4.17.59

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.17.59-x86_64

Qualifiers (status api):

Tests:

Blocking jobs
- upgrade Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Succeeded (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.17-e2e-aws-ovn-serial
- aws-ovn-upgrade-4.17-micro Succeeded periodic-ci-openshift-release-main-ci-4.17-e2e-aws-ovn-upgrade
- aws-ovn-upgrade-micro Succeeded periodic-ci-openshift-release-main-ci-4.17-e2e-aws-ovn-upgrade
- azure-ovn-upgrade-4.17-micro Succeeded periodic-ci-openshift-release-main-ci-4.17-e2e-azure-ovn-upgrade
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.17-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.17-fips-payload-scan
- gcp-ovn-rt-upgrade-4.17-minor Succeeded periodic-ci-openshift-release-main-ci-4.17-upgrade-from-stable-4.16-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.17 Succeeded periodic-ci-openshift-hypershift-release-4.17-periodics-e2e-aws-ovn-conformance
- metal-ipi-ovn-ipv4 Succeeded periodic-ci-openshift-release-main-nightly-4.17-e2e-metal-ipi-ovn-ipv4
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.17-e2e-metal-ipi-ovn-ipv6

Upgrades from:

Untested upgrades: 4.16.11, 4.16.12, 4.16.13, 4.16.14, 4.16.15, 4.16.16, 4.16.18, 4.16.19, 4.16.20, 4.16.21, 4.16.22, 4.16.23, 4.16.24, 4.16.25, 4.16.26, 4.16.27, 4.16.29, 4.16.30, 4.16.31, 4.16.32, 4.16.33, 4.16.34, 4.16.35, 4.16.36, 4.16.37, 4.16.38, 4.16.39, 4.16.40, 4.16.41, 4.16.42, 4.16.43, 4.16.44, 4.16.45, 4.16.46, 4.16.47, 4.16.48, 4.16.49, 4.16.50, 4.16.51, 4.16.52, 4.16.54, 4.16.55, 4.16.56, 4.16.57, 4.16.58, 4.16.59, 4.16.60, 4.16.61, 4.16.62, 4.16.63, 4.16.64, 4.16.65, 4.16.66, 4.16.67, 4.16.68, 4.16.69, 4.16.70, 4.17.10, 4.17.11, 4.17.12, 4.17.13, 4.17.14, 4.17.15, 4.17.16, 4.17.18, 4.17.19, 4.17.20, 4.17.21, 4.17.22, 4.17.23, 4.17.24, 4.17.25, 4.17.26, 4.17.28, 4.17.29, 4.17.3, 4.17.30, 4.17.31, 4.17.32, 4.17.33, 4.17.34, 4.17.35, 4.17.36, 4.17.37, 4.17.38, 4.17.39, 4.17.4, 4.17.40, 4.17.41, 4.17.42, 4.17.43, 4.17.44, 4.17.45, 4.17.46, 4.17.47, 4.17.48, 4.17.5, 4.17.50, 4.17.51, 4.17.52, 4.17.53, 4.17.54, 4.17.55, 4.17.6, 4.17.7, 4.17.8, 4.17.9

4.17.58 (changes) - S S S S S
4.17.57 (changes) - Failed
4.17.56 (changes) - Success
4.17.49 - Success
4.17.27 (changes) - Failed
4.17.17 (changes) - Success
4.17.2 (changes) - Failed
4.17.1 (changes) - Success
4.17.0 (changes) - Failed
4.16.73 (changes) - Failed
4.16.72 (changes) - F S F
4.16.71 (changes) - Failed
4.16.53 (changes) - Success
4.16.28 (changes) - Failed
4.16.17 (changes) - Failed
4.16.10 (changes) - Failed
4.16.9 (changes) - Failed
4.16.8 (changes) - Failed
4.16.0-0.nightly-2026-09-30-195605 (changes) - Success

Upgrades to:

Loading changelog, this may take a while ...

Changes from 4.17.49

Created: 2026-10-07 13:20:56 +0000 UTC

Image Digest: sha256:e94eed312b5fabec9333a6d27547fb01ccf528b3e5706a03a6916409dde24cd2

Components

Kubectl 1.30.5
Kubernetes 1.30.14
Kubernetes Tests 1.30.14
Red Hat Enterprise Linux CoreOS upgraded from 417.94.202602090846-0 to 417.94.202610010234-0 (diff)

Removed images

ovirt-csi-driver
ovirt-csi-driver-operator

Rebuilt images without code change

apiserver-network-proxy git ea660559 sha256:32b1c2b9c9ee8353c5328b090a3e46aff9d74d035aabfb1aa5b4ac81e638906d
aws-machine-controllers git 2b53de06 sha256:a530334b80f8129fe6f4f933f10be25699accafef90c3a456e731cb2e53a8ed9
aws-pod-identity-webhook git 80efc4ea sha256:ef3c3275bb33f4feead2bc8c823ecee38b4b02288533148dd5cb1ce41c3b4355
azure-workload-identity-webhook git 6707f899 sha256:74cee7c5bf9516abd035a3ba22a914e491c7685b0b858aa64c711b4733f38dcf
baremetal-cluster-api-controllers git 41b34248 sha256:e96de5583c04facdf0818055d437e8dfc7e68b72a9a0b42a48b52216c99096e9
baremetal-machine-controllers git ae674d78 sha256:51d820660f2e0daaf01225cceeaf46e517e23c70958ad6fb31053a48b78c3a0f
baremetal-runtimecfg git 74518950 sha256:926f57969839581b6211cbc0a1bd0d9f7a48d4c191aebc841fe056f551cfb4eb
cloud-network-config-controller git 241af368 sha256:4a64d5874bf005d45b958a3d63b429dd838ccbe6785bfa9eb3130255f9096fc0
cluster-bootstrap git 95dd9129 sha256:faa7b16a1d84466c142483aab8fb7cacb44e90c73f3d34050a8fc36d697f5cbc
cluster-cloud-controller-manager-operator git 6d4c0096 sha256:74653f0b8ddb9f6839548c242b64e3b0754c9dba8c8f42a39edf605c92663444
cluster-config-api git 92c55bf0 sha256:5a15a1a0e852171dc29c90c6624fce43c6efcc0912c5411ed2df4d8487703b2f
cluster-config-operator git cfd318de sha256:e1978846b560b7e4e955da4fd4e256d5c92db94803118b20f7b990a87c573077
cluster-control-plane-machine-set-operator git f7e01c2f sha256:073d71fbb3775e0b19393bbf436d664104da174d025f9124c32144d12d3d0b6b
cluster-dns-operator git 81507f04 sha256:98173c94e1a266e2cffe58c8b54fade0c16c8dcb27817a59b24524346c0cb935
cluster-etcd-operator git bfffdcba sha256:a971a64412ab70148b6e24e1e3f8b933f57d1ddfe9e218b60437bd15c952e963
cluster-machine-approver git acc2380e sha256:5d3aa98f865bdfbc8752c32e01f8554e12cf5d16c5c06e76b1e42be0e415e73a
cluster-openshift-controller-manager-operator git b05a249d sha256:2d79fa58eae295a404914cb8e2fbd31aa79aa328e5f8c81e3452234ca69ccf6c
cluster-policy-controller git 7209e90d sha256:b7660eb8a9a076c7ce57a8862e1edb8364352320fbde33d40a917c3eb23af603
cluster-samples-operator git 1d2ba422 sha256:6cfb2679be5b27191b772abf231a8bb4c4de97ffc549b4ed05f834d6be4afcbc
cluster-update-keys git 63022033 sha256:02fc74d517583f7d792e9dcbe125ea04688f5cfaf48b039f588b384490b3a162
cluster-version-operator git b855c680 sha256:4226cc20d6fa858166dabe346c33b3f50c6f619b354402b7b8e286647556ddfc
configmap-reloader git 62d56d6a sha256:608e78d1225e9d35621a5a5bd858bd784639c53c400a0c879b3fb45423ba8422
coredns git fe89d27d sha256:6c6bc184c0adb5e2d68c26b24863868f649a16c1414d9739a86c898361da75f4
csi-driver-manila-operator git efc99a2a sha256:d1c986492c2465619e8703272e32ff4c0a598dcddaf32b033fae9eab547a077c
csi-driver-shared-resource git 66aee5b0 sha256:eec13442c2c28d7bcbb9061690ed305e9a6f4064a99be0014d9e5406d32f424b
csi-driver-shared-resource-webhook git 66aee5b0 sha256:928afd24770d0ca3605c54c9a50f489ecc47ae66d548b86106b35a95a5a1cb92
csi-livenessprobe git e7d841dc sha256:fba10a11b671d289e66c7414ae7d746b26bf1176c1a677a88195728f3573a230
csi-node-driver-registrar git 3dd2253e sha256:e5dfd0e6470027222668ce75f2f48d599d2fbe0da1c59bde239e77e2593ff637
driver-toolkit git 859518f6 sha256:7523deeea15629cc2482e989f564aeb266cc1e9b4bfccc82c50222356db86cb2
egress-router-cni git 3193a756 sha256:b5327316d161475d9fc00031658e0995172cf907fa02423d9a8ed1b10042b2aa
etcd git 0d9e0a90 sha256:28d7970bcacb36f0f1fac155cd831cf43fb6cd1073a45db2ae907bc6f08ed786
gcp-cloud-controller-manager git 8ce997d7 sha256:39d308ad5f6ded80f09378458e55e3eac4804cf8fe52778891052173d55acf1f
gcp-workload-identity-federation-webhook git 08579e9f sha256:4613bbdc6ece6a632d6dd1d36c7b36621f66a1879aee291bc120920adb62cd76
hyperkube git 4e295fa5 sha256:3c0e04b0c74e07f4d6dc02563f15d846317812e0fa5543c8b883ce34a48e5242
ibm-cloud-controller-manager git ad8f7eb0 sha256:e9ea45ef4b853e70c3a3a5668d89c6fec8883643a042cf08b1947d8a89697d51
ibm-vpc-block-csi-driver-operator git ee301303 sha256:b09e1b9168d41746bde07895c10787f9d16c98b87e6b8c800eda3d34f7e1581d
ironic-machine-os-downloader git 9e6596c3 sha256:8f0b574ab5246fe81eae52a718f043cba9f9000896483e1a139b95c27b56241d
ironic-static-ip-manager git bc5b8a2c sha256:9206c95683a71ff1fd2a83caa496628003b09bde2bc2d9ac746b52c34bb14488
keepalived-ipfailover git e3879e9e sha256:54b08a279df55887c95b07d39b72b257155ebf18fb14fd5db53dcea6570be655
kube-proxy git fd50551b sha256:2a7da00687c82338da83c1f7ef8716f6a38a5a736e7f9c69d5cd48901fd75a72
kube-rbac-proxy git f708b5ec sha256:2110891a35b7c426cfff6c0eb9bf7b7f4c1bbafb671e980c5141fbb6a1677af2
kube-storage-version-migrator git 69b07ae0 sha256:0281c0b4eb31e9d5f32034fef982cbc9a9acb9dda3250b3d4d026542e6c980d5
machine-image-customization-controller git 03af8514 sha256:c005a784c2ed11c8e19434353f25f5d65f8b752e7ad5a8dbefb31b6d8f81d31b
multus-admission-controller git 041b743a sha256:94ad8ef90895d74239ed29036297d7c5e6f7aa7143e3529a0886ce1fec1ca837
multus-networkpolicy git 4d0b1703 sha256:79151832873b1b2f51738b72cab0acce56dab88671b5f860f5d4f7a4863874c8
multus-route-override-cni git 391c1b03 sha256:5108e93543ecea7ef38868ae4979fc1b881de743d9df13dd3edc4b4ddcd9bbca
multus-whereabouts-ipam-cni git 40cfb3dc sha256:aeb3575bd5b1830daaddb423bfad4c2ec95fc97ea2dec94d0978f35413718b5e
network-metrics-daemon git f56bbf7a sha256:b3b5d2813f430bbb20693d7cc4b4691ccbd8d4014679b76889c079581fa0bd09
network-tools git e59e7b25 sha256:bfa3b7b9a8ee292a835653e04a1b62f05fdd84e93032b7d82259088918e78735
nutanix-cloud-controller-manager git c9f6cd1f sha256:2315a564b13c0a698442c21c281459c75d12d01a9ddfa22bdbd2b5c3318b482c
nutanix-machine-controllers git a4fadcbc sha256:5fef2a6eab87823ec26a172ffd1d2f15ad441956c8653a88bc127e493cc78fe6
oauth-apiserver git e078aeb2 sha256:2bb2f37b21b9d23ec27e0b34116807cce2852f545139c4580f2c55d18603d488
oc-mirror git 58375b70 sha256:b9f04b35cdbb2eac9d48c63f556a90d0a8f47f1364652c37d857272d1eb4e747
olm-catalogd git c740e056 sha256:ca0d8c608f763db4402c4e32bab418263dae0bbe258316a7a21a61a3b0a2b622
openshift-controller-manager git 967faa66 sha256:dde4a16bd8cd7abc59cf70a2b781fc39dd6fd353c55971c857830665563411e2
openshift-state-metrics git adf64920 sha256:88eb4327aaa9dd0668b509b8ab8d2d6dd62c4a4c4398dae2edc4ea17cdabd077
openstack-cluster-api-controllers git 5593c5f7 sha256:ea0a217ef44ce2246b6890cacf8ce729388b7a3755e9b6f2d7435d2c48730f10
operator-marketplace git 5cf36fde sha256:390b14feafd8b03db57946c12c5ee5766624deb1dcc27d9dd6a05d6d7d010486
pod git 4e295fa5 sha256:d5e58ba139187b155b06f85a2240701229370b22999f00ba540cf7d9df1d8fd4
powervs-machine-controllers git b7478d7e sha256:d3ce49c12acfa8ca19131fc85f51244ad0e01dbc5796adfaa1284ce137ed09b3
rhel-coreos sha256:f317ee961be4b4c2105c066e2b58913bd16dbe6380bb5b6b2c06bfe34bfcc8ce
rhel-coreos-extensions sha256:9ab868cfdb0c448298ab7bb21fbaa388d871fc212d3d32f3f1cfca7c017df1d7
tests git 5abe37f6 sha256:7b9a048594716cdfbce0a83ec42b750a5f1bf14376a289e72d2cfe46d577f35a

agent-installer-api-server

OCPBUGS-89875: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.2 #10801
MGMT-23439: Pin gotestsum to v1.12.2 for Go 1.20 compatibility #10016
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-103137: Bump x/net to v0.35.0-sec.4 #2296
Full changelog

agent-installer-node-agent

OCPBUGS-103143: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #1617
Full changelog

agent-installer-utils

OCPBUGS-68141: bump github.com/sirupsen/logrus to v1.9.3 #238
Full changelog

aws-cloud-controller-manager

OCPBUGS-103332: Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #172
OCPBUGS-88219: replace golang.org/x/net with sustaining fork v0.35.0-sec.4 #181
Full changelog

aws-cluster-api-controllers

🌱 OCPBUGS-123711: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #644
OCPBUGS-78175: [release-4.17] update go mod dependency for konflux #590
Full changelog

aws-ebs-csi-driver

OCPBUGS-82699: Address CVE-2026-35469 #328
OCPBUGS-86234: UPSTREAM: 2367: cleanup: make verify should ignore copyright year #323
OCPBUGS-80031: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.71.3-sec.1 #314
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator

OCPBUGS-103147, OCPBUGS-103155: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #609
OCPBUGS-80133: Bump google.golang.org/grpc #543
Full changelog

aws-kms-encryption-provider

OCPBUGS-80009: Bump google.golang.org/grpc to v1.79.3 #44
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-80035, OCPBUGS-80036, OCPBUGS-80174: Bump google.golang.org/grpc to v1.79.3 #181
Full changelog

azure-cluster-api-controllers

OCPBUGS-80037: Bump google.golang.org/grpc to v1.79.3 #386
OCPBUGS-77983: [release-4.17] update go mod dependency for konflux #363
Full changelog

azure-disk-csi-driver

OCPBUGS-80038: Address CVE-2026-33186 #143
Full changelog

azure-file-csi-driver

OCPBUGS-103162: Bump golang.org/x/net to v0.35.0-sec.4 #159
OCPBUGS-92849: Bump golang.org/x/crypto to v0.33.0-sec.3 #149
OCPBUGS-80041: Bump google.golang.org/grpc to v1.79.3 #130
Full changelog

azure-kms-encryption-provider

OCPBUGS-80010: Bump google.golang.org/grpc to 1.64.1-sec.1 patch #47
Full changelog

azure-machine-controllers

OCPBUGS-103260: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #214
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-89851, OCPBUGS-89856, OCPBUGS-89859, OCPBUGS-92861: Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.33.0-sec.4 #10906
OCPBUGS-127575: Update gcloud version to one that can be found #10917
OCPBUGS-77898: Update RHCOS-release-4.17 bootimage metadata to 417.94.202607240132-0 #10796
OCPBUGS-67204: Update the RHCOS 4.17 bootimage metadata #10285
OCPBUGS-77791: [Release 4.17] pkg/asset/manifests/azure: save cidr blocks #10218
Full changelog

baremetal-operator

OCPBUGS-77185: Unblock BMH direct deletion when detached annotation is present #462
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-91064, OCPBUGS-94526: Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.2 #2345
OCPBUGS-111835: Fix pre-existing unit test failures #2373
Full changelog

cloud-credential-operator

OCPBUGS-81861: Bump go-jose/go-jose/v4@v4.1.4 #1039
OCPBUGS-80044: Bump google.golang.org/grpc to v1.79.3 #1025
Full changelog

cluster-authentication-operator

OCPBUGS-68150: Update library-go to fix CVE-2025-65637 #840
Full changelog

cluster-autoscaler

OCPBUGS-78700: allow clusterapi provider to skip paused resources #414
OCPBUGS-68151: update logrus to version 1.9.3 #398
Full changelog

cluster-autoscaler-operator

OCPBUGS-103166: Bump x/net package in release-4.17 #389
Full changelog

cluster-baremetal-operator

OCPBUGS-77446: Bump github.com/go-errors/errors to v1.5.1 #561
Full changelog

cluster-capi-controllers

OCPBUGS-80045: Bump google.golang.org/grpc to v1.79.3 #291
Full changelog

cluster-capi-operator

OCPBUGS-80049: Bump google.golang.org/grpc to v1.79.3 #570
NO-JIRA: Allow sustaining engineering to self serve dependency updates #559
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-103180: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #292
Full changelog

cluster-image-registry-operator

OCPBUGS-68157: Bump github.com/sirupsen/logrus to 1.9.3 #1284
Full changelog

cluster-ingress-operator

OCPBUGS-103182: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1572
OCPBUGS-86714: Add configuration override for X-SSL strip #1486
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-68162: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-rhel9-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.17] #2055
Full changelog

cluster-kube-cluster-api-operator

OCPBUGS-80056: Bump google.golang.org/grpc to v1.79.3 #78
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-68164: CVE-2025-65637 openshift4/ose-cluster-kube-controller-manager-rhel9-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.17] #908
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #623
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-68167: Bump github.com/sirupsen/logrus to 1.9.1 #140
Full changelog

cluster-monitoring-operator

NO-ISSUE: synchronize OWNERS from main branch [release-4.17] #3110
OCPBUGS-103184: [release-4.17] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame- #3075 #3084
OCPBUGS-77275: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2832
Full changelog

cluster-network-operator

OCPBUGS-85244: whereabouts-token-watcher DaemonSet improvements #3016
OCPBUGS-84181: fix(hypershift): use net.JoinHostPort for URL construction #2983
Full changelog

cluster-node-tuning-operator

OCPBUGS-82706: Bump github.com/moby/spdystream from v0.2.0 to v0.5.1 #1548
OCPBUGS-78214: PPC: filter out namespaces dir #1481
Full changelog

cluster-olm-operator

OCPBUGS-80063: Bump google.golang.org/grpc to v1.79.3 #201
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-68170: CVE-2025-65637 - Update library-go to bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.17] #653
Full changelog

cluster-storage-operator

OCPBUGS-87591: remove oVirt code from CSO 4.17 #708
Full changelog

console

Fix for OCPBUGS-92069: CVE-2026-44990 #16718
OCPBUGS-78672: Namespace is not persisting when switching to developer view from the topology page of admin page #16160
OCPBUGS-98411: CVE-2026-59869 bump js-yaml #17086
OCPBUGS-100514, OCPBUGS-101790: Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss #17059
OCPBUGS-100172: Prevent binary secret data corruption when editing #16879
OCPBUGS-105790: Disable shipwright e2e tests to unblock CI #16955
OCPBUGS-87986: [release-4.17] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16600
Fix for OCPBUGS-81600: CVE-2026-4800 #16564
OCPBUGS-84283: Bump follow-redirects to 1.16.0 to fix CVE-2026-40895 #16738
OCPBUGS-77124: [release-4.17] CVE-2026-26996 Bump minimatch library #16345
OCPBUGS-79443: Bump immutable #16326
NO-JIRA: enable multi-architecture yarn builds #16419
CONSOLE-5011: migrate to yarn berry #16074
Full changelog

console-operator

OCPBUGS-77862: update go mod dependency for konflux #1114
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-85671: CI Build root image tag sync with ART #235
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-80134: Bump google.golang.org/grpc #388
Full changelog

csi-driver-nfs

OCPBUGS-82708: Bump github.com/moby/spdystream@v0.5.1 #195
OCPBUGS-80077: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.71.3-sec.1 to avoid go version bump and fix CVE-2026-33186 #181
Full changelog

csi-driver-shared-resource-operator

OCPBUGS-103198: Bump golang.org/x/net to v0.35.0-sec.3 #127
OCPBUGS-80080: Bump google.golang.org/grpc to v1.79.3 #125
Full changelog

csi-external-attacher

OCPBUGS-80082: Bump google.golang.org/grpc to v1.79.3 #106
Full changelog

csi-external-provisioner

OCPBUGS-82709: Address CVE-2026-35469 #142
OCPBUGS-80083: Bump google.golang.org/grpc #131
Full changelog

csi-external-resizer

OCPBUGS-103208: Bump golang.org/x/net to v0.35.0-sec.4 #214
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-80085, OCPBUGS-80088, OCPBUGS-80089: Bump google.golang.org/grpc to v1.79.3 #214
Full changelog

docker-builder

OCPBUGS-89852, OCPBUGS-90297, OCPBUGS-92380, OCPBUGS-92577, OCPBUGS-92854: Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 #548
OCPBUGS-66988: bump buildah to 1.37.7 to fix CVE-2025-52881 #499
Full changelog

docker-registry

OCPBUGS-68182: update logrus to v1.9.1 #465
Full changelog

gcp-cluster-api-controllers

OCPBUGS-80095: Bump google.golang.org/grpc to v1.79.3 #291
OCPBUGS-78279: [release-4.17] update go mod dependency for konflux #266
Full changelog

gcp-machine-controllers

OCPBUGS-103253: Bump golang.org/x/net to v0.35.0-sec.3 #190
OCPBUGS-80118: Bump google.golang.org/grpc to v1.79.3 #166
Full changelog

gcp-pd-csi-driver

OCPBUGS-80099: Replace google.golang.org/grpc with openshift-sustaining fork v1.71.3-sec.1 #113
Full changelog

gcp-pd-csi-driver-operator

OCPBUGS-80098: Replace google.golang.org/grpc with fork #188
Full changelog

haproxy-router

OCPBUGS-86725: Prevent SSRF via FQDN-typed EndpointSlices #835
OCPBUGS-86714: Strip X-SSL-* headers for plain HTTP #804
OCPBUGS-80100: Address CVE-2026-33186 #779
Full changelog

hypershift

OCPBUGS-76289: CVE-2025-52881 openshift/hypershift multicluster-engine/hypershift-rhel9-operator: container escape and denial of service due to arbitrary write gadgets and procfs write redirects [mce-2.7] #8292
OCPBUGS-99079: fix(backport): konnectivity agent auth #9104
OCPBUGS-89357: build(operator): drop hypershift-no-cgo from operator container images #8761
OCPBUGS-80103: fix https://github.com/advisories/GHSA-p77j-4mvh-x3m3 by replacing grpc-go #8516
OCPBUGS-84181: fix(cno): use brackets only for IPv6 in server URL #8347
OCPBUGS-76533: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7703
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-80105: Bump google.golang.org/grpc to v1.79.3 #144
OCPBUGS-77209: [release-4.17] standardize build paths #123
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-86974: Updating ose-ibmcloud-cluster-api-controllers-container image to be consistent with ART for 4.17 #155
OCPBUGS-103234: Replace golang.org/x/net with openshift-sustaining/net #171
OCPBUGS-115543: Fetch envtest assets from the controller-tools releases #182
Full changelog

ibmcloud-machine-controllers

OCPBUGS-103227: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 #105
NO-JIRA: vendor golint instead of relying on the CI build root #114
OCPBUGS-81667: bump vpc go sdk #92
NO-JIRA: Modernize test infrastructure to align with other MAPI providers #88
Full changelog

insights-operator

OCPBUGS-80108: Bump google.golang.org/grpc to v1.79.3 #1284
OCPBUGS-68193: OCPBUGS-68194: [vuln] Update logrus library to 1.9.3 #1227
Full changelog

ironic

OCPBUGS-88474: Update the commit hash for openstack-ironic that addresses CVE-2026-43003 #905
OCPBUGS-100163: Update openstack-ironic commit hash for CVE-2026-44918 #902
OCPBUGS-76458: Bump pyasn1 to 0.5.1-4 #827
OCPBUGS-74114: Bump keystonemiddleware version to 10.7.1-0.20260216144200.4c001ba for CVE-2026-22797 fix #796
Full changelog

ironic-agent

OCPBUGS-88474: Update commit hash for openstack-ironic-python-agent that addresses CVE-2026-43003 #315
OCPBUGS-99886: Bump ironic-python-agent pinned commit for CVE-2026-66138 #309
OCPBUGS-95067: Replace individual package removal with a single rpm -e loop #287
OCPBUGS-95067: Replace dnf remove with rpm -e to prevent dependency removal #275
Full changelog

kube-metrics-server

NO-ISSUE: synchronize OWNERS from main branch [release-4.17] #89
OCPBUGS-80013: Bump google.golang.org/grpc to v1.79.3 #65
Full changelog

kube-state-metrics

NO-ISSUE: synchronize OWNERS from main branch [release-4.17] #186
OCPBUGS-74874: Deduplicate CRS stores #132
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-95083: OWNERS: Update component to Cloud Compute / KubeVirt Provider #79
Full changelog

kubevirt-csi-driver

OCPBUGS-80014: Bump google.golang.org/grpc to v1.79.3 #102
Full changelog

libvirt-machine-controllers

OCPBUGS-77195: Fix incomplete vendor/ #301
Full changelog

machine-api-operator

OCPBUGS-103256: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #1546
OCPBUGS-79373: [release-4.17] Use resource group when generating default Azure image #1481
Full changelog

machine-config-operator

OCPBUGS-98583: Remove sensitive ControllerConfig logging #6300
OCPBUGS-97845: Bootstrap MCS logging entire ignition #6274
OCPBUGS-74149: enable nodeip-configuration for platform external #5577
OCPBUGS-77979: hermetic 4.17 #5733
OCPBUGS-77889: reduce MCO image size #5746
OCPBUGS-77812: mcd_config_drift not working properly #5741
OCPBUGS-77422: Remove MCD liveness probe #5709
OCPBUGS-77242: After OCL is enabled few phases in MCN are not updating as expected #5575
OCPBUGS-77186: Machine-config controller should not log about non-existent pull-secret changes #5679
OCPBUGS-77090: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5678
OCPBUGS-61190: MCO report “failed to list *v1alpha1.MachineOSConfig” when enable TechPreview after upgrading from 4.16 to 4.17 with one mcp paused #5584
Full changelog

machine-os-images

OCPBUGS-87877: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #101
Full changelog

metallb-frr

OCPBUGS-76548: Dockerfile: unpin FRR rpm #124
Full changelog

monitoring-plugin

Fix for OCPBUGS-98163: CVE-2026-13676 #1050
Fix for OCPBUGS-90525 OCPBUGS-90526: CVE-2026-12151 CVE-2026-9697 #1008
OCPBUGS-79444: immutable bump #897
OU-1260: [release-4.17] feat: use npm instead of yarn #812
OCPBUGS-76809: fix for CVE-2025-69873 #848
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-85250: Fix server url in kubeconfig #299
NO-ISSUE: [release-4.17] Bump Go to 1.22 and fix CI build root image #290
OCPBUGS-77854: hermetic 4.17 #277
Full changelog

must-gather

OCPBUGS-86069: Collect object size with the object count #548
Full changelog

network-interface-bond-cni

OCPBUGS-77350: Updating ose-network-interface-bond-cni-container image to be consistent with ART for 4.17 #110
Full changelog

networking-console-plugin

OCPBUGS-98764: Updating linkify-it to 5.0.2 to fix CVE-2026-48801 #459
OCPBUGS-100158: Updating networking-console-plugin-container image to be consistent with ART for 4.17 #455
OCPBUGS-87998: Retain namespace selection between network policies tabs #428
OCPBUGS-83379: fix CVE-2026-34043 - Update serialize-javascript to 7.0.5 #416
[release-4:17] OCPBUGS-85376: Migration from yarn to npm #414
OCPBUGS-81602: Fix CVE-2026-CVE-2026-4800 in lodash #402
OCPBUGS-79445: Bump immutable #389
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

oauth-server

OCPBUGS-81795: Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 #239
Full changelog

olm-operator-controller

OCPBUGS-103266, OCPBUGS-103269: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #805
OCPBUGS-80129: Update grpc-go to v1.71.3-sec.1 to fix CVE-2026-33186 #736
Full changelog

openshift-apiserver

OCPBUGS-82720: Address CVE-2026-35469 #658
OCPBUGS-68208: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.17] #609
Full changelog

openstack-cinder-csi-driver-operator

OCPBUGS-80133: Bump google.golang.org/grpc to v1.79.3 #194
Full changelog

openstack-machine-api-provider

OCPBUGS-78169: hermetic 4.17 #162
OCPBUGS-76793: Fix make test #160
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-103275, OCPBUGS-103278, OCPBUGS-103286: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1368
OCPBUGS-80136, OCPBUGS-80137, OCPBUGS-80138: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.71.3-sec.1 [release-4.17] #1315
OCPBUGS-77838: Remove the collect-profiles info from the microshift kustomization file #1250
OCPBUGS-76953: Remove the collect-profiles job #1232
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-128826: node: fix serviceUpdateNotNeeded nil pointer comparison #3496
OCPBUGS-82724: Bump github.com/moby/spdystream to v0.5.1 #3322
OCPBUGS-81639: External gateway: Remove routes for external gateway pods in terminating or not ready state #3107
OCPBUGS-78029: Add pperiyasamy to OWNERS for release-4.17 #3046
OCPBUGS-77568: Clear stale conntrack UDP entries for nodePorts #3035
Full changelog

powervs-block-csi-driver

OCPBUGS-80142: Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 #131
OCPBUGS-82725: Fix CVE-2026-35469 by bumping github.com/moby/spdystream to v0.5.1 #125
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-80144: Fix CVE-2026-33186 by bumping google.golang.org/grpc to v1.79.3 #112
Full changelog

powervs-cloud-controller-manager

OCPBUGS-80145: Replace google.golang.org/grpc with openshift-sustaining fork v1.71.3-sec.1 to v1.79.3 to fix CVE-2026-33186 #103
Full changelog

prom-label-proxy

NO-ISSUE: synchronize OWNERS from main branch [release-4.17] #403
Full changelog

prometheus

OCPBUGS-93681: fix for CVE-2026-42151 #378
NO-ISSUE: synchronize OWNERS from main branch #383
OCPBUGS-88631: remote: validate snappy decoded length before allocation in read endpoint #348
OCPBUGS-80146: Bump google.golang.org/grpc #320
Full changelog

prometheus-alertmanager

NO-JIRA: synchronize OWNERS with main #196
OCPBUGS-103294: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #173
OCPBUGS-98167: bump github.com/hashicorp/memberlist to a forked version #166
OCPBUGS-100356: Set testdata CA expiry to 20 years from issue date (#4112) #151
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-103296, OCPBUGS-103297: [release-4.17] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #399
OCPBUGS-77452: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #369
Full changelog