https://github.com/operator-framework/operator-marketplace/compare/4cc7c72487269f0e29fcf48e8d4aa579facbeb6e...4ff8a12f5885e93ffdbd8039f78c7725492f6ffa)
### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/a9a7b4e7538cc49df30ee49ec2c4e2c3b98dffab)
* [TRT-2652](https://issues.redhat.com/browse/TRT-2652): Allow OTE info and list tests commands to work without KUBECONFIG [#3170](https://github.com/openshift/ovn-kubernetes/pull/3170)
* NO-JIRA: DownStream Merge [04-30-2026] [#3169](https://github.com/openshift/ovn-kubernetes/pull/3169)
* NO-JIRA: DownStream Merge [04-27-2026] [#3159](https://github.com/openshift/ovn-kubernetes/pull/3159)
* NO-JIRA: OTE: run EVPN external traffic tests which use random subnet for VTEP [#3148](https://github.com/openshift/ovn-kubernetes/pull/3148)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/aaa4085f32001c72a7f02557aae8ded035deb341...a9a7b4e7538cc49df30ee49ec2c4e2c3b98dffab)
### [prom-label-proxy](https://github.com/openshift/prom-label-proxy/tree/ce91b7a51d1aee390a70e3c418e0f5539ad117c5)
* NO-ISSUE: [bot] Bump openshift/prom-label-proxy to v0.13.0 [#394](https://github.com/openshift/prom-label-proxy/pull/394)
* [Full changelog](https://github.com/openshift/prom-label-proxy/compare/c4c99a3071808f466ee6c3d7b7fa87108b457feb...ce91b7a51d1aee390a70e3c418e0f5539ad117c5)
### [prometheus](https://github.com/openshift/prometheus/tree/d9a07e053e734f6da2520be60bcd043693c47c54)
* NO-JIRA: Upgrade Prometheus to 3.11.2 [#305](https://github.com/openshift/prometheus/pull/305)
* [Full changelog](https://github.com/openshift/prometheus/compare/e1e355916c789607fe98c8832920e2218de4bad5...d9a07e053e734f6da2520be60bcd043693c47c54)
### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/4b911714a57e8a6959b95efaff939af29a2b249c)
* NO-ISSUE: remove ui/app/dist/.build_stamp [#133](https://github.com/openshift/prometheus-alertmanager/pull/133)
* NO-ISSUE: [bot] Bump openshift/prometheus-alertmanager to v0.32.1 [#132](https://github.com/openshift/prometheus-alertmanager/pull/132)
* [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/50fcc4ab67dade22a3e1afa4e315e56360b2e3c4...4b911714a57e8a6959b95efaff939af29a2b249c)
### [prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator/tree/7546381db866dd10a33395d2c28ceeca3c1c1591)
* NO-ISSUE: [bot] Bump openshift/prometheus-operator to v0.91.0 [#380](https://github.com/openshift/prometheus-operator/pull/380)
* [Full changelog](https://github.com/openshift/prometheus-operator/compare/70e38466b9b9143f48283dab8bd0c227f35efe69...7546381db866dd10a33395d2c28ceeca3c1c1591)
### [rhel-coreos-10, rhel-coreos-10-extensions](https://github.com/openshift/os/tree/f41264dc5f1c1f0a389787ecc5aaec573d485b8e)
* NO-JIRA: Revert "OCPBUGS-77244: 9.8: override runc package to pull in newer fixes" [#1925](https://github.com/openshift/os/pull/1925)
* [OCPBUGS-64841](https://issues.redhat.com/browse/OCPBUGS-64841): post-process: Remove workaround for openvswitch additional group [#1918](https://github.com/openshift/os/pull/1918)
* [OCPBUGS-77244](https://issues.redhat.com/browse/OCPBUGS-77244): 9.8: override runc package to pull in newer fixes [#1923](https://github.com/openshift/os/pull/1923)
* NO-JIRA: extensions: Add rhel-9.8-server-ose-4.22 [#1910](https://github.com/openshift/os/pull/1910)
* NO-JIRA: tests: add openshift tag [#1906](https://github.com/openshift/os/pull/1906)
* [COS-3912](https://issues.redhat.com/browse/COS-3912): denylist: drop rhcos.network.init-interfaces-test [#1900](https://github.com/openshift/os/pull/1900)
* NO-JIRA: OWNERS: Add angelcerveraroldan [#1883](https://github.com/openshift/os/pull/1883)
* NO-JIRA: Rename extensions/Dockerfile to Containerfile [#1896](https://github.com/openshift/os/pull/1896)
* NO-JIRA: packages-openshift: Fix repo versions [#1895](https://github.com/openshift/os/pull/1895)
* NO-JIRA: extensions: add a label for extensions image discovery [#1894](https://github.com/openshift/os/pull/1894)
* [COS-3900](https://issues.redhat.com/browse/COS-3900): Start using rhel-10.2 [#1892](https://github.com/openshift/os/pull/1892)
* NO-JIRA: rhaos-pkgs-match-openshift: exclude known package mismatches [#1891](https://github.com/openshift/os/pull/1891)
* No-JIRA: move the OKD SIG repo to 4.22 [#1890](https://github.com/openshift/os/pull/1890)
* NO-JIRA: OWNERS: add user `Rolv-Apneseth` [#1882](https://github.com/openshift/os/pull/1882)
* NO-JIRA: Update to track 4.22 and rhel-9.8 [#1881](https://github.com/openshift/os/pull/1881)
* NO-JIRA: rhel-10.1: enable rhel-10.1-fast-datapath [#1885](https://github.com/openshift/os/pull/1885)
* NO-JIRA: packages-openshift: enable rhel-10.1-fast-datapath [#1884](https://github.com/openshift/os/pull/1884)
* [OCPNODE-4010](https://issues.redhat.com/browse/OCPNODE-4010): package: add ose-crio-credential-provider [#1879](https://github.com/openshift/os/pull/1879)
* [OCPBUGS-70162](https://issues.redhat.com/browse/OCPBUGS-70162): extensions/rhel-10.1: Re-enable ipsec [#1878](https://github.com/openshift/os/pull/1878)
* NO-JIRA: drop use of rhel-9.6-appstream-containernetworking repo [#1877](https://github.com/openshift/os/pull/1877)
* And 3 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/os/compare/10f1a2e738aa55fff22dbe0346609e83a5f6eb90...f41264dc5f1c1f0a389787ecc5aaec573d485b8e)
### [service-ca-operator](https://github.com/openshift/service-ca-operator/tree/e7ccfa308e69ce4ad1f2afcd1d7c8ff25144374b)
* [CNTRLPLANE-2894](https://issues.redhat.com/browse/CNTRLPLANE-2894): e2e network policy test cases [#338](https://github.com/openshift/service-ca-operator/pull/338)
* NO-JIRA: Add control-plane-approvers to OWNERS [#345](https://github.com/openshift/service-ca-operator/pull/345)
* [Full changelog](https://github.com/openshift/service-ca-operator/compare/95674f775bcff10cfec79a61a0e3451e4c48eb71...e7ccfa308e69ce4ad1f2afcd1d7c8ff25144374b)
### [telemeter](https://github.com/openshift/telemeter/tree/33073dc20ca6c534c134f6a0f58e6bf8e162d4ac)
* [OCPBUGS-85082](https://issues.redhat.com/browse/OCPBUGS-85082): update google.golang.org/grpc [#601](https://github.com/openshift/telemeter/pull/601)
* NO-ISSUE: add .coderabbit.yaml [#603](https://github.com/openshift/telemeter/pull/603)
* NO-ISSUE: bump golangci-lint to v2.11.3 [#602](https://github.com/openshift/telemeter/pull/602)
* NO-ISSUE: update OWNERS [#604](https://github.com/openshift/telemeter/pull/604)
* [OCPBUGS-84383](https://issues.redhat.com/browse/OCPBUGS-84383): fix(deps): bump go-jose/v3 to v3.0.5 for JWE unwrap DoS [#588](https://github.com/openshift/telemeter/pull/588)
* [Full changelog](https://github.com/openshift/telemeter/compare/d6c7dd499f7106df78aa8bfd9dee332121ab2f09...33073dc20ca6c534c134f6a0f58e6bf8e162d4ac)
### [tests](https://github.com/openshift/origin/tree/38c4fba02e693db87295168e77400fab917555a3)
* [OCPBUGS-85370](https://issues.redhat.com/browse/OCPBUGS-85370): Raise OpenStack operator watch limits [#31154](https://github.com/openshift/origin/pull/31154)
* [OCPBUGS-85363](https://issues.redhat.com/browse/OCPBUGS-85363): Fixed flakiness of oc set image E2E tests [#31152](https://github.com/openshift/origin/pull/31152)
* [OCPBUGS-85058](https://issues.redhat.com/browse/OCPBUGS-85058): monitortests: allow etcd CO blips during TNF jobs on two-node upgrades [#31138](https://github.com/openshift/origin/pull/31138)
* [OCPBUGS-85486](https://issues.redhat.com/browse/OCPBUGS-85486): stage the creation of test pods to minimize etcd impact [#31164](https://github.com/openshift/origin/pull/31164)
* [OCPNODE-4505](https://issues.redhat.com/browse/OCPNODE-4505): Automation creation of OCP-57401 [#31142](https://github.com/openshift/origin/pull/31142)
* [OCPBUGS-83623](https://issues.redhat.com/browse/OCPBUGS-83623): fix: add distruption tolerance for DualReplica (two-node) topology [#31127](https://github.com/openshift/origin/pull/31127)
* [OCPBUGS-85531](https://issues.redhat.com/browse/OCPBUGS-85531): Fixed flakiness in OCP E2E tests - oc debug image stream [#31168](https://github.com/openshift/origin/pull/31168)
* Revert "OPRUN-4569: test: remove OTE exceptions for OLM" [#31171](https://github.com/openshift/origin/pull/31171)
* [OCPNODE-4108](https://issues.redhat.com/browse/OCPNODE-4108): add E2E tests for upstream dra-example-driver [#31064](https://github.com/openshift/origin/pull/31064)
* [OPRUN-4569](https://issues.redhat.com/browse/OPRUN-4569): test: remove OTE exceptions for OLM [#31150](https://github.com/openshift/origin/pull/31150)
* [OCPEDGE-2386](https://issues.redhat.com/browse/OCPEDGE-2386): Add tnf_etcd_disruption test with 5 new etcd resilience tests. [#30880](https://github.com/openshift/origin/pull/30880)
* NO-JIRA: Improve graceful shutdown LB test output with more details of late requests [#31158](https://github.com/openshift/origin/pull/31158)
* [OCPNODE-4047](https://issues.redhat.com/browse/OCPNODE-4047): Implement kubelet TLS 1.3 via KubeletConfig on workers [#31016](https://github.com/openshift/origin/pull/31016)
* NO-ISSUE: Automated - Update synthetic test data [#31146](https://github.com/openshift/origin/pull/31146)
* [CNTRLPLANE-3374](https://issues.redhat.com/browse/CNTRLPLANE-3374): remove multus exception from monitor test [#31130](https://github.com/openshift/origin/pull/31130)
* [CNTRLPLANE-3428](https://issues.redhat.com/browse/CNTRLPLANE-3428): tls: extract annotation and ConfigMap update helpers [#31156](https://github.com/openshift/origin/pull/31156)
* [OCPBUGS-83580](https://issues.redhat.com/browse/OCPBUGS-83580): Skip dev fuse test on runc runtime [#31140](https://github.com/openshift/origin/pull/31140)
* [OCPBUGS-84516](https://issues.redhat.com/browse/OCPBUGS-84516): remove openshift-machine-config-operator exemption from terminationMessagePolicy monitor [#31120](https://github.com/openshift/origin/pull/31120)
* [CNTRLPLANE-3387](https://issues.redhat.com/browse/CNTRLPLANE-3387): Update list of pending namespaces in the required-scc monitor test [#31135](https://github.com/openshift/origin/pull/31135)
* NO-ISSUE: improve error reporting in cpumetriccollector [#31132](https://github.com/openshift/origin/pull/31132)
* no-jira: tls: deduplicate ConfigMap helpers into standalone functions [#31136](https://github.com/openshift/origin/pull/31136)
* [OCPBUGS-84500](https://issues.redhat.com/browse/OCPBUGS-84500): Verify dynamic revision bump for etcd during kernel crash [#30915](https://github.com/openshift/origin/pull/30915)
* [OCPNODE-3983](https://issues.redhat.com/browse/OCPNODE-3983): Add e2e tests for KubeletEnsureSecretPulledImages feature gate [#31102](https://github.com/openshift/origin/pull/31102)
* [OCPNODE-4381](https://issues.redhat.com/browse/OCPNODE-4381): Migrate OCP-38271 from openshift-tests-private [#30960](https://github.com/openshift/origin/pull/30960)
* [OCPBUGS-85087](https://issues.redhat.com/browse/OCPBUGS-85087): Allow OVN-Kubernetes CIDROverlap pathological events [#31131](https://github.com/openshift/origin/pull/31131)
* NO-JIRA: Increase pathological event thresholds for API server rollout scenarios [#31122](https://github.com/openshift/origin/pull/31122)
* [CNTRLPLANE-2554](https://issues.redhat.com/browse/CNTRLPLANE-2554): Add ExternalOIDCWithUpstreamParity e2e tests [#31028](https://github.com/openshift/origin/pull/31028)
* : no-jira: tls: extract injectTLSAnnotation constant [#31125](https://github.com/openshift/origin/pull/31125)
* [OCPSTRAT-3036](https://issues.redhat.com/browse/OCPSTRAT-3036): Update etcd test data for k8s 1.36 release [#31113](https://github.com/openshift/origin/pull/31113)
* [OCPNODE-4043](https://issues.redhat.com/browse/OCPNODE-4043): Fix NVIDIA DRA driver helm repo configuration [#31104](https://github.com/openshift/origin/pull/31104)
* [TRT-2644](https://issues.redhat.com/browse/TRT-2644): Run CP tests everywhere [#31094](https://github.com/openshift/origin/pull/31094)
* NO-JIRA: Remove fixed bugs on CO conditions [#31081](https://github.com/openshift/origin/pull/31081)
* [OCPBUGS-84831](https://issues.redhat.com/browse/OCPBUGS-84831): Optimize NetworkPolicy reconciliation test to reduce timeout [#31114](https://github.com/openshift/origin/pull/31114)
* NO-ISSUE: Automated - Update synthetic test data [#31109](https://github.com/openshift/origin/pull/31109)
* [OCPBUGS-84809](https://issues.redhat.com/browse/OCPBUGS-84809): Disable particular CSI tests if CSI driver is removed [#31107](https://github.com/openshift/origin/pull/31107)
* NO-JIRA: check jobname for upgrade [#31106](https://github.com/openshift/origin/pull/31106)
* [OCPBUGS-84520](https://issues.redhat.com/browse/OCPBUGS-84520): remove openshift-catalogd exemption from terminationMessagePolicy monitor [#31100](https://github.com/openshift/origin/pull/31100)
* [OCPNODE-2994](https://issues.redhat.com/browse/OCPNODE-2994): Add ArtifactVolume tests and register artifact image [#31017](https://github.com/openshift/origin/pull/31017)
* NO-ISSUE: add QSEs as approvers [#31087](https://github.com/openshift/origin/pull/31087)
* [SPLAT-2562](https://issues.redhat.com/browse/SPLAT-2562): Added 3CMO OTE binary to extensionBinary list [#31004](https://github.com/openshift/origin/pull/31004)
* [OCPCLOUD-3429](https://issues.redhat.com/browse/OCPCLOUD-3429): Ignore excessive image volume events from CAPI operator [#31093](https://github.com/openshift/origin/pull/31093)
* [TRT-2622](https://issues.redhat.com/browse/TRT-2622): copy OTE attrs to junit properties [#31052](https://github.com/openshift/origin/pull/31052)
* [OCPBUGS-83580](https://issues.redhat.com/browse/OCPBUGS-83580): Skip dev fuse test on runc runtime [#31044](https://github.com/openshift/origin/pull/31044)
* [SREP-4676](https://issues.redhat.com/browse/SREP-4676): add exception for managed cluster namespaces [#31082](https://github.com/openshift/origin/pull/31082)
* [OCPBUGS-84257](https://issues.redhat.com/browse/OCPBUGS-84257): fix openshift/network/third-party suite selecting zero tests [#31084](https://github.com/openshift/origin/pull/31084)
* [TRT-2084](https://issues.redhat.com/browse/TRT-2084): comment bugs filed for terminationMessage exemptions [#31079](https://github.com/openshift/origin/pull/31079)
* [OCPBUGS-84504](https://issues.redhat.com/browse/OCPBUGS-84504): retry transient kubeconfig read failures in GetClientConfig [#31080](https://github.com/openshift/origin/pull/31080)
* [TRT-2565](https://issues.redhat.com/browse/TRT-2565): Add simple benchmark for risk analysis HTTP requests [#30965](https://github.com/openshift/origin/pull/30965)
* NO-JIRA: Fix ListImages JSON parsing when extension binaries emit log lines [#31009](https://github.com/openshift/origin/pull/31009)
* [OCPBUGS-84255](https://issues.redhat.com/browse/OCPBUGS-84255): Fix project name error during wait [#31062](https://github.com/openshift/origin/pull/31062)
* NO-JIRA: Skip network policy cases on microshift and hypershift [#31075](https://github.com/openshift/origin/pull/31075)
* [OCPBUGS-79544](https://issues.redhat.com/browse/OCPBUGS-79544): test: add monitortest to detect pods stuck in Pending state [#31045](https://github.com/openshift/origin/pull/31045)
* [OCPBUGS-79544](https://issues.redhat.com/browse/OCPBUGS-79544): Add [Late] test to collect CRI-O goroutine dumps via SIGUSR1 [#31013](https://github.com/openshift/origin/pull/31013)
* NO-ISSUE: Automated - Update synthetic test data [#31063](https://github.com/openshift/origin/pull/31063)
* [Full changelog](https://github.com/openshift/origin/compare/bd8b3ba862681c791f27a347697e465ccaba7313...38c4fba02e693db87295168e77400fab917555a3)