# 4.18.59

Created: 2026-10-26 05:49:12 +0000 UTC

Image Digest: `sha256:dabe7545163af58a2538c645725556acea531fdcfb83fd5aea9b7f28cd112c06`


## Changes from 4.18.28

### Components

* Kubectl 1.31.1
* Kubernetes upgraded from 1.31.13 to 1.31.14
* Kubernetes Tests 1.31.12
* Red Hat Enterprise Linux CoreOS upgraded from 418.94.202511041748-0 to 418.94.202610242013-0



### FeatureGate Changes
| FeatureGate | Default<br/>Hypershift | Default<br/>SelfManagedHA | DevPreviewNoUpgrade<br/>Hypershift | DevPreviewNoUpgrade<br/>SelfManagedHA | TechPreviewNoUpgrade<br/>Hypershift | TechPreviewNoUpgrade<br/>SelfManagedHA  |
| :------ | :---: | :---: | :---: | :---: | :---: | :---:  |
| StreamingCollectionEncodingToJSON <br/> (0 tests)| Enabled<br/>(Changed)| Enabled<br/>(Changed)| Enabled| Enabled| Enabled| Enabled |
| StreamingCollectionEncodingToProtobuf <br/> (0 tests)| Enabled<br/>(Changed)| Enabled<br/>(Changed)| Enabled| Enabled| Enabled| Enabled |


### Removed images

* ovirt-csi-driver
* ovirt-csi-driver-operator


### Rebuilt images without code change

* [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy) git [2f62712d](https://github.com/openshift/apiserver-network-proxy/commit/2f62712d5db70df25490361749e93a552ffb5a24) `sha256:424f5652d9abad080c387a50963b03b41ca9d7220aada48046265e4fabaecd87`
* [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws) git [c3951906](https://github.com/openshift/cloud-provider-aws/commit/c395190655cbb92689a572dcd71c4e2a6c5744b5) `sha256:3e53ca99692292be55da9ae64cb5031038577a0782bc90cc8d42b283984bf02c`
* [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook) git [f54f9a19](https://github.com/openshift/aws-pod-identity-webhook/commit/f54f9a19adb43b395a880ca046aed0841466c28d) `sha256:2757e2730c516f63b8bf07d6fffe803c34e7cf52ea9023bd2bf3aa087310c65b`
* [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3) git [80c3a063](https://github.com/openshift/cluster-api-provider-metal3/commit/80c3a0638eacd65c0d6f54fbd3f4c593085528e8) `sha256:dc1f3739ae8368796b3a0d6a10ec69161df5c15b71abed061620a717e174f0b6`
* [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal) git [1ede6c3f](https://github.com/openshift/cluster-api-provider-baremetal/commit/1ede6c3f08d4a3955bfa1ea5cbbd92f9831c78e7) `sha256:5d347788bf83dd867b1bd6482719971c5b285a1f1a1a074de4136e84dca9e32e`
* [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg) git [35341068](https://github.com/openshift/baremetal-runtimecfg/commit/353410688340dadb583668215e13e2d6cc90e272) `sha256:17c95f476ee8cb23690a22e2606f3d8cd8ea829909f1d5ded515fb4d2603b5ed`
* [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap) git [d1e01954](https://github.com/openshift/cluster-bootstrap/commit/d1e019545aee3250920a01a5f5c465c570de573c) `sha256:64ba4d8157d4326292b231f9c25f640b8602e731d908a8aa2112d6ad2693c420`
* [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator) git [d17bf3a1](https://github.com/openshift/cluster-control-plane-machine-set-operator/commit/d17bf3a1b14e5bc6a8dff6569bfb02d523320990) `sha256:88165c68abddcd1834e8810634980b17f4d940672cb251f32cbfbf614a88da48`
* [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator) git [7cafd0c7](https://github.com/openshift/cluster-dns-operator/commit/7cafd0c7dca2edb154b8444602b600b5901afeba) `sha256:00ac340266bc8b31ebcabbf2c3dea1ff24e8fb037dc5970791d6f5fac2088f4e`
* [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator) git [1e3caa4b](https://github.com/openshift/cluster-image-registry-operator/commit/1e3caa4b5abe4e3dad914a337f87408d060b1fb2) `sha256:92b26b124fc8b478c647160c10f8d74b40602eede14768733f85ca975ae5007d`
* [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator) git [59ba356f](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/commit/59ba356f50ea3128905ffdb7137f868aa0588bab) `sha256:57df22ca6faa7c2e9c9fa3708f8adbfefeb4e20d7736da99886e0c7d857b6848`
* [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver) git [01d5fbbe](https://github.com/openshift/cluster-machine-approver/commit/01d5fbbe0bb798db32e5168dde46e6ed0c873b36) `sha256:88b44dbd753a65aa31d2c0ba419da4c19e5d9edc968dff5360ab5237a55e1855`
* [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator) git [0a6f6eb9](https://github.com/openshift/cluster-openshift-apiserver-operator/commit/0a6f6eb9efec43dfd3c8570b7a08a3d00afc5534) `sha256:e673e2f65cc6bd6235984a107e4aafc945129453f0d79214c6c2122394054ded`
* [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator) git [f1711cf3](https://github.com/openshift/cluster-openshift-controller-manager-operator/commit/f1711cf30f683ec0eaa187cd5168caae9e8c1254) `sha256:722ed48bbb2b3617b353f7a80aba02dceb92eea49877449440deb50cfb8a8fbc`
* [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator) git [bc725fd4](https://github.com/openshift/cluster-samples-operator/commit/bc725fd43d29758ad8f704044ccc8abb6926ad84) `sha256:805f8f7ad7571c3580040f45fd8087baf10b0fea7ed48361f376c31f0590d86f`
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [8caab452](https://github.com/openshift/cluster-update-keys/commit/8caab452b91df0d77ab052b1833a4d54a1374634) `sha256:62ad0d5c439dcc98a216c5a1b97092f3065257174ed81961148a11a6ea76c3ca`
* [configmap-reloader](https://github.com/openshift/configmap-reload) git [e2aaf00a](https://github.com/openshift/configmap-reload/commit/e2aaf00a381b57874178a4272f3bc5257cf8dd98) `sha256:4f469f9a8ecbe48a775f7831ba9f873b68be683c0572f8fced66ada54911134f`
* [coredns](https://github.com/openshift/coredns) git [8ca7f02b](https://github.com/openshift/coredns/commit/8ca7f02b8becb40f7a9919243000e2620d7036d4) `sha256:aabde61be89389c1936a14e2f7f011e774645b11f48ee9043220bb1f07bb0c99`
* [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar) git [ef93f0be](https://github.com/openshift/csi-node-driver-registrar/commit/ef93f0be8c1056f8ed3b2bd2efc1264e3dc2fb3c) `sha256:5c7db397dde87f9b0e127516c1104556bc5031338ba7071e82e42eeb0f3d6f5a`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [2e139edc](https://github.com/openshift/driver-toolkit/commit/2e139edc4aeefbbc41536eeeedc91f317f0835fd) `sha256:593aed143f324d339133224f1f209283bd00ab8c1aea6a184f5e5343af73ede4`
* [etcd](https://github.com/openshift/etcd) git [b5a4f8d0](https://github.com/openshift/etcd/commit/b5a4f8d079fbb04200251d5a6bc7c56f79d9d1e3) `sha256:c5af34391c0a3f6202f5875d38639612adc98a5e54eff98e2d19640312eff780`
* [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp) git [6ea23561](https://github.com/openshift/cloud-provider-gcp/commit/6ea235614f445951c7a4b5525f64f51548461a0d) `sha256:71109373e83ee98fe6667a61031a38482147e7bbfccbe298336554bd0ba7a684`
* [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook) git [f0a670c7](https://github.com/openshift/gcp-workload-identity-federation-webhook/commit/f0a670c7ad8f3694c87f2e3d9e6e7c024f49b411) `sha256:9a040e0a59b38153929e5a27f2ed7d644480c4ab69f9366dab142373efd8804d`
* [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [50ca44fd](https://github.com/openshift/ironic-rhcos-downloader/commit/50ca44fd48943433d502e8bcff3804f5cac7cb5a) `sha256:00860a27eb793493ab221ab9823f665a7a51c82bb2263c8772ce98ffab0c7fca`
* [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager) git [cfbae04f](https://github.com/openshift/ironic-static-ip-manager/commit/cfbae04f288d79c123ee8f817d88562948bc6e5c) `sha256:55109f2b4b299afeb2379ef4d2fb202d32885b78437aa4214dbe691e63b15a15`
* [keepalived-ipfailover](https://github.com/openshift/images) git [716eb0ef](https://github.com/openshift/images/commit/716eb0efe8473796868c0d5a5574349f15129a6a) `sha256:400c6da5cca8bb489501fe52174fe70f5697efe30e987a6f10199de50a038583`
* [multus-admission-controller](https://github.com/openshift/multus-admission-controller) git [0d7ea6c7](https://github.com/openshift/multus-admission-controller/commit/0d7ea6c766349243ade17707af7bd2b43c3b4b8e) `sha256:30306688db0cab05fdadf4a093265e1d41e6b3c75933f5933e28abb923d82026`
* [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy) git [3362bbc4](https://github.com/openshift/multus-networkpolicy/commit/3362bbc4c47ad7aec4f9551355e32870c30ab7c8) `sha256:eff162f9c30e949698de3dc3620c92e21385545ab046e86afadbb4faa5de35e6`
* [multus-route-override-cni](https://github.com/openshift/route-override-cni) git [391c1b03](https://github.com/openshift/route-override-cni/commit/391c1b0361e17c5718508810f0bdb6ff66ae6e81) `sha256:e7889d69c6d8ebf00446216223a32768cfe0a73256a19683735ee63e6278ede0`
* [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni) git [86191ded](https://github.com/openshift/whereabouts-cni/commit/86191ded510a5ec05f05b77ae847b86f50673258) `sha256:3b031c8206b11574b14629bb18064b37d743b432c842e598b6ee01ac3f48ec86`
* [network-interface-bond-cni](https://github.com/openshift/bond-cni) git [e2de9255](https://github.com/openshift/bond-cni/commit/e2de925552f2444fb3b4fac37d36ff7b5fbf58eb) `sha256:4ffcc7ee4870716adf88816bcea85492048365099820b24c334b1ac83021f85f`
* [network-tools](https://github.com/openshift/network-tools) git [47b13549](https://github.com/openshift/network-tools/commit/47b13549115a59d82dbf4c61f9160432608cb9d8) `sha256:4e1b2459893e5a28e682fc3c13c215722c5e7700c746350419868cf44bf0d0ac`
* [nutanix-cloud-controller-manager](https://github.com/openshift/cloud-provider-nutanix) git [d9fe8f38](https://github.com/openshift/cloud-provider-nutanix/commit/d9fe8f38811ca81c23191f0048a70e88b5ccaa04) `sha256:e814c09d304dd714588b63024cd993121096aa951586ab15654c0c8a1ecf90d7`
* [nutanix-machine-controllers](https://github.com/openshift/machine-api-provider-nutanix) git [afe324bf](https://github.com/openshift/machine-api-provider-nutanix/commit/afe324bf56e0348fb45e5fbb9c832c1587482153) `sha256:c765a1412cb75ee98d1bfee8e1fabd339f9ff69ba1d3d16eaa8c7073780cd137`
* [olm-catalogd](https://github.com/openshift/operator-framework-catalogd) git [180aa92c](https://github.com/openshift/operator-framework-catalogd/commit/180aa92c13fda1aa1ae35205c9b380a4ead41e8b) `sha256:646071f761c5002baf90963d0a258e92e936210d3d46c5c1a79d822b431102f9`
* [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager) git [8ee74406](https://github.com/openshift/openshift-controller-manager/commit/8ee744063ed12b249f1a2b89e9af4f53b2f1daf7) `sha256:ffd0e9cadb9d7e9a4eeb15054e88f0ce8b49420c92adaf34955732cddb18f691`
* [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs) git [74e3ece7](https://github.com/openshift/machine-api-provider-powervs/commit/74e3ece7ce84bef0f21bd1bab775f7e6dabb676b) `sha256:debe2934d213c14712c2f9a64190750141f55f340ffd35aa1ec33990a5438275`
* rhel-coreos `sha256:b55adb0436a75ecce57436342d0692553b3274079c031d4122483d0130226a6b`
* rhel-coreos-extensions `sha256:cdebfd8a38969096004c5b63deacb723aa8260fa09eb66c7c6919bea25d8a23f`
* [service-ca-operator](https://github.com/openshift/service-ca-operator) git [30efb529](https://github.com/openshift/service-ca-operator/commit/30efb529a5b7db5d6f352f6ac0470d8385268539) `sha256:82b42548e3733da729555db2773059e9d3a663ea4a95db3b41c0325ddbd21a4a`


### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/da4f7aef264d30604310f9a09271aeecf9a3f767)

* [OCPBUGS-89884](https://issues.redhat.com/browse/OCPBUGS-89884): patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.2 [#10800](https://github.com/openshift/assisted-service/pull/10800)
* [MGMT-23439](https://issues.redhat.com/browse/MGMT-23439): Pin gotestsum to v1.12.2 for Go 1.21 compatibility [#10019](https://github.com/openshift/assisted-service/pull/10019)
* [OCPBUGS-74898](https://issues.redhat.com/browse/OCPBUGS-74898): Retry incomplete cluster registration in ABI [#8817](https://github.com/openshift/assisted-service/pull/8817)
* [OCPBUGS-74911](https://issues.redhat.com/browse/OCPBUGS-74911): Remove root=/dev/disk/by-label/dm-mpath-root from kargs [#8820](https://github.com/openshift/assisted-service/pull/8820)
* [Full changelog](https://github.com/openshift/assisted-service/compare/03ef19051b8561514d37ec691652647cdd2f260c...da4f7aef264d30604310f9a09271aeecf9a3f767)


### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/5e9dbe59ccc89ba07bb3d04acc0693700185875c)

* [OCPBUGS-103348](https://issues.redhat.com/browse/OCPBUGS-103348): Bump x/net to v0.35.0-sec.4 [#2297](https://github.com/openshift/assisted-installer/pull/2297)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/81d6bc2771d3d34de3c364e349ca7f2983e454a2...5e9dbe59ccc89ba07bb3d04acc0693700185875c)


### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/1e5183da7dbcde058f44f35771f4ecc471dd7eac)

* [OCPBUGS-103362](https://issues.redhat.com/browse/OCPBUGS-103362): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#1618](https://github.com/openshift/assisted-installer-agent/pull/1618)
* [MGMT-21849](https://issues.redhat.com/browse/MGMT-21849): Skip arping for remote IPs not in outgoing NIC's subnet [#1332](https://github.com/openshift/assisted-installer-agent/pull/1332)
* [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/32a1f2a4c87eb63ebac848a5edb6c73c5a66dfbb...1e5183da7dbcde058f44f35771f4ecc471dd7eac)


### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/63b87f06c5586b59ca99d7a4546d4c82b2aa0268)

* [OCPBUGS-68243](https://issues.redhat.com/browse/OCPBUGS-68243): bump github.com/sirupsen/logrus to v1.9.3 [#237](https://github.com/openshift/agent-installer-utils/pull/237)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/0e41f7d51a7e74d8f8f33c3c5da65f6dc4c16923...63b87f06c5586b59ca99d7a4546d4c82b2aa0268)


### [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws/tree/51232bbb3be37e6712701049efe0810749bb997f)

* [OCPBUGS-103372](https://issues.redhat.com/browse/OCPBUGS-103372): replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 [#652](https://github.com/openshift/cluster-api-provider-aws/pull/652)
* 🐛 OCPBUGS-123705: UPSTREAM: &lt;carry&gt;: Fix unit tests for OpenShift CI environment [#642](https://github.com/openshift/cluster-api-provider-aws/pull/642)
* 🌱 OCPBUGS-123680: UPSTREAM: &lt;carry&gt;: Remove upstream .github files unused in OpenShift CI [#641](https://github.com/openshift/cluster-api-provider-aws/pull/641)
* [OCPBUGS-77903](https://issues.redhat.com/browse/OCPBUGS-77903): [release-4.18] update go mod dependency for konflux [#589](https://github.com/openshift/cluster-api-provider-aws/pull/589)
* [Full changelog](https://github.com/openshift/cluster-api-provider-aws/compare/f0aabeef9a351b0fb29318578f1afbcda3ea9c3c...51232bbb3be37e6712701049efe0810749bb997f)


### [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver/tree/96ae9d03d19036e55e33b5935b6caf1ed4de2c73)

* [OCPBUGS-82745](https://issues.redhat.com/browse/OCPBUGS-82745): Address CVE-2026-35469 [#327](https://github.com/openshift/aws-ebs-csi-driver/pull/327)
* [OCPBUGS-86167](https://issues.redhat.com/browse/OCPBUGS-86167): UPSTREAM: 2367: cleanup: `make verify` should ignore copyright year [#321](https://github.com/openshift/aws-ebs-csi-driver/pull/321)
* [OCPBUGS-80206](https://issues.redhat.com/browse/OCPBUGS-80206): Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.71.3-sec.1 [#313](https://github.com/openshift/aws-ebs-csi-driver/pull/313)
* [Full changelog](https://github.com/openshift/aws-ebs-csi-driver/compare/b51cd6b8e54d5682cf5491a9eb5af1570261a409...96ae9d03d19036e55e33b5935b6caf1ed4de2c73)


### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/46b780449b0ebf83a65ec0c3c855271188324129)

* [OCPBUGS-103360](https://issues.redhat.com/browse/OCPBUGS-103360), [OCPBUGS-103371](https://issues.redhat.com/browse/OCPBUGS-103371): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#610](https://github.com/openshift/csi-operator/pull/610)
* [OCPBUGS-80308](https://issues.redhat.com/browse/OCPBUGS-80308): Bump google.golang.org/grpc [#542](https://github.com/openshift/csi-operator/pull/542)
* [OCPBUGS-79429](https://issues.redhat.com/browse/OCPBUGS-79429): Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.18 [#531](https://github.com/openshift/csi-operator/pull/531)
* [OCPBUGS-78299](https://issues.redhat.com/browse/OCPBUGS-78299): Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.17 [#524](https://github.com/openshift/csi-operator/pull/524)
* [OCPBUGS-76582](https://issues.redhat.com/browse/OCPBUGS-76582): Fix Cinder, Manila driver metrics [#501](https://github.com/openshift/csi-operator/pull/501)
* [OCPBUGS-62664](https://issues.redhat.com/browse/OCPBUGS-62664): disable e2e snapshot tests [#463](https://github.com/openshift/csi-operator/pull/463)
* [OCPBUGS-63558](https://issues.redhat.com/browse/OCPBUGS-63558): Add RBAC ClusterRole and Binding for driver node [#454](https://github.com/openshift/csi-operator/pull/454)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/csi-operator/compare/cf56e3a4c83edceae052175f2331c4089d22f52c...46b780449b0ebf83a65ec0c3c855271188324129)


### [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider/tree/075d56fd8589620b045de0a5a6bb726dd34e380c)

* [OCPBUGS-80184](https://issues.redhat.com/browse/OCPBUGS-80184): Bump google.golang.org/grpc to v1.79.3 [#43](https://github.com/openshift/aws-encryption-provider/pull/43)
* [Full changelog](https://github.com/openshift/aws-encryption-provider/compare/088dcaf73f980b977ef4f5d2f99e2a93deb87eef...075d56fd8589620b045de0a5a6bb726dd34e380c)


### [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws/tree/7b6bfc7421d1cc700ddbcbf150beccd0ab586183)

* [OCPBUGS-73789](https://issues.redhat.com/browse/OCPBUGS-73789): Fix reconciler consistency checks in Update and Exists [#166](https://github.com/openshift/machine-api-provider-aws/pull/166)
* [Full changelog](https://github.com/openshift/machine-api-provider-aws/compare/96389ffa2b20a310888dd3163956fa978ab1ca71...7b6bfc7421d1cc700ddbcbf150beccd0ab586183)


### [azure-cloud-controller-manager, azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure/tree/6902de45abe8ec88980d3eb4621574cae5ab8f1b)

* [OCPBUGS-103373](https://issues.redhat.com/browse/OCPBUGS-103373), [OCPBUGS-103550](https://issues.redhat.com/browse/OCPBUGS-103550): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#208](https://github.com/openshift/cloud-provider-azure/pull/208)
* [OCPBUGS-80210](https://issues.redhat.com/browse/OCPBUGS-80210), [OCPBUGS-80211](https://issues.redhat.com/browse/OCPBUGS-80211), [OCPBUGS-80350](https://issues.redhat.com/browse/OCPBUGS-80350): Bump google.golang.org/grpc to v1.79.3 [#190](https://github.com/openshift/cloud-provider-azure/pull/190)
* [Full changelog](https://github.com/openshift/cloud-provider-azure/compare/9c24d768d8789fd677b09c9e7b3dd9118b41a558...6902de45abe8ec88980d3eb4621574cae5ab8f1b)


### [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure/tree/7e24d10b27c632a28f66a57469fb63c25b68e0c1)

* [OCPBUGS-89899](https://issues.redhat.com/browse/OCPBUGS-89899): Address CVE-2026-39829 [#401](https://github.com/openshift/cluster-api-provider-azure/pull/401)
* [OCPBUGS-80212](https://issues.redhat.com/browse/OCPBUGS-80212): Bump google.golang.org/grpc to v1.79.3 [#390](https://github.com/openshift/cluster-api-provider-azure/pull/390)
* [OCPBUGS-77905](https://issues.redhat.com/browse/OCPBUGS-77905): [release-4.18] update go mod dependency for konflux [#362](https://github.com/openshift/cluster-api-provider-azure/pull/362)
* [Full changelog](https://github.com/openshift/cluster-api-provider-azure/compare/b29c582ec409fc7da93a70b624e6f959165cefe1...7e24d10b27c632a28f66a57469fb63c25b68e0c1)


### [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver/tree/9736d81a70d1aecc1ecdeb154106694d627b5754)

* UPSTREAM: 3635: OCPBUGS-103367: Bump golang.org/x/net to v0.43.0-sec.4 [#172](https://github.com/openshift/azure-disk-csi-driver/pull/172)
* [OCPBUGS-114621](https://issues.redhat.com/browse/OCPBUGS-114621): UPSTREAM: 3277: fix: allow `.` in Azure tags [#179](https://github.com/openshift/azure-disk-csi-driver/pull/179)
* [OCPBUGS-80213](https://issues.redhat.com/browse/OCPBUGS-80213): Address CVE-2026-33186 [#142](https://github.com/openshift/azure-disk-csi-driver/pull/142)
* [OCPBUGS-78037](https://issues.redhat.com/browse/OCPBUGS-78037): add instantAccessDurationMinutes parameter to enable IA snapshots for PremiumV2/UltraSSD disks [#130](https://github.com/openshift/azure-disk-csi-driver/pull/130)
* [Full changelog](https://github.com/openshift/azure-disk-csi-driver/compare/6cced6667a8e896c191bd678f740d2b7e0629538...9736d81a70d1aecc1ecdeb154106694d627b5754)


### [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver/tree/8acb2cde0a4a2f88aceb91710ea4f63b5778dcd1)

* [OCPBUGS-103366](https://issues.redhat.com/browse/OCPBUGS-103366): Bump golang.org/x/net to v0.35.0-sec.4 [#158](https://github.com/openshift/azure-file-csi-driver/pull/158)
* [OCPBUGS-92789](https://issues.redhat.com/browse/OCPBUGS-92789): Bump golang.org/x/crypto to v0.33.0-sec.3 [#148](https://github.com/openshift/azure-file-csi-driver/pull/148)
* [OCPBUGS-80216](https://issues.redhat.com/browse/OCPBUGS-80216): Address CVE-2026-33186 [#133](https://github.com/openshift/azure-file-csi-driver/pull/133)
* [Full changelog](https://github.com/openshift/azure-file-csi-driver/compare/4b34592e8ea0a3f5cc937457a6fc79c1a6ac95cd...8acb2cde0a4a2f88aceb91710ea4f63b5778dcd1)


### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/baf90faf2bdc3d26e571fbcf0266efcb48c58d97)

* [OCPBUGS-80185](https://issues.redhat.com/browse/OCPBUGS-80185): Bump google.golang.org/grpc to 1.64.1-sec.1 patch [#46](https://github.com/openshift/azure-kubernetes-kms/pull/46)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/c937080f51cec58650daa15805be548d09310c64...baf90faf2bdc3d26e571fbcf0266efcb48c58d97)


### [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure/tree/87fd6f710298c181ec6e857925824bd647d4294f)

* [OCPBUGS-103471](https://issues.redhat.com/browse/OCPBUGS-103471): replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 [#213](https://github.com/openshift/machine-api-provider-azure/pull/213)
* [OCPBUGS-65882](https://issues.redhat.com/browse/OCPBUGS-65882): Set updateDomainCount to one when faultDomainCount is one [#175](https://github.com/openshift/machine-api-provider-azure/pull/175)
* [Full changelog](https://github.com/openshift/machine-api-provider-azure/compare/9d90e7e5503c3cb70da051f3dd29f8761013b7e5...87fd6f710298c181ec6e857925824bd647d4294f)


### [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity/tree/63221a401f95f338e198fa9c267d6fba0c50fb09)

* [OCPBUGS-103390](https://issues.redhat.com/browse/OCPBUGS-103390): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#63](https://github.com/openshift/azure-workload-identity/pull/63)
* [Full changelog](https://github.com/openshift/azure-workload-identity/compare/f60e4029d64de202e81d2cd114f8a90dc0a1878e...63221a401f95f338e198fa9c267d6fba0c50fb09)


### [baremetal-installer, installer, installer-altinfra, installer-artifacts](https://github.com/openshift/installer/tree/64b69e4fc29bd2011b2c386116d6571bfa0be3ab)

* NO-JIRA: data/manifests/bootkube/cvo-overrides: Default to eus-4.18 [#11004](https://github.com/openshift/installer/pull/11004)
* [OCPBUGS-103391](https://issues.redhat.com/browse/OCPBUGS-103391), [OCPBUGS-103464](https://issues.redhat.com/browse/OCPBUGS-103464): Bump golang.org/x/net to v0.35.0-sec.4 [#10970](https://github.com/openshift/installer/pull/10970)
* [OCPBUGS-89882](https://issues.redhat.com/browse/OCPBUGS-89882), [OCPBUGS-89888](https://issues.redhat.com/browse/OCPBUGS-89888), [OCPBUGS-89919](https://issues.redhat.com/browse/OCPBUGS-89919), [OCPBUGS-92878](https://issues.redhat.com/browse/OCPBUGS-92878): Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.33.0-sec.4 [#10901](https://github.com/openshift/installer/pull/10901)
* [OCPBUGS-121872](https://issues.redhat.com/browse/OCPBUGS-121872): Update gcloud version to one that can be found [#10857](https://github.com/openshift/installer/pull/10857)
* [OCPBUGS-77052](https://issues.redhat.com/browse/OCPBUGS-77052): Update RHCOS-release-4.18 bootimage metadata to 418.94.202608142238-0 [#10795](https://github.com/openshift/installer/pull/10795)
* [OCPBUGS-95616](https://issues.redhat.com/browse/OCPBUGS-95616): azure: Add field in installconfig to disallow shared access key [#10670](https://github.com/openshift/installer/pull/10670)
* [OCPBUGS-78550](https://issues.redhat.com/browse/OCPBUGS-78550): fix wavelength zone name regex [#10409](https://github.com/openshift/installer/pull/10409)
* [OCPBUGS-45579](https://issues.redhat.com/browse/OCPBUGS-45579): PowerVS: Listen to machineNetwork [#9277](https://github.com/openshift/installer/pull/9277)
* [OCPBUGS-73784](https://issues.redhat.com/browse/OCPBUGS-73784): pkg/asset/manifests/azure: save cidr blocks [#10217](https://github.com/openshift/installer/pull/10217)
* [OCPBUGS-76598](https://issues.redhat.com/browse/OCPBUGS-76598): Increase agent-installer pre-network-manager timeout [#10299](https://github.com/openshift/installer/pull/10299)
* [OCPBUGS-67203](https://issues.redhat.com/browse/OCPBUGS-67203): Update the RHCOS 4.18 bootimage metadata [#10294](https://github.com/openshift/installer/pull/10294)
* [OCPBUGS-74676](https://issues.redhat.com/browse/OCPBUGS-74676): [release-4.18] GCP: skip AI zones [#10275](https://github.com/openshift/installer/pull/10275)
* [OCPBUGS-69880](https://issues.redhat.com/browse/OCPBUGS-69880): Azure UPI ARM template: use storageAccountId [#10179](https://github.com/openshift/installer/pull/10179)
* [OCPBUGS-68244](https://issues.redhat.com/browse/OCPBUGS-68244): [4.18] uplift logrus [#10166](https://github.com/openshift/installer/pull/10166)
* [OCPBUGS-57590](https://issues.redhat.com/browse/OCPBUGS-57590): Mount the user-ca-bundle into ICC [#9794](https://github.com/openshift/installer/pull/9794)
* [OCPBUGS-63494](https://issues.redhat.com/browse/OCPBUGS-63494): Catch gcp destroy cases where the operation is nil [#10030](https://github.com/openshift/installer/pull/10030)
* [OCPBUGS-52659](https://issues.redhat.com/browse/OCPBUGS-52659): [release-4.18] CORS-3825: pkg/infrastructure/azure: support nvme [#9545](https://github.com/openshift/installer/pull/9545)
* [OCPBUGS-65588](https://issues.redhat.com/browse/OCPBUGS-65588): Update the RHCOS 4.18 bootimage metadata [#10113](https://github.com/openshift/installer/pull/10113)
* [OCPBUGS-58504](https://issues.redhat.com/browse/OCPBUGS-58504): Refactor removing loadbalancer in OpenStack [#9831](https://github.com/openshift/installer/pull/9831)
* [Full changelog](https://github.com/openshift/installer/compare/d4d4b15b3121e69b12a66435b8fae3ea081321d1...64b69e4fc29bd2011b2c386116d6571bfa0be3ab)


### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/c138c6f1bd35dc189039a8246eeaf0a83ee5e4b7)

* [OCPBUGS-98321](https://issues.redhat.com/browse/OCPBUGS-98321): Add BMH finalizer on PreprovisioningImage [#509](https://github.com/openshift/baremetal-operator/pull/509)
* [OCPBUGS-59259](https://issues.redhat.com/browse/OCPBUGS-59259): Fix HFC error handling in actionPreparing [#502](https://github.com/openshift/baremetal-operator/pull/502)
* [OCPBUGS-87967](https://issues.redhat.com/browse/OCPBUGS-87967): Fix preprovisioning network Secret lifecycle during BMH deletion [#495](https://github.com/openshift/baremetal-operator/pull/495)
* [OCPBUGS-76988](https://issues.redhat.com/browse/OCPBUGS-76988): Unblock BMH direct deletion when detached annotation is present [#461](https://github.com/openshift/baremetal-operator/pull/461)
* [Full changelog](https://github.com/openshift/baremetal-operator/compare/45c6255cafc5633d1ab6b9460ececa5c9197cce8...c138c6f1bd35dc189039a8246eeaf0a83ee5e4b7)


### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/a622623a766e65ea4855c15c711d4130b65a3438)

* [OCPBUGS-103346](https://issues.redhat.com/browse/OCPBUGS-103346), [OCPBUGS-103383](https://issues.redhat.com/browse/OCPBUGS-103383): Use patched x/net fork v0.35.0-sec.4 [#2418](https://github.com/openshift/oc/pull/2418)
* [OCPBUGS-91365](https://issues.redhat.com/browse/OCPBUGS-91365), [OCPBUGS-94688](https://issues.redhat.com/browse/OCPBUGS-94688): Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.2 [#2344](https://github.com/openshift/oc/pull/2344)
* [OCPBUGS-109669](https://issues.redhat.com/browse/OCPBUGS-109669): Fix pre-existing unit test failures on release-4.18 [#2372](https://github.com/openshift/oc/pull/2372)
* [OCPBUGS-83872](https://issues.redhat.com/browse/OCPBUGS-83872): pkg/cli/admin/upgrade: Tighten force warnings [#2165](https://github.com/openshift/oc/pull/2165)
* [OCPBUGS-65707](https://issues.redhat.com/browse/OCPBUGS-65707): fix(must-gather): do not set node affinity if nodename is set [#2145](https://github.com/openshift/oc/pull/2145)
* [OCPBUGS-64608](https://issues.redhat.com/browse/OCPBUGS-64608): Help with must-gather scheduling through suggesting preferance of nodes [#2127](https://github.com/openshift/oc/pull/2127)
* [Full changelog](https://github.com/openshift/oc/compare/4fcb2d07875f05d881ac90af73723db0ae5b1d6e...a622623a766e65ea4855c15c711d4130b65a3438)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/469dbd254ecc225b7ca0899b3fbbfaa5ee89b046)

* [OCPBUGS-81887](https://issues.redhat.com/browse/OCPBUGS-81887): Bump go-jose/go-jose/v4@v4.1.4 [#1031](https://github.com/openshift/cloud-credential-operator/pull/1031)
* [OCPBUGS-80219](https://issues.redhat.com/browse/OCPBUGS-80219): Fix CVE-2026-33186 using openshift-sustaining grpc-go fork [#1041](https://github.com/openshift/cloud-credential-operator/pull/1041)
* [OCPBUGS-74548](https://issues.redhat.com/browse/OCPBUGS-74548): Resolve nil pointer exception in hasResourceTags [#968](https://github.com/openshift/cloud-credential-operator/pull/968)
* [OCPBUGS-65800](https://issues.redhat.com/browse/OCPBUGS-65800): ccoctl azure: retry custom role creation on consistency errors [#950](https://github.com/openshift/cloud-credential-operator/pull/950)
* [OCPBUGS-65479](https://issues.redhat.com/browse/OCPBUGS-65479): ccoctl: use pagination when listing resources in aws [#947](https://github.com/openshift/cloud-credential-operator/pull/947)
* [OCPBUGS-63548](https://issues.redhat.com/browse/OCPBUGS-63548): ccoctl: add public-key-file flag to create-all [#938](https://github.com/openshift/cloud-credential-operator/pull/938)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/e5d3657e8c72884d89672c94594efb2cae05d372...469dbd254ecc225b7ca0899b3fbbfaa5ee89b046)


### [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller/tree/f892b9152672d963b667d6d644e65576946133a3)

* [OCPBUGS-73750](https://issues.redhat.com/browse/OCPBUGS-73750): [release-4.18] Fix pointers without ptr.Deref [#199](https://github.com/openshift/cloud-network-config-controller/pull/199)
* [OCPBUGS-65651](https://issues.redhat.com/browse/OCPBUGS-65651): [release-4.18] Fix capacity calculation [#193](https://github.com/openshift/cloud-network-config-controller/pull/193)
* [OCPBUGS-64779](https://issues.redhat.com/browse/OCPBUGS-64779): [release-4.18] Change the capacity struct from int to ptrOfInt [#189](https://github.com/openshift/cloud-network-config-controller/pull/189)
* [Full changelog](https://github.com/openshift/cloud-network-config-controller/compare/beacfbc2f2afa651616ad1c3c6712c511318a8d4...f892b9152672d963b667d6d644e65576946133a3)


### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/86d9846f91c627043128f4854bb6fc34a605b8ce)

* [OCPBUGS-103378](https://issues.redhat.com/browse/OCPBUGS-103378): replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 [#988](https://github.com/openshift/cluster-authentication-operator/pull/988)
* [OCPBUGS-75897](https://issues.redhat.com/browse/OCPBUGS-75897): set appropriate rolling update settings [#835](https://github.com/openshift/cluster-authentication-operator/pull/835)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/882f8799b8a550605e4812479272691de3f5c0d2...86d9846f91c627043128f4854bb6fc34a605b8ce)


### [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler/tree/34730793bf4057072ed97b421e6b3af57166cc14)

* [OCPBUGS-78699](https://issues.redhat.com/browse/OCPBUGS-78699): allow clusterapi provider to skip paused resources [#413](https://github.com/openshift/kubernetes-autoscaler/pull/413)
* [OCPBUGS-75925](https://issues.redhat.com/browse/OCPBUGS-75925): Fixes histograms becoming empty after loaded from checkpoints [#402](https://github.com/openshift/kubernetes-autoscaler/pull/402)
* [Full changelog](https://github.com/openshift/kubernetes-autoscaler/compare/4f1bde97bfb5da70a107996bf952b445462429c3...34730793bf4057072ed97b421e6b3af57166cc14)


### [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator/tree/6daa3e93947e8a74958a8a747946c060def5e3c7)

* [OCPBUGS-103386](https://issues.redhat.com/browse/OCPBUGS-103386): Bump x/net package in release-4.18 [#388](https://github.com/openshift/cluster-autoscaler-operator/pull/388)
* [Full changelog](https://github.com/openshift/cluster-autoscaler-operator/compare/474ad65cde3d965a565d41cac5bfd96a92f880fa...6daa3e93947e8a74958a8a747946c060def5e3c7)


### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/3e6d1ab1617c0ec1b5872f258a0c7ec1eb55e079)

* [OCPBUGS-81549](https://issues.redhat.com/browse/OCPBUGS-81549): Explicitly set the ReadOnlyRootFilesystem flag to false [#584](https://github.com/openshift/cluster-baremetal-operator/pull/584)
* [OCPBUGS-78708](https://issues.redhat.com/browse/OCPBUGS-78708): Update kubebuilder tools to more latest version [#579](https://github.com/openshift/cluster-baremetal-operator/pull/579)
* [OCPBUGS-57590](https://issues.redhat.com/browse/OCPBUGS-57590): Mount the user-ca-bundle into ICC [#486](https://github.com/openshift/cluster-baremetal-operator/pull/486)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/555fab9f8c12da6ebdadaeaf6134df22902a42e9...3e6d1ab1617c0ec1b5872f258a0c7ec1eb55e079)


### [cluster-capi-controllers](https://github.com/openshift/cluster-api/tree/c4c8799ba15d9a4b7ef8d2fb98fdee351fbae027)

* [OCPBUGS-80220](https://issues.redhat.com/browse/OCPBUGS-80220): Bump google.golang.org/grpc to v1.79.3 [#297](https://github.com/openshift/cluster-api/pull/297)
* [Full changelog](https://github.com/openshift/cluster-api/compare/63df38bcdb4aa8ca25c26b1f70321d5d198e27d1...c4c8799ba15d9a4b7ef8d2fb98fdee351fbae027)


### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/b5b89440b706f8760fb0e26938cdbafff265c6bc)

* [OCPBUGS-80224](https://issues.redhat.com/browse/OCPBUGS-80224): Bump google.golang.org/grpc to v1.79.3 [#566](https://github.com/openshift/cluster-capi-operator/pull/566)
* NO-JIRA: Allow sustaining engineering to self serve dependency updates [#558](https://github.com/openshift/cluster-capi-operator/pull/558)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/2f2737e1ed649009eef31c19ffff7468b67de32d...b5b89440b706f8760fb0e26938cdbafff265c6bc)


### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/84a08c1a1d1502b6c03ce53f2d8f5c94a8b2828b)

* [OCPBUGS-103380](https://issues.redhat.com/browse/OCPBUGS-103380): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#513](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/513)
* [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/8abb067318de3cc68967a0f24627c26912242524...84a08c1a1d1502b6c03ce53f2d8f5c94a8b2828b)


### [cluster-config-api](https://github.com/openshift/api/tree/f9b2d1ae30ebf759bc287c38474b41f246852cae)

* [OCPBUGS-98486](https://issues.redhat.com/browse/OCPBUGS-98486): add new serviceAccountToken fs type [#2927](https://github.com/openshift/api/pull/2927)
* [OCPBUGS-70315](https://issues.redhat.com/browse/OCPBUGS-70315): Add HTTPKeepAliveTimeout to IngressController API [#2638](https://github.com/openshift/api/pull/2638)
* NO-JIRA: [release-4.18] OWNERS: update approvers/reviewers [#2625](https://github.com/openshift/api/pull/2625)
* [OCPBUGS-67214](https://issues.redhat.com/browse/OCPBUGS-67214): Introduce ClosedClientConnectionPolicy to IngressController API [#2618](https://github.com/openshift/api/pull/2618)
* [CNTRLPLANE-1980](https://issues.redhat.com/browse/CNTRLPLANE-1980): Promote streaming list encoding to Default [#2598](https://github.com/openshift/api/pull/2598)
* NO-JIRA: Promote streaming list encoding to Default on Hypershift. [#2562](https://github.com/openshift/api/pull/2562)
* [Full changelog](https://github.com/openshift/api/compare/98e18dae8c7a82a4075c65ca0d357c9bf31cfb7c...f9b2d1ae30ebf759bc287c38474b41f246852cae)


### [cluster-config-operator](https://github.com/openshift/cluster-config-operator/tree/fe5e928628200b49a07aa50e4dfa634fb9452607)

* [OCPBUGS-68249](https://issues.redhat.com/browse/OCPBUGS-68249): Update logrus to 1.9.3 to address CVE-2025-65637 [#464](https://github.com/openshift/cluster-config-operator/pull/464)
* [Full changelog](https://github.com/openshift/cluster-config-operator/compare/85cb40728227fac13a2983fb6e3170d67cf62075...fe5e928628200b49a07aa50e4dfa634fb9452607)


### [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator/tree/54a9349e3d46979dd943c4b4b7eb4fd4e9b2b494)

* [OCPBUGS-103405](https://issues.redhat.com/browse/OCPBUGS-103405): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#293](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/293)
* [Full changelog](https://github.com/openshift/cluster-csi-snapshot-controller-operator/compare/6fe700087e8be6513285edd18f461790fecc65c3...54a9349e3d46979dd943c4b4b7eb4fd4e9b2b494)


### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/f3a37e434b476fe7da5d3cdc2c893d1f594a5480)

* [OCPBUGS-103410](https://issues.redhat.com/browse/OCPBUGS-103410): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#1695](https://github.com/openshift/cluster-etcd-operator/pull/1695)
* [OCPBUGS-78776](https://issues.redhat.com/browse/OCPBUGS-78776): [release-4.18] : Prefer to remove members where they have another healthy machine in the same failure domain index [#1573](https://github.com/openshift/cluster-etcd-operator/pull/1573)
* [OCPBUGS-76284](https://issues.redhat.com/browse/OCPBUGS-76284): Add priority field to prevent early shutdown [#1545](https://github.com/openshift/cluster-etcd-operator/pull/1545)
* [OCPBUGS-63451](https://issues.redhat.com/browse/OCPBUGS-63451): Ensure revision.json persists on ungraceful shutdown [#1503](https://github.com/openshift/cluster-etcd-operator/pull/1503)
* [OCPBUGS-58412](https://issues.redhat.com/browse/OCPBUGS-58412): bump library-go to bring in revision controller revision-ready annotation fix [#1518](https://github.com/openshift/cluster-etcd-operator/pull/1518)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/0f87d4a7da8222d0a1fd21c3c8ced0f0ca3927fe...f3a37e434b476fe7da5d3cdc2c893d1f594a5480)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/fdaf5248a73ea29dbfd104fa4583e0461f6ad03a)

* [OCPBUGS-103414](https://issues.redhat.com/browse/OCPBUGS-103414): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 [#1571](https://github.com/openshift/cluster-ingress-operator/pull/1571)
* [OCPBUGS-70315](https://issues.redhat.com/browse/OCPBUGS-70315): Implement HTTPKeepAliveTimeout tuning option [#1333](https://github.com/openshift/cluster-ingress-operator/pull/1333)
* NO-JIRA: Add new NID team members to OWNERS [#1319](https://github.com/openshift/cluster-ingress-operator/pull/1319)
* [OCPBUGS-67214](https://issues.redhat.com/browse/OCPBUGS-67214): Implement ClosedClientConnectionPolicy field [#1322](https://github.com/openshift/cluster-ingress-operator/pull/1322)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/d967a73c5f7da76783ee1af093f21817e7681e1d...fdaf5248a73ea29dbfd104fa4583e0461f6ad03a)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/c7f615ba375151e412bb5d4ac79f3fe5bf6747a8)

* [OCPBUGS-103402](https://issues.redhat.com/browse/OCPBUGS-103402): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#2299](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2299)
* [OCPBUGS-76284](https://issues.redhat.com/browse/OCPBUGS-76284): Add priority field to prevent early shutdown [#2031](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2031)
* [OCPBUGS-58412](https://issues.redhat.com/browse/OCPBUGS-58412): bump library-go to bring in revision controller revision-ready annotation fix [#1976](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1976)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/bac8a7c99c2e8562a05b784c8fe4f8ecd91eecdf...c7f615ba375151e412bb5d4ac79f3fe5bf6747a8)


### [cluster-kube-cluster-api-operator](https://github.com/openshift/cluster-api-operator/tree/efe651a9d382e5e41e480823c12f06e51b5b50d0)

* [OCPBUGS-80231](https://issues.redhat.com/browse/OCPBUGS-80231): Bump google.golang.org/grpc to v1.79.3 [#77](https://github.com/openshift/cluster-api-operator/pull/77)
* [Full changelog](https://github.com/openshift/cluster-api-operator/compare/33a1141ebfe0476e9f8c9d7dc20e49e42c52a9dd...efe651a9d382e5e41e480823c12f06e51b5b50d0)


### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/1bab093a303a38f2a6c8ad14c7e3cecaa412079c)

* [OCPBUGS-103404](https://issues.redhat.com/browse/OCPBUGS-103404): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#961](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/961)
* [OCPBUGS-76284](https://issues.redhat.com/browse/OCPBUGS-76284): Add priority field to prevent early shutdown [#906](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/906)
* [OCPBUGS-58412](https://issues.redhat.com/browse/OCPBUGS-58412): bump library-go to bring in revision controller revision-ready annotation fix [#897](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/897)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/a2cbb5725fe5e560ba40d884cfd079b3f8391f03...1bab093a303a38f2a6c8ad14c7e3cecaa412079c)


### [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator/tree/4e99db62cea1d2ca48765230c6f5663d1f2c2702)

* [CNTRLPLANE-2843](https://issues.redhat.com/browse/CNTRLPLANE-2843): chore: update OWNERS [#622](https://github.com/openshift/cluster-kube-scheduler-operator/pull/622)
* [OCPBUGS-76284](https://issues.redhat.com/browse/OCPBUGS-76284): Add priority field to prevent early shutdown [#612](https://github.com/openshift/cluster-kube-scheduler-operator/pull/612)
* [OCPBUGS-58412](https://issues.redhat.com/browse/OCPBUGS-58412): bump library-go to bring in revision controller revision-ready annotation fix [#590](https://github.com/openshift/cluster-kube-scheduler-operator/pull/590)
* [Full changelog](https://github.com/openshift/cluster-kube-scheduler-operator/compare/6182930dde5ec8dd22bd50481e8b369ce673484c...4e99db62cea1d2ca48765230c6f5663d1f2c2702)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/87b50fc0c80f75b974d1400c8fbcb0a0885d8d66)

* [OCPBUGS-129140](https://issues.redhat.com/browse/OCPBUGS-129140): don't delete admin-owned Alertmanager secrets on destroy [#3142](https://github.com/openshift/cluster-monitoring-operator/pull/3142)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.18] [#3116](https://github.com/openshift/cluster-monitoring-operator/pull/3116)
* [OCPBUGS-103412](https://issues.redhat.com/browse/OCPBUGS-103412): [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#3075](https://github.com/openshift/cluster-monitoring-operator/pull/3075)
* [OCPBUGS-105311](https://issues.redhat.com/browse/OCPBUGS-105311): [release-4.18] wrap library-go resourceCache with mutex for thread safety [#3041](https://github.com/openshift/cluster-monitoring-operator/pull/3041)
* [OCPBUGS-104540](https://issues.redhat.com/browse/OCPBUGS-104540): Backport e2e stabilization 4.18 [#3030](https://github.com/openshift/cluster-monitoring-operator/pull/3030)
* [OCPBUGS-100375](https://issues.redhat.com/browse/OCPBUGS-100375): [release-4.18] fix: watch cluster wide proxy changes and apply changes accordingly [#3024](https://github.com/openshift/cluster-monitoring-operator/pull/3024)
* [OCPBUGS-94081](https://issues.redhat.com/browse/OCPBUGS-94081): ship collector:node_scrape_collector_success:avg to Telemetry [#2992](https://github.com/openshift/cluster-monitoring-operator/pull/2992)
* [OCPBUGS-86995](https://issues.redhat.com/browse/OCPBUGS-86995): increase lookup interval [#2944](https://github.com/openshift/cluster-monitoring-operator/pull/2944)
* [OCPBUGS-77274](https://issues.redhat.com/browse/OCPBUGS-77274): AlertingRule: fix duplicate PrometheusRules after MD5-&gt;SHA-224 naming change [#2833](https://github.com/openshift/cluster-monitoring-operator/pull/2833)
* [OCPBUGS-67168](https://issues.redhat.com/browse/OCPBUGS-67168): Add the collection of MTV migration metrics [#2774](https://github.com/openshift/cluster-monitoring-operator/pull/2774)
* [OCPBUGS-61965](https://issues.redhat.com/browse/OCPBUGS-61965): add flag `--watch-referenced-objects-in-all-namespaces` to prometheus-operator [#2723](https://github.com/openshift/cluster-monitoring-operator/pull/2723)
* [OCPBUGS-64579](https://issues.redhat.com/browse/OCPBUGS-64579): Fix KSM deny-list typo [#2731](https://github.com/openshift/cluster-monitoring-operator/pull/2731)
* [OCPBUGS-63488](https://issues.redhat.com/browse/OCPBUGS-63488): Remove AlertManager endpoints when disabled [#2737](https://github.com/openshift/cluster-monitoring-operator/pull/2737)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/e8683f7f2fd30b45bfd8a94ca5c70c37029c1363...87b50fc0c80f75b974d1400c8fbcb0a0885d8d66)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/bb2b3f7e6f3d628ddde0a17a107f01ce9db34afb)

* [OCPBUGS-100191](https://issues.redhat.com/browse/OCPBUGS-100191): Bump github.com/containernetworking/cni v0.8.0 -&gt; v1.3.0 [#3096](https://github.com/openshift/cluster-network-operator/pull/3096)
* [OCPBUGS-85443](https://issues.redhat.com/browse/OCPBUGS-85443): Remove duplicated openssl parameter [#3006](https://github.com/openshift/cluster-network-operator/pull/3006)
* [OCPBUGS-84869](https://issues.redhat.com/browse/OCPBUGS-84869): wait for patch port to apply drop garp flows [#2988](https://github.com/openshift/cluster-network-operator/pull/2988)
* [OCPBUGS-84180](https://issues.redhat.com/browse/OCPBUGS-84180): fix(hypershift): use net.JoinHostPort for URL construction [#2977](https://github.com/openshift/cluster-network-operator/pull/2977)
* [OCPBUGS-77151](https://issues.redhat.com/browse/OCPBUGS-77151): Add config override for openflow-probe [#2965](https://github.com/openshift/cluster-network-operator/pull/2965)
* [OCPBUGS-78833](https://issues.redhat.com/browse/OCPBUGS-78833): Fix whereabouts-token-watcher DaemonSet improvements [#2940](https://github.com/openshift/cluster-network-operator/pull/2940)
* [OCPBUGS-74154](https://issues.redhat.com/browse/OCPBUGS-74154): whereabouts-config is a reserved name for user interaction. [#2884](https://github.com/openshift/cluster-network-operator/pull/2884)
* [OCPBUGS-73767](https://issues.redhat.com/browse/OCPBUGS-73767): Tweak iptables-alerter to try to avoid crictl bug [#2877](https://github.com/openshift/cluster-network-operator/pull/2877)
* [OCPBUGS-65704](https://issues.redhat.com/browse/OCPBUGS-65704), [OCPBUGS-65705](https://issues.redhat.com/browse/OCPBUGS-65705): Annotate whereabouts-controller [#2842](https://github.com/openshift/cluster-network-operator/pull/2842)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/eec368f2985d93c136785b6f37bdd39559a1cf4c...bb2b3f7e6f3d628ddde0a17a107f01ce9db34afb)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/cb375d177811aa52b53124335de2f87f417136d8)

* [OCPBUGS-90575](https://issues.redhat.com/browse/OCPBUGS-90575): Requeue PerformanceStatus update when status write fails [#1552](https://github.com/openshift/cluster-node-tuning-operator/pull/1552)
* [OCPBUGS-82752](https://issues.redhat.com/browse/OCPBUGS-82752): Bump github.com/moby/spdystream from v0.4.0 to v0.5.1 [#1544](https://github.com/openshift/cluster-node-tuning-operator/pull/1544)
* [OCPBUGS-75954](https://issues.redhat.com/browse/OCPBUGS-75954): PPC: filter out namespaces dir [#1465](https://github.com/openshift/cluster-node-tuning-operator/pull/1465)
* [OCPBUGS-69947](https://issues.redhat.com/browse/OCPBUGS-69947): [release-4.18] E2E: skip stalld test checking sched_fifo [#1451](https://github.com/openshift/cluster-node-tuning-operator/pull/1451)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/eb5caaf6e854e26dbf249862eac1b0a902325ad8...cb375d177811aa52b53124335de2f87f417136d8)


### [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator/tree/fa9d9ab4f994caca680f0edf3563b03c2e74020c)

* [OCPBUGS-80239](https://issues.redhat.com/browse/OCPBUGS-80239): Bump google.golang.org/grpc to v1.79.3 [#200](https://github.com/openshift/cluster-olm-operator/pull/200)
* [Full changelog](https://github.com/openshift/cluster-olm-operator/compare/88088e4bfe9f55ea7ab2c4331cebee727c8c0c34...fa9d9ab4f994caca680f0edf3563b03c2e74020c)


### [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller/tree/3b44245d8fe9d9b1083998d8d956c7bc4d96a066)

* [OCPBUGS-98486](https://issues.redhat.com/browse/OCPBUGS-98486): Backport fs type service account token 4.18 [#196](https://github.com/openshift/cluster-policy-controller/pull/196)
* [Full changelog](https://github.com/openshift/cluster-policy-controller/compare/5fd852525909ce6eab52972ba9ce8fcf56528eb9...3b44245d8fe9d9b1083998d8d956c7bc4d96a066)


### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/475bca99da31d4bb0479affe03f841bbce565c1e)

* [OCPBUGS-103401](https://issues.redhat.com/browse/OCPBUGS-103401): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#735](https://github.com/openshift/cluster-storage-operator/pull/735)
* [OCPBUGS-87556](https://issues.redhat.com/browse/OCPBUGS-87556): remove oVirt code from CSO 4.18 [#707](https://github.com/openshift/cluster-storage-operator/pull/707)
* [OCPBUGS-77627](https://issues.redhat.com/browse/OCPBUGS-77627): add vsphere permissions for checking if users is authorized to see metrics [#670](https://github.com/openshift/cluster-storage-operator/pull/670)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/43fe40ddc11a8453f83273bbea82ae6295b496f9...475bca99da31d4bb0479affe03f841bbce565c1e)


### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/ad2a48af8a20fb593c8c076db319f5df67497a58)

* [OCPBUGS-103432](https://issues.redhat.com/browse/OCPBUGS-103432): Bump golang.org/x/net to v0.35.0-sec.3 [#1459](https://github.com/openshift/cluster-version-operator/pull/1459)
* [OCPBUGS-70182](https://issues.redhat.com/browse/OCPBUGS-70182): Unify capitalization when comparing architectures for available updates [#1327](https://github.com/openshift/cluster-version-operator/pull/1327)
* NO-ISSUE: hongkai becomes an approver release-4.18 [#1286](https://github.com/openshift/cluster-version-operator/pull/1286)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/69444928d785cac03ed223576500586ea4d7ee55...ad2a48af8a20fb593c8c076db319f5df67497a58)


### [console](https://github.com/openshift/console/tree/35eef0b706bbd2e76903d6189b77d63f66316ff6)

* [OCPBUGS-127183](https://issues.redhat.com/browse/OCPBUGS-127183): Re-enable Knative Cypress e2e tests [#16907](https://github.com/openshift/console/pull/16907)
* [OCPBUGS-113759](https://issues.redhat.com/browse/OCPBUGS-113759): block GraphQL introspection over websocket [#17130](https://github.com/openshift/console/pull/17130)
* Fix for OCPBUGS-92075: CVE-2026-44990 [#16717](https://github.com/openshift/console/pull/16717)
* [OCPBUGS-100515](https://issues.redhat.com/browse/OCPBUGS-100515), [OCPBUGS-101791](https://issues.redhat.com/browse/OCPBUGS-101791): Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss [#17058](https://github.com/openshift/console/pull/17058)
* [OCPBUGS-98420](https://issues.redhat.com/browse/OCPBUGS-98420): [release-4.18] CVE-2026-59869 bump js-yaml [#17076](https://github.com/openshift/console/pull/17076)
* [OCPBUGS-81520](https://issues.redhat.com/browse/OCPBUGS-81520): Console can only show user name instead of full name as the display name [#16238](https://github.com/openshift/console/pull/16238)
* [OCPBUGS-86740](https://issues.redhat.com/browse/OCPBUGS-86740), [OCPBUGS-87085](https://issues.redhat.com/browse/OCPBUGS-87085), [OCPBUGS-97763](https://issues.redhat.com/browse/OCPBUGS-97763): [release-4.18] bump package: protobufjs, fast-uri [#16728](https://github.com/openshift/console/pull/16728)
* [OCPBUGS-100069](https://issues.redhat.com/browse/OCPBUGS-100069): quickstart page i18n misses (Fix Quick Starts i18n bundle lookup for zh-CN) [#16872](https://github.com/openshift/console/pull/16872)
* [OCPBUGS-91944](https://issues.redhat.com/browse/OCPBUGS-91944): Prevent binary secret data corruption when editing [#16673](https://github.com/openshift/console/pull/16673)
* [OCPBUGS-99487](https://issues.redhat.com/browse/OCPBUGS-99487): Disable Knative e2e Cypress tests in CI [#16803](https://github.com/openshift/console/pull/16803)
* [OCPBUGS-99648](https://issues.redhat.com/browse/OCPBUGS-99648): Disable shipwright e2e tests to unblock CI [#16818](https://github.com/openshift/console/pull/16818)
* [OCPBUGS-86453](https://issues.redhat.com/browse/OCPBUGS-86453): [release-4.18] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators [#16511](https://github.com/openshift/console/pull/16511)
* Fix for OCPBUGS-81604: CVE-2026-4800 [#16563](https://github.com/openshift/console/pull/16563)
* [OCPBUGS-84284](https://issues.redhat.com/browse/OCPBUGS-84284): Bump follow-redirects to 1.16.0 to fix CVE-2026-40895 [#16675](https://github.com/openshift/console/pull/16675)
* [OCPBUGS-77125](https://issues.redhat.com/browse/OCPBUGS-77125): [release-4.18] CVE-2026-26996 Bump minimatch library [#16344](https://github.com/openshift/console/pull/16344)
* [OCPBUGS-79447](https://issues.redhat.com/browse/OCPBUGS-79447): Bump immutable [#16325](https://github.com/openshift/console/pull/16325)
* NO-JIRA: enable multi-architecture yarn builds [#16421](https://github.com/openshift/console/pull/16421)
* [CONSOLE-5011](https://issues.redhat.com/browse/CONSOLE-5011): migrate to yarn berry [#16073](https://github.com/openshift/console/pull/16073)
* NO-JIRA: Bump builder image to v29 [#15995](https://github.com/openshift/console/pull/15995)
* [OCPBUGS-65808](https://issues.redhat.com/browse/OCPBUGS-65808): Fix PatternFly dark theme colors for charts and form inputs [#15951](https://github.com/openshift/console/pull/15951)
* [OCPBUGS-74458](https://issues.redhat.com/browse/OCPBUGS-74458): Bump lodash to latest [#15965](https://github.com/openshift/console/pull/15965)
* [OCPBUGS-73753](https://issues.redhat.com/browse/OCPBUGS-73753): Fix Helm chart installation with CA/TLS certificates [#15914](https://github.com/openshift/console/pull/15914)
* [OCPBUGS-73662](https://issues.redhat.com/browse/OCPBUGS-73662): Namespace is not persisting when switching to developer view from the topology page of admin page [#15910](https://github.com/openshift/console/pull/15910)
* [OCPBUGS-69915](https://issues.redhat.com/browse/OCPBUGS-69915): PVC shows negative Available space in OpenShift Console on RHOCP 4 [#15868](https://github.com/openshift/console/pull/15868)
* [OCPBUGS-69448](https://issues.redhat.com/browse/OCPBUGS-69448): Fixes namespace-scoped operators that were not showing as installed when viewing OperatorHub in "All Projects" mode [#15855](https://github.com/openshift/console/pull/15855)
* [OCPBUGS-68361](https://issues.redhat.com/browse/OCPBUGS-68361): Disallowed Pipelines-plugin Pipelines navigation section [#15842](https://github.com/openshift/console/pull/15842)
* [OCPBUGS-65592](https://issues.redhat.com/browse/OCPBUGS-65592): HPA Form View in RHOCP Web Console Incorrectly Requires Both CPU and … [#15725](https://github.com/openshift/console/pull/15725)
* [OCPBUGS-65932](https://issues.redhat.com/browse/OCPBUGS-65932): Preserve query string in perspective switch + remove dev console folks from `reviewers` [#15761](https://github.com/openshift/console/pull/15761)
* [OCPBUGS-65533](https://issues.redhat.com/browse/OCPBUGS-65533): Preserve path on perspective switch [#15716](https://github.com/openshift/console/pull/15716)
* [OCPBUGS-64735](https://issues.redhat.com/browse/OCPBUGS-64735): Expose prometheus tenancy label path as a proxy [#15685](https://github.com/openshift/console/pull/15685)
* [OCPBUGS-64682](https://issues.redhat.com/browse/OCPBUGS-64682): limit node log length to 1000 lines [#15680](https://github.com/openshift/console/pull/15680)
* [Full changelog](https://github.com/openshift/console/compare/fbb9a4ec3bf61a9ecdd6fcc722d7bfc68a9fb515...35eef0b706bbd2e76903d6189b77d63f66316ff6)


### [console-operator](https://github.com/openshift/console-operator/tree/2a0ef19e3ec9f8bfaba5cc758ffe36047ba2f57d)

* [OCPBUGS-103424](https://issues.redhat.com/browse/OCPBUGS-103424): Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 [#1223](https://github.com/openshift/console-operator/pull/1223)
* [OCPBUGS-98985](https://issues.redhat.com/browse/OCPBUGS-98985): [4.18] Stabilize telemetry config to prevent continuous console pod rollouts [#1190](https://github.com/openshift/console-operator/pull/1190)
* [OCPBUGS-77861](https://issues.redhat.com/browse/OCPBUGS-77861): update go mod dependency for konflux [#1113](https://github.com/openshift/console-operator/pull/1113)
* [Full changelog](https://github.com/openshift/console-operator/compare/60dd3f557240d2408b7c12409d727732f8b355a3...2a0ef19e3ec9f8bfaba5cc758ffe36047ba2f57d)


### [container-networking-plugins, containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins/tree/090b88ce1854b21afacd8302ab03c7d8aa667070)

* [OCPBUGS-85672](https://issues.redhat.com/browse/OCPBUGS-85672): CI Build root image tag sync with ART [#236](https://github.com/openshift/containernetworking-plugins/pull/236)
* [Full changelog](https://github.com/openshift/containernetworking-plugins/compare/e8ca1d70c43f33cd0e75c776e2a24afbec61b46c...090b88ce1854b21afacd8302ab03c7d8aa667070)


### [csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/a34070f9a9880fcbc3ac3d0d81c04f932a7afabf)

* [OCPBUGS-80309](https://issues.redhat.com/browse/OCPBUGS-80309): Bump google.golang.org/grpc [#387](https://github.com/openshift/cloud-provider-openstack/pull/387)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/8857214a0160e383269525675ecbe6be40ca6f80...a34070f9a9880fcbc3ac3d0d81c04f932a7afabf)


### [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs/tree/a651acb2e777e4738869e108dc73a5555f8a79cc)

* [OCPBUGS-82754](https://issues.redhat.com/browse/OCPBUGS-82754): Bump github.com/moby/spdystream@v0.5.1 [#194](https://github.com/openshift/csi-driver-nfs/pull/194)
* [OCPBUGS-80254](https://issues.redhat.com/browse/OCPBUGS-80254): Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.71.3-sec.1 to avoid go version bump and fix CVE-2026-33186 [#180](https://github.com/openshift/csi-driver-nfs/pull/180)
* [Full changelog](https://github.com/openshift/csi-driver-nfs/compare/32e775900642ab9c3560a06219104d7c38f8461c...a651acb2e777e4738869e108dc73a5555f8a79cc)


### [csi-external-attacher](https://github.com/openshift/csi-external-attacher/tree/0348cc3dc6afbff8eddbdc85aadf599117d8c82d)

* UPSTREAM: 110: OCPBUGS-103429: Bump golang.org/x/net to v0.35.0-sec.4 [#115](https://github.com/openshift/csi-external-attacher/pull/115)
* [OCPBUGS-80255](https://issues.redhat.com/browse/OCPBUGS-80255): Bump google.golang.org/grpc to v1.79.3 [#105](https://github.com/openshift/csi-external-attacher/pull/105)
* [Full changelog](https://github.com/openshift/csi-external-attacher/compare/39b37c06a27481c708f071464bd1049ea7db97c7...0348cc3dc6afbff8eddbdc85aadf599117d8c82d)


### [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner/tree/5945a3a19bc358904dd16bdc1f172dce6e2d256b)

* [OCPBUGS-92883](https://issues.redhat.com/browse/OCPBUGS-92883): Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.33.0-sec.5 to address CVE-2026-46597 [#163](https://github.com/openshift/csi-external-provisioner/pull/163)
* [OCPBUGS-82755](https://issues.redhat.com/browse/OCPBUGS-82755): Address CVE-2026-35469 [#135](https://github.com/openshift/csi-external-provisioner/pull/135)
* [OCPBUGS-80256](https://issues.redhat.com/browse/OCPBUGS-80256): Bump google.golang.org/grpc [#130](https://github.com/openshift/csi-external-provisioner/pull/130)
* [Full changelog](https://github.com/openshift/csi-external-provisioner/compare/376f0ea04c64a41cb5166ff415fff849ff2da380...5945a3a19bc358904dd16bdc1f172dce6e2d256b)


### [csi-external-resizer](https://github.com/openshift/csi-external-resizer/tree/7e33709d63c9f22c6aeeb2137708c8aba512e711)

* [OCPBUGS-103430](https://issues.redhat.com/browse/OCPBUGS-103430): Bump golang.org/x/net to v0.35.0-sec.4 [#213](https://github.com/openshift/csi-external-resizer/pull/213)
* [OCPBUGS-80257](https://issues.redhat.com/browse/OCPBUGS-80257): Bump google.golang.org/grpc to v1.79.3 [#203](https://github.com/openshift/csi-external-resizer/pull/203)
* [Full changelog](https://github.com/openshift/csi-external-resizer/compare/a14236907d2e7f3f0342d399f01ad38ee66b3346...7e33709d63c9f22c6aeeb2137708c8aba512e711)


### [csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook](https://github.com/openshift/csi-external-snapshotter/tree/df7707f06925800ea55ff8038665a3191867c163)

* [OCPBUGS-127502](https://issues.redhat.com/browse/OCPBUGS-127502): [release-4.18] OCPBUGS-127500: UPSTREAM: 1392: Fix VolumeSnapshotContent deletion [#257](https://github.com/openshift/csi-external-snapshotter/pull/257)
* [OCPBUGS-103427](https://issues.redhat.com/browse/OCPBUGS-103427), [OCPBUGS-103428](https://issues.redhat.com/browse/OCPBUGS-103428): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 [#228](https://github.com/openshift/csi-external-snapshotter/pull/228)
* [OCPBUGS-80258](https://issues.redhat.com/browse/OCPBUGS-80258), [OCPBUGS-80261](https://issues.redhat.com/browse/OCPBUGS-80261), [OCPBUGS-80262](https://issues.redhat.com/browse/OCPBUGS-80262): Bump google.golang.org/grpc to v1.79.3 [#211](https://github.com/openshift/csi-external-snapshotter/pull/211)
* [Full changelog](https://github.com/openshift/csi-external-snapshotter/compare/8ddbcd381bf5317c1d1a93db3b5760681a33cb27...df7707f06925800ea55ff8038665a3191867c163)


### [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe/tree/0f1aff4017cda59d2b1130bc69f7412e5e85b25a)

* [OCPBUGS-103425](https://issues.redhat.com/browse/OCPBUGS-103425): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#103](https://github.com/openshift/csi-livenessprobe/pull/103)
* [Full changelog](https://github.com/openshift/csi-livenessprobe/compare/3a977844a9373d9b330fa923994a4c800e2cc745...0f1aff4017cda59d2b1130bc69f7412e5e85b25a)


### [docker-builder](https://github.com/openshift/builder/tree/c79e9bd005935182ea2b7631b68778a8ffc28d3d)

* [OCPBUGS-89907](https://issues.redhat.com/browse/OCPBUGS-89907), [OCPBUGS-90327](https://issues.redhat.com/browse/OCPBUGS-90327), [OCPBUGS-92414](https://issues.redhat.com/browse/OCPBUGS-92414), [OCPBUGS-92621](https://issues.redhat.com/browse/OCPBUGS-92621), [OCPBUGS-92892](https://issues.redhat.com/browse/OCPBUGS-92892): Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 [#549](https://github.com/openshift/builder/pull/549)
* [OCPBUGS-66990](https://issues.redhat.com/browse/OCPBUGS-66990): bump buildah to 1.37.7 to fix CVE-2025-52881 [#498](https://github.com/openshift/builder/pull/498)
* [OCPBUGS-65655](https://issues.redhat.com/browse/OCPBUGS-65655): BuildConfig inline Dockerfile fails with heredoc syntax [#486](https://github.com/openshift/builder/pull/486)
* [Full changelog](https://github.com/openshift/builder/compare/a5cbc2b1862e9fbf2bb0ca52ec54ce85e67f1d7f...c79e9bd005935182ea2b7631b68778a8ffc28d3d)


### [docker-registry](https://github.com/openshift/image-registry/tree/2047e0a3849170b035bd7079c533c1eaa871dd8b)

* [OCPBUGS-103437](https://issues.redhat.com/browse/OCPBUGS-103437): [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#480](https://github.com/openshift/image-registry/pull/480)
* [OCPBUGS-68253](https://issues.redhat.com/browse/OCPBUGS-68253): update logrus to v1.9.1 [#464](https://github.com/openshift/image-registry/pull/464)
* [Full changelog](https://github.com/openshift/image-registry/compare/cfa51ab4b60fc0e836547626a5fd02b97ee82708...2047e0a3849170b035bd7079c533c1eaa871dd8b)


### [egress-router-cni](https://github.com/openshift/egress-router-cni/tree/632b6ad446da77c12005c6b2e4da5086ce84e6e4)

* [OCPBUGS-100191](https://issues.redhat.com/browse/OCPBUGS-100191): Bump containernetworking/cni to v1.3.0 github.com/containernetworking/plugins to 1.4.0 [#109](https://github.com/openshift/egress-router-cni/pull/109)
* [Full changelog](https://github.com/openshift/egress-router-cni/compare/3193a756d60e14f7139992e2e42b7036955652e7...632b6ad446da77c12005c6b2e4da5086ce84e6e4)


### [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp/tree/6d4539447313cc3ede325e58433b3f8c450e208a)

* [OCPBUGS-80270](https://issues.redhat.com/browse/OCPBUGS-80270): Bump google.golang.org/grpc to v1.79.3 [#290](https://github.com/openshift/cluster-api-provider-gcp/pull/290)
* [OCPBUGS-78278](https://issues.redhat.com/browse/OCPBUGS-78278): [release-4.18] update go mod dependency for konflux [#265](https://github.com/openshift/cluster-api-provider-gcp/pull/265)
* [Full changelog](https://github.com/openshift/cluster-api-provider-gcp/compare/1fff69026f5478680ee535531ab8dc2fb76f2f5c...6d4539447313cc3ede325e58433b3f8c450e208a)


### [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp/tree/f15d4a247196831c454e1b3824e7eb9193df83a4)

* [OCPBUGS-103482](https://issues.redhat.com/browse/OCPBUGS-103482): Bump golang.org/x/net to v0.35.0-sec.3 [#189](https://github.com/openshift/machine-api-provider-gcp/pull/189)
* [OCPBUGS-80293](https://issues.redhat.com/browse/OCPBUGS-80293): Bump google.golang.org/grpc to v1.79.3 [#165](https://github.com/openshift/machine-api-provider-gcp/pull/165)
* [Full changelog](https://github.com/openshift/machine-api-provider-gcp/compare/b2f858ba546520410f391b5f6afdbe0b1562903d...f15d4a247196831c454e1b3824e7eb9193df83a4)


### [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver/tree/5b3b9a6d4131fa538721d7db0a17a64dac9f79ae)

* [OCPBUGS-103438](https://issues.redhat.com/browse/OCPBUGS-103438): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#145](https://github.com/openshift/gcp-pd-csi-driver/pull/145)
* [OCPBUGS-80274](https://issues.redhat.com/browse/OCPBUGS-80274): Bump google.golang.org/grpc to v1.71.3-sec.1 in release-4.18 [#112](https://github.com/openshift/gcp-pd-csi-driver/pull/112)
* [OCPBUGS-68258](https://issues.redhat.com/browse/OCPBUGS-68258): UPSTREAM: 2056: bump github.com/sirupsen/logrus to v1.9.3 [#89](https://github.com/openshift/gcp-pd-csi-driver/pull/89)
* [OCPBUGS-44772](https://issues.redhat.com/browse/OCPBUGS-44772): Fix Hyperdisk Resize That Requires Iops/Throughput Adjustment [#83](https://github.com/openshift/gcp-pd-csi-driver/pull/83)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver/compare/1b8c94ac55d8602ba6669325ade654ae47ea74cf...5b3b9a6d4131fa538721d7db0a17a64dac9f79ae)


### [gcp-pd-csi-driver-operator](https://github.com/openshift/gcp-pd-csi-driver-operator/tree/4432976ac44305e5f34e97e759728cedd44e8b85)

* [OCPBUGS-80273](https://issues.redhat.com/browse/OCPBUGS-80273): Replace google.golang.org/grpc with fork [#187](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/187)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver-operator/compare/7cb8b38ceae1e2f38149df0e111a40ba38b49aeb...4432976ac44305e5f34e97e759728cedd44e8b85)


### [haproxy-router](https://github.com/openshift/router/tree/347f03e9d6caaf6bf249bf1d2075965112eab228)

* [OCPBUGS-86726](https://issues.redhat.com/browse/OCPBUGS-86726): Prevent SSRF via FQDN-typed EndpointSlices [#821](https://github.com/openshift/router/pull/821)
* [OCPBUGS-86715](https://issues.redhat.com/browse/OCPBUGS-86715): Strip X-SSL-* headers for plain HTTP [#800](https://github.com/openshift/router/pull/800)
* [OCPBUGS-80275](https://issues.redhat.com/browse/OCPBUGS-80275): Bump google.golang.org/grpc to v1.79.3 [#768](https://github.com/openshift/router/pull/768)
* [OCPBUGS-67214](https://issues.redhat.com/browse/OCPBUGS-67214): Add option abortonclose to HAProxy configuration template [#703](https://github.com/openshift/router/pull/703)
* [Full changelog](https://github.com/openshift/router/compare/d8058949aaf91dcdea050c58e6a34ef5f6670c67...347f03e9d6caaf6bf249bf1d2075965112eab228)


### [hyperkube, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/91c24081f468e7636c824f4f5a2eb68660b81012)

* [OCPBUGS-54724](https://issues.redhat.com/browse/OCPBUGS-54724): Fix implementation of ContainsCIDR to allow non-equal addresses [#2267](https://github.com/openshift/kubernetes/pull/2267)
* [OCPBUGS-65553](https://issues.redhat.com/browse/OCPBUGS-65553): Update to Kubernetes v1.31.14 [#2521](https://github.com/openshift/kubernetes/pull/2521)
* [OCPBUGS-65494](https://issues.redhat.com/browse/OCPBUGS-65494): Fix Concurrentmap Iteration [#2512](https://github.com/openshift/kubernetes/pull/2512)
* [Full changelog](https://github.com/openshift/kubernetes/compare/56747b62f392bf1b0da64649aa2285f6a524c435...91c24081f468e7636c824f4f5a2eb68660b81012)


### [hypershift](https://github.com/openshift/hypershift/tree/27a5a49092208cf45635939841b2df61a0a50222)

* [OCPBUGS-131922](https://issues.redhat.com/browse/OCPBUGS-131922): Router publish strategy related changes for IBM Cloud platform [#10007](https://github.com/openshift/hypershift/pull/10007)
* fix(deps): OCPBUGS-76288: Update runc, selinux, and their transitive deps to fix CVE-2025-52881 [#8289](https://github.com/openshift/hypershift/pull/8289)
* [ACM-37663](https://issues.redhat.com/browse/ACM-37663): Rebase hypershift operator runtime image to RHEL 9.8 ELS [#9451](https://github.com/openshift/hypershift/pull/9451)
* [ACM-38044](https://issues.redhat.com/browse/ACM-38044): update Containerfile.cli base images to floating tags [release-4.18] [#9044](https://github.com/openshift/hypershift/pull/9044)
* [OCPBUGS-99142](https://issues.redhat.com/browse/OCPBUGS-99142): fix(backport): konnectivity agent auth [#9096](https://github.com/openshift/hypershift/pull/9096)
* [OCPBUGS-62756](https://issues.redhat.com/browse/OCPBUGS-62756): Restart HCP on stale serving certs [#8245](https://github.com/openshift/hypershift/pull/8245)
* [OCPBUGS-89356](https://issues.redhat.com/browse/OCPBUGS-89356): build(operator): drop hypershift-no-cgo from operator container images [#8760](https://github.com/openshift/hypershift/pull/8760)
* NO-JIRA: remove path filter from control-plane-operator pipelines [#8665](https://github.com/openshift/hypershift/pull/8665)
* [OCPBUGS-80278](https://issues.redhat.com/browse/OCPBUGS-80278): fix CVE-2026-33186 by replacing grpc-go [#8515](https://github.com/openshift/hypershift/pull/8515)
* [OCPBUGS-84180](https://issues.redhat.com/browse/OCPBUGS-84180): fix(cno): use brackets only for IPv6 in server URL [#8346](https://github.com/openshift/hypershift/pull/8346)
* [OCPBUGS-76532](https://issues.redhat.com/browse/OCPBUGS-76532): feat(updates): enable CVO metrics access with RHOBS monitoring flag [#7699](https://github.com/openshift/hypershift/pull/7699)
* [OCPBUGS-77368](https://issues.redhat.com/browse/OCPBUGS-77368): Fix ignition-server pod restarts [#7878](https://github.com/openshift/hypershift/pull/7878)
* [CNTRLPLANE-1708](https://issues.redhat.com/browse/CNTRLPLANE-1708): Backport Customer Global Pull Secret to OpenShift 4.18.z [#7354](https://github.com/openshift/hypershift/pull/7354)
* [OCPBUGS-72932](https://issues.redhat.com/browse/OCPBUGS-72932): Fix Konflux EC voilation, update deprecated base … [#7456](https://github.com/openshift/hypershift/pull/7456)
* [OCPBUGS-69847](https://issues.redhat.com/browse/OCPBUGS-69847): test: remove unit tests that depend on network communication [release-4.18] [#7406](https://github.com/openshift/hypershift/pull/7406)
* [OCPBUGS-65843](https://issues.redhat.com/browse/OCPBUGS-65843): specify SCC annotation for pods in data plane [#7267](https://github.com/openshift/hypershift/pull/7267)
* [CNTRLPLANE-1902](https://issues.redhat.com/browse/CNTRLPLANE-1902): Migrate 4.18 pipelines to common pipeline template [#7211](https://github.com/openshift/hypershift/pull/7211)
* [OCPBUGS-61700](https://issues.redhat.com/browse/OCPBUGS-61700): use csi-resizer image from release provider [#7103](https://github.com/openshift/hypershift/pull/7103)
* [OCPBUGS-63638](https://issues.redhat.com/browse/OCPBUGS-63638): [release-4.18] fix(konnectivity): resolve circular dependency causing DNS timeouts and excessive retries [#7111](https://github.com/openshift/hypershift/pull/7111)
* [Full changelog](https://github.com/openshift/hypershift/compare/5a73548bacc7b5d6904cca1bd68175a31cee4a25...27a5a49092208cf45635939841b2df61a0a50222)


### [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm/tree/b801da5863cfbf9891c96b123a58e11c4e1e5091)

* [OCPBUGS-120695](https://issues.redhat.com/browse/OCPBUGS-120695): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#114](https://github.com/openshift/cloud-provider-ibm/pull/114)
* [Full changelog](https://github.com/openshift/cloud-provider-ibm/compare/a33026b12f204a9fe2580fcce13d52b11cfb1b1c...b801da5863cfbf9891c96b123a58e11c4e1e5091)


### [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver/tree/4f6a6d3b806def06b0d1a5a2632bc3ea014687c3)

* [OCPBUGS-80280](https://issues.redhat.com/browse/OCPBUGS-80280): Bump google.golang.org/grpc to v1.79.3 [#143](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/143)
* [OCPBUGS-77207](https://issues.redhat.com/browse/OCPBUGS-77207): [release-4.18] standardize build paths [#122](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/122)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver/compare/c7d883c586f548093481d87d7226d875502b30da...4f6a6d3b806def06b0d1a5a2632bc3ea014687c3)


### [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/tree/8bad5372aed998a1505b15a9d4826c26d9c44ff6)

* [OCPBUGS-103440](https://issues.redhat.com/browse/OCPBUGS-103440): Use patched x/net fork v0.35.0-sec.4 [#189](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/189)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/compare/1c7bc07e69c1e74a36b39b31f878da6391fdeefe...8bad5372aed998a1505b15a9d4826c26d9c44ff6)


### [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud/tree/2394335b884bd08f6d7f0017a537aeef4663addb)

* [OCPBUGS-103453](https://issues.redhat.com/browse/OCPBUGS-103453): Replace golang.org/x/net with openshift-sustaining/net [#172](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/172)
* [OCPBUGS-115513](https://issues.redhat.com/browse/OCPBUGS-115513): Fetch envtest assets from the controller-tools releases [#183](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/183)
* [OCPBUGS-67286](https://issues.redhat.com/browse/OCPBUGS-67286): [release-4.18] Fix incomplete vendor/ [#140](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/140)
* [Full changelog](https://github.com/openshift/cluster-api-provider-ibmcloud/compare/5df161611ece493f54bb8a14963449102b763836...2394335b884bd08f6d7f0017a537aeef4663addb)


### [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud/tree/f2a7a281512de89371799b269aadd8af5419ae37)

* [OCPBUGS-103467](https://issues.redhat.com/browse/OCPBUGS-103467): replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 [#104](https://github.com/openshift/machine-api-provider-ibmcloud/pull/104)
* [OCPBUGS-41223](https://issues.redhat.com/browse/OCPBUGS-41223): Updating ose-ibmcloud-machine-controllers-container image to be consistent with ART for 4.18 [#45](https://github.com/openshift/machine-api-provider-ibmcloud/pull/45)
* NO-JIRA: vendor golint instead of relying on the CI build root [#115](https://github.com/openshift/machine-api-provider-ibmcloud/pull/115)
* [OCPBUGS-81647](https://issues.redhat.com/browse/OCPBUGS-81647): bump vpc go sdk [#91](https://github.com/openshift/machine-api-provider-ibmcloud/pull/91)
* NO-JIRA: Modernize test infrastructure to align with other MAPI providers [#87](https://github.com/openshift/machine-api-provider-ibmcloud/pull/87)
* [Full changelog](https://github.com/openshift/machine-api-provider-ibmcloud/compare/e6eddf85c26eb056108b67fdad43bbbd2d9b4718...f2a7a281512de89371799b269aadd8af5419ae37)


### [insights-operator](https://github.com/openshift/insights-operator/tree/1a2a4c25f94ca12851d665501b52e946ecede82a)

* [OCPBUGS-103459](https://issues.redhat.com/browse/OCPBUGS-103459): Bump golang.org/x/net to v0.35.0-sec.3 [#1355](https://github.com/openshift/insights-operator/pull/1355)
* [OCPBUGS-80283](https://issues.redhat.com/browse/OCPBUGS-80283): Bump google.golang.org/grpc to v1.79.3 [#1283](https://github.com/openshift/insights-operator/pull/1283)
* [OCPBUGS-76963](https://issues.redhat.com/browse/OCPBUGS-76963): Extends the time for the extractor liveness probe [#1234](https://github.com/openshift/insights-operator/pull/1234)
* [OCPBUGS-76537](https://issues.redhat.com/browse/OCPBUGS-76537): [release-4.18] [bugfix] The ConfigMap value for StoragePath is ignored on basic routine [#1239](https://github.com/openshift/insights-operator/pull/1239)
* [OCPBUGS-68263](https://issues.redhat.com/browse/OCPBUGS-68263): Update github.com/sirupsen/logrus to v1.9.3 [#1205](https://github.com/openshift/insights-operator/pull/1205)
* [OCPBUGS-68263](https://issues.redhat.com/browse/OCPBUGS-68263): [release-4.18] golanci-lint version update & corresponding fixes (#1045) [#1206](https://github.com/openshift/insights-operator/pull/1206)
* [OCPBUGS-66396](https://issues.redhat.com/browse/OCPBUGS-66396): Add filtering to add other possible pod status to QEMU gatherer [#1195](https://github.com/openshift/insights-operator/pull/1195)
* [OCPBUGS-66182](https://issues.redhat.com/browse/OCPBUGS-66182): QEMU logs are not gathered if there are pending status virt-launcher pods [#1189](https://github.com/openshift/insights-operator/pull/1189)
* [OCPBUGS-66181](https://issues.redhat.com/browse/OCPBUGS-66181): [bugfix] The archive's records may include files whose names are out of bounds [#1188](https://github.com/openshift/insights-operator/pull/1188)
* [Full changelog](https://github.com/openshift/insights-operator/compare/5a7544487fd5944735bf3ff961c383700590b76b...1a2a4c25f94ca12851d665501b52e946ecede82a)


### [insights-runtime-exporter, insights-runtime-extractor](https://github.com/openshift/insights-runtime-extractor/tree/3d444833113258a5606cddc55192c9183d520968)

* [OCPBUGS-77789](https://issues.redhat.com/browse/OCPBUGS-77789): remove dnf cache from the container images [#69](https://github.com/openshift/insights-runtime-extractor/pull/69)
* [Full changelog](https://github.com/openshift/insights-runtime-extractor/compare/7149f2d5ed4682258bd429cd719ea154e1a27550...3d444833113258a5606cddc55192c9183d520968)


### [ironic](https://github.com/openshift/ironic-image/tree/3b9ae090705e9013364e489e8b4a6065aa43a94e)

* [OCPBUGS-88475](https://issues.redhat.com/browse/OCPBUGS-88475): Updating openstack-ironic commit that fixes CVE-2026-43003 [#903](https://github.com/openshift/ironic-image/pull/903)
* [OCPBUGS-105860](https://issues.redhat.com/browse/OCPBUGS-105860): update ironic pin to include CVE-2026-54423 fix (release-4.18) [#893](https://github.com/openshift/ironic-image/pull/893)
* [OCPBUGS-100164](https://issues.redhat.com/browse/OCPBUGS-100164): Update openstack-ironic commit hash for CVE-2026-44918 [#888](https://github.com/openshift/ironic-image/pull/888)
* [OCPBUGS-76459](https://issues.redhat.com/browse/OCPBUGS-76459): Bump pyasn1 to 0.5.1-4 [#826](https://github.com/openshift/ironic-image/pull/826)
* [OCPBUGS-74407](https://issues.redhat.com/browse/OCPBUGS-74407): Update sushy to include DGX B200 credentials fix [#832](https://github.com/openshift/ironic-image/pull/832)
* [OCPBUGS-74115](https://issues.redhat.com/browse/OCPBUGS-74115): Bump keystonemiddleware version to 10.7.1-0.20260216144200.4c001ba for CVE-2026-22797 fix [#795](https://github.com/openshift/ironic-image/pull/795)
* [OCPBUGS-69790](https://issues.redhat.com/browse/OCPBUGS-69790): Bump eventlet version to 0.33.1-7 [#760](https://github.com/openshift/ironic-image/pull/760)
* [OCPBUGS-65573](https://issues.redhat.com/browse/OCPBUGS-65573): Include Handle HTTP 400 and 409 race condition in Redfish power opera… [#727](https://github.com/openshift/ironic-image/pull/727)
* [Full changelog](https://github.com/openshift/ironic-image/compare/cd4755924baecf3b87f87c348c2568dec88434fd...3b9ae090705e9013364e489e8b4a6065aa43a94e)


### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/00262e5c67e6c7f2f2d6ef761fb28bef983bd0d7)

* [OCPBUGS-99888](https://issues.redhat.com/browse/OCPBUGS-99888): Correct ironic-python-agent pin to include the CVE-2026-66138 fix [#314](https://github.com/openshift/ironic-agent-image/pull/314)
* [OCPBUGS-88475](https://issues.redhat.com/browse/OCPBUGS-88475): Update openstack-ironic-python-agent commit hash that address CVE-2026-43003 [#313](https://github.com/openshift/ironic-agent-image/pull/313)
* [OCPBUGS-99888](https://issues.redhat.com/browse/OCPBUGS-99888): Bump ironic-python-agent pinned commit for CVE-2026-66138 [#308](https://github.com/openshift/ironic-agent-image/pull/308)
* [OCPBUGS-95066](https://issues.redhat.com/browse/OCPBUGS-95066): Replace individual package removal with a single rpm -e loop [#286](https://github.com/openshift/ironic-agent-image/pull/286)
* [OCPBUGS-95066](https://issues.redhat.com/browse/OCPBUGS-95066): Replace dnf remove with rpm -e to prevent dependency removal [#274](https://github.com/openshift/ironic-agent-image/pull/274)
* [OCPBUGS-69780](https://issues.redhat.com/browse/OCPBUGS-69780): Bump eventlet version to 0.33.1-7 [#230](https://github.com/openshift/ironic-agent-image/pull/230)
* [OCPBUGS-68360](https://issues.redhat.com/browse/OCPBUGS-68360): Include Test advertised ip reachability before assigning it [#226](https://github.com/openshift/ironic-agent-image/pull/226)
* [OCPBUGS-62456](https://issues.redhat.com/browse/OCPBUGS-62456): netutils: Use ethtool ioctl to get permanent mac address [#206](https://github.com/openshift/ironic-agent-image/pull/206)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/b79bddef03460124923c7ce8616d83f719a49960...00262e5c67e6c7f2f2d6ef761fb28bef983bd0d7)


### [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server/tree/4e8a8ef4478a20adb21ad2a494caca9bd2561e1d)

* NO-ISSUE: synchronize OWNERS from main branch [release-4.18] [#81](https://github.com/openshift/kubernetes-metrics-server/pull/81)
* [OCPBUGS-80190](https://issues.redhat.com/browse/OCPBUGS-80190): Bump google.golang.org/grpc to v1.79.3 [#64](https://github.com/openshift/kubernetes-metrics-server/pull/64)
* [Full changelog](https://github.com/openshift/kubernetes-metrics-server/compare/962ccca2b9ad6d0c0e16576c2fac4a71112bf0bf...4e8a8ef4478a20adb21ad2a494caca9bd2561e1d)


### [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy/tree/f72b2ec69dc82611820dff33470c73cc0254415e)

* [OCPBUGS-39450](https://issues.redhat.com/browse/OCPBUGS-39450): Updating kube-rbac-proxy-container image to be consistent with ART for 4.18 [#105](https://github.com/openshift/kube-rbac-proxy/pull/105)
* [Full changelog](https://github.com/openshift/kube-rbac-proxy/compare/5a14ea9d338b2582c7c2a8f89f351a0c30f56371...f72b2ec69dc82611820dff33470c73cc0254415e)


### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/822eb88a279b48089914eac3faa3db160383adcd)

* [OCPBUGS-103452](https://issues.redhat.com/browse/OCPBUGS-103452): Use patched x/net fork v0.35.0-sec.4 [#164](https://github.com/openshift/kube-state-metrics/pull/164)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.18] [#172](https://github.com/openshift/kube-state-metrics/pull/172)
* [OCPBUGS-74873](https://issues.redhat.com/browse/OCPBUGS-74873): Deduplicate CRS stores [#131](https://github.com/openshift/kube-state-metrics/pull/131)
* [Full changelog](https://github.com/openshift/kube-state-metrics/compare/cb5a92969b18ac1cc5bded06f6d722d8ab6b8e61...822eb88a279b48089914eac3faa3db160383adcd)


### [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator/tree/815b43b7f7288da76dd314553e113aefe2a5897d)

* [OCPBUGS-78273](https://issues.redhat.com/browse/OCPBUGS-78273): fix /vendor for hermetic 4.18 [#239](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/239)
* [Full changelog](https://github.com/openshift/kubernetes-kube-storage-version-migrator/compare/c0f1886ab08d8c2ed84c9ea648b3f65cd82dc5f5...815b43b7f7288da76dd314553e113aefe2a5897d)


### [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt/tree/1d880a29214ba93d2246cbd6658f40d4c533309b)

* [OCPBUGS-39554](https://issues.redhat.com/browse/OCPBUGS-39554): Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 4.18 [#45](https://github.com/openshift/cloud-provider-kubevirt/pull/45)
* [OCPBUGS-95084](https://issues.redhat.com/browse/OCPBUGS-95084): OWNERS: Update component to Cloud Compute / KubeVirt Provider [#77](https://github.com/openshift/cloud-provider-kubevirt/pull/77)
* [Full changelog](https://github.com/openshift/cloud-provider-kubevirt/compare/3f4542ecd17fb0e47da4c6d9bceb076b98fb314b...1d880a29214ba93d2246cbd6658f40d4c533309b)


### [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver/tree/140f6dfca3393bfb69842c558cabdcd2d6082667)

* [OCPBUGS-80191](https://issues.redhat.com/browse/OCPBUGS-80191): Bump google.golang.org/grpc to v1.79.3 [#101](https://github.com/openshift/kubevirt-csi-driver/pull/101)
* [OCPBUGS-79362](https://issues.redhat.com/browse/OCPBUGS-79362): Add annotation-based fallback for infra VM node ID resolution [#86](https://github.com/openshift/kubevirt-csi-driver/pull/86)
* [Full changelog](https://github.com/openshift/kubevirt-csi-driver/compare/09f4797657654ce788ea3a1077fd7cf7ce96fb5a...140f6dfca3393bfb69842c558cabdcd2d6082667)


### [libvirt-machine-controllers](https://github.com/openshift/cluster-api-provider-libvirt/tree/875b03bd28f1104af74413c3bc72e4546a428bf4)

* [OCPBUGS-77194](https://issues.redhat.com/browse/OCPBUGS-77194): Fix incomplete vendor/ [#300](https://github.com/openshift/cluster-api-provider-libvirt/pull/300)
* [Full changelog](https://github.com/openshift/cluster-api-provider-libvirt/compare/a336f0b5f7ee99c418aaab3d511707bd0064bd56...875b03bd28f1104af74413c3bc72e4546a428bf4)


### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/bdfe53f860aea1a4f18ed97bf4b026168baff669)

* [OCPBUGS-103469](https://issues.redhat.com/browse/OCPBUGS-103469): replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 [#1545](https://github.com/openshift/machine-api-operator/pull/1545)
* [OCPBUGS-78795](https://issues.redhat.com/browse/OCPBUGS-78795): [release-4.18] : correct aws kms permissions [#1478](https://github.com/openshift/machine-api-operator/pull/1478)
* [OCPBUGS-78796](https://issues.redhat.com/browse/OCPBUGS-78796): [release-4.18] Use resource group when generating default Azure image [#1480](https://github.com/openshift/machine-api-operator/pull/1480)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/609dbab54830f51bf73f382fb64911cb0e6b30ac...bdfe53f860aea1a4f18ed97bf4b026168baff669)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/f6da18fbc1ae60c86633f5737e80ebbbaa329eae)

* [OCPBUGS-103483](https://issues.redhat.com/browse/OCPBUGS-103483): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#6507](https://github.com/openshift/machine-config-operator/pull/6507)
* [OCPBUGS-129117](https://issues.redhat.com/browse/OCPBUGS-129117): Degraded MCP as generated-kubelet is generated with an old controller version [#6624](https://github.com/openshift/machine-config-operator/pull/6624)
* [OCPBUGS-127017](https://issues.redhat.com/browse/OCPBUGS-127017): Update message for MachineOSBuildFailed condition [#6566](https://github.com/openshift/machine-config-operator/pull/6566)
* [OCPBUGS-122250](https://issues.redhat.com/browse/OCPBUGS-122250): Add missing verb in MCC RBAC [#6540](https://github.com/openshift/machine-config-operator/pull/6540)
* [OCPBUGS-105477](https://issues.redhat.com/browse/OCPBUGS-105477): Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole [#6391](https://github.com/openshift/machine-config-operator/pull/6391)
* [OCPBUGS-94116](https://issues.redhat.com/browse/OCPBUGS-94116): move cleanUpDuplicatedMC to avoid double reboot on first updated  [#6249](https://github.com/openshift/machine-config-operator/pull/6249)
* [OCPBUGS-91747](https://issues.redhat.com/browse/OCPBUGS-91747): Verify extension packages are installed [#6216](https://github.com/openshift/machine-config-operator/pull/6216)
* [OCPBUGS-98445](https://issues.redhat.com/browse/OCPBUGS-98445): Remove sensitive ControllerConfig logging [#6294](https://github.com/openshift/machine-config-operator/pull/6294)
* [OCPBUGS-97588](https://issues.redhat.com/browse/OCPBUGS-97588): Bootstrap MCS logging entire ignition [#6268](https://github.com/openshift/machine-config-operator/pull/6268)
* [OCPBUGS-86845](https://issues.redhat.com/browse/OCPBUGS-86845): Apply password only if changes exist [#6113](https://github.com/openshift/machine-config-operator/pull/6113)
* [OCPBUGS-86695](https://issues.redhat.com/browse/OCPBUGS-86695): use --delete-if-present for karg removal [#6102](https://github.com/openshift/machine-config-operator/pull/6102)
* [OCPBUGS-86844](https://issues.redhat.com/browse/OCPBUGS-86844): Fix ssh and password rollbacks [#6096](https://github.com/openshift/machine-config-operator/pull/6096)
* [OCPBUGS-86692](https://issues.redhat.com/browse/OCPBUGS-86692): Fix re-cordon detection [#6101](https://github.com/openshift/machine-config-operator/pull/6101)
* [OCPBUGS-86300](https://issues.redhat.com/browse/OCPBUGS-86300): Add terminationMessagePolicy to build pod containers [#6074](https://github.com/openshift/machine-config-operator/pull/6074)
* [OCPBUGS-86021](https://issues.redhat.com/browse/OCPBUGS-86021): Fix units rollback if update failure [#6052](https://github.com/openshift/machine-config-operator/pull/6052)
* [OCPBUGS-79483](https://issues.redhat.com/browse/OCPBUGS-79483): set default-timeout-stop to 200s globally [#5805](https://github.com/openshift/machine-config-operator/pull/5805)
* [OCPBUGS-62692](https://issues.redhat.com/browse/OCPBUGS-62692): configure-ovs: work around a Cisco switch issue [#5329](https://github.com/openshift/machine-config-operator/pull/5329)
* [OCPBUGS-78056](https://issues.redhat.com/browse/OCPBUGS-78056): Prevent unnecessary systemd unit disable [#5758](https://github.com/openshift/machine-config-operator/pull/5758)
* [OCPBUGS-74148](https://issues.redhat.com/browse/OCPBUGS-74148): enable nodeip-configuration for platform external [#5578](https://github.com/openshift/machine-config-operator/pull/5578)
* [OCPBUGS-77777](https://issues.redhat.com/browse/OCPBUGS-77777): reduce MCO image size [#5738](https://github.com/openshift/machine-config-operator/pull/5738)
* [OCPBUGS-77576](https://issues.redhat.com/browse/OCPBUGS-77576): mcd_config_drift not working properly [#5726](https://github.com/openshift/machine-config-operator/pull/5726)
* [OCPBUGS-77421](https://issues.redhat.com/browse/OCPBUGS-77421): Remove MCD liveness probe [#5710](https://github.com/openshift/machine-config-operator/pull/5710)
* [OCPBUGS-74644](https://issues.redhat.com/browse/OCPBUGS-74644): After OCL is enabled few phases in MCN are not updating as expected [#5605](https://github.com/openshift/machine-config-operator/pull/5605)
* [OCPBUGS-77092](https://issues.redhat.com/browse/OCPBUGS-77092): Machine-config controller should not log about non-existent pull-secret changes [#5680](https://github.com/openshift/machine-config-operator/pull/5680)
* [OCPBUGS-77041](https://issues.redhat.com/browse/OCPBUGS-77041): machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] [#5671](https://github.com/openshift/machine-config-operator/pull/5671)
* [OCPBUGS-76560](https://issues.redhat.com/browse/OCPBUGS-76560): [release-4.18]: cherry pick to few fixes that needed for missing services and configuration [#5653](https://github.com/openshift/machine-config-operator/pull/5653)
* [OCPBUGS-71227](https://issues.redhat.com/browse/OCPBUGS-71227): MCP is not correctly degraded when a pivotError happens [#5534](https://github.com/openshift/machine-config-operator/pull/5534)
* [OCPBUGS-70336](https://issues.redhat.com/browse/OCPBUGS-70336): Remove log exposing kubeconfig [#5528](https://github.com/openshift/machine-config-operator/pull/5528)
* [OCPBUGS-62169](https://issues.redhat.com/browse/OCPBUGS-62169): Fix - NetworkManager restart or crash renders br-ex unusable [#5356](https://github.com/openshift/machine-config-operator/pull/5356)
* [OCPBUGS-65850](https://issues.redhat.com/browse/OCPBUGS-65850): Remove --mount directives [#5433](https://github.com/openshift/machine-config-operator/pull/5433)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/bb2aa85171d93b2df952ed802a8cb200164e666f...f6da18fbc1ae60c86633f5737e80ebbbaa329eae)


### [machine-image-customization-controller](https://github.com/openshift/image-customization-controller/tree/f973472f152090aae86e189271fdff66926b75c3)

* [OCPBUGS-103463](https://issues.redhat.com/browse/OCPBUGS-103463): Replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 [#193](https://github.com/openshift/image-customization-controller/pull/193)
* [OCPBUGS-82149](https://issues.redhat.com/browse/OCPBUGS-82149): Return error when network data Secret lacks nmstate key [#174](https://github.com/openshift/image-customization-controller/pull/174)
* [OCPBUGS-77888](https://issues.redhat.com/browse/OCPBUGS-77888): Clean up dnf cache to reduce container image size [#168](https://github.com/openshift/image-customization-controller/pull/168)
* [OCPBUGS-68262](https://issues.redhat.com/browse/OCPBUGS-68262): [4.18] Uplift logrus [#151](https://github.com/openshift/image-customization-controller/pull/151)
* [Full changelog](https://github.com/openshift/image-customization-controller/compare/d9a71247dafd469182d4bd13ef227c9be82a1e32...f973472f152090aae86e189271fdff66926b75c3)


### [machine-os-images](https://github.com/openshift/machine-os-images/tree/b2321b2c9fac3424087f71a1e2cf7b5ce4ccd772)

* [OCPBUGS-87876](https://issues.redhat.com/browse/OCPBUGS-87876): Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs [#100](https://github.com/openshift/machine-os-images/pull/100)
* [Full changelog](https://github.com/openshift/machine-os-images/compare/ab43283689560737ad32566dd59e0d3d77fee4e1...b2321b2c9fac3424087f71a1e2cf7b5ce4ccd772)


### [metallb-frr](https://github.com/openshift/frr/tree/760c6639a0c4825745d69b389b50689ebc2b8052)

* [OCPBUGS-74485](https://issues.redhat.com/browse/OCPBUGS-74485): Dockerfile: unpin FRR rpm [#121](https://github.com/openshift/frr/pull/121)
* [Full changelog](https://github.com/openshift/frr/compare/98ccbe64c9b76aabb6a7bb2ff8cf61cc8e6d9f91...760c6639a0c4825745d69b389b50689ebc2b8052)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/2a04ad9d00250b82f93f6c360a8f1487a4c02b17)

* [OU-1589](https://issues.redhat.com/browse/OU-1589): [release-4.18] sanitize linkified URLs in alert annotations [#1378](https://github.com/openshift/monitoring-plugin/pull/1378)
* NO-JIRA: [release-4.18] fix: reduce flakiness by assert charts existence and scroll into view before clicking [#1365](https://github.com/openshift/monitoring-plugin/pull/1365)
* [OU-1241](https://issues.redhat.com/browse/OU-1241): [release-4.18] feat: unset query timeouts so they are defined in the backend [#1359](https://github.com/openshift/monitoring-plugin/pull/1359)
* [OCPBUGS-103481](https://issues.redhat.com/browse/OCPBUGS-103481): CVE-2026-33814-4-18 openshift4/ose-monitoring-plugin-rhel9: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.18] [#1217](https://github.com/openshift/monitoring-plugin/pull/1217)
* NO-JIRA: [release-4.18] Sanitize alert runbook URLs [#1297](https://github.com/openshift/monitoring-plugin/pull/1297)
* [OCPBUGS-98772](https://issues.redhat.com/browse/OCPBUGS-98772): [release-4.18] replace outdated react-linkify dependency [#1179](https://github.com/openshift/monitoring-plugin/pull/1179)
* [OCPBUGS-74461](https://issues.redhat.com/browse/OCPBUGS-74461): CVE-2025-13465 openshift4/ose-monitoring-plugin-rhel9: prototype pollution in _.unset and _.omit functions [openshift-4.18] [#1141](https://github.com/openshift/monitoring-plugin/pull/1141)
* [OCPBUGS-79448](https://issues.redhat.com/browse/OCPBUGS-79448): immutable bump: fix for CVE-2026-29063 [#922](https://github.com/openshift/monitoring-plugin/pull/922)
* [OU-1241](https://issues.redhat.com/browse/OU-1241): unset frontend timeout to use the backend configuration [#905](https://github.com/openshift/monitoring-plugin/pull/905)
* [OCPBUGS-83374](https://issues.redhat.com/browse/OCPBUGS-83374): fix: re encode params when redirecting from graph to query-browser [#878](https://github.com/openshift/monitoring-plugin/pull/878)
* NO-JIRA: fix: pin http-errors to 2.0.1 for hermetic builds [#870](https://github.com/openshift/monitoring-plugin/pull/870)
* [OU-993](https://issues.redhat.com/browse/OU-993): adding cypress Dockerfiles [#861](https://github.com/openshift/monitoring-plugin/pull/861)
* [OU-876](https://issues.redhat.com/browse/OU-876): monitoring automated testing backported and adjusted to pf-5 and diff UI [#777](https://github.com/openshift/monitoring-plugin/pull/777)
* NO-JIRA: simplify dockerfile by removing cachito dependencies [release-4.18] [#818](https://github.com/openshift/monitoring-plugin/pull/818)
* [OCPBUGS-70291](https://issues.redhat.com/browse/OCPBUGS-70291): fix: update qs vulnerable dependency [#739](https://github.com/openshift/monitoring-plugin/pull/739)
* [OCPBUGS-65958](https://issues.redhat.com/browse/OCPBUGS-65958): Fix metrics gaps 4.18 [#656](https://github.com/openshift/monitoring-plugin/pull/656)
* [OCPBUGS-64735](https://issues.redhat.com/browse/OCPBUGS-64735): allow tenancy access to metrics tag [#638](https://github.com/openshift/monitoring-plugin/pull/638)
* [OU-1059](https://issues.redhat.com/browse/OU-1059): add perspective to action injector [#632](https://github.com/openshift/monitoring-plugin/pull/632)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/fafea6bc427827c137eb312d9a8d31ad2893114e...2a04ad9d00250b82f93f6c360a8f1487a4c02b17)


### [multus-cni, multus-cni-microshift](https://github.com/openshift/multus-cni/tree/c5fd5666c4b85bd4b7bcf0a34feedebc05b14827)

* [OCPBUGS-85249](https://issues.redhat.com/browse/OCPBUGS-85249): Fix server url in kubeconfig [#298](https://github.com/openshift/multus-cni/pull/298)
* NO-ISSUE: [release-4.18] Bump Go to 1.22 and fix CI build root image [#291](https://github.com/openshift/multus-cni/pull/291)
* [OCPBUGS-77853](https://issues.redhat.com/browse/OCPBUGS-77853): hermetic 4.18 [#276](https://github.com/openshift/multus-cni/pull/276)
* [Full changelog](https://github.com/openshift/multus-cni/compare/21fb8e05e5de697bbb4ec3c7ca685b0518aca82d...c5fd5666c4b85bd4b7bcf0a34feedebc05b14827)


### [must-gather](https://github.com/openshift/must-gather/tree/bfba924cb4cbb19f4c72d27b7ea5990df60cbc30)

* [OCPBUGS-86019](https://issues.redhat.com/browse/OCPBUGS-86019): Collect object size with the object count [#547](https://github.com/openshift/must-gather/pull/547)
* [Full changelog](https://github.com/openshift/must-gather/compare/02e536cc7b3a6632da0643ab78f8dd6570e7f122...bfba924cb4cbb19f4c72d27b7ea5990df60cbc30)


### [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon/tree/0c680e85c5e9361228dfb52e6828fb657d83cf99)

* [OCPBUGS-103472](https://issues.redhat.com/browse/OCPBUGS-103472): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 [#153](https://github.com/openshift/network-metrics-daemon/pull/153)
* [OCPBUGS-130596](https://issues.redhat.com/browse/OCPBUGS-130596): fix golint not found on Go 1.22 CI builder [#156](https://github.com/openshift/network-metrics-daemon/pull/156)
* [Full changelog](https://github.com/openshift/network-metrics-daemon/compare/11e2dec958aa2adcad07b9eecaf8f50479e0880a...0c680e85c5e9361228dfb52e6828fb657d83cf99)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/809625867725729005dc4f41ae2361395a05f543)

* [OCPBUGS-98784](https://issues.redhat.com/browse/OCPBUGS-98784): Updating linkify-it to 5.0.2 to fix CVE-2026-48801 [#460](https://github.com/openshift/networking-console-plugin/pull/460)
* [OCPBUGS-99991](https://issues.redhat.com/browse/OCPBUGS-99991): Updating networking-console-plugin-container image to be consistent with ART for 4.18 [#454](https://github.com/openshift/networking-console-plugin/pull/454)
* [OCPBUGS-41880](https://issues.redhat.com/browse/OCPBUGS-41880): Fix namespace retention between NetworkPolicies tabs when MultiNetworkPolicies are disabled [#433](https://github.com/openshift/networking-console-plugin/pull/433)
* [OCPBUGS-41880](https://issues.redhat.com/browse/OCPBUGS-41880): Retain namespace selection between network policies tabs [#424](https://github.com/openshift/networking-console-plugin/pull/424)
* [OCPBUGS-87000](https://issues.redhat.com/browse/OCPBUGS-87000): Update Dockerfile.art to 4.22 build image [#426](https://github.com/openshift/networking-console-plugin/pull/426)
* [OCPBUGS-83382](https://issues.redhat.com/browse/OCPBUGS-83382): Fix CVE 2026 34043 serialize javascript 4.18 [#413](https://github.com/openshift/networking-console-plugin/pull/413)
* [release-4:18] OCPBUGS-85067: Migration from yarn to npm [#412](https://github.com/openshift/networking-console-plugin/pull/412)
* [OCPBUGS-81606](https://issues.redhat.com/browse/OCPBUGS-81606): Fix CVE-2026-CVE-2026-4800 in lodash [#401](https://github.com/openshift/networking-console-plugin/pull/401)
* [OCPBUGS-79449](https://issues.redhat.com/browse/OCPBUGS-79449): Bump immutable [#390](https://github.com/openshift/networking-console-plugin/pull/390)
* [CNV-76277](https://issues.redhat.com/browse/CNV-76277): Fix name generator with unprofessional names [#319](https://github.com/openshift/networking-console-plugin/pull/319)
* [OCPBUGS-63582](https://issues.redhat.com/browse/OCPBUGS-63582): Fixed - Extra semicolon observed before Service IP in OCP Console [#306](https://github.com/openshift/networking-console-plugin/pull/306)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/15535681de838e97e0a137fb0cc7123746019b08...809625867725729005dc4f41ae2361395a05f543)


### [oauth-apiserver](https://github.com/openshift/oauth-apiserver/tree/1078b191784c375d31008aef9ee2b8484ca5fe7f)

* NO-JIRA: (chore): update OWNERS file [#170](https://github.com/openshift/oauth-apiserver/pull/170)
* [OCPBUGS-65841](https://issues.redhat.com/browse/OCPBUGS-65841): UPSTREAM: &lt;carry&gt;: bump kubernetes-apiserver to pick up loopback certificate expiration update [#155](https://github.com/openshift/oauth-apiserver/pull/155)
* [Full changelog](https://github.com/openshift/oauth-apiserver/compare/e54edaa6a6b3dd09831d24654835b54c1bdd089f...1078b191784c375d31008aef9ee2b8484ca5fe7f)


### [oauth-proxy](https://github.com/openshift/oauth-proxy/tree/6f4260c0afab7a8e2f7e911cb32debaa24824957)

* [OCPBUGS-112094](https://issues.redhat.com/browse/OCPBUGS-112094): bugfix: rewrite open redirect strings to '/' [#384](https://github.com/openshift/oauth-proxy/pull/384)
* [Full changelog](https://github.com/openshift/oauth-proxy/compare/9225edb9821cab67ffa628b05e0eed67973436f0...6f4260c0afab7a8e2f7e911cb32debaa24824957)


### [oauth-server](https://github.com/openshift/oauth-server/tree/5357b4d1d1477d90ea733a39749cc9b2abf5ed77)

* [OCPBUGS-87072](https://issues.redhat.com/browse/OCPBUGS-87072): bugfix: default to english when Accept-Language header contains more than 1000 underscores [#272](https://github.com/openshift/oauth-server/pull/272)
* [OCPBUGS-81803](https://issues.redhat.com/browse/OCPBUGS-81803): Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 [#238](https://github.com/openshift/oauth-server/pull/238)
* [Full changelog](https://github.com/openshift/oauth-server/compare/287caff3aef5b5f8535ac2bf1242671a5c7701b7...5357b4d1d1477d90ea733a39749cc9b2abf5ed77)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/a75bd023e2cdcd61b3ad0b09ac1bf250bb4665a1)

* [OCPBUGS-129488](https://issues.redhat.com/browse/OCPBUGS-129488): v1 accept catalog root entries and relative symlink targets [#1578](https://github.com/openshift/oc-mirror/pull/1578)
* [OCPBUGS-66051](https://issues.redhat.com/browse/OCPBUGS-66051): Remove empty status field from generated IDMS/ITMS files (manual 4.18 backport) [#1324](https://github.com/openshift/oc-mirror/pull/1324)
* [OCPBUGS-65510](https://issues.redhat.com/browse/OCPBUGS-65510): removes unintended exec permissions [#1312](https://github.com/openshift/oc-mirror/pull/1312)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/0c70491887c3c68191844a8ec80f2bde7b255723...a75bd023e2cdcd61b3ad0b09ac1bf250bb4665a1)


### [olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller/tree/ec807165b1a8c6c4eff30388ee81ff02ed19a8ef)

* [OCPBUGS-103488](https://issues.redhat.com/browse/OCPBUGS-103488): [release-4.18]  Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#804](https://github.com/openshift/operator-framework-operator-controller/pull/804)
* [OCPBUGS-100434](https://issues.redhat.com/browse/OCPBUGS-100434): increase catalog HTTP client timeout from 10s to 5m [#787](https://github.com/openshift/operator-framework-operator-controller/pull/787)
* [OCPBUGS-87830](https://issues.redhat.com/browse/OCPBUGS-87830): [release-4.18] operator-controller: clean up orphaned temp dirs in catalog cache [#751](https://github.com/openshift/operator-framework-operator-controller/pull/751)
* [OCPBUGS-80304](https://issues.redhat.com/browse/OCPBUGS-80304): Update grpc-go to v1.71.3-sec.1 to fix CVE-2026-33186 [#735](https://github.com/openshift/operator-framework-operator-controller/pull/735)
* [Full changelog](https://github.com/openshift/operator-framework-operator-controller/compare/48a1e9247ab72edf8d61fa2376df5e6d9e16e53e...ec807165b1a8c6c4eff30388ee81ff02ed19a8ef)


### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/0185e4bf19acafdc9b56984458a1ec5867b11470)

* [OCPBUGS-82769](https://issues.redhat.com/browse/OCPBUGS-82769): Address CVE-2026-35469 [#657](https://github.com/openshift/openshift-apiserver/pull/657)
* [OCPBUGS-74234](https://issues.redhat.com/browse/OCPBUGS-74234): Bump library-go for route path validation fix [#603](https://github.com/openshift/openshift-apiserver/pull/603)
* [OCPBUGS-69955](https://issues.redhat.com/browse/OCPBUGS-69955): Add ValidatingAdmissionPolicy and check for omissions next time. [#589](https://github.com/openshift/openshift-apiserver/pull/589)
* [OCPBUGS-66379](https://issues.redhat.com/browse/OCPBUGS-66379): pkg/image: conditionally parse raw image manifest [#585](https://github.com/openshift/openshift-apiserver/pull/585)
* [OCPBUGS-65842](https://issues.redhat.com/browse/OCPBUGS-65842): UPSTREAM &lt;carry&gt;: bump kubernetes-apiserver to pick up loopback certificate expiration update [#581](https://github.com/openshift/openshift-apiserver/pull/581)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/5d7a65bad932a0434928571b74db27588bb9be2d...0185e4bf19acafdc9b56984458a1ec5867b11470)


### [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics/tree/24f256fe2b9814bfb47d7c5f9934ecfb51707990)

* NO-ISSUE: synchronize OWNERS from main branch [#153](https://github.com/openshift/openshift-state-metrics/pull/153)
* [Full changelog](https://github.com/openshift/openshift-state-metrics/compare/3cca6feee0d646331bdbc9d49732fbdf49448d41...24f256fe2b9814bfb47d7c5f9934ecfb51707990)


### [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack/tree/d5e6ff9f4baf4f306374f894d7b5e3e36ef52520)

* [OCPBUGS-64816](https://issues.redhat.com/browse/OCPBUGS-64816): Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.11 into release-4.18 [#371](https://github.com/openshift/cluster-api-provider-openstack/pull/371)
* [Full changelog](https://github.com/openshift/cluster-api-provider-openstack/compare/ce2c2d17d9c489d776f0383869d453dff89b0462...d5e6ff9f4baf4f306374f894d7b5e3e36ef52520)


### [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack/tree/b8e611fcdd9db2e20e99ac860633078ad0f9313b)

* [OCPBUGS-93867](https://issues.redhat.com/browse/OCPBUGS-93867): Revendor CAPO [#174](https://github.com/openshift/machine-api-provider-openstack/pull/174)
* [OCPBUGS-69648](https://issues.redhat.com/browse/OCPBUGS-69648): Don't record event for every reconcile [#143](https://github.com/openshift/machine-api-provider-openstack/pull/143)
* [OCPBUGS-76792](https://issues.redhat.com/browse/OCPBUGS-76792): Fix make test [#159](https://github.com/openshift/machine-api-provider-openstack/pull/159)
* [OCPBUGS-74986](https://issues.redhat.com/browse/OCPBUGS-74986): Revendor CAPO [#152](https://github.com/openshift/machine-api-provider-openstack/pull/152)
* [Full changelog](https://github.com/openshift/machine-api-provider-openstack/compare/d914e77ee67211024153b1535e8709c3cf190512...b8e611fcdd9db2e20e99ac860633078ad0f9313b)


### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/b3573251315be79aa5bbe6a1cb0b5606b5371835)

* [OCPBUGS-103497](https://issues.redhat.com/browse/OCPBUGS-103497), [OCPBUGS-103502](https://issues.redhat.com/browse/OCPBUGS-103502), [OCPBUGS-103503](https://issues.redhat.com/browse/OCPBUGS-103503): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 [#1366](https://github.com/openshift/operator-framework-olm/pull/1366)
* [OCPBUGS-80311](https://issues.redhat.com/browse/OCPBUGS-80311), [OCPBUGS-80312](https://issues.redhat.com/browse/OCPBUGS-80312), [OCPBUGS-80313](https://issues.redhat.com/browse/OCPBUGS-80313): Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.71.3-sec.1 [release-4.18] [#1314](https://github.com/openshift/operator-framework-olm/pull/1314)
* [OCPBUGS-81473](https://issues.redhat.com/browse/OCPBUGS-81473): Fix nil pointer dereference in sortUnpackJobs when sorting non-failed jobs [#1273](https://github.com/openshift/operator-framework-olm/pull/1273)
* [OCPBUGS-77714](https://issues.redhat.com/browse/OCPBUGS-77714): Remove the collect-profiles info from the microshift kustomization file [#1245](https://github.com/openshift/operator-framework-olm/pull/1245)
* [OCPBUGS-76924](https://issues.redhat.com/browse/OCPBUGS-76924): Remove the collect-profiles job [#1231](https://github.com/openshift/operator-framework-olm/pull/1231)
* [OCPBUGS-65700](https://issues.redhat.com/browse/OCPBUGS-65700): Fix TOCTOU race condition in ensureInstallPlan (#3682) [#1156](https://github.com/openshift/operator-framework-olm/pull/1156)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/f295d320d98493b70a105fa22ca79fab546a2e52...b3573251315be79aa5bbe6a1cb0b5606b5371835)


### [operator-marketplace](https://github.com/operator-framework/operator-marketplace/tree/34521c26450e93eea0379e52f86b02c69fbacb49)

* [OCPBUGS-73883](https://issues.redhat.com/browse/OCPBUGS-73883): Increase default catalog polling interval to 4h (240m) [#707](https://github.com/operator-framework/operator-marketplace/pull/707)
* [OCPBUGS-68272](https://issues.redhat.com/browse/OCPBUGS-68272), [OCPBUGS-68273](https://issues.redhat.com/browse/OCPBUGS-68273): CVE-2025-65637 fixed in logrus v1.9.3+ [#703](https://github.com/operator-framework/operator-marketplace/pull/703)
* [Full changelog](https://github.com/operator-framework/operator-marketplace/compare/ea9bc1139efb443b244170d08759b6816cdae4d9...34521c26450e93eea0379e52f86b02c69fbacb49)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/97019aa52cc0641ab084f17c7fec3c51c37a0ce3)

* [OCPBUGS-129152](https://issues.redhat.com/browse/OCPBUGS-129152): Branch Sync release-4.20 to release-4.18 [10-05-2026] [#3511](https://github.com/openshift/ovn-kubernetes/pull/3511)
* [OCPBUGS-112810](https://issues.redhat.com/browse/OCPBUGS-112810), [OCPBUGS-113507](https://issues.redhat.com/browse/OCPBUGS-113507): Branch Sync release-4.19 to release-4.18 [08-21-2026] [#3410](https://github.com/openshift/ovn-kubernetes/pull/3410)
* [OCPBUGS-105851](https://issues.redhat.com/browse/OCPBUGS-105851): Branch Sync release-4.19 to release-4.18 [08-11-2026] [#3386](https://github.com/openshift/ovn-kubernetes/pull/3386)
* [OCPBUGS-82773](https://issues.redhat.com/browse/OCPBUGS-82773): Bump github.com/moby/spdystream to v0.5.1 [#3321](https://github.com/openshift/ovn-kubernetes/pull/3321)
* [OCPBUGS-98957](https://issues.redhat.com/browse/OCPBUGS-98957): Branch Sync release-4.19 to release-4.18 [07-09-2026] [#3290](https://github.com/openshift/ovn-kubernetes/pull/3290)
* [OCPBUGS-86230](https://issues.redhat.com/browse/OCPBUGS-86230): Branch Sync release-4.19 to release-4.18 [05-19-2026] [#3197](https://github.com/openshift/ovn-kubernetes/pull/3197)
* [OCPBUGS-74399](https://issues.redhat.com/browse/OCPBUGS-74399), [OCPBUGS-85434](https://issues.redhat.com/browse/OCPBUGS-85434): Branch Sync release-4.19 to release-4.18 [05-12-2026] [#3184](https://github.com/openshift/ovn-kubernetes/pull/3184)
* [OCPBUGS-77151](https://issues.redhat.com/browse/OCPBUGS-77151), [OCPBUGS-83567](https://issues.redhat.com/browse/OCPBUGS-83567): Branch Sync release-4.19 to release-4.18 [04-16-2026] [#3143](https://github.com/openshift/ovn-kubernetes/pull/3143)
* [OCPBUGS-82148](https://issues.redhat.com/browse/OCPBUGS-82148): Branch Sync release-4.19 to release-4.18 [04-05-2026] [#3117](https://github.com/openshift/ovn-kubernetes/pull/3117)
* [OCPBUGS-81479](https://issues.redhat.com/browse/OCPBUGS-81479): node: fix serviceUpdateNotNeeded nil pointer comparison [#3101](https://github.com/openshift/ovn-kubernetes/pull/3101)
* [OCPBUGS-78015](https://issues.redhat.com/browse/OCPBUGS-78015): Add pperiyasamy to OWNERS for release-4.18 [#3045](https://github.com/openshift/ovn-kubernetes/pull/3045)
* [OCPBUGS-77516](https://issues.redhat.com/browse/OCPBUGS-77516): Clear stale conntrack UDP entries for nodePorts [#3016](https://github.com/openshift/ovn-kubernetes/pull/3016)
* [OCPBUGS-77083](https://issues.redhat.com/browse/OCPBUGS-77083), [OCPBUGS-77106](https://issues.redhat.com/browse/OCPBUGS-77106): [release-4.18] combined backport PR for 2 escalations [#2987](https://github.com/openshift/ovn-kubernetes/pull/2987)
* [OCPBUGS-48710](https://issues.redhat.com/browse/OCPBUGS-48710): Branch Sync release-4.19 to release-4.18 [02-04-2026] [#2970](https://github.com/openshift/ovn-kubernetes/pull/2970)
* [OCPBUGS-74270](https://issues.redhat.com/browse/OCPBUGS-74270): release-4.18 fix(localnet, ipamless): Prevent LSP deletion on sync [#2943](https://github.com/openshift/ovn-kubernetes/pull/2943)
* [OCPBUGS-70346](https://issues.redhat.com/browse/OCPBUGS-70346): Branch Sync release-4.19 to release-4.18 [01-07-2026] [#2922](https://github.com/openshift/ovn-kubernetes/pull/2922)
* [OCPBUGS-66140](https://issues.redhat.com/browse/OCPBUGS-66140): Branch Sync release-4.19 to release-4.18 [12-31-2025] [#2916](https://github.com/openshift/ovn-kubernetes/pull/2916)
* [CORENET-6055](https://issues.redhat.com/browse/CORENET-6055), [OCPBUGS-48710](https://issues.redhat.com/browse/OCPBUGS-48710), [OCPBUGS-66360](https://issues.redhat.com/browse/OCPBUGS-66360), [OCPBUGS-66381](https://issues.redhat.com/browse/OCPBUGS-66381), [OCPBUGS-66428](https://issues.redhat.com/browse/OCPBUGS-66428): Branch Sync release-4.19 to release-4.18 [12-03-2025] [#2895](https://github.com/openshift/ovn-kubernetes/pull/2895)
* [OCPBUGS-68347](https://issues.redhat.com/browse/OCPBUGS-68347): Add ricky-rav to OWNERS for release-4.18 [#2897](https://github.com/openshift/ovn-kubernetes/pull/2897)
* [OCPBUGS-64855](https://issues.redhat.com/browse/OCPBUGS-64855): Fix stale EIP assignments during failover and controller restart [#2849](https://github.com/openshift/ovn-kubernetes/pull/2849)
* [OCPBUGS-64780](https://issues.redhat.com/browse/OCPBUGS-64780): kubevirt: fix bad release of IPs of live migratable pods [#2847](https://github.com/openshift/ovn-kubernetes/pull/2847)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/2fe096327a6da6602c509d108ea0ed4a599a7eb3...97019aa52cc0641ab084f17c7fec3c51c37a0ce3)


### [powervs-block-csi-driver](https://github.com/openshift/ibm-powervs-block-csi-driver/tree/e8700dfa4d7b191acd1c12a0ed1d54f1c9ac5b3a)

* [OCPBUGS-80317](https://issues.redhat.com/browse/OCPBUGS-80317): Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 [#130](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/130)
* [OCPBUGS-82774](https://issues.redhat.com/browse/OCPBUGS-82774): Fix CVE-2026-35469 by bumping github.com/moby/spdystream to v0.5.1 [#124](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/124)
* [OCPBUGS-51896](https://issues.redhat.com/browse/OCPBUGS-51896): Mitigate CVE-2025-22868 by updating golang.org/x/oauth2 [#102](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/102)
* [OCPBUGS-70002](https://issues.redhat.com/browse/OCPBUGS-70002): Update builder image's golang version to 1.23 [#103](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/103)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver/compare/d36aea34452210f988f74e93e0640318f3db1938...e8700dfa4d7b191acd1c12a0ed1d54f1c9ac5b3a)


### [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/tree/9c9131b7deb794eb8b220c70d4ca6ac245623761)

* [OCPBUGS-80318](https://issues.redhat.com/browse/OCPBUGS-80318): Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 [#111](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/111)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/compare/01fc505abcf3b83bba284a00258b6761a9b7ce8a...9c9131b7deb794eb8b220c70d4ca6ac245623761)


### [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs/tree/601c30ffc7d3f7303a654aa4bbd4242c8b5ac8ad)

* [OCPBUGS-80319](https://issues.redhat.com/browse/OCPBUGS-80319): Replace google.golang.org/grpc with openshift-sustaining fork v1.71.3-sec.1 to v1.79.3 to fix CVE-2026-33186 [#99](https://github.com/openshift/cloud-provider-powervs/pull/99)
* [Full changelog](https://github.com/openshift/cloud-provider-powervs/compare/17ae6fba6eda58aa0d91f162206386105dff9962...601c30ffc7d3f7303a654aa4bbd4242c8b5ac8ad)


### [prom-label-proxy](https://github.com/openshift/prom-label-proxy/tree/0a8af65bb5313067643abe13c0cd3e40a5f078f9)

* NO-ISSUE: synchronize OWNERS from main branch [release-4.18] [#409](https://github.com/openshift/prom-label-proxy/pull/409)
* [Full changelog](https://github.com/openshift/prom-label-proxy/compare/35c1136915f7a6896dfcb479e1f686fd18542856...0a8af65bb5313067643abe13c0cd3e40a5f078f9)


### [prometheus](https://github.com/openshift/prometheus/tree/b22830578f2ea08d5d3fddf846ec9090415ffed1)

* NO-ISSUE: synchronize OWNERS from main branch [#386](https://github.com/openshift/prometheus/pull/386)
* [OCPBUGS-93696](https://issues.redhat.com/browse/OCPBUGS-93696): fix for CVE-2026-42151 [#368](https://github.com/openshift/prometheus/pull/368)
* [OCPBUGS-88628](https://issues.redhat.com/browse/OCPBUGS-88628): remote: validate snappy decoded length before allocation in read endpoint [#346](https://github.com/openshift/prometheus/pull/346)
* [OCPBUGS-80320](https://issues.redhat.com/browse/OCPBUGS-80320): Bump google.golang.org/grpc to v1.79.3 [#308](https://github.com/openshift/prometheus/pull/308)
* [Full changelog](https://github.com/openshift/prometheus/compare/a85013a6c5176d8a569d1908532c9c31aa399306...b22830578f2ea08d5d3fddf846ec9090415ffed1)


### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/bf14b2e6ee92f5ef23ffe7e7d152664b1824518b)

* NO-JIRA: synchronize OWNERS with main [#189](https://github.com/openshift/prometheus-alertmanager/pull/189)
* [OCPBUGS-103512](https://issues.redhat.com/browse/OCPBUGS-103512): Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 [#172](https://github.com/openshift/prometheus-alertmanager/pull/172)
* [OCPBUGS-98183](https://issues.redhat.com/browse/OCPBUGS-98183): build(deps): hashicorp/memberlist to a forked version [#165](https://github.com/openshift/prometheus-alertmanager/pull/165)
* [OCPBUGS-100355](https://issues.redhat.com/browse/OCPBUGS-100355): Set testdata CA expiry to 20 years from issue date (#4112) [#148](https://github.com/openshift/prometheus-alertmanager/pull/148)
* [OCPBUGS-74976](https://issues.redhat.com/browse/OCPBUGS-74976): Include go-verify-deps expected files in gitignore [#114](https://github.com/openshift/prometheus-alertmanager/pull/114)
* [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/a432067579aaa60326a104f4ce2eba18e1ab444c...bf14b2e6ee92f5ef23ffe7e7d152664b1824518b)


### [prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator/tree/f61f2c8a94852307cdc3a7c3a98604b0d628b40f)

* NO-ISSUE: synchronize OWNERS from main branch [#412](https://github.com/openshift/prometheus-operator/pull/412)
* [OCPBUGS-103510](https://issues.redhat.com/browse/OCPBUGS-103510), [OCPBUGS-103513](https://issues.redhat.com/browse/OCPBUGS-103513): [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#397](https://github.com/openshift/prometheus-operator/pull/397)
* [OCPBUGS-77298](https://issues.redhat.com/browse/OCPBUGS-77298): backport upstream fix to reconcile resources with inconsistent status [#370](https://github.com/openshift/prometheus-operator/pull/370)
* [OCPBUGS-77398](https://issues.redhat.com/browse/OCPBUGS-77398): Validate `webhookURL` secret for `MSTeams` receiver in `AlertmanagerConfig` CRD [#366](https://github.com/openshift/prometheus-operator/pull/366)
* [OCPBUGS-61965](https://issues.redhat.com/browse/OCPBUGS-61965): reconcile workload configurations when a referenced secret/configmap key is updated [#347](https://github.com/openshift/prometheus-operator/pull/347)
* [Full changelog](https://github.com/openshift/prometheus-operator/compare/18c2332d37d2c98d1b9bacd92eb574ecab130b6d...f61f2c8a94852307cdc3a7c3a98604b0d628b40f)


### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/a990ab3849532fe8ed1523fb4b3ac2d636e460f6)

* [OCPBUGS-103506](https://issues.redhat.com/browse/OCPBUGS-103506): Use patched x/net fork v0.35.0-sec.4 [#196](https://github.com/openshift/node_exporter/pull/196)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.18] [#202](https://github.com/openshift/node_exporter/pull/202)
* [Full changelog](https://github.com/openshift/node_exporter/compare/92e17ff5c45807198adc8b59f5b3f63a9b7f1726...a990ab3849532fe8ed1523fb4b3ac2d636e460f6)


### [route-controller-manager](https://github.com/openshift/route-controller-manager/tree/4c126441740eac46b0153b280f13d9ed54195249)

* [OCPBUGS-103349](https://issues.redhat.com/browse/OCPBUGS-103349): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#110](https://github.com/openshift/route-controller-manager/pull/110)
* [OCPBUGS-80199](https://issues.redhat.com/browse/OCPBUGS-80199): Bump google.golang.org/grpc to v1.79.3 [#85](https://github.com/openshift/route-controller-manager/pull/85)
* [Full changelog](https://github.com/openshift/route-controller-manager/compare/ce6ffa24dac3a5f49f70818e1159e40eaf27a6a3...4c126441740eac46b0153b280f13d9ed54195249)


### [telemeter](https://github.com/openshift/telemeter/tree/999cdb5f7cde3beb8dcf45fe13ba34d0fb5837c4)

* [OCPBUGS-80333](https://issues.redhat.com/browse/OCPBUGS-80333): Bump google.golang.org/grpc to v1.79.3 [#599](https://github.com/openshift/telemeter/pull/599)
* [OCPBUGS-81804](https://issues.redhat.com/browse/OCPBUGS-81804): [release-4.18] Fix CVE-2026-34986 [#596](https://github.com/openshift/telemeter/pull/596)
* [Full changelog](https://github.com/openshift/telemeter/compare/490612bdaa6412762403c8eee902c20f033ca5aa...999cdb5f7cde3beb8dcf45fe13ba34d0fb5837c4)


### [tests](https://github.com/openshift/origin/tree/ccfc4e70bbdb64e2a747f8c86427595c6e6bc09b)

* [OCPBUGS-130856](https://issues.redhat.com/browse/OCPBUGS-130856): stage the creation of test pods to minimize etcd impact [#31740](https://github.com/openshift/origin/pull/31740)
* [OCPBUGS-77876](https://issues.redhat.com/browse/OCPBUGS-77876): Backport: Remove duplicated graceful termination test from release-4.18 [#30702](https://github.com/openshift/origin/pull/30702)
* [OCPBUGS-74207](https://issues.redhat.com/browse/OCPBUGS-74207): Unrevert TLS tests with fixes [#30708](https://github.com/openshift/origin/pull/30708)
* [OCPBUGS-69900](https://issues.redhat.com/browse/OCPBUGS-69900): Updated the upgrade duration limit to 100 minutes for ppc64le [#30628](https://github.com/openshift/origin/pull/30628)
* [OCPBUGS-63668](https://issues.redhat.com/browse/OCPBUGS-63668): Add imagestream update dryrun test [#30436](https://github.com/openshift/origin/pull/30436)
* [Full changelog](https://github.com/openshift/origin/compare/408d767f503d45acdaf996fc854ffc94d1c614df...ccfc4e70bbdb64e2a747f8c86427595c6e6bc09b)


### [thanos](https://github.com/openshift/thanos/tree/265d24eb9566214073f08694c2ed8131d35cb53a)

* [OCPBUGS-80335](https://issues.redhat.com/browse/OCPBUGS-80335): Bump google.golang.org/grpc to v1.79.3 [#184](https://github.com/openshift/thanos/pull/184)
* [Full changelog](https://github.com/openshift/thanos/compare/f1599f65c5fd652150821ae954d563747a649b53...265d24eb9566214073f08694c2ed8131d35cb53a)


### [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere/tree/b4dbf34a16f6f1f269b7e3ab9409c7e888b822ab)

* [OCPBUGS-77668](https://issues.redhat.com/browse/OCPBUGS-77668): hermetic migration 4.18 [#105](https://github.com/openshift/cloud-provider-vsphere/pull/105)
* [Full changelog](https://github.com/openshift/cloud-provider-vsphere/compare/c414d1f5b0d910300cafda742aca146d41fce98a...b4dbf34a16f6f1f269b7e3ab9409c7e888b822ab)


### [vsphere-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-vsphere/tree/afae9545a3b5c205968da051a2ea28126ecba913)

* [OCPBUGS-80340](https://issues.redhat.com/browse/OCPBUGS-80340): Bump google.golang.org/grpc to v1.79.3 [#104](https://github.com/openshift/cluster-api-provider-vsphere/pull/104)
* [OCPBUGS-78018](https://issues.redhat.com/browse/OCPBUGS-78018): hermetic migration 4.18 [#84](https://github.com/openshift/cluster-api-provider-vsphere/pull/84)
* [Full changelog](https://github.com/openshift/cluster-api-provider-vsphere/compare/767b33a7c0145136bfe3655de0ed02e888b4a270...afae9545a3b5c205968da051a2ea28126ecba913)


### [vsphere-csi-driver, vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver/tree/21d598fe3af8c29c2ed5976c472c5df0f5ba3052)

* [OCPBUGS-92888](https://issues.redhat.com/browse/OCPBUGS-92888): Bump golang.org/x/crypto/ssh to v0.33.0-sec.3 [#193](https://github.com/openshift/vmware-vsphere-csi-driver/pull/193)
* [OCPBUGS-80343](https://issues.redhat.com/browse/OCPBUGS-80343): Bump google.golang.org/grpc to v1.79.3 [#176](https://github.com/openshift/vmware-vsphere-csi-driver/pull/176)
* [OCPBUGS-68278](https://issues.redhat.com/browse/OCPBUGS-68278): CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.9.3 [#156](https://github.com/openshift/vmware-vsphere-csi-driver/pull/156)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver/compare/cfcad01dbca611e0bf7d54af099bba8563acfd4f...21d598fe3af8c29c2ed5976c472c5df0f5ba3052)


### [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator/tree/97f1161c902d0237320719fa41294373a0d97b07)

* [OCPBUGS-103531](https://issues.redhat.com/browse/OCPBUGS-103531): Bump golang.org/x/net to v0.35.0-sec.3 [#356](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/356)
* [OCPBUGS-81673](https://issues.redhat.com/browse/OCPBUGS-81673): Fix password escaping [#342](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/342)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver-operator/compare/2b241410a972898f0ce80dec3bfdf4f974721937...97f1161c902d0237320719fa41294373a0d97b07)


### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/521d379ac390b82dc2904bee4776c26481c6d0e7)

* [OCPBUGS-129532](https://issues.redhat.com/browse/OCPBUGS-129532): Fixed compute cluster permission logic for single fd with read-only custom resourcepool [#245](https://github.com/openshift/vsphere-problem-detector/pull/245)
* [OCPBUGS-103545](https://issues.redhat.com/browse/OCPBUGS-103545): Bump golang.org/x/net to v0.35.0-sec.4 [#233](https://github.com/openshift/vsphere-problem-detector/pull/233)
* [OCPBUGS-81556](https://issues.redhat.com/browse/OCPBUGS-81556): fix concurrent map writes [#215](https://github.com/openshift/vsphere-problem-detector/pull/215)
* [OCPBUGS-70359](https://issues.redhat.com/browse/OCPBUGS-70359): Fixed logic for vSphere compute cluster permission [#200](https://github.com/openshift/vsphere-problem-detector/pull/200)
* [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/1a2036121a48da7493bdb50913c2b71c2372be60...521d379ac390b82dc2904bee4776c26481c6d0e7)