# 5.1.0-okd-scos.ec.0
Created: 2026-10-20 23:47:04 +0000 UTC
Image Digest: `sha256:21939e69e90bd9599b848e7aca34ecaf1fbbbabc1ae6b081380aa88bb2d88d6a`
Promoted from registry.ci.openshift.org/origin/release-scos:5.1.0-0.okd-scos-nightly-2026-10-17-054048
## Changes from 5.0.0-okd-scos.ec.10
### Components
* Kubectl 1.36.2
* Kubernetes upgraded from 1.36.3 to 1.37.1
* Kubernetes Tests 1.36.2
* CentOS Stream CoreOS 10 upgraded from 10.0.20260819-0 to 10.0.20261014-0
### FeatureGate Changes
| FeatureGate | Default
Hypershift | Default
SelfManagedHA | DevPreviewNoUpgrade
Hypershift | DevPreviewNoUpgrade
SelfManagedHA | OKD
Hypershift | OKD
SelfManagedHA | TechPreviewNoUpgrade
Hypershift | TechPreviewNoUpgrade
SelfManagedHA |
| :------ | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: |
| AWSServiceLBNetworkSecurityGroup
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| AzureWorkloadIdentity
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| BootImageSkewEnforcement
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| SigstoreImageVerification
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| SigstoreImageVerificationPKI
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| VSphereMultiDisk
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| VSphereMultiNetworks
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| VolumeGroupSnapshot
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| OpenShiftPodSecurityAdmission
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| SELinuxMount
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| TLSAdherence
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| VSphereMultiVCenterDay2
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| AuthenticationComponentProxy
(0 tests)| Disabled| Enabled
(Changed)| Disabled| Enabled| Disabled| Enabled
(Changed)| Disabled| Enabled |
| CompositePodGroup
(0 tests)| | | | | | | | |
| ControllerManagerConfig
(0 tests)| | | | Enabled
(New)| | | | |
| DRADeviceTaintRules
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| DRAWorkloadResourceClaims
(0 tests)| | | | | | | | |
| EgressIPNodeSelector
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| ExternalOIDCAsWebhook
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| GenericWorkload
(0 tests)| | | | | | | | |
| GomaxprocsInjection
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| IngressControllerLBSecurityGroupsAWS
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| MACSecurity
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| ManagedBootImagesAWSCAPI
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| OLMLifecycleAndCompatibility
(0 tests)| Disabled| Enabled| Disabled| Enabled| Disabled| Enabled| Disabled| Disabled
(Changed) |
| OVNKubernetesUplinkMode
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | | |
| PodGroupPreemptionPolicy
(0 tests)| | | | | | | | |
| TopologyAwareWorkloadScheduling
(0 tests)| | | | | | | | |
| UnifiedClusterManagedDNSAndLB
(0 tests)| | | | Enabled
(New)| | | | |
| VSpherePerComponentScopedCreds
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | | |
### New images
* [azure-karpenter-provider-azure](https://github.com/openshift/Azure-karpenter-provider-azure) git [28a0c2c6](https://github.com/openshift/Azure-karpenter-provider-azure/commit/28a0c2c60d6bd9e10cfcd8d891dee185b5d09750) `sha256:b191289af97208ae222217471fbdce9e3b992eb92ff839bec1ea0210263d3e09`
### Removed images
* cluster-kube-cluster-api-operator
* configmap-reloader
* oc-mirror
### Rebuilt images without code change
* [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook) git [0d33a459](https://github.com/openshift/aws-pod-identity-webhook/commit/0d33a4596e2a22d188fe74c4a6497c37c2528c1f) `sha256:0108adde0577f232a753e725567c5130591eee608594fc1b001487d6cfd8cdd1`
* [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator) git [8da2f1fc](https://github.com/openshift/cluster-openshift-controller-manager-operator/commit/8da2f1fcb1e76e8b1b97b16ca7bbfa7116287eb8) `sha256:af3f8580414042a55a88065f9b802a0e075dc5bf82c064e6bbae1ca101cc4a3f`
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [9607604d](https://github.com/openshift/cluster-update-keys/commit/9607604d35acee234051bd0da8a14321b4edd38e) `sha256:11d0670f2dddffb2e665d77a5679aec45014e276a60f2befc8b04b5876179ebd`
* [csi-external-resizer](https://github.com/openshift/csi-external-resizer) git [14aa7028](https://github.com/openshift/csi-external-resizer/commit/14aa7028f485e95c800bb7ffbf9b66a2bf75ceaf) `sha256:c2ad0f60b7de589e1de99499cbb3600df6bed00c18f2f4378a65677f3e28f108`
* [csi-external-snapshotter](https://github.com/openshift/csi-external-snapshotter) git [a019d1a9](https://github.com/openshift/csi-external-snapshotter/commit/a019d1a9d9e1d26ffd0b2e0d911733180fa608b2) `sha256:a702278cdbb63896dbe5ee683c3bbfc51890cb08fd87e230664381f58f617b0a`
* [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar) git [5766960d](https://github.com/openshift/csi-node-driver-registrar/commit/5766960d82ffb9ef84d15e903ae57d0a6781ef11) `sha256:0448a90dd7d4a977b18eb5f3222a2b39b1c32e85aede2652fa5c6c567a0dfa57`
* [csi-snapshot-controller](https://github.com/openshift/csi-external-snapshotter) git [a019d1a9](https://github.com/openshift/csi-external-snapshotter/commit/a019d1a9d9e1d26ffd0b2e0d911733180fa608b2) `sha256:734e96302d6e02712ee790c3a7ba5a052ccde3349b1b013941ef5f2421dca744`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [b63b175a](https://github.com/openshift/driver-toolkit/commit/b63b175a79b9fe0c29f6ed63df3c2d7862ba408a) `sha256:71ff71799ca2efecdb817e5e9d6d1673160162c108fc4a0fdf282eb7dc88156a`
* [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp) git [51c32646](https://github.com/openshift/cloud-provider-gcp/commit/51c326465b3160124b8097953b42e44f1056da5a) `sha256:c26d772ee44405bac55b9d8a9f7f9af52331c1047b6df250feb8878e72cae884`
* [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook) git [4501ff2f](https://github.com/openshift/gcp-workload-identity-federation-webhook/commit/4501ff2f53576c31df0511b69444e65e1eeba745) `sha256:9c260efbae758c472fcb133c8c9beb0ac35083a78a9f87a7898e793dc18b22da`
* [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm) git [11bc35dd](https://github.com/openshift/cloud-provider-ibm/commit/11bc35dd6fd5163259023a6f1dfcc59ce813ab5f) `sha256:8a12fbe4da01c8d227f1856f17816ba75b25ffaa92bbdc4a0b8157810b894fe6`
* [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [f8e41b2e](https://github.com/openshift/ironic-rhcos-downloader/commit/f8e41b2ed8915474a99e3eb34b54692afb0611da) `sha256:ebe489fc7705a05fdb4babce5dc3be31f317b01dcb5a3a9d4305f5d0e1dc3e2e`
* [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager) git [486a0418](https://github.com/openshift/ironic-static-ip-manager/commit/486a041897d703d55ef59c98e2b20a01588a0b4c) `sha256:c9b37ebb1f80f96a3e1b17ea8b99382036d02f66a39afbb0b90b83d6c3e0b039`
* [nutanix-machine-controllers](https://github.com/openshift/machine-api-provider-nutanix) git [249b7c8e](https://github.com/openshift/machine-api-provider-nutanix/commit/249b7c8edfca8f25413dc76bc5a216fbe12a9ab1) `sha256:09856078a6e5917ddad3bf255119ad296937deb4c9421141a3c2eef99869a986`
* [service-ca-operator](https://github.com/openshift/service-ca-operator) git [ed872ba1](https://github.com/openshift/service-ca-operator/commit/ed872ba14b615ca5726ae90e987268877a0b0b20) `sha256:b861196edb2fb8cdbe63753b8ec515105b73b9c36647e2ba00286fd37f10405e`
* [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere) git [eb29de19](https://github.com/openshift/cloud-provider-vsphere/commit/eb29de194594bad8e5bc572102f1008cb26655a7) `sha256:d40e94686b635579ae1cc2a2daee81ae3703d4272cc66402f9f272b14428d33e`
### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/9307cfae14e639b061127932c2fefedb11c987f0)
* NO-ISSUE: [master] Bump OCP versions: 4.22, 4.19 [#11229](https://github.com/openshift/assisted-service/pull/11229)
* NO-ISSUE: [master] Bump OCP versions: 4.20, 4.21 [#11205](https://github.com/openshift/assisted-service/pull/11205)
* [AGENT-1648](https://issues.redhat.com/browse/AGENT-1648): Set fips in install-config for the agent-based installer [#11114](https://github.com/openshift/assisted-service/pull/11114)
* NO-ISSUE: [master] Bump OCP versions: 5.0 [#11204](https://github.com/openshift/assisted-service/pull/11204)
* [MGMT-19216](https://issues.redhat.com/browse/MGMT-19216): Add node selector and tolerations to our webhook [#11049](https://github.com/openshift/assisted-service/pull/11049)
* [ACM-44934](https://issues.redhat.com/browse/ACM-44934): CVE-2026-88031 Bump github.com/go-openapi/loads, github.com/go-openapi/analysis, github.com/go-openapi/validate, github.com/go-openapi/strfmt to fix CVE-2026-88031 through introducers update (models module) [#11165](https://github.com/openshift/assisted-service/pull/11165)
* [MGMT-25133](https://issues.redhat.com/browse/MGMT-25133): Accept OpenSSH authorized_keys options in SSH key validation [#10830](https://github.com/openshift/assisted-service/pull/10830)
* [ACM-44934](https://issues.redhat.com/browse/ACM-44934): CVE-2026-88031 Bump go.mongodb.org/mongo-driver to v1.17.10 through indirect dependency conversion (api module) [#11164](https://github.com/openshift/assisted-service/pull/11164)
* [ACM-47334](https://issues.redhat.com/browse/ACM-47334): CVE-2026-63209 Bump github.com/klauspost/compress to v1.18.7 through indirect dependency conversion [#11149](https://github.com/openshift/assisted-service/pull/11149)
* NO-ISSUE: upgrade Go to 1.26.7 [#11119](https://github.com/openshift/assisted-service/pull/11119)
* NO-ISSUE: [master] Bump OCP versions: 4.16, 4.14, 4.19 [#11197](https://github.com/openshift/assisted-service/pull/11197)
* [ACM-47458](https://issues.redhat.com/browse/ACM-47458): CVE-2026-84304 Bump google.golang.org/grpc to v1.83.1 using replace directive (api module) [#11185](https://github.com/openshift/assisted-service/pull/11185)
* [ACM-44934](https://issues.redhat.com/browse/ACM-44934): CVE-2026-88031 Bump go.mongodb.org/mongo-driver to v1.17.10 through indirect dependency conversion (client module) [#11195](https://github.com/openshift/assisted-service/pull/11195)
* [ACM-47334](https://issues.redhat.com/browse/ACM-47334): CVE-2026-63209 Bump github.com/klauspost/compress to v1.18.7 using replace directive (api module) [#11155](https://github.com/openshift/assisted-service/pull/11155)
* [ACM-47334](https://issues.redhat.com/browse/ACM-47334): CVE-2026-63209 Bump github.com/klauspost/compress to v1.18.7 using replace directive (models module) [#11156](https://github.com/openshift/assisted-service/pull/11156)
* [ACM-47334](https://issues.redhat.com/browse/ACM-47334): CVE-2026-63209 Bump github.com/klauspost/compress to v1.18.7 using replace directive (client module) [#11157](https://github.com/openshift/assisted-service/pull/11157)
* [ACM-47458](https://issues.redhat.com/browse/ACM-47458): CVE-2026-84304 Bump google.golang.org/grpc to v1.83.1 through indirect dependency conversion [#11139](https://github.com/openshift/assisted-service/pull/11139)
* NO-ISSUE: [master] Bump OCP versions: 4.22, 4.20, 4.21 [#11094](https://github.com/openshift/assisted-service/pull/11094)
* [MGMT-25505](https://issues.redhat.com/browse/MGMT-25505): moving seaweedfs to our own repo [#11085](https://github.com/openshift/assisted-service/pull/11085)
* [MGMT-25497](https://issues.redhat.com/browse/MGMT-25497): Use OCP version for disconnected iso images [#11062](https://github.com/openshift/assisted-service/pull/11062)
* [ACM-39262](https://issues.redhat.com/browse/ACM-39262): chain PostgreSQL hops for EUS skip-upgrades [#10882](https://github.com/openshift/assisted-service/pull/10882)
* [MGMT-24807](https://issues.redhat.com/browse/MGMT-24807): OpenShift AI validation message is confusing — doesn't state role and shows a different (lower) CPU/RAM number than the aggregated worker-role requirement [#10969](https://github.com/openshift/assisted-service/pull/10969)
* [MGMT-23594](https://issues.redhat.com/browse/MGMT-23594): Installation should not be stopped if we can't pull the must gather image [#10935](https://github.com/openshift/assisted-service/pull/10935)
* [OCPBUGS-104857](https://issues.redhat.com/browse/OCPBUGS-104857): Disk validation falsely reports iSCSI host IP conflict when iBFT initiator uses DHCP (flags=7) on dual-homed host [#11007](https://github.com/openshift/assisted-service/pull/11007)
* NO-ISSUE: [master] Bump OCP versions: 4.14, 4.20, 5.0, 4.22, 4.16, 4.21, 4.18, 4.19, 4.17 [#11084](https://github.com/openshift/assisted-service/pull/11084)
* [MGMT-25505](https://issues.redhat.com/browse/MGMT-25505): minio was deprecated [#11050](https://github.com/openshift/assisted-service/pull/11050)
* NO-ISSUE: [master] Bump OCP versions: 4.22, 4.19, 4.20, 4.21 [#11004](https://github.com/openshift/assisted-service/pull/11004)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#10957](https://github.com/openshift/assisted-service/pull/10957)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#10958](https://github.com/openshift/assisted-service/pull/10958)
* NO-ISSUE: [master] Bump OCP versions: 5.0, 4.18, 4.19, 4.13 [#10980](https://github.com/openshift/assisted-service/pull/10980)
* [MGMT-25431](https://issues.redhat.com/browse/MGMT-25431): CVE-2026-84445 Bump google.golang.org/grpc to v1.82.2 through indirect dependency conversion [#10975](https://github.com/openshift/assisted-service/pull/10975)
* [MGMT-24967](https://issues.redhat.com/browse/MGMT-24967): Static-IP iSCSI Boot-from-SAN Support in Assisted Installer [#10925](https://github.com/openshift/assisted-service/pull/10925)
* [OCPBUGS-115550](https://issues.redhat.com/browse/OCPBUGS-115550): Allow agent-installer invoker to have a suffix [#10968](https://github.com/openshift/assisted-service/pull/10968)
* [MGMT-25123](https://issues.redhat.com/browse/MGMT-25123): create endpoint for listing OVE images [#10933](https://github.com/openshift/assisted-service/pull/10933)
* [MGMT-25355](https://issues.redhat.com/browse/MGMT-25355): Migrate to harness-agnostic agent configuration layout [#10966](https://github.com/openshift/assisted-service/pull/10966)
* [ACM-38075](https://issues.redhat.com/browse/ACM-38075): Assisted Service Agent controller does not approve day-2 CSRs for worker nodes provisioned with pre-existing BMHs via ClusterInstance scale-out [#10944](https://github.com/openshift/assisted-service/pull/10944)
* NO-ISSUE: [master] Bump OCP versions: 4.21, 5.0, 4.16, 4.14, 4.22, 4.20, 4.19 [#10967](https://github.com/openshift/assisted-service/pull/10967)
* [MGMT-24854](https://issues.redhat.com/browse/MGMT-24854): Cilium CNI is not supported on OCP 4.22 [#10819](https://github.com/openshift/assisted-service/pull/10819)
* [MGMT-25367](https://issues.redhat.com/browse/MGMT-25367): consider imageType when selecting OpenShift version [#10917](https://github.com/openshift/assisted-service/pull/10917)
* [MGMT-25406](https://issues.redhat.com/browse/MGMT-25406): Add OpenShift-compatible CIDR length validation [#10948](https://github.com/openshift/assisted-service/pull/10948)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#10946](https://github.com/openshift/assisted-service/pull/10946)
* NO-ISSUE: [master] Bump OCP versions: 4.21, 4.22, 4.20 [#10942](https://github.com/openshift/assisted-service/pull/10942)
* [ACM-41555](https://issues.redhat.com/browse/ACM-41555): Enable PQC in Dockerfiles [#10901](https://github.com/openshift/assisted-service/pull/10901)
* [MGMT-25131](https://issues.redhat.com/browse/MGMT-25131): When getting the release image for a cluster we should always prioritize cluster.OcpReleaseImage if it's set [#10938](https://github.com/openshift/assisted-service/pull/10938)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#10941](https://github.com/openshift/assisted-service/pull/10941)
* NO-ISSUE: [master] Bump OCP versions: 5.0 [#10937](https://github.com/openshift/assisted-service/pull/10937)
* [APPSRE-14688](https://issues.redhat.com/browse/APPSRE-14688): remove legacy monitoring.coreos.com/v1 ServiceMonitors [#10931](https://github.com/openshift/assisted-service/pull/10931)
* NO-ISSUE: [master] Bump OCP versions: 4.17, 5.0 [#10924](https://github.com/openshift/assisted-service/pull/10924)
* [OCPBUGS-120683](https://issues.redhat.com/browse/OCPBUGS-120683): Fix NUMAResourcesOperator CR name so it can be applied [#10910](https://github.com/openshift/assisted-service/pull/10910)
* NO-ISSUE: Update operator bundle channel to ocm-5.1 [#10867](https://github.com/openshift/assisted-service/pull/10867)
* [OCPBUGS-120675](https://issues.redhat.com/browse/OCPBUGS-120675): added missing subscription name for lvms-operator [#10909](https://github.com/openshift/assisted-service/pull/10909)
* [AGENT-1529](https://issues.redhat.com/browse/AGENT-1529): Add ovnKubernetesConfig to install-config definition [#10430](https://github.com/openshift/assisted-service/pull/10430)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#10912](https://github.com/openshift/assisted-service/pull/10912)
* NO-ISSUE: [master] Bump OCP versions: 4.17, 4.19, 4.20, 4.16, 4.21 [#10907](https://github.com/openshift/assisted-service/pull/10907)
* NO-ISSUE:Bump go.opentelemetry.io/otel to v1.44.0 in master [#10869](https://github.com/openshift/assisted-service/pull/10869)
* [MGMT-25130](https://issues.redhat.com/browse/MGMT-25130): assisted-service and assisted-image-service NetworkPolicy ingress has no source restriction (any pod in any namespace can reach them directly) [#10906](https://github.com/openshift/assisted-service/pull/10906)
* NO-ISSUE: Modify Konflux YAMLs to ocm-5.1 [#10874](https://github.com/openshift/assisted-service/pull/10874)
* [MGMT-25139](https://issues.redhat.com/browse/MGMT-25139): Allow setting os-stream on both clusters and infraenvs [#10742](https://github.com/openshift/assisted-service/pull/10742)
* [MGMT-20398](https://issues.redhat.com/browse/MGMT-20398): Force status on bmh after install [#10606](https://github.com/openshift/assisted-service/pull/10606)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#10884](https://github.com/openshift/assisted-service/pull/10884)
* [MGMT-24877](https://issues.redhat.com/browse/MGMT-24877): Improve sensitive credential redaction [#10857](https://github.com/openshift/assisted-service/pull/10857)
* [OCPBUGS-29975](https://issues.redhat.com/browse/OCPBUGS-29975): Allow multiple machine networks for UMN clusters [#10817](https://github.com/openshift/assisted-service/pull/10817)
* [MGMT-21334](https://issues.redhat.com/browse/MGMT-21334): Don't check ImageSetRef for installed clusters [#10854](https://github.com/openshift/assisted-service/pull/10854)
* NO-ISSUE: Add missing Close() [#10856](https://github.com/openshift/assisted-service/pull/10856)
* [MGMT-24693](https://issues.redhat.com/browse/MGMT-24693): fix e2e-ai-operator-disconnected-capi [#10806](https://github.com/openshift/assisted-service/pull/10806)
* [ACM-42573](https://issues.redhat.com/browse/ACM-42573): Assisted services' networkpolicy doesn't work for external image service and local image registry in disconnected environment [#10850](https://github.com/openshift/assisted-service/pull/10850)
* [MGMT-25066](https://issues.redhat.com/browse/MGMT-25066): Add continuous node label reconciliation in InfraEnv controller [#10813](https://github.com/openshift/assisted-service/pull/10813)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#10829](https://github.com/openshift/assisted-service/pull/10829)
* [MGMT-25065](https://issues.redhat.com/browse/MGMT-25065): Add InfraEnv to Agent node label propagation [#10812](https://github.com/openshift/assisted-service/pull/10812)
* NO-ISSUE: Add same-namespace egress for image-service to assisted-service [#10816](https://github.com/openshift/assisted-service/pull/10816)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/assisted-service/compare/8177722b388c34c334961352e9ab471ed4f8e95c...9307cfae14e639b061127932c2fefedb11c987f0)
### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/eccd9f6920544feb01eb1da43dc81b9b9997dfe0)
* [ACM-44932](https://issues.redhat.com/browse/ACM-44932): CVE-2026-88031 Bump go.mongodb.org/mongo-driver to v1.17.10 through indirect dependency conversion [#2443](https://github.com/openshift/assisted-installer/pull/2443)
* [MGMT-25001](https://issues.redhat.com/browse/MGMT-25001): Bump Go to 1.26.7 for stdlib CVEs [#2432](https://github.com/openshift/assisted-installer/pull/2432)
* NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.14.0 [#2389](https://github.com/openshift/assisted-installer/pull/2389)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#2417](https://github.com/openshift/assisted-installer/pull/2417)
* NO-ISSUE: Refresh RPM lockfiles [#2418](https://github.com/openshift/assisted-installer/pull/2418)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#2330](https://github.com/openshift/assisted-installer/pull/2330)
* NO-ISSUE: migrate Renovate config [#2363](https://github.com/openshift/assisted-installer/pull/2363)
* [MGMT-25156](https://issues.redhat.com/browse/MGMT-25156): Fix CVE-2026-17106 [#2328](https://github.com/openshift/assisted-installer/pull/2328)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#2339](https://github.com/openshift/assisted-installer/pull/2339)
* [OCPBUGS-115550](https://issues.redhat.com/browse/OCPBUGS-115550): Allow agent-installer invoker to have a suffix [#2341](https://github.com/openshift/assisted-installer/pull/2341)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#2326](https://github.com/openshift/assisted-installer/pull/2326)
* [ACM-41555](https://issues.redhat.com/browse/ACM-41555): Enable PQC in Dockerfiles [#2307](https://github.com/openshift/assisted-installer/pull/2307)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#2309](https://github.com/openshift/assisted-installer/pull/2309)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#2304](https://github.com/openshift/assisted-installer/pull/2304)
* [MGMT-24885](https://issues.redhat.com/browse/MGMT-24885): Harden command construction and credential handling [#2275](https://github.com/openshift/assisted-installer/pull/2275)
* NO-ISSUE: Add approver bluesort [#2286](https://github.com/openshift/assisted-installer/pull/2286)
* NO-ISSUE: Modify Konflux YAMLs to ocm-5.1 [#2281](https://github.com/openshift/assisted-installer/pull/2281)
* NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.13.2 [#2285](https://github.com/openshift/assisted-installer/pull/2285)
* NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.13.1 [#2273](https://github.com/openshift/assisted-installer/pull/2273)
* NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.13.0 [#2271](https://github.com/openshift/assisted-installer/pull/2271)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/fa7eb52b083a161b122e1c543d487edb3de0955c...eccd9f6920544feb01eb1da43dc81b9b9997dfe0)
### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/775b77f30ea6a6f2980a5d2e744e22b65d8fb4b4)
* [OCPBUGS-130428](https://issues.redhat.com/browse/OCPBUGS-130428): Bump golang.org/x/crypto to v0.56.0 to fix CVE-2026-56855 [#1718](https://github.com/openshift/assisted-installer-agent/pull/1718)
* [OCPBUGS-130445](https://issues.redhat.com/browse/OCPBUGS-130445): CVE-2026-78662 Bump golang.org/x/crypto to v0.56.0 [#1719](https://github.com/openshift/assisted-installer-agent/pull/1719)
* [ACM-44931](https://issues.redhat.com/browse/ACM-44931): CVE-2026-88031 Bump go.mongodb.org/mongo-driver to v1.17.10 through indirect dependency conversion [#1716](https://github.com/openshift/assisted-installer-agent/pull/1716)
* [MGMT-24979](https://issues.redhat.com/browse/MGMT-24979): Bump Go to 1.26.7 for stdlib CVEs [#1696](https://github.com/openshift/assisted-installer-agent/pull/1696)
* [MGMT-25508](https://issues.redhat.com/browse/MGMT-25508): Exclude ASPEED 1a03:2000 from GPU inventory [#1694](https://github.com/openshift/assisted-installer-agent/pull/1694)
* [MGMT-23804](https://issues.redhat.com/browse/MGMT-23804): GPU inventory incorrectly includes non-GPU PCI devices (DPU/SmartNIC devices) [#1670](https://github.com/openshift/assisted-installer-agent/pull/1670)
* [MGMT-25157](https://issues.redhat.com/browse/MGMT-25157): CVE-2026-17106 Bump github.com/moby/go-archive to v0.3.0 through indirect dependency conversion [#1630](https://github.com/openshift/assisted-installer-agent/pull/1630)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#1676](https://github.com/openshift/assisted-installer-agent/pull/1676)
* NO-ISSUE: Refresh RPM lockfiles [#1684](https://github.com/openshift/assisted-installer-agent/pull/1684)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#1635](https://github.com/openshift/assisted-installer-agent/pull/1635)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#1653](https://github.com/openshift/assisted-installer-agent/pull/1653)
* NO-ISSUE: Refresh RPM lockfiles [#1590](https://github.com/openshift/assisted-installer-agent/pull/1590)
* [OCPBUGS-106189](https://issues.redhat.com/browse/OCPBUGS-106189): Assisted installer fails to disambiguate machines [#1625](https://github.com/openshift/assisted-installer-agent/pull/1625)
* [ACM-41555](https://issues.redhat.com/browse/ACM-41555): Enable PQC in Dockerfiles [#1622](https://github.com/openshift/assisted-installer-agent/pull/1622)
* [MGMT-20398](https://issues.redhat.com/browse/MGMT-20398): Don't start main agent until ironic reports it's ready [#1518](https://github.com/openshift/assisted-installer-agent/pull/1518)
* NO-ISSUE: Modify Konflux YAMLs to ocm-5.1 [#1602](https://github.com/openshift/assisted-installer-agent/pull/1602)
* NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.13.1 [#1600](https://github.com/openshift/assisted-installer-agent/pull/1600)
* NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.13.0 [#1597](https://github.com/openshift/assisted-installer-agent/pull/1597)
* [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/aeec165131a4c528174a58a011d1c3c31cfd7cc1...775b77f30ea6a6f2980a5d2e744e22b65d8fb4b4)
### [agent-installer-ui](https://github.com/openshift-assisted/assisted-installer-ui/tree/046e90e94675f78b98f4dec149d0373b20421604)
* [MGMT-25543](https://issues.redhat.com/browse/MGMT-25543): OVE above-the-sea: remove proxy fields (#4113) [#4113](https://github.com/openshift-assisted/assisted-installer-ui/pull/4113)
* Remove Assisted Chatbot (#4091) [#4091](https://github.com/openshift-assisted/assisted-installer-ui/pull/4091)
* Red Hat Konflux purge assisted-ui-chatbot-saas-main (#4111) [#4111](https://github.com/openshift-assisted/assisted-installer-ui/pull/4111)
* [MGMT-25125](https://issues.redhat.com/browse/MGMT-25125): Implement Offline Openshift Versions Dropdown (#4107) [#4107](https://github.com/openshift-assisted/assisted-installer-ui/pull/4107)
* chore(deps): update dependency ip-address to ^10.7.3 (#4109) [#4109](https://github.com/openshift-assisted/assisted-installer-ui/pull/4109)
* chore(deps): update dependency immutable to ^5.1.9 (#4108) [#4108](https://github.com/openshift-assisted/assisted-installer-ui/pull/4108)
* Bump joi from 17.13.7 to 17.13.8 (#4100) [#4100](https://github.com/openshift-assisted/assisted-installer-ui/pull/4100)
* Upgrade Axios to 1.20.0 (#4105) [#4105](https://github.com/openshift-assisted/assisted-installer-ui/pull/4105)
* Bump compression from 1.8.1 to 1.8.2 (#4104) [#4104](https://github.com/openshift-assisted/assisted-installer-ui/pull/4104)
* Bump postcss-selector-parser from 7.1.5 to 7.1.6 (#4103) [#4103](https://github.com/openshift-assisted/assisted-installer-ui/pull/4103)
* Bump source-map-js from 1.2.1 to 1.2.2 (#4102) [#4102](https://github.com/openshift-assisted/assisted-installer-ui/pull/4102)
* Bump proxy-addr from 2.0.7 to 2.0.8 (#4101) [#4101](https://github.com/openshift-assisted/assisted-installer-ui/pull/4101)
* CVE Upgrade (#4099) [#4099](https://github.com/openshift-assisted/assisted-installer-ui/pull/4099)
* [MGMT-25084](https://issues.redhat.com/browse/MGMT-25084): Upgrade axios to 1.20.0 (#4098) [#4098](https://github.com/openshift-assisted/assisted-installer-ui/pull/4098)
* chore(deps): update dependency dompurify to ^3.4.16 (#4094) [#4094](https://github.com/openshift-assisted/assisted-installer-ui/pull/4094)
* chore(deps): update dependency @types/node to ^24.19.1 (#4093) [#4093](https://github.com/openshift-assisted/assisted-installer-ui/pull/4093)
* Do not show limited support level warning in disconnected flow (#4087) [#4087](https://github.com/openshift-assisted/assisted-installer-ui/pull/4087)
* Update OpenShift version for OVE (#4084) [#4084](https://github.com/openshift-assisted/assisted-installer-ui/pull/4084)
* Bump ip-address from 10.4.0 to 10.5.1 (#4083) [#4083](https://github.com/openshift-assisted/assisted-installer-ui/pull/4083)
* Bump undici from 7.29.0 to 7.30.0 (#4082) [#4082](https://github.com/openshift-assisted/assisted-installer-ui/pull/4082)
* chore(deps): update konflux references (#4072) [#4072](https://github.com/openshift-assisted/assisted-installer-ui/pull/4072)
* remove disconvering word from StaticIP for Disconnected mode (#4079) [#4079](https://github.com/openshift-assisted/assisted-installer-ui/pull/4079)
* chore(deps): update dependency ajv to ^8.20.0 (#4077) [#4077](https://github.com/openshift-assisted/assisted-installer-ui/pull/4077)
* Bump immutable from 3.8.3 to 3.8.4 (#4078) [#4078](https://github.com/openshift-assisted/assisted-installer-ui/pull/4078)
* chore(deps): update dependency @types/node to ^24.13.6 (#4076) [#4076](https://github.com/openshift-assisted/assisted-installer-ui/pull/4076)
* [OCPBUGS-123716](https://issues.redhat.com/browse/OCPBUGS-123716): [Above the sea UI] The rendezvous IP must match one of the defined static IPs (#4071) [#4071](https://github.com/openshift-assisted/assisted-installer-ui/pull/4071)
* Add Proxy and NTP configurations (#4068) [#4068](https://github.com/openshift-assisted/assisted-installer-ui/pull/4068)
* Above the sea - hide pull secret field when it's already been set (#4067) [#4067](https://github.com/openshift-assisted/assisted-installer-ui/pull/4067)
* chore(deps): update dependency brace-expansion to ^5.0.12 (#4063) [#4063](https://github.com/openshift-assisted/assisted-installer-ui/pull/4063)
* chore(deps): update konflux references (#4061) [#4061](https://github.com/openshift-assisted/assisted-installer-ui/pull/4061)
* chore(deps): update dependency @types/node to ^24.13.5 (#4062) [#4062](https://github.com/openshift-assisted/assisted-installer-ui/pull/4062)
* Add Single-Stack, Increase ImageSize Label and show LVMS Label (#4054) [#4054](https://github.com/openshift-assisted/assisted-installer-ui/pull/4054)
* fix(deps): update typescript type definitions (non-major) (#4022) [#4022](https://github.com/openshift-assisted/assisted-installer-ui/pull/4022)
* [OCPBUGS-121378](https://issues.redhat.com/browse/OCPBUGS-121378): Do not show IRI custom manifests in the disconnected UI (#4048) [#4048](https://github.com/openshift-assisted/assisted-installer-ui/pull/4048)
* chore(deps): update dependency axios to ^1.20.0 (#4047) [#4047](https://github.com/openshift-assisted/assisted-installer-ui/pull/4047)
* chore(deps): update dependency dompurify to ^3.4.15 (#4046) [#4046](https://github.com/openshift-assisted/assisted-installer-ui/pull/4046)
* Bump js-yaml from 4.3.1 to 4.3.2 (#4034) [#4034](https://github.com/openshift-assisted/assisted-installer-ui/pull/4034)
* Bump react-router from 7.18.1 to 7.18.2 (#4036) [#4036](https://github.com/openshift-assisted/assisted-installer-ui/pull/4036)
* [OCPBUGS-115122](https://issues.redhat.com/browse/OCPBUGS-115122): Show IPv6 Technology Preview badge in Subnets dropdown for single-cluster only (#4013) [#4013](https://github.com/openshift-assisted/assisted-installer-ui/pull/4013)
* Bump vitest from 3.2.6 to 4.1.11 (#4035) [#4035](https://github.com/openshift-assisted/assisted-installer-ui/pull/4035)
* Bump joi from 17.13.4 to 17.13.7 (#4033) [#4033](https://github.com/openshift-assisted/assisted-installer-ui/pull/4033)
* [OCPBUGS-121366](https://issues.redhat.com/browse/OCPBUGS-121366): Move IPv6 Technology Preview badge out of the header (#4027) [#4027](https://github.com/openshift-assisted/assisted-installer-ui/pull/4027)
* Remove stale OCM_REFRESH_TOKEN code (#4012) [#4012](https://github.com/openshift-assisted/assisted-installer-ui/pull/4012)
* chore(deps): update dependency postcss to ^8.5.28 (#4021) [#4021](https://github.com/openshift-assisted/assisted-installer-ui/pull/4021)
* chore(deps): update konflux references (#4020) [#4020](https://github.com/openshift-assisted/assisted-installer-ui/pull/4020)
* Change reuse SSH key label in OVE (#4018) [#4018](https://github.com/openshift-assisted/assisted-installer-ui/pull/4018)
* Bump qs from 6.15.3 to 6.16.0 (#4011) [#4011](https://github.com/openshift-assisted/assisted-installer-ui/pull/4011)
* Bump fflate from 0.4.8 to 0.4.9 (#4017) [#4017](https://github.com/openshift-assisted/assisted-installer-ui/pull/4017)
* [MGMT-25128](https://issues.redhat.com/browse/MGMT-25128): Assisted Installer UI (above-the-sea) adjustment to 4.22 GA (#3996) [#3996](https://github.com/openshift-assisted/assisted-installer-ui/pull/3996)
* Bump fast-uri from 3.1.5 to 3.1.7 (#4010) [#4010](https://github.com/openshift-assisted/assisted-installer-ui/pull/4010)
* Bump browserslist from 4.28.2 to 4.28.8 (#4007) [#4007](https://github.com/openshift-assisted/assisted-installer-ui/pull/4007)
* Bump postcss-selector-parser from 7.1.1 to 7.1.5 (#4006) [#4006](https://github.com/openshift-assisted/assisted-installer-ui/pull/4006)
* Add LVM as an operator for OVE (#4001) [#4001](https://github.com/openshift-assisted/assisted-installer-ui/pull/4001)
* Allow LSO to be selected as a standalone operator (#4000) [#4000](https://github.com/openshift-assisted/assisted-installer-ui/pull/4000)
* chore(deps): update dependency yup to ^1.7.1 (#3999) [#3999](https://github.com/openshift-assisted/assisted-installer-ui/pull/3999)
* chore(deps): update dependency js-cookie to ^3.0.8 (#3998) [#3998](https://github.com/openshift-assisted/assisted-installer-ui/pull/3998)
* Update OWNERS file (#3989) [#3989](https://github.com/openshift-assisted/assisted-installer-ui/pull/3989)
* NO-ISSUE: Add Yarn resolutions for js-cookie and basic-ftp (#3985) [#3985](https://github.com/openshift-assisted/assisted-installer-ui/pull/3985)
* Tweak boot instructions for disconnected (#3968) [#3968](https://github.com/openshift-assisted/assisted-installer-ui/pull/3968)
* [MGMT-24639](https://issues.redhat.com/browse/MGMT-24639): Choosing 5 masters on hosts page instead of 3 that was configured on cluster details causing the Hosts page stuck with no error/warning (#3942) [#3942](https://github.com/openshift-assisted/assisted-installer-ui/pull/3942)
* Hardcode OVE openshift version from 4.21 to 4.21.27 (#3976) [#3976](https://github.com/openshift-assisted/assisted-installer-ui/pull/3976)
* Resolve console warnings/errors (#3967) [#3967](https://github.com/openshift-assisted/assisted-installer-ui/pull/3967)
* Add rule for creating/editing forms (#3962) [#3962](https://github.com/openshift-assisted/assisted-installer-ui/pull/3962)
* chore(deps): update dependency ws to ^8.21.3 (#3974) [#3974](https://github.com/openshift-assisted/assisted-installer-ui/pull/3974)
* chore(deps): update dependency dompurify to ^3.4.14 (#3973) [#3973](https://github.com/openshift-assisted/assisted-installer-ui/pull/3973)
* Resolve duplicate 'useFeature' issue (#3969) [#3969](https://github.com/openshift-assisted/assisted-installer-ui/pull/3969)
* [MGMT-24493](https://issues.redhat.com/browse/MGMT-24493): Allow HTTPS proxy for Discovery ISO (#3777) [#3777](https://github.com/openshift-assisted/assisted-installer-ui/pull/3777)
* [MGMT-24494](https://issues.redhat.com/browse/MGMT-24494): Add exclusive NTP sources to the Add hosts discovery ISO … (#3934) [#3934](https://github.com/openshift-assisted/assisted-installer-ui/pull/3934)
* MGMT-24202 | [Staging] [UI] - Air-gapped -Technology Preview badge placement is inconsistent (should appear at end of line) (#3965) [#3965](https://github.com/openshift-assisted/assisted-installer-ui/pull/3965)
* Fix BasicStep Form import (#3966) [#3966](https://github.com/openshift-assisted/assisted-installer-ui/pull/3966)
* NO-ISSUE: Improve the /ocm folder structure (#3817) [#3817](https://github.com/openshift-assisted/assisted-installer-ui/pull/3817)
* chore(deps): update dependency postcss to ^8.5.26 (#3963) [#3963](https://github.com/openshift-assisted/assisted-installer-ui/pull/3963)
* chore(deps): update dependency sanitize-html to ^2.17.7 (#3964) [#3964](https://github.com/openshift-assisted/assisted-installer-ui/pull/3964)
* [Full changelog](https://github.com/openshift-assisted/assisted-installer-ui/compare/e46bd4d04173f9ce7c76dc1afe73e8c3ebcb608a...046e90e94675f78b98f4dec149d0373b20421604)
### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/f952dce298d6788f289e3ef95efa89d5ef1c9a3f)
* [AGENT-1565](https://issues.redhat.com/browse/AGENT-1565): Add OVE 4.22 tekton file to agent-installer-utils [#320](https://github.com/openshift/agent-installer-utils/pull/320)
* [AGENT-1629](https://issues.redhat.com/browse/AGENT-1629): Add --fips flag to the OVE ISO builder script [#356](https://github.com/openshift/agent-installer-utils/pull/356)
* [OCPBUGS-111468](https://issues.redhat.com/browse/OCPBUGS-111468): prefix-validate URLs used in commands [#349](https://github.com/openshift/agent-installer-utils/pull/349)
* [OCPBUGS-111479](https://issues.redhat.com/browse/OCPBUGS-111479): Quote variable expansion in `skopeo inspect` invocation [#348](https://github.com/openshift/agent-installer-utils/pull/348)
* [OCPBUGS-63475](https://issues.redhat.com/browse/OCPBUGS-63475): Refresh rendezvous IP selection list [#345](https://github.com/openshift/agent-installer-utils/pull/345)
* [OCPBUGS-123720](https://issues.redhat.com/browse/OCPBUGS-123720): Fix agent TUI timeout [#346](https://github.com/openshift/agent-installer-utils/pull/346)
* [AGENT-1577](https://issues.redhat.com/browse/AGENT-1577): Use master branch of appliance as image builder [#333](https://github.com/openshift/agent-installer-utils/pull/333)
* [OCPBUGS-114020](https://issues.redhat.com/browse/OCPBUGS-114020): Use branch 5.1 for Konflux builds [#344](https://github.com/openshift/agent-installer-utils/pull/344)
* [AGENT-1573](https://issues.redhat.com/browse/AGENT-1573): Add release-5.1 config for ISOBuilder [#327](https://github.com/openshift/agent-installer-utils/pull/327)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/33aa46920190a1c587599dfda77d9c1e3899e255...f952dce298d6788f289e3ef95efa89d5ef1c9a3f)
### [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy/tree/ee1167a208561c55485453d9237036c6ab37cb73)
* [CNTRLPLANE-4019](https://issues.redhat.com/browse/CNTRLPLANE-4019): Merge upstream master (4f8517c1) into main [#116](https://github.com/openshift/apiserver-network-proxy/pull/116)
* [Full changelog](https://github.com/openshift/apiserver-network-proxy/compare/d6ec9243d24050d7d7ad7f939e45f821171f000e...ee1167a208561c55485453d9237036c6ab37cb73)
### [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws/tree/e44d1350940f8fcc82fd60f91c5984d7952a3b08)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes/cloud-provider-aws:master (853eb04) into main [#162](https://github.com/openshift/cloud-provider-aws/pull/162)
* [Full changelog](https://github.com/openshift/cloud-provider-aws/compare/278e8c07a72a50e7d3f28fc743c38c64f008f5aa...e44d1350940f8fcc82fd60f91c5984d7952a3b08)
### [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws/tree/3bf5bb7061c12adfb93f7cb2c9ffe8370b0daa35)
* [OCPBUGS-128249](https://issues.redhat.com/browse/OCPBUGS-128249): UPSTREAM: <carry>: remove redundant GitHub summary verification [#658](https://github.com/openshift/cluster-api-provider-aws/pull/658)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#636](https://github.com/openshift/cluster-api-provider-aws/pull/636)
* NO-JIRA: UPSTREAM: <drop>: update manifests-gen [#657](https://github.com/openshift/cluster-api-provider-aws/pull/657)
* NO-JIRA: fix(make): verify generated summary from pull request revision [#656](https://github.com/openshift/cluster-api-provider-aws/pull/656)
* 🌱 NO-JIRA: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI [#632](https://github.com/openshift/cluster-api-provider-aws/pull/632)
* [Full changelog](https://github.com/openshift/cluster-api-provider-aws/compare/6fe56d037dc82c8babc6d70228dc89d3606385cd...3bf5bb7061c12adfb93f7cb2c9ffe8370b0daa35)
### [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver/tree/f0c5dd9f969c22ef16f279ecc9f42bcbf7bae35f)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#331](https://github.com/openshift/aws-ebs-csi-driver/pull/331)
* [Full changelog](https://github.com/openshift/aws-ebs-csi-driver/compare/8b8c4cef02ec9b670e2709f2aacc0ed72420be90...f0c5dd9f969c22ef16f279ecc9f42bcbf7bae35f)
### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, gcp-pd-csi-driver-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/3f56dc8428620a6c718bc3ab33cd2a6a44278493)
* [STOR-3068](https://issues.redhat.com/browse/STOR-3068): Bump all libraries [#646](https://github.com/openshift/csi-operator/pull/646)
* [OCPBUGS-120762](https://issues.redhat.com/browse/OCPBUGS-120762): restrict azure-file secrets ClusterRole to get and create verbs [#639](https://github.com/openshift/csi-operator/pull/639)
* [STOR-3141](https://issues.redhat.com/browse/STOR-3141), [STOR-3142](https://issues.redhat.com/browse/STOR-3142): EFS, Samba: Ship Network Policies in the operator bundle [#629](https://github.com/openshift/csi-operator/pull/629)
* [OCPBUGS-127462](https://issues.redhat.com/browse/OCPBUGS-127462): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#638](https://github.com/openshift/csi-operator/pull/638)
* [OCPBUGS-88301](https://issues.redhat.com/browse/OCPBUGS-88301): Remove redundant delete role verb [#620](https://github.com/openshift/csi-operator/pull/620)
* [OCPBUGS-113538](https://issues.redhat.com/browse/OCPBUGS-113538): Enable SELinuxMount tests [#605](https://github.com/openshift/csi-operator/pull/605)
* [STOR-3074](https://issues.redhat.com/browse/STOR-3074): Bump OLM metadata to 5.1 [#627](https://github.com/openshift/csi-operator/pull/627)
* [OCPBUGS-112272](https://issues.redhat.com/browse/OCPBUGS-112272): node ServiceMonitor serverName uses guest namespace on HyperShift [#603](https://github.com/openshift/csi-operator/pull/603)
* [OCPBUGS-115269](https://issues.redhat.com/browse/OCPBUGS-115269): openstack-manila: Consume CA cert from CCO secret [#617](https://github.com/openshift/csi-operator/pull/617)
* NO-JIRA: Add reference to cluster-storage-operator in AGENTS.md [#616](https://github.com/openshift/csi-operator/pull/616)
* [STOR-3090](https://issues.redhat.com/browse/STOR-3090): Enable pod-delete-after-umount CSI suite for driver OCP manifests [#596](https://github.com/openshift/csi-operator/pull/596)
* [OCPBUGS-120667](https://issues.redhat.com/browse/OCPBUGS-120667): fix(gcp-pd): don't apply guest-cluster resources against the management cluster on HyperShift [#618](https://github.com/openshift/csi-operator/pull/618)
* [OCPBUGS-105410](https://issues.redhat.com/browse/OCPBUGS-105410): Remove MutableCSINodeAllocatableCount featuregate [#600](https://github.com/openshift/csi-operator/pull/600)
* [GCP-1074](https://issues.redhat.com/browse/GCP-1074): feat(gcp-pd): enable HyperShift support for GCP PD CSI driver operator [#601](https://github.com/openshift/csi-operator/pull/601)
* [OCPBUGS-111088](https://issues.redhat.com/browse/OCPBUGS-111088): Replace deprecated pod.spec.service account [#604](https://github.com/openshift/csi-operator/pull/604)
* [OCPBUGS-105392](https://issues.redhat.com/browse/OCPBUGS-105392): Add proxy hook for HyperShift CSI driver controller deployments [#594](https://github.com/openshift/csi-operator/pull/594)
* [Full changelog](https://github.com/openshift/csi-operator/compare/31b3192f3a5182ee1b523370cdfd94833b75e6d1...3f56dc8428620a6c718bc3ab33cd2a6a44278493)
### [aws-karpenter-provider-aws](https://github.com/openshift/aws-karpenter-provider-aws/tree/aa136f7fdc38fb6d55888a2d623fed08ea73dfb7)
* NO-JIRA: Update Karpenter owner aliases [#50](https://github.com/openshift/aws-karpenter-provider-aws/pull/50)
* [OCPBUGS-85090](https://issues.redhat.com/browse/OCPBUGS-85090): Align simulated with actual allocatable resources [#46](https://github.com/openshift/aws-karpenter-provider-aws/pull/46)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#44](https://github.com/openshift/aws-karpenter-provider-aws/pull/44)
* [AUTOSCALE-904](https://issues.redhat.com/browse/AUTOSCALE-904): Add agentic SDLC artifacts to aws-karpenter-provider-aws [#41](https://github.com/openshift/aws-karpenter-provider-aws/pull/41)
* [OCPBUGS-85085](https://issues.redhat.com/browse/OCPBUGS-85085): default max-pods to 250 for Custom AMI family [#40](https://github.com/openshift/aws-karpenter-provider-aws/pull/40)
* [Full changelog](https://github.com/openshift/aws-karpenter-provider-aws/compare/d04b52621a47868d907e986b37a01fcddeb8a23f...aa136f7fdc38fb6d55888a2d623fed08ea73dfb7)
### [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider/tree/f4d8aaa238a39279f90263de662eca89a52236d6)
* [OCPBUGS-124534](https://issues.redhat.com/browse/OCPBUGS-124534): Bump grpc-go to v1.83.2 [#55](https://github.com/openshift/aws-encryption-provider/pull/55)
* [Full changelog](https://github.com/openshift/aws-encryption-provider/compare/9b18930d2db9521a08faa7165488bdcf6482b9cf...f4d8aaa238a39279f90263de662eca89a52236d6)
### [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws/tree/f8155b0e0363d70d240dec04129cda9490f6ed1b)
* [OCPBUGS-126179](https://issues.redhat.com/browse/OCPBUGS-126179): Fixed dedicated host tests to check for machineset to exist [#217](https://github.com/openshift/machine-api-provider-aws/pull/217)
* [Full changelog](https://github.com/openshift/machine-api-provider-aws/compare/9f2e9b3c46b391c7219257a426ad80ca8a296af0...f8155b0e0363d70d240dec04129cda9490f6ed1b)
### [aws-node-termination-handler](https://github.com/openshift/aws-node-termination-handler/tree/b64c6ab9cec07965ad6688096822cce17338f089)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#15](https://github.com/openshift/aws-node-termination-handler/pull/15)
* [Full changelog](https://github.com/openshift/aws-node-termination-handler/compare/9b33cce5107d71df5c65dbca6c08f1f71d9e6e8a...b64c6ab9cec07965ad6688096822cce17338f089)
### [azure-cloud-controller-manager, azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure/tree/2b2ba3b799d7e126826d63dc153611b97cced61f)
* [OCPBUGS-105320](https://issues.redhat.com/browse/OCPBUGS-105320): skip public ip check for azure stack [#203](https://github.com/openshift/cloud-provider-azure/pull/203)
* [Full changelog](https://github.com/openshift/cloud-provider-azure/compare/b99e4ce4ff5c2665b273384b0673824833c40ce5...2b2ba3b799d7e126826d63dc153611b97cced61f)
### [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure/tree/dc9698901ac66aa4287ec3e2c95a8eb2580fc3a5)
* [OCPCLOUD-3690](https://issues.redhat.com/browse/OCPCLOUD-3690): Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.27.0 (3d9e0c3) into main [#412](https://github.com/openshift/cluster-api-provider-azure/pull/412)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#413](https://github.com/openshift/cluster-api-provider-azure/pull/413)
* [Full changelog](https://github.com/openshift/cluster-api-provider-azure/compare/63731729974bff3be90ae2206c53d760572499d1...dc9698901ac66aa4287ec3e2c95a8eb2580fc3a5)
### [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver/tree/f45ca8b02d65d6c5d57bd551c379fb2f08b1c43a)
* NO-JIRA: Add coderabbit config [#183](https://github.com/openshift/azure-disk-csi-driver/pull/183)
* [OCPBUGS-111076](https://issues.redhat.com/browse/OCPBUGS-111076): UPSTREAM: 3754: chore: upgrade Azure cloud provider lib- [#180](https://github.com/openshift/azure-disk-csi-driver/pull/180)
* [Full changelog](https://github.com/openshift/azure-disk-csi-driver/compare/64091ea10ac93fd62b83c63b4b7379063aca9058...f45ca8b02d65d6c5d57bd551c379fb2f08b1c43a)
### [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver/tree/9dc3d1eb4a5fee41140dd49afd7769e4820bd961)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#167](https://github.com/openshift/azure-file-csi-driver/pull/167)
* [Full changelog](https://github.com/openshift/azure-file-csi-driver/compare/9689f03011ce700b3bffc32791af839e80d0e0ab...9dc3d1eb4a5fee41140dd49afd7769e4820bd961)
### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/4bbe983bea2d88b643fe756b8e013964fa312f0b)
* [OCPBUGS-124531](https://issues.redhat.com/browse/OCPBUGS-124531): Bump grpc-go to v1.83.2 [#65](https://github.com/openshift/azure-kubernetes-kms/pull/65)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#64](https://github.com/openshift/azure-kubernetes-kms/pull/64)
* [OCPSTRAT-3549](https://issues.redhat.com/browse/OCPSTRAT-3549): support sovereign Managed HSM endpoints [#54](https://github.com/openshift/azure-kubernetes-kms/pull/54)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/6409e379fa979104a9515108608c22492bb803a7...4bbe983bea2d88b643fe756b8e013964fa312f0b)
### [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure/tree/4ba9605f3a9af6ddc31afb86a95439454fdd2965)
* [OCPBUGS-105398](https://issues.redhat.com/browse/OCPBUGS-105398): refactor: remove AzureWorkloadIdentity feature gate [#207](https://github.com/openshift/machine-api-provider-azure/pull/207)
* [Full changelog](https://github.com/openshift/machine-api-provider-azure/compare/4ff6c6b8730c1253918f1f5261b9c12cab2e5903...4ba9605f3a9af6ddc31afb86a95439454fdd2965)
### [azure-service-operator](https://github.com/openshift/azure-service-operator/tree/b371cd0419df01d984977779a729a098ed24b24d)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#47](https://github.com/openshift/azure-service-operator/pull/47)
* [Full changelog](https://github.com/openshift/azure-service-operator/compare/0611cd27b9eaa4a1fa8e0ab8ddc85352a61903e0...b371cd0419df01d984977779a729a098ed24b24d)
### [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity/tree/3f118b30e806a344c9fbc08245fea677a9979cad)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#69](https://github.com/openshift/azure-workload-identity/pull/69)
* [OCPBUGS-123198](https://issues.redhat.com/browse/OCPBUGS-123198): Bump golang.org/x/net to v0.53.0 to address CVE-2026-33814 [#70](https://github.com/openshift/azure-workload-identity/pull/70)
* [Full changelog](https://github.com/openshift/azure-workload-identity/compare/2b4705c5d999339ce17d47a9b2a637d238891dae...3f118b30e806a344c9fbc08245fea677a9979cad)
### [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3/tree/077fb85ff07130c5262811512ab343b3294a9d4b)
* [OCPBUGS-128431](https://issues.redhat.com/browse/OCPBUGS-128431): Go HTTP/2: Denial of Service via malformed PRIORITY_UPDATE frame - CVE-2026-33814 [#110](https://github.com/openshift/cluster-api-provider-metal3/pull/110)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#107](https://github.com/openshift/cluster-api-provider-metal3/pull/107)
* [Full changelog](https://github.com/openshift/cluster-api-provider-metal3/compare/ad4f1c2bd7b527437496b71b5b93ee1439243d65...077fb85ff07130c5262811512ab343b3294a9d4b)
### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/4cc123418234529a216eaed8547a878333f814d0)
* [OCPBUGS-131836](https://issues.redhat.com/browse/OCPBUGS-131836): support InfraEnv AdditionalNTPSources in unconfigured-ignition [#10996](https://github.com/openshift/installer/pull/10996)
* no-jira: lint: define constants for aws subnet scope strings [#10984](https://github.com/openshift/installer/pull/10984)
* [SPLAT-2981](https://issues.redhat.com/browse/SPLAT-2981): decouple multidisk gates [#10939](https://github.com/openshift/installer/pull/10939)
* [OCPBUGS-85811](https://issues.redhat.com/browse/OCPBUGS-85811): Add omitzero to the AWS vpc field [#10977](https://github.com/openshift/installer/pull/10977)
* [OCPBUGS-127102](https://issues.redhat.com/browse/OCPBUGS-127102): Add internalJoinSubnet to installConfigOverrides [#10963](https://github.com/openshift/installer/pull/10963)
* [OCPBUGS-127058](https://issues.redhat.com/browse/OCPBUGS-127058): Azure DualStack: Allow IPv6 CIDRs to be provided first [#10954](https://github.com/openshift/installer/pull/10954)
* [OCPBUGS-129534](https://issues.redhat.com/browse/OCPBUGS-129534): golangci: avoid var-naming package-name flake [#10953](https://github.com/openshift/installer/pull/10953)
* [CORS-4689](https://issues.redhat.com/browse/CORS-4689): aws: update CAPA controller to v2.12.1 [#10949](https://github.com/openshift/installer/pull/10949)
* [SPLAT-2976](https://issues.redhat.com/browse/SPLAT-2976): multi-disk close install-config validation gaps [#10934](https://github.com/openshift/installer/pull/10934)
* [TRT-3001](https://issues.redhat.com/browse/TRT-3001): Revert #10152 "OCPBUGS-76925: Update no_proxy list to include AWS DNS resolver for UserProvisionedDNS" [#10951](https://github.com/openshift/installer/pull/10951)
* [OCPBUGS-127394](https://issues.redhat.com/browse/OCPBUGS-127394): Removed PowerVS InstallConfig debug log statement exposing sensitive information [#10898](https://github.com/openshift/installer/pull/10898)
* [OCPBUGS-128718](https://issues.redhat.com/browse/OCPBUGS-128718): validate AssignIpv6AddressOnCreation on BYO subnets for DualStackIPv4Primary [#10933](https://github.com/openshift/installer/pull/10933)
* [OCPBUGS-76925](https://issues.redhat.com/browse/OCPBUGS-76925): Update no_proxy list to include AWS DNS resolver for UserProvisionedDNS [#10152](https://github.com/openshift/installer/pull/10152)
* [OCPBUGS-105321](https://issues.redhat.com/browse/OCPBUGS-105321): pki: switch to ECDSA defaults and thread PKI profile to leaf certs [#10743](https://github.com/openshift/installer/pull/10743)
* [OCPBUGS-127240](https://issues.redhat.com/browse/OCPBUGS-127240): gcp: restrict global KMS location check to defaultMachinePlatform [#10907](https://github.com/openshift/installer/pull/10907)
* [OCPBUGS-115159](https://issues.redhat.com/browse/OCPBUGS-115159): aws: provision dedicated IAM resources for edge compute pool [#10836](https://github.com/openshift/installer/pull/10836)
* [OKD-194](https://issues.redhat.com/browse/OKD-194): Add OKD cincinnati as the default update service for OKD [#10834](https://github.com/openshift/installer/pull/10834)
* [OCPBUGS-126706](https://issues.redhat.com/browse/OCPBUGS-126706): azure: allow isolated Ebdsv5/Ebsv5 VM families [#10888](https://github.com/openshift/installer/pull/10888)
* [OCPBUGS-115550](https://issues.redhat.com/browse/OCPBUGS-115550): use different INSTALL_INVOKER for unconfigured ignition [#10848](https://github.com/openshift/installer/pull/10848)
* [OCPBUGS-99762](https://issues.redhat.com/browse/OCPBUGS-99762): retry Azure bootstrap ignition upload [#10835](https://github.com/openshift/installer/pull/10835)
* [OCPBUGS-90536](https://issues.redhat.com/browse/OCPBUGS-90536): openstack: Guard network resource names on `os_net_id` being defined [#10639](https://github.com/openshift/installer/pull/10639)
* [OCPBUGS-123770](https://issues.redhat.com/browse/OCPBUGS-123770): Inject the pull-secret as podman secret in the agent-installer-ui container [#10882](https://github.com/openshift/installer/pull/10882)
* [OCPBUGS-112483](https://issues.redhat.com/browse/OCPBUGS-112483): use api-int record for ignition host when using externally managed LB and DNS [#10860](https://github.com/openshift/installer/pull/10860)
* no-jira: aws: fetch instance type on demand instead of listing all [#10851](https://github.com/openshift/installer/pull/10851)
* [OCPBUGS-61892](https://issues.redhat.com/browse/OCPBUGS-61892): fix swap disk nil-panic and block swap on control plane [#10859](https://github.com/openshift/installer/pull/10859)
* [OCPBUGS-59743](https://issues.redhat.com/browse/OCPBUGS-59743): azure: reject data disks on Azure Stack Hub [#10823](https://github.com/openshift/installer/pull/10823)
* [OCPBUGS-86133](https://issues.redhat.com/browse/OCPBUGS-86133): dont allow duplicate failure domains and fields [#10741](https://github.com/openshift/installer/pull/10741)
* [OCPBUGS-91640](https://issues.redhat.com/browse/OCPBUGS-91640): Warn about ignored install-config fields in ABI [#10646](https://github.com/openshift/installer/pull/10646)
* [OCPBUGS-114375](https://issues.redhat.com/browse/OCPBUGS-114375): azure: skip AppendVarPartition when DiskSetup provides a user-defined /var mount [#10818](https://github.com/openshift/installer/pull/10818)
* [OCPBUGS-115187](https://issues.redhat.com/browse/OCPBUGS-115187): Gather master only from primary IP on baremetal [#10838](https://github.com/openshift/installer/pull/10838)
* [OCPBUGS-114882](https://issues.redhat.com/browse/OCPBUGS-114882): OCPBUGS-112662: GCD load balancer health-check firewall ranges [#10850](https://github.com/openshift/installer/pull/10850)
* [SPLAT-2923](https://issues.redhat.com/browse/SPLAT-2923): vsphere: retry and throttle vCenter lookups during UPI VM creation [#10847](https://github.com/openshift/installer/pull/10847)
* [OCPBUGS-59521](https://issues.redhat.com/browse/OCPBUGS-59521): azure: fixes when setting DiskEncryptionSet on data disks [#10776](https://github.com/openshift/installer/pull/10776)
* [CORS-4550](https://issues.redhat.com/browse/CORS-4550): bump openshift api for gcd feature gate [#10775](https://github.com/openshift/installer/pull/10775)
* [OCPBUGS-59520](https://issues.redhat.com/browse/OCPBUGS-59520): azure: require storageAccountType when managedDisk is specified [#10805](https://github.com/openshift/installer/pull/10805)
* [AGENT-626](https://issues.redhat.com/browse/AGENT-626): Allow UserManaged LoadBalancer on baremetal/vsphere platforms [#10558](https://github.com/openshift/installer/pull/10558)
* [OCPBUGS-59522](https://issues.redhat.com/browse/OCPBUGS-59522): azure: reject securityEncryptionType on data disks [#10777](https://github.com/openshift/installer/pull/10777)
* [OCPBUGS-45804](https://issues.redhat.com/browse/OCPBUGS-45804): Update timeout in GetMarketplaceImage to 5 minutes [#10767](https://github.com/openshift/installer/pull/10767)
* [CORS-4441](https://issues.redhat.com/browse/CORS-4441): Bump Azure Marketplace Images [#10764](https://github.com/openshift/installer/pull/10764)
* [OCPBUGS-105510](https://issues.redhat.com/browse/OCPBUGS-105510): images: add BUILD_VERSION arg [#10781](https://github.com/openshift/installer/pull/10781)
* [CORS-4308](https://issues.redhat.com/browse/CORS-4308): networking: enforce NetworkObservabilityInstall feature gate [#10774](https://github.com/openshift/installer/pull/10774)
* [MULTIARCH-6274](https://issues.redhat.com/browse/MULTIARCH-6274): agent: Enable platform external s390x [#10588](https://github.com/openshift/installer/pull/10588)
* [OCPBUGS-54305](https://issues.redhat.com/browse/OCPBUGS-54305): Power VS: Get permitted network from user [#9607](https://github.com/openshift/installer/pull/9607)
* [OSASINFRA-4359](https://issues.redhat.com/browse/OSASINFRA-4359): Bump CAPO in openshift/installer [#10726](https://github.com/openshift/installer/pull/10726)
* [OCPBUGS-60993](https://issues.redhat.com/browse/OCPBUGS-60993): Enrich IBI config image proxy NoProxy with cluster networks [#10649](https://github.com/openshift/installer/pull/10649)
* [CORS-4308](https://issues.redhat.com/browse/CORS-4308): Enable Network Observability during installation [#10382](https://github.com/openshift/installer/pull/10382)
* [OPNET-781](https://issues.redhat.com/browse/OPNET-781): Add BGP VIP management support [#10718](https://github.com/openshift/installer/pull/10718)
* [Full changelog](https://github.com/openshift/installer/compare/b6f119779c7ce529a94c7b8956a057343675f212...4cc123418234529a216eaed8547a878333f814d0)
### [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal/tree/26162bf34fac0761c66dc2a6c5cca9407b60b606)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#278](https://github.com/openshift/cluster-api-provider-baremetal/pull/278)
* [OCPBUGS-123730](https://issues.redhat.com/browse/OCPBUGS-123730): Bump golang.org/x/net to v0.58.0 to address CVE-2026-33814 [#279](https://github.com/openshift/cluster-api-provider-baremetal/pull/279)
* [OCPBUGS-112338](https://issues.redhat.com/browse/OCPBUGS-112338): Fix race that can provision multiple hosts [#275](https://github.com/openshift/cluster-api-provider-baremetal/pull/275)
* [Full changelog](https://github.com/openshift/cluster-api-provider-baremetal/compare/f2b0db1919fff1344bc68948894c6775c0bf24a3...26162bf34fac0761c66dc2a6c5cca9407b60b606)
### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/849e5bef16116cb16afbef129c102d0436f4e734)
* [OCPBUGS-120721](https://issues.redhat.com/browse/OCPBUGS-120721): Test int64 BIOS bounds [#528](https://github.com/openshift/baremetal-operator/pull/528)
* [OCPBUGS-120721](https://issues.redhat.com/browse/OCPBUGS-120721): Bump gophercloud to v2.15.0 [#527](https://github.com/openshift/baremetal-operator/pull/527)
* [OCPBUGS-121877](https://issues.redhat.com/browse/OCPBUGS-121877): pull in gophercloud fix for fast inspection [#525](https://github.com/openshift/baremetal-operator/pull/525)
* [OCPBUGS-122043](https://issues.redhat.com/browse/OCPBUGS-122043), [OCPBUGS-91736](https://issues.redhat.com/browse/OCPBUGS-91736): Merge upstream [#524](https://github.com/openshift/baremetal-operator/pull/524)
* NO-ISSUE: Merge upstream 2026-09-03 [#523](https://github.com/openshift/baremetal-operator/pull/523)
* NO-ISSUE: Restore .golangci.yaml downstream [#522](https://github.com/openshift/baremetal-operator/pull/522)
* [Full changelog](https://github.com/openshift/baremetal-operator/compare/34bbeb376836bf01793d4e70d29065d619ebcaa1...849e5bef16116cb16afbef129c102d0436f4e734)
### [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg/tree/a8a259f56c61e086d96fab128f2b30738a36fa8b)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#415](https://github.com/openshift/baremetal-runtimecfg/pull/415)
* [OCPBUGS-98258](https://issues.redhat.com/browse/OCPBUGS-98258): Cloud Platforms: Filter out node's own IP from Upstreams [#399](https://github.com/openshift/baremetal-runtimecfg/pull/399)
* [OCPBUGS-86571](https://issues.redhat.com/browse/OCPBUGS-86571): node-ip: wait for both address families on dual-stack clusters [#391](https://github.com/openshift/baremetal-runtimecfg/pull/391)
* [Full changelog](https://github.com/openshift/baremetal-runtimecfg/compare/3a261a6f4a6211e8f4031611104ced4def436dde...a8a259f56c61e086d96fab128f2b30738a36fa8b)
### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/758dbfa96d00a3e7a1baef5d05f01a1ef620f661)
* : NO-JIRA: fix(set volumes): mention configmap in invalid volume type error [#2437](https://github.com/openshift/oc/pull/2437)
* [OCPBUGS-120725](https://issues.redhat.com/browse/OCPBUGS-120725): Return error when markers are not all replaced [#2429](https://github.com/openshift/oc/pull/2429)
* [OCPBUGS-60768](https://issues.redhat.com/browse/OCPBUGS-60768): properly indent multiline node messages in upgrade status output [#2341](https://github.com/openshift/oc/pull/2341)
* [OCPEDGE-2416](https://issues.redhat.com/browse/OCPEDGE-2416): Add oc adm transition topology command for SNO to HA transitions [#2295](https://github.com/openshift/oc/pull/2295)
* [OCPBUGS-126457](https://issues.redhat.com/browse/OCPBUGS-126457): [oc create route edge --help] Typo in WildcardPolicy option description [#2409](https://github.com/openshift/oc/pull/2409)
* [OCPBUGS-122354](https://issues.redhat.com/browse/OCPBUGS-122354): Fix inconsistent terminology in oc set probe help example [#2404](https://github.com/openshift/oc/pull/2404)
* [OCPBUGS-122036](https://issues.redhat.com/browse/OCPBUGS-122036): docs(env): add deployment example for configmap import in oc set env help [#2401](https://github.com/openshift/oc/pull/2401)
* NO-JIRA: README: Mention gcc as an oc dependency [#2402](https://github.com/openshift/oc/pull/2402)
* [OCPBUGS-122005](https://issues.redhat.com/browse/OCPBUGS-122005): Add IDMS support to `oc image info` [#2397](https://github.com/openshift/oc/pull/2397)
* [OCPBUGS-114015](https://issues.redhat.com/browse/OCPBUGS-114015): Added deployment example to oc set env help command [#2389](https://github.com/openshift/oc/pull/2389)
* NO-JIRA: Move to openshift/osincli [#2386](https://github.com/openshift/oc/pull/2386)
* NO-JIRA: Fix `oc` builds on Mac OS X Apple Silicon machines [#2246](https://github.com/openshift/oc/pull/2246)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/oc/compare/4b0a124d300cef187037bda6f1b04caa69ab8b62...758dbfa96d00a3e7a1baef5d05f01a1ef620f661)
### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/82a5b4459331bc8218bdf49cb83a8eaf92ba4b05)
* [CCO-772](https://issues.redhat.com/browse/CCO-772): ccoctl - Add set-upgradeable-to command [#1105](https://github.com/openshift/cloud-credential-operator/pull/1105)
* [CCO-775](https://issues.redhat.com/browse/CCO-775): ccoctl Create custom roles before identity bindings [#1104](https://github.com/openshift/cloud-credential-operator/pull/1104)
* [CCO-771](https://issues.redhat.com/browse/CCO-771): Add ccoctl apply secrets command for AWS, Azure and GCP [#1095](https://github.com/openshift/cloud-credential-operator/pull/1095)
* [OCPBUGS-17664](https://issues.redhat.com/browse/OCPBUGS-17664): Improve error messages for SCP-denied IAM operations [#1084](https://github.com/openshift/cloud-credential-operator/pull/1084)
* [CCO-849](https://issues.redhat.com/browse/CCO-849): bump go toolchain to 1.26.5 to resolve snyk complaints [#1065](https://github.com/openshift/cloud-credential-operator/pull/1065)
* [OCPBUGS-112282](https://issues.redhat.com/browse/OCPBUGS-112282): In testing skip pod-identity-webhook checks on external platform [#1085](https://github.com/openshift/cloud-credential-operator/pull/1085)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/b187feee66f4ce0f992059b21a97a2ae88e4cdd9...82a5b4459331bc8218bdf49cb83a8eaf92ba4b05)
### [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller/tree/3702e0a65c357082155ec3fb57fdc651ac33c4a0)
* [OCPBUGS-124549](https://issues.redhat.com/browse/OCPBUGS-124549): deps: bump google.golang.org/api and google.golang.org/grpc to v1.84.0 [#275](https://github.com/openshift/cloud-network-config-controller/pull/275)
* [OSASINFRA-4400](https://issues.redhat.com/browse/OSASINFRA-4400): make openstack allowed address pairs configurable [#230](https://github.com/openshift/cloud-network-config-controller/pull/230)
* [OCPBUGS-105398](https://issues.redhat.com/browse/OCPBUGS-105398): refactor: remove Azure workload identity feature gate [#266](https://github.com/openshift/cloud-network-config-controller/pull/266)
* [OCPBUGS-112564](https://issues.redhat.com/browse/OCPBUGS-112564): Fix CVE-2026-41178 - bump go.opentelemetry.io/otel to v1.44.0 [#262](https://github.com/openshift/cloud-network-config-controller/pull/262)
* [Full changelog](https://github.com/openshift/cloud-network-config-controller/compare/7afccf2d78f6cb5dd3181de1588c5063bd995d7d...3702e0a65c357082155ec3fb57fdc651ac33c4a0)
### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/d20beabe1dc06d236606e9aa63e492d5d7db2a18)
* [CNTRLPLANE-4731](https://issues.redhat.com/browse/CNTRLPLANE-4731): Add KMSPreflightCycle e2e [#1031](https://github.com/openshift/cluster-authentication-operator/pull/1031)
* NO-JIRA: Update library-go [#1028](https://github.com/openshift/cluster-authentication-operator/pull/1028)
* NO-JIRA: bugfix: external-oidc: omit client-credential TLS generated config when empty [#971](https://github.com/openshift/cluster-authentication-operator/pull/971)
* NO-JIRA: Update library-go [#1027](https://github.com/openshift/cluster-authentication-operator/pull/1027)
* [CNTRLPLANE-4719](https://issues.redhat.com/browse/CNTRLPLANE-4719): deps: Rebase to 1.37 and update other deps [#1024](https://github.com/openshift/cluster-authentication-operator/pull/1024)
* NO-JIRA: bump openshift/api https://github.com/openshift/api/pull/3083 [#1022](https://github.com/openshift/cluster-authentication-operator/pull/1022)
* NO-JIRA: bump library-go https://github.com/openshift/library-go/pull/2518 [#1020](https://github.com/openshift/cluster-authentication-operator/pull/1020)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2512 [#1016](https://github.com/openshift/cluster-authentication-operator/pull/1016)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2474 [#1014](https://github.com/openshift/cluster-authentication-operator/pull/1014)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): encryption/assertion: bring back the preflight assertion for CAO and OAS-O [#1011](https://github.com/openshift/cluster-authentication-operator/pull/1011)
* [CNTRLPLANE-4402](https://issues.redhat.com/browse/CNTRLPLANE-4402): implement new External OIDC architecture under ExternalOIDCAsWebhook feature gate [#1002](https://github.com/openshift/cluster-authentication-operator/pull/1002)
* [OCPBUGS-122888](https://issues.redhat.com/browse/OCPBUGS-122888): Add high contrast support to oauth templates [#999](https://github.com/openshift/cluster-authentication-operator/pull/999)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): bump library-go to get the new KMS plugin deployment strategy [#1004](https://github.com/openshift/cluster-authentication-operator/pull/1004)
* [OCPBUGS-107949](https://issues.redhat.com/browse/OCPBUGS-107949): fix CVE-2026-41178 by updating otel to v1.44.0 [#978](https://github.com/openshift/cluster-authentication-operator/pull/978)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2478 [#1006](https://github.com/openshift/cluster-authentication-operator/pull/1006)
* [OPRUN-4768](https://issues.redhat.com/browse/OPRUN-4768): bump openshift/api [#1005](https://github.com/openshift/cluster-authentication-operator/pull/1005)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2463 [#997](https://github.com/openshift/cluster-authentication-operator/pull/997)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#991](https://github.com/openshift/cluster-authentication-operator/pull/991)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2439 [#987](https://github.com/openshift/cluster-authentication-operator/pull/987)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pick https://github.com/openshift/library-go/pull/2449- #2287 [#985](https://github.com/openshift/cluster-authentication-operator/pull/985)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2451 [#984](https://github.com/openshift/cluster-authentication-operator/pull/984)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): kms: wire EncryptionConfigurationComputer into encryption controllers [#983](https://github.com/openshift/cluster-authentication-operator/pull/983)
* NO-JIRA: Bump library-go [#977](https://github.com/openshift/cluster-authentication-operator/pull/977)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): kms: wire preflight deployer [#975](https://github.com/openshift/cluster-authentication-operator/pull/975)
* NO-JIRA: Update library-go to get latest changes [#976](https://github.com/openshift/cluster-authentication-operator/pull/976)
* NO-JIRA: bump library-go changes [#974](https://github.com/openshift/cluster-authentication-operator/pull/974)
* NO-JIRA: update KMS tests with bump library-go changes [#969](https://github.com/openshift/cluster-authentication-operator/pull/969)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/954abf76eb0000ff218257489783c8e61dc115b8...d20beabe1dc06d236606e9aa63e492d5d7db2a18)
### [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler/tree/a819db459f3e0a88becba4c58bf053c6dbda28f2)
* [AUTOSCALE-898](https://issues.redhat.com/browse/AUTOSCALE-898): Add agentic SDLC files [#437](https://github.com/openshift/kubernetes-autoscaler/pull/437)
* [Full changelog](https://github.com/openshift/kubernetes-autoscaler/compare/f393f54229e6c3ae74c35ae72012af92d31c03d3...a819db459f3e0a88becba4c58bf053c6dbda28f2)
### [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator/tree/49d03c60e05e8856dde5a416e01c8512cc824a59)
* [OCPBUGS-130317](https://issues.redhat.com/browse/OCPBUGS-130317): add machinepools to CAPI ClusterRole for autoscaler [#406](https://github.com/openshift/cluster-autoscaler-operator/pull/406)
* [AUTOSCALE-949](https://issues.redhat.com/browse/AUTOSCALE-949): Release chore CAO bump to k8s 1.37 and OCP 5.1 [#404](https://github.com/openshift/cluster-autoscaler-operator/pull/404)
* [AUTOSCALE-709](https://issues.redhat.com/browse/AUTOSCALE-709): implement conditions and authoritative API [#402](https://github.com/openshift/cluster-autoscaler-operator/pull/402)
* [AUTOSCALE-899](https://issues.redhat.com/browse/AUTOSCALE-899): add claude and contributing files [#399](https://github.com/openshift/cluster-autoscaler-operator/pull/399)
* [OCPBUGS-111092](https://issues.redhat.com/browse/OCPBUGS-111092): update version to properly detect errors [#395](https://github.com/openshift/cluster-autoscaler-operator/pull/395)
* [OCPBUGS-105277](https://issues.redhat.com/browse/OCPBUGS-105277): implement startupTaints [#383](https://github.com/openshift/cluster-autoscaler-operator/pull/383)
* [Full changelog](https://github.com/openshift/cluster-autoscaler-operator/compare/e48fe1179ad671757b5a40688e2d125c1f326e8b...49d03c60e05e8856dde5a416e01c8512cc824a59)
### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/2eb059a60ad7f4e332bd1208813f904ab51f2ddb)
* NO-ISSUE: Add deployment diagrams to README [#680](https://github.com/openshift/cluster-baremetal-operator/pull/680)
* [OCPBUGS-127132](https://issues.redhat.com/browse/OCPBUGS-127132): Pass WATCH_NAMESPACE to image-customization [#666](https://github.com/openshift/cluster-baremetal-operator/pull/666)
* [OCPBUGS-54957](https://issues.redhat.com/browse/OCPBUGS-54957): Remove recreate strategy from BMO deployment [#640](https://github.com/openshift/cluster-baremetal-operator/pull/640)
* Metal-1833: Add attach_non_bootable_iso OTE test [#617](https://github.com/openshift/cluster-baremetal-operator/pull/617)
* [OCPBUGS-115207](https://issues.redhat.com/browse/OCPBUGS-115207): Make HostPath VolumeMounts ReadOnly for image customization container [#658](https://github.com/openshift/cluster-baremetal-operator/pull/658)
* [OCPBUGS-86888](https://issues.redhat.com/browse/OCPBUGS-86888): Fix IDMS YAML serialization for oc image extract [#645](https://github.com/openshift/cluster-baremetal-operator/pull/645)
* [METAL-1833](https://issues.redhat.com/browse/METAL-1833): Add bmo_validations and ncsi_reject_poweroff OTE test [#618](https://github.com/openshift/cluster-baremetal-operator/pull/618)
* [OCPBUGS-115067](https://issues.redhat.com/browse/OCPBUGS-115067): Use bcrypt DefaultCost for Ironic passwords [#650](https://github.com/openshift/cluster-baremetal-operator/pull/650)
* [OCPBUGS-114433](https://issues.redhat.com/browse/OCPBUGS-114433): Increase firmware e2e timeouts and add HPE Mellanox NIC bastion mapping [#649](https://github.com/openshift/cluster-baremetal-operator/pull/649)
* [OCPQE-32100](https://issues.redhat.com/browse/OCPQE-32100): Add batched firmware update tests (bmc+bios+nic) [#643](https://github.com/openshift/cluster-baremetal-operator/pull/643)
* [OCPBUGS-105610](https://issues.redhat.com/browse/OCPBUGS-105610): drop IRONIC_INSECURE from BMO [#642](https://github.com/openshift/cluster-baremetal-operator/pull/642)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/402bb6ef1e5cc450cd72282ed891102510b5388c...2eb059a60ad7f4e332bd1208813f904ab51f2ddb)
### [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap/tree/641ed6cfb98189f02fe2eb515491ee9de0831136)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#149](https://github.com/openshift/cluster-bootstrap/pull/149)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#146](https://github.com/openshift/cluster-bootstrap/pull/146)
* [CNTRLPLANE-3717](https://issues.redhat.com/browse/CNTRLPLANE-3717): Add Agentic SDLC context files [#133](https://github.com/openshift/cluster-bootstrap/pull/133)
* [CNF-23048](https://issues.redhat.com/browse/CNF-23048): Migrate away from deprecated ioutil [#123](https://github.com/openshift/cluster-bootstrap/pull/123)
* [Full changelog](https://github.com/openshift/cluster-bootstrap/compare/451fff460e643abd2e6e9dfd88e29b27d3b1fedb...641ed6cfb98189f02fe2eb515491ee9de0831136)
### [cluster-capi-controllers](https://github.com/openshift/cluster-api/tree/0916086435f2570dcf91a198e420a14331a73546)
* [OCPCLOUD-3686](https://issues.redhat.com/browse/OCPCLOUD-3686): Rebase OpenShift Cluster API onto upstream v1.14.3 [#308](https://github.com/openshift/cluster-api/pull/308)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#309](https://github.com/openshift/cluster-api/pull/309)
* NO-JIRA: UPSTREAM: <carry>: remove redundant GitHub summary verification [#313](https://github.com/openshift/cluster-api/pull/313)
* NO-JIRA: UPSTREAM: <drop>: update manifests-gen [#312](https://github.com/openshift/cluster-api/pull/312)
* [OCPCLOUD-1501](https://issues.redhat.com/browse/OCPCLOUD-1501): allow CAPI manager to patch Nodes [#311](https://github.com/openshift/cluster-api/pull/311)
* [OCPCLOUD-1501](https://issues.redhat.com/browse/OCPCLOUD-1501): add OpenShift CAPI manager local cluster RBAC [#310](https://github.com/openshift/cluster-api/pull/310)
* [Full changelog](https://github.com/openshift/cluster-api/compare/303d9786a5017d299b6e7fc702bb92f5cb4550cf...0916086435f2570dcf91a198e420a14331a73546)
### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/330eb41ef26ade36bfd230044a09e27894d371f2)
* [OCPCLOUD-3541](https://issues.redhat.com/browse/OCPCLOUD-3541): Use feature gates consistently [#603](https://github.com/openshift/cluster-capi-operator/pull/603)
* [OCPBUGS-127650](https://issues.redhat.com/browse/OCPBUGS-127650): openstack: allow to specify UserManaged load balancer [#678](https://github.com/openshift/cluster-capi-operator/pull/678)
* [OCPBUGS-128384](https://issues.redhat.com/browse/OCPBUGS-128384): Extend InfraTemplate reconciliation wait [#681](https://github.com/openshift/cluster-capi-operator/pull/681)
* [OCPBUGS-123094](https://issues.redhat.com/browse/OCPBUGS-123094): Update MongoDB Go driver to v1.17.10 [#676](https://github.com/openshift/cluster-capi-operator/pull/676)
* [OCPBUGS-128576](https://issues.redhat.com/browse/OCPBUGS-128576): add ec2:ModifyInstanceMetadataOptions to AWS CredentialsRequest [#682](https://github.com/openshift/cluster-capi-operator/pull/682)
* NO-JIRA: Update actuator testutils builder paths [#683](https://github.com/openshift/cluster-capi-operator/pull/683)
* [OCPBUGS-128356](https://issues.redhat.com/browse/OCPBUGS-128356): Remove unnecessary ClusterOperator test status update [#680](https://github.com/openshift/cluster-capi-operator/pull/680)
* [OCPBUGS-127467](https://issues.redhat.com/browse/OCPBUGS-127467): Pass original TLSProfileSpec to security profile watcher [#677](https://github.com/openshift/cluster-capi-operator/pull/677)
* NO-JIRA: use capi 1.13/capv 1.16 imports [#675](https://github.com/openshift/cluster-capi-operator/pull/675)
* NO-JIRA: Bump linter to v2.13.2 [#674](https://github.com/openshift/cluster-capi-operator/pull/674)
* [OCPCLOUD-1501](https://issues.redhat.com/browse/OCPCLOUD-1501): use projected tokens for management kubeconfig [#669](https://github.com/openshift/cluster-capi-operator/pull/669)
* [OCPBUGS-100155](https://issues.redhat.com/browse/OCPBUGS-100155): fix flaky MachineSet sync test by atomically verifying InfraTemplate [#647](https://github.com/openshift/cluster-capi-operator/pull/647)
* [OCPBUGS-114670](https://issues.redhat.com/browse/OCPBUGS-114670): fix(capi2mapi): normalize empty SSHKeyName to nil for MAPI AWS conversion [#659](https://github.com/openshift/cluster-capi-operator/pull/659)
* [OCPBUGS-115197](https://issues.redhat.com/browse/OCPBUGS-115197): machinesync: preserve Synchronized condition lastTransitionTime in CAPI-to-MAPI sync [#656](https://github.com/openshift/cluster-capi-operator/pull/656)
* NO-JIRA: Skip CAPI IPAM test on MicroShift [#661](https://github.com/openshift/cluster-capi-operator/pull/661)
* [OCPCLOUD-3557](https://issues.redhat.com/browse/OCPCLOUD-3557): split capi-controllers and machine-api-migration [#622](https://github.com/openshift/cluster-capi-operator/pull/622)
* NO-JIRA: port OTP CAPI tests to OTE framework [#627](https://github.com/openshift/cluster-capi-operator/pull/627)
* [OCPBUGS-105850](https://issues.redhat.com/browse/OCPBUGS-105850): skip Cluster API Machine Management tests on External topology [#646](https://github.com/openshift/cluster-capi-operator/pull/646)
* NO-JIRA: embed transformer YAML so go mod vendor copies it [#657](https://github.com/openshift/cluster-capi-operator/pull/657)
* [OCPCLOUD-3442](https://issues.redhat.com/browse/OCPCLOUD-3442): Migrate four controllers to per-controller condition reporting [#577](https://github.com/openshift/cluster-capi-operator/pull/577)
* NO-JIRA: Fix flaky CI unit tests: reduce parallelism [#645](https://github.com/openshift/cluster-capi-operator/pull/645)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/5afa8634c5bd26c8ed12dbecb0c31e79ed2fb39c...330eb41ef26ade36bfd230044a09e27894d371f2)
### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/9ca11878cc35862f4af4c194985b4f3ae3a835fa)
* [OCPBUGS-111416](https://issues.redhat.com/browse/OCPBUGS-111416): Moved node sync job creation from manifest to operator controller [#504](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/504)
* [OCPBUGS-105385](https://issues.redhat.com/browse/OCPBUGS-105385): Bump cloud-provider-aws to fix NLB e2e occasional timeout failures [#503](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/503)
* [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/0da197f80d941f537331f173bc7613d6729a2767...9ca11878cc35862f4af4c194985b4f3ae3a835fa)
### [cluster-config-api](https://github.com/openshift/api/tree/e07c1fd9d99c88fda2804b1a14bff2d14bede331)
* [OCPBUGS-130730](https://issues.redhat.com/browse/OCPBUGS-130730): Remove topology transition immutability validation [#3096](https://github.com/openshift/api/pull/3096)
* [NE-2912](https://issues.redhat.com/browse/NE-2912): Add HAProxy 3.4 as a selectable non-default version [#3067](https://github.com/openshift/api/pull/3067)
* [OPNET-809](https://issues.redhat.com/browse/OPNET-809): machineconfiguration/v1alpha1: add BGPVIPConfig CRD [#2972](https://github.com/openshift/api/pull/2972)
* [OCPNODE-4730](https://issues.redhat.com/browse/OCPNODE-4730): Add workload scheduling feature gates [#3092](https://github.com/openshift/api/pull/3092)
* [NE-2922](https://issues.redhat.com/browse/NE-2922): Promote Ingress operator API to v1 [#3079](https://github.com/openshift/api/pull/3079)
* [OCPBUGS-123649](https://issues.redhat.com/browse/OCPBUGS-123649): enable DRADeviceTaintRules feature gate in TPNU [#3072](https://github.com/openshift/api/pull/3072)
* [OCPEDGE-3075](https://issues.redhat.com/browse/OCPEDGE-3075): feat: add spec.infrastructureTopology to Infrastructure API [#3056](https://github.com/openshift/api/pull/3056)
* Fix CustomNoUpgrade rendering with omitted overrides [#3080](https://github.com/openshift/api/pull/3080)
* NO-JIRA: change KMS preflight result validation [#3083](https://github.com/openshift/api/pull/3083)
* [OCPBUGS-129172](https://issues.redhat.com/browse/OCPBUGS-129172): Loosen CAPI skew validations [#3077](https://github.com/openshift/api/pull/3077)
* Support Quay CI payloads and add Kubernetes v1.37.1 envtest tools [#3082](https://github.com/openshift/api/pull/3082)
* [CNTRLPLANE-4604](https://issues.redhat.com/browse/CNTRLPLANE-4604): promoting AuthenticationComponentProxy feature gate to Default feature set [#3075](https://github.com/openshift/api/pull/3075)
* [STOR-2859](https://issues.redhat.com/browse/STOR-2859): Add APIs for disabling force detach in KCM operator [#2668](https://github.com/openshift/api/pull/2668)
* Rename Console ingress helper type to ConsoleIngress [#3070](https://github.com/openshift/api/pull/3070)
* [CORENET-7617](https://issues.redhat.com/browse/CORENET-7617): features: Add ovn-kuberntes MACSecurity feature gate [#3062](https://github.com/openshift/api/pull/3062)
* [CNTRLPLANE-4518](https://issues.redhat.com/browse/CNTRLPLANE-4518): authentication: add v1alpha1 external OIDC configuration API [#3061](https://github.com/openshift/api/pull/3061)
* [MCO-2535](https://issues.redhat.com/browse/MCO-2535): add skew enforcement validations for CAPI MachineManagers [#3058](https://github.com/openshift/api/pull/3058)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Rebase 1.37 [#2945](https://github.com/openshift/api/pull/2945)
* [OCPBUGS-126808](https://issues.redhat.com/browse/OCPBUGS-126808): Enable OLMLifecycleAndCompatibility by default in version 5+ [#3045](https://github.com/openshift/api/pull/3045)
* [NE-2913](https://issues.redhat.com/browse/NE-2913): Remove HAProxy 2.8 [#3048](https://github.com/openshift/api/pull/3048)
* [CNTRLPLANE-4402](https://issues.redhat.com/browse/CNTRLPLANE-4402): add ExternalOIDCAsWebhook feature gate [#3043](https://github.com/openshift/api/pull/3043)
* [OCPEDGE-3079](https://issues.redhat.com/browse/OCPEDGE-3079): UnifiedClusterManagedDNSAndLB FeatureGate [#3054](https://github.com/openshift/api/pull/3054)
* [OCPBUGS-115007](https://issues.redhat.com/browse/OCPBUGS-115007): Remove BootImageSkewEnforcement feature gate from Default API [#3031](https://github.com/openshift/api/pull/3031)
* [OCPBUGS-120757](https://issues.redhat.com/browse/OCPBUGS-120757): Fix misleading certificate chain docs in TLSConfig [#3047](https://github.com/openshift/api/pull/3047)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): replace KMS config with pluginConfig reference [#3028](https://github.com/openshift/api/pull/3028)
* [HPCASE-362](https://issues.redhat.com/browse/HPCASE-362): Promote TLSAdherence feature gate to GA [#2883](https://github.com/openshift/api/pull/2883)
* NO-JIRA: Fix codegen diagnostic formatting [#3049](https://github.com/openshift/api/pull/3049)
* operator: Add an option to configure OVN-Kubernetes GatewayConfig without an uplink specified. [#3009](https://github.com/openshift/api/pull/3009)
* [OCPBUGS-105398](https://issues.redhat.com/browse/OCPBUGS-105398): chore: remove AzureWorkloadIdentity feature gate [#3018](https://github.com/openshift/api/pull/3018)
* [OPRUN-4768](https://issues.redhat.com/browse/OPRUN-4768): Add serving TLS curve preferences [#3044](https://github.com/openshift/api/pull/3044)
* Remove feature gate VolumeGroupSnapshot [#3027](https://github.com/openshift/api/pull/3027)
* [STOR-3089](https://issues.redhat.com/browse/STOR-3089): Graduate SELinuxMount to GA [#3023](https://github.com/openshift/api/pull/3023)
* [OCPBUGS-112638](https://issues.redhat.com/browse/OCPBUGS-112638): register DRADeviceTaintRules in TPNU [#3004](https://github.com/openshift/api/pull/3004)
* Fix validation pattern for machine/vsphereprovider [#3033](https://github.com/openshift/api/pull/3033)
* features: enable TLSAdherence feature gate for OKD featureset [#3021](https://github.com/openshift/api/pull/3021)
* [CORENET-7538](https://issues.redhat.com/browse/CORENET-7538): Add EgressIPNodeSelector feature gate [#3032](https://github.com/openshift/api/pull/3032)
* [SPLAT-2890](https://issues.redhat.com/browse/SPLAT-2890): Add VSphereScopedCredentials feature gate [#2988](https://github.com/openshift/api/pull/2988)
* [MCO-2332](https://issues.redhat.com/browse/MCO-2332): MCO-2333: Introduce CAPI resource types to boot image update API [#2990](https://github.com/openshift/api/pull/2990)
* [OCPBUGS-99266](https://issues.redhat.com/browse/OCPBUGS-99266): move empty CRIOCredentialProviderConfig CR to run-level 0000_10 [#3011](https://github.com/openshift/api/pull/3011)
* [OCPBUGS-105399](https://issues.redhat.com/browse/OCPBUGS-105399), [OCPBUGS-105400](https://issues.redhat.com/browse/OCPBUGS-105400): Remove SigstoreImageVerification and SigstoreImageVerificationPKI feature gates [#3000](https://github.com/openshift/api/pull/3000)
* [OCPBUGS-112330](https://issues.redhat.com/browse/OCPBUGS-112330): Fix 'supercede' typos in machineconfiguration types [#2996](https://github.com/openshift/api/pull/2996)
* [SPLAT-2864](https://issues.redhat.com/browse/SPLAT-2864): Promote VSphereMultiVCenterDay2 to GA [#2968](https://github.com/openshift/api/pull/2968)
* [CORS-4550](https://issues.redhat.com/browse/CORS-4550): Promote GCD to Default [#2991](https://github.com/openshift/api/pull/2991)
* [OCPBUGS-105407](https://issues.redhat.com/browse/OCPBUGS-105407): Remove VSphereMultiNetworks feature gate [#2975](https://github.com/openshift/api/pull/2975)
* config/v1: add IBMCloudServiceTransitGateway and IBMCloudServicePowerVS to IBMCloudServiceName [#2959](https://github.com/openshift/api/pull/2959)
* [OCPNODE-4526](https://issues.redhat.com/browse/OCPNODE-4526): Block '..' traversal in StorePath [#2999](https://github.com/openshift/api/pull/2999)
* [OCPBUGS-74510](https://issues.redhat.com/browse/OCPBUGS-74510): Remove VSphereMultiDisk feature gate [#2973](https://github.com/openshift/api/pull/2973)
* Add printer columns to PodNetworkConnectivityCheck CRD [#2977](https://github.com/openshift/api/pull/2977)
* [NE-2387](https://issues.redhat.com/browse/NE-2387): IngressController AWS NLB Security Group Selection [#2914](https://github.com/openshift/api/pull/2914)
* [OCPBUGS-112479](https://issues.redhat.com/browse/OCPBUGS-112479): Handle Sippy date-only format in featuregate-test-analyzer [#2998](https://github.com/openshift/api/pull/2998)
* [CNTRLPLANE-3871](https://issues.redhat.com/browse/CNTRLPLANE-3871): promote OSStreams feature gate to Default for Hypershift [#2993](https://github.com/openshift/api/pull/2993)
* [TRT-2908](https://issues.redhat.com/browse/TRT-2908): Revert "CNTRLPLANE-3871: promote OSStreams feature gate to Default for Hypershift" [#2989](https://github.com/openshift/api/pull/2989)
* [OCPBUGS-105409](https://issues.redhat.com/browse/OCPBUGS-105409): chore: remove AWSServiceLBNetworkSecurityGroup feature gate [#2974](https://github.com/openshift/api/pull/2974)
* [CORS-4529](https://issues.redhat.com/browse/CORS-4529): Azure IL6 Secret Cloud support [#2919](https://github.com/openshift/api/pull/2919)
* [CNTRLPLANE-3609](https://issues.redhat.com/browse/CNTRLPLANE-3609): graduate etcdBackendQuota to GA [#2946](https://github.com/openshift/api/pull/2946)
* [CNTRLPLANE-3871](https://issues.redhat.com/browse/CNTRLPLANE-3871): promote OSStreams feature gate to Default for Hypershift [#2950](https://github.com/openshift/api/pull/2950)
* [OCPNODE-4601](https://issues.redhat.com/browse/OCPNODE-4601): Add {system,container}GomaxprocsBehavior field [#2934](https://github.com/openshift/api/pull/2934)
* [Full changelog](https://github.com/openshift/api/compare/31af9f93e31ecd483504b3302d78f67c5a077a9e...e07c1fd9d99c88fda2804b1a14bff2d14bede331)
### [cluster-config-operator](https://github.com/openshift/cluster-config-operator/tree/5c5530c5944b227649717a76273cc09c18005356)
* [OCPBUGS-130339](https://issues.redhat.com/browse/OCPBUGS-130339): Read OpenShift API server replicas from deployment [#524](https://github.com/openshift/cluster-config-operator/pull/524)
* NO-JIRA: chore: Adding some edge folks as OWNERS in the topology controller [#508](https://github.com/openshift/cluster-config-operator/pull/508)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#504](https://github.com/openshift/cluster-config-operator/pull/504)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#500](https://github.com/openshift/cluster-config-operator/pull/500)
* [OCPEDGE-2747](https://issues.redhat.com/browse/OCPEDGE-2747): feat: add topology transition controller for day-2 SNO to HA transitions [#495](https://github.com/openshift/cluster-config-operator/pull/495)
* [Full changelog](https://github.com/openshift/cluster-config-operator/compare/9f787f73f5fffca5cd511ef2c2e704afc14f68ce...5c5530c5944b227649717a76273cc09c18005356)
### [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator/tree/8ca6b2588cefcbeffc895ee8ec51fb52ce9f1bb3)
* [OCPCLOUD-3658](https://issues.redhat.com/browse/OCPCLOUD-3658): bump Kubernetes dependencies to 1.37 [#423](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/423)
* [OCPCLOUD-3707](https://issues.redhat.com/browse/OCPCLOUD-3707): feat(tls): add support for TLS groups/curve preferences [#424](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/424)
* [OCPBUGS-65497](https://issues.redhat.com/browse/OCPBUGS-65497): Add debug-useful ClusterOperator relatedObjects [#404](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/404)
* [OCPBUGS-86988](https://issues.redhat.com/browse/OCPBUGS-86988): Guard against empty workspace field on vsphere [#407](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/407)
* [Full changelog](https://github.com/openshift/cluster-control-plane-machine-set-operator/compare/c00cf58dd81954ca100757f6a2d2af8d84770fd5...8ca6b2588cefcbeffc895ee8ec51fb52ce9f1bb3)
### [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator/tree/41e9a6ccf361de2b37c0e91c2e03fb7fec31a634)
* [STOR-3068](https://issues.redhat.com/browse/STOR-3068): Bump all libraries [#302](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/302)
* [OCPBUGS-127462](https://issues.redhat.com/browse/OCPBUGS-127462): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#298](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/298)
* [OCPBUGS-104846](https://issues.redhat.com/browse/OCPBUGS-104846): Remove VolumeGroupSnapshot feature gate [#297](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/297)
* [Full changelog](https://github.com/openshift/cluster-csi-snapshot-controller-operator/compare/35ec0224eb0e5219d5eae012fb703223a6f3e1f7...41e9a6ccf361de2b37c0e91c2e03fb7fec31a634)
### [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator/tree/3a1eec9b63b48748e5aae3d281b40deaeb3a84e9)
* NO-JIRA: Add pedjak to OWNERS [#490](https://github.com/openshift/cluster-dns-operator/pull/490)
* [OCPBUGS-87970](https://issues.redhat.com/browse/OCPBUGS-87970): Stop using legacy topology-aware hints for DNS [#501](https://github.com/openshift/cluster-dns-operator/pull/501)
* [NE-2126](https://issues.redhat.com/browse/NE-2126): Migrating DNS test cases from QE repo [#491](https://github.com/openshift/cluster-dns-operator/pull/491)
* [OCPBUGS-53192](https://issues.redhat.com/browse/OCPBUGS-53192): Update code reference to use the default branch name 'main' [#488](https://github.com/openshift/cluster-dns-operator/pull/488)
* [ART-23537](https://issues.redhat.com/browse/ART-23537): Fix hermetic build failure by removing update-bindata from build target [#489](https://github.com/openshift/cluster-dns-operator/pull/489)
* [NE-2880](https://issues.redhat.com/browse/NE-2880): Update GitHub issue template URLs [#487](https://github.com/openshift/cluster-dns-operator/pull/487)
* [NE-2126](https://issues.redhat.com/browse/NE-2126): Migrating DNS operator test cases from QE repo [#485](https://github.com/openshift/cluster-dns-operator/pull/485)
* [Full changelog](https://github.com/openshift/cluster-dns-operator/compare/c0ed09e329e9001629518604a58205e3fbe8284a...3a1eec9b63b48748e5aae3d281b40deaeb3a84e9)
### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/04b4210b9c8681cbbb3849682a5966ed383d3376)
* NO-JIRA: move TNF scripts to bindata/etcd/tnf with TNF OWNERS [#1728](https://github.com/openshift/cluster-etcd-operator/pull/1728)
* NO-JIRA: Update the tests to skip if OCPFeatureGate:AutomatedEtcdBackup is not enabled [#1731](https://github.com/openshift/cluster-etcd-operator/pull/1731)
* [OCPBUGS-100304](https://issues.redhat.com/browse/OCPBUGS-100304): write force_new_cluster as a claim timestamp [#1721](https://github.com/openshift/cluster-etcd-operator/pull/1721)
* [OCPBUGS-112390](https://issues.redhat.com/browse/OCPBUGS-112390): [TNF] lifecycle part 2 - update setup deadlock fix & conditions cleanup [#1668](https://github.com/openshift/cluster-etcd-operator/pull/1668)
* NO-JIRA: Add TNF ownership for docs/tnf [#1725](https://github.com/openshift/cluster-etcd-operator/pull/1725)
* [OCPBUGS-123169](https://issues.redhat.com/browse/OCPBUGS-123169): add static linter for workload partitioning annotations [#1707](https://github.com/openshift/cluster-etcd-operator/pull/1707)
* [OCPBUGS-105240](https://issues.redhat.com/browse/OCPBUGS-105240): TNF: wait for etcd-bootstrap member removal before setup [#1672](https://github.com/openshift/cluster-etcd-operator/pull/1672)
* [OCPBUGS-84650](https://issues.redhat.com/browse/OCPBUGS-84650): force installer revision when external-etcd-pod ConfigMap is created [#1705](https://github.com/openshift/cluster-etcd-operator/pull/1705)
* [OCPBUGS-126911](https://issues.redhat.com/browse/OCPBUGS-126911): fix(tnf): set read-only root filesystems [#1715](https://github.com/openshift/cluster-etcd-operator/pull/1715)
* [CNTRLPLANE-4414](https://issues.redhat.com/browse/CNTRLPLANE-4414): allow TLS 1.3 profiles without ciphers [#1710](https://github.com/openshift/cluster-etcd-operator/pull/1710)
* NO-JIRA: refactor: remove unused cert-watcher daemonset manifest [#1711](https://github.com/openshift/cluster-etcd-operator/pull/1711)
* [OCPBUGS-123168](https://issues.redhat.com/browse/OCPBUGS-123168): fix: add missing workload paritioning annotation on cert-watcher daemonset [#1706](https://github.com/openshift/cluster-etcd-operator/pull/1706)
* [OCPBUGS-104851](https://issues.redhat.com/browse/OCPBUGS-104851): feat: add cert-watcher DaemonSet to restart etcd on CA bundle rotation [#1675](https://github.com/openshift/cluster-etcd-operator/pull/1675)
* [OCPBUGS-94106](https://issues.redhat.com/browse/OCPBUGS-94106): fall back to intermediate ciphers during etcd bootstrap [#1689](https://github.com/openshift/cluster-etcd-operator/pull/1689)
* [OCPBUGS-80957](https://issues.redhat.com/browse/OCPBUGS-80957): Reset node status when UID changes [#1687](https://github.com/openshift/cluster-etcd-operator/pull/1687)
* [OCPBUGS-105322](https://issues.redhat.com/browse/OCPBUGS-105322): fix etcdSignerCAExpiration* alert description wording [#1686](https://github.com/openshift/cluster-etcd-operator/pull/1686)
* [CNTRLPLANE-4131](https://issues.redhat.com/browse/CNTRLPLANE-4131): update to latest api to pull in etcd db ga [#1680](https://github.com/openshift/cluster-etcd-operator/pull/1680)
* [OCPBUGS-109740](https://issues.redhat.com/browse/OCPBUGS-109740): Fix tnf_cluster_in_service during per-node maintenance [#1678](https://github.com/openshift/cluster-etcd-operator/pull/1678)
* [OCPBUGS-109743](https://issues.redhat.com/browse/OCPBUGS-109743): Derive console notification docs URL from cluster version [#1676](https://github.com/openshift/cluster-etcd-operator/pull/1676)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/a921cfeac38e9c34f8f781c812753c167679ddab...04b4210b9c8681cbbb3849682a5966ed383d3376)
### [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator/tree/440b92963974ca8f8c0fd7187b2c4d4492a406a4)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#1368](https://github.com/openshift/cluster-image-registry-operator/pull/1368)
* [OCPBUGS-114531](https://issues.redhat.com/browse/OCPBUGS-114531): Add 2m degraded inertia to ImagePrunerController [#1365](https://github.com/openshift/cluster-image-registry-operator/pull/1365)
* [OCPBUGS-112551](https://issues.redhat.com/browse/OCPBUGS-112551): imageconfig: Preserve ImageStreamImportMode during upgrade race [#1363](https://github.com/openshift/cluster-image-registry-operator/pull/1363)
* [OCPBUGS-86308](https://issues.redhat.com/browse/OCPBUGS-86308): do not report progressing during cluster scale up [#1361](https://github.com/openshift/cluster-image-registry-operator/pull/1361)
* [OCPBUGS-113705](https://issues.redhat.com/browse/OCPBUGS-113705): CNTRLPLANE-3779: Migrated go standard cases to ote [#1343](https://github.com/openshift/cluster-image-registry-operator/pull/1343)
* [Full changelog](https://github.com/openshift/cluster-image-registry-operator/compare/94cd22d000c8b8eef24dd43cd05d06544df24930...440b92963974ca8f8c0fd7187b2c4d4492a406a4)
### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/45007ca6932ce7159ee5120084bde0a4d33c4b83)
* [TRT-3022](https://issues.redhat.com/browse/TRT-3022): Revert #1556 "NE-2126: Migrating Ingress operator test cases from QE repo" [#1623](https://github.com/openshift/cluster-ingress-operator/pull/1623)
* [OCPBUGS-129612](https://issues.redhat.com/browse/OCPBUGS-129612): Rebuild fake DNS provider when DNS zones are added [#1614](https://github.com/openshift/cluster-ingress-operator/pull/1614)
* [NE-2126](https://issues.redhat.com/browse/NE-2126): Migrating Ingress operator test cases from QE repo [#1556](https://github.com/openshift/cluster-ingress-operator/pull/1556)
* [OCPBUGS-129664](https://issues.redhat.com/browse/OCPBUGS-129664): Bump to ossm 3.4.3 and Istio 1.30.5 [#1606](https://github.com/openshift/cluster-ingress-operator/pull/1606)
* [OCPBUGS-126999](https://issues.redhat.com/browse/OCPBUGS-126999): Support ambient AWS credentials in tests [#1602](https://github.com/openshift/cluster-ingress-operator/pull/1602)
* [NE-2922](https://issues.redhat.com/browse/NE-2922): Remove duplicate operator Ingress CRD from CIO payload [#1613](https://github.com/openshift/cluster-ingress-operator/pull/1613)
* [NE-2879](https://issues.redhat.com/browse/NE-2879): Update GitHub issue template URLs [#1578](https://github.com/openshift/cluster-ingress-operator/pull/1578)
* [OCPBUGS-105442](https://issues.redhat.com/browse/OCPBUGS-105442): improve Sail RBAC verification diagnostics [#1601](https://github.com/openshift/cluster-ingress-operator/pull/1601)
* [NE-2834](https://issues.redhat.com/browse/NE-2834): Replace deprecated math/rand.Read in e2e test [#1533](https://github.com/openshift/cluster-ingress-operator/pull/1533)
* [OCPBUGS-115108](https://issues.redhat.com/browse/OCPBUGS-115108): derive ingress Degraded grace [#1583](https://github.com/openshift/cluster-ingress-operator/pull/1583)
* [OCPBUGS-125752](https://issues.redhat.com/browse/OCPBUGS-125752): discover AWS subnets from CAPI with MAPI fallback [#1592](https://github.com/openshift/cluster-ingress-operator/pull/1592)
* [OCPBUGS-128253](https://issues.redhat.com/browse/OCPBUGS-128253): Wait for AWS NLB SG baseline [#1604](https://github.com/openshift/cluster-ingress-operator/pull/1604)
* [OCPBUGS-53193](https://issues.redhat.com/browse/OCPBUGS-53193): Update code references to use the default branch name 'main' [#1591](https://github.com/openshift/cluster-ingress-operator/pull/1591)
* [NE-2570](https://issues.redhat.com/browse/NE-2570): Simplify TLS profile validation [#1594](https://github.com/openshift/cluster-ingress-operator/pull/1594)
* [OCPBUGS-122346](https://issues.redhat.com/browse/OCPBUGS-122346): Fix GatewayClass index registration retries during bootstrap [#1588](https://github.com/openshift/cluster-ingress-operator/pull/1588)
* [OCPBUGS-105442](https://issues.redhat.com/browse/OCPBUGS-105442): Remove escalate/bind from Sail Library ClusterRole [#1548](https://github.com/openshift/cluster-ingress-operator/pull/1548)
* [NE-2909](https://issues.redhat.com/browse/NE-2909): Address Gateway API management-mode follow-ups [#1595](https://github.com/openshift/cluster-ingress-operator/pull/1595)
* [OCPBUGS-105317](https://issues.redhat.com/browse/OCPBUGS-105317): Bump to OSSM 3.4.2 and istio 1.30.4 [#1576](https://github.com/openshift/cluster-ingress-operator/pull/1576)
* [OCPBUGS-105398](https://issues.redhat.com/browse/OCPBUGS-105398): docs: clarify Azure workload identity token file [#1586](https://github.com/openshift/cluster-ingress-operator/pull/1586)
* NO-JIRA: Add pedjak to OWNERS [#1596](https://github.com/openshift/cluster-ingress-operator/pull/1596)
* [NE-2388](https://issues.redhat.com/browse/NE-2388): aws nlb security groups [#1500](https://github.com/openshift/cluster-ingress-operator/pull/1500)
* [NE-2779](https://issues.redhat.com/browse/NE-2779): Implement Gateway API management mode [#1547](https://github.com/openshift/cluster-ingress-operator/pull/1547)
* [OCPBUGS-86050](https://issues.redhat.com/browse/OCPBUGS-86050): Update ROUTER_CURVES environment variable for go 1.26 [#1542](https://github.com/openshift/cluster-ingress-operator/pull/1542)
* [OCPBUGS-6718](https://issues.redhat.com/browse/OCPBUGS-6718): minimize wildcard RBAC permissions [#1579](https://github.com/openshift/cluster-ingress-operator/pull/1579)
* [OCPBUGS-105398](https://issues.redhat.com/browse/OCPBUGS-105398): refactor: remove Azure workload identity feature gate [#1575](https://github.com/openshift/cluster-ingress-operator/pull/1575)
* [NE-2491](https://issues.redhat.com/browse/NE-2491): Delete the CRL controller [#1536](https://github.com/openshift/cluster-ingress-operator/pull/1536)
* [WAF-3](https://issues.redhat.com/browse/WAF-3): Implement extension provider capability for WAF [#1555](https://github.com/openshift/cluster-ingress-operator/pull/1555)
* [OCPBUGS-62627](https://issues.redhat.com/browse/OCPBUGS-62627): Suppress Progressing during infrastructure-driven ingress unavailability [#1496](https://github.com/openshift/cluster-ingress-operator/pull/1496)
* [OCPBUGS-92835](https://issues.redhat.com/browse/OCPBUGS-92835): add grace period to Available condition for deployment… [#1544](https://github.com/openshift/cluster-ingress-operator/pull/1544)
* [OCPBUGS-109582](https://issues.redhat.com/browse/OCPBUGS-109582): Normalize malformed CIDRs to avoid upgrade disruptions [#1549](https://github.com/openshift/cluster-ingress-operator/pull/1549)
* [OCPBUGS-91026](https://issues.redhat.com/browse/OCPBUGS-91026): Add missing KAS-defaulted fields to ValidatingAdmissionPolicy manifest [#1560](https://github.com/openshift/cluster-ingress-operator/pull/1560)
* [OCPBUGS-112280](https://issues.redhat.com/browse/OCPBUGS-112280): Preserve server-defaulted fields on init containers and volumes [#1557](https://github.com/openshift/cluster-ingress-operator/pull/1557)
* [NE-2856](https://issues.redhat.com/browse/NE-2856): Fix staticcheck warnings across multiple packages [#1553](https://github.com/openshift/cluster-ingress-operator/pull/1553)
* [NE-2032](https://issues.redhat.com/browse/NE-2032): e2e: Signal service deprovisioning issues during Gateway DNS test [#1220](https://github.com/openshift/cluster-ingress-operator/pull/1220)
* [OCPBUGS-101783](https://issues.redhat.com/browse/OCPBUGS-101783): reconcile canary certificate on dependency creation [#1538](https://github.com/openshift/cluster-ingress-operator/pull/1538)
* [OCPBUGS-100074](https://issues.redhat.com/browse/OCPBUGS-100074): Use /healthz for router startup probe [#1528](https://github.com/openshift/cluster-ingress-operator/pull/1528)
* [OCPBUGS-86841](https://issues.redhat.com/browse/OCPBUGS-86841): Add BackendTLSPolicy and ReferenceGrant e2e test coverage helpers [#1467](https://github.com/openshift/cluster-ingress-operator/pull/1467)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/fe8a2bcf6342fab7aa19c47b4397a7d226962136...45007ca6932ce7159ee5120084bde0a4d33c4b83)
### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/ad5501e4bfad0397f73b1f91a907c5dc6cfe5fd0)
* [CNTRLPLANE-4731](https://issues.redhat.com/browse/CNTRLPLANE-4731): Add KMSPreflightCycle e2e [#2348](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2348)
* [OCPKUEUE-887](https://issues.redhat.com/browse/OCPKUEUE-887): Enable workload API versions for feature gates [#2332](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2332)
* NO-JIRA: Update library-go [#2349](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2349)
* NO-JIRA: Update library-go [#2347](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2347)
* [TRT-3013](https://issues.redhat.com/browse/TRT-3013): Revert "Use 300s shutdown delay on AWS" [#2346](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2346)
* NO-JIRA: bump openshift/api https://github.com/openshift/api/pull/3083 [#2339](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2339)
* [OCPBUGS-86789](https://issues.redhat.com/browse/OCPBUGS-86789): Extend AWS shutdown delay to 300s [#2267](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2267)
* [CNTRLPLANE-4408](https://issues.redhat.com/browse/CNTRLPLANE-4408): Support the `ExternalOIDCAsWebhook` feature gate [#2325](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2325)
* NO-JIRA: bump library-go https://github.com/openshift/library-go/pull/2518 [#2337](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2337)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): update deprecated API usage alerts for kube 1.37 [#2334](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2334)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Bump to golang-1.26-openshift-5.1 image [#2268](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2268)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2474 [#2327](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2327)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): encryption/assertion: bring back the preflight assertion for CAO and OAS-O [#2320](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2320)
* [CNTRLPLANE-4303](https://issues.redhat.com/browse/CNTRLPLANE-4303): Remove old go standard e2e encryption cases [#2322](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2322)
* [CNTRLPLANE-4303](https://issues.redhat.com/browse/CNTRLPLANE-4303): Migrate e2e-encryption to ote [#2290](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2290)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): bump library-go to get the new KMS plugin deployment strategy [#2315](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2315)
* [OCPBUGS-112638](https://issues.redhat.com/browse/OCPBUGS-112638): apienablement: enable resource.k8s.io/v1beta2 when DeviceTaintRule is enabled [#2275](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2275)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2478 [#2313](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2313)
* [OPRUN-4768](https://issues.redhat.com/browse/OPRUN-4768): bump openshift/api [#2316](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2316)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2463 [#2309](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2309)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#2307](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2307)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2439 [#2282](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2282)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pick https://github.com/openshift/library-go/pull/2449 [#2287](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2287)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2451 [#2289](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2289)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): kms: wire EncryptionConfigurationComputer into encryption controllers [#2292](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2292)
* NO-JIRA: Bump library-go [#2286](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2286)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): kms: wire preflight deployer [#2276](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2276)
* NO-JIRA: Update library-go to get latest changes [#2280](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2280)
* [OCPBUGS-80958](https://issues.redhat.com/browse/OCPBUGS-80958): Kube apiserver node replace [#2199](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2199)
* NO-JIRA: bump library-go changes [#2270](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2270)
* [OCPBUGS-38661](https://issues.redhat.com/browse/OCPBUGS-38661): Use 10min inertia for GuardControllerDegraded [#2273](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2273)
* [OCPBUGS-85183](https://issues.redhat.com/browse/OCPBUGS-85183): Add kind-aware staleness detection for runtime-config entries [#2179](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2179)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2430 [#2271](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2271)
* NO-JIRA:Remove old perf tests and update Makefile [#2269](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2269)
* [CNTRLPLANE-4110](https://issues.redhat.com/browse/CNTRLPLANE-4110): Migrate e2e encryption perf cases to ote [#2256](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2256)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/440392249bc58324156ba813b797728e9a81fa3c...ad5501e4bfad0397f73b1f91a907c5dc6cfe5fd0)
### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/c4854ad5ad5d1f9b2dfef3f721f96632334acde7)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Rebase 1.37 [#953](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/953)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#967](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/967)
* [OCPBUGS-107974](https://issues.redhat.com/browse/OCPBUGS-107974): fix CVE-2026-41178 [#955](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/955)
* [OCPBUGS-38662](https://issues.redhat.com/browse/OCPBUGS-38662): Use 10min inertia for GuardControllerDegraded [#956](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/956)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/7be80f36a759d713170588c44fcd5b45970382d5...c4854ad5ad5d1f9b2dfef3f721f96632334acde7)
### [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator/tree/ab8cbfbb1e5532cec39d08c6e84b8f8c0ea856ef)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Rebase 1.37 [#660](https://github.com/openshift/cluster-kube-scheduler-operator/pull/660)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#676](https://github.com/openshift/cluster-kube-scheduler-operator/pull/676)
* [OCPBUGS-107969](https://issues.redhat.com/browse/OCPBUGS-107969): bump otel to v1.44.0 to fix CVE-2026-41178 [#662](https://github.com/openshift/cluster-kube-scheduler-operator/pull/662)
* [OCPBUGS-38663](https://issues.redhat.com/browse/OCPBUGS-38663): Use 10min inertia for GuardControllerDegraded [#661](https://github.com/openshift/cluster-kube-scheduler-operator/pull/661)
* [Full changelog](https://github.com/openshift/cluster-kube-scheduler-operator/compare/7b737a3f68ff52ebff3c9f541edbca357dde7111...ab8cbfbb1e5532cec39d08c6e84b8f8c0ea856ef)
### [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/tree/01da4b3eee18148dddb64b734939ef2b3cb110ef)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#183](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/183)
* [Full changelog](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/compare/ec1db56482efc9dced72b44a1c2b6817dbfffe91...01da4b3eee18148dddb64b734939ef2b3cb110ef)
### [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver/tree/bd330ca2421f5a30cca8aafa26b60ad5af321ec8)
* [OCPBUGS-57437](https://issues.redhat.com/browse/OCPBUGS-57437): Add serving cert renewal e2e test [#342](https://github.com/openshift/cluster-machine-approver/pull/342)
* [OCPBUGS-57437](https://issues.redhat.com/browse/OCPBUGS-57437): Always permit asking node name in CSR SANs [#344](https://github.com/openshift/cluster-machine-approver/pull/344)
* [OCPCLOUD-3659](https://issues.redhat.com/browse/OCPCLOUD-3659): bump Kubernetes dependencies to 1.37 [#340](https://github.com/openshift/cluster-machine-approver/pull/340)
* NO-JIRA: Add OTE [#341](https://github.com/openshift/cluster-machine-approver/pull/341)
* NO-JIRA: feat(tls): add support for TLS groups/curve preferences [#308](https://github.com/openshift/cluster-machine-approver/pull/308)
* [OCPBUGS-99489](https://issues.redhat.com/browse/OCPBUGS-99489): Add NetworkPolicy manifests to openshift-cluster-machine-approver namespace [#313](https://github.com/openshift/cluster-machine-approver/pull/313)
* [OCPBUGS-121194](https://issues.redhat.com/browse/OCPBUGS-121194): fix: retry serving CSRs while Machine addresses populate [#321](https://github.com/openshift/cluster-machine-approver/pull/321)
* [OCPBUGS-57437](https://issues.redhat.com/browse/OCPBUGS-57437): Always validate EgressIPs [#309](https://github.com/openshift/cluster-machine-approver/pull/309)
* [Full changelog](https://github.com/openshift/cluster-machine-approver/compare/11c03d0952f281ca9cfb62e528e5a0e24ae644ab...bd330ca2421f5a30cca8aafa26b60ad5af321ec8)
### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/23655aab712adb18ce1f0690ff8598a8ed165947)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3153](https://github.com/openshift/cluster-monitoring-operator/pull/3153)
* [OCPBUGS-35391](https://issues.redhat.com/browse/OCPBUGS-35391): separate infra memory capacity from workers [#3132](https://github.com/openshift/cluster-monitoring-operator/pull/3132)
* [OCPBUGS-99988](https://issues.redhat.com/browse/OCPBUGS-99988): amcfg: remove client-side TLS enforcement for additional alertmanager configs [#3012](https://github.com/openshift/cluster-monitoring-operator/pull/3012)
* NO-JIRA: configure custom features for monitoring-plugin [#3149](https://github.com/openshift/cluster-monitoring-operator/pull/3149)
* [OCPBUGS-128640](https://issues.redhat.com/browse/OCPBUGS-128640): filter ciphers not supported by Thanos [#3134](https://github.com/openshift/cluster-monitoring-operator/pull/3134)
* [OCPBUGS-11267](https://issues.redhat.com/browse/OCPBUGS-11267), [OCPBUGS-123539](https://issues.redhat.com/browse/OCPBUGS-123539): tidy up RBAC permissions on secrets and configmaps for Prometheus operators [#3053](https://github.com/openshift/cluster-monitoring-operator/pull/3053)
* [ART-22049](https://issues.redhat.com/browse/ART-22049): remove references to configmap-reloader image [#3051](https://github.com/openshift/cluster-monitoring-operator/pull/3051)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3118](https://github.com/openshift/cluster-monitoring-operator/pull/3118)
* NO-ISSUE: [bot] Update jsonnet dependencies [#3117](https://github.com/openshift/cluster-monitoring-operator/pull/3117)
* [OCPBUGS-125779](https://issues.redhat.com/browse/OCPBUGS-125779): don't delete admin-owned Alertmanager secrets on destroy [#3133](https://github.com/openshift/cluster-monitoring-operator/pull/3133)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3105](https://github.com/openshift/cluster-monitoring-operator/pull/3105)
* [MON-4696](https://issues.redhat.com/browse/MON-4696): Bump prometheus-operator dependencies to v0.94.1 [#3102](https://github.com/openshift/cluster-monitoring-operator/pull/3102)
* [OCPBUGS-126689](https://issues.redhat.com/browse/OCPBUGS-126689): fix(e2e): use Job with backoffLimit for TestDocExamples [#3094](https://github.com/openshift/cluster-monitoring-operator/pull/3094)
* [OCPBUGS-123794](https://issues.redhat.com/browse/OCPBUGS-123794): Fix flaky TestTelemetryReport/rate_issues [#3093](https://github.com/openshift/cluster-monitoring-operator/pull/3093)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3097](https://github.com/openshift/cluster-monitoring-operator/pull/3097)
* [MON-4689](https://issues.redhat.com/browse/MON-4689), [OCPBUGS-123539](https://issues.redhat.com/browse/OCPBUGS-123539): Bump prometheus-operator jsonnet and libs to v0.94.0 [#3083](https://github.com/openshift/cluster-monitoring-operator/pull/3083)
* [OCPBUGS-123792](https://issues.redhat.com/browse/OCPBUGS-123792): restore node-exporter textfile metrics with read-only rootfs [#3088](https://github.com/openshift/cluster-monitoring-operator/pull/3088)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3089](https://github.com/openshift/cluster-monitoring-operator/pull/3089)
* NO-JIRA: Skip flaky TestTelemetryReport/rate_issues subtest [#3087](https://github.com/openshift/cluster-monitoring-operator/pull/3087)
* [OCPBUGS-83375](https://issues.redhat.com/browse/OCPBUGS-83375): Create alerting rule for metrics-server failing to scrape kubelet [#2933](https://github.com/openshift/cluster-monitoring-operator/pull/2933)
* [MON-4638](https://issues.redhat.com/browse/MON-4638): align ThanosQueryOverload description with for=1h [#3062](https://github.com/openshift/cluster-monitoring-operator/pull/3062)
* [MON-4665](https://issues.redhat.com/browse/MON-4665): wire zoneinfo node-exporter collector from ClusterMonitorin… [#3063](https://github.com/openshift/cluster-monitoring-operator/pull/3063)
* NO-JIRA: Makefile: ensure JUnit test name prefix is applied even on test failure [#3079](https://github.com/openshift/cluster-monitoring-operator/pull/3079)
* NO-ISSUE: update jsonnet dependencies [#3077](https://github.com/openshift/cluster-monitoring-operator/pull/3077)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3076](https://github.com/openshift/cluster-monitoring-operator/pull/3076)
* [MON-4560](https://issues.redhat.com/browse/MON-4560): implement merge logic in CMO for the new field in the ClusterMonitoring CRD [#3056](https://github.com/openshift/cluster-monitoring-operator/pull/3056)
* [MON-4632](https://issues.redhat.com/browse/MON-4632), [MON-4633](https://issues.redhat.com/browse/MON-4633): Send metrics ramen:dr_policy_type:max and ramen:dr_protected_apps:max via Telemetry [#3074](https://github.com/openshift/cluster-monitoring-operator/pull/3074)
* [MON-4617](https://issues.redhat.com/browse/MON-4617): Update kube-prometheus and add resourceMetricsAPI field [#3069](https://github.com/openshift/cluster-monitoring-operator/pull/3069)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3068](https://github.com/openshift/cluster-monitoring-operator/pull/3068)
* NO-JIRA: Fix staticcheck warnings across multiple packages [#3059](https://github.com/openshift/cluster-monitoring-operator/pull/3059)
* NO-JIRA: test: produce JUnit XML from e2e runs in CI [#3054](https://github.com/openshift/cluster-monitoring-operator/pull/3054)
* NO-JIRA: Makefile: version-stamp golangci-lint binary to prevent stale linter - #3057#3057 [#3057](https://github.com/openshift/cluster-monitoring-operator/pull/3057)
* [OCPBUGS-99769](https://issues.redhat.com/browse/OCPBUGS-99769): wrap library-go resourceCache with mutex for thread safety [#3040](https://github.com/openshift/cluster-monitoring-operator/pull/3040)
* NO-JIRA: hack/tools: remove unused vendor directory [#3055](https://github.com/openshift/cluster-monitoring-operator/pull/3055)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/efeeabf10a9c46f7a82086d2c04c9fc6d93a2b22...23655aab712adb18ce1f0690ff8598a8ed165947)
### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/fc66cef8b3724a5d724fc8f8d9ef5c7bac755916)
* [OPNET-783](https://issues.redhat.com/browse/OPNET-783): network: Add BGP VIP management support [#3047](https://github.com/openshift/cluster-network-operator/pull/3047)
* [OCPBUGS-130570](https://issues.redhat.com/browse/OCPBUGS-130570): Added global overrides for OVN-Kubernetes [#2851](https://github.com/openshift/cluster-network-operator/pull/2851)
* [OCPBUGS-123509](https://issues.redhat.com/browse/OCPBUGS-123509): multus: Refresh ignored namespaces on namespace changes [#3167](https://github.com/openshift/cluster-network-operator/pull/3167)
* [CORENET-7399](https://issues.redhat.com/browse/CORENET-7399): Expand golangci-lint configuration with comprehensive linter set [#3164](https://github.com/openshift/cluster-network-operator/pull/3164)
* [OCPBUGS-127174](https://issues.redhat.com/browse/OCPBUGS-127174): Fix issues when NetObserv fails to install [#3171](https://github.com/openshift/cluster-network-operator/pull/3171)
* NO-JIRA: fix(ovn-kubernetes): disable local DB probes [#3163](https://github.com/openshift/cluster-network-operator/pull/3163)
* [CORENET-7275](https://issues.redhat.com/browse/CORENET-7275): Add AGENTS.md, point CodeRabbit knowledge base at it [#3146](https://github.com/openshift/cluster-network-operator/pull/3146)
* [CORENET-7479](https://issues.redhat.com/browse/CORENET-7479): Add status.vrfName and shortNames to UDN/CUDN CRDs [#3145](https://github.com/openshift/cluster-network-operator/pull/3145)
* [OCPBUGS-113591](https://issues.redhat.com/browse/OCPBUGS-113591): golangci-lint: enable ContextTodo/ContextBackground in usetesting [#3138](https://github.com/openshift/cluster-network-operator/pull/3138)
* [OCPBUGS-92080](https://issues.redhat.com/browse/OCPBUGS-92080): Adds rendering of enable-multi-network-policy in ovnkube-node [#3084](https://github.com/openshift/cluster-network-operator/pull/3084)
* [OCPBUGS-112562](https://issues.redhat.com/browse/OCPBUGS-112562): CVE-2026-41178 - bump go.opentelemetry.io/otel to v1.44.0 [#3132](https://github.com/openshift/cluster-network-operator/pull/3132)
* [OCPBUGS-112278](https://issues.redhat.com/browse/OCPBUGS-112278): Add ConfigMap hash annotation to networking console plugin deployment [#3131](https://github.com/openshift/cluster-network-operator/pull/3131)
* [CORENET-6714](https://issues.redhat.com/browse/CORENET-6714): Install NOO using OLMv0 instead of OLMv1 [#3115](https://github.com/openshift/cluster-network-operator/pull/3115)
* [OCPBUGS-64582](https://issues.redhat.com/browse/OCPBUGS-64582): Drop strategy.rollingUpdate and switch strategy.type to Recreate via pre-patch in frr-k8s-statuscleaner deployments on SNO [#3121](https://github.com/openshift/cluster-network-operator/pull/3121)
* [OCPBUGS-105887](https://issues.redhat.com/browse/OCPBUGS-105887): Filter unsupported cipher suites to prevent ovnkube-identity crash [#3119](https://github.com/openshift/cluster-network-operator/pull/3119)
* NO-ISSUE: modernise the codebase using go fix [#3113](https://github.com/openshift/cluster-network-operator/pull/3113)
* [CORENET-7330](https://issues.redhat.com/browse/CORENET-7330): Allow per-node OVN encap IP override via env-overrides [#2998](https://github.com/openshift/cluster-network-operator/pull/2998)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/1b9a053663d46a789d8c500314cdfae3f879c060...fc66cef8b3724a5d724fc8f8d9ef5c7bac755916)
### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/728999bd889af5e4a6a6c8dcbfe781102188906c)
* [OSDOCS-22738](https://issues.redhat.com/browse/OSDOCS-22738): Fix hexadecimal typos in PerformanceProfile device comments [#1640](https://github.com/openshift/cluster-node-tuning-operator/pull/1640)
* [OCPBUGS-129451](https://issues.redhat.com/browse/OCPBUGS-129451): E2E: remove always-skipped IRQ load balance test [#1653](https://github.com/openshift/cluster-node-tuning-operator/pull/1653)
* [OCPBUGS-129613](https://issues.redhat.com/browse/OCPBUGS-129613): E2E: Add labels to ovsdpdk tests [#1657](https://github.com/openshift/cluster-node-tuning-operator/pull/1657)
* NO-JIRA: Update OWNERS file [#1655](https://github.com/openshift/cluster-node-tuning-operator/pull/1655)
* [OCPBUGS-129449](https://issues.redhat.com/browse/OCPBUGS-129449): E2E: Fix flaky test_id:64099 reboot assertion [#1652](https://github.com/openshift/cluster-node-tuning-operator/pull/1652)
* [OCPBUGS-115749](https://issues.redhat.com/browse/OCPBUGS-115749): Tighten operator RBAC to least privilege [#1639](https://github.com/openshift/cluster-node-tuning-operator/pull/1639)
* [OCPBUGS-66217](https://issues.redhat.com/browse/OCPBUGS-66217): PerformanceProfile and Tuned CRDs during bootstrap [#1596](https://github.com/openshift/cluster-node-tuning-operator/pull/1596)
* [OCPBUGS-127113](https://issues.redhat.com/browse/OCPBUGS-127113): E2E: Fix no-op Get() assertions in mixedcpus [#1571](https://github.com/openshift/cluster-node-tuning-operator/pull/1571)
* [OCPBUGS-129448](https://issues.redhat.com/browse/OCPBUGS-129448): E2E: check against available cpus instead of online cpuset [#1645](https://github.com/openshift/cluster-node-tuning-operator/pull/1645)
* [OCPBUGS-129450](https://issues.redhat.com/browse/OCPBUGS-129450): E2E: LLC: Fix assertions of odd cpus allocations [#1644](https://github.com/openshift/cluster-node-tuning-operator/pull/1644)
* [OCPBUGS-129165](https://issues.redhat.com/browse/OCPBUGS-129165): Makefile: Modify pao-functests-update-only to run tier-0 and tier-1 tests [#1651](https://github.com/openshift/cluster-node-tuning-operator/pull/1651)
* [OCPBUGS-105474](https://issues.redhat.com/browse/OCPBUGS-105474): Prevent offlined CPUs from being re-onlined after reboot by udev hotplug rule [#1618](https://github.com/openshift/cluster-node-tuning-operator/pull/1618)
* [OCPBUGS-126458](https://issues.redhat.com/browse/OCPBUGS-126458): E2E: PPC: replace no-op log-on-match with actual assertions (4 sites) [#1638](https://github.com/openshift/cluster-node-tuning-operator/pull/1638)
* NO-JIRA: Address govulncheck complaints [#1637](https://github.com/openshift/cluster-node-tuning-operator/pull/1637)
* [OCPBUGS-127362](https://issues.redhat.com/browse/OCPBUGS-127362): E2E: ovsDpdk remaining cases and consolidate suite [#1628](https://github.com/openshift/cluster-node-tuning-operator/pull/1628)
* [OCPBUGS-116703](https://issues.redhat.com/browse/OCPBUGS-116703): E2E: add missing matcher to offlined CPU Expect() calls [#1629](https://github.com/openshift/cluster-node-tuning-operator/pull/1629)
* [OCPBUGS-112336](https://issues.redhat.com/browse/OCPBUGS-112336): apis: add missing fields to apis v1 [#1597](https://github.com/openshift/cluster-node-tuning-operator/pull/1597)
* NO-JIRA: Fix CentOS Stream image build failing in dnf history undo [#1633](https://github.com/openshift/cluster-node-tuning-operator/pull/1633)
* [CNF-23698](https://issues.redhat.com/browse/CNF-23698): e2e: make OVS dynamic pinning tests compatible with ovsDpdk CPUs [#1598](https://github.com/openshift/cluster-node-tuning-operator/pull/1598)
* [CNF-25173](https://issues.redhat.com/browse/CNF-25173): e2e: resolve primary MCP from profile in test 32364 [#1624](https://github.com/openshift/cluster-node-tuning-operator/pull/1624)
* [OCPBUGS-113651](https://issues.redhat.com/browse/OCPBUGS-113651): Disable timer.migration on RHCOS 10 [#1614](https://github.com/openshift/cluster-node-tuning-operator/pull/1614)
* [CNF-26060](https://issues.redhat.com/browse/CNF-26060): add optional --ovs-dpdk-cpu-count flag (default 0) [#1590](https://github.com/openshift/cluster-node-tuning-operator/pull/1590)
* NO-JIRA: Bump Kubernetes, OpenShift and other dependencies [#1615](https://github.com/openshift/cluster-node-tuning-operator/pull/1615)
* [OCPBUGS-113647](https://issues.redhat.com/browse/OCPBUGS-113647): E2E: Minor fixes to Memory Manager and hugepages split tests [#1578](https://github.com/openshift/cluster-node-tuning-operator/pull/1578)
* [OCPBUGS-112537](https://issues.redhat.com/browse/OCPBUGS-112537): E2E: Fix ovs dynamic pinning, kubelet and mustgather tests [#1565](https://github.com/openshift/cluster-node-tuning-operator/pull/1565)
* [CNF-26497](https://issues.redhat.com/browse/CNF-26497): unconditionally disable fwupd-refresh.timer [#1591](https://github.com/openshift/cluster-node-tuning-operator/pull/1591)
* [OCPBUGS-112025](https://issues.redhat.com/browse/OCPBUGS-112025): Bump golang.org/x/net [#1593](https://github.com/openshift/cluster-node-tuning-operator/pull/1593)
* [OCPBUGS-105476](https://issues.redhat.com/browse/OCPBUGS-105476): Update PPC help description [#1582](https://github.com/openshift/cluster-node-tuning-operator/pull/1582)
* [OCPBUGS-105458](https://issues.redhat.com/browse/OCPBUGS-105458): Use Add() instead of AddRateLimited() for routine Profile enqueues [#1584](https://github.com/openshift/cluster-node-tuning-operator/pull/1584)
* NO-JIRA: ci: disable smt alignment for ovsDpdk tests [#1589](https://github.com/openshift/cluster-node-tuning-operator/pull/1589)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/accb8e2235f97d682b9d3aea95295bdfaf9b15e0...728999bd889af5e4a6a6c8dcbfe781102188906c)
### [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator/tree/b1f8f5a3abe4561d7c1c0a89183b03d735e037bb)
* NO-ISSUE: Support object-controller (ClusterObjectSet) component [#255](https://github.com/openshift/cluster-olm-operator/pull/255)
* [OPRUN-4768](https://issues.redhat.com/browse/OPRUN-4768): Apply TLS curve preferences to metrics server [#248](https://github.com/openshift/cluster-olm-operator/pull/248)
* [OCPBUGS-105876](https://issues.redhat.com/browse/OCPBUGS-105876): Wire availableInertia into the olm StatusSyncer [#233](https://github.com/openshift/cluster-olm-operator/pull/233)
* [OPRUN-4645](https://issues.redhat.com/browse/OPRUN-4645): observe and apply TLS curve preferences to operand deployments [#226](https://github.com/openshift/cluster-olm-operator/pull/226)
* NO-ISSUE: Bump helm.sh/helm/v3 from 3.21.3 to 3.21.4 [#235](https://github.com/openshift/cluster-olm-operator/pull/235)
* NO-ISSUE: Bump the k8s-dependencies group across 1 directory with 5 updates [#237](https://github.com/openshift/cluster-olm-operator/pull/237)
* NO-ISSUE: Bump golang.org/x/text from 0.40.0 to 0.41.0 [#234](https://github.com/openshift/cluster-olm-operator/pull/234)
* NO-ISSUE: Bump github.com/stretchr/testify from 1.11.1 to 1.12.1 [#236](https://github.com/openshift/cluster-olm-operator/pull/236)
* NO-ISSUE: Bump the k8s-dependencies group across 1 directory with 5 updates [#227](https://github.com/openshift/cluster-olm-operator/pull/227)
* NO-ISSUE: Bump github.com/operator-framework/operator-controller from 1.5.1 to 1.11.0 [#228](https://github.com/openshift/cluster-olm-operator/pull/228)
* NO-ISSUE: Update dependabot config with NO-ISSUE prefix [#232](https://github.com/openshift/cluster-olm-operator/pull/232)
* NO-ISSUE: Bump github.com/go-logr/logr from 1.4.3 to 1.4.4 [#231](https://github.com/openshift/cluster-olm-operator/pull/231)
* [Full changelog](https://github.com/openshift/cluster-olm-operator/compare/228ec940921e4443b2724ef512c0d211d4a38ba7...b1f8f5a3abe4561d7c1c0a89183b03d735e037bb)
### [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator/tree/125ba73aa08c5398a20adcad89b63e6cc1245ce7)
* [CNTRLPLANE-4731](https://issues.redhat.com/browse/CNTRLPLANE-4731): Adding KMS e2e preflight and e2e rotation [#806](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/806)
* NO-JIRA: Update library-go [#803](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/803)
* NO-JIRA: Update library-go [#802](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/802)
* NO-JIRA: bump openshift/api https://github.com/openshift/api/pull/3083 [#798](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/798)
* NO-JIRA: Open bump library-go https://github.com/openshift/library-go/pull/2518 [#797](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/797)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2512 [#794](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/794)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2474 [#792](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/792)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): encryption/assertion: bring back the preflight assertion for CAO and OAS-O [#787](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/787)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): bump library-go to get the new KMS plugin deployment strategy [#781](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/781)
* [OCPBUGS-109468](https://issues.redhat.com/browse/OCPBUGS-109468): fix CVE-2026-41178 by updating otel to v1.44.0 [#761](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/761)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2478 [#783](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/783)
* [OPRUN-4768](https://issues.redhat.com/browse/OPRUN-4768): bump openshift/api [#782](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/782)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2463- #2309 [#770](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/770)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#768](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/768)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2439 [#767](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/767)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pick https://github.com/openshift/library-go/pull/2449- #2287 [#764](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/764)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2451 [#763](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/763)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): kms: wire EncryptionConfigurationComputer into encryption controllers [#762](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/762)
* NO-JIRA: Bump library-go [#760](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/760)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): kms: wire preflight deployer [#758](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/758)
* NO-JIRA: Update library-go to get latest changes [#759](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/759)
* NO-JIRA: Update KMS cases and bump library-go [#756](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/756)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2430 [#754](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/754)
* [OCPBUGS-105786](https://issues.redhat.com/browse/OCPBUGS-105786): Revert "Revert "NO-JIRA: Disable WatchList feature gate due to the missing support of Project watch"" [#751](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/751)
* [Full changelog](https://github.com/openshift/cluster-openshift-apiserver-operator/compare/28420873a3c92985df8ec089e6513b16c4f2f3a0...125ba73aa08c5398a20adcad89b63e6cc1245ce7)
### [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller/tree/c9e9a348260921c9e788e33a51e904502cbe2d13)
* [CNTRLPLANE-3731](https://issues.redhat.com/browse/CNTRLPLANE-3731): Add Agentic SDLC context files to cluster-policy-controller [#191](https://github.com/openshift/cluster-policy-controller/pull/191)
* [Full changelog](https://github.com/openshift/cluster-policy-controller/compare/469bbf211d35eee0df4422bda7e9e600b080f0f2...c9e9a348260921c9e788e33a51e904502cbe2d13)
### [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator/tree/2c667f703af8eaec6a76c91263ba9c78c60675ab)
* [CNTRLPLANE-4448](https://issues.redhat.com/browse/CNTRLPLANE-4448): Support for TLS Group Preferences [#725](https://github.com/openshift/cluster-samples-operator/pull/725)
* [OKD-425](https://issues.redhat.com/browse/OKD-425): Revert openliberty back to 26.0.0.6 [#709](https://github.com/openshift/cluster-samples-operator/pull/709)
* [TRT-2905](https://issues.redhat.com/browse/TRT-2905): Fix python:latest and nodejs template references after UBI 8 tag removal [#706](https://github.com/openshift/cluster-samples-operator/pull/706)
* [Full changelog](https://github.com/openshift/cluster-samples-operator/compare/ba80c7efd89885b08dc890eb5aefb994ee1e7ab9...2c667f703af8eaec6a76c91263ba9c78c60675ab)
### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/b229e74889130654d9f8da310af9ad3bacc8edda)
* [STOR-3068](https://issues.redhat.com/browse/STOR-3068): Bump all libraries [#755](https://github.com/openshift/cluster-storage-operator/pull/755)
* [OCPBUGS-120762](https://issues.redhat.com/browse/OCPBUGS-120762): restrict azure-file secrets ClusterRole to get/list/watch/create [#750](https://github.com/openshift/cluster-storage-operator/pull/750)
* [OCPBUGS-127462](https://issues.redhat.com/browse/OCPBUGS-127462): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#748](https://github.com/openshift/cluster-storage-operator/pull/748)
* [OCPBUGS-127453](https://issues.redhat.com/browse/OCPBUGS-127453): Fix the un-upgradeable message [#746](https://github.com/openshift/cluster-storage-operator/pull/746)
* [OCPBUGS-127453](https://issues.redhat.com/browse/OCPBUGS-127453): Use KCS link in the un-upgradeable message [#744](https://github.com/openshift/cluster-storage-operator/pull/744)
* [GCP-958](https://issues.redhat.com/browse/GCP-958): re-enable GCP PD CSI driver in HyperShift path [#742](https://github.com/openshift/cluster-storage-operator/pull/742)
* [GCP-958](https://issues.redhat.com/browse/GCP-958): temporarily disable GCP PD CSI driver in HyperShift path [#739](https://github.com/openshift/cluster-storage-operator/pull/739)
* [GCP-1075](https://issues.redhat.com/browse/GCP-1075): feat(gcp-pd): enable HyperShift support for GCP PD CSI driver operator [#728](https://github.com/openshift/cluster-storage-operator/pull/728)
* [OCPBUGS-112710](https://issues.redhat.com/browse/OCPBUGS-112710): clusterrole/openshift-csi-main-snapshotter-role needs volume group snapshot rules [#727](https://github.com/openshift/cluster-storage-operator/pull/727)
* [OCPBUGS-91027](https://issues.redhat.com/browse/OCPBUGS-91027): Add KAS-defaulted fields to storage-operator ValidatingAdmissionPolicy manifests [#726](https://github.com/openshift/cluster-storage-operator/pull/726)
* [OCPBUGS-105391](https://issues.redhat.com/browse/OCPBUGS-105391): Pass management cluster proxy env vars to CSI driver operator deployments [#723](https://github.com/openshift/cluster-storage-operator/pull/723)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/b2ee363241ad0425efd56badb6046884cadda97d...b229e74889130654d9f8da310af9ad3bacc8edda)
### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/ef627b49dc6fb986260f78bb79bf8a4e547657af)
* [CNTRLPLANE-4455](https://issues.redhat.com/browse/CNTRLPLANE-4455): Inject observed TLS Groups into annotated ConfigMaps [#1484](https://github.com/openshift/cluster-version-operator/pull/1484)
* NO-JIRA: test/cvo: serve accept-risks graph from in-cluster update service [#1476](https://github.com/openshift/cluster-version-operator/pull/1476)
* [OTA-2130](https://issues.redhat.com/browse/OTA-2130): add execution step, planner skill, and risk data [#1475](https://github.com/openshift/cluster-version-operator/pull/1475)
* [OCPBUGS-65558](https://issues.redhat.com/browse/OCPBUGS-65558): Cancel payload retrieval pod on upgrade clear [#1470](https://github.com/openshift/cluster-version-operator/pull/1470)
* [OCPBUGS-8252](https://issues.redhat.com/browse/OCPBUGS-8252): pkg/cvo: report unresolvable desired releases [#1467](https://github.com/openshift/cluster-version-operator/pull/1467)
* [OCPBUGS-129378](https://issues.redhat.com/browse/OCPBUGS-129378): skip console plugin deployment on OCP < 5.0 [#1482](https://github.com/openshift/cluster-version-operator/pull/1482)
* NO-ISSUE: docs/user/tasks-*by-number-and-component.svg: Update to 5.0 [#1485](https://github.com/openshift/cluster-version-operator/pull/1485)
* NO-JIRA: pkg/cvo: add architecture label to cluster_version_payload [#1480](https://github.com/openshift/cluster-version-operator/pull/1480)
* NO-ISSUE: test/cvo: set needRecover before mutating cluster resources [#1477](https://github.com/openshift/cluster-version-operator/pull/1477)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#1471](https://github.com/openshift/cluster-version-operator/pull/1471)
* [OKD-194](https://issues.redhat.com/browse/OKD-194): Add OKD cincinnati as the default update service for OKD [#1466](https://github.com/openshift/cluster-version-operator/pull/1466)
* [OTA-2109](https://issues.redhat.com/browse/OTA-2109): harden console plugin nginx TLS configuration [#1453](https://github.com/openshift/cluster-version-operator/pull/1453)
* [OTA-2110](https://issues.redhat.com/browse/OTA-2110): remove cluster_id from LLM-bound readiness payload [#1451](https://github.com/openshift/cluster-version-operator/pull/1451)
* [OTA-2111](https://issues.redhat.com/browse/OTA-2111): set readOnlyRootFilesystem on console plugin container [#1452](https://github.com/openshift/cluster-version-operator/pull/1452)
* [OTA-2108](https://issues.redhat.com/browse/OTA-2108): restrict console plugin NetworkPolicy to openshift-console namespace [#1450](https://github.com/openshift/cluster-version-operator/pull/1450)
* [OTA-2106](https://issues.redhat.com/browse/OTA-2106): drop NetworkCheck (SDN gone, proxy data unused) [#1442](https://github.com/openshift/cluster-version-operator/pull/1442)
* NO-ISSUE: pkg/readiness/cluster_conditions: Conditionally include Upgradeable [#1463](https://github.com/openshift/cluster-version-operator/pull/1463)
* [OCPBUGS-54864](https://issues.redhat.com/browse/OCPBUGS-54864): reduce verbosity of skipping metrics log messages [#1439](https://github.com/openshift/cluster-version-operator/pull/1439)
* NO-ISSUE: OWNERS: Pratik is no longer at Red Hat :( [#1449](https://github.com/openshift/cluster-version-operator/pull/1449)
* [OCPBUGS-80925](https://issues.redhat.com/browse/OCPBUGS-80925): Remove the CRB for the default openshift-cluster-version SA [#1366](https://github.com/openshift/cluster-version-operator/pull/1366)
* [OCPBUGS-110322](https://issues.redhat.com/browse/OCPBUGS-110322): pkg/agenticrun/controller: Pivot to cluster-update-advisor directory [#1446](https://github.com/openshift/cluster-version-operator/pull/1446)
* "OTA-2107: Harden AgenticRun against indirect prompt injection" [#1443](https://github.com/openshift/cluster-version-operator/pull/1443)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/219aba7debd16c83bb6ccdccf156af921ce54dfe...ef627b49dc6fb986260f78bb79bf8a4e547657af)
### [console](https://github.com/openshift/console/tree/de8cdf6461735171f2384af93eb44a0606f25ec4)
* [CONSOLE-5552](https://issues.redhat.com/browse/CONSOLE-5552): Add Bridge CSP mode flag [#17369](https://github.com/openshift/console/pull/17369)
* NO-JIRA: Console plugin SDK package CHANGELOG update [#17392](https://github.com/openshift/console/pull/17392)
* [CONSOLE-5065](https://issues.redhat.com/browse/CONSOLE-5065): Migrate off of deprecated TS types [#17140](https://github.com/openshift/console/pull/17140)
* [CONSOLE-5065](https://issues.redhat.com/browse/CONSOLE-5065): Hold back on dynamicModulePatternFlyPackages update [#17390](https://github.com/openshift/console/pull/17390)
* [OCPBUGS-125794](https://issues.redhat.com/browse/OCPBUGS-125794): Show Software Catalog operators for namespace-scoped users [#17327](https://github.com/openshift/console/pull/17327)
* [CONSOLE-5564](https://issues.redhat.com/browse/CONSOLE-5564): ConsoleDataView API improvements [#17385](https://github.com/openshift/console/pull/17385)
* [OCPBUGS-130732](https://issues.redhat.com/browse/OCPBUGS-130732): Add security response headers [#17376](https://github.com/openshift/console/pull/17376)
* [CONSOLE-5065](https://issues.redhat.com/browse/CONSOLE-5065): Update dynamicModulePatternFlyPackages and related imports [#17379](https://github.com/openshift/console/pull/17379)
* [HELM-863](https://issues.redhat.com/browse/HELM-863): Show Helm nav tab regardless of HelmChartRepository/ProjectHelmChartRepository instance existence [#17338](https://github.com/openshift/console/pull/17338)
* [CONSOLE-5564](https://issues.redhat.com/browse/CONSOLE-5564): Add rearrangable columns to ConsoleDataView [#17370](https://github.com/openshift/console/pull/17370)
* [CONSOLE-5549](https://issues.redhat.com/browse/CONSOLE-5549): Add performance profiling for the dashboards page [#17346](https://github.com/openshift/console/pull/17346)
* [CONSOLE-5560](https://issues.redhat.com/browse/CONSOLE-5560): table column extension follow ups [#17363](https://github.com/openshift/console/pull/17363)
* [CONSOLE-5560](https://issues.redhat.com/browse/CONSOLE-5560): Add ConsoleDataView table column extensions [#17351](https://github.com/openshift/console/pull/17351)
* [OCPBUGS-84497](https://issues.redhat.com/browse/OCPBUGS-84497): Cap rendered alerts in notification drawer and dashboards [#17324](https://github.com/openshift/console/pull/17324)
* [CONSOLE-5544](https://issues.redhat.com/browse/CONSOLE-5544): Migrate OLM tables to ConsoleDataView [#17342](https://github.com/openshift/console/pull/17342)
* [CONSOLE-5540](https://issues.redhat.com/browse/CONSOLE-5540): Migrate metal3, container-security, and shipwright tables to ConsoleDataView [#17340](https://github.com/openshift/console/pull/17340)
* [CONSOLE-5099](https://issues.redhat.com/browse/CONSOLE-5099): Add kubeconfig download for ServiceAccounts and current user [#17199](https://github.com/openshift/console/pull/17199)
* [OCPBUGS-128719](https://issues.redhat.com/browse/OCPBUGS-128719): fix incorrect breakpoint in code editor sidebar [#17336](https://github.com/openshift/console/pull/17336)
* [CONSOLE-5539](https://issues.redhat.com/browse/CONSOLE-5539): Migrate knative tables to ConsoleDataView [#17326](https://github.com/openshift/console/pull/17326)
* [OCPBUGS-128465](https://issues.redhat.com/browse/OCPBUGS-128465): Fix flaky namespace selection and eliminate cross-file contention in OLM Data Grid e2e specs [#17329](https://github.com/openshift/console/pull/17329)
* [HELM-859](https://issues.redhat.com/browse/HELM-859): Guard against null/missing urls in Helm charts [#17280](https://github.com/openshift/console/pull/17280)
* [OCPBUGS-127046](https://issues.redhat.com/browse/OCPBUGS-127046): provide PatternFly dynamic modules without Console consuming them [#17318](https://github.com/openshift/console/pull/17318)
* NO-JIRA: Document the console.page/resource/list contract [#17312](https://github.com/openshift/console/pull/17312)
* [OCPBUGS-71193](https://issues.redhat.com/browse/OCPBUGS-71193): Group details page renders a kebab button instead of Actions button [#17197](https://github.com/openshift/console/pull/17197)
* NO-JIRA: small improvements and dep bumps [#17219](https://github.com/openshift/console/pull/17219)
* [CONSOLE-5113](https://issues.redhat.com/browse/CONSOLE-5113): Add default namespace warnings [#17177](https://github.com/openshift/console/pull/17177)
* [OCPBUGS-126807](https://issues.redhat.com/browse/OCPBUGS-126807): Post qa-verify evidence via gh's native --attach instead of base64 [#17193](https://github.com/openshift/console/pull/17193)
* [OCPBUGS-125223](https://issues.redhat.com/browse/OCPBUGS-125223): restore some old test-prow-e2e scenarios [#17187](https://github.com/openshift/console/pull/17187)
* [OCPBUGS-126219](https://issues.redhat.com/browse/OCPBUGS-126219): i18n upload/download routine task - version 4.23/5.0 (Additional) [#17190](https://github.com/openshift/console/pull/17190)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#17176](https://github.com/openshift/console/pull/17176)
* [OCPBUGS-90834](https://issues.redhat.com/browse/OCPBUGS-90834): Fix empty vSphere connection details after upgrade [#17020](https://github.com/openshift/console/pull/17020)
* [OCPBUGS-123141](https://issues.redhat.com/browse/OCPBUGS-123141): i18n upload/download routine task - version 4.23/5.0 [#17165](https://github.com/openshift/console/pull/17165)
* [CONSOLE-4998](https://issues.redhat.com/browse/CONSOLE-4998): Add types for serverless resources [#17152](https://github.com/openshift/console/pull/17152)
* [OCPBUGS-121263](https://issues.redhat.com/browse/OCPBUGS-121263): bump go-git to 5.19.2 [#17148](https://github.com/openshift/console/pull/17148)
* [OCPBUGS-115458](https://issues.redhat.com/browse/OCPBUGS-115458): CVE-2026-84375 bump js-yaml to 3.15.2/4.3.2 [#17133](https://github.com/openshift/console/pull/17133)
* [OCPBUGS-115318](https://issues.redhat.com/browse/OCPBUGS-115318): fix Helm test flake by replacing pkill with PID-file cleanup [#17128](https://github.com/openshift/console/pull/17128)
* [OCPBUGS-120684](https://issues.redhat.com/browse/OCPBUGS-120684): Update stale comment [#17141](https://github.com/openshift/console/pull/17141)
* NO-JIRA: add prettier to playwright folder [#17137](https://github.com/openshift/console/pull/17137)
* [OCPBUGS-115300](https://issues.redhat.com/browse/OCPBUGS-115300): Stabilize topology, node-groups, and debug-pod e2e [#17134](https://github.com/openshift/console/pull/17134)
* [OCPBUGS-115300](https://issues.redhat.com/browse/OCPBUGS-115300): Fix Playwright login helper idempotency and session recovery [#17126](https://github.com/openshift/console/pull/17126)
* [HELM-480](https://issues.redhat.com/browse/HELM-480): Change handler return code [#17042](https://github.com/openshift/console/pull/17042)
* [OCPBUGS-115298](https://issues.redhat.com/browse/OCPBUGS-115298): Rename e2e scripts so playwright is the main one [#17127](https://github.com/openshift/console/pull/17127)
* [CONSOLE-5002](https://issues.redhat.com/browse/CONSOLE-5002): `UserPreferenceContext`and linting follow up [#17124](https://github.com/openshift/console/pull/17124)
* [OCPBUGS-109632](https://issues.redhat.com/browse/OCPBUGS-109632): Fix webhook creation in Git for PAC [#17078](https://github.com/openshift/console/pull/17078)
* NO-JIRA: fix session-persistence tests failing due to pre-loaded storageState [#17121](https://github.com/openshift/console/pull/17121)
* [CONSOLE-5002](https://issues.redhat.com/browse/CONSOLE-5002): re-render user preferences only when a listened key changes [#17104](https://github.com/openshift/console/pull/17104)
* [OCPBUGS-114052](https://issues.redhat.com/browse/OCPBUGS-114052): move yarn install to prow scripts [#17119](https://github.com/openshift/console/pull/17119)
* [OCPBUGS-115128](https://issues.redhat.com/browse/OCPBUGS-115128): Upgrade grpc to v1.83.2 and x/net to v0.58.0 [#17120](https://github.com/openshift/console/pull/17120)
* [RFE-9146](https://issues.redhat.com/browse/RFE-9146): Docs followup for service account impersonation [#17093](https://github.com/openshift/console/pull/17093)
* [CONSOLE-5000](https://issues.redhat.com/browse/CONSOLE-5000): Remove Redux activeNamespace in favor of NamespaceContext [#17102](https://github.com/openshift/console/pull/17102)
* NO-JIRA: Improve readability of `test-frontend` output [#17080](https://github.com/openshift/console/pull/17080)
* [OCPBUGS-112809](https://issues.redhat.com/browse/OCPBUGS-112809): Restore panic on Helm test infrastructure failure [#17077](https://github.com/openshift/console/pull/17077)
* [OCPBUGS-85646](https://issues.redhat.com/browse/OCPBUGS-85646): display operators in catalog when Tech Preview enabled [#16976](https://github.com/openshift/console/pull/16976)
* [OCPBUGS-95590](https://issues.redhat.com/browse/OCPBUGS-95590): Hide Builds nav section when Build capability is disabled [#16891](https://github.com/openshift/console/pull/16891)
* [CONSOLE-5001](https://issues.redhat.com/browse/CONSOLE-5001): Remove ImmutableJS [#17024](https://github.com/openshift/console/pull/17024)
* [OCPBUGS-105603](https://issues.redhat.com/browse/OCPBUGS-105603): Strip version tag from OCI chart URL to prevent doubl… [#16999](https://github.com/openshift/console/pull/16999)
* [OCPBUGS-99884](https://issues.redhat.com/browse/OCPBUGS-99884): Fix "Set as default" StorageClass action [#17066](https://github.com/openshift/console/pull/17066)
* [OCPBUGS-112462](https://issues.redhat.com/browse/OCPBUGS-112462): Remove empty integration-tests package from CI [#17064](https://github.com/openshift/console/pull/17064)
* [OCPBUGS-52186](https://issues.redhat.com/browse/OCPBUGS-52186): Show CPU/Memory metrics for non-admin users on Projects page [#17001](https://github.com/openshift/console/pull/17001)
* [OCPBUGS-111698](https://issues.redhat.com/browse/OCPBUGS-111698): Migrate app/ Cypress e2e tests to Playwright [#17015](https://github.com/openshift/console/pull/17015)
* [OCPBUGS-112046](https://issues.redhat.com/browse/OCPBUGS-112046): fix Helm test flake by detecting dead processes early [#17039](https://github.com/openshift/console/pull/17039)
* [CONSOLE-5463](https://issues.redhat.com/browse/CONSOLE-5463): Turn on react compiler linting rules [#17032](https://github.com/openshift/console/pull/17032)
* [OCPBUGS-75963](https://issues.redhat.com/browse/OCPBUGS-75963): Fix Edit Machine count action on MachineSet details page [#17038](https://github.com/openshift/console/pull/17038)
* [OCPBUGS-95597](https://issues.redhat.com/browse/OCPBUGS-95597): Fix UI validation for private Bitbucket repositories [#17028](https://github.com/openshift/console/pull/17028)
* [OCPBUGS-111634](https://issues.redhat.com/browse/OCPBUGS-111634): Keep OLS cluster-update prompts within OpenAI 32k limit [#17018](https://github.com/openshift/console/pull/17018)
* [OCPBUGS-111699](https://issues.redhat.com/browse/OCPBUGS-111699): Migrate secrets e2e tests from Cypress to Playwright [#17006](https://github.com/openshift/console/pull/17006)
* [CONSOLE-5159](https://issues.redhat.com/browse/CONSOLE-5159), [OCPBUGS-95606](https://issues.redhat.com/browse/OCPBUGS-95606): Replace deprecated Node10 moduleResolution with Bundler for TS6 compatibility [#16259](https://github.com/openshift/console/pull/16259)
* [OCPBUGS-111929](https://issues.redhat.com/browse/OCPBUGS-111929): Fix plugin entrypoint failing to load [#17027](https://github.com/openshift/console/pull/17027)
* [HELM-827](https://issues.redhat.com/browse/HELM-827): Add RTL unit tests for 9 critical Helm plugin components [#16909](https://github.com/openshift/console/pull/16909)
* NO-JIRA: add myself to owners and add frontend owners to .claude [#17025](https://github.com/openshift/console/pull/17025)
* [OCPBUGS-86298](https://issues.redhat.com/browse/OCPBUGS-86298): Fix missing Impersonate action on RoleBinding detail page [#16783](https://github.com/openshift/console/pull/16783)
* [OCPBUGS-86294](https://issues.redhat.com/browse/OCPBUGS-86294): Fix MachineAutoscaler modal crash when opened from detail page [#16781](https://github.com/openshift/console/pull/16781)
* [OCPBUGS-86511](https://issues.redhat.com/browse/OCPBUGS-86511): Fix flaky TestAsyncCache backend test [#17009](https://github.com/openshift/console/pull/17009)
* [OCPBUGS-111644](https://issues.redhat.com/browse/OCPBUGS-111644): Shared Playwright e2e context and test generation skill [#16986](https://github.com/openshift/console/pull/16986)
* [CONSOLE-5003](https://issues.redhat.com/browse/CONSOLE-5003): reimplement and enable jest linting [#17019](https://github.com/openshift/console/pull/17019)
* [OCPBUGS-95594](https://issues.redhat.com/browse/OCPBUGS-95594): make cloud provider fields optional during operator install [#16927](https://github.com/openshift/console/pull/16927)
* [OCPBUGS-14473](https://issues.redhat.com/browse/OCPBUGS-14473): Guard against undefined data in dashboard charts [#16952](https://github.com/openshift/console/pull/16952)
* And 37 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/console/compare/d51eacd73d7c6bd722c4af36928f09c329d4d220...de8cdf6461735171f2384af93eb44a0606f25ec4)
### [console-operator](https://github.com/openshift/console-operator/tree/4105b421407c8f7c1cff49f3221235861d39dec2)
* [HELM-850](https://issues.redhat.com/browse/HELM-850): Address review feedback on Helm CLI download descriptions [#1235](https://github.com/openshift/console-operator/pull/1235)
* [RFE-4149](https://issues.redhat.com/browse/RFE-4149): Read only filesystem - temp directory mount [#1014](https://github.com/openshift/console-operator/pull/1014)
* [TRT-3005](https://issues.redhat.com/browse/TRT-3005): Revert #1227 "OCPSTRAT-3567: Replace console allow-all NetworkPolicy with scoped policies" [#1241](https://github.com/openshift/console-operator/pull/1241)
* NO-JIRA: Update API and client-go dependencies for Console ingress helper rename [#1236](https://github.com/openshift/console-operator/pull/1236)
* [OCPSTRAT-3567](https://issues.redhat.com/browse/OCPSTRAT-3567): Replace console allow-all NetworkPolicy with scoped policies [#1227](https://github.com/openshift/console-operator/pull/1227)
* [OCPBUGS-86719](https://issues.redhat.com/browse/OCPBUGS-86719): Use zero-downtime rollout strategy for console pods [#1168](https://github.com/openshift/console-operator/pull/1168)
* [CNTRLPLANE-4564](https://issues.redhat.com/browse/CNTRLPLANE-4564): Update to the latest openshift/api and rebase to 1.37 [#1237](https://github.com/openshift/console-operator/pull/1237)
* [OCPBUGS-109666](https://issues.redhat.com/browse/OCPBUGS-109666): fix the name of the Helm release in EAP 8.1 quickstart [#1208](https://github.com/openshift/console-operator/pull/1208)
* [OCPBUGS-121388](https://issues.redhat.com/browse/OCPBUGS-121388): Make console status flush cancellation-aware [#1228](https://github.com/openshift/console-operator/pull/1228)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#1230](https://github.com/openshift/console-operator/pull/1230)
* [CONSOLE-5405](https://issues.redhat.com/browse/CONSOLE-5405): Update console-operator to Kubernetes 1.36 [#1211](https://github.com/openshift/console-operator/pull/1211)
* [OCPBUGS-104500](https://issues.redhat.com/browse/OCPBUGS-104500): Use content hash for ConfigMap deployment annotations [#1217](https://github.com/openshift/console-operator/pull/1217)
* [OCPBUGS-71237](https://issues.redhat.com/browse/OCPBUGS-71237): Generate session-secret for all auth types [#1204](https://github.com/openshift/console-operator/pull/1204)
* [OCPBUGS-58422](https://issues.redhat.com/browse/OCPBUGS-58422): Handle disabled Ingress capability in HyperShift [#1182](https://github.com/openshift/console-operator/pull/1182)
* [OCPBUGS-92204](https://issues.redhat.com/browse/OCPBUGS-92204): Clear stale OIDC degraded condition on auth type change [#1212](https://github.com/openshift/console-operator/pull/1212)
* [CNF-23047](https://issues.redhat.com/browse/CNF-23047): Migrate away from deprecated ioutil [#1072](https://github.com/openshift/console-operator/pull/1072)
* [OCPBUGS-104854](https://issues.redhat.com/browse/OCPBUGS-104854): Fix excessive DeploymentUpdated events via content hash [#1210](https://github.com/openshift/console-operator/pull/1210)
* [OCPBUGS-109670](https://issues.redhat.com/browse/OCPBUGS-109670): Derive documentationBaseURL dynamically from OPERATOR_IMAGE_VERSION [#1209](https://github.com/openshift/console-operator/pull/1209)
* [Full changelog](https://github.com/openshift/console-operator/compare/630495120bc5ddc9e05cd6defc2102690ced6301...4105b421407c8f7c1cff49f3221235861d39dec2)
### [container-networking-plugins, containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins/tree/44c6428e4c9a20fd2f0c3ad4de11e50862a51151)
* [CORENET-7231](https://issues.redhat.com/browse/CORENET-7231): Update OWNERS file [#241](https://github.com/openshift/containernetworking-plugins/pull/241)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#248](https://github.com/openshift/containernetworking-plugins/pull/248)
* [OCPBUGS-83863](https://issues.redhat.com/browse/OCPBUGS-83863): Remove rhel8 build stage [#228](https://github.com/openshift/containernetworking-plugins/pull/228)
* [Full changelog](https://github.com/openshift/containernetworking-plugins/compare/d253ee09d629b8172ffc9c3e4b571320fc63ee34...44c6428e4c9a20fd2f0c3ad4de11e50862a51151)
### [coredns](https://github.com/openshift/coredns/tree/83aefed36b4dd6eb800885e56af7cf97fc9db8d7)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#215](https://github.com/openshift/coredns/pull/215)
* [Full changelog](https://github.com/openshift/coredns/compare/37aaba896e97f4b9a091aab6d36f2213b8854474...83aefed36b4dd6eb800885e56af7cf97fc9db8d7)
### [csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/ce2ac54d011d7292c44828f1603490d7593bd73d)
* UPSTREAM-SYNC: Sync main with latest upstream (release-1.37) [#446](https://github.com/openshift/cloud-provider-openstack/pull/446)
* [OCPBUGS-98116](https://issues.redhat.com/browse/OCPBUGS-98116): Bump golang.org/x/crypto to v0.52.0 [#410](https://github.com/openshift/cloud-provider-openstack/pull/410)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/aa9a8100e87ff13abf4dd6343c84c9f4948debef...ce2ac54d011d7292c44828f1603490d7593bd73d)
### [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs/tree/69f816f69e1273868bc19cb13fe6dbd9a7a9ff5f)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master (f12e133) into main [#199](https://github.com/openshift/csi-driver-nfs/pull/199)
* [Full changelog](https://github.com/openshift/csi-driver-nfs/compare/beb9567b4ef15656a88c1c71e0b08e7bf2e96aaa...69f816f69e1273868bc19cb13fe6dbd9a7a9ff5f)
### [csi-external-attacher](https://github.com/openshift/csi-external-attacher/tree/9fec0cd4e5043505e3b0bf7230e3d41e1482f85b)
* [STOR-3085](https://issues.redhat.com/browse/STOR-3085): Rebase to upstream v4.13.0 for OCP 5.1 [#123](https://github.com/openshift/csi-external-attacher/pull/123)
* [Full changelog](https://github.com/openshift/csi-external-attacher/compare/3fd668b3f07dd382e5c7b6239d50f7988f652e64...9fec0cd4e5043505e3b0bf7230e3d41e1482f85b)
### [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner/tree/4af23e6310423f2be9f25dbd772d228a6ca34443)
* [STOR-3085](https://issues.redhat.com/browse/STOR-3085): Rebase to upstream v6.4.0 for OCP 5.1 [#165](https://github.com/openshift/csi-external-provisioner/pull/165)
* [Full changelog](https://github.com/openshift/csi-external-provisioner/compare/7ff338c9d1296f0e5d4d8080a76bb191c8f3be30...4af23e6310423f2be9f25dbd772d228a6ca34443)
### [csi-external-snapshot-metadata](https://github.com/openshift/csi-external-snapshot-metadata/tree/0399f2634abb48378e1a29899530c1de157a03ec)
* [STOR-3085](https://issues.redhat.com/browse/STOR-3085): Rebase to upstream v1.1.0 for OCP 5.1 [#35](https://github.com/openshift/csi-external-snapshot-metadata/pull/35)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#27](https://github.com/openshift/csi-external-snapshot-metadata/pull/27)
* NO-ISSUE: Bump golang.org/x/net to v0.53.0 and Go to 1.25.10 [#22](https://github.com/openshift/csi-external-snapshot-metadata/pull/22)
* [Full changelog](https://github.com/openshift/csi-external-snapshot-metadata/compare/b929f29695d4a1ab21a70868f681d463a673380f...0399f2634abb48378e1a29899530c1de157a03ec)
### [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe/tree/4d22ba873038484dcd7fa67553d00ae01d20428a)
* [OCPBUGS-122222](https://issues.redhat.com/browse/OCPBUGS-122222): Bump go.opentelemetry.io/otel to v1.44.0 to address CVE-2026-41178 [#96](https://github.com/openshift/csi-livenessprobe/pull/96)
* [Full changelog](https://github.com/openshift/csi-livenessprobe/compare/463dc553ebb04df192d573c5a1612dcb50cb1f52...4d22ba873038484dcd7fa67553d00ae01d20428a)
### [docker-builder](https://github.com/openshift/builder/tree/eb6fab812908e89e61afd9083d96a3e44d979b20)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#558](https://github.com/openshift/builder/pull/558)
* NO-JIRA: Bump golang.org/x/crypto, update CI builder images and go directive to go1.26 [#555](https://github.com/openshift/builder/pull/555)
* [Full changelog](https://github.com/openshift/builder/compare/35b0a13b45e95c19046a59dc8727cf60210d6a0d...eb6fab812908e89e61afd9083d96a3e44d979b20)
### [docker-registry](https://github.com/openshift/image-registry/tree/ad28258ba72b92639a64c13942528cfd07bcdcbd)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#487](https://github.com/openshift/image-registry/pull/487)
* [CNTRLPLANE-4447](https://issues.redhat.com/browse/CNTRLPLANE-4447): add support for configuring TLS groups [#488](https://github.com/openshift/image-registry/pull/488)
* [OCPBUGS-99398](https://issues.redhat.com/browse/OCPBUGS-99398): Fix resolveUpstreamRef to properly propagate not-found errors [#475](https://github.com/openshift/image-registry/pull/475)
* [Full changelog](https://github.com/openshift/image-registry/compare/a91ce6edf2c5cc08aa184c47dff79e842079c533...ad28258ba72b92639a64c13942528cfd07bcdcbd)
### [egress-router-cni](https://github.com/openshift/egress-router-cni/tree/0264f879b64fe94c28f1b7a32c5fcd91a5ec43db)
* [OCPBUGS-55356](https://issues.redhat.com/browse/OCPBUGS-55356): Fix invalid IPv6 sysctl key for enabling IP forwarding [#112](https://github.com/openshift/egress-router-cni/pull/112)
* [OCPBUGS-105251](https://issues.redhat.com/browse/OCPBUGS-105251): Update Dockerfiles [#111](https://github.com/openshift/egress-router-cni/pull/111)
* [Full changelog](https://github.com/openshift/egress-router-cni/compare/bc639044a3aee89f1f9547ad0539481b8d808516...0264f879b64fe94c28f1b7a32c5fcd91a5ec43db)
### [etcd, installer-etcd-artifacts](https://github.com/openshift/etcd/tree/8480451b19d39e15760c32e773521a295920eaa9)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#415](https://github.com/openshift/etcd/pull/415)
* [CNTRLPLANE-3724](https://issues.redhat.com/browse/CNTRLPLANE-3724): add agentic context docs for the openshift/etcd fork [#411](https://github.com/openshift/etcd/pull/411)
* [Full changelog](https://github.com/openshift/etcd/compare/609b11ed8fc404fb95572d7c87e3243a1206cdb7...8480451b19d39e15760c32e773521a295920eaa9)
### [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp/tree/897628ca4a2429cd3f6913e667a01b3c20613bac)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#314](https://github.com/openshift/cluster-api-provider-gcp/pull/314)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.13.1 (8198b8b) into main [#302](https://github.com/openshift/cluster-api-provider-gcp/pull/302)
* [Full changelog](https://github.com/openshift/cluster-api-provider-gcp/compare/dbcbfe70efa75f192309f2d0f8daae2c6a441e90...897628ca4a2429cd3f6913e667a01b3c20613bac)
### [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp/tree/64956d7e3314b1b5922e6a1f384846769341bba3)
* [OCPBUGS-90560](https://issues.redhat.com/browse/OCPBUGS-90560): resolve boot disk image at reconcile time [#181](https://github.com/openshift/machine-api-provider-gcp/pull/181)
* [OCPBUGS-82191](https://issues.redhat.com/browse/OCPBUGS-82191): Wait for RUNNING before providerID; retry stockout [#160](https://github.com/openshift/machine-api-provider-gcp/pull/160)
* [Full changelog](https://github.com/openshift/machine-api-provider-gcp/compare/91033fc5b42f58acdad7be8c89a0012f5f2c9b5b...64956d7e3314b1b5922e6a1f384846769341bba3)
### [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver/tree/ce7b501ec5bc6ab63c894474a770ccc54fd8d1d2)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#131](https://github.com/openshift/gcp-pd-csi-driver/pull/131)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver/compare/049c0b96742c40fdd4384920afe17cefa5fa3d27...ce7b501ec5bc6ab63c894474a770ccc54fd8d1d2)
### [haproxy-router, haproxy-router-haproxy28, haproxy-router-haproxy32](https://github.com/openshift/router/tree/237097c7a3fedcd6c3218d7b7d1c580f401f34a6)
* [OCPBUGS-88730](https://issues.redhat.com/browse/OCPBUGS-88730): Validate positive rate limits [#850](https://github.com/openshift/router/pull/850)
* [NE-2126](https://issues.redhat.com/browse/NE-2126): Migrating Route test cases from QE repo [#848](https://github.com/openshift/router/pull/848)
* NO-JIRA: Add pedjak to OWNERS [#847](https://github.com/openshift/router/pull/847)
* [OCPBUGS-84250](https://issues.redhat.com/browse/OCPBUGS-84250): Add debug logging when dynamic update fails [#836](https://github.com/openshift/router/pull/836)
* [OCPBUGS-77056](https://issues.redhat.com/browse/OCPBUGS-77056): Lock DeleteFunc to stop SARCompleted overwriting rejection [#840](https://github.com/openshift/router/pull/840)
* [Full changelog](https://github.com/openshift/router/compare/3381229146657d2e6bd94115dda0885f25cb3bed...237097c7a3fedcd6c3218d7b7d1c580f401f34a6)
### [hyperkube, installer-kube-apiserver-artifacts, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/92e1a4b8eea32cd95383e29e7cfafc8d562917e4)
* UPSTREAM: <carry>: OCPBUGS-128829: Handle k8s-tests-ext IP family probe failures [#2806](https://github.com/openshift/kubernetes/pull/2806)
* [OCPBUGS-130922](https://issues.redhat.com/browse/OCPBUGS-130922): UPSTREAM: <carry>: Fix vSphere topology test exclusions [#2816](https://github.com/openshift/kubernetes/pull/2816)
* [STOR-3083](https://issues.redhat.com/browse/STOR-3083): Fix disabled tests for newer test names [#2822](https://github.com/openshift/kubernetes/pull/2822)
* [OCPBUGS-112749](https://issues.redhat.com/browse/OCPBUGS-112749): Deflake pod resize deferred tests [#2765](https://github.com/openshift/kubernetes/pull/2765)
* [OCPBUGS-129642](https://issues.redhat.com/browse/OCPBUGS-129642): UPSTREAM: <carry>: bump cadvisor for statseq fix [#2819](https://github.com/openshift/kubernetes/pull/2819)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Daemonset test has changed names -> needs corrected env selector [#2813](https://github.com/openshift/kubernetes/pull/2813)
* : OCPBUGS-123651: UPSTREAM: <carry>: Add needed labels to RHEL pause image [#2809](https://github.com/openshift/kubernetes/pull/2809)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Rebase 1.37 [#2738](https://github.com/openshift/kubernetes/pull/2738)
* [OCPBUGS-127540](https://issues.redhat.com/browse/OCPBUGS-127540): UPSTREAM: 142168: Refuse UNC symlink targets in Windows subPath resolution [#2793](https://github.com/openshift/kubernetes/pull/2793)
* NOJIRA: add explicit merge commit message [#2788](https://github.com/openshift/kubernetes/pull/2788)
* [OCPBUGS-123651](https://issues.redhat.com/browse/OCPBUGS-123651): UPSTREAM: <carry>: Use FROM scratch for RHEL pause image [#2774](https://github.com/openshift/kubernetes/pull/2774)
* NO-JIRA: Rebase master to Kubernetes v1.36.4 [#2777](https://github.com/openshift/kubernetes/pull/2777)
* NO-JIRA: Skip SELinuxMountReadWriteOncePodOnly tests now that SELinuxMount is GA [#2782](https://github.com/openshift/kubernetes/pull/2782)
* [OCPBUGS-104846](https://issues.redhat.com/browse/OCPBUGS-104846): UPSTREAM: 141358: Enable group snapshot tests in all configurations [#2747](https://github.com/openshift/kubernetes/pull/2747)
* NO-JIRA: Make graceful-termination-duration flag required for the watch-termination command [#2761](https://github.com/openshift/kubernetes/pull/2761)
* [Full changelog](https://github.com/openshift/kubernetes/compare/306002d4cb7d5621b4b9d1871d1d029682f8f824...92e1a4b8eea32cd95383e29e7cfafc8d562917e4)
### [hypershift](https://github.com/openshift/hypershift/tree/253c3f5c790d08668d4aa365688e88a0ab950af8)
* [AUTOSCALE-1057](https://issues.redhat.com/browse/AUTOSCALE-1057): rename standalone karpenter-operator deployment env var [#9954](https://github.com/openshift/hypershift/pull/9954)
* NO-JIRA: Add Dan Mace to core-approvers [#9994](https://github.com/openshift/hypershift/pull/9994)
* [OCPBUGS-126895](https://issues.redhat.com/browse/OCPBUGS-126895): preserve AWS API error details on AWSEndpointService reconcile [#9707](https://github.com/openshift/hypershift/pull/9707)
* [OCPSTRAT-3686](https://issues.redhat.com/browse/OCPSTRAT-3686): Set creationTimestamp in the operator image-references file [#9878](https://github.com/openshift/hypershift/pull/9878)
* [OCPBUGS-129594](https://issues.redhat.com/browse/OCPBUGS-129594): Fix IPv6 endpoint authorities in CPO [#9982](https://github.com/openshift/hypershift/pull/9982)
* [CNTRLPLANE-4711](https://issues.redhat.com/browse/CNTRLPLANE-4711): feat(azure): add opt-in IP forwarding for NodePools [#9966](https://github.com/openshift/hypershift/pull/9966)
* NO-JIRA: test(e2e): refactor Karpenter v2 test helpers and harden upgrade test [#9662](https://github.com/openshift/hypershift/pull/9662)
* [OCPSTRAT-3686](https://issues.redhat.com/browse/OCPSTRAT-3686): Zero pad the commit distance in derived nightly tags [#9980](https://github.com/openshift/hypershift/pull/9980)
* [CNTRLPLANE-4538](https://issues.redhat.com/browse/CNTRLPLANE-4538): correct August report blog attribution [#9931](https://github.com/openshift/hypershift/pull/9931)
* [CNTRLPLANE-4102](https://issues.redhat.com/browse/CNTRLPLANE-4102): chore(contrib): remove aws-leaked-resources [#9963](https://github.com/openshift/hypershift/pull/9963)
* [OCPBUGS-129581](https://issues.redhat.com/browse/OCPBUGS-129581): Preserve supplied Unmanaged etcd credentials [#9941](https://github.com/openshift/hypershift/pull/9941)
* [OCPBUGS-114415](https://issues.redhat.com/browse/OCPBUGS-114415): intermittent timeouts in TestDialDirectWithProxy [#9960](https://github.com/openshift/hypershift/pull/9960)
* [TRT-3008](https://issues.redhat.com/browse/TRT-3008): revert(ingressoperator): restore HAProxy 2.8 wiring [#9976](https://github.com/openshift/hypershift/pull/9976)
* [OCPBUGS-129420](https://issues.redhat.com/browse/OCPBUGS-129420): Propagate configured NodePool labels and taints with native capacity [#9919](https://github.com/openshift/hypershift/pull/9919)
* [OCPBUGS-49661](https://issues.redhat.com/browse/OCPBUGS-49661): fix(cpo): report real ValidAWSKMSConfig condition [#9953](https://github.com/openshift/hypershift/pull/9953)
* [OCPCLOUD-3708](https://issues.redhat.com/browse/OCPCLOUD-3708): feat(machine-approver): plumb TLS curve preferences [#9743](https://github.com/openshift/hypershift/pull/9743)
* [CNTRLPLANE-3646](https://issues.redhat.com/browse/CNTRLPLANE-3646): enable all platform agnostic and specific e2e v2 tests for AWS [#9701](https://github.com/openshift/hypershift/pull/9701)
* [GCP-504](https://issues.redhat.com/browse/GCP-504): NodePool Platform Conditions [#8917](https://github.com/openshift/hypershift/pull/8917)
* [CNTRLPLANE-4575](https://issues.redhat.com/browse/CNTRLPLANE-4575): add DeterministicLBIP feature gate [#9898](https://github.com/openshift/hypershift/pull/9898)
* [NE-2913](https://issues.redhat.com/browse/NE-2913): Remove HAProxy 2.8 reference [#9703](https://github.com/openshift/hypershift/pull/9703)
* [OCPBUGS-129006](https://issues.redhat.com/browse/OCPBUGS-129006): Converge Azure private DNS network links safely [#9896](https://github.com/openshift/hypershift/pull/9896)
* NO-JIRA: ci(deps): bump actions/actions-runner from 2.337.0 to 2.338.0 [#9956](https://github.com/openshift/hypershift/pull/9956)
* NO-JIRA: Require GCP workload identity mutation on 5.1 and later [#9936](https://github.com/openshift/hypershift/pull/9936)
* NO-JIRA: build(deps): bump the azure-github-dependencies group across 1 directory with 3 updates [#9777](https://github.com/openshift/hypershift/pull/9777)
* [OCPBUGS-129491](https://issues.redhat.com/browse/OCPBUGS-129491): ensure e2e v1 AWS OIDC providers are tagged with e2e metadata [#9933](https://github.com/openshift/hypershift/pull/9933)
* NO-JIRA: chore(owners): add CI operator config owners [#9938](https://github.com/openshift/hypershift/pull/9938)
* [CNTRLPLANE-4480](https://issues.redhat.com/browse/CNTRLPLANE-4480): feat(api): promote HCPUserFacingOperatorLogs feature gate to Default [#9724](https://github.com/openshift/hypershift/pull/9724)
* [AUTOSCALE-1008](https://issues.redhat.com/browse/AUTOSCALE-1008): feat(karpenter-operator): monitor operand rollout status for version tracking [#9654](https://github.com/openshift/hypershift/pull/9654)
* [AUTOSCALE-995](https://issues.redhat.com/browse/AUTOSCALE-995): implement cpu options [#9623](https://github.com/openshift/hypershift/pull/9623)
* [CNTRLPLANE-4600](https://issues.redhat.com/browse/CNTRLPLANE-4600): remove all reported deadcode candidates [#9904](https://github.com/openshift/hypershift/pull/9904)
* [CNTRLPLANE-4565](https://issues.redhat.com/browse/CNTRLPLANE-4565): Promote ingress and Azure private OAuth v2 tests to blocking [#9918](https://github.com/openshift/hypershift/pull/9918)
* [AUTOSCALE-947](https://issues.redhat.com/browse/AUTOSCALE-947): fix(karpenter): defer EC2NodeClass reconcile to standalone operator [#9746](https://github.com/openshift/hypershift/pull/9746)
* [OCPBUGS-104597](https://issues.redhat.com/browse/OCPBUGS-104597): fix(etcdbackup): correctly classify Azure client-secret credentials from Velero BSL secrets [#9321](https://github.com/openshift/hypershift/pull/9321)
* [CNTRLPLANE-4565](https://issues.redhat.com/browse/CNTRLPLANE-4565): Remove duplicated v1 AWS E2E checks [#9881](https://github.com/openshift/hypershift/pull/9881)
* [CNTRLPLANE-4337](https://issues.redhat.com/browse/CNTRLPLANE-4337): Extract cluster-foundation ownership with characterization [#9905](https://github.com/openshift/hypershift/pull/9905)
* NO-JIRA: strip DWARF info from linter plugins to fix macOS dyld crash [#9909](https://github.com/openshift/hypershift/pull/9909)
* [OCPBUGS-112277](https://issues.redhat.com/browse/OCPBUGS-112277): Skip PodDisruptionBudgets for SingleReplica control planes [#9394](https://github.com/openshift/hypershift/pull/9394)
* [OCPBUGS-128613](https://issues.redhat.com/browse/OCPBUGS-128613): validate Azure HostedCluster subnet ID [#9825](https://github.com/openshift/hypershift/pull/9825)
* [OCPBUGS-127429](https://issues.redhat.com/browse/OCPBUGS-127429): Enable DeviceTaintRule API for hosted clusters [#9518](https://github.com/openshift/hypershift/pull/9518)
* [CNTRLPLANE-550](https://issues.redhat.com/browse/CNTRLPLANE-550): Refactor HyperShift CLI for cross-platform consistency and testability [#9570](https://github.com/openshift/hypershift/pull/9570)
* [GCP-967](https://issues.redhat.com/browse/GCP-967): Add GCP workload identity webhook support [#9549](https://github.com/openshift/hypershift/pull/9549)
* [CNTRLPLANE-4558](https://issues.redhat.com/browse/CNTRLPLANE-4558): Update Dockerfile and Containerfile images for Kubernetes 1.37 [#9873](https://github.com/openshift/hypershift/pull/9873)
* [OCPBUGS-126889](https://issues.redhat.com/browse/OCPBUGS-126889): preserve wrapped Azure credential reconcile errors [#9704](https://github.com/openshift/hypershift/pull/9704)
* [OCPBUGS-129003](https://issues.redhat.com/browse/OCPBUGS-129003): Refresh performance-profile conditions at the same generation [#9891](https://github.com/openshift/hypershift/pull/9891)
* [MULTIARCH-5567](https://issues.redhat.com/browse/MULTIARCH-5567): Added support to create multi-arch (s390x & x86) NodePools with KubeVirt platform on heterogeneous management clusters [#9586](https://github.com/openshift/hypershift/pull/9586)
* [OCPBUGS-128975](https://issues.redhat.com/browse/OCPBUGS-128975): Count only successful upsert updates [#9872](https://github.com/openshift/hypershift/pull/9872)
* [OCPBUGS-109196](https://issues.redhat.com/browse/OCPBUGS-109196): fix(nodepool): validate KubeVirt additionalNetworks NAD namespace [#9299](https://github.com/openshift/hypershift/pull/9299)
* NO-JIRA: docs: fix stale N-2 version skew references to N-3 [#8999](https://github.com/openshift/hypershift/pull/8999)
* [AUTOSCALE-977](https://issues.redhat.com/browse/AUTOSCALE-977): feat(karpenter): defer default NodeClass to standalone operator [#9695](https://github.com/openshift/hypershift/pull/9695)
* [CNTRLPLANE-4562](https://issues.redhat.com/browse/CNTRLPLANE-4562): add kubeClientQPS and kubeClientBurst to ClusterAutoscaling [#9857](https://github.com/openshift/hypershift/pull/9857)
* [CNTRLPLANE-4548](https://issues.redhat.com/browse/CNTRLPLANE-4548): fix: move combined-pull-secret creation to top-level CPO [#9844](https://github.com/openshift/hypershift/pull/9844)
* [CNTRLPLANE-4553](https://issues.redhat.com/browse/CNTRLPLANE-4553): Remove duplicate release trigger and draft mode [#9880](https://github.com/openshift/hypershift/pull/9880)
* [CNTRLPLANE-4553](https://issues.redhat.com/browse/CNTRLPLANE-4553): Compact yq JSON output for GITHUB_OUTPUT in tag workflow [#9879](https://github.com/openshift/hypershift/pull/9879)
* [CNTRLPLANE-4553](https://issues.redhat.com/browse/CNTRLPLANE-4553): Add workflows permission and manual trigger for tag creation [#9877](https://github.com/openshift/hypershift/pull/9877)
* [CNTRLPLANE-4552](https://issues.redhat.com/browse/CNTRLPLANE-4552): request HO v0.1.86 tag [#9848](https://github.com/openshift/hypershift/pull/9848)
* [CNTRLPLANE-4553](https://issues.redhat.com/browse/CNTRLPLANE-4553): use runner.temp and detect arch for release workflow tool installs [#9851](https://github.com/openshift/hypershift/pull/9851)
* [CNTRLPLANE-4335](https://issues.redhat.com/browse/CNTRLPLANE-4335): Extract RBAC reconciliation into dedicated module [#9726](https://github.com/openshift/hypershift/pull/9726)
* [CNTRLPLANE-3890](https://issues.redhat.com/browse/CNTRLPLANE-3890): Add product-cli unit tests for HCP create cluster [#9591](https://github.com/openshift/hypershift/pull/9591)
* [CNTRLPLANE-4550](https://issues.redhat.com/browse/CNTRLPLANE-4550): improve HO hotfix documentation and fix template [#9845](https://github.com/openshift/hypershift/pull/9845)
* [OCPSTRAT-3686](https://issues.redhat.com/browse/OCPSTRAT-3686): Emit release-manifests/image-references from the operator build [#9854](https://github.com/openshift/hypershift/pull/9854)
* [CNTRLPLANE-4556](https://issues.redhat.com/browse/CNTRLPLANE-4556): Bump Kubernetes dependencies to 1.37 [#9568](https://github.com/openshift/hypershift/pull/9568)
* [OCPBUGS-77307](https://issues.redhat.com/browse/OCPBUGS-77307): Generate KubeVirt nmstate network config conditionally [#9381](https://github.com/openshift/hypershift/pull/9381)
* [CNTRLPLANE-4553](https://issues.redhat.com/browse/CNTRLPLANE-4553): install release workflow binaries to user-writable path [#9849](https://github.com/openshift/hypershift/pull/9849)
* [CNTRLPLANE-4465](https://issues.redhat.com/browse/CNTRLPLANE-4465): group MintMaker Go dependency updates by module [#9715](https://github.com/openshift/hypershift/pull/9715)
* [CNTRLPLANE-4379](https://issues.redhat.com/browse/CNTRLPLANE-4379): add release automation workflows for PR-based tagging [#9566](https://github.com/openshift/hypershift/pull/9566)
* [CNTRLPLANE-3341](https://issues.redhat.com/browse/CNTRLPLANE-3341): Extract support/imageregistry package from support/util [#9832](https://github.com/openshift/hypershift/pull/9832)
* [CNTRLPLANE-3901](https://issues.redhat.com/browse/CNTRLPLANE-3901): Add product-cli unit tests for IAM-Infra (Azure) [#9180](https://github.com/openshift/hypershift/pull/9180)
* [CCO-848](https://issues.redhat.com/browse/CCO-848): feat(cloud_credential_operator): inject centralized TLS configuration [#9409](https://github.com/openshift/hypershift/pull/9409)
* [OCPBUGS-109641](https://issues.redhat.com/browse/OCPBUGS-109641): fix slice bounds out of range panic in getAvailableCandidates [#9309](https://github.com/openshift/hypershift/pull/9309)
* [CNTRLPLANE-4090](https://issues.redhat.com/browse/CNTRLPLANE-4090): deduplicate internal constants by migrating consumers to shared packages [#9804](https://github.com/openshift/hypershift/pull/9804)
* [ACM-38185](https://issues.redhat.com/browse/ACM-38185): chore(owners): add ACM HyperShift owners for product-cli [#9082](https://github.com/openshift/hypershift/pull/9082)
* [CNTRLPLANE-4538](https://issues.redhat.com/browse/CNTRLPLANE-4538): add August 2026 progress report [#9839](https://github.com/openshift/hypershift/pull/9839)
* NO-JIRA: nodepool: log when user-data/token Secrets are deleted [#9819](https://github.com/openshift/hypershift/pull/9819)
* [OCPSTRAT-3686](https://issues.redhat.com/browse/OCPSTRAT-3686): Use git tag for hypershift nightly tag pipeline [#9826](https://github.com/openshift/hypershift/pull/9826)
* NO-JIRA: chore(deps): refresh rpm lockfiles (main) [SECURITY] [#9667](https://github.com/openshift/hypershift/pull/9667)
* [OCPBUGS-127651](https://issues.redhat.com/browse/OCPBUGS-127651): fix(operator): prevent deadlock when CRD conversion webhook caBundle is missing [#9782](https://github.com/openshift/hypershift/pull/9782)
* NO-JIRA: Remove Claude-powered PR comment workflows [#9830](https://github.com/openshift/hypershift/pull/9830)
* [OCPBUGS-99659](https://issues.redhat.com/browse/OCPBUGS-99659): reconcile NetworkPolicies for KubeVirt HCP router mode [#9619](https://github.com/openshift/hypershift/pull/9619)
* [CNTRLPLANE-3902](https://issues.redhat.com/browse/CNTRLPLANE-3902): Add product-cli unit tests for kubeconfig [#9217](https://github.com/openshift/hypershift/pull/9217)
* [GCP-1148](https://issues.redhat.com/browse/GCP-1148): Make zone required for cluster and nodepool creation [#9708](https://github.com/openshift/hypershift/pull/9708)
* [CNTRLPLANE-3900](https://issues.redhat.com/browse/CNTRLPLANE-3900): Add shared cmd/ unit tests for destroy cluster [#9166](https://github.com/openshift/hypershift/pull/9166)
* [CNTRLPLANE-1053](https://issues.redhat.com/browse/CNTRLPLANE-1053): Validate KAS reachability via SVC URL in KubeAPIDNSName e2e test [#9355](https://github.com/openshift/hypershift/pull/9355)
* NO-JIRA: build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 [#9776](https://github.com/openshift/hypershift/pull/9776)
* [CNTRLPLANE-3344](https://issues.redhat.com/browse/CNTRLPLANE-3344): Extract support/reconcilerpolicy package from support/util [#9734](https://github.com/openshift/hypershift/pull/9734)
* [OCPBUGS-98099](https://issues.redhat.com/browse/OCPBUGS-98099): test(e2e): isolate legacy Karpenter upgrade workload [#9806](https://github.com/openshift/hypershift/pull/9806)
* [CNTRLPLANE-4497](https://issues.redhat.com/browse/CNTRLPLANE-4497): add azure-orphaned-role-assignments tool [#9745](https://github.com/openshift/hypershift/pull/9745)
* [OCPBUGS-128500](https://issues.redhat.com/browse/OCPBUGS-128500): Gate custom ingress strategy E2E coverage to 4.21+ [#9814](https://github.com/openshift/hypershift/pull/9814)
* [OCPSTRAT-3686](https://issues.redhat.com/browse/OCPSTRAT-3686): import nightly release tags [#9809](https://github.com/openshift/hypershift/pull/9809)
* [OCPBUGS-114937](https://issues.redhat.com/browse/OCPBUGS-114937): Add readiness probe to kube-scheduler control plane deployment [#9789](https://github.com/openshift/hypershift/pull/9789)
* [OCPBUGS-128466](https://issues.redhat.com/browse/OCPBUGS-128466): reconcile aggregated docs [#9808](https://github.com/openshift/hypershift/pull/9808)
* NO-JIRA: chore(owners): refresh owner aliases [#9805](https://github.com/openshift/hypershift/pull/9805)
* [ROSAENG-65607](https://issues.redhat.com/browse/ROSAENG-65607): Adjust regex validation to allow sqs-fips url format (for FEDRAMP support) [#9737](https://github.com/openshift/hypershift/pull/9737)
* NO-JIRA: add serena/headroom files/folders to gitignore [#9802](https://github.com/openshift/hypershift/pull/9802)
* [OCPBUGS-126613](https://issues.redhat.com/browse/OCPBUGS-126613): fix(api): add missing + prefix to kubebuilder annotation on networkType [#9646](https://github.com/openshift/hypershift/pull/9646)
* [CNTRLPLANE-3632](https://issues.redhat.com/browse/CNTRLPLANE-3632): Revert #8698: NodePool rollout control [#9797](https://github.com/openshift/hypershift/pull/9797)
* [OCPBUGS-127049](https://issues.redhat.com/browse/OCPBUGS-127049): fix(globalps): schedule global-pull-secret-syncer on karpenter nodes [#9719](https://github.com/openshift/hypershift/pull/9719)
* [CNTRLPLANE-4508](https://issues.redhat.com/browse/CNTRLPLANE-4508): fix(e2e): detect installer flags supported by target image [#9792](https://github.com/openshift/hypershift/pull/9792)
* NO-JIRA: build(deps): bump compatible sigs-k8s dependencies [#9778](https://github.com/openshift/hypershift/pull/9778)
* [OCPBUGS-114936](https://issues.redhat.com/browse/OCPBUGS-114936): add PodDisruptionBudget for the HyperShift Operator [#9526](https://github.com/openshift/hypershift/pull/9526)
* [OCPBUGS-115085](https://issues.redhat.com/browse/OCPBUGS-115085): fix: mount combined-pull-secret in OpenShift API Server [#9617](https://github.com/openshift/hypershift/pull/9617)
* [OCPBUGS-109640](https://issues.redhat.com/browse/OCPBUGS-109640): fix(cmd/dump): filter resources by cluster platform [#9639](https://github.com/openshift/hypershift/pull/9639)
* NO-JIRA: fix(nodepool) data race in TestReconcileSelectorDropsStaleLabels [#9772](https://github.com/openshift/hypershift/pull/9772)
* [OCPBUGS-88757](https://issues.redhat.com/browse/OCPBUGS-88757): Align HCCO CatalogSource registryPoll interval with OCP defaults [#8745](https://github.com/openshift/hypershift/pull/8745)
* [CNTRLPLANE-4460](https://issues.redhat.com/browse/CNTRLPLANE-4460): refactor(test): chain BeforeApply handlers instead of overwriting [#9709](https://github.com/openshift/hypershift/pull/9709)
* NO-JIRA: ci(deps): bump codecov/codecov-action from 7.0.0 to 7.1.0 [#9681](https://github.com/openshift/hypershift/pull/9681)
* NO-JIRA: ci(deps): bump actions/cache from 4.2.3 to 6.1.0 [#9338](https://github.com/openshift/hypershift/pull/9338)
* [OCPSTRAT-3686](https://issues.redhat.com/browse/OCPSTRAT-3686): Update default ociStorage repository [#9770](https://github.com/openshift/hypershift/pull/9770)
* [OCPBUGS-127110](https://issues.redhat.com/browse/OCPBUGS-127110): Install HO via Job from operator image in e2e upgrade tests [#9736](https://github.com/openshift/hypershift/pull/9736)
* [OCPBUGS-127070](https://issues.redhat.com/browse/OCPBUGS-127070): Align .ci-operator.yaml build root tag with Dockerfiles [#9723](https://github.com/openshift/hypershift/pull/9723)
* [CNTRLPLANE-4374](https://issues.redhat.com/browse/CNTRLPLANE-4374): bug - gate platform CAPI types behind CRD discovery to fix bulk inspect on limited-CRD clusters [#9552](https://github.com/openshift/hypershift/pull/9552)
* [OCPBUGS-98066](https://issues.redhat.com/browse/OCPBUGS-98066): fix(nodepool): rebuild CAPI selectors deterministically on reconcile [#9698](https://github.com/openshift/hypershift/pull/9698)
* [CNTRLPLANE-3632](https://issues.redhat.com/browse/CNTRLPLANE-3632): Predictable NodePool rollout control [#8698](https://github.com/openshift/hypershift/pull/8698)
* [CNTRLPLANE-4090](https://issues.redhat.com/browse/CNTRLPLANE-4090): Move HostedControlPlaneNamespace to shared package [#9551](https://github.com/openshift/hypershift/pull/9551)
* [SPLAT-2742](https://issues.redhat.com/browse/SPLAT-2742): remove inlined SetSecurityGroups IAM permission [#9717](https://github.com/openshift/hypershift/pull/9717)
* [CNTRLPLANE-4213](https://issues.redhat.com/browse/CNTRLPLANE-4213): decouple konflux pr pipelines [#9413](https://github.com/openshift/hypershift/pull/9413)
* NO-JIRA: test(e2e): check OS streams for OpenShift 5.0 nightlies [#9712](https://github.com/openshift/hypershift/pull/9712)
* [CNTRLPLANE-3755](https://issues.redhat.com/browse/CNTRLPLANE-3755): fix(e2e): gate release-specific fields for version compatibility [#9564](https://github.com/openshift/hypershift/pull/9564)
* [CNTRLPLANE-2775](https://issues.redhat.com/browse/CNTRLPLANE-2775): Expose KAS availability and latency metrics from CPO [#9244](https://github.com/openshift/hypershift/pull/9244)
* [CNTRLPLANE-4092](https://issues.redhat.com/browse/CNTRLPLANE-4092): Move dump.go to its own package to break transitive dependency on sharedingress [#9727](https://github.com/openshift/hypershift/pull/9727)
* [OCPBUGS-125907](https://issues.redhat.com/browse/OCPBUGS-125907): fix(aws): use unique Route 53 caller references [#9647](https://github.com/openshift/hypershift/pull/9647)
* [OCPBUGS-114723](https://issues.redhat.com/browse/OCPBUGS-114723): Decouple user CA bundle reconciliation from resources controller [#9458](https://github.com/openshift/hypershift/pull/9458)
* NO-JIRA: chore(owners): add daniel-rejniak to gcp-reviewers [#9700](https://github.com/openshift/hypershift/pull/9700)
* [CNTRLPLANE-4304](https://issues.redhat.com/browse/CNTRLPLANE-4304): fix(ci): validate pending commit messages with gitlint [#9710](https://github.com/openshift/hypershift/pull/9710)
* [CNTRLPLANE-4395](https://issues.redhat.com/browse/CNTRLPLANE-4395): Make git commit format skill model and harness agnostic [#9625](https://github.com/openshift/hypershift/pull/9625)
* [OCPBUGS-123791](https://issues.redhat.com/browse/OCPBUGS-123791): CAPI storage version migration exclude IPAM [#9642](https://github.com/openshift/hypershift/pull/9642)
* [CNTRLPLANE-4365](https://issues.redhat.com/browse/CNTRLPLANE-4365): Publish hosted control plane sizing guidance [#9532](https://github.com/openshift/hypershift/pull/9532)
* [AUTOSCALE-873](https://issues.redhat.com/browse/AUTOSCALE-873): Add sidecar to standalone karpenter-operator [#9565](https://github.com/openshift/hypershift/pull/9565)
* [CNTRLPLANE-4090](https://issues.redhat.com/browse/CNTRLPLANE-4090): Move CPO, HCCO and etcd recovery manifest constructors to shared packages [#9592](https://github.com/openshift/hypershift/pull/9592)
* [OCPBUGS-113995](https://issues.redhat.com/browse/OCPBUGS-113995): classify WebIdentityErr by cause to prevent false invalid creds [#9406](https://github.com/openshift/hypershift/pull/9406)
* [OCPBUGS-115468](https://issues.redhat.com/browse/OCPBUGS-115468): fix NodePool: truncate oversized machine messages instead of dropping them [#9567](https://github.com/openshift/hypershift/pull/9567)
* feat(kubevirt): OCPBUGS-55974: add CPU model configuration for NodePool VMs [#7431](https://github.com/openshift/hypershift/pull/7431)
* [CNTRLPLANE-4209](https://issues.redhat.com/browse/CNTRLPLANE-4209): Consolidate Azure lifecycle test lanes [#9572](https://github.com/openshift/hypershift/pull/9572)
* [GCP-510](https://issues.redhat.com/browse/GCP-510): Implement GCP NodePool CLI Commands [#9466](https://github.com/openshift/hypershift/pull/9466)
* [OCPBUGS-84562](https://issues.redhat.com/browse/OCPBUGS-84562): Configure AWS CCM region directly [#9602](https://github.com/openshift/hypershift/pull/9602)
* NO-JIRA: ci(deps): bump astral-sh/setup-uv from 6.1.0 to 10.1.0 [#9682](https://github.com/openshift/hypershift/pull/9682)
* NO-JIRA: chore(owners): add core approvers [#9651](https://github.com/openshift/hypershift/pull/9651)
* [CNTRLPLANE-4090](https://issues.redhat.com/browse/CNTRLPLANE-4090): Move metric name constants to shared packages [#9540](https://github.com/openshift/hypershift/pull/9540)
* [OCPBUGS-125803](https://issues.redhat.com/browse/OCPBUGS-125803): skip TLS flag propagation tests for older operator versions [#9641](https://github.com/openshift/hypershift/pull/9641)
* [CNTRLPLANE-4453](https://issues.redhat.com/browse/CNTRLPLANE-4453): clarify private Key Vault validation comments [#9645](https://github.com/openshift/hypershift/pull/9645)
* [CNTRLPLANE-4209](https://issues.redhat.com/browse/CNTRLPLANE-4209): Update Azure lifecycle test-flow documentation [#9573](https://github.com/openshift/hypershift/pull/9573)
* [CNTRLPLANE-4456](https://issues.redhat.com/browse/CNTRLPLANE-4456): Run envtests for release-5.0 [#9649](https://github.com/openshift/hypershift/pull/9649)
* [AUTOSCALE-974](https://issues.redhat.com/browse/AUTOSCALE-974), [AUTOSCALE-980](https://issues.redhat.com/browse/AUTOSCALE-980): allow Karpenter to be deployed on Azure [#9545](https://github.com/openshift/hypershift/pull/9545)
* [OCPBUGS-123512](https://issues.redhat.com/browse/OCPBUGS-123512): fix(e2e): derive node runtimes from upgraded NodePool state [#9611](https://github.com/openshift/hypershift/pull/9611)
* [OCPBUGS-122236](https://issues.redhat.com/browse/OCPBUGS-122236): stabilize JUnit test identities [#9580](https://github.com/openshift/hypershift/pull/9580)
* chore(renovate): enable supported release branches [#9631](https://github.com/openshift/hypershift/pull/9631)
* [CNTRLPLANE-4209](https://issues.redhat.com/browse/CNTRLPLANE-4209): Reject shared variants in concurrent e2e lanes [#9571](https://github.com/openshift/hypershift/pull/9571)
* [OCPBUGS-109672](https://issues.redhat.com/browse/OCPBUGS-109672): fix(cpo) wait for etcd health, not just DNS [#9460](https://github.com/openshift/hypershift/pull/9460)
* [OCPBUGS-123645](https://issues.redhat.com/browse/OCPBUGS-123645): add missing Azure v2 matrix coverage [#9616](https://github.com/openshift/hypershift/pull/9616)
* NO-JIRA: fix(e2e): restore Eventually retry for post-upgrade health condition check [#9632](https://github.com/openshift/hypershift/pull/9632)
* [OCPBUGS-89689](https://issues.redhat.com/browse/OCPBUGS-89689): karpenter control plane upgrade premature drift fix [#9234](https://github.com/openshift/hypershift/pull/9234)
* [CNTRLPLANE-3880](https://issues.redhat.com/browse/CNTRLPLANE-3880): Add E2E test for etcd snapshot restore to prevent split brain regression [#9356](https://github.com/openshift/hypershift/pull/9356)
* NO-JIRA: Bump envtest workflow timeout to 20 minutes [#9630](https://github.com/openshift/hypershift/pull/9630)
* [CNTRLPLANE-4090](https://issues.redhat.com/browse/CNTRLPLANE-4090): Move labels, taints, scheduler, VAP and misc constants to shared packages [#9544](https://github.com/openshift/hypershift/pull/9544)
* NO-JIRA: Fix CONTRIBUTING.md link path and remove trailing blank lines [#9621](https://github.com/openshift/hypershift/pull/9621)
* [OCPBUGS-122011](https://issues.redhat.com/browse/OCPBUGS-122011): fix(e2e): Make `InstallHyperShiftOperator` platform aware [#9555](https://github.com/openshift/hypershift/pull/9555)
* [CNTRLPLANE-3532](https://issues.redhat.com/browse/CNTRLPLANE-3532): Enable HC and HCP status-write linting [#9563](https://github.com/openshift/hypershift/pull/9563)
* [CNTRLPLANE-3608](https://issues.redhat.com/browse/CNTRLPLANE-3608): Add nested virtualization support for AWS EC2 NodePools [#8681](https://github.com/openshift/hypershift/pull/8681)
* [GCP-1122](https://issues.redhat.com/browse/GCP-1122): chore: add pvasant to gcp-reviewers alias [#9465](https://github.com/openshift/hypershift/pull/9465)
* [CNTRLPLANE-4393](https://issues.redhat.com/browse/CNTRLPLANE-4393): document CAPI provider image override mechanisms [#9482](https://github.com/openshift/hypershift/pull/9482)
* [CNTRLPLANE-3277](https://issues.redhat.com/browse/CNTRLPLANE-3277): Add Azure OAuth LoadBalancer private topology e2e test [#8584](https://github.com/openshift/hypershift/pull/8584)
* [OCPBUGS-122232](https://issues.redhat.com/browse/OCPBUGS-122232): Gate CAPI API version by management release [#9587](https://github.com/openshift/hypershift/pull/9587)
* [CNTRLPLANE-4093](https://issues.redhat.com/browse/CNTRLPLANE-4093): Move shared label constants to api/hypershift/v1beta1 [#9415](https://github.com/openshift/hypershift/pull/9415)
* [CNTRLPLANE-4207](https://issues.redhat.com/browse/CNTRLPLANE-4207): document Azure lifecycle test sharding [#9504](https://github.com/openshift/hypershift/pull/9504)
* [GCP-958](https://issues.redhat.com/browse/GCP-958): test(e2e/v2): register gcp-pd-csi-driver control plane workloads [#9589](https://github.com/openshift/hypershift/pull/9589)
* [OCPBUGS-97942](https://issues.redhat.com/browse/OCPBUGS-97942): fix(cli): add --service-publishing-strategy flag to hcp create cluster agent [#8985](https://github.com/openshift/hypershift/pull/8985)
* NO-JIRA: build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 [#9546](https://github.com/openshift/hypershift/pull/9546)
* [CNTRLPLANE-4094](https://issues.redhat.com/browse/CNTRLPLANE-4094): Move ExternalDNSLBPort and KASRouteHostname to support/netutil [#9414](https://github.com/openshift/hypershift/pull/9414)
* NO-JIRA: fix(ci): use --target for pip install on ARC runner [#9531](https://github.com/openshift/hypershift/pull/9531)
* [CNTRLPLANE-4150](https://issues.redhat.com/browse/CNTRLPLANE-4150): feat: Maintain ingress serving cert for HostedCluster ingress [#9132](https://github.com/openshift/hypershift/pull/9132)
* [CNTRLPLANE-4207](https://issues.redhat.com/browse/CNTRLPLANE-4207): update v2 test flow documentation [#9569](https://github.com/openshift/hypershift/pull/9569)
* [CNTRLPLANE-4369](https://issues.redhat.com/browse/CNTRLPLANE-4369): add prow job id tag to e2e v2 aws resources [#9542](https://github.com/openshift/hypershift/pull/9542)
* NO-JIRA: fix(managed-azure): continue resource group cleanup when HC destroy fails [#9404](https://github.com/openshift/hypershift/pull/9404)
* [ACM-41684](https://issues.redhat.com/browse/ACM-41684): Switch hypershift-operator runtime to PQC base image [#9453](https://github.com/openshift/hypershift/pull/9453)
* NO-JIRA: fix(install): increase WaitUntilAvailable timeout from 5m to 10m [#9306](https://github.com/openshift/hypershift/pull/9306)
* [OCPBUGS-87991](https://issues.redhat.com/browse/OCPBUGS-87991): validate additionalNetworks name format in KubeVirt NodePools [#8710](https://github.com/openshift/hypershift/pull/8710)
* NO-JIRA: feat(azure): Add scripts to setup credentials and check resources [#9446](https://github.com/openshift/hypershift/pull/9446)
* [CNTRLPLANE-4005](https://issues.redhat.com/browse/CNTRLPLANE-4005): Skip CDI importer pods from custom labels and tolerations checks [#9240](https://github.com/openshift/hypershift/pull/9240)
* [OCPBUGS-109724](https://issues.redhat.com/browse/OCPBUGS-109724): fix KubeVirt custom baseDomain ingress documentation [#9318](https://github.com/openshift/hypershift/pull/9318)
* NO-JIRA: spread AKS nodes across availability zones [#9449](https://github.com/openshift/hypershift/pull/9449)
* [CNTRLPLANE-4370](https://issues.redhat.com/browse/CNTRLPLANE-4370): Revert "Merge pull request #9543 from ironcladlou/e2e-promotion" [#9574](https://github.com/openshift/hypershift/pull/9574)
* [OCPBUGS-114415](https://issues.redhat.com/browse/OCPBUGS-114415): Increase relay timeouts to prevent intermittent test failures [#9459](https://github.com/openshift/hypershift/pull/9459)
* NO-JIRA: Gate GCP credential validation by control plane version [#9562](https://github.com/openshift/hypershift/pull/9562)
* [OCPBUGS-120840](https://issues.redhat.com/browse/OCPBUGS-120840): remove TechPreviewNoUpgrade from AWS cluster creation args [#9535](https://github.com/openshift/hypershift/pull/9535)
* [OCPBUGS-121208](https://issues.redhat.com/browse/OCPBUGS-121208): filter AWS-reserved tag keys before calling DeleteTags [#9538](https://github.com/openshift/hypershift/pull/9538)
* [GCP-883](https://issues.redhat.com/browse/GCP-883): Optimize GCP PSC NAT allocation [#9472](https://github.com/openshift/hypershift/pull/9472)
* [CNTRLPLANE-3603](https://issues.redhat.com/browse/CNTRLPLANE-3603): Migrate clients from CAPI v1beta1 to v1beta2 [#8717](https://github.com/openshift/hypershift/pull/8717)
* NO-JIRA: remove duplicate e2e v2 test flow doc [#9553](https://github.com/openshift/hypershift/pull/9553)
* [CNTRLPLANE-4370](https://issues.redhat.com/browse/CNTRLPLANE-4370): enforce explicit blocking/informing labels on all v2 e2e tests [#9543](https://github.com/openshift/hypershift/pull/9543)
* NO-JIRA: ci(deps): bump actions/actions-runner from 2.336.0 to 2.337.0- #9513 [#9513](https://github.com/openshift/hypershift/pull/9513)
* [CNTRLPLANE-3998](https://issues.redhat.com/browse/CNTRLPLANE-3998): warn when deprecated kube-apiserver verbosity annotation is set [#9461](https://github.com/openshift/hypershift/pull/9461)
* [CNTRLPLANE-3532](https://issues.redhat.com/browse/CNTRLPLANE-3532): migrate HCCO/route status patches to statuspatching [#9385](https://github.com/openshift/hypershift/pull/9385)
* [OCPBUGS-99534](https://issues.redhat.com/browse/OCPBUGS-99534): etcd initialization bugs after etcdctl snapshot restore [#9048](https://github.com/openshift/hypershift/pull/9048)
* [CNTRLPLANE-3646](https://issues.redhat.com/browse/CNTRLPLANE-3646): increase e2e v2 control plane upgrade coverage for v1 parity [#9491](https://github.com/openshift/hypershift/pull/9491)
* [OCPBUGS-120685](https://issues.redhat.com/browse/OCPBUGS-120685): fix(e2e): select a live NodePool for osImageStream node OS verification [#9506](https://github.com/openshift/hypershift/pull/9506)
* [ROSAENG-63186](https://issues.redhat.com/browse/ROSAENG-63186): fix(hcco): Add VAP to protect kas-bootstrap RBAC bindings from deletion [#9203](https://github.com/openshift/hypershift/pull/9203)
* NO-JIRA: remove unsafe v1 framework usage from karpenter upgrade test [#9522](https://github.com/openshift/hypershift/pull/9522)
* [CNTRLPLANE-2007](https://issues.redhat.com/browse/CNTRLPLANE-2007): KubeVirt default ingress passthrough with HostNetwork endpoint publishing strategy [#9514](https://github.com/openshift/hypershift/pull/9514)
* [CNTRLPLANE-4207](https://issues.redhat.com/browse/CNTRLPLANE-4207): Balance Azure v2 lifecycle test shards [#9419](https://github.com/openshift/hypershift/pull/9419)
* [CNTRLPLANE-3532](https://issues.redhat.com/browse/CNTRLPLANE-3532): add hcpstatuspatch linter and status-patching AGENTS.md guidance [#9388](https://github.com/openshift/hypershift/pull/9388)
* [OCPBUGS-114459](https://issues.redhat.com/browse/OCPBUGS-114459): recognize domain-specific test fields [#9454](https://github.com/openshift/hypershift/pull/9454)
* [GCP-503](https://issues.redhat.com/browse/GCP-503): feat(gcp): Implement OrphanDeleter [#8884](https://github.com/openshift/hypershift/pull/8884)
* [OCPBUGS-115269](https://issues.redhat.com/browse/OCPBUGS-115269): openstack: Start populating cacert in clouds.yaml [#9467](https://github.com/openshift/hypershift/pull/9467)
* [CNTRLPLANE-3951](https://issues.redhat.com/browse/CNTRLPLANE-3951): fix(e2e): accept node deletion as success in TestSpotTerminationHandler [#9428](https://github.com/openshift/hypershift/pull/9428)
* [OCPBUGS-74960](https://issues.redhat.com/browse/OCPBUGS-74960): fix orphaned security group during VPC endpoint deletion [#9517](https://github.com/openshift/hypershift/pull/9517)
* NO-JIRA: test(backuprestore): enable SnapshotMoveData in backup configurations [#9429](https://github.com/openshift/hypershift/pull/9429)
* [GCP-958](https://issues.redhat.com/browse/GCP-958): feat(gcp): complete GCP PD CSI driver wiring in HyperShift [#9450](https://github.com/openshift/hypershift/pull/9450)
* [RHOBS-1707](https://issues.redhat.com/browse/RHOBS-1707): Add OpenTelemetry SDK tracing to hypershift-operator [#9390](https://github.com/openshift/hypershift/pull/9390)
* [OCPBUGS-105464](https://issues.redhat.com/browse/OCPBUGS-105464): fix(nodepool): inject default worker SG by status ID, not fail-open capability flag [#9456](https://github.com/openshift/hypershift/pull/9456)
* [OCPBUGS-84368](https://issues.redhat.com/browse/OCPBUGS-84368): add safe-to-evict annotation and remove tolerations to fix autoscaler scale-down and drain loop [#8338](https://github.com/openshift/hypershift/pull/8338)
* [AUTOSCALE-998](https://issues.redhat.com/browse/AUTOSCALE-998): inject token-minter image to standalone karpenter-operator [#9492](https://github.com/openshift/hypershift/pull/9492)
* [OCPBUGS-120685](https://issues.redhat.com/browse/OCPBUGS-120685): fix(e2e): label flaking nodepool osImageStream test informing [#9505](https://github.com/openshift/hypershift/pull/9505)
* NO-JIRA: feat(chaibot): add per-platform Slack handle pings to CI health report [#9478](https://github.com/openshift/hypershift/pull/9478)
* build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /hack/tools [#9479](https://github.com/openshift/hypershift/pull/9479)
* build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 [#9480](https://github.com/openshift/hypershift/pull/9480)
* [OCPBUGS-114408](https://issues.redhat.com/browse/OCPBUGS-114408): fix(api): allow spaces in AWS resource tag keys and values [#9425](https://github.com/openshift/hypershift/pull/9425)
* [GCP-1113](https://issues.redhat.com/browse/GCP-1113): retry transient network errors in hypershift create iam gcp [#9436](https://github.com/openshift/hypershift/pull/9436)
* [OCPBUGS-115542](https://issues.redhat.com/browse/OCPBUGS-115542): fix(e2e): poll for etcd-init completion before reading restore logs [#9481](https://github.com/openshift/hypershift/pull/9481)
* [OCPBUGS-114368](https://issues.redhat.com/browse/OCPBUGS-114368): Retry Microsoft Graph transport failures [#9421](https://github.com/openshift/hypershift/pull/9421)
* [OCPBUGS-86690](https://issues.redhat.com/browse/OCPBUGS-86690): fix Azure cluster deletion hanging when resource groups are already deleted [#8682](https://github.com/openshift/hypershift/pull/8682)
* [CNTRLPLANE-4041](https://issues.redhat.com/browse/CNTRLPLANE-4041): add new release branches to renovate config [#9470](https://github.com/openshift/hypershift/pull/9470)
* [OCPBUGS-77781](https://issues.redhat.com/browse/OCPBUGS-77781): fix(certs): normalize IP SANs to stop dual-stack KAS cert churn [#9286](https://github.com/openshift/hypershift/pull/9286)
* [CNTRLPLANE-4205](https://issues.redhat.com/browse/CNTRLPLANE-4205): document OSImageStream behaviour deviations [#9486](https://github.com/openshift/hypershift/pull/9486)
* [CNTRLPLANE-3755](https://issues.redhat.com/browse/CNTRLPLANE-3755): fix(e2e): add version gating to EnsureCAPIFinalizers tests [#9443](https://github.com/openshift/hypershift/pull/9443)
* [CNTRLPLANE-3646](https://issues.redhat.com/browse/CNTRLPLANE-3646): enable e2e v2 aws control plane upgrade tests [#9474](https://github.com/openshift/hypershift/pull/9474)
* [OCPBUGS-115403](https://issues.redhat.com/browse/OCPBUGS-115403): ensure informing junit files are unique across test groups [#9473](https://github.com/openshift/hypershift/pull/9473)
* [ACM-41685](https://issues.redhat.com/browse/ACM-41685): Enable PQC crypto policy in hypershift-cli image [#9463](https://github.com/openshift/hypershift/pull/9463)
* [OCPBUGS-113712](https://issues.redhat.com/browse/OCPBUGS-113712): preserve immutable AWS load balancer annotations [#9469](https://github.com/openshift/hypershift/pull/9469)
* NO-JIRA: chore(konflux): update Tekton task bundles to latest versions [#9483](https://github.com/openshift/hypershift/pull/9483)
* [CNTRLPLANE-4204](https://issues.redhat.com/browse/CNTRLPLANE-4204): reorganize OSImageStream e2e tests after graduation [#9418](https://github.com/openshift/hypershift/pull/9418)
* [CNTRLPLANE-3201](https://issues.redhat.com/browse/CNTRLPLANE-3201): feat(e2e): enable etcd snapshot backup test on Azure [#9226](https://github.com/openshift/hypershift/pull/9226)
* [CNTRLPLANE-2029](https://issues.redhat.com/browse/CNTRLPLANE-2029): docs(backuprestore): add Agent and KubeVirt platform prerequisites [#9072](https://github.com/openshift/hypershift/pull/9072)
* [CNTRLPLANE-3950](https://issues.redhat.com/browse/CNTRLPLANE-3950): fix flaky TestKMSRootVolumeEncryption race condition. [#9304](https://github.com/openshift/hypershift/pull/9304)
* [CNTRLPLANE-4208](https://issues.redhat.com/browse/CNTRLPLANE-4208): Right-size Azure v2 e2e worker counts [#9426](https://github.com/openshift/hypershift/pull/9426)
* [CNTRLPLANE-3646](https://issues.redhat.com/browse/CNTRLPLANE-3646): port karpenter upgrade test to v2 [#9397](https://github.com/openshift/hypershift/pull/9397)
* NO-JIRA: fix(azure): orphan AzureMachines when capi-provider cannot run [#9403](https://github.com/openshift/hypershift/pull/9403)
* [OCPBUGS-99021](https://issues.redhat.com/browse/OCPBUGS-99021): Use separate certificate signers for konnectivity [#9098](https://github.com/openshift/hypershift/pull/9098)
* [OCPBUGS-99329](https://issues.redhat.com/browse/OCPBUGS-99329): avoid cache miss false-negative on credential Secret lookup [#9074](https://github.com/openshift/hypershift/pull/9074)
* NO-JIRA: group ChaiBot health report by OCP version [#9447](https://github.com/openshift/hypershift/pull/9447)
* NO-JIRA: Migrate hypershift-ci-python and contrib/oidc to uv for managing python deps [#9442](https://github.com/openshift/hypershift/pull/9442)
* [GCP-421](https://issues.redhat.com/browse/GCP-421): feat(install): bump external-dns to 1.3.5 and bundle DNSEndpoint CRD [#9433](https://github.com/openshift/hypershift/pull/9433)
* NO-JIRA: test(e2e/v2): add upsert desired-state-hash E2E tests [#9257](https://github.com/openshift/hypershift/pull/9257)
* [RFE-9138](https://issues.redhat.com/browse/RFE-9138): feat: label some hosted control plane services [#8298](https://github.com/openshift/hypershift/pull/8298)
* [OCPBUGS-109595](https://issues.redhat.com/browse/OCPBUGS-109595): use RetryWatcher and TCP keepalive for create-guests watch resilience [#9435](https://github.com/openshift/hypershift/pull/9435)
* [OCPBUGS-95614](https://issues.redhat.com/browse/OCPBUGS-95614): fix(cpo): include unavailable components in KASLoadBalancerNotReachable message [#9232](https://github.com/openshift/hypershift/pull/9232)
* [OCPBUGS-114014](https://issues.redhat.com/browse/OCPBUGS-114014): add Agent CAPI pause step to cross-cluster migration [#9416](https://github.com/openshift/hypershift/pull/9416)
* [CNTRLPLANE-4216](https://issues.redhat.com/browse/CNTRLPLANE-4216): Migrate Azure VM instance families to Dsv5 [#9423](https://github.com/openshift/hypershift/pull/9423)
* [CNTRLPLANE-4006](https://issues.redhat.com/browse/CNTRLPLANE-4006): fix(e2e) disable client-side rate limiting and increase NodePool config timeout [#9331](https://github.com/openshift/hypershift/pull/9331)
* [CNTRLPLANE-4004](https://issues.redhat.com/browse/CNTRLPLANE-4004): test(envtest): add CEL validation tests for AWS resource tag types [#9375](https://github.com/openshift/hypershift/pull/9375)
* [OCPBUGS-86669](https://issues.redhat.com/browse/OCPBUGS-86669): fix(cli): make deleteCLISecrets non-fatal during cluster destroy [#8787](https://github.com/openshift/hypershift/pull/8787)
* [CNTRLPLANE-3999](https://issues.redhat.com/browse/CNTRLPLANE-3999): add declarative TestPlan for composing v2 cluster variants and test matrices [#9420](https://github.com/openshift/hypershift/pull/9420)
* NO-JIRA: test(e2e): allow more time for control plane pod restarts [#9422](https://github.com/openshift/hypershift/pull/9422)
* [OCPBUGS-113580](https://issues.redhat.com/browse/OCPBUGS-113580): Bound NodePool metrics cache reads [#9389](https://github.com/openshift/hypershift/pull/9389)
* NO-JIRA: Makefile: fix PULL_BASE_SHA leading space breaking local verify [#9395](https://github.com/openshift/hypershift/pull/9395)
* [OCPBUGS-97811](https://issues.redhat.com/browse/OCPBUGS-97811): fix Tenant API downtime during a management worker node [#9279](https://github.com/openshift/hypershift/pull/9279)
* NO-JIRA: Run lint and vet against all build tags [#9427](https://github.com/openshift/hypershift/pull/9427)
* [OCPBUGS-114265](https://issues.redhat.com/browse/OCPBUGS-114265): Use managemet cluster kubeconfig for CAPI migration test [#9412](https://github.com/openshift/hypershift/pull/9412)
* [OCPBUGS-100142](https://issues.redhat.com/browse/OCPBUGS-100142): fix(konnectivity): fallback to alternative DNS-resolved IPs on connection failure [#9181](https://github.com/openshift/hypershift/pull/9181)
* [CNTRLPLANE-3532](https://issues.redhat.com/browse/CNTRLPLANE-3532): migrate CPO status patches to statuspatching helpers [#8966](https://github.com/openshift/hypershift/pull/8966)
* [OCPSTRAT-3686](https://issues.redhat.com/browse/OCPSTRAT-3686): Add pipeline for nightly release tag process [#9371](https://github.com/openshift/hypershift/pull/9371)
* [OCPBUGS-111601](https://issues.redhat.com/browse/OCPBUGS-111601): Fix v2 control plane upgrade rollout race [#9384](https://github.com/openshift/hypershift/pull/9384)
* [CNTRLPLANE-2883](https://issues.redhat.com/browse/CNTRLPLANE-2883): Migrate ARM64 NodePool creation test to v2 [#8926](https://github.com/openshift/hypershift/pull/8926)
* [CNTRLPLANE-4115](https://issues.redhat.com/browse/CNTRLPLANE-4115): fix(ci): report actionable cause when /rebase push hits workflow files [#9358](https://github.com/openshift/hypershift/pull/9358)
* [OCPBUGS-113991](https://issues.redhat.com/browse/OCPBUGS-113991): Scope forced NodePool cleanup to the target cluster [#9398](https://github.com/openshift/hypershift/pull/9398)
* [CNTRLPLANE-1831](https://issues.redhat.com/browse/CNTRLPLANE-1831): address review feedback on DR documentation [#9407](https://github.com/openshift/hypershift/pull/9407)
* [OCPBUGS-98467](https://issues.redhat.com/browse/OCPBUGS-98467): fix(konnectivity): enable --sync-forever to restore lost agent-server tunnels [#9260](https://github.com/openshift/hypershift/pull/9260)
* [CNTRLPLANE-3616](https://issues.redhat.com/browse/CNTRLPLANE-3616): e2e tests for TLS profile change of konnectivity-server [#8886](https://github.com/openshift/hypershift/pull/8886)
* [CNTRLPLANE-3626](https://issues.redhat.com/browse/CNTRLPLANE-3626): feat(ignition-server, ignition-server-proxy): inject centralized TLS configuration [#8910](https://github.com/openshift/hypershift/pull/8910)
* [OCPBUGS-112450](https://issues.redhat.com/browse/OCPBUGS-112450): introduce e2e v2 linting rules and enforcement [#9357](https://github.com/openshift/hypershift/pull/9357)
* [CNTRLPLANE-1831](https://issues.redhat.com/browse/CNTRLPLANE-1831): restructure backup/restore disaster recovery documentation [#9382](https://github.com/openshift/hypershift/pull/9382)
* [ACM-42704](https://issues.redhat.com/browse/ACM-42704): Add Konflux MCE 5.1 pipelines for hypershift CLI and operator [#9396](https://github.com/openshift/hypershift/pull/9396)
* [OCPBUGS-111601](https://issues.redhat.com/browse/OCPBUGS-111601): Prevent conversion webhook startup deadlock [#9387](https://github.com/openshift/hypershift/pull/9387)
* [ROSAENG-14082](https://issues.redhat.com/browse/ROSAENG-14082): --dump-guest-cluster option can now optionally be supplied with policies [#8882](https://github.com/openshift/hypershift/pull/8882)
* [CNTRLPLANE-3646](https://issues.redhat.com/browse/CNTRLPLANE-3646): port core karpenter autonode e2e tests to v2 framework [#9292](https://github.com/openshift/hypershift/pull/9292)
* [GCP-916](https://issues.redhat.com/browse/GCP-916): allow goog-partner-solution label key in GCP resourceLabels [#9267](https://github.com/openshift/hypershift/pull/9267)
* [CNTRLPLANE-3871](https://issues.redhat.com/browse/CNTRLPLANE-3871): promote OSStreams feature gate to Default [#9328](https://github.com/openshift/hypershift/pull/9328)
* [CNTRLPLANE-3903](https://issues.redhat.com/browse/CNTRLPLANE-3903): Add unit test for hcp version command [#9218](https://github.com/openshift/hypershift/pull/9218)
* [OCPBUGS-111985](https://issues.redhat.com/browse/OCPBUGS-111985), [OCPBUGS-111986](https://issues.redhat.com/browse/OCPBUGS-111986): bump haproxy to 3.0.5-6.el10_2.2 to fix CVE-2026-55203 and CVE-2026-55204 [#9333](https://github.com/openshift/hypershift/pull/9333)
* [OCPBUGS-112328](https://issues.redhat.com/browse/OCPBUGS-112328): Clear SSHKey from HCP and delete synced secret when HC SSHKey is removed [#9374](https://github.com/openshift/hypershift/pull/9374)
* [CNTRLPLANE-4169](https://issues.redhat.com/browse/CNTRLPLANE-4169): Add GHA envtest jobs for Kubernetes 1.36 [#9353](https://github.com/openshift/hypershift/pull/9353)
* [CNTRLPLANE-3604](https://issues.redhat.com/browse/CNTRLPLANE-3604): Capi v1beta2 storage migration [#8938](https://github.com/openshift/hypershift/pull/8938)
* [CNTRLPLANE-3532](https://issues.redhat.com/browse/CNTRLPLANE-3532): migrate HO karpenter status patch to statuspatching helper [#8968](https://github.com/openshift/hypershift/pull/8968)
* no-jira: add karpenter-operator dev image override annotation [#9295](https://github.com/openshift/hypershift/pull/9295)
* [CNTRLPLANE-4025](https://issues.redhat.com/browse/CNTRLPLANE-4025): feat(azure): support managed HSM for KMS encryption [#9199](https://github.com/openshift/hypershift/pull/9199)
* [OCPBUGS-44164](https://issues.redhat.com/browse/OCPBUGS-44164): Fix TestNodePoolReplaceUpgrade flaky timeout on OpenStack [#8749](https://github.com/openshift/hypershift/pull/8749)
* revert: OCPBUGS-112478: fix(cpo): handle service-ca generation errors in CSI serving cert reconciliation [#9365](https://github.com/openshift/hypershift/pull/9365)
* [CNTRLPLANE-3954](https://issues.redhat.com/browse/CNTRLPLANE-3954): add kube-scheduler metrics endpoint e2e coverage [#9159](https://github.com/openshift/hypershift/pull/9159)
* NO-JIRA: align aws_test.go test case names with testcasename linter [#9367](https://github.com/openshift/hypershift/pull/9367)
* [CNTRLPLANE-4003](https://issues.redhat.com/browse/CNTRLPLANE-4003): Add per-tag override field for AWS resource tag precedence [#9152](https://github.com/openshift/hypershift/pull/9152)
* [OCPBUGS-97705](https://issues.redhat.com/browse/OCPBUGS-97705): fix(azure): skip KMS validation for private Key Vaults on ARO HCP [#8965](https://github.com/openshift/hypershift/pull/8965)
* chore: add .pi symlink for Claude Code skill discovery [#9361](https://github.com/openshift/hypershift/pull/9361)
* [OCPBUGS-85182](https://issues.redhat.com/browse/OCPBUGS-85182): Remove MutatingAdmissionPolicy runtime-config from KAS [#9350](https://github.com/openshift/hypershift/pull/9350)
* [OCPBUGS-86771](https://issues.redhat.com/browse/OCPBUGS-86771): docs(api): document issuerURL immutability and serviceAccountIssuer override [#8916](https://github.com/openshift/hypershift/pull/8916)
* NO-JIRA: chore(owners): add members to core-reviewers [#9352](https://github.com/openshift/hypershift/pull/9352)
* [OCPBUGS-85065](https://issues.redhat.com/browse/OCPBUGS-85065): Fix repeated CPO Deployment churn due to OPENSHIFT_IMG_OVERRIDES reordering [#8656](https://github.com/openshift/hypershift/pull/8656)
* NO-JIRA: align GCP creds metric test case names with testcasename linter [#9351](https://github.com/openshift/hypershift/pull/9351)
* [GCP-959](https://issues.redhat.com/browse/GCP-959): Add GCP PSC conditions to metrics and add platform-specific gauges [#9258](https://github.com/openshift/hypershift/pull/9258)
* [CNTRLPLANE-3899](https://issues.redhat.com/browse/CNTRLPLANE-3899): Add shared cmd/ unit tests for create nodepool agent [#9162](https://github.com/openshift/hypershift/pull/9162)
* [CNTRLPLANE-4008](https://issues.redhat.com/browse/CNTRLPLANE-4008): enable hypershiftlinter and fix test naming [#9271](https://github.com/openshift/hypershift/pull/9271)
* [OCPBUGS-86670](https://issues.redhat.com/browse/OCPBUGS-86670): fix(cpo): handle service-ca generation errors in CSI serving cert reconciliation [#8622](https://github.com/openshift/hypershift/pull/8622)
* [OCPBUGS-105194](https://issues.redhat.com/browse/OCPBUGS-105194): Add retry with exponential back-off for transient dump errors [#9303](https://github.com/openshift/hypershift/pull/9303)
* [CNTRLPLANE-4041](https://issues.redhat.com/browse/CNTRLPLANE-4041): fix(build): bump missed second-stage base image in Dockerfile.e2e to 5.1 [#9345](https://github.com/openshift/hypershift/pull/9345)
* [CNTRLPLANE-4026](https://issues.redhat.com/browse/CNTRLPLANE-4026): fix(ci): Enable Dependabot to track and automate GHA runner image updates [#9330](https://github.com/openshift/hypershift/pull/9330)
* [CNTRLPLANE-4041](https://issues.redhat.com/browse/CNTRLPLANE-4041): bump base images in dockerfiles to 5.1 [#9325](https://github.com/openshift/hypershift/pull/9325)
* NO-JIRA: fix(ci): update restructure-commits workflow path after skills migration [#9335](https://github.com/openshift/hypershift/pull/9335)
* [CNTRLPLANE-4115](https://issues.redhat.com/browse/CNTRLPLANE-4115): Revert invalid workflows permission from rebase.yaml [#9329](https://github.com/openshift/hypershift/pull/9329)
* [OCPBUGS-99550](https://issues.redhat.com/browse/OCPBUGS-99550): Managed Azure setup_aks_cluster.sh fails to run with "--kubernetes-version 1.33.0" flag [#9080](https://github.com/openshift/hypershift/pull/9080)
* [OCPBUGS-105282](https://issues.redhat.com/browse/OCPBUGS-105282): Add proxy env vars to cluster-storage-operator deployment [#9256](https://github.com/openshift/hypershift/pull/9256)
* [CNTRLPLANE-4115](https://issues.redhat.com/browse/CNTRLPLANE-4115): Fix /rebase workflow: add missing workflows permission [#9323](https://github.com/openshift/hypershift/pull/9323)
* NO-JIRA: Convert Claude commands to agentskills.io skill format for harness portability [#9062](https://github.com/openshift/hypershift/pull/9062)
* [CNTRLPLANE-3871](https://issues.redhat.com/browse/CNTRLPLANE-3871): add [FeatureGate:OSStreams] tag for FG promotion tracking [#9297](https://github.com/openshift/hypershift/pull/9297)
* [OCPBUGS-83564](https://issues.redhat.com/browse/OCPBUGS-83564): Apply registry overrides to release image pullspec before fetching [#9108](https://github.com/openshift/hypershift/pull/9108)
* [CNTRLPLANE-4008](https://issues.redhat.com/browse/CNTRLPLANE-4008): feat: add hypershiftlinter golangci-lint plugin [#9237](https://github.com/openshift/hypershift/pull/9237)
* [OCPBUGS-105875](https://issues.redhat.com/browse/OCPBUGS-105875): fix(hcco): run kas-connection-checker as non-root [#9296](https://github.com/openshift/hypershift/pull/9296)
* [ARO-26896](https://issues.redhat.com/browse/ARO-26896): feat: hardcode ETCD_METRICS=extensive in etcd StatefulSet template [#9192](https://github.com/openshift/hypershift/pull/9192)
* [OCPBUGS-105802](https://issues.redhat.com/browse/OCPBUGS-105802): Use the correct v1 mcfg api for OSImageStream during ignition [#9283](https://github.com/openshift/hypershift/pull/9283)
* [CNTRLPLANE-4043](https://issues.redhat.com/browse/CNTRLPLANE-4043): ci(e2e): add CI workflow to verify e2e compilation on PRs [#9305](https://github.com/openshift/hypershift/pull/9305)
* And 4 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/hypershift/compare/7a5170972d2ec1aea5f049b3c8351de9ac1f009d...253c3f5c790d08668d4aa365688e88a0ab950af8)
### [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver/tree/8f1f7d630bc9df33d25cd209fc04869f967b7823)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#161](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/161)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver/compare/3a89d7d17d25727270414b07d3daaa3bc329d743...8f1f7d630bc9df33d25cd209fc04869f967b7823)
### [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/tree/5b8c75809ee2c05b2e26d309aa4614fcb4c2d501)
* [OCPBUGS-98100](https://issues.redhat.com/browse/OCPBUGS-98100): disable snapshot tests for ibm-vpc-block-csi-driver [#175](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/175)
* [STOR-3068](https://issues.redhat.com/browse/STOR-3068): Bump all libraries [#198](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/198)
* [OCPBUGS-127462](https://issues.redhat.com/browse/OCPBUGS-127462): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#194](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/194)
* [OCPBUGS-113538](https://issues.redhat.com/browse/OCPBUGS-113538): Enable SELinuxMount tests [#180](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/180)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/compare/be4fd01725ce5ab0b47f846c905a349aeee8ab53...5b8c75809ee2c05b2e26d309aa4614fcb4c2d501)
### [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud/tree/5823f38cea16b6a9a002e791288290bc50b500a0)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-ibmcloud:v0.15.0 (5704e48) into main [#184](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/184)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#187](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/187)
* [OCPBUGS-114006](https://issues.redhat.com/browse/OCPBUGS-114006): UPSTREAM: 2933: Bump all go.opentelemetry.io/otel modules to v1.44.0 [#165](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/165)
* [Full changelog](https://github.com/openshift/cluster-api-provider-ibmcloud/compare/286dd2de7957e9c2897e152417f16907d324d819...5823f38cea16b6a9a002e791288290bc50b500a0)
### [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud/tree/c2439897d64ade66b2159b48dc7ae68712b98400)
* [CNF-23394](https://issues.redhat.com/browse/CNF-23394): mockgen deprecated: use uber-go/mock instead [#73](https://github.com/openshift/machine-api-provider-ibmcloud/pull/73)
* [Full changelog](https://github.com/openshift/machine-api-provider-ibmcloud/compare/2615d13b730255b21ccb401d3dc039006c54a4fe...c2439897d64ade66b2159b48dc7ae68712b98400)
### [insights-operator](https://github.com/openshift/insights-operator/tree/4c9b958a938d50286f23748a2cac692006bd94a6)
* NO-JIRA: Revert "WIP: how to add gpu node" [#1390](https://github.com/openshift/insights-operator/pull/1390)
* [CCXDEV-16671](https://issues.redhat.com/browse/CCXDEV-16671): add GPU node topology gatherer [#1364](https://github.com/openshift/insights-operator/pull/1364)
* NO-JIRA: add permissions to fetch MaasModelRefs [#1388](https://github.com/openshift/insights-operator/pull/1388)
* [CCXDEV-16669](https://issues.redhat.com/browse/CCXDEV-16669): gather externalModels [#1379](https://github.com/openshift/insights-operator/pull/1379)
* [CCXDEV-16670](https://issues.redhat.com/browse/CCXDEV-16670): add MaaSModelRef gatherer [#1377](https://github.com/openshift/insights-operator/pull/1377)
* [CCXDEV-16666](https://issues.redhat.com/browse/CCXDEV-16666): gather InferenceService from the KServe operator [#1345](https://github.com/openshift/insights-operator/pull/1345)
* [OCPBUGS-97968](https://issues.redhat.com/browse/OCPBUGS-97968): add insights-runtime-extractor-scc missing fields [#1359](https://github.com/openshift/insights-operator/pull/1359)
* [CCXDEV-16041](https://issues.redhat.com/browse/CCXDEV-16041): multiclusterhub gatherer [#1343](https://github.com/openshift/insights-operator/pull/1343)
* NO-JIRA: improve create-gatherer skill [#1348](https://github.com/openshift/insights-operator/pull/1348)
* [CCXDEV-16040](https://issues.redhat.com/browse/CCXDEV-16040): Add multicluster gatherer [#1337](https://github.com/openshift/insights-operator/pull/1337)
* [CCXDEV-16594](https://issues.redhat.com/browse/CCXDEV-16594): add custom proxy field to insights config [#1329](https://github.com/openshift/insights-operator/pull/1329)
* [Full changelog](https://github.com/openshift/insights-operator/compare/2f616dc436db2e35d70c9a049be98c185f684243...4c9b958a938d50286f23748a2cac692006bd94a6)
### [insights-runtime-exporter, insights-runtime-extractor](https://github.com/openshift/insights-runtime-extractor/tree/23a0d856df20187f8a560f226546907a7bbeed23)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#92](https://github.com/openshift/insights-runtime-extractor/pull/92)
* NO-JIRA: chore: add slashpai to owner list [#91](https://github.com/openshift/insights-runtime-extractor/pull/91)
* [Full changelog](https://github.com/openshift/insights-runtime-extractor/compare/7c9aa14915e639edd20bc0869747487e2e73fe51...23a0d856df20187f8a560f226546907a7bbeed23)
### [ironic](https://github.com/openshift/ironic-image/tree/96b9798380748f08e36d190af8cb6ef9672b9c0a)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#929](https://github.com/openshift/ironic-image/pull/929)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#924](https://github.com/openshift/ironic-image/pull/924)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#923](https://github.com/openshift/ironic-image/pull/923)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#921](https://github.com/openshift/ironic-image/pull/921)
* [METAL-1958](https://issues.redhat.com/browse/METAL-1958): Merge contiguous Dockerfile RUN layers to reduce image size [#916](https://github.com/openshift/ironic-image/pull/916)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#917](https://github.com/openshift/ironic-image/pull/917)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#910](https://github.com/openshift/ironic-image/pull/910)
* NO-ISSUE: Manually sync Ironic - part 2 [#909](https://github.com/openshift/ironic-image/pull/909)
* NO-ISSUE: Manually sync Ironic and Sushy from the forks [#906](https://github.com/openshift/ironic-image/pull/906)
* [METAL-1931](https://issues.redhat.com/browse/METAL-1931): Add cargo for bcrypt rust extensions [#895](https://github.com/openshift/ironic-image/pull/895)
* [Full changelog](https://github.com/openshift/ironic-image/compare/001adec7884e75a5078e4e72c8bc8d2a51376b43...96b9798380748f08e36d190af8cb6ef9672b9c0a)
### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/283fb6c94c73cb621b892e1f14f2e2d851ccc7cf)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#321](https://github.com/openshift/ironic-agent-image/pull/321)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#320](https://github.com/openshift/ironic-agent-image/pull/320)
* [METAL-1958](https://issues.redhat.com/browse/METAL-1958): Remove OKD build deps in the same layer they are installed [#318](https://github.com/openshift/ironic-agent-image/pull/318)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#319](https://github.com/openshift/ironic-agent-image/pull/319)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#317](https://github.com/openshift/ironic-agent-image/pull/317)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#302](https://github.com/openshift/ironic-agent-image/pull/302)
* [METAL-1931](https://issues.redhat.com/browse/METAL-1931): Add cargo for bcrypt rust extensions [#303](https://github.com/openshift/ironic-agent-image/pull/303)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/601c9bf36bbc4a0796c4c55e59bfe3cc46252ed3...283fb6c94c73cb621b892e1f14f2e2d851ccc7cf)
### [karpenter-operator](https://github.com/openshift/karpenter-operator/tree/f6687434d78c8b2f96d86e0c91f8beb82998608a)
* NO-JIRA: docs: clarify explicit test expectations [#60](https://github.com/openshift/karpenter-operator/pull/60)
* [AUTOSCALE-1046](https://issues.redhat.com/browse/AUTOSCALE-1046): feat: hold Azure NodeClass releases during control plane upgrades [#56](https://github.com/openshift/karpenter-operator/pull/56)
* [AUTOSCALE-166](https://issues.redhat.com/browse/AUTOSCALE-166): skip unsupported static capacity regression tests [#59](https://github.com/openshift/karpenter-operator/pull/59)
* [AUTOSCALE-166](https://issues.redhat.com/browse/AUTOSCALE-166): constrain regression e2e nodes to amd64 [#57](https://github.com/openshift/karpenter-operator/pull/57)
* NO-JIRA: add Deployment manifest golden-file testing [#53](https://github.com/openshift/karpenter-operator/pull/53)
* [AUTOSCALE-969](https://issues.redhat.com/browse/AUTOSCALE-969): add defaultNodeClass method for azure [#54](https://github.com/openshift/karpenter-operator/pull/54)
* NO-JIRA: refactor: align controller conventions [#55](https://github.com/openshift/karpenter-operator/pull/55)
* [OCPBUGS-116223](https://issues.redhat.com/browse/OCPBUGS-116223): fix: report ClusterOperator status on unsupported platforms [#50](https://github.com/openshift/karpenter-operator/pull/50)
* [AUTOSCALE-1045](https://issues.redhat.com/browse/AUTOSCALE-1045): feat: add OpenShiftAzureNodeClass API and controller [#44](https://github.com/openshift/karpenter-operator/pull/44)
* NO-JIRA: update controller and logging guidance in agents.md [#51](https://github.com/openshift/karpenter-operator/pull/51)
* [AUTOSCALE-1057](https://issues.redhat.com/browse/AUTOSCALE-1057): Implement karpenter operator metric and add test [#48](https://github.com/openshift/karpenter-operator/pull/48)
* NO-JIRA: fix: require EBS in block device mappings [#47](https://github.com/openshift/karpenter-operator/pull/47)
* NO-JIRA: fix: align controller logging with controller-runtime guidelines [#49](https://github.com/openshift/karpenter-operator/pull/49)
* NO-JIRA: chore: enforce consistent import aliases [#46](https://github.com/openshift/karpenter-operator/pull/46)
* [AUTOSCALE-1043](https://issues.redhat.com/browse/AUTOSCALE-1043): add pod monitor for karpenter and operator [#45](https://github.com/openshift/karpenter-operator/pull/45)
* NO-JIRA: chore: version local build tool binaries [#37](https://github.com/openshift/karpenter-operator/pull/37)
* [AUTOSCALE-947](https://issues.redhat.com/browse/AUTOSCALE-947): feat: migrate EC2NodeClass controller from HyperShift [#43](https://github.com/openshift/karpenter-operator/pull/43)
* [AUTOSCALE-1008](https://issues.redhat.com/browse/AUTOSCALE-1008): Add label and annotation for MonitorOperandsRolloutStatus tracking [#39](https://github.com/openshift/karpenter-operator/pull/39)
* [AUTOSCALE-977](https://issues.redhat.com/browse/AUTOSCALE-977): feat: reconcile default NodeClass [#38](https://github.com/openshift/karpenter-operator/pull/38)
* [AUTOSCALE-856](https://issues.redhat.com/browse/AUTOSCALE-856): Add Azure Karpenter provider image reference [#41](https://github.com/openshift/karpenter-operator/pull/41)
* [AUTOSCALE-166](https://issues.redhat.com/browse/AUTOSCALE-166): Add minimum instance size requirements [#36](https://github.com/openshift/karpenter-operator/pull/36)
* NO-JIRA: fixup OWNERS_ALIASES [#35](https://github.com/openshift/karpenter-operator/pull/35)
* NO-JIRA: chore: update build tool versions [#34](https://github.com/openshift/karpenter-operator/pull/34)
* [AUTOSCALE-873](https://issues.redhat.com/browse/AUTOSCALE-873): fix: apply OpenShift Karpenter CRD adjustments [#33](https://github.com/openshift/karpenter-operator/pull/33)
* [AUTOSCALE-974](https://issues.redhat.com/browse/AUTOSCALE-974): deploy karpenter-provider-azure on HCP [#32](https://github.com/openshift/karpenter-operator/pull/32)
* [AUTOSCALE-946](https://issues.redhat.com/browse/AUTOSCALE-946): migrate approver for node CSRs [#29](https://github.com/openshift/karpenter-operator/pull/29)
* no-jira: remove aggregate cluster role [#30](https://github.com/openshift/karpenter-operator/pull/30)
* [AUTOSCALE-998](https://issues.redhat.com/browse/AUTOSCALE-998): deploy karpenter-provider-aws on HCP [#26](https://github.com/openshift/karpenter-operator/pull/26)
* [AUTOSCALE-968](https://issues.redhat.com/browse/AUTOSCALE-968): sync AKSNodeClass CRD and add Azure cloud provider [#28](https://github.com/openshift/karpenter-operator/pull/28)
* [AUTOSCALE-906](https://issues.redhat.com/browse/AUTOSCALE-906): add agentic SDLC context files [#27](https://github.com/openshift/karpenter-operator/pull/27)
* [AUTOSCALE-976](https://issues.redhat.com/browse/AUTOSCALE-976): enable CRD controller for management cluster mode [#24](https://github.com/openshift/karpenter-operator/pull/24)
* [AUTOSCALE-872](https://issues.redhat.com/browse/AUTOSCALE-872): Implement OpenshiftEC2NodeClass objects [#25](https://github.com/openshift/karpenter-operator/pull/25)
* [AUTOSCALE-166](https://issues.redhat.com/browse/AUTOSCALE-166): Apply NodeOverlay to hostedcluster during karpenter-core e2e for AWS HCP AutoNode [#22](https://github.com/openshift/karpenter-operator/pull/22)
* [Full changelog](https://github.com/openshift/karpenter-operator/compare/56725605325c54693ebed5b0983d5d0478a87fca...f6687434d78c8b2f96d86e0c91f8beb82998608a)
### [keepalived-ipfailover](https://github.com/openshift/images/tree/8ca25e40158ebc16da94bcec6a4f89c980cb3c73)
* NO-JIRA: Enable CentOS Stream 10 OKD package repositories in base image [#254](https://github.com/openshift/images/pull/254)
* [NE-2126](https://issues.redhat.com/browse/NE-2126): Migrating Ipfailover test cases to images repo [#245](https://github.com/openshift/images/pull/245)
* [Full changelog](https://github.com/openshift/images/compare/13118bff15103b31a6528bf8de2d0d6de05f4742...8ca25e40158ebc16da94bcec6a4f89c980cb3c73)
### [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server/tree/b81e4806032163f01cd40a3a39cc245eca1cf9d9)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#80](https://github.com/openshift/kubernetes-metrics-server/pull/80)
* NO-ISSUE: [bot] Bump openshift/kubernetes-metrics-server to v0.9.0 [#72](https://github.com/openshift/kubernetes-metrics-server/pull/72)
* [Full changelog](https://github.com/openshift/kubernetes-metrics-server/compare/3d2e9cd0469d636e32dc0e4d4b6f65957eb27d71...b81e4806032163f01cd40a3a39cc245eca1cf9d9)
### [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy/tree/75554a0355eb0c9b25904102437a529703af89b8)
* NO-JIRA: Merge upstream v0.23.0 [#162](https://github.com/openshift/kube-rbac-proxy/pull/162)
* [CNTRLPLANE-3685](https://issues.redhat.com/browse/CNTRLPLANE-3685): docs - add Agentic SDLC context files [#144](https://github.com/openshift/kube-rbac-proxy/pull/144)
* NO-JIRA: update OWNERS [#147](https://github.com/openshift/kube-rbac-proxy/pull/147)
* NO-JIRA: Merge upstream v0.22.1 [#146](https://github.com/openshift/kube-rbac-proxy/pull/146)
* [Full changelog](https://github.com/openshift/kube-rbac-proxy/compare/43c114bc124f59e2fc3223dea8e0a8f4cdeed18d...75554a0355eb0c9b25904102437a529703af89b8)
### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/4ee3abf755840bf17040e4008445cf4303e94fb9)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#169](https://github.com/openshift/kube-state-metrics/pull/169)
* NO-ISSUE: [bot] Bump openshift/kube-state-metrics to v2.20.0 [#155](https://github.com/openshift/kube-state-metrics/pull/155)
* [Full changelog](https://github.com/openshift/kube-state-metrics/compare/019ecc7d533333dfd3bf8893e78cd7ec6e282f01...4ee3abf755840bf17040e4008445cf4303e94fb9)
### [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator/tree/c67b43a2519e63f02e4be27ae6c8d4edcbc75950)
* [OCPBUGS-126583](https://issues.redhat.com/browse/OCPBUGS-126583): Bump golang.org/x/net to v0.55.0 to address CVE-2026-33814 [#266](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/266)
* NO-JIRA: Bump Go builder and CI images from 1.24 to 1.26 for openshift-5.1 [#265](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/265)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#262](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/262)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#259](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/259)
* [Full changelog](https://github.com/openshift/kubernetes-kube-storage-version-migrator/compare/72835e43c7754356645e41031f3a99926b4d42e6...c67b43a2519e63f02e4be27ae6c8d4edcbc75950)
### [kube-vip](https://github.com/openshift/kube-vip/tree/b272a7342833dad64574158101decb94ebe703d0)
* NO-JIRA: Merge https://github.com/kube-vip/kube-vip:main (https://github.com/openshift/kube-vip/commit/6cbf5aaeda356be0ee3fc5d8482d483c28bb4103) into main [#19](https://github.com/openshift/kube-vip/pull/19)
* [Full changelog](https://github.com/openshift/kube-vip/compare/1bb8a96eb31eaacc7cb49a9e8e397b66e62d87e9...b272a7342833dad64574158101decb94ebe703d0)
### [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt/tree/69b587936de73e3d9c6479b7b39899b6a45e90aa)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#87](https://github.com/openshift/cloud-provider-kubevirt/pull/87)
* [Full changelog](https://github.com/openshift/cloud-provider-kubevirt/compare/5eb884abcd2ff17ae8d7b2691ca12494597c08a6...69b587936de73e3d9c6479b7b39899b6a45e90aa)
### [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver/tree/5dc8df62eab9bd1539ad03ec776fad08df62ab58)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#119](https://github.com/openshift/kubevirt-csi-driver/pull/119)
* [Full changelog](https://github.com/openshift/kubevirt-csi-driver/compare/00dd0030fdfcdb6937ebefd8fb92363a8f78ef73...5dc8df62eab9bd1539ad03ec776fad08df62ab58)
### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/b86410145e827fed51b4ed4ec7d01cf6ed4f5623)
* [OCPBUGS-90560](https://issues.redhat.com/browse/OCPBUGS-90560): remove GCP boot disk image defaulting from admission webhook [#1525](https://github.com/openshift/machine-api-operator/pull/1525)
* [OCPBUGS-90560](https://issues.redhat.com/browse/OCPBUGS-90560): add RBAC for GCP boot image resolution [#1560](https://github.com/openshift/machine-api-operator/pull/1560)
* [OCPCLOUD-3660](https://issues.redhat.com/browse/OCPCLOUD-3660): bump to Kubernetes 1.37 [#1570](https://github.com/openshift/machine-api-operator/pull/1570)
* [OCPBUGS-129369](https://issues.redhat.com/browse/OCPBUGS-129369): fix race in VAP MachineSet e2e test cleanup [#1572](https://github.com/openshift/machine-api-operator/pull/1572)
* [SPLAT-2983](https://issues.redhat.com/browse/SPLAT-2983): Use Machine API vSphere credentials in e2e tests [#1568](https://github.com/openshift/machine-api-operator/pull/1568)
* [OCPBUGS-122165](https://issues.redhat.com/browse/OCPBUGS-122165): Reduce vCenter API load in the vSphere machine controller [#1552](https://github.com/openshift/machine-api-operator/pull/1552)
* [OCPCLOUD-3438](https://issues.redhat.com/browse/OCPCLOUD-3438): Bump govmomi to 0.53.0 [#1498](https://github.com/openshift/machine-api-operator/pull/1498)
* NO-ISSUE: Add opt-in kube-rbac-proxy sidecar for pprof endpoint (AWS) [#1502](https://github.com/openshift/machine-api-operator/pull/1502)
* [OCPBUGS-47508](https://issues.redhat.com/browse/OCPBUGS-47508): Set --max-concurrent-reconciles=10 for AWS machine controller [#1521](https://github.com/openshift/machine-api-operator/pull/1521)
* [SPLAT-2825](https://issues.redhat.com/browse/SPLAT-2825): Moved OTE machine tests to openshift/disruptive-longrunning [#1539](https://github.com/openshift/machine-api-operator/pull/1539)
* [OCPBUGS-105398](https://issues.redhat.com/browse/OCPBUGS-105398): refactor: remove AzureWorkloadIdentity feature gate [#1537](https://github.com/openshift/machine-api-operator/pull/1537)
* [SPLAT-2826](https://issues.redhat.com/browse/SPLAT-2826): Compare against oldObject in vSphere failure-domain VAPs [#1536](https://github.com/openshift/machine-api-operator/pull/1536)
* [OCPBUGS-74510](https://issues.redhat.com/browse/OCPBUGS-74510): Removed VSphereMultiDisk feature gate [#1532](https://github.com/openshift/machine-api-operator/pull/1532)
* [OCPBUGS-105407](https://issues.redhat.com/browse/OCPBUGS-105407): Remove VSphereMultiNetworks feature gate from e2e test [#1533](https://github.com/openshift/machine-api-operator/pull/1533)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/b3cabb0301b12a2b256bf8aed85c3f4c7b0dab3c...b86410145e827fed51b4ed4ec7d01cf6ed4f5623)
### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/328a5db3946d1b024116cef74154ec70f23d5fb3)
* [MCO-2475](https://issues.redhat.com/browse/MCO-2475): Simplified the Irreconcilable Differences test to only fetch Ignition contents [#6646](https://github.com/openshift/machine-config-operator/pull/6646)
* [OCPBUGS-130604](https://issues.redhat.com/browse/OCPBUGS-130604): test/extended: accept the data/by-lun Azure disk path [#6650](https://github.com/openshift/machine-config-operator/pull/6650)
* [OCPBUGS-129377](https://issues.redhat.com/browse/OCPBUGS-129377): MCD fails to rollback from OCL to stock RHCOS when extensions are installed [#6631](https://github.com/openshift/machine-config-operator/pull/6631)
* [OCPBUGS-129536](https://issues.redhat.com/browse/OCPBUGS-129536): Update cleanup for test `PolarionID:84219` to wait for node to be removed [#6648](https://github.com/openshift/machine-config-operator/pull/6648)
* [OCPBUGS-128286](https://issues.redhat.com/browse/OCPBUGS-128286): only enable signed policy when testing signed payloads [#6611](https://github.com/openshift/machine-config-operator/pull/6611)
* [OCPBUGS-99751](https://issues.redhat.com/browse/OCPBUGS-99751): Verify MOSC existence via API before serving layered image [#6352](https://github.com/openshift/machine-config-operator/pull/6352)
* [OCPBUGS-124571](https://issues.redhat.com/browse/OCPBUGS-124571): Bump version of `google.golang.org/grpc` [#6633](https://github.com/openshift/machine-config-operator/pull/6633)
* [SPLAT-2996](https://issues.redhat.com/browse/SPLAT-2996): use component-scoped vSphere credentials for boot image updates [#6641](https://github.com/openshift/machine-config-operator/pull/6641)
* [OCPBUGS-126565](https://issues.redhat.com/browse/OCPBUGS-126565): OCPBUGS-127020: Enable `readOnlyRootFilesystem: true` for machine-config-operator container [#6568](https://github.com/openshift/machine-config-operator/pull/6568)
* [MCO-2522](https://issues.redhat.com/browse/MCO-2522): Adapt all extended e2e test cases to use ManagedMachine… [#6621](https://github.com/openshift/machine-config-operator/pull/6621)
* [OCPBUGS-129112](https://issues.redhat.com/browse/OCPBUGS-129112): Skip GCP reconcile for unknown arch [#6625](https://github.com/openshift/machine-config-operator/pull/6625)
* [OCPBUGS-85519](https://issues.redhat.com/browse/OCPBUGS-85519): Add IRI credentials to the internal registry pull secret [#6067](https://github.com/openshift/machine-config-operator/pull/6067)
* [OCPBUGS-128811](https://issues.redhat.com/browse/OCPBUGS-128811): Remove reverse (rhel10 to rhel9) OSStreams upgrade tests [#6638](https://github.com/openshift/machine-config-operator/pull/6638)
* [OCPBUGS-128535](https://issues.redhat.com/browse/OCPBUGS-128535): Revert "OCPBUGS-91746: Remove sandboxed-containers (kata-containers) from extended-priv tests" [#6613](https://github.com/openshift/machine-config-operator/pull/6613)
* [MCO-1989](https://issues.redhat.com/browse/MCO-1989): Fix RHEL9-specific MCD Logic for RHEL10/CentOS10 for adaptability [#6515](https://github.com/openshift/machine-config-operator/pull/6515)
* [OCPBUGS-121959](https://issues.redhat.com/browse/OCPBUGS-121959): Make NIC persistence unconditional instead of version-specific [#6516](https://github.com/openshift/machine-config-operator/pull/6516)
* [OCPBUGS-128716](https://issues.redhat.com/browse/OCPBUGS-128716): logout vCenter clients after use [#6629](https://github.com/openshift/machine-config-operator/pull/6629)
* [AGENT-1454](https://issues.redhat.com/browse/AGENT-1454): Enforce APIServer TLS profile on IRI registry [#6592](https://github.com/openshift/machine-config-operator/pull/6592)
* [OCPBUGS-128457](https://issues.redhat.com/browse/OCPBUGS-128457): Fix layered OS updates on older nodes [#6630](https://github.com/openshift/machine-config-operator/pull/6630)
* [OCPBUGS-128676](https://issues.redhat.com/browse/OCPBUGS-128676): Boot image controller skips MachineSets that don't match any failure domain [#6606](https://github.com/openshift/machine-config-operator/pull/6606)
* [OPNET-782](https://issues.redhat.com/browse/OPNET-782): Render BGP VIP static pods instead of keepalived [#6326](https://github.com/openshift/machine-config-operator/pull/6326)
* [OCPBUGS-128659](https://issues.redhat.com/browse/OCPBUGS-128659): Filter cosign signature tags from the IRI release lookup [#6604](https://github.com/openshift/machine-config-operator/pull/6604)
* [MCO-2522](https://issues.redhat.com/browse/MCO-2522): Create ManagedMachineSet interface [#6602](https://github.com/openshift/machine-config-operator/pull/6602)
* NO-ISSUE: Initial version of the create MCO test plan skill [#6560](https://github.com/openshift/machine-config-operator/pull/6560)
* [OCPBUGS-128535](https://issues.redhat.com/browse/OCPBUGS-128535): Revert "OCPBUGS-91746: temporarily remove sandboxed-containers from extensions test" [#6596](https://github.com/openshift/machine-config-operator/pull/6596)
* NO-ISSUE: Fix typo in controller [#6595](https://github.com/openshift/machine-config-operator/pull/6595)
* NO-ISSUE: Increase timeout for `ImagePulledFromRegistry=Unknown` in non-SNO suites [#6598](https://github.com/openshift/machine-config-operator/pull/6598)
* [SPLAT-2376](https://issues.redhat.com/browse/SPLAT-2376): test/extended: add Azure machine pool disk setup tests [#6559](https://github.com/openshift/machine-config-operator/pull/6559)
* [OCPBUGS-105412](https://issues.redhat.com/browse/OCPBUGS-105412): Updated openshift/api vendor [#6586](https://github.com/openshift/machine-config-operator/pull/6586)
* [OCPBUGS-127481](https://issues.redhat.com/browse/OCPBUGS-127481): change markdown linter approach [#6591](https://github.com/openshift/machine-config-operator/pull/6591)
* [OCPBUGS-127707](https://issues.redhat.com/browse/OCPBUGS-127707): check CAPI manager modes for default skew status [#6589](https://github.com/openshift/machine-config-operator/pull/6589)
* [MCO-2572](https://issues.redhat.com/browse/MCO-2572): Consider nodes "Updated" when they have been manually set to an unready state but no update is happening [#6536](https://github.com/openshift/machine-config-operator/pull/6536)
* [OCPBUGS-127481](https://issues.redhat.com/browse/OCPBUGS-127481): Add markdown linter [#6582](https://github.com/openshift/machine-config-operator/pull/6582)
* [OCPBUGS-127022](https://issues.redhat.com/browse/OCPBUGS-127022): Enable `readOnlyRootFilesystem: true` for machine-config-server container [#6569](https://github.com/openshift/machine-config-operator/pull/6569)
* [OCPBUGS-74136](https://issues.redhat.com/browse/OCPBUGS-74136): Split wait-for-ipsec-connect into two services to avoid ipsec restart [#6440](https://github.com/openshift/machine-config-operator/pull/6440)
* NO-ISSUE: Increase timeout for `ImagePulledFromRegistry=Unknown` in non-SNO suites [#6574](https://github.com/openshift/machine-config-operator/pull/6574)
* [OCPBUGS-86768](https://issues.redhat.com/browse/OCPBUGS-86768): Nodes created with 4.13 base images cannot join the cluster [#6435](https://github.com/openshift/machine-config-operator/pull/6435)
* [MCO-2536](https://issues.redhat.com/browse/MCO-2536): Update operator to populate CAPI bootimage status [#6469](https://github.com/openshift/machine-config-operator/pull/6469)
* [OCPBUGS-126899](https://issues.redhat.com/browse/OCPBUGS-126899): Add MCN/PIS/MOSC/MOSB/OSImageStream to relatedObjects [#6563](https://github.com/openshift/machine-config-operator/pull/6563)
* [OCPBUGS-86571](https://issues.redhat.com/browse/OCPBUGS-86571): templates: pass --dual-stack to nodeip-configuration [#6105](https://github.com/openshift/machine-config-operator/pull/6105)
* [OCPBUGS-57177](https://issues.redhat.com/browse/OCPBUGS-57177): Degrade the MachineConfigPool on PinnedImageSet degrade [#6443](https://github.com/openshift/machine-config-operator/pull/6443)
* [OCPBUGS-63048](https://issues.redhat.com/browse/OCPBUGS-63048): Kube object asserts do not handle case where object is replaced [#6059](https://github.com/openshift/machine-config-operator/pull/6059)
* [OCPBUGS-100366](https://issues.redhat.com/browse/OCPBUGS-100366): Re-queue ContainerRuntimeConfig on status update failure [#6415](https://github.com/openshift/machine-config-operator/pull/6415)
* [OCPBUGS-90502](https://issues.redhat.com/browse/OCPBUGS-90502): Run nmstatectl format in nmstate-configuration [#6209](https://github.com/openshift/machine-config-operator/pull/6209)
* [OCPBUGS-115002](https://issues.redhat.com/browse/OCPBUGS-115002): Remove BootImageSkewEnforcement references to gate component from MCO [#6522](https://github.com/openshift/machine-config-operator/pull/6522)
* [OCPBUGS-114882](https://issues.redhat.com/browse/OCPBUGS-114882): drop GCD health-check ranges in openshift-gcp-routes [#6501](https://github.com/openshift/machine-config-operator/pull/6501)
* [OPNET-801](https://issues.redhat.com/browse/OPNET-801): Switch on-prem HAProxy pods to haproxy-router-haproxy32 image [#6502](https://github.com/openshift/machine-config-operator/pull/6502)
* [OCPBUGS-122237](https://issues.redhat.com/browse/OCPBUGS-122237): [TNF] Add infinite retry on untaint systemd unit [#6535](https://github.com/openshift/machine-config-operator/pull/6535)
* [OCPBUGS-116491](https://issues.redhat.com/browse/OCPBUGS-116491): Correctly handle MC deletion in image mode when no new build is required [#6528](https://github.com/openshift/machine-config-operator/pull/6528)
* [OCPBUGS-121353](https://issues.redhat.com/browse/OCPBUGS-121353): Pass missing proxy vars to bootstrap MCC [#6526](https://github.com/openshift/machine-config-operator/pull/6526)
* [MCO-2575](https://issues.redhat.com/browse/MCO-2575): Refactor verification functions for `calculateStatus` test cases [#6543](https://github.com/openshift/machine-config-operator/pull/6543)
* [MCO-2570](https://issues.redhat.com/browse/MCO-2570): remove poll methods [#6532](https://github.com/openshift/machine-config-operator/pull/6532)
* [OCPBUGS-114737](https://issues.redhat.com/browse/OCPBUGS-114737): updateLayeredOS deploy-from-self when skopeo < 1.22.2 [#6475](https://github.com/openshift/machine-config-operator/pull/6475)
* [OCPBUGS-122209](https://issues.redhat.com/browse/OCPBUGS-122209): Fix IsBootImageUpdateSupported to include vSphere and Azure platforms [#6523](https://github.com/openshift/machine-config-operator/pull/6523)
* [OCPBUGS-105283](https://issues.redhat.com/browse/OCPBUGS-105283): Mount /etc/container in mosb [#6451](https://github.com/openshift/machine-config-operator/pull/6451)
* [OCPBUGS-95238](https://issues.redhat.com/browse/OCPBUGS-95238): Dump compact cache to CM for persistence [#6379](https://github.com/openshift/machine-config-operator/pull/6379)
* [OCPBUGS-114664](https://issues.redhat.com/browse/OCPBUGS-114664): Fix CVE-2026-15792: Upgrade BuildKit to v0.31.2 [#6472](https://github.com/openshift/machine-config-operator/pull/6472)
* [OCPBUGS-120711](https://issues.redhat.com/browse/OCPBUGS-120711): Fix vsphere network absolute paths [#6497](https://github.com/openshift/machine-config-operator/pull/6497)
* [OCPBUGS-112721](https://issues.redhat.com/browse/OCPBUGS-112721): Retry on conflict in syncMachineConfigNodes [#6496](https://github.com/openshift/machine-config-operator/pull/6496)
* [OCPBUGS-116490](https://issues.redhat.com/browse/OCPBUGS-116490): remove nft chains before checking the ignition config [#6485](https://github.com/openshift/machine-config-operator/pull/6485)
* NO-ISSUE: check mosb failed message in test 85980 [#6500](https://github.com/openshift/machine-config-operator/pull/6500)
* [OCPBUGS-109657](https://issues.redhat.com/browse/OCPBUGS-109657): Assert errors in TestGetPrimaryPoolForNode [#6482](https://github.com/openshift/machine-config-operator/pull/6482)
* [OCPBUGS-115123](https://issues.redhat.com/browse/OCPBUGS-115123): Replace wildcard permissions with explicit verbs in MachineConfigServer ClusterRole [#6470](https://github.com/openshift/machine-config-operator/pull/6470)
* [OCPBUGS-112348](https://issues.redhat.com/browse/OCPBUGS-112348): Increase TC-74751 Eventually timeout for vSphere OVA upload [#6481](https://github.com/openshift/machine-config-operator/pull/6481)
* [OCPBUGS-115158](https://issues.redhat.com/browse/OCPBUGS-115158): Update AMI Whitelist [#6474](https://github.com/openshift/machine-config-operator/pull/6474)
* [OCPBUGS-115203](https://issues.redhat.com/browse/OCPBUGS-115203): Skip vsphere fd-unmatched machinesets for bootimage updates [#6477](https://github.com/openshift/machine-config-operator/pull/6477)
* [MCO-2530](https://issues.redhat.com/browse/MCO-2530): Remove unused functions, constants, parameters, and returns throughout the codebase [#6403](https://github.com/openshift/machine-config-operator/pull/6403)
* [MCO-2427](https://issues.redhat.com/browse/MCO-2427): Move OCB and OSStreams tests to longduration suite [#6454](https://github.com/openshift/machine-config-operator/pull/6454)
* [OCPBUGS-109659](https://issues.redhat.com/browse/OCPBUGS-109659): Check conddegraded nil before dereference in TestCalculateStatus [#6462](https://github.com/openshift/machine-config-operator/pull/6462)
* [OCPBUGS-69681](https://issues.redhat.com/browse/OCPBUGS-69681): limit ContainerRuntimeConfig status condition to 3 [#6434](https://github.com/openshift/machine-config-operator/pull/6434)
* [OCPBUGS-111648](https://issues.redhat.com/browse/OCPBUGS-111648): crio: drop restore support [#6412](https://github.com/openshift/machine-config-operator/pull/6412)
* [OCPBUGS-112043](https://issues.redhat.com/browse/OCPBUGS-112043): Preserve proxy environment vars [#6424](https://github.com/openshift/machine-config-operator/pull/6424)
* [OPNET-679](https://issues.redhat.com/browse/OPNET-679): grant NET_ADMIN capability to coredns-monitor [#6449](https://github.com/openshift/machine-config-operator/pull/6449)
* [OCPEDGE-2984](https://issues.redhat.com/browse/OCPEDGE-2984): fix: adjust fencing validator to match MAC-address based credential secrets [#6450](https://github.com/openshift/machine-config-operator/pull/6450)
* [OCPBUGS-112465](https://issues.redhat.com/browse/OCPBUGS-112465): Update the MachineOSBuild event and condition functionality to more clearly handle pod failures with retries [#6431](https://github.com/openshift/machine-config-operator/pull/6431)
* [OCPBUGS-112784](https://issues.redhat.com/browse/OCPBUGS-112784): Revert TNF Graceful node shutdown [#6442](https://github.com/openshift/machine-config-operator/pull/6442)
* [OCPBUGS-105399](https://issues.redhat.com/browse/OCPBUGS-105399): Remove SigstoreImageVerification feature gate references [#6445](https://github.com/openshift/machine-config-operator/pull/6445)
* [OCPBUGS-64623](https://issues.redhat.com/browse/OCPBUGS-64623): Use kubernetes scheme in drain controller event recorder [#6446](https://github.com/openshift/machine-config-operator/pull/6446)
* [OCPNODE-4526](https://issues.redhat.com/browse/OCPNODE-4526): Add '..' block, max-length, and cross-store uniqueness [#6433](https://github.com/openshift/machine-config-operator/pull/6433)
* [OCPBUGS-100065](https://issues.redhat.com/browse/OCPBUGS-100065): on-prem: tune API VIP haproxy health checks [#6400](https://github.com/openshift/machine-config-operator/pull/6400)
* [OCPBUGS-109746](https://issues.redhat.com/browse/OCPBUGS-109746): OCPBUGS-112085: CORS-4441: Bootimage controller should gracefully handle Azure gen1 image removal [#6404](https://github.com/openshift/machine-config-operator/pull/6404)
* NO-ISSUE: Extend timeout for waiting for `UpdatePrepared` MCN condition for SNO resiliency [#6428](https://github.com/openshift/machine-config-operator/pull/6428)
* [OCPBUGS-98258](https://issues.redhat.com/browse/OCPBUGS-98258): Fix upstreams for CoreDNS pods on Cloud platforms [#6383](https://github.com/openshift/machine-config-operator/pull/6383)
* NO-JIRA: Skip OVN-K VRFs in ofport-request dispatcher script [#6398](https://github.com/openshift/machine-config-operator/pull/6398)
* [OCPBUGS-109739](https://issues.redhat.com/browse/OCPBUGS-109739): Increase rpm-ostree rebase retry backoff and preserve error [#6413](https://github.com/openshift/machine-config-operator/pull/6413)
* [OCPBUGS-112075](https://issues.redhat.com/browse/OCPBUGS-112075): skip proxy for OSImageStream discovery in HyperShift [#6420](https://github.com/openshift/machine-config-operator/pull/6420)
* [OCPBUGS-65504](https://issues.redhat.com/browse/OCPBUGS-65504): machine-config ClusterOperator relatedObjects missing ClusterRoleBinding [#6369](https://github.com/openshift/machine-config-operator/pull/6369)
* [AGENT-1570](https://issues.redhat.com/browse/AGENT-1570): Remove all NoRegistryClusterInstall feature gate check [#6396](https://github.com/openshift/machine-config-operator/pull/6396)
* [MCO-2411](https://issues.redhat.com/browse/MCO-2411): Add AWS marketplace AMI band check target [#6365](https://github.com/openshift/machine-config-operator/pull/6365)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/f81aa9cf1d4bb4999a300f0df364f8685fd65d10...328a5db3946d1b024116cef74154ec70f23d5fb3)
### [machine-image-customization-controller](https://github.com/openshift/image-customization-controller/tree/87f4774be1fc58b6b3868c57326a80f95bd81594)
* [OCPBUGS-112616](https://issues.redhat.com/browse/OCPBUGS-112616): Update xz and ignition/v2 with known vulnerabilities [#185](https://github.com/openshift/image-customization-controller/pull/185)
* [OCPBUGS-112617](https://issues.redhat.com/browse/OCPBUGS-112617): Stop accepting IRONIC_AGENT_PULL_SECRET from the envi… [#186](https://github.com/openshift/image-customization-controller/pull/186)
* [Full changelog](https://github.com/openshift/image-customization-controller/compare/e49b096880f17296d42a77443dc14d732683333d...87f4774be1fc58b6b3868c57326a80f95bd81594)
### [machine-os-images](https://github.com/openshift/machine-os-images/tree/3fca30d8f935900603dab36abd6cc4a1e356b693)
* [OKD-465](https://issues.redhat.com/browse/OKD-465): Update Dockerfile installer base to ocp/5.1 [#120](https://github.com/openshift/machine-os-images/pull/120)
* [OCPBUGS-126621](https://issues.redhat.com/browse/OCPBUGS-126621): Select bundled CoreOS version when COREOS_VERSION is unset [#116](https://github.com/openshift/machine-os-images/pull/116)
* [OCPBUGS-112613](https://issues.redhat.com/browse/OCPBUGS-112613): Validate aarch64 ISO checksum after cross-arch extraction [#113](https://github.com/openshift/machine-os-images/pull/113)
* [TRT-2935](https://issues.redhat.com/browse/TRT-2935): Revert machine-os-images PR #110 — fatal aarch64 ISO check crashes metal3 init-container [#112](https://github.com/openshift/machine-os-images/pull/112)
* [OKD-429](https://issues.redhat.com/browse/OKD-429): Fix OKD/SCOS builds to use centos CoreOS streams [#109](https://github.com/openshift/machine-os-images/pull/109)
* [OCPBUGS-112613](https://issues.redhat.com/browse/OCPBUGS-112613): Validate aarch64 ISO checksum after cross-arch extraction [#110](https://github.com/openshift/machine-os-images/pull/110)
* [Full changelog](https://github.com/openshift/machine-os-images/compare/bf618aac93c71a56e8249669c579f0a782742e2e...3fca30d8f935900603dab36abd6cc4a1e356b693)
### [metallb-frr](https://github.com/openshift/frr/tree/567c9101668ad51d96feb15ff121d69d6256fc1a)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#138](https://github.com/openshift/frr/pull/138)
* [OKD-453](https://issues.redhat.com/browse/OKD-453): Dockerfile.openshift: conditionally install frr or frr10 based on OS version [#137](https://github.com/openshift/frr/pull/137)
* [Full changelog](https://github.com/openshift/frr/compare/54a6ea48902d81460536b81ea6bdceb89c12e622...567c9101668ad51d96feb15ff121d69d6256fc1a)
### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/a4c94901209a8f37718a78a69dffc2de8cfe0319)
* NO-JIRA: watch AlertRelabelConfig resource in openshift-monitoring only [#1361](https://github.com/openshift/monitoring-plugin/pull/1361)
* NO-JIRA: Add alerting GET endpoints to OpenAPI [#1344](https://github.com/openshift/monitoring-plugin/pull/1344)
* NO-JIRA: fix: provide SA token to console bridge to access remote dashboards from local dev env [#1351](https://github.com/openshift/monitoring-plugin/pull/1351)
* NO-JIRA: fix: patch vulnerable dependencies [#1318](https://github.com/openshift/monitoring-plugin/pull/1318)
* NO-JIRA: Add alert management API [#1339](https://github.com/openshift/monitoring-plugin/pull/1339)
* [OU-1392](https://issues.redhat.com/browse/OU-1392): fix: parse datetime ranges from the specified format rather than browser specific apis [#1308](https://github.com/openshift/monitoring-plugin/pull/1308)
* [OU-1483](https://issues.redhat.com/browse/OU-1483): automation - perses rbac stability and group permission for all users [#1326](https://github.com/openshift/monitoring-plugin/pull/1326)
* [OU-1600](https://issues.redhat.com/browse/OU-1600): fix: sort agentic runs by created to avoid getting stalled runs related to alerts [#1325](https://github.com/openshift/monitoring-plugin/pull/1325)
* [OU-1436](https://issues.redhat.com/browse/OU-1436): refactor to prepare for alert management [#1324](https://github.com/openshift/monitoring-plugin/pull/1324)
* [OU-1212](https://issues.redhat.com/browse/OU-1212): Create Observability Services landing page [#1289](https://github.com/openshift/monitoring-plugin/pull/1289)
* NO-JIRA: update devspace to sync backend and config changes [#1322](https://github.com/openshift/monitoring-plugin/pull/1322)
* NO-JIRA: prevent importing feature files in shared files [#1323](https://github.com/openshift/monitoring-plugin/pull/1323)
* [OU-1528](https://issues.redhat.com/browse/OU-1528): Swapping namespaces in Alerts optimized [#1305](https://github.com/openshift/monitoring-plugin/pull/1305)
* NO-JIRA: Agent skills consolidated [#1298](https://github.com/openshift/monitoring-plugin/pull/1298)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#1264](https://github.com/openshift/monitoring-plugin/pull/1264)
* NO-JIRA: sanitize runbook_url [#1255](https://github.com/openshift/monitoring-plugin/pull/1255)
* [OU-1150](https://issues.redhat.com/browse/OU-1150): more refactors [#1286](https://github.com/openshift/monitoring-plugin/pull/1286)
* NO-JIRA: duplicate dashboard creates perses project [#1258](https://github.com/openshift/monitoring-plugin/pull/1258)
* [OCPBUGS-123668](https://issues.redhat.com/browse/OCPBUGS-123668): patch adm-zip vulnerable version [#1274](https://github.com/openshift/monitoring-plugin/pull/1274)
* NO-JIRA: feat: migrate to vitest [#1237](https://github.com/openshift/monitoring-plugin/pull/1237)
* [OU-1220](https://issues.redhat.com/browse/OU-1220): Add column to display dashboard id in perses dashboard list page [#1257](https://github.com/openshift/monitoring-plugin/pull/1257)
* [OU-791](https://issues.redhat.com/browse/OU-791): hide Export as CSV link on empty Alerts page [#1251](https://github.com/openshift/monitoring-plugin/pull/1251)
* NO-JIRA: fix(metrics): sync query-browser URL into Redux after navigation [#1238](https://github.com/openshift/monitoring-plugin/pull/1238)
* [OU-1344](https://issues.redhat.com/browse/OU-1344): Add granular permission checks [#1185](https://github.com/openshift/monitoring-plugin/pull/1185)
* NO-JIRA: Pin node 22 and migrate deprecated i18next-parser [#1235](https://github.com/openshift/monitoring-plugin/pull/1235)
* NO-JIRA: use existing env var as a dashboard project in the OLS show time… [#1236](https://github.com/openshift/monitoring-plugin/pull/1236)
* [OU-1147](https://issues.redhat.com/browse/OU-1147): Perses UI Customization. Allow semantic tokens to map correctly with PatternFly themes and modes [#1226](https://github.com/openshift/monitoring-plugin/pull/1226)
* [OU-1472](https://issues.redhat.com/browse/OU-1472): refactor variables [#1224](https://github.com/openshift/monitoring-plugin/pull/1224)
* [OCPBUGS-119714](https://issues.redhat.com/browse/OCPBUGS-119714), [OCPBUGS-119717](https://issues.redhat.com/browse/OCPBUGS-119717): fix: upgrade fast-uri to 3.1.7 [#1234](https://github.com/openshift/monitoring-plugin/pull/1234)
* [OCPBUGS-115456](https://issues.redhat.com/browse/OCPBUGS-115456): fix: upgrade vulnerable dependencies [#1233](https://github.com/openshift/monitoring-plugin/pull/1233)
* [OU-1472](https://issues.redhat.com/browse/OU-1472): lint tags [#1221](https://github.com/openshift/monitoring-plugin/pull/1221)
* [OU-1472](https://issues.redhat.com/browse/OU-1472): perses version upgrade fixes [#1228](https://github.com/openshift/monitoring-plugin/pull/1228)
* [OCPBUGS-114786](https://issues.redhat.com/browse/OCPBUGS-114786), [OCPBUGS-114789](https://issues.redhat.com/browse/OCPBUGS-114789), [OCPBUGS-114792](https://issues.redhat.com/browse/OCPBUGS-114792): fix: upgrade vulnerable fast-uri dependency [#1200](https://github.com/openshift/monitoring-plugin/pull/1200)
* NO-JIRA: Add dchromik to observability-ui aliases [#1230](https://github.com/openshift/monitoring-plugin/pull/1230)
* NO-JIRA: upgrade webpack [#1213](https://github.com/openshift/monitoring-plugin/pull/1213)
* [OCPBUGS-114776](https://issues.redhat.com/browse/OCPBUGS-114776), [OCPBUGS-114795](https://issues.redhat.com/browse/OCPBUGS-114795): fix: upgrade vulnerable dompurify dependency [#1199](https://github.com/openshift/monitoring-plugin/pull/1199)
* [OU-1423](https://issues.redhat.com/browse/OU-1423): fix: adjust perses mui theme to patternfly glass mode [#1195](https://github.com/openshift/monitoring-plugin/pull/1195)
* NO-JIRA: swap perses to ols specific tag for ols testing run [#1194](https://github.com/openshift/monitoring-plugin/pull/1194)
* [OU-1409](https://issues.redhat.com/browse/OU-1409): include the legal disclaimer in the alert actions to agentic runs [#1188](https://github.com/openshift/monitoring-plugin/pull/1188)
* [OU-1417](https://issues.redhat.com/browse/OU-1417): Fix Perses tooltips background color in OCP 5 [#1178](https://github.com/openshift/monitoring-plugin/pull/1178)
* [OLS-3921](https://issues.redhat.com/browse/OLS-3921): disable button shrink [#1186](https://github.com/openshift/monitoring-plugin/pull/1186)
* [OU-1422](https://issues.redhat.com/browse/OU-1422): feat: update perses dependecies to allow to tag the OLS contributed panels [#1045](https://github.com/openshift/monitoring-plugin/pull/1045)
* [OU-1472](https://issues.redhat.com/browse/OU-1472): rename tags to be the same as backend features [#1128](https://github.com/openshift/monitoring-plugin/pull/1128)
* [OU-1471](https://issues.redhat.com/browse/OU-1471): don't throw when listing globaldatasource for fallback [#1153](https://github.com/openshift/monitoring-plugin/pull/1153)
* [OU-1514](https://issues.redhat.com/browse/OU-1514): update useFeatures hook to feature driven backend [#1151](https://github.com/openshift/monitoring-plugin/pull/1151)
* NO-JIRA: chore: organize dev dependencies and avoid cypress binary install [#1148](https://github.com/openshift/monitoring-plugin/pull/1148)
* NO-JIRA: feat: replace outdated react-linkify dependency [#1144](https://github.com/openshift/monitoring-plugin/pull/1144)
* [OU-1472](https://issues.redhat.com/browse/OU-1472): remove incidents feature from backend and tests [#1127](https://github.com/openshift/monitoring-plugin/pull/1127)
* [OU-1107](https://issues.redhat.com/browse/OU-1107), [OU-1108](https://issues.redhat.com/browse/OU-1108): ACM alerting UI with alerts and perses [#1105](https://github.com/openshift/monitoring-plugin/pull/1105)
* And 2 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/ead9ddbe0f08c13ba813004e31506de40586313e...a4c94901209a8f37718a78a69dffc2de8cfe0319)
### [multus-admission-controller](https://github.com/openshift/multus-admission-controller/tree/38e6aaf2312bd7b330b36c30404f3a0f25c1bda0)
* [CORENET-7234](https://issues.redhat.com/browse/CORENET-7234): Update OWNERS file [#118](https://github.com/openshift/multus-admission-controller/pull/118)
* NO-JIRA: Bump to Ginkgo v2 2.33.0 [#142](https://github.com/openshift/multus-admission-controller/pull/142)
* [CORENET-7567](https://issues.redhat.com/browse/CORENET-7567): Add TLS curve preferences configuration support [#143](https://github.com/openshift/multus-admission-controller/pull/143)
* [CORENET-7375](https://issues.redhat.com/browse/CORENET-7375): d/s merge Bump Kubernetes to 1.36.2 and Go to 1.26 [#123](https://github.com/openshift/multus-admission-controller/pull/123)
* [OCPBUGS-112557](https://issues.redhat.com/browse/OCPBUGS-112557): Bump golang.org/x/net to 0.57.0 to fix CVE-2026-33814 [#125](https://github.com/openshift/multus-admission-controller/pull/125)
* [Full changelog](https://github.com/openshift/multus-admission-controller/compare/c0bdec9ce6a1a69985fdba5481c47fb34461eb6c...38e6aaf2312bd7b330b36c30404f3a0f25c1bda0)
### [multus-cni, multus-cni-microshift](https://github.com/openshift/multus-cni/tree/65b175bfbceeb7de7bc4a82d336858d93e30120c)
* [CORENET-7619](https://issues.redhat.com/browse/CORENET-7619): DS Merge 10/12/26 [#370](https://github.com/openshift/multus-cni/pull/370)
* [OCPBUGS-114000](https://issues.redhat.com/browse/OCPBUGS-114000): DS Merge 08/27/2026 [#344](https://github.com/openshift/multus-cni/pull/344)
* [Full changelog](https://github.com/openshift/multus-cni/compare/8f597f4b90dffe1d1cb9aee558fe53a0046c9e35...65b175bfbceeb7de7bc4a82d336858d93e30120c)
### [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy/tree/39e9cccfa32951d0243c99638099da0a84d0d598)
* NO-JIRA: Downstream merge 20260826 [#120](https://github.com/openshift/multus-networkpolicy/pull/120)
* [Full changelog](https://github.com/openshift/multus-networkpolicy/compare/bfbac5025c056c4bf53aeeef50c4bcf466f5eb11...39e9cccfa32951d0243c99638099da0a84d0d598)
### [multus-route-override-cni](https://github.com/openshift/route-override-cni/tree/345809e13769604b88431f4a226c56c7227cadce)
* [CORENET-7631](https://issues.redhat.com/browse/CORENET-7631): Update the minimum Go version [#84](https://github.com/openshift/route-override-cni/pull/84)
* [CORENET-7631](https://issues.redhat.com/browse/CORENET-7631): Bump Kubernetes to 1.37 and Go to 1.26.8 [#83](https://github.com/openshift/route-override-cni/pull/83)
* [CORENET-7237](https://issues.redhat.com/browse/CORENET-7237): Update OWNERS file [#70](https://github.com/openshift/route-override-cni/pull/70)
* [OCPBUGS-83863](https://issues.redhat.com/browse/OCPBUGS-83863): Remove rhel8 build stage [#66](https://github.com/openshift/route-override-cni/pull/66)
* [Full changelog](https://github.com/openshift/route-override-cni/compare/375ac966115fd03febd218a8331e8794560bd28e...345809e13769604b88431f4a226c56c7227cadce)
### [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni/tree/6a6381d869e964d741a551fd869644b0364c5b26)
* [CORENET-7230](https://issues.redhat.com/browse/CORENET-7230): Update OWNERS file [#414](https://github.com/openshift/whereabouts-cni/pull/414)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#430](https://github.com/openshift/whereabouts-cni/pull/430)
* [OCPBUGS-112555](https://issues.redhat.com/browse/OCPBUGS-112555): Fix for CVE-2026-33814 [#418](https://github.com/openshift/whereabouts-cni/pull/418)
* [Full changelog](https://github.com/openshift/whereabouts-cni/compare/4b0c2166726247e36a0125432609844045e48dc3...6a6381d869e964d741a551fd869644b0364c5b26)
### [must-gather](https://github.com/openshift/must-gather/tree/e2487964fe989e4147fc02cede01ea0bc8a6be7c)
* [OCPBUGS-122049](https://issues.redhat.com/browse/OCPBUGS-122049): gather_ppc: collect per-node ethtool channel data [#562](https://github.com/openshift/must-gather/pull/562)
* [WINC-2092](https://issues.redhat.com/browse/WINC-2092): Add windows_exporter log collection [#560](https://github.com/openshift/must-gather/pull/560)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#563](https://github.com/openshift/must-gather/pull/563)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/must-gather/compare/a0ede0ebb91084ab103f8c8921aea5a7a04b73bb...e2487964fe989e4147fc02cede01ea0bc8a6be7c)
### [network-interface-bond-cni](https://github.com/openshift/bond-cni/tree/b8723844dc69940f55208cdb265653ab57f959f0)
* [OCPBUGS-83863](https://issues.redhat.com/browse/OCPBUGS-83863): Remove rhel8 build stage [#113](https://github.com/openshift/bond-cni/pull/113)
* [Full changelog](https://github.com/openshift/bond-cni/compare/2c395f566f259f1a1726409e2472029fa52918c9...b8723844dc69940f55208cdb265653ab57f959f0)
### [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon/tree/f2abba74f88bff66660ab1baa0a7e105ede1f399)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#158](https://github.com/openshift/network-metrics-daemon/pull/158)
* [CORENET-7238](https://issues.redhat.com/browse/CORENET-7238): Update OWNERS file [#145](https://github.com/openshift/network-metrics-daemon/pull/145)
* [OCPBUGS-112553](https://issues.redhat.com/browse/OCPBUGS-112553), [OCPBUGS-112568](https://issues.redhat.com/browse/OCPBUGS-112568): Fix CVE for ose-network-metrics-daemon [#147](https://github.com/openshift/network-metrics-daemon/pull/147)
* [Full changelog](https://github.com/openshift/network-metrics-daemon/compare/20e6b987ea44e7cf0805662e8fec44d625b6f278...f2abba74f88bff66660ab1baa0a7e105ede1f399)
### [network-tools](https://github.com/openshift/network-tools/tree/03ae0e816cbf7608e6a326ac71a0a00619941e08)
* NO-JIRA: Added iperf3 [#189](https://github.com/openshift/network-tools/pull/189)
* [Full changelog](https://github.com/openshift/network-tools/compare/0b53ac3dccf59cd169555bf18c207122374bf003...03ae0e816cbf7608e6a326ac71a0a00619941e08)
### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/8504c88cc43720f26fbc22855e32664bb8a94b5a)
* maintenance: bump cypress-io/github-action from 6 to 7 in the github-actions group [#608](https://github.com/openshift/networking-console-plugin/pull/608)
* [OCPNETUI-80](https://issues.redhat.com/browse/OCPNETUI-80): Migrate to eslint v9 [#488](https://github.com/openshift/networking-console-plugin/pull/488)
* maintenance: bump the npm group with 20 updates [#598](https://github.com/openshift/networking-console-plugin/pull/598)
* [OCPNETUI-140](https://issues.redhat.com/browse/OCPNETUI-140): dependency cleanup [#589](https://github.com/openshift/networking-console-plugin/pull/589)
* [OCPNETUI-140](https://issues.redhat.com/browse/OCPNETUI-140): reassign dev and prod dependencies [#582](https://github.com/openshift/networking-console-plugin/pull/582)
* [OCPNETUI-56](https://issues.redhat.com/browse/OCPNETUI-56): Add hot-cluster E2E workflows, composite actions, and Dockerfile.ci [#497](https://github.com/openshift/networking-console-plugin/pull/497)
* [OCPBUGS-105361](https://issues.redhat.com/browse/OCPBUGS-105361): Create UDN modal now supports secondary UDN creation [#579](https://github.com/openshift/networking-console-plugin/pull/579)
* maintenance: bump the npm group with 26 updates [#575](https://github.com/openshift/networking-console-plugin/pull/575)
* [OCPBUGS-98590](https://issues.redhat.com/browse/OCPBUGS-98590): Added validation to NAD creation pages [#553](https://github.com/openshift/networking-console-plugin/pull/553)
* maintenance: bump the npm group across 1 directory with 17 updates [#563](https://github.com/openshift/networking-console-plugin/pull/563)
* [OCPNETUI-140](https://issues.redhat.com/browse/OCPNETUI-140): Align shared modules with Console [#546](https://github.com/openshift/networking-console-plugin/pull/546)
* [OCPNETUI-140](https://issues.redhat.com/browse/OCPNETUI-140): Extend dependabot ignore list [#545](https://github.com/openshift/networking-console-plugin/pull/545)
* maintenance: bump the npm group across 1 directory with 201 updates [#544](https://github.com/openshift/networking-console-plugin/pull/544)
* maintenance: bump the npm-security group across 1 directory with 10 updates [#521](https://github.com/openshift/networking-console-plugin/pull/521)
* [OCPNETUI-65](https://issues.redhat.com/browse/OCPNETUI-65): Enable dependabot updates on release-5.0 [#524](https://github.com/openshift/networking-console-plugin/pull/524)
* [OCPBUGS-86053](https://issues.redhat.com/browse/OCPBUGS-86053): Fix MultiNetworkPolicy list crash when spec is missing [#523](https://github.com/openshift/networking-console-plugin/pull/523)
* [OCPNETUI-78](https://issues.redhat.com/browse/OCPNETUI-78): Remove unused Dockerfile.art [#516](https://github.com/openshift/networking-console-plugin/pull/516)
* [OCPNETUI-63](https://issues.redhat.com/browse/OCPNETUI-63): Drop unused Helm charts [#473](https://github.com/openshift/networking-console-plugin/pull/473)
* [OCPNETUI-14](https://issues.redhat.com/browse/OCPNETUI-14): Add Cypress E2E tests for network-to-VM cross-navigation [#493](https://github.com/openshift/networking-console-plugin/pull/493)
* [OCPNETUI-65](https://issues.redhat.com/browse/OCPNETUI-65): Add multi-branch dependabot config [#487](https://github.com/openshift/networking-console-plugin/pull/487)
* [CNV-67257](https://issues.redhat.com/browse/CNV-67257): Set physicalNetworkName on OVN localnet NADs created from the console [#477](https://github.com/openshift/networking-console-plugin/pull/477)
* [OCPBUGS-105358](https://issues.redhat.com/browse/OCPBUGS-105358): Fix NAD config generated in form for OVN K8s secondary localnet networks [#496](https://github.com/openshift/networking-console-plugin/pull/496)
* [OCPNETUI-81](https://issues.redhat.com/browse/OCPNETUI-81): Retry fetching from npm registry to unblock OKD build [#494](https://github.com/openshift/networking-console-plugin/pull/494)
* [OCPNETUI-56](https://issues.redhat.com/browse/OCPNETUI-56): Add CI scripts for hot-cluster E2E infrastructure [#489](https://github.com/openshift/networking-console-plugin/pull/489)
* [OCPNETUI-56](https://issues.redhat.com/browse/OCPNETUI-56): Add ci-env-controller Helm chart for test environment lifecycle [#491](https://github.com/openshift/networking-console-plugin/pull/491)
* [OCPNETUI-56](https://issues.redhat.com/browse/OCPNETUI-56): Add ci-test-stack Helm chart for E2E test environments [#490](https://github.com/openshift/networking-console-plugin/pull/490)
* [OCPNETUI-22](https://issues.redhat.com/browse/OCPNETUI-22): Add Cypress E2E tests for Service create and edit form [#480](https://github.com/openshift/networking-console-plugin/pull/480)
* [OCPNETUI-78](https://issues.redhat.com/browse/OCPNETUI-78): Sync Dockerfile and Dockerfile.art [#485](https://github.com/openshift/networking-console-plugin/pull/485)
* [OCPNETUI-59](https://issues.redhat.com/browse/OCPNETUI-59): Add Cypress E2E tests for Service and Route endpoint health [#481](https://github.com/openshift/networking-console-plugin/pull/481)
* [OCPNETUI-66](https://issues.redhat.com/browse/OCPNETUI-66): Drop unused devcontainer config [#474](https://github.com/openshift/networking-console-plugin/pull/474)
* [OCPNETUI-56](https://issues.redhat.com/browse/OCPNETUI-56): Add Cypress test specs and runner scripts [#470](https://github.com/openshift/networking-console-plugin/pull/470)
* [OCPBUGS-113967](https://issues.redhat.com/browse/OCPBUGS-113967): Fix 404 error on MultiNetworkPolicy page when "All projects" is selected [#483](https://github.com/openshift/networking-console-plugin/pull/483)
* [OCPBUGS-91643](https://issues.redhat.com/browse/OCPBUGS-91643): Fixed IP sorting in service overview [#482](https://github.com/openshift/networking-console-plugin/pull/482)
* [OCPBUGS-112660](https://issues.redhat.com/browse/OCPBUGS-112660): Marked strings for i18n in NetworkPolicies list page [#478](https://github.com/openshift/networking-console-plugin/pull/478)
* [OCPBUGS-86249](https://issues.redhat.com/browse/OCPBUGS-86249): fixed edit pod selector [#476](https://github.com/openshift/networking-console-plugin/pull/476)
* [OCPNETUI-56](https://issues.redhat.com/browse/OCPNETUI-56): Add Cypress E2E framework config and support files [#468](https://github.com/openshift/networking-console-plugin/pull/468)
* [OCPNETUI-56](https://issues.redhat.com/browse/OCPNETUI-56): Add Cypress page objects and test constants [#469](https://github.com/openshift/networking-console-plugin/pull/469)
* chore(i18n): update Sprint 1 translations and Memsource CLI skill docs [#471](https://github.com/openshift/networking-console-plugin/pull/471)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/f1b85458ebe27eb262e1750bd59de67986f84111...8504c88cc43720f26fbc22855e32664bb8a94b5a)
### [nutanix-cloud-controller-manager](https://github.com/openshift/cloud-provider-nutanix/tree/eded4633cafeaab62f01736ef6a6115077bebf7c)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#84](https://github.com/openshift/cloud-provider-nutanix/pull/84)
* [OCPBUGS-123772](https://issues.redhat.com/browse/OCPBUGS-123772): Bump golang.org/x/net to v0.58.0 to address CVE-2026-33814 [#85](https://github.com/openshift/cloud-provider-nutanix/pull/85)
* [Full changelog](https://github.com/openshift/cloud-provider-nutanix/compare/dc584c6b2e895a6217f9e2dbed765209af1898a1...eded4633cafeaab62f01736ef6a6115077bebf7c)
### [oauth-apiserver](https://github.com/openshift/oauth-apiserver/tree/dd82b4a7e06ef4c0ad5abc2a7fbbb2882d765b41)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#228](https://github.com/openshift/oauth-apiserver/pull/228)
* [OCPBUGS-108041](https://issues.redhat.com/browse/OCPBUGS-108041): fix CVE-2026-41178 by bumping otel to v1.44.0 [#219](https://github.com/openshift/oauth-apiserver/pull/219)
* [CNTRLPLANE-2260](https://issues.redhat.com/browse/CNTRLPLANE-2260): test migration of tokenreview tests to OTE [#212](https://github.com/openshift/oauth-apiserver/pull/212)
* NO-JIRA: Remove cluster profile directory authentication as it is no longer injected in CI [#217](https://github.com/openshift/oauth-apiserver/pull/217)
* [Full changelog](https://github.com/openshift/oauth-apiserver/compare/bcd5f6fecb809a315e10502b977d2e18a45f756c...dd82b4a7e06ef4c0ad5abc2a7fbbb2882d765b41)
### [oauth-proxy](https://github.com/openshift/oauth-proxy/tree/2c9e613ae807baecb5bbeeb47b567b2e6c47a088)
* NO-JIRA: watcher: fix undying goroutine [#378](https://github.com/openshift/oauth-proxy/pull/378)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#377](https://github.com/openshift/oauth-proxy/pull/377)
* [ACM-37203](https://issues.redhat.com/browse/ACM-37203): Add support for configurable TLS profiles [#372](https://github.com/openshift/oauth-proxy/pull/372)
* [OCPBUGS-115305](https://issues.redhat.com/browse/OCPBUGS-115305): bugfix: rewrite open redirect strings to '/' [#374](https://github.com/openshift/oauth-proxy/pull/374)
* NO-JIRA: Add control-plane-approvers to OWNERS [#373](https://github.com/openshift/oauth-proxy/pull/373)
* [Full changelog](https://github.com/openshift/oauth-proxy/compare/310d2f7b90762b407d6100eb3940bd5b2f348108...2c9e613ae807baecb5bbeeb47b567b2e6c47a088)
### [oauth-server](https://github.com/openshift/oauth-server/tree/0a5bbfdd3e9dd93f46133b92841087995095e09a)
* [OCPBUGS-122888](https://issues.redhat.com/browse/OCPBUGS-122888): Add high contrast support to oauth templates [#262](https://github.com/openshift/oauth-server/pull/262)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#260](https://github.com/openshift/oauth-server/pull/260)
* [OCPBUGS-115307](https://issues.redhat.com/browse/OCPBUGS-115307): bugfix: default to english when Accept-Language header contains more than 1000 underscores [#253](https://github.com/openshift/oauth-server/pull/253)
* [Full changelog](https://github.com/openshift/oauth-server/compare/ba7cdda479958ce73517b546f81ed8d4998d318d...0a5bbfdd3e9dd93f46133b92841087995095e09a)
### [olm-catalogd, olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller/tree/f1fea91342f9317cf0a3c023208849d79030a915)
* NO-ISSUE: Pin controller-runtime to v0.24.1 in tests-extension [#821](https://github.com/openshift/operator-framework-operator-controller/pull/821)
* [OCPBUGS-97746](https://issues.redhat.com/browse/OCPBUGS-97746), [OPRUN-4738](https://issues.redhat.com/browse/OPRUN-4738), [OPRUN-4774](https://issues.redhat.com/browse/OPRUN-4774), [OPRUN-4775](https://issues.redhat.com/browse/OPRUN-4775): Synchronize From Upstream Repositories [#819](https://github.com/openshift/operator-framework-operator-controller/pull/819)
* ocpbugs-115274: fix webhook finalizer flake [#798](https://github.com/openshift/operator-framework-operator-controller/pull/798)
* [OCPBUGS-121303](https://issues.redhat.com/browse/OCPBUGS-121303), [OCPBUGS-121304](https://issues.redhat.com/browse/OCPBUGS-121304): Bump go-git to v5.19.2 [#810](https://github.com/openshift/operator-framework-operator-controller/pull/810)
* [OPRUN-4723](https://issues.redhat.com/browse/OPRUN-4723): Synchronize From Upstream Repositories [#811](https://github.com/openshift/operator-framework-operator-controller/pull/811)
* NO-ISSUE: Synchronize From Upstream Repositories [#791](https://github.com/openshift/operator-framework-operator-controller/pull/791)
* [OCPBUGS-83515](https://issues.redhat.com/browse/OCPBUGS-83515): UPSTREAM: <carry>: use internal shell image for catalog FBC curl Job [#792](https://github.com/openshift/operator-framework-operator-controller/pull/792)
* NO-ISSUE: Synchronize From Upstream Repositories [#790](https://github.com/openshift/operator-framework-operator-controller/pull/790)
* [Full changelog](https://github.com/openshift/operator-framework-operator-controller/compare/49582d3d95fd5e5c8e2d232bf0d5568860514e5d...f1fea91342f9317cf0a3c023208849d79030a915)
### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/34196aabd9e9a3435bbd7824d1f0b5b409264c23)
* [OCPBUGS-108032](https://issues.redhat.com/browse/OCPBUGS-108032): update otel to 1.44.0 to fix CVE-2026-41178 [#684](https://github.com/openshift/openshift-apiserver/pull/684)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/ab0315228cde432c8cd62df012b791a66a72c7b3...34196aabd9e9a3435bbd7824d1f0b5b409264c23)
### [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager/tree/72964318318f2a65e66b766a288b2241e6a6c51e)
* [CNTRLPLANE-4583](https://issues.redhat.com/browse/CNTRLPLANE-4583): bump(k8s.io): 1.37.1 [#462](https://github.com/openshift/openshift-controller-manager/pull/462)
* [CNTRLPLANE-3878](https://issues.redhat.com/browse/CNTRLPLANE-3878): bump(k8s.io): 1.36.3 [#451](https://github.com/openshift/openshift-controller-manager/pull/451)
* [Full changelog](https://github.com/openshift/openshift-controller-manager/compare/726a0562818b68faccfa130ae7ea17ff42915418...72964318318f2a65e66b766a288b2241e6a6c51e)
### [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics/tree/de9762d4058aab05b91e413dc0f700ff9f02431e)
* NO-JIRA: update OWNERS [#140](https://github.com/openshift/openshift-state-metrics/pull/140)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#139](https://github.com/openshift/openshift-state-metrics/pull/139)
* [Full changelog](https://github.com/openshift/openshift-state-metrics/compare/3b4ea3e753d97fea66e0f52c8282a711358b4ff7...de9762d4058aab05b91e413dc0f700ff9f02431e)
### [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack/tree/b8ba789ff1dcc2db5e8a9605eec30258ca815485)
* UPSTREAM-SYNC: Re-baseline main onto clean upstream merge to unblock rebasebot [#446](https://github.com/openshift/cluster-api-provider-openstack/pull/446)
* Fix release 0.14 sync: incomplete vendoring in hack/tools [#433](https://github.com/openshift/cluster-api-provider-openstack/pull/433)
* Fix rebasebot post-rebase hook helper path lookup [#432](https://github.com/openshift/cluster-api-provider-openstack/pull/432)
* Fix rebasebot merge-bot by removing stale API version artifacts [#431](https://github.com/openshift/cluster-api-provider-openstack/pull/431)
* [Full changelog](https://github.com/openshift/cluster-api-provider-openstack/compare/9f64446f441ff7bcebd123a0dc35d4156c309681...b8ba789ff1dcc2db5e8a9605eec30258ca815485)
### [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack/tree/310df6f120009ed6fbb9935556d226ec0b207a1b)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#187](https://github.com/openshift/machine-api-provider-openstack/pull/187)
* [Full changelog](https://github.com/openshift/machine-api-provider-openstack/compare/6b30092b0a1196b016f4300b79c895f0e7f2e9a8...310df6f120009ed6fbb9935556d226ec0b207a1b)
### [openstack-resource-controller](https://github.com/openshift/openstack-resource-controller/tree/642037113b21f8b553ae449ed79888afd46cd006)
* UPSTREAM-SYNC: Merge https://github.com/k-orc/openstack-resource-controller:release-2.0 into main [#40](https://github.com/openshift/openstack-resource-controller/pull/40)
* [Full changelog](https://github.com/openshift/openstack-resource-controller/compare/58dbc0482c144c21effee2476947889122a518eb...642037113b21f8b553ae449ed79888afd46cd006)
### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/14f999ff089a3275d3a144224e871d825461ec3b)
* [OCPBUGS-126127](https://issues.redhat.com/browse/OCPBUGS-126127): test: bump test extension gRPC to v1.83.2 [#1382](https://github.com/openshift/operator-framework-olm/pull/1382)
* NO-ISSUE: add per-scenario PSA compliance audit [#1374](https://github.com/openshift/operator-framework-olm/pull/1374)
* NO-ISSUE: Synchronize From Upstream Repositories [#1361](https://github.com/openshift/operator-framework-olm/pull/1361)
* [OCPBUGS-122255](https://issues.redhat.com/browse/OCPBUGS-122255): tests-extension: fix PolarionID:68521 and Polarion:27680 [#1376](https://github.com/openshift/operator-framework-olm/pull/1376)
* [OCPBUGS-83412](https://issues.redhat.com/browse/OCPBUGS-83412): set catalogsource spec.grpcpodconfig.scc: restricted for all non-legacy cases [#1359](https://github.com/openshift/operator-framework-olm/pull/1359)
* [OCPBUGS-104542](https://issues.redhat.com/browse/OCPBUGS-104542): force node arch for opm and catalogsource pod for multiarch tests; fix test failure [#1357](https://github.com/openshift/operator-framework-olm/pull/1357)
* [OCPBUGS-23954](https://issues.redhat.com/browse/OCPBUGS-23954), [OCPBUGS-78095](https://issues.redhat.com/browse/OCPBUGS-78095): Synchronize From Upstream Repositories [#1355](https://github.com/openshift/operator-framework-olm/pull/1355)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/c3d56d2021bbb8d57bc359fabded3b35b253f55e...14f999ff089a3275d3a144224e871d825461ec3b)
### [operator-marketplace](https://github.com/operator-framework/operator-marketplace/tree/5a7d0ade6d5fae66fca8b5d376f89037a914b499)
* NO-ISSUE: Bump github.com/onsi/gomega from 1.43.1 to 1.44.0 [#797](https://github.com/operator-framework/operator-marketplace/pull/797)
* NO-ISSUE: Bump github.com/onsi/gomega from 1.43.0 to 1.43.1 [#795](https://github.com/operator-framework/operator-marketplace/pull/795)
* NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.32.2 to 2.33.0 [#796](https://github.com/operator-framework/operator-marketplace/pull/796)
* NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.32.1 to 2.32.2 [#794](https://github.com/operator-framework/operator-marketplace/pull/794)
* NO-ISSUE: Bump github.com/onsi/gomega from 1.42.1 to 1.43.0 [#781](https://github.com/operator-framework/operator-marketplace/pull/781)
* NO-ISSUE: Bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 [#779](https://github.com/operator-framework/operator-marketplace/pull/779)
* NO-ISSUE: Bump github.com/stretchr/testify from 1.12.0 to 1.12.1 [#777](https://github.com/operator-framework/operator-marketplace/pull/777)
* NO-ISSUE: Bump the k8s-dependencies group across 1 directory with 3 updates [#776](https://github.com/operator-framework/operator-marketplace/pull/776)
* NO-ISSUE: Bump github.com/sirupsen/logrus from 1.10.0 to 1.10.1 [#778](https://github.com/operator-framework/operator-marketplace/pull/778)
* NO-ISSUE: Bump github.com/sirupsen/logrus from 1.9.4 to 1.10.0 [#774](https://github.com/operator-framework/operator-marketplace/pull/774)
* NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.32.0 to 2.32.1 [#773](https://github.com/operator-framework/operator-marketplace/pull/773)
* [Full changelog](https://github.com/operator-framework/operator-marketplace/compare/fa9e19b2ae7ad8de20b345e3bd736923f5c516cc...5a7d0ade6d5fae66fca8b5d376f89037a914b499)
### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/0de3886bb79aa0db71e17ddc42898f934e43359e)
* [OCPBUGS-128662](https://issues.redhat.com/browse/OCPBUGS-128662): DownStream Merge [10-08-2026] [#3517](https://github.com/openshift/ovn-kubernetes/pull/3517)
* NO-JIRA: DownStream Merge [09-28-2026] [#3479](https://github.com/openshift/ovn-kubernetes/pull/3479)
* [CORENET-7596](https://issues.redhat.com/browse/CORENET-7596), [OCPBUGS-123678](https://issues.redhat.com/browse/OCPBUGS-123678): DownStream Merge [09-23-2026] [#3473](https://github.com/openshift/ovn-kubernetes/pull/3473)
* [CORENET-7572](https://issues.redhat.com/browse/CORENET-7572): DownStream Merge [09-21-2026] [#3465](https://github.com/openshift/ovn-kubernetes/pull/3465)
* [CORENET-7562](https://issues.redhat.com/browse/CORENET-7562), [OCPBUGS-98726](https://issues.redhat.com/browse/OCPBUGS-98726), [OCPBUGS-99645](https://issues.redhat.com/browse/OCPBUGS-99645): DownStream Merge [09-11-2026] [#3439](https://github.com/openshift/ovn-kubernetes/pull/3439)
* [OCPBUGS-112563](https://issues.redhat.com/browse/OCPBUGS-112563), [OCPBUGS-99451](https://issues.redhat.com/browse/OCPBUGS-99451): DownStream Merge [08-31-2026] [#3434](https://github.com/openshift/ovn-kubernetes/pull/3434)
* [CORENET-7467](https://issues.redhat.com/browse/CORENET-7467): run OTE tests only in ovn-kubernetes conformance suites [#3416](https://github.com/openshift/ovn-kubernetes/pull/3416)
* [OCPBUGS-112470](https://issues.redhat.com/browse/OCPBUGS-112470): Register test images using tests extension [#3363](https://github.com/openshift/ovn-kubernetes/pull/3363)
* NO-JIRA: DownStream Merge [08-17-2026] [#3402](https://github.com/openshift/ovn-kubernetes/pull/3402)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/7b4de5ed3bd4381e3a17cdfddbe14be1432b9860...0de3886bb79aa0db71e17ddc42898f934e43359e)
### [powervs-block-csi-driver](https://github.com/openshift/ibm-powervs-block-csi-driver/tree/cfe345c7dd6e7f817927847690658b199c3d1653)
* [MULTIARCH-6346](https://issues.redhat.com/browse/MULTIARCH-6346): Rebase with upstream - go modules updates and code changes [#138](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/138)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver/compare/5911994c5d70906e0f0972411176392ada9942d1...cfe345c7dd6e7f817927847690658b199c3d1653)
### [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/tree/ed2182b2c4bf9fb565aeef5dff5de0f7b9a10a33)
* [STOR-3068](https://issues.redhat.com/browse/STOR-3068): Bump all libraries [#127](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/127)
* [OCPBUGS-127462](https://issues.redhat.com/browse/OCPBUGS-127462): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#124](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/124)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/compare/f90431bfe8ca93850450b2b24fae152d2385ca08...ed2182b2c4bf9fb565aeef5dff5de0f7b9a10a33)
### [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs/tree/d522403fbb37f32b03048b0aef1544abce127f33)
* No-Jira: Update packages in go.mod [#125](https://github.com/openshift/cloud-provider-powervs/pull/125)
* No-Jira: Update packages in go.mod [#114](https://github.com/openshift/cloud-provider-powervs/pull/114)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#109](https://github.com/openshift/cloud-provider-powervs/pull/109)
* No-Jira: Update packages in go.mod [#108](https://github.com/openshift/cloud-provider-powervs/pull/108)
* [Full changelog](https://github.com/openshift/cloud-provider-powervs/compare/18eb5238fb2c86632edb24175f536d815f28ddf6...d522403fbb37f32b03048b0aef1544abce127f33)
### [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs/tree/8a58cd4c8cd3281461a9ddd6b0ccb0615402fe5d)
* [OCPBUGS-127383](https://issues.redhat.com/browse/OCPBUGS-127383): Bump x/net and opentelemetry to address CVEs [#150](https://github.com/openshift/machine-api-provider-powervs/pull/150)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#147](https://github.com/openshift/machine-api-provider-powervs/pull/147)
* [OCPBUGS-112023](https://issues.redhat.com/browse/OCPBUGS-112023): Update dependencies to k8s 1.36 [#146](https://github.com/openshift/machine-api-provider-powervs/pull/146)
* [Full changelog](https://github.com/openshift/machine-api-provider-powervs/compare/28c928ff78def160837170991f084b0fe71ca9be...8a58cd4c8cd3281461a9ddd6b0ccb0615402fe5d)
### [prom-label-proxy](https://github.com/openshift/prom-label-proxy/tree/769aeb6a1dda2d71c5e91ea6cbb8d5f510821135)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#401](https://github.com/openshift/prom-label-proxy/pull/401)
* NO-ISSUE: [bot] Bump openshift/prom-label-proxy to v0.15.1 [#399](https://github.com/openshift/prom-label-proxy/pull/399)
* [Full changelog](https://github.com/openshift/prom-label-proxy/compare/4ab9ff73c665319352288fe0b9b9e1df71832525...769aeb6a1dda2d71c5e91ea6cbb8d5f510821135)
### [prometheus](https://github.com/openshift/prometheus/tree/bd8b9338260ba7cb7c5903abc75e0ea87935df6b)
* NO-ISSUE: [bot] Bump openshift/prometheus to v3.15.0 [#399](https://github.com/openshift/prometheus/pull/399)
* NO-JIRA: update OWNERS [#379](https://github.com/openshift/prometheus/pull/379)
* NO-JIRA: [bot] Bump openshift/prometheus to v3.14.0 [#363](https://github.com/openshift/prometheus/pull/363)
* NO-ISSUE: [bot] Bump openshift/prometheus to v3.14.0 [#361](https://github.com/openshift/prometheus/pull/361)
* [Full changelog](https://github.com/openshift/prometheus/compare/01d8335673aa6f88f5742ef510e133efee88a7bf...bd8b9338260ba7cb7c5903abc75e0ea87935df6b)
### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/f126069d12d76009293a0e1668a5c00425d5d926)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#186](https://github.com/openshift/prometheus-alertmanager/pull/186)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#175](https://github.com/openshift/prometheus-alertmanager/pull/175)
* Bump openshift/prometheus-alertmanager to v0.34.1 [#177](https://github.com/openshift/prometheus-alertmanager/pull/177)
* Bump openshift/prometheus-alertmanager to v0.34.0 [#168](https://github.com/openshift/prometheus-alertmanager/pull/168)
* NO-ISSUE: Remove unused upstream .github/workflows [#167](https://github.com/openshift/prometheus-alertmanager/pull/167)
* [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/89bdff8b5b885e4a3d0f7d0327fe39221f3d2dce...f126069d12d76009293a0e1668a5c00425d5d926)
### [prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator/tree/551af86c1cf232f82140e1c50725d8d3c1df746e)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#405](https://github.com/openshift/prometheus-operator/pull/405)
* [MON-4696](https://issues.redhat.com/browse/MON-4696): Bump openshift/prometheus-operator to v0.94.1 [#403](https://github.com/openshift/prometheus-operator/pull/403)
* [MON-4689](https://issues.redhat.com/browse/MON-4689): Bump openshift/prometheus-operator to v0.94.0 [#400](https://github.com/openshift/prometheus-operator/pull/400)
* NO-ISSUE: [bot] Bump openshift/prometheus-operator to v0.93.1 [#393](https://github.com/openshift/prometheus-operator/pull/393)
* [Full changelog](https://github.com/openshift/prometheus-operator/compare/67895c7c968f42e97efec58f4140fffae4832028...551af86c1cf232f82140e1c50725d8d3c1df746e)
### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/d54be6318c024ab0df5415548ab4deb35d1bab52)
* NO-JIRA: Update OWNERS [#199](https://github.com/openshift/node_exporter/pull/199)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#189](https://github.com/openshift/node_exporter/pull/189)
* NO-ISSUE: [bot] Bump openshift/node_exporter to v1.12.1 [#186](https://github.com/openshift/node_exporter/pull/186)
* [OCPBUGS-100376](https://issues.redhat.com/browse/OCPBUGS-100376): cherry-pick 24c6dce279c418bcb911824e8c8be1c81a1e832b - Fix fibrechannel_linux for ppc64le (#3769) [#184](https://github.com/openshift/node_exporter/pull/184)
* [Full changelog](https://github.com/openshift/node_exporter/compare/b8af472104ce559c8fb9bf31fd4fc38bdbdc34e7...d54be6318c024ab0df5415548ab4deb35d1bab52)
### [route-controller-manager](https://github.com/openshift/route-controller-manager/tree/a158fff7ce3826058bd2d7338b206cdd600d0d40)
* [OCPBUGS-104856](https://issues.redhat.com/browse/OCPBUGS-104856): clear unmanaged-route metric when the route is removed [#102](https://github.com/openshift/route-controller-manager/pull/102)
* [Full changelog](https://github.com/openshift/route-controller-manager/compare/59697cf7af4517dd44e28179a57f7f35b6ea0e22...a158fff7ce3826058bd2d7338b206cdd600d0d40)
### [stream-coreos, stream-coreos-extensions](https://github.com/openshift/os/tree/62965e8043270be3ae4b4568f6f6475ed1804973)
* [OCPBUGS-123732](https://issues.redhat.com/browse/OCPBUGS-123732): Re-enable sandboxed-containers extension for 5.0 [#1971](https://github.com/openshift/os/pull/1971)
* NO-JIRA: Update to track 5.1 [#1964](https://github.com/openshift/os/pull/1964)
* [Full changelog](https://github.com/openshift/os/compare/d2f3751e77c4b79b1553d18758c2ea91f06f51fc...62965e8043270be3ae4b4568f6f6475ed1804973)
### [telemeter](https://github.com/openshift/telemeter/tree/c1db3dc4233dc50dded21357182390188e0fc78e)
* NO-JIRA: split rule tests by recording rule [#630](https://github.com/openshift/telemeter/pull/630)
* NO-JIRA: format Telemeter rule expressions [#628](https://github.com/openshift/telemeter/pull/628)
* NO-ISSUE: tidy up tools/go.mod [#617](https://github.com/openshift/telemeter/pull/617)
* [OCPBUGS-122075](https://issues.redhat.com/browse/OCPBUGS-122075): don't log authorization header [#614](https://github.com/openshift/telemeter/pull/614)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#622](https://github.com/openshift/telemeter/pull/622)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Remove generated Telemeter tools vendor tree [#618](https://github.com/openshift/telemeter/pull/618)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#615](https://github.com/openshift/telemeter/pull/615)
* [OCPBUGS-115550](https://issues.redhat.com/browse/OCPBUGS-115550): Add 'agent-installer-postconfig' install_type [#616](https://github.com/openshift/telemeter/pull/616)
* [BIZ-794](https://issues.redhat.com/browse/BIZ-794): separte managed and self-managed ACM capacity [#612](https://github.com/openshift/telemeter/pull/612)
* [Full changelog](https://github.com/openshift/telemeter/compare/22ba1701333f3fd26490cc15b89ddf21df3f67f6...c1db3dc4233dc50dded21357182390188e0fc78e)
### [tests](https://github.com/openshift/origin/tree/f95ab45b16cf0ae68b7c106c48cd3befd8eaf9fb)
* NO-JIRA: omit skipped tests from high_cpu_e2e_tests autodl data [#31759](https://github.com/openshift/origin/pull/31759)
* [TRT-3020](https://issues.redhat.com/browse/TRT-3020): Report audit request violations as flakes [#31756](https://github.com/openshift/origin/pull/31756)
* NO-JIRA: Remove exception OCPBUGS-85677 [#31734](https://github.com/openshift/origin/pull/31734)
* [OCPQUAL-55](https://issues.redhat.com/browse/OCPQUAL-55): remove static.redhat.com disruption monitor [#31685](https://github.com/openshift/origin/pull/31685)
* [OCPBUGS-129376](https://issues.redhat.com/browse/OCPBUGS-129376): Azure dual-stack load balancers should expose public and internal services over IPv4 and IPv6 [#31716](https://github.com/openshift/origin/pull/31716)
* [OCPNODE-4776](https://issues.redhat.com/browse/OCPNODE-4776): Add Kerberos authentication test plan for OCP 5.1 [#31704](https://github.com/openshift/origin/pull/31704)
* [NETOBSERV-2563](https://issues.redhat.com/browse/NETOBSERV-2563): Add network observability e2e tests [#31342](https://github.com/openshift/origin/pull/31342)
* [OCPEDGE-2985](https://issues.redhat.com/browse/OCPEDGE-2985): Assert PacemakerFencingEvent after real fencing [#31703](https://github.com/openshift/origin/pull/31703)
* [NE-2913](https://issues.redhat.com/browse/NE-2913): Update deprecated HAProxy versions in upgrade test [#31701](https://github.com/openshift/origin/pull/31701)
* [OCPBUGS-130621](https://issues.redhat.com/browse/OCPBUGS-130621): Clean up component proxy login resources [#31729](https://github.com/openshift/origin/pull/31729)
* [OCPBUGS-86789](https://issues.redhat.com/browse/OCPBUGS-86789): Revert "Make early request monitor test informing" [#31590](https://github.com/openshift/origin/pull/31590)
* [OCPBUGS-86789](https://issues.redhat.com/browse/OCPBUGS-86789): Move external ip policy test to disruptive-longrunning [#31638](https://github.com/openshift/origin/pull/31638)
* NO-ISSUE: Automated - Update synthetic test data [#31698](https://github.com/openshift/origin/pull/31698)
* [OCPBUGS-123649](https://issues.redhat.com/browse/OCPBUGS-123649): allow v1beta2 DRA API in discovery test [#31566](https://github.com/openshift/origin/pull/31566)
* [OCPBUGS-129615](https://issues.redhat.com/browse/OCPBUGS-129615): Allow Prometheus auth test to reach console metrics [#31723](https://github.com/openshift/origin/pull/31723)
* NO-JIRA: Document shrink-only retry allowlist policy [#31710](https://github.com/openshift/origin/pull/31710)
* [OCPBUGS-129175](https://issues.redhat.com/browse/OCPBUGS-129175): Handle offline or removed nodes in TNF replacement test [#31708](https://github.com/openshift/origin/pull/31708)
* NO-JIRA: Add cluster-machine-approver OTE suite [#31706](https://github.com/openshift/origin/pull/31706)
* [OCPBUGS-129012](https://issues.redhat.com/browse/OCPBUGS-129012): Parallel SSA ClusterOperator test races with sig-arch operator version check [#31699](https://github.com/openshift/origin/pull/31699)
* NO-ISSUE: Revert "Add CustomResourcePublishOpenAPI conformance test to retry allowlist" [#31694](https://github.com/openshift/origin/pull/31694)
* [OCPQUAL-42](https://issues.redhat.com/browse/OCPQUAL-42): Refresh retry allowlist against 5.0 and 5.1 CI data [#31551](https://github.com/openshift/origin/pull/31551)
* [CNTRLPLANE-3483](https://issues.redhat.com/browse/CNTRLPLANE-3483): Add e2e test Hot reloading changes of the external OIDC configuration [#31678](https://github.com/openshift/origin/pull/31678)
* [OCPBUGS-122386](https://issues.redhat.com/browse/OCPBUGS-122386): e2e-analysis: add --skip-readiness-checks flag for degraded cluster lanes [#31635](https://github.com/openshift/origin/pull/31635)
* NO-ISSUE: Automated - Update synthetic test data [#31682](https://github.com/openshift/origin/pull/31682)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Mirror glibc-dns-testing 2.0.0 for the k8s 1.37 rebase(revert in rebase PR) [#31683](https://github.com/openshift/origin/pull/31683)
* [INTEROP-9204](https://issues.redhat.com/browse/INTEROP-9204): Add --extension-local-binaries flag for local extension binary loading [#31652](https://github.com/openshift/origin/pull/31652)
* trt-2972: use matcher details [#31676](https://github.com/openshift/origin/pull/31676)
* [OCPBUGS-128397](https://issues.redhat.com/browse/OCPBUGS-128397): Skip router verbosity rollout for degraded TNF tests [#31680](https://github.com/openshift/origin/pull/31680)
* [OPCT-460](https://issues.redhat.com/browse/OPCT-460): Increase timeout for external IP policy test to accommodate in-cluster rollouts [#31636](https://github.com/openshift/origin/pull/31636)
* NO-JIRA: Up threshold for mass dns disruption to fail a test based on real world observations [#31674](https://github.com/openshift/origin/pull/31674)
* [CNTRLPLANE-3851](https://issues.redhat.com/browse/CNTRLPLANE-3851): Oauth server proxy config e2e [#31463](https://github.com/openshift/origin/pull/31463)
* [CNTRLPLANE-3474](https://issues.redhat.com/browse/CNTRLPLANE-3474): Add tests for external claims source featuregate [#31591](https://github.com/openshift/origin/pull/31591)
* [OCPBUGS-127184](https://issues.redhat.com/browse/OCPBUGS-127184): Redact OAuth tokens from test cleanup logs [#31640](https://github.com/openshift/origin/pull/31640)
* [STOR-3090](https://issues.redhat.com/browse/STOR-3090): Add CSI storage test for pod delete after host umount of mounted volume [#31488](https://github.com/openshift/origin/pull/31488)
* [OCPBUGS-111056](https://issues.redhat.com/browse/OCPBUGS-111056): Make operator log scraper and monitor tests topology-aware [#31597](https://github.com/openshift/origin/pull/31597)
* [CNTRLPLANE-4303](https://issues.redhat.com/browse/CNTRLPLANE-4303): Add threshold for ote encryption cases [#31658](https://github.com/openshift/origin/pull/31658)
* [OCPBUGS-112722](https://issues.redhat.com/browse/OCPBUGS-112722): make webhook build resolution wait phase-independent [#31655](https://github.com/openshift/origin/pull/31655)
* [OCPBUGS-121385](https://issues.redhat.com/browse/OCPBUGS-121385): Resolve Additional Storage agnhost image through mirror [#31618](https://github.com/openshift/origin/pull/31618)
* [NE-2750](https://issues.redhat.com/browse/NE-2750): implement feature test for GatewayAPIManagementMode [#31503](https://github.com/openshift/origin/pull/31503)
* [OCPEDGE-3076](https://issues.redhat.com/browse/OCPEDGE-3076): Fix TNF kubelet disruption test race condition [#31650](https://github.com/openshift/origin/pull/31650)
* [OCPSTRAT-3661](https://issues.redhat.com/browse/OCPSTRAT-3661): Always emit passing cases for found issues in RBAC monitor test [#31639](https://github.com/openshift/origin/pull/31639)
* NO-ISSUE: Automated - Update synthetic test data [#31607](https://github.com/openshift/origin/pull/31607)
* NO-JIRA: Add a new test for mass DNS disruption [#31625](https://github.com/openshift/origin/pull/31625)
* [OCPBUGS-114022](https://issues.redhat.com/browse/OCPBUGS-114022): Avoid polling skipped Prometheus target namespaces [#31563](https://github.com/openshift/origin/pull/31563)
* [TRT-2830](https://issues.redhat.com/browse/TRT-2830): add REVIEW.md for agentic review responses [#31637](https://github.com/openshift/origin/pull/31637)
* [OCPSTRAT-3661](https://issues.redhat.com/browse/OCPSTRAT-3661): Add Sippy discovered exceptions for RBAC monitor test [#31616](https://github.com/openshift/origin/pull/31616)
* [OCPBUGS-104846](https://issues.redhat.com/browse/OCPBUGS-104846): Filter both [FeatureGate:] and [OCPFeatureGate:] [#31623](https://github.com/openshift/origin/pull/31623)
* [OCPBUGS-121384](https://issues.redhat.com/browse/OCPBUGS-121384): Isolate KubeletEnsureSecretPulledImages test setup [#31619](https://github.com/openshift/origin/pull/31619)
* [OKD-454](https://issues.redhat.com/browse/OKD-454): Skip OKD job name check for cluster-bot launch jobs [#31628](https://github.com/openshift/origin/pull/31628)
* [OCPBUGS-92837](https://issues.redhat.com/browse/OCPBUGS-92837): test/router: wait for all per-route metrics before asserting [#31344](https://github.com/openshift/origin/pull/31344)
* [CORENET-6746](https://issues.redhat.com/browse/CORENET-6746): Allow EgressIP NoMatchingNodeFound events to repeat pathologically [#31614](https://github.com/openshift/origin/pull/31614)
* [OCPBUGS-86789](https://issues.redhat.com/browse/OCPBUGS-86789): Bump network config timeout to 25 minutes [#31599](https://github.com/openshift/origin/pull/31599)
* [CNTRLPLANE-3789](https://issues.redhat.com/browse/CNTRLPLANE-3789): Add e2e tests for authentication component proxy [#31446](https://github.com/openshift/origin/pull/31446)
* [OCPBUGS-84250](https://issues.redhat.com/browse/OCPBUGS-84250): Increase router verbosity in DCM tests [#31555](https://github.com/openshift/origin/pull/31555)
* NO-JIRA: test: poll final EgressFirewall DNS deny assertion [#31473](https://github.com/openshift/origin/pull/31473)
* [OCPBUGS-66213](https://issues.redhat.com/browse/OCPBUGS-66213): add link to jira card [#31609](https://github.com/openshift/origin/pull/31609)
* [NE-2839](https://issues.redhat.com/browse/NE-2839): Add HAProxy version upgrade tests [#31602](https://github.com/openshift/origin/pull/31602)
* [CORENET-7243](https://issues.redhat.com/browse/CORENET-7243): Add TLS Profile Compliance tests for networking components [#31500](https://github.com/openshift/origin/pull/31500)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Fix check in auth test for 1.37 given new NamedAuthorizer behavior [#31574](https://github.com/openshift/origin/pull/31574)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Update etcd test data for k8s 1.37 release [#31605](https://github.com/openshift/origin/pull/31605)
* [METAL-1833](https://issues.redhat.com/browse/METAL-1833): Register cluster-baremetal-tests-ext in extension registry [#31197](https://github.com/openshift/origin/pull/31197)
* [OCPSTRAT-3661](https://issues.redhat.com/browse/OCPSTRAT-3661): Add monitortest to verify possible Cluster Admin escalation paths [#31536](https://github.com/openshift/origin/pull/31536)
* [OCPBUGS-66213](https://issues.redhat.com/browse/OCPBUGS-66213): image registry single replica exceptions [#31544](https://github.com/openshift/origin/pull/31544)
* [OCPBUGS-111997](https://issues.redhat.com/browse/OCPBUGS-111997): Add Degraded=True exception for authentication operator during upgrade [#31535](https://github.com/openshift/origin/pull/31535)
* [TRT-2939](https://issues.redhat.com/browse/TRT-2939): Revert "Merge pull request #31495 from jcmoraisjr/NE-2839-haproxy-version-upgrade-tests" [#31598](https://github.com/openshift/origin/pull/31598)
* [OCPBUGS-77283](https://issues.redhat.com/browse/OCPBUGS-77283): bump kubevirt fedora containerDisk to multi-arch v1.8.2 + permanent exception [#31284](https://github.com/openshift/origin/pull/31284)
* [OCPBUGS-112662](https://issues.redhat.com/browse/OCPBUGS-112662): Fix the number of requests in repeated exec [#31548](https://github.com/openshift/origin/pull/31548)
* [OCPBUGS-115153](https://issues.redhat.com/browse/OCPBUGS-115153): Make extension test-binary extraction architecture-aware [#31579](https://github.com/openshift/origin/pull/31579)
* NO-ISSUE: Automated - Update synthetic test data [#31581](https://github.com/openshift/origin/pull/31581)
* [NE-2839](https://issues.redhat.com/browse/NE-2839): Add HAProxy version upgrade tests [#31495](https://github.com/openshift/origin/pull/31495)
* [OCPBUGS-111643](https://issues.redhat.com/browse/OCPBUGS-111643): Fixed Flakiness of Webhook test - ClusterResourceQuota validation [#31531](https://github.com/openshift/origin/pull/31531)
* [OCPNODE-4470](https://issues.redhat.com/browse/OCPNODE-4470): Add DRA consumable capacity e2e tests [#31448](https://github.com/openshift/origin/pull/31448)
* [OCPBUGS-112390](https://issues.redhat.com/browse/OCPBUGS-112390): Fix node replacement test timestamp filter and allow job retry [#31492](https://github.com/openshift/origin/pull/31492)
* [TRT-2930](https://issues.redhat.com/browse/TRT-2930): skip regional-PD e2e on GCP families without pd-standard [#31572](https://github.com/openshift/origin/pull/31572)
* [ROSAENG-391](https://issues.redhat.com/browse/ROSAENG-391): Add CustomResourcePublishOpenAPI conformance test to retry allowlist [#31552](https://github.com/openshift/origin/pull/31552)
* [OCPBUGS-114341](https://issues.redhat.com/browse/OCPBUGS-114341): Allow KubeDaemonSetRolloutStuck alert on external platform clusters [#31564](https://github.com/openshift/origin/pull/31564)
* [OCPBUGS-111581](https://issues.redhat.com/browse/OCPBUGS-111581): Fix probe termination test to use pod status instead of kubelet event text [#31528](https://github.com/openshift/origin/pull/31528)
* [OCPBUGS-112283](https://issues.redhat.com/browse/OCPBUGS-112283): Allow KubeDaemonSetMisScheduled alert on external platform clusters [#31556](https://github.com/openshift/origin/pull/31556)
* [OCPBUGS-99536](https://issues.redhat.com/browse/OCPBUGS-99536): Raise status polling timeout and write bound [#31534](https://github.com/openshift/origin/pull/31534)
* [OCPBUGS-86257](https://issues.redhat.com/browse/OCPBUGS-86257): Fix pathological events [#31543](https://github.com/openshift/origin/pull/31543)
* [OCPBUGS-105399](https://issues.redhat.com/browse/OCPBUGS-105399), [OCPBUGS-105400](https://issues.redhat.com/browse/OCPBUGS-105400): Remove TechPreview skips and event matchers from sigstore imagepolicy tests [#31521](https://github.com/openshift/origin/pull/31521)
* [CNTRLPLANE-3423](https://issues.redhat.com/browse/CNTRLPLANE-3423): e2e TLS test for service-operator-ca [#31480](https://github.com/openshift/origin/pull/31480)
* [OCPBUGS-112470](https://issues.redhat.com/browse/OCPBUGS-112470): fix duplicate destination tags in openshift-tests images output [#31542](https://github.com/openshift/origin/pull/31542)
* [OCPBUGS-84517](https://issues.redhat.com/browse/OCPBUGS-84517): Remove stale openshift-marketplace terminationMessagePolicy exemption [#31355](https://github.com/openshift/origin/pull/31355)
* [CONSOLE-5188](https://issues.redhat.com/browse/CONSOLE-5188): remove console exceptions [#31280](https://github.com/openshift/origin/pull/31280)
* [OCPBUGS-100298](https://issues.redhat.com/browse/OCPBUGS-100298): pin internal-lb-monitor pollers to worker nodes [#31466](https://github.com/openshift/origin/pull/31466)
* [OCPBUGS-84513](https://issues.redhat.com/browse/OCPBUGS-84513): remove openshift-cluster-version terminationMessagePolicy exemption [#31359](https://github.com/openshift/origin/pull/31359)
* [OCPBUGS-105461](https://issues.redhat.com/browse/OCPBUGS-105461): allow baremetal to progress while MCO does [#31511](https://github.com/openshift/origin/pull/31511)
* [OCPBUGS-105874](https://issues.redhat.com/browse/OCPBUGS-105874): Avoid TLS port-forward to stale endpoints on degraded TNF clusters. [#31502](https://github.com/openshift/origin/pull/31502)
* [OCPBUGS-111704](https://issues.redhat.com/browse/OCPBUGS-111704): router/metrics: enable proxy protocol for client on AWS clusters [#31526](https://github.com/openshift/origin/pull/31526)
* [OCPBUGS-109671](https://issues.redhat.com/browse/OCPBUGS-109671): monitortests: allow image-registry node-ca Progressing on DualReplica [#31517](https://github.com/openshift/origin/pull/31517)
* [CNTRLPLANE-1739](https://issues.redhat.com/browse/CNTRLPLANE-1739): e2e additional tests for pki config [#31491](https://github.com/openshift/origin/pull/31491)
* [OCPBUGS-104561](https://issues.redhat.com/browse/OCPBUGS-104561): test: exclude NTO debug pods from best-effort QoS invariant [#31472](https://github.com/openshift/origin/pull/31472)
* [OCPBUGS-105876](https://issues.redhat.com/browse/OCPBUGS-105876): tolerate brief olm Available=False during upgrades [#31518](https://github.com/openshift/origin/pull/31518)
* NO-JIRA: Remove exception OCPBUGS-66225 [#31471](https://github.com/openshift/origin/pull/31471)
* NO-JIRA: Remove exception OCPBUGS-86009 [#31470](https://github.com/openshift/origin/pull/31470)
* [OCPCLOUD-3420](https://issues.redhat.com/browse/OCPCLOUD-3420): Remove exceptions OCPBUGS-42837 and OCPBUGS-64852 [#31469](https://github.com/openshift/origin/pull/31469)
* [MON-4471](https://issues.redhat.com/browse/MON-4471): test/extended/prometheus: move alert tests to "Test Framework" [#30703](https://github.com/openshift/origin/pull/30703)
* [OCPBUGS-106190](https://issues.redhat.com/browse/OCPBUGS-106190): Make oc rsh test resilient [#31515](https://github.com/openshift/origin/pull/31515)
* [TRT-2898](https://issues.redhat.com/browse/TRT-2898): Fix leaked ClusterRoleBinding in pull_secrets test [#31514](https://github.com/openshift/origin/pull/31514)
* And 5 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/origin/compare/d829b900b99e4d9afc163b14be91a385ed7ea705...f95ab45b16cf0ae68b7c106c48cd3befd8eaf9fb)
### [thanos](https://github.com/openshift/thanos/tree/dd928fe046fcdae5bd0566da9a605bdbe171d0f0)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#215](https://github.com/openshift/thanos/pull/215)
* Bump openshift/thanos to v0.42.4 [#203](https://github.com/openshift/thanos/pull/203)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#206](https://github.com/openshift/thanos/pull/206)
* [OCPBUGS-120744](https://issues.redhat.com/browse/OCPBUGS-120744): bump go.opentelemetry.io/otel to fix CVE-2026-41178 [#204](https://github.com/openshift/thanos/pull/204)
* [Full changelog](https://github.com/openshift/thanos/compare/2a09eb84b92ccd71d5f1f11e0dda6d5aa9624e19...dd928fe046fcdae5bd0566da9a605bdbe171d0f0)
### [volume-data-source-validator](https://github.com/openshift/volume-data-source-validator/tree/74c15812928b59e90bc271d0173130d0e7171eb3)
* NO-JIRA: Add coderabbit config [#23](https://github.com/openshift/volume-data-source-validator/pull/23)
* [OCPBUGS-127004](https://issues.redhat.com/browse/OCPBUGS-127004): Bump golang.org/x/net to version 0.57.0 that fixes CVE-2026-33814 [#17](https://github.com/openshift/volume-data-source-validator/pull/17)
* [Full changelog](https://github.com/openshift/volume-data-source-validator/compare/ee9cd7aba4e096a9a957386ef20777e8950df352...74c15812928b59e90bc271d0173130d0e7171eb3)
### [vsphere-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-vsphere/tree/c228c0a16a2f1f63aa4ba975e6e728c070b8df7d)
* [OCPCLOUD-3691](https://issues.redhat.com/browse/OCPCLOUD-3691): Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.17.0 (2509b8e) into main [#116](https://github.com/openshift/cluster-api-provider-vsphere/pull/116)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#117](https://github.com/openshift/cluster-api-provider-vsphere/pull/117)
* [Full changelog](https://github.com/openshift/cluster-api-provider-vsphere/compare/557fdf1a9a3540d9aa8f3a81e4a950673a416a80...c228c0a16a2f1f63aa4ba975e6e728c070b8df7d)
### [vsphere-csi-driver, vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver/tree/ab0b0520dcc2ac95c5e95cc37c31c1a24ebeb9f3)
* [STOR-3083](https://issues.redhat.com/browse/STOR-3083): Rebase v3.7.3 [#214](https://github.com/openshift/vmware-vsphere-csi-driver/pull/214)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#200](https://github.com/openshift/vmware-vsphere-csi-driver/pull/200)
* [OCPBUGS-122179](https://issues.redhat.com/browse/OCPBUGS-122179): Fix credential exposure in logs (CWE-532) [#199](https://github.com/openshift/vmware-vsphere-csi-driver/pull/199)
* [OCPBUGS-114884](https://issues.redhat.com/browse/OCPBUGS-114884): UPSTREAM: 4272: Fix crash in syncer when node can't be found [#201](https://github.com/openshift/vmware-vsphere-csi-driver/pull/201)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver/compare/6b18bb29fc45383c21aa6c7513d151e443aa305e...ab0b0520dcc2ac95c5e95cc37c31c1a24ebeb9f3)
### [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator/tree/408de115e87d22e4a8cff933e53048db9815bf76)
* [STOR-3068](https://issues.redhat.com/browse/STOR-3068): Bump all libraries [#370](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/370)
* [OCPBUGS-127462](https://issues.redhat.com/browse/OCPBUGS-127462): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#367](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/367)
* [OCPBUGS-113538](https://issues.redhat.com/browse/OCPBUGS-113538): Enable SELinuxMount tests [#362](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/362)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver-operator/compare/aa27946700642a9c8e518e130673097b38a2f8bb...408de115e87d22e4a8cff933e53048db9815bf76)
### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/967ce27a302cbdf5a40647544c73734aa4ffbb56)
* [STOR-3068](https://issues.redhat.com/browse/STOR-3068): Bump all libraries [#249](https://github.com/openshift/vsphere-problem-detector/pull/249)
* [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/14a2d33817c1ddd1d753cc76decea059376e30c9...967ce27a302cbdf5a40647544c73734aa4ffbb56)