diff --git a/Makefile.kube_git.var b/Makefile.kube_git.var
index 1078fae892..4f534e2151 100644
--- a/Makefile.kube_git.var
+++ b/Makefile.kube_git.var
@@ -1,5 +1,5 @@
 KUBE_GIT_MAJOR=1
 KUBE_GIT_MINOR=31
-KUBE_GIT_VERSION=v1.31.11
-KUBE_GIT_COMMIT=3c7968e741684de8dc08ebc8aef1890b099eccae
+KUBE_GIT_VERSION=v1.31.12
+KUBE_GIT_COMMIT=a4cad449903ebc0483194289514d09f1deac1b66
 KUBE_GIT_TREE_STATE=clean
diff --git a/Makefile.version.aarch64.var b/Makefile.version.aarch64.var
index 194b295bdd..225a419342 100644
--- a/Makefile.version.aarch64.var
+++ b/Makefile.version.aarch64.var
@@ -1 +1 @@
-OCP_VERSION := 4.18.0-0.nightly-arm64-2025-09-03-045711
+OCP_VERSION := 4.18.0-0.nightly-arm64-2025-09-10-195319
diff --git a/Makefile.version.x86_64.var b/Makefile.version.x86_64.var
index e310792375..ec7b69a2db 100644
--- a/Makefile.version.x86_64.var
+++ b/Makefile.version.x86_64.var
@@ -1 +1 @@
-OCP_VERSION := 4.18.0-0.nightly-2025-09-03-101304
+OCP_VERSION := 4.18.0-0.nightly-2025-09-10-135328
diff --git a/assets/controllers/kube-apiserver/defaultconfig.yaml b/assets/controllers/kube-apiserver/defaultconfig.yaml
index b69a1ae3a1..abbaceeb0a 100644
--- a/assets/controllers/kube-apiserver/defaultconfig.yaml
+++ b/assets/controllers/kube-apiserver/defaultconfig.yaml
@@ -120,7 +120,7 @@ apiServerArguments:
   event-ttl:
     - 3h
   goaway-chance:
-    - "0"
+    - "0.001"
   http2-max-streams-per-connection:
     - "2000" # recommended is 1000, but we need to mitigate https://github.com/kubernetes/kubernetes/issues/74412
   kubelet-certificate-authority:
diff --git a/assets/optional/multus/kustomization.aarch64.yaml b/assets/optional/multus/kustomization.aarch64.yaml
index 627a97d75d..982682865a 100644
--- a/assets/optional/multus/kustomization.aarch64.yaml
+++ b/assets/optional/multus/kustomization.aarch64.yaml
@@ -2,7 +2,7 @@
 images:
   - name: multus-cni-microshift
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:016753501f4be4bf083dd23a9bee607dcb458c4662fa3ac7898e08158f2f8c3a
+    digest: sha256:4896acd7055402c8d270fe7ff6fc30804978f6488052d9331fb94a9e0da3a58d
   - name: containernetworking-plugins-microshift
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:3c78e13ec0fd31e80ccf2b3f4b08df9efb7854739c9e5d75a9f6572d81c5b4b4
+    digest: sha256:d789325b82fe8545c0ee4bbaf28e75287ce358c4ae6638866648bae63ab256eb
diff --git a/assets/optional/multus/kustomization.x86_64.yaml b/assets/optional/multus/kustomization.x86_64.yaml
index 4310242a07..2812b5f5d9 100644
--- a/assets/optional/multus/kustomization.x86_64.yaml
+++ b/assets/optional/multus/kustomization.x86_64.yaml
@@ -2,7 +2,7 @@
 images:
   - name: multus-cni-microshift
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:ca78cad82282a70210b26c6781b9f86d6d18a62980d09c20e62e5e3592ccad1e
+    digest: sha256:32c341c90bc3bce981e83b143183bf7ee635d735fcdfdb8f6663bff629634049
   - name: containernetworking-plugins-microshift
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:545547b6c5226b309cd9cc577c0b91759d542e58f2bd60bfe00b15164a30b007
+    digest: sha256:ddf10104213897ba1fcadf2c66156c1aaa065cf58b027935a6aecb25b1a4c4f7
diff --git a/assets/optional/multus/release-multus-aarch64.json b/assets/optional/multus/release-multus-aarch64.json
index 1d9a90aecb..c0cb44c676 100644
--- a/assets/optional/multus/release-multus-aarch64.json
+++ b/assets/optional/multus/release-multus-aarch64.json
@@ -1,9 +1,9 @@
 {
   "release": {
-    "base": "4.18.0-0.nightly-arm64-2025-09-03-045711"
+    "base": "4.18.0-0.nightly-arm64-2025-09-10-195319"
   },
   "images": {
-    "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:016753501f4be4bf083dd23a9bee607dcb458c4662fa3ac7898e08158f2f8c3a",
-    "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3c78e13ec0fd31e80ccf2b3f4b08df9efb7854739c9e5d75a9f6572d81c5b4b4"
+    "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:4896acd7055402c8d270fe7ff6fc30804978f6488052d9331fb94a9e0da3a58d",
+    "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:d789325b82fe8545c0ee4bbaf28e75287ce358c4ae6638866648bae63ab256eb"
   }
 }
diff --git a/assets/optional/multus/release-multus-x86_64.json b/assets/optional/multus/release-multus-x86_64.json
index 05c9f7cdfa..6870febd51 100644
--- a/assets/optional/multus/release-multus-x86_64.json
+++ b/assets/optional/multus/release-multus-x86_64.json
@@ -1,9 +1,9 @@
 {
   "release": {
-    "base": "4.18.0-0.nightly-2025-09-03-101304"
+    "base": "4.18.0-0.nightly-2025-09-10-135328"
   },
   "images": {
-    "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:ca78cad82282a70210b26c6781b9f86d6d18a62980d09c20e62e5e3592ccad1e",
-    "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:545547b6c5226b309cd9cc577c0b91759d542e58f2bd60bfe00b15164a30b007"
+    "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:32c341c90bc3bce981e83b143183bf7ee635d735fcdfdb8f6663bff629634049",
+    "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:ddf10104213897ba1fcadf2c66156c1aaa065cf58b027935a6aecb25b1a4c4f7"
   }
 }
diff --git a/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml b/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml
index b9824c18ab..d567136e3d 100644
--- a/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml
+++ b/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml
@@ -2,13 +2,13 @@
 images:
   - name: quay.io/operator-framework/olm
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:91e28ef615d50aa6c72987991cd10b6f231419d356bda0783049e76b10ceb0ec
+    digest: sha256:5cf671637d8747c0c5c53c3342e30ea721e683e5cad51a627ad76a0687b6a286
   - name: quay.io/operator-framework/configmap-operator-registry
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:a8b3b7e6e540ba8ceb03d86638f6b53319db3465088e0372ef5309eebfec0fb4
+    digest: sha256:a34145f99c43f6eaa33d90ca5ded31709e70532e2bf2af699837c98041309f17
   - name: quay.io/openshift/origin-kube-rbac-proxy
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:e4d2928509a1b0daf46038b10a549e54df7d21810eee98b4a1c81ffe592a0e35
+    digest: sha256:5a32438138f59921a5124dec8f5fb2bc15dc21d69c8179d43e49fb54a6cd1a79
 
 patches:
   - patch: |-
@@ -16,12 +16,12 @@ patches:
        path: /spec/template/spec/containers/0/env/-
        value:
          name: OPERATOR_REGISTRY_IMAGE
-         value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a8b3b7e6e540ba8ceb03d86638f6b53319db3465088e0372ef5309eebfec0fb4
+         value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a34145f99c43f6eaa33d90ca5ded31709e70532e2bf2af699837c98041309f17
      - op: add
        path: /spec/template/spec/containers/0/env/-
        value:
          name: OLM_IMAGE
-         value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:91e28ef615d50aa6c72987991cd10b6f231419d356bda0783049e76b10ceb0ec
+         value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:5cf671637d8747c0c5c53c3342e30ea721e683e5cad51a627ad76a0687b6a286
     target:
       kind: Deployment
       labelSelector: app=catalog-operator
diff --git a/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml b/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml
index eaed8cce8c..dbb875b7cd 100644
--- a/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml
+++ b/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml
@@ -2,13 +2,13 @@
 images:
   - name: quay.io/operator-framework/olm
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:b0711dd038e6c5b557797b40fd8896a5dfa708fafa0df5bd10fa67ea9f33a6ae
+    digest: sha256:f1547e9e79b1a63fc594687f88ba87f65b0d8cec9ef93c7df50f4a234f63ce33
   - name: quay.io/operator-framework/configmap-operator-registry
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:ec79bd4481898e4467d2e5f32d05662908936b06cd3f7ef1420a98c6f0a4e1f7
+    digest: sha256:506a711a325eb0f454232dbb1e538af4797f04ec3071f0fa407c8d712a9211c2
   - name: quay.io/openshift/origin-kube-rbac-proxy
     newName: quay.io/openshift-release-dev/ocp-v4.0-art-dev
-    digest: sha256:05ea4625eec55253f86b454dec2742638bd4f4993d2ba0d5422e8d7beaef864b
+    digest: sha256:0470599a9a0cb7e570b2e9169d59a9358d6304072260cee85312df8197a46283
 
 patches:
   - patch: |-
@@ -16,12 +16,12 @@ patches:
        path: /spec/template/spec/containers/0/env/-
        value:
          name: OPERATOR_REGISTRY_IMAGE
-         value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:ec79bd4481898e4467d2e5f32d05662908936b06cd3f7ef1420a98c6f0a4e1f7
+         value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:506a711a325eb0f454232dbb1e538af4797f04ec3071f0fa407c8d712a9211c2
      - op: add
        path: /spec/template/spec/containers/0/env/-
        value:
          name: OLM_IMAGE
-         value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:b0711dd038e6c5b557797b40fd8896a5dfa708fafa0df5bd10fa67ea9f33a6ae
+         value: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f1547e9e79b1a63fc594687f88ba87f65b0d8cec9ef93c7df50f4a234f63ce33
     target:
       kind: Deployment
       labelSelector: app=catalog-operator
diff --git a/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json b/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json
index 75cc7575fc..fe45e6f4d4 100644
--- a/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json
+++ b/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json
@@ -1,10 +1,10 @@
 {
   "release": {
-    "base": "4.18.0-0.nightly-arm64-2025-09-03-045711"
+    "base": "4.18.0-0.nightly-arm64-2025-09-10-195319"
   },
   "images": {
-    "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:91e28ef615d50aa6c72987991cd10b6f231419d356bda0783049e76b10ceb0ec",
-    "operator-registry": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a8b3b7e6e540ba8ceb03d86638f6b53319db3465088e0372ef5309eebfec0fb4",
-    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:e4d2928509a1b0daf46038b10a549e54df7d21810eee98b4a1c81ffe592a0e35"
+    "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:5cf671637d8747c0c5c53c3342e30ea721e683e5cad51a627ad76a0687b6a286",
+    "operator-registry": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a34145f99c43f6eaa33d90ca5ded31709e70532e2bf2af699837c98041309f17",
+    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:5a32438138f59921a5124dec8f5fb2bc15dc21d69c8179d43e49fb54a6cd1a79"
   }
 }
diff --git a/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json b/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json
index 80294f5970..0d30ca228c 100644
--- a/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json
+++ b/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json
@@ -1,10 +1,10 @@
 {
   "release": {
-    "base": "4.18.0-0.nightly-2025-09-03-101304"
+    "base": "4.18.0-0.nightly-2025-09-10-135328"
   },
   "images": {
-    "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:b0711dd038e6c5b557797b40fd8896a5dfa708fafa0df5bd10fa67ea9f33a6ae",
-    "operator-registry": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:ec79bd4481898e4467d2e5f32d05662908936b06cd3f7ef1420a98c6f0a4e1f7",
-    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:05ea4625eec55253f86b454dec2742638bd4f4993d2ba0d5422e8d7beaef864b"
+    "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f1547e9e79b1a63fc594687f88ba87f65b0d8cec9ef93c7df50f4a234f63ce33",
+    "operator-registry": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:506a711a325eb0f454232dbb1e538af4797f04ec3071f0fa407c8d712a9211c2",
+    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:0470599a9a0cb7e570b2e9169d59a9358d6304072260cee85312df8197a46283"
   }
 }
diff --git a/assets/release/release-aarch64.json b/assets/release/release-aarch64.json
index 2a9087163b..7ec0560ae1 100644
--- a/assets/release/release-aarch64.json
+++ b/assets/release/release-aarch64.json
@@ -1,16 +1,16 @@
 {
   "release": {
-    "base": "4.18.0-0.nightly-arm64-2025-09-03-045711"
+    "base": "4.18.0-0.nightly-arm64-2025-09-10-195319"
   },
   "images": {
-    "cli": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:8bb731c8611bb5aca6f0a2523f0b6248ec2f10fb89cf3fd7520e4b01dbf79fa7",
-    "coredns": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:56476d218d817f12156e67a5949dc5aa96cdfbc47b8af87494e68a5599e0ea52",
-    "haproxy-router": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:7dd551f8e626ec72f135fe7a90b7589b26cda72d831817dbd369701fc15429a1",
-    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:e4d2928509a1b0daf46038b10a549e54df7d21810eee98b4a1c81ffe592a0e35",
-    "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:48c2f2e999d26681a196bd4f044efdef55a0d137bf01ee039d0d6af21d0f1d24",
-    "pod": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:ead78a41605a84c33874cf439f8fb7ca4e40d238311b944bb6573c3a74599c32",
-    "service-ca-operator": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:dadd6f5c854815079e5dbb9cdd274399e396b242c3a6b60de24bc96355e6755e",
+    "cli": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:4d3104dadbc2d4b3e8028bb48c77dbb10eebbb1af46615b579c7332d0b215353",
+    "coredns": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:8130cb0c47349d7abd81f9dd9379e44de7b289f71b28902fc14055c0d0d4e069",
+    "haproxy-router": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:039f507bbc6c42588ac61fce3c1e76ba44d2f8f9eee877fdd832f9bbff589274",
+    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:5a32438138f59921a5124dec8f5fb2bc15dc21d69c8179d43e49fb54a6cd1a79",
+    "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:cb52b81af63bb16500acfc033ea69486717b76b34b2ca1cd3660e3e1d1290d40",
+    "pod": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:843d145890e1f69ceadf72aa2762f15049f7c0b5699b0a36b40e36b6cbec5b56",
+    "service-ca-operator": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:e148bece3e038fea83a6d35c660422e4cb5e1ba228c927012b7c67631be416ce",
     "lvms_operator": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:bd6dc4d6e90fdbcdb844759e203c9c591abc5ac29a956257a90bda101a37b76e",
-    "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:224aff3fd638d3a6ebb6954a7923e76ae25c013d65f6b257f5aceade4033ebdd"
+    "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:39f715f20a7da3d58e20b1d8de46829df6b43bd86b5e9b0cb304e26ac0853a3c"
   }
 }
diff --git a/assets/release/release-x86_64.json b/assets/release/release-x86_64.json
index f6404063a5..78e94f201f 100644
--- a/assets/release/release-x86_64.json
+++ b/assets/release/release-x86_64.json
@@ -1,16 +1,16 @@
 {
   "release": {
-    "base": "4.18.0-0.nightly-2025-09-03-101304"
+    "base": "4.18.0-0.nightly-2025-09-10-135328"
   },
   "images": {
-    "cli": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:df2e6c589083d742ab3eeb863dc26a267b9e3b4a86f07fec2ff5c230733fa4ff",
-    "coredns": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:d96ca6ca34d38debb586165c04ca6aa3735d09d25f89cb60043fb800f5ccdf7e",
-    "haproxy-router": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3afe86a1db4b0cadd29edd815c8106fc0cfca92916e8a7f33fcda8c5e5b21914",
-    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:05ea4625eec55253f86b454dec2742638bd4f4993d2ba0d5422e8d7beaef864b",
-    "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:89cff1bdbc386572c0d8f2ea26087dfb728803b2c90329bf6f0f10e2ab781ee8",
-    "pod": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:01dfbfa63c6a054c432b329ef61b460f97e35f9536a325ea6c79acad49775eb9",
-    "service-ca-operator": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3f0bcbff40a7c02499b25e8c70386261eeb2e53d4fc26d302da44fdf71c6d336",
+    "cli": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9565856231dcfc847f76c351203dd0b3058c852d3b3df9df14e0d108bd6067bc",
+    "coredns": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:b84effe3edad35a85c588d56b732c2035aa254b2f1738b33e8bce57305f37dd4",
+    "haproxy-router": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:ed41e709c229010ac299ad39d27abd6a889c94524c7c48bb4b2eb7fcb45e5140",
+    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:0470599a9a0cb7e570b2e9169d59a9358d6304072260cee85312df8197a46283",
+    "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:ec06d2ea571f182170ab35d042cc271868f907f13f40380a177d756a0d82913e",
+    "pod": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:5f926ab7f668a1c2ab96002a10416d48fec768d6146fb2cb243e8adf2ed43aba",
+    "service-ca-operator": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:22dcb1bbbde59f9d10a83423f39bbc54841cdbbd2eca48efc3a8c880b5ec0ef9",
     "lvms_operator": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:bd6dc4d6e90fdbcdb844759e203c9c591abc5ac29a956257a90bda101a37b76e",
-    "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:398184506d43278f5abb00b3dacb766c6cc3cffd94fa821c701e747add69a40c"
+    "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:7c16eee7d59491d224693ad415252a917a02172f5dc7c43bc4362cb874fcd69c"
   }
 }
diff --git a/deps/github.com/openshift/kubernetes/.go-version b/deps/github.com/openshift/kubernetes/.go-version
index b6773170a5..aafdde18c8 100644
--- a/deps/github.com/openshift/kubernetes/.go-version
+++ b/deps/github.com/openshift/kubernetes/.go-version
@@ -1 +1 @@
-1.23.10
+1.23.11
diff --git a/deps/github.com/openshift/kubernetes/CHANGELOG/CHANGELOG-1.31.md b/deps/github.com/openshift/kubernetes/CHANGELOG/CHANGELOG-1.31.md
index 0de66a3ae7..ade9495d41 100644
--- a/deps/github.com/openshift/kubernetes/CHANGELOG/CHANGELOG-1.31.md
+++ b/deps/github.com/openshift/kubernetes/CHANGELOG/CHANGELOG-1.31.md
@@ -1,301 +1,401 @@
 <!-- BEGIN MUNGE: GENERATED_TOC -->
 
-- [v1.31.10](#v13110)
-  - [Downloads for v1.31.10](#downloads-for-v13110)
+- [v1.31.11](#v13111)
+  - [Downloads for v1.31.11](#downloads-for-v13111)
     - [Source Code](#source-code)
     - [Client Binaries](#client-binaries)
     - [Server Binaries](#server-binaries)
     - [Node Binaries](#node-binaries)
     - [Container Images](#container-images)
-  - [Changelog since v1.31.9](#changelog-since-v1319)
+  - [Changelog since v1.31.10](#changelog-since-v13110)
   - [Changes by Kind](#changes-by-kind)
-    - [Feature](#feature)
     - [Bug or Regression](#bug-or-regression)
-    - [Other (Cleanup or Flake)](#other-cleanup-or-flake)
   - [Dependencies](#dependencies)
     - [Added](#added)
     - [Changed](#changed)
     - [Removed](#removed)
-- [v1.31.9](#v1319)
-  - [Downloads for v1.31.9](#downloads-for-v1319)
+- [v1.31.10](#v13110)
+  - [Downloads for v1.31.10](#downloads-for-v13110)
     - [Source Code](#source-code-1)
     - [Client Binaries](#client-binaries-1)
     - [Server Binaries](#server-binaries-1)
     - [Node Binaries](#node-binaries-1)
     - [Container Images](#container-images-1)
-  - [Changelog since v1.31.8](#changelog-since-v1318)
+  - [Changelog since v1.31.9](#changelog-since-v1319)
   - [Changes by Kind](#changes-by-kind-1)
-    - [Feature](#feature-1)
+    - [Feature](#feature)
     - [Bug or Regression](#bug-or-regression-1)
+    - [Other (Cleanup or Flake)](#other-cleanup-or-flake)
   - [Dependencies](#dependencies-1)
     - [Added](#added-1)
     - [Changed](#changed-1)
     - [Removed](#removed-1)
-- [v1.31.8](#v1318)
-  - [Downloads for v1.31.8](#downloads-for-v1318)
+- [v1.31.9](#v1319)
+  - [Downloads for v1.31.9](#downloads-for-v1319)
     - [Source Code](#source-code-2)
     - [Client Binaries](#client-binaries-2)
     - [Server Binaries](#server-binaries-2)
     - [Node Binaries](#node-binaries-2)
     - [Container Images](#container-images-2)
-  - [Changelog since v1.31.7](#changelog-since-v1317)
+  - [Changelog since v1.31.8](#changelog-since-v1318)
   - [Changes by Kind](#changes-by-kind-2)
+    - [Feature](#feature-1)
     - [Bug or Regression](#bug-or-regression-2)
   - [Dependencies](#dependencies-2)
     - [Added](#added-2)
     - [Changed](#changed-2)
     - [Removed](#removed-2)
-- [v1.31.7](#v1317)
-  - [Downloads for v1.31.7](#downloads-for-v1317)
+- [v1.31.8](#v1318)
+  - [Downloads for v1.31.8](#downloads-for-v1318)
     - [Source Code](#source-code-3)
     - [Client Binaries](#client-binaries-3)
     - [Server Binaries](#server-binaries-3)
     - [Node Binaries](#node-binaries-3)
     - [Container Images](#container-images-3)
-  - [Changelog since v1.31.6](#changelog-since-v1316)
+  - [Changelog since v1.31.7](#changelog-since-v1317)
   - [Changes by Kind](#changes-by-kind-3)
     - [Bug or Regression](#bug-or-regression-3)
-    - [Other (Cleanup or Flake)](#other-cleanup-or-flake-1)
   - [Dependencies](#dependencies-3)
     - [Added](#added-3)
     - [Changed](#changed-3)
     - [Removed](#removed-3)
-- [v1.31.6](#v1316)
-  - [Downloads for v1.31.6](#downloads-for-v1316)
+- [v1.31.7](#v1317)
+  - [Downloads for v1.31.7](#downloads-for-v1317)
     - [Source Code](#source-code-4)
     - [Client Binaries](#client-binaries-4)
     - [Server Binaries](#server-binaries-4)
     - [Node Binaries](#node-binaries-4)
     - [Container Images](#container-images-4)
-  - [Changelog since v1.31.5](#changelog-since-v1315)
-  - [Important Security Information](#important-security-information)
-    - [CVE-2025-0426: Node Denial of Service via Kubelet Checkpoint API](#cve-2025-0426-node-denial-of-service-via-kubelet-checkpoint-api)
+  - [Changelog since v1.31.6](#changelog-since-v1316)
   - [Changes by Kind](#changes-by-kind-4)
-    - [Feature](#feature-2)
     - [Bug or Regression](#bug-or-regression-4)
-    - [Other (Cleanup or Flake)](#other-cleanup-or-flake-2)
+    - [Other (Cleanup or Flake)](#other-cleanup-or-flake-1)
   - [Dependencies](#dependencies-4)
     - [Added](#added-4)
     - [Changed](#changed-4)
     - [Removed](#removed-4)
-- [v1.31.5](#v1315)
-  - [Downloads for v1.31.5](#downloads-for-v1315)
+- [v1.31.6](#v1316)
+  - [Downloads for v1.31.6](#downloads-for-v1316)
     - [Source Code](#source-code-5)
     - [Client Binaries](#client-binaries-5)
     - [Server Binaries](#server-binaries-5)
     - [Node Binaries](#node-binaries-5)
     - [Container Images](#container-images-5)
-  - [Changelog since v1.31.4](#changelog-since-v1314)
-  - [Important Security Information](#important-security-information-1)
-    - [CVE-2024-9042: Command Injection affecting Windows nodes via nodes/*/logs/query API](#cve-2024-9042-command-injection-affecting-windows-nodes-via-nodeslogsquery-api)
+  - [Changelog since v1.31.5](#changelog-since-v1315)
+  - [Important Security Information](#important-security-information)
+    - [CVE-2025-0426: Node Denial of Service via Kubelet Checkpoint API](#cve-2025-0426-node-denial-of-service-via-kubelet-checkpoint-api)
   - [Changes by Kind](#changes-by-kind-5)
-    - [API Change](#api-change)
-    - [Feature](#feature-3)
+    - [Feature](#feature-2)
     - [Bug or Regression](#bug-or-regression-5)
+    - [Other (Cleanup or Flake)](#other-cleanup-or-flake-2)
   - [Dependencies](#dependencies-5)
     - [Added](#added-5)
     - [Changed](#changed-5)
     - [Removed](#removed-5)
-- [v1.31.4](#v1314)
-  - [Downloads for v1.31.4](#downloads-for-v1314)
+- [v1.31.5](#v1315)
+  - [Downloads for v1.31.5](#downloads-for-v1315)
     - [Source Code](#source-code-6)
     - [Client Binaries](#client-binaries-6)
     - [Server Binaries](#server-binaries-6)
     - [Node Binaries](#node-binaries-6)
     - [Container Images](#container-images-6)
-  - [Changelog since v1.31.3](#changelog-since-v1313)
+  - [Changelog since v1.31.4](#changelog-since-v1314)
+  - [Important Security Information](#important-security-information-1)
+    - [CVE-2024-9042: Command Injection affecting Windows nodes via nodes/*/logs/query API](#cve-2024-9042-command-injection-affecting-windows-nodes-via-nodeslogsquery-api)
   - [Changes by Kind](#changes-by-kind-6)
-    - [Feature](#feature-4)
+    - [API Change](#api-change)
+    - [Feature](#feature-3)
     - [Bug or Regression](#bug-or-regression-6)
   - [Dependencies](#dependencies-6)
     - [Added](#added-6)
     - [Changed](#changed-6)
     - [Removed](#removed-6)
-- [v1.31.3](#v1313)
-  - [Downloads for v1.31.3](#downloads-for-v1313)
+- [v1.31.4](#v1314)
+  - [Downloads for v1.31.4](#downloads-for-v1314)
     - [Source Code](#source-code-7)
     - [Client Binaries](#client-binaries-7)
     - [Server Binaries](#server-binaries-7)
     - [Node Binaries](#node-binaries-7)
     - [Container Images](#container-images-7)
-  - [Changelog since v1.31.2](#changelog-since-v1312)
+  - [Changelog since v1.31.3](#changelog-since-v1313)
   - [Changes by Kind](#changes-by-kind-7)
+    - [Feature](#feature-4)
     - [Bug or Regression](#bug-or-regression-7)
   - [Dependencies](#dependencies-7)
     - [Added](#added-7)
     - [Changed](#changed-7)
     - [Removed](#removed-7)
-- [v1.31.2](#v1312)
-  - [Downloads for v1.31.2](#downloads-for-v1312)
+- [v1.31.3](#v1313)
+  - [Downloads for v1.31.3](#downloads-for-v1313)
     - [Source Code](#source-code-8)
     - [Client Binaries](#client-binaries-8)
     - [Server Binaries](#server-binaries-8)
     - [Node Binaries](#node-binaries-8)
     - [Container Images](#container-images-8)
-  - [Changelog since v1.31.1](#changelog-since-v1311)
+  - [Changelog since v1.31.2](#changelog-since-v1312)
   - [Changes by Kind](#changes-by-kind-8)
-    - [Feature](#feature-5)
     - [Bug or Regression](#bug-or-regression-8)
-    - [Other (Cleanup or Flake)](#other-cleanup-or-flake-3)
-    - [Uncategorized](#uncategorized)
   - [Dependencies](#dependencies-8)
     - [Added](#added-8)
     - [Changed](#changed-8)
     - [Removed](#removed-8)
-- [v1.31.1](#v1311)
-  - [Downloads for v1.31.1](#downloads-for-v1311)
+- [v1.31.2](#v1312)
+  - [Downloads for v1.31.2](#downloads-for-v1312)
     - [Source Code](#source-code-9)
     - [Client Binaries](#client-binaries-9)
     - [Server Binaries](#server-binaries-9)
     - [Node Binaries](#node-binaries-9)
     - [Container Images](#container-images-9)
-  - [Changelog since v1.31.0](#changelog-since-v1310)
+  - [Changelog since v1.31.1](#changelog-since-v1311)
   - [Changes by Kind](#changes-by-kind-9)
-    - [Deprecation](#deprecation)
-    - [API Change](#api-change-1)
-    - [Feature](#feature-6)
+    - [Feature](#feature-5)
     - [Bug or Regression](#bug-or-regression-9)
-    - [Other (Cleanup or Flake)](#other-cleanup-or-flake-4)
+    - [Other (Cleanup or Flake)](#other-cleanup-or-flake-3)
+    - [Uncategorized](#uncategorized)
   - [Dependencies](#dependencies-9)
     - [Added](#added-9)
     - [Changed](#changed-9)
     - [Removed](#removed-9)
-- [v1.31.0](#v1310)
-  - [Downloads for v1.31.0](#downloads-for-v1310)
+- [v1.31.1](#v1311)
+  - [Downloads for v1.31.1](#downloads-for-v1311)
     - [Source Code](#source-code-10)
     - [Client Binaries](#client-binaries-10)
     - [Server Binaries](#server-binaries-10)
     - [Node Binaries](#node-binaries-10)
     - [Container Images](#container-images-10)
-  - [Changelog since v1.30.0](#changelog-since-v1300)
-  - [Urgent Upgrade Notes](#urgent-upgrade-notes)
-    - [(No, really, you MUST read this before you upgrade)](#no-really-you-must-read-this-before-you-upgrade)
+  - [Changelog since v1.31.0](#changelog-since-v1310)
   - [Changes by Kind](#changes-by-kind-10)
-    - [Deprecation](#deprecation-1)
-    - [API Change](#api-change-2)
-    - [Feature](#feature-7)
-    - [Failing Test](#failing-test)
+    - [Deprecation](#deprecation)
+    - [API Change](#api-change-1)
+    - [Feature](#feature-6)
     - [Bug or Regression](#bug-or-regression-10)
-    - [Other (Cleanup or Flake)](#other-cleanup-or-flake-5)
+    - [Other (Cleanup or Flake)](#other-cleanup-or-flake-4)
   - [Dependencies](#dependencies-10)
     - [Added](#added-10)
     - [Changed](#changed-10)
     - [Removed](#removed-10)
-- [v1.31.0-rc.1](#v1310-rc1)
-  - [Downloads for v1.31.0-rc.1](#downloads-for-v1310-rc1)
+- [v1.31.0](#v1310)
+  - [Downloads for v1.31.0](#downloads-for-v1310)
     - [Source Code](#source-code-11)
     - [Client Binaries](#client-binaries-11)
     - [Server Binaries](#server-binaries-11)
     - [Node Binaries](#node-binaries-11)
     - [Container Images](#container-images-11)
-  - [Changelog since v1.31.0-rc.0](#changelog-since-v1310-rc0)
+  - [Changelog since v1.30.0](#changelog-since-v1300)
+  - [Urgent Upgrade Notes](#urgent-upgrade-notes)
+    - [(No, really, you MUST read this before you upgrade)](#no-really-you-must-read-this-before-you-upgrade)
   - [Changes by Kind](#changes-by-kind-11)
-    - [API Change](#api-change-3)
-    - [Feature](#feature-8)
+    - [Deprecation](#deprecation-1)
+    - [API Change](#api-change-2)
+    - [Feature](#feature-7)
+    - [Failing Test](#failing-test)
     - [Bug or Regression](#bug-or-regression-11)
+    - [Other (Cleanup or Flake)](#other-cleanup-or-flake-5)
   - [Dependencies](#dependencies-11)
     - [Added](#added-11)
     - [Changed](#changed-11)
     - [Removed](#removed-11)
-- [v1.31.0-rc.0](#v1310-rc0)
-  - [Downloads for v1.31.0-rc.0](#downloads-for-v1310-rc0)
+- [v1.31.0-rc.1](#v1310-rc1)
+  - [Downloads for v1.31.0-rc.1](#downloads-for-v1310-rc1)
     - [Source Code](#source-code-12)
     - [Client Binaries](#client-binaries-12)
     - [Server Binaries](#server-binaries-12)
     - [Node Binaries](#node-binaries-12)
     - [Container Images](#container-images-12)
-  - [Changelog since v1.31.0-beta.0](#changelog-since-v1310-beta0)
-  - [Urgent Upgrade Notes](#urgent-upgrade-notes-1)
-    - [(No, really, you MUST read this before you upgrade)](#no-really-you-must-read-this-before-you-upgrade-1)
+  - [Changelog since v1.31.0-rc.0](#changelog-since-v1310-rc0)
   - [Changes by Kind](#changes-by-kind-12)
-    - [Deprecation](#deprecation-2)
-    - [API Change](#api-change-4)
-    - [Feature](#feature-9)
-    - [Failing Test](#failing-test-1)
+    - [API Change](#api-change-3)
+    - [Feature](#feature-8)
     - [Bug or Regression](#bug-or-regression-12)
-    - [Other (Cleanup or Flake)](#other-cleanup-or-flake-6)
   - [Dependencies](#dependencies-12)
     - [Added](#added-12)
     - [Changed](#changed-12)
     - [Removed](#removed-12)
-- [v1.31.0-beta.0](#v1310-beta0)
-  - [Downloads for v1.31.0-beta.0](#downloads-for-v1310-beta0)
+- [v1.31.0-rc.0](#v1310-rc0)
+  - [Downloads for v1.31.0-rc.0](#downloads-for-v1310-rc0)
     - [Source Code](#source-code-13)
     - [Client Binaries](#client-binaries-13)
     - [Server Binaries](#server-binaries-13)
     - [Node Binaries](#node-binaries-13)
     - [Container Images](#container-images-13)
-  - [Changelog since v1.31.0-alpha.3](#changelog-since-v1310-alpha3)
+  - [Changelog since v1.31.0-beta.0](#changelog-since-v1310-beta0)
+  - [Urgent Upgrade Notes](#urgent-upgrade-notes-1)
+    - [(No, really, you MUST read this before you upgrade)](#no-really-you-must-read-this-before-you-upgrade-1)
   - [Changes by Kind](#changes-by-kind-13)
-    - [API Change](#api-change-5)
-    - [Feature](#feature-10)
+    - [Deprecation](#deprecation-2)
+    - [API Change](#api-change-4)
+    - [Feature](#feature-9)
+    - [Failing Test](#failing-test-1)
     - [Bug or Regression](#bug-or-regression-13)
-    - [Other (Cleanup or Flake)](#other-cleanup-or-flake-7)
+    - [Other (Cleanup or Flake)](#other-cleanup-or-flake-6)
   - [Dependencies](#dependencies-13)
     - [Added](#added-13)
     - [Changed](#changed-13)
     - [Removed](#removed-13)
-- [v1.31.0-alpha.3](#v1310-alpha3)
-  - [Downloads for v1.31.0-alpha.3](#downloads-for-v1310-alpha3)
+- [v1.31.0-beta.0](#v1310-beta0)
+  - [Downloads for v1.31.0-beta.0](#downloads-for-v1310-beta0)
     - [Source Code](#source-code-14)
     - [Client Binaries](#client-binaries-14)
     - [Server Binaries](#server-binaries-14)
     - [Node Binaries](#node-binaries-14)
     - [Container Images](#container-images-14)
-  - [Changelog since v1.31.0-alpha.2](#changelog-since-v1310-alpha2)
+  - [Changelog since v1.31.0-alpha.3](#changelog-since-v1310-alpha3)
   - [Changes by Kind](#changes-by-kind-14)
-    - [API Change](#api-change-6)
-    - [Feature](#feature-11)
+    - [API Change](#api-change-5)
+    - [Feature](#feature-10)
     - [Bug or Regression](#bug-or-regression-14)
-    - [Other (Cleanup or Flake)](#other-cleanup-or-flake-8)
+    - [Other (Cleanup or Flake)](#other-cleanup-or-flake-7)
   - [Dependencies](#dependencies-14)
     - [Added](#added-14)
     - [Changed](#changed-14)
     - [Removed](#removed-14)
-- [v1.31.0-alpha.2](#v1310-alpha2)
-  - [Downloads for v1.31.0-alpha.2](#downloads-for-v1310-alpha2)
+- [v1.31.0-alpha.3](#v1310-alpha3)
+  - [Downloads for v1.31.0-alpha.3](#downloads-for-v1310-alpha3)
     - [Source Code](#source-code-15)
     - [Client Binaries](#client-binaries-15)
     - [Server Binaries](#server-binaries-15)
     - [Node Binaries](#node-binaries-15)
     - [Container Images](#container-images-15)
-  - [Changelog since v1.31.0-alpha.1](#changelog-since-v1310-alpha1)
-  - [Urgent Upgrade Notes](#urgent-upgrade-notes-2)
-    - [(No, really, you MUST read this before you upgrade)](#no-really-you-must-read-this-before-you-upgrade-2)
+  - [Changelog since v1.31.0-alpha.2](#changelog-since-v1310-alpha2)
   - [Changes by Kind](#changes-by-kind-15)
-    - [API Change](#api-change-7)
-    - [Feature](#feature-12)
-    - [Failing Test](#failing-test-2)
+    - [API Change](#api-change-6)
+    - [Feature](#feature-11)
     - [Bug or Regression](#bug-or-regression-15)
-    - [Other (Cleanup or Flake)](#other-cleanup-or-flake-9)
+    - [Other (Cleanup or Flake)](#other-cleanup-or-flake-8)
   - [Dependencies](#dependencies-15)
     - [Added](#added-15)
     - [Changed](#changed-15)
     - [Removed](#removed-15)
-- [v1.31.0-alpha.1](#v1310-alpha1)
-  - [Downloads for v1.31.0-alpha.1](#downloads-for-v1310-alpha1)
+- [v1.31.0-alpha.2](#v1310-alpha2)
+  - [Downloads for v1.31.0-alpha.2](#downloads-for-v1310-alpha2)
     - [Source Code](#source-code-16)
     - [Client Binaries](#client-binaries-16)
     - [Server Binaries](#server-binaries-16)
     - [Node Binaries](#node-binaries-16)
     - [Container Images](#container-images-16)
+  - [Changelog since v1.31.0-alpha.1](#changelog-since-v1310-alpha1)
+  - [Urgent Upgrade Notes](#urgent-upgrade-notes-2)
+    - [(No, really, you MUST read this before you upgrade)](#no-really-you-must-read-this-before-you-upgrade-2)
+  - [Changes by Kind](#changes-by-kind-16)
+    - [API Change](#api-change-7)
+    - [Feature](#feature-12)
+    - [Failing Test](#failing-test-2)
+    - [Bug or Regression](#bug-or-regression-16)
+    - [Other (Cleanup or Flake)](#other-cleanup-or-flake-9)
+  - [Dependencies](#dependencies-16)
+    - [Added](#added-16)
+    - [Changed](#changed-16)
+    - [Removed](#removed-16)
+- [v1.31.0-alpha.1](#v1310-alpha1)
+  - [Downloads for v1.31.0-alpha.1](#downloads-for-v1310-alpha1)
+    - [Source Code](#source-code-17)
+    - [Client Binaries](#client-binaries-17)
+    - [Server Binaries](#server-binaries-17)
+    - [Node Binaries](#node-binaries-17)
+    - [Container Images](#container-images-17)
   - [Changelog since v1.30.0](#changelog-since-v1300-1)
   - [Urgent Upgrade Notes](#urgent-upgrade-notes-3)
     - [(No, really, you MUST read this before you upgrade)](#no-really-you-must-read-this-before-you-upgrade-3)
-  - [Changes by Kind](#changes-by-kind-16)
+  - [Changes by Kind](#changes-by-kind-17)
     - [Deprecation](#deprecation-3)
     - [API Change](#api-change-8)
     - [Feature](#feature-13)
     - [Failing Test](#failing-test-3)
-    - [Bug or Regression](#bug-or-regression-16)
+    - [Bug or Regression](#bug-or-regression-17)
     - [Other (Cleanup or Flake)](#other-cleanup-or-flake-10)
-  - [Dependencies](#dependencies-16)
-    - [Added](#added-16)
-    - [Changed](#changed-16)
-    - [Removed](#removed-16)
+  - [Dependencies](#dependencies-17)
+    - [Added](#added-17)
+    - [Changed](#changed-17)
+    - [Removed](#removed-17)
 
 <!-- END MUNGE: GENERATED_TOC -->
 
+# v1.31.11
+
+
+## Downloads for v1.31.11
+
+
+
+### Source Code
+
+filename | sha512 hash
+-------- | -----------
+[kubernetes.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes.tar.gz) | 57d1b303ff710937e100588b57ed04afdb3486b9cb1f8b345ab5338312903bdd3aea783730deea471b5f66c7a352d2bb7f032bb9e9128bc3fd54c91bcb1fafcb
+[kubernetes-src.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-src.tar.gz) | eeb1a91b8e690aa753982beb23b76321f959432384ee5d7913f370dece9a05e66d830a054e8d0a46da8117a43c5ef5d3b09fcffbf77c9785454466b341bcc3d1
+
+### Client Binaries
+
+filename | sha512 hash
+-------- | -----------
+[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-client-darwin-amd64.tar.gz) | 2d71d3e9e56222c6416c7552b0c1fa218fafc3d288ff6cec26055301afc14122e2475767c010db1743aa35e2301783d5c703b69aad52fda1ffbbb6553b8e03a6
+[kubernetes-client-darwin-arm64.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-client-darwin-arm64.tar.gz) | 1bb26a1a76881294ed579be50db7b4598ee5ba688f8d636f15e47113f111f418eaea7fa46a67ae68c2260934a698e03f8a099dc9ea061edfc72d954bd68338b2
+[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-client-linux-386.tar.gz) | 67282a864cd3ec0399f8f7871b6037c4ad61e04be926350c142138117ecaee8e7c97c1b68a97183a6ce2a55fc74f1f1c092de4dc5af8b2df388f8c50a3f68ce3
+[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-client-linux-amd64.tar.gz) | 2fb7eab4a4a23811504f852e6ea10626156524e62bd968027c07b79a0a51d5075683ef71de4978e0f6be557d645f8b18b60cf0fce882ab4a65a0f589da44238e
+[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-client-linux-arm.tar.gz) | 56a3e493cf409ef41fe8acd845734ea7d88f6b571928eae403d396e7264c7d2eaa6d383d594783d6e477b5574deba01457497a3e13a08caa1b3445dcacc4a90d
+[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-client-linux-arm64.tar.gz) | 3a340cbcc535b6b019291dff1b7e4a5bd82bf354d8c0a9e436f2c18c88922ce4136129bc46a0297b3f6728fdedc33503031d02aeb26b55afafd2c18e508ec421
+[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-client-linux-ppc64le.tar.gz) | 4867c8c2817b3f83afca5d99c024098acd2c7f153d59c32ac1f5f4a33a30ca8818f7b0e27888e4d640ec63b7ca9739a9e4a0361049f2bc848616671a868adef1
+[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-client-linux-s390x.tar.gz) | a602498d7d096693c1bee433cc76972ebe5692317e14d8d7d61a118ed3cebc307d9021c997eed8449abed907476d02a50c25e4011e61920da62c67c1ce9e8934
+[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-client-windows-386.tar.gz) | 9f8f51ec24c99cde8c542c84c75b5d92d57b1445b916b0f819a50ee58dc3b5de93079e3dde64cee1404ca52b9aee3c4fa06d1933d2cad6a0a514fbd81e4259c3
+[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-client-windows-amd64.tar.gz) | e09ccaebe7e1d7e7054cade199222e808777d87f713214f96572a39339141f7b406a46c53b2006a38e7acbccc0511abdc0368542ead7cb39d20ca4066f73eeae
+[kubernetes-client-windows-arm64.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-client-windows-arm64.tar.gz) | 2b243070e2ef991370952e3c394cf2cce0f038e20b079ae47287b837cf6a524ab30957682a8fa7971b4cf6b8b916d7ba1f96329d7b042a32f68658932c435f48
+
+### Server Binaries
+
+filename | sha512 hash
+-------- | -----------
+[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-server-linux-amd64.tar.gz) | 988e6914fc2ca7019e711166724a290437dbcfc568daa256e0dfc28a466c84468bdee1e633b51334ef942197530e023a989485924dc8853dd4d6b1fee7b02573
+[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-server-linux-arm64.tar.gz) | 375dc840451863f4865d982d21d7dfbaca5927a2a17a004c9afffdf01e7654ffe40c742d1166967c0a65c9c61f72f5d68db3b13199b85fb17a8bdbaa3054f9f1
+[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-server-linux-ppc64le.tar.gz) | 0b029d1f3e1a96dbf2b9f8613c70316b7b6b351f39ff5e474746fe35845452bc438403519526f6197b18b56a0e5b3cca9a324cd10cfc4b7631950efa34d11404
+[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-server-linux-s390x.tar.gz) | e05cbbb55b408c0ad2c6e20be71f6dd116919962aff1447e36d8606396fbf57735b400e0cfb8c54471889a63fa0a1ae97a59239d37b3bd05abea0835c08e3cd1
+
+### Node Binaries
+
+filename | sha512 hash
+-------- | -----------
+[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-node-linux-amd64.tar.gz) | 7cc86f69fb23e4d64e80375d06e833bf3d205e3443676216ecff2b75e933d4f126591da74e1dc2c73c09d2dc80b4b1132ee31a5bdfcf25f58c01fd74c603ddcf
+[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-node-linux-arm64.tar.gz) | 1455df3dd71763ce55ca0358bed4dc769f66f0dfde82072e5d28b55a87f336e9d5a6bb4bc35d6596e44804fc5f3120cae60e913887b64128ce48a6c058f5eb7c
+[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-node-linux-ppc64le.tar.gz) | 39ef44166711a4a8e0551524d6a4105f8b81106198d351457c501daa7055a4d0f4d3b25195a9c5c236b399c049382f91a34d52db2df599dc072b9994149d8b79
+[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-node-linux-s390x.tar.gz) | 3a97048de99a54303dd1c295ad796ce04a07a0386eedc7e6e4fd204145d58226521eef943b368ad61c5ac9d03edd4454be43b4e58f04aada752eeb686731d086
+[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.31.11/kubernetes-node-windows-amd64.tar.gz) | 62e45577ea336b957c906ebe0abac0c38e9e2bb8bf03b895065adc0e72a5e20f2868f52f71cc6a9809d01ca50b96d7ddb131f5dfdb533032e371f7dff1e73ef1
+
+### Container Images
+
+All container images are available as manifest lists and support the described
+architectures. It is also possible to pull a specific architecture directly by
+adding the "-$ARCH" suffix  to the container image name.
+
+name | architectures
+---- | -------------
+[registry.k8s.io/conformance:v1.31.11](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/conformance) | [amd64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/conformance-amd64), [arm64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/conformance-arm64), [ppc64le](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/conformance-ppc64le), [s390x](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/conformance-s390x)
+[registry.k8s.io/kube-apiserver:v1.31.11](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-apiserver) | [amd64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-apiserver-amd64), [arm64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-apiserver-arm64), [ppc64le](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-apiserver-ppc64le), [s390x](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-apiserver-s390x)
+[registry.k8s.io/kube-controller-manager:v1.31.11](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-controller-manager) | [amd64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-controller-manager-amd64), [arm64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-controller-manager-arm64), [ppc64le](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-controller-manager-ppc64le), [s390x](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-controller-manager-s390x)
+[registry.k8s.io/kube-proxy:v1.31.11](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-proxy) | [amd64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-proxy-amd64), [arm64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-proxy-arm64), [ppc64le](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-proxy-ppc64le), [s390x](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-proxy-s390x)
+[registry.k8s.io/kube-scheduler:v1.31.11](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-scheduler) | [amd64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-scheduler-amd64), [arm64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-scheduler-arm64), [ppc64le](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-scheduler-ppc64le), [s390x](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-scheduler-s390x)
+[registry.k8s.io/kubectl:v1.31.11](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kubectl) | [amd64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kubectl-amd64), [arm64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kubectl-arm64), [ppc64le](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kubectl-ppc64le), [s390x](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kubectl-s390x)
+
+## Changelog since v1.31.10
+
+## Changes by Kind
+
+### Bug or Regression
+
+- Fix a bug causing unexpected delay of creating pods for newly created jobs ([#132109](https://github.com/kubernetes/kubernetes/pull/132109), [@linxiulei](https://github.com/linxiulei)) [SIG Apps and Testing]
+- Kubeadm: fixed issue where etcd member promotion fails with an error saying the member was already promoted ([#132282](https://github.com/kubernetes/kubernetes/pull/132282), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle]
+
+## Dependencies
+
+### Added
+_Nothing has changed._
+
+### Changed
+_Nothing has changed._
+
+### Removed
+_Nothing has changed._
+
+
+
 # v1.31.10
 
 
diff --git a/deps/github.com/openshift/kubernetes/build/build-image/cross/VERSION b/deps/github.com/openshift/kubernetes/build/build-image/cross/VERSION
index 6d86e0f4a2..8804b93f53 100644
--- a/deps/github.com/openshift/kubernetes/build/build-image/cross/VERSION
+++ b/deps/github.com/openshift/kubernetes/build/build-image/cross/VERSION
@@ -1 +1 @@
-v1.31.0-go1.23.10-bullseye.0
+v1.31.0-go1.23.11-bullseye.0
diff --git a/deps/github.com/openshift/kubernetes/build/common.sh b/deps/github.com/openshift/kubernetes/build/common.sh
index 98c6d309bd..a35fb7bb56 100755
--- a/deps/github.com/openshift/kubernetes/build/common.sh
+++ b/deps/github.com/openshift/kubernetes/build/common.sh
@@ -97,8 +97,8 @@ readonly KUBE_RSYNC_PORT="${KUBE_RSYNC_PORT:-}"
 readonly KUBE_CONTAINER_RSYNC_PORT=8730
 
 # These are the default versions (image tags) for their respective base images.
-readonly __default_distroless_iptables_version=v0.6.11
-readonly __default_go_runner_version=v2.4.0-go1.23.10-bookworm.0
+readonly __default_distroless_iptables_version=v0.6.12
+readonly __default_go_runner_version=v2.4.0-go1.23.11-bookworm.0
 readonly __default_setcap_version=bookworm-v1.0.3
 
 # These are the base images for the Docker-wrapped binaries.
diff --git a/deps/github.com/openshift/kubernetes/build/dependencies.yaml b/deps/github.com/openshift/kubernetes/build/dependencies.yaml
index 5accdff482..3cafb0897e 100644
--- a/deps/github.com/openshift/kubernetes/build/dependencies.yaml
+++ b/deps/github.com/openshift/kubernetes/build/dependencies.yaml
@@ -116,7 +116,7 @@ dependencies:
 
   # Golang
   - name: "golang: upstream version"
-    version: 1.23.10
+    version: 1.23.11
     refPaths:
     - path: .go-version
     - path: build/build-image/cross/VERSION
@@ -139,7 +139,7 @@ dependencies:
     #   match: minimum_go_version=go([0-9]+\.[0-9]+)
 
   - name: "registry.k8s.io/kube-cross: dependents"
-    version: v1.31.0-go1.23.10-bullseye.0
+    version: v1.31.0-go1.23.11-bullseye.0
     refPaths:
     - path: build/build-image/cross/VERSION
 
@@ -177,7 +177,7 @@ dependencies:
       match: registry\.k8s\.io\/build-image\/debian-base:[a-zA-Z]+\-v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)
 
   - name: "registry.k8s.io/distroless-iptables: dependents"
-    version: v0.6.11
+    version: v0.6.12
     refPaths:
     - path: build/common.sh
       match: __default_distroless_iptables_version=
@@ -185,7 +185,7 @@ dependencies:
       match: configs\[DistrolessIptables\] = Config{list\.BuildImageRegistry, "distroless-iptables", "v([0-9]+)\.([0-9]+)\.([0-9]+)"}
 
   - name: "registry.k8s.io/go-runner: dependents"
-    version: v2.4.0-go1.23.10-bookworm.0
+    version: v2.4.0-go1.23.11-bookworm.0
     refPaths:
     - path: build/common.sh
       match: __default_go_runner_version=
diff --git a/deps/github.com/openshift/kubernetes/openshift-hack/images/hyperkube/Dockerfile.rhel b/deps/github.com/openshift/kubernetes/openshift-hack/images/hyperkube/Dockerfile.rhel
index f5dac3e825..477584809d 100644
--- a/deps/github.com/openshift/kubernetes/openshift-hack/images/hyperkube/Dockerfile.rhel
+++ b/deps/github.com/openshift/kubernetes/openshift-hack/images/hyperkube/Dockerfile.rhel
@@ -14,4 +14,4 @@ COPY --from=builder /tmp/build/* /usr/bin/
 LABEL io.k8s.display-name="OpenShift Kubernetes Server Commands" \
     io.k8s.description="OpenShift is a platform for developing, building, and deploying containerized applications." \
     io.openshift.tags="openshift,hyperkube" \
-    io.openshift.build.versions="kubernetes=1.31.11"
+    io.openshift.build.versions="kubernetes=1.31.12"
diff --git a/deps/github.com/openshift/kubernetes/plugin/pkg/admission/noderestriction/admission.go b/deps/github.com/openshift/kubernetes/plugin/pkg/admission/noderestriction/admission.go
index bd313cf0c2..f083e1f007 100644
--- a/deps/github.com/openshift/kubernetes/plugin/pkg/admission/noderestriction/admission.go
+++ b/deps/github.com/openshift/kubernetes/plugin/pkg/admission/noderestriction/admission.go
@@ -489,6 +489,11 @@ func (p *Plugin) admitNode(nodeName string, a admission.Attributes) error {
 			return admission.NewForbidden(a, fmt.Errorf("node %q is not allowed to modify taints", nodeName))
 		}
 
+		// Don't allow a node to update its own ownerReferences.
+		if !apiequality.Semantic.DeepEqual(node.OwnerReferences, oldNode.OwnerReferences) {
+			return admission.NewForbidden(a, fmt.Errorf("node %q is not allowed to modify ownerReferences", nodeName))
+		}
+
 		// Don't allow a node to update labels outside the allowed set.
 		// This would allow a node to add or modify its labels in a way that would let it steer privileged workloads to itself.
 		modifiedLabels := getModifiedLabels(node.Labels, oldNode.Labels)
diff --git a/deps/github.com/openshift/kubernetes/plugin/pkg/admission/noderestriction/admission_test.go b/deps/github.com/openshift/kubernetes/plugin/pkg/admission/noderestriction/admission_test.go
index 3b6e107b2a..e3e0fc7627 100644
--- a/deps/github.com/openshift/kubernetes/plugin/pkg/admission/noderestriction/admission_test.go
+++ b/deps/github.com/openshift/kubernetes/plugin/pkg/admission/noderestriction/admission_test.go
@@ -247,10 +247,14 @@ func (a *admitTestCase) run(t *testing.T) {
 
 func Test_nodePlugin_Admit(t *testing.T) {
 	var (
-		mynode = &user.DefaultInfo{Name: "system:node:mynode", Groups: []string{"system:nodes"}}
-		bob    = &user.DefaultInfo{Name: "bob"}
+		trueRef = true
+		mynode  = &user.DefaultInfo{Name: "system:node:mynode", Groups: []string{"system:nodes"}}
+		bob     = &user.DefaultInfo{Name: "bob"}
+
+		mynodeObjMeta          = metav1.ObjectMeta{Name: "mynode", UID: "mynode-uid"}
+		mynodeObjMetaOwnerRefA = metav1.ObjectMeta{Name: "mynode", UID: "mynode-uid", OwnerReferences: []metav1.OwnerReference{{Name: "fooerA", Controller: &trueRef}}}
+		mynodeObjMetaOwnerRefB = metav1.ObjectMeta{Name: "mynode", UID: "mynode-uid", OwnerReferences: []metav1.OwnerReference{{Name: "fooerB", Controller: &trueRef}}}
 
-		mynodeObjMeta    = metav1.ObjectMeta{Name: "mynode", UID: "mynode-uid"}
 		mynodeObj        = &api.Node{ObjectMeta: mynodeObjMeta}
 		mynodeObjConfigA = &api.Node{ObjectMeta: mynodeObjMeta, Spec: api.NodeSpec{ConfigSource: &api.NodeConfigSource{
 			ConfigMap: &api.ConfigMapNodeConfigSource{
@@ -267,9 +271,11 @@ func Test_nodePlugin_Admit(t *testing.T) {
 				KubeletConfigKey: "kubelet",
 			}}}}
 
-		mynodeObjTaintA = &api.Node{ObjectMeta: mynodeObjMeta, Spec: api.NodeSpec{Taints: []api.Taint{{Key: "mykey", Value: "A"}}}}
-		mynodeObjTaintB = &api.Node{ObjectMeta: mynodeObjMeta, Spec: api.NodeSpec{Taints: []api.Taint{{Key: "mykey", Value: "B"}}}}
-		othernodeObj    = &api.Node{ObjectMeta: metav1.ObjectMeta{Name: "othernode"}}
+		mynodeObjTaintA    = &api.Node{ObjectMeta: mynodeObjMeta, Spec: api.NodeSpec{Taints: []api.Taint{{Key: "mykey", Value: "A"}}}}
+		mynodeObjTaintB    = &api.Node{ObjectMeta: mynodeObjMeta, Spec: api.NodeSpec{Taints: []api.Taint{{Key: "mykey", Value: "B"}}}}
+		mynodeObjOwnerRefA = &api.Node{ObjectMeta: mynodeObjMetaOwnerRefA}
+		mynodeObjOwnerRefB = &api.Node{ObjectMeta: mynodeObjMetaOwnerRefB}
+		othernodeObj       = &api.Node{ObjectMeta: metav1.ObjectMeta{Name: "othernode"}}
 
 		coremymirrorpod, v1mymirrorpod           = makeTestPod("ns", "mymirrorpod", "mynode", true)
 		coreothermirrorpod, v1othermirrorpod     = makeTestPod("ns", "othermirrorpod", "othernode", true)
@@ -1052,6 +1058,24 @@ func Test_nodePlugin_Admit(t *testing.T) {
 			attributes: admission.NewAttributesRecord(setForbiddenUpdateLabels(mynodeObj, "new"), setForbiddenUpdateLabels(mynodeObj, "old"), nodeKind, mynodeObj.Namespace, mynodeObj.Name, nodeResource, "", admission.Update, &metav1.UpdateOptions{}, false, mynode),
 			err:        `is not allowed to modify labels: foo.node-restriction.kubernetes.io/foo, node-restriction.kubernetes.io/foo, other.k8s.io/foo, other.kubernetes.io/foo`,
 		},
+		{
+			name:       "forbid update of my node: add owner reference",
+			podsGetter: existingPods,
+			attributes: admission.NewAttributesRecord(mynodeObjOwnerRefA, mynodeObj, nodeKind, mynodeObj.Namespace, mynodeObj.Name, nodeResource, "", admission.Update, &metav1.UpdateOptions{}, false, mynode),
+			err:        "node \"mynode\" is not allowed to modify ownerReferences",
+		},
+		{
+			name:       "forbid update of my node: remove owner reference",
+			podsGetter: existingPods,
+			attributes: admission.NewAttributesRecord(mynodeObj, mynodeObjOwnerRefA, nodeKind, mynodeObj.Namespace, mynodeObj.Name, nodeResource, "", admission.Update, &metav1.UpdateOptions{}, false, mynode),
+			err:        "node \"mynode\" is not allowed to modify ownerReferences",
+		},
+		{
+			name:       "forbid update of my node: change owner reference",
+			podsGetter: existingPods,
+			attributes: admission.NewAttributesRecord(mynodeObjOwnerRefA, mynodeObjOwnerRefB, nodeKind, mynodeObj.Namespace, mynodeObj.Name, nodeResource, "", admission.Update, &metav1.UpdateOptions{}, false, mynode),
+			err:        "node \"mynode\" is not allowed to modify ownerReferences",
+		},
 
 		// Other node object
 		{
diff --git a/deps/github.com/openshift/kubernetes/staging/publishing/rules.yaml b/deps/github.com/openshift/kubernetes/staging/publishing/rules.yaml
index 1fa950ad40..ca76ec0012 100644
--- a/deps/github.com/openshift/kubernetes/staging/publishing/rules.yaml
+++ b/deps/github.com/openshift/kubernetes/staging/publishing/rules.yaml
@@ -2898,4 +2898,4 @@ rules:
       - staging/src/k8s.io/endpointslice
 recursive-delete-patterns:
 - '*/.gitattributes'
-default-go-version: 1.23.10
+default-go-version: 1.23.11
diff --git a/deps/github.com/openshift/kubernetes/test/images/Makefile b/deps/github.com/openshift/kubernetes/test/images/Makefile
index a96a629816..7048c9fa86 100644
--- a/deps/github.com/openshift/kubernetes/test/images/Makefile
+++ b/deps/github.com/openshift/kubernetes/test/images/Makefile
@@ -16,7 +16,7 @@ REGISTRY ?= registry.k8s.io/e2e-test-images
 GOARM ?= 7
 DOCKER_CERT_BASE_PATH ?=
 QEMUVERSION=v5.1.0-2
-GOLANG_VERSION=1.23.10
+GOLANG_VERSION=1.23.11
 export
 
 ifndef WHAT
diff --git a/deps/github.com/openshift/kubernetes/test/utils/image/manifest.go b/deps/github.com/openshift/kubernetes/test/utils/image/manifest.go
index eafaa37c2b..88b6034005 100644
--- a/deps/github.com/openshift/kubernetes/test/utils/image/manifest.go
+++ b/deps/github.com/openshift/kubernetes/test/utils/image/manifest.go
@@ -229,7 +229,7 @@ func initImageConfigs(list RegistryList) (map[ImageID]Config, map[ImageID]Config
 	configs[BusyBox] = Config{list.PromoterE2eRegistry, "busybox", "1.36.1-1"}
 	configs[CudaVectorAdd] = Config{list.PromoterE2eRegistry, "cuda-vector-add", "1.0"}
 	configs[CudaVectorAdd2] = Config{list.PromoterE2eRegistry, "cuda-vector-add", "2.3"}
-	configs[DistrolessIptables] = Config{list.BuildImageRegistry, "distroless-iptables", "v0.6.11"}
+	configs[DistrolessIptables] = Config{list.BuildImageRegistry, "distroless-iptables", "v0.6.12"}
 	configs[Etcd] = Config{list.GcEtcdRegistry, "etcd", "3.5.15-0"}
 	configs[Httpd] = Config{list.PromoterE2eRegistry, "httpd", "2.4.38-4"}
 	configs[HttpdNew] = Config{list.PromoterE2eRegistry, "httpd", "2.4.39-4"}
diff --git a/etcd/go.mod b/etcd/go.mod
index cc07cb827c..6d87fa8177 100644
--- a/etcd/go.mod
+++ b/etcd/go.mod
@@ -14,11 +14,11 @@ require (
 	github.com/openshift/build-machinery-go v0.0.0-20250602125535-1b6d00b8c37c
 	github.com/spf13/cobra v1.8.1
 	go.etcd.io/etcd/server/v3 v3.5.13
-	k8s.io/apimachinery v1.31.11
-	k8s.io/cli-runtime v1.31.11
-	k8s.io/component-base v1.31.11
+	k8s.io/apimachinery v1.31.12
+	k8s.io/cli-runtime v1.31.12
+	k8s.io/component-base v1.31.12
 	k8s.io/klog/v2 v2.130.1
-	k8s.io/kubectl v1.31.11
+	k8s.io/kubectl v1.31.12
 	sigs.k8s.io/yaml v1.4.0
 )
 
@@ -41,7 +41,7 @@ require (
 	google.golang.org/genproto/googleapis/api v0.0.0-20240930140551-af27646dc61f // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240924160255-9d4c2d233b61 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
-	k8s.io/apiserver v1.31.11 // indirect
+	k8s.io/apiserver v1.31.12 // indirect
 )
 
 require (
@@ -133,8 +133,8 @@ require (
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/api v1.31.11 // indirect
-	k8s.io/client-go v1.31.11 // indirect
+	k8s.io/api v1.31.12 // indirect
+	k8s.io/client-go v1.31.12 // indirect
 	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
 	k8s.io/utils v0.0.0-20240921022957-49e7df575cb6 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
diff --git a/etcd/vendor/modules.txt b/etcd/vendor/modules.txt
index d2eeaa2494..573e6228cb 100644
--- a/etcd/vendor/modules.txt
+++ b/etcd/vendor/modules.txt
@@ -625,7 +625,7 @@ gopkg.in/yaml.v2
 # gopkg.in/yaml.v3 v3.0.1
 ## explicit
 gopkg.in/yaml.v3
-# k8s.io/api v1.31.11 => ../deps/github.com/openshift/kubernetes/staging/src/k8s.io/api
+# k8s.io/api v1.31.12 => ../deps/github.com/openshift/kubernetes/staging/src/k8s.io/api
 ## explicit; go 1.22.0
 k8s.io/api/admission/v1
 k8s.io/api/admission/v1beta1
@@ -685,7 +685,7 @@ k8s.io/api/storage/v1
 k8s.io/api/storage/v1alpha1
 k8s.io/api/storage/v1beta1
 k8s.io/api/storagemigration/v1alpha1
-# k8s.io/apimachinery v1.31.11 => ../deps/github.com/openshift/kubernetes/staging/src/k8s.io/apimachinery
+# k8s.io/apimachinery v1.31.12 => ../deps/github.com/openshift/kubernetes/staging/src/k8s.io/apimachinery
 ## explicit; go 1.22.0
 k8s.io/apimachinery/pkg/api/equality
 k8s.io/apimachinery/pkg/api/errors
@@ -745,17 +745,17 @@ k8s.io/apimachinery/pkg/watch
 k8s.io/apimachinery/third_party/forked/golang/json
 k8s.io/apimachinery/third_party/forked/golang/netutil
 k8s.io/apimachinery/third_party/forked/golang/reflect
-# k8s.io/apiserver v1.31.11 => ../deps/github.com/openshift/kubernetes/staging/src/k8s.io/apiserver
+# k8s.io/apiserver v1.31.12 => ../deps/github.com/openshift/kubernetes/staging/src/k8s.io/apiserver
 ## explicit; go 1.22.0
 k8s.io/apiserver/pkg/apis/audit
 k8s.io/apiserver/pkg/apis/audit/v1
-# k8s.io/cli-runtime v1.31.11 => ../deps/github.com/openshift/kubernetes/staging/src/k8s.io/cli-runtime
+# k8s.io/cli-runtime v1.31.12 => ../deps/github.com/openshift/kubernetes/staging/src/k8s.io/cli-runtime
 ## explicit; go 1.22.0
 k8s.io/cli-runtime/pkg/genericclioptions
 k8s.io/cli-runtime/pkg/genericiooptions
 k8s.io/cli-runtime/pkg/printers
 k8s.io/cli-runtime/pkg/resource
-# k8s.io/client-go v1.31.11 => ../deps/github.com/openshift/kubernetes/staging/src/k8s.io/client-go
+# k8s.io/client-go v1.31.12 => ../deps/github.com/openshift/kubernetes/staging/src/k8s.io/client-go
 ## explicit; go 1.22.0
 k8s.io/client-go/applyconfigurations/admissionregistration/v1
 k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1
@@ -910,7 +910,7 @@ k8s.io/client-go/util/jsonpath
 k8s.io/client-go/util/keyutil
 k8s.io/client-go/util/watchlist
 k8s.io/client-go/util/workqueue
-# k8s.io/component-base v1.31.11 => ../deps/github.com/openshift/kubernetes/staging/src/k8s.io/component-base
+# k8s.io/component-base v1.31.12 => ../deps/github.com/openshift/kubernetes/staging/src/k8s.io/component-base
 ## explicit; go 1.22.0
 k8s.io/component-base/cli
 k8s.io/component-base/cli/flag
@@ -947,7 +947,7 @@ k8s.io/kube-openapi/pkg/spec3
 k8s.io/kube-openapi/pkg/util/proto
 k8s.io/kube-openapi/pkg/util/proto/validation
 k8s.io/kube-openapi/pkg/validation/spec
-# k8s.io/kubectl v1.31.11 => ../deps/github.com/openshift/kubernetes/staging/src/k8s.io/kubectl
+# k8s.io/kubectl v1.31.12 => ../deps/github.com/openshift/kubernetes/staging/src/k8s.io/kubectl
 ## explicit; go 1.22.0
 k8s.io/kubectl/pkg/cmd/util
 k8s.io/kubectl/pkg/scheme
diff --git a/go.mod b/go.mod
index 9536c2905a..ff8bb40fdf 100644
--- a/go.mod
+++ b/go.mod
@@ -24,12 +24,12 @@ require (
 	go.etcd.io/etcd/client/v3 v3.5.14
 	golang.org/x/sys v0.29.0
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/api v1.31.11
-	k8s.io/cli-runtime v1.31.11
+	k8s.io/api v1.31.12
+	k8s.io/cli-runtime v1.31.12
 	k8s.io/klog/v2 v2.130.1
 	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340
-	k8s.io/kubectl v1.31.11
-	k8s.io/kubernetes v1.31.11
+	k8s.io/kubectl v1.31.12
+	k8s.io/kubernetes v1.31.12
 	sigs.k8s.io/yaml v1.4.0
 )
 
@@ -37,13 +37,13 @@ require (
 	github.com/evanphx/json-patch v4.12.0+incompatible
 	github.com/fsnotify/fsnotify v1.7.0
 	gopkg.in/yaml.v2 v2.4.0
-	k8s.io/apiextensions-apiserver v1.31.11
-	k8s.io/apimachinery v1.31.11
-	k8s.io/apiserver v1.31.11
-	k8s.io/client-go v1.31.11
-	k8s.io/cloud-provider v1.31.11
-	k8s.io/component-base v1.31.11
-	k8s.io/kube-aggregator v1.31.11
+	k8s.io/apiextensions-apiserver v1.31.12
+	k8s.io/apimachinery v1.31.12
+	k8s.io/apiserver v1.31.12
+	k8s.io/client-go v1.31.12
+	k8s.io/cloud-provider v1.31.12
+	k8s.io/component-base v1.31.12
+	k8s.io/kube-aggregator v1.31.12
 	k8s.io/utils v0.0.0-20240921022957-49e7df575cb6
 	sigs.k8s.io/kube-storage-version-migrator v0.0.6-0.20230721195810-5c8923c5ff96
 	sigs.k8s.io/kustomize/api v0.17.2
@@ -192,22 +192,22 @@ require (
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
-	k8s.io/cluster-bootstrap v1.31.11 // indirect
-	k8s.io/component-helpers v1.31.11 // indirect
-	k8s.io/controller-manager v1.31.11 // indirect
-	k8s.io/cri-api v1.31.11 // indirect
-	k8s.io/cri-client v1.31.11 // indirect
-	k8s.io/csi-translation-lib v1.31.11 // indirect
-	k8s.io/dynamic-resource-allocation v1.31.11 // indirect
-	k8s.io/endpointslice v1.31.11 // indirect
+	k8s.io/cluster-bootstrap v1.31.12 // indirect
+	k8s.io/component-helpers v1.31.12 // indirect
+	k8s.io/controller-manager v1.31.12 // indirect
+	k8s.io/cri-api v1.31.12 // indirect
+	k8s.io/cri-client v1.31.12 // indirect
+	k8s.io/csi-translation-lib v1.31.12 // indirect
+	k8s.io/dynamic-resource-allocation v1.31.12 // indirect
+	k8s.io/endpointslice v1.31.12 // indirect
 	k8s.io/gengo/v2 v2.0.0-20240228010128-51d4e06bde70 // indirect
-	k8s.io/kms v1.31.11 // indirect
-	k8s.io/kube-controller-manager v1.31.11 // indirect
-	k8s.io/kube-scheduler v1.31.11 // indirect
-	k8s.io/kubelet v1.31.11 // indirect
-	k8s.io/metrics v1.31.11 // indirect
-	k8s.io/mount-utils v1.31.11 // indirect
-	k8s.io/pod-security-admission v1.31.11 // indirect
+	k8s.io/kms v1.31.12 // indirect
+	k8s.io/kube-controller-manager v1.31.12 // indirect
+	k8s.io/kube-scheduler v1.31.12 // indirect
+	k8s.io/kubelet v1.31.12 // indirect
+	k8s.io/metrics v1.31.12 // indirect
+	k8s.io/mount-utils v1.31.12 // indirect
+	k8s.io/pod-security-admission v1.31.12 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
diff --git a/packaging/crio.conf.d/10-microshift_amd64.conf b/packaging/crio.conf.d/10-microshift_amd64.conf
index 676a4ad973..ce2461dd4a 100644
--- a/packaging/crio.conf.d/10-microshift_amd64.conf
+++ b/packaging/crio.conf.d/10-microshift_amd64.conf
@@ -25,6 +25,6 @@ plugin_dirs = [
 # for community builds on top of OKD, this setting has no effect
 [crio.image]
 global_auth_file="/etc/crio/openshift-pull-secret"
-pause_image = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:01dfbfa63c6a054c432b329ef61b460f97e35f9536a325ea6c79acad49775eb9"
+pause_image = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:5f926ab7f668a1c2ab96002a10416d48fec768d6146fb2cb243e8adf2ed43aba"
 pause_image_auth_file = "/etc/crio/openshift-pull-secret"
 pause_command = "/usr/bin/pod"
diff --git a/packaging/crio.conf.d/10-microshift_arm64.conf b/packaging/crio.conf.d/10-microshift_arm64.conf
index 55efd2abb0..8bbe2286dc 100644
--- a/packaging/crio.conf.d/10-microshift_arm64.conf
+++ b/packaging/crio.conf.d/10-microshift_arm64.conf
@@ -25,6 +25,6 @@ plugin_dirs = [
 # for community builds on top of OKD, this setting has no effect
 [crio.image]
 global_auth_file="/etc/crio/openshift-pull-secret"
-pause_image = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:ead78a41605a84c33874cf439f8fb7ca4e40d238311b944bb6573c3a74599c32"
+pause_image = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:843d145890e1f69ceadf72aa2762f15049f7c0b5699b0a36b40e36b6cbec5b56"
 pause_image_auth_file = "/etc/crio/openshift-pull-secret"
 pause_command = "/usr/bin/pod"
diff --git a/scripts/auto-rebase/changelog.txt b/scripts/auto-rebase/changelog.txt
index 8a78dc0502..a7564faea0 100644
--- a/scripts/auto-rebase/changelog.txt
+++ b/scripts/auto-rebase/changelog.txt
@@ -1,40 +1,52 @@
-- api embedded-component c86d80652a9ed6a3a6b35d9d81c06aaeb723f8e1 to 97c9a2259ba103d79e2b7d777337464621b08499
-  - e7c394b 2025-08-26T18:23:05Z Update crd-schema.json to release 1.33 branch
-
-- cluster-network-operator embedded-component c1a702897dc2ca3dc4cdc04f4984a718960ea46a to 7aecd65a845e22325931cc7bee85a7554d204382
-  - 1244350 2025-08-25T02:27:45Z Add release version annotation to whereabouts-controller and whereabouts-token-watcher
-
-- kubernetes embedded-component 45be6afa71817681e9d19fa129884fb81ba9439b to 3c7968e741684de8dc08ebc8aef1890b099eccae
-  - f50d9d53e 2025-08-25T10:42:52-04:00 UPSTREAM: <carry>: remove the backward compat featuregate for 132028
-  - 683924808 2025-08-21T15:01:43-04:00 Revert "[release-4.18] OCPBUGS-57488: UPSTREAM: <carry>: Mark admissionregistration.k8s.io/v1beta1 as deprecated."
-  - 4795ccdc4 2025-08-21T12:06:08-04:00 UPSTREAM: 132028: podresources: list: use active pods in list
-  - 1d9e321d1 2025-06-16T13:36:55Z UPSTREAM: <carry>: Mark admissionregistration.k8s.io/v1beta1 as deprecated.
-
-- machine-config-operator embedded-component 240e315c241bf702f9dc7fb201922793c6be147e to 6cabdc1467e3bcc9961544e148530a9c88789856
-  - 20902bd9 2025-07-29T14:47:35Z OCPBUGS-57484: Handle migration from OpenShift SDN
-  - 089ce4ca 2025-07-29T14:47:35Z OPNET-681: Support migration from configure-ovs to NMState
-  - 22ed2775 2025-06-11T21:20:17Z Give bonding slaves time to implicitly activate.
-  - faa0ec93 2025-06-11T21:20:17Z Revert "Race in configure-ovs.sh affects bonding interface configuration."
-  - 5b601a0e 2025-06-11T21:20:17Z Race in configure-ovs.sh affects bonding interface configuration.
-
-- openshift-controller-manager embedded-component c87671821e6b05173e5bdc0aab1f80f29438e192 to 8ee744063ed12b249f1a2b89e9af4f53b2f1daf7
-  - 25c66de 2025-08-28T12:02:40Z legacy image pull secret rollback controller
-  - 695b502 2025-08-28T12:02:40Z introduce rollback controllers
-
-- operator-framework-olm embedded-component 583538413e0032f33ce2236e9ea503b85226554e to a62bebb1c75e41da8b01024f01a9b1e8a1fe3f8f
-  - 408a886d 2025-08-19T12:53:58Z Upstream: <carry>: regenerate manifests
-  - 1bc8f331 2025-08-19T12:53:58Z Upstream: 3580: add NetworkPolicy as a supported kind
-  - 81831462 2025-08-19T12:53:58Z Upstream: <carry>: Add allow-all networkpolicy for openshift-operators namespace
-  - 818f0d8c 2025-08-19T12:53:58Z Upstream: 1675: Add NetworkPolicy as a supported kind
-
-- kubernetes image-amd64 45be6afa71817681e9d19fa129884fb81ba9439b to 3c7968e741684de8dc08ebc8aef1890b099eccae
-  - f50d9d53e 2025-08-25T10:42:52-04:00 UPSTREAM: <carry>: remove the backward compat featuregate for 132028
-  - 683924808 2025-08-21T15:01:43-04:00 Revert "[release-4.18] OCPBUGS-57488: UPSTREAM: <carry>: Mark admissionregistration.k8s.io/v1beta1 as deprecated."
-  - 4795ccdc4 2025-08-21T12:06:08-04:00 UPSTREAM: 132028: podresources: list: use active pods in list
-  - 1d9e321d1 2025-06-16T13:36:55Z UPSTREAM: <carry>: Mark admissionregistration.k8s.io/v1beta1 as deprecated.
-
-- kubernetes image-arm64 d3330e0a45923552fac5a5ef94aab8f10047f967 to 3c7968e741684de8dc08ebc8aef1890b099eccae
-  - f50d9d53e 2025-08-25T10:42:52-04:00 UPSTREAM: <carry>: remove the backward compat featuregate for 132028
-  - 683924808 2025-08-21T15:01:43-04:00 Revert "[release-4.18] OCPBUGS-57488: UPSTREAM: <carry>: Mark admissionregistration.k8s.io/v1beta1 as deprecated."
-  - 4795ccdc4 2025-08-21T12:06:08-04:00 UPSTREAM: 132028: podresources: list: use active pods in list
+- api embedded-component 97c9a2259ba103d79e2b7d777337464621b08499 to e16f6cc860949caf863e79bd838491cdcb6e9641
+  - 28dddb3 2025-08-26T14:45:42+00:00 MachineOSConfig name should match MachineConfigPool
+  - 0e88dc1 2025-03-05T10:11:08+00:00 Add CEL validation for RegistrySources in Image API
+
+- cluster-kube-apiserver-operator embedded-component b46a20724df762e2df17956d9eb341252e73fccb to b6ad4b065b9f9677f0b33d625f9ae9dc36ccc3fc
+  - 7de8bb4 2025-08-29T03:13:33+00:00 Set goaway chance to 0.001
+
+- cluster-network-operator embedded-component 7aecd65a845e22325931cc7bee85a7554d204382 to b3b281c37120b57834417e1399ea27969e33b2ea
+  - f10907d 2025-08-06T13:54:32+00:00 Update CNO reviwers/approvers
+
+- kubernetes embedded-component 3c7968e741684de8dc08ebc8aef1890b099eccae to a4cad449903ebc0483194289514d09f1deac1b66
+  - f8af2469b 2025-09-05T13:10:19-03:00 UPSTREAM: revert: 133264: Revert "remove failing test that depends on expired credential, remove credential, add TODOs"
+  - 4f965d8cf 2025-08-26T15:38:26-04:00 UPSTREAM: <drop>: hack/update-vendor.sh, make update and update image
+  - c1e5f4a23 2025-08-13T14:22:03+00:00 Release commit for Kubernetes v1.31.12
+  - 2e6eaa1fb 2025-08-10T15:11:14-07:00 do not allow the node to update it's owner reference
+  - f662eeba8 2025-07-28T16:38:29-07:00 remove failing test that depends on expired credential, remove credential, add TODOs
+  - 569122914 2025-07-15T18:33:31+00:00 Update CHANGELOG/CHANGELOG-1.31.md for v1.31.11
+  - 42be76d78 2025-07-11T20:45:36+02:00 Bump images, dependencies and versions to go 1.23.11 and distroless iptables
+  - 3691b1d98 2025-05-01T21:56:29-07:00 fix(kubelet): acquire imageRecordsLock when removing image
+
+- operator-framework-olm embedded-component a62bebb1c75e41da8b01024f01a9b1e8a1fe3f8f to f295d320d98493b70a105fa22ca79fab546a2e52
+  - f4b5d52e 2025-09-06T18:04:33+02:00 UPSTREAM: <carry>: make downstream csv namespace labeler plugin e2e more resilient to race conditions
+  - 16a8043b 2025-09-06T18:04:33+02:00 Make PSA catalog tests more resilient (#3645)
+  - d82c79f1 2025-09-06T18:04:33+02:00 refactor ensure job to remove named parameters (#3644)
+  - 20569cec 2025-09-06T18:04:33+02:00 Disable FailForward bad resource e2e (#3572)
+
+- kube-rbac-proxy image-amd64 526498ab32996a0f67a96530ad7173f955e3fbe2 to 5a14ea9d338b2582c7c2a8f89f351a0c30f56371
+  - c4999f9 2025-08-29T13:56:14+02:00 fix(go.mod): bump golang.org/x/crypto/ssh to 0.31.0
+
+- kubernetes image-amd64 3c7968e741684de8dc08ebc8aef1890b099eccae to a4cad449903ebc0483194289514d09f1deac1b66
+  - f8af2469b 2025-09-05T13:10:19-03:00 UPSTREAM: revert: 133264: Revert "remove failing test that depends on expired credential, remove credential, add TODOs"
+  - 4f965d8cf 2025-08-26T15:38:26-04:00 UPSTREAM: <drop>: hack/update-vendor.sh, make update and update image
+  - c1e5f4a23 2025-08-13T14:22:03+00:00 Release commit for Kubernetes v1.31.12
+  - 2e6eaa1fb 2025-08-10T15:11:14-07:00 do not allow the node to update it's owner reference
+  - f662eeba8 2025-07-28T16:38:29-07:00 remove failing test that depends on expired credential, remove credential, add TODOs
+  - 569122914 2025-07-15T18:33:31+00:00 Update CHANGELOG/CHANGELOG-1.31.md for v1.31.11
+  - 42be76d78 2025-07-11T20:45:36+02:00 Bump images, dependencies and versions to go 1.23.11 and distroless iptables
+  - 3691b1d98 2025-05-01T21:56:29-07:00 fix(kubelet): acquire imageRecordsLock when removing image
+
+- kube-rbac-proxy image-arm64 526498ab32996a0f67a96530ad7173f955e3fbe2 to 5a14ea9d338b2582c7c2a8f89f351a0c30f56371
+  - c4999f9 2025-08-29T13:56:14+02:00 fix(go.mod): bump golang.org/x/crypto/ssh to 0.31.0
+
+- kubernetes image-arm64 3c7968e741684de8dc08ebc8aef1890b099eccae to a4cad449903ebc0483194289514d09f1deac1b66
+  - f8af2469b 2025-09-05T13:10:19-03:00 UPSTREAM: revert: 133264: Revert "remove failing test that depends on expired credential, remove credential, add TODOs"
+  - 4f965d8cf 2025-08-26T15:38:26-04:00 UPSTREAM: <drop>: hack/update-vendor.sh, make update and update image
+  - c1e5f4a23 2025-08-13T14:22:03+00:00 Release commit for Kubernetes v1.31.12
+  - 2e6eaa1fb 2025-08-10T15:11:14-07:00 do not allow the node to update it's owner reference
+  - f662eeba8 2025-07-28T16:38:29-07:00 remove failing test that depends on expired credential, remove credential, add TODOs
+  - 569122914 2025-07-15T18:33:31+00:00 Update CHANGELOG/CHANGELOG-1.31.md for v1.31.11
+  - 42be76d78 2025-07-11T20:45:36+02:00 Bump images, dependencies and versions to go 1.23.11 and distroless iptables
+  - 3691b1d98 2025-05-01T21:56:29-07:00 fix(kubelet): acquire imageRecordsLock when removing image
 
diff --git a/scripts/auto-rebase/commits.txt b/scripts/auto-rebase/commits.txt
index 9efb6e0523..f979ba6bf0 100644
--- a/scripts/auto-rebase/commits.txt
+++ b/scripts/auto-rebase/commits.txt
@@ -1,35 +1,35 @@
-https://github.com/openshift/api embedded-component 97c9a2259ba103d79e2b7d777337464621b08499
+https://github.com/openshift/api embedded-component e16f6cc860949caf863e79bd838491cdcb6e9641
 https://github.com/openshift/cluster-csi-snapshot-controller-operator embedded-component 6fe700087e8be6513285edd18f461790fecc65c3
 https://github.com/openshift/cluster-dns-operator embedded-component 7cafd0c7dca2edb154b8444602b600b5901afeba
 https://github.com/openshift/cluster-ingress-operator embedded-component d967a73c5f7da76783ee1af093f21817e7681e1d
-https://github.com/openshift/cluster-kube-apiserver-operator embedded-component b46a20724df762e2df17956d9eb341252e73fccb
+https://github.com/openshift/cluster-kube-apiserver-operator embedded-component b6ad4b065b9f9677f0b33d625f9ae9dc36ccc3fc
 https://github.com/openshift/cluster-kube-controller-manager-operator embedded-component a2cbb5725fe5e560ba40d884cfd079b3f8391f03
 https://github.com/openshift/cluster-kube-scheduler-operator embedded-component 6182930dde5ec8dd22bd50481e8b369ce673484c
-https://github.com/openshift/cluster-network-operator embedded-component 7aecd65a845e22325931cc7bee85a7554d204382
+https://github.com/openshift/cluster-network-operator embedded-component b3b281c37120b57834417e1399ea27969e33b2ea
 https://github.com/openshift/cluster-openshift-controller-manager-operator embedded-component f1711cf30f683ec0eaa187cd5168caae9e8c1254
 https://github.com/openshift/cluster-policy-controller embedded-component 5fd852525909ce6eab52972ba9ce8fcf56528eb9
 https://github.com/openshift/csi-external-snapshotter embedded-component 838d2484157f076bbb81f1b584898aec6f051c2f
 https://github.com/openshift/etcd embedded-component b5a4f8d079fbb04200251d5a6bc7c56f79d9d1e3
-https://github.com/openshift/kubernetes embedded-component 3c7968e741684de8dc08ebc8aef1890b099eccae
+https://github.com/openshift/kubernetes embedded-component a4cad449903ebc0483194289514d09f1deac1b66
 https://github.com/openshift/kubernetes-kube-storage-version-migrator embedded-component c0f1886ab08d8c2ed84c9ea648b3f65cd82dc5f5
 https://github.com/openshift/machine-config-operator embedded-component 6cabdc1467e3bcc9961544e148530a9c88789856
 https://github.com/openshift/openshift-controller-manager embedded-component 8ee744063ed12b249f1a2b89e9af4f53b2f1daf7
-https://github.com/openshift/operator-framework-olm embedded-component a62bebb1c75e41da8b01024f01a9b1e8a1fe3f8f
+https://github.com/openshift/operator-framework-olm embedded-component f295d320d98493b70a105fa22ca79fab546a2e52
 https://github.com/openshift/route-controller-manager embedded-component ce6ffa24dac3a5f49f70818e1159e40eaf27a6a3
 https://github.com/openshift/service-ca-operator embedded-component 30efb529a5b7db5d6f352f6ac0470d8385268539
 https://github.com/openshift/oc image-amd64 4fcb2d07875f05d881ac90af73723db0ae5b1d6e
 https://github.com/openshift/coredns image-amd64 eb75d9b4f41a5ce0258d6f245c6206715ecb283b
 https://github.com/openshift/csi-external-snapshotter image-amd64 838d2484157f076bbb81f1b584898aec6f051c2f
 https://github.com/openshift/router image-amd64 d8058949aaf91dcdea050c58e6a34ef5f6670c67
-https://github.com/openshift/kube-rbac-proxy image-amd64 526498ab32996a0f67a96530ad7173f955e3fbe2
+https://github.com/openshift/kube-rbac-proxy image-amd64 5a14ea9d338b2582c7c2a8f89f351a0c30f56371
 https://github.com/openshift/ovn-kubernetes image-amd64 2cbd05df74c6ab851fc644a8614417f104d5a494
-https://github.com/openshift/kubernetes image-amd64 3c7968e741684de8dc08ebc8aef1890b099eccae
+https://github.com/openshift/kubernetes image-amd64 a4cad449903ebc0483194289514d09f1deac1b66
 https://github.com/openshift/service-ca-operator image-amd64 30efb529a5b7db5d6f352f6ac0470d8385268539
 https://github.com/openshift/oc image-arm64 4fcb2d07875f05d881ac90af73723db0ae5b1d6e
 https://github.com/openshift/coredns image-arm64 eb75d9b4f41a5ce0258d6f245c6206715ecb283b
 https://github.com/openshift/csi-external-snapshotter image-arm64 838d2484157f076bbb81f1b584898aec6f051c2f
 https://github.com/openshift/router image-arm64 d8058949aaf91dcdea050c58e6a34ef5f6670c67
-https://github.com/openshift/kube-rbac-proxy image-arm64 526498ab32996a0f67a96530ad7173f955e3fbe2
+https://github.com/openshift/kube-rbac-proxy image-arm64 5a14ea9d338b2582c7c2a8f89f351a0c30f56371
 https://github.com/openshift/ovn-kubernetes image-arm64 2cbd05df74c6ab851fc644a8614417f104d5a494
-https://github.com/openshift/kubernetes image-arm64 3c7968e741684de8dc08ebc8aef1890b099eccae
+https://github.com/openshift/kubernetes image-arm64 a4cad449903ebc0483194289514d09f1deac1b66
 https://github.com/openshift/service-ca-operator image-arm64 30efb529a5b7db5d6f352f6ac0470d8385268539
diff --git a/scripts/auto-rebase/last_rebase.sh b/scripts/auto-rebase/last_rebase.sh
index db4fcf575b..42a01774a0 100755
--- a/scripts/auto-rebase/last_rebase.sh
+++ b/scripts/auto-rebase/last_rebase.sh
@@ -1,2 +1,2 @@
 #!/bin/bash -x
-./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release:4.18.0-0.nightly-2025-09-03-101304" "registry.ci.openshift.org/ocp-arm64/release-arm64:4.18.0-0.nightly-arm64-2025-09-03-045711"
+./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release:4.18.0-0.nightly-2025-09-10-135328" "registry.ci.openshift.org/ocp-arm64/release-arm64:4.18.0-0.nightly-arm64-2025-09-10-195319"
diff --git a/vendor/k8s.io/kubernetes/plugin/pkg/admission/noderestriction/admission.go b/vendor/k8s.io/kubernetes/plugin/pkg/admission/noderestriction/admission.go
index bd313cf0c2..f083e1f007 100644
--- a/vendor/k8s.io/kubernetes/plugin/pkg/admission/noderestriction/admission.go
+++ b/vendor/k8s.io/kubernetes/plugin/pkg/admission/noderestriction/admission.go
@@ -489,6 +489,11 @@ func (p *Plugin) admitNode(nodeName string, a admission.Attributes) error {
 			return admission.NewForbidden(a, fmt.Errorf("node %q is not allowed to modify taints", nodeName))
 		}
 
+		// Don't allow a node to update its own ownerReferences.
+		if !apiequality.Semantic.DeepEqual(node.OwnerReferences, oldNode.OwnerReferences) {
+			return admission.NewForbidden(a, fmt.Errorf("node %q is not allowed to modify ownerReferences", nodeName))
+		}
+
 		// Don't allow a node to update labels outside the allowed set.
 		// This would allow a node to add or modify its labels in a way that would let it steer privileged workloads to itself.
 		modifiedLabels := getModifiedLabels(node.Labels, oldNode.Labels)
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 5ef45a90f0..1347bd297b 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1193,7 +1193,7 @@ gopkg.in/yaml.v2
 # gopkg.in/yaml.v3 v3.0.1
 ## explicit
 gopkg.in/yaml.v3
-# k8s.io/api v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/api
+# k8s.io/api v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/api
 ## explicit; go 1.22.0
 k8s.io/api/admission/v1
 k8s.io/api/admission/v1beta1
@@ -1253,7 +1253,7 @@ k8s.io/api/storage/v1
 k8s.io/api/storage/v1alpha1
 k8s.io/api/storage/v1beta1
 k8s.io/api/storagemigration/v1alpha1
-# k8s.io/apiextensions-apiserver v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/apiextensions-apiserver
+# k8s.io/apiextensions-apiserver v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/apiextensions-apiserver
 ## explicit; go 1.22.0
 k8s.io/apiextensions-apiserver/pkg/apihelpers
 k8s.io/apiextensions-apiserver/pkg/apis/apiextensions
@@ -1300,7 +1300,7 @@ k8s.io/apiextensions-apiserver/pkg/generated/openapi
 k8s.io/apiextensions-apiserver/pkg/registry/customresource
 k8s.io/apiextensions-apiserver/pkg/registry/customresource/tableconvertor
 k8s.io/apiextensions-apiserver/pkg/registry/customresourcedefinition
-# k8s.io/apimachinery v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/apimachinery
+# k8s.io/apimachinery v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/apimachinery
 ## explicit; go 1.22.0
 k8s.io/apimachinery/pkg/api/equality
 k8s.io/apimachinery/pkg/api/errors
@@ -1371,7 +1371,7 @@ k8s.io/apimachinery/pkg/watch
 k8s.io/apimachinery/third_party/forked/golang/json
 k8s.io/apimachinery/third_party/forked/golang/netutil
 k8s.io/apimachinery/third_party/forked/golang/reflect
-# k8s.io/apiserver v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/apiserver
+# k8s.io/apiserver v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/apiserver
 ## explicit; go 1.22.0
 k8s.io/apiserver/pkg/admission
 k8s.io/apiserver/pkg/admission/configuration
@@ -1546,13 +1546,13 @@ k8s.io/apiserver/plugin/pkg/authenticator/token/oidc
 k8s.io/apiserver/plugin/pkg/authenticator/token/webhook
 k8s.io/apiserver/plugin/pkg/authorizer/webhook
 k8s.io/apiserver/plugin/pkg/authorizer/webhook/metrics
-# k8s.io/cli-runtime v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/cli-runtime
+# k8s.io/cli-runtime v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/cli-runtime
 ## explicit; go 1.22.0
 k8s.io/cli-runtime/pkg/genericclioptions
 k8s.io/cli-runtime/pkg/genericiooptions
 k8s.io/cli-runtime/pkg/printers
 k8s.io/cli-runtime/pkg/resource
-# k8s.io/client-go v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/client-go
+# k8s.io/client-go v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/client-go
 ## explicit; go 1.22.0
 k8s.io/client-go/applyconfigurations
 k8s.io/client-go/applyconfigurations/admissionregistration/v1
@@ -1910,7 +1910,7 @@ k8s.io/client-go/util/keyutil
 k8s.io/client-go/util/retry
 k8s.io/client-go/util/watchlist
 k8s.io/client-go/util/workqueue
-# k8s.io/cloud-provider v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/cloud-provider
+# k8s.io/cloud-provider v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/cloud-provider
 ## explicit; go 1.22.0
 k8s.io/cloud-provider
 k8s.io/cloud-provider/api
@@ -1932,14 +1932,14 @@ k8s.io/cloud-provider/service/helpers
 k8s.io/cloud-provider/volume
 k8s.io/cloud-provider/volume/errors
 k8s.io/cloud-provider/volume/helpers
-# k8s.io/cluster-bootstrap v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/cluster-bootstrap
+# k8s.io/cluster-bootstrap v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/cluster-bootstrap
 ## explicit; go 1.22.0
 k8s.io/cluster-bootstrap/token/api
 k8s.io/cluster-bootstrap/token/jws
 k8s.io/cluster-bootstrap/token/util
 k8s.io/cluster-bootstrap/util/secrets
 k8s.io/cluster-bootstrap/util/tokens
-# k8s.io/component-base v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/component-base
+# k8s.io/component-base v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/component-base
 ## explicit; go 1.22.0
 k8s.io/component-base/cli
 k8s.io/component-base/cli/flag
@@ -1973,7 +1973,7 @@ k8s.io/component-base/tracing
 k8s.io/component-base/tracing/api/v1
 k8s.io/component-base/version
 k8s.io/component-base/version/verflag
-# k8s.io/component-helpers v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/component-helpers
+# k8s.io/component-helpers v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/component-helpers
 ## explicit; go 1.22.0
 k8s.io/component-helpers/apimachinery/lease
 k8s.io/component-helpers/apps/poddisruptionbudget
@@ -1986,7 +1986,7 @@ k8s.io/component-helpers/scheduling/corev1
 k8s.io/component-helpers/scheduling/corev1/nodeaffinity
 k8s.io/component-helpers/storage/ephemeral
 k8s.io/component-helpers/storage/volume
-# k8s.io/controller-manager v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/controller-manager
+# k8s.io/controller-manager v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/controller-manager
 ## explicit; go 1.22.0
 k8s.io/controller-manager/app
 k8s.io/controller-manager/config
@@ -2003,27 +2003,27 @@ k8s.io/controller-manager/pkg/informerfactory
 k8s.io/controller-manager/pkg/leadermigration
 k8s.io/controller-manager/pkg/leadermigration/config
 k8s.io/controller-manager/pkg/leadermigration/options
-# k8s.io/cri-api v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/cri-api
+# k8s.io/cri-api v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/cri-api
 ## explicit; go 1.22.0
 k8s.io/cri-api/pkg/apis
 k8s.io/cri-api/pkg/apis/runtime/v1
 k8s.io/cri-api/pkg/errors
-# k8s.io/cri-client v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/cri-client
+# k8s.io/cri-client v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/cri-client
 ## explicit; go 1.22.0
 k8s.io/cri-client/pkg
 k8s.io/cri-client/pkg/internal
 k8s.io/cri-client/pkg/logs
 k8s.io/cri-client/pkg/util
-# k8s.io/csi-translation-lib v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/csi-translation-lib
+# k8s.io/csi-translation-lib v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/csi-translation-lib
 ## explicit; go 1.22.0
 k8s.io/csi-translation-lib
 k8s.io/csi-translation-lib/plugins
-# k8s.io/dynamic-resource-allocation v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/dynamic-resource-allocation
+# k8s.io/dynamic-resource-allocation v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/dynamic-resource-allocation
 ## explicit; go 1.22.0
 k8s.io/dynamic-resource-allocation/cel
 k8s.io/dynamic-resource-allocation/resourceclaim
 k8s.io/dynamic-resource-allocation/structured
-# k8s.io/endpointslice v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/endpointslice
+# k8s.io/endpointslice v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/endpointslice
 ## explicit; go 1.22.0
 k8s.io/endpointslice
 k8s.io/endpointslice/metrics
@@ -2048,13 +2048,13 @@ k8s.io/klog/v2/internal/severity
 k8s.io/klog/v2/internal/sloghandler
 k8s.io/klog/v2/internal/verbosity
 k8s.io/klog/v2/textlogger
-# k8s.io/kms v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/kms
+# k8s.io/kms v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/kms
 ## explicit; go 1.22.0
 k8s.io/kms/apis/v1beta1
 k8s.io/kms/apis/v2
 k8s.io/kms/pkg/service
 k8s.io/kms/pkg/util
-# k8s.io/kube-aggregator v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/kube-aggregator
+# k8s.io/kube-aggregator v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/kube-aggregator
 ## explicit; go 1.22.0
 k8s.io/kube-aggregator/pkg/apis/apiregistration
 k8s.io/kube-aggregator/pkg/apis/apiregistration/install
@@ -2087,7 +2087,7 @@ k8s.io/kube-aggregator/pkg/controllers/status/remote
 k8s.io/kube-aggregator/pkg/registry/apiservice
 k8s.io/kube-aggregator/pkg/registry/apiservice/etcd
 k8s.io/kube-aggregator/pkg/registry/apiservice/rest
-# k8s.io/kube-controller-manager v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/kube-controller-manager
+# k8s.io/kube-controller-manager v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/kube-controller-manager
 ## explicit; go 1.22.0
 k8s.io/kube-controller-manager/config/v1alpha1
 # k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340
@@ -2120,11 +2120,11 @@ k8s.io/kube-openapi/pkg/validation/spec
 k8s.io/kube-openapi/pkg/validation/strfmt
 k8s.io/kube-openapi/pkg/validation/strfmt/bson
 k8s.io/kube-openapi/pkg/validation/validate
-# k8s.io/kube-scheduler v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/kube-scheduler
+# k8s.io/kube-scheduler v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/kube-scheduler
 ## explicit; go 1.22.0
 k8s.io/kube-scheduler/config/v1
 k8s.io/kube-scheduler/extender/v1
-# k8s.io/kubectl v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/kubectl
+# k8s.io/kubectl v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/kubectl
 ## explicit; go 1.22.0
 k8s.io/kubectl/pkg/apps
 k8s.io/kubectl/pkg/cmd/apiresources
@@ -2159,7 +2159,7 @@ k8s.io/kubectl/pkg/util/storage
 k8s.io/kubectl/pkg/util/templates
 k8s.io/kubectl/pkg/util/term
 k8s.io/kubectl/pkg/validation
-# k8s.io/kubelet v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/kubelet
+# k8s.io/kubelet v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/kubelet
 ## explicit; go 1.22.0
 k8s.io/kubelet/config/v1
 k8s.io/kubelet/config/v1alpha1
@@ -2180,7 +2180,7 @@ k8s.io/kubelet/pkg/cri/streaming
 k8s.io/kubelet/pkg/cri/streaming/portforward
 k8s.io/kubelet/pkg/cri/streaming/remotecommand
 k8s.io/kubelet/pkg/types
-# k8s.io/kubernetes v1.31.11 => ./deps/github.com/openshift/kubernetes
+# k8s.io/kubernetes v1.31.12 => ./deps/github.com/openshift/kubernetes
 ## explicit; go 1.22.0
 k8s.io/kubernetes/cmd/kube-apiserver/app
 k8s.io/kubernetes/cmd/kube-apiserver/app/options
@@ -2989,7 +2989,7 @@ k8s.io/kubernetes/third_party/forked/gonum/graph
 k8s.io/kubernetes/third_party/forked/gonum/graph/internal/linear
 k8s.io/kubernetes/third_party/forked/gonum/graph/simple
 k8s.io/kubernetes/third_party/forked/gonum/graph/traverse
-# k8s.io/metrics v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/metrics
+# k8s.io/metrics v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/metrics
 ## explicit; go 1.22.0
 k8s.io/metrics/pkg/apis/custom_metrics
 k8s.io/metrics/pkg/apis/custom_metrics/v1beta1
@@ -3004,10 +3004,10 @@ k8s.io/metrics/pkg/client/clientset/versioned/typed/metrics/v1beta1
 k8s.io/metrics/pkg/client/custom_metrics
 k8s.io/metrics/pkg/client/custom_metrics/scheme
 k8s.io/metrics/pkg/client/external_metrics
-# k8s.io/mount-utils v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/mount-utils
+# k8s.io/mount-utils v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/mount-utils
 ## explicit; go 1.22.0
 k8s.io/mount-utils
-# k8s.io/pod-security-admission v1.31.11 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/pod-security-admission
+# k8s.io/pod-security-admission v1.31.12 => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/pod-security-admission
 ## explicit; go 1.22.0
 k8s.io/pod-security-admission/admission
 k8s.io/pod-security-admission/admission/api