# 4.15.71

Created: 2026-11-08 23:57:22 +0000 UTC

Image Digest: `sha256:f38b4b30160584e04166a69480438f34538cb8ad2dbc2db5a0efb0fa34e99af0`


## Changes from 4.15.39

### Components

* Kubernetes upgraded from 1.28.14 to 1.28.15
* Red Hat Enterprise Linux CoreOS upgraded from 415.92.202411201723-0 to 415.92.202611051005-0


### Removed images

* ovirt-csi-driver
* ovirt-csi-driver-operator
* ovirt-machine-controllers


### Rebuilt images without code change

* [agent-installer-utils](https://github.com/openshift/agent-installer-utils) git [33b7d855](https://github.com/openshift/agent-installer-utils/commit/33b7d855fdebd24a972f32dafafd29e40b117e46) `sha256:6ea822ced093386e9cab8bb20052775630fad30c33d3107729336d56b984af9c`
* [alibaba-disk-csi-driver-operator](https://github.com/openshift/alibaba-disk-csi-driver-operator) git [41b367ae](https://github.com/openshift/alibaba-disk-csi-driver-operator/commit/41b367ae3bb6de9292539c0ecd98c81c5edc8294) `sha256:5807b98ba550a228bae4cb3eb81ce2352d1d3c6744a76450e913f38345cd451a`
* [alibaba-machine-controllers](https://github.com/openshift/cluster-api-provider-alibaba) git [f7f5eed8](https://github.com/openshift/cluster-api-provider-alibaba/commit/f7f5eed811b33b9beee1ed6a34f956449fbf7fc7) `sha256:fc5f0391564f79e78ba7783b5775479811383cce937300a3a80c8bcb07cec6b0`
* [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy) git [adccbd5c](https://github.com/openshift/apiserver-network-proxy/commit/adccbd5c16daecfe861fa530acdcbba5ec682a3a) `sha256:a7dc0ad378a85d5aa4e4debc3bececd0675c69a70c19349340a47b0834f21068`
* [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver) git [7043c1cc](https://github.com/openshift/aws-ebs-csi-driver/commit/7043c1cca6e17dd3c90006140f6361cf0e776d69) `sha256:3e12654286e12b5c05ae3fa8b3f0b0f3f45e3be34e9d91c08fd59d9128ccd35f`
* [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook) git [13385034](https://github.com/openshift/aws-pod-identity-webhook/commit/13385034ec9a843a6b40f8b3aec9966ada785115) `sha256:0e1b1f216a90ace8721d0ac64416134027704f1b39b5e5b5ebfa1dd38d5c5d16`
* [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver) git [dcb7e1c7](https://github.com/openshift/azure-disk-csi-driver/commit/dcb7e1c7d239ab5a26d70d7abcff1eb97b634b8d) `sha256:9a52a7c67af6fa5de53ab368412cdabe74a72cb07ebc19e6c3eab73c68bbcb30`
* [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg) git [1fbb2c0c](https://github.com/openshift/baremetal-runtimecfg/commit/1fbb2c0c1e6af304a673d5ac43803d4bb5dca95c) `sha256:4005b970da93c0144bae6e921761f814c3200b5224efcf6f82e1eaa923c64f7e`
* [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller) git [6864da06](https://github.com/openshift/cloud-network-config-controller/commit/6864da0642026d6004df171539fa9fd5bcb6c2df) `sha256:8b428083a0ab8e3ed0de3dbb6d997b22721537953aa50d8db63133490cda569a`
* [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap) git [0849c462](https://github.com/openshift/cluster-bootstrap/commit/0849c462de13b9a5765b9a8c882acb9e6e8bf39e) `sha256:fc33204cbdde8a47f74c48a6183ffcd67ff3c17a68f4f5b69a5fab8b5852cf89`
* [cluster-capi-controllers](https://github.com/openshift/cluster-api) git [2053e13c](https://github.com/openshift/cluster-api/commit/2053e13cb0fda9188e9b685db83c1e1f492e6efa) `sha256:ceb31067f7d13a3b3115c839850cc8242f9a22cfbadebb6c4adf6c2ef7b22810`
* [cluster-config-api](https://github.com/openshift/api) git [0a58f8c3](https://github.com/openshift/api/commit/0a58f8c30a8c309baaa4aecd05580039b4d3888b) `sha256:ee11e86048a832887d49711298853442a3bdaad5aa7a8757f824f060a3842a36`
* [cluster-config-operator](https://github.com/openshift/cluster-config-operator) git [0b4c69fd](https://github.com/openshift/cluster-config-operator/commit/0b4c69fd7e282b9037cbb2b6e2d09c96bcc29818) `sha256:ea0e0514a6cd3296d52b41437096c5705a6c0f12da68b6768bafce8fd6845c76`
* [cluster-kube-cluster-api-operator](https://github.com/openshift/cluster-api-operator) git [128d8e08](https://github.com/openshift/cluster-api-operator/commit/128d8e08c48e2002c416e84d0dec816bf5999c7e) `sha256:e888a1b0e601e4b47f6202721fa31aa8d0929331dbbb03165106fcb85fa6dc2f`
* [cluster-platform-operators-manager](https://github.com/openshift/platform-operators) git [37a0a919](https://github.com/openshift/platform-operators/commit/37a0a919b1032f7affa49b756eda4762d77751d5) `sha256:85db24ab428e888254b975ea729808badf0be470d108d6f7a999e278238084bc`
* [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller) git [cc48f315](https://github.com/openshift/cluster-policy-controller/commit/cc48f3152213bfe6e42fdd82f760246e862d208f) `sha256:e30557be670bd6a685feeebc18789795fe8a1ad0291045247e330648ba54d94c`
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [802233d8](https://github.com/openshift/cluster-update-keys/commit/802233d84243d3eeceef50a29579501e94ebbf26) `sha256:f6a80728169ee801a6db1291c56fc4c59feb90dc3bf4cb373710bd7887a882c1`
* [configmap-reloader](https://github.com/openshift/configmap-reload) git [617398f5](https://github.com/openshift/configmap-reload/commit/617398f581faadbad2c7ded993bfa3169a87b6ab) `sha256:95b40a4edc518ea7864f11f7590ed78a0b1b135714371a7c80d2f4f1ff71158e`
* [csi-driver-shared-resource](https://github.com/openshift/csi-driver-shared-resource) git [260a085a](https://github.com/openshift/csi-driver-shared-resource/commit/260a085ae25606bba7a94cdfed88f67265905ba9) `sha256:bd5db4288c45b14c8e040d576858b93b0bf4336ca3e6348b274e51f8f02d6c97`
* [csi-driver-shared-resource-operator](https://github.com/openshift/csi-driver-shared-resource-operator) git [8d017b7f](https://github.com/openshift/csi-driver-shared-resource-operator/commit/8d017b7f19f0226dfd4fc7933271939c550d180f) `sha256:3df4be424029358662fd5640cafe98e8a4218f3925cbcd4386bf455e52acfeef`
* [csi-driver-shared-resource-webhook](https://github.com/openshift/csi-driver-shared-resource) git [260a085a](https://github.com/openshift/csi-driver-shared-resource/commit/260a085ae25606bba7a94cdfed88f67265905ba9) `sha256:6f9529dcf0c09a7a639ad8099f2ab3d02f558cf9c087acf3f197dfc9cfb03f02`
* [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner) git [ce5a1a33](https://github.com/openshift/csi-external-provisioner/commit/ce5a1a33fadf10bba0c90510c09dfc879dcfec87) `sha256:cd17c4e1cfb90215cacdc7e074beb9e507de8f2f63f916e97b2acbd294e0613f`
* [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe) git [240bb8c0](https://github.com/openshift/csi-livenessprobe/commit/240bb8c0c7b24d0b18831be4ace39bcbc8d599e3) `sha256:0a3e479529bf3704c256dd2f81039b068f1d4b74a505a7debcea38474a9a366f`
* [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar) git [9005584e](https://github.com/openshift/csi-node-driver-registrar/commit/9005584ee45c4d3158e383870aafa5d78a03b141) `sha256:1aaf9ef5aee46a848e6d442fe11d28ba31bc47ebe408c8a63d993ceca58f1b65`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [7a448c2e](https://github.com/openshift/driver-toolkit/commit/7a448c2ee026c772e293dd344da587493c859f82) `sha256:f18c5bde512dddb75b35dc9534cf6c81d9f2436a182927da643cd6aeca0c64bb`
* [egress-router-cni](https://github.com/openshift/egress-router-cni) git [f8ec690b](https://github.com/openshift/egress-router-cni/commit/f8ec690bc12a13ec7c9c45f0e3696ad02e143581) `sha256:9e7c9b7c655e4191b9e6a871a80493d4644933f3604433d3dd2ef4d441732e2c`
* [etcd](https://github.com/openshift/etcd) git [a7005ef1](https://github.com/openshift/etcd/commit/a7005ef1eae85eec6c59411860538169cea182fd) `sha256:648dd59754d18097f32d7e21c7a62c292aeff553503c5a35ff536ab20e73219b`
* [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp) git [fc50272a](https://github.com/openshift/cloud-provider-gcp/commit/fc50272ac32348a96455688c470bf256b1042825) `sha256:5368af186ba1ccdc2ca5f2fb889f23c021fb4b7d941dfe415582704da1fce34f`
* [keepalived-ipfailover](https://github.com/openshift/images) git [87c23b5a](https://github.com/openshift/images/commit/87c23b5aa611556ff5013822c7779e6c7551a0f0) `sha256:b14bcbfe21bb0849e747dec542b04ce4e3ff6984b71ac764cbf41fd94d59a315`
* [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy) git [9308e7f2](https://github.com/openshift/kube-rbac-proxy/commit/9308e7f2a6d984fa7b8ddc125524d7b7356f92ce) `sha256:ef471676dc66764f5cdf30a1547260c5271cc241154b4af70adae5040abab9bb`
* machine-os-content `sha256:3aa5693113e6db09400a9ac2506963ded33da9eb4bea93db87141ee7ba915af6`
* [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy) git [b377b4b5](https://github.com/openshift/multus-networkpolicy/commit/b377b4b5fd3029cd5cabc773ca6223cabd6b2af7) `sha256:1f21d5458c808ed6a25df5d6cdc9de935634471c570513e9988782b74129adad`
* [multus-route-override-cni](https://github.com/openshift/route-override-cni) git [1ccafc34](https://github.com/openshift/route-override-cni/commit/1ccafc340ca1147abb42c7ad8dda1f23ba4eb1ee) `sha256:3bf9616a5e115503fc48449b89bb3a21784b0bdb59e9247da5643695cbd07368`
* [network-interface-bond-cni](https://github.com/openshift/bond-cni) git [f91decaa](https://github.com/openshift/bond-cni/commit/f91decaa10cfa233c9e680c96ec7ae642e30a03c) `sha256:18ec1ce73b758997c6a1a19c2714cd6e4bf1a0355f98db9045c9777acd21d8eb`
* [network-tools](https://github.com/openshift/network-tools) git [17536c8d](https://github.com/openshift/network-tools/commit/17536c8dff76d50efb604187ba763020bd084771) `sha256:760d01bbdb64a0ae6c9e8aff985a4838ef0d6f0a6b89db8d1f33df9c0203f895`
* [nutanix-cloud-controller-manager](https://github.com/openshift/cloud-provider-nutanix) git [040d4e01](https://github.com/openshift/cloud-provider-nutanix/commit/040d4e016058c188d2ba0a7575054ee44b94af9e) `sha256:b1558b7aba6f3134f414017d5c7fce7eaff8b1e43366a1e7cb6b74a605d4dae1`
* [olm-catalogd](https://github.com/openshift/operator-framework-catalogd) git [035d3835](https://github.com/openshift/operator-framework-catalogd/commit/035d3835e581bee8ba59ec8919b43c8d7ce4ecfd) `sha256:4ae266fba861cfb08bbb3b0afe35a3df3726c7e9d4e908fa83954a9d597ccb36`
* [olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller) git [303b954f](https://github.com/openshift/operator-framework-operator-controller/commit/303b954fa5a92e810aebbe55ab8fafe8dbc06c58) `sha256:7b2309e652deff79e3805d15c2f8a85e1f3c231842550bc5ec671c6427d30513`
* [olm-rukpak](https://github.com/openshift/operator-framework-rukpak) git [5b09cd44](https://github.com/openshift/operator-framework-rukpak/commit/5b09cd44e9ca7b2ec91fd6f906ac4612636277e3) `sha256:e5d4a1f8049bdbdafc987489736e8b8552a9d954679ee42cebc712b9eb8d81c0`
* [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack) git [232472ea](https://github.com/openshift/cluster-api-provider-openstack/commit/232472ea527aa86764d93e77dc67b0c7db9cc050) `sha256:db1e381844bcfb5f01161dc5e3279306138ee7bddbb4676f0b50c96fb10cfc33`
* [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs) git [1d6a7ed9](https://github.com/openshift/cloud-provider-powervs/commit/1d6a7ed991427b1c8048b0b44b706228e5c2a001) `sha256:3e56562c01a833e2b12cc898d4f7b8331837db3e70b41c788c423f35de1c58cf`
* rhel-coreos `sha256:3c7f91a44117a3045c9d5d4b774cdeefec690dd6721ff2eb456173ce05b10c35`
* rhel-coreos-extensions `sha256:00d5f4ae0c741166eb0dbdcfdb8a30993a5ed0418bd8466930ba8620fc4ad7e6`
* [telemeter](https://github.com/openshift/telemeter) git [14489f7d](https://github.com/openshift/telemeter/commit/14489f7dc656175e11a3ef962fcbcd113b3651a9) `sha256:bd84baa9f5b30d159f6673df242d97242f554427c86aac1ac6a3fd435ebb7394`
* [thanos](https://github.com/openshift/thanos) git [66161ad4](https://github.com/openshift/thanos/commit/66161ad4e03e5593f5a3a33aaaffbcd41555d62a) `sha256:aa2668606184952be40720b82c63df51414849576676759eb62509aa78920f92`


### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/25cb7a738aeebf34e4ef80f33013d01b0ec8f009)

* [OCPBUGS-89785](https://issues.redhat.com/browse/OCPBUGS-89785): patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.4 [#10820](https://github.com/openshift/assisted-service/pull/10820)
* And 3 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/assisted-service/compare/59ec11581b77fb1e03e153f7399ccc2e97e8c0bf...25cb7a738aeebf34e4ef80f33013d01b0ec8f009)


### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/d8fd2fad663073fd27ca36e93057a14eddebf4e3)

* [OCPBUGS-102698](https://issues.redhat.com/browse/OCPBUGS-102698): Use patched x/net fork v0.35.0-sec.4 [#2367](https://github.com/openshift/assisted-installer/pull/2367)
* And 3 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/fde2b2eace2f7ceaedc1ac63f0da77f21cfd78f7...d8fd2fad663073fd27ca36e93057a14eddebf4e3)


### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/0c3edd1e323da04b61a12690d8bbef0c76b6f5f9)

* [OCPBUGS-102685](https://issues.redhat.com/browse/OCPBUGS-102685): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#1615](https://github.com/openshift/assisted-installer-agent/pull/1615)
* run go mod tidy / vendor [#1020](https://github.com/openshift/assisted-installer-agent/pull/1020)
* And 3 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/366295f2cba23d0e7e1a61b384e226f707ff56a6...0c3edd1e323da04b61a12690d8bbef0c76b6f5f9)


### [alibaba-cloud-controller-manager](https://github.com/openshift/cloud-provider-alibaba-cloud/tree/3e41eb029ceb3d398805fd9d31c839a649a46ec4)

* [OCPBUGS-102693](https://issues.redhat.com/browse/OCPBUGS-102693): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 [#63](https://github.com/openshift/cloud-provider-alibaba-cloud/pull/63)
* [Full changelog](https://github.com/openshift/cloud-provider-alibaba-cloud/compare/abf4fa96550caf09e788b66fc06f1df802768397...3e41eb029ceb3d398805fd9d31c839a649a46ec4)


### [alibaba-cloud-csi-driver](https://github.com/openshift/alibaba-cloud-csi-driver/tree/4fb95a28e02d9f080ca41caa209896c1c5f9a563)

* [OCPBUGS-67910](https://issues.redhat.com/browse/OCPBUGS-67910): Bump github.com/sirupsen/logrus to v1.8.3 [#47](https://github.com/openshift/alibaba-cloud-csi-driver/pull/47)
* [Full changelog](https://github.com/openshift/alibaba-cloud-csi-driver/compare/be4888d3dc176b9801364981fbb34d831f6d6ffe...4fb95a28e02d9f080ca41caa209896c1c5f9a563)


### [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws/tree/3fb5e1be24c6fce2a2dacd1bbb22426a120dee92)

* [OCPBUGS-102874](https://issues.redhat.com/browse/OCPBUGS-102874): Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 [#176](https://github.com/openshift/cloud-provider-aws/pull/176)
* [OCPBUGS-88139](https://issues.redhat.com/browse/OCPBUGS-88139): replace golang.org/x/net with sustaining fork v0.35.0-sec.4 [#179](https://github.com/openshift/cloud-provider-aws/pull/179)
* [Full changelog](https://github.com/openshift/cloud-provider-aws/compare/fd77d92ced47559dadf53fb8c97d1cbeb64dde8c...3fb5e1be24c6fce2a2dacd1bbb22426a120dee92)


### [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws/tree/4b8f5705ffea0f5723d574e966e73fd938944167)

* [OCPBUGS-102702](https://issues.redhat.com/browse/OCPBUGS-102702): replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 [#655](https://github.com/openshift/cluster-api-provider-aws/pull/655)
* 🌱 OCPBUGS-123713: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI [#646](https://github.com/openshift/cluster-api-provider-aws/pull/646)
* [OCPBUGS-78228](https://issues.redhat.com/browse/OCPBUGS-78228): [release-4.15] hermetic 4.15 [#592](https://github.com/openshift/cluster-api-provider-aws/pull/592)
* [OCPBUGS-61943](https://issues.redhat.com/browse/OCPBUGS-61943): UPSTREAM <carry>: revert: Only tag NetworkInterfaces in RunInstances if IAM Allows It [#573](https://github.com/openshift/cluster-api-provider-aws/pull/573)
* [OCPBUGS-58668](https://issues.redhat.com/browse/OCPBUGS-58668), [OCPBUGS-58673](https://issues.redhat.com/browse/OCPBUGS-58673): bump github.com/golang/glog to v1.2.5 [#562](https://github.com/openshift/cluster-api-provider-aws/pull/562)
* [Full changelog](https://github.com/openshift/cluster-api-provider-aws/compare/7f00d2cde7a40b8438c5e0d5e64a4d15a035883a...4b8f5705ffea0f5723d574e966e73fd938944167)


### [aws-ebs-csi-driver-operator](https://github.com/openshift/csi-operator/tree/278e6de61d2906006a73abe8737573983cc9d896)

* [OCPBUGS-102714](https://issues.redhat.com/browse/OCPBUGS-102714): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#614](https://github.com/openshift/csi-operator/pull/614)
* [OCPBUGS-67913](https://issues.redhat.com/browse/OCPBUGS-67913): Bumped logrus to 1.9.3 [#492](https://github.com/openshift/csi-operator/pull/492)
* [Full changelog](https://github.com/openshift/csi-operator/compare/2a2b9dd109ba9d4abce11411c96787b21887f929...278e6de61d2906006a73abe8737573983cc9d896)


### [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws/tree/fb9a59a0f7636ffece8cc585f5ab8844e67cd198)

* [OCPBUGS-63141](https://issues.redhat.com/browse/OCPBUGS-63141): client: re-use a single file for building the session instead of randomly named files [#153](https://github.com/openshift/machine-api-provider-aws/pull/153)
* [OCPBUGS-63141](https://issues.redhat.com/browse/OCPBUGS-63141): revert: client: re-use a single file for building the session instead of randomly named files [#150](https://github.com/openshift/machine-api-provider-aws/pull/150)
* [OCPBUGS-63141](https://issues.redhat.com/browse/OCPBUGS-63141): client: re-use a single file for building the session instead of randomly named files [#143](https://github.com/openshift/machine-api-provider-aws/pull/143)
* [OCPBUGS-47680](https://issues.redhat.com/browse/OCPBUGS-47680): fix Associate*IpAddress flag on launch EC2 [#122](https://github.com/openshift/machine-api-provider-aws/pull/122)
* [Full changelog](https://github.com/openshift/machine-api-provider-aws/compare/0129b1e3e6cf8d142dbff58d6f25ec9d42b0d382...fb9a59a0f7636ffece8cc585f5ab8844e67cd198)


### [azure-cloud-controller-manager, azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure/tree/f32ed28d823a70fdc099a874dd34bab32d59b4b2)

* [OCPBUGS-88144](https://issues.redhat.com/browse/OCPBUGS-88144): Replace golang.org/x/net with sustaining fork v0.35.0-sec.4 to address CVE-2026-39821 [#217](https://github.com/openshift/cloud-provider-azure/pull/217)
* [OCPBUGS-102708](https://issues.redhat.com/browse/OCPBUGS-102708), [OCPBUGS-102879](https://issues.redhat.com/browse/OCPBUGS-102879): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#211](https://github.com/openshift/cloud-provider-azure/pull/211)
* [OCPBUGS-79916](https://issues.redhat.com/browse/OCPBUGS-79916), [OCPBUGS-85634](https://issues.redhat.com/browse/OCPBUGS-85634), [OCPBUGS-85637](https://issues.redhat.com/browse/OCPBUGS-85637): Bump google.golang.org/grpc to v1.79.3 [#187](https://github.com/openshift/cloud-provider-azure/pull/187)
* [Full changelog](https://github.com/openshift/cloud-provider-azure/compare/0d799a261f70bbdf546d911f5f8b59e2c324bd16...f32ed28d823a70fdc099a874dd34bab32d59b4b2)


### [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure/tree/7896f4a94ae32cf038daa77e255ec207832c1081)

* [OCPBUGS-78177](https://issues.redhat.com/browse/OCPBUGS-78177): [release-4.15] update go mod dependency for konflux [#365](https://github.com/openshift/cluster-api-provider-azure/pull/365)
* [Full changelog](https://github.com/openshift/cluster-api-provider-azure/compare/44832d2da09778d7ff4d2413c9e10852f330a55d...7896f4a94ae32cf038daa77e255ec207832c1081)


### [azure-disk-csi-driver-operator](https://github.com/openshift/azure-disk-csi-driver-operator/tree/31f3f12949f25b386774890cfc3c338c73fda94b)

* [OCPBUGS-102724](https://issues.redhat.com/browse/OCPBUGS-102724): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 [#130](https://github.com/openshift/azure-disk-csi-driver-operator/pull/130)
* [Full changelog](https://github.com/openshift/azure-disk-csi-driver-operator/compare/160cf624a88f500de7a1f79e6dd9384bb7d17842...31f3f12949f25b386774890cfc3c338c73fda94b)


### [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver/tree/1f24659375a5fec1eab8a5444f544b2a3175a3ea)

* [OCPBUGS-102709](https://issues.redhat.com/browse/OCPBUGS-102709): Bump golang.org/x/net to v0.35.0-sec.4 [#161](https://github.com/openshift/azure-file-csi-driver/pull/161)
* UPSTREAM: 3221: OCPBUGS-92749: Bump golang.org/x/crypto to v0.33.0-sec.5 [#166](https://github.com/openshift/azure-file-csi-driver/pull/166)
* [OCPBUGS-79874](https://issues.redhat.com/browse/OCPBUGS-79874): Bump google.golang.org/grpc to v1.79.3 [#131](https://github.com/openshift/azure-file-csi-driver/pull/131)
* [ART-13080](https://issues.redhat.com/browse/ART-13080): Regenerate go.mod to fix build failure [#94](https://github.com/openshift/azure-file-csi-driver/pull/94)
* [Full changelog](https://github.com/openshift/azure-file-csi-driver/compare/bcf919dc0467f84192758155aac4976df5054da6...1f24659375a5fec1eab8a5444f544b2a3175a3ea)


### [azure-file-csi-driver-operator](https://github.com/openshift/azure-file-csi-driver-operator/tree/1d4249e82998e0a9f1d0763a8a344a0a0843a471)

* [OCPBUGS-102716](https://issues.redhat.com/browse/OCPBUGS-102716): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#120](https://github.com/openshift/azure-file-csi-driver-operator/pull/120)
* [OCPBUGS-67918](https://issues.redhat.com/browse/OCPBUGS-67918): Bump github.com/sirupsen/logrus to v1.9.3 [#113](https://github.com/openshift/azure-file-csi-driver-operator/pull/113)
* [OCPBUGS-60544](https://issues.redhat.com/browse/OCPBUGS-60544): add tag matching to Azure File storage class [#110](https://github.com/openshift/azure-file-csi-driver-operator/pull/110)
* [Full changelog](https://github.com/openshift/azure-file-csi-driver-operator/compare/367c4e45899033f7fb7494c0004b83157b6723aa...1d4249e82998e0a9f1d0763a8a344a0a0843a471)


### [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure/tree/737d2a61a4a06b379cf35a6a2ba3992f980bcb17)

* [OCPBUGS-102803](https://issues.redhat.com/browse/OCPBUGS-102803): replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 [#216](https://github.com/openshift/machine-api-provider-azure/pull/216)
* [OCPBUGS-130942](https://issues.redhat.com/browse/OCPBUGS-130942): Fix unit tests [#224](https://github.com/openshift/machine-api-provider-azure/pull/224)
* [OCPBUGS-56657](https://issues.redhat.com/browse/OCPBUGS-56657): Fix failure when attempting to modify immutable availabilitySet [#150](https://github.com/openshift/machine-api-provider-azure/pull/150)
* [OCPBUGS-53226](https://issues.redhat.com/browse/OCPBUGS-53226): dynamically setting the amount of fault domains [#134](https://github.com/openshift/machine-api-provider-azure/pull/134)
* [Full changelog](https://github.com/openshift/machine-api-provider-azure/compare/615b457bcfa1a40e7900585154952aac8194bed4...737d2a61a4a06b379cf35a6a2ba3992f980bcb17)


### [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity/tree/5db478a9876556666b10f135487a2fd9f82e8653)

* [OCPBUGS-53794](https://issues.redhat.com/browse/OCPBUGS-53794): github.com/golang-jwt/jwt/v4 v4.5.2 [#34](https://github.com/openshift/azure-workload-identity/pull/34)
* [Full changelog](https://github.com/openshift/azure-workload-identity/compare/2333b7fae0592ae26d77cbac49ce23e7fbaa00b1...5db478a9876556666b10f135487a2fd9f82e8653)


### [baremetal-installer, installer, installer-altinfra, installer-artifacts](https://github.com/openshift/installer/tree/bf73b4efbb441d052415866ef4c7b1d466153f11)

* no-jira: upi: install gcloud 447.0.0 from versioned archive [#10999](https://github.com/openshift/installer/pull/10999)
* [OCPBUGS-102719](https://issues.redhat.com/browse/OCPBUGS-102719): Bump golang.org/x/net to v0.35.0-sec.4 [#11011](https://github.com/openshift/installer/pull/11011)
* [OCPBUGS-89836](https://issues.redhat.com/browse/OCPBUGS-89836), [OCPBUGS-92734](https://issues.redhat.com/browse/OCPBUGS-92734): Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.33.0-sec.5 to address CVE-2026-39829, CVE-2026-46597 [#10952](https://github.com/openshift/installer/pull/10952)
* [OCPBUGS-127709](https://issues.redhat.com/browse/OCPBUGS-127709): Update gcloud version to one that can be found [#10920](https://github.com/openshift/installer/pull/10920)
* [OCPBUGS-79036](https://issues.redhat.com/browse/OCPBUGS-79036): Azure UPI ARM template: use storageAccountId [#10418](https://github.com/openshift/installer/pull/10418)
* [OCPBUGS-76929](https://issues.redhat.com/browse/OCPBUGS-76929): terraform/provider/google: Fixing GCP inconsistencies present with the service account creation [#10316](https://github.com/openshift/installer/pull/10316)
* [OCPBUGS-42554](https://issues.redhat.com/browse/OCPBUGS-42554): only allow a single network in failure domain topology [#9060](https://github.com/openshift/installer/pull/9060)
* [OCPBUGS-62849](https://issues.redhat.com/browse/OCPBUGS-62849): Release 4.15 bump terraform provider azurerm [#10007](https://github.com/openshift/installer/pull/10007)
* [OCPBUGS-62410](https://issues.redhat.com/browse/OCPBUGS-62410): Make swift containers removal not fatal for UPI. [#9978](https://github.com/openshift/installer/pull/9978)
* [OCPBUGS-60497](https://issues.redhat.com/browse/OCPBUGS-60497): update resolv.conf every time on bootstrap node [#9885](https://github.com/openshift/installer/pull/9885)
* [OCPBUGS-39416](https://issues.redhat.com/browse/OCPBUGS-39416): OpenStack: Install CI dependencies from rpm [#9103](https://github.com/openshift/installer/pull/9103)
* [OCPBUGS-54353](https://issues.redhat.com/browse/OCPBUGS-54353): aws/edge/byovpc: tag edge subnets with shared value [#9612](https://github.com/openshift/installer/pull/9612)
* [OCPBUGS-54367](https://issues.redhat.com/browse/OCPBUGS-54367): IBMCloud: Move to IBM TF openshift fork [#9614](https://github.com/openshift/installer/pull/9614)
* [OCPBUGS-45961](https://issues.redhat.com/browse/OCPBUGS-45961): Update upi references to api-internal [#9298](https://github.com/openshift/installer/pull/9298)
* [OCPBUGS-50994](https://issues.redhat.com/browse/OCPBUGS-50994): Bump terraform-provider-google version to v5.37.0 to fix consistent issues during cluster creation [#9509](https://github.com/openshift/installer/pull/9509)
* [OCPBUGS-41815](https://issues.redhat.com/browse/OCPBUGS-41815): Validate MTU for custom network [#9294](https://github.com/openshift/installer/pull/9294)
* [OCPBUGS-28706](https://issues.redhat.com/browse/OCPBUGS-28706): [azure] update tested x86 instance type on 4.15 [#7966](https://github.com/openshift/installer/pull/7966)
* [OCPBUGS-47716](https://issues.redhat.com/browse/OCPBUGS-47716): [release-4.15] Power VS: Create region-zone-sysType hierarchy [#9340](https://github.com/openshift/installer/pull/9340)
* [OCPBUGS-44259](https://issues.redhat.com/browse/OCPBUGS-44259): IBMCloud: Ignore failed VPC regions [#9183](https://github.com/openshift/installer/pull/9183)
* [ARO-12457](https://issues.redhat.com/browse/ARO-12457): Include bootstrap docker config file in go module [#9260](https://github.com/openshift/installer/pull/9260)
* [OCPBUGS-45207](https://issues.redhat.com/browse/OCPBUGS-45207): add chrony.conf file when additional NTP sources are configured [#9251](https://github.com/openshift/installer/pull/9251)
* [CORS-3753](https://issues.redhat.com/browse/CORS-3753): Allow mocking of the Azure client everywhere [#9221](https://github.com/openshift/installer/pull/9221)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/installer/compare/4caaa383b8dfa4853d1962a966a430da27417423...bf73b4efbb441d052415866ef4c7b1d466153f11)


### [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal/tree/abd5d24efd670cfb719757c0d5af3409ee3c0058)

* [OCPBUGS-78100](https://issues.redhat.com/browse/OCPBUGS-78100): [release-4.15] fix vendor/ for hermetic migration [#244](https://github.com/openshift/cluster-api-provider-baremetal/pull/244)
* [OCPBUGS-46641](https://issues.redhat.com/browse/OCPBUGS-46641): Bump x/net to 0.33.0 [#227](https://github.com/openshift/cluster-api-provider-baremetal/pull/227)
* [Full changelog](https://github.com/openshift/cluster-api-provider-baremetal/compare/73a72cc821224eb7ad0fad25d3bcc8272658238b...abd5d24efd670cfb719757c0d5af3409ee3c0058)


### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/880ee0500b561ac9d0dc70d88c3f2fdfa4c7edee)

* [OCPBUGS-53336](https://issues.redhat.com/browse/OCPBUGS-53336): BMO can expose any secret via BMCEventSubscription CRD [#408](https://github.com/openshift/baremetal-operator/pull/408)
* [Full changelog](https://github.com/openshift/baremetal-operator/compare/62a7d56e20785c3f4cf02cb2511270a7aa32deea...880ee0500b561ac9d0dc70d88c3f2fdfa4c7edee)


### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/b1ed7ae497594b4c1b9637667ebd101020cd3103)

* [OCPBUGS-102683](https://issues.redhat.com/browse/OCPBUGS-102683), [OCPBUGS-102721](https://issues.redhat.com/browse/OCPBUGS-102721), [OCPBUGS-88167](https://issues.redhat.com/browse/OCPBUGS-88167), [OCPBUGS-88282](https://issues.redhat.com/browse/OCPBUGS-88282), [OCPBUGS-90959](https://issues.redhat.com/browse/OCPBUGS-90959): Use patched x/net fork v0.35.0-sec.4 [#2415](https://github.com/openshift/oc/pull/2415)
* [Full changelog](https://github.com/openshift/oc/compare/82316376e25f6453b58258df6bf1e11ec4abb670...b1ed7ae497594b4c1b9637667ebd101020cd3103)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/cffd42537ac64a3936a12de001db938d0904126e)

* [OCPBUGS-60974](https://issues.redhat.com/browse/OCPBUGS-60974): ccoctl: aws to use proper issuer url on subsequent runs [#910](https://github.com/openshift/cloud-credential-operator/pull/910)
* [OCPBUGS-58678](https://issues.redhat.com/browse/OCPBUGS-58678): github.com/golang/glog v1.2.5 [#894](https://github.com/openshift/cloud-credential-operator/pull/894)
* [OCPBUGS-53417](https://issues.redhat.com/browse/OCPBUGS-53417): github.com/golang/glog v1.2.4 [#844](https://github.com/openshift/cloud-credential-operator/pull/844)
* [OCPBUGS-53818](https://issues.redhat.com/browse/OCPBUGS-53818): update github.com/golang-jwt/jwt [#840](https://github.com/openshift/cloud-credential-operator/pull/840)
* [OCPBUGS-51540](https://issues.redhat.com/browse/OCPBUGS-51540): Ignore SNYK-GOLANG-GOLANGORGXOAUTH2JWS-8749594 due to not being affected [#833](https://github.com/openshift/cloud-credential-operator/pull/833)
* [OCPBUGS-47068](https://issues.redhat.com/browse/OCPBUGS-47068): golang.org/x/net v0.33.0 [#806](https://github.com/openshift/cloud-credential-operator/pull/806)
* [OCPBUGS-45940](https://issues.redhat.com/browse/OCPBUGS-45940): Add AWS region to aws-pod-identity-webhook [#802](https://github.com/openshift/cloud-credential-operator/pull/802)
* [OCPBUGS-45008](https://issues.redhat.com/browse/OCPBUGS-45008): Add retry to ccoctl gcp create functions [#795](https://github.com/openshift/cloud-credential-operator/pull/795)
* [OCPBUGS-45003](https://issues.redhat.com/browse/OCPBUGS-45003): github.com/golang-jwt/jwt/v4 v4.5.1 [#784](https://github.com/openshift/cloud-credential-operator/pull/784)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/60b3edb85025c66c2962fdb31c800afd484c8ba1...cffd42537ac64a3936a12de001db938d0904126e)


### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/17b7617a5c7adce0176f9e2a17a8904d0d6c0735)

* [OCPBUGS-102735](https://issues.redhat.com/browse/OCPBUGS-102735): replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 [#992](https://github.com/openshift/cluster-authentication-operator/pull/992)
* [OCPBUGS-132017](https://issues.redhat.com/browse/OCPBUGS-132017): test/e2e: pin Keycloak IdP test image to 24.0 [#1033](https://github.com/openshift/cluster-authentication-operator/pull/1033)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/7aaa40eb28afdae8c5994b672b33cd4be31cc7d1...17b7617a5c7adce0176f9e2a17a8904d0d6c0735)


### [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler/tree/89149896bc6a3d02ebf117c61d5e9ea50ad73129)

* [OCPBUGS-45149](https://issues.redhat.com/browse/OCPBUGS-45149): [release-4.15] VPA: Update OWNERS file [#326](https://github.com/openshift/kubernetes-autoscaler/pull/326)
* [Full changelog](https://github.com/openshift/kubernetes-autoscaler/compare/e78ea20540f3f445f7417cf4fe138738f3a4143a...89149896bc6a3d02ebf117c61d5e9ea50ad73129)


### [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator/tree/091858c1143356956231dd7416f0dd0ae2ee789a)

* [OCPBUGS-102738](https://issues.redhat.com/browse/OCPBUGS-102738): Bump x/net package in release-4.15 [#391](https://github.com/openshift/cluster-autoscaler-operator/pull/391)
* [Full changelog](https://github.com/openshift/cluster-autoscaler-operator/compare/8425d88b5bedd5d22acfb0f6c0edf929ec401288...091858c1143356956231dd7416f0dd0ae2ee789a)


### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/9508bd334d661b6e8e76d452082f9a6f822a7739)

* [OCPBUGS-77448](https://issues.redhat.com/browse/OCPBUGS-77448): Bump github.com/go-errors/errors to v1.5.1 [#563](https://github.com/openshift/cluster-baremetal-operator/pull/563)
* [OCPBUGS-44046](https://issues.redhat.com/browse/OCPBUGS-44046): SCC-pinning for metal3-baremetal-operator [#454](https://github.com/openshift/cluster-baremetal-operator/pull/454)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/934c2181e98f11c1a2629bd34d4a09e61323ffd6...9508bd334d661b6e8e76d452082f9a6f822a7739)


### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/e5aeca52d0a0739f1a87f39c9e5d4fa3592370ea)

* NO-JIRA: Allow sustaining engineering to self serve dependency updates [#561](https://github.com/openshift/cluster-capi-operator/pull/561)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/203435ef87a2bed13fc43db893deb8bee1dff97f...e5aeca52d0a0739f1a87f39c9e5d4fa3592370ea)


### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/aa3b6faf9cc55b87f59101adcb780d3e62ea53c5)

* [OCPBUGS-102730](https://issues.redhat.com/browse/OCPBUGS-102730): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#516](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/516)
* [OCPBUGS-63169](https://issues.redhat.com/browse/OCPBUGS-63169): ccm: disable unused secure-serving port and webhook [#424](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/424)
* [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/56181136d91dff7bac4aa5acb2c1461381ac6e34...aa3b6faf9cc55b87f59101adcb780d3e62ea53c5)


### [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator/tree/e1b692b1e9552db95c17f6a03b41d258237ab480)

* [OCPBUGS-45839](https://issues.redhat.com/browse/OCPBUGS-45839): relax validation on delete and if failureDomains not configured [#336](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/336)
* [Full changelog](https://github.com/openshift/cluster-control-plane-machine-set-operator/compare/c03231f93a4630b94d86dde98688f357777c14b6...e1b692b1e9552db95c17f6a03b41d258237ab480)


### [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator/tree/835086f2b9dbc5194bb570a01d59d695d38f9f90)

* [OCPBUGS-102745](https://issues.redhat.com/browse/OCPBUGS-102745): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#290](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/290)
* [Full changelog](https://github.com/openshift/cluster-csi-snapshot-controller-operator/compare/65dbb12b710b7126f662f5f7f2d8272f9f6868cc...835086f2b9dbc5194bb570a01d59d695d38f9f90)


### [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator/tree/0d5e29f5802d4fc05d8956c0b4ada75acaf8925d)

* [OCPBUGS-102734](https://issues.redhat.com/browse/OCPBUGS-102734): Use patched x/net fork v0.35.0-sec.4 [#492](https://github.com/openshift/cluster-dns-operator/pull/492)
* [OCPBUGS-52499](https://issues.redhat.com/browse/OCPBUGS-52499): [release-4.15] Add runbook_url for CoreDNSErrorsHigh [#432](https://github.com/openshift/cluster-dns-operator/pull/432)
* [Full changelog](https://github.com/openshift/cluster-dns-operator/compare/49290d7db2194df73dfaeb1e719580dabf166690...0d5e29f5802d4fc05d8956c0b4ada75acaf8925d)


### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/28b7be0f2c4d86d72d1fb6f296e9251e24fe441d)

* [OCPBUGS-102736](https://issues.redhat.com/browse/OCPBUGS-102736): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#1698](https://github.com/openshift/cluster-etcd-operator/pull/1698)
* [OCPBUGS-67931](https://issues.redhat.com/browse/OCPBUGS-67931): Update logrus to 1.9.3 to address CVE-2025-65637 [#1547](https://github.com/openshift/cluster-etcd-operator/pull/1547)
* [OCPBUGS-53506](https://issues.redhat.com/browse/OCPBUGS-53506): fix CVE-2025-30204 [#1404](https://github.com/openshift/cluster-etcd-operator/pull/1404)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/b72a596d1f588da8eca821f28f286dfd609691d1...28b7be0f2c4d86d72d1fb6f296e9251e24fe441d)


### [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator/tree/8558f479e1cfc437a898bdf895bfdbd7ae5fb070)

* [OCPBUGS-67932](https://issues.redhat.com/browse/OCPBUGS-67932): Bump logrus to 1.9.1 [#1289](https://github.com/openshift/cluster-image-registry-operator/pull/1289)
* [OCPBUGS-53866](https://issues.redhat.com/browse/OCPBUGS-53866): bump github.com/golang-jwt/jwt [#1220](https://github.com/openshift/cluster-image-registry-operator/pull/1220)
* [OCPBUGS-51596](https://issues.redhat.com/browse/OCPBUGS-51596): bump golang.org/x/oauth2 [#1211](https://github.com/openshift/cluster-image-registry-operator/pull/1211)
* [OCPBUGS-51264](https://issues.redhat.com/browse/OCPBUGS-51264): ensure that storage names don't end in dashes [#1183](https://github.com/openshift/cluster-image-registry-operator/pull/1183)
* [Full changelog](https://github.com/openshift/cluster-image-registry-operator/compare/6776f554e8b0664f6e7f54abc4a2c03f42a2a378...8558f479e1cfc437a898bdf895bfdbd7ae5fb070)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/5ef0efade292a92de4debfe2b7cc02ae0027729e)

* [OCPBUGS-102733](https://issues.redhat.com/browse/OCPBUGS-102733): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 [#1574](https://github.com/openshift/cluster-ingress-operator/pull/1574)
* [OCPBUGS-86712](https://issues.redhat.com/browse/OCPBUGS-86712): Add configuration override for X-SSL strip [#1491](https://github.com/openshift/cluster-ingress-operator/pull/1491)
* [OCPBUGS-49392](https://issues.redhat.com/browse/OCPBUGS-49392): Block Upgrades in release 4.15 for CA-Signed Certs Using SHA1 [#1172](https://github.com/openshift/cluster-ingress-operator/pull/1172)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/9e0d092565a4589dbcbafb7b1212651afa6d36fa...5ef0efade292a92de4debfe2b7cc02ae0027729e)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/9e3f9ec8a3c1c42643af78c61e984d077a692da2)

* [OCPBUGS-67937](https://issues.redhat.com/browse/OCPBUGS-67937): CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-rhel9-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.15.z] [#2044](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2044)
* [OCPBUGS-50661](https://issues.redhat.com/browse/OCPBUGS-50661): Increase waitForFallbackDegradedConditionTimeout [#1806](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1806)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/aabc7863cdbd76f8909a10fbc1be53b032e4ec31...9e3f9ec8a3c1c42643af78c61e984d077a692da2)


### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/399d82eaa7093d0982cdf7e1b53838ace3e6cc41)

* [OCPBUGS-102747](https://issues.redhat.com/browse/OCPBUGS-102747): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#964](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/964)
* [OCPBUGS-67987](https://issues.redhat.com/browse/OCPBUGS-67987): CVE-2025-65637 openshift4/ose-kube-proxy-rhel9: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.15.z] [#910](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/910)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/ee8cf52558df0862f9927dbc7275fbe6cc1a1e5f...399d82eaa7093d0982cdf7e1b53838ace3e6cc41)


### [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator/tree/183510ee50bb135bfe685bf40b3a7d6aecad27fe)

* [CNTRLPLANE-2843](https://issues.redhat.com/browse/CNTRLPLANE-2843): chore: update OWNERS [#625](https://github.com/openshift/cluster-kube-scheduler-operator/pull/625)
* [Full changelog](https://github.com/openshift/cluster-kube-scheduler-operator/compare/f054dfaf189b43b262c11ef7f97038c79592c796...183510ee50bb135bfe685bf40b3a7d6aecad27fe)


### [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/tree/acf9540b9d87be60f2bee90d38e06eac674a3e20)

* [OCPBUGS-67942](https://issues.redhat.com/browse/OCPBUGS-67942): Bump github.com/sirupsen/logrus to v1.9.1 [#145](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/145)
* [Full changelog](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/compare/e76cea5f52bd5a125d051c6a0da4127a4dae6700...acf9540b9d87be60f2bee90d38e06eac674a3e20)


### [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver/tree/863813ecd7b4c1416e76120896add365c492a59e)

* [OCPBUGS-46034](https://issues.redhat.com/browse/OCPBUGS-46034): Ensure trailing dots on DNS names do not block serving cert auth [#258](https://github.com/openshift/cluster-machine-approver/pull/258)
* [OCPBUGS-46034](https://issues.redhat.com/browse/OCPBUGS-46034): Client internal DNS checks should ignore trailing dot [#252](https://github.com/openshift/cluster-machine-approver/pull/252)
* [Full changelog](https://github.com/openshift/cluster-machine-approver/compare/6a809ce320324a3f841c7ac992cc77eafe1d97d7...863813ecd7b4c1416e76120896add365c492a59e)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/dac9f08e35d755ff7df78bd5d9db5b46d7054655)

* [OCPBUGS-102754](https://issues.redhat.com/browse/OCPBUGS-102754): [release-4.15] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame- #3090 [#3091](https://github.com/openshift/cluster-monitoring-operator/pull/3091)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.15] [#3109](https://github.com/openshift/cluster-monitoring-operator/pull/3109)
* [OCPBUGS-66047](https://issues.redhat.com/browse/OCPBUGS-66047): test: remove image registry e2e tests [#2757](https://github.com/openshift/cluster-monitoring-operator/pull/2757)
* [OCPBUGS-46570](https://issues.redhat.com/browse/OCPBUGS-46570): Add new metrics for OpenShift logging telemetry [#2541](https://github.com/openshift/cluster-monitoring-operator/pull/2541)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/2eb5a2c888b61fdbf80a238c3ff13787f989b7b2...dac9f08e35d755ff7df78bd5d9db5b46d7054655)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/4bc7f18710e781f1a230cf3417eeb36fcafc0b9b)

* [OCPBUGS-51287](https://issues.redhat.com/browse/OCPBUGS-51287): Manual feature backport of cert rotation for whereabouts [#3122](https://github.com/openshift/cluster-network-operator/pull/3122)
* [OCPBUGS-84183](https://issues.redhat.com/browse/OCPBUGS-84183): fix(hypershift): use net.JoinHostPort for URL construction [#2995](https://github.com/openshift/cluster-network-operator/pull/2995)
* [OCPBUGS-62980](https://issues.redhat.com/browse/OCPBUGS-62980): Update CNO reviewers/approvers [#2817](https://github.com/openshift/cluster-network-operator/pull/2817)
* [OCPBUGS-56649](https://issues.redhat.com/browse/OCPBUGS-56649): Fix live migration with feature migration configured explicitly [#2715](https://github.com/openshift/cluster-network-operator/pull/2715)
* [OCPBUGS-36688](https://issues.redhat.com/browse/OCPBUGS-36688), [OCPBUGS-43099](https://issues.redhat.com/browse/OCPBUGS-43099): Unexpected Behavior During Cluster Upgrade for the ovn-ipsec-host pods [#2658](https://github.com/openshift/cluster-network-operator/pull/2658)
* [OCPBUGS-53282](https://issues.redhat.com/browse/OCPBUGS-53282): Not update status.migration of the network.config CR to empty [#2669](https://github.com/openshift/cluster-network-operator/pull/2669)
* [Release 4.15] OCPBUGS-51208: Use applyconfigurations for updating network.oprerator status [#2653](https://github.com/openshift/cluster-network-operator/pull/2653)
* [OCPBUGS-47633](https://issues.redhat.com/browse/OCPBUGS-47633): Prevent live migration process from flapping between step-2 and step-3 [#2609](https://github.com/openshift/cluster-network-operator/pull/2609)
* [OCPBUGS-45890](https://issues.redhat.com/browse/OCPBUGS-45890): Pass transit_switch_subnet options in ovnkube-node pod [#2587](https://github.com/openshift/cluster-network-operator/pull/2587)
* [OCPBUGS-43716](https://issues.redhat.com/browse/OCPBUGS-43716): Skip including default crypto policies to avoid authby issue [#2599](https://github.com/openshift/cluster-network-operator/pull/2599)
* [OCPBUGS-46149](https://issues.redhat.com/browse/OCPBUGS-46149): Remove ip xfrm state when IPsec is disabled [#2596](https://github.com/openshift/cluster-network-operator/pull/2596)
* [OCPBUGS-43605](https://issues.redhat.com/browse/OCPBUGS-43605): OCPBUGS-42244: Exporting environment varialbe NODE_CNI for live migration [#2539](https://github.com/openshift/cluster-network-operator/pull/2539)
* [OCPBUGS-44973](https://issues.redhat.com/browse/OCPBUGS-44973), [SDN-5436](https://issues.redhat.com/browse/SDN-5436): Provide support for user owned IPsec machine configs [#2576](https://github.com/openshift/cluster-network-operator/pull/2576)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/7b8459dc88657a44785995a4c0cc88403a95954d...4bc7f18710e781f1a230cf3417eeb36fcafc0b9b)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/e828bd93defc0cc9c3fcf799d9715b95b2c03f79)

* e2e:performance: decode to valid kubeletconfig object (#1275) [#1275](https://github.com/openshift/cluster-node-tuning-operator/pull/1275)
* Fix context deadlines in ExecCommandOnPod() (#1265) [#1265](https://github.com/openshift/cluster-node-tuning-operator/pull/1265)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/4010bec15ab232b10d847df430b72913c8e66573...e828bd93defc0cc9c3fcf799d9715b95b2c03f79)


### [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator/tree/0a6713150279776bada78c64717c2a8af0dce16b)

* [OCPBUGS-86345](https://issues.redhat.com/browse/OCPBUGS-86345): Update grpc-go to v1.64.1-sec.1 to fix CVE-2026-33186 [#208](https://github.com/openshift/cluster-olm-operator/pull/208)
* [Full changelog](https://github.com/openshift/cluster-olm-operator/compare/a7ba89874970cd10765e1d0753405e32fb357d84...0a6713150279776bada78c64717c2a8af0dce16b)


### [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator/tree/031c048d17690cf5601addfe7de3eb6b067fabbd)

* [OCPBUGS-67946](https://issues.redhat.com/browse/OCPBUGS-67946): CVE-2025-65637 -  Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.15] [#655](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/655)
* [Full changelog](https://github.com/openshift/cluster-openshift-apiserver-operator/compare/078c81f6e3e39675e8b1edd864e1ddf72472bb73...031c048d17690cf5601addfe7de3eb6b067fabbd)


### [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator/tree/1ae0ba75cfdb910990437ab2898690b9e3f8f94a)

* [OCPBUGS-48832](https://issues.redhat.com/browse/OCPBUGS-48832): Add new team members to the OWNERS file [#379](https://github.com/openshift/cluster-openshift-controller-manager-operator/pull/379)
* [Full changelog](https://github.com/openshift/cluster-openshift-controller-manager-operator/compare/68e8bcd5c5df5072d5eefb8abd9c9ecab289adf4...1ae0ba75cfdb910990437ab2898690b9e3f8f94a)


### [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator/tree/a01ebb5009c7dd0f0adcd0647660797fb5f3aa74)

* [OCPBUGS-63517](https://issues.redhat.com/browse/OCPBUGS-63517): references to github.com/sclorg/django-ex.git now also refer to the branch [#660](https://github.com/openshift/cluster-samples-operator/pull/660)
* [OCPBUGS-55475](https://issues.redhat.com/browse/OCPBUGS-55475): Adding mutex to func createSamples on handler.go [#634](https://github.com/openshift/cluster-samples-operator/pull/634)
* [OCPBUGS-54481](https://issues.redhat.com/browse/OCPBUGS-54481): add rhdmalone to owners [#623](https://github.com/openshift/cluster-samples-operator/pull/623)
* [OCPBUGS-49369](https://issues.redhat.com/browse/OCPBUGS-49369): add shannon and aroyoredhat as owners [#597](https://github.com/openshift/cluster-samples-operator/pull/597)
* [Full changelog](https://github.com/openshift/cluster-samples-operator/compare/dac17316605b5dbdc0b12f84af7ff3aa41e8f577...a01ebb5009c7dd0f0adcd0647660797fb5f3aa74)


### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/953a330cf44b0ff3c786b333313bd5b7fafd00da)

* [OCPBUGS-102758](https://issues.redhat.com/browse/OCPBUGS-102758): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#732](https://github.com/openshift/cluster-storage-operator/pull/732)
* [OCPBUGS-87726](https://issues.redhat.com/browse/OCPBUGS-87726): remove oVirt code from CSO 4.15 [#710](https://github.com/openshift/cluster-storage-operator/pull/710)
* [OCPBUGS-67955](https://issues.redhat.com/browse/OCPBUGS-67955): bump github.com/sirupsen/logrus to v1.9.3 [#654](https://github.com/openshift/cluster-storage-operator/pull/654)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/4c2b89d6a00e5a0c300b61dbad2a9e289c404e98...953a330cf44b0ff3c786b333313bd5b7fafd00da)


### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/175e43980db809314c35bd80b2b2b22d40059aaa)

* [OCPBUGS-102770](https://issues.redhat.com/browse/OCPBUGS-102770): Bump golang.org/x/net to v0.35.0-sec.3 [#1462](https://github.com/openshift/cluster-version-operator/pull/1462)
* [OCPBUGS-50591](https://issues.redhat.com/browse/OCPBUGS-50591): Set `openshift.io/required-scc`: privileged annotation in `version` pods [#1152](https://github.com/openshift/cluster-version-operator/pull/1152)
* [OCPBUGS-45330](https://issues.redhat.com/browse/OCPBUGS-45330): deps: bump golang.org/x/net to 0.31.0 [#1119](https://github.com/openshift/cluster-version-operator/pull/1119)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/fbb41e8d40fd3753fb44cffe68189b717356c564...175e43980db809314c35bd80b2b2b22d40059aaa)


### [console](https://github.com/openshift/console/tree/d6a6ce977b7f6327ac63ecc4410261edcf7235b3)

* [OCPBUGS-105795](https://issues.redhat.com/browse/OCPBUGS-105795): Fix operator-hub e2e test by replacing unavailable Red Hat catalog source with Community [#17460](https://github.com/openshift/console/pull/17460)
* [OCPBUGS-133310](https://issues.redhat.com/browse/OCPBUGS-133310): Stabilize legacy OperatorHub Cypress waits [#17422](https://github.com/openshift/console/pull/17422)
* [OCPBUGS-101788](https://issues.redhat.com/browse/OCPBUGS-101788): Bump postcss to fix CVE-2026-69153 [#17113](https://github.com/openshift/console/pull/17113)
* [OCPBUGS-98421](https://issues.redhat.com/browse/OCPBUGS-98421): CVE-2026-59869 [#16753](https://github.com/openshift/console/pull/16753)
* Fix for OCPBUGS-92070: CVE-2026-44990 [#16720](https://github.com/openshift/console/pull/16720)
* [OCPBUGS-100512](https://issues.redhat.com/browse/OCPBUGS-100512): Bump postcss to fix CVE-2026-45623 [#17034](https://github.com/openshift/console/pull/17034)
* [OCPBUGS-92747](https://issues.redhat.com/browse/OCPBUGS-92747): CVE-2026-46597 openshift4/ose-console: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs [openshift-4.15.z] [#16962](https://github.com/openshift/console/pull/16962)
* [OCPBUGS-105792](https://issues.redhat.com/browse/OCPBUGS-105792): Disable operator-hub e2e tests to unblock CI [#16957](https://github.com/openshift/console/pull/16957)
* [OCPBUGS-112512](https://issues.redhat.com/browse/OCPBUGS-112512): Fix JSON annotation parsing to prevent OperatorHub crash [#17070](https://github.com/openshift/console/pull/17070)
* [OCPBUGS-87983](https://issues.redhat.com/browse/OCPBUGS-87983): [release-4.15] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators [#16598](https://github.com/openshift/console/pull/16598)
* [OCPBUGS-77117](https://issues.redhat.com/browse/OCPBUGS-77117): [release-4.15] CVE-2026-26996 Bump minimatch library [#16347](https://github.com/openshift/console/pull/16347)
* Fix for OCPBUGS-81596: CVE-2026-4800 [#16567](https://github.com/openshift/console/pull/16567)
* [OCPBUGS-88366](https://issues.redhat.com/browse/OCPBUGS-88366), [OCPBUGS-88379](https://issues.redhat.com/browse/OCPBUGS-88379), [OCPBUGS-88395](https://issues.redhat.com/browse/OCPBUGS-88395), [OCPBUGS-88402](https://issues.redhat.com/browse/OCPBUGS-88402), [OCPBUGS-88415](https://issues.redhat.com/browse/OCPBUGS-88415), [OCPBUGS-88427](https://issues.redhat.com/browse/OCPBUGS-88427), [OCPBUGS-88445](https://issues.redhat.com/browse/OCPBUGS-88445): CVE-2026-44495 [#16611](https://github.com/openshift/console/pull/16611)
* [OCPBUGS-79436](https://issues.redhat.com/browse/OCPBUGS-79436): CVE-2026-29063 Bump immutable [#16328](https://github.com/openshift/console/pull/16328)
* NO-JIRA: enable multi-architecture yarn builds [#16425](https://github.com/openshift/console/pull/16425)
* [OCPBUGS-83298](https://issues.redhat.com/browse/OCPBUGS-83298): [release-4.15] openshift4/ose-console: Axios: Remote Code Execution via Prototype Pollution escalation [#16302](https://github.com/openshift/console/pull/16302)
* [OCPBUGS-76575](https://issues.redhat.com/browse/OCPBUGS-76575): Bump axios [#16033](https://github.com/openshift/console/pull/16033)
* [CONSOLE-5011](https://issues.redhat.com/browse/CONSOLE-5011): migrate to yarn berry [#16081](https://github.com/openshift/console/pull/16081)
* NO-JIRA: Bump builder image to v29 [#15992](https://github.com/openshift/console/pull/15992)
* [OCPBUGS-74443](https://issues.redhat.com/browse/OCPBUGS-74443): Bump lodash to latest [#15970](https://github.com/openshift/console/pull/15970)
* [OCPBUGS-69767](https://issues.redhat.com/browse/OCPBUGS-69767): Disallowed Pipelines-plugin Pipelines navigation section [#15864](https://github.com/openshift/console/pull/15864)
* [OCPBUGS-65822](https://issues.redhat.com/browse/OCPBUGS-65822): Remove required flag from 'console.flag/model' pipelines-plugin extension [#15749](https://github.com/openshift/console/pull/15749)
* [OCPBUGS-65601](https://issues.redhat.com/browse/OCPBUGS-65601): `/auth/error?error=missing_state&error_type=auth` is showing blank page [#15727](https://github.com/openshift/console/pull/15727)
* [OCPBUGS-44159](https://issues.redhat.com/browse/OCPBUGS-44159): bump dompurify to latest [#15592](https://github.com/openshift/console/pull/15592)
* [OCPBUGS-60672](https://issues.redhat.com/browse/OCPBUGS-60672): Secret key with binary file changes when edited via Console [#15422](https://github.com/openshift/console/pull/15422)
* [OCPBUGS-59997](https://issues.redhat.com/browse/OCPBUGS-59997): Remove the devconsole backend common internet proxy and replace it with dedicated ones [#15359](https://github.com/openshift/console/pull/15359)
* [OCPBUGS-59564](https://issues.redhat.com/browse/OCPBUGS-59564): Add flags in console static plugin for all the components of this epic [#15306](https://github.com/openshift/console/pull/15306)
* [OCPBUGS-60029](https://issues.redhat.com/browse/OCPBUGS-60029): fix bug where / in console.tab/horizontalNav href brea… [#15353](https://github.com/openshift/console/pull/15353)
* [OCPBUGS-57521](https://issues.redhat.com/browse/OCPBUGS-57521): Debug pod logs are not accessible when debugging a node via OpenShift Console [#15181](https://github.com/openshift/console/pull/15181)
* [OCPBUGS-58223](https://issues.redhat.com/browse/OCPBUGS-58223): Fix TypeError Cannot read properties of null (reading 'metadata') [#15221](https://github.com/openshift/console/pull/15221)
* [OCPBUGS-57097](https://issues.redhat.com/browse/OCPBUGS-57097): Add all files to `vendor` regardless of gitignore [#15134](https://github.com/openshift/console/pull/15134)
* [OCPBUGS-45257](https://issues.redhat.com/browse/OCPBUGS-45257): Enabling topology e2e tests on CI [#14721](https://github.com/openshift/console/pull/14721)
* [OCPBUGS-55733](https://issues.redhat.com/browse/OCPBUGS-55733): fix bug where operator appears twice [#15021](https://github.com/openshift/console/pull/15021)
* [OCPBUGS-55174](https://issues.redhat.com/browse/OCPBUGS-55174): Add missing pipelines plugin name to known plugins [#14982](https://github.com/openshift/console/pull/14982)
* [OCPBUGS-54673](https://issues.redhat.com/browse/OCPBUGS-54673): Added token to proxy header [#14943](https://github.com/openshift/console/pull/14943)
* [OCPBUGS-54252](https://issues.redhat.com/browse/OCPBUGS-54252): Update the monitoring topic used by the console team [#14904](https://github.com/openshift/console/pull/14904)
* [OCPBUGS-53138](https://issues.redhat.com/browse/OCPBUGS-53138): fix run time error when no completed version exists [#14879](https://github.com/openshift/console/pull/14879)
* [OCPBUGS-53055](https://issues.redhat.com/browse/OCPBUGS-53055): Show Observe section without PROMETHEUS and MONITORING flags [#14867](https://github.com/openshift/console/pull/14867)
* [OCPBUGS-52344](https://issues.redhat.com/browse/OCPBUGS-52344): fix alert rule link [#14828](https://github.com/openshift/console/pull/14828)
* [OCPBUGS-51332](https://issues.redhat.com/browse/OCPBUGS-51332): Do not pass CSV name to operand list page when an exen… [#14800](https://github.com/openshift/console/pull/14800)
* [OCPBUGS-49849](https://issues.redhat.com/browse/OCPBUGS-49849): include external labels so silenced alerts not displayed in notifications [#14718](https://github.com/openshift/console/pull/14718)
* [OCPBUGS-48593](https://issues.redhat.com/browse/OCPBUGS-48593): ReRun of Resolver based PipelineRuns fails from UI [#14689](https://github.com/openshift/console/pull/14689)
* [OCPBUGS-48592](https://issues.redhat.com/browse/OCPBUGS-48592): ImagePullSecret getting duplicated when editing DeploymentConfig in Form View [#14688](https://github.com/openshift/console/pull/14688)
* [OCPBUGS-48048](https://issues.redhat.com/browse/OCPBUGS-48048): Update vendor imports to include all PatternFly components [#14662](https://github.com/openshift/console/pull/14662)
* [OCPBUGS-47646](https://issues.redhat.com/browse/OCPBUGS-47646): fix table combination [#14649](https://github.com/openshift/console/pull/14649)
* [OCPBUGS-46430](https://issues.redhat.com/browse/OCPBUGS-46430): Plugins that use very old PF4 dropdown or menu components with grouped items have bullets and padding that needs to be removed. [#14626](https://github.com/openshift/console/pull/14626)
* [OCPBUGS-45950](https://issues.redhat.com/browse/OCPBUGS-45950): Unable to remove finally tasks in pipeline builder mode [#14606](https://github.com/openshift/console/pull/14606)
* [OCPBUGS-46389](https://issues.redhat.com/browse/OCPBUGS-46389): use TaskRuns results.tekton.dev/record annotation to get the logs [#14622](https://github.com/openshift/console/pull/14622)
* [OCPBUGS-45248](https://issues.redhat.com/browse/OCPBUGS-45248): Remove ClusterTask dependency in console from Pipelines 1.17 [#14564](https://github.com/openshift/console/pull/14564)
* [OCPBUGS-44979](https://issues.redhat.com/browse/OCPBUGS-44979): Don't request user settings configmap if no user has been loaded. [#14534](https://github.com/openshift/console/pull/14534)
* [OCPBUGS-37397](https://issues.redhat.com/browse/OCPBUGS-37397): RWOP accessMode is not available on OpenShift console UI [#14078](https://github.com/openshift/console/pull/14078)
* [OCPBUGS-44998](https://issues.redhat.com/browse/OCPBUGS-44998): Add IBM Block Storage CSI driver support for RWX [#14536](https://github.com/openshift/console/pull/14536)
* [OCPBUGS-44738](https://issues.redhat.com/browse/OCPBUGS-44738): Add flag to hide the pipelines-plugin pipeline builder extensions [#14513](https://github.com/openshift/console/pull/14513)
* [Full changelog](https://github.com/openshift/console/compare/8e9e4015d859afb4219ae4c770a258fdf8aca565...d6a6ce977b7f6327ac63ecc4410261edcf7235b3)


### [console-operator](https://github.com/openshift/console-operator/tree/5666a545a321589881619fdf352aefc4873317c6)

* [OCPBUGS-102761](https://issues.redhat.com/browse/OCPBUGS-102761): Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 [#1226](https://github.com/openshift/console-operator/pull/1226)
* [OCPBUGS-77993](https://issues.redhat.com/browse/OCPBUGS-77993): [release-4.15] hermetic 4.15 [#1130](https://github.com/openshift/console-operator/pull/1130)
* [OCPBUGS-77993](https://issues.redhat.com/browse/OCPBUGS-77993): [release-4.15] NO-JIRA: update go mod dependency for konflux [#1116](https://github.com/openshift/console-operator/pull/1116)
* [OCPBUGS-46482](https://issues.redhat.com/browse/OCPBUGS-46482): Dont disable console when authConfig type is set to None [#953](https://github.com/openshift/console-operator/pull/953)
* [Full changelog](https://github.com/openshift/console-operator/compare/5d7ebcddf5a58d44ba37d63b149b06d6fc5ae1d8...5666a545a321589881619fdf352aefc4873317c6)


### [container-networking-plugins](https://github.com/openshift/containernetworking-plugins/tree/ffce799a1d110ae86e2f86052e3f930020782fb4)

* [OCPBUGS-85668](https://issues.redhat.com/browse/OCPBUGS-85668): CI Build root image tag sync with ART [#233](https://github.com/openshift/containernetworking-plugins/pull/233)
* [OCPBUGS-55948](https://issues.redhat.com/browse/OCPBUGS-55948): Check error returned by ipv6 SettleAddresses [#190](https://github.com/openshift/containernetworking-plugins/pull/190)
* [OCPBUGS-37732](https://issues.redhat.com/browse/OCPBUGS-37732): Update owners [#167](https://github.com/openshift/containernetworking-plugins/pull/167)
* [Full changelog](https://github.com/openshift/containernetworking-plugins/compare/401d35070f2d1d4db3f08ffe183b8262754b7287...ffce799a1d110ae86e2f86052e3f930020782fb4)


### [coredns](https://github.com/openshift/coredns/tree/d3a19e6731ea414a520cfad85c11634f4824c895)

* [OCPBUGS-77512](https://issues.redhat.com/browse/OCPBUGS-77512): Modify .gitignore to not exclude vendor build folders [#169](https://github.com/openshift/coredns/pull/169)
* [Full changelog](https://github.com/openshift/coredns/compare/1326282c9e158078634be4261b75ded247d233d7...d3a19e6731ea414a520cfad85c11634f4824c895)


### [csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/88bc46808fe0b18ec73c259e73639702a5a74ba7)

* [OCPBUGS-102846](https://issues.redhat.com/browse/OCPBUGS-102846), [OCPBUGS-102852](https://issues.redhat.com/browse/OCPBUGS-102852): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork- #419 [#419](https://github.com/openshift/cloud-provider-openstack/pull/419)
* [OCPBUGS-79905](https://issues.redhat.com/browse/OCPBUGS-79905): Bump google.golang.org/grpc [#398](https://github.com/openshift/cloud-provider-openstack/pull/398)
* [OCPBUGS-67958](https://issues.redhat.com/browse/OCPBUGS-67958): fix CVE-2025-65637 [#362](https://github.com/openshift/cloud-provider-openstack/pull/362)
* [OCPBUGS-58885](https://issues.redhat.com/browse/OCPBUGS-58885): CARRY: don't ignore json files [#342](https://github.com/openshift/cloud-provider-openstack/pull/342)
* [OCPBUGS-43375](https://issues.redhat.com/browse/OCPBUGS-43375): Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.28 into release-4.15 [#297](https://github.com/openshift/cloud-provider-openstack/pull/297)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/6ab1226a552376801e1f5712e3189a27729a23ed...88bc46808fe0b18ec73c259e73639702a5a74ba7)


### [csi-driver-manila-operator](https://github.com/openshift/csi-driver-manila-operator/tree/5d02c9d86b784658714e8041917493cfb8819025)

* [OCPBUGS-102769](https://issues.redhat.com/browse/OCPBUGS-102769): Use patched x/net fork v0.35.0-sec.4 [#261](https://github.com/openshift/csi-driver-manila-operator/pull/261)
* [OCPBUGS-67959](https://issues.redhat.com/browse/OCPBUGS-67959): Bump logrus [#252](https://github.com/openshift/csi-driver-manila-operator/pull/252)
* [Full changelog](https://github.com/openshift/csi-driver-manila-operator/compare/9bcf382eb68d3dd13a553dce41822d24da3870d0...5d02c9d86b784658714e8041917493cfb8819025)


### [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs/tree/f55d6f0de700a7d30634a870d5cc5ccb0fc24f98)

* [OCPBUGS-84930](https://issues.redhat.com/browse/OCPBUGS-84930): Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 to avoid go version bump and fix CVE-2026-33186 [#183](https://github.com/openshift/csi-driver-nfs/pull/183)
* [Full changelog](https://github.com/openshift/csi-driver-nfs/compare/d032dc1050b58a965e6bb9f923baef6d3c95538e...f55d6f0de700a7d30634a870d5cc5ccb0fc24f98)


### [csi-external-attacher](https://github.com/openshift/csi-external-attacher/tree/4d4bda957c386adaa531cb79cd1330a7336b35fc)

* [OCPBUGS-102764](https://issues.redhat.com/browse/OCPBUGS-102764): Bump golang.org/x/net to v0.35.0-sec.4 [#118](https://github.com/openshift/csi-external-attacher/pull/118)
* [Full changelog](https://github.com/openshift/csi-external-attacher/compare/f806f266600fbc0db4d072e4d041fc80e28deee7...4d4bda957c386adaa531cb79cd1330a7336b35fc)


### [csi-external-resizer](https://github.com/openshift/csi-external-resizer/tree/15aa4c705bd1858a1f3bd4529fada4944386506a)

* [OCPBUGS-102768](https://issues.redhat.com/browse/OCPBUGS-102768): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 [#205](https://github.com/openshift/csi-external-resizer/pull/205)
* [Full changelog](https://github.com/openshift/csi-external-resizer/compare/3b4236d382e4593ca41ecc6f394775be467b1a0d...15aa4c705bd1858a1f3bd4529fada4944386506a)


### [csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook](https://github.com/openshift/csi-external-snapshotter/tree/d4bda1840678e420c4f17881f6a644ac01683349)

* [OCPBUGS-102760](https://issues.redhat.com/browse/OCPBUGS-102760), [OCPBUGS-102784](https://issues.redhat.com/browse/OCPBUGS-102784): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 [#231](https://github.com/openshift/csi-external-snapshotter/pull/231)
* [Full changelog](https://github.com/openshift/csi-external-snapshotter/compare/4f2955c7c90cd150f9dfae782148d0fa8eba7342...d4bda1840678e420c4f17881f6a644ac01683349)


### [docker-builder](https://github.com/openshift/builder/tree/a5f0f0a5b74f9157158cdf561b29a61884c7faf1)

* [OCPBUGS-89799](https://issues.redhat.com/browse/OCPBUGS-89799), [OCPBUGS-90277](https://issues.redhat.com/browse/OCPBUGS-90277), [OCPBUGS-92299](https://issues.redhat.com/browse/OCPBUGS-92299), [OCPBUGS-92583](https://issues.redhat.com/browse/OCPBUGS-92583), [OCPBUGS-92728](https://issues.redhat.com/browse/OCPBUGS-92728): Bump golang.org/x/crypto to fix CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-46597 [#544](https://github.com/openshift/builder/pull/544)
* [OCPBUGS-65960](https://issues.redhat.com/browse/OCPBUGS-65960): BuildConfig inline Dockerfile fails with heredoc syntax [#491](https://github.com/openshift/builder/pull/491)
* [OCPBUGS-58141](https://issues.redhat.com/browse/OCPBUGS-58141): S2I build cpu limits observed by assemble are limited to 1 cpu [#477](https://github.com/openshift/builder/pull/477)
* [OCPBUGS-42917](https://issues.redhat.com/browse/OCPBUGS-42917), [OCPBUGS-43294](https://issues.redhat.com/browse/OCPBUGS-43294): Bump buildah to 1.33.12 [#442](https://github.com/openshift/builder/pull/442)
* [OCPBUGS-43188](https://issues.redhat.com/browse/OCPBUGS-43188): runc library bump to 1.1.12 [#436](https://github.com/openshift/builder/pull/436)
* [OCPBUGS-48298](https://issues.redhat.com/browse/OCPBUGS-48298): skipping some unit tests to avoid failures as they are duplicate [#428](https://github.com/openshift/builder/pull/428)
* [OCPBUGS-48281](https://issues.redhat.com/browse/OCPBUGS-48281): Add team members to the OWNERS file [#427](https://github.com/openshift/builder/pull/427)
* [Full changelog](https://github.com/openshift/builder/compare/160e7cacc7ab7a6664e4c574b78139a29ace9cd3...a5f0f0a5b74f9157158cdf561b29a61884c7faf1)


### [docker-registry](https://github.com/openshift/image-registry/tree/89c03ea33937f22ce59a0b4faff51cff8c237176)

* [OCPBUGS-53650](https://issues.redhat.com/browse/OCPBUGS-53650): bump jwt and oauth dependencies [#433](https://github.com/openshift/image-registry/pull/433)
* [Full changelog](https://github.com/openshift/image-registry/compare/b9de67d83c9f850ed42317495b7b340109b3c9ac...89c03ea33937f22ce59a0b4faff51cff8c237176)


### [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp/tree/3a2055f00aa0b2c1960b13639b10603a613eac85)

* [OCPBUGS-78281](https://issues.redhat.com/browse/OCPBUGS-78281): [release-4.15] update go mod dependency for konflux [#268](https://github.com/openshift/cluster-api-provider-gcp/pull/268)
* [Full changelog](https://github.com/openshift/cluster-api-provider-gcp/compare/bad54034ed075b24ee8962661e78cfbd84a7dd0a...3a2055f00aa0b2c1960b13639b10603a613eac85)


### [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp/tree/7ac1a063ec541ea6e1d5fa37ec43f19581066821)

* [OCPBUGS-102832](https://issues.redhat.com/browse/OCPBUGS-102832): Bump golang.org/x/net to v0.35.0-sec.3 [#192](https://github.com/openshift/machine-api-provider-gcp/pull/192)
* [OCPBUGS-79899](https://issues.redhat.com/browse/OCPBUGS-79899): Address CVE-2026-33186 [#175](https://github.com/openshift/machine-api-provider-gcp/pull/175)
* [OCPBUGS-79899](https://issues.redhat.com/browse/OCPBUGS-79899): Fix setup-envtest GCS 401 by downloading binaries directly [#177](https://github.com/openshift/machine-api-provider-gcp/pull/177)
* [OCPBUGS-55410](https://issues.redhat.com/browse/OCPBUGS-55410), [OCPBUGS-55411](https://issues.redhat.com/browse/OCPBUGS-55411): Disable shielded VMs for non-UEFI disks [#117](https://github.com/openshift/machine-api-provider-gcp/pull/117)
* [Full changelog](https://github.com/openshift/machine-api-provider-gcp/compare/b15daaf5836910277b7154a006800505f018aa5a...7ac1a063ec541ea6e1d5fa37ec43f19581066821)


### [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver/tree/1cc8b7512f16b7ab8eac8a431561d5ec23f8ab83)

* [OCPBUGS-102786](https://issues.redhat.com/browse/OCPBUGS-102786): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#142](https://github.com/openshift/gcp-pd-csi-driver/pull/142)
* [OCPBUGS-67973](https://issues.redhat.com/browse/OCPBUGS-67973): Update logrus to v1.9.3 [#93](https://github.com/openshift/gcp-pd-csi-driver/pull/93)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver/compare/856ee3e23802cd341619cc4fc3181cf6ebbbd548...1cc8b7512f16b7ab8eac8a431561d5ec23f8ab83)


### [gcp-pd-csi-driver-operator](https://github.com/openshift/gcp-pd-csi-driver-operator/tree/7cec5854d50298a19ae85290fbdbde5a3de6c898)

* [OCPBUGS-67971](https://issues.redhat.com/browse/OCPBUGS-67971): bump github.com/sirupsen/logrus to v1.9.3 [#161](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/161)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver-operator/compare/3b91ee310c8a7394ceb2d4de6a51dd18a3800312...7cec5854d50298a19ae85290fbdbde5a3de6c898)


### [haproxy-router](https://github.com/openshift/router/tree/a46169719b2a76c0fc157fd2c23ecb6893f83c83)

* [OCPBUGS-102779](https://issues.redhat.com/browse/OCPBUGS-102779): Use patched x/net fork v0.35.0-sec.4 [#857](https://github.com/openshift/router/pull/857)
* [OCPBUGS-86712](https://issues.redhat.com/browse/OCPBUGS-86712): Strip X-SSL-* headers for plain HTTP [#806](https://github.com/openshift/router/pull/806)
* [OCPBUGS-49392](https://issues.redhat.com/browse/OCPBUGS-49392): Block Upgrades for CA-Signed Certs Using SHA1 [#641](https://github.com/openshift/router/pull/641)
* [Full changelog](https://github.com/openshift/router/compare/dc38fbd84dfbed3a897f2d36b469d0ccfd1ecda3...a46169719b2a76c0fc157fd2c23ecb6893f83c83)


### [hyperkube, pod](https://github.com/openshift/kubernetes/tree/5cb2ef48f2e7e6cd14abc5e7a5ee90cd25f0d744)

* [OCPBUGS-67902](https://issues.redhat.com/browse/OCPBUGS-67902), [OCPBUGS-67977](https://issues.redhat.com/browse/OCPBUGS-67977): CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 [4.15] [#2583](https://github.com/openshift/kubernetes/pull/2583)
* [OCPBUGS-74300](https://issues.redhat.com/browse/OCPBUGS-74300): Skip E2e: attach on previously attached volumes should work [#2569](https://github.com/openshift/kubernetes/pull/2569)
* [OCPBUGS-59147](https://issues.redhat.com/browse/OCPBUGS-59147): UPSTREAM: 130047: adjusting loopback certificate validity in kube-apiserver [#2358](https://github.com/openshift/kubernetes/pull/2358)
* [OCPBUGS-59147](https://issues.redhat.com/browse/OCPBUGS-59147): UPSTREAM: <carry>: disable some legacy cloud provider Azure tests [#2359](https://github.com/openshift/kubernetes/pull/2359)
* [OCPBUGS-52183](https://issues.redhat.com/browse/OCPBUGS-52183): UPSTREAM: <carry>: kubelet/cm: fix bug where kubelet restarts from missing cpuset cgroup [#2227](https://github.com/openshift/kubernetes/pull/2227)
* [OCPBUGS-53139](https://issues.redhat.com/browse/OCPBUGS-53139): UPSTREAM: 129180: prevent unnecessary resolving of iscsi/fc devices to dm [#2244](https://github.com/openshift/kubernetes/pull/2244)
* [OCPBUGS-44514](https://issues.redhat.com/browse/OCPBUGS-44514): Bump k8s api to 1.28.15 [#2132](https://github.com/openshift/kubernetes/pull/2132)
* [Full changelog](https://github.com/openshift/kubernetes/compare/502c5ce31170c64d2cb97884b450aea9b63eb2e8...5cb2ef48f2e7e6cd14abc5e7a5ee90cd25f0d744)


### [hypershift](https://github.com/openshift/hypershift/tree/0c79962920bc370a74252fbb3b5ccb1d45ba82f0)

* Sync approver aliases with main for release-4.15 [#10197](https://github.com/openshift/hypershift/pull/10197)
* [release 4.15] Fix OCPBUGS-99080: CVE-2026-16242 konnectivity agent auth [#9130](https://github.com/openshift/hypershift/pull/9130)
* [OCPBUGS-84183](https://issues.redhat.com/browse/OCPBUGS-84183): fix(cno): use brackets only for IPv6 in server URL [#8308](https://github.com/openshift/hypershift/pull/8308)
* [OCPBUGS-74670](https://issues.redhat.com/browse/OCPBUGS-74670), [OCPBUGS-74671](https://issues.redhat.com/browse/OCPBUGS-74671): Support proxy authentication when user/pass is included in URL [#7606](https://github.com/openshift/hypershift/pull/7606)
* [CNTRLPLANE-1266](https://issues.redhat.com/browse/CNTRLPLANE-1266): Drop extinct mce-2.5 pipeline [#6655](https://github.com/openshift/hypershift/pull/6655)
* [CNTRLPLANE-1232](https://issues.redhat.com/browse/CNTRLPLANE-1232): Move CPO pipeline to hermetic builds [#6601](https://github.com/openshift/hypershift/pull/6601)
* [OCPBUGS-58506](https://issues.redhat.com/browse/OCPBUGS-58506): [release-4.15] Add missing service network DNS entries to KAS cert [#6394](https://github.com/openshift/hypershift/pull/6394)
* [OCPBUGS-57553](https://issues.redhat.com/browse/OCPBUGS-57553): Add proxy variables for the MCD Pod [#6293](https://github.com/openshift/hypershift/pull/6293)
* [OCPBUGS-57121](https://issues.redhat.com/browse/OCPBUGS-57121): Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs [#6231](https://github.com/openshift/hypershift/pull/6231)
* [OCPBUGS-46467](https://issues.redhat.com/browse/OCPBUGS-46467): Consistently look up and dial cloud API hostnames [#5300](https://github.com/openshift/hypershift/pull/5300)
* [OCPBUGS-52590](https://issues.redhat.com/browse/OCPBUGS-52590): Honor proxy vars in the util insecure http client [#5791](https://github.com/openshift/hypershift/pull/5791)
* [CNTRLPLANE-920](https://issues.redhat.com/browse/CNTRLPLANE-920): Konflux build pipeline service account migration [#6086](https://github.com/openshift/hypershift/pull/6086)
* [CNTRLPLANE-920](https://issues.redhat.com/browse/CNTRLPLANE-920): Konflux build pipeline service account migration [#6081](https://github.com/openshift/hypershift/pull/6081)
* [OCPBUGS-55266](https://issues.redhat.com/browse/OCPBUGS-55266): [release-4.15] Add konnectivity-proxy sidecar to openshift-oauth-apiserver [#6070](https://github.com/openshift/hypershift/pull/6070)
* [OCPBUGS-51800](https://issues.redhat.com/browse/OCPBUGS-51800): Fix golang crypto dependency go.mod replacement [#5995](https://github.com/openshift/hypershift/pull/5995)
* [OCPBUGS-53898](https://issues.redhat.com/browse/OCPBUGS-53898): bump golang-jwt v4 and v5 [#5908](https://github.com/openshift/hypershift/pull/5908)
* Red Hat Konflux update control-plane-operator-4-15 [#5955](https://github.com/openshift/hypershift/pull/5955)
* [ART-11792](https://issues.redhat.com/browse/ART-11792): update go mod dependency for konflux [#5923](https://github.com/openshift/hypershift/pull/5923)
* [OCPBUGS-51729](https://issues.redhat.com/browse/OCPBUGS-51729), [OCPBUGS-51800](https://issues.redhat.com/browse/OCPBUGS-51800): Bump dependencies to OCP fork in backports [#5902](https://github.com/openshift/hypershift/pull/5902)
* [OCPBUGS-50867](https://issues.redhat.com/browse/OCPBUGS-50867): Prevent IgnitionServer from flooding the API server with patch requests [#5633](https://github.com/openshift/hypershift/pull/5633)
* [OCPBUGS-52992](https://issues.redhat.com/browse/OCPBUGS-52992): [release-4.15] OCPBUGS-52506: refactor aws identity health check into new controller [#5815](https://github.com/openshift/hypershift/pull/5815)
* [OCPBUGS-52896](https://issues.redhat.com/browse/OCPBUGS-52896): Make managed-trust-bundle optional [#5813](https://github.com/openshift/hypershift/pull/5813)
* [OCPBUGS-50699](https://issues.redhat.com/browse/OCPBUGS-50699): add region to AWS creds passed to operators managed by CPO [#5669](https://github.com/openshift/hypershift/pull/5669)
* NO-JIRA: chore(deps): update dependency mkdocs-material to v9.6.6 [#5729](https://github.com/openshift/hypershift/pull/5729)
* [OCPBUGS-51253](https://issues.redhat.com/browse/OCPBUGS-51253): OCPBUGS-50692: Fix IsIPv4 function identifying also addresses instead of CIDRs [#5701](https://github.com/openshift/hypershift/pull/5701)
* [OCPBUGS-52172](https://issues.redhat.com/browse/OCPBUGS-52172): [release-4.15] Add HostedCluster additional trustbundles to konnectivity-https-proxy [#5722](https://github.com/openshift/hypershift/pull/5722)
* NO-JIRA: chore(deps): update dependency mkdocs-material to v9.6.5 [#5683](https://github.com/openshift/hypershift/pull/5683)
* chore(deps): update registry.access.redhat.com/ubi9-minimal docker tag to v9.5-1739420147 [#5624](https://github.com/openshift/hypershift/pull/5624)
* NO-JIRA: chore(deps): update dependency mkdocs-material to v9 [#5642](https://github.com/openshift/hypershift/pull/5642)
* NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9-minimal docker tag to v9.5-1738816775 [#5576](https://github.com/openshift/hypershift/pull/5576)
* NO-JIRA: chore(deps): update konflux references [#5588](https://github.com/openshift/hypershift/pull/5588)
* NO-JIRA: Red Hat Konflux update control-plane-operator-4-15 [#5338](https://github.com/openshift/hypershift/pull/5338)
* NO-JIRA: chore(deps): update dependency mkdocs-mermaid2-plugin to v0.6.0 [#5589](https://github.com/openshift/hypershift/pull/5589)
* NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.6.3 [#5586](https://github.com/openshift/hypershift/pull/5586)
* NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.6.2 [#5577](https://github.com/openshift/hypershift/pull/5577)
* [OCPBUGS-49668](https://issues.redhat.com/browse/OCPBUGS-49668): fix overwriting PKI operator HCP conditions [#5512](https://github.com/openshift/hypershift/pull/5512)
* NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1737480393 [#5486](https://github.com/openshift/hypershift/pull/5486)
* NO-JIRA: chore(deps): update konflux references (release-4.15) [#5480](https://github.com/openshift/hypershift/pull/5480)
* NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.50 (release-4.15) [#5434](https://github.com/openshift/hypershift/pull/5434)
* NO-JIRA: Update dependency mkdocs-material to v8.5.11 (release-4.15) [#5429](https://github.com/openshift/hypershift/pull/5429)
* NO-JIRA: chore(deps): update konflux references (release-4.15) [#5425](https://github.com/openshift/hypershift/pull/5425)
* NO-JIRA: chore(deps): update konflux references (release-4.15) [#5386](https://github.com/openshift/hypershift/pull/5386)
* NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1736729788 (release-4.15) - abandoned [#5380](https://github.com/openshift/hypershift/pull/5380)
* NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9-minimal docker tag to v9.5-1736404155 (release-4.15) [#5379](https://github.com/openshift/hypershift/pull/5379)
* NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.49 (release-4.15) [#5385](https://github.com/openshift/hypershift/pull/5385)
* NO-JIRA: [release-4.15] Bump golang.org/x/crypto and golang.org/x/net [#5371](https://github.com/openshift/hypershift/pull/5371)
* NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v9.5-1734626445 (release-4.15) - abandoned [#5344](https://github.com/openshift/hypershift/pull/5344)
* NO-JIRA: chore(deps): update registry.access.redhat.com/ubi9-minimal docker tag to v9.5-1734497536 (release-4.15) [#5343](https://github.com/openshift/hypershift/pull/5343)
* [OCPBUGS-46075](https://issues.redhat.com/browse/OCPBUGS-46075): Do not send traffic to local audit-webhook through konnectivity [#5274](https://github.com/openshift/hypershift/pull/5274)
* NO-JIRA: Update dependency mkdocs-glightbox to v0.4.0 (release-4.15) [#5327](https://github.com/openshift/hypershift/pull/5327)
* NO-JIRA: Update Konflux references (release-4.15) [#5326](https://github.com/openshift/hypershift/pull/5326)
* [OCPBUGS-47545](https://issues.redhat.com/browse/OCPBUGS-47545): Separate CPO containerfiles [#5334](https://github.com/openshift/hypershift/pull/5334)
* NO-JIRA: chore(deps): update dependency mkdocs to v1.6.1 (release-4.15) [#5292](https://github.com/openshift/hypershift/pull/5292)
* NO-JIRA: chore(deps): update konflux references (release-4.15) [#5291](https://github.com/openshift/hypershift/pull/5291)
* NO-JIRA: chore(deps): update konflux references (release-4.15) [#5251](https://github.com/openshift/hypershift/pull/5251)
* [OCPBUGS-44522](https://issues.redhat.com/browse/OCPBUGS-44522): Add network policies for konnectivity server and ignition server proxy [#5120](https://github.com/openshift/hypershift/pull/5120)
* [OCPBUGS-43931](https://issues.redhat.com/browse/OCPBUGS-43931): Return the right tagReference on Catalogs ImageStream [#5187](https://github.com/openshift/hypershift/pull/5187)
* NO-JIRA: Update squidfunk/mkdocs-material Docker tag to v9.5.47 (release-4.15) [#5210](https://github.com/openshift/hypershift/pull/5210)
* NO-JIRA: chore(deps): update konflux references (release-4.15) [#5208](https://github.com/openshift/hypershift/pull/5208)
* NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v9.5.46 (release-4.15) [#5190](https://github.com/openshift/hypershift/pull/5190)
* NO-JIRA: chore(deps): update konflux references to 7779f9e (release-4.15) [#5182](https://github.com/openshift/hypershift/pull/5182)
* [OCPBUGS-44278](https://issues.redhat.com/browse/OCPBUGS-44278): Configure OAuth https proxy to dial cloud endpoints directly [#5068](https://github.com/openshift/hypershift/pull/5068)
* [Full changelog](https://github.com/openshift/hypershift/compare/ff2600ab1d4ff8f5b6a860b5e9f9e9b38724e667...0c79962920bc370a74252fbb3b5ccb1d45ba82f0)


### [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm/tree/9aee59216203bd2e5fc8afbfffef988736a469de)

* [OCPBUGS-102785](https://issues.redhat.com/browse/OCPBUGS-102785): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#117](https://github.com/openshift/cloud-provider-ibm/pull/117)
* [Full changelog](https://github.com/openshift/cloud-provider-ibm/compare/cc0d54159c5d626aaa91eef94a92a80b3d1a3870...9aee59216203bd2e5fc8afbfffef988736a469de)


### [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver/tree/5b58d112224287f6d6491b0143c73d37817cb3fd)

* [OCPBUGS-79893](https://issues.redhat.com/browse/OCPBUGS-79893): Bump google.golang.org/grpc to v1.79.3 [#148](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/148)
* [OCPBUGS-77211](https://issues.redhat.com/browse/OCPBUGS-77211): [release-4.15] standardize build paths [#125](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/125)
* [OCPBUGS-58739](https://issues.redhat.com/browse/OCPBUGS-58739): bump github.com/golang/glog to version v1.2.4 [#107](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/107)
* [OCPBUGS-56064](https://issues.redhat.com/browse/OCPBUGS-56064): tech debt: rework vendor patches [#92](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/92)
* [OCPBUGS-53906](https://issues.redhat.com/browse/OCPBUGS-53906): bump github.com/golang-jwt/jwt/v4 to v4.5.2 [#85](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/85)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver/compare/81877ac81f4c59eebcfaa1653ef2bb6ed2283d1d...5b58d112224287f6d6491b0143c73d37817cb3fd)


### [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/tree/5a701801611b4117c67170306b2149e429dd55a7)

* [OCPBUGS-102790](https://issues.redhat.com/browse/OCPBUGS-102790): Use patched x/net fork v0.35.0-sec.4 [#186](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/186)
* [OCPBUGS-67980](https://issues.redhat.com/browse/OCPBUGS-67980), [OCPBUGS-67981](https://issues.redhat.com/browse/OCPBUGS-67981): bump github.com/sirupsen/logrus to v1.9.3 [#165](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/165)
* [OCPBUGS-59775](https://issues.redhat.com/browse/OCPBUGS-59775): [IBM VPC] set offlineExpansion to false in e2e test manifest [#150](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/150)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/compare/1c5b0f9fd714a3df22f6f0273aa8479bd37bbe18...5a701801611b4117c67170306b2149e429dd55a7)


### [ibm-vpc-node-label-updater](https://github.com/openshift/ibm-vpc-node-label-updater/tree/ef4e3cd1150421793938eaeddf8b1e177864282e)

* [OCPBUGS-102789](https://issues.redhat.com/browse/OCPBUGS-102789): Bump golang.org/x/net to v0.35.0-sec.4 [#62](https://github.com/openshift/ibm-vpc-node-label-updater/pull/62)
* [OCPBUGS-56064](https://issues.redhat.com/browse/OCPBUGS-56064): tech debt: rework vendor patches [#49](https://github.com/openshift/ibm-vpc-node-label-updater/pull/49)
* [OCPBUGS-53538](https://issues.redhat.com/browse/OCPBUGS-53538): bump github.com/golang-jwt/jwt/v4 to v4.5.2 [#45](https://github.com/openshift/ibm-vpc-node-label-updater/pull/45)
* [Full changelog](https://github.com/openshift/ibm-vpc-node-label-updater/compare/5d72ced58e4ff3c4d4ad02f181578755dfa0312a...ef4e3cd1150421793938eaeddf8b1e177864282e)


### [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud/tree/b15667b0e420e7e5a40e4b903fd4947849c06ada)

* [OCPBUGS-102817](https://issues.redhat.com/browse/OCPBUGS-102817): Replace golang.org/x/net with openshift-sustaining/net [#169](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/169)
* [OCPBUGS-115545](https://issues.redhat.com/browse/OCPBUGS-115545): Fetch envtest assets from the controller-tools releases [#180](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/180)
* [OCPBUGS-67289](https://issues.redhat.com/browse/OCPBUGS-67289): [release-4.15] Fix incomplete vendor/ [#137](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/137)
* [OCPBUGS-51814](https://issues.redhat.com/browse/OCPBUGS-51814): CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork [#122](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/122)
* [Full changelog](https://github.com/openshift/cluster-api-provider-ibmcloud/compare/b934c68cd083ea3abb65faf463cb6ab5383e5d7d...b15667b0e420e7e5a40e4b903fd4947849c06ada)


### [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud/tree/60300f023a8f6d01d4bd799ac01ff6ad47b352c0)

* [OCPBUGS-102807](https://issues.redhat.com/browse/OCPBUGS-102807): replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 [#107](https://github.com/openshift/machine-api-provider-ibmcloud/pull/107)
* NO-JIRA: fix unit tests broken by deprecated kubebuilder-tools bucket [#112](https://github.com/openshift/machine-api-provider-ibmcloud/pull/112)
* [OCPBUGS-36084](https://issues.redhat.com/browse/OCPBUGS-36084): Bump dependency for CVE [#54](https://github.com/openshift/machine-api-provider-ibmcloud/pull/54)
* [OCPBUGS-43675](https://issues.redhat.com/browse/OCPBUGS-43675): IBMCloud: Handle pagination for subnets [#48](https://github.com/openshift/machine-api-provider-ibmcloud/pull/48)
* [Full changelog](https://github.com/openshift/machine-api-provider-ibmcloud/compare/6b0b8ea7b16d407fd012ef134b1f9a65ed0bc3a1...60300f023a8f6d01d4bd799ac01ff6ad47b352c0)


### [insights-operator](https://github.com/openshift/insights-operator/tree/475f6a31bb52b65065d4f3e971b197a5e8cb0a3f)

* [OCPBUGS-102804](https://issues.redhat.com/browse/OCPBUGS-102804): Bump golang.org/x/net to v0.35.0-sec.3 [#1358](https://github.com/openshift/insights-operator/pull/1358)
* And 3 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/insights-operator/compare/692e90c04ac4546949eb4a537d88bb1b4801f6cb...475f6a31bb52b65065d4f3e971b197a5e8cb0a3f)


### [ironic](https://github.com/openshift/ironic-image/tree/4ad23bcc3442cdf21c95221126c929af8e4fed20)

* [OCPBUGS-97990](https://issues.redhat.com/browse/OCPBUGS-97990): bump openstack-ironic pin for CVE-2026-44918 fix [#913](https://github.com/openshift/ironic-image/pull/913)
* [OCPBUGS-97807](https://issues.redhat.com/browse/OCPBUGS-97807): bump openstack-ironic pin for CVE-2026-54423 fix(release-4.15) [#878](https://github.com/openshift/ironic-image/pull/878)
* [OCPBUGS-69784](https://issues.redhat.com/browse/OCPBUGS-69784): Bump eventlet version to 0.33.1-7 [#764](https://github.com/openshift/ironic-image/pull/764)
* [OCPBUGS-48148](https://issues.redhat.com/browse/OCPBUGS-48148), [OCPBUGS-48597](https://issues.redhat.com/browse/OCPBUGS-48597): Bump jinja2 to 3.0.1-6.el9.2 [#624](https://github.com/openshift/ironic-image/pull/624)
* [Full changelog](https://github.com/openshift/ironic-image/compare/6603bcfdfbb9b0a8a35cf4d14ec45480fce9efde...4ad23bcc3442cdf21c95221126c929af8e4fed20)


### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/bcf0cdbc51481669651e8315a06f3940377508da)

* [OCPBUGS-99889](https://issues.redhat.com/browse/OCPBUGS-99889): Bump ironic-python-agent pinned commit for CVE-2026-66138 [#311](https://github.com/openshift/ironic-agent-image/pull/311)
* [OCPBUGS-95071](https://issues.redhat.com/browse/OCPBUGS-95071): Replace individual package removal with a single rpm -e loop [#289](https://github.com/openshift/ironic-agent-image/pull/289)
* [OCPBUGS-95071](https://issues.redhat.com/browse/OCPBUGS-95071): Replace dnf remove with rpm -e to prevent dependency removal [#277](https://github.com/openshift/ironic-agent-image/pull/277)
* [OCPBUGS-69782](https://issues.redhat.com/browse/OCPBUGS-69782): Bump eventlet version to 0.33.1-7 [#233](https://github.com/openshift/ironic-agent-image/pull/233)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/d339f3ffb3bbf9879037c1f3d88303880dcb3068...bcf0cdbc51481669651e8315a06f3940377508da)


### [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader/tree/705a69ae94d273a2975ce19aa8fdd74b193e7a7c)

* [OCPBUGS-87172](https://issues.redhat.com/browse/OCPBUGS-87172): CI build root image tag and go version in go.mod sync with ART 4.15 [#121](https://github.com/openshift/ironic-rhcos-downloader/pull/121)
* [Full changelog](https://github.com/openshift/ironic-rhcos-downloader/compare/bcbcd95b6209afc8248b34c55294686dbd3831a3...705a69ae94d273a2975ce19aa8fdd74b193e7a7c)


### [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager/tree/989bcb4f50a98c741f3c9c02c2f0fb118be216c8)

* [OCPBUGS-49836](https://issues.redhat.com/browse/OCPBUGS-49836): Fix subnet validation [#49](https://github.com/openshift/ironic-static-ip-manager/pull/49)
* [Full changelog](https://github.com/openshift/ironic-static-ip-manager/compare/472000211344be4a5e9581820e94895144cf2bfc...989bcb4f50a98c741f3c9c02c2f0fb118be216c8)


### [k8s-prometheus-adapter](https://github.com/openshift/k8s-prometheus-adapter/tree/6e3ef168ef09794d1d3b8c2582f8938c21c0a568)

* [OCPBUGS-102809](https://issues.redhat.com/browse/OCPBUGS-102809): [release-4.15] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#112](https://github.com/openshift/k8s-prometheus-adapter/pull/112)
* [Full changelog](https://github.com/openshift/k8s-prometheus-adapter/compare/34e201936898455995cd60c6699c6329a696f288...6e3ef168ef09794d1d3b8c2582f8938c21c0a568)


### [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server/tree/b93e2b984066ae4cdd61fcd3a8d9147ad902c0c8)

* NO-ISSUE: synchronize OWNERS from main branch [release-4.15] [#86](https://github.com/openshift/kubernetes-metrics-server/pull/86)
* [OCPBUGS-102707](https://issues.redhat.com/browse/OCPBUGS-102707): CVE-2026-33814 openshift4/kube-metrics-server-rhel8:… [#73](https://github.com/openshift/kubernetes-metrics-server/pull/73)
* [Full changelog](https://github.com/openshift/kubernetes-metrics-server/compare/bcbf241cece8ef455be32a910f1570bae827b4a1...b93e2b984066ae4cdd61fcd3a8d9147ad902c0c8)


### [kube-proxy, sdn](https://github.com/openshift/sdn/tree/53680a50f8ca7bbcfa6c258c557c765fa6f8471a)

* [OCPBUGS-54868](https://issues.redhat.com/browse/OCPBUGS-54868): Handle `openshift-host-network` namespace as special when it modifies [#654](https://github.com/openshift/sdn/pull/654)
* [OCPBUGS-46576](https://issues.redhat.com/browse/OCPBUGS-46576): Get rid of deps.diff so it doesn't keep causing problems [4.15] [#646](https://github.com/openshift/sdn/pull/646)
* [OCPBUGS-45955](https://issues.redhat.com/browse/OCPBUGS-45955): Stop checking ruleVersion [4.16] [#644](https://github.com/openshift/sdn/pull/644)
* [OCPBUGS-43605](https://issues.redhat.com/browse/OCPBUGS-43605): backport fix for network policy during live migration [#642](https://github.com/openshift/sdn/pull/642)
* [Full changelog](https://github.com/openshift/sdn/compare/f371b5be76a71a7f55f2e0b674f09a7f2ec5f5bf...53680a50f8ca7bbcfa6c258c557c765fa6f8471a)


### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/22a00b8143a69d7af15e45609e594f0d87a730aa)

* [OCPBUGS-102811](https://issues.redhat.com/browse/OCPBUGS-102811): Use patched x/net fork v0.35.0-sec.4 [#161](https://github.com/openshift/kube-state-metrics/pull/161)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.15] [#190](https://github.com/openshift/kube-state-metrics/pull/190)
* [Full changelog](https://github.com/openshift/kube-state-metrics/compare/037b59c265454c599dfb0829a856e14b1ab07896...22a00b8143a69d7af15e45609e594f0d87a730aa)


### [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator/tree/a6a9ab1a765ea5bf5815e6b15a5a39840a03bb3e)

* NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-15). [#228](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/228)
* [Full changelog](https://github.com/openshift/kubernetes-kube-storage-version-migrator/compare/e8749689edb8e7fea42eca5f2b67c3187192cdeb...a6a9ab1a765ea5bf5815e6b15a5a39840a03bb3e)


### [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt/tree/379c50d50b7158efd554b8ff69bea6a2a443e1a8)

* [OCPBUGS-95081](https://issues.redhat.com/browse/OCPBUGS-95081): OWNERS: Update component to Cloud Compute / KubeVirt Provider [#83](https://github.com/openshift/cloud-provider-kubevirt/pull/83)
* [Full changelog](https://github.com/openshift/cloud-provider-kubevirt/compare/dbaf9ea1edd5a953606a80cb45f723c934a73ded...379c50d50b7158efd554b8ff69bea6a2a443e1a8)


### [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver/tree/ebe618a56a660c5b4199aa51fc06933129024cbb)

* [OCPBUGS-83658](https://issues.redhat.com/browse/OCPBUGS-83658): Bump google.golang.org/grpc to v1.79.3 [#103](https://github.com/openshift/kubevirt-csi-driver/pull/103)
* fix for OCPBUGS-58587: CVE-2024-45339 openshift4/kubevirt-csi-driver [#69](https://github.com/openshift/kubevirt-csi-driver/pull/69)
* [Full changelog](https://github.com/openshift/kubevirt-csi-driver/compare/d3bdbce4b08eb05eea70be77f4ecf33e351ce4d3...ebe618a56a660c5b4199aa51fc06933129024cbb)


### [libvirt-machine-controllers](https://github.com/openshift/cluster-api-provider-libvirt/tree/416999a8de40238abc7be3b24e54857f8e5e97e6)

* [OCPBUGS-77197](https://issues.redhat.com/browse/OCPBUGS-77197): Fix incomplete vendor [#303](https://github.com/openshift/cluster-api-provider-libvirt/pull/303)
* [OCPBUGS-26506](https://issues.redhat.com/browse/OCPBUGS-26506): Updating ose-libvirt-machine-controllers-container image to be consistent with ART for 4.15 [#282](https://github.com/openshift/cluster-api-provider-libvirt/pull/282)
* [Full changelog](https://github.com/openshift/cluster-api-provider-libvirt/compare/1e096cdf1bfd60e9bf5ee6c90585a8f96cc0c09a...416999a8de40238abc7be3b24e54857f8e5e97e6)


### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/659757f603394f0adfd59b4b9a2b5457427bea24)

* [OCPBUGS-102825](https://issues.redhat.com/browse/OCPBUGS-102825): replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 [#1548](https://github.com/openshift/machine-api-operator/pull/1548)
* [OCPBUGS-130682](https://issues.redhat.com/browse/OCPBUGS-130682): Fix unit and vsphere namespace tests [#1580](https://github.com/openshift/machine-api-operator/pull/1580)
* [OCPBUGS-67989](https://issues.redhat.com/browse/OCPBUGS-67989): bumped logrus to v1.9.3 [#1460](https://github.com/openshift/machine-api-operator/pull/1460)
* [OCPBUGS-59861](https://issues.redhat.com/browse/OCPBUGS-59861): Updates GCP CredentialsRequest [#1397](https://github.com/openshift/machine-api-operator/pull/1397)
* [OCPBUGS-55410](https://issues.redhat.com/browse/OCPBUGS-55410), [OCPBUGS-55411](https://issues.redhat.com/browse/OCPBUGS-55411): Updates GCP credentials request [#1356](https://github.com/openshift/machine-api-operator/pull/1356)
* [OCPBUGS-53251](https://issues.redhat.com/browse/OCPBUGS-53251): add image/read permissions [#1349](https://github.com/openshift/machine-api-operator/pull/1349)
* [OCPBUGS-52481](https://issues.redhat.com/browse/OCPBUGS-52481): Drop oVirt support [#1340](https://github.com/openshift/machine-api-operator/pull/1340)
* [OCPBUGS-48105](https://issues.redhat.com/browse/OCPBUGS-48105): Vsphere: Handle cloned instance with lost taskID [#1321](https://github.com/openshift/machine-api-operator/pull/1321)
* [OCPBUGS-46080](https://issues.redhat.com/browse/OCPBUGS-46080): Ensure deletion annotation takes priority and oldestPolicy can distinguish longer ages [#1314](https://github.com/openshift/machine-api-operator/pull/1314)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/3ab953de1bdc5c1977222011ebc31254d06c98d2...659757f603394f0adfd59b4b9a2b5457427bea24)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/1ffa8341fb18365b72398fc4eedffcbe4d423256)

* [OCPBUGS-99046](https://issues.redhat.com/browse/OCPBUGS-99046): Remove sensitive ControllerConfig logging [#6318](https://github.com/openshift/machine-config-operator/pull/6318)
* [OCPBUGS-77636](https://issues.redhat.com/browse/OCPBUGS-77636): Machine-config controller should not log about non-existent pull-secret changes [#5573](https://github.com/openshift/machine-config-operator/pull/5573)
* [OCPBUGS-60214](https://issues.redhat.com/browse/OCPBUGS-60214): [release-4.15] OCPBUGS-53248: Enforce VIPs to be collocated at the same host [#4988](https://github.com/openshift/machine-config-operator/pull/4988)
* [OCPBUGS-59737](https://issues.redhat.com/browse/OCPBUGS-59737): Remove MachineConfigNode CRD from manifests [#5188](https://github.com/openshift/machine-config-operator/pull/5188)
* [OCPBUGS-48284](https://issues.redhat.com/browse/OCPBUGS-48284): Do not run resolv-prepender from NM dispatcher [#4783](https://github.com/openshift/machine-config-operator/pull/4783)
* [OCPBUGS-57340](https://issues.redhat.com/browse/OCPBUGS-57340): Do not enable on-prem-resolv-prepender.path for UPI [#5115](https://github.com/openshift/machine-config-operator/pull/5115)
* [OCPBUGS-36688](https://issues.redhat.com/browse/OCPBUGS-36688): Add ipsec connect wait service [#4937](https://github.com/openshift/machine-config-operator/pull/4937)
* [OCPBUGS-54206](https://issues.redhat.com/browse/OCPBUGS-54206): Update format verbs for alert logs [#4943](https://github.com/openshift/machine-config-operator/pull/4943)
* [OCPBUGS-54176](https://issues.redhat.com/browse/OCPBUGS-54176): Update ObservedGeneration in KubeletConfig [#4944](https://github.com/openshift/machine-config-operator/pull/4944)
* [OCPBUGS-43742](https://issues.redhat.com/browse/OCPBUGS-43742): Soften haproxy timeout for kubeapi probe [#4663](https://github.com/openshift/machine-config-operator/pull/4663)
* [OCPBUGS-50526](https://issues.redhat.com/browse/OCPBUGS-50526): Add clarification to invalid maxUnavailable alert [#4842](https://github.com/openshift/machine-config-operator/pull/4842)
* [OCPBUGS-48583](https://issues.redhat.com/browse/OCPBUGS-48583): trying to wait for sub-contorllers [#4796](https://github.com/openshift/machine-config-operator/pull/4796)
* [OCPBUGS-46034](https://issues.redhat.com/browse/OCPBUGS-46034): Remove trailing periods from AWS provided hostnames [#4745](https://github.com/openshift/machine-config-operator/pull/4745)
* [OCPBUGS-44565](https://issues.redhat.com/browse/OCPBUGS-44565): Post upgrading from 4.14 to 4.15.36, the observedGeneration count increased tremendously [#4702](https://github.com/openshift/machine-config-operator/pull/4702)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/657ab58b76a99f2e566714bead33674c08ff9301...1ffa8341fb18365b72398fc4eedffcbe4d423256)


### [machine-image-customization-controller](https://github.com/openshift/image-customization-controller/tree/1290e685f133f927ccbf656d8988b9a7765fbd9d)

* [OCPBUGS-102816](https://issues.redhat.com/browse/OCPBUGS-102816): Replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 [#197](https://github.com/openshift/image-customization-controller/pull/197)
* [OCPBUGS-67983](https://issues.redhat.com/browse/OCPBUGS-67983): [4.15] uplift logrus [#154](https://github.com/openshift/image-customization-controller/pull/154)
* [Full changelog](https://github.com/openshift/image-customization-controller/compare/97d87657caab4323f82f9d0958e6d30fc8fd1846...1290e685f133f927ccbf656d8988b9a7765fbd9d)


### [machine-os-images](https://github.com/openshift/machine-os-images/tree/ad1c48fc1654d6e4b8ceb22f500e90ca6eb25230)

* [OCPBUGS-87879](https://issues.redhat.com/browse/OCPBUGS-87879): Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs [#103](https://github.com/openshift/machine-os-images/pull/103)
* [OCPBUGS-54170](https://issues.redhat.com/browse/OCPBUGS-54170): Change rhcos release browser url [#58](https://github.com/openshift/machine-os-images/pull/58)
* [Full changelog](https://github.com/openshift/machine-os-images/compare/9e9c920f985a375536e8d4caafd2d7ed579e27f3...ad1c48fc1654d6e4b8ceb22f500e90ca6eb25230)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/80e192ab68ecf5c067b8a6453c24be870fca7b65)

* NO-JIRA: Updating monitoring-plugin-container image to be consistent with ART for 4.15 [#1399](https://github.com/openshift/monitoring-plugin/pull/1399)
* [OCPBUGS-127147](https://issues.redhat.com/browse/OCPBUGS-127147): Replace react-linkify with linkify-react to fix CVE-2026-59887 [#1355](https://github.com/openshift/monitoring-plugin/pull/1355)
* [OCPBUGS-74446](https://issues.redhat.com/browse/OCPBUGS-74446): [release-4.15] fix: upgrade lodash to remove vulnerable code [#907](https://github.com/openshift/monitoring-plugin/pull/907)
* [OCPBUGS-78493](https://issues.redhat.com/browse/OCPBUGS-78493): fix for CVE-2025-69873 [#850](https://github.com/openshift/monitoring-plugin/pull/850)
* [OCPBUGS-44393](https://issues.redhat.com/browse/OCPBUGS-44393): Manual cherry pick cross spawn 4.15 [#277](https://github.com/openshift/monitoring-plugin/pull/277)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/e40b085a258b5762532875bbd9ce34d1f75a90b4...80e192ab68ecf5c067b8a6453c24be870fca7b65)


### [multus-admission-controller](https://github.com/openshift/multus-admission-controller/tree/a2e3c6e5d5dcb6dd059f87a2f5a519482d955c45)

* [OCPBUGS-58769](https://issues.redhat.com/browse/OCPBUGS-58769): Update the github.com/golang/glog module to v1.2.4 [#104](https://github.com/openshift/multus-admission-controller/pull/104)
* [Full changelog](https://github.com/openshift/multus-admission-controller/compare/9ea52de962dd644573c99b2f9554a6c4dfaacf62...a2e3c6e5d5dcb6dd059f87a2f5a519482d955c45)


### [multus-cni](https://github.com/openshift/multus-cni/tree/d7c59498b60c2a93bfdfe49f2d9ab5c923239b66)

* [OCPBUGS-85252](https://issues.redhat.com/browse/OCPBUGS-85252): Fix server url in kubeconfig [#301](https://github.com/openshift/multus-cni/pull/301)
* no-issue: [release-4.15] Bump Go to 1.20 and fix CI build root image [#294](https://github.com/openshift/multus-cni/pull/294)
* [Full changelog](https://github.com/openshift/multus-cni/compare/05497ad135c629de9b4ffb0a13fb91d58a335d25...d7c59498b60c2a93bfdfe49f2d9ab5c923239b66)


### [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni/tree/cfa4f975508177d8daee9652ca75fe16f9e5dc27)

* [OCPBUGS-55619](https://issues.redhat.com/browse/OCPBUGS-55619): Fixes leftover podref issue [#366](https://github.com/openshift/whereabouts-cni/pull/366)
* [Full changelog](https://github.com/openshift/whereabouts-cni/compare/d80fe46e1895698f3d1073ab965c859a89be2a47...cfa4f975508177d8daee9652ca75fe16f9e5dc27)


### [must-gather](https://github.com/openshift/must-gather/tree/0f70f31cc6a01d849fef5262e20f934bf87a91ee)

* [OCPBUGS-36371](https://issues.redhat.com/browse/OCPBUGS-36371): Run ppc node collection in parallel [#430](https://github.com/openshift/must-gather/pull/430)
* [OCPBUGS-42970](https://issues.redhat.com/browse/OCPBUGS-42970): Collect etcd object count [#456](https://github.com/openshift/must-gather/pull/456)
* [OCPBUGS-48083](https://issues.redhat.com/browse/OCPBUGS-48083): Update owners [#474](https://github.com/openshift/must-gather/pull/474)
* [OCPBUGS-46451](https://issues.redhat.com/browse/OCPBUGS-46451): Support gathering IPsec data [#471](https://github.com/openshift/must-gather/pull/471)
* [Full changelog](https://github.com/openshift/must-gather/compare/48de487eb38d1434440e4fb8164022b2b708332a...0f70f31cc6a01d849fef5262e20f934bf87a91ee)


### [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon/tree/1b188fa1f7efdda0dafbdd409deed32450017dfc)

* [OCPBUGS-58779](https://issues.redhat.com/browse/OCPBUGS-58779): Bump github.com/golang/glog to v1.2.4 (#114) [#114](https://github.com/openshift/network-metrics-daemon/pull/114)
* [OCPBUGS-60374](https://issues.redhat.com/browse/OCPBUGS-60374): Replace e2e test image (#126) [#126](https://github.com/openshift/network-metrics-daemon/pull/126)
* swtich golint install method (#124) [#124](https://github.com/openshift/network-metrics-daemon/pull/124)
* [Full changelog](https://github.com/openshift/network-metrics-daemon/compare/9e21740225af47318a9ed6d03c2eb9ee2aaea883...1b188fa1f7efdda0dafbdd409deed32450017dfc)


### [nutanix-machine-controllers](https://github.com/openshift/machine-api-provider-nutanix/tree/ec58a6114b305b91d9a476e5f29c98b1a059c2ad)

* [OCPBUGS-47264](https://issues.redhat.com/browse/OCPBUGS-47264): fixing CVE-2024-45338 [#117](https://github.com/openshift/machine-api-provider-nutanix/pull/117)
* [OCPBUGS-51850](https://issues.redhat.com/browse/OCPBUGS-51850): CVE-2025-22868 [#109](https://github.com/openshift/machine-api-provider-nutanix/pull/109)
* [Full changelog](https://github.com/openshift/machine-api-provider-nutanix/compare/8de6f944d35b2fefaf926006aecf8445be4e6149...ec58a6114b305b91d9a476e5f29c98b1a059c2ad)


### [oauth-apiserver](https://github.com/openshift/oauth-apiserver/tree/2a98b2ccd96215b432c018b817d238766613df5d)

* [OCPBUGS-74925](https://issues.redhat.com/browse/OCPBUGS-74925): bump kubernetes-apiserver to pick up loopback cert expiration update [#173](https://github.com/openshift/oauth-apiserver/pull/173)
* NO-JIRA: (chore): update OWNERS [#175](https://github.com/openshift/oauth-apiserver/pull/175)
* [Full changelog](https://github.com/openshift/oauth-apiserver/compare/0e158441dbfdf232d7fea50b7c4eae3023d2cdbb...2a98b2ccd96215b432c018b817d238766613df5d)


### [oauth-proxy](https://github.com/openshift/oauth-proxy/tree/75df1732d90b178391ce9ae218d95cf4bb26c3d7)

* [OCPBUGS-136606](https://issues.redhat.com/browse/OCPBUGS-136606): [release-4.15] Sync OWNERS and OWNERS_ALIASES with master [#400](https://github.com/openshift/oauth-proxy/pull/400)
* [OCPBUGS-112089](https://issues.redhat.com/browse/OCPBUGS-112089): bugfix: rewrite open redirect strings to '/' [#387](https://github.com/openshift/oauth-proxy/pull/387)
* [OCPBUGS-61447](https://issues.redhat.com/browse/OCPBUGS-61447): Update x/crypto to v0.31.0 [#336](https://github.com/openshift/oauth-proxy/pull/336)
* [Full changelog](https://github.com/openshift/oauth-proxy/compare/241a88c47cb01d0e61ff105ceff81ad14fd9ea6e...75df1732d90b178391ce9ae218d95cf4bb26c3d7)


### [oauth-server](https://github.com/openshift/oauth-server/tree/25c9f9a789ea84e50052bcce7b713666d0325597)

* [OCPBUGS-102830](https://issues.redhat.com/browse/OCPBUGS-102830): Replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 [#292](https://github.com/openshift/oauth-server/pull/292)
* [OCPBUGS-87066](https://issues.redhat.com/browse/OCPBUGS-87066): bugfix: default to english when Accept-Language header contains more than 1000 underscores [#275](https://github.com/openshift/oauth-server/pull/275)
* [Full changelog](https://github.com/openshift/oauth-server/compare/c055dbb9a84e04575ade106e9a43cc638a8aeaef...25c9f9a789ea84e50052bcce7b713666d0325597)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/55da6c9d28fcbd0c975fd42cf5916a10d7c192d9)

* [OCPBUGS-130909](https://issues.redhat.com/browse/OCPBUGS-130909): v1 accept catalog root entries and relative symlink targets [#1597](https://github.com/openshift/oc-mirror/pull/1597)
* [OCPBUGS-77858](https://issues.redhat.com/browse/OCPBUGS-77858): fix vendor for hermetic 4.15 [#1361](https://github.com/openshift/oc-mirror/pull/1361)
* And 2 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/e91f573c771182f7fd4a2d3513ed49562dee6b38...55da6c9d28fcbd0c975fd42cf5916a10d7c192d9)


### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/e488c1f6be78eef974989890ce99526518d66ec4)

* [OCPBUGS-82665](https://issues.redhat.com/browse/OCPBUGS-82665): Address CVE-2026-35469 [#648](https://github.com/openshift/openshift-apiserver/pull/648)
* [OCPBUGS-67998](https://issues.redhat.com/browse/OCPBUGS-67998): CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.15] [#611](https://github.com/openshift/openshift-apiserver/pull/611)
* [OCPBUGS-74923](https://issues.redhat.com/browse/OCPBUGS-74923): bump kubernetes-apiserver to pick up loopback cert expiration update [#600](https://github.com/openshift/openshift-apiserver/pull/600)
* [OCPBUGS-58822](https://issues.redhat.com/browse/OCPBUGS-58822): Fix image reference in TestImageStreamImportQuayIO [#517](https://github.com/openshift/openshift-apiserver/pull/517)
* [OCPBUGS-47766](https://issues.redhat.com/browse/OCPBUGS-47766): Pass expected type to deploymentconfig/scale object validation. [#466](https://github.com/openshift/openshift-apiserver/pull/466)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/08f4c422eed5d9584799244c0d9755708686c0c8...e488c1f6be78eef974989890ce99526518d66ec4)


### [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager/tree/110a10ad9c720400f87e3428354ccff051b70af3)

* [OCPBUGS-57761](https://issues.redhat.com/browse/OCPBUGS-57761): Set node-pullsecrets volume to read-only to protect image pull credentials [#396](https://github.com/openshift/openshift-controller-manager/pull/396)
* [OCPBUGS-56474](https://issues.redhat.com/browse/OCPBUGS-56474): Empty proxy variables are causing issues during the build [#383](https://github.com/openshift/openshift-controller-manager/pull/383)
* [OCPBUGS-54344](https://issues.redhat.com/browse/OCPBUGS-54344): Unable to look up the service account secrets for build [#370](https://github.com/openshift/openshift-controller-manager/pull/370)
* [OCPBUGS-48280](https://issues.redhat.com/browse/OCPBUGS-48280): Add team members to the OWNERS file [#359](https://github.com/openshift/openshift-controller-manager/pull/359)
* [Full changelog](https://github.com/openshift/openshift-controller-manager/compare/f2afd434358966ccc09f55d4915d2689ed2cb1b6...110a10ad9c720400f87e3428354ccff051b70af3)


### [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics/tree/4b6dd0e358b8e75d880adc4967567e31f0f79ff6)

* NO-ISSUE: synchronize OWNERS from main branch [#149](https://github.com/openshift/openshift-state-metrics/pull/149)
* [Full changelog](https://github.com/openshift/openshift-state-metrics/compare/1915f64591a18c11138d10c00c50b3f5cff632ce...4b6dd0e358b8e75d880adc4967567e31f0f79ff6)


### [openstack-cinder-csi-driver-operator](https://github.com/openshift/openstack-cinder-csi-driver-operator/tree/3bf0fd40a4534c6b13cbbc59fe18b5dd4ba7e8bf)

* [OCPBUGS-102841](https://issues.redhat.com/browse/OCPBUGS-102841): Use patched x/net fork v0.35.0-sec.4 [#200](https://github.com/openshift/openstack-cinder-csi-driver-operator/pull/200)
* [OCPBUGS-68000](https://issues.redhat.com/browse/OCPBUGS-68000): CVE-2025-65637 openshift4/ose-openstack-cinder-csi-driver-rhel8-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.15.z] [#192](https://github.com/openshift/openstack-cinder-csi-driver-operator/pull/192)
* [Full changelog](https://github.com/openshift/openstack-cinder-csi-driver-operator/compare/d0c24077b4e4ac1e00a6a529a814066cd9b5521c...3bf0fd40a4534c6b13cbbc59fe18b5dd4ba7e8bf)


### [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack/tree/bf81e212f644e7d09a66fd111566e71f0538851e)

* [OCPBUGS-78171](https://issues.redhat.com/browse/OCPBUGS-78171): hermetic 4.15 [#164](https://github.com/openshift/machine-api-provider-openstack/pull/164)
* [Full changelog](https://github.com/openshift/machine-api-provider-openstack/compare/396a09fffe401679f18e8a7db56c77bbf2dee246...bf81e212f644e7d09a66fd111566e71f0538851e)


### [operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/91512e7b67ac94df9568cc33d53cb49fc28cbb8e)

* [OCPBUGS-102858](https://issues.redhat.com/browse/OCPBUGS-102858): Use patched x/net fork v0.35.0-sec.4 [#1381](https://github.com/openshift/operator-framework-olm/pull/1381)
* [OCPBUGS-102857](https://issues.redhat.com/browse/OCPBUGS-102857): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 [#1375](https://github.com/openshift/operator-framework-olm/pull/1375)
* [OCPBUGS-79906](https://issues.redhat.com/browse/OCPBUGS-79906), [OCPBUGS-87895](https://issues.redhat.com/browse/OCPBUGS-87895): Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.64.1-sec.1 [release-4.15] [#1325](https://github.com/openshift/operator-framework-olm/pull/1325)
* [OCPBUGS-82056](https://issues.redhat.com/browse/OCPBUGS-82056): Drop github.com/distribution/distribution dep [#1303](https://github.com/openshift/operator-framework-olm/pull/1303)
* [OCPBUGS-61466](https://issues.redhat.com/browse/OCPBUGS-61466): [release-4.15] Add NetworkPolicy as a supported kind [#1051](https://github.com/openshift/operator-framework-olm/pull/1051)
* [OCPBUGS-61389](https://issues.redhat.com/browse/OCPBUGS-61389): [4.15] e2e stability fixes [#1084](https://github.com/openshift/operator-framework-olm/pull/1084)
* [OCPBUGS-57430](https://issues.redhat.com/browse/OCPBUGS-57430): reduce cache expiry frequency [release-4.19] [#1023](https://github.com/openshift/operator-framework-olm/pull/1023)
* [OCPBUGS-56463](https://issues.redhat.com/browse/OCPBUGS-56463): fix(olm): improve error logging for missing olm.managed label (#3558) [#1010](https://github.com/openshift/operator-framework-olm/pull/1010)
* [OCPBUGS-48662](https://issues.redhat.com/browse/OCPBUGS-48662): Fix concurrent namespace resolution [#948](https://github.com/openshift/operator-framework-olm/pull/948)
* [OCPBUGS-48697](https://issues.redhat.com/browse/OCPBUGS-48697): Fix excessive catalog source snapshots cause severe performance regression [#958](https://github.com/openshift/operator-framework-olm/pull/958)
* [OCPBUGS-46926](https://issues.redhat.com/browse/OCPBUGS-46926), [OCPBUGS-46933](https://issues.redhat.com/browse/OCPBUGS-46933), [OCPBUGS-47313](https://issues.redhat.com/browse/OCPBUGS-47313): x/net bump to v0.34.0 [release-4.15] [#940](https://github.com/openshift/operator-framework-olm/pull/940)
* [OCPBUGS-46479](https://issues.redhat.com/browse/OCPBUGS-46479): CRD upgrade existing CR validation fix [#917](https://github.com/openshift/operator-framework-olm/pull/917)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/2a0924f9655371f636d16b60e9ae7e49934c5640...91512e7b67ac94df9568cc33d53cb49fc28cbb8e)


### [operator-marketplace](https://github.com/operator-framework/operator-marketplace/tree/5c7af29b454e253322d8650c7d125c842eca92c8)

* [OCPBUGS-68005](https://issues.redhat.com/browse/OCPBUGS-68005): CVE-2025-65637 fixed in logrus v1.9.3+ [#733](https://github.com/operator-framework/operator-marketplace/pull/733)
* [OCPBUGS-62221](https://issues.redhat.com/browse/OCPBUGS-62221): Remove Expect func so that the test case can use the retry logic [#672](https://github.com/operator-framework/operator-marketplace/pull/672)
* [OCPBUGS-62119](https://issues.redhat.com/browse/OCPBUGS-62119): Update memoryTarget on catalog source pods [#666](https://github.com/operator-framework/operator-marketplace/pull/666)
* [OCPBUGS-49428](https://issues.redhat.com/browse/OCPBUGS-49428): Upgrade golang.org/x/net [release-4.15] [#588](https://github.com/operator-framework/operator-marketplace/pull/588)
* [Full changelog](https://github.com/operator-framework/operator-marketplace/compare/1f1bc1988527f01b7326f63953aacbd400fd8426...5c7af29b454e253322d8650c7d125c842eca92c8)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/871ee75596467e467b6123f66e135b363af14086)

* [OCPBUGS-97815](https://issues.redhat.com/browse/OCPBUGS-97815): External gateway: Remove routes for external gateway pods in terminating or not ready state [#3285](https://github.com/openshift/ovn-kubernetes/pull/3285)
* [CORENET-6055](https://issues.redhat.com/browse/CORENET-6055), [OCPBUGS-76403](https://issues.redhat.com/browse/OCPBUGS-76403): [release-4.15] Dockerfile: Unpin OVN and consume the latest from FDP [#2974](https://github.com/openshift/ovn-kubernetes/pull/2974)
* [OCPBUGS-56660](https://issues.redhat.com/browse/OCPBUGS-56660), [OCPBUGS-58162](https://issues.redhat.com/browse/OCPBUGS-58162): Unpin OVS patch versions #2649 [#2649](https://github.com/openshift/ovn-kubernetes/pull/2649)
* [OCPBUGS-56419](https://issues.redhat.com/browse/OCPBUGS-56419): Update to FDP25.A.1 24.03.5-40. [#2573](https://github.com/openshift/ovn-kubernetes/pull/2573)
* [OCPBUGS-50583](https://issues.redhat.com/browse/OCPBUGS-50583): Bump OVN to 23.09.6-12 to consume fix for FDP-905 [#2454](https://github.com/openshift/ovn-kubernetes/pull/2454)
* [OCPBUGS-53384](https://issues.redhat.com/browse/OCPBUGS-53384): [release-4.15] Dockerfile.base: bump OVS version to 3.3 [#2492](https://github.com/openshift/ovn-kubernetes/pull/2492)
* [OCPBUGS-43605](https://issues.redhat.com/browse/OCPBUGS-43605): Add SDN node subnet gateway IP to host-network address_set [#2419](https://github.com/openshift/ovn-kubernetes/pull/2419)
* [OCPBUGS-46403](https://issues.redhat.com/browse/OCPBUGS-46403): Add static route to the hairpin masquerade IPs to pod [#2396](https://github.com/openshift/ovn-kubernetes/pull/2396)
* [OCPBUGS-47799](https://issues.redhat.com/browse/OCPBUGS-47799): Let OVN-northd bind remote ports [#2407](https://github.com/openshift/ovn-kubernetes/pull/2407)
* [OCPBUGS-44708](https://issues.redhat.com/browse/OCPBUGS-44708): Add hybird overlay pod IPs to the namespace address_set [#2399](https://github.com/openshift/ovn-kubernetes/pull/2399)
* [OCPBUGS-45097](https://issues.redhat.com/browse/OCPBUGS-45097): pin libreswan to 4.6-3.el9_0.3 [#2374](https://github.com/openshift/ovn-kubernetes/pull/2374)
* [OCPBUGS-44782](https://issues.redhat.com/browse/OCPBUGS-44782): Bump ovs to 3.1.0-137 [#2359](https://github.com/openshift/ovn-kubernetes/pull/2359)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/0d35785ab8c4fccea85a0d2e6dc49fe1da2d11cd...871ee75596467e467b6123f66e135b363af14086)


### [powervs-block-csi-driver](https://github.com/openshift/ibm-powervs-block-csi-driver/tree/ac7311a4ece482ff94f12a5854d56277234924f6)

* [OCPBUGS-105269](https://issues.redhat.com/browse/OCPBUGS-105269): Mitigate CVE-2025-30204 by bumping github.com/golang-jwt/jwt/v4 to v4.5.2 [#140](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/140)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver/compare/38bee567a703d3d5ab2ca6e1e047eea8e799c3c5...ac7311a4ece482ff94f12a5854d56277234924f6)


### [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/tree/766c2e6af74efa696364cef21c2b9915ed886e42)

* [OCPBUGS-68006](https://issues.redhat.com/browse/OCPBUGS-68006): Fix CVE-2025-65637 by bumping logrus to v1.9.1 [#99](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/99)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/compare/a3729dcb75a7da8c9ee7466da5de07e2f1fe5951...766c2e6af74efa696364cef21c2b9915ed886e42)


### [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs/tree/5c68b044b7fc3e70e39f6d67e4df440d8206d929)

* [OCPBUGS-61702](https://issues.redhat.com/browse/OCPBUGS-61702): Use OS_GIT_VERSION in Makefile when found (for Konflux builds) [#128](https://github.com/openshift/machine-api-provider-powervs/pull/128)
* [OCPBUGS-54753](https://issues.redhat.com/browse/OCPBUGS-54753): Fix for CVE-2024-51744 in github.com/golang-jwt/jwt/v4 in release-4.15 [#115](https://github.com/openshift/machine-api-provider-powervs/pull/115)
* [Full changelog](https://github.com/openshift/machine-api-provider-powervs/compare/4121cfc4304dcbb698993a388368f4025ab9c24a...5c68b044b7fc3e70e39f6d67e4df440d8206d929)


### [prom-label-proxy](https://github.com/openshift/prom-label-proxy/tree/dbafe465622fd6d5cbd6b3c538865b30e722233e)

* NO-ISSUE: synchronize OWNERS from main branch [release-4.15] [#402](https://github.com/openshift/prom-label-proxy/pull/402)
* [Full changelog](https://github.com/openshift/prom-label-proxy/compare/f3f1f5d1161df6c25a0e1d04218dfc6447782ab4...dbafe465622fd6d5cbd6b3c538865b30e722233e)


### [prometheus](https://github.com/openshift/prometheus/tree/2eab5cdc63f4bbeb16478b726ec8f7af41977024)

* [OCPBUGS-129665](https://issues.redhat.com/browse/OCPBUGS-129665): fix for CVE-2026-42151 [#397](https://github.com/openshift/prometheus/pull/397)
* [OCPBUGS-93655](https://issues.redhat.com/browse/OCPBUGS-93655): remote/azuread: use Secret type for OAuth client_secret [release-4.15] [#362](https://github.com/openshift/prometheus/pull/362)
* [OCPBUGS-102853](https://issues.redhat.com/browse/OCPBUGS-102853): Use patched x/net fork v0.35.0-sec.4 [#377](https://github.com/openshift/prometheus/pull/377)
* NO-ISSUE: synchronize OWNERS from main branch [#385](https://github.com/openshift/prometheus/pull/385)
* [OCPBUGS-88592](https://issues.redhat.com/browse/OCPBUGS-88592): remote: validate snappy decoded length before allocation in read endpoint [#352](https://github.com/openshift/prometheus/pull/352)
* [OCPBUGS-79907](https://issues.redhat.com/browse/OCPBUGS-79907): Bump google.golang.org/grpc [#322](https://github.com/openshift/prometheus/pull/322)
* [OCPBUGS-56740](https://issues.redhat.com/browse/OCPBUGS-56740): BACKPORT: fix promtool analyze block shows metric name with 0 cardinality [#256](https://github.com/openshift/prometheus/pull/256)
* [OCPBUGS-43669](https://issues.redhat.com/browse/OCPBUGS-43669): fix(discovery): Handle cache.DeletedFinalStateUnknown in node informers' DeleteFunc [#233](https://github.com/openshift/prometheus/pull/233)
* [Full changelog](https://github.com/openshift/prometheus/compare/6828e4464c45f239a89c7965233c2fef49c6b1fb...2eab5cdc63f4bbeb16478b726ec8f7af41977024)


### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/9f4d4f4d59634739cf7d8cb33a0b75121cafd1b7)

* [OCPBUGS-98170](https://issues.redhat.com/browse/OCPBUGS-98170): bump github.com/hashicorp/memberlist to a forked version to fix CVE-2026-14362 [#204](https://github.com/openshift/prometheus-alertmanager/pull/204)
* NO-JIRA: synchronize OWNERS with main [#199](https://github.com/openshift/prometheus-alertmanager/pull/199)
* [OCPBUGS-100359](https://issues.redhat.com/browse/OCPBUGS-100359): Set testdata CA expiry to 20 years from issue date (#4112) [#153](https://github.com/openshift/prometheus-alertmanager/pull/153)
* [OCPBUGS-77058](https://issues.redhat.com/browse/OCPBUGS-77058): Include go-verify-deps expected files in gitignore [#117](https://github.com/openshift/prometheus-alertmanager/pull/117)
* [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/870ade52a6097bc55cec29c1a9cc028967c5d23c...9f4d4f4d59634739cf7d8cb33a0b75121cafd1b7)


### [prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator/tree/d4b95df2391f127284c961b7e25854e617a462b7)

* NO-ISSUE: synchronize OWNERS from main branch [#421](https://github.com/openshift/prometheus-operator/pull/421)
* [OCPBUGS-102842](https://issues.redhat.com/browse/OCPBUGS-102842), [OCPBUGS-102845](https://issues.redhat.com/browse/OCPBUGS-102845): release-4.15] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#402](https://github.com/openshift/prometheus-operator/pull/402)
* [Full changelog](https://github.com/openshift/prometheus-operator/compare/902436ac6a8eec8f2f3f8b91f519a3d319924833...d4b95df2391f127284c961b7e25854e617a462b7)


### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/8003e3df372926ac663b618d49d13ac99e99feb8)

* NO-ISSUE: synchronize OWNERS from main branch [release-4.15] [#206](https://github.com/openshift/node_exporter/pull/206)
* [OCPBUGS-102844](https://issues.redhat.com/browse/OCPBUGS-102844): Use patched x/net fork v0.35.0-sec.4 [#193](https://github.com/openshift/node_exporter/pull/193)
* [Full changelog](https://github.com/openshift/node_exporter/compare/aed837c322b6eb54d88956acada07b5b390b5c25...8003e3df372926ac663b618d49d13ac99e99feb8)


### [route-controller-manager](https://github.com/openshift/route-controller-manager/tree/54e5f5a9654986f73f079c90a8bf7c078e61b22e)

* [OCPBUGS-102695](https://issues.redhat.com/browse/OCPBUGS-102695): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#106](https://github.com/openshift/route-controller-manager/pull/106)
* [OCPBUGS-86882](https://issues.redhat.com/browse/OCPBUGS-86882): [release-4.15] bump google.golang.org/grpc to v1.64.1-sec.1 [#93](https://github.com/openshift/route-controller-manager/pull/93)
* [Full changelog](https://github.com/openshift/route-controller-manager/compare/c5cc7a73705e4086759e2a36811b055b7716def4...54e5f5a9654986f73f079c90a8bf7c078e61b22e)


### [service-ca-operator](https://github.com/openshift/service-ca-operator/tree/57a122c2a6c6a2fe0c6ab11946859c435cf593b9)

* [OCPBUGS-68019](https://issues.redhat.com/browse/OCPBUGS-68019): update logrus to v1.9.1 [#321](https://github.com/openshift/service-ca-operator/pull/321)
* [Full changelog](https://github.com/openshift/service-ca-operator/compare/19f312e96bb4e5b7da9f61ea4cab202b227a60c6...57a122c2a6c6a2fe0c6ab11946859c435cf593b9)


### [tests](https://github.com/openshift/origin/tree/5f7fd13dd62088759c24d734528c1c6f18ba732b)

* [OCPBUGS-130859](https://issues.redhat.com/browse/OCPBUGS-130859): stage the creation of test pods to minimize etcd impact [#31743](https://github.com/openshift/origin/pull/31743)
* [OCPBUGS-74300](https://issues.redhat.com/browse/OCPBUGS-74300): Skip E2e: attach on previously attached volumes should work [#30725](https://github.com/openshift/origin/pull/30725)
* [OCPBUGS-66329](https://issues.redhat.com/browse/OCPBUGS-66329): Replace RunHostCmd with Exec function to censor bearer token being exposed [#30528](https://github.com/openshift/origin/pull/30528)
* [OCPBUGS-57335](https://issues.redhat.com/browse/OCPBUGS-57335): Fix regex parser for censoring private key [#29913](https://github.com/openshift/origin/pull/29913)
* [OCPBUGS-61229](https://issues.redhat.com/browse/OCPBUGS-61229): images/tests: Remove rteval [#30207](https://github.com/openshift/origin/pull/30207)
* [OCPBUGS-57136](https://issues.redhat.com/browse/OCPBUGS-57136): aws/edge: prevent test using unschedulable nodes [#29897](https://github.com/openshift/origin/pull/29897)
* [OCPBUGS-55477](https://issues.redhat.com/browse/OCPBUGS-55477): support provider type external [#29739](https://github.com/openshift/origin/pull/29739)
* NO-JIRA: Sync OWNERS from main branch [#29856](https://github.com/openshift/origin/pull/29856)
* [OCPBUGS-55695](https://issues.redhat.com/browse/OCPBUGS-55695): [build] Ensure Git Clone Does Not Run Privileged [#29752](https://github.com/openshift/origin/pull/29752)
* [OCPBUGS-54769](https://issues.redhat.com/browse/OCPBUGS-54769): Fix egress firewall tests by updating the URL from docs.openshift.com to redhat.com [#29664](https://github.com/openshift/origin/pull/29664)
* [OCPBUGS-52582](https://issues.redhat.com/browse/OCPBUGS-52582): Use payload pullspec for image info test [#29590](https://github.com/openshift/origin/pull/29590)
* [OCPBUGS-41614](https://issues.redhat.com/browse/OCPBUGS-41614): Disable:Broken for [sig-builds][Feature:Builds][Slow] can use private repositories as build input build using an HTTP token should be able to clone source code via an HTTP token [#29502](https://github.com/openshift/origin/pull/29502)
* [OCPBUGS-49647](https://issues.redhat.com/browse/OCPBUGS-49647): Fixing build s2i ruby test data inline with latest ruby version(>=3.0) [#29503](https://github.com/openshift/origin/pull/29503)
* [OCPBUGS-48749](https://issues.redhat.com/browse/OCPBUGS-48749): Add/remove team members to the OWNERS file for Builds [#29551](https://github.com/openshift/origin/pull/29551)
* [Full changelog](https://github.com/openshift/origin/compare/1ec96648894ae137d5d976aed612e203e2eb8184...5f7fd13dd62088759c24d734528c1c6f18ba732b)


### [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere/tree/177878b3f35d938242ccd9c6ab268c424e95e650)

* [OCPBUGS-102888](https://issues.redhat.com/browse/OCPBUGS-102888): Replace golang.org/x/net with sustaining fork for CVE-2026-33814 in 4.15 [#138](https://github.com/openshift/cloud-provider-vsphere/pull/138)
* [OCPBUGS-78030](https://issues.redhat.com/browse/OCPBUGS-78030): hermetic migration 4.15 [#108](https://github.com/openshift/cloud-provider-vsphere/pull/108)
* [Full changelog](https://github.com/openshift/cloud-provider-vsphere/compare/81ad52ad7bcf37b225bc50a6e6150ca0572057b7...177878b3f35d938242ccd9c6ab268c424e95e650)


### [vsphere-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-vsphere/tree/c0212e3276d0270d369d306317026a87d727d180)

* [OCPBUGS-78021](https://issues.redhat.com/browse/OCPBUGS-78021): hermetic migration 4.15 [#87](https://github.com/openshift/cluster-api-provider-vsphere/pull/87)
* [OCPBUGS-61654](https://issues.redhat.com/browse/OCPBUGS-61654): Fix unit tests [#73](https://github.com/openshift/cluster-api-provider-vsphere/pull/73)
* [Full changelog](https://github.com/openshift/cluster-api-provider-vsphere/compare/5611168658586d68b5a92c77c07304694fc2cc64...c0212e3276d0270d369d306317026a87d727d180)


### [vsphere-csi-driver, vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver/tree/6ff97bb1441a4edf2ccf451a6c63c206e9cf61d6)

* [OCPBUGS-86873](https://issues.redhat.com/browse/OCPBUGS-86873): Bump google.golang.org/grpc [#183](https://github.com/openshift/vmware-vsphere-csi-driver/pull/183)
* [OCPBUGS-68022](https://issues.redhat.com/browse/OCPBUGS-68022): CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 [#159](https://github.com/openshift/vmware-vsphere-csi-driver/pull/159)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver/compare/4b15e93bd578484c4bfb1c124fa655c451bbd1ca...6ff97bb1441a4edf2ccf451a6c63c206e9cf61d6)


### [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator/tree/744f9ec239096ad3abecb33f784e6d1ca060c1b2)

* [OCPBUGS-102873](https://issues.redhat.com/browse/OCPBUGS-102873): Use patched x/net fork v0.35.0-sec.4 [#366](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/366)
* [OCPBUGS-68020](https://issues.redhat.com/browse/OCPBUGS-68020), [OCPBUGS-68024](https://issues.redhat.com/browse/OCPBUGS-68024): CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.9.3 [#323](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/323)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver-operator/compare/e0d46570a06caff3439b410b9c9f75cb383a3d2d...744f9ec239096ad3abecb33f784e6d1ca060c1b2)


### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/afb0e767f4920fbc3cc88016ab506a4ccb554ac5)

* [OCPBUGS-102889](https://issues.redhat.com/browse/OCPBUGS-102889): Bump golang.org/x/net to v0.35.0-sec.4 [#236](https://github.com/openshift/vsphere-problem-detector/pull/236)
* [OCPBUGS-68031](https://issues.redhat.com/browse/OCPBUGS-68031): bump github.com/sirupsen/logrus to v1.9.3 [#201](https://github.com/openshift/vsphere-problem-detector/pull/201)
* [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/15ed0ae1d7bcfc9fd24e32bf3650e0e960c115be...afb0e767f4920fbc3cc88016ab506a4ccb554ac5)