What's Changed
- PROJQUAY-11677: fix(cve): CVE-2026-48526 - PyJWT [redhat-3.17] by @aroyoredhat in #6106
- [redhat-3.17] NO-ISSUE: chore(test): backport Playwright tests from master by @jbpratt in #6117
- [redhat-3.17] PROJQUAY-11689: oci: Fix lazy manifest loader for OCI images to properly accept mixed indexes by @openshift-cherrypick-robot in #6122
- [redhat-3.17] PROJQUAY-11598: fix(cve): CVE-2026-44432 - urllib3 by @aroyoredhat in #6081
- [redhat-3.17] PROJQUAY-11583: feat(test): add geo-replication e2e testing with Garage S3 by @openshift-cherrypick-robot in #6051
- [redhat-3.17] NO-ISSUE: test(auth): add LDAP team sync Playwright E2E tests by @openshift-cherrypick-robot in #6138
- [redhat-3.17] NO-ISSUE: fix(playwright): use networkidle to fix flaky ui-toggle test by @openshift-cherrypick-robot in #6125
- [redhat-3.17] NO-ISSUE: fix(test): fix flaky geo-rep and LDAP sync Playwright tests by @jbpratt in #6139
- [redhat-3.17] NO-ISSUE: feat(buildman): enable container builds in CI with PopenExecutor by @jbpratt in #6140
- [redhat-3.17] PROJQUAY-11723: test(playwright/notifications): add build notification delivery tests by @openshift-cherrypick-robot in #6141
- [redhat-3.17] NO-ISSUE: chore(web): remove Cypress and all associated infrastructure by @jbpratt in #6142
- [redhat-3.17] PROJQUAY-11692: fix(superuser): fix BuildTrigger.to_dict() AttributeError and BuildLogs loading race by @openshift-cherrypick-robot in #6147
- [redhat-3.17] PROJQUAY-11688: gc: Optimize deletion queries by @openshift-cherrypick-robot in #6149
- [redhat-3.17] PROJQUAY-11764: chore(web): bump axios to 1.16.1 by @nindsimonv in #6173
- PROJQUAY-11735: fix(cve): CVE-2026-9277 - shell-quote by @aroyoredhat in #6168
- [redhat-3.17] PROJQUAY-11718: fix(cve): CVE-2026-10143 - kafka-python bump by @openshift-cherrypick-robot in #6193
- PROJQUAY-11665: fix(cve): CVE-2026-6322 - FastUri by @namansharma18899 in #6166
- [redhat-3.17] NO-ISSUE: fix(test): isolate autoprune user-namespace tests with freshUser fixture by @openshift-cherrypick-robot in #6201
- [redhat-3.17] NO-ISSUE: fix(test): make builds sort test resilient to identical timestamps by @openshift-cherrypick-robot in #6202
- [redhat-3.17] PROJQUAY-11947: test(e2e): add real export delivery tests for usage logs by @openshift-cherrypick-robot in #6227
- [redhat-3.17] PROJQUAY-11855: permissions: Optimize loading of permissions on UI login by @ibazulic in #6229
- [redhat-3.17] NO-ISSUE: chore(config-tool): update Go base image to 1.25.11-alpine3.24 by @openshift-cherrypick-robot in #6243
- [redhat-3.17] NO-ISSUE: fix(test): click sort button inside column header in builds test by @openshift-cherrypick-robot in #6242
- [redhat-3.17] PROJQUAY-11956: fix(web): disable quota fetch when feature is off by @openshift-cherrypick-robot in #6238
- [redhat-3.17] PROJQUAY-12000: fix(config-tool): s3 validator always uses https matching python backend by @openshift-cherrypick-robot in #6245
- [redhat-3.17] PROJQUAY-11712: deps: Bump golang.org/x/net to version 0.55.0 by @openshift-cherrypick-robot in #6239
- [redhat-3.17] PROJQUAY-11872: fix(cve): CVE-2026-12143 - form-data by @aroyoredhat in #6250
- [redhat-3.17] NO-ISSUE: test(mailpit): override api url by @openshift-cherrypick-robot in #6264
- PROJQUAY-11712: chore(deps): update go version to 1.25.0 by @alexissolanas in #6305
- [redhat-3.17] PROJQUAY-12080: fix(cve): CVE-2026-13676 - FastUri by @openshift-cherrypick-robot in #6337
- [redhat-3.17] PROJQUAY-11963: deps: bump sanitize-html to 2.17.5 by @redhat-chai-bot in #6354
- [redhat-3.17] NO-ISSUE: fix: prevent deadlock in test_has_garbage under parallel execution (PROJQUAY-11089) by @openshift-cherrypick-robot in #6232
- [redhat-3.17] NO-ISSUE: ci: move vpc sg rule cleanup to dedicated workflow job by @openshift-cherrypick-robot in #6206
- [redhat-3.17] NO-ISSUE: test(playwright): align container helper context by @jbpratt in #6411
- [redhat-3.17] NO-ISSUE: test(playwright): replace podman image helpers by @openshift-cherrypick-robot in #6412
- [redhat-3.17] PROJQUAY-11180: fix(proxy): prevent SSRF in proxy cache upstream registry configuration by @nindsimonv in #6413
- [redhat-3.17] NO-ISSUE: fix(web): regenerate package-lock.json with resolved URLs by @redhat-chai-bot in #6423
- [redhat-3.17] NO-ISSUE: fix(playwright): update BUSYBOX_IMAGE to valid digest by @openshift-cherrypick-robot in #6550
- [redhat-3.17] PROJQUAY-12317,PROJQUAY-12276: chore(deps): upgrade pyasn1 from 0.6.3 to 0.6.4 to address CVE-2026-59885,CVE-2026-59886 by @rhdmalone in #6567
- [redhat-3.17] PROJQUAY-12227: fix(ui): correct same repo name tag breadcrumb paths by @openshift-cherrypick-robot in #6518
- [redhat-3.17] PROJQUAY-12333: chore(deps): Bump pillow to 12.3.0 by @nindsimonv in #6618
- [redhat-3.17] PROJQUAY-12393: fix(ui): match domainRoute keywords as path segments by @openshift-cherrypick-robot in #6636
- [redhat-3.17] PROJQUAY-12416: fix(mirroring): use separate authfiles for same-registry mirror by @openshift-cherrypick-robot in #6670
- [redhat-3.17] PROJQUAY-12424: chore(deps): override js-yaml to address CVE-2026-59869 by @openshift-cherrypick-robot in #6674
- PROJQUAY-12402: chore(deps): override brace-expansion to address CVE-2026-13149 by @namansharma18899 in #6691
- v3.17.4 Changelog Bump by @github-actions[bot] in #6694
- PROJQUAY-12355: fix(mirroring): prevent SSRF in repository sources by @redhat-chai-bot in #6725
Full Changelog: v3.17.3...v3.17.4