4.20.46

PullSpec:

quay.io/openshift-release-dev/ocp-release:4.20.46-multi

Qualifiers (status api): None

Tests:

Informing jobs
- e2e-aws-ovn-multi-a-a Succeeded periodic-ci-openshift-multiarch-main-nightly-4.20-ocp-e2e-aws-ovn-multi-a-a
- e2e-aws-ovn-multi-x-x Succeeded periodic-ci-openshift-multiarch-main-nightly-4.20-ocp-e2e-aws-ovn-multi-x-x
- hypershift-e2e-aks-multi-x-ax Failed (1 retry) periodic-ci-openshift-hypershift-release-4.20-periodics-e2e-aks-multi-x-ax
  - Attempt 1 Failed
  - Attempt 2 Failed

Upgrades from:

Untested upgrades: 4.19.15, 4.19.16, 4.19.17, 4.19.18, 4.19.19, 4.19.20, 4.19.21, 4.19.22, 4.19.23, 4.19.24, 4.19.25, 4.19.26, 4.19.27, 4.19.28, 4.19.29, 4.19.30, 4.19.31, 4.19.32, 4.19.33, 4.19.34, 4.19.35, 4.19.36, 4.19.37, 4.19.38, 4.19.39, 4.19.40, 4.19.41, 4.19.42, 4.19.43, 4.19.44, 4.19.45, 4.19.46, 4.19.47, 4.19.48, 4.19.49, 4.19.50, 4.19.51, 4.19.52, 4.19.53, 4.19.54, 4.19.55, 4.20.0, 4.20.1, 4.20.10, 4.20.11, 4.20.12, 4.20.13, 4.20.14, 4.20.15, 4.20.16, 4.20.17, 4.20.18, 4.20.19, 4.20.2, 4.20.20, 4.20.21, 4.20.22, 4.20.23, 4.20.24, 4.20.25, 4.20.26, 4.20.27, 4.20.28, 4.20.29, 4.20.3, 4.20.30, 4.20.31, 4.20.32, 4.20.33, 4.20.34, 4.20.35, 4.20.36, 4.20.37, 4.20.38, 4.20.39, 4.20.4, 4.20.40, 4.20.41, 4.20.42, 4.20.43, 4.20.44, 4.20.45, 4.20.5, 4.20.6, 4.20.8, 4.20.9

4.22.22 - Failed Failed

Loading changelog, this may take a while ...

Changes from 4.22.22

Created: 2026-11-05 22:54:00 +0000 UTC

Image Digest: sha256:1ea97e0f8c0a0b2a7df7b6246c57a84944dd31b8b89ace4cf95fff5432508d89

Release 4.20.46 was created from quay.io/openshift-release-dev/ocp-release-nightly@sha256:45b2772e6140c9c1286173389cfbc30a5f2eac0428de76b1390293955f0f96b2

Components

Kubectl upgraded from 1.35.2 to 1.33.3
Kubernetes upgraded from 1.35.9 to 1.33.13
Kubernetes Tests upgraded from 1.35.1 to 1.33.4
Red Hat Enterprise Linux CoreOS upgraded from 10.2.20261102-1 to 9.6.20261104-0

The CoreOS links above are for the base CoreOS layer used to build the OpenShift node image and do not contain OpenShift components. This is normally only useful to devs working closely with the CoreOS team. For info about the node image, see the Node Image Info section.

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	OKD Hypershift	OKD SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
AWSDualStackInstall (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
AWSEuropeanSovereignCloudInstall (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
AdditionalStorageConfig (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
AzureDualStackInstall (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
CBORServingAndStorage (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
CRDCompatibilityRequirementOperator (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
CRIOCredentialProviderConfig (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ClientsAllowCBOR (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ClientsPreferCBOR (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ClusterAPIComputeInstall (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ClusterAPIControlPlaneInstall (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ClusterAPIMachineManagement (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ClusterAPIMachineManagementAWS (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ClusterAPIMachineManagementAzure (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ClusterAPIMachineManagementBareMetal (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ClusterAPIMachineManagementGCP (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ClusterAPIMachineManagementOpenStack (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ClusterAPIMachineManagementPowerVS (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ClusterAPIMachineManagementVSphere (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ClusterUpdateAcceptRisks (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ClusterUpdatePreflight (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ConfidentialCluster (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ConfigurablePKI (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
DRAPartitionableDevices (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
EVPN (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
EventTTL (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ExternalOIDCExternalClaimsSourcing (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ExternalOIDCWithUpstreamParity (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
GCPDualStackInstall (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
GCPSovereignCloudInstall (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
HyperShiftOnlyDynamicResourceAllocation (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
KMSEncryption (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
MachineAPIMigrationAWS (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
MachineAPIMigrationOpenStack (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
MachineAPIMigrationVSphere (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ManagedBootImagesCPMS (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
MutableCSINodeAllocatableCount (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
NetworkConnect (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
NewOLMBoxCutterRuntime (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
NewOLMConfigAPI (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
NoOverlayMode (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
NoRegistryClusterInstall (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
OSStreams (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
OnPremDNSRecords (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ProvisioningRequestAvailable (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
TLSAdherence (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Not Available (Changed)	Not Available (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
BootImageSkewEnforcement (0 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Not Available (Changed)	Not Available (Changed)	Disabled (Changed)	Disabled (Changed)
VSphereMixedNodeEnv (0 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Not Available (Changed)	Not Available (Changed)	Disabled (Changed)	Disabled (Changed)
AzureClusterHostedDNSInstall (0 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Not Available (Changed)	Not Available (Changed)	Enabled	Enabled
DualReplica (5 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Not Available (Changed)	Not Available (Changed)	Enabled	Enabled
ImageStreamImportMode (4 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Not Available (Changed)	Not Available (Changed)	Enabled	Enabled
IngressControllerDynamicConfigurationManager (0 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Not Available (Changed)	Not Available (Changed)	Enabled	Enabled
InsightsConfig (0 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Not Available (Changed)	Not Available (Changed)	Enabled	Enabled
InsightsOnDemandDataGather (0 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Not Available (Changed)	Not Available (Changed)	Enabled	Enabled
SigstoreImageVerificationPKI (0 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Not Available (Changed)	Not Available (Changed)	Enabled	Enabled
VSphereHostVMGroupZonal (0 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Not Available (Changed)	Not Available (Changed)	Enabled	Enabled
AWSServiceLBNetworkSecurityGroup (0 tests)	Disabled	Disabled (Changed)	Enabled	Enabled	Not Available (Changed)	Not Available (Changed)	Enabled	Enabled
NewOLMWebhookProviderOpenshiftServiceCA (0 tests)	Disabled	Disabled (Changed)	Disabled	Enabled	Not Available (Changed)	Not Available (Changed)	Disabled	Enabled
AdditionalRoutingCapabilities (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
AdminNetworkPolicy (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
AlibabaPlatform (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
CPMSMachineNamePrefix (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
GatewayAPI (5 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
GatewayAPIController (13 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
HighlyAvailableArbiter (8 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
ImageVolume (7 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
IngressControllerLBSubnetsAWS (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
MachineConfigNodes (13 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
ManagedBootImages (5 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
ManagedBootImagesAWS (5 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
NetworkDiagnosticsConfig (6 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
NetworkLiveMigration (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
NetworkSegmentation (61 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
PinnedImages (5 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
PreconfiguredUDNAddresses (10 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
ProcMountType (1 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
RouteAdvertisements (11 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
SetEIPForNLBIngressController (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
KMSEncryptionProvider (0 tests)	Disabled	Disabled	Enabled	Enabled	Not Available (Changed)	Not Available (Changed)	Enabled (Changed)	Enabled (Changed)
DynamicResourceAllocation (47 tests)			Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
GCPClusterHostedDNS (0 tests)			Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
GCPClusterHostedDNSInstall (0 tests)			Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
InsightsConfigAPI (0 tests)			Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
ManagedBootImagesAzure (0 tests)			Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
ManagedBootImagesvSphere (6 tests)			Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
NoRegistryClusterOperations (0 tests)				Enabled (New)	Not Available (Changed)	Not Available (Changed)		Enabled (New)
NodeSwap (0 tests)			Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
TranslateStreamCloseWebsocketRequests (0 tests)			Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)
VolumeAttributesClass (50 tests)			Enabled (New)	Enabled (New)	Not Available (Changed)	Not Available (Changed)	Enabled (New)	Enabled (New)

New images

cluster-kube-cluster-api-operator git adaae0d4 sha256:bcd9ce8adb2057d66151bf7374611d34610d306dc57f3e72b1c164ab3b441be5

Removed images

aws-node-termination-handler
rhel-coreos-10
rhel-coreos-10-extensions

agent-installer-api-server

OCPBUGS-89951: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.2 #10798
OCPBUGS-105890: manifest_generator add a label to LUKS root #10803
OCPBUGS-93748: Add sourcedir /run/chrony-dhcp to generated chrony.conf #10537
OCPBUGS-81880: Mark raw FC/iSCSI multipath members as ineligible #10149
OCPBUGS-81880: Prefer multipath disk in ABI disk selection #10111
OCPBUGS-70300: Prevent race in agent-installer kubeconfig generation #8707
OCPBUGS-65901: Retry incomplete cluster registration in ABI #8429
OCPBUGS-57606: Updating ose-agent-installer-api-server-container image to be consist… #8399
OCPBUGS-63486: Align kube descheduler activation CR with OVE needs #8136
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-103794: Bump x/net to v0.35.0-sec.4 #2291
OCPBUGS-81641: fix: allow workers to join TNA cluster when 1 master + arbiter are ready #2070
Full changelog

agent-installer-node-agent

OCPBUGS-103797: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #1620
OCPBUGS-57718: Update golang images to 1.24 for OpenShift 4.20 #1194
Full changelog

agent-installer-ui

OCPBUGS-113552: Bump nanoid to >=3.3.17 in 4.20 (#4066) #4066
OCPBUGS-119962: Bump qs to >=6.16.0 in release-4.20 (#4045) #4045
OCPBUGS-104550: Bump tmp to ^0.2.6 to address CVE-2026-44705 (#4016) #4016
Update OWNERS file (#3992) #3992
OCPBUGS-100524, OCPBUGS-103012: Bump ip-address to fix CVE-2026-54272 and CVE-2026-69192 (#3988) #3988
OCPBUGS-109781: Bump tar pkg version to ^7.5.21 to address CVE-2026-73566 (#3972) #3972
ART-22057: Move @types/react-dom to dependencies in chatbot (#3958) #3958
OCPBUGS-104460: Pin minimatch to ^10.2.6 and brace-expansion to ^5.0.9 (CVE-2026-14257) (#3961) #3961
OCPBUGS-91623: Bump ws to 8.21.0 for CVE-2026-45736 (#3907) #3907
OCPBUGS-98265: Bump tar to 7.5.19 in 4.20 (#3892) #3892
Apply patches (#3876) #3876
Update OWNERS file (#3881) #3881
OCPBUGS-98429: Bump js-yaml to 4.3.0 in 4.20 (#3864) #3864
OCPBUGS-89699: bump form-data to 2.5.6 and 4.0.6 via yarn.lock patch and scoped resolution to address CVE-2026-12143 (#3879) #3879
patch CVE-2026-9277 and CVE-2026-42338 via yarn resolutions (#3854) #3854
OCPBUGS-88394, OCPBUGS-88407: Bump axios to 1.18.1 (#3859) #3859
OCPBUGS-85542: Bump msw pkg version to 2.13.5 (#3730) #3730
OCPBUGS-84606, OCPBUGS-84829, OCPBUGS-84992, OCPBUGS-85008, OCPBUGS-85010, OCPBUGS-85038: Bump axios to ^1.15.1 (#3691) #3691
Update OWNERS file (#3657) #3657
Bump happy-dom from 20.0.2 to 20.8.9 (#3526) #3526
OCPBUGS-77793: bump react-router-dom-v5-compat to ^6.30.3 to address CVE-2026-22029 (#3582) #3582
OCPBUGS-77794: upgrade lodash and lodash-es to 4.17.23 to address CVE-2025-13465 (#3546) #3546
OCPBUGS-83301: bump axios to ^1.15.0 for fixing CVE-2026-40175 (#3584) #3584
Updating assisted-installer-ui-container image to be consistent with ART for 4.20 (#3458) #3458
Add support for release branches in PR workflow (#3529) #3529
remove external platforms field from below sea level UI (#3318) #3318
Adding TechPreview Budge for Assisted installer and agent (#3296) #3296
OCPBUGS-62680: Include assisted disconnected UI image in release payload (#3188) (#3189) #3188
OCPBUGS-61953: Update dependency sourcing to remote (#3178) #3178
Full changelog

agent-installer-utils

OCPBUGS-77238: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 2f3015a #224
OCPBUGS-75868: Increase Konflux build pipeline memory #247
OCPBUGS-68324: bump github.com/sirupsen/logrus to v1.9.3 #235
OCPBUGS-69834: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 20eb21c #208
OCPBUGS-69830: Update Konflux references #207
OCPBUGS-67306: Update Konflux release version to 4.20.8 #212
OCPBUGS-66431: Add Konflux PipelineRun params required by release pipeline #206
OCPBUGS-66425: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 13cf619 #186
OCPBUGS-66422: Update Konflux references #185
OCPBUGS-66406: Update Konflux release version to 4.20.6 #204
OCPBUGS-65715: Update 4.20 version to 4.20.4 #196
OCPBUGS-64694: Update 4.20 version to 4.20.2 #193
OCPBUGS-63585: AGENT-1203: Simplify isobuilder #189
OCPBUGS-63590: Update 4.20 version to 4.20.1 #190
OCPBUGS-63372: Backport Konflux changes #183
OCPBUGS-62749: Red Hat Konflux kflux-prd-rh02 update ove-ui-iso-4-20 #172
Full changelog

aws-cluster-api-controllers

🐛 OCPBUGS-134665: UPSTREAM: 6132: Persist ProviderID immediately after instance creation #666
OCPBUGS-81942: Bump go-jose/go-jose/v4@v4.1.4 #611
OCPBUGS-103806: replace golang.org/x/net with openshift-sustaining/net v0.43.0-sec.4 for CVE-2026-33814 #650
🐛 OCPBUGS-123528: UPSTREAM: <carry>: Fix unit tests for OpenShift CI environment #638
🌱 [release-4.20] OCPBUGS-123527: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #637
OCPBUGS-61040: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.9.2 (d3a7da1) into release-4.20 #578
Full changelog

aws-ebs-csi-driver

OCPBUGS-80562: Bump google.golang.org/grpc to v1.79.3 #311
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-103853, OCPBUGS-103932, OCPBUGS-103973: replace golang.org/x/net with openshift-sustaining fork #634
OCPBUGS-103805, OCPBUGS-103816: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #612
OCPBUGS-85573: Add init container for Manila node daemonset #553
OCPBUGS-80667: Bump google.golang.org/grpc to v1.79.3 #540
OCPBUGS-74918: adds the csi-external-resizer to the image-references #529
OCPBUGS-72563: deploy prometheus role and binding on hypershift guest #491
OCPBUGS-65895: allow all-egress for efs operator #473
OCPBUGS-65686: Bump gophercloud #470
OCPBUGS-63560: Add RBAC ClusterRole and Binding for driver node #456
OCPBUGS-62688: Add withCABundleDaemonSetHook() to AWS EFS operator #441
Full changelog

aws-kms-encryption-provider

OCPBUGS-80537: Bump google.golang.org/grpc to v1.79.3 #41
OCPBUGS-78426: Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.20 #34
Full changelog

aws-machine-controllers

OCPBUGS-103908: CVE-2026-33814: Bump golang.org/x/net to openshift-sustaining/net v0.50.0-sec.4 (release-4.20) #200
OCPBUGS-103908: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 #207
OCPBUGS-72570: Fix reconciler consistency checks in Update and Exists #164
OCPBUGS-63136: client: re-use a single file for building the session instead of randomly named files #148
Full changelog

aws-pod-identity-webhook

OCPBUGS-103812: Bump golang.org/x/net to v0.50.0-sec.3 #223
OCPBUGS-74169: Fix GOTOOLCHAIN env var #212
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-103808, OCPBUGS-103983: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.3 to address CVE-2026-33814 #206
OCPBUGS-80566, OCPBUGS-80567: Bump google.golang.org/grpc to v1.79.3 #179
Full changelog

azure-cluster-api-controllers

OCPBUGS-133111: Carry VM Reapply recovery #423
OCPBUGS-103801: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 #403
OCPBUGS-89962: Address CVE-2026-39829 #399
OCPBUGS-80568: Bump google.golang.org/grpc to v1.79.3 #384
Full changelog

azure-disk-csi-driver

UPSTREAM: 3635: OCPBUGS-96365: Bump golang.org/x/net to v0.50.0-sec.4 #167
OCPBUGS-106191: UPSTREAM: 3277: fix: allow . in Azure tags #169
OCPBUGS-80569: Bump google.golang.org/grpc to v1.79.3 #140
OCPBUGS-85054: Fix dangling detaches 420 #145
OCPBUGS-78034: add instantAccessDurationMinutes parameter to enable IA snapshots for PremiumV2/UltraSSD disks #128
Full changelog

azure-file-csi-driver

OCPBUGS-103813: Bump golang.org/x/net to v0.50.0-sec.4 #156
OCPBUGS-111841: always chmod expected setgid bit in TestChmodIfPermissionMismatch #153
OCPBUGS-92939: Bump golang.org/x/crypto to v0.48.0-sec.1 #146
OCPBUGS-80572: Bump google.golang.org/grpc to v1.79.3 #128
Full changelog

azure-kms-encryption-provider

OCPBUGS-103785: [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #59
OCPBUGS-80538: Bump google.golang.org/grpc to 1.64.1-sec.1 patch #44
OCPBUGS-78423: Updating azure-kms-encryption-provider-container image to be consistent with ART for 4.20 #28
Full changelog

azure-machine-controllers

OCPBUGS-103905: replace golang.org/x/net with openshift-sustaining/net@v0.50.0-sec.4 #211
OCPBUGS-65708: Set updateDomainCount to one when faultDomainCount is one #173
OCPBUGS-63535: Support DataDisks on Azure Stack Hub #165
Full changelog

azure-service-operator

OCPBUGS-80539: Bump google.golang.org/grpc to v1.79.3 #29
Full changelog

azure-workload-identity-webhook

OCPBUGS-103815: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 #61
OCPBUGS-81944: Bump go-jose/go-jose/v4@v4.1.4 #51
OCPBUGS-86846: [release-4.20] filter out “remove” patches #49
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-87816: [release-4.20] Add omitempty to vSphere and Nutanix MachinePool slice fields #10608
OCPBUGS-133958: Update RHCOS-release-4.20 bootimage metadata to 9.6.20261027-0 #11031
SPLAT-2867: Add vSphere multi vCenter Day 2 support #10880
OCPBUGS-103817: Bump golang.org/x/net to v0.50.0-sec.4 #10942
OCPBUGS-89997, OCPBUGS-92937: Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.48.0-sec.2 #10821
OCPBUGS-100063: openstack: Reserve addresses for load balancer #10723
OCPBUGS-112324: [release-4.20]: Enrich IBI config image proxy NoProxy with cluster networks #10779
OCPBUGS-114414: Update gcloud version to one that can be found #10816
OCPBUGS-113536: Update RHCOS-release-4.20 bootimage metadata to 9.6.20260818-0 #10799
OCPBUGS-89242: Update RHCOS-release-4.20 data/data/coreos/rhcos.json to 9.6.20260616-0 #10650
OCPBUGS-86552: azure: Add field in installconfig to disallow shared access key #10575
OCPBUGS-77834: Update RHCOS-release-4.20 bootimage metadata to 9.6.20260512-0 #10580
OCPBUGS-79001: [release 4.20] - Allow all instance types in the install config for GCP #10503
OCPBUGS-78694: [release-4.20]: openstack: Disable LoadBalancer in cloud config when Octavia is unavailable #10401
OCPBUGS-79665: Use correct Project ID with GCP Shared VPC #10436
OCPBUGS-80884: [release-4.20] Add c8g* to tested_instance_types_aarch64 #10437
OCPBUGS-77896: Increase size of /var/ostreecontainer mount #10365
OCPBUGS-78091: fix wavelength zone name regex #10373
OCPBUGS-77050: Update the RHCOS 4.20 bootimage metadata to 9.6.20260217-1 #10358
OCPBUGS-74674: [release-4.20] GCP: skip AI zones #10273
OCPBUGS-74551: add support for NVIDIA H100 and H200 enabled machine series #10263
OCPBUGS-66356: Update the RHCOS 4.20 bootimage metadata to 9.6.20260112-0 #10247
OCPBUGS-73681: pkg/asset/manifests/azure: save cidr blocks #10208
OCPBUGS-73785: ensure deterministic zone ordering for control plane machines #10219
OCPBUGS-71212: Increase agent-installer pre-network-manager timeout #10199
OCPBUGS-65767: Add StandardFXmdsv2Family to azure tested instance type list #10104
OCPBUGS-66231: Use separate tmpfs for ostree checkout on live ISO #10140
OCPBUGS-65763: continue to update 02_storage.json using new property storageAccountId #10103
OCPBUGS-66257: CORS-4249: bump ARO marketplace images #10142
OCPBUGS-66207, OCPBUGS-66208: Fix console info for interactive agent installer #10136
Revert “OCPBUGS-65586: Update the RHCOS 4.20 bootimage metadata to 9.6.202511…” #10093
OCPBUGS-65586: Update the RHCOS 4.20 bootimage metadata to 9.6.202511… #10084
OCPBUGS-64924: Azure UPI ARM template: use storageAccountId #10069
OCPBUGS-64595: Remove pending items on gcp no-op #10056
OCPBUGS-63633: Update the RHCOS 4.20 bootimage metadata to 9.6.20251023-0 #10037
OCPBUGS-63461: Prevent duplicate noProxy when adding nodes #10028
OCPBUGS-62920: AGENT-1269: Use agent-installer-ui image from release #10009
OCPBUGS-62343: [release-4.20] vSphere 7 deprecation #9973
OCPBUGS-62124: Update the RHCOS 4.20 bootimage metadata #9997
OCPBUGS-62948: Add an option in image-based installation to specify architecture #9943
OCPBUGS-62935: Add MTU validation for networkConfig #10010
OCPBUGS-62846: None: Allow IPv6 Primary DualStack installs on platforms None and External #10005
OCPBUGS-62656: Set agent-extract-tui start timeout #9990
OCPBUGS-62640: Wildcards not reliable for copying container files #9986
OCPBUGS-62297: Set default for PrivateDNSZone Project ID #9968
OCPBUGS-61528: Allow user to BYO private zone without specifying name #9936
OCPBUGS-61552: Shellcheck fix 4.20 #9938
Full changelog

baremetal-machine-controllers

OCPBUGS-103820: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #266
Full changelog

baremetal-operator

OCPBUGS-98095: Add BMH finalizer on PreprovisioningImage #507
OCPBUGS-87965: Fix preprovisioning network Secret lifecycle during BMH deletion #493
OCPBUGS-82008: Fix PPI for ACM #486
OCPBUGS-78745: OCPBUGS-78836: PR2774 and PR2793 backports [release-4.20] #470
Bug OCPBUGS-76546: BMO fails to start servicing despite updates to HFC spec #460
OCPBUGS-74987: Abort inspection/cleaning before powering off during deletion #453
OCPBUGS-74084: Require PreprovisioningImage for deprovisioning when cleaning is enabled #446
OCPBUGS-63538: Create a PreprovisioningImage for servicing if needed #435
OCPBUGS-69667: Change architecture default to match controller #440
Full changelog

baremetal-runtimecfg

OCPBUGS-103819: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #406
OCPBUGS-72567: Fix TNA and TNF dummy ip for ipv6 #379
OCPBUGS-77170: Install dbus-tools, needed in pkg/monitor/dnsmasqmonitor.go #384
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-103964: [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #2381
OCPBUGS-91324, OCPBUGS-94907: Bump golang.org/x/net to openshift-sustaining/net v0.50.0-sec.2 #2342
OCPBUGS-81946: Bump go-jose/go-jose/v4 to v4.1.4 #2274
OCPBUGS-77170: Install subscription-manager in required images #2209
OCPBUGS-77495: Makefile: Strip debugging symbols by default #2212
OCPBUGS-77145: oc adm policy: Only initialize UserClient if built-in OAuth is enabled #2207
OCPBUGS-74969: Fix unit test failure by updating ruby version to 3.3 #2194
OCPBUGS-74965: Clear defaultNodeSelector to run on any node #2193
OCPBUGS-66241: Fall back to simpler behavior, if setsid,ps,pkill are not installed #2158
OCPBUGS-65481: pkg/cli/admin/upgrade: Tighten force warnings #2140
OCPBUGS-65523: fix(must-gather): do not set node affinity if nodename is set #2142
OCPBUGS-64791: Rely on overall available disk space of the mounted volume #2133
OCPBUGS-64773: oc adm must-gather: Wrap gather in a session #2132
OCPBUGS-61757: pkg/cli/admin/upgrade/recommend: Enable precheck and accept gates #2097
Full changelog

cloud-credential-operator

OCPBUGS-103822: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 #1098
NO-JIRA: Revert “OCPBUGS-87109 Scope minted AWS IAM policies to cluster-owned resources” #1061
OCPBUGS-87109: Scope minted AWS IAM policies to cluster-owned resources #1047
OCPBUGS-81947: Bump go-jose/go-jose/v4@v4.1.4 #1029
OCPBUGS-79368: google.golang.org/grpc v1.79.3 #994
OCPBUGS-78200: Fix infrastructure resource name filtering in watch predicate #989
OCPBUGS-74546: Resolve nil pointer exception in hasResourceTags #970
OCPBUGS-65798: ccoctl azure: retry custom role creation on consistency errors #948
OCPBUGS-63690: ccoctl: use pagination when listing resources in aws #941
OCPBUGS-63546: ccoctl: add public-key-file flag to create-all #936
OCPBUGS-61586: set cloud-credential-operator as default-container #916
OCPBUGS-61225: ccoctl: aws to use proper issuer url on subsequent runs #912
Full changelog

cloud-network-config-controller

OCPBUGS-103779: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #269
OCPBUGS-88310: Retrieve subnet from vnet subnets.addressPrefixes field #226
OCPBUGS-64742: Fix capacity calculation #188
OCPBUGS-63542: Change the capacity struct from int to ptrOfInt #185
Full changelog

cluster-authentication-operator

OCPBUGS-103829: Bump golang.org/x/net from v0.38.0 to v0.50.0-sec.4 #981
OCPBUGS-81502: Do not return error when an IdP returns 500 during a grant check #866
OCPBUGS-66315: externaloidc: return errors when node statuses cannot be used to determine oidc state #814
OCPBUGS-61896: set appropriate rolling update settings #792
OCPBUGS-63319: (bugfix): configure status controller to remove unset versions #802
OCPBUGS-64668: Update OIDC e2e test to expect admission-time validation error of invalid CEL expression #804
Full changelog

cluster-autoscaler

OCPBUGS-103955: Replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 for CVE-2026-33814 #440
OCPBUGS-109662: UPSTREAM: 9458: fix(clusterapi): use kind-aware version discovery for infra references #435
OCPBUGS-78690: allow clusterapi provider to skip paused resources #411
OCPBUGS-77506: Pick upstream commits to Fix VPA recommender concurrent access panic #407
OCPBUGS-63675: update node info processors to include unschedulable nodes #391
OCPBUGS-63495: refactor cloud provider options #387
Full changelog

cluster-autoscaler-operator

OCPBUGS-103824: Bump x/net package in release-4.20 #384
Full changelog

cluster-baremetal-operator

OCPBUGS-103828: Use patched x/net fork v0.50.0-sec.4 #675
OCPBUGS-86555: Remove trailing dot from BMO Ironic endpoint #608
OCPBUGS-84376: Fix ironic-proxy service routing for port 6385 #593
OCPBUGS-81643: Allow ProvisioningCIDR for unmanaged network #585
OCPBUGS-76340: Explicitly set the ReadOnlyRootFilesystem flag to false #555
OCPBUGS-77488: Fix NO_PROXY matching for URLs with trailing dots #567
OCPBUGS-77074: Update kubebuilder tools to more latest version #559
OCPBUGS-75933: Explicitly set ReadOnlyRootFilesystem to false for machine-os-images so that SCC don’t end up enforcing it to true #552
OCPBUGS-73916: Fix DNS resolution for metal3 service endpoints by adding trailing dots #548
OCPBUGS-71203: Mount /etc/pki/ca-trust to machine-os-images & Enable runtime extraction of aarch64 images #543
OCPBUGS-62316: Always have a service for ironic-api port #511
Full changelog

cluster-capi-controllers

OCPBUGS-80577: Bump google.golang.org/grpc to v1.79.3 #289
OCPBUGS-78375: Updating ose-cluster-api-container image to be consistent with ART for 4.20 #268
Full changelog

cluster-capi-operator

NO-JIRA: Allow sustaining engineering to self serve dependency updates #556
OCPBUGS-80581: Bump google.golang.org/grpc to v1.79.3 #545
OCPBUGS-62755: kubeconfig controller: do not error on token secret not yet populated #377
OCPBUGS-61770: Fix conversion of Machines without MachineSet #362
Full changelog

cluster-cloud-controller-manager-operator

SPLAT-2867: Added support to manage kube-cloud-config for vSphere in openshift-config-managed #521
OCPBUGS-103842: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 #511
OCPBUGS-63164: ccm: disable unused secure-serving port and webhook #419
Full changelog

cluster-config-api

SPLAT-2867: Add vSphere multi vCenter Day 2 #3038
OCPBUGS-82147, OCPBUGS-92038, OCPBUGS-92039, OCPBUGS-92041, OCPBUGS-92042: Promote GatewayAPIWithoutOLM feature gate to Default #2869
OCPBUGS-98332: add new serviceAccountToken fs type #2925
OCPBUGS-82147, OCPBUGS-92038, OCPBUGS-92039, OCPBUGS-92041, OCPBUGS-92042: Promote GatewayAPIWithoutOLM feature gate to TechPreview #2874
OCPBUGS-85155: Backport GatewayAPIWithoutOLM feature gate as disabled #2871
OCPBUGS-86849: Add labelSelector to MachineSet status for scale subresource #2867
CORENET-6431: network, virt: Graduate PreconfiguredUDNAddresses feature gate #2546
OCPBUGS-66204: Introduce ClosedClientConnectionPolicy to IngressController API #2609
OCPBUGS-66135: Add HTTPKeepAliveTimeout to IngressController API #2607
OCPBUGS-64843: payload-command: remove authentication CR from hypershift payload #2573
OCPBUGS-64940: Promote BYO OIDC features #2515
OCPBUGS-62280: ConsoleLink CRD has incorrect additionalPrinterColumns entry #2509
OCPBUGS-62256: ConsoleLink CRD has incorrect additionalPrinterColumns entry #2508
OCPBUGS-61977: Add ‘AGE’ print column to MachineConfigNode object #2497
OCPBUGS-56778: Disable PSA for 4.20 #2475
Full changelog

cluster-config-operator

SPLAT-2867: Migrate vSphere sync of kube-cloud-config to 3CMO #506
Full changelog

cluster-control-plane-machine-set-operator

OCPBUGS-114721: Fixed issue where nameserver is not set when recreating cpms #418
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-103839: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #295
OCPBUGS-83507: Fix PDB unhealthyPodEvictionPolicy field name #273
OCPBUGS-62258: add all-egress label to deployments on HCP and IBM #244
Full changelog

cluster-dns-operator

OCPBUGS-103832: Use patched x/net fork v0.50.0-sec.4 #497
Full changelog

cluster-etcd-operator

OCPBUGS-103831: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 #1693
OCPBUGS-85412: fix(tnf): align Pacemaker kubelet and etcd retry pacing #1616
OCPBUGS-77313: Wait for revision stability before removing etcd members #1571
OCPBUGS-78047: Prefer to remove members where they have another healthy machine in the same failure domain index #1564
OCPBUGS-74624: Add priority field to prevent early shutdown #1508
OCPBUGS-63677: Backport 1504 1514 release.420 #1516
OCPBUGS-62738: CNTRLPLANE-1315:Add OpenShift Tests Extension (OTE) for cluster-etcd-operator #1491
OCPBUGS-63249: Ensure revision.json persists on ungraceful shutdown #1501
Full changelog

cluster-ingress-operator

OCPBUGS-103834: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.3 #1569
OCPBUGS-99476: Respect proxy configuration on gwapi provisioning #1519
OCPBUGS-99910: E2E test for internal LoadBalancer Annotations #1526
OCPBUGS-99484: Add e2e test for Gateway API infrastructure annotations #1521
OCPBUGS-98968: Bump Istio version from v1.26.2 to v1.26.8 #1510
OCPBUGS-85155: Fix e2e tests to work on platforms with unmanaged DNS #1514
OCPBUGS-99225: Fix logic on gatewayapi test cleanup #1512
OCPBUGS-88353, OCPBUGS-88354: Ensure canary cert matches the default ingress controller’s cert #1469
OCPBUGS-82147, OCPBUGS-92038, OCPBUGS-92039, OCPBUGS-92041, OCPBUGS-92042: Remove feature-set annotations from Sail Library RBAC Manifests #1497
OCPBUGS-82147, OCPBUGS-92038, OCPBUGS-92039, OCPBUGS-92041, OCPBUGS-92042: Replace OLM-based Istio install with Sail Library #1459
OCPBUGS-85523: Remove restriction of unmanaged x-k8s.io #1488
OCPBUGS-86717: Add configuration override for X-SSL strip #1472
OCPBUGS-85130: Add PrometheusRule for Gateway API gathering #1436
OCPBUGS-84132: set trustBundleName in Istio global values #1420
NO-JIRA: Add new NID team members to OWNERS #1317
OCPBUGS-66135: Implement HTTPKeepAliveTimeout tuning option #1312
OCPBUGS-66204: Implement ClosedClientConnectionPolicy field #1314
OCPBUGS-65664: IngressOperator not exposing some metrics for degraded… #1305
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-103840: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 #2297
OCPBUGS-127411: Bump of library-go #2342
OCPBUGS-128037: Fix kube-apiserver-to-kubelet-signer refresh interval #2323
OCPBUGS-98555: scc: fix uid{Min,Max}Range for nested-container #2226
OCPBUGS-87902: scc: Grant authenticated users use of restricted-v3 #1950
OCPBUGS-85271: fsync static pod cert and manifest writes for crash durability #2145
OCPBUGS-85564: [4.20] operator should not override authentication config serviceAccountIssuer with the default one during the operator initialization #2152
OCPBUGS-83856: Allow setting the oauthMetadata when auth type is None #2117
OCPBUGS-79419: : Always set service-account-jwks-uri to LB URL even with custom issuer #2078
OCPBUGS-77005: scc: restricted-v3: Fix runAsUser range #1948
OCPBUGS-74229: SCC: allow image volume type for all SCCs #2006
OCPBUGS-65679: enable resource v1beta2 api if DynamicResourceAllocation is enabled #1929
OCPBUGS-62057: OpenShift cluster got degraded after rotating the kube-apiserver-service-network-signer cert #1961
OCPBUGS-64689: Add priority field to prevent early shutdown #1955
OCPBUGS-55670: revert dev cert rotation #1906
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-103841: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #959
OCPBUGS-64684: Add priority field to prevent early shutdown #890
OCPBUGS-55217: Throttle resourcesynccontroller on pairs with dual writers. #882
OCPBUGS-61323: CNTRLPLANE-1275:Fixing arch issue #870
Full changelog

cluster-kube-scheduler-operator

OCPBUGS-103846: [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #667
OCPBUGS-83738: add /var/run/kubernetes as emptyDir #642
CNTRLPLANE-2843: chore: update OWNERS #620
OCPBUGS-74337: Add OPERATOR_IMAGE_VERSION to recovery container #604
OCPBUGS-74624: Add priority field to prevent early shutdown #586
OCPBUGS-61544: add readonlyRootFilesystem #576
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-61325: CNTRLPLANE-1306:Fixing arch issue #131
Full changelog

cluster-machine-approver

OCPBUGS-135047: Fix expired test certificate in csr_check_test.go #347
OCPBUGS-63587: port 9193 need to be internal and port 9194 need to have a service #280
Full changelog

cluster-monitoring-operator

OCPBUGS-129138: don’t delete admin-owned Alertmanager secrets on destroy #3140
NO-ISSUE: synchronize OWNERS from main branch [release-4.20] #3115
OCPBUGS-112574: [release-4.20] Makefile: version-stamp golangci-lint binary to prevent stale linter #3066
OCPBUGS-103845: [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #3072
OCPBUGS-105309: [release-4.20] wrap library-go resourceCache with mutex for thread safety #3043
OCPBUGS-104538: Backport e2e stabilization 4.20 #3028
OCPBUGS-100371: [release-4.20] fix: watch cluster wide proxy changes and apply changes accordingly #3022
OCPBUGS-99764: fall back to kube-system/global-pull-secret for telemeter-client token #3003
OCPBUGS-92195: set Prometheus shards value explicitly #2973
OCPBUGS-94078: ship collector:node_scrape_collector_success:avg to Telemetry #2990
OCPBUGS-86992: increase lookup interval #2947
OCPBUGS-85130: Enable Gateway API telemetry metrics #2920
OCPBUGS-74490: Include kube_pod_labels in minimal profile #2844
OCPBUGS-77272: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2835
OCPBUGS-74623: update expr for AlertmanagerClusterFailedToSendAlerts to exclude value 0 #2805
OCPBUGS-67166: Add the collection of MTV migration metrics #2772
OCPBUGS-62978: add tls configuration for the monitoring plugin deployment #2718
OCPBUGS-62829: Remove cluster from non-multicluster dashboards #2701
OCPBUGS-64577: Fix KSM deny-list typo #2729
OCPBUGS-63408: chore(prometheus/remotewrite): [release-4.20] clarify that the in-cluster proxy env vars set in prometheus container can be used in all configs that support proxyConfig.proxyFromEnvironment #2721
OCPBUGS-62979: Remove AlertManager endpoints when disabled #2710
OCPBUGS-62750: Add mcd_local_unsupported_packages metric from MCO to telemetry 4.20 #2692
OCPBUGS-62308: test: remove image registry e2e tests #2686
OCPBUGS-61680: add flag --watch-referenced-objects-in-all-namespaces to prometheus-operator #2667
OCPBUGS-61207: chore(jsonnet): use prometheus_remote_storage_queue_highest_timestamp_seconds in PrometheusRemoteWriteBehind #2661
OCPBUGS-61166: Revert “MON-4343: Cleanup deprecate pa config” #2659
Full changelog

cluster-network-operator

OCPBUGS-103851: [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #3157
OCPBUGS-128652: Allow per-node OVN encap IP override via env-overrides #3180
OCPBUGS-127390: Restart pods when rendering egressIP settings #3173
OCPBUGS-113989: frr-k8s: use Recreate strategy for webhook server deployment on SNO #3142
OCPBUGS-105852: Remove version-specific CNI binary copy logic #3118
OCPBUGS-99749: Bump frr-k8s MAX_FDS from 1024 to 65536 #3091
OCPBUGS-98796: Bump github.com/containernetworking/cni v0.8.0 -> v1.3.0 #3071
OCPBUGS-84176: Handle zero-worker HyperShift clusters in daemonset rollout [4.20 backport] #2973
OCPBUGS-83821: wait for patch port to apply drop garp flows #2966
OCPBUGS-77148: Add config override for openflow-probe #2918
OCPBUGS-76349: Remove duplicated openssl parameter #2901
CORENET-6311, OCPBUGS-74139: Skip running _stackmanager for libreswan 5.3+ #2872
OCPBUGS-73365: fix(hypershift): use net.JoinHostPort for URL construction #2876
OCPBUGS-66253: Add kubevirt platform to dual-stack supported platforms #2860
OCPBUGS-66412: Fix whereabouts-token-watcher DaemonSet improvements #2850
OCPBUGS-66164: [release-4.20] CORENET-6465: Remove unneeded logging config from managed ovn-kubernetes #2838
OCPBUGS-66162: [release-4.20] CORENET-6488: Preserve custom resource requests on ovn-control-plane pods #2835
OCPBUGS-46422: Add a ValidatingAdmissionPolicy blocking ServiceCIDR changes [4.20] #2827
OCPBUGS-64733: api, l2udn: subnets must be masked #2823
OCPBUGS-62678: Tweak iptables-alerter to try to avoid crictl bug #2811
OCPBUGS-62273: Fix EgressIP stale GARP post reboot + pod restart #2806
OCPBUGS-61779: Relax label req. of DPU/DPU Host/Smart NIC #2800
OCPBUGS-61370: Set maxUnavailable 10% on MultiNetworkPolicy DS #2793
Full changelog

cluster-node-tuning-operator

OCPBUGS-115719: Update PPC help description #1627
OCPBUGS-112026: BUG-FIX Latency Test #1594
OCPBUGS-111091: e2e: fix: clear hugepages before switching kernelPageSize to 4k #1588
OCPBUGS-114730: Use Add() instead of AddRateLimited() for routine Profile enqueues #1620
OCPBUGS-105509: e2e: fix broken checks and rework netqueue tests to avoid ARM ethtool blackout flakes #1581
OCPBUGS-90598: perf: latency: compute memory resources dynamically #1553
OCPBUGS-86815: Requeue PerformanceStatus update when status write fails #1530
OCPBUGS-82850: Bump github.com/moby/spdystream from v0.5.0 to v0.5.1 #1532
OCPBUGS-65773: Watch MCP changes including spec and labels #1434
OCPBUGS-66364: Add support for lscpu_check TuneD built-in #1443
OCPBUGS-85372: e2e: Add irqbalance StartLimitBurst >= 100 #1513
OCPBUGS-78247: workloadhints: use IsVM to skip BM-only tests #1482
OCPBUGS-70349: Remove CgroupModeV1 reference from the code #1437
OCPBUGS-62721: E2E: skip SMT disabled test when L3 cache spans entire NUMA node #1404
OCPBUGS-63751: PPC: ghw: filter out namespaces dir #1421
OCPBUGS-64832: e2e:hugepages: changing tests to use hugepages-allocator tool #1427
OCPBUGS-64588: e2e:llc: skip test when no BM worker is found #1422
OCPBUGS-63010: E2E: Add test cases related to schedulable control plane nodes #1409
OCPBUGS-62889: E2E: llc: make sure to remove any trailing newspaces #1408
OCPBUGS-63334: Do not cause kubelet failed dependency by ocp-tuned-one-shot.service #1415
OCPBUGS-62214: E2E: Add function to check control plane nodes are schedulable. #1398
OCPBUGS-62023: release-4.20: e2e: set of fixes/changes to ovs pinning testing #1394
OCPBUGS-62017: E2E: llc: Create testing namespace before Runtime tests #1393
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-olm-operator

OCPBUGS-103850: bump golang.org/x/net to v0.50.0-sec.3 to fix CVE-2026-33814 #243
OCPBUGS-80596: Bump google.golang.org/grpc to v1.79.3 #198
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-61607: set up openshift-tests-extension for cluster-openshift-controller-manager-operator and add a sanity test #396
Full changelog

cluster-policy-controller

OCPBUGS-103864: Bump golang.org/x/net to v0.50.0-sec.3 #200
OCPBUGS-98332: [4.20] add serviceAccountToken volume type to psalabelsyncer #194
OCPBUGS-62053: fix(psalabelsyncer): return an error instead of panic when converting an unknown volume #168
Full changelog

cluster-samples-operator

OCPBUGS-129478: Restrict samples operator access to the global pull-secret #729
OCPBUGS-63507: references to github.com/sclorg/django-ex.git now also refer to the branch #655
Full changelog

cluster-storage-operator

OCPBUGS-103858: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #737
OCPBUGS-77519: remove oVirt code from CSO #704
OCPBUGS-86121: add Azure Disk CSI driver SA name to CredentialsRequest #702
OCPBUGS-79532: volume-data-source-validator should run on master nodes #688
OCPBUGS-75912: add vsphere permissions for checking if users is authorized to see metrics #663
OCPBUGS-70343: volume-data-source-validator must use IfNotPresent image pull policy #653
OCPBUGS-62668, OCPBUGS-62993: Move metrics to vsphere driver #630
OCPBUGS-62175: add all-egress label to deployments on HCP and IBM #622
OCPBUGS-61249: Fix logging e2e also faster cleanup #613
Full changelog

cluster-version-operator

OCPBUGS-103852: Bump golang.org/x/net to v0.50.0-sec.3 #1457
OCPBUGS-79463: Implement mTLS authentication and authorization for CVO metrics endpoint #1374
OCPBUGS-74177: lib/resourcemerge/core: Reconcile ConfigMap binaryData too #1303
OCPBUGS-64828: lib/resourcemerge: Add support for hostUsers flag #1259
OCPBUGS-70180: [release-4.20] OCPBUGS-70180: Unify capitalization when comparing architectures for available updates #1281
OCPBUGS-63001: Add ClusterVersionOperator manifests to TechPreviewNoUpgrade clusters in 4.20 #1247
OCPBUGS-62867: temporarily disable metrics auth for hypershift clusters #1244
Full changelog

console

OCPBUGS-122351: Wait for demo plugin deployment readiness #17168
OCPBUGS-60136: Fix Operator Backed catalog empty on disconnected clusters #17184
[release-4.20 ]OCPBUGS-84041: Fix template placeholder {{name}} not resolved and runtime error on Group details page #16313
OCPBUGS-121663: Validate chart URL in /api/helm/verify #17147
OCPBUGS-114054: make cloud provider fields optional during operator install #17098
OCPBUGS-100517, OCPBUGS-101794: Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss #17056
OCPBUGS-112274: Fix flaky TestAsyncCache backend test #17047
Fix OCPBUGS-98785: CVE-2026-48801 #16854
Fix for OCPBUGS-105903: CVE-2026-73086 #16967
OCPBUGS-109132: Fix leading whitespace in Quick Start execute code snippets #17003
Fix for OCPBUGS-89701: CVE-2026-12143 #16646
OCPBUGS-104530: Re-enable-knative #16908
OCPBUGS-98436: [release-4.20] CVE-2026-59869 bump js-yaml #16916
OCPBUGS-100057: quickstart page i18n misses (Fix Quick Starts i18n bundle lookup for zh-CN) #16867
OCPBUGS-99312: Disable Knative e2e Cypress tests in CI #16795
OCPBUGS-99167: fixing severity not showing number of issues #16620
OCPBUGS-84286: Bump follow-redirects to 1.16.0 to fix CVE-2026-40895 #16671
Fix for OCPBUGS-81613: CVE-2026-4800 #16561
OCPBUGS-86746, OCPBUGS-87089, OCPBUGS-88753: [release-4.20] bump package: webpack-dev-server, protobufjs, fast-uri #16674
OCPBUGS-86455: [release-4.20] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16509
OCPBUGS-89235: Allow VolumeSnapshot restore when parent PVC is deleted #16635
OCPBUGS-87835: Prevent binary secret data corruption when editing #16571
OCPBUGS-79455: Bump immutable #16323
OCPBUGS-86582: Fix macOS Option key in pod terminal #16557
OCPBUGS-86872: Fix Shipwright detail pages crashing with React error #310 #16527
OCPBUGS-87100: fix trailing quote in prometheus query #16552
OCPBUGS-77127: [release-4.20] CVE-2026-26996 Bump minimatch library #16272
NO-JIRA: enable multi-architecture yarn builds #16418
OCPBUGS-83819: Fix false positive scheduler degradation caused by user workloads #16308
OCPBUGS-85042: Remove PII from events #16402
OCPBUGS-81575: Add robots.txt policy to console #16243
OCPBUGS-78439: Backport OCPBUGS-61536: vsphere settings #16141
OCPBUGS-83495: remove dev to admin links as dev monitoring views are enabled #16173
OCPBUGS-82012: Fix VolumeSnapshot and VolumeSnapshotContent tables sorting #16261
OCPBUGS-77037: Fix QueryBrowser import to use SDK path to avoid circular dependency #16222
OCPBUGS-83573: Performance improvements + AsyncComponent refactor #16300
OCPBUGS-83420: Fix resource log dropdown TypeError #16282
OCPBUGS-81678: Fix useOperatorCatalogCategories hook. #16251
OCPBUGS-81322: Migrate InstallPlan components table to PatternFly Table #16217
OCPBUGS-81439: Fix TypeError in OLS code import to console #16221
OCPBUGS-81495, OCPBUGS-81496: OLM prompts for GCP Workload Identity parameters during Kiali Operato… #16231
OCPBUGS-78295: Fix editing secrets with mixed text and binary data #16132
OCPBUGS-78366: Clean up old session cookies to prevent accumulation #16136
OCPBUGS-78839, OCPBUGS-79465, OCPBUGS-79466: apiVersion is empty on YAML creation page - Runtime error occurs when create MachineConfig with default yaml from… #16192
OCPBUGS-76951: “Import from Git” should not force HTTPS/443 for Git providers (GitHub/GitLab/Bitbucket) #16029
OCPBUGS-77951: Fix infinite recursion in project access form #16117
CONSOLE-5011: migrate to yarn berry #16070
OCPBUGS-76543: Use Actions button instead of kebab menu on Subscription details page #16018
OCPBUGS-75880: Fix referenceFor parameter in SubscriptionDetailsPage #15987
OCPBUGS-74696: Bump lodash to latest #15963
OCPBUGS-74158: Do not resolve disabled catalog type extensions #15931
OCPBUGS-72417: make cloudCredentials optional so operators load when … #15901
OCPBUGS-67225: Remove unwanted semicolon from Serverless Channel and Broker list #15834
OCPBUGS-69917: There should be no role ARN field as token-auth-aws/azure/gcp=false in csv annotations #15869
OCPBUGS-73775: make cloudCredentials optional so operators load when … #15918
OCPBUGS-69732: Fix Helm chart installation with CA/TLS certificates #15862
OCPBUGS-70332: Visiting Group Detail Page > RoleBindings will show error #15887
OCPBUGS-67136: Spread operand details across 2 col #15858
OCPBUGS-66427: Update client initialization in checkPackageManifestHandler #15822
OCPBUGS-67221: Disallowed Pipelines-plugin Pipelines navigation section #15833
OCPBUGS-66248: The number of Quick Starts item is wrong #15797
OCPBUGS-66206: Sync YAML editor modal settings #15787
OCPBUGS-65900: Fix unnecessary rerenders with pod-connect #15758
OCPBUGS-61785: Add validation and type guards on healthHandler calls to prevent errors #15500
OCPBUGS-65793: OpenShift Console can only show user name instead of full name as the display name #15743
OCPBUGS-65949: Add SDK-webpack 4.20 changelogs #15768
NO-JIRA: Add SDK 4.20 changelogs #15765
OCPBUGS-65761: Preserve query string in perspective switch + remove dev console folks from reviewers #15740
OCPBUGS-64861, OCPBUGS-64863: Upgrade Helm to 3.18.5 #15705
OCPBUGS-64702: Lack Chinese/Japanese/Korean translations for ‘On/Off’ switch button on editor setting modal of yaml page. #15683
OCPBUGS-63125: use tenancy path for project scoped status card #15608
OCPBUGS-61330: fix namespace path generation for non-namespaced resources #15498
OCPBUGS-62953: Automatically redirect all-namespaces catalog to default namespace #15640
OCPBUGS-64862: Convert standalone terminal route to extension #15702
OCPBUGS-63499: Turn on fContentSecurityPolicyEnabled by default #15639
OCPBUGS-64639: HPA Form View in RHOCP Web Console Incorrectly Requires Both CPU and … #15673
OCPBUGS-63616: Preserve path on perspective switch #15650
OCPBUGS-64809: Never allow OTHER_CATEGORY in categories #15690
OCPBUGS-63608: Fix catalog search relevance scoring, so that operators with attribute.keywords are displayed and remove unnecessary metadataName from calculation #15648
OCPBUGS-63470: limit node log length to 1000 lines #15635
OCPBUGS-63440: Expose prometheus tenancy label path as a proxy #15632
OCPBUGS-63465: Remove required flag from ‘console.flag/model’ pipelines-plugin extension #15634
OCPBUGS-63403: Fix Bare Metal Hosts nav item #15628
OCPBUGS-62644: bump dompurify to latest #15587
OCPBUGS-61926: PVC shows negative Available space in OpenShift Console on RHOCP 4 #15512
OCPBUGS-61861: cluster in workload identity mode is not applied with the token-auth-… #15507
OCPBUGS-61848: Updation of label from edit label doesn’t work #15506
OCPBUGS-62196: Add Missing Periods to Error Messages and update try again button link #15537
OCPBUGS-62015: Help dropdown should be closed automatically after tour model opened #15519
OCPBUGS-61990: Change default tab size from 4 to 2 #15515
OCPBUGS-61671: i18n upload/download routine task for OCP version 4.20 #15485
OCPBUGS-61777: Fix improper DescriptionList refactor #15499
OCPBUGS-61327: Correct the ordering of Catalog categories to be alphabetized #15468
OCPBUGS-61226: fix typo in update approval strategy label #15458
Full changelog

console-operator

OCPBUGS-103860: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #1221
NETOBSERV-2296: add missing annotations on netobserv quickstart #1095
OCPBUGS-100112: Sort plugin list to make them deterministic #1202
OCPBUGS-98986: [4.20] Stabilize telemetry config to prevent continuous console pod rollouts #1191
OCPBUGS-84254: Redeploy console pods upon cert rotation #1142
OCPBUGS-77771: Add rhel8 and rhel9 oc binaries for Linux OS in CLI downloads #1122
OCPBUGS-76267: Fix PDB blocking node drains during cluster upgrades + update donwloads deployment #1105
OCPBUGS-69960: Reset StorageVersionMigrationDegraded condition #1085
OCPBUGS-69654: Update path for browsing catalogs and operators in quickstarts. #1083
OCPBUGS-64602: Remove v1alpha1 ConsolePlugin version from CRDs status #1060
OCPBUGS-61230: pluginOrder field should only contain available plugins #1040
Full changelog

coredns

OCPBUGS-103861: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #203
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-96434: Bump golang.org/x/net to v0.50.0-sec.4 #418
OCPBUGS-80668: bump google.golang.org/grpc@v1.79.3 #385
OCPBUGS-74890: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.33 into release-4.20 #368
OCPBUGS-64811: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.33 into release-4.20 #355
Full changelog

csi-driver-nfs

OCPBUGS-82853: Bump github.com/moby/spdystream@v0.5.1 #192
OCPBUGS-80610: CVE-2026-33186: bump google.golang.org/grpc v1.79.3 #177
Full changelog

csi-external-attacher

UPSTREAM: 110: OCPBUGS-103856: Bump golang.org/x/net to v0.50.0-sec.4 #113
OCPBUGS-80611: Bump google.golang.org/grpc to v1.79.3 #103
Full changelog

csi-external-provisioner

OCPBUGS-92946: Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.48.0-sec.3 to address CVE-2026-46597 #160
OCPBUGS-96392: Bump golang.org/x/net to v0.50.0-sec.4 #150
OCPBUGS-82854: Address CVE-2026-35469 #141
OCPBUGS-80612: Bump google.golang.org/grpc to v1.79.3 #128
Full changelog

csi-external-resizer

OCPBUGS-103867: Bump golang.org/x/net to v0.50.0-sec.4 #211
OCPBUGS-80613: Bump google.golang.org/grpc to v1.79.3 #201
OCPBUGS-61546: Requeue PVC over PV creation #172
Full changelog

csi-external-snapshot-metadata

OCPBUGS-80614: Bump google.golang.org/grpc to v1.79.3 #21
OCPBUGS-103868: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 #34
Full changelog

csi-external-snapshotter, csi-snapshot-controller

OCPBUGS-103869: Replace golang.org/x/net with github.com/openshift-sustaining/net v0.50.0-sec.3 #236
OCPBUGS-92084: UPSTREAM: 1392: Fix VolumeSnapshotContent deletion #225
OCPBUGS-80615, OCPBUGS-80618: Bump google.golang.org/grpc to v1.79.3 #209
Full changelog

csi-livenessprobe

OCPBUGS-103865: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 #109
Full changelog

csi-node-driver-registrar

OCPBUGS-62844: update log level verbosity to not clutter logs #87
Full changelog

docker-builder

OCPBUGS-89994, OCPBUGS-90424, OCPBUGS-92486, OCPBUGS-92631, OCPBUGS-92790: Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 #554
OCPBUGS-66991: bump buildah to 1.39.7 to fix CVE-2025-52881 #496
OCPBUGS-64857: BuildConfig inline Dockerfile fails with heredoc syntax #483
Full changelog

docker-registry

OCPBUGS-103870: [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #478
OCPBUGS-68327: update logrus to v1.9.1 #462
OCPBUGS-61638: update OWNERS #449
Full changelog

driver-toolkit

OCPBUGS-78783: Support ubi minimal base image #187
Full changelog

egress-router-cni

OCPBUGS-98796: Bump containernetworking/cni to v1.3.0 github.com/containernetworking/plugins to 1.4.0 #107
Full changelog

etcd

OCPBUGS-70151: 4.20 rebase 3.5.26 #358
OCPBUGS-63474: 4.20 rebase 3.5.24 #347
OCPBUGS-60874: Revert “OCPBUGS-52181: Ensure cluster id changes during force-new-cluster” #339
OCPBUGS-57675: Updating ose-etcd-container image to be consistent with ART for 4.20 #334
ETCD-726: Rebase etcd 3.5.21 openshift 4.19 #324
OCPBUGS-52181: Ensure cluster id changes during force-new-cluster #313
OCPBUGS-50510: Add configurable option for hardware-related timeout delay #311
OCPBUGS-45488: Updating ose-etcd-container image to be consistent with ART for 4.19 #306
ETCD-717: Rebase etcd 3.5.19 openshift 4.19 #315
DOWNSTREAM: <carry>: OCPBUGS-51838: fix a compaction induce latency issue #309
ETCD-709: Rebase etcd 3.5.18 openshift 4.19 #308
OCPBUGS-44528: Rebase etcd 3.5.17 openshift 4.18 #302
DOWNSTREAM: <carry>: ETCD-697: add tls min/max version to grpc proxy #301
DOWNSTREAM: <carry>: ETCD-696: Add rev bumping to force-new-cluster #300
NO-ISSUE: Add support for cachi2 based deps in Dockerfile.art #296
NO-ISSUE: Add support for cachi2 based deps #294
OCPBUGS-39188: Rebase etcd 3.5.16 openshift 4.18 #290
NO-JIRA: use golang 1.22 image #285
ETCD-656: Automate datadir move after quorum-restore #284
DOWNSTREAM: <carry>: ETCD-653: add jq to the etcd image #282
OCPBUGS-34653: Rebase etcd 3.5.14 openshift 4.17 #273
CORS-3191: DOWNSTREAM <carry>: add native binary to installer images #269
CORS-3249: DOWNSTREAM <carry>: installer: make etcd binaries static #268
CORS-3249: DOWNSTREAM <carry>: add installer Dockerfile for ART builds #267
OCPBUGS-31624: Rebase etcd 3.5.13 openshift 4.16 #259
no-issue: Update Installer dockerfile to use golang-1.20 #251
OCPBUGS-28730: Rebase etcd 3.5.12 openshift 4.16 #242
CORS-3191: Add Dockerfile to build etcd for openshift-installer #249
OCPBUGS-24988: Updating ose-etcd-container image to be consistent with ART #236
OCPBUGS-24931: Rebase etcd 3.5.11 openshift 4.16 #237
OCPBUGS-19279: Updating ose-etcd images to be consistent with ART #215
OCPBUGS-20560: [4.15] Rebase openshift/etcd to 3.5.10 #224
OCPBUGS-18179: UPSTREAM <carry>: update build images to rhel9 #211
OCPBUGS-11850: Rebase etcd-3.5.9 into openshift-4.14 #203
OCPBUGS-11850: Rebase etcd-3.5.8 into openshift-4.14 #201
Update owners #184
Updating ose-etcd images to be consistent with ART #182
Updating ose-etcd images to be consistent with ART #181
OCPBUGS-5458: UPSTREAM:<carry>: etcdserver: process the scenaro of the last WAL rec… #175
OCPBUGS-3098: Rebase openshift/etcd 4.13 onto v3.5.6 #168
Bug OCPBUGS-3098: UPSTREAM: <carry>: server/etcdmain: add configurable cipher list to gRPC proxy listener #162
OCPBUGS-861: Rebase openshift/etcd 4.12 onto v3.5.5 #144
Updating ose-etcd images to be consistent with ART #134
Bug 2085997: increases cluster discovery time from 10s to 135s #131
Revert “UPSTREAM: <carry>: increases cluster discovery time from 10s to 180s” #130
Bug 2085997: increases cluster discovery time from 10s to 180s #129
Add new members to reviewers/approvers #121
Remove MemberList patch #120
3.5.3 with history #116
Contiguous to 3.5.2 #109
OWNERS: bump #104
UPSTREAM: <carry>: add –experimental-max-learner flag #102
OWNERS: clean up #101
Bug 2003775: UPSTREAM: <carry>: server: Fix for v3.5 Ensure that cluster members stored in v2store and backend are in sync #98
UPSTREAM: <carry>: storage/backend: Add a gauge to indicate if defrag is active #97
Updating ose-etcd images to be consistent with ART #95
Bug 1994986: (CARRY) etcdctl/ctlv3/ctl.go: Remove check perf command #94
Bug 1992673: Fix build #93
ETCD-203: Updating ose-etcd images to be consistent with ART #92
ETCD-202: bump etcd v3.5.0 #91
ETCD-200: Bump etcd v3.4.16 to go 1.15 #86
Updating ose-etcd images to be consistent with ART #87
ETCD-199: bump etcd v3.4.16 #83
Updating ose-etcd images to be consistent with ART #84
Bug 1958913: discover-etcd-initial-cluster: retry if member is not part of member list and dataDir exists #81
Bug 1958405: UPSTREAM: <carry>: etcdserver/api/etcdhttp: log successful etcd server side health check in debug level #80
Bug 1958405: UPSTREAM: <carry>: *: log server-side /health checks #79
Bug 1958405: UPSTREAM: <carry>: server: add support for log rotation (#12774) #78
UPSTREAM: <carry>: *: ensure zap logger is set before use #75
ETCD-180: Bug 1927942: UPSTREAM: <carry>: *: add support for socket options #70
ETCD-178: Bug 1931652: openshift-tools: fix on off flow and add unit tests #73
Updating ose-etcd builder & base images to be consistent with ART #68
Bug 1870189: Bump v3.4.14 #65
OWNERS: add component #60
Updating ose-etcd builder & base images to be consistent with ART #59
Bug 1878163: Updating ose-etcd builder & base images to be consistent with ART #57
Bug 1883772: discover-etcd-initial-cluster: improve error handling when we dont scale member #56
Bug 1859196: bump etcd v3.4.9 #52
Bug 1814576: make evaluation of targetMember strict #48
*: bump etcd to v3.4.7 #44
list all peers in initial-cluster #38
Bug 1808544: If we weren’t able to get client or target member go ahead and start … #36
Bug 1808073: fix archive member name, unmask error #34
Bug 1806751: Archive data-dir if target member is unstarted #29
Use var lib etcd as data dir #30
Bug 1805807: create logic for golang ETCD_INITIAL_CLUSTER #28
add stub discovery-etcd-initial-cluster #26
Bug 1801237: *: bump etcd to v3.3.18 #21
: bump etcd to v3.3.17 #20
Dockerfile: bump golang 1.12 #19
BUG 1747124: Dockerfile: use build instead of make build #17
Dockerfile: bump golang to 1.11 #14
Bug 1706103: Dockerfile: set coreos org as canonical for release-3.3 #12
[cherry-pick openshift-4.0] *: Change gRPC proxy to expose etcd server endpoint /metrics #6
Dockerfile: resolve issue where binary was not properly copied #5
clientv3: automated cherry pick of #10153 to release-3.3 #10161
Automated cherry pick of #9997 #10041
etcdctl: cherry pick of #10109 to release-3.3 #10122
etcdserver: remove duplicated imports #10093
etcdserver: cherry-pick #9861 to release-3.3 #10027
Automated cherry pick of #9990 #10004
Automated cherry pick of #9761 #9940
And 206 elided commits (e.g. from squash or rebase merges)
Full changelog

gcp-cloud-controller-manager

OCPBUGS-103881, OCPBUGS-103993, OCPBUGS-88254: Replace golang.org/x/net with sustaining fork for CVE-2026-33814 #163
OCPBUGS-99227: Fix node.kubernetes.io/exclude-from-external-load-balancers on masters #129
NO-JIRA: Update OWNERS #158
OCPBUGS-83720: Fix OSD ILB bug #109
OCPBUGS-77152: Fix ose gcp cloud controller manager hermetic #97
Full changelog

gcp-cluster-api-controllers

OCPBUGS-103883: Bump golang.org/x/net to github.com/openshift-sustaining/net v0.50.0-sec.4 CVE-2026-33814 [release-4.20] #318
OCPBUGS-80628: Bump google.golang.org/grpc to v1.79.3 #288
Full changelog

gcp-machine-controllers

OCPBUGS-103902: Bump golang.org/x/net to v0.50.0-sec.3 #187
OCPBUGS-80651: Bump google.golang.org/grpc to v1.79.3 #163
Full changelog

gcp-pd-csi-driver

OCPBUGS-103880: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #147
OCPBUGS-80632: Bump google.golang.org/grpc to v1.79.3 in release 4.20 #103
Full changelog

gcp-pd-csi-driver-operator

OCPBUGS-103880: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #210
OCPBUGS-97961: no-op OWNERS change to trigger postsubmit jobs #198
OCPBUGS-80631: Bump google.golang.org/grpc to v1.79.3 #185
Full changelog

gcp-workload-identity-federation-webhook

OCPBUGS-103888: Replace golang.org/x/net with github.com/openshift-sustaining/net v0.35.0-sec.4 #24
Full changelog

haproxy-router

OCPBUGS-86728: Prevent SSRF via FQDN-typed EndpointSlices #819
OCPBUGS-86717: Strip X-SSL-* headers for plain HTTP #797
OCPBUGS-87220: Replace HTTP backend liveness check with admin socket check #789
OCPBUGS-80633: Bump google.golang.org/grpc to v1.79.3 #766
OCPBUGS-78435: Updating openshift-enterprise-haproxy-router-container image to be consistent with ART for 4.20 #750
OCPBUGS-78432: Updating ose-haproxy-router-base-container image to be consistent with ART for 4.20 #749
OCPBUGS-79529: Lower verbosity for parseIPList empty list logging #753
OCPBUGS-66204: Add option abortonclose to HAProxy configuration template #695
OCPBUGS-61558: Revert Prevent startup failures due to name resolution” #674
Full changelog

hyperkube, kube-proxy, pod

UPSTREAM: <carry>: OCPBUGS-125759: Fix ClusterIsIPv6() detection for dual-stack v6-primary clusters #2780
OCPBUGS-105592: backport kubernetes/conformance umbrella suite #2741
OCPBUGS-117657: Fix performance related issues when selinux metrics are emitted #2768
OCPBUGS-93896: Rebase v1.33.13 in release-4.20 #2706
OCPBUGS-87173: fix flake race in VAP e2e case #2679
OCPBUGS-85501: Bump Kubernetes v1.33.12 to release-4.20 #2666
“OCPBUGS-83609: Bump to k8s v1.33.11” #2648
OCPBUGS-78993: Bump v1.33.10 to release-4.20 #2643
NO-JIRA: UPSTREAM: <carry>: Add jacobsee and jubittajohn to DOWNSTREAM_OWNERS #2638
OCPBUGS-77476: Rebase v1.33.9 to release-4.20 #2614
OCPBUGS-76517: Bump 1.33.8 #2595
OCPBUGS-74977: UPSTREAM: 136595: raise kubelet CSI init backoff to cover ~140s DNS delays #2581
OCPBUGS-61843: UPSTREAM: 131850: cpumanager: uncorecache alignment for odd integer cpus #2498
OCPBUGS-65551: Bump 1.33.6 #2518
OCPBUGS-46422: Remove patch/update from ServiceCIDR API conformance test #2466
NO-JIRA: enable CBOR tests #2502
OCPBUGS-63601: UPSTREAM: <carry>: Skip CPU resource status for workload-partitioning #2504
OCPBUGS-61555: Bump 1.33.5 #2461
OCPBUGS-61753: UPSTREAM: <carry>: Add retries for GetCurrentResourceVersion. #2469
OCPBUGS-61720: Do not remove PVC ClaimRef to fix flaky VAC test #2463
OCPBUGS-61197: UPSTREAM: 133425: Fix SELinux label comparison #2445
OCPBUGS-61347: UPSTREAM: <carry>: backporting fix for concurrent map iteration and write #2450
OCPBUGS-61333: Unrevert bump to v1.33.4 #2449
Full changelog

hypershift

OCPBUGS-129444: Prevent infraID and clusterID removal via parent-level CEL rules #9927
Sync approver aliases with main for release-4.20 #10187
build: [release-4.20] ACM-45149: Migrate Go builder for hypershift-cli, hypershift-release #10070
CNTRLPLANE-3774: fix: control-plane-operator: improve opaque conditions #10060
OCPBUGS-130864: filter AWS-reserved tag keys before calling DeleteTags #9985
OCPBUGS-92954: CVE-2026-46597 openshift4/ose-hypershift-rhel9: golan.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs [openshift-4.20] #9273
OCPBUGS-96899: Bump go-toolset to 1.25.9 to address CVE-2025-61729 #9101
OCPBUGS-100104: OCPBUGS-86296: Propagate management cluster proxy env vars to konnectivity sidecar #9149
OCPBUGS-122206: fix(kubevirt): use only first MachineInternalIP per family in EndpointSlice endpoints #9798
OCPBUGS-128419: fix(konnectivity): enable –sync-forever to restore lost agent-server tunnels #9801
OCPBUGS-129370: Add MTU override for OVN-Kubernetes on hosted clusters #9911
OCPBUGS-112733: fix(certs): normalize IP SANs to stop dual-stack KAS cert churn #9498
OCPBUGS-82862, OCPBUGS-83593: Address CVE-2026-35469 #9024
CNTRLPLANE-4571: add kubeClientQPS and kubeClientBurst to ClusterAutoscaling #9890
OCPBUGS-129090: [release-4.20] fix: grant cluster-autoscaler watch access #9882
OCPBUGS-128386: Apply ingress load balancer scope to default IngressController #9539
OCPBUGS-113993: [release-4.20] fix router component ordering to prevent missing HAProxy backends #9399
CNTRLPLANE-4211: Backport ConfigurationStatus API for external authentication #9410
CNTRLPLANE-4161: Maintain ingress serving cert for HostedCluster ingress #9780
OCPBUGS-127054: hardcode ETCD_METRICS=extensive in etcd StatefulSet template #9720
OCPBUGS-120750: update Containerfile.cli runtime base image to floating tag [release-4.20] #9558
OCPBUGS-94180: fix registry override matching and propagation to init containers #8880
OCPBUGS-106185: fix(upsert): add desired-state hash to detect spec field removals #9291
OCPBUGS-105812: Add proxy env vars to AWS cloud-controller-manager deployment #9284
OCPBUGS-105211: Apply MetricsSet relabel configs to KAS ServiceMonitor #9235
OCPBUGS-97923: fix(nodepool): skip CNI-internal IPs in ClusterNetworkCIDRConflict check [release-4.20] #8950
OCPBUGS-90085: Fix NodePool reconciliation failure when updating mirrored immutable ConfigMaps #8813
fix(deps): OCPBUGS-83829: Update runc, selinux, and their transitive deps to fix CVE-2025-52881 #8750
CNTRLPLANE-3874: Backport controlPlaneVersion status to release-4.20 #9055
OCPBUGS-90088: [release-4.20] clear stale EtcdRecoveryActive failure condition when etcd is healthy #8808
OCPBUGS-99143: fix(backport): konnectivity agent auth #9092
OCPBUGS-98574: [release-4.20] fix(cpo): deduplicate VPC endpoint subnets by AZ to prevent DuplicateSubnetsInSameZone #8994
OCPBUGS-78400: remove resource limits from Agent CAPI provider #7947
OCPBUGS-94175: fix(cpo): prevent informer creation for inaccessible resource types #8876
OCPBUGS-89354: build(operator): drop hypershift-no-cgo from operator container images #8758
OCPBUGS-86020: OCPBUGS-62177: [release 4-20] verify cert revocation against all KAS pods #8536
OCPBUGS-77967: fix: global-pull-secret-syncer pod ~15-minute delay scheduling on new nodes #8716
OCPBUGS-86780: [release-4.20] OCPBUGS-81671: Ignition generalize image download errors #8573
OCPBUGS-85825: [release-4.20] Add KAS readiness sidecar to OAS, OAuth API Server, and OLM packageserver #8529
OCPBUGS-85825: [release-4.20] Set unhealthyPodEvictionPolicy to AlwaysAllow on all PDBs #8528
NO-JIRA: remove path filter from control-plane-operator pipelines #8666
OCPBUGS-86573: [release-4.20] add CP pull-secret watches for in-place propagation #8596
OCPBUGS-86567: fix Konflux application label for CPO 4.20 pipelines #8603
OCPBUGS-86567: [release-4.20] set limits for aro.openshift.io/swift-nic in request overrides for ARO swift #8593
OCPBUGS-83711: fix(kubevirt): filter link-local addresses from EndpointSlice endpoints #8271
OCPBUGS-85622: fix CVE-2026-33186 by updating grpc-go #8517
OCPBUGS-77109: Add UserAgent telemetry to CPO Azure SDK clients #8374
OCPBUGS-83663: fix(cpo): reconcile ClusterIP private router service for ARO HCP #8140
OCPBUGS-82069: OCPBUGS-81670: fix(cpo-v2): preserve HCCO modifications to OCM Controllers field #8177
OCPBUGS-78474: Fix deadlock when changing release image during initial provisioning #7953
OCPBUGS-81746: Honor AWS AMI override in NodePool token generation #8183
OCPBUGS-80950: fix(cpo): Don’t remove HCP Ingress from routes when CapabilityRoute is disabled #8083
OCPBUGS-78979: fix(hostedcluster): Remove referenced resource annotations regardless of hcp status #8023
CNTRLPLANE-3008: Azure web identity webhook 4.20 #7998
OCPBUGS-78741: fix(sync-global-pullsecret): compare content ignoring trailing newlines #7976
CNTRLPLANE-2814: feat(aro): Swift support #7885
OCPBUGS-76992: fix kubevirt, use 100.66.0.0/16 for join subnet #7733
OCPBUGS-78305: Fix context cancel accumulation in getMirrorFromICSPOrIDMS #7890
OCPBUGS-76324: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7660
OCPBUGS-77366: Fix ignition-server pod restarts #7842
OCPBUGS-75931: [release-4.20] fix(cpo): Correct route labeling logic for HCP router infrastructure #7642
OCPBUGS-74105: Fix CVE-2025-58183 #7546
CNTRLPLANE-2680: Add support for setting max expiration duration for KAS service account tokens #7707
OCPBUGS-74775: feat(cpo): check components are available before setting HostedCluster available #7616
OCPBUGS-72409: fix(Portieris): Fix Portieris by mounting emptyDir to ‘./.trust’ work dir #7421
OCPBUGS-73365: fix(cno): use brackets only for IPv6 in server URL #7461
OCPBUGS-72405: Fix Konflux EC voilation, update deprecated base … #7444
OCPBUGS-66409: test: Fix control plane components rollout failure when NetworkType is not OVNKubernetes #7337
CNTRLPLANE-2205: fix(hcco): allow for ARN reuse across components #7383
OCPBUGS-69378: test: remove network-dependent unit tests for image metadata #7391
OCPBUGS-66397: fix(kas): apply LoadBalancerSourceRanges only for LoadBalancer service type #7336
NO-JIRA: Update expected digest for busybox:latest in TestGetDigest #7350
CNTRLPLANE-1710: feat(globalps): security enhancements on GlobalPullSecret feature #7234
OCPBUGS-65576: add hypershift-no-cgo to the latest operator conta… #7229
CORENET-6484: Restart ovnkube-control-plane pods when restart-date annotation is set #7190
OCPBUGS-63509: fix(ingress): add LoadBalancerSourceRanges support for external router service #7098
OCPBUGS-64848: feat: Promote ExternalOIDCWithUIDAndExtraClaimMappings feature to GA for Hypershift #7204
OCPBUGS-61774: fix(capi-provider): use single replica deployment for aws and azure #6834
CNTRLPLANE-1908: control-plane-operator-4-20 Konflux pipelines #7216
OCPBUGS-63539: remove NTO Service and ServiceMonitor #7099
OCPBUGS-63718: specify SCC annotation for pods in data plane #7132
OCPBUGS-63128: resolve initContainer permission issue after node reboot #7080
OCPBUGS-63604: fix(konnectivity): resolve circular dependency causing DNS timeouts and excessive retries #7107
OCPBUGS-63367: FIPS compliant hypershift binary #7083
OCPBUGS-62020: fix(security): harden konnectivity-agent DaemonSet security context #6870
OCPBUGS-62806: Fix driver-config ConfigMap content flapping due to random ordering #6945
OCPBUGS-63387: fix: routes are not used in case of IBM Cloud #7079
CNTRLPLANE-1648: Remove main-branch build pipelines from release-4.20 #7050
OCPSTRAT-2472: Add latest tag to MCE 2.10 build pipeline #6912
OCPBUGS-62182: fix(kas-bootstrap): increase wait timeouts to avoid KAS startup races #6887
OCPBUGS-62005: Enable VolumeAttributesClass runtime config #6868
OCPBUGS-62006: fix(ignition-server): Don’t delete user-managed cert secrets #6869
OCPBUGS-61863: ci: Use the common MCE konflux pipeline #6847
OCPBUGS-61066: fix: propagate AWSLoadBalancerTargetNodesAnnotation to HCP #6772
OCPBUGS-61575: fix(kas): Set correct container port in postStart handler, 2 #6854
OCPBUGS-61565: [release-4.20] fix(proxy): ensure URLs have scheme before proxy resolution #6791
OCPBUGS-61746: fix(oauth): oauth-openshift deployment should be HA #6828
OCPBUGS-56778: fix(kas): Disable PSA enforcement in 4.20 #6830
CNTRLPLANE-1397: feat(konflux): tag MCE HO images with latest #6784
OCPBUGS-61670: fix(control-plane): remove resource limits from kube-controller-manager #6804
OCPBUGS-61667: resolve MIRRORED_RELEASE_IMAGE flapping #6803
OCPBUGS-61321: rename CCM deployments to align with 4.19 #6768
OCPBUGS-61322: fix: cleanup old PKI operator deployment during upgrades #6769
Full changelog

ibm-cloud-controller-manager

OCPBUGS-120697: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 #112
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-80638: Bump google.golang.org/grpc to v1.79.3 #141
OCPBUGS-77205: [release-4.20] standardize build paths #120
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-103890: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.4 to address CVE-2026-33814 #197
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-86916: Updating ose-ibmcloud-cluster-api-controllers-container image to be consistent with ART for 4.20 #154
OCPBUGS-103886: Replace golang.org/x/net with openshift-sustaining/net #174
Full changelog

ibmcloud-machine-controllers

OCPBUGS-103892: replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 #102
OCPBUGS-81317: bump vpc go sdk #89
NO-JIRA: Modernize test infrastructure to align with other MAPI providers #85
Full changelog

insights-operator

OCPBUGS-129108: Add multicluster gatherer #1382
OCPBUGS-126912: add custom proxy field to insights config #1370
OCPBUGS-103898: Bump golang.org/x/net to v0.50.0-sec.3 #1353
OCPBUGS-111834: secrets and configmap revisions count gathering #1344
OCPBUGS-104608: Fix indentation bug on livenessProbe #1338
OCPBUGS-92001: fall back to kube-system/global-pull-secret for Insights token #1311
OCPBUGS-99788: update HyperShift deployment manifest #1326
OCPBUGS-87870: extractor controller #1304
OCPBUGS-86948: add config option to disable runtime extractor #1298
OCPBUGS-86235: [release-4.20] Add OpenTelemetry CR Gatherer #1293
OCPBUGS-82970: kubeletconfig gathere #1270
OCPBUGS-80641: Bump google.golang.org/grpc to v1.79.3 (Revamp #1261) #1267
OCPBUGS-76961: Extends the time for the extractor liveness probe #1231
OCPBUGS-74902: set Progressing condition on cluster update #1219
OCPBUGS-75114: [bugfix] The ConfigMap value for StoragePath is ignored on basic routine #1222
OCPBUGS-64107: [release-4.20] Patch for GO-2025-4014 #1215
OCPBUGS-66062: Add filtering to add other possible pod status to QEMU gatherer #1185
OCPBUGS-64800: QEMU logs are not gathered if there are pending status virt-launcher pods #1174
OCPBUGS-65660: [bugfix] The archive’s records may include files whose names are out of bounds #1177
OCPBUGS-62019: update DataGather condition when gathering job fails #1155
OCPBUGS-61784: Update error message for missing SCA certificates #1139
OCPBUGS-61845: add missing permissions for replicasets and events #1144
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

insights-runtime-exporter, insights-runtime-extractor

OCPBUGS-77566: remove dnf cache from the container images #66
Full changelog

ironic

OCPBUGS-134139: Lenovo hardware gets stuck on rebooting #942
OCPBUGS-114410: ZTP deployment failed on an iDRAC10 cluster #922
OCPBUGS-105862: update ironic pin to include CVE-2026-54423 fix (release-4.20) #891
OCPBUGS-88477: Updating openstack-ironic commit in requirements.cachito that addresses CVE-2026-43003 #887
OCPBUGS-100166: Update openstack-ironic commit hash for CVE-2026-44918 #881
OCPBUGS-90559: [4.20] Fix parallel power concurrency #857
Bugs OCPBUGS-82295 OCPBUGS-84371: Update sushy and Ironic to resolve ARM SuperMicro boot, Cisco vMedia Insert and BIOS Settings update issues. #830
OCPBUGS-84854: Bump pyasn to 0.5.1-5 #824
OCPBUGS-82299: Bump sushy hash to include Supermicro ARS-111GL-NHR fix #841
OCPBUGS-74405: Update sushy to include DGX B200 credentials fix #820
OCPBUGS-74117: Bump keystonemiddleware version to 10.9.0-0.20260216145500.557d173 for CVE-2026-22797 fix #792
OCPBUGS-77264: fix for minimal builds #800
OCPBUGS-76539: Update ironic hash for 4.20 with heartbeat inspection fix #788
Bug OCPBUGS-76547: Bump 4.20 ironic-image to include firmware update fixes #787
OCPBUGS-69786: Bump eventlet version #756
METAL-1695: OKD: install Ironic from the OpenShift fork #740
OKD-304: Fix python dependencies for OKD #731
OCPBUGS-64850: Handle HTTP 400 and 409 race condition in Redfish power operations #720
OCPBUGS-64820: Fix IPA external inspection callback url override #713
OCPBUGS-52427: Bump ironic and sushy to fix idrac10 #698
OKD-290: (OKD4.20) Fix ironic-image errors and metal3 pod crashes on CentOS9 #696
OCPBUGS-61461: revert the switch to local RPC #690
OCPBUGS-61257: set [json_rpc]port unconditionally #686
Full changelog

ironic-agent

OCPBUGS-99887: Bump ironic-python-agent pinned commit for CVE-2026-66138 #306
OCPBUGS-88477: Updating ironic-python-agent commit hash that fixes CVE-2026-43003 #301
OCPBUGS-95063: Replace individual package removal with a single rpm -e loop #284
OCPBUGS-95063: Replace dnf remove with rpm -e to prevent dependency removal #272
OCPBUGS-77264: fixes for minimal builds #244
OCPBUGS-69777: Bump eventlet version #228
OCPBUGS-66934: Filter out more USB network devices #221
OCPBUGS-66084, OKD-295: Fix broken OKD ironic-agent-image #216
OCPBUGS-65519: Include Test advertised ip reachability before assigning it #212
Full changelog

keepalived-ipfailover

OCPBUGS-99902: Reinstall tzdata if /usr/share/zoneinfo is missing #249
OCPBUGS-78076: openshift-enterprise-base: remove subscription-manager, dbus, systemd #227
Full changelog

kube-metrics-server

NO-ISSUE: synchronize OWNERS from main branch [release-4.20] #88
OCPBUGS-80542: Bump google.golang.org/grpc to v1.79.3 #62
Full changelog

kube-rbac-proxy

OCPBUGS-127952: Replace golang.org/x/net with sustaining_fork version to resolve CVE-2026-39821 (release-4.20) #167
Full changelog

kube-state-metrics

OCPBUGS-130943: backport kube-state-metrics 2.18 memory leak fix #200
OCPBUGS-103899: Use patched x/net fork v0.50.0-sec.4 #166
NO-ISSUE: synchronize OWNERS from main branch [release-4.20] #173
OCPBUGS-99402: fix CronJob timezone panic and embed tzdata in kube-state-metrics #152
Fix for OCPBUGS-81951: CVE-2026-34986 bump github.com/go-jose/go-jose/v4 #144
OCPBUGS-80646: Bump google.golang.org/grpc to v1.79.3 #139
OCPBUGS-72589: fix: only close existing channels #128
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-95086: OWNERS: Update component to Cloud Compute / KubeVirt Provider #80
OCPBUGS-74100: [4.20] sync upstream 2026-01-27 #62
Full changelog

kubevirt-csi-driver

OCPBUGS-80543: Bump google.golang.org/grpc to v1.79.3 #99
OCPBUGS-79064: Add annotation-based fallback for infra VM node ID resolution #84
OCPBUGS-78371: Updating ose-kubevirt-csi-driver-container image to be consistent with ART for 4.20 #78
Full changelog

machine-api-operator

OCPBUGS-133319: fix race in VAP MachineSet e2e test cleanup #1588
OCPBUGS-130608: [release-4.20] Reduce vCenter API load in the vSphere machine controller #1579
SPLAT-2867: Added multi vCenter Day 2 Support #1555
OCPBUGS-129422: vsphere - Cache REST API sessions to prevent excessive vCenter logouts #1573
OCPBUGS-103915: replace golang.org/x/net with openshift-sustaining/net@v0.50.0-sec.4 #1543
OCPBUGS-86849: Populate status label selector for scale subresource #1504
OCPBUGS-83394: Remove cluster-api-provider-libvirt references #1487
OCPBUGS-78424: [release-4.20] Use resource group when generating default Azure image #1475
OCPBUGS-61853: Fixed multi nic e2e to wait for node removal after machineset tests #1418
OCPBUGS-61853: Adjusted machine e2e tests to wait for nodes to clean up #1416
OCPBUGS-61314: bump openshift/api #1410
Full changelog

machine-config-operator

OCPBUGS-132751: Replace wildcard permissions with explicit verbs in MachineConfigServer ClusterRole #6669
OCPBUGS-133362: Split wait-for-ipsec-connect into two services to avoid ipsec restart #6679
OCPBUGS-127495: limit ContainerRuntimeConfig status condition to 3 #6584
OCPBUGS-128460: Correctly handle MC deletion in image mode when no new build is required #6594
OCPBUGS-128658: wrong early exit during kubelet MCs regeneration #6603
OCPBUGS-103920: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #6505
OCPBUGS-115436: Fix SHA idempotency test in nmstate-configuration.sh #6480
OCPBUGS-122109: Update message for MachineOSBuildFailed condition #6518
OCPBUGS-116934: Update AMI Whitelist #6487
OCPBUGS-114390: Use kubernetes scheme in drain controller event recorder #6456
OCPBUGS-111311: Fix duplicate template error #6411
OCPBUGS-105436: Use providerSpec.Template in vSphere machineset reconciliation #6386
OCPBUGS-95577: Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole #6256
OCPBUGS-105215: Update AMI Whitelist #6377
OCPBUGS-99650: Delete stale auto-sizing MachineConfigs for non-default (custom) pools 4.20 #6335
[release:4.20] OCPBUGS-98096: In OCB to check when a image is removed the old build is triggered again and the MC should start updating directly and no new MOSB should be triggred #6285
OCPBUGS-92029, OCPBUGS-98746: [release-4.20] Backport ocl test fixes and shard the test suite #6305
OCPBUGS-93807: move cleanUpDuplicatedMC to avoid double reboot on first updated Master node #6242
OCPBUGS-97906: Inject proxy into MCC deployment #6277
OCPBUGS-98214: fix: update arbiter crio config #6288
OCPBUGS-97824: Make vsphere template updates atomic #6272
OCPBUGS-97844: Remove sensitive ControllerConfig logging #6273
OCPBUGS-97586: Fix kubelet certificate wait loop in criometricsproxy.yaml #6267
OCPBUGS-96160: Update AMI Whitelist #6262
OCPBUGS-94227: Bootstrap MCS logging entire ignition #6251
OCPBUGS-91732: Update custom containerfile OCB test to work in a disconnected environment #6222
OCPBUGS-90969: Process rebuild annotation on machine-os-builder restart #6215
OCPBUGS-91635: daemon: don’t pull/extract extensions for all OS updates #6214
OCPBUGS-88689: Skip chrony-wait on first node join #6191
OCPBUGS-90133: vSphere boot image hot loop detection is non-functional due to stable template names #6207
OCPBUGS-88360: configure-ovs: copy lldp mode to br-ex port #6181
OCPBUGS-86864: Verify extension packages are installed #6114
OCPBUGS-86987: Update AMI Whitelist #6132
OCPBUGS-83862: Generate autosizing-disabled machineconfig only for master and worker nodes on OCP 4.20 #5885
OCPBUGS-81953: Fix CVE-2026-34986 #6033
OCPBUGS-86577: Fix re-cordon detection #6086
OCPBUGS-86134: use --delete-if-present for karg removal #6063
OCPBUGS-86313: Apply password only if changes exist #6075
OCPBUGS-86032: Add terminationMessagePolicy to build pod containers #6057
OCPBUGS-85078: Fix ssh and password rollbacks #6002
OCPBUGS-85336: Fix units rollback if update failure #6022
OCPBUGS-85069: Fix encapsulated IGN version #6001
OCPBUGS-84962: Update AMI Whitelist #5991
OCPBUGS-84890: improve JSON unmarshalling for secret decoding #5916
OCPBUGS-84151: Allow enablement of systemd units with existing files #5873
OCPBUGS-83867: Update AMI Whitelist #5866
OCPBUGS-83393: Use HA leader election defaults for MCO on SNO #5848
OCPBUGS-80947: Skip boot image updates until cluster is stable #5812
OCPBUGS-79370: Re-order logger setting to eliminate race condition #5791
[release 4.20] OCPBUGS-77252: Calculate machine counts in MCP status from node properties #5692
OCPBUGS-79577: Update AMI Whitelist #5806
OCPBUGS-79371: set default-timeout-stop to 200s globally #5792
OCPBUGS-78049: install/0000_80_machine-config_04_kube_rbac_proxy_config: Consistent terminal newline #5753
OCPBUGS-77883: Fix failure domain matching during vsphere boot image updates #5745
OCPBUGS-77950: Update AMI Whitelist #5748
OCPBUGS-77665: Update AMI Whitelist #5731
OCPBUGS-77064: reduce MCO image size #5673
OCPBUGS-77472: Clean up vsphere login error logging #5715
OCPBUGS-77369: Remove MCD liveness probe #5707
OCPBUGS-77181: mcd_config_drift not working properly #5684
OCPBUGS-76921: Prevent unnecessary systemd unit disable #5664
OCPBUGS-77008: Machine-config controller should not log about non-existent pull-secret changes #5668
OCPBUGS-74433: Set NodeDegraded MCN condition when node state annotation is set to Degraded #5649
OCPBUGS-76339: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5631
OCPBUGS-76361: Update AMI script and list #5641
OCPBUGS-74146: enable nodeip-configuration for platform external #5580
OCPBUGS-74298: Fix up bootstrap-e2e #5590
OCPBUGS-73884: pkg/controller/container-runtime-config: admin_ack handling for 4.20-to-4.21 OCI mirror requirement #5558
OCPBUGS-73776: Fix timeout during configMap cleanup #5557
OCPBUGS-74081: Enable existing units without content #5565
OCPBUGS-66260: Set -fin timeouts in HAProxy config #5459
OCPBUGS-70201: ctrcfg: set increase ulimits when upgrading from 4.20 to 4.21 #5516
OCPBUGS-69706: Fix keepalived SIGTERM handling #5507
OCPBUGS-70322: Skip boot image updates if arch annotation is not found #5525
OCPBUGS-70349: Remove the dead code of setting the operator status for cgroupv1 based clusters #5446
OCPBUGS-69666: Remove log exposing kubeconfig #5505
OCPBUGS-69444: MCP is not correctly degraded when a pivotError happens #5503
OCPBUGS-65545, OCPBUGS-67007: cherry pick to few fixes that needed for missing services and configuration #5480
OCPBUGS-67137: Fix cleanup in TestInstallRPMAndCheckMCDMetrics to decrease risk of test failures due to interference #5478
OKD-294: Migrate runtime from runc to crun on an upgrade for OKD #5467
OCPBUGS-65898: fixes systemd unit creation for empty units #5437
OCPBUGS-64822: block upgrades for conflict non-default ClusterImagePolicy resources #5414
OCPBUGS-65777: Enforce OCP 4.20 and earlier cluster to have AutoSizingReserved disabled by default #5387
OCPBUGS-65781: Remove –mount directives #5425
OCPBUGS-65556: [release-4.20] Backport: Add delays to reduce TestOSBuildController failures #5396
OCPBUGS-64822: remove check for conflicting ClusterImagePolicy in syncUpgradeableStatus #5413
OCPBUGS-65509: e2e gcp ocl PR backport #5407
OCPBUGS-64822: Implement upgrade blocking for conflicting ClusterImagePolicy named “openshift” #5397
OCPBUGS-59766: Update timing of MCN desired config spec update to align with node annotation setting #5367
OCPBUGS-64656: Update the OCP base image in Dockerfile to 4.20 reference #5392
OCPBUGS-63534: Create temporal allow policy #5373
OCPBUGS-62167: Fix - NetworkManager restart or crash renders br-ex unusable #5353
OCPBUGS-63127: Ensure the node passed to RunCordonOrUncordon comes from the latest updated state #5349
OCPBUGS-63337: RHEL10 RT kernel packages filtering #5365
OCPBUGS-62801: Only fire OSImageURLOverridden and set metrics on changes #5339
OCPBUGS-62273: Networking: reset ovn-remote config and allow ovnkube controller to s… #5317
OCPBUGS-62803: Skip rpm-ostree local rebase if no PIS #5340
OCPBUGS-62095: CRI-O: set hard/soft file descriptor ulimits to 1048576 #5308
OCPBUGS-62174: Fix MCP updated machine count for image mode disabling case #5307
OCPBUGS-62675: Cert Controller should live fetch SAN IPs during cert rotation #5326
OCPBUGS-62602: configure-ovs: work around a Cisco switch issue #5321
OCPBUGS-62080: Add mcd_local_unsupported_packages recording rule #5297
OCPBUGS-61882: Add nil/null checks to image registry secret decode #5292
OCPBUGS-62073: Improve MCN CRD clean-up script #5296
OCPBUGS-61516: Machine-config controller should actively manage cordon while draining #5281
OCPBUGS-61824: Override NMState service definition #5286
OCPBUGS-61232: Recheck generatedByControllerVersion annotation prior to deleting a degraded MC #5273
Full changelog

machine-image-customization-controller

OCPBUGS-103894: Replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 for CVE-2026-33814 #194
OCPBUGS-81296: Return error when network data Secret lacks nmstate key #172
OCPBUGS-77496: Clean up dnf cache to reduce container image size #165
Full changelog

machine-os-images

OCPBUGS-87874: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #98
OCPBUGS-85480: Force rebuild for OCP 4.20 #94
OCPBUGS-85480: Force rebuild for OCP 4.20 #86
OCPBUGS-71203: Backport multi arch fixes #77
Full changelog

metallb-frr

OCPBUGS-65516: [release-4.20] Dockerfile: unpin FRR rpm #111
Full changelog

monitoring-plugin

OU-1589: [release-4.20] sanitize linkified URLs in alert annotations #1380
OCPBUGS-130565: [release-4.20] escape regex variable values in regex matcher contexts #1346
OU-1392: [release-4.20] fix: parse datetime ranges from the specified format rather than browser specific apis- #1352 #1352
OCPBUGS-118235: [release-4.20] Bump fast-uri to 3.1.7 to fix CVE-2026-84292 #1334
OU-1528: [release-4.20] Optimize namespace changes in Alerts #1310
OCPBUGS-103912: CVE-2026-33814-4-20 openshift4/ose-monitoring-plugin-rhel9: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.20] #1215
NO-JIRA: [release-4.20] Sanitize alert runbook URLs #1293
OCPBUGS-98433: fix for CVE-2026-59869 #1183
OCPBUGS-98773: [release-4.20] replace outdated react-linkify dependency #1166
NO-JIRA: Fix for OCPBUGS-89697 CVE-2026-12143 #1138
OCPBUGS-99027: Fix CVE-2026-49978 - bump DOMPurify to >= 3.4.7 #1087
OU-1240: Makefile and package.json to enable test-frontend-ci #1096
OU-1240: Dockerfile.test permission #1079
OCPBUGS-99297: graph redirect query parameter #1074
OU-651: Fix AlertRules page to display user defined loki alerts #1058
Fix for OCPBUGS-91621: CVE-2026-45736 #1025
NO-JIRA: fix incidents unit test #1039
Fix for OCPBUGS-94012: CVE-2026-13676 #1030
OCPBUGS-87091: [release-4.20] fast-uri: URI authority bypass due to improper delimiter handling #974
OCPBUGS-88372, OCPBUGS-88383, OCPBUGS-88392, OCPBUGS-88428, OCPBUGS-88430, OCPBUGS-88446: CVE-2026-44487 bump axios to 1.16.0 #1000
OCPBUGS-84289: bump follow-redirects to 1.16.0 #986
OCPBUGS-79456: immutable bump: fix for CVE-2026-29063 [4.20] #951
OU-1371: reset queries when namespace changes in dev perspective #945
OU-1369: prevent namespace and project desync #941
OCPBUGS-83495: [release-4.20] feat: re enable dev console views #855
OCPBUGS-83302: [release-4.20] openshift4/ose-monitoring-plugin-rhel9: Axios: Remote Code Execution via Prototype Pollution escalation #888
OCPBUGS-82440: fix: re encode params when redirecting from graph to query-browser #872
OCPBUGS-77406: bump koa #866
OCPBUGS-78359: fix for CVE-2025-69873 #846
OCPBUGS-78425: Updating monitoring-plugin-container image to be consistent with ART for 4.20 #843
OU-1062: [release-4.20] feat: mark alert menu active for incidents tab #826
OCPBUGS-76581: [release-4.20] CVE-2026-25639 openshift4/ose-monitoring-plugin-rhel9: Axios affected by Denial of Service via proto Key in mergeConfig #796
NO-JIRA: [release-4.20] e2e-monitoring fixing loop on legacy dashboard #830
NO-JIRA: [release-4.20] simplify dockerfile by removing cachito dependencies #807
revert #780 #792
OCPBUGS-76581: [release-4.20] CVE-2026-25639 openshift4/ose-monitoring-plugin-rhel9:Axios affected by Denial of Service via proto Key in mergeConfig [openshift-4.20] #780
OCPBUGS-76613: [release-4.20] fix: update vulnerable dependencies #766
OCPBUGS-73842: fix: update qs vulnerable dependency #733
NO-JIRA: [release-4.20] fix: remove unnecessary package.lock #732
OU-1146: remove random multiplication #704
OU-1135: [release-4.20] monitoring testing backport #700
OCPBUGS-69725: [release-4.20] fix: upgrade node-forge vulnerable dependency #701
OU-1130: Merge main to release 4.20 #683
OCPBUGS-66389: Time range and Refresh interval dropdown button lack of unique identifier #668
OCPBUGS-66240: configure max TLS version only when specified #664
OCPBUGS-65947: add missing conversion units #654
OCPBUGS-63440: fetch metric labels with tenancy #617
OCPBUGS-63162: [release-4.20] Improve alignment with console SDK #604
OCPBUGS-62978: allow additional TLS config #592
Full changelog

multus-admission-controller

OCPBUGS-103909: bump golang.org/x/net to v0.35.0-sec.3 to fix CVE-2026-33814 #132
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-103910, OCPBUGS-103913: [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #355
OCPBUGS-120774: [Release 4.20] Cherry-pick fix for the issue of stripping delegate datastore config on CNI DEL, leaking IPAM addresses- #350 #352
OCPBUGS-73737: Fix server url in kubeconfig #273
OCPBUGS-73888: update ci-operator.yaml #274
Full changelog

multus-networkpolicy

OCPBUGS-103918: [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #126
OCPBUGS-77548: Clean up dnf cache #102
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-103917: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #424
Full changelog

must-gather

OCPBUGS-87215: Add Istio/Gateway API gather scripts to OCP 4.20.z #555
OCPBUGS-85488: Collect object size with the object count #545
Full changelog

network-metrics-daemon

OCPBUGS-103914: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #151
Full changelog

networking-console-plugin

maintenance: Bump the npm group with 70 updates #659
OCPNETUI-168: Update Owners file #649
maintenance: Bump the npm group with 32 updates #640
OCPNETUI-180: migrate to @kubevirt-ui-ext/kubevirt-api #630
maintenance: Bump the npm group with 24 updates #623
OCPNETUI-185: Sync Dockerfile with Dockerfile.art #616
maintenance: Bump the npm group with 20 updates #601
OCPNETUI-157: dependency cleanup #593
OCPNETUI-157: reassign dev and prod dependencies #586
maintenance: Bump the npm group with 23 updates #574
maintenance: Bump the npm group across 1 directory with 24 updates #572
OCPNETUI-157: Align shared modules with Console #567
maintenance: Bump the npm group with 15 updates #550
maintenance: Bump the npm group across 1 directory with 20 updates #533
maintenance: Bump the npm group with 227 updates #508
OCPNETUI-82: Lower Dockerfile base image versions #519
OCPBUGS-98776: Updating linkify-it to 5.0.2 to fix CVE-2026-48801 #462
OCPBUGS-92706: Updated doc links based on release #440
OCPBUGS-81615: Fix CVE-2026-CVE-2026-4800 in lodash #399
OCPBUGS-83386: Fix CVE-2026-34043 in serialize-javascript #394
OCPBUGS-84124: Migrate to npm #387
OCPBUGS-77226: Fix NAD creation using default namespace instead of selected one #350
CNV-77540: fix Enable MultiNetworkPolicies lead to invalid URL #342
CNV-76277: Fix name generator with unprofessional names #317
CNV-72230: fix networking links #308
OCPBUGS-66335: fix flickerying in synced editor #304
CNV-72771: fix null error #300
CNV-71965: replacing the broken link to VirtualMachine network docs #298
Hide VirtualMachine networks page in 4.20 release #290
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

nutanix-cloud-controller-manager

OCPBUGS-103916: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 #75
Full changelog

oauth-apiserver

OCPBUGS-103931: Replace golang.org/x/net with github.com/openshift-sustaining/net v0.50.0-sec.4 #222
NO-JIRA: (chore): update OWNERS file #168
OCPBUGS-63052: (bugfix): useroauthaccesstokens: cast delete validation object to correct type for admission #151
OCPBUGS-61753: Bump openshift/kubernetes-apiserver. #147
Full changelog

oauth-proxy

OCPBUGS-112095: bugfix: rewrite open redirect strings to ‘/’ #382
OCPBUGS-74132: test/e2e - do not use ambiguous container image short names #345
Full changelog

oauth-server

OCPBUGS-103923: Replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 for CVE-2026-33814 #283
OCPBUGS-87076: bugfix: default to english when Accept-Language header contains more than 1000 underscores #270
OCPBUGS-81813: Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 #236
OCPBUGS-77500: groupmapper: avoid mutating original group users slice when removing user #214
OCPBUGS-68330: go.mod: bump logrus from v1.9.0 to v1.9.3 to fix CVE-2025-65637 #209
Full changelog

oc-mirror

OCPBUGS-129447: v1 accept catalog root entries and relative symlink targets #1576
OCPBUGS-105780: fix for CVE-2026-39829 #1506
Fix for OCPBUGS-81937: CVE-2026-34986 github.com/go-jose/go-jose/v4 #1427
OCPBUGS-84064: Remove status field from CatalogSource, ClusterCatalog… #1392
OCPBUGS-85204: update integration test Dockerfile #1393
OCPBUGS-77416: Fix registriesd “unknown userid” failure for arbitrary UIDs #1360
OCPBUGS-76630: Fix reg config detection for explicit false values #1350
OCPBUGS-76949: fix conversion issue for catalog #1353
OCPBUGS-75007: [release-4.20] fix duplicated channel bug in filtered catalogs #1347
OCPBUGS-64647: fix: return only requested version #1306
OCPBUGS-65787: Remove empty status field from generated IDMS/ITMS files #1313
OCPBUGS-63030: removes unintended exec permissions #1291
OCPBUGS-62463: generate the archive only after mirroring #1279
OCPBUGS-62283: v2/cli: show binary version in output #1276
And 4 elided commits (e.g. from squash or rebase merges)
Full changelog

olm-catalogd, olm-operator-controller

OCPBUGS-129017: [release-4.20] clean up orphaned catalog cache temp dirs #816
OCPBUGS-103922, OCPBUGS-103927: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #802
OCPBUGS-100431: Fix cache path to avoid /var/cache/dnf conflict #786
OCPBUGS-100075: increase catalog HTTP client timeout from 10s to 5m #777
OCPBUGS-86968: catalogd: clean up orphaned temp dirs in catalog storage #744
OCPBUGS-80662, OCPBUGS-80663: Bump google.golang.org/grpc to v1.79.3 #727
OCPBUGS-81956, OCPBUGS-81957: Bump github.com/go-jose/go-jose/v4@4.1.1 to 4.1.4 #719
OCPBUGS-61890: 🐛 CRD upgrade safety fixes and ratcheting (#2123) #527
NO-ISSUE: add jiazha to approvers #513
OCPBUGS-62811: for incompatible test add func to wait builder and deployer SA creation by OCP controller #503
OCPBUGS-62722: (cherry-pick) Fix truncate large error messages and unhandle changes for crd upgrade safety in status conditions #496
OCPBUGS-61705: Revert “Handle service-ca cert availability/rotation” #474
OCPBUGS-61563: [OTE] Update webhook ote tests to use latest webhook-operator #469
Full changelog

openshift-apiserver

OCPBUGS-82867: Address CVE-2026-35469 #652
OCPBUGS-65848: Add ValidatingAdmissionPolicy and check for omissions next time. #577
OCPBUGS-61982: pkg/image: conditionally parse raw image manifest #559
OCPBUGS-65814: update pkg/image/OWNERS #575
OCPBUGS-61753: Bump openshift/kubernetes-apiserver. #557
OCPBUGS-61494: ensure cache invalidation after a time #553
Full changelog

openshift-controller-manager

OCPBUGS-103921: Use patched x/net fork v0.50.0-sec.4 #459
OCPBUGS-61900: Fix Dockerfile.rhel: Add OTE binary build and packaging for release-4.20 #420
OCPBUGS-61790: CNTRLPLANE-1308: set up openshift-tests-extension for openshift-controller-manager and add a sanity test #418
Full changelog

openshift-state-metrics

NO-ISSUE: synchronize OWNERS from main branch #151
Full changelog

openstack-cluster-api-controllers

UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.12 into release-4.20 #392
OCPBUGS-64814: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.12 into release-4.20 #381
OCPBUGS-64814: Fix verify step #389
Full changelog

openstack-machine-api-provider

OCPBUGS-94016: Revendor CAPO #172
OCPBUGS-69645: Don’t record event for every reconcile #145
OCPBUGS-76790: Fix make test #157
OCPBUGS-74226: Revendor CAPO #148
Full changelog

openstack-resource-controller

OCPBUGS-103790: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 #45
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-103940, OCPBUGS-103947, OCPBUGS-103949: Replace golang.org/x/net with githubcom/openshift-sustaining/net@v0.50.0-sec.3- #1364 #1364
OCPBUGS-95400, OCPBUGS-95403: bumping containerd to v1.7.33 #1352
OCPBUGS-80670, OCPBUGS-80671, OCPBUGS-80672: Bump google.golang.org/grpc to v1.79.3 for CVE-2026-33186[Release-4.20] #1293
OCPBUGS-81958, OCPBUGS-81959, OCPBUGS-81960: Bump github.com/go-jose/go-jose/v4 to v4.1.4 #1295
OCPBUGS-79681: Fix nil pointer dereference in sortUnpackJobs when sorting non-failed jobs #1267
OCPBUGS-81292: add jiazha to approvers #1269
OCPBUGS-77958: Update NetworkPolicy egress for HyperShift custom API ports #1253
OCPBUGS-77230: Remove the collect-profiles info from the microshift kustomization file #1236
OCPBUGS-76335: Remove the collect-profiles job #1223
OCPBUGS-62014: rorfs for cacheless lacks write access to /tmp/ to generate cache #1170
OCPBUGS-64724: Fix TOCTOU race condition in ensureInstallPlan (#3682) #1139
OCPBUGS-61362: [4.20] e2e stability fixes #1077
Full changelog

operator-marketplace

OCPBUGS-77582: Update NetworkPolicy egress to support HyperShift custom API ports #730
OCPBUGS-73876: Update default catalog polling interval to 4h (240m) #708
OCPBUGS-65680: enforce client side auth requirement for metrics endpoint #688
OCPBUGS-62216: Remove Expect func so that the test case can use the retry logic #667
OCPBUGS-61200: Add NetworkPolicy for hypershift #660
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-135938: Handle missing links gracefully in EgressIP reconciliation #3592
OCPBUGS-135008: Add arkadeepsen, martinkennelly and pperiyasamy to OWNERS file #3586
OCPBUGS-74711: [release-4.20] EgressIP annotation corruption causes stale IPs on br-ex after failover #3257
OCPBUGS-121361: Fix UDN controller startup timeout during pod sync #3539
OCPBUGS-128426: egressip: set IFA_PROTO on EgressIP addresses to prevent nmstate persistence- #3437 #3507
OCPBUGS-129457: egressip: fix duplicate IP assignment on control-plane restart #3485
OCPBUGS-41830: add ability to skip tests that require root #3309
OCPBUGS-128980: EIP duplicate MAC race during node shutdown #3506
OCPBUGS-99642: EgressIP: add route policies for east-west traffic between networks #3324
OCPBUGS-105423: Fix traffic leak in egress IP on secondary interface #3376
OCPBUGS-105557: Broadcast traffic fan-out across UDNs hits OVS resubmit limit #3377
OCPBUGS-99643: Migrate ovs external_ids bash ovs-vsctl calls to libovsdb #3326
OCPBUGS-95076: prevent duplicate logical_router_static_route #3275
OCPBUGS-99542: kubevirt: skip source LSP re-enable when source pod is not local #3318
OCPBUGS-99543: kubevirt: Support handling vm hostname field #3319
OCPBUGS-82872: Bump github.com/moby/spdystream to v0.5.1 #3316
OCPBUGS-85366: ANP-Skip redundant status updates to reduce API server load #3183
OCPBUGS-76473: Remove forced V(5) logging during startup #2919
OCPBUGS-72401, OCPBUGS-72402: manual backport bug fixes #2927
OCPBUGS-81484: CUDN: cleanup NADs in terminating namespaces without pods #3102
OCPBUGS-74395: kubevirt, Use pod network subnet gateway IP for DHCP router option #3070
OCPBUGS-82115: egressip: Skip bridge configuration for secondary network IPs #3120
OCPBUGS-84054: [release 4.20] virt: fix SyncVirtualMachines deleting UDN DHCP options during startup #3152
OCPBUGS-78777: Fix NAD Controller syncAll for networkID upgrade from node->NAD #3093
OCPBUGS-81477: node: fix serviceUpdateNotNeeded nil pointer comparison #3099
OCPBUGS-79537: EgressFirewall: Use exponential backoff to refresh IP addresses for DNS names #3088
OCPBUGS-77148: Minimize ACLs by combining ipBlocks into single ACL #2981
OCPBUGS-77357: Clear stale conntrack UDP entries for nodePorts #3012
OCPBUGS-77081, OCPBUGS-77094: [release-4.20] combined backport PR for 2 escalations #2985
OCPBUGS-73788: Fix service flows for BGP on IPV6 #2934
OCPBUGS-74268: release-4.20 fix(localnet, ipamless): Prevent LSP deletion on sync #2941
OCPBUGS-66049: Fix conntrack reconciliation to use service port instead of endpoint port #2874
OCPBUGS-64836: back-port IP & MAC conflict detection #2827
OCPBUGS-65514: [4.20] status manager: remove managedFields for deleted zone upon zone deletion #2855
OCPBUGS-65951: [release-4.20]: Fix linter issues, add missing cheryy-pick bits of #2844 #2866
OCPBUGS-65618: [release-4.20] OCP4: 4.18.22 EgressIP Failover does not succeed - extended downtime and no reassignment between egress-capable peers #2865
OCPBUGS-65605: add lint target to run golanci natively #2856
OCPBUGS-64697: [release-4.20] Referencing pod named ports within a service results in bad DNAT rules containing tcp/0 target port #2844
OCPBUGS-63686: Fix stale EIP assignments during failover and controller restart #2835
OCPBUGS-64590: NetPol & MultiNetPol: Process update only when spec fields and/or related annotation are updated #2841
OCPBUGS-63696: Fixes OF flows to be VLAN aware as well as add DPU checks for certain features #2837
OCPBUGS-63007: kubevirt: fix bad release of IPs of live migratable pods #2801
OCPBUGS-63577: [release-4.20] CORENET-6055: Dockerfile: Unpin OVN and consume the latest from FDP. #2808
OCPBUGS-63631: Skip Pending pods in EgressIP status updates #2831
OCPBUGS-62913: Configure sec nic EIPv6 address with NODAD and maximum lifetime #2797
OCPBUGS-62273: Fix EgressIP stale GARP post reboot + pod restart #2767
OCPBUGS-61453: [4.20] allow default network -> localnet on the same node for any localnet subnet #2751
OCPBUGS-62336: Fix EgressIP controller deadlock by sorting node locks lexicographically #2770
OCPBUGS-61239: Skip node-encap-ips annotation in DPU host mode #2763
OCPBUGS-61778: Adding ovndb-raft-functions.sh to ovnk image #2760
Full changelog

powervs-block-csi-driver

OCPBUGS-101351, OCPBUGS-103945, OCPBUGS-89652, OCPBUGS-89986, OCPBUGS-90451, OCPBUGS-91082, OCPBUGS-92501, OCPBUGS-92964, OCPBUGS-93471, OCPBUGS-94893, OCPBUGS-96442: Bump golang.org dependencies #146
OCPBUGS-80675: Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 #128
OCPBUGS-82873: Fix CVE-2026-35469 by bumping github.com/moby/spdystream to v0.5.1 #122
OCPBUGS-75818: Mitigate CVE-2025-61726 by bumping golang to 1.24.13 #113
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-103934: CVE-2026-33814 - Bump golang.org/x/net to v0.57.0 and golang to 1.25 #123
OCPBUGS-80676: Fix CVE-2026-33186 by bumping google.golang.org/grpc to v1.79.3 #108
OCPBUGS-75820: Mitigate CVE-2025-61726 by bumping golang to 1.24.13 #105
Full changelog

powervs-cloud-controller-manager

OCPBUGS-80677: bump google.golang.org/grpc to v1.79.3 #97
Full changelog

prom-label-proxy

NO-ISSUE: synchronize OWNERS from main branch [release-4.20] #407
OCPBUGS-84068: update to v0.12.1 #393
Full changelog

prometheus

NO-ISSUE: synchronize OWNERS from main branch #381
OCPBUGS-93713: fix for CVE-2026-42151- #358 #358
OCPBUGS-88682: remote: validate snappy decoded length before allocation in read endpoint #342
OCPBUGS-80678: Bump google.golang.org/grpc to v1.79.3 #319
OCPBUGS-86251: fix: TLS client cert rotation when no CA is configured #315
OCPBUGS-78582: [release-4.20] chore(kubernetes): deduplicate warning logs from the API #299
OCPBUGS-62275: chore(scrape): default to legacy validation/escaping scheme until utf-8 is fully supported by prometheus-operator #273
OCPBUGS-61207: chore: compute highestTimestamp at queryManager level #264
Full changelog

prometheus-alertmanager

NO-JIRA: synchronize OWNERS with main #197
OCPBUGS-103946: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #170
OCPBUGS-98175: build(deps): bump github.com/hashicorp/memberlist to a… #160
OCPBUGS-100353: Set testdata CA expiry to 20 years from issue date (#4112) #149
OCPBUGS-99449: embed tzdata in the alertmanager binary #143
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

NO-ISSUE: synchronize OWNERS from main branch #414
OCPBUGS-103950, OCPBUGS-103952: [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #395
OCPBUGS-77296: backport upstream fix to reconcile resources with inconsistent status #367
OCPBUGS-77190: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #362
Full changelog

prometheus-node-exporter

OCPBUGS-103944: CVE-2026-33814 openshift4/ose-prometheus-node-exporter-rhel9: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.20] #214
NO-ISSUE: synchronize OWNERS from main branch [release-4.20] #205
OCPBUGS-63624: bump github.com/prometheus/procfs to v0.16.1 #173
Full changelog

rhel-coreos, rhel-coreos-extensions

OCPBUGS-105533: NetworkManager-ovs has moved to RHCOS #1959
NO-JIRA: rhaos-pkgs-match-openshift: exclude known package mismatches #1920
OCPBUGS-82524: post-process: Remove workaround for openvswitch additional group #1928
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

route-controller-manager

OCPBUGS-103792: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #108
OCPBUGS-80554: Bump google.golang.org/grpc to v1.79.3 #83
OCPBUGS-76957: filter ingress namespace on UnmanagedRoutes metric #74
Full changelog

service-ca-operator

OCPBUGS-61966: don’t hotloop on secret creation errors #275
Full changelog

telemeter

OCPBUGS-80691: Bump google.golang.org/grpc to v1.79.3 #590
OCPBUGS-81814: [release-1.20] Fix CVE-2026-34986 #594
Full changelog

tests

OCPBUGS-130854: stage the creation of test pods to minimize etcd impact #31746
OCPBUGS-117011: Raise status polling timeout and write bound #31596
OCPBUGS-114440: Fix probe termination test to use pod status instead of kubelet event text #31570
OCPBUGS-100440: retry GetVotingMemberNames on transient etcd client fails #31508
OCPBUGS-99782: Backport node_e2e test migrations #31430
OCPBUGS-99301: admit and extract non-payload 4.20 #31387
OCPBUGS-85523: Remove restriction of unmanaged x-k8s.io #31351
OCPBUGS-91996: Add openshift/disruptive-longrunning testsuite in release-4.20 branch #31334
OCPBUGS-82147, OCPBUGS-92038, OCPBUGS-92039, OCPBUGS-92041, OCPBUGS-92042, OCPBUGS-92043, OCPBUGS-92044, OCPBUGS-92045: Backport noOLM Gateway API test coverage and upgrade tests #31322
OCPBUGS-87902: tests: authorization/rbac: Align restricted-v3 rule #31285
OCPBUGS-85155, OCPBUGS-87207: Enable Gateway API tests on vSphere and baremetal #31262
OCPBUGS-87902: tests: authorization/rbac: Add restricted-v3 scc #30502
: OCPBUGS-77313: Add test for CPMS OnDelete strategy with full master replacement #30882
OCPBUGS-78193: Exclude disruption during NoExecuteTaintManager serial tests #30858
OCPBUGS-83447: Fix PinnedImages test to respect node taints #30970
: run resource request/limit check early #30888
OCPBUGS-78025: Skip oauth test for external control plane topology #30848
OCPBUGS-78084: Update optimized builds test to use rpm -qa instead of dnf #30861
OCPBUGS-78084: Allow test to tolerate running on minimal images #30853
OCPBUGS-77824: add the missing namespace from managed openshift #30837
OCPBUGS-77776: Update MCN tests to better handle condition transitions through the “Unknown” state #30829
OCPBUGS-72395: Unrevert TLS tests with fixes #30668
OCPBUGS-72412, OCPBUGS-72413: only run Netpol two at a time #30666
OCPBUGS-69686: BeforeEach was indirectly called in DetermineReleasePayloadImage #30620
OCPBUGS-66072: [release-4.20] net(virt) remove virtctl if not correctly retrieved #30538
OCPBUGS-64836: back-port IP & MAC conflict detection e2e tests #30414
OCPBUGS-66963: Fix MachineConfigNode test in two-node fencing clusters #30540
OCPBUGS-66365: update watch request limits for marketplace-operator #30569
OCPBUGS-66979: Revert “OCPNODE-3912: Add a test for NodeSizing default change to OCP 4.20” #30582
OCPNODE-3912: Add a test for NodeSizing default change to OCP 4.20 #30467
OCPBUGS-64777: [release-4.20] Add e2e tests for storage network policy #30468
OCPBUGS-46422: Add test that the ServiceCIDR API is blocked [4.20] #30434
OCPBUGS-63656: Redact bearertoken in TestContext #30435
OCPBUGS-64598: Updated the upgrade duration limit to 100 minutes for ppc64le #30451
OCPBUGS-64593: [release-4.20] NO-JIRA: Filter preconfiguredIPs based on cluster IP family support #30415
OCPBUGS-63725: CNTRLPLANE-1766:fix(disruption): Using correct internal LB of apiserver for monitor test on ARO and Baremetal Hypershift #30439
OCPBUGS-63171: Add imagestream update dryrun test #30389
OCPBUGS-63513: Migrate OCP-32383 to upstream #30423
OCPBUGS-62841: fix(test): prevent nil pointer dereference in ginkgo test runner #30350
OCPBUGS-46422: Skip ServiceCIDR in etcd_storage_path test (4.20) #30257
OCPBUGS-62695: cherry-pick 30270 to release-4.20 #30335
OCPBUGS-62231: network test isolation and reduced parallelization to protect cpu #30300
Revert “[release-4.20] OCPBUGS-62140:OCPSTRAT-2045:Automating OCPSTRAT-2045 feature in upstream” #30303
OCPBUGS-62140: OCPSTRAT-2045:Automating OCPSTRAT-2045 feature in upstream #30299
OCPBUGS-61757: test/extended/cli/adm_upgrade/recommend: Enable precheck and accept #30260
OCPBUGS-62075: Temporarily remove commatrix documentation test for rework #30287
OCPBUGS-62007: oidc: improve rollout wait times #30284
CNF-18661: Update vendor with communication matrix bug fixes on 4.20 #30271
OCPBUGS-61734: Restore retries for flaky port foward test #30266
OCPBUGS-61540: chore(extended/prometheus): ²⁄₂: make ‘targets auth’ test more lenient and more resilient #30263
OCPBUGS-61744: update machines scale test #30258
OCPBUGS-61732: [release-4.20] CNTRLPLANE-945: oidc: add retry logic for Keycloak route creation #30251
OCPBUGS-61731: [release-4.20] CNTRLPLANE-945: images: add keycloak images and use them in ExternalOIDC tests #30250
OCPBUGS-61600: Skip config-operator checking when featureSet is DevPreviewNoUpgrade #30245
OCPBUGS-61540: chore(extended/prometheus): make ‘targets auth’ test more lenient and more resilient. #30237
OCPBUGS-61478: Add flaky kubectl logs test to the retry list to clean signal for release #30231
OCPBUGS-61333: Bump to latest openshift/kubernetes (v1.33.4) #30228
OCPBUGS-61286: Mark etcd net overload logging test as a flake #30214
CNTRLPLANE-1306: Enable OTE for cluster-kube-storage-version-migrator-operator #30213
CNTRLPLANE-945: [release-4.20] CNTRLPLANE-945: improve logging, add startup probe to Keycloak Deployment #30204
Full changelog

thanos

OCPBUGS-129055: Bump github.com/klauspost/compress to fix CVE-2026-63209 #230
OCPBUGS-80693: Bump google.golang.org/grpc to v1.79.3 #182
Full changelog

volume-data-source-validator

OCPBUGS-103985: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.3 #20
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-103963: Replace golang.org/x/net with sustaining fork for CVE-2026-33814 in 4.20 #133
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-103968: Bump golang.org/x/net to github.com/openshift-sustaining/net v0.50.0-sec.4 CVE-2026-33814 [release-4.20] #126
OCPBUGS-80698: Bump google.golang.org/grpc to v1.79.3 #109
OCPBUGS-78436: Updating ose-vsphere-cluster-api-controllers-container image to be consistent with ART for 4.20 #92
OCPBUGS-61647: Fix unit tests #68
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-96458: Bump golang.org/x/net to v0.50.0-sec.4 #197
OCPBUGS-92959: Bump golang.org/x/crypto/ssh to v0.48.0-sec.1 #191
OCPBUGS-80701: Bump google.golang.org/grpc to v1.79.3 #174
Full changelog

vsphere-csi-driver-operator

OCPBUGS-103996: Bump golang.org/x/net to v0.50.0-sec.3 #354
”[release-4.20] OCPBUGS-84891: Fix escaping password” #340
Full changelog

vsphere-problem-detector

OCPBUGS-130578: Fixed GetVCenter to handle removed FDs better #246
OCPBUGS-88024: Fixed compute cluster permission logic for single fd with read-only custom resourcepool #225
OCPBUGS-103980: Bump golang.org/x/net to v0.50.0-sec.4 #231
OCPBUGS-74901: fix concurrent map writes #208
OCPBUGS-65795: Fixed logic for vSphere compute cluster permission #197
Full changelog

Node Image Info

Loading node image info, this may take a while ...

Red Hat Enterprise Linux CoreOS (`rhel-coreos`)

Package List

cri-o-1.33.13-9.rhaos4.20.gitd6a41c4.el9
kernel-5.14.0-570.154.1.el9_6
openshift-kubelet-4.20.0-202610221619.p2.g8008e65.assembly.stream.el9
systemd-252-51.el9_6.6

Full list (564 packages)

NetworkManager-1:1.52.0-11.el9_6.1
NetworkManager-cloud-setup-1:1.52.0-11.el9_6.1
NetworkManager-libnm-1:1.52.0-11.el9_6.1
NetworkManager-ovs-1:1.52.0-11.el9_6.1
NetworkManager-team-1:1.52.0-11.el9_6.1
NetworkManager-tui-1:1.52.0-11.el9_6.1
WALinuxAgent-udev-2.13.1.1-1.el9_6
aardvark-dns-2:1.14.0-1.el9
acl-2.4.0-0.el9_6.1
adcli-0.9.2-1.el9
afterburn-5.9.0-1.el9_6
afterburn-dracut-5.9.0-1.el9_6
alternatives-1.24-2.el9
attr-2.5.1-3.el9
audit-3.1.5-4.el9
audit-libs-3.1.5-4.el9
authselect-1.2.6-3.el9
authselect-libs-1.2.6-3.el9
avahi-libs-0.8-22.el9_6.1
basesystem-11-13.el9
bash-5.1.8-9.el9
bash-completion-1:2.11-5.el9
bind-libs-32:9.16.23-31.el9_6.5
bind-license-32:9.16.23-31.el9_6.5
bind-utils-32:9.16.23-31.el9_6.5
binutils-2.35.2-63.el9_6.1
binutils-gold-2.35.2-63.el9_6.1
bootc-1.1.6-6.el9_6
bootupd-0.2.35-1.el9_6
bsdtar-3.5.3-7.el9_6.2
bubblewrap-0.4.1-8.el9_6.1
bzip2-1.0.8-10.el9_5
bzip2-libs-1.0.8-10.el9_5
c-ares-1.19.1-2.el9_4
ca-certificates-2026.2.92_v9.0.319-90.3.el9_6
checkpolicy-3.6-1.el9
chrony-4.6.1-1.el9
cifs-utils-7.2-0.el9_6.2
clevis-21-208.el9
clevis-dracut-21-208.el9
clevis-luks-21-208.el9
clevis-systemd-21-208.el9
cloud-utils-growpart-0.33-1.el9
composefs-1.0.8-1.el9
composefs-libs-1.0.8-1.el9
conmon-3:2.1.12-1.el9_6.1
conmon-rs-0.6.6-0.rhaos4.18.el9.1
console-login-helper-messages-0.21.3-1.el9
console-login-helper-messages-issuegen-0.21.3-1.el9
console-login-helper-messages-profile-0.21.3-1.el9
container-selinux-4:2.247.0-1.el9_6
containernetworking-plugins-1:1.6.2-3.el9_6.1
containers-common-2:1-117.el9_6
coreos-installer-0.24.0-6.el9_6
coreos-installer-bootinfra-0.24.0-6.el9_6
coreutils-8.32-39.el9
coreutils-common-8.32-39.el9
cpio-2.13-16.el9
cracklib-2.9.6-27.el9
cracklib-dicts-2.9.6-27.el9
cri-o-1.33.13-9.rhaos4.20.gitd6a41c4.el9
cri-tools-1.33.0-7.el9
criu-3.19-1.3.el9_6
criu-libs-3.19-1.3.el9_6
crun-1.27-1.el9_6
crypto-policies-20250128-1.git5269e22.el9
crypto-policies-scripts-20250128-1.git5269e22.el9
cryptsetup-2.7.2-3.el9_6.1
cryptsetup-libs-2.7.2-3.el9_6.1
curl-7.76.1-31.el9_6.4
cyrus-sasl-gssapi-2.1.27-21.el9
cyrus-sasl-lib-2.1.27-21.el9
dbus-1:1.12.20-8.el9
dbus-broker-28-7.el9
dbus-common-1:1.12.20-8.el9
dbus-libs-1:1.12.20-8.el9
dbus-tools-1:1.12.20-8.el9
device-mapper-9:1.02.202-6.el9
device-mapper-event-9:1.02.202-6.el9
device-mapper-event-libs-9:1.02.202-6.el9
device-mapper-libs-9:1.02.202-6.el9
device-mapper-multipath-0.8.7-35.el9_6.3
device-mapper-multipath-libs-0.8.7-35.el9_6.3
device-mapper-persistent-data-1.1.0-1.el9
diffutils-3.7-12.el9
dmidecode-1:3.6-1.el9
dnf-4.14.0-25.el9
dnf-data-4.14.0-25.el9
dnsmasq-2.85-17.el9_6.2
dosfstools-4.2-3.el9
dracut-057-89.git20250311.el9_6.1
dracut-network-057-89.git20250311.el9_6.1
dracut-squash-057-89.git20250311.el9_6.1
e2fsprogs-1.46.5-7.el9
e2fsprogs-libs-1.46.5-7.el9
efi-filesystem-6-2.el9_0
efibootmgr-16-12.el9
efivar-libs-38-3.el9
elfutils-debuginfod-client-0.192-6.el9_6
elfutils-default-yama-scope-0.192-6.el9_6
elfutils-libelf-0.192-6.el9_6
elfutils-libs-0.192-6.el9_6
ethtool-2:6.11-1.el9
expat-2.5.0-5.el9_6.1
fcoe-utils-1.0.34-0.git14ef0d2.el9
file-5.39-16.el9
file-libs-5.39-16.el9
filesystem-3.16-5.el9
findutils-1:4.8.0-7.el9
firewalld-filesystem-1.3.4-15.el9_6.1
fstrm-0.6.1-3.el9
fuse-2.9.9-17.el9
fuse-common-3.10.2-9.el9
fuse-libs-2.9.9-17.el9
fuse-overlayfs-1.14-1.el9
fuse3-3.10.2-9.el9
fuse3-libs-3.10.2-9.el9
fwupd-2.1.6-1.el9_6
gawk-5.1.0-6.el9
gawk-all-langpacks-5.1.0-6.el9
gdbm-libs-1:1.23-1.el9
gdisk-1.0.7-5.el9
geolite2-city-20191217-6.el9
geolite2-country-20191217-6.el9
gettext-0.21-8.el9
gettext-libs-0.21-8.el9
git-core-2.47.3-1.el9_6
glib2-2.68.4-16.el9_6.8
glibc-2.34-168.el9_6.25
glibc-common-2.34-168.el9_6.25
glibc-gconv-extra-2.34-168.el9_6.25
glibc-minimal-langpack-2.34-168.el9_6.25
glusterfs-6.0-57.4.el9
glusterfs-client-xlators-6.0-57.4.el9
glusterfs-fuse-6.0-57.4.el9
glusterfs-libs-6.0-57.4.el9
gmp-1:6.2.0-13.el9
gnupg2-2.3.3-4.el9_6.1
gnutls-3.8.3-6.el9_6.5
gobject-introspection-1.68.0-11.el9
gpgme-1.15.1-6.el9
grep-3.6-5.el9
groff-base-1.22.4-10.el9
grub2-common-1:2.06-105.el9_6.2
grub2-efi-x64-1:2.06-105.el9_6.2
grub2-pc-1:2.06-105.el9_6.2
grub2-pc-modules-1:2.06-105.el9_6.2
grub2-tools-1:2.06-105.el9_6.2
grub2-tools-minimal-1:2.06-105.el9_6.2
gssproxy-0.8.4-7.el9
gzip-1.12-1.el9
hostname-3.23-6.el9
hwdata-0.348-9.18.el9
ignition-2.21.0-7.el9_6.2
ignition-grub-2.21.0-7.el9_6.2
ima-evm-utils-1.5-3.el9
info-6.7-15.el9
inih-49-6.el9
initscripts-service-10.11.8-4.el9
ipcalc-1.0.0-5.el9
iproute-6.11.0-1.el9
iproute-tc-6.11.0-1.el9
iptables-libs-1.8.10-11.el9_5
iptables-nft-1.8.10-11.el9_5
iputils-20210202-11.el9_6.3
irqbalance-2:1.9.4-2.el9_6.2
iscsi-initiator-utils-6.2.1.9-1.gita65a472.el9_6.3
iscsi-initiator-utils-iscsiuio-6.2.1.9-1.gita65a472.el9_6.3
isns-utils-libs-0.101-4.el9_6.1
jansson-2.14-1.el9
jose-14-1.el9
jq-1.6-17.el9_6.4
json-c-0.14-11.el9
json-glib-1.6.6-1.el9
kbd-2.4.0-11.el9
kbd-legacy-2.4.0-11.el9
kbd-misc-2.4.0-11.el9
kernel-5.14.0-570.154.1.el9_6
kernel-core-5.14.0-570.154.1.el9_6
kernel-modules-5.14.0-570.154.1.el9_6
kernel-modules-core-5.14.0-570.154.1.el9_6
kernel-modules-extra-5.14.0-570.154.1.el9_6
kexec-tools-2.0.29-5.el9_6.2
keyutils-1.6.3-1.el9
keyutils-libs-1.6.3-1.el9
kmod-28-10.el9
kmod-libs-28-10.el9
kpartx-0.8.7-35.el9_6.3
krb5-libs-1.21.1-8.el9_6.2
less-590-5.el9
libacl-2.4.0-0.el9_6.1
libaio-0.3.111-13.el9
libarchive-3.5.3-7.el9_6.2
libassuan-2.5.5-3.el9
libattr-2.5.1-3.el9
libbasicobjects-0.1.1-53.el9
libblkid-2.37.4-21.el9_6.1
libbpf-2:1.5.0-1.el9
libbrotli-1.0.9-7.el9_6.3
libcap-2.48-9.el9_6.1
libcap-ng-0.8.2-7.el9
libcbor-0.7.0-5.el9
libcollection-0.7.0-53.el9
libcom_err-1.46.5-7.el9
libcomps-0.1.18-1.el9
libconfig-1.7.2-9.el9
libcurl-7.76.1-31.el9_6.4
libdaemon-0.14-23.el9
libdb-5.3.28-57.el9_6
libdhash-0.5.0-53.el9
libdnf-0.69.0-13.el9
libdnf-plugin-subscription-manager-1.29.45.1-1.el9_6
libdrm-2.4.123-2.el9
libeconf-0.4.1-4.el9
libedit-3.1-38.20210216cvs.el9
libev-4.33-6.el9
libevent-2.1.12-8.el9_4
libfdisk-2.37.4-21.el9_6.1
libffi-3.4.2-8.el9
libfido2-1.13.0-2.el9
libgcc-11.5.0-5.el9_5
libgcrypt-1.10.0-11.el9_6.1
libgomp-11.5.0-5.el9_5
libgpg-error-1.42-5.el9
libibverbs-54.0-2.el9_6
libicu-67.1-10.el9_6
libidn2-2.3.0-7.el9
libini_config-1.3.1-53.el9
libipa_hbac-2.9.6-4.el9_6.5
libjcat-0.1.6-3.el9
libjose-14-1.el9
libkcapi-1.4.0-2.el9_6.1
libkcapi-hmaccalc-1.4.0-2.el9_6.1
libksba-1.5.1-7.el9
libldb-4.21.3-14.el9_6.1
libluksmeta-9-12.el9
libmaxminddb-1.5.2-4.el9
libmicrohttpd-1:0.9.72-5.el9
libmnl-1.0.4-16.el9_4
libmodulemd-2.13.0-2.el9
libmount-2.37.4-21.el9_6.1
libmspack-0.10.1-0.7.alpha.el9
libndp-1.9-1.el9
libnet-1.2-7.el9
libnetfilter_conntrack-1.0.9-1.el9
libnfnetlink-1.0.1-23.el9_5
libnfsidmap-1:2.5.4-34.el9_6.5
libnftnl-1.2.6-4.el9_4
libnghttp2-1.43.0-6.el9_6.1
libnl3-3.11.0-1.el9
libnl3-cli-3.11.0-1.el9
libnvme-1.11.1-1.el9
libpath_utils-0.2.1-53.el9
libpcap-14:1.10.0-4.el9
libpciaccess-0.16-7.el9
libpkgconf-1.7.3-10.el9
libpsl-0.21.1-5.el9
libpwquality-1.4.4-8.el9
libref_array-0.1.5-53.el9
librepo-1.14.5-2.el9
libreport-filesystem-2.15.2-6.el9
librhsm-0.0.3-9.el9
libseccomp-2.5.2-2.el9
libselinux-3.6-3.el9
libselinux-utils-3.6-3.el9
libsemanage-3.6-5.el9_6
libsepol-3.6-2.el9
libsigsegv-2.13-4.el9
libslirp-4.4.0-8.el9
libsmartcols-2.37.4-21.el9_6.1
libsmbclient-4.21.3-14.el9_6.1
libsolv-0.7.24-3.el9_6.1
libss-1.46.5-7.el9
libssh-0.10.4-15.el9_6.1
libssh-config-0.10.4-15.el9_6.1
libsss_certmap-2.9.6-4.el9_6.5
libsss_idmap-2.9.6-4.el9_6.5
libsss_nss_idmap-2.9.6-4.el9_6.5
libsss_sudo-2.9.6-4.el9_6.5
libstdc++-11.5.0-5.el9_5
libtalloc-2.4.2-1.el9
libtasn1-4.16.0-9.el9
libtdb-1.4.12-1.el9
libteam-1.31-16.el9_1
libtevent-0.16.1-1.el9
libtirpc-1.3.3-9.el9
libtool-ltdl-2.4.6-46.el9
libunistring-0.9.10-15.el9
liburing-2.5-1.el9
libusbx-1.0.30-1.el9_6
libuser-0.63-16.el9
libutempter-1.2.1-6.el9
libuuid-2.37.4-21.el9_6.1
libuv-1:1.42.0-2.el9_4
libverto-0.3.2-3.el9
libverto-libev-0.3.2-3.el9
libwbclient-4.21.3-14.el9_6.1
libxcrypt-4.4.18-3.el9
libxcrypt-compat-4.4.18-3.el9
libxml2-2.9.13-13.el9_6
libxmlb-0.3.28-1.el9_6
libxslt-1.1.34-13.el9_6.2
libyaml-0.2.5-7.el9
libzstd-1.5.5-1.el9
linux-firmware-20251111-151.8.el9_6
linux-firmware-whence-20251111-151.8.el9_6
lldpad-1.1.1-4.gitf1dd9eb.el9
lmdb-libs-0.9.29-3.el9
logrotate-3.18.0-9.el9
lsof-4.94.0-3.el9
lua-libs-5.4.4-4.el9
luksmeta-9-12.el9
lvm2-9:2.03.28-6.el9
lvm2-libs-9:2.03.28-6.el9
lz4-libs-1.9.3-5.el9
lzo-2.10-7.el9
mdadm-4.3-8.el9_6.1
microcode_ctl-4:20250211-1.20260227.1.el9_6
mokutil-2:0.6.0-4.el9
mpfr-4.1.0-7.el9
nano-5.6.1-7.el9
ncurses-6.2-10.20210508.el9_6.2
ncurses-base-6.2-10.20210508.el9_6.2
ncurses-libs-6.2-10.20210508.el9_6.2
net-tools-2.0-0.64.20160912git.el9
netavark-2:1.14.1-1.el9_6.1
nettle-3.10.1-1.el9
newt-0.52.21-11.el9
nfs-utils-1:2.5.4-34.el9_6.5
nftables-1:1.0.9-6.el9_6.1
nmap-ncat-3:7.92-3.el9
nmstate-2.2.60-1.el9_6.1
npth-1.6-8.el9
nss-altfiles-2.18.1-20.el9
numactl-libs-2.0.19-1.el9
numad-0.5-37.20150602git.el9
nvme-cli-2.11-7.el9_6
oniguruma-6.9.6-1.el9.6
open-vm-tools-12.5.0-1.el9_6.2
openldap-2.6.8-4.el9
openshift-clients-4.20.0-202610221619.p2.gef515cf.assembly.stream.el9
openshift-kubelet-4.20.0-202610221619.p2.g8008e65.assembly.stream.el9
openssh-8.7p1-45.el9_6.5
openssh-clients-8.7p1-45.el9_6.5
openssh-server-8.7p1-45.el9_6.5
openssl-1:3.2.2-7.el9_6.4
openssl-fips-provider-3.0.7-11.el9_0
openssl-fips-provider-so-3.0.7-11.el9_0
openssl-libs-1:3.2.2-7.el9_6.4
openvswitch-selinux-extra-policy-1.0-39.el9fdp
openvswitch3.5-3.5.2-72.el9fdp.3
os-prober-1.77-12.el9_5
ose-aws-ecr-image-credential-provider-4.20.0-202610221619.p2.gbb88da1.assembly.stream.el9
ose-azure-acr-image-credential-provider-4.20.0-202610221619.p2.g5e41860.assembly.stream.el9
ose-gcp-gcr-image-credential-provider-4.20.0-202611040818.p2.g9502c2e.assembly.stream.el9
ostree-2025.2-4.el9_6
ostree-grub2-2025.2-4.el9_6
ostree-libs-2025.2-4.el9_6
p11-kit-0.25.3-3.el9_5
p11-kit-trust-0.25.3-3.el9_5
pam-1.5.1-26.el9_6.1
passt-0^20250217.ga1e48a0-14.el9_6
passt-selinux-0^20250217.ga1e48a0-14.el9_6
passwd-0.80-12.el9
pciutils-3.7.0-7.el9
pciutils-libs-3.7.0-7.el9
pcre-8.44-4.el9
pcre2-10.40-6.el9_6.1
pcre2-syntax-10.40-6.el9_6.1
perl-AutoLoader-5.74-481.1.el9_6
perl-B-1.80-481.1.el9_6
perl-Carp-1.50-460.el9
perl-Class-Struct-0.66-481.1.el9_6
perl-Data-Dumper-2.174-462.el9
perl-Digest-1.19-4.el9
perl-Digest-MD5-2.58-4.el9
perl-Encode-4:3.08-462.el9
perl-Errno-1.30-481.1.el9_6
perl-Exporter-5.74-461.el9
perl-Fcntl-1.13-481.1.el9_6
perl-File-Basename-2.85-481.1.el9_6
perl-File-Path-2.18-4.el9
perl-File-Temp-1:0.231.100-4.el9
perl-File-stat-1.09-481.1.el9_6
perl-FileHandle-2.03-481.1.el9_6
perl-Getopt-Long-1:2.52-4.el9
perl-Getopt-Std-1.12-481.1.el9_6
perl-HTTP-Tiny-0.076-462.el9
perl-IO-1.43-481.1.el9_6
perl-IO-Socket-IP-0.41-5.el9
perl-IO-Socket-SSL-2.073-2.el9
perl-IPC-Open3-1.21-481.1.el9_6
perl-MIME-Base64-3.16-4.el9
perl-Mozilla-CA-20200520-6.el9
perl-NDBM_File-1.15-481.1.el9_6
perl-Net-SSLeay-1.94-1.el9
perl-POSIX-1.94-481.1.el9_6
perl-PathTools-3.78-461.el9
perl-Pod-Escapes-1:1.07-460.el9
perl-Pod-Perldoc-3.28.01-461.el9
perl-Pod-Simple-1:3.42-4.el9
perl-Pod-Usage-4:2.01-4.el9
perl-Scalar-List-Utils-4:1.56-462.el9
perl-SelectSaver-1.02-481.1.el9_6
perl-Socket-4:2.031-4.el9
perl-Storable-1:3.21-460.el9
perl-Symbol-1.08-481.1.el9_6
perl-Term-ANSIColor-5.01-461.el9
perl-Term-Cap-1.17-460.el9
perl-Text-ParseWords-3.30-460.el9
perl-Text-Tabs+Wrap-2013.0523-460.el9
perl-Time-Local-2:1.300-7.el9
perl-URI-5.09-3.el9
perl-base-2.27-481.1.el9_6
perl-constant-1.33-461.el9
perl-if-0.60.800-481.1.el9_6
perl-interpreter-4:5.32.1-481.1.el9_6
perl-libnet-3.13-4.el9
perl-libs-4:5.32.1-481.1.el9_6
perl-mro-1.23-481.1.el9_6
perl-overload-1.31-481.1.el9_6
perl-overloading-0.02-481.1.el9_6
perl-parent-1:0.238-460.el9
perl-podlators-1:4.14-460.el9
perl-subs-1.03-481.1.el9_6
perl-vars-1.05-481.1.el9_6
pigz-2.8-1.el9
pkgconf-1.7.3-10.el9
pkgconf-m4-1.7.3-10.el9
pkgconf-pkg-config-1.7.3-10.el9
podman-5:5.4.0-22.el9_6.5
policycoreutils-3.6-2.1.el9
policycoreutils-python-utils-3.6-2.1.el9
polkit-0.117-13.el9
polkit-libs-0.117-13.el9
polkit-pkla-compat-0.1-21.el9
popt-1.18-8.el9
procps-ng-3.3.17-14.el9
protobuf-c-1.3.3-13.el9
psmisc-23.4-3.el9
publicsuffix-list-dafsa-20210518-3.el9
python-unversioned-command-3.9.21-2.el9_6.7
python3-3.9.21-2.el9_6.7
python3-audit-3.1.5-4.el9
python3-chardet-4.0.0-5.el9
python3-cloud-what-1.29.45.1-1.el9_6
python3-dateutil-1:2.8.1-7.el9
python3-dbus-1.2.18-2.el9
python3-decorator-4.4.2-6.el9
python3-distro-1.5.0-7.el9
python3-dnf-4.14.0-25.el9
python3-dnf-plugin-versionlock-4.3.0-20.el9
python3-dnf-plugins-core-4.3.0-20.el9
python3-gobject-base-3.40.1-6.el9
python3-gobject-base-noarch-3.40.1-6.el9
python3-gpg-1.15.1-6.el9
python3-hawkey-0.69.0-13.el9
python3-idna-2.10-7.el9_4.1
python3-iniparse-0.4-45.el9
python3-inotify-0.9.6-25.el9
python3-libcomps-0.1.18-1.el9
python3-libdnf-0.69.0-13.el9
python3-librepo-1.14.5-2.el9
python3-libs-3.9.21-2.el9_6.7
python3-libselinux-3.6-3.el9
python3-libsemanage-3.6-5.el9_6
python3-pip-wheel-21.3.1-1.el9
python3-policycoreutils-3.6-2.1.el9
python3-pysocks-1.7.1-12.el9
python3-pyyaml-5.4.1-6.el9
python3-requests-2.25.1-10.el9_6
python3-rpm-4.16.1.3-37.el9
python3-setools-4.4.4-1.el9
python3-setuptools-53.0.0-13.el9_6.1
python3-setuptools-wheel-53.0.0-13.el9_6.1
python3-six-1.15.0-9.el9
python3-subscription-manager-rhsm-1.29.45.1-1.el9_6
python3-systemd-234-19.el9
python3-urllib3-1.26.5-6.el9_6.2
qemu-guest-agent-17:9.1.0-15.el9_6.20
quota-1:4.09-4.el9
quota-nls-1:4.09-4.el9
rdma-core-54.0-2.el9_6
readline-8.1-4.el9
redhat-release-9.6-0.1.el9
redhat-release-eula-9.6-0.1.el9
rpcbind-1.2.6-7.el9
rpm-4.16.1.3-37.el9
rpm-build-libs-4.16.1.3-37.el9
rpm-libs-4.16.1.3-37.el9
rpm-ostree-2025.6-6.el9_6
rpm-ostree-libs-2025.6-6.el9_6
rpm-plugin-selinux-4.16.1.3-37.el9
rpm-plugin-systemd-inhibit-4.16.1.3-37.el9
rpm-sign-libs-4.16.1.3-37.el9
rsync-3.2.5-3.el9_6.1
runc-4:1.2.9-3.el9_6.1
samba-client-libs-4.21.3-14.el9_6.1
samba-common-4.21.3-14.el9_6.1
samba-common-libs-4.21.3-14.el9_6.1
sed-4.8-9.el9
selinux-policy-38.1.53-5.el9_6.2
selinux-policy-targeted-38.1.53-5.el9_6.2
setup-2.13.7-10.el9
sg3_utils-1.47-10.el9_6.2
sg3_utils-libs-1.47-10.el9_6.2
shadow-utils-2:4.9-12.el9
shadow-utils-subid-2:4.9-12.el9
shared-mime-info-2.1-5.el9
shim-x64-16.1-8.el9_6
skopeo-2:1.18.1-6.el9_6.1
slang-2.3.2-11.el9
slirp4netns-1.3.2-1.el9
snappy-1.1.8-8.el9
socat-1.7.4.1-6.el9_6.1
sqlite-libs-3.34.1-8.el9_6.1
squashfs-tools-4.4-10.git1.el9
ssh-key-dir-0.1.4-1.el9
sssd-2.9.6-4.el9_6.5
sssd-ad-2.9.6-4.el9_6.5
sssd-client-2.9.6-4.el9_6.5
sssd-common-2.9.6-4.el9_6.5
sssd-common-pac-2.9.6-4.el9_6.5
sssd-ipa-2.9.6-4.el9_6.5
sssd-krb5-2.9.6-4.el9_6.5
sssd-krb5-common-2.9.6-4.el9_6.5
sssd-ldap-2.9.6-4.el9_6.5
sssd-nfs-idmap-2.9.6-4.el9_6.5
sssd-proxy-2.9.6-4.el9_6.5
stalld-1.20.4-1.el9_6
strace-6.12-1.el9
subscription-manager-1.29.45.1-1.el9_6
subscription-manager-rhsm-certificates-20220623-1.el9
sudo-1.9.5p2-10.el9_6.4
systemd-252-51.el9_6.6
systemd-journal-remote-252-51.el9_6.6
systemd-libs-252-51.el9_6.6
systemd-pam-252-51.el9_6.6
systemd-rpm-macros-252-51.el9_6.6
systemd-udev-252-51.el9_6.6
tar-2:1.34-7.el9_6.2
teamd-1.31-16.el9_1
tmux-3.2a-5.el9
toolbox-0.1.2-1.rhaos4.19.el9
tpm2-tools-5.2-4.el9
tpm2-tss-3.2.3-1.el9
tzdata-2026e-1.el9_6
unbound-libs-1.16.2-19.el9_6.2
usermode-1.114-6.el9
userspace-rcu-0.12.1-6.el9
util-linux-2.37.4-21.el9_6.1
util-linux-core-2.37.4-21.el9_6.1
vim-minimal-2:8.2.2637-22.el9_6.4
virt-what-1.27-1.el9
which-2.21-30.el9_6
xfsprogs-6.4.0-5.el9
xmlsec1-1.2.29-13.el9
xmlsec1-openssl-1.2.29-13.el9
xz-5.2.5-8.el9_0
xz-libs-5.2.5-8.el9_0
yajl-2.1.0-25.el9
zlib-1.2.11-40.el9
zram-generator-0.3.2-7.el9
zstd-1.5.5-1.el9

Changed:

NetworkManager 1:1.54.3-5.el9_8 → 1:1.52.0-11.el9_6.1
NetworkManager-cloud-setup 1:1.54.3-5.el9_8 → 1:1.52.0-11.el9_6.1
NetworkManager-libnm 1:1.54.3-5.el9_8 → 1:1.52.0-11.el9_6.1
NetworkManager-ovs 1:1.54.3-5.el9_8 → 1:1.52.0-11.el9_6.1
NetworkManager-team 1:1.54.3-5.el9_8 → 1:1.52.0-11.el9_6.1
NetworkManager-tui 1:1.54.3-5.el9_8 → 1:1.52.0-11.el9_6.1
WALinuxAgent-udev 2.14.0.1-4.el9 → 2.13.1.1-1.el9_6
aardvark-dns 2:1.17.1-1.el9_8 → 2:1.14.0-1.el9
acl 2.4.0-1.el9_8 → 2.4.0-0.el9_6.1
adcli 0.9.3.1-3.el9 → 0.9.2-1.el9
afterburn 5.10.0-1.el9 → 5.9.0-1.el9_6
afterburn-dracut 5.10.0-1.el9 → 5.9.0-1.el9_6
attr 2.6.0-1.el9_8 → 2.5.1-3.el9
audit 3.1.5-8.el9 → 3.1.5-4.el9
audit-libs 3.1.5-8.el9 → 3.1.5-4.el9
avahi-libs 0.8-23.el9 → 0.8-22.el9_6.1
bind-libs 32:9.16.23-40.el9_8.13 → 32:9.16.23-31.el9_6.5
bind-license 32:9.16.23-40.el9_8.13 → 32:9.16.23-31.el9_6.5
bind-utils 32:9.16.23-40.el9_8.13 → 32:9.16.23-31.el9_6.5
binutils 2.35.2-72.el9 → 2.35.2-63.el9_6.1
binutils-gold 2.35.2-72.el9 → 2.35.2-63.el9_6.1
bootc 1.16.4-2.el9_8 → 1.1.6-6.el9_6
bootupd 0.2.35-1.el9_8 → 0.2.35-1.el9_6
bsdtar 3.5.3-11.el9_8 → 3.5.3-7.el9_6.2
bubblewrap 0.6.3-1.el9_8.1 → 0.4.1-8.el9_6.1
bzip2 1.0.8-11.el9 → 1.0.8-10.el9_5
bzip2-libs 1.0.8-11.el9 → 1.0.8-10.el9_5
ca-certificates 2026.2.92_v9.0.319-90.3.el9_8 → 2026.2.92_v9.0.319-90.3.el9_6
chrony 4.8-1.el9 → 4.6.1-1.el9
cifs-utils 7.7-1.el9_8 → 7.2-0.el9_6.2
clevis 21-209.el9 → 21-208.el9
clevis-dracut 21-209.el9 → 21-208.el9
clevis-luks 21-209.el9 → 21-208.el9
clevis-systemd 21-209.el9 → 21-208.el9
conmon 3:2.2.1-2.el9_8 → 3:2.1.12-1.el9_6.1
container-selinux 4:2.247.0-1.el9_8 → 4:2.247.0-1.el9_6
containernetworking-plugins 1:1.9.0-4.el9_8 → 1:1.6.2-3.el9_6.1
containers-common 5:5.8-1.el9 → 2:1-117.el9_6
coreos-installer 0.26.0-1.el9_8 → 0.24.0-6.el9_6
coreos-installer-bootinfra 0.26.0-1.el9_8 → 0.24.0-6.el9_6
coreutils 8.32-41.el9_8.1 → 8.32-39.el9
coreutils-common 8.32-41.el9_8.1 → 8.32-39.el9
cracklib 2.9.6-28.el9 → 2.9.6-27.el9
cracklib-dicts 2.9.6-28.el9 → 2.9.6-27.el9
cri-o 1.35.10-4.rhaos4.22.git9943eab.el9 → 1.33.13-9.rhaos4.20.gitd6a41c4.el9
cri-tools 1.35.0-5.el9 → 1.33.0-7.el9
criu 3.19-4.el9_8 → 3.19-1.3.el9_6
criu-libs 3.19-4.el9_8 → 3.19-1.3.el9_6
crun 1.27-1.el9_8 → 1.27-1.el9_6
crypto-policies 20260224-1.gitea0f072.el9_8 → 20250128-1.git5269e22.el9
crypto-policies-scripts 20260224-1.gitea0f072.el9_8 → 20250128-1.git5269e22.el9
cryptsetup 2.8.1-3.el9 → 2.7.2-3.el9_6.1
cryptsetup-libs 2.8.1-3.el9 → 2.7.2-3.el9_6.1
curl 7.76.1-40.el9_8.9 → 7.76.1-31.el9_6.4
cyrus-sasl-gssapi 2.1.27-22.el9 → 2.1.27-21.el9
cyrus-sasl-lib 2.1.27-22.el9 → 2.1.27-21.el9
dbus-broker 28-9.el9_8 → 28-7.el9
device-mapper 9:1.02.207-4.el9_8.1 → 9:1.02.202-6.el9
device-mapper-event 9:1.02.207-4.el9_8.1 → 9:1.02.202-6.el9
device-mapper-event-libs 9:1.02.207-4.el9_8.1 → 9:1.02.202-6.el9
device-mapper-libs 9:1.02.207-4.el9_8.1 → 9:1.02.202-6.el9
device-mapper-multipath 0.8.7-45.el9 → 0.8.7-35.el9_6.3
device-mapper-multipath-libs 0.8.7-45.el9 → 0.8.7-35.el9_6.3
dmidecode 1:3.6-2.el9 → 1:3.6-1.el9
dnf 4.14.0-34.el9_8 → 4.14.0-25.el9
dnf-data 4.14.0-34.el9_8 → 4.14.0-25.el9
dnsmasq 2.85-18.el9_8.2 → 2.85-17.el9_6.2
dracut 057-120.git20260728.el9_8 → 057-89.git20250311.el9_6.1
dracut-network 057-120.git20260728.el9_8 → 057-89.git20250311.el9_6.1
dracut-squash 057-120.git20260728.el9_8 → 057-89.git20250311.el9_6.1
e2fsprogs 1.46.5-8.el9 → 1.46.5-7.el9
e2fsprogs-libs 1.46.5-8.el9 → 1.46.5-7.el9
efi-filesystem 6-4.el9 → 6-2.el9_0
elfutils-debuginfod-client 0.194-1.el9 → 0.192-6.el9_6
elfutils-default-yama-scope 0.194-1.el9 → 0.192-6.el9_6
elfutils-libelf 0.194-1.el9 → 0.192-6.el9_6
elfutils-libs 0.194-1.el9 → 0.192-6.el9_6
ethtool 2:6.15-2.el9 → 2:6.11-1.el9
expat 2.5.0-6.el9_8.7 → 2.5.0-5.el9_6.1
file 5.39-17.el9 → 5.39-16.el9
file-libs 5.39-17.el9 → 5.39-16.el9
firewalld-filesystem 1.3.4-20.el9_8 → 1.3.4-15.el9_6.1
fuse-overlayfs 1.16-1.el9_7 → 1.14-1.el9
fwupd 2.0.19-2.el9_8 → 2.1.6-1.el9_6
gawk 5.1.0-6.el9_8.1 → 5.1.0-6.el9
gawk-all-langpacks 5.1.0-6.el9_8.1 → 5.1.0-6.el9
git-core 2.52.0-1.el9 → 2.47.3-1.el9_6
glib2 2.68.4-19.el9_8.10 → 2.68.4-16.el9_6.8
glibc 2.34-283.el9_8 → 2.34-168.el9_6.25
glibc-common 2.34-283.el9_8 → 2.34-168.el9_6.25
glibc-gconv-extra 2.34-283.el9_8 → 2.34-168.el9_6.25
glibc-minimal-langpack 2.34-283.el9_8 → 2.34-168.el9_6.25
gnupg2 2.3.3-5.el9_7 → 2.3.3-4.el9_6.1
gnutls 3.8.10-9.el9_8 → 3.8.3-6.el9_6.5
grub2-common 1:2.06-127.el9_8 → 1:2.06-105.el9_6.2
grub2-efi-x64 1:2.06-127.el9_8 → 1:2.06-105.el9_6.2
grub2-pc 1:2.06-127.el9_8 → 1:2.06-105.el9_6.2
grub2-pc-modules 1:2.06-127.el9_8 → 1:2.06-105.el9_6.2
grub2-tools 1:2.06-127.el9_8 → 1:2.06-105.el9_6.2
grub2-tools-minimal 1:2.06-127.el9_8 → 1:2.06-105.el9_6.2
gzip 1.12-2.el9_8 → 1.12-1.el9
hwdata 0.348-9.22.el9 → 0.348-9.18.el9
ignition 2.26.0-1.el9_8.2 → 2.21.0-7.el9_6.2
ignition-grub 2.26.0-1.el9_8.2 → 2.21.0-7.el9_6.2
ima-evm-utils 1.6.2-2.el9 → 1.5-3.el9
iproute 6.17.0-2.el9 → 6.11.0-1.el9
iproute-tc 6.17.0-2.el9 → 6.11.0-1.el9
iputils 20210202-15.el9_7 → 20210202-11.el9_6.3
irqbalance 2:1.9.4-5.el9 → 2:1.9.4-2.el9_6.2
iscsi-initiator-utils 6.2.1.11-1.git4b3e853.el9_8.2 → 6.2.1.9-1.gita65a472.el9_6.3
iscsi-initiator-utils-iscsiuio 6.2.1.11-1.git4b3e853.el9_8.2 → 6.2.1.9-1.gita65a472.el9_6.3
isns-utils-libs 0.101-4.el9_8.1 → 0.101-4.el9_6.1
jq 1.6-19.el9_8.2 → 1.6-17.el9_6.4
kbd 2.4.0-12.el9_8 → 2.4.0-11.el9
kbd-legacy 2.4.0-12.el9_8 → 2.4.0-11.el9
kbd-misc 2.4.0-12.el9_8 → 2.4.0-11.el9
kernel 5.14.0-687.65.1.el9_8 → 5.14.0-570.154.1.el9_6
kernel-core 5.14.0-687.65.1.el9_8 → 5.14.0-570.154.1.el9_6
kernel-modules 5.14.0-687.65.1.el9_8 → 5.14.0-570.154.1.el9_6
kernel-modules-core 5.14.0-687.65.1.el9_8 → 5.14.0-570.154.1.el9_6
kernel-modules-extra 5.14.0-687.65.1.el9_8 → 5.14.0-570.154.1.el9_6
kexec-tools 2.0.29-17.el9 → 2.0.29-5.el9_6.2
kmod 28-11.el9 → 28-10.el9
kmod-libs 28-11.el9 → 28-10.el9
kpartx 0.8.7-45.el9 → 0.8.7-35.el9_6.3
krb5-libs 1.21.1-10.el9_8.1 → 1.21.1-8.el9_6.2
less 590-6.el9 → 590-5.el9
libacl 2.4.0-1.el9_8 → 2.4.0-0.el9_6.1
libarchive 3.5.3-11.el9_8 → 3.5.3-7.el9_6.2
libattr 2.6.0-1.el9_8 → 2.5.1-3.el9
libblkid 2.37.4-25.el9 → 2.37.4-21.el9_6.1
libbpf 2:1.5.0-3.el9 → 2:1.5.0-1.el9
libbrotli 1.0.9-10.el9_8.1 → 1.0.9-7.el9_6.3
libcap 2.48-10.el9_8.1 → 2.48-9.el9_6.1
libcom_err 1.46.5-8.el9 → 1.46.5-7.el9
libcurl 7.76.1-40.el9_8.9 → 7.76.1-31.el9_6.4
libdnf 0.69.0-18.el9 → 0.69.0-13.el9
libdnf-plugin-subscription-manager 1.29.50-1.el9 → 1.29.45.1-1.el9_6
libdrm 2.4.128-1.el9 → 2.4.123-2.el9
libeconf 0.4.1-7.el9_8 → 0.4.1-4.el9
libedit 3.1-39.20210216cvs.el9 → 3.1-38.20210216cvs.el9
libevent 2.1.13-1.el9_8 → 2.1.12-8.el9_4
libfdisk 2.37.4-25.el9 → 2.37.4-21.el9_6.1
libgcc 11.5.0-14.el9 → 11.5.0-5.el9_5
libgcrypt 1.10.0-13.el9_8 → 1.10.0-11.el9_6.1
libgomp 11.5.0-14.el9 → 11.5.0-5.el9_5
libibverbs 61.0-2.el9 → 54.0-2.el9_6
libipa_hbac 2.9.8-4.el9_8.1 → 2.9.6-4.el9_6.5
libkcapi 1.4.0-3.el9_8 → 1.4.0-2.el9_6.1
libkcapi-hmaccalc 1.4.0-3.el9_8 → 1.4.0-2.el9_6.1
libldb 4.23.5-12.el9_8 → 4.21.3-14.el9_6.1
libluksmeta 10-1.el9 → 9-12.el9
libmount 2.37.4-25.el9 → 2.37.4-21.el9_6.1
libnfsidmap 1:2.5.4-42.el9_8 → 1:2.5.4-34.el9_6.5
libnghttp2 1.43.0-6.el9_8.2 → 1.43.0-6.el9_6.1
libnvme 1.16.1-3.el9_8 → 1.11.1-1.el9
libpcap 14:1.10.0-4.el9_8.1 → 14:1.10.0-4.el9
librepo 1.19.0-1.el9 → 1.14.5-2.el9
libsepol 3.6-3.el9 → 3.6-2.el9
libsmartcols 2.37.4-25.el9 → 2.37.4-21.el9_6.1
libsmbclient 4.23.5-12.el9_8 → 4.21.3-14.el9_6.1
libsolv 0.7.24-6.el9_8 → 0.7.24-3.el9_6.1
libss 1.46.5-8.el9 → 1.46.5-7.el9
libssh 0.10.4-19.el9_8 → 0.10.4-15.el9_6.1
libssh-config 0.10.4-19.el9_8 → 0.10.4-15.el9_6.1
libsss_certmap 2.9.8-4.el9_8.1 → 2.9.6-4.el9_6.5
libsss_idmap 2.9.8-4.el9_8.1 → 2.9.6-4.el9_6.5
libsss_nss_idmap 2.9.8-4.el9_8.1 → 2.9.6-4.el9_6.5
libsss_sudo 2.9.8-4.el9_8.1 → 2.9.6-4.el9_6.5
libstdc++ 11.5.0-14.el9 → 11.5.0-5.el9_5
libtalloc 2.4.3-1.el9 → 2.4.2-1.el9
libtasn1 4.16.0-10.el9_8 → 4.16.0-9.el9
libtdb 1.4.14-1.el9 → 1.4.12-1.el9
libtevent 0.17.1-1.el9 → 0.16.1-1.el9
liburing 2.12-1.el9 → 2.5-1.el9
libusbx 1.0.30-1.el9_8 → 1.0.30-1.el9_6
libuser 0.63-17.el9 → 0.63-16.el9
libuuid 2.37.4-25.el9 → 2.37.4-21.el9_6.1
libwbclient 4.23.5-12.el9_8 → 4.21.3-14.el9_6.1
libxml2 2.9.13-14.el9_8.5 → 2.9.13-13.el9_6
libxmlb 0.3.24-1.el9 → 0.3.28-1.el9_6
libxslt 1.1.34-14.el9_8.1 → 1.1.34-13.el9_6.2
linux-firmware 20261026-161.5.el9_8 → 20251111-151.8.el9_6
linux-firmware-whence 20261026-161.5.el9_8 → 20251111-151.8.el9_6
logrotate 3.18.0-12.el9 → 3.18.0-9.el9
luksmeta 10-1.el9 → 9-12.el9
lvm2 9:2.03.33-4.el9_8.1 → 9:2.03.28-6.el9
lvm2-libs 9:2.03.33-4.el9_8.1 → 9:2.03.28-6.el9
mdadm 4.4-4.el9_8.2 → 4.3-8.el9_6.1
microcode_ctl 4:20260210-1.20260812.1.el9_8 → 4:20250211-1.20260227.1.el9_6
mokutil 2:0.7.2-4.el9 → 2:0.6.0-4.el9
mpfr 4.1.0-10.el9 → 4.1.0-7.el9
ncurses 6.2-12.20210508.el9 → 6.2-10.20210508.el9_6.2
ncurses-base 6.2-12.20210508.el9 → 6.2-10.20210508.el9_6.2
ncurses-libs 6.2-12.20210508.el9 → 6.2-10.20210508.el9_6.2
netavark 2:1.17.2-1.el9 → 2:1.14.1-1.el9_6.1
nfs-utils 1:2.5.4-42.el9_8 → 1:2.5.4-34.el9_6.5
nftables 1:1.0.9-9.el9_8 → 1:1.0.9-6.el9_6.1
nmap-ncat 3:7.92-5.el9 → 3:7.92-3.el9
nmstate 2.2.60-2.el9_8 → 2.2.60-1.el9_6.1
numactl-libs 2.0.19-3.el9 → 2.0.19-1.el9
nvme-cli 2.16-1.el9 → 2.11-7.el9_6
open-vm-tools 13.0.10-1.el9 → 12.5.0-1.el9_6.2
openshift-clients 4.22.0-202610221634.p2.ga726d94.assembly.stream.el9 → 4.20.0-202610221619.p2.gef515cf.assembly.stream.el9
openshift-kubelet 4.22.0-202610292101.p2.gc253e21.assembly.stream.el9 → 4.20.0-202610221619.p2.g8008e65.assembly.stream.el9
openssh 9.9p1-13.el9_8 → 8.7p1-45.el9_6.5
openssh-clients 9.9p1-13.el9_8 → 8.7p1-45.el9_6.5
openssh-server 9.9p1-13.el9_8 → 8.7p1-45.el9_6.5
openssl 1:3.5.8-2.el9_8 → 1:3.2.2-7.el9_6.4
openssl-fips-provider 3.0.7-11.el9_8 → 3.0.7-11.el9_0
openssl-fips-provider-so 3.0.7-11.el9_8 → 3.0.7-11.el9_0
openssl-libs 1:3.5.8-2.el9_8 → 1:3.2.2-7.el9_6.4
ose-aws-ecr-image-credential-provider 4.22.0-202610221634.p2.gd3eb84f.assembly.stream.el9 → 4.20.0-202610221619.p2.gbb88da1.assembly.stream.el9
ose-azure-acr-image-credential-provider 4.22.0-202610221634.p2.g860d459.assembly.stream.el9 → 4.20.0-202610221619.p2.g5e41860.assembly.stream.el9
ose-gcp-gcr-image-credential-provider 4.22.0-202610221634.p2.g85bdbf8.assembly.stream.el9 → 4.20.0-202611040818.p2.g9502c2e.assembly.stream.el9
ostree 2025.7-1.el9 → 2025.2-4.el9_6
ostree-grub2 2025.7-1.el9 → 2025.2-4.el9_6
ostree-libs 2025.7-1.el9 → 2025.2-4.el9_6
p11-kit 0.26.4-1.el9_8 → 0.25.3-3.el9_5
p11-kit-trust 0.26.4-1.el9_8 → 0.25.3-3.el9_5
pam 1.5.1-28.el9_8.1 → 1.5.1-26.el9_6.1
passt 0^20251210.gd04c480-7.el9_8 → 0^20250217.ga1e48a0-14.el9_6
passt-selinux 0^20251210.gd04c480-7.el9_8 → 0^20250217.ga1e48a0-14.el9_6
pcre2 10.40-7.el9_8 → 10.40-6.el9_6.1
pcre2-syntax 10.40-7.el9_8 → 10.40-6.el9_6.1
perl-AutoLoader 5.74-484.el9_8 → 5.74-481.1.el9_6
perl-B 1.80-484.el9_8 → 1.80-481.1.el9_6
perl-Class-Struct 0.66-484.el9_8 → 0.66-481.1.el9_6
perl-Errno 1.30-484.el9_8 → 1.30-481.1.el9_6
perl-Fcntl 1.13-484.el9_8 → 1.13-481.1.el9_6
perl-File-Basename 2.85-484.el9_8 → 2.85-481.1.el9_6
perl-File-stat 1.09-484.el9_8 → 1.09-481.1.el9_6
perl-FileHandle 2.03-484.el9_8 → 2.03-481.1.el9_6
perl-Getopt-Std 1.12-484.el9_8 → 1.12-481.1.el9_6
perl-IO 1.43-484.el9_8 → 1.43-481.1.el9_6
perl-IPC-Open3 1.21-484.el9_8 → 1.21-481.1.el9_6
perl-NDBM_File 1.15-484.el9_8 → 1.15-481.1.el9_6
perl-Net-SSLeay 1.94-3.el9 → 1.94-1.el9
perl-POSIX 1.94-484.el9_8 → 1.94-481.1.el9_6
perl-SelectSaver 1.02-484.el9_8 → 1.02-481.1.el9_6
perl-Symbol 1.08-484.el9_8 → 1.08-481.1.el9_6
perl-URI 5.09-3.el9_8.1 → 5.09-3.el9
perl-base 2.27-484.el9_8 → 2.27-481.1.el9_6
perl-if 0.60.800-484.el9_8 → 0.60.800-481.1.el9_6
perl-interpreter 4:5.32.1-484.el9_8 → 4:5.32.1-481.1.el9_6
perl-libs 4:5.32.1-484.el9_8 → 4:5.32.1-481.1.el9_6
perl-mro 1.23-484.el9_8 → 1.23-481.1.el9_6
perl-overload 1.31-484.el9_8 → 1.31-481.1.el9_6
perl-overloading 0.02-484.el9_8 → 0.02-481.1.el9_6
perl-subs 1.03-484.el9_8 → 1.03-481.1.el9_6
perl-vars 1.05-484.el9_8 → 1.05-481.1.el9_6
podman 6:5.8.2-8.el9_8 → 5:5.4.0-22.el9_6.5
policycoreutils 3.6-5.el9 → 3.6-2.1.el9
policycoreutils-python-utils 3.6-5.el9 → 3.6-2.1.el9
polkit 0.117-14.el9 → 0.117-13.el9
polkit-libs 0.117-14.el9 → 0.117-13.el9
python-unversioned-command 3.9.25-7.el9_8.6 → 3.9.21-2.el9_6.7
python3 3.9.25-7.el9_8.6 → 3.9.21-2.el9_6.7
python3-audit 3.1.5-8.el9 → 3.1.5-4.el9
python3-cloud-what 1.29.50-1.el9 → 1.29.45.1-1.el9_6
python3-dateutil 1:2.9.0.post0-1.el9_7 → 1:2.8.1-7.el9
python3-dnf 4.14.0-34.el9_8 → 4.14.0-25.el9
python3-dnf-plugin-versionlock 4.3.0-26.el9 → 4.3.0-20.el9
python3-dnf-plugins-core 4.3.0-26.el9 → 4.3.0-20.el9
python3-hawkey 0.69.0-18.el9 → 0.69.0-13.el9
python3-idna 2.10-8.el9_8 → 2.10-7.el9_4.1
python3-libdnf 0.69.0-18.el9 → 0.69.0-13.el9
python3-librepo 1.19.0-1.el9 → 1.14.5-2.el9
python3-libs 3.9.25-7.el9_8.6 → 3.9.21-2.el9_6.7
python3-pip-wheel 21.3.1-2.el9_8 → 21.3.1-1.el9
python3-policycoreutils 3.6-5.el9 → 3.6-2.1.el9
python3-rpm 4.16.1.3-40.el9 → 4.16.1.3-37.el9
python3-setuptools 53.0.0-15.el9 → 53.0.0-13.el9_6.1
python3-setuptools-wheel 53.0.0-15.el9 → 53.0.0-13.el9_6.1
python3-subscription-manager-rhsm 1.29.50-1.el9 → 1.29.45.1-1.el9_6
python3-urllib3 1.26.5-8.el9_8.2 → 1.26.5-6.el9_6.2
qemu-guest-agent 17:10.1.0-17.el9_8.9 → 17:9.1.0-15.el9_6.20
rdma-core 61.0-2.el9 → 54.0-2.el9_6
redhat-release 9.8-1.0.el9 → 9.6-0.1.el9
redhat-release-eula 9.8-1.0.el9 → 9.6-0.1.el9
rpcbind 1.2.6-7.el9_8.1 → 1.2.6-7.el9
rpm 4.16.1.3-40.el9 → 4.16.1.3-37.el9
rpm-build-libs 4.16.1.3-40.el9 → 4.16.1.3-37.el9
rpm-libs 4.16.1.3-40.el9 → 4.16.1.3-37.el9
rpm-ostree 2026.1-6.el9_8 → 2025.6-6.el9_6
rpm-ostree-libs 2026.1-6.el9_8 → 2025.6-6.el9_6
rpm-plugin-selinux 4.16.1.3-40.el9 → 4.16.1.3-37.el9
rpm-plugin-systemd-inhibit 4.16.1.3-40.el9 → 4.16.1.3-37.el9
rpm-sign-libs 4.16.1.3-40.el9 → 4.16.1.3-37.el9
rsync 3.2.7-1.el9_8 → 3.2.5-3.el9_6.1
runc 4:1.4.2-3.el9_8 → 4:1.2.9-3.el9_6.1
samba-client-libs 4.23.5-12.el9_8 → 4.21.3-14.el9_6.1
samba-common 4.23.5-12.el9_8 → 4.21.3-14.el9_6.1
samba-common-libs 4.23.5-12.el9_8 → 4.21.3-14.el9_6.1
sed 4.8-10.el9 → 4.8-9.el9
selinux-policy 38.1.75-2.el9_8.1 → 38.1.53-5.el9_6.2
selinux-policy-targeted 38.1.75-2.el9_8.1 → 38.1.53-5.el9_6.2
sg3_utils 1.47-10.el9_8.1 → 1.47-10.el9_6.2
sg3_utils-libs 1.47-10.el9_8.1 → 1.47-10.el9_6.2
shadow-utils 2:4.9-16.el9 → 2:4.9-12.el9
shadow-utils-subid 2:4.9-16.el9 → 2:4.9-12.el9
shim-x64 16.1-7.el9 → 16.1-8.el9_6
skopeo 2:1.22.2-9.el9_8 → 2:1.18.1-6.el9_6.1
slirp4netns 1.3.3-1.el9 → 1.3.2-1.el9
socat 1.7.4.1-8.el9 → 1.7.4.1-6.el9_6.1
sqlite-libs 3.34.1-11.el9_8 → 3.34.1-8.el9_6.1
sssd 2.9.8-4.el9_8.1 → 2.9.6-4.el9_6.5
sssd-ad 2.9.8-4.el9_8.1 → 2.9.6-4.el9_6.5
sssd-client 2.9.8-4.el9_8.1 → 2.9.6-4.el9_6.5
sssd-common 2.9.8-4.el9_8.1 → 2.9.6-4.el9_6.5
sssd-common-pac 2.9.8-4.el9_8.1 → 2.9.6-4.el9_6.5
sssd-ipa 2.9.8-4.el9_8.1 → 2.9.6-4.el9_6.5
sssd-krb5 2.9.8-4.el9_8.1 → 2.9.6-4.el9_6.5
sssd-krb5-common 2.9.8-4.el9_8.1 → 2.9.6-4.el9_6.5
sssd-ldap 2.9.8-4.el9_8.1 → 2.9.6-4.el9_6.5
sssd-nfs-idmap 2.9.8-4.el9_8.1 → 2.9.6-4.el9_6.5
sssd-proxy 2.9.8-4.el9_8.1 → 2.9.6-4.el9_6.5
stalld 1.26.3-1.el9 → 1.20.4-1.el9_6
subscription-manager 1.29.50-1.el9 → 1.29.45.1-1.el9_6
sudo 1.9.17p2-3.el9_8.3 → 1.9.5p2-10.el9_6.4
systemd 252-67.el9_8.6 → 252-51.el9_6.6
systemd-journal-remote 252-67.el9_8.6 → 252-51.el9_6.6
systemd-libs 252-67.el9_8.6 → 252-51.el9_6.6
systemd-pam 252-67.el9_8.6 → 252-51.el9_6.6
systemd-rpm-macros 252-67.el9_8.6 → 252-51.el9_6.6
systemd-udev 252-67.el9_8.6 → 252-51.el9_6.6
tar 2:1.34-13.el9_8 → 2:1.34-7.el9_6.2
toolbox 0.1.2-1.rhaos4.22.el9 → 0.1.2-1.rhaos4.19.el9
tpm2-tools 5.2-7.el9 → 5.2-4.el9
tzdata 2026e-1.el9_8 → 2026e-1.el9_6
unbound-libs 1.24.2-3.el9_8.8 → 1.16.2-19.el9_6.2
usermode 1.114-7.el9 → 1.114-6.el9
util-linux 2.37.4-25.el9 → 2.37.4-21.el9_6.1
util-linux-core 2.37.4-25.el9 → 2.37.4-21.el9_6.1
vim-minimal 2:8.2.2637-26.el9_8.23 → 2:8.2.2637-22.el9_6.4
virt-what 1.27-2.el9 → 1.27-1.el9
xfsprogs 6.4.0-7.el9 → 6.4.0-5.el9
xz 5.2.5-8.el9_8.1 → 5.2.5-8.el9_0
xz-libs 5.2.5-8.el9_8.1 → 5.2.5-8.el9_0
zram-generator 1.1.2-1.el9 → 0.3.2-7.el9

Removed:

adcli-selinux 0.9.3.1-3.el9
azure-vm-utils 0.7.0-1.el9
flashrom 1.2-10.el9
fwupd-plugin-flashrom 2.0.19-2.el9_8
numactl 2.0.19-3.el9
ose-crio-credential-provider 4.22.0-202610221634.p2.g83d4961.assembly.stream.el9
perl-Unicode-Normalize 1.27-461.el9

Extensions

Full list (162 packages)

NetworkManager-libreswan-1.2.29-1.el9_6.x86_64
bison-3.7.4-5.el9.x86_64
capstone-4.0.2-11.el9_6.x86_64
corosync-3.1.9-2.el9_6.2.x86_64
corosynclib-3.1.9-2.el9_6.2.x86_64
cpp-11.5.0-5.el9_5.x86_64
crun-wasm-1.8.5-5.rhaos4.14.el9.x86_64
daxctl-libs-78-2.el9.x86_64
edk2-ovmf-20241117-2.el9_6.2.noarch
elfutils-libelf-devel-0.192-6.el9_6.x86_64
fence-agents-all-4.10.0-86.el9_6.23.x86_64
fence-agents-amt-ws-4.10.0-86.el9_6.23.noarch
fence-agents-apc-4.10.0-86.el9_6.23.noarch
fence-agents-apc-snmp-4.10.0-86.el9_6.23.noarch
fence-agents-bladecenter-4.10.0-86.el9_6.23.noarch
fence-agents-brocade-4.10.0-86.el9_6.23.noarch
fence-agents-cisco-mds-4.10.0-86.el9_6.23.noarch
fence-agents-cisco-ucs-4.10.0-86.el9_6.23.noarch
fence-agents-common-4.10.0-86.el9_6.23.noarch
fence-agents-drac5-4.10.0-86.el9_6.23.noarch
fence-agents-eaton-snmp-4.10.0-86.el9_6.23.noarch
fence-agents-emerson-4.10.0-86.el9_6.23.noarch
fence-agents-eps-4.10.0-86.el9_6.23.noarch
fence-agents-heuristics-ping-4.10.0-86.el9_6.23.noarch
fence-agents-hpblade-4.10.0-86.el9_6.23.noarch
fence-agents-ibmblade-4.10.0-86.el9_6.23.noarch
fence-agents-ifmib-4.10.0-86.el9_6.23.noarch
fence-agents-ilo-moonshot-4.10.0-86.el9_6.23.noarch
fence-agents-ilo-mp-4.10.0-86.el9_6.23.noarch
fence-agents-ilo-ssh-4.10.0-86.el9_6.23.noarch
fence-agents-ilo2-4.10.0-86.el9_6.23.noarch
fence-agents-intelmodular-4.10.0-86.el9_6.23.noarch
fence-agents-ipdu-4.10.0-86.el9_6.23.noarch
fence-agents-ipmilan-4.10.0-86.el9_6.23.noarch
fence-agents-kdump-4.10.0-86.el9_6.23.x86_64
fence-agents-mpath-4.10.0-86.el9_6.23.noarch
fence-agents-redfish-4.10.0-86.el9_6.23.x86_64
fence-agents-rhevm-4.10.0-86.el9_6.23.noarch
fence-agents-rsa-4.10.0-86.el9_6.23.noarch
fence-agents-rsb-4.10.0-86.el9_6.23.noarch
fence-agents-sbd-4.10.0-86.el9_6.23.noarch
fence-agents-scsi-4.10.0-86.el9_6.23.noarch
fence-agents-vmware-rest-4.10.0-86.el9_6.23.noarch
fence-agents-vmware-soap-4.10.0-86.el9_6.23.noarch
fence-agents-wti-4.10.0-86.el9_6.23.noarch
fence-virt-4.10.0-86.el9_6.23.x86_64
flex-2.6.4-9.el9.x86_64
fmt-9.1.0-1.el9.x86_64
gcc-11.5.0-5.el9_5.x86_64
glibc-devel-2.34-168.el9_6.25.x86_64
glibc-headers-2.34-168.el9_6.25.x86_64
gnutls-dane-3.8.3-6.el9_6.5.x86_64
gnutls-utils-3.8.3-6.el9_6.5.x86_64
ipmitool-1.8.18-27.el9.x86_64
ipxe-roms-qemu-20200823-9.git4bd064de.el9_0.noarch
kata-containers-3.31.0-6.rhaos4.19.el9.x86_64
kernel-5.14.0-570.154.1.el9_6.x86_64
kernel-core-5.14.0-570.154.1.el9_6.x86_64
kernel-devel-5.14.0-570.154.1.el9_6.x86_64
kernel-headers-5.14.0-570.154.1.el9_6.x86_64
kernel-modules-5.14.0-570.154.1.el9_6.x86_64
kernel-modules-extra-5.14.0-570.154.1.el9_6.x86_64
kernel-rt-core-5.14.0-570.154.1.el9_6.x86_64
kernel-rt-devel-5.14.0-570.154.1.el9_6.x86_64
kernel-rt-kvm-5.14.0-570.154.1.el9_6.x86_64
kernel-rt-modules-5.14.0-570.154.1.el9_6.x86_64
kernel-rt-modules-core-5.14.0-570.154.1.el9_6.x86_64
kernel-rt-modules-extra-5.14.0-570.154.1.el9_6.x86_64
krb5-pkinit-1.21.1-8.el9_6.2.x86_64
krb5-workstation-1.21.1-8.el9_6.2.x86_64
ldns-1.7.1-12.el9_6.1.x86_64
libfdt-1.6.0-7.el9.x86_64
libkadm5-1.21.1-8.el9_6.2.x86_64
libknet1-1.28-1.el9.x86_64
libknet1-compress-bzip2-plugin-1.28-1.el9.x86_64
libknet1-compress-lz4-plugin-1.28-1.el9.x86_64
libknet1-compress-lzma-plugin-1.28-1.el9.x86_64
libknet1-compress-lzo2-plugin-1.28-1.el9.x86_64
libknet1-compress-plugins-all-1.28-1.el9.x86_64
libknet1-compress-zlib-plugin-1.28-1.el9.x86_64
libknet1-compress-zstd-plugin-1.28-1.el9.x86_64
libknet1-crypto-nss-plugin-1.28-1.el9.x86_64
libknet1-crypto-openssl-plugin-1.28-1.el9.x86_64
libknet1-crypto-plugins-all-1.28-1.el9.x86_64
libknet1-plugins-all-1.28-1.el9.x86_64
libmpc-1.2.1-4.el9.x86_64
libnozzle1-1.28-1.el9.x86_64
libpmem-1.12.1-1.el9.x86_64
libpng-2:1.6.37-12.el9_6.4.x86_64
libqb-2.0.8-1.el9.x86_64
librdmacm-54.0-2.el9_6.x86_64
libreswan-5.3.2-2.el9fdp.x86_64
libwsman1-2.6.8-23.el9.x86_64
libxcrypt-devel-4.4.18-3.el9.x86_64
libzstd-devel-1.5.5-1.el9.x86_64
lld-17.0.6-1.el9.x86_64
lld-libs-17.0.6-1.el9.x86_64
llvm-17.0.6-5.el9.x86_64
llvm-libs-17.0.6-5.el9.x86_64
lm_sensors-libs-3.6.0-10.el9.x86_64
m4-1.4.19-1.el9.x86_64
make-1:4.3-8.el9.x86_64
ndctl-libs-78-2.el9.x86_64
net-snmp-libs-1:5.9.1-17.el9_6.1.x86_64
net-snmp-utils-1:5.9.1-17.el9_6.1.x86_64
nspr-4.39.0-5.el9_6.x86_64
nss-3.124.0-5.el9_6.x86_64
nss-softokn-3.124.0-5.el9_6.x86_64
nss-softokn-freebl-3.124.0-5.el9_6.x86_64
nss-sysinit-3.124.0-5.el9_6.x86_64
nss-tools-3.124.0-5.el9_6.x86_64
nss-util-3.124.0-5.el9_6.x86_64
openssl-devel-1:3.2.2-7.el9_6.4.x86_64
openvswitch3.5-ipsec-3.5.2-72.el9fdp.3.x86_64
openwsman-python3-2.6.8-23.el9.x86_64
pacemaker-2.1.9-1.4.el9_6.x86_64
pacemaker-cli-2.1.9-1.4.el9_6.x86_64
pacemaker-cluster-libs-2.1.9-1.4.el9_6.x86_64
pacemaker-libs-2.1.9-1.4.el9_6.x86_64
pacemaker-schemas-2.1.9-1.4.el9_6.noarch
pcp-conf-6.3.7-1.el9_6.1.x86_64
pcp-libs-6.3.7-1.el9_6.1.x86_64
pcs-0.11.9-2.el9_6.4.x86_64
perl-TimeDate-1:2.33-6.el9.noarch
pixman-0.40.0-6.el9_3.x86_64
protobuf-3.14.0-16.el9_6.1.x86_64
python3-cffi-1.14.5-5.el9.x86_64
python3-cryptography-36.0.1-5.el9_6.x86_64
python3-lxml-4.6.5-3.el9_6.1.x86_64
python3-openvswitch3.5-3.5.2-72.el9fdp.3.x86_64
python3-ply-3.11-14.el9.noarch
python3-pycparser-2.20-6.el9.noarch
python3-pycurl-7.43.0.6-8.el9.x86_64
python3-pyparsing-2.4.7-9.el9.noarch
python3-tornado-6.4.2-2.el9_6.7.x86_64
qemu-img-17:9.1.0-15.el9_6.20.x86_64
qemu-kvm-common-17:9.1.0-15.el9_6.20.x86_64
qemu-kvm-core-17:9.1.0-15.el9_6.20.x86_64
redhat-logos-90.5-1.el9_6.1.x86_64
resource-agents-4.10.0-71.el9_6.36.x86_64
ruby-3.0.7-166.el9_6.x86_64
ruby-default-gems-3.0.7-166.el9_6.noarch
ruby-libs-3.0.7-166.el9_6.x86_64
rubygem-bigdecimal-3.0.0-166.el9_6.x86_64
rubygem-bundler-2.2.33-166.el9_6.noarch
rubygem-io-console-0.5.7-166.el9_6.x86_64
rubygem-json-2.5.1-166.el9_6.x86_64
rubygem-psych-3.3.2-166.el9_6.x86_64
rubygem-rdoc-6.3.4.1-166.el9_6.noarch
rubygem-rexml-3.2.5-166.el9_6.noarch
rubygems-3.2.33-166.el9_6.noarch
sbd-1.5.2-1.el9.x86_64
seabios-bin-1.16.3-4.el9.noarch
seavgabios-bin-1.16.3-4.el9.noarch
spdlog-1.13.0-1.rhaos4.14.el9.x86_64
sysstat-12.5.4-9.el9.x86_64
telnet-1:0.17-85.el9.x86_64
usbguard-1.0.0-16.el9.x86_64
usbguard-selinux-1.0.0-16.el9.noarch
virtiofsd-1.13.2-1.el9_6.x86_64
wasmedge-0.14.0-2.rhaos4.20.el9.x86_64
zlib-devel-1.2.11-40.el9.x86_64

Red Hat Enterprise Linux CoreOS base layer: 9.6.20261104-0

OCPBUGS-87874: Add support for hermetic builds via Cachi2 prefetched CoreOS base layer: ISOs #98

View changelog in Markdown or change previous release:

Source code for this page located on github