# 5.0.0-okd-scos.1

Created: 2026-09-30 07:37:00 +0000 UTC

Image Digest: `sha256:a5e956045b37dc8c3d2fa78f43b33ae4da38dd99662c7b0deb81151f3359b612`

Promoted from registry.ci.openshift.org/origin/release-scos:5.0.0-0.okd-scos-nightly-2026-09-29-172229


## Changes from 5.0.0-okd-scos.0

### Components

* Kubectl 1.36.2
* Kubernetes upgraded from 1.36.3 to 1.36.4
* Kubernetes Tests 1.36.2
* CentOS Stream CoreOS 10 10.0.20260819-0



### FeatureGate Changes
| FeatureGate | Default<br/>Hypershift | Default<br/>SelfManagedHA | DevPreviewNoUpgrade<br/>Hypershift | DevPreviewNoUpgrade<br/>SelfManagedHA | OKD<br/>Hypershift | OKD<br/>SelfManagedHA | TechPreviewNoUpgrade<br/>Hypershift | TechPreviewNoUpgrade<br/>SelfManagedHA  |
| :------ | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---:  |
| DRADeviceTaintRules <br/> (0 tests)|  |  |  |  |  |  |  |   |


### Rebuilt images without code change

* [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver) git [8b8c4cef](https://github.com/openshift/aws-ebs-csi-driver/commit/8b8c4cef02ec9b670e2709f2aacc0ed72420be90) `sha256:bf7d110f35785348f38db9f21680cf135f1a33aa727f8271890a131f7b199116`
* [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms) git [6409e379](https://github.com/openshift/azure-kubernetes-kms/commit/6409e379fa979104a9515108608c22492bb803a7) `sha256:6b83e04738752b03d682bff11fb72d244c0339feaedaccd510c995b050486203`
* [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator) git [e48fe117](https://github.com/openshift/cluster-autoscaler-operator/commit/e48fe1179ad671757b5a40688e2d125c1f326e8b) `sha256:d330def079025b69eaf3d77fedc55eb79f810d184b0c6de9bb07cd01adf39220`
* [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator) git [c0ed09e3](https://github.com/openshift/cluster-dns-operator/commit/c0ed09e329e9001629518604a58205e3fbe8284a) `sha256:f34f2a80a8d750e00add8bb0fff339817af335751222790449653b6f36cab392`
* [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator) git [ba80c7ef](https://github.com/openshift/cluster-samples-operator/commit/ba80c7efd89885b08dc890eb5aefb994ee1e7ab9) `sha256:5cb79db5201ebffa0b98a84caebfd42d67fdf040e472acd4ad9188b824d2d9c7`
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [9607604d](https://github.com/openshift/cluster-update-keys/commit/9607604d35acee234051bd0da8a14321b4edd38e) `sha256:a986f241a04a655920454801956bed6429011cb026e38ca50682dfac4b1c4947`
* [configmap-reloader](https://github.com/openshift/configmap-reload) git [ce80869a](https://github.com/openshift/configmap-reload/commit/ce80869a83b55ebbdc21a5550ec5747645203bd2) `sha256:11092c7b365db47de7ea6be16d5d09bc7855dd036598150c3d7f12588d82bda0`
* [coredns](https://github.com/openshift/coredns) git [37aaba89](https://github.com/openshift/coredns/commit/37aaba896e97f4b9a091aab6d36f2213b8854474) `sha256:6dcbac7e971b92e60c2f9b724f7fe4bea69818ea602ce35052f68e10de86e55a`
* [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs) git [beb9567b](https://github.com/openshift/csi-driver-nfs/commit/beb9567b4ef15656a88c1c71e0b08e7bf2e96aaa) `sha256:45c9d98ff40cd5b40d1f4c371729171935c0943cf271a4d6536625dd2ec78bcb`
* [csi-external-attacher](https://github.com/openshift/csi-external-attacher) git [3fd668b3](https://github.com/openshift/csi-external-attacher/commit/3fd668b3f07dd382e5c7b6239d50f7988f652e64) `sha256:888bb503cba958e2d0efe9348502b52239fe4493ed01053688db6f57821b1697`
* [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner) git [7ff338c9](https://github.com/openshift/csi-external-provisioner/commit/7ff338c9d1296f0e5d4d8080a76bb191c8f3be30) `sha256:68965cabd297c27dcf86f82ef2f933e828d3cb6572e3ffc2604758ffd46ad60c`
* [csi-external-resizer](https://github.com/openshift/csi-external-resizer) git [14aa7028](https://github.com/openshift/csi-external-resizer/commit/14aa7028f485e95c800bb7ffbf9b66a2bf75ceaf) `sha256:78bf21838eb62222174a1601e03194dbe433dbac6b7a9f6fe1f79b47b5361436`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [b63b175a](https://github.com/openshift/driver-toolkit/commit/b63b175a79b9fe0c29f6ed63df3c2d7862ba408a) `sha256:f4ea2e1ee8334b5cd36d8c0a44482e192d785dbab60fbab2f5c30f2980673700`
* [etcd](https://github.com/openshift/etcd) git [609b11ed](https://github.com/openshift/etcd/commit/609b11ed8fc404fb95572d7c87e3243a1206cdb7) `sha256:275335bf838d458345bf66315b419e2a7aa2a157a050c2488e7c16186f0ba352`
* [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp) git [dbcbfe70](https://github.com/openshift/cluster-api-provider-gcp/commit/dbcbfe70efa75f192309f2d0f8daae2c6a441e90) `sha256:585ead4ee0c29dd8595d00913cd3fc1339edf84bb243fa65847d909c72c9d058`
* [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver) git [3a89d7d1](https://github.com/openshift/ibm-vpc-block-csi-driver/commit/3a89d7d17d25727270414b07d3daaa3bc329d743) `sha256:85762bad8a49cc3a47f293f0e816721f12f3297c562877589cc06b3c6055fef0`
* [insights-runtime-exporter](https://github.com/openshift/insights-runtime-extractor) git [7c9aa149](https://github.com/openshift/insights-runtime-extractor/commit/7c9aa14915e639edd20bc0869747487e2e73fe51) `sha256:e207a57c5cd42d3e41212a358af66fb4fd999d7ed4b2dad034075cfc951c23e5`
* [insights-runtime-extractor](https://github.com/openshift/insights-runtime-extractor) git [7c9aa149](https://github.com/openshift/insights-runtime-extractor/commit/7c9aa14915e639edd20bc0869747487e2e73fe51) `sha256:e602134598703cce0e754614ed19cbbf2e4d0b823de35780b14164ea6b607e7f`
* [ironic-agent](https://github.com/openshift/ironic-agent-image) git [601c9bf3](https://github.com/openshift/ironic-agent-image/commit/601c9bf36bbc4a0796c4c55e59bfe3cc46252ed3) `sha256:2fbe9503ec8c6fa9c818ca858341021cda6b7d18fac17d250997a4033701a2de`
* [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager) git [486a0418](https://github.com/openshift/ironic-static-ip-manager/commit/486a041897d703d55ef59c98e2b20a01588a0b4c) `sha256:caf906a1e5030475ceac8a986c19561ed6fc9f48dcd9f704ad109bab828a77a6`
* [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator) git [05d6b0c4](https://github.com/openshift/kubernetes-kube-storage-version-migrator/commit/05d6b0c4537954b2b115c793646fb598756bb303) `sha256:984197b53048d45fe4a829ee0144d60fc33c3751755e24f0fa627ee4aeb58551`
* [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt) git [5eb884ab](https://github.com/openshift/cloud-provider-kubevirt/commit/5eb884abcd2ff17ae8d7b2691ca12494597c08a6) `sha256:47639e8a35d01341fd6decedeb6cafac8da152ded721a51d28033bc73d68a805`
* [multus-cni](https://github.com/openshift/multus-cni) git [8f597f4b](https://github.com/openshift/multus-cni/commit/8f597f4b90dffe1d1cb9aee558fe53a0046c9e35) `sha256:84006714dcb6b0b15934a92e777edb5ed9e52079f0a4a36517ecfb87c57a44f2`
* [multus-cni-microshift](https://github.com/openshift/multus-cni) git [8f597f4b](https://github.com/openshift/multus-cni/commit/8f597f4b90dffe1d1cb9aee558fe53a0046c9e35) `sha256:54e1528d7c428894142c3740d6e61b4d5cde734ae89bd099852579db50c7dc98`
* [network-interface-bond-cni](https://github.com/openshift/bond-cni) git [2c395f56](https://github.com/openshift/bond-cni/commit/2c395f566f259f1a1726409e2472029fa52918c9) `sha256:370e588f2cc7e8c33f7ef14dc187eb9d79884a3bc0c3ccd87927f03a47b627ac`
* [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon) git [20e6b987](https://github.com/openshift/network-metrics-daemon/commit/20e6b987ea44e7cf0805662e8fec44d625b6f278) `sha256:5988504b31a3de40575a6c0f612be5cb3c8adbc0a9934a98e928800232d15e90`
* [network-tools](https://github.com/openshift/network-tools) git [0b53ac3d](https://github.com/openshift/network-tools/commit/0b53ac3dccf59cd169555bf18c207122374bf003) `sha256:f88c44fc7a39ea2bf0185d71736d4d5a38f545110b1980f69ab57538d3a0c7d0`
* [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager) git [726a0562](https://github.com/openshift/openshift-controller-manager/commit/726a0562818b68faccfa130ae7ea17ff42915418) `sha256:2cb4dcd3c7f5b85e7d988790e4022f4dfd30f9b3d41138d993653aa12cd2d931`
* [openstack-resource-controller](https://github.com/openshift/openstack-resource-controller) git [58dbc048](https://github.com/openshift/openstack-resource-controller/commit/58dbc0482c144c21effee2476947889122a518eb) `sha256:9259e4f795cc943504f7d82d8a8af7983f94ff1ee8dda3846e0f13bdc518b859`
* [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator) git [f90431bf](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/commit/f90431bfe8ca93850450b2b24fae152d2385ca08) `sha256:7e56953efbbde7aed191dd119928035f7377de6edb83e7540b035af4c39e42ab`
* [prometheus](https://github.com/openshift/prometheus) git [01d83356](https://github.com/openshift/prometheus/commit/01d8335673aa6f88f5742ef510e133efee88a7bf) `sha256:c5019ed4c77fd8578b6e2e17c03667f113daa0716afda06920168dc57263dbb4`
* [route-controller-manager](https://github.com/openshift/route-controller-manager) git [59697cf7](https://github.com/openshift/route-controller-manager/commit/59697cf7af4517dd44e28179a57f7f35b6ea0e22) `sha256:8d9fbb0f96a11e02ad38d81752a5559766e9b89b586abd391e38d463e79fcd02`
* [service-ca-operator](https://github.com/openshift/service-ca-operator) git [ed872ba1](https://github.com/openshift/service-ca-operator/commit/ed872ba14b615ca5726ae90e987268877a0b0b20) `sha256:219a5d0bb7ea6ba2b59c8a2159fc9a0652664df89c8f05253154b9d2df81b72a`
* [telemeter](https://github.com/openshift/telemeter) git [22ba1701](https://github.com/openshift/telemeter/commit/22ba1701333f3fd26490cc15b89ddf21df3f67f6) `sha256:8a97a7286a259c96be877a116650a7f69d2ef3dc684697bf71a10b615c54ee1e`
* [thanos](https://github.com/openshift/thanos) git [2a09eb84](https://github.com/openshift/thanos/commit/2a09eb84b92ccd71d5f1f11e0dda6d5aa9624e19) `sha256:4335f6ce5cb7525c11ee3147f5c8577127d6261cd020abfa65f219b9bed99a97`


### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/9d3ba858ccb93831d99281659a3578e13bab9464)

* [OCPBUGS-126900](https://issues.redhat.com/browse/OCPBUGS-126900): Allow agent-installer invoker to have a suffix [#10978](https://github.com/openshift/assisted-service/pull/10978)
* [Full changelog](https://github.com/openshift/assisted-service/compare/8177722b388c34c334961352e9ab471ed4f8e95c...9d3ba858ccb93831d99281659a3578e13bab9464)


### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/c322faaa90c54af873bcf2102897c08d50c7ecdd)

* [OCPBUGS-126900](https://issues.redhat.com/browse/OCPBUGS-126900): Allow agent-installer invoker to have a suffix [#2347](https://github.com/openshift/assisted-installer/pull/2347)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/fa7eb52b083a161b122e1c543d487edb3de0955c...c322faaa90c54af873bcf2102897c08d50c7ecdd)


### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/449d4e9e9d2f08330d2d31ad80517caf990652c3)

* [OCPBUGS-127048](https://issues.redhat.com/browse/OCPBUGS-127048): Quote variable expansion in `skopeo inspect` invocation [#354](https://github.com/openshift/agent-installer-utils/pull/354)
* [OCPBUGS-127042](https://issues.redhat.com/browse/OCPBUGS-127042): Refresh rendezvous IP selection list [#353](https://github.com/openshift/agent-installer-utils/pull/353)
* [OCPBUGS-127008](https://issues.redhat.com/browse/OCPBUGS-127008): Fix agent TUI timeout [#350](https://github.com/openshift/agent-installer-utils/pull/350)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/33aa46920190a1c587599dfda77d9c1e3899e255...449d4e9e9d2f08330d2d31ad80517caf990652c3)


### [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws/tree/725c855793c97a62b4b670aa4523be4b406c2ebe)

* [OCPBUGS-128250](https://issues.redhat.com/browse/OCPBUGS-128250): UPSTREAM: &lt;carry&gt;: remove redundant GitHub summary verification [#659](https://github.com/openshift/cluster-api-provider-aws/pull/659)
* [Full changelog](https://github.com/openshift/cluster-api-provider-aws/compare/6fe56d037dc82c8babc6d70228dc89d3606385cd...725c855793c97a62b4b670aa4523be4b406c2ebe)


### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, gcp-pd-csi-driver-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/f1931a0b51ffd400af6d8b800cee27692957c1e2)

* : [release-5.0] OCPBUGS-128035: Enable pod-delete-after-umount CSI suite for driver OCP manifests [#628](https://github.com/openshift/csi-operator/pull/628)
* [OCPBUGS-120666](https://issues.redhat.com/browse/OCPBUGS-120666): fix(gcp-pd): do not apply guest-cluster resources against the management cluster on HyperShift [#623](https://github.com/openshift/csi-operator/pull/623)
* [Full changelog](https://github.com/openshift/csi-operator/compare/31b3192f3a5182ee1b523370cdfd94833b75e6d1...f1931a0b51ffd400af6d8b800cee27692957c1e2)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/e43280830436d7edddb488ce43a5709ef9396291)

* [OCPBUGS-126592](https://issues.redhat.com/browse/OCPBUGS-126592): Update RHCOS-release-5.0 bootimage metadata to 9.8.20260921-0 / 10.2.20260922-0 [#10923](https://github.com/openshift/installer/pull/10923)
* [OCPBUGS-126900](https://issues.redhat.com/browse/OCPBUGS-126900): use different INSTALL_INVOKER for unconfigured ignition [#10900](https://github.com/openshift/installer/pull/10900)
* [OCPBUGS-126682](https://issues.redhat.com/browse/OCPBUGS-126682): Inject the pull-secret as podman secret in the agent-installer-ui container [#10887](https://github.com/openshift/installer/pull/10887)
* [Full changelog](https://github.com/openshift/installer/compare/b6f119779c7ce529a94c7b8956a057343675f212...e43280830436d7edddb488ce43a5709ef9396291)


### [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal/tree/baead0597929c02bc1ce8e8f5a275c7430c5cd26)

* [OCPBUGS-123652](https://issues.redhat.com/browse/OCPBUGS-123652): Fix race that can provision multiple hosts [#280](https://github.com/openshift/cluster-api-provider-baremetal/pull/280)
* [OCPBUGS-104256](https://issues.redhat.com/browse/OCPBUGS-104256): Bump golang.org/x/net to v0.58.0 to address CVE-2026-33814 [#263](https://github.com/openshift/cluster-api-provider-baremetal/pull/263)
* [Full changelog](https://github.com/openshift/cluster-api-provider-baremetal/compare/f2b0db1919fff1344bc68948894c6775c0bf24a3...baead0597929c02bc1ce8e8f5a275c7430c5cd26)


### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/f269e4bf4b133be83153f8711a991ac71e7bafc8)

* [OCPBUGS-127499](https://issues.redhat.com/browse/OCPBUGS-127499): Add high contrast support to oauth templates [#1013](https://github.com/openshift/cluster-authentication-operator/pull/1013)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Update build-machinery-go vendor dependency [#998](https://github.com/openshift/cluster-authentication-operator/pull/998)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/954abf76eb0000ff218257489783c8e61dc115b8...f269e4bf4b133be83153f8711a991ac71e7bafc8)


### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/20369c92cc64521d6937e926d85791fac5dd505a)

* [OCPBUGS-122243](https://issues.redhat.com/browse/OCPBUGS-122243): Make HostPath VolumeMounts ReadOnly for image customization container [#659](https://github.com/openshift/cluster-baremetal-operator/pull/659)
* [OCPBUGS-123600](https://issues.redhat.com/browse/OCPBUGS-123600): Add attach_non_bootable_iso OTE test [#665](https://github.com/openshift/cluster-baremetal-operator/pull/665)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/d7957265fdafbbb93bb2a0d4723fc9719da1378d...20369c92cc64521d6937e926d85791fac5dd505a)


### [cluster-capi-controllers](https://github.com/openshift/cluster-api/tree/070008546d092b0f03b1d66dc69b71a96de17bd7)

* [OCPBUGS-128250](https://issues.redhat.com/browse/OCPBUGS-128250): UPSTREAM: &lt;carry&gt;: remove redundant GitHub summary verification [#314](https://github.com/openshift/cluster-api/pull/314)
* [Full changelog](https://github.com/openshift/cluster-api/compare/303d9786a5017d299b6e7fc702bb92f5cb4550cf...070008546d092b0f03b1d66dc69b71a96de17bd7)


### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/ae4883f8cb90b67e40eb08aaf52794cf07f26b8a)

* [OCPBUGS-128290](https://issues.redhat.com/browse/OCPBUGS-128290): Pass original TLSProfileSpec to security profile watcher [#679](https://github.com/openshift/cluster-capi-operator/pull/679)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/5afa8634c5bd26c8ed12dbecb0c31e79ed2fb39c...ae4883f8cb90b67e40eb08aaf52794cf07f26b8a)


### [cluster-config-api](https://github.com/openshift/api/tree/c1bf12f5d04823f92c88af6c9835890de13b3474)

* [OCPBUGS-123648](https://issues.redhat.com/browse/OCPBUGS-123648): [5.0] register DRADeviceTaintRules in all feature sets [#3040](https://github.com/openshift/api/pull/3040)
* [Full changelog](https://github.com/openshift/api/compare/31af9f93e31ecd483504b3302d78f67c5a077a9e...c1bf12f5d04823f92c88af6c9835890de13b3474)


### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/6f04db0c29856f1b0e93dbfd3303e5784c57175e)

* [OCPBUGS-127274](https://issues.redhat.com/browse/OCPBUGS-127274): fix(tnf): set read-only root filesystems [#1716](https://github.com/openshift/cluster-etcd-operator/pull/1716)
* [OCPBUGS-127061](https://issues.redhat.com/browse/OCPBUGS-127061): allow TLS 1.3 profiles without ciphers [#1714](https://github.com/openshift/cluster-etcd-operator/pull/1714)
* [OCPBUGS-123640](https://issues.redhat.com/browse/OCPBUGS-123640): fix: add missing workload paritioning annotation on cert-watcher daemonset [#1709](https://github.com/openshift/cluster-etcd-operator/pull/1709)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/fb6ecceb7232511baa7df34d38e65415de52322d...6f04db0c29856f1b0e93dbfd3303e5784c57175e)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/4ef55ea002a406a2e9193594ef583a24ddb4ff3b)

* [OCPBUGS-126741](https://issues.redhat.com/browse/OCPBUGS-126741): Bump to OSSM 3.4.2 and Istio v1.30.4 [#1600](https://github.com/openshift/cluster-ingress-operator/pull/1600)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/fe8a2bcf6342fab7aa19c47b4397a7d226962136...4ef55ea002a406a2e9193594ef583a24ddb4ff3b)


### [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver/tree/93c05fa0f59c67fdb35cd39dd55bdf8cd1f842a4)

* [OCPBUGS-128455](https://issues.redhat.com/browse/OCPBUGS-128455): Revert EgressIP validation backport [#338](https://github.com/openshift/cluster-machine-approver/pull/338)
* [OCPBUGS-127107](https://issues.redhat.com/browse/OCPBUGS-127107): fix: retry serving CSRs while Machine addresses populate [#322](https://github.com/openshift/cluster-machine-approver/pull/322)
* [Full changelog](https://github.com/openshift/cluster-machine-approver/compare/11c03d0952f281ca9cfb62e528e5a0e24ae644ab...93c05fa0f59c67fdb35cd39dd55bdf8cd1f842a4)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/6c05ec734024129de0f58caacc5c4ef74d8ea385)

* [OCPBUGS-127465](https://issues.redhat.com/browse/OCPBUGS-127465): fix(e2e): use Job with backoffLimit for TestDocExamples [#3104](https://github.com/openshift/cluster-monitoring-operator/pull/3104)
* [OCPBUGS-127422](https://issues.redhat.com/browse/OCPBUGS-127422): Fix flaky TestTelemetryReport/rate_issues [#3098](https://github.com/openshift/cluster-monitoring-operator/pull/3098)
* [OCPBUGS-126958](https://issues.redhat.com/browse/OCPBUGS-126958): restore node-exporter textfile metrics with read-only rootfs [#3096](https://github.com/openshift/cluster-monitoring-operator/pull/3096)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/efeeabf10a9c46f7a82086d2c04c9fc6d93a2b22...6c05ec734024129de0f58caacc5c4ef74d8ea385)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/f6e3f382e8c2282f48722431eed38cdbc44d8e9f)

* [OCPBUGS-123795](https://issues.redhat.com/browse/OCPBUGS-123795): apis: add missing fields to apis v1 [#1636](https://github.com/openshift/cluster-node-tuning-operator/pull/1636)
* [OCPBUGS-123511](https://issues.redhat.com/browse/OCPBUGS-123511): e2e: make OVS dynamic pinning tests compatible with ovsDpdk CPUs [#1631](https://github.com/openshift/cluster-node-tuning-operator/pull/1631)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/accb8e2235f97d682b9d3aea95295bdfaf9b15e0...f6e3f382e8c2282f48722431eed38cdbc44d8e9f)


### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/1f558eec1a9848958510a1dd8d3c84a711840ca8)

* [OCPBUGS-128248](https://issues.redhat.com/browse/OCPBUGS-128248): Use KCS link in the un-upgradeable message [#745](https://github.com/openshift/cluster-storage-operator/pull/745)
* [OCPBUGS-123152](https://issues.redhat.com/browse/OCPBUGS-123152): Backport gcp pd hypershift release 5.0 [#743](https://github.com/openshift/cluster-storage-operator/pull/743)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/b2ee363241ad0425efd56badb6046884cadda97d...1f558eec1a9848958510a1dd8d3c84a711840ca8)


### [console](https://github.com/openshift/console/tree/d63818a73d0df1db4608a518d959da7068324730)

* [OCPBUGS-128463](https://issues.redhat.com/browse/OCPBUGS-128463): provide PatternFly dynamic modules without Console consuming them [#17325](https://github.com/openshift/console/pull/17325)
* [OCPBUGS-127187](https://issues.redhat.com/browse/OCPBUGS-127187): Add CSP violation detection to Playwright [#17218](https://github.com/openshift/console/pull/17218)
* [OCPBUGS-127019](https://issues.redhat.com/browse/OCPBUGS-127019): restore some old test-prow-e2e scenarios [#17198](https://github.com/openshift/console/pull/17198)
* [OCPBUGS-127051](https://issues.redhat.com/browse/OCPBUGS-127051): Post qa-verify evidence via gh's native --attach instead of base64 [#17200](https://github.com/openshift/console/pull/17200)
* [OCPBUGS-120722](https://issues.redhat.com/browse/OCPBUGS-120722): Helm backend test flake: parallel packages race on global pkill chartmuseum [#17144](https://github.com/openshift/console/pull/17144)
* [OCPBUGS-126894](https://issues.redhat.com/browse/OCPBUGS-126894): i18n upload/download routine task - version 4.23/5.0 (Additional) [#17195](https://github.com/openshift/console/pull/17195)
* [OCPBUGS-126884](https://issues.redhat.com/browse/OCPBUGS-126884): Keep notification bell visible when read notifications exist [#17194](https://github.com/openshift/console/pull/17194)
* [OCPBUGS-114008](https://issues.redhat.com/browse/OCPBUGS-114008): Strip version tag from OCI chart URL to prevent doubl… [#17097](https://github.com/openshift/console/pull/17097)
* [OCPBUGS-122258](https://issues.redhat.com/browse/OCPBUGS-122258): Handle Prometheus percentage strings [#17161](https://github.com/openshift/console/pull/17161)
* [OCPBUGS-123616](https://issues.redhat.com/browse/OCPBUGS-123616): increase httpRetry and update yarn [#17181](https://github.com/openshift/console/pull/17181)
* [OCPBUGS-123202](https://issues.redhat.com/browse/OCPBUGS-123202): Fix Namespace column hidden on Node Pods tab with active namespace [#17175](https://github.com/openshift/console/pull/17175)
* [OCPBUGS-123647](https://issues.redhat.com/browse/OCPBUGS-123647): i18n upload/download routine task - version 4.23/5.0 [#17183](https://github.com/openshift/console/pull/17183)
* And 3 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/console/compare/e15ec744673924852b341bb517d605c6c6989413...d63818a73d0df1db4608a518d959da7068324730)


### [container-networking-plugins, containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins/tree/38989a55d844f751631dd23d9b86fde5a5195acc)

* NO-JIRA: Fix Go builders in CI [#250](https://github.com/openshift/containernetworking-plugins/pull/250)
* [Full changelog](https://github.com/openshift/containernetworking-plugins/compare/d253ee09d629b8172ffc9c3e4b571320fc63ee34...38989a55d844f751631dd23d9b86fde5a5195acc)


### [haproxy-router, haproxy-router-haproxy28, haproxy-router-haproxy32](https://github.com/openshift/router/tree/a39a742e03e7be863c92c4b820025c6e0f78a7eb)

* [OCPBUGS-123650](https://issues.redhat.com/browse/OCPBUGS-123650): Lock DeleteFunc to stop SARCompleted overwriting rejection [#846](https://github.com/openshift/router/pull/846)
* [Full changelog](https://github.com/openshift/router/compare/3381229146657d2e6bd94115dda0885f25cb3bed...a39a742e03e7be863c92c4b820025c6e0f78a7eb)


### [hyperkube, installer-kube-apiserver-artifacts, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/2a6104ec563aeaa77c97352f4d28580eea7918d2)

* NOJIRA: add explicit merge commit message [#2792](https://github.com/openshift/kubernetes/pull/2792)
* [OCPBUGS-127122](https://issues.redhat.com/browse/OCPBUGS-127122): UPSTREAM: &lt;carry&gt;: Use FROM scratch for RHEL pause image [#2786](https://github.com/openshift/kubernetes/pull/2786)
* NO-JIRA: Rebase release-5.0 to Kubernetes v1.36.4 [#2776](https://github.com/openshift/kubernetes/pull/2776)
* [Full changelog](https://github.com/openshift/kubernetes/compare/b376ee7b841bed5a51cb9520b37d87931c48a821...2a6104ec563aeaa77c97352f4d28580eea7918d2)


### [hypershift](https://github.com/openshift/hypershift/tree/3e9f6e8f3eefef70ef3404dabf0ca10ee866fb42)

* [OCPBUGS-127000](https://issues.redhat.com/browse/OCPBUGS-127000): Updating ose-hypershift-container image to be consistent with ART for 5.0 [#9713](https://github.com/openshift/hypershift/pull/9713)
* [OCPBUGS-126441](https://issues.redhat.com/browse/OCPBUGS-126441): openstack: Start populating cacert in clouds.yaml [#9655](https://github.com/openshift/hypershift/pull/9655)
* [OCPBUGS-123155](https://issues.redhat.com/browse/OCPBUGS-123155): complete GCP PD wiring in HyperShift [#9598](https://github.com/openshift/hypershift/pull/9598)
* [ACM-41684](https://issues.redhat.com/browse/ACM-41684): Switch hypershift-operator runtime to PQC base image [#9452](https://github.com/openshift/hypershift/pull/9452)
* [CNTRLPLANE-4159](https://issues.redhat.com/browse/CNTRLPLANE-4159): Maintain ingress serving cert for HostedCluster ingress [#9604](https://github.com/openshift/hypershift/pull/9604)
* [OCPBUGS-122276](https://issues.redhat.com/browse/OCPBUGS-122276): fix(hcco): run kas-connection-checker as non-root [#9694](https://github.com/openshift/hypershift/pull/9694)
* [ACM-41684](https://issues.redhat.com/browse/ACM-41684): Switch hypershift-operator runtime to PQC base image [#9590](https://github.com/openshift/hypershift/pull/9590)
* [OCPBUGS-112730](https://issues.redhat.com/browse/OCPBUGS-112730): fix(certs): normalize IP SANs to stop dual-stack KAS cert churn [#9495](https://github.com/openshift/hypershift/pull/9495)
* [OCPBUGS-122229](https://issues.redhat.com/browse/OCPBUGS-122229): filter AWS-reserved tag keys before calling DeleteTags [#9576](https://github.com/openshift/hypershift/pull/9576)
* [OCPBUGS-123150](https://issues.redhat.com/browse/OCPBUGS-123150): [release-5.0] [CNTRLPLANE-3626](https://redhat.atlassian.net/browse/CNTRLPLANE-3626): feat(ignition-server, ignition-server-proxy): inject centralized TLS configuration [#9408](https://github.com/openshift/hypershift/pull/9408)
* [OCPBUGS-123793](https://issues.redhat.com/browse/OCPBUGS-123793): Use multiarch CI build root on release-5.0 [#9633](https://github.com/openshift/hypershift/pull/9633)
* [Full changelog](https://github.com/openshift/hypershift/compare/93cce984163b400abfde05b67a0b7d5f3f589d4e...3e9f6e8f3eefef70ef3404dabf0ca10ee866fb42)


### [ironic](https://github.com/openshift/ironic-image/tree/de4cf8f092d4b17dd6607a1dbe7d096547224d99)

* [OCPBUGS-98475](https://issues.redhat.com/browse/OCPBUGS-98475): bump sushy to include fix [#918](https://github.com/openshift/ironic-image/pull/918)
* Bug OCPBUGS-123709: Bumping sushy hash to include jobstate fixes [#914](https://github.com/openshift/ironic-image/pull/914)
* [Full changelog](https://github.com/openshift/ironic-image/compare/1b55b61973edd01938783aa2c3cc22c9ea97dfa6...de4cf8f092d4b17dd6607a1dbe7d096547224d99)


### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/15ce1906da17ac8cf0f0d58b5f1babcc503ad8c6)

* [OCPBUGS-125793](https://issues.redhat.com/browse/OCPBUGS-125793): Add opt-in kube-rbac-proxy sidecar for pprof endpoint (AWS) [#1556](https://github.com/openshift/machine-api-operator/pull/1556)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/b3cabb0301b12a2b256bf8aed85c3f4c7b0dab3c...15ce1906da17ac8cf0f0d58b5f1babcc503ad8c6)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/cafc37a760319b235d5301e3790f83e2de9d78f7)

* [OCPBUGS-127447](https://issues.redhat.com/browse/OCPBUGS-127447): Nodes created with 4.13 base images cannot join the cluster [#6580](https://github.com/openshift/machine-config-operator/pull/6580)
* [OCPBUGS-119104](https://issues.redhat.com/browse/OCPBUGS-119104): drop GCD health-check ranges in openshift-gcp-routes [#6555](https://github.com/openshift/machine-config-operator/pull/6555)
* [OCPBUGS-123664](https://issues.redhat.com/browse/OCPBUGS-123664): Correctly handle MC deletion in image mode when no new build is required [#6546](https://github.com/openshift/machine-config-operator/pull/6546)
* [OCPBUGS-122277](https://issues.redhat.com/browse/OCPBUGS-122277): Fix IsBootImageUpdateSupported to include vSphere and Azure platforms [#6530](https://github.com/openshift/machine-config-operator/pull/6530)
* [OCPBUGS-126703](https://issues.redhat.com/browse/OCPBUGS-126703): Add '..' block, max-length, and cross-store uniqueness [#6483](https://github.com/openshift/machine-config-operator/pull/6483)
* [OCPBUGS-122238](https://issues.redhat.com/browse/OCPBUGS-122238): [TNF] Add infinite retry on untaint systemd unit [#6553](https://github.com/openshift/machine-config-operator/pull/6553)
* [OCPBUGS-122915](https://issues.redhat.com/browse/OCPBUGS-122915): Mount /etc/container in mosb [#6537](https://github.com/openshift/machine-config-operator/pull/6537)
* [OCPBUGS-122217](https://issues.redhat.com/browse/OCPBUGS-122217): Dump compact cache to CM for persistence [#6525](https://github.com/openshift/machine-config-operator/pull/6525)
* [OCPBUGS-121942](https://issues.redhat.com/browse/OCPBUGS-121942): Replace wildcard permissions with explicit verbs in MachineConfigServer ClusterRole [#6514](https://github.com/openshift/machine-config-operator/pull/6514)
* [OCPBUGS-123672](https://issues.redhat.com/browse/OCPBUGS-123672): Pass missing proxy vars to bootstrap MCC [#6548](https://github.com/openshift/machine-config-operator/pull/6548)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/ec5cb6c3bcd7448f2b757ab951eafd2c46d677b9...cafc37a760319b235d5301e3790f83e2de9d78f7)


### [machine-os-images](https://github.com/openshift/machine-os-images/tree/631d5def9be9903585e92dcde6a877362f12586b)

* [OCPBUGS-127128](https://issues.redhat.com/browse/OCPBUGS-127128): [release-5.0] Fix OKD/SCOS builds to use centos CoreOS streams [#119](https://github.com/openshift/machine-os-images/pull/119)
* [Full changelog](https://github.com/openshift/machine-os-images/compare/bf618aac93c71a56e8249669c579f0a782742e2e...631d5def9be9903585e92dcde6a877362f12586b)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/e8610c3c8b35ec0758523c21a2e60aa8c7e59914)

* NO-JIRA: [release-5.0] Sanitize alert runbook URLs [#1290](https://github.com/openshift/monitoring-plugin/pull/1290)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/97c9a8384e5d7fe92d9b1bc4dc8c676b6bc78eff...e8610c3c8b35ec0758523c21a2e60aa8c7e59914)


### [multus-route-override-cni](https://github.com/openshift/route-override-cni/tree/0c111164a2c5c7f315aa58f257b7fa862e1c6b51)

* NO-JIRA: Update CI builders to Go 1.26 [#82](https://github.com/openshift/route-override-cni/pull/82)
* [Full changelog](https://github.com/openshift/route-override-cni/compare/375ac966115fd03febd218a8331e8794560bd28e...0c111164a2c5c7f315aa58f257b7fa862e1c6b51)


### [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni/tree/5853a398100c6b274165ef062906bdf91bba9e4b)

* NO-JIRA: Update CI builders to Go 1.26 [#436](https://github.com/openshift/whereabouts-cni/pull/436)
* [Full changelog](https://github.com/openshift/whereabouts-cni/compare/4b0c2166726247e36a0125432609844045e48dc3...5853a398100c6b274165ef062906bdf91bba9e4b)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/4b73531b19eecb6a73dc2cb9e26606a06e1f8725)

* [OCPNETUI-146](https://issues.redhat.com/browse/OCPNETUI-146): Align shared modules with Console [#560](https://github.com/openshift/networking-console-plugin/pull/560)
* maintenance: Bump the npm group with 10 updates [#547](https://github.com/openshift/networking-console-plugin/pull/547)
* maintenance: Bump the npm group across 1 directory with 216 updates [#542](https://github.com/openshift/networking-console-plugin/pull/542)
* maintenance: Bump terser-webpack-plugin from 5.4.0 to 5.6.1 [#531](https://github.com/openshift/networking-console-plugin/pull/531)
* maintenance: Bump loader-runner from 4.3.1 to 4.3.2 [#530](https://github.com/openshift/networking-console-plugin/pull/530)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/4509d691e67664e9b3a911278fcbf38d54bb9cfc...4b73531b19eecb6a73dc2cb9e26606a06e1f8725)


### [oauth-proxy](https://github.com/openshift/oauth-proxy/tree/eb5344f3aba1752b569747c9c15210acff873666)

* [ACM-37203](https://issues.redhat.com/browse/ACM-37203): Add support for configurable TLS profiles [#380](https://github.com/openshift/oauth-proxy/pull/380)
* [Full changelog](https://github.com/openshift/oauth-proxy/compare/310d2f7b90762b407d6100eb3940bd5b2f348108...eb5344f3aba1752b569747c9c15210acff873666)


### [oauth-server](https://github.com/openshift/oauth-server/tree/e1a28882b283cf0be80628c7aaae83cb9020afd0)

* [OCPBUGS-127499](https://issues.redhat.com/browse/OCPBUGS-127499): Add high contrast support to oauth templates [#286](https://github.com/openshift/oauth-server/pull/286)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Update build-machinery-go vendor dependency [#261](https://github.com/openshift/oauth-server/pull/261)
* [Full changelog](https://github.com/openshift/oauth-server/compare/ba7cdda479958ce73517b546f81ed8d4998d318d...e1a28882b283cf0be80628c7aaae83cb9020afd0)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/1d2affb98c6ead7ef77bed3b0e169145e7f9d6cb)

* [OCPBUGS-122282](https://issues.redhat.com/browse/OCPBUGS-122282): egressip: set IFA_PROTO on EgressIP addresses to prevent nmstate persistence [#3437](https://github.com/openshift/ovn-kubernetes/pull/3437)
* [OCPBUGS-127013](https://issues.redhat.com/browse/OCPBUGS-127013): [release-5.0] e2e: exclude machine network subnets from UDN/BGP allocators [#3466](https://github.com/openshift/ovn-kubernetes/pull/3466)
* [OCPBUGS-122287](https://issues.redhat.com/browse/OCPBUGS-122287): Fix wrong infrastructure-locked role when namespace is missing [#3438](https://github.com/openshift/ovn-kubernetes/pull/3438)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/7b4de5ed3bd4381e3a17cdfddbe14be1432b9860...1d2affb98c6ead7ef77bed3b0e169145e7f9d6cb)


### [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs/tree/f4378c2d8cea286ad2ff2f57235c970bf90abaf5)

* [OCPBUGS-101730](https://issues.redhat.com/browse/OCPBUGS-101730), [OCPBUGS-104390](https://issues.redhat.com/browse/OCPBUGS-104390), [OCPBUGS-108069](https://issues.redhat.com/browse/OCPBUGS-108069): Bump x/net to address CVEs [#111](https://github.com/openshift/cloud-provider-powervs/pull/111)
* [Full changelog](https://github.com/openshift/cloud-provider-powervs/compare/18eb5238fb2c86632edb24175f536d815f28ddf6...f4378c2d8cea286ad2ff2f57235c970bf90abaf5)


### [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs/tree/467f6c5b9e880a62c442e6fc6f3f4877f4cd9d04)

* [OCPBUGS-113646](https://issues.redhat.com/browse/OCPBUGS-113646): Update dependencies to k8s 1.36 [#148](https://github.com/openshift/machine-api-provider-powervs/pull/148)
* [Full changelog](https://github.com/openshift/machine-api-provider-powervs/compare/28c928ff78def160837170991f084b0fe71ca9be...467f6c5b9e880a62c442e6fc6f3f4877f4cd9d04)


### [prom-label-proxy](https://github.com/openshift/prom-label-proxy/tree/64ae73faf7bfa202e1abb9e122d6415a9a9f9a94)

* NO-ISSUE: synchronize OWNERS from main branch [release-5.0] [#410](https://github.com/openshift/prom-label-proxy/pull/410)
* [Full changelog](https://github.com/openshift/prom-label-proxy/compare/4ab9ff73c665319352288fe0b9b9e1df71832525...64ae73faf7bfa202e1abb9e122d6415a9a9f9a94)


### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/d2f710d9f859e73f3e03adf69bd25e0014865a5e)

* NO-ISSUE: synchronize OWNERS from main branch [release-5.0] [#211](https://github.com/openshift/node_exporter/pull/211)
* [Full changelog](https://github.com/openshift/node_exporter/compare/b8af472104ce559c8fb9bf31fd4fc38bdbdc34e7...d2f710d9f859e73f3e03adf69bd25e0014865a5e)


### [tests](https://github.com/openshift/origin/tree/b19e60087bbee9ccceefc09908e69cf1b55ed6e7)

* [OCPBUGS-127400](https://issues.redhat.com/browse/OCPBUGS-127400): Redact OAuth tokens from test cleanup logs [#31668](https://github.com/openshift/origin/pull/31668)
* [OCPBUGS-127419](https://issues.redhat.com/browse/OCPBUGS-127419): Fix node replacement test timestamp filter and allow job retry [#31577](https://github.com/openshift/origin/pull/31577)
* [OCPBUGS-123600](https://issues.redhat.com/browse/OCPBUGS-123600): Register cluster-baremetal-tests-ext in extension registry [#31641](https://github.com/openshift/origin/pull/31641)
* [[release-5.0] OCPBUGS-121193: Fixed Flakiness of Webhook test - ClusterResourceQuota validation](https://github.com/openshift/origin/pull/31642#top) [#31642](https://github.com/openshift/origin/pull/31642)
* [Full changelog](https://github.com/openshift/origin/compare/83ec78e3c4eece275f65229c420b211a427edde3...b19e60087bbee9ccceefc09908e69cf1b55ed6e7)


### [volume-data-source-validator](https://github.com/openshift/volume-data-source-validator/tree/42a87e53d18314300ffc1d91845f2667ea3812a7)

* [OCPBUGS-104423](https://issues.redhat.com/browse/OCPBUGS-104423): Bump golang.org/x/net to version 0.57.0 that fixes CVE-2026-33814 [#18](https://github.com/openshift/volume-data-source-validator/pull/18)
* [Full changelog](https://github.com/openshift/volume-data-source-validator/compare/ee9cd7aba4e096a9a957386ef20777e8950df352...42a87e53d18314300ffc1d91845f2667ea3812a7)


### [vsphere-csi-driver, vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver/tree/ccc6fcb38a09ab60413da64ea8a9492c8d656b73)

* [OCPBUGS-126888](https://issues.redhat.com/browse/OCPBUGS-126888): Fix credential exposure in logs (CWE-532) [#203](https://github.com/openshift/vmware-vsphere-csi-driver/pull/203)
* [OCPBUGS-126711](https://issues.redhat.com/browse/OCPBUGS-126711): UPSTREAM: 4272: Fix crash in syncer when node can't be found [#202](https://github.com/openshift/vmware-vsphere-csi-driver/pull/202)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver/compare/6b18bb29fc45383c21aa6c7513d151e443aa305e...ccc6fcb38a09ab60413da64ea8a9492c8d656b73)