# 5.1.0-ec.2
Created: 2026-11-06 21:19:35 +0000 UTC
Image Digest: `sha256:0a8c0243e3a6843fc17183af53a7fb529eae406c4745ff33d645e710d1d56923`
## Changes from 5.1.0-ec.0
### Components
* Kubectl upgraded from 1.36.2 to 1.37.1
* Kubernetes upgraded from 1.36.3 to 1.37.1
* Kubernetes Tests 1.36.2
* Red Hat Enterprise Linux CoreOS 10.2 upgraded from 10.2.20260831-0 to 10.2.20261027-0
### FeatureGate Changes
| FeatureGate | Default
Hypershift | Default
SelfManagedHA | DevPreviewNoUpgrade
Hypershift | DevPreviewNoUpgrade
SelfManagedHA | OKD
Hypershift | OKD
SelfManagedHA | TechPreviewNoUpgrade
Hypershift | TechPreviewNoUpgrade
SelfManagedHA |
| :------ | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: |
| AzureWorkloadIdentity
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| BootImageSkewEnforcement
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| DualReplica
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| SELinuxMountGAReadiness
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| VolumeGroupSnapshot
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| AzureMultiDisk
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| KMSEncryption
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| OpenShiftPodSecurityAdmission
(0 tests)| Disabled
(Changed)| Disabled
(Changed)| Enabled| Enabled| Disabled
(Changed)| Disabled
(Changed)| Enabled| Enabled |
| SELinuxMount
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| TLSAdherence
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| AuthenticationComponentProxy
(0 tests)| Disabled| Enabled
(Changed)| Disabled| Enabled| Disabled| Enabled
(Changed)| Disabled| Enabled |
| AuthenticationComponentProxyExternalOIDC
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | | |
| ClusterAPIMachineManagementNutanix
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| ClusterAPIOperator
(0 tests)| | | | Enabled
(New)| | | | Enabled
(New) |
| CompositePodGroup
(0 tests)| | | | | | | | |
| ControllerManagerConfig
(0 tests)| | | | Enabled
(New)| | | | |
| DRADeviceTaintRules
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| DRAWorkloadResourceClaims
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| EgressIPNodeSelector
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| ExternalOIDCAsWebhook
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| GenericWorkload
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| MACSecurity
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| MachineAPIMigrationNutanix
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| ManagedBootImagesAWSCAPI
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| MetalEnrollmentAPI
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | | |
| OLMLifecycleAndCompatibility
(0 tests)| Disabled| Enabled| Disabled| Enabled| Disabled| Disabled
(Changed)| Disabled| Enabled |
| OVNKubernetesUplinkMode
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | | |
| OpenStackMaxAllowedAddressPairs
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| PodGroupPreemptionPolicy
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| StoragePathAlert
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| TopologyAwareWorkloadScheduling
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| UnifiedClusterManagedDNSAndLB
(0 tests)| | | | Enabled
(New)| | | | |
| VSpherePerComponentScopedCreds
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | | |
### New images
* [azure-karpenter-provider-azure](https://github.com/openshift/Azure-karpenter-provider-azure) git [bc70c724](https://github.com/openshift/Azure-karpenter-provider-azure/commit/bc70c7241ed3f1e05d97a4713c9bfdefc52cf1ee) `sha256:3fcb379ba20499576bc12c05762f3c603e72fd6e966b55090d71ac0518cfbff1`
* [csi-volume-device-exporter](https://github.com/openshift/csi-volume-device-exporter) git [78eb5c79](https://github.com/openshift/csi-volume-device-exporter/commit/78eb5c79aabe534846771f4166c783a8a79886e6) `sha256:a331dd8572cb012b982a84c4fc0d6caa73b7127afc4e818d038d85330dac921e`
### Removed images
* configmap-reloader
* haproxy-router-haproxy28
### Rebuilt images without code change
* [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook) git [0d33a459](https://github.com/openshift/aws-pod-identity-webhook/commit/0d33a4596e2a22d188fe74c4a6497c37c2528c1f) `sha256:ace859b4bab07c6cfba29e5157fdc0a13c13fb5e6784a121868c12a7b56fc3ac`
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [9607604d](https://github.com/openshift/cluster-update-keys/commit/9607604d35acee234051bd0da8a14321b4edd38e) `sha256:763dc6f0d9b42a136e384936145bd4a184b31e026d461f69c7b2454a86fc6518`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [b63b175a](https://github.com/openshift/driver-toolkit/commit/b63b175a79b9fe0c29f6ed63df3c2d7862ba408a) `sha256:1939567a3c43b5f73e89cbc8531c457a8899ff7ec01da43f66a0441e9fa25849`
* [driver-toolkit-10](https://github.com/openshift/driver-toolkit) git [b63b175a](https://github.com/openshift/driver-toolkit/commit/b63b175a79b9fe0c29f6ed63df3c2d7862ba408a) `sha256:908e1a7434d8e58e892ef129b90d851b7c779a815e3a01ff74339ceaeb27cee8`
* [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook) git [4501ff2f](https://github.com/openshift/gcp-workload-identity-federation-webhook/commit/4501ff2f53576c31df0511b69444e65e1eeba745) `sha256:61be63a848496e742d98b5c778f06bd29f9070cd95fa840d8d9009daf9e06a9c`
* [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [f8e41b2e](https://github.com/openshift/ironic-rhcos-downloader/commit/f8e41b2ed8915474a99e3eb34b54692afb0611da) `sha256:c7dbd0797d10c49d1d25082a3e4d159f82c45f591e1d13b113aec5d231f91fcc`
* [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager) git [486a0418](https://github.com/openshift/ironic-static-ip-manager/commit/486a041897d703d55ef59c98e2b20a01588a0b4c) `sha256:a0be957175cfa81d653a907689accb58cdd20642d18f9b9f79b17a4136da3bda`
* [machine-image-customization-controller](https://github.com/openshift/image-customization-controller) git [87f4774b](https://github.com/openshift/image-customization-controller/commit/87f4774be1fc58b6b3868c57326a80f95bd81594) `sha256:039f379d53a122bf87c0c0ae46e36833bcdfa0e4e3c631e1141a6ecb5af2d9e1`
* [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy) git [39e9cccf](https://github.com/openshift/multus-networkpolicy/commit/39e9cccfa32951d0243c99638099da0a84d0d598) `sha256:129bb6739888a44aa489b501e89d22108ab02b9038c742c364f45f051972210f`
* [network-interface-bond-cni](https://github.com/openshift/bond-cni) git [b8723844](https://github.com/openshift/bond-cni/commit/b8723844dc69940f55208cdb265653ab57f959f0) `sha256:e3f14469594cd990d4b6614f515bcb2053fd2331e4f117dcda193091cb846345`
* [powervs-block-csi-driver](https://github.com/openshift/ibm-powervs-block-csi-driver) git [cfe345c7](https://github.com/openshift/ibm-powervs-block-csi-driver/commit/cfe345c7dd6e7f817927847690658b199c3d1653) `sha256:cf4f4e54361e23a4d2f6ca426aa74b46fac48b846b05e6f6446106a48e8e0938`
* [service-ca-operator](https://github.com/openshift/service-ca-operator) git [ed872ba1](https://github.com/openshift/service-ca-operator/commit/ed872ba14b615ca5726ae90e987268877a0b0b20) `sha256:59c9d256fc3f0b9923bfea3616fdf722f2bb89c94d37a812c27e412b4e717e1a`
### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/0d44006dc6e77a6930d650cfd87c6bc7fb4b4c45)
* NO-ISSUE: [master] Bump OCP versions: 4.19, 5.0 [#11336](https://github.com/openshift/assisted-service/pull/11336)
* NO-ISSUE: Refresh RPM lockfiles [#11331](https://github.com/openshift/assisted-service/pull/11331)
* NO-ISSUE: [master] Bump OCP versions: 4.14, 4.18, 4.20, 4.16, 4.22, 4.19, 4.21, 5.0 [#11323](https://github.com/openshift/assisted-service/pull/11323)
* [MGMT-25002](https://issues.redhat.com/browse/MGMT-25002): Prevent host event leaks across InfraEnvs [#11036](https://github.com/openshift/assisted-service/pull/11036)
* [MGMT-25583](https://issues.redhat.com/browse/MGMT-25583): CVE-2026-116587 Bump github.com/go-jose/go-jose/v4 to v4.1.6 [#11321](https://github.com/openshift/assisted-service/pull/11321)
* NO-ISSUE: Refresh RPM lockfiles [#11297](https://github.com/openshift/assisted-service/pull/11297)
* NO-ISSUE: [master] Bump OCP versions: 4.19 [#11278](https://github.com/openshift/assisted-service/pull/11278)
* [MGMT-25480](https://issues.redhat.com/browse/MGMT-25480): Sync NTP sources from CRD spec by comparing to DB [#11198](https://github.com/openshift/assisted-service/pull/11198)
* NO-ISSUE: [master] Bump OCP versions: 4.21, 4.20, 4.22 [#11270](https://github.com/openshift/assisted-service/pull/11270)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#11264](https://github.com/openshift/assisted-service/pull/11264)
* [OCPEDGE-3082](https://issues.redhat.com/browse/OCPEDGE-3082): Skip dnsmasq for UnifiedClusterManagedDNSAndLB FG + SNO + None platform [#11228](https://github.com/openshift/assisted-service/pull/11228)
* [ACM-48279](https://issues.redhat.com/browse/ACM-48279): Cilium blocks infrastructure-operator access to the Kubernetes API [#11245](https://github.com/openshift/assisted-service/pull/11245)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#11254](https://github.com/openshift/assisted-service/pull/11254)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#11043](https://github.com/openshift/assisted-service/pull/11043)
* [ACM-44934](https://issues.redhat.com/browse/ACM-44934): CVE-2026-88031 Bump go.mongodb.org/mongo-driver to v1.17.10 using replace directive [#11220](https://github.com/openshift/assisted-service/pull/11220)
* NO-ISSUE: [master] Bump OCP versions: 4.13, 4.16, 4.17, 4.18, 5.0 [#11240](https://github.com/openshift/assisted-service/pull/11240)
* NO-ISSUE: [master] Bump OCP versions: 4.22, 4.19 [#11229](https://github.com/openshift/assisted-service/pull/11229)
* NO-ISSUE: [master] Bump OCP versions: 4.20, 4.21 [#11205](https://github.com/openshift/assisted-service/pull/11205)
* [AGENT-1648](https://issues.redhat.com/browse/AGENT-1648): Set fips in install-config for the agent-based installer [#11114](https://github.com/openshift/assisted-service/pull/11114)
* NO-ISSUE: [master] Bump OCP versions: 5.0 [#11204](https://github.com/openshift/assisted-service/pull/11204)
* [MGMT-19216](https://issues.redhat.com/browse/MGMT-19216): Add node selector and tolerations to our webhook [#11049](https://github.com/openshift/assisted-service/pull/11049)
* [ACM-44934](https://issues.redhat.com/browse/ACM-44934): CVE-2026-88031 Bump github.com/go-openapi/loads, github.com/go-openapi/analysis, github.com/go-openapi/validate, github.com/go-openapi/strfmt to fix CVE-2026-88031 through introducers update (models module) [#11165](https://github.com/openshift/assisted-service/pull/11165)
* [MGMT-25133](https://issues.redhat.com/browse/MGMT-25133): Accept OpenSSH authorized_keys options in SSH key validation [#10830](https://github.com/openshift/assisted-service/pull/10830)
* [ACM-44934](https://issues.redhat.com/browse/ACM-44934): CVE-2026-88031 Bump go.mongodb.org/mongo-driver to v1.17.10 through indirect dependency conversion (api module) [#11164](https://github.com/openshift/assisted-service/pull/11164)
* [ACM-47334](https://issues.redhat.com/browse/ACM-47334): CVE-2026-63209 Bump github.com/klauspost/compress to v1.18.7 through indirect dependency conversion [#11149](https://github.com/openshift/assisted-service/pull/11149)
* NO-ISSUE: upgrade Go to 1.26.7 [#11119](https://github.com/openshift/assisted-service/pull/11119)
* NO-ISSUE: [master] Bump OCP versions: 4.16, 4.14, 4.19 [#11197](https://github.com/openshift/assisted-service/pull/11197)
* [ACM-47458](https://issues.redhat.com/browse/ACM-47458): CVE-2026-84304 Bump google.golang.org/grpc to v1.83.1 using replace directive (api module) [#11185](https://github.com/openshift/assisted-service/pull/11185)
* [ACM-44934](https://issues.redhat.com/browse/ACM-44934): CVE-2026-88031 Bump go.mongodb.org/mongo-driver to v1.17.10 through indirect dependency conversion (client module) [#11195](https://github.com/openshift/assisted-service/pull/11195)
* [ACM-47334](https://issues.redhat.com/browse/ACM-47334): CVE-2026-63209 Bump github.com/klauspost/compress to v1.18.7 using replace directive (api module) [#11155](https://github.com/openshift/assisted-service/pull/11155)
* [ACM-47334](https://issues.redhat.com/browse/ACM-47334): CVE-2026-63209 Bump github.com/klauspost/compress to v1.18.7 using replace directive (models module) [#11156](https://github.com/openshift/assisted-service/pull/11156)
* [ACM-47334](https://issues.redhat.com/browse/ACM-47334): CVE-2026-63209 Bump github.com/klauspost/compress to v1.18.7 using replace directive (client module) [#11157](https://github.com/openshift/assisted-service/pull/11157)
* [ACM-47458](https://issues.redhat.com/browse/ACM-47458): CVE-2026-84304 Bump google.golang.org/grpc to v1.83.1 through indirect dependency conversion [#11139](https://github.com/openshift/assisted-service/pull/11139)
* NO-ISSUE: [master] Bump OCP versions: 4.22, 4.20, 4.21 [#11094](https://github.com/openshift/assisted-service/pull/11094)
* [MGMT-25505](https://issues.redhat.com/browse/MGMT-25505): moving seaweedfs to our own repo [#11085](https://github.com/openshift/assisted-service/pull/11085)
* [MGMT-25497](https://issues.redhat.com/browse/MGMT-25497): Use OCP version for disconnected iso images [#11062](https://github.com/openshift/assisted-service/pull/11062)
* [ACM-39262](https://issues.redhat.com/browse/ACM-39262): chain PostgreSQL hops for EUS skip-upgrades [#10882](https://github.com/openshift/assisted-service/pull/10882)
* [MGMT-24807](https://issues.redhat.com/browse/MGMT-24807): OpenShift AI validation message is confusing — doesn't state role and shows a different (lower) CPU/RAM number than the aggregated worker-role requirement [#10969](https://github.com/openshift/assisted-service/pull/10969)
* [MGMT-23594](https://issues.redhat.com/browse/MGMT-23594): Installation should not be stopped if we can't pull the must gather image [#10935](https://github.com/openshift/assisted-service/pull/10935)
* [OCPBUGS-104857](https://issues.redhat.com/browse/OCPBUGS-104857): Disk validation falsely reports iSCSI host IP conflict when iBFT initiator uses DHCP (flags=7) on dual-homed host [#11007](https://github.com/openshift/assisted-service/pull/11007)
* NO-ISSUE: [master] Bump OCP versions: 4.14, 4.20, 5.0, 4.22, 4.16, 4.21, 4.18, 4.19, 4.17 [#11084](https://github.com/openshift/assisted-service/pull/11084)
* [MGMT-25505](https://issues.redhat.com/browse/MGMT-25505): minio was deprecated [#11050](https://github.com/openshift/assisted-service/pull/11050)
* NO-ISSUE: [master] Bump OCP versions: 4.22, 4.19, 4.20, 4.21 [#11004](https://github.com/openshift/assisted-service/pull/11004)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#10957](https://github.com/openshift/assisted-service/pull/10957)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#10958](https://github.com/openshift/assisted-service/pull/10958)
* NO-ISSUE: [master] Bump OCP versions: 5.0, 4.18, 4.19, 4.13 [#10980](https://github.com/openshift/assisted-service/pull/10980)
* [MGMT-25431](https://issues.redhat.com/browse/MGMT-25431): CVE-2026-84445 Bump google.golang.org/grpc to v1.82.2 through indirect dependency conversion [#10975](https://github.com/openshift/assisted-service/pull/10975)
* [MGMT-24967](https://issues.redhat.com/browse/MGMT-24967): Static-IP iSCSI Boot-from-SAN Support in Assisted Installer [#10925](https://github.com/openshift/assisted-service/pull/10925)
* [OCPBUGS-115550](https://issues.redhat.com/browse/OCPBUGS-115550): Allow agent-installer invoker to have a suffix [#10968](https://github.com/openshift/assisted-service/pull/10968)
* [MGMT-25123](https://issues.redhat.com/browse/MGMT-25123): create endpoint for listing OVE images [#10933](https://github.com/openshift/assisted-service/pull/10933)
* [MGMT-25355](https://issues.redhat.com/browse/MGMT-25355): Migrate to harness-agnostic agent configuration layout [#10966](https://github.com/openshift/assisted-service/pull/10966)
* [ACM-38075](https://issues.redhat.com/browse/ACM-38075): Assisted Service Agent controller does not approve day-2 CSRs for worker nodes provisioned with pre-existing BMHs via ClusterInstance scale-out [#10944](https://github.com/openshift/assisted-service/pull/10944)
* NO-ISSUE: [master] Bump OCP versions: 4.21, 5.0, 4.16, 4.14, 4.22, 4.20, 4.19 [#10967](https://github.com/openshift/assisted-service/pull/10967)
* [MGMT-24854](https://issues.redhat.com/browse/MGMT-24854): Cilium CNI is not supported on OCP 4.22 [#10819](https://github.com/openshift/assisted-service/pull/10819)
* [MGMT-25367](https://issues.redhat.com/browse/MGMT-25367): consider imageType when selecting OpenShift version [#10917](https://github.com/openshift/assisted-service/pull/10917)
* [MGMT-25406](https://issues.redhat.com/browse/MGMT-25406): Add OpenShift-compatible CIDR length validation [#10948](https://github.com/openshift/assisted-service/pull/10948)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#10946](https://github.com/openshift/assisted-service/pull/10946)
* NO-ISSUE: [master] Bump OCP versions: 4.21, 4.22, 4.20 [#10942](https://github.com/openshift/assisted-service/pull/10942)
* [ACM-41555](https://issues.redhat.com/browse/ACM-41555): Enable PQC in Dockerfiles [#10901](https://github.com/openshift/assisted-service/pull/10901)
* [MGMT-25131](https://issues.redhat.com/browse/MGMT-25131): When getting the release image for a cluster we should always prioritize cluster.OcpReleaseImage if it's set [#10938](https://github.com/openshift/assisted-service/pull/10938)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#10941](https://github.com/openshift/assisted-service/pull/10941)
* NO-ISSUE: [master] Bump OCP versions: 5.0 [#10937](https://github.com/openshift/assisted-service/pull/10937)
* [APPSRE-14688](https://issues.redhat.com/browse/APPSRE-14688): remove legacy monitoring.coreos.com/v1 ServiceMonitors [#10931](https://github.com/openshift/assisted-service/pull/10931)
* NO-ISSUE: [master] Bump OCP versions: 4.17, 5.0 [#10924](https://github.com/openshift/assisted-service/pull/10924)
* [OCPBUGS-120683](https://issues.redhat.com/browse/OCPBUGS-120683): Fix NUMAResourcesOperator CR name so it can be applied [#10910](https://github.com/openshift/assisted-service/pull/10910)
* NO-ISSUE: Update operator bundle channel to ocm-5.1 [#10867](https://github.com/openshift/assisted-service/pull/10867)
* [OCPBUGS-120675](https://issues.redhat.com/browse/OCPBUGS-120675): added missing subscription name for lvms-operator [#10909](https://github.com/openshift/assisted-service/pull/10909)
* [AGENT-1529](https://issues.redhat.com/browse/AGENT-1529): Add ovnKubernetesConfig to install-config definition [#10430](https://github.com/openshift/assisted-service/pull/10430)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#10912](https://github.com/openshift/assisted-service/pull/10912)
* NO-ISSUE: [master] Bump OCP versions: 4.17, 4.19, 4.20, 4.16, 4.21 [#10907](https://github.com/openshift/assisted-service/pull/10907)
* NO-ISSUE:Bump go.opentelemetry.io/otel to v1.44.0 in master [#10869](https://github.com/openshift/assisted-service/pull/10869)
* [MGMT-25130](https://issues.redhat.com/browse/MGMT-25130): assisted-service and assisted-image-service NetworkPolicy ingress has no source restriction (any pod in any namespace can reach them directly) [#10906](https://github.com/openshift/assisted-service/pull/10906)
* NO-ISSUE: Modify Konflux YAMLs to ocm-5.1 [#10874](https://github.com/openshift/assisted-service/pull/10874)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/assisted-service/compare/d13116d7889481aa2d3c2f46f2449611f5a90356...0d44006dc6e77a6930d650cfd87c6bc7fb4b4c45)
### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/1485df1bc332e738e5e9e12f5f1c36e7cde69866)
* [OCPBUGS-132570](https://issues.redhat.com/browse/OCPBUGS-132570): Preserve firstboot network config across OS image replacement [#2465](https://github.com/openshift/assisted-installer/pull/2465)
* NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.15.0 [#2477](https://github.com/openshift/assisted-installer/pull/2477)
* [ACM-44932](https://issues.redhat.com/browse/ACM-44932): CVE-2026-88031 Bump go.mongodb.org/mongo-driver to v1.17.10 through indirect dependency conversion [#2443](https://github.com/openshift/assisted-installer/pull/2443)
* [MGMT-25001](https://issues.redhat.com/browse/MGMT-25001): Bump Go to 1.26.7 for stdlib CVEs [#2432](https://github.com/openshift/assisted-installer/pull/2432)
* NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.14.0 [#2389](https://github.com/openshift/assisted-installer/pull/2389)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#2417](https://github.com/openshift/assisted-installer/pull/2417)
* NO-ISSUE: Refresh RPM lockfiles [#2418](https://github.com/openshift/assisted-installer/pull/2418)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#2330](https://github.com/openshift/assisted-installer/pull/2330)
* NO-ISSUE: migrate Renovate config [#2363](https://github.com/openshift/assisted-installer/pull/2363)
* [MGMT-25156](https://issues.redhat.com/browse/MGMT-25156): Fix CVE-2026-17106 [#2328](https://github.com/openshift/assisted-installer/pull/2328)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#2339](https://github.com/openshift/assisted-installer/pull/2339)
* [OCPBUGS-115550](https://issues.redhat.com/browse/OCPBUGS-115550): Allow agent-installer invoker to have a suffix [#2341](https://github.com/openshift/assisted-installer/pull/2341)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#2326](https://github.com/openshift/assisted-installer/pull/2326)
* [ACM-41555](https://issues.redhat.com/browse/ACM-41555): Enable PQC in Dockerfiles [#2307](https://github.com/openshift/assisted-installer/pull/2307)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#2309](https://github.com/openshift/assisted-installer/pull/2309)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#2304](https://github.com/openshift/assisted-installer/pull/2304)
* [MGMT-24885](https://issues.redhat.com/browse/MGMT-24885): Harden command construction and credential handling [#2275](https://github.com/openshift/assisted-installer/pull/2275)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/87d1f289e17ea079cb8baf3ec897f9101ec65b00...1485df1bc332e738e5e9e12f5f1c36e7cde69866)
### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/c9c45088c300b0a2aee2b03d294ed4c885587461)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#1768](https://github.com/openshift/assisted-installer-agent/pull/1768)
* NO-ISSUE: Refresh RPM lockfiles [#1774](https://github.com/openshift/assisted-installer-agent/pull/1774)
* [MGMT-25567](https://issues.redhat.com/browse/MGMT-25567): fix(apivip_check): honor HTTPS proxy with custom CA [#1737](https://github.com/openshift/assisted-installer-agent/pull/1737)
* NO-ISSUE: Refresh RPM lockfiles [#1757](https://github.com/openshift/assisted-installer-agent/pull/1757)
* NO-ISSUE: Refresh RPM lockfiles [#1705](https://github.com/openshift/assisted-installer-agent/pull/1705)
* [OCPBUGS-130428](https://issues.redhat.com/browse/OCPBUGS-130428): Bump golang.org/x/crypto to v0.56.0 to fix CVE-2026-56855 [#1718](https://github.com/openshift/assisted-installer-agent/pull/1718)
* [OCPBUGS-130445](https://issues.redhat.com/browse/OCPBUGS-130445): CVE-2026-78662 Bump golang.org/x/crypto to v0.56.0 [#1719](https://github.com/openshift/assisted-installer-agent/pull/1719)
* [ACM-44931](https://issues.redhat.com/browse/ACM-44931): CVE-2026-88031 Bump go.mongodb.org/mongo-driver to v1.17.10 through indirect dependency conversion [#1716](https://github.com/openshift/assisted-installer-agent/pull/1716)
* [MGMT-24979](https://issues.redhat.com/browse/MGMT-24979): Bump Go to 1.26.7 for stdlib CVEs [#1696](https://github.com/openshift/assisted-installer-agent/pull/1696)
* [MGMT-25508](https://issues.redhat.com/browse/MGMT-25508): Exclude ASPEED 1a03:2000 from GPU inventory [#1694](https://github.com/openshift/assisted-installer-agent/pull/1694)
* [MGMT-23804](https://issues.redhat.com/browse/MGMT-23804): GPU inventory incorrectly includes non-GPU PCI devices (DPU/SmartNIC devices) [#1670](https://github.com/openshift/assisted-installer-agent/pull/1670)
* [MGMT-25157](https://issues.redhat.com/browse/MGMT-25157): CVE-2026-17106 Bump github.com/moby/go-archive to v0.3.0 through indirect dependency conversion [#1630](https://github.com/openshift/assisted-installer-agent/pull/1630)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#1676](https://github.com/openshift/assisted-installer-agent/pull/1676)
* NO-ISSUE: Refresh RPM lockfiles [#1684](https://github.com/openshift/assisted-installer-agent/pull/1684)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#1635](https://github.com/openshift/assisted-installer-agent/pull/1635)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#1653](https://github.com/openshift/assisted-installer-agent/pull/1653)
* NO-ISSUE: Refresh RPM lockfiles [#1590](https://github.com/openshift/assisted-installer-agent/pull/1590)
* [OCPBUGS-106189](https://issues.redhat.com/browse/OCPBUGS-106189): Assisted installer fails to disambiguate machines [#1625](https://github.com/openshift/assisted-installer-agent/pull/1625)
* [ACM-41555](https://issues.redhat.com/browse/ACM-41555): Enable PQC in Dockerfiles [#1622](https://github.com/openshift/assisted-installer-agent/pull/1622)
* [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/a909d424d5bc542e7591b6a05cc817e46cf14ee9...c9c45088c300b0a2aee2b03d294ed4c885587461)
### [agent-installer-ui](https://github.com/openshift-assisted/assisted-installer-ui/tree/58e24601e5d0769ba95de52032ceb6bf7db0c144)
* Bump undici from 7.30.0 to 7.30.1 (#4149) [#4149](https://github.com/openshift-assisted/assisted-installer-ui/pull/4149)
* Bump happy-dom from 20.9.0 to 21.0.4 (#4148) [#4148](https://github.com/openshift-assisted/assisted-installer-ui/pull/4148)
* [MGMT-25561](https://issues.redhat.com/browse/MGMT-25561): OVE above-the-sea: UI should update additional_ntp_sources instead of ntp_sources (#4118) [#4118](https://github.com/openshift-assisted/assisted-installer-ui/pull/4118)
* Don't show Static IP steps in OVE below the sea (#4119) [#4119](https://github.com/openshift-assisted/assisted-installer-ui/pull/4119)
* Hide the network type control in OVE (#4129) [#4129](https://github.com/openshift-assisted/assisted-installer-ui/pull/4129)
* Add to OVE custom manifest workaround filter (#4128) [#4128](https://github.com/openshift-assisted/assisted-installer-ui/pull/4128)
* Update GH actions to @v7 (#4127) [#4127](https://github.com/openshift-assisted/assisted-installer-ui/pull/4127)
* Bump vite from 8.0.16 to 8.1.6 (#4121) [#4121](https://github.com/openshift-assisted/assisted-installer-ui/pull/4121)
* Bump follow-redirects from 1.16.0 to 1.16.1 (#4120) [#4120](https://github.com/openshift-assisted/assisted-installer-ui/pull/4120)
* Temporarily hide static IP controls (#4116) [#4116](https://github.com/openshift-assisted/assisted-installer-ui/pull/4116)
* [MGMT-25543](https://issues.redhat.com/browse/MGMT-25543): OVE above-the-sea: remove proxy fields (#4113) [#4113](https://github.com/openshift-assisted/assisted-installer-ui/pull/4113)
* Remove Assisted Chatbot (#4091) [#4091](https://github.com/openshift-assisted/assisted-installer-ui/pull/4091)
* Red Hat Konflux purge assisted-ui-chatbot-saas-main (#4111) [#4111](https://github.com/openshift-assisted/assisted-installer-ui/pull/4111)
* [MGMT-25125](https://issues.redhat.com/browse/MGMT-25125): Implement Offline Openshift Versions Dropdown (#4107) [#4107](https://github.com/openshift-assisted/assisted-installer-ui/pull/4107)
* chore(deps): update dependency ip-address to ^10.7.3 (#4109) [#4109](https://github.com/openshift-assisted/assisted-installer-ui/pull/4109)
* chore(deps): update dependency immutable to ^5.1.9 (#4108) [#4108](https://github.com/openshift-assisted/assisted-installer-ui/pull/4108)
* Bump joi from 17.13.7 to 17.13.8 (#4100) [#4100](https://github.com/openshift-assisted/assisted-installer-ui/pull/4100)
* Upgrade Axios to 1.20.0 (#4105) [#4105](https://github.com/openshift-assisted/assisted-installer-ui/pull/4105)
* Bump compression from 1.8.1 to 1.8.2 (#4104) [#4104](https://github.com/openshift-assisted/assisted-installer-ui/pull/4104)
* Bump postcss-selector-parser from 7.1.5 to 7.1.6 (#4103) [#4103](https://github.com/openshift-assisted/assisted-installer-ui/pull/4103)
* Bump source-map-js from 1.2.1 to 1.2.2 (#4102) [#4102](https://github.com/openshift-assisted/assisted-installer-ui/pull/4102)
* Bump proxy-addr from 2.0.7 to 2.0.8 (#4101) [#4101](https://github.com/openshift-assisted/assisted-installer-ui/pull/4101)
* CVE Upgrade (#4099) [#4099](https://github.com/openshift-assisted/assisted-installer-ui/pull/4099)
* [MGMT-25084](https://issues.redhat.com/browse/MGMT-25084): Upgrade axios to 1.20.0 (#4098) [#4098](https://github.com/openshift-assisted/assisted-installer-ui/pull/4098)
* chore(deps): update dependency dompurify to ^3.4.16 (#4094) [#4094](https://github.com/openshift-assisted/assisted-installer-ui/pull/4094)
* chore(deps): update dependency @types/node to ^24.19.1 (#4093) [#4093](https://github.com/openshift-assisted/assisted-installer-ui/pull/4093)
* Do not show limited support level warning in disconnected flow (#4087) [#4087](https://github.com/openshift-assisted/assisted-installer-ui/pull/4087)
* Update OpenShift version for OVE (#4084) [#4084](https://github.com/openshift-assisted/assisted-installer-ui/pull/4084)
* Bump ip-address from 10.4.0 to 10.5.1 (#4083) [#4083](https://github.com/openshift-assisted/assisted-installer-ui/pull/4083)
* Bump undici from 7.29.0 to 7.30.0 (#4082) [#4082](https://github.com/openshift-assisted/assisted-installer-ui/pull/4082)
* chore(deps): update konflux references (#4072) [#4072](https://github.com/openshift-assisted/assisted-installer-ui/pull/4072)
* remove disconvering word from StaticIP for Disconnected mode (#4079) [#4079](https://github.com/openshift-assisted/assisted-installer-ui/pull/4079)
* chore(deps): update dependency ajv to ^8.20.0 (#4077) [#4077](https://github.com/openshift-assisted/assisted-installer-ui/pull/4077)
* Bump immutable from 3.8.3 to 3.8.4 (#4078) [#4078](https://github.com/openshift-assisted/assisted-installer-ui/pull/4078)
* chore(deps): update dependency @types/node to ^24.13.6 (#4076) [#4076](https://github.com/openshift-assisted/assisted-installer-ui/pull/4076)
* [OCPBUGS-123716](https://issues.redhat.com/browse/OCPBUGS-123716): [Above the sea UI] The rendezvous IP must match one of the defined static IPs (#4071) [#4071](https://github.com/openshift-assisted/assisted-installer-ui/pull/4071)
* Add Proxy and NTP configurations (#4068) [#4068](https://github.com/openshift-assisted/assisted-installer-ui/pull/4068)
* Above the sea - hide pull secret field when it's already been set (#4067) [#4067](https://github.com/openshift-assisted/assisted-installer-ui/pull/4067)
* chore(deps): update dependency brace-expansion to ^5.0.12 (#4063) [#4063](https://github.com/openshift-assisted/assisted-installer-ui/pull/4063)
* chore(deps): update konflux references (#4061) [#4061](https://github.com/openshift-assisted/assisted-installer-ui/pull/4061)
* chore(deps): update dependency @types/node to ^24.13.5 (#4062) [#4062](https://github.com/openshift-assisted/assisted-installer-ui/pull/4062)
* Add Single-Stack, Increase ImageSize Label and show LVMS Label (#4054) [#4054](https://github.com/openshift-assisted/assisted-installer-ui/pull/4054)
* fix(deps): update typescript type definitions (non-major) (#4022) [#4022](https://github.com/openshift-assisted/assisted-installer-ui/pull/4022)
* [OCPBUGS-121378](https://issues.redhat.com/browse/OCPBUGS-121378): Do not show IRI custom manifests in the disconnected UI (#4048) [#4048](https://github.com/openshift-assisted/assisted-installer-ui/pull/4048)
* chore(deps): update dependency axios to ^1.20.0 (#4047) [#4047](https://github.com/openshift-assisted/assisted-installer-ui/pull/4047)
* chore(deps): update dependency dompurify to ^3.4.15 (#4046) [#4046](https://github.com/openshift-assisted/assisted-installer-ui/pull/4046)
* Bump js-yaml from 4.3.1 to 4.3.2 (#4034) [#4034](https://github.com/openshift-assisted/assisted-installer-ui/pull/4034)
* Bump react-router from 7.18.1 to 7.18.2 (#4036) [#4036](https://github.com/openshift-assisted/assisted-installer-ui/pull/4036)
* [OCPBUGS-115122](https://issues.redhat.com/browse/OCPBUGS-115122): Show IPv6 Technology Preview badge in Subnets dropdown for single-cluster only (#4013) [#4013](https://github.com/openshift-assisted/assisted-installer-ui/pull/4013)
* Bump vitest from 3.2.6 to 4.1.11 (#4035) [#4035](https://github.com/openshift-assisted/assisted-installer-ui/pull/4035)
* Bump joi from 17.13.4 to 17.13.7 (#4033) [#4033](https://github.com/openshift-assisted/assisted-installer-ui/pull/4033)
* [OCPBUGS-121366](https://issues.redhat.com/browse/OCPBUGS-121366): Move IPv6 Technology Preview badge out of the header (#4027) [#4027](https://github.com/openshift-assisted/assisted-installer-ui/pull/4027)
* Remove stale OCM_REFRESH_TOKEN code (#4012) [#4012](https://github.com/openshift-assisted/assisted-installer-ui/pull/4012)
* chore(deps): update dependency postcss to ^8.5.28 (#4021) [#4021](https://github.com/openshift-assisted/assisted-installer-ui/pull/4021)
* chore(deps): update konflux references (#4020) [#4020](https://github.com/openshift-assisted/assisted-installer-ui/pull/4020)
* Change reuse SSH key label in OVE (#4018) [#4018](https://github.com/openshift-assisted/assisted-installer-ui/pull/4018)
* Bump qs from 6.15.3 to 6.16.0 (#4011) [#4011](https://github.com/openshift-assisted/assisted-installer-ui/pull/4011)
* Bump fflate from 0.4.8 to 0.4.9 (#4017) [#4017](https://github.com/openshift-assisted/assisted-installer-ui/pull/4017)
* [MGMT-25128](https://issues.redhat.com/browse/MGMT-25128): Assisted Installer UI (above-the-sea) adjustment to 4.22 GA (#3996) [#3996](https://github.com/openshift-assisted/assisted-installer-ui/pull/3996)
* Bump fast-uri from 3.1.5 to 3.1.7 (#4010) [#4010](https://github.com/openshift-assisted/assisted-installer-ui/pull/4010)
* Bump browserslist from 4.28.2 to 4.28.8 (#4007) [#4007](https://github.com/openshift-assisted/assisted-installer-ui/pull/4007)
* Bump postcss-selector-parser from 7.1.1 to 7.1.5 (#4006) [#4006](https://github.com/openshift-assisted/assisted-installer-ui/pull/4006)
* [Full changelog](https://github.com/openshift-assisted/assisted-installer-ui/compare/334b4c7dddb57092420af626e92e6a750d6c2afb...58e24601e5d0769ba95de52032ceb6bf7db0c144)
### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/f952dce298d6788f289e3ef95efa89d5ef1c9a3f)
* [AGENT-1565](https://issues.redhat.com/browse/AGENT-1565): Add OVE 4.22 tekton file to agent-installer-utils [#320](https://github.com/openshift/agent-installer-utils/pull/320)
* [AGENT-1629](https://issues.redhat.com/browse/AGENT-1629): Add --fips flag to the OVE ISO builder script [#356](https://github.com/openshift/agent-installer-utils/pull/356)
* [OCPBUGS-111468](https://issues.redhat.com/browse/OCPBUGS-111468): prefix-validate URLs used in commands [#349](https://github.com/openshift/agent-installer-utils/pull/349)
* [OCPBUGS-111479](https://issues.redhat.com/browse/OCPBUGS-111479): Quote variable expansion in `skopeo inspect` invocation [#348](https://github.com/openshift/agent-installer-utils/pull/348)
* [OCPBUGS-63475](https://issues.redhat.com/browse/OCPBUGS-63475): Refresh rendezvous IP selection list [#345](https://github.com/openshift/agent-installer-utils/pull/345)
* [OCPBUGS-123720](https://issues.redhat.com/browse/OCPBUGS-123720): Fix agent TUI timeout [#346](https://github.com/openshift/agent-installer-utils/pull/346)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/49322a1138a1a5cbcf7cbe58d78852b22a055fdd...f952dce298d6788f289e3ef95efa89d5ef1c9a3f)
### [agentic-skills](https://github.com/openshift/agentic-skills/tree/3a5f379af6a0a0a6a5cb56c5d224743bb901c28f)
* NO-ISSUE: Gitops skills updated [#66](https://github.com/openshift/agentic-skills/pull/66)
* [OBSINTA-1732](https://issues.redhat.com/browse/OBSINTA-1732): investigate-alerts skill - initialize Prometheus access on demand and other improvements [#59](https://github.com/openshift/agentic-skills/pull/59)
* [GITOPS-11460](https://issues.redhat.com/browse/GITOPS-11460): Add argo team onboard skill [#54](https://github.com/openshift/agentic-skills/pull/54)
* [GITOPS-11457](https://issues.redhat.com/browse/GITOPS-11457), [GITOPS-11458](https://issues.redhat.com/browse/GITOPS-11458): Add argo-operations and argo-repo-audit skills [#53](https://github.com/openshift/agentic-skills/pull/53)
* [GITOPS-11459](https://issues.redhat.com/browse/GITOPS-11459): Add argo-cluster-debug Skill Knowledge [#55](https://github.com/openshift/agentic-skills/pull/55)
* [GITOPS-10499](https://issues.redhat.com/browse/GITOPS-10499): Add Argo knowledge skill [#38](https://github.com/openshift/agentic-skills/pull/38)
* [Full changelog](https://github.com/openshift/agentic-skills/compare/7aca4bee317cd70a4204795db6b1d7b9eb78f48c...3a5f379af6a0a0a6a5cb56c5d224743bb901c28f)
### [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy/tree/ee1167a208561c55485453d9237036c6ab37cb73)
* [CNTRLPLANE-4019](https://issues.redhat.com/browse/CNTRLPLANE-4019): Merge upstream master (4f8517c1) into main [#116](https://github.com/openshift/apiserver-network-proxy/pull/116)
* [Full changelog](https://github.com/openshift/apiserver-network-proxy/compare/d6ec9243d24050d7d7ad7f939e45f821171f000e...ee1167a208561c55485453d9237036c6ab37cb73)
### [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws/tree/6951d70c670c52b37606fa1fab73f713677135ac)
* [OCPCLOUD-3684](https://issues.redhat.com/browse/OCPCLOUD-3684): Merge https://github.com/kubernetes/cloud-provider-aws/tree/master (c87c679) into main [#191](https://github.com/openshift/cloud-provider-aws/pull/191)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes/cloud-provider-aws:master (853eb04) into main [#162](https://github.com/openshift/cloud-provider-aws/pull/162)
* [Full changelog](https://github.com/openshift/cloud-provider-aws/compare/278e8c07a72a50e7d3f28fc743c38c64f008f5aa...6951d70c670c52b37606fa1fab73f713677135ac)
### [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws/tree/801828ccdcdb90aa6714baace313a1bd9572115f)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws/tree/v2.13.1 (6883178) into main [#664](https://github.com/openshift/cluster-api-provider-aws/pull/664)
* [OCPBUGS-128249](https://issues.redhat.com/browse/OCPBUGS-128249): UPSTREAM: <carry>: remove redundant GitHub summary verification [#658](https://github.com/openshift/cluster-api-provider-aws/pull/658)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#636](https://github.com/openshift/cluster-api-provider-aws/pull/636)
* NO-JIRA: UPSTREAM: <drop>: update manifests-gen [#657](https://github.com/openshift/cluster-api-provider-aws/pull/657)
* NO-JIRA: fix(make): verify generated summary from pull request revision [#656](https://github.com/openshift/cluster-api-provider-aws/pull/656)
* 🌱 NO-JIRA: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI [#632](https://github.com/openshift/cluster-api-provider-aws/pull/632)
* [Full changelog](https://github.com/openshift/cluster-api-provider-aws/compare/e345a83efda50037cd59ae0741a62cf7169f5def...801828ccdcdb90aa6714baace313a1bd9572115f)
### [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver/tree/6c2222d12860b8d48352cf9effec9cda28b1ecbe)
* [STOR-3072](https://issues.redhat.com/browse/STOR-3072): Rebase to upstream v1.65.0 for OCP 5.1 [#347](https://github.com/openshift/aws-ebs-csi-driver/pull/347)
* NO-ISSUE: Address CVE-2026-33814 [#354](https://github.com/openshift/aws-ebs-csi-driver/pull/354)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#331](https://github.com/openshift/aws-ebs-csi-driver/pull/331)
* [Full changelog](https://github.com/openshift/aws-ebs-csi-driver/compare/8b8c4cef02ec9b670e2709f2aacc0ed72420be90...6c2222d12860b8d48352cf9effec9cda28b1ecbe)
### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, gcp-pd-csi-driver-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/206342b1bbd2d7b017a06f4a03dc679ca2c47c2c)
* [STOR-3210](https://issues.redhat.com/browse/STOR-3210): Enable Online Expansion tests for Azure Disk [#650](https://github.com/openshift/csi-operator/pull/650)
* [STOR-3173](https://issues.redhat.com/browse/STOR-3173): Configure TLS groups for OLM-managed operators [#654](https://github.com/openshift/csi-operator/pull/654)
* [STOR-3176](https://issues.redhat.com/browse/STOR-3176): Support TLS Groups in operators for kube-rbac-proxy sidecar [#651](https://github.com/openshift/csi-operator/pull/651)
* [STOR-3068](https://issues.redhat.com/browse/STOR-3068): Bump all libraries [#646](https://github.com/openshift/csi-operator/pull/646)
* [OCPBUGS-120762](https://issues.redhat.com/browse/OCPBUGS-120762): restrict azure-file secrets ClusterRole to get and create verbs [#639](https://github.com/openshift/csi-operator/pull/639)
* [STOR-3141](https://issues.redhat.com/browse/STOR-3141), [STOR-3142](https://issues.redhat.com/browse/STOR-3142): EFS, Samba: Ship Network Policies in the operator bundle [#629](https://github.com/openshift/csi-operator/pull/629)
* [OCPBUGS-127462](https://issues.redhat.com/browse/OCPBUGS-127462): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#638](https://github.com/openshift/csi-operator/pull/638)
* [OCPBUGS-88301](https://issues.redhat.com/browse/OCPBUGS-88301): Remove redundant delete role verb [#620](https://github.com/openshift/csi-operator/pull/620)
* [OCPBUGS-113538](https://issues.redhat.com/browse/OCPBUGS-113538): Enable SELinuxMount tests [#605](https://github.com/openshift/csi-operator/pull/605)
* [STOR-3074](https://issues.redhat.com/browse/STOR-3074): Bump OLM metadata to 5.1 [#627](https://github.com/openshift/csi-operator/pull/627)
* [OCPBUGS-112272](https://issues.redhat.com/browse/OCPBUGS-112272): node ServiceMonitor serverName uses guest namespace on HyperShift [#603](https://github.com/openshift/csi-operator/pull/603)
* [OCPBUGS-115269](https://issues.redhat.com/browse/OCPBUGS-115269): openstack-manila: Consume CA cert from CCO secret [#617](https://github.com/openshift/csi-operator/pull/617)
* NO-JIRA: Add reference to cluster-storage-operator in AGENTS.md [#616](https://github.com/openshift/csi-operator/pull/616)
* [STOR-3090](https://issues.redhat.com/browse/STOR-3090): Enable pod-delete-after-umount CSI suite for driver OCP manifests [#596](https://github.com/openshift/csi-operator/pull/596)
* [OCPBUGS-120667](https://issues.redhat.com/browse/OCPBUGS-120667): fix(gcp-pd): don't apply guest-cluster resources against the management cluster on HyperShift [#618](https://github.com/openshift/csi-operator/pull/618)
* [Full changelog](https://github.com/openshift/csi-operator/compare/857bbb16fa89b0b531e27ed0fc0eaa1e94efecb6...206342b1bbd2d7b017a06f4a03dc679ca2c47c2c)
### [aws-karpenter-provider-aws](https://github.com/openshift/aws-karpenter-provider-aws/tree/aa136f7fdc38fb6d55888a2d623fed08ea73dfb7)
* NO-JIRA: Update Karpenter owner aliases [#50](https://github.com/openshift/aws-karpenter-provider-aws/pull/50)
* [OCPBUGS-85090](https://issues.redhat.com/browse/OCPBUGS-85090): Align simulated with actual allocatable resources [#46](https://github.com/openshift/aws-karpenter-provider-aws/pull/46)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#44](https://github.com/openshift/aws-karpenter-provider-aws/pull/44)
* [AUTOSCALE-904](https://issues.redhat.com/browse/AUTOSCALE-904): Add agentic SDLC artifacts to aws-karpenter-provider-aws [#41](https://github.com/openshift/aws-karpenter-provider-aws/pull/41)
* [OCPBUGS-85085](https://issues.redhat.com/browse/OCPBUGS-85085): default max-pods to 250 for Custom AMI family [#40](https://github.com/openshift/aws-karpenter-provider-aws/pull/40)
* [Full changelog](https://github.com/openshift/aws-karpenter-provider-aws/compare/dc822233cc526b6cc55f20009a4c1b034f245133...aa136f7fdc38fb6d55888a2d623fed08ea73dfb7)
### [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider/tree/f4d8aaa238a39279f90263de662eca89a52236d6)
* [OCPBUGS-124534](https://issues.redhat.com/browse/OCPBUGS-124534): Bump grpc-go to v1.83.2 [#55](https://github.com/openshift/aws-encryption-provider/pull/55)
* [Full changelog](https://github.com/openshift/aws-encryption-provider/compare/9b18930d2db9521a08faa7165488bdcf6482b9cf...f4d8aaa238a39279f90263de662eca89a52236d6)
### [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws/tree/456653e63c05ab78f31d0191a4a488b68d9b5eef)
* [OCPCLOUD-3661](https://issues.redhat.com/browse/OCPCLOUD-3661): bump to Kubernetes 1.37 [#227](https://github.com/openshift/machine-api-provider-aws/pull/227)
* [OCPBUGS-126179](https://issues.redhat.com/browse/OCPBUGS-126179): Fixed dedicated host tests to check for machineset to exist [#217](https://github.com/openshift/machine-api-provider-aws/pull/217)
* [Full changelog](https://github.com/openshift/machine-api-provider-aws/compare/9f2e9b3c46b391c7219257a426ad80ca8a296af0...456653e63c05ab78f31d0191a4a488b68d9b5eef)
### [aws-node-termination-handler](https://github.com/openshift/aws-node-termination-handler/tree/b64c6ab9cec07965ad6688096822cce17338f089)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#15](https://github.com/openshift/aws-node-termination-handler/pull/15)
* [Full changelog](https://github.com/openshift/aws-node-termination-handler/compare/e4ff2aaec292db42de9f3eef4908ba1c421a2a6c...b64c6ab9cec07965ad6688096822cce17338f089)
### [azure-cloud-controller-manager, azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure/tree/c66a908826575f8f88e750822fbe9c2afdbdb49a)
* [OCPCLOUD-3676](https://issues.redhat.com/browse/OCPCLOUD-3676): Merge https://github.com/kubernetes-sigs/cloud-provider-azure/tree/release-1.37 (6e6e09b) into main [#200](https://github.com/openshift/cloud-provider-azure/pull/200)
* [OCPBUGS-105320](https://issues.redhat.com/browse/OCPBUGS-105320): skip public ip check for azure stack [#203](https://github.com/openshift/cloud-provider-azure/pull/203)
* [Full changelog](https://github.com/openshift/cloud-provider-azure/compare/b99e4ce4ff5c2665b273384b0673824833c40ce5...c66a908826575f8f88e750822fbe9c2afdbdb49a)
### [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure/tree/1621a6f14ae1f7dfafa12a1cc616cca176048034)
* [OCPBUGS-129622](https://issues.redhat.com/browse/OCPBUGS-129622): Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:release-1.27 (8c829ce) into main [#420](https://github.com/openshift/cluster-api-provider-azure/pull/420)
* [OCPCLOUD-3690](https://issues.redhat.com/browse/OCPCLOUD-3690): Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.27.0 (3d9e0c3) into main [#412](https://github.com/openshift/cluster-api-provider-azure/pull/412)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#413](https://github.com/openshift/cluster-api-provider-azure/pull/413)
* [Full changelog](https://github.com/openshift/cluster-api-provider-azure/compare/63731729974bff3be90ae2206c53d760572499d1...1621a6f14ae1f7dfafa12a1cc616cca176048034)
### [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver/tree/4f38fc62865498f7c28dca88f3d28fea0395799a)
* [TRT-3028](https://issues.redhat.com/browse/TRT-3028): UPSTREAM: <drop>: Revert "STOR-3077: Rebase to v1.36.0 for OCP 5.1" [#187](https://github.com/openshift/azure-disk-csi-driver/pull/187)
* [STOR-3077](https://issues.redhat.com/browse/STOR-3077): Rebase to v1.36.0 for OCP 5.1 [#182](https://github.com/openshift/azure-disk-csi-driver/pull/182)
* NO-JIRA: Add coderabbit config [#183](https://github.com/openshift/azure-disk-csi-driver/pull/183)
* [OCPBUGS-111076](https://issues.redhat.com/browse/OCPBUGS-111076): UPSTREAM: 3754: chore: upgrade Azure cloud provider lib- [#180](https://github.com/openshift/azure-disk-csi-driver/pull/180)
* [Full changelog](https://github.com/openshift/azure-disk-csi-driver/compare/c5e303bb0c6a55332637d7a583cfceec1a3a900b...4f38fc62865498f7c28dca88f3d28fea0395799a)
### [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver/tree/505f5a9465873952d8e80acbb7c8a9c37a7b921e)
* [STOR-3082](https://issues.redhat.com/browse/STOR-3082): Rebase to v1.35.10 for OCP 5.1 [#170](https://github.com/openshift/azure-file-csi-driver/pull/170)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#167](https://github.com/openshift/azure-file-csi-driver/pull/167)
* [Full changelog](https://github.com/openshift/azure-file-csi-driver/compare/9689f03011ce700b3bffc32791af839e80d0e0ab...505f5a9465873952d8e80acbb7c8a9c37a7b921e)
### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/4bbe983bea2d88b643fe756b8e013964fa312f0b)
* [OCPBUGS-124531](https://issues.redhat.com/browse/OCPBUGS-124531): Bump grpc-go to v1.83.2 [#65](https://github.com/openshift/azure-kubernetes-kms/pull/65)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#64](https://github.com/openshift/azure-kubernetes-kms/pull/64)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/21fc3813f6cc12ce6246531891b5ad395e2afaad...4bbe983bea2d88b643fe756b8e013964fa312f0b)
### [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure/tree/0f6806316355ad37eb606d6ab74b0cf76a2efebe)
* [OCPBUGS-127058](https://issues.redhat.com/browse/OCPBUGS-127058): Azure DualStack: Update Load Balancer backend pool matching for IPv6 [#221](https://github.com/openshift/machine-api-provider-azure/pull/221)
* [OCPCLOUD-3663](https://issues.redhat.com/browse/OCPCLOUD-3663): bump Kubernetes dependencies to 1.37 [#220](https://github.com/openshift/machine-api-provider-azure/pull/220)
* [Full changelog](https://github.com/openshift/machine-api-provider-azure/compare/4ba9605f3a9af6ddc31afb86a95439454fdd2965...0f6806316355ad37eb606d6ab74b0cf76a2efebe)
### [azure-service-operator](https://github.com/openshift/azure-service-operator/tree/b371cd0419df01d984977779a729a098ed24b24d)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#47](https://github.com/openshift/azure-service-operator/pull/47)
* [Full changelog](https://github.com/openshift/azure-service-operator/compare/0611cd27b9eaa4a1fa8e0ab8ddc85352a61903e0...b371cd0419df01d984977779a729a098ed24b24d)
### [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity/tree/3f118b30e806a344c9fbc08245fea677a9979cad)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#69](https://github.com/openshift/azure-workload-identity/pull/69)
* [OCPBUGS-123198](https://issues.redhat.com/browse/OCPBUGS-123198): Bump golang.org/x/net to v0.53.0 to address CVE-2026-33814 [#70](https://github.com/openshift/azure-workload-identity/pull/70)
* [Full changelog](https://github.com/openshift/azure-workload-identity/compare/2b4705c5d999339ce17d47a9b2a637d238891dae...3f118b30e806a344c9fbc08245fea677a9979cad)
### [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3/tree/173713b1dd209ec9a7844997b06c06b383ec0ed7)
* [OCPBUGS-135071](https://issues.redhat.com/browse/OCPBUGS-135071): fix: preserve standalone remediation CRDs when BareMetal machine management is disabled [#117](https://github.com/openshift/cluster-api-provider-metal3/pull/117)
* [OCPBUGS-132229](https://issues.redhat.com/browse/OCPBUGS-132229): UPSTREAM: 3440: Bump x/net to v0.55.0 [#113](https://github.com/openshift/cluster-api-provider-metal3/pull/113)
* [OCPBUGS-128431](https://issues.redhat.com/browse/OCPBUGS-128431): Go HTTP/2: Denial of Service via malformed PRIORITY_UPDATE frame - CVE-2026-33814 [#110](https://github.com/openshift/cluster-api-provider-metal3/pull/110)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#107](https://github.com/openshift/cluster-api-provider-metal3/pull/107)
* [Full changelog](https://github.com/openshift/cluster-api-provider-metal3/compare/ad4f1c2bd7b527437496b71b5b93ee1439243d65...173713b1dd209ec9a7844997b06c06b383ec0ed7)
### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/f13cbf3931807e3dda28778b3c5024ba242bbcbc)
* [MULTIARCH-6330](https://issues.redhat.com/browse/MULTIARCH-6330): Installer: Modify IBMPowerVSCluster manifest to switch to PowerVS DHCP subnet [#11030](https://github.com/openshift/installer/pull/11030)
* [MULTIARCH-6014](https://issues.redhat.com/browse/MULTIARCH-6014): PowerVS: Use PowerVS Stock Catalogue Images [#10647](https://github.com/openshift/installer/pull/10647)
* [MULTIARCH-6455](https://issues.redhat.com/browse/MULTIARCH-6455): Update CAPIBM to v0.15.2, CAPV (vsphere) to 1.17.0 and CAPI to v1.14.0 [#10902](https://github.com/openshift/installer/pull/10902)
* [SPLAT-2981](https://issues.redhat.com/browse/SPLAT-2981): drop Azure diskSetup gate test ahead of promotion [#11035](https://github.com/openshift/installer/pull/11035)
* [OCPBUGS-122924](https://issues.redhat.com/browse/OCPBUGS-122924): Default IngressController to Modern TLS [#10875](https://github.com/openshift/installer/pull/10875)
* [OCPBUGS-133483](https://issues.redhat.com/browse/OCPBUGS-133483): PowerVC: fix two issues with cherry-pick 10966 [#11027](https://github.com/openshift/installer/pull/11027)
* [OCPBUGS-132853](https://issues.redhat.com/browse/OCPBUGS-132853): [Azure] Fix nil error wrap in getNextAvailableIPForLoadBalancer [#11019](https://github.com/openshift/installer/pull/11019)
* [OCPBUGS-129425](https://issues.redhat.com/browse/OCPBUGS-129425), [OCPBUGS-94441](https://issues.redhat.com/browse/OCPBUGS-94441): bump upi-installer base image to RHEL 10 [#10715](https://github.com/openshift/installer/pull/10715)
* [RFE-8788](https://issues.redhat.com/browse/RFE-8788): Update installer to accept Capacity Group Reservation IDs for Azure [#10102](https://github.com/openshift/installer/pull/10102)
* [OCPBUGS-127058](https://issues.redhat.com/browse/OCPBUGS-127058): Azure DualStack: Rename IPv6 Backend pools [#10998](https://github.com/openshift/installer/pull/10998)
* [SPLAT-3016](https://issues.redhat.com/browse/SPLAT-3016): multi-disk: disallow system mount paths for user-defined disks [#11021](https://github.com/openshift/installer/pull/11021)
* [OCPBUGS-130398](https://issues.redhat.com/browse/OCPBUGS-130398): PowerVC: Support non admin user [#10966](https://github.com/openshift/installer/pull/10966)
* [OCPBUGS-126133](https://issues.redhat.com/browse/OCPBUGS-126133): CVE-2026-84445: Bump google.golang.org/grpc to v1.83.2 [#10936](https://github.com/openshift/installer/pull/10936)
* [OPNET-810](https://issues.redhat.com/browse/OPNET-810): deps: bump openshift/api and Kubernetes packages to 1.37 [#10985](https://github.com/openshift/installer/pull/10985)
* [OCPBUGS-132573](https://issues.redhat.com/browse/OCPBUGS-132573): azure: omit empty machine security profiles [#10960](https://github.com/openshift/installer/pull/10960)
* [OPNET-810](https://issues.redhat.com/browse/OPNET-810): baremetal: align bgpVIPConfig peer fields with the BGPVIPConfig CRD [#10931](https://github.com/openshift/installer/pull/10931)
* [OCPBUGS-132208](https://issues.redhat.com/browse/OCPBUGS-132208): unconfigured-ignition must include nmstateconfig.yaml when present [#11010](https://github.com/openshift/installer/pull/11010)
* [OCPBUGS-130604](https://issues.redhat.com/browse/OCPBUGS-130604), [OCPBUGS-132034](https://issues.redhat.com/browse/OCPBUGS-132034): azure: set up data disks via the LUN link and other validation gaps [#10975](https://github.com/openshift/installer/pull/10975)
* [OKD-507](https://issues.redhat.com/browse/OKD-507): Update SCOS bootimage metadata to 10.0.20261014-0 [#10864](https://github.com/openshift/installer/pull/10864)
* [OCPBUGS-131836](https://issues.redhat.com/browse/OCPBUGS-131836): support InfraEnv AdditionalNTPSources in unconfigured-ignition [#10996](https://github.com/openshift/installer/pull/10996)
* no-jira: lint: define constants for aws subnet scope strings [#10984](https://github.com/openshift/installer/pull/10984)
* [SPLAT-2981](https://issues.redhat.com/browse/SPLAT-2981): decouple multidisk gates [#10939](https://github.com/openshift/installer/pull/10939)
* [OCPBUGS-85811](https://issues.redhat.com/browse/OCPBUGS-85811): Add omitzero to the AWS vpc field [#10977](https://github.com/openshift/installer/pull/10977)
* [OCPBUGS-127102](https://issues.redhat.com/browse/OCPBUGS-127102): Add internalJoinSubnet to installConfigOverrides [#10963](https://github.com/openshift/installer/pull/10963)
* [OCPBUGS-127058](https://issues.redhat.com/browse/OCPBUGS-127058): Azure DualStack: Allow IPv6 CIDRs to be provided first [#10954](https://github.com/openshift/installer/pull/10954)
* [OCPBUGS-129534](https://issues.redhat.com/browse/OCPBUGS-129534): golangci: avoid var-naming package-name flake [#10953](https://github.com/openshift/installer/pull/10953)
* [CORS-4689](https://issues.redhat.com/browse/CORS-4689): aws: update CAPA controller to v2.12.1 [#10949](https://github.com/openshift/installer/pull/10949)
* [SPLAT-2976](https://issues.redhat.com/browse/SPLAT-2976): multi-disk close install-config validation gaps [#10934](https://github.com/openshift/installer/pull/10934)
* [TRT-3001](https://issues.redhat.com/browse/TRT-3001): Revert #10152 "OCPBUGS-76925: Update no_proxy list to include AWS DNS resolver for UserProvisionedDNS" [#10951](https://github.com/openshift/installer/pull/10951)
* [OCPBUGS-127394](https://issues.redhat.com/browse/OCPBUGS-127394): Removed PowerVS InstallConfig debug log statement exposing sensitive information [#10898](https://github.com/openshift/installer/pull/10898)
* [OCPBUGS-128718](https://issues.redhat.com/browse/OCPBUGS-128718): validate AssignIpv6AddressOnCreation on BYO subnets for DualStackIPv4Primary [#10933](https://github.com/openshift/installer/pull/10933)
* [OCPBUGS-76925](https://issues.redhat.com/browse/OCPBUGS-76925): Update no_proxy list to include AWS DNS resolver for UserProvisionedDNS [#10152](https://github.com/openshift/installer/pull/10152)
* [OCPBUGS-105321](https://issues.redhat.com/browse/OCPBUGS-105321): pki: switch to ECDSA defaults and thread PKI profile to leaf certs [#10743](https://github.com/openshift/installer/pull/10743)
* [OCPBUGS-127240](https://issues.redhat.com/browse/OCPBUGS-127240): gcp: restrict global KMS location check to defaultMachinePlatform [#10907](https://github.com/openshift/installer/pull/10907)
* [OCPBUGS-115159](https://issues.redhat.com/browse/OCPBUGS-115159): aws: provision dedicated IAM resources for edge compute pool [#10836](https://github.com/openshift/installer/pull/10836)
* [OKD-194](https://issues.redhat.com/browse/OKD-194): Add OKD cincinnati as the default update service for OKD [#10834](https://github.com/openshift/installer/pull/10834)
* [OCPBUGS-126706](https://issues.redhat.com/browse/OCPBUGS-126706): azure: allow isolated Ebdsv5/Ebsv5 VM families [#10888](https://github.com/openshift/installer/pull/10888)
* [OCPBUGS-115550](https://issues.redhat.com/browse/OCPBUGS-115550): use different INSTALL_INVOKER for unconfigured ignition [#10848](https://github.com/openshift/installer/pull/10848)
* [OCPBUGS-99762](https://issues.redhat.com/browse/OCPBUGS-99762): retry Azure bootstrap ignition upload [#10835](https://github.com/openshift/installer/pull/10835)
* [OCPBUGS-90536](https://issues.redhat.com/browse/OCPBUGS-90536): openstack: Guard network resource names on `os_net_id` being defined [#10639](https://github.com/openshift/installer/pull/10639)
* [OCPBUGS-123770](https://issues.redhat.com/browse/OCPBUGS-123770): Inject the pull-secret as podman secret in the agent-installer-ui container [#10882](https://github.com/openshift/installer/pull/10882)
* [OCPBUGS-112483](https://issues.redhat.com/browse/OCPBUGS-112483): use api-int record for ignition host when using externally managed LB and DNS [#10860](https://github.com/openshift/installer/pull/10860)
* no-jira: aws: fetch instance type on demand instead of listing all [#10851](https://github.com/openshift/installer/pull/10851)
* [OCPBUGS-61892](https://issues.redhat.com/browse/OCPBUGS-61892): fix swap disk nil-panic and block swap on control plane [#10859](https://github.com/openshift/installer/pull/10859)
* [OCPBUGS-59743](https://issues.redhat.com/browse/OCPBUGS-59743): azure: reject data disks on Azure Stack Hub [#10823](https://github.com/openshift/installer/pull/10823)
* [OCPBUGS-86133](https://issues.redhat.com/browse/OCPBUGS-86133): dont allow duplicate failure domains and fields [#10741](https://github.com/openshift/installer/pull/10741)
* [OCPBUGS-91640](https://issues.redhat.com/browse/OCPBUGS-91640): Warn about ignored install-config fields in ABI [#10646](https://github.com/openshift/installer/pull/10646)
* [OCPBUGS-114375](https://issues.redhat.com/browse/OCPBUGS-114375): azure: skip AppendVarPartition when DiskSetup provides a user-defined /var mount [#10818](https://github.com/openshift/installer/pull/10818)
* [OCPBUGS-115187](https://issues.redhat.com/browse/OCPBUGS-115187): Gather master only from primary IP on baremetal [#10838](https://github.com/openshift/installer/pull/10838)
* [OCPBUGS-114882](https://issues.redhat.com/browse/OCPBUGS-114882): OCPBUGS-112662: GCD load balancer health-check firewall ranges [#10850](https://github.com/openshift/installer/pull/10850)
* [SPLAT-2923](https://issues.redhat.com/browse/SPLAT-2923): vsphere: retry and throttle vCenter lookups during UPI VM creation [#10847](https://github.com/openshift/installer/pull/10847)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/installer/compare/c8d299965fc1527648ce7aeb368c198a7b28e85d...f13cbf3931807e3dda28778b3c5024ba242bbcbc)
### [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal/tree/51bc686e528a7c831f49c0057bed244fa24bbbb0)
* [OCPCLOUD-3709](https://issues.redhat.com/browse/OCPCLOUD-3709): feat(tls): support remediation webhook curve preferences [#283](https://github.com/openshift/cluster-api-provider-baremetal/pull/283)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#278](https://github.com/openshift/cluster-api-provider-baremetal/pull/278)
* [OCPBUGS-123730](https://issues.redhat.com/browse/OCPBUGS-123730): Bump golang.org/x/net to v0.58.0 to address CVE-2026-33814 [#279](https://github.com/openshift/cluster-api-provider-baremetal/pull/279)
* [OCPBUGS-112338](https://issues.redhat.com/browse/OCPBUGS-112338): Fix race that can provision multiple hosts [#275](https://github.com/openshift/cluster-api-provider-baremetal/pull/275)
* [Full changelog](https://github.com/openshift/cluster-api-provider-baremetal/compare/f2b0db1919fff1344bc68948894c6775c0bf24a3...51bc686e528a7c831f49c0057bed244fa24bbbb0)
### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/257604b553932dbfe490df459db29a42b781f7a5)
* [METAL-1980](https://issues.redhat.com/browse/METAL-1980): Merge upstream [#529](https://github.com/openshift/baremetal-operator/pull/529)
* [OCPBUGS-120721](https://issues.redhat.com/browse/OCPBUGS-120721): Test int64 BIOS bounds [#528](https://github.com/openshift/baremetal-operator/pull/528)
* [OCPBUGS-120721](https://issues.redhat.com/browse/OCPBUGS-120721): Bump gophercloud to v2.15.0 [#527](https://github.com/openshift/baremetal-operator/pull/527)
* [OCPBUGS-121877](https://issues.redhat.com/browse/OCPBUGS-121877): pull in gophercloud fix for fast inspection [#525](https://github.com/openshift/baremetal-operator/pull/525)
* [OCPBUGS-122043](https://issues.redhat.com/browse/OCPBUGS-122043), [OCPBUGS-91736](https://issues.redhat.com/browse/OCPBUGS-91736): Merge upstream [#524](https://github.com/openshift/baremetal-operator/pull/524)
* NO-ISSUE: Merge upstream 2026-09-03 [#523](https://github.com/openshift/baremetal-operator/pull/523)
* NO-ISSUE: Restore .golangci.yaml downstream [#522](https://github.com/openshift/baremetal-operator/pull/522)
* [Full changelog](https://github.com/openshift/baremetal-operator/compare/34bbeb376836bf01793d4e70d29065d619ebcaa1...257604b553932dbfe490df459db29a42b781f7a5)
### [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg/tree/145ef72c22b7a52aa28134fda17226a44a80935e)
* [OCPEDGE-3080](https://issues.redhat.com/browse/OCPEDGE-3080): Allow no DNS upstreams [#420](https://github.com/openshift/baremetal-runtimecfg/pull/420)
* [OCPEDGE-3080](https://issues.redhat.com/browse/OCPEDGE-3080): Introduce --discover-node-ip for SNO CoreDNS [#417](https://github.com/openshift/baremetal-runtimecfg/pull/417)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#415](https://github.com/openshift/baremetal-runtimecfg/pull/415)
* [OCPBUGS-98258](https://issues.redhat.com/browse/OCPBUGS-98258): Cloud Platforms: Filter out node's own IP from Upstreams [#399](https://github.com/openshift/baremetal-runtimecfg/pull/399)
* [Full changelog](https://github.com/openshift/baremetal-runtimecfg/compare/3057d9978db74dcd5012a293d37d571b524c4e46...145ef72c22b7a52aa28134fda17226a44a80935e)
### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/14498e9ce7fa0fff64e132d96d58ae557f840d36)
* [OCPEDGE-2991](https://issues.redhat.com/browse/OCPEDGE-2991): Read topology transition evaluations from API [#2449](https://github.com/openshift/oc/pull/2449)
* [OCPEDGE-2960](https://issues.redhat.com/browse/OCPEDGE-2960): Update topology subcommand to read transition status from infra api [#2430](https://github.com/openshift/oc/pull/2430)
* NO-JIRA: Rebase to 1.37 and update other dependencies. [#2435](https://github.com/openshift/oc/pull/2435)
* NO-JIRA: Add DS_Store to gitignore file [#2441](https://github.com/openshift/oc/pull/2441)
* : NO-JIRA: fix(set volumes): mention configmap in invalid volume type error [#2437](https://github.com/openshift/oc/pull/2437)
* [OCPBUGS-120725](https://issues.redhat.com/browse/OCPBUGS-120725): Return error when markers are not all replaced [#2429](https://github.com/openshift/oc/pull/2429)
* [OCPBUGS-60768](https://issues.redhat.com/browse/OCPBUGS-60768): properly indent multiline node messages in upgrade status output [#2341](https://github.com/openshift/oc/pull/2341)
* [OCPEDGE-2416](https://issues.redhat.com/browse/OCPEDGE-2416): Add oc adm transition topology command for SNO to HA transitions [#2295](https://github.com/openshift/oc/pull/2295)
* [OCPBUGS-126457](https://issues.redhat.com/browse/OCPBUGS-126457): [oc create route edge --help] Typo in WildcardPolicy option description [#2409](https://github.com/openshift/oc/pull/2409)
* [OCPBUGS-122354](https://issues.redhat.com/browse/OCPBUGS-122354): Fix inconsistent terminology in oc set probe help example [#2404](https://github.com/openshift/oc/pull/2404)
* [OCPBUGS-122036](https://issues.redhat.com/browse/OCPBUGS-122036): docs(env): add deployment example for configmap import in oc set env help [#2401](https://github.com/openshift/oc/pull/2401)
* NO-JIRA: README: Mention gcc as an oc dependency [#2402](https://github.com/openshift/oc/pull/2402)
* [OCPBUGS-122005](https://issues.redhat.com/browse/OCPBUGS-122005): Add IDMS support to `oc image info` [#2397](https://github.com/openshift/oc/pull/2397)
* [OCPBUGS-114015](https://issues.redhat.com/browse/OCPBUGS-114015): Added deployment example to oc set env help command [#2389](https://github.com/openshift/oc/pull/2389)
* NO-JIRA: Move to openshift/osincli [#2386](https://github.com/openshift/oc/pull/2386)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/oc/compare/2902632b849a20d312215e16f2058233f1713553...14498e9ce7fa0fff64e132d96d58ae557f840d36)
### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/a19ed01469ad1e3384df6636f6d9feffe5b1eb15)
* NO-JIRA: Fix staticcheck warnings across multiple packages [#1109](https://github.com/openshift/cloud-credential-operator/pull/1109)
* [CCO-772](https://issues.redhat.com/browse/CCO-772): ccoctl - Add set-upgradeable-to command [#1105](https://github.com/openshift/cloud-credential-operator/pull/1105)
* [CCO-775](https://issues.redhat.com/browse/CCO-775): ccoctl Create custom roles before identity bindings [#1104](https://github.com/openshift/cloud-credential-operator/pull/1104)
* [CCO-771](https://issues.redhat.com/browse/CCO-771): Add ccoctl apply secrets command for AWS, Azure and GCP [#1095](https://github.com/openshift/cloud-credential-operator/pull/1095)
* [OCPBUGS-17664](https://issues.redhat.com/browse/OCPBUGS-17664): Improve error messages for SCP-denied IAM operations [#1084](https://github.com/openshift/cloud-credential-operator/pull/1084)
* [CCO-849](https://issues.redhat.com/browse/CCO-849): bump go toolchain to 1.26.5 to resolve snyk complaints [#1065](https://github.com/openshift/cloud-credential-operator/pull/1065)
* [OCPBUGS-112282](https://issues.redhat.com/browse/OCPBUGS-112282): In testing skip pod-identity-webhook checks on external platform [#1085](https://github.com/openshift/cloud-credential-operator/pull/1085)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/b187feee66f4ce0f992059b21a97a2ae88e4cdd9...a19ed01469ad1e3384df6636f6d9feffe5b1eb15)
### [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller/tree/e4d8b92203f41156a03ea22f7f5a3360483a054c)
* [CORENET-7645](https://issues.redhat.com/browse/CORENET-7645): Add minimal AGENTS.md [#278](https://github.com/openshift/cloud-network-config-controller/pull/278)
* [CORENET-7581](https://issues.redhat.com/browse/CORENET-7581): Bump Kubernetes dependencies to 1.37.1 [#273](https://github.com/openshift/cloud-network-config-controller/pull/273)
* [OCPBUGS-124549](https://issues.redhat.com/browse/OCPBUGS-124549): deps: bump google.golang.org/api and google.golang.org/grpc to v1.84.0 [#275](https://github.com/openshift/cloud-network-config-controller/pull/275)
* [OSASINFRA-4400](https://issues.redhat.com/browse/OSASINFRA-4400): make openstack allowed address pairs configurable [#230](https://github.com/openshift/cloud-network-config-controller/pull/230)
* [OCPBUGS-105398](https://issues.redhat.com/browse/OCPBUGS-105398): refactor: remove Azure workload identity feature gate [#266](https://github.com/openshift/cloud-network-config-controller/pull/266)
* [Full changelog](https://github.com/openshift/cloud-network-config-controller/compare/82bed43e8218e8c22de1b65ccd141096e92685fb...e4d8b92203f41156a03ea22f7f5a3360483a054c)
### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/10ca5a46a8d89c521999b842e306f7276da4fb74)
* NO-JIRA: bump(openshift/library-go): to get retry in preflight check status report [#1045](https://github.com/openshift/cluster-authentication-operator/pull/1045)
* NO-JIRA: Update library-go to run conditional step in KMS [#1043](https://github.com/openshift/cluster-authentication-operator/pull/1043)
* [CNTRLPLANE-4787](https://issues.redhat.com/browse/CNTRLPLANE-4787): Make External OIDC proxy handling more robust [#1036](https://github.com/openshift/cluster-authentication-operator/pull/1036)
* NO-JIRA: Fix staticcheck warnings across multiple packages [#1025](https://github.com/openshift/cluster-authentication-operator/pull/1025)
* NO-JIRA: bump(openshift/library-go): to get KMS GA [#1041](https://github.com/openshift/cluster-authentication-operator/pull/1041)
* [CNTRLPLANE-4787](https://issues.redhat.com/browse/CNTRLPLANE-4787): Reapply: Add support for External OIDC proxy [#1039](https://github.com/openshift/cluster-authentication-operator/pull/1039)
* NO-JIRA: Update library-go to get KMS changes [#1040](https://github.com/openshift/cluster-authentication-operator/pull/1040)
* [TRT-3040](https://issues.redhat.com/browse/TRT-3040): Revert #1001 "CNTRLPLANE-4787: Add support for External OIDC proxy" [#1038](https://github.com/openshift/cluster-authentication-operator/pull/1038)
* [CNTRLPLANE-4787](https://issues.redhat.com/browse/CNTRLPLANE-4787): Add support for External OIDC proxy [#1001](https://github.com/openshift/cluster-authentication-operator/pull/1001)
* [CNTRLPLANE-4519](https://issues.redhat.com/browse/CNTRLPLANE-4519): External OIDC lib go generator [#1018](https://github.com/openshift/cluster-authentication-operator/pull/1018)
* NO-JIRA: Update library-go [#1032](https://github.com/openshift/cluster-authentication-operator/pull/1032)
* [CNTRLPLANE-4731](https://issues.redhat.com/browse/CNTRLPLANE-4731): Add KMSPreflightCycle e2e [#1031](https://github.com/openshift/cluster-authentication-operator/pull/1031)
* NO-JIRA: Update library-go [#1028](https://github.com/openshift/cluster-authentication-operator/pull/1028)
* NO-JIRA: bugfix: external-oidc: omit client-credential TLS generated config when empty [#971](https://github.com/openshift/cluster-authentication-operator/pull/971)
* NO-JIRA: Update library-go [#1027](https://github.com/openshift/cluster-authentication-operator/pull/1027)
* [CNTRLPLANE-4719](https://issues.redhat.com/browse/CNTRLPLANE-4719): deps: Rebase to 1.37 and update other deps [#1024](https://github.com/openshift/cluster-authentication-operator/pull/1024)
* NO-JIRA: bump openshift/api https://github.com/openshift/api/pull/3083 [#1022](https://github.com/openshift/cluster-authentication-operator/pull/1022)
* NO-JIRA: bump library-go https://github.com/openshift/library-go/pull/2518 [#1020](https://github.com/openshift/cluster-authentication-operator/pull/1020)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2512 [#1016](https://github.com/openshift/cluster-authentication-operator/pull/1016)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2474 [#1014](https://github.com/openshift/cluster-authentication-operator/pull/1014)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): encryption/assertion: bring back the preflight assertion for CAO and OAS-O [#1011](https://github.com/openshift/cluster-authentication-operator/pull/1011)
* [CNTRLPLANE-4402](https://issues.redhat.com/browse/CNTRLPLANE-4402): implement new External OIDC architecture under ExternalOIDCAsWebhook feature gate [#1002](https://github.com/openshift/cluster-authentication-operator/pull/1002)
* [OCPBUGS-122888](https://issues.redhat.com/browse/OCPBUGS-122888): Add high contrast support to oauth templates [#999](https://github.com/openshift/cluster-authentication-operator/pull/999)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): bump library-go to get the new KMS plugin deployment strategy [#1004](https://github.com/openshift/cluster-authentication-operator/pull/1004)
* [OCPBUGS-107949](https://issues.redhat.com/browse/OCPBUGS-107949): fix CVE-2026-41178 by updating otel to v1.44.0 [#978](https://github.com/openshift/cluster-authentication-operator/pull/978)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2478 [#1006](https://github.com/openshift/cluster-authentication-operator/pull/1006)
* [OPRUN-4768](https://issues.redhat.com/browse/OPRUN-4768): bump openshift/api [#1005](https://github.com/openshift/cluster-authentication-operator/pull/1005)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2463 [#997](https://github.com/openshift/cluster-authentication-operator/pull/997)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#991](https://github.com/openshift/cluster-authentication-operator/pull/991)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2439 [#987](https://github.com/openshift/cluster-authentication-operator/pull/987)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pick https://github.com/openshift/library-go/pull/2449- #2287 [#985](https://github.com/openshift/cluster-authentication-operator/pull/985)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2451 [#984](https://github.com/openshift/cluster-authentication-operator/pull/984)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): kms: wire EncryptionConfigurationComputer into encryption controllers [#983](https://github.com/openshift/cluster-authentication-operator/pull/983)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/14c33fae096437e8c703d312156d7adf2a8f7e34...10ca5a46a8d89c521999b842e306f7276da4fb74)
### [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler/tree/a819db459f3e0a88becba4c58bf053c6dbda28f2)
* [AUTOSCALE-898](https://issues.redhat.com/browse/AUTOSCALE-898): Add agentic SDLC files [#437](https://github.com/openshift/kubernetes-autoscaler/pull/437)
* [Full changelog](https://github.com/openshift/kubernetes-autoscaler/compare/f393f54229e6c3ae74c35ae72012af92d31c03d3...a819db459f3e0a88becba4c58bf053c6dbda28f2)
### [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator/tree/49d03c60e05e8856dde5a416e01c8512cc824a59)
* [OCPBUGS-130317](https://issues.redhat.com/browse/OCPBUGS-130317): add machinepools to CAPI ClusterRole for autoscaler [#406](https://github.com/openshift/cluster-autoscaler-operator/pull/406)
* [AUTOSCALE-949](https://issues.redhat.com/browse/AUTOSCALE-949): Release chore CAO bump to k8s 1.37 and OCP 5.1 [#404](https://github.com/openshift/cluster-autoscaler-operator/pull/404)
* [AUTOSCALE-709](https://issues.redhat.com/browse/AUTOSCALE-709): implement conditions and authoritative API [#402](https://github.com/openshift/cluster-autoscaler-operator/pull/402)
* [Full changelog](https://github.com/openshift/cluster-autoscaler-operator/compare/e4f426dcd988735d1e49da743240231be6ab6a40...49d03c60e05e8856dde5a416e01c8512cc824a59)
### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/8676940193cd3f76a28d050af39de7bcade0db1e)
* [CNF-22903](https://issues.redhat.com/browse/CNF-22903): Add support for Ironic Networking service [#630](https://github.com/openshift/cluster-baremetal-operator/pull/630)
* [METAL-1934](https://issues.redhat.com/browse/METAL-1934): Add support for feature gates [#663](https://github.com/openshift/cluster-baremetal-operator/pull/663)
* [OCPBUGS-115068](https://issues.redhat.com/browse/OCPBUGS-115068): Validate Provisioning fields passed to containers [#653](https://github.com/openshift/cluster-baremetal-operator/pull/653)
* NO-ISSUE: Add deployment diagrams to README [#680](https://github.com/openshift/cluster-baremetal-operator/pull/680)
* [OCPBUGS-127132](https://issues.redhat.com/browse/OCPBUGS-127132): Pass WATCH_NAMESPACE to image-customization [#666](https://github.com/openshift/cluster-baremetal-operator/pull/666)
* [OCPBUGS-54957](https://issues.redhat.com/browse/OCPBUGS-54957): Remove recreate strategy from BMO deployment [#640](https://github.com/openshift/cluster-baremetal-operator/pull/640)
* Metal-1833: Add attach_non_bootable_iso OTE test [#617](https://github.com/openshift/cluster-baremetal-operator/pull/617)
* [OCPBUGS-115207](https://issues.redhat.com/browse/OCPBUGS-115207): Make HostPath VolumeMounts ReadOnly for image customization container [#658](https://github.com/openshift/cluster-baremetal-operator/pull/658)
* [OCPBUGS-86888](https://issues.redhat.com/browse/OCPBUGS-86888): Fix IDMS YAML serialization for oc image extract [#645](https://github.com/openshift/cluster-baremetal-operator/pull/645)
* [METAL-1833](https://issues.redhat.com/browse/METAL-1833): Add bmo_validations and ncsi_reject_poweroff OTE test [#618](https://github.com/openshift/cluster-baremetal-operator/pull/618)
* [OCPBUGS-115067](https://issues.redhat.com/browse/OCPBUGS-115067): Use bcrypt DefaultCost for Ironic passwords [#650](https://github.com/openshift/cluster-baremetal-operator/pull/650)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/bc67262323fe29fe1793bf7f421e214a2500476f...8676940193cd3f76a28d050af39de7bcade0db1e)
### [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap/tree/641ed6cfb98189f02fe2eb515491ee9de0831136)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#149](https://github.com/openshift/cluster-bootstrap/pull/149)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#146](https://github.com/openshift/cluster-bootstrap/pull/146)
* [CNTRLPLANE-3717](https://issues.redhat.com/browse/CNTRLPLANE-3717): Add Agentic SDLC context files [#133](https://github.com/openshift/cluster-bootstrap/pull/133)
* [CNF-23048](https://issues.redhat.com/browse/CNF-23048): Migrate away from deprecated ioutil [#123](https://github.com/openshift/cluster-bootstrap/pull/123)
* [Full changelog](https://github.com/openshift/cluster-bootstrap/compare/7b1593a47898b6a97dc457efaca464624e9f2afa...641ed6cfb98189f02fe2eb515491ee9de0831136)
### [cluster-capi-controllers](https://github.com/openshift/cluster-api/tree/bb5a4cf7cfb28705a46e25bf26a6d13d0ddb0424)
* [TRT-3024](https://issues.redhat.com/browse/TRT-3024): UPSTREAM: <drop>: Revert "Rebase OpenShift Cluster API onto upstream v1.14.3" [#318](https://github.com/openshift/cluster-api/pull/318)
* [OCPCLOUD-3686](https://issues.redhat.com/browse/OCPCLOUD-3686): Rebase OpenShift Cluster API onto upstream v1.14.3 [#308](https://github.com/openshift/cluster-api/pull/308)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#309](https://github.com/openshift/cluster-api/pull/309)
* NO-JIRA: UPSTREAM: <carry>: remove redundant GitHub summary verification [#313](https://github.com/openshift/cluster-api/pull/313)
* NO-JIRA: UPSTREAM: <drop>: update manifests-gen [#312](https://github.com/openshift/cluster-api/pull/312)
* [OCPCLOUD-1501](https://issues.redhat.com/browse/OCPCLOUD-1501): allow CAPI manager to patch Nodes [#311](https://github.com/openshift/cluster-api/pull/311)
* [OCPCLOUD-1501](https://issues.redhat.com/browse/OCPCLOUD-1501): add OpenShift CAPI manager local cluster RBAC [#310](https://github.com/openshift/cluster-api/pull/310)
* [Full changelog](https://github.com/openshift/cluster-api/compare/303d9786a5017d299b6e7fc702bb92f5cb4550cf...bb5a4cf7cfb28705a46e25bf26a6d13d0ddb0424)
### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/39401fe5b2578309481ea223ecf6f17f58b4ae91)
* [OCPBUGS-135094](https://issues.redhat.com/browse/OCPBUGS-135094): Increase installer unit-test cleanup timeout [#705](https://github.com/openshift/cluster-capi-operator/pull/705)
* [OCPCLOUD-3725](https://issues.redhat.com/browse/OCPCLOUD-3725): refactor: gate legacy tombstones on ClusterAPIOperator [#704](https://github.com/openshift/cluster-capi-operator/pull/704)
* [OCPCLOUD-3726](https://issues.redhat.com/browse/OCPCLOUD-3726): Add scaffolding for Upgradeable controller [#703](https://github.com/openshift/cluster-capi-operator/pull/703)
* [OCPBUGS-135028](https://issues.redhat.com/browse/OCPBUGS-135028): fix: grant installer watch access to cluster configuration [#702](https://github.com/openshift/cluster-capi-operator/pull/702)
* [OCPCLOUD-3725](https://issues.redhat.com/browse/OCPCLOUD-3725): refactor: operator manifests to follow the ClusterAPIOperator feature gate [#701](https://github.com/openshift/cluster-capi-operator/pull/701)
* [OCPBUGS-133479](https://issues.redhat.com/browse/OCPBUGS-133479): Run unmanaged CRD handoff as one extension test [#700](https://github.com/openshift/cluster-capi-operator/pull/700)
* [OCPCLOUD-3545](https://issues.redhat.com/browse/OCPCLOUD-3545): Consume CompatibilityRequirement v1 [#694](https://github.com/openshift/cluster-capi-operator/pull/694)
* [OCPBUGS-133479](https://issues.redhat.com/browse/OCPBUGS-133479): fix(e2e): remove CRD compatibility gate from handoff test [#699](https://github.com/openshift/cluster-capi-operator/pull/699)
* [OCPCLOUD-3725](https://issues.redhat.com/browse/OCPCLOUD-3725): test: separate Cluster API operator health checks from machine management [#698](https://github.com/openshift/cluster-capi-operator/pull/698)
* [OCPBUGS-133416](https://issues.redhat.com/browse/OCPBUGS-133416): fix(openstack): tolerate multiple external networks when no router exists [#697](https://github.com/openshift/cluster-capi-operator/pull/697)
* [OCPCLOUD-3725](https://issues.redhat.com/browse/OCPCLOUD-3725): Support operator no-components mode [#696](https://github.com/openshift/cluster-capi-operator/pull/696)
* [OCPCLOUD-3704](https://issues.redhat.com/browse/OCPCLOUD-3704): Enable CRD Compatibility Checker e2e tests on External topology [#688](https://github.com/openshift/cluster-capi-operator/pull/688)
* [OCPCLOUD-3724](https://issues.redhat.com/browse/OCPCLOUD-3724): Enable proxy injection for capi-controllers [#692](https://github.com/openshift/cluster-capi-operator/pull/692)
* [OCPCLOUD-3655](https://issues.redhat.com/browse/OCPCLOUD-3655): bump Kubernetes dependencies to 1.37 [#686](https://github.com/openshift/cluster-capi-operator/pull/686)
* [OCPCLOUD-3704](https://issues.redhat.com/browse/OCPCLOUD-3704): Enable CRD Compatibility Checker support on Hosted OpenShift independently of Cluster API [#685](https://github.com/openshift/cluster-capi-operator/pull/685)
* [OCPCLOUD-3465](https://issues.redhat.com/browse/OCPCLOUD-3465): feat: implement cluster-wide proxy support [#586](https://github.com/openshift/cluster-capi-operator/pull/586)
* [OCPCLOUD-3318](https://issues.redhat.com/browse/OCPCLOUD-3318): Integrate CompatibilityRequirements into the CCAPIO Installer [#648](https://github.com/openshift/cluster-capi-operator/pull/648)
* [OCPBUGS-98492](https://issues.redhat.com/browse/OCPBUGS-98492): Fix orphaned MachineSet sync finalizer cleanup [#689](https://github.com/openshift/cluster-capi-operator/pull/689)
* [OCPCLOUD-3541](https://issues.redhat.com/browse/OCPCLOUD-3541): Use feature gates consistently [#603](https://github.com/openshift/cluster-capi-operator/pull/603)
* [OCPBUGS-127650](https://issues.redhat.com/browse/OCPBUGS-127650): openstack: allow to specify UserManaged load balancer [#678](https://github.com/openshift/cluster-capi-operator/pull/678)
* [OCPBUGS-128384](https://issues.redhat.com/browse/OCPBUGS-128384): Extend InfraTemplate reconciliation wait [#681](https://github.com/openshift/cluster-capi-operator/pull/681)
* [OCPBUGS-123094](https://issues.redhat.com/browse/OCPBUGS-123094): Update MongoDB Go driver to v1.17.10 [#676](https://github.com/openshift/cluster-capi-operator/pull/676)
* [OCPBUGS-128576](https://issues.redhat.com/browse/OCPBUGS-128576): add ec2:ModifyInstanceMetadataOptions to AWS CredentialsRequest [#682](https://github.com/openshift/cluster-capi-operator/pull/682)
* NO-JIRA: Update actuator testutils builder paths [#683](https://github.com/openshift/cluster-capi-operator/pull/683)
* [OCPBUGS-128356](https://issues.redhat.com/browse/OCPBUGS-128356): Remove unnecessary ClusterOperator test status update [#680](https://github.com/openshift/cluster-capi-operator/pull/680)
* [OCPBUGS-127467](https://issues.redhat.com/browse/OCPBUGS-127467): Pass original TLSProfileSpec to security profile watcher [#677](https://github.com/openshift/cluster-capi-operator/pull/677)
* NO-JIRA: use capi 1.13/capv 1.16 imports [#675](https://github.com/openshift/cluster-capi-operator/pull/675)
* NO-JIRA: Bump linter to v2.13.2 [#674](https://github.com/openshift/cluster-capi-operator/pull/674)
* [OCPCLOUD-1501](https://issues.redhat.com/browse/OCPCLOUD-1501): use projected tokens for management kubeconfig [#669](https://github.com/openshift/cluster-capi-operator/pull/669)
* [OCPBUGS-100155](https://issues.redhat.com/browse/OCPBUGS-100155): fix flaky MachineSet sync test by atomically verifying InfraTemplate [#647](https://github.com/openshift/cluster-capi-operator/pull/647)
* [OCPBUGS-114670](https://issues.redhat.com/browse/OCPBUGS-114670): fix(capi2mapi): normalize empty SSHKeyName to nil for MAPI AWS conversion [#659](https://github.com/openshift/cluster-capi-operator/pull/659)
* [OCPBUGS-115197](https://issues.redhat.com/browse/OCPBUGS-115197): machinesync: preserve Synchronized condition lastTransitionTime in CAPI-to-MAPI sync [#656](https://github.com/openshift/cluster-capi-operator/pull/656)
* NO-JIRA: Skip CAPI IPAM test on MicroShift [#661](https://github.com/openshift/cluster-capi-operator/pull/661)
* [OCPCLOUD-3557](https://issues.redhat.com/browse/OCPCLOUD-3557): split capi-controllers and machine-api-migration [#622](https://github.com/openshift/cluster-capi-operator/pull/622)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/a134d6fc659a598150e669c6041c925c7036a4a3...39401fe5b2578309481ea223ecf6f17f58b4ae91)
### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/afd5b1c73e844747b597271f1530c99fb4b641d0)
* [SPLAT-2994](https://issues.redhat.com/browse/SPLAT-2994): resolve AWS region from Infrastructure before environment [#529](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/529)
* [OCPCLOUD-3673](https://issues.redhat.com/browse/OCPCLOUD-3673): bump Kubernetes dependencies to 1.37 [#523](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/523)
* [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/9ca11878cc35862f4af4c194985b4f3ae3a835fa...afd5b1c73e844747b597271f1530c99fb4b641d0)
### [cluster-config-api](https://github.com/openshift/api/tree/f677639a402fe455b8243b23b1d160cfc3587918)
* [SPLAT-2981](https://issues.redhat.com/browse/SPLAT-2981): promote AzureMultiDisk to GA [#3091](https://github.com/openshift/api/pull/3091)
* [MON-4645](https://issues.redhat.com/browse/MON-4645): allow __ prefixed labels in sourceLabels [#3050](https://github.com/openshift/api/pull/3050)
* [OCPSTRAT-3523](https://issues.redhat.com/browse/OCPSTRAT-3523): Add OpenStack.maxAllowedAddressPairs to Infrastructure API [#3098](https://github.com/openshift/api/pull/3098)
* [OCPBUGS-104847](https://issues.redhat.com/browse/OCPBUGS-104847): Remove SELinuxMountGAReadiness feature gate [#3122](https://github.com/openshift/api/pull/3122)
* NO-JIRA: Add example of validating an OpenShift release version [#3137](https://github.com/openshift/api/pull/3137)
* feat: register FeatureGateClusterAPIMachineManagementNutanix [#3140](https://github.com/openshift/api/pull/3140)
* [MON-4654](https://issues.redhat.com/browse/MON-4654): allow query parameters in remote write URLs [#3124](https://github.com/openshift/api/pull/3124)
* [OCPBUGS-105408](https://issues.redhat.com/browse/OCPBUGS-105408): Remove DualReplica feature gate [#3123](https://github.com/openshift/api/pull/3123)
* [OCPCLOUD-3725](https://issues.redhat.com/browse/OCPCLOUD-3725): feat: gate Cluster API configuration on operator availability [#3131](https://github.com/openshift/api/pull/3131)
* Nutanix: featuregate for MachineAPIMigrationNutanix [#3125](https://github.com/openshift/api/pull/3125)
* [OPNET-809](https://issues.redhat.com/browse/OPNET-809): ship the BGPVIPConfig CRD in the payload [#3127](https://github.com/openshift/api/pull/3127)
* [METAL-1977](https://issues.redhat.com/browse/METAL-1977): add MetalEnrollmentAPI feature gate [#3090](https://github.com/openshift/api/pull/3090)
* [OCPCLOUD-3544](https://issues.redhat.com/browse/OCPCLOUD-3544): Graduate CompatibilityRequirement API to v1 [#2905](https://github.com/openshift/api/pull/2905)
* [CNTRLPLANE-4390](https://issues.redhat.com/browse/CNTRLPLANE-4390): Remove OpenShiftPodSecurityAdmission feature gate from Default feature set. [#3035](https://github.com/openshift/api/pull/3035)
* [CNTRLPLANE-4771](https://issues.redhat.com/browse/CNTRLPLANE-4771): Graduate KMSEncryption to GA [#3100](https://github.com/openshift/api/pull/3100)
* [STOR-3180](https://issues.redhat.com/browse/STOR-3180): Add Feature Gate StoragePathAlert [#3105](https://github.com/openshift/api/pull/3105)
* [OCPNODE-4827](https://issues.redhat.com/browse/OCPNODE-4827): Drop v1apha1 CRIOCredentialProviderConfig entirely [#3113](https://github.com/openshift/api/pull/3113)
* [OCPCLOUD-3330](https://issues.redhat.com/browse/OCPCLOUD-3330): Add ClusterAPIOperator feature gate [#3109](https://github.com/openshift/api/pull/3109)
* [OCPKUEUE-887](https://issues.redhat.com/browse/OCPKUEUE-887): Enable workload scheduling feature gates for DP/TP (except CompositePodGroup) [#3112](https://github.com/openshift/api/pull/3112)
* [TRT-3027](https://issues.redhat.com/browse/TRT-3027): Revert #3102 "OCPKUEUE-887: Enable workload scheduling feature gates for DP/TP" [#3107](https://github.com/openshift/api/pull/3107)
* [OCPEDGE-2989](https://issues.redhat.com/browse/OCPEDGE-2989): OCPEDGE-2958: Add topologyTransitionStatus to Infrastructure status [#3029](https://github.com/openshift/api/pull/3029)
* [CNTRLPLANE-4394](https://issues.redhat.com/browse/CNTRLPLANE-4394): Add foundations for AuthenticationComponentProxyExternalOIDC [#3037](https://github.com/openshift/api/pull/3037)
* [OCPKUEUE-887](https://issues.redhat.com/browse/OCPKUEUE-887): Enable workload scheduling feature gates for DP/TP [#3102](https://github.com/openshift/api/pull/3102)
* [OCPBUGS-130730](https://issues.redhat.com/browse/OCPBUGS-130730): Remove topology transition immutability validation [#3096](https://github.com/openshift/api/pull/3096)
* [NE-2912](https://issues.redhat.com/browse/NE-2912): Add HAProxy 3.4 as a selectable non-default version [#3067](https://github.com/openshift/api/pull/3067)
* [OPNET-809](https://issues.redhat.com/browse/OPNET-809): machineconfiguration/v1alpha1: add BGPVIPConfig CRD [#2972](https://github.com/openshift/api/pull/2972)
* [OCPNODE-4730](https://issues.redhat.com/browse/OCPNODE-4730): Add workload scheduling feature gates [#3092](https://github.com/openshift/api/pull/3092)
* [NE-2922](https://issues.redhat.com/browse/NE-2922): Promote Ingress operator API to v1 [#3079](https://github.com/openshift/api/pull/3079)
* [OCPBUGS-123649](https://issues.redhat.com/browse/OCPBUGS-123649): enable DRADeviceTaintRules feature gate in TPNU [#3072](https://github.com/openshift/api/pull/3072)
* [OCPEDGE-3075](https://issues.redhat.com/browse/OCPEDGE-3075): feat: add spec.infrastructureTopology to Infrastructure API [#3056](https://github.com/openshift/api/pull/3056)
* Fix CustomNoUpgrade rendering with omitted overrides [#3080](https://github.com/openshift/api/pull/3080)
* NO-JIRA: change KMS preflight result validation [#3083](https://github.com/openshift/api/pull/3083)
* [OCPBUGS-129172](https://issues.redhat.com/browse/OCPBUGS-129172): Loosen CAPI skew validations [#3077](https://github.com/openshift/api/pull/3077)
* Support Quay CI payloads and add Kubernetes v1.37.1 envtest tools [#3082](https://github.com/openshift/api/pull/3082)
* [CNTRLPLANE-4604](https://issues.redhat.com/browse/CNTRLPLANE-4604): promoting AuthenticationComponentProxy feature gate to Default feature set [#3075](https://github.com/openshift/api/pull/3075)
* [STOR-2859](https://issues.redhat.com/browse/STOR-2859): Add APIs for disabling force detach in KCM operator [#2668](https://github.com/openshift/api/pull/2668)
* Rename Console ingress helper type to ConsoleIngress [#3070](https://github.com/openshift/api/pull/3070)
* [CORENET-7617](https://issues.redhat.com/browse/CORENET-7617): features: Add ovn-kuberntes MACSecurity feature gate [#3062](https://github.com/openshift/api/pull/3062)
* [CNTRLPLANE-4518](https://issues.redhat.com/browse/CNTRLPLANE-4518): authentication: add v1alpha1 external OIDC configuration API [#3061](https://github.com/openshift/api/pull/3061)
* [MCO-2535](https://issues.redhat.com/browse/MCO-2535): add skew enforcement validations for CAPI MachineManagers [#3058](https://github.com/openshift/api/pull/3058)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Rebase 1.37 [#2945](https://github.com/openshift/api/pull/2945)
* [OCPBUGS-126808](https://issues.redhat.com/browse/OCPBUGS-126808): Enable OLMLifecycleAndCompatibility by default in version 5+ [#3045](https://github.com/openshift/api/pull/3045)
* [NE-2913](https://issues.redhat.com/browse/NE-2913): Remove HAProxy 2.8 [#3048](https://github.com/openshift/api/pull/3048)
* [CNTRLPLANE-4402](https://issues.redhat.com/browse/CNTRLPLANE-4402): add ExternalOIDCAsWebhook feature gate [#3043](https://github.com/openshift/api/pull/3043)
* [OCPEDGE-3079](https://issues.redhat.com/browse/OCPEDGE-3079): UnifiedClusterManagedDNSAndLB FeatureGate [#3054](https://github.com/openshift/api/pull/3054)
* [OCPBUGS-115007](https://issues.redhat.com/browse/OCPBUGS-115007): Remove BootImageSkewEnforcement feature gate from Default API [#3031](https://github.com/openshift/api/pull/3031)
* [OCPBUGS-120757](https://issues.redhat.com/browse/OCPBUGS-120757): Fix misleading certificate chain docs in TLSConfig [#3047](https://github.com/openshift/api/pull/3047)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): replace KMS config with pluginConfig reference [#3028](https://github.com/openshift/api/pull/3028)
* [HPCASE-362](https://issues.redhat.com/browse/HPCASE-362): Promote TLSAdherence feature gate to GA [#2883](https://github.com/openshift/api/pull/2883)
* NO-JIRA: Fix codegen diagnostic formatting [#3049](https://github.com/openshift/api/pull/3049)
* operator: Add an option to configure OVN-Kubernetes GatewayConfig without an uplink specified. [#3009](https://github.com/openshift/api/pull/3009)
* [OCPBUGS-105398](https://issues.redhat.com/browse/OCPBUGS-105398): chore: remove AzureWorkloadIdentity feature gate [#3018](https://github.com/openshift/api/pull/3018)
* [OPRUN-4768](https://issues.redhat.com/browse/OPRUN-4768): Add serving TLS curve preferences [#3044](https://github.com/openshift/api/pull/3044)
* Remove feature gate VolumeGroupSnapshot [#3027](https://github.com/openshift/api/pull/3027)
* [STOR-3089](https://issues.redhat.com/browse/STOR-3089): Graduate SELinuxMount to GA [#3023](https://github.com/openshift/api/pull/3023)
* [OCPBUGS-112638](https://issues.redhat.com/browse/OCPBUGS-112638): register DRADeviceTaintRules in TPNU [#3004](https://github.com/openshift/api/pull/3004)
* Fix validation pattern for machine/vsphereprovider [#3033](https://github.com/openshift/api/pull/3033)
* features: enable TLSAdherence feature gate for OKD featureset [#3021](https://github.com/openshift/api/pull/3021)
* [CORENET-7538](https://issues.redhat.com/browse/CORENET-7538): Add EgressIPNodeSelector feature gate [#3032](https://github.com/openshift/api/pull/3032)
* [SPLAT-2890](https://issues.redhat.com/browse/SPLAT-2890): Add VSphereScopedCredentials feature gate [#2988](https://github.com/openshift/api/pull/2988)
* [MCO-2332](https://issues.redhat.com/browse/MCO-2332): MCO-2333: Introduce CAPI resource types to boot image update API [#2990](https://github.com/openshift/api/pull/2990)
* [Full changelog](https://github.com/openshift/api/compare/c7d4aa14a7649477cdb9e7c4a733d61bf70913ea...f677639a402fe455b8243b23b1d160cfc3587918)
### [cluster-config-operator](https://github.com/openshift/cluster-config-operator/tree/25d3850c8799c11a0924dcc32576ae44d647ee9f)
* [OCPEDGE-2990](https://issues.redhat.com/browse/OCPEDGE-2990): Report supported topology evaluations [#522](https://github.com/openshift/cluster-config-operator/pull/522)
* NO-JIRA: Update Go to 1.26 and OpenShift API dependencies [#528](https://github.com/openshift/cluster-config-operator/pull/528)
* [OCPBUGS-130339](https://issues.redhat.com/browse/OCPBUGS-130339): Read OpenShift API server replicas from deployment [#524](https://github.com/openshift/cluster-config-operator/pull/524)
* NO-JIRA: chore: Adding some edge folks as OWNERS in the topology controller [#508](https://github.com/openshift/cluster-config-operator/pull/508)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#504](https://github.com/openshift/cluster-config-operator/pull/504)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#500](https://github.com/openshift/cluster-config-operator/pull/500)
* [OCPEDGE-2747](https://issues.redhat.com/browse/OCPEDGE-2747): feat: add topology transition controller for day-2 SNO to HA transitions [#495](https://github.com/openshift/cluster-config-operator/pull/495)
* [Full changelog](https://github.com/openshift/cluster-config-operator/compare/9f787f73f5fffca5cd511ef2c2e704afc14f68ce...25d3850c8799c11a0924dcc32576ae44d647ee9f)
### [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator/tree/8ca6b2588cefcbeffc895ee8ec51fb52ce9f1bb3)
* [OCPCLOUD-3658](https://issues.redhat.com/browse/OCPCLOUD-3658): bump Kubernetes dependencies to 1.37 [#423](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/423)
* [OCPCLOUD-3707](https://issues.redhat.com/browse/OCPCLOUD-3707): feat(tls): add support for TLS groups/curve preferences [#424](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/424)
* [OCPBUGS-65497](https://issues.redhat.com/browse/OCPBUGS-65497): Add debug-useful ClusterOperator relatedObjects [#404](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/404)
* [Full changelog](https://github.com/openshift/cluster-control-plane-machine-set-operator/compare/81541d53f815a4cb25255b0dad33f449762c4609...8ca6b2588cefcbeffc895ee8ec51fb52ce9f1bb3)
### [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator/tree/41e9a6ccf361de2b37c0e91c2e03fb7fec31a634)
* [STOR-3068](https://issues.redhat.com/browse/STOR-3068): Bump all libraries [#302](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/302)
* [OCPBUGS-127462](https://issues.redhat.com/browse/OCPBUGS-127462): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#298](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/298)
* [OCPBUGS-104846](https://issues.redhat.com/browse/OCPBUGS-104846): Remove VolumeGroupSnapshot feature gate [#297](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/297)
* [Full changelog](https://github.com/openshift/cluster-csi-snapshot-controller-operator/compare/35ec0224eb0e5219d5eae012fb703223a6f3e1f7...41e9a6ccf361de2b37c0e91c2e03fb7fec31a634)
### [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator/tree/9d18bdd71092bd9eaad426c6ec42b719c3a992e9)
* [NE-2126](https://issues.redhat.com/browse/NE-2126): Ship tests-ext binary as raw gzip instead of tar.gz [#503](https://github.com/openshift/cluster-dns-operator/pull/503)
* NO-JIRA: Add pedjak to OWNERS [#490](https://github.com/openshift/cluster-dns-operator/pull/490)
* [OCPBUGS-87970](https://issues.redhat.com/browse/OCPBUGS-87970): Stop using legacy topology-aware hints for DNS [#501](https://github.com/openshift/cluster-dns-operator/pull/501)
* [NE-2126](https://issues.redhat.com/browse/NE-2126): Migrating DNS test cases from QE repo [#491](https://github.com/openshift/cluster-dns-operator/pull/491)
* [OCPBUGS-53192](https://issues.redhat.com/browse/OCPBUGS-53192): Update code reference to use the default branch name 'main' [#488](https://github.com/openshift/cluster-dns-operator/pull/488)
* [ART-23537](https://issues.redhat.com/browse/ART-23537): Fix hermetic build failure by removing update-bindata from build target [#489](https://github.com/openshift/cluster-dns-operator/pull/489)
* [NE-2880](https://issues.redhat.com/browse/NE-2880): Update GitHub issue template URLs [#487](https://github.com/openshift/cluster-dns-operator/pull/487)
* [NE-2126](https://issues.redhat.com/browse/NE-2126): Migrating DNS operator test cases from QE repo [#485](https://github.com/openshift/cluster-dns-operator/pull/485)
* [Full changelog](https://github.com/openshift/cluster-dns-operator/compare/c0ed09e329e9001629518604a58205e3fbe8284a...9d18bdd71092bd9eaad426c6ec42b719c3a992e9)
### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/88ac66d6714baa24466adbf697a75b0781b1362c)
* NO-JIRA: bump k8s 1.37 [#1733](https://github.com/openshift/cluster-etcd-operator/pull/1733)
* NO-JIRA: move TNF scripts to bindata/etcd/tnf with TNF OWNERS [#1728](https://github.com/openshift/cluster-etcd-operator/pull/1728)
* NO-JIRA: Update the tests to skip if OCPFeatureGate:AutomatedEtcdBackup is not enabled [#1731](https://github.com/openshift/cluster-etcd-operator/pull/1731)
* [OCPBUGS-100304](https://issues.redhat.com/browse/OCPBUGS-100304): write force_new_cluster as a claim timestamp [#1721](https://github.com/openshift/cluster-etcd-operator/pull/1721)
* [OCPBUGS-112390](https://issues.redhat.com/browse/OCPBUGS-112390): [TNF] lifecycle part 2 - update setup deadlock fix & conditions cleanup [#1668](https://github.com/openshift/cluster-etcd-operator/pull/1668)
* NO-JIRA: Add TNF ownership for docs/tnf [#1725](https://github.com/openshift/cluster-etcd-operator/pull/1725)
* [OCPBUGS-123169](https://issues.redhat.com/browse/OCPBUGS-123169): add static linter for workload partitioning annotations [#1707](https://github.com/openshift/cluster-etcd-operator/pull/1707)
* [OCPBUGS-105240](https://issues.redhat.com/browse/OCPBUGS-105240): TNF: wait for etcd-bootstrap member removal before setup [#1672](https://github.com/openshift/cluster-etcd-operator/pull/1672)
* [OCPBUGS-84650](https://issues.redhat.com/browse/OCPBUGS-84650): force installer revision when external-etcd-pod ConfigMap is created [#1705](https://github.com/openshift/cluster-etcd-operator/pull/1705)
* [OCPBUGS-126911](https://issues.redhat.com/browse/OCPBUGS-126911): fix(tnf): set read-only root filesystems [#1715](https://github.com/openshift/cluster-etcd-operator/pull/1715)
* [CNTRLPLANE-4414](https://issues.redhat.com/browse/CNTRLPLANE-4414): allow TLS 1.3 profiles without ciphers [#1710](https://github.com/openshift/cluster-etcd-operator/pull/1710)
* NO-JIRA: refactor: remove unused cert-watcher daemonset manifest [#1711](https://github.com/openshift/cluster-etcd-operator/pull/1711)
* [OCPBUGS-123168](https://issues.redhat.com/browse/OCPBUGS-123168): fix: add missing workload paritioning annotation on cert-watcher daemonset [#1706](https://github.com/openshift/cluster-etcd-operator/pull/1706)
* [OCPBUGS-104851](https://issues.redhat.com/browse/OCPBUGS-104851): feat: add cert-watcher DaemonSet to restart etcd on CA bundle rotation [#1675](https://github.com/openshift/cluster-etcd-operator/pull/1675)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/36c44461e9bd3af7c76915058370da87bc2ceb39...88ac66d6714baa24466adbf697a75b0781b1362c)
### [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator/tree/9dba9645bb8ebae13006c76e726d6e2e42e72b1d)
* [CNTRLPLANE-4447](https://issues.redhat.com/browse/CNTRLPLANE-4447): observe tls groups preferences [#1379](https://github.com/openshift/cluster-image-registry-operator/pull/1379)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#1368](https://github.com/openshift/cluster-image-registry-operator/pull/1368)
* [OCPBUGS-114531](https://issues.redhat.com/browse/OCPBUGS-114531): Add 2m degraded inertia to ImagePrunerController [#1365](https://github.com/openshift/cluster-image-registry-operator/pull/1365)
* [OCPBUGS-112551](https://issues.redhat.com/browse/OCPBUGS-112551): imageconfig: Preserve ImageStreamImportMode during upgrade race [#1363](https://github.com/openshift/cluster-image-registry-operator/pull/1363)
* [Full changelog](https://github.com/openshift/cluster-image-registry-operator/compare/f9c7439f0924147bc02f2bf74ad403ebe105408d...9dba9645bb8ebae13006c76e726d6e2e42e72b1d)
### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/7d6e32bc7f1d5932303db24f6c5446d73d52a14f)
* [OCPBUGS-122924](https://issues.redhat.com/browse/OCPBUGS-122924): Default IngressController to Modern TLS [#1593](https://github.com/openshift/cluster-ingress-operator/pull/1593)
* [NE-2922](https://issues.redhat.com/browse/NE-2922): Use the featuregate to add Ingress resource [#1651](https://github.com/openshift/cluster-ingress-operator/pull/1651)
* [NE-2922](https://issues.redhat.com/browse/NE-2922): Migrate operator Ingress consumers to v1 [#1618](https://github.com/openshift/cluster-ingress-operator/pull/1618)
* [OCPBUGS-121851](https://issues.redhat.com/browse/OCPBUGS-121851): Complete zero-worker HyperShift startup without premature router readiness [#1631](https://github.com/openshift/cluster-ingress-operator/pull/1631)
* [NE-2938](https://issues.redhat.com/browse/NE-2938): Bump Kubernetes to 1.37 [#1643](https://github.com/openshift/cluster-ingress-operator/pull/1643)
* [NE-2779](https://issues.redhat.com/browse/NE-2779): Move Gateway API CRD VAP management from CVO to CIO [#1627](https://github.com/openshift/cluster-ingress-operator/pull/1627)
* [NE-2913](https://issues.redhat.com/browse/NE-2913): Remove HAProxy 2.8 reference [#1599](https://github.com/openshift/cluster-ingress-operator/pull/1599)
* [TRT-3032](https://issues.redhat.com/browse/TRT-3032): Revert #1607 "OCPBUGS-121851: Report ingress Available=True on zero-worker HyperShift startup" [#1630](https://github.com/openshift/cluster-ingress-operator/pull/1630)
* [NE-2901](https://issues.redhat.com/browse/NE-2901): Document commit conventions in AGENTS.md [#1582](https://github.com/openshift/cluster-ingress-operator/pull/1582)
* [OCPBUGS-128105](https://issues.redhat.com/browse/OCPBUGS-128105): Allow disabling endpoint address validation [#1608](https://github.com/openshift/cluster-ingress-operator/pull/1608)
* [OCPBUGS-118434](https://issues.redhat.com/browse/OCPBUGS-118434): Remove obsolete workaround that hardcodes spec.replicas [#1581](https://github.com/openshift/cluster-ingress-operator/pull/1581)
* [OCPBUGS-121851](https://issues.redhat.com/browse/OCPBUGS-121851): Report ingress Available=True on zero-worker HyperShift startup [#1607](https://github.com/openshift/cluster-ingress-operator/pull/1607)
* [TRT-3022](https://issues.redhat.com/browse/TRT-3022): Revert #1556 "NE-2126: Migrating Ingress operator test cases from QE repo" [#1623](https://github.com/openshift/cluster-ingress-operator/pull/1623)
* [OCPBUGS-129612](https://issues.redhat.com/browse/OCPBUGS-129612): Rebuild fake DNS provider when DNS zones are added [#1614](https://github.com/openshift/cluster-ingress-operator/pull/1614)
* [NE-2126](https://issues.redhat.com/browse/NE-2126): Migrating Ingress operator test cases from QE repo [#1556](https://github.com/openshift/cluster-ingress-operator/pull/1556)
* [OCPBUGS-129664](https://issues.redhat.com/browse/OCPBUGS-129664): Bump to ossm 3.4.3 and Istio 1.30.5 [#1606](https://github.com/openshift/cluster-ingress-operator/pull/1606)
* [OCPBUGS-126999](https://issues.redhat.com/browse/OCPBUGS-126999): Support ambient AWS credentials in tests [#1602](https://github.com/openshift/cluster-ingress-operator/pull/1602)
* [NE-2922](https://issues.redhat.com/browse/NE-2922): Remove duplicate operator Ingress CRD from CIO payload [#1613](https://github.com/openshift/cluster-ingress-operator/pull/1613)
* [NE-2879](https://issues.redhat.com/browse/NE-2879): Update GitHub issue template URLs [#1578](https://github.com/openshift/cluster-ingress-operator/pull/1578)
* [OCPBUGS-105442](https://issues.redhat.com/browse/OCPBUGS-105442): improve Sail RBAC verification diagnostics [#1601](https://github.com/openshift/cluster-ingress-operator/pull/1601)
* [NE-2834](https://issues.redhat.com/browse/NE-2834): Replace deprecated math/rand.Read in e2e test [#1533](https://github.com/openshift/cluster-ingress-operator/pull/1533)
* [OCPBUGS-115108](https://issues.redhat.com/browse/OCPBUGS-115108): derive ingress Degraded grace [#1583](https://github.com/openshift/cluster-ingress-operator/pull/1583)
* [OCPBUGS-125752](https://issues.redhat.com/browse/OCPBUGS-125752): discover AWS subnets from CAPI with MAPI fallback [#1592](https://github.com/openshift/cluster-ingress-operator/pull/1592)
* [OCPBUGS-128253](https://issues.redhat.com/browse/OCPBUGS-128253): Wait for AWS NLB SG baseline [#1604](https://github.com/openshift/cluster-ingress-operator/pull/1604)
* [OCPBUGS-53193](https://issues.redhat.com/browse/OCPBUGS-53193): Update code references to use the default branch name 'main' [#1591](https://github.com/openshift/cluster-ingress-operator/pull/1591)
* [NE-2570](https://issues.redhat.com/browse/NE-2570): Simplify TLS profile validation [#1594](https://github.com/openshift/cluster-ingress-operator/pull/1594)
* [OCPBUGS-122346](https://issues.redhat.com/browse/OCPBUGS-122346): Fix GatewayClass index registration retries during bootstrap [#1588](https://github.com/openshift/cluster-ingress-operator/pull/1588)
* [OCPBUGS-105442](https://issues.redhat.com/browse/OCPBUGS-105442): Remove escalate/bind from Sail Library ClusterRole [#1548](https://github.com/openshift/cluster-ingress-operator/pull/1548)
* [NE-2909](https://issues.redhat.com/browse/NE-2909): Address Gateway API management-mode follow-ups [#1595](https://github.com/openshift/cluster-ingress-operator/pull/1595)
* [OCPBUGS-105317](https://issues.redhat.com/browse/OCPBUGS-105317): Bump to OSSM 3.4.2 and istio 1.30.4 [#1576](https://github.com/openshift/cluster-ingress-operator/pull/1576)
* [OCPBUGS-105398](https://issues.redhat.com/browse/OCPBUGS-105398): docs: clarify Azure workload identity token file [#1586](https://github.com/openshift/cluster-ingress-operator/pull/1586)
* NO-JIRA: Add pedjak to OWNERS [#1596](https://github.com/openshift/cluster-ingress-operator/pull/1596)
* [NE-2388](https://issues.redhat.com/browse/NE-2388): aws nlb security groups [#1500](https://github.com/openshift/cluster-ingress-operator/pull/1500)
* [NE-2779](https://issues.redhat.com/browse/NE-2779): Implement Gateway API management mode [#1547](https://github.com/openshift/cluster-ingress-operator/pull/1547)
* [OCPBUGS-86050](https://issues.redhat.com/browse/OCPBUGS-86050): Update ROUTER_CURVES environment variable for go 1.26 [#1542](https://github.com/openshift/cluster-ingress-operator/pull/1542)
* [OCPBUGS-6718](https://issues.redhat.com/browse/OCPBUGS-6718): minimize wildcard RBAC permissions [#1579](https://github.com/openshift/cluster-ingress-operator/pull/1579)
* [OCPBUGS-105398](https://issues.redhat.com/browse/OCPBUGS-105398): refactor: remove Azure workload identity feature gate [#1575](https://github.com/openshift/cluster-ingress-operator/pull/1575)
* [NE-2491](https://issues.redhat.com/browse/NE-2491): Delete the CRL controller [#1536](https://github.com/openshift/cluster-ingress-operator/pull/1536)
* [WAF-3](https://issues.redhat.com/browse/WAF-3): Implement extension provider capability for WAF [#1555](https://github.com/openshift/cluster-ingress-operator/pull/1555)
* [OCPBUGS-62627](https://issues.redhat.com/browse/OCPBUGS-62627): Suppress Progressing during infrastructure-driven ingress unavailability [#1496](https://github.com/openshift/cluster-ingress-operator/pull/1496)
* [OCPBUGS-92835](https://issues.redhat.com/browse/OCPBUGS-92835): add grace period to Available condition for deployment… [#1544](https://github.com/openshift/cluster-ingress-operator/pull/1544)
* [OCPBUGS-109582](https://issues.redhat.com/browse/OCPBUGS-109582): Normalize malformed CIDRs to avoid upgrade disruptions [#1549](https://github.com/openshift/cluster-ingress-operator/pull/1549)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/5bf72fcc4534d9ba2c4d65d29cdb8b01c83cf550...7d6e32bc7f1d5932303db24f6c5446d73d52a14f)
### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/cc0ed4791d5802e613e33e89b97c9b18b1786a8a)
* NO-JIRA: bump(openshift/library-go): to get retry in preflight check status report [#2368](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2368)
* [CNTRLPLANE-4845](https://issues.redhat.com/browse/CNTRLPLANE-4845): Migrate sno disruptive and encryption rotation e2e to ote [#2365](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2365)
* [OCPBUGS-133759](https://issues.redhat.com/browse/OCPBUGS-133759): Raise kube-apiserver operator memory request [#2366](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2366)
* NO-JIRA: Update library-go to run conditional step in KMS [#2367](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2367)
* NO-JIRA: bump(openshift/library-go): to get KMS GA [#2364](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2364)
* NO-JIRA: Update library-go [#2362](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2362)
* [OCPBUGS-60496](https://issues.redhat.com/browse/OCPBUGS-60496): Use BoundServceAccountTokenVolume dy default [#1896](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1896)
* NO-JIRA: Update library-go [#2354](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2354)
* [CNTRLPLANE-4731](https://issues.redhat.com/browse/CNTRLPLANE-4731): Add KMSPreflightCycle e2e [#2348](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2348)
* [OCPKUEUE-887](https://issues.redhat.com/browse/OCPKUEUE-887): Enable workload API versions for feature gates [#2332](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2332)
* NO-JIRA: Update library-go [#2349](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2349)
* NO-JIRA: Update library-go [#2347](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2347)
* [TRT-3013](https://issues.redhat.com/browse/TRT-3013): Revert "Use 300s shutdown delay on AWS" [#2346](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2346)
* NO-JIRA: bump openshift/api https://github.com/openshift/api/pull/3083 [#2339](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2339)
* [OCPBUGS-86789](https://issues.redhat.com/browse/OCPBUGS-86789): Extend AWS shutdown delay to 300s [#2267](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2267)
* [CNTRLPLANE-4408](https://issues.redhat.com/browse/CNTRLPLANE-4408): Support the `ExternalOIDCAsWebhook` feature gate [#2325](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2325)
* NO-JIRA: bump library-go https://github.com/openshift/library-go/pull/2518 [#2337](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2337)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): update deprecated API usage alerts for kube 1.37 [#2334](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2334)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Bump to golang-1.26-openshift-5.1 image [#2268](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2268)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2474 [#2327](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2327)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): encryption/assertion: bring back the preflight assertion for CAO and OAS-O [#2320](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2320)
* [CNTRLPLANE-4303](https://issues.redhat.com/browse/CNTRLPLANE-4303): Remove old go standard e2e encryption cases [#2322](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2322)
* [CNTRLPLANE-4303](https://issues.redhat.com/browse/CNTRLPLANE-4303): Migrate e2e-encryption to ote [#2290](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2290)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): bump library-go to get the new KMS plugin deployment strategy [#2315](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2315)
* [OCPBUGS-112638](https://issues.redhat.com/browse/OCPBUGS-112638): apienablement: enable resource.k8s.io/v1beta2 when DeviceTaintRule is enabled [#2275](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2275)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2478 [#2313](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2313)
* [OPRUN-4768](https://issues.redhat.com/browse/OPRUN-4768): bump openshift/api [#2316](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2316)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2463 [#2309](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2309)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#2307](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2307)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2439 [#2282](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2282)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pick https://github.com/openshift/library-go/pull/2449 [#2287](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2287)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2451 [#2289](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2289)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): kms: wire EncryptionConfigurationComputer into encryption controllers [#2292](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2292)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/2fa5365f29eff19a528856740274fe0c37b18b68...cc0ed4791d5802e613e33e89b97c9b18b1786a8a)
### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/c5551c1428d12edd17eb97d80cca43ee45b113cc)
* [CNTRLPLANE-4441](https://issues.redhat.com/browse/CNTRLPLANE-4441): feat: inject tls groups [#974](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/974)
* [STOR-2875](https://issues.redhat.com/browse/STOR-2875): wire volumeForceDetach config observer for KCM [#975](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/975)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Rebase 1.37 [#953](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/953)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#967](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/967)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/330fe4a6ed1a15ae1c2b572138d596fd5780d318...c5551c1428d12edd17eb97d80cca43ee45b113cc)
### [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator/tree/ab8cbfbb1e5532cec39d08c6e84b8f8c0ea856ef)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Rebase 1.37 [#660](https://github.com/openshift/cluster-kube-scheduler-operator/pull/660)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#676](https://github.com/openshift/cluster-kube-scheduler-operator/pull/676)
* [Full changelog](https://github.com/openshift/cluster-kube-scheduler-operator/compare/6a750a9fd626675a2bc35b43b75dbc182ce3d8e9...ab8cbfbb1e5532cec39d08c6e84b8f8c0ea856ef)
### [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/tree/01da4b3eee18148dddb64b734939ef2b3cb110ef)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#183](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/183)
* [Full changelog](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/compare/f5d3bfe64bda67ffb8299af01ebf2722287edf04...01da4b3eee18148dddb64b734939ef2b3cb110ef)
### [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver/tree/2821b7f4301df470bd28824aef97ca23b2df77d5)
* [OCPBUGS-57437](https://issues.redhat.com/browse/OCPBUGS-57437): Always permit asking node name in CSR SANs [#344](https://github.com/openshift/cluster-machine-approver/pull/344)
* [OCPCLOUD-3659](https://issues.redhat.com/browse/OCPCLOUD-3659): bump Kubernetes dependencies to 1.37 [#340](https://github.com/openshift/cluster-machine-approver/pull/340)
* NO-JIRA: Add OTE [#341](https://github.com/openshift/cluster-machine-approver/pull/341)
* NO-JIRA: feat(tls): add support for TLS groups/curve preferences [#308](https://github.com/openshift/cluster-machine-approver/pull/308)
* [OCPBUGS-99489](https://issues.redhat.com/browse/OCPBUGS-99489): Add NetworkPolicy manifests to openshift-cluster-machine-approver namespace [#313](https://github.com/openshift/cluster-machine-approver/pull/313)
* [OCPBUGS-121194](https://issues.redhat.com/browse/OCPBUGS-121194): fix: retry serving CSRs while Machine addresses populate [#321](https://github.com/openshift/cluster-machine-approver/pull/321)
* [Full changelog](https://github.com/openshift/cluster-machine-approver/compare/c96773c19165a46d55007cd6a14d24376ab83d4c...2821b7f4301df470bd28824aef97ca23b2df77d5)
### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/c125a1544b2cd2ec474b280bb59a4552738bb400)
* [MON-4699](https://issues.redhat.com/browse/MON-4699): allow-list Trainer usage metrics [#3170](https://github.com/openshift/cluster-monitoring-operator/pull/3170)
* [MON-4653](https://issues.redhat.com/browse/MON-4653): verify empty remote write source labels serialization and merge [#3165](https://github.com/openshift/cluster-monitoring-operator/pull/3165)
* [MON-4658](https://issues.redhat.com/browse/MON-4658): verify integer batch send deadline conversion [#3163](https://github.com/openshift/cluster-monitoring-operator/pull/3163)
* [MON-4654](https://issues.redhat.com/browse/MON-4654): verify remote write URL query parameters survive conversion [#3166](https://github.com/openshift/cluster-monitoring-operator/pull/3166)
* [MON-4659](https://issues.redhat.com/browse/MON-4659): verify integer remote write backoff conversion [#3164](https://github.com/openshift/cluster-monitoring-operator/pull/3164)
* [MON-4657](https://issues.redhat.com/browse/MON-4657): verify integer remote write timeout conversion [#3162](https://github.com/openshift/cluster-monitoring-operator/pull/3162)
* [MON-4660](https://issues.redhat.com/browse/MON-4660): verify integer metadata send interval conversion [#3152](https://github.com/openshift/cluster-monitoring-operator/pull/3152)
* [OU-1306](https://issues.redhat.com/browse/OU-1306): add monitoring-plugin backend proxy for all non-GET requests [#3159](https://github.com/openshift/cluster-monitoring-operator/pull/3159)
* [OCPBUGS-132863](https://issues.redhat.com/browse/OCPBUGS-132863): remove Prometheus config reloader rules [#3169](https://github.com/openshift/cluster-monitoring-operator/pull/3169)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3167](https://github.com/openshift/cluster-monitoring-operator/pull/3167)
* NO-JIRA: [bot] Update jsonnet dependencies [#3168](https://github.com/openshift/cluster-monitoring-operator/pull/3168)
* [MON-4655](https://issues.redhat.com/browse/MON-4655): append byte unit to enforced body size limit [#3145](https://github.com/openshift/cluster-monitoring-operator/pull/3145)
* NO-JIRA: chore: restrict NetworkPolicy ingress rules for thanos ruler and thanos sidecars on prometheus pods [#2926](https://github.com/openshift/cluster-monitoring-operator/pull/2926)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3153](https://github.com/openshift/cluster-monitoring-operator/pull/3153)
* [OCPBUGS-35391](https://issues.redhat.com/browse/OCPBUGS-35391): separate infra memory capacity from workers [#3132](https://github.com/openshift/cluster-monitoring-operator/pull/3132)
* [OCPBUGS-99988](https://issues.redhat.com/browse/OCPBUGS-99988): amcfg: remove client-side TLS enforcement for additional alertmanager configs [#3012](https://github.com/openshift/cluster-monitoring-operator/pull/3012)
* NO-JIRA: configure custom features for monitoring-plugin [#3149](https://github.com/openshift/cluster-monitoring-operator/pull/3149)
* [OCPBUGS-128640](https://issues.redhat.com/browse/OCPBUGS-128640): filter ciphers not supported by Thanos [#3134](https://github.com/openshift/cluster-monitoring-operator/pull/3134)
* [OCPBUGS-11267](https://issues.redhat.com/browse/OCPBUGS-11267), [OCPBUGS-123539](https://issues.redhat.com/browse/OCPBUGS-123539): tidy up RBAC permissions on secrets and configmaps for Prometheus operators [#3053](https://github.com/openshift/cluster-monitoring-operator/pull/3053)
* [ART-22049](https://issues.redhat.com/browse/ART-22049): remove references to configmap-reloader image [#3051](https://github.com/openshift/cluster-monitoring-operator/pull/3051)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3118](https://github.com/openshift/cluster-monitoring-operator/pull/3118)
* NO-ISSUE: [bot] Update jsonnet dependencies [#3117](https://github.com/openshift/cluster-monitoring-operator/pull/3117)
* [OCPBUGS-125779](https://issues.redhat.com/browse/OCPBUGS-125779): don't delete admin-owned Alertmanager secrets on destroy [#3133](https://github.com/openshift/cluster-monitoring-operator/pull/3133)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3105](https://github.com/openshift/cluster-monitoring-operator/pull/3105)
* [MON-4696](https://issues.redhat.com/browse/MON-4696): Bump prometheus-operator dependencies to v0.94.1 [#3102](https://github.com/openshift/cluster-monitoring-operator/pull/3102)
* [OCPBUGS-126689](https://issues.redhat.com/browse/OCPBUGS-126689): fix(e2e): use Job with backoffLimit for TestDocExamples [#3094](https://github.com/openshift/cluster-monitoring-operator/pull/3094)
* [OCPBUGS-123794](https://issues.redhat.com/browse/OCPBUGS-123794): Fix flaky TestTelemetryReport/rate_issues [#3093](https://github.com/openshift/cluster-monitoring-operator/pull/3093)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3097](https://github.com/openshift/cluster-monitoring-operator/pull/3097)
* [MON-4689](https://issues.redhat.com/browse/MON-4689), [OCPBUGS-123539](https://issues.redhat.com/browse/OCPBUGS-123539): Bump prometheus-operator jsonnet and libs to v0.94.0 [#3083](https://github.com/openshift/cluster-monitoring-operator/pull/3083)
* [OCPBUGS-123792](https://issues.redhat.com/browse/OCPBUGS-123792): restore node-exporter textfile metrics with read-only rootfs [#3088](https://github.com/openshift/cluster-monitoring-operator/pull/3088)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3089](https://github.com/openshift/cluster-monitoring-operator/pull/3089)
* NO-JIRA: Skip flaky TestTelemetryReport/rate_issues subtest [#3087](https://github.com/openshift/cluster-monitoring-operator/pull/3087)
* [OCPBUGS-83375](https://issues.redhat.com/browse/OCPBUGS-83375): Create alerting rule for metrics-server failing to scrape kubelet [#2933](https://github.com/openshift/cluster-monitoring-operator/pull/2933)
* [MON-4638](https://issues.redhat.com/browse/MON-4638): align ThanosQueryOverload description with for=1h [#3062](https://github.com/openshift/cluster-monitoring-operator/pull/3062)
* [MON-4665](https://issues.redhat.com/browse/MON-4665): wire zoneinfo node-exporter collector from ClusterMonitorin… [#3063](https://github.com/openshift/cluster-monitoring-operator/pull/3063)
* NO-JIRA: Makefile: ensure JUnit test name prefix is applied even on test failure [#3079](https://github.com/openshift/cluster-monitoring-operator/pull/3079)
* NO-ISSUE: update jsonnet dependencies [#3077](https://github.com/openshift/cluster-monitoring-operator/pull/3077)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3076](https://github.com/openshift/cluster-monitoring-operator/pull/3076)
* [MON-4560](https://issues.redhat.com/browse/MON-4560): implement merge logic in CMO for the new field in the ClusterMonitoring CRD [#3056](https://github.com/openshift/cluster-monitoring-operator/pull/3056)
* [MON-4632](https://issues.redhat.com/browse/MON-4632), [MON-4633](https://issues.redhat.com/browse/MON-4633): Send metrics ramen:dr_policy_type:max and ramen:dr_protected_apps:max via Telemetry [#3074](https://github.com/openshift/cluster-monitoring-operator/pull/3074)
* [MON-4617](https://issues.redhat.com/browse/MON-4617): Update kube-prometheus and add resourceMetricsAPI field [#3069](https://github.com/openshift/cluster-monitoring-operator/pull/3069)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3068](https://github.com/openshift/cluster-monitoring-operator/pull/3068)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/f581865b41267ff23bbf1cb30fbdd2e02cecd42f...c125a1544b2cd2ec474b280bb59a4552738bb400)
### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/67681812fea3d0477cdcdd5be167dcd959164e1b)
* [CORENET-7707](https://issues.redhat.com/browse/CORENET-7707): Update AdminPolicyBasedExternalRoute CRD to be consistent with upstream [#3210](https://github.com/openshift/cluster-network-operator/pull/3210)
* [CORENET-6512](https://issues.redhat.com/browse/CORENET-6512): [CNO] Setup OTE framework and migrate test cases from tests-private [#3015](https://github.com/openshift/cluster-network-operator/pull/3015)
* [CNV-97772](https://issues.redhat.com/browse/CNV-97772): ovn-kubernetes, Gate MAC security schemas for Tech Preview [#3179](https://github.com/openshift/cluster-network-operator/pull/3179)
* [OCPBUGS-123662](https://issues.redhat.com/browse/OCPBUGS-123662): Provide clarity on status of NOO installation [#3166](https://github.com/openshift/cluster-network-operator/pull/3166)
* [OPNET-819](https://issues.redhat.com/browse/OPNET-819): frr-k8s: master-monitor follows platform pod conventions [#3202](https://github.com/openshift/cluster-network-operator/pull/3202)
* [CORENET-7580](https://issues.redhat.com/browse/CORENET-7580): Bump Kubernetes to 1.37.1 [#3183](https://github.com/openshift/cluster-network-operator/pull/3183)
* [CORENET-6320](https://issues.redhat.com/browse/CORENET-6320): fix(workloads): enforce read-only root filesystems [#3170](https://github.com/openshift/cluster-network-operator/pull/3170)
* [OPNET-783](https://issues.redhat.com/browse/OPNET-783): statusmanager: Treat zero-node DaemonSets as rolled out [#3046](https://github.com/openshift/cluster-network-operator/pull/3046)
* NO-ISSUE: Align frr-k8s 5.1 CRDs [#3195](https://github.com/openshift/cluster-network-operator/pull/3195)
* [OPNET-783](https://issues.redhat.com/browse/OPNET-783): network: Add BGP VIP management support [#3047](https://github.com/openshift/cluster-network-operator/pull/3047)
* [OCPBUGS-130570](https://issues.redhat.com/browse/OCPBUGS-130570): Added global overrides for OVN-Kubernetes [#2851](https://github.com/openshift/cluster-network-operator/pull/2851)
* [OCPBUGS-123509](https://issues.redhat.com/browse/OCPBUGS-123509): multus: Refresh ignored namespaces on namespace changes [#3167](https://github.com/openshift/cluster-network-operator/pull/3167)
* [CORENET-7399](https://issues.redhat.com/browse/CORENET-7399): Expand golangci-lint configuration with comprehensive linter set [#3164](https://github.com/openshift/cluster-network-operator/pull/3164)
* [OCPBUGS-127174](https://issues.redhat.com/browse/OCPBUGS-127174): Fix issues when NetObserv fails to install [#3171](https://github.com/openshift/cluster-network-operator/pull/3171)
* NO-JIRA: fix(ovn-kubernetes): disable local DB probes [#3163](https://github.com/openshift/cluster-network-operator/pull/3163)
* [CORENET-7275](https://issues.redhat.com/browse/CORENET-7275): Add AGENTS.md, point CodeRabbit knowledge base at it [#3146](https://github.com/openshift/cluster-network-operator/pull/3146)
* [CORENET-7479](https://issues.redhat.com/browse/CORENET-7479): Add status.vrfName and shortNames to UDN/CUDN CRDs [#3145](https://github.com/openshift/cluster-network-operator/pull/3145)
* [OCPBUGS-113591](https://issues.redhat.com/browse/OCPBUGS-113591): golangci-lint: enable ContextTodo/ContextBackground in usetesting [#3138](https://github.com/openshift/cluster-network-operator/pull/3138)
* [OCPBUGS-92080](https://issues.redhat.com/browse/OCPBUGS-92080): Adds rendering of enable-multi-network-policy in ovnkube-node [#3084](https://github.com/openshift/cluster-network-operator/pull/3084)
* [OCPBUGS-112562](https://issues.redhat.com/browse/OCPBUGS-112562): CVE-2026-41178 - bump go.opentelemetry.io/otel to v1.44.0 [#3132](https://github.com/openshift/cluster-network-operator/pull/3132)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/31a6ffd3e4c2b466607c21bed423d33b1f7e77e6...67681812fea3d0477cdcdd5be167dcd959164e1b)
### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/f02d1329cbef6d83e0d52e687d71eeef50b67c90)
* [CNF-28347](https://issues.redhat.com/browse/CNF-28347): Makefile: fix ARM e2e target and Hypershift ginkgo args [#1675](https://github.com/openshift/cluster-node-tuning-operator/pull/1675)
* NO-JIRA: fix isolatedCpuFreq doc comment to say maximum frequency [#1669](https://github.com/openshift/cluster-node-tuning-operator/pull/1669)
* NO-JIRA: Restrict metrics and webhook ingress [#1670](https://github.com/openshift/cluster-node-tuning-operator/pull/1670)
* NO-JIRA: tuned: restrict profile names [#1661](https://github.com/openshift/cluster-node-tuning-operator/pull/1661)
* [OSDOCS-22738](https://issues.redhat.com/browse/OSDOCS-22738): Fix hexadecimal typos in PerformanceProfile device comments [#1640](https://github.com/openshift/cluster-node-tuning-operator/pull/1640)
* [OCPBUGS-129451](https://issues.redhat.com/browse/OCPBUGS-129451): E2E: remove always-skipped IRQ load balance test [#1653](https://github.com/openshift/cluster-node-tuning-operator/pull/1653)
* [OCPBUGS-129613](https://issues.redhat.com/browse/OCPBUGS-129613): E2E: Add labels to ovsdpdk tests [#1657](https://github.com/openshift/cluster-node-tuning-operator/pull/1657)
* NO-JIRA: Update OWNERS file [#1655](https://github.com/openshift/cluster-node-tuning-operator/pull/1655)
* [OCPBUGS-129449](https://issues.redhat.com/browse/OCPBUGS-129449): E2E: Fix flaky test_id:64099 reboot assertion [#1652](https://github.com/openshift/cluster-node-tuning-operator/pull/1652)
* [OCPBUGS-115749](https://issues.redhat.com/browse/OCPBUGS-115749): Tighten operator RBAC to least privilege [#1639](https://github.com/openshift/cluster-node-tuning-operator/pull/1639)
* [OCPBUGS-66217](https://issues.redhat.com/browse/OCPBUGS-66217): PerformanceProfile and Tuned CRDs during bootstrap [#1596](https://github.com/openshift/cluster-node-tuning-operator/pull/1596)
* [OCPBUGS-127113](https://issues.redhat.com/browse/OCPBUGS-127113): E2E: Fix no-op Get() assertions in mixedcpus [#1571](https://github.com/openshift/cluster-node-tuning-operator/pull/1571)
* [OCPBUGS-129448](https://issues.redhat.com/browse/OCPBUGS-129448): E2E: check against available cpus instead of online cpuset [#1645](https://github.com/openshift/cluster-node-tuning-operator/pull/1645)
* [OCPBUGS-129450](https://issues.redhat.com/browse/OCPBUGS-129450): E2E: LLC: Fix assertions of odd cpus allocations [#1644](https://github.com/openshift/cluster-node-tuning-operator/pull/1644)
* [OCPBUGS-129165](https://issues.redhat.com/browse/OCPBUGS-129165): Makefile: Modify pao-functests-update-only to run tier-0 and tier-1 tests [#1651](https://github.com/openshift/cluster-node-tuning-operator/pull/1651)
* [OCPBUGS-105474](https://issues.redhat.com/browse/OCPBUGS-105474): Prevent offlined CPUs from being re-onlined after reboot by udev hotplug rule [#1618](https://github.com/openshift/cluster-node-tuning-operator/pull/1618)
* [OCPBUGS-126458](https://issues.redhat.com/browse/OCPBUGS-126458): E2E: PPC: replace no-op log-on-match with actual assertions (4 sites) [#1638](https://github.com/openshift/cluster-node-tuning-operator/pull/1638)
* NO-JIRA: Address govulncheck complaints [#1637](https://github.com/openshift/cluster-node-tuning-operator/pull/1637)
* [OCPBUGS-127362](https://issues.redhat.com/browse/OCPBUGS-127362): E2E: ovsDpdk remaining cases and consolidate suite [#1628](https://github.com/openshift/cluster-node-tuning-operator/pull/1628)
* [OCPBUGS-116703](https://issues.redhat.com/browse/OCPBUGS-116703): E2E: add missing matcher to offlined CPU Expect() calls [#1629](https://github.com/openshift/cluster-node-tuning-operator/pull/1629)
* [OCPBUGS-112336](https://issues.redhat.com/browse/OCPBUGS-112336): apis: add missing fields to apis v1 [#1597](https://github.com/openshift/cluster-node-tuning-operator/pull/1597)
* NO-JIRA: Fix CentOS Stream image build failing in dnf history undo [#1633](https://github.com/openshift/cluster-node-tuning-operator/pull/1633)
* [CNF-23698](https://issues.redhat.com/browse/CNF-23698): e2e: make OVS dynamic pinning tests compatible with ovsDpdk CPUs [#1598](https://github.com/openshift/cluster-node-tuning-operator/pull/1598)
* [CNF-25173](https://issues.redhat.com/browse/CNF-25173): e2e: resolve primary MCP from profile in test 32364 [#1624](https://github.com/openshift/cluster-node-tuning-operator/pull/1624)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/246b707a99945e3c23291d7776446358ec3b7511...f02d1329cbef6d83e0d52e687d71eeef50b67c90)
### [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator/tree/f71f8213797cc8cfda3569baae15f387b57a745c)
* [OCPBUGS-132357](https://issues.redhat.com/browse/OCPBUGS-132357): Prevent TLS curve restart loop on FIPS clusters [#257](https://github.com/openshift/cluster-olm-operator/pull/257)
* [OPRUN-4799](https://issues.redhat.com/browse/OPRUN-4799): Update OpenShift and Kubernetes libraries [#260](https://github.com/openshift/cluster-olm-operator/pull/260)
* NO-ISSUE: Remove SingleOwnNamespaceInstallSupport integration [#256](https://github.com/openshift/cluster-olm-operator/pull/256)
* NO-ISSUE: Bump github.com/operator-framework/operator-controller from 1.11.0 to 1.12.0 [#253](https://github.com/openshift/cluster-olm-operator/pull/253)
* NO-ISSUE: Support object-controller (ClusterObjectSet) component [#255](https://github.com/openshift/cluster-olm-operator/pull/255)
* [OPRUN-4768](https://issues.redhat.com/browse/OPRUN-4768): Apply TLS curve preferences to metrics server [#248](https://github.com/openshift/cluster-olm-operator/pull/248)
* [OCPBUGS-105876](https://issues.redhat.com/browse/OCPBUGS-105876): Wire availableInertia into the olm StatusSyncer [#233](https://github.com/openshift/cluster-olm-operator/pull/233)
* [OPRUN-4645](https://issues.redhat.com/browse/OPRUN-4645): observe and apply TLS curve preferences to operand deployments [#226](https://github.com/openshift/cluster-olm-operator/pull/226)
* NO-ISSUE: Bump helm.sh/helm/v3 from 3.21.3 to 3.21.4 [#235](https://github.com/openshift/cluster-olm-operator/pull/235)
* [Full changelog](https://github.com/openshift/cluster-olm-operator/compare/addad7cab1b1cb0854349c8404c08128fe420402...f71f8213797cc8cfda3569baae15f387b57a745c)
### [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator/tree/0bd629d8590e09ef6157f906c717f3e842e51d44)
* NO-JIRA: bump(openshift/library-go): to get retry in preflight check status report [#812](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/812)
* [CNTRLPLANE-4439](https://issues.redhat.com/browse/CNTRLPLANE-4439): feat: inject tls groups [#793](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/793)
* NO-JIRA: Update library-go to run conditional step in KMS [#811](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/811)
* NO-JIRA: bump(openshift/library-go): to get KMS GA [#810](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/810)
* NO-JIRA: Update library-go [#809](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/809)
* NO-JIRA: Update library-go [#807](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/807)
* [CNTRLPLANE-4731](https://issues.redhat.com/browse/CNTRLPLANE-4731): Adding KMS e2e preflight and e2e rotation [#806](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/806)
* NO-JIRA: Update library-go [#803](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/803)
* NO-JIRA: Update library-go [#802](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/802)
* NO-JIRA: bump openshift/api https://github.com/openshift/api/pull/3083 [#798](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/798)
* NO-JIRA: Open bump library-go https://github.com/openshift/library-go/pull/2518 [#797](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/797)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2512 [#794](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/794)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2474 [#792](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/792)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): encryption/assertion: bring back the preflight assertion for CAO and OAS-O [#787](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/787)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): bump library-go to get the new KMS plugin deployment strategy [#781](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/781)
* [OCPBUGS-109468](https://issues.redhat.com/browse/OCPBUGS-109468): fix CVE-2026-41178 by updating otel to v1.44.0 [#761](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/761)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2478 [#783](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/783)
* [OPRUN-4768](https://issues.redhat.com/browse/OPRUN-4768): bump openshift/api [#782](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/782)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2463- #2309 [#770](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/770)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#768](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/768)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2439 [#767](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/767)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pick https://github.com/openshift/library-go/pull/2449- #2287 [#764](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/764)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2451 [#763](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/763)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): kms: wire EncryptionConfigurationComputer into encryption controllers [#762](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/762)
* [Full changelog](https://github.com/openshift/cluster-openshift-apiserver-operator/compare/c7cea84d7f74b5aca7ea27e49fc2be814d744e60...0bd629d8590e09ef6157f906c717f3e842e51d44)
### [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator/tree/8da2f1fcb1e76e8b1b97b16ca7bbfa7116287eb8)
* [OCPBUGS-112448](https://issues.redhat.com/browse/OCPBUGS-112448): Bump kubernetes dependencies to v1.36 [#444](https://github.com/openshift/cluster-openshift-controller-manager-operator/pull/444)
* [Full changelog](https://github.com/openshift/cluster-openshift-controller-manager-operator/compare/ca4d2061fba488b34c042e7a16946157db595599...8da2f1fcb1e76e8b1b97b16ca7bbfa7116287eb8)
### [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller/tree/81e222007c2ceec48a908877eb71fb135a2c2453)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): bump k8s 1.37 [#211](https://github.com/openshift/cluster-policy-controller/pull/211)
* [CNTRLPLANE-3731](https://issues.redhat.com/browse/CNTRLPLANE-3731): Add Agentic SDLC context files to cluster-policy-controller [#191](https://github.com/openshift/cluster-policy-controller/pull/191)
* [Full changelog](https://github.com/openshift/cluster-policy-controller/compare/469bbf211d35eee0df4422bda7e9e600b080f0f2...81e222007c2ceec48a908877eb71fb135a2c2453)
### [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator/tree/cb826726d77224d5e8d1fd9026d25525c6982a55)
* NO-ISSUE: Restrict samples operator access to the global pull-secret [#726](https://github.com/openshift/cluster-samples-operator/pull/726)
* [CNTRLPLANE-4448](https://issues.redhat.com/browse/CNTRLPLANE-4448): Support for TLS Group Preferences [#725](https://github.com/openshift/cluster-samples-operator/pull/725)
* [Full changelog](https://github.com/openshift/cluster-samples-operator/compare/a4147d3308b2e935f58cf05eac4bf5fa35fa6cf8...cb826726d77224d5e8d1fd9026d25525c6982a55)
### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/05cac72a292e2b6a7ce541f530621dc81b07cedb)
* [STOR-3187](https://issues.redhat.com/browse/STOR-3187): Add csi-volume-device-exporter to CSO manifests [#762](https://github.com/openshift/cluster-storage-operator/pull/762)
* [OCPBUGS-104847](https://issues.redhat.com/browse/OCPBUGS-104847): Remove SELinuxMountGAReadiness patches [#759](https://github.com/openshift/cluster-storage-operator/pull/759)
* [STOR-3172](https://issues.redhat.com/browse/STOR-3172): Add TLS group support to CSO [#758](https://github.com/openshift/cluster-storage-operator/pull/758)
* [STOR-3176](https://issues.redhat.com/browse/STOR-3176): Add featuregates and clusterversions permissions to ClusterRoles [#756](https://github.com/openshift/cluster-storage-operator/pull/756)
* [STOR-3068](https://issues.redhat.com/browse/STOR-3068): Bump all libraries [#755](https://github.com/openshift/cluster-storage-operator/pull/755)
* [OCPBUGS-120762](https://issues.redhat.com/browse/OCPBUGS-120762): restrict azure-file secrets ClusterRole to get/list/watch/create [#750](https://github.com/openshift/cluster-storage-operator/pull/750)
* [OCPBUGS-127462](https://issues.redhat.com/browse/OCPBUGS-127462): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#748](https://github.com/openshift/cluster-storage-operator/pull/748)
* [OCPBUGS-127453](https://issues.redhat.com/browse/OCPBUGS-127453): Fix the un-upgradeable message [#746](https://github.com/openshift/cluster-storage-operator/pull/746)
* [OCPBUGS-127453](https://issues.redhat.com/browse/OCPBUGS-127453): Use KCS link in the un-upgradeable message [#744](https://github.com/openshift/cluster-storage-operator/pull/744)
* [GCP-958](https://issues.redhat.com/browse/GCP-958): re-enable GCP PD CSI driver in HyperShift path [#742](https://github.com/openshift/cluster-storage-operator/pull/742)
* [GCP-958](https://issues.redhat.com/browse/GCP-958): temporarily disable GCP PD CSI driver in HyperShift path [#739](https://github.com/openshift/cluster-storage-operator/pull/739)
* [GCP-1075](https://issues.redhat.com/browse/GCP-1075): feat(gcp-pd): enable HyperShift support for GCP PD CSI driver operator [#728](https://github.com/openshift/cluster-storage-operator/pull/728)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/6b031ec699a65512557b70eabedd85a95c238bbb...05cac72a292e2b6a7ce541f530621dc81b07cedb)
### [cluster-update-console-plugin](https://github.com/openshift/cluster-update-console-plugin/tree/770c09fa8741e3167dad266dc931b6ed036d3884)
* [OCPBUGS-128821](https://issues.redhat.com/browse/OCPBUGS-128821): Fix analysis timeout stuck in Analyzing state [#25](https://github.com/openshift/cluster-update-console-plugin/pull/25)
* [OTA-2140](https://issues.redhat.com/browse/OTA-2140): Add ApprovalPolicy warning banner for non-manual stages [#28](https://github.com/openshift/cluster-update-console-plugin/pull/28)
* [OCPBUGS-128825](https://issues.redhat.com/browse/OCPBUGS-128825): Re-analyse deletes AgenticRun for fresh cluster data [#26](https://github.com/openshift/cluster-update-console-plugin/pull/26)
* NO-JIRA: Update OWNERS file [#27](https://github.com/openshift/cluster-update-console-plugin/pull/27)
* [Full changelog](https://github.com/openshift/cluster-update-console-plugin/compare/02b220dd2aef5c1788768178e3ffd8592ccb89b9...770c09fa8741e3167dad266dc931b6ed036d3884)
### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/6ed826deb367c76ae1904d00c7cdf36969be9842)
* [OTA-2144](https://issues.redhat.com/browse/OTA-2144): Add a curve preference override for metrics [#1500](https://github.com/openshift/cluster-version-operator/pull/1500)
* [OCPCLOUD-3725](https://issues.redhat.com/browse/OCPCLOUD-3725): refactor(capability): use ClusterAPIOperator instead of ClusterAPIMachineManagement [#1499](https://github.com/openshift/cluster-version-operator/pull/1499)
* NO-JIRA: test/util: wait for the update service to serve before returning [#1498](https://github.com/openshift/cluster-version-operator/pull/1498)
* [OTA-2144](https://issues.redhat.com/browse/OTA-2144): TLSGroups support on the /metrics endpoint [#1495](https://github.com/openshift/cluster-version-operator/pull/1495)
* [CNTRLPLANE-4455](https://issues.redhat.com/browse/CNTRLPLANE-4455): Inject observed TLS Groups into annotated ConfigMaps [#1484](https://github.com/openshift/cluster-version-operator/pull/1484)
* NO-JIRA: test/cvo: serve accept-risks graph from in-cluster update service [#1476](https://github.com/openshift/cluster-version-operator/pull/1476)
* [OTA-2130](https://issues.redhat.com/browse/OTA-2130): add execution step, planner skill, and risk data [#1475](https://github.com/openshift/cluster-version-operator/pull/1475)
* [OCPBUGS-65558](https://issues.redhat.com/browse/OCPBUGS-65558): Cancel payload retrieval pod on upgrade clear [#1470](https://github.com/openshift/cluster-version-operator/pull/1470)
* [OCPBUGS-8252](https://issues.redhat.com/browse/OCPBUGS-8252): pkg/cvo: report unresolvable desired releases [#1467](https://github.com/openshift/cluster-version-operator/pull/1467)
* [OCPBUGS-129378](https://issues.redhat.com/browse/OCPBUGS-129378): skip console plugin deployment on OCP < 5.0 [#1482](https://github.com/openshift/cluster-version-operator/pull/1482)
* NO-ISSUE: docs/user/tasks-*by-number-and-component.svg: Update to 5.0 [#1485](https://github.com/openshift/cluster-version-operator/pull/1485)
* NO-JIRA: pkg/cvo: add architecture label to cluster_version_payload [#1480](https://github.com/openshift/cluster-version-operator/pull/1480)
* NO-ISSUE: test/cvo: set needRecover before mutating cluster resources [#1477](https://github.com/openshift/cluster-version-operator/pull/1477)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#1471](https://github.com/openshift/cluster-version-operator/pull/1471)
* [OKD-194](https://issues.redhat.com/browse/OKD-194): Add OKD cincinnati as the default update service for OKD [#1466](https://github.com/openshift/cluster-version-operator/pull/1466)
* [OTA-2109](https://issues.redhat.com/browse/OTA-2109): harden console plugin nginx TLS configuration [#1453](https://github.com/openshift/cluster-version-operator/pull/1453)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/697ea9314e3e5c39b218b8781b32813b0e4ae84c...6ed826deb367c76ae1904d00c7cdf36969be9842)
### [console](https://github.com/openshift/console/tree/8b308232798fb7dcc073eac0b83aa367c44d7ff0)
* [CONSOLE-3958](https://issues.redhat.com/browse/CONSOLE-3958): Replace getting started components with MultiContentCard [#17444](https://github.com/openshift/console/pull/17444)
* [CONSOLE-5568](https://issues.redhat.com/browse/CONSOLE-5568): update demo plugin tooling config [#17453](https://github.com/openshift/console/pull/17453)
* [CONSOLE-5568](https://issues.redhat.com/browse/CONSOLE-5568): clean up eslint config in vscode [#17442](https://github.com/openshift/console/pull/17442)
* [OCPBUGS-132777](https://issues.redhat.com/browse/OCPBUGS-132777): Remove the redundant detailsPage wrapper [#17413](https://github.com/openshift/console/pull/17413)
* [CONSOLE-5527](https://issues.redhat.com/browse/CONSOLE-5527): Split operator catalog into Classic and Next-Gen types [#17355](https://github.com/openshift/console/pull/17355)
* [CONSOLE-5570](https://issues.redhat.com/browse/CONSOLE-5570): Allow blob image sources in the default CSP [#17437](https://github.com/openshift/console/pull/17437)
* [OCPBUGS-128928](https://issues.redhat.com/browse/OCPBUGS-128928): Preserve ~new route when switching projects [#17349](https://github.com/openshift/console/pull/17349)
* [OCPBUGS-132338](https://issues.redhat.com/browse/OCPBUGS-132338): Preserve revealed Secret values across page rerenders [#17412](https://github.com/openshift/console/pull/17412)
* [CONSOLE-5568](https://issues.redhat.com/browse/CONSOLE-5568): migrate to oxlint [#17425](https://github.com/openshift/console/pull/17425)
* [CONSOLE-5479](https://issues.redhat.com/browse/CONSOLE-5479): UI and backend for OLMv0-to-OLMv1 migration [#17377](https://github.com/openshift/console/pull/17377)
* [OCPBUGS-132933](https://issues.redhat.com/browse/OCPBUGS-132933): Isolate polling test plugin mocks [#17421](https://github.com/openshift/console/pull/17421)
* NO-JIRA: migrate to ESM only + migrate to oxfmt [#17408](https://github.com/openshift/console/pull/17408)
* [OCPBUGS-132163](https://issues.redhat.com/browse/OCPBUGS-132163): Use "Technology Preview" in preview badge labels [#17396](https://github.com/openshift/console/pull/17396)
* [CONSOLE-5477](https://issues.redhat.com/browse/CONSOLE-5477): Support TLS group preferences [#17371](https://github.com/openshift/console/pull/17371)
* [CONSOLE-5567](https://issues.redhat.com/browse/CONSOLE-5567): Increase size of annotation, label and taint edit modals [#17398](https://github.com/openshift/console/pull/17398)
* [OCPBUGS-114708](https://issues.redhat.com/browse/OCPBUGS-114708): Remove early "analytics.page()" on Segment init [#17178](https://github.com/openshift/console/pull/17178)
* [OCPBUGS-132032](https://issues.redhat.com/browse/OCPBUGS-132032): Restore ConfigMap and BuildConfig form view edit actions [#17397](https://github.com/openshift/console/pull/17397)
* [CONSOLE-4824](https://issues.redhat.com/browse/CONSOLE-4824): migrate remaining jsx/js to tsx/ts [#17391](https://github.com/openshift/console/pull/17391)
* [CONSOLE-5552](https://issues.redhat.com/browse/CONSOLE-5552): Add Bridge CSP mode flag [#17369](https://github.com/openshift/console/pull/17369)
* NO-JIRA: Console plugin SDK package CHANGELOG update [#17392](https://github.com/openshift/console/pull/17392)
* [CONSOLE-5065](https://issues.redhat.com/browse/CONSOLE-5065): Migrate off of deprecated TS types [#17140](https://github.com/openshift/console/pull/17140)
* [CONSOLE-5065](https://issues.redhat.com/browse/CONSOLE-5065): Hold back on dynamicModulePatternFlyPackages update [#17390](https://github.com/openshift/console/pull/17390)
* [OCPBUGS-125794](https://issues.redhat.com/browse/OCPBUGS-125794): Show Software Catalog operators for namespace-scoped users [#17327](https://github.com/openshift/console/pull/17327)
* [CONSOLE-5564](https://issues.redhat.com/browse/CONSOLE-5564): ConsoleDataView API improvements [#17385](https://github.com/openshift/console/pull/17385)
* [OCPBUGS-130732](https://issues.redhat.com/browse/OCPBUGS-130732): Add security response headers [#17376](https://github.com/openshift/console/pull/17376)
* [CONSOLE-5065](https://issues.redhat.com/browse/CONSOLE-5065): Update dynamicModulePatternFlyPackages and related imports [#17379](https://github.com/openshift/console/pull/17379)
* [HELM-863](https://issues.redhat.com/browse/HELM-863): Show Helm nav tab regardless of HelmChartRepository/ProjectHelmChartRepository instance existence [#17338](https://github.com/openshift/console/pull/17338)
* [CONSOLE-5564](https://issues.redhat.com/browse/CONSOLE-5564): Add rearrangable columns to ConsoleDataView [#17370](https://github.com/openshift/console/pull/17370)
* [CONSOLE-5549](https://issues.redhat.com/browse/CONSOLE-5549): Add performance profiling for the dashboards page [#17346](https://github.com/openshift/console/pull/17346)
* [CONSOLE-5560](https://issues.redhat.com/browse/CONSOLE-5560): table column extension follow ups [#17363](https://github.com/openshift/console/pull/17363)
* [CONSOLE-5560](https://issues.redhat.com/browse/CONSOLE-5560): Add ConsoleDataView table column extensions [#17351](https://github.com/openshift/console/pull/17351)
* [OCPBUGS-84497](https://issues.redhat.com/browse/OCPBUGS-84497): Cap rendered alerts in notification drawer and dashboards [#17324](https://github.com/openshift/console/pull/17324)
* [CONSOLE-5544](https://issues.redhat.com/browse/CONSOLE-5544): Migrate OLM tables to ConsoleDataView [#17342](https://github.com/openshift/console/pull/17342)
* [CONSOLE-5540](https://issues.redhat.com/browse/CONSOLE-5540): Migrate metal3, container-security, and shipwright tables to ConsoleDataView [#17340](https://github.com/openshift/console/pull/17340)
* [CONSOLE-5099](https://issues.redhat.com/browse/CONSOLE-5099): Add kubeconfig download for ServiceAccounts and current user [#17199](https://github.com/openshift/console/pull/17199)
* [OCPBUGS-128719](https://issues.redhat.com/browse/OCPBUGS-128719): fix incorrect breakpoint in code editor sidebar [#17336](https://github.com/openshift/console/pull/17336)
* [CONSOLE-5539](https://issues.redhat.com/browse/CONSOLE-5539): Migrate knative tables to ConsoleDataView [#17326](https://github.com/openshift/console/pull/17326)
* [OCPBUGS-128465](https://issues.redhat.com/browse/OCPBUGS-128465): Fix flaky namespace selection and eliminate cross-file contention in OLM Data Grid e2e specs [#17329](https://github.com/openshift/console/pull/17329)
* [HELM-859](https://issues.redhat.com/browse/HELM-859): Guard against null/missing urls in Helm charts [#17280](https://github.com/openshift/console/pull/17280)
* [OCPBUGS-127046](https://issues.redhat.com/browse/OCPBUGS-127046): provide PatternFly dynamic modules without Console consuming them [#17318](https://github.com/openshift/console/pull/17318)
* NO-JIRA: Document the console.page/resource/list contract [#17312](https://github.com/openshift/console/pull/17312)
* [OCPBUGS-71193](https://issues.redhat.com/browse/OCPBUGS-71193): Group details page renders a kebab button instead of Actions button [#17197](https://github.com/openshift/console/pull/17197)
* NO-JIRA: small improvements and dep bumps [#17219](https://github.com/openshift/console/pull/17219)
* [CONSOLE-5113](https://issues.redhat.com/browse/CONSOLE-5113): Add default namespace warnings [#17177](https://github.com/openshift/console/pull/17177)
* [OCPBUGS-126807](https://issues.redhat.com/browse/OCPBUGS-126807): Post qa-verify evidence via gh's native --attach instead of base64 [#17193](https://github.com/openshift/console/pull/17193)
* [OCPBUGS-125223](https://issues.redhat.com/browse/OCPBUGS-125223): restore some old test-prow-e2e scenarios [#17187](https://github.com/openshift/console/pull/17187)
* [OCPBUGS-126219](https://issues.redhat.com/browse/OCPBUGS-126219): i18n upload/download routine task - version 4.23/5.0 (Additional) [#17190](https://github.com/openshift/console/pull/17190)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#17176](https://github.com/openshift/console/pull/17176)
* [OCPBUGS-90834](https://issues.redhat.com/browse/OCPBUGS-90834): Fix empty vSphere connection details after upgrade [#17020](https://github.com/openshift/console/pull/17020)
* [OCPBUGS-123141](https://issues.redhat.com/browse/OCPBUGS-123141): i18n upload/download routine task - version 4.23/5.0 [#17165](https://github.com/openshift/console/pull/17165)
* [CONSOLE-4998](https://issues.redhat.com/browse/CONSOLE-4998): Add types for serverless resources [#17152](https://github.com/openshift/console/pull/17152)
* [OCPBUGS-121263](https://issues.redhat.com/browse/OCPBUGS-121263): bump go-git to 5.19.2 [#17148](https://github.com/openshift/console/pull/17148)
* [OCPBUGS-115458](https://issues.redhat.com/browse/OCPBUGS-115458): CVE-2026-84375 bump js-yaml to 3.15.2/4.3.2 [#17133](https://github.com/openshift/console/pull/17133)
* [OCPBUGS-115318](https://issues.redhat.com/browse/OCPBUGS-115318): fix Helm test flake by replacing pkill with PID-file cleanup [#17128](https://github.com/openshift/console/pull/17128)
* [OCPBUGS-120684](https://issues.redhat.com/browse/OCPBUGS-120684): Update stale comment [#17141](https://github.com/openshift/console/pull/17141)
* NO-JIRA: add prettier to playwright folder [#17137](https://github.com/openshift/console/pull/17137)
* [OCPBUGS-115300](https://issues.redhat.com/browse/OCPBUGS-115300): Stabilize topology, node-groups, and debug-pod e2e [#17134](https://github.com/openshift/console/pull/17134)
* [OCPBUGS-115300](https://issues.redhat.com/browse/OCPBUGS-115300): Fix Playwright login helper idempotency and session recovery [#17126](https://github.com/openshift/console/pull/17126)
* [HELM-480](https://issues.redhat.com/browse/HELM-480): Change handler return code [#17042](https://github.com/openshift/console/pull/17042)
* [OCPBUGS-115298](https://issues.redhat.com/browse/OCPBUGS-115298): Rename e2e scripts so playwright is the main one [#17127](https://github.com/openshift/console/pull/17127)
* [CONSOLE-5002](https://issues.redhat.com/browse/CONSOLE-5002): `UserPreferenceContext`and linting follow up [#17124](https://github.com/openshift/console/pull/17124)
* And 30 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/console/compare/a5af6d5d69b83b6165b50ab42b8c9df4548c87d2...8b308232798fb7dcc073eac0b83aa367c44d7ff0)
### [console-operator](https://github.com/openshift/console-operator/tree/a0d111dd8b824e519ffd291b06da52bcf93ca8ec)
* [TRT-3060](https://issues.redhat.com/browse/TRT-3060): Revert #1158 "CONSOLE-5293: Use console-downloads image instead of cli-artifacts" [#1251](https://github.com/openshift/console-operator/pull/1251)
* [CONSOLE-5293](https://issues.redhat.com/browse/CONSOLE-5293): Use console-downloads image instead of cli-artifacts [#1158](https://github.com/openshift/console-operator/pull/1158)
* [OCPBUGS-132701](https://issues.redhat.com/browse/OCPBUGS-132701): Gate tlsGroups observation on TLSGroupPreferences [#1248](https://github.com/openshift/console-operator/pull/1248)
* [CONSOLE-5477](https://issues.redhat.com/browse/CONSOLE-5477): Support TLS group preferences [#1240](https://github.com/openshift/console-operator/pull/1240)
* [HELM-850](https://issues.redhat.com/browse/HELM-850): Address review feedback on Helm CLI download descriptions [#1235](https://github.com/openshift/console-operator/pull/1235)
* [RFE-4149](https://issues.redhat.com/browse/RFE-4149): Read only filesystem - temp directory mount [#1014](https://github.com/openshift/console-operator/pull/1014)
* [TRT-3005](https://issues.redhat.com/browse/TRT-3005): Revert #1227 "OCPSTRAT-3567: Replace console allow-all NetworkPolicy with scoped policies" [#1241](https://github.com/openshift/console-operator/pull/1241)
* NO-JIRA: Update API and client-go dependencies for Console ingress helper rename [#1236](https://github.com/openshift/console-operator/pull/1236)
* [OCPSTRAT-3567](https://issues.redhat.com/browse/OCPSTRAT-3567): Replace console allow-all NetworkPolicy with scoped policies [#1227](https://github.com/openshift/console-operator/pull/1227)
* [OCPBUGS-86719](https://issues.redhat.com/browse/OCPBUGS-86719): Use zero-downtime rollout strategy for console pods [#1168](https://github.com/openshift/console-operator/pull/1168)
* [CNTRLPLANE-4564](https://issues.redhat.com/browse/CNTRLPLANE-4564): Update to the latest openshift/api and rebase to 1.37 [#1237](https://github.com/openshift/console-operator/pull/1237)
* [OCPBUGS-109666](https://issues.redhat.com/browse/OCPBUGS-109666): fix the name of the Helm release in EAP 8.1 quickstart [#1208](https://github.com/openshift/console-operator/pull/1208)
* [OCPBUGS-121388](https://issues.redhat.com/browse/OCPBUGS-121388): Make console status flush cancellation-aware [#1228](https://github.com/openshift/console-operator/pull/1228)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#1230](https://github.com/openshift/console-operator/pull/1230)
* [CONSOLE-5405](https://issues.redhat.com/browse/CONSOLE-5405): Update console-operator to Kubernetes 1.36 [#1211](https://github.com/openshift/console-operator/pull/1211)
* [OCPBUGS-104500](https://issues.redhat.com/browse/OCPBUGS-104500): Use content hash for ConfigMap deployment annotations [#1217](https://github.com/openshift/console-operator/pull/1217)
* [Full changelog](https://github.com/openshift/console-operator/compare/c285c672c5928a66775051de5cc0b99c90cfac41...a0d111dd8b824e519ffd291b06da52bcf93ca8ec)
### [container-networking-plugins, containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins/tree/44c6428e4c9a20fd2f0c3ad4de11e50862a51151)
* [CORENET-7231](https://issues.redhat.com/browse/CORENET-7231): Update OWNERS file [#241](https://github.com/openshift/containernetworking-plugins/pull/241)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#248](https://github.com/openshift/containernetworking-plugins/pull/248)
* [Full changelog](https://github.com/openshift/containernetworking-plugins/compare/b0bea6bcba28cab2ffa15da03cbae98805af7eca...44c6428e4c9a20fd2f0c3ad4de11e50862a51151)
### [coredns](https://github.com/openshift/coredns/tree/c7b28efa94231de224dcb057e49bbabc9fe0286b)
* [NE-2790](https://issues.redhat.com/browse/NE-2790): Update CoreDNS to v1.14.7 [#197](https://github.com/openshift/coredns/pull/197)
* [OCPBUGS-125770](https://issues.redhat.com/browse/OCPBUGS-125770): validate DNS requests before unpacking [#217](https://github.com/openshift/coredns/pull/217)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#215](https://github.com/openshift/coredns/pull/215)
* [Full changelog](https://github.com/openshift/coredns/compare/37aaba896e97f4b9a091aab6d36f2213b8854474...c7b28efa94231de224dcb057e49bbabc9fe0286b)
### [csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/049e93b693fd5ea7cbcddade0d4361f6d5125c0b)
* [OSASINFRA-4483](https://issues.redhat.com/browse/OSASINFRA-4483): UPSTREAM: <carry>: Initial Dockerfile for osbrick-sidecar [#447](https://github.com/openshift/cloud-provider-openstack/pull/447)
* UPSTREAM-SYNC: Sync main with latest upstream (release-1.37) [#446](https://github.com/openshift/cloud-provider-openstack/pull/446)
* [OCPBUGS-98116](https://issues.redhat.com/browse/OCPBUGS-98116): Bump golang.org/x/crypto to v0.52.0 [#410](https://github.com/openshift/cloud-provider-openstack/pull/410)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/aa9a8100e87ff13abf4dd6343c84c9f4948debef...049e93b693fd5ea7cbcddade0d4361f6d5125c0b)
### [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs/tree/69f816f69e1273868bc19cb13fe6dbd9a7a9ff5f)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master (f12e133) into main [#199](https://github.com/openshift/csi-driver-nfs/pull/199)
* [Full changelog](https://github.com/openshift/csi-driver-nfs/compare/beb9567b4ef15656a88c1c71e0b08e7bf2e96aaa...69f816f69e1273868bc19cb13fe6dbd9a7a9ff5f)
### [csi-external-attacher](https://github.com/openshift/csi-external-attacher/tree/9fec0cd4e5043505e3b0bf7230e3d41e1482f85b)
* [STOR-3085](https://issues.redhat.com/browse/STOR-3085): Rebase to upstream v4.13.0 for OCP 5.1 [#123](https://github.com/openshift/csi-external-attacher/pull/123)
* [Full changelog](https://github.com/openshift/csi-external-attacher/compare/3fd668b3f07dd382e5c7b6239d50f7988f652e64...9fec0cd4e5043505e3b0bf7230e3d41e1482f85b)
### [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner/tree/4af23e6310423f2be9f25dbd772d228a6ca34443)
* [STOR-3085](https://issues.redhat.com/browse/STOR-3085): Rebase to upstream v6.4.0 for OCP 5.1 [#165](https://github.com/openshift/csi-external-provisioner/pull/165)
* [Full changelog](https://github.com/openshift/csi-external-provisioner/compare/7ff338c9d1296f0e5d4d8080a76bb191c8f3be30...4af23e6310423f2be9f25dbd772d228a6ca34443)
### [csi-external-resizer](https://github.com/openshift/csi-external-resizer/tree/c01245ea625e058d6ee032fb2b3a2595a7ad499c)
* [STOR-3085](https://issues.redhat.com/browse/STOR-3085): Rebase to upstream v2.3.0 for OCP 5.1 [#217](https://github.com/openshift/csi-external-resizer/pull/217)
* [Full changelog](https://github.com/openshift/csi-external-resizer/compare/14aa7028f485e95c800bb7ffbf9b66a2bf75ceaf...c01245ea625e058d6ee032fb2b3a2595a7ad499c)
### [csi-external-snapshot-metadata](https://github.com/openshift/csi-external-snapshot-metadata/tree/0399f2634abb48378e1a29899530c1de157a03ec)
* [STOR-3085](https://issues.redhat.com/browse/STOR-3085): Rebase to upstream v1.1.0 for OCP 5.1 [#35](https://github.com/openshift/csi-external-snapshot-metadata/pull/35)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#27](https://github.com/openshift/csi-external-snapshot-metadata/pull/27)
* NO-ISSUE: Bump golang.org/x/net to v0.53.0 and Go to 1.25.10 [#22](https://github.com/openshift/csi-external-snapshot-metadata/pull/22)
* [Full changelog](https://github.com/openshift/csi-external-snapshot-metadata/compare/239703c637e005cf785892d214d219add70e3533...0399f2634abb48378e1a29899530c1de157a03ec)
### [csi-external-snapshotter, csi-snapshot-controller](https://github.com/openshift/csi-external-snapshotter/tree/a570de6a368dab9532e540d7f1ce10c3b03c6d1a)
* [STOR-3085](https://issues.redhat.com/browse/STOR-3085): Rebase to upstream v8.7.0 for OCP 5.1 [#260](https://github.com/openshift/csi-external-snapshotter/pull/260)
* [Full changelog](https://github.com/openshift/csi-external-snapshotter/compare/a019d1a9d9e1d26ffd0b2e0d911733180fa608b2...a570de6a368dab9532e540d7f1ce10c3b03c6d1a)
### [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe/tree/be6ff291d9015cd0a96f54c152b18864906b5a6b)
* [STOR-3085](https://issues.redhat.com/browse/STOR-3085): Rebase to upstream v2.20.0 for OCP 5.1 [#105](https://github.com/openshift/csi-livenessprobe/pull/105)
* [OCPBUGS-122222](https://issues.redhat.com/browse/OCPBUGS-122222): Bump go.opentelemetry.io/otel to v1.44.0 to address CVE-2026-41178 [#96](https://github.com/openshift/csi-livenessprobe/pull/96)
* [Full changelog](https://github.com/openshift/csi-livenessprobe/compare/463dc553ebb04df192d573c5a1612dcb50cb1f52...be6ff291d9015cd0a96f54c152b18864906b5a6b)
### [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar/tree/de3c4217dca58af8b0b267c378eccae45e9eeaf5)
* [STOR-3085](https://issues.redhat.com/browse/STOR-3085): Rebase to upstream v2.18.0 for OCP 5.1 [#110](https://github.com/openshift/csi-node-driver-registrar/pull/110)
* [Full changelog](https://github.com/openshift/csi-node-driver-registrar/compare/5766960d82ffb9ef84d15e903ae57d0a6781ef11...de3c4217dca58af8b0b267c378eccae45e9eeaf5)
### [docker-builder](https://github.com/openshift/builder/tree/eb6fab812908e89e61afd9083d96a3e44d979b20)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#558](https://github.com/openshift/builder/pull/558)
* NO-JIRA: Bump golang.org/x/crypto, update CI builder images and go directive to go1.26 [#555](https://github.com/openshift/builder/pull/555)
* [Full changelog](https://github.com/openshift/builder/compare/2cda03a93696d4620703848471b3b873b0b2fa1e...eb6fab812908e89e61afd9083d96a3e44d979b20)
### [docker-registry](https://github.com/openshift/image-registry/tree/ad28258ba72b92639a64c13942528cfd07bcdcbd)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#487](https://github.com/openshift/image-registry/pull/487)
* [CNTRLPLANE-4447](https://issues.redhat.com/browse/CNTRLPLANE-4447): add support for configuring TLS groups [#488](https://github.com/openshift/image-registry/pull/488)
* [Full changelog](https://github.com/openshift/image-registry/compare/823010aa7b0dcf1da53a26c2ec135d0a32e63d85...ad28258ba72b92639a64c13942528cfd07bcdcbd)
### [egress-router-cni](https://github.com/openshift/egress-router-cni/tree/0264f879b64fe94c28f1b7a32c5fcd91a5ec43db)
* [OCPBUGS-55356](https://issues.redhat.com/browse/OCPBUGS-55356): Fix invalid IPv6 sysctl key for enabling IP forwarding [#112](https://github.com/openshift/egress-router-cni/pull/112)
* [Full changelog](https://github.com/openshift/egress-router-cni/compare/49554e572efac19f660a00ecfe2ccbc4e84be1e0...0264f879b64fe94c28f1b7a32c5fcd91a5ec43db)
### [etcd](https://github.com/openshift/etcd/tree/7d21cb41113f72a3267d0eaab8d0f38f3a9f70d1)
* [CNTRLPLANE-4423](https://issues.redhat.com/browse/CNTRLPLANE-4423): Add --curve-preferences to configure TLS curves [#420](https://github.com/openshift/etcd/pull/420)
* NO-JIRA: allow 60s for snapshot member readiness [#424](https://github.com/openshift/etcd/pull/424)
* NO-JIRA: allow 180s for retained client reconnect [#423](https://github.com/openshift/etcd/pull/423)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#415](https://github.com/openshift/etcd/pull/415)
* [CNTRLPLANE-3724](https://issues.redhat.com/browse/CNTRLPLANE-3724): add agentic context docs for the openshift/etcd fork [#411](https://github.com/openshift/etcd/pull/411)
* [Full changelog](https://github.com/openshift/etcd/compare/609b11ed8fc404fb95572d7c87e3243a1206cdb7...7d21cb41113f72a3267d0eaab8d0f38f3a9f70d1)
### [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp/tree/05099ac2932974114fd5a30cb172d888505c8056)
* Revert "OCPCLOUD-3677: Merge https://github.com/kubernetes/cloud-provider-gcp/tree/master (05550ad) into main" [#175](https://github.com/openshift/cloud-provider-gcp/pull/175)
* [OCPBUGS-122200](https://issues.redhat.com/browse/OCPBUGS-122200), [OCPCLOUD-3677](https://issues.redhat.com/browse/OCPCLOUD-3677): Merge https://github.com/kubernetes/cloud-provider-gcp/tree/master (05550ad) into main [#133](https://github.com/openshift/cloud-provider-gcp/pull/133)
* [Full changelog](https://github.com/openshift/cloud-provider-gcp/compare/51c326465b3160124b8097953b42e44f1056da5a...05099ac2932974114fd5a30cb172d888505c8056)
### [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp/tree/897628ca4a2429cd3f6913e667a01b3c20613bac)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#314](https://github.com/openshift/cluster-api-provider-gcp/pull/314)
* [Full changelog](https://github.com/openshift/cluster-api-provider-gcp/compare/5c3d894654ec0316347b26fb586a074bab160b2e...897628ca4a2429cd3f6913e667a01b3c20613bac)
### [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp/tree/6c9aa976f3fef0be78383fd45ef01262cdce673a)
* [OCPCLOUD-3662](https://issues.redhat.com/browse/OCPCLOUD-3662): bump Kubernetes dependencies to 1.37 [#197](https://github.com/openshift/machine-api-provider-gcp/pull/197)
* [OCPBUGS-90560](https://issues.redhat.com/browse/OCPBUGS-90560): resolve boot disk image at reconcile time [#181](https://github.com/openshift/machine-api-provider-gcp/pull/181)
* [Full changelog](https://github.com/openshift/machine-api-provider-gcp/compare/aac3d11bb011778fbb4f7717c59c18f617f82ad1...6c9aa976f3fef0be78383fd45ef01262cdce673a)
### [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver/tree/ce7b501ec5bc6ab63c894474a770ccc54fd8d1d2)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#131](https://github.com/openshift/gcp-pd-csi-driver/pull/131)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver/compare/049c0b96742c40fdd4384920afe17cefa5fa3d27...ce7b501ec5bc6ab63c894474a770ccc54fd8d1d2)
### [haproxy-router, haproxy-router-haproxy32](https://github.com/openshift/router/tree/01bee8da2387d0cfbd7a1acd934bb92a8c320527)
* NO-JIRA: Add pedjak to OWNERS [#847](https://github.com/openshift/router/pull/847)
* [OCPBUGS-84250](https://issues.redhat.com/browse/OCPBUGS-84250): Add debug logging when dynamic update fails [#836](https://github.com/openshift/router/pull/836)
* [OCPBUGS-77056](https://issues.redhat.com/browse/OCPBUGS-77056): Lock DeleteFunc to stop SARCompleted overwriting rejection [#840](https://github.com/openshift/router/pull/840)
* [Full changelog](https://github.com/openshift/router/compare/3381229146657d2e6bd94115dda0885f25cb3bed...01bee8da2387d0cfbd7a1acd934bb92a8c320527)
### [hyperkube, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/096638bbe2ee3da6e20336ae559c7a520c6e5089)
* [OCPBUGS-104847](https://issues.redhat.com/browse/OCPBUGS-104847): Revert "UPSTREAM: <carry>: Store SELinuxWarningController upgrade check as a ConfigMap [#2827](https://github.com/openshift/kubernetes/pull/2827)
* [OCPBUGS-129682](https://issues.redhat.com/browse/OCPBUGS-129682): Repair SingleReplica test exclusions [#2815](https://github.com/openshift/kubernetes/pull/2815)
* UPSTREAM: <carry>: OCPBUGS-128829: Handle k8s-tests-ext IP family probe failures [#2806](https://github.com/openshift/kubernetes/pull/2806)
* [OCPBUGS-130922](https://issues.redhat.com/browse/OCPBUGS-130922): UPSTREAM: <carry>: Fix vSphere topology test exclusions [#2816](https://github.com/openshift/kubernetes/pull/2816)
* [STOR-3083](https://issues.redhat.com/browse/STOR-3083): Fix disabled tests for newer test names [#2822](https://github.com/openshift/kubernetes/pull/2822)
* [OCPBUGS-112749](https://issues.redhat.com/browse/OCPBUGS-112749): Deflake pod resize deferred tests [#2765](https://github.com/openshift/kubernetes/pull/2765)
* [OCPBUGS-129642](https://issues.redhat.com/browse/OCPBUGS-129642): UPSTREAM: <carry>: bump cadvisor for statseq fix [#2819](https://github.com/openshift/kubernetes/pull/2819)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Daemonset test has changed names -> needs corrected env selector [#2813](https://github.com/openshift/kubernetes/pull/2813)
* : OCPBUGS-123651: UPSTREAM: <carry>: Add needed labels to RHEL pause image [#2809](https://github.com/openshift/kubernetes/pull/2809)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Rebase 1.37 [#2738](https://github.com/openshift/kubernetes/pull/2738)
* [OCPBUGS-127540](https://issues.redhat.com/browse/OCPBUGS-127540): UPSTREAM: 142168: Refuse UNC symlink targets in Windows subPath resolution [#2793](https://github.com/openshift/kubernetes/pull/2793)
* NOJIRA: add explicit merge commit message [#2788](https://github.com/openshift/kubernetes/pull/2788)
* [OCPBUGS-123651](https://issues.redhat.com/browse/OCPBUGS-123651): UPSTREAM: <carry>: Use FROM scratch for RHEL pause image [#2774](https://github.com/openshift/kubernetes/pull/2774)
* NO-JIRA: Rebase master to Kubernetes v1.36.4 [#2777](https://github.com/openshift/kubernetes/pull/2777)
* NO-JIRA: Skip SELinuxMountReadWriteOncePodOnly tests now that SELinuxMount is GA [#2782](https://github.com/openshift/kubernetes/pull/2782)
* [OCPBUGS-104846](https://issues.redhat.com/browse/OCPBUGS-104846): UPSTREAM: 141358: Enable group snapshot tests in all configurations [#2747](https://github.com/openshift/kubernetes/pull/2747)
* [Full changelog](https://github.com/openshift/kubernetes/compare/fb553cd105957b64651b393cb1a42f59faab190e...096638bbe2ee3da6e20336ae559c7a520c6e5089)
### [hypershift](https://github.com/openshift/hypershift/tree/225d8d2265006815d4487423b7ddac7571325d77)
* [CNTRLPLANE-4576](https://issues.redhat.com/browse/CNTRLPLANE-4576): Validate serviceAnnotations allowlist and size bounds [#10142](https://github.com/openshift/hypershift/pull/10142)
* [CNTRLPLANE-4577](https://issues.redhat.com/browse/CNTRLPLANE-4577): CPO passthrough of serviceAnnotations and loadBalancerClass to KAS Service [#10133](https://github.com/openshift/hypershift/pull/10133)
* [OCPBUGS-129115](https://issues.redhat.com/browse/OCPBUGS-129115): Validate external KubeVirt infrastructure kubeconfigs [#9903](https://github.com/openshift/hypershift/pull/9903)
* [CNTRLPLANE-4817](https://issues.redhat.com/browse/CNTRLPLANE-4817): Bump Azure CAPI provider (CAPZ) to v1.27.0 [#10078](https://github.com/openshift/hypershift/pull/10078)
* [OCPBUGS-129436](https://issues.redhat.com/browse/OCPBUGS-129436): Fix manual HA etcd snapshot recovery documentation [#10150](https://github.com/openshift/hypershift/pull/10150)
* [CNTRLPLANE-4850](https://issues.redhat.com/browse/CNTRLPLANE-4850): Bump core Cluster API to v1.14.3 [#10143](https://github.com/openshift/hypershift/pull/10143)
* NO-JIRA: ci(deps): bump astral-sh/setup-uv from 10.1.0 to 10.3.2 [#10163](https://github.com/openshift/hypershift/pull/10163)
* NO-JIRA: docs: direct contributors to #forum-ocp-hypershift [#10153](https://github.com/openshift/hypershift/pull/10153)
* [GCP-1240](https://issues.redhat.com/browse/GCP-1240): Add GCP Resource Manager tag API [#9735](https://github.com/openshift/hypershift/pull/9735)
* [CNTRLPLANE-4447](https://issues.redhat.com/browse/CNTRLPLANE-4447): Adds support for preferred TLS Groups [#10148](https://github.com/openshift/hypershift/pull/10148)
* [OCPBUGS-109628](https://issues.redhat.com/browse/OCPBUGS-109628): treat unstarted etcd member as unhealthy instead of aborting recovery [#10035](https://github.com/openshift/hypershift/pull/10035)
* [CNTRLPLANE-4826](https://issues.redhat.com/browse/CNTRLPLANE-4826): Stop gating NodePool rollout completion on upToDateReplicas [#10084](https://github.com/openshift/hypershift/pull/10084)
* [CNTRLPLANE-4832](https://issues.redhat.com/browse/CNTRLPLANE-4832): cover managed ingress DNS zone deletion [#10100](https://github.com/openshift/hypershift/pull/10100)
* NO-JIRA: chore(deps): update actions/download-artifact action to v8.0.2 (main) [#9968](https://github.com/openshift/hypershift/pull/9968)
* [GCP-1315](https://issues.redhat.com/browse/GCP-1315): test(e2e/v2): add GCP multi-cluster lifecycle platform config [#9977](https://github.com/openshift/hypershift/pull/9977)
* [CNTRLPLANE-4513](https://issues.redhat.com/browse/CNTRLPLANE-4513): chore(aws): stop writing and prune deprecated aws-load-balancer-subnets annotation [#9807](https://github.com/openshift/hypershift/pull/9807)
* [CNTRLPLANE-4732](https://issues.redhat.com/browse/CNTRLPLANE-4732): route kubelet through HAProxy on all public HCPs [#9988](https://github.com/openshift/hypershift/pull/9988)
* [CNTRLPLANE-3928](https://issues.redhat.com/browse/CNTRLPLANE-3928): e2e: verify workload pulls through the image mirror [#10075](https://github.com/openshift/hypershift/pull/10075)
* NO-JIRA: fix: remove CustomNoUpgrade HyperShift CRDs during API generation [#10136](https://github.com/openshift/hypershift/pull/10136)
* NO-JIRA: Fix parallel CAPI verification race [#10073](https://github.com/openshift/hypershift/pull/10073)
* [CNTRLPLANE-4486](https://issues.redhat.com/browse/CNTRLPLANE-4486): Enforce unit test function structure in hypershiftlinter [#9738](https://github.com/openshift/hypershift/pull/9738)
* [NE-2816](https://issues.redhat.com/browse/NE-2816): update haproxy image [#10065](https://github.com/openshift/hypershift/pull/10065)
* [CNTRLPLANE-4816](https://issues.redhat.com/browse/CNTRLPLANE-4816): Bump AWS CAPI provider to v2.13.1 [#10064](https://github.com/openshift/hypershift/pull/10064)
* [OCPBUGS-99759](https://issues.redhat.com/browse/OCPBUGS-99759): Publish compatible scale-from-zero capacity annotations [#10062](https://github.com/openshift/hypershift/pull/10062)
* [OCPBUGS-29551](https://issues.redhat.com/browse/OCPBUGS-29551): Document NodePool upgrade defaults in hcp help [#10014](https://github.com/openshift/hypershift/pull/10014)
* [AUTOSCALE-1044](https://issues.redhat.com/browse/AUTOSCALE-1044): detect multi-arch support for Karpenter ARM64 provisioning [#10116](https://github.com/openshift/hypershift/pull/10116)
* [OCPBUGS-129580](https://issues.redhat.com/browse/OCPBUGS-129580): wait for 0 nodes before subnet configmap cleanup in TestKarpenter [#10117](https://github.com/openshift/hypershift/pull/10117)
* [OCPBUGS-59842](https://issues.redhat.com/browse/OCPBUGS-59842): Bound etcd defragment RPCs and stop timed-out cycles [#10113](https://github.com/openshift/hypershift/pull/10113)
* [CONSOLE-5449](https://issues.redhat.com/browse/CONSOLE-5449): Preserve component route labels in HostedCluster and HostedControlPlane CRDs [#9815](https://github.com/openshift/hypershift/pull/9815)
* [OCPBUGS-127549](https://issues.redhat.com/browse/OCPBUGS-127549): gate ARO HCP router on backend service ClusterIPs being assigned [#9775](https://github.com/openshift/hypershift/pull/9775)
* [OCPBUGS-133784](https://issues.redhat.com/browse/OCPBUGS-133784): ensure verify-ci runs lint [#10126](https://github.com/openshift/hypershift/pull/10126)
* [OCPBUGS-133387](https://issues.redhat.com/browse/OCPBUGS-133387): Sync OSImageStream e2eutilallowlist scopes [#10124](https://github.com/openshift/hypershift/pull/10124)
* [OCPBUGS-131937](https://issues.redhat.com/browse/OCPBUGS-131937): Fix TLS downgrade restart waits for unsupported operators [#10108](https://github.com/openshift/hypershift/pull/10108)
* [CNTRLPLANE-4557](https://issues.redhat.com/browse/CNTRLPLANE-4557): Make restructure-commits model-neutral and enforce component boundaries [#9853](https://github.com/openshift/hypershift/pull/9853)
* NO-JIRA: chore(deps): update module go.mongodb.org/mongo-driver to v1.17.10 (main) [#10055](https://github.com/openshift/hypershift/pull/10055)
* [OCPBUGS-100035](https://issues.redhat.com/browse/OCPBUGS-100035): Add periodic resync and reduce backoff ceiling for HCCO resources controller [#10013](https://github.com/openshift/hypershift/pull/10013)
* [OCPBUGS-129497](https://issues.redhat.com/browse/OCPBUGS-129497): Align shared root and API dependencies [#9940](https://github.com/openshift/hypershift/pull/9940)
* NO-JIRA: Update e2e v2 AGENTS.md [#10115](https://github.com/openshift/hypershift/pull/10115)
* NO-JIRA: Deny use of v1 e2e package code in new v2 e2e code [#10112](https://github.com/openshift/hypershift/pull/10112)
* [CNTRLPLANE-4843](https://issues.redhat.com/browse/CNTRLPLANE-4843): Update common Konflux task bundles and artifact wiring [#10120](https://github.com/openshift/hypershift/pull/10120)
* [CNTRLPLANE-4447](https://issues.redhat.com/browse/CNTRLPLANE-4447): enable TLSGroupPreferences on TechPreviewNoUpgrade [#10094](https://github.com/openshift/hypershift/pull/10094)
* [GCP-1220](https://issues.redhat.com/browse/GCP-1220): Reconcile GCP LoadBalancer Service resource-label annotations in HCCO [#9644](https://github.com/openshift/hypershift/pull/9644)
* [CNTRLPLANE-4576](https://issues.redhat.com/browse/CNTRLPLANE-4576): Add loadBalancerClass and serviceAnnotations API fields [#9913](https://github.com/openshift/hypershift/pull/9913)
* [CNTRLPLANE-4807](https://issues.redhat.com/browse/CNTRLPLANE-4807): Add KubeletHAProxyRouting FeatureGate [#10043](https://github.com/openshift/hypershift/pull/10043)
* [CNTRLPLANE-4601](https://issues.redhat.com/browse/CNTRLPLANE-4601): Add a GitHub Actions deadcode gate [#10110](https://github.com/openshift/hypershift/pull/10110)
* [CNTRLPLANE-3927](https://issues.redhat.com/browse/CNTRLPLANE-3927): add e2e v2 test for imageContentSources propagation to IDMS and ignition [#10029](https://github.com/openshift/hypershift/pull/10029)
* [OCPBUGS-133387](https://issues.redhat.com/browse/OCPBUGS-133387): fix(e2e) wait for NodePool version in cross-major OSImageStream specs [#10107](https://github.com/openshift/hypershift/pull/10107)
* [OCPBUGS-131838](https://issues.redhat.com/browse/OCPBUGS-131838): pass allocated UID to standalone karpenter-operator [#10024](https://github.com/openshift/hypershift/pull/10024)
* [CNTRLPLANE-4600](https://issues.redhat.com/browse/CNTRLPLANE-4600): Add reporting-only deadcode command and reports [#9902](https://github.com/openshift/hypershift/pull/9902)
* [CNTRLPLANE-4817](https://issues.redhat.com/browse/CNTRLPLANE-4817): Resolve CAPI packages with go list in the provider sync [#10083](https://github.com/openshift/hypershift/pull/10083)
* [OCPBUGS-132920](https://issues.redhat.com/browse/OCPBUGS-132920): sync CAPK install CRDs with openshift CAPK release-5.1 [#10082](https://github.com/openshift/hypershift/pull/10082)
* NO-JIRA: fix(e2e): skip managed DNS e2e below 5.1 [#10063](https://github.com/openshift/hypershift/pull/10063)
* NO-JIRA: bump google.golang.org/grpc to 1.83.2 in tools [#10095](https://github.com/openshift/hypershift/pull/10095)
* [CNTRLPLANE-3632](https://issues.redhat.com/browse/CNTRLPLANE-3632): Predictable NodePool rollout control [#9818](https://github.com/openshift/hypershift/pull/9818)
* [OCPBUGS-84499](https://issues.redhat.com/browse/OCPBUGS-84499): Etcd recovery on unreachable nodes [#9992](https://github.com/openshift/hypershift/pull/9992)
* NO-JIRA: chore: fixup karpenter reviewers and approvers in OWNERS [#10023](https://github.com/openshift/hypershift/pull/10023)
* NO-JIRA: Fix kube-storage-version-migrator removal assertion [#10097](https://github.com/openshift/hypershift/pull/10097)
* [CNTRLPLANE-2042](https://issues.redhat.com/browse/CNTRLPLANE-2042): test(e2e): add cross-cluster backup restore coverage for AWS [#9979](https://github.com/openshift/hypershift/pull/9979)
* NO-JIRA: ci(deps): bump actions/create-github-app-token from 1.12.0 to 3.3.0 [#10087](https://github.com/openshift/hypershift/pull/10087)
* [OCPBUGS-132561](https://issues.redhat.com/browse/OCPBUGS-132561): Fix Azure role-assignment cleanup in CI [#10061](https://github.com/openshift/hypershift/pull/10061)
* [CNTRLPLANE-4662](https://issues.redhat.com/browse/CNTRLPLANE-4662): docs(aws): add managed DNS how-to [#9943](https://github.com/openshift/hypershift/pull/9943)
* [OCPBUGS-132796](https://issues.redhat.com/browse/OCPBUGS-132796): Filter nonstandard AZ subnets from AWS endpoints [#10080](https://github.com/openshift/hypershift/pull/10080)
* [OCPCLOUD-3704](https://issues.redhat.com/browse/OCPCLOUD-3704): enable CRD compatibility requirements for preview clusters [#9871](https://github.com/openshift/hypershift/pull/9871)
* [OCPBUGS-130965](https://issues.redhat.com/browse/OCPBUGS-130965): CVO upgrades stuck in Upgradeable=False (ResourceDeletesInProgress) [#10037](https://github.com/openshift/hypershift/pull/10037)
* NO-JIRA: build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.45.0 [#9661](https://github.com/openshift/hypershift/pull/9661)
* [GCP-1221](https://issues.redhat.com/browse/GCP-1221): Manage GCP worker firewall rules in CPO [#9640](https://github.com/openshift/hypershift/pull/9640)
* [CNTRLPLANE-4193](https://issues.redhat.com/browse/CNTRLPLANE-4193): feat: add initialKMSKeyARN for StorageClass KMS encryption [#9147](https://github.com/openshift/hypershift/pull/9147)
* [AUTOSCALE-944](https://issues.redhat.com/browse/AUTOSCALE-944): fix(karpenter): defer HCP lifecycle to standalone operator [#9930](https://github.com/openshift/hypershift/pull/9930)
* [CNTRLPLANE-3999](https://issues.redhat.com/browse/CNTRLPLANE-3999): Replace e2e v2 Platform.DeleteArgs with declarative ClusterSpec [#10033](https://github.com/openshift/hypershift/pull/10033)
* NO-JIRA: build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.37.0 to 1.45.0 in /hack/tools [#9656](https://github.com/openshift/hypershift/pull/9656)
* [OCPBUGS-86668](https://issues.redhat.com/browse/OCPBUGS-86668): fix CA rotation race in ReconcileTotalClientCA [#8618](https://github.com/openshift/hypershift/pull/8618)
* [GCP-1211](https://issues.redhat.com/browse/GCP-1211): Set PSC and load balancer resource labels [#9612](https://github.com/openshift/hypershift/pull/9612)
* [OCPBUGS-85079](https://issues.redhat.com/browse/OCPBUGS-85079): Fix global pull-secret label sync on HO upgrade [#8650](https://github.com/openshift/hypershift/pull/8650)
* [OCPBUGS-128637](https://issues.redhat.com/browse/OCPBUGS-128637): preserve role credentials for shared service accounts [#9828](https://github.com/openshift/hypershift/pull/9828)
* NO-JIRA: chore(deps): update cloudflare/wrangler-action action to v4.1.3 (main) [#9907](https://github.com/openshift/hypershift/pull/9907)
* [CNTRLPLANE-3610](https://issues.redhat.com/browse/CNTRLPLANE-3610): Decouple CAPI provider Go module dependencies [#8704](https://github.com/openshift/hypershift/pull/8704)
* [CNTRLPLANE-4559](https://issues.redhat.com/browse/CNTRLPLANE-4559): Add OpenShift Kubernetes 1.37.1 envtest coverage [#10039](https://github.com/openshift/hypershift/pull/10039)
* [OCPKUEUE-921](https://issues.redhat.com/browse/OCPKUEUE-921): feat: enable was in hypershift [#10034](https://github.com/openshift/hypershift/pull/10034)
* [CNTRLPLANE-4642](https://issues.redhat.com/browse/CNTRLPLANE-4642): Capture Azure E2E diagnostics [#9915](https://github.com/openshift/hypershift/pull/9915)
* NO-JIRA: chore(deps): update actions/upload-artifact action to v7.0.2 (main) [#9969](https://github.com/openshift/hypershift/pull/9969)
* [AUTOSCALE-1068](https://issues.redhat.com/browse/AUTOSCALE-1068): docs for AutoNode/Karpenter on self-managed azure [#10009](https://github.com/openshift/hypershift/pull/10009)
* [CNTRLPLANE-4167](https://issues.redhat.com/browse/CNTRLPLANE-4167): test: port scale-from-zero autoscaling test to v2 framework [#9411](https://github.com/openshift/hypershift/pull/9411)
* ci: sync release branches to community fork [#8220](https://github.com/openshift/hypershift/pull/8220)
* [OCPBUGS-74083](https://issues.redhat.com/browse/OCPBUGS-74083): encryption condition propagation [#10008](https://github.com/openshift/hypershift/pull/10008)
* [OCPBUGS-131937](https://issues.redhat.com/browse/OCPBUGS-131937): test(e2e-v2): skip control-plane-pki-operator TLS config tests on older operators [#10032](https://github.com/openshift/hypershift/pull/10032)
* [NE-2913](https://issues.redhat.com/browse/NE-2913): remove HAProxy 2.8 reference [#9984](https://github.com/openshift/hypershift/pull/9984)
* [CNTRLPLANE-3999](https://issues.redhat.com/browse/CNTRLPLANE-3999): remove Platform.CreateArgs to make ClusterSpecs more declarative [#10005](https://github.com/openshift/hypershift/pull/10005)
* [OCPBUGS-123171](https://issues.redhat.com/browse/OCPBUGS-123171): docs(capi-image-overrides): Add new override for versions below 4.19 [#9942](https://github.com/openshift/hypershift/pull/9942)
* [CNTRLPLANE-4160](https://issues.redhat.com/browse/CNTRLPLANE-4160), [CNTRLPLANE-4161](https://issues.redhat.com/browse/CNTRLPLANE-4161): use newer CPO for azure 4.20/4.21 overrides [#9967](https://github.com/openshift/hypershift/pull/9967)
* NO-JIRA: Document proportionate pre-PR validation [#10015](https://github.com/openshift/hypershift/pull/10015)
* NO-JIRA: clarify NodePool status.osImageStream vs MCO OSImageStream status [#10019](https://github.com/openshift/hypershift/pull/10019)
* [CNTRLPLANE-3201](https://issues.redhat.com/browse/CNTRLPLANE-3201): test(backup-restore): wait for manual backup before scheduling [#9961](https://github.com/openshift/hypershift/pull/9961)
* [AUTOSCALE-1057](https://issues.redhat.com/browse/AUTOSCALE-1057): rename standalone karpenter-operator deployment env var [#9954](https://github.com/openshift/hypershift/pull/9954)
* NO-JIRA: Add Dan Mace to core-approvers [#9994](https://github.com/openshift/hypershift/pull/9994)
* [OCPBUGS-126895](https://issues.redhat.com/browse/OCPBUGS-126895): preserve AWS API error details on AWSEndpointService reconcile [#9707](https://github.com/openshift/hypershift/pull/9707)
* [OCPSTRAT-3686](https://issues.redhat.com/browse/OCPSTRAT-3686): Set creationTimestamp in the operator image-references file [#9878](https://github.com/openshift/hypershift/pull/9878)
* [OCPBUGS-129594](https://issues.redhat.com/browse/OCPBUGS-129594): Fix IPv6 endpoint authorities in CPO [#9982](https://github.com/openshift/hypershift/pull/9982)
* [CNTRLPLANE-4711](https://issues.redhat.com/browse/CNTRLPLANE-4711): feat(azure): add opt-in IP forwarding for NodePools [#9966](https://github.com/openshift/hypershift/pull/9966)
* NO-JIRA: test(e2e): refactor Karpenter v2 test helpers and harden upgrade test [#9662](https://github.com/openshift/hypershift/pull/9662)
* [OCPSTRAT-3686](https://issues.redhat.com/browse/OCPSTRAT-3686): Zero pad the commit distance in derived nightly tags [#9980](https://github.com/openshift/hypershift/pull/9980)
* [CNTRLPLANE-4538](https://issues.redhat.com/browse/CNTRLPLANE-4538): correct August report blog attribution [#9931](https://github.com/openshift/hypershift/pull/9931)
* [CNTRLPLANE-4102](https://issues.redhat.com/browse/CNTRLPLANE-4102): chore(contrib): remove aws-leaked-resources [#9963](https://github.com/openshift/hypershift/pull/9963)
* [OCPBUGS-129581](https://issues.redhat.com/browse/OCPBUGS-129581): Preserve supplied Unmanaged etcd credentials [#9941](https://github.com/openshift/hypershift/pull/9941)
* [OCPBUGS-114415](https://issues.redhat.com/browse/OCPBUGS-114415): intermittent timeouts in TestDialDirectWithProxy [#9960](https://github.com/openshift/hypershift/pull/9960)
* [TRT-3008](https://issues.redhat.com/browse/TRT-3008): revert(ingressoperator): restore HAProxy 2.8 wiring [#9976](https://github.com/openshift/hypershift/pull/9976)
* [OCPBUGS-129420](https://issues.redhat.com/browse/OCPBUGS-129420): Propagate configured NodePool labels and taints with native capacity [#9919](https://github.com/openshift/hypershift/pull/9919)
* [OCPBUGS-49661](https://issues.redhat.com/browse/OCPBUGS-49661): fix(cpo): report real ValidAWSKMSConfig condition [#9953](https://github.com/openshift/hypershift/pull/9953)
* [OCPCLOUD-3708](https://issues.redhat.com/browse/OCPCLOUD-3708): feat(machine-approver): plumb TLS curve preferences [#9743](https://github.com/openshift/hypershift/pull/9743)
* [CNTRLPLANE-3646](https://issues.redhat.com/browse/CNTRLPLANE-3646): enable all platform agnostic and specific e2e v2 tests for AWS [#9701](https://github.com/openshift/hypershift/pull/9701)
* [GCP-504](https://issues.redhat.com/browse/GCP-504): NodePool Platform Conditions [#8917](https://github.com/openshift/hypershift/pull/8917)
* [CNTRLPLANE-4575](https://issues.redhat.com/browse/CNTRLPLANE-4575): add DeterministicLBIP feature gate [#9898](https://github.com/openshift/hypershift/pull/9898)
* [NE-2913](https://issues.redhat.com/browse/NE-2913): Remove HAProxy 2.8 reference [#9703](https://github.com/openshift/hypershift/pull/9703)
* [OCPBUGS-129006](https://issues.redhat.com/browse/OCPBUGS-129006): Converge Azure private DNS network links safely [#9896](https://github.com/openshift/hypershift/pull/9896)
* NO-JIRA: ci(deps): bump actions/actions-runner from 2.337.0 to 2.338.0 [#9956](https://github.com/openshift/hypershift/pull/9956)
* NO-JIRA: Require GCP workload identity mutation on 5.1 and later [#9936](https://github.com/openshift/hypershift/pull/9936)
* NO-JIRA: build(deps): bump the azure-github-dependencies group across 1 directory with 3 updates [#9777](https://github.com/openshift/hypershift/pull/9777)
* [OCPBUGS-129491](https://issues.redhat.com/browse/OCPBUGS-129491): ensure e2e v1 AWS OIDC providers are tagged with e2e metadata [#9933](https://github.com/openshift/hypershift/pull/9933)
* NO-JIRA: chore(owners): add CI operator config owners [#9938](https://github.com/openshift/hypershift/pull/9938)
* [CNTRLPLANE-4480](https://issues.redhat.com/browse/CNTRLPLANE-4480): feat(api): promote HCPUserFacingOperatorLogs feature gate to Default [#9724](https://github.com/openshift/hypershift/pull/9724)
* [AUTOSCALE-1008](https://issues.redhat.com/browse/AUTOSCALE-1008): feat(karpenter-operator): monitor operand rollout status for version tracking [#9654](https://github.com/openshift/hypershift/pull/9654)
* [AUTOSCALE-995](https://issues.redhat.com/browse/AUTOSCALE-995): implement cpu options [#9623](https://github.com/openshift/hypershift/pull/9623)
* [CNTRLPLANE-4600](https://issues.redhat.com/browse/CNTRLPLANE-4600): remove all reported deadcode candidates [#9904](https://github.com/openshift/hypershift/pull/9904)
* [CNTRLPLANE-4565](https://issues.redhat.com/browse/CNTRLPLANE-4565): Promote ingress and Azure private OAuth v2 tests to blocking [#9918](https://github.com/openshift/hypershift/pull/9918)
* [AUTOSCALE-947](https://issues.redhat.com/browse/AUTOSCALE-947): fix(karpenter): defer EC2NodeClass reconcile to standalone operator [#9746](https://github.com/openshift/hypershift/pull/9746)
* [OCPBUGS-104597](https://issues.redhat.com/browse/OCPBUGS-104597): fix(etcdbackup): correctly classify Azure client-secret credentials from Velero BSL secrets [#9321](https://github.com/openshift/hypershift/pull/9321)
* [CNTRLPLANE-4565](https://issues.redhat.com/browse/CNTRLPLANE-4565): Remove duplicated v1 AWS E2E checks [#9881](https://github.com/openshift/hypershift/pull/9881)
* [CNTRLPLANE-4337](https://issues.redhat.com/browse/CNTRLPLANE-4337): Extract cluster-foundation ownership with characterization [#9905](https://github.com/openshift/hypershift/pull/9905)
* NO-JIRA: strip DWARF info from linter plugins to fix macOS dyld crash [#9909](https://github.com/openshift/hypershift/pull/9909)
* [OCPBUGS-112277](https://issues.redhat.com/browse/OCPBUGS-112277): Skip PodDisruptionBudgets for SingleReplica control planes [#9394](https://github.com/openshift/hypershift/pull/9394)
* [OCPBUGS-128613](https://issues.redhat.com/browse/OCPBUGS-128613): validate Azure HostedCluster subnet ID [#9825](https://github.com/openshift/hypershift/pull/9825)
* [OCPBUGS-127429](https://issues.redhat.com/browse/OCPBUGS-127429): Enable DeviceTaintRule API for hosted clusters [#9518](https://github.com/openshift/hypershift/pull/9518)
* [CNTRLPLANE-550](https://issues.redhat.com/browse/CNTRLPLANE-550): Refactor HyperShift CLI for cross-platform consistency and testability [#9570](https://github.com/openshift/hypershift/pull/9570)
* [GCP-967](https://issues.redhat.com/browse/GCP-967): Add GCP workload identity webhook support [#9549](https://github.com/openshift/hypershift/pull/9549)
* [CNTRLPLANE-4558](https://issues.redhat.com/browse/CNTRLPLANE-4558): Update Dockerfile and Containerfile images for Kubernetes 1.37 [#9873](https://github.com/openshift/hypershift/pull/9873)
* [OCPBUGS-126889](https://issues.redhat.com/browse/OCPBUGS-126889): preserve wrapped Azure credential reconcile errors [#9704](https://github.com/openshift/hypershift/pull/9704)
* [OCPBUGS-129003](https://issues.redhat.com/browse/OCPBUGS-129003): Refresh performance-profile conditions at the same generation [#9891](https://github.com/openshift/hypershift/pull/9891)
* [MULTIARCH-5567](https://issues.redhat.com/browse/MULTIARCH-5567): Added support to create multi-arch (s390x & x86) NodePools with KubeVirt platform on heterogeneous management clusters [#9586](https://github.com/openshift/hypershift/pull/9586)
* [OCPBUGS-128975](https://issues.redhat.com/browse/OCPBUGS-128975): Count only successful upsert updates [#9872](https://github.com/openshift/hypershift/pull/9872)
* [OCPBUGS-109196](https://issues.redhat.com/browse/OCPBUGS-109196): fix(nodepool): validate KubeVirt additionalNetworks NAD namespace [#9299](https://github.com/openshift/hypershift/pull/9299)
* NO-JIRA: docs: fix stale N-2 version skew references to N-3 [#8999](https://github.com/openshift/hypershift/pull/8999)
* [AUTOSCALE-977](https://issues.redhat.com/browse/AUTOSCALE-977): feat(karpenter): defer default NodeClass to standalone operator [#9695](https://github.com/openshift/hypershift/pull/9695)
* [CNTRLPLANE-4562](https://issues.redhat.com/browse/CNTRLPLANE-4562): add kubeClientQPS and kubeClientBurst to ClusterAutoscaling [#9857](https://github.com/openshift/hypershift/pull/9857)
* [CNTRLPLANE-4548](https://issues.redhat.com/browse/CNTRLPLANE-4548): fix: move combined-pull-secret creation to top-level CPO [#9844](https://github.com/openshift/hypershift/pull/9844)
* [CNTRLPLANE-4553](https://issues.redhat.com/browse/CNTRLPLANE-4553): Remove duplicate release trigger and draft mode [#9880](https://github.com/openshift/hypershift/pull/9880)
* [CNTRLPLANE-4553](https://issues.redhat.com/browse/CNTRLPLANE-4553): Compact yq JSON output for GITHUB_OUTPUT in tag workflow [#9879](https://github.com/openshift/hypershift/pull/9879)
* [CNTRLPLANE-4553](https://issues.redhat.com/browse/CNTRLPLANE-4553): Add workflows permission and manual trigger for tag creation [#9877](https://github.com/openshift/hypershift/pull/9877)
* [CNTRLPLANE-4552](https://issues.redhat.com/browse/CNTRLPLANE-4552): request HO v0.1.86 tag [#9848](https://github.com/openshift/hypershift/pull/9848)
* [CNTRLPLANE-4553](https://issues.redhat.com/browse/CNTRLPLANE-4553): use runner.temp and detect arch for release workflow tool installs [#9851](https://github.com/openshift/hypershift/pull/9851)
* [CNTRLPLANE-4335](https://issues.redhat.com/browse/CNTRLPLANE-4335): Extract RBAC reconciliation into dedicated module [#9726](https://github.com/openshift/hypershift/pull/9726)
* [CNTRLPLANE-3890](https://issues.redhat.com/browse/CNTRLPLANE-3890): Add product-cli unit tests for HCP create cluster [#9591](https://github.com/openshift/hypershift/pull/9591)
* [CNTRLPLANE-4550](https://issues.redhat.com/browse/CNTRLPLANE-4550): improve HO hotfix documentation and fix template [#9845](https://github.com/openshift/hypershift/pull/9845)
* [OCPSTRAT-3686](https://issues.redhat.com/browse/OCPSTRAT-3686): Emit release-manifests/image-references from the operator build [#9854](https://github.com/openshift/hypershift/pull/9854)
* [CNTRLPLANE-4556](https://issues.redhat.com/browse/CNTRLPLANE-4556): Bump Kubernetes dependencies to 1.37 [#9568](https://github.com/openshift/hypershift/pull/9568)
* [OCPBUGS-77307](https://issues.redhat.com/browse/OCPBUGS-77307): Generate KubeVirt nmstate network config conditionally [#9381](https://github.com/openshift/hypershift/pull/9381)
* [CNTRLPLANE-4553](https://issues.redhat.com/browse/CNTRLPLANE-4553): install release workflow binaries to user-writable path [#9849](https://github.com/openshift/hypershift/pull/9849)
* [CNTRLPLANE-4465](https://issues.redhat.com/browse/CNTRLPLANE-4465): group MintMaker Go dependency updates by module [#9715](https://github.com/openshift/hypershift/pull/9715)
* [CNTRLPLANE-4379](https://issues.redhat.com/browse/CNTRLPLANE-4379): add release automation workflows for PR-based tagging [#9566](https://github.com/openshift/hypershift/pull/9566)
* [CNTRLPLANE-3341](https://issues.redhat.com/browse/CNTRLPLANE-3341): Extract support/imageregistry package from support/util [#9832](https://github.com/openshift/hypershift/pull/9832)
* [CNTRLPLANE-3901](https://issues.redhat.com/browse/CNTRLPLANE-3901): Add product-cli unit tests for IAM-Infra (Azure) [#9180](https://github.com/openshift/hypershift/pull/9180)
* [CCO-848](https://issues.redhat.com/browse/CCO-848): feat(cloud_credential_operator): inject centralized TLS configuration [#9409](https://github.com/openshift/hypershift/pull/9409)
* [OCPBUGS-109641](https://issues.redhat.com/browse/OCPBUGS-109641): fix slice bounds out of range panic in getAvailableCandidates [#9309](https://github.com/openshift/hypershift/pull/9309)
* [CNTRLPLANE-4090](https://issues.redhat.com/browse/CNTRLPLANE-4090): deduplicate internal constants by migrating consumers to shared packages [#9804](https://github.com/openshift/hypershift/pull/9804)
* [ACM-38185](https://issues.redhat.com/browse/ACM-38185): chore(owners): add ACM HyperShift owners for product-cli [#9082](https://github.com/openshift/hypershift/pull/9082)
* [CNTRLPLANE-4538](https://issues.redhat.com/browse/CNTRLPLANE-4538): add August 2026 progress report [#9839](https://github.com/openshift/hypershift/pull/9839)
* NO-JIRA: nodepool: log when user-data/token Secrets are deleted [#9819](https://github.com/openshift/hypershift/pull/9819)
* [OCPSTRAT-3686](https://issues.redhat.com/browse/OCPSTRAT-3686): Use git tag for hypershift nightly tag pipeline [#9826](https://github.com/openshift/hypershift/pull/9826)
* NO-JIRA: chore(deps): refresh rpm lockfiles (main) [SECURITY] [#9667](https://github.com/openshift/hypershift/pull/9667)
* [OCPBUGS-127651](https://issues.redhat.com/browse/OCPBUGS-127651): fix(operator): prevent deadlock when CRD conversion webhook caBundle is missing [#9782](https://github.com/openshift/hypershift/pull/9782)
* NO-JIRA: Remove Claude-powered PR comment workflows [#9830](https://github.com/openshift/hypershift/pull/9830)
* [OCPBUGS-99659](https://issues.redhat.com/browse/OCPBUGS-99659): reconcile NetworkPolicies for KubeVirt HCP router mode [#9619](https://github.com/openshift/hypershift/pull/9619)
* [CNTRLPLANE-3902](https://issues.redhat.com/browse/CNTRLPLANE-3902): Add product-cli unit tests for kubeconfig [#9217](https://github.com/openshift/hypershift/pull/9217)
* [GCP-1148](https://issues.redhat.com/browse/GCP-1148): Make zone required for cluster and nodepool creation [#9708](https://github.com/openshift/hypershift/pull/9708)
* [CNTRLPLANE-3900](https://issues.redhat.com/browse/CNTRLPLANE-3900): Add shared cmd/ unit tests for destroy cluster [#9166](https://github.com/openshift/hypershift/pull/9166)
* [CNTRLPLANE-1053](https://issues.redhat.com/browse/CNTRLPLANE-1053): Validate KAS reachability via SVC URL in KubeAPIDNSName e2e test [#9355](https://github.com/openshift/hypershift/pull/9355)
* NO-JIRA: build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 [#9776](https://github.com/openshift/hypershift/pull/9776)
* [CNTRLPLANE-3344](https://issues.redhat.com/browse/CNTRLPLANE-3344): Extract support/reconcilerpolicy package from support/util [#9734](https://github.com/openshift/hypershift/pull/9734)
* [OCPBUGS-98099](https://issues.redhat.com/browse/OCPBUGS-98099): test(e2e): isolate legacy Karpenter upgrade workload [#9806](https://github.com/openshift/hypershift/pull/9806)
* [CNTRLPLANE-4497](https://issues.redhat.com/browse/CNTRLPLANE-4497): add azure-orphaned-role-assignments tool [#9745](https://github.com/openshift/hypershift/pull/9745)
* [OCPBUGS-128500](https://issues.redhat.com/browse/OCPBUGS-128500): Gate custom ingress strategy E2E coverage to 4.21+ [#9814](https://github.com/openshift/hypershift/pull/9814)
* [OCPSTRAT-3686](https://issues.redhat.com/browse/OCPSTRAT-3686): import nightly release tags [#9809](https://github.com/openshift/hypershift/pull/9809)
* [OCPBUGS-114937](https://issues.redhat.com/browse/OCPBUGS-114937): Add readiness probe to kube-scheduler control plane deployment [#9789](https://github.com/openshift/hypershift/pull/9789)
* [OCPBUGS-128466](https://issues.redhat.com/browse/OCPBUGS-128466): reconcile aggregated docs [#9808](https://github.com/openshift/hypershift/pull/9808)
* NO-JIRA: chore(owners): refresh owner aliases [#9805](https://github.com/openshift/hypershift/pull/9805)
* [ROSAENG-65607](https://issues.redhat.com/browse/ROSAENG-65607): Adjust regex validation to allow sqs-fips url format (for FEDRAMP support) [#9737](https://github.com/openshift/hypershift/pull/9737)
* NO-JIRA: add serena/headroom files/folders to gitignore [#9802](https://github.com/openshift/hypershift/pull/9802)
* [OCPBUGS-126613](https://issues.redhat.com/browse/OCPBUGS-126613): fix(api): add missing + prefix to kubebuilder annotation on networkType [#9646](https://github.com/openshift/hypershift/pull/9646)
* [CNTRLPLANE-3632](https://issues.redhat.com/browse/CNTRLPLANE-3632): Revert #8698: NodePool rollout control [#9797](https://github.com/openshift/hypershift/pull/9797)
* [OCPBUGS-127049](https://issues.redhat.com/browse/OCPBUGS-127049): fix(globalps): schedule global-pull-secret-syncer on karpenter nodes [#9719](https://github.com/openshift/hypershift/pull/9719)
* [CNTRLPLANE-4508](https://issues.redhat.com/browse/CNTRLPLANE-4508): fix(e2e): detect installer flags supported by target image [#9792](https://github.com/openshift/hypershift/pull/9792)
* NO-JIRA: build(deps): bump compatible sigs-k8s dependencies [#9778](https://github.com/openshift/hypershift/pull/9778)
* [OCPBUGS-114936](https://issues.redhat.com/browse/OCPBUGS-114936): add PodDisruptionBudget for the HyperShift Operator [#9526](https://github.com/openshift/hypershift/pull/9526)
* [OCPBUGS-115085](https://issues.redhat.com/browse/OCPBUGS-115085): fix: mount combined-pull-secret in OpenShift API Server [#9617](https://github.com/openshift/hypershift/pull/9617)
* [OCPBUGS-109640](https://issues.redhat.com/browse/OCPBUGS-109640): fix(cmd/dump): filter resources by cluster platform [#9639](https://github.com/openshift/hypershift/pull/9639)
* NO-JIRA: fix(nodepool) data race in TestReconcileSelectorDropsStaleLabels [#9772](https://github.com/openshift/hypershift/pull/9772)
* [OCPBUGS-88757](https://issues.redhat.com/browse/OCPBUGS-88757): Align HCCO CatalogSource registryPoll interval with OCP defaults [#8745](https://github.com/openshift/hypershift/pull/8745)
* [CNTRLPLANE-4460](https://issues.redhat.com/browse/CNTRLPLANE-4460): refactor(test): chain BeforeApply handlers instead of overwriting [#9709](https://github.com/openshift/hypershift/pull/9709)
* NO-JIRA: ci(deps): bump codecov/codecov-action from 7.0.0 to 7.1.0 [#9681](https://github.com/openshift/hypershift/pull/9681)
* NO-JIRA: ci(deps): bump actions/cache from 4.2.3 to 6.1.0 [#9338](https://github.com/openshift/hypershift/pull/9338)
* [OCPSTRAT-3686](https://issues.redhat.com/browse/OCPSTRAT-3686): Update default ociStorage repository [#9770](https://github.com/openshift/hypershift/pull/9770)
* [OCPBUGS-127110](https://issues.redhat.com/browse/OCPBUGS-127110): Install HO via Job from operator image in e2e upgrade tests [#9736](https://github.com/openshift/hypershift/pull/9736)
* [OCPBUGS-127070](https://issues.redhat.com/browse/OCPBUGS-127070): Align .ci-operator.yaml build root tag with Dockerfiles [#9723](https://github.com/openshift/hypershift/pull/9723)
* [CNTRLPLANE-4374](https://issues.redhat.com/browse/CNTRLPLANE-4374): bug - gate platform CAPI types behind CRD discovery to fix bulk inspect on limited-CRD clusters [#9552](https://github.com/openshift/hypershift/pull/9552)
* [OCPBUGS-98066](https://issues.redhat.com/browse/OCPBUGS-98066): fix(nodepool): rebuild CAPI selectors deterministically on reconcile [#9698](https://github.com/openshift/hypershift/pull/9698)
* [CNTRLPLANE-3632](https://issues.redhat.com/browse/CNTRLPLANE-3632): Predictable NodePool rollout control [#8698](https://github.com/openshift/hypershift/pull/8698)
* [CNTRLPLANE-4090](https://issues.redhat.com/browse/CNTRLPLANE-4090): Move HostedControlPlaneNamespace to shared package [#9551](https://github.com/openshift/hypershift/pull/9551)
* [SPLAT-2742](https://issues.redhat.com/browse/SPLAT-2742): remove inlined SetSecurityGroups IAM permission [#9717](https://github.com/openshift/hypershift/pull/9717)
* [CNTRLPLANE-4213](https://issues.redhat.com/browse/CNTRLPLANE-4213): decouple konflux pr pipelines [#9413](https://github.com/openshift/hypershift/pull/9413)
* NO-JIRA: test(e2e): check OS streams for OpenShift 5.0 nightlies [#9712](https://github.com/openshift/hypershift/pull/9712)
* [CNTRLPLANE-3755](https://issues.redhat.com/browse/CNTRLPLANE-3755): fix(e2e): gate release-specific fields for version compatibility [#9564](https://github.com/openshift/hypershift/pull/9564)
* [CNTRLPLANE-2775](https://issues.redhat.com/browse/CNTRLPLANE-2775): Expose KAS availability and latency metrics from CPO [#9244](https://github.com/openshift/hypershift/pull/9244)
* [CNTRLPLANE-4092](https://issues.redhat.com/browse/CNTRLPLANE-4092): Move dump.go to its own package to break transitive dependency on sharedingress [#9727](https://github.com/openshift/hypershift/pull/9727)
* [OCPBUGS-125907](https://issues.redhat.com/browse/OCPBUGS-125907): fix(aws): use unique Route 53 caller references [#9647](https://github.com/openshift/hypershift/pull/9647)
* [OCPBUGS-114723](https://issues.redhat.com/browse/OCPBUGS-114723): Decouple user CA bundle reconciliation from resources controller [#9458](https://github.com/openshift/hypershift/pull/9458)
* NO-JIRA: chore(owners): add daniel-rejniak to gcp-reviewers [#9700](https://github.com/openshift/hypershift/pull/9700)
* [CNTRLPLANE-4304](https://issues.redhat.com/browse/CNTRLPLANE-4304): fix(ci): validate pending commit messages with gitlint [#9710](https://github.com/openshift/hypershift/pull/9710)
* [CNTRLPLANE-4395](https://issues.redhat.com/browse/CNTRLPLANE-4395): Make git commit format skill model and harness agnostic [#9625](https://github.com/openshift/hypershift/pull/9625)
* [OCPBUGS-123791](https://issues.redhat.com/browse/OCPBUGS-123791): CAPI storage version migration exclude IPAM [#9642](https://github.com/openshift/hypershift/pull/9642)
* [CNTRLPLANE-4365](https://issues.redhat.com/browse/CNTRLPLANE-4365): Publish hosted control plane sizing guidance [#9532](https://github.com/openshift/hypershift/pull/9532)
* [AUTOSCALE-873](https://issues.redhat.com/browse/AUTOSCALE-873): Add sidecar to standalone karpenter-operator [#9565](https://github.com/openshift/hypershift/pull/9565)
* [CNTRLPLANE-4090](https://issues.redhat.com/browse/CNTRLPLANE-4090): Move CPO, HCCO and etcd recovery manifest constructors to shared packages [#9592](https://github.com/openshift/hypershift/pull/9592)
* [OCPBUGS-113995](https://issues.redhat.com/browse/OCPBUGS-113995): classify WebIdentityErr by cause to prevent false invalid creds [#9406](https://github.com/openshift/hypershift/pull/9406)
* [OCPBUGS-115468](https://issues.redhat.com/browse/OCPBUGS-115468): fix NodePool: truncate oversized machine messages instead of dropping them [#9567](https://github.com/openshift/hypershift/pull/9567)
* feat(kubevirt): OCPBUGS-55974: add CPU model configuration for NodePool VMs [#7431](https://github.com/openshift/hypershift/pull/7431)
* [CNTRLPLANE-4209](https://issues.redhat.com/browse/CNTRLPLANE-4209): Consolidate Azure lifecycle test lanes [#9572](https://github.com/openshift/hypershift/pull/9572)
* [GCP-510](https://issues.redhat.com/browse/GCP-510): Implement GCP NodePool CLI Commands [#9466](https://github.com/openshift/hypershift/pull/9466)
* [OCPBUGS-84562](https://issues.redhat.com/browse/OCPBUGS-84562): Configure AWS CCM region directly [#9602](https://github.com/openshift/hypershift/pull/9602)
* NO-JIRA: ci(deps): bump astral-sh/setup-uv from 6.1.0 to 10.1.0 [#9682](https://github.com/openshift/hypershift/pull/9682)
* NO-JIRA: chore(owners): add core approvers [#9651](https://github.com/openshift/hypershift/pull/9651)
* [CNTRLPLANE-4090](https://issues.redhat.com/browse/CNTRLPLANE-4090): Move metric name constants to shared packages [#9540](https://github.com/openshift/hypershift/pull/9540)
* [OCPBUGS-125803](https://issues.redhat.com/browse/OCPBUGS-125803): skip TLS flag propagation tests for older operator versions [#9641](https://github.com/openshift/hypershift/pull/9641)
* [CNTRLPLANE-4453](https://issues.redhat.com/browse/CNTRLPLANE-4453): clarify private Key Vault validation comments [#9645](https://github.com/openshift/hypershift/pull/9645)
* [CNTRLPLANE-4209](https://issues.redhat.com/browse/CNTRLPLANE-4209): Update Azure lifecycle test-flow documentation [#9573](https://github.com/openshift/hypershift/pull/9573)
* [CNTRLPLANE-4456](https://issues.redhat.com/browse/CNTRLPLANE-4456): Run envtests for release-5.0 [#9649](https://github.com/openshift/hypershift/pull/9649)
* [AUTOSCALE-974](https://issues.redhat.com/browse/AUTOSCALE-974), [AUTOSCALE-980](https://issues.redhat.com/browse/AUTOSCALE-980): allow Karpenter to be deployed on Azure [#9545](https://github.com/openshift/hypershift/pull/9545)
* [OCPBUGS-123512](https://issues.redhat.com/browse/OCPBUGS-123512): fix(e2e): derive node runtimes from upgraded NodePool state [#9611](https://github.com/openshift/hypershift/pull/9611)
* [OCPBUGS-122236](https://issues.redhat.com/browse/OCPBUGS-122236): stabilize JUnit test identities [#9580](https://github.com/openshift/hypershift/pull/9580)
* chore(renovate): enable supported release branches [#9631](https://github.com/openshift/hypershift/pull/9631)
* [CNTRLPLANE-4209](https://issues.redhat.com/browse/CNTRLPLANE-4209): Reject shared variants in concurrent e2e lanes [#9571](https://github.com/openshift/hypershift/pull/9571)
* [OCPBUGS-109672](https://issues.redhat.com/browse/OCPBUGS-109672): fix(cpo) wait for etcd health, not just DNS [#9460](https://github.com/openshift/hypershift/pull/9460)
* [OCPBUGS-123645](https://issues.redhat.com/browse/OCPBUGS-123645): add missing Azure v2 matrix coverage [#9616](https://github.com/openshift/hypershift/pull/9616)
* NO-JIRA: fix(e2e): restore Eventually retry for post-upgrade health condition check [#9632](https://github.com/openshift/hypershift/pull/9632)
* [OCPBUGS-89689](https://issues.redhat.com/browse/OCPBUGS-89689): karpenter control plane upgrade premature drift fix [#9234](https://github.com/openshift/hypershift/pull/9234)
* [CNTRLPLANE-3880](https://issues.redhat.com/browse/CNTRLPLANE-3880): Add E2E test for etcd snapshot restore to prevent split brain regression [#9356](https://github.com/openshift/hypershift/pull/9356)
* NO-JIRA: Bump envtest workflow timeout to 20 minutes [#9630](https://github.com/openshift/hypershift/pull/9630)
* [CNTRLPLANE-4090](https://issues.redhat.com/browse/CNTRLPLANE-4090): Move labels, taints, scheduler, VAP and misc constants to shared packages [#9544](https://github.com/openshift/hypershift/pull/9544)
* NO-JIRA: Fix CONTRIBUTING.md link path and remove trailing blank lines [#9621](https://github.com/openshift/hypershift/pull/9621)
* [OCPBUGS-122011](https://issues.redhat.com/browse/OCPBUGS-122011): fix(e2e): Make `InstallHyperShiftOperator` platform aware [#9555](https://github.com/openshift/hypershift/pull/9555)
* [CNTRLPLANE-3532](https://issues.redhat.com/browse/CNTRLPLANE-3532): Enable HC and HCP status-write linting [#9563](https://github.com/openshift/hypershift/pull/9563)
* [CNTRLPLANE-3608](https://issues.redhat.com/browse/CNTRLPLANE-3608): Add nested virtualization support for AWS EC2 NodePools [#8681](https://github.com/openshift/hypershift/pull/8681)
* [GCP-1122](https://issues.redhat.com/browse/GCP-1122): chore: add pvasant to gcp-reviewers alias [#9465](https://github.com/openshift/hypershift/pull/9465)
* [CNTRLPLANE-4393](https://issues.redhat.com/browse/CNTRLPLANE-4393): document CAPI provider image override mechanisms [#9482](https://github.com/openshift/hypershift/pull/9482)
* [CNTRLPLANE-3277](https://issues.redhat.com/browse/CNTRLPLANE-3277): Add Azure OAuth LoadBalancer private topology e2e test [#8584](https://github.com/openshift/hypershift/pull/8584)
* [OCPBUGS-122232](https://issues.redhat.com/browse/OCPBUGS-122232): Gate CAPI API version by management release [#9587](https://github.com/openshift/hypershift/pull/9587)
* [CNTRLPLANE-4093](https://issues.redhat.com/browse/CNTRLPLANE-4093): Move shared label constants to api/hypershift/v1beta1 [#9415](https://github.com/openshift/hypershift/pull/9415)
* [CNTRLPLANE-4207](https://issues.redhat.com/browse/CNTRLPLANE-4207): document Azure lifecycle test sharding [#9504](https://github.com/openshift/hypershift/pull/9504)
* [GCP-958](https://issues.redhat.com/browse/GCP-958): test(e2e/v2): register gcp-pd-csi-driver control plane workloads [#9589](https://github.com/openshift/hypershift/pull/9589)
* [OCPBUGS-97942](https://issues.redhat.com/browse/OCPBUGS-97942): fix(cli): add --service-publishing-strategy flag to hcp create cluster agent [#8985](https://github.com/openshift/hypershift/pull/8985)
* NO-JIRA: build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 [#9546](https://github.com/openshift/hypershift/pull/9546)
* [CNTRLPLANE-4094](https://issues.redhat.com/browse/CNTRLPLANE-4094): Move ExternalDNSLBPort and KASRouteHostname to support/netutil [#9414](https://github.com/openshift/hypershift/pull/9414)
* NO-JIRA: fix(ci): use --target for pip install on ARC runner [#9531](https://github.com/openshift/hypershift/pull/9531)
* [CNTRLPLANE-4150](https://issues.redhat.com/browse/CNTRLPLANE-4150): feat: Maintain ingress serving cert for HostedCluster ingress [#9132](https://github.com/openshift/hypershift/pull/9132)
* [CNTRLPLANE-4207](https://issues.redhat.com/browse/CNTRLPLANE-4207): update v2 test flow documentation [#9569](https://github.com/openshift/hypershift/pull/9569)
* [CNTRLPLANE-4369](https://issues.redhat.com/browse/CNTRLPLANE-4369): add prow job id tag to e2e v2 aws resources [#9542](https://github.com/openshift/hypershift/pull/9542)
* NO-JIRA: fix(managed-azure): continue resource group cleanup when HC destroy fails [#9404](https://github.com/openshift/hypershift/pull/9404)
* [ACM-41684](https://issues.redhat.com/browse/ACM-41684): Switch hypershift-operator runtime to PQC base image [#9453](https://github.com/openshift/hypershift/pull/9453)
* NO-JIRA: fix(install): increase WaitUntilAvailable timeout from 5m to 10m [#9306](https://github.com/openshift/hypershift/pull/9306)
* [OCPBUGS-87991](https://issues.redhat.com/browse/OCPBUGS-87991): validate additionalNetworks name format in KubeVirt NodePools [#8710](https://github.com/openshift/hypershift/pull/8710)
* NO-JIRA: feat(azure): Add scripts to setup credentials and check resources [#9446](https://github.com/openshift/hypershift/pull/9446)
* [CNTRLPLANE-4005](https://issues.redhat.com/browse/CNTRLPLANE-4005): Skip CDI importer pods from custom labels and tolerations checks [#9240](https://github.com/openshift/hypershift/pull/9240)
* [OCPBUGS-109724](https://issues.redhat.com/browse/OCPBUGS-109724): fix KubeVirt custom baseDomain ingress documentation [#9318](https://github.com/openshift/hypershift/pull/9318)
* NO-JIRA: spread AKS nodes across availability zones [#9449](https://github.com/openshift/hypershift/pull/9449)
* [CNTRLPLANE-4370](https://issues.redhat.com/browse/CNTRLPLANE-4370): Revert "Merge pull request #9543 from ironcladlou/e2e-promotion" [#9574](https://github.com/openshift/hypershift/pull/9574)
* [OCPBUGS-114415](https://issues.redhat.com/browse/OCPBUGS-114415): Increase relay timeouts to prevent intermittent test failures [#9459](https://github.com/openshift/hypershift/pull/9459)
* NO-JIRA: Gate GCP credential validation by control plane version [#9562](https://github.com/openshift/hypershift/pull/9562)
* [OCPBUGS-120840](https://issues.redhat.com/browse/OCPBUGS-120840): remove TechPreviewNoUpgrade from AWS cluster creation args [#9535](https://github.com/openshift/hypershift/pull/9535)
* [OCPBUGS-121208](https://issues.redhat.com/browse/OCPBUGS-121208): filter AWS-reserved tag keys before calling DeleteTags [#9538](https://github.com/openshift/hypershift/pull/9538)
* [GCP-883](https://issues.redhat.com/browse/GCP-883): Optimize GCP PSC NAT allocation [#9472](https://github.com/openshift/hypershift/pull/9472)
* [CNTRLPLANE-3603](https://issues.redhat.com/browse/CNTRLPLANE-3603): Migrate clients from CAPI v1beta1 to v1beta2 [#8717](https://github.com/openshift/hypershift/pull/8717)
* NO-JIRA: remove duplicate e2e v2 test flow doc [#9553](https://github.com/openshift/hypershift/pull/9553)
* [CNTRLPLANE-4370](https://issues.redhat.com/browse/CNTRLPLANE-4370): enforce explicit blocking/informing labels on all v2 e2e tests [#9543](https://github.com/openshift/hypershift/pull/9543)
* NO-JIRA: ci(deps): bump actions/actions-runner from 2.336.0 to 2.337.0- #9513 [#9513](https://github.com/openshift/hypershift/pull/9513)
* [CNTRLPLANE-3998](https://issues.redhat.com/browse/CNTRLPLANE-3998): warn when deprecated kube-apiserver verbosity annotation is set [#9461](https://github.com/openshift/hypershift/pull/9461)
* [CNTRLPLANE-3532](https://issues.redhat.com/browse/CNTRLPLANE-3532): migrate HCCO/route status patches to statuspatching [#9385](https://github.com/openshift/hypershift/pull/9385)
* [OCPBUGS-99534](https://issues.redhat.com/browse/OCPBUGS-99534): etcd initialization bugs after etcdctl snapshot restore [#9048](https://github.com/openshift/hypershift/pull/9048)
* [CNTRLPLANE-3646](https://issues.redhat.com/browse/CNTRLPLANE-3646): increase e2e v2 control plane upgrade coverage for v1 parity [#9491](https://github.com/openshift/hypershift/pull/9491)
* [OCPBUGS-120685](https://issues.redhat.com/browse/OCPBUGS-120685): fix(e2e): select a live NodePool for osImageStream node OS verification [#9506](https://github.com/openshift/hypershift/pull/9506)
* [ROSAENG-63186](https://issues.redhat.com/browse/ROSAENG-63186): fix(hcco): Add VAP to protect kas-bootstrap RBAC bindings from deletion [#9203](https://github.com/openshift/hypershift/pull/9203)
* NO-JIRA: remove unsafe v1 framework usage from karpenter upgrade test [#9522](https://github.com/openshift/hypershift/pull/9522)
* [CNTRLPLANE-2007](https://issues.redhat.com/browse/CNTRLPLANE-2007): KubeVirt default ingress passthrough with HostNetwork endpoint publishing strategy [#9514](https://github.com/openshift/hypershift/pull/9514)
* [CNTRLPLANE-4207](https://issues.redhat.com/browse/CNTRLPLANE-4207): Balance Azure v2 lifecycle test shards [#9419](https://github.com/openshift/hypershift/pull/9419)
* [CNTRLPLANE-3532](https://issues.redhat.com/browse/CNTRLPLANE-3532): add hcpstatuspatch linter and status-patching AGENTS.md guidance [#9388](https://github.com/openshift/hypershift/pull/9388)
* [OCPBUGS-114459](https://issues.redhat.com/browse/OCPBUGS-114459): recognize domain-specific test fields [#9454](https://github.com/openshift/hypershift/pull/9454)
* [GCP-503](https://issues.redhat.com/browse/GCP-503): feat(gcp): Implement OrphanDeleter [#8884](https://github.com/openshift/hypershift/pull/8884)
* [OCPBUGS-115269](https://issues.redhat.com/browse/OCPBUGS-115269): openstack: Start populating cacert in clouds.yaml [#9467](https://github.com/openshift/hypershift/pull/9467)
* [CNTRLPLANE-3951](https://issues.redhat.com/browse/CNTRLPLANE-3951): fix(e2e): accept node deletion as success in TestSpotTerminationHandler [#9428](https://github.com/openshift/hypershift/pull/9428)
* [OCPBUGS-74960](https://issues.redhat.com/browse/OCPBUGS-74960): fix orphaned security group during VPC endpoint deletion [#9517](https://github.com/openshift/hypershift/pull/9517)
* NO-JIRA: test(backuprestore): enable SnapshotMoveData in backup configurations [#9429](https://github.com/openshift/hypershift/pull/9429)
* [GCP-958](https://issues.redhat.com/browse/GCP-958): feat(gcp): complete GCP PD CSI driver wiring in HyperShift [#9450](https://github.com/openshift/hypershift/pull/9450)
* [RHOBS-1707](https://issues.redhat.com/browse/RHOBS-1707): Add OpenTelemetry SDK tracing to hypershift-operator [#9390](https://github.com/openshift/hypershift/pull/9390)
* [OCPBUGS-105464](https://issues.redhat.com/browse/OCPBUGS-105464): fix(nodepool): inject default worker SG by status ID, not fail-open capability flag [#9456](https://github.com/openshift/hypershift/pull/9456)
* [OCPBUGS-84368](https://issues.redhat.com/browse/OCPBUGS-84368): add safe-to-evict annotation and remove tolerations to fix autoscaler scale-down and drain loop [#8338](https://github.com/openshift/hypershift/pull/8338)
* [AUTOSCALE-998](https://issues.redhat.com/browse/AUTOSCALE-998): inject token-minter image to standalone karpenter-operator [#9492](https://github.com/openshift/hypershift/pull/9492)
* [OCPBUGS-120685](https://issues.redhat.com/browse/OCPBUGS-120685): fix(e2e): label flaking nodepool osImageStream test informing [#9505](https://github.com/openshift/hypershift/pull/9505)
* NO-JIRA: feat(chaibot): add per-platform Slack handle pings to CI health report [#9478](https://github.com/openshift/hypershift/pull/9478)
* build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /hack/tools [#9479](https://github.com/openshift/hypershift/pull/9479)
* build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 [#9480](https://github.com/openshift/hypershift/pull/9480)
* [OCPBUGS-114408](https://issues.redhat.com/browse/OCPBUGS-114408): fix(api): allow spaces in AWS resource tag keys and values [#9425](https://github.com/openshift/hypershift/pull/9425)
* [GCP-1113](https://issues.redhat.com/browse/GCP-1113): retry transient network errors in hypershift create iam gcp [#9436](https://github.com/openshift/hypershift/pull/9436)
* [OCPBUGS-115542](https://issues.redhat.com/browse/OCPBUGS-115542): fix(e2e): poll for etcd-init completion before reading restore logs [#9481](https://github.com/openshift/hypershift/pull/9481)
* [OCPBUGS-114368](https://issues.redhat.com/browse/OCPBUGS-114368): Retry Microsoft Graph transport failures [#9421](https://github.com/openshift/hypershift/pull/9421)
* [OCPBUGS-86690](https://issues.redhat.com/browse/OCPBUGS-86690): fix Azure cluster deletion hanging when resource groups are already deleted [#8682](https://github.com/openshift/hypershift/pull/8682)
* [CNTRLPLANE-4041](https://issues.redhat.com/browse/CNTRLPLANE-4041): add new release branches to renovate config [#9470](https://github.com/openshift/hypershift/pull/9470)
* [OCPBUGS-77781](https://issues.redhat.com/browse/OCPBUGS-77781): fix(certs): normalize IP SANs to stop dual-stack KAS cert churn [#9286](https://github.com/openshift/hypershift/pull/9286)
* [CNTRLPLANE-4205](https://issues.redhat.com/browse/CNTRLPLANE-4205): document OSImageStream behaviour deviations [#9486](https://github.com/openshift/hypershift/pull/9486)
* [CNTRLPLANE-3755](https://issues.redhat.com/browse/CNTRLPLANE-3755): fix(e2e): add version gating to EnsureCAPIFinalizers tests [#9443](https://github.com/openshift/hypershift/pull/9443)
* [CNTRLPLANE-3646](https://issues.redhat.com/browse/CNTRLPLANE-3646): enable e2e v2 aws control plane upgrade tests [#9474](https://github.com/openshift/hypershift/pull/9474)
* [OCPBUGS-115403](https://issues.redhat.com/browse/OCPBUGS-115403): ensure informing junit files are unique across test groups [#9473](https://github.com/openshift/hypershift/pull/9473)
* [ACM-41685](https://issues.redhat.com/browse/ACM-41685): Enable PQC crypto policy in hypershift-cli image [#9463](https://github.com/openshift/hypershift/pull/9463)
* [OCPBUGS-113712](https://issues.redhat.com/browse/OCPBUGS-113712): preserve immutable AWS load balancer annotations [#9469](https://github.com/openshift/hypershift/pull/9469)
* NO-JIRA: chore(konflux): update Tekton task bundles to latest versions [#9483](https://github.com/openshift/hypershift/pull/9483)
* [CNTRLPLANE-4204](https://issues.redhat.com/browse/CNTRLPLANE-4204): reorganize OSImageStream e2e tests after graduation [#9418](https://github.com/openshift/hypershift/pull/9418)
* [CNTRLPLANE-3201](https://issues.redhat.com/browse/CNTRLPLANE-3201): feat(e2e): enable etcd snapshot backup test on Azure [#9226](https://github.com/openshift/hypershift/pull/9226)
* [CNTRLPLANE-2029](https://issues.redhat.com/browse/CNTRLPLANE-2029): docs(backuprestore): add Agent and KubeVirt platform prerequisites [#9072](https://github.com/openshift/hypershift/pull/9072)
* [CNTRLPLANE-3950](https://issues.redhat.com/browse/CNTRLPLANE-3950): fix flaky TestKMSRootVolumeEncryption race condition. [#9304](https://github.com/openshift/hypershift/pull/9304)
* [CNTRLPLANE-4208](https://issues.redhat.com/browse/CNTRLPLANE-4208): Right-size Azure v2 e2e worker counts [#9426](https://github.com/openshift/hypershift/pull/9426)
* [CNTRLPLANE-3646](https://issues.redhat.com/browse/CNTRLPLANE-3646): port karpenter upgrade test to v2 [#9397](https://github.com/openshift/hypershift/pull/9397)
* NO-JIRA: fix(azure): orphan AzureMachines when capi-provider cannot run [#9403](https://github.com/openshift/hypershift/pull/9403)
* [OCPBUGS-99021](https://issues.redhat.com/browse/OCPBUGS-99021): Use separate certificate signers for konnectivity [#9098](https://github.com/openshift/hypershift/pull/9098)
* [OCPBUGS-99329](https://issues.redhat.com/browse/OCPBUGS-99329): avoid cache miss false-negative on credential Secret lookup [#9074](https://github.com/openshift/hypershift/pull/9074)
* NO-JIRA: group ChaiBot health report by OCP version [#9447](https://github.com/openshift/hypershift/pull/9447)
* And 4 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/hypershift/compare/813b57efa2caeb867d8ff3b9f3f0603651402dff...225d8d2265006815d4487423b7ddac7571325d77)
### [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm/tree/acf2cb50d53867796344a516b3aaabfcd7f2630d)
* [OCPCLOUD-3678](https://issues.redhat.com/browse/OCPCLOUD-3678): Merge https://github.com/IBM-Cloud/cloud-provider-ibm:01595b6d497cc6ec6f807bd7136ac43d147ea042 (01595b6) into main [#89](https://github.com/openshift/cloud-provider-ibm/pull/89)
* [Full changelog](https://github.com/openshift/cloud-provider-ibm/compare/11bc35dd6fd5163259023a6f1dfcc59ce813ab5f...acf2cb50d53867796344a516b3aaabfcd7f2630d)
### [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver/tree/ea479e39e9feb756e8c025ff2eca83f69bdd2a5d)
* [STOR-3075](https://issues.redhat.com/browse/STOR-3075): Rebase to v5.2.32 for OCP 5.1 [#175](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/175)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#161](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/161)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver/compare/3a89d7d17d25727270414b07d3daaa3bc329d743...ea479e39e9feb756e8c025ff2eca83f69bdd2a5d)
### [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/tree/eff02c84e81efacbb7419ee4f436a8eb9d7a8f03)
* [STOR-3176](https://issues.redhat.com/browse/STOR-3176): Support TLS Groups in operators for kube-rbac-proxy sidecar [#203](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/203)
* [OCPBUGS-98100](https://issues.redhat.com/browse/OCPBUGS-98100): disable snapshot tests for ibm-vpc-block-csi-driver [#175](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/175)
* [STOR-3068](https://issues.redhat.com/browse/STOR-3068): Bump all libraries [#198](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/198)
* [OCPBUGS-127462](https://issues.redhat.com/browse/OCPBUGS-127462): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#194](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/194)
* [OCPBUGS-113538](https://issues.redhat.com/browse/OCPBUGS-113538): Enable SELinuxMount tests [#180](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/180)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/compare/be4fd01725ce5ab0b47f846c905a349aeee8ab53...eff02c84e81efacbb7419ee4f436a8eb9d7a8f03)
### [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud/tree/5823f38cea16b6a9a002e791288290bc50b500a0)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-ibmcloud:v0.15.0 (5704e48) into main [#184](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/184)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#187](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/187)
* [OCPBUGS-114006](https://issues.redhat.com/browse/OCPBUGS-114006): UPSTREAM: 2933: Bump all go.opentelemetry.io/otel modules to v1.44.0 [#165](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/165)
* [Full changelog](https://github.com/openshift/cluster-api-provider-ibmcloud/compare/286dd2de7957e9c2897e152417f16907d324d819...5823f38cea16b6a9a002e791288290bc50b500a0)
### [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud/tree/5b19ea36429837bc3e68204b3219776ed2c43dff)
* [OCPCLOUD-3666](https://issues.redhat.com/browse/OCPCLOUD-3666): bump Kubernetes dependencies to 1.37 [#117](https://github.com/openshift/machine-api-provider-ibmcloud/pull/117)
* [CNF-23394](https://issues.redhat.com/browse/CNF-23394): mockgen deprecated: use uber-go/mock instead [#73](https://github.com/openshift/machine-api-provider-ibmcloud/pull/73)
* [Full changelog](https://github.com/openshift/machine-api-provider-ibmcloud/compare/2615d13b730255b21ccb401d3dc039006c54a4fe...5b19ea36429837bc3e68204b3219776ed2c43dff)
### [insights-operator](https://github.com/openshift/insights-operator/tree/8bdb4812c7dbca93dd11a2bc5fe0e7d875f070ee)
* [OCPBUGS-132789](https://issues.redhat.com/browse/OCPBUGS-132789): Gate ingress secret bindings on Ingress capability [#1403](https://github.com/openshift/insights-operator/pull/1403)
* [CCXDEV-16668](https://issues.redhat.com/browse/CCXDEV-16668): kserve gather servingRuntimes and clusterServingRuntimes CRs [#1385](https://github.com/openshift/insights-operator/pull/1385)
* [OCPBUGS-132226](https://issues.redhat.com/browse/OCPBUGS-132226): add CVO annotations to secret gatherer RBAC [#1397](https://github.com/openshift/insights-operator/pull/1397)
* NO-JIRA: Restructure scope of gather SA to specific namespaces (from 5.0) [#1392](https://github.com/openshift/insights-operator/pull/1392)
* NO-JIRA: Revert "WIP: how to add gpu node" [#1390](https://github.com/openshift/insights-operator/pull/1390)
* [CCXDEV-16671](https://issues.redhat.com/browse/CCXDEV-16671): add GPU node topology gatherer [#1364](https://github.com/openshift/insights-operator/pull/1364)
* NO-JIRA: add permissions to fetch MaasModelRefs [#1388](https://github.com/openshift/insights-operator/pull/1388)
* [CCXDEV-16669](https://issues.redhat.com/browse/CCXDEV-16669): gather externalModels [#1379](https://github.com/openshift/insights-operator/pull/1379)
* [CCXDEV-16670](https://issues.redhat.com/browse/CCXDEV-16670): add MaaSModelRef gatherer [#1377](https://github.com/openshift/insights-operator/pull/1377)
* [CCXDEV-16666](https://issues.redhat.com/browse/CCXDEV-16666): gather InferenceService from the KServe operator [#1345](https://github.com/openshift/insights-operator/pull/1345)
* [OCPBUGS-97968](https://issues.redhat.com/browse/OCPBUGS-97968): add insights-runtime-extractor-scc missing fields [#1359](https://github.com/openshift/insights-operator/pull/1359)
* [Full changelog](https://github.com/openshift/insights-operator/compare/9bf68c79ce211fb1e16050cc20552166a89b3f34...8bdb4812c7dbca93dd11a2bc5fe0e7d875f070ee)
### [insights-runtime-exporter, insights-runtime-extractor](https://github.com/openshift/insights-runtime-extractor/tree/68a7815cb622c7919e07bfba0e08334576189a25)
* [OCPBUGS-128853](https://issues.redhat.com/browse/OCPBUGS-128853): drop privilege before executing fingerprints. [#95](https://github.com/openshift/insights-runtime-extractor/pull/95)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#92](https://github.com/openshift/insights-runtime-extractor/pull/92)
* [Full changelog](https://github.com/openshift/insights-runtime-extractor/compare/ba3de3b9777161897b75fc5a88e179dfbe8f6c53...68a7815cb622c7919e07bfba0e08334576189a25)
### [ironic](https://github.com/openshift/ironic-image/tree/1fac30c51807330f3971ca58e3ee50bab8639b51)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#947](https://github.com/openshift/ironic-image/pull/947)
* [METAL-1741](https://issues.redhat.com/browse/METAL-1741): Install oslo.i18n from source [#944](https://github.com/openshift/ironic-image/pull/944)
* [METAL-1913](https://issues.redhat.com/browse/METAL-1913): Enable bootc deploy autodetection [#911](https://github.com/openshift/ironic-image/pull/911)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#943](https://github.com/openshift/ironic-image/pull/943)
* NO-ISSUE: Improve Slack notification for existing requirements update PRs [#940](https://github.com/openshift/ironic-image/pull/940)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#939](https://github.com/openshift/ironic-image/pull/939)
* [OCPBUGS-130802](https://issues.redhat.com/browse/OCPBUGS-130802), [OCPBUGS-130834](https://issues.redhat.com/browse/OCPBUGS-130834): Bump urllib3 to 2.8.0 [#938](https://github.com/openshift/ironic-image/pull/938)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#933](https://github.com/openshift/ironic-image/pull/933)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#931](https://github.com/openshift/ironic-image/pull/931)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#929](https://github.com/openshift/ironic-image/pull/929)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#924](https://github.com/openshift/ironic-image/pull/924)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#923](https://github.com/openshift/ironic-image/pull/923)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#921](https://github.com/openshift/ironic-image/pull/921)
* [METAL-1958](https://issues.redhat.com/browse/METAL-1958): Merge contiguous Dockerfile RUN layers to reduce image size [#916](https://github.com/openshift/ironic-image/pull/916)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#917](https://github.com/openshift/ironic-image/pull/917)
* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#910](https://github.com/openshift/ironic-image/pull/910)
* NO-ISSUE: Manually sync Ironic - part 2 [#909](https://github.com/openshift/ironic-image/pull/909)
* NO-ISSUE: Manually sync Ironic and Sushy from the forks [#906](https://github.com/openshift/ironic-image/pull/906)
* [Full changelog](https://github.com/openshift/ironic-image/compare/b7df7f3cb23d87efb18608919f21684b3f942297...1fac30c51807330f3971ca58e3ee50bab8639b51)
### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/2d5a89b98bf1e4fa2b64176f9e7ac076b07677a9)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#330](https://github.com/openshift/ironic-agent-image/pull/330)
* [METAL-1741](https://issues.redhat.com/browse/METAL-1741): Install oslo.i18n from source [#331](https://github.com/openshift/ironic-agent-image/pull/331)
* NO-ISSUE: Improve Slack notification for existing requirements update PRs [#329](https://github.com/openshift/ironic-agent-image/pull/329)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#322](https://github.com/openshift/ironic-agent-image/pull/322)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#321](https://github.com/openshift/ironic-agent-image/pull/321)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#320](https://github.com/openshift/ironic-agent-image/pull/320)
* [METAL-1958](https://issues.redhat.com/browse/METAL-1958): Remove OKD build deps in the same layer they are installed [#318](https://github.com/openshift/ironic-agent-image/pull/318)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#319](https://github.com/openshift/ironic-agent-image/pull/319)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#317](https://github.com/openshift/ironic-agent-image/pull/317)
* NO-ISSUE: Update requirements.cachito with latest ironic-python-agent [#302](https://github.com/openshift/ironic-agent-image/pull/302)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/fa214e73446c76ea2f10470beb31028dd035d909...2d5a89b98bf1e4fa2b64176f9e7ac076b07677a9)
### [karpenter-operator](https://github.com/openshift/karpenter-operator/tree/0a8e040a5754e86883db572c225c823ae6365702)
* [OCPBUGS-133506](https://issues.redhat.com/browse/OCPBUGS-133506): satisfy HCP pod requirements [#70](https://github.com/openshift/karpenter-operator/pull/70)
* [AUTOSCALE-1058](https://issues.redhat.com/browse/AUTOSCALE-1058): Refactor EC2 and Azure NodeClass controllers [#65](https://github.com/openshift/karpenter-operator/pull/65)
* [AUTOSCALE-1062](https://issues.redhat.com/browse/AUTOSCALE-1062): fix: remove Azure-specific maxPods bounds [#66](https://github.com/openshift/karpenter-operator/pull/66)
* [OCPBUGS-133401](https://issues.redhat.com/browse/OCPBUGS-133401): attach HCP pull credentials to operand service account [#68](https://github.com/openshift/karpenter-operator/pull/68)
* [AUTOSCALE-166](https://issues.redhat.com/browse/AUTOSCALE-166): improve core karpenter e2es more [#67](https://github.com/openshift/karpenter-operator/pull/67)
* [AUTOSCALE-166](https://issues.redhat.com/browse/AUTOSCALE-166): Scope core regression to performance tests [#63](https://github.com/openshift/karpenter-operator/pull/63)
* [OCPBUGS-131838](https://issues.redhat.com/browse/OCPBUGS-131838): support karpenter operand UID without scc [#61](https://github.com/openshift/karpenter-operator/pull/61)
* [AUTOSCALE-166](https://issues.redhat.com/browse/AUTOSCALE-166): fixup karpenter core e2e script [#64](https://github.com/openshift/karpenter-operator/pull/64)
* NO-JIRA: chore: allow karpenter operand images to be overriden [#58](https://github.com/openshift/karpenter-operator/pull/58)
* [AUTOSCALE-944](https://issues.redhat.com/browse/AUTOSCALE-944): feat: migrate HostedControlPlane lifecycle controller from HyperShift [#52](https://github.com/openshift/karpenter-operator/pull/52)
* NO-JIRA: docs: clarify explicit test expectations [#60](https://github.com/openshift/karpenter-operator/pull/60)
* [AUTOSCALE-1046](https://issues.redhat.com/browse/AUTOSCALE-1046): feat: hold Azure NodeClass releases during control plane upgrades [#56](https://github.com/openshift/karpenter-operator/pull/56)
* [AUTOSCALE-166](https://issues.redhat.com/browse/AUTOSCALE-166): skip unsupported static capacity regression tests [#59](https://github.com/openshift/karpenter-operator/pull/59)
* [AUTOSCALE-166](https://issues.redhat.com/browse/AUTOSCALE-166): constrain regression e2e nodes to amd64 [#57](https://github.com/openshift/karpenter-operator/pull/57)
* NO-JIRA: add Deployment manifest golden-file testing [#53](https://github.com/openshift/karpenter-operator/pull/53)
* [AUTOSCALE-969](https://issues.redhat.com/browse/AUTOSCALE-969): add defaultNodeClass method for azure [#54](https://github.com/openshift/karpenter-operator/pull/54)
* NO-JIRA: refactor: align controller conventions [#55](https://github.com/openshift/karpenter-operator/pull/55)
* [OCPBUGS-116223](https://issues.redhat.com/browse/OCPBUGS-116223): fix: report ClusterOperator status on unsupported platforms [#50](https://github.com/openshift/karpenter-operator/pull/50)
* [AUTOSCALE-1045](https://issues.redhat.com/browse/AUTOSCALE-1045): feat: add OpenShiftAzureNodeClass API and controller [#44](https://github.com/openshift/karpenter-operator/pull/44)
* NO-JIRA: update controller and logging guidance in agents.md [#51](https://github.com/openshift/karpenter-operator/pull/51)
* [AUTOSCALE-1057](https://issues.redhat.com/browse/AUTOSCALE-1057): Implement karpenter operator metric and add test [#48](https://github.com/openshift/karpenter-operator/pull/48)
* NO-JIRA: fix: require EBS in block device mappings [#47](https://github.com/openshift/karpenter-operator/pull/47)
* NO-JIRA: fix: align controller logging with controller-runtime guidelines [#49](https://github.com/openshift/karpenter-operator/pull/49)
* NO-JIRA: chore: enforce consistent import aliases [#46](https://github.com/openshift/karpenter-operator/pull/46)
* [AUTOSCALE-1043](https://issues.redhat.com/browse/AUTOSCALE-1043): add pod monitor for karpenter and operator [#45](https://github.com/openshift/karpenter-operator/pull/45)
* NO-JIRA: chore: version local build tool binaries [#37](https://github.com/openshift/karpenter-operator/pull/37)
* [AUTOSCALE-947](https://issues.redhat.com/browse/AUTOSCALE-947): feat: migrate EC2NodeClass controller from HyperShift [#43](https://github.com/openshift/karpenter-operator/pull/43)
* [AUTOSCALE-1008](https://issues.redhat.com/browse/AUTOSCALE-1008): Add label and annotation for MonitorOperandsRolloutStatus tracking [#39](https://github.com/openshift/karpenter-operator/pull/39)
* [AUTOSCALE-977](https://issues.redhat.com/browse/AUTOSCALE-977): feat: reconcile default NodeClass [#38](https://github.com/openshift/karpenter-operator/pull/38)
* [AUTOSCALE-856](https://issues.redhat.com/browse/AUTOSCALE-856): Add Azure Karpenter provider image reference [#41](https://github.com/openshift/karpenter-operator/pull/41)
* [AUTOSCALE-166](https://issues.redhat.com/browse/AUTOSCALE-166): Add minimum instance size requirements [#36](https://github.com/openshift/karpenter-operator/pull/36)
* NO-JIRA: fixup OWNERS_ALIASES [#35](https://github.com/openshift/karpenter-operator/pull/35)
* NO-JIRA: chore: update build tool versions [#34](https://github.com/openshift/karpenter-operator/pull/34)
* [AUTOSCALE-873](https://issues.redhat.com/browse/AUTOSCALE-873): fix: apply OpenShift Karpenter CRD adjustments [#33](https://github.com/openshift/karpenter-operator/pull/33)
* [AUTOSCALE-974](https://issues.redhat.com/browse/AUTOSCALE-974): deploy karpenter-provider-azure on HCP [#32](https://github.com/openshift/karpenter-operator/pull/32)
* [AUTOSCALE-946](https://issues.redhat.com/browse/AUTOSCALE-946): migrate approver for node CSRs [#29](https://github.com/openshift/karpenter-operator/pull/29)
* no-jira: remove aggregate cluster role [#30](https://github.com/openshift/karpenter-operator/pull/30)
* [Full changelog](https://github.com/openshift/karpenter-operator/compare/892b17c079251b141ee8142501798227dfa58359...0a8e040a5754e86883db572c225c823ae6365702)
### [keepalived-ipfailover](https://github.com/openshift/images/tree/c7e5377009eac0fc3853bb9f0ba9d702985977d7)
* [NE-2126](https://issues.redhat.com/browse/NE-2126): Make the ipfailover extension safe to register in origin [#256](https://github.com/openshift/images/pull/256)
* [NE-2126](https://issues.redhat.com/browse/NE-2126): Materialize ipfailover testdata lazily into a temp directory [#255](https://github.com/openshift/images/pull/255)
* NO-JIRA: Enable CentOS Stream 10 OKD package repositories in base image [#254](https://github.com/openshift/images/pull/254)
* [Full changelog](https://github.com/openshift/images/compare/32930575a2bb3571601a7444becc06d06e901657...c7e5377009eac0fc3853bb9f0ba9d702985977d7)
### [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server/tree/f260d5ba2211732bcbc7383cb7a07c9a144b4014)
* Bump openshift/kubernetes-metrics-server to v0.9.1 [#102](https://github.com/openshift/kubernetes-metrics-server/pull/102)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#80](https://github.com/openshift/kubernetes-metrics-server/pull/80)
* NO-ISSUE: [bot] Bump openshift/kubernetes-metrics-server to v0.9.0 [#72](https://github.com/openshift/kubernetes-metrics-server/pull/72)
* [Full changelog](https://github.com/openshift/kubernetes-metrics-server/compare/3d2e9cd0469d636e32dc0e4d4b6f65957eb27d71...f260d5ba2211732bcbc7383cb7a07c9a144b4014)
### [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy/tree/75554a0355eb0c9b25904102437a529703af89b8)
* NO-JIRA: Merge upstream v0.23.0 [#162](https://github.com/openshift/kube-rbac-proxy/pull/162)
* [CNTRLPLANE-3685](https://issues.redhat.com/browse/CNTRLPLANE-3685): docs - add Agentic SDLC context files [#144](https://github.com/openshift/kube-rbac-proxy/pull/144)
* [Full changelog](https://github.com/openshift/kube-rbac-proxy/compare/0f9a53a85f8436587adbbdc58caaf89e500cd8db...75554a0355eb0c9b25904102437a529703af89b8)
### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/4ee3abf755840bf17040e4008445cf4303e94fb9)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#169](https://github.com/openshift/kube-state-metrics/pull/169)
* NO-ISSUE: [bot] Bump openshift/kube-state-metrics to v2.20.0 [#155](https://github.com/openshift/kube-state-metrics/pull/155)
* [Full changelog](https://github.com/openshift/kube-state-metrics/compare/019ecc7d533333dfd3bf8893e78cd7ec6e282f01...4ee3abf755840bf17040e4008445cf4303e94fb9)
### [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator/tree/c67b43a2519e63f02e4be27ae6c8d4edcbc75950)
* [OCPBUGS-126583](https://issues.redhat.com/browse/OCPBUGS-126583): Bump golang.org/x/net to v0.55.0 to address CVE-2026-33814 [#266](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/266)
* NO-JIRA: Bump Go builder and CI images from 1.24 to 1.26 for openshift-5.1 [#265](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/265)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#262](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/262)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#259](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/259)
* [Full changelog](https://github.com/openshift/kubernetes-kube-storage-version-migrator/compare/72835e43c7754356645e41031f3a99926b4d42e6...c67b43a2519e63f02e4be27ae6c8d4edcbc75950)
### [kube-vip](https://github.com/openshift/kube-vip/tree/b272a7342833dad64574158101decb94ebe703d0)
* NO-JIRA: Merge https://github.com/kube-vip/kube-vip:main (https://github.com/openshift/kube-vip/commit/6cbf5aaeda356be0ee3fc5d8482d483c28bb4103) into main [#19](https://github.com/openshift/kube-vip/pull/19)
* [Full changelog](https://github.com/openshift/kube-vip/compare/3aaf76bd7be6d066b87f85eb30ba77edc0a57dcd...b272a7342833dad64574158101decb94ebe703d0)
### [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt/tree/4b1124a8cfcb65556fe44fac4150c0e86640bb0b)
* NO-ISSUE: Fix CVE-2026-33814 - bump golang.org/x/net to sustaining fork v0.50.0-sec.4 [#104](https://github.com/openshift/cloud-provider-kubevirt/pull/104)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#87](https://github.com/openshift/cloud-provider-kubevirt/pull/87)
* [Full changelog](https://github.com/openshift/cloud-provider-kubevirt/compare/5eb884abcd2ff17ae8d7b2691ca12494597c08a6...4b1124a8cfcb65556fe44fac4150c0e86640bb0b)
### [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver/tree/85737e90631afcfe5a504473bd80e0a1b1297a9e)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump Go builder to 1.26 [#123](https://github.com/openshift/kubevirt-csi-driver/pull/123)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#119](https://github.com/openshift/kubevirt-csi-driver/pull/119)
* [Full changelog](https://github.com/openshift/kubevirt-csi-driver/compare/7ff99994ecc3a675fac6f9aa7fa418cdb0dca32b...85737e90631afcfe5a504473bd80e0a1b1297a9e)
### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/506db7b1bac5724604b2a95358dac8107d5ef92c)
* [OCPCLOUD-3709](https://issues.redhat.com/browse/OCPCLOUD-3709): feat(tls): add TLS groups and curve preferences [#1571](https://github.com/openshift/machine-api-operator/pull/1571)
* [CNF-26431](https://issues.redhat.com/browse/CNF-26431): Allow ironic-networking JSON-RPC port in NetworkPolicy [#1530](https://github.com/openshift/machine-api-operator/pull/1530)
* [OCPBUGS-90560](https://issues.redhat.com/browse/OCPBUGS-90560): remove GCP boot disk image defaulting from admission webhook [#1525](https://github.com/openshift/machine-api-operator/pull/1525)
* [OCPBUGS-90560](https://issues.redhat.com/browse/OCPBUGS-90560): add RBAC for GCP boot image resolution [#1560](https://github.com/openshift/machine-api-operator/pull/1560)
* [OCPCLOUD-3660](https://issues.redhat.com/browse/OCPCLOUD-3660): bump to Kubernetes 1.37 [#1570](https://github.com/openshift/machine-api-operator/pull/1570)
* [OCPBUGS-129369](https://issues.redhat.com/browse/OCPBUGS-129369): fix race in VAP MachineSet e2e test cleanup [#1572](https://github.com/openshift/machine-api-operator/pull/1572)
* [SPLAT-2983](https://issues.redhat.com/browse/SPLAT-2983): Use Machine API vSphere credentials in e2e tests [#1568](https://github.com/openshift/machine-api-operator/pull/1568)
* [OCPBUGS-122165](https://issues.redhat.com/browse/OCPBUGS-122165): Reduce vCenter API load in the vSphere machine controller [#1552](https://github.com/openshift/machine-api-operator/pull/1552)
* [OCPCLOUD-3438](https://issues.redhat.com/browse/OCPCLOUD-3438): Bump govmomi to 0.53.0 [#1498](https://github.com/openshift/machine-api-operator/pull/1498)
* NO-ISSUE: Add opt-in kube-rbac-proxy sidecar for pprof endpoint (AWS) [#1502](https://github.com/openshift/machine-api-operator/pull/1502)
* [OCPBUGS-47508](https://issues.redhat.com/browse/OCPBUGS-47508): Set --max-concurrent-reconciles=10 for AWS machine controller [#1521](https://github.com/openshift/machine-api-operator/pull/1521)
* [SPLAT-2825](https://issues.redhat.com/browse/SPLAT-2825): Moved OTE machine tests to openshift/disruptive-longrunning [#1539](https://github.com/openshift/machine-api-operator/pull/1539)
* [OCPBUGS-105398](https://issues.redhat.com/browse/OCPBUGS-105398): refactor: remove AzureWorkloadIdentity feature gate [#1537](https://github.com/openshift/machine-api-operator/pull/1537)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/08e31544b6e3af6b5e5c8dcf9b7dad2840318958...506db7b1bac5724604b2a95358dac8107d5ef92c)
### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/9dadf03d34883f9e6ace6231a3a003e2358f2048)
* [OCPBUGS-135256](https://issues.redhat.com/browse/OCPBUGS-135256): update automated scale tests for the oldest supported… [#6700](https://github.com/openshift/machine-config-operator/pull/6700)
* [OPNET-811](https://issues.redhat.com/browse/OPNET-811): on-prem: propagate BGP VIP peer changes; disable-connected-check for FRR neighbors [#6685](https://github.com/openshift/machine-config-operator/pull/6685)
* [OCPBUGS-132697](https://issues.redhat.com/browse/OCPBUGS-132697): correctly wait for the cluster to settle after scale … [#6691](https://github.com/openshift/machine-config-operator/pull/6691)
* [OCPBUGS-115127](https://issues.redhat.com/browse/OCPBUGS-115127): Replace wildcard permissions with explicit verbs in MachineOSBuilder ClusterRole [#6471](https://github.com/openshift/machine-config-operator/pull/6471)
* [MCO-2522](https://issues.redhat.com/browse/MCO-2522): implement capi machinesets in E2E tests [#6644](https://github.com/openshift/machine-config-operator/pull/6644)
* [OCPBUGS-126565](https://issues.redhat.com/browse/OCPBUGS-126565): OCPBUGS-127024: OCPBUGS-127025: Enable `readOnlyRootFilesystem: true` for `machine-os-builder` and `create-digest-configmap` containers [#6640](https://github.com/openshift/machine-config-operator/pull/6640)
* [OCPBUGS-132309](https://issues.redhat.com/browse/OCPBUGS-132309): Fix MCN stale current config edge case [#6676](https://github.com/openshift/machine-config-operator/pull/6676)
* [OCPNODE-4602](https://issues.redhat.com/browse/OCPNODE-4602): implement {system,container}GomaxprocsBehavior field [#6332](https://github.com/openshift/machine-config-operator/pull/6332)
* [OCPBUGS-132754](https://issues.redhat.com/browse/OCPBUGS-132754): Handle restrictive policies for layered OS updates [#6670](https://github.com/openshift/machine-config-operator/pull/6670)
* [OCPBUGS-126565](https://issues.redhat.com/browse/OCPBUGS-126565): OCPBUGS-127021: Enable readOnlyRootFilesystem: true for `machine-config-controller` container [#6573](https://github.com/openshift/machine-config-operator/pull/6573)
* [OPNET-818](https://issues.redhat.com/browse/OPNET-818): on-prem: BGP VIP static pods follow platform pod conventions [#6673](https://github.com/openshift/machine-config-operator/pull/6673)
* [MCO-2622](https://issues.redhat.com/browse/MCO-2622): Update MCO dependencies to Kubernetes 1.37 [#6661](https://github.com/openshift/machine-config-operator/pull/6661)
* [OPNET-782](https://issues.redhat.com/browse/OPNET-782): on-prem: give the frr-k8s static pod reloader writable /tmp and /var/log/frr [#6643](https://github.com/openshift/machine-config-operator/pull/6643)
* [OCPBUGS-132308](https://issues.redhat.com/browse/OCPBUGS-132308): stabilize test 66436 - disable weak SSH cipher suites [#6666](https://github.com/openshift/machine-config-operator/pull/6666)
* [OCPBUGS-131830](https://issues.redhat.com/browse/OCPBUGS-131830): stabilise TestAPIServerCiphers unit test [#6659](https://github.com/openshift/machine-config-operator/pull/6659)
* [MCO-2475](https://issues.redhat.com/browse/MCO-2475): Simplified the Irreconcilable Differences test to only fetch Ignition contents [#6646](https://github.com/openshift/machine-config-operator/pull/6646)
* [OCPBUGS-130604](https://issues.redhat.com/browse/OCPBUGS-130604): test/extended: accept the data/by-lun Azure disk path [#6650](https://github.com/openshift/machine-config-operator/pull/6650)
* [OCPBUGS-129377](https://issues.redhat.com/browse/OCPBUGS-129377): MCD fails to rollback from OCL to stock RHCOS when extensions are installed [#6631](https://github.com/openshift/machine-config-operator/pull/6631)
* [OCPBUGS-129536](https://issues.redhat.com/browse/OCPBUGS-129536): Update cleanup for test `PolarionID:84219` to wait for node to be removed [#6648](https://github.com/openshift/machine-config-operator/pull/6648)
* [OCPBUGS-128286](https://issues.redhat.com/browse/OCPBUGS-128286): only enable signed policy when testing signed payloads [#6611](https://github.com/openshift/machine-config-operator/pull/6611)
* [OCPBUGS-99751](https://issues.redhat.com/browse/OCPBUGS-99751): Verify MOSC existence via API before serving layered image [#6352](https://github.com/openshift/machine-config-operator/pull/6352)
* [OCPBUGS-124571](https://issues.redhat.com/browse/OCPBUGS-124571): Bump version of `google.golang.org/grpc` [#6633](https://github.com/openshift/machine-config-operator/pull/6633)
* [SPLAT-2996](https://issues.redhat.com/browse/SPLAT-2996): use component-scoped vSphere credentials for boot image updates [#6641](https://github.com/openshift/machine-config-operator/pull/6641)
* [OCPBUGS-126565](https://issues.redhat.com/browse/OCPBUGS-126565): OCPBUGS-127020: Enable `readOnlyRootFilesystem: true` for machine-config-operator container [#6568](https://github.com/openshift/machine-config-operator/pull/6568)
* [MCO-2522](https://issues.redhat.com/browse/MCO-2522): Adapt all extended e2e test cases to use ManagedMachine… [#6621](https://github.com/openshift/machine-config-operator/pull/6621)
* [OCPBUGS-129112](https://issues.redhat.com/browse/OCPBUGS-129112): Skip GCP reconcile for unknown arch [#6625](https://github.com/openshift/machine-config-operator/pull/6625)
* [OCPBUGS-85519](https://issues.redhat.com/browse/OCPBUGS-85519): Add IRI credentials to the internal registry pull secret [#6067](https://github.com/openshift/machine-config-operator/pull/6067)
* [OCPBUGS-128811](https://issues.redhat.com/browse/OCPBUGS-128811): Remove reverse (rhel10 to rhel9) OSStreams upgrade tests [#6638](https://github.com/openshift/machine-config-operator/pull/6638)
* [OCPBUGS-128535](https://issues.redhat.com/browse/OCPBUGS-128535): Revert "OCPBUGS-91746: Remove sandboxed-containers (kata-containers) from extended-priv tests" [#6613](https://github.com/openshift/machine-config-operator/pull/6613)
* [MCO-1989](https://issues.redhat.com/browse/MCO-1989): Fix RHEL9-specific MCD Logic for RHEL10/CentOS10 for adaptability [#6515](https://github.com/openshift/machine-config-operator/pull/6515)
* [OCPBUGS-121959](https://issues.redhat.com/browse/OCPBUGS-121959): Make NIC persistence unconditional instead of version-specific [#6516](https://github.com/openshift/machine-config-operator/pull/6516)
* [OCPBUGS-128716](https://issues.redhat.com/browse/OCPBUGS-128716): logout vCenter clients after use [#6629](https://github.com/openshift/machine-config-operator/pull/6629)
* [AGENT-1454](https://issues.redhat.com/browse/AGENT-1454): Enforce APIServer TLS profile on IRI registry [#6592](https://github.com/openshift/machine-config-operator/pull/6592)
* [OCPBUGS-128457](https://issues.redhat.com/browse/OCPBUGS-128457): Fix layered OS updates on older nodes [#6630](https://github.com/openshift/machine-config-operator/pull/6630)
* [OCPBUGS-128676](https://issues.redhat.com/browse/OCPBUGS-128676): Boot image controller skips MachineSets that don't match any failure domain [#6606](https://github.com/openshift/machine-config-operator/pull/6606)
* [OPNET-782](https://issues.redhat.com/browse/OPNET-782): Render BGP VIP static pods instead of keepalived [#6326](https://github.com/openshift/machine-config-operator/pull/6326)
* [OCPBUGS-128659](https://issues.redhat.com/browse/OCPBUGS-128659): Filter cosign signature tags from the IRI release lookup [#6604](https://github.com/openshift/machine-config-operator/pull/6604)
* [MCO-2522](https://issues.redhat.com/browse/MCO-2522): Create ManagedMachineSet interface [#6602](https://github.com/openshift/machine-config-operator/pull/6602)
* NO-ISSUE: Initial version of the create MCO test plan skill [#6560](https://github.com/openshift/machine-config-operator/pull/6560)
* [OCPBUGS-128535](https://issues.redhat.com/browse/OCPBUGS-128535): Revert "OCPBUGS-91746: temporarily remove sandboxed-containers from extensions test" [#6596](https://github.com/openshift/machine-config-operator/pull/6596)
* NO-ISSUE: Fix typo in controller [#6595](https://github.com/openshift/machine-config-operator/pull/6595)
* NO-ISSUE: Increase timeout for `ImagePulledFromRegistry=Unknown` in non-SNO suites [#6598](https://github.com/openshift/machine-config-operator/pull/6598)
* [SPLAT-2376](https://issues.redhat.com/browse/SPLAT-2376): test/extended: add Azure machine pool disk setup tests [#6559](https://github.com/openshift/machine-config-operator/pull/6559)
* [OCPBUGS-105412](https://issues.redhat.com/browse/OCPBUGS-105412): Updated openshift/api vendor [#6586](https://github.com/openshift/machine-config-operator/pull/6586)
* [OCPBUGS-127481](https://issues.redhat.com/browse/OCPBUGS-127481): change markdown linter approach [#6591](https://github.com/openshift/machine-config-operator/pull/6591)
* [OCPBUGS-127707](https://issues.redhat.com/browse/OCPBUGS-127707): check CAPI manager modes for default skew status [#6589](https://github.com/openshift/machine-config-operator/pull/6589)
* [MCO-2572](https://issues.redhat.com/browse/MCO-2572): Consider nodes "Updated" when they have been manually set to an unready state but no update is happening [#6536](https://github.com/openshift/machine-config-operator/pull/6536)
* [OCPBUGS-127481](https://issues.redhat.com/browse/OCPBUGS-127481): Add markdown linter [#6582](https://github.com/openshift/machine-config-operator/pull/6582)
* [OCPBUGS-127022](https://issues.redhat.com/browse/OCPBUGS-127022): Enable `readOnlyRootFilesystem: true` for machine-config-server container [#6569](https://github.com/openshift/machine-config-operator/pull/6569)
* [OCPBUGS-74136](https://issues.redhat.com/browse/OCPBUGS-74136): Split wait-for-ipsec-connect into two services to avoid ipsec restart [#6440](https://github.com/openshift/machine-config-operator/pull/6440)
* NO-ISSUE: Increase timeout for `ImagePulledFromRegistry=Unknown` in non-SNO suites [#6574](https://github.com/openshift/machine-config-operator/pull/6574)
* [OCPBUGS-86768](https://issues.redhat.com/browse/OCPBUGS-86768): Nodes created with 4.13 base images cannot join the cluster [#6435](https://github.com/openshift/machine-config-operator/pull/6435)
* [MCO-2536](https://issues.redhat.com/browse/MCO-2536): Update operator to populate CAPI bootimage status [#6469](https://github.com/openshift/machine-config-operator/pull/6469)
* [OCPBUGS-126899](https://issues.redhat.com/browse/OCPBUGS-126899): Add MCN/PIS/MOSC/MOSB/OSImageStream to relatedObjects [#6563](https://github.com/openshift/machine-config-operator/pull/6563)
* [OCPBUGS-86571](https://issues.redhat.com/browse/OCPBUGS-86571): templates: pass --dual-stack to nodeip-configuration [#6105](https://github.com/openshift/machine-config-operator/pull/6105)
* [OCPBUGS-57177](https://issues.redhat.com/browse/OCPBUGS-57177): Degrade the MachineConfigPool on PinnedImageSet degrade [#6443](https://github.com/openshift/machine-config-operator/pull/6443)
* [OCPBUGS-63048](https://issues.redhat.com/browse/OCPBUGS-63048): Kube object asserts do not handle case where object is replaced [#6059](https://github.com/openshift/machine-config-operator/pull/6059)
* [OCPBUGS-100366](https://issues.redhat.com/browse/OCPBUGS-100366): Re-queue ContainerRuntimeConfig on status update failure [#6415](https://github.com/openshift/machine-config-operator/pull/6415)
* [OCPBUGS-90502](https://issues.redhat.com/browse/OCPBUGS-90502): Run nmstatectl format in nmstate-configuration [#6209](https://github.com/openshift/machine-config-operator/pull/6209)
* [OCPBUGS-115002](https://issues.redhat.com/browse/OCPBUGS-115002): Remove BootImageSkewEnforcement references to gate component from MCO [#6522](https://github.com/openshift/machine-config-operator/pull/6522)
* [OCPBUGS-114882](https://issues.redhat.com/browse/OCPBUGS-114882): drop GCD health-check ranges in openshift-gcp-routes [#6501](https://github.com/openshift/machine-config-operator/pull/6501)
* [OPNET-801](https://issues.redhat.com/browse/OPNET-801): Switch on-prem HAProxy pods to haproxy-router-haproxy32 image [#6502](https://github.com/openshift/machine-config-operator/pull/6502)
* [OCPBUGS-122237](https://issues.redhat.com/browse/OCPBUGS-122237): [TNF] Add infinite retry on untaint systemd unit [#6535](https://github.com/openshift/machine-config-operator/pull/6535)
* [OCPBUGS-116491](https://issues.redhat.com/browse/OCPBUGS-116491): Correctly handle MC deletion in image mode when no new build is required [#6528](https://github.com/openshift/machine-config-operator/pull/6528)
* [OCPBUGS-121353](https://issues.redhat.com/browse/OCPBUGS-121353): Pass missing proxy vars to bootstrap MCC [#6526](https://github.com/openshift/machine-config-operator/pull/6526)
* [MCO-2575](https://issues.redhat.com/browse/MCO-2575): Refactor verification functions for `calculateStatus` test cases [#6543](https://github.com/openshift/machine-config-operator/pull/6543)
* [MCO-2570](https://issues.redhat.com/browse/MCO-2570): remove poll methods [#6532](https://github.com/openshift/machine-config-operator/pull/6532)
* [OCPBUGS-114737](https://issues.redhat.com/browse/OCPBUGS-114737): updateLayeredOS deploy-from-self when skopeo < 1.22.2 [#6475](https://github.com/openshift/machine-config-operator/pull/6475)
* [OCPBUGS-122209](https://issues.redhat.com/browse/OCPBUGS-122209): Fix IsBootImageUpdateSupported to include vSphere and Azure platforms [#6523](https://github.com/openshift/machine-config-operator/pull/6523)
* [OCPBUGS-105283](https://issues.redhat.com/browse/OCPBUGS-105283): Mount /etc/container in mosb [#6451](https://github.com/openshift/machine-config-operator/pull/6451)
* [OCPBUGS-95238](https://issues.redhat.com/browse/OCPBUGS-95238): Dump compact cache to CM for persistence [#6379](https://github.com/openshift/machine-config-operator/pull/6379)
* [OCPBUGS-114664](https://issues.redhat.com/browse/OCPBUGS-114664): Fix CVE-2026-15792: Upgrade BuildKit to v0.31.2 [#6472](https://github.com/openshift/machine-config-operator/pull/6472)
* [OCPBUGS-120711](https://issues.redhat.com/browse/OCPBUGS-120711): Fix vsphere network absolute paths [#6497](https://github.com/openshift/machine-config-operator/pull/6497)
* [OCPBUGS-112721](https://issues.redhat.com/browse/OCPBUGS-112721): Retry on conflict in syncMachineConfigNodes [#6496](https://github.com/openshift/machine-config-operator/pull/6496)
* [OCPBUGS-116490](https://issues.redhat.com/browse/OCPBUGS-116490): remove nft chains before checking the ignition config [#6485](https://github.com/openshift/machine-config-operator/pull/6485)
* NO-ISSUE: check mosb failed message in test 85980 [#6500](https://github.com/openshift/machine-config-operator/pull/6500)
* [OCPBUGS-109657](https://issues.redhat.com/browse/OCPBUGS-109657): Assert errors in TestGetPrimaryPoolForNode [#6482](https://github.com/openshift/machine-config-operator/pull/6482)
* [OCPBUGS-115123](https://issues.redhat.com/browse/OCPBUGS-115123): Replace wildcard permissions with explicit verbs in MachineConfigServer ClusterRole [#6470](https://github.com/openshift/machine-config-operator/pull/6470)
* [OCPBUGS-112348](https://issues.redhat.com/browse/OCPBUGS-112348): Increase TC-74751 Eventually timeout for vSphere OVA upload [#6481](https://github.com/openshift/machine-config-operator/pull/6481)
* [OCPBUGS-115158](https://issues.redhat.com/browse/OCPBUGS-115158): Update AMI Whitelist [#6474](https://github.com/openshift/machine-config-operator/pull/6474)
* [OCPBUGS-115203](https://issues.redhat.com/browse/OCPBUGS-115203): Skip vsphere fd-unmatched machinesets for bootimage updates [#6477](https://github.com/openshift/machine-config-operator/pull/6477)
* [MCO-2530](https://issues.redhat.com/browse/MCO-2530): Remove unused functions, constants, parameters, and returns throughout the codebase [#6403](https://github.com/openshift/machine-config-operator/pull/6403)
* [MCO-2427](https://issues.redhat.com/browse/MCO-2427): Move OCB and OSStreams tests to longduration suite [#6454](https://github.com/openshift/machine-config-operator/pull/6454)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/e7e6abbd38052da7edbb1a01bf0548d2bb03468b...9dadf03d34883f9e6ace6231a3a003e2358f2048)
### [machine-os-images](https://github.com/openshift/machine-os-images/tree/3fca30d8f935900603dab36abd6cc4a1e356b693)
* [OKD-465](https://issues.redhat.com/browse/OKD-465): Update Dockerfile installer base to ocp/5.1 [#120](https://github.com/openshift/machine-os-images/pull/120)
* [OCPBUGS-126621](https://issues.redhat.com/browse/OCPBUGS-126621): Select bundled CoreOS version when COREOS_VERSION is unset [#116](https://github.com/openshift/machine-os-images/pull/116)
* [OCPBUGS-112613](https://issues.redhat.com/browse/OCPBUGS-112613): Validate aarch64 ISO checksum after cross-arch extraction [#113](https://github.com/openshift/machine-os-images/pull/113)
* [Full changelog](https://github.com/openshift/machine-os-images/compare/1d6a7d787cc8d1f8570b3310a764be493071c8eb...3fca30d8f935900603dab36abd6cc4a1e356b693)
### [metallb-frr](https://github.com/openshift/frr/tree/567c9101668ad51d96feb15ff121d69d6256fc1a)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#138](https://github.com/openshift/frr/pull/138)
* [OKD-453](https://issues.redhat.com/browse/OKD-453): Dockerfile.openshift: conditionally install frr or frr10 based on OS version [#137](https://github.com/openshift/frr/pull/137)
* [Full changelog](https://github.com/openshift/frr/compare/54a6ea48902d81460536b81ea6bdceb89c12e622...567c9101668ad51d96feb15ff121d69d6256fc1a)
### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/fc098fa592d89131014d895c8c1947ad24a4eb99)
* NO-JIRA: add diagnose-pipeline-failure skill and fix monitoring-dev periodic [#1402](https://github.com/openshift/monitoring-plugin/pull/1402)
* [CNV-87535](https://issues.redhat.com/browse/CNV-87535): address orphan cleanup review feedback [#1398](https://github.com/openshift/monitoring-plugin/pull/1398)
* [OU-1428](https://issues.redhat.com/browse/OU-1428): add persistent column selection and sorting [#1396](https://github.com/openshift/monitoring-plugin/pull/1396)
* [OU-1429](https://issues.redhat.com/browse/OU-1429): upgrade openshift sdk version [#1395](https://github.com/openshift/monitoring-plugin/pull/1395)
* [CNV-87535](https://issues.redhat.com/browse/CNV-87535): k8s: add orphan AlertRelabelConfig GC [#1174](https://github.com/openshift/monitoring-plugin/pull/1174)
* NO-JIRA: Fix vulnerable dependencies [#1394](https://github.com/openshift/monitoring-plugin/pull/1394)
* NO-JIRA: add playwrite component tests [#1392](https://github.com/openshift/monitoring-plugin/pull/1392)
* [OU-1593](https://issues.redhat.com/browse/OU-1593): Upgrade perses [#1366](https://github.com/openshift/monitoring-plugin/pull/1366)
* [OU-1595](https://issues.redhat.com/browse/OU-1595): merge logging-view into the monitoring console plugin [#1360](https://github.com/openshift/monitoring-plugin/pull/1360)
* [OU-1428](https://issues.redhat.com/browse/OU-1428): add missing alert list page tooltips [#1387](https://github.com/openshift/monitoring-plugin/pull/1387)
* [OU-1428](https://issues.redhat.com/browse/OU-1428): alert management list page [#1345](https://github.com/openshift/monitoring-plugin/pull/1345)
* [OCPBUGS-131104](https://issues.redhat.com/browse/OCPBUGS-131104), [OCPBUGS-131955](https://issues.redhat.com/browse/OCPBUGS-131955), [OCPBUGS-131960](https://issues.redhat.com/browse/OCPBUGS-131960), [OCPBUGS-131970](https://issues.redhat.com/browse/OCPBUGS-131970), [OCPBUGS-131984](https://issues.redhat.com/browse/OCPBUGS-131984), [OCPBUGS-132028](https://issues.redhat.com/browse/OCPBUGS-132028): Upgrade vulnerable dependencies [#1328](https://github.com/openshift/monitoring-plugin/pull/1328)
* [OCPBUGS-132207](https://issues.redhat.com/browse/OCPBUGS-132207): fix metrics series color squares [#1368](https://github.com/openshift/monitoring-plugin/pull/1368)
* [OU-1488](https://issues.redhat.com/browse/OU-1488): sanitize linkified URLs in alert annotations [#1374](https://github.com/openshift/monitoring-plugin/pull/1374)
* [OU-1428](https://issues.redhat.com/browse/OU-1428): fix prometheus rules api compatibility by removing omitempty's [#1373](https://github.com/openshift/monitoring-plugin/pull/1373)
* NO-JIRA: watch AlertRelabelConfig resource in openshift-monitoring only [#1361](https://github.com/openshift/monitoring-plugin/pull/1361)
* NO-JIRA: Add alerting GET endpoints to OpenAPI [#1344](https://github.com/openshift/monitoring-plugin/pull/1344)
* NO-JIRA: fix: provide SA token to console bridge to access remote dashboards from local dev env [#1351](https://github.com/openshift/monitoring-plugin/pull/1351)
* NO-JIRA: fix: patch vulnerable dependencies [#1318](https://github.com/openshift/monitoring-plugin/pull/1318)
* NO-JIRA: Add alert management API [#1339](https://github.com/openshift/monitoring-plugin/pull/1339)
* [OU-1392](https://issues.redhat.com/browse/OU-1392): fix: parse datetime ranges from the specified format rather than browser specific apis [#1308](https://github.com/openshift/monitoring-plugin/pull/1308)
* [OU-1483](https://issues.redhat.com/browse/OU-1483): automation - perses rbac stability and group permission for all users [#1326](https://github.com/openshift/monitoring-plugin/pull/1326)
* [OU-1600](https://issues.redhat.com/browse/OU-1600): fix: sort agentic runs by created to avoid getting stalled runs related to alerts [#1325](https://github.com/openshift/monitoring-plugin/pull/1325)
* [OU-1436](https://issues.redhat.com/browse/OU-1436): refactor to prepare for alert management [#1324](https://github.com/openshift/monitoring-plugin/pull/1324)
* [OU-1212](https://issues.redhat.com/browse/OU-1212): Create Observability Services landing page [#1289](https://github.com/openshift/monitoring-plugin/pull/1289)
* NO-JIRA: update devspace to sync backend and config changes [#1322](https://github.com/openshift/monitoring-plugin/pull/1322)
* NO-JIRA: prevent importing feature files in shared files [#1323](https://github.com/openshift/monitoring-plugin/pull/1323)
* [OU-1528](https://issues.redhat.com/browse/OU-1528): Swapping namespaces in Alerts optimized [#1305](https://github.com/openshift/monitoring-plugin/pull/1305)
* NO-JIRA: Agent skills consolidated [#1298](https://github.com/openshift/monitoring-plugin/pull/1298)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#1264](https://github.com/openshift/monitoring-plugin/pull/1264)
* NO-JIRA: sanitize runbook_url [#1255](https://github.com/openshift/monitoring-plugin/pull/1255)
* [OU-1150](https://issues.redhat.com/browse/OU-1150): more refactors [#1286](https://github.com/openshift/monitoring-plugin/pull/1286)
* NO-JIRA: duplicate dashboard creates perses project [#1258](https://github.com/openshift/monitoring-plugin/pull/1258)
* [OCPBUGS-123668](https://issues.redhat.com/browse/OCPBUGS-123668): patch adm-zip vulnerable version [#1274](https://github.com/openshift/monitoring-plugin/pull/1274)
* NO-JIRA: feat: migrate to vitest [#1237](https://github.com/openshift/monitoring-plugin/pull/1237)
* [OU-1220](https://issues.redhat.com/browse/OU-1220): Add column to display dashboard id in perses dashboard list page [#1257](https://github.com/openshift/monitoring-plugin/pull/1257)
* [OU-791](https://issues.redhat.com/browse/OU-791): hide Export as CSV link on empty Alerts page [#1251](https://github.com/openshift/monitoring-plugin/pull/1251)
* NO-JIRA: fix(metrics): sync query-browser URL into Redux after navigation [#1238](https://github.com/openshift/monitoring-plugin/pull/1238)
* [OU-1344](https://issues.redhat.com/browse/OU-1344): Add granular permission checks [#1185](https://github.com/openshift/monitoring-plugin/pull/1185)
* NO-JIRA: Pin node 22 and migrate deprecated i18next-parser [#1235](https://github.com/openshift/monitoring-plugin/pull/1235)
* NO-JIRA: use existing env var as a dashboard project in the OLS show time… [#1236](https://github.com/openshift/monitoring-plugin/pull/1236)
* [OU-1147](https://issues.redhat.com/browse/OU-1147): Perses UI Customization. Allow semantic tokens to map correctly with PatternFly themes and modes [#1226](https://github.com/openshift/monitoring-plugin/pull/1226)
* [OU-1472](https://issues.redhat.com/browse/OU-1472): refactor variables [#1224](https://github.com/openshift/monitoring-plugin/pull/1224)
* [OCPBUGS-119714](https://issues.redhat.com/browse/OCPBUGS-119714), [OCPBUGS-119717](https://issues.redhat.com/browse/OCPBUGS-119717): fix: upgrade fast-uri to 3.1.7 [#1234](https://github.com/openshift/monitoring-plugin/pull/1234)
* [OCPBUGS-115456](https://issues.redhat.com/browse/OCPBUGS-115456): fix: upgrade vulnerable dependencies [#1233](https://github.com/openshift/monitoring-plugin/pull/1233)
* [OU-1472](https://issues.redhat.com/browse/OU-1472): lint tags [#1221](https://github.com/openshift/monitoring-plugin/pull/1221)
* [OU-1472](https://issues.redhat.com/browse/OU-1472): perses version upgrade fixes [#1228](https://github.com/openshift/monitoring-plugin/pull/1228)
* [OCPBUGS-114786](https://issues.redhat.com/browse/OCPBUGS-114786), [OCPBUGS-114789](https://issues.redhat.com/browse/OCPBUGS-114789), [OCPBUGS-114792](https://issues.redhat.com/browse/OCPBUGS-114792): fix: upgrade vulnerable fast-uri dependency [#1200](https://github.com/openshift/monitoring-plugin/pull/1200)
* NO-JIRA: Add dchromik to observability-ui aliases [#1230](https://github.com/openshift/monitoring-plugin/pull/1230)
* NO-JIRA: upgrade webpack [#1213](https://github.com/openshift/monitoring-plugin/pull/1213)
* And 2 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/525bbd1556c5af07906360bac2e91c6d70959b65...fc098fa592d89131014d895c8c1947ad24a4eb99)
### [multus-admission-controller](https://github.com/openshift/multus-admission-controller/tree/3d6d6699aa06bb3b24d35620fb17b5b705ed0bb8)
* [CORENET-6320](https://issues.redhat.com/browse/CORENET-6320): fix(deployment): use read-only root filesystems [#138](https://github.com/openshift/multus-admission-controller/pull/138)
* [CORENET-7234](https://issues.redhat.com/browse/CORENET-7234): Update OWNERS file [#118](https://github.com/openshift/multus-admission-controller/pull/118)
* NO-JIRA: Bump to Ginkgo v2 2.33.0 [#142](https://github.com/openshift/multus-admission-controller/pull/142)
* [CORENET-7567](https://issues.redhat.com/browse/CORENET-7567): Add TLS curve preferences configuration support [#143](https://github.com/openshift/multus-admission-controller/pull/143)
* [CORENET-7375](https://issues.redhat.com/browse/CORENET-7375): d/s merge Bump Kubernetes to 1.36.2 and Go to 1.26 [#123](https://github.com/openshift/multus-admission-controller/pull/123)
* [OCPBUGS-112557](https://issues.redhat.com/browse/OCPBUGS-112557): Bump golang.org/x/net to 0.57.0 to fix CVE-2026-33814 [#125](https://github.com/openshift/multus-admission-controller/pull/125)
* [Full changelog](https://github.com/openshift/multus-admission-controller/compare/6d9df61378321846c00a32f0c42b6688daacd649...3d6d6699aa06bb3b24d35620fb17b5b705ed0bb8)
### [multus-cni, multus-cni-microshift](https://github.com/openshift/multus-cni/tree/65b175bfbceeb7de7bc4a82d336858d93e30120c)
* [CORENET-7619](https://issues.redhat.com/browse/CORENET-7619): DS Merge 10/12/26 [#370](https://github.com/openshift/multus-cni/pull/370)
* [Full changelog](https://github.com/openshift/multus-cni/compare/f046826640baf19d335411b2116fe8d2124158d3...65b175bfbceeb7de7bc4a82d336858d93e30120c)
### [multus-route-override-cni](https://github.com/openshift/route-override-cni/tree/345809e13769604b88431f4a226c56c7227cadce)
* [CORENET-7631](https://issues.redhat.com/browse/CORENET-7631): Update the minimum Go version [#84](https://github.com/openshift/route-override-cni/pull/84)
* [CORENET-7631](https://issues.redhat.com/browse/CORENET-7631): Bump Kubernetes to 1.37 and Go to 1.26.8 [#83](https://github.com/openshift/route-override-cni/pull/83)
* [CORENET-7237](https://issues.redhat.com/browse/CORENET-7237): Update OWNERS file [#70](https://github.com/openshift/route-override-cni/pull/70)
* [Full changelog](https://github.com/openshift/route-override-cni/compare/ce65e37e2571101213bb32643316812df311701b...345809e13769604b88431f4a226c56c7227cadce)
### [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni/tree/6a6381d869e964d741a551fd869644b0364c5b26)
* [CORENET-7230](https://issues.redhat.com/browse/CORENET-7230): Update OWNERS file [#414](https://github.com/openshift/whereabouts-cni/pull/414)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#430](https://github.com/openshift/whereabouts-cni/pull/430)
* [OCPBUGS-112555](https://issues.redhat.com/browse/OCPBUGS-112555): Fix for CVE-2026-33814 [#418](https://github.com/openshift/whereabouts-cni/pull/418)
* [Full changelog](https://github.com/openshift/whereabouts-cni/compare/d918bda28ad3d0200b6e4f2ef2801556764762e5...6a6381d869e964d741a551fd869644b0364c5b26)
### [must-gather](https://github.com/openshift/must-gather/tree/e2487964fe989e4147fc02cede01ea0bc8a6be7c)
* [OCPBUGS-122049](https://issues.redhat.com/browse/OCPBUGS-122049): gather_ppc: collect per-node ethtool channel data [#562](https://github.com/openshift/must-gather/pull/562)
* [WINC-2092](https://issues.redhat.com/browse/WINC-2092): Add windows_exporter log collection [#560](https://github.com/openshift/must-gather/pull/560)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#563](https://github.com/openshift/must-gather/pull/563)
* [Full changelog](https://github.com/openshift/must-gather/compare/1e5c2ec841c1ed29110febaf8a448936842a2f4d...e2487964fe989e4147fc02cede01ea0bc8a6be7c)
### [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon/tree/f2abba74f88bff66660ab1baa0a7e105ede1f399)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#158](https://github.com/openshift/network-metrics-daemon/pull/158)
* [CORENET-7238](https://issues.redhat.com/browse/CORENET-7238): Update OWNERS file [#145](https://github.com/openshift/network-metrics-daemon/pull/145)
* [Full changelog](https://github.com/openshift/network-metrics-daemon/compare/80fc3abc785d2b4d8275ba316c579de43416148d...f2abba74f88bff66660ab1baa0a7e105ede1f399)
### [network-tools](https://github.com/openshift/network-tools/tree/47d3d41a66947a012fbe6370b91470f7b19ae8bf)
* [CORENET-7641](https://issues.redhat.com/browse/CORENET-7641), [CORENET-7647](https://issues.redhat.com/browse/CORENET-7647): Add AGENTS.md and coderabbit config [#192](https://github.com/openshift/network-tools/pull/192)
* NO-JIRA: Added iperf3 [#189](https://github.com/openshift/network-tools/pull/189)
* [Full changelog](https://github.com/openshift/network-tools/compare/0b53ac3dccf59cd169555bf18c207122374bf003...47d3d41a66947a012fbe6370b91470f7b19ae8bf)
### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/f693d575801277e20df82e29cf422e979e984c66)
* [OCPNETUI-138](https://issues.redhat.com/browse/OCPNETUI-138): Add Cypress E2E tests for topology resource details drawer [#664](https://github.com/openshift/networking-console-plugin/pull/664)
* [OCPNETUI-18](https://issues.redhat.com/browse/OCPNETUI-18): Add Cypress E2E tests for topology CUDN/UDN nodes [#656](https://github.com/openshift/networking-console-plugin/pull/656)
* [OCPNETUI-31](https://issues.redhat.com/browse/OCPNETUI-31): Add Cypress E2E tests for topology NAD nodes [#655](https://github.com/openshift/networking-console-plugin/pull/655)
* [OCPNETUI-56](https://issues.redhat.com/browse/OCPNETUI-56): Split hot-cluster-e2e-run.yml into composite actions [#581](https://github.com/openshift/networking-console-plugin/pull/581)
* [OCPBUGS-132373](https://issues.redhat.com/browse/OCPBUGS-132373): Removed clearing of spec.selector/ports on switch to ExternalName service type [#641](https://github.com/openshift/networking-console-plugin/pull/641)
* [OCPNETUI-168](https://issues.redhat.com/browse/OCPNETUI-168): Update Owners file [#644](https://github.com/openshift/networking-console-plugin/pull/644)
* [OCPNETUI-115](https://issues.redhat.com/browse/OCPNETUI-115): Topology toolbar view [#643](https://github.com/openshift/networking-console-plugin/pull/643)
* [OCPNETUI-114](https://issues.redhat.com/browse/OCPNETUI-114): Add network topology view [#561](https://github.com/openshift/networking-console-plugin/pull/561)
* [OCPNETUI-56](https://issues.redhat.com/browse/OCPNETUI-56): Add custom ARC runner image with pre-installed tools [#580](https://github.com/openshift/networking-console-plugin/pull/580)
* [OCPNETUI-136](https://issues.redhat.com/browse/OCPNETUI-136): E2E tests for the topology node view [#631](https://github.com/openshift/networking-console-plugin/pull/631)
* maintenance: bump the npm group with 32 updates [#635](https://github.com/openshift/networking-console-plugin/pull/635)
* [OCPNETUI-178](https://issues.redhat.com/browse/OCPNETUI-178): migrate to @kubevirt-ui-ext/kubevirt-api [#626](https://github.com/openshift/networking-console-plugin/pull/626)
* [OCPNETUI-137](https://issues.redhat.com/browse/OCPNETUI-137): E2E tests for the topology view toolbar [#632](https://github.com/openshift/networking-console-plugin/pull/632)
* [OCPNETUI-56](https://issues.redhat.com/browse/OCPNETUI-56): Hot-cluster CI infrastructure and test fixes [#522](https://github.com/openshift/networking-console-plugin/pull/522)
* maintenance: bump the npm group with 33 updates [#619](https://github.com/openshift/networking-console-plugin/pull/619)
* maintenance: bump cypress-io/github-action from 6 to 7 in the github-actions group [#608](https://github.com/openshift/networking-console-plugin/pull/608)
* [OCPNETUI-80](https://issues.redhat.com/browse/OCPNETUI-80): Migrate to eslint v9 [#488](https://github.com/openshift/networking-console-plugin/pull/488)
* maintenance: bump the npm group with 20 updates [#598](https://github.com/openshift/networking-console-plugin/pull/598)
* [OCPNETUI-140](https://issues.redhat.com/browse/OCPNETUI-140): dependency cleanup [#589](https://github.com/openshift/networking-console-plugin/pull/589)
* [OCPNETUI-140](https://issues.redhat.com/browse/OCPNETUI-140): reassign dev and prod dependencies [#582](https://github.com/openshift/networking-console-plugin/pull/582)
* [OCPNETUI-56](https://issues.redhat.com/browse/OCPNETUI-56): Add hot-cluster E2E workflows, composite actions, and Dockerfile.ci [#497](https://github.com/openshift/networking-console-plugin/pull/497)
* [OCPBUGS-105361](https://issues.redhat.com/browse/OCPBUGS-105361): Create UDN modal now supports secondary UDN creation [#579](https://github.com/openshift/networking-console-plugin/pull/579)
* maintenance: bump the npm group with 26 updates [#575](https://github.com/openshift/networking-console-plugin/pull/575)
* [OCPBUGS-98590](https://issues.redhat.com/browse/OCPBUGS-98590): Added validation to NAD creation pages [#553](https://github.com/openshift/networking-console-plugin/pull/553)
* maintenance: bump the npm group across 1 directory with 17 updates [#563](https://github.com/openshift/networking-console-plugin/pull/563)
* [OCPNETUI-140](https://issues.redhat.com/browse/OCPNETUI-140): Align shared modules with Console [#546](https://github.com/openshift/networking-console-plugin/pull/546)
* [OCPNETUI-140](https://issues.redhat.com/browse/OCPNETUI-140): Extend dependabot ignore list [#545](https://github.com/openshift/networking-console-plugin/pull/545)
* maintenance: bump the npm group across 1 directory with 201 updates [#544](https://github.com/openshift/networking-console-plugin/pull/544)
* maintenance: bump the npm-security group across 1 directory with 10 updates [#521](https://github.com/openshift/networking-console-plugin/pull/521)
* [OCPNETUI-65](https://issues.redhat.com/browse/OCPNETUI-65): Enable dependabot updates on release-5.0 [#524](https://github.com/openshift/networking-console-plugin/pull/524)
* [OCPBUGS-86053](https://issues.redhat.com/browse/OCPBUGS-86053): Fix MultiNetworkPolicy list crash when spec is missing [#523](https://github.com/openshift/networking-console-plugin/pull/523)
* [OCPNETUI-78](https://issues.redhat.com/browse/OCPNETUI-78): Remove unused Dockerfile.art [#516](https://github.com/openshift/networking-console-plugin/pull/516)
* [OCPNETUI-63](https://issues.redhat.com/browse/OCPNETUI-63): Drop unused Helm charts [#473](https://github.com/openshift/networking-console-plugin/pull/473)
* [OCPNETUI-14](https://issues.redhat.com/browse/OCPNETUI-14): Add Cypress E2E tests for network-to-VM cross-navigation [#493](https://github.com/openshift/networking-console-plugin/pull/493)
* [OCPNETUI-65](https://issues.redhat.com/browse/OCPNETUI-65): Add multi-branch dependabot config [#487](https://github.com/openshift/networking-console-plugin/pull/487)
* [CNV-67257](https://issues.redhat.com/browse/CNV-67257): Set physicalNetworkName on OVN localnet NADs created from the console [#477](https://github.com/openshift/networking-console-plugin/pull/477)
* [OCPBUGS-105358](https://issues.redhat.com/browse/OCPBUGS-105358): Fix NAD config generated in form for OVN K8s secondary localnet networks [#496](https://github.com/openshift/networking-console-plugin/pull/496)
* [OCPNETUI-81](https://issues.redhat.com/browse/OCPNETUI-81): Retry fetching from npm registry to unblock OKD build [#494](https://github.com/openshift/networking-console-plugin/pull/494)
* [OCPNETUI-56](https://issues.redhat.com/browse/OCPNETUI-56): Add CI scripts for hot-cluster E2E infrastructure [#489](https://github.com/openshift/networking-console-plugin/pull/489)
* [OCPNETUI-56](https://issues.redhat.com/browse/OCPNETUI-56): Add ci-env-controller Helm chart for test environment lifecycle [#491](https://github.com/openshift/networking-console-plugin/pull/491)
* [OCPNETUI-56](https://issues.redhat.com/browse/OCPNETUI-56): Add ci-test-stack Helm chart for E2E test environments [#490](https://github.com/openshift/networking-console-plugin/pull/490)
* [OCPNETUI-22](https://issues.redhat.com/browse/OCPNETUI-22): Add Cypress E2E tests for Service create and edit form [#480](https://github.com/openshift/networking-console-plugin/pull/480)
* [OCPNETUI-78](https://issues.redhat.com/browse/OCPNETUI-78): Sync Dockerfile and Dockerfile.art [#485](https://github.com/openshift/networking-console-plugin/pull/485)
* [OCPNETUI-59](https://issues.redhat.com/browse/OCPNETUI-59): Add Cypress E2E tests for Service and Route endpoint health [#481](https://github.com/openshift/networking-console-plugin/pull/481)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/881e2f26370d07c2c5e6240e478000da34cf15a6...f693d575801277e20df82e29cf422e979e984c66)
### [nutanix-cloud-controller-manager](https://github.com/openshift/cloud-provider-nutanix/tree/eded4633cafeaab62f01736ef6a6115077bebf7c)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#84](https://github.com/openshift/cloud-provider-nutanix/pull/84)
* [OCPBUGS-123772](https://issues.redhat.com/browse/OCPBUGS-123772): Bump golang.org/x/net to v0.58.0 to address CVE-2026-33814 [#85](https://github.com/openshift/cloud-provider-nutanix/pull/85)
* [Full changelog](https://github.com/openshift/cloud-provider-nutanix/compare/dc584c6b2e895a6217f9e2dbed765209af1898a1...eded4633cafeaab62f01736ef6a6115077bebf7c)
### [nutanix-machine-controllers](https://github.com/openshift/machine-api-provider-nutanix/tree/62f4cab314a62b41ddf45e183c5137db9510cac5)
* [OCPCLOUD-3664](https://issues.redhat.com/browse/OCPCLOUD-3664): bump Kubernetes dependencies to 1.37 [#142](https://github.com/openshift/machine-api-provider-nutanix/pull/142)
* [Full changelog](https://github.com/openshift/machine-api-provider-nutanix/compare/249b7c8edfca8f25413dc76bc5a216fbe12a9ab1...62f4cab314a62b41ddf45e183c5137db9510cac5)
### [oauth-apiserver](https://github.com/openshift/oauth-apiserver/tree/d059f0e86a0a8370414c45d8af10dcd1f9134b0a)
* [CNTRLPLANE-4583](https://issues.redhat.com/browse/CNTRLPLANE-4583): K8s 1.37 rebase [#239](https://github.com/openshift/oauth-apiserver/pull/239)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#228](https://github.com/openshift/oauth-apiserver/pull/228)
* [OCPBUGS-108041](https://issues.redhat.com/browse/OCPBUGS-108041): fix CVE-2026-41178 by bumping otel to v1.44.0 [#219](https://github.com/openshift/oauth-apiserver/pull/219)
* [Full changelog](https://github.com/openshift/oauth-apiserver/compare/81d5261594cba423b2519b8bc171e7967b987e36...d059f0e86a0a8370414c45d8af10dcd1f9134b0a)
### [oauth-proxy](https://github.com/openshift/oauth-proxy/tree/2c9e613ae807baecb5bbeeb47b567b2e6c47a088)
* NO-JIRA: watcher: fix undying goroutine [#378](https://github.com/openshift/oauth-proxy/pull/378)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#377](https://github.com/openshift/oauth-proxy/pull/377)
* [ACM-37203](https://issues.redhat.com/browse/ACM-37203): Add support for configurable TLS profiles [#372](https://github.com/openshift/oauth-proxy/pull/372)
* [OCPBUGS-115305](https://issues.redhat.com/browse/OCPBUGS-115305): bugfix: rewrite open redirect strings to '/' [#374](https://github.com/openshift/oauth-proxy/pull/374)
* [Full changelog](https://github.com/openshift/oauth-proxy/compare/63a61bf10cbf46145a127246216540a38b50a018...2c9e613ae807baecb5bbeeb47b567b2e6c47a088)
### [oauth-server](https://github.com/openshift/oauth-server/tree/c7275e7430212511532b678d69f53add19d2708b)
* [CNTRLPLANE-4583](https://issues.redhat.com/browse/CNTRLPLANE-4583): K8s 1.37 rebase [#290](https://github.com/openshift/oauth-server/pull/290)
* [OCPBUGS-130780](https://issues.redhat.com/browse/OCPBUGS-130780): Remove ancient deprecated header [#196](https://github.com/openshift/oauth-server/pull/196)
* [OCPBUGS-122888](https://issues.redhat.com/browse/OCPBUGS-122888): Add high contrast support to oauth templates [#262](https://github.com/openshift/oauth-server/pull/262)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Update build-machinery-go vendor dependency [#260](https://github.com/openshift/oauth-server/pull/260)
* [OCPBUGS-115307](https://issues.redhat.com/browse/OCPBUGS-115307): bugfix: default to english when Accept-Language header contains more than 1000 underscores [#253](https://github.com/openshift/oauth-server/pull/253)
* [Full changelog](https://github.com/openshift/oauth-server/compare/1600eafd18f46d54ad0a9ff70fa03a085f6f6218...c7275e7430212511532b678d69f53add19d2708b)
### [olm-catalogd, olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller/tree/505480fd1df54cd7408fb7c03d0c78e15300b671)
* [OPRUN-4826](https://issues.redhat.com/browse/OPRUN-4826): Update OLMv1 test extension to Kubernetes 1.37 [#841](https://github.com/openshift/operator-framework-operator-controller/pull/841)
* [OPRUN-4825](https://issues.redhat.com/browse/OPRUN-4825): Update default-catalog-consistency to Kubernetes 1.37 [#840](https://github.com/openshift/operator-framework-operator-controller/pull/840)
* [OPRUN-4791](https://issues.redhat.com/browse/OPRUN-4791): Synchronize From Upstream Repositories [#838](https://github.com/openshift/operator-framework-operator-controller/pull/838)
* NO-ISSUE: Synchronize From Upstream Repositories [#832](https://github.com/openshift/operator-framework-operator-controller/pull/832)
* NO-ISSUE: Remove NewOLMOwnSingleNamespace OTE tests [#833](https://github.com/openshift/operator-framework-operator-controller/pull/833)
* [OPRUN-4802](https://issues.redhat.com/browse/OPRUN-4802): Synchronize From Upstream Repositories [#836](https://github.com/openshift/operator-framework-operator-controller/pull/836)
* NO-ISSUE: Synchronize From Upstream Repositories [#831](https://github.com/openshift/operator-framework-operator-controller/pull/831)
* [OPRUN-4786](https://issues.redhat.com/browse/OPRUN-4786), [OPRUN-4793](https://issues.redhat.com/browse/OPRUN-4793): Synchronize From Upstream Repositories [#830](https://github.com/openshift/operator-framework-operator-controller/pull/830)
* NO-ISSUE: Synchronize From Upstream Repositories [#829](https://github.com/openshift/operator-framework-operator-controller/pull/829)
* NO-ISSUE: Synchronize From Upstream Repositories [#828](https://github.com/openshift/operator-framework-operator-controller/pull/828)
* NO-ISSUE: Synchronize From Upstream Repositories [#826](https://github.com/openshift/operator-framework-operator-controller/pull/826)
* NO-ISSUE: Synchronize From Upstream Repositories [#823](https://github.com/openshift/operator-framework-operator-controller/pull/823)
* NO-ISSUE: Pin controller-runtime to v0.24.1 in tests-extension [#821](https://github.com/openshift/operator-framework-operator-controller/pull/821)
* [OCPBUGS-97746](https://issues.redhat.com/browse/OCPBUGS-97746), [OPRUN-4738](https://issues.redhat.com/browse/OPRUN-4738), [OPRUN-4774](https://issues.redhat.com/browse/OPRUN-4774), [OPRUN-4775](https://issues.redhat.com/browse/OPRUN-4775): Synchronize From Upstream Repositories [#819](https://github.com/openshift/operator-framework-operator-controller/pull/819)
* ocpbugs-115274: fix webhook finalizer flake [#798](https://github.com/openshift/operator-framework-operator-controller/pull/798)
* [OCPBUGS-121303](https://issues.redhat.com/browse/OCPBUGS-121303), [OCPBUGS-121304](https://issues.redhat.com/browse/OCPBUGS-121304): Bump go-git to v5.19.2 [#810](https://github.com/openshift/operator-framework-operator-controller/pull/810)
* [OPRUN-4723](https://issues.redhat.com/browse/OPRUN-4723): Synchronize From Upstream Repositories [#811](https://github.com/openshift/operator-framework-operator-controller/pull/811)
* NO-ISSUE: Synchronize From Upstream Repositories [#791](https://github.com/openshift/operator-framework-operator-controller/pull/791)
* [OCPBUGS-83515](https://issues.redhat.com/browse/OCPBUGS-83515): UPSTREAM: <carry>: use internal shell image for catalog FBC curl Job [#792](https://github.com/openshift/operator-framework-operator-controller/pull/792)
* [Full changelog](https://github.com/openshift/operator-framework-operator-controller/compare/19afc52f9d237c9cf1a2406ec228c363ebe1c677...505480fd1df54cd7408fb7c03d0c78e15300b671)
### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/2926454df7613f5addfff9c8b274337c014a513b)
* [CNTRLPLANE-4583](https://issues.redhat.com/browse/CNTRLPLANE-4583): K8s 1.37 rebase [#692](https://github.com/openshift/openshift-apiserver/pull/692)
* NO-JIRA: route: Use Network Ingress DNS owner aliases [#690](https://github.com/openshift/openshift-apiserver/pull/690)
* [OCPBUGS-108032](https://issues.redhat.com/browse/OCPBUGS-108032): update otel to 1.44.0 to fix CVE-2026-41178 [#684](https://github.com/openshift/openshift-apiserver/pull/684)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/ab0315228cde432c8cd62df012b791a66a72c7b3...2926454df7613f5addfff9c8b274337c014a513b)
### [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager/tree/72964318318f2a65e66b766a288b2241e6a6c51e)
* [CNTRLPLANE-4583](https://issues.redhat.com/browse/CNTRLPLANE-4583): bump(k8s.io): 1.37.1 [#462](https://github.com/openshift/openshift-controller-manager/pull/462)
* [Full changelog](https://github.com/openshift/openshift-controller-manager/compare/5235418de7c86e6fae1004f84e55a2fbc1d3ac1c...72964318318f2a65e66b766a288b2241e6a6c51e)
### [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics/tree/de9762d4058aab05b91e413dc0f700ff9f02431e)
* NO-JIRA: update OWNERS [#140](https://github.com/openshift/openshift-state-metrics/pull/140)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#139](https://github.com/openshift/openshift-state-metrics/pull/139)
* [Full changelog](https://github.com/openshift/openshift-state-metrics/compare/3b4ea3e753d97fea66e0f52c8282a711358b4ff7...de9762d4058aab05b91e413dc0f700ff9f02431e)
### [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack/tree/b6b2c8393370dccb3549cd7485faac290045e258)
* Bump manifests-gen for proxy injection annotation [#452](https://github.com/openshift/cluster-api-provider-openstack/pull/452)
* [OCPBUGS-131040](https://issues.redhat.com/browse/OCPBUGS-131040): Replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 for CVE-2026-33814 [main] [#451](https://github.com/openshift/cluster-api-provider-openstack/pull/451)
* UPSTREAM-SYNC: Re-baseline main onto clean upstream merge to unblock rebasebot [#446](https://github.com/openshift/cluster-api-provider-openstack/pull/446)
* Fix release 0.14 sync: incomplete vendoring in hack/tools [#433](https://github.com/openshift/cluster-api-provider-openstack/pull/433)
* [Full changelog](https://github.com/openshift/cluster-api-provider-openstack/compare/8fcaaaa900a4fd24fd53dab2c7c44c91bbf5a9c6...b6b2c8393370dccb3549cd7485faac290045e258)
### [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack/tree/58a615b1517504c85786ee08163625bcd6a39a22)
* [OSASINFRA-4544](https://issues.redhat.com/browse/OSASINFRA-4544): Bump CAPO to 0.15 and adopt CAPO API v1beta2 [#193](https://github.com/openshift/machine-api-provider-openstack/pull/193)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#187](https://github.com/openshift/machine-api-provider-openstack/pull/187)
* [Full changelog](https://github.com/openshift/machine-api-provider-openstack/compare/6b30092b0a1196b016f4300b79c895f0e7f2e9a8...58a615b1517504c85786ee08163625bcd6a39a22)
### [openstack-resource-controller](https://github.com/openshift/openstack-resource-controller/tree/642037113b21f8b553ae449ed79888afd46cd006)
* UPSTREAM-SYNC: Merge https://github.com/k-orc/openstack-resource-controller:release-2.0 into main [#40](https://github.com/openshift/openstack-resource-controller/pull/40)
* [Full changelog](https://github.com/openshift/openstack-resource-controller/compare/58dbc0482c144c21effee2476947889122a518eb...642037113b21f8b553ae449ed79888afd46cd006)
### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/6726ed5dc88b02262fca4a2242387df51d6da18b)
* [OPRUN-4828](https://issues.redhat.com/browse/OPRUN-4828): Update OLMv0 test extension to Kubernetes 1.37 [#1397](https://github.com/openshift/operator-framework-olm/pull/1397)
* NO-ISSUE: Synchronize From Upstream Repositories [#1398](https://github.com/openshift/operator-framework-olm/pull/1398)
* [OPRUN-4798](https://issues.redhat.com/browse/OPRUN-4798): synchronize OLMv0 TLS curves and update package-server manager [#1394](https://github.com/openshift/operator-framework-olm/pull/1394)
* [OPRUN-4798](https://issues.redhat.com/browse/OPRUN-4798): Synchronize From Upstream Repositories [#1377](https://github.com/openshift/operator-framework-olm/pull/1377)
* [OCPBUGS-126127](https://issues.redhat.com/browse/OCPBUGS-126127): test: bump test extension gRPC to v1.83.2 [#1382](https://github.com/openshift/operator-framework-olm/pull/1382)
* NO-ISSUE: add per-scenario PSA compliance audit [#1374](https://github.com/openshift/operator-framework-olm/pull/1374)
* NO-ISSUE: Synchronize From Upstream Repositories [#1361](https://github.com/openshift/operator-framework-olm/pull/1361)
* [OCPBUGS-122255](https://issues.redhat.com/browse/OCPBUGS-122255): tests-extension: fix PolarionID:68521 and Polarion:27680 [#1376](https://github.com/openshift/operator-framework-olm/pull/1376)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/cfe91e367d56b3bd96331942e3c7c7d434fd9c0d...6726ed5dc88b02262fca4a2242387df51d6da18b)
### [operator-marketplace](https://github.com/operator-framework/operator-marketplace/tree/5a7d0ade6d5fae66fca8b5d376f89037a914b499)
* NO-ISSUE: Bump github.com/onsi/gomega from 1.43.1 to 1.44.0 [#797](https://github.com/operator-framework/operator-marketplace/pull/797)
* NO-ISSUE: Bump github.com/onsi/gomega from 1.43.0 to 1.43.1 [#795](https://github.com/operator-framework/operator-marketplace/pull/795)
* NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.32.2 to 2.33.0 [#796](https://github.com/operator-framework/operator-marketplace/pull/796)
* NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.32.1 to 2.32.2 [#794](https://github.com/operator-framework/operator-marketplace/pull/794)
* NO-ISSUE: Bump github.com/onsi/gomega from 1.42.1 to 1.43.0 [#781](https://github.com/operator-framework/operator-marketplace/pull/781)
* NO-ISSUE: Bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 [#779](https://github.com/operator-framework/operator-marketplace/pull/779)
* NO-ISSUE: Bump github.com/stretchr/testify from 1.12.0 to 1.12.1 [#777](https://github.com/operator-framework/operator-marketplace/pull/777)
* [Full changelog](https://github.com/operator-framework/operator-marketplace/compare/f421eb0250c49687b08ea405e64fdbbb5509a9b7...5a7d0ade6d5fae66fca8b5d376f89037a914b499)
### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/a6dca1bb5cbd5014ca1dccf90fc87c3e438d7e04)
* [CORENET-6748](https://issues.redhat.com/browse/CORENET-6748): OTE: Enable EgressFirewall tests [#3433](https://github.com/openshift/ovn-kubernetes/pull/3433)
* NO-JIRA: DownStream Merge [10-28-2026] [#3581](https://github.com/openshift/ovn-kubernetes/pull/3581)
* [OCPBUGS-127208](https://issues.redhat.com/browse/OCPBUGS-127208): DownStream Merge [10-22-2026] [#3572](https://github.com/openshift/ovn-kubernetes/pull/3572)
* NO-JIRA: Add arkadeepsen, martinkennelly and pperiyasamy to OWNERS file [#3570](https://github.com/openshift/ovn-kubernetes/pull/3570)
* [CORENET-6746](https://issues.redhat.com/browse/CORENET-6746): Enable EgressIP E2E tests on baremetal, AWS, Azure and GCP for OTE [#3227](https://github.com/openshift/ovn-kubernetes/pull/3227)
* [NO-JIRA: DownStream Merge [10-19-2026] [#3561](https://github.com/openshift/ovn-kubernetes/pull/3561)
* [OCPBUGS-120087](https://issues.redhat.com/browse/OCPBUGS-120087), [OCPBUGS-123556](https://issues.redhat.com/browse/OCPBUGS-123556), [OCPBUGS-128278](https://issues.redhat.com/browse/OCPBUGS-128278): DownStream Merge [10-14-2026] [#3543](https://github.com/openshift/ovn-kubernetes/pull/3543)
* [OCPBUGS-128662](https://issues.redhat.com/browse/OCPBUGS-128662): DownStream Merge [10-08-2026] [#3517](https://github.com/openshift/ovn-kubernetes/pull/3517)
* NO-JIRA: DownStream Merge [09-28-2026] [#3479](https://github.com/openshift/ovn-kubernetes/pull/3479)
* [CORENET-7596](https://issues.redhat.com/browse/CORENET-7596), [OCPBUGS-123678](https://issues.redhat.com/browse/OCPBUGS-123678): DownStream Merge [09-23-2026] [#3473](https://github.com/openshift/ovn-kubernetes/pull/3473)
* [CORENET-7572](https://issues.redhat.com/browse/CORENET-7572): DownStream Merge [09-21-2026] [#3465](https://github.com/openshift/ovn-kubernetes/pull/3465)
* [CORENET-7562](https://issues.redhat.com/browse/CORENET-7562), [OCPBUGS-98726](https://issues.redhat.com/browse/OCPBUGS-98726), [OCPBUGS-99645](https://issues.redhat.com/browse/OCPBUGS-99645): DownStream Merge [09-11-2026] [#3439](https://github.com/openshift/ovn-kubernetes/pull/3439)
* [OCPBUGS-112563](https://issues.redhat.com/browse/OCPBUGS-112563), [OCPBUGS-99451](https://issues.redhat.com/browse/OCPBUGS-99451): DownStream Merge [08-31-2026] [#3434](https://github.com/openshift/ovn-kubernetes/pull/3434)
* [CORENET-7467](https://issues.redhat.com/browse/CORENET-7467): run OTE tests only in ovn-kubernetes conformance suites [#3416](https://github.com/openshift/ovn-kubernetes/pull/3416)
* [OCPBUGS-112470](https://issues.redhat.com/browse/OCPBUGS-112470): Register test images using tests extension [#3363](https://github.com/openshift/ovn-kubernetes/pull/3363)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/2f9add8106687de6dba052689b97a189f92439f9...a6dca1bb5cbd5014ca1dccf90fc87c3e438d7e04)
### [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/tree/c130d47e0bbc870188f1d8995d7ae2fa3f63e337)
* [STOR-3176](https://issues.redhat.com/browse/STOR-3176): Support TLS Groups in operators for kube-rbac-proxy sidecar [#130](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/130)
* [STOR-3068](https://issues.redhat.com/browse/STOR-3068): Bump all libraries [#127](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/127)
* [OCPBUGS-127462](https://issues.redhat.com/browse/OCPBUGS-127462): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#124](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/124)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/compare/f90431bfe8ca93850450b2b24fae152d2385ca08...c130d47e0bbc870188f1d8995d7ae2fa3f63e337)
### [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs/tree/a663b6d1d212ad36cb7454a5e46b37b84fe35cd7)
* [OCPCLOUD-3723](https://issues.redhat.com/browse/OCPCLOUD-3723): Merge https://github.com/IBM-Cloud/cloud-provider-ibm:01595b6d497cc6ec6f807bd7136ac43d147ea042 (01595b6) into main [#124](https://github.com/openshift/cloud-provider-powervs/pull/124)
* No-Jira: Update packages in go.mod [#125](https://github.com/openshift/cloud-provider-powervs/pull/125)
* No-Jira: Update packages in go.mod [#114](https://github.com/openshift/cloud-provider-powervs/pull/114)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#109](https://github.com/openshift/cloud-provider-powervs/pull/109)
* No-Jira: Update packages in go.mod [#108](https://github.com/openshift/cloud-provider-powervs/pull/108)
* [Full changelog](https://github.com/openshift/cloud-provider-powervs/compare/18eb5238fb2c86632edb24175f536d815f28ddf6...a663b6d1d212ad36cb7454a5e46b37b84fe35cd7)
### [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs/tree/f6109c1daa4a14ea2115ef0125130ffd3c4fefbc)
* NO-JIRA: Update OWNERS_ALIASES to modify approvers and reviewers [#145](https://github.com/openshift/machine-api-provider-powervs/pull/145)
* [OCPCLOUD-3665](https://issues.redhat.com/browse/OCPCLOUD-3665): bump Kubernetes dependencies to 1.37 [#152](https://github.com/openshift/machine-api-provider-powervs/pull/152)
* [OCPBUGS-127383](https://issues.redhat.com/browse/OCPBUGS-127383): Bump x/net and opentelemetry to address CVEs [#150](https://github.com/openshift/machine-api-provider-powervs/pull/150)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#147](https://github.com/openshift/machine-api-provider-powervs/pull/147)
* [OCPBUGS-112023](https://issues.redhat.com/browse/OCPBUGS-112023): Update dependencies to k8s 1.36 [#146](https://github.com/openshift/machine-api-provider-powervs/pull/146)
* [Full changelog](https://github.com/openshift/machine-api-provider-powervs/compare/e88cf81dd9ad174f395b86f9cdc40fa30cb06bf4...f6109c1daa4a14ea2115ef0125130ffd3c4fefbc)
### [prom-label-proxy](https://github.com/openshift/prom-label-proxy/tree/769aeb6a1dda2d71c5e91ea6cbb8d5f510821135)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#401](https://github.com/openshift/prom-label-proxy/pull/401)
* NO-ISSUE: [bot] Bump openshift/prom-label-proxy to v0.15.1 [#399](https://github.com/openshift/prom-label-proxy/pull/399)
* [Full changelog](https://github.com/openshift/prom-label-proxy/compare/4ab9ff73c665319352288fe0b9b9e1df71832525...769aeb6a1dda2d71c5e91ea6cbb8d5f510821135)
### [prometheus](https://github.com/openshift/prometheus/tree/5ee7c34ddf532bacdac39ced4c61a54ab1e2cd66)
* NO-ISSUE: [bot] Bump openshift/prometheus to v3.15.1 [#405](https://github.com/openshift/prometheus/pull/405)
* NO-ISSUE: [bot] Bump openshift/prometheus to v3.15.0 [#399](https://github.com/openshift/prometheus/pull/399)
* NO-JIRA: update OWNERS [#379](https://github.com/openshift/prometheus/pull/379)
* NO-JIRA: [bot] Bump openshift/prometheus to v3.14.0 [#363](https://github.com/openshift/prometheus/pull/363)
* NO-ISSUE: [bot] Bump openshift/prometheus to v3.14.0 [#361](https://github.com/openshift/prometheus/pull/361)
* [Full changelog](https://github.com/openshift/prometheus/compare/01d8335673aa6f88f5742ef510e133efee88a7bf...5ee7c34ddf532bacdac39ced4c61a54ab1e2cd66)
### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/f126069d12d76009293a0e1668a5c00425d5d926)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#186](https://github.com/openshift/prometheus-alertmanager/pull/186)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#175](https://github.com/openshift/prometheus-alertmanager/pull/175)
* Bump openshift/prometheus-alertmanager to v0.34.1 [#177](https://github.com/openshift/prometheus-alertmanager/pull/177)
* Bump openshift/prometheus-alertmanager to v0.34.0 [#168](https://github.com/openshift/prometheus-alertmanager/pull/168)
* NO-ISSUE: Remove unused upstream .github/workflows [#167](https://github.com/openshift/prometheus-alertmanager/pull/167)
* [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/89bdff8b5b885e4a3d0f7d0327fe39221f3d2dce...f126069d12d76009293a0e1668a5c00425d5d926)
### [prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator/tree/db2005715d9dda659f69d5dabf244c9a529d7734)
* NO-ISSUE: [bot] Bump openshift/prometheus-operator to v0.94.2 [#423](https://github.com/openshift/prometheus-operator/pull/423)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#405](https://github.com/openshift/prometheus-operator/pull/405)
* [MON-4696](https://issues.redhat.com/browse/MON-4696): Bump openshift/prometheus-operator to v0.94.1 [#403](https://github.com/openshift/prometheus-operator/pull/403)
* [MON-4689](https://issues.redhat.com/browse/MON-4689): Bump openshift/prometheus-operator to v0.94.0 [#400](https://github.com/openshift/prometheus-operator/pull/400)
* NO-ISSUE: [bot] Bump openshift/prometheus-operator to v0.93.1 [#393](https://github.com/openshift/prometheus-operator/pull/393)
* [Full changelog](https://github.com/openshift/prometheus-operator/compare/67895c7c968f42e97efec58f4140fffae4832028...db2005715d9dda659f69d5dabf244c9a529d7734)
### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/41a2ce965e42357f5d1cd71f34498c19eb99932f)
* [OCPBUGS-129592](https://issues.redhat.com/browse/OCPBUGS-129592): Test mountinfo parsing beyond 1 MiB [#217](https://github.com/openshift/node_exporter/pull/217)
* NO-JIRA: Update OWNERS [#199](https://github.com/openshift/node_exporter/pull/199)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#189](https://github.com/openshift/node_exporter/pull/189)
* NO-ISSUE: [bot] Bump openshift/node_exporter to v1.12.1 [#186](https://github.com/openshift/node_exporter/pull/186)
* [Full changelog](https://github.com/openshift/node_exporter/compare/ff8cca07e946d00683527a18203def8b5f8e7380...41a2ce965e42357f5d1cd71f34498c19eb99932f)
### [rhel-coreos, rhel-coreos-10, rhel-coreos-10-extensions](https://github.com/openshift/os/tree/286a9a3722a2544db7e4af7b7f85392c4bc53cf1)
* [COS-4569](https://issues.redhat.com/browse/COS-4569): Add off-layering directory for Nvidia builds [#1979](https://github.com/openshift/os/pull/1979)
* [OCPBUGS-123732](https://issues.redhat.com/browse/OCPBUGS-123732): Re-enable sandboxed-containers extension for 5.0 [#1971](https://github.com/openshift/os/pull/1971)
* NO-JIRA: Update to track 5.1 [#1964](https://github.com/openshift/os/pull/1964)
* [Full changelog](https://github.com/openshift/os/compare/d2f3751e77c4b79b1553d18758c2ea91f06f51fc...286a9a3722a2544db7e4af7b7f85392c4bc53cf1)
### [rhel-coreos-extensions](https://github.com/openshift/os/tree/62965e8043270be3ae4b4568f6f6475ed1804973)
* [OCPBUGS-123732](https://issues.redhat.com/browse/OCPBUGS-123732): Re-enable sandboxed-containers extension for 5.0 [#1971](https://github.com/openshift/os/pull/1971)
* NO-JIRA: Update to track 5.1 [#1964](https://github.com/openshift/os/pull/1964)
* [Full changelog](https://github.com/openshift/os/compare/d2f3751e77c4b79b1553d18758c2ea91f06f51fc...62965e8043270be3ae4b4568f6f6475ed1804973)
### [route-controller-manager](https://github.com/openshift/route-controller-manager/tree/a158fff7ce3826058bd2d7338b206cdd600d0d40)
* [OCPBUGS-104856](https://issues.redhat.com/browse/OCPBUGS-104856): clear unmanaged-route metric when the route is removed [#102](https://github.com/openshift/route-controller-manager/pull/102)
* [Full changelog](https://github.com/openshift/route-controller-manager/compare/59697cf7af4517dd44e28179a57f7f35b6ea0e22...a158fff7ce3826058bd2d7338b206cdd600d0d40)
### [telemeter](https://github.com/openshift/telemeter/tree/c1db3dc4233dc50dded21357182390188e0fc78e)
* NO-JIRA: split rule tests by recording rule [#630](https://github.com/openshift/telemeter/pull/630)
* NO-JIRA: format Telemeter rule expressions [#628](https://github.com/openshift/telemeter/pull/628)
* NO-ISSUE: tidy up tools/go.mod [#617](https://github.com/openshift/telemeter/pull/617)
* [OCPBUGS-122075](https://issues.redhat.com/browse/OCPBUGS-122075): don't log authorization header [#614](https://github.com/openshift/telemeter/pull/614)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#622](https://github.com/openshift/telemeter/pull/622)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Remove generated Telemeter tools vendor tree [#618](https://github.com/openshift/telemeter/pull/618)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#615](https://github.com/openshift/telemeter/pull/615)
* [OCPBUGS-115550](https://issues.redhat.com/browse/OCPBUGS-115550): Add 'agent-installer-postconfig' install_type [#616](https://github.com/openshift/telemeter/pull/616)
* [Full changelog](https://github.com/openshift/telemeter/compare/a47a32bd9e52b1c86a4e1eaeb9d55f7956b6a583...c1db3dc4233dc50dded21357182390188e0fc78e)
### [tests](https://github.com/openshift/origin/tree/895e3d93a081321bd4adbecb3c2c0ec65b8c1cca)
* NO-ISSUE: Automated - Update synthetic test data [#31828](https://github.com/openshift/origin/pull/31828)
* [TRT-3011](https://issues.redhat.com/browse/TRT-3011): Wait for OAuth server rollouts in component proxy tests [#31779](https://github.com/openshift/origin/pull/31779)
* [OCPBUGS-119673](https://issues.redhat.com/browse/OCPBUGS-119673), [OCPEDGE-2819](https://issues.redhat.com/browse/OCPEDGE-2819): Update TNF credential rotation test [#31611](https://github.com/openshift/origin/pull/31611)
* [OCPCLOUD-3330](https://issues.redhat.com/browse/OCPCLOUD-3330): Create test/shared module initially containing reusable fake cincinnati server [#31804](https://github.com/openshift/origin/pull/31804)
* [CORENET-6512](https://issues.redhat.com/browse/CORENET-6512): Add CNO test extension binary [#31218](https://github.com/openshift/origin/pull/31218)
* [OCPBUGS-133466](https://issues.redhat.com/browse/OCPBUGS-133466): allow DaemonSet SuccessfulCreate pathological events [#31810](https://github.com/openshift/origin/pull/31810)
* [AGENT-1654](https://issues.redhat.com/browse/AGENT-1654): Add IRI deletion test [#31757](https://github.com/openshift/origin/pull/31757)
* NO-JIRA: singleton-placement-collector: collect on single node and two node clusters [#31815](https://github.com/openshift/origin/pull/31815)
* [TRT-3049](https://issues.redhat.com/browse/TRT-3049): Align NetObserv timeout test with CNO status contract [#31814](https://github.com/openshift/origin/pull/31814)
* NO-JIRA: Add ANP/BANP Ready-In-Zone status cleanup e2e [#31593](https://github.com/openshift/origin/pull/31593)
* [NE-2922](https://issues.redhat.com/browse/NE-2922): Migrate operator Ingress management-mode tests to v1 [#31807](https://github.com/openshift/origin/pull/31807)
* [OCPBUGS-82190](https://issues.redhat.com/browse/OCPBUGS-82190): Remove etcd preDrain hook strip workaround from node replacement test [#31149](https://github.com/openshift/origin/pull/31149)
* [CNTRLPLANE-2157](https://issues.redhat.com/browse/CNTRLPLANE-2157): Migrate test cases of KubeAPI server functionality to OTE [#31697](https://github.com/openshift/origin/pull/31697)
* NO-JIRA: Improve etcd-scaling job reliability by removing checks that don't apply to control plane replacement [#31797](https://github.com/openshift/origin/pull/31797)
* [OCPBUGS-131892](https://issues.redhat.com/browse/OCPBUGS-131892): add memory thrashing and CPU saturation intervals [#31766](https://github.com/openshift/origin/pull/31766)
* [OCPNODE-4674](https://issues.redhat.com/browse/OCPNODE-4674): Split node long-running tests into openshift/nodes/isolated [#31586](https://github.com/openshift/origin/pull/31586)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Rebase 1.37 [#31721](https://github.com/openshift/origin/pull/31721)
* [OCPSTRAT-3661](https://issues.redhat.com/browse/OCPSTRAT-3661): Add additional rbac escalation monitortest exceptions [#31802](https://github.com/openshift/origin/pull/31802)
* NO-ISSUE: Automated - Update synthetic test data [#31799](https://github.com/openshift/origin/pull/31799)
* [OCPBUGS-130621](https://issues.redhat.com/browse/OCPBUGS-130621): Isolate LDAP group sync test resources [#31730](https://github.com/openshift/origin/pull/31730)
* [OCPBUGS-132757](https://issues.redhat.com/browse/OCPBUGS-132757): Further optimize oc must gather tests to improve efficiency [#31282](https://github.com/openshift/origin/pull/31282)
* NO-JIRA: Fix CPU partitioning test isolation [#31777](https://github.com/openshift/origin/pull/31777)
* NO-JIRA: add host-network-connection-integrity monitor test [#31785](https://github.com/openshift/origin/pull/31785)
* NO-JIRA: cli: accept both error: invalid/Invalid image name casing in oc run tests [#31791](https://github.com/openshift/origin/pull/31791)
* [OCPBUGS-123644](https://issues.redhat.com/browse/OCPBUGS-123644): Allow etcd probe error due to tls config change [#31789](https://github.com/openshift/origin/pull/31789)
* [OCPBUGS-130780](https://issues.redhat.com/browse/OCPBUGS-130780): stop expecting OAuth X-XSS-Protection header [#31788](https://github.com/openshift/origin/pull/31788)
* [OCPBUGS-126709](https://issues.redhat.com/browse/OCPBUGS-126709): Allow VirtPlatformDependencyMissing alert [#31787](https://github.com/openshift/origin/pull/31787)
* [OCPBUGS-131892](https://issues.redhat.com/browse/OCPBUGS-131892): add singleton-placement-collector monitor test [#31768](https://github.com/openshift/origin/pull/31768)
* NO-JIRA: Support reusable devcontainer setup and optional OpenCode [#31775](https://github.com/openshift/origin/pull/31775)
* [OCPEDGE-3027](https://issues.redhat.com/browse/OCPEDGE-3027): add TNF metrics e2e coverage [#31663](https://github.com/openshift/origin/pull/31663)
* [OCPBUGS-132363](https://issues.redhat.com/browse/OCPBUGS-132363): Allow prometheus test pods to access NTO metrics port [#31781](https://github.com/openshift/origin/pull/31781)
* [TRT-3011](https://issues.redhat.com/browse/TRT-3011): Include noProxy login test in OAuth scaling event exception [#31780](https://github.com/openshift/origin/pull/31780)
* [OCPBUGS-132202](https://issues.redhat.com/browse/OCPBUGS-132202): request only supported IP families in kubevirt VM network data [#31770](https://github.com/openshift/origin/pull/31770)
* [MCO-2626](https://issues.redhat.com/browse/MCO-2626): Remove MCN's node create and delete test [#31771](https://github.com/openshift/origin/pull/31771)
* [CNTRLPLANE-3481](https://issues.redhat.com/browse/CNTRLPLANE-3481): (Testing/Functional) Sourcing claims from multiple sources works as expected [#31712](https://github.com/openshift/origin/pull/31712)
* [NE-2816](https://issues.redhat.com/browse/NE-2816): Apply HAProxy sidecar on router e2e tests [#31589](https://github.com/openshift/origin/pull/31589)
* [OCPBUGS-129429](https://issues.redhat.com/browse/OCPBUGS-129429): Soften PHC offline assertions [#31717](https://github.com/openshift/origin/pull/31717)
* [NETOBSERV-2563](https://issues.redhat.com/browse/NETOBSERV-2563): skip network observability e2e tests in disconnected env [#31767](https://github.com/openshift/origin/pull/31767)
* [TRT-3011](https://issues.redhat.com/browse/TRT-3011): Increase AuthenticationComponentProxy scaling event allowance to 70 [#31754](https://github.com/openshift/origin/pull/31754)
* NO-JIRA: omit skipped tests from high_cpu_e2e_tests autodl data [#31759](https://github.com/openshift/origin/pull/31759)
* [TRT-3020](https://issues.redhat.com/browse/TRT-3020): Report audit request violations as flakes [#31756](https://github.com/openshift/origin/pull/31756)
* NO-JIRA: Remove exception OCPBUGS-85677 [#31734](https://github.com/openshift/origin/pull/31734)
* [OCPQUAL-55](https://issues.redhat.com/browse/OCPQUAL-55): remove static.redhat.com disruption monitor [#31685](https://github.com/openshift/origin/pull/31685)
* [OCPBUGS-129376](https://issues.redhat.com/browse/OCPBUGS-129376): Azure dual-stack load balancers should expose public and internal services over IPv4 and IPv6 [#31716](https://github.com/openshift/origin/pull/31716)
* [OCPNODE-4776](https://issues.redhat.com/browse/OCPNODE-4776): Add Kerberos authentication test plan for OCP 5.1 [#31704](https://github.com/openshift/origin/pull/31704)
* [NETOBSERV-2563](https://issues.redhat.com/browse/NETOBSERV-2563): Add network observability e2e tests [#31342](https://github.com/openshift/origin/pull/31342)
* [OCPEDGE-2985](https://issues.redhat.com/browse/OCPEDGE-2985): Assert PacemakerFencingEvent after real fencing [#31703](https://github.com/openshift/origin/pull/31703)
* [NE-2913](https://issues.redhat.com/browse/NE-2913): Update deprecated HAProxy versions in upgrade test [#31701](https://github.com/openshift/origin/pull/31701)
* [OCPBUGS-130621](https://issues.redhat.com/browse/OCPBUGS-130621): Clean up component proxy login resources [#31729](https://github.com/openshift/origin/pull/31729)
* [OCPBUGS-86789](https://issues.redhat.com/browse/OCPBUGS-86789): Revert "Make early request monitor test informing" [#31590](https://github.com/openshift/origin/pull/31590)
* [OCPBUGS-86789](https://issues.redhat.com/browse/OCPBUGS-86789): Move external ip policy test to disruptive-longrunning [#31638](https://github.com/openshift/origin/pull/31638)
* NO-ISSUE: Automated - Update synthetic test data [#31698](https://github.com/openshift/origin/pull/31698)
* [OCPBUGS-123649](https://issues.redhat.com/browse/OCPBUGS-123649): allow v1beta2 DRA API in discovery test [#31566](https://github.com/openshift/origin/pull/31566)
* [OCPBUGS-129615](https://issues.redhat.com/browse/OCPBUGS-129615): Allow Prometheus auth test to reach console metrics [#31723](https://github.com/openshift/origin/pull/31723)
* NO-JIRA: Document shrink-only retry allowlist policy [#31710](https://github.com/openshift/origin/pull/31710)
* [OCPBUGS-129175](https://issues.redhat.com/browse/OCPBUGS-129175): Handle offline or removed nodes in TNF replacement test [#31708](https://github.com/openshift/origin/pull/31708)
* NO-JIRA: Add cluster-machine-approver OTE suite [#31706](https://github.com/openshift/origin/pull/31706)
* [OCPBUGS-129012](https://issues.redhat.com/browse/OCPBUGS-129012): Parallel SSA ClusterOperator test races with sig-arch operator version check [#31699](https://github.com/openshift/origin/pull/31699)
* NO-ISSUE: Revert "Add CustomResourcePublishOpenAPI conformance test to retry allowlist" [#31694](https://github.com/openshift/origin/pull/31694)
* [OCPQUAL-42](https://issues.redhat.com/browse/OCPQUAL-42): Refresh retry allowlist against 5.0 and 5.1 CI data [#31551](https://github.com/openshift/origin/pull/31551)
* [CNTRLPLANE-3483](https://issues.redhat.com/browse/CNTRLPLANE-3483): Add e2e test Hot reloading changes of the external OIDC configuration [#31678](https://github.com/openshift/origin/pull/31678)
* [OCPBUGS-122386](https://issues.redhat.com/browse/OCPBUGS-122386): e2e-analysis: add --skip-readiness-checks flag for degraded cluster lanes [#31635](https://github.com/openshift/origin/pull/31635)
* NO-ISSUE: Automated - Update synthetic test data [#31682](https://github.com/openshift/origin/pull/31682)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Mirror glibc-dns-testing 2.0.0 for the k8s 1.37 rebase(revert in rebase PR) [#31683](https://github.com/openshift/origin/pull/31683)
* [INTEROP-9204](https://issues.redhat.com/browse/INTEROP-9204): Add --extension-local-binaries flag for local extension binary loading [#31652](https://github.com/openshift/origin/pull/31652)
* trt-2972: use matcher details [#31676](https://github.com/openshift/origin/pull/31676)
* [OCPBUGS-128397](https://issues.redhat.com/browse/OCPBUGS-128397): Skip router verbosity rollout for degraded TNF tests [#31680](https://github.com/openshift/origin/pull/31680)
* [OPCT-460](https://issues.redhat.com/browse/OPCT-460): Increase timeout for external IP policy test to accommodate in-cluster rollouts [#31636](https://github.com/openshift/origin/pull/31636)
* NO-JIRA: Up threshold for mass dns disruption to fail a test based on real world observations [#31674](https://github.com/openshift/origin/pull/31674)
* [CNTRLPLANE-3851](https://issues.redhat.com/browse/CNTRLPLANE-3851): Oauth server proxy config e2e [#31463](https://github.com/openshift/origin/pull/31463)
* [CNTRLPLANE-3474](https://issues.redhat.com/browse/CNTRLPLANE-3474): Add tests for external claims source featuregate [#31591](https://github.com/openshift/origin/pull/31591)
* [OCPBUGS-127184](https://issues.redhat.com/browse/OCPBUGS-127184): Redact OAuth tokens from test cleanup logs [#31640](https://github.com/openshift/origin/pull/31640)
* [STOR-3090](https://issues.redhat.com/browse/STOR-3090): Add CSI storage test for pod delete after host umount of mounted volume [#31488](https://github.com/openshift/origin/pull/31488)
* [OCPBUGS-111056](https://issues.redhat.com/browse/OCPBUGS-111056): Make operator log scraper and monitor tests topology-aware [#31597](https://github.com/openshift/origin/pull/31597)
* [CNTRLPLANE-4303](https://issues.redhat.com/browse/CNTRLPLANE-4303): Add threshold for ote encryption cases [#31658](https://github.com/openshift/origin/pull/31658)
* [OCPBUGS-112722](https://issues.redhat.com/browse/OCPBUGS-112722): make webhook build resolution wait phase-independent [#31655](https://github.com/openshift/origin/pull/31655)
* [OCPBUGS-121385](https://issues.redhat.com/browse/OCPBUGS-121385): Resolve Additional Storage agnhost image through mirror [#31618](https://github.com/openshift/origin/pull/31618)
* [NE-2750](https://issues.redhat.com/browse/NE-2750): implement feature test for GatewayAPIManagementMode [#31503](https://github.com/openshift/origin/pull/31503)
* [OCPEDGE-3076](https://issues.redhat.com/browse/OCPEDGE-3076): Fix TNF kubelet disruption test race condition [#31650](https://github.com/openshift/origin/pull/31650)
* [OCPSTRAT-3661](https://issues.redhat.com/browse/OCPSTRAT-3661): Always emit passing cases for found issues in RBAC monitor test [#31639](https://github.com/openshift/origin/pull/31639)
* NO-ISSUE: Automated - Update synthetic test data [#31607](https://github.com/openshift/origin/pull/31607)
* NO-JIRA: Add a new test for mass DNS disruption [#31625](https://github.com/openshift/origin/pull/31625)
* [OCPBUGS-114022](https://issues.redhat.com/browse/OCPBUGS-114022): Avoid polling skipped Prometheus target namespaces [#31563](https://github.com/openshift/origin/pull/31563)
* [TRT-2830](https://issues.redhat.com/browse/TRT-2830): add REVIEW.md for agentic review responses [#31637](https://github.com/openshift/origin/pull/31637)
* [OCPSTRAT-3661](https://issues.redhat.com/browse/OCPSTRAT-3661): Add Sippy discovered exceptions for RBAC monitor test [#31616](https://github.com/openshift/origin/pull/31616)
* [OCPBUGS-104846](https://issues.redhat.com/browse/OCPBUGS-104846): Filter both [FeatureGate:] and [OCPFeatureGate:] [#31623](https://github.com/openshift/origin/pull/31623)
* [OCPBUGS-121384](https://issues.redhat.com/browse/OCPBUGS-121384): Isolate KubeletEnsureSecretPulledImages test setup [#31619](https://github.com/openshift/origin/pull/31619)
* [OKD-454](https://issues.redhat.com/browse/OKD-454): Skip OKD job name check for cluster-bot launch jobs [#31628](https://github.com/openshift/origin/pull/31628)
* [OCPBUGS-92837](https://issues.redhat.com/browse/OCPBUGS-92837): test/router: wait for all per-route metrics before asserting [#31344](https://github.com/openshift/origin/pull/31344)
* [CORENET-6746](https://issues.redhat.com/browse/CORENET-6746): Allow EgressIP NoMatchingNodeFound events to repeat pathologically [#31614](https://github.com/openshift/origin/pull/31614)
* [OCPBUGS-86789](https://issues.redhat.com/browse/OCPBUGS-86789): Bump network config timeout to 25 minutes [#31599](https://github.com/openshift/origin/pull/31599)
* [CNTRLPLANE-3789](https://issues.redhat.com/browse/CNTRLPLANE-3789): Add e2e tests for authentication component proxy [#31446](https://github.com/openshift/origin/pull/31446)
* [OCPBUGS-84250](https://issues.redhat.com/browse/OCPBUGS-84250): Increase router verbosity in DCM tests [#31555](https://github.com/openshift/origin/pull/31555)
* NO-JIRA: test: poll final EgressFirewall DNS deny assertion [#31473](https://github.com/openshift/origin/pull/31473)
* [OCPBUGS-66213](https://issues.redhat.com/browse/OCPBUGS-66213): add link to jira card [#31609](https://github.com/openshift/origin/pull/31609)
* [NE-2839](https://issues.redhat.com/browse/NE-2839): Add HAProxy version upgrade tests [#31602](https://github.com/openshift/origin/pull/31602)
* [CORENET-7243](https://issues.redhat.com/browse/CORENET-7243): Add TLS Profile Compliance tests for networking components [#31500](https://github.com/openshift/origin/pull/31500)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Fix check in auth test for 1.37 given new NamedAuthorizer behavior [#31574](https://github.com/openshift/origin/pull/31574)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Update etcd test data for k8s 1.37 release [#31605](https://github.com/openshift/origin/pull/31605)
* [METAL-1833](https://issues.redhat.com/browse/METAL-1833): Register cluster-baremetal-tests-ext in extension registry [#31197](https://github.com/openshift/origin/pull/31197)
* [OCPSTRAT-3661](https://issues.redhat.com/browse/OCPSTRAT-3661): Add monitortest to verify possible Cluster Admin escalation paths [#31536](https://github.com/openshift/origin/pull/31536)
* [OCPBUGS-66213](https://issues.redhat.com/browse/OCPBUGS-66213): image registry single replica exceptions [#31544](https://github.com/openshift/origin/pull/31544)
* [OCPBUGS-111997](https://issues.redhat.com/browse/OCPBUGS-111997): Add Degraded=True exception for authentication operator during upgrade [#31535](https://github.com/openshift/origin/pull/31535)
* [TRT-2939](https://issues.redhat.com/browse/TRT-2939): Revert "Merge pull request #31495 from jcmoraisjr/NE-2839-haproxy-version-upgrade-tests" [#31598](https://github.com/openshift/origin/pull/31598)
* [OCPBUGS-77283](https://issues.redhat.com/browse/OCPBUGS-77283): bump kubevirt fedora containerDisk to multi-arch v1.8.2 + permanent exception [#31284](https://github.com/openshift/origin/pull/31284)
* [OCPBUGS-112662](https://issues.redhat.com/browse/OCPBUGS-112662): Fix the number of requests in repeated exec [#31548](https://github.com/openshift/origin/pull/31548)
* [OCPBUGS-115153](https://issues.redhat.com/browse/OCPBUGS-115153): Make extension test-binary extraction architecture-aware [#31579](https://github.com/openshift/origin/pull/31579)
* NO-ISSUE: Automated - Update synthetic test data [#31581](https://github.com/openshift/origin/pull/31581)
* [NE-2839](https://issues.redhat.com/browse/NE-2839): Add HAProxy version upgrade tests [#31495](https://github.com/openshift/origin/pull/31495)
* [OCPBUGS-111643](https://issues.redhat.com/browse/OCPBUGS-111643): Fixed Flakiness of Webhook test - ClusterResourceQuota validation [#31531](https://github.com/openshift/origin/pull/31531)
* And 4 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/origin/compare/42b963ac884b41db0af70e2dcfc78b17d262b496...895e3d93a081321bd4adbecb3c2c0ec65b8c1cca)
### [thanos](https://github.com/openshift/thanos/tree/f751e5877230a36bd9d44132aa2b9864b5e12e40)
* NO-JIRA: [bot] Bump openshift/thanos to v0.42.5 [#233](https://github.com/openshift/thanos/pull/233)
* [OCPBUGS-129064](https://issues.redhat.com/browse/OCPBUGS-129064): Bump github.com/klauspost/compress to fix CVE-2026-63209 [#227](https://github.com/openshift/thanos/pull/227)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#215](https://github.com/openshift/thanos/pull/215)
* Bump openshift/thanos to v0.42.4 [#203](https://github.com/openshift/thanos/pull/203)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#206](https://github.com/openshift/thanos/pull/206)
* [OCPBUGS-120744](https://issues.redhat.com/browse/OCPBUGS-120744): bump go.opentelemetry.io/otel to fix CVE-2026-41178 [#204](https://github.com/openshift/thanos/pull/204)
* [Full changelog](https://github.com/openshift/thanos/compare/75fa632b483716e53aec19f6adf7d4c4652a4453...f751e5877230a36bd9d44132aa2b9864b5e12e40)
### [volume-data-source-validator](https://github.com/openshift/volume-data-source-validator/tree/3ac9e351c97a083eb89ae3f8d695df0af138efc0)
* [STOR-3071](https://issues.redhat.com/browse/STOR-3071): Rebase to v1.8.0 for OCP 5.1 [#22](https://github.com/openshift/volume-data-source-validator/pull/22)
* NO-JIRA: Add coderabbit config [#23](https://github.com/openshift/volume-data-source-validator/pull/23)
* [OCPBUGS-127004](https://issues.redhat.com/browse/OCPBUGS-127004): Bump golang.org/x/net to version 0.57.0 that fixes CVE-2026-33814 [#17](https://github.com/openshift/volume-data-source-validator/pull/17)
* [Full changelog](https://github.com/openshift/volume-data-source-validator/compare/ee9cd7aba4e096a9a957386ef20777e8950df352...3ac9e351c97a083eb89ae3f8d695df0af138efc0)
### [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere/tree/103974bfb3aa79c162c739af91c40ea5a0660700)
* [OCPCLOUD-3680](https://issues.redhat.com/browse/OCPCLOUD-3680): Merge https://github.com/kubernetes/cloud-provider-vsphere/tree/master (cd8a5b0) into main [#130](https://github.com/openshift/cloud-provider-vsphere/pull/130)
* [Full changelog](https://github.com/openshift/cloud-provider-vsphere/compare/eb29de194594bad8e5bc572102f1008cb26655a7...103974bfb3aa79c162c739af91c40ea5a0660700)
### [vsphere-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-vsphere/tree/c228c0a16a2f1f63aa4ba975e6e728c070b8df7d)
* [OCPCLOUD-3691](https://issues.redhat.com/browse/OCPCLOUD-3691): Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.17.0 (2509b8e) into main [#116](https://github.com/openshift/cluster-api-provider-vsphere/pull/116)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#117](https://github.com/openshift/cluster-api-provider-vsphere/pull/117)
* [Full changelog](https://github.com/openshift/cluster-api-provider-vsphere/compare/557fdf1a9a3540d9aa8f3a81e4a950673a416a80...c228c0a16a2f1f63aa4ba975e6e728c070b8df7d)
### [vsphere-csi-driver, vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver/tree/854d56df29ba8b108d7c397e9cb34df317dca13a)
* [OCPBUGS-132044](https://issues.redhat.com/browse/OCPBUGS-132044): Fix build without boringcrypto [#229](https://github.com/openshift/vmware-vsphere-csi-driver/pull/229)
* [STOR-3083](https://issues.redhat.com/browse/STOR-3083): Rebase v3.7.3 [#214](https://github.com/openshift/vmware-vsphere-csi-driver/pull/214)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#200](https://github.com/openshift/vmware-vsphere-csi-driver/pull/200)
* [OCPBUGS-122179](https://issues.redhat.com/browse/OCPBUGS-122179): Fix credential exposure in logs (CWE-532) [#199](https://github.com/openshift/vmware-vsphere-csi-driver/pull/199)
* [OCPBUGS-114884](https://issues.redhat.com/browse/OCPBUGS-114884): UPSTREAM: 4272: Fix crash in syncer when node can't be found [#201](https://github.com/openshift/vmware-vsphere-csi-driver/pull/201)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver/compare/6b18bb29fc45383c21aa6c7513d151e443aa305e...854d56df29ba8b108d7c397e9cb34df317dca13a)
### [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator/tree/639d1baab138ecd7e3adb12c49fd8c7dd4fa6b28)
* [STOR-3176](https://issues.redhat.com/browse/STOR-3176): Support TLS Groups in operators for kube-rbac-proxy sidecar [#373](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/373)
* [STOR-3068](https://issues.redhat.com/browse/STOR-3068): Bump all libraries [#370](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/370)
* [OCPBUGS-127462](https://issues.redhat.com/browse/OCPBUGS-127462): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#367](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/367)
* [OCPBUGS-113538](https://issues.redhat.com/browse/OCPBUGS-113538): Enable SELinuxMount tests [#362](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/362)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver-operator/compare/aa27946700642a9c8e518e130673097b38a2f8bb...639d1baab138ecd7e3adb12c49fd8c7dd4fa6b28)
### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/784de65a26a17fdf276c11401d4659609c3b26af)
* [OCPBUGS-130729](https://issues.redhat.com/browse/OCPBUGS-130729): Skip node checks for non-vSphere nodes [#247](https://github.com/openshift/vsphere-problem-detector/pull/247)
* [STOR-3068](https://issues.redhat.com/browse/STOR-3068): Bump all libraries [#249](https://github.com/openshift/vsphere-problem-detector/pull/249)
* [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/14a2d33817c1ddd1d753cc76decea059376e30c9...784de65a26a17fdf276c11401d4659609c3b26af)