4.13.67

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.13.67-x86_64

Team Approvals:

Accepted
- QE

Tests:

Blocking jobs
- upgrade Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Succeeded (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
Informing jobs
- aws-sdn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.13-e2e-aws-sdn-serial
- aws-sdn-upgrade-4.13-micro Succeeded periodic-ci-openshift-release-main-nightly-4.13-e2e-aws-sdn-upgrade
- azure-ovn-upgrade-4.13-micro Succeeded periodic-ci-openshift-release-main-ci-4.13-e2e-azure-ovn-upgrade
- driver-toolkit Failed (2 retries) periodic-ci-openshift-release-main-nightly-4.13-e2e-aws-driver-toolkit
- fips-scan Succeeded (2 retries) periodic-ci-openshift-release-main-nightly-4.13-fips-payload-scan
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.13-e2e-metal-ipi-ovn-ipv6
- metal-ipi-sdn-bm Succeeded periodic-ci-openshift-release-main-nightly-4.13-e2e-metal-ipi-sdn-bm

Upgrades from:

Untested upgrades: 4.12.19, 4.12.20, 4.12.21, 4.12.22, 4.12.23, 4.12.24, 4.12.25, 4.12.26, 4.12.27, 4.12.28, 4.12.29, 4.12.30, 4.12.31, 4.12.32, 4.12.33, 4.12.34, 4.12.35, 4.12.36, 4.12.37, 4.12.38, 4.12.39, 4.12.40, 4.12.41, 4.12.42, 4.12.43, 4.12.44, 4.12.46, 4.12.47, 4.12.48, 4.12.49, 4.12.50, 4.12.51, 4.12.53, 4.12.54, 4.12.55, 4.12.56, 4.12.57, 4.12.58, 4.12.59, 4.12.60, 4.12.62, 4.12.63, 4.12.65, 4.12.66, 4.12.67, 4.12.68, 4.12.69, 4.12.70, 4.12.71, 4.12.72, 4.12.73, 4.12.74, 4.12.75, 4.12.76, 4.12.77, 4.12.78, 4.12.79, 4.12.80, 4.12.81, 4.12.82, 4.12.83, 4.12.84, 4.12.85, 4.12.86, 4.12.87, 4.13.10, 4.13.11, 4.13.12, 4.13.14, 4.13.16, 4.13.17, 4.13.18, 4.13.19, 4.13.21, 4.13.22, 4.13.23, 4.13.24, 4.13.25, 4.13.27, 4.13.28, 4.13.29, 4.13.3, 4.13.30, 4.13.31, 4.13.32, 4.13.33, 4.13.34, 4.13.35, 4.13.36, 4.13.37, 4.13.38, 4.13.39, 4.13.4, 4.13.40, 4.13.41, 4.13.42, 4.13.43, 4.13.44, 4.13.45, 4.13.46, 4.13.48, 4.13.49, 4.13.5, 4.13.50, 4.13.51, 4.13.52, 4.13.53, 4.13.54, 4.13.55, 4.13.56, 4.13.57, 4.13.58, 4.13.59, 4.13.6, 4.13.60, 4.13.61, 4.13.62, 4.13.63, 4.13.7, 4.13.8, 4.13.9

Upgrades to:

Loading changelog, this may take a while ...

Changes from 4.13.26

Created: 2026-05-29 06:17:46 +0000 UTC

Image Digest: sha256:596514a0fcc2e3110cbcdf2fc57295c2df375f2f0ff36452ff0d7d181ad6c603

Components

Kubernetes upgraded from 1.26.11 to 1.26.15
Red Hat Enterprise Linux CoreOS upgraded from 413.92.202312042340-0 to 413.92.202605271328-0 (diff)

Rebuilt images without code change

alibaba-cloud-csi-driver git 6384f904 sha256:e3c6e35aab5401f48d8e6c867692b4aacbe05a33748fdcbf83840689a39521e6
alibaba-disk-csi-driver-operator git 7e415973 sha256:a6ee3962bb6846e591065bddc2acf914d5048728534747e8dd8cc5c4f5918839
alibaba-machine-controllers git 4c0f96a6 sha256:69c529b75d7ab8c920eb22c86fc400c7b94678808744fdfb56fa31702f309b71
azure-cloud-controller-manager git bf9bd022 sha256:96da7667e39837305b8312e36eb2c2e7ac656f56412c37c53d7ac89ea87ea9cd
azure-cloud-node-manager git bf9bd022 sha256:f88b9694e9747f12e2891b35c065f163e76a8c102ca4f9f49c3429ddd7c570aa
azure-disk-csi-driver git b6d3fbcb sha256:9098ad9d6b5aa177e16a59b9f240b0f63f0a2ed990bde697ea0c31bb96a2d61a
azure-disk-csi-driver-operator git 8534d756 sha256:d736b2a8185b5883af8c2a22efae106fda1e78357287372c3395212a2723f69a
cluster-bootstrap git ee908b6b sha256:b2fc553d9db722fe9f5ec51442dd15959caa154d570b0de0ab9697def8921c11
cluster-kube-cluster-api-operator git 18c076b1 sha256:b941e64c39ba567a4697da3923eed33b2fa2af246afd9262adc1a8fe333c1b9d
cluster-machine-approver git 25fe7b4b sha256:1304f4176ee86758894b6ed7dd43d2afd04187b84839d604af0919db8469f0ce
cluster-platform-operators-manager git 312c5f24 sha256:6a6bb13f64fb62fe0d8bf76d66942a9c4b6908d613ad74433b4fe972f068ac5e
cluster-policy-controller git 3b0d0755 sha256:7b14e612289dbdcba85e806f2a759a5b0fb1f6321c65962723bcca0a715756db
configmap-reloader git 9adad592 sha256:85b35899d4f3526ff97c7c282835d105a6d2c2eae4d20a372d38fec7fb4e9b6f
csi-external-attacher git d9290843 sha256:62822c6d990ebd5efde50e43586054470d7ec7e4a464093e7e0e711c551a4680
csi-external-provisioner git 0bf126b7 sha256:3583e56f86497fda0cedc8100770c6cba3142a2c94d20f46f83ab775558c9644
csi-external-resizer git e8036caf sha256:e1abf62208ec34ee147f3c694a93de05ae28eadb8264b309d3ace146383cea56
csi-livenessprobe git 3587db51 sha256:e28cc55817e48ddbc0fda50e2c8158c41a0a5c0e8ea2129c3cd124dcc4360a90
csi-node-driver-registrar git 9ea90f34 sha256:860a0f7ed30884333716d4d1b722db538af28a82420fc558e998b541323593ad
driver-toolkit git d719bdcf sha256:b35755c010da1f4e77a53f43485156e0d0bd9fff3093a719ba7cc04fb070edbd
gcp-cloud-controller-manager git 507fea98 sha256:0dcd0962c1652b24b2352c521b258d23a99fd0cf5f22bd5c4ddb7612057c3f87
gcp-pd-csi-driver git 81e60746 sha256:f634ae3015d0eb57e9a444bf037dd8d091fcfccd5960a7d35f803eb76a92d635
gcp-pd-csi-driver-operator git 08c561b8 sha256:7ebfca680feabcfb685c45e078efdc676ac3e5cd6e383283841525a25fa5953d
ironic-machine-os-downloader git ce291779 sha256:044acd8a9131f782311f97ca00f84b01634de86794bcf62c14420ab8e1dcbd21
ironic-static-ip-manager git 4536724a sha256:3ed67066d49b06f15a5229712186e103fded0cf818e9d5d4012a26f905fe8081
k8s-prometheus-adapter git 0fce7c7c sha256:9c2b6d23a4a70716be5a1c5fa69e30f5ecdd860527a1587a7bff52ce4ab02e00
kube-state-metrics git fd791df5 sha256:0db42628ef42a5055dd9da995b2e76e9b95e63cfb956c32c8590f5da44abd864
kubevirt-cloud-controller-manager git ee2033ec sha256:ca08bd931714a8a3c79f6cf5eb0067ab88a97f745c46131fd7bb012dc4b6f6ac
kuryr-cni git 36754b7b sha256:231c2b36807d5d68de0454d95c956fee37e482bd15542f05c94cd2e84e31bcc9
kuryr-controller git 36754b7b sha256:a6e03d92e48a96dc15b0383033be842fc7452c8d691702c0c2ea62cc78cf5279
machine-os-content sha256:8b4f07bc3160ae27cab6505faba1b43ba02173efe321fd4ec201fd1e91e390db
multus-networkpolicy git 7176ab75 sha256:5f1308b416df35fe35277a8f7754c8ec2e96759404589c1749ef12923e8dbbb2
multus-route-override-cni git ca3bbec5 sha256:13fc244c3d291f749a9962633eb6357e495c638ea3ed4402f545ec25563c7df1
network-interface-bond-cni git 84bda2af sha256:5968b68bfadd486c0b66e42b4f34a41fa398e3b1a531673ca5746477578581e1
network-tools git 073feda1 sha256:360e784b29fff56c23f83228efbbe63e69eec1649f0e9f53c53c8889aab664dd
oauth-proxy git 44af5a3a sha256:b679952069c45bc53634ad09dcfa4e1080027a8d3b696e9f76d9a50855ed96a3
oauth-server git eb54be28 sha256:0bf610b47e6d50ff1dfd6b0f2a8e964d6d26f4c61119426e8c0289ac43baed72
openshift-state-metrics git 9be421f0 sha256:86ce3cc1bc4a3f6480b533270f6bafb2908bfe62a9e0cc566a03db4a9b021e98
ovirt-csi-driver git 54958deb sha256:987909284b7d6cfc2eb5f5216c68b9d966b844ddd4c99ab24867e9f7ddcdb098
ovirt-machine-controllers git 22d89b3f sha256:d8cf611de61c9a5d1d9d263eee4e864bde6d867be2d70f4f8b84f7293bb535c4
prom-label-proxy git b501d5e2 sha256:05901390865fb765f71cb8e090262bde0108ed23056917ca433d1ae5bdea35c3
prometheus-config-reloader git 30fdccd1 sha256:0d022dbb8d039538b70135565b2b0e2d41261f2968a80d88f9135fe751e9bfb7
prometheus-node-exporter git 59d699ca sha256:5ccd062cb9ba493cab4f0cb308e80fd26385a0cd5a7961f74a68d51b21c45852
prometheus-operator git 30fdccd1 sha256:fea19035811e61e20d6db997a8f41bc3ae2b28a5d8371250bbd8b9263c03f111
prometheus-operator-admission-webhook git 30fdccd1 sha256:d0a23eb16fb3ae471607616c6e5e39e913d99a065bcc7635b1407b73a7c12244
rhel-coreos sha256:6a94b3129f7624ba2c351e7dba4ffdd5a5e008579a74c128ebf3db10cbe98aec
rhel-coreos-extensions sha256:3fc79aea046c9a6b819f3608d328597843ba444231e26eec9600fe243785caaf
route-controller-manager git 6667a6cb sha256:0ffccf7d46e03493058c33451201744fc6f9cc6902fd33db34d2ae2acf5469ef

agent-installer-api-server

MGMT-23439: Bump Go 1.18 to 1.20 and regenerate code #10043
MGMT-23439: Use archived dnf repositories for CentOS Stream 8 #10017
And 7 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-59114: CVE-2024-45339: Bump glog pkg to version 1.2.4 (#1195) #1195
OCPBUGS-53717: Bump jwt to 4.5.2 in release-4.13 (#1094) #1094
Bump golang.org/x/net to 0.33.0 (#1015) #1015
OCPBUGS-13612: Update version go-http-metrics/gin (#935) #935
MGMT-17595: Bump x/net to at least v0.24.0 to mitigate CVE-2023-45288 (#835) #835
MGMT-17588: Bump runc to v1.1.12 to mitigate CVE-2024-21626 (#829) #829
MGMT-17541: Replace broken golangci reference (#826) #826
Full changelog

agent-installer-node-agent

OCPBUGS-67568: Bump logrus v1.9.0 to v1.9.3 #1280
And 7 elided commits (e.g. from squash or rebase merges)
Full changelog

alibaba-cloud-controller-manager

OCPBUGS-21238: Bump golang.org/x/net to v0.19.0 #43
Full changelog

apiserver-network-proxy

OCPBUGS-38066: Revert “Agent: Respect HTTPS_PROXY env vars for proxied connections” #61
OCPBUGS-31984: Bump golang.org/x/net to v0.23.0 #52
Full changelog

aws-cloud-controller-manager

OCPBUGS-32073: update for CVE-2023-45288 [release-4.13] #84
OCPBUGS-27964: bump go.opentelemetry.io #72
Full changelog

aws-cluster-api-controllers

OCPBUGS-78230: [release-4.13] hermetic 4.13 #594
OCPBUGS-32470: UPSTREAM: 4670:Update awsmachine providerID and instanceID immediately after ec2:RunInstances is called #509
Full changelog

aws-ebs-csi-driver

OCPBUGS-33363: [release-4.13] UPSTREAM: 1919: Add reserved-volume-attachments #266
Full changelog

aws-ebs-csi-driver-operator

OCPBUGS-67575: Updated logrus to v1.8.3 #314
OCPBUGS-33363: Explicitly reserve 1 attachment for the root disk #307
Full changelog

aws-machine-controllers

OCPBUGS-24563: Reduce metrics cardinality #96
OCPBUGS-21568: Update golang.org/x/net to v0.17.0 #89
Full changelog

aws-pod-identity-webhook

OCPBUGS-32882: Upgrade go-jose module to 2.6.3 #190
OCPBUGS-21331: Upgrade golang/x/net for CVE-2023-39325 #184
Full changelog

azure-cluster-api-controllers

OCPBUGS-78179: [release-4.13] Hermetic 4.13 #367
OCPBUGS-36022: Update go-retryablehttp to v0.7.7 #314
Full changelog

azure-file-csi-driver

OCPBUGS-41678: bump mount-utils to treat ENODEV error as corrupted mount #81
Full changelog

azure-file-csi-driver-operator

OCPBUGS-67580: Bump github.com/sirupsen/logrus to v1.8.3 #115
Full changelog

azure-machine-controllers

OCPBUGS-78265: hermetic 4.13 #187
OCPBUGS-29906: Don’t create availability set when using spot instances #104
OCPBUGS-24563: Reduce metrics cardinality #89
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-81578: Azure UPI ARM template: use storageAccountId #10454
OCPBUGS-76931: terraform/provider/google: Fixing inconsistencies with the service account creation #10384
OCPBUGS-66232: Replace terraform-provider-google with Openshift fork #10141
OCPBUGS-62848: Release 4.13 bump terraform provider azurerm #10006
OCPBUGS-55034: IBMCloud: Move to IBM TF openshift fork #9668
OCPBUGS-39217: Add yq v4 to ci image #8922
OCPBUGS-36088: [release-4.13]: bump go-retryablehttp for CVE fix #8659
OCPBUGS-29124: IBMCloud: Handle disk delete errors #7989
OCPBUGS-37168: Add yq-v4 to the upi-installer image for CI #8743
OCPBUGS-35976: [release-4.13] bump github.com/containers/image for CVE fix #8651
OCPBUGS-33732: preserve category name when trying to find tag category #8419
OCPBUGS-33062: openstack: Honour worker server group policy #8323
OCPBUGS-32359: Updated libvirt installer to include multi-arch yq and symlink for backwards compatibility #8284
OCPBUGS-22979: IBMCloud: Add eu-es region #7685
OCPBUGS-30629: baremetal: populate customDeploy in advance #8129
OCPBUGS-29627: update RHCOS 4.13 bootimage metadata to 413.92.202402131523-0 #8038
OCPBUGS-30000: [release-4.13] Bump containerd for vulnerability fix #8073
OCPBUGS-28654: Fix depreciated typo #7963
OCPBUGS-27453: baremetal: correct external_http_url for v6-only BMCs #7934
OCPBUGS-23499: update RHCOS 4.13 bootimage metadata to 413.92.202401100947-0 #7920
OCPBUGS-25420: destroy: gcp: fix destroying regional disks #7840
Full changelog

baremetal-machine-controllers

OCPBUGS-78102: [release-4.13] fix vendor/ for hermetic migration #246
OCPBUGS-46640: Bump x/net 0.33.0 #229
OCPBUGS-29822: Extend metal3remediation aggregation role #212
Full changelog

baremetal-operator

OCPBUGS-53334: BMO can expose any secret via BMCEventSubscription CRD 4.13 #411
OCPBUGS-30629: Do not update instance_info and deploy_interface for active nodes #337
Full changelog

baremetal-runtimecfg

OCPBUGS-26929: Add .snyk file to ignore vendor and test files #295
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-30288: oc adm catalog mirror: use ToSlash and FromSlash to unify the path separators #1700
OCPBUGS-25418: Add client version in must-gather summary #1635
OCPBUGS-24461: Overwrite template’s namespace with the explicit one #1617
Full changelog

cloud-credential-operator

OCPBUGS-53419: github.com/golang/glog v1.2.4 #846
OCPBUGS-51546: Ignore SNYK-GOLANG-GOLANGORGXOAUTH2JWS-8749594 due to not being affected #831
OCPBUGS-43340: Update github.com/sirupsen/logrus v1.8.3 #770
OCPBUGS-37834: Resolve SNYK errors in security job. #743
OCPBUGS-37421: SNYK ignore go-client misreporting #740
OCPBUGS-36028: IBM/go-sdk-core update to v5.17.4 #722
OCPBUGS-32898: Upgrade go-jose module to 2.6.3 #698
OCPBUGS-27912: Resolve all outstanding snyk vulnerabilities #651
NO-JIRA: Removing andrew from OWNERS #644
OCPBUGS-25369: Discover AWS dns suffix from partition and region. #640
Full changelog

cloud-network-config-controller

OCPBUGS-32180: Avoid nil pointer panic while assigning private IP on Azure #139
Full changelog

cluster-authentication-operator

OCPBUGS-28760: Fix http2 [4.13] #654
Full changelog

cluster-autoscaler

OCPBUGS-45151: [release-4.13] VPA: Update OWNERS file #328
OCPBUGS-40929: update VPA golang.org/x/net for http rapid reset for CVE-2024-8421 #317
OCPBUGS-31702: add check for taint.value == nil #295
OCPBUGS-30874: Fix unstructured taint parsing in Cluster API provider #289
Full changelog

cluster-autoscaler-operator

OCPBUGS-31992: Update x/net to v0.25.0 #324
Full changelog

cluster-baremetal-operator

OCPBUGS-77450: Bump github.com/go-errors/errors to v1.5.1 #565
OCPBUGS-31993: bump x/net to 0.23.0 #439
Full changelog

cluster-capi-controllers

OCPBUGS-77975: fix vendor for hermetic #266
Full changelog

cluster-capi-operator

NO-JIRA: Allow sustaining engineering to self serve dependency updates #563
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-35562: update azure and ash tolerations on node manager #353
OCPBUGS-35562: update unit tests [release-4.13] #354
OCPBUGS-21169: Bump golang.org/x/net to v0.18.0 #296
Full changelog

cluster-config-operator

OCPBUGS-28802: Add required PSa labels #404
Full changelog

cluster-control-plane-machine-set-operator

OCPBUGS-48259: Add unreadyNodeGracePeriod for allowing brief node hiccups #342
OCPBUGS-35380: Improved debugging of API listing errors #304
OCPBUGS-30156: Never delete a Machine when there’s a single Machine in an index #286
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-32334: create suitable role and roleBinding for csi-snapshot-webhook #206
Full changelog

cluster-dns-operator

OCPBUGS-52501: [release-4.13] Add runbook_url for CoreDNSErrorsHigh #434
OCPBUGS-11449: Enable topology-aware hints iff nodes in >=2 zones #418
OCPBUGS-11449: Ignore max unavailable for status #417
OCPBUGS-11449: Set DNS DaemonSet’s maxSurge value to 10% #366
Full changelog

cluster-etcd-operator

OCPBUGS-67597: Update logrus to 1.9.3 to address CVE-2025-65637 #1549
OCPBUGS-53509: fix CVE-2025-30204 #1415
OCPBUGS-35077: return errors in wait-for-ceo #1273
OCPBUGS-31988: update golang x net #1255
OCPBUGS-30248: fix panic in health check timeouts #1217
OCPBUGS-30245: [4.13] Replace nodelister with master nodelister everywhere #1216
OCPBUGS-23572: Add annotation in the etcd-guard static pod for worklo… #1163
OCPBUGS-23106: [4.13] Remove z-upgrades from UpgradeBackupController #1154
Full changelog

cluster-image-registry-operator

OCPBUGS-67598: Bump logrus to 1.8.3 #1291
OCPBUGS-53869: Bump github.com/golang-jwt/jwt #1235
OCPBUGS-51602: bump golang.org/x/oauth2 #1222
OCPBUGS-36034: go.*,vendor: bump go-retryablehttp #1070
OCPBUGS-29935: pkg/storage/s3: enable bucket key on encryption settings #1007
Full changelog

cluster-ingress-operator

OCPBUGS-43095: Add alert for RFC 7230 violation in Transfer-Encoding headers #1161
OCPBUGS-43095: Add e2e test for duplicate Transfer-Encoding headers #1150
OCPBUGS-36551: Add Regexp Anchor to TestAll #1104
OCPBUGS-35453: [release-4.13] internal service changed fix target port logic #1089
OCPBUGS-35094: TestHostNetworkPortBinding: Delete t.Parallel() #1082
OCPBUGS-34765: Don’t add clientca-configmap finalizer if deleting #1073
OCPBUGS-34409: desiredRouterDeployment: Set HostPort if needed #1062
OCPBUGS-33990: Avoid spurious updates for internalTrafficPolicy [Backport to 4.13] #1055
OCPBUGS-34476: Use centos7 tag for quay.io/centos7/httpd-24-centos7 image #1065
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-67602: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.13.z] #2047
OCPBUGS-50850: Increase waitForFallbackDegradedConditionTimeout #1809
OCPBUGS-34062: [4.13] add a controller that reconciles SCCs’ volumes #1677
OCPBUGS-25922: [release-4.13] dashboard: use recording rules for most metrics #1611
: OCPBUGS-24023: Add workload partitioning annotation #1591
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-27066: bump(library-go)=release-4.13 #788
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #627
OCPBUGS-27065: bump(library-go)=release-4.13 #528
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-67607: Bump github.com/sirupsen/logrus to v1.8.3 #142
Full changelog

cluster-monitoring-operator

OCPBUGS-76488: test: remove image registry e2e tests #2813
OCPBUGS-33581: label for infra nodes for metric cluster:capacity_cpu_cores:sum #2344
OCPBUGS-28767: fix generation of telemeter token hash #2305
OCPBUGS-25388: Add RHACM telemetry metric for 4.13 #2203
Full changelog

cluster-network-operator

OCPBUGS-78106: fix vendor for hermetic 4.13 #2914
OCPBUGS-43856: manifests/02-cncc-credentials: Set skipServiceCheck for GCP #2547
OCPBUGS-38403: Add missing runbook for OVNKubernetesNorthdInactive #2471
OCPBUGS-37941: update whereabouts crd #2458
OCPBUGS-30150: ipsec: fix openssl typo #2290
OCPBUGS-29674: add env var in whereabouts-reconciler daemonset #2279
OCPBUGS-29301: Update ingressconfig_controller to use field Manager #2267
OCPBUGS-28208: ipsec: fix oopsy from 2e3fc8e (cherry-pick of 980c08318e) #2222
OCPBUGS-28777: fix whereabouts conformance test failures #2241
OCPBUGS-27958: Add ConfigMap mount to the whereabouts-reconciler DaemonSet #2220
NO-JIRA: add kyrtapz as reviewer and approver for release 4.13 #2229
OCPBUGS-22293: remove all managed fields used by old manager #2094
OCPBUGS-24570: Disable weak SSH cipher suitesRm weak ciphers 4.13 #2163
OCPBUGS-21716: Bump golang.org/x/net and github.com/openshift/library-go #2123
OCPBUGS-22896: run update-codegen after adding maxLogFiles cfg #2162
OCPBUGS-22971: HyperShift: Use the local konnectivity proxy when checking proxy readiness #2098
OCPBUGS-22896: Remove oldest ovn acl log files when file limit exceeded #2097
Full changelog

cluster-node-tuning-operator

E2E: workload hints: compare existing profile with changes being made to avoid mcp getting stuck (#1069) #1069
OCPBUGS-33030: [release-4.13][manual]Reduce number of reboots in offline tests (#1048) #1048
Scheduler plugin: ignore IRQs (#1027) #1027
irqbalance: set banned cpus list to 0 (#1003) #1003
OCPBUGS-24353: rps: cherry-picks of rps fixes (#865) #865
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-76595: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.13] #659
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-38455: Update opentelemetry to mitigate CVE #365
Full changelog

cluster-samples-operator

OCPBUGS-63520: references to github.com/sclorg/django-ex.git now also refer to the branch #662
OCPBUGS-54812: add rhdmalone to owners #628
OCPBUGS-49663: add shannon and aroyoredhat as owners #599
OCPBUGS-21198: update k8s.io/apiserver version #589
Full changelog

cluster-storage-operator

OCPBUGS-67622: Bump logrus to v1.8.3 #656
OCPBUGS-33468: Fix problem-detector proxy setting #473
Full changelog

cluster-update-keys

NO-ISSUE: Updating ose-cluster-update-keys-container image to be consistent with ART for 4.13 #78
OCPBUGS-43886: keys: Update Red Hat keys to use SHA256 signatures #67
Full changelog

cluster-version-operator

OCPBUGS-45332: deps: bump golang.org/x/net to 0.31.0 #1121
OCPBUGS-27049: pkg/cvo/availableupdates: Only bump LastAttempt on Cincinnati pulls #1019
Full changelog

console

ART-18919: pin fsevents to latest #16481
NO-JIRA: enable multi-architecture yarn builds #16423
CONSOLE-5011: migrate to yarn berry #16083
NO-JIRA: Bump builder image to v29 #15989
OCPBUGS-74437: Bump lodash to latest #15972
OCPBUGS-44160: bump dompurify to latest #15594
OCPBUGS-57100: Add all files to vendor regardless of gitignore #15136
OCPBUGS-54892: Show Observe section without PROMETHEUS and MONITORING flags #14960
OCPBUGS-45292: A value submitted in From view is wrapped with single quotation after switching to Yaml view. #14573
OCPBUGS-44356: Application creation fail when manually entering input scaling value in local setup #14509
OCPBUGS-45197: Edit the secret and add the Chinese in the web-console, garbled characters will be displayed #14552
OCPBUGS-44585: Need to allow blank for Project/namespace when setting SA Subject in ‘Project access tab’ #14497
OCPBUGS-36557: Increase login flow state paramater length/entropy #14483
OCPBUGS-42951: The filepath including leading slash makes error during parsing devfile using Gitlab #14383
OCPBUGS-41594: Redirects to new PipelineRun logs URL from old PipelineRun logs URL #14263
OCPBUGS-35259: fix vCenter cluster being empty #13952
OCPBUGS-32147: Bump graphql-go to v1.3.0 #13922
OCPBUGS-33978: Helm Plugin’s Catalog incorrectly renders a single index entry into multiple tiles #13872
OCPBUGS-34342: Fix PipelineRun Logs tab navigation #13890
OCPBUGS-24395: Extra space is in the translation text(Chinese) of ‘Create rolebinding’ and ‘replicate rolebinding’ #13405
OCPBUGS-33777: restrict Masthead logo to max-height to 60px #13860
OCPBUGS-33749: Add visual connector between VMs and non VMs workloads #13857
OCPBUGS-33382: Routes created by devfiles do not always use HTTPS #13827
OCPBUGS-33650: fix issues with Edit Route form #13851
OCPBUGS-32500: PipelineRuns in Console show wrong status or load indefinitely #13780
OCPBUGS-31077: Pipeline Name gets changed to “new-pipeline” on the Edit Pipeline YAML/Builder #13683
OCPBUGS-31595: Fix operands list endpoint. #13714
OCPBUGS-29063: add additional check to determine if file is binary #13579
OCPBUGS-28788: Copy response code from proxied plugin requests #13561
OCPBUGS-29243: Add a new allowInsecure option to the internet proxy #13593
OCPBUGS-27406: Add Pipeline metrics tab using plugin #13525
OCPBUGS-23483: add access to create, edit and delete silences for developer user from developer perspective #13349
OCPBUGS-25427: Fix plugin proxy handler #13449
OCPBUGS-25465: fix runtime error on Node details Overview when Machin… #13452
OCPBUGS-25146: add access review for impersonate #13437
OCPBUGS-24591: ConsolePlugin metrics must no longer be grouped by the vendor #13424
OCPBUGS-22241: Save also the location.search and .hash values in localStorage to restore them after login #13271
Full changelog

console-operator

OCPBUGS-77995: [release-4.13] NO-JIRA: update go mod dependency for konflux #1118
OCPBUGS-18674: Reset console operator’s conditions #894
OCPBUGS-30599: Disable HTTP/2 for webhook #875
OCPBUGS-21008: [release-4.13] Bump library-go and golang.org/x/net #866
OCPBUGS-6208: Updating openshift-enterprise-console-operator images to be consistent with ART #872
OCPBUGS-24591: ConsolePlugin metrics must no longer be grouped by the vendor #821
Full changelog

container-networking-plugins

ART-13080: Fix Hermeto build issues #197
Full changelog

coredns

OCPBUGS-60804: Bump github.com/golang/glog to v1.2.4 #150
OCPBUGS-38431: UPSTREAM: 6354: openshift: key cache on Checking Disabled (CD) bit #129
OCPBUGS-28205: UPSTREAM: 6277: openshift: Fix OCPBUGS-28205 #113
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-67628: fix CVE-2025-65637 #364
OCPBUGS-58888: CARRY: don’t ignore json files #344
OCPBUGS-52414: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.26 into release-4.13 #313
And 9 elided commits (e.g. from squash or rebase merges)
Full changelog

csi-driver-manila-operator

OCPBUGS-67629: Bump logrus #254
OCPBUGS-26224: Fix selector for manila-csi-driver-controller-metrics service #224
Full changelog

csi-driver-nfs

OCPBUGS-84928: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 to avoid go version bump and fix CVE-2026-33186 #185
Full changelog

csi-driver-shared-resource, csi-driver-shared-resource-webhook

OCPBUGS-28953: Replace ‘coreydaley’ with ‘sayan-biswas’ in OWNERS file #168
Full changelog

csi-driver-shared-resource-operator

OCPBUGS-28958: Replace ‘coreydaley’ with ‘sayan-biswas’ in OWNERS file #104
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-29728: cherry-pick:release-4.13: OCPBUGS-29244 Update VolumeSnapshot and VolumeSnapshotContent using JSON patch #141
Full changelog

docker-builder

OCPBUGS-43295: Buildah dependency bump to 1.29.5 #460
OCPBUGS-43191: runc library bump to 1.1.12 #439
OCPBUGS-48836: skipping some unit tests to avoid failures as they are duplicate #434
OCPBUGS-48655: Add new team members to the OWNERS file #431
Replace ‘coreydaley’ with ‘sayan-biswas’ #407
BUILD-854: Add adambkaplan as approver #405
Full changelog

docker-registry

OCPBUGS-53653: bump jwt and oauth dependencies #436
Full changelog

egress-router-cni

OCPBUGS-11648: update go-yaml to v2.4.0 #68
Full changelog

etcd

OCPBUGS-32920: Revert “Merge pull request #262 from Elbehery/rebase-etcd-3.5.13-open… #266
OCPBUGS-31653: Rebase etcd 3.5.13 openshift 4.13 #262
ETCD-537: Revert “bump build root go1.20” #263
OCPBUGS-28734: Rebase etcd 3.5.12 openshift 4.13 #245
ETCD-537: bump build root go1.20 #252
OCPBUGS-26925: Rebase etcd 3.5.11 openshift 4.13 #239
Full changelog

gcp-cluster-api-controllers

OCPBUGS-78283: [release-4.13] hermetic migration 4.13 #279
OCPBUGS-78283: [release-4.13] hermetic migration 4.13 #270
Full changelog

gcp-machine-controllers

OCPBUGS-78182: hermetic 4.13 #142
OCPBUGS-56916: Disable shielded VMs for non-UEFI disks #120
OCPBUGS-24563: Reduce metrics cardinality. #74
Full changelog

haproxy-router

OCPBUGS-78109: [release-4.13] hermetic 4.13 #743
OCPBUGS-43095: add duplicate_te_header_total metric #626
OCPBUGS-34673: Properly handle rewrite-target annotation #608
OCPBUGS-33911: Reject routes with MD5 certs #600
OCPBUGS-33448: Count active services before setting weight to 1 #594
OCPBUGS-33280: Route ‘haproxy.router.openshift.io/timeout’ value is not validated #591
Full changelog

hyperkube, pod

OCPBUGS-77660: Skip E2e: attach on previously attached volumes should work #2606
OCPBUGS-67556, OCPBUGS-67652: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 [4.13] #2626
OCPBUGS-77800: UPSTREAM: 133262: Remove permafailing tests using an expired GCP project #2611
OCPBUGS-41678: mount-utils: treat syscall.ENODEV as corrupted mount #2083
OCPBUGS-37280: UPSTREAM: 126104: Add funcs in pkg/filesystem/util that can actually … #2045
OCPBUGS-28660: UPSTREAM: <carry>: kubelet/cm: use MkdirAll when creating cpuset to ignore file exists error #1875
UPSTREAM: <drop>: Bump golang.org/x/net to v0.23.0 #1938
OCPBUGS-31505: Update to kubernetes 1.26.15 #1930
Address CVE #14
OCPBUGS-29663: Update to kubernetes 1.26.14 #1889
OCPBUGS-12210: Prevent partially filled HPA behaviors from crashing kube-controller-manager #1876
OCPBUGS-27370: Update to kubernetes 1.26.13 #1859
OCPBUGS-25814: Fix device uncertain errors on reboot - 4.13 #1831
OCPBUGS-25988: Update to kubernetes 1.26.12 #1839
OCPBUGS-25767: legacy-cloud-providers: prevent index out-of-range in getNextUnitNumber #1834
OCPBUGS-23521: UPSTREAM: <carry>: support for both icsp and idms objects #1798
Full changelog

hypershift

OCPBUGS-77756: fix vendor for hermetic 4.13 #7822
OCPBUGS-53901: bump golang-jwt v4 #5948
OCPBUGS-39184: fix: bump github.com/IBM/go-sdk-core/v5 #4627
OCPBUGS-41515: set Konnectivity cipher suites #4284
NO-JIRA: hack: make the e2e script generic #4202
HOSTEDCP-1146: cpo: use CPO spec container image if it is a sha256 reference #3296
Full changelog

ibm-cloud-controller-manager

OCPBUGS-24999: Add Snyk file to exclude vendor directory on scan #66
OCPBUGS-21137: Bump golang.org/x/net to v0.18.0 #56
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-77213: [release-4.13] standardize build paths #127
OCPBUGS-59124: bump github.com/golang/glog to v1.2.4 #110
OCPBUGS-56066: tech debt: rework vendor patches #94
OCPBUGS-53909: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #87
OCPBUGS-36064: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #74
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-67656, OCPBUGS-67657: bump github.com/sirupsen/logrus to v1.8.3 #164
OCPBUGS-59874: [IBM VPC] set offlineExpansion to false in e2e test manifest #152
OCPBUGS-36070: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #123
Full changelog

ibm-vpc-node-label-updater

OCPBUGS-56066: tech debt: rework vendor patches #51
OCPBUGS-53541: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #47
OCPBUGS-36010: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #43
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-67291: [release-4.13] Fix incomplete vendor/ #135
OCPBUGS-36076: UPSTREAM: <carry>: Fix go-retryablehttp CVE - 4.13 #90
Full changelog

ibmcloud-machine-controllers

OCPBUGS-78275: hermetic 4.13 #78
OCPBUGS-36082: Bump dependency for CVE #56
Full changelog

insights-operator

OCPBUGS-36475: properly encode the URL for the advisor links (#962) (#965) #962
OCPBUGS-33449: anonymization - externalIP can be nil (#931) (#933) (#935) #931
OCPBUGS-31991: bump golang.org/x/net version (#927) #927
OCPBUGS-28157: Add extra check in ids to bypass validations (#905) #905
gather etcd_server_slow metrics (#902) (#909) #902
OCPBUGS-23962: adds helm information gather (#868) (#883) #868
Full changelog

ironic

OCPBUGS-69791: Bump eventlet version to 0.33.1-7 #766
OCPBUGS-48146, OCPBUGS-48595: Bump jinja2 to 3.0.1-6.el9.2 #626
OCPBUGS-43952, OCPBUGS-43960: Bump python-waitress [4.13] #608
OCPBUGS-37764, OCPBUGS-39384: Include fixes for CVE-2024-44082 #585
OCPBUGS-38509: set min version for python3-webob #557
OCPBUGS-33374: bump werkzeug #543
OCPBUGS-34898: bump jinja2 #538
OCPBUGS-37116: Update eventlet version #525
OCPBUGS-32363: [4.13] remove unused prometheus-exporter #488
OCPBUGS-32387: Use unix sockets by default for reverse proxy communication #476
OCPBUGS-29190: Fix Inspector iPXE config for IPv6 addresses #453
Full changelog

ironic-agent

OCPBUGS-69776: adding eventlet-0.33.1-7 #235
OCPBUGS-39384: Include fixes for CVE-2024-44082 #164
OCPBUGS-38509: set webob and bump werkzeug #152
OCPBUGS-29725: Always add ignition to set hostname on /etc/hostname #111
Full changelog

keepalived-ipfailover

OCPBUGS-6236: Updating openshift-enterprise-egress-router images to be consistent with ART #121
Full changelog

kube-proxy, sdn

OCPBUGS-55758: Handle openshift-host-network namespace as special when it modifies #656
OCPBUGS-20771: update x/net to v0.17.0 #590
Full changelog

kube-rbac-proxy

OCPBUGS-31987: CVE-2023-45288 [4.13] #107
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-13). #230
Full changelog

kubevirt-csi-driver

“OCPBUGS-29791: [release-4.13] Address CVE-2024-1725: Restrict access to infrastructure PVCs by requiring matching infraClusterLabels on tenant PVCs” #35
Full changelog

libvirt-machine-controllers

OCPBUGS-77199: Fix incomplete vendor #305
Full changelog

machine-api-operator

OCPBUGS-78270: hermetic 4.13 #1469
OCPBUGS-67672: bumped logrus to v1.9.3 #1461
OCPBUGS-43856: install/0000_30_machine-api-operator_00_credentials-request: Set skipServiceCheck again for GCP #1304
OCPBUGS-32015: Fix zone tag value reconciliation for vSphere machines #1225
OCPBUGS-31994: Update x/net to v0.25.0 #1245
NO-JIRA: [release-4.13] Fix data race conditions in unit tests #1254
OCPBUGS-25165: Add Snyk file to exclude vendor directory on scan #1194
OCPBUGS-24277: Update reference URL #1188
Full changelog

machine-config-operator

OCPBUGS-61234: Trigger a new build #5278
OCPBUGS-59125: [release-4.13] Bump golang/glog to fix CVE-2024-45339 #5175
OCPBUGS-44206: Panic seen in CI job for MCC pod #4680
OCPBUGS-38372: Revert “MCD-pull: run after network-online.target in Azure” #4527
OCPBUGS-38295: daemon/update: disable systemd unit before overwriting #4522
OCPBUGS-37783: Openshift uncordoned compute-node that was intentionally cordoned #4507
OCPBUGS-37160: MCD-pull: run after network-online.target in Azure #4474
OCPBUGS-36782: daemon: Handle correctly OS Version for 4.1 and 4.2 bootimages #4464
OCPBUGS-32208: Run resolv-prepender entirely async #4314
OCPBUGS-33327: make verify should use MCO’s kube version #4352
OCPBUGS-29721: Add existing kubeletconfig/ctrcfg mc-name-suffix annotation #4206
OCPBUGS-30285: set nodeStatusReportFrequency #4243
OCPBUGS-28740: crio: drop automatic image cleanup on upgrades #4154
OCPBUGS-29151: fix nodeStatusUpdateFrequency #4170
OCPBUGS-24661: daemon: Add support for new nmstate logic #4036
OCPBUGS-27816: use *resource.Quantity to not automatically set 0 #4141
OCPBUGS-22272, OCPBUGS-27172: kubelet: fix kubelet labels #4120
OCPBUGS-27096: Azure Run ovs-configuration.service before dnsmasq.service #4115
OCPBUGS-19658: After dual-stack conversion reconcile IPFamilies #3935
Full changelog

machine-image-customization-controller

OCPBUGS-67658: bumped logrus to v1.9.3 #160
OCPBUGS-27089: configurable ironic agent vlan creation #117
Full changelog

machine-os-images

OCPBUGS-54172: Change rhcos release browser url #60
Full changelog

multus-admission-controller

OCPBUGS-60293: Bump github.com/golang/glog to v1.2.4 #106
OCPBUGS-60841: Update owners #108
Full changelog

multus-cni

OCPBUGS-28020: Fix SAST scan issues for multus-cni-container [4.13] #224
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-37941, OCPBUGS-37944: [release-4.13] Stateful fixes #306
OCPBUGS-27958: Enable reconciler configuration #241
OCPBUGS-27367: [release-4.13] Backport fix assignment #236
Full changelog

must-gather

OCPBUGS-48085: Update owners #476
Full changelog

network-metrics-daemon

OCPBUGS-59699: Bump github.com/golang/glog to v1.2.4 (#117) #117
[release 4.13] OCPBUGS-60541: Replace e2e test image (#132) #132
swtich golint install method (#129) #129
Correct 4.16 owners file (#130) #130
Added METRIC_TEST_IMAGE var (#90) #90
Full changelog

nutanix-cloud-controller-manager

OCPBUGS-12645, OCPBUGS-20879: bump golang.org/x/net to v0.17.0 #36
Full changelog

nutanix-machine-controllers

OCPBUGS-78157: hermetic 4.13 #131
OCPBUGS-51856: Fixing CVE-2025-22868 #119
OCPBUGS-47262: fixing CVE-2024-45338 #115
OCPBUGS-20976: bump golang.org/x/net to v0.17.0 #86
OCPBUGS-24563: Reduce metrics cardinality #59
OCPBUGS-25459: Fix CI by running tests natively by default #60
Full changelog

oauth-apiserver

OCPBUGS-31996: bump x/net to 0.24.0 #112
OCPBUGS-28674: Fix HTTP/2 deps for release-4.13 #102
Full changelog

oc-mirror

changes the owners file (#1012) #1012
OCPBUGS-48513: e2e: use same version of crane as in go.mod (#1025) #1025
Bump version to include v5.11.0 of go-git (#823) #823
OCPBUGS-385: Capability to override default channel (#749) (#791) #749
OCPBUGS-19429: Fix cross EUS channel upgrade path calculation (#775) #775
Full changelog

olm-rukpak

: OCPBUGS-27594,OCPBUGS-27679: Update go-git to v5.11.0 #75
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

openshift-apiserver

OCPBUGS-78596: Fix image reference in TestImageStreamImportQuayIO [release-4.13] #622
OCPBUGS-76482: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.13] #613
OCPBUGS-32446: bump(x/net) to v0.23.0 #430
Full changelog

openshift-controller-manager

OCPBUGS-58035: Set node-pullsecrets volume to read-only to protect image pull credentials #402
OCPBUGS-57051: Empty proxy variables are causing issues during the build #388
OCPBUGS-48656: Add new team members to the OWNERS file #362
[release 4.13] OCPBUGS-38407, OCPBUGS-38408: Update opentelemetry dependency #326
OCPBUGS-41952: Add adambkaplan as approver #335
Full changelog

openstack-cinder-csi-driver-operator

OCPBUGS-67685: Bump logrus #190
Full changelog

openstack-machine-api-provider

OCPBUGS-78174: hermetic 4.13 #166
OCPBUGS-34422: Ensure portSecurity is correctly set in the Instance Ports #119
Full changelog

operator-lifecycle-manager, operator-registry

OCPBUGS-61470: [release-4.13] Add NetworkPolicy as a supported kind #1053
OCPBUGS-61391: [4.13] e2e stability fixes #1086
OCPBUGS-46924, OCPBUGS-46931, OCPBUGS-47311: x/net bump to v0.34.0 [release-4.13] #942
OCPBUGS-47507: CRD upgrade existing CR validation fix (#3442) #924
NO-ISSUE: [release-4.13] Backport e2e fixes #876
OCPBUGS-42146: adds paginating lister for evaluating CRs’ upgrade fitness versus new CRDs. #871
OCPBUGS-38254: [CARRY] perform operator apiService certificate validity checks directly #836
OCPBUGS-38608: (fix) Resolver: list CatSrc using client, instead of referring to registry-server cache (#3349) #843
OCPBUGS-32856: bump go-jose to v2.6.3 #780
OCPBUGS-35241: Unblock CI #772
OCPBUGS-27564, OCPBUGS-27569, OCPBUGS-27649, OCPBUGS-27654: bump go-git/v5 to 5.11.0 #682
OCPBUGS-28228: Registry Pod Controller Flag #672
OCPBUGS-27891: [CARRY] SSC RBAC #669
OCPBUGS-8653: bump golang-migrate to v4.16.1 (#1107) #649
Full changelog

operator-marketplace

OCPBUGS-49430: Upgrade golang.org/x/net [release-4.13] #590
OCPBUGS-32074: update golang.org/x/net for CVE-2023-45288 #566
Full changelog

ovirt-csi-driver-operator

OCPBUGS-67725: Bump github.com/sirupsen/logrus to v1.8.3 #147
Full changelog

ovn-kubernetes-microshift-rhel-9, ovn-kubernetes-rhel-9

CORENET-6055, OCPBUGS-84635: [release-4.13] Dockerfile: Unpin OVN and consume the latest from FDP #3074
OCPBUGS-59934: Dockerfile: Remove ovs version pinning #2697
OCPBUGS-55950: Bump ovs and ovn to latest patch releases #2553
OCPBUGS-38264: [release-4.13] Bump OVSDBTimeout and make it configurable #2289
OCPBUGS-37119: EgressIP: Reload certificates for the grpc heatlhcheck server #2226
OCPBUGS-35100: [release-4.13] ipv6+all protocols conntrack flush #2200
OCPBUGS-34669, SDN-4186: Introduce a validating webhook for ovnkube-node #2053
OCPBUGS-29865: CVE-2022-41723: net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding #2095
OCPBUGS-33730: Improves service iptables efficiency on start up #2172
OCPBUGS-32988: Bumping OVS #2143
OCPBUGS-33421: [release-4.13] Full implementation of KEP-1669 ProxyTerminatingEndpoints + ETP=local fix #2130
OCPBUGS-33218: [release-4.13] OVN bump to 23.06.1-112 #2153
OCPBUGS-28983, OCPBUGS-30920: Update netpol namespace address sets usage to the old ways #2097
OCPBUGS-29851: Egress IP, Services: use all node IP addresses #2090
OCPBUGS-28630: Synchronize node primary address update #2036
OCPBUGS-25611: Avoid panic due to stale ACLs with 1013 priority #1987
OCPBUGS-27257: Ensure session affinity cleanup on backend removal #2022
OCPBUGS-27736: CARRY: Updates owners and adds Surya #2024
OCPBUGS-24419: OVNK/GW: Ignore headless services in syncServices #1971
OCPBUGS-23258: Update leaderelection config to allow retries #1992
OCPBUGS-26242: Fix Egress IP Deletion Handler to Prevent OVN Policy Leaks #2011
OCPBUGS-25923: Forward ICMP packets to OVN loadbalancer #2004
OCPBUGS-25224: [release-4.13] fixes MTU configuration on gateway router #1988
OCPBUGS-14799: Updating endpoints when using allocateLBNP=0, lgw mode fails #1940
OCPBUGS-25095: Fragment oversized reply packets in LGW mode #1983
OCPBUGS-24391: Limit OVN-Kubernetes RBAC permissions #1950
OCPBUGS-23014: Netpol retryFramework cleanup #1957
Full changelog

powervs-block-csi-driver

OCPBUGS-36094: Fix CVE-2024-6104 by updating http-retryable to 0.7.7 #91
OCPBUGS-33638: Fix CVE2023-45288 by bumping x/net to v0.24.0 -4.13 #82
OCPBUGS-24728: synk: ignore vendor dir #61
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-67694: Fix CVE-2025-65637 by bumping logrus to v1.8.3 #101
OCPBUGS-25716: snyk: ignore vendor dir #61
Full changelog

powervs-cloud-controller-manager

OCPBUGS-36104: UPSTREAM: <carry>: Fix go-retryablehttp CVE 4.13 #76
OCPBUGS-24731: UPSTREAM: <carry>: snyk code scan exclude vendor directory #53
Full changelog

powervs-machine-controllers

OCPBUGS-78041: hermetic 4.13 #137
OCPBUGS-54013: Fix for CVE-2025-30204 & CVE-2024-51744 in github.com/golang-jwt/jwt/v4 in release-4.13 #122
OCPBUGS-41980: Update go.mod to fix CVE - 4.13 #87
OCPBUGS-24563: Reduce metrics cardinality #69
OCPBUGS-24741: snyk code scan exclude vendor directory #64
Full changelog

prometheus

OCPBUGS-67695: chore: CVE-2025-65637: bump sirupsen/logrus to 1.9.3 #290
OCPBUGS-26423: Add Exemplars support for all time series #191
Full changelog

prometheus-alertmanager

OCPBUGS-77849: Include go-verify-deps expected files in gitignore #122
Full changelog

service-ca-operator

OCPBUGS-28759: Fix HTTP/2 (4.13) #232
Full changelog

telemeter

OCPBUGS-34829: fix issuer check during JWT authentication 4.13 #540
Full changelog

tests

OCPBUGS-55954: [build] Ensure Git Clone Does Not Run Privileged #29769
OCPBUGS-54771: Component Readiness: [Networking / ovn-kubernetes] [EgressFirewall] test regressed #29661
OCPBUGS-53285: Add/remove team members to the OWNERS file for Builds #29608
OCPBUGS-53297: Disable:Broken for [sig-builds][Feature:Builds][Slow] can use private repositories as build input build using an HTTP token should be able to clone source code via an HTTP token #29610
OCPBUGS-52584: Use payload pullspec for image info test #29592
OCPBUGS-37921: Removes dependency on samples operator images #29007
OCPBUGS-35053: updated timeout to 3 seconds to account for network timing issues #28862
OCPBUGS-36501: test/extended: skip etcd leader change check on hypershift #28922
OCPBUGS-35857: Use centos7 tag instead of latest for cmd images tests #28895
OCPBUGS-33985: Provide SCC access via RBAC #28835
Full changelog

thanos

OCPBUGS-76959: CVE-2025-65637 Update sirupsen/logrus to 1.9.3 #168
OCPBUGS-27206: Bump otel/http to 0.44.0 [openshift-4.13.z] #138
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-78032: hermetic migration 4.13 #110
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-78024: hermetic migration 4.13 #89
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-67712: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #161
Full changelog

vsphere-csi-driver-operator

OCPBUGS-67711, OCPBUGS-67717: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #326
Full changelog

vsphere-problem-detector

OCPBUGS-67723: bump github.com/sirupsen/logrus to v1.9.3 #203
OCPBUGS-57511: Ported VPD changes for permission check #184
Full changelog

Node Image Info

Loading node image info, this may take a while ...

Unable to show node image info: too many concurrent oc adm release info --rpmdb/--rpmdb-diff operations (limit 16)

View changelog in Markdown or change previous release:

Source code for this page located on github