4.12.93

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.12.93-x86_64

Team Approvals:

Accepted
- QE

Tests:

Blocking jobs
- upgrade Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-sdn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.12-e2e-aws-sdn-serial
- azure-ovn-upgrade-4.12-micro Failed (3 retries) periodic-ci-openshift-release-main-ci-4.12-e2e-azure-ovn-upgrade
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.12-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.12-fips-payload-scan
- gcp-sdn-upgrade-4.12-micro Failed (3 retries) periodic-ci-openshift-release-main-ci-4.12-e2e-gcp-sdn-upgrade
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.12-e2e-metal-ipi-ovn-ipv6
- metal-ipi-sdn-ipv4 Succeeded periodic-ci-openshift-release-main-nightly-4.12-e2e-metal-ipi-sdn-ipv4

Upgrades from:

Untested upgrades: 4.11.14, 4.11.16, 4.11.17, 4.11.18, 4.11.19, 4.11.20, 4.11.22, 4.11.23, 4.11.24, 4.11.25, 4.11.26, 4.11.27, 4.11.28, 4.11.29, 4.11.30, 4.11.31, 4.11.32, 4.11.33, 4.11.34, 4.11.35, 4.11.36, 4.11.37, 4.11.38, 4.11.39, 4.11.40, 4.11.41, 4.11.42, 4.11.44, 4.11.45, 4.11.47, 4.11.48, 4.11.49, 4.11.50, 4.11.51, 4.11.52, 4.11.53, 4.11.54, 4.11.55, 4.11.56, 4.12.10, 4.12.11, 4.12.12, 4.12.13, 4.12.14, 4.12.15, 4.12.16, 4.12.17, 4.12.18, 4.12.19, 4.12.20, 4.12.21, 4.12.22, 4.12.23, 4.12.24, 4.12.25, 4.12.26, 4.12.27, 4.12.28, 4.12.29, 4.12.3, 4.12.30, 4.12.31, 4.12.32, 4.12.33, 4.12.34, 4.12.35, 4.12.36, 4.12.37, 4.12.38, 4.12.39, 4.12.4, 4.12.40, 4.12.41, 4.12.42, 4.12.43, 4.12.44, 4.12.45, 4.12.46, 4.12.47, 4.12.49, 4.12.5, 4.12.50, 4.12.51, 4.12.53, 4.12.54, 4.12.55, 4.12.56, 4.12.57, 4.12.58, 4.12.59, 4.12.6, 4.12.60, 4.12.61, 4.12.62, 4.12.63, 4.12.64, 4.12.65, 4.12.66, 4.12.67, 4.12.68, 4.12.69, 4.12.7, 4.12.70, 4.12.72, 4.12.73, 4.12.74, 4.12.75, 4.12.76, 4.12.77, 4.12.78, 4.12.79, 4.12.8, 4.12.80, 4.12.81, 4.12.82, 4.12.83, 4.12.84, 4.12.86, 4.12.87, 4.12.88, 4.12.89, 4.12.9

Upgrades to:

4.13.0-0.ci-2026-07-01-210307 (changes) - Success

Loading changelog, this may take a while ...

Changes from 4.12.48

Created: 2026-07-01 09:05:03 +0000 UTC

Image Digest: sha256:746f1a33a0b89a5489916b10366777b2672b65cfcd0cdfaffe5a710e3aa15f35

Components

Kubernetes 1.25.16
Red Hat Enterprise Linux CoreOS upgraded from 412.86.202401201721-0 to 412.86.202606251120-0 (diff)

Rebuilt images without code change

alibaba-cloud-csi-driver git 4d3b1125 sha256:efb872406f5366868112ee15a8eed933c744582823baab5eace75f518dd4f453
alibaba-disk-csi-driver-operator git 99bcda8d sha256:dc677de74473d97426b4f8125c3f7253ecb6b50c4e893d108f44f26569f16af3
azure-cloud-controller-manager git 2193ccfa sha256:5f4ab64b7f83467310e30953c0f330022ae5847bd03c8c1fbe4985c99e620e5e
azure-cloud-node-manager git 2193ccfa sha256:ac821b44ad51df246f239a8316017297868c211cdcf16a9d89757a49c615cca8
azure-disk-csi-driver-operator git 988b8cc8 sha256:0d76b81b821646f4c935735c604c149869cbbccdf526aa447c3ea1dc8c36a650
azure-file-csi-driver git 15aade4d sha256:9191e287caa01d739272eb3c1c40dca80d43d10ea2a1c00ee8db064441ca1ea4
baremetal-runtimecfg git 474ed48e sha256:f6210485d67113cce6fe355f307963c2c87e4605d3fbd6149bfe06775995ae10
cluster-bootstrap git 138a1cf2 sha256:0edea1accbf32dd13d55e18adeb160b992d1d28d226b6c35754f259f78a81c69
cluster-cloud-controller-manager-operator git 3b1f0843 sha256:5ff8cb793f6cc94320e12b06697fd3f65a5c8679b3c40d463f34b15111be0781
cluster-kube-cluster-api-operator git d50f7322 sha256:9dee0cae58a5a3c58030a26dc00037ea3a62fe5700c172d8712140e1569c4045
cluster-kube-controller-manager-operator git c3c07beb sha256:5f864db5d6f69d23b52cd21271c5507cb65ee646131b9e3a95a0079f68b2417e
cluster-machine-approver git 7b08a4de sha256:dab64390ab38d92cdfddcfcca956a0fa1614f347667e73b4ceff52d74e58733b
cluster-openshift-controller-manager-operator git ab963d8a sha256:eb378eca93d94f923a0605f18412718a23df3415831d14841c5c19e380bc9495
cluster-platform-operators-manager git c930dc74 sha256:d20b1c4d9fd363a17e90a1d5d8930c2f243a56bdb04518936642460ea004cbc6
cluster-policy-controller git cb8862b0 sha256:f509c46ca51b03909430ba553f5f9abc50bbed64a59de310f291548af5a0e9d2
cluster-update-keys git 2796e173 sha256:5fd8c559f13e96a23ff870b4e486f323ec7811b042dca8801a338b8a85fdb075
configmap-reloader git e4d9170e sha256:188e5642e1f263e2bfdd12999adfe817debf55abd233e63e13eadb4c1dbc259a
csi-external-attacher git fac7b8fd sha256:7b90a74db50532c5407fc46a1997061fadb0861371daabb9fa4ab9aa65d5ea8f
csi-external-provisioner git 3aa7c527 sha256:5125ae6238560acaf3983b982b296b4f176e03af9b97a000e18a75102ed4307d
csi-external-resizer git 5b066ba4 sha256:81f83e6de979491d4fcb1317943e22976257265d7dfee0b759398cca26edaf8c
csi-livenessprobe git e6545e71 sha256:e3a7a2b831c8dfca5621dbcaae9f06a15c689f7cd6adfb8328b84497e6a75002
csi-node-driver-registrar git c316b896 sha256:b227f4af59bc3c284876a71b270788fd0379ce224719d2b2d99c47520c5753bc
egress-router-cni git a92e4157 sha256:840c527e75c4f5c328403fc77c8fd562f46f88f622818e33b1883006aed641fe
gcp-cloud-controller-manager git 8a84952e sha256:3b97ec60030e5893e42be65238b2cc39416807e3892a4eac76dee904528dc822
gcp-pd-csi-driver git 5dcfd675 sha256:99b29bc860da128a03109ab20e6a7a6712e4d846242db118eb31e781adde6fd9
gcp-pd-csi-driver-operator git 30e97ba5 sha256:ff4db1c722479738f8c71b1629fad3a296b2fefe6279982e48ddd1ac141c5f51
ibm-cloud-controller-manager git 8bd0ea8f sha256:b404a622bf9a87b0286c15e52361bbb69f7888cd77c428776ccf97835c1445ea
ironic-machine-os-downloader git c65c1f1c sha256:05942253c7435ba7e12b5ff43643750a0ec4b7b7cd984d0734a16de480d3184e
ironic-static-ip-manager git a8ade8fe sha256:de7a47f3b1f2cd468c124e2404cf6a77a60d3dd0b3cedea4c627b8656781e16c
k8s-prometheus-adapter git 36c06694 sha256:fd3175da59ceebe7571d3c438c2f81ad941497cf871eb3e89c896acf32858461
keepalived-ipfailover git 7e8a0105 sha256:5956b24191992ea9673b80d3647f8a46183bd8039eb7b908256a15c2c92496af
kube-state-metrics git 748f7131 sha256:aa07934591aff546c4cba7de9500425dcb2c0c59478f2538174eedccc7ecd815
kubevirt-cloud-controller-manager git a19615cd sha256:70f238836b887dc3a3584532076c7501bce81864a71b77760e0473a098d9a98e
kubevirt-csi-driver git f407c8a7 sha256:1af41fe7128a75b075567072c87902ed63402cdf1650121abeaba833c752e993
kuryr-cni git 8fd2f8b0 sha256:eec731aefdec7e28c1e05ab5b6f3deb914508a3f235d93c679a80d42a81605d7
kuryr-controller git 8fd2f8b0 sha256:22c19329d9c1dfb71a78255b6be78ecd76e378bda56f985bd19e0bd93d823118
libvirt-machine-controllers git a2882f7a sha256:b72e3157a99278b2a19a6acbd50bc14546b9b88d1ac31402d64c54af89ab96ef
machine-os-content sha256:6b0ba38d0954110004d656e2cd708ca5dfb68a6ba062cc51b082fa3e8a23e656
multus-networkpolicy git 644461f2 sha256:ff48f2af627ba25245df151e5a09b6e6f04668c7ad884c5575f12b8b6f17f943
network-interface-bond-cni git 30386d6b sha256:027dfa3c55c822a6ff05e244cf0a8ad73d3e776d99d92489cbd38304ee735230
network-tools git c76613c7 sha256:491e90ac0f7ba1e29953be7764e6cfd062014378e8d3fcf40778ddc411e88f04
oauth-proxy git 03e5b13b sha256:e15e8c6ae26987295283d08fc5a4528e4c09062fa93ed31af1df0032eb4d6a23
openshift-state-metrics git 3d5dc18d sha256:13077cc14c1c8ba5909291c3ae34093bada5ef54e3fd0da050aa19de31d7c0d9
openstack-machine-api-provider git 05657663 sha256:56f315d87a6f27ecc79399095af7cb4519f6f78cb32af0fae80eac2743d14b87
openstack-machine-controllers git f13e381e sha256:3df6c563c9724d961e537c0cc878429ed2ee6010a956c833a51f08dd5ae5a0d0
ovirt-csi-driver git 87ab3789 sha256:dc86be617dd1a4d3995f93f3aacac0d4ade6363e8bc7a1c1825b72d5da44eed2
ovirt-machine-controllers git 03e8cb50 sha256:8f72f27863a8e6c50163c48b33f98c229aeea75ef8df623ab6e93064ae2bebbf
powervs-block-csi-driver git b78e8e78 sha256:61f53c037634e4a3bf5c77fe40215640fd24591d7a3c046931182cea77aefe85
powervs-cloud-controller-manager git 4fb4334c sha256:ee7db2acc889079cf5a814d47c8e12cc7b9bd0443eeac25ca1eb808dd8fe7dfb
prom-label-proxy git b1907888 sha256:46cf946a700c169961d196b6ba27a0276741d1d946f3418801ec247f9ec431dd
prometheus-config-reloader git d1e399d5 sha256:cc4d6cb612bdb96cb2eaf53763f7b315855c36b804ccbb4b54426209d0c7e9e2
prometheus-node-exporter git 99077a3c sha256:b336202e6b2ddce878c78bd67ce21ea1ed5281ff1302d41a3d457af7195fe922
prometheus-operator git d1e399d5 sha256:bd7f215f3d464c5e81d035da235d0f8797b42d4ce6afd94e9c75d4a24b721f24
prometheus-operator-admission-webhook git d1e399d5 sha256:5636536e3ff8cc8d3ca1bbe6d551c8179bfd7a45c9e5c7f652863c9988eb6b66
rhel-coreos-8 sha256:eac6a070790f65e7b967aaef5f349eeca667908374db5bbc39bfee5fa46f0966
rhel-coreos-8-extensions sha256:05d5bc56d7aab0f3a432f31f1843d37a39225ee332fbf6ed0dd47594f69809b0
route-controller-manager git 0f141ce9 sha256:9f84b055c2ce211396be9640e6fd22dce9120ba9fe9a4209399a6fdefc1400e0

agent-installer-api-server

OCPBUGS-78114: [release-4.12] NO-JIRA: hermetic 4.12 #9956
OCPBUGS-67386: Bump logrus from 1.9.0 to 19.3 #8768
And 6 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-67388: Bump logrus v1.9.0 to v1.9.3 #1465
And 5 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-node-agent

OCPBUGS-67390: Bump logrus v1.9.0 to v1.9.3 #1287
And 5 elided commits (e.g. from squash or rebase merges)
Full changelog

alibaba-cloud-controller-manager

OCPBUGS-21218: Bump golang.org/x/net to v0.19.0 #45
Full changelog

alibaba-machine-controllers

Updating ose-alibaba-machine-controllers images to be consistent with ART #35
Full changelog

apiserver-network-proxy

OCPBUGS-38066: Revert “Agent: Respect HTTPS_PROXY env vars for proxied connections” #61
OCPBUGS-31984: Bump golang.org/x/net to v0.23.0 #52
Full changelog

aws-cloud-controller-manager

OCPBUGS-32079: update for CVE-2023-45288 [release-4.12] #85
Full changelog

aws-cluster-api-controllers

OCPBUGS-78231: [release-4.12] hermetic 4.12 #595
Full changelog

aws-ebs-csi-driver

OCPBUGS-33457: UPSTREAM: 1919: Add reserved-volume-attachments #267
Full changelog

aws-ebs-csi-driver-operator

OCPBUGS-67399: Updated logrus to v1.8.3 #315
OCPBUGS-33457: Explicitly reserve 1 attachment for the root disk #308
Full changelog

aws-machine-controllers

OCPBUGS-78268: hermetic 4.12 #176
OCPBUGS-24564: Reduce metrics cardinality #97
Full changelog

aws-pod-identity-webhook

OCPBUGS-32880: Upgrade go-jose module to 2.6.3 #191
Full changelog

azure-cluster-api-controllers

OCPBUGS-78180: [release-4.12] Hermetic 4.12 #368
OCPBUGS-36021: Update go-retryablehttp to v0.7.7 #315
Full changelog

azure-disk-csi-driver

OCPBUGS-56067: tech debt: rework vendor patches #106
Full changelog

azure-file-csi-driver-operator

OCPBUGS-67404: Bump github.com/sirupsen/logrus to v1.8.3 #116
Full changelog

azure-machine-controllers

OCPBUGS-78266: hermetic 4.12 #188
OCPBUGS-36148: Fix mapi_instance_create_failed metric with accelerated networking #115
OCPBUGS-30809: Don’t create availability set when using spot instances #105
OCPBUGS-24564: Reduce cardinality #97
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-83750: Azure UPI ARM template: use storageAccountId #10511
OCPBUGS-78352: terraform/providers/google: Fixing inconsistencies with the service account creation #10385
OCPBUGS-66250: Replace terraform-provider-google with Openshift fork #10144
OCPBUGS-62820: Release 4.12 bump terraform provider azurerm #10002
OCPBUGS-55035: IBMCloud: Move to IBM TF openshift fork #9670
OTA-1310: data/manifests/bootkube/cvo-overrides: Default to eus-4.12 #9373
OCPBUGS-36087: [release-4.12]: bump go-retryablehttp for CVE fix #8660
OCPBUGS-39290: Add yq v4 to ci image #8929
OCPBUGS-36179: [release-4.12]: bump github.com/container/images for CVE fix #8663
OCPBUGS-22981: IBMCloud: Add eu-es region #7686
OCPBUGS-30630: baremetal: populate customDeploy in advance #8144
OCPBUGS-32449: Updated libvirt installer to include multi-arch yq and symlink for backwards compatibility #8290
OCPBUGS-30768: update RHCOS 4.12 bootimage metadata to 412.86.202402272018-0 #8140
OCPBUGS-30134: [release-4.12] bump containerd for vulnerability fix #8091
OCPBUGS-27454: baremetal: correct external_http_url for v6-only BMCs #7900
Full changelog

baremetal-machine-controllers

OCPBUGS-78103: [release-4.12] fix vendor/ for hermetic migration #247
OCPBUGS-46642: Bump x/net to 0.33.0 #230
Full changelog

baremetal-operator

OCPBUGS-53335: CVE-2025-29781 ose-baremetal-operator-container: Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD [openshift-4.12.z] #412
OCPBUGS-30630: Do not update instance_info and deploy_interface for active nodes #338
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-30289: oc adm catalog mirror: use ToSlash and FromSlash to unify the path separators #1701
Full changelog

cloud-credential-operator

OCPBUGS-53420: github.com/golang/glog v1.2.4 #847
OCPBUGS-51538: Ignore SNYK-GOLANG-GOLANGORGXOAUTH2JWS-8749594 due to not being affected #832
OCPBUGS-37322: update modules: grpc, protobuf, logrus #764
OCPBUGS-42166: Resolve SNYK errors in security job. #760
OCPBUGS-37422: SNYK ignore go-client misreporting #744
NO-JIRA: Add jstuever to OWNERS #733
OCPBUGS-36027: IBM/go-sdk-core update to v5.17.4 #723
OCPBUGS-32897: Upgrade go-jose module to 2.6.3 #699
Full changelog

cloud-network-config-controller

OCPBUGS-33198: Avoid nil pointer panic while assigning private IP on Azure #141
Full changelog

cluster-authentication-operator

OCPBUGS-20683: CVE 2023 39325 [4.12] #653
Full changelog

cluster-autoscaler

OCPBUGS-45152: [release-4.12] VPA: Update OWNERS file #329
OCPBUGS-40928: update VPA golang.org/x/net for http rapid reset for CVE-2024-8421 #318
OCPBUGS-30911: Fix unstructured taint parsing in Cluster API provider #291
Full changelog

cluster-autoscaler-operator

OCPBUGS-32005: Update x/net to v0.25.0 #325
Full changelog

cluster-baremetal-operator

OCPBUGS-77451: Bump github.com/go-errors/errors to v1.5.1 #566
OCPBUGS-32006: bump x/net to 0.23.0 #440
Full changelog

cluster-capi-controllers

OCPBUGS-86891: update CI build root and Dockerfile tags w.r.t ART 4.12 streams #299
OCPBUGS-77976: fix vendor for hermetic #267
Full changelog

cluster-capi-operator

NO-JIRA: Allow sustaining engineering to self serve dependency updates #564
Full changelog

cluster-config-operator

OCPBUGS-16243: retire LatencySensitive featureset #336
Full changelog

cluster-control-plane-machine-set-operator

OCPBUGS-48325: Add unreadyNodeGracePeriod for allowing brief node hiccups #344
OCPBUGS-35421: Improved debugging of API listing errors #306
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-32429: create suitable role and roleBinding for csi-snapshot-webhook #207
Full changelog

cluster-dns-operator

OCPBUGS-52502: [release-4.12] Add runbook_url for CoreDNSErrorsHigh #435
Full changelog

cluster-etcd-operator

OCPBUGS-67421: Update logrus to 1.9.3 to address CVE-2025-65637 #1550
OCPBUGS-53508: fix CVE-2025-30204 #1416
OCPBUGS-35501: return errors in wait-for-ceo #1277
OCPBUGS-32001: update golang x net #1256
OCPBUGS-30914: Replace nodelister with master nodelister everywhere #1224
OCPBUGS-30938: fix panic in health check timeouts #1228
OCPBUGS-27776: [4.13] Remove z-upgrades from UpgradeBackupController #1185
OCPBUGS-23151: relax readiness to local serializable requests #1156
Full changelog

cluster-image-registry-operator

OCPBUGS-67422: Bump logrus to 1.8.3 #1292
OCPBUGS-53868: Bump github.com/golang-jwt/jwt #1236
OCPBUGS-51594: bump golang.org/x/oauth2 #1223
OCPBUGS-36033: go.*,vendor: bump go-retryablehttp #1071
Full changelog

cluster-ingress-operator

OCPBUGS-43703: Add e2e test for duplicate Transfer-Encoding headers #1158
OCPBUGS-43703: Add alert for RFC 7230 violation in Transfer-Encoding headers #1162
OCPBUGS-35454: internal service changed fix target port logic #1092
OCPBUGS-35304: TestHostNetworkPortBinding: Delete t.Parallel() #1083
OCPBUGS-35027: Don’t add clientca-configmap finalizer if deleting #1080
OCPBUGS-34888: desiredRouterDeployment: Set HostPort if needed #1076
OCPBUGS-34757: Avoid spurious updates for internalTrafficPolicy #1070
OCPBUGS-34110: Avoid spurious updates for scope in IngressClass #1056
OCPBUGS-34548: Use centos7 tag for quay.io/centos7/httpd-24-centos7 image #1068
Full changelog

cluster-kube-apiserver-operator

NO-JIRA: refactor: Updating go builder in the CI, Dockerfile and go.mod to be consistent with ART 4.12 #2175
OCPBUGS-67424: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.12.z] #2048
OCPBUGS-50880: Increase waitForFallbackDegradedConditionTimeout #1811
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #628
OCPBUGS-27067: bump(library-go)=release-4.12 #529
Full changelog

cluster-kube-storage-version-migrator-operator

NO-JIRA: Reconciling the ART and CI go tool chain versions #173
OCPBUGS-67429: Bump github.com/sirupsen/logrus to v1.8.3 #143
Full changelog

cluster-monitoring-operator

OCPBUGS-76642: test: remove image registry e2e tests #2816
OCPBUGS-77403: test/e2e: improve prometheus remote-write test #2819
OCPBUGS-35558: label for infra nodes for metric cluster:capacity_cpu_cores:sum #2383
OCPBUGS-28766: fix generation of telemeter token hash #2306
Full changelog

cluster-network-operator

OCPBUGS-43872: manifests/02-cncc-credentials: Set skipServiceCheck for GCP #2548
OCPBUGS-38905: Add missing runbook for OVNKubernetesNorthdInactive #2479
OCPBUGS-37942: [release-4.12] update whereabouts crd #2461
OCPBUGS-29167: fix whereabouts conformance test failures #2256
OCPBUGS-29884: add env var in whereabouts-reconciler daemonset #2284
OCPBUGS-29302: Update ingressconfig_controller to use field Manager #2268
OCPBUGS-28801: [release-4.12] Add ConfigMap mount to the whereabouts-reconciler DaemonSet #2244
NO-JIRA: add kyrtapz as reviewer and approver for release 4.12 #2230
Full changelog

cluster-node-tuning-operator

irqbalance: set banned cpus list to 0 (#1006) #1006
Refactor IRQ load balancing enable/disable test (#1038) #1038
Scheduler plugin: ignore IRQs (#1034) #1034
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-76594: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.12] #660
Full changelog

cluster-samples-operator

OCPBUGS-63521: references to github.com/sclorg/django-ex.git now also refer to the branch #663
OCPBUGS-54913: add rhdmalone to owners #629
OCPBUGS-49664: add shannon and aroyoredhat as owners #600
OCPBUGS-21179: update k8s.io/apiserver version #590
Full changelog

cluster-storage-operator

OCPBUGS-67444: Bump logrus to v1.8.3 #657
Full changelog

cluster-version-operator

OCPBUGS-45333: deps: bump golang.org/x/net to 0.31.0 #1122
OCPBUGS-27443: pkg/cvo/availableupdates: Only bump LastAttempt on Cincinnati pulls #1024
Full changelog

console

OCPBUGS-79430: CVE-2026-29063 Bump immutable #16331
ART-18753: pin fsevents to latest #16482
NO-JIRA: enable multi-architecture yarn builds #16422
NO-JIRA: Updating openshift-enterprise-console-container image to be consistent with ART for 4.12 #12539
CONSOLE-5011: migrate to yarn berry #16084
NO-JIRA: Bump builder image to v29 #15988
OCPBUGS-74435: Bump lodash to latest #15973
OCPBUGS-44155: bump dompurify to latest #15595
OCPBUGS-57101: Add all files to vendor regardless of gitignore #15137
OCPBUGS-55210: Show Observe section without PROMETHEUS and MONITORING flags #14986
Dockerfile yarn line update #14838
OCPBUGS-45291: Application creation fail when manually entering input scaling value in local setup #14572
OCPBUGS-45235: Edit the secret and add the Chinese in the web-console, garbled characters will be displayed #14561
OCPBUGS-36561: Increase login flow state paramater length/entropy #14539
OCPBUGS-43639: Copy response code from proxied plugin requests #14423
OCPBUGS-33519: Observe > Metrics targets, Alert user if they do not have access to information on this page (e.g. 403). #14334
OCPBUGS-41600: Fix plugin proxy handler #14266
OCPBUGS-41854: Redirects to new PipelineRun logs URL from old PipelineRun logs URL #14283
OCPBUGS-34564: Routes created by devfiles do not always use HTTPS #13907
OCPBUGS-34933: Helm Plugin’s Catalog incorrectly renders a single index entry into multiple tiles #13930
OCPBUGS-32146: Bump graphql-go to v1.3.0 #13923
OCPBUGS-34845: Fix PipelineRun Logs tab navigation #13920
OCPBUGS-33778: fix issues with Edit Route form #13859
OCPBUGS-27479: Bump helm pkg #13528
OCPBUGS-29746: Add Pipeline metrics tab using plugin #13621
OCPBUGS-29348: Added Proxy to non k8s endpoints #13600
Full changelog

console-operator

Updating openshift-enterprise-console-operator-container image to be consistent with ART for 4.12 #1137
OCPBUGS-77996: [release-4.12] NO-JIRA: update go mod dependency for konflux #1119
OCPBUGS-33386: Reset console operator’s conditions #898
OCPBUGS-20988: Disable HTTP/2 for webhook #876
OCPBUGS-30990: [release-4.12] Bump library-go and golang.org/x/net #867
Full changelog

container-networking-plugins

ART-13080: Fix Hermeto build issues #198
Full changelog

coredns

OCPBUGS-59711: Bump github.com/golang/glog to v1.2.4 #151
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-79763: Apply code mitigations for CVE-2026-33186 #401
OCPBUGS-67448: CVE-2025-65637 #365
OCPBUGS-58889: CARRY: don’t ignore json files #345
And 13 elided commits (e.g. from squash or rebase merges)
Full changelog

csi-driver-manila-operator

OCPBUGS-67449: Bump logrus #255
OCPBUGS-30295: Fix selector for manila-csi-driver-controller-metrics service #228
Full changelog

csi-driver-nfs

OCPBUGS-84927: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 to avoid go version bump and fix CVE-2026-33186 #186
Full changelog

csi-driver-shared-resource, csi-driver-shared-resource-webhook

OCPBUGS-28953: Replace ‘coreydaley’ with ‘sayan-biswas’ in OWNERS file #169
Full changelog

csi-driver-shared-resource-operator

OCPBUGS-28959: Replace ‘coreydaley’ with ‘sayan-biswas’ in OWNERS file #105
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-29244: cherry-pick:release-4.12: OCPBUGS-29244 Update VolumeSnapshot and VolumeSnapshotContent using JSON patch #140
Full changelog

docker-builder

OCPBUGS-43296: Bump buildah to 1.26.9 #449
OCPBUGS-43187: runc library bump to 1.1.12 #440
OCPBUGS-49345: skipping some unit tests to avoid failures as they are duplicate #437
OCPBUGS-48738: Add new team members to the OWNERS file #433
Replace ‘coreydaley’ with ‘sayan-biswas’ #408
BUILD-854: Add adambkaplan as approver #406
Full changelog

docker-registry

OCPBUGS-53652: bump jwt and oauth dependencies #442
Full changelog

driver-toolkit

OCPBUGS-63597: Remove realtime kernel from 4.12.z #176
Full changelog

etcd

OCPBUGS-28736: Rebase etcd 3.5.12 openshift 4.12 #246
Full changelog

gcp-cluster-api-controllers

OCPBUGS-78284: [release-4.12] hermetic migration 4.12 #278
OCPBUGS-78284: [release-4.12] hermetic migration 4.12 #271
Full changelog

gcp-machine-controllers

OCPBUGS-78183: hermetic 4.12 #143
OCPBUGS-24564: Reduce metrics cardinality. #76
Full changelog

haproxy-router

OCPBUGS-74943: Adding escapeHAProxySingleQuotes for sanitize [release-4.12] #784
OCPBUGS-78110: [release-4.12] hermetic 4.12 #744
OCPBUGS-43703: add duplicate_te_header_total metric #632
OCPBUGS-35875: Properly handle rewrite-target annotation #610
OCPBUGS-33432: Route ‘haproxy.router.openshift.io/timeout’ value is not validated #593
OCPBUGS-34212: Reject routes with MD5 certs #601
OCPBUGS-33517: Count active services before setting weight to 1 #581
Full changelog

hyperkube, pod

OCPBUGS-77661: Skip E2e: attach on previously attached volumes should work #2649
OCPBUGS-77469: hermetic 4.12 #2652
OCPBUGS-67374, OCPBUGS-67472: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 [4.12] #2596
OCPBUGS-78226: UPSTREAM: 133262: Remove permafailing tests using an expired GCP project #2625
OCPBUGS-37282: UPSTREAM: 126104: Add funcs in pkg/filesystem/util that can actually … #2046
OCPBUGS-30454: CVE 2024-24786 #1974
UPSTREAM: <drop>: Bump golang.org/x/net to v0.23.0 #1940
Address CVE #13
OCPBUGS-15527: Prevent partially filled HPA behaviors from crashing kube-controller-manager #1887
Full changelog

hypershift

OCPBUGS-77768: fix vendor for hermetic 4.12 #7823
Updating ose-hypershift-container image to be consistent with ART for 4.12 #6976
OCPBUGS-41516: set Konnectivity cipher suites #4283
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-77214: [release-4.12] standardize build paths #128
OCPBUGS-58873: bump github.com/golang/glog to v1.2.4 #111
OCPBUGS-56067: tech debt: rework vendor patches #95
OCPBUGS-53908: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #88
OCPBUGS-36063: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #75
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-67476, OCPBUGS-67477: bump github.com/sirupsen/logrus to v1.8.3 #163
OCPBUGS-60058: [IBM VPC] set offlineExpansion to false in e2e test manifest #153
OCPBUGS-36069: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #124
Full changelog

ibm-vpc-node-label-updater

OCPBUGS-56067: tech debt: rework vendor patches #52
OCPBUGS-53540: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #48
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-67292: [release-4.12] Fix incomplete vendor/ #134
Full changelog

ibmcloud-machine-controllers

OCPBUGS-78276: hermetic 4.12 #79
Full changelog

insights-operator

OCPBUGS-32004: bump golang.org/x/net version (#932) #932
OCPBUGS-28519: Add extra check in ids to bypass validations (#906) #906
Full changelog

ironic

OCPBUGS-69787: Bump eventlet version to 0.30.2-5 #767
OCPBUGS-48145, OCPBUGS-48596: Bump jinja to 3.0.1-6.el9.2 #627
OCPBUGS-43949, OCPBUGS-43957: Bump python-waitress [4.12] #609
OCPBUGS-37766, OCPBUGS-39385: Include fixes for CVE-2024-44082 #586
OCPBUGS-38513: set min version for python3-webob #558
OCPBUGS-33373: bump werkzeug #547
OCPBUGS-34897: bump jinja2 #541
OCPBUGS-32362: [4.12] remove unused prometheus-exporter #489
OCPBUGS-32386: Use unix sockets by default for reverse proxy communication #477
OCPBUGS-29229: Fix Inspector iPXE config for IPv6 addresses #454
Full changelog

ironic-agent

OCPBUGS-69778: adding eventlet 0.30.2-5 #236
OCPBUGS-39385: Include fixes for CVE-2024-44082 #165
OCPBUGS-38513: set webob and bump werkzeug #153
OCPBUGS-29769: Always add ignition to set hostname on /etc/hostname #112
Full changelog

kube-proxy, sdn

OCPBUGS-56130: Handle openshift-host-network namespace as special when it modifies #657
OCPBUGS-20753: update x/net to v0.17.0 #615
Full changelog

kube-rbac-proxy

OCPBUGS-32000: CVE-2023-45288 [4.12] #106
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-11). #231
Full changelog

machine-api-operator

OCPBUGS-78271: hermetic 4.12 #1470
OCPBUGS-43872: install/0000_30_machine-api-operator_00_credentials-request: Set skipServiceCheck again for GCP #1305
OCPBUGS-32007: Update x/net to v0.25.0 #1257
Full changelog

machine-config-operator

OCPBUGS-77981: hermetic 4.12 #5734
OCPBUGS-58874: [release-4.12] Bump golang/glog to fix CVE-2024-45339 #5174
OCPBUGS-44325: Panic seen in CI job for MCC pod #4689
OCPBUGS-38382: [release-4.12] daemon/update: disable systemd unit before overwriting #4530
OCPBUGS-33665: Run resolv-prepender entirely async #4364
OCPBUGS-30829: Add existing kubeletconfig/ctrcfg mc-name-suffix annotation #4257
OCPBUGS-30823: Introduce kubelet-dependencies.target and firstboot-osupdate.target #4268
OCPBUGS-30329: set nodeStatusReportFrequency #4246
OCPBUGS-19659: After dual-stack conversion reconcile IPFamilies #3936
OCPBUGS-29366: release-4.12: fix nodeStatusUpdateFrequency #4180
OCPBUGS-29278: crio: drop automatic image cleanup on upgrades #4178
Full changelog

machine-image-customization-controller

OCPBUGS-67478: bumped logrus to v1.9.3 #161
Full changelog

machine-os-images

OCPBUGS-87882: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #106
OCPBUGS-54173: Change rhcos release browser url #61
Full changelog

multus-admission-controller

OCPBUGS-60292: Bump github.com/golang/glog to v1.2.4 #107
OCPBUGS-60850: Update owners #109
Full changelog

multus-cni

OCPBUGS-28520: Fix SAST scan issues for multus-cni-container [4.12] #225
Full changelog

multus-route-override-cni

OCPBUGS-78160: hermetic 4.12 #64
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-37942, OCPBUGS-38019: [release-4.12] Stateful fixes #310
OCPBUGS-28801: [release-4.12] Enable whereabouts config #244
OCPBUGS-16008: Cherry pick fix assignment 4.12 #238
Full changelog

must-gather

OCPBUGS-48086: Update owners #477
OCPBUGS-24523: [release-4.12] Add csi-proxy logs collection in must-gather for Windows nodes #394
Full changelog

network-metrics-daemon

-sOCPBUGS-59700:Bump github.com/golang/glog to v1.2.4 (#125) #125
Replace e2e test image (#134) #134
swtich golint install method (#133) #133
Correct 4.16 owners file (#131) #131
Full changelog

nutanix-machine-controllers

OCPBUGS-78158: hermetic 4.12 #132
OCPBUGS-51849: Fixing CVE-2025-22868 #121
OCPBUGS-47263: fixing CVE-2024-45338 #114
OCPBUGS-20956: bump golang.org/x/net to v0.17.0 #88
Full changelog

oauth-apiserver

OCPBUGS-32010: bump x/net to 0.24.0 #113
OCPBUGS-21049: Bump K8s to v1.25 #104
Full changelog

oauth-server

OCPBUGS-27478: bump osin deps #144
Full changelog

oc-mirror

changes the owners file (#1011) #1011
OCPBUGS-48513: e2e: use same version of crane as in go.mod (#1027) #1027
Bump version to include v5.11.0 of go-git (#825) #825
OCPBUGS-385: Capability to override default channel (#749) (#796) #749
OCPBUGS-19429: Fix cross EUS channel upgrade path calculation (#779) #779
Full changelog

olm-rukpak

: OCPBUGS-27593,OCPBUGS-27678: Update go-git to v5.11.0 #76
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

openshift-apiserver

OCPBUGS-76481: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.12] #614
OCPBUGS-79381: Fix image reference in TestImageStreamImportQuayIO #623
OCPBUGS-32447: ose-openshift-apiserver-container: golang: net/http, x… #481
: OCPBUGS-21429: Enable HTTP/2 CVE mitigation #399
Full changelog

openshift-controller-manager

OCPBUGS-58296: Inconsistencies in dependencies are fixed #410
OCPBUGS-58157: Set node-pullsecrets volume to read-only to protect image pull credentials #403
OCPBUGS-57171: Empty proxy variables are causing issues during the build #389
OCPBUGS-49644: Add new team members to the OWNERS file #364
OCPBUGS-41953: Add adambkaplan as approver #336
Full changelog

openstack-cinder-csi-driver-operator

OCPBUGS-67502: Bump logrus #191
Full changelog

operator-lifecycle-manager, operator-registry

OCPBUGS-86254: Drop github.com/distribution/distribution in go.mod #1312
OCPBUGS-61471: [release-4.12] Add NetworkPolicy as a supported kind #1054
OCPBUGS-61392: [4.12] e2e stability fixes #1087
OCPBUGS-46925, OCPBUGS-46932, OCPBUGS-47312: x/net bump to v0.34.0 [release-4.12] #943
NO-ISSUE: [release-4.12] Backport e2e fixes #880
OCPBUGS-38610: (fix) Resolver: list CatSrc using client, instead of referring to registry-server cache (#3349) #875
OCPBUGS-42161: adds paginating lister for evaluating CRs’ upgrade fitness versus new CRDs #873
OCPBUGS-41881: [CARRY] perform operator apiService certificate validity checks directly #866
OCPBUGS-32854: bump go-jose to v2.6.3 #782
OCPBUGS-35242: Unblock CI #773
OCPBUGS-27563, OCPBUGS-27568, OCPBUGS-27648, OCPBUGS-27653: bump go-git/v5 to 5.11.0 #688
OCPBUGS-27962: [CARRY] SSC RBAC #671
OCPBUGS-28229: Registry Pod Controller Flag #673
Full changelog

operator-marketplace

OCPBUGS-49426: Upgrade golang.org/x/net [release-4.12] #591
NO-ISSUE: Updating marketplace-operator images to be consistent with ART [4.12] #510
OCPBUGS-32081: update golang.org/x/net for CVE-2023-45288 #567
Full changelog

ovirt-csi-driver-operator

OCPBUGS-67542: Bump github.com/sirupsen/logrus to v1.8.3 #148
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

CORENET-6055, OCPBUGS-84636: [release-4.12] Dockerfile: Unpin OVN and consume the latest from FDP #3075
OCPBUGS-59935: Dockerfile: Remove ovs version pinning #2698
NO-JIRA: Updating ose-ovn-kubernetes-container image to be consistent with ART for 4.12 #2092
OCPBUGS-55951: Bump ovn and ovs to latest 23.06 and 3.1 respectively #2554
OCPBUGS-50502: EgressIP: Reload certificates for the grpc heatlhcheck server #2457
OCPBUGS-35876: [release-4.12] ipv6+all protocols conntrack flush #2214
OCPBUGS-29864: CVE-2022-41723: avoid quadratic complexity in HPACK decoding #2204
OCPBUGS-34273, OCPBUGS-34414: Improves service iptables efficiency on start up + ICMP error messages to pass through #2184
OCPBUGS-32990: Bump OVS #2144
OCPBUGS-33422: [release-4.12] Full implementation of KEP-1669 ProxyTerminatingEndpoints + ETP=local fix #2135
OCPBUGS-25889: [release-4.12] OVN bump to 23.06.1-112 #2154
OCPBUGS-23259: [release-4.12] Update leaderelection config to allow retries #2017
OCPBUGS-28598: CARRY: Updates owners and adds Surya #2034
OCPBUGS-26700: [release-4.12] fixes MTU configuration on gateway router #2015
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-67511: Fix CVE-2025-65637 by bumping logrus to v1.8.3 #102
Full changelog

powervs-machine-controllers

OCPBUGS-78043: hermetic 4.12 #138
OCPBUGS-54012: Fix for CVE-2025-30204 & CVE-2024-51744 in github.com/golang-jwt/jwt/v4 in release-4.12 #123
OCPBUGS-24564: Reduce metrics cardinality #75
Full changelog

prometheus

OCPBUGS-67512: CVE-2025-65637 Update sirupsen/logrus to 1.9.3 #291
Full changelog

prometheus-alertmanager

OCPBUGS-77906: Include go-verify-deps expected files in gitignore #124
Full changelog

service-ca-operator

NO-JIRA: Updating ose-service-ca-operator-container image to be consistent with ART for 4.12 #360
OCPBUGS-21026: CVE 2023 39325 (4.12) #231
Full changelog

telemeter

OCPBUGS-34827: fix issuer check during JWT authentication 4.12 #541
Full changelog

tests

OCPBUGS-56120: [build] Ensure Git Clone Does Not Run Privileged #29788
OCPBUGS-37799: Disable:Broken for [sig-builds][Feature:Builds][Slow] can use private repositories as build input build using an HTTP token should be able to clone source code via an HTTP token #29621
OCPBUGS-54772: Component Readiness: [Networking / ovn-kubernetes] [EgressFirewall] test regressed #29662
OCPBUGS-54147: Add/remove team members to the OWNERS file for Builds #29622
OCPBUGS-52585: Use payload pullspec for image info test #29593
OCPBUGS-41585: Removes dependency on samples operator images #29080
Full changelog

thanos

OCPBUGS-67525: CVE-2025-65637 Update sirupsen/logrus to 1.9.3 #169
OCPBUGS-27100: Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to 0.44.0 #137
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-78036: hermetic migration 4.12 #111
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-78026: hermetic migration 4.12 #90
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-67529: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #162
Full changelog

vsphere-csi-driver-operator

OCPBUGS-67528, OCPBUGS-67534: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #327
Full changelog

vsphere-problem-detector

OCPBUGS-67540: bump github.com/sirupsen/logrus to v1.9.3 #204
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github