4.13.72

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.13.72-x86_64

Qualifiers (status api):

Tests:

Blocking jobs
- upgrade Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Succeeded (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
Informing jobs
- aws-sdn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.13-e2e-aws-sdn-serial
- aws-sdn-upgrade-4.13-micro Succeeded periodic-ci-openshift-release-main-nightly-4.13-e2e-aws-sdn-upgrade
- azure-ovn-upgrade-4.13-micro Succeeded (1 retry) periodic-ci-openshift-release-main-ci-4.13-e2e-azure-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- driver-toolkit Succeeded (1 retry) periodic-ci-openshift-release-main-nightly-4.13-e2e-aws-driver-toolkit
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.13-fips-payload-scan
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.13-e2e-metal-ipi-ovn-ipv6
- metal-ipi-sdn-ipv4 Succeeded periodic-ci-openshift-release-main-nightly-4.13-e2e-metal-ipi-sdn-ipv4

Upgrades from:

Untested upgrades: 4.12.19, 4.12.20, 4.12.21, 4.12.22, 4.12.23, 4.12.25, 4.12.26, 4.12.27, 4.12.28, 4.12.29, 4.12.30, 4.12.31, 4.12.32, 4.12.33, 4.12.34, 4.12.35, 4.12.36, 4.12.37, 4.12.38, 4.12.39, 4.12.40, 4.12.41, 4.12.42, 4.12.43, 4.12.44, 4.12.45, 4.12.46, 4.12.47, 4.12.48, 4.12.49, 4.12.50, 4.12.51, 4.12.52, 4.12.54, 4.12.55, 4.12.56, 4.12.57, 4.12.58, 4.12.59, 4.12.60, 4.12.61, 4.12.62, 4.12.64, 4.12.65, 4.12.66, 4.12.67, 4.12.68, 4.12.69, 4.12.70, 4.12.71, 4.12.72, 4.12.73, 4.12.74, 4.12.75, 4.12.76, 4.12.77, 4.12.78, 4.12.79, 4.12.80, 4.12.81, 4.12.82, 4.12.83, 4.12.84, 4.12.85, 4.12.86, 4.12.87, 4.12.88, 4.12.89, 4.12.90, 4.12.91, 4.12.92, 4.12.93, 4.12.94, 4.12.95, 4.12.96, 4.12.97, 4.13.10, 4.13.11, 4.13.12, 4.13.13, 4.13.14, 4.13.15, 4.13.16, 4.13.17, 4.13.18, 4.13.21, 4.13.22, 4.13.23, 4.13.24, 4.13.25, 4.13.26, 4.13.27, 4.13.28, 4.13.3, 4.13.30, 4.13.31, 4.13.32, 4.13.33, 4.13.34, 4.13.35, 4.13.36, 4.13.37, 4.13.38, 4.13.39, 4.13.4, 4.13.40, 4.13.41, 4.13.42, 4.13.43, 4.13.44, 4.13.45, 4.13.46, 4.13.47, 4.13.48, 4.13.49, 4.13.5, 4.13.51, 4.13.52, 4.13.53, 4.13.54, 4.13.55, 4.13.56, 4.13.57, 4.13.58, 4.13.59, 4.13.6, 4.13.60, 4.13.61, 4.13.62, 4.13.63, 4.13.64, 4.13.65, 4.13.66, 4.13.67, 4.13.68, 4.13.7, 4.13.8, 4.13.9

Upgrades to:

4.14.0-0.nightly-2026-10-07-220531 (changes) - Failed Failed
4.14.0-0.ci-2026-10-07-203253 (changes) - F S F S

Loading changelog, this may take a while ...

Changes from 4.13.50

Created: 2026-10-07 10:52:00 +0000 UTC

Image Digest: sha256:c889dfb978becf40cea36fa5517cd6540944d49cba22aa4783aa1083b93e2470

Components

Kubernetes 1.26.15
Red Hat Enterprise Linux CoreOS upgraded from 413.92.202408270922-0 to 413.92.202609302032-0 (diff)

Rebuilt images without code change

alibaba-cloud-controller-manager git e41e11cc sha256:53f0da136a9496f96b29f2fc096385b56181789de07d82c1d4dcb19412810dcc
alibaba-cloud-csi-driver git 6384f904 sha256:770a7088247664851ab576ad1b79daa33572be305fa6c37e4b1d52faff99cba7
alibaba-disk-csi-driver-operator git 7e415973 sha256:58e701c38286db4e5f71259268135f46a2ecba0f95f16839c208cc6d78655071
alibaba-machine-controllers git 4c0f96a6 sha256:c9f186a8664420433a808c24acd021f22bb2c09ecfbe88b4edba163d04b9fbb7
aws-cloud-controller-manager git 95c03b7b sha256:9604e70f9b4ccb3dfd092da6c7ad63ffa433f185528cbf070d8313b55b11c01a
aws-ebs-csi-driver git 8205d51c sha256:b6613d99a75e252695f4a6bc1849c8a35318a90660b46ab0199e9f75472afb79
aws-machine-controllers git e1a57b5e sha256:9be92361ebbef988ba2435d86354617e8a11cd8729620205b5d0c65e3f97ed10
aws-pod-identity-webhook git ae01a272 sha256:23966e08aad69de32de754972c13125d5f1bdb359c8420c52b21779f5018ee90
azure-cloud-controller-manager git bf9bd022 sha256:a9e68afebab92cffff56f591af45a53efc5575eabe19ee3ca6a5e395b3c32999
azure-cloud-node-manager git bf9bd022 sha256:5421bb2032d751071e7f6bdc0800ae6aa4a5d24ad6ae07d26201bbe97370821f
azure-disk-csi-driver git b6d3fbcb sha256:63a46f2a2ffa74069e82f0579acb8b313355a977df1863e2c2328038ba848c6e
azure-disk-csi-driver-operator git 8534d756 sha256:e1978fb1329a3df67a1f763ccf448b37b0d01f8c81a4746fac39c221cbacdcf9
baremetal-runtimecfg git 1280cf54 sha256:cd3861e7d868752209a225299a2fd7852ef67f466de18f0dbca438ce9e3192c5
cli git d192e901 sha256:d656c09216748eaacfa70595b217c6fca86d7b6cd355003185b9db3dd7b6fc3c
cli-artifacts git d192e901 sha256:c73749529648127e25227a810f5d644c9518c0cf3c74121d7fec7058f26d7101
cloud-network-config-controller git d377281c sha256:75d72aede5593d547ac0f66d01fd3556ffe24e535335557075526c6768a12c6e
cluster-authentication-operator git 1801056c sha256:dc9fcbb11883ef61e5acddc1d085e26bba4a12ab0a6a60aba5d8cf04d7626141
cluster-bootstrap git ee908b6b sha256:3a7e3d62a2e110f843a62db02acac2034417c21d89a40342a0b1f3bab7ceae94
cluster-cloud-controller-manager-operator git 38f638f0 sha256:763fc5d5699d38c6aa28cfbcdd9d76e4679de22046a64278791b3c7fc3ea8000
cluster-config-operator git a6d56530 sha256:531b08920b34cd19d8e5ecd16bf1e77752096c539e93c48081598efb9c532316
cluster-csi-snapshot-controller-operator git c068540d sha256:4c0dcfd8f46c74c3c704e256ff2fb758724f016dc43664ef5a6a1f0a865eee7d
cluster-kube-cluster-api-operator git 18c076b1 sha256:4e28b5abfb80ab21f21aed6e80404cdd08bb25b0a3f95881def050027785a67f
cluster-kube-controller-manager-operator git dac71136 sha256:bc46af22e08f05e92055e8792f6d8089d81e3f86e0f63c98a6c1b420be1c3490
cluster-machine-approver git 25fe7b4b sha256:cd8c9855c4bf3c110944e39fec833141ec77d7b3dec00faaa636278bbc5b33e8
cluster-platform-operators-manager git 312c5f24 sha256:e8e289bb1b244d938bd3244c71bc0bf6006a102d71b28838200cf20d4cd727f3
cluster-policy-controller git 3b0d0755 sha256:f2032e249192ebb82ada184400e3701aa83689cd7780b83d84e1a5600504c889
configmap-reloader git 9adad592 sha256:66cb3a2059351787b4ec501b4775d4b4fd31ce04ae03d2db71402fa667b83ccd
csi-driver-shared-resource-operator git bc169d2d sha256:e24f0165038ebd1b60b7f519e48e0ee84e0ac1dd5fae813ea6e6110793534fde
csi-external-attacher git d9290843 sha256:45253406dad2276d370a1cf836a4ce01a511c6babc38f797bebef3234eea3c96
csi-external-provisioner git 0bf126b7 sha256:7210609b35f7e1e6a1a294e6c4c41ef81e0b224deecd6743bbedfc03afc8d633
csi-external-resizer git e8036caf sha256:bfafcb90ec4455acd822be37328a828abc6a6ba8e692a815450ec3132fc58fdb
csi-external-snapshotter git c8a7a097 sha256:d3a632edae3418e5c6f1ccab22dcbfff4b5de84fea8d26711c23d64bf8d2d55a
csi-livenessprobe git 3587db51 sha256:e533c8697cd8b3dff0e9db80b355cafabfa9490618b6eaec0d39f53f0d1f0be7
csi-node-driver-registrar git 9ea90f34 sha256:5d9873071710f5c60c15034ce741b56658b0fbd3ba7cce97601dde567e3fc40f
csi-snapshot-controller git c8a7a097 sha256:fdcdc80a140966093f1b97fdf32ea4f4d36090d04b5a80f4ee5f1b9d3a445f8c
csi-snapshot-validation-webhook git c8a7a097 sha256:afbd1d8f6f6693e898d7aca723f6d1ba4ab08922f7015a92ab896414aaf13a74
deployer git d192e901 sha256:5e085f1db60d55ee8c2d1af6354e639751e2785cb0b4e6540ed34ea592a44b34
driver-toolkit git d719bdcf sha256:96e4faa0b713f7b04bbf7adac1e3eff3d1ba0a8d75877bb08a5cbda7f797f950
egress-router-cni git dfe03737 sha256:79889ad0acb3db2d278c37068e02c7e1636ead92a1bbadb15b6040104225d0a4
etcd git a6b7ad43 sha256:9c527cc69cb3d88c790315a2bf2144449fdf08a5cf8c35835cbddea94cbda663
gcp-cloud-controller-manager git 507fea98 sha256:c3838377febfc1da9d8a975ab75ce610b41132982d62e541237b7ee0440f7dc5
gcp-pd-csi-driver git 81e60746 sha256:77aa3c42075cea0ab9fc2f4e24bc51a21c8675172ab359520f62272b6a8b40ee
gcp-pd-csi-driver-operator git 08c561b8 sha256:bc143d224447e13d1868de4d1dcd3557214304ce010ad3ded6171d9b8c96ebb0
ibm-cloud-controller-manager git b5bcaf9c sha256:c8cd8f4c8eb07dcdf382d735303e0416abe1bbbaf5633df2cac80d751e7f2411
insights-operator git 162554e1 sha256:a77dac6b703ca0acfd496243abdad69bf21b40d7046b4735571132b11f39e583
ironic-static-ip-manager git 4536724a sha256:a5c82bf65dcbce06b0575ce8df6b6a6cf2f5df30b909390c343e0be7766cd253
k8s-prometheus-adapter git 0fce7c7c sha256:81d3b752930e80e8c6b1eb49e4bf8df63f82175a85c467e837503fd5c6fd6bff
keepalived-ipfailover git 1a14e5c9 sha256:61de665b57c5437a0c915ab54786704e74c1c853b921eb1e98dab01672aa999a
kuryr-cni git 36754b7b sha256:1a5b03875157d01fd18afdb4ff3f226d81bdfa7cd22c45f0cd8d538bf9822045
kuryr-controller git 36754b7b sha256:07b0c7be23eb676b0daae239febb469dfcc5fa7245599a209ba9be40da977ead
machine-os-content sha256:3217a9d3655f1b611bd8b2ffb2d6a169627581a46fcc7faf6ad1a56c9125b4d3
multus-cni git 12897bd1 sha256:f9bd83fcca991164b127010d2f2bdd4ef7bb540916574a24eb631f685c306c07
multus-networkpolicy git 7176ab75 sha256:99e4590f2ededc9654257eadce45d3114ec39c5e3a7d788c1c0375d4ce8a6e55
multus-route-override-cni git ca3bbec5 sha256:72e82cf90f3958b5107fae743753b0e7ebf967b12fe4888c46c7732b8d3b425f
multus-whereabouts-ipam-cni git 9f8d13c7 sha256:b50d2815f8fa01f37f3c14e0edf51a5d6dd7e9074af4a4bd288e70d63812a563
network-interface-bond-cni git 84bda2af sha256:39d22a0d74b9358fc4254dbafbd32b0c7d23d226af22c8a574cb72a465656dd9
network-tools git 073feda1 sha256:359e2c4a5e247ef57d6a27f481f4b31412e96093f5204501d53bc062c4f5a8a0
oauth-apiserver git 6a597164 sha256:024c623846194aded5fd28023905d666d0cc82e36ec7f2f4645a531db1e5459b
oauth-server git eb54be28 sha256:c5fd5b05f5f33519cc2c61530d17c10e1dc1ed72f2dd5833c093094fc230fdc4
olm-rukpak git 7dde3cd3 sha256:9799b7a2f212c8bf669be8ef5f881874221e082fdda41ace2152edb82c0126e7
ovirt-machine-controllers git 22d89b3f sha256:fcf675e97dfe9da9dfb595b571d221e59a773008918cd04b6f366f6ba34e31a1
powervs-block-csi-driver git 16fa5555 sha256:9ad95314433e943b5ee3615dc284a506ad0b7f1e3dec06c3587e83ae4d7aab17
prometheus-config-reloader git 30fdccd1 sha256:b250ba6886480245f505b536818edbd98ce61b87aa2d6f5c292fb742a4250708
prometheus-operator git 30fdccd1 sha256:2aabdcd901f0923ba69a8a6b23c9c29c5f658befb78ce2ab75454911fa08dab3
prometheus-operator-admission-webhook git 30fdccd1 sha256:7f1d94b7db2e6ef855e0014a60a2431205f3023defa3e58c4d7d49250cc2d49e
rhel-coreos sha256:afd4eec8b91706f5a43aa7c948b4f89fa3238675b3b308eda92d730871b1fd89
rhel-coreos-extensions sha256:6209810122199118ef493b5d9d8fe086817868485efcf0ed9841619bfbf7f86a
service-ca-operator git dba00dc5 sha256:0d08c68acd1384516a0748ce65f1bc5ccba28f53bd887ae155a3f1ff03d23cff
tools git d192e901 sha256:df12a1bb8f3383ea988ce2aded70508532ecbe9e37f30afe1d897da2cc7a6ca3

agent-installer-api-server

MGMT-23439: Bump Go 1.18 to 1.20 and regenerate code #10043
MGMT-23439: Use archived dnf repositories for CentOS Stream 8 #10017
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-59114: CVE-2024-45339: Bump glog pkg to version 1.2.4 (#1195) #1195
OCPBUGS-53717: Bump jwt to 4.5.2 in release-4.13 (#1094) #1094
Bump golang.org/x/net to 0.33.0 (#1015) #1015
OCPBUGS-13612: Update version go-http-metrics/gin (#935) #935
Full changelog

agent-installer-node-agent

OCPBUGS-102304: CVE-2026-33814 - replace golang.org/x/net with openshift-sustaining fork v0.35.0-sec.3 #1628
OCPBUGS-67568: Bump logrus v1.9.0 to v1.9.3 #1280
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

apiserver-network-proxy

OCPBUGS-38066: Revert “Agent: Respect HTTPS_PROXY env vars for proxied connections” #61
Full changelog

aws-cluster-api-controllers

OCPBUGS-78230: [release-4.13] hermetic 4.13 #594
Full changelog

aws-ebs-csi-driver-operator

OCPBUGS-67575: Updated logrus to v1.8.3 #314
Full changelog

azure-cluster-api-controllers

OCPBUGS-78179: [release-4.13] Hermetic 4.13 #367
Full changelog

azure-file-csi-driver

OCPBUGS-102318: Bump golang.org/x/net to v0.35.0-sec.4 #163
OCPBUGS-41678: bump mount-utils to treat ENODEV error as corrupted mount #81
Full changelog

azure-file-csi-driver-operator

OCPBUGS-67580: Bump github.com/sirupsen/logrus to v1.8.3 #115
Full changelog

azure-machine-controllers

OCPBUGS-78265: hermetic 4.13 #187
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-81578: Azure UPI ARM template: use storageAccountId #10454
OCPBUGS-76931: terraform/provider/google: Fixing inconsistencies with the service account creation #10384
OCPBUGS-66232: Replace terraform-provider-google with Openshift fork #10141
OCPBUGS-62848: Release 4.13 bump terraform provider azurerm #10006
OCPBUGS-55034: IBMCloud: Move to IBM TF openshift fork #9668
OCPBUGS-39217: Add yq v4 to ci image #8922
Full changelog

baremetal-machine-controllers

OCPBUGS-78102: [release-4.13] fix vendor/ for hermetic migration #246
OCPBUGS-46640: Bump x/net 0.33.0 #229
Full changelog

baremetal-operator

OCPBUGS-53334: BMO can expose any secret via BMCEventSubscription CRD 4.13 #411
Full changelog

cloud-credential-operator

OCPBUGS-53419: github.com/golang/glog v1.2.4 #846
OCPBUGS-51546: Ignore SNYK-GOLANG-GOLANGORGXOAUTH2JWS-8749594 due to not being affected #831
OCPBUGS-43340: Update github.com/sirupsen/logrus v1.8.3 #770
OCPBUGS-37834: Resolve SNYK errors in security job. #743
Full changelog

cluster-autoscaler

OCPBUGS-45151: [release-4.13] VPA: Update OWNERS file #328
OCPBUGS-40929: update VPA golang.org/x/net for http rapid reset for CVE-2024-8421 #317
Full changelog

cluster-autoscaler-operator

OCPBUGS-102315: Bump x/net package in release-4.13 #393
Full changelog

cluster-baremetal-operator

OCPBUGS-77450: Bump github.com/go-errors/errors to v1.5.1 #565
OCPBUGS-31993: bump x/net to 0.23.0 #439
Full changelog

cluster-capi-controllers

OCPBUGS-77975: fix vendor for hermetic #266
Full changelog

cluster-capi-operator

NO-JIRA: Allow sustaining engineering to self serve dependency updates #563
Full changelog

cluster-control-plane-machine-set-operator

OCPBUGS-48259: Add unreadyNodeGracePeriod for allowing brief node hiccups #342
Full changelog

cluster-dns-operator

OCPBUGS-52501: [release-4.13] Add runbook_url for CoreDNSErrorsHigh #434
Full changelog

cluster-etcd-operator

OCPBUGS-67597: Update logrus to 1.9.3 to address CVE-2025-65637 #1549
OCPBUGS-53509: fix CVE-2025-30204 #1415
Full changelog

cluster-image-registry-operator

OCPBUGS-67598: Bump logrus to 1.8.3 #1291
OCPBUGS-53869: Bump github.com/golang-jwt/jwt #1235
OCPBUGS-51602: bump golang.org/x/oauth2 #1222
Full changelog

cluster-ingress-operator

OCPBUGS-86710: Add configuration override for X-SSL strip #1493
OCPBUGS-43095: Add alert for RFC 7230 violation in Transfer-Encoding headers #1161
OCPBUGS-43095: Add e2e test for duplicate Transfer-Encoding headers #1150
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-67602: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.13.z] #2047
OCPBUGS-50850: Increase waitForFallbackDegradedConditionTimeout #1809
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #627
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-67607: Bump github.com/sirupsen/logrus to v1.8.3 #142
Full changelog

cluster-monitoring-operator

NO-ISSUE: synchronize OWNERS from main branch [release-4.13] #3111
OCPBUGS-76488: test: remove image registry e2e tests #2813
Full changelog

cluster-network-operator

OCPBUGS-78106: fix vendor for hermetic 4.13 #2914
OCPBUGS-43856: manifests/02-cncc-credentials: Set skipServiceCheck for GCP #2547
Full changelog

cluster-node-tuning-operator

E2E: workload hints: compare existing profile with changes being made to avoid mcp getting stuck (#1069) #1069
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-76595: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.13] #659
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-38455: Update opentelemetry to mitigate CVE #365
Full changelog

cluster-samples-operator

OCPBUGS-63520: references to github.com/sclorg/django-ex.git now also refer to the branch #662
OCPBUGS-54812: add rhdmalone to owners #628
OCPBUGS-49663: add shannon and aroyoredhat as owners #599
OCPBUGS-21198: update k8s.io/apiserver version #589
Full changelog

cluster-storage-operator

OCPBUGS-67622: Bump logrus to v1.8.3 #656
Full changelog

cluster-update-keys

NO-ISSUE: Updating ose-cluster-update-keys-container image to be consistent with ART for 4.13 #78
OCPBUGS-43886: keys: Update Red Hat keys to use SHA256 signatures #67
Full changelog

cluster-version-operator

OCPBUGS-45332: deps: bump golang.org/x/net to 0.31.0 #1121
Full changelog

console

OCPBUGS-77115: [release-4.13] CVE-2026-26996 Bump minimatch library #16488
OCPBUGS-98418: CVE-2026-59869 #16755
OCPBUGS-92691: CVE-2026-46597 openshift4/ose-console: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs [openshift-4.13.z] #16977
Fix for OCPBUGS-92068: CVE-2026-44990 #16722
OCPBUGS-100521, OCPBUGS-101797: Bump postcss to fix CVE-2026-45623, CVE-2026-69153 #17112
OCPBUGS-112511: Fix JSON annotation parsing to prevent OperatorHub crash #17069
OCPBUGS-87988: [release-4.13] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16596
Fix for OCPBUGS-81594: CVE-2026-4800 #16569
OCPBUGS-88410, OCPBUGS-88442: CVE-2026-44486 openshift4/ose-console: Axios: Information disclosure of proxy credentials via HTTP redirects #16779
OCPBUGS-88375, OCPBUGS-88384, OCPBUGS-88391, OCPBUGS-88404, OCPBUGS-88410, OCPBUGS-88414, OCPBUGS-88442: CVE-2026-44495 #16622
OCPBUGS-79432: CVE-2026-29063 Bump immutable #16330
ART-18919: pin fsevents to latest #16481
NO-JIRA: enable multi-architecture yarn builds #16423
CONSOLE-5011: migrate to yarn berry #16083
NO-JIRA: Bump builder image to v29 #15989
OCPBUGS-74437: Bump lodash to latest #15972
OCPBUGS-44160: bump dompurify to latest #15594
OCPBUGS-57100: Add all files to vendor regardless of gitignore #15136
OCPBUGS-54892: Show Observe section without PROMETHEUS and MONITORING flags #14960
OCPBUGS-45292: A value submitted in From view is wrapped with single quotation after switching to Yaml view. #14573
OCPBUGS-44356: Application creation fail when manually entering input scaling value in local setup #14509
OCPBUGS-45197: Edit the secret and add the Chinese in the web-console, garbled characters will be displayed #14552
OCPBUGS-44585: Need to allow blank for Project/namespace when setting SA Subject in ‘Project access tab’ #14497
OCPBUGS-36557: Increase login flow state paramater length/entropy #14483
OCPBUGS-42951: The filepath including leading slash makes error during parsing devfile using Gitlab #14383
OCPBUGS-41594: Redirects to new PipelineRun logs URL from old PipelineRun logs URL #14263
Full changelog

console-operator

OCPBUGS-77995: [release-4.13] NO-JIRA: update go mod dependency for konflux #1118
Full changelog

container-networking-plugins

ART-13080: Fix Hermeto build issues #197
Full changelog

coredns

OCPBUGS-60804: Bump github.com/golang/glog to v1.2.4 #150
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-79799: Apply code mitigations for CVE-2026-33186 #400
OCPBUGS-67628: fix CVE-2025-65637 #364
OCPBUGS-58888: CARRY: don’t ignore json files #344
OCPBUGS-52414: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.26 into release-4.13 #313
Full changelog

csi-driver-manila-operator

OCPBUGS-67629: Bump logrus #254
Full changelog

csi-driver-nfs

OCPBUGS-84928: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 to avoid go version bump and fix CVE-2026-33186 #185
Full changelog

csi-driver-shared-resource, csi-driver-shared-resource-webhook

OCPBUGS-102349: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #530
Full changelog

docker-builder

OCPBUGS-43295: Buildah dependency bump to 1.29.5 #460
OCPBUGS-43191: runc library bump to 1.1.12 #439
OCPBUGS-48836: skipping some unit tests to avoid failures as they are duplicate #434
OCPBUGS-48655: Add new team members to the OWNERS file #431
Full changelog

docker-registry

OCPBUGS-53653: bump jwt and oauth dependencies #436
Full changelog

gcp-cluster-api-controllers

OCPBUGS-78283: [release-4.13] hermetic migration 4.13 #279
OCPBUGS-78283: [release-4.13] hermetic migration 4.13 #270
Full changelog

gcp-machine-controllers

OCPBUGS-102404: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #195
OCPBUGS-79795: Address CVE-2026-33186 #173
OCPBUGS-78182: hermetic 4.13 #142
OCPBUGS-56916: Disable shielded VMs for non-UEFI disks #120
Full changelog

haproxy-router

OCPBUGS-86710: Strip X-SSL-* headers for plain HTTP #808
OCPBUGS-74945: Adding escapeHAProxySingleQuotes for sanitize [release-4.13] #783
OCPBUGS-78109: [release-4.13] hermetic 4.13 #743
OCPBUGS-43095: add duplicate_te_header_total metric #626
Full changelog

hyperkube, pod

OCPBUGS-77660: Skip E2e: attach on previously attached volumes should work #2606
OCPBUGS-67556, OCPBUGS-67652: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 [4.13] #2626
OCPBUGS-77800: UPSTREAM: 133262: Remove permafailing tests using an expired GCP project #2611
OCPBUGS-41678: mount-utils: treat syscall.ENODEV as corrupted mount #2083
Full changelog

hypershift

OCPBUGS-77756: fix vendor for hermetic 4.13 #7822
OCPBUGS-53901: bump golang-jwt v4 #5948
OCPBUGS-39184: fix: bump github.com/IBM/go-sdk-core/v5 #4627
OCPBUGS-41515: set Konnectivity cipher suites #4284
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-79790: patch google.golang.org/grpc to v1.79.3 #159
OCPBUGS-77213: [release-4.13] standardize build paths #127
OCPBUGS-59124: bump github.com/golang/glog to v1.2.4 #110
OCPBUGS-56066: tech debt: rework vendor patches #94
OCPBUGS-53909: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #87
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-67656, OCPBUGS-67657: bump github.com/sirupsen/logrus to v1.8.3 #164
OCPBUGS-59874: [IBM VPC] set offlineExpansion to false in e2e test manifest #152
Full changelog

ibm-vpc-node-label-updater

OCPBUGS-56066: tech debt: rework vendor patches #51
OCPBUGS-53541: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #47
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-102403: Replace golang.org/x/net with openshift-sustaining/net #167
OCPBUGS-115548: Fetch envtest assets from the controller-tools releases #178
OCPBUGS-67291: [release-4.13] Fix incomplete vendor/ #135
OCPBUGS-36076: UPSTREAM: <carry>: Fix go-retryablehttp CVE - 4.13 #90
Full changelog

ibmcloud-machine-controllers

OCPBUGS-102411: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 #109
OCPBUGS-78275: hermetic 4.13 #78
OCPBUGS-36082: Bump dependency for CVE #56
Full changelog

ironic

OCPBUGS-69791: Bump eventlet version to 0.33.1-7 #766
OCPBUGS-48146, OCPBUGS-48595: Bump jinja2 to 3.0.1-6.el9.2 #626
OCPBUGS-43952, OCPBUGS-43960: Bump python-waitress [4.13] #608
OCPBUGS-37764, OCPBUGS-39384: Include fixes for CVE-2024-44082 #585
OCPBUGS-38509: set min version for python3-webob #557
Full changelog

ironic-agent

OCPBUGS-96902: Replace individual package removal with a single rpm -e loop #279
OCPBUGS-69776: adding eventlet-0.33.1-7 #235
OCPBUGS-39384: Include fixes for CVE-2024-44082 #164
OCPBUGS-38509: set webob and bump werkzeug #152
Full changelog

ironic-machine-os-downloader

OCPBUGS-87170: CI build root image tag and go version in go.mod version synced with ART 4.13 #119
Full changelog

kube-proxy, sdn

OCPBUGS-55758: Handle openshift-host-network namespace as special when it modifies #656
Full changelog

kube-rbac-proxy

OCPBUGS-31987: CVE-2023-45288 [4.13] #107
Full changelog

kube-state-metrics

NO-ISSUE: synchronize OWNERS from main branch [release-4.13] #191
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-13). #230
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-95079: OWNERS: Update component to Cloud Compute / KubeVirt Provider #78
Full changelog

kubevirt-csi-driver

OCPBUGS-83661: Bump google.golang.org/grpc to v1.79.3 #109
Full changelog

libvirt-machine-controllers

OCPBUGS-77199: Fix incomplete vendor #305
Full changelog

machine-api-operator

OCPBUGS-78270: hermetic 4.13 #1469
OCPBUGS-67672: bumped logrus to v1.9.3 #1461
OCPBUGS-43856: install/0000_30_machine-api-operator_00_credentials-request: Set skipServiceCheck again for GCP #1304
Full changelog

machine-config-operator

OCPBUGS-61234: Trigger a new build #5278
OCPBUGS-59125: [release-4.13] Bump golang/glog to fix CVE-2024-45339 #5175
OCPBUGS-44206: Panic seen in CI job for MCC pod #4680
Full changelog

machine-image-customization-controller

OCPBUGS-67658: bumped logrus to v1.9.3 #160
Full changelog

machine-os-images

OCPBUGS-87881: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #105
OCPBUGS-54172: Change rhcos release browser url #60
Full changelog

multus-admission-controller

OCPBUGS-60293: Bump github.com/golang/glog to v1.2.4 #106
OCPBUGS-60841: Update owners #108
Full changelog

must-gather

OCPBUGS-48085: Update owners #476
Full changelog

network-metrics-daemon

OCPBUGS-59699: Bump github.com/golang/glog to v1.2.4 (#117) #117
[release 4.13] OCPBUGS-60541: Replace e2e test image (#132) #132
swtich golint install method (#129) #129
Correct 4.16 owners file (#130) #130
Full changelog

nutanix-cloud-controller-manager

OCPBUGS-12645, OCPBUGS-20879: bump golang.org/x/net to v0.17.0 #36
Full changelog

nutanix-machine-controllers

OCPBUGS-78157: hermetic 4.13 #131
OCPBUGS-51856: Fixing CVE-2025-22868 #119
OCPBUGS-47262: fixing CVE-2024-45338 #115
OCPBUGS-20976: bump golang.org/x/net to v0.17.0 #86
Full changelog

oc-mirror

changes the owners file (#1012) #1012
OCPBUGS-48513: e2e: use same version of crane as in go.mod (#1025) #1025
Full changelog

openshift-apiserver

OCPBUGS-90519: Address CVE-2026-35469 #662
OCPBUGS-78596: Fix image reference in TestImageStreamImportQuayIO [release-4.13] #622
OCPBUGS-76482: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.13] #613
OCPBUGS-32446: bump(x/net) to v0.23.0 #430
Full changelog

openshift-controller-manager

OCPBUGS-58035: Set node-pullsecrets volume to read-only to protect image pull credentials #402
OCPBUGS-57051: Empty proxy variables are causing issues during the build #388
OCPBUGS-48656: Add new team members to the OWNERS file #362
[release 4.13] OCPBUGS-38407, OCPBUGS-38408: Update opentelemetry dependency #326
OCPBUGS-41952: Add adambkaplan as approver #335
Full changelog

openshift-state-metrics

OCPBUGS-102413: CVE-2026-33814 openshift4/ose-openshift-state-metrics-rhel8: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.13.z] #137
Full changelog

openstack-cinder-csi-driver-operator

OCPBUGS-67685: Bump logrus #190
Full changelog

openstack-machine-api-provider

OCPBUGS-78174: hermetic 4.13 #166
Full changelog

operator-lifecycle-manager, operator-registry

OCPBUGS-79800, OCPBUGS-79801: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.64.1-sec.1 [release-4.13] #1329
OCPBUGS-82051: Drop github.com/distribution/distribution from go.mod #1305
OCPBUGS-61470: [release-4.13] Add NetworkPolicy as a supported kind #1053
OCPBUGS-61391: [4.13] e2e stability fixes #1086
OCPBUGS-46924, OCPBUGS-46931, OCPBUGS-47311: x/net bump to v0.34.0 [release-4.13] #942
OCPBUGS-47507: CRD upgrade existing CR validation fix (#3442) #924
NO-ISSUE: [release-4.13] Backport e2e fixes #876
OCPBUGS-42146: adds paginating lister for evaluating CRs’ upgrade fitness versus new CRDs. #871
OCPBUGS-38254: [CARRY] perform operator apiService certificate validity checks directly #836
Full changelog

operator-marketplace

OCPBUGS-49430: Upgrade golang.org/x/net [release-4.13] #590
Full changelog

ovirt-csi-driver

OCPBUGS-102467: Replace x/net pkg with openshift-sustaining/net pkg v0.35.0-sec.3 to Address CVE-2026-33814 #164
Full changelog

ovirt-csi-driver-operator

OCPBUGS-67725: Bump github.com/sirupsen/logrus to v1.8.3 #147
Full changelog

ovn-kubernetes-microshift-rhel-9, ovn-kubernetes-rhel-9

CORENET-6055, OCPBUGS-84635: [release-4.13] Dockerfile: Unpin OVN and consume the latest from FDP #3074
OCPBUGS-59934: Dockerfile: Remove ovs version pinning #2697
OCPBUGS-55950: Bump ovs and ovn to latest patch releases #2553
OCPBUGS-38264: [release-4.13] Bump OVSDBTimeout and make it configurable #2289
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-67694: Fix CVE-2025-65637 by bumping logrus to v1.8.3 #101
Full changelog

powervs-cloud-controller-manager

OCPBUGS-36104: UPSTREAM: <carry>: Fix go-retryablehttp CVE 4.13 #76
Full changelog

powervs-machine-controllers

OCPBUGS-78041: hermetic 4.13 #137
OCPBUGS-54013: Fix for CVE-2025-30204 & CVE-2024-51744 in github.com/golang-jwt/jwt/v4 in release-4.13 #122
OCPBUGS-41980: Update go.mod to fix CVE - 4.13 #87
Full changelog

prom-label-proxy

NO-ISSUE: synchronize OWNERS from main branch [release-4.13] #411
Full changelog

prometheus

NO-ISSUE: synchronize OWNERS from main branch #384
OCPBUGS-88591: remote: validate snappy decoded length before allocation in read endpoint #354
OCPBUGS-86877: Bump google.golang.org/grpc #324
OCPBUGS-67695: chore: CVE-2025-65637: bump sirupsen/logrus to 1.9.3 #290
Full changelog

prometheus-alertmanager

NO-JIRA: synchronize OWNERS with main #190
OCPBUGS-100363: Set testdata CA expiry to 20 years from issue date (#4112) #152
OCPBUGS-77849: Include go-verify-deps expected files in gitignore #122
Full changelog

prometheus-node-exporter

NO-ISSUE: synchronize OWNERS from main branch [release-4.13] #207
Full changelog

route-controller-manager

OCPBUGS-86884: [release-4.13] bump google.golang.org/grpc to v1.64.1-sec.1 #96
Full changelog

telemeter

NO-ISSUE: synchronize OWNERS from main branch [release-4.13] #626
Full changelog

tests

OCPBUGS-55954: [build] Ensure Git Clone Does Not Run Privileged #29769
OCPBUGS-54771: Component Readiness: [Networking / ovn-kubernetes] [EgressFirewall] test regressed #29661
OCPBUGS-53285: Add/remove team members to the OWNERS file for Builds #29608
OCPBUGS-53297: Disable:Broken for [sig-builds][Feature:Builds][Slow] can use private repositories as build input build using an HTTP token should be able to clone source code via an HTTP token #29610
OCPBUGS-52584: Use payload pullspec for image info test #29592
OCPBUGS-37921: Removes dependency on samples operator images #29007
Full changelog

thanos

NO-ISSUE: synchronize OWNERS from main branch [release-4.13] #217
OCPBUGS-76959: CVE-2025-65637 Update sirupsen/logrus to 1.9.3 #168
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-78032: hermetic migration 4.13 #110
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-78024: hermetic migration 4.13 #89
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-67712: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #161
Full changelog

vsphere-csi-driver-operator

OCPBUGS-67711, OCPBUGS-67717: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #326
Full changelog

vsphere-problem-detector

OCPBUGS-102464: Bump golang.org/x/net to v0.35.0-sec.4 #238
OCPBUGS-67723: bump github.com/sirupsen/logrus to v1.9.3 #203
OCPBUGS-57511: Ported VPD changes for permission check #184
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github