pkg syscall (darwin-arm64), const SYS_CLOSE_NOCANCEL ideal-int
pkg syscall (darwin-arm64), const SYS_CONNECT = 98
pkg syscall (darwin-arm64), const SYS_CONNECT ideal-int
pkg syscall (darwin-arm64), const SYS_CONNECT_NOCANCEL = 409
pkg syscall (darwin-arm64), const SYS_CONNECT_NOCANCEL ideal-int
pkg syscall (darwin-arm64), const SYS_COPYFILE = 227
pkg syscall (darwin-arm64), const SYS_COPYFILE ideal-int

// container.securityContext take precedence over field values of PodSecurityContext.
message PodSecurityContext {
  // The SELinux context to be applied to all containers.
  // If unspecified, the container runtime will allocate a random SELinux context for each
  // container.  May also be set in SecurityContext.  If set in
  // both SecurityContext and PodSecurityContext, the value specified in SecurityContext

### Auth

- Fixed OpenID Connect (OIDC) token refresh when the client secret contains a special character. ([#76914](https://github.com/kubernetes/kubernetes/pull/76914), [@tsuna](https://github.com/tsuna))

* kube-apiserver: the OpenID Connect authenticator can now verify ID Tokens signed with JOSE algorithms other than RS256 through the --oidc-signing-algs flag. ([#58544](https://github.com/kubernetes/kubernetes/pull/58544), [@ericchiang](https://github.com/ericchiang))

- [`KTIJ-24121`](https://youtrack.jetbrains.com/issue/KTIJ-24121) K2 IDE. "failed to convert element KtLightField" when trying to declare property after function that has return with type mismatch
- [`KTIJ-25335`](https://youtrack.jetbrains.com/issue/KTIJ-25335) K2 IDE. "failed to convert element KtLightField:<no name provided>" on attempt to set property in class with constructor

- Fixes a regression in v1beta1 PodDisruptionBudget handling of `strategic merge patch`-type API requests for the `selector` field. Prior to 1.21, these requests would merge `matchLabels` content and replace `matchExpressions` content. In 1.21, patch requests touching the `selector` field started replacing the entire selector. This is consistent with server-side apply and the v1 PodDisruptionBudget behavior, but should not have been changed for v1beta1. ([#...

* API server authentication now caches successful bearer token authentication results for a few seconds. ([#50258](https://github.com/kubernetes/kubernetes/pull/50258), [@liggitt](https://github.com/liggitt))

- Ignore context canceled from validate and mutate webhook ([#120017](https://github.com/kubernetes/kubernetes/pull/120017), [@divyasri537](https://github.com/divyasri537)) [SIG API Machinery]

### API Change

* The OpenID Connect authenticator can now use a custom prefix, or omit the default prefix, for username and groups claims through the --oidc-username-prefix and --oidc-groups-prefix flags. For example, the authenticator can map a user with the username "jane" to "google:jane"...