# 4.23.0-ec.2

Created: 2026-11-04 08:15:51 +0000 UTC

Image Digest: `sha256:b334da2d94ca52f84f8174598bb6d1d1707e20e8febe0a6bb7a388ce5fd0d466`


## Changes from 4.23.0-ec.1

### Components

* Kubectl 1.36.2
* Kubernetes upgraded from 1.36.3 to 1.36.5
* Kubernetes Tests 1.36.2
* Red Hat Enterprise Linux CoreOS 10.2 upgraded from 10.2.20260918-0 to 10.2.20261027-0



### FeatureGate Changes
| FeatureGate | Default<br/>Hypershift | Default<br/>SelfManagedHA | DevPreviewNoUpgrade<br/>Hypershift | DevPreviewNoUpgrade<br/>SelfManagedHA | OKD<br/>Hypershift | OKD<br/>SelfManagedHA | TechPreviewNoUpgrade<br/>Hypershift | TechPreviewNoUpgrade<br/>SelfManagedHA  |
| :------ | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---:  |
| OLMLifecycleAndCompatibility <br/> (0 tests)| Disabled| Disabled<br/>(Changed)| Disabled| Enabled| Disabled| Disabled<br/>(Changed)| Disabled| Enabled |
| DRADeviceTaintRules <br/> (0 tests)|  |  | Enabled<br/>(New)| Enabled<br/>(New)|  |  | Enabled<br/>(New)| Enabled<br/>(New) |


### Rebuilt images without code change

* [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy) git [d6ec9243](https://github.com/openshift/apiserver-network-proxy/commit/d6ec9243d24050d7d7ad7f939e45f821171f000e) `sha256:170e36a1fea1c97f05afe2dd842f8f09092bb4c37e85dc0e4a764781a7207c7a`
* [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider) git [9b18930d](https://github.com/openshift/aws-encryption-provider/commit/9b18930d2db9521a08faa7165488bdcf6482b9cf) `sha256:b00ed81612d88dd39f211e49eac6c7b39032f62a5424eb7da0e78927374be487`
* [baremetal-operator](https://github.com/openshift/baremetal-operator) git [34bbeb37](https://github.com/openshift/baremetal-operator/commit/34bbeb376836bf01793d4e70d29065d619ebcaa1) `sha256:8e7796d298d26da0383bde2172e24b5cbdd506a26c14e60c85cfedff2ba85feb`
* [cli](https://github.com/openshift/oc) git [4b0a124d](https://github.com/openshift/oc/commit/4b0a124d300cef187037bda6f1b04caa69ab8b62) `sha256:e8c118cca1fde474a533fa52503c756d0cc76c6e55d0c36763d1623c43fd0fcd`
* [cli-artifacts](https://github.com/openshift/oc) git [4b0a124d](https://github.com/openshift/oc/commit/4b0a124d300cef187037bda6f1b04caa69ab8b62) `sha256:092fa39f9d0d048c8914c34557e7bf4a5e310865ee24afd948fe1fddd8bca7d1`
* [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator) git [b187feee](https://github.com/openshift/cloud-credential-operator/commit/b187feee66f4ce0f992059b21a97a2ae88e4cdd9) `sha256:b05b9a8a148952936390e6dc3a6371f3f67e435d1ddb31c7b8dcb6f5088f4ca5`
* [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller) git [7afccf2d](https://github.com/openshift/cloud-network-config-controller/commit/7afccf2d78f6cb5dd3181de1588c5063bd995d7d) `sha256:f96034d3aec3a6744ff39d51e7d0e4b9502777b8e4693d71ff7dfc1102973f64`
* [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler) git [f393f542](https://github.com/openshift/kubernetes-autoscaler/commit/f393f54229e6c3ae74c35ae72012af92d31c03d3) `sha256:e93a63b36eebdd44a407111772dc7fea26275c037a248f3671ee2f76e7f327fc`
* [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator) git [e48fe117](https://github.com/openshift/cluster-autoscaler-operator/commit/e48fe1179ad671757b5a40688e2d125c1f326e8b) `sha256:9d6d54f5028d06c8f994369e57311c3b7608cd43e611374c14ba7371936043c2`
* [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator) git [0da197f8](https://github.com/openshift/cluster-cloud-controller-manager-operator/commit/0da197f80d941f537331f173bc7613d6729a2767) `sha256:b301cc01e609307c7f2c73cdc11d3262488f076e0f02e0ebf96e8733db405690`
* [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator) git [c00cf58d](https://github.com/openshift/cluster-control-plane-machine-set-operator/commit/c00cf58dd81954ca100757f6a2d2af8d84770fd5) `sha256:ca6f90e749b3e5b82cbcffb9f9ed2fe186c0387a2883e855311f93269d5bc765`
* [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator) git [c0ed09e3](https://github.com/openshift/cluster-dns-operator/commit/c0ed09e329e9001629518604a58205e3fbe8284a) `sha256:ac54f853b890253b2cb504d961b3a88aceff30617ed251883832cde7b0a688a9`
* [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator) git [1ee372e7](https://github.com/openshift/cluster-kube-controller-manager-operator/commit/1ee372e7019b41fbcb4c64323142c4a06bf266d0) `sha256:1fa314bf6cbef2d981fcec062a8fe6274ecd26174606db0c263eb80e03895eee`
* [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator) git [e0d271fc](https://github.com/openshift/cluster-kube-scheduler-operator/commit/e0d271fceb3727138177e017f860a8ff79738bb3) `sha256:02a3f2a7a610d421e4968de348cda65eaf1ae1975bdaf47db1388d03dccf38fc`
* [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator) git [228ec940](https://github.com/openshift/cluster-olm-operator/commit/228ec940921e4443b2724ef512c0d211d4a38ba7) `sha256:e67894a34fabd92c5662b09dfca518a5e93be30a51c21dca6cd0c4587052c9dc`
* [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator) git [8da2f1fc](https://github.com/openshift/cluster-openshift-controller-manager-operator/commit/8da2f1fcb1e76e8b1b97b16ca7bbfa7116287eb8) `sha256:e0aa2b8102bb3b13c5312f6fe7c08c973ef6b0d9a9a9b68bb65f43725c45d91e`
* [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller) git [469bbf21](https://github.com/openshift/cluster-policy-controller/commit/469bbf211d35eee0df4422bda7e9e600b080f0f2) `sha256:8e11d5dd33e3188d50eab6d88ccd3daf4e96629efa66eb89611e9f7805e1da5c`
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [9607604d](https://github.com/openshift/cluster-update-keys/commit/9607604d35acee234051bd0da8a14321b4edd38e) `sha256:ed776313ade60cecb54c2fef074031b180524cc6404cec47bcf08758791afb19`
* [console](https://github.com/openshift/console) git [0216b2de](https://github.com/openshift/console/commit/0216b2de8b57c3375fcc161d2c75a031bef72c1b) `sha256:a3b08b48ca0cb2b28d191c79cc931e260f595092fb14bf9fb7f8bb320a2d7b3f`
* [csi-external-attacher](https://github.com/openshift/csi-external-attacher) git [3fd668b3](https://github.com/openshift/csi-external-attacher/commit/3fd668b3f07dd382e5c7b6239d50f7988f652e64) `sha256:ba32e61fbd081614d75414bbc0e3f2e16b6e35a78bd62a574e9663179217899e`
* [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner) git [7ff338c9](https://github.com/openshift/csi-external-provisioner/commit/7ff338c9d1296f0e5d4d8080a76bb191c8f3be30) `sha256:e24e3a575389632c010ef8948fdb17f1761882abf9c56e36f892226275dacb24`
* [csi-external-resizer](https://github.com/openshift/csi-external-resizer) git [14aa7028](https://github.com/openshift/csi-external-resizer/commit/14aa7028f485e95c800bb7ffbf9b66a2bf75ceaf) `sha256:4d5852fef4b1177dd737c536cd0d161b00acb89b3f71f978329c8ca08c0c08a6`
* [csi-external-snapshotter](https://github.com/openshift/csi-external-snapshotter) git [a019d1a9](https://github.com/openshift/csi-external-snapshotter/commit/a019d1a9d9e1d26ffd0b2e0d911733180fa608b2) `sha256:b61893d944eb0e418106489e3106a722cd78c99314275a83054aa05f838aca72`
* [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe) git [cab57d51](https://github.com/openshift/csi-livenessprobe/commit/cab57d511106916bba6953977106f06b2fec01fd) `sha256:a2f38841e63cf42881db209cbb111ec2ec97a0b176a74bdda24cf5399cb3b7ac`
* [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar) git [5766960d](https://github.com/openshift/csi-node-driver-registrar/commit/5766960d82ffb9ef84d15e903ae57d0a6781ef11) `sha256:21c9b5154576d6a32bd7df67325a0e8611cbcee12e7e1a55cbd5de4e93b64d2b`
* [csi-snapshot-controller](https://github.com/openshift/csi-external-snapshotter) git [a019d1a9](https://github.com/openshift/csi-external-snapshotter/commit/a019d1a9d9e1d26ffd0b2e0d911733180fa608b2) `sha256:f0429e25fb4fbc4b2810fdbb1611edf450f33d05ea54ac0b47250ac6fd32cebf`
* [deployer](https://github.com/openshift/oc) git [4b0a124d](https://github.com/openshift/oc/commit/4b0a124d300cef187037bda6f1b04caa69ab8b62) `sha256:3d87f5f6384c4e47ccba5f9a34cd98f13e22f4a6a8fbe48afc2f16b4ea9fe0e9`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [b63b175a](https://github.com/openshift/driver-toolkit/commit/b63b175a79b9fe0c29f6ed63df3c2d7862ba408a) `sha256:0166f92b53181232ef16a42aeedb56f37432cf03429118c026cb2091885c089c`
* [egress-router-cni](https://github.com/openshift/egress-router-cni) git [bc639044](https://github.com/openshift/egress-router-cni/commit/bc639044a3aee89f1f9547ad0539481b8d808516) `sha256:125647debef36dd357d8bcf6d2c84bd3f3b123e781aff196b8054eb44c8e4332`
* [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook) git [4501ff2f](https://github.com/openshift/gcp-workload-identity-federation-webhook/commit/4501ff2f53576c31df0511b69444e65e1eeba745) `sha256:be93b10a978a7ab52aa980b5656fc0d6d975ef91ddc8f06d6e607c88493471f3`
* [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm) git [11bc35dd](https://github.com/openshift/cloud-provider-ibm/commit/11bc35dd6fd5163259023a6f1dfcc59ce813ab5f) `sha256:343d5ecfffec5b96d4b9c407a7a0c9b21f0fadc977b1a219e8bafcffd839fdee`
* [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud) git [2615d13b](https://github.com/openshift/machine-api-provider-ibmcloud/commit/2615d13b730255b21ccb401d3dc039006c54a4fe) `sha256:ec2ccdb1daeaa3cfc476ca66cd75082b6a3563954e3bf1bdb2d4f55b355f0f1f`
* [keepalived-ipfailover](https://github.com/openshift/images) git [3f1cf083](https://github.com/openshift/images/commit/3f1cf0830f196a6755b8baf179fc0401188251c4) `sha256:9c28c54cc90fd8abb0640fa946e74cd66752492ef21c5d1dcac18aef0322d2d1`
* [multus-admission-controller](https://github.com/openshift/multus-admission-controller) git [c0bdec9c](https://github.com/openshift/multus-admission-controller/commit/c0bdec9ce6a1a69985fdba5481c47fb34461eb6c) `sha256:d81b09dd055469b17818ec4e192f3b6ac4aaea2e597ce29868d3e166d071e96f`
* [multus-cni](https://github.com/openshift/multus-cni) git [8f597f4b](https://github.com/openshift/multus-cni/commit/8f597f4b90dffe1d1cb9aee558fe53a0046c9e35) `sha256:1402ce973916e91f7827990c3727f6c3a230514bb6a5b04aa586478401e6fc9c`
* [multus-cni-microshift](https://github.com/openshift/multus-cni) git [8f597f4b](https://github.com/openshift/multus-cni/commit/8f597f4b90dffe1d1cb9aee558fe53a0046c9e35) `sha256:e7c44e99856705889362bdcf65ad0b7c39e4f9eedd8fecdc1de15dc6d493b6c4`
* [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy) git [bfbac502](https://github.com/openshift/multus-networkpolicy/commit/bfbac5025c056c4bf53aeeef50c4bcf466f5eb11) `sha256:20ec99dac2fcc95f49b2a2670dcdfbe726c3ef5f22179a31fbe0394a04df23e8`
* [must-gather](https://github.com/openshift/must-gather) git [f4c72a69](https://github.com/openshift/must-gather/commit/f4c72a69ebedddead25591da3a115bc4b0bc49ca) `sha256:fbd0e4d94846059ff182e74d00961d9e1b3071271552c487b8a241f6a20bde84`
* [network-interface-bond-cni](https://github.com/openshift/bond-cni) git [2c395f56](https://github.com/openshift/bond-cni/commit/2c395f566f259f1a1726409e2472029fa52918c9) `sha256:6dcfc42d9b7dec8008472d0b8ebb15ea2480646bf03ab148939e7e094063397c`
* [network-tools](https://github.com/openshift/network-tools) git [0b53ac3d](https://github.com/openshift/network-tools/commit/0b53ac3dccf59cd169555bf18c207122374bf003) `sha256:e4214091e0a4a7a706b9befdbe49cda975bb0c69166de475ebc617be543b9886`
* [olm-catalogd](https://github.com/openshift/operator-framework-operator-controller) git [49582d3d](https://github.com/openshift/operator-framework-operator-controller/commit/49582d3d95fd5e5c8e2d232bf0d5568860514e5d) `sha256:7023916023703c697523aef4b8f25753f5b4f94af8abb7ffc963a7d460edabd2`
* [olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller) git [49582d3d](https://github.com/openshift/operator-framework-operator-controller/commit/49582d3d95fd5e5c8e2d232bf0d5568860514e5d) `sha256:b8dc8168fe37b9890d5e73f1aa0421e1caf82c8e6b21c2bb9c53856207b08443`
* [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager) git [726a0562](https://github.com/openshift/openshift-controller-manager/commit/726a0562818b68faccfa130ae7ea17ff42915418) `sha256:9dca81eb47c82146d86f3de03e3a6e9ce2abee71ed9212939c382a399f83644d`
* [openstack-resource-controller](https://github.com/openshift/openstack-resource-controller) git [58dbc048](https://github.com/openshift/openstack-resource-controller/commit/58dbc0482c144c21effee2476947889122a518eb) `sha256:b604843937dd0e789cbc66a76e1c3ecc501801e26280f859b34d067414562689`
* [operator-framework-tools](https://github.com/openshift/operator-framework-olm) git [c3d56d20](https://github.com/openshift/operator-framework-olm/commit/c3d56d2021bbb8d57bc359fabded3b35b253f55e) `sha256:3435166feb57a7f43564f94ceddf3505d88ccda025886810893288c75cec8acf`
* [operator-lifecycle-manager](https://github.com/openshift/operator-framework-olm) git [c3d56d20](https://github.com/openshift/operator-framework-olm/commit/c3d56d2021bbb8d57bc359fabded3b35b253f55e) `sha256:4f4ec72c309499d38072871750560f9496e603d76d549b0b775910e3131eabb3`
* [operator-marketplace](https://github.com/operator-framework/operator-marketplace) git [fa9e19b2](https://github.com/operator-framework/operator-marketplace/commit/fa9e19b2ae7ad8de20b345e3bd736923f5c516cc) `sha256:30ee8ec9da22bc7f8b9924d4b8eff44826e005aa907f75905d9ba34039d056fb`
* [operator-registry](https://github.com/openshift/operator-framework-olm) git [c3d56d20](https://github.com/openshift/operator-framework-olm/commit/c3d56d2021bbb8d57bc359fabded3b35b253f55e) `sha256:5c837c29fb989e646e359c274fdb886405d8ad76ebd27386548a37e950c8a6e6`
* [rhel-coreos](https://github.com/openshift/os) git [7324ccd3](https://github.com/openshift/os/commit/7324ccd30e5b2b3146639cb610bfe92c743c91a1) `sha256:354b8d0b3b7fe314b37005642ce0751d0750dfe849a9c3a6c6003c4591b308a9`
* [rhel-coreos-10](https://github.com/openshift/os) git [7324ccd3](https://github.com/openshift/os/commit/7324ccd30e5b2b3146639cb610bfe92c743c91a1) `sha256:44560f741d8e0146688ab04c1713507dbe8dba15921a03d13e203c66a4c449a0`
* [rhel-coreos-10-extensions](https://github.com/openshift/os) git [7324ccd3](https://github.com/openshift/os/commit/7324ccd30e5b2b3146639cb610bfe92c743c91a1) `sha256:404f3cb4723b772bbc3cc204c5e8441960eca5543c48e4bdc745ef00e9ffdb96`
* [rhel-coreos-extensions](https://github.com/openshift/os) git [7324ccd3](https://github.com/openshift/os/commit/7324ccd30e5b2b3146639cb610bfe92c743c91a1) `sha256:e16a1dff317d64b6cf5ba29880c036f65f28bd0fec3780b466a2f21f7dbfbf5d`
* [route-controller-manager](https://github.com/openshift/route-controller-manager) git [59697cf7](https://github.com/openshift/route-controller-manager/commit/59697cf7af4517dd44e28179a57f7f35b6ea0e22) `sha256:429013c592c7f803beec7a828d28bcb911cb307fbd5ae1fca2011fd9712bec80`
* [service-ca-operator](https://github.com/openshift/service-ca-operator) git [ed872ba1](https://github.com/openshift/service-ca-operator/commit/ed872ba14b615ca5726ae90e987268877a0b0b20) `sha256:86d54e82a504a7f596dfd6dabd0c2400410242748afa62b408de9816f6d8a40d`
* [tools](https://github.com/openshift/oc) git [4b0a124d](https://github.com/openshift/oc/commit/4b0a124d300cef187037bda6f1b04caa69ab8b62) `sha256:5839972f51d209594013ccc017facf61d0b405d20806dc4dd27b7cfb7b0ed92c`


### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/25f92c67e44fd08c5f282664cdd569bb8a0f63aa)

* [OCPBUGS-130354](https://issues.redhat.com/browse/OCPBUGS-130354): Add ovnKubernetesConfig to install-config definition- #11116 [#11116](https://github.com/openshift/assisted-service/pull/11116)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#11028](https://github.com/openshift/assisted-service/pull/11028)
* [OCPBUGS-126900](https://issues.redhat.com/browse/OCPBUGS-126900): Allow agent-installer invoker to have a suffix [#10978](https://github.com/openshift/assisted-service/pull/10978)
* [Full changelog](https://github.com/openshift/assisted-service/compare/8177722b388c34c334961352e9ab471ed4f8e95c...25f92c67e44fd08c5f282664cdd569bb8a0f63aa)


### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/cff7ab8663f5e64e86279ef45973f7967e2a2b07)

* [OCPBUGS-133398](https://issues.redhat.com/browse/OCPBUGS-133398): Preserve firstboot network config across OS image replacement [#2487](https://github.com/openshift/assisted-installer/pull/2487)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#2382](https://github.com/openshift/assisted-installer/pull/2382)
* [OCPBUGS-126900](https://issues.redhat.com/browse/OCPBUGS-126900): Allow agent-installer invoker to have a suffix [#2347](https://github.com/openshift/assisted-installer/pull/2347)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/fa7eb52b083a161b122e1c543d487edb3de0955c...cff7ab8663f5e64e86279ef45973f7967e2a2b07)


### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/a75a7c931350d762396c5c7578246b841d9ffaff)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#1664](https://github.com/openshift/assisted-installer-agent/pull/1664)
* [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/b1d92ca20c3a276744861d8fb77745bb8f42ea9a...a75a7c931350d762396c5c7578246b841d9ffaff)


### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/449d4e9e9d2f08330d2d31ad80517caf990652c3)

* [OCPBUGS-127048](https://issues.redhat.com/browse/OCPBUGS-127048): Quote variable expansion in `skopeo inspect` invocation [#354](https://github.com/openshift/agent-installer-utils/pull/354)
* [OCPBUGS-127042](https://issues.redhat.com/browse/OCPBUGS-127042): Refresh rendezvous IP selection list [#353](https://github.com/openshift/agent-installer-utils/pull/353)
* [OCPBUGS-127008](https://issues.redhat.com/browse/OCPBUGS-127008): Fix agent TUI timeout [#350](https://github.com/openshift/agent-installer-utils/pull/350)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/33aa46920190a1c587599dfda77d9c1e3899e255...449d4e9e9d2f08330d2d31ad80517caf990652c3)


### [aws-cloud-controller-manager, aws-cluster-api-controllers, aws-ebs-csi-driver, aws-ebs-csi-driver-operator, aws-machine-controllers, aws-pod-identity-webhook, azure-cloud-controller-manager, azure-cloud-node-manager, azure-cluster-api-controllers, azure-disk-csi-driver, azure-disk-csi-driver-operator, azure-file-csi-driver, azure-file-csi-driver-operator, azure-machine-controllers, azure-workload-identity-webhook, csi-driver-manila, csi-driver-manila-operator, csi-driver-nfs, gcp-cloud-controller-manager, gcp-cluster-api-controllers, gcp-machine-controllers, gcp-pd-csi-driver, gcp-pd-csi-driver-operator, hyperkube, ironic, ironic-agent, ironic-machine-os-downloader, ironic-static-ip-manager, kube-proxy, machine-image-customization-controller, nutanix-cloud-controller-manager, nutanix-machine-controllers, pod, powervs-block-csi-driver, powervs-block-csi-driver-operator, powervs-cloud-controller-manager, powervs-machine-controllers, vsphere-cloud-controller-manager, vsphere-cluster-api-controllers, vsphere-csi-driver, vsphere-csi-driver-operator, vsphere-csi-driver-syncer, vsphere-problem-detector](https://github.com/openshift/kubernetes/tree/b8b2c80fc60865caaa58f565f41d569355f124eb)

* [OCPBUGS-132930](https://issues.redhat.com/browse/OCPBUGS-132930): UPSTREAM: 140661: admission/namespace/lifecycle: allow updates to resources in deleted namespaces [#2828](https://github.com/openshift/kubernetes/pull/2828)
* [OCPBUGS-130593](https://issues.redhat.com/browse/OCPBUGS-130593): [5.0] Deflake pod resize deferred tests [#2818](https://github.com/openshift/kubernetes/pull/2818)
* [OCPBUGS-127122](https://issues.redhat.com/browse/OCPBUGS-127122): UPSTREAM: &lt;carry&gt;: Add needed labels to RHEL pause image [#2810](https://github.com/openshift/kubernetes/pull/2810)
* NO-JIRA: Rebase v1.36.5 in release-5.0 [#2802](https://github.com/openshift/kubernetes/pull/2802)
* UPSTREAM: 142167: Refuse UNC symlink targets in Windows subPath resolution [#2795](https://github.com/openshift/kubernetes/pull/2795)
* NOJIRA: add explicit merge commit message [#2792](https://github.com/openshift/kubernetes/pull/2792)
* [OCPBUGS-127122](https://issues.redhat.com/browse/OCPBUGS-127122): UPSTREAM: &lt;carry&gt;: Use FROM scratch for RHEL pause image [#2786](https://github.com/openshift/kubernetes/pull/2786)
* NO-JIRA: Rebase release-5.0 to Kubernetes v1.36.4 [#2776](https://github.com/openshift/kubernetes/pull/2776)
* [Full changelog](https://github.com/openshift/kubernetes/compare/b376ee7b841bed5a51cb9520b37d87931c48a821...b8b2c80fc60865caaa58f565f41d569355f124eb)


### [aws-karpenter-provider-aws](https://github.com/openshift/aws-karpenter-provider-aws/tree/d8ba4583eda5714f006524d6c05390d55842f830)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#48](https://github.com/openshift/aws-karpenter-provider-aws/pull/48)
* [OCPBUGS-127053](https://issues.redhat.com/browse/OCPBUGS-127053): Align simulated with actual allocatable resources [#47](https://github.com/openshift/aws-karpenter-provider-aws/pull/47)
* [Full changelog](https://github.com/openshift/aws-karpenter-provider-aws/compare/d04b52621a47868d907e986b37a01fcddeb8a23f...d8ba4583eda5714f006524d6c05390d55842f830)


### [aws-node-termination-handler](https://github.com/openshift/aws-node-termination-handler/tree/ed93e0e393ab94fb8286bc0da9f98918d20475a3)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#16](https://github.com/openshift/aws-node-termination-handler/pull/16)
* [Full changelog](https://github.com/openshift/aws-node-termination-handler/compare/9b33cce5107d71df5c65dbca6c08f1f71d9e6e8a...ed93e0e393ab94fb8286bc0da9f98918d20475a3)


### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/9bc8029d8fd9360d18053884db1b806db7defbb2)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#66](https://github.com/openshift/azure-kubernetes-kms/pull/66)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/6409e379fa979104a9515108608c22492bb803a7...9bc8029d8fd9360d18053884db1b806db7defbb2)


### [azure-service-operator](https://github.com/openshift/azure-service-operator/tree/26f483f05301e430d384053862923c40864e755e)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#48](https://github.com/openshift/azure-service-operator/pull/48)
* [Full changelog](https://github.com/openshift/azure-service-operator/compare/0611cd27b9eaa4a1fa8e0ab8ddc85352a61903e0...26f483f05301e430d384053862923c40864e755e)


### [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3/tree/75697aee19c7210714bf9c93cb7dc17da585cb3f)

* [OCPBUGS-96812](https://issues.redhat.com/browse/OCPBUGS-96812): Bump x/net to v0.60.0 [#116](https://github.com/openshift/cluster-api-provider-metal3/pull/116)
* [OCPBUGS-104273](https://issues.redhat.com/browse/OCPBUGS-104273): Bump golang.org/x/net to v0.53.0 [#108](https://github.com/openshift/cluster-api-provider-metal3/pull/108)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#109](https://github.com/openshift/cluster-api-provider-metal3/pull/109)
* [Full changelog](https://github.com/openshift/cluster-api-provider-metal3/compare/ad4f1c2bd7b527437496b71b5b93ee1439243d65...75697aee19c7210714bf9c93cb7dc17da585cb3f)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/8647f26b2920740cea868af125a419d483a277b0)

* [OCPBUGS-132707](https://issues.redhat.com/browse/OCPBUGS-132707): azure: omit empty machine security profiles [#11016](https://github.com/openshift/installer/pull/11016)
* [OCPBUGS-134756](https://issues.redhat.com/browse/OCPBUGS-134756): PowerVC: fix two issues with cherry-pick 10966 [#11037](https://github.com/openshift/installer/pull/11037)
* [OCPBUGS-133316](https://issues.redhat.com/browse/OCPBUGS-133316): PowerVC: Support non admin user [#11020](https://github.com/openshift/installer/pull/11020)
* [OCPBUGS-133520](https://issues.redhat.com/browse/OCPBUGS-133520): Update RHCOS-release-5.0 bootimage metadata to 10.2.20261026-0 / 9.8.20261026-0 [#11025](https://github.com/openshift/installer/pull/11025)
* [OCPBUGS-132355](https://issues.redhat.com/browse/OCPBUGS-132355): unconfigured-ignition must include nmstateconfig.yaml when present [#11012](https://github.com/openshift/installer/pull/11012)
* [OCPBUGS-131972](https://issues.redhat.com/browse/OCPBUGS-131972): support InfraEnv AdditionalNTPSources in unconfigured-ignition [#11001](https://github.com/openshift/installer/pull/11001)
* [OCPBUGS-129582](https://issues.redhat.com/browse/OCPBUGS-129582): Removed PowerVS InstallConfig debug log statement exposing sensitive information [#10955](https://github.com/openshift/installer/pull/10955)
* [OCPBUGS-130584](https://issues.redhat.com/browse/OCPBUGS-130584): Add internalJoinSubnet to installConfigOverrides [#10968](https://github.com/openshift/installer/pull/10968)
* [OCPBUGS-122006](https://issues.redhat.com/browse/OCPBUGS-122006): Warn about ignored install-config fields in ABI [#10861](https://github.com/openshift/installer/pull/10861)
* [OCPBUGS-128501](https://issues.redhat.com/browse/OCPBUGS-128501): gcp: restrict global KMS location check to defaultMachinePlatform [#10929](https://github.com/openshift/installer/pull/10929)
* [OCPBUGS-126592](https://issues.redhat.com/browse/OCPBUGS-126592): Update RHCOS-release-5.0 bootimage metadata to 9.8.20260921-0 / 10.2.20260922-0 [#10923](https://github.com/openshift/installer/pull/10923)
* [OCPBUGS-126900](https://issues.redhat.com/browse/OCPBUGS-126900): use different INSTALL_INVOKER for unconfigured ignition [#10900](https://github.com/openshift/installer/pull/10900)
* [Full changelog](https://github.com/openshift/installer/compare/2060c6b26391f7dacd6fe19920b8b267f5f8f8b9...8647f26b2920740cea868af125a419d483a277b0)


### [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal/tree/7f3bfffd7b7703cd601dbf83f6bfc56a190d017d)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#281](https://github.com/openshift/cluster-api-provider-baremetal/pull/281)
* [OCPBUGS-123652](https://issues.redhat.com/browse/OCPBUGS-123652): Fix race that can provision multiple hosts [#280](https://github.com/openshift/cluster-api-provider-baremetal/pull/280)
* [OCPBUGS-104256](https://issues.redhat.com/browse/OCPBUGS-104256): Bump golang.org/x/net to v0.58.0 to address CVE-2026-33814 [#263](https://github.com/openshift/cluster-api-provider-baremetal/pull/263)
* [Full changelog](https://github.com/openshift/cluster-api-provider-baremetal/compare/f2b0db1919fff1344bc68948894c6775c0bf24a3...7f3bfffd7b7703cd601dbf83f6bfc56a190d017d)


### [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg/tree/3cde69071d3f6d5f2bc79b1cb55e5394021fcbb8)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#416](https://github.com/openshift/baremetal-runtimecfg/pull/416)
* [Full changelog](https://github.com/openshift/baremetal-runtimecfg/compare/3a261a6f4a6211e8f4031611104ced4def436dde...3cde69071d3f6d5f2bc79b1cb55e5394021fcbb8)


### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/5236c5de287346c54131d57fd359b5b4e6aa8f7a)

* [OCPBUGS-127139](https://issues.redhat.com/browse/OCPBUGS-127139): fix CVE-2026-41178 by updating otel to v1.44.0 [#1008](https://github.com/openshift/cluster-authentication-operator/pull/1008)
* [OCPBUGS-127499](https://issues.redhat.com/browse/OCPBUGS-127499): Add high contrast support to oauth templates [#1013](https://github.com/openshift/cluster-authentication-operator/pull/1013)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/848c4c96d8e322b7987e44eecc4ad30e64ce5ed4...5236c5de287346c54131d57fd359b5b4e6aa8f7a)


### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/20369c92cc64521d6937e926d85791fac5dd505a)

* [OCPBUGS-122243](https://issues.redhat.com/browse/OCPBUGS-122243): Make HostPath VolumeMounts ReadOnly for image customization container [#659](https://github.com/openshift/cluster-baremetal-operator/pull/659)
* [OCPBUGS-123600](https://issues.redhat.com/browse/OCPBUGS-123600): Add attach_non_bootable_iso OTE test [#665](https://github.com/openshift/cluster-baremetal-operator/pull/665)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/d7957265fdafbbb93bb2a0d4723fc9719da1378d...20369c92cc64521d6937e926d85791fac5dd505a)


### [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap/tree/ab74989bad5e19d8e137b2175decf4c5b4c1ae22)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#150](https://github.com/openshift/cluster-bootstrap/pull/150)
* [Full changelog](https://github.com/openshift/cluster-bootstrap/compare/9573b4d6ef1638c013cde95ec29ddcc80e10cf87...ab74989bad5e19d8e137b2175decf4c5b4c1ae22)


### [cluster-capi-controllers](https://github.com/openshift/cluster-api/tree/6f2e5dcc9e83873e25772fa7c7e10e99b696bb0d)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#315](https://github.com/openshift/cluster-api/pull/315)
* [OCPBUGS-128250](https://issues.redhat.com/browse/OCPBUGS-128250): UPSTREAM: &lt;carry&gt;: remove redundant GitHub summary verification [#314](https://github.com/openshift/cluster-api/pull/314)
* [Full changelog](https://github.com/openshift/cluster-api/compare/303d9786a5017d299b6e7fc702bb92f5cb4550cf...6f2e5dcc9e83873e25772fa7c7e10e99b696bb0d)


### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/0d06adb94113a8f9bc76b754ae6e906d4020a9d6)

* [OCPBUGS-128732](https://issues.redhat.com/browse/OCPBUGS-128732): add ec2:ModifyInstanceMetadataOptions to AWS CredentialsRequest [#684](https://github.com/openshift/cluster-capi-operator/pull/684)
* [OCPBUGS-128290](https://issues.redhat.com/browse/OCPBUGS-128290): Pass original TLSProfileSpec to security profile watcher [#679](https://github.com/openshift/cluster-capi-operator/pull/679)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/5afa8634c5bd26c8ed12dbecb0c31e79ed2fb39c...0d06adb94113a8f9bc76b754ae6e906d4020a9d6)


### [cluster-config-api](https://github.com/openshift/api/tree/70586205d5fa77e2a47a0373d1ea712c9a3e0b6a)

* [OCPBUGS-112658](https://issues.redhat.com/browse/OCPBUGS-112658): [5.0] enable DRADeviceTaintRules feature gate in TPNU/DevPreview [#3094](https://github.com/openshift/api/pull/3094)
* [OCPBUGS-130323](https://issues.redhat.com/browse/OCPBUGS-130323): Rename console ingress helper type [#3089](https://github.com/openshift/api/pull/3089)
* [OCPBUGS-126809](https://issues.redhat.com/browse/OCPBUGS-126809): Enable OLMLifecycleAndCompatibility by default in version 5+ [#3064](https://github.com/openshift/api/pull/3064)
* [OCPBUGS-123648](https://issues.redhat.com/browse/OCPBUGS-123648): [5.0] register DRADeviceTaintRules in all feature sets [#3040](https://github.com/openshift/api/pull/3040)
* [Full changelog](https://github.com/openshift/api/compare/31af9f93e31ecd483504b3302d78f67c5a077a9e...70586205d5fa77e2a47a0373d1ea712c9a3e0b6a)


### [cluster-config-operator](https://github.com/openshift/cluster-config-operator/tree/66aaee528a6fa29463046e0af51336bb405b8fb8)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#520](https://github.com/openshift/cluster-config-operator/pull/520)
* [Full changelog](https://github.com/openshift/cluster-config-operator/compare/324996d8fff21db132e0c4764600d4720adab4be...66aaee528a6fa29463046e0af51336bb405b8fb8)


### [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator/tree/6b40834f1fa1430c458734d396b39775f1232647)

* [OCPBUGS-128798](https://issues.redhat.com/browse/OCPBUGS-128798): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#300](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/300)
* [Full changelog](https://github.com/openshift/cluster-csi-snapshot-controller-operator/compare/35ec0224eb0e5219d5eae012fb703223a6f3e1f7...6b40834f1fa1430c458734d396b39775f1232647)


### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/dc770522d0076e02bc454d4f53f4c3f8f9e2f0d6)

* [OCPBUGS-133396](https://issues.redhat.com/browse/OCPBUGS-133396): Add TNF ownership for docs/tnf [#1726](https://github.com/openshift/cluster-etcd-operator/pull/1726)
* [OCPBUGS-133381](https://issues.redhat.com/browse/OCPBUGS-133381): force installer revision when external-etcd-pod ConfigMap is created [#1738](https://github.com/openshift/cluster-etcd-operator/pull/1738)
* [OCPBUGS-114736](https://issues.redhat.com/browse/OCPBUGS-114736): [TNF] lifecycle part 2 - update setup deadlock fix & conditions cleanup [#1727](https://github.com/openshift/cluster-etcd-operator/pull/1727)
* [OCPBUGS-128762](https://issues.redhat.com/browse/OCPBUGS-128762): TNF: wait for etcd-bootstrap member removal before setup [#1722](https://github.com/openshift/cluster-etcd-operator/pull/1722)
* [OCPBUGS-127274](https://issues.redhat.com/browse/OCPBUGS-127274): fix(tnf): set read-only root filesystems [#1716](https://github.com/openshift/cluster-etcd-operator/pull/1716)
* [OCPBUGS-127061](https://issues.redhat.com/browse/OCPBUGS-127061): allow TLS 1.3 profiles without ciphers [#1714](https://github.com/openshift/cluster-etcd-operator/pull/1714)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/73835ffac883949ae5fcea3fd9eb0f4076ae711a...dc770522d0076e02bc454d4f53f4c3f8f9e2f0d6)


### [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator/tree/8135895ad26c69d538fb972767350397b479a647)

* [OCPBUGS-128764](https://issues.redhat.com/browse/OCPBUGS-128764): Add 2m degraded inertia to ImagePrunerController [#1383](https://github.com/openshift/cluster-image-registry-operator/pull/1383)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#1380](https://github.com/openshift/cluster-image-registry-operator/pull/1380)
* [OCPBUGS-128565](https://issues.redhat.com/browse/OCPBUGS-128565): Revert "imageconfig: preserve ImageStreamImportMode during upgrade race" [#1381](https://github.com/openshift/cluster-image-registry-operator/pull/1381)
* [Full changelog](https://github.com/openshift/cluster-image-registry-operator/compare/b6d3329d7059adba44dd0c3e9c0e9da264f9a551...8135895ad26c69d538fb972767350397b479a647)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/b6d02a2de548cef873a0da200c8bd1332193e0e3)

* [OCPBUGS-132923](https://issues.redhat.com/browse/OCPBUGS-132923): discover AWS subnets from CAPI with MAPI fallback [#1644](https://github.com/openshift/cluster-ingress-operator/pull/1644)
* [OCPBUGS-129426](https://issues.redhat.com/browse/OCPBUGS-129426): Enable readOnlyRootFilesystem for cluster ingress components [#1610](https://github.com/openshift/cluster-ingress-operator/pull/1610)
* [OCPBUGS-131938](https://issues.redhat.com/browse/OCPBUGS-131938): [OSSM Wave 05] Bump to OSSM 3.4.3 and Istio v1.30.5 [#1625](https://github.com/openshift/cluster-ingress-operator/pull/1625)
* [OCPBUGS-126741](https://issues.redhat.com/browse/OCPBUGS-126741): Bump to OSSM 3.4.2 and Istio v1.30.4 [#1600](https://github.com/openshift/cluster-ingress-operator/pull/1600)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/fe8a2bcf6342fab7aa19c47b4397a7d226962136...b6d02a2de548cef873a0da200c8bd1332193e0e3)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/ec33ea1e2bde9b77b29f12a450bb548980cb5e3d)

* [OCPBUGS-123648](https://issues.redhat.com/browse/OCPBUGS-123648): apienablement: enable resource.k8s.io/v1beta2 when DeviceTaintRule is enabled [#2321](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2321)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/b8c26db7c7c7e49476235ec83b2e81ef0996e242...ec33ea1e2bde9b77b29f12a450bb548980cb5e3d)


### [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/tree/01d7a12d27c2b52c6ece97ec0b60c71fe0e493d3)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#184](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/184)
* [Full changelog](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/compare/ec1db56482efc9dced72b44a1c2b6817dbfffe91...01d7a12d27c2b52c6ece97ec0b60c71fe0e493d3)


### [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver/tree/c7596728b89d7a11750e668f8d8c801f559dfc8f)

* [OCPBUGS-135091](https://issues.redhat.com/browse/OCPBUGS-135091): Add NetworkPolicy manifests to openshift-cluster-machine-approver namespace [#348](https://github.com/openshift/cluster-machine-approver/pull/348)
* [OCPBUGS-128455](https://issues.redhat.com/browse/OCPBUGS-128455): Revert EgressIP validation backport [#338](https://github.com/openshift/cluster-machine-approver/pull/338)
* [OCPBUGS-127107](https://issues.redhat.com/browse/OCPBUGS-127107): fix: retry serving CSRs while Machine addresses populate [#322](https://github.com/openshift/cluster-machine-approver/pull/322)
* [Full changelog](https://github.com/openshift/cluster-machine-approver/compare/11c03d0952f281ca9cfb62e528e5a0e24ae644ab...c7596728b89d7a11750e668f8d8c801f559dfc8f)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/fdd81d5b65b7f83dd3709dffa7f91845765a1369)

* [OCPBUGS-130771](https://issues.redhat.com/browse/OCPBUGS-130771): amcfg: remove client-side TLS enforcement for additional alertmanager configs [#3155](https://github.com/openshift/cluster-monitoring-operator/pull/3155)
* [OCPBUGS-129135](https://issues.redhat.com/browse/OCPBUGS-129135): don't delete admin-owned Alertmanager secrets on destroy [#3137](https://github.com/openshift/cluster-monitoring-operator/pull/3137)
* [OCPBUGS-128817](https://issues.redhat.com/browse/OCPBUGS-128817): filter ciphers not supported by Thanos [#3146](https://github.com/openshift/cluster-monitoring-operator/pull/3146)
* [OCPBUGS-127465](https://issues.redhat.com/browse/OCPBUGS-127465): fix(e2e): use Job with backoffLimit for TestDocExamples [#3104](https://github.com/openshift/cluster-monitoring-operator/pull/3104)
* [OCPBUGS-127422](https://issues.redhat.com/browse/OCPBUGS-127422): Fix flaky TestTelemetryReport/rate_issues [#3098](https://github.com/openshift/cluster-monitoring-operator/pull/3098)
* [OCPBUGS-126958](https://issues.redhat.com/browse/OCPBUGS-126958): restore node-exporter textfile metrics with read-only rootfs [#3096](https://github.com/openshift/cluster-monitoring-operator/pull/3096)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/efeeabf10a9c46f7a82086d2c04c9fc6d93a2b22...fdd81d5b65b7f83dd3709dffa7f91845765a1369)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/df46ddbcc728f5c8372726725f38bc289f4562a0)

* [OCPBUGS-129114](https://issues.redhat.com/browse/OCPBUGS-129114): fix(ovn-kubernetes): disable local DB probes [#3185](https://github.com/openshift/cluster-network-operator/pull/3185)
* [OCPBUGS-130581](https://issues.redhat.com/browse/OCPBUGS-130581): Added global overrides for OVN-Kubernetes [#3191](https://github.com/openshift/cluster-network-operator/pull/3191)
* [OCPBUGS-115004](https://issues.redhat.com/browse/OCPBUGS-115004): Add ConfigMap hash annotation to networking console plugin deployment [#3144](https://github.com/openshift/cluster-network-operator/pull/3144)
* [OCPBUGS-128644](https://issues.redhat.com/browse/OCPBUGS-128644): Fix issues when NetObserv fails to install [#3181](https://github.com/openshift/cluster-network-operator/pull/3181)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/3b484353063fe95156373f7cf51c5ba13f501256...df46ddbcc728f5c8372726725f38bc289f4562a0)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/9e8095860b2d30a6846c084e01fb2dd40335cefe)

* [OCPBUGS-114740](https://issues.redhat.com/browse/OCPBUGS-114740): E2E: Minor fixes to Memory Manager and hugepages split tests [#1622](https://github.com/openshift/cluster-node-tuning-operator/pull/1622)
* [OCPBUGS-129644](https://issues.redhat.com/browse/OCPBUGS-129644): E2E: Add labels to ovsdpdk tests [#1659](https://github.com/openshift/cluster-node-tuning-operator/pull/1659)
* [OCPBUGS-129611](https://issues.redhat.com/browse/OCPBUGS-129611): E2E: Fix no-op Get() assertions in mixedcpus [#1658](https://github.com/openshift/cluster-node-tuning-operator/pull/1658)
* [OCPBUGS-127373](https://issues.redhat.com/browse/OCPBUGS-127373): E2E: ovsDpdk remaining cases and consolidate suite [#1643](https://github.com/openshift/cluster-node-tuning-operator/pull/1643)
* [OCPBUGS-114738](https://issues.redhat.com/browse/OCPBUGS-114738): E2E: Fix ovs dynamic pinning, kubelet and mustgather tests [#1621](https://github.com/openshift/cluster-node-tuning-operator/pull/1621)
* [OCPBUGS-129433](https://issues.redhat.com/browse/OCPBUGS-129433): Makefile: Modify pao-functests-update-only to run tier-0 and tier-1 tests [#1654](https://github.com/openshift/cluster-node-tuning-operator/pull/1654)
* [OCPBUGS-128909](https://issues.redhat.com/browse/OCPBUGS-128909): Prevent offlined CPUs from being re-onlined after reboot by udev hotplug rule [#1648](https://github.com/openshift/cluster-node-tuning-operator/pull/1648)
* [OCPBUGS-128813](https://issues.redhat.com/browse/OCPBUGS-128813): E2E: PPC: replace no-op log-on-match with actual assertions (4 sites) [#1647](https://github.com/openshift/cluster-node-tuning-operator/pull/1647)
* [OCPBUGS-127360](https://issues.redhat.com/browse/OCPBUGS-127360): E2E: add missing matcher to offlined CPU Expect() calls [#1642](https://github.com/openshift/cluster-node-tuning-operator/pull/1642)
* [OCPBUGS-123795](https://issues.redhat.com/browse/OCPBUGS-123795): apis: add missing fields to apis v1 [#1636](https://github.com/openshift/cluster-node-tuning-operator/pull/1636)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/ea084dcf2a92e08a6686e89da49738383bbefd39...9e8095860b2d30a6846c084e01fb2dd40335cefe)


### [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator/tree/02e1e59df526cb1e298220dbb5568e9761f37895)

* [OCPBUGS-127160](https://issues.redhat.com/browse/OCPBUGS-127160): fix CVE-2026-41178 by updating otel to v1.44.0 [#785](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/785)
* [Full changelog](https://github.com/openshift/cluster-openshift-apiserver-operator/compare/d56fffed57ce229b53b4cb1eba63311360051806...02e1e59df526cb1e298220dbb5568e9761f37895)


### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/e7c64303284066d2595be06f7f01502bed12af24)

* [OCPBUGS-128248](https://issues.redhat.com/browse/OCPBUGS-128248): Fix the un-upgradeable message [#747](https://github.com/openshift/cluster-storage-operator/pull/747)
* [OCPBUGS-128798](https://issues.redhat.com/browse/OCPBUGS-128798): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#752](https://github.com/openshift/cluster-storage-operator/pull/752)
* [OCPBUGS-128248](https://issues.redhat.com/browse/OCPBUGS-128248): Use KCS link in the un-upgradeable message [#745](https://github.com/openshift/cluster-storage-operator/pull/745)
* [OCPBUGS-123152](https://issues.redhat.com/browse/OCPBUGS-123152): Backport gcp pd hypershift release 5.0 [#743](https://github.com/openshift/cluster-storage-operator/pull/743)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/b2ee363241ad0425efd56badb6046884cadda97d...e7c64303284066d2595be06f7f01502bed12af24)


### [cluster-update-console-plugin](https://github.com/openshift/cluster-update-console-plugin/tree/24012dd6f536b46e071aa6ebde841abed5a4d3eb)

* [OCPBUGS-129533](https://issues.redhat.com/browse/OCPBUGS-129533): Re-analyse deletes AgenticRun for fresh cluster data [#29](https://github.com/openshift/cluster-update-console-plugin/pull/29)
* NO-JIRA: Fix release-5.0 frontend CI by using node22 build root [#30](https://github.com/openshift/cluster-update-console-plugin/pull/30)
* [Full changelog](https://github.com/openshift/cluster-update-console-plugin/compare/8e684dc03729798295e1b2b059826a5a5abe76c8...24012dd6f536b46e071aa6ebde841abed5a4d3eb)


### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/1749df0facdbe5a8c9661321a67d3a9a902cf202)

* [OCPBUGS-129016](https://issues.redhat.com/browse/OCPBUGS-129016): skip console plugin deployment on OCP &lt; 5.0 [#1481](https://github.com/openshift/cluster-version-operator/pull/1481)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#1479](https://github.com/openshift/cluster-version-operator/pull/1479)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/219aba7debd16c83bb6ccdccf156af921ce54dfe...1749df0facdbe5a8c9661321a67d3a9a902cf202)


### [configmap-reloader](https://github.com/openshift/configmap-reload/tree/4e585cf9bb144a6a1e58004abb33e5bbcc9594e8)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#86](https://github.com/openshift/configmap-reload/pull/86)
* [Full changelog](https://github.com/openshift/configmap-reload/compare/ce80869a83b55ebbdc21a5550ec5747645203bd2...4e585cf9bb144a6a1e58004abb33e5bbcc9594e8)


### [console-operator](https://github.com/openshift/console-operator/tree/be6cdf0e0dbdc6c1ebf8883d51439b55bc282c78)

* [OCPBUGS-130323](https://issues.redhat.com/browse/OCPBUGS-130323): Update API and client-go dependencies for Console ingress helper rename [#1245](https://github.com/openshift/console-operator/pull/1245)
* [OCPBUGS-132033](https://issues.redhat.com/browse/OCPBUGS-132033): Address review feedback on Helm CLI download descriptions [#1243](https://github.com/openshift/console-operator/pull/1243)
* [OCPBUGS-113613](https://issues.redhat.com/browse/OCPBUGS-113613): Handle disabled Ingress capability in HyperShift [#1215](https://github.com/openshift/console-operator/pull/1215)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#1234](https://github.com/openshift/console-operator/pull/1234)
* [Full changelog](https://github.com/openshift/console-operator/compare/630495120bc5ddc9e05cd6defc2102690ced6301...be6cdf0e0dbdc6c1ebf8883d51439b55bc282c78)


### [container-networking-plugins, containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins/tree/23278182eec51396cca07cc1e202898411e2d11d)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#251](https://github.com/openshift/containernetworking-plugins/pull/251)
* NO-JIRA: Fix Go builders in CI [#250](https://github.com/openshift/containernetworking-plugins/pull/250)
* [Full changelog](https://github.com/openshift/containernetworking-plugins/compare/d253ee09d629b8172ffc9c3e4b571320fc63ee34...23278182eec51396cca07cc1e202898411e2d11d)


### [coredns](https://github.com/openshift/coredns/tree/5929cdc03ef425d1db05552589cac0fd4adbd96a)

* [OCPBUGS-133771](https://issues.redhat.com/browse/OCPBUGS-133771): validate DNS requests before unpacking [#222](https://github.com/openshift/coredns/pull/222)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#218](https://github.com/openshift/coredns/pull/218)
* [Full changelog](https://github.com/openshift/coredns/compare/37aaba896e97f4b9a091aab6d36f2213b8854474...5929cdc03ef425d1db05552589cac0fd4adbd96a)


### [csi-external-snapshot-metadata](https://github.com/openshift/csi-external-snapshot-metadata/tree/ce497b1ed7da0b3e9ab51c1cbdc19c54f69361a0)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#31](https://github.com/openshift/csi-external-snapshot-metadata/pull/31)
* [Full changelog](https://github.com/openshift/csi-external-snapshot-metadata/compare/b929f29695d4a1ab21a70868f681d463a673380f...ce497b1ed7da0b3e9ab51c1cbdc19c54f69361a0)


### [docker-builder](https://github.com/openshift/builder/tree/a5718a4f8c8260a997c7f2546b94edd9dcac68aa)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#570](https://github.com/openshift/builder/pull/570)
* [Full changelog](https://github.com/openshift/builder/compare/1e53243554dead3d84297e341651c5eb83eb37a4...a5718a4f8c8260a997c7f2546b94edd9dcac68aa)


### [docker-registry](https://github.com/openshift/image-registry/tree/ab9f84929eee9019fb5aede74316ea321f99e575)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#489](https://github.com/openshift/image-registry/pull/489)
* [Full changelog](https://github.com/openshift/image-registry/compare/9436b2271fc9b687bda31e335bacc4031dcba80a...ab9f84929eee9019fb5aede74316ea321f99e575)


### [etcd](https://github.com/openshift/etcd/tree/7cf5f0dbc98a20dc8b765151ab8b53f3019e3c81)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#418](https://github.com/openshift/etcd/pull/418)
* Update Dockerfile references from golang-1.25 to golang-1.26 [#417](https://github.com/openshift/etcd/pull/417)
* [Full changelog](https://github.com/openshift/etcd/compare/609b11ed8fc404fb95572d7c87e3243a1206cdb7...7cf5f0dbc98a20dc8b765151ab8b53f3019e3c81)


### [haproxy-router, haproxy-router-haproxy28, haproxy-router-haproxy32](https://github.com/openshift/router/tree/a3a92ffb3b2b6f84d6c875a1d0a573a47bbb837c)

* [OCPBUGS-123650](https://issues.redhat.com/browse/OCPBUGS-123650): External certificate routes admit slowly at scale [#873](https://github.com/openshift/router/pull/873)
* [OCPBUGS-123650](https://issues.redhat.com/browse/OCPBUGS-123650): Lock DeleteFunc to stop SARCompleted overwriting rejection [#846](https://github.com/openshift/router/pull/846)
* [Full changelog](https://github.com/openshift/router/compare/3381229146657d2e6bd94115dda0885f25cb3bed...a3a92ffb3b2b6f84d6c875a1d0a573a47bbb837c)


### [hypershift](https://github.com/openshift/hypershift/tree/96caf058a6e24db8a766709b389fbc7a24090bc6)

* [OCPBUGS-134555](https://issues.redhat.com/browse/OCPBUGS-134555): Add periodic resync and reduce backoff ceiling for HCCO resources controller [#10134](https://github.com/openshift/hypershift/pull/10134)
* [OCPBUGS-133415](https://issues.redhat.com/browse/OCPBUGS-133415): Etcd recovery on unreachable nodes [#10101](https://github.com/openshift/hypershift/pull/10101)
* [OCPBUGS-133261](https://issues.redhat.com/browse/OCPBUGS-133261): CVO upgrades stuck in Upgradeable=False (ResourceDeletesInProgress) [#10093](https://github.com/openshift/hypershift/pull/10093)
* [OCPBUGS-133307](https://issues.redhat.com/browse/OCPBUGS-133307): Manage GCP worker firewall rules in CPO [#10096](https://github.com/openshift/hypershift/pull/10096)
* [OCPBUGS-127161](https://issues.redhat.com/browse/OCPBUGS-127161): etcd initialization bugs after etcdctl snapshot restore [#9834](https://github.com/openshift/hypershift/pull/9834)
* [OCPBUGS-131061](https://issues.redhat.com/browse/OCPBUGS-131061): Fix IPv6 endpoint authorities in CPO [#10002](https://github.com/openshift/hypershift/pull/10002)
* [OCPBUGS-130868](https://issues.redhat.com/browse/OCPBUGS-130868): Preserve supplied Unmanaged etcd credentials [#9989](https://github.com/openshift/hypershift/pull/9989)
* [ACM-48074](https://issues.redhat.com/browse/ACM-48074): remove OCP 5.1 from release-5.0 supported versions [#9997](https://github.com/openshift/hypershift/pull/9997)
* [OCPBUGS-128589](https://issues.redhat.com/browse/OCPBUGS-128589): fix(api): add missing + prefix to kubebuilder annotation on networkType [#9906](https://github.com/openshift/hypershift/pull/9906)
* [OCPBUGS-127430](https://issues.redhat.com/browse/OCPBUGS-127430): [5.0] Enable DeviceTaintRule API for hosted clusters [#9914](https://github.com/openshift/hypershift/pull/9914)
* [OCPBUGS-121866](https://issues.redhat.com/browse/OCPBUGS-121866): Generate KubeVirt nmstate network config conditionally [#9894](https://github.com/openshift/hypershift/pull/9894)
* [OCPBUGS-129118](https://issues.redhat.com/browse/OCPBUGS-129118): Count only successful upsert updates [#9899](https://github.com/openshift/hypershift/pull/9899)
* [CNTRLPLANE-4568](https://issues.redhat.com/browse/CNTRLPLANE-4568): add kubeClientQPS and kubeClientBurst to ClusterAutoscaling [#9885](https://github.com/openshift/hypershift/pull/9885)
* [OCPBUGS-128504](https://issues.redhat.com/browse/OCPBUGS-128504): fix: mount combined-pull-secret in OpenShift API Server [#9883](https://github.com/openshift/hypershift/pull/9883)
* [OCPBUGS-128396](https://issues.redhat.com/browse/OCPBUGS-128396): [release-5.0]: fix(globalps): schedule global-pull-secret-syncer on karpenter nodes [#9799](https://github.com/openshift/hypershift/pull/9799)
* [OCPBUGS-127000](https://issues.redhat.com/browse/OCPBUGS-127000): Updating ose-hypershift-container image to be consistent with ART for 5.0 [#9713](https://github.com/openshift/hypershift/pull/9713)
* [OCPBUGS-126441](https://issues.redhat.com/browse/OCPBUGS-126441): openstack: Start populating cacert in clouds.yaml [#9655](https://github.com/openshift/hypershift/pull/9655)
* [OCPBUGS-123155](https://issues.redhat.com/browse/OCPBUGS-123155): complete GCP PD wiring in HyperShift [#9598](https://github.com/openshift/hypershift/pull/9598)
* [ACM-41684](https://issues.redhat.com/browse/ACM-41684): Switch hypershift-operator runtime to PQC base image [#9452](https://github.com/openshift/hypershift/pull/9452)
* [CNTRLPLANE-4159](https://issues.redhat.com/browse/CNTRLPLANE-4159): Maintain ingress serving cert for HostedCluster ingress [#9604](https://github.com/openshift/hypershift/pull/9604)
* [OCPBUGS-122276](https://issues.redhat.com/browse/OCPBUGS-122276): fix(hcco): run kas-connection-checker as non-root [#9694](https://github.com/openshift/hypershift/pull/9694)
* [Full changelog](https://github.com/openshift/hypershift/compare/f17305a432f02f3352c052c717e98db730a6edb4...96caf058a6e24db8a766709b389fbc7a24090bc6)


### [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver/tree/ff30ef526a2be17abd82d9c02f6dae9907c9d3f0)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#170](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/170)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver/compare/3a89d7d17d25727270414b07d3daaa3bc329d743...ff30ef526a2be17abd82d9c02f6dae9907c9d3f0)


### [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/tree/2382f03fcd576f84827d91a72798af01912663f8)

* [OCPBUGS-131837](https://issues.redhat.com/browse/OCPBUGS-131837): disable snapshot tests for ibm-vpc-block-csi-driver [#201](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/201)
* [OCPBUGS-128798](https://issues.redhat.com/browse/OCPBUGS-128798): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#196](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/196)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/compare/be4fd01725ce5ab0b47f846c905a349aeee8ab53...2382f03fcd576f84827d91a72798af01912663f8)


### [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud/tree/76a37f0c259508d3c9d3bf2bead5a8b1953a5c82)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#188](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/188)
* [Full changelog](https://github.com/openshift/cluster-api-provider-ibmcloud/compare/3604a6c42f3002800e5cad2a012aacaf9b5f7405...76a37f0c259508d3c9d3bf2bead5a8b1953a5c82)


### [insights-operator](https://github.com/openshift/insights-operator/tree/63f2a9615b4c49a07da42db1ce713c7154261504)

* [OCPBUGS-123492](https://issues.redhat.com/browse/OCPBUGS-123492): gather InferenceService from the KServe operator [#1366](https://github.com/openshift/insights-operator/pull/1366)
* [OCPBUGS-132682](https://issues.redhat.com/browse/OCPBUGS-132682): add CVO annotations to secret gatherer RBAC- #1399 [#1404](https://github.com/openshift/insights-operator/pull/1404)
* [OCPBUGS-130926](https://issues.redhat.com/browse/OCPBUGS-130926): add permissions to fetch MaasModelRefs [#1391](https://github.com/openshift/insights-operator/pull/1391)
* [OCPBUGS-129610](https://issues.redhat.com/browse/OCPBUGS-129610): gather MaasModelRefs [#1386](https://github.com/openshift/insights-operator/pull/1386)
* [OCPBUGS-114055](https://issues.redhat.com/browse/OCPBUGS-114055): multiclusterhub gatherer [#1361](https://github.com/openshift/insights-operator/pull/1361)
* [OCPBUGS-122039](https://issues.redhat.com/browse/OCPBUGS-122039): add insights-runtime-extractor-scc missing fields [#1363](https://github.com/openshift/insights-operator/pull/1363)
* [Full changelog](https://github.com/openshift/insights-operator/compare/2f616dc436db2e35d70c9a049be98c185f684243...63f2a9615b4c49a07da42db1ce713c7154261504)


### [insights-runtime-exporter, insights-runtime-extractor](https://github.com/openshift/insights-runtime-extractor/tree/0aa20327e590c03afa4cac5ee22efd7935ab4515)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#93](https://github.com/openshift/insights-runtime-extractor/pull/93)
* [Full changelog](https://github.com/openshift/insights-runtime-extractor/compare/7c9aa14915e639edd20bc0869747487e2e73fe51...0aa20327e590c03afa4cac5ee22efd7935ab4515)


### [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server/tree/87f46bcece52a9690a4bf5684448e5ddb721d8e3)

* NO-ISSUE: synchronize OWNERS from main branch [release-5.0] [#87](https://github.com/openshift/kubernetes-metrics-server/pull/87)
* [Full changelog](https://github.com/openshift/kubernetes-metrics-server/compare/3d2e9cd0469d636e32dc0e4d4b6f65957eb27d71...87f46bcece52a9690a4bf5684448e5ddb721d8e3)


### [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy/tree/14b6905aa3accb8bb16cd92f3438a9868597bd52)

* [OCPBUGS-129323](https://issues.redhat.com/browse/OCPBUGS-129323): Address CVE-2026-84304 [#176](https://github.com/openshift/kube-rbac-proxy/pull/176)
* [OCPBUGS-128068](https://issues.redhat.com/browse/OCPBUGS-128068): Bump golang.org/x/net from v0.52.0 to v0.58.0 to resolve CVE-2026-39821 (release-5.0) [#164](https://github.com/openshift/kube-rbac-proxy/pull/164)
* [OCPBUGS-129318](https://issues.redhat.com/browse/OCPBUGS-129318): Address CVE-2026-29181 [#181](https://github.com/openshift/kube-rbac-proxy/pull/181)
* [Full changelog](https://github.com/openshift/kube-rbac-proxy/compare/43c114bc124f59e2fc3223dea8e0a8f4cdeed18d...14b6905aa3accb8bb16cd92f3438a9868597bd52)


### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/f51eb63aea78184f30069ccbeaa2fa346dc9e88d)

* NO-ISSUE: synchronize OWNERS from main branch [release-5.0] [#183](https://github.com/openshift/kube-state-metrics/pull/183)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#170](https://github.com/openshift/kube-state-metrics/pull/170)
* [Full changelog](https://github.com/openshift/kube-state-metrics/compare/019ecc7d533333dfd3bf8893e78cd7ec6e282f01...f51eb63aea78184f30069ccbeaa2fa346dc9e88d)


### [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator/tree/87fa52c72bb3245c90ba1dc3b0e3c02224c6b27b)

* [OCPBUGS-104371](https://issues.redhat.com/browse/OCPBUGS-104371): Bump golang.org/x/net to v0.55.0 to address CVE-2026-33814 [#258](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/258)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#264](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/264)
* [Full changelog](https://github.com/openshift/kubernetes-kube-storage-version-migrator/compare/05d6b0c4537954b2b115c793646fb598756bb303...87fa52c72bb3245c90ba1dc3b0e3c02224c6b27b)


### [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt/tree/1dcf1ec97896555d9cf2594c638d8779692e29e0)

* [OCPBUGS-104361](https://issues.redhat.com/browse/OCPBUGS-104361): Fix CVE-2026-33814 - bump golang.org/x/net to sustaining fork v0.50.0-sec.4 [#101](https://github.com/openshift/cloud-provider-kubevirt/pull/101)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#99](https://github.com/openshift/cloud-provider-kubevirt/pull/99)
* [Full changelog](https://github.com/openshift/cloud-provider-kubevirt/compare/5eb884abcd2ff17ae8d7b2691ca12494597c08a6...1dcf1ec97896555d9cf2594c638d8779692e29e0)


### [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver/tree/05905d2f805968e1c86cb97b2be1440590a48ef3)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#120](https://github.com/openshift/kubevirt-csi-driver/pull/120)
* [Full changelog](https://github.com/openshift/kubevirt-csi-driver/compare/00dd0030fdfcdb6937ebefd8fb92363a8f78ef73...05905d2f805968e1c86cb97b2be1440590a48ef3)


### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/fcb64975b70e848f193ffd8e9beb1b2a413d84d1)

* [OCPBUGS-130795](https://issues.redhat.com/browse/OCPBUGS-130795): remove GCP boot disk image defaulting from admission webhook [#1582](https://github.com/openshift/machine-api-operator/pull/1582)
* [OCPBUGS-130795](https://issues.redhat.com/browse/OCPBUGS-130795): add RBAC for GCP boot image resolution [#1581](https://github.com/openshift/machine-api-operator/pull/1581)
* [OCPBUGS-129504](https://issues.redhat.com/browse/OCPBUGS-129504): fix race in VAP MachineSet e2e test cleanup [#1575](https://github.com/openshift/machine-api-operator/pull/1575)
* [OCPBUGS-128566](https://issues.redhat.com/browse/OCPBUGS-128566): [release-5.0] Reduce vCenter API load in the vSphere machine controller [#1566](https://github.com/openshift/machine-api-operator/pull/1566)
* [OCPBUGS-125793](https://issues.redhat.com/browse/OCPBUGS-125793): Add opt-in kube-rbac-proxy sidecar for pprof endpoint (AWS) [#1556](https://github.com/openshift/machine-api-operator/pull/1556)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/b3cabb0301b12a2b256bf8aed85c3f4c7b0dab3c...fcb64975b70e848f193ffd8e9beb1b2a413d84d1)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/68ac8c527bc629ae3ef6f73d43697fd116c55b6a)

* [OCPBUGS-134739](https://issues.redhat.com/browse/OCPBUGS-134739): Fix MCN stale current config edge case [#6693](https://github.com/openshift/machine-config-operator/pull/6693)
* [OCPBUGS-133366](https://issues.redhat.com/browse/OCPBUGS-133366): Add `machineconfignode`, `pinnedimageset`, `machineosconfig`, `machineosbuild`, and `osimagestream`  resources to `relatedObjects` [#6680](https://github.com/openshift/machine-config-operator/pull/6680)
* [OCPBUGS-133334](https://issues.redhat.com/browse/OCPBUGS-133334): stabilize test 66436 - disable weak SSH cipher suites [#6678](https://github.com/openshift/machine-config-operator/pull/6678)
* [OCPBUGS-131014](https://issues.redhat.com/browse/OCPBUGS-131014): MCD fails to rollback from OCL to stock RHCOS when extensions are installed [#6654](https://github.com/openshift/machine-config-operator/pull/6654)
* [OCPBUGS-127483](https://issues.redhat.com/browse/OCPBUGS-127483): Split wait-for-ipsec-connect into two services to avoid ipsec restart [#6583](https://github.com/openshift/machine-config-operator/pull/6583)
* [OCPBUGS-132359](https://issues.redhat.com/browse/OCPBUGS-132359): only enable signed policy when testing … [#6667](https://github.com/openshift/machine-config-operator/pull/6667)
* [OCPBUGS-131619](https://issues.redhat.com/browse/OCPBUGS-131619): Increase timeout for `ImagePulledFromRegistry=Unknown` transition in ImageModeStatusReporting test [#6660](https://github.com/openshift/machine-config-operator/pull/6660)
* [OCPBUGS-130888](https://issues.redhat.com/browse/OCPBUGS-130888): Update cleanup for test `PolarionID:84219` to wait for node to be removed [#6653](https://github.com/openshift/machine-config-operator/pull/6653)
* [OCPBUGS-128536](https://issues.redhat.com/browse/OCPBUGS-128536): Revert "OCPBUGS-91746: temporarily remove sandboxed-containers from extensions test" and "OCPBUGS-91746: Remove sandboxed-containers (kata-containers) from extended-priv tests" [#6597](https://github.com/openshift/machine-config-operator/pull/6597)
* [OCPBUGS-129537](https://issues.redhat.com/browse/OCPBUGS-129537): Remove reverse (rhel10 to rhel9) OSStreams upgrade tests [#6639](https://github.com/openshift/machine-config-operator/pull/6639)
* [OCPBUGS-129431](https://issues.redhat.com/browse/OCPBUGS-129431): logout vCenter clients after use [#6635](https://github.com/openshift/machine-config-operator/pull/6635)
* [OCPBUGS-129374](https://issues.redhat.com/browse/OCPBUGS-129374): Fix layered OS updates on older nodes [#6632](https://github.com/openshift/machine-config-operator/pull/6632)
* [OCPBUGS-129269](https://issues.redhat.com/browse/OCPBUGS-129269): Boot image controller skips MachineSets that don't match any failure domain [#6628](https://github.com/openshift/machine-config-operator/pull/6628)
* [OCPBUGS-128927](https://issues.redhat.com/browse/OCPBUGS-128927): Filter cosign signature tags from the IRI release lookup [#6615](https://github.com/openshift/machine-config-operator/pull/6615)
* [OCPBUGS-127192](https://issues.redhat.com/browse/OCPBUGS-127192): Run nmstatectl format in nmstate-configuration [#6572](https://github.com/openshift/machine-config-operator/pull/6572)
* [OCPBUGS-127447](https://issues.redhat.com/browse/OCPBUGS-127447): Nodes created with 4.13 base images cannot join the cluster [#6580](https://github.com/openshift/machine-config-operator/pull/6580)
* [OCPBUGS-119104](https://issues.redhat.com/browse/OCPBUGS-119104): drop GCD health-check ranges in openshift-gcp-routes [#6555](https://github.com/openshift/machine-config-operator/pull/6555)
* [OCPBUGS-123664](https://issues.redhat.com/browse/OCPBUGS-123664): Correctly handle MC deletion in image mode when no new build is required [#6546](https://github.com/openshift/machine-config-operator/pull/6546)
* [OCPBUGS-122277](https://issues.redhat.com/browse/OCPBUGS-122277): Fix IsBootImageUpdateSupported to include vSphere and Azure platforms [#6530](https://github.com/openshift/machine-config-operator/pull/6530)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/ea7d971717f7c6fac339f5cf4ffbbccb23234edc...68ac8c527bc629ae3ef6f73d43697fd116c55b6a)


### [machine-os-images](https://github.com/openshift/machine-os-images/tree/631d5def9be9903585e92dcde6a877362f12586b)

* [OCPBUGS-127128](https://issues.redhat.com/browse/OCPBUGS-127128): [release-5.0] Fix OKD/SCOS builds to use centos CoreOS streams [#119](https://github.com/openshift/machine-os-images/pull/119)
* [Full changelog](https://github.com/openshift/machine-os-images/compare/bf618aac93c71a56e8249669c579f0a782742e2e...631d5def9be9903585e92dcde6a877362f12586b)


### [metallb-frr](https://github.com/openshift/frr/tree/f47b9e073cb4dc03d0b4259d711a156052185044)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#139](https://github.com/openshift/frr/pull/139)
* [Full changelog](https://github.com/openshift/frr/compare/54a6ea48902d81460536b81ea6bdceb89c12e622...f47b9e073cb4dc03d0b4259d711a156052185044)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/c243b5a09dbd8fec17ab115e416f15c7e96c10fc)

* [OU-1589](https://issues.redhat.com/browse/OU-1589): [release-5.0] sanitize linkified URLs in alert annotations [#1383](https://github.com/openshift/monitoring-plugin/pull/1383)
* [OCPBUGS-132867](https://issues.redhat.com/browse/OCPBUGS-132867): fix metrics series color squares [#1375](https://github.com/openshift/monitoring-plugin/pull/1375)
* [OU-1392](https://issues.redhat.com/browse/OU-1392): [release-5.0] fix: parse datetime ranges from the specified format rather than browser specific apis [#1348](https://github.com/openshift/monitoring-plugin/pull/1348)
* [OCPBUGS-119704](https://issues.redhat.com/browse/OCPBUGS-119704): Bump fast-uri to fix CVE-2026-84292 [#1332](https://github.com/openshift/monitoring-plugin/pull/1332)
* [OU-1600](https://issues.redhat.com/browse/OU-1600): fix: sort agentic runs by created to avoid getting stalled runs related to alerts [#1327](https://github.com/openshift/monitoring-plugin/pull/1327)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#1307](https://github.com/openshift/monitoring-plugin/pull/1307)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/e8610c3c8b35ec0758523c21a2e60aa8c7e59914...c243b5a09dbd8fec17ab115e416f15c7e96c10fc)


### [multus-route-override-cni](https://github.com/openshift/route-override-cni/tree/0c111164a2c5c7f315aa58f257b7fa862e1c6b51)

* NO-JIRA: Update CI builders to Go 1.26 [#82](https://github.com/openshift/route-override-cni/pull/82)
* [Full changelog](https://github.com/openshift/route-override-cni/compare/375ac966115fd03febd218a8331e8794560bd28e...0c111164a2c5c7f315aa58f257b7fa862e1c6b51)


### [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni/tree/77810eb02c634bee98b8bda17adb6adf69716d02)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#437](https://github.com/openshift/whereabouts-cni/pull/437)
* NO-JIRA: Update CI builders to Go 1.26 [#436](https://github.com/openshift/whereabouts-cni/pull/436)
* [Full changelog](https://github.com/openshift/whereabouts-cni/compare/4b0c2166726247e36a0125432609844045e48dc3...77810eb02c634bee98b8bda17adb6adf69716d02)


### [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon/tree/82a60353740a54e16ae88e9cbd963a00f7f74a33)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#159](https://github.com/openshift/network-metrics-daemon/pull/159)
* [Full changelog](https://github.com/openshift/network-metrics-daemon/compare/20e6b987ea44e7cf0805662e8fec44d625b6f278...82a60353740a54e16ae88e9cbd963a00f7f74a33)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/8ecee458690f861ab33eeb3b8d0f4b944f2e8931)

* [OCPNETUI-168](https://issues.redhat.com/browse/OCPNETUI-168): Update Owners file [#645](https://github.com/openshift/networking-console-plugin/pull/645)
* maintenance: Bump the npm group with 32 updates [#638](https://github.com/openshift/networking-console-plugin/pull/638)
* [OCPNETUI-183](https://issues.redhat.com/browse/OCPNETUI-183): migrate to @kubevirt-ui-ext/kubevirt-api [#627](https://github.com/openshift/networking-console-plugin/pull/627)
* Reset form state using correct default values [#625](https://github.com/openshift/networking-console-plugin/pull/625)
* maintenance: Bump the npm group with 23 updates [#622](https://github.com/openshift/networking-console-plugin/pull/622)
* maintenance: Bump the npm group with 20 updates [#599](https://github.com/openshift/networking-console-plugin/pull/599)
* [OCPNETUI-146](https://issues.redhat.com/browse/OCPNETUI-146): dependency cleanup [#590](https://github.com/openshift/networking-console-plugin/pull/590)
* [OCPNETUI-146](https://issues.redhat.com/browse/OCPNETUI-146): reassign dev and prod dependencies [#583](https://github.com/openshift/networking-console-plugin/pull/583)
* maintenance: Bump the npm group with 26 updates [#577](https://github.com/openshift/networking-console-plugin/pull/577)
* maintenance: Bump the npm group across 1 directory with 16 updates [#562](https://github.com/openshift/networking-console-plugin/pull/562)
* [OCPNETUI-146](https://issues.redhat.com/browse/OCPNETUI-146): Align shared modules with Console [#560](https://github.com/openshift/networking-console-plugin/pull/560)
* maintenance: Bump the npm group with 10 updates [#547](https://github.com/openshift/networking-console-plugin/pull/547)
* maintenance: Bump the npm group across 1 directory with 216 updates [#542](https://github.com/openshift/networking-console-plugin/pull/542)
* maintenance: Bump terser-webpack-plugin from 5.4.0 to 5.6.1 [#531](https://github.com/openshift/networking-console-plugin/pull/531)
* maintenance: Bump loader-runner from 4.3.1 to 4.3.2 [#530](https://github.com/openshift/networking-console-plugin/pull/530)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/4509d691e67664e9b3a911278fcbf38d54bb9cfc...8ecee458690f861ab33eeb3b8d0f4b944f2e8931)


### [oauth-apiserver](https://github.com/openshift/oauth-apiserver/tree/d7210a22725ec41f3d15b3bf0fb402b4bc50eb48)

* [OCPBUGS-115299](https://issues.redhat.com/browse/OCPBUGS-115299): fix CVE-2026-41178 by bumping otel to v1.44.0 [#227](https://github.com/openshift/oauth-apiserver/pull/227)
* [Full changelog](https://github.com/openshift/oauth-apiserver/compare/a59e07d789b5a2531e94053cfe7c53edde90e931...d7210a22725ec41f3d15b3bf0fb402b4bc50eb48)


### [oauth-proxy](https://github.com/openshift/oauth-proxy/tree/f4fb9013872724cf5ab5874904dcc41b40b48c66)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#391](https://github.com/openshift/oauth-proxy/pull/391)
* [ACM-37203](https://issues.redhat.com/browse/ACM-37203): Add support for configurable TLS profiles [#380](https://github.com/openshift/oauth-proxy/pull/380)
* [Full changelog](https://github.com/openshift/oauth-proxy/compare/310d2f7b90762b407d6100eb3940bd5b2f348108...f4fb9013872724cf5ab5874904dcc41b40b48c66)


### [oauth-server](https://github.com/openshift/oauth-server/tree/e1a28882b283cf0be80628c7aaae83cb9020afd0)

* [OCPBUGS-127499](https://issues.redhat.com/browse/OCPBUGS-127499): Add high contrast support to oauth templates [#286](https://github.com/openshift/oauth-server/pull/286)
* [Full changelog](https://github.com/openshift/oauth-server/compare/6c2c889640ec53563021d0c0f09c4388cdcdb806...e1a28882b283cf0be80628c7aaae83cb9020afd0)


### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/5bbe8e7ad5451909ad22caaa9e5d2a98840b468e)

* [OCPBUGS-127175](https://issues.redhat.com/browse/OCPBUGS-127175): update otel to 1.44.0 to fix CVE-2026-41178 [#689](https://github.com/openshift/openshift-apiserver/pull/689)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/ab0315228cde432c8cd62df012b791a66a72c7b3...5bbe8e7ad5451909ad22caaa9e5d2a98840b468e)


### [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics/tree/24da765b7f06cec8ba36fffa68d11b500e81f8bd)

* NO-ISSUE: synchronize OWNERS from main branch [#145](https://github.com/openshift/openshift-state-metrics/pull/145)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#141](https://github.com/openshift/openshift-state-metrics/pull/141)
* [Full changelog](https://github.com/openshift/openshift-state-metrics/compare/3b4ea3e753d97fea66e0f52c8282a711358b4ff7...24da765b7f06cec8ba36fffa68d11b500e81f8bd)


### [openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/f32d78f4758c69c67b453a83e1345a417b4a63c9)

* [OCPBUGS-108037](https://issues.redhat.com/browse/OCPBUGS-108037): Bump go.opentelemetry.io/otel to v1.44.0 in 5.0 [#427](https://github.com/openshift/cloud-provider-openstack/pull/427)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/aa9a8100e87ff13abf4dd6343c84c9f4948debef...f32d78f4758c69c67b453a83e1345a417b4a63c9)


### [openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/3974a8b545f06a7f18f442cdcf472b69475d83ad)

* [OCPBUGS-126441](https://issues.redhat.com/browse/OCPBUGS-126441): openstack-manila: Consume CA cert from CCO secret [#636](https://github.com/openshift/csi-operator/pull/636)
* [OCPBUGS-128798](https://issues.redhat.com/browse/OCPBUGS-128798): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#641](https://github.com/openshift/csi-operator/pull/641)
* : [release-5.0] OCPBUGS-128035: Enable pod-delete-after-umount CSI suite for driver OCP manifests [#628](https://github.com/openshift/csi-operator/pull/628)
* [Full changelog](https://github.com/openshift/csi-operator/compare/57a5d72c6758cccafb9f14b1c28d1b2ea4510364...3974a8b545f06a7f18f442cdcf472b69475d83ad)


### [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack/tree/e77483b082e5e77ffc2276d5a68e8c865ab245a8)

* [OCPBUGS-104396](https://issues.redhat.com/browse/OCPBUGS-104396): Replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 for CVE-2026-33814 [release-5.0] [#436](https://github.com/openshift/cluster-api-provider-openstack/pull/436)
* [Full changelog](https://github.com/openshift/cluster-api-provider-openstack/compare/9f64446f441ff7bcebd123a0dc35d4156c309681...e77483b082e5e77ffc2276d5a68e8c865ab245a8)


### [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack/tree/0b4a6d1ac12fe27b56392263291e0efd93db7791)

* [OCPBUGS-104369](https://issues.redhat.com/browse/OCPBUGS-104369): Fix CVE-2026-33814 - bump golang.org/x/net to v0.53.0 [#196](https://github.com/openshift/machine-api-provider-openstack/pull/196)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#192](https://github.com/openshift/machine-api-provider-openstack/pull/192)
* [Full changelog](https://github.com/openshift/machine-api-provider-openstack/compare/6b30092b0a1196b016f4300b79c895f0e7f2e9a8...0b4a6d1ac12fe27b56392263291e0efd93db7791)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/23b61c3ffcd93b8c7e85e913d37bbf82f47eedb9)

* [OCPBUGS-133284](https://issues.redhat.com/browse/OCPBUGS-133284): Add arkadeepsen, martinkennelly and pperiyasamy to OWNERS file [#3573](https://github.com/openshift/ovn-kubernetes/pull/3573)
* [OCPBUGS-131017](https://issues.redhat.com/browse/OCPBUGS-131017): [release-5.0] node: prioritize default network before primary UDN fan-out [#3542](https://github.com/openshift/ovn-kubernetes/pull/3542)
* [OCPBUGS-128643](https://issues.redhat.com/browse/OCPBUGS-128643): EIP duplicate MAC race during node shutdown [#3489](https://github.com/openshift/ovn-kubernetes/pull/3489)
* [OCPBUGS-122282](https://issues.redhat.com/browse/OCPBUGS-122282): egressip: set IFA_PROTO on EgressIP addresses to prevent nmstate persistence [#3437](https://github.com/openshift/ovn-kubernetes/pull/3437)
* [OCPBUGS-127013](https://issues.redhat.com/browse/OCPBUGS-127013): [release-5.0] e2e: exclude machine network subnets from UDN/BGP allocators [#3466](https://github.com/openshift/ovn-kubernetes/pull/3466)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/3ce12184bf66e8be8abe365f81ffdfa7dbb4dd76...23b61c3ffcd93b8c7e85e913d37bbf82f47eedb9)


### [prom-label-proxy](https://github.com/openshift/prom-label-proxy/tree/6a214d5e8a141eb8a07e74d1cdb8a9a80be22015)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#414](https://github.com/openshift/prom-label-proxy/pull/414)
* NO-ISSUE: synchronize OWNERS from main branch [release-5.0] [#410](https://github.com/openshift/prom-label-proxy/pull/410)
* [Full changelog](https://github.com/openshift/prom-label-proxy/compare/4ab9ff73c665319352288fe0b9b9e1df71832525...6a214d5e8a141eb8a07e74d1cdb8a9a80be22015)


### [prometheus](https://github.com/openshift/prometheus/tree/127adf44c2af0612f812594fd10a9e06392146ed)

* NO-ISSUE: synchronize OWNERS from main branch [#392](https://github.com/openshift/prometheus/pull/392)
* [Full changelog](https://github.com/openshift/prometheus/compare/01d8335673aa6f88f5742ef510e133efee88a7bf...127adf44c2af0612f812594fd10a9e06392146ed)


### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/7c923dc6e56f150807d8f643da8357d315415c7f)

* NO-JIRA: synchronize OWNERS with main [#194](https://github.com/openshift/prometheus-alertmanager/pull/194)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#187](https://github.com/openshift/prometheus-alertmanager/pull/187)
* [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/89bdff8b5b885e4a3d0f7d0327fe39221f3d2dce...7c923dc6e56f150807d8f643da8357d315415c7f)


### [prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator/tree/a66f3a8975d843f9a2dbee434833821190e1752e)

* NO-ISSUE: synchronize OWNERS from main branch [#411](https://github.com/openshift/prometheus-operator/pull/411)
* [Full changelog](https://github.com/openshift/prometheus-operator/compare/67895c7c968f42e97efec58f4140fffae4832028...a66f3a8975d843f9a2dbee434833821190e1752e)


### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/ae80a6d76915cb4461533c270cd580604049eb22)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#213](https://github.com/openshift/node_exporter/pull/213)
* NO-ISSUE: synchronize OWNERS from main branch [release-5.0] [#211](https://github.com/openshift/node_exporter/pull/211)
* [Full changelog](https://github.com/openshift/node_exporter/compare/b8af472104ce559c8fb9bf31fd4fc38bdbdc34e7...ae80a6d76915cb4461533c270cd580604049eb22)


### [telemeter](https://github.com/openshift/telemeter/tree/5eb6dff8fd9d22d61b33df7af0af51f57fc2eebb)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Remove unintended tools/vendor from release-5.0 [#627](https://github.com/openshift/telemeter/pull/627)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#623](https://github.com/openshift/telemeter/pull/623)
* [Full changelog](https://github.com/openshift/telemeter/compare/22ba1701333f3fd26490cc15b89ddf21df3f67f6...5eb6dff8fd9d22d61b33df7af0af51f57fc2eebb)


### [tests](https://github.com/openshift/origin/tree/d4707bc839019f69ab1d95ae92a7aa68968fd29a)

* [OCPBUGS-129437](https://issues.redhat.com/browse/OCPBUGS-129437): Increase timeout for external IP policy test to accommodate in-cluster rollouts [#31718](https://github.com/openshift/origin/pull/31718)
* [OCPBUGS-133005](https://issues.redhat.com/browse/OCPBUGS-133005): Further optimize oc must gather tests to improve efficiency [#31798](https://github.com/openshift/origin/pull/31798)
* [OCPBUGS-130586](https://issues.redhat.com/browse/OCPBUGS-130586): e2e-analysis: add --skip-readiness-checks flag for degraded cluster lanes [#31727](https://github.com/openshift/origin/pull/31727)
* [OCPBUGS-132902](https://issues.redhat.com/browse/OCPBUGS-132902): Allow etcd probe error due to tls config change [#31796](https://github.com/openshift/origin/pull/31796)
* [NETOBSERV-2563](https://issues.redhat.com/browse/NETOBSERV-2563): Add network observability e2e tests with disconnected skips [#31772](https://github.com/openshift/origin/pull/31772)
* [OCPBUGS-132327](https://issues.redhat.com/browse/OCPBUGS-132327): make webhook build resolution wait phase-independent [#31774](https://github.com/openshift/origin/pull/31774)
* [OCPBUGS-131833](https://issues.redhat.com/browse/OCPBUGS-131833): Handle offline or removed nodes in TNF replacement test [#31725](https://github.com/openshift/origin/pull/31725)
* [OCPBUGS-112658](https://issues.redhat.com/browse/OCPBUGS-112658): allow v1beta2 DRA API in discovery test [#31728](https://github.com/openshift/origin/pull/31728)
* [OCPBUGS-128800](https://issues.redhat.com/browse/OCPBUGS-128800): assert PHC recovery after network disruption instead of logging it [#31690](https://github.com/openshift/origin/pull/31690)
* [OCPBUGS-128791](https://issues.redhat.com/browse/OCPBUGS-128791): Improve TNF recovery test stability: AfterEach cleanup, migration-threshold, east-west fixes [#31693](https://github.com/openshift/origin/pull/31693)
* [OCPBUGS-127449](https://issues.redhat.com/browse/OCPBUGS-127449): Make operator log scraper and monitor tests topology-aware [#31671](https://github.com/openshift/origin/pull/31671)
* [OCPBUGS-128380](https://issues.redhat.com/browse/OCPBUGS-128380): Add CSI storage test for pod delete after host umount of mounted volume [#31670](https://github.com/openshift/origin/pull/31670)
* [OCPBUGS-127400](https://issues.redhat.com/browse/OCPBUGS-127400): Redact OAuth tokens from test cleanup logs [#31668](https://github.com/openshift/origin/pull/31668)
* [OCPBUGS-127419](https://issues.redhat.com/browse/OCPBUGS-127419): Fix node replacement test timestamp filter and allow job retry [#31577](https://github.com/openshift/origin/pull/31577)
* And 3 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/origin/compare/5469b61543bdbba51f6701bbc8882ccbd1fc3098...d4707bc839019f69ab1d95ae92a7aa68968fd29a)


### [thanos](https://github.com/openshift/thanos/tree/2c1599d96f7eb74531f883dde971e208de0f64b8)

* [OCPBUGS-129060](https://issues.redhat.com/browse/OCPBUGS-129060): Bump github.com/klauspost/compress to fix CVE-2026-63209 [#226](https://github.com/openshift/thanos/pull/226)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#216](https://github.com/openshift/thanos/pull/216)
* [Full changelog](https://github.com/openshift/thanos/compare/2a09eb84b92ccd71d5f1f11e0dda6d5aa9624e19...2c1599d96f7eb74531f883dde971e208de0f64b8)


### [volume-data-source-validator](https://github.com/openshift/volume-data-source-validator/tree/42a87e53d18314300ffc1d91845f2667ea3812a7)

* [OCPBUGS-104423](https://issues.redhat.com/browse/OCPBUGS-104423): Bump golang.org/x/net to version 0.57.0 that fixes CVE-2026-33814 [#18](https://github.com/openshift/volume-data-source-validator/pull/18)
* [Full changelog](https://github.com/openshift/volume-data-source-validator/compare/ee9cd7aba4e096a9a957386ef20777e8950df352...42a87e53d18314300ffc1d91845f2667ea3812a7)