Back to index

PullSpec:

quay.io/openshift-release-dev/ocp-release-nightly@sha256:3abc6f33ec84c2b9ff64b21b2e2f7f567871a5bdfd01007eac7de550531516e1

Qualifiers (status api): None

Tests:

• Blocking jobs
  • e2e-aws-ovn-multi-x-ax Succeeded periodic-ci-openshift-multiarch-main-nightly-4.17-ocp-e2e-aws-ovn-multi-x-ax
• Informing jobs
  • e2e-aws-ovn-minor-upgrade-multi-a-a Succeeded periodic-ci-openshift-multiarch-main-nightly-4.17-ocp-e2e-upgrade-aws-ovn-multi-a-a
  • e2e-nightly-upgrade-aws-ovn-multi-a-a Succeeded periodic-ci-openshift-multiarch-main-nightly-4.17-ocp-e2e-upgrade-aws-ovn-multi-a-a

Upgrades from:

• 4.17.0-0.nightly-multi-2026-11-06-175424 (changes) - Success
• 4.16.0-0.nightly-multi-2026-11-08-131501 - Success

---

Loading changelog, this may take a while ...

Changes from 4.16.0-0.nightly-multi-2026-11-08-131501

Created: 2026-11-09 10:22:41 +0000 UTC

Image Digest: sha256:34c20e4f437dd308e48b90f431a847a3c43eada19a7b45b1ddb9854dd124855b

Components

• Kubectl upgraded from 1.29.7 to 1.30.5
• Kubernetes upgraded from 1.29.14 to 1.30.14
• Kubernetes Tests upgraded from 1.29.0 to 1.30.14
• Red Hat Enterprise Linux CoreOS upgraded from 416.94.202611061114-0 to 417.94.202611061051-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
ClusterAPIInstallAzure (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled (Changed)	Enabled (Changed)	Enabled (Changed)	Enabled (Changed)
ImagePolicy (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ServiceAccountTokenNodeBindingValidation (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ServiceAccountTokenPodNodeInfo (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ChunkSizeMiB (5 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
ClusterAPIInstallGCP (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
ClusterAPIInstallPowerVS (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
GCPLabelsTags (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
ManagedBootImages (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
NodeDisruptionPolicy (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
ValidatingAdmissionPolicy (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
AWSEFSDriverVolumeMetrics (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
IngressControllerLBSubnetsAWS (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
MultiArchInstallAWS (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
MultiArchInstallGCP (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
SetEIPForNLBIngressController (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
AdditionalRoutingCapabilities (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
BootcNodeManagement (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ClusterMonitoringConfig (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
MachineAPIMigration (0 tests)
ManagedBootImagesAWS (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
MultiArchInstallAzure (0 tests)
NetworkSegmentation (28 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
OVNObservability (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
PersistentIPsForVirtualization (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ProcMountType (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
RouteAdvertisements (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
UserNamespacesSupport (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

New images

• baremetal-cluster-api-controllers git 41b34248 sha256:1d549122a261e9afea7b0d7d16ebb1adcc377be03f56e7e09b1c80d053356945
• gcp-workload-identity-federation-webhook git 653b08cc sha256:137ad703b0636b20ae7a1e92ba3fb5aed533f28a42c4e9a5850f8453be9920ab
• metallb-frr git b575d5df sha256:08424924b321d4003cf6e565c33d8866fbb2b11909251ba605163439b1e75e22
• networking-console-plugin git 4412fa1f sha256:18977cc341e2613f8f4fba75c132f75102984ebe11d76619c023996c589202c1

Removed images

• alibaba-cloud-controller-manager
• alibaba-machine-controllers
• k8s-prometheus-adapter
• olm-rukpak
• sdn

Rebuilt images without code change

• rhel-coreos sha256:69c03b2b4662eed5d11ad3af4bdb4500c20610c7011e3e78730d3fb6291ae5c5
• rhel-coreos-extensions sha256:b4a22b76fb2b9f78e229812006dbdd8a7b54456d6a44da9a3b0b4326f4eb6a21

agent-installer-api-server

• OCPBUGS-89875: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.2 #10801
• MGMT-23439: Pin gotestsum to v1.12.2 for Go 1.20 compatibility #10016
• And 154 elided commits (e.g. from squash or rebase merges)
• Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

• OCPBUGS-103137: Bump x/net to v0.35.0-sec.4 #2296
• And 18 elided commits (e.g. from squash or rebase merges)
• Full changelog

agent-installer-node-agent

• OCPBUGS-103143: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #1617
• And 22 elided commits (e.g. from squash or rebase merges)
• Full changelog

agent-installer-utils

• OCPBUGS-68141: bump github.com/sirupsen/logrus to v1.9.3 #238
• append .0 to go.mod version #110
• OCPBUGS-34187: Updating ose-agent-installer-utils-container image to be consistent with ART for 4.17 #35
• Full changelog

apiserver-network-proxy

• append .0 to go.mod version #82
• OCPBUGS-37052: Revert “Agent: Respect HTTPS_PROXY env vars for proxied connections” #57
• OCPBUGS-34199: Updating ose-apiserver-network-proxy-container image to be consistent with ART for 4.17 #54
• Full changelog

aws-cloud-controller-manager

• OCPBUGS-103332: Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #172
• OCPBUGS-88219: replace golang.org/x/net with sustaining fork v0.35.0-sec.4 #181
• append .0 to go.mod version #109
• NO-JIRA: Update OWNERS #91
• OCPCLOUD-2608: Merge https://github.com/kubernetes/cloud-provider-aws:master (0445cf1) into master #62
• OCPBUGS-33979: update for CVE-2023-45288 [release-4.17] #87
• OCPBUGS-31572: Ensure that addresses are added in network device index order #86
• Full changelog

aws-cluster-api-controllers

• OCPBUGS-103142: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #653
• OCPBUGS-130953: Fix OIDC test certificate thumbprint #663
• 🌱 OCPBUGS-123711: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #644
• OCPBUGS-78175: [release-4.17] update go mod dependency for konflux #590
• OCPBUGS-61940: UPSTREAM <carry>: revert: Only tag NetworkInterfaces in RunInstances if IAM Allows It #571
• OCPBUGS-58669, OCPBUGS-58674: bump github.com/golang/glog to v1.2.5 #559
• OCPBUGS-53727: bump to github.com/golang-jwt/jwt/v4@v4.5.2 #546
• OCPBUGS-51309: UPSTREAM: 5339: Bump glog for recent fixes #539
• OCPBUGS-43921: OSD-25934: Only tag NetworkInterfaces in RunInstances if IAM Allows It #528
• OCPCLOUD-2679: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.6.1 (6db1244) into master #519
• NO-JIRA: Update OWNERS #517
• OCPBUGS-34382: Updating ose-aws-cluster-api-controllers-container image to be consistent with ART for 4.17 #515
• OCPCLOUD-2620: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.5.0 (fb221b1) into master #512
• Full changelog

aws-ebs-csi-driver

• OCPBUGS-90292: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.6 #353
• OCPBUGS-82699: Address CVE-2026-35469 #328
• OCPBUGS-86234: UPSTREAM: 2367: cleanup: make verify should ignore copyright year #323
• OCPBUGS-80031: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.71.3-sec.1 #314
• STOR-1598: Rebase to v1.32.0 for OCP 4.17 #272
• OCPBUGS-36943: Updating ose-aws-ebs-csi-driver-container image to be consistent with ART for 4.17 #273
• OCPBUGS-34232: Updating ose-aws-ebs-csi-driver-container image to be consistent with ART for 4.17 #268
• Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator

• OCPBUGS-103305: Use patched x/net fork v0.35.0-sec.4 #631
• OCPBUGS-103147, OCPBUGS-103155: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #609
• OCPBUGS-80133: Bump google.golang.org/grpc #543
• OCPBUGS-64704: Use 127.0.0.1 for healtz http-endpoints #462
• OCPBUGS-63557: Add RBAC ClusterRole and Binding for driver node #453
• OCPBUGS-62974: Add withCABundleDaemonSetHook() to AWS EFS operator #449
• OCPBUGS-60597: Bump library-go to fix assignment to nil map issue #422
• OCPBUGS-60470: Backport stale conditions fix #416
• OCPBUGS-46512: remove EFS driver metrics #350
• OCPBUGS-44974: Set separate secrets for file and disk config on HyperShift #331
• OCPBUGS-42949: add tag matching to Azure File storage class #291
• OCPBUGS-43789: add ability to control kube rbac proxy container image… #310
• OCPBUGS-42997: Correct aws efs csi driver config as removable #296
• OCPBUGS-38355: Bump openshift/api to get EFS volume metrics #274
• OCPBUGS-38736: Some CSI driver containers missing terminationMessagePolicy #263
• OCPBUGS-38815: add init container in EFS CSI controller pod #265
• OCPBUGS-38355: Volume Metrics for EFS CSI Driver #257
• STOR-1819: Add manifest with OCP specific test config #254
• NO-JIRA: use service account namespace placeholder for smb role bindings #250
• STOR-2002: add Azure File snapshot support #253
• OCPBUGS-37488: add init container in EBS CSI controller pod #248
• STOR-1856: add STS hook for EFS credentials request controller #251
• STOR-1874: Use real HyperShift API #236
• OCPBUGS-37274: Add FIPS_ENABLED to env vars for aws-efs-csi-driver (2) #249
• STOR-1856: remove aws efs operator legacy dir #244
• STOR-1596: Bump all deps for 4.17 #240
• STOR-1856: STOR-1606: migrate legacy AWS EFS operator code to csi-operator #237
• OCPBUGS-36936: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.17 #241
• OCPBUGS-36948: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.17 #243
• OCPBUGS-36942: Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.17 #242
• STOR-1606: Bump OLM metadata to 4.17 #239
• OCPBUGS-34451: Bump go version to be consistent with ART #238
• STOR-1290: don’t pass credentials via environment variables in AWS EBS #202
• STOR-1856: migrate AWS EFS operator to csi-operator #232
• NO-JIRA: keep smb test storageclass consistent with official doc #234
• OCPBUGS-34667: Ensure Node Metric Service is created in the openshift-cluster-csi-drivers namespace for both OpenShift and Hypershift #233
• OCPBUGS-34189: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.17 #227
• OCPBUGS-32370: Configure scraping of node metrics #223
• OCPBUGS-33776: Adjust port for registrar sidecar in aws-ebs csi driver container #225
• Full changelog

aws-kms-encryption-provider

• OCPBUGS-80009: Bump google.golang.org/grpc to v1.79.3 #44
• OCPBUGS-34314: Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.17 #19
• hack: display diff on verify-mod-tidy failure #25
• NO-JIRA: Bump to latest #20
• Full changelog

aws-machine-controllers

• OCPBUGS-73822: Fix reconciler consistency checks in Update and Exists #167
• OCPBUGS-63139: client: re-use a single file for building the session instead of randomly named files #145
• OCPBUGS-45186: fix Associate*IpAddress flag when launch EC2 #118
• OCPCLOUD-2565: Add feature gates flag #108
• OCPBUGS-36469: Update placementGroupPartition to honour it as a pointer #107
• CFE-1064: Add support for PlacementGroupPartition of placement group #101
• NO-JIRA: Update OWNERS #105
• OCPCLOUD-2615: Update dependencies to K8s 1.30 #104
• OCPBUGS-34255: Updating ose-machine-api-provider-aws-container image to be consistent with ART for 4.17 #103
• Full changelog

aws-pod-identity-webhook

• OCPBUGS-51232: github.com/go-jose/go-jose/v4 v4.0.5 #202
• OCPBUGS-36522: Rename Dockerfile #195
• OCPBUGS-34147: Updating ose-aws-pod-identity-webhook-container image to be consistent with ART for 4.17 #194
• OCPBUGS-34147: Updating ose-aws-pod-identity-webhook-container image to be consistent with ART for 4.17 #193
• Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

• OCPBUGS-103148, OCPBUGS-103330: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #209
• OCPBUGS-80035, OCPBUGS-80036, OCPBUGS-80174: Bump google.golang.org/grpc to v1.79.3 #181
• OCPBUGS-46039: Prevent panic when informer receives cache.DeletedFinalStateUnknown #132
• NO-JIRA: Update OWNERS #123
• OCPCLOUD-2607: Merge https://github.com/kubernetes-sigs/cloud-provider-azure:master (e6f5e9a) into master #113
• Full changelog

azure-cluster-api-controllers

• OCPBUGS-80037: Bump google.golang.org/grpc to v1.79.3 #386
• OCPBUGS-77983: [release-4.17] update go mod dependency for konflux #363
• OCPCLOUD-2584: Add manifest generation #300
• OCPBUGS-34246: Updating ose-azure-cluster-api-controllers-container image to be consistent with ART for 4.17 #312
• OCPBUGS-36026: Update go-retryablehttp to v0.7.7 #309
• NO-JIRA: Update OWNERS #308
• OCPCLOUD-1640: Add DisableExtensionOperations field #301
• OCPCLOUD-2621: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.15.0 (e1f1f75) into master #305
• Full changelog

azure-disk-csi-driver

• OCPBUGS-103158: Bump golang.org/x/net to v0.35.0-sec.4 #173
• OCPBUGS-80038: Address CVE-2026-33186 #143
• STOR-1601: Rebase to upstream v1.29.7 for OCP 4.17 #81
• OCPBUGS-36939: Updating ose-azure-disk-csi-driver-container image to be consistent with ART for 4.17 #83
• OCPBUGS-34111: Updating ose-azure-disk-csi-driver-container image to be consistent with ART for 4.17 #79
• Full changelog

azure-file-csi-driver

• OCPBUGS-103162: Bump golang.org/x/net to v0.35.0-sec.4 #159
• OCPBUGS-92849: Bump golang.org/x/crypto to v0.33.0-sec.3 #149
• OCPBUGS-80041: Bump google.golang.org/grpc to v1.79.3 #130
• OCPBUGS-38669: bump mount-utils to treat ENODEV error as corrupted mount #75
• STOR-2002: UPSTREAM: 2040: fix snapshot size #73
• STOR-1604: Rebase v1.30.3 for OCP 4.17 #70
• OCPBUGS-34464: Updating ose-azure-file-csi-driver-container image to be consistent with ART for 4.17 #72
• Full changelog

azure-kms-encryption-provider

• OCPBUGS-80010: Bump google.golang.org/grpc to 1.64.1-sec.1 patch #47
• append .0 to go.mod version #19
• OCPBUGS-53495: bump golang-jwt v4 #12
• OCPBUGS-34277: Updating azure-kms-encryption-provider-container image to be consistent with ART for 4.17 #7
• OCPBUGS-33805: Use exec form entrypoint #5
• Full changelog

azure-machine-controllers

• OCPBUGS-103260: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #214
• OCPBUGS-65954: Set updateDomainCount to one when faultDomainCount is one #176
• OCPBUGS-63700: Support datadisks on Stack Hub #168
• OCPBUGS-56168: [release-4.17] Update virtualmachines service to armcompute/v5 SDK #146
• OCPBUGS-56655: Fix failure when attempting to modify immutable availabilitySet #152
• OCPBUGS-55729: Update eviction policy for Spot VMs from Deallocate to Delete #140
• OCPBUGS-54393: Re-reconcile machine on NIC provisioning failure #136
• OCPBUGS-52359: Remove unused vnet package #130
• OCPBUGS-50017: dynamically setting the amount of fault domains #127
• OCPCLOUD-2565: Adds –feature-gates CLI argument #116
• NO-JIRA: Update OWNERS #114
• OCPCLOUD-2614: Update to K8s 1.30 #113
• OCPBUGS-34184: Updating ose-machine-api-provider-azure-container image to be consistent with ART for 4.17 #108
• CFE-1050: Add support of capacity reservation group in openshift/machine-api-provider-azure #107
• Full changelog

azure-workload-identity-webhook

• OCPBUGS-103156: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #64
• OCPBUGS-53799: github.com/golang-jwt/jwt/v4 v4.5.2 #32
• OCPBUGS-51234: github.com/go-jose/go-jose/v4 v4.0.5 #28
• OCPBUGS-36402: Rename Dockerfile.rhel7 to Dockerfile.ocp #23
• OCPBUGS-34208: Updating ose-azure-workload-identity-webhook-container image to be consistent with ART for 4.17 #22
• OCPBUGS-34208: Updating ose-azure-workload-identity-webhook-container image to be consistent with ART for 4.17 #21
• Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

• OCPBUGS-103154: Bump golang.org/x/net to v0.35.0-sec.4 #10972
• OCPBUGS-89851, OCPBUGS-89856, OCPBUGS-89859, OCPBUGS-92861: Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.33.0-sec.4 #10906
• OCPBUGS-127575: Update gcloud version to one that can be found #10917
• OCPBUGS-77898: Update RHCOS-release-4.17 bootimage metadata to 417.94.202607240132-0 #10796
• OCPBUGS-67204: Update the RHCOS 4.17 bootimage metadata #10285
• OCPBUGS-77791: [Release 4.17] pkg/asset/manifests/azure: save cidr blocks #10218
• OCPBUGS-74677: [release-4.17] GCP: skip AI zones #10276
• OCPBUGS-74555: Azure UPI ARM template: use storageAccountId #10264
• OCPBUGS-68142: [4.17] uplift logrus #10167
• OCPBUGS-53236: Validation for API and Ingress VIPs when using user-managed load balancer #10047
• OCPBUGS-62951: Update the RHCOS 4.17 bootimage metadata #10021
• OCPBUGS-62054: Make swift containers removal not fatal for UPI. #9952
• OCPBUGS-54599: Update the RHCOS 4.17 bootimage metadata #9902
• OCPBUGS-58319: vSphere - remove unit tests using nip.io #9821
• OCPBUGS-57293: sort zone slices extracted from map of byo subnets #9778
• OCPBUGS-56448: vsphere - check if host is powered down or on standby before uploading template #9726
• OCPBUGS-57292: ensure ctrplane nodes can access bootstrap MCS #9775
• OCPBUGS-57304: IBI nmstate unit test fix #9777
• OCPBUGS-55224: Fix Load balancer IP setup #9675
• OCPBUGS-51116: update resolv.conf every time on bootstrap node #9504
• OCPBUGS-51210: Fixes panic during GCP tags fetch due to unstable network #9512
• OCPBUGS-46375: Allow spaces in the aws tags [release-4.17] #9315
• OCPBUGS-54357: IBMCloud: Move to IBM TF openshift fork #9613
• OCPBUGS-53378: Remove error logging when determining image arch #9581
• OCPBUGS-53459: aws: fix NLB creation in secret regions #9071
• OCPBUGS-52961: Remove tmp directory used for agent pxe files #9552
• OCPBUGS-43528: Prevent race with provisioning-interface service #9110
• OCPBUGS-44058: Log correct hostname for validation status #9162
• OCPBUGS-50967: PowerVS: destroy dhcp hack #9494
• OCPBUGS-50846: OCPBUGS-50702: [release-4.17] MGMT-19771: Convert IDS to proper IDMS manifest #9470
• OCPBUGS-50876: correct typo #9484
• OCPBUGS-49975: aws/edge/byovpc: subnets tag kube cluster tag to shared #9445
• OCPBUGS-48761: Update RHCOS 4.17 bootimage metadata to 417.94.202501301529-0 #9448
• OCPBUGS-49993: Disable IP Forwarding for CAPG Machines #9446
• OCPBUGS-41300: Azure: Update SecurityType passed in at Image creation #9409
• OCPBUGS-49362: [Nutanix] Installation failed with timeout when uploading images to PC #9406
• OCPBUGS-48645: azure: use separate /var to avoid growfs timeouts #9381
• OCPBUGS-45340: move GCP zone filtering client-side #9264
• OCPBUGS-48257: remove the types which failed by RHEL-59521 and add the new gpu vm type #9354
• OCPBUGS-45813: Remove unused variable from ASH arm template 06_workers.json #9285
• OCPBUGS-48359: Allow more time for Service Account Creation #9362
• OCPBUGS-45344: support additionalNTPSources in node-joiner tool #9265
• OCPBUGS-48119: Always set AllowCrossTenantReplication parameter to false #9346
• OCPBUGS-46432: Power VS: Create region-zone-sysType hierarchy #9319
• OCPBUGS-46360: aws: add ec2:AllocateAddress perm requirement. #9313
• no-jira: Collect bootstrap logs when control plane provisioning fails #9308
• OCPBUGS-45726: IBMCloud: Add service overrides #9267
• OCPBUGS-42117: Remove destroy search for regional target tcp proxies #9025
• OCPBUGS-45484: PowerVS: Listen to machineNetwork #9271
• OCPBUGS-44848: aws: user right perm for untagging BYO IAM profiles #9228
• OCPBUGS-45276: Bump Azure Machine Timeout #9257
• ARO-12457: Include bootstrap docker config file in go module #9258
• OCPBUGS-43047: fix slice init length #9089
• OCPBUGS-43800: pkg/asset/installconfig/azure: send full certifcate chain #9140
• CORS-3753: Allow mocking of the Azure client everywhere #9219
• OCPBUGS-44611: [release-4.17] capi/aws: set Node Port Service CIDR override #9209
• OCPBUGS-44230: Add C4A instance types #9181
• OCPBUGS-44231: [release-4.17] capi/aws: bump provider for LB DNS lookup fix #9179
• OCPBUGS-44261: Ensure rendezvousIP is checked against host IP #9184
• OCPBUGS-43972: Cherrypick oci ccm fix to 4.17 #9152
• OCPBUGS-44247: PowerVS: Update 4.17 CAPI ibmcloud to 9b077049 #9182
• OCPBUGS-41642: vendor: Update openshift/api to pick up v4.17 capability sets #9013
• OCPBUGS-44226: PowerVS: Fix MissingSecurityGroupRules #9175
• OCPBUGS-44227: PowerVS: Fix destroy persistent TG #9176
• OCPBUGS-44228: PowerVS: Change CAPI verbosity level #9177
• OCPBUGS-43846: add chrony.conf file when additional NTP sources are configured #9142
• OCPBUGS-43735: Add C4 instance validation #9130
• OCPBUGS-43897: Revendor assisted service external platform oci #9147
• OCPBUGS-43786: Limit GCP API firewall rule for internal clusters #9138
• OCPBUGS-43547: Power VS: Fix incorrect error handling for AddSecurityGroupRule #9112
• OCPBUGS-43088: GCP Validate Disk and Instance Type #9091
• OCPBUGS-43329: IBMCloud: Handle pagination for subnets #9096
• OCPBUGS-42716: Update RHCOS 4.17 bootimage metadata to 417.94.202410090854-0 #9092
• OCPBUGS-42806: gather: simplify service regex for analyze #9079
• OCPBUGS-42996: Power VS Ensure Metadata populated for CAPI/private cluster case on PowerVS #9086
• OCPBUGS-42115: Add validation for gcp disk and instance types #9023
• OCPBUGS-42842: add new tested azure instance types detected during QE 4.17 full function test #9080
• OCPBUGS-41812: Validate MTU for custom network #9084
• OCPBUGS-42794: PowerVS: Add support for persistent Transit Gateways #9078
• OCPBUGS-42699: machines: don’t sort mpool zones #9065
• OCPBUGS-42483: PowerVS: update capi ibmcloud c6bcd313 for 4.17 #9054
• OCPBUGS-39414: OpenStack: Install CI dependencies from rpm #8994
• OCPBUGS-42142: Skip private managed zone creation for xpn installs #9033
• OCPBUGS-42183: Add GCP N4 Machine Series to tested instances for OCP #9041
• OCPBUGS-42126: add tested IBMCloud instance types in 4.17 test #9030
• OCPBUGS-42118: Set default release image to 4.17 #9026
• OCPBUGS-42116: Remove bindings for XPN installs #9024
• OCPBUGS-39409: Fix IPv6 security group rule for schedulable master #8970
• OCPBUGS-41622: update RHCOS 4.17 bootimage metadata to 417.94.202409120353-0 #9019
• OCPBUGS-42051: Fix integration tests #9018
• OCPBUGS-41300: Azure CAPI: Improve handling of security features configured on the MachinePools and OSDisk #9007
• OCPBUGS-39286: Fix var_files syntax to work on older version of ansible #8933
• OCPBUGS-41896: Add AWS c7g,m7g,r8g to tested instance types #9005
• OCPBUGS-41542: Azure CAPI: Update publicAccess for Blob Containers #9006
• OCPBUGS-41702: aws: bump capa to fix EIP leak on bootstrap when BYOIP #8991
• OCPBUGS-38933: install-status reflects day 2 services #8899
• OCPBUGS-39239, OCPBUGS-39240: vSphere - If template is defined skip downloading #8926
• OCPBUGS-41300: Azure CAPI: Set SecurityType as a Feature while creating Gallery Image #8990
• OCPBUGS-41500: Bump extract-machine-os timout to 20m #8981
• OCPBUGS-38963: IngressController subnet selection in AWS #8909
• OCPBUGS-41542: Azure CAPI: Fix storage account and vhd container public access #8984
• OCPBUGS-41539: Pick the next available IP address for internal LB #8980
• OCPBUGS-38568: Azure: Add master and worker VM IPs to both the backend pools API LoadBalancer #8968
• OCPBUGS-39545, OCPBUGS-39546, OCPBUGS-39547: update vault version to 1.13.10 #8954
• OCPBUGS-38568: Azure CAPI: Add check for APIServer OperatorPublishingStrategy #8870
• OCPBUGS-41283: update RHCOS 4.17 bootimage metadata to 417.94.202408270355-0 #8975
• OCPBUGS-39495: capi/aws/byo-vpc/multi-cidr: fix group rules #8952
• OCPBUGS-39433: dropping this warning as the move from terraform is transparent to the end user #8950
• OCPBUGS-38752: Remove firewall rules created by CAPG #8948
• OCPBUGS-38738: pkg/infrastructure/azure: set correct cloud for BYO vnet #8972
• OCPBUGS-39308: Fix to validation for GCP pre-created ServiceAccount #8931
• OCPBUGS-39467: Enable TLS for virtual media in initial ironic deployment #8947
• OCPBUGS-39092: Use infrastructure resource to retrieve platform type #8914
• OCPBUGS-38934: failed to install Nutanix OCP 4.16 cluster with DHCP network #8900
• OCPBUGS-38841: ic: validate release arch is compatible with cluster arch #8895
• OCPBUGS-38600: GCP Global Address failed to destroy #8884
• OCPBUGS-38616: incorrect folder gen, workaround govmomi vm folder path bug #8867
• OCPBUGS-39002: Add new disk types GCP Control Plane nodes #8903
• OCPBUGS-38301: upi/aws: update lambda runtime python version #8896
• OCPBUGS-38832: aws: validate public-only subnets configs #8893
• OCPBUGS-38497: vsphere, if secureboot is enabled, disable it in the template #8841
• OCPBUGS-38560: import failure when esxi config is not the same in the cluster #8857
• OCPBUGS-38604: Updated powercli configuration to allow multi vcenters #8865
• OCPBUGS-38738: CAPZ USGovernmentCloud fixes #8885
• OCPBUGS-38534: Resource deletion is holding up deletion process #8849
• OCPBUGS-38677: upstream capv bug causes session timeout #8874
• OCPBUGS-38246: Add roles needed for shared VPC #8866
• OCPBUGS-38692: aws: add support for clusters with public-only subnets #8878
• OCPBUGS-38700: pkg/infrastructure/azure: limit storage account to 24 characters or less #8879
• OCPBUGS-38602: pkg/asset/machines: fix Azure zones #8862
• OCPBUGS-38730: Fix typo #8881
• OCPBUGS-38488: AGENT-938: Enhance console logging to display node ISO expiry date during addNodes workflow #8839
• OCPBUGS-38569: only allow a single network in failure domain topology #8859
• OCPBUGS-38604: Enhanced vSphere UPI scripts for multi vcenter support #8863
• OCPBUGS-38387: aws: do not allow edge pools of different arch #8828
• OCPBUGS-38244: Do not create firewall rules for xpn installs #8847
• OCPBUGS-38447: [release-4.17] bump capa for instance register fix #8836
• OCPBUGS-38439: PowerVS: Fix mad system pool #8834
• OCPBUGS-38393: [release-4.17] CFE-920: Update GCP userLabels and userTags configs description #8821
• OCPBUGS-38356: Update control plane tags to match CAPI networks #8823
• AGENT-944: Enable assisted-service debug logging #8816
• OCPBUGS-37770: data/bootstrap/files/usr/local/bin/bootkube: Pass CVO render –feature-gate-manifest-path #8813
• OCPBUGS-37821: Remove timed context for gcp client #8792
• CORS-3575: Azure: remove azure terraform code and resources #8764
• OCPBUGS-37540: Gather Azure Logs through load balancer #8812
• AGENT-937: Check Authentication Token for Node Boot-Up on day2 #8802
• Revert “Revert #8221 “SPLAT-1553: Added multi vCenter support for capi installer.”” #8638
• MULTIARCH-4770: MULTIARCH-4776: bump o/api for MultiArchInstall FGs #8808
• MULTIARCH-4098: Power VS: Make CAPI the default deployment method #8814
• CORS-3617: Make Azure CAPI the default (& only) install option #8809
• no-jira: PowerVS: Block disconnected deploys in 4.17 #8798
• CORS-3608: aws: deprecate platform.aws.amiID field #8755
• NO-ISSUE: Remove unnecessary code #8805
• AGENT-890: Simplify Agent ISO kargs setting #8513
• CORS-3546: Nutanix: add gpus and dataDisks support #8765
• OCPBUGS-38055: fix/aws/edge: IAM profile must be same of workers #8803
• CORS-3594: MOVE GCP CAPI to default feature set #8723
• no-jira: doc: minor update to installation doc #8795
• AGENT-870: Update AUTH_TYPE #8108
• OCPBUGS-37594: pkg/infrastructure/azure: Set architecture when creating gallery image #8800
• CORS-3609: aws: support existing IAM instance profiles #8689
• MULTIARCH-4828: Pass ServiceEndpoints from install-config to CAPI for PowerVS #8781
• MGMT-18364: add image-based installation ISO integration tests #8797
• CORS-3565: CAPZ private clusters #8732
• OCPBUGS-36361: Azure: If credentialsMode is manual, pass the identity through #8786
• CORS-3299: Azure: Use Customer Managed Key to enable Storage Account Encryption #8736
• MULTIARCH-4770: bump o/api for MultiArchInstall TechPreview gates #8791
• OCPBUGS-34953: fix bogus analyze message when gather fails #8787
• AGENT-928: allow user to specify sshKey via config file #8779
• OCPBUGS-35262: Upgrade to latest cluster-api-provider-gcp #8780
• AGENT-862: Change day-2 monitor timeout back to 90 minutes #8783
• AGENT-919: Authenticate day2 operations #8717
• OCPBUGS-35959: azure: Fix Accelerated network enablement #8667
• CORS-3209: Set UserTags on CAPG resources #8691
• no-jira: bootstrap: add shellcheck directives to follow sourced files #8741
• CORS-3580: Update GCP Disk Types #8773
• no-jira: Azure: remove stale DNS migration images #8775
• OCPBUGS-37217: CAPI GCP - retry SetIAMPolicy #8763
• OCPBUGS-37427: bootstrap gather fails in vsphere, only ipv6 address used #8759
• OCPBUGS-37356: vSphere validation fails if dc is in a folder #8758
• OCPBUGS-35366: Update upi references to api-internal #8582
• AGENT-862: Extend monitor-add-nodes to support multiple nodes #8507
• AGENT-854: day2 add-nodes workflow validations #8740
• AGENT-900: enable fips for add-nodes workflow #8760
• CORS-3568: Support GCP pre-created Service Accounts for CAPG #8750
• OCPBUGS-36302: pkg/asset/machines/azure: Don’t set disk encryption set to nil #8756
• OCPBUGS-36780: ic: fix typo in warning message #8744
• OCPBUGS-36913: openstack: Fix security group tagging #8757
• OCPBUGS-36390: aws: do not require create permissions when BYO IAM role #8688
• MULTIARCH-4814: ic: add release arch validation for multi-arch clusters #8761
• AGENT-922: Remove misleading inClusterConfig warning #8715
• OCPBUGS-36904: aws: bump CAPA for subnet tagging fix #8730
• no-jira: Replace Equal with ErrorContains for image-based nmstatectl unit tests #8762
• OCPBUGS-37226: Persist image-based config manifests from state instead of template #8752
• MGMT-18364: Add image-based config ISO integration tests #8737
• OCPBUGS-36917: openstack: Fix apiVIPs and ingressVIPs docs #8728
• no-jira: docs/user/azure: fix byo vnet security groups #8485
• CORS-3607: Azure CAPI Installs within Tech Preview featureset #8754
• MULTIARCH-4777: gcp: support multi-arch nodes #8701
• OCPBUGS-35406: Use service CIDRs to determine bootstrap kubelet IP family #8681
• AGENT-910: node-joiner multi-arch support #8644
• METAL-1039: Allow baremetal platform without MAPI #8521
• CORS-3569: UDR for Capz #8731
• MULTIARCH-4569: aws: support multi-arch nodes #8698
• no-jira: Revert “Merge pull request #8714 from r4f4/bump-default-release-4.17” #8753
• OCPBUGS-37104: openstack: Validate controlPlanePort has subnet #8739
• OCPBUGS-37164: Handle empty config for image-based create image #8745
• OCPBUGS-37107: Power VS: Disable SNAT when specifying imageContentSources #8697
• STOR-1353: Attempt to cleanup GCP Filestore instances on destroy #8699
• CORS-3073: azure: Allow for installs in existing vnets #8662
• MGMT-17842: Add image-based installer create config ISO #8514
• MGMT-17226: Add image-based installer create installation ISO #8679
• OCPBUGS-35440: capi/aws: bump provider for ingress rules fix #8596
• OCPBUGS-34638: destroy/gcp: set value for DiscardLocalSsd #8649
• CORS-3302: port forward SSH to bootstrap host #8669
• OCPBUGS-36713: CAPG use existing subnets and VPC #8722
• MGMT-17226: Add imagebased installer skeleton #8709
• CORS-3485: Azure: modify control plane outbound LB into submission as an API LB #8652
• OCPBUGS-36378: capi: start controllers after WaitGroup is created #8693
• CORS-2775: cmd: destroy: remove deprecated github.com/pkg/errors #8720
• OCPBUGS-33973: Openstack UPI - Reintroduce unique resource names. #8477
• MULTIARCH-4568: Print release image arch and default arch when the payload is multi #8515
• CORS-3593: go.mod: bump k8s dependencies #8713
• OCPBUGS-35262: Skip firewall rule creation if permission is missing #8706
• OCPBUGS-36142: azure: Fix HyperVGeneration for gen2 images. #8666
• OCPBUGS-35542: Cleanup capi artifacts #8599
• CORS-3590: releaseimage: update default version #8714
• AGENT-875: Authenticate agents #8395
• OCPBUGS-34708: CORS-3582: capi: remove unused feature gates #8703
• OCPBUGS-36660: CORS-3591: 4.17 default channel incorrectly points to stable-4.16 #8708
• CORS-3296: CAPG - configure Internal LoadBalancer in the provider #8421
• CORS-3547: Upgrade cluster-api-provider-gcp to v1.7 #8700
• AGENT-876: Authenticate systemd services and curl requests #8393
• SPLAT-1670: install pwsh from ci mirrored image #8643
• OCPBUGS-36453: PowerVS: add .ssh directory #8686
• OCPBUGS-35262: Fix shared vpc issues with capg installs #8583
• AGENT-925: retrieve ignition endpoint to add a new node #8650
• OCPBUGS-35752: capi/aws: disable EKS controller in CAPA #8628
• OSASINFRA-3402: Use Gophercloud v2.0.0 #8685
• AGENT-871: Authenticate wait for #8270
• OCPBUGS-36318: update RHCOS 4.17 bootimage metadata to 417.94.202407010929-0 #8690
• OCPBUGS-36316: Power VS: Allow pending network for internal publishing strategy #8677
• OCPBUGS-36242: vSphere - If the folder pre-exists do not tag #8671
• OSASINFRA-3510: Change ‘Generate’ to accept a context #8562
• OCPBUGS-36284: Remove etcd store when provisioning fails #8673
• OCPBUGS-36092: bump go-retryablehttp for CVE fix #8653
• no-jira: Update documentation on libvirt installs for devs #8675
• OCPBUGS-36176: PowerVS: Add ibmcloud plugins #8661
• OCPBUGS-35382: CAPG marketplace image use for control plane nodes #8665
• OCPBUGS-35852: capi: shutdown local controlplane as the last step #8639
• OCPBUGS-35188: aws: remove terraform configs #8557
• CORS-3435: Create user assigned identity for Azure VM’s #8645
• MULTIARCH-4515: Add new files for agent-based installer (LPAR support for s390x) #8536
• OCPBUGS-35420: OSASINFRA-1962: openstack: Validate additionalNetworkIDs and additionalSecurityGroupIDs #8592
• CORS-3483: Update CAPI and CAPZ versions to set Machine DisableExtensionOperations #8627
• OCPBUGS-34978: Power VS: Ensure that VPC has prerequesite resources for private #8532
• OCPBUGS-35547: Configured logger for controller-runtime #8641
• OSASINFRA-3465: openstack: Update Gophercloud to v2 #8493
• CORS-3562: azure: Setting experimental MachinePool featuregate to false #8637
• CORS-3434: azure: Skip image upload if env var is set #8283
• OCPBUGS-14963: IBMCloud: Ignore failed VPC regions #8556
• OCPBUGS-33735: Remove GCP bootstrap ssh firewall rule #8523
• OCPBUGS-31275: gcp: Validate install-config examples #8198
• no-jira: images: upi-installer image cleanup #8216
• OCPBUGS-33702: baremetal: bootstrap: bind icc to localhost #8445
• Revert #8221 “SPLAT-1553: Added multi vCenter support for capi installer.” #8630
• OCPBUGS-35426: Update cluster-api-provider-openstack to v0.10.3 #8625
• OCPBUGS-35523: remove terraform libvirt from the installer #8610
• OCPBUGS-30025: fix: changed validation for olm and marketplace #8609
• OCPBUGS-35430: Support CAPI provider custom timeouts #8568
• OCPBUGS-35533: Fix ethertype for masters service router SG creation #8615
• CORS-3265: capz: Add Accelerated Networking #8418
• OCPBUGS-35494: capi/aws: allow 6443 for private cluster NLB #8620
• OCPBUGS-35530: capi/aws: retry SSH ingress rule removal #8616
• OCPBUGS-35400: For GCP, only configure kmsKeyServiceAccount if set #8597
• SPLAT-1553: Added multi vCenter support for capi installer. #8221
• OCPBUGS-34037: bump github.com/container/images for CVE fix #8564
• OCPBUGS-35511: capi aws: append random string in caller ref #8593
• SPLAT-1437: CAPI/AWS/BYOIP: supporting Public IPv4 Pool #8175
• OCPBUGS-35467: capi/aws: disable CAPA’s TagUnmanagedNetworkResources feature gate #8602
• OCPBUGS-33745: save etcd data to its own directory #8424
• NO-JIRA: Remove dulek from openstack-{approvers,reviewers} #8413
• OCPBUGS-34819: capi/aws: bump provider for fixes #8545
• OCPBUGS-34618: vsphere - allow network selection on cluster name #8505
• OCPBUGS-35037: aws: delete ignition bucket on bootstrap destroy #8584
• OCPBUGS-35293: Add ELB V2 permission to set security groups on API server load balancer #8572
• OCPBUGS-34712: add tested instance type for IBMCloud #8549
• OCPBUGS-35315: capi: use polling instead of exponential backoff #8522
• OCPBUGS-35197: capi/aws: do not set proxy for masters #8570
• OCPBUGS-34005: openstack: Attach a bootstrap FIP to the cluster network port #8578
• OCPBUGS-35309: Add S3 permission to allow attaching S3 bucket policy #8573
• OCPBUGS-33661: capi/aws: rename preserveBootstrapIgnition #8460
• OCPBUGS-35180: Prevent multiple invocations on CAPI #8565
• OCPBUGS-33681: Cleanup bootstrap resources for capg install #8489
• OCPBUGS-34713: AWS remove extra tags from awsmachines for security groups and subnets #8567
• OCPBUGS-35041: capi: do not override KUBECONFIG #8542
• OCPBUGS-34325: Updating ose-baremetal-installer-container image to be consistent with ART for 4.17 #8559
• OCPBUGS-35182: write etcd and kube-apiserver logs #8441
• OCPBUGS-34456: bump envtest binaries version #8471
• no-jira: hack: bump golangci-lint version #8535
• OCPBUGS-34416: Validate OnHostMaintenance and ConfidentialCompute #8541
• OCPBUGS-35039: PowerVS: Destroy DHCP in ERROR state #8544
• OCPBUGS-34082: baremetal: check if HardwareDetails is nil #8443
• OCPBUGS-34368: OCPBUGS-34325: OCPBUGS-34311: OCPBUGS-34221: Bump golang 1.22 #8473
• OCPBUGS-34295: wait for ip addresses to be present on machines #8450
• OCPBUGS-35099: OCPBUGS-4466: Prevent cluster installation with mismatched worker assets and worker replicas #8370
• OCPBUGS-35038: capi/aws: add BootstrapDestroyer guard #8543
• OCPBUGS-34915: Add network tags to capg control plane machines #8531
• OCPBUGS-35020: capi/aws: don’t use S3 stub for masters #8538
• OCPBUGS-33662: aws: don’t always require s3:Delete* permissions #8410
• OCPBUGS-34969: Power VS: Add ports needed for private clusters to security group #8530
• OCPBUGS-34900: Increase timeout for bootstrap complete #8534
• no-jira: Minor updates to fix linting issues. #8529
• OCPBUGS-34869: PowerVS: fix AddIPToLoadBalancerPool #8508
• MULTIARCH-4640: Add 4 new regions for PowerVS #8484
• OCPBUGS-34493: baremetal: Don’t always enable provisioning-interface.service #8491
• No-jira: Revert “Cleanup GCP Filestore instances on destroy” #8527
• OCPBUGS-33793: Make Ingress capability required for all baselines #8525
• OCPBUGS-34692: update RHCOS 4.17 bootimage metadata to 417.94.202405291927-0 #8516
• OCPBUGS-33789: [Nutanix] installer intermittent failed at uploading the bootstrap image to PC when CAPI enabled #8468
• STOR-1353: Cleanup GCP Filestore instances on destroy #7251
• OSASINFRA-3456: OpenStack: do not use trunk for the Machines by default #8497
• OCPBUGS-33508: capi/aws: fix setting custom AMI #8466
• OCPBUGS-33793: Make Ingress capability required for standalone OpenShift #8502
• CORS-3523, CORS-3524: aws: terraform: add spot instance support for masters #8349
• OCPBUGS-33410: attach tag to folder,fix folder destroy #8373
• OCPQE-22479: add machine series ‘A3’ and ‘C3D’ to ‘Tested instance types for GCP’ #8504
• OCPBUGS-33840: Warn before trimming cluster name #8367
• OCPBUGS-33234: azure: bump profile used for network #8351
• OCPBUGS-33925: tfvars: change asset’s name #8464
• OCPBUGS-33561, OCPBUGS-33615: capv - missing cores/socket,disk type #8446
• no-jira: Removing unused users from owners aliases #8498
• OCPBUGS-30860: Use infrastructure API to detect cluster topology #8429
• MGMT-17468: Detect Release Image Arch in a Disconnected Env. #8378
• MULTIARCH-4076: PowerVS: Default region bug fix #7862
• OCPBUGS-34243: unique AWS HostedZone Caller Ref #8453
• OCPBUGS-30516: bump golang-protobuf for CVE fix #8379
• no-jira: images: delete Dockerfile.upi.ci.rhel8 #8377
• OCPBUGS-33570: Nutanix IPI install with capi failed to set bootType #8454
• OCPBUGS-34389: aws/cluster: restrict SSH on private clusters #8462
• OCPBUGS-34368: Updating ose-installer-artifacts-container image to be consistent with ART for 4.17 #8459
• OCPBUGS-34354: PowerVS: update capi ibmcloud to release 0 8 0 #8458
• OCPBUGS-33926: capi/aws: don’t modify BYO role’s policy #8457
• OCPBUGS-33912: PowerVS: Use random subnet #8420
• OCPBUGS-34221: Updating ose-installer-altinfra-container image to be consistent with ART for 4.17 #8449
• OCPBUGS-34311: Updating ose-installer-container image to be consistent with ART for 4.17 #8455
• OCPBUGS-34040: Add –dir /tmp to node-joiner-monitor.sh #8444
• OCPBUGS-30860: bootstrap: hit readyz when checking LB status #8400
• OCPBUGS-33877: bump aws bootstrap destroy timeout #8427
• OCPBUGS-33995: PowerVS: Also fill out PlatformSpec for custom endpoints #8439
• TRT-1674: 4.17 capi revert 1 #8433
• OCPBUGS-33493: Enable leader election for baremetal operator #8391
• OCPBUGS-33890: SPLAT-1469: Remove vsphere terraform #8254
• CORS-2840: promote capi-installers to default feature set #8416
• And 2 elided commits (e.g. from squash or rebase merges)
• Full changelog

baremetal-machine-controllers

• OCPBUGS-68143: [4.17] uplift logrus #239
• OCPBUGS-46646: Bump x/net to 0.33.0 #225
• OCPBUGS-34210: Updating baremetal-machine-controller-container image to be consistent with ART for 4.17 #219
• OCPBUGS-34210: Updating baremetal-machine-controller-container image to be consistent with ART for 4.17 #217
• Full changelog

baremetal-operator

• OCPBUGS-77185: Unblock BMH direct deletion when detached annotation is present #462
• OCPBUGS-53325: BMO can expose any secret via BMCEventSubscription CRD #406
• OCPBUGS-42387: Remove dataImage finalizer if BMH is missing #390
• OCPBUGS-49701: Handle HFC for non-redfish HW #395
• OCPBUGS-39489: Disallow fetching secrets from namespaces different from the host’s one #377
• OCPBUGS-38937: [OCP] Ability to disable agent power off after deployment #371
• OCPBUGS-36425: Sync jul 30 #367
• NO-ISSUE: Bmo sync jul9 #364
• OCPBUGS-35559: Bmo sync jul5 #362
• OCPBUGS-29687: Merge upstream #360
• OCPBUGS-34318: Updating ose-baremetal-operator-container image to be consistent with ART for 4.17 #357
• OCPBUGS-34318: Updating ose-baremetal-operator-container image to be consistent with ART for 4.17 #356
• Full changelog

baremetal-runtimecfg

• OCPBUGS-103159: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #409
• OCPBUGS-71209: Bump logrus version #377
• OCPBUGS-60112: Re-add ENABLE_NODEIP_DEBUG env var #363
• OCPBUGS-48766: Extend haproxy-monitor fall time #340
• OCPBUGS-38423: Distinguish NotExist from nil for keepalived sentinel file errors. #329
• OCPBUGS-38562: Handle errors in iptables healthcheck #330
• OCPBUGS-32348: Change mechanism of debug flag #309
• OCPBUGS-32141: Fix handling of ELB Node IP detection #316
• OCPBUGS-34706: Add support for OVN HostCidrs annotation #317
• OCPBUGS-34136: Updating ose-baremetal-runtimecfg-container image to be consistent with ART for 4.17 #314
• OCPBUGS-32141: Handle scenario when VIP does not belong to L2 #313
• Full changelog

cli, cli-artifacts, deployer, tools

• OCPBUGS-102061, OCPBUGS-103161: Use patched x/net fork v0.35.0-sec.4 #2417
• OCPBUGS-91064, OCPBUGS-94526: Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.2 #2345
• OCPBUGS-111835: Fix pre-existing unit test failures #2373
• OCPBUGS-64615: Help with must-gather scheduling through suggesting preferance of nodes #2150
• OCPBUGS-56734: Adding sos.conf file for default sos config into the tools image #2027
• OCPBUGS-58091: avoid transfering permissions when copying artifacts from node-joiner pod #2053
• OCPBUGS-57446: Use fedora image in unit tests instead of centos #2038
• OCPBUGS-49607: Address golang.org/x/* CVEs #1962
• OCPBUGS-50984: Add HOST env var in oc debug for sos report collects more #1976
• OCPBUGS-49605: Address github.com/docker/docker CVE #1968
• OCPBUGS-45344: additional rbac policy rules #1937
• OCPBUGS-45517: add retry in case of image pull error #1940
• OCPBUGS-44508: Show node-joiner container logs when error occurs #1912
• OCPBUGS-44830: Fix newapp unit test failure by using different image #1913
• OCPBUGS-43696: Bump k8s dependencies to 1.30.5 #1902
• OCPBUGS-41642: vendor: Update openshift/api to pick up the v4.17 capability set #1876
• OCPBUGS-42176: Fix copy artifacts for all CPU architectures #1880
• OCPBUGS-42721: Update push targets of digest with new appended tags #1892
• OCPBUGS-42580: fix outputname flag for node-image create command #1888
• OCPBUGS-42164: Check cast result in adm prune deployments to prevent panic #1879
• OCPBUGS-39090: use proxy settings when required #1860
• make the idle command’s scale update unconditional #1856
• OCPBUGS-38720: Add examples for some oc adm policy commands #1850
• WRKLDS-1318: flags for single node interface #1841
• OTA-1309: upgrade-status: test a compact cluster and a single-node cluster #1829
• WRKLDS-1429: Adds a guardrail for node-image commands which is supported only for Openshift version 4.17+ #1837
• OTA-1153: upgrade-status: communicate control plane completion clearly #1831
• NO-JIRA: upgrade-status: fix HasOSImage function #1834
• WRKLDS-1316: Retry and do not fail when logs cannot be updated #1836
• NO-JIRA: upgrade-status: fix a typo in README #1830
• WRKLDS-1316: Remove clusterversions from certificates api group #1835
• AGENT-854: add the required role to support platform type validation #1832
• WRKLDS-1316: oc adm node-image monitor command #1823
• OTA-1291: upgrade status: removes custom nodes from the worker pool (2) #1825
• NO-JIRA: Minor wording tweaks for CLI help #1826
• OCPBUGS-37345: Revert “OCPBUGS-35994: pkg/cli/admin/upgrade/rollback: Drop this command” #1827
• OTA-1291: upgrade status: removes custom nodes from the worker pool #1822
• : MULTIARCH-4568: Inject ReleaseArch into openshift-install #1792
• OCPBUGS-35994: pkg/cli/admin/upgrade/rollback: Drop this command #1806
• no-jira: Extend the kube version check for images/tools/Dockerfile #1813
• OCPBUGS-36525: Bump k8s to 1.30.2 #1812
• WRKLDS-1310: pkg/cli/admin/mustgather: GA since and since-time flags #1811
• OCPBUGS-36183: pkg/cli/admin/prune/renderedmachineconfigs: ‘Error dry-run deleting’ #1807
• OCPBUGS-33897: upgrade status: control plane completion estimate #1742
• OCPBUGS-31848: don’t manually delete must-gather’s cluster role binding #1790
• OCPBUGS-34877: Ignore pruning when deployment points to replicationcontroller #1797
• NO-JIRA: pkg/helpers: remove legacy pkg #1791
• WRKLDS-1292: oc k8s 1.30 bump #1789
• NO-JIRA: Update comment about using OpenFileSequential #1793
• OCPBUGS-33896: upgrade status: polish alert insights #1787
• OCPBUGS-32108: stop loading legacy schemes on global scheme #1775
• OCPBUGS-33896: status/inspect-alerts: handle non-200 by Thanos #1782
• OCPBUGS-34465: Updating openshift-enterprise-deployer-container image to be consistent with ART for 4.17 #1785
• OCPBUGS-33903: Simplify output when not updating #1774
• OCPBUGS-34207: Updating ose-tools-container image to be consistent with ART for 4.17 #1780
• OCPBUGS-34154: Updating openshift-enterprise-cli-container image to be consistent with ART for 4.17 #1779
• OCPBUGS-33762: Hardcode resource groups/kinds for now #1773
• AUTH-482: set required-scc annotation to privileged for node debug pods #1763
• OCPBUGS-33905: pkg/cli/admin/upgrade/rollback: Gate on OC_ENABLE_CMD_UPGRADE_ROLLBACK #1764
• OCPBUGS-33651: Add s390x based oc into extraction target #1766
• OCPBUGS-33896: add alert data to upgrade health in oc adm upgrade status #1740
• And 3 elided commits (e.g. from squash or rebase merges)
• Full changelog

cloud-credential-operator

• OCPBUGS-81861: Bump go-jose/go-jose/v4@v4.1.4 #1039
• OCPBUGS-80044: Bump google.golang.org/grpc to v1.79.3 #1025
• OCPBUGS-65801: ccoctl azure: retry custom role creation on consistency errors #951
• OCPBUGS-65480: ccoctl: use pagination when listing resources in aws #945
• OCPBUGS-63549: ccoctl: add public-key-file flag to create-all #939
• OCPBUGS-55128: snyk to ignore SNYK-GOLANG-GOLANGORGXNETHTML-9572088 #917
• OCPBUGS-60972: ccoctl: aws to use proper issuer url on subsequent runs #908
• OCPBUGS-58679: github.com/golang/glog v1.2.5 #892
• OCPBUGS-58248: ccoctl: only add owned tag to azure resources on create #883
• OCPBUGS-56980: Azure: resolve nil pointer exception when role assignment exists #868
• OCPBUGS-54828: Render: configure proxy on bootstrap static pod #863
• OCPBUGS-53415: github.com/golang/glog v1.2.4 #842
• OCPBUGS-53823: update github.com/golang-jwt/jwt #838
• OCPBUGS-51548: Ignore SNYK-GOLANG-GOLANGORGXOAUTH2JWS-8749594 due to not being affected #828
• OCPBUGS-51238: github.com/go-jose/go-jose/v4 v4.0.5 #825
• OCPBUGS-47071: golang.org/x/net v0.33.0 #804
• OCPBUGS-45938: Add AWS region to aws-pod-identity-webhook #799
• OCPBUGS-45006: Add retry to ccoctl gcp create functions #793
• OCPBUGS-45001: github.com/golang-jwt/jwt/v4 v4.5.1 #787
• OCPBUGS-44123: Add GCP pod identity webhook #776
• OCPBUGS-43644: Only attempt timed token credentials on supported platforms. #773
• OCPBUGS-43335: Update github.com/sirupsen/logrus v1.9.3 #766
• OCPBUGS-41233: List secrets in batches to avoid api timeout #756
• OCPBUGS-38952: Follow-up bug fixes for CCO-572 #751
• OCPBUGS-38375: update google.golang.org/grpc v1.65.0 #747
• SPLAT-1718: Remove alibaba #737
• CCO-572: STS OLM for GCP (WIF) #708
• CCO-580: Upgrade to Kubernetes 1.30 #725
• OCPBUGS-37334: SNYK ignore go-client misreporting #734
• OCPBUGS-35016: Update to azidentity v1.7.0 #716
• OCPBUGS-34347: Updating ose-cloud-credential-operator-container image to be consistent with ART for 4.17 #719
• OCPBUGS-36032: IBM/go-sdk-core update to v5.6.3 #715
• OCPBUGS-36140: GCP passthrough permissions check to ignore problematic permissions. #712
• NO-JIRA: Fix Makefile for developer install #711
• OCPBUGS-33566: AWS STS should not error when a credentailsRequest does not have awsSTSIAMRoleARN #703
• OCPBUGS-33621: docs: Azure WI migration to extract only the credentialRequests needed by the cluster. #702
• Full changelog

cloud-network-config-controller

• OCPBUGS-66132: [release-4.17] Fix capacity calculation #194
• OCPBUGS-65520: Change the capacity struct from int to ptrOfInt #191
• OCPBUGS-56257: Increase API call timeout to 30 second #171
• SDN-4773: Add support for Azure Managed Service Identity authentication #151
• NO-JIRA:Update linter file #146
• SDN-4924: Rebase 1.30 #150
• OCPBUGS-34302: Updating ose-cloud-network-config-controller-container image to be consistent with ART for 4.17 #148
• Full changelog

cluster-authentication-operator

• OCPBUGS-103168: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #989
• OCPBUGS-68150: Update library-go to fix CVE-2025-65637 #840
• OCPBUGS-54580: Avoid duplicate OAuth client creation #765
• OCPBUGS-43657: audit: do not log requests to /livez #724
• OCPBUGS-42784: manifests should not use APIs that are removed in upcoming releases #712
• OCPBUGS-42545: when no type is specified, don’t make illegal condition #703
• OCPBUGS-39021: increase oauth-apiserver failureThreshold #693
• OCPBUGS-35828: controller: set ownership annotation for webhook-auth secret #678
• NO-JIRA: endpoint test: use httpbin #680
• NO-JIRA: Several fixes for Keycloack IDP test #679
• NO-JIRA: OWNERS: add ibihim, liouk, rm old #677
• OCPBUGS-33654: update OpenShift favicon to new brand standard #674
• OCPBUGS-33654: update OpenShift favicon to new brand standard #670
• Full changelog

cluster-autoscaler

• OCPBUGS-78700: allow clusterapi provider to skip paused resources #414
• OCPBUGS-68151: update logrus to version 1.9.3 #398
• OCPBUGS-60913: revert openshift replica fix #376
• OCPBUGS-60608: fix checkpoint gc of unknown recommenders #371
• OCPBUGS-59266: Fix cool down status condition to trigger scale down #362
• OCPBUGS-54325: improve replica counting and decrease target size behavior #352
• OCPBUGS-48606: UPSTREAM: <carry>: 🐛(metrics) Initialize metrics for autoscaler errors, scale events, and pod evictions #337
• OCPBUGS-45147: [release-4.17] VPA: Update OWNERS file #324
• OCPBUGS-37498: Updating ose-vertical-pod-autoscaler-container image to be consistent with ART for 4.17 #311
• PODAUTO-202: Update VPA ocp/builder Dockerfile images to openshift/release images #310
• PODAUTO-199: Upstream rebase to VPA 1.1.2 #309
• OCPBUGS-34242: Updating ose-vertical-pod-autoscaler-container image to be consistent with ART for 4.17 #304
• NO-JIRA: Update OWNERS #307
• OCPCLOUD-2616: rebase on upstream 1.30.1 release #306
• OCPBUGS-34428: Updating atomic-openshift-cluster-autoscaler-container image to be consistent with ART for 4.17 #305
• OCPBUGS-33904: Updating atomic-openshift-cluster-autoscaler-container image to be consistent with ART for 4.17 #302
• OCPBUGS-33592: fix: scale up broken for providers not implementing NodeGroup.GetOptions() #300
• Full changelog

cluster-autoscaler-operator

• OCPBUGS-103166: Bump x/net package in release-4.17 #389
• OCPBUGS-45929: set max soft bulk taint count to zero #337
• NO-JIRA: Update OWNERS #329
• OCPBUGS-35952: add aws zone-id to ignore labels #328
• OCPCLOUD-2617: Bump k8s to 1.30 #327
• OCPBUGS-34151: Updating ose-cluster-autoscaler-operator-container image to be consistent with ART for 4.17 #323
• Full changelog

cluster-baremetal-operator

• OCPBUGS-103170: Use patched x/net fork v0.35.0-sec.4 #672
• OCPBUGS-77446: Bump github.com/go-errors/errors to v1.5.1 #561
• OCPBUGS-63715: Always have a service for ironic-api port #519
• OCPBUGS-63666: Allow provisioningIP when network disabled #518
• OCPBUGS-61097: Remove webhookport (9447) as HostPort #505
• OCPBUGS-54542: Add missing relatedObjects #469
• OCPBUGS-41926: SCC-pinning for metal3-baremetal-operator #444
• OCPBUGS-29660: Ignore provisioning ip config if disabled #429
• METAL-1040: Allow CBO to run without MAPI #423
• METAL-503: Remove ironic-inspector #430
• OCPBUGS-29687: Move Secrets from environment variables to VolumeMounts in metal3-httpd container #408
• AUTH-482: set required-scc for openshift workloads #407
• OCPBUGS-29687: Move pull secret from env var to VolumeMount in metal3-image-customization container #428
• OCPBUGS-35211: Add capability to metal3-ramdisk-logs container #424
• OCPBUGS-34649: provisioning: add ownership for tls secret #422
• OCPBUGS-34119: Upgrade controller-tools and library-go #421
• OCPBUGS-34119: Updating ose-cluster-baremetal-operator-container image to be consistent with ART for 4.17 #419
• OCPBUGS-32304: Run metal3 containers as specific users and groups #417
• Full changelog

cluster-bootstrap

• OCPBUGS-34034: Updating ose-cluster-bootstrap-container image to be consistent with ART for 4.17 #108
• Full changelog

cluster-capi-controllers

• OCPBUGS-80045: Bump google.golang.org/grpc to v1.79.3 #291
• NO-JIRA: Update OWNERS #211
• OCPCLOUD-2625: Merge https://github.com/kubernetes-sigs/cluster-api:v1.7.2 (a5898a2) into master #210
• OCPBUGS-34133: Updating ose-cluster-api-container image to be consistent with ART for 4.17 #208
• Full changelog

cluster-capi-operator

• OCPBUGS-80049: Bump google.golang.org/grpc to v1.79.3 #570
• NO-JIRA: Allow sustaining engineering to self serve dependency updates #559
• append .0 to go.mod version #314
• OCPBUGS-48493: fix: always update clusteroperator status versions when differing #250
• OCPBUGS-41576: Use CAPO v0.10 and API v1beta1 #205
• OCPBUGS-39309: manifests-gen: fix: readd missing metadata #198
• OCPBUGS-37718: fix: align openstack e2e branch #191
• OCPBUGS-36296: fix: sort CredentialsRequest manifests after namespace #183
• OCPCLOUD-2638: Add stricter linting configuration #186
• OCPCLOUD-2204, OCPCLOUD-2205, OCPCLOUD-2206, OCPCLOUD-2207: Add InfraCluster controller + AWSCluster implementation #169
• OCPCLOUD-2584: Implement compression of components in configMap #170
• NO-JIRA: Update OWNERS #179
• OCPCLOUD-2619: Bump CAPI 1.7 and k8s 1.29 #176
• OCPBUGS-34085: Updating ose-cluster-capi-operator-container image to be consistent with ART for 4.17 #174
• Full changelog

cluster-cloud-controller-manager-operator

• OCPBUGS-103176: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #514
• OCPBUGS-63167: ccm: disable unused secure-serving port and webhook #423
• OCPBUGS-60211: Update service selector to match deployment label #406
• OCPBUGS-60211: Add Service using common resource templating #407
• OCPBUGS-43389: update goimports targets #371
• OCPBUGS-41941: IBMCloud: Modify liveness probe for IBM Cloud CCM to use loopback address #365
• SPLAT-1720: Remove Alibaba #324
• OCPBUGS-35798: PowerVS: Remove bind address #355
• NO-JIRA: Update OWNERS #357
• OCPCLOUD-2609: rebase for kubernetes 1.30 #356
• NO-JIRA: openstack: Remove dulek from OWNERS #345
• OCPBUGS-34144: Updating ose-cluster-cloud-controller-manager-operator-container image to be consistent with ART for 4.17 #346
• OCPBUGS-34938: Refactor resourceapply tests #352
• OCPBUGS-34689: Nutanix CCM pods Cipher Suites vulnerability issue #348
• Full changelog

cluster-config-api

• CNTRLPLANE-1981: Promote streaming list encoding to Default #2599
• OCPBUGS-71184: Add HTTPKeepAliveTimeout to IngressController API #2639
• NO-JIRA: Promote streaming list encoding to Default on Hypershift. #2567
• CNTRLPLANE-1611: Add feature gates for StreamingCollectionEncoding #2538
• OCPBUGS-57285: Add IPsec API for NAT-T UDP encapsulation support #2363
• OCPBUGS-49702: Add IdleConnectionTerminationPolicy field to IngressControllerSpec #2186
• OCPBUGS-39130: Added checks to prevent vCenters from changing after install past 1 vCenter #2014
• OCPBUGS-41642: config/v1/types_cluster_version: Add v4.17 capability set #2023
• OCPBUGS-34333: Updating ose-cluster-config-api-container image to be consistent with ART for 4.17 #1903
• features: disable PSA #2018
• OCPBUGS-38355: Promote AWSEFSDriverVolumeMetrics to GA #2020
• OCPBUGS-39300: clean up openshift-sdn references in the API [4.17] #2008
• OCPBUGS-38958: [4.17] add UserNamespacesSupport/ProcMountType to tech preview features #2011
• OCPBUGS-38605: remove duplicate featuregate ‘ExternalRouteCertificate’ #2004
• CFE-921: Enable GCPLabelsTags featureGate by default for GA #1971
• MULTIARCH-4776: MULTIARCH-4770: installer: promote MultiArchInstall FGs #1991
• Power VS: Move Power VS to CAPI by default #1979
• CORS-3617: Promote Azure CAPI as the default Install method #1987
• STOR-1422: Add field for enabling EFS volume metrics #1853
• SDN-5086: Add API and feature gates for OVN-K BGP support #1944
• NE-1794: Promote eipAllocations API in GA #1989
• SDN-5186: Add OVNObservability feature gate as Tech Preview. #1986
• AUTH-527: security/v1 - add constant for enforcing psa annotation #1980
• IR-471: Removing featuregate for chunkSizeMiB config #1948
• Run update-payload-crds after update-codegen-crds #1974
• CORS-3594: Setting CAPG as the default infra provider #1958
• NE-1774: Promote IngressControllerLBSubnetsAWS to GA #1966
• OCPBUGS-35906: a rule to check if the featureSet is one of the known set of features #1952
• featuregate promotion: use latest release instead of hard coding #1984
• Add MCP and Config Version columns to MCN output #1972
• MCO-1065: MCO-1171: Promoting ManagedBootImages and NodeDisruptionPolicy to default featureset #1975
• MULTIARCH-4770: features: move MultiArchInstall[AWS|GCP] to TechPreview #1973
• Nutanix mapi: gpus and dataDisks support #1935
• CONSOLE-4161: Add support for lightspeed button integration #1956
• NE-1516: Add configuration for AWS Elastic IPs (EIPs) via Ingress Controller CR. #1826
• Added Feature Gate for Bootc Update Path #1969
• CORS-3607: Add Azure CAPI installer to tech preview feature set #1967
• OCPNODE-2436: SigstoreImageVerification featuregate marker for the ClusterImagePolicy and ImagePolicy #1964
• Feature gate sippy queries to use variant registry #1909
• NE-1530: Fix empty subnet list CEL validation #1961
• OCPBUGS-36523: Rename Dockerfile #1949
• NE-1530: IngressController LB Subnet Selection in AWS #1841
• MCO-1215: add ManagedBootImagesAWS to Feature Gate #1945
• OCPBUGS-36469: Update placementGroupPartition to pointer #1953
• OCPNODE-2358: Update (cluster)imagepolicy doc no restriction on release repo scopes #1927
• OCPBUGS-36213: Remove the conversion webhook reference from the ConsolePlugin CRD spec #1946
• features: add multi-arch feature gate per platform #1947
• MON-3546: Add ClusterMonitoringCRD feature gate #1930
• SDN-4934: Add NetworkSegmentation Feature Gate #1941
• OCPBUGS-34906: Fix IngressController missing listTypes #1917
• METAL-1038 Remove baremetal dependency on MachineAPI capability #1916
• NO-JIRA: remove beta enabled features from feature gates #1934
• OCPBUGS-34907: prevent removing featureSet entirely #1932
• CFE-1063: Add PlacementGroupPartition in AWSMachineProviderConfig #1897
• Update published Kubebuilder tools #1924
• OCPBUGS-34974: IBMCloud: Add IBM Cloud Services #1919
• CNV-41151: ipam, virt: add persistent ips feature gate #1913
• Adds conditions to MachineSet #1907
• Feature gates for platforms, architecture, and installs #1895
• API-1783: Bump 1.30.1 #1906
• OCPBUGS-33787: add console and download URLs to console operator config #1887
• OCPCLOUD-2563: Add Machine/MachineSet API for MAPI to CAPI migration #1818
• OCPBUGS-33882: Streamline bootstrap crds #1899
• STOR-1839: promote VSphereDriverConfiguration feature to Accessible-by-default #1902
• API-1783: bump(k8s): update k8s to v1.30 #1813
• CFE-1047: Add the field “CapacityReservationGroupID” to “AzureMachineProviderSpec” in openshift/api #1866
• remove console v1alpha1 which was present since 4.12 #1856
• ETCD-488: Move etcd hardware speed feature to GA #1844
• API-1783: Promote ValidatingAdmissionPolicy to GA #1888
• NO-JIRA: Enable the ibm-cloud-managed cluster profile on network.operator CRD #1896
• Full changelog

cluster-config-operator

• OCPBUGS-75998: Update logrus to 1.9.3 to address CVE-2025-65637 #465
• append .0 to go.mod version #441
• OCPBUGS-34178: Updating ose-cluster-config-operator-container image to be consistent with ART for 4.17 #419
• Full changelog

cluster-control-plane-machine-set-operator

• OCPBUGS-44047: relax validation on delete and if failureDomains not configured #330
• OCPBUGS-38643: Add 1 minute stabilisation for clusteroperators after rollout #321
• OCPBUGS-36469: Bump openshift/api #315
• CFE-1087: API Bump for capacity Reservation #313
• NO-JIRA: Update OWNERS #311
• NO-JIRA: CPMS Cluster Operator should set related objects #310
• OCPBUGS-35416: Wait for ControlPlaneMachineSet to be created when waiting for it to be updated #305
• OCPBUGS-35069: Improved debugging of API listing errors #297
• OCPBUGS-20061: Add unreadyNodeGracePeriod for allowing brief node hiccups #294
• OCPCLOUD-2600: Bump deps to k8s v1.30, go 1.22 #295
• Full changelog

cluster-csi-snapshot-controller-operator

• OCPBUGS-103180: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #292
• CNV-43972: HCP custom tolerations integration #214
• STOR-1593: Update api extensions to upstream #215
• STOR-1596: Bump all deps for 4.17 #213
• OCPBUGS-36528: Rename Dockerfile #212
• OCPBUGS-34449: Updating ose-cluster-csi-snapshot-controller-operator-container image to be consistent with ART for 4.17 #210
• OCPBUGS-34174: Updating ose-cluster-csi-snapshot-controller-operator-container image to be consistent with ART for 4.17 #209
• Full changelog

cluster-dns-operator

• OCPBUGS-103178: Use patched x/net fork v0.35.0-sec.4 #494
• OCPBUGS-52497: [release-4.17] Add runbook_url for CoreDNSErrorsHigh #430
• OCPBUGS-33750: Bump version of DNSNameResolver controller #415
• OCPBUGS-34229: Updating ose-cluster-dns-operator-container image to be consistent with ART for 4.17 #414
• OCPBUGS-34229: Updating ose-cluster-dns-operator-container image to be consistent with ART for 4.17 #413
• Full changelog

cluster-etcd-operator

• OCPBUGS-103181: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #1696
• OCPBUGS-68156: Update logrus to 1.9.3 to address CVE-2025-65637 #1542
• OCPBUGS-61337: Vendor latest mixin, including additional and modified alerts for etcdDatabaseQuotaLowSpace #1480
• OCPBUGS-60220: add missing ports to svc and pod spec #1461
• OCPBUGS-53511: fix CVE-2025-30204 #1414
• OCPBUGS-38574: use pooled client for etcd single member health checks #1327
• OCPBUGS-38454: prefer env var over hardcoding ciphers #1316
• NO-JIRA: degrade targetconfigcontroller on quorum loss #1309
• OCPBUGS-36462: ensure ordering in member health checks #1308
• NO-JIRA: only update envvar listeners on real changes #1300
• ETCD-636: expose PruneOpts #1297
• ETCD-493: Reflect etcd grafana dashboard mixin from upstream #1291
• ETCD-604: Prune revisioned resources #1292
• OCPBUGS-36621: Force sync on missing etcd-all-bundles configmap #1296
• Revert “OCPBUGS-36621: add etcd-all-bundles to cvo create-only” #1295
• ETCD-574: Update TLS artifact descriptions according to registry requ… #1294
• OCPBUGS-36621: add etcd-all-bundles to cvo create-only #1293
• NO-JIRA: only read signer/bundles on forced leaf generation #1288
• OCPBUGS-36301: parallelize member health checks #1286
• OCPBUGS-36407: Rename Dockerfile.rhel7 to Dockerfile.ocp #1289
• NO-JIRA: cert rotation same assertions #1285
• NO-JIRA: fix false positive bootstrap in cert signer controller #1283
• NO-JIRA: update library-go #1281
• ETCD-607: gate leaf cert generation (with bundle revision) #1275
• NO-JIRA: Update etcd-tls-assets.md #1195
• ETCD-606: Batch bundle revision rollout #1271
• NO-JIRA: update library go #1274
• ETCD-620: Update api vendor libraries to get GA’ed tuning profiles #1264
• TRT-1687: Revert #1268 “ETCD-606: Batch bundle revision rollout” #1270
• ETCD-603: add revision helpers #1267
• OCPBUGS-34376: Updating cluster-etcd-operator-container image to be consistent with ART for 4.17 #1263
• NO-JIRA:check the cluster is healthy or not after getting env var, to ensure it is safe to rollout #1262
• And 1 elided commits (e.g. from squash or rebase merges)
• Full changelog

cluster-image-registry-operator

• OCPBUGS-68157: Bump github.com/sirupsen/logrus to 1.9.3 #1284
• OCPBUGS-53871: bump github.com/golang-jwt/jwt #1218
• OCPBUGS-51604: bump golang.org/x/oauth2 #1209
• OCPBUGS-51103: ensure that storage names don’t end in dashes #1180
• OCPBUGS-43564: fix proxy config and leader election test flakes #1144
• OCPBUGS-43350: pkg/storage/azure: also check for auth failure error code on deletion #1139
• OCPBUGS-42812: azureclient: stop validating credentials when creating the client #1130
• OCPBUGS-42394: pkg/storage/azure: use cluster-api tag key to discover vnet #1125
• OCPBUGS-42362: Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #1124
• OCPBUGS-38538: Avoid Shared Access Key usage for Azure Storage Account when using Managed Identity based auth #1103
• OCPBUGS-38885: pkg/resource: invoke update-ca-trust extract with –output #1097
• IR-467, OCPBUGS-38379: Enable MSI override for ARO HCP #1088
• SPLAT-1721: Remove alibaba #1077
• IR-471: Removing featuregate for chunkSizeMiB config #1073
• Revert “IR-467: Enable Azure MSI authentication” #1079
• IR-467: Enable Azure MSI authentication #1020
• OCPBUGS-37207: Power VS: Check endpoints against lower case strings #1076
• IR-471: Adding additional validation #1074
• OCPBUGS-36038: go.*,vendor: bump go-retryablehttp #1063
• IR-477: pkg/operator: deactivate azure path fix job #1061
• IR-471: Exposing chunksize variable to utilize docker registry config #1060
• OCPBUGS-34107: Updating ose-cluster-image-registry-operator-container image to be consistent with ART for 4.17 #1045
• OCPBUGS-34399: Update rbac for featuregate #1056
• OCPBUGS-33453: add SAR capability to image-registry #1046
• CFE-962: Refactor code to mock GCP tag service for UTs #1027
• OCPBUGS-34399: Revert “Merge pull request #1026 from deepsm007/expose-chunksize” #1052
• OCPBUGS-34399: Exposing chunksize variable to utilize docker registry config #1026
• OCPBUGS-34107: Updating ose-cluster-image-registry-operator-container image to be consistent with ART for 4.17 #1040
• OCPBUGS-32710: pkg/storage/s3: use force path style in favour of virtual hosted style config #1028
• OCPBUGS-33149: azure-path-fix: get client secret from k8s secret #1029
• OCPBUGS-33868: Bump openshift api, client-go & library-go #1036
• Full changelog

cluster-ingress-operator

• OCPBUGS-103182: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1572
• OCPBUGS-86714: Add configuration override for X-SSL strip #1486
• OCPBUGS-71184: Implement HTTPKeepAliveTimeout tuning option #1335
• OCPBUGS-49702: Add e2e tests for IdleConnectionTerminationPolicy #1225
• OCPBUGS-49702: Add support for IdleConnectionTerminationPolicy #1223
• OCPBUGS-39220: Ingress operator status not degraded when canary route fails #1136
• OCPBUGS-38646: Clear LB Status Parameters on LB Type Change #1131
• OCPBUGS-38540: Resolve DNS Resolution CI Flakes in Subnets and EIP E2E #1129
• OCPBUGS-38079: Bump controller-runtime to v0.18.4 #1122
• NE-1798: API bump for promotion of eipAllocation from feature gates to GA. #1118
• NE-1688: Enable Azure MSI authentication for ARO HCP #1119
• NE-1674: Add LB EIP Allocation for AWS #1109
• NE-1531: Fix Initialization of NLB Status Parameters #1114
• NE-1531: AWS Subnet Selection #1046
• NE-1273: Add a watch to the ingress operator so it will recreate the gwapi crds #1106
• OCPBUGS-37627: Fix getRouteHost error handling #1110
• NE-1208: Gateway API E2E Testing #1023
• OCPBUGS-31664: Fix SyncLoadBalancerFailed status message of IngressController #1102
• OCPBUGS-36465: Delete and recreate canary route to clear spec.host #1095
• OCPBUGS-34413: Refine logging for accurate infra CR status updates #1103
• OCPBUGS-35342: Add e2e test for connect timeout #1084
• NO-JIRA: Add grzpiotrowski to OWNERS #1090
• NO-JIRA: addowner-Thealisyed #1091
• OCPBUGS-35356: Retry IngressController updates in router status E2E #1085
• OCPBUGS-9037: Change Canary to use passthrough route #978
• OCPBUGS-35368: Add Regexp Anchor to TestAll #1087
• OCPBUGS-23221: internalServiceChanged: Fix target port logic #1052
• OCPBUGS-34262: Updating ose-cluster-ingress-operator-container image to be consistent with ART for 4.17 #1067
• NE-1400: Bump to OSSM 2.5 and Gateway API v0.6.2 CRDs #1018
• OCPBUGS-33792: Bump openshift/library-go to resolve NewPrometheusClient E2E failures #1054
• Full changelog

cluster-kube-apiserver-operator

• OCPBUGS-103173: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #2300
• OCPBUGS-68162: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-rhel9-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.17] #2055
• OCPBUGS-63614: SCC: add hostmount-anyuid-v2 #1954
• OCPBUGS-60398: Add missing service ports to apiserver service #1893
• OCPBUGS-50516: Increase waitForFallbackDegradedConditionTimeout #1803
• OCPBUGS-43657: audit: do not log requests to /livez #1758
• OCPBUGS-34310: Updating ose-cluster-kube-apiserver-operator-container image to be consistent with ART for 4.17 #1738
• OCPBUGS-41874: increase kube-apiserver failureThreshold #1733
• OCPBUGS-34679: revert dev cert rotation 4.17 #1729
• OCPBUGS-34942: Update APIRemovedInNextReleaseInUse for kube 1.30 / ocp 4.17 #1698
• NO-JIRA: nodekubeconfigcontroller: set ownership component for node kubeconfigs #1704
• AUTH-521: add disabled syncer as reason to CFE for PSA #1686
• NO-JIRA: update library-go #1703
• OCPEDGE-1102: Revert high cpu usage alert description #1680
• OCPEDGE-902: add SNO control plane high cpu usage alert #1676
• OCPBUGS-34782: manifests: add ownership annotation for kubelet-bootstrap-kubeconfig #1694
• OCPBUGS-34544: Disable PersistentVolumeLabel admission plugin #1693
• OCPBUGS-34800: Update APIRemovedInNextReleaseInUse for kube 1.30 / ocp 4.17 #1697
• OCPBUGS-33963: Create one-shot migrations for the flowcontrol group. #1689
• API-1783: bump(k8s): update k8s version to v1.30.0 #1666
• Full changelog

cluster-kube-cluster-api-operator

• OCPBUGS-80056: Bump google.golang.org/grpc to v1.79.3 #78
• OCPBUGS-42612: Sync Release 4.17 with UPSTREAM #48
• UPSTREAM: <carry>: OCPBUGS-30487: Bump google.golang.org/protobuf #39
• NO-JIRA: Update OWNERS #40
• OCPBUGS-34084: Updating ose-cluster-kube-cluster-api-operator-container image to be consistent with ART for 4.17 #38
• Full changelog

cluster-kube-controller-manager-operator

• OCPBUGS-103172: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #962
• OCPBUGS-68164: CVE-2025-65637 openshift4/ose-cluster-kube-controller-manager-rhel9-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.17] #908
• OCPBUGS-60249: Missing endpoint slices for open ports the operator uses #855
• NO-JIRA: update library-go #814
• OCPBUGS-34859: manifests: set owning-component for csr-signer-signer #812
• OCPBUGS-34281: Updating ose-cluster-kube-controller-manager-operator-container image to be consistent with ART for 4.17 #813
• API-1783: bump(k8s): bump k8s version to v1.30.0 #803
• OCPCLOUD-2513: Remove cloud-provider, cloud-config, and cloud-volume-plugin flags #806
• Full changelog

cluster-kube-scheduler-operator

• OCPBUGS-103171: [release-4.17] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #670
• CNTRLPLANE-2843: chore: update OWNERS #623
• OCPBUGS-68165: deps: Update library-go and logrus to fix a CVE #613
• no-jira: Rename Dockerfile #546
• NO-JIRA: update library-go #544
• OCPBUGS-34367: Updating ose-cluster-kube-scheduler-operator-container image to be consistent with ART for 4.17 #543
• API-1783: bump(k8s): bump k8s version to v1.30.0 #540
• Full changelog

cluster-kube-storage-version-migrator-operator

• OCPBUGS-68167: Bump github.com/sirupsen/logrus to 1.9.1 #140
• OCPBUGS-46593: “gracefully” shutdown KSVM pod. #123
• NO-JIRA: bump(*) #113
• OCPBUGS-34306: Updating ose-cluster-kube-storage-version-migrator-operator-container image to be consistent with ART for 4.17 #110
• OCPBUGS-34306: Updating ose-cluster-kube-storage-version-migrator-operator-container image to be consistent with ART for 4.17 #109
• Full changelog

cluster-machine-approver

• OCPBUGS-48155: Fix race condition in CO status controller test #266
• OCPBUGS-46429: Filter CSRs by signerName #261
• OCPBUGS-45918: Ensure trailing dots on DNS names do not block serving cert auth #256
• OCPBUGS-45918: Client internal DNS checks should ignore trailing dot #250
• OCPBUGS-43312: Client internal DNS checks should be case insensitive #242
• NO-JIRA: Update OWNERS #236
• OCPCLOUD-2602: Update dependencies to Kube 1.30 #235
• OCPBUGS-34138: Updating ose-cluster-machine-approver-container image to be consistent with ART for 4.17 #232
• OCPBUGS-33644: check for machine crd before listing machines #231
• Full changelog

cluster-monitoring-operator

• OCPBUGS-129160: don’t delete admin-owned Alertmanager secrets on destroy #3143
• NO-ISSUE: synchronize OWNERS from main branch [release-4.17] #3110
• OCPBUGS-103184: [release-4.17] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame- #3075 #3084
• OCPBUGS-77275: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2832
• OCPBUGS-64580: Fix KSM deny-list typo #2732
• OCPBUGS-63489: Add mcd_local_unsupported_packages metric from MCO to telemetry 4.17 #2725
• OCPBUGS-63123: test: remove image registry e2e tests #2715
• OCPBUGS-61766: chore(jsonnet): use prometheus_remote_storage_queue_highest_timestamp_seconds in PrometheusRemoteWriteBehind #2672
• OCPBUGS-60017: operator: increase wait time till degraded to max 4 times 5m #2634
• OCPBUGS-44971: Add new metrics for OpenShift logging telemetry #2526
• OCPBUGS-44003: fix(monitoring-plugin): disable emitting nginx version on error pages #2511
• OCPBUGS-43690: chore: introduce a config parsing check via a strict unmarshaller for… #2494
• OCPBUGS-43788: Add runbook url for TelemeterClientFailures #2507
• OCPBUGS-43545: Fix api doc on Thanos Ruler default retention #2501
• OCPBUGS-41341: disable user-defined monitoring per object #2458
• OCPBUGS-41908: filter alerts sent to Telemeter #2470
• OCPBUGS-41580: Configure graceful shutdown for metrics-server (4.17 backport) #2463
• OCPBUGS-39029: Backport #2441 for 4.17 #2445
• MON-3972: [bot] Synchronize versions of the downstream components #2434
• OCPBUGS-17506: Make error messages clearer on poll timeouts #2417
• MON-3964: set scrape timestamp tolerance for user workload monitoring #2429
• MON-3961: inject proxy env variables in Alertmanager #2424
• MON-3949: [bot] Synchronize versions of the downstream components #2419
• MON-3900: follow-up: clean up operator logic and some tests now that metrics-server is the default Metrics API backend #2425
• OCPBUGS-37686: fix documentation typos #2427
• NO-JIRA: fix: fix a small typo #2426
• MON-3921: Revert “Revert “Merge pull request #2392 from machine424/f-… #2403
• MON-3959: Skip TestTLSSecurityProfileConfiguration as disruptive #2423
• MON-3900: Remove prometheus-adapter code #2409
• MON-3947: [bot] Synchronize versions of the downstream components #2418
• MON-3947: [bot] Synchronize versions of the downstream components #2414
• MON-3947: Bump prometheus-operator to 0.75.1 #2416
• MON-2065: jsonnet: exclude kubernetes-storage rules #2377
• OCPBUGS-36495: Add deprecated config runbook #2410
• OCPBUGS-31250: Exclude windows nodes from kubelet servicemonitor #2368
• OCPBUGS-36406: add runbook_url annotations #2401
• MON-3914: add a regression test for gogc based on the go_gc_gogc_percent metric #2393
• MON-3914: [bot] Synchronize versions of the downstream components #2394
• OCPBUGS-36299: Revert #2392 “MON-3800: jsonnet: update prometheus dep to fetch the PrometheusKuber…” #2398
• MON-3800: jsonnet: update prometheus dep to fetch the PrometheusKuber… #2392
• OCPBUGS-35480: Add deprecation for prometheus adapter #2381
• MON-3915: chore: bump Go dependencies #2387
• MON-3914: adjust Prometheus GOGC based on infra topology #2390
• OCPBUGS-32696: opt-out of multi-cluster Prometheus dashboard #2351
• OCPBUGS-35397: attach runbook to the PrometheusDuplicateTimestamps alert #2365
• MON-3905: [bot] Synchronize versions of the downstream components #2382
• MON-3894: revert(monitoring-plugin): undo nginx caching tweaks as the issue was… #2380
• MON-3795, SDN-3817: Expose OVNKubernetes:AdminNetworkPolicy Metrics via telemetry #2297
• MON-3897: [bot] Synchronize versions of the downstream components #2378
• OBSDOCS-883: change docs to correct retention time uwm prometheus #2277
• MON-3884: Send metric acm_managed_cluster_worker_cores via Telemetry #2367
• MON-3887, MON-3889: [bot] Synchronize versions of the downstream components #2376
• MON-3888: bump go tools 1.22 #2375
• MON-3882: [bot] Synchronize versions of the downstream components #2371
• MON-3701: clean-up injection of CA bundle for user Alertmanager #2361
• OCPBUGS-33645: inject trusted CA bundle into UWM Alertmanager #2349
• OCPBUGS-34437: Updating cluster-monitoring-operator-container image to be consistent with ART for 4.17 #2372
• MON-3881: chore: remove hack/ocp-images.sh #2366
• MON-3801: clean-up unused OAuth proxy references #2359
• MON-3701: clean-up injection of CA bundle for user Prometheus #2362
• MON-3874: chore: poll immediately in the e2e tests #2356
• MON-3701: clean-up tests #2360
• OCPBUGS-33955: remove deprecated logtostderr argument #2355
• OCPBUGS-33686: [bot] Synchronize versions of the downstream components #2363
• OCPBUGS-23000: node-exporter: Prevent cluster-autoscaler from evicting #2346
• MON-3763: Add cnv_abnormal #2291
• OCPBUGS-34080: Updating cluster-monitoring-operator-container image to be consistent with ART for 4.17 #2358
• : NO-JIRA: Fix formatting in the resources documentation #2353
• Full changelog

cluster-network-operator

• OCPBUGS-85244: whereabouts-token-watcher DaemonSet improvements #3016
• OCPBUGS-84181: fix(hypershift): use net.JoinHostPort for URL construction #2983
• OCPBUGS-73799: Tweak iptables-alerter to try to avoid crictl bug #2878
• : NO-JIRA: Update CNO reviewers/approvers #2767
• OCPBUGS-74348: [release-4.17] fix typo in release annotation for whereabouts-token-watcher deamonset #2888
• OCPBUGS-45086: Re-disable metrics server #2579
• OCPBUGS-63154: Add drop flows for GARPs #2818
• [Release 4.17] OCPBUGS-61765: Update CNO reviewers/approvers #2799
• OCPBUGS-58066: [release-4.17]: Manual feature backport of cert rotation for whereabouts #2784
• OCPBUGS-57285: Implement IPsec NAT-Traversal encapsulation option #2726
• OCPBUGS-55518: iptables-alerter streamlining #2698
• OCPBUGS-55033: Add IPv6 NGINX configuration #2689
• OCPBUGS-52951: Unexpected Behavior During Cluster Upgrade for the ovn-ipsec-host pods #2654
• OCPBUGS-49816: ovn-k, rbac: Enable users read & modify UserDefinedNetwork CRs #2655
• OCPBUGS-49961: Update egressfirewall CRD to be consistent with ovn-kubernetes repo #2642
• : OCPBUGS-44863: Add nodeslicepool #2574
• OCPBUGS-44807: ovn-k, cudn: Add missing permissions to ovnkube-node #2575
• OCPBUGS-43714: Skip including default crypto policies to avoid authby issue #2597
• OCPBUGS-46146: Remove ip xfrm state when IPsec is disabled #2594
• OCPBUGS-44415: Pass transit_switch_subnet options in ovnkube-node pod #2561
• OCPBUGS-44807, SDN-4930, SDN-5297: OVN-Kubernetes node RBAC tightening #2568
• OCPBUGS-44807, SDN-5297, SDN-5472: bindata, ovn-k: Add ClusterUserDefinedNetwork CRD and RBAC #2566
• OCPBUGS-44807, SDN-4930, SDN-5297: ovn-k, udn: Update UserDefinedNetwork CRD #2551
• OCPBUGS-44807, SDN-4930, SDN-5297: Adds UDN list/watch to ovnknode rbac #2540
• OCPBUGS-44779, SDN-5436: Provide support for user owned IPsec machine configs #2564
• OCPBUGS-44330: Add controlplane cli image envar for use with hypershift #2542
• OCPBUGS-43343: OCPBUGS-42244: Exporting environment varialbe NODE_CNI for live migration #2536
• OCPBUGS-43317: Use CNIConfDir for mounting directory to ovn-ipsec-host pod #2533
• OCPBUGS-39300: rebase openshift/api for openshift-sdn removal [4.17] #2477
• OCPBUGS-39121: Live migration: report network overlap via live_migration_blocked metric #2483
• OCPBUGS-42260: Configure narrowing=yes for IPsec connections #2510
• OCPBUGS-41674: Add configurable subnets while running hybrid-overlay-node binary #2497
• OCPBUGS-41591: Set required-scc for openshift workloads #2490
• OCPBUGS-39313: HyperShift: do not use antiaffinity on single replica control planes #2486
• OCPBUGS-39387: add required-scc annotation to console-plugin deployment #2487
• OCPBUGS-39425: Preload networking plugin locales #2489
• OCPBUGS-38932: Deploy networking-console-plugin by CNO #2478
• OCPBUGS-38932: Add networking-console-plugin image to release payload #2474
• OCPBUGS-38654: [release-4.17] Verify that the codegen changes were commited #2475
• OCPBUGS-38364: OVN-K, UDN CRD: Add missing permissions to control-plane #2472
• OCPBUGS-38176: multus, Add openshift-cnv to globalNamespace #2466
• SDN-4919: Change the masquerade subnet default value for new clusters #2460
• SDN-5072: Deploy FRR-K8s #2450
• SDN-5144: Add UserDefinedNetwork CRD and RBAC #2464
• SDN-4773: Add Azure MSI Env Var for ARO HCP #2465
• NO-JIRA: more openshift-sdn cleanup #2455
• SDN-5070: Allow day 2 customization of masquerade subnet #2421
• OCPBUGS-37786: Add proxy env vars to onvkube-node #2453
• OCPBUGS-37713: Handle random crictl errors in iptables-alerter #2451
• CNV-43973: HCP custom tolerations integration #2441
• SDN-4919: OVN-Kubernetes UDN: EndpointSlice mirror controller RBAC permissions #2448
• SDN-4934: Enable TechPreview FeatureGate for NetworkSegmentation #2433
• OCPBUGS-33758: Fix IC distributed control plane alerts #2406
• SDN-5029: ipam, virt: enable the persistent ips feature #2431
• SDN-4916: Bump to k8s v1.30 latest #2429
• OCPBUGS-30950: Set mount propagation to HostToContainer for /var/lib/kubelet #2368
• SDN-4934: Network Segmentation Feature Gate Vendoring from API #2428
• OCPBUGS-23758: Set global IP forwarding sysctl parameters while starting ovnkube-node #2385
• OCPBUGS-29648: update whereabouts crd #2414
• OCPBUGS-31878: Propogate hypershift control plane priority class override to multus and preserve container resource requests #2335
• OCPBUGS-35316: Create the configmap mtu if not found #2410
• OCPBUGS-34313: Updating cluster-network-operator-container image to be consistent with ART for 4.17 #2381
• OCPBUGS-30948: Use applyconfigurations for updating network.oprerator status #2333
• SDN-5029: linter: removed deprecated linters #2408
• OCPBUGS-23000: Adds cluster-autoscaler annotation to prevent eviction #2369
• OCPBUGS-33497: Limit iptables-alerter’s cpu #2401
• SDN-4896: Drop openshift-sdn support #2384
• NP-976, OCPBUGS-34658: Live migration: add metrics to observe CNI live migration #2388
• OCPBUGS-34858, OCPBUGS-34916: Validate live migration before setting the progressing condition #2399
• OCPBUGS-34524: Fix DNSResolver feature gate enablement #2387
• MON-3795, SDN-3817: Add ANP metric rule expressions for telemetry exposure #2347
• OCPBUGS-33497: Handle pod exiting race conditions in iptables-alerter #2377
• OCPBUGS-31876: Enable UDP aggregation on s390x #2331
• OCPBUGS-34359: Ensure that the node-identity webhook address contains colons for IPv6 #2382
• NP-975: Align new node subnet allocation between OVN-K and SDN during live migration #2367
• OCPBUGS-32991: Add conditions for ignored-namespaces #2358
• NP-974: Validation for live migration from OpenShiftSDN to OVNKubernetes #2344
• OCPBUGS-33728: Add custom masquerade subnet against right key at ovnkube-config CM #2371
• Full changelog

cluster-node-tuning-operator

• OCPBUGS-82706: Bump github.com/moby/spdystream from v0.2.0 to v0.5.1 #1548
• OCPBUGS-78214: PPC: filter out namespaces dir #1481
• OCPBUGS-63504: Do not cause kubelet failed dependency by ocp-tuned-one-shot.service #1418
• And 65 elided commits (e.g. from squash or rebase merges)
• Full changelog

cluster-olm-operator

• OCPBUGS-103193: bump golang.org/x/net to v0.35.0-sec.3 to fix CVE-2026-33814 #246
• OCPBUGS-80063: Bump google.golang.org/grpc to v1.79.3 #201
• OCPBUGS-37544: add version flag #62
• OPRUN-3403: Remove Rukpak references from code #63
• OPRUN-3405: Stop building rukpak #60
• OPRUN-3437: update configmap permissions #59
• OCPBUGS-36686: Re-enable cluster-olm-operator #58
• OCPBUGS-34126: Updating ose-cluster-olm-operator-container image to be consistent with ART for 4.17 #55
• OCPBUGS-36684: Disable cluster-olm-operator #56
• NO-ISSUE: Update owners #57
• Full changelog

cluster-openshift-apiserver-operator

• OCPBUGS-68170: CVE-2025-65637 - Update library-go to bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.17] #653
• OCPBUGS-43657: audit: do not log requests to /livez #599
• OCPBUGS-41850: increase openshift-apiserver failureThreshold #589
• OCPBUGS-34349: Updating ose-cluster-openshift-apiserver-operator-container image to be consistent with ART for 4.17 #580
• OCPBUGS-34349: Updating ose-cluster-openshift-apiserver-operator-container image to be consistent with ART for 4.17 #579
• Full changelog

cluster-openshift-controller-manager-operator

• OCPBUGS-47770: Add team members to the OWNERS file #375
• no-jira: OWNERS: remove former employees #354
• OCPBUGS-35801: nil pointer reference in ocm-operator #355
• WRKLDS-1327: Replace wildcards by explicit list of verbs #353
• WRKLDS-1292: Bump k8s dependencies to 1.30.1 #352
• OCPBUGS-34395: Move cluster Build CR to runlevel 10 to match CRD #351
• OCPBUGS-34077: Always Disable Default Rolebindings Controller #346
• OCPBUGS-34054: lots of churn during image registry managed/removed transition #347
• OCPBUILD-9: Adds capabilities for builder & deployer rolebindings controller #335
• Full changelog

cluster-policy-controller

• OCPBUGS-41849: pkg/psalabelsyncer: switch to PSA version ‘latest’ #154
• WRKLDS-1292: bump(k8s.io)=1.30.1 #151
• OCPBUGS-34304: Updating ose-cluster-policy-controller-container image to be consistent with ART for 4.17 #150
• OCPBUGS-34304: Updating ose-cluster-policy-controller-container image to be consistent with ART for 4.17 #149
• Full changelog

cluster-samples-operator

• OCPBUGS-129480: Restrict samples operator access to the global pull-secret #733
• OCPBUGS-63515: references to github.com/sclorg/django-ex.git now also refer to the branch #658
• OCPBUGS-55800: only update LastTransitionTime if operator status change #640
• OCPBUGS-55795: Adding filter to clusterOperatorInformerEventHandler #639
• OCPBUGS-55894: Samples Operator should sort failing image imports #641
• OCPBUGS-55042: Adding mutex to func createSamples on handler.go #632
• OCPBUGS-54362: add rhdmalone to owners #619
• OCPBUGS-48786: add shannon and aroyoredhat as owners #595
• OCPBUGS-39120: Sync the non-OKD assets from master to release-4.17 #577
• OKD-225: remove only the EOL CentOS 7 images #575
• OCPBUGS-39071: Fix library-sync.sh to handle renames in unsupported samples #565
• OCPBUGS-38927: Update Go version, API version and vendored libs to the same versions as in the openshift/api. #564
• OCPBUGS-33899: Updating ose-cluster-samples-operator-container image to be consistent with ART for 4.17 #547
• OCPBUGS-38471: Only pick up the changes from the supported imagestreams and templates in library-sync.sh. #560
• KUBESAW-162: add mfrancisc and metlos as owners #549
• Full changelog

cluster-storage-operator

• OCPBUGS-103187: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #734
• OCPBUGS-87591: remove oVirt code from CSO 4.17 #708
• OCPBUGS-41160: Move metrics to vsphere driver #633
• OCPBUGS-52222: fix Vsphere cluster Storage operator in Unavailable state #560
• OCPBUGS-44997: Fix PodStartupStorageOperationsFailing alert #543
• OCPBUGS-43794: add ability to control kube rbac proxy container image on controlplane #529
• OCPBUGS-43112: assets: shared-resource: hypershift: add pull-secret to operator SA #520
• OCPBUGS-38355: Bump openshift/api to get EFS volume metrics #501
• OCPBUGS-38760: include azure perms for route table #503
• OCPBUGS-39365: Use restricted-v2 SCC and remove runAsUser in Hypershift #498
• STOR-1422: Bump(openshift/api): to get EFS volume metrics #496
• CFE-879: Add TagUser role to creadentials request of GCP PD operator #490
• OCPBUGS-37488: Pass TOOLS_IMAGE env var to AWS EBS CSI Driver operator #494
• CNV-44992: HCP custom tolerations integration #493
• OCPBUGS-37633: Add permissions for vsphere_problem_detector to access clustercsidrivers #495
• STOR-1767: Disable vsphere-problem-detector alerts if ManagementState==Removed #487
• STOR-1596: Bump all deps for 4.17 #486
• MON-2065: manifests: add k8s storage rules #477
• OCPBUGS-36169: deactivate MultipleDefaultStorageClasses alert immediately after being fixed #483
• STOR-1767: add env var OPERATOR_NAME to vsphere csi operator deployment #485
• STOR-1593: add patch role to PVs for provisioner #482
• OCPBUGS-34590: revert vsphere problem detector controller name change #479
• OCPBUGS-34291: Updating ose-cluster-storage-operator-container image to be consistent with ART for 4.17 #476
• STOR-1839: VSphereDriverConfiguration feature Accessible-by-default #478
• STOR-1839: VSphereDriverConfiguration feature Accessible-by-default #475
• OCPBUGS-34291: Updating ose-cluster-storage-operator-container image to be consistent with ART for 4.17 #474
• SPLAT-1555: Added featuregate for vSphere Multi vCenter. #465
• Full changelog

cluster-update-keys

• NO-ISSUE: Updating ose-cluster-update-keys-container image to be consistent with ART for 4.17 #79
• Revert “OCPBUGS-38257: Revert #58 “OTA-1304: manifests.rhel/0000_90_openshift-cluster-image-policy: New manifest”” #61
• OCPBUGS-37770: Revert #58 “OTA-1304: manifests.rhel/0000_90_openshift-cluster-image-policy: New manifest” #59
• OTA-1304: manifests.rhel/0000_90_openshift-cluster-image-policy: New manifest #58
• OCPBUGS-35528: keys: Update Red Hat keys to use SHA256 signatures #57
• Full changelog

cluster-version-operator

• OCPBUGS-103186: Bump golang.org/x/net to v0.35.0-sec.3 #1460
• OCPBUGS-58451: Failing=Unknown upon long CO updating #1212
• OCPBUGS-50589: Set openshift.io/required-scc: privileged annotation in version pods #1154
• OCPBUGS-39558: Filter out shallowly UpdateEffectNone errors from a MultipleErrors message in the Failing condition #1114
• OCPBUGS-45328: deps: bump golang.org/x/net to 0.31.0 #1117
• OCPBUGS-43586: Upgradeable=False should not block a 4.(y+1).z to 4.(y+1).z’ retarget #1095
• OCPBUGS-41642: vendor: Update openshift/api to pick up the v4.17 capability sets #1087
• OCPBUGS-37770: cmd/render: Add –feature-gate-manifest-path option #1078
• OCPBUGS-37770: pkg/payload/render: Include release image (Cluster)ImagePolicy #1076
• OCPBUGS-37345: Revert “OCPBUGS-35994: Revert “OCPBUGS-24535: pkg/payload/precondition/clusterversion/rollback: Allow previous version within z-stream”” #1072
• no-jira: TestCVO: set known caps from configv1.KnownClusterVersionCapabilities #1075
• no-jira: TestSetCapabilities: use KnownClusterVersionCapabilities for known keys instead of picking DefaultCapabilitySet #1073
• OCPBUGS-32678: Fix a panic caused by a data race #1070
• OCPBUGS-33983: vendor: Update openshift/api to pick up zz_generated.crd-manifests #1045
• OCPBUGS-35994: Revert “OCPBUGS-24535: pkg/payload/precondition/clusterversion/rollback: Allow previous version within z-stream” #1061
• Revert “METAL-1053, OCPBUGS-33983: Remove baremetal dependency on MachineAPI capability” #1063
• METAL-1053: Remove baremetal dependency on MachineAPI capability #1051
• NO-JIRA: Update OWNERS #1058
• OCPBUGS-35464: Updating cluster-version-operator-container image to be consistent with ART for 4.17 #1056
• Revert “OCPBUGS-34287: Updating cluster-version-operator-container image to be consistent with ART for 4.17” #1055
• NO-JIRA: typo change previousily to previously #1054
• OCPBUGS-34287: Updating cluster-version-operator-container image to be consistent with ART for 4.17 #1047
• OCPBUGS-35236: Revert: Add support for Custom Certificate Authorities for custom signature stores” #1052
• And 1 elided commits (e.g. from squash or rebase merges)
• Full changelog

configmap-reloader

• append .0 to go.mod version #70
• OCPBUGS-34355: Updating configmap-reload-container image to be consistent with ART for 4.17 #62
• OCPBUGS-34355: Updating configmap-reload-container image to be consistent with ART for 4.17 #61
• Full changelog

console

• OCPBUGS-127155: [release-4.17] inkify-it: Denial of Service via crafted mailto: links #17382
• Fix for OCPBUGS-92069: CVE-2026-44990 #16718
• OCPBUGS-78672: Namespace is not persisting when switching to developer view from the topology page of admin page #16160
• OCPBUGS-98411: CVE-2026-59869 bump js-yaml #17086
• OCPBUGS-100514, OCPBUGS-101790: Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss #17059
• OCPBUGS-100172: Prevent binary secret data corruption when editing #16879
• OCPBUGS-105790: Disable shipwright e2e tests to unblock CI #16955
• OCPBUGS-87986: [release-4.17] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16600
• Fix for OCPBUGS-81600: CVE-2026-4800 #16564
• OCPBUGS-84283: Bump follow-redirects to 1.16.0 to fix CVE-2026-40895 #16738
• OCPBUGS-77124: [release-4.17] CVE-2026-26996 Bump minimatch library #16345
• OCPBUGS-79443: Bump immutable #16326
• NO-JIRA: enable multi-architecture yarn builds #16419
• CONSOLE-5011: migrate to yarn berry #16074
• NO-JIRA: Bump builder image to v29 #15994
• OCPBUGS-74452: Bump lodash to latest #15966
• OCPBUGS-69403: Disallowed Pipelines-plugin Pipelines navigation section #15849
• OCPBUGS-65933: Preserve URL in perspective switch + remove dev console folks from reviewers #15762
• OCPBUGS-64942: Expose prometheus tenancy label path as a proxy #15710
• OCPBUGS-64599: Remove required flag from ‘console.flag/model’ pipelines-plugin extension #15665
• OCPBUGS-62631: /auth/error?error=missing_state&error_type=auth is showing blank page #15554
• OCPBUGS-63212: switch to dev perspective for /dev-monitoring #15614
• OCPBUGS-63397: fix bug where Roles list was displaying invalid data f… #15627
• OCPBUGS-62282: Fix desync of console and variable namespace #15545
• OCPBUGS-44154: bump dompurify to latest #15590
• OCPBUGS-61737: Remove ancient X-XSS-Protection header #15494
• OCPBUGS-54241: VolumeSnapshots are not displayed in OpenShift Web Console #15465
• OCPBUGS-59747: OpenShift console PVC clone cannot use B as the unit #15324
• NO-JIRA: Increase the timeout on the cypress test #15420
• OCPBUGS-58365: change ‘/metrics/usage’ endpoint to ‘/api/metrics/usage’ #15271
• OCPBUGS-59544: Secret key with binary file changes when edited via Console #15301
• OCPBUGS-59784: Update the golang.org/x/crypto/ssh to 0.31.0 in the openshift-console image #15329
• OCPBUGS-58337: Tolerate unknown fields in Infrastructur… #15236
• OCPBUGS-59492: Cannot read properties of undefined (reading ‘node-role.kubernetes.io/master’) error while accessing node logs from console #15294
• OCPBUGS-59879: add data-test attrs to console plugins … #15338
• OCPBUGS-59510: Not able to launch terminal window from OCP web console due to console plugin conflicts #15297
• OCPBUGS-59265: fix bug where / in console.tab/horizontalNav href brea… #15270
• OCPBUGS-58318: Implement sessions in openshift authenticator #15238
• OCPBUGS-58224: Add the ability to launch multiple modals with useModal hook #15222
• OCPBUGS-58378: Cannot read properties of undefined (reading ‘filter’) error while accessing nodes from console. #15241
• OCPBUGS-57835: Add flags in console static plugin for all the components of this epic #15192
• OCPBUGS-57932: Fix TypeError Cannot read properties of null (reading ‘metadata’) #15197
• OCPBUGS-57182: Fix ‘/metrics’ endpoint token review to handle interna… #15154
• OCPBUGS-56895: HorizontalPodAutoscalers via console require CPU resource limit even though HPAs use requests for scaling #15108
• OCPBUGS-57095: Add all files to vendor regardless of gitignore #15132
• OCPBUGS-57114: Debug pod logs are not accessible when debugging a node via OpenShift Console #15142
• OCPBUGS-56975: Sample segment sessions #15114
• OCPBUGS-56844: Enable knative tests #14387
• OCPBUGS-56375: remove 60 day alert from cluster update modal #15062
• OCPBUGS-55924: Fetching taskRuns in PLR details page using PLR UID also #15029
• OCPBUGS-55756: update the Deployment pod on change in imageStream #15022
• OCPBUGS-56238: Remove the devconsole backend common internet proxy and replace it with dedicated ones #15049
• OCPBUGS-55447: Authenticate user token in openshift Authenticate func #15010
• OCPBUGS-55415: fix bug where operator appears twice #15002
• OCPBUGS-55202: Do not load CSRs if user does not have permissions #14985
• OCPBUGS-52999: Pipeline visualisation shows all tasks as Failed and after that goes to Running state #14862
• OCPBUGS-53168: Remove logoutOpenShift method call #14883
• OCPBUGS-51277: Fix JSON annotation parsing issue and harden related code #14795
• OCPBUGS-53086: Update the monitoring topic used by the console team #14871
• OCPBUGS-52205: Show Observe section without PROMETHEUS and MONITORING flags #14811
• OCPBUGS-51292: fix run time error when no completed version exists #14796
• OCPBUGS-51126: Fix alert rule link to alert in dev perspective #14785
• OCPBUGS-49795: ‘create a Project’ button on Getting started page doesn’t work #14714
• OCPBUGS-39602: Set default build option as BUILDS for Builder Image sample #14241
• OCPBUGS-45740: Fix Function Import: An error occurred Cannot read properties of undefined (reading ‘filter’) #14595
• OCPBUGS-45625: use default StorageClass for ServerlessFunction pipelineVolumeClaimTemplate #14589
• OCPBUGS-41596: No need to supply ‘User workload notifications’ option on ‘User Preference’ page for normal user #14265
• OCPBUGS-44220: disable flaking and change pre-condition test for knative e2e #14467
• OCPBUGS-43751: Added token to proxy header #14430
• OCPBUGS-48161: ERROR in search tool: Cannot read properties of undefined (reading ‘state’) #14667
• OCPBUGS-48227: fix navigation from non-General User Preference tab to… #14674
• OCPBUGS-41672: Update vendor imports to include all PatternFly components #14272
• OCPBUGS-46344: OCP web console show pod status as Init:0/1 after using Native sidecars #14616
• OCPBUGS-47497: Getting Oh no, something went wrong error when trying to install operator. #14645
• OCPBUGS-43673: Disable GQL introspection #14640
• OCPBUGS-45949: ReRun of Resolver based PipelineRuns fails from UI #14605
• OCPBUGS-45954: Fixed capitalization in OpenShift Lightspeed #14607
• OCPBUGS-45948: ImagePullSecret getting duplicated when editing DeploymentConfig in Form View #14604
• OCPBUGS-45667: Do not pass CSV name to operand list page when an exen… #14591
• OCPBUGS-46000: The description and name for GCP Pool ID is not consist #14611
• OCPBUGS-42558: Plugins that use very old PF4 dropdown or menu components with grouped items have bullets and padding that needs to be removed. #14344
• OCPBUGS-44656: update ConditionalUpdates release type #14505
• OCPBUGS-43888: While accessing the node terminal from UI observed ‘Warning alert:Admission Webhook Warning` #14444
• OCPBUGS-43441: fix table combination #14546
• OCPBUGS-44169: use TaskRuns results.tekton.dev/record annotation to get the logs #14538
• OCPBUGS-44873: Unable to remove finally tasks in pipeline builder mode #14527
• OCPBUGS-42791: Add missing pipelines plugin name to known plugins #14377
• OCPBUGS-44699: Add multiline support to template instantiation #14508
• OCPBUGS-44183: Remove ClusterTask dependency in console from Pipelines 1.17 #14512
• OCPBUGS-44764: Add IBM Block Storage CSI driver support for RWX #14517
• OCPBUGS-43795: While upgrading the cluster from UI observed Warning alert:Admission Webhook Warning #14433
• OCPBUGS-44722: include external labels so silenced alerts not displayed in notifications #14511
• OCPBUGS-44358: BuildConfig form breaks on manually enter the Git URL #14478
• OCPBUGS-43073: Telemetry userPreference results in empty nodes output to the DOM #14392
• OCPBUGS-44587: Start last run do not work in buildConfig details page #14499
• OCPBUGS-44586: Collapse/Expand Feature Added, Removal Option Removed in Version 4.16 #14498
• OCPBUGS-44450: Don’t request user settings configmap if no user has been loaded. #14482
• OCPBUGS-44479: conditionally display MachineConfig details page Confi… #14488
• OCPBUGS-43878: Add flag to hide the pipelines-plugin pipeline builder extensions #14457
• OCPBUGS-42824: remove axios as it is no longer in use #14381
• OCPBUGS-42955: Enabling topology e2e tests on CI #14402
• OCPBUGS-43009: Project is “Undefined” on “VolumeSnapshot” create page #14389
• OCPBUGS-42607: add role exclusion to avoid unexpected triggering the namespace menu #14351
• OCPBUGS-42606: make createdBy mandatory and auto fill with the current user #14352
• OCPBUGS-42585: Red Hat Camel K Operator installation via cli #14346
• OCPBUGS-42299: Increase login flow state paramater length/entropy #14318
• OCPBUGS-42391: change “Partial cluster update” to “Control plane onl… #14323
• OCPBUGS-42380: Allow operators to enable monitoring by default #14316
• OCPBUGS-42060: Console crashes when ssh is selected in add secret for starting a pipeline run #14301
• OCPBUGS-42223: restore Spotlight removal on next click #14314
• OCPBUGS-39181: add Create button to Console plugins tab #14220
• OCPBUGS-39091: update Events ChipGroup to use integrated close #14211
• OCPBUGS-38563: do not directly mutate links in useMemo #14159
• OCPBUGS-41685: Topology screen crashes when completed pod is selected #14276
• OCPBUGS-41482: Unit Tests for the new Ask Lightspeed Button #14249
• OCPBUGS-39601: Console user settings resources misses ownerRef, removing a user results in remaining data #14240
• OCPBUGS-41893: Disable Extension Catalog tech preview nav item #14289
• OCPBUGS-39110: List of default Camel K event sources disappears when adding a custom event source #14214
• OCPBUGS-41684: Fix access mode selection menu issue #14277
• OCPBUGS-41350: Update Lightspeed logo to new standards #14245
• OCPBUGS-41480: improve layout and findability of Hide Lightspeed pref… #14248
• OCPBUGS-39453: Use vCenterCluster value from CM as primary resource #14235
• OCPBUGS-39109: Need to allow blank for Project/namespace when setting SA Subject in ‘Project access tab’ #14213
• OCPBUGS-38903: Networking section depends on networking-console-plugin #14185
• OCPBUGS-38300: Add telemetry to Lightspeed console capability #14129
• OCPBUGS-38591: Add support for GCP Workload Identity / Federated identity operator installs #14160
• OCPBUGS-38427: fix bug where cluster version text appears black in da… #14145
• OCPBUGS-38615: improve Lightspeed popup contents and navigation #14163
• OCPBUGS-38395: A value submitted in From view is wrapped with single quotation after switching to Yaml view. #14141
• OCPBUGS-38394: Unrelated readme opened when opening CodeReady workspaces from Quarkus using s2i quickstart #14140
• OCPBUGS-38691: Modifying helm e2e test to fix CI issue #14169
• OCPBUGS-38412: Values entered into the Instantiate Template form are automatically cleared #14143
• OCPBUGS-38644: Add the signals correlation to the app launcher #14161
• OCPBUGS-38462: 2 Metrics tab in 4.17 developer console #14149
• OCPBUGS-38389: correct casing in “Lightspeed” #14139
• OCPBUGS-38240: Disable “Helm release status verification: HR-01-TC04” test due to CI outage #14126
• OCPBUGS-38036: Properly chain trap commands #14111
• CONSOLE-4104: Implement basic OLM V1 catalog view with filtering #14056
• CONSOLE-3970: add Lightspeed button #14030
• OCPBUGS-37426: No documentation covering how to translate plugin messages #14081
• NO-JIRA: Update Console plugin SDK package changelogs post publish #14104
• ODC-7632: Combine Shipwright model pages #14029
• ODC-7626: Web Terminal Operator installation via cli #14009
• ODC-7648: Open Lightspeed Chat Interface by clicking a button on the YAML Editor component #14087
• OCPBUGS-30889: No access to list pipelines.tekton.dev prevents from using Delete application form #13942
• OCPBUGS-36872: Add base path to locale init #14046
• OCPBUGS-37802: Build option is selected as Shipwright on edit if created the deployment using BuildConfig #14101
• OCPBUGS-36619: Switch to use annotations as labels from PipelineRuns created through Pipelines as Code is deprecated #14034
• ODC-7634: Test all current workflows, write Integration tests #14075
• OCPBUGS-36816: Include PatternFly-4 chart styles so they are available for dynamic plugins that still use PF4 react-charts #14080
• CNV-41506, OCPBUGS-37403: Localnet NAD incorrectly displayed #13948
• ODC-7640: Remove Alerting Details Page from Console #14072
• CONSOLE-4098: Show deprecated operators in OperatorHub (Post-installation screens) #14048
• OCPBUGS-35301: add missing translation in TriggerBindingSection #14062
• OCPBUGS-23332: Fix utilization card limits/total display #14053
• CNV-35124, OCPBUGS-37401: OVN Kubernetes multi-homing #14044
• ODC-7621, ODC-7633: Add Shipwright as Build Options in Add & Edit Forms #14016
• CONSOLE-4171: i18n upload/download routine task - sprint 256 #14054
• Add dynamic plugin SDK package changelogs & update plugin docs #14012
• OCPBUGS-37054: hide ‘View all steps in documentation’ for ROSA and OSD #14061
• OCPBUGS-33801: Manually create an API token for a ServiceAccount #14038
• ODC-7639: Remove alerts list from dev console codebase #14014
• ODC-7624, ODC-7628: shipwright test improvement #13990
• OCPBUGS-34387: maintain session across tabs #14041
• OCPBUGS-34901: ensure correct API version for OperandDetails #14036
• OCPBUGS-36801: disable serverless tests till further investigation #14042
• ODC-7620: Modal submit button: show loading state #14007
• OCPBUGS-35940: Create RoleBinding will trigger Admission Webhook Warning #14021
• OCPBUGS-34956: increase namespace deletion timeout for k-native e2e tests #14039
• CONSOLE-4060: Show deprecated operators in OperatorHub (Pre-installation screens) #13961
• OCPBUGS-34956: disable failing knative e2e test #14019
• OCPBUGS-35926: Add debounce to PAC auto selecton in git import flow #14011
• OCPBUGS-30841: Redirects to new PipelineRun logs URL from old PipelineRun logs URL #14032
• OCPBUGS-36260: Tooltip on Pipeline when expression is not shows #14023
• OCPBUGS-31047: Reordered dependancy warning to fix the lint error #13993
• ODC-7612: Serverless Operator installation via CLI #13949
• OCPBUGS-36339: Fix “Auto deploy when new image is available” becomes unchecked when editing a deployment from web console #14024
• CONSOLE-4140: display URI decoded configuration files on MachineConfi… #14015
• OCPBUGS-36424: DeploymentConfigs deprecation info alert should not present on the Edit deployment page #14025
• OCPBUGS-31685: Revert - terminal: use username if uid is not present #13719
• OCPBUGS-35284: fix BMH restart annotation #13995
• CONSOLE-4134: i18n upload/download routine task sprint - 255 #13991
• OCPBUGS-35879: Fix TypeError: Cannot read properties of null (reading ‘metadata’) in Topology view #14017
• CONSOLE-3792: Add extension point to enable customized create project modal for dynamic plugins #13825
• OCPBUGS-33490: Update Docs links for “Learn More” in Display Warning Policy Notification #14002
• ODC-7581: Gitea support when using Import from Git in Developer Console #13928
• OCPBUGS-35928: Improve control over PatternFly shared modules used in Console plugins #13992
• OCPBUGS-35999: Remove duplicate code in storage module #14004
• OCPBUGS-35996: remove orphaned i18n files #14001
• ODC-7627: Move test-cypress script into a frontend sub-folder to make it easier to approve changes #13937
• OCPBUGS-35908: fix flaking crd-extension tests #14000
• ODC-7613: Update the UI for selecting the Git Provider in the Import form #13936
• CONSOLE-3824: Remove kubevirt-plugin code #13769
• ODC-7585: Pipeline operator installation via CLI #13909
• OCPBUGS-33136: Fix invalid node filesystem query #13924
• OCPBUGS-34316: Manually Approve client CSR displays an unknown warning message #13939
• RHSTOR-5836: add info for ODF use-case (LSO LocalVolumeSet “Create” page) #13965
• OCPBUGS-34937: Violation warning is not displayed for minAvailable in PDB Create/Edit form #13935
• OCPBUGS-32550: Fix placement of icons on WebKit #13987
• ODC-7614: Port exposed in Dockerfile not observed in the Ports Dropdown in Git Import Form #13953
• OCPBUGS-35418: Error with html escaping for Route helptext #13980
• OCPBUGS-35497: Update Go prereq in README.md #13979
• OCPBUGS-34986: remove duplicate OAuth config #13957
• ODC-7596: Show Pod Disruption warning message in Topology page #13921
• OCPBUGS-35492: add info on obtaining first preferred language #13976
• OCPBUGS-34516: Improve catalog grid icon display and scaling #13901
• CONSOLE-4115: Add OLM v1 package #13960
• OCPBUGS-25929: Fix: Quick Start “next” button requires double click to move to next step #13934
• OCPBUGS-22853: Keep useUserSettings hook in the internal api #13967
• OCPBUGS-29804: Fix crash if helm chart metadata is nil #13963
• OCPBUGS-30218: fix pseudolocalization #13964
• OCPBUGS-35376: sessions: fix sessions pruning #13903
• OCPBUGS-35287: Alphabetize icons, alias httpd to apache #13958
• OCPBUGS-29499, OCPBUGS-29804: bump helm to 3.14.4 #13816
• (chore) Update tectonic builder image to use golang-1.22 #13932
• OCPBUGS-29744: Removed nested label component #13946
• OCPBUGS-34752: Forward selected key prop in IconDropdown component #13919
• OCPBUGS-34683: Ensure requiredVersion is set for Console provided shared modules #13893
• OCPBUGS-33756: Display of “Auth Token GCP” filter in OperatorHub should be conditioned #13867
• OCPBUGS-35080: replace global refresh sync lock in OIDC provider with per-refresh-token one #13655
• NO-JIRA: Remove Edge from devconsole_pr.md #13943
• NO-JIRA: docs: update dead links in docs/helm #13904
• OCPBUGS-35031: restore missing CloseButton styles #13941
• OCPBUGS-34862: Fix Inconsistent Capitalization of “Import from Git” #13925
• OCPBUGS-34684: i18n upload/download routine task - Sprint 254 #13910
• OCPBUGS-29777: RWOP accessMode is not available on OpenShift console UI #13829
• OCPBUGS-34656, OCPBUGS-34791, OCPBUGS-34828: disabling add-flow A-04-TC01 test and knative tests due to flakes #13931
• OCPBUGS-34958: Replace Red Hat catalog source with Community #13938
• OCPBUGS-33539: Add default sorting column for VirtualizedTable component of dynamic plugin sdk #13916
• OCPBUGS-34533: Fix updating the “Until” field on the Silence > Edit page #13926
• CONSOLE-3662, CONSOLE-4097, OCPBUGS-34538: Update plugin docs regarding Console 4.16 shared module changes #13900
• NO-JIRA: revert “Add username/uid label and annotation for the user setting ConfigMap, Role and RoleBinding” #13917
• OCPBUGS-33747: console always query ‘openshift’ CSVs when listing namespaced operator details #13912
• OCPBUGS-33733: The s2i build strategy is not assumed for Serverless Functions #13889
• OCPBUGS-19855: Validate watchK8sObject query must have name and namespace for namespaced resources #13876
• OCPBUGS-29215: Update console cookies to use SameSite strict mode. #13878
• OCPBUGS-33631: show “Debug container” link for pods with status.phase… #13850
• OCPBUGS-32698: Remove TELEMETRY_DISABLED check from console telemetry… #13808
• OCPBUGS-34170: Updating openshift-enterprise-console-container image to be consistent with ART for 4.17 #13896
• OCPBUGS-32321: Add username/uid label and annotation for the user setting ConfigMap, Role and RoleBinding #13798
• OCPBUGS-34222: Fix for cypress local auth issue #13895
• OCPBUGS-32950: Restore user toggle when authentification is disabled #13797
• OCPBUGS-34052: Include English Translations text for Supported Languages in User Preference Dropdown #13877
• OCPBUGS-34200: fix bug where textarea is not resizable #13892
• CONSOLE-4085: Updated oc client link in readme #13888
• OCPBUGS-34170: Updating openshift-enterprise-console-container image to be consistent with ART for 4.17 #13886
• ODC-7432: Remove pf classnames from gitops integration test #13845
• HELM-532: Sort on basis of Chart Version #13846
• OCPBUGS-32632: Improve Pipeline list page performance #13842
• OCPBUGS-33090: UI inconsistency in topology when application grouping is collapsed #13858
• OCPBUGS-32476: Import from Git allow users to import an app with Build option Pipeline also when no Pipeline is available #13853
• OCPBUGS-33383: Fix Admission webhook warning for Route and BuildConfig creation via import flow #13828
• OCPBUGS-32405: Create Serverless form does not create BuildConfig #13775
• NO-ISSUE: metal3: update OWNERS #13635
• OCPBUGS-29510: Fix console crash-loop with OIDC auth config #13713
• OCPBUGS-33717: Use bridge instead of cnv-bridge #13854
• OCPBUGS-33636: Updating the secrets using Form editor displays an unknown warning message #13852
• OCPBUGS-33587: Fix password set to Secret created through Start Pipeline form #13844
• OCPBUGS-33869: i18n - Download and merge French and Spanish languages translations in the OCP Console #13861
• CONSOLE-4058: add user-impersonation to QuickStartGettingStartedCard,… #13862
• And 18 elided commits (e.g. from squash or rebase merges)
• Full changelog

console-operator

• OCPBUGS-103205: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #1224
• OCPBUGS-77862: update go mod dependency for konflux #1114
• OCPBUGS-60298: Update downloads deployment configuration to use master node selector #1033
• OCPBUGS-45302: console/status: set initial value of Message field #943
• OCPBUGS-46390: Dont disable console when authConfig type is set to None #951
• OCPBUGS-38728: Get externalOrganizationID instead of the organizationID #926
• OCPBUGS-36213: Vendor proper commit #928
• CONSOLE-4163: Add RBAC for console to GET PackageManifests #921
• CONSOLE-4161: Add Capabilities to config builder #920
• OCPBUGS-35941: Bump documentationBaseURL to 4.17 #912
• OCPBUGS-36213: Bump openshift/api to pick up removal of conversion webhook server reference #919
• OCPBUGS-33715: Add logging for determining the ORG_ID source #918
• OCPBUGS-33715: Cache organization ID when the ID changes #913
• TRT-1733: Revert #914 “OCPBUGS-29547: Apply hypershift cluster-profile for ibm-cloud-managed” #915
• OCPBUGS-29547: Apply hypershift cluster-profile for ibm-cloud-managed #914
• OCPBUGS-33787: Add cluster wide trusted CA bundle to operator #911
• OCPBUGS-33787: Tolerate the absence of ingress capability on HyperShift clusters #886
• OCPBUGS-33787: deps: bump openshift/api #907
• AUTH-482: set required-scc for openshift workloads #871
• OCPBUGS-34364: Updating openshift-enterprise-console-operator-container image to be consistent with ART for 4.17 #906
• OCPBUGS-31777: Updates message verbs to use %q where appropriate. #902
• OCPBUGS-33715: Cache organization ID #904
• Full changelog

container-networking-plugins, containernetworking-plugins-microshift

• OCPBUGS-85671: CI Build root image tag sync with ART #235
• OCPBUGS-68135: Bump logrus to v1.9.1 #224
• OCPBUGS-55622: Check error returned by ipv6 SettleAddresses #187
• NP-1042: Update owners #164
• OKD-218: install util-linux #165
• Full changelog

coredns

• OCPBUGS-103200: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #206
• OCPBUGS-62825: UPSTREAM: 7083 and 6836: Fix failing TestZoneExternalCNAMELookupWithProxy #155
• append .0 to go.mod version #135
• NE-1721: Merge 1.11.3 #118
• OCPBUGS-33750: UPSTREAM: <carry>: openshift: Bump the version of ocp_dnsnameresolver external plugin #122
• OCPBUGS-34619: UPSTREAM: 6692: openshift: Fix OCPBUGS-34619 #121
• OCPBUGS-34169: Updating coredns-container image to be consistent with ART for 4.17 #120
• OCPBUGS-34169: Updating coredns-container image to be consistent with ART for 4.17 #119
• Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

• OCPBUGS-103277, OCPBUGS-103279: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork- #421 #421
• OCPBUGS-80134: Bump google.golang.org/grpc #388
• OCPBUGS-68209: fix CVE-2025-65637 #357
• OCPBUGS-58839: CARRY: don’t ignore json files #340
• OCPBUGS-52416: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.30 into release-4.17 #319
• OCPBUGS-43427: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.30 into release-4.17 #314
• OCPBUGS-43427: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.30 into release-4.17 #302
• OCPBUGS-34113: Updating ose-openstack-cinder-csi-driver-container image to be consistent with ART for 4.17 #292
• OCPBUGS-34113, OCPBUGS-34137, OCPBUGS-34460, OCPBUGS-35462: sync upstream on release-1.30/go1.22 #287
• NO-JIRA: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.29 into master #284
• NO-JIRA: Remove dulek from shiftstack-team #279
• OCPBUGS-34113: Updating ose-openstack-cinder-csi-driver-container image to be consistent with ART for 4.17 #280
• Full changelog

csi-driver-manila-operator

• OCPBUGS-103201: Use patched x/net fork v0.35.0-sec.4 #263
• OCPBUGS-38457: Add missing healthchecks #240
• AUTH-482: set required-scc for openshift workloads #234
• STOR-1596: Bump all deps for 4.17 #233
• OCPBUGS-34090: Updating csi-driver-manila-operator-container image to be consistent with ART for 4.17 #232
• OCPBUGS-34090: Updating csi-driver-manila-operator-container image to be consistent with ART for 4.17 #231
• Full changelog

csi-driver-nfs

• OCPBUGS-82708: Bump github.com/moby/spdystream@v0.5.1 #195
• OCPBUGS-80077: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.71.3-sec.1 to avoid go version bump and fix CVE-2026-33186 #181
• append .0 to go.mod version #156
• OCPBUGS-34363: Updating csi-driver-nfs-container image to be consistent with ART for 4.17 #144
• NO-JIRA: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master into master #140
• OCPBUGS-34363: Updating csi-driver-nfs-container image to be consistent with ART for 4.17 #142
• Full changelog

csi-driver-shared-resource, csi-driver-shared-resource-webhook

• append .0 to go.mod version #372
• OCPBUGS-34217: Updating ose-csi-driver-shared-resource-container image to be consistent with ART for 4.17 #188
• OCPBUGS-44510: Updating ose-csi-driver-shared-resource-webhook-container image to be consistent with ART for 4.17 #233
• Updating Readme to add a new Clusterrole #190
• NO-JIRA: Clarify Personas for Sharing #185
• OCPBUGS-34472: Updating ose-csi-driver-shared-resource-mustgather-container image to be consistent with ART for 4.17 #189
• OCPBUGS-34217: Updating ose-csi-driver-shared-resource-container image to be consistent with ART for 4.17 #187
• Full changelog

csi-driver-shared-resource-operator

• OCPBUGS-103198: Bump golang.org/x/net to v0.35.0-sec.3 #127
• OCPBUGS-80080: Bump google.golang.org/grpc to v1.79.3 #125
• STOR-1596: Bump all deps for 4.17 #114
• Full changelog

csi-external-attacher

• OCPBUGS-103210: Bump golang.org/x/net to v0.35.0-sec.4 #116
• OCPBUGS-80082: Bump google.golang.org/grpc to v1.79.3 #106
• STOR-1593: Rebase external-attacher to v4.6.1 for OCP 4.17 #76
• OCPBUGS-36455: Rename Dockerfile to Dockerfile.ocp #77
• OCPBUGS-34440: Updating csi-attacher-container image to be consistent with ART for 4.17 #75
• OCPBUGS-34098: Updating csi-attacher-container image to be consistent with ART for 4.17 #74
• Full changelog

csi-external-provisioner

• OCPBUGS-92864: Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.33.0-sec.5 to address CVE-2026-46597 #162
• OCPBUGS-82709: Address CVE-2026-35469 #142
• OCPBUGS-80083: Bump google.golang.org/grpc #131
• STOR-1593: Rebase to upstream v5.0.2 for 4.17 #104
• OCPBUGS-34458: Updating csi-provisioner-container image to be consistent with ART for 4.17 #103
• OCPBUGS-37455: Revert 5.0.1 rebase #102
• STOR-1593: Rebase to upstream v5.0.1 for 4.17 #98
• Full changelog

csi-external-resizer

• OCPBUGS-80084: Patching openshift-sustaining/grpc-go v1.71.3-sec.1 #204
• OCPBUGS-103208: Bump golang.org/x/net to v0.35.0-sec.4 #214
• OCPBUGS-62466: Requeue PVC over PV creation #175
• STOR-1593: Rebase to upstream v1.11.1 for 4.17 #164
• OCPBUGS-34356: Updating ose-csi-external-resizer-container image to be consistent with ART for 4.17 #163
• OCPBUGS-34356: Updating ose-csi-external-resizer-container image to be consistent with ART for 4.17 #162
• Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

• OCPBUGS-103212, OCPBUGS-103215: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #229
• OCPBUGS-80085, OCPBUGS-80088, OCPBUGS-80089: Bump google.golang.org/grpc to v1.79.3 #214
• OCPBUGS-60449: UPSTREAM: 1238: Snapshot Controller startup should not LIST all volumesnapshots #184
• STOR-1593: Rebase external-snapshotter to v8.0.1 for OCP 4.17 #156
• OCPBUGS-34257: Updating ose-csi-snapshot-validation-webhook-container image to be consistent with ART for 4.17 #158
• OCPBUGS-34292: Updating ose-csi-snapshot-controller-container image to be consistent with ART for 4.17 #159
• OCPBUGS-34435: Updating ose-csi-external-snapshotter-container image to be consistent with ART for 4.17 #157
• OCPBUGS-34292: Updating ose-csi-snapshot-controller-container image to be consistent with ART for 4.17 #152
• OCPBUGS-34257: Updating ose-csi-snapshot-validation-webhook-container image to be consistent with ART for 4.17 #151
• OCPBUGS-34061: Updating ose-csi-external-snapshotter-container image to be consistent with ART for 4.17 #150
• Full changelog

csi-livenessprobe

• OCPBUGS-103203: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #110
• append .0 to go.mod version #73
• OCPBUGS-36456: Rename Dockerfile #67
• OCPBUGS-34275: Updating csi-livenessprobe-container image to be consistent with ART for 4.17 #66
• OCPBUGS-34275: Updating csi-livenessprobe-container image to be consistent with ART for 4.17 #65
• Full changelog

csi-node-driver-registrar

• OCPBUGS-63682: update log level verbosity to not clutter logs #90
• append .0 to go.mod version #80
• OCPBUGS-34361: Updating csi-node-driver-registrar-container image to be consistent with ART for 4.17 #74
• OCPBUGS-34361: Updating csi-node-driver-registrar-container image to be consistent with ART for 4.17 #73
• Full changelog

docker-builder

• OCPBUGS-89852, OCPBUGS-90297, OCPBUGS-92380, OCPBUGS-92577, OCPBUGS-92854: Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 #548
• OCPBUGS-66988: bump buildah to 1.37.7 to fix CVE-2025-52881 #499
• OCPBUGS-65816: BuildConfig inline Dockerfile fails with heredoc syntax #488
• OCPBUGS-57939: S2I build cpu limits observed by assemble are limited to 1 cpu #474
• OCPBUGS-53075: Upgraded Kubernetes dependency from 1.28.2 to 1.30.2 #465
• OCPBUGS-42894: buildah dependency bump to 1.37.6 #452
• OCPBUGS-33889: Updating openshift-enterprise-builder-container image to be consistent with ART for 4.17 #393
• OCPBUGS-47768: Add team members to the OWNERS file #423
• OCPBUGS-47712: skipping some unit tests to avoid failures as they are duplicate #421
• OCPBUGS-33215: Bumps openshift/api & related dependencies #394
• OCPBUGS-25495: Upgrade s2i and buildah #392
• Full changelog

docker-registry

• OCPBUGS-103223: [release-4.17] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #481
• OCPBUGS-68182: update logrus to v1.9.1 #465
• OCPBUGS-60090: bump docker distribution to fix purgeuploads panic #440
• OCPBUGS-53655: bump jwt and oauth dependencies #431
• OCPBUGS-49695: bump docker distribution #422
• OCPBUGS-39040: pull upstream distribution changes to use a consistent multipart chunk size #409
• OCPBUGS-36521: Rename Dockerfile #407
• OCPBUGS-35335: use SelfAccessReview to obtain user info #404
• OCPBUGS-34442: Updating openshift-enterprise-registry-container image to be consistent with ART for 4.17 #401
• OCPBUGS-33453: Use SAR instead of SSAR #402
• OCPBUGS-34115: Updating openshift-enterprise-registry-container image to be consistent with ART for 4.17 #399
• Full changelog

driver-toolkit

• Adding the + char to the RT kernel version. (#154) #154
• Updating driver-toolkit-container image to be consistent with ART for 4.17 (#153) #153
• ART bash parser is failing on [[…]] syntax (#151) #151
• Patch manifests to require stream-coreos instead of rhel-coreos in the OKD/SCOS case (#149) #149
• Full changelog

egress-router-cni

• OCPBUGS-37730: Build rhel8 binary from rhel8 golang builder #88
• OCPBUGS-35526: update to go 1.22 and k8s.io mods to v0.30 #84
• OKD-217: install util-linux #82
• Full changelog

etcd

• DOWNSTREAM: <carry>: OCPBUGS-53447: fix a compaction induce latency issue #321
• ETCD-714: Rebase etcd 3.5.18 openshift 4.17 #310
• NO-ISSUE: Add support for cachi2 based deps #297
• OCPBUGS-42680: Rebase etcd 3.5.16 openshift 4.17 #291
• NO-JIRA: use golang 1.22 image #286
• OCPBUGS-34653: Rebase etcd 3.5.14 openshift 4.17 #273
• Full changelog

gcp-cloud-controller-manager

• OCPBUGS-35256: Allow bootstrap node in existing instance groups #66
• NO-JIRA: Update OWNERS #65
• OCPCLOUD-2606: Merge https://github.com/kubernetes/cloud-provider-gcp:master (856e124) into master #57
• OCPBUGS-30505: Bump protobuf to v1.34.1 #62
• Full changelog

gcp-cluster-api-controllers

• OCPBUGS-80095: Bump google.golang.org/grpc to v1.79.3 #291
• OCPBUGS-78279: [release-4.17] update go mod dependency for konflux #266
• NO-JIRA: Update OWNERS #229
• OCPCLOUD-2622: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.7.0 (93bb59d) into master #228
• Full changelog

gcp-machine-controllers

• OCPBUGS-103253: Bump golang.org/x/net to v0.35.0-sec.3 #190
• OCPBUGS-80118: Bump google.golang.org/grpc to v1.79.3 #166
• OCPBUGS-53037: Disable shielded VMs for non-UEFI disks #115
• OCPBUGS-48064: Refactor exists() to handle gcp API change #105
• OCPBUGS-46082: update a2 gpu detection logic to be dynamic #100
• OCPBUGS-43738: Add c4a instance as arm type #95
• OCPCLOUD-2565: Bump o/api and MAO packages #87
• NO-JIRA: Update OWNERS #85
• OCPCLOUD-2613: Bump k8s to 1.30 #84
• OCPBUGS-34381: Updating ose-machine-api-provider-gcp-container image to be consistent with ART for 4.17 #83
• Full changelog

gcp-pd-csi-driver

• OCPBUGS-103235: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #144
• OCPBUGS-80099: Replace google.golang.org/grpc with openshift-sustaining fork v1.71.3-sec.1 #113
• OCPBUGS-68186: Update logrus to 1.9.3 #90
• STOR-1602: Rebase to upstream v1.14.1 for OCP 4.17 #68
• OCPBUGS-34245: Updating ose-gcp-pd-csi-driver-container image to be consistent with ART for 4.17 #69
• Full changelog

gcp-pd-csi-driver-operator

• OCPBUGS-103225: Use patched x/net fork v0.35.0-sec.4 #217
• OCPBUGS-80098: Replace google.golang.org/grpc with fork #188
• CFE-879: Add resourceTags in Infrastructure to driver args list #120
• STOR-1596: Bump all deps for 4.17 #124
• OCPBUGS-34439: Updating ose-gcp-pd-csi-driver-operator-container image to be consistent with ART for 4.17 #123
• OCPBUGS-34097: Updating ose-gcp-pd-csi-driver-operator-container image to be consistent with ART for 4.17 #121
• Full changelog

haproxy-router

• OCPBUGS-103220: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #845
• OCPBUGS-86725: Prevent SSRF via FQDN-typed EndpointSlices #835
• OCPBUGS-86714: Strip X-SSL-* headers for plain HTTP #804
• OCPBUGS-80100: Address CVE-2026-33186 #779
• OCPBUGS-49390: Reject All CA-Signed Certs Using SHA1 #650
• OCPBUGS-49702: Add support for IdleCloseTerminationPolicy #652
• OCPBUGS-38101: Bump k8s.io/* packages to v0.30.3 #615
• OCPBUGS-34351: Updating ose-haproxy-router-base-container image to be consistent with ART for 4.17 #602
• OCPBUGS-34471: Updating openshift-enterprise-haproxy-router-container image to be consistent with ART for 4.17 #604
• Full changelog

hyperkube, pod

• OCPBUGS-136162: Fix kubeadm preflight host URL construction #2842
• OCPBUGS-68132, OCPBUGS-68190: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 #2573
• OCPBUGS-72531: Skip E2e: attach on previously attached volumes should work #2566
• OCPBUGS-65695: Fix Concurrentmap Iteration #2520
• OCPBUGS-63460: UPSTREAM: <carry>: backporting fix for concurrent map iteration and write #2456 #2496
• CNTRLPLANE-1611: Backport StreamingCollectionEncoding for JSON and protobuf #2486
• OCPBUGS-61584: UPSTREAM: <carry>: Don’t retry storage calls with side effects. #2458
• OCPBUGS-60552: [4.17] podresources: list: use active pods #2426
• 4.17: OCPBUGS-60998: scheduler: Improve CSILimits plugin accuracy by using VolumeAttachments #2434
• OCPBUGS-57888: Bump k8s api to 1.30.14 #2355
• OCPBUGS-57196: UPSTREAM: 130047: adjusting loopback certificate validity in kube-apiserver #2328
• OCPBUGS-57289: kubelet: fix a stall on startup from waiting too long for a stat call #2206
• OCPBUGS-55269: Bump k8s api to 1.30.12 #2280
• OCPBUGS-53016: Bump k8s api to 1.30.11 #2250
• OCPBUGS-51006: Bump k8s api to 1.30.10 #2210
• OCPBUGS-49905: Bump k8s api to 1.30.9 #2198
• : OCPBUGS-46364: Fix grace period used for immediate evictions #2164
• OCPBUGS-46002: Bump k8s api to 1.30.7 #2160
• OCPBUGS-39318: UPSTREAM: 126994: Add required FieldManager for validatingadmissionpolicy e2e #2070
• OCPBUGS-43820: UPSTREAM: <carry>: kubelet/cm: fix bug where kubelet restarts from missing cpuset cgroup #2126
• OCPBUGS-44897: Backport format library to enable usage in 4.18 #2140
• OCPBUGS-44512: Bump k8s api to 1.30.6 #2134
• OCPBUGS-42427: UPSTREAM: 125398: Fix issue with scheduler failing on hostname mismatch #2097
• OCPBUGS-42640: Unrevert Bump k8s api to 1.30.5” #2107
• OCPBUGS-42640: Revert #2089 “OCPBUGS-42167: Bump k8s api to 1.30.5” #2100
• OCPBUGS-42167: Bump k8s api to 1.30.5 #2089
• OCPBUGS-42019: UPSTREAM: <drop>: bump(github.com/openshift/apiserver-library-go) #2087
• OCPBUGS-41638: UPSTREAM: <carry>: bump cadvisor version to fix missing network stats #2081
• OCPBUGS-39014: Bump 1.30.4 #2062
• OCPBUGS-38363: UPSTREAM: 126470: Move APIServingWithRoutine to alpha and disabled by default #2053
• NO-JIRA: update downstream owners #2048
• OCPBUGS-37620: Bump 1.30.3 #2038
• NO-JIRA: UPSTREAM: 126213: add test about container metrics from cadvisor #2040
• OCPBUGS-37281: UPSTREAM: 126104: Add funcs in pkg/filesystem/util to set file permissions on Windows and update container log dir perms #2034
• OCPEDGE-1181: UPSTREAM: <carry>: update test annotations for sno #2033
• NO-JIRA: add tool to validate test packages imported #2024
• OCPBUGS-36742: UPSTREAM: <carry>: sync imports #2017
• OCPBUGS-37111: UPSTREAM: 125404: Fix that PodIP field is temporarily removed for a terminal pod #2025
• NO-JIRA: UPSTREAM: <drop>: bump(github.com/openshift/apiserver-library-go) #2023
• MULTIARCH-4229: UPSTREAM:<carry>:bump cadvisor for 3516 upstream patches #2012
• OCPBUGS-36743: UPSTREAM: <carry>: inject k8s version from hyperkube Dockerfile #2018
• OCPBUGS-34294: OCPBUGS-34309: UPSTREAM: <carry>: update base image #1998
• API-1783: Bump 1.30.2 #1996
• OCPBUGS-14613: drop carry “don’t fail integration due to too many goroutines” #1995
• OCPBUGS-34544: UPSTREAM: <carry>: Disable PersistentVolumeLabel by default #1991
• OCPBUGS-34050: Backport 125337 #1987
• OCPBUGS-34544: UPSTREAM: <carry>: Disable e2e tests that need PersistentVolumeLabel #1986
• OCPBUGS-34593: UPSTREAM: 124933: [Scheduler] Use allNodes when calculating nextStartNodeIndex #1983
• API-1783: UPSTREAM: <carry>: skip PodLifecycleSleepAction test #1982
• API-1783: UPSTREAM: <carry>: skip storage tests #1981
• OCPBUGS-25331: UPSTREAM: <carry>: extend termination events #1827
• API-1783: Bump 1.30.1 #1979
• API-1783: Rebase 1.30.0 #1953
• Full changelog

hypershift

• Sync approver aliases with main for release-4.17 #10188
• OCPBUGS-76289: CVE-2025-52881 openshift/hypershift multicluster-engine/hypershift-rhel9-operator: container escape and denial of service due to arbitrary write gadgets and procfs write redirects [mce-2.7] #8292
• OCPBUGS-99079: fix(backport): konnectivity agent auth #9104
• OCPBUGS-89357: build(operator): drop hypershift-no-cgo from operator container images #8761
• OCPBUGS-80103: fix https://github.com/advisories/GHSA-p77j-4mvh-x3m3 by replacing grpc-go #8516
• OCPBUGS-84181: fix(cno): use brackets only for IPv6 in server URL #8347
• OCPBUGS-76533: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7703
• OCPBUGS-74230, OCPBUGS-74294: [release-4.17] Support proxy authentication when user/pass is included in URL #7568
• fix: OCPBUGS-72956: Fix Konflux EC voilation, update deprecated base … #7457
• OCPBUGS-69865: test: remove unit tests that depend on network communication [release-4.17] #7411
• OCPBUGS-57123: Add support for registry root entry only in the IDMS/ICSP #6230
• CNTRLPLANE-1903: Migrate 4.17 pipelines to use common pipeline #7215
• OCPBUGS-63639: [release-4.17] fix(konnectivity): resolve circular dependency causing DNS timeouts and excessive retries #7112
• OCPBUGS-64604: Update DNS names for ovn-kubernetes cp metrics #7150
• OCPBUGS-63370: fix: Make the hypershift CLI binary FIPS-compliant #7094
• CNTRLPLANE-1425: feat(konflux): tag MCE HO images with latest #6838
• OCPBUGS-57143: [release-4.17] HCP payload doesn’t respect multiple mirrors #6771
• OCPBUGS-61290: Update KCM node monitor grace period #6760
• OCPBUGS-61208: use common MCE konflux pipeline #6749
• OCPBUGS-60149: [release-4.17] Always compress and encode payload in token secret for inplace upgrades #6740
• OCPBUGS-61101: Use system trust bundle in CPO IDP https client #6735
• OCPBUGS-60921: konflux for hcp-cli #6699
• CNTRLPLANE-1204: HO MCE change to hermetic ta build #6653
• CNTRLPLANE-1230: Move CPO pipeline to hermetic builds #6598
• CNTRLPLANE-936: fix(tekton): drop multiarch builds on PR #6224
• OCPBUGS-57432: Add proxy variables for the MCD Pod #6258
• CNTRLPLANE-918: Konflux build pipeline service account migration #6088
• CNTRLPLANE-918: Konflux build pipeline service account migration #6083
• OCPBUGS-55723: Don’t check if olm images exist if guest cluster #6115
• OCPBUGS-55500, RHOCPPRIO-433: Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs #6098
• OCPBUGS-51808: Fix golang crypto dependency go.mod replacement #5993
• OCPBUGS-54841: Add konnectivity-proxy sidecar to openshift-oauth-apiserver #6017
• OCPBUGS-53323: Handle multiple mirror entries for source #5894
• OCPBUGS-54631: Sync RBAC for attaching volumes on VM level #5997
• NO-JIRA: update konflux references #5479
• OCPBUGS-53903: bump golang-jwt v4 and v5 #5906
• NO-JIRA: Red Hat Konflux update control-plane-operator-4-17 #5959
• ART-11792: update go mod dependency for konflux #5920
• OCPBUGS-51737, OCPBUGS-51808: Bump dependencies to OCP fork in backports #5900
• OCPBUGS-48439: kubevirt, Don’t break on hostname NodePort.Address #5394
• OCPBUGS-51240: bump go-jose #5863
• OCPBUGS-52657: Make managed-trust-bundle optional #5794
• OCPBUGS-52425: [release-4.17] refactor aws identity health check into new controller #5772
• OCPBUGS-46340: change plaform to platform #5562
• OCPBUGS-51339: [release-4.17] Fix IsProgressing condition in HostedClusters #5712
• OCPBUGS-50697: add region to AWS creds passed to operators managed by CPO #5671
• OCPBUGS-51098: 4.17 Add HostedCluster additional trustbundles to konnectivity-https-proxy #5675
• NO-JIRA: Update dependency mkdocs-material to v9.6.5 #5682
• OCPBUGS-50596: Honor proxy vars in the util insecure http client #5605
• OCPBUGS-49828: Duplicate hostDevices.name when hostDevices.deviceName has multiple types. #5558
• OCPBUGS-48487, OCPBUGS-48488, OCPBUGS-48490: Fix IPv6 Disconnected HCP deployments #5402
• OCPBUGS-47533: Prevent IgnitionServer from flooding the API server with patch requests #5332
• NO-JIRA: Update dependency mkdocs-material to v9.6.3 #5590
• OCPBUGS-45268: Reconcile proxy CA bundle into hosted cluster #5228
• OCPBUGS-46465: Consistently look up and dial cloud API hostnames #5302
• NO-JIRA: Update dependency mkdocs-material to v9.6.1 #5528
• OCPBUGS-49638: fix overwriting PKI operator HCP conditions #5504
• OCPBUGS-46440: Allow ARM64 arch deployment on Agent platform #5296
• OCPBUGS-48170: fix disconnected via CLI #5465
• OCPBUGS-38810: nodepoolcontroller: List() PerformanceProfile status per NodePool #4585
• NO-JIRA: Update dependency mkdocs-mermaid2-plugin to v1.2.1 (release-4.17) #5428
• NO-JIRA: Update dependency mkdocs-material to v9.5.50 (release-4.17) #5427
• OCPBUGS-44927: Add multi-arch validation for HC/NodePool compatibility #5238
• NO-JIRA: [release-4.17] Bump golang.org/x/crypto and golang.org/x/net #5368
• NO-JIRA: Update Konflux references (release-4.17) #5329
• OCPBUGS-46412: Separate CPO containerfiles #5285
• NO-JIRA: chore(deps): update konflux references (release-4.17) #5289
• NO-JIRA: chore(deps): update dependency mkdocs to v1.6.1 (release-4.17) #5290
• OCPBUGS-44114: Add external kas address to no proxy skip list #5028
• NO-JIRA: Red Hat Konflux update hypershift-release-mce-28 #5174
• NO-JIRA: chore(deps): update konflux references (release-4.17) #5249
• OCPBUGS-44630: Use ingress role in private link controller for DNS operations #5142
• NO-JIRA: chore(deps): update konflux references (release-4.17) #5183
• NO-JIRA: chore(deps): update konflux references (release-4.17) #5154
• NO-JIRA: chore(deps): update konflux references (release-4.17) #5144
• OCPBUGS-44184: dont use registryOverrides on kube rbac proxy image be… #5033
• NO-JIRA: chore(deps): update konflux references (release-4.17) #5113
• OCPBUGS-43929: Return the right tagReference on Catalogs ImageStream #4993
• OCPBUGS-44276: Configure OAuth https proxy to dial cloud endpoints directly #5070
• OCPBUGS-44268: Fix order rendering HCP objects #5064
• NO-JIRA: Update Konflux references (release-4.17) #5098
• chore(deps): update konflux references (release-4.17) #5075
• HOSTEDCP-2046: CPO 4.17 tekton builds #5006
• NO-JIRA: chore(deps): update konflux references (release-4.17) #5053
• NO-JIRA: Update Konflux references to fedcfe0 (release-4.17) #5041
• chore(deps): update konflux references (release-4.17) #5023
• chore(deps): update konflux references to f53fe54 (release-4.17) #5018
• NO-JIRA: Update Konflux references (release-4.17) #5009
• OCPBUGS-42879: Add network policies for konnectivity server and ignition server proxy #4865
• NO-JIRA: bump catalog operators version #4992
• NO-JIRA: chore(deps): update konflux references (release-4.17) #4972
• OCPBUGS-43746: add ValidIDPConfiguration condition to report IDP config issues #4969
• NO-JIRA: chore(deps): update konflux references (release-4.17) #4958
• OCPBUGS-43464: Pass feature flags to clusterpolicy controller #4928
• NO-JIRA: chore(deps): update konflux references (release-4.17) #4931
• OCPBUGS-42704: Run 2 replicas of active/passive HA components #4843
• OCPBUGS-43316: Enforce privileged PSA by default #4834
• NO-JIRA: chore(deps): update konflux references (release-4.17) #4921
• OCPBUGS-43374: release-4.17 openstack/e2e: re-work nodepool tests #4914
• NO-JIRA: chore(deps): update konflux references to 674e70f (release-4.17) #4907
• NO-JIRA: chore(deps): update konflux references (release-4.17) #4895
• OCPBUGS-43051: Use guest DNS resolution in Konnectivity HTTPS proxy by default #4885
• HOSTEDCP-2020: [release-4.17] Add support for SharedVPC #4873
• HOSTEDCP-2023: [release-4.17] Split worker and vpc endpoint security groups #4882
• OCPBUGS-42974: [release-4.17] Do not send traffic to local audit-webhook through konnectivity #4869
• NO-JIRA: Remove EnsurePSANotPrivileged check #4855
• OCPBUGS-42714: label routes only when HCP router used #4845
• NO-JIRA: chore(deps): update konflux references to 37b9187 (release-4.17) #4854
• OCPBUGS-42390: Add Annotation to skip deleting hcp namespace #4792
• NO-JIRA: chore(deps): update konflux references (release-4.17) #4812
• NO-JIRA: e2e: openstack: fix nil deref in route53 teardown #4810
• OCPBUGS-42261: Conditionally manage kubeconfig secrets for DNS and Ingress operators #4764
• OCPBUGS-42098: Use KubeClientCABundle for HostedClusterConfigOperator cluster-signer-ca #4736
• chore(deps): update konflux references to 5ac9b24 (release-4.17) #4780
• OCPBUGS-41552: Let payload generation pick the release for the NodePool #4691
• chore(deps): update konflux references to 2c3426a (release-4.17) #4774
• NO-JIRA: chore(deps): update konflux references (release-4.17) #4761
• NO-JIRA: Security fixes for openshift-ci-security job #4748
• NO-JIRA: chore(deps): update konflux references (release-4.17) #4726
• HOSTEDCP-1953: bump CCO version #4694
• NO-JIRA: chore(deps): update konflux references (release-4.17) #4682
• OCPBUGS-41371: CPO oauth idp converter: resolve names before dialing #4681
• OCPBUGS-38637: Use http dialer when dialing through proxy #4680
• OSASINFRA-3572, OSASINFRA-3573: OpenStack backports for ingress #4644
• OCPBUGS-39365: Update CSO deployment file #4655
• OCPBUGS-39452: Fix multi-arch validation by prioritizing ReleaseImage check #4665
• OCPBUGS-39419: handle version skewed NodePools that do not have rhel9 binaries #4662
• OCPBUGS-39371: Fixed NodePool version validation #4657
• OCPBUGS-39234: Set Image as mutable and trigger upgrades on Azure NodePool spec changes #4640
• HOSTEDCP-1938: Remove saas template in 4.17 #4645
• OCPBUGS-39225: copy image-registry AdditionalTrustedCA configmap into HC openshift-config #4637
• OCPBUGS-39159: regroup KAS certs into public and private certs #4634
• OCPBUGS-39102: Add networking-console-plugin image to CNO as an env var #4592
• NO-JIRA: chore(deps): update konflux references (release-4.17) #4601
• OCPBUGS-38967: [release-4.17] Remove go workspaces #4620
• OCPBUGS-38941: copy oapi ca-trust recursively when building trust anchor #4614
• HOSTEDCP-1861: cpo: separate KAS cert into internal and external #4595
• OCPBUGS-38833: [Azure] Use infraID from infra-json if provided #4590
• NO-JIRA: Fix KubeVirtNodesLiveMigratable condition for NodePools with 0 replicas #4588
• HOSTEDCP-1764: retrieve registryOverrides when ImageStream is not ava… #4540
• NO-JIRA: Update quay.io/openshift/origin-base Docker tag to v4.16 (release-4.17) #4573
• NO-JIRA: Update golang Docker tag to v1.23 (release-4.17) #4571
• NO-JIRA: Update Konflux references (release-4.17) #4570
• OCPBUGS-38410: bump CPO base image to use 4.17:base-rhel9 #4544
• OCPBUGS-38637: HTTPS proxy: do not proxy communication to cloud providers #4577
• HOSTEDCP-1609: Support configuring Azure diagnostics via CLI flags #4555
• OCPBUGS-38438: release-4.17 should not build main HO #4550
• CNV-42532: KubeVirt: add label to DataVolume #4509
• OCPBUGS-38183: make use of azure-disk-driver-control-plane-image #4514
• OSASINFRA-3546: docs/openstack: fix typo #4510
• OCPBUGS-25937: Support KMS v2 on AWS #4502
• OSASINFRA-3555: openstack: e2e adjustments #4492
• HOSTEDCP-1776: Set KCM node monitor grace period #4404
• HOSTEDCP-1853: Add Arm NodePool Support Through Azure Marketplace #4455
• OCPBUGS-38041: test: e2e: handle 409 conflict in EnsureHostedClusterImmutability #4493
• HOSTEDCP-1850: Allow setting Kube APIServer maximum requests in flight #4488
• OSASINFRA-3550: openstack: ingress API & octavia ingress provider #4474
• OCPBUGS-37488: CSO: add environment variable for tools image #4483
• NO-JIRA: Update Konflux 4.17 and perform migration #4486
• NO-JIRA: Update Konflux and perform migration #4485
• OSASINFRA-3554: OpenStack: Use external network ID in favor of Name #4477
• OCPBUGS-37934: Reverting ETCD cluster rebuild #4475
• OCPBUGS-37052: Use konnectivity HTTP proxy for ingress controller #4456
• HOSTEDCP-1669: Add first azure services validation #4466
• NO-JIRA: Remove non relevant OVNSbDb service type declarations #4465
• HOSTEDCP-1565: add VPC Endpoint Service proxy support #4470
• OCPBUGS-37832: set proxy envvars on aws and azure CCMs #4468
• HOSTEDCP-1851: Use a multi-arch haproxy image for shared ingress #4454
• HOSTEDCP-1669: Make hostedcluster.spec.services immutable for non IBM platforms #4449
• NO-JIRA: Ensure VolumeSnapshots are deleted during cloud resource cleanup #4306
• OCPBUGS-37753: Let the CPO oidc check resolve through data plane #4273
• NO-JIRA: Update IBM go sdk #4435
• NO-JIRA: Flaky cert validation test #4448
• CNF-12681: Added support for performance profile status #4020
• HOSTEDCP-1778: Default multi-arch flag to true and default release stream for HCP CLI #4447
• OCPBUGS-36932: Add HTTP konnectivity proxy to OAuth server #4381
• OSASINFRA-3550: docs/openstack: adds content for Ingress with MetalLB #4439
• OCPBUGS-37703: fix release stream flag/rhcos image for create cluste… #4445
• CNV-32074: Add Kubevirt live-migratable condition for HC and NP #4361
• OCPBUGS-37698: mce-2.7 enablement for main #4442
• OCPBUGS-36689: Omit the unused 0000_50_olm_06-psm-operator.service.ya… #4348
• OSASINFRA-3546: openstack: document how to create a cluster #4414
• NO-JIRA: chore(deps): update konflux references (main) #4426
• HOSTEDCP-1798: Update AWS multi-arch docs to include migration #4421
• OCPBUGS-37625: DedicatedRequestServing scheduler: make taken labels list consistent #4425
• OCPBUGS-37486: Set right endpointSlice port #4422
• OCPBUGS-24400: Only recreate etcd if hasn’t ever been ready #4419
• OSASINFRA-3319: implements required OpenStack credentials #4410
• HOSTEDCP-1791: dont render any secrets in manifest file #4420
• HOSTEDCP-1798: Refactor multi-arch validation algorithm #4405
• OSASINFRA-3538: openstack: small fixes for CLI #4415
• OCPBUGS-34820: Keep in sync the HC and HCP ICS field #4412
• HOSTEDCP-1813: Moves MachineIdentity from the HostedCluster API to the NodePool API #4408
• HOSTEDCP-1791: dont render cloud-credentials secret #4406
• OSASINFRA-3312: Implements OpenStack Node pools #4409
• OSASINFRA-3539: Add ipam to cluster-api assets #4399
• OSASINFRA-3538: openstack: cluster CLI #4396
• HOSTEDCP-1838: Migrate buildah config in tekton files for migration from 0.1 to 0.2 #4403
• HOSTEDCP-1836: Fix Snyk vulnerability with python deps #4394
• OCPBUGS-36897: fix(api): Nodepool CEL validation fix #4378
• OSASINFRA-3311: openstack: CAPO provider deployment #4373
• OCPBUGS-37222: extract rhel9 MCO binaries for rhel8 based MCO images #4382
• HOSTEDCP-1834: Fix Dependabot Issue By Updating Azure RHCOS Image Copy Process #4379
• OCPBUGS-37102: Separate ibmcloud kms encryption configuration types #4372
• NO-JIRA: Fix OADP backup objects #4376
• HOSTEDCP-1832: Document konnectivity in HyperShift #4374
• CNV-39630: Add ability to set tolerations on the HostedCluster #4339
• OSASINFRA-3525: Initial PR to start supporting OpenStack platform #4350
• CNF-11845: nodepoolcontroller: mirror containerruntimeconfig to HCP NS #4150
• HOSTEDCP-1795, HOSTEDCP-1796: Customize the self-generated cert validity and rotation #4335
• OCPBUGS-34816: Fix the resource from is checking the MHC platform #4365
• HOSTEDCP-1820: Add snyk helper scripts to contrib #4359
• NO-JIRA: Update Konflux references #4362
• OCPBUGS-35899: Doubled machineHealthCheck timeout on Agent and None #4345
• OCPBUGS-24400: Recreate the ETCD statefulSet on HostedCluster deployment when stays failing #4354
• OCPBUGS-35905: E2E test to verify openshift-apiserver TLS certificates #4322
• OSASINFRA-3310: Adds cluster-api-provider-openstack assets #4355
• HOSTEDCP-1734, HOSTEDCP-1737: use proxy-protocol-v2 for shared ingress #4330
• NO-JIRA: Let cmd unit tests run without a running Kubernetes cluster #4310
• NO-JIRA: Default azure to run as managed-service=aro #4316
• OCPBUGS-34865: Fix name resolution for HTTPS konnectivity proxy #4351
• NO-JIRA: add ignition payload inspect docs #4346
• OCPBUGS-33934: Add newline after TLS certs referenced by image.config #4343
• NO-JIRA: Update catalog annotation based on an OCP version #4344
• HOSTEDCP-1818: fix(build): update to the fixed clamav image #4342
• OCPBUGS-36681: Set Azure VM identity if user assigned identity set #4332
• HOSTEDCP-1716: When running the HO locally it should no required a running pod #4268
• CNF-12951: hypershift:performanceprofile: associate profile name with user input #4108
• NO-JIRA: Add net policy to allow ingress from sharedingress namespace #4336
• OCPBUGS-34865: Add HTTP(s) konnectivity proxy for openshift-apiserver #4218
• OCPBUGS-34820: Delete IDMS in dataplane once HCP ICS field is removed #4333
• NO-JIRA: KubeVirtJsonPatchTest: fix vmi slice assignment #4319
• NO-JIRA: Update ci image of capk to 4.17 #4183
• NO-JIRA: Dump capz azure resources #4329
• NO-JIRA: Remove Steve Kuznetsov from approvers/owners #4334
• NO-JIRA: Update Konflux references #4324
• NO-JIRA: Update AKS contrib docs #4314
• HOSTEDCP-1808: Update Mkdocs, dependencies and dockerfile #4323
• NO-JIRA: Dump sharedingress manifest #4321
• NO-JIRA: Enhance aks docs #4311
• NO-JIRA: e2e tests: skip checking ValidKubeVirtInfraNetworkMTU if no workers #4313
• Revert “HOSTEDCP-1778: Enable MultiArch flag by default” #4312
• NO-JIRA: skip validate metrics on azure e2e #4305
• NO-JIRA: skip multiarch test before HC creation #4292
• OCPBUGS-30986: remove weak ciphers from security profile #4294
• NO-JIRA: Add release notes to commit and print proper output when release errors #4304
• HOSTEDCP-1778: Enable MultiArch flag by default #4272
• CNV-39589: [Kubevirt] Add support for passing GPU devices to NodePools #4101
• NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v8.5.11 - abandoned #4300
• NO-JIRA: chore(deps): update konflux references #4297
• OCPBUGS-23922: hcco: reconcile apiserver config into hosted cluster #4278
• OCPBUGS-36230: Use a reconciled proxy config when generating nodepool userdata #4277
• OCPBUGS-35521: Move infra-volumesnapshot-class-mapping to core binding #4290
• OCPBUGS-33060: enable audit log for oauth-openshift #3994
• NO-JIRA: test/e2e: remove api budget checks #4286
• NO-JIRA: fixup azure aks docs #4293
• NO-JIRA: Update HC on AKS doc for new flags for infra #4274
• HOSTEDCP-1342: Add new metrics to check CA bundle validity and expiry [OSD-15414] #3442
• NO-JIRA: cmd/cluster/kubevirt: add a test from dvossel #4220
• HOSTEDCP-1709, HOSTEDCP-1777: test/e2e: complete move to eventually blocks #4263
• OCPBUGS-36188: kubevirt-csi-driver: Pass infra kubeconfig in case of external infra #4271
• OCPBUGS-31840: Make guest cluster components use the correct KAS port #3849
• HOSTEDCP-1447: test/e2e: tar.gz hosted cluster content #4256
• Update Konflux references #4258
• OCPBUGS-35979: Keep old user data for aws < 4.16 #4269
• NO-JIRA: Fix the getting started page by adding export to BUCKET_NAME #4207
• HOSTEDCP-1221: add heterogenous NP e2e #4005
• OCPBUGS-35874: check mgmt cluster for route capability before DeleteIfNeeded for ovn sbdb route #4254
• HOSTEDCP-1709: test/e2e: actually wait for guest cluster client #4262
• NO-JIRA: OWNERS: add stevekuznetsov #4255
• HOSTEDCP-1709: test/e2e: use the eventually abstraction in chaos test #4247
• HOSTEDCP-1709: test/e2e: updates to the eventually construct #4253
• HOSTEDCP-1684: remove CLI requirement for RG flag when NSG ID is supp… #4232
• CNV-30445: KubeVirt: Enable multiqueue by default #4221
• NO-JIRA: chore(deps): update konflux references #4249
• HOSTEDCP-1729: Support for on-demand global routing when creating transit gateway #4081
• NO-JIRA: test/e2e: reduce logging for ssh and oc adm inspect #4242
• NO-JIRA: test/e2e: reduce logging on guest cluster infra cleanup #4239
• NO-JIRA: remove CI_TESTS_RUNS from e2e script as we now directly pass… #4226
• OCPBUGS-35450: Remove KMS V1 provider support for IBM Cloud #4215
• NO-JIRA: chore(deps): update konflux references to ff44cf3 #4244
• HOSTEDCP-1709: test/e2e: add a harness for asynchronous assertions #4206
• NO-JIRA: test: e2e: bump CPO mutate budget #4237
• OCPBUGS-34544: Disable PersistentVolumeLabel admission plugin #4107
• NO-JIRA: Shared ingress tests #4229
• NO-JIRA: Bump golang.org/x/net from 0.20.0 to 0.23.0 in /contrib/aws-tag-lb-service-webhook #3914
• NO-JIRA: chore(deps): update konflux references to 2be7c9c (main) #4222
• NO-JIRA: Revert “kubevirt, e2e: Skip advanced multinet for CI” #4203
• OCPBUGS-35513: cluster/core: fix nodepool naming #4219
• OCPBUGS-33428: Complete KAS migration to none endpoint reconciler type #4133
• CNV-42626: Transition kubevirt vms to use topology spread constraints #4145
• NO-JIRA: Fix tests to avoid race conditions #4214
• HOSTEDCP-1542: cmd: use validated and completed opts pattern #4212
• NO-JIRA: feat(olm): Set packageserver replicas to 2 for IBMCloudPlatform #4184
• NO-JIRA: Added markdown for storage table support #4213
• HOSTEDCP-1542: Fixed infra-id not being defaulted first #4210
• HOSTEDCP-1721: Enable shared ingress for Azure #4188
• HOSTEDCP-1542: cmd/cluster: refactor to remove example fixtures #4018
• HOSTEDCP-1402: cmd/infra/aws/destroy: allow using component credentials #3975
• HOSTEDCP-1446: hack: remove old arguments and scripts #4186
• OCPBUGS-34650: Allow specifying the volume detach timeout for machines via NodePools #4136
• HOSTEDCP-1709: test/e2e: misc context fixes: #4172
• IR-471: registry operator: Add missing env var, wait for rbac #4123
• HOSTEDCP-1514: support Azure diagnostics on NodePools #3970
• OCPBUGS-34807: Fixed ValidReleaseInfo condition #4129
• OCPBUGS-33951: Documentation for disconnected MGMT Cluster #4182
• kubevirt, e2e: Skip advanced multinet for CI #4187
• OCPBUGS-35205: Add hypershift-cluster-version-operator image to release providers #4138
• chore(deps): update konflux references #4165
• HOSTEDCP-1446: hack: make the e2e script generic #4176
• NO-JIRA: Delete references to the openshift-sdn image in CNO #4164
• HOSTEDCP-1709: test/e2e: always bound assertions in time #4170
• HOSTEDCP-1712: Initialize infra id for e2e-azure tests #4163
• OCPBUGS-34274: Generate default worker security group rules based on machineCIDR #4085
• NO-JIRA: test/e2e: remove dead code #4171
• HOSTEDCP-1709: hack/test: remove timeouts #4169
• OCPBUGS-34987: Add missing Tag permissions to cli role #4166
• HOSTEDCP-1553: Add annotation to customize log verbosity of kube-apiserver #4026
• HOSTEDCP-1689: add PodMonitor for external-dns #4147
• OCPBUGS-33953: Document how ICSP/IDMS work in HCP #4098
• OCPBUGS-33952: Documented HCP service exposure #4086
• NO-JIRA: Dependabot updates #4152
• HOSTEDCP-1709: test/e2e: constrain actions to context, timeout #4142
• HOSTEDCP-1709: e2e/util: improve logging during node readiness poll #4153
• OCPBUGS-34607: Disable machine pool feature gate #4109
• HOSTEDCP-1694: Automate HO Deployment Tag & Commit Updates for ROSA HCP #4102
• OCPBUGS-32467: nodepool_controller: add a reconciler for cleanup #3969
• OCPBUGS-34699: Allow access to root-ca configmap in cluster-network-operator role #4122
• HOSTEDCP-1542: cmd: add an option to render into a file, use it in e2e #4036
• OCPBUGS-33724: Fixes update issue with KubeVirt platform #4039
• HOSTEDCP-1564: Ensure VNET, NSG, & Managed RG locations match #4071
• HOSTEDCP-1687: Allow arm64 baremetal nodes to a nodepool in a multi-arch cluster #4060
• NO-JIRA: test/e2e: don’t validate metrics after failure #4143
• OCPBUGS-32186: cmd: report server version, supported OCP #3987
• NO-JIRA: Add link to agent heterogeneous nodepools doc #4135
• OCPBUGS-34734: Fix disconnected metadata inspection for nodepool #4130
• HOSTEDCP-1697: Allow overriding hosted cluster size label #4121
• OCPBUGS-18711: add AWS STS URL to OIDC provider audiences #4094
• HOSTEDCP-1558: use openshift/api instead of thirdparty for machineconfig #3983
• OCPBUGS-34741: Fix fleet manager pair label check #4132
• HOSTEDCP-1683: Use go workspaces #3980
• OCPBUGS-31568: Prevent hypershift install render –template and –outputs from being used together #3824
• NO-JIRA: chore(deps): update rhtap references #4118
• NO-JIRA: Update RHTAP references #4113
• HOSTEDCP-1688: Use operator namespace for openshift-config-managed-trusted-ca-bundle #4088
• HOSTEDCP-1570: remove liveness and readiness probes using metrics endpoint #4001
• OCPBUGS-33987: Use configmaps to track hosted cluster pair labels and set controller concurrency #4103
• MULTIARCH-4668: Add how to doc for heterogeneous node pools on Agent platform #3991
• OCPBUGS-34540: Fix RegistryMirrorProvider modifying the cached image directly #4100
• TRT-1685: bump openshift/api #4095
• OCPBUGS-33428: Reconcile KAS endpoints and endpoint slice #3942
• OCPBUGS-33181: Fixed audit-logs sigterm failing to terminate gracefully #3972
• OCPBUGS-31446: Add TrustedBundles to OAS container #4031
• NO-JIRA: Align kv min version to the default min version (now that default is >= 4.14 #4083
• OCPBUGS-30986: remove weak cipher #3855
• OCPBUGS-34071: Do not scale down legacy nodes #4076
• NO-JIRA: test: relax mgmt KAS egress check #4082
• HOSTEDCP-1681: Skip konflux when not necessary #4080
• OCPBUGS-33977: Allow specifying machine health check timeout in cluster sizing config #4075
• OCPBUGS-34095: Sync the autoscaler periodically #4074
• OCPBUGS-25758: fix router on 4.14 y-stream upgrade #4033
• NO-JIRA: Reinstate wrongly removed fields from cert rotation objects #4070
• OCPBUGS-34019: Make active & backup Azure KMS containers use different –metrics-addr #4066
• OCPBUGS-33742: setting higher priority class for external-dns pods #4050
• OCPBUGS-32257: Fix userReleaseProvider not using icsp/idms from mgmt cluster #4043
• CNF-12792: nto: add configmaps/finalizers under operator Role #3992
• CNV-40881: kubevirt, e2e, add test for advanced multinet #3902
• OCPBUGS-33377: Modify token secret MCS hash in place #4057
• chore(deps): update rhtap references #4063
• HOSTEDCP-1556: Support Priority based expander for cluster-autoscaler #4029
• NO-JIRA: Bump library-go dependency and bump LatestSupportedVersion to 4.17.0 #4044
• OCPBUGS-33726: Remove service-ca annotation from azure csi & file controller metrics services #4035
• OCPBUGS-33802: don’t delay new cluster creation #4045
• TRT-1672: e2e: proceed with teardown even if dump fails #4051
• OCPBUGS-33659: Improve resliency of size tagging when hostedcluster KAS down #4034
• And 5 elided commits (e.g. from squash or rebase merges)
• Full changelog

ibm-cloud-controller-manager

• OCPBUGS-120696: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #115
• NO-JIRA: Update OWNERS #72
• OCPCLOUD-2604: Merge https://github.com/IBM-Cloud/cloud-provider-ibm:release-1.30 (b05e0d9) into master #68
• OCPBUGS-34186: Updating ose-ibm-cloud-controller-manager-container image to be consistent with ART for 4.17 #70
• Full changelog

ibm-vpc-block-csi-driver

• OCPBUGS-80105: Bump google.golang.org/grpc to v1.79.3 #144
• OCPBUGS-77209: [release-4.17] standardize build paths #123
• OCPBUGS-58740: bump github.com/golang/glog to version v1.2.4 #105
• OCPBUGS-56062: tech debt: rework vendor patches #90
• append .0 to go.mod version #100
• OCPBUGS-53911: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #83
• STOR-1589: Rebase to upstream 5.2.8 for OCP 4.17 #70
• OCPBUGS-34162: Updating ose-ibm-vpc-block-csi-driver-container image to be consistent with ART for 4.17 #68
• OCPBUGS-36074: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #69
• OCPBUGS-34162: Updating ose-ibm-vpc-block-csi-driver-container image to be consistent with ART for 4.17 #67
• Full changelog

ibm-vpc-block-csi-driver-operator

• OCPBUGS-103222: Use patched x/net fork v0.35.0-sec.4 #188
• OCPBUGS-58435: [IBM VPC] set offlineExpansion to false in e2e test manifest #146
• OCPBUGS-42277: Reorder static resources to create RBAC first #128
• STOR-1596: Bump all deps for 4.17 #125
• OCPBUGS-36074: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #119
• OCPBUGS-34453: Updating ose-ibm-vpc-block-csi-driver-operator-container image to be consistent with ART for 4.17 #118
• OCPBUGS-34224: Updating ose-ibm-vpc-block-csi-driver-operator-container image to be consistent with ART for 4.17 #117
• Full changelog

ibmcloud-cluster-api-controllers

• OCPBUGS-86974: Updating ose-ibmcloud-cluster-api-controllers-container image to be consistent with ART for 4.17 #155
• OCPBUGS-103234: Replace golang.org/x/net with openshift-sustaining/net #171
• OCPBUGS-115543: Fetch envtest assets from the controller-tools releases #182
• OCPBUGS-67287: [release-4.17] Fix incomplete vendor/ #139
• OCPBUGS-51823: CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork #121
• OCPBUGS-50566: Fix for CVE-2024-45338 in golang.org/x/net/html in release-4.17 #101
• OCPBUGS-44880: Fetch service instance id from spec of IBMPowerVSCluster object while setting provider id #94
• OCPBUGS-37369: UPSTREAM: <carry>: Fix go-retryablehttp CVE - 4.17 #86
• NO-JIRA: Update OWNERS #83
• OCPCLOUD-2624: Merge https://github.com/kubernetes-sigs/cluster-api-provider-ibmcloud:v0.8.0 (8cd12b5) into main #82
• Full changelog

ibmcloud-machine-controllers

• OCPBUGS-103227: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 #105
• NO-JIRA: vendor golint instead of relying on the CI build root #114
• OCPBUGS-81667: bump vpc go sdk #92
• NO-JIRA: Modernize test infrastructure to align with other MAPI providers #88
• OCPBUGS-52957: IBMCloud: MAPI replacing unhealthy CP nodes #63
• OCPBUGS-37379: Bump dependency for CVE #49
• OCPCLOUD-2565: Adds –feature-gates CLI argument #43
• OCPBUGS-36185: IBMCloud: Handle pagination for subnets #41
• NO-JIRA: Update OWNERS #40
• OCPCLOUD-2612: Update kube deps to 1.30 #38
• OCPBUGS-34341: Updating ose-ibmcloud-machine-controllers-container image to be consistent with ART for 4.17 #37
• Full changelog

insights-operator

• OCPBUGS-103241: Bump golang.org/x/net to v0.35.0-sec.3 #1356
• OCPBUGS-80108: Bump google.golang.org/grpc to v1.79.3 #1284
• OCPBUGS-68193: OCPBUGS-68194: [vuln] Update logrus library to 1.9.3 #1227
• OCPBUGS-67008: Add filtering to add other possible pod status to QEMU gatherer #1196
• OCPBUGS-66395: QEMU logs are not gathered if there are pending status virt-launcher pods #1194
• OCPBUGS-66394: [bugfix] The archive’s records may include files whose names are out of bounds #1193
• OCPBUGS-64629: add permissions to gather clusterrole #1170
• OCPBUGS-63500: add missing permissions for replicasets and events #1165
• AUTH-482: set required-scc for dataGahtering jobs & pods #1049
• And 34 elided commits (e.g. from squash or rebase merges)
• Full changelog

ironic

• OCPBUGS-88474: Update the commit hash for openstack-ironic that addresses CVE-2026-43003 #905
• OCPBUGS-100163: Update openstack-ironic commit hash for CVE-2026-44918 #902
• OCPBUGS-76458: Bump pyasn1 to 0.5.1-4 #827
• OCPBUGS-74114: Bump keystonemiddleware version to 10.7.1-0.20260216144200.4c001ba for CVE-2026-22797 fix #796
• OCPBUGS-69792: Bump eventlet version to 0.33.1-7 #761
• METAL-1305: Do not use openstack packages #647
• OCPBUGS-52292: Fix runlogwatch script #643
• OCPBUGS-50673: Install python3-inotify pkg explicitly #640
• OCPBUGS-49998: Fix runlogwatch failure if LOG_DIR does not exist #637
• OCPBUGS-49822: Drop quiet option of grep to avoid race condition with pipefail #633
• OCPBUGS-49756: Use pynotify instead of inotify-tools #631
• OCPBUGS-48149: Bump jinja2 to 3.1.5 #622
• OCPBUGS-43955, OCPBUGS-43963: Bump python-waitress [4.17] #603
• OCPBUGS-42692: Include fixes for CVE-2024-5569 #590
• OCPBUGS-42509: Include fix for CVE-2024-47211 #593
• OCPBUGS-41783: Set node “alive” when inspection finished #578
• OCPBUGS-39380: Include fixes for CVE-2024-44082 into 4.17 #576
• OCPBUGS-37365: Update log statement to avoid logging entire node object #573
• OCPBUGS-38511: set min version for python3-webob #552
• OCPBUGS-38784: Update sushy to include Huwaei Fix ( Duplicate PR ) #572
• OCPBUGS-39013: Bump ironic-lib to fix utf8 decoding issue #568
• NO-ISSUE: fix scos and fcos dockerfiles to remove ironic-inspector #567
• OCPBUGS-38465: update sushy to pick up the RAID fix #545
• OCPBUGS-38481: Update root image #546
• OCPBUGS-37402: bump werkzeug #533
• METAL-1094: Sync with upstream metal3-io/ironic-image #532
• OCPBUGS-37084: Update ironic projects to latest available #522
• METAL-1070: Align ironic dependencies with latest upper constraints #520
• OCPBUGS-33335: Update Python Jinja2 #519
• METAL-1049: Download and install sources from local dir #494
• OCPBUGS-32261: Update ironic-inspector to fix the memory leak #516
• NO-ISSUE: Bump ironic projects versions #514
• OCPBUGS-29687: Read ironic and inspector htpasswds from files #513
• Bug OCPBUGS-34534: Disable installation of .pyc files through pip #508
• METAL-882: Update dependency versions for OCP 4.17 #505
• OCPBUGS-33902: Updating ironic-container image to be consistent with ART for 4.17 #501
• Full changelog

ironic-agent

• OCPBUGS-88474: Update commit hash for openstack-ironic-python-agent that addresses CVE-2026-43003 #315
• OCPBUGS-99886: Bump ironic-python-agent pinned commit for CVE-2026-66138 #309
• OCPBUGS-95067: Replace individual package removal with a single rpm -e loop #287
• OCPBUGS-95067: Replace dnf remove with rpm -e to prevent dependency removal #275
• OCPBUGS-69775: Bump eventlet version to 0.33.1-7 #231
• OCPBUGS-62490: netutils: Use ethtool ioctl to get permanent mac address #214
• OCPBUGS-55680: Delay determining the hostname to put into ignition #185
• METAL-1305: Do not use openstack packages #179
• OCPBUGS-39013: Bump ironic-lib to fix utf8 decoding issue #155
• OCPBUGS-39380: Include fixes for CVE-2024-44082 into 4.17 #160
• OCPBUGS-38511: set webob and bump werkzeug #148
• OCPBUGS-38481: Update root image #145
• METAL-1049: Download and install sources from local dir #142
• OCPBUGS-37086: Update ironic projects to latest available #141
• METAL-1070: Align ironic dependencies with latest upper constraints #140
• OCPBUGS-35968: Disable installation of .pyc files through pip #139
• NO-ISSUE: Bump ironic projects versions #137
• NO-ISSUE: Replace README with an explanation how this agent works #138
• OCPBUGS-33888: Updating ironic-agent-container image to be consistent with ART for 4.17 #134
• Full changelog

ironic-machine-os-downloader

• append .0 to go.mod version #104
• OCPBUGS-33892: Updating ironic-rhcos-downloader-container image to be consistent with ART for 4.17 #98
• Full changelog

ironic-static-ip-manager

• OCPBUGS-49350: Fix subnet validation #47
• OCPBUGS-33907: Updating ironic-static-ip-manager-container image to be consistent with ART for 4.17 #43
• Full changelog

keepalived-ipfailover

• OCPBUGS-34348: Updating openshift-enterprise-keepalived-ipfailover-container image to be consistent with ART for 4.17 #186
• OKD-219: add util-linux to base image #187
• OCPBUGS-34152: Updating openshift-enterprise-egress-router-container image to be consistent with ART for 4.17 #184
• OCPBUGS-34338: Updating ose-egress-http-proxy-container image to be consistent with ART for 4.17 #185
• OCPBUGS-34103: Updating openshift-enterprise-egress-dns-proxy-container image to be consistent with ART for 4.17 #183
• OCPBUGS-33909: Updating openshift-enterprise-base-container image to be consistent with ART for 4.17 #182
• OCPBUGS-33908: Updating openshift-enterprise-base-rhel9-container image to be consistent with ART for 4.17 #181
• Full changelog

kube-metrics-server

• NO-ISSUE: synchronize OWNERS from main branch [release-4.17] #89
• OCPBUGS-80013: Bump google.golang.org/grpc to v1.79.3 #65
• append .0 to go.mod version #43
• : OCPBUGS-46491: Disable HTTP2 #40
• OCPBUGS-41580: Wire server run options to flags. #35
• OCPBUGS-34258: Updating ose-kube-metrics-server-container image to be consistent with ART for 4.17 #29
• OCPBUGS-34258: Updating ose-kube-metrics-server-container image to be consistent with ART for 4.17 #28
• Full changelog

kube-proxy

• OCPBUGS-68165: deps: Update library-go to fix a CVE #661
• OCPBUGS-43807: Revendor to a patched k/k with our prefer-local-DNS hack #640
• SDN-4925: Revendor k/k to upstream 1.30.3 (for kube-proxy) #630
• OCPBUGS-34279: ART sync and golang 1.22 update #629
• OCPBUGS-34279: Updating kube-proxy-container image to be consistent with ART for 4.17 #623
• OCPBUGS-26084: Fix scan issue #622
• Full changelog

kube-rbac-proxy

• ART-13124: Update go.mod to include patch version in go directive #120
• OCPBUGS-42697: protobuf bump [4.17] #112
• OCPBUGS-34057: Updating kube-rbac-proxy-container image to be consistent with ART for 4.17 #99
• Full changelog

kube-state-metrics

• OCPBUGS-103237: Use patched x/net fork v0.35.0-sec.4 #163
• NO-ISSUE: synchronize OWNERS from main branch [release-4.17] #186
• OCPBUGS-74874: Deduplicate CRS stores #132
• OCPBUGS-33620: [bot] Bump openshift/kube-state-metrics to v2.13.0 #115
• OCPBUGS-34202: Updating kube-state-metrics-container image to be consistent with ART for 4.17 #113
• OCPBUGS-34202: Updating kube-state-metrics-container image to be consistent with ART for 4.17 #112
• Full changelog

kube-storage-version-migrator

• NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-17). #226
• ART-13124: Update go.mod to include patch version in go directive #217
• OCPBUGS-34066: Updating ose-kube-storage-version-migrator-container image to be consistent with ART for 4.17 #205
• Full changelog

kubevirt-cloud-controller-manager

• OCPBUGS-95083: OWNERS: Update component to Cloud Compute / KubeVirt Provider #79
• OCPBUGS-34447: Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 4.17 #44
• OCPBUGS-34157: Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 4.17 #43
• Full changelog

kubevirt-csi-driver

• OCPBUGS-80014: Bump google.golang.org/grpc to v1.79.3 #102
• OCPBUGS-54631: Ensure volume stays attached through reboots #56
• OCPBUGS-44623: During detach don’t return error if VM is not found #50
• CNV-45886: Add csi-clone support to kubevirt-csi (#118) #45
• CNV-44899: Sync upstream 2024-07-22 #44
• OCPBUGS-35093: Updating ose-kubevirt-csi-driver-container image to be consistent with ART for 4.17 #43
• OCPBUGS-34058: Updating ose-kubevirt-csi-driver-container image to be consistent with ART for 4.17 #41
• Full changelog

libvirt-machine-controllers

• OCPBUGS-77195: Fix incomplete vendor/ #301
• Full changelog

machine-api-operator

• OCPBUGS-103256: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #1546
• OCPBUGS-79373: [release-4.17] Use resource group when generating default Azure image #1481
• OCPBUGS-57073: Updates GCP CredentialsRequest #1377
• OCPBUGS-53036, OCPBUGS-53037: Updates GCP credentials request #1345
• OCPBUGS-52576: add image/read permissions #1344
• OCPBUGS-52359: Remove unneeded VNet permissions from Azure CredentialsRequest #1337
• OCPBUGS-51370: Drop oVirt support #1334
• OCPBUGS-43851: vSphere klog initialization preventing verbose log messages #1302
• OCPBUGS-42414: Ensure deletion annotation takes priority and oldestPolicy can distinguish longer ages #1293
• OCPBUGS-38868: Updates message verbs to use %q where appropriate #1278
• OCPCLOUD-2565: Machineset feature gating #1273
• OCPBUGS-37154: Added Permisions for Azure Capacity Reservation #1272
• OCPCLOUD-2565: Updates vsphere feature gates #1269
• CORS-3546: Nutanix: add gpus and dataDisks support #1266
• CORS-3580: Add the hyperdisk-balanced disk type #1268
• OCPBUGS-36469: Update validation for placementGroupPartition to honour it as pointer #1267
• CFE-1065: Add range validation for placementGroupPartition #1265
• CFE-1065: Add support for PlacementGroupPartition of placement group #1242
• NO-JIRA: Update OWNERS #1264
• OCPBUGS-1735: Vsphere: Handle cloned instance with lost taskID #1223
• OCPCLOUD-2565: Bump openshift/api #1256
• OCPCLOUD-2610: Update to Kube 1.30 deps #1255
• SPLAT-1638: Added multi vCenter support #1241
• CFE-1051: Adding validation for Azure capacityReservationGroupID #1250
• OCPBUGS-34450: Updating ose-machine-api-operator-container image to be consistent with ART for 4.17 #1251
• SPLAT-1415: Remove Alibaba #1200
• https://issues.redhat.com/browse/OCPBUGS-34391: Revert #1234 “CFE-1051: Add the webhook validation for \“CapacityReservationGroupID\” to \“AzureMachineProviderSpec\” in openshift/machine-api-operator” #1246
• CFE-1051: Add the webhook validation for “CapacityReservationGroupID” to “AzureMachineProviderSpec” in openshift/machine-api-operator #1234
• OCPBUGS-34182: Updating ose-machine-api-operator-container image to be consistent with ART for 4.17 #1244
• Full changelog

machine-config-operator

• OCPBUGS-103252: Use patched x/net fork v0.35.0-sec.4 #6578
• OCPBUGS-98583: Remove sensitive ControllerConfig logging #6300
• OCPBUGS-97845: Bootstrap MCS logging entire ignition #6274
• OCPBUGS-74149: enable nodeip-configuration for platform external #5577
• OCPBUGS-77979: hermetic 4.17 #5733
• OCPBUGS-77889: reduce MCO image size #5746
• OCPBUGS-77812: mcd_config_drift not working properly #5741
• OCPBUGS-77422: Remove MCD liveness probe #5709
• OCPBUGS-77242: After OCL is enabled few phases in MCN are not updating as expected #5575
• OCPBUGS-77186: Machine-config controller should not log about non-existent pull-secret changes #5679
• OCPBUGS-77090: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5678
• OCPBUGS-61190: MCO report “failed to list *v1alpha1.MachineOSConfig” when enable TechPreview after upgrading from 4.16 to 4.17 with one mcp paused #5584
• OCPBUGS-60112: Enable debug logging for nodeip-configuration #5219
• OCPBUGS-62170: Fix - NetworkManager restart or crash renders br-ex unusable #5355
• OCPBUGS-66037: Remove –mount directives #5443
• OCPBUGS-63154: [release-4.17] Networking: reset ovn-remote config and allow ovnkube controller to set it #5358
• OCPBUGS-63540: Add control-plane label for master nodes on legacy clusters #5375
• OCPBUGS-63364: Invalid architecture value found in annotation during 4.19 update #5368
• OCPBUGS-63055: Recheck generatedByControllerVersion annotation prior to deleting a degraded MC #5346
• OCPBUGS-62741: Add /etc/docker/certs.d to template #5335
• OCPBUGS-62683: Add mcd_local_unsupported_packages recording rule #5327
• OCPBUGS-60890: Race in configure-ovs.sh affects bonding interface configuration. #5267
• OCPBUGS-61859: Override NMState service definition #5289
• OCPBUGS-59930, OPNET-681: Support migration to NMState #5206
• OCPBUGS-56752: Support NODEIP_HINT in IPI deployments too #5080
• OCPBUGS-60704: operator: switch out VAP v1beta1 to v1 #5256
• OCPBUGS-57084: scope MCD node listers to current node #5107
• OCPBUGS-60239: Add workaround fix for static pod race #5231
• OCPBUGS-58292: Do not set cpu system reserve below the default value #5157
• OCPBUGS-58063: Update desired config in MCN on OCL update #5139
• OCPBUGS-56625: Give keepalived container chroot cap #5072
• OCPBUGS-58219: Boot image controller should correctly handle marketplace boot images #5151
• OCPBUGS-58218: add MachineConfiguration to CO related objects #5150
• OCPBUGS-57135: pkg/operator/status: Drop PoolUpdating as an Upgradeable=False condition #5111
• OCPBUGS-56901: Fix dynamic-system-reserved-calc.sh when only true parameter is used #5096
• OCPBUGS-56976: Boot Image Controller should not degrade when golden configmap is slow to update #5101
• OCPBUGS-56990: Only update boot disks during GCP boot image updates #5102
• OCPBUGS-56828: daemon: fix ostree-finalize-staged race workaround for package mode RHEL workers #5087
• OCPBUGS-52313: Update machine-config-daemon-pull.service to use custom policy for Podman < 4.4.1 #4893
• OCPBUGS-56665: Add hot loop detection in the boot image controller #5077
• OCPBUGS-56395: error from generateAndValidateRenderedMachineConfig function can be misleading #5060
• OCPBUGS-56218: Rewrote TestFirstBootHasSSHKeys e2e test in pure Go #5053
• OCPBUGS-55615: MSBIC should not update windows machinesets #5021
• OCPBUGS-55490: MCO should fall back to us-east-1 for AWS bootimages if no region specific-AMI exists #5020
• OCPBUGS-54830: Make mtu-migration run after wait-for-primary-ip #4989
• OCPBUGS-52314: on-prem/resolv-prepender: stop leaking tmp files #4894
• OCPBUGS-45989: Do not run resolv-prepender from NM dispatcher #4785
• OCPBUGS-52188: ignore mc not found error #4957
• OCPBUGS-52951: Add ipsec connect wait service #4930
• OCPBUGS-53441: Fixing typos for MachineConfigNode #4936
• OCPBUGS-53186: Update ObservedGeneration in KubeletConfig #4919
• OCPBUGS-53225: daemon: ensure ostree-finalize-staged is started before rebooting #4920
• OCPBUGS-52160: Enforce VIPs to be collocated at the same host #4884
• OCPBUGS-52303: Enable nmstate-configuration on all platforms #4891
• OCPBUGS-51003: daemon: add nil check for annotation fetching #4862
• OCPBUGS-51353: Update cluster-reader ClusterRole permissions #4882
• OCPBUGS-50955: create /run/nodeip-configuration before use #4858
• OCPBUGS-51334: Update format verbs for alert logs #4880
• OCPBUGS-52257: configure-ovs workaround for ovs-if-br-ex bug #4889
• OCPBUGS-49973: Update the storage.conf configuration file template #4836
• OCPBUGS-49363: Auto-recover from MC with invalid extension #4824
• OCPBUGS-49716: MCO CO degrades are stuck on until master pool updates complete #4826
• OCPBUGS-49639: Add clarification to invalid maxUnavailable alert #4820
• OCPBUGS-47475: Pausing Master MCP results in Alerts #4769
• OCPBUGS-47802: OCPBUGS-47801: trying to wait for sub-controllers #4775
• OCPBUGS-38292: controller: default to runc when upgrading clusters from 4.17 to 4.18 #4715
• OCPBUGS-45918: Remove trailing periods from AWS provided hostnames #4738
• OCPBUGS-39223: Do not enable on-prem-resolv-prepender.path for UPI #4572
• OCPBUGS-38292: Revert “controller: default to runc when upgrading clusters from 4.17 to 4.18” #4716
• OCPBUGS-38292: controller: default to runc when upgrading clusters from 4.17 to 4.18 #4635
• OCPBUGS-44561: Disable tx chksum for driver IDPF on GCP C3/C4 #4701
• MCO-1343: Backport Telemetry to 4.17 #4650
• OCPBUGS-43917: Disable ESP offload for OVS attached interfaces #4667
• OCPBUGS-43719: Soften haproxy timeout for kubeapi probe #4657
• OCPBUGS-42577: openstack: fix non-old systemd compatible unit #4620
• OCPBUGS-42108: Do not use ‘restart’ for ‘oneshot’ service #4615
• OCPBUGS-42979: Regenerate the rendered MC in use when deleted #4634
• OCPBUGS-42677: The MCO does not properly degrade when pools are failing to render a new config #4623
• OCPBUGS-42081: Check for kernel arg diff in updateOnClusterBuild #4595
• OCPBUGS-41255: Set ESP offloads off in bonds if slaves don’t support them #4598
• OCPBUGS-42256: Panic seen in CI job for MCC pod #4603
• OCPBUGS-42200: MCPs report wrong number of nodes when we move nodes from one custom MCP to another custom MCP #4602
• OCPBUGS-41357: Enable the use of Linux Bridge as the ovs default port connection #4567
• OCPBUGS-41686: MCPs with RHEL nodes are degraded when a userCA bundle is added to the cluster #4580
• OCPBUGS-41802: When newly built images rolled out, the update progress is not displaying correctly (went 0 –> 3) #4583
• OCPBUGS-41688: Add alert for users of deprecating the Image Registry workaround #4581
• OCPBUGS-41312: CVE-2024-3727 ose-machine-config-operator-container: containers/image: digest type does not guarantee valid type #4564
• OCPBUGS-38868: Updates message verbs to use %q where appropriate #4547
• OCPBUGS-38770: SCC-pinning for openshift workloads #4542
• OCPBUGS-38846: Machine-config daemon ListPools panic during tech-preview CI runs #4546
• OCPBUGS-38415: Give keepalived-monitor necessary capabilities #4532
• OCPNODE-2482: Enable CRI-O internal repair feature as the default #4535
• OCPBUGS-38374: Revert “MCD-pull: run after network-online.target in Azure” #4529
• OCPBUGS-38321: Revert “templates/master/cri-o: make crun as the default container runtime” #4524
• OCPNODE-2357: templates/master/cri-o: make crun as the default container runtime #4518
• NO-JIRA: crio: set min memory for crun #4516
• OCPBUGS-35800: kubelet config controller does not always propogate tlsSecurityProfile #4512
• OCPBUGS-31298: Prevent no-operation patches from overloading the kube-api server with unnecessary calls #4511
• MCO-703: Lifecycle Buildah with MCO #4471
• MCO-1214: Enabled boot images updates for AWS #4492
• NO-ISSUE: Move ManagedBootImages and NodeDisruptionPolicy to default e2e suite #4513
• NO-JIRA: Fix HasOSImage function #4510
• NO-ISSUE: Remove openshift/api pin #4508
• MCO-1065: MCO-1171: API bump for ManagedBootImages and NodeDisruptionPolicy GA #4496
• OCPBUGS-33784: Guard MachineOSBuild informers with feature gates #4497
• MCO-1230: Retry build and push operations multiple times #4469
• OCPBUGS-30955: On-Prem resolv prepender to watch for NM changes #4488
• MCO-1191, MCO-1194: Experiment with creating internal go bindings for bootc , Incorporate support for bootc commands to Machine Config Daemon #4465
• OCPBUGS-36289: e2e test should wait for MCD pod to be running #4444
• NO-ISSUE: OWNERS: keep up-to-date with active maintainers #4493
• MCO-1202: MCO-1203: MCO-1204: MCO-1205: MCO-1213: Implementing tlsSecurityProfile for MCO #4435
• SPLAT-1381: Remove Alibaba #4112
• NO-ISSUE: API bump to fetch BootcNodeManagement FG #4487
• OCPBUGS-36175: Remove privileged flag from on-prem containers #4443
• OCPNODE-2438: bump API and update CRD manifests #4480
• OCPBUGS-37271: kubelet: boot without PSI for performance concerns #4470
• MCO-1125: OCPBUGS-35277: Allow paths to be defined for non-disruptive updates #4472
• OCPBUGS-19537: OCB should fail if node is not coreos based #4442
• MCO-1227: Run boot image controller only when required #4477
• OCPBUGS-33397: Openshift uncordoned compute-node that was intentionally cordoned #4475
• OCPBUGS-33134: Nodes are drained twice when an OCB image is applied #4467
• OCPBUGS-36654: Machine-config operator should not hot loop generating ValidatingAdmissionPolicyUpdated events #4460
• OPNET-465: Refactor LB and DNS manifest list for vSphere #4167
• MCO-1103: Restore setup-envtest used in the verify test #4458
• MCO-1144: Implement progressing/error boot images conditions on the MachineConfiguration object #4390
• NO-ISSUE: Revert “disable mglru service” #4468
• OCPBUGS-36344: Add CIP relevant mirrors to sigstore attachement cfg #4449
• OCPBUGS-35436: Remove disable-mglru.service #4466
• OCPBUGS-36711: templates: run disable-mglru conditionally #4459
• OCPBUGS-35300: MCD-pull: run after network-online.target in Azure #4423
• OCPBUGS-30603: Bootstrap e2e test featuregate setup does not match the actual code #4439
• MCO-1147, OCPBUGS-34225: Pick up openshift/kubernetes 1.30 rebase updates, Dockerfile Update #4399
• OCPNODE-2226: Introduce versioning in auto-node-sizing feature #4363
• OCPBUGS-21628, OCPBUGS-28974: daemon: Handle correctly OS Version for 4.1 and 4.2 bootimages #4429
• OCPBUGS-33694: daemon/update: disable systemd unit before overwriting #4421
• OCPBUGS-36178: remove unnecessary e2e test TestControllerConfigStuff #4434
• OCPBUGS-33913, OCPBUGS-34261: CurrentImagePullSecret should be consumed by the MCD #4395
• OCPBUGS-35971: disable mglru kernel feature #4425
• NO-JIRA: format policy.json #4412
• OCPBUGS-32348: Make logging configurable for on-prem components #4344
• OCPBUGS-31710: Unify machineconfig file format for kubeletconfig to use YAML encoding instead of JSON encoding #4350
• OCPBUGS-35519: Revert “Azure: add Azure specific dnsmasq ordering” #4411
• OCPBUGS-33331: Fix reference to $host_file #4353
• OCPBUGS-34050: Default ipv4 NODE_IP to 0.0.0.0 #4388
• OCPBUGS-35300: Azure: add Azure specific dnsmasq ordering #4404
• OCPNODE-2216: crio: migrate metrics port to localhost only [4.17] #4292
• OCPNODE-2336: Drop ClusterImagePolicy validation on scope conflicts with release-image repo #4401
• OCPBUGS-33671, OCPBUGS-34079: fix secret canonicalization #4366
• OCPBUGS-33129: Panic when we remove an OCB infra MCP and we try to create new ones with different names #4396
• MCO-1152: MCO-1146: Add e2e tests for NodeDisruptionPolicy #4365
• OCPBUGS-34959: ensure event handlers are registered after queue is configured #4359
• OCPBUGS-29820: kubelet.service: wait for chronyd #4381
• OCPBUGS-33248: daemon: upgrade os image from local container storage if it exists #4347
• OCPBUGS-28653: userCA and cloudCA certfiicates are not removed from nodes and ignition config #4378
• OCPBUGS-32367: The MCD can override a restart crio action with a reload crio action #4376
• OCPBUGS-31312: machine-config-controller not logging enough details to triage the malformed certificate issue. #4379
• OCPBUGS-32242: The MCO makes a lot of API requests for ClusterOperator objects #4321
• OCPBUGS-30343: Scope each MCN object to only be accessible from its associated MCD #4346
• AUTH-482: set required-scc for openshift workloads #4219
• NO-ISSUE: Update baremetal owner aliases #4354
• SPLAT-1554: Added featuregate for multi vCenter support. #4298
• OCPBUGS-33803: machine-os-puller SA refreshes every hour, causing machine config regeneration #4370
• Full changelog

machine-image-customization-controller

• OCPBUGS-103246: Use patched x/net fork v0.35.0-sec.4 #192
• OCPBUGS-68192: [4.17] Uplift logrus #152
• append .0 to go.mod version #135
• OCPBUGS-34358: Updating ose-image-customization-controller-container image to be consistent with ART for 4.17 #127
• OCPBUGS-34358: Updating ose-image-customization-controller-container image to be consistent with ART for 4.17 #126
• Full changelog

machine-os-images

• OCPBUGS-87877: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #101
• OCPBUGS-54146: Change rhcos release browser url #56
• OCPBUGS-34177: Updating ose-machine-os-images-container image to be consistent with ART for 4.17 #38
• Full changelog

monitoring-plugin

• OCPBUGS-118233: [release-4.17] Bump fast-uri to 3.1.7 to fix CVE-2026-84292 #1336
• OCPBUGS-98777: [release-4.17] replace outdated react-linkify dependency #1343
• Fix for OCPBUGS-98163: CVE-2026-13676 #1050
• Fix for OCPBUGS-90525 OCPBUGS-90526: CVE-2026-12151 CVE-2026-9697 #1008
• OCPBUGS-79444: immutable bump #897
• OU-1260: [release-4.17] feat: use npm instead of yarn #812
• OCPBUGS-76809: fix for CVE-2025-69873 #848
• OCPBUGS-70290: Manual cherry pick qs vulnerability 4 17 #747
• OCPBUGS-64942: Use tenancy access to metric lables #639
• OU-1058: Don’t show TP button in non-administrator #637
• OCPBUGS-62282: align dev and admin persective tab names #602
• OCPBUGS-62282: add missing translation string #587
• OCPBUGS-61891: feat: add alerting rules tab to dev console #538
• OCPBUGS-59399: Fix “Export as CSV” #468
• OCPBUGS-54211: fix issue preventing dev silences from loading #374
• OU-724: remove deleted image #377
• OCPBUGS-51117: Fix overview links #357
• OCPBUGS-44394: remove unused package and upgrade vulnerable dependency #271
• OCPBUGS-43238: upgrade dynamic plugin sdk to remove vulnerable dependencies 4.17 #216
• OCPBUGS-42408: fix path-to-regexp dependency #196
• NO-JIRA: Update query-browser to not use setState #166
• NO-JIRA: upgrade to go 1.22 fixing the z version #163
• NO-JIRA: downgrade to go 1.21 to be able to use cachito #161
• NO-JIRA: add FIPS compliant flags and env vars #159
• NO-JIRA: fix cachito web folder #152
• NO-JIRA: Use DNF and go based image in Dockerfile #155
• NO-JIRA: fix command chain for art image #150
• NO-JIRA: fix cachito pem file location #147
• NO-JIRA: fix cachito target folder #145
• NO-JIRA: Fix art image cachito path for yarn lock #143
• OU-436: Add Golang backend #128
• OU-258: Dev console: Use Metrics page from monitoring-plugin #138
• OCPBUGS-37291: check undefined function before calling #137
• NO-JIRA: Fix docker local and log query browser error #135
• OU-248: Add Alerts Detail Page #131
• OU-238: Export CSV #127
• OCPBUGS-36970: Use the non-tenancy URL in the Admin perspective #134
• OU-251: Prevent rule labels from being added to alert labels for dev console #132
• OU-439: Add the predefined queries list to the admin metrics #129
• OU-251: Migrate Developer Perspective Alert List to Monitoring Plugin #125
• OKD-210: Use rhel9 base image in Dockerfile #121
• OCPBUGS-34312: Updating monitoring-plugin-container image to be consistent with ART for 4.17 #120
• OCPBUGS-34312: Updating monitoring-plugin-container image to be consistent with ART for 4.17 #119
• Full changelog

multus-admission-controller

• OCPBUGS-103264: bump golang.org/x/net to v0.35.0-sec.3 to fix CVE-2026-33814 #135
• OCPBUGS-58770: Update the github.com/golang/glog module to v1.2.4 #102
• append .0 to go.mod version #97
• OCPBUGS-34283: Updating ose-multus-admission-controller-container image to be consistent with ART for 4.17 #85
• NP-1046: Update owners #86
• Full changelog

multus-cni, multus-cni-microshift

• OCPBUGS-103255, OCPBUGS-103257: [release-4.17] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #358
• OCPBUGS-85250: Fix server url in kubeconfig #299
• NO-ISSUE: [release-4.17] Bump Go to 1.22 and fix CI build root image #290
• OCPBUGS-77854: hermetic 4.17 #277
• OCPBUGS-43391: Update net-attach-def client library to 1.7.5 for cri-o functionality [backport 4.17] #257
• OCPBUGS-47471: adds getcontext (backport 4.17) #260
• OCPBUGS-41817: always attempt a live pod get on miss to confirm its really not there #248
• OCPBUGS-37991: Downstream sync to address multiple interface returns in network-status annotation #245
• OKD-218: install util-linux #241
• OCPBUGS-34911: Update owners file #237
• OCPBUGS-33559: Thick plugin should not wait for API readiness on CNI DEL #233
• Full changelog

multus-networkpolicy

• append .0 to go.mod version #71
• And 3 elided commits (e.g. from squash or rebase merges)
• Full changelog

multus-route-override-cni

• NP-1041: Update owners #57
• Full changelog

multus-whereabouts-ipam-cni

• OCPBUGS-73728: Update tag on ci-operator.yaml file #395
• OCPBUGS-70256: Prevent accidental IP deallocation in statefulsets #393
• OCPBUGS-55617: Fixes leftover podref issue #364
• OCPBUGS-48745: [Release-4.17]Kubeconfig loop #334
• OCPBUGS-33941: upstream sync 23072024 #303
• NP-1045: Update owners #285
• OCPBUGS-29648: upstream sync 13062024 #290
• OCPBUGS-24663: upstream sync 2024/05/23 #284
• Full changelog

must-gather

• OCPBUGS-86069: Collect object size with the object count #548
• OCPBUGS-60607: Separate resources with comma to fix malformed inspect #504
• NO-JIRA: append .0 to go.mod version #492
• OCPBUGS-48068: Update owners #452
• OCPBUGS-46281: Support gathering IPsec data #467
• OCPBUGS-42835: Removes reference to gather_multus_logs in 4.17 #459
• OCPBUGS-42964: Collect etcd object count #453
• OCPBUGS-42958: Gather OSUS data #443
• OCPBUGS-42835: [Release-4.17] Network logs collection: skip unready nodes #445
• CNF-13837: gather_ppc: fallback option when NTO image not found #436
• MON-3108: Add gather_metrics for Prometheus fetching #434
• OCPBUGS-33959, SDN-5066: Remove needless multus log collection #431
• NO-JIRA: Update dockerfile rename changes #433
• NO-JIRA: Rename Dockerfile #432
• NO-JIRA: Correct typo. #414
• NO-JIRA: Adding the missing clusterresourcequota and Flowcontrol resources #408
• OCPBUGS-34360: Run ppc node collection in parallel #424
• OCPBUGS-31037: Collect PerformanceProfile Data From all Nodes #410
• OCPBUGS-33959: Network logs collection: skip unready nodes #425
• OCPBUGS-34467: Updating ose-must-gather-container image to be consistent with ART for 4.17 #423
• Full changelog

network-interface-bond-cni

• OCPBUGS-77350: Updating ose-network-interface-bond-cni-container image to be consistent with ART for 4.17 #110
• OCPBUGS-59620: Bump github.com/containernetworking/plugins from to 1.7.1 #83
• NO-JIRA: Add ci-operator file #82
• OCPBUGS-34286: Updating ose-network-interface-bond-cni-container image to be consistent with ART for 4.17 #64
• Full changelog

network-metrics-daemon

• OCPBUGS-103254: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #154
• OCPBUGS-130598: add ./bin to PATH in check_golint.sh #162
• append .0 to go.mod version #105
• And 6 elided commits (e.g. from squash or rebase merges)
• Full changelog

network-tools

• append .0 to go.mod version #148
• NO-JIRA: Add real total line to the bug ranking #131
• NO-JIRA: Px score for bugs #128
• OCPBUGS-34469: Updating ose-network-tools-container image to be consistent with ART for 4.17 #129
• NO-JIRA:In recently assigned bugs, exclude bugs we don’t count as such #127
• Full changelog

nutanix-cloud-controller-manager

• NO-JIRA: Update OWNERS #34
• OCPCLOUD-2603: Merge https://github.com/nutanix-cloud-native/cloud-provider-nutanix:main (ab0df3a) into main #31
• Full changelog

nutanix-machine-controllers

• OCPBUGS-51859: CVE-2025-22868 #111
• OCPBUGS-47267: fixing CVE-2024-45338 #92
• OCPBUGS-55728: Fix link-local addresses being added to machine #102
• CORS-3546: Nutanix: support for gpus and dataDisks #77
• OCPCLOUD-2565: Adds –feature-gates CLI argument #78
• OCPCLOUD-2611: Update to Kube 1.30 #75
• OCPBUGS-34230: Updating ose-nutanix-machine-controllers-container image to be consistent with ART for 4.17 #74
• NO-JIRA: Update OWNERS #76
• Full changelog

oauth-apiserver

• OCPBUGS-103267: Replace golang.org/x/net with github.com/openshift-sustaining/net v0.35.0-sec.4 #225
• OCPBUGS-66228: UPSTREAM <carry>: bump kubernetes-apiserver to pick up loopback certificate expiration update #157
• NO-JIRA: (chore): update OWNERS file #171
• OCPBUGS-61584: Bump openshift/kubernetes-apiserver for etcd retry patches. #143
• append .0 to go.mod version #133
• OCPBUGS-46044: Update dependencies to address CVE-2024-24786 #127
• OCPBUGS-34446: Updating ose-oauth-apiserver-container image to be consistent with ART for 4.17 #116
• OCPBUGS-34140: Updating ose-oauth-apiserver-container image to be consistent with ART for 4.17 #115
• Full changelog

oauth-proxy

• OCPBUGS-136604: [release-4.17] Sync OWNERS and OWNERS_ALIASES with master #402
• OCPBUGS-112108: bugfix: rewrite open redirect strings to ‘/’ #385
• OCPBUGS-61445: Update x/crypto to v0.31.0 #334
• OCPBUGS-58472: fix e2e tests #327
• OCPBUGS-30443: Update dependencies to address CVE-2024-24786 #298
• OCPBUGS-46659: Fix oauth-proxy e2e-component tests #303
• Full changelog

oauth-server

• OCPBUGS-103265: Replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #280
• OCPBUGS-87070: bugfix: default to english when Accept-Language header contains more than 1000 underscores #273
• OCPBUGS-81795: Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 #239
• OCPBUGS-61584: Bump openshift/kubernetes-apiserver for etcd retry patches. #198
• append .0 to go.mod version #185
• OCPBUGS-44118: escape spaces in oauth callback path #167
• OCPBUGS-43587: Fix login path for go1.22 mux pattern matching #162
• OCPBUGS-34248: Updating oauth-server-container image to be consistent with ART for 4.17 #149
• OCPBUGS-33695: p/o/handlers - fix nil-pointer, if ResStatus is nil #150
• Full changelog

oc-mirror

• OCPBUGS-130910: v1 accept catalog root entries and relative symlink targets #1595
• And 37 elided commits (e.g. from squash or rebase merges)
• Full changelog

olm-catalogd

• NO-ISSUE: Synchronize From Upstream Repositories #59
• NO-ISSUE: Synchronize From Upstream Repositories #57
• NO-ISSUE: Synchronize From Upstream Repositories #53
• And 5 elided commits (e.g. from squash or rebase merges)
• Full changelog

olm-operator-controller

• OCPBUGS-103266, OCPBUGS-103269: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #805
• OCPBUGS-80129: Update grpc-go to v1.71.3-sec.1 to fix CVE-2026-33186 #736
• NO-ISSUE: Synchronize From Upstream Repositories #124
• NO-ISSUE: Synchronize From Upstream Repositories #123
• NO-ISSUE: Synchronize From Upstream Repositories #121
• NO-ISSUE: Synchronize From Upstream Repositories #119
• NO-ISSUE: Synchronize From Upstream Repositories #118
• NO-ISSUE: Synchronize From Upstream Repositories #117
• NO-ISSUE: Synchronize From Upstream Repositories #115
• OCPBUGS-36471: Synchronize From Upstream Repositories #114
• NO-ISSUE: Synchronize From Upstream Repositories #111
• NO-ISSUE: Synchronize From Upstream Repositories #110
• NO-ISSUE: Synchronize From Upstream Repositories #109
• NO-ISSUE: Synchronize From Upstream Repositories #108
• NO-ISSUE: Synchronize From Upstream Repositories #107
• NO-ISSUE: Synchronize From Upstream Repositories #106
• NO-ISSUE: Synchronize From Upstream Repositories #104
• NO-ISSUE: Synchronize From Upstream Repositories #103
• And 12 elided commits (e.g. from squash or rebase merges)
• Full changelog

openshift-apiserver

• OCPBUGS-82720: Address CVE-2026-35469 #658
• OCPBUGS-68208: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.17] #609
• OCPBUGS-74143: pkg/image: conditionally parse raw image manifest #596
• OCPBUGS-66229: UPSTREAM <carry>: bump kubernetes-apiserver to pick up loopback certificate expiration update #584
• OCPBUGS-63392: Wire dry run option to Image API server operations #565
• OCPBUGS-61584: Bump openshift/kubernetes-apiserver for etcd retry patches. #554
• OCPBUGS-53382: Skip blocked registry check for registries with mirrors #500
• OCPBUGS-58821: Fix image reference in TestImageStreamImportQuayIO #515
• append .0 to go.mod version #525
• OCPBUGS-49399: prevent panic when no image and error are set #488
• OCPBUGS-49399: validate image property isn’t nil before using #489
• OCPBUGS-49399: move on to the next digest/tag during failures #487
• OCPBUGS-42752: Pass expected type to deploymentconfig/scale object validation. #457
• OCPBUGS-42232: fail image import when both image and error are nil #450
• OCPBUGS-34375: Updating ose-openshift-apiserver-container image to be consistent with ART for 4.17 #437
• Full changelog

openshift-controller-manager

• OCPBUGS-103272: Use patched x/net fork v0.35.0-sec.4 #456
• OCPBUGS-61199: legacy image pull secret rollback controller #413
• OCPBUGS-57950: ignore error failing to find pull/push secrets #400
• OCPBUGS-57480: Set node-pullsecrets volume to read-only to protect image pull credentials #393
• OCPBUGS-55826: Empty proxy variables are causing issues during the build #379
• OCPBUGS-47769: Add team members to the OWNERS file #357
• OCPBUGS-44093: user system:serviceaccount:openshift-infra:serviceaccount-pull-secrets-controller in ns/openshift-infra must not produce too many applies #350
• NO-JIRA: cleanup root and app OWNERS #346
• OCPBUGS-42362: Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #339
• OCPBUGS-39167: replaces deprecated square/go-jose wtih go-jose/go-jose #328
• OCPBUGS-35731: Race condition when deleting ServiceAccount #318
• Revert Revert OCPBUGS-36833: 4.16 “Bad” reconciliation loops can cause unbounded dockercfg secret creation #322
• NO-JIRA: Revert “OCPBUGS-36833: 4.16 “Bad” reconciliation loops can cause unbounded dockercfg secret creation” #321
• OCPBUGS-36833: 4.16 “Bad” reconciliation loops can cause unbounded dockercfg secret creation #319
• OCPBUGS-32873: Replace deprecated gopkg.in/square/go-jose.v2 #315
• OCPBUGS-12699: Whitelists lower-case proxy envs to pod proxydefaults #310
• WRKLDS-1292: Bump k8s dependencies to 1.30.1 #313
• OCPBUGS-33815: openshift-controller-manager overwriting/undoing changes to ServiceAccount imagePullSecrets #306
• OCPBUGS-33834: filter delete events #307
• Full changelog

openshift-state-metrics

• NO-ISSUE: synchronize OWNERS from main branch #150
• append .0 to go.mod version #124
• OCPBUGS-34298: Updating openshift-state-metrics-container image to be consistent with ART for 4.17 #117
• OCPBUGS-34298: Updating openshift-state-metrics-container image to be consistent with ART for 4.17 #116
• MON-3878: Remove deprectated logtostderr #114
• Full changelog

openstack-cinder-csi-driver-operator

• OCPBUGS-103280: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #196
• OCPBUGS-80133: Bump google.golang.org/grpc to v1.79.3 #194
• NO-JIRA: Add more docs for configuration options #167
• STOR-1596: Bump all deps for 4.17 #176
• OCPBUGS-30949: Add config map hooks #168
• OCPBUGS-34870: Correct out-of-bounds check #170
• OCPBUGS-34276: Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 4.17 #169
• Full changelog

openstack-cluster-api-controllers

• OCPBUGS-44455: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.17 #343
• append .0 to go.mod version #364
• OCPBUGS-44455: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.17 #342
• OCPBUGS-44959: Makefile changes for merge-bot #340
• OCPBUGS-44455: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.17 #329
• OCPBUGS-43584: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.17 #323
• OCPBUGS-34072: Updating openstack-cluster-api-controllers-container image to be consistent with ART for 4.17 #317
• Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into main #316
• Remove dulek from shiftstack-team #313
• NO-JIRA: Bump to latest CAPO v0.10 #314
• Full changelog

openstack-machine-api-provider

• OCPBUGS-78169: hermetic 4.17 #162
• OCPBUGS-76793: Fix make test #160
• NO-JIRA: Update shiftstack-team in OWNERS_ALIASES #118
• OCPBUGS-34329: Update to Go v1.22, and OCP v4.17 and Kubernetes v1.30 #117
• NO-JIRA: Remove a stray comment #113
• OCPBUGS-33954: Failure to get bootstrap is non-fatal #112
• OCPBUGS-33806: Fix panic deleting Machine in ERROR state #111
• Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

• OCPBUGS-103275, OCPBUGS-103278, OCPBUGS-103286: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1368
• OCPBUGS-80136, OCPBUGS-80137, OCPBUGS-80138: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.71.3-sec.1 [release-4.17] #1315
• OCPBUGS-77838: Remove the collect-profiles info from the microshift kustomization file #1250
• OCPBUGS-76953: Remove the collect-profiles job #1232
• OCPBUGS-67301: Fix TOCTOU race condition in ensureInstallPlan (#3682) #1172
• OCPBUGS-57092: [release-4.17] e2e stability fixes #1081
• OCPBUGS-60791: Add NetworkPolicy as a supported kind #1058
• OCPBUGS-57428: reduce cache expiry frequency [release-4.19] #1021
• OCPBUGS-59253: Reduce Frequency of Update Requests for Copied CSVs (#3597) #1036
• OCPBUGS-57438: operatorgroup: ensure clusterroleselectors in clusterrole aggregation rules are sorted #1025
• OCPBUGS-56250: fix(olm): improve error logging for missing olm.managed label (#3558) #1004
• OCPBUGS-51226, OCPBUGS-51228, OCPBUGS-51246: (vendor) pin go-jose/v4@v4.0.5 #998
• OCPBUGS-53071: add missing pod disruption reasons to isPodDead #982
• OCPBUGS-53283: Ensure that PSA label is latest instead of pinning versions #985
• OCPBUGS-50829, OCPBUGS-50831, OCPBUGS-50835: CVE-2025-24976 Bump github.com/distribution/distribution/v3 [release-4.17] #968
• OCPBUGS-48695: Fix excessive catalog source snapshots cause severe performance regression #956
• OCPBUGS-45845: Fix concurrent namespace resolution #944
• OCPBUGS-46929, OCPBUGS-46936, OCPBUGS-47316: x/net bump to v0.34.0 [release-4.17] #938
• OCPBUGS-46598: catalog-operator: Delete Pods that were evicted (#3459) #922
• OCPBUGS-46054: CRD upgrade existing CR validation fix #913
• OCPBUGS-44760: fix: call TokenRequest API when service account token secret is missing #898
• OCPBUGS-43965: Return an error when the IP status cannot be updated #885
• OCPBUGS-41549: [4.17] adds paginating lister for evaluating CRs’ upgrade fitness versus new CRDs. #860
• OCPBUGS-41498: [release-4.17] Fix e2e flake: upgrade CRD with deprecated version #858
• OCPBUGS-39574: (fix) registry pods do not come up again after node failure (#3366) #855
• OCPBUGS-39458: add optional schema migrations; default to olm.bundle.object instead of olm.csv.metadata (#1384) #851
• NO-ISSUE: Synchronize From Upstream Repositories #835
• NO-ISSUE: Synchronize From Upstream Repositories #834
• NO-ISSUE: Update junit report file name to show spec results on Test Grid #832
• OCPBUGS-36500: remove cvo hypershift profile annotation from psm-operator manifests #831
• NO-ISSUE: Synchronize From Upstream Repositories #830
• NO-ISSUE: Synchronize From Upstream Repositories #827
• NO-ISSUE: Synchronize From Upstream Repositories #825
• NO-ISSUE: Synchronize From Upstream Repositories #820
• NO-ISSUE: Synchronize From Upstream Repositories #816
• OCPBUGS-35970: add io.openshift.release.operator label to image #812
• NO-ISSUE: Synchronize From Upstream Repositories #815
• NO-ISSUE: add output-dir to E2E_GINKGO_OPTS #813
• OCPBUGS-35970: don’t erase the filesystem from the base tools image #804
• NO-ISSUE: Manual Sync 0702 #808
• OCPBUGS-35970: switch base image #802
• NO-ISSUE: Synchronize From Upstream Repositories #801
• NO-ISSUE: Synchronize From Upstream Repositories #797
• NO-ISSUE: Manual Sync #796
• OPRUN-3221: 🌱 fix xplat compile for of-tools image; hide utest files from git; use rhel8 art builder image #770
• NO-ISSUE: Synchronize From Upstream Repositories #790
• NO-ISSUE: Synchronize From Upstream Repositories #783
• NO-ISSUE: Synchronize From Upstream Repositories #778
• NO-ISSUE: Synchronize From Upstream Repositories #763
• NO-ISSUE: (Manual) Synchronize From Upstream Repositories #758
• Full changelog

operator-marketplace

• OCPBUGS-68212, OCPBUGS-68213: [release-4.17] CVE-2025-65637 fixed in logrus v1.9.3+ #710
• OCPBUGS-62219: Remove Expect func so that the test case can use the retry logic #670
• OCPBUGS-61036: Update memoryTarget on catalog source pods #663
• ART-13124: append .0 to go.mod version #638
• OCPBUGS-53179: Ensure that PSA label is latest instead of pinning versions #607
• OCPBUGS-49431: Upgrade golang.org/x/net [release-4.17] #585
• OCPBUGS-39297: Replace 4.16 image references with 4.17 #573
• NO-ISSUE: Add client certificate and key to service monitor #482
• OCPBUGS-34244: Updating marketplace-operator-container image to be consistent with ART for 4.17 #568
• Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

• OCPBUGS-128826: node: fix serviceUpdateNotNeeded nil pointer comparison #3496
• OCPBUGS-82724: Bump github.com/moby/spdystream to v0.5.1 #3322
• OCPBUGS-81639: External gateway: Remove routes for external gateway pods in terminating or not ready state #3107
• OCPBUGS-78029: Add pperiyasamy to OWNERS for release-4.17 #3046
• OCPBUGS-77568: Clear stale conntrack UDP entries for nodePorts #3035
• CORENET-6055, OCPBUGS-74492: [release-4.17] Dockerfile: Unpin OVN and consume the latest from FDP #2959
• [release:4.17] OCPBUGS-71985: Fix conntrack reconciliation to use service port instead of endpoint port #2936
• OCPBUGS-71218: [release-4.17] CVE-2025-65637 Bump github.com/sirupsen/logrus to v1.9.1 through indirect dependency conversion (go-controller module) #2905
• OCPBUGS-71198: NetPol & MultiNetPol: Process update only when spec fields and/or related annotation are updated #2923
• OCPBUGS-68348: Add ricky-rav to OWNERS for release-4.17 #2898
• OCPBUGS-65928: Skip Pending pods in EgressIP status #2871
• OCPBUGS-65569: [release-4.17]: kubevirt: fix bad release of IPs of live migratable pods #2857
• OCPBUGS-64856: Fix stale EIP assignments during failover and controller restart #2850
• OCPBUGS-64674: [release-4.17]: Configure sec nic EIPv6 address with NODAD and maximum lifetime #2843
• OCPBUGS-63154: Fix EgressIP stale GARP post reboot + pod restart #2807
• OCPBUGS-61749: [release-4.17] Fix dnsnameresolver address set #2796
• OCPBUGS-60484: Update OWNERS file: Add Patryk/Martin as approvers #2717
• OCPBUGS-59381: [release-4.17] Fix default network -> localnet #2667
• OCPBUGS-58160: Unpin OVS patch versions, move to ovs 3.5 #2647
• OCPBUGS-57109: Fix hybrid overlay node subnets collision with cluster subnets #2620
• OCPBUGS-57107: Increase InformerSyncTimeout to 60s #2623
• OCPBUGS-56443: Fix predicate for cluster subnet route to gateway router #2578
• OCPBUGS-56244: Allow default network pods to reach localnet on the same node #2572
• OCPBUGS-52480: Handles unspecified protocol in network policy port #2478
• OCPBUGS-54203: Update OVN to FDP25.A.1 24.03.5-40. #2496
• OCPBUGS-52409: Change dynamic_neigh_routers to false for the Interconnect topology. #2476
• OCPBUGS-50519: kubevirt, localnet: Reduce live migration downtime #2458
• OCPBUGS-48777: Fixes unexpected mp0 route removal during start up #2423
• OCPBUGS-48828: fixes overzealous deletion of SNAT in egressIP #2425
• OCPBUGS-47506: Let OVN-northd bind remote ports #2404
• OCPBUGS-45953: bump OVS version to 3.4.0-18 #2393
• OCPBUGS-45312: pin libreswan to 4.6-3.el9_0.3 #2384
• OCPBUGS-45339: Dockerfile: Update OVN to the 24.03.2-32.el9fdp minor release. #2376
• OCPBUGS-43454: Ignore cluster manager topology not managed errors for localnet with no subnets #2362
• OCPBUGS-44303: Add hybird overlay pod IPs to the namespace address_set #2340
• OCPBUGS-42931: Add static route to the hairpin masquerade IPs to pod #2315
• OCPBUGS-39200: Dockerfile: Bump OVS to 3.4.0-1 #2287
• OCPBUGS-42940: Fix egress gateway pod cleanup for remote zone pods. #2316
• OCPBUGS-39406, SDN-4919: Downstream Merge 28th August #2283
• SDN-4919: Downstream Merge August 22nd #2277
• SDN-4919: Downstream Merge 20th August #2274
• OCPBUGS-38267, OCPBUGS-38653, OCPBUGS-38693: Downstream Merge 14th August 2024 #2265
• OCPBUGS-37541: Fix per-pod MCS/metadata blocking #2240
• OCPBUGS-36614, OCPBUGS-36865, SDN-4919: [DownstreamMerge] 29 July 2024 #2241
• OCPBUGS-37709: Revert #2233 DownStream Merge: 24th July 2024 #2243
• OCPBUGS-36865, SDN-4919: DownStream Merge: 24th July 2024 #2233
• SDN-4919: Downstream Merge July 10th #2223
• OCPBUGS-33758, OCPBUGS-33758, OCPBUGS-35347, OCPBUGS-35367, SDN-4919, SDN-5011: Downstream Merge: July 2nd #2217
• OCPBUGS-34463: Updating ovn-kubernetes-microshift-container image to be consistent with ART for 4.17 #2186
• OCPBUGS-34778: bump OVN to fix multicast bug #2210
• OCPBUGS-34462: Updating ose-ovn-kubernetes-container image to be consistent with ART for 4.17 #2191
• OCPBUGS-33005: Downstream Merge June 17th #2206
• SDN-4157: Downstream Merge June 7th 2024 #2201
• OCPBUGS-34109: Updating ose-ovn-kubernetes-base-container image to be consistent with ART for 4.17 #2176
• OCPBUGS-34331: [DownstreamMerge] 23 May 2024 #2180
• OKD-40: Add ovnver_okd and ovsver_okd to Dockerfile.base #2161
• Full changelog

powervs-block-csi-driver

• OCPBUGS-80142: Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 #131
• OCPBUGS-82725: Fix CVE-2026-35469 by bumping github.com/moby/spdystream to v0.5.1 #125
• MULTIARCH-4809: Rebase with upstream: go modules updates and code changes. #86
• OCPBUGS-35349: Updating ose-powervs-block-csi-driver-container image to be consistent with ART for 4.17 #84
• OCPBUGS-34123: Updating ose-powervs-block-csi-driver-container image to be consistent with ART for 4.17 #83
• Full changelog

powervs-block-csi-driver-operator

• OCPBUGS-80144: Fix CVE-2026-33186 by bumping google.golang.org/grpc to v1.79.3 #112
• STOR-1596: Bump all deps for 4.17 #73
• OCPBUGS-36229: Fix CVE-2023-45288 and CVE-2024-24786 #69
• OCPBUGS-35871: Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART for 4.17 #72
• OCPBUGS-34219: Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART for 4.17 #71
• Full changelog

powervs-cloud-controller-manager

• OCPBUGS-80145: Replace google.golang.org/grpc with openshift-sustaining fork v1.71.3-sec.1 to v1.79.3 to fix CVE-2026-33186 #103
• No-Jira: Manual rebase of upstream release 1.30 on 22-Jul-2024 #72
• No-Jira: Add multiarch reviewers and approvers to OWNER file #70
• No-Jira: Merge https://github.com/IBM-Cloud/cloud-provider-ibm:release-1.29 (6c2ab88) into main #69
• OCPBUGS-34864: Merge https://github.com/IBM-Cloud/cloud-provider-ibm:release-1.29 (5a0fb34) into main #41
• OCPBUGS-34372: Updating ose-powervs-cloud-controller-manager-container image to be consistent with ART for 4.17 #68
• Full changelog

powervs-machine-controllers

• OCPBUGS-61204: Use OS_GIT_VERSION in Makefile when found (for Konflux builds) #126
• append .0 to go.mod version #117
• OCPBUGS-54750: Fix for CVE-2024-51744 in github.com/golang-jwt/jwt/v4 in release-4.17 #113
• OCPBUGS-37688: Update go.mod to fix CVE #81
• OCPBUGS-34379: Updating ose-powervs-machine-controllers-container image to be consistent with ART for 4.17 #78
• OCPBUGS-33995: Add more custom endpoints #76
• Full changelog

prom-label-proxy

• NO-ISSUE: synchronize OWNERS from main branch [release-4.17] #403
• append .0 to go.mod version #381
• MON-3972: [bot] Bump openshift/prom-label-proxy to v0.11.0 #375
• MON-3905: [bot] Bump openshift/prom-label-proxy to v0.10.0 #373
• MON-3897: [bot] Bump openshift/prom-label-proxy to v0.9.0 #372
• OCPBUGS-34362: Updating prom-label-proxy-container image to be consistent with ART for 4.17 #371
• OCPBUGS-34362: Updating prom-label-proxy-container image to be consistent with ART for 4.17 #370
• Full changelog

prometheus

• OCPBUGS-93681: fix for CVE-2026-42151 #378
• NO-ISSUE: synchronize OWNERS from main branch #383
• OCPBUGS-88631: remote: validate snappy decoded length before allocation in read endpoint #348
• OCPBUGS-80146: Bump google.golang.org/grpc #320
• OCPBUGS-61766: chore: compute highestTimestamp at queryManager level #268
• append .0 to go.mod version #258
• OCPBUGS-56738: BACKPORT: fix promtool analyze block shows metric name with 0 cardinality #254
• OCPBUGS-54941: Scraping: Bump cache iteration after error to avoid false duplicate detection. #249
• OCPBUGS-43667: fix(discovery): Handle cache.DeletedFinalStateUnknown in node informers’ DeleteFunc #230
• OCPBUGS-38690: Restore Prometheus functionality to accept samples with different timestamps from the same series in a single scrape. #221
• MON-3914: [bot] Bump openshift/prometheus to v2.53.1 #215
• OCPBUGS-37370: backport of upstream fix #216
• OCPBUGS-37244: [bot] Bump openshift/prometheus to v2.53.1 #211
• OCPBUGS-35483: cherry-pick upstream fix to make PrometheusRemoteWriteBehind fire when remote endpoint is never reached. #213
• OCPBUGS-36768: cherry-pick upstream remote-write fix #210
• MON-3914: [bot] Bump openshift/prometheus to v2.53.0 #208
• MON-3914: [bot] Bump openshift/prometheus to v2.53.0 #206
• OCPBUGS-34264: Updating golang-github-prometheus-prometheus-container image to be consistent with ART for 4.17 #205
• Full changelog

prometheus-alertmanager

• NO-JIRA: synchronize OWNERS with main #196
• OCPBUGS-103294: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #173
• OCPBUGS-98167: bump github.com/hashicorp/memberlist to a forked version #166
• OCPBUGS-100356: Set testdata CA expiry to 20 years from issue date (#4112) #151
• OCPBUGS-75885: Include go-verify-deps expected files in gitignore #115
• append .0 to go.mod version #102
• OCPBUGS-34297: Updating golang-github-prometheus-alertmanager-contain… #93
• OCPBUGS-33686: [bot] Bump openshift/prometheus-alertmanager to v0.27.0 #90
• Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

• NO-ISSUE: synchronize OWNERS from main branch #416
• OCPBUGS-103296, OCPBUGS-103297: [release-4.17] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #399
• OCPBUGS-77452: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #369
• OCPBUGS-58408: Fix: One Alertmanager Config failing blocks all others. (#6585) #336
• OCPBUGS-48069: fix: validate smtp smarthost and smtp from fields #323
• OCPBUGS-38398: feat: sync proxy settings in Alertmanager configuration #296
• MON-3947: Bump openshift/prometheus-operator to v0.75.2 #294
• MON-3889: [bot] Bump openshift/prometheus-operator to v0.74.0 #287
• OCPBUGS-34153, OCPBUGS-34308, OCPBUGS-34459: Updating prometheus-operator-container image to be consistent with ART for 4.17 #293
• OCPBUGS-34308: Updating prometheus-config-reloader-container image to be consistent with ART for 4.17 #289
• OCPBUGS-34153: Updating prometheus-operator-admission-webhook-container image to be consistent with ART for 4.17 #288
• Full changelog

prometheus-node-exporter

• OCPBUGS-103292: Use patched x/net fork v0.35.0-sec.4 #195
• NO-ISSUE: synchronize OWNERS from main branch [release-4.17] #212
• append .0 to go.mod version #167
• MON-3949: [bot] Bump openshift/node_exporter to v1.8.2 #149
• OCPBUGS-34124: Updating golang-github-prometheus-node_exporter-container image to be consistent with ART for 4.17 #148
• MON-3882: [bot] Bump openshift/node_exporter to v1.8.1 #146
• OCPBUGS-34124: Updating golang-github-prometheus-node_exporter-container image to be consistent with ART for 4.17 #147
• Full changelog

route-controller-manager

• OCPBUGS-103135: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #111
• OCPBUGS-80022: Bump google.golang.org/grpc to v1.79.3 #86
• OCPBUGS-55943: Added error event for failed ingress to route conversion #60
• OCPBUGS-53077: ingress: Reset metrics when ingress is deleted #57
• WRKLDS-1292: bump(k8s.io)=1.30.1 #44
• OCPBUGS-34146: Updating ose-route-controller-manager-container image to be consistent with ART for 4.17 #43
• OCPBUGS-34146: Updating ose-route-controller-manager-container image to be consistent with ART for 4.17 #42
• Full changelog

service-ca-operator

• OCPBUGS-68220: Update logrus to 1.9.3 to address CVE-2025-65637 #316
• Fix for OCPBUGS-68221: CVE-2025-65637 bump github.com/sirupsen/logrus to v1.9.3 #309
• append .0 to go.mod version #266
• OCPBUGS-34228: Updating ose-service-ca-operator-container image to be consistent with ART for 4.17 #261
• NO-JIRA: fix outdated doc links #241
• Full changelog

telemeter

• OCPBUGS-81796: [release-4.17] Fix CVE-2026-34986 #597
• OCPBUGS-80159: Bump google.golang.org/grpc to v1.79.3 #600
• ART-13124: Update go.mod to include patch version in go directive #562
• OCPBUGS-33285: Add metricsclient_http_requests_total metric #500
• MON-3890: add recording rule acm_capacity_effective_cpu_cores #534
• OCPBUGS-34833: fix issuer check during JWT authentication #536
• OCPBUGS-34431: Updating telemeter-container image to be consistent with ART for 4.17 #533
• OCPBUGS-34039: Updating telemeter-container image to be consistent with ART for 4.17 #532
• Full changelog

tests

• OCPBUGS-130857: stage the creation of test pods to minimize etcd impact #31741
• OCPBUGS-65492: Add imagestream update dryrun test #30479
• OCPBUGS-64927: update telemtery limit for 4.17 e2e case #30472
• OCPBUGS-64641: Migrate OCP-32383 to upstream #30455
• OCPBUGS-63392: Backport pr 29834 to release-4.18 #30408
• OCPBUGS-61162: images/tests: Remove rteval #30202
• NO-JIRA: Update extended/networking OWNERS #30090
• OCPBUGS-57324: Fix bearer token exposure in exit condition as well #29910
• OCPBUGS-57888: Bump to Kubernetes v1.30.14 #29983
• OCPBUGS-50664: Replace RunHostCmd with Exec function to censor bearer token being exposed #29539
• OCPBUGS-56221: aws/edge: prevent test using unschedulable nodes #29792
• OCPBUGS-55451: support provider type external #29737
• OCPBUGS-55269: Bump to Kubernetes v1.30.12 #29771
• OCPBUGS-55498: [build] Ensure Git Clone Does Not Run Privileged #29743
• OCPBUGS-54767: Fix egress firewall tests by updating the URL from docs.openshift.com to redhat.com #29660
• OCPBUGS-52580: Use payload pullspec for image info test #29588
• OCPBUGS-38835: Try also user CA for getting openshift-tests image #29029
• OCPBUGS-49411: Add a monitor test to detect concurrent installer pod or static pod #29487
• OCPBUGS-48634: Revert “[release-4.17] OCPBUGS-48459, SDN-4930: ovn-k, udn crd e2e: Fix status report consumer assertion” #29453
• OCPBUGS-48459, SDN-4930: ovn-k, udn crd e2e: Fix status report consumer assertion #29301
• OCPBUGS-48345: Add team members to the OWNERS file for PR approvals #29430
• OCPBUGS-48188: Fixing build s2i ruby test data inline with latest ruby version(>=3.0) #29409
• : OCPBUGS-48093: fix unit test for compare against string #29405
• OCPBUGS-44190: Fix UnexpectedNodeNotReady and UnexpectedNodeUnreachable #29306
• OCPBUGS-43576, SDN-4930: Don’t modify pod routes in tests #29250
• OCPBUGS-43576, SDN-4930: Set startup probe for UDN tests #29244
• OCPBUGS-43576, SDN-4930: UserDefinedPrimaryNetworks: curl the KAPI IP through eth0 #29241
• OCPBUGS-44795: fix: adding oslat updates and outputting test results to the artifacts #29193
• OCPBUGS-43576, SDN-4930: network_segmentation: allow multiple UDN status conditions #29259
• OCPBUGS-44494: removing rteval from the realtime test suite #29194
• OCPBUGS-44496: fix: adding in a SNO time override for AWS Metal #29192
• OCPBUGS-44062: Adjust createDNSPod() to support hypershift dual-stack test #29254
• OCPBUGS-44045: Ignore infra nodes on tap cni tests #29251
• OCPBUGS-43569: feat: update to use pullspec image #29207
• OCPBUGS-43576: Porting testing for netConfig and UDN and CIDR overlapping tests from upstream #29181
• OCPBUGS-39606: Add image registry capability check #29174
• OCPBUGS-42814: ruby:3.0-ubi8 => ruby:3.1-ubi8 #29162
• OCPBUGS-42336: Fix image ecosystem tests 4.17 #29126
• OCPBUGS-41817: Update the NotFound case for CNI plugin to reflect changes #29091
• OCPBUGS-39134: Bump timeout for the pod-network-service endpoints check #29051
• OCPBUGS-38674: add unexpected ready for monitor tests #29021
• OCPBUGS-39254: Change Operator Installed for Smoke Test #29055
• OCPBUGS-39031: kube-apiserver rollout: wait for stability before exiting #29047
• OCPBUGS-38446: NetworkSegmentation tests: fix the IPv6 node IP detection #29005
• NO-JIRA: create a test that repeatedly rolls out the kube-apiserver and uses m… #28986
• NO-JIRA: drop ocp-storage exceptions for termination policy #28793
• STOR-1819: Add OpenShift specific CSI certification test #28967
• TRT-1723: riskanalysis: pass along errors from API request #28984
• SDN-4919: NetworkSegmentation: Add tests for EndpointSlices mirror controller #28945
• OCPEDGE-1033: fix: making oslat test more dynamic to handle different cpu sets #28980
• OCPEDGE-1182: fix: remove un-needed test #28979
• TRT-1688: Revert “allow etcd log test to flake under vsphere” #28978
• OCPBUGS-37837: vertical scaling test should not rely on CPMS replicas #28969
• OCPBUGS-37986: Revert #28944 “ Reapply \“Merge pull request #28277 from vrutkovs/in-cluster-fixes-v3\ #28977
• IR-471: Skipping chunksizemib tests #28975
• OCPBUGS-37245: Ignore pod sandbox adds expected to fail #28973
• OCPBUGS-18865: Reapply “Merge pull request #28277 from vrutkovs/in-cluster-fixes-v3” #28944
• NO-JIRA: Disable:Broken for [sig-builds][Feature:Builds][Slow] can use private repositories as build input build using an HTTP token should be able to clone source code via an HTTP token [apigroup:build.openshift.io] #28968
• NO-JIRA: riskanalysis: improve request retries #28961
• SDN-4919: Skip network segmentation tests #28964
• NO-ISSUE: Automated - Update synthetic test data #28954
• OCPBUGS-37675: Add a version command to openshift-tests #28960
• NO-ISSUE: Use external binary name on retry #28955
• OCPBUGS-35880: fix pod not returning success on ‘Managed cluster should verify that nodes have no unexpected reboots’ #28953
• OCPEDGE-1181: bump(ocp/k8s): updating to pull in annotation fix for SNO conformance test #28948
• IR-471: Updating the test with skipper function #28947
• no-jira: e2e: mark tests as [apigroup:apps.openshift.io] dependent #28951
• NO-JIRA: Revert “pathologicalevents: Ignore leaky RecreatingTerminatedPod” #28950
• SDN-5133: Add udn test framework #28933
• NO-ISSUE: Automated - Update synthetic test data #28914
• OCPBUGS-37436: increase telemetry series permitted avg threshold #28943
• TRT-1702: record risk analysis results in BQ #28926
• OCPBUGS-37411: Revert #28277 “OCPBUGS-18865: add monitortest: in-cluster disruption monitors” #28942
• no-jira: e2e: check for deployer RB only when DeploymentConfig is enabled #28941
• no-jira: e2e: check for deployer SA only when DeploymentConfig is enabled #28939
• OCPBUGS-18865: add monitortest: in-cluster disruption monitors #28277
• OCPBUGS-36742: Sync imports #28929
• OCPEDGE-1125: upkeep: add better logging for crio failures #28852
• NO-JIRA: egressfirewall: skip ping tests in case of hypershift kubevirt on Azure infra #28916
• IR-471: Add test for ChunkSizeMiB configuration for Registry #28932
• STOR-1961: Fix vSphereDriverConfiguration tests #28936
• NO-JIRA: Fail on APIs removed in the next release #28240
• OCPBUGS-36672: Shorten stabilization time for etcd profiles test #28930
• API-1802: watchevents: add cert rotation events #28639
• OCPBUGS-34902: Revert “NO-JIRA: test: skip crio test for rt runs” #28918
• OCPBUGS-36403: test/extended/util/openshift/clusterversionoperator/adminack: No nested framework.Fail #28917
• NO-JIRA: Always try to pull the the in-cluster test binary #28900
• NO-JIRA: fix: update skip logic for watchdog #28920
• ETCD-611: update cert rotation tests #28890
• Use ephemeral cluster docker config.json for test binary extraction #28873
• OCPBUGS-36263: Expand allowance for kubelet metrics api endpoint outages during node upgrades #28911
• USHIFT-3455: Skip legacy-etcd monitor tests in microshift #28874
• OCPEDGE-800: feat: add SNO upgrade consideration during pathological errors #28903
• OCPBUGS-34475: remove unused in-cluster monitoring code #28908
• OCPBUGS-36187: Revert #28515 Re-enable test/extended/router/http2 tests on AWS” #28905
• OCPBUGS-33486: Removes dependency on samples operator images #28840
• OCPBUGS-26601: Re-enable test/extended/router/http2 tests on AWS #28515
• NO-ISSUE: Automated - Update synthetic test data #28897
• TRT-1718: Add new intervals for kubelet metrics endpoints down #28896
• NO-JIRA: Add display flag to the primary EtcdLeadership intervals #28861
• OCPEDGE-1157: fix: resolve serial operator availability #28893
• OCPBUGS-35535: add Proxy config #28880
• Revert “TRT-1691: Revert #28735 “TRT-1576: Fail if operator has Available=False unless in upgrade window”” #28851
• USHIFT-3455: Add apigroup to skip a FeatureGate test in MicroShift #28875
• NO-ISSUE: fix the node reboot test to actually run #28884
• ETCD-578: Fix etcd profiles e2e test to check returned status for upd… #28836
• NO-JIRA: use lib-go version of the markdown interface #28707
• ETCD-606: Open up the RequiredInstallerResourcesMissing test to more resources. #28866
• OCPBUGS-34448: monitortestframework: unsupported monitors should warn, not error #28865
• OCPBUGS-34468: art consistency openshift 4.17 openshift enterprise tests custom #28876
• trt-1689: Filter must-gather and truncate system node users #28856
• API-1783: bump(k8s.io/kubernetes) #28869
• NO-ISSUE: Automated - Update synthetic test data #28867
• API-1783: Rebase 1.30 #28829
• OCPBUGS-33497: Add a “limit” exception for iptables-alerter #28858
• TRT-1688: allow test to flake under vsphere #28855
• NO-JIRA: test: skip crio test for rt runs #28854
• API-1783: Conditionally skip tests to help with k8s 1.30 #28850
• STOR-1839: correct feature gate annotation for vsphere snapshot test #28846
• OCPBUGS-34666: Update etcd test data for 1.30 release #28843
• TRT-1691: Revert #28735 “TRT-1576: Fail if operator has Available=False unless in upgrade window” #28847
• TRT-1576: Fail if operator has Available=False unless in upgrade window #28735
• TRT-1218: Add the display flag for interval Sources that should have them #28816
• TRT-1686: Reduce logging of podspec in the PodsStreamer #28833
• OCPBUGS-34403: Only look for thanos connections to platform monitoring stack #28825
• NO-ISSUE: Automated - Update synthetic test data #28811
• OCPBUGS-34346: Regenerate TLS info #28657
• API-1783: Conditionally skip tests to help with k8s 1.30 #28832
• ETCD-565: add manual etcd signer cert rotation e2e test #28684
• TRT-1653: Fix regexes for now quoted podUID in system journal log parsing #28804
• ETCD-578: remove Tech Preview check from etcd profiles e2e test #28817
• OCPBUGS-33944: Fix regex parser for censoring private key #28813
• NO-JIRA: fix: update test to use IsSingleNode func #28801
• NO-JIRA: Drop Cluster Infra related exceptions from termination message policy tests #28798
• API-1783: Conditionally skip tests to help with k8s 1.30 #28814
• CFE-853: e2e test case for DNSNameResolver and EgressFirewall integration #28683
• NO-JIRA: quota.sh: 4.16 no longer creates legacy API tokens #28808
• And 1 elided commits (e.g. from squash or rebase merges)
• Full changelog

thanos

• OCPBUGS-80161: Bump google.golang.org/grpc to v1.79.3 #185
• append .0 to go.mod version #161
• OCPBUGS-34088: Updating ose-thanos-container image to be consistent with ART for 4.17 #148
• MON-3887: [bot] Bump openshift/thanos to v0.35.1 #147
• Full changelog

vsphere-cloud-controller-manager

• OCPBUGS-103318: Replace golang.org/x/net with sustaining fork for CVE-2026-33814 in 4.17 #136
• OCPBUGS-78027: hermetic migration 4.17 #106
• OCPBUGS-43432: update check-fmt goimports command #78
• OCPBUGS-37661: Bump otelgrpc to v0.53.0 #74
• NO-JIRA: Update OWNERS #69
• OCPBUGS-34626, OCPCLOUD-2605: Merge https://github.com/kubernetes/cloud-provider-vsphere:master (b087162) into master #62
• Full changelog

vsphere-cluster-api-controllers

• OCPBUGS-80165: Bump google.golang.org/grpc to v1.79.3 #105
• OCPBUGS-78019: hermetic migration 4.17 #85
• OCPBUGS-61652: Fix unit tests #71
• NO-JIRA: Update OWNERS #47
• OCPBUGS-34179, OCPCLOUD-2623: Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.10.0 (41eeb09) into master #44
• And 1 elided commits (e.g. from squash or rebase merges)
• Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

• OCPBUGS-92391: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.6 #232
• OCPBUGS-103314, OCPBUGS-103319: Use patched x/net fork v0.35.0-sec.4 #209
• OCPBUGS-92852: Bump golang.org/x/crypto/ssh to v0.33.0-sec.3 #194
• OCPBUGS-80168: Bump google.golang.org/grpc #177
• OCPBUGS-68224: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #157
• OCPBUGS-43705: redact sensitive information when logging VCenter config #133
• OCPBUGS-34114: Updating vmware-vsphere-syncer-container image to be consistent with ART for 4.17 #125
• OCPBUGS-34099: Updating ose-vmware-vsphere-csi-driver-container image to be consistent with ART for 4.17 #124
• STOR-1600: Rebase against v3.2.0 #122
• Full changelog

vsphere-csi-driver-operator

• OCPBUGS-103315: Bump golang.org/x/net to v0.35.0-sec.3 #357
• OCPBUGS-52207: fix panic when vcenter address is incorrect #295
• OCPBUGS-50593: Set reconcile-sync to 10 minute for ListVolume #291
• OCPBUGS-49858: Escape backslash in vCenter username #288
• OCPBUGS-49685: List only linux nodes #285
• OCPBUGS-43778: Fix panic on nil infrastructure Spec.PlatformSpec.VSphere #264
• OCPBUGS-42327: Fix the config loading warning #259
• OCPBUGS-42007: Remove conditions and controllers #254
• OCPBUGS-42006: Add check for vCenter version #253
• OCPBUGS-42008: Implement minor quality of life improvements. #255
• OCPBUGS-38442: Restart CSI driver controller pod on config change #247
• OCPBUGS-37772: Disable CSI migration in multi-vCenter cluster #243
• SPLAT-1637: Initial changes for multi vcenter support. #228
• STOR-1593: Disable toplogy feature explicitly #241
• STOR-1949: Add cns migration #242
• STOR-1596: Bump all deps for 4.17 #236
• STOR-1767: Delete resources if spec.ManagementState is equal to Removed for removable CSI drivers #233
• OCPBUGS-37201: Make sure credentials are wrapped in double quotes #239
• OCPBUGS-37201: Ignore comment symbols when reading the ini file #238
• STOR-1290: don’t pass credentials via environment variables in vSphere #227
• OCPBUGS-34234: Updating ose-vmware-vsphere-csi-driver-operator-container image to be consistent with ART for 4.17 #232
• Full changelog

vsphere-problem-detector

• OCPBUGS-103317: Bump golang.org/x/net to v0.35.0-sec.4 #234
• OCPBUGS-84085: fix concurrent map writes #216
• OCPBUGS-61755: Check for number of FailureDomain-s in GetVCenter() #190
• SPLAT-1658: Add multi vCenter support #158
• STOR-1767: Silence vsphere-problem-detector if State is Removed #169
• STOR-1767: Make checks less frequent if State is Removed in ClusterCSIDriver #166
• STOR-1596: Bump all deps for 4.17 #163
• OCPBUGS-34563: Drop event when CheckDefaultDatastore fails #165
• OCPBUGS-34176: Updating ose-vsphere-problem-detector-container image to be consistent with ART for 4.17 #164
• OCPBUGS-35215: Fix missing failure-domains #159
• Full changelog

---

View changelog in Markdown or change previous release: 4.17.0-0.nightly-multi-2026-11-06-1754244.17.0-0.nightly-multi-2026-11-02-2333584.17.0-0.nightly-multi-2026-11-02-0346254.17.0-0.nightly-multi-2026-10-31-2320024.17.0-0.nightly-multi-2026-10-31-1120024.17.0-0.nightly-multi-2026-10-19-2247134.17.0-0.nightly-multi-2026-10-16-025809───5.1.0-0.nightly-multi-2026-11-09-1434475.1.0-0.nightly-multi-2026-11-09-0708375.1.0-0.nightly-multi-2026-11-09-0009045.1.0-0.nightly-multi-2026-11-08-1736485.1.0-0.nightly-multi-2026-11-08-1153525.1.0-0.nightly-multi-2026-11-08-0531535.1.0-0.nightly-multi-2026-11-03-0812285.1.0-0.nightly-multi-2026-08-10-113053───5.0.0-0.nightly-multi-2026-11-09-0456115.0.0-0.nightly-multi-2026-11-08-1826345.0.0-0.nightly-multi-2026-11-08-1222055.0.0-0.nightly-multi-2026-11-08-0432135.0.0-0.nightly-multi-2026-11-07-1827185.0.0-0.nightly-multi-2026-11-07-0840535.0.0-0.nightly-multi-2026-08-09-1858125.0.0-0.nightly-multi-2026-07-09-124132───4.23.0-0.nightly-multi-2026-11-09-1308034.23.0-0.nightly-multi-2026-11-08-1308034.23.0-0.nightly-multi-2026-11-07-1308034.23.0-0.nightly-multi-2026-11-06-1308034.23.0-0.nightly-multi-2026-11-03-2244394.23.0-0.nightly-multi-2026-11-01-2244394.23.0-0.nightly-multi-2026-10-21-2008084.23.0-0.nightly-multi-2026-10-02-063617───4.22.0-0.nightly-multi-2026-11-09-1324444.22.0-0.nightly-multi-2026-11-09-0337094.22.0-0.nightly-multi-2026-11-08-1744374.22.0-0.nightly-multi-2026-11-08-0944374.22.0-0.nightly-multi-2026-11-08-0144374.22.0-0.nightly-multi-2026-11-07-1744374.22.0-0.nightly-multi-2026-07-08-1924364.22.0-0.nightly-multi-2026-07-06-135903───4.21.0-0.nightly-multi-2026-11-06-1246084.21.0-0.nightly-multi-2026-11-06-0046084.21.0-0.nightly-multi-2026-11-05-1104374.21.0-0.nightly-multi-2026-11-04-2304374.21.0-0.nightly-multi-2026-11-02-0219304.21.0-0.nightly-multi-2026-10-30-2318484.21.0-0.nightly-multi-2026-10-29-2318484.21.0-0.nightly-multi-2026-10-15-031607───4.20.0-0.nightly-multi-2026-11-06-1203294.20.0-0.nightly-multi-2026-11-06-0003294.20.0-0.nightly-multi-2026-11-04-2217454.20.0-0.nightly-multi-2026-11-02-0228144.20.0-0.nightly-multi-2026-10-30-1747214.20.0-0.nightly-multi-2026-10-30-0547214.20.0-0.nightly-multi-2026-10-25-1418424.20.0-0.nightly-multi-2026-09-13-024541───4.19.0-0.nightly-multi-2026-11-06-0336344.19.0-0.nightly-multi-2026-11-04-2122554.19.0-0.nightly-multi-2026-11-02-0221484.19.0-0.nightly-multi-2026-10-30-1616574.19.0-0.nightly-multi-2026-10-30-0416574.19.0-0.nightly-multi-2026-10-29-1616574.19.0-0.nightly-multi-2026-10-15-0131224.19.0-0.nightly-multi-2026-10-12-135617───4.18.0-0.nightly-multi-2026-11-07-0402314.18.0-0.nightly-multi-2026-11-06-1602314.18.0-0.nightly-multi-2026-11-06-0402314.18.0-0.nightly-multi-2026-11-05-1223164.18.0-0.nightly-multi-2026-11-05-0020214.18.0-0.nightly-multi-2026-11-04-0632304.18.0-0.nightly-multi-2026-11-03-1832304.18.0-0.nightly-multi-2026-10-19-222908───4.16.0-0.nightly-multi-2026-11-08-1315014.16.0-0.nightly-multi-2026-11-08-0115014.16.0-0.nightly-multi-2026-11-07-1315014.16.0-0.nightly-multi-2026-11-07-0115014.16.0-0.nightly-multi-2026-11-06-1315014.16.0-0.nightly-multi-2026-11-05-2345434.16.0-0.nightly-multi-2026-11-04-0252244.16.0-0.nightly-multi-2026-10-29-182735───4.15.0-0.nightly-multi-2026-11-09-1624134.15.0-0.nightly-multi-2026-11-08-1250284.15.0-0.nightly-multi-2026-11-07-0607594.15.0-0.nightly-multi-2026-11-06-1807594.15.0-0.nightly-multi-2026-11-06-0607594.15.0-0.nightly-multi-2026-11-05-1807594.15.0-0.nightly-multi-2026-11-03-0811154.15.0-0.nightly-multi-2026-11-02-181748───4.14.0-0.nightly-multi-2026-11-09-0832104.14.0-0.nightly-multi-2026-11-08-2032104.14.0-0.nightly-multi-2026-11-08-0832104.14.0-0.nightly-multi-2026-11-07-2032104.14.0-0.nightly-multi-2026-11-07-0832104.14.0-0.nightly-multi-2026-11-06-2032104.14.0-0.nightly-multi-2026-11-04-0413284.14.0-0.nightly-multi-2026-11-02-031113───4.13.0-0.nightly-multi-2024-11-20-0737144.13.0-0.nightly-multi-2024-11-19-0923484.13.0-0.nightly-multi-2024-11-18-0413024.13.0-0.nightly-multi-2024-11-14-2200024.13.0-0.nightly-multi-2024-11-14-1508494.13.0-0.nightly-multi-2024-11-14-064808───4.12.0-0.nightly-multi-2024-07-22-0956144.12.0-0.nightly-multi-2024-07-20-0422324.12.0-0.nightly-multi-2024-07-19-2153184.12.0-0.nightly-multi-2024-07-19-0647394.12.0-0.nightly-multi-2024-07-18-1317554.12.0-0.nightly-multi-2024-07-18-041245───4.11.0-0.nightly-multi-2024-08-24-0116374.11.0-0.nightly-multi-2024-07-27-0120154.11.0-0.nightly-multi-2024-07-06-0140494.11.0-0.nightly-multi-2024-07-01-0854224.11.0-0.nightly-multi-2024-04-20-0926484.11.0-0.nightly-multi-2024-04-20-075713───5.0.15.0.05.0.0-rc.85.0.0-rc.75.0.0-rc.65.0.0-rc.55.0.0-rc.45.0.0-rc.35.0.0-rc.25.0.0-rc.15.0.0-rc.0───4.22.224.22.214.22.204.22.194.22.184.22.174.22.164.22.154.22.144.22.134.22.124.22.114.22.104.22.94.22.84.22.74.22.64.22.54.22.44.22.34.22.24.22.14.22.04.22.0-rc.54.22.0-rc.44.22.0-rc.34.22.0-rc.24.22.0-rc.14.22.0-rc.04.21.424.21.414.21.404.21.394.21.384.21.374.21.364.21.354.21.344.21.334.21.324.21.314.21.304.21.294.21.284.21.274.21.264.21.254.21.244.21.234.21.224.21.214.21.204.21.194.21.184.21.174.21.164.21.154.21.144.21.134.21.124.21.114.21.104.21.94.21.84.21.74.21.64.21.54.21.44.21.34.21.24.21.14.21.04.21.0-rc.24.21.0-rc.14.21.0-rc.04.20.464.20.454.20.444.20.434.20.424.20.414.20.404.20.394.20.384.20.374.20.364.20.354.20.344.20.334.20.324.20.314.20.304.20.294.20.284.20.274.20.264.20.254.20.244.20.234.20.224.20.214.20.204.20.194.20.184.20.174.20.164.20.154.20.144.20.134.20.124.20.114.20.104.20.94.20.84.20.64.20.54.20.44.20.34.20.24.20.14.20.04.20.0-rc.34.20.0-rc.24.20.0-rc.14.20.0-rc.04.19.554.19.544.19.534.19.524.19.514.19.504.19.494.19.484.19.474.19.464.19.454.19.444.19.434.19.424.19.414.19.404.19.394.19.384.19.374.19.364.19.354.19.344.19.334.19.324.19.314.19.304.19.294.19.284.19.274.19.264.19.254.19.244.19.234.19.224.19.214.19.204.19.194.19.184.19.174.19.164.19.154.19.144.19.134.19.124.19.114.19.104.19.94.19.84.19.74.19.64.19.54.19.44.19.34.19.24.19.14.19.04.19.0-rc.54.19.0-rc.44.19.0-rc.34.19.0-rc.24.19.0-rc.14.19.0-rc.04.18.604.18.594.18.584.18.574.18.564.18.554.18.544.18.534.18.524.18.514.18.504.18.494.18.484.18.474.18.464.18.454.18.444.18.434.18.424.18.414.18.404.18.394.18.384.18.374.18.364.18.354.18.344.18.334.18.324.18.314.18.304.18.294.18.284.18.274.18.264.18.254.18.244.18.234.18.224.18.214.18.204.18.194.18.184.18.174.18.164.18.154.18.144.18.134.18.124.18.114.18.104.18.94.18.84.18.74.18.64.18.54.18.44.18.34.18.24.18.14.18.04.18.0-rc.104.18.0-rc.94.18.0-rc.84.18.0-rc.74.18.0-rc.64.18.0-rc.54.18.0-rc.44.18.0-rc.34.18.0-rc.24.18.0-rc.14.18.0-rc.04.17.604.17.594.17.584.17.574.17.564.17.554.17.544.17.534.17.524.17.514.17.504.17.494.17.484.17.474.17.464.17.454.17.444.17.434.17.424.17.414.17.404.17.394.17.384.17.374.17.364.17.354.17.344.17.334.17.324.17.314.17.304.17.294.17.284.17.274.17.264.17.254.17.244.17.234.17.224.17.214.17.204.17.194.17.184.17.174.17.164.17.154.17.144.17.134.17.124.17.114.17.104.17.94.17.84.17.74.17.64.17.54.17.44.17.34.17.24.17.14.17.04.17.0-rc.64.17.0-rc.54.17.0-rc.44.17.0-rc.34.17.0-rc.24.17.0-rc.14.17.0-rc.04.16.754.16.744.16.734.16.724.16.714.16.704.16.694.16.684.16.674.16.664.16.654.16.644.16.634.16.624.16.614.16.604.16.594.16.584.16.574.16.564.16.554.16.544.16.534.16.524.16.514.16.504.16.494.16.484.16.474.16.464.16.454.16.444.16.434.16.424.16.414.16.404.16.394.16.384.16.374.16.364.16.354.16.344.16.334.16.324.16.314.16.304.16.294.16.284.16.274.16.264.16.254.16.244.16.234.16.214.16.204.16.194.16.184.16.174.16.164.16.154.16.144.16.134.16.124.16.114.16.104.16.94.16.84.16.74.16.64.16.54.16.44.16.34.16.24.16.14.16.04.16.0-rc.94.16.0-rc.84.16.0-rc.74.16.0-rc.64.16.0-rc.54.16.0-rc.44.16.0-rc.34.16.0-rc.24.16.0-rc.14.16.0-rc.04.15.714.15.704.15.694.15.684.15.674.15.664.15.654.15.644.15.634.15.624.15.614.15.604.15.594.15.584.15.574.15.564.15.554.15.544.15.534.15.524.15.514.15.504.15.494.15.484.15.474.15.464.15.454.15.444.15.434.15.424.15.414.15.404.15.394.15.384.15.374.15.364.15.354.15.344.15.334.15.324.15.314.15.304.15.294.15.284.15.274.15.264.15.254.15.244.15.234.15.224.15.214.15.204.15.194.15.184.15.174.15.164.15.154.15.144.15.134.15.124.15.114.15.104.15.94.15.84.15.74.15.64.15.54.15.44.15.34.15.24.15.14.15.04.15.0-rc.84.15.0-rc.74.15.0-rc.54.15.0-rc.44.15.0-rc.34.15.0-rc.24.15.0-rc.14.15.0-rc.04.14.784.14.774.14.764.14.754.14.744.14.734.14.724.14.714.14.704.14.694.14.684.14.674.14.664.14.654.14.644.14.634.14.624.14.614.14.604.14.594.14.584.14.574.14.564.14.554.14.544.14.534.14.524.14.514.14.504.14.494.14.484.14.474.14.464.14.454.14.444.14.434.14.424.14.414.14.404.14.394.14.384.14.374.14.364.14.354.14.344.14.334.14.324.14.314.14.304.14.294.14.284.14.274.14.264.14.254.14.244.14.234.14.224.14.214.14.204.14.194.14.184.14.174.14.164.14.154.14.144.14.134.14.124.14.114.14.104.14.94.14.84.14.74.14.64.14.54.14.44.14.34.14.24.14.14.14.04.14.0-rc.74.14.0-rc.64.14.0-rc.54.14.0-rc.44.14.0-rc.34.14.0-rc.24.14.0-rc.14.14.0-rc.04.13.534.13.524.13.514.13.504.13.494.13.484.13.474.13.464.13.454.13.444.13.434.13.424.13.414.13.404.13.394.13.384.13.374.13.364.13.354.13.344.13.334.13.324.13.314.13.304.13.294.13.284.13.274.13.264.13.254.13.244.13.234.13.224.13.214.13.204.13.194.13.184.13.174.13.164.13.154.13.144.13.134.13.124.13.114.13.104.13.94.13.84.13.74.13.64.13.54.13.44.13.34.13.24.13.14.13.04.13.0-rc.84.13.0-rc.74.13.0-rc.64.13.0-rc.54.13.0-rc.44.13.0-rc.34.13.0-rc.24.13.0-rc.04.12.614.12.604.12.594.12.584.12.574.12.564.12.554.12.544.12.534.12.524.12.514.12.504.12.494.12.484.12.474.12.464.12.454.12.444.12.434.12.424.12.414.12.404.12.394.12.384.12.374.12.364.12.354.12.344.12.334.12.324.12.314.12.304.12.294.12.284.12.274.12.264.12.254.12.244.12.234.12.224.12.214.12.204.12.194.12.184.12.174.12.164.12.154.12.144.12.134.12.124.12.114.12.104.12.94.12.84.12.74.12.64.12.54.12.44.12.34.12.24.12.14.12.04.12.0-rc.84.12.0-rc.74.12.0-rc.64.12.0-rc.54.12.0-rc.44.12.0-rc.34.12.0-rc.24.12.0-rc.14.12.0-rc.04.11.59-multi4.11.58-multi4.11.57-multi4.11.56-multi4.11.55-multi4.11.54-multi4.11.53-multi4.11.52-multi4.11.51-multi4.11.50-multi4.11.49-multi4.11.48-multi4.11.47-multi4.11.46-multi4.11.45-multi4.11.44-multi4.11.43-multi4.11.42-multi4.11.41-multi4.11.40-multi4.11.39-multi4.11.38-multi4.11.37-multi4.11.36-multi4.11.35-multi4.11.34-multi4.11.33-multi4.11.32-multi4.11.31-multi4.11.30-multi4.11.29-multi4.11.28-multi4.11.27-multi4.11.26-multi4.11.25-multi4.11.24-multi4.11.23-multi4.11.22-multi4.11.21-multi4.11.20-multi4.11.19-multi4.11.18-multi4.11.17-multi4.11.16-multi4.11.14-multi4.11.13-multi4.11.12-multi4.11.11-multi4.11.10-multi4.11.9-multi4.11.8-multi4.11.7-multi4.11.6-multi4.11.5-multi4.11.4-multi4.11.2-multi4.11.1-multi4.11.0-multi-rc.74.11.0-multi-rc.64.11.0-multi───4.23.0-ec.24.23.0-ec.14.23.0-ec.0───5.1.0-ec.25.1.0-ec.15.1.0-ec.0

Source code for this page located on github