4.16.74

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.16.74-x86_64

Qualifiers (status api): None

Tests:

Blocking jobs
- upgrade Pending (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Pending
- upgrade-minor Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-aws-ovn-serial
- aws-ovn-upgrade-micro Succeeded periodic-ci-openshift-release-main-ci-4.16-e2e-aws-ovn-upgrade
- aws-sdn-upgrade-4.16-micro Failed (1 retry) periodic-ci-openshift-release-main-nightly-4.16-e2e-aws-sdn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- azure-ovn-upgrade-4.16-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.16-e2e-azure-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-aws-driver-toolkit
- fips-scan Succeeded (1 retry) periodic-ci-openshift-release-main-nightly-4.16-fips-payload-scan
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- gcp-ovn-rt-upgrade-4.16-minor Succeeded (1 retry) periodic-ci-openshift-release-main-ci-4.16-upgrade-from-stable-4.15-e2e-gcp-ovn-rt-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- metal-ipi-ovn-ipv4 Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-metal-ipi-ovn-ipv4
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.16-e2e-metal-ipi-ovn-ipv6

Upgrades from:

Untested upgrades: 4.15.21, 4.15.22, 4.15.23, 4.15.24, 4.15.25, 4.15.26, 4.15.27, 4.15.28, 4.15.29, 4.15.30, 4.15.32, 4.15.33, 4.15.34, 4.15.35, 4.15.36, 4.15.37, 4.15.38, 4.15.39, 4.15.40, 4.15.41, 4.15.42, 4.15.43, 4.15.44, 4.15.45, 4.15.46, 4.15.47, 4.15.48, 4.15.49, 4.15.50, 4.15.51, 4.15.52, 4.15.53, 4.15.54, 4.15.55, 4.15.56, 4.15.57, 4.15.58, 4.15.59, 4.15.60, 4.15.61, 4.15.62, 4.15.63, 4.15.64, 4.15.65, 4.16.10, 4.16.11, 4.16.12, 4.16.13, 4.16.14, 4.16.15, 4.16.17, 4.16.18, 4.16.19, 4.16.20, 4.16.21, 4.16.22, 4.16.23, 4.16.24, 4.16.25, 4.16.26, 4.16.27, 4.16.28, 4.16.29, 4.16.3, 4.16.31, 4.16.32, 4.16.33, 4.16.34, 4.16.35, 4.16.36, 4.16.37, 4.16.38, 4.16.39, 4.16.4, 4.16.40, 4.16.41, 4.16.42, 4.16.43, 4.16.44, 4.16.45, 4.16.46, 4.16.47, 4.16.48, 4.16.49, 4.16.5, 4.16.50, 4.16.52, 4.16.53, 4.16.54, 4.16.55, 4.16.56, 4.16.57, 4.16.58, 4.16.59, 4.16.6, 4.16.60, 4.16.61, 4.16.62, 4.16.63, 4.16.64, 4.16.65, 4.16.66, 4.16.67, 4.16.68, 4.16.69, 4.16.7, 4.16.70, 4.16.8, 4.16.9

4.16.73 (changes) - S F F F F F F P
4.16.72 (changes) - Failed
4.16.71 (changes) - Failed
4.16.51 - Success
4.16.30 (changes) - Failed
4.16.16 (changes) - Failed
4.16.2 (changes) - Success
4.16.1 (changes) - Failed
4.16.0 (changes) - Success
4.15.70 (changes) - Failed Success
4.15.69 (changes) - Failed
4.15.68 (changes) - Success
4.15.67 (changes) - Failed
4.15.66 (changes) - Failed
4.15.31 (changes) - Success
4.15.20 (changes) - Failed
4.15.19 (changes) - Failed
4.15.18 (changes) - Failed
4.15.0-0.nightly-2026-10-18-234511 (changes) - Failed Success

Loading changelog, this may take a while ...

Changes from 4.16.51

Created: 2026-10-26 05:08:20 +0000 UTC

Image Digest: sha256:58c211bf5fa3664f25940bf74fd4f4456938fa7f2abcefef3fcd7bfcced6b226

Components

Kubectl 1.29.7
Kubernetes 1.29.14
Kubernetes Tests 1.29.0
Red Hat Enterprise Linux CoreOS upgraded from 416.94.202510221349-0 to 416.94.202610242150-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
StreamingCollectionEncodingToJSON (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
StreamingCollectionEncodingToProtobuf (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

Removed images

ovirt-csi-driver
ovirt-csi-driver-operator

Rebuilt images without code change

alibaba-machine-controllers git 248372a4 sha256:9b7975e21a36101514615e7268cb589f625ae7f39b169c8023a7bbc6d60c6313
apiserver-network-proxy git ca81b6a3 sha256:acc28bddd4334e67f7ef458e84af07ca83a7cd4d321a7c7d29d0fdd854f238f2
aws-ebs-csi-driver git 1d29a74a sha256:358a766505aa5394eb81b12ec55b3e415dab94b1feb9873359b267fe2c29a8b3
aws-kms-encryption-provider git c66065de sha256:45e262f459fa92194969b52df503e8e7904d027e3a230160b13a359057d937e2
aws-pod-identity-webhook git 459c5314 sha256:b00e17065de24a13c1301f0ed8bf06006769de9d17de95a42caba24426366146
azure-disk-csi-driver git 6b55f6fb sha256:7814762612903f416f7e7c836073b7157066db641f88a5dd7ab9e0ceeeac86cf
azure-workload-identity-webhook git 5b8d171e sha256:27e8c042ca11d8dd7bb9b56b4e6b229ffa437e20bc86a5d6b95ee6047155da41
cluster-bootstrap git 27bfb59f sha256:cf3ada6328d6495fda5102000c1b468dc3bc490c5600c83e10dbee55bfdf8bd6
cluster-capi-controllers git 5830a10a sha256:dd15e17c17f1833fa2dd6cb025a878d61c267f9f6fef488315819bbc5aa20495
cluster-config-operator git 441d29c9 sha256:28ea4af7f5d23b7d0a98cf4952eb529c7f21725635c3d3539afd750f1be2276b
cluster-control-plane-machine-set-operator git 14571e8a sha256:553fdc8d5e4b4bacb0b6dda5c1521304121f2bc27ea8996f5448cd165764cc36
cluster-dns-operator git a4b1cfb4 sha256:72e7d0e5114e31f183882f4929eff52335e09eadfff43d16b36f607c7074ee9d
cluster-kube-cluster-api-operator git 95ceaa9e sha256:73a9b52cf271a7a68f4cb5e542d42384c6b2cac69704f6c96d7cc1e36f2eaa63
cluster-kube-controller-manager-operator git b3faac1f sha256:a5100509d2364205bf9c8ee8bee5f5e849c44b5622f30f910bdb2acef7f009d4
cluster-machine-approver git 7685374f sha256:b9426c4e27a55b48c2eda0008bb34218a3fd30917cfd103c64e47503666110eb
cluster-openshift-controller-manager-operator git 2ed3cf99 sha256:49e406785946afd86712c746692eb8a843b10ef3431bfbc99968f553465463b2
cluster-policy-controller git eaea543f sha256:034317d6611a1458195cbb0ab4d0a41cc77ba9367c714fd93417f6e27b5cbb03
cluster-update-keys git e8478585 sha256:d56e3b402ad511c20012167fd52f5e5e70d6c4e6eb3a21092435c82a8177ef4c
cluster-version-operator git be820285 sha256:dd341a130fc2296685590de0eb099c19304d2ab694089f8bc384b5e9fee75505
configmap-reloader git dc91ddc4 sha256:b8c5f1175739f189558dbb853cf1f1c0f95f42ad44e950ba5c38ba6488f503f2
csi-driver-manila-operator git c25d1ff2 sha256:036873062e02a3ddb381d9ea1b3a388ac59a87259daf9fcc5ebd946f258de63a
csi-driver-shared-resource git bc125def sha256:e2cab12f83cf6fbea8608aea2e8fa828089fa123f4c249a3cb3bdc95c9ca3325
csi-driver-shared-resource-webhook git bc125def sha256:5480b81f84ff1d8786ab3468ba03cfc84bcf9452f052d2826136032b33b11fe6
csi-external-attacher git 7da80aab sha256:e7c7b51c858025d67af5946b606de0db6501d924a0808fc98b7cc91ccc6da673
csi-external-provisioner git 9e8af011 sha256:966ddeabf0b572cc0819d3488d7eb22cb08e6b5436876839fc2eab255d16cba4
csi-livenessprobe git f5e3ff55 sha256:d1ba3685b64d86bb2bad917ae0955b4d018b9d8ba57b7a7268a43974e7413516
docker-registry git 072c544c sha256:4cd2d87d4599fa8603c3f056571c8f5961c36f40a8c05d006d1b330622cd1847
driver-toolkit git 1d5732f0 sha256:9f26932d084601d97653c2c3df87a8a60056a14c71a4663cef2a77c76d6ab7cd
egress-router-cni git 7089efe6 sha256:8270d2512eb45cf13d00e1960928e150ab17ea32c9fd7f31d874a77feb0730c9
etcd git e7911c0d sha256:3ff50c1051fd52ee2f5c5fe7d8250157c41c0fcc7dcf7f8a4aa8658402425b61
gcp-cloud-controller-manager git 26b43dfc sha256:a6ee348699b26231cf4970948ea76902b77b3f4a3b8d773f87763349a3ab193a
gcp-pd-csi-driver-operator git 799327f7 sha256:62ac85f74c1a642a81d4c73cd94d5c340886831bc2bf6ab76bea46fa16eaa7ad
ironic-machine-os-downloader git 93b8b5fa sha256:e6e45d05302e2eddc522a65be98d690849809a602ec511268ae4e8d4f0472695
ironic-static-ip-manager git f44e8a08 sha256:7b4dab51064eb5a414fb017559b2184b7d78e51506e755d262af16ebef6ad565
k8s-prometheus-adapter git e4f859be sha256:e62c99c1675935852d6da5106609b5df93a970db2e8bef67761c22045cb27044
keepalived-ipfailover git b58673a3 sha256:2c60053fc2c2f1c30c02dc6368becb7ac924104a768a4fcb4cbd0399a5c84b93
kube-proxy git 53fea06b sha256:21fe4dead4ff61bdf1fc51441c17a854fc02a9cff1152b8c0b47740a1cb471be
kube-rbac-proxy git c38f4734 sha256:76c129626d6d79aa7ab15c90d76de86795cdcc3adca886b507b00037dd579209
kube-storage-version-migrator git 6f213320 sha256:81abc9fecb457c33efe3a2a6a8f67d28b8800c826c31c89ea30e9c92ab4f7f03
multus-admission-controller git a15bf454 sha256:3296cc08b9b67e4dc7e3706ec3d3676e5be6e61f7b71f645d2147e498f3c59b9
multus-networkpolicy git f988f894 sha256:761ea7aa04b0cbaa980e5e997214fbaf7209d0a37f087ce1e2a66299ff66688c
multus-route-override-cni git 73594f77 sha256:6a779bbb8bda1f7caa886fd600ececb09d9902c22d24b6a34670648f4508dbab
network-interface-bond-cni git e6880659 sha256:96fe079022e9297a50f68535faf9c626dfc54e9ced532a5f0cc8d6ce55c13b0e
network-metrics-daemon git 1210db38 sha256:9f4af8d172a13b28132b5a23072d31ab7e0ac5fad31db6421fc0040d6b21e365
network-tools git 234ed43e sha256:b05b2daa6c9ef2f183805da1e4864abfa4c34745695c814117a803d371ff3adb
nutanix-cloud-controller-manager git 28bf5963 sha256:d20ec58957c658ea5c2700a62115a4f3155c162cf95d9de21e27901338fc3497
nutanix-machine-controllers git 2f2e121b sha256:9137f66327afa6d9a1c4e9e2fe0aad211cb088288c066af76bb6f0e24ce4a446
olm-operator-controller git 80b8649c sha256:5a05a258ea16c20bc1ebc8f5c2d4d25c8baa11ea68bfe71b9101a04576fdaea4
olm-rukpak git 282cc84c sha256:ff7f5dc7a254716bb4ce379987d493e8a51c5b304916fd1ac981312fa2627355
openshift-controller-manager git 90f73f7e sha256:c28e3ae2a66b06aacb87dc967f5ddd2f36d38eb0d95f2901d578b34de1d922fa
openstack-cinder-csi-driver-operator git 85b52097 sha256:eb6c1ed4356ef3ae2647220472d4df88a92069e89e1ee4ba026463015b67a9f0
openstack-cluster-api-controllers git 3b972b2b sha256:e2567b4ead3533a2a95b418e25127d27d739475a22c11840a0988257840aff55
powervs-block-csi-driver-operator git 9c5dd8d1 sha256:acba32c6e0fac3907bda899cbaac369d87726672301196e1264e1babe6c5bd8a
powervs-cloud-controller-manager git 20e6dc70 sha256:d7606e153e433ff26aff09520205c29831baa30dc5ea7a7ad02a98e49aa972f4
powervs-machine-controllers git 2bfcc0f8 sha256:b5795a7af0bf19ece720ba4123272585ad42ed4c1bd515c6d1803551f4080a76
rhel-coreos sha256:7a3d1801767f632f75fc5b0cefc8517f8bd36d59e7a8795b84c3302392554a01
rhel-coreos-extensions sha256:37844522c06cc37153cccefbee961043a08f919b2af2d8150cc69e6ffefe0705
sdn git 53fea06b sha256:748bb5531aabadf2f136333a8ca856946c67ba64b26dec95b6f9d98297f282d7
service-ca-operator git 538c7b98 sha256:8d2e745cc423a6e9318bd9b40a030d8621f9626473863af60bbc94cdc9870d4d
telemeter git c1ecd105 sha256:feeed6d5bcddce05779fc75177282c52ce0828798fe95ce8570d75823197a191
thanos git 85eee25c sha256:920ca8853345c044c8c88daa143c396f5c03504b48d0a33dfea5d0f68c14c925

agent-installer-api-server

OCPBUGS-89848: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.2 #10802
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-102901: Bump x/net to v0.35.0-sec.4 #2295
Full changelog

agent-installer-node-agent

OCPBUGS-102913: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #1616
Full changelog

agent-installer-utils

OCPBUGS-68046: bump github.com/sirupsen/logrus to v1.9.3 #239
Full changelog

alibaba-cloud-controller-manager

OCPBUGS-102906: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #62
Full changelog

aws-cloud-controller-manager

OCPBUGS-103119: Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #177
OCPBUGS-88174: replace golang.org/x/net with sustaining fork v0.35.0-sec.4 #180
Full changelog

aws-cluster-api-controllers

🌱 OCPBUGS-123712: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #645
OCPBUGS-78227: [release-4.16] update go mod dependency for konflux #591
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator

OCPBUGS-102919, OCPBUGS-102939: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #608
OCPBUGS-64831: Use 127.0.0.1 for healtz http-endpoints #467
OCPBUGS-64768: Add RBAC ClusterRole and Binding for driver node #465
Full changelog

aws-machine-controllers

OCPBUGS-73903: Fix reconciler consistency checks in Update and Exists #168
OCPBUGS-63140: client: re-use a single file for building the session instead of randomly named files #144
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-102933, OCPBUGS-103121: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #210
OCPBUGS-79998, OCPBUGS-85635, OCPBUGS-85636: Bump google.golang.org/grpc to v1.79.3 #182
Full changelog

azure-cluster-api-controllers

OCPBUGS-78176: [release-4.16] update go mod dependency for konflux #364
Full changelog

azure-file-csi-driver

OCPBUGS-102923: Bump golang.org/x/net to v0.35.0-sec.4 #160
UPSTREAM: 3221: OCPBUGS-115466: Bump golang.org/x/crypto to v0.33.0-sec.5 #165
OCPBUGS-89335: Address CVE-2026-33186 #139
Full changelog

azure-kms-encryption-provider

OCPBUGS-79927: Bump google.golang.org/grpc to 1.64.1-sec.1 patch #48
Full changelog

azure-machine-controllers

OCPBUGS-103039: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #215
OCPBUGS-66044: Set updateDomainCount to one when faultDomainCount is one #177
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-102938: Bump golang.org/x/net to v0.35.0-sec.4 #10973
OCPBUGS-89841, OCPBUGS-89843, OCPBUGS-89847, OCPBUGS-92760: Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.33.0-sec.4 #10924
OCPBUGS-127603: Update gcloud version to one that can be found #10918
OCPBUGS-67206: Update RHCOS-release-4.16 bootimage metadata to 416.94.202608150307-0 #10798
Revert “OCPBUGS-60668: Update RHCOS-release-4.16 bootimage metadata to 416.94.202601221345-0” #10846
OCPBUGS-60668: Update RHCOS-release-4.16 bootimage metadata to 416.94.202601221345-0 #10281
OCPBUGS-74885: Azure UPI ARM template: use storageAccountId #10282
OCPBUGS-76586: terraform/provider/google: Fixing GCP inconsistencies present with the service account creation #10298
OCPBUGS-73879: data/manifests/bootkube/cvo-overrides: Default to eus-4.16 #10226
OCPBUGS-54165: aws: fix NLB creation in secret regions #10031
OCPBUGS-53237: Validation for API and Ingress VIPs when using user-managed load balancer #10048
Full changelog

baremetal-machine-controllers

OCPBUGS-78099: [release-4.16] fix vendor/ for hermetic migration 4.16 #243
Full changelog

baremetal-operator

OCPBUGS-77278: Unblock BMH direct deletion when detached annotation is present #463
Full changelog

baremetal-runtimecfg

OCPBUGS-60113: Re-add ENABLE_NODEIP_DEBUG env var #362
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-102912, OCPBUGS-102935, OCPBUGS-103104: Use patched x/net fork v0.35.0-sec.4 #2416
OCPBUGS-91215, OCPBUGS-91552, OCPBUGS-91589: Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.2 #2346
OCPBUGS-111894: Fix pre-existing unit test failures #2374
OCPBUGS-64616: Help with must-gather scheduling through suggesting preferance of nodes #2151
OCPBUGS-64561: Update go-jose, x/crypto, x/net #2144
Full changelog

cloud-credential-operator

OCPBUGS-81849: Bump go-jose/go-jose/v4@v4.1.4 #1040
OCPBUGS-79941: Bump google.golang.org/grpc to v1.79.3 #1026
OCPBUGS-65802: ccoctl azure: retry custom role creation on consistency errors #952
OCPBUGS-63550: ccoctl: add public-key-file flag to create-all #940
Full changelog

cloud-network-config-controller

OCPBUGS-66346: [release-4.16] Fix capacity calculation #195
OCPBUGS-65567: [release-4.16] Change the capacity struct from int to ptrOfInt #192
Full changelog

cluster-authentication-operator

OCPBUGS-102924: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #990
Full changelog

cluster-autoscaler

OCPBUGS-78702: allow clusterapi provider to skip paused resources #415
Full changelog

cluster-autoscaler-operator

OCPBUGS-102934: Bump x/net package in release-4.16 #390
Full changelog

cluster-baremetal-operator

OCPBUGS-77447: Bump github.com/go-errors/errors to v1.5.1 #562
OCPBUGS-64741: Always have a service for ironic-api port #524
OCPBUGS-63417: Fix ironic inspector container privileges #513
Full changelog

cluster-capi-operator

OCPBUGS-79943: Bump google.golang.org/grpc to v1.79.3 #573
NO-JIRA: Allow sustaining engineering to self serve dependency updates #560
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-63168: ccm: disable unused secure-serving port and webhook #422
Full changelog

cluster-config-api

CNTRLPLANE-1982: Promote streaming list encoding to Default #2600
OCPBUGS-71202: Add HTTPKeepAliveTimeout to IngressController API #2640
NO-JIRA: Promote streaming list encoding to Default on Hypershift. #2568
CNTRLPLANE-1611: Add feature gates for StreamingCollectionEncoding #2542
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-102965: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #291
Full changelog

cluster-etcd-operator

OCPBUGS-68058: Update logrus to 1.9.3 to address CVE-2025-65637 #1546
Full changelog

cluster-image-registry-operator

OCPBUGS-68059: : Bump github.com/sirupsen/logrus to v1.9.1 #1285
Full changelog

cluster-ingress-operator

OCPBUGS-102952: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1573
OCPBUGS-86713: Add configuration override for X-SSL strip #1487
OCPBUGS-71202: Implement HTTPKeepAliveTimeout tuning option #1337
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-68064: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-rhel9-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.16.z] #2043
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #624
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-68069: Bump github.com/sirupsen/logrus to v1.9.1 #144
Full changelog

cluster-monitoring-operator

NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #3113
OCPBUGS-102945: [release-4.16] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #3090
OCPBUGS-77276: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2831
OCPBUGS-64581: Fix KSM deny-list typo #2733
OCPBUGS-64637: Add mcd_local_unsupported_packages metric from MCO to telemetry 4.16 #2735
OCPBUGS-62765: port metric acm_managed_cluster_worker_cores:max to OCP 4.16 #2719
OCPBUGS-63235: test: remove image registry e2e tests #2727
Full changelog

cluster-network-operator

OCPBUGS-67000: Re-disable metrics server #2855
OCPBUGS-63233: Manual feature backport of cert rotation for whereabouts #3040
OCPBUGS-84182: fix(hypershift): use net.JoinHostPort for URL construction #2981
OCPBUGS-75890: Tweak iptables-alerter to try to avoid crictl bug #2898
: NO-JIRA: Update CNO reviewers/approvers #2768
OCPBUGS-63155: Add drop flows for GARPs #2819
Full changelog

cluster-node-tuning-operator

OCPBUGS-82675: Bump github.com/moby/spdystream from v0.2.0 to v0.5.1 #1551
OCPBUGS-78766: [4.16] PPC: filter out namespaces dir #1466
Full changelog

cluster-olm-operator

OCPBUGS-86243: Update grpc-go to v1.67.3-sec.1 to fix CVE-2026-33186 #206
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-68072: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.16] #654
Full changelog

cluster-samples-operator

OCPBUGS-63516: references to github.com/sclorg/django-ex.git now also refer to the branch #659
Full changelog

cluster-storage-operator

OCPBUGS-102969: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #733
OCPBUGS-87613: remove oVirt code from CSO 4.16 #709
OCPBUGS-78769: Add patch permission to provisioner role #685
Full changelog

console

OCPBUGS-98424: CVE-2026-59869 bump js-yaml #17158
Fix for OCPBUGS-92076: CVE-2026-44990 #16719
OCPBUGS-100513, OCPBUGS-101789: Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss #17060
OCPBUGS-114417: Prevent binary secret data corruption when editing #17101
OCPBUGS-105793: Disable failing OLM and other e2e tests to unblock CI #16958
OCPBUGS-105796: Fix operator-hub e2e test by replacing unavailable Red Hat catalog source with Community #17081
OCPBUGS-87987: [release-4.16] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16599
OCPBUGS-81597: CVE-2026-4800 #16566
OCPBUGS-77123: [release-4.16] CVE-2026-26996 Bump minimatch library #16346
OCPBUGS-79439: Bump immutable #16657
OCPBUGS-88027: Fix JSON annotation parsing to prevent OperatorHub crash #16588
OCPBUGS-88377, OCPBUGS-88380, OCPBUGS-88412, OCPBUGS-88419, OCPBUGS-88444: CVE-2026-44495 #16612
OCPBUGS-88554: Stabilize legacy OperatorHub Cypress waits #16608
NO-JIRA: enable multi-architecture yarn builds #16417
OCPBUGS-83299: [release-4.16] openshift4/ose-console-rhel9: Axios: Remote Code Execution via Prototype Pollution escalation #16298
OCPBUGS-78673: Namespace is not persisting when switching to developer view from the topology page of admin page #16161
CONSOLE-5011: migrate to yarn berry #16078
OCPBUGS-76578: Bump axios #16032
NO-JIRA: Bump builder image to v29 #15993
OCPBUGS-74447: Bump lodash to latest #15967
OCPBUGS-69678: Disallowed Pipelines-plugin Pipelines navigation section #15857
OCPBUGS-64884: Remove required flag from ‘console.flag/model’ pipelines-plugin extension #15707
OCPBUGS-64649: /auth/error?error=missing_state&error_type=auth is showing blank page #15675
Full changelog

console-operator

OCPBUGS-102982: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #1225
OCPBUGS-77992: update go mod dependency for konflux #1115
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-85669: CI Build root image tag sync with ART #234
Full changelog

coredns

OCPBUGS-77463: Modify .gitignore to not exclude vendor build folders #168
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-79978: Bump google.golang.org/grpc #389
OCPBUGS-68080: fix CVE-2025-65637 #361
Full changelog

csi-driver-nfs

OCPBUGS-84931: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.67.3-sec.1 to avoid go version bump and fix CVE-2026-33186 #182
Full changelog

csi-driver-shared-resource-operator

OCPBUGS-102984: Bump golang.org/x/net to v0.35.0-sec.3 #128
Full changelog

csi-external-resizer

OCPBUGS-102985: Bump golang.org/x/net to v0.35.0-sec.4 #215
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-102978, OCPBUGS-102990: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #230
Full changelog

csi-node-driver-registrar

OCPBUGS-64632: update log level verbosity to not clutter logs #91
Full changelog

docker-builder

OCPBUGS-89824, OCPBUGS-90269, OCPBUGS-92346, OCPBUGS-92576, OCPBUGS-92768: Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 #553
OCPBUGS-65907: BuildConfig inline Dockerfile fails with heredoc syntax #489
Full changelog

gcp-cluster-api-controllers

OCPBUGS-78280: [release-4.16] update go mod dependency for konflux #267
Full changelog

gcp-machine-controllers

OCPBUGS-103045: Bump golang.org/x/net to v0.35.0-sec.3 #191
OCPBUGS-79970: Bump google.golang.org/grpc to v1.79.3 #167
OCPBUGS-79970: [release-4.16] Fix setup-envtest GCS 401 by downloading binaries directly #176
Full changelog

gcp-pd-csi-driver

OCPBUGS-103000: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #143
OCPBUGS-68087: Update logrus to 1.9.3 #92
Full changelog

haproxy-router

OCPBUGS-103005: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #844
OCPBUGS-86713: Strip X-SSL-* headers for plain HTTP #805
OCPBUGS-79960: Bump google.golang.org/grpc to v1.79.3 #769
Full changelog

hyperkube, pod

OCPBUGS-68041, OCPBUGS-68091: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 [4.16] #2582
OCPBUGS-74299: Skip E2e: attach on previously attached volumes should work #2568
OCPBUGS-65694: Fix Concurrentmap Iteration #2519
CNTRLPLANE-1612: Backport StreamingCollectionEncoding for JSON and protobuf #2485
Full changelog

hypershift

OCPBUGS-33097: [release-4.16] fix(api): remove deprecated OVNSbDb service type #9820
OCPBUGS-120748: update Containerfile.cli base images to floating tags [release-4.16] #9560
OCPBUGS-99075: fix(backport): konnectivity agent auth #9097
OCPBUGS-84182: fix(cno): use brackets only for IPv6 in server URL #8348
OCPBUGS-76534: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7704
OCPBUGS-74375, OCPBUGS-74376: Support proxy authentication when user/pass is included in URL #7578
OCPBUGS-73118: Fix Konflux EC voilation, update deprecated base … #7459
OCPBUGS-63640: [release-4.16] fix(konnectivity): resolve circular dependency causing DNS timeouts and excessive retries #7113
OCPBUGS-64680: Update DNS names for ovn-kubernetes cp metrics #7158
CNTRLPLANE-1904: Migrate 4.16 pipelines to common pipeline template #7212
Full changelog

ibm-cloud-controller-manager

OCPBUGS-120701: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #116
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-79964: Bump google.golang.org/grpc to v1.79.3 #145
OCPBUGS-77210: [release-4.16] standardize build paths #124
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-102992: Use patched x/net fork v0.35.0-sec.4 #187
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-103009: Replace golang.org/x/net with openshift-sustaining/net #170
OCPBUGS-115544: Fetch envtest assets from the controller-tools releases #181
OCPBUGS-67288: [release-4.16] Fix incomplete vendor/ #138
Full changelog

ibmcloud-machine-controllers

OCPBUGS-103003: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 #106
NO-JIRA: fix unit tests broken by deprecated kubebuilder-tools bucket #113
Full changelog

insights-operator

OCPBUGS-68370: Add filtering to add other possible pod status to QEMU gatherer #1200
OCPBUGS-67009: QEMU logs are not gathered if there are pending status virt-launcher pods #1197
Full changelog

ironic

OCPBUGS-85333: update ironic-image commit hash to address CVE-2026-43003 #912
OCPBUGS-100162: bump openstack-ironic pin for CVE-2026-44918 fix #908
OCPBUGS-104459: bump openstack-ironic pin for CVE-2026-54423 fix(release-4.16) #877
OCPBUGS-76457: Bump pyasn1 to 0.5.1-4 #828
OCPBUGS-69789: Bump eventlet version to 0.33.1-7 #763
Full changelog

ironic-agent

OCPBUGS-85333: Update ironic-python-agent commit hash to address CVE-2026-43003 #316
OCPBUGS-99890: Bump ironic-python-agent pinned commit for CVE-2026-66138 #310
OCPBUGS-95070: Replace individual package removal with a single rpm -e loop #288
OCPBUGS-95070: Replace dnf remove with rpm -e to prevent dependency removal #276
OCPBUGS-61165: netutils: Use ethtool ioctl to get permanent mac address #215
OCPBUGS-69781: Bump eventlet version to 0.33.1-7 #232
Full changelog

kube-metrics-server

NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #85
OCPBUGS-79929: Bump google.golang.org/grpc to v1.79.3 #66
Full changelog

kube-state-metrics

NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #192
OCPBUGS-74875: Deduplicate CRS stores #133
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-95082: OWNERS: Update component to Cloud Compute / KubeVirt Provider #82
Full changelog

kubevirt-csi-driver

OCPBUGS-79930: Bump google.golang.org/grpc to v1.79.3 #108
Full changelog

libvirt-machine-controllers

OCPBUGS-77196: Fix incomplete vendor/ #302
Full changelog

machine-api-operator

OCPBUGS-103044: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #1547
OCPBUGS-98439: Use resource group when generating default Azure image #1516
OCPBUGS-76849: bumped logrus to v1.9.3 #1463
Full changelog

machine-config-operator

OCPBUGS-98960: Remove sensitive ControllerConfig logging #6315
OCPBUGS-98253: Bootstrap MCS logging entire ignition #6290
OCPBUGS-62171: Fix - NetworkManager restart or crash renders br-ex unusable #5354
OCPBUGS-60113: Enable debug logging for nodeip-configuration #5218
OCPBUGS-77253: Machine-config controller should not log about non-existent pull-secret changes #5694
OCPBUGS-77184: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5685
OCPBUGS-63155: [release-4.16] Networking: reset ovn-remote config and allow ovnkube controller to set it #5359
OCPBUGS-60773: scope MCD node listers to current node #5260
OCPBUGS-63553: Add control-plane label for master nodes on legacy clusters #5376
OCPBUGS-57423: pkg/operator/status: Drop PoolUpdating as an Upgradeable=False condition #5119
Full changelog

machine-image-customization-controller

OCPBUGS-103007: Use patched x/net fork v0.35.0-sec.4 #191
OCPBUGS-68093: [4.16] uplift logrus #153
Full changelog

machine-os-images

OCPBUGS-87878: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #102
Full changelog

monitoring-plugin

OU-1589: [release-4.16] sanitize linkified URLs in alert annotations #1377
OCPBUGS-118240: [release-4.16] Bump fast-uri to 3.1.7 to fix CVE-2026-84292 #1337
OCPBUGS-127152: Replace react-linkify with linkify-react to fix CVE-2026-59887 #1356
NO-JIRA: [release-4.16] Sanitize alert runbook URLs #1292
Fix for OCPBUGS-113514: CVE-2026-18446 #1184
Fix for OCPBUGS-94001: CVE-2026-13676 #1049
Fix for OCPBUGS-90069 OCPBUGS-90073: CVE-2026-12151 CVE-2026-9697 #1007
OCPBUGS-79441: immutable bump #898
OU-1260: [release-4.16] feat: use npm instead of yarn #813
OCPBUGS-76807: fix for CVE-2025-69873 #849
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-85251: Fix server url in kubeconfig #300
NO-ISSUE: [release-4.16] Bump Go to 1.21 and fix CI build root image #292
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-70215: Prevent accidental IP deallocation in statefulsets #396
Full changelog

must-gather

OCPBUGS-86218: Collect object size with the object count #550
OCPBUGS-66106: Separate resources with comma to fix malformed inspect #515
Full changelog

oauth-apiserver

OCPBUGS-74112: UPSTREAM: <carry>: bump kubernetes-apiserver to pick up loopback cert expiration update #166
NO-JIRA: (chore): update OWNERS file #172
Full changelog

oauth-proxy

OCPBUGS-112100: bugfix: rewrite open redirect strings to ‘/’ #386
Full changelog

oauth-server

OCPBUGS-87068: bugfix: default to english when Accept-Language header contains more than 1000 underscores #274
Full changelog

oc-mirror

OCPBUGS-129584: v1 accept catalog root entries and relative symlink targets #1581
Full changelog

olm-catalogd

OCPBUGS-103064: [release-4.16] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #149
Full changelog

openshift-apiserver

OCPBUGS-82682: Address CVE-2026-35469 #649
OCPBUGS-68104: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.16] #610
OCPBUGS-74113: UPSTREAM: <carry>: bump kubernetes-apiserver to pick up loopback cert expiration update #595
OCPBUGS-63394: Wire dry run option to Image API server operations #566
Full changelog

openshift-state-metrics

NO-ISSUE: synchronize OWNERS from main branch #144
Full changelog

openstack-machine-api-provider

OCPBUGS-78170: hermetic 4.16 #163
OCPBUGS-76794: Fix make test #155
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-103065, OCPBUGS-103070, OCPBUGS-103078: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1367
OCPBUGS-79980, OCPBUGS-79981, OCPBUGS-87898: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.67.3-sec.1 [release-4.16] #1318
OCPBUGS-82057: Drop github.com/distribution/distribution dep #1302
OCPBUGS-77959: Remove the collect-profiles info from the microshift kustomization file #1251
OCPBUGS-77169: Remove the collect-profiles job #1235
Full changelog

operator-marketplace

OCPBUGS-68108, OCPBUGS-68109: CVE-2025-65637 fixed in logrus v1.9.3+ #722
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-128828: node: fix serviceUpdateNotNeeded nil pointer comparison #3497
OCPBUGS-83497: External gateway: Remove routes for external gateway pods in terminating or not ready state #3140
OCPBUGS-78033: Add pperiyasamy to OWNERS for release-4.16 #3047
OCPBUGS-77685: Clear stale conntrack UDP entries for nodePorts #3038
OCPBUGS-77187: Fix conntrack reconciliation to use service port instead of endpoint port #2998
CORENET-6055, OCPBUGS-76277: [release-4.16] Dockerfile: Unpin OVN and consume the latest from FDP #2972
OCPBUGS-71219: [release-4.16] CVE-2025-65637 Bump github.com/sirupsen/logrus to v1.9.1 through indirect dependency conversion (go-controller module) #2906
OCPBUGS-72541: NetPol & MultiNetPol: Process update only when spec fields and/or related annotation are updated #2933
OCPBUGS-68349: Add ricky-rav to OWNERS for release-4.16 #2899
OCPBUGS-66155: Skip Pending pods in EgressIP status updates #2880
OCPBUGS-64944: [release-4.16]: Configure sec nic EIPv6 address with NODAD and maximum lifetime #2853
OCPBUGS-64858: Fix stale EIP assignments during failover and controller restart #2851
OCPBUGS-63155: Fix EgressIP stale GARP post reboot + pod restart #2809
OCPBUGS-63230: Fix dnsnameresolver address set #2812
Full changelog

powervs-block-csi-driver

OCPBUGS-105268: Mitigate CVE-2025-30204 by bumping github.com/golang-jwt/jwt/v4 to v4.5.2 #139
Full changelog

prom-label-proxy

NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #404
Full changelog

prometheus

OCPBUGS-93677: fix for CVE-2026-42151 #395
NO-ISSUE: synchronize OWNERS from main branch #387
OCPBUGS-88616: remote: validate snappy decoded length before allocation in read endpoint #349
OCPBUGS-79985: Bump google.golang.org/grpc #321
Full changelog

prometheus-alertmanager

OCPBUGS-98169: bump github.com/hashicorp/memberlist to a forked version to fix CVE-2026-14362 #203
NO-JIRA: synchronize OWNERS with main #188
OCPBUGS-103072: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #174
OCPBUGS-100357: Set testdata CA expiry to 20 years from issue date (#4112) #146
OCPBUGS-76536: Include go-verify-deps expected files in gitignore #116
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

NO-ISSUE: synchronize OWNERS from main branch #420
OCPBUGS-103085, OCPBUGS-103089: [release-4.16] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #401
Full changelog

prometheus-node-exporter

OCPBUGS-103088: Use patched x/net fork v0.35.0-sec.4 #194
NO-ISSUE: synchronize OWNERS from main branch [release-4.16] #203
Full changelog

route-controller-manager

OCPBUGS-79934: Bump google.golang.org/grpc to v1.79.3 #87
Full changelog

tests

OCPBUGS-130858: stage the creation of test pods to minimize etcd impact #31742
OCPBUGS-105460: Use tagged version for openshift/kubernetes dependency #31541
OCPBUGS-74299: Update to latest openshift/kubernetes #30825
OCPBUGS-63395: Backport pr 29834 to release-4.18 #30409
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-78028: hermetic migration 4.16 #107
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-78020: hermetic migration 4.16 #86
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-86874: Bump google.golang.org/grpc #182
OCPBUGS-68119: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #158
Full changelog

vsphere-csi-driver-operator

OCPBUGS-103111: Bump golang.org/x/net to v0.35.0-sec.3 #358
Full changelog

vsphere-problem-detector

OCPBUGS-103110: Bump golang.org/x/net to v0.35.0-sec.4 #235
OCPBUGS-86445: fix concurrent map writes #219
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github