# 4.19.52

Created: 2026-10-15 11:12:41 +0000 UTC

Image Digest: `sha256:acb954a5270202f5bc8aa69caa74021ffccf8caf0d468dcf509c3a7068944670`


## Changes from 4.19.28

### Components

* Kubectl 1.32.1
* Kubernetes 1.32.13
* Kubernetes Tests 1.32.8
* Red Hat Enterprise Linux CoreOS upgraded from 9.6.20260407-0 to 9.6.20261013-0


### Removed images

* ovirt-csi-driver
* ovirt-csi-driver-operator


### Rebuilt images without code change

* [agent-installer-utils](https://github.com/openshift/agent-installer-utils) git [34af4548](https://github.com/openshift/agent-installer-utils/commit/34af4548d9d162c4e07e7426d4c672d8fbc3500c) `sha256:eb9fd620aece19893e5d628508c2fba1bf376c129f611a7cd9b25decd041c7f8`
* [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy) git [77213cc5](https://github.com/openshift/apiserver-network-proxy/commit/77213cc5eed50f6c0ec0600133e01274020657ef) `sha256:36b3524c7adbb8ef343ce6d8b029fafab5e82796672a3f3e213fbead5ea346c8`
* [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws) git [425c1c5b](https://github.com/openshift/cloud-provider-aws/commit/425c1c5be39628421bdfb63caf25beb169307473) `sha256:663bfb474c32b295302ab6e0fb5007705e4692b2ca6a22e3a0679a6e991a099c`
* [aws-karpenter-provider-aws](https://github.com/openshift/aws-karpenter-provider-aws) git [68ae0c26](https://github.com/openshift/aws-karpenter-provider-aws/commit/68ae0c265271b4447f42decf88c6a44b343eeec9) `sha256:4a050c18cae4876f6909838277bb230a252ad04ae4e84126f34bde79a4f460bf`
* [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws) git [14f4b995](https://github.com/openshift/machine-api-provider-aws/commit/14f4b995a810d26516d5f1c88f7bee1d524686b0) `sha256:2373dfa9e070458f908c4985e23783a3e612e2564f79af629ae11a75d81ce6d6`
* [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook) git [b0a16d53](https://github.com/openshift/aws-pod-identity-webhook/commit/b0a16d53fbf28a55110bbb36a69f23bc772b3297) `sha256:f044d2eb0eefdf4f36ad12cbf066b75840c79954d1486c4917c78cc8fda7fdb4`
* [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3) git [06a66db1](https://github.com/openshift/cluster-api-provider-metal3/commit/06a66db1ac3c28f6d9a1adf16146ebec219c8534) `sha256:52473c7539da9ef8d377918a47f6b3919baaede20f8e666688b16cd973f86613`
* [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal) git [f7a78954](https://github.com/openshift/cluster-api-provider-baremetal/commit/f7a789548f76d3117f3400ac597c0db615778d57) `sha256:f0cd0a257c5a957c8e7939fae1e2bbaf1eb9617036066dd97fc6e3ca6d47251b`
* [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg) git [2f969c7a](https://github.com/openshift/baremetal-runtimecfg/commit/2f969c7a1df33a398298df731505a508ad120db9) `sha256:f60fdc90640e2114d9b50cd312f119cc1a0876323dc97a3f0edd399bdaae29e8`
* [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller) git [49b7a9e2](https://github.com/openshift/cloud-network-config-controller/commit/49b7a9e2f1cc77fee3a8ee776d3eac8bae1be86e) `sha256:5d3e6e6aebc8455d12d50d054836f0a7eeea06c9e935e2f8b78c204ab831c09f`
* [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator) git [d25f6513](https://github.com/openshift/cluster-baremetal-operator/commit/d25f65138ada818ff264f66e239e856a5e51abed) `sha256:f2969d1260671de40e64b936ff8a10427fdaf2b62ceb2480e3355c3e9abffeb8`
* [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap) git [8fde9c52](https://github.com/openshift/cluster-bootstrap/commit/8fde9c52fbb6b6044785ebae0751000b049fd0ed) `sha256:8d352762f0a864008d6d3d4b4ad726d131c2364079335f3ebe8b40500ee73250`
* [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator) git [5b39a4df](https://github.com/openshift/cluster-cloud-controller-manager-operator/commit/5b39a4dfc245942db4a21cec493bfb2a15bb4b21) `sha256:5548dd4ac93d3ef8de8fa688f566f33eec4754c5654297a68e4306b2d4a7b436`
* [cluster-config-operator](https://github.com/openshift/cluster-config-operator) git [96607b59](https://github.com/openshift/cluster-config-operator/commit/96607b590ba35a8f008073e105e01e72a5bfba2e) `sha256:a475e3947d0ac35e824a0c1e623ec282fa6f070ead709ca53d599987fd6fe133`
* [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator) git [1dbf0c7a](https://github.com/openshift/cluster-control-plane-machine-set-operator/commit/1dbf0c7a5d513dedcc18de0ee5fb34e18b8b53f2) `sha256:435545a383df64abe2d4c708dafc3f41d8d3428e433fddaa3bba67c92285fac9`
* [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator) git [65981306](https://github.com/openshift/cluster-dns-operator/commit/659813065170f4e52f80b7a29bbab64bfa9aa172) `sha256:d6b0fd2ad739432e569064d54b5db3d672ec116cbe8ad1c329f75462455eb113`
* [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator) git [3335b120](https://github.com/openshift/cluster-image-registry-operator/commit/3335b120ecbae4a792373a814474aeebde58d6c2) `sha256:00331e1c4dfb51b95a0e7518625b582da9b84401630f0215cc478be90a69a194`
* [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator) git [7c4e4469](https://github.com/openshift/cluster-kube-controller-manager-operator/commit/7c4e44698b6004e52c59e03dd0c89611fbbfa999) `sha256:a52f05b354d687ac9e6ea943050f86f644b54427fc9b0b2467229fff541a7e83`
* [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator) git [bf8cd78f](https://github.com/openshift/cluster-kube-scheduler-operator/commit/bf8cd78f223b3d27ea4fb170d22edea14df26df3) `sha256:2588de9104cf7c3d9e6f7468d7f56dc3116d769e5234d37adc650f3829af7c0e`
* [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator) git [4e514049](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/commit/4e51404906f0648304e81414e0d299c52214f7a8) `sha256:4d6b360b4a1c3b682b9a1bf41e626942cc769beea661c6c7cef8155b764b0a1b`
* [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver) git [49517f79](https://github.com/openshift/cluster-machine-approver/commit/49517f79bdfeb0fa06f2bc80d793a0c9db194aab) `sha256:337ebb3416f41a5117269edfee27dc1fe7c91546f1c25bb4eebb7b5942fda850`
* [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator) git [5f66a3e1](https://github.com/openshift/cluster-openshift-apiserver-operator/commit/5f66a3e13fd98eaaa0941e8e0724b1f56a797d6d) `sha256:05bd69a22661da7ef6551604ccff178f076750f453074f8a2349e3cfdb50fda8`
* [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator) git [0ab30996](https://github.com/openshift/cluster-openshift-controller-manager-operator/commit/0ab30996207ada63ef2e2fd4f47aac03b0872c9a) `sha256:72586a3f60c5d4d0ef02cb080392bf8088e305188cb37c22dc7ab67f450ffd8f`
* [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator) git [aa7f05d2](https://github.com/openshift/cluster-samples-operator/commit/aa7f05d27fb2a60314278f0c248fd961442a4144) `sha256:3838a010e26fa35ee641f74acf499a218f7b6846093be7385b805d9509f985bd`
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [0ea36f0a](https://github.com/openshift/cluster-update-keys/commit/0ea36f0a4c0ad6a6abc81a91b2ac87d68d294020) `sha256:cfcca41192d7aadfbfc828967e9c0fe516c06edb60941bfa75b6fb66d79ac44c`
* [configmap-reloader](https://github.com/openshift/configmap-reload) git [a2a48a3a](https://github.com/openshift/configmap-reload/commit/a2a48a3a767fdb70644c65ab863bd4fc125987d2) `sha256:9ce255e21ea6ab3e8e8f8478b003457061987c1f524e339bfba24ba9b66b79ce`
* [coredns](https://github.com/openshift/coredns) git [4f649314](https://github.com/openshift/coredns/commit/4f64931403bf747b78bccb40ad877b08da534e23) `sha256:e360d507cffe9a9686c2cb22779eec418436d3e3cdd4f1f721a60d5a3f99d348`
* [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe) git [ca514478](https://github.com/openshift/csi-livenessprobe/commit/ca5144785b2c8caa6fe0ffcf7837e8e17b4864fb) `sha256:463f0936121929cd5cd853e530c3a00e396812976ae0facc554a952fa2d49a0b`
* [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar) git [fa578445](https://github.com/openshift/csi-node-driver-registrar/commit/fa578445467753d2a000cb1ba1cb5dc91cfb9542) `sha256:b73616992e60a0c3b025c9120e26ed91cb3ce92f55ff552019543aa59eec12b5`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [686fdac5](https://github.com/openshift/driver-toolkit/commit/686fdac595884ade83fef7b2b9c41169bf3fcb21) `sha256:b4a886685cc9cf838ace04da8b20bc370a3e5f53d3dd03202052a73b094534d1`
* [etcd](https://github.com/openshift/etcd) git [3ebce536](https://github.com/openshift/etcd/commit/3ebce536634cb76794f1b9668072a094c132c16a) `sha256:471371e9963db03c6a2a7d68b4292dd11997e784e9145b880456aabfe9cb0ee0`
* [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp) git [d8d3aeba](https://github.com/openshift/cloud-provider-gcp/commit/d8d3aeba536f4c9f6593a08045466f06dc7406ff) `sha256:771983c5a89d26dfebe3ea9b61640e2a8d50c38d52db320b5464ef69cbc22e44`
* [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook) git [fbf4c1b2](https://github.com/openshift/gcp-workload-identity-federation-webhook/commit/fbf4c1b2b233806f8233b89abca2795a4cadef14) `sha256:4ca983e5c6d288d9edc7e71c0f5e38bad7c0aa7c2b2c0313b2b3e05f684b6d1c`
* [insights-runtime-exporter](https://github.com/openshift/insights-runtime-extractor) git [f8977615](https://github.com/openshift/insights-runtime-extractor/commit/f897761561e72281c27a9aac851ef936b874a2b9) `sha256:2f28825ce424a635d7cd1ac38e3f6c7db2746c19cddcd673a1aa458589e46cc4`
* [insights-runtime-extractor](https://github.com/openshift/insights-runtime-extractor) git [f8977615](https://github.com/openshift/insights-runtime-extractor/commit/f897761561e72281c27a9aac851ef936b874a2b9) `sha256:bbe5f6376549135b664904093b7595c850aa345e4ba87167f60a8e6697a73a23`
* [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [dacba7d7](https://github.com/openshift/ironic-rhcos-downloader/commit/dacba7d7809a048392d18050096dcc20f2878b6f) `sha256:48edb58429beea3c5fea8efd89658208030bc103880eed8a46cbb7a66e33de10`
* [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager) git [fcd9564e](https://github.com/openshift/ironic-static-ip-manager/commit/fcd9564e3bfa12e45576af376d168b5036dd8206) `sha256:352aafad097bbb1d40223483b8a08bf8483f38202506877c2ffd065a103c2369`
* [keepalived-ipfailover](https://github.com/openshift/images) git [b42e7cf2](https://github.com/openshift/images/commit/b42e7cf218c4eef071cc29e0894fe8cfaed80b7f) `sha256:622a418f58b084e454ced51e31986407660b292c62c72e4694b923b0d3223087`
* [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy) git [59127756](https://github.com/openshift/kube-rbac-proxy/commit/591277560f328601273f88f2881e09ccccd90a97) `sha256:f51ee85c187afd0beb63d07d7e589a7111e518e1ac5c0230e1db79a9b9a59991`
* [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator) git [fdef30c8](https://github.com/openshift/kubernetes-kube-storage-version-migrator/commit/fdef30c84b3d45ede364500984221c3f492b1415) `sha256:48e2f1b6caee03fbc874b5ff4519c42b6d3e16d420ac232c9b09088cdb636794`
* [libvirt-machine-controllers](https://github.com/openshift/cluster-api-provider-libvirt) git [be869073](https://github.com/openshift/cluster-api-provider-libvirt/commit/be869073822c90e5d2e026f6af76a20d7e570ccc) `sha256:a6b7b206093caabdf598501609b24c9081e3945de8a2d1816e8daddaf807b23d`
* [metallb-frr](https://github.com/openshift/frr) git [9c93b083](https://github.com/openshift/frr/commit/9c93b083918f4266b7139ae39207c12cd4824345) `sha256:b3e1762849fb9bf8be28a3fa3a44651693e388b78032344c6df7fc61acbfde9b`
* [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy) git [0451c877](https://github.com/openshift/multus-networkpolicy/commit/0451c87778f69356a705e79a9575b1e61c80f09c) `sha256:dd9a086ada46befa8dc57b3347a8cf0f8f9bc4d05dab16326898b63eb144c9aa`
* [multus-route-override-cni](https://github.com/openshift/route-override-cni) git [391c1b03](https://github.com/openshift/route-override-cni/commit/391c1b0361e17c5718508810f0bdb6ff66ae6e81) `sha256:5b0c8b578534e7e3b23e42dad759a23daefdd0e66e13e852f2e7dfaf988861cf`
* [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni) git [0e1112ce](https://github.com/openshift/whereabouts-cni/commit/0e1112cea12c707a93bd01d408c598dd070c8676) `sha256:dd56bebeb25a5bd75cdfc7be296d97a52cdedddd6e2233d2c2351d3ee5f1f6d7`
* [network-interface-bond-cni](https://github.com/openshift/bond-cni) git [fd8f506d](https://github.com/openshift/bond-cni/commit/fd8f506d59353ac89db5c8015969e81dafdab774) `sha256:4138c3be915ba95e10c441472678c3650371f488e7db4bfc2bf1746e8dd1ad7b`
* [network-tools](https://github.com/openshift/network-tools) git [633767b2](https://github.com/openshift/network-tools/commit/633767b26eb0d7c69e370599d40458e72e7d1a69) `sha256:cf797b0a1428715fe0b4ee73914168f28075bf7fe0bd836aebb14c216ee45ced`
* [nutanix-cloud-controller-manager](https://github.com/openshift/cloud-provider-nutanix) git [db1f264a](https://github.com/openshift/cloud-provider-nutanix/commit/db1f264a7b04784e5f671e61cda0609695e555bb) `sha256:b1d06707ed98368d52281fb8fdcd080bcfa9067a65bf756b7e94634854ea8995`
* [nutanix-machine-controllers](https://github.com/openshift/machine-api-provider-nutanix) git [a26db5a0](https://github.com/openshift/machine-api-provider-nutanix/commit/a26db5a04ecffd98c6a9ee8204af621bf2416ec9) `sha256:63127f54ee20c94c0e25ca6db0fc4340d3e45b2964e37189735ec31a89358bee`
* [oauth-apiserver](https://github.com/openshift/oauth-apiserver) git [5539eb2b](https://github.com/openshift/oauth-apiserver/commit/5539eb2b1174fe0d8a65287c449c99ec3a362122) `sha256:f6d3908390a7e76a8713127874d7018ea301e89d98dbffa53fd72fddda08f45b`
* [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager) git [5b3063ff](https://github.com/openshift/openshift-controller-manager/commit/5b3063ff149f290bebca0783fc508dfbf07689a5) `sha256:ea4ad2598dc66fa8e52cfdeff280320f1399c7d52b875032814672d7ccdf74a9`
* [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics) git [c604f81c](https://github.com/openshift/openshift-state-metrics/commit/c604f81c4953f0feacfcf927cb5de883af027060) `sha256:d31e6bf45e29b6fe2e6fc149ec12c580a4eee7363229b280d35f6325001f1d0d`
* [openstack-resource-controller](https://github.com/openshift/openstack-resource-controller) git [d00bab2b](https://github.com/openshift/openstack-resource-controller/commit/d00bab2b3029ead7cd0e2ae61c7d396239434b48) `sha256:09bb7b4a25a43e64fc15431cf6352a1fccd0bd5bc88aa5207c61d0bafaee4279`
* [operator-marketplace](https://github.com/operator-framework/operator-marketplace) git [ca41bfdd](https://github.com/operator-framework/operator-marketplace/commit/ca41bfdd1a96f70632ea3d218a9a007ecbcf76f5) `sha256:2310a18577d165e5829e1f4daa5e3149812b6cb7a0c771acb9ce854b90f784eb`
* [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs) git [ff6e9a8e](https://github.com/openshift/machine-api-provider-powervs/commit/ff6e9a8e1ea2eebb552cdc64974f8f6e7e5cbd1a) `sha256:00212e5870a4c15c66652110254814cc7abdcba5402cbc6d8991a2b49fb92f85`
* [service-ca-operator](https://github.com/openshift/service-ca-operator) git [4dfa6916](https://github.com/openshift/service-ca-operator/commit/4dfa6916f984d0fd7188380edc88b250738f07f7) `sha256:029cb0228de51b1705c45fc4fb5e38b778dbaf6ec23f18b82b27d09880a27349`
* [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere) git [ce0f10cb](https://github.com/openshift/cloud-provider-vsphere/commit/ce0f10cbccf0a7427bfa66df86187a5b2e184974) `sha256:c9105d28a47587116b14c268259410e5856f4aac01ec63cea9ea83d7ecf21ac4`


### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/b9a9b450c13bd60e1af03846613c7e5d3b11bf52)

* [OCPBUGS-89930](https://issues.redhat.com/browse/OCPBUGS-89930): patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.2 [#10799](https://github.com/openshift/assisted-service/pull/10799)
* [OCPBUGS-94046](https://issues.redhat.com/browse/OCPBUGS-94046): Add sourcedir /run/chrony-dhcp to generated chrony.conf [#10545](https://github.com/openshift/assisted-service/pull/10545)
* [Full changelog](https://github.com/openshift/assisted-service/compare/bf9d9f92728aa6d3185de42fe477fd0d0d1594c2...b9a9b450c13bd60e1af03846613c7e5d3b11bf52)


### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/701bea01c212116915a877f011095460a7801b7a)

* [OCPBUGS-103563](https://issues.redhat.com/browse/OCPBUGS-103563): Bump x/net to v0.35.0-sec.4 [#2290](https://github.com/openshift/assisted-installer/pull/2290)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/0de29205c8b99bdfdc12271281d5830f185d8f8c...701bea01c212116915a877f011095460a7801b7a)


### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/dd543190cf2e911b5db6166a6c3020116d61d630)

* [OCPBUGS-103566](https://issues.redhat.com/browse/OCPBUGS-103566): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#1619](https://github.com/openshift/assisted-installer-agent/pull/1619)
* [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/1753a85e3d8cf18e10bdf35c3a4ac87a74cab44e...dd543190cf2e911b5db6166a6c3020116d61d630)


### [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws/tree/da97b8ac2843ea360b1c9039170a69846fa887c8)

* [OCPBUGS-103572](https://issues.redhat.com/browse/OCPBUGS-103572): replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 [#651](https://github.com/openshift/cluster-api-provider-aws/pull/651)
* 🐛 OCPBUGS-123677: UPSTREAM: <carry>: Fix unit tests for OpenShift CI environment [#640](https://github.com/openshift/cluster-api-provider-aws/pull/640)
* 🌱 OCPBUGS-123613: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI [#639](https://github.com/openshift/cluster-api-provider-aws/pull/639)
* [Full changelog](https://github.com/openshift/cluster-api-provider-aws/compare/0a740b04471ca2bc5bb7a3034e78a62cfc2c24a2...da97b8ac2843ea360b1c9039170a69846fa887c8)


### [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver/tree/c6b30f20d3102016749dec90e8be4574caaa3368)

* [OCPBUGS-82794](https://issues.redhat.com/browse/OCPBUGS-82794): Address CVE-2026-35469 [#330](https://github.com/openshift/aws-ebs-csi-driver/pull/330)
* [OCPBUGS-80386](https://issues.redhat.com/browse/OCPBUGS-80386): Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.75.1-sec.1 [#312](https://github.com/openshift/aws-ebs-csi-driver/pull/312)
* [Full changelog](https://github.com/openshift/aws-ebs-csi-driver/compare/3f7eede5a2a7962f682a1fa87f9fcb90e7533117...c6b30f20d3102016749dec90e8be4574caaa3368)


### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/597fdadcba0ebc457a50e205e62d8bc6ff27c4d3)

* [OCPBUGS-103592](https://issues.redhat.com/browse/OCPBUGS-103592), [OCPBUGS-103601](https://issues.redhat.com/browse/OCPBUGS-103601): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#611](https://github.com/openshift/csi-operator/pull/611)
* [OCPBUGS-80489](https://issues.redhat.com/browse/OCPBUGS-80489): Bump google.golang.org/grpc [#541](https://github.com/openshift/csi-operator/pull/541)
* [OCPBUGS-84242](https://issues.redhat.com/browse/OCPBUGS-84242): [release-4.19] adds the csi-external-resizer to the image-references [#546](https://github.com/openshift/csi-operator/pull/546)
* [Full changelog](https://github.com/openshift/csi-operator/compare/99b646dbac5540b4054300df6a535d10e475d8b0...597fdadcba0ebc457a50e205e62d8bc6ff27c4d3)


### [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider/tree/65915f01ac0077888c21cd6450cba2a9e2d998ad)

* [OCPBUGS-80360](https://issues.redhat.com/browse/OCPBUGS-80360): Bump google.golang.org/grpc to v1.79.3 [#42](https://github.com/openshift/aws-encryption-provider/pull/42)
* [Full changelog](https://github.com/openshift/aws-encryption-provider/compare/6dd8d81c504b39d0b80ca5b8df9a1c534fc1d6f8...65915f01ac0077888c21cd6450cba2a9e2d998ad)


### [azure-cloud-controller-manager, azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure/tree/b249afb943993264abdb7829e770e16f6df04732)

* [OCPBUGS-103595](https://issues.redhat.com/browse/OCPBUGS-103595), [OCPBUGS-103768](https://issues.redhat.com/browse/OCPBUGS-103768): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.3 to address CVE-2026-33814 [#207](https://github.com/openshift/cloud-provider-azure/pull/207)
* [OCPBUGS-80390](https://issues.redhat.com/browse/OCPBUGS-80390), [OCPBUGS-80391](https://issues.redhat.com/browse/OCPBUGS-80391), [OCPBUGS-80533](https://issues.redhat.com/browse/OCPBUGS-80533): Bump google.golang.org/grpc to v1.79.3 [#180](https://github.com/openshift/cloud-provider-azure/pull/180)
* [Full changelog](https://github.com/openshift/cloud-provider-azure/compare/7109d6b4eaefda87b235c88b92c2e17fd3dd0117...b249afb943993264abdb7829e770e16f6df04732)


### [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure/tree/42a1e2b4be81633e6778b5dd835fd9ed31845515)

* [OCPBUGS-89940](https://issues.redhat.com/browse/OCPBUGS-89940): Address CVE-2026-39829 [#400](https://github.com/openshift/cluster-api-provider-azure/pull/400)
* [OCPBUGS-80392](https://issues.redhat.com/browse/OCPBUGS-80392): Bump google.golang.org/grpc to v1.79.3 [#385](https://github.com/openshift/cluster-api-provider-azure/pull/385)
* [Full changelog](https://github.com/openshift/cluster-api-provider-azure/compare/2e2909cf1317cb84285de3c73f6acadb9e8a31f2...42a1e2b4be81633e6778b5dd835fd9ed31845515)


### [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver/tree/0decf70e1dd637d57d1e06b89657722ba1ee517d)

* UPSTREAM: 3582: OCPBUGS-103602: Bump golang.org/x/net to v0.43.0-sec.4 [#171](https://github.com/openshift/azure-disk-csi-driver/pull/171)
* [OCPBUGS-112786](https://issues.redhat.com/browse/OCPBUGS-112786): UPSTREAM: 3277: fix: allow `.` in Azure tags [#170](https://github.com/openshift/azure-disk-csi-driver/pull/170)
* [OCPBUGS-80393](https://issues.redhat.com/browse/OCPBUGS-80393): Bump google.golang.org/grpc to v1.79.3 [#141](https://github.com/openshift/azure-disk-csi-driver/pull/141)
* [OCPBUGS-78035](https://issues.redhat.com/browse/OCPBUGS-78035): add instantAccessDurationMinutes parameter to enable IA snapshots for PremiumV2/UltraSSD disks [#129](https://github.com/openshift/azure-disk-csi-driver/pull/129)
* [Full changelog](https://github.com/openshift/azure-disk-csi-driver/compare/466334d41a33d801cef0e81bc7186b8fd42b3f30...0decf70e1dd637d57d1e06b89657722ba1ee517d)


### [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver/tree/e409c0054eee97a7ab9ea318125573d10a0a1b3b)

* [OCPBUGS-103591](https://issues.redhat.com/browse/OCPBUGS-103591): Bump golang.org/x/net to v0.43.0-sec.4 [#157](https://github.com/openshift/azure-file-csi-driver/pull/157)
* [OCPBUGS-92920](https://issues.redhat.com/browse/OCPBUGS-92920): Bump golang.org/x/crypto to  v0.41.0-sec.2 [#147](https://github.com/openshift/azure-file-csi-driver/pull/147)
* [OCPBUGS-80396](https://issues.redhat.com/browse/OCPBUGS-80396): Bump google.golang.org/grpc to v1.79.3 [#129](https://github.com/openshift/azure-file-csi-driver/pull/129)
* [Full changelog](https://github.com/openshift/azure-file-csi-driver/compare/8970409a952051e3fdc08728eddadb24bba94b70...e409c0054eee97a7ab9ea318125573d10a0a1b3b)


### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/03fdb55d0c7970ca775ef17a8a7221d855a7a489)

* [OCPBUGS-103554](https://issues.redhat.com/browse/OCPBUGS-103554): [release-4.19] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#60](https://github.com/openshift/azure-kubernetes-kms/pull/60)
* [OCPBUGS-80361](https://issues.redhat.com/browse/OCPBUGS-80361): Bump google.golang.org/grpc to 1.64.1-sec.1 patch [#45](https://github.com/openshift/azure-kubernetes-kms/pull/45)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/20a9ba53d5900578d497c84bb09cd46bc5859a29...03fdb55d0c7970ca775ef17a8a7221d855a7a489)


### [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure/tree/a829b8df984354f54fdc3e9b98a9e64d96378909)

* [OCPBUGS-103689](https://issues.redhat.com/browse/OCPBUGS-103689): replace golang.org/x/net with openshift-sustaining/net@v0.43.0-sec.4 [#212](https://github.com/openshift/machine-api-provider-azure/pull/212)
* [Full changelog](https://github.com/openshift/machine-api-provider-azure/compare/163515df04124d4e2daaab47dc6fd30a1e5b246e...a829b8df984354f54fdc3e9b98a9e64d96378909)


### [azure-service-operator](https://github.com/openshift/azure-service-operator/tree/3bb352c18a940bf419a3ed8b1e7e5f23c3ba286e)

* [OCPBUGS-80362](https://issues.redhat.com/browse/OCPBUGS-80362): Bump google.golang.org/grpc to v1.79.3 [#30](https://github.com/openshift/azure-service-operator/pull/30)
* [Full changelog](https://github.com/openshift/azure-service-operator/compare/0ae129b4768d2e10e0ca215d272e207bfae963a3...3bb352c18a940bf419a3ed8b1e7e5f23c3ba286e)


### [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity/tree/7ac35ab63a99d82617d37da58cd2d11291ce3d5c)

* [OCPBUGS-81914](https://issues.redhat.com/browse/OCPBUGS-81914): CVE-2026-34986: use sustaining go-jose fork (avoids Go 1.24 bump) [#52](https://github.com/openshift/azure-workload-identity/pull/52)
* [Full changelog](https://github.com/openshift/azure-workload-identity/compare/e5c6c44c87ebbe57a33650dd6270275e7cca771e...7ac35ab63a99d82617d37da58cd2d11291ce3d5c)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/ccad5b204b7f6ac63f3932c195664d901398c3d0)

* [OCPBUGS-103604](https://issues.redhat.com/browse/OCPBUGS-103604), [OCPBUGS-103681](https://issues.redhat.com/browse/OCPBUGS-103681): Bump golang.org/x/net to v0.43.0-sec.4 [#10969](https://github.com/openshift/installer/pull/10969)
* [OCPBUGS-100064](https://issues.redhat.com/browse/OCPBUGS-100064): openstack: Reserve addresses for load balancer [#10722](https://github.com/openshift/installer/pull/10722)
* [OCPBUGS-89936](https://issues.redhat.com/browse/OCPBUGS-89936), [OCPBUGS-92919](https://issues.redhat.com/browse/OCPBUGS-92919): Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.41.0-sec.3 [#10856](https://github.com/openshift/installer/pull/10856)
* [OCPBUGS-115289](https://issues.redhat.com/browse/OCPBUGS-115289): Update gcloud version to one that can be found [#10844](https://github.com/openshift/installer/pull/10844)
* [OCPBUGS-113537](https://issues.redhat.com/browse/OCPBUGS-113537): Update RHCOS-release-4.19 bootimage metadata to 9.6.20260818-0 [#10800](https://github.com/openshift/installer/pull/10800)
* [OCPBUGS-79002](https://issues.redhat.com/browse/OCPBUGS-79002): [release-4.19] - Allow all instance types in the install config for GCP [#10505](https://github.com/openshift/installer/pull/10505)
* [OCPBUGS-91984](https://issues.redhat.com/browse/OCPBUGS-91984): azure: Add field in installconfig to disallow shared access key [#10653](https://github.com/openshift/installer/pull/10653)
* [OCPBUGS-77051](https://issues.redhat.com/browse/OCPBUGS-77051): Update RHCOS-release-4.19 data/data/coreos/rhcos.json to 9.6.20260616-0 [#10652](https://github.com/openshift/installer/pull/10652)
* [Full changelog](https://github.com/openshift/installer/compare/9cdc31344d455cbc638d490cdc32c978e0b822c1...ccad5b204b7f6ac63f3932c195664d901398c3d0)


### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/8fa7f68fd41fa2bb78cd8f0a4d758c703b37a672)

* [OCPBUGS-98209](https://issues.redhat.com/browse/OCPBUGS-98209): Add BMH finalizer on PreprovisioningImage [#508](https://github.com/openshift/baremetal-operator/pull/508)
* [OCPBUGS-87966](https://issues.redhat.com/browse/OCPBUGS-87966): Fix preprovisioning network Secret lifecycle during BMH deletion [#494](https://github.com/openshift/baremetal-operator/pull/494)
* [OCPBUGS-88039](https://issues.redhat.com/browse/OCPBUGS-88039): Fix invalidDNSNameinvalidipv6 test [#496](https://github.com/openshift/baremetal-operator/pull/496)
* [Full changelog](https://github.com/openshift/baremetal-operator/compare/f4e49d5f3b0a2a3ee7a2cc7716bc8d70f33f3506...8fa7f68fd41fa2bb78cd8f0a4d758c703b37a672)


### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/270921939bb63f95219f865d138f8f0208369097)

* [OCPBUGS-103551](https://issues.redhat.com/browse/OCPBUGS-103551), [OCPBUGS-103599](https://issues.redhat.com/browse/OCPBUGS-103599): Use patched x/net fork v0.43.0-sec.4 [#2419](https://github.com/openshift/oc/pull/2419)
* Fix for OCPBUGS-88243: CVE-2026-39821 [#2362](https://github.com/openshift/oc/pull/2362)
* [OCPBUGS-91095](https://issues.redhat.com/browse/OCPBUGS-91095), [OCPBUGS-94720](https://issues.redhat.com/browse/OCPBUGS-94720): Bump golang.org/x/net to openshift-sustaining/net v0.43.0-sec.2 [#2343](https://github.com/openshift/oc/pull/2343)
* [OCPBUGS-105503](https://issues.redhat.com/browse/OCPBUGS-105503), [OCPBUGS-105504](https://issues.redhat.com/browse/OCPBUGS-105504): Fix pre-existing unit test failures on release-4.19 [#2356](https://github.com/openshift/oc/pull/2356)
* [Full changelog](https://github.com/openshift/oc/compare/b2a93a639c07ebf4d547d10877b6c13f65583248...270921939bb63f95219f865d138f8f0208369097)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/5559fd7e62adf0e94f82d2737ad0ba9b39146afe)

* [OCPBUGS-81917](https://issues.redhat.com/browse/OCPBUGS-81917): Bump go-jose/go-jose/v4@v4.1.4 [#1030](https://github.com/openshift/cloud-credential-operator/pull/1030)
* [OCPBUGS-80400](https://issues.redhat.com/browse/OCPBUGS-80400): Bump google.golang.org/grpc to v1.79.3 [#1023](https://github.com/openshift/cloud-credential-operator/pull/1023)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/2faf05d3fe49f9aefd1e96249d58e686a3f1ce8e...5559fd7e62adf0e94f82d2737ad0ba9b39146afe)


### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/4b788a77b84fadcf4ae847899b768559d9b0dc57)

* [OCPBUGS-103609](https://issues.redhat.com/browse/OCPBUGS-103609): Bump golang.org/x/net from v0.30.0 to v0.43.0-sec.4 [#982](https://github.com/openshift/cluster-authentication-operator/pull/982)
* [OCPBUGS-86956](https://issues.redhat.com/browse/OCPBUGS-86956): Updating ose-cluster-authentication-operator-container image to be consistent with ART for 4.19 [#852](https://github.com/openshift/cluster-authentication-operator/pull/852)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/1d930619673e99029a1e5cec0194b5a3580ec35a...4b788a77b84fadcf4ae847899b768559d9b0dc57)


### [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler/tree/80d92230e71d2bf79e24616a8586aa19be54dd55)

* [OCPBUGS-103756](https://issues.redhat.com/browse/OCPBUGS-103756): Replace golang.org/x/net with openshift-sustaining/net v0.43.0-sec.4 for CVE-2026-33814 [#441](https://github.com/openshift/kubernetes-autoscaler/pull/441)
* [Full changelog](https://github.com/openshift/kubernetes-autoscaler/compare/33b1498504745b15dff672a68f4005e35855cc4e...80d92230e71d2bf79e24616a8586aa19be54dd55)


### [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator/tree/54bf5566c1b4a0e71f4841c75fb6ca2040e8b956)

* [OCPBUGS-103611](https://issues.redhat.com/browse/OCPBUGS-103611): Bump x/net package in release-4.19 [#385](https://github.com/openshift/cluster-autoscaler-operator/pull/385)
* [Full changelog](https://github.com/openshift/cluster-autoscaler-operator/compare/dd778375334821fb94db695ec1963e2f7f001893...54bf5566c1b4a0e71f4841c75fb6ca2040e8b956)


### [cluster-capi-controllers](https://github.com/openshift/cluster-api/tree/42b8aeca8d812175660e6b372fc2145792b48f2d)

* [OCPBUGS-80401](https://issues.redhat.com/browse/OCPBUGS-80401): Bump google.golang.org/grpc to v1.79.3 [#295](https://github.com/openshift/cluster-api/pull/295)
* [Full changelog](https://github.com/openshift/cluster-api/compare/479f0c4edcfc5bc5706600070e8b8c142e59a5d4...42b8aeca8d812175660e6b372fc2145792b48f2d)


### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/cc2093ef2d72cd3cf0a42519f5e791e1b95ed6a5)

* [OCPBUGS-80405](https://issues.redhat.com/browse/OCPBUGS-80405): Bump google.golang.org/grpc to v1.79.3 [#546](https://github.com/openshift/cluster-capi-operator/pull/546)
* NO-JIRA: Allow sustaining engineering to self serve dependency updates [#557](https://github.com/openshift/cluster-capi-operator/pull/557)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/cf9e6e9bf7f28ac52ea7b2f0af6b0b80cd7c32b9...cc2093ef2d72cd3cf0a42519f5e791e1b95ed6a5)


### [cluster-config-api](https://github.com/openshift/api/tree/1ebdd7bba8e6c503a1f61c6d467ed877783826e1)

* [OCPBUGS-98410](https://issues.redhat.com/browse/OCPBUGS-98410): add new serviceAccountToken fs type [#2926](https://github.com/openshift/api/pull/2926)
* [Full changelog](https://github.com/openshift/api/compare/482f1b56dcc4d97ab9d3f7c22f102ecb54af83bb...1ebdd7bba8e6c503a1f61c6d467ed877783826e1)


### [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator/tree/75abb4acc2cf816fc05a3d98bc4a0238deea24d4)

* [OCPBUGS-103626](https://issues.redhat.com/browse/OCPBUGS-103626): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#294](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/294)
* [Full changelog](https://github.com/openshift/cluster-csi-snapshot-controller-operator/compare/cf99de974354133f853928cff9e19ad19c5347d9...75abb4acc2cf816fc05a3d98bc4a0238deea24d4)


### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/024f8af5195a6bdbe0eb7e253ba83b5d3190247f)

* [OCPBUGS-85275](https://issues.redhat.com/browse/OCPBUGS-85275): Wait for revision stability before removing etcd members [#1613](https://github.com/openshift/cluster-etcd-operator/pull/1613)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/bc5779c02e6affbefb43541e5b57969ca09a8b94...024f8af5195a6bdbe0eb7e253ba83b5d3190247f)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/47d5d36cacb3b2eae377cbd8591d0634363aa76a)

* [OCPBUGS-103610](https://issues.redhat.com/browse/OCPBUGS-103610): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.3 [#1570](https://github.com/openshift/cluster-ingress-operator/pull/1570)
* [OCPBUGS-86716](https://issues.redhat.com/browse/OCPBUGS-86716): Add configuration override for X-SSL strip [#1476](https://github.com/openshift/cluster-ingress-operator/pull/1476)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/7ce99b2c11f456e0e6e3cfa80ebf7682466eb0ea...47d5d36cacb3b2eae377cbd8591d0634363aa76a)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/d9337a500419d77ac4ffae75a894ae6e5910509b)

* [OCPBUGS-128389](https://issues.redhat.com/browse/OCPBUGS-128389): Fix kube-apiserver-to-kubelet-signer refresh interval [#2324](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2324)
* [OCPBUGS-83857](https://issues.redhat.com/browse/OCPBUGS-83857): Allow setting the oauthMetadata when auth type is None [#2118](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2118)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/4bbd3be9dfda4a08dca98648209151de2a869f25...d9337a500419d77ac4ffae75a894ae6e5910509b)


### [cluster-kube-cluster-api-operator](https://github.com/openshift/cluster-api-operator/tree/21f858318e12e7fc2304ea6d3639680b6863a597)

* [OCPBUGS-80412](https://issues.redhat.com/browse/OCPBUGS-80412): Bump google.golang.org/grpc to v1.79.3 [#76](https://github.com/openshift/cluster-api-operator/pull/76)
* [Full changelog](https://github.com/openshift/cluster-api-operator/compare/3ec30377ffff951dc9c0fc2257d290e4b4958465...21f858318e12e7fc2304ea6d3639680b6863a597)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/b3cb1873b40e92d713c0fd178dea95a832b7ed19)

* NO-ISSUE: synchronize OWNERS from main branch [release-4.19] [#3107](https://github.com/openshift/cluster-monitoring-operator/pull/3107)
* [OCPBUGS-112575](https://issues.redhat.com/browse/OCPBUGS-112575): [release-4.19] Makefile: version-stamp golangci-lint binary to prevent stale linter [#3067](https://github.com/openshift/cluster-monitoring-operator/pull/3067)
* [OCPBUGS-105310](https://issues.redhat.com/browse/OCPBUGS-105310): [release-4.19] wrap library-go resourceCache with mutex for thread safety [#3042](https://github.com/openshift/cluster-monitoring-operator/pull/3042)
* [OCPBUGS-103627](https://issues.redhat.com/browse/OCPBUGS-103627): [release-4.19] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#3073](https://github.com/openshift/cluster-monitoring-operator/pull/3073)
* [OCPBUGS-104539](https://issues.redhat.com/browse/OCPBUGS-104539): Backport e2e stabilization 4.19 [#3029](https://github.com/openshift/cluster-monitoring-operator/pull/3029)
* [OCPBUGS-100373](https://issues.redhat.com/browse/OCPBUGS-100373): [release-4.19] fix: watch cluster wide proxy changes and apply changes accordingly [#3023](https://github.com/openshift/cluster-monitoring-operator/pull/3023)
* [OCPBUGS-94080](https://issues.redhat.com/browse/OCPBUGS-94080): ship collector:node_scrape_collector_success:avg to Telemetry [#2991](https://github.com/openshift/cluster-monitoring-operator/pull/2991)
* [OCPBUGS-86994](https://issues.redhat.com/browse/OCPBUGS-86994): increase lookup interval [#2948](https://github.com/openshift/cluster-monitoring-operator/pull/2948)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/428ef596b766bb5b01a50a2ad5371b9734b6b989...b3cb1873b40e92d713c0fd178dea95a832b7ed19)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/d0c6f75e06c861c7f2d5355dab0e7bd8a20de43c)

* [OCPBUGS-99750](https://issues.redhat.com/browse/OCPBUGS-99750): Bump github.com/containernetworking/cni v0.8.0 -> v1.3.0 [#3094](https://github.com/openshift/cluster-network-operator/pull/3094)
* [OCPBUGS-84177](https://issues.redhat.com/browse/OCPBUGS-84177): Handle zero-worker HyperShift clusters in daemonset rollout [4.19 backport] [#2974](https://github.com/openshift/cluster-network-operator/pull/2974)
* [OCPBUGS-85404](https://issues.redhat.com/browse/OCPBUGS-85404): Remove duplicated openssl parameter [#3003](https://github.com/openshift/cluster-network-operator/pull/3003)
* [OCPBUGS-84201](https://issues.redhat.com/browse/OCPBUGS-84201): wait for patch port to apply drop garp flows [#2971](https://github.com/openshift/cluster-network-operator/pull/2971)
* [OCPBUGS-84143](https://issues.redhat.com/browse/OCPBUGS-84143): fix(hypershift): use net.JoinHostPort for URL construction [#2969](https://github.com/openshift/cluster-network-operator/pull/2969)
* [OCPBUGS-77150](https://issues.redhat.com/browse/OCPBUGS-77150): Add config override for openflow-probe [#2964](https://github.com/openshift/cluster-network-operator/pull/2964)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/c56dbe730979a72781c87e01bb5bccffe527e6c6...d0c6f75e06c861c7f2d5355dab0e7bd8a20de43c)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/097449ea419bdb986c6d42e4b42506f80eaa691c)

* [OCPBUGS-115119](https://issues.redhat.com/browse/OCPBUGS-115119): Use Add() instead of AddRateLimited() for routine Profile enqueues [#1626](https://github.com/openshift/cluster-node-tuning-operator/pull/1626)
* [OCPBUGS-87932](https://issues.redhat.com/browse/OCPBUGS-87932): Requeue PerformanceStatus update when status write fails [#1543](https://github.com/openshift/cluster-node-tuning-operator/pull/1543)
* [OCPBUGS-82802](https://issues.redhat.com/browse/OCPBUGS-82802): Bump github.com/moby/spdystream from v0.5.0 to v0.5.1 [#1533](https://github.com/openshift/cluster-node-tuning-operator/pull/1533)
* [OCPBUGS-85438](https://issues.redhat.com/browse/OCPBUGS-85438): e2e: Add irqbalance StartLimitBurst >= 100 [#1514](https://github.com/openshift/cluster-node-tuning-operator/pull/1514)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/bf23cbf12f5fd764cbf01ba911cb7e1bc623c82f...097449ea419bdb986c6d42e4b42506f80eaa691c)


### [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator/tree/88faec2c2449f9f4ed3cfc4b8893cc29e6bfbbf3)

* [OCPBUGS-80420](https://issues.redhat.com/browse/OCPBUGS-80420): Bump google.golang.org/grpc to v1.79.3 [#199](https://github.com/openshift/cluster-olm-operator/pull/199)
* [Full changelog](https://github.com/openshift/cluster-olm-operator/compare/efb91390ee10673d8f3f16e604390bd68d361d50...88faec2c2449f9f4ed3cfc4b8893cc29e6bfbbf3)


### [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller/tree/d1ea75b45228a6af17f3a1899ab4bd214e28f54b)

* [OCPBUGS-98410](https://issues.redhat.com/browse/OCPBUGS-98410): [4.19] add serviceAccountToken volume type to psalabelsyncer [#195](https://github.com/openshift/cluster-policy-controller/pull/195)
* [Full changelog](https://github.com/openshift/cluster-policy-controller/compare/748524784686a5f397490563882cbfb88f9acd01...d1ea75b45228a6af17f3a1899ab4bd214e28f54b)


### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/1f6e0a9a7460d400fc7a8d0aff94739c64040daa)

* [OCPBUGS-103630](https://issues.redhat.com/browse/OCPBUGS-103630): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#736](https://github.com/openshift/cluster-storage-operator/pull/736)
* [OCPBUGS-87095](https://issues.redhat.com/browse/OCPBUGS-87095): remove oVirt code from CSO 4.19 [#705](https://github.com/openshift/cluster-storage-operator/pull/705)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/9dd4dc3fa79410674687c8282689ecb0edfec5f2...1f6e0a9a7460d400fc7a8d0aff94739c64040daa)


### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/ea7bd42ee4f7a5d4774c0c0b3b0ce31940a9cf38)

* [OCPBUGS-103642](https://issues.redhat.com/browse/OCPBUGS-103642): Bump golang.org/x/net to v0.43.0-sec.3 [#1458](https://github.com/openshift/cluster-version-operator/pull/1458)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/842a2ac2261e03bc5b6717620c076bf58652c1f6...ea7bd42ee4f7a5d4774c0c0b3b0ce31940a9cf38)


### [console](https://github.com/openshift/console/tree/8bcbe07d37cdf28d7c7cba0ba3dbff7a2dffc5b6)

* [OCPBUGS-83496](https://issues.redhat.com/browse/OCPBUGS-83496): remove dev to admin links as dev monitoring views are enabled [#16174](https://github.com/openshift/console/pull/16174)
* [OCPBUGS-83496](https://issues.redhat.com/browse/OCPBUGS-83496): Temporarily skip the flaky Data Grid installation spec [#17354](https://github.com/openshift/console/pull/17354)
* [OCPBUGS-128641](https://issues.redhat.com/browse/OCPBUGS-128641): Wait for demo plugin deployment readiness [#17332](https://github.com/openshift/console/pull/17332)
* [OCPBUGS-111706](https://issues.redhat.com/browse/OCPBUGS-111706): Re-enable Knative Cypress e2e tests [#16906](https://github.com/openshift/console/pull/16906)
* [OCPBUGS-122013](https://issues.redhat.com/browse/OCPBUGS-122013): Validate chart URL in /api/helm/verify [#17154](https://github.com/openshift/console/pull/17154)
* Fix for OCPBUGS-92079: CVE-2026-44990 [#16716](https://github.com/openshift/console/pull/16716)
* [OCPBUGS-112275](https://issues.redhat.com/browse/OCPBUGS-112275): Fix flaky TestAsyncCache backend test [#17048](https://github.com/openshift/console/pull/17048)
* Fix OCPBUGS-98765: CVE-2026-48801 [#16855](https://github.com/openshift/console/pull/16855)
* [OCPBUGS-100516](https://issues.redhat.com/browse/OCPBUGS-100516), [OCPBUGS-101792](https://issues.redhat.com/browse/OCPBUGS-101792): Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss [#17057](https://github.com/openshift/console/pull/17057)
* [OCPBUGS-98428](https://issues.redhat.com/browse/OCPBUGS-98428): [release-4.19] CVE-2026-59869 bump js-yaml [#17007](https://github.com/openshift/console/pull/17007)
* [OCPBUGS-109139](https://issues.redhat.com/browse/OCPBUGS-109139): Fix leading whitespace in Quick Start execute code snippets [#17004](https://github.com/openshift/console/pull/17004)
* [OCPBUGS-100182](https://issues.redhat.com/browse/OCPBUGS-100182): fix trailing quote in prometheus query [#16884](https://github.com/openshift/console/pull/16884)
* [OCPBUGS-100068](https://issues.redhat.com/browse/OCPBUGS-100068): quickstart page i18n misses (Fix Quick Starts i18n bundle lookup for zh-CN)- #16869 [#16871](https://github.com/openshift/console/pull/16871)
* [OCPBUGS-86751](https://issues.redhat.com/browse/OCPBUGS-86751), [OCPBUGS-87083](https://issues.redhat.com/browse/OCPBUGS-87083), [OCPBUGS-88750](https://issues.redhat.com/browse/OCPBUGS-88750): [release-4.19] bump package: webpack-dev-server, protobufjs, fast-uri [#16727](https://github.com/openshift/console/pull/16727)
* [OCPBUGS-99486](https://issues.redhat.com/browse/OCPBUGS-99486): Disable Knative e2e Cypress tests in CI [#16802](https://github.com/openshift/console/pull/16802)
* [OCPBUGS-84285](https://issues.redhat.com/browse/OCPBUGS-84285): Bump follow-redirects to 1.16.0 to fix CVE-2026-40895 [#16672](https://github.com/openshift/console/pull/16672)
* Fix for OCPBUGS-81608: CVE-2026-4800 [#16562](https://github.com/openshift/console/pull/16562)
* [OCPBUGS-86454](https://issues.redhat.com/browse/OCPBUGS-86454): [release-4.19] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators [#16526](https://github.com/openshift/console/pull/16526)
* [OCPBUGS-97966](https://issues.redhat.com/browse/OCPBUGS-97966): Fix false positive scheduler degradation caused by user workloads [#16725](https://github.com/openshift/console/pull/16725)
* [OCPBUGS-90623](https://issues.redhat.com/browse/OCPBUGS-90623): Allow VolumeSnapshot restore when parent PVC is deleted [#16661](https://github.com/openshift/console/pull/16661)
* [OCPBUGS-89712](https://issues.redhat.com/browse/OCPBUGS-89712): Prevent binary secret data corruption when editing [#16640](https://github.com/openshift/console/pull/16640)
* [OCPBUGS-79451](https://issues.redhat.com/browse/OCPBUGS-79451): Bump immutable [#16324](https://github.com/openshift/console/pull/16324)
* [OCPBUGS-77126](https://issues.redhat.com/browse/OCPBUGS-77126): [release-4.19] CVE-2026-26996 Bump minimatch library [#16343](https://github.com/openshift/console/pull/16343)
* [OCPBUGS-85308](https://issues.redhat.com/browse/OCPBUGS-85308): [release-4.19] Backport OCPBUGS-78439: vsphere settings [#16413](https://github.com/openshift/console/pull/16413)
* [OCPBUGS-84772](https://issues.redhat.com/browse/OCPBUGS-84772): Add robots.txt policy to console [#16378](https://github.com/openshift/console/pull/16378)
* NO-JIRA: enable multi-architecture yarn builds [#16416](https://github.com/openshift/console/pull/16416)
* [OCPBUGS-84271](https://issues.redhat.com/browse/OCPBUGS-84271): Fix VolumeSnapshot and VolumeSnapshotContent table sorting [#16335](https://github.com/openshift/console/pull/16335)
* [OCPBUGS-81738](https://issues.redhat.com/browse/OCPBUGS-81738): Fix editing secrets with mixed text and binary data [#16257](https://github.com/openshift/console/pull/16257)
* [OCPBUGS-81736](https://issues.redhat.com/browse/OCPBUGS-81736): Migrate InstallPlan components table to PatternFly Table [#16256](https://github.com/openshift/console/pull/16256)
* [OCPBUGS-81574](https://issues.redhat.com/browse/OCPBUGS-81574): Clean up old session cookies to prevent accumulation [#16242](https://github.com/openshift/console/pull/16242)
* [Full changelog](https://github.com/openshift/console/compare/a0d0d1604bcaec19d8da60ab6aa5153969329068...8bcbe07d37cdf28d7c7cba0ba3dbff7a2dffc5b6)


### [console-operator](https://github.com/openshift/console-operator/tree/45c535c7efb115b1bc4d5e0156e884b451f02672)

* [OCPBUGS-103631](https://issues.redhat.com/browse/OCPBUGS-103631): Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 [#1222](https://github.com/openshift/console-operator/pull/1222)
* [NETOBSERV-2296](https://issues.redhat.com/browse/NETOBSERV-2296): add missing annotations on netobserv quickstart [#1094](https://github.com/openshift/console-operator/pull/1094)
* [OCPBUGS-98988](https://issues.redhat.com/browse/OCPBUGS-98988): [4.19] Stabilize telemetry config to prevent continuous console pod rollouts [#1193](https://github.com/openshift/console-operator/pull/1193)
* [Full changelog](https://github.com/openshift/console-operator/compare/034e4865824a6c10c48b912e8584bf7afb095852...45c535c7efb115b1bc4d5e0156e884b451f02672)


### [container-networking-plugins, containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins/tree/810a3b3f62b0c0c981813e2c8ee70ae24e30fca1)

* [OCPBUGS-85715](https://issues.redhat.com/browse/OCPBUGS-85715): CI Build root image tag sync with ART [#238](https://github.com/openshift/containernetworking-plugins/pull/238)
* [Full changelog](https://github.com/openshift/containernetworking-plugins/compare/b09f487cf0529098b2065ca169ae85ccec955796...810a3b3f62b0c0c981813e2c8ee70ae24e30fca1)


### [csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/cad695482eba6c96c5ab52e6c71188f44f85646f)

* [OCPBUGS-80490](https://issues.redhat.com/browse/OCPBUGS-80490): Bump google.golang.org/grpc [#386](https://github.com/openshift/cloud-provider-openstack/pull/386)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/5f3ccea6b322ae392c328f9aefa390747a7fa035...cad695482eba6c96c5ab52e6c71188f44f85646f)


### [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs/tree/f604d3542c65ba79c0980a335d6db9cbac7e32d1)

* [OCPBUGS-82805](https://issues.redhat.com/browse/OCPBUGS-82805): Bump github.com/moby/spdystream@v0.5.1 [#193](https://github.com/openshift/csi-driver-nfs/pull/193)
* [OCPBUGS-80434](https://issues.redhat.com/browse/OCPBUGS-80434): Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.75.1-sec.1 to avoid go version bump and fix CVE-2026-33186 [#178](https://github.com/openshift/csi-driver-nfs/pull/178)
* [Full changelog](https://github.com/openshift/csi-driver-nfs/compare/2eb5c109dd19f5a1b84410c0952db5cfaecb2f56...f604d3542c65ba79c0980a335d6db9cbac7e32d1)


### [csi-external-attacher](https://github.com/openshift/csi-external-attacher/tree/839536a03f5a2f337ec09090283468a6e2d5cd11)

* UPSTREAM: 110: OCPBUGS-103651: Bump golang.org/x/net to v0.43.0-sec.4 [#114](https://github.com/openshift/csi-external-attacher/pull/114)
* [OCPBUGS-80435](https://issues.redhat.com/browse/OCPBUGS-80435): Bump google.golang.org/grpc to v1.79.3 [#104](https://github.com/openshift/csi-external-attacher/pull/104)
* [Full changelog](https://github.com/openshift/csi-external-attacher/compare/a8175e3908635cc8357ac845a271f9e5b278c6aa...839536a03f5a2f337ec09090283468a6e2d5cd11)


### [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner/tree/37814acaa4dd92def6b71dcf9f090b54a796bf3e)

* [OCPBUGS-92905](https://issues.redhat.com/browse/OCPBUGS-92905): Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.41.0-sec.4 to address CVE-2026-46597 [#161](https://github.com/openshift/csi-external-provisioner/pull/161)
* [OCPBUGS-82806](https://issues.redhat.com/browse/OCPBUGS-82806): Address CVE-2026-35469 [#140](https://github.com/openshift/csi-external-provisioner/pull/140)
* [OCPBUGS-80436](https://issues.redhat.com/browse/OCPBUGS-80436): Bump google.golang.org/grpc [#129](https://github.com/openshift/csi-external-provisioner/pull/129)
* [Full changelog](https://github.com/openshift/csi-external-provisioner/compare/9db1cdb1e0dfbe29529561bbdb55b45bd2b1e321...37814acaa4dd92def6b71dcf9f090b54a796bf3e)


### [csi-external-resizer](https://github.com/openshift/csi-external-resizer/tree/b91b0d999bf775948c50a3416e7d7c26866cf2e8)

* [OCPBUGS-103650](https://issues.redhat.com/browse/OCPBUGS-103650): Bump golang.org/x/net to v0.43.0-sec.4 [#212](https://github.com/openshift/csi-external-resizer/pull/212)
* [OCPBUGS-80437](https://issues.redhat.com/browse/OCPBUGS-80437): Patching google.golang.org/grpc to v1.75.1 [#202](https://github.com/openshift/csi-external-resizer/pull/202)
* [Full changelog](https://github.com/openshift/csi-external-resizer/compare/ac275c3a81edcc4edf23aecf8974c9c23f2aaea9...b91b0d999bf775948c50a3416e7d7c26866cf2e8)


### [csi-external-snapshotter, csi-snapshot-controller](https://github.com/openshift/csi-external-snapshotter/tree/83a5d68520a603b42dc199e5b39a7bf6cf66622d)

* [OCPBUGS-127500](https://issues.redhat.com/browse/OCPBUGS-127500): [release-4.19] OCPBUGS-92084: UPSTREAM: 1392: Fix VolumeSnapshotContent deletion [#256](https://github.com/openshift/csi-external-snapshotter/pull/256)
* [OCPBUGS-103648](https://issues.redhat.com/browse/OCPBUGS-103648): Replace golang.org/x/net with github.com/openshift-sustaining/net v0.43.0-sec.3 [#237](https://github.com/openshift/csi-external-snapshotter/pull/237)
* [OCPBUGS-80438](https://issues.redhat.com/browse/OCPBUGS-80438), [OCPBUGS-80441](https://issues.redhat.com/browse/OCPBUGS-80441): Bump google.golang.org/grpc to v1.79.3 [#210](https://github.com/openshift/csi-external-snapshotter/pull/210)
* [Full changelog](https://github.com/openshift/csi-external-snapshotter/compare/580c6960cd665dfdc3d77538bb7744b8754aca26...83a5d68520a603b42dc199e5b39a7bf6cf66622d)


### [docker-builder](https://github.com/openshift/builder/tree/aee5284dce8e4134b27c32258d56aa13e34c7fe6)

* [OCPBUGS-89948](https://issues.redhat.com/browse/OCPBUGS-89948), [OCPBUGS-90373](https://issues.redhat.com/browse/OCPBUGS-90373), [OCPBUGS-92448](https://issues.redhat.com/browse/OCPBUGS-92448), [OCPBUGS-92619](https://issues.redhat.com/browse/OCPBUGS-92619), [OCPBUGS-92917](https://issues.redhat.com/browse/OCPBUGS-92917): Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 [#552](https://github.com/openshift/builder/pull/552)
* NO-JIRA: Bump Go builder image from 1.23 to 1.24 for OpenShift 4.19 [#536](https://github.com/openshift/builder/pull/536)
* [Full changelog](https://github.com/openshift/builder/compare/493200aed335b88aaec66f4d35622fef43eae47a...aee5284dce8e4134b27c32258d56aa13e34c7fe6)


### [docker-registry](https://github.com/openshift/image-registry/tree/8cbe7286f3bb1ceec33c6cb0acd265d441e032ed)

* [OCPBUGS-103654](https://issues.redhat.com/browse/OCPBUGS-103654): [relese-4.19] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#479](https://github.com/openshift/image-registry/pull/479)
* [Full changelog](https://github.com/openshift/image-registry/compare/53c4fd9d7448c1bad07cb45abfb47b25046deedc...8cbe7286f3bb1ceec33c6cb0acd265d441e032ed)


### [egress-router-cni](https://github.com/openshift/egress-router-cni/tree/b9ba5d49ffcd39bbd9a54033032496985bd99489)

* [OCPBUGS-99750](https://issues.redhat.com/browse/OCPBUGS-99750): Bump containernetworking/cni to v1.3.0 github.com/containernetworking/plugins to 1.4.0 [#108](https://github.com/openshift/egress-router-cni/pull/108)
* [Full changelog](https://github.com/openshift/egress-router-cni/compare/85353bb936a289b8b817f7b437afacdf7458c667...b9ba5d49ffcd39bbd9a54033032496985bd99489)


### [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp/tree/cc42384fe0834f4d1711bc4e2794fab2886f292f)

* [OCPBUGS-80451](https://issues.redhat.com/browse/OCPBUGS-80451): Bump google.golang.org/grpc to v1.79.3 [#289](https://github.com/openshift/cluster-api-provider-gcp/pull/289)
* [Full changelog](https://github.com/openshift/cluster-api-provider-gcp/compare/c8b865a1c4045a3b62dbf5ffea514f2c62d893f8...cc42384fe0834f4d1711bc4e2794fab2886f292f)


### [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp/tree/b0d2342531b789d9ba4b219549da783678a89500)

* [OCPBUGS-103685](https://issues.redhat.com/browse/OCPBUGS-103685): Bump golang.org/x/net to v0.43.0-sec.3 [#188](https://github.com/openshift/machine-api-provider-gcp/pull/188)
* [OCPBUGS-80473](https://issues.redhat.com/browse/OCPBUGS-80473): Bump google.golang.org/grpc to v1.79.3 [#164](https://github.com/openshift/machine-api-provider-gcp/pull/164)
* [Full changelog](https://github.com/openshift/machine-api-provider-gcp/compare/4fd69cf5c0b71fb477271c69d6ddd4b276b18092...b0d2342531b789d9ba4b219549da783678a89500)


### [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver/tree/68f780b93df28977b0f0569814b14d7db2500edb)

* [OCPBUGS-80455](https://issues.redhat.com/browse/OCPBUGS-80455): Bump google.golang.org/grpc to v1.79.3 in release-4.19 [#110](https://github.com/openshift/gcp-pd-csi-driver/pull/110)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver/compare/cdaddac53f3a5624216a0b8a08953a3d5d572a9d...68f780b93df28977b0f0569814b14d7db2500edb)


### [gcp-pd-csi-driver-operator](https://github.com/openshift/gcp-pd-csi-driver-operator/tree/19962336d00de10a9e173dbae33973a1abcaeb3f)

* [OCPBUGS-80454](https://issues.redhat.com/browse/OCPBUGS-80454): Replace google.golang.org/grpc with fork [#186](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/186)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver-operator/compare/44c74f24fba97b4afdbac55c9e77eb50eb21a4d1...19962336d00de10a9e173dbae33973a1abcaeb3f)


### [haproxy-router](https://github.com/openshift/router/tree/f0d97a0ddaccf153648fee10067bdd146aa00c77)

* [OCPBUGS-86727](https://issues.redhat.com/browse/OCPBUGS-86727): Prevent SSRF via FQDN-typed EndpointSlices [#820](https://github.com/openshift/router/pull/820)
* [OCPBUGS-86716](https://issues.redhat.com/browse/OCPBUGS-86716): Strip X-SSL-* headers for plain HTTP [#799](https://github.com/openshift/router/pull/799)
* [OCPBUGS-80456](https://issues.redhat.com/browse/OCPBUGS-80456): Bump google.golang.org/grpc to v1.79.3 [#767](https://github.com/openshift/router/pull/767)
* [Full changelog](https://github.com/openshift/router/compare/5fe8cc069b2f44b3393545ac92c3201e8a87d82b...f0d97a0ddaccf153648fee10067bdd146aa00c77)


### [hyperkube, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/63adf010aa20e104c0b7043b47f42f50c9f72b17)

* [OCPBUGS-82786](https://issues.redhat.com/browse/OCPBUGS-82786), [OCPBUGS-82814](https://issues.redhat.com/browse/OCPBUGS-82814): Address CVE-2026-35469 [#2680](https://github.com/openshift/kubernetes/pull/2680)
* [Full changelog](https://github.com/openshift/kubernetes/compare/a674efabac8b5044e6256ce4e2385914be215376...63adf010aa20e104c0b7043b47f42f50c9f72b17)


### [hypershift](https://github.com/openshift/hypershift/tree/41d850819ce18f21e08e34b4039873251c5a208b)

* [OCPBUGS-120749](https://issues.redhat.com/browse/OCPBUGS-120749): update Containerfile.cli runtime base image to floating tag [release-4.19] [#9559](https://github.com/openshift/hypershift/pull/9559)
* [OCPBUGS-76287](https://issues.redhat.com/browse/OCPBUGS-76287): CVE-2025-52881 openshift/hypershift multicluster-engine/hypershift-rhel9-operator: container escape and denial of service due to arbitrary write gadgets and procfs write redirects [mce-2.9] [#8282](https://github.com/openshift/hypershift/pull/8282)
* [OCPBUGS-99116](https://issues.redhat.com/browse/OCPBUGS-99116): fix(backport): konnectivity agent auth [#9094](https://github.com/openshift/hypershift/pull/9094)
* [OCPBUGS-89355](https://issues.redhat.com/browse/OCPBUGS-89355): build(operator): drop hypershift-no-cgo from operator container images [#8759](https://github.com/openshift/hypershift/pull/8759)
* NO-JIRA: fix(tekton): remove path filter from control-plane-operator pipelines [#8664](https://github.com/openshift/hypershift/pull/8664)
* [OCPBUGS-85623](https://issues.redhat.com/browse/OCPBUGS-85623): fix CVE-2026-33186 by replacing grpc-go [#8512](https://github.com/openshift/hypershift/pull/8512)
* [OCPBUGS-84143](https://issues.redhat.com/browse/OCPBUGS-84143): fix(cno): use brackets only for IPv6 in server URL [#8345](https://github.com/openshift/hypershift/pull/8345)
* [Full changelog](https://github.com/openshift/hypershift/compare/5b151f06d8bfaa8a4594d8c2c748b8d4463163dd...41d850819ce18f21e08e34b4039873251c5a208b)


### [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm/tree/b916c603eadf504f816303640cf763b59e30266b)

* [OCPBUGS-120698](https://issues.redhat.com/browse/OCPBUGS-120698): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#113](https://github.com/openshift/cloud-provider-ibm/pull/113)
* [Full changelog](https://github.com/openshift/cloud-provider-ibm/compare/7422aab27110768d8604539b9bb01ca329ff70b7...b916c603eadf504f816303640cf763b59e30266b)


### [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver/tree/7923f6c19410d90324a22e34b7eb7ee2dae8197c)

* [OCPBUGS-80461](https://issues.redhat.com/browse/OCPBUGS-80461): Bump google.golang.org/grpc to v1.79.3 [#142](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/142)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver/compare/93126b6c4d8b1488a8b5e08f63af38625b90ca7a...7923f6c19410d90324a22e34b7eb7ee2dae8197c)


### [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/tree/b00f472da1ed8f361bfa7ff994e411d87ef636f6)

* [OCPBUGS-103677](https://issues.redhat.com/browse/OCPBUGS-103677): Use patched x/net fork v0.43.0-sec.4 [#190](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/190)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/compare/3dfcfa12e31bccd7c43018e1324a391b0bc03244...b00f472da1ed8f361bfa7ff994e411d87ef636f6)


### [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud/tree/9878e8a46b85f6508df64e1dca7f61e991177502)

* [OCPBUGS-103676](https://issues.redhat.com/browse/OCPBUGS-103676): Replace golang.org/x/net with openshift-sustaining/net [#173](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/173)
* [Full changelog](https://github.com/openshift/cluster-api-provider-ibmcloud/compare/940ac1c27e5548f738219b8c2ea4d1b6924e60e5...9878e8a46b85f6508df64e1dca7f61e991177502)


### [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud/tree/301c962bf0ad72233aaaf4c5df3ec5c559c142b6)

* [OCPBUGS-103680](https://issues.redhat.com/browse/OCPBUGS-103680): replace golang.org/x/net with openshift-sustaining/net v0.43.0-sec.4 [#103](https://github.com/openshift/machine-api-provider-ibmcloud/pull/103)
* [Full changelog](https://github.com/openshift/machine-api-provider-ibmcloud/compare/bdbc75c1786a8a58e7d1a9c24db95e6a5a334266...301c962bf0ad72233aaaf4c5df3ec5c559c142b6)


### [insights-operator](https://github.com/openshift/insights-operator/tree/ad827886f3dc7052dcc880a0b1af44d8be8a2cff)

* [OCPBUGS-103682](https://issues.redhat.com/browse/OCPBUGS-103682): Bump golang.org/x/net to v0.43.0-sec.3 [#1354](https://github.com/openshift/insights-operator/pull/1354)
* [OCPBUGS-112750](https://issues.redhat.com/browse/OCPBUGS-112750): secrets and configmap revisions count gathering [#1350](https://github.com/openshift/insights-operator/pull/1350)
* [OCPBUGS-105424](https://issues.redhat.com/browse/OCPBUGS-105424): Fix indentation bug on livenessProbe [#1340](https://github.com/openshift/insights-operator/pull/1340)
* [OCPBUGS-99987](https://issues.redhat.com/browse/OCPBUGS-99987): update HyperShift deployment manifest [#1328](https://github.com/openshift/insights-operator/pull/1328)
* [OCPBUGS-88482](https://issues.redhat.com/browse/OCPBUGS-88482): [release-4.19] extractor-controller [#1306](https://github.com/openshift/insights-operator/pull/1306)
* [OCPBUGS-87808](https://issues.redhat.com/browse/OCPBUGS-87808): add config option to disable runtime extractor [#1303](https://github.com/openshift/insights-operator/pull/1303)
* [OCPBUGS-80464](https://issues.redhat.com/browse/OCPBUGS-80464): Bump google.golang.org/grpc to v1.79.3 [#1282](https://github.com/openshift/insights-operator/pull/1282)
* [OCPBUGS-83563](https://issues.redhat.com/browse/OCPBUGS-83563): kubeletconfig gatherer [#1272](https://github.com/openshift/insights-operator/pull/1272)
* [Full changelog](https://github.com/openshift/insights-operator/compare/3ee147867a3ee800f0e66571552965da98c990b7...ad827886f3dc7052dcc880a0b1af44d8be8a2cff)


### [ironic](https://github.com/openshift/ironic-image/tree/bf69786af61add2098597da5a14d3da1991d3798)

* [OCPBUGS-88476](https://issues.redhat.com/browse/OCPBUGS-88476): Updating openstack-ironic commit that fixes CVE-2026-43003 [#896](https://github.com/openshift/ironic-image/pull/896)
* [OCPBUGS-100165](https://issues.redhat.com/browse/OCPBUGS-100165): Update openstack-ironic commit hash for CVE-2026-44918 [#882](https://github.com/openshift/ironic-image/pull/882)
* [OCPBUGS-84855](https://issues.redhat.com/browse/OCPBUGS-84855): Bump pyasn1 to 0.5.1-4 [#825](https://github.com/openshift/ironic-image/pull/825)
* [Full changelog](https://github.com/openshift/ironic-image/compare/98c6998c67cf8205135d7180c36f95a1fd4ebdc7...bf69786af61add2098597da5a14d3da1991d3798)


### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/9a24b3300c400fae2e35c1958f45c189bc394ad4)

* [OCPBUGS-99885](https://issues.redhat.com/browse/OCPBUGS-99885): Bump ironic-python-agent pinned commit for CVE-2026-66138 [#307](https://github.com/openshift/ironic-agent-image/pull/307)
* [OCPBUGS-88476](https://issues.redhat.com/browse/OCPBUGS-88476): Update ironic-python-agent commit that fixes CVE-2026-43003 [#304](https://github.com/openshift/ironic-agent-image/pull/304)
* [OCPBUGS-95065](https://issues.redhat.com/browse/OCPBUGS-95065): Replace individual package removal with a single rpm -e loop [#285](https://github.com/openshift/ironic-agent-image/pull/285)
* [OCPBUGS-95065](https://issues.redhat.com/browse/OCPBUGS-95065): Replace dnf remove with rpm -e to prevent dependency removal [#273](https://github.com/openshift/ironic-agent-image/pull/273)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/d7f33593262aadda98c83a369cad2e3ee92054ad...9a24b3300c400fae2e35c1958f45c189bc394ad4)


### [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server/tree/a20f305638fa4c06b9a1e6a99458fd180d3b83d7)

* NO-ISSUE: synchronize OWNERS from main branch [release-4.19] [#84](https://github.com/openshift/kubernetes-metrics-server/pull/84)
* [OCPBUGS-80365](https://issues.redhat.com/browse/OCPBUGS-80365): Bump google.golang.org/grpc to v1.79.3 [#63](https://github.com/openshift/kubernetes-metrics-server/pull/63)
* [Full changelog](https://github.com/openshift/kubernetes-metrics-server/compare/037a0e7e4ef401cd81d3e8330eeed26c8c753592...a20f305638fa4c06b9a1e6a99458fd180d3b83d7)


### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/e5dfce12e8ccb858df67f46b41200f0746982161)

* NO-ISSUE: synchronize OWNERS from main branch [release-4.19] [#193](https://github.com/openshift/kube-state-metrics/pull/193)
* [OCPBUGS-99405](https://issues.redhat.com/browse/OCPBUGS-99405): fix CronJob timezone panic and embed tzdata in kube-state-metrics [#154](https://github.com/openshift/kube-state-metrics/pull/154)
* [Full changelog](https://github.com/openshift/kube-state-metrics/compare/c3da3b5fdc5bd2d23966e33b676701a4950b1a53...e5dfce12e8ccb858df67f46b41200f0746982161)


### [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt/tree/f0ff269ad70900ec841e2e47a9d92e6703bc6539)

* [OCPBUGS-78392](https://issues.redhat.com/browse/OCPBUGS-78392): Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 4.19 [#63](https://github.com/openshift/cloud-provider-kubevirt/pull/63)
* [OCPBUGS-78392](https://issues.redhat.com/browse/OCPBUGS-78392): Regenerate go.sum to fix verify-deps [#85](https://github.com/openshift/cloud-provider-kubevirt/pull/85)
* [OCPBUGS-95085](https://issues.redhat.com/browse/OCPBUGS-95085): OWNERS: Update component to Cloud Compute / KubeVirt Provider [#84](https://github.com/openshift/cloud-provider-kubevirt/pull/84)
* [Full changelog](https://github.com/openshift/cloud-provider-kubevirt/compare/3f4542ecd17fb0e47da4c6d9bceb076b98fb314b...f0ff269ad70900ec841e2e47a9d92e6703bc6539)


### [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver/tree/f7dbbba1f6134ac84ad00e6849003a75c4b4a076)

* [OCPBUGS-80366](https://issues.redhat.com/browse/OCPBUGS-80366): Bump google.golang.org/grpc to v1.79.3 [#100](https://github.com/openshift/kubevirt-csi-driver/pull/100)
* [Full changelog](https://github.com/openshift/kubevirt-csi-driver/compare/765abeccb884627e903e2b9b9d27055fd7e06b69...f7dbbba1f6134ac84ad00e6849003a75c4b4a076)


### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/ac319ca48579f088890de554bdd7fdf8235d07c0)

* [OCPBUGS-103684](https://issues.redhat.com/browse/OCPBUGS-103684): replace golang.org/x/net with openshift-sustaining/net@v0.43.0-sec.4 [#1544](https://github.com/openshift/machine-api-operator/pull/1544)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/d89af39e4ddb9b0a89d400664cb496e505e71991...ac319ca48579f088890de554bdd7fdf8235d07c0)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/725b0f0df6b353683550c008e232a3012f6b8024)

* [OCPBUGS-103699](https://issues.redhat.com/browse/OCPBUGS-103699): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#6506](https://github.com/openshift/machine-config-operator/pull/6506)
* [OCPBUGS-128824](https://issues.redhat.com/browse/OCPBUGS-128824): [Release-4.19] Degraded MCP as generated-kubelet is generated with an old controller version [#6612](https://github.com/openshift/machine-config-operator/pull/6612)
* [OCPBUGS-122228](https://issues.redhat.com/browse/OCPBUGS-122228): Update message for MachineOSBuildFailed condition [#6527](https://github.com/openshift/machine-config-operator/pull/6527)
* [OCPBUGS-120741](https://issues.redhat.com/browse/OCPBUGS-120741): [manual cherry-pick of #6446] Use kubernetes scheme in drain controller event recorder [#6499](https://github.com/openshift/machine-config-operator/pull/6499)
* [OCPBUGS-116942](https://issues.redhat.com/browse/OCPBUGS-116942): Update AMI Whitelist [#6488](https://github.com/openshift/machine-config-operator/pull/6488)
* [OCPBUGS-105427](https://issues.redhat.com/browse/OCPBUGS-105427): Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole [#6384](https://github.com/openshift/machine-config-operator/pull/6384)
* [OCPBUGS-105216](https://issues.redhat.com/browse/OCPBUGS-105216): Update AMI Whitelist [#6378](https://github.com/openshift/machine-config-operator/pull/6378)
* [OCPBUGS-93808](https://issues.redhat.com/browse/OCPBUGS-93808): move cleanUpDuplicatedMC to avoid double reboot on first updated Master node [#6243](https://github.com/openshift/machine-config-operator/pull/6243)
* [OCPBUGS-98103](https://issues.redhat.com/browse/OCPBUGS-98103): Remove sensitive ControllerConfig logging [#6287](https://github.com/openshift/machine-config-operator/pull/6287)
* [OCPBUGS-95589](https://issues.redhat.com/browse/OCPBUGS-95589): Bootstrap MCS logging entire ignition [#6258](https://github.com/openshift/machine-config-operator/pull/6258)
* [OCPBUGS-95273](https://issues.redhat.com/browse/OCPBUGS-95273): Update custom containerfile OCB test to work in a disconnected environment [#6255](https://github.com/openshift/machine-config-operator/pull/6255)
* [OCPBUGS-96167](https://issues.redhat.com/browse/OCPBUGS-96167): Update AMI Whitelist [#6263](https://github.com/openshift/machine-config-operator/pull/6263)
* [OCPBUGS-88566](https://issues.redhat.com/browse/OCPBUGS-88566): Verify extension packages are installed [#6182](https://github.com/openshift/machine-config-operator/pull/6182)
* [OCPBUGS-86986](https://issues.redhat.com/browse/OCPBUGS-86986): Update AMI Whitelist [#6131](https://github.com/openshift/machine-config-operator/pull/6131)
* [OCPBUGS-86650](https://issues.redhat.com/browse/OCPBUGS-86650): Apply password only if changes exist [#6097](https://github.com/openshift/machine-config-operator/pull/6097)
* [OCPBUGS-86575](https://issues.redhat.com/browse/OCPBUGS-86575): use --delete-if-present for karg removal [#6088](https://github.com/openshift/machine-config-operator/pull/6088)
* [OCPBUGS-86586](https://issues.redhat.com/browse/OCPBUGS-86586): Fix re-cordon detection [#6093](https://github.com/openshift/machine-config-operator/pull/6093)
* [OCPBUGS-86233](https://issues.redhat.com/browse/OCPBUGS-86233): Fix ssh and password rollbacks [#6069](https://github.com/openshift/machine-config-operator/pull/6069)
* [OCPBUGS-66284](https://issues.redhat.com/browse/OCPBUGS-66284): Set -fin timeouts in HAProxy config [#5461](https://github.com/openshift/machine-config-operator/pull/5461)
* [OCPBUGS-86165](https://issues.redhat.com/browse/OCPBUGS-86165): Add terminationMessagePolicy to build pod containers [#6064](https://github.com/openshift/machine-config-operator/pull/6064)
* [OCPBUGS-85581](https://issues.redhat.com/browse/OCPBUGS-85581): Fix units rollback if update failure [#6039](https://github.com/openshift/machine-config-operator/pull/6039)
* [OCPBUGS-85018](https://issues.redhat.com/browse/OCPBUGS-85018): Update AMI Whitelist [#5997](https://github.com/openshift/machine-config-operator/pull/5997)
* [OCPBUGS-84042](https://issues.redhat.com/browse/OCPBUGS-84042): Update AMI Whitelist [#5871](https://github.com/openshift/machine-config-operator/pull/5871)
* [release 4.19] OCPBUGS-81289: Calculate machine counts in MCP status from node properties [#5823](https://github.com/openshift/machine-config-operator/pull/5823)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/c6d2a0384998bb4d60b12d06673d07ed8eea293b...725b0f0df6b353683550c008e232a3012f6b8024)


### [machine-image-customization-controller](https://github.com/openshift/image-customization-controller/tree/346df973c99aaba561f1cc5c84e8d1db17fe3152)

* [OCPBUGS-103675](https://issues.redhat.com/browse/OCPBUGS-103675): Replace golang.org/x/net with openshift-sustaining/net v0.43.0-sec.4 for CVE-2026-33814 [#198](https://github.com/openshift/image-customization-controller/pull/198)
* [Full changelog](https://github.com/openshift/image-customization-controller/compare/6d34fbab6ca22e74eb1761278f05d28c42518d8a...346df973c99aaba561f1cc5c84e8d1db17fe3152)


### [machine-os-images](https://github.com/openshift/machine-os-images/tree/147cdd71cfee75248abb8138990e82ea8376b3d4)

* [OCPBUGS-87875](https://issues.redhat.com/browse/OCPBUGS-87875): Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs [#99](https://github.com/openshift/machine-os-images/pull/99)
* [Full changelog](https://github.com/openshift/machine-os-images/compare/32b5f16c7f59698b40cc2a23116804d9067824d2...147cdd71cfee75248abb8138990e82ea8376b3d4)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/66f6d880f9566ea3216cb03ac194a45c913a3ff0)

* [OCPBUGS-130731](https://issues.redhat.com/browse/OCPBUGS-130731): escape regex variable values in regex matcher contexts [#1357](https://github.com/openshift/monitoring-plugin/pull/1357)
* [OCPBUGS-118234](https://issues.redhat.com/browse/OCPBUGS-118234): [release-4.19] Bump fast-uri to 3.1.7 to fix CVE-2026-84292 [#1335](https://github.com/openshift/monitoring-plugin/pull/1335)
* [OU-1392](https://issues.redhat.com/browse/OU-1392): [release-4.19] fix: parse datetime ranges from the specified format rather than browser specific apis- #1352 [#1354](https://github.com/openshift/monitoring-plugin/pull/1354)
* [OU-1528](https://issues.redhat.com/browse/OU-1528): [release-4.19] Optimize namespace changes in Alerts [#1309](https://github.com/openshift/monitoring-plugin/pull/1309)
* [OCPBUGS-103703](https://issues.redhat.com/browse/OCPBUGS-103703): CVE-2026-33814-4-19 openshift4/ose-monitoring-plugin-rhel9: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.19] [#1216](https://github.com/openshift/monitoring-plugin/pull/1216)
* NO-JIRA: [release-4.19] Sanitize alert runbook URLs [#1291](https://github.com/openshift/monitoring-plugin/pull/1291)
* [OCPBUGS-98783](https://issues.redhat.com/browse/OCPBUGS-98783): [release-4.19] replace outdated react-linkify dependency [#1167](https://github.com/openshift/monitoring-plugin/pull/1167)
* Fix for OCPBUGS-89704: CVE-2026-12143 [#1152](https://github.com/openshift/monitoring-plugin/pull/1152)
* [OCPBUGS-99026](https://issues.redhat.com/browse/OCPBUGS-99026): Fix CVE-2026-49978 - bump DOMPurify to >= 3.4.7 [#1088](https://github.com/openshift/monitoring-plugin/pull/1088)
* [OU-1240](https://issues.redhat.com/browse/OU-1240): Makefile and package.json to enable test-frontend-ci [#1097](https://github.com/openshift/monitoring-plugin/pull/1097)
* [OU-1240](https://issues.redhat.com/browse/OU-1240): Dockerfile.test permission [#1082](https://github.com/openshift/monitoring-plugin/pull/1082)
* [OCPBUGS-99306](https://issues.redhat.com/browse/OCPBUGS-99306): graph redirect query parameter [#1075](https://github.com/openshift/monitoring-plugin/pull/1075)
* Fix for OCPBUGS-91617: CVE-2026-45736 [#1026](https://github.com/openshift/monitoring-plugin/pull/1026)
* [OU-651](https://issues.redhat.com/browse/OU-651): Fix AlertRules page to display user defined loki alerts [#1059](https://github.com/openshift/monitoring-plugin/pull/1059)
* Fix for OCPBUGS-94010: CVE-2026-13676 [#1031](https://github.com/openshift/monitoring-plugin/pull/1031)
* NO-JIRA: fix incidents unit test [#1040](https://github.com/openshift/monitoring-plugin/pull/1040)
* [OCPBUGS-87084](https://issues.redhat.com/browse/OCPBUGS-87084): [release-4.19] fast-uri: URI authority bypass due to improper delimiter handling [#993](https://github.com/openshift/monitoring-plugin/pull/993)
* [OCPBUGS-84288](https://issues.redhat.com/browse/OCPBUGS-84288): bump follow-redirects to 1.16.0 [#988](https://github.com/openshift/monitoring-plugin/pull/988)
* [OCPBUGS-86923](https://issues.redhat.com/browse/OCPBUGS-86923): Updating monitoring-plugin-container image to be consistent with ART for 4.19 [#970](https://github.com/openshift/monitoring-plugin/pull/970)
* [OCPBUGS-79452](https://issues.redhat.com/browse/OCPBUGS-79452): immutable bump: fix for CVE-2026-29063 [4.19] [#952](https://github.com/openshift/monitoring-plugin/pull/952)
* [OU-1372](https://issues.redhat.com/browse/OU-1372): reset queries when namespace changes in dev perspective [#950](https://github.com/openshift/monitoring-plugin/pull/950)
* [OU-1370](https://issues.redhat.com/browse/OU-1370): prevent namespace and project desync [#944](https://github.com/openshift/monitoring-plugin/pull/944)
* [OCPBUGS-83496](https://issues.redhat.com/browse/OCPBUGS-83496): [release-4.19] feat: re enable dev console views [#858](https://github.com/openshift/monitoring-plugin/pull/858)
* [OCPBUGS-83300](https://issues.redhat.com/browse/OCPBUGS-83300): [release-4.19] openshift4/ose-monitoring-plugin-rhel9: Axios: Remote Code Execution via Prototype Pollution escalation [#889](https://github.com/openshift/monitoring-plugin/pull/889)
* [OCPBUGS-82520](https://issues.redhat.com/browse/OCPBUGS-82520): fix: re encode params when redirecting from graph to query-browser [#874](https://github.com/openshift/monitoring-plugin/pull/874)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/8b4e419fee2b4438ec95e77ff4411d0882ec5bf1...66f6d880f9566ea3216cb03ac194a45c913a3ff0)


### [multus-admission-controller](https://github.com/openshift/multus-admission-controller/tree/6b99f73434be96d97e631872537d75cd3150136d)

* [OCPBUGS-103694](https://issues.redhat.com/browse/OCPBUGS-103694): bump golang.org/x/net to v0.35.0-sec.3 to fix CVE-2026-33814 [#133](https://github.com/openshift/multus-admission-controller/pull/133)
* [Full changelog](https://github.com/openshift/multus-admission-controller/compare/381c36baaad8e45ba10cca43aeeaf00dfc907462...6b99f73434be96d97e631872537d75cd3150136d)


### [multus-cni, multus-cni-microshift](https://github.com/openshift/multus-cni/tree/bea995092ab1fa875fa237a06f4eaa60a7bb2c90)

* [OCPBUGS-103706](https://issues.redhat.com/browse/OCPBUGS-103706), [OCPBUGS-103709](https://issues.redhat.com/browse/OCPBUGS-103709): [release-4.19] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame- #355 [#356](https://github.com/openshift/multus-cni/pull/356)
* [OCPBUGS-85248](https://issues.redhat.com/browse/OCPBUGS-85248): Fix server url in kubeconfig [#288](https://github.com/openshift/multus-cni/pull/288)
* NO-ISSUE: [release-4.19] fix CI build root image [#289](https://github.com/openshift/multus-cni/pull/289)
* [Full changelog](https://github.com/openshift/multus-cni/compare/cf0f68ec2b5fe9bc72d0da325e02cf63968747fe...bea995092ab1fa875fa237a06f4eaa60a7bb2c90)


### [must-gather](https://github.com/openshift/must-gather/tree/cbe044bce8937a811d97719e13b1459d9e8b1fb0)

* [OCPBUGS-85578](https://issues.redhat.com/browse/OCPBUGS-85578): Collect object size with the object count [#546](https://github.com/openshift/must-gather/pull/546)
* [Full changelog](https://github.com/openshift/must-gather/compare/b8318d0796b685953b495fc9dcbbc0a6c411b1b6...cbe044bce8937a811d97719e13b1459d9e8b1fb0)


### [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon/tree/a54952687391e32b8ddd2e9fa5c2eb765feac6b2)

* [OCPBUGS-103710](https://issues.redhat.com/browse/OCPBUGS-103710): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 [#152](https://github.com/openshift/network-metrics-daemon/pull/152)
* [Full changelog](https://github.com/openshift/network-metrics-daemon/compare/89e4882698653fdd80fcee2e9d92e668cb02d2d1...a54952687391e32b8ddd2e9fa5c2eb765feac6b2)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/08858fc34813b91a5e9bcdc4f3a4d631dfd2540d)

* maintenance: Bump the npm group with 20 updates [#600](https://github.com/openshift/networking-console-plugin/pull/600)
* [OCPNETUI-158](https://issues.redhat.com/browse/OCPNETUI-158): dependency cleanup [#588](https://github.com/openshift/networking-console-plugin/pull/588)
* [OCPNETUI-158](https://issues.redhat.com/browse/OCPNETUI-158): reassign dev and prod dependencies [#587](https://github.com/openshift/networking-console-plugin/pull/587)
* maintenance: Bump the npm group with 23 updates [#573](https://github.com/openshift/networking-console-plugin/pull/573)
* maintenance: Bump the npm group across 1 directory with 24 updates [#570](https://github.com/openshift/networking-console-plugin/pull/570)
* [OCPNETUI-158](https://issues.redhat.com/browse/OCPNETUI-158): Align shared modules with Console [#568](https://github.com/openshift/networking-console-plugin/pull/568)
* maintenance: Bump the npm group with 15 updates [#551](https://github.com/openshift/networking-console-plugin/pull/551)
* maintenance: Bump the npm group across 1 directory with 20 updates [#534](https://github.com/openshift/networking-console-plugin/pull/534)
* maintenance: Bump the npm group with 246 updates [#509](https://github.com/openshift/networking-console-plugin/pull/509)
* [OCPNETUI-82](https://issues.redhat.com/browse/OCPNETUI-82): Lower Dockerfile base image versions [#520](https://github.com/openshift/networking-console-plugin/pull/520)
* [OCPBUGS-98778](https://issues.redhat.com/browse/OCPBUGS-98778): Updating linkify-it to 5.0.2 to fix CVE-2026-48801 [#461](https://github.com/openshift/networking-console-plugin/pull/461)
* [OCPBUGS-60277](https://issues.redhat.com/browse/OCPBUGS-60277): fixed broken link in empty state [#441](https://github.com/openshift/networking-console-plugin/pull/441)
* [OCPBUGS-41605](https://issues.redhat.com/browse/OCPBUGS-41605): Retain namespace selection between network policies tabs [#422](https://github.com/openshift/networking-console-plugin/pull/422)
* [OCPBUGS-83384](https://issues.redhat.com/browse/OCPBUGS-83384): Fix CVE-2026-34043 in serialize-javascript [#395](https://github.com/openshift/networking-console-plugin/pull/395)
* [release-4:19] OCPBUGS-84634: Migration from yarn to npm [#398](https://github.com/openshift/networking-console-plugin/pull/398)
* [OCPBUGS-66279](https://issues.redhat.com/browse/OCPBUGS-66279), [OCPBUGS-67251](https://issues.redhat.com/browse/OCPBUGS-67251): fix node-forge by upgrading webpack-dev-server: ^4.7.4 → ^5.2.3" [#410](https://github.com/openshift/networking-console-plugin/pull/410)
* [OCPBUGS-73654](https://issues.redhat.com/browse/OCPBUGS-73654): CVE-2026-22029 fix to @remix-run/router to 1.23.2 [#405](https://github.com/openshift/networking-console-plugin/pull/405)
* [OCPBUGS-81610](https://issues.redhat.com/browse/OCPBUGS-81610): Fix CVE-2026-CVE-2026-4800 in lodash [#400](https://github.com/openshift/networking-console-plugin/pull/400)
* [OCPBUGS-79453](https://issues.redhat.com/browse/OCPBUGS-79453): Bump immutable [#391](https://github.com/openshift/networking-console-plugin/pull/391)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/6e1a6e53741b2f92983baf3433df64f4fe8e6e07...08858fc34813b91a5e9bcdc4f3a4d631dfd2540d)


### [oauth-proxy](https://github.com/openshift/oauth-proxy/tree/82eb187790297c4d73eee12906831ac26dc47531)

* [OCPBUGS-112092](https://issues.redhat.com/browse/OCPBUGS-112092): bugfix: rewrite open redirect strings to '/' [#383](https://github.com/openshift/oauth-proxy/pull/383)
* [Full changelog](https://github.com/openshift/oauth-proxy/compare/f74e8e006cd47ae9b7cab525796f53af8fb1da9c...82eb187790297c4d73eee12906831ac26dc47531)


### [oauth-server](https://github.com/openshift/oauth-server/tree/9a4045d315d6af48647dcb3c7344b656a1cd95f1)

* [OCPBUGS-87074](https://issues.redhat.com/browse/OCPBUGS-87074): bugfix: default to english when Accept-Language header contains more than 1000 underscores [#271](https://github.com/openshift/oauth-server/pull/271)
* [OCPBUGS-81808](https://issues.redhat.com/browse/OCPBUGS-81808): Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 [#237](https://github.com/openshift/oauth-server/pull/237)
* [Full changelog](https://github.com/openshift/oauth-server/compare/eafa143a67a0ba86439f96ceb6a1ca9d2b3815e3...9a4045d315d6af48647dcb3c7344b656a1cd95f1)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/7d72c0d980256b905282d35dd507b618b63dae1a)

* [OCPBUGS-129461](https://issues.redhat.com/browse/OCPBUGS-129461): v1 accept catalog root entries and relative symlink targets [#1577](https://github.com/openshift/oc-mirror/pull/1577)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/9700b486d6b4b4625060caef2c2804c429d676fb...7d72c0d980256b905282d35dd507b618b63dae1a)


### [olm-catalogd, olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller/tree/ec1174c7663e357dbace86033780ab1f1a74225f)

* [OCPBUGS-129018](https://issues.redhat.com/browse/OCPBUGS-129018): [release-4.19] clean up orphaned catalog cache temp dirs [#817](https://github.com/openshift/operator-framework-operator-controller/pull/817)
* [OCPBUGS-103696](https://issues.redhat.com/browse/OCPBUGS-103696), [OCPBUGS-103702](https://issues.redhat.com/browse/OCPBUGS-103702): Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#803](https://github.com/openshift/operator-framework-operator-controller/pull/803)
* [OCPBUGS-104519](https://issues.redhat.com/browse/OCPBUGS-104519): Fix cache path to avoid /var/cache/dnf conflict [#789](https://github.com/openshift/operator-framework-operator-controller/pull/789)
* [OCPBUGS-100313](https://issues.redhat.com/browse/OCPBUGS-100313): increase catalog HTTP client timeout from 10s to 5m [#784](https://github.com/openshift/operator-framework-operator-controller/pull/784)
* [OCPBUGS-87180](https://issues.redhat.com/browse/OCPBUGS-87180): [release-4.19] catalogd: clean up orphaned temp dirs in catalog storage [#748](https://github.com/openshift/operator-framework-operator-controller/pull/748)
* [OCPBUGS-80484](https://issues.redhat.com/browse/OCPBUGS-80484), [OCPBUGS-80485](https://issues.redhat.com/browse/OCPBUGS-80485): Update grpc to v1.75.1-sec.1 to fix CVE-2026-33186 [#731](https://github.com/openshift/operator-framework-operator-controller/pull/731)
* [Full changelog](https://github.com/openshift/operator-framework-operator-controller/compare/4b3ad172bc6e39f82cf1a1925df2cd1ef294d0d8...ec1174c7663e357dbace86033780ab1f1a74225f)


### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/0a0123dc2dfb4a9148c1d0b3c032034555eb8969)

* [OCPBUGS-82820](https://issues.redhat.com/browse/OCPBUGS-82820): Address CVE-2026-35469 [#647](https://github.com/openshift/openshift-apiserver/pull/647)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/a5eb0298114e532b8b1e3cca74e3c263136892ac...0a0123dc2dfb4a9148c1d0b3c032034555eb8969)


### [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack/tree/bd1fc7041d18f108120a86a4429c4f45b624b04b)

* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.12 into release-4.19 [#393](https://github.com/openshift/cluster-api-provider-openstack/pull/393)
* [Full changelog](https://github.com/openshift/cluster-api-provider-openstack/compare/4e7f9611b32128a93fac36d2ea554a931dfe4f85...bd1fc7041d18f108120a86a4429c4f45b624b04b)


### [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack/tree/bc4fe51daf4f4a9329ec15745b0b3b9188f23729)

* [OCPBUGS-94015](https://issues.redhat.com/browse/OCPBUGS-94015): Revendor CAPO [#173](https://github.com/openshift/machine-api-provider-openstack/pull/173)
* [Full changelog](https://github.com/openshift/machine-api-provider-openstack/compare/e8b2a9a559f553618136f17b8db3c639bb0a9f1e...bc4fe51daf4f4a9329ec15745b0b3b9188f23729)


### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/f6281d2dce8510e1cab53334694268c2b88b70ee)

* [OCPBUGS-103713](https://issues.redhat.com/browse/OCPBUGS-103713), [OCPBUGS-103714](https://issues.redhat.com/browse/OCPBUGS-103714), [OCPBUGS-103716](https://issues.redhat.com/browse/OCPBUGS-103716): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.3- #1365 [#1365](https://github.com/openshift/operator-framework-olm/pull/1365)
* [OCPBUGS-80492](https://issues.redhat.com/browse/OCPBUGS-80492), [OCPBUGS-80493](https://issues.redhat.com/browse/OCPBUGS-80493), [OCPBUGS-80494](https://issues.redhat.com/browse/OCPBUGS-80494): Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.75.1-sec.1 [release-4.19] [#1310](https://github.com/openshift/operator-framework-olm/pull/1310)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/93649380ab6fdccf8ec1716f89162b506c7de172...f6281d2dce8510e1cab53334694268c2b88b70ee)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/ae900a5b4555e6bde78a3644eb8ad422737b6fbb)

* [OCPBUGS-129151](https://issues.redhat.com/browse/OCPBUGS-129151): Branch Sync release-4.20 to release-4.19 [10-05-2026] [#3510](https://github.com/openshift/ovn-kubernetes/pull/3510)
* [OCPBUGS-111880](https://issues.redhat.com/browse/OCPBUGS-111880), [OCPBUGS-111887](https://issues.redhat.com/browse/OCPBUGS-111887): Branch Sync release-4.20 to release-4.19 [08-18-2026] [#3403](https://github.com/openshift/ovn-kubernetes/pull/3403)
* [OCPBUGS-95077](https://issues.redhat.com/browse/OCPBUGS-95077): Branch Sync release-4.20 to release-4.19 [08-11-2026] [#3380](https://github.com/openshift/ovn-kubernetes/pull/3380)
* [OCPBUGS-105881](https://issues.redhat.com/browse/OCPBUGS-105881): Add pperiyasamy to OWNERS for release-4.19 [#3387](https://github.com/openshift/ovn-kubernetes/pull/3387)
* [OCPBUGS-98616](https://issues.redhat.com/browse/OCPBUGS-98616): Branch Sync release-4.20 to release-4.19 [07-09-2026] [#3289](https://github.com/openshift/ovn-kubernetes/pull/3289)
* [OCPBUGS-82825](https://issues.redhat.com/browse/OCPBUGS-82825): Bump github.com/moby/spdystream to v0.5.1 [#3320](https://github.com/openshift/ovn-kubernetes/pull/3320)
* [OCPBUGS-98212](https://issues.redhat.com/browse/OCPBUGS-98212): Branch Sync release-4.20 to release-4.19 [05-27-2026] [#3207](https://github.com/openshift/ovn-kubernetes/pull/3207)
* [OCPBUGS-85512](https://issues.redhat.com/browse/OCPBUGS-85512): Branch Sync release-4.20 to release-4.19 [05-12-2026] [#3186](https://github.com/openshift/ovn-kubernetes/pull/3186)
* [OCPBUGS-74397](https://issues.redhat.com/browse/OCPBUGS-74397), [OCPBUGS-85355](https://issues.redhat.com/browse/OCPBUGS-85355): Branch Sync release-4.20 to release-4.19 [05-10-2026] [#3181](https://github.com/openshift/ovn-kubernetes/pull/3181)
* [OCPBUGS-81478](https://issues.redhat.com/browse/OCPBUGS-81478): node: fix serviceUpdateNotNeeded nil pointer comparison [#3100](https://github.com/openshift/ovn-kubernetes/pull/3100)
* [OCPBUGS-82032](https://issues.redhat.com/browse/OCPBUGS-82032): Branch Sync release-4.20 to release-4.19 [04-04-2026] [#3116](https://github.com/openshift/ovn-kubernetes/pull/3116)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/253d3ed8c6babe1b07fcb7910df3ebaf2d3c5b33...ae900a5b4555e6bde78a3644eb8ad422737b6fbb)


### [powervs-block-csi-driver](https://github.com/openshift/ibm-powervs-block-csi-driver/tree/c96184e9ef1c49b83ebbde7aa5610d24ea3ff6ac)

* [OCPBUGS-86907](https://issues.redhat.com/browse/OCPBUGS-86907): Updating ose-powervs-block-csi-driver-container image to be consistent with ART for 4.19 [#135](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/135)
* [OCPBUGS-80497](https://issues.redhat.com/browse/OCPBUGS-80497): Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 [#129](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/129)
* [OCPBUGS-82826](https://issues.redhat.com/browse/OCPBUGS-82826): Fix CVE-2026-35469 by bumping github.com/moby/spdystream to v0.5.1 [#123](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/123)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver/compare/b800691893b5c7cee169b296356b29ec99bc75bd...c96184e9ef1c49b83ebbde7aa5610d24ea3ff6ac)


### [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/tree/edc06e4a27944a6e8ce64ccab50ad2ede85f536b)

* [OCPBUGS-86917](https://issues.redhat.com/browse/OCPBUGS-86917): Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART for 4.19 [#116](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/116)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/compare/ad49862f7580502d75985117bb52bafb78d8ee78...edc06e4a27944a6e8ce64ccab50ad2ede85f536b)


### [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs/tree/fd25fd0b25a51474d045d74fd571ecb4d1e7f3c5)

* [OCPBUGS-80499](https://issues.redhat.com/browse/OCPBUGS-80499): Replace google.golang.org/grpc with openshift-sustaining fork v1.75.1-sec.1 to v1.79.3 to fix CVE-2026-33186 [#100](https://github.com/openshift/cloud-provider-powervs/pull/100)
* [Full changelog](https://github.com/openshift/cloud-provider-powervs/compare/ef83f3f5b8bf00f829bb71d1857a5f59e63f9f17...fd25fd0b25a51474d045d74fd571ecb4d1e7f3c5)


### [prom-label-proxy](https://github.com/openshift/prom-label-proxy/tree/7e940516469fd79e74ab09828935c06b17f2834a)

* NO-ISSUE: synchronize OWNERS from main branch [release-4.19] [#412](https://github.com/openshift/prom-label-proxy/pull/412)
* [Full changelog](https://github.com/openshift/prom-label-proxy/compare/13666465233bfe72a19d6d3f48576a508fdea145...7e940516469fd79e74ab09828935c06b17f2834a)


### [prometheus](https://github.com/openshift/prometheus/tree/df7cd414210e07b98fe544889f0a3209b0b3da36)

* NO-ISSUE: synchronize OWNERS from main branch [#382](https://github.com/openshift/prometheus/pull/382)
* [OCPBUGS-93706](https://issues.redhat.com/browse/OCPBUGS-93706): fix for CVE-2026-42151 [#360](https://github.com/openshift/prometheus/pull/360)
* [OCPBUGS-88654](https://issues.redhat.com/browse/OCPBUGS-88654): remote: validate snappy decoded length before allocation in read endpoint [#343](https://github.com/openshift/prometheus/pull/343)
* [OCPBUGS-98388](https://issues.redhat.com/browse/OCPBUGS-98388): fix: TLS client cert rotation when no CA is configured [#341](https://github.com/openshift/prometheus/pull/341)
* [OCPBUGS-80500](https://issues.redhat.com/browse/OCPBUGS-80500): Bump google.golang.org/grpc to v1.79.3 [#307](https://github.com/openshift/prometheus/pull/307)
* [Full changelog](https://github.com/openshift/prometheus/compare/396601b64177f9c6f9d52ff8ac53017c9d150ff7...df7cd414210e07b98fe544889f0a3209b0b3da36)


### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/9492b20ccfb409add6831d7ff482082b943f7bbe)

* NO-JIRA: synchronize OWNERS with main [#191](https://github.com/openshift/prometheus-alertmanager/pull/191)
* [OCPBUGS-103733](https://issues.redhat.com/browse/OCPBUGS-103733): Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 [#171](https://github.com/openshift/prometheus-alertmanager/pull/171)
* [OCPBUGS-98179](https://issues.redhat.com/browse/OCPBUGS-98179): fixes CVE-2026-14362 [#161](https://github.com/openshift/prometheus-alertmanager/pull/161)
* [OCPBUGS-100354](https://issues.redhat.com/browse/OCPBUGS-100354): Set testdata CA expiry to 20 years from issue date (#4112) [#150](https://github.com/openshift/prometheus-alertmanager/pull/150)
* [OCPBUGS-99450](https://issues.redhat.com/browse/OCPBUGS-99450): embed tzdata in the alertmanager binary [#144](https://github.com/openshift/prometheus-alertmanager/pull/144)
* [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/6ff6a8848263ceb5fbac784f4976d9c04e92e61e...9492b20ccfb409add6831d7ff482082b943f7bbe)


### [prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator/tree/0d74bc6a5aaf0a6bc37c301546d2f2fd668344ff)

* [OCPBUGS-103729](https://issues.redhat.com/browse/OCPBUGS-103729), [OCPBUGS-103735](https://issues.redhat.com/browse/OCPBUGS-103735): [release-4.19] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#396](https://github.com/openshift/prometheus-operator/pull/396)
* [Full changelog](https://github.com/openshift/prometheus-operator/compare/40703af366f376665b8b0c303233463845de285c...0d74bc6a5aaf0a6bc37c301546d2f2fd668344ff)


### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/c5f33cf4bc98b6118ca0fb23b1d8681092caf93e)

* [OCPBUGS-103732](https://issues.redhat.com/browse/OCPBUGS-103732): CVE-2026-33814 openshift4/ose-prometheus-node-exporter-rhel9: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.19] [#215](https://github.com/openshift/node_exporter/pull/215)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.19] [#201](https://github.com/openshift/node_exporter/pull/201)
* [Full changelog](https://github.com/openshift/node_exporter/compare/c90542d8cef6d25545ae00481ffff5622cdce928...c5f33cf4bc98b6118ca0fb23b1d8681092caf93e)


### [rhel-coreos, rhel-coreos-extensions](https://github.com/openshift/os/tree/3522fbaca282ebdb5abd999babc2ee71d5b0d030)

* [OCPBUGS-109661](https://issues.redhat.com/browse/OCPBUGS-109661): NetworkManager-ovs has moved to RHCOS [#1960](https://github.com/openshift/os/pull/1960)
* NO-JIRA: rhaos-pkgs-match-openshift: exclude known package mismatches [#1921](https://github.com/openshift/os/pull/1921)
* [OCPBUGS-82525](https://issues.redhat.com/browse/OCPBUGS-82525): post-process: Remove workaround for openvswitch additional group [#1927](https://github.com/openshift/os/pull/1927)
* [Full changelog](https://github.com/openshift/os/compare/e1692fc917c9c88076254144cb67f516bd0b81fd...3522fbaca282ebdb5abd999babc2ee71d5b0d030)


### [route-controller-manager](https://github.com/openshift/route-controller-manager/tree/6068e2c71fc1efb67324a91f48c1470c647f1344)

* [OCPBUGS-80378](https://issues.redhat.com/browse/OCPBUGS-80378): Bump google.golang.org/grpc to v1.79.3 [#84](https://github.com/openshift/route-controller-manager/pull/84)
* [Full changelog](https://github.com/openshift/route-controller-manager/compare/25d79fdf101f3d41f4583a970e5f324b79fb42d8...6068e2c71fc1efb67324a91f48c1470c647f1344)


### [telemeter](https://github.com/openshift/telemeter/tree/4da8f469ce9059cfacc55fd3f83e2b32a56de444)

* [OCPBUGS-80513](https://issues.redhat.com/browse/OCPBUGS-80513): Bump google.golang.org/grpc to v1.79.3 [#591](https://github.com/openshift/telemeter/pull/591)
* [OCPBUGS-81809](https://issues.redhat.com/browse/OCPBUGS-81809): [release-1.19] Fix CVE-2026-34986 [#595](https://github.com/openshift/telemeter/pull/595)
* [Full changelog](https://github.com/openshift/telemeter/compare/d72f157000039dddd96962d08d51c17ef716a7d4...4da8f469ce9059cfacc55fd3f83e2b32a56de444)


### [tests](https://github.com/openshift/origin/tree/01cbb25927880e3e3ab91ebd08a368d35bcabff1)

* [OCPBUGS-130855](https://issues.redhat.com/browse/OCPBUGS-130855): stage the creation of test pods to minimize etcd impact [#31739](https://github.com/openshift/origin/pull/31739)
* [OCPBUGS-121957](https://issues.redhat.com/browse/OCPBUGS-121957): Raise status polling timeout and write bound [#31622](https://github.com/openshift/origin/pull/31622)
* [OCPBUGS-100441](https://issues.redhat.com/browse/OCPBUGS-100441): retry GetVotingMemberNames on transient etcd client fails [#31509](https://github.com/openshift/origin/pull/31509)
* [OCPBUGS-104577](https://issues.redhat.com/browse/OCPBUGS-104577): Backport node_e2e test migrations [#31484](https://github.com/openshift/origin/pull/31484)
* [OCPBUGS-100045](https://issues.redhat.com/browse/OCPBUGS-100045): Add openshift/disruptive-longrunning testsuite in release-4.19 [#31438](https://github.com/openshift/origin/pull/31438)
* [OCPBUGS-99302](https://issues.redhat.com/browse/OCPBUGS-99302): admit and extract non-payload 4.19 [#31404](https://github.com/openshift/origin/pull/31404)
* [OCPBUGS-77878](https://issues.redhat.com/browse/OCPBUGS-77878): auditloganalyzer: update test name, remove duplicated test [#29992](https://github.com/openshift/origin/pull/29992)
* [OCPBUGS-85275](https://issues.redhat.com/browse/OCPBUGS-85275): Add test for CPMS OnDelete strategy with full master replacement [#31054](https://github.com/openshift/origin/pull/31054)
* [OCPBUGS-83656](https://issues.redhat.com/browse/OCPBUGS-83656): Fix PinnedImages test to respect node taints [#30971](https://github.com/openshift/origin/pull/30971)
* [OCPBUGS-78545](https://issues.redhat.com/browse/OCPBUGS-78545): Skip oauth test for external control plane topology [#30887](https://github.com/openshift/origin/pull/30887)
* [Full changelog](https://github.com/openshift/origin/compare/d7514f0f703e5262db5b031fb85244265daae190...01cbb25927880e3e3ab91ebd08a368d35bcabff1)


### [thanos](https://github.com/openshift/thanos/tree/a4c98b8568a067fcb499cd040a5177b31ea1832b)

* [OCPBUGS-80515](https://issues.redhat.com/browse/OCPBUGS-80515): Bump google.golang.org/grpc to v1.79.3 [#183](https://github.com/openshift/thanos/pull/183)
* [Full changelog](https://github.com/openshift/thanos/compare/95f7bb216c27bea9c8001a7b49fbd66d23286f80...a4c98b8568a067fcb499cd040a5177b31ea1832b)


### [vsphere-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-vsphere/tree/87699d7edbe20ceb08760581c0eebae59265d821)

* [OCPBUGS-80520](https://issues.redhat.com/browse/OCPBUGS-80520): Bump google.golang.org/grpc to v1.79.3 [#103](https://github.com/openshift/cluster-api-provider-vsphere/pull/103)
* [Full changelog](https://github.com/openshift/cluster-api-provider-vsphere/compare/f33d67f8f38e33af45efcb25003a001a17165cdc...87699d7edbe20ceb08760581c0eebae59265d821)


### [vsphere-csi-driver, vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver/tree/a6d34fbb196008ef3073a8bb92a2d332e895929e)

* [OCPBUGS-92935](https://issues.redhat.com/browse/OCPBUGS-92935): Bump golang.org/x/crypto/ssh to v0.41.0-sec.2 [#192](https://github.com/openshift/vmware-vsphere-csi-driver/pull/192)
* [OCPBUGS-80523](https://issues.redhat.com/browse/OCPBUGS-80523): Bump google.golang.org/grpc to v1.79.3 [#175](https://github.com/openshift/vmware-vsphere-csi-driver/pull/175)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver/compare/b8d3322fec45db4d4a8233527364f336d5e3560b...a6d34fbb196008ef3073a8bb92a2d332e895929e)


### [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator/tree/0121c1381f7d0215cf0b24cfbdbe12857ca065e2)

* [OCPBUGS-103754](https://issues.redhat.com/browse/OCPBUGS-103754): Bump golang.org/x/net to v0.43.0-sec.3 [#355](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/355)
* [OCPBUGS-84895](https://issues.redhat.com/browse/OCPBUGS-84895): Fix password escaping [#341](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/341)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver-operator/compare/c2b41c36105daa94272ff4c5a32ec9d5637626a4...0121c1381f7d0215cf0b24cfbdbe12857ca065e2)


### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/995d91a8586a90b256207b988e9bd246f1c3cfd1)

* [OCPBUGS-123520](https://issues.redhat.com/browse/OCPBUGS-123520): Fixed compute cluster permission logic for single fd with read-only custom resourcepool [#240](https://github.com/openshift/vsphere-problem-detector/pull/240)
* [OCPBUGS-103758](https://issues.redhat.com/browse/OCPBUGS-103758): Bump golang.org/x/net to v0.43.0-sec.4 [#232](https://github.com/openshift/vsphere-problem-detector/pull/232)
* [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/7b8e065fef1a8a4a43f023abc777c3b6b6bcb3a7...995d91a8586a90b256207b988e9bd246f1c3cfd1)