# 5.0.0-okd-scos.2

Created: 2026-10-13 17:12:51 +0000 UTC

Image Digest: `sha256:3c208aa73b9346119d44023155f94300fb33198c6d40c16c8eb5b04a355b042f`

Promoted from registry.ci.openshift.org/origin/release-scos:5.0.0-0.okd-scos-nightly-2026-10-13-071739


## Changes from 5.0.0-okd-scos.0

### Components

* Kubectl 1.36.2
* Kubernetes upgraded from 1.36.3 to 1.36.5
* Kubernetes Tests 1.36.2
* CentOS Stream CoreOS 10 10.0.20260819-0



### FeatureGate Changes
| FeatureGate | Default<br/>Hypershift | Default<br/>SelfManagedHA | DevPreviewNoUpgrade<br/>Hypershift | DevPreviewNoUpgrade<br/>SelfManagedHA | OKD<br/>Hypershift | OKD<br/>SelfManagedHA | TechPreviewNoUpgrade<br/>Hypershift | TechPreviewNoUpgrade<br/>SelfManagedHA  |
| :------ | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---:  |
| OLMLifecycleAndCompatibility <br/> (0 tests)| Disabled| Disabled<br/>(Changed)| Disabled| Disabled<br/>(Changed)| Disabled| Enabled| Disabled| Disabled<br/>(Changed) |
| DRADeviceTaintRules <br/> (0 tests)|  |  |  |  |  |  |  |   |


### Rebuilt images without code change

* [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy) git [d6ec9243](https://github.com/openshift/apiserver-network-proxy/commit/d6ec9243d24050d7d7ad7f939e45f821171f000e) `sha256:cbe632223aabe04e0fc7105211dee245b2d00c823a9b953fa6cc10e7dd822769`
* [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws) git [278e8c07](https://github.com/openshift/cloud-provider-aws/commit/278e8c07a72a50e7d3f28fc743c38c64f008f5aa) `sha256:d40a49eec3eabf72d268222b097ee54bace141c344f89151c7095cc14b1fe018`
* [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider) git [9b18930d](https://github.com/openshift/aws-encryption-provider/commit/9b18930d2db9521a08faa7165488bdcf6482b9cf) `sha256:c5586e983e6b6ba78fb6f2b98c1fdd5069da77afe311085adcfca8d3bfa4fb41`
* [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook) git [0d33a459](https://github.com/openshift/aws-pod-identity-webhook/commit/0d33a4596e2a22d188fe74c4a6497c37c2528c1f) `sha256:ffaef930003e2144c7969eef3fc38982f917a225b84dc4007ee006561a50b4ba`
* [azure-cloud-controller-manager](https://github.com/openshift/cloud-provider-azure) git [95f0a12c](https://github.com/openshift/cloud-provider-azure/commit/95f0a12ce3f7f3770d099d3610a376f06cc713df) `sha256:3b04ba2ca0914d006043ed0b09fab09c2c95d8408e6e927b3d3501b0d0034685`
* [azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure) git [95f0a12c](https://github.com/openshift/cloud-provider-azure/commit/95f0a12ce3f7f3770d099d3610a376f06cc713df) `sha256:6ec21abb748319a5ddbc552621b5547a08361864525bf05dbe38d07e76bfcbad`
* [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver) git [64091ea1](https://github.com/openshift/azure-disk-csi-driver/commit/64091ea10ac93fd62b83c63b4b7379063aca9058) `sha256:5a326117f0442e320a8c2e0106e73aae8ddff82383e1d999659ae9d88ecdd6ea`
* [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure) git [4ff6c6b8](https://github.com/openshift/machine-api-provider-azure/commit/4ff6c6b8730c1253918f1f5261b9c12cab2e5903) `sha256:4f982bc1affc8d62123345a9908c9ab2658525bbc25ba29925cdf14ba29aa0f4`
* [baremetal-operator](https://github.com/openshift/baremetal-operator) git [34bbeb37](https://github.com/openshift/baremetal-operator/commit/34bbeb376836bf01793d4e70d29065d619ebcaa1) `sha256:c9bce047a07539eaf3478bd34e5f09dd29f94e5d7060594b4280d9abb2d3c15d`
* [cli](https://github.com/openshift/oc) git [4b0a124d](https://github.com/openshift/oc/commit/4b0a124d300cef187037bda6f1b04caa69ab8b62) `sha256:25e8f93177ab315f6830458ec0c63618e79f565cba154de51850ce2f87582eb4`
* [cli-artifacts](https://github.com/openshift/oc) git [4b0a124d](https://github.com/openshift/oc/commit/4b0a124d300cef187037bda6f1b04caa69ab8b62) `sha256:19f7d377026207b545a1044837e759af05ad9bbb546c3c394f90b2bb02b5fb6d`
* [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator) git [b187feee](https://github.com/openshift/cloud-credential-operator/commit/b187feee66f4ce0f992059b21a97a2ae88e4cdd9) `sha256:f1e078db9e938274174fa8b2a95afbc85572b999e19dacae9835073e73588777`
* [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller) git [7afccf2d](https://github.com/openshift/cloud-network-config-controller/commit/7afccf2d78f6cb5dd3181de1588c5063bd995d7d) `sha256:c579a315ba7e2534502c49663424f9785f54c382d46fa0c8ce9acf1273954b1b`
* [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler) git [f393f542](https://github.com/openshift/kubernetes-autoscaler/commit/f393f54229e6c3ae74c35ae72012af92d31c03d3) `sha256:8f42ebeb91efefc70e091cfb6857ef2a5cbbf5d5e38d7406fabf0c9075dae35e`
* [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator) git [e48fe117](https://github.com/openshift/cluster-autoscaler-operator/commit/e48fe1179ad671757b5a40688e2d125c1f326e8b) `sha256:d330def079025b69eaf3d77fedc55eb79f810d184b0c6de9bb07cd01adf39220`
* [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator) git [0da197f8](https://github.com/openshift/cluster-cloud-controller-manager-operator/commit/0da197f80d941f537331f173bc7613d6729a2767) `sha256:8ce0f476f3e5424cb18bb4e07e7780741a016f0eb5379ece0e813742c42c15f3`
* [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator) git [c00cf58d](https://github.com/openshift/cluster-control-plane-machine-set-operator/commit/c00cf58dd81954ca100757f6a2d2af8d84770fd5) `sha256:1df1cb0617dd7708aab42ab9db7b9c2fb8cfcb6f5acbb6eb6b6f20997018b3a4`
* [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator) git [c0ed09e3](https://github.com/openshift/cluster-dns-operator/commit/c0ed09e329e9001629518604a58205e3fbe8284a) `sha256:f34f2a80a8d750e00add8bb0fff339817af335751222790449653b6f36cab392`
* [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator) git [228ec940](https://github.com/openshift/cluster-olm-operator/commit/228ec940921e4443b2724ef512c0d211d4a38ba7) `sha256:9ec2e74652df3391191b8857d12d73b7eed199abb1016b25d5cd1b210f6b7d3e`
* [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller) git [469bbf21](https://github.com/openshift/cluster-policy-controller/commit/469bbf211d35eee0df4422bda7e9e600b080f0f2) `sha256:faf246e5671646087d37a7e54cb51e317f11644a06ccceadbf9d97864c1f89ba`
* [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator) git [ba80c7ef](https://github.com/openshift/cluster-samples-operator/commit/ba80c7efd89885b08dc890eb5aefb994ee1e7ab9) `sha256:5cb79db5201ebffa0b98a84caebfd42d67fdf040e472acd4ad9188b824d2d9c7`
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [9607604d](https://github.com/openshift/cluster-update-keys/commit/9607604d35acee234051bd0da8a14321b4edd38e) `sha256:36275f3185a4eeec5c36360113c1f1995e5a146830098a465ecf1ef996330df7`
* [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs) git [beb9567b](https://github.com/openshift/csi-driver-nfs/commit/beb9567b4ef15656a88c1c71e0b08e7bf2e96aaa) `sha256:1a3165a1c0aac2bd27af8e80d63ca1bd926fd5547d5791d71ac4729869f73661`
* [csi-external-attacher](https://github.com/openshift/csi-external-attacher) git [3fd668b3](https://github.com/openshift/csi-external-attacher/commit/3fd668b3f07dd382e5c7b6239d50f7988f652e64) `sha256:d203e228b89332e5958ca03229a3f8070617c7579e2e9e1ebaf8d5a54df335b0`
* [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner) git [7ff338c9](https://github.com/openshift/csi-external-provisioner/commit/7ff338c9d1296f0e5d4d8080a76bb191c8f3be30) `sha256:7f96bf44f664caef43068784fea8cb10e4733aaeef6096ae526522b226748727`
* [csi-external-resizer](https://github.com/openshift/csi-external-resizer) git [14aa7028](https://github.com/openshift/csi-external-resizer/commit/14aa7028f485e95c800bb7ffbf9b66a2bf75ceaf) `sha256:9a81f2c39891ffa999c30c44001dcab9931c7ec2d3c3c56b2f19652f9405c69d`
* [csi-external-snapshotter](https://github.com/openshift/csi-external-snapshotter) git [a019d1a9](https://github.com/openshift/csi-external-snapshotter/commit/a019d1a9d9e1d26ffd0b2e0d911733180fa608b2) `sha256:418cd7e9b664559440730a4538a7798c023e98cc8e5d6f17b71bdde84983515e`
* [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe) git [cab57d51](https://github.com/openshift/csi-livenessprobe/commit/cab57d511106916bba6953977106f06b2fec01fd) `sha256:8843e7ca1a7675a17c12948d097533eff08c97bcbe2d3e45e3bf7d47ca87749d`
* [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar) git [5766960d](https://github.com/openshift/csi-node-driver-registrar/commit/5766960d82ffb9ef84d15e903ae57d0a6781ef11) `sha256:70acd2a3459eeaa2e376e6c4c0f4061580e1849d5958ea129af2f403d19ac4f2`
* [csi-snapshot-controller](https://github.com/openshift/csi-external-snapshotter) git [a019d1a9](https://github.com/openshift/csi-external-snapshotter/commit/a019d1a9d9e1d26ffd0b2e0d911733180fa608b2) `sha256:edf1e85d4e2aac0ecb7516f5e39832bf7dd4c91c14bca8e03edc3394c98e6c59`
* [deployer](https://github.com/openshift/oc) git [4b0a124d](https://github.com/openshift/oc/commit/4b0a124d300cef187037bda6f1b04caa69ab8b62) `sha256:75b48f99eacebf3a135ec8f22f7c5e56d75f48a08183f8971bb2231f8873d413`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [b63b175a](https://github.com/openshift/driver-toolkit/commit/b63b175a79b9fe0c29f6ed63df3c2d7862ba408a) `sha256:044ed90851471732a241ba9deef1e03f59d6553e1c3912057156722fbe99fe50`
* [egress-router-cni](https://github.com/openshift/egress-router-cni) git [bc639044](https://github.com/openshift/egress-router-cni/commit/bc639044a3aee89f1f9547ad0539481b8d808516) `sha256:1711b0e4434d28f0e690602864178cfa2c7123e46aa42fddf52c0ad4ce43fb4d`
* [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp) git [51c32646](https://github.com/openshift/cloud-provider-gcp/commit/51c326465b3160124b8097953b42e44f1056da5a) `sha256:efb9f7040e7dda18e49292937c4968e9296ad3ba60405335b0da8fe89e939b4c`
* [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook) git [4501ff2f](https://github.com/openshift/gcp-workload-identity-federation-webhook/commit/4501ff2f53576c31df0511b69444e65e1eeba745) `sha256:954acb77814a718a748541cb3d548584dfde7e2c009990a8d1748e7b158930ab`
* [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud) git [2615d13b](https://github.com/openshift/machine-api-provider-ibmcloud/commit/2615d13b730255b21ccb401d3dc039006c54a4fe) `sha256:8dcd117127b61ce621abad04f046f782baaa6fe80ad194f434c8a2e63bc405db`
* [ironic-agent](https://github.com/openshift/ironic-agent-image) git [601c9bf3](https://github.com/openshift/ironic-agent-image/commit/601c9bf36bbc4a0796c4c55e59bfe3cc46252ed3) `sha256:26fb08ce536405a5b4a6ba3d07bc31e56d6821e55d1fff709da4493952aac799`
* [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [f8e41b2e](https://github.com/openshift/ironic-rhcos-downloader/commit/f8e41b2ed8915474a99e3eb34b54692afb0611da) `sha256:4ccb8c50f509dfcb58701fd87623935458b65b3340d7792244486c188c42f918`
* [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager) git [486a0418](https://github.com/openshift/ironic-static-ip-manager/commit/486a041897d703d55ef59c98e2b20a01588a0b4c) `sha256:ad0bd9669273b8644aab56d0e1f2bb93d5c09675150d7a3f69d986feb6df017f`
* [karpenter-operator](https://github.com/openshift/karpenter-operator) git [56725605](https://github.com/openshift/karpenter-operator/commit/56725605325c54693ebed5b0983d5d0478a87fca) `sha256:1cd9257d82c93589a568b9885b0f1869001645fd10938f9ee4528e26b9e3fc76`
* [kube-vip](https://github.com/openshift/kube-vip) git [1bb8a96e](https://github.com/openshift/kube-vip/commit/1bb8a96eb31eaacc7cb49a9e8e397b66e62d87e9) `sha256:e258161f91655894cfed29bdf5f938e62747dd66d4eef91c1323c50d9399fb6a`
* [machine-image-customization-controller](https://github.com/openshift/image-customization-controller) git [e49b0968](https://github.com/openshift/image-customization-controller/commit/e49b096880f17296d42a77443dc14d732683333d) `sha256:89be756bbc65515a2835334002b773ed62dc197b2a2823465ec816518f36f6fe`
* [multus-admission-controller](https://github.com/openshift/multus-admission-controller) git [c0bdec9c](https://github.com/openshift/multus-admission-controller/commit/c0bdec9ce6a1a69985fdba5481c47fb34461eb6c) `sha256:7923f58784c3596945b0bf24084fffe0e6e1a59a19a46e91e8c1761aefd670ad`
* [multus-cni](https://github.com/openshift/multus-cni) git [8f597f4b](https://github.com/openshift/multus-cni/commit/8f597f4b90dffe1d1cb9aee558fe53a0046c9e35) `sha256:540618e2a957c814cbb8263849bb2c6ade31dd20fc057a623c40eafe9c8200ae`
* [multus-cni-microshift](https://github.com/openshift/multus-cni) git [8f597f4b](https://github.com/openshift/multus-cni/commit/8f597f4b90dffe1d1cb9aee558fe53a0046c9e35) `sha256:54e1528d7c428894142c3740d6e61b4d5cde734ae89bd099852579db50c7dc98`
* [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy) git [bfbac502](https://github.com/openshift/multus-networkpolicy/commit/bfbac5025c056c4bf53aeeef50c4bcf466f5eb11) `sha256:130f763c435a92fb813bf32cdeeec2d54c9b82dd0390274162cf7f365a237abf`
* [must-gather](https://github.com/openshift/must-gather) git [f4c72a69](https://github.com/openshift/must-gather/commit/f4c72a69ebedddead25591da3a115bc4b0bc49ca) `sha256:fa70149fd1269a73e0db7d265ff233cdf062f403f9ebffc08a249b051fbd75cf`
* [network-interface-bond-cni](https://github.com/openshift/bond-cni) git [2c395f56](https://github.com/openshift/bond-cni/commit/2c395f566f259f1a1726409e2472029fa52918c9) `sha256:537bca20c03f3ae1d90ad8c9c666be7cea865450daef0073864347b2c7faa4f3`
* [network-tools](https://github.com/openshift/network-tools) git [0b53ac3d](https://github.com/openshift/network-tools/commit/0b53ac3dccf59cd169555bf18c207122374bf003) `sha256:d56d5b9ee51473f040249b5642fecd3709eababf6782b62c49c38341ba09e0da`
* [nutanix-machine-controllers](https://github.com/openshift/machine-api-provider-nutanix) git [249b7c8e](https://github.com/openshift/machine-api-provider-nutanix/commit/249b7c8edfca8f25413dc76bc5a216fbe12a9ab1) `sha256:4cbb8253d2764b0d4d1be32c53733edb36332868d0d652489748651c17df6c2b`
* [olm-catalogd](https://github.com/openshift/operator-framework-operator-controller) git [49582d3d](https://github.com/openshift/operator-framework-operator-controller/commit/49582d3d95fd5e5c8e2d232bf0d5568860514e5d) `sha256:e74f453a836480071d9bbe58ead237cfc2aa5c752aa5d04b37709d4eedc170a9`
* [olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller) git [49582d3d](https://github.com/openshift/operator-framework-operator-controller/commit/49582d3d95fd5e5c8e2d232bf0d5568860514e5d) `sha256:0e5a56f3f6c85822733a5691852315f9281cc6ee8d8f3066fdd70d4deb5d0a9f`
* [openshift-apiserver](https://github.com/openshift/openshift-apiserver) git [ab031522](https://github.com/openshift/openshift-apiserver/commit/ab0315228cde432c8cd62df012b791a66a72c7b3) `sha256:c05f8ed401fa853509fab15cfede6005345c06d5b57809e91b7ede85237cb437`
* [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager) git [726a0562](https://github.com/openshift/openshift-controller-manager/commit/726a0562818b68faccfa130ae7ea17ff42915418) `sha256:2cb4dcd3c7f5b85e7d988790e4022f4dfd30f9b3d41138d993653aa12cd2d931`
* [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack) git [9f64446f](https://github.com/openshift/cluster-api-provider-openstack/commit/9f64446f441ff7bcebd123a0dc35d4156c309681) `sha256:b68af2b744f580fb66cbf6345a0b95a948a29d0de4748ba684aed2eff8c454bd`
* [openstack-resource-controller](https://github.com/openshift/openstack-resource-controller) git [58dbc048](https://github.com/openshift/openstack-resource-controller/commit/58dbc0482c144c21effee2476947889122a518eb) `sha256:e3ca221c7c78af692b6f06f8b299b3e8742d262a7da11720ab4daa86c9fe34cd`
* [operator-framework-tools](https://github.com/openshift/operator-framework-olm) git [c3d56d20](https://github.com/openshift/operator-framework-olm/commit/c3d56d2021bbb8d57bc359fabded3b35b253f55e) `sha256:84285add24c9ab92eb0f17a2a735232cfdb48912b6c820fc179ab17617343f0c`
* [operator-lifecycle-manager](https://github.com/openshift/operator-framework-olm) git [c3d56d20](https://github.com/openshift/operator-framework-olm/commit/c3d56d2021bbb8d57bc359fabded3b35b253f55e) `sha256:dbf2a52ecad4628da2e2c7630721570c289dcf3d9c63221dec357e62667320ab`
* [operator-marketplace](https://github.com/operator-framework/operator-marketplace) git [fa9e19b2](https://github.com/operator-framework/operator-marketplace/commit/fa9e19b2ae7ad8de20b345e3bd736923f5c516cc) `sha256:bd4c58302f5356ac9e1dfe037de64bd6786b59c0794537b07c52a580962ccad2`
* [operator-registry](https://github.com/openshift/operator-framework-olm) git [c3d56d20](https://github.com/openshift/operator-framework-olm/commit/c3d56d2021bbb8d57bc359fabded3b35b253f55e) `sha256:82b36f91943a84607c577a94abba0206a3c61f561da5587c57146173b7bd36fc`
* [powervs-block-csi-driver](https://github.com/openshift/ibm-powervs-block-csi-driver) git [5911994c](https://github.com/openshift/ibm-powervs-block-csi-driver/commit/5911994c5d70906e0f0972411176392ada9942d1) `sha256:7b379f6fa445e232fcbe5918be2954aa8cbf9c81cb5d6978ee33d9c69802124e`
* [prometheus-operator](https://github.com/openshift/prometheus-operator) git [67895c7c](https://github.com/openshift/prometheus-operator/commit/67895c7c968f42e97efec58f4140fffae4832028) `sha256:ea2e1f67d862bb62fa609a34a329f6be5c26b7b659a4efe8f30c8c30b2440a5a`
* [route-controller-manager](https://github.com/openshift/route-controller-manager) git [59697cf7](https://github.com/openshift/route-controller-manager/commit/59697cf7af4517dd44e28179a57f7f35b6ea0e22) `sha256:48c38c55d616e0e801423ea1aa6d09b2827e07e4e0a6e32ac726d7fc5ed4a8f4`
* [service-ca-operator](https://github.com/openshift/service-ca-operator) git [ed872ba1](https://github.com/openshift/service-ca-operator/commit/ed872ba14b615ca5726ae90e987268877a0b0b20) `sha256:219a5d0bb7ea6ba2b59c8a2159fc9a0652664df89c8f05253154b9d2df81b72a`
* [tools](https://github.com/openshift/oc) git [4b0a124d](https://github.com/openshift/oc/commit/4b0a124d300cef187037bda6f1b04caa69ab8b62) `sha256:7b8f9ef38ec77ffd2d13a7926134e8a01fa71e2341d01c8c3ad5f6421ff99729`
* [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere) git [eb29de19](https://github.com/openshift/cloud-provider-vsphere/commit/eb29de194594bad8e5bc572102f1008cb26655a7) `sha256:04e62eaaa84904ca959074e1ff4e07556d02d9d4253ac2380533741ada03d66a`
* [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector) git [14a2d338](https://github.com/openshift/vsphere-problem-detector/commit/14a2d33817c1ddd1d753cc76decea059376e30c9) `sha256:56056bc3538ea725019abc911f1bcd52896d040f636ad81a07f4e020fe0ac398`


### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/ec0bb5a1196c6fd1cbd3376dd453a85ce8d4ddb4)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#11028](https://github.com/openshift/assisted-service/pull/11028)
* [OCPBUGS-126900](https://issues.redhat.com/browse/OCPBUGS-126900): Allow agent-installer invoker to have a suffix [#10978](https://github.com/openshift/assisted-service/pull/10978)
* [Full changelog](https://github.com/openshift/assisted-service/compare/8177722b388c34c334961352e9ab471ed4f8e95c...ec0bb5a1196c6fd1cbd3376dd453a85ce8d4ddb4)


### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/2da79ae52e7f22ab9f44aff4301ea8143cd8ff85)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#2382](https://github.com/openshift/assisted-installer/pull/2382)
* [OCPBUGS-126900](https://issues.redhat.com/browse/OCPBUGS-126900): Allow agent-installer invoker to have a suffix [#2347](https://github.com/openshift/assisted-installer/pull/2347)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/fa7eb52b083a161b122e1c543d487edb3de0955c...2da79ae52e7f22ab9f44aff4301ea8143cd8ff85)


### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/a75a7c931350d762396c5c7578246b841d9ffaff)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#1664](https://github.com/openshift/assisted-installer-agent/pull/1664)
* [OCPBUGS-87404](https://issues.redhat.com/browse/OCPBUGS-87404): Updating ose-agent-installer-node-agent-container image to be consistent with ART for 5.0 [#1491](https://github.com/openshift/assisted-installer-agent/pull/1491)
* [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/aeec165131a4c528174a58a011d1c3c31cfd7cc1...a75a7c931350d762396c5c7578246b841d9ffaff)


### [agent-installer-ui](https://github.com/openshift-assisted/assisted-installer-ui/tree/b1c53f528a8219dd5660b4bc7cdc0c6429d807fa)

* Do not show limited support level warning in disconnected flow (#4088) [#4088](https://github.com/openshift-assisted/assisted-installer-ui/pull/4088)
* [Full changelog](https://github.com/openshift-assisted/assisted-installer-ui/compare/d085665f508757802bb8686c3dd39a8f1088fc06...b1c53f528a8219dd5660b4bc7cdc0c6429d807fa)


### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/449d4e9e9d2f08330d2d31ad80517caf990652c3)

* [OCPBUGS-127048](https://issues.redhat.com/browse/OCPBUGS-127048): Quote variable expansion in `skopeo inspect` invocation [#354](https://github.com/openshift/agent-installer-utils/pull/354)
* [OCPBUGS-127042](https://issues.redhat.com/browse/OCPBUGS-127042): Refresh rendezvous IP selection list [#353](https://github.com/openshift/agent-installer-utils/pull/353)
* [OCPBUGS-127008](https://issues.redhat.com/browse/OCPBUGS-127008): Fix agent TUI timeout [#350](https://github.com/openshift/agent-installer-utils/pull/350)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/33aa46920190a1c587599dfda77d9c1e3899e255...449d4e9e9d2f08330d2d31ad80517caf990652c3)


### [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws/tree/812216c630c78dcc9d8d104d6d15366d7271ff59)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#660](https://github.com/openshift/cluster-api-provider-aws/pull/660)
* [OCPBUGS-128250](https://issues.redhat.com/browse/OCPBUGS-128250): UPSTREAM: &lt;carry&gt;: remove redundant GitHub summary verification [#659](https://github.com/openshift/cluster-api-provider-aws/pull/659)
* [Full changelog](https://github.com/openshift/cluster-api-provider-aws/compare/6fe56d037dc82c8babc6d70228dc89d3606385cd...812216c630c78dcc9d8d104d6d15366d7271ff59)


### [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver/tree/34dbd7674b5a39e1d3c65eedfd9fab85004e2353)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#343](https://github.com/openshift/aws-ebs-csi-driver/pull/343)
* [Full changelog](https://github.com/openshift/aws-ebs-csi-driver/compare/8b8c4cef02ec9b670e2709f2aacc0ed72420be90...34dbd7674b5a39e1d3c65eedfd9fab85004e2353)


### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, gcp-pd-csi-driver-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/a441aefa2b3ac425dd7b68c34927bcdd66713571)

* [OCPBUGS-128798](https://issues.redhat.com/browse/OCPBUGS-128798): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#641](https://github.com/openshift/csi-operator/pull/641)
* : [release-5.0] OCPBUGS-128035: Enable pod-delete-after-umount CSI suite for driver OCP manifests [#628](https://github.com/openshift/csi-operator/pull/628)
* [OCPBUGS-120666](https://issues.redhat.com/browse/OCPBUGS-120666): fix(gcp-pd): do not apply guest-cluster resources against the management cluster on HyperShift [#623](https://github.com/openshift/csi-operator/pull/623)
* [Full changelog](https://github.com/openshift/csi-operator/compare/31b3192f3a5182ee1b523370cdfd94833b75e6d1...a441aefa2b3ac425dd7b68c34927bcdd66713571)


### [aws-karpenter-provider-aws](https://github.com/openshift/aws-karpenter-provider-aws/tree/d8ba4583eda5714f006524d6c05390d55842f830)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#48](https://github.com/openshift/aws-karpenter-provider-aws/pull/48)
* [OCPBUGS-127053](https://issues.redhat.com/browse/OCPBUGS-127053): Align simulated with actual allocatable resources [#47](https://github.com/openshift/aws-karpenter-provider-aws/pull/47)
* [Full changelog](https://github.com/openshift/aws-karpenter-provider-aws/compare/d04b52621a47868d907e986b37a01fcddeb8a23f...d8ba4583eda5714f006524d6c05390d55842f830)


### [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws/tree/791ca0f9584cd7c170e545528e5588238bbe77cd)

* [OCPBUGS-128830](https://issues.redhat.com/browse/OCPBUGS-128830): Fixed dedicated host tests to check for machineset to exist [#226](https://github.com/openshift/machine-api-provider-aws/pull/226)
* [Full changelog](https://github.com/openshift/machine-api-provider-aws/compare/9f2e9b3c46b391c7219257a426ad80ca8a296af0...791ca0f9584cd7c170e545528e5588238bbe77cd)


### [aws-node-termination-handler](https://github.com/openshift/aws-node-termination-handler/tree/ed93e0e393ab94fb8286bc0da9f98918d20475a3)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#16](https://github.com/openshift/aws-node-termination-handler/pull/16)
* [Full changelog](https://github.com/openshift/aws-node-termination-handler/compare/9b33cce5107d71df5c65dbca6c08f1f71d9e6e8a...ed93e0e393ab94fb8286bc0da9f98918d20475a3)


### [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure/tree/01c1957cacd76b4123e4b7947d2e9d208c9cd1af)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#414](https://github.com/openshift/cluster-api-provider-azure/pull/414)
* [Full changelog](https://github.com/openshift/cluster-api-provider-azure/compare/63731729974bff3be90ae2206c53d760572499d1...01c1957cacd76b4123e4b7947d2e9d208c9cd1af)


### [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver/tree/9719f03e539db9b122ce1cdde47f75f205a82750)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#168](https://github.com/openshift/azure-file-csi-driver/pull/168)
* [Full changelog](https://github.com/openshift/azure-file-csi-driver/compare/9689f03011ce700b3bffc32791af839e80d0e0ab...9719f03e539db9b122ce1cdde47f75f205a82750)


### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/9bc8029d8fd9360d18053884db1b806db7defbb2)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#66](https://github.com/openshift/azure-kubernetes-kms/pull/66)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/6409e379fa979104a9515108608c22492bb803a7...9bc8029d8fd9360d18053884db1b806db7defbb2)


### [azure-service-operator](https://github.com/openshift/azure-service-operator/tree/26f483f05301e430d384053862923c40864e755e)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#48](https://github.com/openshift/azure-service-operator/pull/48)
* [Full changelog](https://github.com/openshift/azure-service-operator/compare/0611cd27b9eaa4a1fa8e0ab8ddc85352a61903e0...26f483f05301e430d384053862923c40864e755e)


### [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity/tree/374345793cac5c9ed3323ba6b91934eae5fa0b41)

* [OCPBUGS-104262](https://issues.redhat.com/browse/OCPBUGS-104262): Bump golang.org/x/net to v0.53.0 to address CVE-2026-33814 [#58](https://github.com/openshift/azure-workload-identity/pull/58)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#71](https://github.com/openshift/azure-workload-identity/pull/71)
* [Full changelog](https://github.com/openshift/azure-workload-identity/compare/2b4705c5d999339ce17d47a9b2a637d238891dae...374345793cac5c9ed3323ba6b91934eae5fa0b41)


### [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3/tree/18b98547b7c5635a840a5ec4449c9ef8cb6a06e9)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#109](https://github.com/openshift/cluster-api-provider-metal3/pull/109)
* [Full changelog](https://github.com/openshift/cluster-api-provider-metal3/compare/ad4f1c2bd7b527437496b71b5b93ee1439243d65...18b98547b7c5635a840a5ec4449c9ef8cb6a06e9)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/eb06e33ff4f9c54303c6ccc243a0a1e7121285c8)

* [OCPBUGS-122006](https://issues.redhat.com/browse/OCPBUGS-122006): Warn about ignored install-config fields in ABI [#10861](https://github.com/openshift/installer/pull/10861)
* [OCPBUGS-128501](https://issues.redhat.com/browse/OCPBUGS-128501): gcp: restrict global KMS location check to defaultMachinePlatform [#10929](https://github.com/openshift/installer/pull/10929)
* [OCPBUGS-126592](https://issues.redhat.com/browse/OCPBUGS-126592): Update RHCOS-release-5.0 bootimage metadata to 9.8.20260921-0 / 10.2.20260922-0 [#10923](https://github.com/openshift/installer/pull/10923)
* [OCPBUGS-126900](https://issues.redhat.com/browse/OCPBUGS-126900): use different INSTALL_INVOKER for unconfigured ignition [#10900](https://github.com/openshift/installer/pull/10900)
* [OCPBUGS-126682](https://issues.redhat.com/browse/OCPBUGS-126682): Inject the pull-secret as podman secret in the agent-installer-ui container [#10887](https://github.com/openshift/installer/pull/10887)
* [Full changelog](https://github.com/openshift/installer/compare/b6f119779c7ce529a94c7b8956a057343675f212...eb06e33ff4f9c54303c6ccc243a0a1e7121285c8)


### [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal/tree/7f3bfffd7b7703cd601dbf83f6bfc56a190d017d)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#281](https://github.com/openshift/cluster-api-provider-baremetal/pull/281)
* [OCPBUGS-123652](https://issues.redhat.com/browse/OCPBUGS-123652): Fix race that can provision multiple hosts [#280](https://github.com/openshift/cluster-api-provider-baremetal/pull/280)
* [OCPBUGS-104256](https://issues.redhat.com/browse/OCPBUGS-104256): Bump golang.org/x/net to v0.58.0 to address CVE-2026-33814 [#263](https://github.com/openshift/cluster-api-provider-baremetal/pull/263)
* [Full changelog](https://github.com/openshift/cluster-api-provider-baremetal/compare/f2b0db1919fff1344bc68948894c6775c0bf24a3...7f3bfffd7b7703cd601dbf83f6bfc56a190d017d)


### [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg/tree/3cde69071d3f6d5f2bc79b1cb55e5394021fcbb8)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#416](https://github.com/openshift/baremetal-runtimecfg/pull/416)
* [Full changelog](https://github.com/openshift/baremetal-runtimecfg/compare/3a261a6f4a6211e8f4031611104ced4def436dde...3cde69071d3f6d5f2bc79b1cb55e5394021fcbb8)


### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/f269e4bf4b133be83153f8711a991ac71e7bafc8)

* [OCPBUGS-127499](https://issues.redhat.com/browse/OCPBUGS-127499): Add high contrast support to oauth templates [#1013](https://github.com/openshift/cluster-authentication-operator/pull/1013)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Update build-machinery-go vendor dependency [#998](https://github.com/openshift/cluster-authentication-operator/pull/998)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/954abf76eb0000ff218257489783c8e61dc115b8...f269e4bf4b133be83153f8711a991ac71e7bafc8)


### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/20369c92cc64521d6937e926d85791fac5dd505a)

* [OCPBUGS-122243](https://issues.redhat.com/browse/OCPBUGS-122243): Make HostPath VolumeMounts ReadOnly for image customization container [#659](https://github.com/openshift/cluster-baremetal-operator/pull/659)
* [OCPBUGS-123600](https://issues.redhat.com/browse/OCPBUGS-123600): Add attach_non_bootable_iso OTE test [#665](https://github.com/openshift/cluster-baremetal-operator/pull/665)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/d7957265fdafbbb93bb2a0d4723fc9719da1378d...20369c92cc64521d6937e926d85791fac5dd505a)


### [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap/tree/ab74989bad5e19d8e137b2175decf4c5b4c1ae22)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#150](https://github.com/openshift/cluster-bootstrap/pull/150)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Update build-machinery-go vendor dependency [#147](https://github.com/openshift/cluster-bootstrap/pull/147)
* [Full changelog](https://github.com/openshift/cluster-bootstrap/compare/451fff460e643abd2e6e9dfd88e29b27d3b1fedb...ab74989bad5e19d8e137b2175decf4c5b4c1ae22)


### [cluster-capi-controllers](https://github.com/openshift/cluster-api/tree/6f2e5dcc9e83873e25772fa7c7e10e99b696bb0d)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#315](https://github.com/openshift/cluster-api/pull/315)
* [OCPBUGS-128250](https://issues.redhat.com/browse/OCPBUGS-128250): UPSTREAM: &lt;carry&gt;: remove redundant GitHub summary verification [#314](https://github.com/openshift/cluster-api/pull/314)
* [Full changelog](https://github.com/openshift/cluster-api/compare/303d9786a5017d299b6e7fc702bb92f5cb4550cf...6f2e5dcc9e83873e25772fa7c7e10e99b696bb0d)


### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/0d06adb94113a8f9bc76b754ae6e906d4020a9d6)

* [OCPBUGS-128732](https://issues.redhat.com/browse/OCPBUGS-128732): add ec2:ModifyInstanceMetadataOptions to AWS CredentialsRequest [#684](https://github.com/openshift/cluster-capi-operator/pull/684)
* [OCPBUGS-128290](https://issues.redhat.com/browse/OCPBUGS-128290): Pass original TLSProfileSpec to security profile watcher [#679](https://github.com/openshift/cluster-capi-operator/pull/679)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/5afa8634c5bd26c8ed12dbecb0c31e79ed2fb39c...0d06adb94113a8f9bc76b754ae6e906d4020a9d6)


### [cluster-config-api](https://github.com/openshift/api/tree/3063f49533e8e7b08a30bb68c45047c14a3b3822)

* [OCPBUGS-126809](https://issues.redhat.com/browse/OCPBUGS-126809): Enable OLMLifecycleAndCompatibility by default in version 5+ [#3064](https://github.com/openshift/api/pull/3064)
* [OCPBUGS-123648](https://issues.redhat.com/browse/OCPBUGS-123648): [5.0] register DRADeviceTaintRules in all feature sets [#3040](https://github.com/openshift/api/pull/3040)
* [Full changelog](https://github.com/openshift/api/compare/31af9f93e31ecd483504b3302d78f67c5a077a9e...3063f49533e8e7b08a30bb68c45047c14a3b3822)


### [cluster-config-operator](https://github.com/openshift/cluster-config-operator/tree/66aaee528a6fa29463046e0af51336bb405b8fb8)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#520](https://github.com/openshift/cluster-config-operator/pull/520)
* [OCPBUGS-87358](https://issues.redhat.com/browse/OCPBUGS-87358): Updating ose-cluster-config-operator-container image to be consistent with ART for 5.0 [#493](https://github.com/openshift/cluster-config-operator/pull/493)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Update build-machinery-go vendor dependency [#502](https://github.com/openshift/cluster-config-operator/pull/502)
* [Full changelog](https://github.com/openshift/cluster-config-operator/compare/9f787f73f5fffca5cd511ef2c2e704afc14f68ce...66aaee528a6fa29463046e0af51336bb405b8fb8)


### [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator/tree/6b40834f1fa1430c458734d396b39775f1232647)

* [OCPBUGS-128798](https://issues.redhat.com/browse/OCPBUGS-128798): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#300](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/300)
* [Full changelog](https://github.com/openshift/cluster-csi-snapshot-controller-operator/compare/35ec0224eb0e5219d5eae012fb703223a6f3e1f7...6b40834f1fa1430c458734d396b39775f1232647)


### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/f0587e37ea322e9277ae228335be72a5796b6b33)

* [OCPBUGS-128762](https://issues.redhat.com/browse/OCPBUGS-128762): TNF: wait for etcd-bootstrap member removal before setup [#1722](https://github.com/openshift/cluster-etcd-operator/pull/1722)
* [OCPBUGS-127274](https://issues.redhat.com/browse/OCPBUGS-127274): fix(tnf): set read-only root filesystems [#1716](https://github.com/openshift/cluster-etcd-operator/pull/1716)
* [OCPBUGS-127061](https://issues.redhat.com/browse/OCPBUGS-127061): allow TLS 1.3 profiles without ciphers [#1714](https://github.com/openshift/cluster-etcd-operator/pull/1714)
* [OCPBUGS-123640](https://issues.redhat.com/browse/OCPBUGS-123640): fix: add missing workload paritioning annotation on cert-watcher daemonset [#1709](https://github.com/openshift/cluster-etcd-operator/pull/1709)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/fb6ecceb7232511baa7df34d38e65415de52322d...f0587e37ea322e9277ae228335be72a5796b6b33)


### [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator/tree/8135895ad26c69d538fb972767350397b479a647)

* [OCPBUGS-128764](https://issues.redhat.com/browse/OCPBUGS-128764): Add 2m degraded inertia to ImagePrunerController [#1383](https://github.com/openshift/cluster-image-registry-operator/pull/1383)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#1380](https://github.com/openshift/cluster-image-registry-operator/pull/1380)
* [OCPBUGS-128565](https://issues.redhat.com/browse/OCPBUGS-128565): Revert "imageconfig: preserve ImageStreamImportMode during upgrade race" [#1381](https://github.com/openshift/cluster-image-registry-operator/pull/1381)
* [Full changelog](https://github.com/openshift/cluster-image-registry-operator/compare/b6d3329d7059adba44dd0c3e9c0e9da264f9a551...8135895ad26c69d538fb972767350397b479a647)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/4ef55ea002a406a2e9193594ef583a24ddb4ff3b)

* [OCPBUGS-126741](https://issues.redhat.com/browse/OCPBUGS-126741): Bump to OSSM 3.4.2 and Istio v1.30.4 [#1600](https://github.com/openshift/cluster-ingress-operator/pull/1600)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/fe8a2bcf6342fab7aa19c47b4397a7d226962136...4ef55ea002a406a2e9193594ef583a24ddb4ff3b)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/ec33ea1e2bde9b77b29f12a450bb548980cb5e3d)

* [OCPBUGS-123648](https://issues.redhat.com/browse/OCPBUGS-123648): apienablement: enable resource.k8s.io/v1beta2 when DeviceTaintRule is enabled [#2321](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2321)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Update build-machinery-go vendor dependency [#2311](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2311)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/440392249bc58324156ba813b797728e9a81fa3c...ec33ea1e2bde9b77b29f12a450bb548980cb5e3d)


### [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator/tree/e0d271fceb3727138177e017f860a8ff79738bb3)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Update build-machinery-go vendor dependency [#677](https://github.com/openshift/cluster-kube-scheduler-operator/pull/677)
* [Full changelog](https://github.com/openshift/cluster-kube-scheduler-operator/compare/7b737a3f68ff52ebff3c9f541edbca357dde7111...e0d271fceb3727138177e017f860a8ff79738bb3)


### [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/tree/01d7a12d27c2b52c6ece97ec0b60c71fe0e493d3)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#184](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/pull/184)
* [Full changelog](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/compare/ec1db56482efc9dced72b44a1c2b6817dbfffe91...01d7a12d27c2b52c6ece97ec0b60c71fe0e493d3)


### [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver/tree/93c05fa0f59c67fdb35cd39dd55bdf8cd1f842a4)

* [OCPBUGS-128455](https://issues.redhat.com/browse/OCPBUGS-128455): Revert EgressIP validation backport [#338](https://github.com/openshift/cluster-machine-approver/pull/338)
* [OCPBUGS-127107](https://issues.redhat.com/browse/OCPBUGS-127107): fix: retry serving CSRs while Machine addresses populate [#322](https://github.com/openshift/cluster-machine-approver/pull/322)
* [Full changelog](https://github.com/openshift/cluster-machine-approver/compare/11c03d0952f281ca9cfb62e528e5a0e24ae644ab...93c05fa0f59c67fdb35cd39dd55bdf8cd1f842a4)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/b272ab22a6cc8671e7b9f6fd0ac1c2e91940dd55)

* [OCPBUGS-128817](https://issues.redhat.com/browse/OCPBUGS-128817): filter ciphers not supported by Thanos [#3146](https://github.com/openshift/cluster-monitoring-operator/pull/3146)
* [OCPBUGS-127465](https://issues.redhat.com/browse/OCPBUGS-127465): fix(e2e): use Job with backoffLimit for TestDocExamples [#3104](https://github.com/openshift/cluster-monitoring-operator/pull/3104)
* [OCPBUGS-127422](https://issues.redhat.com/browse/OCPBUGS-127422): Fix flaky TestTelemetryReport/rate_issues [#3098](https://github.com/openshift/cluster-monitoring-operator/pull/3098)
* [OCPBUGS-126958](https://issues.redhat.com/browse/OCPBUGS-126958): restore node-exporter textfile metrics with read-only rootfs [#3096](https://github.com/openshift/cluster-monitoring-operator/pull/3096)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/efeeabf10a9c46f7a82086d2c04c9fc6d93a2b22...b272ab22a6cc8671e7b9f6fd0ac1c2e91940dd55)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/f729b5d090ceeab5a2d7e3ad74387b1a1630fb89)

* [OCPBUGS-115004](https://issues.redhat.com/browse/OCPBUGS-115004): Add ConfigMap hash annotation to networking console plugin deployment [#3144](https://github.com/openshift/cluster-network-operator/pull/3144)
* [OCPBUGS-128644](https://issues.redhat.com/browse/OCPBUGS-128644): Fix issues when NetObserv fails to install [#3181](https://github.com/openshift/cluster-network-operator/pull/3181)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/3b484353063fe95156373f7cf51c5ba13f501256...f729b5d090ceeab5a2d7e3ad74387b1a1630fb89)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/f3fb675b7b3ac7992ba3462d87f9f67336d86ba2)

* [OCPBUGS-129644](https://issues.redhat.com/browse/OCPBUGS-129644): E2E: Add labels to ovsdpdk tests [#1659](https://github.com/openshift/cluster-node-tuning-operator/pull/1659)
* [OCPBUGS-129611](https://issues.redhat.com/browse/OCPBUGS-129611): E2E: Fix no-op Get() assertions in mixedcpus [#1658](https://github.com/openshift/cluster-node-tuning-operator/pull/1658)
* [OCPBUGS-127373](https://issues.redhat.com/browse/OCPBUGS-127373): E2E: ovsDpdk remaining cases and consolidate suite [#1643](https://github.com/openshift/cluster-node-tuning-operator/pull/1643)
* [OCPBUGS-114738](https://issues.redhat.com/browse/OCPBUGS-114738): E2E: Fix ovs dynamic pinning, kubelet and mustgather tests [#1621](https://github.com/openshift/cluster-node-tuning-operator/pull/1621)
* [OCPBUGS-129433](https://issues.redhat.com/browse/OCPBUGS-129433): Makefile: Modify pao-functests-update-only to run tier-0 and tier-1 tests [#1654](https://github.com/openshift/cluster-node-tuning-operator/pull/1654)
* [OCPBUGS-128909](https://issues.redhat.com/browse/OCPBUGS-128909): Prevent offlined CPUs from being re-onlined after reboot by udev hotplug rule [#1648](https://github.com/openshift/cluster-node-tuning-operator/pull/1648)
* [OCPBUGS-128813](https://issues.redhat.com/browse/OCPBUGS-128813): E2E: PPC: replace no-op log-on-match with actual assertions (4 sites) [#1647](https://github.com/openshift/cluster-node-tuning-operator/pull/1647)
* [OCPBUGS-127360](https://issues.redhat.com/browse/OCPBUGS-127360): E2E: add missing matcher to offlined CPU Expect() calls [#1642](https://github.com/openshift/cluster-node-tuning-operator/pull/1642)
* [OCPBUGS-123795](https://issues.redhat.com/browse/OCPBUGS-123795): apis: add missing fields to apis v1 [#1636](https://github.com/openshift/cluster-node-tuning-operator/pull/1636)
* [OCPBUGS-123511](https://issues.redhat.com/browse/OCPBUGS-123511): e2e: make OVS dynamic pinning tests compatible with ovsDpdk CPUs [#1631](https://github.com/openshift/cluster-node-tuning-operator/pull/1631)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/accb8e2235f97d682b9d3aea95295bdfaf9b15e0...f3fb675b7b3ac7992ba3462d87f9f67336d86ba2)


### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/e7c64303284066d2595be06f7f01502bed12af24)

* [OCPBUGS-128248](https://issues.redhat.com/browse/OCPBUGS-128248): Fix the un-upgradeable message [#747](https://github.com/openshift/cluster-storage-operator/pull/747)
* [OCPBUGS-128798](https://issues.redhat.com/browse/OCPBUGS-128798): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#752](https://github.com/openshift/cluster-storage-operator/pull/752)
* [OCPBUGS-128248](https://issues.redhat.com/browse/OCPBUGS-128248): Use KCS link in the un-upgradeable message [#745](https://github.com/openshift/cluster-storage-operator/pull/745)
* [OCPBUGS-123152](https://issues.redhat.com/browse/OCPBUGS-123152): Backport gcp pd hypershift release 5.0 [#743](https://github.com/openshift/cluster-storage-operator/pull/743)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/b2ee363241ad0425efd56badb6046884cadda97d...e7c64303284066d2595be06f7f01502bed12af24)


### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/df40add4381949115dd8dab476f474c44ce15b20)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#1479](https://github.com/openshift/cluster-version-operator/pull/1479)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/219aba7debd16c83bb6ccdccf156af921ce54dfe...df40add4381949115dd8dab476f474c44ce15b20)


### [configmap-reloader](https://github.com/openshift/configmap-reload/tree/4e585cf9bb144a6a1e58004abb33e5bbcc9594e8)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#86](https://github.com/openshift/configmap-reload/pull/86)
* [Full changelog](https://github.com/openshift/configmap-reload/compare/ce80869a83b55ebbdc21a5550ec5747645203bd2...4e585cf9bb144a6a1e58004abb33e5bbcc9594e8)


### [console](https://github.com/openshift/console/tree/28009425f828c6a82067430231ce6ce8017fff98)

* [OCPBUGS-130324](https://issues.redhat.com/browse/OCPBUGS-130324): Guard against null/missing urls in Helm charts [#17344](https://github.com/openshift/console/pull/17344)
* [OCPBUGS-129474](https://issues.redhat.com/browse/OCPBUGS-129474): Cap rendered alerts in notification drawer and dashboards [#17367](https://github.com/openshift/console/pull/17367)
* [OCPBUGS-128861](https://issues.redhat.com/browse/OCPBUGS-128861): fix incorrect breakpoint in code editor sidebar [#17343](https://github.com/openshift/console/pull/17343)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#17320](https://github.com/openshift/console/pull/17320)
* [OCPBUGS-127461](https://issues.redhat.com/browse/OCPBUGS-127461): Console does not offer ReadWriteOncePod (RWOP) for AWS EBS CSI StorageClasses [#17289](https://github.com/openshift/console/pull/17289)
* [OCPBUGS-128463](https://issues.redhat.com/browse/OCPBUGS-128463): provide PatternFly dynamic modules without Console consuming them [#17325](https://github.com/openshift/console/pull/17325)
* [OCPBUGS-127187](https://issues.redhat.com/browse/OCPBUGS-127187): Add CSP violation detection to Playwright [#17218](https://github.com/openshift/console/pull/17218)
* [OCPBUGS-127019](https://issues.redhat.com/browse/OCPBUGS-127019): restore some old test-prow-e2e scenarios [#17198](https://github.com/openshift/console/pull/17198)
* [OCPBUGS-127051](https://issues.redhat.com/browse/OCPBUGS-127051): Post qa-verify evidence via gh's native --attach instead of base64 [#17200](https://github.com/openshift/console/pull/17200)
* [OCPBUGS-120722](https://issues.redhat.com/browse/OCPBUGS-120722): Helm backend test flake: parallel packages race on global pkill chartmuseum [#17144](https://github.com/openshift/console/pull/17144)
* [OCPBUGS-126894](https://issues.redhat.com/browse/OCPBUGS-126894): i18n upload/download routine task - version 4.23/5.0 (Additional) [#17195](https://github.com/openshift/console/pull/17195)
* [OCPBUGS-126884](https://issues.redhat.com/browse/OCPBUGS-126884): Keep notification bell visible when read notifications exist [#17194](https://github.com/openshift/console/pull/17194)
* [OCPBUGS-114008](https://issues.redhat.com/browse/OCPBUGS-114008): Strip version tag from OCI chart URL to prevent doubl… [#17097](https://github.com/openshift/console/pull/17097)
* [OCPBUGS-122258](https://issues.redhat.com/browse/OCPBUGS-122258): Handle Prometheus percentage strings [#17161](https://github.com/openshift/console/pull/17161)
* [OCPBUGS-123616](https://issues.redhat.com/browse/OCPBUGS-123616): increase httpRetry and update yarn [#17181](https://github.com/openshift/console/pull/17181)
* [OCPBUGS-123202](https://issues.redhat.com/browse/OCPBUGS-123202): Fix Namespace column hidden on Node Pods tab with active namespace [#17175](https://github.com/openshift/console/pull/17175)
* [OCPBUGS-123647](https://issues.redhat.com/browse/OCPBUGS-123647): i18n upload/download routine task - version 4.23/5.0 [#17183](https://github.com/openshift/console/pull/17183)
* And 3 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/console/compare/e15ec744673924852b341bb517d605c6c6989413...28009425f828c6a82067430231ce6ce8017fff98)


### [console-operator](https://github.com/openshift/console-operator/tree/8682c553ccb55537a5457333706a26ae438eb3f9)

* [OCPBUGS-113613](https://issues.redhat.com/browse/OCPBUGS-113613): Handle disabled Ingress capability in HyperShift [#1215](https://github.com/openshift/console-operator/pull/1215)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#1234](https://github.com/openshift/console-operator/pull/1234)
* [Full changelog](https://github.com/openshift/console-operator/compare/630495120bc5ddc9e05cd6defc2102690ced6301...8682c553ccb55537a5457333706a26ae438eb3f9)


### [container-networking-plugins, containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins/tree/23278182eec51396cca07cc1e202898411e2d11d)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#251](https://github.com/openshift/containernetworking-plugins/pull/251)
* NO-JIRA: Fix Go builders in CI [#250](https://github.com/openshift/containernetworking-plugins/pull/250)
* [Full changelog](https://github.com/openshift/containernetworking-plugins/compare/d253ee09d629b8172ffc9c3e4b571320fc63ee34...23278182eec51396cca07cc1e202898411e2d11d)


### [coredns](https://github.com/openshift/coredns/tree/bbbbf9a28f179e92c9481a2923c989ddeb84999b)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#218](https://github.com/openshift/coredns/pull/218)
* [Full changelog](https://github.com/openshift/coredns/compare/37aaba896e97f4b9a091aab6d36f2213b8854474...bbbbf9a28f179e92c9481a2923c989ddeb84999b)


### [csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/f32d78f4758c69c67b453a83e1345a417b4a63c9)

* [OCPBUGS-108037](https://issues.redhat.com/browse/OCPBUGS-108037): Bump go.opentelemetry.io/otel to v1.44.0 in 5.0 [#427](https://github.com/openshift/cloud-provider-openstack/pull/427)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/aa9a8100e87ff13abf4dd6343c84c9f4948debef...f32d78f4758c69c67b453a83e1345a417b4a63c9)


### [csi-external-snapshot-metadata](https://github.com/openshift/csi-external-snapshot-metadata/tree/ce497b1ed7da0b3e9ab51c1cbdc19c54f69361a0)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#31](https://github.com/openshift/csi-external-snapshot-metadata/pull/31)
* [Full changelog](https://github.com/openshift/csi-external-snapshot-metadata/compare/b929f29695d4a1ab21a70868f681d463a673380f...ce497b1ed7da0b3e9ab51c1cbdc19c54f69361a0)


### [docker-builder](https://github.com/openshift/builder/tree/a5718a4f8c8260a997c7f2546b94edd9dcac68aa)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#570](https://github.com/openshift/builder/pull/570)
* [Full changelog](https://github.com/openshift/builder/compare/1e53243554dead3d84297e341651c5eb83eb37a4...a5718a4f8c8260a997c7f2546b94edd9dcac68aa)


### [docker-registry](https://github.com/openshift/image-registry/tree/ab9f84929eee9019fb5aede74316ea321f99e575)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#489](https://github.com/openshift/image-registry/pull/489)
* [OCPBUGS-87287](https://issues.redhat.com/browse/OCPBUGS-87287): Updating openshift-enterprise-registry-container image to be consistent with ART for 5.0 [#472](https://github.com/openshift/image-registry/pull/472)
* [Full changelog](https://github.com/openshift/image-registry/compare/a91ce6edf2c5cc08aa184c47dff79e842079c533...ab9f84929eee9019fb5aede74316ea321f99e575)


### [etcd, installer-etcd-artifacts](https://github.com/openshift/etcd/tree/7cf5f0dbc98a20dc8b765151ab8b53f3019e3c81)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#418](https://github.com/openshift/etcd/pull/418)
* Update Dockerfile references from golang-1.25 to golang-1.26 [#417](https://github.com/openshift/etcd/pull/417)
* [Full changelog](https://github.com/openshift/etcd/compare/609b11ed8fc404fb95572d7c87e3243a1206cdb7...7cf5f0dbc98a20dc8b765151ab8b53f3019e3c81)


### [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp/tree/5f2261824f63b608c8911b92bd140d324381ae21)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#315](https://github.com/openshift/cluster-api-provider-gcp/pull/315)
* [Full changelog](https://github.com/openshift/cluster-api-provider-gcp/compare/dbcbfe70efa75f192309f2d0f8daae2c6a441e90...5f2261824f63b608c8911b92bd140d324381ae21)


### [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp/tree/4e309609acea989fdc9590295e56e2de0a1c6608)

* [OCPBUGS-129163](https://issues.redhat.com/browse/OCPBUGS-129163): Wait for RUNNING before providerID; retry stockout [#198](https://github.com/openshift/machine-api-provider-gcp/pull/198)
* [Full changelog](https://github.com/openshift/machine-api-provider-gcp/compare/91033fc5b42f58acdad7be8c89a0012f5f2c9b5b...4e309609acea989fdc9590295e56e2de0a1c6608)


### [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver/tree/981fb466b5565a755df52bcb6c626d8f7fb82980)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#136](https://github.com/openshift/gcp-pd-csi-driver/pull/136)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver/compare/049c0b96742c40fdd4384920afe17cefa5fa3d27...981fb466b5565a755df52bcb6c626d8f7fb82980)


### [haproxy-router, haproxy-router-haproxy28, haproxy-router-haproxy32](https://github.com/openshift/router/tree/a39a742e03e7be863c92c4b820025c6e0f78a7eb)

* [OCPBUGS-123650](https://issues.redhat.com/browse/OCPBUGS-123650): Lock DeleteFunc to stop SARCompleted overwriting rejection [#846](https://github.com/openshift/router/pull/846)
* [Full changelog](https://github.com/openshift/router/compare/3381229146657d2e6bd94115dda0885f25cb3bed...a39a742e03e7be863c92c4b820025c6e0f78a7eb)


### [hyperkube, installer-kube-apiserver-artifacts, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/bf3ef614b88993576f8c76728496ed0f2d61db47)

* [OCPBUGS-127122](https://issues.redhat.com/browse/OCPBUGS-127122): UPSTREAM: &lt;carry&gt;: Add needed labels to RHEL pause image [#2810](https://github.com/openshift/kubernetes/pull/2810)
* NO-JIRA: Rebase v1.36.5 in release-5.0 [#2802](https://github.com/openshift/kubernetes/pull/2802)
* UPSTREAM: 142167: Refuse UNC symlink targets in Windows subPath resolution [#2795](https://github.com/openshift/kubernetes/pull/2795)
* NOJIRA: add explicit merge commit message [#2792](https://github.com/openshift/kubernetes/pull/2792)
* [OCPBUGS-127122](https://issues.redhat.com/browse/OCPBUGS-127122): UPSTREAM: &lt;carry&gt;: Use FROM scratch for RHEL pause image [#2786](https://github.com/openshift/kubernetes/pull/2786)
* NO-JIRA: Rebase release-5.0 to Kubernetes v1.36.4 [#2776](https://github.com/openshift/kubernetes/pull/2776)
* [Full changelog](https://github.com/openshift/kubernetes/compare/b376ee7b841bed5a51cb9520b37d87931c48a821...bf3ef614b88993576f8c76728496ed0f2d61db47)


### [hypershift](https://github.com/openshift/hypershift/tree/449f32ab51795e584f7cbc80653e5b4f1424b29c)

* [OCPBUGS-121866](https://issues.redhat.com/browse/OCPBUGS-121866): Generate KubeVirt nmstate network config conditionally [#9894](https://github.com/openshift/hypershift/pull/9894)
* [OCPBUGS-129118](https://issues.redhat.com/browse/OCPBUGS-129118): Count only successful upsert updates [#9899](https://github.com/openshift/hypershift/pull/9899)
* [CNTRLPLANE-4568](https://issues.redhat.com/browse/CNTRLPLANE-4568): add kubeClientQPS and kubeClientBurst to ClusterAutoscaling [#9885](https://github.com/openshift/hypershift/pull/9885)
* [OCPBUGS-128504](https://issues.redhat.com/browse/OCPBUGS-128504): fix: mount combined-pull-secret in OpenShift API Server [#9883](https://github.com/openshift/hypershift/pull/9883)
* [OCPBUGS-128396](https://issues.redhat.com/browse/OCPBUGS-128396): [release-5.0]: fix(globalps): schedule global-pull-secret-syncer on karpenter nodes [#9799](https://github.com/openshift/hypershift/pull/9799)
* [OCPBUGS-127000](https://issues.redhat.com/browse/OCPBUGS-127000): Updating ose-hypershift-container image to be consistent with ART for 5.0 [#9713](https://github.com/openshift/hypershift/pull/9713)
* [OCPBUGS-126441](https://issues.redhat.com/browse/OCPBUGS-126441): openstack: Start populating cacert in clouds.yaml [#9655](https://github.com/openshift/hypershift/pull/9655)
* [OCPBUGS-123155](https://issues.redhat.com/browse/OCPBUGS-123155): complete GCP PD wiring in HyperShift [#9598](https://github.com/openshift/hypershift/pull/9598)
* [ACM-41684](https://issues.redhat.com/browse/ACM-41684): Switch hypershift-operator runtime to PQC base image [#9452](https://github.com/openshift/hypershift/pull/9452)
* [CNTRLPLANE-4159](https://issues.redhat.com/browse/CNTRLPLANE-4159): Maintain ingress serving cert for HostedCluster ingress [#9604](https://github.com/openshift/hypershift/pull/9604)
* [OCPBUGS-122276](https://issues.redhat.com/browse/OCPBUGS-122276): fix(hcco): run kas-connection-checker as non-root [#9694](https://github.com/openshift/hypershift/pull/9694)
* [ACM-41684](https://issues.redhat.com/browse/ACM-41684): Switch hypershift-operator runtime to PQC base image [#9590](https://github.com/openshift/hypershift/pull/9590)
* [OCPBUGS-112730](https://issues.redhat.com/browse/OCPBUGS-112730): fix(certs): normalize IP SANs to stop dual-stack KAS cert churn [#9495](https://github.com/openshift/hypershift/pull/9495)
* [OCPBUGS-122229](https://issues.redhat.com/browse/OCPBUGS-122229): filter AWS-reserved tag keys before calling DeleteTags [#9576](https://github.com/openshift/hypershift/pull/9576)
* [OCPBUGS-123150](https://issues.redhat.com/browse/OCPBUGS-123150): [release-5.0] [CNTRLPLANE-3626](https://redhat.atlassian.net/browse/CNTRLPLANE-3626): feat(ignition-server, ignition-server-proxy): inject centralized TLS configuration [#9408](https://github.com/openshift/hypershift/pull/9408)
* [OCPBUGS-123793](https://issues.redhat.com/browse/OCPBUGS-123793): Use multiarch CI build root on release-5.0 [#9633](https://github.com/openshift/hypershift/pull/9633)
* [Full changelog](https://github.com/openshift/hypershift/compare/93cce984163b400abfde05b67a0b7d5f3f589d4e...449f32ab51795e584f7cbc80653e5b4f1424b29c)


### [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver/tree/ff30ef526a2be17abd82d9c02f6dae9907c9d3f0)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#170](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/170)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver/compare/3a89d7d17d25727270414b07d3daaa3bc329d743...ff30ef526a2be17abd82d9c02f6dae9907c9d3f0)


### [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/tree/6f252012da7f6f27a08af2aae531288dbf871d15)

* [OCPBUGS-128798](https://issues.redhat.com/browse/OCPBUGS-128798): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#196](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/196)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/compare/be4fd01725ce5ab0b47f846c905a349aeee8ab53...6f252012da7f6f27a08af2aae531288dbf871d15)


### [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud/tree/76a37f0c259508d3c9d3bf2bead5a8b1953a5c82)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#188](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/188)
* [Full changelog](https://github.com/openshift/cluster-api-provider-ibmcloud/compare/3604a6c42f3002800e5cad2a012aacaf9b5f7405...76a37f0c259508d3c9d3bf2bead5a8b1953a5c82)


### [insights-operator](https://github.com/openshift/insights-operator/tree/7eb596a73b1e6f1c15fadc3c98078ddca6530a0a)

* [OCPBUGS-129610](https://issues.redhat.com/browse/OCPBUGS-129610): gather MaasModelRefs [#1386](https://github.com/openshift/insights-operator/pull/1386)
* [OCPBUGS-114055](https://issues.redhat.com/browse/OCPBUGS-114055): multiclusterhub gatherer [#1361](https://github.com/openshift/insights-operator/pull/1361)
* [OCPBUGS-122039](https://issues.redhat.com/browse/OCPBUGS-122039): add insights-runtime-extractor-scc missing fields [#1363](https://github.com/openshift/insights-operator/pull/1363)
* [Full changelog](https://github.com/openshift/insights-operator/compare/2f616dc436db2e35d70c9a049be98c185f684243...7eb596a73b1e6f1c15fadc3c98078ddca6530a0a)


### [insights-runtime-exporter, insights-runtime-extractor](https://github.com/openshift/insights-runtime-extractor/tree/49ce37d8a066388cd789fe1a3928ae03aa4209ff)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#93](https://github.com/openshift/insights-runtime-extractor/pull/93)
* [Full changelog](https://github.com/openshift/insights-runtime-extractor/compare/7c9aa14915e639edd20bc0869747487e2e73fe51...49ce37d8a066388cd789fe1a3928ae03aa4209ff)


### [ironic](https://github.com/openshift/ironic-image/tree/cde72492a445bdfdbc36cb5c15b869c76dedef60)

* [OCPBUGS-128481](https://issues.redhat.com/browse/OCPBUGS-128481): Fix SameFileError [#927](https://github.com/openshift/ironic-image/pull/927)
* [OCPBUGS-98475](https://issues.redhat.com/browse/OCPBUGS-98475): bump sushy to include fix [#918](https://github.com/openshift/ironic-image/pull/918)
* Bug OCPBUGS-123709: Bumping sushy hash to include jobstate fixes [#914](https://github.com/openshift/ironic-image/pull/914)
* [Full changelog](https://github.com/openshift/ironic-image/compare/1b55b61973edd01938783aa2c3cc22c9ea97dfa6...cde72492a445bdfdbc36cb5c15b869c76dedef60)


### [keepalived-ipfailover](https://github.com/openshift/images/tree/3f1cf0830f196a6755b8baf179fc0401188251c4)

* [OCPBUGS-87506](https://issues.redhat.com/browse/OCPBUGS-87506): Updating openshift-enterprise-keepalived-ipfailover-container image to be consistent with ART for 5.0 [#238](https://github.com/openshift/images/pull/238)
* [Full changelog](https://github.com/openshift/images/compare/13118bff15103b31a6528bf8de2d0d6de05f4742...3f1cf0830f196a6755b8baf179fc0401188251c4)


### [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server/tree/87f46bcece52a9690a4bf5684448e5ddb721d8e3)

* NO-ISSUE: synchronize OWNERS from main branch [release-5.0] [#87](https://github.com/openshift/kubernetes-metrics-server/pull/87)
* [Full changelog](https://github.com/openshift/kubernetes-metrics-server/compare/3d2e9cd0469d636e32dc0e4d4b6f65957eb27d71...87f46bcece52a9690a4bf5684448e5ddb721d8e3)


### [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy/tree/2f8a556d09638faeb09b366e95ecb75279ce7c8a)

* [OCPBUGS-128068](https://issues.redhat.com/browse/OCPBUGS-128068): Bump golang.org/x/net from v0.52.0 to v0.58.0 to resolve CVE-2026-39821 (release-5.0) [#164](https://github.com/openshift/kube-rbac-proxy/pull/164)
* [OCPBUGS-129318](https://issues.redhat.com/browse/OCPBUGS-129318): Address CVE-2026-29181 [#181](https://github.com/openshift/kube-rbac-proxy/pull/181)
* [Full changelog](https://github.com/openshift/kube-rbac-proxy/compare/43c114bc124f59e2fc3223dea8e0a8f4cdeed18d...2f8a556d09638faeb09b366e95ecb75279ce7c8a)


### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/f51eb63aea78184f30069ccbeaa2fa346dc9e88d)

* NO-ISSUE: synchronize OWNERS from main branch [release-5.0] [#183](https://github.com/openshift/kube-state-metrics/pull/183)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#170](https://github.com/openshift/kube-state-metrics/pull/170)
* [Full changelog](https://github.com/openshift/kube-state-metrics/compare/019ecc7d533333dfd3bf8893e78cd7ec6e282f01...f51eb63aea78184f30069ccbeaa2fa346dc9e88d)


### [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator/tree/236d1d76ab05fe757b53e722d10a0a920c1d49fd)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#264](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/264)
* [Full changelog](https://github.com/openshift/kubernetes-kube-storage-version-migrator/compare/05d6b0c4537954b2b115c793646fb598756bb303...236d1d76ab05fe757b53e722d10a0a920c1d49fd)


### [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt/tree/b15ad4848697562553150b0c7474004462fceab1)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#99](https://github.com/openshift/cloud-provider-kubevirt/pull/99)
* [Full changelog](https://github.com/openshift/cloud-provider-kubevirt/compare/5eb884abcd2ff17ae8d7b2691ca12494597c08a6...b15ad4848697562553150b0c7474004462fceab1)


### [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver/tree/05905d2f805968e1c86cb97b2be1440590a48ef3)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#120](https://github.com/openshift/kubevirt-csi-driver/pull/120)
* [Full changelog](https://github.com/openshift/kubevirt-csi-driver/compare/00dd0030fdfcdb6937ebefd8fb92363a8f78ef73...05905d2f805968e1c86cb97b2be1440590a48ef3)


### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/e700e7607f66e0ac74db3328955fe7d91dc4839d)

* [OCPBUGS-129504](https://issues.redhat.com/browse/OCPBUGS-129504): fix race in VAP MachineSet e2e test cleanup [#1575](https://github.com/openshift/machine-api-operator/pull/1575)
* [OCPBUGS-128566](https://issues.redhat.com/browse/OCPBUGS-128566): [release-5.0] Reduce vCenter API load in the vSphere machine controller [#1566](https://github.com/openshift/machine-api-operator/pull/1566)
* [OCPBUGS-125793](https://issues.redhat.com/browse/OCPBUGS-125793): Add opt-in kube-rbac-proxy sidecar for pprof endpoint (AWS) [#1556](https://github.com/openshift/machine-api-operator/pull/1556)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/b3cabb0301b12a2b256bf8aed85c3f4c7b0dab3c...e700e7607f66e0ac74db3328955fe7d91dc4839d)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/e3f6479a979898937cce9cbebf428823dae249fb)

* [OCPBUGS-129537](https://issues.redhat.com/browse/OCPBUGS-129537): Remove reverse (rhel10 to rhel9) OSStreams upgrade tests [#6639](https://github.com/openshift/machine-config-operator/pull/6639)
* [OCPBUGS-129431](https://issues.redhat.com/browse/OCPBUGS-129431): logout vCenter clients after use [#6635](https://github.com/openshift/machine-config-operator/pull/6635)
* [OCPBUGS-129374](https://issues.redhat.com/browse/OCPBUGS-129374): Fix layered OS updates on older nodes [#6632](https://github.com/openshift/machine-config-operator/pull/6632)
* [OCPBUGS-129269](https://issues.redhat.com/browse/OCPBUGS-129269): Boot image controller skips MachineSets that don't match any failure domain [#6628](https://github.com/openshift/machine-config-operator/pull/6628)
* [OCPBUGS-128927](https://issues.redhat.com/browse/OCPBUGS-128927): Filter cosign signature tags from the IRI release lookup [#6615](https://github.com/openshift/machine-config-operator/pull/6615)
* [OCPBUGS-127192](https://issues.redhat.com/browse/OCPBUGS-127192): Run nmstatectl format in nmstate-configuration [#6572](https://github.com/openshift/machine-config-operator/pull/6572)
* [OCPBUGS-127447](https://issues.redhat.com/browse/OCPBUGS-127447): Nodes created with 4.13 base images cannot join the cluster [#6580](https://github.com/openshift/machine-config-operator/pull/6580)
* [OCPBUGS-119104](https://issues.redhat.com/browse/OCPBUGS-119104): drop GCD health-check ranges in openshift-gcp-routes [#6555](https://github.com/openshift/machine-config-operator/pull/6555)
* [OCPBUGS-123664](https://issues.redhat.com/browse/OCPBUGS-123664): Correctly handle MC deletion in image mode when no new build is required [#6546](https://github.com/openshift/machine-config-operator/pull/6546)
* [OCPBUGS-122277](https://issues.redhat.com/browse/OCPBUGS-122277): Fix IsBootImageUpdateSupported to include vSphere and Azure platforms [#6530](https://github.com/openshift/machine-config-operator/pull/6530)
* [OCPBUGS-126703](https://issues.redhat.com/browse/OCPBUGS-126703): Add '..' block, max-length, and cross-store uniqueness [#6483](https://github.com/openshift/machine-config-operator/pull/6483)
* [OCPBUGS-122238](https://issues.redhat.com/browse/OCPBUGS-122238): [TNF] Add infinite retry on untaint systemd unit [#6553](https://github.com/openshift/machine-config-operator/pull/6553)
* [OCPBUGS-122915](https://issues.redhat.com/browse/OCPBUGS-122915): Mount /etc/container in mosb [#6537](https://github.com/openshift/machine-config-operator/pull/6537)
* [OCPBUGS-122217](https://issues.redhat.com/browse/OCPBUGS-122217): Dump compact cache to CM for persistence [#6525](https://github.com/openshift/machine-config-operator/pull/6525)
* [OCPBUGS-121942](https://issues.redhat.com/browse/OCPBUGS-121942): Replace wildcard permissions with explicit verbs in MachineConfigServer ClusterRole [#6514](https://github.com/openshift/machine-config-operator/pull/6514)
* [OCPBUGS-123672](https://issues.redhat.com/browse/OCPBUGS-123672): Pass missing proxy vars to bootstrap MCC [#6548](https://github.com/openshift/machine-config-operator/pull/6548)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/ec5cb6c3bcd7448f2b757ab951eafd2c46d677b9...e3f6479a979898937cce9cbebf428823dae249fb)


### [machine-os-images](https://github.com/openshift/machine-os-images/tree/631d5def9be9903585e92dcde6a877362f12586b)

* [OCPBUGS-127128](https://issues.redhat.com/browse/OCPBUGS-127128): [release-5.0] Fix OKD/SCOS builds to use centos CoreOS streams [#119](https://github.com/openshift/machine-os-images/pull/119)
* [Full changelog](https://github.com/openshift/machine-os-images/compare/bf618aac93c71a56e8249669c579f0a782742e2e...631d5def9be9903585e92dcde6a877362f12586b)


### [metallb-frr](https://github.com/openshift/frr/tree/f47b9e073cb4dc03d0b4259d711a156052185044)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#139](https://github.com/openshift/frr/pull/139)
* [Full changelog](https://github.com/openshift/frr/compare/54a6ea48902d81460536b81ea6bdceb89c12e622...f47b9e073cb4dc03d0b4259d711a156052185044)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/bde909332b62f154573dcf93dcf206f05c0dfd27)

* [OCPBUGS-119704](https://issues.redhat.com/browse/OCPBUGS-119704): Bump fast-uri to fix CVE-2026-84292 [#1332](https://github.com/openshift/monitoring-plugin/pull/1332)
* [OU-1600](https://issues.redhat.com/browse/OU-1600): fix: sort agentic runs by created to avoid getting stalled runs related to alerts [#1327](https://github.com/openshift/monitoring-plugin/pull/1327)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#1307](https://github.com/openshift/monitoring-plugin/pull/1307)
* NO-JIRA: [release-5.0] Sanitize alert runbook URLs [#1290](https://github.com/openshift/monitoring-plugin/pull/1290)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/97c9a8384e5d7fe92d9b1bc4dc8c676b6bc78eff...bde909332b62f154573dcf93dcf206f05c0dfd27)


### [multus-route-override-cni](https://github.com/openshift/route-override-cni/tree/0c111164a2c5c7f315aa58f257b7fa862e1c6b51)

* NO-JIRA: Update CI builders to Go 1.26 [#82](https://github.com/openshift/route-override-cni/pull/82)
* [Full changelog](https://github.com/openshift/route-override-cni/compare/375ac966115fd03febd218a8331e8794560bd28e...0c111164a2c5c7f315aa58f257b7fa862e1c6b51)


### [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni/tree/77810eb02c634bee98b8bda17adb6adf69716d02)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#437](https://github.com/openshift/whereabouts-cni/pull/437)
* NO-JIRA: Update CI builders to Go 1.26 [#436](https://github.com/openshift/whereabouts-cni/pull/436)
* [Full changelog](https://github.com/openshift/whereabouts-cni/compare/4b0c2166726247e36a0125432609844045e48dc3...77810eb02c634bee98b8bda17adb6adf69716d02)


### [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon/tree/82a60353740a54e16ae88e9cbd963a00f7f74a33)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#159](https://github.com/openshift/network-metrics-daemon/pull/159)
* [Full changelog](https://github.com/openshift/network-metrics-daemon/compare/20e6b987ea44e7cf0805662e8fec44d625b6f278...82a60353740a54e16ae88e9cbd963a00f7f74a33)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/567d89b0d3e357b43733ce4c4cb67cd33137ae13)

* [OCPNETUI-146](https://issues.redhat.com/browse/OCPNETUI-146): dependency cleanup [#590](https://github.com/openshift/networking-console-plugin/pull/590)
* [OCPNETUI-146](https://issues.redhat.com/browse/OCPNETUI-146): reassign dev and prod dependencies [#583](https://github.com/openshift/networking-console-plugin/pull/583)
* maintenance: Bump the npm group with 26 updates [#577](https://github.com/openshift/networking-console-plugin/pull/577)
* maintenance: Bump the npm group across 1 directory with 16 updates [#562](https://github.com/openshift/networking-console-plugin/pull/562)
* [OCPNETUI-146](https://issues.redhat.com/browse/OCPNETUI-146): Align shared modules with Console [#560](https://github.com/openshift/networking-console-plugin/pull/560)
* maintenance: Bump the npm group with 10 updates [#547](https://github.com/openshift/networking-console-plugin/pull/547)
* maintenance: Bump the npm group across 1 directory with 216 updates [#542](https://github.com/openshift/networking-console-plugin/pull/542)
* maintenance: Bump terser-webpack-plugin from 5.4.0 to 5.6.1 [#531](https://github.com/openshift/networking-console-plugin/pull/531)
* maintenance: Bump loader-runner from 4.3.1 to 4.3.2 [#530](https://github.com/openshift/networking-console-plugin/pull/530)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/4509d691e67664e9b3a911278fcbf38d54bb9cfc...567d89b0d3e357b43733ce4c4cb67cd33137ae13)


### [nutanix-cloud-controller-manager](https://github.com/openshift/cloud-provider-nutanix/tree/8c2be29f4939788e2dff59f00e6be8d2225897cc)

* [OCPBUGS-104356](https://issues.redhat.com/browse/OCPBUGS-104356): Bump golang.org/x/net to v0.58.0 to address CVE-2026-33814 [#72](https://github.com/openshift/cloud-provider-nutanix/pull/72)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#86](https://github.com/openshift/cloud-provider-nutanix/pull/86)
* [Full changelog](https://github.com/openshift/cloud-provider-nutanix/compare/dc584c6b2e895a6217f9e2dbed765209af1898a1...8c2be29f4939788e2dff59f00e6be8d2225897cc)


### [oauth-apiserver](https://github.com/openshift/oauth-apiserver/tree/a59e07d789b5a2531e94053cfe7c53edde90e931)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Update build-machinery-go vendor dependency [#229](https://github.com/openshift/oauth-apiserver/pull/229)
* [Full changelog](https://github.com/openshift/oauth-apiserver/compare/bcd5f6fecb809a315e10502b977d2e18a45f756c...a59e07d789b5a2531e94053cfe7c53edde90e931)


### [oauth-proxy](https://github.com/openshift/oauth-proxy/tree/f4fb9013872724cf5ab5874904dcc41b40b48c66)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#391](https://github.com/openshift/oauth-proxy/pull/391)
* [ACM-37203](https://issues.redhat.com/browse/ACM-37203): Add support for configurable TLS profiles [#380](https://github.com/openshift/oauth-proxy/pull/380)
* [Full changelog](https://github.com/openshift/oauth-proxy/compare/310d2f7b90762b407d6100eb3940bd5b2f348108...f4fb9013872724cf5ab5874904dcc41b40b48c66)


### [oauth-server](https://github.com/openshift/oauth-server/tree/e1a28882b283cf0be80628c7aaae83cb9020afd0)

* [OCPBUGS-127499](https://issues.redhat.com/browse/OCPBUGS-127499): Add high contrast support to oauth templates [#286](https://github.com/openshift/oauth-server/pull/286)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Update build-machinery-go vendor dependency [#261](https://github.com/openshift/oauth-server/pull/261)
* [Full changelog](https://github.com/openshift/oauth-server/compare/ba7cdda479958ce73517b546f81ed8d4998d318d...e1a28882b283cf0be80628c7aaae83cb9020afd0)


### [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics/tree/e2b0875109bf6b4c1dd5695c7afc0324669be0b4)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#141](https://github.com/openshift/openshift-state-metrics/pull/141)
* [Full changelog](https://github.com/openshift/openshift-state-metrics/compare/3b4ea3e753d97fea66e0f52c8282a711358b4ff7...e2b0875109bf6b4c1dd5695c7afc0324669be0b4)


### [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack/tree/52fb27200e4f95c0faf8b6472c81382e9d3b728c)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#192](https://github.com/openshift/machine-api-provider-openstack/pull/192)
* [Full changelog](https://github.com/openshift/machine-api-provider-openstack/compare/6b30092b0a1196b016f4300b79c895f0e7f2e9a8...52fb27200e4f95c0faf8b6472c81382e9d3b728c)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/42d40a0557e403ca93f7ae90b63dd3827c513f0b)

* [OCPBUGS-128643](https://issues.redhat.com/browse/OCPBUGS-128643): EIP duplicate MAC race during node shutdown [#3489](https://github.com/openshift/ovn-kubernetes/pull/3489)
* [OCPBUGS-122282](https://issues.redhat.com/browse/OCPBUGS-122282): egressip: set IFA_PROTO on EgressIP addresses to prevent nmstate persistence [#3437](https://github.com/openshift/ovn-kubernetes/pull/3437)
* [OCPBUGS-127013](https://issues.redhat.com/browse/OCPBUGS-127013): [release-5.0] e2e: exclude machine network subnets from UDN/BGP allocators [#3466](https://github.com/openshift/ovn-kubernetes/pull/3466)
* [OCPBUGS-122287](https://issues.redhat.com/browse/OCPBUGS-122287): Fix wrong infrastructure-locked role when namespace is missing [#3438](https://github.com/openshift/ovn-kubernetes/pull/3438)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/7b4de5ed3bd4381e3a17cdfddbe14be1432b9860...42d40a0557e403ca93f7ae90b63dd3827c513f0b)


### [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/tree/eda65d2c294355914b10b491f4d3d6b93931c27f)

* [OCPBUGS-128798](https://issues.redhat.com/browse/OCPBUGS-128798): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#126](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/126)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/compare/f90431bfe8ca93850450b2b24fae152d2385ca08...eda65d2c294355914b10b491f4d3d6b93931c27f)


### [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs/tree/412a7c3b090cf1b5846da3a4ff27bdef528a7062)

* [OCPBUGS-108069](https://issues.redhat.com/browse/OCPBUGS-108069): Bump otel to address CVE-2026-41178 [#112](https://github.com/openshift/cloud-provider-powervs/pull/112)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#113](https://github.com/openshift/cloud-provider-powervs/pull/113)
* [OCPBUGS-101730](https://issues.redhat.com/browse/OCPBUGS-101730), [OCPBUGS-104390](https://issues.redhat.com/browse/OCPBUGS-104390), [OCPBUGS-108069](https://issues.redhat.com/browse/OCPBUGS-108069): Bump x/net to address CVEs [#111](https://github.com/openshift/cloud-provider-powervs/pull/111)
* [Full changelog](https://github.com/openshift/cloud-provider-powervs/compare/18eb5238fb2c86632edb24175f536d815f28ddf6...412a7c3b090cf1b5846da3a4ff27bdef528a7062)


### [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs/tree/693963340a62fc986c8de5d4de76ff9fd66a53ae)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#151](https://github.com/openshift/machine-api-provider-powervs/pull/151)
* [OCPBUGS-113646](https://issues.redhat.com/browse/OCPBUGS-113646): Update dependencies to k8s 1.36 [#148](https://github.com/openshift/machine-api-provider-powervs/pull/148)
* [Full changelog](https://github.com/openshift/machine-api-provider-powervs/compare/28c928ff78def160837170991f084b0fe71ca9be...693963340a62fc986c8de5d4de76ff9fd66a53ae)


### [prom-label-proxy](https://github.com/openshift/prom-label-proxy/tree/6a214d5e8a141eb8a07e74d1cdb8a9a80be22015)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#414](https://github.com/openshift/prom-label-proxy/pull/414)
* NO-ISSUE: synchronize OWNERS from main branch [release-5.0] [#410](https://github.com/openshift/prom-label-proxy/pull/410)
* [Full changelog](https://github.com/openshift/prom-label-proxy/compare/4ab9ff73c665319352288fe0b9b9e1df71832525...6a214d5e8a141eb8a07e74d1cdb8a9a80be22015)


### [prometheus](https://github.com/openshift/prometheus/tree/127adf44c2af0612f812594fd10a9e06392146ed)

* NO-ISSUE: synchronize OWNERS from main branch [#392](https://github.com/openshift/prometheus/pull/392)
* [Full changelog](https://github.com/openshift/prometheus/compare/01d8335673aa6f88f5742ef510e133efee88a7bf...127adf44c2af0612f812594fd10a9e06392146ed)


### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/7c923dc6e56f150807d8f643da8357d315415c7f)

* NO-JIRA: synchronize OWNERS with main [#194](https://github.com/openshift/prometheus-alertmanager/pull/194)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#187](https://github.com/openshift/prometheus-alertmanager/pull/187)
* [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/89bdff8b5b885e4a3d0f7d0327fe39221f3d2dce...7c923dc6e56f150807d8f643da8357d315415c7f)


### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/ae80a6d76915cb4461533c270cd580604049eb22)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#213](https://github.com/openshift/node_exporter/pull/213)
* NO-ISSUE: synchronize OWNERS from main branch [release-5.0] [#211](https://github.com/openshift/node_exporter/pull/211)
* [Full changelog](https://github.com/openshift/node_exporter/compare/b8af472104ce559c8fb9bf31fd4fc38bdbdc34e7...ae80a6d76915cb4461533c270cd580604049eb22)


### [telemeter](https://github.com/openshift/telemeter/tree/5eb6dff8fd9d22d61b33df7af0af51f57fc2eebb)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Remove unintended tools/vendor from release-5.0 [#627](https://github.com/openshift/telemeter/pull/627)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#623](https://github.com/openshift/telemeter/pull/623)
* [Full changelog](https://github.com/openshift/telemeter/compare/22ba1701333f3fd26490cc15b89ddf21df3f67f6...5eb6dff8fd9d22d61b33df7af0af51f57fc2eebb)


### [tests](https://github.com/openshift/origin/tree/85031f79aef4e26808f9358f78766c75fea4f9a7)

* [OCPBUGS-128800](https://issues.redhat.com/browse/OCPBUGS-128800): assert PHC recovery after network disruption instead of logging it [#31690](https://github.com/openshift/origin/pull/31690)
* [OCPBUGS-128791](https://issues.redhat.com/browse/OCPBUGS-128791): Improve TNF recovery test stability: AfterEach cleanup, migration-threshold, east-west fixes [#31693](https://github.com/openshift/origin/pull/31693)
* [OCPBUGS-127449](https://issues.redhat.com/browse/OCPBUGS-127449): Make operator log scraper and monitor tests topology-aware [#31671](https://github.com/openshift/origin/pull/31671)
* [OCPBUGS-128380](https://issues.redhat.com/browse/OCPBUGS-128380): Add CSI storage test for pod delete after host umount of mounted volume [#31670](https://github.com/openshift/origin/pull/31670)
* [OCPBUGS-127400](https://issues.redhat.com/browse/OCPBUGS-127400): Redact OAuth tokens from test cleanup logs [#31668](https://github.com/openshift/origin/pull/31668)
* [OCPBUGS-127419](https://issues.redhat.com/browse/OCPBUGS-127419): Fix node replacement test timestamp filter and allow job retry [#31577](https://github.com/openshift/origin/pull/31577)
* [OCPBUGS-123600](https://issues.redhat.com/browse/OCPBUGS-123600): Register cluster-baremetal-tests-ext in extension registry [#31641](https://github.com/openshift/origin/pull/31641)
* [[release-5.0] OCPBUGS-121193: Fixed Flakiness of Webhook test - ClusterResourceQuota validation](https://github.com/openshift/origin/pull/31642#top) [#31642](https://github.com/openshift/origin/pull/31642)
* And 3 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/origin/compare/83ec78e3c4eece275f65229c420b211a427edde3...85031f79aef4e26808f9358f78766c75fea4f9a7)


### [thanos](https://github.com/openshift/thanos/tree/d0cde96c8decc617bbb4b221741d659cb09dc183)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#216](https://github.com/openshift/thanos/pull/216)
* [Full changelog](https://github.com/openshift/thanos/compare/2a09eb84b92ccd71d5f1f11e0dda6d5aa9624e19...d0cde96c8decc617bbb4b221741d659cb09dc183)


### [volume-data-source-validator](https://github.com/openshift/volume-data-source-validator/tree/42a87e53d18314300ffc1d91845f2667ea3812a7)

* [OCPBUGS-104423](https://issues.redhat.com/browse/OCPBUGS-104423): Bump golang.org/x/net to version 0.57.0 that fixes CVE-2026-33814 [#18](https://github.com/openshift/volume-data-source-validator/pull/18)
* [Full changelog](https://github.com/openshift/volume-data-source-validator/compare/ee9cd7aba4e096a9a957386ef20777e8950df352...42a87e53d18314300ffc1d91845f2667ea3812a7)


### [vsphere-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-vsphere/tree/26421b3ebde423b80f50350b51907f28a9346ead)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#129](https://github.com/openshift/cluster-api-provider-vsphere/pull/129)
* [Full changelog](https://github.com/openshift/cluster-api-provider-vsphere/compare/557fdf1a9a3540d9aa8f3a81e4a950673a416a80...26421b3ebde423b80f50350b51907f28a9346ead)


### [vsphere-csi-driver, vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver/tree/595da68887893073d28ca736b2a0c6ab1b8e0d97)

* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Bump google.golang.org/protobuf to v1.36.12 [#212](https://github.com/openshift/vmware-vsphere-csi-driver/pull/212)
* [OCPBUGS-126888](https://issues.redhat.com/browse/OCPBUGS-126888): Fix credential exposure in logs (CWE-532) [#203](https://github.com/openshift/vmware-vsphere-csi-driver/pull/203)
* [OCPBUGS-126711](https://issues.redhat.com/browse/OCPBUGS-126711): UPSTREAM: 4272: Fix crash in syncer when node can't be found [#202](https://github.com/openshift/vmware-vsphere-csi-driver/pull/202)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver/compare/6b18bb29fc45383c21aa6c7513d151e443aa305e...595da68887893073d28ca736b2a0c6ab1b8e0d97)


### [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator/tree/bb8cb2770fe6e99080ad4ea919e389923408617a)

* [OCPBUGS-128798](https://issues.redhat.com/browse/OCPBUGS-128798): Unresolved ${TLS_CIPHER_SUITES} for Custom TLS 1.3 profile [#369](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/369)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver-operator/compare/aa27946700642a9c8e518e130673097b38a2f8bb...bb8cb2770fe6e99080ad4ea919e389923408617a)