# 5.1.0-ec.2
Created: 2026-11-06 21:04:45 +0000 UTC
Image Digest: `sha256:1c0b97f5c13dcccf8abc33e797fc96a650ecb5a8e7c88a2a5d8ab05d930963cf`
## Changes from 5.1.0-ec.1
### Components
* Kubectl upgraded from 1.36.2 to 1.37.1
* Kubernetes upgraded from 1.36.4 to 1.37.1
* Kubernetes Tests 1.36.2
* Red Hat Enterprise Linux CoreOS 10.2 upgraded from 10.2.20260918-0 to 10.2.20261027-0
### FeatureGate Changes
| FeatureGate | Default
Hypershift | Default
SelfManagedHA | DevPreviewNoUpgrade
Hypershift | DevPreviewNoUpgrade
SelfManagedHA | OKD
Hypershift | OKD
SelfManagedHA | TechPreviewNoUpgrade
Hypershift | TechPreviewNoUpgrade
SelfManagedHA |
| :------ | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: |
| BootImageSkewEnforcement
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| DualReplica
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| SELinuxMountGAReadiness
(0 tests)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed)| Unconditionally Enabled
(Changed) |
| AzureMultiDisk
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| KMSEncryption
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled |
| OpenShiftPodSecurityAdmission
(0 tests)| Disabled
(Changed)| Disabled
(Changed)| Enabled| Enabled| Disabled
(Changed)| Disabled
(Changed)| Enabled| Enabled |
| TLSAdherence
(0 tests)| Enabled
(Changed)| Enabled
(Changed)| Enabled| Enabled| Enabled| Enabled| Enabled| Enabled |
| OLMLifecycleAndCompatibility
(0 tests)| Disabled| Disabled
(Changed)| Disabled| Enabled| Disabled| Disabled
(Changed)| Disabled| Disabled
(Changed) |
| AuthenticationComponentProxy
(0 tests)| Disabled| Enabled
(Changed)| Disabled| Enabled| Disabled| Enabled
(Changed)| Disabled| Enabled |
| DRADeviceTaintRules
(0 tests)| Disabled| Disabled| Enabled
(Changed)| Enabled
(Changed)| Disabled| Disabled| Enabled
(Changed)| Enabled
(Changed) |
| AuthenticationComponentProxyExternalOIDC
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | | |
| ClusterAPIMachineManagementNutanix
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| ClusterAPIOperator
(0 tests)| | | | Enabled
(New)| | | | Enabled
(New) |
| CompositePodGroup
(0 tests)| | | | | | | | |
| ControllerManagerConfig
(0 tests)| | | | Enabled
(New)| | | | |
| DRAWorkloadResourceClaims
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| ExternalOIDCAsWebhook
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| GenericWorkload
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| MACSecurity
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| MachineAPIMigrationNutanix
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| MetalEnrollmentAPI
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | | |
| OpenStackMaxAllowedAddressPairs
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| PodGroupPreemptionPolicy
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| StoragePathAlert
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| TopologyAwareWorkloadScheduling
(0 tests)| | | Enabled
(New)| Enabled
(New)| | | Enabled
(New)| Enabled
(New) |
| UnifiedClusterManagedDNSAndLB
(0 tests)| | | | Enabled
(New)| | | | |
### New images
* [azure-karpenter-provider-azure](https://github.com/openshift/Azure-karpenter-provider-azure) git [bc70c724](https://github.com/openshift/Azure-karpenter-provider-azure/commit/bc70c7241ed3f1e05d97a4713c9bfdefc52cf1ee) `sha256:e2922db3ed3e344be8bbe9456b48214c834f956292ce7d40472935f7e6b4a8e3`
* [csi-volume-device-exporter](https://github.com/openshift/csi-volume-device-exporter) git [78eb5c79](https://github.com/openshift/csi-volume-device-exporter/commit/78eb5c79aabe534846771f4166c783a8a79886e6) `sha256:9157455805c2187936ba8ba94f4573925d2ea0d9ed022584464238c9433ffbc9`
### Removed images
* configmap-reloader
* haproxy-router-haproxy28
### Rebuilt images without code change
* [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler) git [a819db45](https://github.com/openshift/kubernetes-autoscaler/commit/a819db459f3e0a88becba4c58bf053c6dbda28f2) `sha256:776fa0778b67b37479efecbf976ed34dc4b901042a929eff1a8f4deead8184f6`
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [9607604d](https://github.com/openshift/cluster-update-keys/commit/9607604d35acee234051bd0da8a14321b4edd38e) `sha256:601fc62cc02f12cd8801e16a463fd5010733586be5110edbef392b70ec7415af`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [b63b175a](https://github.com/openshift/driver-toolkit/commit/b63b175a79b9fe0c29f6ed63df3c2d7862ba408a) `sha256:e9e0e3d59f9520c0299b5083bd5c059b1047d5b8fcf3b2f0310a10eedc569d02`
* [driver-toolkit-10](https://github.com/openshift/driver-toolkit) git [b63b175a](https://github.com/openshift/driver-toolkit/commit/b63b175a79b9fe0c29f6ed63df3c2d7862ba408a) `sha256:c559cb8b67c3932314b78f6a70ca4597c327432ed848f4202fcd308d77954b95`
* [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook) git [4501ff2f](https://github.com/openshift/gcp-workload-identity-federation-webhook/commit/4501ff2f53576c31df0511b69444e65e1eeba745) `sha256:d2a71eb65885bb1b4f14ba0747b42fd22955f4310fc18ce41d8beee489691a41`
* [kube-vip](https://github.com/openshift/kube-vip) git [b272a734](https://github.com/openshift/kube-vip/commit/b272a7342833dad64574158101decb94ebe703d0) `sha256:1208a7453295f54f670c8ea0349d0634288115f0da72348f82f51f8002d448b8`
* [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy) git [39e9cccf](https://github.com/openshift/multus-networkpolicy/commit/39e9cccfa32951d0243c99638099da0a84d0d598) `sha256:a574a672bcd7ebeafec712fe971997f5aa7baf10c5addb913970c987f451f98c`
* [network-interface-bond-cni](https://github.com/openshift/bond-cni) git [b8723844](https://github.com/openshift/bond-cni/commit/b8723844dc69940f55208cdb265653ab57f959f0) `sha256:c8e4d6fa1de30db47b35a732b7f5070782e2853f500739c846b59bc8273d73af`
* [openstack-resource-controller](https://github.com/openshift/openstack-resource-controller) git [64203711](https://github.com/openshift/openstack-resource-controller/commit/642037113b21f8b553ae449ed79888afd46cd006) `sha256:8928db879bf0eb365e8cf5ce1f28b84213669696eca5b4de46b34f4c690acd90`
* [route-controller-manager](https://github.com/openshift/route-controller-manager) git [a158fff7](https://github.com/openshift/route-controller-manager/commit/a158fff7ce3826058bd2d7338b206cdd600d0d40) `sha256:4366718a7b751dd8afafc661a6c9fe890d1c5f6622eb0e136121d2e19cafd88f`
* [service-ca-operator](https://github.com/openshift/service-ca-operator) git [ed872ba1](https://github.com/openshift/service-ca-operator/commit/ed872ba14b615ca5726ae90e987268877a0b0b20) `sha256:83e290b2ccd0c4d54565183f2d1c7636a0203e4b7f64fb3ea33e248b7ae730c9`
### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/0d44006dc6e77a6930d650cfd87c6bc7fb4b4c45)
* NO-ISSUE: [master] Bump OCP versions: 4.19, 5.0 [#11336](https://github.com/openshift/assisted-service/pull/11336)
* NO-ISSUE: Refresh RPM lockfiles [#11331](https://github.com/openshift/assisted-service/pull/11331)
* NO-ISSUE: [master] Bump OCP versions: 4.14, 4.18, 4.20, 4.16, 4.22, 4.19, 4.21, 5.0 [#11323](https://github.com/openshift/assisted-service/pull/11323)
* [MGMT-25002](https://issues.redhat.com/browse/MGMT-25002): Prevent host event leaks across InfraEnvs [#11036](https://github.com/openshift/assisted-service/pull/11036)
* [MGMT-25583](https://issues.redhat.com/browse/MGMT-25583): CVE-2026-116587 Bump github.com/go-jose/go-jose/v4 to v4.1.6 [#11321](https://github.com/openshift/assisted-service/pull/11321)
* NO-ISSUE: Refresh RPM lockfiles [#11297](https://github.com/openshift/assisted-service/pull/11297)
* NO-ISSUE: [master] Bump OCP versions: 4.19 [#11278](https://github.com/openshift/assisted-service/pull/11278)
* [MGMT-25480](https://issues.redhat.com/browse/MGMT-25480): Sync NTP sources from CRD spec by comparing to DB [#11198](https://github.com/openshift/assisted-service/pull/11198)
* NO-ISSUE: [master] Bump OCP versions: 4.21, 4.20, 4.22 [#11270](https://github.com/openshift/assisted-service/pull/11270)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#11264](https://github.com/openshift/assisted-service/pull/11264)
* [OCPEDGE-3082](https://issues.redhat.com/browse/OCPEDGE-3082): Skip dnsmasq for UnifiedClusterManagedDNSAndLB FG + SNO + None platform [#11228](https://github.com/openshift/assisted-service/pull/11228)
* [ACM-48279](https://issues.redhat.com/browse/ACM-48279): Cilium blocks infrastructure-operator access to the Kubernetes API [#11245](https://github.com/openshift/assisted-service/pull/11245)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#11254](https://github.com/openshift/assisted-service/pull/11254)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#11043](https://github.com/openshift/assisted-service/pull/11043)
* [ACM-44934](https://issues.redhat.com/browse/ACM-44934): CVE-2026-88031 Bump go.mongodb.org/mongo-driver to v1.17.10 using replace directive [#11220](https://github.com/openshift/assisted-service/pull/11220)
* NO-ISSUE: [master] Bump OCP versions: 4.13, 4.16, 4.17, 4.18, 5.0 [#11240](https://github.com/openshift/assisted-service/pull/11240)
* NO-ISSUE: [master] Bump OCP versions: 4.22, 4.19 [#11229](https://github.com/openshift/assisted-service/pull/11229)
* NO-ISSUE: [master] Bump OCP versions: 4.20, 4.21 [#11205](https://github.com/openshift/assisted-service/pull/11205)
* [AGENT-1648](https://issues.redhat.com/browse/AGENT-1648): Set fips in install-config for the agent-based installer [#11114](https://github.com/openshift/assisted-service/pull/11114)
* NO-ISSUE: [master] Bump OCP versions: 5.0 [#11204](https://github.com/openshift/assisted-service/pull/11204)
* [MGMT-19216](https://issues.redhat.com/browse/MGMT-19216): Add node selector and tolerations to our webhook [#11049](https://github.com/openshift/assisted-service/pull/11049)
* [ACM-44934](https://issues.redhat.com/browse/ACM-44934): CVE-2026-88031 Bump github.com/go-openapi/loads, github.com/go-openapi/analysis, github.com/go-openapi/validate, github.com/go-openapi/strfmt to fix CVE-2026-88031 through introducers update (models module) [#11165](https://github.com/openshift/assisted-service/pull/11165)
* [MGMT-25133](https://issues.redhat.com/browse/MGMT-25133): Accept OpenSSH authorized_keys options in SSH key validation [#10830](https://github.com/openshift/assisted-service/pull/10830)
* [ACM-44934](https://issues.redhat.com/browse/ACM-44934): CVE-2026-88031 Bump go.mongodb.org/mongo-driver to v1.17.10 through indirect dependency conversion (api module) [#11164](https://github.com/openshift/assisted-service/pull/11164)
* [ACM-47334](https://issues.redhat.com/browse/ACM-47334): CVE-2026-63209 Bump github.com/klauspost/compress to v1.18.7 through indirect dependency conversion [#11149](https://github.com/openshift/assisted-service/pull/11149)
* NO-ISSUE: upgrade Go to 1.26.7 [#11119](https://github.com/openshift/assisted-service/pull/11119)
* NO-ISSUE: [master] Bump OCP versions: 4.16, 4.14, 4.19 [#11197](https://github.com/openshift/assisted-service/pull/11197)
* [ACM-47458](https://issues.redhat.com/browse/ACM-47458): CVE-2026-84304 Bump google.golang.org/grpc to v1.83.1 using replace directive (api module) [#11185](https://github.com/openshift/assisted-service/pull/11185)
* [ACM-44934](https://issues.redhat.com/browse/ACM-44934): CVE-2026-88031 Bump go.mongodb.org/mongo-driver to v1.17.10 through indirect dependency conversion (client module) [#11195](https://github.com/openshift/assisted-service/pull/11195)
* [ACM-47334](https://issues.redhat.com/browse/ACM-47334): CVE-2026-63209 Bump github.com/klauspost/compress to v1.18.7 using replace directive (api module) [#11155](https://github.com/openshift/assisted-service/pull/11155)
* [ACM-47334](https://issues.redhat.com/browse/ACM-47334): CVE-2026-63209 Bump github.com/klauspost/compress to v1.18.7 using replace directive (models module) [#11156](https://github.com/openshift/assisted-service/pull/11156)
* [ACM-47334](https://issues.redhat.com/browse/ACM-47334): CVE-2026-63209 Bump github.com/klauspost/compress to v1.18.7 using replace directive (client module) [#11157](https://github.com/openshift/assisted-service/pull/11157)
* [ACM-47458](https://issues.redhat.com/browse/ACM-47458): CVE-2026-84304 Bump google.golang.org/grpc to v1.83.1 through indirect dependency conversion [#11139](https://github.com/openshift/assisted-service/pull/11139)
* NO-ISSUE: [master] Bump OCP versions: 4.22, 4.20, 4.21 [#11094](https://github.com/openshift/assisted-service/pull/11094)
* [MGMT-25505](https://issues.redhat.com/browse/MGMT-25505): moving seaweedfs to our own repo [#11085](https://github.com/openshift/assisted-service/pull/11085)
* [MGMT-25497](https://issues.redhat.com/browse/MGMT-25497): Use OCP version for disconnected iso images [#11062](https://github.com/openshift/assisted-service/pull/11062)
* [ACM-39262](https://issues.redhat.com/browse/ACM-39262): chain PostgreSQL hops for EUS skip-upgrades [#10882](https://github.com/openshift/assisted-service/pull/10882)
* [MGMT-24807](https://issues.redhat.com/browse/MGMT-24807): OpenShift AI validation message is confusing — doesn't state role and shows a different (lower) CPU/RAM number than the aggregated worker-role requirement [#10969](https://github.com/openshift/assisted-service/pull/10969)
* [MGMT-23594](https://issues.redhat.com/browse/MGMT-23594): Installation should not be stopped if we can't pull the must gather image [#10935](https://github.com/openshift/assisted-service/pull/10935)
* [OCPBUGS-104857](https://issues.redhat.com/browse/OCPBUGS-104857): Disk validation falsely reports iSCSI host IP conflict when iBFT initiator uses DHCP (flags=7) on dual-homed host [#11007](https://github.com/openshift/assisted-service/pull/11007)
* NO-ISSUE: [master] Bump OCP versions: 4.14, 4.20, 5.0, 4.22, 4.16, 4.21, 4.18, 4.19, 4.17 [#11084](https://github.com/openshift/assisted-service/pull/11084)
* [MGMT-25505](https://issues.redhat.com/browse/MGMT-25505): minio was deprecated [#11050](https://github.com/openshift/assisted-service/pull/11050)
* NO-ISSUE: [master] Bump OCP versions: 4.22, 4.19, 4.20, 4.21 [#11004](https://github.com/openshift/assisted-service/pull/11004)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#10957](https://github.com/openshift/assisted-service/pull/10957)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#10958](https://github.com/openshift/assisted-service/pull/10958)
* NO-ISSUE: [master] Bump OCP versions: 5.0, 4.18, 4.19, 4.13 [#10980](https://github.com/openshift/assisted-service/pull/10980)
* [Full changelog](https://github.com/openshift/assisted-service/compare/db6eaf18787a49decbde2cfd368381cfe528e3cb...0d44006dc6e77a6930d650cfd87c6bc7fb4b4c45)
### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/1485df1bc332e738e5e9e12f5f1c36e7cde69866)
* [OCPBUGS-132570](https://issues.redhat.com/browse/OCPBUGS-132570): Preserve firstboot network config across OS image replacement [#2465](https://github.com/openshift/assisted-installer/pull/2465)
* NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.15.0 [#2477](https://github.com/openshift/assisted-installer/pull/2477)
* [ACM-44932](https://issues.redhat.com/browse/ACM-44932): CVE-2026-88031 Bump go.mongodb.org/mongo-driver to v1.17.10 through indirect dependency conversion [#2443](https://github.com/openshift/assisted-installer/pull/2443)
* [MGMT-25001](https://issues.redhat.com/browse/MGMT-25001): Bump Go to 1.26.7 for stdlib CVEs [#2432](https://github.com/openshift/assisted-installer/pull/2432)
* NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.14.0 [#2389](https://github.com/openshift/assisted-installer/pull/2389)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#2417](https://github.com/openshift/assisted-installer/pull/2417)
* NO-ISSUE: Refresh RPM lockfiles [#2418](https://github.com/openshift/assisted-installer/pull/2418)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#2330](https://github.com/openshift/assisted-installer/pull/2330)
* NO-ISSUE: migrate Renovate config [#2363](https://github.com/openshift/assisted-installer/pull/2363)
* [MGMT-25156](https://issues.redhat.com/browse/MGMT-25156): Fix CVE-2026-17106 [#2328](https://github.com/openshift/assisted-installer/pull/2328)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/4282317d91570e00028984d6f22da3a17ad5513f...1485df1bc332e738e5e9e12f5f1c36e7cde69866)
### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/c9c45088c300b0a2aee2b03d294ed4c885587461)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#1768](https://github.com/openshift/assisted-installer-agent/pull/1768)
* NO-ISSUE: Refresh RPM lockfiles [#1774](https://github.com/openshift/assisted-installer-agent/pull/1774)
* [MGMT-25567](https://issues.redhat.com/browse/MGMT-25567): fix(apivip_check): honor HTTPS proxy with custom CA [#1737](https://github.com/openshift/assisted-installer-agent/pull/1737)
* NO-ISSUE: Refresh RPM lockfiles [#1757](https://github.com/openshift/assisted-installer-agent/pull/1757)
* NO-ISSUE: Refresh RPM lockfiles [#1705](https://github.com/openshift/assisted-installer-agent/pull/1705)
* [OCPBUGS-130428](https://issues.redhat.com/browse/OCPBUGS-130428): Bump golang.org/x/crypto to v0.56.0 to fix CVE-2026-56855 [#1718](https://github.com/openshift/assisted-installer-agent/pull/1718)
* [OCPBUGS-130445](https://issues.redhat.com/browse/OCPBUGS-130445): CVE-2026-78662 Bump golang.org/x/crypto to v0.56.0 [#1719](https://github.com/openshift/assisted-installer-agent/pull/1719)
* [ACM-44931](https://issues.redhat.com/browse/ACM-44931): CVE-2026-88031 Bump go.mongodb.org/mongo-driver to v1.17.10 through indirect dependency conversion [#1716](https://github.com/openshift/assisted-installer-agent/pull/1716)
* [MGMT-24979](https://issues.redhat.com/browse/MGMT-24979): Bump Go to 1.26.7 for stdlib CVEs [#1696](https://github.com/openshift/assisted-installer-agent/pull/1696)
* [MGMT-25508](https://issues.redhat.com/browse/MGMT-25508): Exclude ASPEED 1a03:2000 from GPU inventory [#1694](https://github.com/openshift/assisted-installer-agent/pull/1694)
* [MGMT-23804](https://issues.redhat.com/browse/MGMT-23804): GPU inventory incorrectly includes non-GPU PCI devices (DPU/SmartNIC devices) [#1670](https://github.com/openshift/assisted-installer-agent/pull/1670)
* [MGMT-25157](https://issues.redhat.com/browse/MGMT-25157): CVE-2026-17106 Bump github.com/moby/go-archive to v0.3.0 through indirect dependency conversion [#1630](https://github.com/openshift/assisted-installer-agent/pull/1630)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#1676](https://github.com/openshift/assisted-installer-agent/pull/1676)
* NO-ISSUE: Refresh RPM lockfiles [#1684](https://github.com/openshift/assisted-installer-agent/pull/1684)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#1635](https://github.com/openshift/assisted-installer-agent/pull/1635)
* NO-ISSUE: Refresh RPM lockfiles [SECURITY] [#1653](https://github.com/openshift/assisted-installer-agent/pull/1653)
* NO-ISSUE: Refresh RPM lockfiles [#1590](https://github.com/openshift/assisted-installer-agent/pull/1590)
* [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/234004589633185edd5b6c80504d7ddb81c291c7...c9c45088c300b0a2aee2b03d294ed4c885587461)
### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/f952dce298d6788f289e3ef95efa89d5ef1c9a3f)
* [AGENT-1565](https://issues.redhat.com/browse/AGENT-1565): Add OVE 4.22 tekton file to agent-installer-utils [#320](https://github.com/openshift/agent-installer-utils/pull/320)
* [AGENT-1629](https://issues.redhat.com/browse/AGENT-1629): Add --fips flag to the OVE ISO builder script [#356](https://github.com/openshift/agent-installer-utils/pull/356)
* [OCPBUGS-111468](https://issues.redhat.com/browse/OCPBUGS-111468): prefix-validate URLs used in commands [#349](https://github.com/openshift/agent-installer-utils/pull/349)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/cd6b338387fa652ffd1c23fc0ebb939486afe83b...f952dce298d6788f289e3ef95efa89d5ef1c9a3f)
### [agentic-skills](https://github.com/openshift/agentic-skills/tree/3a5f379af6a0a0a6a5cb56c5d224743bb901c28f)
* NO-ISSUE: Gitops skills updated [#66](https://github.com/openshift/agentic-skills/pull/66)
* [OBSINTA-1732](https://issues.redhat.com/browse/OBSINTA-1732): investigate-alerts skill - initialize Prometheus access on demand and other improvements [#59](https://github.com/openshift/agentic-skills/pull/59)
* [GITOPS-11460](https://issues.redhat.com/browse/GITOPS-11460): Add argo team onboard skill [#54](https://github.com/openshift/agentic-skills/pull/54)
* [GITOPS-11457](https://issues.redhat.com/browse/GITOPS-11457), [GITOPS-11458](https://issues.redhat.com/browse/GITOPS-11458): Add argo-operations and argo-repo-audit skills [#53](https://github.com/openshift/agentic-skills/pull/53)
* [GITOPS-11459](https://issues.redhat.com/browse/GITOPS-11459): Add argo-cluster-debug Skill Knowledge [#55](https://github.com/openshift/agentic-skills/pull/55)
* [Full changelog](https://github.com/openshift/agentic-skills/compare/6968f9025f62487cab799b5ad7e675ad13fa1f5a...3a5f379af6a0a0a6a5cb56c5d224743bb901c28f)
### [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy/tree/ee1167a208561c55485453d9237036c6ab37cb73)
* [CNTRLPLANE-4019](https://issues.redhat.com/browse/CNTRLPLANE-4019): Merge upstream master (4f8517c1) into main [#116](https://github.com/openshift/apiserver-network-proxy/pull/116)
* [Full changelog](https://github.com/openshift/apiserver-network-proxy/compare/d6ec9243d24050d7d7ad7f939e45f821171f000e...ee1167a208561c55485453d9237036c6ab37cb73)
### [aws-cloud-controller-manager, aws-cluster-api-controllers, aws-ebs-csi-driver, aws-ebs-csi-driver-operator, aws-machine-controllers, aws-pod-identity-webhook, azure-cloud-controller-manager, azure-cloud-node-manager, azure-cluster-api-controllers, azure-disk-csi-driver, azure-disk-csi-driver-operator, azure-file-csi-driver, azure-file-csi-driver-operator, azure-machine-controllers, azure-workload-identity-webhook, csi-driver-manila, csi-driver-manila-operator, csi-driver-nfs, gcp-cloud-controller-manager, gcp-cluster-api-controllers, gcp-machine-controllers, gcp-pd-csi-driver, gcp-pd-csi-driver-operator, hyperkube, ironic, ironic-agent, ironic-machine-os-downloader, ironic-static-ip-manager, kube-proxy, machine-image-customization-controller, nutanix-cloud-controller-manager, nutanix-machine-controllers, pod, powervs-block-csi-driver, powervs-block-csi-driver-operator, powervs-cloud-controller-manager, powervs-machine-controllers, vsphere-cloud-controller-manager, vsphere-cluster-api-controllers, vsphere-csi-driver, vsphere-csi-driver-operator, vsphere-csi-driver-syncer, vsphere-problem-detector](https://github.com/openshift/kubernetes/tree/096638bbe2ee3da6e20336ae559c7a520c6e5089)
* [OCPBUGS-104847](https://issues.redhat.com/browse/OCPBUGS-104847): Revert "UPSTREAM: <carry>: Store SELinuxWarningController upgrade check as a ConfigMap [#2827](https://github.com/openshift/kubernetes/pull/2827)
* [OCPBUGS-129682](https://issues.redhat.com/browse/OCPBUGS-129682): Repair SingleReplica test exclusions [#2815](https://github.com/openshift/kubernetes/pull/2815)
* UPSTREAM: <carry>: OCPBUGS-128829: Handle k8s-tests-ext IP family probe failures [#2806](https://github.com/openshift/kubernetes/pull/2806)
* [OCPBUGS-130922](https://issues.redhat.com/browse/OCPBUGS-130922): UPSTREAM: <carry>: Fix vSphere topology test exclusions [#2816](https://github.com/openshift/kubernetes/pull/2816)
* [STOR-3083](https://issues.redhat.com/browse/STOR-3083): Fix disabled tests for newer test names [#2822](https://github.com/openshift/kubernetes/pull/2822)
* [OCPBUGS-112749](https://issues.redhat.com/browse/OCPBUGS-112749): Deflake pod resize deferred tests [#2765](https://github.com/openshift/kubernetes/pull/2765)
* [OCPBUGS-129642](https://issues.redhat.com/browse/OCPBUGS-129642): UPSTREAM: <carry>: bump cadvisor for statseq fix [#2819](https://github.com/openshift/kubernetes/pull/2819)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Daemonset test has changed names -> needs corrected env selector [#2813](https://github.com/openshift/kubernetes/pull/2813)
* : OCPBUGS-123651: UPSTREAM: <carry>: Add needed labels to RHEL pause image [#2809](https://github.com/openshift/kubernetes/pull/2809)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Rebase 1.37 [#2738](https://github.com/openshift/kubernetes/pull/2738)
* [OCPBUGS-127540](https://issues.redhat.com/browse/OCPBUGS-127540): UPSTREAM: 142168: Refuse UNC symlink targets in Windows subPath resolution [#2793](https://github.com/openshift/kubernetes/pull/2793)
* NOJIRA: add explicit merge commit message [#2788](https://github.com/openshift/kubernetes/pull/2788)
* [OCPBUGS-123651](https://issues.redhat.com/browse/OCPBUGS-123651): UPSTREAM: <carry>: Use FROM scratch for RHEL pause image [#2774](https://github.com/openshift/kubernetes/pull/2774)
* [Full changelog](https://github.com/openshift/kubernetes/compare/7cb7f330df454d8581b579ad835ad6b263533126...096638bbe2ee3da6e20336ae559c7a520c6e5089)
### [aws-karpenter-provider-aws](https://github.com/openshift/aws-karpenter-provider-aws/tree/aa136f7fdc38fb6d55888a2d623fed08ea73dfb7)
* NO-JIRA: Update Karpenter owner aliases [#50](https://github.com/openshift/aws-karpenter-provider-aws/pull/50)
* [Full changelog](https://github.com/openshift/aws-karpenter-provider-aws/compare/27c9527374d3d714ade3988f18cdc6eb46bc8262...aa136f7fdc38fb6d55888a2d623fed08ea73dfb7)
### [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider/tree/f4d8aaa238a39279f90263de662eca89a52236d6)
* [OCPBUGS-124534](https://issues.redhat.com/browse/OCPBUGS-124534): Bump grpc-go to v1.83.2 [#55](https://github.com/openshift/aws-encryption-provider/pull/55)
* [Full changelog](https://github.com/openshift/aws-encryption-provider/compare/9b18930d2db9521a08faa7165488bdcf6482b9cf...f4d8aaa238a39279f90263de662eca89a52236d6)
### [aws-node-termination-handler](https://github.com/openshift/aws-node-termination-handler/tree/b64c6ab9cec07965ad6688096822cce17338f089)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#15](https://github.com/openshift/aws-node-termination-handler/pull/15)
* [Full changelog](https://github.com/openshift/aws-node-termination-handler/compare/e4ff2aaec292db42de9f3eef4908ba1c421a2a6c...b64c6ab9cec07965ad6688096822cce17338f089)
### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/4bbe983bea2d88b643fe756b8e013964fa312f0b)
* [OCPBUGS-124531](https://issues.redhat.com/browse/OCPBUGS-124531): Bump grpc-go to v1.83.2 [#65](https://github.com/openshift/azure-kubernetes-kms/pull/65)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#64](https://github.com/openshift/azure-kubernetes-kms/pull/64)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/21fc3813f6cc12ce6246531891b5ad395e2afaad...4bbe983bea2d88b643fe756b8e013964fa312f0b)
### [azure-service-operator](https://github.com/openshift/azure-service-operator/tree/b371cd0419df01d984977779a729a098ed24b24d)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#47](https://github.com/openshift/azure-service-operator/pull/47)
* [Full changelog](https://github.com/openshift/azure-service-operator/compare/0611cd27b9eaa4a1fa8e0ab8ddc85352a61903e0...b371cd0419df01d984977779a729a098ed24b24d)
### [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3/tree/173713b1dd209ec9a7844997b06c06b383ec0ed7)
* [OCPBUGS-135071](https://issues.redhat.com/browse/OCPBUGS-135071): fix: preserve standalone remediation CRDs when BareMetal machine management is disabled [#117](https://github.com/openshift/cluster-api-provider-metal3/pull/117)
* [OCPBUGS-132229](https://issues.redhat.com/browse/OCPBUGS-132229): UPSTREAM: 3440: Bump x/net to v0.55.0 [#113](https://github.com/openshift/cluster-api-provider-metal3/pull/113)
* [OCPBUGS-128431](https://issues.redhat.com/browse/OCPBUGS-128431): Go HTTP/2: Denial of Service via malformed PRIORITY_UPDATE frame - CVE-2026-33814 [#110](https://github.com/openshift/cluster-api-provider-metal3/pull/110)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#107](https://github.com/openshift/cluster-api-provider-metal3/pull/107)
* [Full changelog](https://github.com/openshift/cluster-api-provider-metal3/compare/ad4f1c2bd7b527437496b71b5b93ee1439243d65...173713b1dd209ec9a7844997b06c06b383ec0ed7)
### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/f13cbf3931807e3dda28778b3c5024ba242bbcbc)
* [MULTIARCH-6330](https://issues.redhat.com/browse/MULTIARCH-6330): Installer: Modify IBMPowerVSCluster manifest to switch to PowerVS DHCP subnet [#11030](https://github.com/openshift/installer/pull/11030)
* [MULTIARCH-6014](https://issues.redhat.com/browse/MULTIARCH-6014): PowerVS: Use PowerVS Stock Catalogue Images [#10647](https://github.com/openshift/installer/pull/10647)
* [MULTIARCH-6455](https://issues.redhat.com/browse/MULTIARCH-6455): Update CAPIBM to v0.15.2, CAPV (vsphere) to 1.17.0 and CAPI to v1.14.0 [#10902](https://github.com/openshift/installer/pull/10902)
* [SPLAT-2981](https://issues.redhat.com/browse/SPLAT-2981): drop Azure diskSetup gate test ahead of promotion [#11035](https://github.com/openshift/installer/pull/11035)
* [OCPBUGS-122924](https://issues.redhat.com/browse/OCPBUGS-122924): Default IngressController to Modern TLS [#10875](https://github.com/openshift/installer/pull/10875)
* [OCPBUGS-133483](https://issues.redhat.com/browse/OCPBUGS-133483): PowerVC: fix two issues with cherry-pick 10966 [#11027](https://github.com/openshift/installer/pull/11027)
* [OCPBUGS-132853](https://issues.redhat.com/browse/OCPBUGS-132853): [Azure] Fix nil error wrap in getNextAvailableIPForLoadBalancer [#11019](https://github.com/openshift/installer/pull/11019)
* [OCPBUGS-129425](https://issues.redhat.com/browse/OCPBUGS-129425), [OCPBUGS-94441](https://issues.redhat.com/browse/OCPBUGS-94441): bump upi-installer base image to RHEL 10 [#10715](https://github.com/openshift/installer/pull/10715)
* [RFE-8788](https://issues.redhat.com/browse/RFE-8788): Update installer to accept Capacity Group Reservation IDs for Azure [#10102](https://github.com/openshift/installer/pull/10102)
* [OCPBUGS-127058](https://issues.redhat.com/browse/OCPBUGS-127058): Azure DualStack: Rename IPv6 Backend pools [#10998](https://github.com/openshift/installer/pull/10998)
* [SPLAT-3016](https://issues.redhat.com/browse/SPLAT-3016): multi-disk: disallow system mount paths for user-defined disks [#11021](https://github.com/openshift/installer/pull/11021)
* [OCPBUGS-130398](https://issues.redhat.com/browse/OCPBUGS-130398): PowerVC: Support non admin user [#10966](https://github.com/openshift/installer/pull/10966)
* [OCPBUGS-126133](https://issues.redhat.com/browse/OCPBUGS-126133): CVE-2026-84445: Bump google.golang.org/grpc to v1.83.2 [#10936](https://github.com/openshift/installer/pull/10936)
* [OPNET-810](https://issues.redhat.com/browse/OPNET-810): deps: bump openshift/api and Kubernetes packages to 1.37 [#10985](https://github.com/openshift/installer/pull/10985)
* [OCPBUGS-132573](https://issues.redhat.com/browse/OCPBUGS-132573): azure: omit empty machine security profiles [#10960](https://github.com/openshift/installer/pull/10960)
* [OPNET-810](https://issues.redhat.com/browse/OPNET-810): baremetal: align bgpVIPConfig peer fields with the BGPVIPConfig CRD [#10931](https://github.com/openshift/installer/pull/10931)
* [OCPBUGS-132208](https://issues.redhat.com/browse/OCPBUGS-132208): unconfigured-ignition must include nmstateconfig.yaml when present [#11010](https://github.com/openshift/installer/pull/11010)
* [OCPBUGS-130604](https://issues.redhat.com/browse/OCPBUGS-130604), [OCPBUGS-132034](https://issues.redhat.com/browse/OCPBUGS-132034): azure: set up data disks via the LUN link and other validation gaps [#10975](https://github.com/openshift/installer/pull/10975)
* [OKD-507](https://issues.redhat.com/browse/OKD-507): Update SCOS bootimage metadata to 10.0.20261014-0 [#10864](https://github.com/openshift/installer/pull/10864)
* [OCPBUGS-131836](https://issues.redhat.com/browse/OCPBUGS-131836): support InfraEnv AdditionalNTPSources in unconfigured-ignition [#10996](https://github.com/openshift/installer/pull/10996)
* no-jira: lint: define constants for aws subnet scope strings [#10984](https://github.com/openshift/installer/pull/10984)
* [SPLAT-2981](https://issues.redhat.com/browse/SPLAT-2981): decouple multidisk gates [#10939](https://github.com/openshift/installer/pull/10939)
* [OCPBUGS-85811](https://issues.redhat.com/browse/OCPBUGS-85811): Add omitzero to the AWS vpc field [#10977](https://github.com/openshift/installer/pull/10977)
* [OCPBUGS-127102](https://issues.redhat.com/browse/OCPBUGS-127102): Add internalJoinSubnet to installConfigOverrides [#10963](https://github.com/openshift/installer/pull/10963)
* [OCPBUGS-127058](https://issues.redhat.com/browse/OCPBUGS-127058): Azure DualStack: Allow IPv6 CIDRs to be provided first [#10954](https://github.com/openshift/installer/pull/10954)
* [OCPBUGS-129534](https://issues.redhat.com/browse/OCPBUGS-129534): golangci: avoid var-naming package-name flake [#10953](https://github.com/openshift/installer/pull/10953)
* [CORS-4689](https://issues.redhat.com/browse/CORS-4689): aws: update CAPA controller to v2.12.1 [#10949](https://github.com/openshift/installer/pull/10949)
* [SPLAT-2976](https://issues.redhat.com/browse/SPLAT-2976): multi-disk close install-config validation gaps [#10934](https://github.com/openshift/installer/pull/10934)
* [TRT-3001](https://issues.redhat.com/browse/TRT-3001): Revert #10152 "OCPBUGS-76925: Update no_proxy list to include AWS DNS resolver for UserProvisionedDNS" [#10951](https://github.com/openshift/installer/pull/10951)
* [OCPBUGS-127394](https://issues.redhat.com/browse/OCPBUGS-127394): Removed PowerVS InstallConfig debug log statement exposing sensitive information [#10898](https://github.com/openshift/installer/pull/10898)
* [OCPBUGS-128718](https://issues.redhat.com/browse/OCPBUGS-128718): validate AssignIpv6AddressOnCreation on BYO subnets for DualStackIPv4Primary [#10933](https://github.com/openshift/installer/pull/10933)
* [OCPBUGS-76925](https://issues.redhat.com/browse/OCPBUGS-76925): Update no_proxy list to include AWS DNS resolver for UserProvisionedDNS [#10152](https://github.com/openshift/installer/pull/10152)
* [OCPBUGS-105321](https://issues.redhat.com/browse/OCPBUGS-105321): pki: switch to ECDSA defaults and thread PKI profile to leaf certs [#10743](https://github.com/openshift/installer/pull/10743)
* [OCPBUGS-127240](https://issues.redhat.com/browse/OCPBUGS-127240): gcp: restrict global KMS location check to defaultMachinePlatform [#10907](https://github.com/openshift/installer/pull/10907)
* [OCPBUGS-115159](https://issues.redhat.com/browse/OCPBUGS-115159): aws: provision dedicated IAM resources for edge compute pool [#10836](https://github.com/openshift/installer/pull/10836)
* [OKD-194](https://issues.redhat.com/browse/OKD-194): Add OKD cincinnati as the default update service for OKD [#10834](https://github.com/openshift/installer/pull/10834)
* [OCPBUGS-126706](https://issues.redhat.com/browse/OCPBUGS-126706): azure: allow isolated Ebdsv5/Ebsv5 VM families [#10888](https://github.com/openshift/installer/pull/10888)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/installer/compare/987d45178f07740138e98234ff2cbc5571d4b7a5...f13cbf3931807e3dda28778b3c5024ba242bbcbc)
### [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal/tree/51bc686e528a7c831f49c0057bed244fa24bbbb0)
* [OCPCLOUD-3709](https://issues.redhat.com/browse/OCPCLOUD-3709): feat(tls): support remediation webhook curve preferences [#283](https://github.com/openshift/cluster-api-provider-baremetal/pull/283)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#278](https://github.com/openshift/cluster-api-provider-baremetal/pull/278)
* [Full changelog](https://github.com/openshift/cluster-api-provider-baremetal/compare/20e143749b9bdb4b0cb8387bacae2ad5feece6bf...51bc686e528a7c831f49c0057bed244fa24bbbb0)
### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/257604b553932dbfe490df459db29a42b781f7a5)
* [METAL-1980](https://issues.redhat.com/browse/METAL-1980): Merge upstream [#529](https://github.com/openshift/baremetal-operator/pull/529)
* [OCPBUGS-120721](https://issues.redhat.com/browse/OCPBUGS-120721): Test int64 BIOS bounds [#528](https://github.com/openshift/baremetal-operator/pull/528)
* [OCPBUGS-120721](https://issues.redhat.com/browse/OCPBUGS-120721): Bump gophercloud to v2.15.0 [#527](https://github.com/openshift/baremetal-operator/pull/527)
* [Full changelog](https://github.com/openshift/baremetal-operator/compare/8511455cfcf63d7daa377b4db8050e99ce0e7603...257604b553932dbfe490df459db29a42b781f7a5)
### [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg/tree/145ef72c22b7a52aa28134fda17226a44a80935e)
* [OCPEDGE-3080](https://issues.redhat.com/browse/OCPEDGE-3080): Allow no DNS upstreams [#420](https://github.com/openshift/baremetal-runtimecfg/pull/420)
* [OCPEDGE-3080](https://issues.redhat.com/browse/OCPEDGE-3080): Introduce --discover-node-ip for SNO CoreDNS [#417](https://github.com/openshift/baremetal-runtimecfg/pull/417)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#415](https://github.com/openshift/baremetal-runtimecfg/pull/415)
* [Full changelog](https://github.com/openshift/baremetal-runtimecfg/compare/3a0594b2c808b056d037e82093f0ca2268832792...145ef72c22b7a52aa28134fda17226a44a80935e)
### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/14498e9ce7fa0fff64e132d96d58ae557f840d36)
* [OCPEDGE-2991](https://issues.redhat.com/browse/OCPEDGE-2991): Read topology transition evaluations from API [#2449](https://github.com/openshift/oc/pull/2449)
* [OCPEDGE-2960](https://issues.redhat.com/browse/OCPEDGE-2960): Update topology subcommand to read transition status from infra api [#2430](https://github.com/openshift/oc/pull/2430)
* NO-JIRA: Rebase to 1.37 and update other dependencies. [#2435](https://github.com/openshift/oc/pull/2435)
* NO-JIRA: Add DS_Store to gitignore file [#2441](https://github.com/openshift/oc/pull/2441)
* : NO-JIRA: fix(set volumes): mention configmap in invalid volume type error [#2437](https://github.com/openshift/oc/pull/2437)
* [OCPBUGS-120725](https://issues.redhat.com/browse/OCPBUGS-120725): Return error when markers are not all replaced [#2429](https://github.com/openshift/oc/pull/2429)
* [OCPBUGS-60768](https://issues.redhat.com/browse/OCPBUGS-60768): properly indent multiline node messages in upgrade status output [#2341](https://github.com/openshift/oc/pull/2341)
* [OCPEDGE-2416](https://issues.redhat.com/browse/OCPEDGE-2416): Add oc adm transition topology command for SNO to HA transitions [#2295](https://github.com/openshift/oc/pull/2295)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/oc/compare/75a043dda6d517af6f40fcf77f371be33e80b59a...14498e9ce7fa0fff64e132d96d58ae557f840d36)
### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/a19ed01469ad1e3384df6636f6d9feffe5b1eb15)
* NO-JIRA: Fix staticcheck warnings across multiple packages [#1109](https://github.com/openshift/cloud-credential-operator/pull/1109)
* [CCO-772](https://issues.redhat.com/browse/CCO-772): ccoctl - Add set-upgradeable-to command [#1105](https://github.com/openshift/cloud-credential-operator/pull/1105)
* [CCO-775](https://issues.redhat.com/browse/CCO-775): ccoctl Create custom roles before identity bindings [#1104](https://github.com/openshift/cloud-credential-operator/pull/1104)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/5c4a3963b75cd85a180c2680d9ae77f5a98c5019...a19ed01469ad1e3384df6636f6d9feffe5b1eb15)
### [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller/tree/e4d8b92203f41156a03ea22f7f5a3360483a054c)
* [CORENET-7645](https://issues.redhat.com/browse/CORENET-7645): Add minimal AGENTS.md [#278](https://github.com/openshift/cloud-network-config-controller/pull/278)
* [CORENET-7581](https://issues.redhat.com/browse/CORENET-7581): Bump Kubernetes dependencies to 1.37.1 [#273](https://github.com/openshift/cloud-network-config-controller/pull/273)
* [OCPBUGS-124549](https://issues.redhat.com/browse/OCPBUGS-124549): deps: bump google.golang.org/api and google.golang.org/grpc to v1.84.0 [#275](https://github.com/openshift/cloud-network-config-controller/pull/275)
* [OSASINFRA-4400](https://issues.redhat.com/browse/OSASINFRA-4400): make openstack allowed address pairs configurable [#230](https://github.com/openshift/cloud-network-config-controller/pull/230)
* [Full changelog](https://github.com/openshift/cloud-network-config-controller/compare/d3b5de705d133ad568e37b8ccf027d5ccd5e7d38...e4d8b92203f41156a03ea22f7f5a3360483a054c)
### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/10ca5a46a8d89c521999b842e306f7276da4fb74)
* NO-JIRA: bump(openshift/library-go): to get retry in preflight check status report [#1045](https://github.com/openshift/cluster-authentication-operator/pull/1045)
* NO-JIRA: Update library-go to run conditional step in KMS [#1043](https://github.com/openshift/cluster-authentication-operator/pull/1043)
* [CNTRLPLANE-4787](https://issues.redhat.com/browse/CNTRLPLANE-4787): Make External OIDC proxy handling more robust [#1036](https://github.com/openshift/cluster-authentication-operator/pull/1036)
* NO-JIRA: Fix staticcheck warnings across multiple packages [#1025](https://github.com/openshift/cluster-authentication-operator/pull/1025)
* NO-JIRA: bump(openshift/library-go): to get KMS GA [#1041](https://github.com/openshift/cluster-authentication-operator/pull/1041)
* [CNTRLPLANE-4787](https://issues.redhat.com/browse/CNTRLPLANE-4787): Reapply: Add support for External OIDC proxy [#1039](https://github.com/openshift/cluster-authentication-operator/pull/1039)
* NO-JIRA: Update library-go to get KMS changes [#1040](https://github.com/openshift/cluster-authentication-operator/pull/1040)
* [TRT-3040](https://issues.redhat.com/browse/TRT-3040): Revert #1001 "CNTRLPLANE-4787: Add support for External OIDC proxy" [#1038](https://github.com/openshift/cluster-authentication-operator/pull/1038)
* [CNTRLPLANE-4787](https://issues.redhat.com/browse/CNTRLPLANE-4787): Add support for External OIDC proxy [#1001](https://github.com/openshift/cluster-authentication-operator/pull/1001)
* [CNTRLPLANE-4519](https://issues.redhat.com/browse/CNTRLPLANE-4519): External OIDC lib go generator [#1018](https://github.com/openshift/cluster-authentication-operator/pull/1018)
* NO-JIRA: Update library-go [#1032](https://github.com/openshift/cluster-authentication-operator/pull/1032)
* [CNTRLPLANE-4731](https://issues.redhat.com/browse/CNTRLPLANE-4731): Add KMSPreflightCycle e2e [#1031](https://github.com/openshift/cluster-authentication-operator/pull/1031)
* NO-JIRA: Update library-go [#1028](https://github.com/openshift/cluster-authentication-operator/pull/1028)
* NO-JIRA: bugfix: external-oidc: omit client-credential TLS generated config when empty [#971](https://github.com/openshift/cluster-authentication-operator/pull/971)
* NO-JIRA: Update library-go [#1027](https://github.com/openshift/cluster-authentication-operator/pull/1027)
* [CNTRLPLANE-4719](https://issues.redhat.com/browse/CNTRLPLANE-4719): deps: Rebase to 1.37 and update other deps [#1024](https://github.com/openshift/cluster-authentication-operator/pull/1024)
* NO-JIRA: bump openshift/api https://github.com/openshift/api/pull/3083 [#1022](https://github.com/openshift/cluster-authentication-operator/pull/1022)
* NO-JIRA: bump library-go https://github.com/openshift/library-go/pull/2518 [#1020](https://github.com/openshift/cluster-authentication-operator/pull/1020)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2512 [#1016](https://github.com/openshift/cluster-authentication-operator/pull/1016)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2474 [#1014](https://github.com/openshift/cluster-authentication-operator/pull/1014)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): encryption/assertion: bring back the preflight assertion for CAO and OAS-O [#1011](https://github.com/openshift/cluster-authentication-operator/pull/1011)
* [CNTRLPLANE-4402](https://issues.redhat.com/browse/CNTRLPLANE-4402): implement new External OIDC architecture under ExternalOIDCAsWebhook feature gate [#1002](https://github.com/openshift/cluster-authentication-operator/pull/1002)
* [OCPBUGS-122888](https://issues.redhat.com/browse/OCPBUGS-122888): Add high contrast support to oauth templates [#999](https://github.com/openshift/cluster-authentication-operator/pull/999)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): bump library-go to get the new KMS plugin deployment strategy [#1004](https://github.com/openshift/cluster-authentication-operator/pull/1004)
* [OCPBUGS-107949](https://issues.redhat.com/browse/OCPBUGS-107949): fix CVE-2026-41178 by updating otel to v1.44.0 [#978](https://github.com/openshift/cluster-authentication-operator/pull/978)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2478 [#1006](https://github.com/openshift/cluster-authentication-operator/pull/1006)
* [OPRUN-4768](https://issues.redhat.com/browse/OPRUN-4768): bump openshift/api [#1005](https://github.com/openshift/cluster-authentication-operator/pull/1005)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/e5d042008d9aab23414c4be66fcfbd430d0f996d...10ca5a46a8d89c521999b842e306f7276da4fb74)
### [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator/tree/49d03c60e05e8856dde5a416e01c8512cc824a59)
* [OCPBUGS-130317](https://issues.redhat.com/browse/OCPBUGS-130317): add machinepools to CAPI ClusterRole for autoscaler [#406](https://github.com/openshift/cluster-autoscaler-operator/pull/406)
* [AUTOSCALE-949](https://issues.redhat.com/browse/AUTOSCALE-949): Release chore CAO bump to k8s 1.37 and OCP 5.1 [#404](https://github.com/openshift/cluster-autoscaler-operator/pull/404)
* [AUTOSCALE-709](https://issues.redhat.com/browse/AUTOSCALE-709): implement conditions and authoritative API [#402](https://github.com/openshift/cluster-autoscaler-operator/pull/402)
* [Full changelog](https://github.com/openshift/cluster-autoscaler-operator/compare/e4f426dcd988735d1e49da743240231be6ab6a40...49d03c60e05e8856dde5a416e01c8512cc824a59)
### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/8676940193cd3f76a28d050af39de7bcade0db1e)
* [CNF-22903](https://issues.redhat.com/browse/CNF-22903): Add support for Ironic Networking service [#630](https://github.com/openshift/cluster-baremetal-operator/pull/630)
* [METAL-1934](https://issues.redhat.com/browse/METAL-1934): Add support for feature gates [#663](https://github.com/openshift/cluster-baremetal-operator/pull/663)
* [OCPBUGS-115068](https://issues.redhat.com/browse/OCPBUGS-115068): Validate Provisioning fields passed to containers [#653](https://github.com/openshift/cluster-baremetal-operator/pull/653)
* NO-ISSUE: Add deployment diagrams to README [#680](https://github.com/openshift/cluster-baremetal-operator/pull/680)
* [OCPBUGS-127132](https://issues.redhat.com/browse/OCPBUGS-127132): Pass WATCH_NAMESPACE to image-customization [#666](https://github.com/openshift/cluster-baremetal-operator/pull/666)
* [OCPBUGS-54957](https://issues.redhat.com/browse/OCPBUGS-54957): Remove recreate strategy from BMO deployment [#640](https://github.com/openshift/cluster-baremetal-operator/pull/640)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/e1eabae06e1c08f4becfa99e56ca9f707fa10abd...8676940193cd3f76a28d050af39de7bcade0db1e)
### [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap/tree/641ed6cfb98189f02fe2eb515491ee9de0831136)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#149](https://github.com/openshift/cluster-bootstrap/pull/149)
* [Full changelog](https://github.com/openshift/cluster-bootstrap/compare/86a2349618a095e9558a008130f64ebb16ee8c30...641ed6cfb98189f02fe2eb515491ee9de0831136)
### [cluster-capi-controllers](https://github.com/openshift/cluster-api/tree/bb5a4cf7cfb28705a46e25bf26a6d13d0ddb0424)
* [TRT-3024](https://issues.redhat.com/browse/TRT-3024): UPSTREAM: <drop>: Revert "Rebase OpenShift Cluster API onto upstream v1.14.3" [#318](https://github.com/openshift/cluster-api/pull/318)
* [OCPCLOUD-3686](https://issues.redhat.com/browse/OCPCLOUD-3686): Rebase OpenShift Cluster API onto upstream v1.14.3 [#308](https://github.com/openshift/cluster-api/pull/308)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#309](https://github.com/openshift/cluster-api/pull/309)
* NO-JIRA: UPSTREAM: <carry>: remove redundant GitHub summary verification [#313](https://github.com/openshift/cluster-api/pull/313)
* NO-JIRA: UPSTREAM: <drop>: update manifests-gen [#312](https://github.com/openshift/cluster-api/pull/312)
* [OCPCLOUD-1501](https://issues.redhat.com/browse/OCPCLOUD-1501): allow CAPI manager to patch Nodes [#311](https://github.com/openshift/cluster-api/pull/311)
* [OCPCLOUD-1501](https://issues.redhat.com/browse/OCPCLOUD-1501): add OpenShift CAPI manager local cluster RBAC [#310](https://github.com/openshift/cluster-api/pull/310)
* [Full changelog](https://github.com/openshift/cluster-api/compare/303d9786a5017d299b6e7fc702bb92f5cb4550cf...bb5a4cf7cfb28705a46e25bf26a6d13d0ddb0424)
### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/39401fe5b2578309481ea223ecf6f17f58b4ae91)
* [OCPBUGS-135094](https://issues.redhat.com/browse/OCPBUGS-135094): Increase installer unit-test cleanup timeout [#705](https://github.com/openshift/cluster-capi-operator/pull/705)
* [OCPCLOUD-3725](https://issues.redhat.com/browse/OCPCLOUD-3725): refactor: gate legacy tombstones on ClusterAPIOperator [#704](https://github.com/openshift/cluster-capi-operator/pull/704)
* [OCPCLOUD-3726](https://issues.redhat.com/browse/OCPCLOUD-3726): Add scaffolding for Upgradeable controller [#703](https://github.com/openshift/cluster-capi-operator/pull/703)
* [OCPBUGS-135028](https://issues.redhat.com/browse/OCPBUGS-135028): fix: grant installer watch access to cluster configuration [#702](https://github.com/openshift/cluster-capi-operator/pull/702)
* [OCPCLOUD-3725](https://issues.redhat.com/browse/OCPCLOUD-3725): refactor: operator manifests to follow the ClusterAPIOperator feature gate [#701](https://github.com/openshift/cluster-capi-operator/pull/701)
* [OCPBUGS-133479](https://issues.redhat.com/browse/OCPBUGS-133479): Run unmanaged CRD handoff as one extension test [#700](https://github.com/openshift/cluster-capi-operator/pull/700)
* [OCPCLOUD-3545](https://issues.redhat.com/browse/OCPCLOUD-3545): Consume CompatibilityRequirement v1 [#694](https://github.com/openshift/cluster-capi-operator/pull/694)
* [OCPBUGS-133479](https://issues.redhat.com/browse/OCPBUGS-133479): fix(e2e): remove CRD compatibility gate from handoff test [#699](https://github.com/openshift/cluster-capi-operator/pull/699)
* [OCPCLOUD-3725](https://issues.redhat.com/browse/OCPCLOUD-3725): test: separate Cluster API operator health checks from machine management [#698](https://github.com/openshift/cluster-capi-operator/pull/698)
* [OCPBUGS-133416](https://issues.redhat.com/browse/OCPBUGS-133416): fix(openstack): tolerate multiple external networks when no router exists [#697](https://github.com/openshift/cluster-capi-operator/pull/697)
* [OCPCLOUD-3725](https://issues.redhat.com/browse/OCPCLOUD-3725): Support operator no-components mode [#696](https://github.com/openshift/cluster-capi-operator/pull/696)
* [OCPCLOUD-3704](https://issues.redhat.com/browse/OCPCLOUD-3704): Enable CRD Compatibility Checker e2e tests on External topology [#688](https://github.com/openshift/cluster-capi-operator/pull/688)
* [OCPCLOUD-3724](https://issues.redhat.com/browse/OCPCLOUD-3724): Enable proxy injection for capi-controllers [#692](https://github.com/openshift/cluster-capi-operator/pull/692)
* [OCPCLOUD-3655](https://issues.redhat.com/browse/OCPCLOUD-3655): bump Kubernetes dependencies to 1.37 [#686](https://github.com/openshift/cluster-capi-operator/pull/686)
* [OCPCLOUD-3704](https://issues.redhat.com/browse/OCPCLOUD-3704): Enable CRD Compatibility Checker support on Hosted OpenShift independently of Cluster API [#685](https://github.com/openshift/cluster-capi-operator/pull/685)
* [OCPCLOUD-3465](https://issues.redhat.com/browse/OCPCLOUD-3465): feat: implement cluster-wide proxy support [#586](https://github.com/openshift/cluster-capi-operator/pull/586)
* [OCPCLOUD-3318](https://issues.redhat.com/browse/OCPCLOUD-3318): Integrate CompatibilityRequirements into the CCAPIO Installer [#648](https://github.com/openshift/cluster-capi-operator/pull/648)
* [OCPBUGS-98492](https://issues.redhat.com/browse/OCPBUGS-98492): Fix orphaned MachineSet sync finalizer cleanup [#689](https://github.com/openshift/cluster-capi-operator/pull/689)
* [OCPCLOUD-3541](https://issues.redhat.com/browse/OCPCLOUD-3541): Use feature gates consistently [#603](https://github.com/openshift/cluster-capi-operator/pull/603)
* [OCPBUGS-127650](https://issues.redhat.com/browse/OCPBUGS-127650): openstack: allow to specify UserManaged load balancer [#678](https://github.com/openshift/cluster-capi-operator/pull/678)
* [OCPBUGS-128384](https://issues.redhat.com/browse/OCPBUGS-128384): Extend InfraTemplate reconciliation wait [#681](https://github.com/openshift/cluster-capi-operator/pull/681)
* [OCPBUGS-123094](https://issues.redhat.com/browse/OCPBUGS-123094): Update MongoDB Go driver to v1.17.10 [#676](https://github.com/openshift/cluster-capi-operator/pull/676)
* [OCPBUGS-128576](https://issues.redhat.com/browse/OCPBUGS-128576): add ec2:ModifyInstanceMetadataOptions to AWS CredentialsRequest [#682](https://github.com/openshift/cluster-capi-operator/pull/682)
* NO-JIRA: Update actuator testutils builder paths [#683](https://github.com/openshift/cluster-capi-operator/pull/683)
* [OCPBUGS-128356](https://issues.redhat.com/browse/OCPBUGS-128356): Remove unnecessary ClusterOperator test status update [#680](https://github.com/openshift/cluster-capi-operator/pull/680)
* [OCPBUGS-127467](https://issues.redhat.com/browse/OCPBUGS-127467): Pass original TLSProfileSpec to security profile watcher [#677](https://github.com/openshift/cluster-capi-operator/pull/677)
* NO-JIRA: use capi 1.13/capv 1.16 imports [#675](https://github.com/openshift/cluster-capi-operator/pull/675)
* NO-JIRA: Bump linter to v2.13.2 [#674](https://github.com/openshift/cluster-capi-operator/pull/674)
* [OCPCLOUD-1501](https://issues.redhat.com/browse/OCPCLOUD-1501): use projected tokens for management kubeconfig [#669](https://github.com/openshift/cluster-capi-operator/pull/669)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/02013fdb38814f1ddc8ac46e568d7369e6ec687b...39401fe5b2578309481ea223ecf6f17f58b4ae91)
### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/afd5b1c73e844747b597271f1530c99fb4b641d0)
* [SPLAT-2994](https://issues.redhat.com/browse/SPLAT-2994): resolve AWS region from Infrastructure before environment [#529](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/529)
* [OCPCLOUD-3673](https://issues.redhat.com/browse/OCPCLOUD-3673): bump Kubernetes dependencies to 1.37 [#523](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/523)
* [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/9ca11878cc35862f4af4c194985b4f3ae3a835fa...afd5b1c73e844747b597271f1530c99fb4b641d0)
### [cluster-config-api](https://github.com/openshift/api/tree/f677639a402fe455b8243b23b1d160cfc3587918)
* [SPLAT-2981](https://issues.redhat.com/browse/SPLAT-2981): promote AzureMultiDisk to GA [#3091](https://github.com/openshift/api/pull/3091)
* [MON-4645](https://issues.redhat.com/browse/MON-4645): allow __ prefixed labels in sourceLabels [#3050](https://github.com/openshift/api/pull/3050)
* [OCPSTRAT-3523](https://issues.redhat.com/browse/OCPSTRAT-3523): Add OpenStack.maxAllowedAddressPairs to Infrastructure API [#3098](https://github.com/openshift/api/pull/3098)
* [OCPBUGS-104847](https://issues.redhat.com/browse/OCPBUGS-104847): Remove SELinuxMountGAReadiness feature gate [#3122](https://github.com/openshift/api/pull/3122)
* NO-JIRA: Add example of validating an OpenShift release version [#3137](https://github.com/openshift/api/pull/3137)
* feat: register FeatureGateClusterAPIMachineManagementNutanix [#3140](https://github.com/openshift/api/pull/3140)
* [MON-4654](https://issues.redhat.com/browse/MON-4654): allow query parameters in remote write URLs [#3124](https://github.com/openshift/api/pull/3124)
* [OCPBUGS-105408](https://issues.redhat.com/browse/OCPBUGS-105408): Remove DualReplica feature gate [#3123](https://github.com/openshift/api/pull/3123)
* [OCPCLOUD-3725](https://issues.redhat.com/browse/OCPCLOUD-3725): feat: gate Cluster API configuration on operator availability [#3131](https://github.com/openshift/api/pull/3131)
* Nutanix: featuregate for MachineAPIMigrationNutanix [#3125](https://github.com/openshift/api/pull/3125)
* [OPNET-809](https://issues.redhat.com/browse/OPNET-809): ship the BGPVIPConfig CRD in the payload [#3127](https://github.com/openshift/api/pull/3127)
* [METAL-1977](https://issues.redhat.com/browse/METAL-1977): add MetalEnrollmentAPI feature gate [#3090](https://github.com/openshift/api/pull/3090)
* [OCPCLOUD-3544](https://issues.redhat.com/browse/OCPCLOUD-3544): Graduate CompatibilityRequirement API to v1 [#2905](https://github.com/openshift/api/pull/2905)
* [CNTRLPLANE-4390](https://issues.redhat.com/browse/CNTRLPLANE-4390): Remove OpenShiftPodSecurityAdmission feature gate from Default feature set. [#3035](https://github.com/openshift/api/pull/3035)
* [CNTRLPLANE-4771](https://issues.redhat.com/browse/CNTRLPLANE-4771): Graduate KMSEncryption to GA [#3100](https://github.com/openshift/api/pull/3100)
* [STOR-3180](https://issues.redhat.com/browse/STOR-3180): Add Feature Gate StoragePathAlert [#3105](https://github.com/openshift/api/pull/3105)
* [OCPNODE-4827](https://issues.redhat.com/browse/OCPNODE-4827): Drop v1apha1 CRIOCredentialProviderConfig entirely [#3113](https://github.com/openshift/api/pull/3113)
* [OCPCLOUD-3330](https://issues.redhat.com/browse/OCPCLOUD-3330): Add ClusterAPIOperator feature gate [#3109](https://github.com/openshift/api/pull/3109)
* [OCPKUEUE-887](https://issues.redhat.com/browse/OCPKUEUE-887): Enable workload scheduling feature gates for DP/TP (except CompositePodGroup) [#3112](https://github.com/openshift/api/pull/3112)
* [TRT-3027](https://issues.redhat.com/browse/TRT-3027): Revert #3102 "OCPKUEUE-887: Enable workload scheduling feature gates for DP/TP" [#3107](https://github.com/openshift/api/pull/3107)
* [OCPEDGE-2989](https://issues.redhat.com/browse/OCPEDGE-2989): OCPEDGE-2958: Add topologyTransitionStatus to Infrastructure status [#3029](https://github.com/openshift/api/pull/3029)
* [CNTRLPLANE-4394](https://issues.redhat.com/browse/CNTRLPLANE-4394): Add foundations for AuthenticationComponentProxyExternalOIDC [#3037](https://github.com/openshift/api/pull/3037)
* [OCPKUEUE-887](https://issues.redhat.com/browse/OCPKUEUE-887): Enable workload scheduling feature gates for DP/TP [#3102](https://github.com/openshift/api/pull/3102)
* [OCPBUGS-130730](https://issues.redhat.com/browse/OCPBUGS-130730): Remove topology transition immutability validation [#3096](https://github.com/openshift/api/pull/3096)
* [NE-2912](https://issues.redhat.com/browse/NE-2912): Add HAProxy 3.4 as a selectable non-default version [#3067](https://github.com/openshift/api/pull/3067)
* [OPNET-809](https://issues.redhat.com/browse/OPNET-809): machineconfiguration/v1alpha1: add BGPVIPConfig CRD [#2972](https://github.com/openshift/api/pull/2972)
* [OCPNODE-4730](https://issues.redhat.com/browse/OCPNODE-4730): Add workload scheduling feature gates [#3092](https://github.com/openshift/api/pull/3092)
* [NE-2922](https://issues.redhat.com/browse/NE-2922): Promote Ingress operator API to v1 [#3079](https://github.com/openshift/api/pull/3079)
* [OCPBUGS-123649](https://issues.redhat.com/browse/OCPBUGS-123649): enable DRADeviceTaintRules feature gate in TPNU [#3072](https://github.com/openshift/api/pull/3072)
* [OCPEDGE-3075](https://issues.redhat.com/browse/OCPEDGE-3075): feat: add spec.infrastructureTopology to Infrastructure API [#3056](https://github.com/openshift/api/pull/3056)
* Fix CustomNoUpgrade rendering with omitted overrides [#3080](https://github.com/openshift/api/pull/3080)
* NO-JIRA: change KMS preflight result validation [#3083](https://github.com/openshift/api/pull/3083)
* [OCPBUGS-129172](https://issues.redhat.com/browse/OCPBUGS-129172): Loosen CAPI skew validations [#3077](https://github.com/openshift/api/pull/3077)
* Support Quay CI payloads and add Kubernetes v1.37.1 envtest tools [#3082](https://github.com/openshift/api/pull/3082)
* [CNTRLPLANE-4604](https://issues.redhat.com/browse/CNTRLPLANE-4604): promoting AuthenticationComponentProxy feature gate to Default feature set [#3075](https://github.com/openshift/api/pull/3075)
* [STOR-2859](https://issues.redhat.com/browse/STOR-2859): Add APIs for disabling force detach in KCM operator [#2668](https://github.com/openshift/api/pull/2668)
* Rename Console ingress helper type to ConsoleIngress [#3070](https://github.com/openshift/api/pull/3070)
* [CORENET-7617](https://issues.redhat.com/browse/CORENET-7617): features: Add ovn-kuberntes MACSecurity feature gate [#3062](https://github.com/openshift/api/pull/3062)
* [CNTRLPLANE-4518](https://issues.redhat.com/browse/CNTRLPLANE-4518): authentication: add v1alpha1 external OIDC configuration API [#3061](https://github.com/openshift/api/pull/3061)
* [MCO-2535](https://issues.redhat.com/browse/MCO-2535): add skew enforcement validations for CAPI MachineManagers [#3058](https://github.com/openshift/api/pull/3058)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Rebase 1.37 [#2945](https://github.com/openshift/api/pull/2945)
* [OCPBUGS-126808](https://issues.redhat.com/browse/OCPBUGS-126808): Enable OLMLifecycleAndCompatibility by default in version 5+ [#3045](https://github.com/openshift/api/pull/3045)
* [NE-2913](https://issues.redhat.com/browse/NE-2913): Remove HAProxy 2.8 [#3048](https://github.com/openshift/api/pull/3048)
* [CNTRLPLANE-4402](https://issues.redhat.com/browse/CNTRLPLANE-4402): add ExternalOIDCAsWebhook feature gate [#3043](https://github.com/openshift/api/pull/3043)
* [OCPEDGE-3079](https://issues.redhat.com/browse/OCPEDGE-3079): UnifiedClusterManagedDNSAndLB FeatureGate [#3054](https://github.com/openshift/api/pull/3054)
* [OCPBUGS-115007](https://issues.redhat.com/browse/OCPBUGS-115007): Remove BootImageSkewEnforcement feature gate from Default API [#3031](https://github.com/openshift/api/pull/3031)
* [OCPBUGS-120757](https://issues.redhat.com/browse/OCPBUGS-120757): Fix misleading certificate chain docs in TLSConfig [#3047](https://github.com/openshift/api/pull/3047)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): replace KMS config with pluginConfig reference [#3028](https://github.com/openshift/api/pull/3028)
* [HPCASE-362](https://issues.redhat.com/browse/HPCASE-362): Promote TLSAdherence feature gate to GA [#2883](https://github.com/openshift/api/pull/2883)
* [Full changelog](https://github.com/openshift/api/compare/9fb49bfd35acae3aad6414514f669568ada12ada...f677639a402fe455b8243b23b1d160cfc3587918)
### [cluster-config-operator](https://github.com/openshift/cluster-config-operator/tree/25d3850c8799c11a0924dcc32576ae44d647ee9f)
* [OCPEDGE-2990](https://issues.redhat.com/browse/OCPEDGE-2990): Report supported topology evaluations [#522](https://github.com/openshift/cluster-config-operator/pull/522)
* NO-JIRA: Update Go to 1.26 and OpenShift API dependencies [#528](https://github.com/openshift/cluster-config-operator/pull/528)
* [OCPBUGS-130339](https://issues.redhat.com/browse/OCPBUGS-130339): Read OpenShift API server replicas from deployment [#524](https://github.com/openshift/cluster-config-operator/pull/524)
* NO-JIRA: chore: Adding some edge folks as OWNERS in the topology controller [#508](https://github.com/openshift/cluster-config-operator/pull/508)
* [Full changelog](https://github.com/openshift/cluster-config-operator/compare/6a4d4a58182fa4e810c9c6bf66d14eea4cfe37bb...25d3850c8799c11a0924dcc32576ae44d647ee9f)
### [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator/tree/8ca6b2588cefcbeffc895ee8ec51fb52ce9f1bb3)
* [OCPCLOUD-3658](https://issues.redhat.com/browse/OCPCLOUD-3658): bump Kubernetes dependencies to 1.37 [#423](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/423)
* [OCPCLOUD-3707](https://issues.redhat.com/browse/OCPCLOUD-3707): feat(tls): add support for TLS groups/curve preferences [#424](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/424)
* [OCPBUGS-65497](https://issues.redhat.com/browse/OCPBUGS-65497): Add debug-useful ClusterOperator relatedObjects [#404](https://github.com/openshift/cluster-control-plane-machine-set-operator/pull/404)
* [Full changelog](https://github.com/openshift/cluster-control-plane-machine-set-operator/compare/81541d53f815a4cb25255b0dad33f449762c4609...8ca6b2588cefcbeffc895ee8ec51fb52ce9f1bb3)
### [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator/tree/41e9a6ccf361de2b37c0e91c2e03fb7fec31a634)
* [STOR-3068](https://issues.redhat.com/browse/STOR-3068): Bump all libraries [#302](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/302)
* [OCPBUGS-127462](https://issues.redhat.com/browse/OCPBUGS-127462): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#298](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/298)
* [Full changelog](https://github.com/openshift/cluster-csi-snapshot-controller-operator/compare/03b68fd87ae423f78b2a31174d6c432acad47eb5...41e9a6ccf361de2b37c0e91c2e03fb7fec31a634)
### [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator/tree/9d18bdd71092bd9eaad426c6ec42b719c3a992e9)
* [NE-2126](https://issues.redhat.com/browse/NE-2126): Ship tests-ext binary as raw gzip instead of tar.gz [#503](https://github.com/openshift/cluster-dns-operator/pull/503)
* NO-JIRA: Add pedjak to OWNERS [#490](https://github.com/openshift/cluster-dns-operator/pull/490)
* [OCPBUGS-87970](https://issues.redhat.com/browse/OCPBUGS-87970): Stop using legacy topology-aware hints for DNS [#501](https://github.com/openshift/cluster-dns-operator/pull/501)
* [NE-2126](https://issues.redhat.com/browse/NE-2126): Migrating DNS test cases from QE repo [#491](https://github.com/openshift/cluster-dns-operator/pull/491)
* [OCPBUGS-53192](https://issues.redhat.com/browse/OCPBUGS-53192): Update code reference to use the default branch name 'main' [#488](https://github.com/openshift/cluster-dns-operator/pull/488)
* [Full changelog](https://github.com/openshift/cluster-dns-operator/compare/c480e21c16d3383a7c09752f8dea61743c765cfa...9d18bdd71092bd9eaad426c6ec42b719c3a992e9)
### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/88ac66d6714baa24466adbf697a75b0781b1362c)
* NO-JIRA: bump k8s 1.37 [#1733](https://github.com/openshift/cluster-etcd-operator/pull/1733)
* NO-JIRA: move TNF scripts to bindata/etcd/tnf with TNF OWNERS [#1728](https://github.com/openshift/cluster-etcd-operator/pull/1728)
* NO-JIRA: Update the tests to skip if OCPFeatureGate:AutomatedEtcdBackup is not enabled [#1731](https://github.com/openshift/cluster-etcd-operator/pull/1731)
* [OCPBUGS-100304](https://issues.redhat.com/browse/OCPBUGS-100304): write force_new_cluster as a claim timestamp [#1721](https://github.com/openshift/cluster-etcd-operator/pull/1721)
* [OCPBUGS-112390](https://issues.redhat.com/browse/OCPBUGS-112390): [TNF] lifecycle part 2 - update setup deadlock fix & conditions cleanup [#1668](https://github.com/openshift/cluster-etcd-operator/pull/1668)
* NO-JIRA: Add TNF ownership for docs/tnf [#1725](https://github.com/openshift/cluster-etcd-operator/pull/1725)
* [OCPBUGS-123169](https://issues.redhat.com/browse/OCPBUGS-123169): add static linter for workload partitioning annotations [#1707](https://github.com/openshift/cluster-etcd-operator/pull/1707)
* [OCPBUGS-105240](https://issues.redhat.com/browse/OCPBUGS-105240): TNF: wait for etcd-bootstrap member removal before setup [#1672](https://github.com/openshift/cluster-etcd-operator/pull/1672)
* [OCPBUGS-84650](https://issues.redhat.com/browse/OCPBUGS-84650): force installer revision when external-etcd-pod ConfigMap is created [#1705](https://github.com/openshift/cluster-etcd-operator/pull/1705)
* [OCPBUGS-126911](https://issues.redhat.com/browse/OCPBUGS-126911): fix(tnf): set read-only root filesystems [#1715](https://github.com/openshift/cluster-etcd-operator/pull/1715)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/891802de59125027f63e4e15d153ca9f4301744f...88ac66d6714baa24466adbf697a75b0781b1362c)
### [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator/tree/9dba9645bb8ebae13006c76e726d6e2e42e72b1d)
* [CNTRLPLANE-4447](https://issues.redhat.com/browse/CNTRLPLANE-4447): observe tls groups preferences [#1379](https://github.com/openshift/cluster-image-registry-operator/pull/1379)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#1368](https://github.com/openshift/cluster-image-registry-operator/pull/1368)
* [Full changelog](https://github.com/openshift/cluster-image-registry-operator/compare/7c198c202079bc9dc76debab40dcf5610bcf8707...9dba9645bb8ebae13006c76e726d6e2e42e72b1d)
### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/7d6e32bc7f1d5932303db24f6c5446d73d52a14f)
* [OCPBUGS-122924](https://issues.redhat.com/browse/OCPBUGS-122924): Default IngressController to Modern TLS [#1593](https://github.com/openshift/cluster-ingress-operator/pull/1593)
* [NE-2922](https://issues.redhat.com/browse/NE-2922): Use the featuregate to add Ingress resource [#1651](https://github.com/openshift/cluster-ingress-operator/pull/1651)
* [NE-2922](https://issues.redhat.com/browse/NE-2922): Migrate operator Ingress consumers to v1 [#1618](https://github.com/openshift/cluster-ingress-operator/pull/1618)
* [OCPBUGS-121851](https://issues.redhat.com/browse/OCPBUGS-121851): Complete zero-worker HyperShift startup without premature router readiness [#1631](https://github.com/openshift/cluster-ingress-operator/pull/1631)
* [NE-2938](https://issues.redhat.com/browse/NE-2938): Bump Kubernetes to 1.37 [#1643](https://github.com/openshift/cluster-ingress-operator/pull/1643)
* [NE-2779](https://issues.redhat.com/browse/NE-2779): Move Gateway API CRD VAP management from CVO to CIO [#1627](https://github.com/openshift/cluster-ingress-operator/pull/1627)
* [NE-2913](https://issues.redhat.com/browse/NE-2913): Remove HAProxy 2.8 reference [#1599](https://github.com/openshift/cluster-ingress-operator/pull/1599)
* [TRT-3032](https://issues.redhat.com/browse/TRT-3032): Revert #1607 "OCPBUGS-121851: Report ingress Available=True on zero-worker HyperShift startup" [#1630](https://github.com/openshift/cluster-ingress-operator/pull/1630)
* [NE-2901](https://issues.redhat.com/browse/NE-2901): Document commit conventions in AGENTS.md [#1582](https://github.com/openshift/cluster-ingress-operator/pull/1582)
* [OCPBUGS-128105](https://issues.redhat.com/browse/OCPBUGS-128105): Allow disabling endpoint address validation [#1608](https://github.com/openshift/cluster-ingress-operator/pull/1608)
* [OCPBUGS-118434](https://issues.redhat.com/browse/OCPBUGS-118434): Remove obsolete workaround that hardcodes spec.replicas [#1581](https://github.com/openshift/cluster-ingress-operator/pull/1581)
* [OCPBUGS-121851](https://issues.redhat.com/browse/OCPBUGS-121851): Report ingress Available=True on zero-worker HyperShift startup [#1607](https://github.com/openshift/cluster-ingress-operator/pull/1607)
* [TRT-3022](https://issues.redhat.com/browse/TRT-3022): Revert #1556 "NE-2126: Migrating Ingress operator test cases from QE repo" [#1623](https://github.com/openshift/cluster-ingress-operator/pull/1623)
* [OCPBUGS-129612](https://issues.redhat.com/browse/OCPBUGS-129612): Rebuild fake DNS provider when DNS zones are added [#1614](https://github.com/openshift/cluster-ingress-operator/pull/1614)
* [NE-2126](https://issues.redhat.com/browse/NE-2126): Migrating Ingress operator test cases from QE repo [#1556](https://github.com/openshift/cluster-ingress-operator/pull/1556)
* [OCPBUGS-129664](https://issues.redhat.com/browse/OCPBUGS-129664): Bump to ossm 3.4.3 and Istio 1.30.5 [#1606](https://github.com/openshift/cluster-ingress-operator/pull/1606)
* [OCPBUGS-126999](https://issues.redhat.com/browse/OCPBUGS-126999): Support ambient AWS credentials in tests [#1602](https://github.com/openshift/cluster-ingress-operator/pull/1602)
* [NE-2922](https://issues.redhat.com/browse/NE-2922): Remove duplicate operator Ingress CRD from CIO payload [#1613](https://github.com/openshift/cluster-ingress-operator/pull/1613)
* [NE-2879](https://issues.redhat.com/browse/NE-2879): Update GitHub issue template URLs [#1578](https://github.com/openshift/cluster-ingress-operator/pull/1578)
* [OCPBUGS-105442](https://issues.redhat.com/browse/OCPBUGS-105442): improve Sail RBAC verification diagnostics [#1601](https://github.com/openshift/cluster-ingress-operator/pull/1601)
* [NE-2834](https://issues.redhat.com/browse/NE-2834): Replace deprecated math/rand.Read in e2e test [#1533](https://github.com/openshift/cluster-ingress-operator/pull/1533)
* [OCPBUGS-115108](https://issues.redhat.com/browse/OCPBUGS-115108): derive ingress Degraded grace [#1583](https://github.com/openshift/cluster-ingress-operator/pull/1583)
* [OCPBUGS-125752](https://issues.redhat.com/browse/OCPBUGS-125752): discover AWS subnets from CAPI with MAPI fallback [#1592](https://github.com/openshift/cluster-ingress-operator/pull/1592)
* [OCPBUGS-128253](https://issues.redhat.com/browse/OCPBUGS-128253): Wait for AWS NLB SG baseline [#1604](https://github.com/openshift/cluster-ingress-operator/pull/1604)
* [OCPBUGS-53193](https://issues.redhat.com/browse/OCPBUGS-53193): Update code references to use the default branch name 'main' [#1591](https://github.com/openshift/cluster-ingress-operator/pull/1591)
* [NE-2570](https://issues.redhat.com/browse/NE-2570): Simplify TLS profile validation [#1594](https://github.com/openshift/cluster-ingress-operator/pull/1594)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/a373f6b0e8b36ed26c84e2d0f1dee64dd81351d4...7d6e32bc7f1d5932303db24f6c5446d73d52a14f)
### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/cc0ed4791d5802e613e33e89b97c9b18b1786a8a)
* NO-JIRA: bump(openshift/library-go): to get retry in preflight check status report [#2368](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2368)
* [CNTRLPLANE-4845](https://issues.redhat.com/browse/CNTRLPLANE-4845): Migrate sno disruptive and encryption rotation e2e to ote [#2365](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2365)
* [OCPBUGS-133759](https://issues.redhat.com/browse/OCPBUGS-133759): Raise kube-apiserver operator memory request [#2366](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2366)
* NO-JIRA: Update library-go to run conditional step in KMS [#2367](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2367)
* NO-JIRA: bump(openshift/library-go): to get KMS GA [#2364](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2364)
* NO-JIRA: Update library-go [#2362](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2362)
* [OCPBUGS-60496](https://issues.redhat.com/browse/OCPBUGS-60496): Use BoundServceAccountTokenVolume dy default [#1896](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1896)
* NO-JIRA: Update library-go [#2354](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2354)
* [CNTRLPLANE-4731](https://issues.redhat.com/browse/CNTRLPLANE-4731): Add KMSPreflightCycle e2e [#2348](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2348)
* [OCPKUEUE-887](https://issues.redhat.com/browse/OCPKUEUE-887): Enable workload API versions for feature gates [#2332](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2332)
* NO-JIRA: Update library-go [#2349](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2349)
* NO-JIRA: Update library-go [#2347](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2347)
* [TRT-3013](https://issues.redhat.com/browse/TRT-3013): Revert "Use 300s shutdown delay on AWS" [#2346](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2346)
* NO-JIRA: bump openshift/api https://github.com/openshift/api/pull/3083 [#2339](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2339)
* [OCPBUGS-86789](https://issues.redhat.com/browse/OCPBUGS-86789): Extend AWS shutdown delay to 300s [#2267](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2267)
* [CNTRLPLANE-4408](https://issues.redhat.com/browse/CNTRLPLANE-4408): Support the `ExternalOIDCAsWebhook` feature gate [#2325](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2325)
* NO-JIRA: bump library-go https://github.com/openshift/library-go/pull/2518 [#2337](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2337)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): update deprecated API usage alerts for kube 1.37 [#2334](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2334)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Bump to golang-1.26-openshift-5.1 image [#2268](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2268)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2474 [#2327](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2327)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): encryption/assertion: bring back the preflight assertion for CAO and OAS-O [#2320](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2320)
* [CNTRLPLANE-4303](https://issues.redhat.com/browse/CNTRLPLANE-4303): Remove old go standard e2e encryption cases [#2322](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2322)
* [CNTRLPLANE-4303](https://issues.redhat.com/browse/CNTRLPLANE-4303): Migrate e2e-encryption to ote [#2290](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2290)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): bump library-go to get the new KMS plugin deployment strategy [#2315](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2315)
* [OCPBUGS-112638](https://issues.redhat.com/browse/OCPBUGS-112638): apienablement: enable resource.k8s.io/v1beta2 when DeviceTaintRule is enabled [#2275](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2275)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2478 [#2313](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2313)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/ae7f3ea3f0fb68b2eafb247049835d5d8543923e...cc0ed4791d5802e613e33e89b97c9b18b1786a8a)
### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/c5551c1428d12edd17eb97d80cca43ee45b113cc)
* [CNTRLPLANE-4441](https://issues.redhat.com/browse/CNTRLPLANE-4441): feat: inject tls groups [#974](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/974)
* [STOR-2875](https://issues.redhat.com/browse/STOR-2875): wire volumeForceDetach config observer for KCM [#975](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/975)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Rebase 1.37 [#953](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/953)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/416af3a20bd39d33d7506f04a6c483528aa9e6dc...c5551c1428d12edd17eb97d80cca43ee45b113cc)
### [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator/tree/ab8cbfbb1e5532cec39d08c6e84b8f8c0ea856ef)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Rebase 1.37 [#660](https://github.com/openshift/cluster-kube-scheduler-operator/pull/660)
* [Full changelog](https://github.com/openshift/cluster-kube-scheduler-operator/compare/7d896ecefe171028a01f6b7cfdbf30bc5828b414...ab8cbfbb1e5532cec39d08c6e84b8f8c0ea856ef)
### [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/tree/01da4b3eee18148dddb64b734939ef2b3cb110ef)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#183](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/183)
* [Full changelog](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/compare/f5d3bfe64bda67ffb8299af01ebf2722287edf04...01da4b3eee18148dddb64b734939ef2b3cb110ef)
### [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver/tree/2821b7f4301df470bd28824aef97ca23b2df77d5)
* [OCPBUGS-57437](https://issues.redhat.com/browse/OCPBUGS-57437): Always permit asking node name in CSR SANs [#344](https://github.com/openshift/cluster-machine-approver/pull/344)
* [OCPCLOUD-3659](https://issues.redhat.com/browse/OCPCLOUD-3659): bump Kubernetes dependencies to 1.37 [#340](https://github.com/openshift/cluster-machine-approver/pull/340)
* NO-JIRA: Add OTE [#341](https://github.com/openshift/cluster-machine-approver/pull/341)
* NO-JIRA: feat(tls): add support for TLS groups/curve preferences [#308](https://github.com/openshift/cluster-machine-approver/pull/308)
* [OCPBUGS-99489](https://issues.redhat.com/browse/OCPBUGS-99489): Add NetworkPolicy manifests to openshift-cluster-machine-approver namespace [#313](https://github.com/openshift/cluster-machine-approver/pull/313)
* [OCPBUGS-121194](https://issues.redhat.com/browse/OCPBUGS-121194): fix: retry serving CSRs while Machine addresses populate [#321](https://github.com/openshift/cluster-machine-approver/pull/321)
* [Full changelog](https://github.com/openshift/cluster-machine-approver/compare/c96773c19165a46d55007cd6a14d24376ab83d4c...2821b7f4301df470bd28824aef97ca23b2df77d5)
### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/c125a1544b2cd2ec474b280bb59a4552738bb400)
* [MON-4699](https://issues.redhat.com/browse/MON-4699): allow-list Trainer usage metrics [#3170](https://github.com/openshift/cluster-monitoring-operator/pull/3170)
* [MON-4653](https://issues.redhat.com/browse/MON-4653): verify empty remote write source labels serialization and merge [#3165](https://github.com/openshift/cluster-monitoring-operator/pull/3165)
* [MON-4658](https://issues.redhat.com/browse/MON-4658): verify integer batch send deadline conversion [#3163](https://github.com/openshift/cluster-monitoring-operator/pull/3163)
* [MON-4654](https://issues.redhat.com/browse/MON-4654): verify remote write URL query parameters survive conversion [#3166](https://github.com/openshift/cluster-monitoring-operator/pull/3166)
* [MON-4659](https://issues.redhat.com/browse/MON-4659): verify integer remote write backoff conversion [#3164](https://github.com/openshift/cluster-monitoring-operator/pull/3164)
* [MON-4657](https://issues.redhat.com/browse/MON-4657): verify integer remote write timeout conversion [#3162](https://github.com/openshift/cluster-monitoring-operator/pull/3162)
* [MON-4660](https://issues.redhat.com/browse/MON-4660): verify integer metadata send interval conversion [#3152](https://github.com/openshift/cluster-monitoring-operator/pull/3152)
* [OU-1306](https://issues.redhat.com/browse/OU-1306): add monitoring-plugin backend proxy for all non-GET requests [#3159](https://github.com/openshift/cluster-monitoring-operator/pull/3159)
* [OCPBUGS-132863](https://issues.redhat.com/browse/OCPBUGS-132863): remove Prometheus config reloader rules [#3169](https://github.com/openshift/cluster-monitoring-operator/pull/3169)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3167](https://github.com/openshift/cluster-monitoring-operator/pull/3167)
* NO-JIRA: [bot] Update jsonnet dependencies [#3168](https://github.com/openshift/cluster-monitoring-operator/pull/3168)
* [MON-4655](https://issues.redhat.com/browse/MON-4655): append byte unit to enforced body size limit [#3145](https://github.com/openshift/cluster-monitoring-operator/pull/3145)
* NO-JIRA: chore: restrict NetworkPolicy ingress rules for thanos ruler and thanos sidecars on prometheus pods [#2926](https://github.com/openshift/cluster-monitoring-operator/pull/2926)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3153](https://github.com/openshift/cluster-monitoring-operator/pull/3153)
* [OCPBUGS-35391](https://issues.redhat.com/browse/OCPBUGS-35391): separate infra memory capacity from workers [#3132](https://github.com/openshift/cluster-monitoring-operator/pull/3132)
* [OCPBUGS-99988](https://issues.redhat.com/browse/OCPBUGS-99988): amcfg: remove client-side TLS enforcement for additional alertmanager configs [#3012](https://github.com/openshift/cluster-monitoring-operator/pull/3012)
* NO-JIRA: configure custom features for monitoring-plugin [#3149](https://github.com/openshift/cluster-monitoring-operator/pull/3149)
* [OCPBUGS-128640](https://issues.redhat.com/browse/OCPBUGS-128640): filter ciphers not supported by Thanos [#3134](https://github.com/openshift/cluster-monitoring-operator/pull/3134)
* [OCPBUGS-11267](https://issues.redhat.com/browse/OCPBUGS-11267), [OCPBUGS-123539](https://issues.redhat.com/browse/OCPBUGS-123539): tidy up RBAC permissions on secrets and configmaps for Prometheus operators [#3053](https://github.com/openshift/cluster-monitoring-operator/pull/3053)
* [ART-22049](https://issues.redhat.com/browse/ART-22049): remove references to configmap-reloader image [#3051](https://github.com/openshift/cluster-monitoring-operator/pull/3051)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3118](https://github.com/openshift/cluster-monitoring-operator/pull/3118)
* NO-ISSUE: [bot] Update jsonnet dependencies [#3117](https://github.com/openshift/cluster-monitoring-operator/pull/3117)
* [OCPBUGS-125779](https://issues.redhat.com/browse/OCPBUGS-125779): don't delete admin-owned Alertmanager secrets on destroy [#3133](https://github.com/openshift/cluster-monitoring-operator/pull/3133)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3105](https://github.com/openshift/cluster-monitoring-operator/pull/3105)
* [MON-4696](https://issues.redhat.com/browse/MON-4696): Bump prometheus-operator dependencies to v0.94.1 [#3102](https://github.com/openshift/cluster-monitoring-operator/pull/3102)
* [OCPBUGS-126689](https://issues.redhat.com/browse/OCPBUGS-126689): fix(e2e): use Job with backoffLimit for TestDocExamples [#3094](https://github.com/openshift/cluster-monitoring-operator/pull/3094)
* [OCPBUGS-123794](https://issues.redhat.com/browse/OCPBUGS-123794): Fix flaky TestTelemetryReport/rate_issues [#3093](https://github.com/openshift/cluster-monitoring-operator/pull/3093)
* NO-JIRA: [bot] Synchronize versions of the downstream components [#3097](https://github.com/openshift/cluster-monitoring-operator/pull/3097)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/ffa52202be7ea5a7b313d10ed1cc9af8f97ed968...c125a1544b2cd2ec474b280bb59a4552738bb400)
### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/67681812fea3d0477cdcdd5be167dcd959164e1b)
* [CORENET-7707](https://issues.redhat.com/browse/CORENET-7707): Update AdminPolicyBasedExternalRoute CRD to be consistent with upstream [#3210](https://github.com/openshift/cluster-network-operator/pull/3210)
* [CORENET-6512](https://issues.redhat.com/browse/CORENET-6512): [CNO] Setup OTE framework and migrate test cases from tests-private [#3015](https://github.com/openshift/cluster-network-operator/pull/3015)
* [CNV-97772](https://issues.redhat.com/browse/CNV-97772): ovn-kubernetes, Gate MAC security schemas for Tech Preview [#3179](https://github.com/openshift/cluster-network-operator/pull/3179)
* [OCPBUGS-123662](https://issues.redhat.com/browse/OCPBUGS-123662): Provide clarity on status of NOO installation [#3166](https://github.com/openshift/cluster-network-operator/pull/3166)
* [OPNET-819](https://issues.redhat.com/browse/OPNET-819): frr-k8s: master-monitor follows platform pod conventions [#3202](https://github.com/openshift/cluster-network-operator/pull/3202)
* [CORENET-7580](https://issues.redhat.com/browse/CORENET-7580): Bump Kubernetes to 1.37.1 [#3183](https://github.com/openshift/cluster-network-operator/pull/3183)
* [CORENET-6320](https://issues.redhat.com/browse/CORENET-6320): fix(workloads): enforce read-only root filesystems [#3170](https://github.com/openshift/cluster-network-operator/pull/3170)
* [OPNET-783](https://issues.redhat.com/browse/OPNET-783): statusmanager: Treat zero-node DaemonSets as rolled out [#3046](https://github.com/openshift/cluster-network-operator/pull/3046)
* NO-ISSUE: Align frr-k8s 5.1 CRDs [#3195](https://github.com/openshift/cluster-network-operator/pull/3195)
* [OPNET-783](https://issues.redhat.com/browse/OPNET-783): network: Add BGP VIP management support [#3047](https://github.com/openshift/cluster-network-operator/pull/3047)
* [OCPBUGS-130570](https://issues.redhat.com/browse/OCPBUGS-130570): Added global overrides for OVN-Kubernetes [#2851](https://github.com/openshift/cluster-network-operator/pull/2851)
* [OCPBUGS-123509](https://issues.redhat.com/browse/OCPBUGS-123509): multus: Refresh ignored namespaces on namespace changes [#3167](https://github.com/openshift/cluster-network-operator/pull/3167)
* [CORENET-7399](https://issues.redhat.com/browse/CORENET-7399): Expand golangci-lint configuration with comprehensive linter set [#3164](https://github.com/openshift/cluster-network-operator/pull/3164)
* [OCPBUGS-127174](https://issues.redhat.com/browse/OCPBUGS-127174): Fix issues when NetObserv fails to install [#3171](https://github.com/openshift/cluster-network-operator/pull/3171)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/61de77e4d4c4f65cd5b3d73e00308bfe837c1066...67681812fea3d0477cdcdd5be167dcd959164e1b)
### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/f02d1329cbef6d83e0d52e687d71eeef50b67c90)
* [CNF-28347](https://issues.redhat.com/browse/CNF-28347): Makefile: fix ARM e2e target and Hypershift ginkgo args [#1675](https://github.com/openshift/cluster-node-tuning-operator/pull/1675)
* NO-JIRA: fix isolatedCpuFreq doc comment to say maximum frequency [#1669](https://github.com/openshift/cluster-node-tuning-operator/pull/1669)
* NO-JIRA: Restrict metrics and webhook ingress [#1670](https://github.com/openshift/cluster-node-tuning-operator/pull/1670)
* NO-JIRA: tuned: restrict profile names [#1661](https://github.com/openshift/cluster-node-tuning-operator/pull/1661)
* [OSDOCS-22738](https://issues.redhat.com/browse/OSDOCS-22738): Fix hexadecimal typos in PerformanceProfile device comments [#1640](https://github.com/openshift/cluster-node-tuning-operator/pull/1640)
* [OCPBUGS-129451](https://issues.redhat.com/browse/OCPBUGS-129451): E2E: remove always-skipped IRQ load balance test [#1653](https://github.com/openshift/cluster-node-tuning-operator/pull/1653)
* [OCPBUGS-129613](https://issues.redhat.com/browse/OCPBUGS-129613): E2E: Add labels to ovsdpdk tests [#1657](https://github.com/openshift/cluster-node-tuning-operator/pull/1657)
* NO-JIRA: Update OWNERS file [#1655](https://github.com/openshift/cluster-node-tuning-operator/pull/1655)
* [OCPBUGS-129449](https://issues.redhat.com/browse/OCPBUGS-129449): E2E: Fix flaky test_id:64099 reboot assertion [#1652](https://github.com/openshift/cluster-node-tuning-operator/pull/1652)
* [OCPBUGS-115749](https://issues.redhat.com/browse/OCPBUGS-115749): Tighten operator RBAC to least privilege [#1639](https://github.com/openshift/cluster-node-tuning-operator/pull/1639)
* [OCPBUGS-66217](https://issues.redhat.com/browse/OCPBUGS-66217): PerformanceProfile and Tuned CRDs during bootstrap [#1596](https://github.com/openshift/cluster-node-tuning-operator/pull/1596)
* [OCPBUGS-127113](https://issues.redhat.com/browse/OCPBUGS-127113): E2E: Fix no-op Get() assertions in mixedcpus [#1571](https://github.com/openshift/cluster-node-tuning-operator/pull/1571)
* [OCPBUGS-129448](https://issues.redhat.com/browse/OCPBUGS-129448): E2E: check against available cpus instead of online cpuset [#1645](https://github.com/openshift/cluster-node-tuning-operator/pull/1645)
* [OCPBUGS-129450](https://issues.redhat.com/browse/OCPBUGS-129450): E2E: LLC: Fix assertions of odd cpus allocations [#1644](https://github.com/openshift/cluster-node-tuning-operator/pull/1644)
* [OCPBUGS-129165](https://issues.redhat.com/browse/OCPBUGS-129165): Makefile: Modify pao-functests-update-only to run tier-0 and tier-1 tests [#1651](https://github.com/openshift/cluster-node-tuning-operator/pull/1651)
* [OCPBUGS-105474](https://issues.redhat.com/browse/OCPBUGS-105474): Prevent offlined CPUs from being re-onlined after reboot by udev hotplug rule [#1618](https://github.com/openshift/cluster-node-tuning-operator/pull/1618)
* [OCPBUGS-126458](https://issues.redhat.com/browse/OCPBUGS-126458): E2E: PPC: replace no-op log-on-match with actual assertions (4 sites) [#1638](https://github.com/openshift/cluster-node-tuning-operator/pull/1638)
* NO-JIRA: Address govulncheck complaints [#1637](https://github.com/openshift/cluster-node-tuning-operator/pull/1637)
* [OCPBUGS-127362](https://issues.redhat.com/browse/OCPBUGS-127362): E2E: ovsDpdk remaining cases and consolidate suite [#1628](https://github.com/openshift/cluster-node-tuning-operator/pull/1628)
* [OCPBUGS-116703](https://issues.redhat.com/browse/OCPBUGS-116703): E2E: add missing matcher to offlined CPU Expect() calls [#1629](https://github.com/openshift/cluster-node-tuning-operator/pull/1629)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/b4c215b68874838b91ee73dcd2fc63897add46f6...f02d1329cbef6d83e0d52e687d71eeef50b67c90)
### [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator/tree/f71f8213797cc8cfda3569baae15f387b57a745c)
* [OCPBUGS-132357](https://issues.redhat.com/browse/OCPBUGS-132357): Prevent TLS curve restart loop on FIPS clusters [#257](https://github.com/openshift/cluster-olm-operator/pull/257)
* [OPRUN-4799](https://issues.redhat.com/browse/OPRUN-4799): Update OpenShift and Kubernetes libraries [#260](https://github.com/openshift/cluster-olm-operator/pull/260)
* NO-ISSUE: Remove SingleOwnNamespaceInstallSupport integration [#256](https://github.com/openshift/cluster-olm-operator/pull/256)
* NO-ISSUE: Bump github.com/operator-framework/operator-controller from 1.11.0 to 1.12.0 [#253](https://github.com/openshift/cluster-olm-operator/pull/253)
* NO-ISSUE: Support object-controller (ClusterObjectSet) component [#255](https://github.com/openshift/cluster-olm-operator/pull/255)
* [OPRUN-4768](https://issues.redhat.com/browse/OPRUN-4768): Apply TLS curve preferences to metrics server [#248](https://github.com/openshift/cluster-olm-operator/pull/248)
* [Full changelog](https://github.com/openshift/cluster-olm-operator/compare/9afc2cacd8fcb69af291396d387b52d3ca140eb1...f71f8213797cc8cfda3569baae15f387b57a745c)
### [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator/tree/0bd629d8590e09ef6157f906c717f3e842e51d44)
* NO-JIRA: bump(openshift/library-go): to get retry in preflight check status report [#812](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/812)
* [CNTRLPLANE-4439](https://issues.redhat.com/browse/CNTRLPLANE-4439): feat: inject tls groups [#793](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/793)
* NO-JIRA: Update library-go to run conditional step in KMS [#811](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/811)
* NO-JIRA: bump(openshift/library-go): to get KMS GA [#810](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/810)
* NO-JIRA: Update library-go [#809](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/809)
* NO-JIRA: Update library-go [#807](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/807)
* [CNTRLPLANE-4731](https://issues.redhat.com/browse/CNTRLPLANE-4731): Adding KMS e2e preflight and e2e rotation [#806](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/806)
* NO-JIRA: Update library-go [#803](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/803)
* NO-JIRA: Update library-go [#802](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/802)
* NO-JIRA: bump openshift/api https://github.com/openshift/api/pull/3083 [#798](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/798)
* NO-JIRA: Open bump library-go https://github.com/openshift/library-go/pull/2518 [#797](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/797)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2512 [#794](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/794)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2474 [#792](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/792)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): encryption/assertion: bring back the preflight assertion for CAO and OAS-O [#787](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/787)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): bump library-go to get the new KMS plugin deployment strategy [#781](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/781)
* [OCPBUGS-109468](https://issues.redhat.com/browse/OCPBUGS-109468): fix CVE-2026-41178 by updating otel to v1.44.0 [#761](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/761)
* [CNTRLPLANE-3237](https://issues.redhat.com/browse/CNTRLPLANE-3237): pull https://github.com/openshift/library-go/pull/2478 [#783](https://github.com/openshift/cluster-openshift-apiserver-operator/pull/783)
* [Full changelog](https://github.com/openshift/cluster-openshift-apiserver-operator/compare/4978130a0b2ed26971dca5e7758d6310d1b5a2b1...0bd629d8590e09ef6157f906c717f3e842e51d44)
### [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller/tree/81e222007c2ceec48a908877eb71fb135a2c2453)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): bump k8s 1.37 [#211](https://github.com/openshift/cluster-policy-controller/pull/211)
* [Full changelog](https://github.com/openshift/cluster-policy-controller/compare/c9e9a348260921c9e788e33a51e904502cbe2d13...81e222007c2ceec48a908877eb71fb135a2c2453)
### [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator/tree/cb826726d77224d5e8d1fd9026d25525c6982a55)
* NO-ISSUE: Restrict samples operator access to the global pull-secret [#726](https://github.com/openshift/cluster-samples-operator/pull/726)
* [CNTRLPLANE-4448](https://issues.redhat.com/browse/CNTRLPLANE-4448): Support for TLS Group Preferences [#725](https://github.com/openshift/cluster-samples-operator/pull/725)
* [Full changelog](https://github.com/openshift/cluster-samples-operator/compare/a4147d3308b2e935f58cf05eac4bf5fa35fa6cf8...cb826726d77224d5e8d1fd9026d25525c6982a55)
### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/05cac72a292e2b6a7ce541f530621dc81b07cedb)
* [STOR-3187](https://issues.redhat.com/browse/STOR-3187): Add csi-volume-device-exporter to CSO manifests [#762](https://github.com/openshift/cluster-storage-operator/pull/762)
* [OCPBUGS-104847](https://issues.redhat.com/browse/OCPBUGS-104847): Remove SELinuxMountGAReadiness patches [#759](https://github.com/openshift/cluster-storage-operator/pull/759)
* [STOR-3172](https://issues.redhat.com/browse/STOR-3172): Add TLS group support to CSO [#758](https://github.com/openshift/cluster-storage-operator/pull/758)
* [STOR-3176](https://issues.redhat.com/browse/STOR-3176): Add featuregates and clusterversions permissions to ClusterRoles [#756](https://github.com/openshift/cluster-storage-operator/pull/756)
* [STOR-3068](https://issues.redhat.com/browse/STOR-3068): Bump all libraries [#755](https://github.com/openshift/cluster-storage-operator/pull/755)
* [OCPBUGS-120762](https://issues.redhat.com/browse/OCPBUGS-120762): restrict azure-file secrets ClusterRole to get/list/watch/create [#750](https://github.com/openshift/cluster-storage-operator/pull/750)
* [OCPBUGS-127462](https://issues.redhat.com/browse/OCPBUGS-127462): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#748](https://github.com/openshift/cluster-storage-operator/pull/748)
* [OCPBUGS-127453](https://issues.redhat.com/browse/OCPBUGS-127453): Fix the un-upgradeable message [#746](https://github.com/openshift/cluster-storage-operator/pull/746)
* [OCPBUGS-127453](https://issues.redhat.com/browse/OCPBUGS-127453): Use KCS link in the un-upgradeable message [#744](https://github.com/openshift/cluster-storage-operator/pull/744)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/da41a216e9cdc764fb8e2fd0447029e68893e1ee...05cac72a292e2b6a7ce541f530621dc81b07cedb)
### [cluster-update-console-plugin](https://github.com/openshift/cluster-update-console-plugin/tree/770c09fa8741e3167dad266dc931b6ed036d3884)
* [OCPBUGS-128821](https://issues.redhat.com/browse/OCPBUGS-128821): Fix analysis timeout stuck in Analyzing state [#25](https://github.com/openshift/cluster-update-console-plugin/pull/25)
* [OTA-2140](https://issues.redhat.com/browse/OTA-2140): Add ApprovalPolicy warning banner for non-manual stages [#28](https://github.com/openshift/cluster-update-console-plugin/pull/28)
* [OCPBUGS-128825](https://issues.redhat.com/browse/OCPBUGS-128825): Re-analyse deletes AgenticRun for fresh cluster data [#26](https://github.com/openshift/cluster-update-console-plugin/pull/26)
* NO-JIRA: Update OWNERS file [#27](https://github.com/openshift/cluster-update-console-plugin/pull/27)
* [Full changelog](https://github.com/openshift/cluster-update-console-plugin/compare/02b220dd2aef5c1788768178e3ffd8592ccb89b9...770c09fa8741e3167dad266dc931b6ed036d3884)
### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/6ed826deb367c76ae1904d00c7cdf36969be9842)
* [OTA-2144](https://issues.redhat.com/browse/OTA-2144): Add a curve preference override for metrics [#1500](https://github.com/openshift/cluster-version-operator/pull/1500)
* [OCPCLOUD-3725](https://issues.redhat.com/browse/OCPCLOUD-3725): refactor(capability): use ClusterAPIOperator instead of ClusterAPIMachineManagement [#1499](https://github.com/openshift/cluster-version-operator/pull/1499)
* NO-JIRA: test/util: wait for the update service to serve before returning [#1498](https://github.com/openshift/cluster-version-operator/pull/1498)
* [OTA-2144](https://issues.redhat.com/browse/OTA-2144): TLSGroups support on the /metrics endpoint [#1495](https://github.com/openshift/cluster-version-operator/pull/1495)
* [CNTRLPLANE-4455](https://issues.redhat.com/browse/CNTRLPLANE-4455): Inject observed TLS Groups into annotated ConfigMaps [#1484](https://github.com/openshift/cluster-version-operator/pull/1484)
* NO-JIRA: test/cvo: serve accept-risks graph from in-cluster update service [#1476](https://github.com/openshift/cluster-version-operator/pull/1476)
* [OTA-2130](https://issues.redhat.com/browse/OTA-2130): add execution step, planner skill, and risk data [#1475](https://github.com/openshift/cluster-version-operator/pull/1475)
* [OCPBUGS-65558](https://issues.redhat.com/browse/OCPBUGS-65558): Cancel payload retrieval pod on upgrade clear [#1470](https://github.com/openshift/cluster-version-operator/pull/1470)
* [OCPBUGS-8252](https://issues.redhat.com/browse/OCPBUGS-8252): pkg/cvo: report unresolvable desired releases [#1467](https://github.com/openshift/cluster-version-operator/pull/1467)
* [OCPBUGS-129378](https://issues.redhat.com/browse/OCPBUGS-129378): skip console plugin deployment on OCP < 5.0 [#1482](https://github.com/openshift/cluster-version-operator/pull/1482)
* NO-ISSUE: docs/user/tasks-*by-number-and-component.svg: Update to 5.0 [#1485](https://github.com/openshift/cluster-version-operator/pull/1485)
* NO-JIRA: pkg/cvo: add architecture label to cluster_version_payload [#1480](https://github.com/openshift/cluster-version-operator/pull/1480)
* NO-ISSUE: test/cvo: set needRecover before mutating cluster resources [#1477](https://github.com/openshift/cluster-version-operator/pull/1477)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#1471](https://github.com/openshift/cluster-version-operator/pull/1471)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/882fd242b69c14e475f5671294712cec88c62c7f...6ed826deb367c76ae1904d00c7cdf36969be9842)
### [console](https://github.com/openshift/console/tree/8b308232798fb7dcc073eac0b83aa367c44d7ff0)
* [CONSOLE-3958](https://issues.redhat.com/browse/CONSOLE-3958): Replace getting started components with MultiContentCard [#17444](https://github.com/openshift/console/pull/17444)
* [CONSOLE-5568](https://issues.redhat.com/browse/CONSOLE-5568): update demo plugin tooling config [#17453](https://github.com/openshift/console/pull/17453)
* [CONSOLE-5568](https://issues.redhat.com/browse/CONSOLE-5568): clean up eslint config in vscode [#17442](https://github.com/openshift/console/pull/17442)
* [OCPBUGS-132777](https://issues.redhat.com/browse/OCPBUGS-132777): Remove the redundant detailsPage wrapper [#17413](https://github.com/openshift/console/pull/17413)
* [CONSOLE-5527](https://issues.redhat.com/browse/CONSOLE-5527): Split operator catalog into Classic and Next-Gen types [#17355](https://github.com/openshift/console/pull/17355)
* [CONSOLE-5570](https://issues.redhat.com/browse/CONSOLE-5570): Allow blob image sources in the default CSP [#17437](https://github.com/openshift/console/pull/17437)
* [OCPBUGS-128928](https://issues.redhat.com/browse/OCPBUGS-128928): Preserve ~new route when switching projects [#17349](https://github.com/openshift/console/pull/17349)
* [OCPBUGS-132338](https://issues.redhat.com/browse/OCPBUGS-132338): Preserve revealed Secret values across page rerenders [#17412](https://github.com/openshift/console/pull/17412)
* [CONSOLE-5568](https://issues.redhat.com/browse/CONSOLE-5568): migrate to oxlint [#17425](https://github.com/openshift/console/pull/17425)
* [CONSOLE-5479](https://issues.redhat.com/browse/CONSOLE-5479): UI and backend for OLMv0-to-OLMv1 migration [#17377](https://github.com/openshift/console/pull/17377)
* [OCPBUGS-132933](https://issues.redhat.com/browse/OCPBUGS-132933): Isolate polling test plugin mocks [#17421](https://github.com/openshift/console/pull/17421)
* NO-JIRA: migrate to ESM only + migrate to oxfmt [#17408](https://github.com/openshift/console/pull/17408)
* [OCPBUGS-132163](https://issues.redhat.com/browse/OCPBUGS-132163): Use "Technology Preview" in preview badge labels [#17396](https://github.com/openshift/console/pull/17396)
* [CONSOLE-5477](https://issues.redhat.com/browse/CONSOLE-5477): Support TLS group preferences [#17371](https://github.com/openshift/console/pull/17371)
* [CONSOLE-5567](https://issues.redhat.com/browse/CONSOLE-5567): Increase size of annotation, label and taint edit modals [#17398](https://github.com/openshift/console/pull/17398)
* [OCPBUGS-114708](https://issues.redhat.com/browse/OCPBUGS-114708): Remove early "analytics.page()" on Segment init [#17178](https://github.com/openshift/console/pull/17178)
* [OCPBUGS-132032](https://issues.redhat.com/browse/OCPBUGS-132032): Restore ConfigMap and BuildConfig form view edit actions [#17397](https://github.com/openshift/console/pull/17397)
* [CONSOLE-4824](https://issues.redhat.com/browse/CONSOLE-4824): migrate remaining jsx/js to tsx/ts [#17391](https://github.com/openshift/console/pull/17391)
* [CONSOLE-5552](https://issues.redhat.com/browse/CONSOLE-5552): Add Bridge CSP mode flag [#17369](https://github.com/openshift/console/pull/17369)
* NO-JIRA: Console plugin SDK package CHANGELOG update [#17392](https://github.com/openshift/console/pull/17392)
* [CONSOLE-5065](https://issues.redhat.com/browse/CONSOLE-5065): Migrate off of deprecated TS types [#17140](https://github.com/openshift/console/pull/17140)
* [CONSOLE-5065](https://issues.redhat.com/browse/CONSOLE-5065): Hold back on dynamicModulePatternFlyPackages update [#17390](https://github.com/openshift/console/pull/17390)
* [OCPBUGS-125794](https://issues.redhat.com/browse/OCPBUGS-125794): Show Software Catalog operators for namespace-scoped users [#17327](https://github.com/openshift/console/pull/17327)
* [CONSOLE-5564](https://issues.redhat.com/browse/CONSOLE-5564): ConsoleDataView API improvements [#17385](https://github.com/openshift/console/pull/17385)
* [OCPBUGS-130732](https://issues.redhat.com/browse/OCPBUGS-130732): Add security response headers [#17376](https://github.com/openshift/console/pull/17376)
* [CONSOLE-5065](https://issues.redhat.com/browse/CONSOLE-5065): Update dynamicModulePatternFlyPackages and related imports [#17379](https://github.com/openshift/console/pull/17379)
* [HELM-863](https://issues.redhat.com/browse/HELM-863): Show Helm nav tab regardless of HelmChartRepository/ProjectHelmChartRepository instance existence [#17338](https://github.com/openshift/console/pull/17338)
* [CONSOLE-5564](https://issues.redhat.com/browse/CONSOLE-5564): Add rearrangable columns to ConsoleDataView [#17370](https://github.com/openshift/console/pull/17370)
* [CONSOLE-5549](https://issues.redhat.com/browse/CONSOLE-5549): Add performance profiling for the dashboards page [#17346](https://github.com/openshift/console/pull/17346)
* [CONSOLE-5560](https://issues.redhat.com/browse/CONSOLE-5560): table column extension follow ups [#17363](https://github.com/openshift/console/pull/17363)
* [CONSOLE-5560](https://issues.redhat.com/browse/CONSOLE-5560): Add ConsoleDataView table column extensions [#17351](https://github.com/openshift/console/pull/17351)
* [OCPBUGS-84497](https://issues.redhat.com/browse/OCPBUGS-84497): Cap rendered alerts in notification drawer and dashboards [#17324](https://github.com/openshift/console/pull/17324)
* [CONSOLE-5544](https://issues.redhat.com/browse/CONSOLE-5544): Migrate OLM tables to ConsoleDataView [#17342](https://github.com/openshift/console/pull/17342)
* [CONSOLE-5540](https://issues.redhat.com/browse/CONSOLE-5540): Migrate metal3, container-security, and shipwright tables to ConsoleDataView [#17340](https://github.com/openshift/console/pull/17340)
* [CONSOLE-5099](https://issues.redhat.com/browse/CONSOLE-5099): Add kubeconfig download for ServiceAccounts and current user [#17199](https://github.com/openshift/console/pull/17199)
* [OCPBUGS-128719](https://issues.redhat.com/browse/OCPBUGS-128719): fix incorrect breakpoint in code editor sidebar [#17336](https://github.com/openshift/console/pull/17336)
* [CONSOLE-5539](https://issues.redhat.com/browse/CONSOLE-5539): Migrate knative tables to ConsoleDataView [#17326](https://github.com/openshift/console/pull/17326)
* [OCPBUGS-128465](https://issues.redhat.com/browse/OCPBUGS-128465): Fix flaky namespace selection and eliminate cross-file contention in OLM Data Grid e2e specs [#17329](https://github.com/openshift/console/pull/17329)
* [HELM-859](https://issues.redhat.com/browse/HELM-859): Guard against null/missing urls in Helm charts [#17280](https://github.com/openshift/console/pull/17280)
* [OCPBUGS-127046](https://issues.redhat.com/browse/OCPBUGS-127046): provide PatternFly dynamic modules without Console consuming them [#17318](https://github.com/openshift/console/pull/17318)
* NO-JIRA: Document the console.page/resource/list contract [#17312](https://github.com/openshift/console/pull/17312)
* [OCPBUGS-71193](https://issues.redhat.com/browse/OCPBUGS-71193): Group details page renders a kebab button instead of Actions button [#17197](https://github.com/openshift/console/pull/17197)
* NO-JIRA: small improvements and dep bumps [#17219](https://github.com/openshift/console/pull/17219)
* [CONSOLE-5113](https://issues.redhat.com/browse/CONSOLE-5113): Add default namespace warnings [#17177](https://github.com/openshift/console/pull/17177)
* And 17 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/console/compare/afe3510f5b5737edb0ab93a584db5d0d85c49f73...8b308232798fb7dcc073eac0b83aa367c44d7ff0)
### [console-operator](https://github.com/openshift/console-operator/tree/a0d111dd8b824e519ffd291b06da52bcf93ca8ec)
* [TRT-3060](https://issues.redhat.com/browse/TRT-3060): Revert #1158 "CONSOLE-5293: Use console-downloads image instead of cli-artifacts" [#1251](https://github.com/openshift/console-operator/pull/1251)
* [CONSOLE-5293](https://issues.redhat.com/browse/CONSOLE-5293): Use console-downloads image instead of cli-artifacts [#1158](https://github.com/openshift/console-operator/pull/1158)
* [OCPBUGS-132701](https://issues.redhat.com/browse/OCPBUGS-132701): Gate tlsGroups observation on TLSGroupPreferences [#1248](https://github.com/openshift/console-operator/pull/1248)
* [CONSOLE-5477](https://issues.redhat.com/browse/CONSOLE-5477): Support TLS group preferences [#1240](https://github.com/openshift/console-operator/pull/1240)
* [HELM-850](https://issues.redhat.com/browse/HELM-850): Address review feedback on Helm CLI download descriptions [#1235](https://github.com/openshift/console-operator/pull/1235)
* [RFE-4149](https://issues.redhat.com/browse/RFE-4149): Read only filesystem - temp directory mount [#1014](https://github.com/openshift/console-operator/pull/1014)
* [TRT-3005](https://issues.redhat.com/browse/TRT-3005): Revert #1227 "OCPSTRAT-3567: Replace console allow-all NetworkPolicy with scoped policies" [#1241](https://github.com/openshift/console-operator/pull/1241)
* NO-JIRA: Update API and client-go dependencies for Console ingress helper rename [#1236](https://github.com/openshift/console-operator/pull/1236)
* [OCPSTRAT-3567](https://issues.redhat.com/browse/OCPSTRAT-3567): Replace console allow-all NetworkPolicy with scoped policies [#1227](https://github.com/openshift/console-operator/pull/1227)
* [OCPBUGS-86719](https://issues.redhat.com/browse/OCPBUGS-86719): Use zero-downtime rollout strategy for console pods [#1168](https://github.com/openshift/console-operator/pull/1168)
* [CNTRLPLANE-4564](https://issues.redhat.com/browse/CNTRLPLANE-4564): Update to the latest openshift/api and rebase to 1.37 [#1237](https://github.com/openshift/console-operator/pull/1237)
* [OCPBUGS-109666](https://issues.redhat.com/browse/OCPBUGS-109666): fix the name of the Helm release in EAP 8.1 quickstart [#1208](https://github.com/openshift/console-operator/pull/1208)
* [OCPBUGS-121388](https://issues.redhat.com/browse/OCPBUGS-121388): Make console status flush cancellation-aware [#1228](https://github.com/openshift/console-operator/pull/1228)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#1230](https://github.com/openshift/console-operator/pull/1230)
* [Full changelog](https://github.com/openshift/console-operator/compare/b8447d3ef1eb621046ebdce84efb8ceb736dabdb...a0d111dd8b824e519ffd291b06da52bcf93ca8ec)
### [container-networking-plugins, containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins/tree/44c6428e4c9a20fd2f0c3ad4de11e50862a51151)
* [CORENET-7231](https://issues.redhat.com/browse/CORENET-7231): Update OWNERS file [#241](https://github.com/openshift/containernetworking-plugins/pull/241)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#248](https://github.com/openshift/containernetworking-plugins/pull/248)
* [Full changelog](https://github.com/openshift/containernetworking-plugins/compare/b0bea6bcba28cab2ffa15da03cbae98805af7eca...44c6428e4c9a20fd2f0c3ad4de11e50862a51151)
### [coredns](https://github.com/openshift/coredns/tree/c7b28efa94231de224dcb057e49bbabc9fe0286b)
* [NE-2790](https://issues.redhat.com/browse/NE-2790): Update CoreDNS to v1.14.7 [#197](https://github.com/openshift/coredns/pull/197)
* [OCPBUGS-125770](https://issues.redhat.com/browse/OCPBUGS-125770): validate DNS requests before unpacking [#217](https://github.com/openshift/coredns/pull/217)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#215](https://github.com/openshift/coredns/pull/215)
* [Full changelog](https://github.com/openshift/coredns/compare/37aaba896e97f4b9a091aab6d36f2213b8854474...c7b28efa94231de224dcb057e49bbabc9fe0286b)
### [csi-external-attacher](https://github.com/openshift/csi-external-attacher/tree/9fec0cd4e5043505e3b0bf7230e3d41e1482f85b)
* [STOR-3085](https://issues.redhat.com/browse/STOR-3085): Rebase to upstream v4.13.0 for OCP 5.1 [#123](https://github.com/openshift/csi-external-attacher/pull/123)
* [Full changelog](https://github.com/openshift/csi-external-attacher/compare/3fd668b3f07dd382e5c7b6239d50f7988f652e64...9fec0cd4e5043505e3b0bf7230e3d41e1482f85b)
### [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner/tree/4af23e6310423f2be9f25dbd772d228a6ca34443)
* [STOR-3085](https://issues.redhat.com/browse/STOR-3085): Rebase to upstream v6.4.0 for OCP 5.1 [#165](https://github.com/openshift/csi-external-provisioner/pull/165)
* [Full changelog](https://github.com/openshift/csi-external-provisioner/compare/7ff338c9d1296f0e5d4d8080a76bb191c8f3be30...4af23e6310423f2be9f25dbd772d228a6ca34443)
### [csi-external-resizer](https://github.com/openshift/csi-external-resizer/tree/c01245ea625e058d6ee032fb2b3a2595a7ad499c)
* [STOR-3085](https://issues.redhat.com/browse/STOR-3085): Rebase to upstream v2.3.0 for OCP 5.1 [#217](https://github.com/openshift/csi-external-resizer/pull/217)
* [Full changelog](https://github.com/openshift/csi-external-resizer/compare/14aa7028f485e95c800bb7ffbf9b66a2bf75ceaf...c01245ea625e058d6ee032fb2b3a2595a7ad499c)
### [csi-external-snapshot-metadata](https://github.com/openshift/csi-external-snapshot-metadata/tree/0399f2634abb48378e1a29899530c1de157a03ec)
* [STOR-3085](https://issues.redhat.com/browse/STOR-3085): Rebase to upstream v1.1.0 for OCP 5.1 [#35](https://github.com/openshift/csi-external-snapshot-metadata/pull/35)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#27](https://github.com/openshift/csi-external-snapshot-metadata/pull/27)
* [Full changelog](https://github.com/openshift/csi-external-snapshot-metadata/compare/e8f0f2a3e9e358061148f90dc41f97cfb0bc5a54...0399f2634abb48378e1a29899530c1de157a03ec)
### [csi-external-snapshotter, csi-snapshot-controller](https://github.com/openshift/csi-external-snapshotter/tree/a570de6a368dab9532e540d7f1ce10c3b03c6d1a)
* [STOR-3085](https://issues.redhat.com/browse/STOR-3085): Rebase to upstream v8.7.0 for OCP 5.1 [#260](https://github.com/openshift/csi-external-snapshotter/pull/260)
* [Full changelog](https://github.com/openshift/csi-external-snapshotter/compare/a019d1a9d9e1d26ffd0b2e0d911733180fa608b2...a570de6a368dab9532e540d7f1ce10c3b03c6d1a)
### [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe/tree/be6ff291d9015cd0a96f54c152b18864906b5a6b)
* [STOR-3085](https://issues.redhat.com/browse/STOR-3085): Rebase to upstream v2.20.0 for OCP 5.1 [#105](https://github.com/openshift/csi-livenessprobe/pull/105)
* [Full changelog](https://github.com/openshift/csi-livenessprobe/compare/4d22ba873038484dcd7fa67553d00ae01d20428a...be6ff291d9015cd0a96f54c152b18864906b5a6b)
### [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar/tree/de3c4217dca58af8b0b267c378eccae45e9eeaf5)
* [STOR-3085](https://issues.redhat.com/browse/STOR-3085): Rebase to upstream v2.18.0 for OCP 5.1 [#110](https://github.com/openshift/csi-node-driver-registrar/pull/110)
* [Full changelog](https://github.com/openshift/csi-node-driver-registrar/compare/5766960d82ffb9ef84d15e903ae57d0a6781ef11...de3c4217dca58af8b0b267c378eccae45e9eeaf5)
### [docker-builder](https://github.com/openshift/builder/tree/eb6fab812908e89e61afd9083d96a3e44d979b20)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#558](https://github.com/openshift/builder/pull/558)
* [Full changelog](https://github.com/openshift/builder/compare/c71e860460d9a120f29202dfc8a8eb30cb2ca30f...eb6fab812908e89e61afd9083d96a3e44d979b20)
### [docker-registry](https://github.com/openshift/image-registry/tree/ad28258ba72b92639a64c13942528cfd07bcdcbd)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#487](https://github.com/openshift/image-registry/pull/487)
* [CNTRLPLANE-4447](https://issues.redhat.com/browse/CNTRLPLANE-4447): add support for configuring TLS groups [#488](https://github.com/openshift/image-registry/pull/488)
* [Full changelog](https://github.com/openshift/image-registry/compare/823010aa7b0dcf1da53a26c2ec135d0a32e63d85...ad28258ba72b92639a64c13942528cfd07bcdcbd)
### [egress-router-cni](https://github.com/openshift/egress-router-cni/tree/0264f879b64fe94c28f1b7a32c5fcd91a5ec43db)
* [OCPBUGS-55356](https://issues.redhat.com/browse/OCPBUGS-55356): Fix invalid IPv6 sysctl key for enabling IP forwarding [#112](https://github.com/openshift/egress-router-cni/pull/112)
* [Full changelog](https://github.com/openshift/egress-router-cni/compare/49554e572efac19f660a00ecfe2ccbc4e84be1e0...0264f879b64fe94c28f1b7a32c5fcd91a5ec43db)
### [etcd](https://github.com/openshift/etcd/tree/7d21cb41113f72a3267d0eaab8d0f38f3a9f70d1)
* [CNTRLPLANE-4423](https://issues.redhat.com/browse/CNTRLPLANE-4423): Add --curve-preferences to configure TLS curves [#420](https://github.com/openshift/etcd/pull/420)
* NO-JIRA: allow 60s for snapshot member readiness [#424](https://github.com/openshift/etcd/pull/424)
* NO-JIRA: allow 180s for retained client reconnect [#423](https://github.com/openshift/etcd/pull/423)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#415](https://github.com/openshift/etcd/pull/415)
* [Full changelog](https://github.com/openshift/etcd/compare/24fb7ef2afe9c4e4ca179f70b101d8ac2a0daeab...7d21cb41113f72a3267d0eaab8d0f38f3a9f70d1)
### [haproxy-router, haproxy-router-haproxy32](https://github.com/openshift/router/tree/01bee8da2387d0cfbd7a1acd934bb92a8c320527)
* NO-JIRA: Add pedjak to OWNERS [#847](https://github.com/openshift/router/pull/847)
* [OCPBUGS-84250](https://issues.redhat.com/browse/OCPBUGS-84250): Add debug logging when dynamic update fails [#836](https://github.com/openshift/router/pull/836)
* [Full changelog](https://github.com/openshift/router/compare/d5cf9f2aa0bdd024f51a208f12558da9bac5ed38...01bee8da2387d0cfbd7a1acd934bb92a8c320527)
### [hypershift](https://github.com/openshift/hypershift/tree/225d8d2265006815d4487423b7ddac7571325d77)
* [CNTRLPLANE-4576](https://issues.redhat.com/browse/CNTRLPLANE-4576): Validate serviceAnnotations allowlist and size bounds [#10142](https://github.com/openshift/hypershift/pull/10142)
* [CNTRLPLANE-4577](https://issues.redhat.com/browse/CNTRLPLANE-4577): CPO passthrough of serviceAnnotations and loadBalancerClass to KAS Service [#10133](https://github.com/openshift/hypershift/pull/10133)
* [OCPBUGS-129115](https://issues.redhat.com/browse/OCPBUGS-129115): Validate external KubeVirt infrastructure kubeconfigs [#9903](https://github.com/openshift/hypershift/pull/9903)
* [CNTRLPLANE-4817](https://issues.redhat.com/browse/CNTRLPLANE-4817): Bump Azure CAPI provider (CAPZ) to v1.27.0 [#10078](https://github.com/openshift/hypershift/pull/10078)
* [OCPBUGS-129436](https://issues.redhat.com/browse/OCPBUGS-129436): Fix manual HA etcd snapshot recovery documentation [#10150](https://github.com/openshift/hypershift/pull/10150)
* [CNTRLPLANE-4850](https://issues.redhat.com/browse/CNTRLPLANE-4850): Bump core Cluster API to v1.14.3 [#10143](https://github.com/openshift/hypershift/pull/10143)
* NO-JIRA: ci(deps): bump astral-sh/setup-uv from 10.1.0 to 10.3.2 [#10163](https://github.com/openshift/hypershift/pull/10163)
* NO-JIRA: docs: direct contributors to #forum-ocp-hypershift [#10153](https://github.com/openshift/hypershift/pull/10153)
* [GCP-1240](https://issues.redhat.com/browse/GCP-1240): Add GCP Resource Manager tag API [#9735](https://github.com/openshift/hypershift/pull/9735)
* [CNTRLPLANE-4447](https://issues.redhat.com/browse/CNTRLPLANE-4447): Adds support for preferred TLS Groups [#10148](https://github.com/openshift/hypershift/pull/10148)
* [OCPBUGS-109628](https://issues.redhat.com/browse/OCPBUGS-109628): treat unstarted etcd member as unhealthy instead of aborting recovery [#10035](https://github.com/openshift/hypershift/pull/10035)
* [CNTRLPLANE-4826](https://issues.redhat.com/browse/CNTRLPLANE-4826): Stop gating NodePool rollout completion on upToDateReplicas [#10084](https://github.com/openshift/hypershift/pull/10084)
* [CNTRLPLANE-4832](https://issues.redhat.com/browse/CNTRLPLANE-4832): cover managed ingress DNS zone deletion [#10100](https://github.com/openshift/hypershift/pull/10100)
* NO-JIRA: chore(deps): update actions/download-artifact action to v8.0.2 (main) [#9968](https://github.com/openshift/hypershift/pull/9968)
* [GCP-1315](https://issues.redhat.com/browse/GCP-1315): test(e2e/v2): add GCP multi-cluster lifecycle platform config [#9977](https://github.com/openshift/hypershift/pull/9977)
* [CNTRLPLANE-4513](https://issues.redhat.com/browse/CNTRLPLANE-4513): chore(aws): stop writing and prune deprecated aws-load-balancer-subnets annotation [#9807](https://github.com/openshift/hypershift/pull/9807)
* [CNTRLPLANE-4732](https://issues.redhat.com/browse/CNTRLPLANE-4732): route kubelet through HAProxy on all public HCPs [#9988](https://github.com/openshift/hypershift/pull/9988)
* [CNTRLPLANE-3928](https://issues.redhat.com/browse/CNTRLPLANE-3928): e2e: verify workload pulls through the image mirror [#10075](https://github.com/openshift/hypershift/pull/10075)
* NO-JIRA: fix: remove CustomNoUpgrade HyperShift CRDs during API generation [#10136](https://github.com/openshift/hypershift/pull/10136)
* NO-JIRA: Fix parallel CAPI verification race [#10073](https://github.com/openshift/hypershift/pull/10073)
* [CNTRLPLANE-4486](https://issues.redhat.com/browse/CNTRLPLANE-4486): Enforce unit test function structure in hypershiftlinter [#9738](https://github.com/openshift/hypershift/pull/9738)
* [NE-2816](https://issues.redhat.com/browse/NE-2816): update haproxy image [#10065](https://github.com/openshift/hypershift/pull/10065)
* [CNTRLPLANE-4816](https://issues.redhat.com/browse/CNTRLPLANE-4816): Bump AWS CAPI provider to v2.13.1 [#10064](https://github.com/openshift/hypershift/pull/10064)
* [OCPBUGS-99759](https://issues.redhat.com/browse/OCPBUGS-99759): Publish compatible scale-from-zero capacity annotations [#10062](https://github.com/openshift/hypershift/pull/10062)
* [OCPBUGS-29551](https://issues.redhat.com/browse/OCPBUGS-29551): Document NodePool upgrade defaults in hcp help [#10014](https://github.com/openshift/hypershift/pull/10014)
* [AUTOSCALE-1044](https://issues.redhat.com/browse/AUTOSCALE-1044): detect multi-arch support for Karpenter ARM64 provisioning [#10116](https://github.com/openshift/hypershift/pull/10116)
* [OCPBUGS-129580](https://issues.redhat.com/browse/OCPBUGS-129580): wait for 0 nodes before subnet configmap cleanup in TestKarpenter [#10117](https://github.com/openshift/hypershift/pull/10117)
* [OCPBUGS-59842](https://issues.redhat.com/browse/OCPBUGS-59842): Bound etcd defragment RPCs and stop timed-out cycles [#10113](https://github.com/openshift/hypershift/pull/10113)
* [CONSOLE-5449](https://issues.redhat.com/browse/CONSOLE-5449): Preserve component route labels in HostedCluster and HostedControlPlane CRDs [#9815](https://github.com/openshift/hypershift/pull/9815)
* [OCPBUGS-127549](https://issues.redhat.com/browse/OCPBUGS-127549): gate ARO HCP router on backend service ClusterIPs being assigned [#9775](https://github.com/openshift/hypershift/pull/9775)
* [OCPBUGS-133784](https://issues.redhat.com/browse/OCPBUGS-133784): ensure verify-ci runs lint [#10126](https://github.com/openshift/hypershift/pull/10126)
* [OCPBUGS-133387](https://issues.redhat.com/browse/OCPBUGS-133387): Sync OSImageStream e2eutilallowlist scopes [#10124](https://github.com/openshift/hypershift/pull/10124)
* [OCPBUGS-131937](https://issues.redhat.com/browse/OCPBUGS-131937): Fix TLS downgrade restart waits for unsupported operators [#10108](https://github.com/openshift/hypershift/pull/10108)
* [CNTRLPLANE-4557](https://issues.redhat.com/browse/CNTRLPLANE-4557): Make restructure-commits model-neutral and enforce component boundaries [#9853](https://github.com/openshift/hypershift/pull/9853)
* NO-JIRA: chore(deps): update module go.mongodb.org/mongo-driver to v1.17.10 (main) [#10055](https://github.com/openshift/hypershift/pull/10055)
* [OCPBUGS-100035](https://issues.redhat.com/browse/OCPBUGS-100035): Add periodic resync and reduce backoff ceiling for HCCO resources controller [#10013](https://github.com/openshift/hypershift/pull/10013)
* [OCPBUGS-129497](https://issues.redhat.com/browse/OCPBUGS-129497): Align shared root and API dependencies [#9940](https://github.com/openshift/hypershift/pull/9940)
* NO-JIRA: Update e2e v2 AGENTS.md [#10115](https://github.com/openshift/hypershift/pull/10115)
* NO-JIRA: Deny use of v1 e2e package code in new v2 e2e code [#10112](https://github.com/openshift/hypershift/pull/10112)
* [CNTRLPLANE-4843](https://issues.redhat.com/browse/CNTRLPLANE-4843): Update common Konflux task bundles and artifact wiring [#10120](https://github.com/openshift/hypershift/pull/10120)
* [CNTRLPLANE-4447](https://issues.redhat.com/browse/CNTRLPLANE-4447): enable TLSGroupPreferences on TechPreviewNoUpgrade [#10094](https://github.com/openshift/hypershift/pull/10094)
* [GCP-1220](https://issues.redhat.com/browse/GCP-1220): Reconcile GCP LoadBalancer Service resource-label annotations in HCCO [#9644](https://github.com/openshift/hypershift/pull/9644)
* [CNTRLPLANE-4576](https://issues.redhat.com/browse/CNTRLPLANE-4576): Add loadBalancerClass and serviceAnnotations API fields [#9913](https://github.com/openshift/hypershift/pull/9913)
* [CNTRLPLANE-4807](https://issues.redhat.com/browse/CNTRLPLANE-4807): Add KubeletHAProxyRouting FeatureGate [#10043](https://github.com/openshift/hypershift/pull/10043)
* [CNTRLPLANE-4601](https://issues.redhat.com/browse/CNTRLPLANE-4601): Add a GitHub Actions deadcode gate [#10110](https://github.com/openshift/hypershift/pull/10110)
* [CNTRLPLANE-3927](https://issues.redhat.com/browse/CNTRLPLANE-3927): add e2e v2 test for imageContentSources propagation to IDMS and ignition [#10029](https://github.com/openshift/hypershift/pull/10029)
* [OCPBUGS-133387](https://issues.redhat.com/browse/OCPBUGS-133387): fix(e2e) wait for NodePool version in cross-major OSImageStream specs [#10107](https://github.com/openshift/hypershift/pull/10107)
* [OCPBUGS-131838](https://issues.redhat.com/browse/OCPBUGS-131838): pass allocated UID to standalone karpenter-operator [#10024](https://github.com/openshift/hypershift/pull/10024)
* [CNTRLPLANE-4600](https://issues.redhat.com/browse/CNTRLPLANE-4600): Add reporting-only deadcode command and reports [#9902](https://github.com/openshift/hypershift/pull/9902)
* [CNTRLPLANE-4817](https://issues.redhat.com/browse/CNTRLPLANE-4817): Resolve CAPI packages with go list in the provider sync [#10083](https://github.com/openshift/hypershift/pull/10083)
* [OCPBUGS-132920](https://issues.redhat.com/browse/OCPBUGS-132920): sync CAPK install CRDs with openshift CAPK release-5.1 [#10082](https://github.com/openshift/hypershift/pull/10082)
* NO-JIRA: fix(e2e): skip managed DNS e2e below 5.1 [#10063](https://github.com/openshift/hypershift/pull/10063)
* NO-JIRA: bump google.golang.org/grpc to 1.83.2 in tools [#10095](https://github.com/openshift/hypershift/pull/10095)
* [CNTRLPLANE-3632](https://issues.redhat.com/browse/CNTRLPLANE-3632): Predictable NodePool rollout control [#9818](https://github.com/openshift/hypershift/pull/9818)
* [OCPBUGS-84499](https://issues.redhat.com/browse/OCPBUGS-84499): Etcd recovery on unreachable nodes [#9992](https://github.com/openshift/hypershift/pull/9992)
* NO-JIRA: chore: fixup karpenter reviewers and approvers in OWNERS [#10023](https://github.com/openshift/hypershift/pull/10023)
* NO-JIRA: Fix kube-storage-version-migrator removal assertion [#10097](https://github.com/openshift/hypershift/pull/10097)
* [CNTRLPLANE-2042](https://issues.redhat.com/browse/CNTRLPLANE-2042): test(e2e): add cross-cluster backup restore coverage for AWS [#9979](https://github.com/openshift/hypershift/pull/9979)
* NO-JIRA: ci(deps): bump actions/create-github-app-token from 1.12.0 to 3.3.0 [#10087](https://github.com/openshift/hypershift/pull/10087)
* [OCPBUGS-132561](https://issues.redhat.com/browse/OCPBUGS-132561): Fix Azure role-assignment cleanup in CI [#10061](https://github.com/openshift/hypershift/pull/10061)
* [CNTRLPLANE-4662](https://issues.redhat.com/browse/CNTRLPLANE-4662): docs(aws): add managed DNS how-to [#9943](https://github.com/openshift/hypershift/pull/9943)
* [OCPBUGS-132796](https://issues.redhat.com/browse/OCPBUGS-132796): Filter nonstandard AZ subnets from AWS endpoints [#10080](https://github.com/openshift/hypershift/pull/10080)
* [OCPCLOUD-3704](https://issues.redhat.com/browse/OCPCLOUD-3704): enable CRD compatibility requirements for preview clusters [#9871](https://github.com/openshift/hypershift/pull/9871)
* [OCPBUGS-130965](https://issues.redhat.com/browse/OCPBUGS-130965): CVO upgrades stuck in Upgradeable=False (ResourceDeletesInProgress) [#10037](https://github.com/openshift/hypershift/pull/10037)
* NO-JIRA: build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.45.0 [#9661](https://github.com/openshift/hypershift/pull/9661)
* [GCP-1221](https://issues.redhat.com/browse/GCP-1221): Manage GCP worker firewall rules in CPO [#9640](https://github.com/openshift/hypershift/pull/9640)
* [CNTRLPLANE-4193](https://issues.redhat.com/browse/CNTRLPLANE-4193): feat: add initialKMSKeyARN for StorageClass KMS encryption [#9147](https://github.com/openshift/hypershift/pull/9147)
* [AUTOSCALE-944](https://issues.redhat.com/browse/AUTOSCALE-944): fix(karpenter): defer HCP lifecycle to standalone operator [#9930](https://github.com/openshift/hypershift/pull/9930)
* [CNTRLPLANE-3999](https://issues.redhat.com/browse/CNTRLPLANE-3999): Replace e2e v2 Platform.DeleteArgs with declarative ClusterSpec [#10033](https://github.com/openshift/hypershift/pull/10033)
* NO-JIRA: build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.37.0 to 1.45.0 in /hack/tools [#9656](https://github.com/openshift/hypershift/pull/9656)
* [OCPBUGS-86668](https://issues.redhat.com/browse/OCPBUGS-86668): fix CA rotation race in ReconcileTotalClientCA [#8618](https://github.com/openshift/hypershift/pull/8618)
* [GCP-1211](https://issues.redhat.com/browse/GCP-1211): Set PSC and load balancer resource labels [#9612](https://github.com/openshift/hypershift/pull/9612)
* [OCPBUGS-85079](https://issues.redhat.com/browse/OCPBUGS-85079): Fix global pull-secret label sync on HO upgrade [#8650](https://github.com/openshift/hypershift/pull/8650)
* [OCPBUGS-128637](https://issues.redhat.com/browse/OCPBUGS-128637): preserve role credentials for shared service accounts [#9828](https://github.com/openshift/hypershift/pull/9828)
* NO-JIRA: chore(deps): update cloudflare/wrangler-action action to v4.1.3 (main) [#9907](https://github.com/openshift/hypershift/pull/9907)
* [CNTRLPLANE-3610](https://issues.redhat.com/browse/CNTRLPLANE-3610): Decouple CAPI provider Go module dependencies [#8704](https://github.com/openshift/hypershift/pull/8704)
* [CNTRLPLANE-4559](https://issues.redhat.com/browse/CNTRLPLANE-4559): Add OpenShift Kubernetes 1.37.1 envtest coverage [#10039](https://github.com/openshift/hypershift/pull/10039)
* [OCPKUEUE-921](https://issues.redhat.com/browse/OCPKUEUE-921): feat: enable was in hypershift [#10034](https://github.com/openshift/hypershift/pull/10034)
* [CNTRLPLANE-4642](https://issues.redhat.com/browse/CNTRLPLANE-4642): Capture Azure E2E diagnostics [#9915](https://github.com/openshift/hypershift/pull/9915)
* NO-JIRA: chore(deps): update actions/upload-artifact action to v7.0.2 (main) [#9969](https://github.com/openshift/hypershift/pull/9969)
* [AUTOSCALE-1068](https://issues.redhat.com/browse/AUTOSCALE-1068): docs for AutoNode/Karpenter on self-managed azure [#10009](https://github.com/openshift/hypershift/pull/10009)
* [CNTRLPLANE-4167](https://issues.redhat.com/browse/CNTRLPLANE-4167): test: port scale-from-zero autoscaling test to v2 framework [#9411](https://github.com/openshift/hypershift/pull/9411)
* ci: sync release branches to community fork [#8220](https://github.com/openshift/hypershift/pull/8220)
* [OCPBUGS-74083](https://issues.redhat.com/browse/OCPBUGS-74083): encryption condition propagation [#10008](https://github.com/openshift/hypershift/pull/10008)
* [OCPBUGS-131937](https://issues.redhat.com/browse/OCPBUGS-131937): test(e2e-v2): skip control-plane-pki-operator TLS config tests on older operators [#10032](https://github.com/openshift/hypershift/pull/10032)
* [NE-2913](https://issues.redhat.com/browse/NE-2913): remove HAProxy 2.8 reference [#9984](https://github.com/openshift/hypershift/pull/9984)
* [CNTRLPLANE-3999](https://issues.redhat.com/browse/CNTRLPLANE-3999): remove Platform.CreateArgs to make ClusterSpecs more declarative [#10005](https://github.com/openshift/hypershift/pull/10005)
* [OCPBUGS-123171](https://issues.redhat.com/browse/OCPBUGS-123171): docs(capi-image-overrides): Add new override for versions below 4.19 [#9942](https://github.com/openshift/hypershift/pull/9942)
* [CNTRLPLANE-4160](https://issues.redhat.com/browse/CNTRLPLANE-4160), [CNTRLPLANE-4161](https://issues.redhat.com/browse/CNTRLPLANE-4161): use newer CPO for azure 4.20/4.21 overrides [#9967](https://github.com/openshift/hypershift/pull/9967)
* NO-JIRA: Document proportionate pre-PR validation [#10015](https://github.com/openshift/hypershift/pull/10015)
* NO-JIRA: clarify NodePool status.osImageStream vs MCO OSImageStream status [#10019](https://github.com/openshift/hypershift/pull/10019)
* [CNTRLPLANE-3201](https://issues.redhat.com/browse/CNTRLPLANE-3201): test(backup-restore): wait for manual backup before scheduling [#9961](https://github.com/openshift/hypershift/pull/9961)
* [AUTOSCALE-1057](https://issues.redhat.com/browse/AUTOSCALE-1057): rename standalone karpenter-operator deployment env var [#9954](https://github.com/openshift/hypershift/pull/9954)
* NO-JIRA: Add Dan Mace to core-approvers [#9994](https://github.com/openshift/hypershift/pull/9994)
* [OCPBUGS-126895](https://issues.redhat.com/browse/OCPBUGS-126895): preserve AWS API error details on AWSEndpointService reconcile [#9707](https://github.com/openshift/hypershift/pull/9707)
* [OCPSTRAT-3686](https://issues.redhat.com/browse/OCPSTRAT-3686): Set creationTimestamp in the operator image-references file [#9878](https://github.com/openshift/hypershift/pull/9878)
* [OCPBUGS-129594](https://issues.redhat.com/browse/OCPBUGS-129594): Fix IPv6 endpoint authorities in CPO [#9982](https://github.com/openshift/hypershift/pull/9982)
* [CNTRLPLANE-4711](https://issues.redhat.com/browse/CNTRLPLANE-4711): feat(azure): add opt-in IP forwarding for NodePools [#9966](https://github.com/openshift/hypershift/pull/9966)
* NO-JIRA: test(e2e): refactor Karpenter v2 test helpers and harden upgrade test [#9662](https://github.com/openshift/hypershift/pull/9662)
* [OCPSTRAT-3686](https://issues.redhat.com/browse/OCPSTRAT-3686): Zero pad the commit distance in derived nightly tags [#9980](https://github.com/openshift/hypershift/pull/9980)
* [CNTRLPLANE-4538](https://issues.redhat.com/browse/CNTRLPLANE-4538): correct August report blog attribution [#9931](https://github.com/openshift/hypershift/pull/9931)
* [CNTRLPLANE-4102](https://issues.redhat.com/browse/CNTRLPLANE-4102): chore(contrib): remove aws-leaked-resources [#9963](https://github.com/openshift/hypershift/pull/9963)
* [OCPBUGS-129581](https://issues.redhat.com/browse/OCPBUGS-129581): Preserve supplied Unmanaged etcd credentials [#9941](https://github.com/openshift/hypershift/pull/9941)
* [OCPBUGS-114415](https://issues.redhat.com/browse/OCPBUGS-114415): intermittent timeouts in TestDialDirectWithProxy [#9960](https://github.com/openshift/hypershift/pull/9960)
* [TRT-3008](https://issues.redhat.com/browse/TRT-3008): revert(ingressoperator): restore HAProxy 2.8 wiring [#9976](https://github.com/openshift/hypershift/pull/9976)
* [OCPBUGS-129420](https://issues.redhat.com/browse/OCPBUGS-129420): Propagate configured NodePool labels and taints with native capacity [#9919](https://github.com/openshift/hypershift/pull/9919)
* [OCPBUGS-49661](https://issues.redhat.com/browse/OCPBUGS-49661): fix(cpo): report real ValidAWSKMSConfig condition [#9953](https://github.com/openshift/hypershift/pull/9953)
* [OCPCLOUD-3708](https://issues.redhat.com/browse/OCPCLOUD-3708): feat(machine-approver): plumb TLS curve preferences [#9743](https://github.com/openshift/hypershift/pull/9743)
* [CNTRLPLANE-3646](https://issues.redhat.com/browse/CNTRLPLANE-3646): enable all platform agnostic and specific e2e v2 tests for AWS [#9701](https://github.com/openshift/hypershift/pull/9701)
* [GCP-504](https://issues.redhat.com/browse/GCP-504): NodePool Platform Conditions [#8917](https://github.com/openshift/hypershift/pull/8917)
* [CNTRLPLANE-4575](https://issues.redhat.com/browse/CNTRLPLANE-4575): add DeterministicLBIP feature gate [#9898](https://github.com/openshift/hypershift/pull/9898)
* [NE-2913](https://issues.redhat.com/browse/NE-2913): Remove HAProxy 2.8 reference [#9703](https://github.com/openshift/hypershift/pull/9703)
* [OCPBUGS-129006](https://issues.redhat.com/browse/OCPBUGS-129006): Converge Azure private DNS network links safely [#9896](https://github.com/openshift/hypershift/pull/9896)
* NO-JIRA: ci(deps): bump actions/actions-runner from 2.337.0 to 2.338.0 [#9956](https://github.com/openshift/hypershift/pull/9956)
* NO-JIRA: Require GCP workload identity mutation on 5.1 and later [#9936](https://github.com/openshift/hypershift/pull/9936)
* NO-JIRA: build(deps): bump the azure-github-dependencies group across 1 directory with 3 updates [#9777](https://github.com/openshift/hypershift/pull/9777)
* [OCPBUGS-129491](https://issues.redhat.com/browse/OCPBUGS-129491): ensure e2e v1 AWS OIDC providers are tagged with e2e metadata [#9933](https://github.com/openshift/hypershift/pull/9933)
* NO-JIRA: chore(owners): add CI operator config owners [#9938](https://github.com/openshift/hypershift/pull/9938)
* [CNTRLPLANE-4480](https://issues.redhat.com/browse/CNTRLPLANE-4480): feat(api): promote HCPUserFacingOperatorLogs feature gate to Default [#9724](https://github.com/openshift/hypershift/pull/9724)
* [AUTOSCALE-1008](https://issues.redhat.com/browse/AUTOSCALE-1008): feat(karpenter-operator): monitor operand rollout status for version tracking [#9654](https://github.com/openshift/hypershift/pull/9654)
* [AUTOSCALE-995](https://issues.redhat.com/browse/AUTOSCALE-995): implement cpu options [#9623](https://github.com/openshift/hypershift/pull/9623)
* [CNTRLPLANE-4600](https://issues.redhat.com/browse/CNTRLPLANE-4600): remove all reported deadcode candidates [#9904](https://github.com/openshift/hypershift/pull/9904)
* [CNTRLPLANE-4565](https://issues.redhat.com/browse/CNTRLPLANE-4565): Promote ingress and Azure private OAuth v2 tests to blocking [#9918](https://github.com/openshift/hypershift/pull/9918)
* [AUTOSCALE-947](https://issues.redhat.com/browse/AUTOSCALE-947): fix(karpenter): defer EC2NodeClass reconcile to standalone operator [#9746](https://github.com/openshift/hypershift/pull/9746)
* [OCPBUGS-104597](https://issues.redhat.com/browse/OCPBUGS-104597): fix(etcdbackup): correctly classify Azure client-secret credentials from Velero BSL secrets [#9321](https://github.com/openshift/hypershift/pull/9321)
* [CNTRLPLANE-4565](https://issues.redhat.com/browse/CNTRLPLANE-4565): Remove duplicated v1 AWS E2E checks [#9881](https://github.com/openshift/hypershift/pull/9881)
* [CNTRLPLANE-4337](https://issues.redhat.com/browse/CNTRLPLANE-4337): Extract cluster-foundation ownership with characterization [#9905](https://github.com/openshift/hypershift/pull/9905)
* NO-JIRA: strip DWARF info from linter plugins to fix macOS dyld crash [#9909](https://github.com/openshift/hypershift/pull/9909)
* [OCPBUGS-112277](https://issues.redhat.com/browse/OCPBUGS-112277): Skip PodDisruptionBudgets for SingleReplica control planes [#9394](https://github.com/openshift/hypershift/pull/9394)
* [OCPBUGS-128613](https://issues.redhat.com/browse/OCPBUGS-128613): validate Azure HostedCluster subnet ID [#9825](https://github.com/openshift/hypershift/pull/9825)
* [OCPBUGS-127429](https://issues.redhat.com/browse/OCPBUGS-127429): Enable DeviceTaintRule API for hosted clusters [#9518](https://github.com/openshift/hypershift/pull/9518)
* [CNTRLPLANE-550](https://issues.redhat.com/browse/CNTRLPLANE-550): Refactor HyperShift CLI for cross-platform consistency and testability [#9570](https://github.com/openshift/hypershift/pull/9570)
* [GCP-967](https://issues.redhat.com/browse/GCP-967): Add GCP workload identity webhook support [#9549](https://github.com/openshift/hypershift/pull/9549)
* [CNTRLPLANE-4558](https://issues.redhat.com/browse/CNTRLPLANE-4558): Update Dockerfile and Containerfile images for Kubernetes 1.37 [#9873](https://github.com/openshift/hypershift/pull/9873)
* [OCPBUGS-126889](https://issues.redhat.com/browse/OCPBUGS-126889): preserve wrapped Azure credential reconcile errors [#9704](https://github.com/openshift/hypershift/pull/9704)
* [OCPBUGS-129003](https://issues.redhat.com/browse/OCPBUGS-129003): Refresh performance-profile conditions at the same generation [#9891](https://github.com/openshift/hypershift/pull/9891)
* [MULTIARCH-5567](https://issues.redhat.com/browse/MULTIARCH-5567): Added support to create multi-arch (s390x & x86) NodePools with KubeVirt platform on heterogeneous management clusters [#9586](https://github.com/openshift/hypershift/pull/9586)
* [OCPBUGS-128975](https://issues.redhat.com/browse/OCPBUGS-128975): Count only successful upsert updates [#9872](https://github.com/openshift/hypershift/pull/9872)
* [OCPBUGS-109196](https://issues.redhat.com/browse/OCPBUGS-109196): fix(nodepool): validate KubeVirt additionalNetworks NAD namespace [#9299](https://github.com/openshift/hypershift/pull/9299)
* NO-JIRA: docs: fix stale N-2 version skew references to N-3 [#8999](https://github.com/openshift/hypershift/pull/8999)
* [AUTOSCALE-977](https://issues.redhat.com/browse/AUTOSCALE-977): feat(karpenter): defer default NodeClass to standalone operator [#9695](https://github.com/openshift/hypershift/pull/9695)
* [CNTRLPLANE-4562](https://issues.redhat.com/browse/CNTRLPLANE-4562): add kubeClientQPS and kubeClientBurst to ClusterAutoscaling [#9857](https://github.com/openshift/hypershift/pull/9857)
* [CNTRLPLANE-4548](https://issues.redhat.com/browse/CNTRLPLANE-4548): fix: move combined-pull-secret creation to top-level CPO [#9844](https://github.com/openshift/hypershift/pull/9844)
* [CNTRLPLANE-4553](https://issues.redhat.com/browse/CNTRLPLANE-4553): Remove duplicate release trigger and draft mode [#9880](https://github.com/openshift/hypershift/pull/9880)
* [CNTRLPLANE-4553](https://issues.redhat.com/browse/CNTRLPLANE-4553): Compact yq JSON output for GITHUB_OUTPUT in tag workflow [#9879](https://github.com/openshift/hypershift/pull/9879)
* [CNTRLPLANE-4553](https://issues.redhat.com/browse/CNTRLPLANE-4553): Add workflows permission and manual trigger for tag creation [#9877](https://github.com/openshift/hypershift/pull/9877)
* [CNTRLPLANE-4552](https://issues.redhat.com/browse/CNTRLPLANE-4552): request HO v0.1.86 tag [#9848](https://github.com/openshift/hypershift/pull/9848)
* [CNTRLPLANE-4553](https://issues.redhat.com/browse/CNTRLPLANE-4553): use runner.temp and detect arch for release workflow tool installs [#9851](https://github.com/openshift/hypershift/pull/9851)
* [CNTRLPLANE-4335](https://issues.redhat.com/browse/CNTRLPLANE-4335): Extract RBAC reconciliation into dedicated module [#9726](https://github.com/openshift/hypershift/pull/9726)
* [CNTRLPLANE-3890](https://issues.redhat.com/browse/CNTRLPLANE-3890): Add product-cli unit tests for HCP create cluster [#9591](https://github.com/openshift/hypershift/pull/9591)
* [CNTRLPLANE-4550](https://issues.redhat.com/browse/CNTRLPLANE-4550): improve HO hotfix documentation and fix template [#9845](https://github.com/openshift/hypershift/pull/9845)
* [OCPSTRAT-3686](https://issues.redhat.com/browse/OCPSTRAT-3686): Emit release-manifests/image-references from the operator build [#9854](https://github.com/openshift/hypershift/pull/9854)
* [CNTRLPLANE-4556](https://issues.redhat.com/browse/CNTRLPLANE-4556): Bump Kubernetes dependencies to 1.37 [#9568](https://github.com/openshift/hypershift/pull/9568)
* [OCPBUGS-77307](https://issues.redhat.com/browse/OCPBUGS-77307): Generate KubeVirt nmstate network config conditionally [#9381](https://github.com/openshift/hypershift/pull/9381)
* [CNTRLPLANE-4553](https://issues.redhat.com/browse/CNTRLPLANE-4553): install release workflow binaries to user-writable path [#9849](https://github.com/openshift/hypershift/pull/9849)
* [CNTRLPLANE-4465](https://issues.redhat.com/browse/CNTRLPLANE-4465): group MintMaker Go dependency updates by module [#9715](https://github.com/openshift/hypershift/pull/9715)
* [CNTRLPLANE-4379](https://issues.redhat.com/browse/CNTRLPLANE-4379): add release automation workflows for PR-based tagging [#9566](https://github.com/openshift/hypershift/pull/9566)
* [CNTRLPLANE-3341](https://issues.redhat.com/browse/CNTRLPLANE-3341): Extract support/imageregistry package from support/util [#9832](https://github.com/openshift/hypershift/pull/9832)
* [CNTRLPLANE-3901](https://issues.redhat.com/browse/CNTRLPLANE-3901): Add product-cli unit tests for IAM-Infra (Azure) [#9180](https://github.com/openshift/hypershift/pull/9180)
* [CCO-848](https://issues.redhat.com/browse/CCO-848): feat(cloud_credential_operator): inject centralized TLS configuration [#9409](https://github.com/openshift/hypershift/pull/9409)
* [OCPBUGS-109641](https://issues.redhat.com/browse/OCPBUGS-109641): fix slice bounds out of range panic in getAvailableCandidates [#9309](https://github.com/openshift/hypershift/pull/9309)
* [CNTRLPLANE-4090](https://issues.redhat.com/browse/CNTRLPLANE-4090): deduplicate internal constants by migrating consumers to shared packages [#9804](https://github.com/openshift/hypershift/pull/9804)
* [ACM-38185](https://issues.redhat.com/browse/ACM-38185): chore(owners): add ACM HyperShift owners for product-cli [#9082](https://github.com/openshift/hypershift/pull/9082)
* [CNTRLPLANE-4538](https://issues.redhat.com/browse/CNTRLPLANE-4538): add August 2026 progress report [#9839](https://github.com/openshift/hypershift/pull/9839)
* NO-JIRA: nodepool: log when user-data/token Secrets are deleted [#9819](https://github.com/openshift/hypershift/pull/9819)
* [OCPSTRAT-3686](https://issues.redhat.com/browse/OCPSTRAT-3686): Use git tag for hypershift nightly tag pipeline [#9826](https://github.com/openshift/hypershift/pull/9826)
* NO-JIRA: chore(deps): refresh rpm lockfiles (main) [SECURITY] [#9667](https://github.com/openshift/hypershift/pull/9667)
* [OCPBUGS-127651](https://issues.redhat.com/browse/OCPBUGS-127651): fix(operator): prevent deadlock when CRD conversion webhook caBundle is missing [#9782](https://github.com/openshift/hypershift/pull/9782)
* NO-JIRA: Remove Claude-powered PR comment workflows [#9830](https://github.com/openshift/hypershift/pull/9830)
* [OCPBUGS-99659](https://issues.redhat.com/browse/OCPBUGS-99659): reconcile NetworkPolicies for KubeVirt HCP router mode [#9619](https://github.com/openshift/hypershift/pull/9619)
* [CNTRLPLANE-3902](https://issues.redhat.com/browse/CNTRLPLANE-3902): Add product-cli unit tests for kubeconfig [#9217](https://github.com/openshift/hypershift/pull/9217)
* [GCP-1148](https://issues.redhat.com/browse/GCP-1148): Make zone required for cluster and nodepool creation [#9708](https://github.com/openshift/hypershift/pull/9708)
* [CNTRLPLANE-3900](https://issues.redhat.com/browse/CNTRLPLANE-3900): Add shared cmd/ unit tests for destroy cluster [#9166](https://github.com/openshift/hypershift/pull/9166)
* [CNTRLPLANE-1053](https://issues.redhat.com/browse/CNTRLPLANE-1053): Validate KAS reachability via SVC URL in KubeAPIDNSName e2e test [#9355](https://github.com/openshift/hypershift/pull/9355)
* NO-JIRA: build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 [#9776](https://github.com/openshift/hypershift/pull/9776)
* [CNTRLPLANE-3344](https://issues.redhat.com/browse/CNTRLPLANE-3344): Extract support/reconcilerpolicy package from support/util [#9734](https://github.com/openshift/hypershift/pull/9734)
* [OCPBUGS-98099](https://issues.redhat.com/browse/OCPBUGS-98099): test(e2e): isolate legacy Karpenter upgrade workload [#9806](https://github.com/openshift/hypershift/pull/9806)
* [CNTRLPLANE-4497](https://issues.redhat.com/browse/CNTRLPLANE-4497): add azure-orphaned-role-assignments tool [#9745](https://github.com/openshift/hypershift/pull/9745)
* [OCPBUGS-128500](https://issues.redhat.com/browse/OCPBUGS-128500): Gate custom ingress strategy E2E coverage to 4.21+ [#9814](https://github.com/openshift/hypershift/pull/9814)
* [OCPSTRAT-3686](https://issues.redhat.com/browse/OCPSTRAT-3686): import nightly release tags [#9809](https://github.com/openshift/hypershift/pull/9809)
* [OCPBUGS-114937](https://issues.redhat.com/browse/OCPBUGS-114937): Add readiness probe to kube-scheduler control plane deployment [#9789](https://github.com/openshift/hypershift/pull/9789)
* [OCPBUGS-128466](https://issues.redhat.com/browse/OCPBUGS-128466): reconcile aggregated docs [#9808](https://github.com/openshift/hypershift/pull/9808)
* NO-JIRA: chore(owners): refresh owner aliases [#9805](https://github.com/openshift/hypershift/pull/9805)
* [ROSAENG-65607](https://issues.redhat.com/browse/ROSAENG-65607): Adjust regex validation to allow sqs-fips url format (for FEDRAMP support) [#9737](https://github.com/openshift/hypershift/pull/9737)
* NO-JIRA: add serena/headroom files/folders to gitignore [#9802](https://github.com/openshift/hypershift/pull/9802)
* [OCPBUGS-126613](https://issues.redhat.com/browse/OCPBUGS-126613): fix(api): add missing + prefix to kubebuilder annotation on networkType [#9646](https://github.com/openshift/hypershift/pull/9646)
* [CNTRLPLANE-3632](https://issues.redhat.com/browse/CNTRLPLANE-3632): Revert #8698: NodePool rollout control [#9797](https://github.com/openshift/hypershift/pull/9797)
* [OCPBUGS-127049](https://issues.redhat.com/browse/OCPBUGS-127049): fix(globalps): schedule global-pull-secret-syncer on karpenter nodes [#9719](https://github.com/openshift/hypershift/pull/9719)
* [CNTRLPLANE-4508](https://issues.redhat.com/browse/CNTRLPLANE-4508): fix(e2e): detect installer flags supported by target image [#9792](https://github.com/openshift/hypershift/pull/9792)
* NO-JIRA: build(deps): bump compatible sigs-k8s dependencies [#9778](https://github.com/openshift/hypershift/pull/9778)
* [OCPBUGS-114936](https://issues.redhat.com/browse/OCPBUGS-114936): add PodDisruptionBudget for the HyperShift Operator [#9526](https://github.com/openshift/hypershift/pull/9526)
* [OCPBUGS-115085](https://issues.redhat.com/browse/OCPBUGS-115085): fix: mount combined-pull-secret in OpenShift API Server [#9617](https://github.com/openshift/hypershift/pull/9617)
* [OCPBUGS-109640](https://issues.redhat.com/browse/OCPBUGS-109640): fix(cmd/dump): filter resources by cluster platform [#9639](https://github.com/openshift/hypershift/pull/9639)
* NO-JIRA: fix(nodepool) data race in TestReconcileSelectorDropsStaleLabels [#9772](https://github.com/openshift/hypershift/pull/9772)
* [OCPBUGS-88757](https://issues.redhat.com/browse/OCPBUGS-88757): Align HCCO CatalogSource registryPoll interval with OCP defaults [#8745](https://github.com/openshift/hypershift/pull/8745)
* [CNTRLPLANE-4460](https://issues.redhat.com/browse/CNTRLPLANE-4460): refactor(test): chain BeforeApply handlers instead of overwriting [#9709](https://github.com/openshift/hypershift/pull/9709)
* NO-JIRA: ci(deps): bump codecov/codecov-action from 7.0.0 to 7.1.0 [#9681](https://github.com/openshift/hypershift/pull/9681)
* NO-JIRA: ci(deps): bump actions/cache from 4.2.3 to 6.1.0 [#9338](https://github.com/openshift/hypershift/pull/9338)
* [OCPSTRAT-3686](https://issues.redhat.com/browse/OCPSTRAT-3686): Update default ociStorage repository [#9770](https://github.com/openshift/hypershift/pull/9770)
* [OCPBUGS-127110](https://issues.redhat.com/browse/OCPBUGS-127110): Install HO via Job from operator image in e2e upgrade tests [#9736](https://github.com/openshift/hypershift/pull/9736)
* [OCPBUGS-127070](https://issues.redhat.com/browse/OCPBUGS-127070): Align .ci-operator.yaml build root tag with Dockerfiles [#9723](https://github.com/openshift/hypershift/pull/9723)
* [CNTRLPLANE-4374](https://issues.redhat.com/browse/CNTRLPLANE-4374): bug - gate platform CAPI types behind CRD discovery to fix bulk inspect on limited-CRD clusters [#9552](https://github.com/openshift/hypershift/pull/9552)
* [OCPBUGS-98066](https://issues.redhat.com/browse/OCPBUGS-98066): fix(nodepool): rebuild CAPI selectors deterministically on reconcile [#9698](https://github.com/openshift/hypershift/pull/9698)
* [CNTRLPLANE-3632](https://issues.redhat.com/browse/CNTRLPLANE-3632): Predictable NodePool rollout control [#8698](https://github.com/openshift/hypershift/pull/8698)
* [CNTRLPLANE-4090](https://issues.redhat.com/browse/CNTRLPLANE-4090): Move HostedControlPlaneNamespace to shared package [#9551](https://github.com/openshift/hypershift/pull/9551)
* [SPLAT-2742](https://issues.redhat.com/browse/SPLAT-2742): remove inlined SetSecurityGroups IAM permission [#9717](https://github.com/openshift/hypershift/pull/9717)
* [CNTRLPLANE-4213](https://issues.redhat.com/browse/CNTRLPLANE-4213): decouple konflux pr pipelines [#9413](https://github.com/openshift/hypershift/pull/9413)
* NO-JIRA: test(e2e): check OS streams for OpenShift 5.0 nightlies [#9712](https://github.com/openshift/hypershift/pull/9712)
* [CNTRLPLANE-3755](https://issues.redhat.com/browse/CNTRLPLANE-3755): fix(e2e): gate release-specific fields for version compatibility [#9564](https://github.com/openshift/hypershift/pull/9564)
* [CNTRLPLANE-2775](https://issues.redhat.com/browse/CNTRLPLANE-2775): Expose KAS availability and latency metrics from CPO [#9244](https://github.com/openshift/hypershift/pull/9244)
* [CNTRLPLANE-4092](https://issues.redhat.com/browse/CNTRLPLANE-4092): Move dump.go to its own package to break transitive dependency on sharedingress [#9727](https://github.com/openshift/hypershift/pull/9727)
* [OCPBUGS-125907](https://issues.redhat.com/browse/OCPBUGS-125907): fix(aws): use unique Route 53 caller references [#9647](https://github.com/openshift/hypershift/pull/9647)
* [OCPBUGS-114723](https://issues.redhat.com/browse/OCPBUGS-114723): Decouple user CA bundle reconciliation from resources controller [#9458](https://github.com/openshift/hypershift/pull/9458)
* NO-JIRA: chore(owners): add daniel-rejniak to gcp-reviewers [#9700](https://github.com/openshift/hypershift/pull/9700)
* [CNTRLPLANE-4304](https://issues.redhat.com/browse/CNTRLPLANE-4304): fix(ci): validate pending commit messages with gitlint [#9710](https://github.com/openshift/hypershift/pull/9710)
* [CNTRLPLANE-4395](https://issues.redhat.com/browse/CNTRLPLANE-4395): Make git commit format skill model and harness agnostic [#9625](https://github.com/openshift/hypershift/pull/9625)
* [OCPBUGS-123791](https://issues.redhat.com/browse/OCPBUGS-123791): CAPI storage version migration exclude IPAM [#9642](https://github.com/openshift/hypershift/pull/9642)
* [CNTRLPLANE-4365](https://issues.redhat.com/browse/CNTRLPLANE-4365): Publish hosted control plane sizing guidance [#9532](https://github.com/openshift/hypershift/pull/9532)
* And 3 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/hypershift/compare/2e7d902422a7dd111801a917ba75935b97dced71...225d8d2265006815d4487423b7ddac7571325d77)
### [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm/tree/acf2cb50d53867796344a516b3aaabfcd7f2630d)
* [OCPCLOUD-3678](https://issues.redhat.com/browse/OCPCLOUD-3678): Merge https://github.com/IBM-Cloud/cloud-provider-ibm:01595b6d497cc6ec6f807bd7136ac43d147ea042 (01595b6) into main [#89](https://github.com/openshift/cloud-provider-ibm/pull/89)
* [Full changelog](https://github.com/openshift/cloud-provider-ibm/compare/11bc35dd6fd5163259023a6f1dfcc59ce813ab5f...acf2cb50d53867796344a516b3aaabfcd7f2630d)
### [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver/tree/ea479e39e9feb756e8c025ff2eca83f69bdd2a5d)
* [STOR-3075](https://issues.redhat.com/browse/STOR-3075): Rebase to v5.2.32 for OCP 5.1 [#175](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/175)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#161](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/161)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver/compare/3a89d7d17d25727270414b07d3daaa3bc329d743...ea479e39e9feb756e8c025ff2eca83f69bdd2a5d)
### [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/tree/eff02c84e81efacbb7419ee4f436a8eb9d7a8f03)
* [STOR-3176](https://issues.redhat.com/browse/STOR-3176): Support TLS Groups in operators for kube-rbac-proxy sidecar [#203](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/203)
* [OCPBUGS-98100](https://issues.redhat.com/browse/OCPBUGS-98100): disable snapshot tests for ibm-vpc-block-csi-driver [#175](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/175)
* [STOR-3068](https://issues.redhat.com/browse/STOR-3068): Bump all libraries [#198](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/198)
* [OCPBUGS-127462](https://issues.redhat.com/browse/OCPBUGS-127462): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#194](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/194)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/compare/d9ad359f7beec76743bd6f4559db26434211661e...eff02c84e81efacbb7419ee4f436a8eb9d7a8f03)
### [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud/tree/5823f38cea16b6a9a002e791288290bc50b500a0)
* UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-ibmcloud:v0.15.0 (5704e48) into main [#184](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/184)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#187](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/187)
* [Full changelog](https://github.com/openshift/cluster-api-provider-ibmcloud/compare/edb8427aa57d4c223d1915ebd90d4034f8fb5f24...5823f38cea16b6a9a002e791288290bc50b500a0)
### [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud/tree/5b19ea36429837bc3e68204b3219776ed2c43dff)
* [OCPCLOUD-3666](https://issues.redhat.com/browse/OCPCLOUD-3666): bump Kubernetes dependencies to 1.37 [#117](https://github.com/openshift/machine-api-provider-ibmcloud/pull/117)
* [Full changelog](https://github.com/openshift/machine-api-provider-ibmcloud/compare/c2439897d64ade66b2159b48dc7ae68712b98400...5b19ea36429837bc3e68204b3219776ed2c43dff)
### [insights-operator](https://github.com/openshift/insights-operator/tree/8bdb4812c7dbca93dd11a2bc5fe0e7d875f070ee)
* [OCPBUGS-132789](https://issues.redhat.com/browse/OCPBUGS-132789): Gate ingress secret bindings on Ingress capability [#1403](https://github.com/openshift/insights-operator/pull/1403)
* [CCXDEV-16668](https://issues.redhat.com/browse/CCXDEV-16668): kserve gather servingRuntimes and clusterServingRuntimes CRs [#1385](https://github.com/openshift/insights-operator/pull/1385)
* [OCPBUGS-132226](https://issues.redhat.com/browse/OCPBUGS-132226): add CVO annotations to secret gatherer RBAC [#1397](https://github.com/openshift/insights-operator/pull/1397)
* NO-JIRA: Restructure scope of gather SA to specific namespaces (from 5.0) [#1392](https://github.com/openshift/insights-operator/pull/1392)
* NO-JIRA: Revert "WIP: how to add gpu node" [#1390](https://github.com/openshift/insights-operator/pull/1390)
* [CCXDEV-16671](https://issues.redhat.com/browse/CCXDEV-16671): add GPU node topology gatherer [#1364](https://github.com/openshift/insights-operator/pull/1364)
* NO-JIRA: add permissions to fetch MaasModelRefs [#1388](https://github.com/openshift/insights-operator/pull/1388)
* [CCXDEV-16669](https://issues.redhat.com/browse/CCXDEV-16669): gather externalModels [#1379](https://github.com/openshift/insights-operator/pull/1379)
* [CCXDEV-16670](https://issues.redhat.com/browse/CCXDEV-16670): add MaaSModelRef gatherer [#1377](https://github.com/openshift/insights-operator/pull/1377)
* [Full changelog](https://github.com/openshift/insights-operator/compare/8f15e3157ff09f54ab22801f5b21da35a195cc6d...8bdb4812c7dbca93dd11a2bc5fe0e7d875f070ee)
### [insights-runtime-exporter, insights-runtime-extractor](https://github.com/openshift/insights-runtime-extractor/tree/68a7815cb622c7919e07bfba0e08334576189a25)
* [OCPBUGS-128853](https://issues.redhat.com/browse/OCPBUGS-128853): drop privilege before executing fingerprints. [#95](https://github.com/openshift/insights-runtime-extractor/pull/95)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#92](https://github.com/openshift/insights-runtime-extractor/pull/92)
* [Full changelog](https://github.com/openshift/insights-runtime-extractor/compare/ba3de3b9777161897b75fc5a88e179dfbe8f6c53...68a7815cb622c7919e07bfba0e08334576189a25)
### [karpenter-operator](https://github.com/openshift/karpenter-operator/tree/0a8e040a5754e86883db572c225c823ae6365702)
* [OCPBUGS-133506](https://issues.redhat.com/browse/OCPBUGS-133506): satisfy HCP pod requirements [#70](https://github.com/openshift/karpenter-operator/pull/70)
* [AUTOSCALE-1058](https://issues.redhat.com/browse/AUTOSCALE-1058): Refactor EC2 and Azure NodeClass controllers [#65](https://github.com/openshift/karpenter-operator/pull/65)
* [AUTOSCALE-1062](https://issues.redhat.com/browse/AUTOSCALE-1062): fix: remove Azure-specific maxPods bounds [#66](https://github.com/openshift/karpenter-operator/pull/66)
* [OCPBUGS-133401](https://issues.redhat.com/browse/OCPBUGS-133401): attach HCP pull credentials to operand service account [#68](https://github.com/openshift/karpenter-operator/pull/68)
* [AUTOSCALE-166](https://issues.redhat.com/browse/AUTOSCALE-166): improve core karpenter e2es more [#67](https://github.com/openshift/karpenter-operator/pull/67)
* [AUTOSCALE-166](https://issues.redhat.com/browse/AUTOSCALE-166): Scope core regression to performance tests [#63](https://github.com/openshift/karpenter-operator/pull/63)
* [OCPBUGS-131838](https://issues.redhat.com/browse/OCPBUGS-131838): support karpenter operand UID without scc [#61](https://github.com/openshift/karpenter-operator/pull/61)
* [AUTOSCALE-166](https://issues.redhat.com/browse/AUTOSCALE-166): fixup karpenter core e2e script [#64](https://github.com/openshift/karpenter-operator/pull/64)
* NO-JIRA: chore: allow karpenter operand images to be overriden [#58](https://github.com/openshift/karpenter-operator/pull/58)
* [AUTOSCALE-944](https://issues.redhat.com/browse/AUTOSCALE-944): feat: migrate HostedControlPlane lifecycle controller from HyperShift [#52](https://github.com/openshift/karpenter-operator/pull/52)
* NO-JIRA: docs: clarify explicit test expectations [#60](https://github.com/openshift/karpenter-operator/pull/60)
* [AUTOSCALE-1046](https://issues.redhat.com/browse/AUTOSCALE-1046): feat: hold Azure NodeClass releases during control plane upgrades [#56](https://github.com/openshift/karpenter-operator/pull/56)
* [AUTOSCALE-166](https://issues.redhat.com/browse/AUTOSCALE-166): skip unsupported static capacity regression tests [#59](https://github.com/openshift/karpenter-operator/pull/59)
* [AUTOSCALE-166](https://issues.redhat.com/browse/AUTOSCALE-166): constrain regression e2e nodes to amd64 [#57](https://github.com/openshift/karpenter-operator/pull/57)
* NO-JIRA: add Deployment manifest golden-file testing [#53](https://github.com/openshift/karpenter-operator/pull/53)
* [AUTOSCALE-969](https://issues.redhat.com/browse/AUTOSCALE-969): add defaultNodeClass method for azure [#54](https://github.com/openshift/karpenter-operator/pull/54)
* NO-JIRA: refactor: align controller conventions [#55](https://github.com/openshift/karpenter-operator/pull/55)
* [OCPBUGS-116223](https://issues.redhat.com/browse/OCPBUGS-116223): fix: report ClusterOperator status on unsupported platforms [#50](https://github.com/openshift/karpenter-operator/pull/50)
* [AUTOSCALE-1045](https://issues.redhat.com/browse/AUTOSCALE-1045): feat: add OpenShiftAzureNodeClass API and controller [#44](https://github.com/openshift/karpenter-operator/pull/44)
* NO-JIRA: update controller and logging guidance in agents.md [#51](https://github.com/openshift/karpenter-operator/pull/51)
* [AUTOSCALE-1057](https://issues.redhat.com/browse/AUTOSCALE-1057): Implement karpenter operator metric and add test [#48](https://github.com/openshift/karpenter-operator/pull/48)
* NO-JIRA: fix: require EBS in block device mappings [#47](https://github.com/openshift/karpenter-operator/pull/47)
* NO-JIRA: fix: align controller logging with controller-runtime guidelines [#49](https://github.com/openshift/karpenter-operator/pull/49)
* NO-JIRA: chore: enforce consistent import aliases [#46](https://github.com/openshift/karpenter-operator/pull/46)
* [AUTOSCALE-1043](https://issues.redhat.com/browse/AUTOSCALE-1043): add pod monitor for karpenter and operator [#45](https://github.com/openshift/karpenter-operator/pull/45)
* NO-JIRA: chore: version local build tool binaries [#37](https://github.com/openshift/karpenter-operator/pull/37)
* [AUTOSCALE-947](https://issues.redhat.com/browse/AUTOSCALE-947): feat: migrate EC2NodeClass controller from HyperShift [#43](https://github.com/openshift/karpenter-operator/pull/43)
* [AUTOSCALE-1008](https://issues.redhat.com/browse/AUTOSCALE-1008): Add label and annotation for MonitorOperandsRolloutStatus tracking [#39](https://github.com/openshift/karpenter-operator/pull/39)
* [AUTOSCALE-977](https://issues.redhat.com/browse/AUTOSCALE-977): feat: reconcile default NodeClass [#38](https://github.com/openshift/karpenter-operator/pull/38)
* [AUTOSCALE-856](https://issues.redhat.com/browse/AUTOSCALE-856): Add Azure Karpenter provider image reference [#41](https://github.com/openshift/karpenter-operator/pull/41)
* [Full changelog](https://github.com/openshift/karpenter-operator/compare/69615069919bf76e68d485681f0fda1bbab4e1c0...0a8e040a5754e86883db572c225c823ae6365702)
### [keepalived-ipfailover](https://github.com/openshift/images/tree/c7e5377009eac0fc3853bb9f0ba9d702985977d7)
* [NE-2126](https://issues.redhat.com/browse/NE-2126): Make the ipfailover extension safe to register in origin [#256](https://github.com/openshift/images/pull/256)
* [NE-2126](https://issues.redhat.com/browse/NE-2126): Materialize ipfailover testdata lazily into a temp directory [#255](https://github.com/openshift/images/pull/255)
* NO-JIRA: Enable CentOS Stream 10 OKD package repositories in base image [#254](https://github.com/openshift/images/pull/254)
* [Full changelog](https://github.com/openshift/images/compare/32930575a2bb3571601a7444becc06d06e901657...c7e5377009eac0fc3853bb9f0ba9d702985977d7)
### [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server/tree/f260d5ba2211732bcbc7383cb7a07c9a144b4014)
* Bump openshift/kubernetes-metrics-server to v0.9.1 [#102](https://github.com/openshift/kubernetes-metrics-server/pull/102)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#80](https://github.com/openshift/kubernetes-metrics-server/pull/80)
* NO-ISSUE: [bot] Bump openshift/kubernetes-metrics-server to v0.9.0 [#72](https://github.com/openshift/kubernetes-metrics-server/pull/72)
* [Full changelog](https://github.com/openshift/kubernetes-metrics-server/compare/3d2e9cd0469d636e32dc0e4d4b6f65957eb27d71...f260d5ba2211732bcbc7383cb7a07c9a144b4014)
### [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy/tree/75554a0355eb0c9b25904102437a529703af89b8)
* NO-JIRA: Merge upstream v0.23.0 [#162](https://github.com/openshift/kube-rbac-proxy/pull/162)
* [Full changelog](https://github.com/openshift/kube-rbac-proxy/compare/15f06dc655748d92897ba0d37cb8a0c40fb5d6fa...75554a0355eb0c9b25904102437a529703af89b8)
### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/4ee3abf755840bf17040e4008445cf4303e94fb9)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#169](https://github.com/openshift/kube-state-metrics/pull/169)
* [Full changelog](https://github.com/openshift/kube-state-metrics/compare/4fcfe28da069857ca4afdcba3a7f167753f4ade8...4ee3abf755840bf17040e4008445cf4303e94fb9)
### [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator/tree/c67b43a2519e63f02e4be27ae6c8d4edcbc75950)
* [OCPBUGS-126583](https://issues.redhat.com/browse/OCPBUGS-126583): Bump golang.org/x/net to v0.55.0 to address CVE-2026-33814 [#266](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/266)
* NO-JIRA: Bump Go builder and CI images from 1.24 to 1.26 for openshift-5.1 [#265](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/265)
* [Full changelog](https://github.com/openshift/kubernetes-kube-storage-version-migrator/compare/3f74baced64e1be5ec9ca16e3a682cd4eca67c06...c67b43a2519e63f02e4be27ae6c8d4edcbc75950)
### [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt/tree/4b1124a8cfcb65556fe44fac4150c0e86640bb0b)
* NO-ISSUE: Fix CVE-2026-33814 - bump golang.org/x/net to sustaining fork v0.50.0-sec.4 [#104](https://github.com/openshift/cloud-provider-kubevirt/pull/104)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#87](https://github.com/openshift/cloud-provider-kubevirt/pull/87)
* [Full changelog](https://github.com/openshift/cloud-provider-kubevirt/compare/5eb884abcd2ff17ae8d7b2691ca12494597c08a6...4b1124a8cfcb65556fe44fac4150c0e86640bb0b)
### [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver/tree/85737e90631afcfe5a504473bd80e0a1b1297a9e)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump Go builder to 1.26 [#123](https://github.com/openshift/kubevirt-csi-driver/pull/123)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#119](https://github.com/openshift/kubevirt-csi-driver/pull/119)
* [Full changelog](https://github.com/openshift/kubevirt-csi-driver/compare/7ff99994ecc3a675fac6f9aa7fa418cdb0dca32b...85737e90631afcfe5a504473bd80e0a1b1297a9e)
### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/506db7b1bac5724604b2a95358dac8107d5ef92c)
* [OCPCLOUD-3709](https://issues.redhat.com/browse/OCPCLOUD-3709): feat(tls): add TLS groups and curve preferences [#1571](https://github.com/openshift/machine-api-operator/pull/1571)
* [CNF-26431](https://issues.redhat.com/browse/CNF-26431): Allow ironic-networking JSON-RPC port in NetworkPolicy [#1530](https://github.com/openshift/machine-api-operator/pull/1530)
* [OCPBUGS-90560](https://issues.redhat.com/browse/OCPBUGS-90560): remove GCP boot disk image defaulting from admission webhook [#1525](https://github.com/openshift/machine-api-operator/pull/1525)
* [OCPBUGS-90560](https://issues.redhat.com/browse/OCPBUGS-90560): add RBAC for GCP boot image resolution [#1560](https://github.com/openshift/machine-api-operator/pull/1560)
* [OCPCLOUD-3660](https://issues.redhat.com/browse/OCPCLOUD-3660): bump to Kubernetes 1.37 [#1570](https://github.com/openshift/machine-api-operator/pull/1570)
* [OCPBUGS-129369](https://issues.redhat.com/browse/OCPBUGS-129369): fix race in VAP MachineSet e2e test cleanup [#1572](https://github.com/openshift/machine-api-operator/pull/1572)
* [SPLAT-2983](https://issues.redhat.com/browse/SPLAT-2983): Use Machine API vSphere credentials in e2e tests [#1568](https://github.com/openshift/machine-api-operator/pull/1568)
* [OCPBUGS-122165](https://issues.redhat.com/browse/OCPBUGS-122165): Reduce vCenter API load in the vSphere machine controller [#1552](https://github.com/openshift/machine-api-operator/pull/1552)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/26d7767bee99ff544430fd138571989f52d67c00...506db7b1bac5724604b2a95358dac8107d5ef92c)
### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/9dadf03d34883f9e6ace6231a3a003e2358f2048)
* [OCPBUGS-135256](https://issues.redhat.com/browse/OCPBUGS-135256): update automated scale tests for the oldest supported… [#6700](https://github.com/openshift/machine-config-operator/pull/6700)
* [OPNET-811](https://issues.redhat.com/browse/OPNET-811): on-prem: propagate BGP VIP peer changes; disable-connected-check for FRR neighbors [#6685](https://github.com/openshift/machine-config-operator/pull/6685)
* [OCPBUGS-132697](https://issues.redhat.com/browse/OCPBUGS-132697): correctly wait for the cluster to settle after scale … [#6691](https://github.com/openshift/machine-config-operator/pull/6691)
* [OCPBUGS-115127](https://issues.redhat.com/browse/OCPBUGS-115127): Replace wildcard permissions with explicit verbs in MachineOSBuilder ClusterRole [#6471](https://github.com/openshift/machine-config-operator/pull/6471)
* [MCO-2522](https://issues.redhat.com/browse/MCO-2522): implement capi machinesets in E2E tests [#6644](https://github.com/openshift/machine-config-operator/pull/6644)
* [OCPBUGS-126565](https://issues.redhat.com/browse/OCPBUGS-126565): OCPBUGS-127024: OCPBUGS-127025: Enable `readOnlyRootFilesystem: true` for `machine-os-builder` and `create-digest-configmap` containers [#6640](https://github.com/openshift/machine-config-operator/pull/6640)
* [OCPBUGS-132309](https://issues.redhat.com/browse/OCPBUGS-132309): Fix MCN stale current config edge case [#6676](https://github.com/openshift/machine-config-operator/pull/6676)
* [OCPNODE-4602](https://issues.redhat.com/browse/OCPNODE-4602): implement {system,container}GomaxprocsBehavior field [#6332](https://github.com/openshift/machine-config-operator/pull/6332)
* [OCPBUGS-132754](https://issues.redhat.com/browse/OCPBUGS-132754): Handle restrictive policies for layered OS updates [#6670](https://github.com/openshift/machine-config-operator/pull/6670)
* [OCPBUGS-126565](https://issues.redhat.com/browse/OCPBUGS-126565): OCPBUGS-127021: Enable readOnlyRootFilesystem: true for `machine-config-controller` container [#6573](https://github.com/openshift/machine-config-operator/pull/6573)
* [OPNET-818](https://issues.redhat.com/browse/OPNET-818): on-prem: BGP VIP static pods follow platform pod conventions [#6673](https://github.com/openshift/machine-config-operator/pull/6673)
* [MCO-2622](https://issues.redhat.com/browse/MCO-2622): Update MCO dependencies to Kubernetes 1.37 [#6661](https://github.com/openshift/machine-config-operator/pull/6661)
* [OPNET-782](https://issues.redhat.com/browse/OPNET-782): on-prem: give the frr-k8s static pod reloader writable /tmp and /var/log/frr [#6643](https://github.com/openshift/machine-config-operator/pull/6643)
* [OCPBUGS-132308](https://issues.redhat.com/browse/OCPBUGS-132308): stabilize test 66436 - disable weak SSH cipher suites [#6666](https://github.com/openshift/machine-config-operator/pull/6666)
* [OCPBUGS-131830](https://issues.redhat.com/browse/OCPBUGS-131830): stabilise TestAPIServerCiphers unit test [#6659](https://github.com/openshift/machine-config-operator/pull/6659)
* [MCO-2475](https://issues.redhat.com/browse/MCO-2475): Simplified the Irreconcilable Differences test to only fetch Ignition contents [#6646](https://github.com/openshift/machine-config-operator/pull/6646)
* [OCPBUGS-130604](https://issues.redhat.com/browse/OCPBUGS-130604): test/extended: accept the data/by-lun Azure disk path [#6650](https://github.com/openshift/machine-config-operator/pull/6650)
* [OCPBUGS-129377](https://issues.redhat.com/browse/OCPBUGS-129377): MCD fails to rollback from OCL to stock RHCOS when extensions are installed [#6631](https://github.com/openshift/machine-config-operator/pull/6631)
* [OCPBUGS-129536](https://issues.redhat.com/browse/OCPBUGS-129536): Update cleanup for test `PolarionID:84219` to wait for node to be removed [#6648](https://github.com/openshift/machine-config-operator/pull/6648)
* [OCPBUGS-128286](https://issues.redhat.com/browse/OCPBUGS-128286): only enable signed policy when testing signed payloads [#6611](https://github.com/openshift/machine-config-operator/pull/6611)
* [OCPBUGS-99751](https://issues.redhat.com/browse/OCPBUGS-99751): Verify MOSC existence via API before serving layered image [#6352](https://github.com/openshift/machine-config-operator/pull/6352)
* [OCPBUGS-124571](https://issues.redhat.com/browse/OCPBUGS-124571): Bump version of `google.golang.org/grpc` [#6633](https://github.com/openshift/machine-config-operator/pull/6633)
* [SPLAT-2996](https://issues.redhat.com/browse/SPLAT-2996): use component-scoped vSphere credentials for boot image updates [#6641](https://github.com/openshift/machine-config-operator/pull/6641)
* [OCPBUGS-126565](https://issues.redhat.com/browse/OCPBUGS-126565): OCPBUGS-127020: Enable `readOnlyRootFilesystem: true` for machine-config-operator container [#6568](https://github.com/openshift/machine-config-operator/pull/6568)
* [MCO-2522](https://issues.redhat.com/browse/MCO-2522): Adapt all extended e2e test cases to use ManagedMachine… [#6621](https://github.com/openshift/machine-config-operator/pull/6621)
* [OCPBUGS-129112](https://issues.redhat.com/browse/OCPBUGS-129112): Skip GCP reconcile for unknown arch [#6625](https://github.com/openshift/machine-config-operator/pull/6625)
* [OCPBUGS-85519](https://issues.redhat.com/browse/OCPBUGS-85519): Add IRI credentials to the internal registry pull secret [#6067](https://github.com/openshift/machine-config-operator/pull/6067)
* [OCPBUGS-128811](https://issues.redhat.com/browse/OCPBUGS-128811): Remove reverse (rhel10 to rhel9) OSStreams upgrade tests [#6638](https://github.com/openshift/machine-config-operator/pull/6638)
* [OCPBUGS-128535](https://issues.redhat.com/browse/OCPBUGS-128535): Revert "OCPBUGS-91746: Remove sandboxed-containers (kata-containers) from extended-priv tests" [#6613](https://github.com/openshift/machine-config-operator/pull/6613)
* [MCO-1989](https://issues.redhat.com/browse/MCO-1989): Fix RHEL9-specific MCD Logic for RHEL10/CentOS10 for adaptability [#6515](https://github.com/openshift/machine-config-operator/pull/6515)
* [OCPBUGS-121959](https://issues.redhat.com/browse/OCPBUGS-121959): Make NIC persistence unconditional instead of version-specific [#6516](https://github.com/openshift/machine-config-operator/pull/6516)
* [OCPBUGS-128716](https://issues.redhat.com/browse/OCPBUGS-128716): logout vCenter clients after use [#6629](https://github.com/openshift/machine-config-operator/pull/6629)
* [AGENT-1454](https://issues.redhat.com/browse/AGENT-1454): Enforce APIServer TLS profile on IRI registry [#6592](https://github.com/openshift/machine-config-operator/pull/6592)
* [OCPBUGS-128457](https://issues.redhat.com/browse/OCPBUGS-128457): Fix layered OS updates on older nodes [#6630](https://github.com/openshift/machine-config-operator/pull/6630)
* [OCPBUGS-128676](https://issues.redhat.com/browse/OCPBUGS-128676): Boot image controller skips MachineSets that don't match any failure domain [#6606](https://github.com/openshift/machine-config-operator/pull/6606)
* [OPNET-782](https://issues.redhat.com/browse/OPNET-782): Render BGP VIP static pods instead of keepalived [#6326](https://github.com/openshift/machine-config-operator/pull/6326)
* [OCPBUGS-128659](https://issues.redhat.com/browse/OCPBUGS-128659): Filter cosign signature tags from the IRI release lookup [#6604](https://github.com/openshift/machine-config-operator/pull/6604)
* [MCO-2522](https://issues.redhat.com/browse/MCO-2522): Create ManagedMachineSet interface [#6602](https://github.com/openshift/machine-config-operator/pull/6602)
* NO-ISSUE: Initial version of the create MCO test plan skill [#6560](https://github.com/openshift/machine-config-operator/pull/6560)
* [OCPBUGS-128535](https://issues.redhat.com/browse/OCPBUGS-128535): Revert "OCPBUGS-91746: temporarily remove sandboxed-containers from extensions test" [#6596](https://github.com/openshift/machine-config-operator/pull/6596)
* NO-ISSUE: Fix typo in controller [#6595](https://github.com/openshift/machine-config-operator/pull/6595)
* NO-ISSUE: Increase timeout for `ImagePulledFromRegistry=Unknown` in non-SNO suites [#6598](https://github.com/openshift/machine-config-operator/pull/6598)
* [SPLAT-2376](https://issues.redhat.com/browse/SPLAT-2376): test/extended: add Azure machine pool disk setup tests [#6559](https://github.com/openshift/machine-config-operator/pull/6559)
* [OCPBUGS-105412](https://issues.redhat.com/browse/OCPBUGS-105412): Updated openshift/api vendor [#6586](https://github.com/openshift/machine-config-operator/pull/6586)
* [OCPBUGS-127481](https://issues.redhat.com/browse/OCPBUGS-127481): change markdown linter approach [#6591](https://github.com/openshift/machine-config-operator/pull/6591)
* [OCPBUGS-127707](https://issues.redhat.com/browse/OCPBUGS-127707): check CAPI manager modes for default skew status [#6589](https://github.com/openshift/machine-config-operator/pull/6589)
* [MCO-2572](https://issues.redhat.com/browse/MCO-2572): Consider nodes "Updated" when they have been manually set to an unready state but no update is happening [#6536](https://github.com/openshift/machine-config-operator/pull/6536)
* [OCPBUGS-127481](https://issues.redhat.com/browse/OCPBUGS-127481): Add markdown linter [#6582](https://github.com/openshift/machine-config-operator/pull/6582)
* [OCPBUGS-127022](https://issues.redhat.com/browse/OCPBUGS-127022): Enable `readOnlyRootFilesystem: true` for machine-config-server container [#6569](https://github.com/openshift/machine-config-operator/pull/6569)
* [OCPBUGS-74136](https://issues.redhat.com/browse/OCPBUGS-74136): Split wait-for-ipsec-connect into two services to avoid ipsec restart [#6440](https://github.com/openshift/machine-config-operator/pull/6440)
* NO-ISSUE: Increase timeout for `ImagePulledFromRegistry=Unknown` in non-SNO suites [#6574](https://github.com/openshift/machine-config-operator/pull/6574)
* [OCPBUGS-86768](https://issues.redhat.com/browse/OCPBUGS-86768): Nodes created with 4.13 base images cannot join the cluster [#6435](https://github.com/openshift/machine-config-operator/pull/6435)
* [MCO-2536](https://issues.redhat.com/browse/MCO-2536): Update operator to populate CAPI bootimage status [#6469](https://github.com/openshift/machine-config-operator/pull/6469)
* [OCPBUGS-126899](https://issues.redhat.com/browse/OCPBUGS-126899): Add MCN/PIS/MOSC/MOSB/OSImageStream to relatedObjects [#6563](https://github.com/openshift/machine-config-operator/pull/6563)
* [OCPBUGS-86571](https://issues.redhat.com/browse/OCPBUGS-86571): templates: pass --dual-stack to nodeip-configuration [#6105](https://github.com/openshift/machine-config-operator/pull/6105)
* [OCPBUGS-57177](https://issues.redhat.com/browse/OCPBUGS-57177): Degrade the MachineConfigPool on PinnedImageSet degrade [#6443](https://github.com/openshift/machine-config-operator/pull/6443)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/86eb9d92e9cfc578224b86467ae45e86485a63b1...9dadf03d34883f9e6ace6231a3a003e2358f2048)
### [machine-os-images](https://github.com/openshift/machine-os-images/tree/3fca30d8f935900603dab36abd6cc4a1e356b693)
* [OKD-465](https://issues.redhat.com/browse/OKD-465): Update Dockerfile installer base to ocp/5.1 [#120](https://github.com/openshift/machine-os-images/pull/120)
* [OCPBUGS-126621](https://issues.redhat.com/browse/OCPBUGS-126621): Select bundled CoreOS version when COREOS_VERSION is unset [#116](https://github.com/openshift/machine-os-images/pull/116)
* [Full changelog](https://github.com/openshift/machine-os-images/compare/2910fb3fef2f907bcb7863471240ba0289621ea6...3fca30d8f935900603dab36abd6cc4a1e356b693)
### [metallb-frr](https://github.com/openshift/frr/tree/567c9101668ad51d96feb15ff121d69d6256fc1a)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#138](https://github.com/openshift/frr/pull/138)
* [Full changelog](https://github.com/openshift/frr/compare/4eebe4a1e50697ea070eec07c7ff022313ef3a8e...567c9101668ad51d96feb15ff121d69d6256fc1a)
### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/fc098fa592d89131014d895c8c1947ad24a4eb99)
* NO-JIRA: add diagnose-pipeline-failure skill and fix monitoring-dev periodic [#1402](https://github.com/openshift/monitoring-plugin/pull/1402)
* [CNV-87535](https://issues.redhat.com/browse/CNV-87535): address orphan cleanup review feedback [#1398](https://github.com/openshift/monitoring-plugin/pull/1398)
* [OU-1428](https://issues.redhat.com/browse/OU-1428): add persistent column selection and sorting [#1396](https://github.com/openshift/monitoring-plugin/pull/1396)
* [OU-1429](https://issues.redhat.com/browse/OU-1429): upgrade openshift sdk version [#1395](https://github.com/openshift/monitoring-plugin/pull/1395)
* [CNV-87535](https://issues.redhat.com/browse/CNV-87535): k8s: add orphan AlertRelabelConfig GC [#1174](https://github.com/openshift/monitoring-plugin/pull/1174)
* NO-JIRA: Fix vulnerable dependencies [#1394](https://github.com/openshift/monitoring-plugin/pull/1394)
* NO-JIRA: add playwrite component tests [#1392](https://github.com/openshift/monitoring-plugin/pull/1392)
* [OU-1593](https://issues.redhat.com/browse/OU-1593): Upgrade perses [#1366](https://github.com/openshift/monitoring-plugin/pull/1366)
* [OU-1595](https://issues.redhat.com/browse/OU-1595): merge logging-view into the monitoring console plugin [#1360](https://github.com/openshift/monitoring-plugin/pull/1360)
* [OU-1428](https://issues.redhat.com/browse/OU-1428): add missing alert list page tooltips [#1387](https://github.com/openshift/monitoring-plugin/pull/1387)
* [OU-1428](https://issues.redhat.com/browse/OU-1428): alert management list page [#1345](https://github.com/openshift/monitoring-plugin/pull/1345)
* [OCPBUGS-131104](https://issues.redhat.com/browse/OCPBUGS-131104), [OCPBUGS-131955](https://issues.redhat.com/browse/OCPBUGS-131955), [OCPBUGS-131960](https://issues.redhat.com/browse/OCPBUGS-131960), [OCPBUGS-131970](https://issues.redhat.com/browse/OCPBUGS-131970), [OCPBUGS-131984](https://issues.redhat.com/browse/OCPBUGS-131984), [OCPBUGS-132028](https://issues.redhat.com/browse/OCPBUGS-132028): Upgrade vulnerable dependencies [#1328](https://github.com/openshift/monitoring-plugin/pull/1328)
* [OCPBUGS-132207](https://issues.redhat.com/browse/OCPBUGS-132207): fix metrics series color squares [#1368](https://github.com/openshift/monitoring-plugin/pull/1368)
* [OU-1488](https://issues.redhat.com/browse/OU-1488): sanitize linkified URLs in alert annotations [#1374](https://github.com/openshift/monitoring-plugin/pull/1374)
* [OU-1428](https://issues.redhat.com/browse/OU-1428): fix prometheus rules api compatibility by removing omitempty's [#1373](https://github.com/openshift/monitoring-plugin/pull/1373)
* NO-JIRA: watch AlertRelabelConfig resource in openshift-monitoring only [#1361](https://github.com/openshift/monitoring-plugin/pull/1361)
* NO-JIRA: Add alerting GET endpoints to OpenAPI [#1344](https://github.com/openshift/monitoring-plugin/pull/1344)
* NO-JIRA: fix: provide SA token to console bridge to access remote dashboards from local dev env [#1351](https://github.com/openshift/monitoring-plugin/pull/1351)
* NO-JIRA: fix: patch vulnerable dependencies [#1318](https://github.com/openshift/monitoring-plugin/pull/1318)
* NO-JIRA: Add alert management API [#1339](https://github.com/openshift/monitoring-plugin/pull/1339)
* [OU-1392](https://issues.redhat.com/browse/OU-1392): fix: parse datetime ranges from the specified format rather than browser specific apis [#1308](https://github.com/openshift/monitoring-plugin/pull/1308)
* [OU-1483](https://issues.redhat.com/browse/OU-1483): automation - perses rbac stability and group permission for all users [#1326](https://github.com/openshift/monitoring-plugin/pull/1326)
* [OU-1600](https://issues.redhat.com/browse/OU-1600): fix: sort agentic runs by created to avoid getting stalled runs related to alerts [#1325](https://github.com/openshift/monitoring-plugin/pull/1325)
* [OU-1436](https://issues.redhat.com/browse/OU-1436): refactor to prepare for alert management [#1324](https://github.com/openshift/monitoring-plugin/pull/1324)
* [OU-1212](https://issues.redhat.com/browse/OU-1212): Create Observability Services landing page [#1289](https://github.com/openshift/monitoring-plugin/pull/1289)
* NO-JIRA: update devspace to sync backend and config changes [#1322](https://github.com/openshift/monitoring-plugin/pull/1322)
* NO-JIRA: prevent importing feature files in shared files [#1323](https://github.com/openshift/monitoring-plugin/pull/1323)
* [OU-1528](https://issues.redhat.com/browse/OU-1528): Swapping namespaces in Alerts optimized [#1305](https://github.com/openshift/monitoring-plugin/pull/1305)
* NO-JIRA: Agent skills consolidated [#1298](https://github.com/openshift/monitoring-plugin/pull/1298)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#1264](https://github.com/openshift/monitoring-plugin/pull/1264)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/b5465f7ec7b9a2139c0299f474779ccc3fd109de...fc098fa592d89131014d895c8c1947ad24a4eb99)
### [multus-admission-controller](https://github.com/openshift/multus-admission-controller/tree/3d6d6699aa06bb3b24d35620fb17b5b705ed0bb8)
* [CORENET-6320](https://issues.redhat.com/browse/CORENET-6320): fix(deployment): use read-only root filesystems [#138](https://github.com/openshift/multus-admission-controller/pull/138)
* [CORENET-7234](https://issues.redhat.com/browse/CORENET-7234): Update OWNERS file [#118](https://github.com/openshift/multus-admission-controller/pull/118)
* NO-JIRA: Bump to Ginkgo v2 2.33.0 [#142](https://github.com/openshift/multus-admission-controller/pull/142)
* [CORENET-7567](https://issues.redhat.com/browse/CORENET-7567): Add TLS curve preferences configuration support [#143](https://github.com/openshift/multus-admission-controller/pull/143)
* [Full changelog](https://github.com/openshift/multus-admission-controller/compare/5429edee2dc087ba0c4595c11bdd5f6d2e52436e...3d6d6699aa06bb3b24d35620fb17b5b705ed0bb8)
### [multus-cni, multus-cni-microshift](https://github.com/openshift/multus-cni/tree/65b175bfbceeb7de7bc4a82d336858d93e30120c)
* [CORENET-7619](https://issues.redhat.com/browse/CORENET-7619): DS Merge 10/12/26 [#370](https://github.com/openshift/multus-cni/pull/370)
* [Full changelog](https://github.com/openshift/multus-cni/compare/f046826640baf19d335411b2116fe8d2124158d3...65b175bfbceeb7de7bc4a82d336858d93e30120c)
### [multus-route-override-cni](https://github.com/openshift/route-override-cni/tree/345809e13769604b88431f4a226c56c7227cadce)
* [CORENET-7631](https://issues.redhat.com/browse/CORENET-7631): Update the minimum Go version [#84](https://github.com/openshift/route-override-cni/pull/84)
* [CORENET-7631](https://issues.redhat.com/browse/CORENET-7631): Bump Kubernetes to 1.37 and Go to 1.26.8 [#83](https://github.com/openshift/route-override-cni/pull/83)
* [CORENET-7237](https://issues.redhat.com/browse/CORENET-7237): Update OWNERS file [#70](https://github.com/openshift/route-override-cni/pull/70)
* [Full changelog](https://github.com/openshift/route-override-cni/compare/ce65e37e2571101213bb32643316812df311701b...345809e13769604b88431f4a226c56c7227cadce)
### [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni/tree/6a6381d869e964d741a551fd869644b0364c5b26)
* [CORENET-7230](https://issues.redhat.com/browse/CORENET-7230): Update OWNERS file [#414](https://github.com/openshift/whereabouts-cni/pull/414)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#430](https://github.com/openshift/whereabouts-cni/pull/430)
* [Full changelog](https://github.com/openshift/whereabouts-cni/compare/40982ea3951b3713e3bb3e1bb75657a325499c54...6a6381d869e964d741a551fd869644b0364c5b26)
### [must-gather](https://github.com/openshift/must-gather/tree/e2487964fe989e4147fc02cede01ea0bc8a6be7c)
* [OCPBUGS-122049](https://issues.redhat.com/browse/OCPBUGS-122049): gather_ppc: collect per-node ethtool channel data [#562](https://github.com/openshift/must-gather/pull/562)
* [Full changelog](https://github.com/openshift/must-gather/compare/521d3451f4918c2bd058bde62d642d9b227a5d65...e2487964fe989e4147fc02cede01ea0bc8a6be7c)
### [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon/tree/f2abba74f88bff66660ab1baa0a7e105ede1f399)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#158](https://github.com/openshift/network-metrics-daemon/pull/158)
* [Full changelog](https://github.com/openshift/network-metrics-daemon/compare/e8830cdeabf085090c13ee68cd19a81ef6fd2adf...f2abba74f88bff66660ab1baa0a7e105ede1f399)
### [network-tools](https://github.com/openshift/network-tools/tree/47d3d41a66947a012fbe6370b91470f7b19ae8bf)
* [CORENET-7641](https://issues.redhat.com/browse/CORENET-7641), [CORENET-7647](https://issues.redhat.com/browse/CORENET-7647): Add AGENTS.md and coderabbit config [#192](https://github.com/openshift/network-tools/pull/192)
* [Full changelog](https://github.com/openshift/network-tools/compare/03ae0e816cbf7608e6a326ac71a0a00619941e08...47d3d41a66947a012fbe6370b91470f7b19ae8bf)
### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/f693d575801277e20df82e29cf422e979e984c66)
* [OCPNETUI-138](https://issues.redhat.com/browse/OCPNETUI-138): Add Cypress E2E tests for topology resource details drawer [#664](https://github.com/openshift/networking-console-plugin/pull/664)
* [OCPNETUI-18](https://issues.redhat.com/browse/OCPNETUI-18): Add Cypress E2E tests for topology CUDN/UDN nodes [#656](https://github.com/openshift/networking-console-plugin/pull/656)
* [OCPNETUI-31](https://issues.redhat.com/browse/OCPNETUI-31): Add Cypress E2E tests for topology NAD nodes [#655](https://github.com/openshift/networking-console-plugin/pull/655)
* [OCPNETUI-56](https://issues.redhat.com/browse/OCPNETUI-56): Split hot-cluster-e2e-run.yml into composite actions [#581](https://github.com/openshift/networking-console-plugin/pull/581)
* [OCPBUGS-132373](https://issues.redhat.com/browse/OCPBUGS-132373): Removed clearing of spec.selector/ports on switch to ExternalName service type [#641](https://github.com/openshift/networking-console-plugin/pull/641)
* [OCPNETUI-168](https://issues.redhat.com/browse/OCPNETUI-168): Update Owners file [#644](https://github.com/openshift/networking-console-plugin/pull/644)
* [OCPNETUI-115](https://issues.redhat.com/browse/OCPNETUI-115): Topology toolbar view [#643](https://github.com/openshift/networking-console-plugin/pull/643)
* [OCPNETUI-114](https://issues.redhat.com/browse/OCPNETUI-114): Add network topology view [#561](https://github.com/openshift/networking-console-plugin/pull/561)
* [OCPNETUI-56](https://issues.redhat.com/browse/OCPNETUI-56): Add custom ARC runner image with pre-installed tools [#580](https://github.com/openshift/networking-console-plugin/pull/580)
* [OCPNETUI-136](https://issues.redhat.com/browse/OCPNETUI-136): E2E tests for the topology node view [#631](https://github.com/openshift/networking-console-plugin/pull/631)
* maintenance: bump the npm group with 32 updates [#635](https://github.com/openshift/networking-console-plugin/pull/635)
* [OCPNETUI-178](https://issues.redhat.com/browse/OCPNETUI-178): migrate to @kubevirt-ui-ext/kubevirt-api [#626](https://github.com/openshift/networking-console-plugin/pull/626)
* [OCPNETUI-137](https://issues.redhat.com/browse/OCPNETUI-137): E2E tests for the topology view toolbar [#632](https://github.com/openshift/networking-console-plugin/pull/632)
* [OCPNETUI-56](https://issues.redhat.com/browse/OCPNETUI-56): Hot-cluster CI infrastructure and test fixes [#522](https://github.com/openshift/networking-console-plugin/pull/522)
* maintenance: bump the npm group with 33 updates [#619](https://github.com/openshift/networking-console-plugin/pull/619)
* maintenance: bump cypress-io/github-action from 6 to 7 in the github-actions group [#608](https://github.com/openshift/networking-console-plugin/pull/608)
* [OCPNETUI-80](https://issues.redhat.com/browse/OCPNETUI-80): Migrate to eslint v9 [#488](https://github.com/openshift/networking-console-plugin/pull/488)
* maintenance: bump the npm group with 20 updates [#598](https://github.com/openshift/networking-console-plugin/pull/598)
* [OCPNETUI-140](https://issues.redhat.com/browse/OCPNETUI-140): dependency cleanup [#589](https://github.com/openshift/networking-console-plugin/pull/589)
* [OCPNETUI-140](https://issues.redhat.com/browse/OCPNETUI-140): reassign dev and prod dependencies [#582](https://github.com/openshift/networking-console-plugin/pull/582)
* [OCPNETUI-56](https://issues.redhat.com/browse/OCPNETUI-56): Add hot-cluster E2E workflows, composite actions, and Dockerfile.ci [#497](https://github.com/openshift/networking-console-plugin/pull/497)
* [OCPBUGS-105361](https://issues.redhat.com/browse/OCPBUGS-105361): Create UDN modal now supports secondary UDN creation [#579](https://github.com/openshift/networking-console-plugin/pull/579)
* maintenance: bump the npm group with 26 updates [#575](https://github.com/openshift/networking-console-plugin/pull/575)
* [OCPBUGS-98590](https://issues.redhat.com/browse/OCPBUGS-98590): Added validation to NAD creation pages [#553](https://github.com/openshift/networking-console-plugin/pull/553)
* maintenance: bump the npm group across 1 directory with 17 updates [#563](https://github.com/openshift/networking-console-plugin/pull/563)
* [OCPNETUI-140](https://issues.redhat.com/browse/OCPNETUI-140): Align shared modules with Console [#546](https://github.com/openshift/networking-console-plugin/pull/546)
* [OCPNETUI-140](https://issues.redhat.com/browse/OCPNETUI-140): Extend dependabot ignore list [#545](https://github.com/openshift/networking-console-plugin/pull/545)
* maintenance: bump the npm group across 1 directory with 201 updates [#544](https://github.com/openshift/networking-console-plugin/pull/544)
* maintenance: bump the npm-security group across 1 directory with 10 updates [#521](https://github.com/openshift/networking-console-plugin/pull/521)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/943fc215c1b8dfb4c5a8c5645dbe94cad6402126...f693d575801277e20df82e29cf422e979e984c66)
### [oauth-apiserver](https://github.com/openshift/oauth-apiserver/tree/d059f0e86a0a8370414c45d8af10dcd1f9134b0a)
* [CNTRLPLANE-4583](https://issues.redhat.com/browse/CNTRLPLANE-4583): K8s 1.37 rebase [#239](https://github.com/openshift/oauth-apiserver/pull/239)
* [Full changelog](https://github.com/openshift/oauth-apiserver/compare/dd82b4a7e06ef4c0ad5abc2a7fbbb2882d765b41...d059f0e86a0a8370414c45d8af10dcd1f9134b0a)
### [oauth-proxy](https://github.com/openshift/oauth-proxy/tree/2c9e613ae807baecb5bbeeb47b567b2e6c47a088)
* NO-JIRA: watcher: fix undying goroutine [#378](https://github.com/openshift/oauth-proxy/pull/378)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#377](https://github.com/openshift/oauth-proxy/pull/377)
* [Full changelog](https://github.com/openshift/oauth-proxy/compare/fa3b694f10331ec3ffd8c6c20b7933cb8ded0111...2c9e613ae807baecb5bbeeb47b567b2e6c47a088)
### [oauth-server](https://github.com/openshift/oauth-server/tree/c7275e7430212511532b678d69f53add19d2708b)
* [CNTRLPLANE-4583](https://issues.redhat.com/browse/CNTRLPLANE-4583): K8s 1.37 rebase [#290](https://github.com/openshift/oauth-server/pull/290)
* [OCPBUGS-130780](https://issues.redhat.com/browse/OCPBUGS-130780): Remove ancient deprecated header [#196](https://github.com/openshift/oauth-server/pull/196)
* [OCPBUGS-122888](https://issues.redhat.com/browse/OCPBUGS-122888): Add high contrast support to oauth templates [#262](https://github.com/openshift/oauth-server/pull/262)
* [Full changelog](https://github.com/openshift/oauth-server/compare/5d2515f56de6fab67875c72bc98fad6a43100a16...c7275e7430212511532b678d69f53add19d2708b)
### [olm-catalogd, olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller/tree/505480fd1df54cd7408fb7c03d0c78e15300b671)
* [OPRUN-4826](https://issues.redhat.com/browse/OPRUN-4826): Update OLMv1 test extension to Kubernetes 1.37 [#841](https://github.com/openshift/operator-framework-operator-controller/pull/841)
* [OPRUN-4825](https://issues.redhat.com/browse/OPRUN-4825): Update default-catalog-consistency to Kubernetes 1.37 [#840](https://github.com/openshift/operator-framework-operator-controller/pull/840)
* [OPRUN-4791](https://issues.redhat.com/browse/OPRUN-4791): Synchronize From Upstream Repositories [#838](https://github.com/openshift/operator-framework-operator-controller/pull/838)
* NO-ISSUE: Synchronize From Upstream Repositories [#832](https://github.com/openshift/operator-framework-operator-controller/pull/832)
* NO-ISSUE: Remove NewOLMOwnSingleNamespace OTE tests [#833](https://github.com/openshift/operator-framework-operator-controller/pull/833)
* [OPRUN-4802](https://issues.redhat.com/browse/OPRUN-4802): Synchronize From Upstream Repositories [#836](https://github.com/openshift/operator-framework-operator-controller/pull/836)
* NO-ISSUE: Synchronize From Upstream Repositories [#831](https://github.com/openshift/operator-framework-operator-controller/pull/831)
* [OPRUN-4786](https://issues.redhat.com/browse/OPRUN-4786), [OPRUN-4793](https://issues.redhat.com/browse/OPRUN-4793): Synchronize From Upstream Repositories [#830](https://github.com/openshift/operator-framework-operator-controller/pull/830)
* NO-ISSUE: Synchronize From Upstream Repositories [#829](https://github.com/openshift/operator-framework-operator-controller/pull/829)
* NO-ISSUE: Synchronize From Upstream Repositories [#828](https://github.com/openshift/operator-framework-operator-controller/pull/828)
* NO-ISSUE: Synchronize From Upstream Repositories [#826](https://github.com/openshift/operator-framework-operator-controller/pull/826)
* NO-ISSUE: Synchronize From Upstream Repositories [#823](https://github.com/openshift/operator-framework-operator-controller/pull/823)
* NO-ISSUE: Pin controller-runtime to v0.24.1 in tests-extension [#821](https://github.com/openshift/operator-framework-operator-controller/pull/821)
* [OCPBUGS-97746](https://issues.redhat.com/browse/OCPBUGS-97746), [OPRUN-4738](https://issues.redhat.com/browse/OPRUN-4738), [OPRUN-4774](https://issues.redhat.com/browse/OPRUN-4774), [OPRUN-4775](https://issues.redhat.com/browse/OPRUN-4775): Synchronize From Upstream Repositories [#819](https://github.com/openshift/operator-framework-operator-controller/pull/819)
* ocpbugs-115274: fix webhook finalizer flake [#798](https://github.com/openshift/operator-framework-operator-controller/pull/798)
* [OCPBUGS-121303](https://issues.redhat.com/browse/OCPBUGS-121303), [OCPBUGS-121304](https://issues.redhat.com/browse/OCPBUGS-121304): Bump go-git to v5.19.2 [#810](https://github.com/openshift/operator-framework-operator-controller/pull/810)
* [OPRUN-4723](https://issues.redhat.com/browse/OPRUN-4723): Synchronize From Upstream Repositories [#811](https://github.com/openshift/operator-framework-operator-controller/pull/811)
* [Full changelog](https://github.com/openshift/operator-framework-operator-controller/compare/0c85f963ea84d2eba058c4217921ac51e9643093...505480fd1df54cd7408fb7c03d0c78e15300b671)
### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/2926454df7613f5addfff9c8b274337c014a513b)
* [CNTRLPLANE-4583](https://issues.redhat.com/browse/CNTRLPLANE-4583): K8s 1.37 rebase [#692](https://github.com/openshift/openshift-apiserver/pull/692)
* NO-JIRA: route: Use Network Ingress DNS owner aliases [#690](https://github.com/openshift/openshift-apiserver/pull/690)
* [OCPBUGS-108032](https://issues.redhat.com/browse/OCPBUGS-108032): update otel to 1.44.0 to fix CVE-2026-41178 [#684](https://github.com/openshift/openshift-apiserver/pull/684)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/ab0315228cde432c8cd62df012b791a66a72c7b3...2926454df7613f5addfff9c8b274337c014a513b)
### [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager/tree/72964318318f2a65e66b766a288b2241e6a6c51e)
* [CNTRLPLANE-4583](https://issues.redhat.com/browse/CNTRLPLANE-4583): bump(k8s.io): 1.37.1 [#462](https://github.com/openshift/openshift-controller-manager/pull/462)
* [Full changelog](https://github.com/openshift/openshift-controller-manager/compare/5235418de7c86e6fae1004f84e55a2fbc1d3ac1c...72964318318f2a65e66b766a288b2241e6a6c51e)
### [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics/tree/de9762d4058aab05b91e413dc0f700ff9f02431e)
* NO-JIRA: update OWNERS [#140](https://github.com/openshift/openshift-state-metrics/pull/140)
* [Full changelog](https://github.com/openshift/openshift-state-metrics/compare/5322ac5a46da4c11c310dc13ae41e6f80045379e...de9762d4058aab05b91e413dc0f700ff9f02431e)
### [openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/049e93b693fd5ea7cbcddade0d4361f6d5125c0b)
* [OSASINFRA-4483](https://issues.redhat.com/browse/OSASINFRA-4483): UPSTREAM: <carry>: Initial Dockerfile for osbrick-sidecar [#447](https://github.com/openshift/cloud-provider-openstack/pull/447)
* UPSTREAM-SYNC: Sync main with latest upstream (release-1.37) [#446](https://github.com/openshift/cloud-provider-openstack/pull/446)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/fb1be731410a5d4eb6b3a3692c9081856df72c10...049e93b693fd5ea7cbcddade0d4361f6d5125c0b)
### [openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/206342b1bbd2d7b017a06f4a03dc679ca2c47c2c)
* [STOR-3210](https://issues.redhat.com/browse/STOR-3210): Enable Online Expansion tests for Azure Disk [#650](https://github.com/openshift/csi-operator/pull/650)
* [STOR-3173](https://issues.redhat.com/browse/STOR-3173): Configure TLS groups for OLM-managed operators [#654](https://github.com/openshift/csi-operator/pull/654)
* [STOR-3176](https://issues.redhat.com/browse/STOR-3176): Support TLS Groups in operators for kube-rbac-proxy sidecar [#651](https://github.com/openshift/csi-operator/pull/651)
* [STOR-3068](https://issues.redhat.com/browse/STOR-3068): Bump all libraries [#646](https://github.com/openshift/csi-operator/pull/646)
* [OCPBUGS-120762](https://issues.redhat.com/browse/OCPBUGS-120762): restrict azure-file secrets ClusterRole to get and create verbs [#639](https://github.com/openshift/csi-operator/pull/639)
* [STOR-3141](https://issues.redhat.com/browse/STOR-3141), [STOR-3142](https://issues.redhat.com/browse/STOR-3142): EFS, Samba: Ship Network Policies in the operator bundle [#629](https://github.com/openshift/csi-operator/pull/629)
* [OCPBUGS-127462](https://issues.redhat.com/browse/OCPBUGS-127462): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#638](https://github.com/openshift/csi-operator/pull/638)
* [OCPBUGS-88301](https://issues.redhat.com/browse/OCPBUGS-88301): Remove redundant delete role verb [#620](https://github.com/openshift/csi-operator/pull/620)
* [OCPBUGS-113538](https://issues.redhat.com/browse/OCPBUGS-113538): Enable SELinuxMount tests [#605](https://github.com/openshift/csi-operator/pull/605)
* [Full changelog](https://github.com/openshift/csi-operator/compare/773340ccc6a7dc3657fe222c7ebd2fcc19adcd56...206342b1bbd2d7b017a06f4a03dc679ca2c47c2c)
### [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack/tree/b6b2c8393370dccb3549cd7485faac290045e258)
* Bump manifests-gen for proxy injection annotation [#452](https://github.com/openshift/cluster-api-provider-openstack/pull/452)
* [OCPBUGS-131040](https://issues.redhat.com/browse/OCPBUGS-131040): Replace golang.org/x/net with openshift-sustaining/net v0.50.0-sec.4 for CVE-2026-33814 [main] [#451](https://github.com/openshift/cluster-api-provider-openstack/pull/451)
* UPSTREAM-SYNC: Re-baseline main onto clean upstream merge to unblock rebasebot [#446](https://github.com/openshift/cluster-api-provider-openstack/pull/446)
* [Full changelog](https://github.com/openshift/cluster-api-provider-openstack/compare/eaa0992898ac0984f25d2fced6b69a1f8db54c7d...b6b2c8393370dccb3549cd7485faac290045e258)
### [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack/tree/58a615b1517504c85786ee08163625bcd6a39a22)
* [OSASINFRA-4544](https://issues.redhat.com/browse/OSASINFRA-4544): Bump CAPO to 0.15 and adopt CAPO API v1beta2 [#193](https://github.com/openshift/machine-api-provider-openstack/pull/193)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#187](https://github.com/openshift/machine-api-provider-openstack/pull/187)
* [Full changelog](https://github.com/openshift/machine-api-provider-openstack/compare/6b30092b0a1196b016f4300b79c895f0e7f2e9a8...58a615b1517504c85786ee08163625bcd6a39a22)
### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/6726ed5dc88b02262fca4a2242387df51d6da18b)
* [OPRUN-4828](https://issues.redhat.com/browse/OPRUN-4828): Update OLMv0 test extension to Kubernetes 1.37 [#1397](https://github.com/openshift/operator-framework-olm/pull/1397)
* NO-ISSUE: Synchronize From Upstream Repositories [#1398](https://github.com/openshift/operator-framework-olm/pull/1398)
* [OPRUN-4798](https://issues.redhat.com/browse/OPRUN-4798): synchronize OLMv0 TLS curves and update package-server manager [#1394](https://github.com/openshift/operator-framework-olm/pull/1394)
* [OPRUN-4798](https://issues.redhat.com/browse/OPRUN-4798): Synchronize From Upstream Repositories [#1377](https://github.com/openshift/operator-framework-olm/pull/1377)
* [OCPBUGS-126127](https://issues.redhat.com/browse/OCPBUGS-126127): test: bump test extension gRPC to v1.83.2 [#1382](https://github.com/openshift/operator-framework-olm/pull/1382)
* NO-ISSUE: add per-scenario PSA compliance audit [#1374](https://github.com/openshift/operator-framework-olm/pull/1374)
* NO-ISSUE: Synchronize From Upstream Repositories [#1361](https://github.com/openshift/operator-framework-olm/pull/1361)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/031c587813b3542c17ec1e861ec3dc37dacccfec...6726ed5dc88b02262fca4a2242387df51d6da18b)
### [operator-marketplace](https://github.com/operator-framework/operator-marketplace/tree/5a7d0ade6d5fae66fca8b5d376f89037a914b499)
* NO-ISSUE: Bump github.com/onsi/gomega from 1.43.1 to 1.44.0 [#797](https://github.com/operator-framework/operator-marketplace/pull/797)
* NO-ISSUE: Bump github.com/onsi/gomega from 1.43.0 to 1.43.1 [#795](https://github.com/operator-framework/operator-marketplace/pull/795)
* NO-ISSUE: Bump github.com/onsi/ginkgo/v2 from 2.32.2 to 2.33.0 [#796](https://github.com/operator-framework/operator-marketplace/pull/796)
* [Full changelog](https://github.com/operator-framework/operator-marketplace/compare/6f413fbbfad17b2cfdf94d9f5b6f34da5028a763...5a7d0ade6d5fae66fca8b5d376f89037a914b499)
### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/a6dca1bb5cbd5014ca1dccf90fc87c3e438d7e04)
* [CORENET-6748](https://issues.redhat.com/browse/CORENET-6748): OTE: Enable EgressFirewall tests [#3433](https://github.com/openshift/ovn-kubernetes/pull/3433)
* NO-JIRA: DownStream Merge [10-28-2026] [#3581](https://github.com/openshift/ovn-kubernetes/pull/3581)
* [OCPBUGS-127208](https://issues.redhat.com/browse/OCPBUGS-127208): DownStream Merge [10-22-2026] [#3572](https://github.com/openshift/ovn-kubernetes/pull/3572)
* NO-JIRA: Add arkadeepsen, martinkennelly and pperiyasamy to OWNERS file [#3570](https://github.com/openshift/ovn-kubernetes/pull/3570)
* [CORENET-6746](https://issues.redhat.com/browse/CORENET-6746): Enable EgressIP E2E tests on baremetal, AWS, Azure and GCP for OTE [#3227](https://github.com/openshift/ovn-kubernetes/pull/3227)
* [NO-JIRA: DownStream Merge [10-19-2026] [#3561](https://github.com/openshift/ovn-kubernetes/pull/3561)
* [OCPBUGS-120087](https://issues.redhat.com/browse/OCPBUGS-120087), [OCPBUGS-123556](https://issues.redhat.com/browse/OCPBUGS-123556), [OCPBUGS-128278](https://issues.redhat.com/browse/OCPBUGS-128278): DownStream Merge [10-14-2026] [#3543](https://github.com/openshift/ovn-kubernetes/pull/3543)
* [OCPBUGS-128662](https://issues.redhat.com/browse/OCPBUGS-128662): DownStream Merge [10-08-2026] [#3517](https://github.com/openshift/ovn-kubernetes/pull/3517)
* NO-JIRA: DownStream Merge [09-28-2026] [#3479](https://github.com/openshift/ovn-kubernetes/pull/3479)
* [CORENET-7596](https://issues.redhat.com/browse/CORENET-7596), [OCPBUGS-123678](https://issues.redhat.com/browse/OCPBUGS-123678): DownStream Merge [09-23-2026] [#3473](https://github.com/openshift/ovn-kubernetes/pull/3473)
* [CORENET-7572](https://issues.redhat.com/browse/CORENET-7572): DownStream Merge [09-21-2026] [#3465](https://github.com/openshift/ovn-kubernetes/pull/3465)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/dc48a3f1faa7ad835c3e412611452d2385f0dd90...a6dca1bb5cbd5014ca1dccf90fc87c3e438d7e04)
### [prom-label-proxy](https://github.com/openshift/prom-label-proxy/tree/769aeb6a1dda2d71c5e91ea6cbb8d5f510821135)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#401](https://github.com/openshift/prom-label-proxy/pull/401)
* [Full changelog](https://github.com/openshift/prom-label-proxy/compare/23e6f4a0c6b58930e7509fd063d7924025a69594...769aeb6a1dda2d71c5e91ea6cbb8d5f510821135)
### [prometheus](https://github.com/openshift/prometheus/tree/5ee7c34ddf532bacdac39ced4c61a54ab1e2cd66)
* NO-ISSUE: [bot] Bump openshift/prometheus to v3.15.1 [#405](https://github.com/openshift/prometheus/pull/405)
* NO-ISSUE: [bot] Bump openshift/prometheus to v3.15.0 [#399](https://github.com/openshift/prometheus/pull/399)
* NO-JIRA: update OWNERS [#379](https://github.com/openshift/prometheus/pull/379)
* [Full changelog](https://github.com/openshift/prometheus/compare/c2c48fe1a4c9d2c0b6bc9f1fa9a41d669eac35f4...5ee7c34ddf532bacdac39ced4c61a54ab1e2cd66)
### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/f126069d12d76009293a0e1668a5c00425d5d926)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#186](https://github.com/openshift/prometheus-alertmanager/pull/186)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#175](https://github.com/openshift/prometheus-alertmanager/pull/175)
* [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/6636dd048c835df8496f7e8fc878a0983bce0d9f...f126069d12d76009293a0e1668a5c00425d5d926)
### [prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator/tree/db2005715d9dda659f69d5dabf244c9a529d7734)
* NO-ISSUE: [bot] Bump openshift/prometheus-operator to v0.94.2 [#423](https://github.com/openshift/prometheus-operator/pull/423)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#405](https://github.com/openshift/prometheus-operator/pull/405)
* [MON-4696](https://issues.redhat.com/browse/MON-4696): Bump openshift/prometheus-operator to v0.94.1 [#403](https://github.com/openshift/prometheus-operator/pull/403)
* [Full changelog](https://github.com/openshift/prometheus-operator/compare/64fea598a4ac46a0976ecb75bfe5dbef01416630...db2005715d9dda659f69d5dabf244c9a529d7734)
### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/41a2ce965e42357f5d1cd71f34498c19eb99932f)
* [OCPBUGS-129592](https://issues.redhat.com/browse/OCPBUGS-129592): Test mountinfo parsing beyond 1 MiB [#217](https://github.com/openshift/node_exporter/pull/217)
* NO-JIRA: Update OWNERS [#199](https://github.com/openshift/node_exporter/pull/199)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#189](https://github.com/openshift/node_exporter/pull/189)
* [Full changelog](https://github.com/openshift/node_exporter/compare/df6c312185d3c8f2fbd7f6f66dc410165bb65682...41a2ce965e42357f5d1cd71f34498c19eb99932f)
### [rhel-coreos, rhel-coreos-10, rhel-coreos-10-extensions](https://github.com/openshift/os/tree/286a9a3722a2544db7e4af7b7f85392c4bc53cf1)
* [COS-4569](https://issues.redhat.com/browse/COS-4569): Add off-layering directory for Nvidia builds [#1979](https://github.com/openshift/os/pull/1979)
* [OCPBUGS-123732](https://issues.redhat.com/browse/OCPBUGS-123732): Re-enable sandboxed-containers extension for 5.0 [#1971](https://github.com/openshift/os/pull/1971)
* NO-JIRA: Update to track 5.1 [#1964](https://github.com/openshift/os/pull/1964)
* [Full changelog](https://github.com/openshift/os/compare/7324ccd30e5b2b3146639cb610bfe92c743c91a1...286a9a3722a2544db7e4af7b7f85392c4bc53cf1)
### [rhel-coreos-extensions](https://github.com/openshift/os/tree/62965e8043270be3ae4b4568f6f6475ed1804973)
* [OCPBUGS-123732](https://issues.redhat.com/browse/OCPBUGS-123732): Re-enable sandboxed-containers extension for 5.0 [#1971](https://github.com/openshift/os/pull/1971)
* NO-JIRA: Update to track 5.1 [#1964](https://github.com/openshift/os/pull/1964)
* [Full changelog](https://github.com/openshift/os/compare/7324ccd30e5b2b3146639cb610bfe92c743c91a1...62965e8043270be3ae4b4568f6f6475ed1804973)
### [telemeter](https://github.com/openshift/telemeter/tree/c1db3dc4233dc50dded21357182390188e0fc78e)
* NO-JIRA: split rule tests by recording rule [#630](https://github.com/openshift/telemeter/pull/630)
* NO-JIRA: format Telemeter rule expressions [#628](https://github.com/openshift/telemeter/pull/628)
* NO-ISSUE: tidy up tools/go.mod [#617](https://github.com/openshift/telemeter/pull/617)
* [OCPBUGS-122075](https://issues.redhat.com/browse/OCPBUGS-122075): don't log authorization header [#614](https://github.com/openshift/telemeter/pull/614)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#622](https://github.com/openshift/telemeter/pull/622)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Remove generated Telemeter tools vendor tree [#618](https://github.com/openshift/telemeter/pull/618)
* [Full changelog](https://github.com/openshift/telemeter/compare/562e12c31ded836d7891a3b3138ad604070b9c5a...c1db3dc4233dc50dded21357182390188e0fc78e)
### [tests](https://github.com/openshift/origin/tree/895e3d93a081321bd4adbecb3c2c0ec65b8c1cca)
* NO-ISSUE: Automated - Update synthetic test data [#31828](https://github.com/openshift/origin/pull/31828)
* [TRT-3011](https://issues.redhat.com/browse/TRT-3011): Wait for OAuth server rollouts in component proxy tests [#31779](https://github.com/openshift/origin/pull/31779)
* [OCPBUGS-119673](https://issues.redhat.com/browse/OCPBUGS-119673), [OCPEDGE-2819](https://issues.redhat.com/browse/OCPEDGE-2819): Update TNF credential rotation test [#31611](https://github.com/openshift/origin/pull/31611)
* [OCPCLOUD-3330](https://issues.redhat.com/browse/OCPCLOUD-3330): Create test/shared module initially containing reusable fake cincinnati server [#31804](https://github.com/openshift/origin/pull/31804)
* [CORENET-6512](https://issues.redhat.com/browse/CORENET-6512): Add CNO test extension binary [#31218](https://github.com/openshift/origin/pull/31218)
* [OCPBUGS-133466](https://issues.redhat.com/browse/OCPBUGS-133466): allow DaemonSet SuccessfulCreate pathological events [#31810](https://github.com/openshift/origin/pull/31810)
* [AGENT-1654](https://issues.redhat.com/browse/AGENT-1654): Add IRI deletion test [#31757](https://github.com/openshift/origin/pull/31757)
* NO-JIRA: singleton-placement-collector: collect on single node and two node clusters [#31815](https://github.com/openshift/origin/pull/31815)
* [TRT-3049](https://issues.redhat.com/browse/TRT-3049): Align NetObserv timeout test with CNO status contract [#31814](https://github.com/openshift/origin/pull/31814)
* NO-JIRA: Add ANP/BANP Ready-In-Zone status cleanup e2e [#31593](https://github.com/openshift/origin/pull/31593)
* [NE-2922](https://issues.redhat.com/browse/NE-2922): Migrate operator Ingress management-mode tests to v1 [#31807](https://github.com/openshift/origin/pull/31807)
* [OCPBUGS-82190](https://issues.redhat.com/browse/OCPBUGS-82190): Remove etcd preDrain hook strip workaround from node replacement test [#31149](https://github.com/openshift/origin/pull/31149)
* [CNTRLPLANE-2157](https://issues.redhat.com/browse/CNTRLPLANE-2157): Migrate test cases of KubeAPI server functionality to OTE [#31697](https://github.com/openshift/origin/pull/31697)
* NO-JIRA: Improve etcd-scaling job reliability by removing checks that don't apply to control plane replacement [#31797](https://github.com/openshift/origin/pull/31797)
* [OCPBUGS-131892](https://issues.redhat.com/browse/OCPBUGS-131892): add memory thrashing and CPU saturation intervals [#31766](https://github.com/openshift/origin/pull/31766)
* [OCPNODE-4674](https://issues.redhat.com/browse/OCPNODE-4674): Split node long-running tests into openshift/nodes/isolated [#31586](https://github.com/openshift/origin/pull/31586)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Rebase 1.37 [#31721](https://github.com/openshift/origin/pull/31721)
* [OCPSTRAT-3661](https://issues.redhat.com/browse/OCPSTRAT-3661): Add additional rbac escalation monitortest exceptions [#31802](https://github.com/openshift/origin/pull/31802)
* NO-ISSUE: Automated - Update synthetic test data [#31799](https://github.com/openshift/origin/pull/31799)
* [OCPBUGS-130621](https://issues.redhat.com/browse/OCPBUGS-130621): Isolate LDAP group sync test resources [#31730](https://github.com/openshift/origin/pull/31730)
* [OCPBUGS-132757](https://issues.redhat.com/browse/OCPBUGS-132757): Further optimize oc must gather tests to improve efficiency [#31282](https://github.com/openshift/origin/pull/31282)
* NO-JIRA: Fix CPU partitioning test isolation [#31777](https://github.com/openshift/origin/pull/31777)
* NO-JIRA: add host-network-connection-integrity monitor test [#31785](https://github.com/openshift/origin/pull/31785)
* NO-JIRA: cli: accept both error: invalid/Invalid image name casing in oc run tests [#31791](https://github.com/openshift/origin/pull/31791)
* [OCPBUGS-123644](https://issues.redhat.com/browse/OCPBUGS-123644): Allow etcd probe error due to tls config change [#31789](https://github.com/openshift/origin/pull/31789)
* [OCPBUGS-130780](https://issues.redhat.com/browse/OCPBUGS-130780): stop expecting OAuth X-XSS-Protection header [#31788](https://github.com/openshift/origin/pull/31788)
* [OCPBUGS-126709](https://issues.redhat.com/browse/OCPBUGS-126709): Allow VirtPlatformDependencyMissing alert [#31787](https://github.com/openshift/origin/pull/31787)
* [OCPBUGS-131892](https://issues.redhat.com/browse/OCPBUGS-131892): add singleton-placement-collector monitor test [#31768](https://github.com/openshift/origin/pull/31768)
* NO-JIRA: Support reusable devcontainer setup and optional OpenCode [#31775](https://github.com/openshift/origin/pull/31775)
* [OCPEDGE-3027](https://issues.redhat.com/browse/OCPEDGE-3027): add TNF metrics e2e coverage [#31663](https://github.com/openshift/origin/pull/31663)
* [OCPBUGS-132363](https://issues.redhat.com/browse/OCPBUGS-132363): Allow prometheus test pods to access NTO metrics port [#31781](https://github.com/openshift/origin/pull/31781)
* [TRT-3011](https://issues.redhat.com/browse/TRT-3011): Include noProxy login test in OAuth scaling event exception [#31780](https://github.com/openshift/origin/pull/31780)
* [OCPBUGS-132202](https://issues.redhat.com/browse/OCPBUGS-132202): request only supported IP families in kubevirt VM network data [#31770](https://github.com/openshift/origin/pull/31770)
* [MCO-2626](https://issues.redhat.com/browse/MCO-2626): Remove MCN's node create and delete test [#31771](https://github.com/openshift/origin/pull/31771)
* [CNTRLPLANE-3481](https://issues.redhat.com/browse/CNTRLPLANE-3481): (Testing/Functional) Sourcing claims from multiple sources works as expected [#31712](https://github.com/openshift/origin/pull/31712)
* [NE-2816](https://issues.redhat.com/browse/NE-2816): Apply HAProxy sidecar on router e2e tests [#31589](https://github.com/openshift/origin/pull/31589)
* [OCPBUGS-129429](https://issues.redhat.com/browse/OCPBUGS-129429): Soften PHC offline assertions [#31717](https://github.com/openshift/origin/pull/31717)
* [NETOBSERV-2563](https://issues.redhat.com/browse/NETOBSERV-2563): skip network observability e2e tests in disconnected env [#31767](https://github.com/openshift/origin/pull/31767)
* [TRT-3011](https://issues.redhat.com/browse/TRT-3011): Increase AuthenticationComponentProxy scaling event allowance to 70 [#31754](https://github.com/openshift/origin/pull/31754)
* NO-JIRA: omit skipped tests from high_cpu_e2e_tests autodl data [#31759](https://github.com/openshift/origin/pull/31759)
* [TRT-3020](https://issues.redhat.com/browse/TRT-3020): Report audit request violations as flakes [#31756](https://github.com/openshift/origin/pull/31756)
* NO-JIRA: Remove exception OCPBUGS-85677 [#31734](https://github.com/openshift/origin/pull/31734)
* [OCPQUAL-55](https://issues.redhat.com/browse/OCPQUAL-55): remove static.redhat.com disruption monitor [#31685](https://github.com/openshift/origin/pull/31685)
* [OCPBUGS-129376](https://issues.redhat.com/browse/OCPBUGS-129376): Azure dual-stack load balancers should expose public and internal services over IPv4 and IPv6 [#31716](https://github.com/openshift/origin/pull/31716)
* [OCPNODE-4776](https://issues.redhat.com/browse/OCPNODE-4776): Add Kerberos authentication test plan for OCP 5.1 [#31704](https://github.com/openshift/origin/pull/31704)
* [NETOBSERV-2563](https://issues.redhat.com/browse/NETOBSERV-2563): Add network observability e2e tests [#31342](https://github.com/openshift/origin/pull/31342)
* [OCPEDGE-2985](https://issues.redhat.com/browse/OCPEDGE-2985): Assert PacemakerFencingEvent after real fencing [#31703](https://github.com/openshift/origin/pull/31703)
* [NE-2913](https://issues.redhat.com/browse/NE-2913): Update deprecated HAProxy versions in upgrade test [#31701](https://github.com/openshift/origin/pull/31701)
* [OCPBUGS-130621](https://issues.redhat.com/browse/OCPBUGS-130621): Clean up component proxy login resources [#31729](https://github.com/openshift/origin/pull/31729)
* [OCPBUGS-86789](https://issues.redhat.com/browse/OCPBUGS-86789): Revert "Make early request monitor test informing" [#31590](https://github.com/openshift/origin/pull/31590)
* [OCPBUGS-86789](https://issues.redhat.com/browse/OCPBUGS-86789): Move external ip policy test to disruptive-longrunning [#31638](https://github.com/openshift/origin/pull/31638)
* NO-ISSUE: Automated - Update synthetic test data [#31698](https://github.com/openshift/origin/pull/31698)
* [OCPBUGS-123649](https://issues.redhat.com/browse/OCPBUGS-123649): allow v1beta2 DRA API in discovery test [#31566](https://github.com/openshift/origin/pull/31566)
* [OCPBUGS-129615](https://issues.redhat.com/browse/OCPBUGS-129615): Allow Prometheus auth test to reach console metrics [#31723](https://github.com/openshift/origin/pull/31723)
* NO-JIRA: Document shrink-only retry allowlist policy [#31710](https://github.com/openshift/origin/pull/31710)
* [OCPBUGS-129175](https://issues.redhat.com/browse/OCPBUGS-129175): Handle offline or removed nodes in TNF replacement test [#31708](https://github.com/openshift/origin/pull/31708)
* NO-JIRA: Add cluster-machine-approver OTE suite [#31706](https://github.com/openshift/origin/pull/31706)
* [OCPBUGS-129012](https://issues.redhat.com/browse/OCPBUGS-129012): Parallel SSA ClusterOperator test races with sig-arch operator version check [#31699](https://github.com/openshift/origin/pull/31699)
* NO-ISSUE: Revert "Add CustomResourcePublishOpenAPI conformance test to retry allowlist" [#31694](https://github.com/openshift/origin/pull/31694)
* [OCPQUAL-42](https://issues.redhat.com/browse/OCPQUAL-42): Refresh retry allowlist against 5.0 and 5.1 CI data [#31551](https://github.com/openshift/origin/pull/31551)
* [CNTRLPLANE-3483](https://issues.redhat.com/browse/CNTRLPLANE-3483): Add e2e test Hot reloading changes of the external OIDC configuration [#31678](https://github.com/openshift/origin/pull/31678)
* [OCPBUGS-122386](https://issues.redhat.com/browse/OCPBUGS-122386): e2e-analysis: add --skip-readiness-checks flag for degraded cluster lanes [#31635](https://github.com/openshift/origin/pull/31635)
* NO-ISSUE: Automated - Update synthetic test data [#31682](https://github.com/openshift/origin/pull/31682)
* [OCPSTRAT-3618](https://issues.redhat.com/browse/OCPSTRAT-3618): Mirror glibc-dns-testing 2.0.0 for the k8s 1.37 rebase(revert in rebase PR) [#31683](https://github.com/openshift/origin/pull/31683)
* [INTEROP-9204](https://issues.redhat.com/browse/INTEROP-9204): Add --extension-local-binaries flag for local extension binary loading [#31652](https://github.com/openshift/origin/pull/31652)
* trt-2972: use matcher details [#31676](https://github.com/openshift/origin/pull/31676)
* [OCPBUGS-128397](https://issues.redhat.com/browse/OCPBUGS-128397): Skip router verbosity rollout for degraded TNF tests [#31680](https://github.com/openshift/origin/pull/31680)
* [OPCT-460](https://issues.redhat.com/browse/OPCT-460): Increase timeout for external IP policy test to accommodate in-cluster rollouts [#31636](https://github.com/openshift/origin/pull/31636)
* NO-JIRA: Up threshold for mass dns disruption to fail a test based on real world observations [#31674](https://github.com/openshift/origin/pull/31674)
* [CNTRLPLANE-3851](https://issues.redhat.com/browse/CNTRLPLANE-3851): Oauth server proxy config e2e [#31463](https://github.com/openshift/origin/pull/31463)
* [CNTRLPLANE-3474](https://issues.redhat.com/browse/CNTRLPLANE-3474): Add tests for external claims source featuregate [#31591](https://github.com/openshift/origin/pull/31591)
* [OCPBUGS-127184](https://issues.redhat.com/browse/OCPBUGS-127184): Redact OAuth tokens from test cleanup logs [#31640](https://github.com/openshift/origin/pull/31640)
* [STOR-3090](https://issues.redhat.com/browse/STOR-3090): Add CSI storage test for pod delete after host umount of mounted volume [#31488](https://github.com/openshift/origin/pull/31488)
* [OCPBUGS-111056](https://issues.redhat.com/browse/OCPBUGS-111056): Make operator log scraper and monitor tests topology-aware [#31597](https://github.com/openshift/origin/pull/31597)
* [CNTRLPLANE-4303](https://issues.redhat.com/browse/CNTRLPLANE-4303): Add threshold for ote encryption cases [#31658](https://github.com/openshift/origin/pull/31658)
* And 3 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/origin/compare/3c85f767a0988a90bba4cc7ebaff609331c4c7ea...895e3d93a081321bd4adbecb3c2c0ec65b8c1cca)
### [thanos](https://github.com/openshift/thanos/tree/f751e5877230a36bd9d44132aa2b9864b5e12e40)
* NO-JIRA: [bot] Bump openshift/thanos to v0.42.5 [#233](https://github.com/openshift/thanos/pull/233)
* [OCPBUGS-129064](https://issues.redhat.com/browse/OCPBUGS-129064): Bump github.com/klauspost/compress to fix CVE-2026-63209 [#227](https://github.com/openshift/thanos/pull/227)
* NO-JIRA: synchronize OWNERS from cluster-monitoring-operator [#215](https://github.com/openshift/thanos/pull/215)
* Bump openshift/thanos to v0.42.4 [#203](https://github.com/openshift/thanos/pull/203)
* [OCPBUGS-114428](https://issues.redhat.com/browse/OCPBUGS-114428): Bump google.golang.org/protobuf to v1.36.12 [#206](https://github.com/openshift/thanos/pull/206)
* [Full changelog](https://github.com/openshift/thanos/compare/6caa7c9cad471582053356a0854cc86b152546fb...f751e5877230a36bd9d44132aa2b9864b5e12e40)
### [volume-data-source-validator](https://github.com/openshift/volume-data-source-validator/tree/3ac9e351c97a083eb89ae3f8d695df0af138efc0)
* [STOR-3071](https://issues.redhat.com/browse/STOR-3071): Rebase to v1.8.0 for OCP 5.1 [#22](https://github.com/openshift/volume-data-source-validator/pull/22)
* NO-JIRA: Add coderabbit config [#23](https://github.com/openshift/volume-data-source-validator/pull/23)
* [Full changelog](https://github.com/openshift/volume-data-source-validator/compare/845636b46d1c4fb1f30fcf5332276573aafeee19...3ac9e351c97a083eb89ae3f8d695df0af138efc0)