# 4.22.20
Created: 2026-10-25 20:11:56 +0000 UTC
Image Digest: `sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813`
## Changes from 4.22.10
### Components
* Kubectl 1.35.2
* Kubernetes upgraded from 1.35.6 to 1.35.9
* Kubernetes Tests 1.35.1
* Red Hat Enterprise Linux CoreOS 10.2 upgraded from 10.2.20260810-0 to 10.2.20261022-1
### FeatureGate Changes
| FeatureGate | Default
Hypershift | Default
SelfManagedHA | DevPreviewNoUpgrade
Hypershift | DevPreviewNoUpgrade
SelfManagedHA | OKD
Hypershift | OKD
SelfManagedHA | TechPreviewNoUpgrade
Hypershift | TechPreviewNoUpgrade
SelfManagedHA |
| :------ | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: |
| IngressControllerDynamicConfigurationManager
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| VSphereMixedNodeEnv
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| NoRegistryClusterInstall
(0 tests)| Disabled| Enabled
(Changed)| Disabled| Enabled| Disabled| Enabled
(Changed)| Disabled| Enabled |
| GCPSovereignCloudInstall
(0 tests)| Enabled
(New)| Enabled
(New)| Enabled
(New)| Enabled
(New)| Enabled
(New)| Enabled
(New)| Enabled
(New)| Enabled
(New) |
| VSphereMultiVCenterDay2
(0 tests)| Disabled| Disabled| Enabled| Enabled| Disabled| Disabled| Enabled
(Changed)| Enabled
(Changed) |
### Rebuilt images without code change
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [3b5c59cc](https://github.com/openshift/cluster-update-keys/commit/3b5c59cc6461663751bc510b4f9f1954ed8c9b50) `sha256:8588f39ec3c4b242a1df3601f71bfa6d06c0cd9f91d5fa904dd0677d8b30c87c`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [7aa4007a](https://github.com/openshift/driver-toolkit/commit/7aa4007a8601bf4bb23b696f580c022f58877223) `sha256:b8a533877f2b886f4a0607f7a10a1a3f52eef072961df3d76c262bfe5dd68c31`
* [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager) git [a379d09f](https://github.com/openshift/ironic-static-ip-manager/commit/a379d09f228d93f2beab1c73d67764c64b21e3cb) `sha256:6aed3dca1f12e537f2892c6045927f25cabc3bef5c021668ca55ec407e10d74b`
* [machine-os-images](https://github.com/openshift/machine-os-images) git [e5342c99](https://github.com/openshift/machine-os-images/commit/e5342c9905a94069e6801737dd6aeddfb74bbac4) `sha256:e0fca1117488d3171dc3e1d5bf3210ea25f2b0783f8bc2d46f08ad2b65566f38`
* [rhel-coreos](https://github.com/openshift/os) git [cf63d7a5](https://github.com/openshift/os/commit/cf63d7a58a420b35b7f5e42ea0e7deffec56cf91) `sha256:e5c3fcc3825ce32152577a868d78f9c6bd9268d0439b842d565a74fab52f1d16`
* [rhel-coreos-10](https://github.com/openshift/os) git [cf63d7a5](https://github.com/openshift/os/commit/cf63d7a58a420b35b7f5e42ea0e7deffec56cf91) `sha256:d6c64e04248735746b2cb036804affb8b48a9236a61641c2525c6f973923e200`
* [rhel-coreos-10-extensions](https://github.com/openshift/os) git [cf63d7a5](https://github.com/openshift/os/commit/cf63d7a58a420b35b7f5e42ea0e7deffec56cf91) `sha256:32f0f9e5a87bf26b2d4dea5e9f15d04b546d329a481910340f35e264a6cbe21f`
* [rhel-coreos-extensions](https://github.com/openshift/os) git [cf63d7a5](https://github.com/openshift/os/commit/cf63d7a58a420b35b7f5e42ea0e7deffec56cf91) `sha256:0ea216443e6659e9d9e26d2acf7c59e65bb6072e54230b6649fc217319f04a2d`
### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/f0099ebbcfc2a03a52caa72e3c69ed5698089f76)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#11107](https://github.com/openshift/assisted-service/pull/11107)
* [OCPBUGS-130620](https://issues.redhat.com/browse/OCPBUGS-130620): Add ovnKubernetesConfig to install-config definition- #11116 [#11203](https://github.com/openshift/assisted-service/pull/11203)
* [OCPBUGS-127124](https://issues.redhat.com/browse/OCPBUGS-127124): Allow agent-installer invoker to have a suffix [#10986](https://github.com/openshift/assisted-service/pull/10986)
* [OCPBUGS-69811](https://issues.redhat.com/browse/OCPBUGS-69811): Updating ose-agent-installer-api-server-container image to be consistent with ART for 4.22 [#8601](https://github.com/openshift/assisted-service/pull/8601)
* [OCPBUGS-121355](https://issues.redhat.com/browse/OCPBUGS-121355): Fix NUMAResourcesOperator CR name so it can be applied [#10934](https://github.com/openshift/assisted-service/pull/10934)
* [OCPBUGS-120755](https://issues.redhat.com/browse/OCPBUGS-120755): added missing subscription name for lvms-operator [#10918](https://github.com/openshift/assisted-service/pull/10918)
* [OCPBUGS-105805](https://issues.redhat.com/browse/OCPBUGS-105805): golang.org/x/crypto bump to v0.52.0 [#10796](https://github.com/openshift/assisted-service/pull/10796)
* [Full changelog](https://github.com/openshift/assisted-service/compare/f8220b56913e9be3cf49d9b9950768b766c36f2c...f0099ebbcfc2a03a52caa72e3c69ed5698089f76)
### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/dd48581b45badb63984a44f9c23ad7a4baadadd5)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#2430](https://github.com/openshift/assisted-installer/pull/2430)
* [OCPBUGS-127124](https://issues.redhat.com/browse/OCPBUGS-127124): Allow agent-installer invoker to have a suffix [#2350](https://github.com/openshift/assisted-installer/pull/2350)
* [OCPBUGS-69893](https://issues.redhat.com/browse/OCPBUGS-69893): Updating ose-agent-installer-orchestrator-container image to be consistent with ART for 4.22 [#1405](https://github.com/openshift/assisted-installer/pull/1405)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/d5515fa077062f9bfcb763d8131b0302bba6a144...dd48581b45badb63984a44f9c23ad7a4baadadd5)
### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/61df33aff9c80912ce8cc1db02d91caf35442c2c)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#1695](https://github.com/openshift/assisted-installer-agent/pull/1695)
* [OCPBUGS-69939](https://issues.redhat.com/browse/OCPBUGS-69939): Updating ose-agent-installer-node-agent-container image to be consistent with ART for 4.22 [#1227](https://github.com/openshift/assisted-installer-agent/pull/1227)
* [OCPBUGS-101855](https://issues.redhat.com/browse/OCPBUGS-101855): Bump golang.org/x/net from v0.47.0 to v0.53.0 [#1595](https://github.com/openshift/assisted-installer-agent/pull/1595)
* [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/753d625f3417752aabb1cf7088f311da4ec43da3...61df33aff9c80912ce8cc1db02d91caf35442c2c)
### [agent-installer-ui](https://github.com/openshift-assisted/assisted-installer-ui/tree/63f76ea309fb15cda620e5f8ec75f8e3c9649b19)
* [OCPBUGS-123183](https://issues.redhat.com/browse/OCPBUGS-123183): Do not show IRI custom manifests in the disconnected UI [#4052](https://github.com/openshift-assisted/assisted-installer-ui/pull/4052)
* And 19 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift-assisted/assisted-installer-ui/compare/59cc3a89551db9be858159da59779c8c4926240c...63f76ea309fb15cda620e5f8ec75f8e3c9649b19)
### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/cb2f08ed6832137b430628967d818649eaf20517)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#358](https://github.com/openshift/agent-installer-utils/pull/358)
* [OCPBUGS-131856](https://issues.redhat.com/browse/OCPBUGS-131856): Add OVE 4.22 tekton file to agent-installer-utils [#357](https://github.com/openshift/agent-installer-utils/pull/357)
* [OCPBUGS-127041](https://issues.redhat.com/browse/OCPBUGS-127041): Refresh rendezvous IP selection list [#352](https://github.com/openshift/agent-installer-utils/pull/352)
* [OCPBUGS-127009](https://issues.redhat.com/browse/OCPBUGS-127009): Fix agent TUI timeout [#351](https://github.com/openshift/agent-installer-utils/pull/351)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/817b11805be82a177657128eac624df2e969d9b2...cb2f08ed6832137b430628967d818649eaf20517)
### [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy/tree/28f3056f41ebed48e9001fc117a2c703afa45195)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#121](https://github.com/openshift/apiserver-network-proxy/pull/121)
* [Full changelog](https://github.com/openshift/apiserver-network-proxy/compare/5e33c22867d59ddd9392a2c6b3194d2f3c6bdfc7...28f3056f41ebed48e9001fc117a2c703afa45195)
### [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws/tree/d3eb84fb6bc5707e5e468a1856c546a4afc7fe1c)
* [OCPBUGS-102049](https://issues.redhat.com/browse/OCPBUGS-102049): Bump golang.org/x/net to v0.53.0 for CVE-2026-33814 [#171](https://github.com/openshift/cloud-provider-aws/pull/171)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#194](https://github.com/openshift/cloud-provider-aws/pull/194)
* [Full changelog](https://github.com/openshift/cloud-provider-aws/compare/b4bad3f89f54ea5df70e49d1fbf3ea3cbc8e59a3...d3eb84fb6bc5707e5e468a1856c546a4afc7fe1c)
### [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws/tree/1bbede906cf3fe604ecb44e67a56143a050795d3)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#662](https://github.com/openshift/cluster-api-provider-aws/pull/662)
* [OCPBUGS-101854](https://issues.redhat.com/browse/OCPBUGS-101854): replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 for CVE-2026-33814 [#648](https://github.com/openshift/cluster-api-provider-aws/pull/648)
* 🌱 [release-4.22] OCPBUGS-119954: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI [#633](https://github.com/openshift/cluster-api-provider-aws/pull/633)
* 🐛 [release-4.22] OCPBUGS-112305: UPSTREAM: 6132: Persist ProviderID immediately after instance creation [#626](https://github.com/openshift/cluster-api-provider-aws/pull/626)
* [Full changelog](https://github.com/openshift/cluster-api-provider-aws/compare/9172366ccfbde3225e045b59587d38db655edd94...1bbede906cf3fe604ecb44e67a56143a050795d3)
### [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver/tree/a7b4d36644d8c39534b10c32b36b50a19b460602)
* [OCPBUGS-101864](https://issues.redhat.com/browse/OCPBUGS-101864): Bump golang.org/x/net to v0.53.0 [#356](https://github.com/openshift/aws-ebs-csi-driver/pull/356)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#349](https://github.com/openshift/aws-ebs-csi-driver/pull/349)
* [Full changelog](https://github.com/openshift/aws-ebs-csi-driver/compare/51d6bc760234ffccb0348937a5cfd70b326119b9...a7b4d36644d8c39534b10c32b36b50a19b460602)
### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/ac564599111768d06ab6c8347d7397aed7de3ed3)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#648](https://github.com/openshift/csi-operator/pull/648)
* [OCPBUGS-119697](https://issues.redhat.com/browse/OCPBUGS-119697): Add proxy hook for HyperShift CSI driver controller deployments [#619](https://github.com/openshift/csi-operator/pull/619)
* [OCPBUGS-101882](https://issues.redhat.com/browse/OCPBUGS-101882), [OCPBUGS-101889](https://issues.redhat.com/browse/OCPBUGS-101889), [OCPBUGS-101890](https://issues.redhat.com/browse/OCPBUGS-101890), [OCPBUGS-102000](https://issues.redhat.com/browse/OCPBUGS-102000): Bump golang.org/x/net to v0.53.0 [#602](https://github.com/openshift/csi-operator/pull/602)
* [OCPBUGS-109635](https://issues.redhat.com/browse/OCPBUGS-109635): csi-driver-smb: DeleteVolume call fails to mkdir under /tmp [#597](https://github.com/openshift/csi-operator/pull/597)
* [Full changelog](https://github.com/openshift/csi-operator/compare/2dc8bfba20a785131909895e590966832621ae38...ac564599111768d06ab6c8347d7397aed7de3ed3)
### [aws-karpenter-provider-aws](https://github.com/openshift/aws-karpenter-provider-aws/tree/41d8484b07202078904590404d9cb7a195c74ac4)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#51](https://github.com/openshift/aws-karpenter-provider-aws/pull/51)
* [OCPBUGS-118884](https://issues.redhat.com/browse/OCPBUGS-118884): default max-pods to 250 for Custom AMI family [#43](https://github.com/openshift/aws-karpenter-provider-aws/pull/43)
* [OCPBUGS-101842](https://issues.redhat.com/browse/OCPBUGS-101842): Fix CVE-2026-33814 [#35](https://github.com/openshift/aws-karpenter-provider-aws/pull/35)
* [Full changelog](https://github.com/openshift/aws-karpenter-provider-aws/compare/f0be9c72e5bf25caeb2ca45c14e67e4d397a52cb...41d8484b07202078904590404d9cb7a195c74ac4)
### [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider/tree/9b6bfa21335847d1ddc42692fda5b1f2b92f9ae5)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#56](https://github.com/openshift/aws-encryption-provider/pull/56)
* [OCPBUGS-83877](https://issues.redhat.com/browse/OCPBUGS-83877): Bump google.golang.org/grpc to v1.79.3 [#54](https://github.com/openshift/aws-encryption-provider/pull/54)
* [OCPBUGS-70017](https://issues.redhat.com/browse/OCPBUGS-70017): Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.22 [#33](https://github.com/openshift/aws-encryption-provider/pull/33)
* [Full changelog](https://github.com/openshift/aws-encryption-provider/compare/19e7b623429799c9c549690a1b5ab499844411f9...9b6bfa21335847d1ddc42692fda5b1f2b92f9ae5)
### [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws/tree/d6fc12eeca488cbc60b6df0fc24b1981fc7146b1)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#229](https://github.com/openshift/machine-api-provider-aws/pull/229)
* [OCPBUGS-101975](https://issues.redhat.com/browse/OCPBUGS-101975): fix CVE-2026-33814 by bumping golang.org/x/net to v0.53.0 [#198](https://github.com/openshift/machine-api-provider-aws/pull/198)
* [OCPBUGS-126916](https://issues.redhat.com/browse/OCPBUGS-126916): Add opt-in pprof endpoint to machine-controller-manager [#218](https://github.com/openshift/machine-api-provider-aws/pull/218)
* [OCPBUGS-126916](https://issues.redhat.com/browse/OCPBUGS-126916): Cache region validation response and close AWS sessions [#219](https://github.com/openshift/machine-api-provider-aws/pull/219)
* [OCPBUGS-85277](https://issues.redhat.com/browse/OCPBUGS-85277): Changed timeout for node ready logic in OTE [#187](https://github.com/openshift/machine-api-provider-aws/pull/187)
* [Full changelog](https://github.com/openshift/machine-api-provider-aws/compare/1a0ccbcfc0a7dc06f3a494f0e2b78aa0a0256b9c...d6fc12eeca488cbc60b6df0fc24b1981fc7146b1)
### [aws-node-termination-handler](https://github.com/openshift/aws-node-termination-handler/tree/5fa3b00a346068ced08dfc4fa529729a1e9d154f)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#17](https://github.com/openshift/aws-node-termination-handler/pull/17)
* [OCPBUGS-101837](https://issues.redhat.com/browse/OCPBUGS-101837): CVE-2026-33814 openshift4/aws-node-termination-handler-rhel9: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.22] [#14](https://github.com/openshift/aws-node-termination-handler/pull/14)
* [Full changelog](https://github.com/openshift/aws-node-termination-handler/compare/341ed3a086925b17671c5349343fedf988a1139e...5fa3b00a346068ced08dfc4fa529729a1e9d154f)
### [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook/tree/4f99b2f67f4584cd9206db223aceb4bb40d47ed3)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#232](https://github.com/openshift/aws-pod-identity-webhook/pull/232)
* [OCPBUGS-101873](https://issues.redhat.com/browse/OCPBUGS-101873): Bump golang.org/x/net to v0.55.0 [#221](https://github.com/openshift/aws-pod-identity-webhook/pull/221)
* [Full changelog](https://github.com/openshift/aws-pod-identity-webhook/compare/8208828799b6c4f91fd9b80128668f7765599e84...4f99b2f67f4584cd9206db223aceb4bb40d47ed3)
### [azure-cloud-controller-manager, azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure/tree/860d4598abe2de913eee30324bbcb9acbda10620)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#223](https://github.com/openshift/cloud-provider-azure/pull/223)
* [Full changelog](https://github.com/openshift/cloud-provider-azure/compare/a17a3e3eb36b14f0348b003018879a32394c7264...860d4598abe2de913eee30324bbcb9acbda10620)
### [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure/tree/63951f9eb314fdb4644eb6907131614614e9b3a1)
* : OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 [#415](https://github.com/openshift/cluster-api-provider-azure/pull/415)
* [OCPBUGS-105465](https://issues.redhat.com/browse/OCPBUGS-105465): Address CVE-2026-39829 [#396](https://github.com/openshift/cluster-api-provider-azure/pull/396)
* [Full changelog](https://github.com/openshift/cluster-api-provider-azure/compare/a6ffab6a17878cb9b9eeaa6337c996989d1e7ee3...63951f9eb314fdb4644eb6907131614614e9b3a1)
### [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver/tree/51bdc527ae1b9723965fe5e911a3834ede228da0)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#184](https://github.com/openshift/azure-disk-csi-driver/pull/184)
* [OCPBUGS-111870](https://issues.redhat.com/browse/OCPBUGS-111870): Bump golang.org/x/crypto to v0.52.0 [#164](https://github.com/openshift/azure-disk-csi-driver/pull/164)
* UPSTREAM: 3635: OCPBUGS-96598: Bump golang.org/x/net to v0.55.0 [#165](https://github.com/openshift/azure-disk-csi-driver/pull/165)
* [Full changelog](https://github.com/openshift/azure-disk-csi-driver/compare/015de26e222e97785488918a8fbe6fc4c2038d23...51bdc527ae1b9723965fe5e911a3834ede228da0)
### [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver/tree/5f6f3b916602d9464ef700f366caf8729b4084df)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#174](https://github.com/openshift/azure-file-csi-driver/pull/174)
* [OCPBUGS-101874](https://issues.redhat.com/browse/OCPBUGS-101874): Bump golang.org/x/net to v0.53.0 [#154](https://github.com/openshift/azure-file-csi-driver/pull/154)
* [Full changelog](https://github.com/openshift/azure-file-csi-driver/compare/91c5760d8435b799bc837f7eb6540025c369d572...5f6f3b916602d9464ef700f366caf8729b4084df)
### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/97f6de0b3c549f97724c9f3b40ee3dbd265adaae)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#67](https://github.com/openshift/azure-kubernetes-kms/pull/67)
* [OCPBUGS-74021](https://issues.redhat.com/browse/OCPBUGS-74021): Updating azure-kms-encryption-provider-container image to be consistent with ART for 4.22 [#27](https://github.com/openshift/azure-kubernetes-kms/pull/27)
* [CNTRLPLANE-4024](https://issues.redhat.com/browse/CNTRLPLANE-4024): support sovereign Managed HSM endpoints- #56 [#56](https://github.com/openshift/azure-kubernetes-kms/pull/56)
* [OCPBUGS-101846](https://issues.redhat.com/browse/OCPBUGS-101846): [release-4.22] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#57](https://github.com/openshift/azure-kubernetes-kms/pull/57)
* [CNTRLPLANE-4024](https://issues.redhat.com/browse/CNTRLPLANE-4024): [release-4.22]: Correct Managed HSM endpoints [#53](https://github.com/openshift/azure-kubernetes-kms/pull/53)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/99b9a3a33d8edfd0a2d2876aa7ef1382b2c75a39...97f6de0b3c549f97724c9f3b40ee3dbd265adaae)
### [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure/tree/097cbec451cafdde35ab60896272a6cb51537412)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#223](https://github.com/openshift/machine-api-provider-azure/pull/223)
* [Full changelog](https://github.com/openshift/machine-api-provider-azure/compare/bad7e9447fa66002e5ec7b0b7952545e7e8a6c9f...097cbec451cafdde35ab60896272a6cb51537412)
### [azure-service-operator](https://github.com/openshift/azure-service-operator/tree/725f444c3a4805069b3b3d8601e7335f79e5bc8a)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#50](https://github.com/openshift/azure-service-operator/pull/50)
* [Full changelog](https://github.com/openshift/azure-service-operator/compare/b44d444422f5a7eb21b9ca65f3975a2d13ec9b36...725f444c3a4805069b3b3d8601e7335f79e5bc8a)
### [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity/tree/26ad8ad275b0deee1bfc72d6cfdf0b486399bf29)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#72](https://github.com/openshift/azure-workload-identity/pull/72)
* [OCPBUGS-101877](https://issues.redhat.com/browse/OCPBUGS-101877): Bump golang.org/x/net to v0.53.0 to address CVE-2026-33814 [#59](https://github.com/openshift/azure-workload-identity/pull/59)
* [Full changelog](https://github.com/openshift/azure-workload-identity/compare/a8fb3bf1a6296d6cbf69142db458aa9b59cb3a45...26ad8ad275b0deee1bfc72d6cfdf0b486399bf29)
### [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3/tree/2e7ebfd88481ede182d641070d63dd1b92b4db68)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#111](https://github.com/openshift/cluster-api-provider-metal3/pull/111)
* [Full changelog](https://github.com/openshift/cluster-api-provider-metal3/compare/6481b52008f0991912f80fdf9d74af3e631a7269...2e7ebfd88481ede182d641070d63dd1b92b4db68)
### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/9d600e66af8190e46763fd388f228a5a19dfa6f1)
* [OCPBUGS-131019](https://issues.redhat.com/browse/OCPBUGS-131019): Removed PowerVS InstallConfig debug log statement exposing sensitive information [#10982](https://github.com/openshift/installer/pull/10982)
* [OCPBUGS-128657](https://issues.redhat.com/browse/OCPBUGS-128657): gcp: restrict global KMS location check to defaultMachinePlatform [#10932](https://github.com/openshift/installer/pull/10932)
* [OCPBUGS-132571](https://issues.redhat.com/browse/OCPBUGS-132571): unconfigured-ignition must include nmstateconfig.yaml when present [#11013](https://github.com/openshift/installer/pull/11013)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#10983](https://github.com/openshift/installer/pull/10983)
* [OCPBUGS-132164](https://issues.redhat.com/browse/OCPBUGS-132164): support InfraEnv AdditionalNTPSources in unconfigured-ignition [#11003](https://github.com/openshift/installer/pull/11003)
* [OCPBUGS-105364](https://issues.redhat.com/browse/OCPBUGS-105364): Azure: delete bootstrap ignition storage during bootstrap destroy [#10778](https://github.com/openshift/installer/pull/10778)
* [OCPBUGS-130602](https://issues.redhat.com/browse/OCPBUGS-130602): Add internalJoinSubnet to installConfigOverrides [#10971](https://github.com/openshift/installer/pull/10971)
* [OCPBUGS-130359](https://issues.redhat.com/browse/OCPBUGS-130359): Warn about ignored install-config fields in ABI [#10964](https://github.com/openshift/installer/pull/10964)
* [OCPBUGS-128831](https://issues.redhat.com/browse/OCPBUGS-128831): gcp: skip quota checks on transient errors [#10935](https://github.com/openshift/installer/pull/10935)
* [OCPBUGS-126568](https://issues.redhat.com/browse/OCPBUGS-126568): [release-4.22] Bump Azure Marketplace Images to be up-to-date [#10884](https://github.com/openshift/installer/pull/10884)
* [OCPBUGS-127124](https://issues.redhat.com/browse/OCPBUGS-127124): use different INSTALL_INVOKER for unconfigured ignition [#10903](https://github.com/openshift/installer/pull/10903)
* [SPLAT-2865](https://issues.redhat.com/browse/SPLAT-2865): Add vSphere multi vCenter Day 2 support [#10740](https://github.com/openshift/installer/pull/10740)
* [OCPBUGS-122251](https://issues.redhat.com/browse/OCPBUGS-122251): [release-4.22]: Promote GCD to GA [#10871](https://github.com/openshift/installer/pull/10871)
* [OCPBUGS-126806](https://issues.redhat.com/browse/OCPBUGS-126806): Inject the pull-secret as podman secret in the agent-installer-ui container [#10897](https://github.com/openshift/installer/pull/10897)
* [OCPBUGS-122133](https://issues.redhat.com/browse/OCPBUGS-122133): gcp: skip disk type check when the permission is denied [#10862](https://github.com/openshift/installer/pull/10862)
* [OCPBUGS-119240](https://issues.redhat.com/browse/OCPBUGS-119240): gcp: allow GCD load balancer health-check firewall ranges [#10853](https://github.com/openshift/installer/pull/10853)
* [OCPBUGS-100061](https://issues.redhat.com/browse/OCPBUGS-100061): openstack: Reserve addresses for load balancer [#10725](https://github.com/openshift/installer/pull/10725)
* [OCPBUGS-114639](https://issues.redhat.com/browse/OCPBUGS-114639): OCPBUGS-112550, OCPBUGS-112549: Release 4.22 GCD and KMS support [#10783](https://github.com/openshift/installer/pull/10783)
* [AGENT-1583](https://issues.redhat.com/browse/AGENT-1583): post-feature promotion (NoRegistryClusterInstall) openshift/api dependencies bump [#10817](https://github.com/openshift/installer/pull/10817)
* [OCPBUGS-112471](https://issues.redhat.com/browse/OCPBUGS-112471): Update timeout in GetMarketplaceImage to 5 minutes [#10784](https://github.com/openshift/installer/pull/10784)
* [OCPBUGS-111885](https://issues.redhat.com/browse/OCPBUGS-111885): pin argcomplete for yq on Python 3.9 (release-4.22) [#10766](https://github.com/openshift/installer/pull/10766)
* [Full changelog](https://github.com/openshift/installer/compare/27857bd7921fc12dc3681c4812892cff949a1d34...9d600e66af8190e46763fd388f228a5a19dfa6f1)
### [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal/tree/04889520a45f67b679f9655c76aad332ec349754)
* : OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 [#284](https://github.com/openshift/cluster-api-provider-baremetal/pull/284)
* [OCPBUGS-101871](https://issues.redhat.com/browse/OCPBUGS-101871): Bump golang.org/x/net to v0.58.0 to address CVE-2026-33814 [#264](https://github.com/openshift/cluster-api-provider-baremetal/pull/264)
* [Full changelog](https://github.com/openshift/cluster-api-provider-baremetal/compare/8d863b9505a5cfc0b01e33f985a3edf9d3c69f4b...04889520a45f67b679f9655c76aad332ec349754)
### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/d26af4d187b505b3fb78039614f2323f4fc81764)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#530](https://github.com/openshift/baremetal-operator/pull/530)
* [OCPBUGS-90570](https://issues.redhat.com/browse/OCPBUGS-90570): Reject non-empty checksum for OCI images [#501](https://github.com/openshift/baremetal-operator/pull/501)
* [OCPBUGS-99420](https://issues.redhat.com/browse/OCPBUGS-99420): Create ports if they are already inspected and machine is re-registering [#518](https://github.com/openshift/baremetal-operator/pull/518)
* [OCPBUGS-83866](https://issues.redhat.com/browse/OCPBUGS-83866): Include image URL and checksum in provisioning error message [#500](https://github.com/openshift/baremetal-operator/pull/500)
* [Full changelog](https://github.com/openshift/baremetal-operator/compare/40d590359685e15514694d74ff990825bfc889f7...d26af4d187b505b3fb78039614f2323f4fc81764)
### [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg/tree/aa922cd6455b4ec62b8a5429db800d307a895328)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#418](https://github.com/openshift/baremetal-runtimecfg/pull/418)
* [OCPBUGS-101879](https://issues.redhat.com/browse/OCPBUGS-101879): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#404](https://github.com/openshift/baremetal-runtimecfg/pull/404)
* [OCPBUGS-112618](https://issues.redhat.com/browse/OCPBUGS-112618): Cloud Platforms: Filter out node's own IP from Upstreams [#401](https://github.com/openshift/baremetal-runtimecfg/pull/401)
* [Full changelog](https://github.com/openshift/baremetal-runtimecfg/compare/dca8cb1be0cce1ce404dfd407ead1326a3c8bb40...aa922cd6455b4ec62b8a5429db800d307a895328)
### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/a726d94391e468525cc5282067cadc1215b1fb5e)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#2439](https://github.com/openshift/oc/pull/2439)
* [OCPBUGS-114426](https://issues.redhat.com/browse/OCPBUGS-114426): Fix go vet warning in process.go [#2408](https://github.com/openshift/oc/pull/2408)
* [OCPBUGS-114426](https://issues.redhat.com/browse/OCPBUGS-114426): Update build-machinery-go vendor dependency [#2399](https://github.com/openshift/oc/pull/2399)
* [OCPBUGS-114734](https://issues.redhat.com/browse/OCPBUGS-114734): Fix windows builds of oc rpm [#2383](https://github.com/openshift/oc/pull/2383)
* [Full changelog](https://github.com/openshift/oc/compare/7ec2e14b74e700fec86dc0936a61f6c12b79d083...a726d94391e468525cc5282067cadc1215b1fb5e)
### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/889beae67459a4151f358850c2e9899529a1fd84)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#1110](https://github.com/openshift/cloud-credential-operator/pull/1110)
* [OCPBUGS-101875](https://issues.redhat.com/browse/OCPBUGS-101875): Bump golang.org/x/net to v0.56.0 to address CVE-2026-33814 [#1096](https://github.com/openshift/cloud-credential-operator/pull/1096)
* [OCPBUGS-114669](https://issues.redhat.com/browse/OCPBUGS-114669): [release-4.22] GCP Alternate Universe Domain Support for WIF [#1092](https://github.com/openshift/cloud-credential-operator/pull/1092)
* [OCPBUGS-114669](https://issues.redhat.com/browse/OCPBUGS-114669): Enable GCP custom universe domain support for CCO [#1083](https://github.com/openshift/cloud-credential-operator/pull/1083)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/c69fe7e078ad2e51f8352af04ff45c54a6a11e1d...889beae67459a4151f358850c2e9899529a1fd84)
### [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller/tree/aab5deb03b8062f059309c2d8d248998d1940ec4)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#277](https://github.com/openshift/cloud-network-config-controller/pull/277)
* : [release-4.22] OCPBUGS-115316: GCP: Set Universe Domain [#264](https://github.com/openshift/cloud-network-config-controller/pull/264)
* [Full changelog](https://github.com/openshift/cloud-network-config-controller/compare/2d69ad953cfaa419e9b6221da9edb152ded91e0b...aab5deb03b8062f059309c2d8d248998d1940ec4)
### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/ec977036e4972b7b100ca83f7892230ddfc56d05)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#1021](https://github.com/openshift/cluster-authentication-operator/pull/1021)
* [OCPBUGS-114426](https://issues.redhat.com/browse/OCPBUGS-114426): Update build-machinery-go vendor dependency [#1000](https://github.com/openshift/cluster-authentication-operator/pull/1000)
* [OCPBUGS-101881](https://issues.redhat.com/browse/OCPBUGS-101881): Bump golang.org/x/net from v0.47.0 to v0.53.0 [#979](https://github.com/openshift/cluster-authentication-operator/pull/979)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/5a44cc2a8c36d144f8782e23f47bc31e2e4ead88...ec977036e4972b7b100ca83f7892230ddfc56d05)
### [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler/tree/a19ca2f494293ebb447c8c1b868fa42fd5b44e80)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#456](https://github.com/openshift/kubernetes-autoscaler/pull/456)
* [OCPBUGS-102038](https://issues.redhat.com/browse/OCPBUGS-102038): [4.22] Fix OCPBUGS-102038 [#434](https://github.com/openshift/kubernetes-autoscaler/pull/434)
* [Full changelog](https://github.com/openshift/kubernetes-autoscaler/compare/7ee0695a75f4441ff339f89ac4b45e0632417c18...a19ca2f494293ebb447c8c1b868fa42fd5b44e80)
### [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator/tree/531e15b4bdf0bd18bd900cf64438402ac127da1e)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#405](https://github.com/openshift/cluster-autoscaler-operator/pull/405)
* [OCPBUGS-101883](https://issues.redhat.com/browse/OCPBUGS-101883): Bump x/net package in release-4.22 [#387](https://github.com/openshift/cluster-autoscaler-operator/pull/387)
* [Full changelog](https://github.com/openshift/cluster-autoscaler-operator/compare/260ea1b5967f47768a0727e8c84d451dc9de5ced...531e15b4bdf0bd18bd900cf64438402ac127da1e)
### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/2e5c3f2ac2d9bd49ce2b3023fab5caa8b674b895)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#682](https://github.com/openshift/cluster-baremetal-operator/pull/682)
* [OCPBUGS-122244](https://issues.redhat.com/browse/OCPBUGS-122244): Make HostPath VolumeMounts ReadOnly for image customization container [#660](https://github.com/openshift/cluster-baremetal-operator/pull/660)
* [OCPBUGS-99390](https://issues.redhat.com/browse/OCPBUGS-99390): Make CBO progress in non-baremetal platforms [#646](https://github.com/openshift/cluster-baremetal-operator/pull/646)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/e65972f997216d9f67cb18112f0cb1a4b57b0fe3...2e5c3f2ac2d9bd49ce2b3023fab5caa8b674b895)
### [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap/tree/04f4aacc2992f29775c1a62c2e8db89077152ba8)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#152](https://github.com/openshift/cluster-bootstrap/pull/152)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Update build-machinery-go vendor dependency [#148](https://github.com/openshift/cluster-bootstrap/pull/148)
* [Full changelog](https://github.com/openshift/cluster-bootstrap/compare/e6be0fdfbf43883e2301dbf2d0eb3ab4a4f93383...04f4aacc2992f29775c1a62c2e8db89077152ba8)
### [cluster-capi-controllers](https://github.com/openshift/cluster-api/tree/dbe6fb7adbb4e1bcaeb14aec6742f28bd4d51b1b)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#317](https://github.com/openshift/cluster-api/pull/317)
* [Full changelog](https://github.com/openshift/cluster-api/compare/f1718df9c13b0cee5ede1b6354e29acc466607a4...dbe6fb7adbb4e1bcaeb14aec6742f28bd4d51b1b)
### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/5edbbe4b21b0934885c7598cb833b9c566ca319a)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#687](https://github.com/openshift/cluster-capi-operator/pull/687)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/5430ff7a34d4c0a946740dcdcd98690c14c63cf9...5edbbe4b21b0934885c7598cb833b9c566ca319a)
### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/49ee7bbbad5b1f521576aa8ee266da78d079e750)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#525](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/525)
* [SPLAT-2865](https://issues.redhat.com/browse/SPLAT-2865): Added support to manage kube-cloud-config for vSphere in openshift-config-managed [#498](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/498)
* [OCPBUGS-101897](https://issues.redhat.com/browse/OCPBUGS-101897): Bump golang.org/x/net to v0.53.0 to address CVE-2026-33814 [#509](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/509)
* [OCPBUGS-114394](https://issues.redhat.com/browse/OCPBUGS-114394): [release-4.22] GCP Alternate Universe Domain Support [#508](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/508)
* [OCPBUGS-112665](https://issues.redhat.com/browse/OCPBUGS-112665): Moved node sync job creation from manifest to operator controller [#507](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/507)
* [OCPBUGS-105883](https://issues.redhat.com/browse/OCPBUGS-105883): Created new job to update vSphere nodes to have vsphere label [#501](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/501)
* [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/b99c3d88b0e7b125f0340bb5d8e3333fa3940a60...49ee7bbbad5b1f521576aa8ee266da78d079e750)
### [cluster-config-api](https://github.com/openshift/api/tree/f94a02c852f17a74216c277542c391b2c851d6ce)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#3081](https://github.com/openshift/api/pull/3081)
* [OCPBUGS-130606](https://issues.redhat.com/browse/OCPBUGS-130606): Add protocol to AWS NLB parameters [#3071](https://github.com/openshift/api/pull/3071)
* [OCPBUGS-128542](https://issues.redhat.com/browse/OCPBUGS-128542): Promote Dynamic Configuration Manager to Default [#3068](https://github.com/openshift/api/pull/3068)
* [OCPBUGS-122251](https://issues.redhat.com/browse/OCPBUGS-122251): Promote GCD to GA in 4.22 [#3034](https://github.com/openshift/api/pull/3034)
* [SPLAT-2865](https://issues.redhat.com/browse/SPLAT-2865): Add vSphere multi vCenter Day 2 [#2969](https://github.com/openshift/api/pull/2969)
* [OCPBUGS-116848](https://issues.redhat.com/browse/OCPBUGS-116848): Add Sovereign cloud feature gate and UniverseDomain field to GCPPlatformStatus [#3022](https://github.com/openshift/api/pull/3022)
* [OCPBUGS-113639](https://issues.redhat.com/browse/OCPBUGS-113639): move empty CRIOCredentialProviderConfig CR to run-level 0000_10 [#3010](https://github.com/openshift/api/pull/3010)
* [SPLAT-2718](https://issues.redhat.com/browse/SPLAT-2718): Promote FeatureGateVSphereMixedNodeEnv to GA [#2949](https://github.com/openshift/api/pull/2949)
* [OCPBUGS-113600](https://issues.redhat.com/browse/OCPBUGS-113600): [release-4.22] OCPBUGS-112479: Handle Sippy date-only format in featuregate-test-analyzer [#3008](https://github.com/openshift/api/pull/3008)
* [OCPBUGS-105168](https://issues.redhat.com/browse/OCPBUGS-105168): Add haproxyVersion in IngressController API [#2971](https://github.com/openshift/api/pull/2971)
* [AGENT-1578](https://issues.redhat.com/browse/AGENT-1578): Promote NoRegistryClusterInstall feature to default [#2979](https://github.com/openshift/api/pull/2979)
* [Full changelog](https://github.com/openshift/api/compare/57eb58a15422da2e90e6da0974350245cc994e69...f94a02c852f17a74216c277542c391b2c851d6ce)
### [cluster-config-operator](https://github.com/openshift/cluster-config-operator/tree/d067deda4d4c71078a4845ac93e7320259f6d7cf)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#523](https://github.com/openshift/cluster-config-operator/pull/523)
* [SPLAT-2865](https://issues.redhat.com/browse/SPLAT-2865): Migrate vSphere sync of kube-cloud-config to 3CMO [#498](https://github.com/openshift/cluster-config-operator/pull/498)
* [OCPBUGS-114426](https://issues.redhat.com/browse/OCPBUGS-114426): Update build-machinery-go vendor dependency [#503](https://github.com/openshift/cluster-config-operator/pull/503)
* [OCPBUGS-77604](https://issues.redhat.com/browse/OCPBUGS-77604): Updating ose-cluster-config-operator-container image to be consistent with ART for 4.22 [#473](https://github.com/openshift/cluster-config-operator/pull/473)
* [Full changelog](https://github.com/openshift/cluster-config-operator/compare/e0c2428e4618493ad9db0681e3b91444746ddf2c...d067deda4d4c71078a4845ac93e7320259f6d7cf)
### [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator/tree/de6a0c76d09213e817a909a8f0eef7e6e667303c)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#425](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/425)
* [OCPBUGS-121958](https://issues.redhat.com/browse/OCPBUGS-121958): Guard against empty workspace field on vsphere [#420](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/420)
* [Full changelog](https://github.com/openshift/cluster-control-plane-machine-set-operator/compare/55dea4dc947da2d8a9c1ffba451a41c3b3662718...de6a0c76d09213e817a909a8f0eef7e6e667303c)
### [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator/tree/7aaacd74b124dc3c464d91d9588633fd02000b93)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#301](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/301)
* [OCPBUGS-101892](https://issues.redhat.com/browse/OCPBUGS-101892): Bump golang.org/x/net from v0.52.0 to v0.53.0 [#286](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/286)
* [Full changelog](https://github.com/openshift/cluster-csi-snapshot-controller-operator/compare/4847d2e09adb887610a0e18061bbf508e17f6ee3...7aaacd74b124dc3c464d91d9588633fd02000b93)
### [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator/tree/d49df560be48fb7b0e44fe26c17d950da2d28eb7)
* [OCPBUGS-101899](https://issues.redhat.com/browse/OCPBUGS-101899): Bump golang.org/x/net to v0.53.0 [#499](https://github.com/openshift/cluster-dns-operator/pull/499)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#502](https://github.com/openshift/cluster-dns-operator/pull/502)
* [Full changelog](https://github.com/openshift/cluster-dns-operator/compare/3d2141182243cde1ec6417bd005c76d29aa88a01...d49df560be48fb7b0e44fe26c17d950da2d28eb7)
### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/0b43d8cadcad25938cec31abb253f7a0eba3e6f6)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#1730](https://github.com/openshift/cluster-etcd-operator/pull/1730)
* [OCPBUGS-94058](https://issues.redhat.com/browse/OCPBUGS-94058): remove version check from guard precheck [#1644](https://github.com/openshift/cluster-etcd-operator/pull/1644)
* [OCPBUGS-89322](https://issues.redhat.com/browse/OCPBUGS-89322): cluster-restore.sh: move extra /var/lib/etcd files to backup [#1632](https://github.com/openshift/cluster-etcd-operator/pull/1632)
* [OCPBUGS-101904](https://issues.redhat.com/browse/OCPBUGS-101904): Bump golang.org/x/net to v0.53.0 address CVE-2026-33814 [#1691](https://github.com/openshift/cluster-etcd-operator/pull/1691)
* [OCPBUGS-114426](https://issues.redhat.com/browse/OCPBUGS-114426): Update build-machinery-go vendor dependency [#1704](https://github.com/openshift/cluster-etcd-operator/pull/1704)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/14ecb163d4a69d1e53802c21d799d6f16b2303dc...0b43d8cadcad25938cec31abb253f7a0eba3e6f6)
### [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator/tree/95d2b2261d4bf3f62053781f1f3ea54e35a8052a)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#1385](https://github.com/openshift/cluster-image-registry-operator/pull/1385)
* [OCPBUGS-88489](https://issues.redhat.com/browse/OCPBUGS-88489): Fix image registry deployment failure on aws-ovn-edge-zones [#1366](https://github.com/openshift/cluster-image-registry-operator/pull/1366)
* [release 4.22] OCPBUGS-114413: GCP Universe Domain Support [#1364](https://github.com/openshift/cluster-image-registry-operator/pull/1364)
* [OCPBUGS-112349](https://issues.redhat.com/browse/OCPBUGS-112349): Improve GCS KMS encryption error handling and documentation [#1362](https://github.com/openshift/cluster-image-registry-operator/pull/1362)
* [Full changelog](https://github.com/openshift/cluster-image-registry-operator/compare/f041d358ef164e02ae82cc5197f9ccd58f515f8c...95d2b2261d4bf3f62053781f1f3ea54e35a8052a)
### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/dd88d2da72c454d6bfeb155051464ac7310708a4)
* [OCPBUGS-126740](https://issues.redhat.com/browse/OCPBUGS-126740): [OSSM Wave 04] Bump to OSSM 3.3.7 and Istio v1.28.10 [#1605](https://github.com/openshift/cluster-ingress-operator/pull/1605)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#1615](https://github.com/openshift/cluster-ingress-operator/pull/1615)
* [OCPBUGS-130606](https://issues.redhat.com/browse/OCPBUGS-130606): Support NLB protocol to configure proxy protocol and client IP preservation [#1621](https://github.com/openshift/cluster-ingress-operator/pull/1621)
* [OCPBUGS-128542](https://issues.redhat.com/browse/OCPBUGS-128542): Promote Dynamic Configuration Manager to Default [#1611](https://github.com/openshift/cluster-ingress-operator/pull/1611)
* [OCPBUGS-112634](https://issues.redhat.com/browse/OCPBUGS-112634): Support Alternate Universe Domain [#1564](https://github.com/openshift/cluster-ingress-operator/pull/1564)
* [OCPBUGS-105168](https://issues.redhat.com/browse/OCPBUGS-105168): Bump openshift/api which adds HAProxy version API [#1545](https://github.com/openshift/cluster-ingress-operator/pull/1545)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/0c0c6484347beac1b187360a23c929819938db38...dd88d2da72c454d6bfeb155051464ac7310708a4)
### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/b99173ad2a12fa8b60c317540a52aa5426f60e63)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#2340](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2340)
* [OCPBUGS-101906](https://issues.redhat.com/browse/OCPBUGS-101906): Bump golang.org/x/net to v0.53.0 to address CVE-2026-33814 [#2295](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2295)
* [OCPBUGS-114426](https://issues.redhat.com/browse/OCPBUGS-114426): Update build-machinery-go vendor dependency [#2312](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2312)
* [OCPBUGS-86944](https://issues.redhat.com/browse/OCPBUGS-86944): Updating ose-cluster-kube-apiserver-operator-container image to be consistent with ART for 4.22 [#2072](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2072)
* [OCPBUGS-120318](https://issues.redhat.com/browse/OCPBUGS-120318): [release-4.22] Backport 10-minute degraded inertia [#2294](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2294)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/9c413cd4dc8c3876cc40ee85c207bf9b143f106f...b99173ad2a12fa8b60c317540a52aa5426f60e63)
### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/cab37a8b6d19976051c70aa3b1e5f471297b0589)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#976](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/976)
* [OCPBUGS-101900](https://issues.redhat.com/browse/OCPBUGS-101900): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#965](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/965)
* [OCPBUGS-114426](https://issues.redhat.com/browse/OCPBUGS-114426): Update build-machinery-go vendor dependency [#969](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/969)
* [OCPBUGS-77677](https://issues.redhat.com/browse/OCPBUGS-77677): Updating ose-cluster-kube-controller-manager-operator-container image to be consistent with ART for 4.22 [#916](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/916)
* [OCPBUGS-116225](https://issues.redhat.com/browse/OCPBUGS-116225): [release-4.22] Add 10-minute degraded inertia [#966](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/966)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/95150ed5dbf11370b4a06e6959c77efa13768561...cab37a8b6d19976051c70aa3b1e5f471297b0589)
### [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator/tree/5ab7becc03a10e7b19bcd9f544dbe88940157dc7)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#680](https://github.com/openshift/cluster-kube-scheduler-operator/pull/680)
* [OCPBUGS-101905](https://issues.redhat.com/browse/OCPBUGS-101905): [release-4.22] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#665](https://github.com/openshift/cluster-kube-scheduler-operator/pull/665)
* [OCPBUGS-114426](https://issues.redhat.com/browse/OCPBUGS-114426): Update build-machinery-go vendor dependency [#678](https://github.com/openshift/cluster-kube-scheduler-operator/pull/678)
* [OCPBUGS-120133](https://issues.redhat.com/browse/OCPBUGS-120133): [release-4.22] Backport 10-minute degraded inertia [#664](https://github.com/openshift/cluster-kube-scheduler-operator/pull/664)
* [Full changelog](https://github.com/openshift/cluster-kube-scheduler-operator/compare/51ea59abd057d0cef56b29b8a74efc28411d5427...5ab7becc03a10e7b19bcd9f544dbe88940157dc7)
### [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/tree/5798970535e520d94e2e02e63cd3d457035d71b7)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#185](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/185)
* [Full changelog](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/compare/9afe66875bff8b5926f2bf6dec4eade1e4a09bab...5798970535e520d94e2e02e63cd3d457035d71b7)
### [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver/tree/4173fa86a8d99c5096e9b25078b598db51a54f13)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#343](https://github.com/openshift/cluster-machine-approver/pull/343)
* [OCPBUGS-128496](https://issues.redhat.com/browse/OCPBUGS-128496): Revert EgressIP validation backport [#337](https://github.com/openshift/cluster-machine-approver/pull/337)
* [OCPBUGS-120752](https://issues.redhat.com/browse/OCPBUGS-120752), [OCPBUGS-127108](https://issues.redhat.com/browse/OCPBUGS-127108): Always validate EgressIPs [#317](https://github.com/openshift/cluster-machine-approver/pull/317)
* [Full changelog](https://github.com/openshift/cluster-machine-approver/compare/fa7bb0222038fdeb51ddeae57b4c193d1b44a0fa...4173fa86a8d99c5096e9b25078b598db51a54f13)
### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/7e452df90f68a0fcd9203300ef9e43ad274338cb)
* [OCPBUGS-130772](https://issues.redhat.com/browse/OCPBUGS-130772): amcfg: remove client-side TLS enforcement for additional alertmanager configs [#3156](https://github.com/openshift/cluster-monitoring-operator/pull/3156)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#3150](https://github.com/openshift/cluster-monitoring-operator/pull/3150)
* [OCPBUGS-129136](https://issues.redhat.com/browse/OCPBUGS-129136): don't delete admin-owned Alertmanager secrets on destroy [#3138](https://github.com/openshift/cluster-monitoring-operator/pull/3138)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.22] [#3112](https://github.com/openshift/cluster-monitoring-operator/pull/3112)
* [OCPBUGS-127466](https://issues.redhat.com/browse/OCPBUGS-127466): fix(e2e): use Job with backoffLimit for TestDocExamples [#3103](https://github.com/openshift/cluster-monitoring-operator/pull/3103)
* [OCPBUGS-126959](https://issues.redhat.com/browse/OCPBUGS-126959): restore node-exporter textfile metrics with read-only rootfs [#3095](https://github.com/openshift/cluster-monitoring-operator/pull/3095)
* [OCPBUGS-111059](https://issues.redhat.com/browse/OCPBUGS-111059): chore: backport support for ogx api adoption metrics [#3058](https://github.com/openshift/cluster-monitoring-operator/pull/3058)
* [OCPBUGS-105469](https://issues.redhat.com/browse/OCPBUGS-105469): enable read-only rootfs for all containers [#3047](https://github.com/openshift/cluster-monitoring-operator/pull/3047)
* [OCPBUGS-112572](https://issues.redhat.com/browse/OCPBUGS-112572): [release-4.22] Makefile: version-stamp golangci-lint binary to prevent stale linter [#3064](https://github.com/openshift/cluster-monitoring-operator/pull/3064)
* [OCPBUGS-105304](https://issues.redhat.com/browse/OCPBUGS-105304): [release-4.22] wrap library-go resourceCache with mutex for thread safety [#3045](https://github.com/openshift/cluster-monitoring-operator/pull/3045)
* [OCPBUGS-104852](https://issues.redhat.com/browse/OCPBUGS-104852): [release-4.22] e2e: scale down CVO and MCO to prevent node reboots during proxy config watch test [#3052](https://github.com/openshift/cluster-monitoring-operator/pull/3052)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/5ea3b57ae26ac222f99d783c566d683e50b9876f...7e452df90f68a0fcd9203300ef9e43ad274338cb)
### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/efa84fc1507c5287eddd65c5a1661da7f28c91cd)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#3187](https://github.com/openshift/cluster-network-operator/pull/3187)
* [OCPBUGS-130582](https://issues.redhat.com/browse/OCPBUGS-130582): Added global overrides for OVN-Kubernetes [#3190](https://github.com/openshift/cluster-network-operator/pull/3190)
* [OCPBUGS-127181](https://issues.redhat.com/browse/OCPBUGS-127181): Adds rendering of enable-multi-network-policy in ovnkube-node [#3172](https://github.com/openshift/cluster-network-operator/pull/3172)
* [OCPBUGS-101929](https://issues.redhat.com/browse/OCPBUGS-101929): [release-4.22] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#3155](https://github.com/openshift/cluster-network-operator/pull/3155)
* [OCPBUGS-113532](https://issues.redhat.com/browse/OCPBUGS-113532): ovn-kubernetes: Move MNP from ConfigMap to CLI flags [#3136](https://github.com/openshift/cluster-network-operator/pull/3136)
* [OCPBUGS-119956](https://issues.redhat.com/browse/OCPBUGS-119956): Allow per-node OVN encap IP override via env-overrides [#3148](https://github.com/openshift/cluster-network-operator/pull/3148)
* [OCPBUGS-99048](https://issues.redhat.com/browse/OCPBUGS-99048): Restart pods when rendering egressIP settings [#3061](https://github.com/openshift/cluster-network-operator/pull/3061)
* [OCPBUGS-105556](https://issues.redhat.com/browse/OCPBUGS-105556): [4.22] frr-k8s: use Recreate strategy for statuscleaner deployment [#3130](https://github.com/openshift/cluster-network-operator/pull/3130)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/6a5fcccf86374942a57dac208d9435eb6b3d7150...efa84fc1507c5287eddd65c5a1661da7f28c91cd)
### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/1acbc2bef9ef7ef47478e4bb128ed894216717f8)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#1660](https://github.com/openshift/cluster-node-tuning-operator/pull/1660)
* [OCPBUGS-130423](https://issues.redhat.com/browse/OCPBUGS-130423): E2E: Fix no-op Get() assertions in mixedcpus [#1662](https://github.com/openshift/cluster-node-tuning-operator/pull/1662)
* [OCPBUGS-129100](https://issues.redhat.com/browse/OCPBUGS-129100): E2E: PPC: replace no-op log-on-match with actual assertions (4 sites) [#1650](https://github.com/openshift/cluster-node-tuning-operator/pull/1650)
* [OCPBUGS-129099](https://issues.redhat.com/browse/OCPBUGS-129099): E2E: add missing matcher to offlined CPU Expect() calls [#1649](https://github.com/openshift/cluster-node-tuning-operator/pull/1649)
* [OCPBUGS-101927](https://issues.redhat.com/browse/OCPBUGS-101927): Bump golang.org/x/net from v0.49.0 to v0.58.0 [#1634](https://github.com/openshift/cluster-node-tuning-operator/pull/1634)
* [OCPBUGS-113579](https://issues.redhat.com/browse/OCPBUGS-113579): Update PPC help description [#1613](https://github.com/openshift/cluster-node-tuning-operator/pull/1613)
* [OCPBUGS-112554](https://issues.redhat.com/browse/OCPBUGS-112554): Use Add() instead of AddRateLimited() for routine Profile enqueues [#1601](https://github.com/openshift/cluster-node-tuning-operator/pull/1601)
* [OCPBUGS-104615](https://issues.redhat.com/browse/OCPBUGS-104615): E2E: LLC: Restore uncore cache annotation to true [#1577](https://github.com/openshift/cluster-node-tuning-operator/pull/1577)
* [OCPBUGS-105873](https://issues.redhat.com/browse/OCPBUGS-105873): BUG-FIX Latency Test [#1583](https://github.com/openshift/cluster-node-tuning-operator/pull/1583)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/5312927f4d6c780bba89a370641957ce0ce0a8d9...1acbc2bef9ef7ef47478e4bb128ed894216717f8)
### [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator/tree/458e208434fa186005806e00671ac25012392f6b)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#254](https://github.com/openshift/cluster-olm-operator/pull/254)
* [OCPBUGS-101911](https://issues.redhat.com/browse/OCPBUGS-101911): Bump golang.org/x/net to v0.56.0 [#241](https://github.com/openshift/cluster-olm-operator/pull/241)
* [Full changelog](https://github.com/openshift/cluster-olm-operator/compare/f66065f7ae39fefe3058d72aa100d41d4327a407...458e208434fa186005806e00671ac25012392f6b)
### [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator/tree/85812363871d64fe8bd5847d24b002d13d5aac45)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#800](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/800)
* [OCPBUGS-101919](https://issues.redhat.com/browse/OCPBUGS-101919): Fix CVE-2026-33814 - update golang.org/x/net to v0.53.0 [#779](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/779)
* [OCPBUGS-114426](https://issues.redhat.com/browse/OCPBUGS-114426): Update build-machinery-go vendor dependency [#772](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/772)
* [Full changelog](https://github.com/openshift/cluster-openshift-apiserver-operator/compare/8417fa98338c2adab73386c63c6d84af14ef99e4...85812363871d64fe8bd5847d24b002d13d5aac45)
### [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator/tree/0b26806c4afd016297e9eb612bd9a9746ec0bd8a)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#450](https://github.com/openshift/cluster-openshift-controller-manager-operator/pull/450)
* [OCPBUGS-101532](https://issues.redhat.com/browse/OCPBUGS-101532): Address CVE-2026-42502 [#443](https://github.com/openshift/cluster-openshift-controller-manager-operator/pull/443)
* [Full changelog](https://github.com/openshift/cluster-openshift-controller-manager-operator/compare/2d2699e4f3fabc80e402f4c090c8cf80c4517977...0b26806c4afd016297e9eb612bd9a9746ec0bd8a)
### [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller/tree/22810075f91276a6504358567abf04db071e23fa)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#210](https://github.com/openshift/cluster-policy-controller/pull/210)
* [OCPBUGS-101925](https://issues.redhat.com/browse/OCPBUGS-101925): Bump golang.org/x/net to v0.55.0 [#198](https://github.com/openshift/cluster-policy-controller/pull/198)
* [Full changelog](https://github.com/openshift/cluster-policy-controller/compare/2e306e143051492a84c5e47a7b3126e096fdf76a...22810075f91276a6504358567abf04db071e23fa)
### [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator/tree/41a6c4d5f3a29e5f69f4f7dd8299108ba09a8600)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#724](https://github.com/openshift/cluster-samples-operator/pull/724)
* [OCPBUGS-129482](https://issues.redhat.com/browse/OCPBUGS-129482): Restrict samples operator access to the global pull-secret [#727](https://github.com/openshift/cluster-samples-operator/pull/727)
* [Full changelog](https://github.com/openshift/cluster-samples-operator/compare/191a6aec444bfdbe5d70f7a23a20ee2fd25b7080...41a6c4d5f3a29e5f69f4f7dd8299108ba09a8600)
### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/78c8eccb6a0e4b93ce4d9d362001970f0618c10f)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#754](https://github.com/openshift/cluster-storage-operator/pull/754)
* [OCPBUGS-112334](https://issues.redhat.com/browse/OCPBUGS-112334): Pass management cluster proxy env vars to CSI driver operator deployments [#740](https://github.com/openshift/cluster-storage-operator/pull/740)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/25672c2af69d1fa76dec61f9db09a989dd5ccdf7...78c8eccb6a0e4b93ce4d9d362001970f0618c10f)
### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/9fa3b469d7e5e381e6530db1dd9aad63d30139c9)
* [OCPBUGS-130968](https://issues.redhat.com/browse/OCPBUGS-130968): Cancel payload retrieval pod on upgrade clear [#1491](https://github.com/openshift/cluster-version-operator/pull/1491)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#1489](https://github.com/openshift/cluster-version-operator/pull/1489)
* [OCPBUGS-101917](https://issues.redhat.com/browse/OCPBUGS-101917): Bump golang.org/x/net to v0.55.0 [#1455](https://github.com/openshift/cluster-version-operator/pull/1455)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/6ac86dc99c02366314381b720ab1d4a38d38f1c2...9fa3b469d7e5e381e6530db1dd9aad63d30139c9)
### [configmap-reloader](https://github.com/openshift/configmap-reload/tree/ef42823089786e6c4d9d79178e595e15d333e2c7)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#87](https://github.com/openshift/configmap-reload/pull/87)
* [Full changelog](https://github.com/openshift/configmap-reload/compare/94e41c4c6a5832dfd19750173d6544784ba235ec...ef42823089786e6c4d9d79178e595e15d333e2c7)
### [console](https://github.com/openshift/console/tree/1284509e1205cb3fc4f88f19411becfe4d4ea59f)
* [OCPBUGS-130937](https://issues.redhat.com/browse/OCPBUGS-130937): Fix xterm ResizeObserver crash on uninitialized dimensions [#17387](https://github.com/openshift/console/pull/17387)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#17415](https://github.com/openshift/console/pull/17415)
* [OCPBUGS-115833](https://issues.redhat.com/browse/OCPBUGS-115833): Show CPU/Memory metrics for non-admin users on Projects page - #17132 [#17132](https://github.com/openshift/console/pull/17132)
* [OCPBUGS-129621](https://issues.redhat.com/browse/OCPBUGS-129621): Cap rendered alerts in notification drawer and dashboards [#17378](https://github.com/openshift/console/pull/17378)
* [OCPBUGS-130325](https://issues.redhat.com/browse/OCPBUGS-130325): Guard against null/missing urls in Helm charts [#17375](https://github.com/openshift/console/pull/17375)
* [OCPBUGS-123201](https://issues.redhat.com/browse/OCPBUGS-123201): Fix Namespace column hidden on Node Pods tab with active namespace [#17174](https://github.com/openshift/console/pull/17174)
* [OCPBUGS-122042](https://issues.redhat.com/browse/OCPBUGS-122042): Strip existing OCI tag before appending new version + fix CSP violation crash [#17345](https://github.com/openshift/console/pull/17345)
* [OCPBUGS-115003](https://issues.redhat.com/browse/OCPBUGS-115003): Validate chart URL in /api/helm/verify to prevent SSRF [#17118](https://github.com/openshift/console/pull/17118)
* [OCPBUGS-114725](https://issues.redhat.com/browse/OCPBUGS-114725): display operators in catalog when Tech Preview enabled [#17114](https://github.com/openshift/console/pull/17114)
* [OCPBUGS-111417](https://issues.redhat.com/browse/OCPBUGS-111417): make cloud provider fields optional during operator install [#17014](https://github.com/openshift/console/pull/17014)
* [OCPBUGS-109521](https://issues.redhat.com/browse/OCPBUGS-109521): Remove unscoped CSV watch from ClusterNotUpgradeableAlert [#17013](https://github.com/openshift/console/pull/17013)
* [OCPBUGS-100519](https://issues.redhat.com/browse/OCPBUGS-100519), [OCPBUGS-101795](https://issues.redhat.com/browse/OCPBUGS-101795): Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss [#17054](https://github.com/openshift/console/pull/17054)
* [OCPBUGS-112271](https://issues.redhat.com/browse/OCPBUGS-112271): Fix flaky TestAsyncCache backend test [#17045](https://github.com/openshift/console/pull/17045)
* [OCPBUGS-105478](https://issues.redhat.com/browse/OCPBUGS-105478): [release-4.22] OCPBUGS-83799: Fix Workloads sidebar ordering when DeploymentConfig is unavailable [#16928](https://github.com/openshift/console/pull/16928)
* Fix OCPBUGS-99414: CVE-2026-59877 [#16834](https://github.com/openshift/console/pull/16834)
* [OCPBUGS-95402](https://issues.redhat.com/browse/OCPBUGS-95402): Fix orphaned shell processes in pod terminal on WebSocket disconnect [#16694](https://github.com/openshift/console/pull/16694)
* Fix for OCPBUGS-101812: CVE-2026-69152 [#16930](https://github.com/openshift/console/pull/16930)
* Fix for OCPBUGS-105894: CVE-2026-73086 [#16965](https://github.com/openshift/console/pull/16965)
* [OCPBUGS-87832](https://issues.redhat.com/browse/OCPBUGS-87832): Use stable username hash for user-settings ConfigMap names [#16565](https://github.com/openshift/console/pull/16565)
* And 2 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/console/compare/c62b7cd934ccfdc9171a874b3bf15d9683f1cb24...1284509e1205cb3fc4f88f19411becfe4d4ea59f)
### [console-operator](https://github.com/openshift/console-operator/tree/1bcbc132acb053c53d003a747d8b6764b194e2e0)
* [OCPBUGS-113612](https://issues.redhat.com/browse/OCPBUGS-113612): Handle disabled Ingress capability in HyperShift [#1214](https://github.com/openshift/console-operator/pull/1214)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#1242](https://github.com/openshift/console-operator/pull/1242)
* [OCPBUGS-101926](https://issues.redhat.com/browse/OCPBUGS-101926): Fix CVE-2026-33814 [#1219](https://github.com/openshift/console-operator/pull/1219)
* [Full changelog](https://github.com/openshift/console-operator/compare/35170581874b91514a9459766758fa0aa5da22f6...1bcbc132acb053c53d003a747d8b6764b194e2e0)
### [container-networking-plugins, containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins/tree/b295a87b578aec9ad3e64ecb60ddd24456a5d6cb)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#252](https://github.com/openshift/containernetworking-plugins/pull/252)
* [OCPBUGS-120707](https://issues.redhat.com/browse/OCPBUGS-120707): Remove rhel8 build stage [#249](https://github.com/openshift/containernetworking-plugins/pull/249)
* [Full changelog](https://github.com/openshift/containernetworking-plugins/compare/db552ad333e84b99ca279a9c01ca2d918ec00c99...b295a87b578aec9ad3e64ecb60ddd24456a5d6cb)
### [coredns](https://github.com/openshift/coredns/tree/c085be2d42c3e7113cd4fb79e4e877a18c02c4ec)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#219](https://github.com/openshift/coredns/pull/219)
* [Full changelog](https://github.com/openshift/coredns/compare/9a71d9a6b788437e755b5ed3bfad78c63fa7c6f4...c085be2d42c3e7113cd4fb79e4e877a18c02c4ec)
### [csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/d302314b9de51fde575f81b9b8cebe241680fe04)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#445](https://github.com/openshift/cloud-provider-openstack/pull/445)
* [OCPBUGS-96666](https://issues.redhat.com/browse/OCPBUGS-96666): Bump golang.org/x/net to v0.55.0 [#416](https://github.com/openshift/cloud-provider-openstack/pull/416)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/710a2aea744fd04546d11ac781fb874694e33ad8...d302314b9de51fde575f81b9b8cebe241680fe04)
### [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs/tree/e70cb65b352f96a4f9d76dd8870909a19e9561c4)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#212](https://github.com/openshift/csi-driver-nfs/pull/212)
* [Full changelog](https://github.com/openshift/csi-driver-nfs/compare/b69115537b79a5b3516e2a900f9095f4ebb3cbe5...e70cb65b352f96a4f9d76dd8870909a19e9561c4)
### [csi-external-attacher](https://github.com/openshift/csi-external-attacher/tree/af02cd29959d8b5dd528e86c86cc9b3c04f0a636)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#124](https://github.com/openshift/csi-external-attacher/pull/124)
* UPSTREAM: 110: OCPBUGS-101913: Bump golang.org/x/net to v0.57.0 [#111](https://github.com/openshift/csi-external-attacher/pull/111)
* [Full changelog](https://github.com/openshift/csi-external-attacher/compare/95a1979700f021e20879480b98b953bc382a0eaf...af02cd29959d8b5dd528e86c86cc9b3c04f0a636)
### [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner/tree/22e2d90605673c89b741ca4f92daa0e746d4c78f)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#166](https://github.com/openshift/csi-external-provisioner/pull/166)
* [OCPBUGS-96626](https://issues.redhat.com/browse/OCPBUGS-96626): Bump golang.org/x/net to v0.57.0 [#148](https://github.com/openshift/csi-external-provisioner/pull/148)
* [Full changelog](https://github.com/openshift/csi-external-provisioner/compare/2d611ab4a7c6fa227a72d54c7ac88530d2c8513b...22e2d90605673c89b741ca4f92daa0e746d4c78f)
### [csi-external-resizer](https://github.com/openshift/csi-external-resizer/tree/c14024e931afd121aa89383fc5891bd97ce544e6)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#218](https://github.com/openshift/csi-external-resizer/pull/218)
* [OCPBUGS-101944](https://issues.redhat.com/browse/OCPBUGS-101944): Bump golang.org/x/net to v0.53.0 [#209](https://github.com/openshift/csi-external-resizer/pull/209)
* [OCPBUGS-82031](https://issues.redhat.com/browse/OCPBUGS-82031): Bump google.golang.org/grpc to v1.79.3 [#199](https://github.com/openshift/csi-external-resizer/pull/199)
* [Full changelog](https://github.com/openshift/csi-external-resizer/compare/4e74a4aa52a2046d6b97a47dff7a60ddb73d0bbd...c14024e931afd121aa89383fc5891bd97ce544e6)
### [csi-external-snapshot-metadata](https://github.com/openshift/csi-external-snapshot-metadata/tree/c341ac0a6fed3796c7653a2d1f9dc84c1a753a18)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#36](https://github.com/openshift/csi-external-snapshot-metadata/pull/36)
* [OCPBUGS-101935](https://issues.redhat.com/browse/OCPBUGS-101935): Bump golang.org/x/net to v0.53.0 [#30](https://github.com/openshift/csi-external-snapshot-metadata/pull/30)
* [OCPBUGS-83948](https://issues.redhat.com/browse/OCPBUGS-83948): Bump google.golang.org/grpc to v1.79.3 [#19](https://github.com/openshift/csi-external-snapshot-metadata/pull/19)
* [Full changelog](https://github.com/openshift/csi-external-snapshot-metadata/compare/7652318579a38838931a5be492cee3573c7c8ecf...c341ac0a6fed3796c7653a2d1f9dc84c1a753a18)
### [csi-external-snapshotter, csi-snapshot-controller](https://github.com/openshift/csi-external-snapshotter/tree/0f6d62e49e13a1b18c79662b1a7bac751bbd336d)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#259](https://github.com/openshift/csi-external-snapshotter/pull/259)
* [OCPBUGS-101938](https://issues.redhat.com/browse/OCPBUGS-101938): UPSTREAM: 1452: Bump golang.org/x/net v0.53.0 to mitigate CVE-2026-33814 [#234](https://github.com/openshift/csi-external-snapshotter/pull/234)
* [Full changelog](https://github.com/openshift/csi-external-snapshotter/compare/28f6e06357f2840c241b9cfe09d301516e681c87...0f6d62e49e13a1b18c79662b1a7bac751bbd336d)
### [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe/tree/536327ec7ad4d6abbb3f15714e19c82da9742bc6)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#106](https://github.com/openshift/csi-livenessprobe/pull/106)
* [OCPBUGS-101948](https://issues.redhat.com/browse/OCPBUGS-101948), [OCPBUGS-104212](https://issues.redhat.com/browse/OCPBUGS-104212): Bump golang.org/x/net to v0.53.0 to address CVE-2026-33814 [#107](https://github.com/openshift/csi-livenessprobe/pull/107)
* [Full changelog](https://github.com/openshift/csi-livenessprobe/compare/4d5e959a182b4db70dc52302bd89eebfec40d5a5...536327ec7ad4d6abbb3f15714e19c82da9742bc6)
### [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar/tree/d2936de6e32c3b2e4441501b4ef0e10fadbaf4d3)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#111](https://github.com/openshift/csi-node-driver-registrar/pull/111)
* [Full changelog](https://github.com/openshift/csi-node-driver-registrar/compare/bb6a6378d2af235b3b253cb422d406bd3d7e30b1...d2936de6e32c3b2e4441501b4ef0e10fadbaf4d3)
### [docker-builder](https://github.com/openshift/builder/tree/c588312e0eef8d8d066aa93c0f9c427dd88af491)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#572](https://github.com/openshift/builder/pull/572)
* [OCPBUGS-95539](https://issues.redhat.com/browse/OCPBUGS-95539): Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 [#551](https://github.com/openshift/builder/pull/551)
* [OCPBUGS-86910](https://issues.redhat.com/browse/OCPBUGS-86910): Updating openshift-enterprise-builder-container image to be consistent with ART for 4.22 [#538](https://github.com/openshift/builder/pull/538)
* [Full changelog](https://github.com/openshift/builder/compare/fcd4ce2d96613a27bd1ab7f53ff47225976c4ba9...c588312e0eef8d8d066aa93c0f9c427dd88af491)
### [docker-registry](https://github.com/openshift/image-registry/tree/d1eaa1eea5f44419c062897439fb841fca61c093)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#491](https://github.com/openshift/image-registry/pull/491)
* [release 4.22] OCPBUGS-114405: GCP: Support Alternate Universe Domain [#476](https://github.com/openshift/image-registry/pull/476)
* [Full changelog](https://github.com/openshift/image-registry/compare/9eae44fcf44142a705031fa16a613c450dbe685a...d1eaa1eea5f44419c062897439fb841fca61c093)
### [egress-router-cni](https://github.com/openshift/egress-router-cni/tree/7869d6ddce3bbde6ded8a08a3b8634d65d445b95)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#116](https://github.com/openshift/egress-router-cni/pull/116)
* [OCPBUGS-120707](https://issues.redhat.com/browse/OCPBUGS-120707): Update Dockerfiles [#114](https://github.com/openshift/egress-router-cni/pull/114)
* [Full changelog](https://github.com/openshift/egress-router-cni/compare/af8f30136791fa3f3dc9e5638bdb062db133bbbd...7869d6ddce3bbde6ded8a08a3b8634d65d445b95)
### [etcd](https://github.com/openshift/etcd/tree/001a74e5c87c52b4e1828f18e89ef6b4bfa38958)
* [OCPBUGS-130714](https://issues.redhat.com/browse/OCPBUGS-130714): Increase snapshot test new member wait timeout [#421](https://github.com/openshift/etcd/pull/421)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#425](https://github.com/openshift/etcd/pull/425)
* [Full changelog](https://github.com/openshift/etcd/compare/6bd01267dc858aca6ff21632f95e98dc62ba33e7...001a74e5c87c52b4e1828f18e89ef6b4bfa38958)
### [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp/tree/85bdbf855e72d276f2ba82b4760b08215e17151a)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#172](https://github.com/openshift/cloud-provider-gcp/pull/172)
* [OCPBUGS-128462](https://issues.redhat.com/browse/OCPBUGS-128462): Bump golang.org/x/net to v0.55.0 for CVE-2026-39821 [#171](https://github.com/openshift/cloud-provider-gcp/pull/171)
* [OCPBUGS-101949](https://issues.redhat.com/browse/OCPBUGS-101949), [OCPBUGS-102055](https://issues.redhat.com/browse/OCPBUGS-102055): Bump golang.org/x/net to v0.53.0 for CVE-2026-33814 [#134](https://github.com/openshift/cloud-provider-gcp/pull/134)
* NO-JIRA: Update OWNERS [#160](https://github.com/openshift/cloud-provider-gcp/pull/160)
* [OCPBUGS-112265](https://issues.redhat.com/browse/OCPBUGS-112265): UPSTREAM: 1250: Support Universe Domain client options (#1250) [#141](https://github.com/openshift/cloud-provider-gcp/pull/141)
* [OCPBUGS-99228](https://issues.redhat.com/browse/OCPBUGS-99228): Fix node.kubernetes.io/exclude-from-external-load-balancers on masters [#130](https://github.com/openshift/cloud-provider-gcp/pull/130)
* [Full changelog](https://github.com/openshift/cloud-provider-gcp/compare/ea31ab85a7cf25e88532598b73502d535462a5d7...85bdbf855e72d276f2ba82b4760b08215e17151a)
### [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp/tree/fdca702c5b86e8c13680f718d99d05ca68cc6cc9)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#321](https://github.com/openshift/cluster-api-provider-gcp/pull/321)
* [Full changelog](https://github.com/openshift/cluster-api-provider-gcp/compare/e7674ede9ce8d021a878a6d5e81942875387e5eb...fdca702c5b86e8c13680f718d99d05ca68cc6cc9)
### [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp/tree/8151bcac115307592aa2c1bd3c11411a4c19be61)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#205](https://github.com/openshift/machine-api-provider-gcp/pull/205)
* [OCPBUGS-114401](https://issues.redhat.com/browse/OCPBUGS-114401): gcd support [#193](https://github.com/openshift/machine-api-provider-gcp/pull/193)
* [Full changelog](https://github.com/openshift/machine-api-provider-gcp/compare/0073bd1187c07febc963fc67f0df67cd33c8f218...8151bcac115307592aa2c1bd3c11411a4c19be61)
### [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver/tree/0df4b63d454ad2467dc0207f32ea041028cee27b)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#150](https://github.com/openshift/gcp-pd-csi-driver/pull/150)
* [OCPBUGS-101954](https://issues.redhat.com/browse/OCPBUGS-101954): CVE-2026-33814: bump golang.org/x/net to v0.53.0 [#148](https://github.com/openshift/gcp-pd-csi-driver/pull/148)
* [OCPBUGS-114412](https://issues.redhat.com/browse/OCPBUGS-114412): Add Universe Domain Support [#129](https://github.com/openshift/gcp-pd-csi-driver/pull/129)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver/compare/48a7a1aa3f2200d01cf1b6e63a5a6cfd5004a8b0...0df4b63d454ad2467dc0207f32ea041028cee27b)
### [gcp-pd-csi-driver-operator](https://github.com/openshift/gcp-pd-csi-driver-operator/tree/634236308866d100c44b683afb85ee0cf8f195d9)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#224](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/224)
* [OCPBUGS-101954](https://issues.redhat.com/browse/OCPBUGS-101954): Bump golang.org/x/net from v0.52.0 to v0.53.0 [#203](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/203)
* [OCPBUGS-115120](https://issues.redhat.com/browse/OCPBUGS-115120): detect GCP Dedicated and use hyperdisk-balanced StorageClass [#204](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/204)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver-operator/compare/3da58a8c88a425e8e05d6e907f5492a49a0ee348...634236308866d100c44b683afb85ee0cf8f195d9)
### [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook/tree/e07402fa2f51dab68a70bffb43ac15477edb6e74)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#29](https://github.com/openshift/gcp-workload-identity-federation-webhook/pull/29)
* [OCPBUGS-101955](https://issues.redhat.com/browse/OCPBUGS-101955): Bump golang.org/x/net to v0.53.0 for CVE-2026-33814 [#22](https://github.com/openshift/gcp-workload-identity-federation-webhook/pull/22)
* [Full changelog](https://github.com/openshift/gcp-workload-identity-federation-webhook/compare/d7675f312ffdc8501032ff8217776cd7172b6bb0...e07402fa2f51dab68a70bffb43ac15477edb6e74)
### [haproxy-router](https://github.com/openshift/router/tree/622d2dfc5256a723cf2ace4b742f4331918e8647)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#865](https://github.com/openshift/router/pull/865)
* [OCPBUGS-126886](https://issues.redhat.com/browse/OCPBUGS-126886): use add/del haproxy api calls [#849](https://github.com/openshift/router/pull/849)
* [OCPBUGS-99286](https://issues.redhat.com/browse/OCPBUGS-99286): Make external cert validation asynchronous and preserve deletion rejection [#858](https://github.com/openshift/router/pull/858)
* [OCPBUGS-101956](https://issues.redhat.com/browse/OCPBUGS-101956): Bump golang.org/x/net from v0.48.0 to v0.53.0 [#834](https://github.com/openshift/router/pull/834)
* [Full changelog](https://github.com/openshift/router/compare/b2665a2999cec36350ccf2614b43941753027773...622d2dfc5256a723cf2ace4b742f4331918e8647)
### [hyperkube, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/c023cae33e1766e787710a8165d7ecfd1ed80938)
* Rebase v1.35.9 in release-4.22 [#2817](https://github.com/openshift/kubernetes/pull/2817)
* NO-JIRA: Rebase release-4.22 to Kubernetes v1.35.8 [#2773](https://github.com/openshift/kubernetes/pull/2773)
* [OCPBUGS-107557](https://issues.redhat.com/browse/OCPBUGS-107557), [OCPBUGS-107672](https://issues.redhat.com/browse/OCPBUGS-107672): bump otel to v1.44.0 to fix CVE-2026-41178 [#2770](https://github.com/openshift/kubernetes/pull/2770)
* [OCPBUGS-98604](https://issues.redhat.com/browse/OCPBUGS-98604): Add NodeSelectorAdjuster admission plugin for HCP clusters (part 2) [#2767](https://github.com/openshift/kubernetes/pull/2767)
* [OCPBUGS-98604](https://issues.redhat.com/browse/OCPBUGS-98604): Add NodeSelectorAdjuster admission plugin for HCP clusters [#2718](https://github.com/openshift/kubernetes/pull/2718)
* [Full changelog](https://github.com/openshift/kubernetes/compare/4a03727d6141fbe09df8550366530b0a6f85d76f...c023cae33e1766e787710a8165d7ecfd1ed80938)
### [hypershift](https://github.com/openshift/hypershift/tree/db8d2278410f6ce7b5ec85971b80aea598d27222)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#9998](https://github.com/openshift/hypershift/pull/9998)
* [OCPBUGS-121867](https://issues.redhat.com/browse/OCPBUGS-121867): Generate KubeVirt nmstate network config conditionally [#9978](https://github.com/openshift/hypershift/pull/9978)
* [OCPBUGS-128505](https://issues.redhat.com/browse/OCPBUGS-128505): fix: mount combined-pull-secret in OpenShift API Server [#9884](https://github.com/openshift/hypershift/pull/9884)
* [OCPBUGS-129020](https://issues.redhat.com/browse/OCPBUGS-129020): backport safe-to-evict annotation fix [#9876](https://github.com/openshift/hypershift/pull/9876)
* [OCPBUGS-129145](https://issues.redhat.com/browse/OCPBUGS-129145): Count only successful upsert updates [#9900](https://github.com/openshift/hypershift/pull/9900)
* [OCPBUGS-127060](https://issues.redhat.com/browse/OCPBUGS-127060): Replace exponential backoff with fixed-interval requeue in CRR controller [#9721](https://github.com/openshift/hypershift/pull/9721)
* [CNTRLPLANE-4569](https://issues.redhat.com/browse/CNTRLPLANE-4569): add kubeClientQPS and kubeClientBurst to ClusterAutoscaling [#9886](https://github.com/openshift/hypershift/pull/9886)
* [OCPBUGS-129105](https://issues.redhat.com/browse/OCPBUGS-129105): [release-4.22] OCPBUGS-127049: fix(globalps): schedule global-pull-secret-syncer on karpenter nodes [#9895](https://github.com/openshift/hypershift/pull/9895)
* [OCPBUGS-95572](https://issues.redhat.com/browse/OCPBUGS-95572): CVE-2026-46597 openshift4/ose-hypershift-rhel9: golang… [#9264](https://github.com/openshift/hypershift/pull/9264)
* [OCPBUGS-101951](https://issues.redhat.com/browse/OCPBUGS-101951): Fix CVE-2026-33814 by bumping golang.org/x/net to v0.53.0 [#9528](https://github.com/openshift/hypershift/pull/9528)
* [OCPBUGS-119698](https://issues.redhat.com/browse/OCPBUGS-119698): Add proxy env vars to cluster-storage-operator deployment" [#9494](https://github.com/openshift/hypershift/pull/9494)
* [CNTRLPLANE-4158](https://issues.redhat.com/browse/CNTRLPLANE-4158): Maintain ingress serving cert for HostedCluster ingress [#9607](https://github.com/openshift/hypershift/pull/9607)
* [OCPBUGS-120746](https://issues.redhat.com/browse/OCPBUGS-120746): Move packageserver PDB from guest cluster to management cluster [#9548](https://github.com/openshift/hypershift/pull/9548)
* [OCPBUGS-127173](https://issues.redhat.com/browse/OCPBUGS-127173): filter AWS-reserved tag keys before calling DeleteTags [#9733](https://github.com/openshift/hypershift/pull/9733)
* [OCPBUGS-123727](https://issues.redhat.com/browse/OCPBUGS-123727): fix(azure): skip KMS validation for private Key Vaults on ARO HCP [#9624](https://github.com/openshift/hypershift/pull/9624)
* [OCPBUGS-112731](https://issues.redhat.com/browse/OCPBUGS-112731): fix(certs): normalize IP SANs to stop dual-stack KAS cert churn [#9496](https://github.com/openshift/hypershift/pull/9496)
* [OCPBUGS-114436](https://issues.redhat.com/browse/OCPBUGS-114436): fix(konnectivity): enable --sync-forever to restore lost agent-server tunnels [#9432](https://github.com/openshift/hypershift/pull/9432)
* [ACM-46124](https://issues.redhat.com/browse/ACM-46124): improve hypershift-rhel9-operator container grade on MCE 2.12 [release-4.22] [#9740](https://github.com/openshift/hypershift/pull/9740)
* [OCPBUGS-125659](https://issues.redhat.com/browse/OCPBUGS-125659): fix(cpo): preserve immutable AWS load balancer annotations [#9637](https://github.com/openshift/hypershift/pull/9637)
* [OCPBUGS-120704](https://issues.redhat.com/browse/OCPBUGS-120704): [release-4.22] fix(operator): health probes + pki-operator TLS config [#9600](https://github.com/openshift/hypershift/pull/9600)
* [OCPBUGS-100445](https://issues.redhat.com/browse/OCPBUGS-100445): create virt-launcher NetworkPolicy on external infra cluster [#9205](https://github.com/openshift/hypershift/pull/9205)
* [OCPBUGS-114889](https://issues.redhat.com/browse/OCPBUGS-114889): hardcode ETCD_METRICS=extensive in etcd StatefulSet template [#9440](https://github.com/openshift/hypershift/pull/9440)
* [CNTRLPLANE-4321](https://issues.redhat.com/browse/CNTRLPLANE-4321): Cherry-pick kube-scheduler metrics support [#9490](https://github.com/openshift/hypershift/pull/9490)
* [CNTRLPLANE-4024](https://issues.redhat.com/browse/CNTRLPLANE-4024): feat(azure): support managed HSM for KMS encryption [#9437](https://github.com/openshift/hypershift/pull/9437)
* [OCPBUGS-98328](https://issues.redhat.com/browse/OCPBUGS-98328): fix(kubevirt): use only first MachineInternalIP per family in EndpointSlice endpoints [#8979](https://github.com/openshift/hypershift/pull/8979)
* [CNTRLPLANE-3774](https://issues.redhat.com/browse/CNTRLPLANE-3774): [release-4.22] fix: control-plane-operator: improve opaque conditions [#9058](https://github.com/openshift/hypershift/pull/9058)
* [OCPBUGS-111083](https://issues.redhat.com/browse/OCPBUGS-111083): fix(hcco): run kas-connection-checker as non-root [#9320](https://github.com/openshift/hypershift/pull/9320)
* [OCPBUGS-105866](https://issues.redhat.com/browse/OCPBUGS-105866): remove redhat-marketplace catalog from HyperShift [#9289](https://github.com/openshift/hypershift/pull/9289)
* [Full changelog](https://github.com/openshift/hypershift/compare/e945b30f303400f6acec66738c482af93dc68a70...db8d2278410f6ce7b5ec85971b80aea598d27222)
### [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm/tree/5575bead2eb27f1a76e64dca4ee4971c4130928b)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#121](https://github.com/openshift/cloud-provider-ibm/pull/121)
* [OCPBUGS-120700](https://issues.redhat.com/browse/OCPBUGS-120700): Bump golang.org/x/net to v0.58.0 to address CVE-2026-33814 [#110](https://github.com/openshift/cloud-provider-ibm/pull/110)
* [Full changelog](https://github.com/openshift/cloud-provider-ibm/compare/24cff9a691e1ebee94669c834320c6ea974a2010...5575bead2eb27f1a76e64dca4ee4971c4130928b)
### [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver/tree/6f7c4dddc1d461afe76e6610dd18d8b99c9f5a35)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#177](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/177)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver/compare/d362aef240c280676249fa34c80fa1b39c684560...6f7c4dddc1d461afe76e6610dd18d8b99c9f5a35)
### [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/tree/9b4f32d075e22074bfc22b979e7a21983955be70)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#200](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/200)
* [OCPBUGS-101952](https://issues.redhat.com/browse/OCPBUGS-101952): Bump golang.org/x/net to v0.53.0 [#192](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/192)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/compare/3d5956ddd2292c381309106d23fff1765380c55e...9b4f32d075e22074bfc22b979e7a21983955be70)
### [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud/tree/e0db01b183082bb2b1969db953739529981f16ac)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#189](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/189)
* [OCPBUGS-101965](https://issues.redhat.com/browse/OCPBUGS-101965): Replace golang.org/x/net with openshift-sustaining/net [#176](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/176)
* [Full changelog](https://github.com/openshift/cluster-api-provider-ibmcloud/compare/03b143d588768a18fd8afa1534ea7d7a04b4d1f3...e0db01b183082bb2b1969db953739529981f16ac)
### [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud/tree/ee7db9abd9105c9079fcad144913c61469d1e017)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#119](https://github.com/openshift/machine-api-provider-ibmcloud/pull/119)
* [Full changelog](https://github.com/openshift/machine-api-provider-ibmcloud/compare/9e5537cd7d239a31d6b2eb56cd44af3ec7b47dd5...ee7db9abd9105c9079fcad144913c61469d1e017)
### [insights-operator](https://github.com/openshift/insights-operator/tree/b8926a376016c4558f8f18a5fb4e7a75fc809c75)
* [OCPBUGS-128979](https://issues.redhat.com/browse/OCPBUGS-128979): multiclusterhub gatherer [#1384](https://github.com/openshift/insights-operator/pull/1384)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#1393](https://github.com/openshift/insights-operator/pull/1393)
* [OCPBUGS-128776](https://issues.redhat.com/browse/OCPBUGS-128776): add insights-runtime-extractor-scc missing fields [#1394](https://github.com/openshift/insights-operator/pull/1394)
* [OCPBUGS-113495](https://issues.redhat.com/browse/OCPBUGS-113495): Add multicluster gatherer [#1351](https://github.com/openshift/insights-operator/pull/1351)
* [OCPBUGS-122009](https://issues.redhat.com/browse/OCPBUGS-122009): add custom proxy field to insights config [#1362](https://github.com/openshift/insights-operator/pull/1362)
* And 3 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/insights-operator/compare/a46094471cfb564f3224975a2b1ea6c12d9d057b...b8926a376016c4558f8f18a5fb4e7a75fc809c75)
### [insights-runtime-exporter, insights-runtime-extractor](https://github.com/openshift/insights-runtime-extractor/tree/9e958218c426d5b615f0ef55e2da3874885cc5eb)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#96](https://github.com/openshift/insights-runtime-extractor/pull/96)
* [Full changelog](https://github.com/openshift/insights-runtime-extractor/compare/70256457b507ec09737800ee7ea022143ed6c3c2...9e958218c426d5b615f0ef55e2da3874885cc5eb)
### [ironic](https://github.com/openshift/ironic-image/tree/cc7292ea2591cee804f8901b84a76b188d7d44e7)
* Bug OCPBUGS-112711: Telco bugfixes sep26 [#915](https://github.com/openshift/ironic-image/pull/915)
* [OCPBUGS-115160](https://issues.redhat.com/browse/OCPBUGS-115160): bump ironic to include fix [#907](https://github.com/openshift/ironic-image/pull/907)
* [OCPBUGS-112341](https://issues.redhat.com/browse/OCPBUGS-112341): Update ironic hash to include fixes related to power management error… [#901](https://github.com/openshift/ironic-image/pull/901)
* [OCPBUGS-105863](https://issues.redhat.com/browse/OCPBUGS-105863): update ironic pin to include CVE-2026-54423 fix (release-4.22) [#889](https://github.com/openshift/ironic-image/pull/889)
* [Full changelog](https://github.com/openshift/ironic-image/compare/70bad6d9dc4298c6014c8fc1b00894e5f6c15ffc...cc7292ea2591cee804f8901b84a76b188d7d44e7)
### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/be386561e40cc3bb56ddd05fbf73a7c9ead5198c)
* [OCPBUGS-99897](https://issues.redhat.com/browse/OCPBUGS-99897): Bump ironic-python-agent pinned commit for CVE-2026-66138 [#294](https://github.com/openshift/ironic-agent-image/pull/294)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/4a33a88f4b13d9eef9831427f523a6b5d88e4401...be386561e40cc3bb56ddd05fbf73a7c9ead5198c)
### [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader/tree/ffe2738eac84a34415c17f4921f7ae2b78c5bfb5)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#124](https://github.com/openshift/ironic-rhcos-downloader/pull/124)
* [Full changelog](https://github.com/openshift/ironic-rhcos-downloader/compare/9953d2b77da077c28f9486a5d965a43149ce30c1...ffe2738eac84a34415c17f4921f7ae2b78c5bfb5)
### [keepalived-ipfailover](https://github.com/openshift/images/tree/d6a9ffc8bd60573ca6e343dce14a964ba67f6c24)
* [OCPBUGS-70034](https://issues.redhat.com/browse/OCPBUGS-70034): Updating openshift-enterprise-keepalived-ipfailover-container image to be consistent with ART for 4.22 [#219](https://github.com/openshift/images/pull/219)
* [Full changelog](https://github.com/openshift/images/compare/6035d101dbc9a7fdd8861d864aeb6f66bacd964b...d6a9ffc8bd60573ca6e343dce14a964ba67f6c24)
### [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server/tree/5c68a8e362596c23adafc0144a85fe668f6417fa)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#92](https://github.com/openshift/kubernetes-metrics-server/pull/92)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.22] [#90](https://github.com/openshift/kubernetes-metrics-server/pull/90)
* [Full changelog](https://github.com/openshift/kubernetes-metrics-server/compare/38c16c4698d131ab0e2da0d4b4b76d5322a89bab...5c68a8e362596c23adafc0144a85fe668f6417fa)
### [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy/tree/cd28f2710ec8c800d64e8eca846cb4b426247d27)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#183](https://github.com/openshift/kube-rbac-proxy/pull/183)
* [OCPBUGS-127951](https://issues.redhat.com/browse/OCPBUGS-127951): Bump golang.org/x/net from v0.52.0 to v0.58.0 to resolve CVE-2026-39821 (release-4.22) [#165](https://github.com/openshift/kube-rbac-proxy/pull/165)
* [Full changelog](https://github.com/openshift/kube-rbac-proxy/compare/d12e274605248f6c59373240a7eae7a7a357dcb3...cd28f2710ec8c800d64e8eca846cb4b426247d27)
### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/0ad71b934f4d4620df914c25926a5c7242dfd9c9)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#201](https://github.com/openshift/kube-state-metrics/pull/201)
* [OCPBUGS-127378](https://issues.redhat.com/browse/OCPBUGS-127378): backport kube-state-metrics 2.18 memory leak fix [#157](https://github.com/openshift/kube-state-metrics/pull/157)
* [OCPBUGS-101958](https://issues.redhat.com/browse/OCPBUGS-101958): Bump golang.org/x/net to v0.53.0 [#168](https://github.com/openshift/kube-state-metrics/pull/168)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.22] [#187](https://github.com/openshift/kube-state-metrics/pull/187)
* [Full changelog](https://github.com/openshift/kube-state-metrics/compare/0a5ea07ca01263c4273a1a929854969e11a69bea...0ad71b934f4d4620df914c25926a5c7242dfd9c9)
### [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator/tree/a67afb9b9fea72316591666c207b3a32e9e07835)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#268](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/268)
* [OCPBUGS-77815](https://issues.redhat.com/browse/OCPBUGS-77815): Updating ose-kube-storage-version-migrator-container image to be consistent with ART for 4.22 [#240](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/240)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Update build-machinery-go vendor dependency [#261](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/261)
* [Full changelog](https://github.com/openshift/kubernetes-kube-storage-version-migrator/compare/72835e43c7754356645e41031f3a99926b4d42e6...a67afb9b9fea72316591666c207b3a32e9e07835)
### [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt/tree/1c35a60ab2124ae2f4cac053be9e2d41da8a0ed0)
* [OCPBUGS-101978](https://issues.redhat.com/browse/OCPBUGS-101978): Bump golang.org/x/net to v0.53.0 [#98](https://github.com/openshift/cloud-provider-kubevirt/pull/98)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#100](https://github.com/openshift/cloud-provider-kubevirt/pull/100)
* [Full changelog](https://github.com/openshift/cloud-provider-kubevirt/compare/09a0a5beaa65fb589d7b571dc47f9748d2463b1c...1c35a60ab2124ae2f4cac053be9e2d41da8a0ed0)
### [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver/tree/f83472f2cc13b303444b64b7c126585978cc18de)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#122](https://github.com/openshift/kubevirt-csi-driver/pull/122)
* [OCPBUGS-69717](https://issues.redhat.com/browse/OCPBUGS-69717): Updating ose-kubevirt-csi-driver-container image to be consistent with ART for 4.22 [#77](https://github.com/openshift/kubevirt-csi-driver/pull/77)
* [Full changelog](https://github.com/openshift/kubevirt-csi-driver/compare/90f14506c2d4fecfba2c355934bde87e6f101a20...f83472f2cc13b303444b64b7c126585978cc18de)
### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/1f3a44ba2b2ebbf7942213d7d8bca74a14b1056f)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#1584](https://github.com/openshift/machine-api-operator/pull/1584)
* [OCPBUGS-130351](https://issues.redhat.com/browse/OCPBUGS-130351): fix race in VAP MachineSet e2e test cleanup [#1577](https://github.com/openshift/machine-api-operator/pull/1577)
* [OCPBUGS-129423](https://issues.redhat.com/browse/OCPBUGS-129423): Reduce vCenter API load in the vSphere machine controller [#1574](https://github.com/openshift/machine-api-operator/pull/1574)
* [OCPBUGS-126916](https://issues.redhat.com/browse/OCPBUGS-126916): Add opt-in kube-rbac-proxy sidecar for pprof endpoint (AWS) [#1558](https://github.com/openshift/machine-api-operator/pull/1558)
* [SPLAT-2865](https://issues.redhat.com/browse/SPLAT-2865): Added multi vCenter Day 2 Support [#1531](https://github.com/openshift/machine-api-operator/pull/1531)
* [OCPBUGS-101989](https://issues.redhat.com/browse/OCPBUGS-101989): Bump golang.org/x/net from v0.49.0 to v0.53.0 [#1541](https://github.com/openshift/machine-api-operator/pull/1541)
* [OCPBUGS-115165](https://issues.redhat.com/browse/OCPBUGS-115165): CORS-4521: GCP: Add regional permission [#1538](https://github.com/openshift/machine-api-operator/pull/1538)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/78c5104d9a69072749f4ddf681926bcc404ef271...1f3a44ba2b2ebbf7942213d7d8bca74a14b1056f)
### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/66c1760b72951b848bad99e119e7a94b6f4e3f63)
* [OCPBUGS-132857](https://issues.redhat.com/browse/OCPBUGS-132857): only enable signed policy when testing… [#6674](https://github.com/openshift/machine-config-operator/pull/6674)
* [OCPBUGS-128499](https://issues.redhat.com/browse/OCPBUGS-128499): [release-4.22] Split wait-for-ipsec-connect into two services to avoid ipsec restart [#6441](https://github.com/openshift/machine-config-operator/pull/6441)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#6656](https://github.com/openshift/machine-config-operator/pull/6656)
* [OCPBUGS-129432](https://issues.redhat.com/browse/OCPBUGS-129432): logout vCenter clients after use [#6636](https://github.com/openshift/machine-config-operator/pull/6636)
* [OCPBUGS-128838](https://issues.redhat.com/browse/OCPBUGS-128838): Run nmstatectl format in nmstate-configuration [#6614](https://github.com/openshift/machine-config-operator/pull/6614)
* [OCPBUGS-129268](https://issues.redhat.com/browse/OCPBUGS-129268): Boot image controller skips MachineSets that don't match any failure domain [#6627](https://github.com/openshift/machine-config-operator/pull/6627)
* [OCPBUGS-129375](https://issues.redhat.com/browse/OCPBUGS-129375): Fix layered OS updates on older nodes whose host skopeo cannot process multi-architecture signatures [#6617](https://github.com/openshift/machine-config-operator/pull/6617)
* [OCPBUGS-128961](https://issues.redhat.com/browse/OCPBUGS-128961): Filter cosign signature tags from the IRI release lookup [#6620](https://github.com/openshift/machine-config-operator/pull/6620)
* [OCPBUGS-127016](https://issues.redhat.com/browse/OCPBUGS-127016): disable bootimages update in TC-52373 proxy test [#6600](https://github.com/openshift/machine-config-operator/pull/6600)
* [OCPBUGS-128622](https://issues.redhat.com/browse/OCPBUGS-128622): Add fix TC 63866 failing in CI job [#6601](https://github.com/openshift/machine-config-operator/pull/6601)
* [OCPBUGS-123173](https://issues.redhat.com/browse/OCPBUGS-123173): remove nft chains before checking the ignition config [#6541](https://github.com/openshift/machine-config-operator/pull/6541)
* [OCPBUGS-119240](https://issues.redhat.com/browse/OCPBUGS-119240): drop GCD health-check ranges in openshift-gcp-routes [#6564](https://github.com/openshift/machine-config-operator/pull/6564)
* [OCPBUGS-101987](https://issues.redhat.com/browse/OCPBUGS-101987): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#6503](https://github.com/openshift/machine-config-operator/pull/6503)
* [OCPBUGS-127018](https://issues.redhat.com/browse/OCPBUGS-127018): Correctly handle MC deletion in image mode when no new build is required [#6567](https://github.com/openshift/machine-config-operator/pull/6567)
* [OCPBUGS-127016](https://issues.redhat.com/browse/OCPBUGS-127016): Fix IsBootImageUpdateSupported to include vSphere and Azure platforms [#6565](https://github.com/openshift/machine-config-operator/pull/6565)
* [OCPBUGS-125661](https://issues.redhat.com/browse/OCPBUGS-125661): Replace wildcard permissions with explicit verbs in MachineConfigServer ClusterRole [#6551](https://github.com/openshift/machine-config-operator/pull/6551)
* [OCPBUGS-122130](https://issues.redhat.com/browse/OCPBUGS-122130): Retry on conflict in syncMachineConfigNodes [#6521](https://github.com/openshift/machine-config-operator/pull/6521)
* [OCPBUGS-126739](https://issues.redhat.com/browse/OCPBUGS-126739): improve JSON unmarshalling for secret decoding [#6561](https://github.com/openshift/machine-config-operator/pull/6561)
* [OCPBUGS-126637](https://issues.redhat.com/browse/OCPBUGS-126637): Mount /etc/container in mosb [#6557](https://github.com/openshift/machine-config-operator/pull/6557)
* [OCPBUGS-122239](https://issues.redhat.com/browse/OCPBUGS-122239): [TNF] Add infinite retry on untaint systemd unit [#6554](https://github.com/openshift/machine-config-operator/pull/6554)
* [OCPBUGS-122961](https://issues.redhat.com/browse/OCPBUGS-122961): updateLayeredOS deploy-from-self when skopeo < 1.22.2 [#6538](https://github.com/openshift/machine-config-operator/pull/6538)
* [OCPBUGS-122279](https://issues.redhat.com/browse/OCPBUGS-122279): limit ContainerRuntimeConfig status condition to 3 [#6531](https://github.com/openshift/machine-config-operator/pull/6531)
* [OCPBUGS-121849](https://issues.redhat.com/browse/OCPBUGS-121849): Fix vsphere network absolute paths [#6512](https://github.com/openshift/machine-config-operator/pull/6512)
* [OCPBUGS-120671](https://issues.redhat.com/browse/OCPBUGS-120671): Skip vsphere fd-unmatched machinesets for bootimage updates [#6494](https://github.com/openshift/machine-config-operator/pull/6494)
* [OCPBUGS-119936](https://issues.redhat.com/browse/OCPBUGS-119936): Increase TC-74751 Eventually timeout for vSphere OVA upload [#6492](https://github.com/openshift/machine-config-operator/pull/6492)
* [OCPBUGS-115401](https://issues.redhat.com/browse/OCPBUGS-115401): Update message for MachineOSBuildFailed condition [#6479](https://github.com/openshift/machine-config-operator/pull/6479)
* [OCPBUGS-116943](https://issues.redhat.com/browse/OCPBUGS-116943): Update AMI Whitelist [#6489](https://github.com/openshift/machine-config-operator/pull/6489)
* [OCPBUGS-112785](https://issues.redhat.com/browse/OCPBUGS-112785): Revert TNF Graceful node shutdown [#6461](https://github.com/openshift/machine-config-operator/pull/6461)
* [OCPBUGS-114418](https://issues.redhat.com/browse/OCPBUGS-114418): [release-4.22] OCPBUGS-113615: Azure confidential clusters should be flagged by skew enforcement [#6459](https://github.com/openshift/machine-config-operator/pull/6459)
* [OCPBUGS-114392](https://issues.redhat.com/browse/OCPBUGS-114392): Use kubernetes scheme in drain controller event recorder [#6458](https://github.com/openshift/machine-config-operator/pull/6458)
* [AGENT-1583](https://issues.redhat.com/browse/AGENT-1583): post-feature promotion (NoRegistryClusterInstall) openshift/api dependencies bump [#6418](https://github.com/openshift/machine-config-operator/pull/6418)
* [OCPBUGS-112618](https://issues.redhat.com/browse/OCPBUGS-112618): Fix upstreams for CoreDNS pods on Cloud platforms [#6438](https://github.com/openshift/machine-config-operator/pull/6438)
* [OCPBUGS-112614](https://issues.redhat.com/browse/OCPBUGS-112614): OCPBUGS-109739: Increase rpm-ostree rebase retry backoff and preserve error [#6436](https://github.com/openshift/machine-config-operator/pull/6436)
* [OCPBUGS-105521](https://issues.redhat.com/browse/OCPBUGS-105521): Fix SHA idempotency test in nmstate-configuration.sh [#6392](https://github.com/openshift/machine-config-operator/pull/6392)
* [OCPBUGS-105929](https://issues.redhat.com/browse/OCPBUGS-105929): Fix duplicate template error and e2es [#6397](https://github.com/openshift/machine-config-operator/pull/6397)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/6901793947571b65438b23074506c0ad85f33031...66c1760b72951b848bad99e119e7a94b6f4e3f63)
### [machine-image-customization-controller](https://github.com/openshift/image-customization-controller/tree/dbd9958746362861d2966f4bba9731a1cdac25eb)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#200](https://github.com/openshift/image-customization-controller/pull/200)
* [OCPBUGS-101953](https://issues.redhat.com/browse/OCPBUGS-101953): Bump golang.org/x/net to v0.53.0 [#196](https://github.com/openshift/image-customization-controller/pull/196)
* [Full changelog](https://github.com/openshift/image-customization-controller/compare/a43d9c977f6332577efcd383cf173a2ff5805a4d...dbd9958746362861d2966f4bba9731a1cdac25eb)
### [metallb-frr](https://github.com/openshift/frr/tree/943578e55487fc99389a36e0b50ee3e02101050e)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#143](https://github.com/openshift/frr/pull/143)
* [Full changelog](https://github.com/openshift/frr/compare/1277b2387272397d3479d74d2d65112112f985b8...943578e55487fc99389a36e0b50ee3e02101050e)
### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/b6fd3ab741ffeaa1addf119c39ffb9ecc2d51011)
* [OU-1589](https://issues.redhat.com/browse/OU-1589): [release-4.22] sanitize linkified URLs in alert annotations [#1382](https://github.com/openshift/monitoring-plugin/pull/1382)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#1362](https://github.com/openshift/monitoring-plugin/pull/1362)
* [OU-1392](https://issues.redhat.com/browse/OU-1392): [release-4.22] fix: parse datetime ranges from the specified format rather than browser specific apis [#1349](https://github.com/openshift/monitoring-plugin/pull/1349)
* [OCPBUGS-129632](https://issues.redhat.com/browse/OCPBUGS-129632): [release-4.22] escape regex variable values in regex matcher contexts [#1340](https://github.com/openshift/monitoring-plugin/pull/1340)
* [OU-1528](https://issues.redhat.com/browse/OU-1528): [release-4.22] Optimize namespace changes in Alerts [#1312](https://github.com/openshift/monitoring-plugin/pull/1312)
* [OCPBUGS-118239](https://issues.redhat.com/browse/OCPBUGS-118239): Bump fast-uri to fix CVE-2026-84292 [#1329](https://github.com/openshift/monitoring-plugin/pull/1329)
* NO-JIRA: [release-4.22] Sanitize alert runbook URLs [#1295](https://github.com/openshift/monitoring-plugin/pull/1295)
* [OCPBUGS-101991](https://issues.redhat.com/browse/OCPBUGS-101991): CVE-2026-33814 openshift4/ose-monitoring-plugin-rhel9: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.22] [#1202](https://github.com/openshift/monitoring-plugin/pull/1202)
* [OLS-3921](https://issues.redhat.com/browse/OLS-3921): disable button shrink [#1189](https://github.com/openshift/monitoring-plugin/pull/1189)
* [OCPBUGS-98787](https://issues.redhat.com/browse/OCPBUGS-98787): replace outdated react-linkify dependency [#1150](https://github.com/openshift/monitoring-plugin/pull/1150)
* [OCPBUGS-98787](https://issues.redhat.com/browse/OCPBUGS-98787): replace outdated react-linkify dependency [#1145](https://github.com/openshift/monitoring-plugin/pull/1145)
* [OCPBUGS-98432](https://issues.redhat.com/browse/OCPBUGS-98432): fix for CVE-2026-59869 [#1114](https://github.com/openshift/monitoring-plugin/pull/1114)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/cd7672c06e24c6d377df29d01d1b0015cd2aacd8...b6fd3ab741ffeaa1addf119c39ffb9ecc2d51011)
### [multus-admission-controller](https://github.com/openshift/multus-admission-controller/tree/9a306e2c31918eb50270e31919fcc0d291ea449e)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#145](https://github.com/openshift/multus-admission-controller/pull/145)
* [OCPBUGS-101972](https://issues.redhat.com/browse/OCPBUGS-101972): bump golang.org/x/net to v0.53.0 to fix CVE-2026-33814 [#130](https://github.com/openshift/multus-admission-controller/pull/130)
* [Full changelog](https://github.com/openshift/multus-admission-controller/compare/d4dd42ba9c17b04e0e5003147f4e140ea5e34749...9a306e2c31918eb50270e31919fcc0d291ea449e)
### [multus-cni, multus-cni-microshift](https://github.com/openshift/multus-cni/tree/172fe464e37399dbafd19783dfd1c31672da79c4)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#372](https://github.com/openshift/multus-cni/pull/372)
* [OCPBUGS-101992](https://issues.redhat.com/browse/OCPBUGS-101992): [release-4.22] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#353](https://github.com/openshift/multus-cni/pull/353)
* [OCPBUGS-120707](https://issues.redhat.com/browse/OCPBUGS-120707): Remove rhel8 build stage [#360](https://github.com/openshift/multus-cni/pull/360)
* [OCPBUGS-120682](https://issues.redhat.com/browse/OCPBUGS-120682): [Release 4.22] Cherry-pick fix for the issue of stripping delegate datastore config on CNI DEL, leaking IPAM addresses [#350](https://github.com/openshift/multus-cni/pull/350)
* [OCPBUGS-114732](https://issues.redhat.com/browse/OCPBUGS-114732): [release-4.22] Revert "Sort DeviceIDs in GetPodResourceMap for deterministic ordering" [#346](https://github.com/openshift/multus-cni/pull/346)
* [Full changelog](https://github.com/openshift/multus-cni/compare/b4ec7d8239ce4bd3ed949bce9816a013377b44c7...172fe464e37399dbafd19783dfd1c31672da79c4)
### [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy/tree/e21b389d60b04eaff6ecc997de2c96e40544000d)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#137](https://github.com/openshift/multus-networkpolicy/pull/137)
* [OCPBUGS-101970](https://issues.redhat.com/browse/OCPBUGS-101970): [release-4.22] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#124](https://github.com/openshift/multus-networkpolicy/pull/124)
* [Full changelog](https://github.com/openshift/multus-networkpolicy/compare/834a093f693e521b8dc4ec7168d03cfba2c1cba1...e21b389d60b04eaff6ecc997de2c96e40544000d)
### [multus-route-override-cni](https://github.com/openshift/route-override-cni/tree/3579b135af9dde1411c66b139fc02695cf51c657)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#86](https://github.com/openshift/route-override-cni/pull/86)
* [OCPBUGS-120707](https://issues.redhat.com/browse/OCPBUGS-120707): Remove rhel8 build stage [#79](https://github.com/openshift/route-override-cni/pull/79)
* [OCPBUGS-120707](https://issues.redhat.com/browse/OCPBUGS-120707): Remove rhel8 build stage [#80](https://github.com/openshift/route-override-cni/pull/80)
* [Full changelog](https://github.com/openshift/route-override-cni/compare/08af4127c77976510cad1c096d9aca977d8ae5af...3579b135af9dde1411c66b139fc02695cf51c657)
### [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni/tree/46dd300c07d255614f1c4cf92a9ff464505007c8)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#440](https://github.com/openshift/whereabouts-cni/pull/440)
* [OCPBUGS-101984](https://issues.redhat.com/browse/OCPBUGS-101984): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#422](https://github.com/openshift/whereabouts-cni/pull/422)
* [OCPBUGS-120707](https://issues.redhat.com/browse/OCPBUGS-120707): Remove rhel8 build stage [#429](https://github.com/openshift/whereabouts-cni/pull/429)
* [Full changelog](https://github.com/openshift/whereabouts-cni/compare/d691040e509bb20c26b5e8366c0d6f3bb45a5e02...46dd300c07d255614f1c4cf92a9ff464505007c8)
### [must-gather](https://github.com/openshift/must-gather/tree/6d3d1acef27d4ac41ccfa988e3079fdc0a311a62)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#574](https://github.com/openshift/must-gather/pull/574)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Update build-machinery-go vendor dependency [#565](https://github.com/openshift/must-gather/pull/565)
* [Full changelog](https://github.com/openshift/must-gather/compare/8554213fa214e8e165e7bedaf8d892bb824d83ef...6d3d1acef27d4ac41ccfa988e3079fdc0a311a62)
### [network-interface-bond-cni](https://github.com/openshift/bond-cni/tree/3f9d1810c3b385b6a7d05724c78d254e17965f0e)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#125](https://github.com/openshift/bond-cni/pull/125)
* [OCPBUGS-120707](https://issues.redhat.com/browse/OCPBUGS-120707): Remove rhel8 build stage [#124](https://github.com/openshift/bond-cni/pull/124)
* [OCPBUGS-69972](https://issues.redhat.com/browse/OCPBUGS-69972): Updating ose-network-interface-bond-cni-container image to be consistent with ART for 4.22 [#109](https://github.com/openshift/bond-cni/pull/109)
* [Full changelog](https://github.com/openshift/bond-cni/compare/5ef2d3205f11fba65e3949c0c57897420a83974a...3f9d1810c3b385b6a7d05724c78d254e17965f0e)
### [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon/tree/3b50c41a00928e4fc4397773e352a226eb287a17)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#165](https://github.com/openshift/network-metrics-daemon/pull/165)
* [OCPBUGS-77680](https://issues.redhat.com/browse/OCPBUGS-77680): Updating ose-network-metrics-daemon-container image to be consistent with ART for 4.22 [#142](https://github.com/openshift/network-metrics-daemon/pull/142)
* [OCPBUGS-101990](https://issues.redhat.com/browse/OCPBUGS-101990): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.3 [#149](https://github.com/openshift/network-metrics-daemon/pull/149)
* [Full changelog](https://github.com/openshift/network-metrics-daemon/compare/5b233ea1d80733c1b00c6bad65dec0620dbf783a...3b50c41a00928e4fc4397773e352a226eb287a17)
### [network-tools](https://github.com/openshift/network-tools/tree/a5e0ff51520d82081d8acf6a450441bafdfb68a4)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#194](https://github.com/openshift/network-tools/pull/194)
* [Full changelog](https://github.com/openshift/network-tools/compare/5c4b905c09ccd6edadb2ff359f45b70ed334f948...a5e0ff51520d82081d8acf6a450441bafdfb68a4)
### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/607429c46733c0a6a11f21a730fa3c09c2a8b00d)
* maintenance: Bump the npm group with 24 updates [#620](https://github.com/openshift/networking-console-plugin/pull/620)
* [OCPNETUI-187](https://issues.redhat.com/browse/OCPNETUI-187): Sync Dockerfile with Dockerfile.art [#618](https://github.com/openshift/networking-console-plugin/pull/618)
* maintenance: Bump the npm group with 20 updates [#596](https://github.com/openshift/networking-console-plugin/pull/596)
* [OCPNETUI-147](https://issues.redhat.com/browse/OCPNETUI-147): dependency cleanup [#591](https://github.com/openshift/networking-console-plugin/pull/591)
* [OCPNETUI-147](https://issues.redhat.com/browse/OCPNETUI-147): reassign dev and prod dependencies [#584](https://github.com/openshift/networking-console-plugin/pull/584)
* maintenance: Bump the npm group with 24 updates [#578](https://github.com/openshift/networking-console-plugin/pull/578)
* maintenance: Bump the npm group across 1 directory with 21 updates [#569](https://github.com/openshift/networking-console-plugin/pull/569)
* [OCPNETUI-147](https://issues.redhat.com/browse/OCPNETUI-147): Align shared modules with Console [#564](https://github.com/openshift/networking-console-plugin/pull/564)
* maintenance: Bump the npm group with 15 updates [#552](https://github.com/openshift/networking-console-plugin/pull/552)
* maintenance: Bump the npm group across 1 directory with 20 updates [#535](https://github.com/openshift/networking-console-plugin/pull/535)
* maintenance: Bump the npm group with 249 updates [#507](https://github.com/openshift/networking-console-plugin/pull/507)
* [OCPBUGS-82108](https://issues.redhat.com/browse/OCPBUGS-82108): Marked strings for i18n in NetworkPolicies list page [#475](https://github.com/openshift/networking-console-plugin/pull/475)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/93a0249eaee2099ea63819d8ca6f35b8f9d507a6...607429c46733c0a6a11f21a730fa3c09c2a8b00d)
### [nutanix-cloud-controller-manager](https://github.com/openshift/cloud-provider-nutanix/tree/8dca1edcdc6b58e8899d2a7054fea919bf6fba93)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#87](https://github.com/openshift/cloud-provider-nutanix/pull/87)
* [OCPBUGS-101973](https://issues.redhat.com/browse/OCPBUGS-101973): Bump golang.org/x/net to v0.58.0 to address CVE-2026-33814 [#73](https://github.com/openshift/cloud-provider-nutanix/pull/73)
* [Full changelog](https://github.com/openshift/cloud-provider-nutanix/compare/8e75679a965b80fee0332f8758471a7d3a75a4e8...8dca1edcdc6b58e8899d2a7054fea919bf6fba93)
### [nutanix-machine-controllers](https://github.com/openshift/machine-api-provider-nutanix/tree/0160e3ca390e80bc2c0807e25bbe640da5f3b56a)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#144](https://github.com/openshift/machine-api-provider-nutanix/pull/144)
* [Full changelog](https://github.com/openshift/machine-api-provider-nutanix/compare/60559fdd7092dd29aa1c72797c49279aa2da39ee...0160e3ca390e80bc2c0807e25bbe640da5f3b56a)
### [oauth-apiserver](https://github.com/openshift/oauth-apiserver/tree/e36e6e72537fc3359b6f384495d6aa50d406f201)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#238](https://github.com/openshift/oauth-apiserver/pull/238)
* [OCPBUGS-101982](https://issues.redhat.com/browse/OCPBUGS-101982): Replace golang.org/x/net with github.com/openshift-sustaining/net v0.50.0-sec.4 [#220](https://github.com/openshift/oauth-apiserver/pull/220)
* [OCPBUGS-109741](https://issues.redhat.com/browse/OCPBUGS-109741): Updating ose-oauth-apiserver-container image to be consistent with ART for 4.22 [#218](https://github.com/openshift/oauth-apiserver/pull/218)
* [OCPBUGS-114426](https://issues.redhat.com/browse/OCPBUGS-114426): Update build-machinery-go vendor dependency [#230](https://github.com/openshift/oauth-apiserver/pull/230)
* [Full changelog](https://github.com/openshift/oauth-apiserver/compare/4c002a9114937ea9c20213f00892761c2013e60b...e36e6e72537fc3359b6f384495d6aa50d406f201)
### [oauth-proxy](https://github.com/openshift/oauth-proxy/tree/e5c9617539d13ccbf8aff7df30a728c5b6dd3b07)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#393](https://github.com/openshift/oauth-proxy/pull/393)
* [OCPBUGS-112096](https://issues.redhat.com/browse/OCPBUGS-112096): bugfix: rewrite open redirect strings to '/' [#379](https://github.com/openshift/oauth-proxy/pull/379)
* [Full changelog](https://github.com/openshift/oauth-proxy/compare/367b72380a41025060d2372269d192cffb4167de...e5c9617539d13ccbf8aff7df30a728c5b6dd3b07)
### [oauth-server](https://github.com/openshift/oauth-server/tree/ab5a6a6c8b01e007c705cff7e9df016ff401685e)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#289](https://github.com/openshift/oauth-server/pull/289)
* [OCPBUGS-101994](https://issues.redhat.com/browse/OCPBUGS-101994): Bump golang.org/x/net to v0.53.0 [#285](https://github.com/openshift/oauth-server/pull/285)
* [OCPBUGS-92015](https://issues.redhat.com/browse/OCPBUGS-92015): bugfix: default to english when Accept-Language header contains more than 1000 underscores [#268](https://github.com/openshift/oauth-server/pull/268)
* [OCPBUGS-114426](https://issues.redhat.com/browse/OCPBUGS-114426): Update build-machinery-go vendor dependency [#263](https://github.com/openshift/oauth-server/pull/263)
* [OCPBUGS-100337](https://issues.redhat.com/browse/OCPBUGS-100337): Updating oauth-server-container image to be consistent with ART for 4.22 [#256](https://github.com/openshift/oauth-server/pull/256)
* [Full changelog](https://github.com/openshift/oauth-server/compare/42031614956a88806d0503cd619b49975ad61682...ab5a6a6c8b01e007c705cff7e9df016ff401685e)
### [oc-mirror](https://github.com/openshift/oc-mirror/tree/7860a5e7f0707a3d8d8729586e8313a41983008d)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#1587](https://github.com/openshift/oc-mirror/pull/1587)
* [OCPBUGS-129169](https://issues.redhat.com/browse/OCPBUGS-129169): v1 accept catalog root entries and relative symlink targets [#1574](https://github.com/openshift/oc-mirror/pull/1574)
* [OCPBUGS-92814](https://issues.redhat.com/browse/OCPBUGS-92814): v1/e2e: reduce helm download flakiness [#1455](https://github.com/openshift/oc-mirror/pull/1455)
* [OCPBUGS-90149](https://issues.redhat.com/browse/OCPBUGS-90149): fix(helm): tolerate v-prefix version mismatch in disk-to-mirror [#1448](https://github.com/openshift/oc-mirror/pull/1448)
* [OCPBUGS-105777](https://issues.redhat.com/browse/OCPBUGS-105777): fix for CVE-2026-39829 [#1501](https://github.com/openshift/oc-mirror/pull/1501)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/e46079438eb2edd26a6ee6c7c53bedecc557ba6c...7860a5e7f0707a3d8d8729586e8313a41983008d)
### [olm-catalogd, olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller/tree/8d8f2a537a054128a25c5755da0cfbcaee1e898a)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#822](https://github.com/openshift/operator-framework-operator-controller/pull/822)
* [OCPBUGS-102003](https://issues.redhat.com/browse/OCPBUGS-102003): [release-4.22] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#800](https://github.com/openshift/operator-framework-operator-controller/pull/800)
* [OCPBUGS-102011](https://issues.redhat.com/browse/OCPBUGS-102011): Bump golang.org/x/net to v0.53.0 to address CVE-2026-33814 [#793](https://github.com/openshift/operator-framework-operator-controller/pull/793)
* [Full changelog](https://github.com/openshift/operator-framework-operator-controller/compare/f80de29f7161d9bca6c92b89396f90fe60bd438f...8d8f2a537a054128a25c5755da0cfbcaee1e898a)
### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/3328a823ba35d5d00953f17e3951e2761dafcc77)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#693](https://github.com/openshift/openshift-apiserver/pull/693)
* [OCPBUGS-109742](https://issues.redhat.com/browse/OCPBUGS-109742): Updating ose-openshift-apiserver-container image to be consistent with ART for 4.22 [#675](https://github.com/openshift/openshift-apiserver/pull/675)
* [OCPBUGS-114426](https://issues.redhat.com/browse/OCPBUGS-114426): Update build-machinery-go vendor dependency [#685](https://github.com/openshift/openshift-apiserver/pull/685)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/7fa546d41a73b519e3af0e6428471c4aaf5c71e5...3328a823ba35d5d00953f17e3951e2761dafcc77)
### [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager/tree/f33af2098ca26cd602b452645e29e3072088e6cc)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#465](https://github.com/openshift/openshift-controller-manager/pull/465)
* [OCPBUGS-102001](https://issues.redhat.com/browse/OCPBUGS-102001): Bump golang.org/x/net to v0.53.0 [#461](https://github.com/openshift/openshift-controller-manager/pull/461)
* [Full changelog](https://github.com/openshift/openshift-controller-manager/compare/26d20feae8892f648f5b06ed3f5492fe6ffb4532...f33af2098ca26cd602b452645e29e3072088e6cc)
### [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics/tree/9ec0c2fb3c72a63ac7dea4f0b8c97f4456fe8315)
* NO-ISSUE: synchronize OWNERS from main branch [#147](https://github.com/openshift/openshift-state-metrics/pull/147)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#143](https://github.com/openshift/openshift-state-metrics/pull/143)
* [Full changelog](https://github.com/openshift/openshift-state-metrics/compare/e71e09969f11a47c87b87c43b762ad1d01f6b04f...9ec0c2fb3c72a63ac7dea4f0b8c97f4456fe8315)
### [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack/tree/9c3d6e76bbe9c5223c4a35c5f362d913f88754f3)
* [OCPBUGS-102013](https://issues.redhat.com/browse/OCPBUGS-102013): CVE-2026-33814- Replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 [release-4.22] [#434](https://github.com/openshift/cluster-api-provider-openstack/pull/434)
* : OCPBUGS-123142: Bump Go builder to 1.26 and protobuf to v1.36.12 [#449](https://github.com/openshift/cluster-api-provider-openstack/pull/449)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.14 into release-4.22 [#419](https://github.com/openshift/cluster-api-provider-openstack/pull/419)
* [Full changelog](https://github.com/openshift/cluster-api-provider-openstack/compare/06d95461581f9374ae05959b66fc50e2a17d077c...9c3d6e76bbe9c5223c4a35c5f362d913f88754f3)
### [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack/tree/7af853530308cf4ac80d1b751931d5d8f995cb7b)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#195](https://github.com/openshift/machine-api-provider-openstack/pull/195)
* [Full changelog](https://github.com/openshift/machine-api-provider-openstack/compare/74bd2dd2e7bc5b93e78b6b204012b6b7d981a4ba...7af853530308cf4ac80d1b751931d5d8f995cb7b)
### [openstack-resource-controller](https://github.com/openshift/openstack-resource-controller/tree/4772092495c2afdcaa4d363a5765c475f73199b0)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#49](https://github.com/openshift/openstack-resource-controller/pull/49)
* [OCPBUGS-101857](https://issues.redhat.com/browse/OCPBUGS-101857): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.50.0-sec.3 to address CVE-2026-33814 [#43](https://github.com/openshift/openstack-resource-controller/pull/43)
* [Full changelog](https://github.com/openshift/openstack-resource-controller/compare/cbea7a9cab145c32e2f347be69996b649893cc22...4772092495c2afdcaa4d363a5765c475f73199b0)
### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/6b4731534cf5e16d0742865ad2dac81a702f81ed)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#1392](https://github.com/openshift/operator-framework-olm/pull/1392)
* [OCPBUGS-101995](https://issues.redhat.com/browse/OCPBUGS-101995): Bump golang.org/x/net to v0.53.0 to address CVE-2026-33814 [#1362](https://github.com/openshift/operator-framework-olm/pull/1362)
* [OCPBUGS-95441](https://issues.redhat.com/browse/OCPBUGS-95441), [OCPBUGS-95458](https://issues.redhat.com/browse/OCPBUGS-95458): bumping containerd to v1.7.33 [#1353](https://github.com/openshift/operator-framework-olm/pull/1353)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/de6260e53055e10e216ec668d692a35554ab0585...6b4731534cf5e16d0742865ad2dac81a702f81ed)
### [operator-marketplace](https://github.com/operator-framework/operator-marketplace/tree/72634e0c85b8804ad31e7e008c35ea0fc0f9c6f0)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#801](https://github.com/operator-framework/operator-marketplace/pull/801)
* [Full changelog](https://github.com/operator-framework/operator-marketplace/compare/38da2ef78cc429f67aea7fb4e589df21ac1ed327...72634e0c85b8804ad31e7e008c35ea0fc0f9c6f0)
### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/1b05d926fc98aec3f9897488bcda59d7d7726789)
* [OCPBUGS-130567](https://issues.redhat.com/browse/OCPBUGS-130567): Add pperiyasamy to OWNERS for release-4.22 [#3527](https://github.com/openshift/ovn-kubernetes/pull/3527)
* [OCPBUGS-128906](https://issues.redhat.com/browse/OCPBUGS-128906): NO-JIRA: Branch Sync release-5.0 to release-4.22 [10-01-2026] [#3502](https://github.com/openshift/ovn-kubernetes/pull/3502)
* NO-JIRA: Branch Sync release-5.0 to release-4.22 [09-29-2026] [#3490](https://github.com/openshift/ovn-kubernetes/pull/3490)
* [OCPBUGS-128612](https://issues.redhat.com/browse/OCPBUGS-128612): Branch Sync release-5.0 to release-4.22 [09-25-2026] [#3476](https://github.com/openshift/ovn-kubernetes/pull/3476)
* [OCPBUGS-128244](https://issues.redhat.com/browse/OCPBUGS-128244): Branch Sync release-5.0 to release-4.22 [09-18-2026] [#3461](https://github.com/openshift/ovn-kubernetes/pull/3461)
* [OCPBUGS-112496](https://issues.redhat.com/browse/OCPBUGS-112496): NO-JIRA: Branch Sync main to release-4.22 [08-18-2026] [#3406](https://github.com/openshift/ovn-kubernetes/pull/3406)
* [OCPBUGS-99043](https://issues.redhat.com/browse/OCPBUGS-99043): Branch Sync main to release-4.22 [08-13-2026] [#3394](https://github.com/openshift/ovn-kubernetes/pull/3394)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/64072f688209e887423e716951d621ae33580860...1b05d926fc98aec3f9897488bcda59d7d7726789)
### [powervs-block-csi-driver](https://github.com/openshift/ibm-powervs-block-csi-driver/tree/19728342560de1cb83467f2ae1b1d3d274a8d5f8)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#149](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/149)
* [OCPBUGS-101580](https://issues.redhat.com/browse/OCPBUGS-101580), [OCPBUGS-102012](https://issues.redhat.com/browse/OCPBUGS-102012), [OCPBUGS-93554](https://issues.redhat.com/browse/OCPBUGS-93554), [OCPBUGS-95566](https://issues.redhat.com/browse/OCPBUGS-95566), [OCPBUGS-96671](https://issues.redhat.com/browse/OCPBUGS-96671), [OCPBUGS-98019](https://issues.redhat.com/browse/OCPBUGS-98019): Fix CVE-2026-39828, 46597, 39835, 27136, 2502 and 33814 [#142](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/142)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver/compare/02959a8d7096501e240d1d9f65da90b87bac45b9...19728342560de1cb83467f2ae1b1d3d274a8d5f8)
### [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/tree/8134ea30e28819f1e24bbb546f1c95733313f03a)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#129](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/129)
* [OCPBUGS-101993](https://issues.redhat.com/browse/OCPBUGS-101993): Mitigate CVE-2026-33814 by bumping golang.org/x/net to v0.57.0 [#121](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/121)
* [OCPBUGS-107713](https://issues.redhat.com/browse/OCPBUGS-107713): Mitigate CVE-2026-41178 by bumping go.opentelemetry.io/otel/sdk to v1.44.0 [#120](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/120)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/compare/277478211cfc7302e9c09b41a0935fbba678614a...8134ea30e28819f1e24bbb546f1c95733313f03a)
### [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs/tree/f0ee901cecc86da0668e1ac8ed4b9e098cd7d7df)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#123](https://github.com/openshift/cloud-provider-powervs/pull/123)
* [OCPBUGS-102007](https://issues.redhat.com/browse/OCPBUGS-102007), [OCPBUGS-107718](https://issues.redhat.com/browse/OCPBUGS-107718): Bump x/net and otel to address CVEs [#115](https://github.com/openshift/cloud-provider-powervs/pull/115)
* [Full changelog](https://github.com/openshift/cloud-provider-powervs/compare/766c0952fd19f8225fe59b2be8e8c8932b24ebd7...f0ee901cecc86da0668e1ac8ed4b9e098cd7d7df)
### [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs/tree/de7331f07e4b1619a0412661b9b199ce65b84c98)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#163](https://github.com/openshift/machine-api-provider-powervs/pull/163)
* [Full changelog](https://github.com/openshift/machine-api-provider-powervs/compare/e88cf81dd9ad174f395b86f9cdc40fa30cb06bf4...de7331f07e4b1619a0412661b9b199ce65b84c98)
### [prom-label-proxy](https://github.com/openshift/prom-label-proxy/tree/1251483937e089dd6b50871308a9f55e33258e30)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#416](https://github.com/openshift/prom-label-proxy/pull/416)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.22] [#413](https://github.com/openshift/prom-label-proxy/pull/413)
* [Full changelog](https://github.com/openshift/prom-label-proxy/compare/c4c99a3071808f466ee6c3d7b7fa87108b457feb...1251483937e089dd6b50871308a9f55e33258e30)
### [prometheus](https://github.com/openshift/prometheus/tree/e364d72f2aa068792c1fdf5473d80c49d67d9137)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#400](https://github.com/openshift/prometheus/pull/400)
* [OCPBUGS-107716](https://issues.redhat.com/browse/OCPBUGS-107716): Bump go.opentelemetry.io/otel to fix CVE-2026-41178 [#396](https://github.com/openshift/prometheus/pull/396)
* NO-ISSUE: synchronize OWNERS from main branch [#391](https://github.com/openshift/prometheus/pull/391)
* [OCPBUGS-93732](https://issues.redhat.com/browse/OCPBUGS-93732): fix for CVE-2026-42151 [#355](https://github.com/openshift/prometheus/pull/355)
* [Full changelog](https://github.com/openshift/prometheus/compare/13ce9de4694ded595ef1455dd836ba4033fed0ea...e364d72f2aa068792c1fdf5473d80c49d67d9137)
### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/08b9320a09acf74ed3d558d6fe47232281c29b4b)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#202](https://github.com/openshift/prometheus-alertmanager/pull/202)
* NO-JIRA: synchronize OWNERS with main [#198](https://github.com/openshift/prometheus-alertmanager/pull/198)
* [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/f090d1413836ce12c0a2f70f862de5787dfe59d0...08b9320a09acf74ed3d558d6fe47232281c29b4b)
### [prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator/tree/451ae0aacec8c684cde78353b5ec7d68f12cb8d0)
* NO-ISSUE: synchronize OWNERS from main branch [#415](https://github.com/openshift/prometheus-operator/pull/415)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#409](https://github.com/openshift/prometheus-operator/pull/409)
* [OCPBUGS-102017](https://issues.redhat.com/browse/OCPBUGS-102017), [OCPBUGS-102031](https://issues.redhat.com/browse/OCPBUGS-102031): [release-4.22] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#398](https://github.com/openshift/prometheus-operator/pull/398)
* [Full changelog](https://github.com/openshift/prometheus-operator/compare/70e38466b9b9143f48283dab8bd0c227f35efe69...451ae0aacec8c684cde78353b5ec7d68f12cb8d0)
### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/303c0e9e123664075aae798c1f8741281ae90979)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#222](https://github.com/openshift/node_exporter/pull/222)
* [OCPBUGS-102026](https://issues.redhat.com/browse/OCPBUGS-102026): Bump golang.org/x/net to v0.53.0 [#198](https://github.com/openshift/node_exporter/pull/198)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.22] [#200](https://github.com/openshift/node_exporter/pull/200)
* [Full changelog](https://github.com/openshift/node_exporter/compare/6c4fc0126407c8404b8604faa2f1230f385b9f44...303c0e9e123664075aae798c1f8741281ae90979)
### [route-controller-manager](https://github.com/openshift/route-controller-manager/tree/c2021f0df34b60ddbfb51bc64aae5ee01ca8cbc9)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#115](https://github.com/openshift/route-controller-manager/pull/115)
* [Full changelog](https://github.com/openshift/route-controller-manager/compare/55f77ca4cf0328b7c4fd7736bce79ebe171a9b6b...c2021f0df34b60ddbfb51bc64aae5ee01ca8cbc9)
### [service-ca-operator](https://github.com/openshift/service-ca-operator/tree/4ece83101d3f1422273979aaa7d15bc225530b7a)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#382](https://github.com/openshift/service-ca-operator/pull/382)
* [OCPBUGS-114426](https://issues.redhat.com/browse/OCPBUGS-114426): Update build-machinery-go vendor dependency [#377](https://github.com/openshift/service-ca-operator/pull/377)
* [Full changelog](https://github.com/openshift/service-ca-operator/compare/9fff46a576033685f66fbb1121eb0a2f134a29be...4ece83101d3f1422273979aaa7d15bc225530b7a)
### [telemeter](https://github.com/openshift/telemeter/tree/46a5233acd712212c9a8e34c5e8cbcf53a3974e8)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#631](https://github.com/openshift/telemeter/pull/631)
* Fix OCPBUGS-107725: CVE-2026-41178 [#613](https://github.com/openshift/telemeter/pull/613)
* [Full changelog](https://github.com/openshift/telemeter/compare/c2ffb0a7035e504a4ddc7292e4d12b7490eab0d4...46a5233acd712212c9a8e34c5e8cbcf53a3974e8)
### [tests](https://github.com/openshift/origin/tree/e442b8cf58f6b5f540538c99c5bb9a69488377be)
* [OCPBUGS-84695](https://issues.redhat.com/browse/OCPBUGS-84695): [TNF] Fix update-setup job discovery to limit check to active job [#31467](https://github.com/openshift/origin/pull/31467)
* [OCPBUGS-130609](https://issues.redhat.com/browse/OCPBUGS-130609): Fix pathological events [#31733](https://github.com/openshift/origin/pull/31733)
* [OCPBUGS-85827](https://issues.redhat.com/browse/OCPBUGS-85827): fix tnf monitor tests [#31184](https://github.com/openshift/origin/pull/31184)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#31753](https://github.com/openshift/origin/pull/31753)
* [OCPBUGS-129079](https://issues.redhat.com/browse/OCPBUGS-129079): Skip Squid proxy configuration [#31702](https://github.com/openshift/origin/pull/31702)
* [OCPBUGS-130606](https://issues.redhat.com/browse/OCPBUGS-130606): Remove NLB hairpin workaround from dual-stack test [#31752](https://github.com/openshift/origin/pull/31752)
* [OCPBUGS-131805](https://issues.redhat.com/browse/OCPBUGS-131805): pathologicalevents: fix HPA FailedGetResourceMetric allowlist [#31760](https://github.com/openshift/origin/pull/31760)
* [OCPBUGS-130353](https://issues.redhat.com/browse/OCPBUGS-130353): Stabilize TNF kernel-panic recovery test [#31736](https://github.com/openshift/origin/pull/31736)
* [OCPBUGS-129174](https://issues.redhat.com/browse/OCPBUGS-129174): Improve TNF recovery test stability: AfterEach cleanup, migration-threshold, east-west fixes [#31707](https://github.com/openshift/origin/pull/31707)
* [OCPBUGS-128819](https://issues.redhat.com/browse/OCPBUGS-128819): Make operator log scraper and monitor tests topology-aware [#31695](https://github.com/openshift/origin/pull/31695)
* [OCPBUGS-130852](https://issues.redhat.com/browse/OCPBUGS-130852): stage the creation of test pods to minimize etcd impact [#31738](https://github.com/openshift/origin/pull/31738)
* [AGENT-1522](https://issues.redhat.com/browse/AGENT-1522): bump InternalReleaseImage to v1 [#31687](https://github.com/openshift/origin/pull/31687)
* [OCPBUGS-120717](https://issues.redhat.com/browse/OCPBUGS-120717): Extend image-registry single replica exception to s390x architecture [#31422](https://github.com/openshift/origin/pull/31422)
* [OCPBUGS-115199](https://issues.redhat.com/browse/OCPBUGS-115199): fix: skip MCPs with non-ready nodes during MCN property validation [#31525](https://github.com/openshift/origin/pull/31525)
* [OCPBUGS-114438](https://issues.redhat.com/browse/OCPBUGS-114438): Fix probe termination test to use pod status instead of kubelet event text [#31568](https://github.com/openshift/origin/pull/31568)
* [OCPBUGS-115161](https://issues.redhat.com/browse/OCPBUGS-115161): Raise status polling timeout and write bound [#31582](https://github.com/openshift/origin/pull/31582)
* [OCPBUGS-115191](https://issues.redhat.com/browse/OCPBUGS-115191): fix: adjusting DaemonSet test to dynamically compute expected pod count [#31522](https://github.com/openshift/origin/pull/31522)
* [AGENT-1583](https://issues.redhat.com/browse/AGENT-1583): post-feature promotion (NoRegistryClusterInstall) openshift/api dependencies bump [#31565](https://github.com/openshift/origin/pull/31565)
* [OCPBUGS-111831](https://issues.redhat.com/browse/OCPBUGS-111831): tolerate one NotReady CP node in EnsureNodesReady for degraded TNF [#31527](https://github.com/openshift/origin/pull/31527)
* [OCPBUGS-100438](https://issues.redhat.com/browse/OCPBUGS-100438): retry GetVotingMemberNames on transient etcd client fails [#31506](https://github.com/openshift/origin/pull/31506)
* [Full changelog](https://github.com/openshift/origin/compare/4151956d13674fc7149514a063e1a5596e51caf0...e442b8cf58f6b5f540538c99c5bb9a69488377be)
### [thanos](https://github.com/openshift/thanos/tree/807e887ed19c9e059bb5ce09e06f6ff3f3902ed1)
* [OCPBUGS-129058](https://issues.redhat.com/browse/OCPBUGS-129058): Bump github.com/klauspost/compress to fix CVE-2026-63209 [#228](https://github.com/openshift/thanos/pull/228)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#222](https://github.com/openshift/thanos/pull/222)
* fix for OCPBUGS-107709: CVE-2026-41178 [#202](https://github.com/openshift/thanos/pull/202)
* [Full changelog](https://github.com/openshift/thanos/compare/f66e2964942983bf9ed4eb2c969046ce7ef14b91...807e887ed19c9e059bb5ce09e06f6ff3f3902ed1)
### [volume-data-source-validator](https://github.com/openshift/volume-data-source-validator/tree/5c71875a3abb6926be8ae3489171a5e14b734ed8)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#25](https://github.com/openshift/volume-data-source-validator/pull/25)
* [OCPBUGS-102040](https://issues.redhat.com/browse/OCPBUGS-102040): Bump golang.org/x/net to version 0.57.0 that fixes CVE-2026-33814 [#19](https://github.com/openshift/volume-data-source-validator/pull/19)
* [Full changelog](https://github.com/openshift/volume-data-source-validator/compare/8e176cec394709cac728423cbbb6c3c914be8485...5c71875a3abb6926be8ae3489171a5e14b734ed8)
### [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere/tree/8a957ee21816eeae84f4bd479f9b962101b23d69)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#142](https://github.com/openshift/cloud-provider-vsphere/pull/142)
* [OCPBUGS-102043](https://issues.redhat.com/browse/OCPBUGS-102043): Bump golang.org/x/net to v0.53.0 in 4.22 [#131](https://github.com/openshift/cloud-provider-vsphere/pull/131)
* [Full changelog](https://github.com/openshift/cloud-provider-vsphere/compare/39008107b1463e3299b0d60c3ac1f7e71ad3e014...8a957ee21816eeae84f4bd479f9b962101b23d69)
### [vsphere-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-vsphere/tree/cc78ca43c14dcb3616c594fc0b92833a8252e4a5)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go builder to 1.26 and protobuf to v1.36.12 [#130](https://github.com/openshift/cluster-api-provider-vsphere/pull/130)
* [OCPBUGS-102045](https://issues.redhat.com/browse/OCPBUGS-102045): Bump golang.org/x/net to v0.53.0 for CVE-2026-33814 [release-4.22] [#128](https://github.com/openshift/cluster-api-provider-vsphere/pull/128)
* [Full changelog](https://github.com/openshift/cluster-api-provider-vsphere/compare/ac542b5afbd9a3897cda34e7ea1852b61c945e36...cc78ca43c14dcb3616c594fc0b92833a8252e4a5)
### [vsphere-csi-driver, vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver/tree/a267a1b211756adc590add702ce90e608fb314ea)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#222](https://github.com/openshift/vmware-vsphere-csi-driver/pull/222)
* UPSTREAM: 187: OCPBUGS-96686: Bump golang.org/x/net to v0.50.0-sec.4 [#195](https://github.com/openshift/vmware-vsphere-csi-driver/pull/195)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver/compare/8c37254f86801197707a3f8ef0e8b077f2e8dd5a...a267a1b211756adc590add702ce90e608fb314ea)
### [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator/tree/55bf9e8ab6849212e5ebbdd996f1e0e66d05b2eb)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#372](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/372)
* [OCPBUGS-102036](https://issues.redhat.com/browse/OCPBUGS-102036): Bump golang.org/x/net to v0.53.0 [#352](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/352)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver-operator/compare/9be965742961e7a84b0af8ff5ea17a852e015c98...55bf9e8ab6849212e5ebbdd996f1e0e66d05b2eb)
### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/af9bd56a4e5a0f336ac78c62d206fde7b8227159)
* [OCPBUGS-123142](https://issues.redhat.com/browse/OCPBUGS-123142): Bump Go to 1.26 and protobuf to v1.36.12 [#250](https://github.com/openshift/vsphere-problem-detector/pull/250)
* [OCPBUGS-105280](https://issues.redhat.com/browse/OCPBUGS-105280): Fixed GetVCenter to handle removed FDs better [#228](https://github.com/openshift/vsphere-problem-detector/pull/228)
* [OCPBUGS-102050](https://issues.redhat.com/browse/OCPBUGS-102050): Bump golang.org/x/net to 0.53.0 [#229](https://github.com/openshift/vsphere-problem-detector/pull/229)
* [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/438d5aad88be4f7d9237d87ed70589e1ebaf18f8...af9bd56a4e5a0f336ac78c62d206fde7b8227159)