4.12.97

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.12.97-x86_64

Qualifiers (status api): None

Tests:

Blocking jobs
- upgrade Pending (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Pending
- upgrade-minor Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-sdn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.12-e2e-aws-sdn-serial
- azure-ovn-upgrade-4.12-micro Pending (1 retry) periodic-ci-openshift-release-main-ci-4.12-e2e-azure-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Pending
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.12-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.12-fips-payload-scan
- gcp-sdn-upgrade-4.12-micro Pending (1 retry) periodic-ci-openshift-release-main-ci-4.12-e2e-gcp-sdn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Pending
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.12-e2e-metal-ipi-ovn-ipv6
- metal-ipi-sdn-ipv4 Succeeded periodic-ci-openshift-release-main-nightly-4.12-e2e-metal-ipi-sdn-ipv4

Upgrades from:

Untested upgrades: 4.11.14, 4.11.15, 4.11.16, 4.11.17, 4.11.19, 4.11.20, 4.11.22, 4.11.23, 4.11.24, 4.11.25, 4.11.26, 4.11.27, 4.11.28, 4.11.29, 4.11.30, 4.11.31, 4.11.32, 4.11.33, 4.11.35, 4.11.36, 4.11.37, 4.11.38, 4.11.39, 4.11.40, 4.11.41, 4.11.42, 4.11.43, 4.11.44, 4.11.45, 4.11.46, 4.11.47, 4.11.48, 4.11.49, 4.11.50, 4.11.51, 4.11.52, 4.11.53, 4.11.54, 4.11.55, 4.11.56, 4.12.10, 4.12.11, 4.12.12, 4.12.13, 4.12.14, 4.12.15, 4.12.16, 4.12.17, 4.12.18, 4.12.20, 4.12.21, 4.12.22, 4.12.23, 4.12.24, 4.12.25, 4.12.26, 4.12.27, 4.12.28, 4.12.29, 4.12.3, 4.12.30, 4.12.31, 4.12.33, 4.12.34, 4.12.35, 4.12.36, 4.12.37, 4.12.38, 4.12.39, 4.12.4, 4.12.40, 4.12.41, 4.12.42, 4.12.43, 4.12.44, 4.12.45, 4.12.46, 4.12.47, 4.12.48, 4.12.49, 4.12.5, 4.12.50, 4.12.51, 4.12.52, 4.12.53, 4.12.54, 4.12.55, 4.12.56, 4.12.57, 4.12.58, 4.12.59, 4.12.6, 4.12.60, 4.12.61, 4.12.62, 4.12.63, 4.12.64, 4.12.65, 4.12.66, 4.12.67, 4.12.68, 4.12.69, 4.12.7, 4.12.70, 4.12.71, 4.12.72, 4.12.73, 4.12.74, 4.12.76, 4.12.77, 4.12.78, 4.12.79, 4.12.8, 4.12.80, 4.12.81, 4.12.82, 4.12.83, 4.12.84, 4.12.85, 4.12.86, 4.12.87, 4.12.88, 4.12.89, 4.12.9, 4.12.90, 4.12.91, 4.12.92, 4.12.93

Loading changelog, this may take a while ...

Changes from 4.12.19

Created: 2026-08-26 09:18:34 +0000 UTC

Image Digest: sha256:610f344ba2a621c2205f79032b10cf06865ee89d2ad8250e96a8d83b4d49f310

Components

Kubernetes upgraded from 1.25.8 to 1.25.16
Red Hat Enterprise Linux CoreOS upgraded from 412.86.202305230130-0 to 412.86.202608241157-0 (diff)

Rebuilt images without code change

cluster-update-keys git 2796e173 sha256:2d490215b593ad12495faa8dc20d28c9412a9075653bcd8b1ee810d0a89b11e9
configmap-reloader git e4d9170e sha256:033946d7083a07833679d2a11bbc6cbf80c0e4433b93cf37831810dd1da72a78
egress-router-cni git a92e4157 sha256:21fcfa5f8116fe83aae757f5a7f89065fa2fb0b5f6f434afdb4319e30806bebc
keepalived-ipfailover git 7e8a0105 sha256:eefe1df7bd9688ca35e0fe105fb21bc66dcd3db2e781e5865d93469bc1e20727
libvirt-machine-controllers git a2882f7a sha256:cb7bde8621b9f746636691e22c416ca23fc5109cfaefe6deb5ff826b67bce412
machine-os-content sha256:03889b26d1b0d4c68227c866889f06caf73db420e727b89bfe9b22108106e910
network-tools git c76613c7 sha256:1614d81ed149dde2ff2ec60a73a49aa0c5c462fe381ca7e0dbf54f4a667e2f24
ovirt-machine-controllers git 03e8cb50 sha256:9970b4861430869e9c79fa4c44fb3dd7c7fd32c1fe927a87e0cc37935ea3ba6f
prom-label-proxy git b1907888 sha256:71ca2b57160a6ed5264b7f29e7d61f82dfb81274d32803b829e766a9bafd6043
rhel-coreos-8 sha256:5995cf76337c1e67de91ae0f5c52465a1a3b6cee3c46a3baf358d7f1cfbe5a2e
rhel-coreos-8-extensions sha256:ec9d970d9911e53b2b3e0ead85a084b15a4f9595170ec53bf1657905ebaad7ae

agent-installer-api-server

OCPBUGS-78114: [release-4.12] NO-JIRA: hermetic 4.12 #9956
OCPBUGS-67386: Bump logrus from 1.9.0 to 19.3 #8768
And 7 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-67388: Bump logrus v1.9.0 to v1.9.3 #1465
And 6 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-node-agent

OCPBUGS-67390: Bump logrus v1.9.0 to v1.9.3 #1287
And 6 elided commits (e.g. from squash or rebase merges)
Full changelog

alibaba-cloud-controller-manager

OCPBUGS-21218: Bump golang.org/x/net to v0.19.0 #45
Full changelog

alibaba-cloud-csi-driver

OCPBUGS-21313: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #38
Full changelog

alibaba-disk-csi-driver-operator

OCPBUGS-21404: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #66
OCPBUGS-18417: set TLS cipher suites in Kube RBAC sidecars #58
Full changelog

alibaba-machine-controllers

Updating ose-alibaba-machine-controllers images to be consistent with ART #35
Full changelog

apiserver-network-proxy

OCPBUGS-38066: Revert “Agent: Respect HTTPS_PROXY env vars for proxied connections” #61
OCPBUGS-31984: Bump golang.org/x/net to v0.23.0 #52
HOSTEDCP-1323: Merge latest code into 4.14 branch #45
OCPBUGS-10187: Updating ose-apiserver-network-proxy images to be consistent with ART #30
Full changelog

aws-cloud-controller-manager

OCPBUGS-32079: update for CVE-2023-45288 [release-4.12] #85
OCPBUGS-20722: Update golang.org/x/net to v0.17.0 #55
Full changelog

aws-cluster-api-controllers

OCPBUGS-78231: [release-4.12] hermetic 4.12 #595
OCPBUGS-20810: bump golang.org/x/net to v0.17.0 #483
OCPBUGS-15548: Pass right SGs for IsExternallyManaged on creation #469
Full changelog

aws-ebs-csi-driver

OCPBUGS-33457: UPSTREAM: 1919: Add reserved-volume-attachments #267
OCPBUGS-20919: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #241
OCPBUGS-14281: Volume unmount repeats after successful unmount, preventing pod delete #226
Full changelog

aws-ebs-csi-driver-operator

OCPBUGS-67399: Updated logrus to v1.8.3 #315
OCPBUGS-33457: Explicitly reserve 1 attachment for the root disk #308
OCPBUGS-21018: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #282
OCPBUGS-18417: set TLS cipher suites in Kube RBAC sidecars #265
OCPBUGS-13721: assets/hypershift/controller_sa: Set controller ServiceAccount imagePullSecrets #230
Full changelog

aws-machine-controllers

OCPBUGS-78268: hermetic 4.12 #176
OCPBUGS-24564: Reduce metrics cardinality #97
OCPBUGS-21562: Update golang.org/x/net to v0.17.0 #90
Full changelog

aws-pod-identity-webhook

OCPBUGS-32880: Upgrade go-jose module to 2.6.3 #191
OCPBUGS-21312: Upgrade golang/x/net for CVE-2023-39325 (4.12) #185
NO-ISSUE: Sync OWNERS with team members #178
NO-ISSUE: snyk: exclude vendor/ #174
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-21401: Bump golang.org/x/net to v0.18.0 #95
OCPBUGS-22832: UPSTREAM: 2805: add disk lun check in AttachDisk to avoid race condition #91
OCPBUGS-17159: Increase service idle max timeout to 100 minutes #82
Full changelog

azure-cluster-api-controllers

OCPBUGS-78180: [release-4.12] Hermetic 4.12 #368
OCPBUGS-36021: Update go-retryablehttp to v0.7.7 #315
OCPBUGS-21489: bump golang.org/x/net to v0.17.0 #289
Full changelog

azure-disk-csi-driver

OCPBUGS-56067: tech debt: rework vendor patches #106
OCPBUGS-22941: UPSTREAM: 1755: fix: detach disk failure when there is throttling #62
OCPBUGS-22832: UPSTREAM: 2805: add disk lun check in AttachDisk to avoid race condition #60
OCPBUGS-20675: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #56
Full changelog

azure-disk-csi-driver-operator

OCPBUGS-20749: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #103
OCPBUGS-18417: set TLS cipher suites in Kube RBAC sidecars #95
Full changelog

azure-file-csi-driver

OCPBUGS-20842: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #39
Full changelog

azure-file-csi-driver-operator

OCPBUGS-67404: Bump github.com/sirupsen/logrus to v1.8.3 #116
OCPBUGS-20946: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #78
OCPBUGS-18417: set TLS cipher suites in Kube RBAC sidecars #71
Full changelog

azure-machine-controllers

OCPBUGS-78266: hermetic 4.12 #188
OCPBUGS-36148: Fix mapi_instance_create_failed metric with accelerated networking #115
OCPBUGS-30809: Don’t create availability set when using spot instances #105
OCPBUGS-24564: Reduce cardinality #97
OCPBUGS-20741: Bump x/net package to v0.18.0 #84
OCPBUGS-19549, OCPBUGS-22247: Fix empty clusterName references for GenerateMachinePublicIPName #82
OCPBUGS-17960: Machine Actuator should not set metadata.name #71
OCPBUGS-17221: Add user defined Tags to NIC Azure resources #69
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-83750: Azure UPI ARM template: use storageAccountId #10511
OCPBUGS-78352: terraform/providers/google: Fixing inconsistencies with the service account creation #10385
OCPBUGS-66250: Replace terraform-provider-google with Openshift fork #10144
OCPBUGS-62820: Release 4.12 bump terraform provider azurerm #10002
OCPBUGS-55035: IBMCloud: Move to IBM TF openshift fork #9670
OTA-1310: data/manifests/bootkube/cvo-overrides: Default to eus-4.12 #9373
OCPBUGS-36087: [release-4.12]: bump go-retryablehttp for CVE fix #8660
OCPBUGS-39290: Add yq v4 to ci image #8929
OCPBUGS-36179: [release-4.12]: bump github.com/container/images for CVE fix #8663
OCPBUGS-22981: IBMCloud: Add eu-es region #7686
OCPBUGS-30630: baremetal: populate customDeploy in advance #8144
OCPBUGS-32449: Updated libvirt installer to include multi-arch yq and symlink for backwards compatibility #8290
OCPBUGS-30768: update RHCOS 4.12 bootimage metadata to 412.86.202402272018-0 #8140
OCPBUGS-30134: [release-4.12] bump containerd for vulnerability fix #8091
OCPBUGS-27454: baremetal: correct external_http_url for v6-only BMCs #7900
OCPBUGS-25593: [release-4.12] OCPBUGS-16640: Update azure cli version to 2.49.0 #7849
OCPBUGS-23184: azure: validation: validate defaultMachinePlatform #7709
OCPBUGS-25476: destroy: gcp: fix destroying regional disks #7845
OCPBUGS-23302: images: installer: add xz to the container #7726
OCPBUGS-23379: images: update govc image in upi-installer #7739
OCPBUGS-22116: Add KMS encryption keys if provided #7769
OCPBUGS-23329: Specify google cloud CLI to version 447.0.0 #7731
OCPBUGS-22933: [release-4.12]: vsphere: fix validation of CPUS and CoresPerSocket #7677
OCPBUGS-13288: use python3 for cloud sdk #7170
OCPBUGS-18645: new Aws secret regions support #7473
OCPBUGS-22288: Don’t log password values #7627
OCPBUGS-18644: terraform: aws: secret regions now support ALIAS record #7472
OCPBUGS-17651: Validate that the rendevousIP is assigned to a master #7416
OCPBUGS-20145: [release-4.12] Use updated ansible-core for Openstack image #7560
OCPBUGS-18646: Allow destroy for C2S isolated (us-iso and us-isob) partitions #7474
OCPBUGS-10992: bootstrap-pivot: skip pivot in SCOS Live ISO #7035
CORS-2792: AWS Shared VPC Backport [release-4.12] #7435
OCPBUGS-18320: CORS-2445: GCP: Add osImage to the install config #7454
OCPBUGS-17404: backport openstack UPI for ansible 2.10 #7399
OCPBUGS-16778: bump RHCOS 4.12 bootimage metadata to 412.86.202308081039-0 #7420
OCPBUGS-17467: Allow override of networkType #7406
OCPBUGS-17174: Set AdditionalTrustBundle in override when mirroring not enabled #7386
OCPBUGS-16382: azure: skip LB creation when not needed #7342
OCPBUGS-14868: Shorten SNO installation duration by releasing CPC lease #7242
OCPBUGS-14495: Support /dev/disk/by-path root device hints #7227
OCPBUGS-16151: ic: azure: validate diskTypes in AzureStack #7331
OCPBUGS-11199: azure: upi: use Image Gallery in ARM templates #7054
OCPBUGS-13940: bump RHCOS 4.12 bootimage metadata to 412.86.202306132230-0 #7249
OCPBUGS-14664: Shorten SNO installation duration by releasing CVO lease #7235
OCPBUGS-7400: Check for AWS STS installation before trying to get all IAM Roles #7175
OCPBUGS-13819: Bootstrap on aws should have same metadata service type as on other nodes #7196
OCPBUGS-12202: Relax vsphere, nutanix VIP validation #7116
OCPBUGS-7551: vSphere - ignore all bootstrap disk changes #6860
OCPBUGS-14014: Do not always output warning msg when releaseImage is digest #7202
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

baremetal-machine-controllers

OCPBUGS-78103: [release-4.12] fix vendor/ for hermetic migration #247
OCPBUGS-46642: Bump x/net to 0.33.0 #230
OCPBUGS-21700: Uplift x/net to v0.17.0 #200
Full changelog

baremetal-operator

OCPBUGS-53335: CVE-2025-29781 ose-baremetal-operator-container: Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD [openshift-4.12.z] #412
OCPBUGS-30630: Do not update instance_info and deploy_interface for active nodes #338
OCPBUGS-24490: backport: Delay delete of detached hosts #326
OCPBUGS-23291: hack for deploying V6-only clusters from dualstack hubs #320
OCPBUGS-21154: Uplift x/net to v0.17.0 #310
OCPBUGS-17703: Trigger reconcile on Secret change #298
OCPBUGS-17459: Set minimum TLS version for webhook to 1.2 #297
OCPBUGS-14188: Deleting unmanaged BMH get stuck fix #283
Full changelog

baremetal-runtimecfg

OCPBUGS-26930: Add .snyk file to ignore vendor and test files #296
OCPBUGS-20127: Increase timeout for bootstrap kubeapi #279
OCPBUGS-18606: Move haproxy firewall rule check earlier in loop #272
OCPBUGS-17715: Don’t render config with incomplete unicast peer list #268
OCPBUGS-15315: Use machine-config state instead of comparing roles #262
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-30289: oc adm catalog mirror: use ToSlash and FromSlash to unify the path separators #1701
OCPBUGS-25642: Add client version in must-gather summary #1639
OCPBUGS-24462: Overwrite template’s namespace with the explicit one #1618
OCPBUGS-23222: regeneratemco: explicitly check for PlatformStatus field #1598
OCPBUGS-20248: oc process: Set original namespace if it differs #1560
OCPBUGS-20291: Truncate existing files when writing from inspect #1563
OCPBUGS-20299: Use quay redis image instead docker mysql #1567
OCPBUGS-16173: Add tls-server-name when property exists in kubeconfig #1507
OCPBUGS-1283: Bump golang.org/x dependencies #1421
OCPBUGS-16056: mcs cert: account for environments that use IP directly #1501
OCPBUGS-16194: reboot: set ignition version to 3.1 #1509
handle the error case of node retrieval while waiting for reboot #1485
bring some cert rotation helpers back into 4.12 [fix unit-tests] #1478
OCPBUGS-14647: [release-4.12] Do not set master node selector if there’s no masters #1366
OCPBUGS-14236: Remove closed centos7 registry from newapp unit tests #1434
Full changelog

cloud-credential-operator

OCPBUGS-53420: github.com/golang/glog v1.2.4 #847
OCPBUGS-51538: Ignore SNYK-GOLANG-GOLANGORGXOAUTH2JWS-8749594 due to not being affected #832
OCPBUGS-37322: update modules: grpc, protobuf, logrus #764
OCPBUGS-42166: Resolve SNYK errors in security job. #760
OCPBUGS-37422: SNYK ignore go-client misreporting #744
NO-JIRA: Add jstuever to OWNERS #733
OCPBUGS-36027: IBM/go-sdk-core update to v5.17.4 #723
OCPBUGS-32897: Upgrade go-jose module to 2.6.3 #699
OCPBUGS-21348: Upgrade golang/x/net for CVE-2023-39325 #624
NO-ISSUE: snyk: exclude vendor/ #619
NO-ISSUE: Removing andrew from OWNERS #618
Full changelog

cloud-network-config-controller

OCPBUGS-33198: Avoid nil pointer panic while assigning private IP on Azure #141
OCPBUGS-22949: Azure: skip backend pool if attached to an outbound rule #128
OCPBUGS-16325: Azure: Handle already existing IP configurations #117
OCPBUGS-14717: increase GCP egress ip capacity to 100 from 10 #114
OCPBUGS-13802: sync CloudPrivateIpConfig when node is missing #112
Full changelog

cluster-authentication-operator

OCPBUGS-20683: CVE 2023 39325 [4.12] #653
OCPBUGS-22689: increase timeout for probes #639
OCPBUGS-13346: dont log jwt tokens #622
Full changelog

cluster-autoscaler

OCPBUGS-45152: [release-4.12] VPA: Update OWNERS file #329
OCPBUGS-40928: update VPA golang.org/x/net for http rapid reset for CVE-2024-8421 #318
OCPBUGS-30911: Fix unstructured taint parsing in Cluster API provider #291
OCPBUGS-23274: Rebase 4.12 branch onto cluster autoscaler 1.25.3 #267
Full changelog

cluster-autoscaler-operator

OCPBUGS-32005: Update x/net to v0.25.0 #325
OCPBUGS-20754: Bump x/net package to v0.18.0 #300
Full changelog

cluster-baremetal-operator

OCPBUGS-77451: Bump github.com/go-errors/errors to v1.5.1 #566
OCPBUGS-32006: bump x/net to 0.23.0 #440
OCPBUGS-23291: hack for deploying V6-only clusters from dualstack hubs #389
OCPBUGS-20845: Uplift x/net to v0.17.0 #371
OCPBUGS-19557: Guard against nil PlatformStatus #367
OCPBUGS-16169: use proxying for inspector in addition to ironic #349
OCPBUGS-15715: Limit role binding to openshift-machine-api namespace #347
Full changelog

cluster-bootstrap

OCPBUGS-14386: Update dependencies and image #91
Add API team to the OWNERS #97
Full changelog

cluster-capi-controllers

OCPBUGS-86891: update CI build root and Dockerfile tags w.r.t ART 4.12 streams #299
OCPBUGS-77976: fix vendor for hermetic #267
OCPBUGS-21521: bump golang.org/x/net to v0.17.0 #186
Full changelog

cluster-capi-operator

NO-JIRA: Allow sustaining engineering to self serve dependency updates #564
OCPBUGS-21055: Bump golang.org/x/net to v0.17.0 #138
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-21148: Bump golang.org/x/net to v0.18.0 #297
OCPBUGS-13862: add separate upgradeable condition for the sync controller #254
Full changelog

cluster-config-operator

OCPBUGS-16243: retire LatencySensitive featureset #336
: OCPBUGS-21245: bump library-go to include switch to HTTP/1.1 #373
CORS-2794: AWS Shared VPC API Bump [release-4.12] #344
Full changelog

cluster-control-plane-machine-set-operator

OCPBUGS-48325: Add unreadyNodeGracePeriod for allowing brief node hiccups #344
OCPBUGS-35421: Improved debugging of API listing errors #306
OCPBUGS-21342: Bump golang.org/x/net to v0.17.0 #260
OCPBUGS-14960: Check ProviderSpec before generating MachineInfo #216
OCPBUGS-15198: Surface cpms vs machines diff #219
OCPBUGS-13943: fix double machine creation on stale cache #210
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-32429: create suitable role and roleBinding for csi-snapshot-webhook #207
OCPBUGS-21442: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #169
Full changelog

cluster-dns-operator

OCPBUGS-52502: [release-4.12] Add runbook_url for CoreDNSErrorsHigh #435
OCPBUGS-21525: Bump golang.org/x/net/http2 to v0.17.0 for CVE-2023-39325 in cluster-dns-operator #391
OCPBUGS-19933: update-node-resolver.sh: Check for errors from >> #385
OCPBUGS-19933: ensure original hosts file contents are preserved #383
OCPBUGS-15251: Add support for protocolStrategy API field to enable force_tcp configuration #378
Full changelog

cluster-etcd-operator

OCPBUGS-67421: Update logrus to 1.9.3 to address CVE-2025-65637 #1550
OCPBUGS-53508: fix CVE-2025-30204 #1416
OCPBUGS-35501: return errors in wait-for-ceo #1277
OCPBUGS-32001: update golang x net #1256
OCPBUGS-30914: Replace nodelister with master nodelister everywhere #1224
OCPBUGS-30938: fix panic in health check timeouts #1228
OCPBUGS-27776: [4.13] Remove z-upgrades from UpgradeBackupController #1185
OCPBUGS-23151: relax readiness to local serializable requests #1156
OCPBUGS-21127: fixing CVE-2023-39325 by updating dependencies #1148
OCPBUGS-20100: [4.12] Backports of backup/restore fixes #1137
OCPBUGS-19837: Update staticpod file permissions to conform with CIS benchmarks #1128
OCPBUGS-17808: reset snapshot default counts to avoid file already lo… #1100
Full changelog

cluster-image-registry-operator

OCPBUGS-67422: Bump logrus to 1.8.3 #1292
OCPBUGS-53868: Bump github.com/golang-jwt/jwt #1236
OCPBUGS-51594: bump golang.org/x/oauth2 #1223
OCPBUGS-36033: go.*,vendor: bump go-retryablehttp #1071
OCPBUGS-22125: increase storage account key cache expiration #939
OCPBUGS-20684: mitigate effects of rapid reset #947
Full changelog

cluster-ingress-operator

OCPBUGS-86709: Add configuration override for X-SSL strip #1494
OCPBUGS-43703: Add e2e test for duplicate Transfer-Encoding headers #1158
OCPBUGS-43703: Add alert for RFC 7230 violation in Transfer-Encoding headers #1162
OCPBUGS-35454: internal service changed fix target port logic #1092
OCPBUGS-35304: TestHostNetworkPortBinding: Delete t.Parallel() #1083
OCPBUGS-35027: Don’t add clientca-configmap finalizer if deleting #1080
OCPBUGS-34888: desiredRouterDeployment: Set HostPort if needed #1076
OCPBUGS-34757: Avoid spurious updates for internalTrafficPolicy #1070
OCPBUGS-34110: Avoid spurious updates for scope in IngressClass #1056
OCPBUGS-34548: Use centos7 tag for quay.io/centos7/httpd-24-centos7 image #1068
OCPBUGS-20765: Bump golang.org/x/net for CVE-2023-44487 #988
OCPBUGS-22432: test/e2e: Don’t use openshift/origin-node #992
NE-1372: Add support for AWS shared VPC in another account #966 #971
OCPBUGS-13049: bump controller-runtime to fix the multi namespace cache indexing #922
OCPBUGS-15467: Add missing AWS permission for ListTagsForResources #954
OCPBUGS-16620: Deflake TestRouterCompressionOperation #963
OCPBUGS-16621: Fix TestClientTLS flakes #964
OCPBUGS-15644: Update TestAWSELBConnectionIdleTimeout to not use wildcard DNS record #959
OCPBUGS-14454, OCPBUGS-14455: Handle mTLS CRLs, and fix accidental CRL duplication #941
Full changelog

cluster-kube-apiserver-operator

NO-JIRA: refactor: Updating go builder in the CI, Dockerfile and go.mod to be consistent with ART 4.12 #2175
OCPBUGS-67424: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.12.z] #2048
OCPBUGS-50880: Increase waitForFallbackDegradedConditionTimeout #1811
OCPBUGS-22736: pkg/operator/configobserver: check that the serving certificate refer… #1571
: OCPBUGS-20855: bump library-go to include switch to HTTP/1.1 #1574
OCPBUGS-19837: Update staticpod file permissions to conform with CIS benchmarks #1559
OCPBUGS-17139: make webhook connection failure a warning in log #1533
OCPBUGS-13346: dont log jwt tokens #1524
Full changelog

cluster-kube-cluster-api-operator

OCPBUGS-20962: bump golang.org/x/net to v0.17.0 #29
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-27068: bump(library-go)=release-4.12 #789
OCPBUGS-21048: Bump deps to address CVE-2023-44487 [4.12] #759
OCPBUGS-19837: Update staticpod file permissions to conform with CIS benchmarks #754
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #628
OCPBUGS-27067: bump(library-go)=release-4.12 #529
OCPBUGS-21239: Sync deps CVE 2023 39325 4.12 #505
OCPBUGS-19837: Update staticpod file permissions to conform with CIS benchmarks #499
OCPBUGS-14652: disable debug pporf with unauthenticated port for 4.12 #481
Full changelog

cluster-kube-storage-version-migrator-operator

NO-JIRA: Reconciling the ART and CI go tool chain versions #173
OCPBUGS-67429: Bump github.com/sirupsen/logrus to v1.8.3 #143
: OCPBUGS-21336: bump library-go to include switch to HTTP/1.1 #98
Full changelog

cluster-machine-approver

OCPBUGS-23486: Filter non node CSRs in metrics #220
OCPBUGS-21430: Bump x/net package to v0.18.0 #214
Full changelog

cluster-monitoring-operator

OCPBUGS-76642: test: remove image registry e2e tests #2816
OCPBUGS-77403: test/e2e: improve prometheus remote-write test #2819
OCPBUGS-35558: label for infra nodes for metric cluster:capacity_cpu_cores:sum #2383
OCPBUGS-28766: fix generation of telemeter token hash #2306
OCPBUGS-25389: Add RHACM telemetry metric for 4.12 #2204
OCPBUGS-21441: Set the new –disable-http2 flag for prometheus-adapter to disable HTTP2 #2148
OCPBUGS-22843: [release-4.12] add RHACS telemetry metrics #2140
OCPBUGS-21234: upgrade golang.org/x/net to v0.17.0 #2123
OCPBUGS-17125: backport metrics collection profiles selector logic to prevent users from double scraping when they upgrade from 4.12 to 4.13 #2047
OCPBUGS-16028: Add the trusted CA bundle in UWM Prometheus pods #2042
OCPBUGS-15473: Limit the value of GOMAXPROCS on node-exporter to 4 #2023
OCPBUGS-13008: Add build number to vcenter version information #1965
Full changelog

cluster-network-operator

OCPBUGS-43872: manifests/02-cncc-credentials: Set skipServiceCheck for GCP #2548
OCPBUGS-38905: Add missing runbook for OVNKubernetesNorthdInactive #2479
OCPBUGS-37942: [release-4.12] update whereabouts crd #2461
OCPBUGS-29167: fix whereabouts conformance test failures #2256
OCPBUGS-29884: add env var in whereabouts-reconciler daemonset #2284
OCPBUGS-29302: Update ingressconfig_controller to use field Manager #2268
OCPBUGS-28801: [release-4.12] Add ConfigMap mount to the whereabouts-reconciler DaemonSet #2244
NO-JIRA: add kyrtapz as reviewer and approver for release 4.12 #2230
[release 4.12] OCPBUGS-23025: Add maxLogFiles config for OVN-K Audit Logging #2188
OCPBUGS-24039: remove all managed fields used by old manager #2099
OCPBUGS-21715: Bump golang.org/x/net and github.com/openshift/library-go #2124
OCPBUGS-24571: Disable weak SSH cipher suites #2164
OCPBUGS-25128: Update to go 1.19 and x/net 0.8.0 #2157
OCPBUGS-23293: IBMCloud specific: patch out management workload for dataplane component thats needed for bootstrapping #2108
OCPBUGS-20277: Edited multus-admission-controller deployment config to not add autoount a service account token #1884
OCPBUGS-20197: remove prestop hooks for northd, sbdbd and nbdb #2055
OCPBUGS-17656: prevent creation of multiple cni-sysctl-allowlist-ds pods #1948
OCPBUGS-11547: Hypershift: Add RollingUpdate parameters to multus-admission-controller #1775
OCPBUGS-16142: fix reconciliation process of the allowlist controller #1891
[release-4.12 ] OCPBUGS-11217:use annotation daemonset to update hybrid overlay #1764
OCPBUGS-15588: Add release version annotation to whereabouts-reconciler #1856
OCPBUGS-13891: [release-4.12] HyperShift: Support HostedControlPlane node selector #1816
OCPBUGS-13067: Fix tier label, privileged, HOSTNAME/NODENAME in whereabouts reconciler [backport 4.12] #1829
OCPBUGS-6061: Update github.com/Masterminds/sprig to v3 #1689
Full changelog

cluster-node-tuning-operator

irqbalance: set banned cpus list to 0 (#1006) #1006
Refactor IRQ load balancing enable/disable test (#1038) #1038
Scheduler plugin: ignore IRQs (#1034) #1034
Disable HTTP/2 for webhook and metrics servers (#849) #849
Remove obsolete protocols and weak ciphers (#847) #847
OCPBUGS-21837: nto: pao avoid timeout when there are too many CSV (#838) #838
Tighten the rules for modifying Tuned Profiles (#790) #790
OCPBUGS-19459: check for object being nil (#821) #821
OCPBUGS-18868: [release-4.14] e2e: add expected max latancy to hwlatdetec test & rename constant (#788) (#808) (#809) #788
Release leader election on manager exit (#789) #789
Fix a race in e2e test rollback.go code (#742) #742
pao: e2e: Make script executable (#734) #734
pao e2e: Split gcp-pao lane (#728) #728
Do not rollback settings on TuneD exit (#711) #711
OCPBUGS-15800: e2e: latency testing: increase the expected threshold and fix gomega truncating output (#710) #710
Revert “Remove optimization to allow full resync (#569)” (#688) #569
update owners 20230109 (#549) #549
Add PerformanceProfiles to ‘oc adm must-gather’ (#667) #667
OCPBUGS-14472: Fix updating numa core siblings map in GetCpuSiblings function (#675) #675
Remove trailing spaces from test names (#572) #572
Remove optimization to allow full resync (#569) #569
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-76594: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.12] #660
OCPBUGS-22689: increase timeout for probes #558
: OCPBUGS-20694: bump library-go to include switch to HTTP/1.1 #556
OCPBUGS-13346: dont log jwt tokens #543
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-20777: bump(k8s,openshift) to address CVE-2023-44487 #311
Full changelog

cluster-platform-operators-manager

OCPBUGS-20979: [release-4.12] Bump golang.org/x/net to v0.17.0 #99
Full changelog

cluster-policy-controller

OCPBUGS-21080: Bump deps to address CVE-2023-44487 [4.12] #136
OCPBUGS-12442: psalabelsyncer: handle empty namespace of a rolebinding subject #111
OCPBUGS-14092: [4.12] fix ClusterResourceQuotas to work for all api resources including custom resources #117
OCPBUGS-13889: external template and route Informer #114
Full changelog

cluster-samples-operator

OCPBUGS-63521: references to github.com/sclorg/django-ex.git now also refer to the branch #663
OCPBUGS-54913: add rhdmalone to owners #629
OCPBUGS-49664: add shannon and aroyoredhat as owners #600
OCPBUGS-21179: update k8s.io/apiserver version #590
OCPBUGS-15757: Update Jenkins and Jenkins Agent Base image versions #506
Full changelog

cluster-storage-operator

OCPBUGS-67444: Bump logrus to v1.8.3 #657
OCPBUGS-21266: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #407
OCPBUGS-18131: Add patch for allowing configmap updates via clusterrole #402
OCPBUGS-14307: User real node name in failing mount alerts #377
Full changelog

cluster-version-operator

OCPBUGS-45333: deps: bump golang.org/x/net to 0.31.0 #1122
OCPBUGS-27443: pkg/cvo/availableupdates: Only bump LastAttempt on Cincinnati pulls #1024
OCPBUGS-20729: [4.12] Bump http-related deps #990
OCPBUGS-22408: pkg/clusterconditions/promql: Warm cache with 1s delay #988
OCPBUGS-22198: Reconcile Volumes in SCCs #985
OCPBUGS-14096: Trigger new sync round on ClusterOperator Available changes #938
Full changelog

console

Fix for OCPBUGS-81593: CVE-2026-4800 #16570
OCPBUGS-88398, OCPBUGS-88416: Bump Axios to fix CVE-2026-44486. Requires a Patch of axios 0.33.0 types to be compatible with old version of TS #16793
OCPBUGS-79430: CVE-2026-29063 Bump immutable #16331
ART-18753: pin fsevents to latest #16482
NO-JIRA: enable multi-architecture yarn builds #16422
NO-JIRA: Updating openshift-enterprise-console-container image to be consistent with ART for 4.12 #12539
CONSOLE-5011: migrate to yarn berry #16084
NO-JIRA: Bump builder image to v29 #15988
OCPBUGS-74435: Bump lodash to latest #15973
OCPBUGS-44155: bump dompurify to latest #15595
OCPBUGS-57101: Add all files to vendor regardless of gitignore #15137
OCPBUGS-55210: Show Observe section without PROMETHEUS and MONITORING flags #14986
Dockerfile yarn line update #14838
OCPBUGS-45291: Application creation fail when manually entering input scaling value in local setup #14572
OCPBUGS-45235: Edit the secret and add the Chinese in the web-console, garbled characters will be displayed #14561
OCPBUGS-36561: Increase login flow state paramater length/entropy #14539
OCPBUGS-43639: Copy response code from proxied plugin requests #14423
OCPBUGS-33519: Observe > Metrics targets, Alert user if they do not have access to information on this page (e.g. 403). #14334
OCPBUGS-41600: Fix plugin proxy handler #14266
OCPBUGS-41854: Redirects to new PipelineRun logs URL from old PipelineRun logs URL #14283
OCPBUGS-34564: Routes created by devfiles do not always use HTTPS #13907
OCPBUGS-34933: Helm Plugin’s Catalog incorrectly renders a single index entry into multiple tiles #13930
OCPBUGS-32146: Bump graphql-go to v1.3.0 #13923
OCPBUGS-34845: Fix PipelineRun Logs tab navigation #13920
OCPBUGS-33778: fix issues with Edit Route form #13859
OCPBUGS-27479: Bump helm pkg #13528
OCPBUGS-29746: Add Pipeline metrics tab using plugin #13621
OCPBUGS-29348: Added Proxy to non k8s endpoints #13600
OCPBUGS-22431: Check if filtered object contains name property #13285
OCPBUGS-25213: add access review for impersonate #13440
OCPBUGS-18116: Bump helm version #13104
OCPBUGS-24236: Remove tech preview badge from Pipeline repository pages #13384
OCPBUGS-23413: Correct logout process #13342
OCPBUGS-24364: Subsequent PipelineRuns take initial PipelineRun name into account #13401
OCPBUGS-13357: add multipath device type to LocalVolumeSet #12805
OCPBUGS-23346: update the KnativeServing API version to v1beta1 for global-config extension #13334
OCPBUGS-23154: remove expandable toggle for conditional update risk d… #13322
OCPBUGS-22964: add support for new features annotations while preservi… #13305
OCPBUGS-19382: Could not import multiple resources via JSON (while YAML supports this) #13168
OCPBUGS-20071: Fix that “Delete application” doesn’t work in topology when Pipelines operator is not installed #13212
OCPBUGS-21727: fetch TaskRuns without selector and reduces the get TaskRuns requests #13251
OCPBUGS-21731: show all the legends for Pipeline metrics in PipelineRun TaskRun Duration chart #13252
OCPBUGS-13580: Regression: OpenShift Console no-longer filters SecretList when displaying ServiceAccount #12747
OCPBUGS-19907: Fixed Edit Application form for Knative Services #13205
OCPBUGS-19045: Web console slowness on Project>Project access page #13155
OCPBUGS-18273: Fix topology crash when a console.topology/data/factory extension tries to resolve a resource with version from the CRDs which doesn’t exists #13113
OCPBUGS-18563: OLM Pages work when copied CSVs are disabled #13055
OCPBUGS-17530: fix bug where binary secret values are corrupted on edit and add test coverage #13087
OCPBUGS-18366: Fix DeploymentConfig list performance issues by lazy loading their ReplicationControllers #13122
OCPBUGS-16660: Manual cherry-pick of #12978 #13039
OCPBUGS-17192: “Duplicate RoleBinding” leads to “Unsupported value” error #13063
OCPBUGS-16846: Fix stop PLR option #13051
OCPBUGS-2182: re-enable operator-install-single-namespace.spec.ts test #13013
OCPBUGS-16732: When removing the project owner from the project in GUI, instead of that user, the group (the default group added as project admin through the project template) will be removed. #13047
OCPBUGS-16046, OCPBUGS-16047, OCPBUGS-16048: Helm Chart installation form hangs on create if JSON-schema is using 2019-09 or 2020-20 standard revisions #12997
OCPBUGS-15898: account for single object in status.conditions instead… #12982
OCPBUGS-16139: The upgrade Helm Release tab in OpenShift GUI Developer console is not refreshing with updated values. #13004
OCPBUGS-15710: Create helm release page doesn’t show a YAML editor when schema isn’t available (httpd-imagestreams chart) #12962
OCPBUGS-15849: Add Pipeline metrics unsupported empty page #12977
OCPBUGS-9405: [OSD] There is no error message shown on node label edi… #12965
OCPBUGS-15798: Remove access review check for PipelineResource from Pipeline section #12969
OCPBUGS-13643: Fix OLM k8sResourcePrefix descriptor dropdown behavior #12813
OCPBUGS-15569: use service port name instead targetPort in the Pipeline Event listener route #12958
OCPBUGS-15535: Delete annotation ‘tekton.dev/v1beta1TaskRuns’ when rerun the PLR #12955
OCPBUGS-15404: Importing a kn Service shows a non-working Open URL decorator also when the Add Route checkbox was unselected #12935
OCPBUGS-15057: only copy workload annotations to debug pod #12903
OCPBUGS-15099: visiting Configurations page returns error Cannot read… #12906
OCPBUGS-15482: Remove PipelineResource CRD check because it’s not installed with PO 1.11 anymore #12948
OCPBUGS-14190: When Creating Sample Devfile from the Samples Page, Topology Icon is not set #12859
OCPBUGS-11989: Modified git import flow module to handle create button enable-disable issue #12775
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

console-operator

Updating openshift-enterprise-console-operator-container image to be consistent with ART for 4.12 #1137
OCPBUGS-77996: [release-4.12] NO-JIRA: update go mod dependency for konflux #1119
OCPBUGS-33386: Reset console operator’s conditions #898
OCPBUGS-20988: Disable HTTP/2 for webhook #876
OCPBUGS-30990: [release-4.12] Bump library-go and golang.org/x/net #867
OCPBUGS-18951: Add haproxy timeout annotation to console routes #792
OCPBUGS-18309: Add missing watch permission for helm-chartrepos-viewers #789
OCPBUGS-15834: Dockerfile: Shift ConsolePlugin CRD after the operator Deployment #791
OCPBUGS-18563: OLM Pages work when copied CSVs are disabled #780
OCPBUGS-13647: Proper cleanup of route sync conditions #762
Full changelog

container-networking-plugins

ART-13080: Fix Hermeto build issues #198
OCPBUGS-20593: build(deps): bump golang.org/x/net from 0.10.0 to 0.17.0 [backport 4.12] #131
Full changelog

coredns

OCPBUGS-59711: Bump github.com/golang/glog to v1.2.4 #151
OCPBUGS-21023: UPSTREAM: <carry>: openshift: Address CVE-2023-39325 #103
OCPBUGS-20144: UPSTREAM: <carry>: openshift: Fix OCPBUGS-20144 #98
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-79763: Apply code mitigations for CVE-2026-33186 #401
OCPBUGS-67448: CVE-2025-65637 #365
OCPBUGS-58889: CARRY: don’t ignore json files #345
And 19 elided commits (e.g. from squash or rebase merges)
Full changelog

csi-driver-manila-operator

OCPBUGS-67449: Bump logrus #255
OCPBUGS-30295: Fix selector for manila-csi-driver-controller-metrics service #228
OCPBUGS-18475: Don’t cache OpenStack client #202
OCPBUGS-18417: set TLS cipher suites in Kube RBAC sidecars #199
Full changelog

csi-driver-nfs

OCPBUGS-84927: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 to avoid go version bump and fix CVE-2026-33186 #186
Full changelog

csi-driver-shared-resource, csi-driver-shared-resource-webhook

OCPBUGS-28953: Replace ‘coreydaley’ with ‘sayan-biswas’ in OWNERS file #169
OCPBUGS-23118: Should reference configmaps instead of secrets #154
OCPBUGS-20703: bump golang.org/x/net to v0.17.0 #148
Full changelog

csi-driver-shared-resource-operator

OCPBUGS-28959: Replace ‘coreydaley’ with ‘sayan-biswas’ in OWNERS file #105
OCPBUGS-20787: bump golang.org/x/net to v0.17.0 #88
Full changelog

csi-external-attacher

OCPBUGS-21139: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #62
Full changelog

csi-external-provisioner

OCPBUGS-20743: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #74
Full changelog

csi-external-resizer

OCPBUGS-20885: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #149
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-29244: cherry-pick:release-4.12: OCPBUGS-29244 Update VolumeSnapshot and VolumeSnapshotContent using JSON patch #140
OCPBUGS-20991: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #111
Full changelog

csi-livenessprobe

OCPBUGS-20629: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #52
Full changelog

csi-node-driver-registrar

OCPBUGS-20674: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #54
Full changelog

docker-builder

OCPBUGS-43296: Bump buildah to 1.26.9 #449
OCPBUGS-43187: runc library bump to 1.1.12 #440
OCPBUGS-49345: skipping some unit tests to avoid failures as they are duplicate #437
OCPBUGS-48738: Add new team members to the OWNERS file #433
Replace ‘coreydaley’ with ‘sayan-biswas’ #408
BUILD-854: Add adambkaplan as approver #406
OCPBUGS-23037: Add -p flag to cp command to preserve timestamps #372
OCPBUGS-20695: [release-4.12]Bump golang.org/x/net #364
OCPBUGS-17228: bump github.com/containers/buildah to v1.26.6 #325
OCPBUGS-15643: Add the git-lfs package #353
Full changelog

docker-registry

OCPBUGS-53652: bump jwt and oauth dependencies #442
OCPBUGS-19306: bump docker-distribution #382
Full changelog

driver-toolkit

OCPBUGS-63597: Remove realtime kernel from 4.12.z #176
Full changelog

etcd

OCPBUGS-28736: Rebase etcd 3.5.12 openshift 4.12 #246
OCPBUGS-27102: Rebase etcd 3.5.11 openshift 4.12 #240
OCPBUGS-21187: [4.12] Carrying fixes for CVE-2023-44487 #228
OCPBUGS-15860: [4.12] Rebase openshift/etcd to 3.5.9 #207
Full changelog

gcp-cloud-controller-manager

OCPBUGS-21282: Bump golang.org/x/net to v0.18.0 #44
Full changelog

gcp-cluster-api-controllers

OCPBUGS-78284: [release-4.12] hermetic migration 4.12 #278
OCPBUGS-78284: [release-4.12] hermetic migration 4.12 #271
OCPBUGS-21380: Bump golang.org/x/net to v0.17.0 #205
Full changelog

gcp-machine-controllers

OCPBUGS-83657: Address CVE-2026-33186 #174
OCPBUGS-78183: hermetic 4.12 #143
OCPBUGS-24564: Reduce metrics cardinality. #76
OCPBUGS-20833: Bump x/net package to v0.18.0 #69
OCPBUGS-14120: Register control plane machines to instance group #52
Full changelog

gcp-pd-csi-driver

OCPBUGS-20718: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #47
Full changelog

gcp-pd-csi-driver-operator

OCPBUGS-20807: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #89
OCPBUGS-18417: set TLS cipher suites in Kube RBAC sidecars #82
Full changelog

haproxy-router

OCPBUGS-86709: Strip X-SSL-* headers for plain HTTP #809
OCPBUGS-74943: Adding escapeHAProxySingleQuotes for sanitize [release-4.12] #784
OCPBUGS-78110: [release-4.12] hermetic 4.12 #744
OCPBUGS-43703: add duplicate_te_header_total metric #632
OCPBUGS-35875: Properly handle rewrite-target annotation #610
OCPBUGS-33432: Route ‘haproxy.router.openshift.io/timeout’ value is not validated #593
OCPBUGS-34212: Reject routes with MD5 certs #601
OCPBUGS-33517: Count active services before setting weight to 1 #581
OCPBUGS-21098: Bump golang.org/x/net to v0.17.0 to address CVE-2023-39325 #532
OCPBUGS-17766: haproxy/template: mitigate CVE-2023-40225 #507
OCPBUGS-18639: properly handle weight=0 #511
OCPBUGS-14454, OCPBUGS-14455: Handle mTLS CRLs, and fix accidental CRL duplication #491
Full changelog

hyperkube, pod

OCPBUGS-77661: Skip E2e: attach on previously attached volumes should work #2649
OCPBUGS-77469: hermetic 4.12 #2652
OCPBUGS-67374, OCPBUGS-67472: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 [4.12] #2596
OCPBUGS-78226: UPSTREAM: 133262: Remove permafailing tests using an expired GCP project #2625
OCPBUGS-37282: UPSTREAM: 126104: Add funcs in pkg/filesystem/util that can actually … #2046
OCPBUGS-30454: CVE 2024-24786 #1974
UPSTREAM: <drop>: Bump golang.org/x/net to v0.23.0 #1940
Address CVE #13
OCPBUGS-15527: Prevent partially filled HPA behaviors from crashing kube-controller-manager #1887
OCPBUGS-25815: Fix device uncertain errors on reboot 4.12 #1833
OCPBUGS-25214: legacy-cloud-providers: prevent index out-of-range in getNextUnitNumber #1835
OCPBUGS-23568: Update to kubernetes 1.25.16 #1807
OCPBUGS-23288: UPSTREAM: 121881: Use golang library instead of mklink #1803
OCPBUGS-20113: UPSTREAM: <carry>: Do not allow nodes to set forbidden openshift labels #1747
openshift-hack: Fix sporadic 141 errors in build-rpms #1774
OCPBUGS-21435: [release-4.12] UPSTREAM: 121125: [1.25][CVE-2023-39325] .: bump golang.org/x/net to v0.17.0 #1760
OCPBUGS-18288, OCPBUGS-19483: Update to kubernetes 1.25.14 #1719
OCPBUGS-18768: UPSTREAM: <carry>: Force using host go always and use host libriaries #1694
OCPBUGS-17188: Update to Kubernetes 1.25.12 #1669
OCPBUGS-17159: Increase service idle max timeout to 100 minutes #1662
OCPBUGS-8737: UPSTREAM: <drop>: bump apiserver-library-go for scc fix #1619
OCPBUGS-15309: Bump to k8s 1.25.11 #1615
OCPBUGS-14745: [release-4.12] UPSTREAM: 118383: bump cadvisor for upstream patch 3301 #1600
OCPBUGS-13173: Bump to k8s 1.25.10 #1582
Full changelog

hypershift

OCPBUGS-77768: fix vendor for hermetic 4.12 #7823
Updating ose-hypershift-container image to be consistent with ART for 4.12 #6976
OCPBUGS-41516: set Konnectivity cipher suites #4283
MULTIARCH-3709: PowerVS - Add reuse resource flags to e2e test #2994
MULTIARCH-3732: PowerVS - Fix cluster deletion when existing resources passed #2993
MULTIARCH-3733: Add dev flags in destroy cluster powervs command #2998
Updated secret permissions for openshift-route-controller-manager #2924
fix(hcco): Add HCP label to HCCO by default #2972
fix(ignition): Add HCP label to ignition-server by default #2949
OCPBUGS-16847: use ignition-proxy Service to populate ignitionEndpoint with strategy NodePort #2855
[release 4.12] OCPBUGS-11555: OAuth OpenShift deployment requires ConfigMap mount patch2 #2803
OCPBUGS-16411: fix deletion bug when hostedzone is already deleted #2835
Kas policy 4.12 #2826
Leader election config update. #2800
OCPBUGS-15614: Check OwningIngressController also in Labels #2759
OCPBUGS-16086: autoscaling balance similar groups #2806
HOSTEDCP-1060: refactor ignition-server reconcilation and add ignition-server proxy #2749
OCPBUGS-14873: Update vendored openshift API for 4.12 #2734
HOSTEDCP-1073: enforce blocked rollout of HCP #2745
properly handle user CA bundle not existing #2711
OCPBUGS-15304: [release-4.12] fix(oauth): Do not proxy IBM Cloud IAM endpoints #2695
OCPBUGS-14873: Honor global ingress configuration LoadBalancer type on AWS #2678
OCPBUGS-14803: Set DisableStrictZoneCheck = true in the AWS Cloud Provider config #2667
[release 4.12] OCPBUGS-11555: OAuth OpenShift deployment requires ConfigMap mount #2512
OCPBUGS-14156: Reconcile oauthDeployment annotations even if kubeadmin secret is not found #2614
OCPBUGS-14031: Include default ingress CA in root CA bundle #2600
OCPBUGS-13626: Sync proxy TrustedCA to guest cluster #2557
OCPBUGS-13639: Cherry pick aws endpoint sg #2579
Full changelog

ibm-cloud-controller-manager

OCPBUGS-24644: Add Snyk file to exclude vendor directory on scan #67
OCPBUGS-21113: Bump golang.org/x/net to v0.18.0 #57
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-79756: Bump google.golang.org/grpc to v1.79.3 #158
OCPBUGS-77214: [release-4.12] standardize build paths #128
OCPBUGS-58873: bump github.com/golang/glog to v1.2.4 #111
OCPBUGS-56067: tech debt: rework vendor patches #95
OCPBUGS-53908: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #88
OCPBUGS-36063: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #75
OCPBUGS-20583: [IBM VPC] failed provisioning volume in proxy cluster #56
OCPBUGS-21206: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #52
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-67476, OCPBUGS-67477: bump github.com/sirupsen/logrus to v1.8.3 #163
OCPBUGS-60058: [IBM VPC] set offlineExpansion to false in e2e test manifest #153
OCPBUGS-36069: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #124
OCPBUGS-20583: [IBM VPC] failed provisioning volume in proxy cluster #79
OCPBUGS-21302: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #83
Full changelog

ibm-vpc-node-label-updater

OCPBUGS-56067: tech debt: rework vendor patches #52
OCPBUGS-53540: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #48
OCPBUGS-21415: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #29
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-67292: [release-4.12] Fix incomplete vendor/ #134
OCPBUGS-21397: UPSTREAM: <carry>: bump golang.org/x/net to v0.18.0 #67
Full changelog

ibmcloud-machine-controllers

OCPBUGS-78276: hermetic 4.12 #79
Full changelog

insights-operator

OCPBUGS-32004: bump golang.org/x/net version (#932) #932
OCPBUGS-28519: Add extra check in ids to bypass validations (#906) #906
adds helm information gather (#890) #890
OCPBUGS-23439: remove username & password config options (#869) #869
OCPBUGS-22922: create Prometheus rules programmatically according the… (#860) (#862) #860
OCPBUGS-20731: update dependencies (#841) #841
Add cherry-pick from 4.13 (#853) #853
OCPBUGS-19476: update Insights report config logging (#831) #831
OCPBUGS-19405: workload info gatherer, add external image repo (#823) #823
OCPBUGS-15031: fix the config serialization & add test (#794) (#800) #794
OCPBUGS-15459: gather PDBs only from openshift namespaces (#804) #804
OCPBUGS-15414: extend configmap gatherer to get gateway-mode-config (#788) (#791) (#801) #788
Full changelog

ironic

OCPBUGS-69787: Bump eventlet version to 0.30.2-5 #767
OCPBUGS-48145, OCPBUGS-48596: Bump jinja to 3.0.1-6.el9.2 #627
OCPBUGS-43949, OCPBUGS-43957: Bump python-waitress [4.12] #609
OCPBUGS-37766, OCPBUGS-39385: Include fixes for CVE-2024-44082 #586
OCPBUGS-38513: set min version for python3-webob #558
OCPBUGS-33373: bump werkzeug #547
OCPBUGS-34897: bump jinja2 #541
OCPBUGS-32362: [4.12] remove unused prometheus-exporter #489
OCPBUGS-32386: Use unix sockets by default for reverse proxy communication #477
OCPBUGS-29229: Fix Inspector iPXE config for IPv6 addresses #454
OCPBUGS-23979: Ironic side of external_http_url (METAL-163) is not wired in correctly #431
OCPBUGS-23357: Upgrade werkzeug dependency #423
OCPBUGS-23182: Use bash process substitution instead of pipe #419
OCPBUGS-19064: Handle Eject DVD in 4.12 #417
OCPBUGS-21849: bump eventlet version #409
OCPBUGS-17642: Expand regex for fcos/okd packages list #392
OCPBUGS-16169: allow inspector to also be proxied #385
OCPBUGS-13586: Add python-flask dependency #373
Bug OCPBUGS-13335: Bump ironic version to include fix to OCPBUGS-13335. #367
Full changelog

ironic-agent

OCPBUGS-96903: Replace individual package removal with a single rpm -e loop #280
OCPBUGS-69778: adding eventlet 0.30.2-5 #236
OCPBUGS-39385: Include fixes for CVE-2024-44082 #165
OCPBUGS-38513: set webob and bump werkzeug #153
OCPBUGS-29769: Always add ignition to set hostname on /etc/hostname #112
OCPBUGS-19008: better compatibility with old hostnamectl #92
OCPBUGS-19008: backport hostname fixes #90
“Bug OCPBUGS-15831: Switch to udevadm command install instead of package” #82
Full changelog

ironic-machine-os-downloader

OCPBUGS-87168: CI Build root image tag and go version in go.mod sync with ART 4.12 #118
OCPBUGS-15735: Binary should be compiled on rhel9 #92
Full changelog

ironic-static-ip-manager

OCPBUGS-14415: Flush addresses on provisioning interface with global scope only #37
Full changelog

k8s-prometheus-adapter

OCPBUGS-21441: upgrade golang.org/x/net to 0.17.0 to address CVE #91
OCPBUGS-20580: limit number of simultaneous client requests #79
Full changelog

kube-proxy, sdn

OCPBUGS-56130: Handle openshift-host-network namespace as special when it modifies #657
OCPBUGS-20753: update x/net to v0.17.0 #615
OCPBUGS-22972: Change the permission of 80-openshift-network.conf to 600 #583
OCPBUGS-18325: Vendor o/k to consume update to prefer local TCP eps for DNS #573
OCPBUGS-13785: EgressNetworkPolicy DNS resolution does not fall back to TCP #542
OCPBUGS-14304: fix possible concurrent map read/write #551
OCPBUGS-13058: save and delete the old egress network policy #539
Full changelog

kube-rbac-proxy

OCPBUGS-32000: CVE-2023-45288 [4.12] #106
OCPBUGS-20687: trim down http2, make it configurable 4.12 #85
Full changelog

kube-state-metrics

OCPBUGS-20764: bump x/net to v0.17.0 #103
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-11). #231
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-95078: OWNERS: Update component to Cloud Compute / KubeVirt Provider #76
Full changelog

kubevirt-csi-driver

OCPBUGS-83660: Bump google.golang.org/grpc to v1.79.3 #110
Full changelog

kuryr-cni, kuryr-controller

Bug OCPBUGS-16376: Fix np retry #740
OCPBUGS-15493: Remove unneeded grpcio dependencies from RPM #737
OCPBUGS-13778: KuryrPort cleanup: Fix issue of subport not found #731
Full changelog

machine-api-operator

OCPBUGS-78271: hermetic 4.12 #1470
OCPBUGS-43872: install/0000_30_machine-api-operator_00_credentials-request: Set skipServiceCheck again for GCP #1305
OCPBUGS-32007: Update x/net to v0.25.0 #1257
OCPBUGS-25303: Update reference URL #1189
OCPBUGS-21501: Bump golang.org/x/net to v0.18.0 #1176
Full changelog

machine-config-operator

OCPBUGS-77981: hermetic 4.12 #5734
OCPBUGS-58874: [release-4.12] Bump golang/glog to fix CVE-2024-45339 #5174
OCPBUGS-44325: Panic seen in CI job for MCC pod #4689
OCPBUGS-38382: [release-4.12] daemon/update: disable systemd unit before overwriting #4530
OCPBUGS-33665: Run resolv-prepender entirely async #4364
OCPBUGS-30829: Add existing kubeletconfig/ctrcfg mc-name-suffix annotation #4257
OCPBUGS-30823: Introduce kubelet-dependencies.target and firstboot-osupdate.target #4268
OCPBUGS-30329: set nodeStatusReportFrequency #4246
OCPBUGS-19659: After dual-stack conversion reconcile IPFamilies #3936
OCPBUGS-29366: release-4.12: fix nodeStatusUpdateFrequency #4180
OCPBUGS-29278: crio: drop automatic image cleanup on upgrades #4178
OCPBUGS-14071: Imageinspect takes type of error into account, drop podman inspect fallback #3717
OCPBUGS-21038: update library-go and kube deps to latest version #4013
OCPBUGS-22719: Backport logspam PRs #4008
OCPBUGS-21723: keepalived/ingress: change healthcheck script #3985
OCPBUGS-18433: Prevent NM from unsetting the hostname #3900
OCPBUGS-20509: resolv-prepender: avoid pulling baremetalRuntimeCfgImage again if it … #3969
OCPBUGS-19779: daemon: always use podman cp to copy extensions container content #3944
OCPBUGS-19515: The kubeconfig copied on to each node has 644 permissions #3931
OCPBUGS-17862: Agent-based install process the container machine-config-controller will be oom #3875
OCPBUGS-17461: The machine-config-controller pod restart in SNO+1 causing daemonsets to restart #3844
OCPBUGS-15570: configure-ovs: support UUID in vlan.parent #3768
OCPBUGS-16754: daemon: Don’t traverse /run/ostree/auth.json symlink #3818
OCPBUGS-11303: Fix regex dot in coredns config file #3660
Full changelog

machine-image-customization-controller

OCPBUGS-67478: bumped logrus to v1.9.3 #161
OCPBUGS-27090: configurable ironic agent vlan creation #119
OCPBUGS-21543: Uplift x/net to v0.17.0 #106
OCPBUGS-19008: Pass BareMetalHost name to IPA (take 2) #101
OCPBUGS-18687: Watch networkData Secrets for changes #96
Full changelog

machine-os-images

OCPBUGS-87882: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #106
OCPBUGS-54173: Change rhcos release browser url #61
Full changelog

multus-admission-controller

OCPBUGS-60292: Bump github.com/golang/glog to v1.2.4 #107
OCPBUGS-60850: Update owners #109
OCPBUGS-21330: Update go.mod for CVE-2023-39325 [Release-4.12] #73
Full changelog

multus-cni

OCPBUGS-28520: Fix SAST scan issues for multus-cni-container [4.12] #225
OCPBUGS-21061: Update go.mod for CVE-2023-39325 [Release-4.12] #196
OCPBUGS-22461: fix multiple default gw #200
OCPBUGS-7844: Fix multus to support CNI plugin which does not create interface [backport 4.12] #164
Full changelog

multus-networkpolicy

OCPBUGS-21420: Update go.mod for CVE-2023-39325 (#36) #36
Full changelog

multus-route-override-cni

OCPBUGS-78160: hermetic 4.12 #64
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-37942, OCPBUGS-38019: [release-4.12] Stateful fixes #310
OCPBUGS-28801: [release-4.12] Enable whereabouts config #244
OCPBUGS-16008: Cherry pick fix assignment 4.12 #238
OCPBUGS-21499: update golang.org/x/net to v0.17.0 #209
OCPBUGS-5953: Denormalize IP name before checking if pod is alive [Backport 4.12] #178
Full changelog

must-gather

OCPBUGS-48086: Update owners #477
OCPBUGS-24523: [release-4.12] Add csi-proxy logs collection in must-gather for Windows nodes #394
Full changelog

network-interface-bond-cni

OCPBUGS-13836: Ignore missing links during delete command #53
Full changelog

network-metrics-daemon

-sOCPBUGS-59700:Bump github.com/golang/glog to v1.2.4 (#125) #125
Replace e2e test image (#134) #134
swtich golint install method (#133) #133
Correct 4.16 owners file (#131) #131
Added METRIC_TEST_IMAGE var (#92) #92
Update the k8s dependencies to 1.25.15 (#84) #84
Revert “Remove e2e tests that consistently fail in 4.12 (#74)” (#77) #74
Full changelog

nutanix-machine-controllers

OCPBUGS-78158: hermetic 4.12 #132
OCPBUGS-51849: Fixing CVE-2025-22868 #121
OCPBUGS-47263: fixing CVE-2024-45338 #114
OCPBUGS-20956: bump golang.org/x/net to v0.17.0 #88
OCPBUGS-25675: Fix CI by running tests natively by default #62
Full changelog

oauth-apiserver

OCPBUGS-32010: bump x/net to 0.24.0 #113
OCPBUGS-21049: Bump K8s to v1.25 #104
Full changelog

oauth-server

OCPBUGS-27478: bump osin deps #144
OCPBUGS-13906: don’t log request query and fragment on failed authn request #129
Full changelog

oc-mirror

changes the owners file (#1011) #1011
OCPBUGS-48513: e2e: use same version of crane as in go.mod (#1027) #1027
Bump version to include v5.11.0 of go-git (#825) #825
OCPBUGS-385: Capability to override default channel (#749) (#796) #749
OCPBUGS-19429: Fix cross EUS channel upgrade path calculation (#779) #779
OCPBUGS-21440: fix: CVE-2023-39325 and CVE-2023-44487 (#713) #713
OCPBUGS-14065: Fix destination image reference (#650) #650
OCPBUGS-11908: Fix (#607) (#641) #607
OCPBUGS-14065: fix: Limit the nested repository path while mirroring the images (#642) #642
updates the OWNERS file (#646) #646
Full changelog

olm-rukpak

: OCPBUGS-27593,OCPBUGS-27678: Update go-git to v5.11.0 #76
OCPBUGS-23449: [release-4.12] Address http2 Vulnerability #64
OCPBUGS-21343: [release-4.12] Bump golang.org/x/net to v0.17.0 #41
UPSTREAM: <carry>: add downstream owners #43
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

openshift-apiserver

OCPBUGS-90518: Address CVE-2026-35469 #663
OCPBUGS-76481: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.12] #614
OCPBUGS-79381: Fix image reference in TestImageStreamImportQuayIO #623
OCPBUGS-32447: ose-openshift-apiserver-container: golang: net/http, x… #481
: OCPBUGS-21429: Enable HTTP/2 CVE mitigation #399
Full changelog

openshift-controller-manager

OCPBUGS-58296: Inconsistencies in dependencies are fixed #410
OCPBUGS-58157: Set node-pullsecrets volume to read-only to protect image pull credentials #403
OCPBUGS-57171: Empty proxy variables are causing issues during the build #389
OCPBUGS-49644: Add new team members to the OWNERS file #364
OCPBUGS-41953: Add adambkaplan as approver #336
Full changelog

openshift-state-metrics

OCPBUGS-20706: bump x/net to v0.17.0 #106
Full changelog

openstack-cinder-csi-driver-operator

OCPBUGS-67502: Bump logrus #191
OCPBUGS-21557: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #137
OCPBUGS-18417: set TLS cipher suites in Kube RBAC sidecars #130
Full changelog

openstack-machine-api-provider

Bug OCPBUGS-19770: Set controller’s SyncPeriod to 1 hour #86
OCPBUGS-10607: Use TenantID if ProjectID is empty #66
Full changelog

openstack-machine-controllers

OCPBUGS-20780: deps: Upgrade golang.org/x/net to v0.17.0 #277
Full changelog

operator-lifecycle-manager, operator-registry

OCPBUGS-86254: Drop github.com/distribution/distribution in go.mod #1312
OCPBUGS-61471: [release-4.12] Add NetworkPolicy as a supported kind #1054
OCPBUGS-61392: [4.12] e2e stability fixes #1087
OCPBUGS-46925, OCPBUGS-46932, OCPBUGS-47312: x/net bump to v0.34.0 [release-4.12] #943
NO-ISSUE: [release-4.12] Backport e2e fixes #880
OCPBUGS-38610: (fix) Resolver: list CatSrc using client, instead of referring to registry-server cache (#3349) #875
OCPBUGS-42161: adds paginating lister for evaluating CRs’ upgrade fitness versus new CRDs #873
OCPBUGS-41881: [CARRY] perform operator apiService certificate validity checks directly #866
OCPBUGS-32854: bump go-jose to v2.6.3 #782
OCPBUGS-35242: Unblock CI #773
OCPBUGS-27563, OCPBUGS-27568, OCPBUGS-27648, OCPBUGS-27653: bump go-git/v5 to 5.11.0 #688
OCPBUGS-27962: [CARRY] SSC RBAC #671
OCPBUGS-28229: Registry Pod Controller Flag #673
OCPBUGS-24619: Update to latest k8s v0.25.15 API server and enable HTTP/2 DoS mitigations #660
OCPBUGS-22132: [release-4.12] Bump golang.org/x/net to v0.17.0 #590
OCPBUGS-18512, RHIBMCS-168: Copied csv listing backport #559
Introduce DOWNSTREAM_OWNERS file #541
Allow cpb to be statically compiled / exempt from FIPS compliance #512
OCPBUGS-15858: fix dynamic conversion webhook #503
OCPBUGS-15737: Re-enable psa plugin #500
Full changelog

operator-marketplace

OCPBUGS-49426: Upgrade golang.org/x/net [release-4.12] #591
NO-ISSUE: Updating marketplace-operator images to be consistent with ART [4.12] #510
OCPBUGS-32081: update golang.org/x/net for CVE-2023-45288 #567
OCPBUGS-20955: [release-4.12] bump golang.org/x/net to 0.17.0 #550
OCPBUGS-18503: remove a race condition #533
OCPBUGS-14109: Revert default catsrc diff changes #519
Full changelog

ovirt-csi-driver

OCPBUGS-23162: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #131
Full changelog

ovirt-csi-driver-operator

OCPBUGS-67542: Bump github.com/sirupsen/logrus to v1.8.3 #148
OCPBUGS-23266: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #128
OCPBUGS-18417: set TLS cipher suites in Kube RBAC sidecars #121
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

CORENET-6055, OCPBUGS-84636: [release-4.12] Dockerfile: Unpin OVN and consume the latest from FDP #3075
OCPBUGS-59935: Dockerfile: Remove ovs version pinning #2698
NO-JIRA: Updating ose-ovn-kubernetes-container image to be consistent with ART for 4.12 #2092
OCPBUGS-55951: Bump ovn and ovs to latest 23.06 and 3.1 respectively #2554
OCPBUGS-50502: EgressIP: Reload certificates for the grpc heatlhcheck server #2457
OCPBUGS-35876: [release-4.12] ipv6+all protocols conntrack flush #2214
OCPBUGS-29864: CVE-2022-41723: avoid quadratic complexity in HPACK decoding #2204
OCPBUGS-34273, OCPBUGS-34414: Improves service iptables efficiency on start up + ICMP error messages to pass through #2184
OCPBUGS-32990: Bump OVS #2144
OCPBUGS-33422: [release-4.12] Full implementation of KEP-1669 ProxyTerminatingEndpoints + ETP=local fix #2135
OCPBUGS-25889: [release-4.12] OVN bump to 23.06.1-112 #2154
OCPBUGS-23259: [release-4.12] Update leaderelection config to allow retries #2017
OCPBUGS-28598: CARRY: Updates owners and adds Surya #2034
OCPBUGS-26700: [release-4.12] fixes MTU configuration on gateway router #2015
OCPBUGS-24420: OVNK/GW: Ignore headless services in syncServices #1972
OCPBUGS-23981: Netpol retryFramework cleanup #1977
OCPBUGS-26243: Fix Egress IP Deletion Handler to Prevent OVN Policy Leaks #2006
OCPBUGS-25096: Fragment oversized reply packets in LGW mode #1984
OCPBUGS-22091: Bump OVN to 23.06.1-39.el8fdp #1943
OCPBUGS-18681: Check libovsdbclient.ErrNotFound on wrapped errors #1862
OCPBUGS-20241: fix race condition in hybrid overlay DRIP alloc #1932
OCPBUGS-18353: Update bridge flow cache when the host address changes #1872
OCPBUGS-14708, OCPBUGS-19089, OCPBUGS-19904, OCPBUGS-19906: Dockerfile: bump OVN to ovn22.12-22.12.1-18.el8fdp #1881
OCPBUGS-18054: Emit node events only when retry failure #1837
OCPBUGS-18652: Do not return error if pod IP cannot be retrieved for deletePeerPod and perf improvements #1903
OCPBUGS-19432: Remove stale egressip status entry #1892
OCPBUGS-18586: Fix OVN SNATing on GR by enabling gateway_mtu on rtoe port of GR #1856
OCPBUGS-18058: [release-4.12] Create egress firewall with one db transaction #1835
OCPBUGS-17675: Don’t return error on delete event that doesn’t ave a chance to succeed. #1814
OCPBUGS-17522: [release-4.12] libovsdb: give monitor setup time to process than normal transactions #1808
OCPBUGS-16336: Backport support AllocateLoadBalancerNodePortsFalse #1766
OCPBUGS-15593: ovnkube-master pod failed to reconnect to ovn db due to ssl expire #1730
OCPBUGS-15719: [relase-4.12] Fix egressFirewall create error handling #1746
OCPBUGS-13744: Improve syncNodes to remove stale data #1732
OCPBUGS-13885: [release-4.12] Drop packets that were not properly SNATed #1679
OCPBUGS-15388: Fix stale SNAT entries for completed pods #1723
OCPBUGS-15709: [release-4.12] Remove non-existing functions test. #1739
OCPBUGS-15424: [release-4.12] Fix network policy to work with long namespace names #1725
OCPBUGS-14982: Validate port before deleting conntrack flow #1713
OCPBUGS-14041: Fix bug that resulted in routes not be restored to a new vnic #1681
OCPBUGS-13953: [release-4.12] Use loadbalancer.Name as client index #1680
Full changelog

powervs-block-csi-driver

OCPBUGS-24733: synk: ignore vendor dir #62
OCPBUGS-21079: CVE-2023-39325 - Update net dependencies - 4.12 #53
Update OWNERS add yussufsh #55
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-67511: Fix CVE-2025-65637 by bumping logrus to v1.8.3 #102
OCPBUGS-25717: snyk: ignore vendor dir #62
OCPBUGS-21168: CVE-2023-39325 - Update net dependencies - 4.12 #42
Update OWNERS add yussufsh #46
Full changelog

powervs-cloud-controller-manager

OCPBUGS-24740: UPSTREAM: <carry>: snyk code scan exclude vendor directory #52
OCPBUGS-21260: CVE-2023-39325 - Update net dependencies - 4.12 #47
Full changelog

powervs-machine-controllers

OCPBUGS-78043: hermetic 4.12 #138
OCPBUGS-54012: Fix for CVE-2025-30204 & CVE-2024-51744 in github.com/golang-jwt/jwt/v4 in release-4.12 #123
OCPBUGS-24564: Reduce metrics cardinality #75
OCPBUGS-24738: snyk code scan exclude vendor directory #63
OCPBUGS-21882: CVE-2023-39325 - Bump golang.org/x/net to v0.17.0 - 4.12 #57
Full changelog

prometheus

OCPBUGS-88580: remote: validate snappy decoded length before allocation in read endpoint #356
OCPBUGS-86876: Bump google.golang.org/grpc #325
OCPBUGS-67512: CVE-2025-65637 Update sirupsen/logrus to 1.9.3 #291
OCPBUGS-21219: update golang.org/x/net to v0.17.0 [4.12] #175
Full changelog

prometheus-alertmanager

OCPBUGS-77906: Include go-verify-deps expected files in gitignore #124
OCPBUGS-21031: Bump golang.org/x/net to v0.17.0 #82
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-20843: Bump golang.org/x/net to v0.17.0 #249
Full changelog

prometheus-node-exporter

OCPBUGS-21123: upgrade golang.org/x/net to v0.17.0 #136
Full changelog

route-controller-manager

OCPBUGS-86881: [release-4.12] bump google.golang.org/grpc to v1.64.1-sec.1 #97
OCPBUGS-14275: Bump k8s to 1.25.10 #27
Full changelog

service-ca-operator

NO-JIRA: Updating ose-service-ca-operator-container image to be consistent with ART for 4.12 #360
OCPBUGS-21026: CVE 2023 39325 (4.12) #231
Full changelog

telemeter

OCPBUGS-34827: fix issuer check during JWT authentication 4.12 #541
OCPBUGS-21310: [release-4.12] fix: Bump golang.org/x/net to v0.17.0 #486
Full changelog

tests

OCPBUGS-56120: [build] Ensure Git Clone Does Not Run Privileged #29788
OCPBUGS-37799: Disable:Broken for [sig-builds][Feature:Builds][Slow] can use private repositories as build input build using an HTTP token should be able to clone source code via an HTTP token #29621
OCPBUGS-54772: Component Readiness: [Networking / ovn-kubernetes] [EgressFirewall] test regressed #29662
OCPBUGS-54147: Add/remove team members to the OWNERS file for Builds #29622
OCPBUGS-52585: Use payload pullspec for image info test #29593
OCPBUGS-41585: Removes dependency on samples operator images #29080
Bug OCPBUGS-20557: Correct condition for rejecting connection #28327
OCPBUGS-18490: bump monitoring SNO bounds #28239
OCPBUGS-18527: Ignore timeout and connection refused errors during upgrade tests for 4.12 #28270
OCPBUGS-18309: Add missing watch permission for console users #28234
OCPBUGS-16696: Wait for DNS DS pods to be ready #28083
OCPBUGS-16243: allow cluster-config-operator to manage featuregate upgrade block #28055
OCPBUGS-15933: remove references to registry.centos.org #28033
CCO-367: Allow CCO to be Upgradeable=False when credentialsMode=Manual #27941
OCPBUGS-14152: Move from registry.centos.org to quay.io #27949
Full changelog

thanos

OCPBUGS-67525: CVE-2025-65637 Update sirupsen/logrus to 1.9.3 #169
OCPBUGS-27100: Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to 0.44.0 #137
OCPBUGS-21135: Bump golang.org/x/net to v0.17.0 #126
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-78036: hermetic migration 4.12 #111
OCPBUGS-21493: Bump golang.org/x/net to v0.18.0 #56
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-78026: hermetic migration 4.12 #90
OCPBUGS-21548: bump golang.org/x/net to v0.17.0 #24
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-67529: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #162
OCPBUGS-20417: syncer: fix nil pointer dereference in log message #98
OCPBUGS-21552: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #92
OCPBUGS-14312: Update 4.12 against v2.7.1 #81
Full changelog

vsphere-csi-driver-operator

OCPBUGS-67528, OCPBUGS-67534: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #327
OCPBUGS-21416: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #175
OCPBUGS-18131: Block upgrade to 4.13 via admin ack #171
OCPBUGS-18333: disable controller hostNetwork #167
Full changelog

vsphere-problem-detector

OCPBUGS-67540: bump github.com/sirupsen/logrus to v1.9.3 #204
OCPBUGS-21574: CVE-2023-44487: bump golang.org/x/net to v0.17.0 #131
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github