# 4.20.39

Created: 2026-09-18 06:12:11 +0000 UTC

Image Digest: `sha256:7bcf96bd0766436fcc30ac30d4bba565d27bfe5772d48177f1afd65878209850`


## Changes from 4.20.28

### Components

* Kubectl 1.33.3
* Kubernetes upgraded from 1.33.12 to 1.33.13
* Kubernetes Tests 1.33.4
* Red Hat Enterprise Linux CoreOS upgraded from 9.6.20260630-0 to 9.6.20260914-0



### FeatureGate Changes
| FeatureGate | Default<br/>Hypershift | Default<br/>SelfManagedHA | DevPreviewNoUpgrade<br/>Hypershift | DevPreviewNoUpgrade<br/>SelfManagedHA | TechPreviewNoUpgrade<br/>Hypershift | TechPreviewNoUpgrade<br/>SelfManagedHA  |
| :------ | :---: | :---: | :---: | :---: | :---: | :---:  |
| GatewayAPIWithoutOLM <br/> (5 tests)| Enabled<br/>(Changed)| Enabled<br/>(Changed)| Enabled<br/>(Changed)| Enabled<br/>(Changed)| Enabled<br/>(Changed)| Enabled<br/>(Changed) |


### Rebuilt images without code change

* [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent) git [637327ec](https://github.com/openshift/assisted-installer-agent/commit/637327ec40cd1f85ac5d7d4f114a2fae89baa8b0) `sha256:2411423f316a9197b88f1de626b3bc13684757672a767bfe5dbc69455f40de20`
* [agent-installer-utils](https://github.com/openshift/agent-installer-utils) git [e3e997d9](https://github.com/openshift/agent-installer-utils/commit/e3e997d9f7b84b134a07186de9bddde21598ae32) `sha256:5c0cfaa6da9661e58a612f97e78074fb281e0739b20e0900deef4a4ceccd8957`
* [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy) git [11b24a2c](https://github.com/openshift/apiserver-network-proxy/commit/11b24a2c7452ef683a1d989f1016e6e815f5c112) `sha256:076495aec45689d24288285929603b02d702d19b88346f44dc280bd3d4ff3e9f`
* [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws) git [bb88da16](https://github.com/openshift/cloud-provider-aws/commit/bb88da16b29d63573861351afc5ca8c4547775d6) `sha256:ed393ed2529184e78bedd923b20f1b99aa9ee0773b732a718d073b34df703b04`
* [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver) git [6c99b973](https://github.com/openshift/aws-ebs-csi-driver/commit/6c99b973a6a5ca0202d56b87119714b9ec4a5365) `sha256:b0653089964ea7a017e31efee4d7f18705ddece06808a4faa52119e307a313eb`
* [aws-karpenter-provider-aws](https://github.com/openshift/aws-karpenter-provider-aws) git [b37141b0](https://github.com/openshift/aws-karpenter-provider-aws/commit/b37141b051bdf790eb7e8f45b95f6bd7dc8140f4) `sha256:2465258d254399a2354d817d675916bee0b53904c674874c20da4378db15a638`
* [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider) git [0000b76a](https://github.com/openshift/aws-encryption-provider/commit/0000b76a838f6b56efcfecfa110bc6795d0f7746) `sha256:87bce096ab350a7b3b98845b5a6172a6a698647e7a374319001b6a0a4c7e4cec`
* [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws) git [999f4f76](https://github.com/openshift/machine-api-provider-aws/commit/999f4f76124e66c7b42af678cb19aff4b29f72d4) `sha256:771eed269ceba588e0d07876c233441f214d03b65c3c81638b854fb90266482a`
* [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook) git [8e83772a](https://github.com/openshift/aws-pod-identity-webhook/commit/8e83772ab8d31b32225744d4f0b0023680692daf) `sha256:36d4e87a8937394f2d6cae058f2fa66e1b2854d51234c9e857e42a96d6b7d6c4`
* [azure-cloud-controller-manager](https://github.com/openshift/cloud-provider-azure) git [fbf11126](https://github.com/openshift/cloud-provider-azure/commit/fbf11126955608076cd568c22be0d630c5db0d84) `sha256:80b3ffc78ba726b7cc12e02e43221054f9feb149c9a586f7afc205dac37d3bc1`
* [azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure) git [fbf11126](https://github.com/openshift/cloud-provider-azure/commit/fbf11126955608076cd568c22be0d630c5db0d84) `sha256:c80b6c73b52e5a290229a2b06c683878d4bf8c774dd84c0ef42800e2b1fc9515`
* [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure) git [68db9150](https://github.com/openshift/machine-api-provider-azure/commit/68db91507ea47f767ee0dc838c08cc371d2ff69f) `sha256:e698fabcd00a53843d30b3dbac5b05a9bb179cb9f90ffa26e56b0f72c2894990`
* [azure-service-operator](https://github.com/openshift/azure-service-operator) git [d957de42](https://github.com/openshift/azure-service-operator/commit/d957de42c2e6255b79fcfe7aedac78eb746d92cc) `sha256:0f3cc803b720ea1a0d4b7721a4040a7985c84a9538f99fd3a3e9b33d65c94849`
* [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3) git [f782ba74](https://github.com/openshift/cluster-api-provider-metal3/commit/f782ba747ed353721c84ceb754ca8403f94adb6a) `sha256:c3f3c5c1afa3b19098002541b82a0ef554ae0a32dabb7a434d225cf8f6bd0e81`
* [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal) git [fb678fec](https://github.com/openshift/cluster-api-provider-baremetal/commit/fb678fec5f7e08348b281341481f33a848204e50) `sha256:6771ce2ea556fc442e024bfaa23df5b94194d224091e90893b94b8b3396106fd`
* [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg) git [5e602ba7](https://github.com/openshift/baremetal-runtimecfg/commit/5e602ba702420d0f30cee175f51fff83e00c1b5b) `sha256:276a53c24bb13185a721ffbb80db08dc5fa8cbf435b667c7229bc7a696667590`
* [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller) git [d22915bc](https://github.com/openshift/cloud-network-config-controller/commit/d22915bc82993ce11cb3fb97e6ae00602f30549b) `sha256:1bca9be9966f2eea991ce44ea816cc470fad6faeb7af4215b4a8e2e640612ff0`
* [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator) git [569ae680](https://github.com/openshift/cluster-authentication-operator/commit/569ae680cbdf0f78cc0d77278c5178160679fe83) `sha256:9c5b4df72d0f8b102b7fc3d5a0da05b777d9aa1ce751709124cf04139b2e518a`
* [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator) git [17181f99](https://github.com/openshift/cluster-baremetal-operator/commit/17181f99343a5b1fb08af8a7994ad3e9eecc6c1e) `sha256:7c426dad5c36df4d94a4a08665cccbe3ede9c0d6d21fa5cf2875db775f395e50`
* [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap) git [74abc555](https://github.com/openshift/cluster-bootstrap/commit/74abc555111bac56a67957ef517ef086e4643c50) `sha256:54f0a00740ad929c11a335f57ea411a0f73ff5b30dbb432f18990c3e3fe46057`
* [cluster-capi-controllers](https://github.com/openshift/cluster-api) git [dfeecf96](https://github.com/openshift/cluster-api/commit/dfeecf9616e049ac552f91a71b2a50cb0e96042c) `sha256:fbce34a031c0d7f6eaa480de8a910d108dd5d990bbaf9a194b9bda2790326477`
* [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator) git [4bd6d82d](https://github.com/openshift/cluster-capi-operator/commit/4bd6d82d21a2d201d9857ca1e26b21c70a648bf5) `sha256:7ab65c4960689b4ebf5ec15dcf2e95bee385be8522b0e053fba92f73001d4a0c`
* [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator) git [276696cc](https://github.com/openshift/cluster-cloud-controller-manager-operator/commit/276696ccf679830b25df341edb7aae9bb3f4e763) `sha256:cac6298e9dffaec12e432e11aaa9335a4b3187e76b36275e2fe5f7c0a4ec3177`
* [cluster-config-operator](https://github.com/openshift/cluster-config-operator) git [657754e2](https://github.com/openshift/cluster-config-operator/commit/657754e2beaed6295ff28bb0f7813cb1c9ce35b2) `sha256:5c8dcbbdd8f9033431a4b06783ef0d60b0ae30fd579cb1e20b576c141733d553`
* [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator) git [a99bd8ff](https://github.com/openshift/cluster-csi-snapshot-controller-operator/commit/a99bd8ffb9aa596fa8d6932d5d93e0613c5d367f) `sha256:45e1076c0a95e46b0c6193f3a6ec319f4fa0b950e397f27b84a2815d2f1e1e2c`
* [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator) git [82578923](https://github.com/openshift/cluster-dns-operator/commit/82578923164636746e0d74d594ab32d83a660c0b) `sha256:ba05b306d96befaa54c18eb2a671bc34173906c5cb65e8afaffde44724108f60`
* [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator) git [9acf049b](https://github.com/openshift/cluster-etcd-operator/commit/9acf049b2985339275796f69a2a8acad47726a29) `sha256:d126a719a9a5ab7435a961b4335f469a032671ecfe26fb98f5fe4a375a4b67e4`
* [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator) git [b04c7c12](https://github.com/openshift/cluster-image-registry-operator/commit/b04c7c121851704973a94a50e42af1425045899c) `sha256:b702f99842cb16148e71f8b5fd58cb33bc65cb7cdaae335e9076e0e6c4cc4888`
* [cluster-kube-cluster-api-operator](https://github.com/openshift/cluster-api-operator) git [adaae0d4](https://github.com/openshift/cluster-api-operator/commit/adaae0d4e6d7a0e466e7e86af399de0b828c8b81) `sha256:7cceb2e0e9cb9463b674b34c3405d51d765078fa294e9bff283ec0fcbf979967`
* [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator) git [438c9dba](https://github.com/openshift/cluster-kube-controller-manager-operator/commit/438c9dba80ddadeabe9efe4a654297a7b550b2b8) `sha256:92a436b9961ac52f1d87ec1590a8ad7bbe892759e9e3354c61b3285a695c1696`
* [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator) git [84eb8c5a](https://github.com/openshift/cluster-kube-scheduler-operator/commit/84eb8c5a73a730d6d08794e51da9c20013ca4304) `sha256:ddf3c2a4890482e3c7ccaa04c656d721b5cd84702eae671a7dcf9dd1d0904290`
* [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator) git [5adc1429](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/commit/5adc14299739bc64c8812cbab0b0ff2d12863602) `sha256:4ce4c3f877d540ed0dd763a2a26e033121a25911289e59fc0dad6447fb2dfb3c`
* [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver) git [b3c82b2e](https://github.com/openshift/cluster-machine-approver/commit/b3c82b2eec66ae3ae510df0603af1212c34be618) `sha256:78fbb4a0ad61586fc0f992c149ee1219e6e8e47a1dc30a02ee5358e2172fe906`
* [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator) git [d01cc083](https://github.com/openshift/cluster-olm-operator/commit/d01cc083748864e3c8dcc72fb75516492dec3555) `sha256:ace26cd486d413ccb02b5afedc4b96d5649dd2db7fdbae17c86afd45f5957e7a`
* [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator) git [9cfa5679](https://github.com/openshift/cluster-openshift-apiserver-operator/commit/9cfa5679a8ac1e5a68eea32179d9e069da85dfcf) `sha256:22cad68546455053f3254793de3497ece90c36d3fbf22038db787af4d3e46ede`
* [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator) git [aa455c04](https://github.com/openshift/cluster-openshift-controller-manager-operator/commit/aa455c043152123595c2b4f72e02279aad9dd48a) `sha256:4bfbf17c0500ad9d4030b80ce66912fb7a3adf7686595542967352050e5a0d0f`
* [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator) git [b343f70f](https://github.com/openshift/cluster-samples-operator/commit/b343f70f19ffd559e1a81d3a3e65bd106e634c13) `sha256:23689bf133c47a7124e68609ed9c3b67438a721ed841222130541a0c0850e4f7`
* [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator) git [e8e9de43](https://github.com/openshift/cluster-storage-operator/commit/e8e9de4345ce79aafbdcf31eb4d4ce3682cfd6b7) `sha256:6cb56a196b8efdc13edbe73864c96502519559d5d9742323fc3ca856bf578c8e`
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [c40e7b9b](https://github.com/openshift/cluster-update-keys/commit/c40e7b9b60c62690a25333fc54ae0d3705474afb) `sha256:e04b480a352692bf7d103737ce0e57f068feeafa133180d52731aa7dc738cdbe`
* [cluster-version-operator](https://github.com/openshift/cluster-version-operator) git [ea3fa769](https://github.com/openshift/cluster-version-operator/commit/ea3fa7695054fc9260936902b33b738bb4c405bc) `sha256:f6bda89e26ff274bd5d73d55ba9672336c0fd386d31cc8c8fea05839aad6fd5a`
* [configmap-reloader](https://github.com/openshift/configmap-reload) git [2438d7c8](https://github.com/openshift/configmap-reload/commit/2438d7c8e495201361d87da205649bc38fc4822b) `sha256:6a590fcfaa629c93474d08756b5a01a81e5ae6e5637c0b5864fd2fb935857480`
* [container-networking-plugins](https://github.com/openshift/containernetworking-plugins) git [184a9601](https://github.com/openshift/containernetworking-plugins/commit/184a96011a8cacb72319cdccb904271a99c5928d) `sha256:54c78c83d763aba658bb1fc5e7319a27255fd232132a02d49aceca0a0fb6d5db`
* [containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins) git [184a9601](https://github.com/openshift/containernetworking-plugins/commit/184a96011a8cacb72319cdccb904271a99c5928d) `sha256:0ef23f12d6254d399d7562bc7b05fd6fd7daf8fac48b26def47d2a4fe38c0275`
* [coredns](https://github.com/openshift/coredns) git [6f39336e](https://github.com/openshift/coredns/commit/6f39336e6da9dc77b2db140a96773c413d50a665) `sha256:b39eef1db3e39af12776ef72083b05f35e82336fce46574d48ac24dbf867cb1d`
* [csi-driver-manila](https://github.com/openshift/cloud-provider-openstack) git [649398c2](https://github.com/openshift/cloud-provider-openstack/commit/649398c2a16731984e65719f6b8b323df79f3ff1) `sha256:02743e134a05ae23beeb1369f9ddf78b9515e76bc7bb86d81cfe788673d49ff7`
* [csi-external-attacher](https://github.com/openshift/csi-external-attacher) git [935f1e1f](https://github.com/openshift/csi-external-attacher/commit/935f1e1f7f9f07c03116e37e760a66e2a58c63c0) `sha256:e74ccec66f5b017b31aeeeb9adf318473898a0073d78af7141908801b5dd8230`
* [csi-external-snapshot-metadata](https://github.com/openshift/csi-external-snapshot-metadata) git [693a8264](https://github.com/openshift/csi-external-snapshot-metadata/commit/693a826455777eaafc677bb2195dc071d184243b) `sha256:e8d905931b0229f357214ecce636ea871c66158dd62ec8a7cdb79c1851a9a232`
* [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe) git [1d6d6b27](https://github.com/openshift/csi-livenessprobe/commit/1d6d6b27460e58f24110c72ec9c96afe2c1d891d) `sha256:fbcdc89da00ccf446d0d2898c0b8af8cb8305b603c2bf4586a8cb8d1d33908ba`
* [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar) git [6ce4713c](https://github.com/openshift/csi-node-driver-registrar/commit/6ce4713c87b735e2546a65a871bd2c7cfe383c31) `sha256:5cc3adbef438d7ea296a1d185274125ab2884806078d07e4f0768e28b0916d33`
* [docker-builder](https://github.com/openshift/builder) git [35afa308](https://github.com/openshift/builder/commit/35afa308e2473046721057112d804334fc4b8217) `sha256:ac47cd71e1299df13e3356b3f86dd9891e824a2fc029f3f291f1ab7c6f33d45d`
* [docker-registry](https://github.com/openshift/image-registry) git [0e96a084](https://github.com/openshift/image-registry/commit/0e96a08424d601be55341bc3f4412fde977602c8) `sha256:ab2b2bb020079ce7d1e541126501c8da891c4a386421426ecf7a6375abe46150`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [62e1f604](https://github.com/openshift/driver-toolkit/commit/62e1f6040cd297149f5f14e0d20814759ec61354) `sha256:2567ca39905460a6b15fa425b66e9ddfcec0f571e0f6b72c699dde5a67d778f8`
* [etcd](https://github.com/openshift/etcd) git [05bca977](https://github.com/openshift/etcd/commit/05bca97760b1cfa1bcef11c0b1f1a5c4dab19709) `sha256:82ef7461961b529fa8147309d05592dec8517cd1b2569274f89375b598cf8ce7`
* [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp) git [74e23890](https://github.com/openshift/cluster-api-provider-gcp/commit/74e2389011d640a371c0acb6ff71b1582cab23a1) `sha256:37752e92accb8a7691d18c09b4de743f0800422d8f89f2199ffd51c3ba66a0cf`
* [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver) git [49e54581](https://github.com/openshift/gcp-pd-csi-driver/commit/49e54581328a46f6aee3f7842d401681d34b2104) `sha256:bc440773ff43ee6b93378c0b7216522df2ae9d4ca5ced1c22b196e35ddc35919`
* [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook) git [b36788ed](https://github.com/openshift/gcp-workload-identity-federation-webhook/commit/b36788edd4c559cffd5f7f1b2e3e51b98c3e92b8) `sha256:bd581bf8dac0bbc305c2deb016511e2844c78dc4cf0750052374bd18c3476d56`
* [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm) git [36ab30f9](https://github.com/openshift/cloud-provider-ibm/commit/36ab30f90e87de0daa926d20ccda88c41abed191) `sha256:b581c8581911415f5cf73915bc36a25b0756fe828429456d1fd6e6431cb9258a`
* [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver) git [0d2143b7](https://github.com/openshift/ibm-vpc-block-csi-driver/commit/0d2143b7aaaf2047e9578fb3ae41f89267d4b1bc) `sha256:7fcf9cff5e0ca4f1c090e1fef6c7551a01183647edab2b408f2653b816f750cb`
* [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator) git [21f405cc](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/commit/21f405cce9573eee1c4f1cf95c0eb601ae77ed99) `sha256:21aaf3b1de7bc1d169ac03e0bd234e47b371c8aaf4514a03e5cd107078f3c608`
* [insights-runtime-exporter](https://github.com/openshift/insights-runtime-extractor) git [39e71471](https://github.com/openshift/insights-runtime-extractor/commit/39e71471d109ed16c336a8e08c2562d837f90029) `sha256:ad747a567b7ea9a7dc68d2e37011463b6926ce5c33fb08d72f77116f6185bb75`
* [insights-runtime-extractor](https://github.com/openshift/insights-runtime-extractor) git [39e71471](https://github.com/openshift/insights-runtime-extractor/commit/39e71471d109ed16c336a8e08c2562d837f90029) `sha256:700ad743fd2acd81e7edb98b504472f5475fd73aea19a030dd2173435e948226`
* [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [6c92e542](https://github.com/openshift/ironic-rhcos-downloader/commit/6c92e5425b58baa9d4dd951a992b7460e8407247) `sha256:f68e44707e60da6a379f41dcb59256ac93091694677590c16ec428da5d92fc7f`
* [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager) git [fa5b8b8b](https://github.com/openshift/ironic-static-ip-manager/commit/fa5b8b8bb73e509f74205a99a0ed1cb07a843885) `sha256:a6d2a612cb8386c99af3cee0fb93414b3d48d2d7482a2ba820056f5dc2dc3683`
* [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server) git [e7379b30](https://github.com/openshift/kubernetes-metrics-server/commit/e7379b302a7377c06cf06d54230decd479f92078) `sha256:928b31832158d820f2c2f2e8888ba5f7d4c194f8a2f507beb8bd6392e3da0d22`
* [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy) git [b9134351](https://github.com/openshift/kube-rbac-proxy/commit/b9134351be37c43408334047d8eb85d0ac01fe4e) `sha256:c5d0e603b52989bf31f7704d0b0723b8796ce4e38fdc94d9b4ba7d8e94c1bbdc`
* [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator) git [0f8a4eb8](https://github.com/openshift/kubernetes-kube-storage-version-migrator/commit/0f8a4eb84ace9b746cf25d51d80dacf34ca5f953) `sha256:efede34456e12b499e6d06432d5044c0107512732c9c4e2765ff05da07fc1720`
* [machine-api-operator](https://github.com/openshift/machine-api-operator) git [de0171b9](https://github.com/openshift/machine-api-operator/commit/de0171b9abf99cde11e789dd0d103cb69e7c6684) `sha256:06a3f77f3a65e960f771aa0d6e9e83c2a6c94dd8a8b38885869fa8390d534779`
* [machine-image-customization-controller](https://github.com/openshift/image-customization-controller) git [fe4360da](https://github.com/openshift/image-customization-controller/commit/fe4360da1fe44c0d8a69c0133f846e0cbc36740c) `sha256:97e666416f9a8d5eb4f6ea0903a27f0abc026780541a601b517a19389c113756`
* [machine-os-images](https://github.com/openshift/machine-os-images) git [5da52107](https://github.com/openshift/machine-os-images/commit/5da52107b36e002d56e5e82f4b2cd496b1c4ec7a) `sha256:41e7909e9525296479cc2ac7d3881b344c25e903b1a5271e1aa0185b34c20c85`
* [metallb-frr](https://github.com/openshift/frr) git [3ca45c51](https://github.com/openshift/frr/commit/3ca45c517eafe07aac0866e5cbd32a5c08081f22) `sha256:c90119572aebb867d6ec11dbc2b5eb61489bb88893db9c3dbcad884e2576f067`
* [multus-admission-controller](https://github.com/openshift/multus-admission-controller) git [fc73c803](https://github.com/openshift/multus-admission-controller/commit/fc73c803caa1140e5a9115ceeb0e38504b001722) `sha256:5586b2fdf3b3dce1c99e1d3839b8506733284f85eaeeeeb448f2ab7327e86196`
* [multus-cni](https://github.com/openshift/multus-cni) git [b2a2f457](https://github.com/openshift/multus-cni/commit/b2a2f457824490d93da101d983b25af966f2be1b) `sha256:c4742a040337a2fef69edc0c5ab512afb1a7614535fc8dbaea2260dd799a23eb`
* [multus-cni-microshift](https://github.com/openshift/multus-cni) git [b2a2f457](https://github.com/openshift/multus-cni/commit/b2a2f457824490d93da101d983b25af966f2be1b) `sha256:59a33de7154284022f373721ddd0a647b6d69d51ab5acb8208afd55f93a9bc3c`
* [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy) git [afbdf825](https://github.com/openshift/multus-networkpolicy/commit/afbdf82505c0d8f212d63e1eee6debced74ef653) `sha256:f18444eec56734535ef6ebcea1c9a03800170880dd2ceda4138fb8b83a8ebdf3`
* [multus-route-override-cni](https://github.com/openshift/route-override-cni) git [391c1b03](https://github.com/openshift/route-override-cni/commit/391c1b0361e17c5718508810f0bdb6ff66ae6e81) `sha256:f11f6c466c1fbe79464489ed81f15c0c9b5028e26abc317b5013b6b334f2586f`
* [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni) git [43c89591](https://github.com/openshift/whereabouts-cni/commit/43c8959152a6ca8afdc73eaed624286628c2c22e) `sha256:958a81308911dcf39d9b0bfed0689fa77cb20cb1d266becfe250afb1933d856f`
* [network-interface-bond-cni](https://github.com/openshift/bond-cni) git [dd3c4d0b](https://github.com/openshift/bond-cni/commit/dd3c4d0b886138d974022b963e72f2e90293abfe) `sha256:7e6d4e705606b84e7d1712f6910efef3e2a7f28b9fe7a4ed3bb4b354d285dc7c`
* [network-tools](https://github.com/openshift/network-tools) git [26d09174](https://github.com/openshift/network-tools/commit/26d09174cbd92386469e777e3bf49bfa95d035d5) `sha256:84c63d5d944429c98077d14c741efbcb0ecaef7fae3444a28905145cfd723052`
* [nutanix-cloud-controller-manager](https://github.com/openshift/cloud-provider-nutanix) git [b575ef15](https://github.com/openshift/cloud-provider-nutanix/commit/b575ef15f13e1434c793ae50824fd0676480be05) `sha256:2c1c2e7590cd637f0c671eaa1282c1629613ae4ed2f60159be0c51f47e491c17`
* [nutanix-machine-controllers](https://github.com/openshift/machine-api-provider-nutanix) git [3200ddef](https://github.com/openshift/machine-api-provider-nutanix/commit/3200ddef48a5a8d47b96539419c51f3619cb1fd5) `sha256:43b1d52edc3ca25085f000a0ec34d5f140356be207aa723b0f47855892e420d0`
* [oauth-apiserver](https://github.com/openshift/oauth-apiserver) git [99f27d25](https://github.com/openshift/oauth-apiserver/commit/99f27d25cc2853fe44ce6c7f7611637ef1492e42) `sha256:e1a8ca2c049820e384adfd6f9435be8270573e30db3e144579df873272c67e84`
* [oauth-server](https://github.com/openshift/oauth-server) git [715ae668](https://github.com/openshift/oauth-server/commit/715ae668b8765b029cb7851a509b9948b8cc57a0) `sha256:9b9b4d83b3cda290ca944152de9837e272b1ae520b2770b790c70bf7415e0e41`
* [oc-mirror](https://github.com/openshift/oc-mirror) git [9b186403](https://github.com/openshift/oc-mirror/commit/9b186403c88394b54ab491871a158a124df39a02) `sha256:0ac4248803dfbd05cf05254ebc18e07b388d67cea839f875b7b95716dd1260c7`
* [openshift-apiserver](https://github.com/openshift/openshift-apiserver) git [eda815e0](https://github.com/openshift/openshift-apiserver/commit/eda815e0515550890354dda41e65f8dd35e15ad5) `sha256:c9ec91a11cac81516bcb5f17886384af5bde6b60e5cec8b0fc0f0eb6e3467add`
* [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager) git [d9e543dd](https://github.com/openshift/openshift-controller-manager/commit/d9e543dd31e981f279c447e4f92f0dac3f665f9e) `sha256:840fdba2fb118492a816b917f68f96ac99b4d1dca3072799c5a081602585ed17`
* [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics) git [b04e2ef0](https://github.com/openshift/openshift-state-metrics/commit/b04e2ef05498c2a4504bd9396a3290c4f263fc37) `sha256:8b2c0b21d6156a24ea7d52147dda380ab6763670cfbdfda02c259dcb1520f32a`
* [openstack-cinder-csi-driver](https://github.com/openshift/cloud-provider-openstack) git [649398c2](https://github.com/openshift/cloud-provider-openstack/commit/649398c2a16731984e65719f6b8b323df79f3ff1) `sha256:90702ea7e9c524ecdee471746d042711055022f874101cac32c5b4a8d1895f01`
* [openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack) git [649398c2](https://github.com/openshift/cloud-provider-openstack/commit/649398c2a16731984e65719f6b8b323df79f3ff1) `sha256:e0598eabbf160f7d42ea812d2c2056af4a870b234f75beb012eef20fd030fb00`
* [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack) git [c91265ed](https://github.com/openshift/cluster-api-provider-openstack/commit/c91265ed4f82c0b36fbfc50040b8180f04fcf4cc) `sha256:6165c99a68aaebef857571c200563150b57788b327e6c1caee048cb353b871e8`
* [openstack-resource-controller](https://github.com/openshift/openstack-resource-controller) git [bf0d2c88](https://github.com/openshift/openstack-resource-controller/commit/bf0d2c88d6bf9bd90b24c979ea63dc37606b45fc) `sha256:c24c96809cb1765b958e0c77f888bb38dcaa93adecfb428de23f6c27b36fa56c`
* [operator-marketplace](https://github.com/operator-framework/operator-marketplace) git [4ccd56c9](https://github.com/operator-framework/operator-marketplace/commit/4ccd56c96839e2389e12bf3f8390a6c062e9b2cf) `sha256:c32eff3a04e658471327b2d34c8ca040be7eacedfc24a8a787d403f3a84305a1`
* [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator) git [4036cd3b](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/commit/4036cd3b5e45cf4d8c3c34def599657435601661) `sha256:4959fd057036038e89f388aa523f6fb90506fe77c34cb3eedbcff02a6a703ba7`
* [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs) git [d634e80b](https://github.com/openshift/cloud-provider-powervs/commit/d634e80b52e7ecb087163eb5927450dc884e24df) `sha256:c63bf36ff4bdc615aa831e87e27cefa82f4369c02225e0b63fc8e649f8ca7772`
* [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs) git [f011b3c7](https://github.com/openshift/machine-api-provider-powervs/commit/f011b3c727c5377302b2ab0a203457490b930a3d) `sha256:50565e12eb892864dec4a9facd6a2aafacd32f5d75f7be1b846c9af8368d1f56`
* [prom-label-proxy](https://github.com/openshift/prom-label-proxy) git [3bc94eed](https://github.com/openshift/prom-label-proxy/commit/3bc94eed432cacc37930aa4b0d8ff375e370cbbe) `sha256:6b9105debf18b8e2e3eaf2e9531388595ef0dbffce10a81f81f41eecfad0d4f9`
* [prometheus-node-exporter](https://github.com/openshift/node_exporter) git [fa749d65](https://github.com/openshift/node_exporter/commit/fa749d65d8eca1cc937554baab91385a78ec8ce1) `sha256:c9e21a1a1e5dcb1c5022b1520fb1ae551a70985eb7aa652fe5229b37b90c34cb`
* [route-controller-manager](https://github.com/openshift/route-controller-manager) git [1a0229e4](https://github.com/openshift/route-controller-manager/commit/1a0229e40e5c569c6c59f6b10c26584bccd084b5) `sha256:5dbea5bf8bf74c57c8d760d0b1ee57280557b2a0a689fc704fb54d8550886add`
* [service-ca-operator](https://github.com/openshift/service-ca-operator) git [37e0c317](https://github.com/openshift/service-ca-operator/commit/37e0c31790b6a954214817974a56c9a699d0cf78) `sha256:8feef81b1c1a9169bac1789e5305fcfb5b49b0ce214856ee31b6117c0f8bec46`
* [telemeter](https://github.com/openshift/telemeter) git [d07a8330](https://github.com/openshift/telemeter/commit/d07a833015fe91fe2df12589a6877dde15e9a227) `sha256:7664df5973eaafaab5824f6d5dd359634787116ddba6441f32c3da6e5509ab0f`
* [thanos](https://github.com/openshift/thanos) git [e09de117](https://github.com/openshift/thanos/commit/e09de117035d272a18dbd94d0bc8c8e29346026e) `sha256:0a399645ece297d42bc6458efed3376544e17c7a3b625befd15eeada079f1822`
* [volume-data-source-validator](https://github.com/openshift/volume-data-source-validator) git [0e61642f](https://github.com/openshift/volume-data-source-validator/commit/0e61642f8d898ee199e42f37319864851dd3627f) `sha256:53e9339bea6a795588d14d9ab61ef59bbf6fec8d1a72b0edf56665b25fe08f74`
* [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere) git [b93eb64f](https://github.com/openshift/cloud-provider-vsphere/commit/b93eb64ff72e7c005687813c8b478d694a0f517a) `sha256:d011a1df996419b5e4da7c5cb683c01e593b28d37b420f32368dbb13a46aaa7a`
* [vsphere-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-vsphere) git [769d0fb7](https://github.com/openshift/cluster-api-provider-vsphere/commit/769d0fb781dfb53df5d533b917c363a553185fd6) `sha256:a56f424ea9ad69c2fcf10b1ef856d09ee83f4955811ba5b2e5f75195267de23a`
* [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator) git [13b68a91](https://github.com/openshift/vmware-vsphere-csi-driver-operator/commit/13b68a91a148667d46bd06ad8fcb839be984671e) `sha256:185b8eb0f6989c4f2df4ed7989ccf6a51bc84300cda69e2c4fd802f8263bc667`


### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/b22ad07bac5979e1691ccb19ded93a5bde8ef570)

* [OCPBUGS-89951](https://issues.redhat.com/browse/OCPBUGS-89951): patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.2 [#10798](https://github.com/openshift/assisted-service/pull/10798)
* [OCPBUGS-105890](https://issues.redhat.com/browse/OCPBUGS-105890): manifest_generator add a label to LUKS root [#10803](https://github.com/openshift/assisted-service/pull/10803)
* [Full changelog](https://github.com/openshift/assisted-service/compare/257fad749a2424b44eae30b0b72360e1e246880e...b22ad07bac5979e1691ccb19ded93a5bde8ef570)


### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/6b65bbfaa7224f7c314fb946acac0cc236f90fe5)

* [OCPBUGS-103794](https://issues.redhat.com/browse/OCPBUGS-103794): Bump x/net to v0.35.0-sec.4 [#2291](https://github.com/openshift/assisted-installer/pull/2291)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/a26df06f52f1426defcf42c6cebcec5b7a956df3...6b65bbfaa7224f7c314fb946acac0cc236f90fe5)


### [agent-installer-ui](https://github.com/openshift-assisted/assisted-installer-ui/tree/90ca98199613be5fa94e7bec1b20093e0f1e5f33)

* [OCPBUGS-104550](https://issues.redhat.com/browse/OCPBUGS-104550): Bump tmp to ^0.2.6 to address CVE-2026-44705 (#4016) [#4016](https://github.com/openshift-assisted/assisted-installer-ui/pull/4016)
* Update OWNERS file (#3992) [#3992](https://github.com/openshift-assisted/assisted-installer-ui/pull/3992)
* [OCPBUGS-100524](https://issues.redhat.com/browse/OCPBUGS-100524), [OCPBUGS-103012](https://issues.redhat.com/browse/OCPBUGS-103012): Bump ip-address to fix CVE-2026-54272 and CVE-2026-69192 (#3988) [#3988](https://github.com/openshift-assisted/assisted-installer-ui/pull/3988)
* [OCPBUGS-109781](https://issues.redhat.com/browse/OCPBUGS-109781): Bump tar pkg version to ^7.5.21 to address CVE-2026-73566 (#3972) [#3972](https://github.com/openshift-assisted/assisted-installer-ui/pull/3972)
* [ART-22057](https://issues.redhat.com/browse/ART-22057): Move @types/react-dom to dependencies in chatbot (#3958) [#3958](https://github.com/openshift-assisted/assisted-installer-ui/pull/3958)
* [OCPBUGS-104460](https://issues.redhat.com/browse/OCPBUGS-104460): Pin minimatch to ^10.2.6 and brace-expansion to ^5.0.9 (CVE-2026-14257) (#3961) [#3961](https://github.com/openshift-assisted/assisted-installer-ui/pull/3961)
* [OCPBUGS-91623](https://issues.redhat.com/browse/OCPBUGS-91623): Bump ws to 8.21.0 for CVE-2026-45736 (#3907) [#3907](https://github.com/openshift-assisted/assisted-installer-ui/pull/3907)
* [OCPBUGS-98265](https://issues.redhat.com/browse/OCPBUGS-98265): Bump tar to 7.5.19 in 4.20 (#3892) [#3892](https://github.com/openshift-assisted/assisted-installer-ui/pull/3892)
* Apply patches (#3876) [#3876](https://github.com/openshift-assisted/assisted-installer-ui/pull/3876)
* Update OWNERS file (#3881) [#3881](https://github.com/openshift-assisted/assisted-installer-ui/pull/3881)
* [OCPBUGS-98429](https://issues.redhat.com/browse/OCPBUGS-98429): Bump js-yaml to 4.3.0 in 4.20 (#3864) [#3864](https://github.com/openshift-assisted/assisted-installer-ui/pull/3864)
* [OCPBUGS-89699](https://issues.redhat.com/browse/OCPBUGS-89699): bump form-data to 2.5.6 and 4.0.6 via yarn.lock patch and scoped resolution to address CVE-2026-12143 (#3879) [#3879](https://github.com/openshift-assisted/assisted-installer-ui/pull/3879)
* patch CVE-2026-9277 and CVE-2026-42338 via yarn resolutions (#3854) [#3854](https://github.com/openshift-assisted/assisted-installer-ui/pull/3854)
* [OCPBUGS-88394](https://issues.redhat.com/browse/OCPBUGS-88394), [OCPBUGS-88407](https://issues.redhat.com/browse/OCPBUGS-88407): Bump axios to 1.18.1 (#3859) [#3859](https://github.com/openshift-assisted/assisted-installer-ui/pull/3859)
* [Full changelog](https://github.com/openshift-assisted/assisted-installer-ui/compare/1f0fec5ed74412d0f96e6a7239e9689b24563ebe...90ca98199613be5fa94e7bec1b20093e0f1e5f33)


### [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws/tree/6a040755480eebf24fc80842b870762addb8b01e)

* 🐛 OCPBUGS-123528: UPSTREAM: &lt;carry&gt;: Fix unit tests for OpenShift CI environment [#638](https://github.com/openshift/cluster-api-provider-aws/pull/638)
* 🌱 [release-4.20] OCPBUGS-123527: UPSTREAM: &lt;carry&gt;: Remove upstream .github files unused in OpenShift CI [#637](https://github.com/openshift/cluster-api-provider-aws/pull/637)
* [Full changelog](https://github.com/openshift/cluster-api-provider-aws/compare/300439ea0736444a160c061578b3bd8956d4f7e6...6a040755480eebf24fc80842b870762addb8b01e)


### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/9577298b014d014dc42eabb4b8f9b8957146d188)

* [OCPBUGS-103805](https://issues.redhat.com/browse/OCPBUGS-103805), [OCPBUGS-103816](https://issues.redhat.com/browse/OCPBUGS-103816): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#612](https://github.com/openshift/csi-operator/pull/612)
* [Full changelog](https://github.com/openshift/csi-operator/compare/910424793d59d291a9e6addaccbd2facf53e2bff...9577298b014d014dc42eabb4b8f9b8957146d188)


### [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure/tree/5a127871523fc21f02f93a26d1e3113075fb3b78)

* [OCPBUGS-89962](https://issues.redhat.com/browse/OCPBUGS-89962): Address CVE-2026-39829 [#399](https://github.com/openshift/cluster-api-provider-azure/pull/399)
* [Full changelog](https://github.com/openshift/cluster-api-provider-azure/compare/c29c68dd2a576f19771dfd0c349b34f890063cdc...5a127871523fc21f02f93a26d1e3113075fb3b78)


### [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver/tree/b772189f1cf2f881052e7ff8d65d7338f16a72ac)

* UPSTREAM: 3635: OCPBUGS-96365: Bump golang.org/x/net to  v0.50.0-sec.4 [#167](https://github.com/openshift/azure-disk-csi-driver/pull/167)
* [OCPBUGS-106191](https://issues.redhat.com/browse/OCPBUGS-106191): UPSTREAM: 3277: fix: allow `.` in Azure tags [#169](https://github.com/openshift/azure-disk-csi-driver/pull/169)
* [Full changelog](https://github.com/openshift/azure-disk-csi-driver/compare/e1ea4e929c51a3fe6823ffb5fd17fb07971ca86d...b772189f1cf2f881052e7ff8d65d7338f16a72ac)


### [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver/tree/bdffa74f61bbdaefccdd984541c0fd303810209e)

* [OCPBUGS-103813](https://issues.redhat.com/browse/OCPBUGS-103813): Bump golang.org/x/net to v0.50.0-sec.4 [#156](https://github.com/openshift/azure-file-csi-driver/pull/156)
* [OCPBUGS-111841](https://issues.redhat.com/browse/OCPBUGS-111841): always chmod expected setgid bit in TestChmodIfPermissionMismatch [#153](https://github.com/openshift/azure-file-csi-driver/pull/153)
* [OCPBUGS-92939](https://issues.redhat.com/browse/OCPBUGS-92939): Bump golang.org/x/crypto to v0.48.0-sec.1 [#146](https://github.com/openshift/azure-file-csi-driver/pull/146)
* [Full changelog](https://github.com/openshift/azure-file-csi-driver/compare/c7bce6e96df8f14b61ead343b901087a44736513...bdffa74f61bbdaefccdd984541c0fd303810209e)


### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/93423109b69567eaef489f262d5c2b103dea9219)

* [OCPBUGS-103785](https://issues.redhat.com/browse/OCPBUGS-103785): [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#59](https://github.com/openshift/azure-kubernetes-kms/pull/59)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/1d6fb8798544b0d0ff60582f82f885e5a6a776ba...93423109b69567eaef489f262d5c2b103dea9219)


### [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity/tree/357712a65437ea3329a8d8a62cf64d27a70dda12)

* [OCPBUGS-81944](https://issues.redhat.com/browse/OCPBUGS-81944): Bump go-jose/go-jose/v4@v4.1.4 [#51](https://github.com/openshift/azure-workload-identity/pull/51)
* [Full changelog](https://github.com/openshift/azure-workload-identity/compare/e5e14097c1df6c26da593354ad6ccfb7b42afbb2...357712a65437ea3329a8d8a62cf64d27a70dda12)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/0b42839adc0600397af50204d4efb6b173ea1bbe)

* [OCPBUGS-100063](https://issues.redhat.com/browse/OCPBUGS-100063): openstack: Reserve addresses for load balancer [#10723](https://github.com/openshift/installer/pull/10723)
* [OCPBUGS-112324](https://issues.redhat.com/browse/OCPBUGS-112324): [release-4.20]: Enrich IBI config image proxy NoProxy with cluster networks [#10779](https://github.com/openshift/installer/pull/10779)
* [OCPBUGS-114414](https://issues.redhat.com/browse/OCPBUGS-114414): Update gcloud version to one that can be found [#10816](https://github.com/openshift/installer/pull/10816)
* [OCPBUGS-113536](https://issues.redhat.com/browse/OCPBUGS-113536): Update RHCOS-release-4.20 bootimage metadata to 9.6.20260818-0 [#10799](https://github.com/openshift/installer/pull/10799)
* [Full changelog](https://github.com/openshift/installer/compare/349feecf1e7597a0a62cf93c97e0870ac7cff2e3...0b42839adc0600397af50204d4efb6b173ea1bbe)


### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/f74f7d4c30cb936e84c79bbc60a9f57660058e98)

* [OCPBUGS-98095](https://issues.redhat.com/browse/OCPBUGS-98095): Add BMH finalizer on PreprovisioningImage [#507](https://github.com/openshift/baremetal-operator/pull/507)
* [Full changelog](https://github.com/openshift/baremetal-operator/compare/9ab97279a18653c9cb8dd3fb9976139b029bd469...f74f7d4c30cb936e84c79bbc60a9f57660058e98)


### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/ef515cfbef680d4040becc4a180afb7a195270a4)

* [OCPBUGS-103964](https://issues.redhat.com/browse/OCPBUGS-103964): [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#2381](https://github.com/openshift/oc/pull/2381)
* [OCPBUGS-91324](https://issues.redhat.com/browse/OCPBUGS-91324), [OCPBUGS-94907](https://issues.redhat.com/browse/OCPBUGS-94907): Bump golang.org/x/net to openshift-sustaining/net v0.50.0-sec.2 [#2342](https://github.com/openshift/oc/pull/2342)
* [Full changelog](https://github.com/openshift/oc/compare/02b0b2d9994a35535b710dd51ac604ed47b29bc9...ef515cfbef680d4040becc4a180afb7a195270a4)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/c6a7e1a6b84b964531d6c842f362f664dd777746)

* NO-JIRA: Revert "OCPBUGS-87109 Scope minted AWS IAM policies to cluster-owned resources" [#1061](https://github.com/openshift/cloud-credential-operator/pull/1061)
* [OCPBUGS-87109](https://issues.redhat.com/browse/OCPBUGS-87109): Scope minted AWS IAM policies to cluster-owned resources [#1047](https://github.com/openshift/cloud-credential-operator/pull/1047)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/080ef1ef21966e775f9853e75b4d0abed6170e58...c6a7e1a6b84b964531d6c842f362f664dd777746)


### [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler/tree/5789322ed3215955ce39c75c185eef9b16ee987f)

* [OCPBUGS-109662](https://issues.redhat.com/browse/OCPBUGS-109662): UPSTREAM: 9458: fix(clusterapi): use kind-aware version discovery for infra references [#435](https://github.com/openshift/kubernetes-autoscaler/pull/435)
* [Full changelog](https://github.com/openshift/kubernetes-autoscaler/compare/6b1d2ef88e19d32143d389de6999c765c7e30cad...5789322ed3215955ce39c75c185eef9b16ee987f)


### [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator/tree/d1311e1f6a6c61c86c80e978681822156c6441fb)

* [OCPBUGS-103824](https://issues.redhat.com/browse/OCPBUGS-103824): Bump x/net package in release-4.20 [#384](https://github.com/openshift/cluster-autoscaler-operator/pull/384)
* [Full changelog](https://github.com/openshift/cluster-autoscaler-operator/compare/147e5a7ff20b46ade7dd932b47e06ca82729f5e8...d1311e1f6a6c61c86c80e978681822156c6441fb)


### [cluster-config-api](https://github.com/openshift/api/tree/05da40ea98557f8351483a39db3d0e7d9076bc8f)

* [OCPBUGS-82147](https://issues.redhat.com/browse/OCPBUGS-82147), [OCPBUGS-92038](https://issues.redhat.com/browse/OCPBUGS-92038), [OCPBUGS-92039](https://issues.redhat.com/browse/OCPBUGS-92039), [OCPBUGS-92041](https://issues.redhat.com/browse/OCPBUGS-92041), [OCPBUGS-92042](https://issues.redhat.com/browse/OCPBUGS-92042): Promote GatewayAPIWithoutOLM feature gate to Default [#2869](https://github.com/openshift/api/pull/2869)
* [OCPBUGS-98332](https://issues.redhat.com/browse/OCPBUGS-98332): add new serviceAccountToken fs type [#2925](https://github.com/openshift/api/pull/2925)
* [OCPBUGS-82147](https://issues.redhat.com/browse/OCPBUGS-82147), [OCPBUGS-92038](https://issues.redhat.com/browse/OCPBUGS-92038), [OCPBUGS-92039](https://issues.redhat.com/browse/OCPBUGS-92039), [OCPBUGS-92041](https://issues.redhat.com/browse/OCPBUGS-92041), [OCPBUGS-92042](https://issues.redhat.com/browse/OCPBUGS-92042): Promote GatewayAPIWithoutOLM feature gate to TechPreview [#2874](https://github.com/openshift/api/pull/2874)
* [Full changelog](https://github.com/openshift/api/compare/6755619009c291e10c1903d20c579eae4bac9854...05da40ea98557f8351483a39db3d0e7d9076bc8f)


### [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator/tree/32546df9054ebbec1055344f8cad25254049df50)

* [OCPBUGS-114721](https://issues.redhat.com/browse/OCPBUGS-114721): Fixed issue where nameserver is not set when recreating cpms [#418](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/418)
* [Full changelog](https://github.com/openshift/cluster-control-plane-machine-set-operator/compare/0bbafe24ade564bc62554251f36de90d524abcde...32546df9054ebbec1055344f8cad25254049df50)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/8e4c40f161d8341d640659ca2779a4294960c183)

* [OCPBUGS-103834](https://issues.redhat.com/browse/OCPBUGS-103834): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.3 [#1569](https://github.com/openshift/cluster-ingress-operator/pull/1569)
* [OCPBUGS-99476](https://issues.redhat.com/browse/OCPBUGS-99476): Respect proxy configuration on gwapi provisioning [#1519](https://github.com/openshift/cluster-ingress-operator/pull/1519)
* [OCPBUGS-99910](https://issues.redhat.com/browse/OCPBUGS-99910): E2E test for internal LoadBalancer Annotations [#1526](https://github.com/openshift/cluster-ingress-operator/pull/1526)
* [OCPBUGS-99484](https://issues.redhat.com/browse/OCPBUGS-99484): Add e2e test for Gateway API infrastructure annotations [#1521](https://github.com/openshift/cluster-ingress-operator/pull/1521)
* [OCPBUGS-98968](https://issues.redhat.com/browse/OCPBUGS-98968): Bump Istio version from v1.26.2 to v1.26.8 [#1510](https://github.com/openshift/cluster-ingress-operator/pull/1510)
* [OCPBUGS-85155](https://issues.redhat.com/browse/OCPBUGS-85155): Fix e2e tests to work on platforms with unmanaged DNS [#1514](https://github.com/openshift/cluster-ingress-operator/pull/1514)
* [OCPBUGS-99225](https://issues.redhat.com/browse/OCPBUGS-99225): Fix logic on gatewayapi test cleanup [#1512](https://github.com/openshift/cluster-ingress-operator/pull/1512)
* [OCPBUGS-88353](https://issues.redhat.com/browse/OCPBUGS-88353), [OCPBUGS-88354](https://issues.redhat.com/browse/OCPBUGS-88354): Ensure canary cert matches the default ingress controller's cert [#1469](https://github.com/openshift/cluster-ingress-operator/pull/1469)
* [OCPBUGS-82147](https://issues.redhat.com/browse/OCPBUGS-82147), [OCPBUGS-92038](https://issues.redhat.com/browse/OCPBUGS-92038), [OCPBUGS-92039](https://issues.redhat.com/browse/OCPBUGS-92039), [OCPBUGS-92041](https://issues.redhat.com/browse/OCPBUGS-92041), [OCPBUGS-92042](https://issues.redhat.com/browse/OCPBUGS-92042): Remove feature-set annotations from Sail Library RBAC Manifests [#1497](https://github.com/openshift/cluster-ingress-operator/pull/1497)
* [OCPBUGS-82147](https://issues.redhat.com/browse/OCPBUGS-82147), [OCPBUGS-92038](https://issues.redhat.com/browse/OCPBUGS-92038), [OCPBUGS-92039](https://issues.redhat.com/browse/OCPBUGS-92039), [OCPBUGS-92041](https://issues.redhat.com/browse/OCPBUGS-92041), [OCPBUGS-92042](https://issues.redhat.com/browse/OCPBUGS-92042): Replace OLM-based Istio install with Sail Library [#1459](https://github.com/openshift/cluster-ingress-operator/pull/1459)
* [OCPBUGS-85523](https://issues.redhat.com/browse/OCPBUGS-85523): Remove restriction of unmanaged x-k8s.io [#1488](https://github.com/openshift/cluster-ingress-operator/pull/1488)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/006a3edb4eec250bc414da316d912fc5231d195b...8e4c40f161d8341d640659ca2779a4294960c183)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/e9accf887ef1182f0a96e3086d54441ba8bcae40)

* [OCPBUGS-98555](https://issues.redhat.com/browse/OCPBUGS-98555): scc: fix uid{Min,Max}Range for nested-container [#2226](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2226)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/00259384502230d2c5b463dcda8a5c05caf2154e...e9accf887ef1182f0a96e3086d54441ba8bcae40)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/84473d49e3242bd9a2f93848663c5cc51e694078)

* [OCPBUGS-112574](https://issues.redhat.com/browse/OCPBUGS-112574): [release-4.20] Makefile: version-stamp golangci-lint binary to prevent stale linter [#3066](https://github.com/openshift/cluster-monitoring-operator/pull/3066)
* [OCPBUGS-103845](https://issues.redhat.com/browse/OCPBUGS-103845): [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#3072](https://github.com/openshift/cluster-monitoring-operator/pull/3072)
* [OCPBUGS-105309](https://issues.redhat.com/browse/OCPBUGS-105309): [release-4.20] wrap library-go resourceCache with mutex for thread safety [#3043](https://github.com/openshift/cluster-monitoring-operator/pull/3043)
* [OCPBUGS-104538](https://issues.redhat.com/browse/OCPBUGS-104538): Backport e2e stabilization 4.20 [#3028](https://github.com/openshift/cluster-monitoring-operator/pull/3028)
* [OCPBUGS-100371](https://issues.redhat.com/browse/OCPBUGS-100371): [release-4.20] fix: watch cluster wide proxy changes and apply changes accordingly [#3022](https://github.com/openshift/cluster-monitoring-operator/pull/3022)
* [OCPBUGS-99764](https://issues.redhat.com/browse/OCPBUGS-99764): fall back to kube-system/global-pull-secret for telemeter-client token [#3003](https://github.com/openshift/cluster-monitoring-operator/pull/3003)
* [OCPBUGS-92195](https://issues.redhat.com/browse/OCPBUGS-92195): set Prometheus shards value explicitly [#2973](https://github.com/openshift/cluster-monitoring-operator/pull/2973)
* [OCPBUGS-94078](https://issues.redhat.com/browse/OCPBUGS-94078): ship collector:node_scrape_collector_success:avg to Telemetry [#2990](https://github.com/openshift/cluster-monitoring-operator/pull/2990)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/61f1d4b358c24d84183b77e6bcce0ad0e66488c2...84473d49e3242bd9a2f93848663c5cc51e694078)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/907dc8b385a37ba34798eb104c489ba1dc7aeef9)

* [OCPBUGS-113989](https://issues.redhat.com/browse/OCPBUGS-113989): frr-k8s: use Recreate strategy for webhook server deployment on SNO [#3142](https://github.com/openshift/cluster-network-operator/pull/3142)
* [OCPBUGS-105852](https://issues.redhat.com/browse/OCPBUGS-105852): Remove version-specific CNI binary copy logic [#3118](https://github.com/openshift/cluster-network-operator/pull/3118)
* [OCPBUGS-99749](https://issues.redhat.com/browse/OCPBUGS-99749): Bump frr-k8s MAX_FDS from 1024 to 65536 [#3091](https://github.com/openshift/cluster-network-operator/pull/3091)
* [OCPBUGS-98796](https://issues.redhat.com/browse/OCPBUGS-98796): Bump github.com/containernetworking/cni v0.8.0 -&gt; v1.3.0 [#3071](https://github.com/openshift/cluster-network-operator/pull/3071)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/56c830ea4487e978a2697d065217b8851ed6cbd9...907dc8b385a37ba34798eb104c489ba1dc7aeef9)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/c491d1ae719221fdb0031fe7f071a787274f7883)

* [OCPBUGS-115719](https://issues.redhat.com/browse/OCPBUGS-115719): Update PPC help description [#1627](https://github.com/openshift/cluster-node-tuning-operator/pull/1627)
* [OCPBUGS-112026](https://issues.redhat.com/browse/OCPBUGS-112026): BUG-FIX Latency Test [#1594](https://github.com/openshift/cluster-node-tuning-operator/pull/1594)
* [OCPBUGS-111091](https://issues.redhat.com/browse/OCPBUGS-111091): e2e: fix: clear hugepages before switching kernelPageSize to 4k [#1588](https://github.com/openshift/cluster-node-tuning-operator/pull/1588)
* [OCPBUGS-114730](https://issues.redhat.com/browse/OCPBUGS-114730): Use Add() instead of AddRateLimited() for routine Profile enqueues [#1620](https://github.com/openshift/cluster-node-tuning-operator/pull/1620)
* [OCPBUGS-105509](https://issues.redhat.com/browse/OCPBUGS-105509): e2e: fix broken checks and rework netqueue tests to avoid ARM ethtool blackout flakes [#1581](https://github.com/openshift/cluster-node-tuning-operator/pull/1581)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/6401d7f3b34ee63da83a1f9917e9f3e35ff35ed6...c491d1ae719221fdb0031fe7f071a787274f7883)


### [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller/tree/67083fab6cea4dde724efd5be5a22bda1f8437d1)

* [OCPBUGS-98332](https://issues.redhat.com/browse/OCPBUGS-98332): [4.20] add serviceAccountToken volume type to psalabelsyncer [#194](https://github.com/openshift/cluster-policy-controller/pull/194)
* [Full changelog](https://github.com/openshift/cluster-policy-controller/compare/47c783103216aa5e1242632127a5d8f98b8b7455...67083fab6cea4dde724efd5be5a22bda1f8437d1)


### [console](https://github.com/openshift/console/tree/5b47c3a684a1c9d2ef4e42835b865bec046eb492)

* [OCPBUGS-121663](https://issues.redhat.com/browse/OCPBUGS-121663): Validate chart URL in /api/helm/verify [#17147](https://github.com/openshift/console/pull/17147)
* [OCPBUGS-114054](https://issues.redhat.com/browse/OCPBUGS-114054): make cloud provider fields optional during operator install [#17098](https://github.com/openshift/console/pull/17098)
* [OCPBUGS-100517](https://issues.redhat.com/browse/OCPBUGS-100517), [OCPBUGS-101794](https://issues.redhat.com/browse/OCPBUGS-101794): Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss [#17056](https://github.com/openshift/console/pull/17056)
* [OCPBUGS-112274](https://issues.redhat.com/browse/OCPBUGS-112274): Fix flaky TestAsyncCache backend test [#17047](https://github.com/openshift/console/pull/17047)
* Fix OCPBUGS-98785: CVE-2026-48801 [#16854](https://github.com/openshift/console/pull/16854)
* Fix for OCPBUGS-105903: CVE-2026-73086 [#16967](https://github.com/openshift/console/pull/16967)
* [OCPBUGS-109132](https://issues.redhat.com/browse/OCPBUGS-109132): Fix leading whitespace in Quick Start execute code snippets [#17003](https://github.com/openshift/console/pull/17003)
* Fix for OCPBUGS-89701: CVE-2026-12143 [#16646](https://github.com/openshift/console/pull/16646)
* [OCPBUGS-104530](https://issues.redhat.com/browse/OCPBUGS-104530): Re-enable-knative [#16908](https://github.com/openshift/console/pull/16908)
* [OCPBUGS-98436](https://issues.redhat.com/browse/OCPBUGS-98436): [release-4.20] CVE-2026-59869 bump js-yaml [#16916](https://github.com/openshift/console/pull/16916)
* [OCPBUGS-100057](https://issues.redhat.com/browse/OCPBUGS-100057): quickstart page i18n misses (Fix Quick Starts i18n bundle lookup for zh-CN) [#16867](https://github.com/openshift/console/pull/16867)
* [OCPBUGS-99312](https://issues.redhat.com/browse/OCPBUGS-99312): Disable Knative e2e Cypress tests in CI [#16795](https://github.com/openshift/console/pull/16795)
* [OCPBUGS-99167](https://issues.redhat.com/browse/OCPBUGS-99167): fixing severity not showing number of issues [#16620](https://github.com/openshift/console/pull/16620)
* [OCPBUGS-84286](https://issues.redhat.com/browse/OCPBUGS-84286): Bump follow-redirects to 1.16.0 to fix CVE-2026-40895 [#16671](https://github.com/openshift/console/pull/16671)
* Fix for OCPBUGS-81613: CVE-2026-4800 [#16561](https://github.com/openshift/console/pull/16561)
* [OCPBUGS-86746](https://issues.redhat.com/browse/OCPBUGS-86746), [OCPBUGS-87089](https://issues.redhat.com/browse/OCPBUGS-87089), [OCPBUGS-88753](https://issues.redhat.com/browse/OCPBUGS-88753): [release-4.20] bump package: webpack-dev-server, protobufjs, fast-uri [#16674](https://github.com/openshift/console/pull/16674)
* [Full changelog](https://github.com/openshift/console/compare/09b060af5f0025cb4069eca3837e2616e10e0260...5b47c3a684a1c9d2ef4e42835b865bec046eb492)


### [console-operator](https://github.com/openshift/console-operator/tree/75a6c0644907549642dd9d05ac451810f034385c)

* [NETOBSERV-2296](https://issues.redhat.com/browse/NETOBSERV-2296): add missing annotations on netobserv quickstart [#1095](https://github.com/openshift/console-operator/pull/1095)
* [OCPBUGS-100112](https://issues.redhat.com/browse/OCPBUGS-100112): Sort plugin list to make them deterministic [#1202](https://github.com/openshift/console-operator/pull/1202)
* [OCPBUGS-98986](https://issues.redhat.com/browse/OCPBUGS-98986): [4.20] Stabilize telemetry config to prevent continuous console pod rollouts [#1191](https://github.com/openshift/console-operator/pull/1191)
* [Full changelog](https://github.com/openshift/console-operator/compare/2b72d7e8cc652ae7063fb95eae8d36b847742c58...75a6c0644907549642dd9d05ac451810f034385c)


### [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs/tree/c4cdae44ef7c33e4b7ce06a3b599a8bc0707bff7)

* [OCPBUGS-82853](https://issues.redhat.com/browse/OCPBUGS-82853): Bump github.com/moby/spdystream@v0.5.1 [#192](https://github.com/openshift/csi-driver-nfs/pull/192)
* [Full changelog](https://github.com/openshift/csi-driver-nfs/compare/20609066e1bd1dbbd107bfca27af67e0a788760e...c4cdae44ef7c33e4b7ce06a3b599a8bc0707bff7)


### [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner/tree/4edfd76da6d8311f9149cb560f3763b6bdc23313)

* [OCPBUGS-96392](https://issues.redhat.com/browse/OCPBUGS-96392): Bump golang.org/x/net to v0.50.0-sec.4 [#150](https://github.com/openshift/csi-external-provisioner/pull/150)
* [Full changelog](https://github.com/openshift/csi-external-provisioner/compare/eb1e4ac9c60067568674269961b46e7d9c974fe4...4edfd76da6d8311f9149cb560f3763b6bdc23313)


### [csi-external-resizer](https://github.com/openshift/csi-external-resizer/tree/4835292fe73b956b6a350373a45fb0877dd705b7)

* [OCPBUGS-103867](https://issues.redhat.com/browse/OCPBUGS-103867): Bump golang.org/x/net to v0.50.0-sec.4 [#211](https://github.com/openshift/csi-external-resizer/pull/211)
* [OCPBUGS-80613](https://issues.redhat.com/browse/OCPBUGS-80613): Bump google.golang.org/grpc to v1.79.3 [#201](https://github.com/openshift/csi-external-resizer/pull/201)
* [Full changelog](https://github.com/openshift/csi-external-resizer/compare/c674bea9bb6a81e463c7fefa974e2109d829daef...4835292fe73b956b6a350373a45fb0877dd705b7)


### [csi-external-snapshotter, csi-snapshot-controller](https://github.com/openshift/csi-external-snapshotter/tree/d123f362cc13d9b14459af7b9e91eb2a9361d3cd)

* [OCPBUGS-92084](https://issues.redhat.com/browse/OCPBUGS-92084): UPSTREAM: 1392: Fix VolumeSnapshotContent deletion [#225](https://github.com/openshift/csi-external-snapshotter/pull/225)
* [Full changelog](https://github.com/openshift/csi-external-snapshotter/compare/433cf89b4e4d1b437a8a446ece28b217ccf9bd06...d123f362cc13d9b14459af7b9e91eb2a9361d3cd)


### [egress-router-cni](https://github.com/openshift/egress-router-cni/tree/cfcc6c44a9aacf48585dbe6618e5561f6c55666a)

* [OCPBUGS-98796](https://issues.redhat.com/browse/OCPBUGS-98796): Bump containernetworking/cni to v1.3.0 github.com/containernetworking/plugins to 1.4.0 [#107](https://github.com/openshift/egress-router-cni/pull/107)
* [Full changelog](https://github.com/openshift/egress-router-cni/compare/5e0f8d1b545899fda27c5e1cc8707d33cba1b534...cfcc6c44a9aacf48585dbe6618e5561f6c55666a)


### [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp/tree/d4bfe3cf78550cf6eabde8714d44b7c69a6a0652)

* [OCPBUGS-99227](https://issues.redhat.com/browse/OCPBUGS-99227): Fix node.kubernetes.io/exclude-from-external-load-balancers on masters [#129](https://github.com/openshift/cloud-provider-gcp/pull/129)
* NO-JIRA: Update OWNERS [#158](https://github.com/openshift/cloud-provider-gcp/pull/158)
* [Full changelog](https://github.com/openshift/cloud-provider-gcp/compare/d5a5541436d9269006928079fcdc507d0b6d4033...d4bfe3cf78550cf6eabde8714d44b7c69a6a0652)


### [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp/tree/430124471dc855f135f8e9d4256ee3930c0037a0)

* [OCPBUGS-103902](https://issues.redhat.com/browse/OCPBUGS-103902): Bump golang.org/x/net to v0.50.0-sec.3 [#187](https://github.com/openshift/machine-api-provider-gcp/pull/187)
* [Full changelog](https://github.com/openshift/machine-api-provider-gcp/compare/b998cf2532b52ce574c42e93c63965b31b9c6c8b...430124471dc855f135f8e9d4256ee3930c0037a0)


### [gcp-pd-csi-driver-operator](https://github.com/openshift/gcp-pd-csi-driver-operator/tree/9fb0e78b4db18f763f7144ca5c13ee380da07460)

* [OCPBUGS-97961](https://issues.redhat.com/browse/OCPBUGS-97961): no-op OWNERS change to trigger postsubmit jobs [#198](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/198)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver-operator/compare/cb9e68cb5c9498a606a3e71b709a9233f59da1f2...9fb0e78b4db18f763f7144ca5c13ee380da07460)


### [haproxy-router](https://github.com/openshift/router/tree/0fec034e28f1f44ed75dcc1ab96f7135fd9beb49)

* [OCPBUGS-86728](https://issues.redhat.com/browse/OCPBUGS-86728): Prevent SSRF via FQDN-typed EndpointSlices [#819](https://github.com/openshift/router/pull/819)
* [Full changelog](https://github.com/openshift/router/compare/40c34581a02ca043d454034e376771c12d2e995c...0fec034e28f1f44ed75dcc1ab96f7135fd9beb49)


### [hyperkube, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/4012064c4f97c60a48b036469d20df3bcb2ac328)

* [OCPBUGS-105592](https://issues.redhat.com/browse/OCPBUGS-105592): backport kubernetes/conformance umbrella suite [#2741](https://github.com/openshift/kubernetes/pull/2741)
* [OCPBUGS-117657](https://issues.redhat.com/browse/OCPBUGS-117657): Fix performance related issues when selinux metrics are emitted [#2768](https://github.com/openshift/kubernetes/pull/2768)
* [OCPBUGS-93896](https://issues.redhat.com/browse/OCPBUGS-93896): Rebase v1.33.13 in release-4.20 [#2706](https://github.com/openshift/kubernetes/pull/2706)
* [Full changelog](https://github.com/openshift/kubernetes/compare/690775342de24ee56631e38e3f17592b14a6b202...4012064c4f97c60a48b036469d20df3bcb2ac328)


### [hypershift](https://github.com/openshift/hypershift/tree/ef0d161652b3c50b02c686dc63b148ec9061b679)

* [OCPBUGS-94180](https://issues.redhat.com/browse/OCPBUGS-94180): fix registry override matching and propagation to init containers [#8880](https://github.com/openshift/hypershift/pull/8880)
* [OCPBUGS-106185](https://issues.redhat.com/browse/OCPBUGS-106185): fix(upsert): add desired-state hash to detect spec field removals [#9291](https://github.com/openshift/hypershift/pull/9291)
* [OCPBUGS-105812](https://issues.redhat.com/browse/OCPBUGS-105812): Add proxy env vars to AWS cloud-controller-manager deployment [#9284](https://github.com/openshift/hypershift/pull/9284)
* [OCPBUGS-105211](https://issues.redhat.com/browse/OCPBUGS-105211): Apply MetricsSet relabel configs to KAS ServiceMonitor [#9235](https://github.com/openshift/hypershift/pull/9235)
* [OCPBUGS-97923](https://issues.redhat.com/browse/OCPBUGS-97923): fix(nodepool): skip CNI-internal IPs in ClusterNetworkCIDRConflict check [release-4.20] [#8950](https://github.com/openshift/hypershift/pull/8950)
* [OCPBUGS-90085](https://issues.redhat.com/browse/OCPBUGS-90085): Fix NodePool reconciliation failure when updating mirrored immutable ConfigMaps [#8813](https://github.com/openshift/hypershift/pull/8813)
* fix(deps): OCPBUGS-83829: Update runc, selinux, and their transitive deps to fix CVE-2025-52881 [#8750](https://github.com/openshift/hypershift/pull/8750)
* [CNTRLPLANE-3874](https://issues.redhat.com/browse/CNTRLPLANE-3874): Backport controlPlaneVersion status to release-4.20 [#9055](https://github.com/openshift/hypershift/pull/9055)
* [OCPBUGS-90088](https://issues.redhat.com/browse/OCPBUGS-90088): [release-4.20] clear stale EtcdRecoveryActive failure condition when etcd is healthy [#8808](https://github.com/openshift/hypershift/pull/8808)
* [OCPBUGS-99143](https://issues.redhat.com/browse/OCPBUGS-99143): fix(backport): konnectivity agent auth [#9092](https://github.com/openshift/hypershift/pull/9092)
* [OCPBUGS-98574](https://issues.redhat.com/browse/OCPBUGS-98574): [release-4.20] fix(cpo): deduplicate VPC endpoint subnets by AZ to prevent DuplicateSubnetsInSameZone [#8994](https://github.com/openshift/hypershift/pull/8994)
* [OCPBUGS-78400](https://issues.redhat.com/browse/OCPBUGS-78400): remove resource limits from Agent CAPI provider [#7947](https://github.com/openshift/hypershift/pull/7947)
* [OCPBUGS-94175](https://issues.redhat.com/browse/OCPBUGS-94175): fix(cpo): prevent informer creation for inaccessible resource types [#8876](https://github.com/openshift/hypershift/pull/8876)
* [Full changelog](https://github.com/openshift/hypershift/compare/5066edc02269135f5b667dc0e479bd33c3f5c410...ef0d161652b3c50b02c686dc63b148ec9061b679)


### [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud/tree/734ed88aef0de0c76f14aed7866f934d4a24e645)

* [OCPBUGS-86916](https://issues.redhat.com/browse/OCPBUGS-86916): Updating ose-ibmcloud-cluster-api-controllers-container image to be consistent with ART for 4.20 [#154](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/154)
* [OCPBUGS-103886](https://issues.redhat.com/browse/OCPBUGS-103886): Replace golang.org/x/net with openshift-sustaining/net [#174](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/174)
* [Full changelog](https://github.com/openshift/cluster-api-provider-ibmcloud/compare/8b6396a4c78f4791b7f3c5ec404a78b499f8546b...734ed88aef0de0c76f14aed7866f934d4a24e645)


### [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud/tree/4bccd47c2a10f319bae4e1666767d02b40cb604f)

* [OCPBUGS-103892](https://issues.redhat.com/browse/OCPBUGS-103892): replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 [#102](https://github.com/openshift/machine-api-provider-ibmcloud/pull/102)
* [Full changelog](https://github.com/openshift/machine-api-provider-ibmcloud/compare/e63e7a191ccc1d391b574d713899e307a88b466c...4bccd47c2a10f319bae4e1666767d02b40cb604f)


### [insights-operator](https://github.com/openshift/insights-operator/tree/1e73d53025993814c217433d4ac6ac4e52801cd9)

* [OCPBUGS-103898](https://issues.redhat.com/browse/OCPBUGS-103898): Bump golang.org/x/net to v0.50.0-sec.3 [#1353](https://github.com/openshift/insights-operator/pull/1353)
* [OCPBUGS-111834](https://issues.redhat.com/browse/OCPBUGS-111834): secrets and configmap revisions count gathering [#1344](https://github.com/openshift/insights-operator/pull/1344)
* [OCPBUGS-104608](https://issues.redhat.com/browse/OCPBUGS-104608): Fix indentation bug on livenessProbe [#1338](https://github.com/openshift/insights-operator/pull/1338)
* [OCPBUGS-92001](https://issues.redhat.com/browse/OCPBUGS-92001): fall back to kube-system/global-pull-secret for Insights token [#1311](https://github.com/openshift/insights-operator/pull/1311)
* [OCPBUGS-99788](https://issues.redhat.com/browse/OCPBUGS-99788): update HyperShift deployment manifest [#1326](https://github.com/openshift/insights-operator/pull/1326)
* [Full changelog](https://github.com/openshift/insights-operator/compare/4186296303bbe4cf3f276dedf794a69a0723f18b...1e73d53025993814c217433d4ac6ac4e52801cd9)


### [ironic](https://github.com/openshift/ironic-image/tree/396112690a167a1b51fc8917ac839f3dba85df0d)

* [OCPBUGS-105862](https://issues.redhat.com/browse/OCPBUGS-105862): update ironic pin to include CVE-2026-54423 fix (release-4.20) [#891](https://github.com/openshift/ironic-image/pull/891)
* [OCPBUGS-88477](https://issues.redhat.com/browse/OCPBUGS-88477): Updating openstack-ironic commit in requirements.cachito that addresses CVE-2026-43003 [#887](https://github.com/openshift/ironic-image/pull/887)
* [OCPBUGS-100166](https://issues.redhat.com/browse/OCPBUGS-100166): Update openstack-ironic commit hash for CVE-2026-44918 [#881](https://github.com/openshift/ironic-image/pull/881)
* [Full changelog](https://github.com/openshift/ironic-image/compare/73a5749d8f04d366b3d1a54e259837df34a5bff5...396112690a167a1b51fc8917ac839f3dba85df0d)


### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/5cceaa3796a6a83b56b83942fede7ba4859cc16f)

* [OCPBUGS-99887](https://issues.redhat.com/browse/OCPBUGS-99887): Bump ironic-python-agent pinned commit for CVE-2026-66138 [#306](https://github.com/openshift/ironic-agent-image/pull/306)
* [OCPBUGS-88477](https://issues.redhat.com/browse/OCPBUGS-88477): Updating ironic-python-agent commit hash that fixes CVE-2026-43003 [#301](https://github.com/openshift/ironic-agent-image/pull/301)
* [OCPBUGS-95063](https://issues.redhat.com/browse/OCPBUGS-95063): Replace individual package removal with a single rpm -e loop [#284](https://github.com/openshift/ironic-agent-image/pull/284)
* [OCPBUGS-95063](https://issues.redhat.com/browse/OCPBUGS-95063): Replace dnf remove with rpm -e to prevent dependency removal [#272](https://github.com/openshift/ironic-agent-image/pull/272)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/652b8b4dcffda86f61e181b43cda184292372a14...5cceaa3796a6a83b56b83942fede7ba4859cc16f)


### [keepalived-ipfailover](https://github.com/openshift/images/tree/4111471533cb072b6aab4a1ac4d523915f8abef1)

* [OCPBUGS-99902](https://issues.redhat.com/browse/OCPBUGS-99902): Reinstall tzdata if /usr/share/zoneinfo is missing [#249](https://github.com/openshift/images/pull/249)
* [Full changelog](https://github.com/openshift/images/compare/6c1bae0007a21796f1d1235df745c1f5152aa893...4111471533cb072b6aab4a1ac4d523915f8abef1)


### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/358d786274fe81017f7d17cc7310117dca127146)

* [OCPBUGS-99402](https://issues.redhat.com/browse/OCPBUGS-99402): fix CronJob timezone panic and embed tzdata in kube-state-metrics [#152](https://github.com/openshift/kube-state-metrics/pull/152)
* [Full changelog](https://github.com/openshift/kube-state-metrics/compare/8c6ad2ef49bf9e437a3ad42707595139db04cb6e...358d786274fe81017f7d17cc7310117dca127146)


### [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt/tree/d9a04bd9046ab1418d83c7bfb7891f49d8429d20)

* [OCPBUGS-95086](https://issues.redhat.com/browse/OCPBUGS-95086): OWNERS: Update component to Cloud Compute / KubeVirt Provider [#80](https://github.com/openshift/cloud-provider-kubevirt/pull/80)
* [Full changelog](https://github.com/openshift/cloud-provider-kubevirt/compare/a2d607b2f1196ac371074d5fd14df80462de5b8f...d9a04bd9046ab1418d83c7bfb7891f49d8429d20)


### [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver/tree/6c353bb1eb5a021c9e845eac839ce85e95a9fede)

* [OCPBUGS-80543](https://issues.redhat.com/browse/OCPBUGS-80543): Bump google.golang.org/grpc to v1.79.3 [#99](https://github.com/openshift/kubevirt-csi-driver/pull/99)
* [Full changelog](https://github.com/openshift/kubevirt-csi-driver/compare/8fb56226aede45e49fb2f362191c6dbcf50897c6...6c353bb1eb5a021c9e845eac839ce85e95a9fede)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/d87a335c2ca5c48ca5aa485754d3548f5ecb42af)

* [OCPBUGS-115436](https://issues.redhat.com/browse/OCPBUGS-115436): Fix SHA idempotency test in nmstate-configuration.sh [#6480](https://github.com/openshift/machine-config-operator/pull/6480)
* [OCPBUGS-122109](https://issues.redhat.com/browse/OCPBUGS-122109): Update message for MachineOSBuildFailed condition [#6518](https://github.com/openshift/machine-config-operator/pull/6518)
* [OCPBUGS-116934](https://issues.redhat.com/browse/OCPBUGS-116934): Update AMI Whitelist [#6487](https://github.com/openshift/machine-config-operator/pull/6487)
* [OCPBUGS-114390](https://issues.redhat.com/browse/OCPBUGS-114390): Use kubernetes scheme in drain controller event recorder [#6456](https://github.com/openshift/machine-config-operator/pull/6456)
* [OCPBUGS-111311](https://issues.redhat.com/browse/OCPBUGS-111311): Fix duplicate template error [#6411](https://github.com/openshift/machine-config-operator/pull/6411)
* [OCPBUGS-105436](https://issues.redhat.com/browse/OCPBUGS-105436): Use providerSpec.Template in vSphere machineset reconciliation [#6386](https://github.com/openshift/machine-config-operator/pull/6386)
* [OCPBUGS-95577](https://issues.redhat.com/browse/OCPBUGS-95577): Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole [#6256](https://github.com/openshift/machine-config-operator/pull/6256)
* [OCPBUGS-105215](https://issues.redhat.com/browse/OCPBUGS-105215): Update AMI Whitelist [#6377](https://github.com/openshift/machine-config-operator/pull/6377)
* [OCPBUGS-99650](https://issues.redhat.com/browse/OCPBUGS-99650): Delete stale auto-sizing MachineConfigs for non-default (custom) pools 4.20 [#6335](https://github.com/openshift/machine-config-operator/pull/6335)
* [release:4.20] OCPBUGS-98096: In OCB to check when a image is removed the old build is triggered again and the MC should start updating directly and no new MOSB should be triggred [#6285](https://github.com/openshift/machine-config-operator/pull/6285)
* [OCPBUGS-92029](https://issues.redhat.com/browse/OCPBUGS-92029), [OCPBUGS-98746](https://issues.redhat.com/browse/OCPBUGS-98746): [release-4.20] Backport ocl test fixes and shard the test suite [#6305](https://github.com/openshift/machine-config-operator/pull/6305)
* [OCPBUGS-93807](https://issues.redhat.com/browse/OCPBUGS-93807): move cleanUpDuplicatedMC to avoid double reboot on first updated Master node [#6242](https://github.com/openshift/machine-config-operator/pull/6242)
* [OCPBUGS-97906](https://issues.redhat.com/browse/OCPBUGS-97906): Inject proxy into MCC deployment [#6277](https://github.com/openshift/machine-config-operator/pull/6277)
* [OCPBUGS-98214](https://issues.redhat.com/browse/OCPBUGS-98214): fix: update arbiter crio config [#6288](https://github.com/openshift/machine-config-operator/pull/6288)
* [OCPBUGS-97824](https://issues.redhat.com/browse/OCPBUGS-97824): Make vsphere template updates atomic [#6272](https://github.com/openshift/machine-config-operator/pull/6272)
* [OCPBUGS-97844](https://issues.redhat.com/browse/OCPBUGS-97844): Remove sensitive ControllerConfig logging [#6273](https://github.com/openshift/machine-config-operator/pull/6273)
* [OCPBUGS-97586](https://issues.redhat.com/browse/OCPBUGS-97586): Fix kubelet certificate wait loop in criometricsproxy.yaml [#6267](https://github.com/openshift/machine-config-operator/pull/6267)
* [OCPBUGS-96160](https://issues.redhat.com/browse/OCPBUGS-96160): Update AMI Whitelist [#6262](https://github.com/openshift/machine-config-operator/pull/6262)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/eb72ebdbfd7d0b7da2de9499661fc006828e5193...d87a335c2ca5c48ca5aa485754d3548f5ecb42af)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/34c1d0428821f51b9c86982e9d124cd7120dce23)

* [OCPBUGS-98433](https://issues.redhat.com/browse/OCPBUGS-98433): fix for CVE-2026-59869 [#1183](https://github.com/openshift/monitoring-plugin/pull/1183)
* [OCPBUGS-98773](https://issues.redhat.com/browse/OCPBUGS-98773): [release-4.20] replace outdated react-linkify dependency [#1166](https://github.com/openshift/monitoring-plugin/pull/1166)
* NO-JIRA: Fix for OCPBUGS-89697 CVE-2026-12143 [#1138](https://github.com/openshift/monitoring-plugin/pull/1138)
* [OCPBUGS-99027](https://issues.redhat.com/browse/OCPBUGS-99027): Fix CVE-2026-49978 - bump DOMPurify to &gt;= 3.4.7 [#1087](https://github.com/openshift/monitoring-plugin/pull/1087)
* [OU-1240](https://issues.redhat.com/browse/OU-1240): Makefile and package.json to enable test-frontend-ci [#1096](https://github.com/openshift/monitoring-plugin/pull/1096)
* [OU-1240](https://issues.redhat.com/browse/OU-1240): Dockerfile.test permission [#1079](https://github.com/openshift/monitoring-plugin/pull/1079)
* [OCPBUGS-99297](https://issues.redhat.com/browse/OCPBUGS-99297): graph redirect query parameter [#1074](https://github.com/openshift/monitoring-plugin/pull/1074)
* [OU-651](https://issues.redhat.com/browse/OU-651): Fix AlertRules page to display user defined loki alerts [#1058](https://github.com/openshift/monitoring-plugin/pull/1058)
* Fix for OCPBUGS-91621: CVE-2026-45736 [#1025](https://github.com/openshift/monitoring-plugin/pull/1025)
* NO-JIRA: fix incidents unit test [#1039](https://github.com/openshift/monitoring-plugin/pull/1039)
* Fix for OCPBUGS-94012: CVE-2026-13676 [#1030](https://github.com/openshift/monitoring-plugin/pull/1030)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/7a87d245dc33dd13b7c12c75e0d2480e4c7db9b7...34c1d0428821f51b9c86982e9d124cd7120dce23)


### [must-gather](https://github.com/openshift/must-gather/tree/6b2eea0d83ca1f05f9032d66be1c2ee80cfa1459)

* [OCPBUGS-87215](https://issues.redhat.com/browse/OCPBUGS-87215): Add Istio/Gateway API gather scripts to OCP 4.20.z [#555](https://github.com/openshift/must-gather/pull/555)
* [Full changelog](https://github.com/openshift/must-gather/compare/01b8371fa2f13c993074569d80db6d1ee97b57ee...6b2eea0d83ca1f05f9032d66be1c2ee80cfa1459)


### [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon/tree/356bd40b74ec289b7052267a9848c91c80a32708)

* [OCPBUGS-103914](https://issues.redhat.com/browse/OCPBUGS-103914): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 [#151](https://github.com/openshift/network-metrics-daemon/pull/151)
* [Full changelog](https://github.com/openshift/network-metrics-daemon/compare/b81340a9fc6963fa3d64d215a12e8528ca797131...356bd40b74ec289b7052267a9848c91c80a32708)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/80efc6dc729c5010ca951f013e9eb4982f4c17ab)

* [OCPBUGS-98776](https://issues.redhat.com/browse/OCPBUGS-98776): Updating linkify-it to 5.0.2 to fix CVE-2026-48801 [#462](https://github.com/openshift/networking-console-plugin/pull/462)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/8e2ff7cbef2335012be302031cfa0f09ca296001...80efc6dc729c5010ca951f013e9eb4982f4c17ab)


### [olm-catalogd, olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller/tree/39c3a80d919cafc207f5f208a5f88b23e468cd8d)

* [OCPBUGS-100431](https://issues.redhat.com/browse/OCPBUGS-100431): Fix cache path to avoid /var/cache/dnf conflict [#786](https://github.com/openshift/operator-framework-operator-controller/pull/786)
* [OCPBUGS-100075](https://issues.redhat.com/browse/OCPBUGS-100075): increase catalog HTTP client timeout from 10s to 5m [#777](https://github.com/openshift/operator-framework-operator-controller/pull/777)
* [Full changelog](https://github.com/openshift/operator-framework-operator-controller/compare/66f771320f0c23b0df5c68a5876c367a1809775d...39c3a80d919cafc207f5f208a5f88b23e468cd8d)


### [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack/tree/02e56026c3a2628c8a5115f4f5bc2bb3514ef6c3)

* [OCPBUGS-94016](https://issues.redhat.com/browse/OCPBUGS-94016): Revendor CAPO [#172](https://github.com/openshift/machine-api-provider-openstack/pull/172)
* [Full changelog](https://github.com/openshift/machine-api-provider-openstack/compare/7f8ae5007e4299769e25172a821342dc2874567c...02e56026c3a2628c8a5115f4f5bc2bb3514ef6c3)


### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/e1d090d165aa3e31de614b18da7cf4dd2f6976f6)

* [OCPBUGS-103940](https://issues.redhat.com/browse/OCPBUGS-103940), [OCPBUGS-103947](https://issues.redhat.com/browse/OCPBUGS-103947), [OCPBUGS-103949](https://issues.redhat.com/browse/OCPBUGS-103949): Replace golang.org/x/net with githubcom/openshift-sustaining/net@v0.50.0-sec.3- #1364 [#1364](https://github.com/openshift/operator-framework-olm/pull/1364)
* [OCPBUGS-95400](https://issues.redhat.com/browse/OCPBUGS-95400), [OCPBUGS-95403](https://issues.redhat.com/browse/OCPBUGS-95403): bumping containerd to v1.7.33 [#1352](https://github.com/openshift/operator-framework-olm/pull/1352)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/1628e53777871f6c264d41a870cc4ee7248106f2...e1d090d165aa3e31de614b18da7cf4dd2f6976f6)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/c28f7669a9ef8e28a47163b1656c5647ea8a725c)

* [OCPBUGS-105423](https://issues.redhat.com/browse/OCPBUGS-105423): Fix traffic leak in egress IP on secondary interface [#3376](https://github.com/openshift/ovn-kubernetes/pull/3376)
* [OCPBUGS-105557](https://issues.redhat.com/browse/OCPBUGS-105557): Broadcast traffic fan-out across UDNs hits OVS resubmit limit [#3377](https://github.com/openshift/ovn-kubernetes/pull/3377)
* [OCPBUGS-99643](https://issues.redhat.com/browse/OCPBUGS-99643): Migrate ovs external_ids bash ovs-vsctl calls to libovsdb [#3326](https://github.com/openshift/ovn-kubernetes/pull/3326)
* [OCPBUGS-95076](https://issues.redhat.com/browse/OCPBUGS-95076): prevent duplicate logical_router_static_route [#3275](https://github.com/openshift/ovn-kubernetes/pull/3275)
* [OCPBUGS-99542](https://issues.redhat.com/browse/OCPBUGS-99542): kubevirt: skip source LSP re-enable when source pod is not local [#3318](https://github.com/openshift/ovn-kubernetes/pull/3318)
* [OCPBUGS-99543](https://issues.redhat.com/browse/OCPBUGS-99543): kubevirt: Support handling vm hostname field [#3319](https://github.com/openshift/ovn-kubernetes/pull/3319)
* [OCPBUGS-82872](https://issues.redhat.com/browse/OCPBUGS-82872): Bump github.com/moby/spdystream to v0.5.1 [#3316](https://github.com/openshift/ovn-kubernetes/pull/3316)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/e02cc75645fbc8981239e4144da1cd4dd98b1b17...c28f7669a9ef8e28a47163b1656c5647ea8a725c)


### [powervs-block-csi-driver](https://github.com/openshift/ibm-powervs-block-csi-driver/tree/22cfe3971df6bbe0bad8f2074b342c199e4de0f3)

* [OCPBUGS-101351](https://issues.redhat.com/browse/OCPBUGS-101351), [OCPBUGS-103945](https://issues.redhat.com/browse/OCPBUGS-103945), [OCPBUGS-89652](https://issues.redhat.com/browse/OCPBUGS-89652), [OCPBUGS-89986](https://issues.redhat.com/browse/OCPBUGS-89986), [OCPBUGS-90451](https://issues.redhat.com/browse/OCPBUGS-90451), [OCPBUGS-91082](https://issues.redhat.com/browse/OCPBUGS-91082), [OCPBUGS-92501](https://issues.redhat.com/browse/OCPBUGS-92501), [OCPBUGS-92964](https://issues.redhat.com/browse/OCPBUGS-92964), [OCPBUGS-93471](https://issues.redhat.com/browse/OCPBUGS-93471), [OCPBUGS-94893](https://issues.redhat.com/browse/OCPBUGS-94893), [OCPBUGS-96442](https://issues.redhat.com/browse/OCPBUGS-96442): Bump golang.org dependencies [#146](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/146)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver/compare/8faa079fe4ba90ca37e7112e4be8a77ccf221e77...22cfe3971df6bbe0bad8f2074b342c199e4de0f3)


### [prometheus](https://github.com/openshift/prometheus/tree/6739fa4523d0b63948f4534d6643e3406dd5d2aa)

* [OCPBUGS-93713](https://issues.redhat.com/browse/OCPBUGS-93713): fix for CVE-2026-42151- #358 [#358](https://github.com/openshift/prometheus/pull/358)
* [OCPBUGS-88682](https://issues.redhat.com/browse/OCPBUGS-88682): remote: validate snappy decoded length before allocation in read endpoint [#342](https://github.com/openshift/prometheus/pull/342)
* [Full changelog](https://github.com/openshift/prometheus/compare/120aea706a6a3858175d1e421d1b325341f9c4b9...6739fa4523d0b63948f4534d6643e3406dd5d2aa)


### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/0bafd4edf6a8e758c8d6c2725554fa79fa9f94da)

* [OCPBUGS-98175](https://issues.redhat.com/browse/OCPBUGS-98175): build(deps): bump github.com/hashicorp/memberlist to a… [#160](https://github.com/openshift/prometheus-alertmanager/pull/160)
* [OCPBUGS-100353](https://issues.redhat.com/browse/OCPBUGS-100353): Set testdata CA expiry to 20 years from issue date (#4112) [#149](https://github.com/openshift/prometheus-alertmanager/pull/149)
* [OCPBUGS-99449](https://issues.redhat.com/browse/OCPBUGS-99449): embed tzdata in the alertmanager binary [#143](https://github.com/openshift/prometheus-alertmanager/pull/143)
* [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/419f2843332265d44982920d6fb4db220ec26f91...0bafd4edf6a8e758c8d6c2725554fa79fa9f94da)


### [prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator/tree/da70230cf87874ce627cb036ec37ce27c79bdd9d)

* [OCPBUGS-103950](https://issues.redhat.com/browse/OCPBUGS-103950), [OCPBUGS-103952](https://issues.redhat.com/browse/OCPBUGS-103952): [release-4.20] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#395](https://github.com/openshift/prometheus-operator/pull/395)
* [Full changelog](https://github.com/openshift/prometheus-operator/compare/425294dded74054100db465d296b2aa76e7a691e...da70230cf87874ce627cb036ec37ce27c79bdd9d)


### [rhel-coreos, rhel-coreos-extensions](https://github.com/openshift/os/tree/847b7d8c3b60f60e86f1de0b7efebb746c75d1bc)

* [OCPBUGS-105533](https://issues.redhat.com/browse/OCPBUGS-105533): NetworkManager-ovs has moved to RHCOS [#1959](https://github.com/openshift/os/pull/1959)
* [Full changelog](https://github.com/openshift/os/compare/ee943c37e640fcc5812d4a2a20ac66d57984e79c...847b7d8c3b60f60e86f1de0b7efebb746c75d1bc)


### [tests](https://github.com/openshift/origin/tree/36e5f07c6805241a2e0c09ba98695b277de87eaa)

* [OCPBUGS-117011](https://issues.redhat.com/browse/OCPBUGS-117011): Raise status polling timeout and write bound [#31596](https://github.com/openshift/origin/pull/31596)
* [OCPBUGS-114440](https://issues.redhat.com/browse/OCPBUGS-114440): Fix probe termination test to use pod status instead of kubelet event text [#31570](https://github.com/openshift/origin/pull/31570)
* [OCPBUGS-100440](https://issues.redhat.com/browse/OCPBUGS-100440): retry GetVotingMemberNames on transient etcd client fails [#31508](https://github.com/openshift/origin/pull/31508)
* [OCPBUGS-99782](https://issues.redhat.com/browse/OCPBUGS-99782): Backport node_e2e test migrations [#31430](https://github.com/openshift/origin/pull/31430)
* [OCPBUGS-99301](https://issues.redhat.com/browse/OCPBUGS-99301): admit and extract non-payload 4.20 [#31387](https://github.com/openshift/origin/pull/31387)
* [OCPBUGS-85523](https://issues.redhat.com/browse/OCPBUGS-85523): Remove restriction of unmanaged x-k8s.io [#31351](https://github.com/openshift/origin/pull/31351)
* [Full changelog](https://github.com/openshift/origin/compare/3ce7df978fb2fdb9c3e68cc26419a5b60c22d84c...36e5f07c6805241a2e0c09ba98695b277de87eaa)


### [vsphere-csi-driver, vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver/tree/6db4d0b24f3e5f2dda79b19db4ba2f5c220b5943)

* [OCPBUGS-96458](https://issues.redhat.com/browse/OCPBUGS-96458): Bump golang.org/x/net to v0.50.0-sec.4 [#197](https://github.com/openshift/vmware-vsphere-csi-driver/pull/197)
* [OCPBUGS-92959](https://issues.redhat.com/browse/OCPBUGS-92959): Bump golang.org/x/crypto/ssh to v0.48.0-sec.1 [#191](https://github.com/openshift/vmware-vsphere-csi-driver/pull/191)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver/compare/0363addf5f2c19322d24a3f61c7b2684da16ead1...6db4d0b24f3e5f2dda79b19db4ba2f5c220b5943)


### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/2502327678b6af2df0aab5fcd6a96e095d18b21a)

* [OCPBUGS-88024](https://issues.redhat.com/browse/OCPBUGS-88024): Fixed compute cluster permission logic for single fd with read-only custom resourcepool [#225](https://github.com/openshift/vsphere-problem-detector/pull/225)
* [OCPBUGS-103980](https://issues.redhat.com/browse/OCPBUGS-103980): Bump golang.org/x/net to v0.50.0-sec.4 [#231](https://github.com/openshift/vsphere-problem-detector/pull/231)
* [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/65d066ab0940dc69aa3f7ec6b02e698a6e4f5795...2502327678b6af2df0aab5fcd6a96e095d18b21a)