4.14.76

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.14.76-x86_64

Qualifiers (status api): None

Tests:

Blocking jobs
- upgrade Pending (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Pending
- upgrade-minor Pending (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Pending
Informing jobs
- aws-ovn-serial Failed (1 retry) periodic-ci-openshift-release-main-nightly-4.14-e2e-aws-ovn-serial
  - Attempt 1 Failed
  - Attempt 2 Failed
- aws-ovn-upgrade-micro Pending (1 retry) periodic-ci-openshift-release-main-ci-4.14-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Pending
- aws-sdn-upgrade-4.14-micro Pending (1 retry) periodic-ci-openshift-release-main-nightly-4.14-e2e-aws-sdn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Pending
- azure-ovn-upgrade-4.14-micro Pending periodic-ci-openshift-release-main-ci-4.14-e2e-azure-ovn-upgrade
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.14-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.14-fips-payload-scan
- gcp-ovn-rt-upgrade-4.14-minor Succeeded periodic-ci-openshift-release-main-ci-4.14-upgrade-from-stable-4.13-e2e-gcp-ovn-rt-upgrade
- metal-ipi-ovn-ipv6 Pending (1 retry) periodic-ci-openshift-release-main-nightly-4.14-e2e-metal-ipi-ovn-ipv6
  - Attempt 1 Failed
  - Attempt 2 Pending
- metal-ipi-sdn-ipv4 Succeeded periodic-ci-openshift-release-main-nightly-4.14-e2e-metal-ipi-sdn-ipv4

Upgrades from:

Untested upgrades: 4.13.23, 4.13.24, 4.13.25, 4.13.27, 4.13.28, 4.13.29, 4.13.30, 4.13.31, 4.13.32, 4.13.33, 4.13.34, 4.13.35, 4.13.36, 4.13.37, 4.13.38, 4.13.40, 4.13.41, 4.13.42, 4.13.43, 4.13.44, 4.13.45, 4.13.46, 4.13.48, 4.13.49, 4.13.50, 4.13.51, 4.13.52, 4.13.53, 4.13.54, 4.13.55, 4.13.56, 4.13.57, 4.13.58, 4.13.59, 4.13.60, 4.13.61, 4.13.62, 4.13.63, 4.13.64, 4.13.65, 4.13.66, 4.13.67, 4.13.68, 4.13.69, 4.14.10, 4.14.11, 4.14.12, 4.14.13, 4.14.14, 4.14.15, 4.14.16, 4.14.17, 4.14.18, 4.14.19, 4.14.20, 4.14.21, 4.14.22, 4.14.23, 4.14.24, 4.14.25, 4.14.26, 4.14.27, 4.14.28, 4.14.29, 4.14.3, 4.14.30, 4.14.31, 4.14.32, 4.14.33, 4.14.34, 4.14.36, 4.14.37, 4.14.38, 4.14.39, 4.14.4, 4.14.40, 4.14.41, 4.14.42, 4.14.43, 4.14.44, 4.14.45, 4.14.46, 4.14.47, 4.14.49, 4.14.5, 4.14.50, 4.14.51, 4.14.52, 4.14.53, 4.14.54, 4.14.56, 4.14.57, 4.14.58, 4.14.59, 4.14.6, 4.14.60, 4.14.61, 4.14.62, 4.14.63, 4.14.64, 4.14.65, 4.14.66, 4.14.67, 4.14.68, 4.14.69, 4.14.7, 4.14.70, 4.14.71, 4.14.72, 4.14.8, 4.14.9

Upgrades to:

4.15.70 (changes) - Failed

Loading changelog, this may take a while ...

Changes from 4.14.55

Created: 2026-10-15 08:30:16 +0000 UTC

Image Digest: sha256:24b407d0effdd7e42262b4cc70867ae7699710c30a263b1b9642d3f93ec7e80d

Components

Kubernetes 1.27.16
Red Hat Enterprise Linux CoreOS upgraded from 414.92.202508041909-0 to 414.92.202610091316-0 (diff)

Removed images

ovirt-csi-driver
ovirt-csi-driver-operator

Rebuilt images without code change

agent-installer-csr-approver git 54aa57eb sha256:4ca66749caf3f3bc1ec9d07151f32bf14fe636847a0652adf2f5e89f14a55352
agent-installer-orchestrator git 54aa57eb sha256:5ba54077d3d3dc4c81cb1cc6a6a35d5b78b3737370237314d3c9f05043c931f5
agent-installer-utils git b3fa10c2 sha256:3c63f7c40bd9acb0570ab7b6bc6a380dca49a5b37ab23838a0b142163c4ddd16
alibaba-cloud-csi-driver git 3dc363d3 sha256:1056083e39e18804129e90c14ab1fe4b109d45b065e4a7f9faa011fe5c09f336
alibaba-disk-csi-driver-operator git 8853e6ef sha256:b463a104cd7d8a533e96c5673af1343a0bdcc155949cf2eae094f6fdfc1c600f
alibaba-machine-controllers git 27f105d3 sha256:14c173ccdd9d854e77536505fb0bb2d1ccf9b83f16e3458e683fca26d4a6a40c
apiserver-network-proxy git f56c606a sha256:e8f16b3beb38db6b2ff60f837225e53d53cfed9ab35827f359457748be5df772
aws-cloud-controller-manager git 9a7820e8 sha256:d3edc36969875a24b4355ec3a85adb2c742053946e7a7a5134be3072b32cc298
aws-ebs-csi-driver git 4622deec sha256:65ee8c86a0cc77da014000316d68b757737f292097feacfdc14576c9f75b2e85
aws-pod-identity-webhook git 2c864ca0 sha256:a364287dbb4339b1f1c0bda64d40ca1c50707fdf44e01ae1b9b2e4fc05b968a4
azure-disk-csi-driver git 6d3558a3 sha256:353cd1a141c299c417353f96cf379adc805425266da415aa8b11a90b8f7bbe49
azure-machine-controllers git d526284e sha256:fa5b902790f0df088717508d76c5fa6a88b31a3f7c9d512c0d5182eb9a01aef6
azure-workload-identity-webhook git 2cb82019 sha256:584f0d266fe8a1b323f202cc316b5e8823dd5c2f9e38f4b2b7cf2edc2f95a8a6
baremetal-runtimecfg git 0ba9e555 sha256:18105206379550b8c6f8aec5908a76ebc738fdd3df194e45f8886a30973039ea
cli git 44b3ac26 sha256:2e36ea7aab8482c4fcc45ac8d68d5d21cd36ddf14a815a8e817b5bbf09036fa8
cli-artifacts git 44b3ac26 sha256:ec3bc12f25630246c5fbf921a6984f8ca1b8628bef2c452a6f8480cf1fabe072
cloud-network-config-controller git 1bd04641 sha256:0cddb8a8b8dc4c0d6eb3df596176cfee25feb16d7daab2183c4f85ae72102ddc
cluster-authentication-operator git 9203d4d5 sha256:de0e1e43e53597ce030d98ea705c7cb5d929a48dd2aa6848a3290f4562abedfa
cluster-autoscaler git d030dbaa sha256:39e598b8d77897328991af9c4a9314bc7a37e6d64f1b7d6108fa398f7717af22
cluster-bootstrap git 93fba13f sha256:b9f6c0ae328b36b945737daf61a19a250e0b63de4f228d746a75394513b5feef
cluster-config-operator git 2378670a sha256:3bc531cb45f3b4b30b121a877261afb627a8c77d27ffa1078469c06127d04f6e
cluster-control-plane-machine-set-operator git 783d9dd1 sha256:c1ffb1cf8b5b361ca9968bbcb60ddd69b92dba2dd8b6a9a616487af1323c92b9
cluster-csi-snapshot-controller-operator git d4a11625 sha256:22fe782ea071e7bd76c27fe14e8476687bf22458a187a87ff4d3ced117e6dc1f
cluster-dns-operator git 0164e3c4 sha256:b20917c3f04f6f9e6636e955a59817822fe95267f1dcbf42e5c6ee43d4def78d
cluster-kube-cluster-api-operator git b287d08b sha256:bba2ef6821f1b5d031d5c469bf19c44e9b5c9e985e1cf4a79cda631fbfc18e70
cluster-kube-controller-manager-operator git 4e059638 sha256:fd45b726e0e76b1b198e5b3c66ca4c44811e5a806fee47bc8f418bab04e1531d
cluster-machine-approver git 38a758d0 sha256:6cf8ae6d22f6b2e54ecfa47051374aa342f26bbe6d3b1b6665a1e025a3d87bf0
cluster-node-tuning-operator git 5511c8df sha256:4faa7b531ce757843d5106024f741c2adf275cbf93b08cb0bb556c91921967df
cluster-platform-operators-manager git 08fb27e7 sha256:5b9f68e0e07512a4583ebf8fc359eb1698fa90cb5132ae570e608c6a86083536
cluster-policy-controller git 219f6f6f sha256:29e07bad8c771f9bbdfd0e8fa94bd0aba50533f721ed8c93b2dfbbaa014f8718
cluster-update-keys git 1a7a6e22 sha256:85fb6457602ba1c3020c718aba613249533d62b054954aa0e17ecf59e51d8594
cluster-version-operator git a1bf9301 sha256:592f8e5b9b18a6667f6df814de083e28db3685012618a27ac0dfc8418eb57bec
configmap-reloader git 716a0c33 sha256:92a51deb30336a2438ea589749b89a321a05a00528964630b9d5b284ac9517cd
csi-driver-shared-resource-operator git c273cd52 sha256:2225026ee0347509a2cd4a7761395f7a54f3d0d2cd650845b53d783e6e4b5a86
csi-external-attacher git 06e8ce0d sha256:efba05eb61265f12fe1f6a6b7d449ed530629fc4c76a625cce5b3c07822aaeb3
csi-external-provisioner git e18ed7f0 sha256:7b1f67e83ffad8c38dbe8af05d7ba75b7f3eb48465cce9c0403227e81823880c
csi-external-resizer git 59a701a4 sha256:93880de64d6b73c8419f2d6bed49909b8f17997ba293b0b6ec54bea551e66cba
csi-livenessprobe git a9bcbde1 sha256:0697e509ebc42a5bdb71e7d36d8796a57f500dc38f04ec5f08e50637ac7ea729
csi-node-driver-registrar git 9dcaa7f5 sha256:77d47d960e2af3bebcae87764cf0ddda086270d361c86741fc0b149f00b56753
deployer git 44b3ac26 sha256:4a5216cffa1409392a9b2acb9a961668846dad4e8d4de80c3563acabadfb6a6e
docker-registry git ce0483f1 sha256:8c26125b2699f1aaf3ae73417933fc2a96ff7385a9782a2b279ab9b50e13f8ed
driver-toolkit git cafed17b sha256:652e7769ce847004a66583fbf6cafd9123d8a3ee49ef0270a4c3d66c2a6ff4be
egress-router-cni git 96f2f54f sha256:2c7bd495a7a02f18f8f200fd16f446fa85788ed3ebefd330b2275b16e2094cd5
etcd git 5ed5044c sha256:6f68b872e1af6246021c0b507eb7237f79fb61a96df9457609fcace26826d807
gcp-cloud-controller-manager git 09e96a91 sha256:0a4c121b184069778377c55befb99beaa0b997351eabeaf7f1d0de41d0e92abc
gcp-pd-csi-driver git 8a626fe5 sha256:0b25f02bf9319d9a5cf45ed9cca4cd720fed7820742861b39b78d80185f2cf60
gcp-pd-csi-driver-operator git 95d55a04 sha256:b007dda12a5cf5c2dd9250f008f068bf721a5130bb9222ffed0fbbde70fc0a82
ibm-cloud-controller-manager git f39488c5 sha256:5ce992613da7504438fbf1778ec9d71f1feec8e028428f75df7450d865928590
ironic-static-ip-manager git 1b194fd1 sha256:01ac73aad83975bb3d25010375f080dcb57a9a8ee54ca1514d6974b38f47d17d
k8s-prometheus-adapter git 801a912b sha256:973452303dd0790296983cdeda71cebf5e959fabc81720fbf762b8b4c3168cb1
keepalived-ipfailover git 03e5f407 sha256:3381d6babf022ba960c2a2dd9d81da910eccd473d4be86fc41209fed4cf60c15
kube-proxy git 1f611c53 sha256:4e1b2271e5e098dcc13c521d29b0f92c6a4c5aaabcfebafb2c8a4e0db3271e1f
kube-rbac-proxy git b8b82595 sha256:89cc3cbf096c6e3c52defa275aeacfd27794338dffe76bb5b2b67f79a4e57409
kuryr-cni git 8926a294 sha256:d2431d5a2fae778c9a8cf23e3d3f2352a2b5f5342ee7ea7f547aaef4478ebd31
kuryr-controller git 8926a294 sha256:18cc10852f900c20ce2bac55ab63cebb5acd1c38cf22f570c39a4ccf71d599db
machine-config-operator git 00b2e0b1 sha256:8fc697b42211c642546dd1f91bb292b09b821710796afefe2da13dd985f1f7c9
machine-os-content sha256:2aace391f83a0247801e22254f2429d882bc3f5d6ab9c20cdf135716843e6cc1
multus-networkpolicy git f670647c sha256:e00403d9ddb985dd8f5d83789401da92488b616aa1de7cd3df3341946906f177
multus-route-override-cni git 5965fed6 sha256:bd0424373fcbd6d49063e1f3ec9e80efa758bf03c4a6d6f7c4f0369833f12db3
multus-whereabouts-ipam-cni git f95487b0 sha256:fac01f44d1738698b3230f32dfdf1479c22f2e538a99b5d650971c773281cc33
must-gather git b8585ca8 sha256:c3e73cc0f32df40516e2b62ee6ca57329b5dbd2b9b5d9c42de8af4aaa790858a
network-interface-bond-cni git 29f61f6b sha256:038213c21f77171c1e016e7b1d0ee56e9bc7d72bec0502c33be33506d2642b0e
network-tools git e79d8173 sha256:64969105b3659cfc94e507a66db885c917a1a32fd5f25a291ebd6d251ba2a5cc
nutanix-cloud-controller-manager git 8930f295 sha256:87da42a8de92104fa83f8b50bb0117ee5b92a7d83d206975de0ba9e16dac828f
nutanix-machine-controllers git c0661680 sha256:f0dafde169b5b1f932924db3c3ef695b89cc23070fdc17b478ff28f56b86547b
olm-catalogd git a333cb0b sha256:cbac1b7e42303599dcdd2043cc4b23e55269e684e1e632245c25afa89aba50aa
olm-operator-controller git fb6fb278 sha256:28d70a9f1b54ab2de90f6423d699db2d67d060942e800559deadfff2945087a8
olm-rukpak git c9409c62 sha256:11d081514a9f3f1f6d3dd778030a75a5e8e840140417036b2a2f984539d7bced
openshift-controller-manager git 1c76570b sha256:6e278f88d9da8a55b16cf54a02deec85864b36f522a408537bc2c2f8b7c7eeef
ovirt-machine-controllers git 5d708631 sha256:7a6c94136558a6f957d943882bf57cc13ad8ffa727a67ec0aaa870cea3f07753
powervs-block-csi-driver git 988f7109 sha256:34cd8c0395b2d818382199adfd6eb421967b72e15eb380fa925a304e429df0ee
powervs-cloud-controller-manager git 19cf1d3f sha256:1a6aa8c5feb901ec922e015e9887012cbf182da47a15a0fe68ce41eabf68dc65
prometheus-config-reloader git a4b845a7 sha256:e6b73eed52d7e95ef70e2f4dd3830d8c3dc4d5fd5f1ea57842a0e37e70988863
prometheus-operator git a4b845a7 sha256:234b1a2cef126945bc2ed1965b60dd3a53ecc955c64fe967cd4bf298170572c6
prometheus-operator-admission-webhook git a4b845a7 sha256:16a57ade7ae109a89f2caf89fd4f23b9d6f0ce8d045e9055703d75f1d456ae6d
rhel-coreos sha256:d7adabdd9ceed1a34dc24a4fdc6e569e032df17767ae29aaad2aba6edfe00dba
rhel-coreos-extensions sha256:2eb99c9d62c010fb7a23e5d81d2a91b3bf1348f1efe2da34b92195e1fd4f3945
sdn git 1f611c53 sha256:39bdcaf469eaac15fb55c8df6002ac3a8f05195cb061c0eb2e09aab9a335182b
service-ca-operator git 3c3f82f7 sha256:f5f2657b22cc4ef169b1a5cbb51e6a4b1251060b820f5721c5573a0aa4efa5f7
tools git 44b3ac26 sha256:5318ad06bcca697f71a1b154da62f2dd18454d5b55de97e2af975b001b75be86

agent-installer-api-server

OCPBUGS-89787: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.4 #10821
MGMT-23439: Bump Go 1.18 to 1.20 and regenerate code #10042
OCPBUGS-78112: [release-4.14] NO-JIRA: hermetic 4.14 #9955
MGMT-23439: Use archived dnf repositories for CentOS Stream 8 #10018
Full changelog

agent-installer-node-agent

OCPBUGS-102504: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #1614
Full changelog

alibaba-cloud-controller-manager

OCPBUGS-102505: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #64
Full changelog

aws-cluster-api-controllers

🌱 OCPBUGS-123714: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #647
OCPBUGS-78229: [release-4.14] hermetic 4.14 #593
OCPBUGS-61944: UPSTREAM <carry>: revert: Only tag NetworkInterfaces in RunInstances if IAM Allows It #574
Full changelog

aws-ebs-csi-driver-operator

OCPBUGS-102508: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #316
OCPBUGS-67748: Updated logrus to v1.9.3 #313
Full changelog

aws-machine-controllers

OCPBUGS-63142: client: re-use a single file for building the session instead of randomly named files #154
OCPBUGS-63142: revert: client: re-use a single file for building the session instead of randomly named files #151
OCPBUGS-63142: client: re-use a single file for building the session instead of randomly named files #142
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-79820, OCPBUGS-79821: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.64.1-sec.1 [release-4.14] #192
Full changelog

azure-cluster-api-controllers

OCPBUGS-78178: [release-4.14] Hermetic 4.14 #366
Full changelog

azure-disk-csi-driver-operator

OCPBUGS-102495: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #131
Full changelog

azure-file-csi-driver

OCPBUGS-102494: Bump golang.org/x/net to v0.35.0-sec.4 #162
OCPBUGS-79822: Correct grpc-go patch version #169
OCPBUGS-79822: Patching openshift-sustaining/grpc-go@v1.67.3-sec.1 #150
Full changelog

azure-file-csi-driver-operator

OCPBUGS-102503: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #119
OCPBUGS-67753: Bump github.com/sirupsen/logrus to v1.9.3 #114
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-79654: Azure UPI ARM template: use storageAccountId #10435
OCPBUGS-76930: terraform/provider/google: Fixing inconsistencies with service account creation #10324
OCPBUGS-62601: update resolv.conf every time on bootstrap node #9985
OCPBUGS-62814: Release 4.14 bump terraform provider azurerm #10001
Full changelog

baremetal-machine-controllers

OCPBUGS-78101: [release-4.14] fix vendor/ for hermetic migration #245
Full changelog

baremetal-operator

OCPBUGS-102514: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #521
Full changelog

cloud-credential-operator

OCPBUGS-60975: ccoctl: aws to use proper issuer url on subsequent runs #911
Full changelog

cluster-autoscaler-operator

OCPBUGS-102528: Bump x/net package in release-4.14 #392
Full changelog

cluster-baremetal-operator

OCPBUGS-77449: Bump github.com/go-errors/errors to v1.5.1 #564
Full changelog

cluster-capi-controllers

OCPBUGS-77974: [release-4.14] fix vendor for hermetic #265
Full changelog

cluster-capi-operator

NO-JIRA: Allow sustaining engineering to self serve dependency updates #562
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-63170: ccm: disable unused secure-serving port and webhook #425
Full changelog

cluster-etcd-operator

OCPBUGS-67770: Update logrus to 1.9.3 to address CVE-2025-65637 #1548
Full changelog

cluster-image-registry-operator

OCPBUGS-67771: Bump logrus to 1.9.1 #1290
OCPBUGS-53867: Bump github.com/golang-jwt/jwt #1229
Full changelog

cluster-ingress-operator

OCPBUGS-86711: Add configuration override for X-SSL strip #1492
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-67775: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.14.z] #2045
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #626
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-67780: Bump github.com/sirupsen/logrus to v1.9.1 #141
Full changelog

cluster-monitoring-operator

NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #3106
OCPBUGS-76415: test: remove image registry e2e tests #2811
Full changelog

cluster-network-operator

OCPBUGS-113758: Manual feature backport of cert rotation for whereabouts #3139
OCPBUGS-84184: fix(hypershift): use net.JoinHostPort for URL construction #2996
OCPBUGS-78105: fix vendor for hermetic 4.14 #2913
Full changelog

cluster-olm-operator

OCPBUGS-86344: Update grpc-go to v1.64.1-sec.1 to fix CVE-2026-33186 #209
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-76593: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.14] #658
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-102558: Use patched x/net fork v0.35.0-sec.4 #448
Full changelog

cluster-samples-operator

OCPBUGS-63518: references to github.com/sclorg/django-ex.git now also refer to the branch #661
Full changelog

cluster-storage-operator

OCPBUGS-87736: remove oVirt code from CSO 4.14 #711
OCPBUGS-67795: Bump logrus to v1.9.3 #655
Full changelog

console

OCPBUGS-98416: CVE-2026-59869 #16754
OCPBUGS-92716: CVE-2026-46597 openshift4/ose-console: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs [openshift-4.14.z] #16963
OCPBUGS-105794: Fix and re-enable operator-install-single-namespace e2e test #17170
Fix for OCPBUGS-92074: CVE-2026-44990 #16721
OCPBUGS-100511: Bump postcss to fix CVE-2026-45623 #17109
OCPBUGS-105791: Disable failing OLM and pipelines e2e tests to unblock CI #16956
OCPBUGS-90614: Fix JSON annotation parsing to prevent OperatorHub crash #16659
OCPBUGS-87989: [release-4.14] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16597
OCPBUGS-77116: [release-4.14] CVE-2026-26996 Bump minimatch library #16348
Fix for OCPBUGS-81595: CVE-2026-4800 #16568
OCPBUGS-88422: Bump axios to ^0.33.0 Addresses CVE-2026-44486 #16789
OCPBUGS-79434: CVE-2026-29063 Bump immutable #16329
ART-18713: pin fsevents to latest #16473
NO-JIRA: enable multi-architecture yarn builds #16424
OCPBUGS-83297: [release-4.14] openshift4/ose-console: Axios: Remote Code Execution via Prototype Pollution escalation #16311
NO-JIRA: Updating openshift-enterprise-console-container image to be consistent with ART for 4.14 #16168
CONSOLE-5011: migrate to yarn berry #16082
NO-JIRA: Bump builder image to v29 #15991
OCPBUGS-74439: Bump lodash to latest #15971
OCPBUGS-44158: bump dompurify to latest #15593
OCPBUGS-59998: Remove the devconsole backend common internet proxy and replace it with dedicated ones #15464
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

console-operator

OCPBUGS-102556: Use patched x/net fork v0.35.0-sec.4 #1233
OCPBUGS-77994: [release-4.14] hermetic 4.14 #1131
OCPBUGS-77994: [release-4.14] NO-JIRA: update go mod dependency for konflux #1117
Full changelog

container-networking-plugins

OCPBUGS-78286: fix vendor for hermetic 4.14 #225
Full changelog

coredns

OCPBUGS-58713: [release-4.14] Bump github.com/golang/glog to v1.2.4 #139
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-79847: Apply code mitigations for CVE-2026-33186 #399
OCPBUGS-67800: fix CVE-2025-65637 #363
Full changelog

csi-driver-manila-operator

OCPBUGS-67801: Bump logrus #253
Full changelog

csi-driver-nfs

OCPBUGS-84929: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 to avoid go version bump and fix CVE-2026-33186 #184
Full changelog

csi-driver-shared-resource, csi-driver-shared-resource-webhook

OCPBUGS-102559: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #531
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-102570: Replace golang.org/x/net with github.com/openshift-sustaining/net v0.35.0-sec.3 #242
Full changelog

docker-builder

OCPBUGS-89417, OCPBUGS-89800, OCPBUGS-90234, OCPBUGS-92322, OCPBUGS-92552, OCPBUGS-92703: Bump golang.org/x/crypto to fix CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-46597 #545
OCPBUGS-66112: BuildConfig inline Dockerfile fails with heredoc syntax #492
Full changelog

gcp-cluster-api-controllers

OCPBUGS-78282: [release-4.14] update go mod dependency for konflux #269
Full changelog

gcp-machine-controllers

OCPBUGS-102607: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #194
OCPBUGS-79841: Bump google.golang.org/grpc to v1.79.3 #168
OCPBUGS-79841: Fix setup-envtest GCS 401 by downloading binaries directly #178
Full changelog

haproxy-router

OCPBUGS-86711: Strip X-SSL-* headers for plain HTTP #807
OCPBUGS-74947: Adding escapeHAProxySingleQuotes for sanitize [release-4.14] #782
OCPBUGS-86966: Regenerate expired test certificate for unit tests #781
Full changelog

hyperkube, pod

OCPBUGS-59473: UPSTREAM: 130047: adjusting loopback certificate validity in kube-apiserver #2364
OCPBUGS-67736, OCPBUGS-67822: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 [4.14] #2586
NO-JIRA: fix verify job failure #2584
OCPBUGS-74302: Skip E2e: attach on previously attached volumes should work #2570
OCPBUGS-59473: UPSTREAM: <carry>: disable some legacy cloud provider Azure tests #2579
Full changelog

hypershift

[release 4.14] Fix OCPBUGS-99086: CVE-2026-16242 konnectivity agent auth #9131
CNTRLPLANE-3979: Update release-4.14 Konflux pipelines to use shared pipelineRef #9196
OCPBUGS-84184: fix(cno): use brackets only for IPv6 in server URL #8370
OCPBUGS-61176: Add missing service network DNS entries to KAS cert #6742
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-79836: Bump google.golang.org/grpc to v1.79.3 #156
OCPBUGS-77212: [release-4.14] standardize build paths #126
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-67825, OCPBUGS-67826: bump github.com/sirupsen/logrus to v1.9.3 #166
Full changelog

ibm-vpc-node-label-updater

OCPBUGS-102599: Bump golang.org/x/net to v0.35.0-sec.4 #63
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-102592: Replace golang.org/x/net with openshift-sustaining/net #168
OCPBUGS-115546: Fetch envtest assets from the controller-tools releases #179
OCPBUGS-67290: [release-4.14] Fix incomplete vendor/ #136
OCPBUGS-51816: CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork #123
Full changelog

ibmcloud-machine-controllers

OCPBUGS-102612: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 #108
NO-JIRA: fix unit tests broken by deprecated kubebuilder-tools bucket #111
Full changelog

ironic

OCPBUGS-97989: bump openstack-ironic pin for CVE-2026-44918 fix #920
OCPBUGS-97806: bump openstack-ironic pin for CVE-2026-54423 fix(release-4.14) #879
OCPBUGS-69788: Bump eventlet version to 0.33.1-7 #765
Full changelog

ironic-agent

OCPBUGS-99891: Bump ironic-python-agent pinned commit for CVE-2026-66138 #312
OCPBUGS-96901: Replace individual package removal with a single rpm -e loop #278
OCPBUGS-69779: Bump eventlet version to 0.33.1-7 #234
Full changelog

ironic-machine-os-downloader

OCPBUGS-87171: CI image build root tag and go version in go.mod sync with ART 4.14 config #120
Full changelog

kube-state-metrics

NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #178
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-14). #229
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-95080: OWNERS: Update component to Cloud Compute / KubeVirt Provider #81
Full changelog

kubevirt-csi-driver

OCPBUGS-83659: Bump google.golang.org/grpc to v1.79.3 #104
Full changelog

machine-os-images

OCPBUGS-87880: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #104
Full changelog

monitoring-plugin

NO-JIRA: [release-4.14] Sanitize alert runbook URLs #1294
OCPBUGS-74442: [release-4.14] fix: upgrade lodash to remove vulnerable code #906
OCPBUGS-78495: fix for CVE-2025-69873 #851
Full changelog

multus-admission-controller

OCPBUGS-58763: Bump github.com/golang/glog to v1.2.4 #105
Full changelog

multus-cni

OCPBUGS-85381: Sanitize bracketed hostnames in kubeconfig server URLs #295
Bump Go to 1.21 and fix CI build root image #293
OCPBUGS-85253: Fix server url in kubeconfig #287
Full changelog

network-metrics-daemon

OCPBUGS-58778: Bump github.com/golang/glog to v1.2.4 (#115) #115
OCPBUGS-60394: Replace e2e test image (#128) #128
swtich golint install method (#127) #127
Full changelog

oauth-apiserver

OCPBUGS-74926: bump kubernetes-apiserver to pick up loopback cert expiration update #174
NO-JIRA: (chore): update OWNERS #176
Full changelog

oauth-proxy

OCPBUGS-112093: bugfix: rewrite open redirect strings to ‘/’ #388
Full changelog

oauth-server

OCPBUGS-87064: bugfix: default to english when Accept-Language header contains more than 1000 underscores #276
Full changelog

oc-mirror

OCPBUGS-129616: v1 accept catalog root entries and relative symlink targets #1582
Full changelog

openshift-apiserver

OCPBUGS-82649: Address CVE-2026-35469 #659
OCPBUGS-74924: bump kubernetes-apiserver to pick up loopback cert expiration update #602
OCPBUGS-76483: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.14] #612
OCPBUGS-56613: Fix image reference in TestImageStreamImportQuayIO #518
Full changelog

openshift-state-metrics

OCPBUGS-102633: CVE-2026-33814 openshift4/ose-openshift-state-metrics-rhel8:Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.14.z] #136
Full changelog

openstack-cinder-csi-driver-operator

OCPBUGS-67853: Bump logrus #189
Full changelog

openstack-machine-api-provider

OCPBUGS-78172: hermetic 4.14 #165
Full changelog

operator-lifecycle-manager, operator-registry

OCPBUGS-102630: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #1373
OCPBUGS-87896, OCPBUGS-87899: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.64.1-sec.1 [release-4.14] #1326
OCPBUGS-86253: Drop github.com/distribution/distribution dep #1304
OCPBUGS-61469: [release-4.14] Add NetworkPolicy as a supported kind #1052
OCPBUGS-61390: [4.14] e2e stability fixes #1085
Full changelog

operator-marketplace

OCPBUGS-62222: Remove Expect func so that the test case can use the retry logic #673
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-97816: External gateway: Remove routes for external gateway pods in terminating or not ready state #3286
CORENET-6055, OCPBUGS-78982: [release-4.14] Dockerfile: Unpin OVN and consume the latest from FDP #3073
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-67860: Fix CVE-2025-65637 by bumping logrus to v1.9.1 #100
Full changelog

powervs-machine-controllers

OCPBUGS-78039: hermetic 4.14 #136
Full changelog

prom-label-proxy

NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #405
Full changelog

prometheus

OCPBUGS-102651: Use patched x/net fork v0.35.0-sec.4 #376
NO-ISSUE: synchronize OWNERS from main branch #390
OCPBUGS-88588: remote: validate snappy decoded length before allocation in read endpoint #353
OCPBUGS-86878: Fix the inconsistent vendor directory #336
OCPBUGS-86878: Bump google.golang.org/grpc #323
Full changelog

prometheus-alertmanager

NO-JIRA: synchronize OWNERS with main #200
OCPBUGS-100361: Set testdata CA expiry to 20 years from issue date (#4112) #147
OCPBUGS-77837: Include go-verify-deps expected files in gitignore #121
Full changelog

prometheus-node-exporter

OCPBUGS-102636: Use patched x/net fork v0.35.0-sec.4 #192
NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #204
Full changelog

route-controller-manager

OCPBUGS-86883: [release-4.14] bump google.golang.org/grpc to v1.64.1-sec.1 #94
Full changelog

telemeter

NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #625
Full changelog

tests

OCPBUGS-74302: Skip E2e: attach on previously attached volumes should work #30727
OCPBUGS-63674: Fix regex parser #30391
OCPBUGS-61233: images/tests: Remove rteval #30208
Full changelog

thanos

NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #219
OCPBUGS-67876: CVE-2025-65637 Update sirupsen/logrus to 1.9.3 #167
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-78031: hermetic migration 4.14 #109
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-78023: hermetic migration 4.14 #88
OCPBUGS-61655: Fix unit tests #74
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-79856: Bump Bump google.golang.org/grpc #179
OCPBUGS-67880: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #160
Full changelog

vsphere-csi-driver-operator

OCPBUGS-67879, OCPBUGS-67885: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.9.3 #325
Full changelog

vsphere-problem-detector

OCPBUGS-102657: Bump golang.org/x/net to v0.35.0-sec.4 #237
OCPBUGS-67891: bump github.com/sirupsen/logrus to v1.9.3 #202
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github