chore: bump ACM to v2.16.3-552 and MCE to v2.11.5-599

[Inbharaj Mani (inbharajmani)]

Summary

• Bump ACM operator bundle to v2.16.3-552 (2026-08-04)
• Bump MCE operator bundle to v2.11.5-599 (2026-08-04)

CVE-2026-4740 (GHSA-q4gv-pjmh-c735) Status

This bundle update picks up a new managedcluster-import-controller-rhel9 image (sha256:4dad2eb1...) which bumps the open-cluster-management.io/ocm Go dependency from v1.1.1 to v1.2.1 — the scanner-recognized fix version. Trivy no longer flags this image.

The remaining 5 images built from stolostron/ocm (backplane-2.11) are at OCM v1.1.4-0.20260731.... The fix code is present (cherry-picked April 8) but scanners still flag them because the GHSA advisory only lists >= v1.2.1 as patched:

Image	OCM Version	Scanner Status
addon-manager-rhel9	v1.1.4 (main module)	Flagged — awaiting GHSA advisory update
placement-rhel9	v1.1.4 (main module)	Flagged — awaiting GHSA advisory update
registration-rhel9	v1.1.4 (main module)	Flagged — awaiting GHSA advisory update
registration-operator-rhel9	v1.1.4 (main module)	Flagged — awaiting GHSA advisory update
work-rhel9	v1.1.4 (main module)	Flagged — awaiting GHSA advisory update
managedcluster-import-controller-rhel9	v1.2.1 (dep)	Clean

A PR to update the GHSA advisory to include v1.1.3 as a patched version is open: github/advisory-database#8953. Once merged, the remaining 5 images will clear.

Test plan

• make helm-charts — ACM helm charts rebuilt successfully
• cd config && make materialize — all rendered configs updated, helm tests pass
• Trivy scan confirms import-controller is clean for CVE-2026-4740

[Copilot]

Pull request overview

Bumps the configured ACM (Advanced Cluster Management) and MCE (MultiCluster Engine) operator bundle digests and refreshes the in-repo Helm chart content/fixtures to match the updated bundle payloads. This is part of keeping the management stack current and (per the PR description) aligning with the CVE-2026-4740 remediation status for at least the managedcluster-import-controller image.

Changes:

• Updated ACM and MCE operator bundle digests in config/config.yaml and propagated to rendered environment configs.
• Updated MCE Helm chart versions to 2.11.5 and refreshed operator operand image digests in the operator Deployment template.
• Regenerated Helm template fixtures and adjusted MCE scheduling constraints to use an infra nodeSelector.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
config/rendered/dev/pers/westus3.yaml	Propagates updated ACM/MCE bundle digests into rendered config for pers.
config/rendered/dev/perf/westus3.yaml	Propagates updated ACM/MCE bundle digests into rendered config for perf.
config/rendered/dev/dev/westus3.yaml	Propagates updated ACM/MCE bundle digests into rendered config for dev.
config/rendered/dev/cspr/westus3.yaml	Propagates updated ACM/MCE bundle digests into rendered config for cspr.
config/rendered/dev/ci01/centralus.yaml	Propagates updated ACM/MCE bundle digests into rendered config for ci01.
config/rendered/dev/ci00/centralus.yaml	Propagates updated ACM/MCE bundle digests into rendered config for ci00.
config/config.yaml	Updates default ACM/MCE bundle digests and version comments.
acm/zz_fixture_TestHelmTemplate_dev_westus3_mgmt_1_mce.yaml	Regenerated Helm fixture reflecting updated MCE manifests (incl. scheduling + version).
acm/zz_fixture_TestHelmTemplate_dev_westus3_mgmt_1_mce_config.yaml	Regenerated Helm fixture content for MCE config chart output.
acm/deploy/helm/multicluster-engine/templates/multicluster-engine-operator.deployment.yaml	Updates operand image digests and changes scheduling behavior for the MCE operator Deployment.
acm/deploy/helm/multicluster-engine/Chart.yaml	Bumps MCE chart version/appVersion and source bundle digest reference.
acm/deploy/helm/multicluster-engine-crds/Chart.yaml	Bumps MCE CRDs chart version/appVersion and source bundle digest reference.
acm/deploy/helm/multicluster-engine-config/charts/policy/values.yaml	Updates governance/policy image override digests to match the new bundle payload.
acm/deploy/helm/multicluster-engine-config/charts/policy/crds/agent.open-cluster-management.io_klusterletaddonconfigs_crd.yaml	Updates CRD header content as part of chart refresh/regeneration.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.

[Jan-Hendrik Boll (janboll)]

/lgtm

[Jan-Hendrik Boll (janboll)]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: inbharajmani, janboll

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• acm/OWNERS [janboll]
• config/OWNERS [janboll]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Rael Garcia (raelga)]

Superseded by #6337, which already merged the same ACM v2.16.3-552 and MCE v2.11.5-599 bumps (force-merged as a P0 exception to land the CVE-2026-4740 / GHSA-q4gv-pjmh-c735 remediation ahead of the deadline). The managedcluster-import-controller image built against the fixed OCM v1.2.1 dependency is now on main via #6337, so this dedicated PR is no longer needed.

Thanks Inbharaj Mani (@inbharajmani) for driving the fix. Closing this one out.

/close