# 5.0.0-ec.3
Created: 2026-06-12 13:10:47 +0000 UTC
Image Digest: `sha256:b5ad6b4bb5efbd9b9d88bd42182e85388742b4441a2ff4301c4f5aa8176d5d29`
## Changes from 5.0.0-ec.0
### Components
* Kubectl upgraded from 1.34.1 to 1.35.2
* Kubernetes upgraded from 1.35.2 to 1.35.3
* Kubernetes Tests upgraded from 1.34.1 to 1.35.1
* Red Hat Enterprise Linux CoreOS 10.2 upgraded from 9.8.20260314-0 to 10.2.20260521-0
### FeatureGate Changes
| FeatureGate | Default
Hypershift | Default
SelfManagedHA | DevPreviewNoUpgrade
Hypershift | DevPreviewNoUpgrade
SelfManagedHA | OKD
Hypershift | OKD
SelfManagedHA | TechPreviewNoUpgrade
Hypershift | TechPreviewNoUpgrade
SelfManagedHA |
| :------ | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: |
| ConsolePluginContentSecurityPolicy
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| DRAPartitionableDevices
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| GCPClusterHostedDNS
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| GCPClusterHostedDNSInstall
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| HighlyAvailableArbiter
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| KMSEncryptionProvider
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| UserNamespacesPodSecurityStandards
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| UserNamespacesSupport
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| AzureClusterHostedDNSInstall
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| DualReplica
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| EVPN
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| EventTTL
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| GatewayAPIWithoutOLM
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| MutatingAdmissionPolicy
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| VSphereHostVMGroupZonal
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| NewOLMOwnSingleNamespace
(0 tests)| Disabled| Disabled
(Changed)| Disabled| Enabled| Disabled| Disabled
(Changed)| Disabled| Enabled |
| ConfidentialCluster
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | | |
| MutableTopology
(0 tests)| | | | Enabled
(New)| | | | |
| NetworkObservabilityInstall
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| NewOLMConfigAPI
(0 tests)| | | | Enabled
(New)| | | | Enabled
(New) |
| NoOverlayMode
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| OLMLifecycleAndCompatibility
(0 tests)| | | | Enabled
(New)| | | | Enabled
(New) |
| TLSAdherence
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| TLSGroupPreferences
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| VSphereMultiVCenterDay2
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | | |
### New images
* [aws-node-termination-handler](https://github.com/openshift/aws-node-termination-handler) git [e4ff2aae](https://github.com/openshift/aws-node-termination-handler/commit/e4ff2aaec292db42de9f3eef4908ba1c421a2a6c) `sha256:a95bb8906b9cf1a3026e047a4dc64c37302957068f9ff6817c5adf37c2c3b9bb`
### Removed images
* cluster-kube-cluster-api-operator
### Rebuilt images without code change
* [aws-karpenter-provider-aws](https://github.com/openshift/aws-karpenter-provider-aws) git [f0be9c72](https://github.com/openshift/aws-karpenter-provider-aws/commit/f0be9c72e5bf25caeb2ca45c14e67e4d397a52cb) `sha256:37639ca24f231ad9e19a37db4f0816aeeadaa890a22f66774673155983953023`
* [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook) git [82088287](https://github.com/openshift/aws-pod-identity-webhook/commit/8208828799b6c4f91fd9b80128668f7765599e84) `sha256:e089b66504705e36489d5b2d3ef8efcdc0c83148353c82d8519eadaf526481b1`
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [3b5c59cc](https://github.com/openshift/cluster-update-keys/commit/3b5c59cc6461663751bc510b4f9f1954ed8c9b50) `sha256:e71e38d4e6a42c2f05d7707c8828bdfbd566e62609d7c0cad120c838610b806f`
* [configmap-reloader](https://github.com/openshift/configmap-reload) git [94e41c4c](https://github.com/openshift/configmap-reload/commit/94e41c4c6a5832dfd19750173d6544784ba235ec) `sha256:cd92fe9b3ceac8518c7611af0364ceef65c8e6cb7564a0f7d481fe434a03de30`
* [csi-external-attacher](https://github.com/openshift/csi-external-attacher) git [98b1f4ac](https://github.com/openshift/csi-external-attacher/commit/98b1f4acf9c004687ef55e9f187703768933bb56) `sha256:5d02fc6f03646dd04044132ec61e2955e177e47a62ef70968106fdde051ee51f`
* [csi-external-resizer](https://github.com/openshift/csi-external-resizer) git [4e74a4aa](https://github.com/openshift/csi-external-resizer/commit/4e74a4aa52a2046d6b97a47dff7a60ddb73d0bbd) `sha256:85a22e8ee60a190de3a259d449810135e067c12d16af2f042c730cfaee8523ab`
* [csi-external-snapshot-metadata](https://github.com/openshift/csi-external-snapshot-metadata) git [76523185](https://github.com/openshift/csi-external-snapshot-metadata/commit/7652318579a38838931a5be492cee3573c7c8ecf) `sha256:43357a55afac865e2dd7655441963f464f294520fac0a06e543021bc36fa010d`
* [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe) git [4d5e959a](https://github.com/openshift/csi-livenessprobe/commit/4d5e959a182b4db70dc52302bd89eebfec40d5a5) `sha256:a26e1c193607787c136af6e183bbe810bda8e74762e18675c067860994f64244`
* [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar) git [cf174b30](https://github.com/openshift/csi-node-driver-registrar/commit/cf174b30fad107d354afb0f0b09030a7c97fd296) `sha256:9183a1a1c51c99a82f7aff98c5be09e047e35108b94253f81e2b7056aa9bbe76`
* [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook) git [d7675f31](https://github.com/openshift/gcp-workload-identity-federation-webhook/commit/d7675f312ffdc8501032ff8217776cd7172b6bb0) `sha256:83103d96320ec8e0d619dd4aee7bd03a5c3ae042b3b2ae25953a14193aa3ae42`
* [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [9953d2b7](https://github.com/openshift/ironic-rhcos-downloader/commit/9953d2b77da077c28f9486a5d965a43149ce30c1) `sha256:748d0824a48328d7179dcdeea7ba71081aa5787f447e3fdf56f6cab333a97d40`
* [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager) git [a379d09f](https://github.com/openshift/ironic-static-ip-manager/commit/a379d09f228d93f2beab1c73d67764c64b21e3cb) `sha256:5600190a72577f90b2a21514a24828c10bae802da9a52749f60b0f71f5e9cdfa`
* [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server) git [38c16c46](https://github.com/openshift/kubernetes-metrics-server/commit/38c16c4698d131ab0e2da0d4b4b76d5322a89bab) `sha256:af68ac68e816af2f7899f05b8f69d7133f3b466bfce79f21a67034d6fc2865a3`
* [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator) git [72835e43](https://github.com/openshift/kubernetes-kube-storage-version-migrator/commit/72835e43c7754356645e41031f3a99926b4d42e6) `sha256:673d3ed71d1266b2a802d9f1c565e0af0c3b945aa270bca6de5516f549c53ae2`
* [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt) git [76dd5a6f](https://github.com/openshift/cloud-provider-kubevirt/commit/76dd5a6fa9e86573bf3dfb79be17edf832e3bae1) `sha256:1779e2e7da891eacb4f2f6930b7a3ef27b5ec3fbdb5a63a953f23e50439adc6e`
* [multus-route-override-cni](https://github.com/openshift/route-override-cni) git [08af4127](https://github.com/openshift/route-override-cni/commit/08af4127c77976510cad1c096d9aca977d8ae5af) `sha256:42a6b1a776688687cfbb8da32b20614143967a8c435ccde81be44d5a811c3bb4`
* [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni) git [d691040e](https://github.com/openshift/whereabouts-cni/commit/d691040e509bb20c26b5e8366c0d6f3bb45a5e02) `sha256:b654e2ad86dafbfca7ce09a8c89715e79fee5795155324cfbf49e0807784a7fa`
* [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon) git [5b233ea1](https://github.com/openshift/network-metrics-daemon/commit/5b233ea1d80733c1b00c6bad65dec0620dbf783a) `sha256:f6bfa7b3923faca81957a82c9bc1a1d765ec2884b80a7530115aae54f8bbb813`
* [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics) git [e71e0996](https://github.com/openshift/openshift-state-metrics/commit/e71e09969f11a47c87b87c43b762ad1d01f6b04f) `sha256:6f093aa1d2284a84a0745ed3cc397b7c19eba69ba022ca7d15f0a2bf32663bdb`
* [volume-data-source-validator](https://github.com/openshift/volume-data-source-validator) git [8e176cec](https://github.com/openshift/volume-data-source-validator/commit/8e176cec394709cac728423cbbb6c3c914be8485) `sha256:fca70775354f9ee1aa2c8bc186a64b1ff95e0cbff06854d1e66dee1abac098d1`
### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/6676a6d8755afa66a2fb0c8b23bc79417196e469)
* NO-ISSUE: [master] Bump OCP versions: 4.18, 4.22, 4.20, 4.13 [#10436](https://github.com/openshift/assisted-service/pull/10436)
* [MGMT-22787](https://issues.redhat.com/browse/MGMT-22787): Add enhancement doc to limit inventory size [#10410](https://github.com/openshift/assisted-service/pull/10410)
* NO-ISSUE: [master] Bump OCP versions: 4.22, 4.21 [#10427](https://github.com/openshift/assisted-service/pull/10427)
* [MGMT-24397](https://issues.redhat.com/browse/MGMT-24397): Add OCP test version builder & PoC [#10321](https://github.com/openshift/assisted-service/pull/10321)
* [MGMT-23738](https://issues.redhat.com/browse/MGMT-23738): Flaky test: "Move Agent to another infraenv" fails with Kubernetes conflict error [#10319](https://github.com/openshift/assisted-service/pull/10319)
* NO-ISSUE: [master] Bump OCP versions: 4.16 [#10423](https://github.com/openshift/assisted-service/pull/10423)
* [MGMT-19732](https://issues.redhat.com/browse/MGMT-19732): Add ntp_sources field for exclusive NTP configuration [#10408](https://github.com/openshift/assisted-service/pull/10408)
* [MGMT-22370](https://issues.redhat.com/browse/MGMT-22370): Add exponential backoff to agent image pull [#10337](https://github.com/openshift/assisted-service/pull/10337)
* [MGMT-24243](https://issues.redhat.com/browse/MGMT-24243): Add option for a delay when applying static network config on minimal ISO [#10373](https://github.com/openshift/assisted-service/pull/10373)
* NO-ISSUE: [master] Bump OCP versions: 4.19, 4.22 [#10402](https://github.com/openshift/assisted-service/pull/10402)
* NO-ISSUE: add Assisted-by commit trailer convention to CLAUDE.md [#10400](https://github.com/openshift/assisted-service/pull/10400)
* NO-ISSUE: [master] Bump OCP versions: 4.21, 5.0 [#10392](https://github.com/openshift/assisted-service/pull/10392)
* [MGMT-21836](https://issues.redhat.com/browse/MGMT-21836): Allow external platform with non-standard HA control plane [#10286](https://github.com/openshift/assisted-service/pull/10286)
* [MGMT-23230](https://issues.redhat.com/browse/MGMT-23230): Add MachineConfig for AMD GPU kernel module blacklist [#9920](https://github.com/openshift/assisted-service/pull/9920)
* [MGMT-24457](https://issues.redhat.com/browse/MGMT-24457): Add MI350P PCI device IDs to NFD NodeFeatureRule [#10388](https://github.com/openshift/assisted-service/pull/10388)
* [MGMT-24393](https://issues.redhat.com/browse/MGMT-24393): Assisted Service IPv6 checks fails comparative [#10340](https://github.com/openshift/assisted-service/pull/10340)
* NO-ISSUE: [master] Bump OCP versions: 4.17, 4.20, 4.18 [#10383](https://github.com/openshift/assisted-service/pull/10383)
* NO-ISSUE: [master] Bump OCP versions: 4.21, 4.22 [#10348](https://github.com/openshift/assisted-service/pull/10348)
* NO-ISSUE: Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26 [#10354](https://github.com/openshift/assisted-service/pull/10354)
* NO-ISSUE: Fix resource leak and inconsistency in manifest download [#10322](https://github.com/openshift/assisted-service/pull/10322)
* [MGMT-21834](https://issues.redhat.com/browse/MGMT-21834): deprecate supported-platforms endpoint [#10122](https://github.com/openshift/assisted-service/pull/10122)
* NO-ISSUE: [master] Bump OCP versions: 4.14, 4.19, 4.18, 4.21, 4.20, 4.16 [#10342](https://github.com/openshift/assisted-service/pull/10342)
* NO-ISSUE: fix typo: 'occured' -> 'occurred' in main.go error wraps [#10316](https://github.com/openshift/assisted-service/pull/10316)
* NO-ISSUE: increase the timout waiting for assisted-image-service [#10327](https://github.com/openshift/assisted-service/pull/10327)
* [MGMT-20634](https://issues.redhat.com/browse/MGMT-20634): Revert mac-identifier and global DNS workarounds as RHEL-91250 and RHEL-72440 resolved [#10318](https://github.com/openshift/assisted-service/pull/10318)
* [ACM-33836](https://issues.redhat.com/browse/ACM-33836): CVE-2026-35469 bump github.com/moby/spdystream [#10314](https://github.com/openshift/assisted-service/pull/10314)
* NO-ISSUE: [master] Bump OCP versions: 4.22, 4.13, 4.16, 4.17 [#10296](https://github.com/openshift/assisted-service/pull/10296)
* NO-ISSUE: [master] Bump OCP versions: 4.21, 4.20, 4.18, 4.19 [#10287](https://github.com/openshift/assisted-service/pull/10287)
* [MGMT-19930](https://issues.redhat.com/browse/MGMT-19930): upgrade PostgreSQL stack to pgx v5 and ocm-sdk-go v0.1.499 [#10230](https://github.com/openshift/assisted-service/pull/10230)
* NO-ISSUE: [master] Bump OCP versions: 4.21 [#10284](https://github.com/openshift/assisted-service/pull/10284)
* [MGMT-24236](https://issues.redhat.com/browse/MGMT-24236): Exclude post-installation hosts from pending-user-action timeout [#10266](https://github.com/openshift/assisted-service/pull/10266)
* [MGMT-24138](https://issues.redhat.com/browse/MGMT-24138): Order network by bootstrap host [#10257](https://github.com/openshift/assisted-service/pull/10257)
* NO-ISSUE: Remove unused RegisterAddHostsOCPCluster functions [#10265](https://github.com/openshift/assisted-service/pull/10265)
* NO-ISSUE: [master] Bump OCP versions: 4.16, 5.0, 4.22 [#10272](https://github.com/openshift/assisted-service/pull/10272)
* [MGMT-24119](https://issues.redhat.com/browse/MGMT-24119): Correct the namespace to install Loki Operator as "openshift-operators-redhat" instead of "openshift-loki" [#10209](https://github.com/openshift/assisted-service/pull/10209)
* [MGMT-23755](https://issues.redhat.com/browse/MGMT-23755): Validate & trim MCS certificates when adding to ignition override [#10262](https://github.com/openshift/assisted-service/pull/10262)
* NO-ISSUE: [master] Bump OCP versions: 4.21, 4.19 [#10263](https://github.com/openshift/assisted-service/pull/10263)
* [MGMT-23680](https://issues.redhat.com/browse/MGMT-23680): CVE-2026-32285 Bump github.com/buger/jsonparser to v1.1.2 [#10240](https://github.com/openshift/assisted-service/pull/10240)
* NO-ISSUE: Update operator bundle channel to backplane-5.0 [#10215](https://github.com/openshift/assisted-service/pull/10215)
* [MGMT-24115](https://issues.redhat.com/browse/MGMT-24115): allow empty image checksum/url in getChecksumAndURL [#10246](https://github.com/openshift/assisted-service/pull/10246)
* [MGMT-23971](https://issues.redhat.com/browse/MGMT-23971): Add a timeout for installing-pending-user-action [#10202](https://github.com/openshift/assisted-service/pull/10202)
* NO-ISSUE: Modify Konflux YAMLs to backplane-5.0 [#10237](https://github.com/openshift/assisted-service/pull/10237)
* [MGMT-23802](https://issues.redhat.com/browse/MGMT-23802): Fix manifest format in log bundles [#10121](https://github.com/openshift/assisted-service/pull/10121)
* [MGMT-23861](https://issues.redhat.com/browse/MGMT-23861): Fix oci detection for day2 clusters [#10231](https://github.com/openshift/assisted-service/pull/10231)
* NO-ISSUE: [master] Bump OCP versions: 4.22 [#10220](https://github.com/openshift/assisted-service/pull/10220)
* [ACM-33186](https://issues.redhat.com/browse/ACM-33186): Revert Renovate configuration for Hive updates [#10203](https://github.com/openshift/assisted-service/pull/10203)
* [MGMT-23553](https://issues.redhat.com/browse/MGMT-23553): Automate events table bloat cleanup [#10140](https://github.com/openshift/assisted-service/pull/10140)
* [MGMT-23665](https://issues.redhat.com/browse/MGMT-23665): fixing CVE-2026-33186 [#10173](https://github.com/openshift/assisted-service/pull/10173)
* NO-ISSUE: Allow restoring soft deleted hosts [#10185](https://github.com/openshift/assisted-service/pull/10185)
* NO-ISSUE: [master] Bump OCP versions: 4.20, 4.21, 4.22, 4.18 [#10201](https://github.com/openshift/assisted-service/pull/10201)
* NO-ISSUE: Bump go modules and linters [#10181](https://github.com/openshift/assisted-service/pull/10181)
* [MGMT-23861](https://issues.redhat.com/browse/MGMT-23861): Revert MGMT-22385 for oci iscsi day2 [#10170](https://github.com/openshift/assisted-service/pull/10170)
* [ACM-32996](https://issues.redhat.com/browse/ACM-32996): Missing nil check in BMACReconciler causes controller panic [#10164](https://github.com/openshift/assisted-service/pull/10164)
* [MGMT-23920](https://issues.redhat.com/browse/MGMT-23920): 4.22 SNO doesn't support 4 cpu cores node [#10153](https://github.com/openshift/assisted-service/pull/10153)
* NO-ISSUE: add shay23bra to owners [#10163](https://github.com/openshift/assisted-service/pull/10163)
* NO-ISSUE: [master] Bump OCP versions: 4.13, 4.19 [#10162](https://github.com/openshift/assisted-service/pull/10162)
* NO-ISSUE: Remove urlAuth from credentials endpoint [#10161](https://github.com/openshift/assisted-service/pull/10161)
* [MCO-2223](https://issues.redhat.com/browse/MCO-2223): Add osImageStream install-config overrides [#10156](https://github.com/openshift/assisted-service/pull/10156)
* NO-ISSUE: [master] Bump OCP versions: 4.21 [#10152](https://github.com/openshift/assisted-service/pull/10152)
* NO-ISSUE: [master] Bump OCP versions: 4.22, 4.18, 4.20 [#10146](https://github.com/openshift/assisted-service/pull/10146)
* [OCPBUGS-79576](https://issues.redhat.com/browse/OCPBUGS-79576): Mark raw FC/iSCSI multipath members as ineligible [#10142](https://github.com/openshift/assisted-service/pull/10142)
* [OCPBUGS-83401](https://issues.redhat.com/browse/OCPBUGS-83401): Fix IRI patcher feature check [#10141](https://github.com/openshift/assisted-service/pull/10141)
* [MGMT-23227](https://issues.redhat.com/browse/MGMT-23227): Skip host operator validation for day2 clusters [#10029](https://github.com/openshift/assisted-service/pull/10029)
* [ACM-32735](https://issues.redhat.com/browse/ACM-32735): Add better API docs to CRDs [#10124](https://github.com/openshift/assisted-service/pull/10124)
* [MGMT-23548](https://issues.redhat.com/browse/MGMT-23548): Ensure tests w/ gomock controllers call Finish() [#10024](https://github.com/openshift/assisted-service/pull/10024)
* [MGMT-22849](https://issues.redhat.com/browse/MGMT-22849): Remove the nmconnection that the openshift-installer writes for the bootstrap. [#10086](https://github.com/openshift/assisted-service/pull/10086)
* NO-ISSUE: Detect missing PostgreSQL client in development [#10119](https://github.com/openshift/assisted-service/pull/10119)
* NO-ISSUE: Add assisted-service-writing-unit-tests agent skill [#10123](https://github.com/openshift/assisted-service/pull/10123)
* [MGMT-23451](https://issues.redhat.com/browse/MGMT-23451): Lower SNO vCPU min to 4 instead of 8 for assisted for OCP 4.22 and above [#10040](https://github.com/openshift/assisted-service/pull/10040)
* [MGMT-23141](https://issues.redhat.com/browse/MGMT-23141): Cluster creation returns SQL error rather than API error [#10113](https://github.com/openshift/assisted-service/pull/10113)
* NO-ISSUE: [master] Bump OCP versions: 4.20, 4.18, 4.21, 4.14, 4.17, 4.19, 4.16 [#10120](https://github.com/openshift/assisted-service/pull/10120)
* [MGMT-23340](https://issues.redhat.com/browse/MGMT-23340): upgrade assisted-service postgresql from 13 to 15 [#10096](https://github.com/openshift/assisted-service/pull/10096)
* NO-ISSUE: Replace github.com/golang/mock with go.uber.org/mock [#10082](https://github.com/openshift/assisted-service/pull/10082)
* [OCPBUGS-79576](https://issues.redhat.com/browse/OCPBUGS-79576): Prefer multipath disk in ABI disk selection [#10091](https://github.com/openshift/assisted-service/pull/10091)
* NO-ISSUE: BMAC: replace per-step Update calls with deferred Patch [#10095](https://github.com/openshift/assisted-service/pull/10095)
* [MGMT-22517](https://issues.redhat.com/browse/MGMT-22517): Change amd gpu operator namespace to openshift-amd-gpu [#10007](https://github.com/openshift/assisted-service/pull/10007)
* [MGMT-23228](https://issues.redhat.com/browse/MGMT-23228): Update NFD config for AMD Instinct GPU detection [#9918](https://github.com/openshift/assisted-service/pull/9918)
* [MGMT-23599](https://issues.redhat.com/browse/MGMT-23599): implement cluster and host validations for Kube API mode [#10044](https://github.com/openshift/assisted-service/pull/10044)
* [MGMT-23253](https://issues.redhat.com/browse/MGMT-23253): Reconcile stuck day2 agent status by checking spoke cluster [#10087](https://github.com/openshift/assisted-service/pull/10087)
* NO-ISSUE: clarify error when interface in bond missing [#10022](https://github.com/openshift/assisted-service/pull/10022)
* [MGMT-23060](https://issues.redhat.com/browse/MGMT-23060): Make InfraEnv CpuArchitecture immutable after creation [#9999](https://github.com/openshift/assisted-service/pull/9999)
* [MGMT-23625](https://issues.redhat.com/browse/MGMT-23625): Remove pinned image version for nfd operator [#10045](https://github.com/openshift/assisted-service/pull/10045)
* [MGMT-23231](https://issues.redhat.com/browse/MGMT-23231): Replace AcceleratorProfile with HardwareProfile [#9919](https://github.com/openshift/assisted-service/pull/9919)
* [MGMT-23674](https://issues.redhat.com/browse/MGMT-23674): Remove controller-runtime dependency from api module [#10071](https://github.com/openshift/assisted-service/pull/10071)
* [MGMT-23650](https://issues.redhat.com/browse/MGMT-23650): Disable image policy in assisted service operator deployment [#10070](https://github.com/openshift/assisted-service/pull/10070)
* [MGMT-23300](https://issues.redhat.com/browse/MGMT-23300): Add missing permission for host reclaim pod [#9934](https://github.com/openshift/assisted-service/pull/9934)
* [MGMT-22939](https://issues.redhat.com/browse/MGMT-22939): Fix cache key to get mustgather image [#9940](https://github.com/openshift/assisted-service/pull/9940)
* [OCPBUGS-79470](https://issues.redhat.com/browse/OCPBUGS-79470): Fix multi-document YAML parsing for NMStateConfig [#10053](https://github.com/openshift/assisted-service/pull/10053)
* NO-ISSUE: [master] Bump OCP versions: 4.16, 4.17, 4.19, 4.21, 4.22 [#10054](https://github.com/openshift/assisted-service/pull/10054)
* [AGENT-1426](https://issues.redhat.com/browse/AGENT-1426): Add localhost mirror only when missing in IRI patcher [#10028](https://github.com/openshift/assisted-service/pull/10028)
* [MGMT-23446](https://issues.redhat.com/browse/MGMT-23446): TNA none platform on 4.19 (block for 4.21 and lower) [#10013](https://github.com/openshift/assisted-service/pull/10013)
* [MGMT-23045](https://issues.redhat.com/browse/MGMT-23045): toggle metal3 integration [#9933](https://github.com/openshift/assisted-service/pull/9933)
* [OCPBUGS-78989](https://issues.redhat.com/browse/OCPBUGS-78989): Gate customDeploy on PreprovisioningImage having correct ISO [#10032](https://github.com/openshift/assisted-service/pull/10032)
* [MGMT-23339](https://issues.redhat.com/browse/MGMT-23339): Add url to release image comparison for Kube API versions [#10030](https://github.com/openshift/assisted-service/pull/10030)
* [MGMT-23550](https://issues.redhat.com/browse/MGMT-23550): Add feature usage for new CNI types [#10027](https://github.com/openshift/assisted-service/pull/10027)
* NO-ISSUE: add skipper skill [#10014](https://github.com/openshift/assisted-service/pull/10014)
* [MGMT-23432](https://issues.redhat.com/browse/MGMT-23432): add third parties CNI support to KUBE API mode [#10015](https://github.com/openshift/assisted-service/pull/10015)
* NO-ISSUE: [master] Bump OCP versions: 4.21 [#10023](https://github.com/openshift/assisted-service/pull/10023)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/assisted-service/compare/7b05e33ec5b466a6ea11f25836f704c74ad2d534...6676a6d8755afa66a2fb0c8b23bc79417196e469)
### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/7c400e88587c5c52a14500ac4c228fa3f99a9d60)
* NO-ISSUE: Refresh RPM lockfiles [#2160](https://github.com/openshift/assisted-installer/pull/2160)
* [MGMT-23784](https://issues.redhat.com/browse/MGMT-23784): CVE-2026-34986 Bump github.com/go-jose/go-jose/v3 to v3.0.5 using replace directive [#2121](https://github.com/openshift/assisted-installer/pull/2121)
* NO-ISSUE: Modify Konflux YAMLs to backplane-5.0 [#2119](https://github.com/openshift/assisted-installer/pull/2119)
* [ACM-33186](https://issues.redhat.com/browse/ACM-33186): Revert Renovate configuration for Hive updates [#2107](https://github.com/openshift/assisted-installer/pull/2107)
* NO-ISSUE: upgrade go.opentelemetry.io/otel/sdk to … [#2097](https://github.com/openshift/assisted-installer/pull/2097)
* [MGMT-23789](https://issues.redhat.com/browse/MGMT-23789): CVE-2026-34986 Bump github.com/go-jose/go-jose/v4 to v4.1.4 through indirect dependency conversion [#2081](https://github.com/openshift/assisted-installer/pull/2081)
* NO-ISSUE: Refresh RPM lockfiles [#2069](https://github.com/openshift/assisted-installer/pull/2069)
* [MGMT-23545](https://issues.redhat.com/browse/MGMT-23545): Mount pull secret token as a file [#2053](https://github.com/openshift/assisted-installer/pull/2053)
* [MGMT-23191](https://issues.redhat.com/browse/MGMT-23191): Ensure MCO configs are present before rebooting the bootstrap node [#2039](https://github.com/openshift/assisted-installer/pull/2039)
* [MGMT-23664](https://issues.redhat.com/browse/MGMT-23664): CVE-2026-33186 Bump google.golang.org/grpc to v1.79.3 through indirect dependency conversion [#2058](https://github.com/openshift/assisted-installer/pull/2058)
* [OCPBUGS-70213](https://issues.redhat.com/browse/OCPBUGS-70213): fix: allow workers to join TNA cluster when 1 master + arbiter are ready [#2056](https://github.com/openshift/assisted-installer/pull/2056)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/c3de39046aa6aaf9bbb531c7ad3cfd82b97a396b...7c400e88587c5c52a14500ac4c228fa3f99a9d60)
### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/b5ecd18f8be9eac3fc6052b24dce306333e6cb8a)
* NO-ISSUE: Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v1.26 [#1461](https://github.com/openshift/assisted-installer-agent/pull/1461)
* NO-ISSUE: Upgrade linter [#1453](https://github.com/openshift/assisted-installer-agent/pull/1453)
* NO-ISSUE: Modify Konflux YAMLs to backplane-5.0 [#1431](https://github.com/openshift/assisted-installer-agent/pull/1431)
* [ACM-31642](https://issues.redhat.com/browse/ACM-31642): fix CVE-2026-33186 [#1417](https://github.com/openshift/assisted-installer-agent/pull/1417)
* [OCPBUGS-63472](https://issues.redhat.com/browse/OCPBUGS-63472): add --copy-network when manual network config is detected [#1374](https://github.com/openshift/assisted-installer-agent/pull/1374)
* [MGMT-23790](https://issues.redhat.com/browse/MGMT-23790): CVE-2026-34986 Bump github.com/go-jose/go-jose/v4 to v4.1.4 through indirect dependency conversion [#1404](https://github.com/openshift/assisted-installer-agent/pull/1404)
* NO-ISSUE: Refactor flag Parsing to avoid multiple calls [#1401](https://github.com/openshift/assisted-installer-agent/pull/1401)
* NO-ISSUE: Refresh RPM lockfiles [#1389](https://github.com/openshift/assisted-installer-agent/pull/1389)
* [MGMT-23300](https://issues.redhat.com/browse/MGMT-23300): Ensure /boot dir has enough space during reclaim [#1316](https://github.com/openshift/assisted-installer-agent/pull/1316)
* [MGMT-23517](https://issues.redhat.com/browse/MGMT-23517): Bump go modules [#1373](https://github.com/openshift/assisted-installer-agent/pull/1373)
* [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/dd12f4a8b403cb33f7b3974ddc06cc73f4804b91...b5ecd18f8be9eac3fc6052b24dce306333e6cb8a)
### [agent-installer-ui](https://github.com/openshift-assisted/assisted-installer-ui/tree/b74ae02bbad3d2f9c71cb49946c0978cebbf0279)
* [OCPBUGS-72598](https://issues.redhat.com/browse/OCPBUGS-72598): Custom manifests are broken in local assisted UI (#3766) [#3766](https://github.com/openshift-assisted/assisted-installer-ui/pull/3766)
* [OCPBUGS-85310](https://issues.redhat.com/browse/OCPBUGS-85310): Static ip prefill for ove below the sea (#3733) [#3733](https://github.com/openshift-assisted/assisted-installer-ui/pull/3733)
* [MGMT-24099](https://issues.redhat.com/browse/MGMT-24099): UI redirects to Custom Manifest page before host discovery when cluster is OCI platform (#3739) [#3739](https://github.com/openshift-assisted/assisted-installer-ui/pull/3739)
* chore(deps): update konflux references (#3762) [#3762](https://github.com/openshift-assisted/assisted-installer-ui/pull/3762)
* [MGMT-24304](https://issues.redhat.com/browse/MGMT-24304): On disconnected environment no Openshift version is set by default on standalone cluster details page and no version is shown in the dropdown till Show all available are shown (#3723) [#3723](https://github.com/openshift-assisted/assisted-installer-ui/pull/3723)
* Bump tmp from 0.2.5 to 0.2.6 (#3760) [#3760](https://github.com/openshift-assisted/assisted-installer-ui/pull/3760)
* chore(deps): update testing packages (#3742) [#3742](https://github.com/openshift-assisted/assisted-installer-ui/pull/3742)
* Revert "OCPBUGS-84038 | [Below the sea UI] Lack of visual feedback (spinner) …" (#3757) [#3757](https://github.com/openshift-assisted/assisted-installer-ui/pull/3757)
* Fix disk encryption parsing for cluster details (#3737) [#3737](https://github.com/openshift-assisted/assisted-installer-ui/pull/3737)
* Reset search field on 'Clear all filters' (#3736) [#3736](https://github.com/openshift-assisted/assisted-installer-ui/pull/3736)
* [MGMT-24444](https://issues.redhat.com/browse/MGMT-24444): Apply sentence case to networking management type labels … (#3747) [#3747](https://github.com/openshift-assisted/assisted-installer-ui/pull/3747)
* Operators section should not be displayed on review and installation progress pages when no operators are selected (#3745) [#3745](https://github.com/openshift-assisted/assisted-installer-ui/pull/3745)
* Remove Arbiter button (#3744) [#3744](https://github.com/openshift-assisted/assisted-installer-ui/pull/3744)
* chore(deps): update typescript (#3743) [#3743](https://github.com/openshift-assisted/assisted-installer-ui/pull/3743)
* chore(deps): update konflux references (#3741) [#3741](https://github.com/openshift-assisted/assisted-installer-ui/pull/3741)
* Update Konflux Quay image address (#3740) [#3740](https://github.com/openshift-assisted/assisted-installer-ui/pull/3740)
* Bump ws from 8.18.3 to 8.20.1 (#3726) [#3726](https://github.com/openshift-assisted/assisted-installer-ui/pull/3726)
* fix monted pull secret parsing (#3692) [#3692](https://github.com/openshift-assisted/assisted-installer-ui/pull/3692)
* chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.9-1778675823 (#3720) [#3720](https://github.com/openshift-assisted/assisted-installer-ui/pull/3720)
* chore(deps): update dependency qs to ^6.15.2 (#3719) [#3719](https://github.com/openshift-assisted/assisted-installer-ui/pull/3719)
* chore(deps): update konflux references (#3718) [#3718](https://github.com/openshift-assisted/assisted-installer-ui/pull/3718)
* chore(deps): update dependency dpdm to v4 (#3555) [#3555](https://github.com/openshift-assisted/assisted-installer-ui/pull/3555)
* Implement useAgents hook for the CIM wizard (#3711) [#3711](https://github.com/openshift-assisted/assisted-installer-ui/pull/3711)
* Ugrade axios to 1.15.2 (#3710) [#3710](https://github.com/openshift-assisted/assisted-installer-ui/pull/3710)
* chore(deps): update dependency qs to ^6.15.1 (#3678) [#3678](https://github.com/openshift-assisted/assisted-installer-ui/pull/3678)
* chore(deps): update dependency eslint to ^8.57.1 (#3677) [#3677](https://github.com/openshift-assisted/assisted-installer-ui/pull/3677)
* chore(deps): update konflux references (#3707) [#3707](https://github.com/openshift-assisted/assisted-installer-ui/pull/3707)
* chore(deps): update dependency redux to ^4.2.1 (#3708) [#3708](https://github.com/openshift-assisted/assisted-installer-ui/pull/3708)
* chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.9-1778171507 (#3709) [#3709](https://github.com/openshift-assisted/assisted-installer-ui/pull/3709)
* Bump fast-uri from 3.1.0 to 3.1.2 (#3706) [#3706](https://github.com/openshift-assisted/assisted-installer-ui/pull/3706)
* OCPBUGS-84038 | [Below the sea UI] Lack of visual feedback (spinner) on disabled "Next" button during background validation (#3687) [#3687](https://github.com/openshift-assisted/assisted-installer-ui/pull/3687)
* [MGMT-23490](https://issues.redhat.com/browse/MGMT-23490): Refactor Troubleshooting Web Console (#3688) [#3688](https://github.com/openshift-assisted/assisted-installer-ui/pull/3688)
* Bump basic-ftp from 5.3.0 to 5.3.1 (#3698) [#3698](https://github.com/openshift-assisted/assisted-installer-ui/pull/3698)
* Bump ip-address from 7.1.0 to 10.1.1 (#3689) [#3689](https://github.com/openshift-assisted/assisted-installer-ui/pull/3689)
* Read from aipVIPs and ingressVIPs in getClusterProperties function (#3661) [#3661](https://github.com/openshift-assisted/assisted-installer-ui/pull/3661)
* Memoize the wizard footer on CIM Review step (#3686) [#3686](https://github.com/openshift-assisted/assisted-installer-ui/pull/3686)
* [MGMT-19002](https://issues.redhat.com/browse/MGMT-19002): [nmstate] UI form view missing autoconf field for ipv6 (#3681) [#3681](https://github.com/openshift-assisted/assisted-installer-ui/pull/3681)
* Add custom-manifests-requirements-satisfied to soft validations on networking wizard step (#3682) [#3682](https://github.com/openshift-assisted/assisted-installer-ui/pull/3682)
* OCPBUGS-84147 | [Below the sea UI] Leaky Abstraction: Transient 500 errors exposed during host binding process (#3672) [#3672](https://github.com/openshift-assisted/assisted-installer-ui/pull/3672)
* [MGMT-21857](https://issues.redhat.com/browse/MGMT-21857): [UI] - Missing "No Matching Clusters" Message (#3667) [#3667](https://github.com/openshift-assisted/assisted-installer-ui/pull/3667)
* Hide internally generated custom manifests on the Cluster Review page (#3646) [#3646](https://github.com/openshift-assisted/assisted-installer-ui/pull/3646)
* chore(deps): update konflux references (#3675) [#3675](https://github.com/openshift-assisted/assisted-installer-ui/pull/3675)
* [MGMT-23950](https://issues.redhat.com/browse/MGMT-23950): [Staging] [UI] - Cluster name missing in page header for draft clusters (#3669) [#3669](https://github.com/openshift-assisted/assisted-installer-ui/pull/3669)
* chore(deps): update dependency @reduxjs/toolkit to ^1.9.7 (#3647) [#3647](https://github.com/openshift-assisted/assisted-installer-ui/pull/3647)
* chore(deps): update dependency axios to ^1.15.2 (#3648) [#3648](https://github.com/openshift-assisted/assisted-installer-ui/pull/3648)
* [MGMT-24152](https://issues.redhat.com/browse/MGMT-24152): UI allows editing pull secret in draft cluster (#3662) [#3662](https://github.com/openshift-assisted/assisted-installer-ui/pull/3662)
* Remove 2 node arbiter option from the control plane dropdown option (#3644) [#3644](https://github.com/openshift-assisted/assisted-installer-ui/pull/3644)
* Bump postcss from 8.5.6 to 8.5.10 (#3641) [#3641](https://github.com/openshift-assisted/assisted-installer-ui/pull/3641)
* Update OWNERS file (#3643) [#3643](https://github.com/openshift-assisted/assisted-installer-ui/pull/3643)
* chore(deps): update konflux references (#3640) [#3640](https://github.com/openshift-assisted/assisted-installer-ui/pull/3640)
* chore(config): migrate config renovate.json (#3639) [#3639](https://github.com/openshift-assisted/assisted-installer-ui/pull/3639)
* [MGMT-23800](https://issues.redhat.com/browse/MGMT-23800): Upgrade Vite (#3589) [#3589](https://github.com/openshift-assisted/assisted-installer-ui/pull/3589)
* chore(deps): update dependency msw to v2.13.5 (#3587) [#3587](https://github.com/openshift-assisted/assisted-installer-ui/pull/3587)
* chore(deps): update dependency @vitejs/plugin-react-swc to v4 (#3553) [#3553](https://github.com/openshift-assisted/assisted-installer-ui/pull/3553)
* chore(deps): update dependency happy-dom to v20.9.0 (#3591) [#3591](https://github.com/openshift-assisted/assisted-installer-ui/pull/3591)
* Add renovate.json (#3637) [#3637](https://github.com/openshift-assisted/assisted-installer-ui/pull/3637)
* chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.8-1776962329 (#3588) [#3588](https://github.com/openshift-assisted/assisted-installer-ui/pull/3588)
* chore(deps): update dependency @redhat-cloud-services/eslint-config-redhat-cloud-services to v3.1.0 (#3577) [#3577](https://github.com/openshift-assisted/assisted-installer-ui/pull/3577)
* chore(deps): update dependency @types/uuid to v11 (#3544) [#3544](https://github.com/openshift-assisted/assisted-installer-ui/pull/3544)
* chore(deps): update yarn to v3.8.7 (#3495) [#3495](https://github.com/openshift-assisted/assisted-installer-ui/pull/3495)
* Add cursor rules for imports (#3595) [#3595](https://github.com/openshift-assisted/assisted-installer-ui/pull/3595)
* NO-ISSUE: Cursor rules for comments and variables (#3592) [#3592](https://github.com/openshift-assisted/assisted-installer-ui/pull/3592)
* Add CLAUDE.md (#3632) [#3632](https://github.com/openshift-assisted/assisted-installer-ui/pull/3632)
* Bump uuid from 8.3.2 to 14.0.0 (#3629) [#3629](https://github.com/openshift-assisted/assisted-installer-ui/pull/3629)
* Bump follow-redirects from 1.15.11 to 1.16.0 (#3586) [#3586](https://github.com/openshift-assisted/assisted-installer-ui/pull/3586)
* [ACM-30344](https://issues.redhat.com/browse/ACM-30344): ACM Console should support ClusterImageSets with by-digest pullspecs (#3609) [#3609](https://github.com/openshift-assisted/assisted-installer-ui/pull/3609)
* Allow to install SNO topology (#3578) [#3578](https://github.com/openshift-assisted/assisted-installer-ui/pull/3578)
* Support third party CNI in CIM (#3600) [#3600](https://github.com/openshift-assisted/assisted-installer-ui/pull/3600)
* Fix Cisco Intersight editing (#3523) [#3523](https://github.com/openshift-assisted/assisted-installer-ui/pull/3523)
* Pull secret appears editable in draft cluster but changes are not applied (#3597) [#3597](https://github.com/openshift-assisted/assisted-installer-ui/pull/3597)
* fix operators list in ABI below the sea (#3590) [#3590](https://github.com/openshift-assisted/assisted-installer-ui/pull/3590)
* [MGMT-23913](https://issues.redhat.com/browse/MGMT-23913): Missing breadcrumbs in on-prem Assisted Installer (#3598) [#3598](https://github.com/openshift-assisted/assisted-installer-ui/pull/3598)
* Update build-tools (#3593) [#3593](https://github.com/openshift-assisted/assisted-installer-ui/pull/3593)
* Upgrade lodash to 4.18.1 (#3566) [#3566](https://github.com/openshift-assisted/assisted-installer-ui/pull/3566)
* Bump basic-ftp from 5.2.1 to 5.3.0 (#3594) [#3594](https://github.com/openshift-assisted/assisted-installer-ui/pull/3594)
* [OCPBUGS-83428](https://issues.redhat.com/browse/OCPBUGS-83428): bump axios to ^1.15.0 for fixing CVE-2026-40175 (#3585) [#3585](https://github.com/openshift-assisted/assisted-installer-ui/pull/3585)
* chore(deps): update dependency @redhat-cloud-services/frontend-components to v7.3.1 (#3568) [#3568](https://github.com/openshift-assisted/assisted-installer-ui/pull/3568)
* chore(deps): update dependency @redhat-cloud-services/tsc-transform-imports to v1.0.58 (#3570) [#3570](https://github.com/openshift-assisted/assisted-installer-ui/pull/3570)
* chore(deps): update dependency @redhat-cloud-services/frontend-components-config to v6.8.4 (#3569) [#3569](https://github.com/openshift-assisted/assisted-installer-ui/pull/3569)
* [MGMT-23090](https://issues.redhat.com/browse/MGMT-23090): Support single stack IPv6 (#3414) [#3414](https://github.com/openshift-assisted/assisted-installer-ui/pull/3414)
* NO-ISSUE: Remove orphan files (#3460) [#3460](https://github.com/openshift-assisted/assisted-installer-ui/pull/3460)
* [MGMT-23328](https://issues.redhat.com/browse/MGMT-23328): remove breadcrumbs for OCM and use logo as a link (#3510) [#3510](https://github.com/openshift-assisted/assisted-installer-ui/pull/3510)
* NO-ISSUE: Update translation files to match new i18next format (#3567) [#3567](https://github.com/openshift-assisted/assisted-installer-ui/pull/3567)
* chore(deps): update dependency rimraf to v6 (#3564) [#3564](https://github.com/openshift-assisted/assisted-installer-ui/pull/3564)
* chore(deps): update konflux references (#3562) [#3562](https://github.com/openshift-assisted/assisted-installer-ui/pull/3562)
* chore(deps): update konflux references (#3561) [#3561](https://github.com/openshift-assisted/assisted-installer-ui/pull/3561)
* chore(deps): update module golang.org/x/sys to v0.43.0 (#3492) [#3492](https://github.com/openshift-assisted/assisted-installer-ui/pull/3492)
* chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.8-1775724628 (#3560) [#3560](https://github.com/openshift-assisted/assisted-installer-ui/pull/3560)
* chore(deps): update dependency qs to v6.15.1 (#3559) [#3559](https://github.com/openshift-assisted/assisted-installer-ui/pull/3559)
* chore(deps): update dependency @redhat-cloud-services/eslint-config-redhat-cloud-services to v3 (#3539) [#3539](https://github.com/openshift-assisted/assisted-installer-ui/pull/3539)
* chore(deps): update dependency msw to v2 (#3557) [#3557](https://github.com/openshift-assisted/assisted-installer-ui/pull/3557)
* chore(deps): update dependency concurrently to v9 (#3554) [#3554](https://github.com/openshift-assisted/assisted-installer-ui/pull/3554)
* chore(deps): update dependency @openapitools/openapi-generator-cli to v2.31.1 (#3534) [#3534](https://github.com/openshift-assisted/assisted-installer-ui/pull/3534)
* chore(deps): update dependency typescript to v5.9.3 (#3489) [#3489](https://github.com/openshift-assisted/assisted-installer-ui/pull/3489)
* chore(deps): update dependency @types/node to v24 (#3543) [#3543](https://github.com/openshift-assisted/assisted-installer-ui/pull/3543)
* chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.8-1775651161 (#3548) [#3548](https://github.com/openshift-assisted/assisted-installer-ui/pull/3548)
* chore(deps): update dependency i18next-parser to v9 (#3556) [#3556](https://github.com/openshift-assisted/assisted-installer-ui/pull/3556)
* Bump basic-ftp from 5.2.0 to 5.2.1 (#3552) [#3552](https://github.com/openshift-assisted/assisted-installer-ui/pull/3552)
* chore(deps): update dependency axios to v1.15.0 (#3551) [#3551](https://github.com/openshift-assisted/assisted-installer-ui/pull/3551)
* chore(deps): update dependency @redhat-cloud-services/frontend-components to v7.3.0 (#3550) [#3550](https://github.com/openshift-assisted/assisted-installer-ui/pull/3550)
* [MGMT-23313](https://issues.redhat.com/browse/MGMT-23313): long text breaks table layout (#3545) [#3545](https://github.com/openshift-assisted/assisted-installer-ui/pull/3545)
* Bump vite from 5.4.21 to 6.4.2 (#3547) [#3547](https://github.com/openshift-assisted/assisted-installer-ui/pull/3547)
* chore(deps): update dependency eslint-plugin-import to v2.32.0 (#3475) [#3475](https://github.com/openshift-assisted/assisted-installer-ui/pull/3475)
* fix(deps): update dependency monaco-editor to v0.55.1 (#3505) [#3505](https://github.com/openshift-assisted/assisted-installer-ui/pull/3505)
* fix(deps): update dependency cypress to v13.17.0 (#3500) [#3500](https://github.com/openshift-assisted/assisted-installer-ui/pull/3500)
* fix(deps): update dependency react-monaco-editor to v0.59.0 (#3537) [#3537](https://github.com/openshift-assisted/assisted-installer-ui/pull/3537)
* chore(deps): update dependency dpdm to v3.15.1 (#3473) [#3473](https://github.com/openshift-assisted/assisted-installer-ui/pull/3473)
* chore(deps): update dependency @redhat-cloud-services/frontend-components-config to v6.8.3 (#3471) [#3471](https://github.com/openshift-assisted/assisted-installer-ui/pull/3471)
* chore(deps): update dependency axios to v1.14.0 (#3536) [#3536](https://github.com/openshift-assisted/assisted-installer-ui/pull/3536)
* chore(deps): update dependency @types/eslint to v9 (#3541) [#3541](https://github.com/openshift-assisted/assisted-installer-ui/pull/3541)
* Updating assisted-installer-ui-container image to be consistent with ART for 4.22 (#3340) [#3340](https://github.com/openshift-assisted/assisted-installer-ui/pull/3340)
* chore(deps): update lodash monorepo to v4.18.1 (#3538) [#3538](https://github.com/openshift-assisted/assisted-installer-ui/pull/3538)
* chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.8-1775042950 (#3533) [#3533](https://github.com/openshift-assisted/assisted-installer-ui/pull/3533)
* chore(deps): update dependency eslint-plugin-react to v7.37.5 (#3476) [#3476](https://github.com/openshift-assisted/assisted-installer-ui/pull/3476)
* Bump @xmldom/xmldom from 0.8.10 to 0.8.12 (#3532) [#3532](https://github.com/openshift-assisted/assisted-installer-ui/pull/3532)
* chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.8-1774968108 (#3531) [#3531](https://github.com/openshift-assisted/assisted-installer-ui/pull/3531)
* Upgrade @openshift-console/dynamic-plugin/sdk (#3522) [#3522](https://github.com/openshift-assisted/assisted-installer-ui/pull/3522)
* Update translation files (#3524) [#3524](https://github.com/openshift-assisted/assisted-installer-ui/pull/3524)
* chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.8-1774618347 (#3519) [#3519](https://github.com/openshift-assisted/assisted-installer-ui/pull/3519)
* Add support for release branches in PR workflow (#3527) [#3527](https://github.com/openshift-assisted/assisted-installer-ui/pull/3527)
* chore(deps): update dependency @redhat-cloud-services/tsc-transform-imports to v1.0.57 (#3407) [#3407](https://github.com/openshift-assisted/assisted-installer-ui/pull/3407)
* Add feature branch to pull request workflow (#3520) [#3520](https://github.com/openshift-assisted/assisted-installer-ui/pull/3520)
* NO-ISSUE: Add cursor rules (#3515) [#3515](https://github.com/openshift-assisted/assisted-installer-ui/pull/3515)
* chore(deps): update registry.access.redhat.com/ubi9/go-toolset docker tag to v1.25.7-1774499506 (#3494) [#3494](https://github.com/openshift-assisted/assisted-installer-ui/pull/3494)
* fix(deps): update module github.com/sirupsen/logrus to v1.9.4 (#3441) [#3441](https://github.com/openshift-assisted/assisted-installer-ui/pull/3441)
* Revert abi abov the sea new flow (#3517) [#3517](https://github.com/openshift-assisted/assisted-installer-ui/pull/3517)
* Bump happy-dom from 20.0.2 to 20.8.9 (#3516) [#3516](https://github.com/openshift-assisted/assisted-installer-ui/pull/3516)
* chore(deps): update dependency swr to v2.4.1 (#3486) [#3486](https://github.com/openshift-assisted/assisted-installer-ui/pull/3486)
* Bump node-forge from 1.3.3 to 1.4.0 (#3513) [#3513](https://github.com/openshift-assisted/assisted-installer-ui/pull/3513)
* chore(deps): update konflux references (#3514) [#3514](https://github.com/openshift-assisted/assisted-installer-ui/pull/3514)
* Bump picomatch from 2.3.1 to 2.3.2 (#3507) [#3507](https://github.com/openshift-assisted/assisted-installer-ui/pull/3507)
* Bump brace-expansion from 1.1.11 to 1.1.13 (#3512) [#3512](https://github.com/openshift-assisted/assisted-installer-ui/pull/3512)
* add pull secret auto populate logic to ABI local UI (#3508) [#3508](https://github.com/openshift-assisted/assisted-installer-ui/pull/3508)
* chore(deps): update dependency tslib to v2.8.1 (#3487) [#3487](https://github.com/openshift-assisted/assisted-installer-ui/pull/3487)
* populate default values in local ui from infraEnv (#3502) [#3502](https://github.com/openshift-assisted/assisted-installer-ui/pull/3502)
* [MGMT-23648](https://issues.redhat.com/browse/MGMT-23648): Removing the manifests using the toggle (#3498) [#3498](https://github.com/openshift-assisted/assisted-installer-ui/pull/3498)
* Add cursor rules for generated files (#3497) [#3497](https://github.com/openshift-assisted/assisted-installer-ui/pull/3497)
* chore(deps): update konflux references (#3472) [#3472](https://github.com/openshift-assisted/assisted-installer-ui/pull/3472)
* chore(deps): update dependency start-server-and-test to v2.1.5 (#3484) [#3484](https://github.com/openshift-assisted/assisted-installer-ui/pull/3484)
* Set customManifestsUpdated when users remove a manifest (#3482) [#3482](https://github.com/openshift-assisted/assisted-installer-ui/pull/3482)
* Red Hat Konflux update assisted-ui-chatbot-saas-main (#3478) [#3478](https://github.com/openshift-assisted/assisted-installer-ui/pull/3478)
* [MGMT-23515](https://issues.redhat.com/browse/MGMT-23515): Use Network type support level (#3465) [#3465](https://github.com/openshift-assisted/assisted-installer-ui/pull/3465)
* Red Hat Konflux purge assisted-installer-chatbot-main (#3477) [#3477](https://github.com/openshift-assisted/assisted-installer-ui/pull/3477)
* fix(deps): update dependency @patternfly/react-core to v6.4.1 (#3438) [#3438](https://github.com/openshift-assisted/assisted-installer-ui/pull/3438)
* chore(deps): update dependency nodemon to v3.1.14 (#3435) [#3435](https://github.com/openshift-assisted/assisted-installer-ui/pull/3435)
* chore(deps): update dependency @vitejs/plugin-react-swc to v3.11.0 (#3444) [#3444](https://github.com/openshift-assisted/assisted-installer-ui/pull/3444)
* chore(deps): update dependency @openapitools/openapi-generator-cli to v2.30.2 (#3442) [#3442](https://github.com/openshift-assisted/assisted-installer-ui/pull/3442)
* chore(deps): update dependency @redhat-cloud-services/frontend-components to v7.1.1 (#3470) [#3470](https://github.com/openshift-assisted/assisted-installer-ui/pull/3470)
* fix(deps): update dependency @patternfly/react-code-editor to v6.4.1 (#3437) [#3437](https://github.com/openshift-assisted/assisted-installer-ui/pull/3437)
* fix(deps): update dependency @patternfly/react-table to v6.4.1 (#3440) [#3440](https://github.com/openshift-assisted/assisted-installer-ui/pull/3440)
* chore(deps): update dependency @redhat-cloud-services/frontend-components-config to v6.7.54 (#3406) [#3406](https://github.com/openshift-assisted/assisted-installer-ui/pull/3406)
* chore(deps): update dependency @sentry/browser to v7.120.4 (#3443) [#3443](https://github.com/openshift-assisted/assisted-installer-ui/pull/3443)
* chore(deps): update dependency eslint to v8.57.1 (#3432) [#3432](https://github.com/openshift-assisted/assisted-installer-ui/pull/3432)
* chore(deps): update dependency axios to v1.13.6 (#3431) [#3431](https://github.com/openshift-assisted/assisted-installer-ui/pull/3431)
* chore(deps): update dependency @types/node to v18.19.130 (#3429) [#3429](https://github.com/openshift-assisted/assisted-installer-ui/pull/3429)
* chore(deps): update dependency @types/lodash to v4.17.24 (#3428) [#3428](https://github.com/openshift-assisted/assisted-installer-ui/pull/3428)
* Bump ajv from 6.12.6 to 6.14.0 (#3411) [#3411](https://github.com/openshift-assisted/assisted-installer-ui/pull/3411)
* chore(deps): update dependency prettier to v2.8.8 (#3436) [#3436](https://github.com/openshift-assisted/assisted-installer-ui/pull/3436)
* chore(deps): update dependency msw to v1.3.5 (#3434) [#3434](https://github.com/openshift-assisted/assisted-installer-ui/pull/3434)
* chore(deps): update dependency eslint-config-prettier to v8.10.2 (#3433) [#3433](https://github.com/openshift-assisted/assisted-installer-ui/pull/3433)
* chore(deps): update dependency @types/react-redux to v7.1.34 (#3430) [#3430](https://github.com/openshift-assisted/assisted-installer-ui/pull/3430)
* chore(deps): update dependency @types/eslint to v8.56.12 (#3427) [#3427](https://github.com/openshift-assisted/assisted-installer-ui/pull/3427)
* chore(deps): update dependency @tsconfig/recommended to v1.0.13 (#3426) [#3426](https://github.com/openshift-assisted/assisted-installer-ui/pull/3426)
* Bump flatted from 3.3.1 to 3.4.2 (#3469) [#3469](https://github.com/openshift-assisted/assisted-installer-ui/pull/3469)
* fix validations for NTP and Proxy in above sea level ABI flow (#3464) [#3464](https://github.com/openshift-assisted/assisted-installer-ui/pull/3464)
* Add identifiers and checked state attribute to custom manifests switch (#3466) [#3466](https://github.com/openshift-assisted/assisted-installer-ui/pull/3466)
* [MGMT-23516](https://issues.redhat.com/browse/MGMT-23516): Left navigation menu is cut off (#3463) [#3463](https://github.com/openshift-assisted/assisted-installer-ui/pull/3463)
* UI doesnt save the data filled by the user (#3452) [#3452](https://github.com/openshift-assisted/assisted-installer-ui/pull/3452)
* fix ISO file name (#3462) [#3462](https://github.com/openshift-assisted/assisted-installer-ui/pull/3462)
* Tech Preview badge should appear at the end of the line (#3461) [#3461](https://github.com/openshift-assisted/assisted-installer-ui/pull/3461)
* [AGENT-1136](https://issues.redhat.com/browse/AGENT-1136): Add USER_AUTH_TOKEN support to disconnected UI proxy (#3454) [#3454](https://github.com/openshift-assisted/assisted-installer-ui/pull/3454)
* Bump rollup from 4.50.1 to 4.59.0 (#3421) [#3421](https://github.com/openshift-assisted/assisted-installer-ui/pull/3421)
* Bump immutable from 3.8.2 to 3.8.3 (#3451) [#3451](https://github.com/openshift-assisted/assisted-installer-ui/pull/3451)
* [Full changelog](https://github.com/openshift-assisted/assisted-installer-ui/compare/c0d3a397b63b60c11465f102e2f52502292182cd...b74ae02bbad3d2f9c71cb49946c0978cebbf0279)
### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/546c1a9f71cff62e7eb85e7e70cd0c66ecd66c13)
* [OCPBUGS-86036](https://issues.redhat.com/browse/OCPBUGS-86036): Filter out link-local IPv6 addresses [#305](https://github.com/openshift/agent-installer-utils/pull/305)
* [OCPBUGS-85524](https://issues.redhat.com/browse/OCPBUGS-85524): update konflux references [#286](https://github.com/openshift/agent-installer-utils/pull/286)
* [AGENT-1476](https://issues.redhat.com/browse/AGENT-1476): Configure CI integration and add Prow e2e test to Konflux [#245](https://github.com/openshift/agent-installer-utils/pull/245)
* [AGENT-1193](https://issues.redhat.com/browse/AGENT-1193): Add mirror-path and registry-cert support for OVE ISO builder [#218](https://github.com/openshift/agent-installer-utils/pull/218)
* [OCPBUGS-83575](https://issues.redhat.com/browse/OCPBUGS-83575): Remove Konflux cert-preflight test [#290](https://github.com/openshift/agent-installer-utils/pull/290)
* NO-JIRA: Add 4.23 appliance-config [#289](https://github.com/openshift/agent-installer-utils/pull/289)
* NO-JIRA: Add 5.0 appliance-config.yaml for iso_builder [#288](https://github.com/openshift/agent-installer-utils/pull/288)
* [OCPBUGS-82537](https://issues.redhat.com/browse/OCPBUGS-82537): update konflux references [#274](https://github.com/openshift/agent-installer-utils/pull/274)
* NO-JIRA: enable xtrace in build-ove-image.sh for debugging [#281](https://github.com/openshift/agent-installer-utils/pull/281)
* [OCPBUGS-81585](https://issues.redhat.com/browse/OCPBUGS-81585): Update operator versions [#280](https://github.com/openshift/agent-installer-utils/pull/280)
* NO-JIRA: Pass environment through to podman [#279](https://github.com/openshift/agent-installer-utils/pull/279)
* [AGENT-1429](https://issues.redhat.com/browse/AGENT-1429): Pass OPENSHIFT_INSTALL_EXPERIMENTAL_DISABLE_IMAGE_POLICY [#278](https://github.com/openshift/agent-installer-utils/pull/278)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/ee5dfd4813f6f9e5219e97109d8f2ce7b8612512...546c1a9f71cff62e7eb85e7e70cd0c66ecd66c13)
### [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy/tree/c2014a5055dd4a3d32acdac070ee4e6b5207686f)
* [CNTRLPLANE-3380](https://issues.redhat.com/browse/CNTRLPLANE-3380): Merge https://github.com/kubernetes-sigs/apiserver-network-proxy:master (588e629) into main [#109](https://github.com/openshift/apiserver-network-proxy/pull/109)
* [CNTRLPLANE-3380](https://issues.redhat.com/browse/CNTRLPLANE-3380): Update OWNERS with HyperShift core team [#107](https://github.com/openshift/apiserver-network-proxy/pull/107)
* [CNTRLPLANE-3359](https://issues.redhat.com/browse/CNTRLPLANE-3359): Rebase to v0.34.0 for OCP 4.23 [#102](https://github.com/openshift/apiserver-network-proxy/pull/102)
* [Full changelog](https://github.com/openshift/apiserver-network-proxy/compare/5e33c22867d59ddd9392a2c6b3194d2f3c6bdfc7...c2014a5055dd4a3d32acdac070ee4e6b5207686f)
### [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws/tree/ce31a2b11578c75a7537ce3c3ef146d7a864b0a0)
* [OCPBUGS-85643](https://issues.redhat.com/browse/OCPBUGS-85643): UPSTREAM: <drop>: bump google.golang.org/grpc to v1.79.3 [#154](https://github.com/openshift/cloud-provider-aws/pull/154)
* NO-JIRA: Update OWNERS [#145](https://github.com/openshift/cloud-provider-aws/pull/145)
* [OCPCLOUD-3215](https://issues.redhat.com/browse/OCPCLOUD-3215): Add support for dual networking stack services [#135](https://github.com/openshift/cloud-provider-aws/pull/135)
* [Full changelog](https://github.com/openshift/cloud-provider-aws/compare/24a55244b598624200fe64150dd8186ec925698a...ce31a2b11578c75a7537ce3c3ef146d7a864b0a0)
### [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws/tree/77b3287fd6d469dc4fe8f57ad6db25fa30a4ad45)
* [OCPBUGS-85567](https://issues.redhat.com/browse/OCPBUGS-85567): Bump github.com/go-jose/go-jose/v4 to 4.1.4 [#607](https://github.com/openshift/cluster-api-provider-aws/pull/607)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#605](https://github.com/openshift/cluster-api-provider-aws/pull/605)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#598](https://github.com/openshift/cluster-api-provider-aws/pull/598)
* NO-JIRA: Update manifests generator [#604](https://github.com/openshift/cluster-api-provider-aws/pull/604)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.11.1 (eaa4c99) into main [#602](https://github.com/openshift/cluster-api-provider-aws/pull/602)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.11.0 (815a1b0) into main [#600](https://github.com/openshift/cluster-api-provider-aws/pull/600)
* NO-JIRA: Update OWNERS [#599](https://github.com/openshift/cluster-api-provider-aws/pull/599)
* [Full changelog](https://github.com/openshift/cluster-api-provider-aws/compare/2d7aa679a7847b8831f4a14e84154170d33574ed...77b3287fd6d469dc4fe8f57ad6db25fa30a4ad45)
### [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver/tree/0dc99489474b344fd8363d4ff1e2d91b4da1a312)
* NO-ISSUE: UPSTREAM: 2911: CVE-2026-33186: bump google.golang.org/grpc v1.80.0 [#315](https://github.com/openshift/aws-ebs-csi-driver/pull/315)
* [Full changelog](https://github.com/openshift/aws-ebs-csi-driver/compare/0927af1c1397b6f3c7545c715e1a87e0263ae2bf...0dc99489474b344fd8363d4ff1e2d91b4da1a312)
### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/5021458d94df6f749bfb61b5eab719129a27c836)
* [OCPBUGS-42363](https://issues.redhat.com/browse/OCPBUGS-42363): Re-enable Azure Disk load test [#558](https://github.com/openshift/csi-operator/pull/558)
* [OCPBUGS-86023](https://issues.redhat.com/browse/OCPBUGS-86023): Add memory limits to SMB CSI sidecar containers [#557](https://github.com/openshift/csi-operator/pull/557)
* [OCPBUGS-85457](https://issues.redhat.com/browse/OCPBUGS-85457): Add init container for Manila node daemonset [#552](https://github.com/openshift/csi-operator/pull/552)
* [OCPBUGS-84052](https://issues.redhat.com/browse/OCPBUGS-84052): Mount writable /tmp in SMB CSI driver [#545](https://github.com/openshift/csi-operator/pull/545)
* [OSASINFRA-3675](https://issues.redhat.com/browse/OSASINFRA-3675): Rework authentication in Manila CSI Driver Operator [#373](https://github.com/openshift/csi-operator/pull/373)
* [OCPBUGS-80930](https://issues.redhat.com/browse/OCPBUGS-80930): Add VolumeAttributesClass e2e test manifests for Azure disk [#538](https://github.com/openshift/csi-operator/pull/538)
* [OCPBUGS-78291](https://issues.redhat.com/browse/OCPBUGS-78291): Allow azure-disk sidecars to read VolumeAttributeClasses [#525](https://github.com/openshift/csi-operator/pull/525)
* [STOR-2762](https://issues.redhat.com/browse/STOR-2762): Bump all deps for 4.22 [#526](https://github.com/openshift/csi-operator/pull/526)
* [OCPBUGS-77674](https://issues.redhat.com/browse/OCPBUGS-77674): Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 4.22 [#516](https://github.com/openshift/csi-operator/pull/516)
* [OCPBUGS-77553](https://issues.redhat.com/browse/OCPBUGS-77553): Updating csi-driver-manila-operator-container image to be consistent with ART for 4.22 [#513](https://github.com/openshift/csi-operator/pull/513)
* [OCPBUGS-77612](https://issues.redhat.com/browse/OCPBUGS-77612): Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.22 [#514](https://github.com/openshift/csi-operator/pull/514)
* [Full changelog](https://github.com/openshift/csi-operator/compare/ab09ffaecadc779e61345daac67f8fde50eaac83...5021458d94df6f749bfb61b5eab719129a27c836)
### [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider/tree/6ca6eea2f3a9d0b090ff63ba5b8e342d5686c9a8)
* [CNTRLPLANE-3380](https://issues.redhat.com/browse/CNTRLPLANE-3380): Update OWNERS with HyperShift core team [#45](https://github.com/openshift/aws-encryption-provider/pull/45)
* [Full changelog](https://github.com/openshift/aws-encryption-provider/compare/19e7b623429799c9c549690a1b5ab499844411f9...6ca6eea2f3a9d0b090ff63ba5b8e342d5686c9a8)
### [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws/tree/2e4196b65473ae99bc9bbedc0bc7168ed3da3914)
* [OCPBUGS-83873](https://issues.redhat.com/browse/OCPBUGS-83873): Changed timeout for node ready logic in OTE [#185](https://github.com/openshift/machine-api-provider-aws/pull/185)
* [SPLAT-2715](https://issues.redhat.com/browse/SPLAT-2715): Fixed broken test and simplified some logic [#182](https://github.com/openshift/machine-api-provider-aws/pull/182)
* NO-JIRA: Update OWNERS [#183](https://github.com/openshift/machine-api-provider-aws/pull/183)
* [SPLAT-2627](https://issues.redhat.com/browse/SPLAT-2627): Created OTE Tests for dedicated hosts [#174](https://github.com/openshift/machine-api-provider-aws/pull/174)
* [SPLAT-2700](https://issues.redhat.com/browse/SPLAT-2700): Added shared tags for BYO DH [#181](https://github.com/openshift/machine-api-provider-aws/pull/181)
* [OCPCLOUD-3283](https://issues.redhat.com/browse/OCPCLOUD-3283): K8s 1.35 bump [#179](https://github.com/openshift/machine-api-provider-aws/pull/179)
* [Full changelog](https://github.com/openshift/machine-api-provider-aws/compare/684b5bba5b7269f0d5dbad65d98c4f426d8a896a...2e4196b65473ae99bc9bbedc0bc7168ed3da3914)
### [azure-cloud-controller-manager, azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure/tree/f10dd9c791c0204da9a4e7620f7998e1c20de449)
* [OCPBUGS-85641](https://issues.redhat.com/browse/OCPBUGS-85641), [OCPBUGS-85642](https://issues.redhat.com/browse/OCPBUGS-85642): UPSTREAM: <drop>: bump google.golang.org/grpc to v1.79.3 [#184](https://github.com/openshift/cloud-provider-azure/pull/184)
* NO-JIRA: Update OWNERS [#174](https://github.com/openshift/cloud-provider-azure/pull/174)
* [OCPCLOUD-3281](https://issues.redhat.com/browse/OCPCLOUD-3281): Merge https://github.com/kubernetes-sigs/cloud-provider-azure:master (314ccf1) into main [#155](https://github.com/openshift/cloud-provider-azure/pull/155)
* [Full changelog](https://github.com/openshift/cloud-provider-azure/compare/8584b9a8eee4464d72cc3c176d33885e098dda0c...f10dd9c791c0204da9a4e7620f7998e1c20de449)
### [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure/tree/28bd11f05b5bb1164b3a6aec3327b666e73887a9)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#387](https://github.com/openshift/cluster-api-provider-azure/pull/387)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#379](https://github.com/openshift/cluster-api-provider-azure/pull/379)
* NO-JIRA: Update manifests generator [#382](https://github.com/openshift/cluster-api-provider-azure/pull/382)
* [OCPBUGS-84694](https://issues.redhat.com/browse/OCPBUGS-84694): Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.23.1 (dbeb413) into main [#380](https://github.com/openshift/cluster-api-provider-azure/pull/380)
* NO-JIRA: Update OWNERS [#376](https://github.com/openshift/cluster-api-provider-azure/pull/376)
* [OCPCLOUD-3294](https://issues.redhat.com/browse/OCPCLOUD-3294): Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.23.0 (ac446a1) into main [#371](https://github.com/openshift/cluster-api-provider-azure/pull/371)
* [Full changelog](https://github.com/openshift/cluster-api-provider-azure/compare/104ebbd2ba141dbeea63d6533004d6a9ac8437cf...28bd11f05b5bb1164b3a6aec3327b666e73887a9)
### [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver/tree/72a8648ad5afe04b815361335bb4873d2ce40d99)
* [OCPBUGS-78197](https://issues.redhat.com/browse/OCPBUGS-78197): check for node name in waitForDiskManagedByTobeRemoved [#144](https://github.com/openshift/azure-disk-csi-driver/pull/144)
* UPSTREAM: 3569: OCPBUGS-83733: Bump grpc to v1.79.3 [#135](https://github.com/openshift/azure-disk-csi-driver/pull/135)
* [Full changelog](https://github.com/openshift/azure-disk-csi-driver/compare/950b1622c43e9c41a38354efb7bfa0d2aba50cdb...72a8648ad5afe04b815361335bb4873d2ce40d99)
### [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver/tree/b66940c2459bdd503270d758e92057c89b798c6d)
* UPSTREAM: 3023: OCPBUGS-83329: Bump grpc to v1.79.3 [#124](https://github.com/openshift/azure-file-csi-driver/pull/124)
* [Full changelog](https://github.com/openshift/azure-file-csi-driver/compare/c481e92ba74550bbd3134a9ae92ccef31de7f60c...b66940c2459bdd503270d758e92057c89b798c6d)
### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/5367d3988bf7c629254ef77dbbbea058f48fdc47)
* [CNTRLPLANE-3380](https://issues.redhat.com/browse/CNTRLPLANE-3380): Merge https://github.com/Azure/kubernetes-kms:master (126fb87) into main [#42](https://github.com/openshift/azure-kubernetes-kms/pull/42)
* [CNTRLPLANE-3380](https://issues.redhat.com/browse/CNTRLPLANE-3380): Add rebasebot-compatible commit prefixes [#41](https://github.com/openshift/azure-kubernetes-kms/pull/41)
* [CNTRLPLANE-3380](https://issues.redhat.com/browse/CNTRLPLANE-3380): Update OWNERS with HyperShift core team [#35](https://github.com/openshift/azure-kubernetes-kms/pull/35)
* [CNTRLPLANE-3204](https://issues.redhat.com/browse/CNTRLPLANE-3204): feat: add workload identity support to Azure KMS plugin [#33](https://github.com/openshift/azure-kubernetes-kms/pull/33)
* [CNTRLPLANE-3358](https://issues.redhat.com/browse/CNTRLPLANE-3358): Sync with upstream Azure/kubernetes-kms [#32](https://github.com/openshift/azure-kubernetes-kms/pull/32)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/99b9a3a33d8edfd0a2d2876aa7ef1382b2c75a39...5367d3988bf7c629254ef77dbbbea058f48fdc47)
### [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure/tree/1a6c2d105dcab368367faeddd90a0f418dcdb93d)
* [PIXAA-7](https://issues.redhat.com/browse/PIXAA-7): Leverage SpotRebalanceRecommendation for instance termination when available [#196](https://github.com/openshift/machine-api-provider-azure/pull/196)
* [OCPBUGS-85416](https://issues.redhat.com/browse/OCPBUGS-85416): Don't permanently fail Machines after provisioning [#193](https://github.com/openshift/machine-api-provider-azure/pull/193)
* NO-JIRA: Update OWNERS [#190](https://github.com/openshift/machine-api-provider-azure/pull/190)
* [OCPCLOUD-3280](https://issues.redhat.com/browse/OCPCLOUD-3280): Bump k8s 1.35 [#189](https://github.com/openshift/machine-api-provider-azure/pull/189)
* [Full changelog](https://github.com/openshift/machine-api-provider-azure/compare/178e7d8a482261b7cfb09019deffa55cefe6ec1d...1a6c2d105dcab368367faeddd90a0f418dcdb93d)
### [azure-service-operator](https://github.com/openshift/azure-service-operator/tree/0827c1fb110ea136fc7abb7b3ac8be062335d00d)
* [OCPBUGS-83613](https://issues.redhat.com/browse/OCPBUGS-83613): Bump grpc package for CVE fix [#21](https://github.com/openshift/azure-service-operator/pull/21)
* [OCPBUGS-69898](https://issues.redhat.com/browse/OCPBUGS-69898): Updating ose-azure-service-operator-container image to be consistent with ART for 4.22 [#16](https://github.com/openshift/azure-service-operator/pull/16)
* NO-JIRA: UPSTREAM: <carry>: add openshift/e2e-tests.sh [#22](https://github.com/openshift/azure-service-operator/pull/22)
* NO-JIRA: Update OWNERS [#20](https://github.com/openshift/azure-service-operator/pull/20)
* [Full changelog](https://github.com/openshift/azure-service-operator/compare/17e574628ee7ef8aa694cfc0ab5e5232b651fbf8...0827c1fb110ea136fc7abb7b3ac8be062335d00d)
### [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity/tree/7b44f75681bf053805a9cff468149b0fe7cf1e33)
* [OCPBUGS-84709](https://issues.redhat.com/browse/OCPBUGS-84709): github.com/go-jose/go-jose/v4 v4.1.4 [#46](https://github.com/openshift/azure-workload-identity/pull/46)
* [CCO-785](https://issues.redhat.com/browse/CCO-785): add flag to configure TLS cipher suites [#44](https://github.com/openshift/azure-workload-identity/pull/44)
* [Full changelog](https://github.com/openshift/azure-workload-identity/compare/d71abde3bdf99ca81d7bc032a0c23f3468e1b37c...7b44f75681bf053805a9cff468149b0fe7cf1e33)
### [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3/tree/986fd4de877f197710e1a3ac9ea2a9de3824928f)
* [OCPBUGS-86476](https://issues.redhat.com/browse/OCPBUGS-86476): Adopt existing Metal3 Remediation CRDs on upgrade [#82](https://github.com/openshift/cluster-api-provider-metal3/pull/82)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#79](https://github.com/openshift/cluster-api-provider-metal3/pull/79)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#74](https://github.com/openshift/cluster-api-provider-metal3/pull/74)
* NO-JIRA: Update manifests generator [#75](https://github.com/openshift/cluster-api-provider-metal3/pull/75)
* [Full changelog](https://github.com/openshift/cluster-api-provider-metal3/compare/ad4eb8a5e67dc08c0686f006641847df4370d599...986fd4de877f197710e1a3ac9ea2a9de3824928f)
### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/b052deaf4378b6efcde486796d88aa8c834059c8)
* fix: OCPBUGS-86012: reset associatedVCenter in failure domain validation loop [#10559](https://github.com/openshift/installer/pull/10559)
* [OCPBUGS-87169](https://issues.redhat.com/browse/OCPBUGS-87169): CVE-2026-34986: Bump go-jose/v4 to 4.1.4 [#10596](https://github.com/openshift/installer/pull/10596)
* [MCO-2296](https://issues.redhat.com/browse/MCO-2296): Remove OSImageStreams v1 replace [#10592](https://github.com/openshift/installer/pull/10592)
* [MCO-2296](https://issues.redhat.com/browse/MCO-2296): OSImageStreams v1 promotion [#10566](https://github.com/openshift/installer/pull/10566)
* no-jira: remove reference to altinfra [#10585](https://github.com/openshift/installer/pull/10585)
* no-jira: improve AI agent readiness with guidelines and AGENTS.md [#10474](https://github.com/openshift/installer/pull/10474)
* [OCPBUGS-85352](https://issues.redhat.com/browse/OCPBUGS-85352): aws: fix Route 53 resource leak during cluster destroy in China regions [#10544](https://github.com/openshift/installer/pull/10544)
* [MCO-2200](https://issues.redhat.com/browse/MCO-2200): Add day-0 dual streams support for ABI install flow [#10481](https://github.com/openshift/installer/pull/10481)
* no-jira: logging: log invoked openshift-install command [#10490](https://github.com/openshift/installer/pull/10490)
* NO-ISSUE: Use types.OSImageStreamValues for validation [#10576](https://github.com/openshift/installer/pull/10576)
* [CORS-4495](https://issues.redhat.com/browse/CORS-4495): Populate RHCOS10 Marketplace Stream [#10556](https://github.com/openshift/installer/pull/10556)
* [MCO-2181](https://issues.redhat.com/browse/MCO-2181): Set OSImageStream default in install-config [#10570](https://github.com/openshift/installer/pull/10570)
* [OCPBUGS-84656](https://issues.redhat.com/browse/OCPBUGS-84656): Update RHCOS-release-4.22 bootimage metadata to 10.2.20260423-0 / 9.8.20260428-0 [#10524](https://github.com/openshift/installer/pull/10524)
* no-jira: PowerVS: Remove unrequired logging [#10552](https://github.com/openshift/installer/pull/10552)
* [CORS-4005](https://issues.redhat.com/browse/CORS-4005): refactor worker manifest serialization [#10407](https://github.com/openshift/installer/pull/10407)
* [OCPEDGE-2115](https://issues.redhat.com/browse/OCPEDGE-2115): types: support MAC address as alternative identifier for fencing credential [#10513](https://github.com/openshift/installer/pull/10513)
* [METAL-1731](https://issues.redhat.com/browse/METAL-1731): baremetal: Add coreos.openshift.io/stream label to BMH and hostSelector [#10502](https://github.com/openshift/installer/pull/10502)
* [OCPBUGS-78126](https://issues.redhat.com/browse/OCPBUGS-78126): baremetal: fix gather bootstrap failing with provisioningNetwork Disabled [#10395](https://github.com/openshift/installer/pull/10395)
* [SPLAT-2452](https://issues.redhat.com/browse/SPLAT-2452): Add SetSecurityGroups IAM permission to master nodes for BYO SG support for AWS NLBs [#10512](https://github.com/openshift/installer/pull/10512)
* [MCO-2164](https://issues.redhat.com/browse/MCO-2164): use machine-config-osimagestream to avoid hard-coding image tag names [#10416](https://github.com/openshift/installer/pull/10416)
* no-jira: images: bump UPI image dependencies to 4.22 [#10538](https://github.com/openshift/installer/pull/10538)
* [MCO-2200](https://issues.redhat.com/browse/MCO-2200): refactored node-joiner to use embedded rhcos data [#10537](https://github.com/openshift/installer/pull/10537)
* [OCPBUGS-79536](https://issues.redhat.com/browse/OCPBUGS-79536): Removing AWS security group OVNDB ports as they are no longer used [#10441](https://github.com/openshift/installer/pull/10441)
* [OCPBUGS-85232](https://issues.redhat.com/browse/OCPBUGS-85232): PowerVS: Add port 80 security group rule [#10541](https://github.com/openshift/installer/pull/10541)
* no-jira: tests: verify AWS instance type minimum cpu and mem requirement tests [#10536](https://github.com/openshift/installer/pull/10536)
* NO-JIRA: pkg/types/nutanix: warn about unused context [#10430](https://github.com/openshift/installer/pull/10430)
* [SPLAT-2710](https://issues.redhat.com/browse/SPLAT-2710): Added vSphere day 2 support [#10529](https://github.com/openshift/installer/pull/10529)
* [OCPBUGS-67159](https://issues.redhat.com/browse/OCPBUGS-67159): openstack: Reserve addresses for load balancer [#10375](https://github.com/openshift/installer/pull/10375)
* [OCPBUGS-77760](https://issues.redhat.com/browse/OCPBUGS-77760): verify FIPS mode after installation completes [#10348](https://github.com/openshift/installer/pull/10348)
* [OCPBUGS-84873](https://issues.redhat.com/browse/OCPBUGS-84873): Fix to agent integration test finding agent-tui files [#10530](https://github.com/openshift/installer/pull/10530)
* [OCPBUGS-84335](https://issues.redhat.com/browse/OCPBUGS-84335): vSphere - Missing unit tests to cover polarion workitems [#10516](https://github.com/openshift/installer/pull/10516)
* [OCPBUGS-84548](https://issues.redhat.com/browse/OCPBUGS-84548): add unit tests for Nutanix to replace polarion workitems [#10520](https://github.com/openshift/installer/pull/10520)
* no-jira: update to Google Cloud SDK 563.0.0 [#10460](https://github.com/openshift/installer/pull/10460)
* [MULTIARCH-5824](https://issues.redhat.com/browse/MULTIARCH-5824): PowerVS: Fix supported system types retrieval for PowerVS regions [#10268](https://github.com/openshift/installer/pull/10268)
* [CORS-3933](https://issues.redhat.com/browse/CORS-3933): Add a retry backoff for checking storage in progress [#10463](https://github.com/openshift/installer/pull/10463)
* [SPLAT-2719](https://issues.redhat.com/browse/SPLAT-2719): vsphere - remove HostGroup zonal feature gate checks [#10497](https://github.com/openshift/installer/pull/10497)
* [OCPEDGE-2255](https://issues.redhat.com/browse/OCPEDGE-2255): baremetal: reject SNO installation on baremetal platform [#10420](https://github.com/openshift/installer/pull/10420)
* [OCPBUGS-78932](https://issues.redhat.com/browse/OCPBUGS-78932): Improved DHCP network deletion reliability by proactively cleaning up attached network interfaces before retrying deletion [#10325](https://github.com/openshift/installer/pull/10325)
* [OCPBUGS-83327](https://issues.redhat.com/browse/OCPBUGS-83327): PowerVS: update CAPI to v0.12.2 [#10488](https://github.com/openshift/installer/pull/10488)
* [OCPBUGS-83335](https://issues.redhat.com/browse/OCPBUGS-83335): dont save CAPI secrets [#10498](https://github.com/openshift/installer/pull/10498)
* [AGENT-1417](https://issues.redhat.com/browse/AGENT-1417): Add kind verification in InternalReleaseImage check [#10332](https://github.com/openshift/installer/pull/10332)
* [MULTIARCH-5854](https://issues.redhat.com/browse/MULTIARCH-5854): implements retry-after logic to limit failures [#10421](https://github.com/openshift/installer/pull/10421)
* [OCPBUGS-78151](https://issues.redhat.com/browse/OCPBUGS-78151): Add provisioningNetworkGateway field to install-config [#10387](https://github.com/openshift/installer/pull/10387)
* [OCPBUGS-77965](https://issues.redhat.com/browse/OCPBUGS-77965): Update RHCOS-release-4.22 bootimage metadata to 10.2.20260405-0 / 9.8.20260403-0 [#10482](https://github.com/openshift/installer/pull/10482)
* [OCPBUGS-77917](https://issues.redhat.com/browse/OCPBUGS-77917): PowerVS: Use short regions and provide a default resource group in survey [#10369](https://github.com/openshift/installer/pull/10369)
* [CORS-3900](https://issues.redhat.com/browse/CORS-3900): Add IPv6 frontend IP configurations for dual-stack [#10328](https://github.com/openshift/installer/pull/10328)
* [MCO-2135](https://issues.redhat.com/browse/MCO-2135): Label Machines, MachineSets, and ControlPaneMachineSets with OSStream labels [#10426](https://github.com/openshift/installer/pull/10426)
* [OCPBUGS-81509](https://issues.redhat.com/browse/OCPBUGS-81509): fix ASO CRD duplication [#10451](https://github.com/openshift/installer/pull/10451)
* [OCPBUGS-76468](https://issues.redhat.com/browse/OCPBUGS-76468): PowerVS:: SSH key must be RSA [#10289](https://github.com/openshift/installer/pull/10289)
* no-jira: PowerVS: add mjturek and hamzy to approvers list [#10483](https://github.com/openshift/installer/pull/10483)
* [OCPEDGE-2072](https://issues.redhat.com/browse/OCPEDGE-2072): bump(ocp/api): pull in latest for DualReplica promotion [#10471](https://github.com/openshift/installer/pull/10471)
* [OCPBUGS-77830](https://issues.redhat.com/browse/OCPBUGS-77830): skip redirect when validating endpoint accessibility [#10360](https://github.com/openshift/installer/pull/10360)
* [OCPBUGS-81622](https://issues.redhat.com/browse/OCPBUGS-81622): Collect bootstrap service records in agent-gather [#10457](https://github.com/openshift/installer/pull/10457)
* [AGENT-1448](https://issues.redhat.com/browse/AGENT-1448): Add IRI registry authentication support [#10389](https://github.com/openshift/installer/pull/10389)
* [OCPBUGS-81635](https://issues.redhat.com/browse/OCPBUGS-81635): AWS: Increase cluster bootstrap timeout with userProvisioned DNS [#10459](https://github.com/openshift/installer/pull/10459)
* [CORS-4373](https://issues.redhat.com/browse/CORS-4373): Remove checks for AzureClusterHostedDNSInstall featuregate [#10455](https://github.com/openshift/installer/pull/10455)
* [CORS-4316](https://issues.redhat.com/browse/CORS-4316): Update the Installer GCP UPI documentation. [#10235](https://github.com/openshift/installer/pull/10235)
* [OCPBUGS-81309](https://issues.redhat.com/browse/OCPBUGS-81309): Fix vSphere with static IPs on TPNU [#10442](https://github.com/openshift/installer/pull/10442)
* [OCPBUGS-79542](https://issues.redhat.com/browse/OCPBUGS-79542): Mount pullsecret manifest to UI container [#10411](https://github.com/openshift/installer/pull/10411)
* [OCPBUGS-81470](https://issues.redhat.com/browse/OCPBUGS-81470): Restart sshd after applying node-image to bootstrap [#10452](https://github.com/openshift/installer/pull/10452)
* [OCPBUGS-37587](https://issues.redhat.com/browse/OCPBUGS-37587): Sign blob container using user delegated creds [#9851](https://github.com/openshift/installer/pull/9851)
* [SPLAT-2622](https://issues.redhat.com/browse/SPLAT-2622): Bump govmomi to v0.53.0 [#10431](https://github.com/openshift/installer/pull/10431)
* [OCPBUGS-78935](https://issues.redhat.com/browse/OCPBUGS-78935): Fix bootstrap VM on non-x86 platforms [#10419](https://github.com/openshift/installer/pull/10419)
* [CORS-4352](https://issues.redhat.com/browse/CORS-4352): aws: validations to ensure install-config is valid for dualstack install [#10380](https://github.com/openshift/installer/pull/10380)
* [OCPBUGS-74528](https://issues.redhat.com/browse/OCPBUGS-74528): upkeep: remove tna feature gate [#10403](https://github.com/openshift/installer/pull/10403)
* NO-JIRA: Add Ella, Daniel to openstack-reviewers [#10434](https://github.com/openshift/installer/pull/10434)
* [CORS-4324](https://issues.redhat.com/browse/CORS-4324): Update default release image to 4.22 [#10429](https://github.com/openshift/installer/pull/10429)
* [OCPBUGS-78589](https://issues.redhat.com/browse/OCPBUGS-78589): baremetal: add serial console logging for bootstrap VM [#10400](https://github.com/openshift/installer/pull/10400)
* [CORS-4359](https://issues.redhat.com/browse/CORS-4359): feature gate install into EU Sovereign Cloud [#10412](https://github.com/openshift/installer/pull/10412)
* [OCPBUGS-59514](https://issues.redhat.com/browse/OCPBUGS-59514): redacted install config for baremetal [#9972](https://github.com/openshift/installer/pull/9972)
* [AGENT-1461](https://issues.redhat.com/browse/AGENT-1461): Do not discard NMStateConfig when agent-config is on disk for unconfigured-ignition [#10393](https://github.com/openshift/installer/pull/10393)
* [AGENT-1471](https://issues.redhat.com/browse/AGENT-1471): Fix race condition: wait for agent-register-infraenv before showing UI URL [#10422](https://github.com/openshift/installer/pull/10422)
* [MCO-2116](https://issues.redhat.com/browse/MCO-2116): Generate OSImageStream manifest [#10357](https://github.com/openshift/installer/pull/10357)
* [AGENT-1136](https://issues.redhat.com/browse/AGENT-1136), [AGENT-1229](https://issues.redhat.com/browse/AGENT-1229): Add auth to unconfigured-ignition [#10381](https://github.com/openshift/installer/pull/10381)
* [SPLAT-2172](https://issues.redhat.com/browse/SPLAT-2172): AWS dedicate host support [#10079](https://github.com/openshift/installer/pull/10079)
* [MCO-2133](https://issues.redhat.com/browse/MCO-2133): Select bootimages based on OSImageStream [#10321](https://github.com/openshift/installer/pull/10321)
* [CORS-4336](https://issues.redhat.com/browse/CORS-4336): Support for AWS European Sovereign Cloud [#10303](https://github.com/openshift/installer/pull/10303)
* [OCPBUGS-74390](https://issues.redhat.com/browse/OCPBUGS-74390): Allow all instance types in the install config for GCP [#10271](https://github.com/openshift/installer/pull/10271)
* no-jira: fix SC2328 shellcheck errors [#10413](https://github.com/openshift/installer/pull/10413)
* [AGENT-1458](https://issues.redhat.com/browse/AGENT-1458): Don't auto-calculate RendezvousIP in unconfigured-ignition [#10405](https://github.com/openshift/installer/pull/10405)
* [CORS-4358](https://issues.redhat.com/browse/CORS-4358): aws: add ICMPv6 ingress rule for dual-stack clusters [#10408](https://github.com/openshift/installer/pull/10408)
* [CORS-4235](https://issues.redhat.com/browse/CORS-4235): Machine Management API Field & Feature Gate [#10402](https://github.com/openshift/installer/pull/10402)
* no-jira: bump golangci-lint to v2.10.1 for Go 1.25 support [#10397](https://github.com/openshift/installer/pull/10397)
* [OCPBUGS-57603](https://issues.redhat.com/browse/OCPBUGS-57603): Disallow cross subscription encryption sets [#10335](https://github.com/openshift/installer/pull/10335)
* [Full changelog](https://github.com/openshift/installer/compare/b3e61d061e160258d453636ce39fb642ca2988d3...b052deaf4378b6efcde486796d88aa8c834059c8)
### [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal/tree/f2b0db1919fff1344bc68948894c6775c0bf24a3)
* [OCPBUGS-87380](https://issues.redhat.com/browse/OCPBUGS-87380): Updating baremetal-machine-controller-container image to be consistent with ART for 5.0 [#256](https://github.com/openshift/cluster-api-provider-baremetal/pull/256)
* [Full changelog](https://github.com/openshift/cluster-api-provider-baremetal/compare/8d863b9505a5cfc0b01e33f985a3edf9d3c69f4b...f2b0db1919fff1344bc68948894c6775c0bf24a3)
### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/7a005472c3461a960aa983a325eddc504f836365)
* NO-ISSUE: Merge upstream [#483](https://github.com/openshift/baremetal-operator/pull/483)
* [OCPBUGS-66071](https://issues.redhat.com/browse/OCPBUGS-66071): Fix PPI for ACM [#456](https://github.com/openshift/baremetal-operator/pull/456)
* [OCPBUGS-64617](https://issues.redhat.com/browse/OCPBUGS-64617): Merge upstream [#473](https://github.com/openshift/baremetal-operator/pull/473)
* [Full changelog](https://github.com/openshift/baremetal-operator/compare/fb6a6d51c2e5b4d56e3be1a225d1c45029b05ce0...7a005472c3461a960aa983a325eddc504f836365)
### [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg/tree/cf62f8c7ac7494096e99997a53ceb48e997c1273)
* NO-ISSUE: Bump go to fix security vulnerabilities [#389](https://github.com/openshift/baremetal-runtimecfg/pull/389)
* [OPNET-709](https://issues.redhat.com/browse/OPNET-709): Migrate from iptables to nftables [#387](https://github.com/openshift/baremetal-runtimecfg/pull/387)
* [Full changelog](https://github.com/openshift/baremetal-runtimecfg/compare/4215243a628dc74624416ab46f7ebc8b93404a38...cf62f8c7ac7494096e99997a53ceb48e997c1273)
### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/d1f312bb855e741cadb8b3ac419d2cb3f3fd7ba5)
* [OCPBUGS-87198](https://issues.redhat.com/browse/OCPBUGS-87198): Fix windows builds of oc rpm [#2281](https://github.com/openshift/oc/pull/2281)
* NO-JIRA: Switch container dependencies to Podman monorepo [#2277](https://github.com/openshift/oc/pull/2277)
* NO-JIRA: Bump go-jose dependency [#2269](https://github.com/openshift/oc/pull/2269)
* NO-JIRA: Making oc cli case blocking [#2260](https://github.com/openshift/oc/pull/2260)
* [OCPBUGS-62799](https://issues.redhat.com/browse/OCPBUGS-62799): Add required-scc annotation to node-joiner pod [#2230](https://github.com/openshift/oc/pull/2230)
* [OTA-1817](https://issues.redhat.com/browse/OTA-1817): Adding unit tests for the extend recommended alerts [#2262](https://github.com/openshift/oc/pull/2262)
* [OCPBUGS-78768](https://issues.redhat.com/browse/OCPBUGS-78768): Skip filter validation for RFC2307 group query when groupUIDAttribute is "dn" [#2259](https://github.com/openshift/oc/pull/2259)
* [RFE-3594](https://issues.redhat.com/browse/RFE-3594): Add group membership info [#2255](https://github.com/openshift/oc/pull/2255)
* NO-JIRA: claude: Change learn-* agents into skills [#2257](https://github.com/openshift/oc/pull/2257)
* NO-JIRA: claude: Improve AGENTS.md and add agents for storing project knowledge [#2251](https://github.com/openshift/oc/pull/2251)
* NO-JIRA: claude: Split tester agent away from code-reviewer [#2250](https://github.com/openshift/oc/pull/2250)
* [OCPBUGS-77845](https://issues.redhat.com/browse/OCPBUGS-77845): Fix extraction of gated manifests using --install-config [#2249](https://github.com/openshift/oc/pull/2249)
* NO-ISSUE: recover the context in upgrade [#2248](https://github.com/openshift/oc/pull/2248)
* NO-JIRA: claude: Turn pr-review skill into code-reviewer agent [#2245](https://github.com/openshift/oc/pull/2245)
* [OCPBUGS-59311](https://issues.redhat.com/browse/OCPBUGS-59311): must-gather: Handle signals properly [#2237](https://github.com/openshift/oc/pull/2237)
* [OTA-1548](https://issues.redhat.com/browse/OTA-1548): set up accepted risks [#2170](https://github.com/openshift/oc/pull/2170)
* [MCO-1961](https://issues.redhat.com/browse/MCO-1961): Allow multiple machine-os versions [#2157](https://github.com/openshift/oc/pull/2157)
* Revert "TRT-2587: Revert #2219 "CNTRLPLANE-2769: Bump k8s dependencies to 1.35"" [#2241](https://github.com/openshift/oc/pull/2241)
* [TRT-2587](https://issues.redhat.com/browse/TRT-2587): Revert #2219 "CNTRLPLANE-2769: Bump k8s dependencies to 1.35" [#2236](https://github.com/openshift/oc/pull/2236)
* [TRT-2585](https://issues.redhat.com/browse/TRT-2585): pkg/cli/admin/release/extract: Support zero-output extraction [#2233](https://github.com/openshift/oc/pull/2233)
* [OCPBUGS-78701](https://issues.redhat.com/browse/OCPBUGS-78701): adm policy add-role-to-user: Fix --dry-run=server [#2231](https://github.com/openshift/oc/pull/2231)
* [OCPBUGS-77845](https://issues.redhat.com/browse/OCPBUGS-77845): Update release extract inclusion to support feature gates and major version [#2222](https://github.com/openshift/oc/pull/2222)
* NO-ISSUE: pkg/cli/admin/release/extract: Read manifests into memory [#2232](https://github.com/openshift/oc/pull/2232)
* NO-JIRA: Add .coderabbit.yaml and AGENTS.md configurations [#2229](https://github.com/openshift/oc/pull/2229)
* [CNTRLPLANE-2769](https://issues.redhat.com/browse/CNTRLPLANE-2769): Bump k8s dependencies to 1.35 [#2219](https://github.com/openshift/oc/pull/2219)
* And 2 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/oc/compare/cb542c5177b98b84b1ae921bee0d1e264b9ca00c...d1f312bb855e741cadb8b3ac419d2cb3f3fd7ba5)
### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/833d9a3e986b917d22e063444031b3a1bda3195f)
* [OCPBUGS-82165](https://issues.redhat.com/browse/OCPBUGS-82165): Add retry logic for concurrent IAM policy changes in GCP [#1014](https://github.com/openshift/cloud-credential-operator/pull/1014)
* [OCPBUGS-58181](https://issues.redhat.com/browse/OCPBUGS-58181): Fix nil pointer dereference in ensureRolesAssignedToManagedIdentity [#987](https://github.com/openshift/cloud-credential-operator/pull/987)
* [CCO-683](https://issues.redhat.com/browse/CCO-683): Remove go-autorest dependency for Azure Stack Cloud configuration [#1024](https://github.com/openshift/cloud-credential-operator/pull/1024)
* [CCO-845](https://issues.redhat.com/browse/CCO-845): use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs [#1019](https://github.com/openshift/cloud-credential-operator/pull/1019)
* [CCO-770](https://issues.redhat.com/browse/CCO-770): Docs: consolidate and simplify short-term token workflows [#986](https://github.com/openshift/cloud-credential-operator/pull/986)
* [CCO-711](https://issues.redhat.com/browse/CCO-711): docs: improve the filter when getting the capi pod [#1016](https://github.com/openshift/cloud-credential-operator/pull/1016)
* [OCPBUGS-84712](https://issues.redhat.com/browse/OCPBUGS-84712): github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 [#1021](https://github.com/openshift/cloud-credential-operator/pull/1021)
* [OCPBUGS-84043](https://issues.redhat.com/browse/OCPBUGS-84043): go.opentelemetry.io/otel v1.43.0 [#1011](https://github.com/openshift/cloud-credential-operator/pull/1011)
* [OCPBUGS-84044](https://issues.redhat.com/browse/OCPBUGS-84044): github.com/go-jose/go-jose/v4 v4.1.4 [#1012](https://github.com/openshift/cloud-credential-operator/pull/1012)
* [OCPBUGS-83449](https://issues.redhat.com/browse/OCPBUGS-83449): test-ext: hypershift skip CCO metrics endpoint validation [#1010](https://github.com/openshift/cloud-credential-operator/pull/1010)
* [CCO-738](https://issues.redhat.com/browse/CCO-738), [CCO-739](https://issues.redhat.com/browse/CCO-739), [CCO-740](https://issues.redhat.com/browse/CCO-740): Overhaul status logic to correctly match spec [#1008](https://github.com/openshift/cloud-credential-operator/pull/1008)
* [CCO-787](https://issues.redhat.com/browse/CCO-787): use apiserver tls config [#965](https://github.com/openshift/cloud-credential-operator/pull/965)
* [CCO-824](https://issues.redhat.com/browse/CCO-824): feat(gcp): add key-storage-method flag for workload identity providers [#1004](https://github.com/openshift/cloud-credential-operator/pull/1004)
* [CCO-779](https://issues.redhat.com/browse/CCO-779): e2e for removing kube-rbac-proxy container (CCO-779) [#991](https://github.com/openshift/cloud-credential-operator/pull/991)
* [OCPBUGS-81584](https://issues.redhat.com/browse/OCPBUGS-81584): Skip CCO health check test for PowerVS platform [#1006](https://github.com/openshift/cloud-credential-operator/pull/1006)
* [OCPBUGS-81328](https://issues.redhat.com/browse/OCPBUGS-81328): tests-ext: Fix MicroShift gating in CCO tests [#1005](https://github.com/openshift/cloud-credential-operator/pull/1005)
* Revert #978: CCO-738, CCO-739: Set operator condition to Progressing when pod identity webhook pod are updating [#1007](https://github.com/openshift/cloud-credential-operator/pull/1007)
* [CORS-4361](https://issues.redhat.com/browse/CORS-4361): aws: add aws-eusc partition support for OIDC S3 buckets [#995](https://github.com/openshift/cloud-credential-operator/pull/995)
* [CCO-738](https://issues.redhat.com/browse/CCO-738), [CCO-739](https://issues.redhat.com/browse/CCO-739): Set operator condition to Progressing when pod identity webhook pod are updating [#978](https://github.com/openshift/cloud-credential-operator/pull/978)
* [OCPBUGS-79360](https://issues.redhat.com/browse/OCPBUGS-79360): google.golang.org/grpc v1.79.3 [#992](https://github.com/openshift/cloud-credential-operator/pull/992)
* [CCO-788](https://issues.redhat.com/browse/CCO-788): Remove kube-rbac-proxy container from metrics [#983](https://github.com/openshift/cloud-credential-operator/pull/983)
* [OCPBUGS-74627](https://issues.redhat.com/browse/OCPBUGS-74627): Fix infrastructure resource name filtering in watch predicate [#985](https://github.com/openshift/cloud-credential-operator/pull/985)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/b2352140c0e275094b48c1af2de5edc6bc0cd68f...833d9a3e986b917d22e063444031b3a1bda3195f)
### [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller/tree/2d69ad953cfaa419e9b6221da9edb152ded91e0b)
* [OCPBUGS-74496](https://issues.redhat.com/browse/OCPBUGS-74496): Add UserAgent to Azure SDK client telemetry options [#208](https://github.com/openshift/cloud-network-config-controller/pull/208)
* [Full changelog](https://github.com/openshift/cloud-network-config-controller/compare/6f38237490a1e94ac13a2240caa48457c0a3bfd8...2d69ad953cfaa419e9b6221da9edb152ded91e0b)
### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/abbfbd5314f9803b638abe05946acad1e7eea6fa)
* [CNTRLPLANE-3226](https://issues.redhat.com/browse/CNTRLPLANE-3226): switch to real Vault KMS plugin in CI [#909](https://github.com/openshift/cluster-authentication-operator/pull/909)
* [CNTRLPLANE-3226](https://issues.redhat.com/browse/CNTRLPLANE-3226): bump library-go to get KMS plugin credentials [#903](https://github.com/openshift/cluster-authentication-operator/pull/903)
* NO-JIRA: Automatic agentic rebase: Update library-go to d8750ed [#908](https://github.com/openshift/cluster-authentication-operator/pull/908)
* NO-JIRA: Automatic agentic rebase: Update library-go to 0cf249e [#907](https://github.com/openshift/cluster-authentication-operator/pull/907)
* [CNTRLPLANE-3364](https://issues.redhat.com/browse/CNTRLPLANE-3364): remove the old go lib std tests [#906](https://github.com/openshift/cluster-authentication-operator/pull/906)
* NO-JIRA: bump latest library-go changes [#904](https://github.com/openshift/cluster-authentication-operator/pull/904)
* NO-JIRA: remove old mock plugin deployment [#902](https://github.com/openshift/cluster-authentication-operator/pull/902)
* [CNTRLPLANE-3236](https://issues.redhat.com/browse/CNTRLPLANE-3236): support deploying Vault mock KMS plugin [#899](https://github.com/openshift/cluster-authentication-operator/pull/899)
* [CNTRLPLANE-3431](https://issues.redhat.com/browse/CNTRLPLANE-3431): restart operator upon config change [#897](https://github.com/openshift/cluster-authentication-operator/pull/897)
* NO-JIRA: Bump auth with latest library-go changes [#900](https://github.com/openshift/cluster-authentication-operator/pull/900)
* [CNTRLPLANE-3210](https://issues.redhat.com/browse/CNTRLPLANE-3210): Refactor `externaloidc` controller to support different configuration generation logic [#893](https://github.com/openshift/cluster-authentication-operator/pull/893)
* [CNTRLPLANE-3364](https://issues.redhat.com/browse/CNTRLPLANE-3364): add the kms suite and migrate the kms tests of auth-o to ote [#895](https://github.com/openshift/cluster-authentication-operator/pull/895)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): Bump library-go and sync plugin changes [#896](https://github.com/openshift/cluster-authentication-operator/pull/896)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): Bump library-go and sync encryption tests with APIServerEncryption struct change [#894](https://github.com/openshift/cluster-authentication-operator/pull/894)
* [CNTRLPLANE-3431](https://issues.redhat.com/browse/CNTRLPLANE-3431): enable tls config injection [#892](https://github.com/openshift/cluster-authentication-operator/pull/892)
* NO-JIRA: Bump latest library-go changes [#890](https://github.com/openshift/cluster-authentication-operator/pull/890)
* [OCPBUGS-69977](https://issues.redhat.com/browse/OCPBUGS-69977): Fix OAuth page showing OKD branding instead of OpenShift [#887](https://github.com/openshift/cluster-authentication-operator/pull/887)
* [OCPBUGS-84951](https://issues.redhat.com/browse/OCPBUGS-84951): Fix terminationMessagePolicy on network policy e2e test pods [#882](https://github.com/openshift/cluster-authentication-operator/pull/882)
* NO-JIRA: Update library-go for latest changes [#873](https://github.com/openshift/cluster-authentication-operator/pull/873)
* [CNTRLPLANE-2523](https://issues.redhat.com/browse/CNTRLPLANE-2523): deploy oauth-apiserver in new OIDC mode when authentication type is OIDC [#858](https://github.com/openshift/cluster-authentication-operator/pull/858)
* NO-JIRA: Add control-plane-approvers to OWNERS [#871](https://github.com/openshift/cluster-authentication-operator/pull/871)
* [CNTRLPLANE-2625](https://issues.redhat.com/browse/CNTRLPLANE-2625): Add Auth network policy e2e cases [#831](https://github.com/openshift/cluster-authentication-operator/pull/831)
* [OCPBUGS-78403](https://issues.redhat.com/browse/OCPBUGS-78403): Do not return error when an IdP returns 500 during a grant check [#856](https://github.com/openshift/cluster-authentication-operator/pull/856)
* Revert "CNTRLPLANE-2589: Migrate test/e2e-encryption to Ginkgo v2 framework" [#857](https://github.com/openshift/cluster-authentication-operator/pull/857)
* [CNTRLPLANE-2589](https://issues.redhat.com/browse/CNTRLPLANE-2589): Migrate test/e2e-encryption to Ginkgo v2 framework [#839](https://github.com/openshift/cluster-authentication-operator/pull/839)
* NO-JIRA: OWNERS: add everettraven as reviewer/approver add ibihim as approver [#842](https://github.com/openshift/cluster-authentication-operator/pull/842)
* [CNTRLPLANE-2610](https://issues.redhat.com/browse/CNTRLPLANE-2610): Create network policies for AUTH components [#825](https://github.com/openshift/cluster-authentication-operator/pull/825)
* [CNTRLPLANE-2990](https://issues.redhat.com/browse/CNTRLPLANE-2990): Update CAO to no longer write to the `Authentication.spec.webhookTokenAuthenticator` field [#854](https://github.com/openshift/cluster-authentication-operator/pull/854)
* [CNTRLPLANE-2996](https://issues.redhat.com/browse/CNTRLPLANE-2996): dependencies: k8s 1.35 rebase [#853](https://github.com/openshift/cluster-authentication-operator/pull/853)
* [CNTRLPLANE-2552](https://issues.redhat.com/browse/CNTRLPLANE-2552): Add support for CEL expression claim mappings for username and groups [#850](https://github.com/openshift/cluster-authentication-operator/pull/850)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/0ad22f8e435095a3e21b3825a685d5edafed5b26...abbfbd5314f9803b638abe05946acad1e7eea6fa)
### [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler/tree/02af1a9fd6bcb87745979980fbbf9a2b0671dddb)
* [OCPBUGS-84130](https://issues.redhat.com/browse/OCPBUGS-84130): UPSTREAM: 9458: fix(clusterapi): use kind-aware version discovery for infra references [#418](https://github.com/openshift/kubernetes-autoscaler/pull/418)
* NO-JIRA: ignore tool and hack files in .snyk scans [#416](https://github.com/openshift/kubernetes-autoscaler/pull/416)
* [OCPBUGS-78152](https://issues.redhat.com/browse/OCPBUGS-78152): allow clusterapi provider to skip paused resources [#409](https://github.com/openshift/kubernetes-autoscaler/pull/409)
* [Full changelog](https://github.com/openshift/kubernetes-autoscaler/compare/b03eb2aa84f7aa18cd12b2f34f6eeafc43ff478b...02af1a9fd6bcb87745979980fbbf9a2b0671dddb)
### [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator/tree/825c44c051df38bbf98c9fcc885a0288204edfe1)
* [OCPBUGS-52155](https://issues.redhat.com/browse/OCPBUGS-52155): Add machinesets to cluster operator related objects [#369](https://github.com/openshift/cluster-autoscaler-operator/pull/369)
* [AUTOSCALE-660](https://issues.redhat.com/browse/AUTOSCALE-660): add enforce node group min size flag [#374](https://github.com/openshift/cluster-autoscaler-operator/pull/374)
* [OCPBUGS-65578](https://issues.redhat.com/browse/OCPBUGS-65578): report Progressing=True on version upgrade [#366](https://github.com/openshift/cluster-autoscaler-operator/pull/366)
* [AUTOSCALE-560](https://issues.redhat.com/browse/AUTOSCALE-560): Add support for using centralized cluster TLS profile for webhook service [#367](https://github.com/openshift/cluster-autoscaler-operator/pull/367)
* [OCPBUGS-78797](https://issues.redhat.com/browse/OCPBUGS-78797): update rbac to include DRA-related resources [#365](https://github.com/openshift/cluster-autoscaler-operator/pull/365)
* [Full changelog](https://github.com/openshift/cluster-autoscaler-operator/compare/66f5155da617e809550ec5cf65676d0958b2ed50...825c44c051df38bbf98c9fcc885a0288204edfe1)
### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/ad7efaabc975e8318056ee74986dec3d135914ed)
* [OCPBUGS-84934](https://issues.redhat.com/browse/OCPBUGS-84934): Add watcher for both TLS Adherence policy and profile changes [#597](https://github.com/openshift/cluster-baremetal-operator/pull/597)
* [OCPBUGS-85824](https://issues.redhat.com/browse/OCPBUGS-85824): Fix empty IRONIC_BASE_URL [#603](https://github.com/openshift/cluster-baremetal-operator/pull/603)
* [OCPBUGS-85496](https://issues.redhat.com/browse/OCPBUGS-85496): Fix webhook to validate the actual admission request object [#601](https://github.com/openshift/cluster-baremetal-operator/pull/601)
* [OCPBUGS-82526](https://issues.redhat.com/browse/OCPBUGS-82526): Fix webhook server not starting due to missing WithValidator [#587](https://github.com/openshift/cluster-baremetal-operator/pull/587)
* [OCPBUGS-82531](https://issues.redhat.com/browse/OCPBUGS-82531): Bind the plain HTTP 8080 metrics port to localhost [#586](https://github.com/openshift/cluster-baremetal-operator/pull/586)
* [OCPBUGS-83612](https://issues.redhat.com/browse/OCPBUGS-83612): Fix image-cache to use HTTPS for metal3-state downloads [#592](https://github.com/openshift/cluster-baremetal-operator/pull/592)
* [OCPBUGS-78151](https://issues.redhat.com/browse/OCPBUGS-78151): Add provisioningNetworkGateway field to CBO [#575](https://github.com/openshift/cluster-baremetal-operator/pull/575)
* [METAL-1715](https://issues.redhat.com/browse/METAL-1715): Enforce 1-year validity and 30-day auto-rotation for Ironic TLS certs [#570](https://github.com/openshift/cluster-baremetal-operator/pull/570)
* [METAL-1780](https://issues.redhat.com/browse/METAL-1780): Gate TLS profile enforcement on APIServer tlsAdherence field [#582](https://github.com/openshift/cluster-baremetal-operator/pull/582)
* [METAL-1720](https://issues.redhat.com/browse/METAL-1720): Add IRONIC_ROOTFS_URL env var for multi-arch rootfs override [#583](https://github.com/openshift/cluster-baremetal-operator/pull/583)
* [METAL-1716](https://issues.redhat.com/browse/METAL-1716): Handle IPv6/dual-stack addresses in certificate SANs [#573](https://github.com/openshift/cluster-baremetal-operator/pull/573)
* NO-ISSUE: Update envtest version [#580](https://github.com/openshift/cluster-baremetal-operator/pull/580)
* [METAL-1720](https://issues.redhat.com/browse/METAL-1720): Add DEPLOY_KERNEL env var for image-customization-controller [#581](https://github.com/openshift/cluster-baremetal-operator/pull/581)
* [METAL-1734](https://issues.redhat.com/browse/METAL-1734): Add support for centralized tls [#572](https://github.com/openshift/cluster-baremetal-operator/pull/572)
* [METAL-1714](https://issues.redhat.com/browse/METAL-1714): Populate complete SANs in Ironic TLS certificate [#569](https://github.com/openshift/cluster-baremetal-operator/pull/569)
* [OCPBUGS-69399](https://issues.redhat.com/browse/OCPBUGS-69399): Allow ProvisioningCIDR for unmanaged network [#553](https://github.com/openshift/cluster-baremetal-operator/pull/553)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/aff20f178671ebc3df3f4bdee4b7e04e69dc42f7...ad7efaabc975e8318056ee74986dec3d135914ed)
### [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap/tree/7b1593a47898b6a97dc457efaca464624e9f2afa)
* [OCPBUGS-73886](https://issues.redhat.com/browse/OCPBUGS-73886): Fix typo in logs [#125](https://github.com/openshift/cluster-bootstrap/pull/125)
* NO-JIRA: Add control-plane-approvers to OWNERS [#127](https://github.com/openshift/cluster-bootstrap/pull/127)
* [OCPBUGS-69694](https://issues.redhat.com/browse/OCPBUGS-69694): Updating ose-cluster-bootstrap-container image to be consistent with ART for 4.22 [#124](https://github.com/openshift/cluster-bootstrap/pull/124)
* [Full changelog](https://github.com/openshift/cluster-bootstrap/compare/dc0d4a5cdaf8a7477cab584208dc99352f46efe2...7b1593a47898b6a97dc457efaca464624e9f2afa)
### [cluster-capi-controllers](https://github.com/openshift/cluster-api/tree/0a73a6858bf14e1b82d2c7477dbb392d882f6a21)
* [OCPBUGS-53005](https://issues.redhat.com/browse/OCPBUGS-53005): Remove references to master branch [#235](https://github.com/openshift/cluster-api/pull/235)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#292](https://github.com/openshift/cluster-api/pull/292)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#290](https://github.com/openshift/cluster-api/pull/290)
* NO-JIRA: Update manifests generator [#287](https://github.com/openshift/cluster-api/pull/287)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api:v1.12.7 (b5fa593) into master [#286](https://github.com/openshift/cluster-api/pull/286)
* [OCPCLOUD-3419](https://issues.redhat.com/browse/OCPCLOUD-3419): Adopt IPAM CRDs on upgrade [#274](https://github.com/openshift/cluster-api/pull/274)
* [OCPBUGS-83513](https://issues.redhat.com/browse/OCPBUGS-83513): Merge https://github.com/kubernetes-sigs/cluster-api:v1.12.5 (efc7142) into master [#275](https://github.com/openshift/cluster-api/pull/275)
* NO-JIRA: Update OWNERS [#278](https://github.com/openshift/cluster-api/pull/278)
* NO-JIRA: IPAM CRDs: Use negated feature-gate: -ClusterAPIMachineManagement instead of feature-set: Default [#273](https://github.com/openshift/cluster-api/pull/273)
* [OCPCLOUD-3291](https://issues.redhat.com/browse/OCPCLOUD-3291): Merge https://github.com/kubernetes-sigs/cluster-api:v1.12.4 (8c01d2f5) into master [#255](https://github.com/openshift/cluster-api/pull/255)
* [OCPCLOUD-3320](https://issues.redhat.com/browse/OCPCLOUD-3320): Fix continuous reconciliation of cluster-api manifests [#269](https://github.com/openshift/cluster-api/pull/269)
* [Full changelog](https://github.com/openshift/cluster-api/compare/54cf5acda5d2742d180b5ae327b0babf61e11cb5...0a73a6858bf14e1b82d2c7477dbb392d882f6a21)
### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/05c113ea5edd0aaf43e34c4a534a673d457449c1)
* NO-JIRA: build: add podman support to container image targets [#580](https://github.com/openshift/cluster-capi-operator/pull/580)
* NO-JIRA: Fix flake in infracluster test [#578](https://github.com/openshift/cluster-capi-operator/pull/578)
* NO-JIRA: fix shell compatibility in Makefile [#572](https://github.com/openshift/cluster-capi-operator/pull/572)
* [OCPBUGS-85530](https://issues.redhat.com/browse/OCPBUGS-85530): Fix failure to start on arm64 [#571](https://github.com/openshift/cluster-capi-operator/pull/571)
* NO-JIRA: Remove stale TODO comment for HostPlacement conversion [#569](https://github.com/openshift/cluster-capi-operator/pull/569)
* NO-JIRA: Allow sustaining engineering to self serve dependency updates [#553](https://github.com/openshift/cluster-capi-operator/pull/553)
* [OCPBUGS-84815](https://issues.redhat.com/browse/OCPBUGS-84815): fix: scope webhook to capi namespace, remove unused webhook endpoints [#543](https://github.com/openshift/cluster-capi-operator/pull/543)
* [OCPCLOUD-2664](https://issues.redhat.com/browse/OCPCLOUD-2664): Update operatorstatus to write correct sub-Conditions [#552](https://github.com/openshift/cluster-capi-operator/pull/552)
* [OCPCLOUD-3429](https://issues.redhat.com/browse/OCPCLOUD-3429): Mount provider images with image volumes [#527](https://github.com/openshift/cluster-capi-operator/pull/527)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#544](https://github.com/openshift/cluster-capi-operator/pull/544)
* [OCPBUGS-84673](https://issues.redhat.com/browse/OCPBUGS-84673): fix: remove retired Microsoft.ClassicStorage permission [#547](https://github.com/openshift/cluster-capi-operator/pull/547)
* NO-JIRA: bump controller-runtime-common to latest main [#540](https://github.com/openshift/cluster-capi-operator/pull/540)
* NO-JIRA: Updates gemini powered skills / agents [#542](https://github.com/openshift/cluster-capi-operator/pull/542)
* NO-JIRA: manifests-gen: set scc annotation in providers Deployments spec [#524](https://github.com/openshift/cluster-capi-operator/pull/524)
* NO-JIRA: Adds deep review skill [#541](https://github.com/openshift/cluster-capi-operator/pull/541)
* NO-JIRA: fix: re-enable setting/diffing httpProtocolIpv6, CAPA now supports it [#537](https://github.com/openshift/cluster-capi-operator/pull/537)
* NO-JIRA: fix: conversion: handle HTTPProtocolIPv6, temporarily disable its diffing [#531](https://github.com/openshift/cluster-capi-operator/pull/531)
* [OCPBUGS-84378](https://issues.redhat.com/browse/OCPBUGS-84378): Refactor e2e newAWSMachineTemplate to use mapi2capi [#532](https://github.com/openshift/cluster-capi-operator/pull/532)
* [OCPBUGS-84340](https://issues.redhat.com/browse/OCPBUGS-84340): Fix e2e flake when workers are in us-west-2b [#529](https://github.com/openshift/cluster-capi-operator/pull/529)
* NO-JIRA: fix: tolerate not-found upon infra machine deletion [#528](https://github.com/openshift/cluster-capi-operator/pull/528)
* NO-JIRA: Update e2e diagnostics [#488](https://github.com/openshift/cluster-capi-operator/pull/488)
* [OCPCLOUD-3345](https://issues.redhat.com/browse/OCPCLOUD-3345), [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add support for TLS envsubst substitution [#519](https://github.com/openshift/cluster-capi-operator/pull/519)
* [OCPBUGS-83601](https://issues.redhat.com/browse/OCPBUGS-83601): Bump grpc package for CVE fix [#523](https://github.com/openshift/cluster-capi-operator/pull/523)
* NO-JIRA: Fix crdcompatibility flakes after webhook creation [#525](https://github.com/openshift/cluster-capi-operator/pull/525)
* NO-JIRA: Update OWNERS [#522](https://github.com/openshift/cluster-capi-operator/pull/522)
* NO-JIRA: Optimize envtest CRD loading by specifying necessary files explicitly [#520](https://github.com/openshift/cluster-capi-operator/pull/520)
* [OCPCLOUD-3319](https://issues.redhat.com/browse/OCPCLOUD-3319): Remove capiinstaller controller [#507](https://github.com/openshift/cluster-capi-operator/pull/507)
* [OCPCLOUD-3419](https://issues.redhat.com/browse/OCPCLOUD-3419): Add adopt-existing annotation [#514](https://github.com/openshift/cluster-capi-operator/pull/514)
* NO-JIRA: Fix flake in object pruning envtests [#516](https://github.com/openshift/cluster-capi-operator/pull/516)
* [OCPBUGS-80922](https://issues.redhat.com/browse/OCPBUGS-80922): Add CVO proxy injection annotation to capi-operator Deployment [#518](https://github.com/openshift/cluster-capi-operator/pull/518)
* [OCPBUGS-81683](https://issues.redhat.com/browse/OCPBUGS-81683): fix: remove Microsoft.Resourcehealth/healthevent permission [#515](https://github.com/openshift/cluster-capi-operator/pull/515)
* NO-JIRA: Add ClusterAPI singleton to related objects [#508](https://github.com/openshift/cluster-capi-operator/pull/508)
* [OCPCLOUD-3365](https://issues.redhat.com/browse/OCPCLOUD-3365), [OCPCLOUD-3384](https://issues.redhat.com/browse/OCPCLOUD-3384): Implement admission action Warn and ensure validations not active when not configured [#492](https://github.com/openshift/cluster-capi-operator/pull/492)
* [OCPCLOUD-3321](https://issues.redhat.com/browse/OCPCLOUD-3321), [OSASINFRA-3980](https://issues.redhat.com/browse/OSASINFRA-3980): Add openstack-resource-controller image to images.json [#506](https://github.com/openshift/cluster-capi-operator/pull/506)
* [OCPCLOUD-3319](https://issues.redhat.com/browse/OCPCLOUD-3319): Create installer controller [#494](https://github.com/openshift/cluster-capi-operator/pull/494)
* NO-JIRA: Fix 2 failures in ci jobs [#485](https://github.com/openshift/cluster-capi-operator/pull/485)
* [SPLAT-2167](https://issues.redhat.com/browse/SPLAT-2167): Added dedicated host support for AWS [#374](https://github.com/openshift/cluster-capi-operator/pull/374)
* [OCPCLOUD-3319](https://issues.redhat.com/browse/OCPCLOUD-3319): Convert ReconcileResult to use a builder pattern [#501](https://github.com/openshift/cluster-capi-operator/pull/501)
* [OCPCLOUD-3319](https://issues.redhat.com/browse/OCPCLOUD-3319): Simplify RelatedObjects on the cluster-api ClusterOperator [#497](https://github.com/openshift/cluster-capi-operator/pull/497)
* NO-JIRA: Common provider manifest fixtures [#498](https://github.com/openshift/cluster-capi-operator/pull/498)
* NO-JIRA: Drop unused replace manifests-gen [#504](https://github.com/openshift/cluster-capi-operator/pull/504)
* [OCPBUGS-77188](https://issues.redhat.com/browse/OCPBUGS-77188): Fix CRD Requirement deployment on SNO [#502](https://github.com/openshift/cluster-capi-operator/pull/502)
* NO-JIRA: Move ProviderMetadata into manifests-gen [#503](https://github.com/openshift/cluster-capi-operator/pull/503)
* NO-JIRA: Fix malformed VAP [#499](https://github.com/openshift/cluster-capi-operator/pull/499)
* NO-JIRA: Instruct agents more forcefully to run tests with make unit [#496](https://github.com/openshift/cluster-capi-operator/pull/496)
* [OCPCLOUD-3319](https://issues.redhat.com/browse/OCPCLOUD-3319): Bump controller-runtime to v0.23 [#495](https://github.com/openshift/cluster-capi-operator/pull/495)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/c0e1cefb5d1232d8de2477581b8a17048aef1d02...05c113ea5edd0aaf43e34c4a534a673d457449c1)
### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/a9cbda8731035e6abf577e6840d3bd2f4c7a075c)
* [OCPBUGS-86303](https://issues.redhat.com/browse/OCPBUGS-86303): e2e/ote-ccm-aws: enhance tests to run hybrid in hypershift HC [#464](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/464)
* NO-JIRA: update owners for CCM-AWS OTE path for SPLAT teeam [#468](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/468)
* [OCPBUGS-42837](https://issues.redhat.com/browse/OCPBUGS-42837): Do not set Degraded=True on transient errors [#436](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/436)
* [OCPBUGS-86299](https://issues.redhat.com/browse/OCPBUGS-86299): e2e/ccm-aws-ote: support to dual-stack IPv6 primary [#466](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/466)
* [OCPBUGS-85414](https://issues.redhat.com/browse/OCPBUGS-85414): fix ote ccm aws e2e resiliency on HCP [#462](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/462)
* [OCPCLOUD-3436](https://issues.redhat.com/browse/OCPCLOUD-3436): use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs [#457](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/457)
* [SPLAT-2651](https://issues.redhat.com/browse/SPLAT-2651): Added support to manage kube-cloud-config for vSphere in openshift-config-managed [#442](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/442)
* NO-JIRA: fix: add pod annotation: openshift.io/required-scc: hostaccess [#450](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/450)
* NO-JIRA: bump controller-runtime-common to latest main [#456](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/456)
* [SPLAT-2562](https://issues.redhat.com/browse/SPLAT-2562): Refactored OTE and added new 3CMO OTE binary [#446](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/446)
* [OCPBUGS-83399](https://issues.redhat.com/browse/OCPBUGS-83399): e2e/ote/ccm-aws fix hairpin traffic on NLB and CLB in EUSC [#449](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/449)
* NO-JIRA: Update OWNERS [#448](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/448)
* NO-JIRA: fix: report all degraded controller conditions instead of first only#444 [#444](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/444)
* [OCPCLOUD-3348](https://issues.redhat.com/browse/OCPCLOUD-3348): Honor TLSAdherence [#440](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/440)
* [SPLAT-2672](https://issues.redhat.com/browse/SPLAT-2672): e2e/ote/ccm-aws: moving OTE binary from CCM-AWS [#437](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/437)
* [OCPBUGS-78118](https://issues.redhat.com/browse/OCPBUGS-78118): Add delete permission for Azure load balancers in credentials request [#438](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/438)
* [OCPCLOUD-3287](https://issues.redhat.com/browse/OCPCLOUD-3287): Update to k8s 1.35.1 dependencies [#439](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/439)
* [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/b1082464bff54680dea0df95d6e5f1aa3ce313b7...a9cbda8731035e6abf577e6840d3bd2f4c7a075c)
### [cluster-config-api](https://github.com/openshift/api/tree/1194f4c62539275cd6dec231cc2bf7e0a010bd94)
* [OCPEDGE-2410](https://issues.redhat.com/browse/OCPEDGE-2410): feat: add mutable topology featuregate [#2872](https://github.com/openshift/api/pull/2872)
* Add KubeletConfigAccepted const in 'machineconfiguration/v1/types.go' [#2853](https://github.com/openshift/api/pull/2853)
* [MON-4029](https://issues.redhat.com/browse/MON-4029): Add KubeStateMetricsConfig to ClusterMonitoring API [#2778](https://github.com/openshift/api/pull/2778)
* [MCO-2296](https://issues.redhat.com/browse/MCO-2296): Promote OSImageStreams to v1 [#2854](https://github.com/openshift/api/pull/2854)
* [MON-4565](https://issues.redhat.com/browse/MON-4565): Add enableUserAlertmanagerConfig to ClusterMonitoring API [#2855](https://github.com/openshift/api/pull/2855)
* Update getLatestReleases to ignore non OCP releases [#2868](https://github.com/openshift/api/pull/2868)
* [NE-2334](https://issues.redhat.com/browse/NE-2334): Implement enhancement in OpenShift API to support for TLS curves in TLSProfile [#2583](https://github.com/openshift/api/pull/2583)
* Revert "Merge pull request #2693 from jcmoraisjr/OCPBUGS-74511-remove… [#2862](https://github.com/openshift/api/pull/2862)
* [CNTRLPLANE-2521](https://issues.redhat.com/browse/CNTRLPLANE-2521): feat: configv1/authentication: add fields for sourcing claims from external sources [#2827](https://github.com/openshift/api/pull/2827)
* [MON-4578](https://issues.redhat.com/browse/MON-4578): Add new fields to ThanosQuerierConfig [#2835](https://github.com/openshift/api/pull/2835)
* [CNTRLPLANE-3361](https://issues.redhat.com/browse/CNTRLPLANE-3361): make transitMount required [#2847](https://github.com/openshift/api/pull/2847)
* [MON-4579](https://issues.redhat.com/browse/MON-4579): Remove NodeSelector and Tolerations from NodeExporterConfig [#2837](https://github.com/openshift/api/pull/2837)
* [CORENET-6714](https://issues.redhat.com/browse/CORENET-6714): Enable Network Observability on Day 0 [#2752](https://github.com/openshift/api/pull/2752)
* [OCPBUGS-74511](https://issues.redhat.com/browse/OCPBUGS-74511): remove RouteExternalCertificate feature gate [#2693](https://github.com/openshift/api/pull/2693)
* [CNTRLPLANE-3361](https://issues.redhat.com/browse/CNTRLPLANE-3361): update vault kms plugin validation [#2836](https://github.com/openshift/api/pull/2836)
* [OCPSTRAT-3036](https://issues.redhat.com/browse/OCPSTRAT-3036): Promote MutatingAdmissionPolicy feature to Default [#2832](https://github.com/openshift/api/pull/2832)
* [OPRUN-4590](https://issues.redhat.com/browse/OPRUN-4590): Add OLMLifecycleAndCompatibility feature gate [#2824](https://github.com/openshift/api/pull/2824)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): Rename KMSConfig Struct to KMSPluginConfig [#2833](https://github.com/openshift/api/pull/2833)
* [SRVKP-11558](https://issues.redhat.com/browse/SRVKP-11558): remove deprecated k8s.io/api packages removed in v0.36.0 [#2834](https://github.com/openshift/api/pull/2834)
* [CORENET-6861](https://issues.redhat.com/browse/CORENET-6861): Promote EVPN Feature Gate [#2799](https://github.com/openshift/api/pull/2799)
* Revert "OCPBUGS-83492: Allow :ref suffix in additionalLayerStores path for stargz-store to support lazy image pulling" [#2823](https://github.com/openshift/api/pull/2823)
* [MON-4561](https://issues.redhat.com/browse/MON-4561): API: Add softirqs node-exporter collector to ClusterMonitoring CRD [#2825](https://github.com/openshift/api/pull/2825)
* Clarify cluster operator Progressing condition [#2829](https://github.com/openshift/api/pull/2829)
* [OCPNODE-4498](https://issues.redhat.com/browse/OCPNODE-4498): features: drop DRAPartitionableDevices awareness [#2828](https://github.com/openshift/api/pull/2828)
* [OCPBUGS-43353](https://issues.redhat.com/browse/OCPBUGS-43353): Add pattern validation for registry entries in image config [#2787](https://github.com/openshift/api/pull/2787)
* [SPLAT-2649](https://issues.redhat.com/browse/SPLAT-2649): Added vSphere Day 2 logic to CRDs [#2784](https://github.com/openshift/api/pull/2784)
* [OCPBUGS-74506](https://issues.redhat.com/browse/OCPBUGS-74506): Remove ConsolePluginSecurityPolicy featuregate [#2683](https://github.com/openshift/api/pull/2683)
* [CNTRLPLANE-2711](https://issues.redhat.com/browse/CNTRLPLANE-2711): add vault kms plug configuration api [#2805](https://github.com/openshift/api/pull/2805)
* [OCPBUGS-74525](https://issues.redhat.com/browse/OCPBUGS-74525): OCPBUGS-74526: Remove UserNamespacesPodSecurityStandards and UserNamespacesSupport [#2762](https://github.com/openshift/api/pull/2762)
* [OCPBUGS-82584](https://issues.redhat.com/browse/OCPBUGS-82584): Add labelSelector to MachineSet status for scale subresource [#2807](https://github.com/openshift/api/pull/2807)
* [OCPBUGS-83754](https://issues.redhat.com/browse/OCPBUGS-83754): fix(config/v1): define constants for authentication types as typed constants [#2814](https://github.com/openshift/api/pull/2814)
* [OCPBUGS-83492](https://issues.redhat.com/browse/OCPBUGS-83492): Allow :ref suffix in additionalLayerStores path for stargz-store to support lazy image pulling [#2806](https://github.com/openshift/api/pull/2806)
* [MON-4037](https://issues.redhat.com/browse/MON-4037): Add MonitoringPluginConfig to ClusterMonitoring API [#2768](https://github.com/openshift/api/pull/2768)
* fix: small typos in comments in types.go [#2804](https://github.com/openshift/api/pull/2804)
* [OCPBUGS-82292](https://issues.redhat.com/browse/OCPBUGS-82292): extend supported values for MCN IRI image status field [#2800](https://github.com/openshift/api/pull/2800)
* [MON-4036](https://issues.redhat.com/browse/MON-4036): Add NodeExporterConfig to ClusterMonitoring API [#2744](https://github.com/openshift/api/pull/2744)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add component names, manifestSubstitutions, and observedGeneration to CAPI revisions [#2786](https://github.com/openshift/api/pull/2786)
* [MON-4035](https://issues.redhat.com/browse/MON-4035): Add ThanosQuerierConfig to ClusterMonitoring API [#2769](https://github.com/openshift/api/pull/2769)
* [NE-2520](https://issues.redhat.com/browse/NE-2520): Promote GatewayAPIWithoutOLM to GA [#2772](https://github.com/openshift/api/pull/2772)
* [OCPEDGE-2197](https://issues.redhat.com/browse/OCPEDGE-2197): Promote TNF (Dual Replica) to default [#2723](https://github.com/openshift/api/pull/2723)
* [OCPBUGS-81627](https://issues.redhat.com/browse/OCPBUGS-81627): Load ClusterResourceQuota CRD before CVO manifests [#2796](https://github.com/openshift/api/pull/2796)
* [OCPEDGE-2492](https://issues.redhat.com/browse/OCPEDGE-2492): feat: promote pacemaker to v1 in prep for tnf [#2792](https://github.com/openshift/api/pull/2792)
* Update verify-feature-promotion HTML output to sort entries and fix overflow [#2793](https://github.com/openshift/api/pull/2793)
* Include candidate tier in default sippy queries for feature promotion [#2789](https://github.com/openshift/api/pull/2789)
* [CNTRLPLANE-2796](https://issues.redhat.com/browse/CNTRLPLANE-2796): promote the event-ttl feature [#2722](https://github.com/openshift/api/pull/2722)
* [OCPBUGS-74533](https://issues.redhat.com/browse/OCPBUGS-74533): Remove GCPClusterHostedDNSInstall featuregate [#2776](https://github.com/openshift/api/pull/2776)
* NO-ISSUE: Fixes KubeletConfig API doc, adds tests and kubebuilder validation [#2651](https://github.com/openshift/api/pull/2651)
* [CORS-4365](https://issues.redhat.com/browse/CORS-4365): Promote AzureClusterHostedDNSInstall to default [#2774](https://github.com/openshift/api/pull/2774)
* Add ConfidentialCluster feature gate [#2779](https://github.com/openshift/api/pull/2779)
* [SPLAT-2664](https://issues.redhat.com/browse/SPLAT-2664): Added new feature gate VSphereMultiVCenterDay2 [#2783](https://github.com/openshift/api/pull/2783)
* [CNTRLPLANE-3115](https://issues.redhat.com/browse/CNTRLPLANE-3115): Add envtest releases for 4.15 and 4.16 [#2785](https://github.com/openshift/api/pull/2785)
* [CNTRLPLANE-2777](https://issues.redhat.com/browse/CNTRLPLANE-2777): add TypeMeta to GenericControllerConfig [#2780](https://github.com/openshift/api/pull/2780)
* tools: codegen: increase sippy request timeout for feature promotion verification [#2782](https://github.com/openshift/api/pull/2782)
* [MON-4036](https://issues.redhat.com/browse/MON-4036): Add TelemeterClientConfig to ClusterMonitoring API [#2755](https://github.com/openshift/api/pull/2755)
* Allow JobTier=candidate in featuregate-test-analyzer with warning [#2781](https://github.com/openshift/api/pull/2781)
* [SPLAT-2320](https://issues.redhat.com/browse/SPLAT-2320): vsphere vm-host zonal ga [#2731](https://github.com/openshift/api/pull/2731)
* [NE-2512](https://issues.redhat.com/browse/NE-2512): operator/ingress: Add configurationManagement option [#2757](https://github.com/openshift/api/pull/2757)
* [CORS-4337](https://issues.redhat.com/browse/CORS-4337): allow AWS Europe Sovereign Cloud partition [#2708](https://github.com/openshift/api/pull/2708)
* [AGENT-1473](https://issues.redhat.com/browse/AGENT-1473): add InternalReleaseImageDegraded state type for MachineConfigNodeStatus Conditions field [#2777](https://github.com/openshift/api/pull/2777)
* [CNTRLPLANE-3010](https://issues.redhat.com/browse/CNTRLPLANE-3010): Add API-side validation to enforce prefixPolicy is not set when username expression is used [#2771](https://github.com/openshift/api/pull/2771)
* [OCPBUGS-74528](https://issues.redhat.com/browse/OCPBUGS-74528): upkeep: HighlyAvailableArbiter has been GA for 2 releases [#2759](https://github.com/openshift/api/pull/2759)
* Improve feature-gated CEL validation merge semantics [#2770](https://github.com/openshift/api/pull/2770)
* [OPRUN-4513](https://issues.redhat.com/browse/OPRUN-4513): Move OLMv1 Single/Own Namespace support back to TP [#2766](https://github.com/openshift/api/pull/2766)
* [CORENET-6390](https://issues.redhat.com/browse/CORENET-6390): API changes and feature gate for OVN-Kubernetes no-overlay mode [#2537](https://github.com/openshift/api/pull/2537)
* [OPRUN-4466](https://issues.redhat.com/browse/OPRUN-4466): Add NewOLMConfigAPI feature gate [#2756](https://github.com/openshift/api/pull/2756)
* Add TLS adherence feature gate [#2680](https://github.com/openshift/api/pull/2680)
* [TRT-2518](https://issues.redhat.com/browse/TRT-2518): Add variant OS and JobTier to promotion check [#2763](https://github.com/openshift/api/pull/2763)
* [MCO-2142](https://issues.redhat.com/browse/MCO-2142): Avoid OSImageStream defaultStream unset [#2764](https://github.com/openshift/api/pull/2764)
* [Full changelog](https://github.com/openshift/api/compare/b3c6104577797f804d921ac05ad91aa4186818f2...1194f4c62539275cd6dec231cc2bf7e0a010bd94)
### [cluster-config-operator](https://github.com/openshift/cluster-config-operator/tree/2697a43188018b6e76a5acbd672d59bc2f77b79e)
* [CNTRLPLANE-3423](https://issues.redhat.com/browse/CNTRLPLANE-3423): feat: have CVO inject the centralized TLS configuration into the operator's config [#491](https://github.com/openshift/cluster-config-operator/pull/491)
* [SPLAT-2747](https://issues.redhat.com/browse/SPLAT-2747): Updated kube cloud config controller to react to feature gate updates [#489](https://github.com/openshift/cluster-config-operator/pull/489)
* [SPLAT-2717](https://issues.redhat.com/browse/SPLAT-2717): Migrate vSphere sync of kube-cloud-config to 3CMO [#481](https://github.com/openshift/cluster-config-operator/pull/481)
* [CNTRLPLANE-1544](https://issues.redhat.com/browse/CNTRLPLANE-1544): manifests: Use restricted-v3 scc for deployment [#451](https://github.com/openshift/cluster-config-operator/pull/451)
* [OCPEDGE-2071](https://issues.redhat.com/browse/OCPEDGE-2071): bump(ocp/api): pull in latest for DualReplica promotion [#480](https://github.com/openshift/cluster-config-operator/pull/480)
* [OCPBUGS-74528](https://issues.redhat.com/browse/OCPBUGS-74528): bump: ocp/api ocp/libray-go [#475](https://github.com/openshift/cluster-config-operator/pull/475)
* [API-1646](https://issues.redhat.com/browse/API-1646): Add config-operator workload and namespaces network policies [#463](https://github.com/openshift/cluster-config-operator/pull/463)
* [OCPSTRAT-2876](https://issues.redhat.com/browse/OCPSTRAT-2876): Teach config operator to filter feature gate manifests by major version inclusion [#459](https://github.com/openshift/cluster-config-operator/pull/459)
* [Full changelog](https://github.com/openshift/cluster-config-operator/compare/9ac2336f38cda129355ff48ab76a97a545fd07ab...2697a43188018b6e76a5acbd672d59bc2f77b79e)
### [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator/tree/85f92f79174d6df783f631eb3187f0e11e89cc96)
* NO-JIRA: bump controller-runtime-common to latest main [#403](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/403)
* NO-JIRA: Update OWNERS [#399](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/399)
* [OCPCLOUD-3349](https://issues.redhat.com/browse/OCPCLOUD-3349): Honor TLS adherence, allow TLS overrides via flags [#398](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/398)
* [OCPCLOUD-3284](https://issues.redhat.com/browse/OCPCLOUD-3284): Bump to k8s 1.35 and associated deps. [#397](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/397)
* [Full changelog](https://github.com/openshift/cluster-control-plane-machine-set-operator/compare/fd6ee313ebfa9ae0c269d06942cf135a8f6b4d87...85f92f79174d6df783f631eb3187f0e11e89cc96)
### [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator/tree/108f37f0e378accc322cbeb68136ec500ec35b94)
* [OCPBUGS-82535](https://issues.redhat.com/browse/OCPBUGS-82535): Fix PDB unhealthyPodEvictionPolicy field name [#271](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/271)
* [STOR-2762](https://issues.redhat.com/browse/STOR-2762): Bump all deps for 4.22 [#270](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/270)
* [Full changelog](https://github.com/openshift/cluster-csi-snapshot-controller-operator/compare/74486094e54c300de15bc19cbdd7144a609ecbc3...108f37f0e378accc322cbeb68136ec500ec35b94)
### [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator/tree/65d60f9c12297a91ee89359e90f591fd44e661b0)
* [OCPBUGS-77532](https://issues.redhat.com/browse/OCPBUGS-77532): Fix premature node schedulability marking in taint checking [#470](https://github.com/openshift/cluster-dns-operator/pull/470)
* [OCPBUGS-78085](https://issues.redhat.com/browse/OCPBUGS-78085): Fix dual-stack service update by preserving IP families [#467](https://github.com/openshift/cluster-dns-operator/pull/467)
* [NE-2500](https://issues.redhat.com/browse/NE-2500): Added network policies for DNS [#468](https://github.com/openshift/cluster-dns-operator/pull/468)
* [Full changelog](https://github.com/openshift/cluster-dns-operator/compare/7709285a381bc9ca24f833bab4789d327a856440...65d60f9c12297a91ee89359e90f591fd44e661b0)
### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/2abd78c6f6e8315e53b2f40f4f6eca9a889ec3b9)
* [OCPBUGS-77345](https://issues.redhat.com/browse/OCPBUGS-77345): validate snapshot before destructive operations in cluster-restore-tnf.sh [#1626](https://github.com/openshift/cluster-etcd-operator/pull/1626)
* [OCPEDGE-2116](https://issues.redhat.com/browse/OCPEDGE-2116): feat: support MAC-address based fencing credentials lookup [#1600](https://github.com/openshift/cluster-etcd-operator/pull/1600)
* [OCPBUGS-83332](https://issues.redhat.com/browse/OCPBUGS-83332): fix cluster-restore-tnf.sh for FQDN hostnames [#1622](https://github.com/openshift/cluster-etcd-operator/pull/1622)
* NO-JIRA: Fixed spelling in files and file names [#1624](https://github.com/openshift/cluster-etcd-operator/pull/1624)
* [OCPEDGE-2604](https://issues.redhat.com/browse/OCPEDGE-2604), [OCPEDGE-2605](https://issues.redhat.com/browse/OCPEDGE-2605): feat: add update-fencing-credentials.sh script for TNF fencing credentials rotation [#1611](https://github.com/openshift/cluster-etcd-operator/pull/1611)
* [CNTRLPLANE-3392](https://issues.redhat.com/browse/CNTRLPLANE-3392): Migrating etcd otp cases to ote [#1612](https://github.com/openshift/cluster-etcd-operator/pull/1612)
* NO-JIRA: Replace bash env var validator with go implementation [#1606](https://github.com/openshift/cluster-etcd-operator/pull/1606)
* NO-JIRA: separate grpc from http server [#1598](https://github.com/openshift/cluster-etcd-operator/pull/1598)
* NO-JIRA: fix CI failure [#1599](https://github.com/openshift/cluster-etcd-operator/pull/1599)
* NO-JIRA: Refactor render test validation [#1597](https://github.com/openshift/cluster-etcd-operator/pull/1597)
* NO-JIRA: Add control-plane-approvers to OWNERS [#1594](https://github.com/openshift/cluster-etcd-operator/pull/1594)
* NO-JIRA: Apply `go fix` changes [#1589](https://github.com/openshift/cluster-etcd-operator/pull/1589)
* NO-JIRA: Remove unused lib/resourcemerge package [#1590](https://github.com/openshift/cluster-etcd-operator/pull/1590)
* [OCPEDGE-2495](https://issues.redhat.com/browse/OCPEDGE-2495): upkeep: bump ocp/api ocp/client-go [#1591](https://github.com/openshift/cluster-etcd-operator/pull/1591)
* [OCPBUGS-81340](https://issues.redhat.com/browse/OCPBUGS-81340): pacemaker CronJob: tune history limit and Job TTL [#1581](https://github.com/openshift/cluster-etcd-operator/pull/1581)
* [OCPEDGE-2495](https://issues.redhat.com/browse/OCPEDGE-2495): feat: update pacemaker in preparation for DualReplica promotion [#1587](https://github.com/openshift/cluster-etcd-operator/pull/1587)
* [OCPBUGS-81341](https://issues.redhat.com/browse/OCPBUGS-81341): fix: add correct annotations to stop update events [#1580](https://github.com/openshift/cluster-etcd-operator/pull/1580)
* [CNTRLPLANE-2621](https://issues.redhat.com/browse/CNTRLPLANE-2621): Restart operator when TLS config changes [#1556](https://github.com/openshift/cluster-etcd-operator/pull/1556)
* [OCPBUGS-80959](https://issues.redhat.com/browse/OCPBUGS-80959): fix(tnf): align Pacemaker kubelet and etcd retry pacing [#1578](https://github.com/openshift/cluster-etcd-operator/pull/1578)
* [CNTRLPLANE-2668](https://issues.redhat.com/browse/CNTRLPLANE-2668): Migrating go standard etcd cases to ote [#1575](https://github.com/openshift/cluster-etcd-operator/pull/1575)
* NO-JIRA: add Lance as a reviewer [#1576](https://github.com/openshift/cluster-etcd-operator/pull/1576)
* [OCPBUGS-78956](https://issues.redhat.com/browse/OCPBUGS-78956): Disable member cache for quorum checker in TNF [#1568](https://github.com/openshift/cluster-etcd-operator/pull/1568)
* [OCPBUGS-65626](https://issues.redhat.com/browse/OCPBUGS-65626): upgrade library-go to latest changes [#1566](https://github.com/openshift/cluster-etcd-operator/pull/1566)
* [OCPBUGS-78930](https://issues.redhat.com/browse/OCPBUGS-78930): add tnf jobs to network policy exceptions [#1574](https://github.com/openshift/cluster-etcd-operator/pull/1574)
* [ETCD-557](https://issues.redhat.com/browse/ETCD-557): Add e2e Network policy test cases [#1543](https://github.com/openshift/cluster-etcd-operator/pull/1543)
* Revert "OCPBUGS-77947: fix(tnf): do not block on stable revision after external etcd transition" [#1572](https://github.com/openshift/cluster-etcd-operator/pull/1572)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/1d06f661e488fc600c5af97b0bd14a6d4cc7f06d...2abd78c6f6e8315e53b2f40f4f6eca9a889ec3b9)
### [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator/tree/aee833aab65ab5a5aa29a04ca9a55bfb0c3e4fe3)
* [OCPBUGS-73768](https://issues.redhat.com/browse/OCPBUGS-73768): bugfix: podtemplatespec: update topology spread constraints [#1347](https://github.com/openshift/cluster-image-registry-operator/pull/1347)
* NO-JIRA: fix flaky TestGlobalTLSCopy unit test [#1341](https://github.com/openshift/cluster-image-registry-operator/pull/1341)
* [OCPBUGS-84725](https://issues.redhat.com/browse/OCPBUGS-84725): Fix stale config cache causing incorrect deployment [#1329](https://github.com/openshift/cluster-image-registry-operator/pull/1329)
* [OCPBUGS-63691](https://issues.redhat.com/browse/OCPBUGS-63691): replace node-ca shell script with go implementation [#1325](https://github.com/openshift/cluster-image-registry-operator/pull/1325)
* [IR-486](https://issues.redhat.com/browse/IR-486): use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs [#1326](https://github.com/openshift/cluster-image-registry-operator/pull/1326)
* NO-JIRA: Add control-plane-approvers to OWNERS [#1324](https://github.com/openshift/cluster-image-registry-operator/pull/1324)
* [OCPBUGS-83282](https://issues.redhat.com/browse/OCPBUGS-83282): Allow longer window before going Degraded [#1318](https://github.com/openshift/cluster-image-registry-operator/pull/1318)
* [CNTRLPLANE-2660](https://issues.redhat.com/browse/CNTRLPLANE-2660): e2e testing automation: Image Registry network policy [#1320](https://github.com/openshift/cluster-image-registry-operator/pull/1320)
* [OCPBUGS-66225](https://issues.redhat.com/browse/OCPBUGS-66225): ImageConfigController: add inertia before ImageConfigC… [#1319](https://github.com/openshift/cluster-image-registry-operator/pull/1319)
* [CNTRLPLANE-3184](https://issues.redhat.com/browse/CNTRLPLANE-3184): Create network policies for image-registry components [#1301](https://github.com/openshift/cluster-image-registry-operator/pull/1301)
* [OCPBUGS-81750](https://issues.redhat.com/browse/OCPBUGS-81750): Use deterministic S3 bucket naming to prevent orphaned buckets [#1317](https://github.com/openshift/cluster-image-registry-operator/pull/1317)
* [OCPBUGS-66225](https://issues.redhat.com/browse/OCPBUGS-66225): ImageConfigController: wait for ClusterVersion informe… [#1316](https://github.com/openshift/cluster-image-registry-operator/pull/1316)
* [OCPBUGS-66225](https://issues.redhat.com/browse/OCPBUGS-66225): fix degraded blip on stale config caches [#1304](https://github.com/openshift/cluster-image-registry-operator/pull/1304)
* [OCPBUGS-66225](https://issues.redhat.com/browse/OCPBUGS-66225): migrate to go 1.25 [#1305](https://github.com/openshift/cluster-image-registry-operator/pull/1305)
* [IR-350](https://issues.redhat.com/browse/IR-350): make metrics server tls configuration file-based [#1297](https://github.com/openshift/cluster-image-registry-operator/pull/1297)
* [Full changelog](https://github.com/openshift/cluster-image-registry-operator/compare/e000262ca78f9bc8dabff8dcfd3d163a37e29b51...aee833aab65ab5a5aa29a04ca9a55bfb0c3e4fe3)
### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/140e0bf13b3d01c369672c766c44b4be0b4ec78c)
* [OCPBUGS-36723](https://issues.redhat.com/browse/OCPBUGS-36723): Add missing include annotations to IBM Cloud and PowerVS ingress CredentialsRequests [#1457](https://github.com/openshift/cluster-ingress-operator/pull/1457)
* [NE-2723](https://issues.redhat.com/browse/NE-2723): Migrate to aws-sdk-go-v2 [#1445](https://github.com/openshift/cluster-ingress-operator/pull/1445)
* [OCPBUGS-85679](https://issues.redhat.com/browse/OCPBUGS-85679): Improve e2e tests reliability [#1434](https://github.com/openshift/cluster-ingress-operator/pull/1434)
* [OCPBUGS-85676](https://issues.redhat.com/browse/OCPBUGS-85676): Harden CRD permission RBAC in operator ClusterRole [#1454](https://github.com/openshift/cluster-ingress-operator/pull/1454)
* [OCPBUGS-74497](https://issues.redhat.com/browse/OCPBUGS-74497): Add UserAgent to Azure SDK client telemetry options [#1400](https://github.com/openshift/cluster-ingress-operator/pull/1400)
* [OCPBUGS-85690](https://issues.redhat.com/browse/OCPBUGS-85690): Add referencegrants and backendtlspolicies to Gateway API RBAC [#1453](https://github.com/openshift/cluster-ingress-operator/pull/1453)
* [OCPBUGS-84491](https://issues.redhat.com/browse/OCPBUGS-84491): Set terminationMessagePolicy on gateway proxy containers [#1428](https://github.com/openshift/cluster-ingress-operator/pull/1428)
* [OCPBUGS-83923](https://issues.redhat.com/browse/OCPBUGS-83923): Update grpc-go and x/net [#1447](https://github.com/openshift/cluster-ingress-operator/pull/1447)
* [NE-2662](https://issues.redhat.com/browse/NE-2662): use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs [#1431](https://github.com/openshift/cluster-ingress-operator/pull/1431)
* [OCPBUGS-80966](https://issues.redhat.com/browse/OCPBUGS-80966): Fix malformed PEM bundle when tls.crt lacks trailing newline [#1405](https://github.com/openshift/cluster-ingress-operator/pull/1405)
* [OCPBUGS-84773](https://issues.redhat.com/browse/OCPBUGS-84773): Allow host network connections to the ingress canary [#1430](https://github.com/openshift/cluster-ingress-operator/pull/1430)
* [OCPBUGS-81442](https://issues.redhat.com/browse/OCPBUGS-81442): TestUnsupportedConfigOverride: Ignore featuregate and defaults [#1408](https://github.com/openshift/cluster-ingress-operator/pull/1408)
* [OCPBUGS-84551](https://issues.redhat.com/browse/OCPBUGS-84551): isFIPSEnabled: Check FIPS_ENABLED env. var. first [#1427](https://github.com/openshift/cluster-ingress-operator/pull/1427)
* [OCPBUGS-54702](https://issues.redhat.com/browse/OCPBUGS-54702): change default timeout tunnel if using AWS NLB [#1349](https://github.com/openshift/cluster-ingress-operator/pull/1349)
* [OCPBUGS-81192](https://issues.redhat.com/browse/OCPBUGS-81192): Fix race condition in internal-to-external LB migration test [#1407](https://github.com/openshift/cluster-ingress-operator/pull/1407)
* [NE-2390](https://issues.redhat.com/browse/NE-2390): Adding AGENTS.md file [#1341](https://github.com/openshift/cluster-ingress-operator/pull/1341)
* [OCPBUGS-25739](https://issues.redhat.com/browse/OCPBUGS-25739): Fix PDB MaxUnavailable for 2-replica ingress controllers [#1380](https://github.com/openshift/cluster-ingress-operator/pull/1380)
* [OCPBUGS-81550](https://issues.redhat.com/browse/OCPBUGS-81550): AWS, Azure and GCP ClusterHostedDNS: Add Ingress LB IPs to Infra CR after masters up [#1411](https://github.com/openshift/cluster-ingress-operator/pull/1411)
* [OCPBUGS-76609](https://issues.redhat.com/browse/OCPBUGS-76609): Do not take over OSSM subscription [#1398](https://github.com/openshift/cluster-ingress-operator/pull/1398)
* [NE-2332](https://issues.redhat.com/browse/NE-2332): Implement ROUTER_CURVES environment variable [#1409](https://github.com/openshift/cluster-ingress-operator/pull/1409)
* [OCPBUGS-3917](https://issues.redhat.com/browse/OCPBUGS-3917): filter non-FIPS TLS 1.3 ciphers from ROUTER_CIPHERSUITES on FIPS clusters [#1401](https://github.com/openshift/cluster-ingress-operator/pull/1401)
* [NE-2501](https://issues.redhat.com/browse/NE-2501): Add network policies for ingress resources [#1392](https://github.com/openshift/cluster-ingress-operator/pull/1392)
* [OCPBUGS-79376](https://issues.redhat.com/browse/OCPBUGS-79376): Bump to OSSM 3.3.1 and Istio v1.28.5 [#1406](https://github.com/openshift/cluster-ingress-operator/pull/1406)
* [OCPBUGS-78541](https://issues.redhat.com/browse/OCPBUGS-78541): Move TestIngressControllerCustomEndpoints to run last [#1388](https://github.com/openshift/cluster-ingress-operator/pull/1388)
* [OCPBUGS-79467](https://issues.redhat.com/browse/OCPBUGS-79467): Change default log level from DEBUG to INFO [#1402](https://github.com/openshift/cluster-ingress-operator/pull/1402)
* [NE-2519](https://issues.redhat.com/browse/NE-2519): Move Sail Library to official release branch [#1404](https://github.com/openshift/cluster-ingress-operator/pull/1404)
* [NE-2523](https://issues.redhat.com/browse/NE-2523): Implement configurationManagement API [#1385](https://github.com/openshift/cluster-ingress-operator/pull/1385)
* [OCPBUGS-79667](https://issues.redhat.com/browse/OCPBUGS-79667): Use feature-gate annotation for Sail Library RBAC [#1393](https://github.com/openshift/cluster-ingress-operator/pull/1393)
* [NE-2396](https://issues.redhat.com/browse/NE-2396): gatewayclass: Enable Horizontal Pod Autoscaling [#1326](https://github.com/openshift/cluster-ingress-operator/pull/1326)
* [CORS-4335](https://issues.redhat.com/browse/CORS-4335): Add support for AWS European Sovereign Cloud [#1360](https://github.com/openshift/cluster-ingress-operator/pull/1360)
* [NE-2421](https://issues.redhat.com/browse/NE-2421): Support dual-stack IngressController on AWS [#1376](https://github.com/openshift/cluster-ingress-operator/pull/1376)
* [OCPBUGS-62237](https://issues.redhat.com/browse/OCPBUGS-62237): Apply APIServer TLS security profile to canary daemonset [#1386](https://github.com/openshift/cluster-ingress-operator/pull/1386)
* [OCPBUGS-78523](https://issues.redhat.com/browse/OCPBUGS-78523): gatewayapi_controller: Replace sync.Once with retry for GatewayClass field indexer setup [#1382](https://github.com/openshift/cluster-ingress-operator/pull/1382)
* [OCPBUGS-62627](https://issues.redhat.com/browse/OCPBUGS-62627): cluster operator ingress reported Progressing=True wit… [#1299](https://github.com/openshift/cluster-ingress-operator/pull/1299)
* [OCPBUGS-62238](https://issues.redhat.com/browse/OCPBUGS-62238): configure tls profile for router metrics [#1378](https://github.com/openshift/cluster-ingress-operator/pull/1378)
* [NE-2285](https://issues.redhat.com/browse/NE-2285): Bump to OSSM 3.3.0 and Istio v1.28.4 [#1396](https://github.com/openshift/cluster-ingress-operator/pull/1396)
* [OCPBUGS-77457](https://issues.redhat.com/browse/OCPBUGS-77457): Respect proxy configuration on gwapi provisioning [#1383](https://github.com/openshift/cluster-ingress-operator/pull/1383)
* [NE-2471](https://issues.redhat.com/browse/NE-2471): Replace OLM-based Istio install with Sail Library [#1354](https://github.com/openshift/cluster-ingress-operator/pull/1354)
* [NE-2501](https://issues.redhat.com/browse/NE-2501): Add RBAC to allow operator to manage network policies [#1389](https://github.com/openshift/cluster-ingress-operator/pull/1389)
* [OCPBUGS-78555](https://issues.redhat.com/browse/OCPBUGS-78555): Increase Gateway E2E timeout to 5 minutes [#1390](https://github.com/openshift/cluster-ingress-operator/pull/1390)
* [NE-2131](https://issues.redhat.com/browse/NE-2131): tests-extension: Append suite names to OTE test specs to preserve original test names [#1387](https://github.com/openshift/cluster-ingress-operator/pull/1387)
* [NE-2418](https://issues.redhat.com/browse/NE-2418): Add e2e test for haproxy_max_connections metric [#1361](https://github.com/openshift/cluster-ingress-operator/pull/1361)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/88b7301f88ba24577de72a84d52675f51ea30886...140e0bf13b3d01c369672c766c44b4be0b4ec78c)
### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/24b60d04b3478e04a728fb0ae1385abc6a478d20)
* [CNTRLPLANE-3226](https://issues.redhat.com/browse/CNTRLPLANE-3226): switch to real Vault KMS plugin in CI [#2180](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2180)
* [CNTRLPLANE-3226](https://issues.redhat.com/browse/CNTRLPLANE-3226): bump library-go to get KMS plugin credentials [#2169](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2169)
* NO-JIRA: Automatic agentic rebase: Update library-go to d8750ed [#2177](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2177)
* NO-JIRA: Automatic agentic rebase: Update library-go to 0cf249e [#2176](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2176)
* NO-JIRA: Bump latest libray-go changes [#2173](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2173)
* NO-JIRA: remove old mock plugin deployment [#2168](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2168)
* NO-JIRA: kms: use DefaultFakeVaultEncryptionProvider to ensure AppRole secret setup [#2167](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2167)
* [OCPBUGS-86057](https://issues.redhat.com/browse/OCPBUGS-86057): render: fall back to Authentication CR [#2166](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2166)
* [CNTRLPLANE-3236](https://issues.redhat.com/browse/CNTRLPLANE-3236): support deploying Vault mock KMS plugin [#2146](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2146)
* NO-JIRA: Add KMS dummy case [#2161](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2161)
* NO-JIRA: Bump latest library-go changes [#2160](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2160)
* [CNTRLPLANE-3238](https://issues.redhat.com/browse/CNTRLPLANE-3238): Add New kms suite [#2156](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2156)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): Bump library-go and sync plugin changes [#2155](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2155)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2220 [#2150](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2150)
* [OCPSTRAT-3036](https://issues.redhat.com/browse/OCPSTRAT-3036): Temporarily extend MutatingAdmissionPolicy runtime-config range to <1.37.0 [#2148](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2148)
* [CNTRLPLANE-3347](https://issues.redhat.com/browse/CNTRLPLANE-3347): Migrate testKMSEncryptionOnOff to ote [#2127](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2127)
* [OCPBUGS-78016](https://issues.redhat.com/browse/OCPBUGS-78016): Use SkipInClusterAuthenticationLookup in check-endpoints [#2113](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2113)
* NO-JIRA: Removal of unuse suites [#2132](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2132)
* [OCPBUGS-76588](https://issues.redhat.com/browse/OCPBUGS-76588): operator should not override authentication config serviceAccountIssuer with the default one during the operator initialization [#2062](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2062)
* [CNTRLPLANE-3327](https://issues.redhat.com/browse/CNTRLPLANE-3327): Migrate TestEncryptionTypeAESCBC to OTE [#2122](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2122)
* NO-JIRA: Add control-plane-approvers to OWNERS [#2110](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2110)
* [CNTRLPLANE-3326](https://issues.redhat.com/browse/CNTRLPLANE-3326): Remove unstable TestBoundTokenOperatorSecretDeletion [#2123](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2123)
* NO-JIRA: Update library-go changes [#2107](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2107)
* [OCPBUGS-79663](https://issues.redhat.com/browse/OCPBUGS-79663): Allow setting the oauthMetadata when auth type is None [#2105](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2105)
* [CNTRLPLANE-3228](https://issues.redhat.com/browse/CNTRLPLANE-3228): Implement 5.0 EUS schedule in KAS-O [#2101](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2101)
* [CNTRLPLANE-2991](https://issues.redhat.com/browse/CNTRLPLANE-2991): Do not configure KAS with Structured Authentication when authentication type is OIDC [#2075](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2075)
* [CNTRLPLANE-2935](https://issues.redhat.com/browse/CNTRLPLANE-2935): Enable configurable PKI for managed certificate rotation [#2051](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2051)
* [CNTRLPLANE-2698](https://issues.redhat.com/browse/CNTRLPLANE-2698): add network policies for apiserver operator and operands [#2029](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2029)
* [OCPBUGS-23366](https://issues.redhat.com/browse/OCPBUGS-23366): bindata/bootkube: Remove configmap-csr-controller-ca.yaml [#2076](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2076)
* [OCPBUGS-76952](https://issues.redhat.com/browse/OCPBUGS-76952): scc: fix uid{Min,Max}Range for nested-container [#2053](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2053)
* NO-JIRA:Fix TestBoundTokenOperatorSecretDeletion stability and monitor failures [#2080](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2080)
* [CNTRLPLANE-2622](https://issues.redhat.com/browse/CNTRLPLANE-2622): Restart operator when TLS config changes [#2059](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2059)
* [CORS-4363](https://issues.redhat.com/browse/CORS-4363): set bindAddress/bindNetwork for dual-stack clusters [#2079](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2079)
* [CNTRLPLANE-2992](https://issues.redhat.com/browse/CNTRLPLANE-2992): Update CKASO to use a default webhook authenticator secret when authentication type is not `None` [#2074](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2074)
* [OCPBUGS-65626](https://issues.redhat.com/browse/OCPBUGS-65626): update library-go to latest [#2026](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2026)
* [CNTRLPLANE-2223](https://issues.redhat.com/browse/CNTRLPLANE-2223): Migrate TestBoundTokenSignerController to ginkgo [#2067](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2067)
* [CNTRLPLANE-2622](https://issues.redhat.com/browse/CNTRLPLANE-2622): config tls on check-endpoints container [#2058](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2058)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/deb703d26f017aea26d4619a7422094ab12b3e65...24b60d04b3478e04a728fb0ae1385abc6a478d20)
### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/9d636ab4992bd501006d2b0c1d3ac512666c6ca7)
* [CNTRLPLANE-3349](https://issues.redhat.com/browse/CNTRLPLANE-3349): Migrate KCM-O cases to ote [#935](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/935)
* [CNTRLPLANE-3107](https://issues.redhat.com/browse/CNTRLPLANE-3107): e2e testing automation Create network network policy test cases [#924](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/924)
* NO-JIRA: Add control-plane-approvers to OWNERS [#926](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/926)
* [CNTRLPLANE-3211](https://issues.redhat.com/browse/CNTRLPLANE-3211): enable configurable PKI for managed certificate rotation [#925](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/925)
* [OCPBUGS-23366](https://issues.redhat.com/browse/OCPBUGS-23366): bindata: Import configmap-csr-controller-ca.yaml from KAS-O [#918](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/918)
* [CNTRLPLANE-2623](https://issues.redhat.com/browse/CNTRLPLANE-2623): Restart operator when TLS config changes [#915](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/915)
* [OCPBUGS-65626](https://issues.redhat.com/browse/OCPBUGS-65626): update library-go to latest [#905](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/905)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/41ab963edfef9473111879069620971365231c49...9d636ab4992bd501006d2b0c1d3ac512666c6ca7)
### [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator/tree/d43423b583269eea8236040424609c3f108ac9c4)
* [WRKLDS-1126](https://issues.redhat.com/browse/WRKLDS-1126): e2e network policy tests [#637](https://github.com/openshift/cluster-kube-scheduler-operator/pull/637)
* NO-JIRA: Add control-plane-approvers to OWNERS [#639](https://github.com/openshift/cluster-kube-scheduler-operator/pull/639)
* [OCPBUGS-82503](https://issues.redhat.com/browse/OCPBUGS-82503): add /var/run/kubernetes as emptyDir [#638](https://github.com/openshift/cluster-kube-scheduler-operator/pull/638)
* [CNTRLPLANE-3219](https://issues.redhat.com/browse/CNTRLPLANE-3219): vendor: bump library-go, api, client-go for configurable PKI [#636](https://github.com/openshift/cluster-kube-scheduler-operator/pull/636)
* [CNTRLPLANE-2756](https://issues.redhat.com/browse/CNTRLPLANE-2756): Add operator and operand network policies [#629](https://github.com/openshift/cluster-kube-scheduler-operator/pull/629)
* [CNTRLPLANE-2810](https://issues.redhat.com/browse/CNTRLPLANE-2810): Restart operator when TLS config changes [#617](https://github.com/openshift/cluster-kube-scheduler-operator/pull/617)
* [OCPBUGS-65626](https://issues.redhat.com/browse/OCPBUGS-65626): update library go to latest [#610](https://github.com/openshift/cluster-kube-scheduler-operator/pull/610)
* [MON-4504](https://issues.redhat.com/browse/MON-4504): Migrate Prometheus targets discovering from Endpoints to EndpointSlices [#614](https://github.com/openshift/cluster-kube-scheduler-operator/pull/614)
* [Full changelog](https://github.com/openshift/cluster-kube-scheduler-operator/compare/a51975da7993b40c35a892e3437f354cb3e133d7...d43423b583269eea8236040424609c3f108ac9c4)
### [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/tree/42647ceeb54e36b5f7c827302f443c10788407ec)
* [OCPBUGS-65984](https://issues.redhat.com/browse/OCPBUGS-65984): add PodDisruptionBudget for migrator deployment [#172](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/172)
* [OCPBUGS-62629](https://issues.redhat.com/browse/OCPBUGS-62629): update library-go for deployment controller updates [#159](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/159)
* NO-JIRA: Add control-plane-approvers to OWNERS [#158](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/158)
* [OCPBUGS-51091](https://issues.redhat.com/browse/OCPBUGS-51091): schedule migrator pods on control-plane nodes [#157](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/157)
* [CNTRLPLANE-3055](https://issues.redhat.com/browse/CNTRLPLANE-3055): Migrate go standard casee to ote [#156](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/156)
* [CNTRLPLANE-2706](https://issues.redhat.com/browse/CNTRLPLANE-2706): add network policy e2e tests for operator and operand [#151](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/151)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/compare/47075d8ce357cf66c4a843cff09cae53cee7cf80...42647ceeb54e36b5f7c827302f443c10788407ec)
### [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver/tree/e602d35f4c8778143d51872bd6e58759ad15b01e)
* NO-JIRA: fix: use feature-gate annotation for CAPI manifests [#304](https://github.com/openshift/cluster-machine-approver/pull/304)
* NO-JIRA: fix: add pod annotation: openshift.io/required-scc: restricted-v2 [#297](https://github.com/openshift/cluster-machine-approver/pull/297)
* NO-JIRA: bump controller-runtime-common to latest main [#302](https://github.com/openshift/cluster-machine-approver/pull/302)
* NO-JIRA: Deploy cluster-machine-approver without host networking [#301](https://github.com/openshift/cluster-machine-approver/pull/301)
* NO-JIRA: Migrate away from deprecated ioutil [#284](https://github.com/openshift/cluster-machine-approver/pull/284)
* [OCPCLOUD-3347](https://issues.redhat.com/browse/OCPCLOUD-3347): tls: use centralized TLS profile (unrevert) [#292](https://github.com/openshift/cluster-machine-approver/pull/292)
* NO-JIRA: Update OWNERS [#296](https://github.com/openshift/cluster-machine-approver/pull/296)
* [Full changelog](https://github.com/openshift/cluster-machine-approver/compare/a9edd695aca56fb58e739b774670a01428360dd8...e602d35f4c8778143d51872bd6e58759ad15b01e)
### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/67978b16bd5fec2c37f66b8a4d4fd270408e824e)
* NO-ISSUE: Update golangci-lint version [#2941](https://github.com/openshift/cluster-monitoring-operator/pull/2941)
* [OCPBUGS-86989](https://issues.redhat.com/browse/OCPBUGS-86989): increase lookup interval [#2943](https://github.com/openshift/cluster-monitoring-operator/pull/2943)
* [MON-4583](https://issues.redhat.com/browse/MON-4583): adding NVIDIA H200 GPU device to accelerators configmap [#2942](https://github.com/openshift/cluster-monitoring-operator/pull/2942)
* [MON-4555](https://issues.redhat.com/browse/MON-4555): migrate federate tests to e2e suite [#2902](https://github.com/openshift/cluster-monitoring-operator/pull/2902)
* NO-ISSUE: improve logging for doc example tests [#2936](https://github.com/openshift/cluster-monitoring-operator/pull/2936)
* [MON-4526](https://issues.redhat.com/browse/MON-4526): manifests: merge ThanosQuerierConfig from ClusterMonitoring CRD [#2924](https://github.com/openshift/cluster-monitoring-operator/pull/2924)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2937](https://github.com/openshift/cluster-monitoring-operator/pull/2937)
* Update jsonnet dependencies [#2927](https://github.com/openshift/cluster-monitoring-operator/pull/2927)
* NO-ISSUE: manifests: remove unused NewConfigMapList method [#2935](https://github.com/openshift/cluster-monitoring-operator/pull/2935)
* [OCPBUGS-86352](https://issues.redhat.com/browse/OCPBUGS-86352): jsonnet: exclude ReplicationController from catch-all … [#2932](https://github.com/openshift/cluster-monitoring-operator/pull/2932)
* NO-ISSUE: chore: remove unused function [#2934](https://github.com/openshift/cluster-monitoring-operator/pull/2934)
* [MON-4525](https://issues.redhat.com/browse/MON-4525): manifests: merge TelemeterClientConfig from ClusterMonitoring CRD [#2928](https://github.com/openshift/cluster-monitoring-operator/pull/2928)
* [MON-4566](https://issues.redhat.com/browse/MON-4566): chore: add telemetry_report tool to help with telemetry change review [#2885](https://github.com/openshift/cluster-monitoring-operator/pull/2885)
* [MON-4529](https://issues.redhat.com/browse/MON-4529): manifests: merge PrometheusOperatorAdmissionWebhookConfig from ClusterMonitoring CRD [#2923](https://github.com/openshift/cluster-monitoring-operator/pull/2923)
* [OCPBUGS-85709](https://issues.redhat.com/browse/OCPBUGS-85709): fix: use numeric ports in NetworkPolicies and add enforcement e2e test [#2925](https://github.com/openshift/cluster-monitoring-operator/pull/2925)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2921](https://github.com/openshift/cluster-monitoring-operator/pull/2921)
* [OCPBUGS-83284](https://issues.redhat.com/browse/OCPBUGS-83284): validate more CMO configmap fields [#2877](https://github.com/openshift/cluster-monitoring-operator/pull/2877)
* [MON-4524](https://issues.redhat.com/browse/MON-4524): MetricsServerConfig resources merge [#2907](https://github.com/openshift/cluster-monitoring-operator/pull/2907)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2918](https://github.com/openshift/cluster-monitoring-operator/pull/2918)
* [MON-4528](https://issues.redhat.com/browse/MON-4528): merge monitoringPluginConfig [#2908](https://github.com/openshift/cluster-monitoring-operator/pull/2908)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2893](https://github.com/openshift/cluster-monitoring-operator/pull/2893)
* [MON-4520](https://issues.redhat.com/browse/MON-4520): follow up AlertManagerConfig and PrometheusOp PR changes [#2900](https://github.com/openshift/cluster-monitoring-operator/pull/2900)
* [TRT-2649](https://issues.redhat.com/browse/TRT-2649): Revert "MON-4558: enable zoneinfo node-exporter collector via config" [#2910](https://github.com/openshift/cluster-monitoring-operator/pull/2910)
* NO-ISSUE: chore(e2e): verify Prometheus Mantine UI is served on port 9090 and refactor ForwardPort helpers [#2905](https://github.com/openshift/cluster-monitoring-operator/pull/2905)
* NO-ISSUE: Update AGENTS.md [#2899](https://github.com/openshift/cluster-monitoring-operator/pull/2899)
* [MON-4563](https://issues.redhat.com/browse/MON-4563): use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs [#2892](https://github.com/openshift/cluster-monitoring-operator/pull/2892)
* [MON-4558](https://issues.redhat.com/browse/MON-4558): enable zoneinfo node-exporter collector via config [#2886](https://github.com/openshift/cluster-monitoring-operator/pull/2886)
* [TRT-2644](https://issues.redhat.com/browse/TRT-2644): Revert "MON-4517: Minimal and telemetry CP monitors" [#2901](https://github.com/openshift/cluster-monitoring-operator/pull/2901)
* NO-ISSUE: [bot] Update jsonnet dependencies [#2894](https://github.com/openshift/cluster-monitoring-operator/pull/2894)
* [MON-4492](https://issues.redhat.com/browse/MON-4492): ClusterMonitoring alertmanagerConfig logic [#2889](https://github.com/openshift/cluster-monitoring-operator/pull/2889)
* [MON-4517](https://issues.redhat.com/browse/MON-4517): Minimal and telemetry CP monitors [#2814](https://github.com/openshift/cluster-monitoring-operator/pull/2814)
* [MON-4560](https://issues.redhat.com/browse/MON-4560): enable softirqs node-exporter collector via config [#2887](https://github.com/openshift/cluster-monitoring-operator/pull/2887)
* NO-JIRA: refactor config merging [#2890](https://github.com/openshift/cluster-monitoring-operator/pull/2890)
* [OCPBUGS-54806](https://issues.redhat.com/browse/OCPBUGS-54806): Add telemetry for user-defined networks [#2596](https://github.com/openshift/cluster-monitoring-operator/pull/2596)
* [CNTRLPLANE-3217](https://issues.redhat.com/browse/CNTRLPLANE-3217): Enable configurable PKI for GRPC TLS certificates [#2882](https://github.com/openshift/cluster-monitoring-operator/pull/2882)
* NO-ISSUE: [bot] Update jsonnet dependencies [#2878](https://github.com/openshift/cluster-monitoring-operator/pull/2878)
* [MON-4115](https://issues.redhat.com/browse/MON-4115): expose label metrics for jobs and cronjobs [#2553](https://github.com/openshift/cluster-monitoring-operator/pull/2553)
* [MON-4480](https://issues.redhat.com/browse/MON-4480): set minimum TLS version for Thanos ruler [#2862](https://github.com/openshift/cluster-monitoring-operator/pull/2862)
* [MON-4442](https://issues.redhat.com/browse/MON-4442): Add AGENTS.md to CMO [#2761](https://github.com/openshift/cluster-monitoring-operator/pull/2761)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2884](https://github.com/openshift/cluster-monitoring-operator/pull/2884)
* [MON-4493](https://issues.redhat.com/browse/MON-4493): add MetricsServerConfig support to ClusterMonitoring CRD [#2809](https://github.com/openshift/cluster-monitoring-operator/pull/2809)
* [MON-4543](https://issues.redhat.com/browse/MON-4543), [OPNET-765](https://issues.redhat.com/browse/OPNET-765): Add kubernetes-nmstate telemetry metrics to allowlist [#2855](https://github.com/openshift/cluster-monitoring-operator/pull/2855)
* [OCPBUGS-74645](https://issues.redhat.com/browse/OCPBUGS-74645): delay alert dispatch in Alertmanager [#2848](https://github.com/openshift/cluster-monitoring-operator/pull/2848)
* [OCPBUGS-81554](https://issues.redhat.com/browse/OCPBUGS-81554): CVE-2026-33186 - bump google.golang.org/grpc to v1.79.3 [#2872](https://github.com/openshift/cluster-monitoring-operator/pull/2872)
* NO-ISSUE: exclude hack/tools/vendor from shellcheck [#2873](https://github.com/openshift/cluster-monitoring-operator/pull/2873)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2865](https://github.com/openshift/cluster-monitoring-operator/pull/2865)
* [OCPBUGS-81159](https://issues.redhat.com/browse/OCPBUGS-81159): reject invalid collection profile in webhook [#2860](https://github.com/openshift/cluster-monitoring-operator/pull/2860)
* NO-ISSUE: [bot] Update jsonnet dependencies [#2861](https://github.com/openshift/cluster-monitoring-operator/pull/2861)
* [MON-4481](https://issues.redhat.com/browse/MON-4481), [MON-4482](https://issues.redhat.com/browse/MON-4482): set minimum TLS version for Thanos sidecars [#2859](https://github.com/openshift/cluster-monitoring-operator/pull/2859)
* NO-JIRA: update jsonnet dependencies [#2858](https://github.com/openshift/cluster-monitoring-operator/pull/2858)
* [OCPBUGS-78976](https://issues.redhat.com/browse/OCPBUGS-78976): configure repair policy to 'evict' [#2856](https://github.com/openshift/cluster-monitoring-operator/pull/2856)
* [MON-4542](https://issues.redhat.com/browse/MON-4542): update Prometheus operator CRDS to v0.90.0 [#2854](https://github.com/openshift/cluster-monitoring-operator/pull/2854)
* NO-JIRA: update github.com/openshift/library-go [#2852](https://github.com/openshift/cluster-monitoring-operator/pull/2852)
* NO-JIRA: change ClusterRolefailed to ClusterRole failed [#2853](https://github.com/openshift/cluster-monitoring-operator/pull/2853)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2857](https://github.com/openshift/cluster-monitoring-operator/pull/2857)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#2851](https://github.com/openshift/cluster-monitoring-operator/pull/2851)
* NO-JIRA: add unit tests for admission webhook's TLS configuration [#2850](https://github.com/openshift/cluster-monitoring-operator/pull/2850)
* [MON-4479](https://issues.redhat.com/browse/MON-4479): use TLS profile to configure CMO server [#2841](https://github.com/openshift/cluster-monitoring-operator/pull/2841)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/6a850bf1259f4eaf50049f238f0801e1ba926726...67978b16bd5fec2c37f66b8a4d4fd270408e824e)
### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/6dc18040e7c214f6a1db25b6f5ef4642c6c6a186)
* [OCPBUGS-66159](https://issues.redhat.com/browse/OCPBUGS-66159): Add `openshift.io/node-selector` annotation to `openshift-network-console` namespace [#2848](https://github.com/openshift/cluster-network-operator/pull/2848)
* [CORENET-7154](https://issues.redhat.com/browse/CORENET-7154): Fix debounce timer for OperatorConfig level being incorrectly cleared [#3011](https://github.com/openshift/cluster-network-operator/pull/3011)
* NO-JIRA: Remove --enable-interconnect flag from OVN-K manifests [#3008](https://github.com/openshift/cluster-network-operator/pull/3008)
* [OCPBUGS-83863](https://issues.redhat.com/browse/OCPBUGS-83863): Remove version-specific CNI binary copy logic [#2967](https://github.com/openshift/cluster-network-operator/pull/2967)
* [OCPBUGS-84519](https://issues.redhat.com/browse/OCPBUGS-84519): Add terminationMessagePolicy to missing ovn-kubernetes containers [#3004](https://github.com/openshift/cluster-network-operator/pull/3004)
* [NVIDIA-596](https://issues.redhat.com/browse/NVIDIA-596): Enable dpu healthcheck [#2941](https://github.com/openshift/cluster-network-operator/pull/2941)
* [TRT-2657](https://issues.redhat.com/browse/TRT-2657): Revert "add remaining CNO NetworkPolicies" (#2959) [#2999](https://github.com/openshift/cluster-network-operator/pull/2999)
* [OCPBUGS-83800](https://issues.redhat.com/browse/OCPBUGS-83800): add remaining CNO NetworkPolicies [#2959](https://github.com/openshift/cluster-network-operator/pull/2959)
* [NVIDIA-554](https://issues.redhat.com/browse/NVIDIA-554): DPU-host mode: use ConfigMap for OVN feature enablement instead of per-node script gating [#2944](https://github.com/openshift/cluster-network-operator/pull/2944)
* [OCPBUGS-83406](https://issues.redhat.com/browse/OCPBUGS-83406), [OCPBUGS-83407](https://issues.redhat.com/browse/OCPBUGS-83407): fix issue for managed mode of no-overlay [#2960](https://github.com/openshift/cluster-network-operator/pull/2960)
* [OCPBUGS-53187](https://issues.redhat.com/browse/OCPBUGS-53187): Update self-referencing URLs from master to main [#2984](https://github.com/openshift/cluster-network-operator/pull/2984)
* [GCP-430](https://issues.redhat.com/browse/GCP-430): Wire GCP WIF credentials for CNCC in HyperShift HCP mode [#2915](https://github.com/openshift/cluster-network-operator/pull/2915)
* [OCPBUGS-65631](https://issues.redhat.com/browse/OCPBUGS-65631): Use dedicated service accounts for multus pods [#2961](https://github.com/openshift/cluster-network-operator/pull/2961)
* NO-JIRA: cleanup unused code and refactor for allowlist controller [#2846](https://github.com/openshift/cluster-network-operator/pull/2846)
* [CORS-4332](https://issues.redhat.com/browse/CORS-4332): Add GCP to the allowed platforms for dual stack [#2894](https://github.com/openshift/cluster-network-operator/pull/2894)
* [OCPBUGS-82973](https://issues.redhat.com/browse/OCPBUGS-82973): Frrk8s tls manifests [#2963](https://github.com/openshift/cluster-network-operator/pull/2963)
* [KONFLUX-11591](https://issues.redhat.com/browse/KONFLUX-11591): Fix ovn-acl-logging CrashLoopBackOff due to startup race condition [#2923](https://github.com/openshift/cluster-network-operator/pull/2923)
* [CORENET-6572](https://issues.redhat.com/browse/CORENET-6572): only report Progressing for active network rollouts [#2937](https://github.com/openshift/cluster-network-operator/pull/2937)
* [CORENET-6543](https://issues.redhat.com/browse/CORENET-6543): Align VTEP CRD additionalPrinterColumns with upstream [#2957](https://github.com/openshift/cluster-network-operator/pull/2957)
* [CNF-21001](https://issues.redhat.com/browse/CNF-21001): multus: MultiNetworkPolicy nftables [#2883](https://github.com/openshift/cluster-network-operator/pull/2883)
* [CORENET-6816](https://issues.redhat.com/browse/CORENET-6816): Add NetworkPolicies for CNO and its operands [#2892](https://github.com/openshift/cluster-network-operator/pull/2892)
* [CORENET-6933](https://issues.redhat.com/browse/CORENET-6933): Update VTEPs/CUDN APIs [#2952](https://github.com/openshift/cluster-network-operator/pull/2952)
* [OCPBUGS-78974](https://issues.redhat.com/browse/OCPBUGS-78974): Fix ManagementState being reset on operator restart [#2942](https://github.com/openshift/cluster-network-operator/pull/2942)
* [CORENET-6613](https://issues.redhat.com/browse/CORENET-6613): `ClusterNetworkConnect` DevPreview FG [#2880](https://github.com/openshift/cluster-network-operator/pull/2880)
* no-jira: Update OWNERS_ALIASES to include myself + "taanyas" and "marty-power" [#2908](https://github.com/openshift/cluster-network-operator/pull/2908)
* [CORENET-6813](https://issues.redhat.com/browse/CORENET-6813): Add config override for allow-icmp-network-policy [#2920](https://github.com/openshift/cluster-network-operator/pull/2920)
* [CORENET-6100](https://issues.redhat.com/browse/CORENET-6100): Add support for no-overlay mode [#2844](https://github.com/openshift/cluster-network-operator/pull/2844)
* [CORENET-6561](https://issues.redhat.com/browse/CORENET-6561): CNO Rebase k8s to 1.35.0 [#2887](https://github.com/openshift/cluster-network-operator/pull/2887)
* [OCPBUGS-78731](https://issues.redhat.com/browse/OCPBUGS-78731): Revert "NVIDIA-554: DPU-host mode: use ConfigMap for OVN feature enablement instead of per-node script gating" [#2938](https://github.com/openshift/cluster-network-operator/pull/2938)
* [OCPBUGS-77015](https://issues.redhat.com/browse/OCPBUGS-77015): wait for patch port to apply drop garp flows [#2910](https://github.com/openshift/cluster-network-operator/pull/2910)
* [OCPBUGS-70016](https://issues.redhat.com/browse/OCPBUGS-70016): Updating cluster-network-operator-container image to be consistent with ART for 4.22 [#2863](https://github.com/openshift/cluster-network-operator/pull/2863)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/3b5ef2d8b37e2e040f5b98a07848a63774aa3012...6dc18040e7c214f6a1db25b6f5ef4642c6c6a186)
### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/434478751a92e4da294f25761f1e11bd6dd17b12)
* [OCPBUGS-87132](https://issues.redhat.com/browse/OCPBUGS-87132): E2E: Remove ovs-vswitchd from platform services [#1526](https://github.com/openshift/cluster-node-tuning-operator/pull/1526)
* [OCPBUGS-86803](https://issues.redhat.com/browse/OCPBUGS-86803): e2e: Remove unnecessary len(numa) < 2 skip gates [#1528](https://github.com/openshift/cluster-node-tuning-operator/pull/1528)
* NO-JIRA: Bump github.com/moby/spdystream from v0.5.0 to v0.5.1 [#1527](https://github.com/openshift/cluster-node-tuning-operator/pull/1527)
* [OCPBUGS-86480](https://issues.redhat.com/browse/OCPBUGS-86480): E2E: Refactor OVS affinity tests into shared helpers and add new workload-partitioning and control-plane reboot test cases. [#1509](https://github.com/openshift/cluster-node-tuning-operator/pull/1509)
* [OCPBUGS-83865](https://issues.redhat.com/browse/OCPBUGS-83865): Revert stalld backend to sched_debug [#1515](https://github.com/openshift/cluster-node-tuning-operator/pull/1515)
* NO-JIRA: E2E: remove obsolete ContainerRuntimeConfig runtime-switch test [#1510](https://github.com/openshift/cluster-node-tuning-operator/pull/1510)
* [OCPBUGS-80952](https://issues.redhat.com/browse/OCPBUGS-80952): perf: latency: compute memory resources dynamically [#1517](https://github.com/openshift/cluster-node-tuning-operator/pull/1517)
* [OCPBUGS-62277](https://issues.redhat.com/browse/OCPBUGS-62277): Requeue PerformanceStatus update when status write fails [#1495](https://github.com/openshift/cluster-node-tuning-operator/pull/1495)
* NO-JIRA: ote: embed extended testdata in cluster-node-tuning-operator-test-ext binary [#1512](https://github.com/openshift/cluster-node-tuning-operator/pull/1512)
* [TRT-2659](https://issues.redhat.com/browse/TRT-2659): Revert #1499 "NO-JIRA: ote: embed extended testdata in cluster-node-tuning-operator-test-ext binary" [#1511](https://github.com/openshift/cluster-node-tuning-operator/pull/1511)
* NO-JIRA: e2e: fix tuned deferred tests on Hypershift [#1494](https://github.com/openshift/cluster-node-tuning-operator/pull/1494)
* NO-JIRA: test/extended: scope oc process to NTO namespace [#1508](https://github.com/openshift/cluster-node-tuning-operator/pull/1508)
* NO-JIRA: ote: embed extended testdata in cluster-node-tuning-operator-test-ext binary [#1499](https://github.com/openshift/cluster-node-tuning-operator/pull/1499)
* [OCPBUGS-84938](https://issues.redhat.com/browse/OCPBUGS-84938): e2e: Add irqbalance StartLimitBurst >= 100 config test [#1493](https://github.com/openshift/cluster-node-tuning-operator/pull/1493)
* NO-JIRA: Bump ghw dependency [#1492](https://github.com/openshift/cluster-node-tuning-operator/pull/1492)
* NO-JIRA: E2E: move dra resource test to reboot tests directory [#1486](https://github.com/openshift/cluster-node-tuning-operator/pull/1486)
* [PSAP-2185](https://issues.redhat.com/browse/PSAP-2185): Support centralized TLS security profile configuration [#1483](https://github.com/openshift/cluster-node-tuning-operator/pull/1483)
* [CNF-18941](https://issues.redhat.com/browse/CNF-18941): e2e: PP: cover ExecCPUAffinity support in tests [#1432](https://github.com/openshift/cluster-node-tuning-operator/pull/1432)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/fe593043d7d87fc69e2f09266afd8e6dadca8ce7...434478751a92e4da294f25761f1e11bd6dd17b12)
### [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator/tree/46f78fd08ea2178cf7610eccf8a5d92b250e0219)
* [OPRUN-4640](https://issues.redhat.com/browse/OPRUN-4640): Update to golang 1.26.3 and openshift-4.23 builders [#211](https://github.com/openshift/cluster-olm-operator/pull/211)
* [OPRUN-4627](https://issues.redhat.com/browse/OPRUN-4627): override catalog tag to 4.x when RELEASE_VERSION is 4.x and catalogd.yaml pins v5.0 [#210](https://github.com/openshift/cluster-olm-operator/pull/210)
* [OPRUN-4599](https://issues.redhat.com/browse/OPRUN-4599): dynamically resolve catalog image tag from OCP release version [#203](https://github.com/openshift/cluster-olm-operator/pull/203)
* [OCPBUGS-62517](https://issues.redhat.com/browse/OCPBUGS-62517): Scale to replicas=2 and enable PDB on HighlyAvailable topology [#202](https://github.com/openshift/cluster-olm-operator/pull/202)
* [OPRUN-4521](https://issues.redhat.com/browse/OPRUN-4521): handle OCP 4.23/5.0 upgrade boundary [#184](https://github.com/openshift/cluster-olm-operator/pull/184)
* [OCPBUGS-77899](https://issues.redhat.com/browse/OCPBUGS-77899): Fix wait logic to handle NewOLM enabled on Default Feature [#193](https://github.com/openshift/cluster-olm-operator/pull/193)
* NO-ISSUE: remove no-op os.Remove call in TestRenderHelmTemplate [#192](https://github.com/openshift/cluster-olm-operator/pull/192)
* [OCPBUGS-77899](https://issues.redhat.com/browse/OCPBUGS-77899): Wait for operator-controller resources before verifyig [#181](https://github.com/openshift/cluster-olm-operator/pull/181)
* [OPRUN-4518](https://issues.redhat.com/browse/OPRUN-4518): Rename ClusterExtensionRevision to ClusterObjectSet [#191](https://github.com/openshift/cluster-olm-operator/pull/191)
* NO-ISSUE: Add fgiudici as reviewer [#190](https://github.com/openshift/cluster-olm-operator/pull/190)
* NO-ISSUE: return semver conversion errors [#183](https://github.com/openshift/cluster-olm-operator/pull/183)
* [OCPBUGS-81188](https://issues.redhat.com/browse/OCPBUGS-81188): Update grpc and other dependencies [#182](https://github.com/openshift/cluster-olm-operator/pull/182)
* [OPRUN-4502](https://issues.redhat.com/browse/OPRUN-4502): Use FratureGateNewOLMConfigAPI from openshift/api [#180](https://github.com/openshift/cluster-olm-operator/pull/180)
* [OPRUN-4502](https://issues.redhat.com/browse/OPRUN-4502): Add feature-gate for DeploymentConfig [#176](https://github.com/openshift/cluster-olm-operator/pull/176)
* [Full changelog](https://github.com/openshift/cluster-olm-operator/compare/8ecafe23f3828c3750dfbdd55f9a9d105c984963...46f78fd08ea2178cf7610eccf8a5d92b250e0219)
### [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator/tree/ab2058390df89cd475db792622d66d0a85b46015)
* [CNTRLPLANE-3226](https://issues.redhat.com/browse/CNTRLPLANE-3226): switch to real Vault KMS plugin in CI [#704](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/704)
* [CNTRLPLANE-3226](https://issues.redhat.com/browse/CNTRLPLANE-3226): bump library-go to get KMS plugin credentials [#699](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/699)
* [CNTRLPLANE-3364](https://issues.redhat.com/browse/CNTRLPLANE-3364): remove old go std tests [#703](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/703)
* NO-JIRA: Automatic agentic rebase: Update library-go to d8750ed [#702](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/702)
* NO-JIRA: Automatic agentic rebase: Update library-go to 0cf249e [#701](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/701)
* NO-JIRA: bump latest library-go changes [#700](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/700)
* NO-jIRA: Remove old mock plugin deployment [#698](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/698)
* NO-JIRA: kms: use DefaultFakeVaultEncryptionProvider to ensure AppRole secre setup [#697](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/697)
* [CNTRLPLANE-3236](https://issues.redhat.com/browse/CNTRLPLANE-3236): support deploying Vault mock KMS plugin [#693](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/693)
* NO-JIRA: Bump latest library-go changes [#692](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/692)
* [CNTRLPLANE-3364](https://issues.redhat.com/browse/CNTRLPLANE-3364): add the kms suite and migrate the kms tests of oas-o to ote [#690](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/690)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): Bump library-go and sync encryption tests with APIServerEncryption struct change [#689](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/689)
* NO-JIRA: Bump latest library-go changes [#688](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/688)
* [API-1768](https://issues.redhat.com/browse/API-1768): e2e network policy tests [#675](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/675)
* NO-JIRA: Add control-plane-approvers to OWNERS [#677](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/677)
* NO-JIRA: Update library-go for latest changes [#678](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/678)
* [CNTRLPLANE-2619](https://issues.redhat.com/browse/CNTRLPLANE-2619): Restart operator when TLS config changes [#662](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/662)
* [CNTRLPLANE-2450](https://issues.redhat.com/browse/CNTRLPLANE-2450): bump(k8s.io): 1.35.2 [#669](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/669)
* [CNTRLPLANE-2619](https://issues.redhat.com/browse/CNTRLPLANE-2619): make checkendpoints use apiserver config [#657](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/657)
* NO-JIRA: OWNERS: remove engineers who have left Red Hat [#646](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/646)
* NO-JIRA: Disable WatchList feature gate due to the missing support of Project watch [#667](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/667)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/cluster-openshift-apiserver-operator/compare/ad799627e1fbec6205f8a7f670d9694f76b01dc4...ab2058390df89cd475db792622d66d0a85b46015)
### [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator/tree/34f95b07f4afbc47558e54e4fa2710fd692e615e)
* [CNTRLPLANE-2907](https://issues.redhat.com/browse/CNTRLPLANE-2907): e2e network policy tests [#428](https://github.com/openshift/cluster-openshift-controller-manager-operator/pull/428)
* NO-JIRA: Add control-plane-approvers to OWNERS [#427](https://github.com/openshift/cluster-openshift-controller-manager-operator/pull/427)
* [OCPBUGS-81472](https://issues.redhat.com/browse/OCPBUGS-81472): Prevent possibility of running controllers against empty informer caches [#426](https://github.com/openshift/cluster-openshift-controller-manager-operator/pull/426)
* [CNTRLPLANE-2620](https://issues.redhat.com/browse/CNTRLPLANE-2620): Restart operator when TLS config changes [#412](https://github.com/openshift/cluster-openshift-controller-manager-operator/pull/412)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/cluster-openshift-controller-manager-operator/compare/8e04fd3a6d1bbdb878a83fa13fde240c593504cc...34f95b07f4afbc47558e54e4fa2710fd692e615e)
### [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller/tree/bb429f5b2a7d77791110b06d8ec5c017183e3ab9)
* NO-JIRA: Add control-plane-approvers to OWNERS [#179](https://github.com/openshift/cluster-policy-controller/pull/179)
* [Full changelog](https://github.com/openshift/cluster-policy-controller/compare/44985a1306411101c84dd5081598fc928b432321...bb429f5b2a7d77791110b06d8ec5c017183e3ab9)
### [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator/tree/0bfb6b3c2f558c9098c438082bffb44eb8f07099)
* [CNF-23044](https://issues.redhat.com/browse/CNF-23044): Migrate away from deprecated ioutil [#668](https://github.com/openshift/cluster-samples-operator/pull/668)
* [CNTRLPLANE-3176](https://issues.redhat.com/browse/CNTRLPLANE-3176): implements operator tls config compliance [#684](https://github.com/openshift/cluster-samples-operator/pull/684)
* [Full changelog](https://github.com/openshift/cluster-samples-operator/compare/eeac6ba8ddbe5cc6d3a403293581648affdf6566...0bfb6b3c2f558c9098c438082bffb44eb8f07099)
### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/8dfdf2ef3310358f3559a5481df43b98b2294791)
* NO-JIRA: Add initial Agent Guide [#682](https://github.com/openshift/cluster-storage-operator/pull/682)
* [STOR-2770](https://issues.redhat.com/browse/STOR-2770): Mount metrics certs of azure-disk and azure-file CSI driver operator for Hypershift [#686](https://github.com/openshift/cluster-storage-operator/pull/686)
* [STOR-2762](https://issues.redhat.com/browse/STOR-2762): Bump all deps for 4.22 [#684](https://github.com/openshift/cluster-storage-operator/pull/684)
* [OCPBUGS-74232](https://issues.redhat.com/browse/OCPBUGS-74232): volume-data-source-validator should run on master nodes [#659](https://github.com/openshift/cluster-storage-operator/pull/659)
* [OCPBUGS-78291](https://issues.redhat.com/browse/OCPBUGS-78291): Allow azure-disk operator to read VolumeAttributeClasses [#683](https://github.com/openshift/cluster-storage-operator/pull/683)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/f7b0b150ea6ca5cf8e295bad48fa0ab163471eda...8dfdf2ef3310358f3559a5481df43b98b2294791)
### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/7d7dea4f133834852d95d0327bb922c93fa9dbd6)
* NO-JIRA: chore: exclude e2e tests from make test unconditionally [#1321](https://github.com/openshift/cluster-version-operator/pull/1321)
* [OTA-1836](https://issues.redhat.com/browse/OTA-1836): Honor the centralized TLS configuration [#1338](https://github.com/openshift/cluster-version-operator/pull/1338)
* NO-JIRA: refactor: simplify redundant error checking conditions [#1320](https://github.com/openshift/cluster-version-operator/pull/1320)
* [OTA-1966](https://issues.redhat.com/browse/OTA-1966): Install namespace/openshift-lightspeed only when TechPreview is enabled [#1394](https://github.com/openshift/cluster-version-operator/pull/1394)
* [OTA-1966](https://issues.redhat.com/browse/OTA-1966): Manage proposals [#1382](https://github.com/openshift/cluster-version-operator/pull/1382)
* [OTA-1935](https://issues.redhat.com/browse/OTA-1935): pkg: Use risk.Source framework to feed Upgradeable [#1368](https://github.com/openshift/cluster-version-operator/pull/1368)
* [OTA-1967](https://issues.redhat.com/browse/OTA-1967): Take official CRDs from the OpenShift Lightspeed operator [#1387](https://github.com/openshift/cluster-version-operator/pull/1387)
* [MON-4477](https://issues.redhat.com/browse/MON-4477): chore: add permissions on endpointslice to Prometheus Role and use serviceDiscoveryRole: EndpointSlice in ServiceMonitors [#1305](https://github.com/openshift/cluster-version-operator/pull/1305)
* [OTA-1966](https://issues.redhat.com/browse/OTA-1966): Init the Proprosal Lifecycle Controller [#1381](https://github.com/openshift/cluster-version-operator/pull/1381)
* NO-JIRA: OpenShiftUpdateRiskMightApply: bump pending to 15m from 10m [#1372](https://github.com/openshift/cluster-version-operator/pull/1372)
* [OTA-1836](https://issues.redhat.com/browse/OTA-1836): chore(deps): Bump general OpenShift dependencies [#1377](https://github.com/openshift/cluster-version-operator/pull/1377)
* [OTA-1979](https://issues.redhat.com/browse/OTA-1979): Revert "lightspeed: Add a new image holding Lightspeed skills" [#1378](https://github.com/openshift/cluster-version-operator/pull/1378)
* NO-JIRA: how-to: troubleshoot bootstrap CVO [#1369](https://github.com/openshift/cluster-version-operator/pull/1369)
* [OTA-1965](https://issues.redhat.com/browse/OTA-1965): Add Lightspeed CustomResourceDefinitions [#1380](https://github.com/openshift/cluster-version-operator/pull/1380)
* NO-ISSUE: Fix TestOperator_upgradeableSync [#1373](https://github.com/openshift/cluster-version-operator/pull/1373)
* [OTA-1962](https://issues.redhat.com/browse/OTA-1962): lightspeed: Add a new image holding Lightspeed skills [#1376](https://github.com/openshift/cluster-version-operator/pull/1376)
* [OTA-1813](https://issues.redhat.com/browse/OTA-1813): Extend alert risk e2e [#1371](https://github.com/openshift/cluster-version-operator/pull/1371)
* [OTA-1933](https://issues.redhat.com/browse/OTA-1933): pkg/risk: Refactor alerts into a generic update-risk interface [#1367](https://github.com/openshift/cluster-version-operator/pull/1367)
* NO-JIRA: All CVO manifests in payload should be included [#1337](https://github.com/openshift/cluster-version-operator/pull/1337)
* [OTA-1813](https://issues.redhat.com/browse/OTA-1813): Drop a local label on alert-risk e2e [#1363](https://github.com/openshift/cluster-version-operator/pull/1363)
* NO-ISSUE: Add CodeRabbit config with review rules from PR analysis [#1360](https://github.com/openshift/cluster-version-operator/pull/1360)
* NO-JIRA: use scrape class which is more succinct [#1365](https://github.com/openshift/cluster-version-operator/pull/1365)
* [CNTRLPLANE-2777](https://issues.redhat.com/browse/CNTRLPLANE-2777): feat(resource builder): allow to inject tls configuration into annotated config maps [#1322](https://github.com/openshift/cluster-version-operator/pull/1322)
* [OTA-1813](https://issues.redhat.com/browse/OTA-1813): Populate risks from alerts [#1329](https://github.com/openshift/cluster-version-operator/pull/1329)
* [OCPBUGS-78997](https://issues.redhat.com/browse/OCPBUGS-78997): Do not discard ListOptions in waitForPodCompletion. [#1361](https://github.com/openshift/cluster-version-operator/pull/1361)
* [OCPBUGS-65621](https://issues.redhat.com/browse/OCPBUGS-65621): add dedicated service account to crb, cvo and version pod [#1266](https://github.com/openshift/cluster-version-operator/pull/1266)
* NO-JIRA: Add test migration guide for openshift-tests-private to CVO [#1336](https://github.com/openshift/cluster-version-operator/pull/1336)
* NO-JIRA: Try not to block by informing [#1356](https://github.com/openshift/cluster-version-operator/pull/1356)
* [OCPSTRAT-2876](https://issues.redhat.com/browse/OCPSTRAT-2876): Allow inclusion/exclusion of manifests based on the OCP major version [#1282](https://github.com/openshift/cluster-version-operator/pull/1282)
* [TRT-2581](https://issues.redhat.com/browse/TRT-2581): Revert "NO-ISSUE: OTA-1605 Automate OCP-42543" [#1353](https://github.com/openshift/cluster-version-operator/pull/1353)
* NO-ISSUE: OTA-1605 Automate OCP-42543 [#1309](https://github.com/openshift/cluster-version-operator/pull/1309)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/6d31e54fc074493d15eb0847d82ac1636afbbc27...7d7dea4f133834852d95d0327bb922c93fa9dbd6)
### [console](https://github.com/openshift/console/tree/ec1ce9ae7581ffc27725f4f61770ab898b62b111)
* [CONSOLE-5242](https://issues.redhat.com/browse/CONSOLE-5242): Remove shipwright-plugin Cypress integration tests [#16553](https://github.com/openshift/console/pull/16553)
* [CONSOLE-4946](https://issues.redhat.com/browse/CONSOLE-4946): Add Configuration tab to Node view [#16124](https://github.com/openshift/console/pull/16124)
* NO-JIRA: Improve cypress-migration skill [#16550](https://github.com/openshift/console/pull/16550)
* [OCPBUGS-82506](https://issues.redhat.com/browse/OCPBUGS-82506), [OCPBUGS-82507](https://issues.redhat.com/browse/OCPBUGS-82507): Re-enable OLM Cypress tests disabled for createRoot [#16531](https://github.com/openshift/console/pull/16531)
* [OCPBUGS-86564](https://issues.redhat.com/browse/OCPBUGS-86564): Use stable username hash for user-settings ConfigMap names [#16512](https://github.com/openshift/console/pull/16512)
* [OCPBUGS-86875](https://issues.redhat.com/browse/OCPBUGS-86875): Always use RHUI icons [#16528](https://github.com/openshift/console/pull/16528)
* [OCPBUGS-86755](https://issues.redhat.com/browse/OCPBUGS-86755): use a clip path instead of overlapping triangles [#16520](https://github.com/openshift/console/pull/16520)
* [CONSOLE-5037](https://issues.redhat.com/browse/CONSOLE-5037): Add knip-based dead code detection in CI [#16523](https://github.com/openshift/console/pull/16523)
* [CONSOLE-5284](https://issues.redhat.com/browse/CONSOLE-5284): Put new node inventory items behind tech-preview [#16414](https://github.com/openshift/console/pull/16414)
* [CONSOLE-5307](https://issues.redhat.com/browse/CONSOLE-5307): Remove dead code 2: electric boogaloo [#16513](https://github.com/openshift/console/pull/16513)
* NO-JIRA: Update Console 4.23 plugin SDK CHANGELOG [#16516](https://github.com/openshift/console/pull/16516)
* [CONSOLE-5091](https://issues.redhat.com/browse/CONSOLE-5091): Add bulk selection and schedulable actions to Nodes page [#16203](https://github.com/openshift/console/pull/16203)
* [CONSOLE-5296](https://issues.redhat.com/browse/CONSOLE-5296): Add non-scalable image warning when scaling workloads [#16436](https://github.com/openshift/console/pull/16436)
* [OCPBUGS-82508](https://issues.redhat.com/browse/OCPBUGS-82508), [OCPBUGS-82509](https://issues.redhat.com/browse/OCPBUGS-82509): Fix and re-enable operator e2e tests disabled for createRoot [#16517](https://github.com/openshift/console/pull/16517)
* [OCPBUGS-86614](https://issues.redhat.com/browse/OCPBUGS-86614): prep for 4.22 GA SDK publish [#16507](https://github.com/openshift/console/pull/16507)
* [CONSOLE-5308](https://issues.redhat.com/browse/CONSOLE-5308): Centralize ResizeObserver polyfill in Jest setup for unit tests [#16506](https://github.com/openshift/console/pull/16506)
* [CONSOLE-5286](https://issues.redhat.com/browse/CONSOLE-5286): Block snapshot tests via ESLint and migrate existing tests to explicit assertions [#16427](https://github.com/openshift/console/pull/16427)
* [CONSOLE-5307](https://issues.redhat.com/browse/CONSOLE-5307): Remove unused exports and dead code [#16502](https://github.com/openshift/console/pull/16502)
* NO-JIRA: Update plugin SDK core package CHANGELOG [#16496](https://github.com/openshift/console/pull/16496)
* NO-JIRA: Capitalize "Basic" in secret dropdown label [#16490](https://github.com/openshift/console/pull/16490)
* [OCPBUGS-83767](https://issues.redhat.com/browse/OCPBUGS-83767): Helm upgrade — preserve release values when changing chart version [#16364](https://github.com/openshift/console/pull/16364)
* [OCPBUGS-86491](https://issues.redhat.com/browse/OCPBUGS-86491): Fix macOS Option key in pod terminal [#16492](https://github.com/openshift/console/pull/16492)
* [CONSOLE-5293](https://issues.redhat.com/browse/CONSOLE-5293): Update Dockerfile.downloads for 4.22 and add RHEL 8/9 oc binaries [#16455](https://github.com/openshift/console/pull/16455)
* [CONSOLE-5298](https://issues.redhat.com/browse/CONSOLE-5298): enable http2 on the backend [#16471](https://github.com/openshift/console/pull/16471)
* [CONSOLE-5253](https://issues.redhat.com/browse/CONSOLE-5253): Extend Unit Tests: Console-App - Core Navigation & Orchestration [#16452](https://github.com/openshift/console/pull/16452)
* [OCPBUGS-86488](https://issues.redhat.com/browse/OCPBUGS-86488): Bump to PatternFly 6.5.1 [#16491](https://github.com/openshift/console/pull/16491)
* [CONSOLE-5244](https://issues.redhat.com/browse/CONSOLE-5244): Migrate webterminal-plugin Cypress tests to Playwright [#16461](https://github.com/openshift/console/pull/16461)
* [CONSOLE-5110](https://issues.redhat.com/browse/CONSOLE-5110): update to PatternFly 6.5.0 [#16172](https://github.com/openshift/console/pull/16172)
* [OCPBUGS-82512](https://issues.redhat.com/browse/OCPBUGS-82512): Fix knative e2e test failures caused by createRoot timing [#16289](https://github.com/openshift/console/pull/16289)
* [CONSOLE-5300](https://issues.redhat.com/browse/CONSOLE-5300): Parallelize context detection to reduce initial load time [#16477](https://github.com/openshift/console/pull/16477)
* [HELM-703](https://issues.redhat.com/browse/HELM-703): Add authentication for Helm chart URLs [#16360](https://github.com/openshift/console/pull/16360)
* [CONSOLE-5194](https://issues.redhat.com/browse/CONSOLE-5194): Audit and fix Claude Code skills for accuracy [#16316](https://github.com/openshift/console/pull/16316)
* [OCPBUGS-84876](https://issues.redhat.com/browse/OCPBUGS-84876): Remove DataViewToolbar wrapper from bottom pagination [#16479](https://github.com/openshift/console/pull/16479)
* NO-JIRA: Add `eslint-plugin-no-barrel-files` [#16476](https://github.com/openshift/console/pull/16476)
* [OCPBUGS-84214](https://issues.redhat.com/browse/OCPBUGS-84214): Fix Shipwright detail pages crashing with React error #310 [#16474](https://github.com/openshift/console/pull/16474)
* [CONSOLE-5197](https://issues.redhat.com/browse/CONSOLE-5197): Improve Playwright artifact collection and add safety checks [#16463](https://github.com/openshift/console/pull/16463)
* [OCPBUGS-71878](https://issues.redhat.com/browse/OCPBUGS-71878): Show empty state instead of 403 error for users without projects [#16464](https://github.com/openshift/console/pull/16464)
* [OCPBUGS-82505](https://issues.redhat.com/browse/OCPBUGS-82505): Re-enable add-flow-ci.feature e2e tests disabled for createRoot adoption [#16285](https://github.com/openshift/console/pull/16285)
* NO-JIRA: Update Console plugin SDK CHANGELOG files [#16465](https://github.com/openshift/console/pull/16465)
* [CONSOLE-5280](https://issues.redhat.com/browse/CONSOLE-5280): Migrate cluster-settings Cypress tests to Playwright [#16444](https://github.com/openshift/console/pull/16444)
* [OCPBUGS-81521](https://issues.redhat.com/browse/OCPBUGS-81521): Adapt dashboard Prometheus polling interval based on query response time [#16441](https://github.com/openshift/console/pull/16441)
* [CONSOLE-5245](https://issues.redhat.com/browse/CONSOLE-5245): Install and configure eslint-plugin-playwright for e2e directory [#16433](https://github.com/openshift/console/pull/16433)
* [CONSOLE-5197](https://issues.redhat.com/browse/CONSOLE-5197): Collect Playwright test artifacts for Prow CI [#16453](https://github.com/openshift/console/pull/16453)
* [OCPBUGS-85649](https://issues.redhat.com/browse/OCPBUGS-85649): bump gRPC-Go package [#16442](https://github.com/openshift/console/pull/16442)
* [OCPBUGS-82513](https://issues.redhat.com/browse/OCPBUGS-82513): Enable Topology e2e tests [#16273](https://github.com/openshift/console/pull/16273)
* [CONSOLE-5200](https://issues.redhat.com/browse/CONSOLE-5200): add qa-verify skill for automated PR visual verification [#16429](https://github.com/openshift/console/pull/16429)
* [OCPBUGS-84669](https://issues.redhat.com/browse/OCPBUGS-84669): Fix ProjectLink to update active namespace in Redux [#16430](https://github.com/openshift/console/pull/16430)
* [CONSOLE-5212](https://issues.redhat.com/browse/CONSOLE-5212): Fix ESM compatibility for Playwright e2e tests [#16445](https://github.com/openshift/console/pull/16445)
* [OCPBUGS-79521](https://issues.redhat.com/browse/OCPBUGS-79521): Restore list page text and row filter functionality [#16440](https://github.com/openshift/console/pull/16440)
* [OCPBUGS-59404](https://issues.redhat.com/browse/OCPBUGS-59404): Allow VolumeSnapshot restore when parent PVC is deleted [#16447](https://github.com/openshift/console/pull/16447)
* [OCPBUGS-83569](https://issues.redhat.com/browse/OCPBUGS-83569): [main] CVE-2026-26996 Bump minimatch library [#16301](https://github.com/openshift/console/pull/16301)
* [CONSOLE-5211](https://issues.redhat.com/browse/CONSOLE-5211): Add Cypress-to-Playwright migration skills and context [#16315](https://github.com/openshift/console/pull/16315)
* [CONSOLE-5229](https://issues.redhat.com/browse/CONSOLE-5229): Enable RTL ESLint rules in Knative tests by removing file-level no-container / no-node-access suppressions [#16405](https://github.com/openshift/console/pull/16405)
* [CONSOLE-5197](https://issues.redhat.com/browse/CONSOLE-5197): Add Playwright E2E test infrastructure for Prow/CI [#16374](https://github.com/openshift/console/pull/16374)
* [CONSOLE-5034](https://issues.redhat.com/browse/CONSOLE-5034): Migrate tile-view-page and value-from-pair to TypeScript [#16412](https://github.com/openshift/console/pull/16412)
* [OCPBUGS-85242](https://issues.redhat.com/browse/OCPBUGS-85242): Add Suspense boundary to LazyRoutePage for plugin routes [#16409](https://github.com/openshift/console/pull/16409)
* [OCPBUGS-77952](https://issues.redhat.com/browse/OCPBUGS-77952): Fix devfile sample import by adding fallback for parent resolution failures [#16149](https://github.com/openshift/console/pull/16149)
* [OCPBUGS-70273](https://issues.redhat.com/browse/OCPBUGS-70273): Prevent binary secret data corruption when editing [#16053](https://github.com/openshift/console/pull/16053)
* [OCPBUGS-65950](https://issues.redhat.com/browse/OCPBUGS-65950): Update template whenever settings are updated [#16143](https://github.com/openshift/console/pull/16143)
* [CONSOLE-5212](https://issues.redhat.com/browse/CONSOLE-5212): Migrate Playwright setup to project dependencies [#16408](https://github.com/openshift/console/pull/16408)
* [CONSOLE-5285](https://issues.redhat.com/browse/CONSOLE-5285): remove corepack dep for build-(frontend/demos), bump yarn [#16426](https://github.com/openshift/console/pull/16426)
* [OCPBUGS-81518](https://issues.redhat.com/browse/OCPBUGS-81518): Increase Resource Dropdown visible items cap to 250. [#16398](https://github.com/openshift/console/pull/16398)
* [CONSOLE-5273](https://issues.redhat.com/browse/CONSOLE-5273): Expose `useToast` in the SDK [#16400](https://github.com/openshift/console/pull/16400)
* [OCPBUGS-59353](https://issues.redhat.com/browse/OCPBUGS-59353): Fix authentication redirect loop on repeated 401 responses [#15814](https://github.com/openshift/console/pull/15814)
* [CONSOLE-5015](https://issues.redhat.com/browse/CONSOLE-5015): Migrate NameValueEditor to TypeScript and PatternFly drag-drop [#16406](https://github.com/openshift/console/pull/16406)
* NO-JIRA: Add approvers and reviewers to helm-plugin OWNERS [#16361](https://github.com/openshift/console/pull/16361)
* [OCPBUGS-85043](https://issues.redhat.com/browse/OCPBUGS-85043): Remove `@console` imports from SDK dist [#16399](https://github.com/openshift/console/pull/16399)
* [OCPBUGS-77931](https://issues.redhat.com/browse/OCPBUGS-77931): Loosen default `img-src` CSP [#16388](https://github.com/openshift/console/pull/16388)
* [OCPBUGS-84324](https://issues.redhat.com/browse/OCPBUGS-84324): Update outdated documentation links and references [#16362](https://github.com/openshift/console/pull/16362)
* [CONSOLE-5212](https://issues.redhat.com/browse/CONSOLE-5212): Set up Playwright e2e test infrastructure [#16320](https://github.com/openshift/console/pull/16320)
* [OCPBUGS-84844](https://issues.redhat.com/browse/OCPBUGS-84844): VSphere plugin changes broke i18n translations - missing strings in locales/en/ [#16384](https://github.com/openshift/console/pull/16384)
* [OCPBUGS-80940](https://issues.redhat.com/browse/OCPBUGS-80940): Fix SDK publish workflow for Yarn Berry [#16392](https://github.com/openshift/console/pull/16392)
* [HELM-613](https://issues.redhat.com/browse/HELM-613): Reject basic auth over non-HTTPS for Helm chart repositories [#16317](https://github.com/openshift/console/pull/16317)
* [OCPBUGS-81519](https://issues.redhat.com/browse/OCPBUGS-81519): Fix Search page state mutation and unnecessary component remounts [#16266](https://github.com/openshift/console/pull/16266)
* [OCPBUGS-84876](https://issues.redhat.com/browse/OCPBUGS-84876): Add bottom pagination to ConsoleDataView for mobile responsiveness [#16391](https://github.com/openshift/console/pull/16391)
* [OCPBUGS-84856](https://issues.redhat.com/browse/OCPBUGS-84856): Fix ESLint Testing Library plugin PR review feedback [#16387](https://github.com/openshift/console/pull/16387)
* [OCPBUGS-82140](https://issues.redhat.com/browse/OCPBUGS-82140): Remove PII from events [#16365](https://github.com/openshift/console/pull/16365)
* NO-JIRA: Align Dockerfile.dev with multi-arch Dockerfile structure [#16390](https://github.com/openshift/console/pull/16390)
* [OCPBUGS-79363](https://issues.redhat.com/browse/OCPBUGS-79363): Move xterm to its own chunk [#16370](https://github.com/openshift/console/pull/16370)
* NO-JIRA: zsh compatibility for microcopy-review [#16389](https://github.com/openshift/console/pull/16389)
* NO-JIRA: Add fsgreco to frontend reviewers [#16381](https://github.com/openshift/console/pull/16381)
* [CONSOLE-5184](https://issues.redhat.com/browse/CONSOLE-5184): Enable ESLint Plugins for React Testing Library [#16270](https://github.com/openshift/console/pull/16270)
* [OCPBUGS-84710](https://issues.redhat.com/browse/OCPBUGS-84710): Fix ConsoleDataView filter order: Name and Label should appear first [#16375](https://github.com/openshift/console/pull/16375)
* [OCPBUGS-84227](https://issues.redhat.com/browse/OCPBUGS-84227): i18n upload/download routine task - version 4.22 [#16318](https://github.com/openshift/console/pull/16318)
* [OCPBUGS-84230](https://issues.redhat.com/browse/OCPBUGS-84230): [release-4.22] - Re-enable cluster-settings/update-modal.cy.ts e2e test disabled for createRoot adoption [#16319](https://github.com/openshift/console/pull/16319)
* [OCPBUGS-81522](https://issues.redhat.com/browse/OCPBUGS-81522): Reduce dashboard re-renders by memoizing cards and stabilizing prop references [#16367](https://github.com/openshift/console/pull/16367)
* [CONSOLE-5203](https://issues.redhat.com/browse/CONSOLE-5203): Remove old QE team from our repos [#16312](https://github.com/openshift/console/pull/16312)
* [OCPBUGS-81518](https://issues.redhat.com/browse/OCPBUGS-81518): Fix ResourceListDropdown performance on large clusters [#16252](https://github.com/openshift/console/pull/16252)
* [OCPBUGS-79067](https://issues.redhat.com/browse/OCPBUGS-79067): Fix crash when switching language to English [#16366](https://github.com/openshift/console/pull/16366)
* NO-JIRA: Remove broken entrypoints and unused packages [#16357](https://github.com/openshift/console/pull/16357)
* [OCPBUGS-82511](https://issues.redhat.com/browse/OCPBUGS-82511): re-enable helm-release.feature [#16274](https://github.com/openshift/console/pull/16274)
* [CONSOLE-5227](https://issues.redhat.com/browse/CONSOLE-5227): Upgrade ESLint from v6 to v8 and @typescript-eslint to v8 [#16353](https://github.com/openshift/console/pull/16353)
* [OCPBUGS-84338](https://issues.redhat.com/browse/OCPBUGS-84338): Update resolveDynamicModuleMaps to skip unavailable packages [#16340](https://github.com/openshift/console/pull/16340)
* [OCPBUGS-84320](https://issues.redhat.com/browse/OCPBUGS-84320): Use popover token in QS modal [#16339](https://github.com/openshift/console/pull/16339)
* [OCPBUGS-84296](https://issues.redhat.com/browse/OCPBUGS-84296): fix Helm list page redirect after upgrade/rollback [#16336](https://github.com/openshift/console/pull/16336)
* NO-JIRA: prepare for 4.22-prerelease.3 sdk publish [#16338](https://github.com/openshift/console/pull/16338)
* [CONSOLE-5144](https://issues.redhat.com/browse/CONSOLE-5144), [OCPBUGS-81319](https://issues.redhat.com/browse/OCPBUGS-81319), [OCPBUGS-83823](https://issues.redhat.com/browse/OCPBUGS-83823): 4.22 SDK fixes [#15655](https://github.com/openshift/console/pull/15655)
* [OCPBUGS-83812](https://issues.redhat.com/browse/OCPBUGS-83812): Fix race conditions in OLM descriptors Cypress test [#16304](https://github.com/openshift/console/pull/16304)
* [OCPBUGS-83816](https://issues.redhat.com/browse/OCPBUGS-83816): Fix race conditions in create-namespace Cypress tests [#16306](https://github.com/openshift/console/pull/16306)
* NO-JIRA: enable multi-architecture yarn builds [#16228](https://github.com/openshift/console/pull/16228)
* [OCPBUGS-83813](https://issues.redhat.com/browse/OCPBUGS-83813): Fix race conditions in debug pod Cypress tests [#16305](https://github.com/openshift/console/pull/16305)
* [OCPBUGS-81668](https://issues.redhat.com/browse/OCPBUGS-81668): Fix User Preferences responsive breakpoints bug [#16279](https://github.com/openshift/console/pull/16279)
* [OCPBUGS-77864](https://issues.redhat.com/browse/OCPBUGS-77864): Add gRPC probe support to container details view [#16245](https://github.com/openshift/console/pull/16245)
* [CONSOLE-5176](https://issues.redhat.com/browse/CONSOLE-5176): Refactor RTL Tests from fireEvent to userEvent [#16294](https://github.com/openshift/console/pull/16294)
* [OCPBUGS-82504](https://issues.redhat.com/browse/OCPBUGS-82504): Re-enable cluster-settings/update-modal.cy.ts e2e test disabled for createRoot adoption [#16283](https://github.com/openshift/console/pull/16283)
* NO-JIRA: Replace deprecated io/ioutil pkg [#15902](https://github.com/openshift/console/pull/15902)
* [OCPBUGS-81630](https://issues.redhat.com/browse/OCPBUGS-81630): Fix unnecessary error on Node Terminal tab [#16263](https://github.com/openshift/console/pull/16263)
* [OCPBUGS-78365](https://issues.redhat.com/browse/OCPBUGS-78365): Fix create visual connector in Topology [#16241](https://github.com/openshift/console/pull/16241)
* [OCPBUGS-83532](https://issues.redhat.com/browse/OCPBUGS-83532): Add empty state visibility check to CRD test [#16303](https://github.com/openshift/console/pull/16303)
* [CONSOLE-5204](https://issues.redhat.com/browse/CONSOLE-5204): Merge PR templates [#16287](https://github.com/openshift/console/pull/16287)
* [OCPBUGS-82510](https://issues.redhat.com/browse/OCPBUGS-82510): Fix web-terminal-adminuser e2e tests broken by createRoot [#16284](https://github.com/openshift/console/pull/16284)
* [OCPBUGS-83446](https://issues.redhat.com/browse/OCPBUGS-83446): Fix Cypress test timeouts by using correct timeout option [#16280](https://github.com/openshift/console/pull/16280)
* [OCPBUGS-83532](https://issues.redhat.com/browse/OCPBUGS-83532): Fix race condition in CRD Cypress test [#16288](https://github.com/openshift/console/pull/16288)
* NO-JIRA: enable Cypress Cloud in CI [#16277](https://github.com/openshift/console/pull/16277)
* [CONSOLE-4809](https://issues.redhat.com/browse/CONSOLE-4809): Extend RTL Test Coverage for Components Migrated from Enzyme [#16249](https://github.com/openshift/console/pull/16249)
* [CONSOLE-4512](https://issues.redhat.com/browse/CONSOLE-4512), [OCPBUGS-82473](https://issues.redhat.com/browse/OCPBUGS-82473): Switch from legacy `render` to `createRoot` [#16202](https://github.com/openshift/console/pull/16202)
* [OCPBUGS-77113](https://issues.redhat.com/browse/OCPBUGS-77113): remove dev to admin links as dev monitoring views are enabled [#16163](https://github.com/openshift/console/pull/16163)
* NO-JIRA: Update Dockerfile.dev to use latest base images [#16264](https://github.com/openshift/console/pull/16264)
* [CONSOLE-5065](https://issues.redhat.com/browse/CONSOLE-5065): Refactor dynamic module import transform code [#16224](https://github.com/openshift/console/pull/16224)
* [OCPBUGS-76556](https://issues.redhat.com/browse/OCPBUGS-76556): fix Developer Sandbox telemetry [#16020](https://github.com/openshift/console/pull/16020)
* NO-JIRA: Add stefanonardo to frontend reviewers#16267 [#16267](https://github.com/openshift/console/pull/16267)
* [OCPBUGS-78904](https://issues.redhat.com/browse/OCPBUGS-78904): Mark notification drawer title for translation [#16229](https://github.com/openshift/console/pull/16229)
* [CONSOLE-3955](https://issues.redhat.com/browse/CONSOLE-3955): Migrate LogSnippet to PatternFly component [#16190](https://github.com/openshift/console/pull/16190)
* [OCPBUGS-81654](https://issues.redhat.com/browse/OCPBUGS-81654): Filter out isActionCell prop to fix React warning [#16247](https://github.com/openshift/console/pull/16247)
* [CONSOLE-5152](https://issues.redhat.com/browse/CONSOLE-5152): bump cypress to latest [#16244](https://github.com/openshift/console/pull/16244)
* [OCPBUGS-81744](https://issues.redhat.com/browse/OCPBUGS-81744): Convert cluster update status integration test to unit test [#16260](https://github.com/openshift/console/pull/16260)
* [OCPBUGS-81506](https://issues.redhat.com/browse/OCPBUGS-81506): Add missing i18n translations for Pagination component [#16233](https://github.com/openshift/console/pull/16233)
* [CNV-62016](https://issues.redhat.com/browse/CNV-62016): add description to ResourceQuota page title [#16086](https://github.com/openshift/console/pull/16086)
* [OCPBUGS-80989](https://issues.redhat.com/browse/OCPBUGS-80989): Skip to fetch resource if model not found and load the other resources in list-page [#16230](https://github.com/openshift/console/pull/16230)
* [CONSOLE-5110](https://issues.redhat.com/browse/CONSOLE-5110): Assorted fixes and improvements [#16250](https://github.com/openshift/console/pull/16250)
* [OCPBUGS-79355](https://issues.redhat.com/browse/OCPBUGS-79355): Fix and enable OLM Package E2E tests disabled during the public/ directory useK8sWatchResource refactoring [#16220](https://github.com/openshift/console/pull/16220)
* [OCPBUGS-74156](https://issues.redhat.com/browse/OCPBUGS-74156): Prevent pod log search from shifting page layout [#16223](https://github.com/openshift/console/pull/16223)
* Revert "OCPBUGS-74156: Prevent pod log viewer from shifting page layout when searching" [#16218](https://github.com/openshift/console/pull/16218)
* [OCPBUGS-74506](https://issues.redhat.com/browse/OCPBUGS-74506): Remove ConsolePluginSecurityPolicy featuregate [#16013](https://github.com/openshift/console/pull/16013)
* [CONSOLE-5151](https://issues.redhat.com/browse/CONSOLE-5151): Replace showdown with marked [#16239](https://github.com/openshift/console/pull/16239)
* [CONSOLE-5094](https://issues.redhat.com/browse/CONSOLE-5094): cypress test improvements [#16046](https://github.com/openshift/console/pull/16046)
* [OCPBUGS-81331](https://issues.redhat.com/browse/OCPBUGS-81331): Storage > VolumeSnapshots and VAC throws error [#16219](https://github.com/openshift/console/pull/16219)
* [CONSOLE-4447](https://issues.redhat.com/browse/CONSOLE-4447): Additional modals switched to use ModalFooterWithAlerts for consistency [#16171](https://github.com/openshift/console/pull/16171)
* [OCPBUGS-80939](https://issues.redhat.com/browse/OCPBUGS-80939): Add robots.txt policy to console [#16205](https://github.com/openshift/console/pull/16205)
* [OCPBUGS-79315](https://issues.redhat.com/browse/OCPBUGS-79315): fix analyze.sh/react-icons treeshake [#16188](https://github.com/openshift/console/pull/16188)
* [CONSOLE-5015](https://issues.redhat.com/browse/CONSOLE-5015): Remove drag-and-drop from TextColumnField [#16204](https://github.com/openshift/console/pull/16204)
* [CONSOLE-5065](https://issues.redhat.com/browse/CONSOLE-5065): Update list of PatternFly packages that support dynamic modules [#16182](https://github.com/openshift/console/pull/16182)
* NO-ISSUE: frontend/packages/console-dynamic-plugin-sdk/README: 4.22 doesn't support PatternFly 5 [#16206](https://github.com/openshift/console/pull/16206)
* [OCPBUGS-62700](https://issues.redhat.com/browse/OCPBUGS-62700): Fix VolumeSnapshot table sorting [#16200](https://github.com/openshift/console/pull/16200)
* [OCPBUGS-79581](https://issues.redhat.com/browse/OCPBUGS-79581): Fix Deprecated Operator Warnings E2E tests Skipped in the Firehose Public Folder PR [#16197](https://github.com/openshift/console/pull/16197)
* [OCPBUGS-74156](https://issues.redhat.com/browse/OCPBUGS-74156): Prevent pod log viewer from shifting page layout when searching [#16193](https://github.com/openshift/console/pull/16193)
* [OCPBUGS-79678](https://issues.redhat.com/browse/OCPBUGS-79678): Align the search input so that its next to the select menu toggle [#16198](https://github.com/openshift/console/pull/16198)
* [OCPBUGS-78584](https://issues.redhat.com/browse/OCPBUGS-78584): Preserve query params in CatalogRedirect [#16165](https://github.com/openshift/console/pull/16165)
* [OCPBUGS-79525](https://issues.redhat.com/browse/OCPBUGS-79525): Fix null reference error in subscription action menu [#16196](https://github.com/openshift/console/pull/16196)
* [OCPBUGS-72526](https://issues.redhat.com/browse/OCPBUGS-72526): Impersonating user loads extra pages that user not authorized to view [#16088](https://github.com/openshift/console/pull/16088)
* [OCPBUGS-79000](https://issues.redhat.com/browse/OCPBUGS-79000): Fix perspective switcher icon suspending the whole app [#16183](https://github.com/openshift/console/pull/16183)
* [CONSOLE-5015](https://issues.redhat.com/browse/CONSOLE-5015): Refactor pinned nav to react-drag-drop [#16146](https://github.com/openshift/console/pull/16146)
* [CONSOLE-5031](https://issues.redhat.com/browse/CONSOLE-5031): Remove Firehose Component and Fix and Cleanup Impacted Types [#16096](https://github.com/openshift/console/pull/16096)
* [CONSOLE-4983](https://issues.redhat.com/browse/CONSOLE-4983): Add Groups to node details [#15981](https://github.com/openshift/console/pull/15981)
* NO-JIRA: prep for 4.22.0-prerelease.2 SDK publish [#16201](https://github.com/openshift/console/pull/16201)
* [OCPBUGS-74140](https://issues.redhat.com/browse/OCPBUGS-74140): Prevent Chinese characters from rendering as unicode escape sequences in alert messages [#16156](https://github.com/openshift/console/pull/16156)
* [OCPBUGS-77814](https://issues.redhat.com/browse/OCPBUGS-77814): Add E2E tests for VolumeAttributesClass UI [#16085](https://github.com/openshift/console/pull/16085)
* [CONSOLE-5073](https://issues.redhat.com/browse/CONSOLE-5073): Update redux-related packages to latest [#16087](https://github.com/openshift/console/pull/16087)
* [OCPBUGS-78543](https://issues.redhat.com/browse/OCPBUGS-78543): Hide filter category selector when only one filter exists [#16153](https://github.com/openshift/console/pull/16153)
* [CONSOLE-5015](https://issues.redhat.com/browse/CONSOLE-5015): Replace react-dnd with PF MultipleFileUpload in topology [#16179](https://github.com/openshift/console/pull/16179)
* [CONSOLE-5134](https://issues.redhat.com/browse/CONSOLE-5134): Update to Go 1.25, K8s 1.35, and Helm 3.20 [#16147](https://github.com/openshift/console/pull/16147)
* [CONSOLE-5135](https://issues.redhat.com/browse/CONSOLE-5135): add deprecation warning for `react-router-dom` [#16178](https://github.com/openshift/console/pull/16178)
* [OCPBUGS-79462](https://issues.redhat.com/browse/OCPBUGS-79462): Skip flaky Data Grid operator E2E tests [#16191](https://github.com/openshift/console/pull/16191)
* [CONSOLE-5027](https://issues.redhat.com/browse/CONSOLE-5027): Refactor public/ Directory Components to useK8sWatchResource(s) [#15954](https://github.com/openshift/console/pull/15954)
* [OCPBUGS-63391](https://issues.redhat.com/browse/OCPBUGS-63391): Replace DataViewTextFilter with existing custom TextFilter [#16151](https://github.com/openshift/console/pull/16151)
* [OCPBUGS-73803](https://issues.redhat.com/browse/OCPBUGS-73803): Fix incorrect OLMv1 documentation URL [#16052](https://github.com/openshift/console/pull/16052)
* [OCPBUGS-74346](https://issues.redhat.com/browse/OCPBUGS-74346): Fix useOperatorCatalogCategories hook. [#16093](https://github.com/openshift/console/pull/16093)
* [OCPBUGS-78534](https://issues.redhat.com/browse/OCPBUGS-78534): Make E2E test create helper idempotent and improve test cleanup [#16148](https://github.com/openshift/console/pull/16148)
* [OCPBUGS-66147](https://issues.redhat.com/browse/OCPBUGS-66147): Make folder field optional for vsphere [#16142](https://github.com/openshift/console/pull/16142)
* [OCPBUGS-77912](https://issues.redhat.com/browse/OCPBUGS-77912): Fix TypeError in OLS code import to console [#16119](https://github.com/openshift/console/pull/16119)
* [OCPBUGS-44612](https://issues.redhat.com/browse/OCPBUGS-44612): Remove useUserPreferenceCompatibility and withUserPreferenceCompatibility [#16076](https://github.com/openshift/console/pull/16076)
* [CONSOLE-5073](https://issues.redhat.com/browse/CONSOLE-5073): Bump i18next to latest [#16150](https://github.com/openshift/console/pull/16150)
* [CONSOLE-4447](https://issues.redhat.com/browse/CONSOLE-4447): Update SecretFormWrapper modal to use ModalFooterWithAlerts [#16167](https://github.com/openshift/console/pull/16167)
* [RFE-7965](https://issues.redhat.com/browse/RFE-7965): add basic auth support for helm repositories [#15624](https://github.com/openshift/console/pull/15624)
* [CONSOLE-5094](https://issues.redhat.com/browse/CONSOLE-5094): Add pesudo CSP violation detection to Cypress [#16048](https://github.com/openshift/console/pull/16048)
* NO-JIRA: Update demo plugin README [#16166](https://github.com/openshift/console/pull/16166)
* [CONSOLE-5093](https://issues.redhat.com/browse/CONSOLE-5093): Remove support for deprecated extensions [#16043](https://github.com/openshift/console/pull/16043)
* [CONSOLE-4447](https://issues.redhat.com/browse/CONSOLE-4447): Remove deprecated modal components and CSS [#16126](https://github.com/openshift/console/pull/16126)
* [CONSOLE-5018](https://issues.redhat.com/browse/CONSOLE-5018): Refactor `UNSAFE_` class components to FC [#16062](https://github.com/openshift/console/pull/16062)
* [CONSOLE-5129](https://issues.redhat.com/browse/CONSOLE-5129): Theme context cleanup [#16155](https://github.com/openshift/console/pull/16155)
* [OCPBUGS-78390](https://issues.redhat.com/browse/OCPBUGS-78390): Reset pagination page when changing namespace [#16138](https://github.com/openshift/console/pull/16138)
* [OCPBUGS-78253](https://issues.redhat.com/browse/OCPBUGS-78253): Fix InstallPlan > Components layout issue [#16127](https://github.com/openshift/console/pull/16127)
* [CONSOLE-4447](https://issues.redhat.com/browse/CONSOLE-4447): Migrate @console/shared modals to PatternFly v6 Modal components [#16079](https://github.com/openshift/console/pull/16079)
* NO-JIRA: Remove cursor context [#16106](https://github.com/openshift/console/pull/16106)
* [CONSOLE-5087](https://issues.redhat.com/browse/CONSOLE-5087): Refactor console-shared-package from Firehose to useK8sWatchResource [#16077](https://github.com/openshift/console/pull/16077)
* [CONSOLE-4447](https://issues.redhat.com/browse/CONSOLE-4447): Migrate modal hooks from useModal to useOverlay [#16061](https://github.com/openshift/console/pull/16061)
* [CONSOLE-5114](https://issues.redhat.com/browse/CONSOLE-5114): Clean up React Router imports and dependencies [#16139](https://github.com/openshift/console/pull/16139)
* [OCPBUGS-78499](https://issues.redhat.com/browse/OCPBUGS-78499): Fix curly quote in operator-hub-community-provider-modal [#16145](https://github.com/openshift/console/pull/16145)
* NO-JIRA: Update PageHeading types [#16095](https://github.com/openshift/console/pull/16095)
* NO-JIRA: Add a progress bar when building [#16099](https://github.com/openshift/console/pull/16099)
* [CONSOLE-4447](https://issues.redhat.com/browse/CONSOLE-4447): Migrate knative-plugin modals to PatternFly 6 [#16065](https://github.com/openshift/console/pull/16065)
* [OCPBUGS-78404](https://issues.redhat.com/browse/OCPBUGS-78404): Fix flaky secret integration tests [#16140](https://github.com/openshift/console/pull/16140)
* [CONSOLE-4447](https://issues.redhat.com/browse/CONSOLE-4447): Migrate core modals to PatternFly 6 Modal components (part 2) [#16123](https://github.com/openshift/console/pull/16123)
* And 23 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/console/compare/fd00ba02a759b5b85fb667ef68f4c15433edb1eb...ec1ce9ae7581ffc27725f4f61770ab898b62b111)
### [console-operator](https://github.com/openshift/console-operator/tree/658550c71d5664068572d217a58ae7bcc2eb6847)
* [CONSOLE-5298](https://issues.redhat.com/browse/CONSOLE-5298): Auto-generate throwaway TLS cert for HTTP/2 support [#1170](https://github.com/openshift/console-operator/pull/1170)
* NO-JIRA: feat: have CVO inject the centralized TLS configuration into the operator's config [#1167](https://github.com/openshift/console-operator/pull/1167)
* [OCPBUGS-74872](https://issues.redhat.com/browse/OCPBUGS-74872): Sort plugin list to make them deterministic [#1107](https://github.com/openshift/console-operator/pull/1107)
* [OCPBUGS-86117](https://issues.redhat.com/browse/OCPBUGS-86117): Add unit and e2e test coverage for cert rotation redeployment [#1160](https://github.com/openshift/console-operator/pull/1160)
* [OCPBUGS-85650](https://issues.redhat.com/browse/OCPBUGS-85650): bump gRPC-Go package [#1156](https://github.com/openshift/console-operator/pull/1156)
* [MON-4510](https://issues.redhat.com/browse/MON-4510): Migrate Prometheus targets discovering from Endpoints to EndpointSlices [#1106](https://github.com/openshift/console-operator/pull/1106)
* [OCPBUGS-85060](https://issues.redhat.com/browse/OCPBUGS-85060): feat: use 2 replicas for console on tnf [#1151](https://github.com/openshift/console-operator/pull/1151)
* [CONSOLE-5204](https://issues.redhat.com/browse/CONSOLE-5204): Add PR template [#1141](https://github.com/openshift/console-operator/pull/1141)
* [OCPBUGS-79068](https://issues.redhat.com/browse/OCPBUGS-79068): Fix HelmChartRepository YAML format [#1129](https://github.com/openshift/console-operator/pull/1129)
* [CONSOLE-5138](https://issues.redhat.com/browse/CONSOLE-5138): Enable readOnlyRootFilesystem for console and download pod [#1123](https://github.com/openshift/console-operator/pull/1123)
* [OCPBUGS-78477](https://issues.redhat.com/browse/OCPBUGS-78477): Bump API to support ExternalOIDCWithUpstreamParity new API fields [#1125](https://github.com/openshift/console-operator/pull/1125)
* [OCPBUGS-63502](https://issues.redhat.com/browse/OCPBUGS-63502): Redeploy console pods upon cert rotation [#1093](https://github.com/openshift/console-operator/pull/1093)
* [OCPBUGS-65622](https://issues.redhat.com/browse/OCPBUGS-65622): add controller for downloads service account deletion logic [#1111](https://github.com/openshift/console-operator/pull/1111)
* Sync Dockerfile.ocp image [#1127](https://github.com/openshift/console-operator/pull/1127)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/console-operator/compare/3d173bcd4293731589d746450509e074dbc4dc59...658550c71d5664068572d217a58ae7bcc2eb6847)
### [container-networking-plugins, containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins/tree/d6f73950658d258e0ddbf2a4ac92e13ac840158b)
* [OCPBUGS-85826](https://issues.redhat.com/browse/OCPBUGS-85826): rebase to pick up dependency updates [#237](https://github.com/openshift/containernetworking-plugins/pull/237)
* [Full changelog](https://github.com/openshift/containernetworking-plugins/compare/747ad66caa1109b2b490aebad01af42bd2d738f1...d6f73950658d258e0ddbf2a4ac92e13ac840158b)
### [coredns](https://github.com/openshift/coredns/tree/3c21b066c9bd86caa06f790dcd1c046667875d46)
* [OCPBUGS-83943](https://issues.redhat.com/browse/OCPBUGS-83943): Bump gRPC to v1.79.3 to resolve CVE-2026-33186 [#183](https://github.com/openshift/coredns/pull/183)
* [Full changelog](https://github.com/openshift/coredns/compare/0dded2d232dab43c107b1dab9d0d9fdfd8259622...3c21b066c9bd86caa06f790dcd1c046667875d46)
### [csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/f8bb5994f3cee8ee2bb5cca25e3e9783ad7dd57c)
* UPSTREAM-SYNC: Sync main with latest upstream (release-1.36) [#393](https://github.com/openshift/cloud-provider-openstack/pull/393)
* UPSTREAM-SYNC: Sync main with latest upstream (release-1.35) [#370](https://github.com/openshift/cloud-provider-openstack/pull/370)
* [OCPBUGS-77578](https://issues.redhat.com/browse/OCPBUGS-77578): Updating ose-openstack-cinder-csi-driver-container image to be consistent with ART for 4.22 [#374](https://github.com/openshift/cloud-provider-openstack/pull/374)
* [OCPBUGS-77755](https://issues.redhat.com/browse/OCPBUGS-77755): Updating ose-openstack-cloud-controller-manager-container image to be consistent with ART for 4.22 [#376](https://github.com/openshift/cloud-provider-openstack/pull/376)
* [OCPBUGS-77592](https://issues.redhat.com/browse/OCPBUGS-77592): Updating csi-driver-manila-container image to be consistent with ART for 4.22 [#375](https://github.com/openshift/cloud-provider-openstack/pull/375)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/fd31b5da11d75a7a80e7c4a6c7a56acf304e2661...f8bb5994f3cee8ee2bb5cca25e3e9783ad7dd57c)
### [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs/tree/f733db66fcd02f714fcc6feef9d0c2ed9135c347)
* NO-JIRA: CVE-2026-35469: Bump github.com/moby/spdystream@v0.5.1 [#189](https://github.com/openshift/csi-driver-nfs/pull/189)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master into main [#179](https://github.com/openshift/csi-driver-nfs/pull/179)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master into main [#175](https://github.com/openshift/csi-driver-nfs/pull/175)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master into main [#170](https://github.com/openshift/csi-driver-nfs/pull/170)
* [Full changelog](https://github.com/openshift/csi-driver-nfs/compare/e9f249405ad2bced3d1805dd5beda368d7f3d564...f733db66fcd02f714fcc6feef9d0c2ed9135c347)
### [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner/tree/2ccbf8c35aa2e5b851116706c018ff44f0bb7d08)
* NO-JIRA: OCPBUGS-82033: Bump google.golang.org/grpc to 1.79.3 [#124](https://github.com/openshift/csi-external-provisioner/pull/124)
* [Full changelog](https://github.com/openshift/csi-external-provisioner/compare/f90c06a3113696cdb757e4b7c9dcfeb0e9dddb81...2ccbf8c35aa2e5b851116706c018ff44f0bb7d08)
### [csi-external-snapshotter, csi-snapshot-controller](https://github.com/openshift/csi-external-snapshotter/tree/77d02e52a442c1a98457797bf8eb5777489aabae)
* NO-JIRA: Bump google.golang.org/grpc to v1.79.3 [#215](https://github.com/openshift/csi-external-snapshotter/pull/215)
* [OCPBUGS-77492](https://issues.redhat.com/browse/OCPBUGS-77492): UPSTREAM: 1392: Fix VolumeSnapshotContent deletion [#207](https://github.com/openshift/csi-external-snapshotter/pull/207)
* [Full changelog](https://github.com/openshift/csi-external-snapshotter/compare/d1bc3ffaa9759c13a06c2ec61c541342e71bd109...77d02e52a442c1a98457797bf8eb5777489aabae)
### [docker-builder](https://github.com/openshift/builder/tree/2cda03a93696d4620703848471b3b873b0b2fa1e)
* [OCPBUGS-77610](https://issues.redhat.com/browse/OCPBUGS-77610): Updating openshift-enterprise-builder-container image to be consistent with ART for 4.22 [#503](https://github.com/openshift/builder/pull/503)
* [OKD-322](https://issues.redhat.com/browse/OKD-322): Update Dockerfile to work on CentOS/RHEL 10 [#500](https://github.com/openshift/builder/pull/500)
* [Full changelog](https://github.com/openshift/builder/compare/711f2e6886a2afaa281524cd08327f86771f53b0...2cda03a93696d4620703848471b3b873b0b2fa1e)
### [docker-registry](https://github.com/openshift/image-registry/tree/57039cd2d9c87547cdf9a8d1dc7cb94f1ca089f7)
* [OCPBUGS-84680](https://issues.redhat.com/browse/OCPBUGS-84680): pin cloud.google.com/go/storage to v1.30.1 to fix blob deletion [#469](https://github.com/openshift/image-registry/pull/469)
* [CNTRLPLANE-3073](https://issues.redhat.com/browse/CNTRLPLANE-3073): bump kubernetes to v1.35 [#467](https://github.com/openshift/image-registry/pull/467)
* [Full changelog](https://github.com/openshift/image-registry/compare/d4cce000f749280e593ed758791b6ef97cc01746...57039cd2d9c87547cdf9a8d1dc7cb94f1ca089f7)
### [driver-toolkit](https://github.com/openshift/driver-toolkit/tree/dc6927de4444956b521131f5f142b6922195834b)
* [OCPBUGS-69851](https://issues.redhat.com/browse/OCPBUGS-69851): Adding support for payload multiple-stream. [#180](https://github.com/openshift/driver-toolkit/pull/180)
* [Full changelog](https://github.com/openshift/driver-toolkit/compare/7aa4007a8601bf4bb23b696f580c022f58877223...dc6927de4444956b521131f5f142b6922195834b)
### [egress-router-cni](https://github.com/openshift/egress-router-cni/tree/d37f51e057620bdee564f68dcfde955acf033d3e)
* [OCPBUGS-83286](https://issues.redhat.com/browse/OCPBUGS-83286): Fix swallowed errors in cmdAdd/cmdDel causing empty CNI result [#95](https://github.com/openshift/egress-router-cni/pull/95)
* NO-JIRA: Update OWNERs file [#96](https://github.com/openshift/egress-router-cni/pull/96)
* [Full changelog](https://github.com/openshift/egress-router-cni/compare/5e0f8d1b545899fda27c5e1cc8707d33cba1b534...d37f51e057620bdee564f68dcfde955acf033d3e)
### [etcd](https://github.com/openshift/etcd/tree/c543fe15324510d13e896c31232ecd5d100d9de5)
* [OCPBUGS-85258](https://issues.redhat.com/browse/OCPBUGS-85258): 5.0 rebase 3.6.11 [#375](https://github.com/openshift/etcd/pull/375)
* [OCPBUGS-82495](https://issues.redhat.com/browse/OCPBUGS-82495): 5.0/4.23 rebase 3.6.10 [#368](https://github.com/openshift/etcd/pull/368)
* [Full changelog](https://github.com/openshift/etcd/compare/d8d67b8ce849f816d6d23c904098336632e2348f...c543fe15324510d13e896c31232ecd5d100d9de5)
### [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp/tree/808c2a2d59dc0584d31484fe49085ba1de7bed74)
* [OCPBUGS-85551](https://issues.redhat.com/browse/OCPBUGS-85551), [OCPBUGS-85552](https://issues.redhat.com/browse/OCPBUGS-85552): Upgrade spdystream and grpc to fix CVEs [#115](https://github.com/openshift/cloud-provider-gcp/pull/115)
* NO-JIRA: Remove custom vendor scripts in favour of standard tooling [#111](https://github.com/openshift/cloud-provider-gcp/pull/111)
* NO-JIRA: Update OWNERS [#105](https://github.com/openshift/cloud-provider-gcp/pull/105)
* [OCPBUGS-78471](https://issues.redhat.com/browse/OCPBUGS-78471): Fix OSD ILB bug [#103](https://github.com/openshift/cloud-provider-gcp/pull/103)
* [OCPCLOUD-3274](https://issues.redhat.com/browse/OCPCLOUD-3274): Merge https://github.com/kubernetes/cloud-provider-gcp:master (378730f) into main [#99](https://github.com/openshift/cloud-provider-gcp/pull/99)
* [Full changelog](https://github.com/openshift/cloud-provider-gcp/compare/c87eef5d0dfc33bc07c9b74cd68f4b5f38203c04...808c2a2d59dc0584d31484fe49085ba1de7bed74)
### [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp/tree/8ae492a86a67ccb75790b2874bb6d6447270e110)
* [OCPBUGS-53005](https://issues.redhat.com/browse/OCPBUGS-53005): Remove references to master branch [#297](https://github.com/openshift/cluster-api-provider-gcp/pull/297)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.12.0 (b9b055d) into master [#295](https://github.com/openshift/cluster-api-provider-gcp/pull/295)
* [OCPBUGS-85101](https://issues.redhat.com/browse/OCPBUGS-85101): Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.11.2 (14609a0) into master [#273](https://github.com/openshift/cluster-api-provider-gcp/pull/273)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#292](https://github.com/openshift/cluster-api-provider-gcp/pull/292)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#284](https://github.com/openshift/cluster-api-provider-gcp/pull/284)
* NO-JIRA: Update manifests generator [#285](https://github.com/openshift/cluster-api-provider-gcp/pull/285)
* [OCPBUGS-77684](https://issues.redhat.com/browse/OCPBUGS-77684): Updating ose-gcp-cluster-api-controllers-container image to be consistent with ART for 4.22 [#272](https://github.com/openshift/cluster-api-provider-gcp/pull/272)
* NO-JIRA: Update OWNERS [#280](https://github.com/openshift/cluster-api-provider-gcp/pull/280)
* [Full changelog](https://github.com/openshift/cluster-api-provider-gcp/compare/37085d5287031ee68f58b165256d4104bba99886...8ae492a86a67ccb75790b2874bb6d6447270e110)
### [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp/tree/065e2b608a027ba47fce02aaabb986e6c650e6d6)
* NO-JIRA: Update OWNERS [#157](https://github.com/openshift/machine-api-provider-gcp/pull/157)
* [OCPBUGS-81576](https://issues.redhat.com/browse/OCPBUGS-81576): Bump gRPC-Go package for CVE fix [#155](https://github.com/openshift/machine-api-provider-gcp/pull/155)
* [OCPCLOUD-3279](https://issues.redhat.com/browse/OCPCLOUD-3279): Rebase to Kube 1.35 for Machine API Provider GCP [#145](https://github.com/openshift/machine-api-provider-gcp/pull/145)
* [Full changelog](https://github.com/openshift/machine-api-provider-gcp/compare/e31069d585cd2f3f7d93dee40ed6312c634c7c36...065e2b608a027ba47fce02aaabb986e6c650e6d6)
### [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver/tree/c58c624fef4cbac80e0efa1d40e8c359d257a1cd)
* UPSTREAM: 2297: OCPBUGS-83423: Bump google.golang.org/grpc to v1.79.3 [#121](https://github.com/openshift/gcp-pd-csi-driver/pull/121)
* [STOR-2751](https://issues.redhat.com/browse/STOR-2751): Rebase to upstream v1.24.1 for OCP 4.22 [#98](https://github.com/openshift/gcp-pd-csi-driver/pull/98)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver/compare/88e5fe85ca8aef5de6ac32f898325f44c33c0c2f...c58c624fef4cbac80e0efa1d40e8c359d257a1cd)
### [gcp-pd-csi-driver-operator](https://github.com/openshift/gcp-pd-csi-driver-operator/tree/684ef36213cdb8b8acbb014a63819c7bb410c746)
* NO-JIRA: Bump google.golang.org/grpc to v1.79.3 to address CVE-2026-33186 [#182](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/182)
* [STOR-2798](https://issues.redhat.com/browse/STOR-2798): Update image-snapshot CSI manifest to use operator provided imageVolumeSnapshotClass [#179](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/179)
* [STOR-2798](https://issues.redhat.com/browse/STOR-2798): Add test e2e manifest and VolumeSnapshotClass for image volumeSnapshotClass CSI tests [#178](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/178)
* [STOR-2762](https://issues.redhat.com/browse/STOR-2762): Bump all deps for 4.22 [#175](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/175)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver-operator/compare/14179b560cb644f386e42174a326d00bc7ba9479...684ef36213cdb8b8acbb014a63819c7bb410c746)
### [haproxy-router](https://github.com/openshift/router/tree/a86164c8ebaed55a2a28451fa913a04f10cc9a72)
* [OCPBUGS-87208](https://issues.redhat.com/browse/OCPBUGS-87208): Adding escapeHAProxySingleQuotes for sanitize [#785](https://github.com/openshift/router/pull/785)
* [NE-2572](https://issues.redhat.com/browse/NE-2572): use add/del haproxy api calls [#763](https://github.com/openshift/router/pull/763)
* [OCPBUGS-86168](https://issues.redhat.com/browse/OCPBUGS-86168): Bump google.golang.org/grpc to v1.79.3 [#777](https://github.com/openshift/router/pull/777)
* Reapply "OCPBUGS-55506: Prevent startup failures due to name resolution" [#677](https://github.com/openshift/router/pull/677)
* [OCPBUGS-77263](https://issues.redhat.com/browse/OCPBUGS-77263): create self-signed crt if failing to read default [#740](https://github.com/openshift/router/pull/740)
* [OCPBUGS-62267](https://issues.redhat.com/browse/OCPBUGS-62267): fix forwarded header for IPv6 on IPv4 stack [#713](https://github.com/openshift/router/pull/713)
* [OCPBUGS-49738](https://issues.redhat.com/browse/OCPBUGS-49738): fix handling of host conflict [#736](https://github.com/openshift/router/pull/736)
* [NE-2332](https://issues.redhat.com/browse/NE-2332): Add support for TLS curves in HAProxy configuration [#755](https://github.com/openshift/router/pull/755)
* [TRT-2597](https://issues.redhat.com/browse/TRT-2597): [Revert "NE-2333: Add support for configurable SSL curves in HAProxy configuration"](https://github.com/openshift/router/pull/754#top) [#754](https://github.com/openshift/router/pull/754)
* [NE-2333](https://issues.redhat.com/browse/NE-2333): Add support for configurable SSL curves in HAProxy configuration [#678](https://github.com/openshift/router/pull/678)
* [OCPBUGS-77773](https://issues.redhat.com/browse/OCPBUGS-77773): fix backend server health check if DCM is enabled [#747](https://github.com/openshift/router/pull/747)
* [OCPBUGS-62238](https://issues.redhat.com/browse/OCPBUGS-62238): configure TLS profile for metrics endpoint [#748](https://github.com/openshift/router/pull/748)
* [Full changelog](https://github.com/openshift/router/compare/1c68a10861fa13a1210fa65c91c36cca3367cc93...a86164c8ebaed55a2a28451fa913a04f10cc9a72)
### [hyperkube, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/872bd3722d0954b31459f715fbd4fb7612aaf338)
* [OCPBUGS-85410](https://issues.redhat.com/browse/OCPBUGS-85410): Fix performance related issues when selinux metrics are emitted [#2668](https://github.com/openshift/kubernetes/pull/2668)
* [OCPBUGS-86229](https://issues.redhat.com/browse/OCPBUGS-86229): apiserver: cache etcd storage monitors to avoid recreating clients on each metrics scrape [#2674](https://github.com/openshift/kubernetes/pull/2674)
* [OCPBUGS-74511](https://issues.redhat.com/browse/OCPBUGS-74511): remove RouteExternalCertificate feature gate [#2585](https://github.com/openshift/kubernetes/pull/2585)
* [OCPBUGS-77243](https://issues.redhat.com/browse/OCPBUGS-77243): test: skip private registry test [#2621](https://github.com/openshift/kubernetes/pull/2621)
* [OCPBUGS-78044](https://issues.redhat.com/browse/OCPBUGS-78044): Improve WatchList test robustness [#2622](https://github.com/openshift/kubernetes/pull/2622)
* [CNTRLPLANE-2553](https://issues.redhat.com/browse/CNTRLPLANE-2553): Update the KAS admission plugin for fields to be compilable at admission time [#2627](https://github.com/openshift/kubernetes/pull/2627)
* [OCPBUGS-83502](https://issues.redhat.com/browse/OCPBUGS-83502): devicemanager: constrain topology hints to device NUMA nodes [#2645](https://github.com/openshift/kubernetes/pull/2645)
* [OCPBUGS-78576](https://issues.redhat.com/browse/OCPBUGS-78576): Update the csi-driver-host-path version to 1.17.1 [#2641](https://github.com/openshift/kubernetes/pull/2641)
* [OCPBUGS-81740](https://issues.redhat.com/browse/OCPBUGS-81740): UPSTREAM: 138259: Filter out unschedulable nodes in kubectl describe test [#2640](https://github.com/openshift/kubernetes/pull/2640)
* [OCPBUGS-78990](https://issues.redhat.com/browse/OCPBUGS-78990): Bump 1.35.3 to master [#2633](https://github.com/openshift/kubernetes/pull/2633)
* [OCPBUGS-78986](https://issues.redhat.com/browse/OCPBUGS-78986): UPSTREAM: 137926: KEP-961: demote maxUnavailable feature in statefulset to off by default [#2632](https://github.com/openshift/kubernetes/pull/2632)
* NO-JIRA: UPSTREAM: <carry>: Register OpenShift cloud providers in k8s-tests-ext [#2635](https://github.com/openshift/kubernetes/pull/2635)
* [OCPBUGS-78504](https://issues.redhat.com/browse/OCPBUGS-78504): unflake HPAConfigurableTolerance test [#2631](https://github.com/openshift/kubernetes/pull/2631)
* UPSTREAM: <carry>: OCPBUGS-39360: Fix ClusterIsIPv6() detection for dual-stack v6-primary clusters [#2603](https://github.com/openshift/kubernetes/pull/2603)
* NO-JIRA: UPSTREAM: <carry>: Add jacobsee and jubittajohn to DOWNSTREAM_OWNERS [#2630](https://github.com/openshift/kubernetes/pull/2630)
* [Full changelog](https://github.com/openshift/kubernetes/compare/2034d92b4a3a51d42e306ba405fc10a89768ac69...872bd3722d0954b31459f715fbd4fb7612aaf338)
### [hypershift](https://github.com/openshift/hypershift/tree/a101e6697af02eba43e6cfd04fc4c00277b72a64)
* [OCPBUGS-87217](https://issues.redhat.com/browse/OCPBUGS-87217): fix: add CPU partitioning workload annotation to control-plane-metrics-forwarder [#8686](https://github.com/openshift/hypershift/pull/8686)
* [CNTRLPLANE-3599](https://issues.redhat.com/browse/CNTRLPLANE-3599): Remove controller-runtime v0.19.7 pin for k8s 1.36 bump [#8683](https://github.com/openshift/hypershift/pull/8683)
* [CNTRLPLANE-3550](https://issues.redhat.com/browse/CNTRLPLANE-3550): Add missing v2 test suites to Azure self-managed test matrix [#8658](https://github.com/openshift/hypershift/pull/8658)
* NO-JIRA: chore(deps): weekly dependabot consolidation [#8634](https://github.com/openshift/hypershift/pull/8634)
* NO-JIRA: test(e2e/v2): sweep AGENTS.md conformance violations [#8659](https://github.com/openshift/hypershift/pull/8659)
* [OCPBUGS-87018](https://issues.redhat.com/browse/OCPBUGS-87018): Revert conditional deletion of openshift-ingress NetworkPolicy [#8662](https://github.com/openshift/hypershift/pull/8662)
* NO-JIRA: move CONTRIBUTING.md to repo root and update CI guidance [#8329](https://github.com/openshift/hypershift/pull/8329)
* [CNTRLPLANE-3548](https://issues.redhat.com/browse/CNTRLPLANE-3548): Add v2 e2e test framework documentation [#8641](https://github.com/openshift/hypershift/pull/8641)
* [OCPBUGS-86008](https://issues.redhat.com/browse/OCPBUGS-86008): Gate Route watch on management cluster capability [#8484](https://github.com/openshift/hypershift/pull/8484)
* Revert "OCPBUGS-86774: Pin azure-cli to 2.72.0 in e2e Dockerfile" [#8652](https://github.com/openshift/hypershift/pull/8652)
* [OCPBUGS-77268](https://issues.redhat.com/browse/OCPBUGS-77268): reconcile HCP when pull secret is unavailable [#8352](https://github.com/openshift/hypershift/pull/8352)
* [GCP-298](https://issues.redhat.com/browse/GCP-298): Add GCP e2e v2 test artifacts directory structure documentation [#8446](https://github.com/openshift/hypershift/pull/8446)
* [CNTRLPLANE-2207](https://issues.redhat.com/browse/CNTRLPLANE-2207): Upgrade to CAPI 1.11 [#8594](https://github.com/openshift/hypershift/pull/8594)
* NO-JIRA: chore(ci): enforce v2 e2e AGENTS.md standards via CodeRabbit [#8660](https://github.com/openshift/hypershift/pull/8660)
* [CNTRLPLANE-1357](https://issues.redhat.com/browse/CNTRLPLANE-1357): add KMSv2 secret encryption e2e v2 test for Self Managed Azure [#8653](https://github.com/openshift/hypershift/pull/8653)
* [CNTRLPLANE-3167](https://issues.redhat.com/browse/CNTRLPLANE-3167): Auto-detect credential type for HCPEtcdBackup [#8368](https://github.com/openshift/hypershift/pull/8368)
* NO-JIRA: Fix Azure private/topology CEL validation rules [#8490](https://github.com/openshift/hypershift/pull/8490)
* [GCP-688](https://issues.redhat.com/browse/GCP-688): Port remaining v1 TestCreateCluster gaps to v2 e2e [#8590](https://github.com/openshift/hypershift/pull/8590)
* NO-JIRA: feat(skills): add validate-pr-override-images skill [#8616](https://github.com/openshift/hypershift/pull/8616)
* [OCPSTRAT-1677](https://issues.redhat.com/browse/OCPSTRAT-1677): Add Spot instances documentation [#8485](https://github.com/openshift/hypershift/pull/8485)
* [OCPBUGS-43444](https://issues.redhat.com/browse/OCPBUGS-43444): Allow kubevirt-csi storageclass default to be changed by user [#8597](https://github.com/openshift/hypershift/pull/8597)
* [CNTRLPLANE-3510](https://issues.redhat.com/browse/CNTRLPLANE-3510): Enable additional golangci-lint linters [#8567](https://github.com/openshift/hypershift/pull/8567)
* [OCPBUGS-86306](https://issues.redhat.com/browse/OCPBUGS-86306): Stop controllers fighting over HCP status [#8562](https://github.com/openshift/hypershift/pull/8562)
* [CNTRLPLANE-3535](https://issues.redhat.com/browse/CNTRLPLANE-3535): Add codecov carryforward flags to stabilize project coverage checks [#8642](https://github.com/openshift/hypershift/pull/8642)
* [OCPSTRAT-1677](https://issues.redhat.com/browse/OCPSTRAT-1677): fix(cpo): increase NTH default workers from 10 to 20 [#8500](https://github.com/openshift/hypershift/pull/8500)
* NO-JIRA: feat(ci): add skopeo and gh CLI to ARC runner image [#8627](https://github.com/openshift/hypershift/pull/8627)
* [OCPBUGS-85584](https://issues.redhat.com/browse/OCPBUGS-85584): Fix stale api.openshift.com labels on HostedControlPlane [#8507](https://github.com/openshift/hypershift/pull/8507)
* NO-JIRA: ci(runner): update base image to actions-runner v2.334.0 [#8643](https://github.com/openshift/hypershift/pull/8643)
* [CNTRLPLANE-3533](https://issues.redhat.com/browse/CNTRLPLANE-3533): Add Dockerfiles to codecov ignore list [#8640](https://github.com/openshift/hypershift/pull/8640)
* [OCPBUGS-86774](https://issues.redhat.com/browse/OCPBUGS-86774): Pin azure-cli to 2.72.0 in e2e Dockerfile [#8638](https://github.com/openshift/hypershift/pull/8638)
* NO-JIRA: ci(deps): bump google-github-actions/auth from 2.1.13 to 3.0.0 [#8630](https://github.com/openshift/hypershift/pull/8630)
* NO-JIRA: ci(deps): bump actions/checkout from 4.3.1 to 6.0.2 [#8631](https://github.com/openshift/hypershift/pull/8631)
* NO-JIRA: Fix HCCO deployment location in AGENTS.md [#8635](https://github.com/openshift/hypershift/pull/8635)
* [CNTRLPLANE-3534](https://issues.redhat.com/browse/CNTRLPLANE-3534): ci: add --allowedTools to address-review-comments workflow [#8639](https://github.com/openshift/hypershift/pull/8639)
* [OCPBUGS-86238](https://issues.redhat.com/browse/OCPBUGS-86238): add CPO overrides for ARO swift-nic resource limits [#8610](https://github.com/openshift/hypershift/pull/8610)
* [OCPBUGS-81544](https://issues.redhat.com/browse/OCPBUGS-81544): requeue when AutoNodeEnabled is progressing [#8497](https://github.com/openshift/hypershift/pull/8497)
* NO-JIRA: add address-review-comments workflow [#8621](https://github.com/openshift/hypershift/pull/8621)
* NO-JIRA: De-duplicate Azure self-managed documentation [#8566](https://github.com/openshift/hypershift/pull/8566)
* [CNTRLPLANE-3531](https://issues.redhat.com/browse/CNTRLPLANE-3531): Remove EFS-backed Go build cache from CI runners [#8637](https://github.com/openshift/hypershift/pull/8637)
* [CNTRLPLANE-3329](https://issues.redhat.com/browse/CNTRLPLANE-3329): Rebuild runner image on gocacheprog and pipeline changes [#8633](https://github.com/openshift/hypershift/pull/8633)
* [CNTRLPLANE-3329](https://issues.redhat.com/browse/CNTRLPLANE-3329): Fix gocacheprog cache corruption with atomic writes [#8624](https://github.com/openshift/hypershift/pull/8624)
* NO-JIRA: fix(karpenter): start node cleanup when CAPI Cluster is deleted [#8589](https://github.com/openshift/hypershift/pull/8589)
* [OCPBUGS-85151](https://issues.redhat.com/browse/OCPBUGS-85151): Re-enable serviceaccount-pull-secrets controller when registry managementState changes from Removed [#8522](https://github.com/openshift/hypershift/pull/8522)
* [OCPBUGS-85243](https://issues.redhat.com/browse/OCPBUGS-85243): Set aws-load-balancer-scheme on public HCP router service [#8458](https://github.com/openshift/hypershift/pull/8458)
* [OCPBUGS-38898](https://issues.redhat.com/browse/OCPBUGS-38898): fix kubeadmin password hash reconciliation to compare password against stored hash [#8358](https://github.com/openshift/hypershift/pull/8358)
* [OCPBUGS-84303](https://issues.redhat.com/browse/OCPBUGS-84303): fix(api): add IPv6 OVN join subnet config to prevent dual-stack routing collision [#8421](https://github.com/openshift/hypershift/pull/8421)
* NO-JIRA: clone ai-helpers into workspace for plugin file access [#8620](https://github.com/openshift/hypershift/pull/8620)
* NO-JIRA: bump claude max-turns to 50 in WIF test [#8619](https://github.com/openshift/hypershift/pull/8619)
* NO-JIRA: test ai-sbom plugin and verify plugin loading [#8614](https://github.com/openshift/hypershift/pull/8614)
* [CNTRLPLANE-3329](https://issues.redhat.com/browse/CNTRLPLANE-3329): Use GOCACHEPROG for zero-copy EFS build cache [#8576](https://github.com/openshift/hypershift/pull/8576)
* NO-JIRA: replace container image with workflow-step plugin setup [#8611](https://github.com/openshift/hypershift/pull/8611)
* NO-JIRA: use ai-helpers container image for Claude WIF test [#8609](https://github.com/openshift/hypershift/pull/8609)
* NO-JIRA: fix Claude WIF test workflow HOME for ARC runners [#8600](https://github.com/openshift/hypershift/pull/8600)
* NO-JIRA: fix Claude WIF test workflow for ARC runners [#8598](https://github.com/openshift/hypershift/pull/8598)
* NO-JIRA: test Claude Code WIF auth in GitHub Actions [#8588](https://github.com/openshift/hypershift/pull/8588)
* [OCPBUGS-86296](https://issues.redhat.com/browse/OCPBUGS-86296): Propagate management cluster proxy env vars to konnectivity sidecar [#8569](https://github.com/openshift/hypershift/pull/8569)
* [OCPBUGS-65730](https://issues.redhat.com/browse/OCPBUGS-65730): add --tls-cipher-suites to oauth-apiserver deployment [#8554](https://github.com/openshift/hypershift/pull/8554)
* [OCPBUGS-85351](https://issues.redhat.com/browse/OCPBUGS-85351): Revert "fix(azure): prevent externalDNSDomain from shadowing cluster apps domain" [#8585](https://github.com/openshift/hypershift/pull/8585)
* [OCPBUGS-84955](https://issues.redhat.com/browse/OCPBUGS-84955): bootstrap serving certs at hypershift operator startup [#8545](https://github.com/openshift/hypershift/pull/8545)
* ci(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 [#8574](https://github.com/openshift/hypershift/pull/8574)
* [CNTRLPLANE-3040](https://issues.redhat.com/browse/CNTRLPLANE-3040): add regression tests for CAS pause/unpause replica clamping [#8262](https://github.com/openshift/hypershift/pull/8262)
* NO-JIRA: chore(deps): weekly dependabot consolidation [#8578](https://github.com/openshift/hypershift/pull/8578)
* [GCP-688](https://issues.redhat.com/browse/GCP-688): Port v1 E2E validations to envtest, unit tests, and v2 Ginkgo specs [#8511](https://github.com/openshift/hypershift/pull/8511)
* NO-JIRA: fix(e2e): lower pull secret in-place propagation test gate to 4.22 [#8553](https://github.com/openshift/hypershift/pull/8553)
* [OCPBUGS-86075](https://issues.redhat.com/browse/OCPBUGS-86075): docs(nodepool): fixing incomplete stuck node drain documentation in section Scaling To Zero [#8544](https://github.com/openshift/hypershift/pull/8544)
* [CNTRLPLANE-3222](https://issues.redhat.com/browse/CNTRLPLANE-3222): Port v1 lifecycle tests to v2 Ginkgo framework [#8527](https://github.com/openshift/hypershift/pull/8527)
* [AUTOSCALE-692](https://issues.redhat.com/browse/AUTOSCALE-692): remove default debug log level from karpenter container [#8561](https://github.com/openshift/hypershift/pull/8561)
* [OCPBUGS-86310](https://issues.redhat.com/browse/OCPBUGS-86310): Handle CA bundle aggregation delay by requeuing revocation [#8563](https://github.com/openshift/hypershift/pull/8563)
* [CNTRLPLANE-3329](https://issues.redhat.com/browse/CNTRLPLANE-3329): Use fuse-overlayfs for build cache instead of full copy [#8568](https://github.com/openshift/hypershift/pull/8568)
* NO-JIRA: fix(e2e): use public multi-arch image for ARM64 karpenter test [#8532](https://github.com/openshift/hypershift/pull/8532)
* [OCPBUGS-86238](https://issues.redhat.com/browse/OCPBUGS-86238): set limits for aro.openshift.io/swift-nic in request overrides for ARO swift [#8552](https://github.com/openshift/hypershift/pull/8552)
* [OCPBUGS-85351](https://issues.redhat.com/browse/OCPBUGS-85351): fix(azure): prevent externalDNSDomain from shadowing cluster apps domain [#8480](https://github.com/openshift/hypershift/pull/8480)
* [CNTRLPLANE-3371](https://issues.redhat.com/browse/CNTRLPLANE-3371): Fix AllowedCIDRs e2e test for Route-based KAS [#8469](https://github.com/openshift/hypershift/pull/8469)
* NO-JIRA: build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 in /hack/tools [#8547](https://github.com/openshift/hypershift/pull/8547)
* NO-JIRA: Update Konflux Tekton task bundles [#8557](https://github.com/openshift/hypershift/pull/8557)
* NO-JIRA: chore(deps): weekly dependabot consolidation [#8464](https://github.com/openshift/hypershift/pull/8464)
* [CNTRLPLANE-3070](https://issues.redhat.com/browse/CNTRLPLANE-3070): Support KMS on self-managed Azure without affecting ARO HCP [#8088](https://github.com/openshift/hypershift/pull/8088)
* [OCPBUGS-59142](https://issues.redhat.com/browse/OCPBUGS-59142): fix ValidReleaseImage condition message to show minor version [#8519](https://github.com/openshift/hypershift/pull/8519)
* NO-JIRA: Add onboarding guide for new HCP team members [#8132](https://github.com/openshift/hypershift/pull/8132)
* [OCPBUGS-85011](https://issues.redhat.com/browse/OCPBUGS-85011): fix(cpo): use check-first pattern for EBS CSI operator serving cert [#8418](https://github.com/openshift/hypershift/pull/8418)
* [CNTRLPLANE-3329](https://issues.redhat.com/browse/CNTRLPLANE-3329): Extend EFS-backed build cache to lint, verify, and envtest workflows [#8495](https://github.com/openshift/hypershift/pull/8495)
* NO-JIRA: ci(deps): bump cloudflare/wrangler-action from 3.15.0 to 4.0.0 [#8524](https://github.com/openshift/hypershift/pull/8524)
* [OCPBUGS-85763](https://issues.redhat.com/browse/OCPBUGS-85763): Fix metrics-proxy deployment failure due to dots in volume names [#8530](https://github.com/openshift/hypershift/pull/8530)
* [GCP-636](https://issues.redhat.com/browse/GCP-636): feat(gcp): support for managing GCP OIDC discovery documents [#8413](https://github.com/openshift/hypershift/pull/8413)
* [OCPBUGS-84307](https://issues.redhat.com/browse/OCPBUGS-84307): Clarify --base-domain flag default behavior [#8381](https://github.com/openshift/hypershift/pull/8381)
* [AUTOSCALE-681](https://issues.redhat.com/browse/AUTOSCALE-681): various karpenter and karpenterupgrade test fixes [#8510](https://github.com/openshift/hypershift/pull/8510)
* [CNTRLPLANE-3329](https://issues.redhat.com/browse/CNTRLPLANE-3329): Replace actions/cache with EFS-backed build cache in unit tests [#8494](https://github.com/openshift/hypershift/pull/8494)
* [OCPBUGS-85577](https://issues.redhat.com/browse/OCPBUGS-85577): Update external-dns image from 1.1.0-3 to 1.2.1 [#8506](https://github.com/openshift/hypershift/pull/8506)
* [OCPBUGS-77827](https://issues.redhat.com/browse/OCPBUGS-77827): fix(api): add missing has() guards to servingCerts CEL validation rule [#8331](https://github.com/openshift/hypershift/pull/8331)
* [CNTRLPLANE-3380](https://issues.redhat.com/browse/CNTRLPLANE-3380): docs: add aws-node-termination-handler to repositories list [#8514](https://github.com/openshift/hypershift/pull/8514)
* [OCPBUGS-85580](https://issues.redhat.com/browse/OCPBUGS-85580): Fix webhook TLS failure after service-ca to self-managed cert migration [#8504](https://github.com/openshift/hypershift/pull/8504)
* build(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 in /hack/tools [#8481](https://github.com/openshift/hypershift/pull/8481)
* [OCPBUGS-85344](https://issues.redhat.com/browse/OCPBUGS-85344): Add version gates for 4.22 backward compatibility in e2e tests [#8466](https://github.com/openshift/hypershift/pull/8466)
* [AUTOSCALE-681](https://issues.redhat.com/browse/AUTOSCALE-681): remove TechPreviewNoUpgrade gate from karpenter upgrade test [#8498](https://github.com/openshift/hypershift/pull/8498)
* [CNTRLPLANE-3329](https://issues.redhat.com/browse/CNTRLPLANE-3329): Mount EFS-backed Go build cache PV on ARC runner pods [#8493](https://github.com/openshift/hypershift/pull/8493)
* NO-JIRA: docs: add repositories page listing team-owned repos [#8505](https://github.com/openshift/hypershift/pull/8505)
* [CNTRLPLANE-3329](https://issues.redhat.com/browse/CNTRLPLANE-3329): Add nightly CronJob to warm EFS-backed Go build cache [#8496](https://github.com/openshift/hypershift/pull/8496)
* [CNTRLPLANE-3324](https://issues.redhat.com/browse/CNTRLPLANE-3324): Restore non-obvious comments after gocyclo refactor [#8487](https://github.com/openshift/hypershift/pull/8487)
* [AUTOSCALE-558](https://issues.redhat.com/browse/AUTOSCALE-558): Expose KubeletConfig on OpenShiftEC2Nodeclass as structured fields + preserveunknown/overflow [#8192](https://github.com/openshift/hypershift/pull/8192)
* NO-JIRA: Fix docs deploy preview by replacing gh CLI with curl [#8488](https://github.com/openshift/hypershift/pull/8488)
* [CNTRLPLANE-2946](https://issues.redhat.com/browse/CNTRLPLANE-2946): Move AWS NLB annotation inside LoadBalancer strategy block [#7993](https://github.com/openshift/hypershift/pull/7993)
* [OCPBUGS-78539](https://issues.redhat.com/browse/OCPBUGS-78539): re-add crash toleration for dns-operator during upgrades [#8483](https://github.com/openshift/hypershift/pull/8483)
* [CNTRLPLANE-3384](https://issues.redhat.com/browse/CNTRLPLANE-3384): Remove unconditional low-quality log messages from controllers [#8428](https://github.com/openshift/hypershift/pull/8428)
* [OCPBUGS-84971](https://issues.redhat.com/browse/OCPBUGS-84971): Gate AWSDefaultSecurityGroupDeleted condition to AWS platform [#8415](https://github.com/openshift/hypershift/pull/8415)
* [CNTRLPLANE-3324](https://issues.redhat.com/browse/CNTRLPLANE-3324): Enable gocyclo linter and reduce cyclomatic complexity [#8309](https://github.com/openshift/hypershift/pull/8309)
* NO-JIRA: fix(karpenter): resolve HCP karpenter finalizer when AutoNode is disabled [#8404](https://github.com/openshift/hypershift/pull/8404)
* [OCPBUGS-62177](https://issues.redhat.com/browse/OCPBUGS-62177): verify cert revocation against all KAS pods [#8263](https://github.com/openshift/hypershift/pull/8263)
* NO-JIRA: Document CEL over webhooks policy for AI agents [#8478](https://github.com/openshift/hypershift/pull/8478)
* NO-JIRA: docs(kubevirt): add how-to for configuring VMs with JSON patches [#8473](https://github.com/openshift/hypershift/pull/8473)
* [CNTRLPLANE-1741](https://issues.redhat.com/browse/CNTRLPLANE-1741): Migrate gomaxprocs-webhook pipelines to use common-operator-build [#7122](https://github.com/openshift/hypershift/pull/7122)
* NO-JIRA: docs: update api-sme agent and api/AGENTS.md conventions [#8477](https://github.com/openshift/hypershift/pull/8477)
* [OCPBUGS-81686](https://issues.redhat.com/browse/OCPBUGS-81686): fix(authentication): use v2 auth validation for CEL and expression support. [#8246](https://github.com/openshift/hypershift/pull/8246)
* [OCPBUGS-85084](https://issues.redhat.com/browse/OCPBUGS-85084): fix(ci): use explicit lease in dependabot commit fix push [#8476](https://github.com/openshift/hypershift/pull/8476)
* [OCPBUGS-75887](https://issues.redhat.com/browse/OCPBUGS-75887): fix(inplaceupgrader): include node name in degraded upgrade error message [#8244](https://github.com/openshift/hypershift/pull/8244)
* NO-JIRA: fix(e2e): prevent agent unbinding and node reboots during backup/restore [#8356](https://github.com/openshift/hypershift/pull/8356)
* NO-JIRA: Update GHA docs for reusable workflow pattern [#8453](https://github.com/openshift/hypershift/pull/8453)
* [GCP-413](https://issues.redhat.com/browse/GCP-413): add image registry v2 e2e tests for hosted clusters [#8412](https://github.com/openshift/hypershift/pull/8412)
* NO-JIRA: docs: make CLAUDE.md a symlink to AGENTS.md across the repo [#8444](https://github.com/openshift/hypershift/pull/8444)
* [CNTRLPLANE-2778](https://issues.redhat.com/browse/CNTRLPLANE-2778): feat(tooling): overhaul pr-report skill and Python script [#7754](https://github.com/openshift/hypershift/pull/7754)
* [ACM-33601](https://issues.redhat.com/browse/ACM-33601): use the latest ubi9 nginx image [#8432](https://github.com/openshift/hypershift/pull/8432)
* [GCP-414](https://issues.redhat.com/browse/GCP-414): add image registry operational guide [#8455](https://github.com/openshift/hypershift/pull/8455)
* [OCPBUGS-84528](https://issues.redhat.com/browse/OCPBUGS-84528): clarify pull secret in-place update behavior and add CP watches [#8327](https://github.com/openshift/hypershift/pull/8327)
* [OCPBUGS-84955](https://issues.redhat.com/browse/OCPBUGS-84955): Add render-sensitive flag to `hypershift install render` [#8436](https://github.com/openshift/hypershift/pull/8436)
* [OCPBUGS-84857](https://issues.redhat.com/browse/OCPBUGS-84857): bump go builder and ubi images [#8437](https://github.com/openshift/hypershift/pull/8437)
* [GCP-410](https://issues.redhat.com/browse/GCP-410): fix(gcp): add registry SA WIF binding for image registry GCS access [#8445](https://github.com/openshift/hypershift/pull/8445)
* [CNTRLPLANE-3381](https://issues.redhat.com/browse/CNTRLPLANE-3381): CPO: Surface cloud resource deletion timeout as a status condition [#8426](https://github.com/openshift/hypershift/pull/8426)
* [OCPBUGS-85084](https://issues.redhat.com/browse/OCPBUGS-85084): fix(ci): rewrite dependabot commit messages to pass gitlint [#8435](https://github.com/openshift/hypershift/pull/8435)
* NO-JIRA: docs: detail release branch e2e config steps in branch-process guide [#8441](https://github.com/openshift/hypershift/pull/8441)
* [CNTRLPLANE-3222](https://issues.redhat.com/browse/CNTRLPLANE-3222): Migrate self-managed Azure e2e tests to v2 Ginkgo framework [#8204](https://github.com/openshift/hypershift/pull/8204)
* [GCP-412](https://issues.redhat.com/browse/GCP-412): add envtest cases for GCP imageRegistry CEL validation [#8411](https://github.com/openshift/hypershift/pull/8411)
* [CNTRLPLANE-2939](https://issues.redhat.com/browse/CNTRLPLANE-2939): Coordinate CRD lifecycle with Cluster CAPI Operator [#7996](https://github.com/openshift/hypershift/pull/7996)
* [OCPBUGS-77040](https://issues.redhat.com/browse/OCPBUGS-77040): Add AWS ISO domains to konnectivity IsCloudAPI [#8251](https://github.com/openshift/hypershift/pull/8251)
* [OCPBUGS-83328](https://issues.redhat.com/browse/OCPBUGS-83328): fix skipProxyForKAS to use standard NO_PROXY matching [#8254](https://github.com/openshift/hypershift/pull/8254)
* [OCPBUGS-84969](https://issues.redhat.com/browse/OCPBUGS-84969): fix(e2e): wait for Karpenter node cleanup in parallel tests to prevent vCPU flake [#8414](https://github.com/openshift/hypershift/pull/8414)
* [CNTRLPLANE-3343](https://issues.redhat.com/browse/CNTRLPLANE-3343): Extract support/k8sutil package from support/util [#8396](https://github.com/openshift/hypershift/pull/8396)
* [TRT-2653](https://issues.redhat.com/browse/TRT-2653): Revert #8357 "OCPBUGS-84572: fix(cpo): generate EBS CSI driver operator serving cert in CPO" [#8417](https://github.com/openshift/hypershift/pull/8417)
* NO-JIRA: chore(deps): weekly dependabot consolidation [#8410](https://github.com/openshift/hypershift/pull/8410)
* NO-JIRA: Skip TestKarpenter for releases < 4.22 [#8409](https://github.com/openshift/hypershift/pull/8409)
* [CNTRLPLANE-3351](https://issues.redhat.com/browse/CNTRLPLANE-3351): e2e: add opt-in CPU resource request overrides for control plane components [#8385](https://github.com/openshift/hypershift/pull/8385)
* [OCPBUGS-84509](https://issues.redhat.com/browse/OCPBUGS-84509): Add AWS LB Controller cross-zone load balancing annotation [#8344](https://github.com/openshift/hypershift/pull/8344)
* [OCPBUGS-84572](https://issues.redhat.com/browse/OCPBUGS-84572): fix(cpo): generate EBS CSI driver operator serving cert in CPO [#8357](https://github.com/openshift/hypershift/pull/8357)
* [OCPBUGS-81631](https://issues.redhat.com/browse/OCPBUGS-81631): fix(metrics): remove noisy vCPU log for non-AWS platforms [#8169](https://github.com/openshift/hypershift/pull/8169)
* NO-JIRA: Extend timeout for CRD removal during integration tests [#8366](https://github.com/openshift/hypershift/pull/8366)
* NO-JIRA: chore(deps): weekly dependabot consolidation [#8395](https://github.com/openshift/hypershift/pull/8395)
* [OCPBUGS-83868](https://issues.redhat.com/browse/OCPBUGS-83868): prevent IAM resource leaks during cluster destroy [#8303](https://github.com/openshift/hypershift/pull/8303)
* [GCP-635](https://issues.redhat.com/browse/GCP-635): feat(gcp): make JWKS file optional when OIDC issuer URL is provided [#8339](https://github.com/openshift/hypershift/pull/8339)
* [OCPBUGS-83757](https://issues.redhat.com/browse/OCPBUGS-83757): Remove network dependencies from unit tests [#8277](https://github.com/openshift/hypershift/pull/8277)
* ci(deps): bump actions/setup-go from 5.6.0 to 6.4.0 [#8393](https://github.com/openshift/hypershift/pull/8393)
* [OCPBUGS-84508](https://issues.redhat.com/browse/OCPBUGS-84508): Fix NLB name parsing for EKS Auto Mode hostnames [#8343](https://github.com/openshift/hypershift/pull/8343)
* [AUTOSCALE-615](https://issues.redhat.com/browse/AUTOSCALE-615): include Karpenter node vCPUs in billing metric [#8265](https://github.com/openshift/hypershift/pull/8265)
* [CNTRLPLANE-3352](https://issues.redhat.com/browse/CNTRLPLANE-3352): Convert GHA callers to use reusable workflows @main [#8387](https://github.com/openshift/hypershift/pull/8387)
* [CNTRLPLANE-3342](https://issues.redhat.com/browse/CNTRLPLANE-3342): Extract support/netutil package from support/util [#8360](https://github.com/openshift/hypershift/pull/8360)
* [CNTRLPLANE-3352](https://issues.redhat.com/browse/CNTRLPLANE-3352): Add reusable GHA workflow definitions [#8386](https://github.com/openshift/hypershift/pull/8386)
* [GCP-410](https://issues.redhat.com/browse/GCP-410): feat(gcp): add HCCO credential propagation for GCP image registry [#7896](https://github.com/openshift/hypershift/pull/7896)
* [OCPBUGS-84551](https://issues.redhat.com/browse/OCPBUGS-84551): fix(ingress): set FIPS_ENABLED env var on ingress operator [#8375](https://github.com/openshift/hypershift/pull/8375)
* [CNTRLPLANE-3307](https://issues.redhat.com/browse/CNTRLPLANE-3307): add unit tests for Azure Private Link Service controllers [#8285](https://github.com/openshift/hypershift/pull/8285)
* [CNTRLPLANE-3160](https://issues.redhat.com/browse/CNTRLPLANE-3160): Drop AutoNodeKarpenter feature gate and promote EC2NodeClass to v1 [#8166](https://github.com/openshift/hypershift/pull/8166)
* NO-JIRA: Improve commit and PR guidance in AGENTS.md [#8373](https://github.com/openshift/hypershift/pull/8373)
* [OCPBUGS-83790](https://issues.redhat.com/browse/OCPBUGS-83790): change Azure workload identity webhook FailurePolicy from Fail to Ignore [#8288](https://github.com/openshift/hypershift/pull/8288)
* NO-JIRA: chore(deps): weekly dependabot consolidation [#8334](https://github.com/openshift/hypershift/pull/8334)
* NO-JIRA: Add API dependency import restriction tool [#8364](https://github.com/openshift/hypershift/pull/8364)
* [SPLAT-2587](https://issues.redhat.com/browse/SPLAT-2587): aws/ccm: introduce configuration to CCM managed Security Groups for NLB [#7460](https://github.com/openshift/hypershift/pull/7460)
* NO-JIRA: add --max-depth flag to nav order verification [#8372](https://github.com/openshift/hypershift/pull/8372)
* NO-JIRA: Do not import external dependencies into API packages [#8355](https://github.com/openshift/hypershift/pull/8355)
* [CNTRLPLANE-3340](https://issues.redhat.com/browse/CNTRLPLANE-3340): Extract support/podspec package from support/util [#8354](https://github.com/openshift/hypershift/pull/8354)
* [OCPBUGS-84251](https://issues.redhat.com/browse/OCPBUGS-84251): fix(azure): detect and replace stale role assignments on cluster re-creation [#8322](https://github.com/openshift/hypershift/pull/8322)
* [OCPBUGS-84236](https://issues.redhat.com/browse/OCPBUGS-84236): Guard Infrastructure CR lookup in AWSEndpointServiceReconciler [#8315](https://github.com/openshift/hypershift/pull/8315)
* fix: OCPBUGS-78575: create virt-launcher NetworkPolicy on external infra cluster [#8056](https://github.com/openshift/hypershift/pull/8056)
* [CNTRLPLANE-3330](https://issues.redhat.com/browse/CNTRLPLANE-3330): ci: improve unit test speed with sharding and parallelism [#8330](https://github.com/openshift/hypershift/pull/8330)
* [CNTRLPLANE-3313](https://issues.redhat.com/browse/CNTRLPLANE-3313): add Etcd Snapshot Backup (Tech Preview) DR documentation [#8299](https://github.com/openshift/hypershift/pull/8299)
* [CNTRLPLANE-2834](https://issues.redhat.com/browse/CNTRLPLANE-2834): add e2e test for etcd snapshot backup method on AWS [#8231](https://github.com/openshift/hypershift/pull/8231)
* docs: NO-JIRA: clarify serialization tag behaviour in api/AGENTS.md [#8328](https://github.com/openshift/hypershift/pull/8328)
* [OCPBUGS-84248](https://issues.redhat.com/browse/OCPBUGS-84248): Remove hardcoded quay.io credentials from EnsureGlobalPullSecret test [#8320](https://github.com/openshift/hypershift/pull/8320)
* NO-JIRA: ci(deps): bump GitHub Actions dependencies [#8333](https://github.com/openshift/hypershift/pull/8333)
* [OCPBUGS-77529](https://issues.redhat.com/browse/OCPBUGS-77529): clean stale mock files before make generate function [#8237](https://github.com/openshift/hypershift/pull/8237)
* [OCPBUGS-79471](https://issues.redhat.com/browse/OCPBUGS-79471): fix(test): reduce e2e autorepair flakes from unhealthy node conditions [#8278](https://github.com/openshift/hypershift/pull/8278)
* NO-JIRA: docs: clarify that control plane downgrades are not supported [#8314](https://github.com/openshift/hypershift/pull/8314)
* [CNTRLPLANE-2204](https://issues.redhat.com/browse/CNTRLPLANE-2204): improve AllNodesHealthy and AllMachinesReady conditions [#8247](https://github.com/openshift/hypershift/pull/8247)
* [GCP-431](https://issues.redhat.com/browse/GCP-431): feat: Add CNCC support for GCP WIF in HyperShift [#7824](https://github.com/openshift/hypershift/pull/7824)
* [OCPBUGS-83410](https://issues.redhat.com/browse/OCPBUGS-83410): fix, cno, skip cloud-network-config-controller check on non-cloud platforms [#8238](https://github.com/openshift/hypershift/pull/8238)
* Revert "OCPBUGS-83730: Add *.apps wildcard to base domain Private DNS zone for Azure private clusters" [#8301](https://github.com/openshift/hypershift/pull/8301)
* NO-JIRA: docs: add jira:ready-to-solve to agentic SDLC workflow [#8304](https://github.com/openshift/hypershift/pull/8304)
* [OCPBUGS-83397](https://issues.redhat.com/browse/OCPBUGS-83397): Fix concurrent CRD reconciliation race [#8266](https://github.com/openshift/hypershift/pull/8266)
* NO-JIRA: MCE 5.0 branch cut [#8290](https://github.com/openshift/hypershift/pull/8290)
* [OCPBUGS-83751](https://issues.redhat.com/browse/OCPBUGS-83751): add missing RBAC for webhook configurations [#8276](https://github.com/openshift/hypershift/pull/8276)
* [OCPBUGS-83730](https://issues.redhat.com/browse/OCPBUGS-83730): Add *.apps wildcard to base domain Private DNS zone for Azure private clusters [#8273](https://github.com/openshift/hypershift/pull/8273)
* NO-JIRA: chore: pass COMMIT_HASH build arg to support git worktrees [#8279](https://github.com/openshift/hypershift/pull/8279)
* [OCPBUGS-78539](https://issues.redhat.com/browse/OCPBUGS-78539): revert temporary crash toleration for dns-operator [#7994](https://github.com/openshift/hypershift/pull/7994)
* [CNTRLPLANE-3296](https://issues.redhat.com/browse/CNTRLPLANE-3296): fix: auto-create python venv in Makefile for verify targets [#8269](https://github.com/openshift/hypershift/pull/8269)
* [OCPSTRAT-2499](https://issues.redhat.com/browse/OCPSTRAT-2499): docs(e2e): add AI agent guidance for v2 test framework [#8207](https://github.com/openshift/hypershift/pull/8207)
* [AUTOSCALE-490](https://issues.redhat.com/browse/AUTOSCALE-490): increase autonode test coverage [#7979](https://github.com/openshift/hypershift/pull/7979)
* [OCPBUGS-83604](https://issues.redhat.com/browse/OCPBUGS-83604): fix(kubevirt): filter link-local addresses from EndpointSlice endpoints [#8264](https://github.com/openshift/hypershift/pull/8264)
* NO-JIRA: fix(test): set 1h time limit on e2e capacity reservations [#8208](https://github.com/openshift/hypershift/pull/8208)
* NO-JIRA: docs(agents): add CRD API machinery fundamentals and envtest docs [#8236](https://github.com/openshift/hypershift/pull/8236)
* [OCPBUGS-83585](https://issues.redhat.com/browse/OCPBUGS-83585): Wait for CRD removal in GenerateCRDInstallTest to fix flaky envtest [#8261](https://github.com/openshift/hypershift/pull/8261)
* NO-JIRA: drop redundant api_ux_validation e2e test [#8210](https://github.com/openshift/hypershift/pull/8210)
* [CNTRLPLANE-3255](https://issues.redhat.com/browse/CNTRLPLANE-3255): enable CodeRabbit reviews on draft PRs [#8250](https://github.com/openshift/hypershift/pull/8250)
* [CNTRLPLANE-635](https://issues.redhat.com/browse/CNTRLPLANE-635): Enable nilness and unparam checks in golangci-lint [#8258](https://github.com/openshift/hypershift/pull/8258)
* [AUTOSCALE-590](https://issues.redhat.com/browse/AUTOSCALE-590): karpenter version logging verification [#8058](https://github.com/openshift/hypershift/pull/8058)
* [CNTRLPLANE-3259](https://issues.redhat.com/browse/CNTRLPLANE-3259): Add sdminonne, clebs, and Nirshal to core-reviewers [#8252](https://github.com/openshift/hypershift/pull/8252)
* ci(claude): add konflux-build command for manual non-expiring builds [#7964](https://github.com/openshift/hypershift/pull/7964)
* NO-JIRA: fix(e2e): handle uint64 underflow in karpenter version computation for 5.x [#8227](https://github.com/openshift/hypershift/pull/8227)
* [CNTRLPLANE-3174](https://issues.redhat.com/browse/CNTRLPLANE-3174): Add unit tests for v2 CPO controller packages [#8215](https://github.com/openshift/hypershift/pull/8215)
* [OCPBUGS-83538](https://issues.redhat.com/browse/OCPBUGS-83538): fix(metrics-proxy): resolve ports from pods instead of deployments [#8221](https://github.com/openshift/hypershift/pull/8221)
* [CNTRLPLANE-3260](https://issues.redhat.com/browse/CNTRLPLANE-3260): fix(ci): split docs-preview into build+deploy to eliminate pwn request [#8256](https://github.com/openshift/hypershift/pull/8256)
* [CNTRLPLANE-3203](https://issues.redhat.com/browse/CNTRLPLANE-3203): Add autoscaling documentation for self-managed Azure [#8239](https://github.com/openshift/hypershift/pull/8239)
* NO-JIRA: add ENVTEST_JOBS knob for parallel envtest execution [#8243](https://github.com/openshift/hypershift/pull/8243)
* [CNTRLPLANE-3260](https://issues.redhat.com/browse/CNTRLPLANE-3260): ci: harden GitHub Actions workflows [#8253](https://github.com/openshift/hypershift/pull/8253)
* [CNTRLPLANE-3214](https://issues.redhat.com/browse/CNTRLPLANE-3214): add envtest suites for HCPEtcdBackup CRD validation [#8199](https://github.com/openshift/hypershift/pull/8199)
* [CNTRLPLANE-3254](https://issues.redhat.com/browse/CNTRLPLANE-3254): Sort how-to guides alphabetically and add CI enforcement [#8248](https://github.com/openshift/hypershift/pull/8248)
* [OCPBUGS-67228](https://issues.redhat.com/browse/OCPBUGS-67228): fix(shared-ingress): bump haproxy to 3.0.5-4.el10_1.1 [#7370](https://github.com/openshift/hypershift/pull/7370)
* [CNTRLPLANE-3065](https://issues.redhat.com/browse/CNTRLPLANE-3065): docs: add Agentic Software Development Life Cycle page [#8235](https://github.com/openshift/hypershift/pull/8235)
* [OCPCLOUD-3347](https://issues.redhat.com/browse/OCPCLOUD-3347): feat(machine-approver): add TLS configuration options to deployment manifests [#8019](https://github.com/openshift/hypershift/pull/8019)
* [OCPBUGS-83389](https://issues.redhat.com/browse/OCPBUGS-83389): fix(supportedversion): normalize OCP 5.x versions for skew and release validation [#8225](https://github.com/openshift/hypershift/pull/8225)
* [SREP-4438](https://issues.redhat.com/browse/SREP-4438): refactor(karpenter): tidy Cincinnati version resolution [#8206](https://github.com/openshift/hypershift/pull/8206)
* NO-JIRA: revert: remove .git/ from .dockerignore [#8201](https://github.com/openshift/hypershift/pull/8201)
* [CNTRLPLANE-3197](https://issues.redhat.com/browse/CNTRLPLANE-3197): add release-4.22 branch to renovate configuration [#8196](https://github.com/openshift/hypershift/pull/8196)
* [CNTRLPLANE-3197](https://issues.redhat.com/browse/CNTRLPLANE-3197): update builder images from 4.22 to 4.23 [#8194](https://github.com/openshift/hypershift/pull/8194)
* [CNTRLPLANE-3216](https://issues.redhat.com/browse/CNTRLPLANE-3216): Add codecov.yml validation to make verify [#8202](https://github.com/openshift/hypershift/pull/8202)
* [GCP-368](https://issues.redhat.com/browse/GCP-368): add GCP CCM v2 e2e tests [#7840](https://github.com/openshift/hypershift/pull/7840)
* [CNTRLPLANE-3233](https://issues.redhat.com/browse/CNTRLPLANE-3233): ci(gha): add release-4.22 branch to GitHub Actions workflows [#8217](https://github.com/openshift/hypershift/pull/8217)
* [CNTRLPLANE-3197](https://issues.redhat.com/browse/CNTRLPLANE-3197): update latest supported version from 4.22 to 4.23 [#8193](https://github.com/openshift/hypershift/pull/8193)
* [CNTRLPLANE-3174](https://issues.redhat.com/browse/CNTRLPLANE-3174): Add unit tests for CPO controller packages [#8184](https://github.com/openshift/hypershift/pull/8184)
* [CNTRLPLANE-3215](https://issues.redhat.com/browse/CNTRLPLANE-3215): fix envtest GHA workflow path filters for CRD test suites [#8200](https://github.com/openshift/hypershift/pull/8200)
* [CNTRLPLANE-2078](https://issues.redhat.com/browse/CNTRLPLANE-2078): add unit tests for AWS Route53 and IAM [#8079](https://github.com/openshift/hypershift/pull/8079)
* [OCPBUGS-82301](https://issues.redhat.com/browse/OCPBUGS-82301): fix(catalogs): use semver comparison for catalog version cap to handle OCP 5.0 [#8195](https://github.com/openshift/hypershift/pull/8195)
* NO-JIRA: control-plane-pki-operator: fix Event emission logic, format [#8190](https://github.com/openshift/hypershift/pull/8190)
* [OCPBUGS-82192](https://issues.redhat.com/browse/OCPBUGS-82192): fix(webhookcerts): handle upgrade from service-ca managed certs [#8189](https://github.com/openshift/hypershift/pull/8189)
* [OCPBUGS-82159](https://issues.redhat.com/browse/OCPBUGS-82159): fix(ignition-server): use major+minor version comparison for OCP 5.0 payloads [#8182](https://github.com/openshift/hypershift/pull/8182)
* [CNTRLPLANE-2511](https://issues.redhat.com/browse/CNTRLPLANE-2511): refactor(cpo): move OAuth internal LB annotation into ReconcileService [#8185](https://github.com/openshift/hypershift/pull/8185)
* [CNTRLPLANE-2511](https://issues.redhat.com/browse/CNTRLPLANE-2511): Support OAuth LoadBalancer with Azure Private Link Service [#8149](https://github.com/openshift/hypershift/pull/8149)
* [OCPBUGS-81644](https://issues.redhat.com/browse/OCPBUGS-81644): fix(cli): fix Azure destroy cluster leaving vnet/nsg resource groups for private topology [#8151](https://github.com/openshift/hypershift/pull/8151)
* [OCPBUGS-33097](https://issues.redhat.com/browse/OCPBUGS-33097): Remove deprecated OVNSbDb service type from default strategy mappings [#8164](https://github.com/openshift/hypershift/pull/8164)
* [CNTRLPLANE-3174](https://issues.redhat.com/browse/CNTRLPLANE-3174): test: Add unit tests for product-cli, token-minter, and sync-fg-configmap [#8178](https://github.com/openshift/hypershift/pull/8178)
* [CNTRLPLANE-3050](https://issues.redhat.com/browse/CNTRLPLANE-3050): feat(ci): use Konflux-built image for GitHub Actions runners [#8092](https://github.com/openshift/hypershift/pull/8092)
* [CNTRLPLANE-2841](https://issues.redhat.com/browse/CNTRLPLANE-2841): test(e2e): add metrics-forwarder e2e test verifying data-plane scraping [#8147](https://github.com/openshift/hypershift/pull/8147)
* [CNTRLPLANE-3037](https://issues.redhat.com/browse/CNTRLPLANE-3037): Create separate assets package specifically for CRD management [#8150](https://github.com/openshift/hypershift/pull/8150)
* [GCP-462](https://issues.redhat.com/browse/GCP-462): Add GCP hosted cluster documentation [#8027](https://github.com/openshift/hypershift/pull/8027)
* NO-JIRA: docs(ci): add sync-community-fork token rotation guide [#8173](https://github.com/openshift/hypershift/pull/8173)
* [CNTRLPLANE-2841](https://issues.redhat.com/browse/CNTRLPLANE-2841): feat(HCCO): reintroduce guest cluster metrics forwarder for control plane metrics [#8146](https://github.com/openshift/hypershift/pull/8146)
* NO-JIRA: fix(e2e): handle rate limiter context deadline error during cleanup [#8137](https://github.com/openshift/hypershift/pull/8137)
* NO-JIRA: fix(ci): remove catch-all pattern from codecov ignore list [#8171](https://github.com/openshift/hypershift/pull/8171)
* [CNTRLPLANE-2511](https://issues.redhat.com/browse/CNTRLPLANE-2511): Allow LoadBalancer publishing strategy for OAuthServer on self-managed Azure [#8148](https://github.com/openshift/hypershift/pull/8148)
* NO-JIRA: chore(ci): add client/ to codecov ignore list [#8167](https://github.com/openshift/hypershift/pull/8167)
* NO-JIRA: feat(e2e): add Azure platform support for backup/restore tests [#8144](https://github.com/openshift/hypershift/pull/8144)
* [OCPBUGS-74960](https://issues.redhat.com/browse/OCPBUGS-74960): prevent resource leak on deletion and handle DependencyViolation [#7868](https://github.com/openshift/hypershift/pull/7868)
* NO-JIRA: docs: expand custom images guide with Dockerfile.dev and CPO override [#8155](https://github.com/openshift/hypershift/pull/8155)
* [CNTRLPLANE-3042](https://issues.redhat.com/browse/CNTRLPLANE-3042): Parallelize make verify targets for faster local development [#8051](https://github.com/openshift/hypershift/pull/8051)
* NO-JIRA: ci: fix codecov ignore patterns for docs and nested files [#8156](https://github.com/openshift/hypershift/pull/8156)
* [OCPBUGS-81270](https://issues.redhat.com/browse/OCPBUGS-81270): fix(external-dns): mitigate Azure DNS API throttling [#8098](https://github.com/openshift/hypershift/pull/8098)
* NO-JIRA: ci: ignore non-Go files in codecov coverage analysis [#8154](https://github.com/openshift/hypershift/pull/8154)
* [OCPBUGS-67240](https://issues.redhat.com/browse/OCPBUGS-67240): Ignition generalize image download errors [#7673](https://github.com/openshift/hypershift/pull/7673)
* NO-JIRA: fix(Makefile): auto-detect upstream remote for lint [#8152](https://github.com/openshift/hypershift/pull/8152)
* [OCPBUGS-79539](https://issues.redhat.com/browse/OCPBUGS-79539): fix(cpo-v2): preserve HCCO modifications to OCM Controllers field [#8072](https://github.com/openshift/hypershift/pull/8072)
* [AUTOSCALE-582](https://issues.redhat.com/browse/AUTOSCALE-582): wire CRD sync and CEL adjustments into karpenter-api target [#8119](https://github.com/openshift/hypershift/pull/8119)
* [CNTRLPLANE-3111](https://issues.redhat.com/browse/CNTRLPLANE-3111): docs: add service publishing strategies reference documentation [#8107](https://github.com/openshift/hypershift/pull/8107)
* NO-JIRA: ci: make docs deploy preview non-blocking [#8145](https://github.com/openshift/hypershift/pull/8145)
* Revert "CNTRLPLANE-2841: feat(HCCO): add guest cluster metrics forwarder for control plane metrics" [#8141](https://github.com/openshift/hypershift/pull/8141)
* NO-JIRA: fix(e2e): handle dual RHCOS payloads in Karpenter drift OS image check [#8128](https://github.com/openshift/hypershift/pull/8128)
* [OCPBUGS-50003](https://issues.redhat.com/browse/OCPBUGS-50003): add ConfigMap fallback and EC2 error caching for vCPU metrics resolution [#6723](https://github.com/openshift/hypershift/pull/6723)
* [CNTRLPLANE-2172](https://issues.redhat.com/browse/CNTRLPLANE-2172): feat(azure): add private endpoint access topology for self-managed HostedClusters [#7821](https://github.com/openshift/hypershift/pull/7821)
* [CNTRLPLANE-2841](https://issues.redhat.com/browse/CNTRLPLANE-2841): feat(HCCO): add guest cluster metrics forwarder for control plane metrics [#7790](https://github.com/openshift/hypershift/pull/7790)
* [CNTRLPLANE-2797](https://issues.redhat.com/browse/CNTRLPLANE-2797): hypershift-operator webhooks port 9443 respect cluster TLS security profile [#8078](https://github.com/openshift/hypershift/pull/8078)
* [OCPBUGS-50603](https://issues.redhat.com/browse/OCPBUGS-50603): Create dedicated identity for KAS bootstrap container [#6827](https://github.com/openshift/hypershift/pull/6827)
* Revert "NO-JIRA: test(e2e): extend AWS guest resource cleanup timeout" [#8138](https://github.com/openshift/hypershift/pull/8138)
* NO-JIRA: ci: improve CI efficiency and codecov configuration [#8113](https://github.com/openshift/hypershift/pull/8113)
* NO-JIRA: test(e2e): add KubeVirt platform to backup/restore e2e test [#8131](https://github.com/openshift/hypershift/pull/8131)
* [OCPBUGS-81162](https://issues.redhat.com/browse/OCPBUGS-81162): fix(cpo): skip router LB services for ARO HCP [#8087](https://github.com/openshift/hypershift/pull/8087)
* NO-JIRA: ci: enable paths filter on envtest workflows [#8125](https://github.com/openshift/hypershift/pull/8125)
* NO-JIRA: test(e2e): extend AWS guest resource cleanup timeout [#8124](https://github.com/openshift/hypershift/pull/8124)
* NO-JIRA: fix(test): deep copy CRDs inside envtest retry loop [#8127](https://github.com/openshift/hypershift/pull/8127)
* NO-JIRA: chore(docs-agg): remove document count from aggregated file [#8126](https://github.com/openshift/hypershift/pull/8126)
* NO-JIRA: ci: separate envtest from unit tests in CI workflow [#8120](https://github.com/openshift/hypershift/pull/8120)
* [OCPBUGS-80926](https://issues.redhat.com/browse/OCPBUGS-80926): consolidate disaster-recovery prerequisites into dedicated page [#8080](https://github.com/openshift/hypershift/pull/8080)
* [CNTRLPLANE-3116](https://issues.redhat.com/browse/CNTRLPLANE-3116): fix(ci): drop pip cache from docs-preview workflow [#8116](https://github.com/openshift/hypershift/pull/8116)
* NO-JIRA: fix(api): regenerate feature gate manifests for ExternalOIDCWithUpstreamParity [#8117](https://github.com/openshift/hypershift/pull/8117)
* [OCPBUGS-78763](https://issues.redhat.com/browse/OCPBUGS-78763): fix: global-pull-secret daemonset node labeling race condition causes pods not to be scheduled on Replace upgrade strategy nodes in time [#7981](https://github.com/openshift/hypershift/pull/7981)
* [CNTRLPLANE-3037](https://issues.redhat.com/browse/CNTRLPLANE-3037): Introduce envtest for integration tests alternative [#8089](https://github.com/openshift/hypershift/pull/8089)
* [CNTRLPLANE-3116](https://issues.redhat.com/browse/CNTRLPLANE-3116): ci(docs): migrate docs-preview job to GitHub Actions [#8109](https://github.com/openshift/hypershift/pull/8109)
* [CNTRLPLANE-244](https://issues.redhat.com/browse/CNTRLPLANE-244): fix(ci): configure Codecov PR comments and add unit tests [#8085](https://github.com/openshift/hypershift/pull/8085)
* NO-JIRA: chore(deps): weekly dependabot consolidation [#8077](https://github.com/openshift/hypershift/pull/8077)
* [OCPBUGS-78931](https://issues.redhat.com/browse/OCPBUGS-78931): add KubeVirt-specific backup settings [#8022](https://github.com/openshift/hypershift/pull/8022)
* [OCPBUGS-81284](https://issues.redhat.com/browse/OCPBUGS-81284): fix(release): allow multiple machine-os component versions [#8101](https://github.com/openshift/hypershift/pull/8101)
* NO-JIRA: fix(aws): load credentials from --aws-creds file using SDK v2 [#8095](https://github.com/openshift/hypershift/pull/8095)
* NO-JIRA: chore(ci): update hypershift-ci-2 manifests [#8062](https://github.com/openshift/hypershift/pull/8062)
* [CNTRLPLANE-2678](https://issues.redhat.com/browse/CNTRLPLANE-2678): Adapt etcd-backup command and add HO namespace manifests [#8040](https://github.com/openshift/hypershift/pull/8040)
* [CNTRLPLANE-2551](https://issues.redhat.com/browse/CNTRLPLANE-2551): Hypershift integration for API Auth Config changes [#7774](https://github.com/openshift/hypershift/pull/7774)
* [GCP-447](https://issues.redhat.com/browse/GCP-447): inject token-minter as native sidecar init container [#7965](https://github.com/openshift/hypershift/pull/7965)
* [AUTOSCALE-538](https://issues.redhat.com/browse/AUTOSCALE-538), [AUTOSCALE-539](https://issues.redhat.com/browse/AUTOSCALE-539): Add Autonode status node counts + enabled condition to HostedCluster API [#7794](https://github.com/openshift/hypershift/pull/7794)
* [CNTRLPLANE-244](https://issues.redhat.com/browse/CNTRLPLANE-244): ci: add Codecov integration to unit test workflow [#8060](https://github.com/openshift/hypershift/pull/8060)
* [CNTRLPLANE-3050](https://issues.redhat.com/browse/CNTRLPLANE-3050): Pre-build lint tools and fix Konflux pipeline triggers [#8052](https://github.com/openshift/hypershift/pull/8052)
* [CNTRLPLANE-2838](https://issues.redhat.com/browse/CNTRLPLANE-2838): feat(CPO): add metrics-proxy control plane component [#7752](https://github.com/openshift/hypershift/pull/7752)
* [CNTRLPLANE-2787](https://issues.redhat.com/browse/CNTRLPLANE-2787): Introduce BASE_DOMAIN env var for E2E test configuration [#7930](https://github.com/openshift/hypershift/pull/7930)
* [CNTRLPLANE-2786](https://issues.redhat.com/browse/CNTRLPLANE-2786): Extend controller architecture diagram with consumes relationship [#8029](https://github.com/openshift/hypershift/pull/8029)
* [IR-350](https://issues.redhat.com/browse/IR-350): add tls security profile configuration for the image registry operator [#8011](https://github.com/openshift/hypershift/pull/8011)
* [AUTOSCALE-571](https://issues.redhat.com/browse/AUTOSCALE-571): fix(karpenter): don't associate public IP addresses for the default OpenshiftEC2NodeClass [#7853](https://github.com/openshift/hypershift/pull/7853)
* NO-JIRA: feat(e2e): skip SupportedVersionSkew condition on OCP < 4.21 in backup/restore tests [#8067](https://github.com/openshift/hypershift/pull/8067)
* [CNTRLPLANE-2076](https://issues.redhat.com/browse/CNTRLPLANE-2076): remove v2 import aliases left from SDK migration [#8063](https://github.com/openshift/hypershift/pull/8063)
* [AUTOSCALE-559](https://issues.redhat.com/browse/AUTOSCALE-559): PrivateLink plumbing for karpenter ec2nodeclass subnets [#7791](https://github.com/openshift/hypershift/pull/7791)
* [STOR-2770](https://issues.redhat.com/browse/STOR-2770): Generate Azure Disk and File CSI Driver Operator metrics serving certs by HCP controller [#7970](https://github.com/openshift/hypershift/pull/7970)
* [CNTRLPLANE-2678](https://issues.redhat.com/browse/CNTRLPLANE-2678): Add fetch-etcd-certs CPO subcommand for HCPEtcdBackup [#8010](https://github.com/openshift/hypershift/pull/8010)
* NO-JIRA: revert(api): remove APIServer Route CEL validation for Azure [#8074](https://github.com/openshift/hypershift/pull/8074)
* [CNTRLPLANE-2172](https://issues.redhat.com/browse/CNTRLPLANE-2172): feat(api): add Azure private endpoint access and PrivateLinkService CRD [#8055](https://github.com/openshift/hypershift/pull/8055)
* [OCPSTRAT-2831](https://issues.redhat.com/browse/OCPSTRAT-2831): chore(owners): add cblecker to core-reviewers and core-approvers [#8018](https://github.com/openshift/hypershift/pull/8018)
* [OCPBUGS-79428](https://issues.redhat.com/browse/OCPBUGS-79428): Add recipe for ACM/MCE HyperShift Operator overrides [#8057](https://github.com/openshift/hypershift/pull/8057)
* [CNTRLPLANE-2076](https://issues.redhat.com/browse/CNTRLPLANE-2076): complete SDK v1 removal and post-migration cleanup [#8038](https://github.com/openshift/hypershift/pull/8038)
* [CNTRLPLANE-2049](https://issues.redhat.com/browse/CNTRLPLANE-2049): update GCP validation error expectations in TestOnCreateAPIUX [#8037](https://github.com/openshift/hypershift/pull/8037)
* [CNTRLPLANE-3046](https://issues.redhat.com/browse/CNTRLPLANE-3046): feat(ci): add monitoring and alerting for ARC runners [#8044](https://github.com/openshift/hypershift/pull/8044)
* [CNTRLPLANE-3049](https://issues.redhat.com/browse/CNTRLPLANE-3049): split verify checks into individual GitHub Actions workflows [#8049](https://github.com/openshift/hypershift/pull/8049)
* [OCPBUGS-79352](https://issues.redhat.com/browse/OCPBUGS-79352): fix(oapi): force WatchList feature gate to disabled for openshift-apiserver [#8035](https://github.com/openshift/hypershift/pull/8035)
* [OCPBUGS-79071](https://issues.redhat.com/browse/OCPBUGS-79071): Fix AWSEndpointService private-router teardown stuck on active VPC Endpoint connections [#8030](https://github.com/openshift/hypershift/pull/8030)
* [CNTRLPLANE-3041](https://issues.redhat.com/browse/CNTRLPLANE-3041): Override ARO/HCP 4.20 CPO with Azure Pod Identity backport [#8025](https://github.com/openshift/hypershift/pull/8025)
* [CNTRLPLANE-3054](https://issues.redhat.com/browse/CNTRLPLANE-3054): Apply init task 0.3 migration to fix broken Konflux pipelines [#8053](https://github.com/openshift/hypershift/pull/8053)
* [OCPBUGS-70301](https://issues.redhat.com/browse/OCPBUGS-70301): force-remove karpenter finalizer when guest KAS is down [#7939](https://github.com/openshift/hypershift/pull/7939)
* [CNTRLPLANE-3047](https://issues.redhat.com/browse/CNTRLPLANE-3047): fix(ci): use community fork token for checkout credential helper [#8050](https://github.com/openshift/hypershift/pull/8050)
* [CNTRLPLANE-2788](https://issues.redhat.com/browse/CNTRLPLANE-2788): validate memory quantity in KubeVirt nodepool create [#7884](https://github.com/openshift/hypershift/pull/7884)
* NO-JIRA: chore(ci): update Konflux Tekton tasks to latest versions [#8048](https://github.com/openshift/hypershift/pull/8048)
* [CNTRLPLANE-3048](https://issues.redhat.com/browse/CNTRLPLANE-3048): refactor gh-actions-runner pipelines and improve CEL triggers [#8045](https://github.com/openshift/hypershift/pull/8045)
* [OCPBUGS-79369](https://issues.redhat.com/browse/OCPBUGS-79369): Add Konflux archived PipelineRun skill and update task discovery [#8043](https://github.com/openshift/hypershift/pull/8043)
* [CNTRLPLANE-3047](https://issues.redhat.com/browse/CNTRLPLANE-3047): add workflow to sync hypershift-community fork [#8042](https://github.com/openshift/hypershift/pull/8042)
* NO-JIRA: chore(claude): add restructure-commits plugin command [#7927](https://github.com/openshift/hypershift/pull/7927)
* [CNTRLPLANE-2986](https://issues.redhat.com/browse/CNTRLPLANE-2986): feat(ci): Add self-hosted GitHub Actions runners for HyperShift [#7980](https://github.com/openshift/hypershift/pull/7980)
* NO-JIRA: fix(ci): pass --upgrade-versions to konflux task update skill [#8036](https://github.com/openshift/hypershift/pull/8036)
* [CNTRLPLANE-2998](https://issues.redhat.com/browse/CNTRLPLANE-2998): Migrate SQS to AWS SDK v2 [#8015](https://github.com/openshift/hypershift/pull/8015)
* NO-JIRA: refactor(oadp): unify backup/restore e2e test with platform auto-detection [#7971](https://github.com/openshift/hypershift/pull/7971)
* [OCPBUGS-78996](https://issues.redhat.com/browse/OCPBUGS-78996): fix(test): create SQS queue dynamically in spot termination handler e2e test [#8007](https://github.com/openshift/hypershift/pull/8007)
* [CNTRLPLANE-2049](https://issues.redhat.com/browse/CNTRLPLANE-2049): fix(api): audit and improve GCP API validation rules [#8003](https://github.com/openshift/hypershift/pull/8003)
* [CNTRLPLANE-2081](https://issues.redhat.com/browse/CNTRLPLANE-2081): Migrate RAM and ARN to AWS SDK v2 [#7986](https://github.com/openshift/hypershift/pull/7986)
* [OCPBUGS-78778](https://issues.redhat.com/browse/OCPBUGS-78778): fix(cpo): Don't remove HCP Ingress from routes when CapabilityRoute is disabled [#8001](https://github.com/openshift/hypershift/pull/8001)
* NO-JIRA: Disable parent ownership for api subdir [#8009](https://github.com/openshift/hypershift/pull/8009)
* NO-JIRA: fix(api): replace CEL url() validators with regex to fix CRD cost budget [#8004](https://github.com/openshift/hypershift/pull/8004)
* [OCPBUGS-78544](https://issues.redhat.com/browse/OCPBUGS-78544): Update base images to address multiple CVEs flagged by MSFT security scans [#7983](https://github.com/openshift/hypershift/pull/7983)
* [OCPBUGS-78705](https://issues.redhat.com/browse/OCPBUGS-78705): Bootstrap CVO manifests should be filtered based on feature-set annotation [#7984](https://github.com/openshift/hypershift/pull/7984)
* NO-JIRA: fix(api): extend kubeapilinter scope to all non-vendor API types [#8002](https://github.com/openshift/hypershift/pull/8002)
* NO-JIRA: build(e2e): include hypershift binary in Dockerfile.e2e [#7919](https://github.com/openshift/hypershift/pull/7919)
* [CNTRLPLANE-2925](https://issues.redhat.com/browse/CNTRLPLANE-2925): add NodePool.Status.NodesInfo for node version distribution [#7917](https://github.com/openshift/hypershift/pull/7917)
* [OCPSTRAT-2336](https://issues.redhat.com/browse/OCPSTRAT-2336): Adjust karpenter API to OpenShift conventions [#7952](https://github.com/openshift/hypershift/pull/7952)
* [OCPBUGS-78539](https://issues.redhat.com/browse/OCPBUGS-78539): chore(e2e): add temporary crash toleration for dns-operator [#7978](https://github.com/openshift/hypershift/pull/7978)
* [CNTRLPLANE-2172](https://issues.redhat.com/browse/CNTRLPLANE-2172): fix(e2e): register Azure private platform e2e flags [#7977](https://github.com/openshift/hypershift/pull/7977)
* NO-JIRA: chore(owners): require api-approvers approval for api/ changes [#7972](https://github.com/openshift/hypershift/pull/7972)
* Update Kube API Linter config for new APIs [#7982](https://github.com/openshift/hypershift/pull/7982)
* NO-JIRA: add .gitattributes to collapse generated files in PR diffs [#7918](https://github.com/openshift/hypershift/pull/7918)
* [CNTRLPLANE-2910](https://issues.redhat.com/browse/CNTRLPLANE-2910): feat(cpo): add Azure workload identity webhook as KAS sidecar [#7867](https://github.com/openshift/hypershift/pull/7867)
* [CNTRLPLANE-2077](https://issues.redhat.com/browse/CNTRLPLANE-2077): refactor(cleanzones): migrate AWS SDK from v1 to v2 [#7960](https://github.com/openshift/hypershift/pull/7960)
* [CNTRLPLANE-2219](https://issues.redhat.com/browse/CNTRLPLANE-2219): feat(aws): migrate ec2 to AWS SDK v2 [#7871](https://github.com/openshift/hypershift/pull/7871)
* [GCP-440](https://issues.redhat.com/browse/GCP-440): Fix GCP boot image discovery from CoreOS stream metadata [#7881](https://github.com/openshift/hypershift/pull/7881)
* And 17 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/hypershift/compare/1a3320029e1b95a759edc622bf4cffdb60793ffa...a101e6697af02eba43e6cfd04fc4c00277b72a64)
### [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm/tree/9024b8c9616eb2e938d780bb4ffa42f235adecf9)
* [OCPBUGS-83587](https://issues.redhat.com/browse/OCPBUGS-83587): bump google.golang.org grpc v1.79.3 [#106](https://github.com/openshift/cloud-provider-ibm/pull/106)
* NO-JIRA: Update OWNERS [#95](https://github.com/openshift/cloud-provider-ibm/pull/95)
* [Full changelog](https://github.com/openshift/cloud-provider-ibm/compare/d9222a1c00c37d635da02b65606fde1e54b2ec03...9024b8c9616eb2e938d780bb4ffa42f235adecf9)
### [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver/tree/e76df035c5b5e5a9ed06b7ff3dac3dba416b3af2)
* NO-JIRA: Bump gRPC library to v1.79.3 and replace golang.org/x/net/context with context [#149](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/149)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver/compare/aa40cd7e1a37e2f48f238fc8d293b0546d5d4caf...e76df035c5b5e5a9ed06b7ff3dac3dba416b3af2)
### [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/tree/badf3773d38456d810da7e1dc6d49c3e730e489c)
* NO-ISSUE: Bump google.golang.org/grpc to v1.79.3 [#172](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/172)
* [STOR-2762](https://issues.redhat.com/browse/STOR-2762): Bump all deps for 4.22 [#168](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/168)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/compare/fcb386083a9523234e1baf20efa39aee4719b3df...badf3773d38456d810da7e1dc6d49c3e730e489c)
### [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud/tree/a26ad7ece37d9ae974d4384d6a4676ccb7666cd9)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#160](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/160)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#158](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/158)
* NO-JIRA: Update manifests generator [#159](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/159)
* NO-JIRA: Update OWNERS [#156](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/156)
* [Full changelog](https://github.com/openshift/cluster-api-provider-ibmcloud/compare/03b143d588768a18fd8afa1534ea7d7a04b4d1f3...a26ad7ece37d9ae974d4384d6a4676ccb7666cd9)
### [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud/tree/1f7397711bf06c87bf497e300870871dc345b827)
* NO-JIRA: Update OWNERS [#93](https://github.com/openshift/machine-api-provider-ibmcloud/pull/93)
* [OCPCLOUD-3278](https://issues.redhat.com/browse/OCPCLOUD-3278): Rebase to Kube 1.35 for Machine API Provider IBM [#83](https://github.com/openshift/machine-api-provider-ibmcloud/pull/83)
* [OCPBUGS-77729](https://issues.redhat.com/browse/OCPBUGS-77729): Updating ose-ibmcloud-machine-controllers-container image to be consistent with ART for 4.22 [#80](https://github.com/openshift/machine-api-provider-ibmcloud/pull/80)
* NO-JIRA: Modernize test infrastructure to align with other MAPI providers [#82](https://github.com/openshift/machine-api-provider-ibmcloud/pull/82)
* [Full changelog](https://github.com/openshift/machine-api-provider-ibmcloud/compare/2294fb1c5141034674f1a4e29a16a599cf8e4990...1f7397711bf06c87bf497e300870871dc345b827)
### [insights-operator](https://github.com/openshift/insights-operator/tree/7c39d495feefbbeb977bd164eb0dc7a5fa4c7ac7)
* [CCXDEV-15790](https://issues.redhat.com/browse/CCXDEV-15790): extractor controller [#1280](https://github.com/openshift/insights-operator/pull/1280)
* [OCPBUGS-85710](https://issues.redhat.com/browse/OCPBUGS-85710): add trusted-ca-bundle to gatherin job [#1289](https://github.com/openshift/insights-operator/pull/1289)
* [CCXDEV-16348](https://issues.redhat.com/browse/CCXDEV-16348): tls metrics [#1275](https://github.com/openshift/insights-operator/pull/1275)
* [OCPBUGS-77351](https://issues.redhat.com/browse/OCPBUGS-77351): fix: add terminationMessagePolicy to runtime extractor containers [#1286](https://github.com/openshift/insights-operator/pull/1286)
* NO-JIRA: remove BaiyangZhou from OWNERS [#1273](https://github.com/openshift/insights-operator/pull/1273)
* [OCPBUGS-85201](https://issues.redhat.com/browse/OCPBUGS-85201): Bump google.golang.org/grpc to v1.79.3 [#1288](https://github.com/openshift/insights-operator/pull/1288)
* NO-JIRA: Update golang version [#1277](https://github.com/openshift/insights-operator/pull/1277)
* NO-JIRA: add write-test claude skill [#1274](https://github.com/openshift/insights-operator/pull/1274)
* [CCXDEV-15561](https://issues.redhat.com/browse/CCXDEV-15561): Improve test coverage 4 [#1226](https://github.com/openshift/insights-operator/pull/1226)
* [CCXDEV-15964](https://issues.redhat.com/browse/CCXDEV-15964): fetch TLS profiles from API server [#1257](https://github.com/openshift/insights-operator/pull/1257)
* [CCXDEV-15963](https://issues.redhat.com/browse/CCXDEV-15963): kubeletconfig gatherer [#1247](https://github.com/openshift/insights-operator/pull/1247)
* NO-JIRA: generate gatherer docs [#1256](https://github.com/openshift/insights-operator/pull/1256)
* [CCXDEV-16094](https://issues.redhat.com/browse/CCXDEV-16094): add config option to disable runtime extractor [#1248](https://github.com/openshift/insights-operator/pull/1248)
* [CCXDEV-16006](https://issues.redhat.com/browse/CCXDEV-16006): add permission for opentelemetrycollectors [#1252](https://github.com/openshift/insights-operator/pull/1252)
* [OCPBUGS-78115](https://issues.redhat.com/browse/OCPBUGS-78115): Fix string accessor error [#1253](https://github.com/openshift/insights-operator/pull/1253)
* [Full changelog](https://github.com/openshift/insights-operator/compare/0a638f675ccfe9446ac4f2609c3698d084259ab7...7c39d495feefbbeb977bd164eb0dc7a5fa4c7ac7)
### [insights-runtime-exporter, insights-runtime-extractor](https://github.com/openshift/insights-runtime-extractor/tree/70256457b507ec09737800ee7ea022143ed6c3c2)
* Update OWNERS to remove 'tremes' [#67](https://github.com/openshift/insights-runtime-extractor/pull/67)
* [Full changelog](https://github.com/openshift/insights-runtime-extractor/compare/0f2bcfdf2a7c42f318e3a950fac48f4190ec2676...70256457b507ec09737800ee7ea022143ed6c3c2)
### [ironic](https://github.com/openshift/ironic-image/tree/323974b0aadc149d0dc29ca352b4be6c53b395d2)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#821](https://github.com/openshift/ironic-image/pull/821)
* [OCPBUGS-83618](https://issues.redhat.com/browse/OCPBUGS-83618): Bump sushy to latest [#838](https://github.com/openshift/ironic-image/pull/838)
* NO-ISSUE: Fix update requirements workflow [#842](https://github.com/openshift/ironic-image/pull/842)
* NO-ISSUE: Document how to use gerrit change hash for testing [#839](https://github.com/openshift/ironic-image/pull/839)
* [OKD-362](https://issues.redhat.com/browse/OKD-362): Add watchdog to python-requirements.okd [#837](https://github.com/openshift/ironic-image/pull/837)
* [OCPBUGS-82540](https://issues.redhat.com/browse/OCPBUGS-82540): Bump pyasn1 to 0.5.1-5 [#822](https://github.com/openshift/ironic-image/pull/822)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#818](https://github.com/openshift/ironic-image/pull/818)
* [METAL-1758](https://issues.redhat.com/browse/METAL-1758): Merge upstream 2026 03 16 [#814](https://github.com/openshift/ironic-image/pull/814)
* [METAL-1735](https://issues.redhat.com/browse/METAL-1735): Add TLS cipher suite and curves related options to ironic for centralized tls support [#810](https://github.com/openshift/ironic-image/pull/810)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#816](https://github.com/openshift/ironic-image/pull/816)
* [METAL-1771](https://issues.redhat.com/browse/METAL-1771): Remove heredoc syntax for hermetic builds compatibility [#815](https://github.com/openshift/ironic-image/pull/815)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#812](https://github.com/openshift/ironic-image/pull/812)
* [OCPBUGS-77528](https://issues.redhat.com/browse/OCPBUGS-77528): Fix interface detection when MAC/IP matches multiple interfaces [#807](https://github.com/openshift/ironic-image/pull/807)
* [METAL-1726](https://issues.redhat.com/browse/METAL-1726): Multi-stage wheel-builder for OCP builds [#786](https://github.com/openshift/ironic-image/pull/786)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#808](https://github.com/openshift/ironic-image/pull/808)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#806](https://github.com/openshift/ironic-image/pull/806)
* [METAL-1749](https://issues.redhat.com/browse/METAL-1749): Uplift setuptools to remove python-wheel deps [#804](https://github.com/openshift/ironic-image/pull/804)
* [METAL-1748](https://issues.redhat.com/browse/METAL-1748): Drop genisoimage in favor of xorriso [#803](https://github.com/openshift/ironic-image/pull/803)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#805](https://github.com/openshift/ironic-image/pull/805)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#801](https://github.com/openshift/ironic-image/pull/801)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#799](https://github.com/openshift/ironic-image/pull/799)
* [OCPBUGS-76935](https://issues.redhat.com/browse/OCPBUGS-76935): Bump keystonemiddleware version to 10.9.0-0.20260216145500.557d173 for CVE-2026-22797 fix [#790](https://github.com/openshift/ironic-image/pull/790)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#793](https://github.com/openshift/ironic-image/pull/793)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#789](https://github.com/openshift/ironic-image/pull/789)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#784](https://github.com/openshift/ironic-image/pull/784)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#783](https://github.com/openshift/ironic-image/pull/783)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#773](https://github.com/openshift/ironic-image/pull/773)
* [ART-14497](https://issues.redhat.com/browse/ART-14497): Fix ART builds with -minimal [#779](https://github.com/openshift/ironic-image/pull/779)
* NO-ISSUE: Bump openstacksdk version to 4.9.0 [#776](https://github.com/openshift/ironic-image/pull/776)
* [OCPBUGS-74579](https://issues.redhat.com/browse/OCPBUGS-74579): fix for minimal builds [#772](https://github.com/openshift/ironic-image/pull/772)
* [OCPBUGS-74427](https://issues.redhat.com/browse/OCPBUGS-74427): Bump eventlet version to latest bugfix [#770](https://github.com/openshift/ironic-image/pull/770)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#768](https://github.com/openshift/ironic-image/pull/768)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#762](https://github.com/openshift/ironic-image/pull/762)
* [Full changelog](https://github.com/openshift/ironic-image/compare/324282211ff7df42b93360c435767a9793d542b6...323974b0aadc149d0dc29ca352b4be6c53b395d2)
### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/0f83b3ffba520606e514846d2529f862226fc442)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#255](https://github.com/openshift/ironic-agent-image/pull/255)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#254](https://github.com/openshift/ironic-agent-image/pull/254)
* NO-ISSUE: Remove openstack repo workaround [#249](https://github.com/openshift/ironic-agent-image/pull/249)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#253](https://github.com/openshift/ironic-agent-image/pull/253)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#248](https://github.com/openshift/ironic-agent-image/pull/248)
* [METAL-1779](https://issues.redhat.com/browse/METAL-1779): Add podman package for bootc deploy [#247](https://github.com/openshift/ironic-agent-image/pull/247)
* NO-ISSUE: Fix update requirements workflow [#252](https://github.com/openshift/ironic-agent-image/pull/252)
* NO-ISSUE: Document how to use gerrit change hash for testing [#250](https://github.com/openshift/ironic-agent-image/pull/250)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#246](https://github.com/openshift/ironic-agent-image/pull/246)
* [METAL-1749](https://issues.redhat.com/browse/METAL-1749): Uplift setuptools to remove python-wheel deps [#245](https://github.com/openshift/ironic-agent-image/pull/245)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#243](https://github.com/openshift/ironic-agent-image/pull/243)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#242](https://github.com/openshift/ironic-agent-image/pull/242)
* [OCPBUGS-74579](https://issues.redhat.com/browse/OCPBUGS-74579): fixes for minimal builds [#240](https://github.com/openshift/ironic-agent-image/pull/240)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#238](https://github.com/openshift/ironic-agent-image/pull/238)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#237](https://github.com/openshift/ironic-agent-image/pull/237)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/ac614863114652e8dd54bc31bde198124c092116...0f83b3ffba520606e514846d2529f862226fc442)
### [keepalived-ipfailover](https://github.com/openshift/images/tree/f5dba030c456e9d8b5804929e3f3b98072cdc08b)
* [OCPBUGS-86911](https://issues.redhat.com/browse/OCPBUGS-86911): Updating openshift-enterprise-base-rhel9-container image to be consistent with ART for 5.0 [#236](https://github.com/openshift/images/pull/236)
* [OCPSTRAT-3113](https://issues.redhat.com/browse/OCPSTRAT-3113): Set DEFAULT:PQ crypto-policies to RHEL9 base image [#230](https://github.com/openshift/images/pull/230)
* Revert "OCPBUGS-84344: yum.conf: omit docs, weak deps" [#234](https://github.com/openshift/images/pull/234)
* [OCPBUGS-84344](https://issues.redhat.com/browse/OCPBUGS-84344): yum.conf: omit docs, weak deps [#231](https://github.com/openshift/images/pull/231)
* [Full changelog](https://github.com/openshift/images/compare/edb8b1e6c5e949c0b470b2bdf7a32f17e53d2f71...f5dba030c456e9d8b5804929e3f3b98072cdc08b)
### [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy/tree/d12e274605248f6c59373240a7eae7a7a357dcb3)
* [CNTRLPLANE-2932](https://issues.redhat.com/browse/CNTRLPLANE-2932): Merge upstream v0.21.1 [#133](https://github.com/openshift/kube-rbac-proxy/pull/133)
* [Full changelog](https://github.com/openshift/kube-rbac-proxy/compare/bdd87a0646eae5683bb83fe30e3649471b757ebf...d12e274605248f6c59373240a7eae7a7a357dcb3)
### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/3b41710783bab83b33e6d8f2033be3a9fbce6a9d)
* [OCPBUGS-85098](https://issues.redhat.com/browse/OCPBUGS-85098): [bot] Bump openshift/kube-state-metrics to v2.19.0 [#141](https://github.com/openshift/kube-state-metrics/pull/141)
* [Full changelog](https://github.com/openshift/kube-state-metrics/compare/6fa06eac4c3942ba64bff18ca93b5a019ea5c976...3b41710783bab83b33e6d8f2033be3a9fbce6a9d)
### [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver/tree/771b562d4875296007850a4d3709a7ae1c6ed3e2)
* [CNV-82343](https://issues.redhat.com/browse/CNV-82343): Add annotation-based fallback for infra VM node ID resolution (#170) [#80](https://github.com/openshift/kubevirt-csi-driver/pull/80)
* [Full changelog](https://github.com/openshift/kubevirt-csi-driver/compare/9e2dbddfe27080b834c83ef93503f886ad4189b6...771b562d4875296007850a4d3709a7ae1c6ed3e2)
### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/d7772c62914781cd312b5e6db24532d694a8a140)
* [OCPBUGS-85416](https://issues.redhat.com/browse/OCPBUGS-85416): Enable actuators to set terminal failure on Exists and Update [#1499](https://github.com/openshift/machine-api-operator/pull/1499)
* [SPLAT-2745](https://issues.redhat.com/browse/SPLAT-2745): Changed vSphere cloud config to be read from openshift-config-managed [#1495](https://github.com/openshift/machine-api-operator/pull/1495)
* [OCPBUGS-82584](https://issues.redhat.com/browse/OCPBUGS-82584): Populate status label selector for scale subresource. [#1490](https://github.com/openshift/machine-api-operator/pull/1490)
* NO-JIRA: machine-api-termination-handler: add scc annotation, terminationMessage: FallbackToLogsOnError [#1494](https://github.com/openshift/machine-api-operator/pull/1494)
* NO-JIRA: bump controller-runtime-common to latest main [#1493](https://github.com/openshift/machine-api-operator/pull/1493)
* NO-JIRA: fix: importing nutanix test to in the binary [#1491](https://github.com/openshift/machine-api-operator/pull/1491)
* NO-JIRA: Update OWNERS [#1486](https://github.com/openshift/machine-api-operator/pull/1486)
* [OCPCLOUD-3346](https://issues.redhat.com/browse/OCPCLOUD-3346): tls: use centralized TLS [#1456](https://github.com/openshift/machine-api-operator/pull/1456)
* [MON-4497](https://issues.redhat.com/browse/MON-4497): metrics: migrate Prometheus SD from Endpoints to EndpointSlices [#1457](https://github.com/openshift/machine-api-operator/pull/1457)
* [SPLAT-2680](https://issues.redhat.com/browse/SPLAT-2680): Changed DHA to require hostAffinity=host [#1484](https://github.com/openshift/machine-api-operator/pull/1484)
* [OCPCLOUD-3282](https://issues.redhat.com/browse/OCPCLOUD-3282), [OCPCLOUD-3288](https://issues.redhat.com/browse/OCPCLOUD-3288): Bump to k8s 1.35 dependencies [#1474](https://github.com/openshift/machine-api-operator/pull/1474)
* NO-JIRA: fix flaky TestReconcile/machine_with_node_likely_to_go_unhealthy#1483 [#1483](https://github.com/openshift/machine-api-operator/pull/1483)
* [SPLAT-2680](https://issues.redhat.com/browse/SPLAT-2680): Fixed MAO to not allow dedicated host configurations for control plane nodes [#1477](https://github.com/openshift/machine-api-operator/pull/1477)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/d8d9ab7e0fce2c6d4fcf24ec45662aa2c88c631e...d7772c62914781cd312b5e6db24532d694a8a140)
### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/62b06d28399b348cb7238d32ad74b9a978c4292f)
* [AGENT-1531](https://issues.redhat.com/browse/AGENT-1531): Remove localhost.localdomain workaround for MCN IRI image field [#6146](https://github.com/openshift/machine-config-operator/pull/6146)
* Fixes OCPBUGS-77140: increase LRU cache and prefetch timeout for PinnedImageSet [#6046](https://github.com/openshift/machine-config-operator/pull/6046)
* [OCPBUGS-87014](https://issues.redhat.com/browse/OCPBUGS-87014): Remove skopeo-install script [#6141](https://github.com/openshift/machine-config-operator/pull/6141)
* [OCPBUGS-86965](https://issues.redhat.com/browse/OCPBUGS-86965): make test 69755 more stable [#6127](https://github.com/openshift/machine-config-operator/pull/6127)
* [OCPBUGS-86554](https://issues.redhat.com/browse/OCPBUGS-86554): Wait for operators after removing master machine [#6091](https://github.com/openshift/machine-config-operator/pull/6091)
* [OCPBUGS-85427](https://issues.redhat.com/browse/OCPBUGS-85427): Remove trailing newline (\n) characters in klog message strings [#6112](https://github.com/openshift/machine-config-operator/pull/6112)
* [MCO-2211](https://issues.redhat.com/browse/MCO-2211): MCO-2210: MCO-2234 MCO-Migrate MCO tests from openshift-tests-private [#5902](https://github.com/openshift/machine-config-operator/pull/5902)
* [OCPBUGS-86890](https://issues.redhat.com/browse/OCPBUGS-86890): fix: update arbiter crio config [#6120](https://github.com/openshift/machine-config-operator/pull/6120)
* [MCO-2296](https://issues.redhat.com/browse/MCO-2296): Remove OSImageStreams v1 replace [#6133](https://github.com/openshift/machine-config-operator/pull/6133)
* [MCO-2296](https://issues.redhat.com/browse/MCO-2296): OSImageStreams v1 promotion [#6076](https://github.com/openshift/machine-config-operator/pull/6076)
* [AGENT-1526](https://issues.redhat.com/browse/AGENT-1526): disable htpasswd auth on IRI registry, keep read-only [#6109](https://github.com/openshift/machine-config-operator/pull/6109)
* NO-ISSUE: Add -L flag to curl to follow redirects automatically [#6121](https://github.com/openshift/machine-config-operator/pull/6121)
* [OCPBUGS-86041](https://issues.redhat.com/browse/OCPBUGS-86041): update IsSNO helper function to correctly access the cluster's topology [#6110](https://github.com/openshift/machine-config-operator/pull/6110)
* [OCPBUGS-83619](https://issues.redhat.com/browse/OCPBUGS-83619): Add version guard for OSStream rendering [#6111](https://github.com/openshift/machine-config-operator/pull/6111)
* NO-ISSUE: Lower IRI deletion log verbosity [#6119](https://github.com/openshift/machine-config-operator/pull/6119)
* [OCPBUGS-86179](https://issues.redhat.com/browse/OCPBUGS-86179): Update ImageModeStatusReporting MCP machine count tests to be resilient on SNO topology [#6089](https://github.com/openshift/machine-config-operator/pull/6089)
* [OCPBUGS-86800](https://issues.redhat.com/browse/OCPBUGS-86800): Update AMI Whitelist [#6108](https://github.com/openshift/machine-config-operator/pull/6108)
* [OCPBUGS-86671](https://issues.redhat.com/browse/OCPBUGS-86671): Fix InternalReleaseImage URL transform [#6100](https://github.com/openshift/machine-config-operator/pull/6100)
* [AGENT-1488](https://issues.redhat.com/browse/AGENT-1488): Aggregate IRI status from MachineConfigNodes [#5841](https://github.com/openshift/machine-config-operator/pull/5841)
* [OCPBUGS-63750](https://issues.redhat.com/browse/OCPBUGS-63750): fix Go build tag behavior [#5494](https://github.com/openshift/machine-config-operator/pull/5494)
* [OCPBUGS-86474](https://issues.redhat.com/browse/OCPBUGS-86474): Tests using realtime kernel should not be limited to a… [#6084](https://github.com/openshift/machine-config-operator/pull/6084)
* [OCPBUGS-86332](https://issues.redhat.com/browse/OCPBUGS-86332): remove tests using base images older than 4.13 [#6077](https://github.com/openshift/machine-config-operator/pull/6077)
* NO-ISSUE: Update TC-88366 to check osImageStream status after update completes [#6078](https://github.com/openshift/machine-config-operator/pull/6078)
* [AGENT-1491](https://issues.redhat.com/browse/AGENT-1491): reclaim disk space from the node when IRI resource is deleted [#5988](https://github.com/openshift/machine-config-operator/pull/5988)
* [OCPBUGS-86035](https://issues.redhat.com/browse/OCPBUGS-86035): Adapt test '54922 - daemon: add check before updating kerne… [#6056](https://github.com/openshift/machine-config-operator/pull/6056)
* [AGENT-1517](https://issues.redhat.com/browse/AGENT-1517): fix iri deletion test [#6070](https://github.com/openshift/machine-config-operator/pull/6070)
* [OCPBUGS-83987](https://issues.redhat.com/browse/OCPBUGS-83987): Fix CVE-2026-33186 [#6065](https://github.com/openshift/machine-config-operator/pull/6065)
* [OCPBUGS-84814](https://issues.redhat.com/browse/OCPBUGS-84814): Skip chrony-wait on first node join [#5990](https://github.com/openshift/machine-config-operator/pull/5990)
* [MCO-2273](https://issues.redhat.com/browse/MCO-2273): MCO-2215: MCO-2183: Migrate remaining TCs from mco.go to MCO, units, kublet suite [#6024](https://github.com/openshift/machine-config-operator/pull/6024)
* [AGENT-1517](https://issues.redhat.com/browse/AGENT-1517): disable iri-registry service on IRI delete [#6041](https://github.com/openshift/machine-config-operator/pull/6041)
* [OCPBUGS-85237](https://issues.redhat.com/browse/OCPBUGS-85237): Manually uncordoned nodes are not automatically re-cordoned [#6028](https://github.com/openshift/machine-config-operator/pull/6028)
* [OCPBUGS-15157](https://issues.redhat.com/browse/OCPBUGS-15157): Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole [#6000](https://github.com/openshift/machine-config-operator/pull/6000)
* [OCPBUGS-65645](https://issues.redhat.com/browse/OCPBUGS-65645): Verify extension packages are installed [#6010](https://github.com/openshift/machine-config-operator/pull/6010)
* [OCPBUGS-79502](https://issues.redhat.com/browse/OCPBUGS-79502): Enable AutoSizingReserved for Hypershift workers [#5847](https://github.com/openshift/machine-config-operator/pull/5847)
* NO-JIRA: daemon: expand os image presence check [#6005](https://github.com/openshift/machine-config-operator/pull/6005)
* [MCO-2212](https://issues.redhat.com/browse/MCO-2212): MCO-2213: Migrate mco_observability and mco_daemon test-suite [#5875](https://github.com/openshift/machine-config-operator/pull/5875)
* [OCPBUGS-63650](https://issues.redhat.com/browse/OCPBUGS-63650): configure-ovs: copy lldp mode to br-ex port [#5698](https://github.com/openshift/machine-config-operator/pull/5698)
* [OCPBUGS-85498](https://issues.redhat.com/browse/OCPBUGS-85498): BareMetal skew e2e fails patching provisioning CR after CBO webhook fix [#6031](https://github.com/openshift/machine-config-operator/pull/6031)
* [OCPBUGS-85497](https://issues.redhat.com/browse/OCPBUGS-85497): only check password hash in /etc/shadow [#6030](https://github.com/openshift/machine-config-operator/pull/6030)
* NO-JIRA: Add fix for ossImagestream status [#6018](https://github.com/openshift/machine-config-operator/pull/6018)
* [MCO-2025](https://issues.redhat.com/browse/MCO-2025): OCP-88366 and add OCP-88814 for osImageStream with osImageURL [#6014](https://github.com/openshift/machine-config-operator/pull/6014)
* [OCPBUGS-83830](https://issues.redhat.com/browse/OCPBUGS-83830): Apply password only if changes exist [#5889](https://github.com/openshift/machine-config-operator/pull/5889)
* [AGENT-1514](https://issues.redhat.com/browse/AGENT-1514): Add ML-KEM verification test for IRI registry [#6003](https://github.com/openshift/machine-config-operator/pull/6003)
* [OCPBUGS-84516](https://issues.redhat.com/browse/OCPBUGS-84516): Add `terminationMessagePolicy` to build pod containers [#5993](https://github.com/openshift/machine-config-operator/pull/5993)
* [OCPBUGS-85117](https://issues.redhat.com/browse/OCPBUGS-85117): Fix 2 flakes happening in the ocl test suite [#6004](https://github.com/openshift/machine-config-operator/pull/6004)
* [OCPBUGS-84842](https://issues.redhat.com/browse/OCPBUGS-84842): Bootloader update attempt should be conditional [#5907](https://github.com/openshift/machine-config-operator/pull/5907)
* [OCPBUGS-75894](https://issues.redhat.com/browse/OCPBUGS-75894): use `--delete-if-present` for karg removal [#5914](https://github.com/openshift/machine-config-operator/pull/5914)
* [OCPBUGS-84661](https://issues.redhat.com/browse/OCPBUGS-84661): Fix wrong early exit during kubelet MCs regeneration [#5898](https://github.com/openshift/machine-config-operator/pull/5898)
* [AGENT-1443](https://issues.redhat.com/browse/AGENT-1443): IRI Add certificate regeneration to MCS cert rotation controller [#5721](https://github.com/openshift/machine-config-operator/pull/5721)
* [OCPBUGS-84691](https://issues.redhat.com/browse/OCPBUGS-84691): prom rules: add alert for nodes using runc [#5874](https://github.com/openshift/machine-config-operator/pull/5874)
* [MCO-1908](https://issues.redhat.com/browse/MCO-1908), [MCO-2213](https://issues.redhat.com/browse/MCO-2213): Migrate MCD related MCO test-cases [#5843](https://github.com/openshift/machine-config-operator/pull/5843)
* [OCPBUGS-84867](https://issues.redhat.com/browse/OCPBUGS-84867): Fix OCL test to handle temporarily empty current-machine-os-build annotation [#5913](https://github.com/openshift/machine-config-operator/pull/5913)
* [OCPBUGS-84832](https://issues.redhat.com/browse/OCPBUGS-84832): daemon: don't pull/extract extensions for all OS updates [#5905](https://github.com/openshift/machine-config-operator/pull/5905)
* [OCPBUGS-84852](https://issues.redhat.com/browse/OCPBUGS-84852): Update AMI Whitelist [#5910](https://github.com/openshift/machine-config-operator/pull/5910)
* [OCPBUGS-84150](https://issues.redhat.com/browse/OCPBUGS-84150): MachineOSConfig "build was not found" error [#5878](https://github.com/openshift/machine-config-operator/pull/5878)
* [OCPBUGS-84699](https://issues.redhat.com/browse/OCPBUGS-84699): Custom pool booting must handle matchExpressions in nodeSelector [#5899](https://github.com/openshift/machine-config-operator/pull/5899)
* [OCPBUGS-84565](https://issues.redhat.com/browse/OCPBUGS-84565): Fix CVE-2026-34986 [#5890](https://github.com/openshift/machine-config-operator/pull/5890)
* [OCPBUGS-83871](https://issues.redhat.com/browse/OCPBUGS-83871): Support bootloader update [#5868](https://github.com/openshift/machine-config-operator/pull/5868)
* [OCPBUGS-84332](https://issues.redhat.com/browse/OCPBUGS-84332): Fix ssh and password rollbacks [#5884](https://github.com/openshift/machine-config-operator/pull/5884)
* [MCO-2222](https://issues.redhat.com/browse/MCO-2222): /automate-test skill for generating e2e tests from specifications [#5864](https://github.com/openshift/machine-config-operator/pull/5864)
* [OCPBUGS-84652](https://issues.redhat.com/browse/OCPBUGS-84652): Include RootCA in the temporal CC [#5896](https://github.com/openshift/machine-config-operator/pull/5896)
* [OCPBUGS-83492](https://issues.redhat.com/browse/OCPBUGS-83492): Auto-append :ref suffix to additionalLayerStores in storage.conf [#5888](https://github.com/openshift/machine-config-operator/pull/5888)
* [OCPBUGS-83826](https://issues.redhat.com/browse/OCPBUGS-83826): deploy-from-self when skopeo < 1.22.2 [#5867](https://github.com/openshift/machine-config-operator/pull/5867)
* [OCPBUGS-84490](https://issues.redhat.com/browse/OCPBUGS-84490): Bump image build timeout for status reporting test [#5886](https://github.com/openshift/machine-config-operator/pull/5886)
* [MCO-2201](https://issues.redhat.com/browse/MCO-2201): Improve /migrate-tests skill: default labels and ordering verification [#5879](https://github.com/openshift/machine-config-operator/pull/5879)
* [OCPBUGS-83859](https://issues.redhat.com/browse/OCPBUGS-83859): Fix encapsulated IGN version [#5872](https://github.com/openshift/machine-config-operator/pull/5872)
* [MCO-1494](https://issues.redhat.com/browse/MCO-1494): Remove monolithic e2e-ocl test suite [#5880](https://github.com/openshift/machine-config-operator/pull/5880)
* [AGENT-1449](https://issues.redhat.com/browse/AGENT-1449): Add IRI registry authentication support to MCO [#5765](https://github.com/openshift/machine-config-operator/pull/5765)
* [OCPBUGS-84218](https://issues.redhat.com/browse/OCPBUGS-84218): Fix units rollback if update failure [#5876](https://github.com/openshift/machine-config-operator/pull/5876)
* [OCPBUGS-79425](https://issues.redhat.com/browse/OCPBUGS-79425): improve JSON unmarshalling for secret decoding [#5813](https://github.com/openshift/machine-config-operator/pull/5813)
* [OCPBUGS-83401](https://issues.redhat.com/browse/OCPBUGS-83401): add RootCA cert to the sysContextBuilder certs [#5861](https://github.com/openshift/machine-config-operator/pull/5861)
* [OCPBUGS-82500](https://issues.redhat.com/browse/OCPBUGS-82500): ClusterHostedDNS on AWS/Azure/GCP: Modify Corefile template to better handle empty record types [#5844](https://github.com/openshift/machine-config-operator/pull/5844)
* [MCO-2201](https://issues.redhat.com/browse/MCO-2201): Add Claude /migrate-tests command for MCO test migration [#5837](https://github.com/openshift/machine-config-operator/pull/5837)
* [MCO-1908](https://issues.redhat.com/browse/MCO-1908): Migrate Kernel related MCO test-cases [#5827](https://github.com/openshift/machine-config-operator/pull/5827)
* [OCPBUGS-83539](https://issues.redhat.com/browse/OCPBUGS-83539): Update AMI Whitelist [#5851](https://github.com/openshift/machine-config-operator/pull/5851)
* [OCPBUGS-78524](https://issues.redhat.com/browse/OCPBUGS-78524): Allow enablement of systemd units with existing files [#5846](https://github.com/openshift/machine-config-operator/pull/5846)
* [OCPBUGS-82974](https://issues.redhat.com/browse/OCPBUGS-82974): Make IRI registry read-only via environment variable [#5845](https://github.com/openshift/machine-config-operator/pull/5845)
* [OCPBUGS-81572](https://issues.redhat.com/browse/OCPBUGS-81572): order corosync after OVS configuration on TNF clusters [#5834](https://github.com/openshift/machine-config-operator/pull/5834)
* [OCPBUGS-83517](https://issues.redhat.com/browse/OCPBUGS-83517): Revert ovs increase CPU priority for Open vSwitch Forwarding Unit [#5849](https://github.com/openshift/machine-config-operator/pull/5849)
* [OCPBUGS-63152](https://issues.redhat.com/browse/OCPBUGS-63152): Fail wait-for-node-ip if primary IP(s) disappear [#5350](https://github.com/openshift/machine-config-operator/pull/5350)
* [MCO-2135](https://issues.redhat.com/browse/MCO-2135): Add test for OSStream labeling of Machines, MachineSets, and ControlPaneMachineSets [#5814](https://github.com/openshift/machine-config-operator/pull/5814)
* [AGENT-1307](https://issues.redhat.com/browse/AGENT-1307): add MCD IRI manager [#5807](https://github.com/openshift/machine-config-operator/pull/5807)
* [MCO-2202](https://issues.redhat.com/browse/MCO-2202): separate duplicate PinnedImageSet validation into OCP-88562 [#5839](https://github.com/openshift/machine-config-operator/pull/5839)
* [MCO-2163](https://issues.redhat.com/browse/MCO-2163): adds machine-config-osimagestream installer helper [#5770](https://github.com/openshift/machine-config-operator/pull/5770)
* [OCPBUGS-69936](https://issues.redhat.com/browse/OCPBUGS-69936): ovs: increase CPU priority for Open vSwitch Forwarding Unit [#5797](https://github.com/openshift/machine-config-operator/pull/5797)
* [MCO-1972](https://issues.redhat.com/browse/MCO-1972): Removes OSImageURLConfig from the build controller [#5424](https://github.com/openshift/machine-config-operator/pull/5424)
* Reapply "MCO-2120: Rework OS Image Stream label classification" [#5767](https://github.com/openshift/machine-config-operator/pull/5767)
* [OCPBUGS-68336](https://issues.redhat.com/browse/OCPBUGS-68336): When adding new nodes, MCD executes commands after setting the nodes' state as Done [#5832](https://github.com/openshift/machine-config-operator/pull/5832)
* [AGENT-1416](https://issues.redhat.com/browse/AGENT-1416): Add default NodeDisruptionPolicy for IRI [#5683](https://github.com/openshift/machine-config-operator/pull/5683)
* NO-ISSUE: Fix order of cleanup to further avoid race [#5826](https://github.com/openshift/machine-config-operator/pull/5826)
* [MCO-2183](https://issues.redhat.com/browse/MCO-2183): migrated configdrift, kubeletconfig, containerruntimeconfig… [#5818](https://github.com/openshift/machine-config-operator/pull/5818)
* [OCPBUGS-78154](https://issues.redhat.com/browse/OCPBUGS-78154): Use HA leader election defaults for MCO on SNO [#5764](https://github.com/openshift/machine-config-operator/pull/5764)
* [OCPBUGS-78498](https://issues.redhat.com/browse/OCPBUGS-78498): Update skew error message with doc links [#5825](https://github.com/openshift/machine-config-operator/pull/5825)
* [MCO-2168](https://issues.redhat.com/browse/MCO-2168): Deleting a PinnedImageSet does not affect images pinned by another PinnedImageSet [#5786](https://github.com/openshift/machine-config-operator/pull/5786)
* NO-ISSUE: In extended tests, disable Skew when disabling the bootimag… [#5811](https://github.com/openshift/machine-config-operator/pull/5811)
* [MCO-2171](https://issues.redhat.com/browse/MCO-2171): Move long running boot image tests to MCO's disruptive suites [#5808](https://github.com/openshift/machine-config-operator/pull/5808)
* NO-ISSUE: Fix MCN Applied condition checks for TP and non-TP clusters [#5796](https://github.com/openshift/machine-config-operator/pull/5796)
* [OCPBUGS-80970](https://issues.redhat.com/browse/OCPBUGS-80970): MCS fallback to latest v3 [#5816](https://github.com/openshift/machine-config-operator/pull/5816)
* [AGENT-1366](https://issues.redhat.com/browse/AGENT-1366): Report InternalReleaseImageController errors in IRI status [#5803](https://github.com/openshift/machine-config-operator/pull/5803)
* [OCPBUGS-62619](https://issues.redhat.com/browse/OCPBUGS-62619): Add etcd size limit validation for rendered MachineConfigs [#5729](https://github.com/openshift/machine-config-operator/pull/5729)
* [MCO-2155](https://issues.redhat.com/browse/MCO-2155): Add stream detection to some more boot image tests [#5799](https://github.com/openshift/machine-config-operator/pull/5799)
* [MCO-2167](https://issues.redhat.com/browse/MCO-2167): Migrate alert test cases from the private repository [#5781](https://github.com/openshift/machine-config-operator/pull/5781)
* [OCPBUGS-78500](https://issues.redhat.com/browse/OCPBUGS-78500): Skew enforcement should dynamically handle baremetal clusters [#5768](https://github.com/openshift/machine-config-operator/pull/5768)
* [OCPBUGS-79088](https://issues.redhat.com/browse/OCPBUGS-79088): OCPBUGS-79357: Skip boot image updates until cluster is stable [#5789](https://github.com/openshift/machine-config-operator/pull/5789)
* [OCPBUGS-79361](https://issues.redhat.com/browse/OCPBUGS-79361): Update AMI Whitelist [#5788](https://github.com/openshift/machine-config-operator/pull/5788)
* NO-ISSUE: Update AMI collection script for installer changes [#5790](https://github.com/openshift/machine-config-operator/pull/5790)
* [OCPBUGS-75200](https://issues.redhat.com/browse/OCPBUGS-75200): set default-timeout-stop to 200s globally [#5782](https://github.com/openshift/machine-config-operator/pull/5782)
* [MCO-2155](https://issues.redhat.com/browse/MCO-2155): Add stream detection to boot image tests [#5784](https://github.com/openshift/machine-config-operator/pull/5784)
* NO-ISSUE: Revert "extract oc binary from base OS image after build" [#5785](https://github.com/openshift/machine-config-operator/pull/5785)
* [OCPBUGS-66104](https://issues.redhat.com/browse/OCPBUGS-66104): Fine tune CoreDNS pod configuration to improve performance [#5695](https://github.com/openshift/machine-config-operator/pull/5695)
* [MCO-2117](https://issues.redhat.com/browse/MCO-2117): Allow default OSImageStream overrides [#5714](https://github.com/openshift/machine-config-operator/pull/5714)
* [OCPBUGS-78595](https://issues.redhat.com/browse/OCPBUGS-78595): Fix log substring matching for disruptive test suite jobs [#5769](https://github.com/openshift/machine-config-operator/pull/5769)
* [OCPBUGS-74223](https://issues.redhat.com/browse/OCPBUGS-74223): Re-order logger setting to eliminate race condition [#5691](https://github.com/openshift/machine-config-operator/pull/5691)
* [MCO-2146](https://issues.redhat.com/browse/MCO-2146): do not use OSImageStream in Hypershift [#5750](https://github.com/openshift/machine-config-operator/pull/5750)
* NO-ISSUE: always build golangci-lint from vendor [#5772](https://github.com/openshift/machine-config-operator/pull/5772)
* [OCPNODE-3201](https://issues.redhat.com/browse/OCPNODE-3201): Default Enablement of system-reserved-compressible in OpenShift [#5408](https://github.com/openshift/machine-config-operator/pull/5408)
* [OCPNODE-3880](https://issues.redhat.com/browse/OCPNODE-3880): Add criocredentialproviderconfig event handler [#5487](https://github.com/openshift/machine-config-operator/pull/5487)
* [OCPNODE-4074](https://issues.redhat.com/browse/OCPNODE-4074): Add additional storage configuration support for CRI-O [#5666](https://github.com/openshift/machine-config-operator/pull/5666)
* NO-ISSUE: Increase timeout + interval for OCL test cleanup [#5732](https://github.com/openshift/machine-config-operator/pull/5732)
* [MCO-2151](https://issues.redhat.com/browse/MCO-2151): Add stream detection to the boot image controller [#5752](https://github.com/openshift/machine-config-operator/pull/5752)
* NO-ISSUE: Allow setting kubeletconfig log level to zero [#5757](https://github.com/openshift/machine-config-operator/pull/5757)
* [OCPBUGS-57473](https://issues.redhat.com/browse/OCPBUGS-57473): extract oc binary instead of pulling OS image [#5313](https://github.com/openshift/machine-config-operator/pull/5313)
* [OCPBUGS-78107](https://issues.redhat.com/browse/OCPBUGS-78107): Disable sandboxed-containers in arm64 10 [#5754](https://github.com/openshift/machine-config-operator/pull/5754)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/5f0d9d7cb472e9aa565bd1e2b0f71f875677de3d...62b06d28399b348cb7238d32ad74b9a978c4292f)
### [machine-image-customization-controller](https://github.com/openshift/image-customization-controller/tree/37733b7432b49de8c477367ba087c938913895e4)
* [METAL-1730](https://issues.redhat.com/browse/METAL-1730): Add stream selection for multi-version support [#175](https://github.com/openshift/image-customization-controller/pull/175)
* [METAL-1720](https://issues.redhat.com/browse/METAL-1720): Add kernel file support for multi-architecture PXE boot [#170](https://github.com/openshift/image-customization-controller/pull/170)
* [Full changelog](https://github.com/openshift/image-customization-controller/compare/eacc65f2ff39a62ac3d229d684b634c7e44acf5f...37733b7432b49de8c477367ba087c938913895e4)
### [machine-os-images](https://github.com/openshift/machine-os-images/tree/a8b4286c6b557f5278d62838917872bafbec10d9)
* [METAL-1730](https://issues.redhat.com/browse/METAL-1730): Add stream symlinks for multi-stream support [#83](https://github.com/openshift/machine-os-images/pull/83)
* [OCPBUGS-85476](https://issues.redhat.com/browse/OCPBUGS-85476): Force rebuild for OCP 5.0 [#87](https://github.com/openshift/machine-os-images/pull/87)
* [METAL-1786](https://issues.redhat.com/browse/METAL-1786): Include RHEL10 in image [#82](https://github.com/openshift/machine-os-images/pull/82)
* [METAL-1729](https://issues.redhat.com/browse/METAL-1729): Add dual CoreOS version support for RHCOS 9 and 10 [#81](https://github.com/openshift/machine-os-images/pull/81)
* [Full changelog](https://github.com/openshift/machine-os-images/compare/d819e02d984741ffb8f150b4d909d5f874e75935...a8b4286c6b557f5278d62838917872bafbec10d9)
### [metallb-frr](https://github.com/openshift/frr/tree/99c313cdedbad293f51a5665587dc4dab450cc28)
* [OCPBUGS-85711](https://issues.redhat.com/browse/OCPBUGS-85711): Sync 2026-05-27 [#132](https://github.com/openshift/frr/pull/132)
* Bump to frr 10 [#127](https://github.com/openshift/frr/pull/127)
* [OCPBUGS-82973](https://issues.redhat.com/browse/OCPBUGS-82973): Sync 25-3-2026 [#128](https://github.com/openshift/frr/pull/128)
* [Full changelog](https://github.com/openshift/frr/compare/5ccdd521dd93522575c172dac86d0b6f301fb3ef...99c313cdedbad293f51a5665587dc4dab450cc28)
### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/78b916b2c4f26304ae09842b51f339d0e756a5e7)
* [OBSINTA-1358](https://issues.redhat.com/browse/OBSINTA-1358): add operator-sdk to Cypress test runner image [#966](https://github.com/openshift/monitoring-plugin/pull/966)
* [OU-1399](https://issues.redhat.com/browse/OU-1399): pass ISO string to Timestamp component for valid date rendering [#968](https://github.com/openshift/monitoring-plugin/pull/968)
* [OU-1275](https://issues.redhat.com/browse/OU-1275): remove byte order mark from dashboard text [#960](https://github.com/openshift/monitoring-plugin/pull/960)
* [COO-1776](https://issues.redhat.com/browse/COO-1776): fix: throw error for unsupported dashboard level datasources [#948](https://github.com/openshift/monitoring-plugin/pull/948)
* [OU-1269](https://issues.redhat.com/browse/OU-1269): Update monitoring-console-plugin for 4.22 [#923](https://github.com/openshift/monitoring-plugin/pull/923)
* [OU-1281](https://issues.redhat.com/browse/OU-1281): show disabled project bar while loading [#936](https://github.com/openshift/monitoring-plugin/pull/936)
* [OU-1351](https://issues.redhat.com/browse/OU-1351): prevent namespace and project desync [#933](https://github.com/openshift/monitoring-plugin/pull/933)
* [OU-1315](https://issues.redhat.com/browse/OU-1315): reset queries when namespace changes in dev perspective [#932](https://github.com/openshift/monitoring-plugin/pull/932)
* [OU-1348](https://issues.redhat.com/browse/OU-1348): fix: panel actions index so they are visible on click [#928](https://github.com/openshift/monitoring-plugin/pull/928)
* [OU-1347](https://issues.redhat.com/browse/OU-1347): fix: avoid throwing error to fallback to global datasource [#920](https://github.com/openshift/monitoring-plugin/pull/920)
* [OU-1203](https://issues.redhat.com/browse/OU-1203): upgrade perses dependencies [#914](https://github.com/openshift/monitoring-plugin/pull/914)
* NO-JIRA: Revert "NO-JIRA: Bump to 4.22.0-prerelease.3 SDK" [#915](https://github.com/openshift/monitoring-plugin/pull/915)
* NO-JIRA: Bump to 4.22.0-prerelease.3 SDK [#903](https://github.com/openshift/monitoring-plugin/pull/903)
* [OU-1323](https://issues.redhat.com/browse/OU-1323): Refactor dashboards state to prevent desync [#912](https://github.com/openshift/monitoring-plugin/pull/912)
* [OU-1341](https://issues.redhat.com/browse/OU-1341): pass label values to the filter [#913](https://github.com/openshift/monitoring-plugin/pull/913)
* [OU-1091](https://issues.redhat.com/browse/OU-1091): swap monitoring-plugin to use DataView [#911](https://github.com/openshift/monitoring-plugin/pull/911)
* NO-JIRA: update perses and fix vulnerable dependencies [#900](https://github.com/openshift/monitoring-plugin/pull/900)
* [TRACING-6030](https://issues.redhat.com/browse/TRACING-6030): add RouterProvider to support links in Panels [#891](https://github.com/openshift/monitoring-plugin/pull/891)
* [OU-1217](https://issues.redhat.com/browse/OU-1217): perses customizable dashboards with perses global datasources for tempo and loki [#877](https://github.com/openshift/monitoring-plugin/pull/877)
* [OU-1307](https://issues.redhat.com/browse/OU-1307): don't fight console to setActiveNamespace [#880](https://github.com/openshift/monitoring-plugin/pull/880)
* NO-JIRA: re-enable get CSRF token [#876](https://github.com/openshift/monitoring-plugin/pull/876)
* [OU-1264](https://issues.redhat.com/browse/OU-1264): mcpToolUI basic implementation for OpenShift Lightpseed + obs-mcp + Perses [#797](https://github.com/openshift/monitoring-plugin/pull/797)
* NO-JIRA: breaking changes follow up [#875](https://github.com/openshift/monitoring-plugin/pull/875)
* [OU-1175](https://issues.redhat.com/browse/OU-1175): OCP 4.22 Breaking Changes [#863](https://github.com/openshift/monitoring-plugin/pull/863)
* [OCPBUGS-81567](https://issues.redhat.com/browse/OCPBUGS-81567): fix: re encode params when redirecting from graph to query-browser [#869](https://github.com/openshift/monitoring-plugin/pull/869)
* [OU-1184](https://issues.redhat.com/browse/OU-1184): lint enabled against cypress files and changes post coo [#862](https://github.com/openshift/monitoring-plugin/pull/862)
* NO-JIRA: automation testing fix on podImage [#868](https://github.com/openshift/monitoring-plugin/pull/868)
* NO-JIRA: exclude @xfail tests from CI incident commands [#865](https://github.com/openshift/monitoring-plugin/pull/865)
* [OBSINTA-1002](https://issues.redhat.com/browse/OBSINTA-1002): consolidate COO 1.4.0 test case documentation [#793](https://github.com/openshift/monitoring-plugin/pull/793)
* NO-JIRA: podImage fix automation testing to remove extra click [#864](https://github.com/openshift/monitoring-plugin/pull/864)
* [OBSINTA-993](https://issues.redhat.com/browse/OBSINTA-993): Tests for incident detection coo 1.4.0 changes [#857](https://github.com/openshift/monitoring-plugin/pull/857)
* [OCPBUGS-77113](https://issues.redhat.com/browse/OCPBUGS-77113): feat: re enable dev console views [#831](https://github.com/openshift/monitoring-plugin/pull/831)
* NO-JIRA: Incident Detection Tests Stabilization [#854](https://github.com/openshift/monitoring-plugin/pull/854)
* NO-JIRA: switch to core platform page before test case run [#837](https://github.com/openshift/monitoring-plugin/pull/837)
* NO-JIRA: Refactor cypress setup and operator commands [#788](https://github.com/openshift/monitoring-plugin/pull/788)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/62a22c11ca2f78c94fd8c1cbc8ebedff3d439d9b...78b916b2c4f26304ae09842b51f339d0e756a5e7)
### [multus-admission-controller](https://github.com/openshift/multus-admission-controller/tree/12d99f3f29fe38f900d0c6400889e3d58c588f45)
* [OCPBUGS-85053](https://issues.redhat.com/browse/OCPBUGS-85053): Bump Go version to 1.25.0 for ML-KEM/PQC support [#115](https://github.com/openshift/multus-admission-controller/pull/115)
* [Full changelog](https://github.com/openshift/multus-admission-controller/compare/16ba7ef8026f5b6d0d08b19c707648d82b1ac592...12d99f3f29fe38f900d0c6400889e3d58c588f45)
### [multus-cni, multus-cni-microshift](https://github.com/openshift/multus-cni/tree/b4ec7d8239ce4bd3ed949bce9816a013377b44c7)
* [CORENET-6886](https://issues.redhat.com/browse/CORENET-6886): downstream sync to kube 1.35 and go to 1.25 [#281](https://github.com/openshift/multus-cni/pull/281)
* [OKD-322](https://issues.redhat.com/browse/OKD-322): Update Dockerfile to work on CentOS/RHEL 10 [#275](https://github.com/openshift/multus-cni/pull/275)
* [Full changelog](https://github.com/openshift/multus-cni/compare/0d343fe11a824b6f5a44571ae0e079e6ed7627a7...b4ec7d8239ce4bd3ed949bce9816a013377b44c7)
### [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy/tree/932bdaa4250d0a1db41a1a1fcac8192f2757211c)
* [OCPBUGS-87264](https://issues.redhat.com/browse/OCPBUGS-87264): Updating ose-multus-networkpolicy-container image to be consistent with ART for 5.0 [#117](https://github.com/openshift/multus-networkpolicy/pull/117)
* [CNF-21001](https://issues.redhat.com/browse/CNF-21001): Remove iptables compatibility commits [#108](https://github.com/openshift/multus-networkpolicy/pull/108)
* [Full changelog](https://github.com/openshift/multus-networkpolicy/compare/834a093f693e521b8dc4ec7168d03cfba2c1cba1...932bdaa4250d0a1db41a1a1fcac8192f2757211c)
### [must-gather](https://github.com/openshift/must-gather/tree/37e5da519790dfb004d014ee00a26252b2294e41)
* no-jira: collect OS Image Stream resource [#533](https://github.com/openshift/must-gather/pull/533)
* [CNV-41714](https://issues.redhat.com/browse/CNV-41714): Add a collector for basic virt related data [#539](https://github.com/openshift/must-gather/pull/539)
* no-jira: chore: address the linting issues in the scripts [#525](https://github.com/openshift/must-gather/pull/525)
* [MG-246](https://issues.redhat.com/browse/MG-246): remove redundant oc inspect command and unused resources [#537](https://github.com/openshift/must-gather/pull/537)
* [MG-241](https://issues.redhat.com/browse/MG-241): Adding support for skipping rotated logs [#536](https://github.com/openshift/must-gather/pull/536)
* no-jira: build(make): default podman flags for ART DNF wrapper [#535](https://github.com/openshift/must-gather/pull/535)
* no-jira: docs: add proposal for e2e [#526](https://github.com/openshift/must-gather/pull/526)
* [RFE-8344](https://issues.redhat.com/browse/RFE-8344): Add Node Feature Discovery Operator collection script [#508](https://github.com/openshift/must-gather/pull/508)
* [RFE-8932](https://issues.redhat.com/browse/RFE-8932): Included object size with the object count [#527](https://github.com/openshift/must-gather/pull/527)
* [Full changelog](https://github.com/openshift/must-gather/compare/d7db85b9511a580691a2c894536dcb838d9f84a3...37e5da519790dfb004d014ee00a26252b2294e41)
### [network-interface-bond-cni](https://github.com/openshift/bond-cni/tree/2e9f050e81a02305f56698b19c249d4d03330dfd)
* NO-JIRA: Sync upstream k8snetworkplumbingwg/master (2026-05-19) [#117](https://github.com/openshift/bond-cni/pull/117)
* NO-JIRA: Openshift Only - update owners file [#111](https://github.com/openshift/bond-cni/pull/111)
* NO-JIRA: Fix diverged git histories via upstream merge [#108](https://github.com/openshift/bond-cni/pull/108)
* [Full changelog](https://github.com/openshift/bond-cni/compare/297eeb4320e07b18d559bc373b665479c760e8c7...2e9f050e81a02305f56698b19c249d4d03330dfd)
### [network-tools](https://github.com/openshift/network-tools/tree/b05fd6281beaad05e7de1f95b506679ca53d2b49)
* NO-JIRA: Add new member [#179](https://github.com/openshift/network-tools/pull/179)
* NO-ISSUE: Add myself back to the bug script [#177](https://github.com/openshift/network-tools/pull/177)
* NO-JIRA: Add mattedallo, marty-power, taanyas as reviewers [#172](https://github.com/openshift/network-tools/pull/172)
* NO-JIRA: Refresh list of team members [#176](https://github.com/openshift/network-tools/pull/176)
* NO-JIRA: Updates to handle changes after migrating to Atlasian cloud [#174](https://github.com/openshift/network-tools/pull/174)
* NO-JIRA: Image slimming [#154](https://github.com/openshift/network-tools/pull/154)
* [Full changelog](https://github.com/openshift/network-tools/compare/a6bcd3cdaf956beec70e6edde2160625d8e8f817...b05fd6281beaad05e7de1f95b506679ca53d2b49)
### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/f5d4e5c5a572e1fa9f289f94b8798c3fe9de65b4)
* [OCPBUGS-81271](https://issues.redhat.com/browse/OCPBUGS-81271): Trim subnet input in UDN creation form [#425](https://github.com/openshift/networking-console-plugin/pull/425)
* [OCPBUGS-54248](https://issues.redhat.com/browse/OCPBUGS-54248): Fix empty state Create button links [#423](https://github.com/openshift/networking-console-plugin/pull/423)
* [CNV-61064](https://issues.redhat.com/browse/CNV-61064): [UDN] Add condition column to the list page [#421](https://github.com/openshift/networking-console-plugin/pull/421)
* Align PatternFly dependencies with resolutions in Console main branch [#420](https://github.com/openshift/networking-console-plugin/pull/420)
* [CONSOLE-5218](https://issues.redhat.com/browse/CONSOLE-5218): Add project documentation and rewrite README [#417](https://github.com/openshift/networking-console-plugin/pull/417)
* [CNV-74110](https://issues.redhat.com/browse/CNV-74110): new translations [#404](https://github.com/openshift/networking-console-plugin/pull/404)
* Update dependencies for upcoming Console 4.22 release [#371](https://github.com/openshift/networking-console-plugin/pull/371)
* [OCPBUGS-83638](https://issues.redhat.com/browse/OCPBUGS-83638): CVE dependency remediation [#379](https://github.com/openshift/networking-console-plugin/pull/379)
* Bump lodash from 4.17.23 to 4.18.1 [#366](https://github.com/openshift/networking-console-plugin/pull/366)
* [OCPBUGS-70285](https://issues.redhat.com/browse/OCPBUGS-70285): Upgrade cypress to v15 to fix CVEs [#345](https://github.com/openshift/networking-console-plugin/pull/345)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/f9c8030dbcdf76e3556e803d34828a120e2eb407...f5d4e5c5a572e1fa9f289f94b8798c3fe9de65b4)
### [nutanix-cloud-controller-manager](https://github.com/openshift/cloud-provider-nutanix/tree/61ec60465b92969966bc4b19637cdda75fb3105a)
* NO-JIRA: Update OWNERS [#61](https://github.com/openshift/cloud-provider-nutanix/pull/61)
* [OCPCLOUD-3272](https://issues.redhat.com/browse/OCPCLOUD-3272): Merge https://github.com/nutanix-cloud-native/cloud-provider-nutanix:main (9c374cb) into main [#54](https://github.com/openshift/cloud-provider-nutanix/pull/54)
* [Full changelog](https://github.com/openshift/cloud-provider-nutanix/compare/ecf52c516afe46f6462e6162266c7e934ec9b29c...61ec60465b92969966bc4b19637cdda75fb3105a)
### [nutanix-machine-controllers](https://github.com/openshift/machine-api-provider-nutanix/tree/246b53bfc7bb59f3cf1e708c7858f12934a5ddbd)
* NO-JIRA: Update OWNERS [#136](https://github.com/openshift/machine-api-provider-nutanix/pull/136)
* [OCPCLOUD-3277](https://issues.redhat.com/browse/OCPCLOUD-3277): Bump k8s 1.35 [#134](https://github.com/openshift/machine-api-provider-nutanix/pull/134)
* [Full changelog](https://github.com/openshift/machine-api-provider-nutanix/compare/e00a719f35cc4ec04441cbe883b01db3377144e4...246b53bfc7bb59f3cf1e708c7858f12934a5ddbd)
### [oauth-apiserver](https://github.com/openshift/oauth-apiserver/tree/97a820bd5412c2d3bb22f083152107ef41631c8c)
* [CNTRLPLANE-2518](https://issues.redhat.com/browse/CNTRLPLANE-2518): Add support for sourcing external claims from a source that requires client credential authentication [#197](https://github.com/openshift/oauth-apiserver/pull/197)
* [CNTRLPLANE-2516](https://issues.redhat.com/browse/CNTRLPLANE-2516): feat: externaloidc: add support for externally sourcing claims [#195](https://github.com/openshift/oauth-apiserver/pull/195)
* [CNTRLPLANE-2516](https://issues.redhat.com/browse/CNTRLPLANE-2516): Add local configuration API for external oidc mode [#194](https://github.com/openshift/oauth-apiserver/pull/194)
* NO-JIRA: Add control-plane-approvers to OWNERS [#192](https://github.com/openshift/oauth-apiserver/pull/192)
* [CNTRLPLANE-3226](https://issues.redhat.com/browse/CNTRLPLANE-3226): chore: sync with openshift repositories [#189](https://github.com/openshift/oauth-apiserver/pull/189)
* [CNTRLPLANE-2989](https://issues.redhat.com/browse/CNTRLPLANE-2989): feat: add external-oidc subcommand to oauth-apiserver [#181](https://github.com/openshift/oauth-apiserver/pull/181)
* [CNTRLPLANE-2260](https://issues.redhat.com/browse/CNTRLPLANE-2260): cmd: wire up OTE ginkgo suite for tokenreviews [#163](https://github.com/openshift/oauth-apiserver/pull/163)
* [Full changelog](https://github.com/openshift/oauth-apiserver/compare/467c63180c69eb57c57f456a09e839c9d8c1f480...97a820bd5412c2d3bb22f083152107ef41631c8c)
### [oauth-proxy](https://github.com/openshift/oauth-proxy/tree/fa27a041c546f80152f1bb0deec777e406f38f87)
* [OCPBUGS-69836](https://issues.redhat.com/browse/OCPBUGS-69836): Updating golang-github-openshift-oauth-proxy-container image to be consistent with ART for 4.22 [#341](https://github.com/openshift/oauth-proxy/pull/341)
* [Full changelog](https://github.com/openshift/oauth-proxy/compare/714292f5478e6c12da6a31710f72bc8fbe6fb925...fa27a041c546f80152f1bb0deec777e406f38f87)
### [oauth-server](https://github.com/openshift/oauth-server/tree/f892602b822782e0080abc70c6cd1d178f11e684)
* NO-JIRA: Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 [#232](https://github.com/openshift/oauth-server/pull/232)
* [CNTRLPLANE-3226](https://issues.redhat.com/browse/CNTRLPLANE-3226): chore: sync with openshift repositories [#221](https://github.com/openshift/oauth-server/pull/221)
* [Full changelog](https://github.com/openshift/oauth-server/compare/69bdf8bc63e094815d07aa16fc2537df5c045489...f892602b822782e0080abc70c6cd1d178f11e684)
### [oc-mirror](https://github.com/openshift/oc-mirror/tree/cd8e7ece819a933b2735d7d10fbbe3729daa17d8)
* [CLID-621](https://issues.redhat.com/browse/CLID-621): simplify test catalog building [#1420](https://github.com/openshift/oc-mirror/pull/1420)
* [CLID-655](https://issues.redhat.com/browse/CLID-655): Add test for incremental mirroring using archives by date [#1416](https://github.com/openshift/oc-mirror/pull/1416)
* [CLID-625](https://issues.redhat.com/browse/CLID-625), [CLID-626](https://issues.redhat.com/browse/CLID-626): Tests for --parallel-images and --parallel-layers flags [#1415](https://github.com/openshift/oc-mirror/pull/1415)
* [CLID-647](https://issues.redhat.com/browse/CLID-647): Add testing docs and skills [#1422](https://github.com/openshift/oc-mirror/pull/1422)
* [OCPBUGS-86264](https://issues.redhat.com/browse/OCPBUGS-86264): Upgrade go-jose to v4.1.4 to fix CVE-2026-34986 [#1414](https://github.com/openshift/oc-mirror/pull/1414)
* [CLID-579](https://issues.redhat.com/browse/CLID-579): Validate BlockedImage regex [#1401](https://github.com/openshift/oc-mirror/pull/1401)
* [OCPBUGS-64640](https://issues.redhat.com/browse/OCPBUGS-64640): remove environment setup output [#1384](https://github.com/openshift/oc-mirror/pull/1384)
* [CLID-623](https://issues.redhat.com/browse/CLID-623): Encapsulate unit test data into tests/unit [#1407](https://github.com/openshift/oc-mirror/pull/1407)
* [CLID-479](https://issues.redhat.com/browse/CLID-479): OTE migration [#1375](https://github.com/openshift/oc-mirror/pull/1375)
* NO-JIRA: Update README.md for Enclave Support link [#1404](https://github.com/openshift/oc-mirror/pull/1404)
* [CLID-612](https://issues.redhat.com/browse/CLID-612): Move integration tests within oc-mirror [#1400](https://github.com/openshift/oc-mirror/pull/1400)
* [CLID-592](https://issues.redhat.com/browse/CLID-592): pkg/cli: add unit tests for environment setup [#1391](https://github.com/openshift/oc-mirror/pull/1391)
* [CLID-532](https://issues.redhat.com/browse/CLID-532): Separate Image struct into AdditionalImage, BlockedImage, SampleImage [#1372](https://github.com/openshift/oc-mirror/pull/1372)
* [OCPBUGS-62603](https://issues.redhat.com/browse/OCPBUGS-62603): Fix printing collection messages with 0 collection items [#1385](https://github.com/openshift/oc-mirror/pull/1385)
* [OCPBUGS-61136](https://issues.redhat.com/browse/OCPBUGS-61136): Only print catalog rebuild message if there are catalo… [#1386](https://github.com/openshift/oc-mirror/pull/1386)
* [CLID-524](https://issues.redhat.com/browse/CLID-524): additionalImages collector error handling [#1343](https://github.com/openshift/oc-mirror/pull/1343)
* [CLID-535](https://issues.redhat.com/browse/CLID-535): api: use OCI definitions from opencontainers spec [#1341](https://github.com/openshift/oc-mirror/pull/1341)
* [CLID-547](https://issues.redhat.com/browse/CLID-547): v2: add `list releases` command [#1373](https://github.com/openshift/oc-mirror/pull/1373)
* [CLID-540](https://issues.redhat.com/browse/CLID-540): v2: add `list operators` command [#1370](https://github.com/openshift/oc-mirror/pull/1370)
* NO-JIRA: Group dependabot updates by package origin [#1336](https://github.com/openshift/oc-mirror/pull/1336)
* no-jira: lint: Remove golangci-lint v1 config. [#1374](https://github.com/openshift/oc-mirror/pull/1374)
* [OCPBUGS-77146](https://issues.redhat.com/browse/OCPBUGS-77146): Remove status field from CatalogSource, ClusterCatalog… [#1369](https://github.com/openshift/oc-mirror/pull/1369)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/516a503976fb75b74c8234b4afa8115e61413d88...cd8e7ece819a933b2735d7d10fbbe3729daa17d8)
### [olm-catalogd, olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller/tree/9fe71d5548bb4a1b1a8ce0c02b3c2a74dded0c59)
* [OPRUN-4637](https://issues.redhat.com/browse/OPRUN-4637): Update dockerfiles to use golang-1.26-release-4.23 builders [#746](https://github.com/openshift/operator-framework-operator-controller/pull/746)
* NO-ISSUE: Synchronize From Upstream Repositories [#741](https://github.com/openshift/operator-framework-operator-controller/pull/741)
* [OPRUN-4571](https://issues.redhat.com/browse/OPRUN-4571): add OLMv1 topology-based deployment scaling e2e test [#737](https://github.com/openshift/operator-framework-operator-controller/pull/737)
* [OPRUN-4625](https://issues.redhat.com/browse/OPRUN-4625): Synchronize from Upstream Repositories [#738](https://github.com/openshift/operator-framework-operator-controller/pull/738)
* [OPRUN-4617](https://issues.redhat.com/browse/OPRUN-4617): Update readme Default Catalog Tests [#739](https://github.com/openshift/operator-framework-operator-controller/pull/739)
* [OPRUN-4607](https://issues.redhat.com/browse/OPRUN-4607): Remove test-experimenal-e2e [#732](https://github.com/openshift/operator-framework-operator-controller/pull/732)
* NO-ISSUE: Synchronize From Upstream Repositories [#733](https://github.com/openshift/operator-framework-operator-controller/pull/733)
* NO-ISSUE: Synchronize From Upstream Repositories [#730](https://github.com/openshift/operator-framework-operator-controller/pull/730)
* [OPRUN-4608](https://issues.redhat.com/browse/OPRUN-4608): UPSTREAM: <carry>: Delete openshift/registry.Dockerfile [#729](https://github.com/openshift/operator-framework-operator-controller/pull/729)
* NO-ISSUE: Synchronize From Upstream Repositories [#726](https://github.com/openshift/operator-framework-operator-controller/pull/726)
* [OPRUN-4607](https://issues.redhat.com/browse/OPRUN-4607): Fix flags passed to test-experimental-e2e [#723](https://github.com/openshift/operator-framework-operator-controller/pull/723)
* [OCPBUGS-85508](https://issues.redhat.com/browse/OCPBUGS-85508): Synchronize From Upstream Repositories [#725](https://github.com/openshift/operator-framework-operator-controller/pull/725)
* NO-ISSUE: Synchronize From Upstream Repositories [#724](https://github.com/openshift/operator-framework-operator-controller/pull/724)
* NO-ISSUE: Synchronize From Upstream Repositories [#722](https://github.com/openshift/operator-framework-operator-controller/pull/722)
* [OCPBUGS-62517](https://issues.redhat.com/browse/OCPBUGS-62517): Set replicas=1, PDB, and pod anti-affinity for HA topology [#709](https://github.com/openshift/operator-framework-operator-controller/pull/709)
* [OCPBUGS-84943](https://issues.redhat.com/browse/OCPBUGS-84943): fix(test): drop blocking namespace-deletion wait between both-watch-modes scenarios [#712](https://github.com/openshift/operator-framework-operator-controller/pull/712)
* [OCPBUGS-62517](https://issues.redhat.com/browse/OCPBUGS-62517): Synchronize from Upstream Repositories [#710](https://github.com/openshift/operator-framework-operator-controller/pull/710)
* NO-ISSUE: UPSTREAM: <carry>: remove dead e2e registry push job and related variables [#711](https://github.com/openshift/operator-framework-operator-controller/pull/711)
* [OPRUN-4587](https://issues.redhat.com/browse/OPRUN-4587): Make OTE local output easier to read [#704](https://github.com/openshift/operator-framework-operator-controller/pull/704)
* NO-ISSUE: Synchronize From Upstream Repositories [#707](https://github.com/openshift/operator-framework-operator-controller/pull/707)
* NO-ISSUE: Synchronize From Upstream Repositories [#706](https://github.com/openshift/operator-framework-operator-controller/pull/706)
* NO-ISSUE: Synchronize From Upstream Repositories [#701](https://github.com/openshift/operator-framework-operator-controller/pull/701)
* [OPRUN-4574](https://issues.redhat.com/browse/OPRUN-4574): UPSTREAM: <carry>: Disable upstream TLSProfile tests [#702](https://github.com/openshift/operator-framework-operator-controller/pull/702)
* [OPRUN-4577](https://issues.redhat.com/browse/OPRUN-4577): OTE: Simplify by remove option to configure tests to run outside of OCP [#703](https://github.com/openshift/operator-framework-operator-controller/pull/703)
* [OPRUN-4572](https://issues.redhat.com/browse/OPRUN-4572): Expand OTE docs with more comprehensive details [#697](https://github.com/openshift/operator-framework-operator-controller/pull/697)
* [OCPBUGS-77972](https://issues.redhat.com/browse/OCPBUGS-77972), [OCPBUGS-81452](https://issues.redhat.com/browse/OCPBUGS-81452): Synchronize From Upstream Repositories [#696](https://github.com/openshift/operator-framework-operator-controller/pull/696)
* [OPRUN-4546](https://issues.redhat.com/browse/OPRUN-4546): Fix boxcutter finalizer ResourceNames in preflight test [#695](https://github.com/openshift/operator-framework-operator-controller/pull/695)
* NO-ISSUE: Synchronize From Upstream Repositories [#694](https://github.com/openshift/operator-framework-operator-controller/pull/694)
* NO-ISSUE: Synchronize From Upstream Repositories [#693](https://github.com/openshift/operator-framework-operator-controller/pull/693)
* [OCPQE-31553](https://issues.redhat.com/browse/OCPQE-31553): Test empty affinity erasure and cleanup [#689](https://github.com/openshift/operator-framework-operator-controller/pull/689)
* NO-ISSUE: Synchronize From Upstream Repositories [#692](https://github.com/openshift/operator-framework-operator-controller/pull/692)
* [OPRUN-4518](https://issues.redhat.com/browse/OPRUN-4518): Remove skip for incompatible operator check after rename of CER [#690](https://github.com/openshift/operator-framework-operator-controller/pull/690)
* [OCPBUGS-60693](https://issues.redhat.com/browse/OCPBUGS-60693), [OCPBUGS-60958](https://issues.redhat.com/browse/OCPBUGS-60958): Synchronize From Upstream Repositories [#691](https://github.com/openshift/operator-framework-operator-controller/pull/691)
* [OPRUN-4426](https://issues.redhat.com/browse/OPRUN-4426): add ocp-87557 [#635](https://github.com/openshift/operator-framework-operator-controller/pull/635)
* [OCPQE-31553](https://issues.redhat.com/browse/OCPQE-31553): update preflight permission case [#686](https://github.com/openshift/operator-framework-operator-controller/pull/686)
* NO-ISSUE: Add fgiudici as reviewer [#681](https://github.com/openshift/operator-framework-operator-controller/pull/681)
* [OCPBUGS-78211](https://issues.redhat.com/browse/OCPBUGS-78211), [OCPBUGS-78455](https://issues.redhat.com/browse/OCPBUGS-78455): Synchronize From Upstream Repositories [#682](https://github.com/openshift/operator-framework-operator-controller/pull/682)
* NO-ISSUE: Add long-duration test script and documents [#664](https://github.com/openshift/operator-framework-operator-controller/pull/664)
* [OCPBUGS-81194](https://issues.redhat.com/browse/OCPBUGS-81194): Update grpc in default-catalog-consistency tests [#679](https://github.com/openshift/operator-framework-operator-controller/pull/679)
* [OCPBUGS-78092](https://issues.redhat.com/browse/OCPBUGS-78092), [OCPBUGS-78311](https://issues.redhat.com/browse/OCPBUGS-78311): Synchronize From Upstream Repositories [#677](https://github.com/openshift/operator-framework-operator-controller/pull/677)
* [OPRUN-4063](https://issues.redhat.com/browse/OPRUN-4063): verify volume/volumeMount override [#678](https://github.com/openshift/operator-framework-operator-controller/pull/678)
* [OCPBUGS-78999](https://issues.redhat.com/browse/OCPBUGS-78999): Update quay-operator bundle version in OTE to fix missing arch [#673](https://github.com/openshift/operator-framework-operator-controller/pull/673)
* [OCPQE-31636](https://issues.redhat.com/browse/OCPQE-31636): enhance QE cases [#666](https://github.com/openshift/operator-framework-operator-controller/pull/666)
* [OCPBUGS-76380](https://issues.redhat.com/browse/OCPBUGS-76380): Synchronize From Upstream Repositories [#676](https://github.com/openshift/operator-framework-operator-controller/pull/676)
* [OPRUN-4228](https://issues.redhat.com/browse/OPRUN-4228): Add boxcutter tests [#672](https://github.com/openshift/operator-framework-operator-controller/pull/672)
* [OPRUN-4468](https://issues.redhat.com/browse/OPRUN-4468): Add OTE tests for OLMv1 DeploymentConfig support [#662](https://github.com/openshift/operator-framework-operator-controller/pull/662)
* [OCPBUGS-78787](https://issues.redhat.com/browse/OCPBUGS-78787): Synchronize from upstream [#670](https://github.com/openshift/operator-framework-operator-controller/pull/670)
* [OCPBUGS-65634](https://issues.redhat.com/browse/OCPBUGS-65634): UPSTREAM: <carry>: add service account to curl job [#653](https://github.com/openshift/operator-framework-operator-controller/pull/653)
* [OPRUN-4063](https://issues.redhat.com/browse/OPRUN-4063): deployment config cases [#654](https://github.com/openshift/operator-framework-operator-controller/pull/654)
* [OCPQE-31265](https://issues.redhat.com/browse/OCPQE-31265): update OCP-75441 to support multi-arch [#668](https://github.com/openshift/operator-framework-operator-controller/pull/668)
* [OPRUN-4509](https://issues.redhat.com/browse/OPRUN-4509): Synchronize From Upstream Repositories [#669](https://github.com/openshift/operator-framework-operator-controller/pull/669)
* NO-ISSUE: Synchronize From Upstream Repositories [#667](https://github.com/openshift/operator-framework-operator-controller/pull/667)
* NO-ISSUE: Synchronize From Upstream Repositories [#665](https://github.com/openshift/operator-framework-operator-controller/pull/665)
* [Full changelog](https://github.com/openshift/operator-framework-operator-controller/compare/db184cb31e0c3fbb4d05067b240846f3d0af6b41...9fe71d5548bb4a1b1a8ce0c02b3c2a74dded0c59)
### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/22f07f6e7825c572abf8214e6a376078d9048296)
* [OCPBUGS-84534](https://issues.redhat.com/browse/OCPBUGS-84534): fix concurrent map race in project authorization cache [#642](https://github.com/openshift/openshift-apiserver/pull/642)
* NO-ISSUE: bump github.com/moby/spdystream v0.5.0 to v0.5.1 to fix CVE-2026-35469 [#650](https://github.com/openshift/openshift-apiserver/pull/650)
* [OCPBUGS-38120](https://issues.redhat.com/browse/OCPBUGS-38120): Ensure Project delete requests are passed through admission [#632](https://github.com/openshift/openshift-apiserver/pull/632)
* NO-JIRA: Add control-plane-approvers to OWNERS [#630](https://github.com/openshift/openshift-apiserver/pull/630)
* [OCPBUGS-74511](https://issues.redhat.com/browse/OCPBUGS-74511): remove RouteExternalCertificate feature gate [#604](https://github.com/openshift/openshift-apiserver/pull/604)
* [CNTRLPLANE-3226](https://issues.redhat.com/browse/CNTRLPLANE-3226): Sync with openshift apiserver 4.22 kubernetes 1.34.1 [#629](https://github.com/openshift/openshift-apiserver/pull/629)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/56aa2d96edd725e44ddd7ff13f23e53e6c509828...22f07f6e7825c572abf8214e6a376078d9048296)
### [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager/tree/5631cf493b006cbc72a8600a7435813272d71940)
* [CNF-23051](https://issues.redhat.com/browse/CNF-23051): Migrate away from deprecated ioutil [#422](https://github.com/openshift/openshift-controller-manager/pull/422)
* NO-JIRA: Add control-plane-approvers to OWNERS [#438](https://github.com/openshift/openshift-controller-manager/pull/438)
* [Full changelog](https://github.com/openshift/openshift-controller-manager/compare/26d20feae8892f648f5b06ed3f5492fe6ffb4532...5631cf493b006cbc72a8600a7435813272d71940)
### [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack/tree/4bc7bc64a57f67992ad074c55d4e8e57fe5ec2ea)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#416](https://github.com/openshift/cluster-api-provider-openstack/pull/416)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#408](https://github.com/openshift/cluster-api-provider-openstack/pull/408)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.14 into main [#390](https://github.com/openshift/cluster-api-provider-openstack/pull/390)
* NO-JIRA: Update manifests generator [#411](https://github.com/openshift/cluster-api-provider-openstack/pull/411)
* [OCPBUGS-77542](https://issues.redhat.com/browse/OCPBUGS-77542): Updating openstack-cluster-api-controllers-container image to be consistent with ART for 4.22 [#399](https://github.com/openshift/cluster-api-provider-openstack/pull/399)
* [Full changelog](https://github.com/openshift/cluster-api-provider-openstack/compare/74cb5b085a21fdec9f0f8c5c1dfa3933075fb1dc...4bc7bc64a57f67992ad074c55d4e8e57fe5ec2ea)
### [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack/tree/8a8c354b99ce83e3c05a91358aadec09944c2fce)
* [OCPBUGS-77724](https://issues.redhat.com/browse/OCPBUGS-77724): Updating ose-machine-api-provider-openstack-container image to be consistent with ART for 4.22 [#161](https://github.com/openshift/machine-api-provider-openstack/pull/161)
* [Full changelog](https://github.com/openshift/machine-api-provider-openstack/compare/bd549946407598aa6354583e404cd740a9201ac2...8a8c354b99ce83e3c05a91358aadec09944c2fce)
### [openstack-resource-controller](https://github.com/openshift/openstack-resource-controller/tree/af431c7d76e7474d9f83c4803aa402c24f075534)
* UPSTREAM-SYNC: Sync main with latest upstream (release-2.0) [#36](https://github.com/openshift/openstack-resource-controller/pull/36)
* UPSTREAM-SYNC:Merge https://github.com/k-orc/openstack-resource-controller:release-1.0 into main [#20](https://github.com/openshift/openstack-resource-controller/pull/20)
* [OCPCLOUD-3321](https://issues.redhat.com/browse/OCPCLOUD-3321), [OSASINFRA-3980](https://issues.redhat.com/browse/OSASINFRA-3980): Update to image-based manifests [#30](https://github.com/openshift/openstack-resource-controller/pull/30)
* NO-JIRA: Update OWNERS_ALIASES [#28](https://github.com/openshift/openstack-resource-controller/pull/28)
* [OCPBUGS-77719](https://issues.redhat.com/browse/OCPBUGS-77719): Updating openstack-resource-controller-container image to be consistent with ART for 4.22 [#26](https://github.com/openshift/openstack-resource-controller/pull/26)
* [Full changelog](https://github.com/openshift/openstack-resource-controller/compare/84e9cc6f52391d3f18578aff36d447a800215f53...af431c7d76e7474d9f83c4803aa402c24f075534)
### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/a1de734673fb56da500b6ea212a70d50bd5740ab)
* NO-ISSUE: Synchronize From Upstream Repositories [#1313](https://github.com/openshift/operator-framework-olm/pull/1313)
* NO-ISSUE: Synchronize From Upstream Repositories [#1311](https://github.com/openshift/operator-framework-olm/pull/1311)
* NO-ISSUE: Synchronize From Upstream Repositories [#1308](https://github.com/openshift/operator-framework-olm/pull/1308)
* NO-ISSUE: Synchronize From Upstream Repositories [#1307](https://github.com/openshift/operator-framework-olm/pull/1307)
* NO-ISSUE: Synchronize From Upstream Repositories [#1306](https://github.com/openshift/operator-framework-olm/pull/1306)
* NO-ISSUE: Synchronize From Upstream Repositories [#1299](https://github.com/openshift/operator-framework-olm/pull/1299)
* [OPRUN-4610](https://issues.redhat.com/browse/OPRUN-4610): Revert lifecycle server changes [#1300](https://github.com/openshift/operator-framework-olm/pull/1300)
* [OCPBUGS-54790](https://issues.redhat.com/browse/OCPBUGS-54790): Fix packageserver PDB annotation for HyperShift [#1297](https://github.com/openshift/operator-framework-olm/pull/1297)
* [OPRUN-4588](https://issues.redhat.com/browse/OPRUN-4588): use AlwaysAllow UnhealthyPodEvictionPolicy option in PDBs [#1280](https://github.com/openshift/operator-framework-olm/pull/1280)
* NO-ISSUE: Synchronize From Upstream Repositories [#1298](https://github.com/openshift/operator-framework-olm/pull/1298)
* [OPRUN-4601](https://issues.redhat.com/browse/OPRUN-4601): use resource-based RBAC for lifecycle-server auth [#1290](https://github.com/openshift/operator-framework-olm/pull/1290)
* [OCPBUGS-84642](https://issues.redhat.com/browse/OCPBUGS-84642): Synchronize From Upstream Repositories [#1291](https://github.com/openshift/operator-framework-olm/pull/1291)
* [OPRUN-4597](https://issues.redhat.com/browse/OPRUN-4597): Fix lifecycle-server readiness probe to allow empty index [#1288](https://github.com/openshift/operator-framework-olm/pull/1288)
* [OPRUN-4541](https://issues.redhat.com/browse/OPRUN-4541), [OPRUN-4544](https://issues.redhat.com/browse/OPRUN-4544): add lifecycle-server for serving FBC catalog lifecycle metadata [#1284](https://github.com/openshift/operator-framework-olm/pull/1284)
* NO-ISSUE: Synchronize From Upstream Repositories [#1286](https://github.com/openshift/operator-framework-olm/pull/1286)
* NO-ISSUE: Synchronize From Upstream Repositories [#1282](https://github.com/openshift/operator-framework-olm/pull/1282)
* NO-ISSUE: Synchronize From Upstream Repositories [#1279](https://github.com/openshift/operator-framework-olm/pull/1279)
* [OCPBUGS-77984](https://issues.redhat.com/browse/OCPBUGS-77984): test(olm): skip ppc64le/s390x for tests using single-arch images [#1276](https://github.com/openshift/operator-framework-olm/pull/1276)
* NO-ISSUE: Synchronize From Upstream Repositories [#1278](https://github.com/openshift/operator-framework-olm/pull/1278)
* NO-ISSUE: Synchronize From Upstream Repositories [#1277](https://github.com/openshift/operator-framework-olm/pull/1277)
* NO-ISSUE: retry transient registry errors in opm QE [#1272](https://github.com/openshift/operator-framework-olm/pull/1272)
* NO-ISSUE: Synchronize From Upstream Repositories [#1275](https://github.com/openshift/operator-framework-olm/pull/1275)
* NO-ISSUE: Synchronize From Upstream Repositories [#1274](https://github.com/openshift/operator-framework-olm/pull/1274)
* NO-ISSUE: Add pedjak and fgiudici as reviewers [#1271](https://github.com/openshift/operator-framework-olm/pull/1271)
* NO-ISSUE: Synchronize From Upstream Repositories [#1268](https://github.com/openshift/operator-framework-olm/pull/1268)
* : NO-ISSUE: Migrate away from deprecated ioutil [#1160](https://github.com/openshift/operator-framework-olm/pull/1160)
* [OCPBUGS-79397](https://issues.redhat.com/browse/OCPBUGS-79397): Fix SA restore resourceVersion conflict error [#1264](https://github.com/openshift/operator-framework-olm/pull/1264)
* [OCPBUGS-77179](https://issues.redhat.com/browse/OCPBUGS-77179): Synchronize From Upstream Repositories [#1260](https://github.com/openshift/operator-framework-olm/pull/1260)
* NO-ISSUE: remove etcd dependency from failing cases [#1241](https://github.com/openshift/operator-framework-olm/pull/1241)
* [OCPQE-31468](https://issues.redhat.com/browse/OCPQE-31468): verify images command log pollution [#1262](https://github.com/openshift/operator-framework-olm/pull/1262)
* [OCPBUGS-78557](https://issues.redhat.com/browse/OCPBUGS-78557): Re-Apply Fix admin context race condition in parallel tests [#1259](https://github.com/openshift/operator-framework-olm/pull/1259)
* [OPRUN-4415](https://issues.redhat.com/browse/OPRUN-4415): automate OCP-87188: Central TLS Profile Consistency [#1207](https://github.com/openshift/operator-framework-olm/pull/1207)
* [TRT-2580](https://issues.redhat.com/browse/TRT-2580): Revert "OCPBUGS-78557: Fix admin context race condition in parallel tests" [#1258](https://github.com/openshift/operator-framework-olm/pull/1258)
* [OCPQE-31804](https://issues.redhat.com/browse/OCPQE-31804): Fix admin context race condition in parallel tests [#1256](https://github.com/openshift/operator-framework-olm/pull/1256)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/bf71e98f7511ae273bf6885ac0951d2b3841340b...a1de734673fb56da500b6ea212a70d50bd5740ab)
### [operator-marketplace](https://github.com/operator-framework/operator-marketplace/tree/03428ca0b0885e297f29fced8be1790444c4d4de)
* [OPRUN-4642](https://issues.redhat.com/browse/OPRUN-4642): Update to golang-1.26-release-4.23 [#757](https://github.com/operator-framework/operator-marketplace/pull/757)
* [OPRUN-4628](https://issues.redhat.com/browse/OPRUN-4628): restrict dynamic version selection for default catalogsources to only apply to v5.0->v4.y [#754](https://github.com/operator-framework/operator-marketplace/pull/754)
* [OPRUN-4598](https://issues.redhat.com/browse/OPRUN-4598): dynamically resolve catalog image tag from OCP release version [#750](https://github.com/operator-framework/operator-marketplace/pull/750)
* NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.28.3 to 2.29.0 [#751](https://github.com/operator-framework/operator-marketplace/pull/751)
* NO-ISSUE: Bump github.com/onsi/gomega from 1.40.0 to 1.41.0 [#752](https://github.com/operator-framework/operator-marketplace/pull/752)
* NO-ISSUE: Bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1 [#747](https://github.com/operator-framework/operator-marketplace/pull/747)
* NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.28.1 to 2.28.3 [#746](https://github.com/operator-framework/operator-marketplace/pull/746)
* NO-ISSUE: Bump the k8s-dependencies group across 1 directory with 3 updates [#741](https://github.com/operator-framework/operator-marketplace/pull/741)
* NO-ISSUE: Bump github.com/operator-framework/operator-lifecycle-manager from 0.41.0 to 0.42.0 [#740](https://github.com/operator-framework/operator-marketplace/pull/740)
* NO-ISSUE: Bump github.com/operator-framework/api from 0.41.0 to 0.42.0 [#738](https://github.com/operator-framework/operator-marketplace/pull/738)
* NO-ISSUE: Add fgiudici as reviewer [#739](https://github.com/operator-framework/operator-marketplace/pull/739)
* NO-ISSUE: Bump the k8s-dependencies group with 3 updates [#737](https://github.com/operator-framework/operator-marketplace/pull/737)
* [Full changelog](https://github.com/operator-framework/operator-marketplace/compare/d87b105718d6b3fad0b556c89bcbdabc1d474138...03428ca0b0885e297f29fced8be1790444c4d4de)
### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/e9295c0d0d7caa1eda7cc9f2f3900c64096c943c)
* NO-JIRA: Sync informing EVPN E2Es with upstream naming [#3220](https://github.com/openshift/ovn-kubernetes/pull/3220)
* [OCPBUGS-81326](https://issues.redhat.com/browse/OCPBUGS-81326), [OCPBUGS-84917](https://issues.redhat.com/browse/OCPBUGS-84917): DownStream Merge [05-19-2026] [#3195](https://github.com/openshift/ovn-kubernetes/pull/3195)
* NO-JIRA: Revert "OCPBUGS-61065: Adding ovndb-raft-functions.sh to ovnk image" [#3192](https://github.com/openshift/ovn-kubernetes/pull/3192)
* NO-JIRA: DownStream Merge [05-07-2026] [#3177](https://github.com/openshift/ovn-kubernetes/pull/3177)
* [TRT-2652](https://issues.redhat.com/browse/TRT-2652): Allow OTE info and list tests commands to work without KUBECONFIG [#3170](https://github.com/openshift/ovn-kubernetes/pull/3170)
* NO-JIRA: DownStream Merge [04-30-2026] [#3169](https://github.com/openshift/ovn-kubernetes/pull/3169)
* NO-JIRA: DownStream Merge [04-27-2026] [#3159](https://github.com/openshift/ovn-kubernetes/pull/3159)
* NO-JIRA: OTE: run EVPN external traffic tests which use random subnet for VTEP [#3148](https://github.com/openshift/ovn-kubernetes/pull/3148)
* [OCPBUGS-84037](https://issues.redhat.com/browse/OCPBUGS-84037): OTE: tolerate missing OpenShift CRDs on MicroShift [#3150](https://github.com/openshift/ovn-kubernetes/pull/3150)
* [CORENET-6537](https://issues.redhat.com/browse/CORENET-6537): OTE: Add external container support to infra provider [#2975](https://github.com/openshift/ovn-kubernetes/pull/2975)
* NO-JIRA: openshift tests: demote to informing [#3131](https://github.com/openshift/ovn-kubernetes/pull/3131)
* NO-JIRA: DownStream Merge [2026-04-09] [#3126](https://github.com/openshift/ovn-kubernetes/pull/3126)
* NO-JIRA: DownStream Merge [04-02-2026] [#3114](https://github.com/openshift/ovn-kubernetes/pull/3114)
* NO-JIRA: Disable informing tests for the time being [#3118](https://github.com/openshift/ovn-kubernetes/pull/3118)
* [OCPBUGS-77510](https://issues.redhat.com/browse/OCPBUGS-77510): DownStream Merge [03-24-2026] [#3084](https://github.com/openshift/ovn-kubernetes/pull/3084)
* [OCPBUGS-77819](https://issues.redhat.com/browse/OCPBUGS-77819): Updating ose-ovn-kubernetes-container image to be consistent with ART for 4.22 [#3036](https://github.com/openshift/ovn-kubernetes/pull/3036)
* [OCPBUGS-77795](https://issues.redhat.com/browse/OCPBUGS-77795): Updating ovn-kubernetes-microshift-container image to be consistent with ART for 4.22 [#3039](https://github.com/openshift/ovn-kubernetes/pull/3039)
* NO-JIRA: DownStream Merge [02-27-2026] [#3011](https://github.com/openshift/ovn-kubernetes/pull/3011)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/eedfcd073cbae0eea97638716019b2b39f141a41...e9295c0d0d7caa1eda7cc9f2f3900c64096c943c)
### [powervs-block-csi-driver](https://github.com/openshift/ibm-powervs-block-csi-driver/tree/b5bc8bbd638c08e4df6ff4e382b4170b202733be)
* [MULTIARCH-6066](https://issues.redhat.com/browse/MULTIARCH-6066): Rebase branch with upstream [#126](https://github.com/openshift/ibm-powervs-block-csi-driver/pull/126)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver/compare/c208095b1f3ff79e2d9eed7f8045d330a8e15c08...b5bc8bbd638c08e4df6ff4e382b4170b202733be)
### [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/tree/a56f9e95588f656435e2cc3b256d9782213a7813)
* [STOR-2762](https://issues.redhat.com/browse/STOR-2762): Bump all deps for 4.22 [#104](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/104)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/compare/ef3f7f44de76bb73f51ec1259d855e9c753d249e...a56f9e95588f656435e2cc3b256d9782213a7813)
### [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs/tree/855eaaae59c78a00638d8426b4b1763e881d9e6f)
* [OCPBUGS-83391](https://issues.redhat.com/browse/OCPBUGS-83391): Merge https://github.com/IBM-Cloud/cloud-provider-ibm:release-1.35 (e48649f) into main [#83](https://github.com/openshift/cloud-provider-powervs/pull/83)
* No-Jira: Update go.opentelemetry.io/otel and google.golang.org/grpc [#94](https://github.com/openshift/cloud-provider-powervs/pull/94)
* [Full changelog](https://github.com/openshift/cloud-provider-powervs/compare/76bdbe5d7f22736eb6765bcf15e84f0c531b14a8...855eaaae59c78a00638d8426b4b1763e881d9e6f)
### [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs/tree/e88cf81dd9ad174f395b86f9cdc40fa30cb06bf4)
* [OCPCLOUD-3271](https://issues.redhat.com/browse/OCPCLOUD-3271): Update dependencies for OpenShift 4.22 release [#140](https://github.com/openshift/machine-api-provider-powervs/pull/140)
* NO-JIRA: Add damdo to approvers list in OWNERS file [#141](https://github.com/openshift/machine-api-provider-powervs/pull/141)
* [OCPBUGS-77745](https://issues.redhat.com/browse/OCPBUGS-77745): Updating ose-powervs-machine-controllers-container image to be consistent with ART for 4.22 [#139](https://github.com/openshift/machine-api-provider-powervs/pull/139)
* [Full changelog](https://github.com/openshift/machine-api-provider-powervs/compare/bc7c3eecb22547fcb20ed36a6f36fccd3fe8ac3b...e88cf81dd9ad174f395b86f9cdc40fa30cb06bf4)
### [prom-label-proxy](https://github.com/openshift/prom-label-proxy/tree/ce91b7a51d1aee390a70e3c418e0f5539ad117c5)
* NO-ISSUE: [bot] Bump openshift/prom-label-proxy to v0.13.0 [#394](https://github.com/openshift/prom-label-proxy/pull/394)
* [Full changelog](https://github.com/openshift/prom-label-proxy/compare/c4c99a3071808f466ee6c3d7b7fa87108b457feb...ce91b7a51d1aee390a70e3c418e0f5539ad117c5)
### [prometheus](https://github.com/openshift/prometheus/tree/1f1bc8a1d7d2af0828371c9c876c95365df0c3d7)
* NO-ISSUE: [bot] Bump openshift/prometheus to v3.11.3 [#318](https://github.com/openshift/prometheus/pull/318)
* NO-ISSUE: [bot] Bump openshift/prometheus to v3.11.3 [#317](https://github.com/openshift/prometheus/pull/317)
* [OCPBUGS-62118](https://issues.redhat.com/browse/OCPBUGS-62118): fix TLS client cert rotation when no CA is configured [#312](https://github.com/openshift/prometheus/pull/312)
* NO-JIRA: Upgrade Prometheus to 3.11.2 [#305](https://github.com/openshift/prometheus/pull/305)
* [OCPBUGS-65568](https://issues.redhat.com/browse/OCPBUGS-65568): chore(kubernetes): deduplicate warning logs from the API [#296](https://github.com/openshift/prometheus/pull/296)
* [Full changelog](https://github.com/openshift/prometheus/compare/9b96528f24085fbbbd6670eea6dab7a75b23f09d...1f1bc8a1d7d2af0828371c9c876c95365df0c3d7)
### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/4b911714a57e8a6959b95efaff939af29a2b249c)
* NO-ISSUE: remove ui/app/dist/.build_stamp [#133](https://github.com/openshift/prometheus-alertmanager/pull/133)
* NO-ISSUE: [bot] Bump openshift/prometheus-alertmanager to v0.32.1 [#132](https://github.com/openshift/prometheus-alertmanager/pull/132)
* NO-ISSUE: Bump openshift/prometheus-alertmanager to v0.32.0 [#129](https://github.com/openshift/prometheus-alertmanager/pull/129)
* NO-ISSUE: update OWNERS [#130](https://github.com/openshift/prometheus-alertmanager/pull/130)
* NO-ISSUE: [bot] Bump openshift/prometheus-alertmanager to v0.31.1 [#127](https://github.com/openshift/prometheus-alertmanager/pull/127)
* [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/ee51f9914c49e1bb459ad7654fc8ddb67c9120fb...4b911714a57e8a6959b95efaff939af29a2b249c)
### [prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator/tree/7546381db866dd10a33395d2c28ceeca3c1c1591)
* NO-ISSUE: [bot] Bump openshift/prometheus-operator to v0.91.0 [#380](https://github.com/openshift/prometheus-operator/pull/380)
* NO-ISSUE: [bot] Bump openshift/prometheus-operator to v0.90.1 [#378](https://github.com/openshift/prometheus-operator/pull/378)
* [MON-4542](https://issues.redhat.com/browse/MON-4542): bump v0.90.0 [#377](https://github.com/openshift/prometheus-operator/pull/377)
* [Full changelog](https://github.com/openshift/prometheus-operator/compare/0ab0bc3dfecfce938c46ef8454287757efd58c51...7546381db866dd10a33395d2c28ceeca3c1c1591)
### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/278f5e5ea25af9d05a7c04ea033a880354d471f6)
* [OCPBUGS-83863](https://issues.redhat.com/browse/OCPBUGS-83863): Strip debug symbols from Go binaries [#180](https://github.com/openshift/node_exporter/pull/180)
* NO-JIRA: [bot] Bump openshift/node_exporter to v1.11.1 [#177](https://github.com/openshift/node_exporter/pull/177)
* [Full changelog](https://github.com/openshift/node_exporter/compare/6c4fc0126407c8404b8604faa2f1230f385b9f44...278f5e5ea25af9d05a7c04ea033a880354d471f6)
### [rhel-coreos, rhel-coreos-extensions](https://github.com/openshift/os/tree/f41264dc5f1c1f0a389787ecc5aaec573d485b8e)
* NO-JIRA: Revert "OCPBUGS-77244: 9.8: override runc package to pull in newer fixes" [#1925](https://github.com/openshift/os/pull/1925)
* [OCPBUGS-64841](https://issues.redhat.com/browse/OCPBUGS-64841): post-process: Remove workaround for openvswitch additional group [#1918](https://github.com/openshift/os/pull/1918)
* [OCPBUGS-77244](https://issues.redhat.com/browse/OCPBUGS-77244): 9.8: override runc package to pull in newer fixes [#1923](https://github.com/openshift/os/pull/1923)
* [Full changelog](https://github.com/openshift/os/compare/3d00d375d491de94fd9dcd0b5440a0efbec3d9db...f41264dc5f1c1f0a389787ecc5aaec573d485b8e)
### [rhel-coreos-10, rhel-coreos-10-extensions](https://github.com/openshift/os/tree/f41264dc5f1c1f0a389787ecc5aaec573d485b8e)
* NO-JIRA: Revert "OCPBUGS-77244: 9.8: override runc package to pull in newer fixes" [#1925](https://github.com/openshift/os/pull/1925)
* [OCPBUGS-64841](https://issues.redhat.com/browse/OCPBUGS-64841): post-process: Remove workaround for openvswitch additional group [#1918](https://github.com/openshift/os/pull/1918)
* [OCPBUGS-77244](https://issues.redhat.com/browse/OCPBUGS-77244): 9.8: override runc package to pull in newer fixes [#1923](https://github.com/openshift/os/pull/1923)
* NO-JIRA: extensions: Add rhel-9.8-server-ose-4.22 [#1910](https://github.com/openshift/os/pull/1910)
* NO-JIRA: tests: add openshift tag [#1906](https://github.com/openshift/os/pull/1906)
* [COS-3912](https://issues.redhat.com/browse/COS-3912): denylist: drop rhcos.network.init-interfaces-test [#1900](https://github.com/openshift/os/pull/1900)
* NO-JIRA: OWNERS: Add angelcerveraroldan [#1883](https://github.com/openshift/os/pull/1883)
* NO-JIRA: Rename extensions/Dockerfile to Containerfile [#1896](https://github.com/openshift/os/pull/1896)
* NO-JIRA: packages-openshift: Fix repo versions [#1895](https://github.com/openshift/os/pull/1895)
* NO-JIRA: extensions: add a label for extensions image discovery [#1894](https://github.com/openshift/os/pull/1894)
* [COS-3900](https://issues.redhat.com/browse/COS-3900): Start using rhel-10.2 [#1892](https://github.com/openshift/os/pull/1892)
* NO-JIRA: rhaos-pkgs-match-openshift: exclude known package mismatches [#1891](https://github.com/openshift/os/pull/1891)
* No-JIRA: move the OKD SIG repo to 4.22 [#1890](https://github.com/openshift/os/pull/1890)
* NO-JIRA: OWNERS: add user `Rolv-Apneseth` [#1882](https://github.com/openshift/os/pull/1882)
* NO-JIRA: Update to track 4.22 and rhel-9.8 [#1881](https://github.com/openshift/os/pull/1881)
* NO-JIRA: rhel-10.1: enable rhel-10.1-fast-datapath [#1885](https://github.com/openshift/os/pull/1885)
* NO-JIRA: packages-openshift: enable rhel-10.1-fast-datapath [#1884](https://github.com/openshift/os/pull/1884)
* [OCPNODE-4010](https://issues.redhat.com/browse/OCPNODE-4010): package: add ose-crio-credential-provider [#1879](https://github.com/openshift/os/pull/1879)
* [OCPBUGS-70162](https://issues.redhat.com/browse/OCPBUGS-70162): extensions/rhel-10.1: Re-enable ipsec [#1878](https://github.com/openshift/os/pull/1878)
* NO-JIRA: drop use of rhel-9.6-appstream-containernetworking repo [#1877](https://github.com/openshift/os/pull/1877)
* And 3 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/os/compare/e8f5a55a31574c1d1e415b23e939e20ddcfcc399...f41264dc5f1c1f0a389787ecc5aaec573d485b8e)
### [route-controller-manager](https://github.com/openshift/route-controller-manager/tree/1916ceb059f500f06e8552f88bf38cd09f9522fd)
* [OCPBUGS-39598](https://issues.redhat.com/browse/OCPBUGS-39598): Remove all duplicate ingress IP addresses in clearPersistedAllocation [#91](https://github.com/openshift/route-controller-manager/pull/91)
* [OCPBUGS-83892](https://issues.redhat.com/browse/OCPBUGS-83892): Update grpc-go and x/net [#88](https://github.com/openshift/route-controller-manager/pull/88)
* [Full changelog](https://github.com/openshift/route-controller-manager/compare/624742d93f3a7885cf7f70985f1e23ff60da580d...1916ceb059f500f06e8552f88bf38cd09f9522fd)
### [service-ca-operator](https://github.com/openshift/service-ca-operator/tree/e7ccfa308e69ce4ad1f2afcd1d7c8ff25144374b)
* [CNTRLPLANE-2894](https://issues.redhat.com/browse/CNTRLPLANE-2894): e2e network policy test cases [#338](https://github.com/openshift/service-ca-operator/pull/338)
* NO-JIRA: Add control-plane-approvers to OWNERS [#345](https://github.com/openshift/service-ca-operator/pull/345)
* NO-JIRA: controller/servingcerts: Align log verbosity [#323](https://github.com/openshift/service-ca-operator/pull/323)
* [OCPBUGS-82110](https://issues.redhat.com/browse/OCPBUGS-82110): fix service-ca-controller CrashLoop on MicroShift [#344](https://github.com/openshift/service-ca-operator/pull/344)
* [CNTRLPLANE-2845](https://issues.redhat.com/browse/CNTRLPLANE-2845): add service-ca operator and workload network policies [#324](https://github.com/openshift/service-ca-operator/pull/324)
* [CNTRLPLANE-2947](https://issues.redhat.com/browse/CNTRLPLANE-2947): Enable configurable PKI for signing CA and serving certificates [#327](https://github.com/openshift/service-ca-operator/pull/327)
* NO-JIRA: migrate from go-bindata to embed [#326](https://github.com/openshift/service-ca-operator/pull/326)
* NO-JIRA: OWNERS: remove vrutkovs and add sanchezl [#318](https://github.com/openshift/service-ca-operator/pull/318)
* NO-JIRA:Update e2e test owners [#339](https://github.com/openshift/service-ca-operator/pull/339)
* NO-JIRA: Add CLAUDE.md [#333](https://github.com/openshift/service-ca-operator/pull/333)
* [CNTRLPLANE-3038](https://issues.redhat.com/browse/CNTRLPLANE-3038): test/e2e: migrate validatingwebhook-ca-bundle-injection to OTE serial suite [#336](https://github.com/openshift/service-ca-operator/pull/336)
* [CNTRLPLANE-3035](https://issues.redhat.com/browse/CNTRLPLANE-3035): test/e2e: migrate mutatingwebhook-ca-bundle-injection to OTE serial suite [#335](https://github.com/openshift/service-ca-operator/pull/335)
* [CNTRLPLANE-3034](https://issues.redhat.com/browse/CNTRLPLANE-3034): test/e2e: migrate crd-ca-bundle-injection to OTE serial suite [#334](https://github.com/openshift/service-ca-operator/pull/334)
* [CNTRLPLANE-3033](https://issues.redhat.com/browse/CNTRLPLANE-3033): test/e2e: migrate apiservice-ca-bundle-injection to OTE serial suite [#332](https://github.com/openshift/service-ca-operator/pull/332)
* [CNTRLPLANE-3015](https://issues.redhat.com/browse/CNTRLPLANE-3015): test/e2e: restore operator config after forced rotation [#331](https://github.com/openshift/service-ca-operator/pull/331)
* [CNTRLPLANE-3009](https://issues.redhat.com/browse/CNTRLPLANE-3009): test/e2e: migrate forced-ca-rotation to OTE serial-disruptive suite [#330](https://github.com/openshift/service-ca-operator/pull/330)
* [CNTRLPLANE-3000](https://issues.redhat.com/browse/CNTRLPLANE-3000): test/e2e: migrate time-based-ca-rotation test for OTE compatibility [#308](https://github.com/openshift/service-ca-operator/pull/308)
* [Full changelog](https://github.com/openshift/service-ca-operator/compare/de11f78073eb847fca80ca6265882c69cb7a747b...e7ccfa308e69ce4ad1f2afcd1d7c8ff25144374b)
### [telemeter](https://github.com/openshift/telemeter/tree/33073dc20ca6c534c134f6a0f58e6bf8e162d4ac)
* [OCPBUGS-85082](https://issues.redhat.com/browse/OCPBUGS-85082): update google.golang.org/grpc [#601](https://github.com/openshift/telemeter/pull/601)
* NO-ISSUE: add .coderabbit.yaml [#603](https://github.com/openshift/telemeter/pull/603)
* NO-ISSUE: bump golangci-lint to v2.11.3 [#602](https://github.com/openshift/telemeter/pull/602)
* NO-ISSUE: update OWNERS [#604](https://github.com/openshift/telemeter/pull/604)
* [OCPBUGS-84383](https://issues.redhat.com/browse/OCPBUGS-84383): fix(deps): bump go-jose/v3 to v3.0.5 for JWE unwrap DoS [#588](https://github.com/openshift/telemeter/pull/588)
* [Full changelog](https://github.com/openshift/telemeter/compare/d6c7dd499f7106df78aa8bfd9dee332121ab2f09...33073dc20ca6c534c134f6a0f58e6bf8e162d4ac)
### [tests](https://github.com/openshift/origin/tree/b1497b7eb0e558f8933943c55c473d2d9326ad4f)
* [OCPBUGS-85486](https://issues.redhat.com/browse/OCPBUGS-85486): Add client retry to critical monitor test setup to avoid transient et… [#31249](https://github.com/openshift/origin/pull/31249)
* NO-JIRA: upkeep: add exception for expected disruption during tnf upgrade [#31206](https://github.com/openshift/origin/pull/31206)
* [OCPEDGE-2436](https://issues.redhat.com/browse/OCPEDGE-2436): Add is_standalone learner check test for two-node etcd disruption suite [#30950](https://github.com/openshift/origin/pull/30950)
* [OCPBUGS-86044](https://issues.redhat.com/browse/OCPBUGS-86044): Use generated names in oc adm policy SCC test [#31221](https://github.com/openshift/origin/pull/31221)
* NO-ISSUE: Automated - Update synthetic test data [#31233](https://github.com/openshift/origin/pull/31233)
* [OCPBUGS-86473](https://issues.redhat.com/browse/OCPBUGS-86473): Consolidate audit log must-gather tests to reduce parallel downloads and master node CPU pressure [#31200](https://github.com/openshift/origin/pull/31200)
* [MCO-2296](https://issues.redhat.com/browse/MCO-2296): Remove OSImageStreams v1 replace [#31256](https://github.com/openshift/origin/pull/31256)
* [TRT-2617](https://issues.redhat.com/browse/TRT-2617): Fix CPU metrics monitor node role lookup [#31252](https://github.com/openshift/origin/pull/31252)
* [MCO-2296](https://issues.redhat.com/browse/MCO-2296): OSImageStreams v1 promotion [#31211](https://github.com/openshift/origin/pull/31211)
* NO-JIRA: Clarify why Envoy pods have no CPU or memory limit [#31145](https://github.com/openshift/origin/pull/31145)
* [TRT-2673](https://issues.redhat.com/browse/TRT-2673): Filter NoExecuteTaintManager disruption from backend-disruption.json [#31248](https://github.com/openshift/origin/pull/31248)
* [OCPBUGS-86221](https://issues.redhat.com/browse/OCPBUGS-86221): update authentication operator conditions to no longer expect WellKnownReadyProgressing [#31236](https://github.com/openshift/origin/pull/31236)
* NO-JIRA: Remove fixed bugs on CO conditions (2) - 2nd try [#31207](https://github.com/openshift/origin/pull/31207)
* [AGENT-1527](https://issues.redhat.com/browse/AGENT-1527): Fix comparison of InternalReleaseImage to mirror [#31250](https://github.com/openshift/origin/pull/31250)
* Revert "CLID-589: add oc-mirror to extensionBinaries" [#31238](https://github.com/openshift/origin/pull/31238)
* [OCPBUGS-86017](https://issues.redhat.com/browse/OCPBUGS-86017): Extend image-registry single replica exception to s390x architecture [#31190](https://github.com/openshift/origin/pull/31190)
* [OCPBUGS-82501](https://issues.redhat.com/browse/OCPBUGS-82501): Fix AWS DualStack CI jobs consistently encounter 2 EgressFirewall Test Failures [#31147](https://github.com/openshift/origin/pull/31147)
* [OCPBUGS-84519](https://issues.redhat.com/browse/OCPBUGS-84519): Remove openshift-ovn-kubernetes terminationMessagePolicy exemption [#31159](https://github.com/openshift/origin/pull/31159)
* NO-ISSUE: Restrict test retries to an allowlist of test names [#31222](https://github.com/openshift/origin/pull/31222)
* [OCPBUGS-86611](https://issues.redhat.com/browse/OCPBUGS-86611): Wait for namespace initialization before creating pod [#31225](https://github.com/openshift/origin/pull/31225)
* [CNTRLPLANE-3238](https://issues.redhat.com/browse/CNTRLPLANE-3238): pathological events: bump KMS ScalingReplicaSet threshold to 120 [#31209](https://github.com/openshift/origin/pull/31209)
* NO-JIRA: Skip CO condition tests on SNO [#30775](https://github.com/openshift/origin/pull/30775)
* [CLID-589](https://issues.redhat.com/browse/CLID-589): add oc-mirror to extensionBinaries [#31006](https://github.com/openshift/origin/pull/31006)
* [OCPBUGS-59500](https://issues.redhat.com/browse/OCPBUGS-59500): pathologicalevents: fix HPA FailedGetResourceMetric allowlist [#31213](https://github.com/openshift/origin/pull/31213)
* [OCPBUGS-86225](https://issues.redhat.com/browse/OCPBUGS-86225): fix PDB AlwaysAllow test failure on IPv6-primary dualstack clusters [#31196](https://github.com/openshift/origin/pull/31196)
* [CNTRLPLANE-3428](https://issues.redhat.com/browse/CNTRLPLANE-3428): tls: add cluster-authentication-operator and operands to tested compo… [#31208](https://github.com/openshift/origin/pull/31208)
* NO-ISSUE: Automated - Update synthetic test data [#31192](https://github.com/openshift/origin/pull/31192)
* [OCPBUGS-86328](https://issues.redhat.com/browse/OCPBUGS-86328): if rhcos9-10 in the job name,update jobname test [#31198](https://github.com/openshift/origin/pull/31198)
* [OCPNODE-4535](https://issues.redhat.com/browse/OCPNODE-4535): Automate OCP-44820 change container registry config [#31182](https://github.com/openshift/origin/pull/31182)
* [OCPBUGS-85363](https://issues.redhat.com/browse/OCPBUGS-85363): Fixed flakiness of oc set image E2E tests [#31191](https://github.com/openshift/origin/pull/31191)
* [OCPNODE-4125](https://issues.redhat.com/browse/OCPNODE-4125): fix imagepolicy image config testcase [#31185](https://github.com/openshift/origin/pull/31185)
* [CNTRLPLANE-3428](https://issues.redhat.com/browse/CNTRLPLANE-3428): tls fix HyperShift guest-side CO wait and Custom profile handling [#31194](https://github.com/openshift/origin/pull/31194)
* [TRT-2669](https://issues.redhat.com/browse/TRT-2669): Revert #31112 "NO-JIRA: Remove fixed bugs on CO conditions (2)" [#31201](https://github.com/openshift/origin/pull/31201)
* [AGENT-1517](https://issues.redhat.com/browse/AGENT-1517): refactored the logic to filter IRI related MachineConfigs [#31179](https://github.com/openshift/origin/pull/31179)
* [OPRUN-4569](https://issues.redhat.com/browse/OPRUN-4569): test: remove OLMv1 OTE exceptions; scope OLMv0 exceptions to SNO [#31172](https://github.com/openshift/origin/pull/31172)
* NO-JIRA: Remove fixed bugs on CO conditions (2) [#31112](https://github.com/openshift/origin/pull/31112)
* [OCPBUGS-85378](https://issues.redhat.com/browse/OCPBUGS-85378): Fix OCP E2E test - Object count when exceed openshift.io/image-tags will ban to create new image references in the project [#31155](https://github.com/openshift/origin/pull/31155)
* NO-ISSUE: Automated - Update synthetic test data [#31181](https://github.com/openshift/origin/pull/31181)
* NO-JIRA: Fix flaky storage-admin e2e test [#31180](https://github.com/openshift/origin/pull/31180)
* [CNTRLPLANE-3428](https://issues.redhat.com/browse/CNTRLPLANE-3428): tls: introduce narrow target types and migrate test functions [#31160](https://github.com/openshift/origin/pull/31160)
* Revert "OCPBUGS-85363: Fixed flakiness of oc set image E2E tests" [#31188](https://github.com/openshift/origin/pull/31188)
* [OCPBUGS-85370](https://issues.redhat.com/browse/OCPBUGS-85370): Raise OpenStack operator watch limits [#31154](https://github.com/openshift/origin/pull/31154)
* [OCPBUGS-85363](https://issues.redhat.com/browse/OCPBUGS-85363): Fixed flakiness of oc set image E2E tests [#31152](https://github.com/openshift/origin/pull/31152)
* [OCPBUGS-85058](https://issues.redhat.com/browse/OCPBUGS-85058): monitortests: allow etcd CO blips during TNF jobs on two-node upgrades [#31138](https://github.com/openshift/origin/pull/31138)
* [OCPBUGS-85486](https://issues.redhat.com/browse/OCPBUGS-85486): stage the creation of test pods to minimize etcd impact [#31164](https://github.com/openshift/origin/pull/31164)
* [OCPNODE-4505](https://issues.redhat.com/browse/OCPNODE-4505): Automation creation of OCP-57401 [#31142](https://github.com/openshift/origin/pull/31142)
* [OCPBUGS-83623](https://issues.redhat.com/browse/OCPBUGS-83623): fix: add distruption tolerance for DualReplica (two-node) topology [#31127](https://github.com/openshift/origin/pull/31127)
* [OCPBUGS-85531](https://issues.redhat.com/browse/OCPBUGS-85531): Fixed flakiness in OCP E2E tests - oc debug image stream [#31168](https://github.com/openshift/origin/pull/31168)
* Revert "OPRUN-4569: test: remove OTE exceptions for OLM" [#31171](https://github.com/openshift/origin/pull/31171)
* [OCPNODE-4108](https://issues.redhat.com/browse/OCPNODE-4108): add E2E tests for upstream dra-example-driver [#31064](https://github.com/openshift/origin/pull/31064)
* [OPRUN-4569](https://issues.redhat.com/browse/OPRUN-4569): test: remove OTE exceptions for OLM [#31150](https://github.com/openshift/origin/pull/31150)
* [OCPEDGE-2386](https://issues.redhat.com/browse/OCPEDGE-2386): Add tnf_etcd_disruption test with 5 new etcd resilience tests. [#30880](https://github.com/openshift/origin/pull/30880)
* NO-JIRA: Improve graceful shutdown LB test output with more details of late requests [#31158](https://github.com/openshift/origin/pull/31158)
* [OCPNODE-4047](https://issues.redhat.com/browse/OCPNODE-4047): Implement kubelet TLS 1.3 via KubeletConfig on workers [#31016](https://github.com/openshift/origin/pull/31016)
* NO-ISSUE: Automated - Update synthetic test data [#31146](https://github.com/openshift/origin/pull/31146)
* [CNTRLPLANE-3374](https://issues.redhat.com/browse/CNTRLPLANE-3374): remove multus exception from monitor test [#31130](https://github.com/openshift/origin/pull/31130)
* [CNTRLPLANE-3428](https://issues.redhat.com/browse/CNTRLPLANE-3428): tls: extract annotation and ConfigMap update helpers [#31156](https://github.com/openshift/origin/pull/31156)
* [OCPBUGS-83580](https://issues.redhat.com/browse/OCPBUGS-83580): Skip dev fuse test on runc runtime [#31140](https://github.com/openshift/origin/pull/31140)
* [OCPBUGS-84516](https://issues.redhat.com/browse/OCPBUGS-84516): remove openshift-machine-config-operator exemption from terminationMessagePolicy monitor [#31120](https://github.com/openshift/origin/pull/31120)
* [CNTRLPLANE-3387](https://issues.redhat.com/browse/CNTRLPLANE-3387): Update list of pending namespaces in the required-scc monitor test [#31135](https://github.com/openshift/origin/pull/31135)
* NO-ISSUE: improve error reporting in cpumetriccollector [#31132](https://github.com/openshift/origin/pull/31132)
* no-jira: tls: deduplicate ConfigMap helpers into standalone functions [#31136](https://github.com/openshift/origin/pull/31136)
* [OCPBUGS-84500](https://issues.redhat.com/browse/OCPBUGS-84500): Verify dynamic revision bump for etcd during kernel crash [#30915](https://github.com/openshift/origin/pull/30915)
* [OCPNODE-3983](https://issues.redhat.com/browse/OCPNODE-3983): Add e2e tests for KubeletEnsureSecretPulledImages feature gate [#31102](https://github.com/openshift/origin/pull/31102)
* [OCPNODE-4381](https://issues.redhat.com/browse/OCPNODE-4381): Migrate OCP-38271 from openshift-tests-private [#30960](https://github.com/openshift/origin/pull/30960)
* [OCPBUGS-85087](https://issues.redhat.com/browse/OCPBUGS-85087): Allow OVN-Kubernetes CIDROverlap pathological events [#31131](https://github.com/openshift/origin/pull/31131)
* NO-JIRA: Increase pathological event thresholds for API server rollout scenarios [#31122](https://github.com/openshift/origin/pull/31122)
* [CNTRLPLANE-2554](https://issues.redhat.com/browse/CNTRLPLANE-2554): Add ExternalOIDCWithUpstreamParity e2e tests [#31028](https://github.com/openshift/origin/pull/31028)
* : no-jira: tls: extract injectTLSAnnotation constant [#31125](https://github.com/openshift/origin/pull/31125)
* [OCPSTRAT-3036](https://issues.redhat.com/browse/OCPSTRAT-3036): Update etcd test data for k8s 1.36 release [#31113](https://github.com/openshift/origin/pull/31113)
* [OCPNODE-4043](https://issues.redhat.com/browse/OCPNODE-4043): Fix NVIDIA DRA driver helm repo configuration [#31104](https://github.com/openshift/origin/pull/31104)
* [TRT-2644](https://issues.redhat.com/browse/TRT-2644): Run CP tests everywhere [#31094](https://github.com/openshift/origin/pull/31094)
* NO-JIRA: Remove fixed bugs on CO conditions [#31081](https://github.com/openshift/origin/pull/31081)
* [OCPBUGS-84831](https://issues.redhat.com/browse/OCPBUGS-84831): Optimize NetworkPolicy reconciliation test to reduce timeout [#31114](https://github.com/openshift/origin/pull/31114)
* NO-ISSUE: Automated - Update synthetic test data [#31109](https://github.com/openshift/origin/pull/31109)
* [OCPBUGS-84809](https://issues.redhat.com/browse/OCPBUGS-84809): Disable particular CSI tests if CSI driver is removed [#31107](https://github.com/openshift/origin/pull/31107)
* NO-JIRA: check jobname for upgrade [#31106](https://github.com/openshift/origin/pull/31106)
* [OCPBUGS-84520](https://issues.redhat.com/browse/OCPBUGS-84520): remove openshift-catalogd exemption from terminationMessagePolicy monitor [#31100](https://github.com/openshift/origin/pull/31100)
* [OCPNODE-2994](https://issues.redhat.com/browse/OCPNODE-2994): Add ArtifactVolume tests and register artifact image [#31017](https://github.com/openshift/origin/pull/31017)
* NO-ISSUE: add QSEs as approvers [#31087](https://github.com/openshift/origin/pull/31087)
* [SPLAT-2562](https://issues.redhat.com/browse/SPLAT-2562): Added 3CMO OTE binary to extensionBinary list [#31004](https://github.com/openshift/origin/pull/31004)
* [OCPCLOUD-3429](https://issues.redhat.com/browse/OCPCLOUD-3429): Ignore excessive image volume events from CAPI operator [#31093](https://github.com/openshift/origin/pull/31093)
* [TRT-2622](https://issues.redhat.com/browse/TRT-2622): copy OTE attrs to junit properties [#31052](https://github.com/openshift/origin/pull/31052)
* [OCPBUGS-83580](https://issues.redhat.com/browse/OCPBUGS-83580): Skip dev fuse test on runc runtime [#31044](https://github.com/openshift/origin/pull/31044)
* [SREP-4676](https://issues.redhat.com/browse/SREP-4676): add exception for managed cluster namespaces [#31082](https://github.com/openshift/origin/pull/31082)
* [OCPBUGS-84257](https://issues.redhat.com/browse/OCPBUGS-84257): fix openshift/network/third-party suite selecting zero tests [#31084](https://github.com/openshift/origin/pull/31084)
* [TRT-2084](https://issues.redhat.com/browse/TRT-2084): comment bugs filed for terminationMessage exemptions [#31079](https://github.com/openshift/origin/pull/31079)
* [OCPBUGS-84504](https://issues.redhat.com/browse/OCPBUGS-84504): retry transient kubeconfig read failures in GetClientConfig [#31080](https://github.com/openshift/origin/pull/31080)
* [TRT-2565](https://issues.redhat.com/browse/TRT-2565): Add simple benchmark for risk analysis HTTP requests [#30965](https://github.com/openshift/origin/pull/30965)
* NO-JIRA: Fix ListImages JSON parsing when extension binaries emit log lines [#31009](https://github.com/openshift/origin/pull/31009)
* [OCPBUGS-84255](https://issues.redhat.com/browse/OCPBUGS-84255): Fix project name error during wait [#31062](https://github.com/openshift/origin/pull/31062)
* NO-JIRA: Skip network policy cases on microshift and hypershift [#31075](https://github.com/openshift/origin/pull/31075)
* [OCPBUGS-79544](https://issues.redhat.com/browse/OCPBUGS-79544): test: add monitortest to detect pods stuck in Pending state [#31045](https://github.com/openshift/origin/pull/31045)
* [OCPBUGS-79544](https://issues.redhat.com/browse/OCPBUGS-79544): Add [Late] test to collect CRI-O goroutine dumps via SIGUSR1 [#31013](https://github.com/openshift/origin/pull/31013)
* NO-ISSUE: Automated - Update synthetic test data [#31063](https://github.com/openshift/origin/pull/31063)
* [OCPBUGS-82072](https://issues.redhat.com/browse/OCPBUGS-82072), [OCPBUGS-82077](https://issues.redhat.com/browse/OCPBUGS-82077): fix: skip unused tests for two node [#30998](https://github.com/openshift/origin/pull/30998)
* [OCPBUGS-82144](https://issues.redhat.com/browse/OCPBUGS-82144): Remove EnsureMemberRemoved from graceful shutdown test [#30981](https://github.com/openshift/origin/pull/30981)
* [OCPEDGE-2381](https://issues.redhat.com/browse/OCPEDGE-2381): Validate no WAL corruption when both nodes shutdown gracefully [#30925](https://github.com/openshift/origin/pull/30925)
* [SPLAT-2562](https://issues.redhat.com/browse/SPLAT-2562): Added VVCDO OTE binary to extensionBinary list [#31014](https://github.com/openshift/origin/pull/31014)
* NO-JIRA: harden watch loop to prevent thread exhaustion [#30956](https://github.com/openshift/origin/pull/30956)
* [OCPBUGS-84244](https://issues.redhat.com/browse/OCPBUGS-84244): cache kube client instance [#30997](https://github.com/openshift/origin/pull/30997)
* [OCPBUGS-83281](https://issues.redhat.com/browse/OCPBUGS-83281): Fix Gateway cleanup in parallel e2e test workers [#31023](https://github.com/openshift/origin/pull/31023)
* [OCPBUGS-84237](https://issues.redhat.com/browse/OCPBUGS-84237): skip on BM which has insufficient host [#31002](https://github.com/openshift/origin/pull/31002)
* [OCPBUGS-83405](https://issues.redhat.com/browse/OCPBUGS-83405): remove unnecessary exceptions from monitoring test [#30924](https://github.com/openshift/origin/pull/30924)
* NO-ISSUE: baremetal: update OWNERS [#31055](https://github.com/openshift/origin/pull/31055)
* [OTA-1977](https://issues.redhat.com/browse/OTA-1977): Skip test case updateLifecycle if the worker pool is paused [#31040](https://github.com/openshift/origin/pull/31040)
* [OCPBUGS-82160](https://issues.redhat.com/browse/OCPBUGS-82160): Skip image-registry operator tests for Libvirt platform in upgrade jobs. [#31001](https://github.com/openshift/origin/pull/31001)
* [OCPEDGE-2284](https://issues.redhat.com/browse/OCPEDGE-2284): Rename two_node directory to edge_topologies [#30623](https://github.com/openshift/origin/pull/30623)
* [OCPBUGS-83402](https://issues.redhat.com/browse/OCPBUGS-83402): Bump oc request-timeout to deflake tests [#31008](https://github.com/openshift/origin/pull/31008)
* [OCPBUGS-82304](https://issues.redhat.com/browse/OCPBUGS-82304): Add sleep to give cvo time to reconcile [#30988](https://github.com/openshift/origin/pull/30988)
* [OCPBUGS-63307](https://issues.redhat.com/browse/OCPBUGS-63307): Move imagepolicy test to disruptive long-running suite [#31043](https://github.com/openshift/origin/pull/31043)
* NO-JIRA: OVNK BGP: allow max unavailability for NNCPs on VRF-Lite test case [#31037](https://github.com/openshift/origin/pull/31037)
* [OCPBUGS-83801](https://issues.redhat.com/browse/OCPBUGS-83801): skip serial and disruptive cases from suite [#31042](https://github.com/openshift/origin/pull/31042)
* [TRT-2635](https://issues.redhat.com/browse/TRT-2635): coderabbit: enable request changes workflow [#31047](https://github.com/openshift/origin/pull/31047)
* [TRT-2084](https://issues.redhat.com/browse/TRT-2084): terminationmessagepolicy: correctly fail on violations [#30993](https://github.com/openshift/origin/pull/30993)
* [OCPBUGS-84036](https://issues.redhat.com/browse/OCPBUGS-84036): CNTRLPLANE-2751:Adding e2e network policy cases for config-operator [#30995](https://github.com/openshift/origin/pull/30995)
* [OCPEDGE-2510](https://issues.redhat.com/browse/OCPEDGE-2510): fix(two-node): bump node replacement timeouts for new node installer pods [#31005](https://github.com/openshift/origin/pull/31005)
* [OCPBUGS-81476](https://issues.redhat.com/browse/OCPBUGS-81476): Fix timeout in PinnedImages GC test [#30962](https://github.com/openshift/origin/pull/30962)
* [OCPBUGS-63307](https://issues.redhat.com/browse/OCPBUGS-63307): honor firstTimestamp annotation value [#31021](https://github.com/openshift/origin/pull/31021)
* no-jira: test/monitoring: increase load balancer readiness and curl connection timeout [#30994](https://github.com/openshift/origin/pull/30994)
* NO-JIRA: Fix UpgradeTargetPayloadImagePullSpec [#31025](https://github.com/openshift/origin/pull/31025)
* [OCPSTRAT-3082](https://issues.redhat.com/browse/OCPSTRAT-3082): TLS propagation test [#30801](https://github.com/openshift/origin/pull/30801)
* NO-JIRA: OVNK BGP: improve debug and increase NNCP timeout for VRF-Lite test case [#31022](https://github.com/openshift/origin/pull/31022)
* [OCPBUGS-83286](https://issues.redhat.com/browse/OCPBUGS-83286): Fix case-sensitive error matching in Whereabouts IP allocation test [#31012](https://github.com/openshift/origin/pull/31012)
* [OCPBUGS-83267](https://issues.redhat.com/browse/OCPBUGS-83267): Use upgrades.Skippable for Gateway API upgrade test skip logic [#31000](https://github.com/openshift/origin/pull/31000)
* [OCPEDGE-2381](https://issues.redhat.com/browse/OCPEDGE-2381): Add test to verify for backup container exists when etcd crashes [#30922](https://github.com/openshift/origin/pull/30922)
* [STOR-2807](https://issues.redhat.com/browse/STOR-2807): Add e2e test to verify CSI driver operators use service CA signed certificates [#30980](https://github.com/openshift/origin/pull/30980)
* [OCPEDGE-2381](https://issues.redhat.com/browse/OCPEDGE-2381): Verify etc pod should start with oom_score_adj as system-node-critical [#30982](https://github.com/openshift/origin/pull/30982)
* [OCPBUGS-78997](https://issues.redhat.com/browse/OCPBUGS-78997): Revert "NO-ISSUE: test/e2e/upgrade: Raise default update-ack timeout to 10m" [#30919](https://github.com/openshift/origin/pull/30919)
* [OCPBUGS-82557](https://issues.redhat.com/browse/OCPBUGS-82557): DCM tests need to be backward compatible [#30999](https://github.com/openshift/origin/pull/30999)
* [OCPBUGS-77948](https://issues.redhat.com/browse/OCPBUGS-77948), [OCPBUGS-77949](https://issues.redhat.com/browse/OCPBUGS-77949), [OCPBUGS-78298](https://issues.redhat.com/browse/OCPBUGS-78298), [OCPEDGE-2443](https://issues.redhat.com/browse/OCPEDGE-2443): TNF node replacement test updates [#30846](https://github.com/openshift/origin/pull/30846)
* NO-JIRA: Update OWNERS [#30996](https://github.com/openshift/origin/pull/30996)
* [OCPBUGS-82046](https://issues.redhat.com/browse/OCPBUGS-82046): Revert "remove some duplicate ovnk test cases" [#30975](https://github.com/openshift/origin/pull/30975)
* [OCPBUGS-78090](https://issues.redhat.com/browse/OCPBUGS-78090): Avoid copy of the oc binary, to support heterogeneous environments [#30992](https://github.com/openshift/origin/pull/30992)
* [OCPBUGS-81340](https://issues.redhat.com/browse/OCPBUGS-81340): fix pacemaker CronJob duplicate-event namespace [#30985](https://github.com/openshift/origin/pull/30985)
* [OCPEDGE-2491](https://issues.redhat.com/browse/OCPEDGE-2491): Log pcs status and etcd member list after every recovery [#30949](https://github.com/openshift/origin/pull/30949)
* [NE-2561](https://issues.redhat.com/browse/NE-2561): Add Gateway API OLM to NO-OLM migration upgrade test [#30897](https://github.com/openshift/origin/pull/30897)
* [OCPBUGS-81716](https://issues.redhat.com/browse/OCPBUGS-81716): Add retry logic for transient network errors in restartKubeletOnNode [#30966](https://github.com/openshift/origin/pull/30966)
* [CORENET-6168](https://issues.redhat.com/browse/CORENET-6168): Add ovn tests extension [#30560](https://github.com/openshift/origin/pull/30560)
* [OCPBUGS-81640](https://issues.redhat.com/browse/OCPBUGS-81640): test/ccm: upgrade ccm healthz test to use aws sdk v2 [#30954](https://github.com/openshift/origin/pull/30954)
* [TRT-2084](https://issues.redhat.com/browse/TRT-2084): terminationmessagepolicy: relax for 5.0 [#30979](https://github.com/openshift/origin/pull/30979)
* [OCPBUGS-81340](https://issues.redhat.com/browse/OCPBUGS-81340): openshift-tests: allow duplicate pacemaker status collector CronJob events [#30953](https://github.com/openshift/origin/pull/30953)
* [OCPBUGS-81737](https://issues.redhat.com/browse/OCPBUGS-81737): Dynamically find worker-generated-kubelet MC name to support different platforms [#30967](https://github.com/openshift/origin/pull/30967)
* [OCPBUGS-81742](https://issues.redhat.com/browse/OCPBUGS-81742): Add exception for the newly added kas-bootstrap-container [#30963](https://github.com/openshift/origin/pull/30963)
* [OCPNODE-4224](https://issues.redhat.com/browse/OCPNODE-4224): Migrating test case OCP-70987 from OTP to origin [#30948](https://github.com/openshift/origin/pull/30948)
* [OCPBUGS-82039](https://issues.redhat.com/browse/OCPBUGS-82039): Fix DCM ingress tests to support IPv6-only clusters [#30972](https://github.com/openshift/origin/pull/30972)
* [OCPBUGS-81685](https://issues.redhat.com/browse/OCPBUGS-81685): OVNK BGP: fix curl arguments not properly tokenized [#30961](https://github.com/openshift/origin/pull/30961)
* [OCPBUGS-81751](https://issues.redhat.com/browse/OCPBUGS-81751): Fix GatewayClass update conflict in markTestDone [#30964](https://github.com/openshift/origin/pull/30964)
* NO-JIRA: Ignore extra fields [#30939](https://github.com/openshift/origin/pull/30939)
* NO-JIRA: fix CUDN status condition tests for new TransportAccepted condition [#30958](https://github.com/openshift/origin/pull/30958)
* [NE-2529](https://issues.redhat.com/browse/NE-2529): add new dcm e2e tests [#30926](https://github.com/openshift/origin/pull/30926)
* [OCPBUGS-81629](https://issues.redhat.com/browse/OCPBUGS-81629): Skip NoRegistryClusterInstall feature tests if InternalReleaseImage resource was not present [#30955](https://github.com/openshift/origin/pull/30955)
* NO-JIRA: feat: update etcd/certrotation suite to disruptive [#30947](https://github.com/openshift/origin/pull/30947)
* [OCPCLOUD-3215](https://issues.redhat.com/browse/OCPCLOUD-3215): test/ccm: add support for verifying NLB health check configuration [#30952](https://github.com/openshift/origin/pull/30952)
* [NE-2520](https://issues.redhat.com/browse/NE-2520): Enable Gateway API tests on vSphere and baremetal [#30946](https://github.com/openshift/origin/pull/30946)
* [SPLAT-2672](https://issues.redhat.com/browse/SPLAT-2672): e2e/ote/ccm-aws: moving binary to cccmo [#30864](https://github.com/openshift/origin/pull/30864)
* [OCPNODE-3725](https://issues.redhat.com/browse/OCPNODE-3725): Add System compressible test [#30935](https://github.com/openshift/origin/pull/30935)
* [OCPCLOUD-3215](https://issues.redhat.com/browse/OCPCLOUD-3215): Detect IPv6 clusters and apply correct policy [#30938](https://github.com/openshift/origin/pull/30938)
* [OCPNODE-4179](https://issues.redhat.com/browse/OCPNODE-4179): Migrating test case OCP-80983 from openshift-tests-private to origin [#30899](https://github.com/openshift/origin/pull/30899)
* [OCPSTRAT-886](https://issues.redhat.com/browse/OCPSTRAT-886): Support dual-stack LB in service disruption monitor [#30936](https://github.com/openshift/origin/pull/30936)
* [OCPBUGS-78978](https://issues.redhat.com/browse/OCPBUGS-78978): Workaround packet sniffer timeouts in BGP tests [#30912](https://github.com/openshift/origin/pull/30912)
* [OTA-1813](https://issues.redhat.com/browse/OTA-1813): Allow for alerts to fire from an e2e test [#30929](https://github.com/openshift/origin/pull/30929)
* [AGENT-1428](https://issues.redhat.com/browse/AGENT-1428): Add e2e extended tests for NoRegistryClusterInstall [#30941](https://github.com/openshift/origin/pull/30941)
* [SPLAT-2627](https://issues.redhat.com/browse/SPLAT-2627): Added MAPA OTE entry [#30808](https://github.com/openshift/origin/pull/30808)
* [OCPSTRAT-2728](https://issues.redhat.com/browse/OCPSTRAT-2728): Rebase 1.35 [#30866](https://github.com/openshift/origin/pull/30866)
* [OCPNODE-4043](https://issues.redhat.com/browse/OCPNODE-4043): Add DRA e2e tests to run on NVIDIA GPU [#30758](https://github.com/openshift/origin/pull/30758)
* [NE-2422](https://issues.redhat.com/browse/NE-2422): Skip Gateway API tests on dual-stack clusters [#30942](https://github.com/openshift/origin/pull/30942)
* [NE-2131](https://issues.redhat.com/browse/NE-2131): register CIO tests extension and remove tests migrated to CIO [#30911](https://github.com/openshift/origin/pull/30911)
* [MCO-2171](https://issues.redhat.com/browse/MCO-2171): remove MCO bootimage tests from origin [#30933](https://github.com/openshift/origin/pull/30933)
* [OCPBUGS-78617](https://issues.redhat.com/browse/OCPBUGS-78617): Fix PinnedImages test should respect node taints [#30913](https://github.com/openshift/origin/pull/30913)
* NO-ISSUE: Make MCN degrade test stable across TechPreview and non-TechPreview [#30943](https://github.com/openshift/origin/pull/30943)
* [TRT-2573](https://issues.redhat.com/browse/TRT-2573): Show non-blocking failure message in JUnit failure output [#30921](https://github.com/openshift/origin/pull/30921)
* [NE-2422](https://issues.redhat.com/browse/NE-2422): Add dual-stack ingress e2e tests for AWSDualStackInstall featuregate [#30904](https://github.com/openshift/origin/pull/30904)
* [OCPNODE-4031](https://issues.redhat.com/browse/OCPNODE-4031): Add criocredentialprovider tests [#30821](https://github.com/openshift/origin/pull/30821)
* [OCPNODE-3720](https://issues.redhat.com/browse/OCPNODE-3720): Test for AutoNodeSizing [#30789](https://github.com/openshift/origin/pull/30789)
* [NE-2422](https://issues.redhat.com/browse/NE-2422): Fix router e2e tests for dual-stack AWS clusters [#30934](https://github.com/openshift/origin/pull/30934)
* [STOR-2505](https://issues.redhat.com/browse/STOR-2505): Add storage binaries check [#30698](https://github.com/openshift/origin/pull/30698)
* [OCPBUGS-78940](https://issues.redhat.com/browse/OCPBUGS-78940): Treat groups as existent if they were found but discovery is stale [#30923](https://github.com/openshift/origin/pull/30923)
* NO-JIRA: Reverting case OOM score adjustment [#30932](https://github.com/openshift/origin/pull/30932)
* [OCPEDGE-2447](https://issues.redhat.com/browse/OCPEDGE-2447): IsMicroShiftCluster: return error instead of calling Skip from container node [#30914](https://github.com/openshift/origin/pull/30914)
* [NE-2501](https://issues.redhat.com/browse/NE-2501): Allow prometheus test pods to access Ingress Operator metrics port [#30928](https://github.com/openshift/origin/pull/30928)
* NO-JIRA: remove extra character [#30920](https://github.com/openshift/origin/pull/30920)
* [OCPEDGE-2447](https://issues.redhat.com/browse/OCPEDGE-2447): increase precondition cluster health timeout to 10m [#30893](https://github.com/openshift/origin/pull/30893)
* [OCPNODE-3751](https://issues.redhat.com/browse/OCPNODE-3751): Add automated tests for kubelet LimitedSwap drop-in configuration for CNV [#30795](https://github.com/openshift/origin/pull/30795)
* [MCO-2155](https://issues.redhat.com/browse/MCO-2155): add osstream exclusion for mco bootimage tests [#30918](https://github.com/openshift/origin/pull/30918)
* [TRT-2539](https://issues.redhat.com/browse/TRT-2539): Fix output capture in ginkgo RunSpec to capture stdout/stderr [#30769](https://github.com/openshift/origin/pull/30769)
* [NE-2498](https://issues.redhat.com/browse/NE-2498): add new DCM e2e tests [#30741](https://github.com/openshift/origin/pull/30741)
* NO-ISSUE: test/e2e/upgrade: Raise default update-ack timeout to 10m [#30917](https://github.com/openshift/origin/pull/30917)
* [TRT-2506](https://issues.redhat.com/browse/TRT-2506): Add OS version info to ClusterData [#30827](https://github.com/openshift/origin/pull/30827)
* [NE-2292](https://issues.redhat.com/browse/NE-2292): Tests for gatewayAPIWithoutOLM featuregate graduation [#30905](https://github.com/openshift/origin/pull/30905)
* [OCPEDGE-2381](https://issues.redhat.com/browse/OCPEDGE-2381): Verify etc pod should start with oom_score_adj as system-node-critical [#30867](https://github.com/openshift/origin/pull/30867)
* NO-JIRA: remove test exception for Insights operator [#30849](https://github.com/openshift/origin/pull/30849)
* [NE-2292](https://issues.redhat.com/browse/NE-2292): Skip OLM tests when GatewayAPIWithoutOLM enabled [#30896](https://github.com/openshift/origin/pull/30896)
* NO-JIRA: Remove TNF node replacement test [#30901](https://github.com/openshift/origin/pull/30901)
* [OCPBUGS-78384](https://issues.redhat.com/browse/OCPBUGS-78384): changed http to https for three places to reduce test false positives and false negatives [#30872](https://github.com/openshift/origin/pull/30872)
* [CNTRLPLANE-2999](https://issues.redhat.com/browse/CNTRLPLANE-2999): Revert PR #30746: TLS 1.3 test causing instability in 4.22 [#30895](https://github.com/openshift/origin/pull/30895)
* NO-JIRA: Add a singleton instance for list of nodes [#30830](https://github.com/openshift/origin/pull/30830)
* [OCPNODE-3932](https://issues.redhat.com/browse/OCPNODE-3932): Add automated tests for non-CNV swap configuration [#30807](https://github.com/openshift/origin/pull/30807)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/origin/compare/085b8a0fe6114a8720d9fae95abb26b5a2cf4cc6...b1497b7eb0e558f8933943c55c473d2d9326ad4f)
### [thanos](https://github.com/openshift/thanos/tree/5d9d0f387e5cc651470f27352b28674103bfdd77)
* [OCPBUGS-81494](https://issues.redhat.com/browse/OCPBUGS-81494): CVE-2026-33186 openshift4/ose-thanos-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation [#179](https://github.com/openshift/thanos/pull/179)
* [Full changelog](https://github.com/openshift/thanos/compare/fdb04c2d68818e447de0bacb51cc7b34d53235b8...5d9d0f387e5cc651470f27352b28674103bfdd77)
### [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere/tree/fb90e2d792e464d9c5ccf782a8101d1f40cf29c0)
* NO-JIRA: Update OWNERS [#119](https://github.com/openshift/cloud-provider-vsphere/pull/119)
* NO-JIRA: Merge https://github.com/kubernetes/cloud-provider-vsphere:release-1.35 (93af0f7) into main [#113](https://github.com/openshift/cloud-provider-vsphere/pull/113)
* [Full changelog](https://github.com/openshift/cloud-provider-vsphere/compare/854aeeabab6301b204efaf041e916847a3b47672...fb90e2d792e464d9c5ccf782a8101d1f40cf29c0)
### [vsphere-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-vsphere/tree/c58b89ae0514f5f416f9595d876d598757181524)
* [OCPBUGS-53005](https://issues.redhat.com/browse/OCPBUGS-53005): Remove references to master branch [#111](https://github.com/openshift/cluster-api-provider-vsphere/pull/111)
* [OCPBUGS-83600](https://issues.redhat.com/browse/OCPBUGS-83600): Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.15.3 (e917f8e) into master [#107](https://github.com/openshift/cluster-api-provider-vsphere/pull/107)
* NO-JIRA: manifests-gen: scope provider webhooks to capi namespace [#106](https://github.com/openshift/cluster-api-provider-vsphere/pull/106)
* [OCPCLOUD-3359](https://issues.redhat.com/browse/OCPCLOUD-3359): Add TLS substitutions [#99](https://github.com/openshift/cluster-api-provider-vsphere/pull/99)
* NO-JIRA: Update manifests generator [#100](https://github.com/openshift/cluster-api-provider-vsphere/pull/100)
* NO-JIRA: Update OWNERS [#96](https://github.com/openshift/cluster-api-provider-vsphere/pull/96)
* [Full changelog](https://github.com/openshift/cluster-api-provider-vsphere/compare/f12e50512efa829a2df97c897862c3f45c201300...c58b89ae0514f5f416f9595d876d598757181524)
### [vsphere-csi-driver, vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver/tree/a47406147d6d009b0f75b69363172e928ac2abb4)
* NO-ISSUE: Bump spdystream to v0.5.1 [#181](https://github.com/openshift/vmware-vsphere-csi-driver/pull/181)
* [OCPBUGS-81525](https://issues.redhat.com/browse/OCPBUGS-81525): Bump google.golang.org/grpc to 1.79.3 [#170](https://github.com/openshift/vmware-vsphere-csi-driver/pull/170)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver/compare/e5c5c1ea677ee1fbfd74823265afa1b82b91df50...a47406147d6d009b0f75b69363172e928ac2abb4)
### [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator/tree/e91f95e27cd47b41ba31399781bba361d6090634)
* [SPLAT-2562](https://issues.redhat.com/browse/SPLAT-2562): Created OTE extension with tests for hybrid env [#335](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/335)
* [STOR-2762](https://issues.redhat.com/browse/STOR-2762): Bump all deps for 4.22 [#334](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/334)
* [STOR-2882](https://issues.redhat.com/browse/STOR-2882): add feature gate for checking platform type is vsphere [#331](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/331)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver-operator/compare/e325a0db6fe047330d316def901e7d73fadf9beb...e91f95e27cd47b41ba31399781bba361d6090634)
### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/d5e2893e95d6aef8467730a370cca199638327b1)
* [OCPBUGS-79057](https://issues.redhat.com/browse/OCPBUGS-79057): Fixed compute cluster permission logic for single fd with read-only custom resourcepool [#220](https://github.com/openshift/vsphere-problem-detector/pull/220)
* [OCPBUGS-56274](https://issues.redhat.com/browse/OCPBUGS-56274): add datacenter consistency check [#212](https://github.com/openshift/vsphere-problem-detector/pull/212)
* [STOR-2762](https://issues.redhat.com/browse/STOR-2762): Bump all deps for 4.22 [#214](https://github.com/openshift/vsphere-problem-detector/pull/214)
* [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/acf69b9fd87581907f36f50268c4dd02b37ebace...d5e2893e95d6aef8467730a370cca199638327b1)