* When creating a service with annotation: service.beta.kubernetes.io/load-balancer-source-ranges containing multiple source ranges and service.beta.kubernetes.io/azure-shared-securityrule: "false",  the NSG rules will be collapsed. ([#71484](https://github.com/kubernetes/kubernetes/pull/71484), [@ritazh](https://github.com/ritazh))

- GCE clusters will include some IP ranges that are not used on the public Internet in the list of non-masq IPs. Bumped ip-masq-agent version to v2.3.0 with flag `nomasq-all-reserved-ranges` turned on. ([#77458](https://github.com/kubernetes/kubernetes/pull/77458), [@grayluck](https://github.com/grayluck))

<!-- BEGIN MUNGE: GENERATED_TOC -->
- [v1.10.13](#v11013)
  - [Downloads for v1.10.13](#downloads-for-v11013)
    - [Client Binaries](#client-binaries)
    - [Server Binaries](#server-binaries)
    - [Node Binaries](#node-binaries)
  - [Changelog since v1.10.12](#changelog-since-v11012)
    - [Other notable changes](#other-notable-changes)
- [v1.10.12](#v11012)
  - [Downloads for v1.10.12](#downloads-for-v11012)
    - [Client Binaries](#client-binaries-1)

<!-- BEGIN MUNGE: GENERATED_TOC -->
- [v1.11.10](#v11110)
  - [Downloads for v1.11.10](#downloads-for-v11110)
    - [Client Binaries](#client-binaries)
    - [Server Binaries](#server-binaries)
    - [Node Binaries](#node-binaries)
  - [Changelog since v1.11.9](#changelog-since-v1119)
    - [Other notable changes](#other-notable-changes)
- [v1.11.9](#v1119)
  - [Downloads for v1.11.9](#downloads-for-v1119)
    - [Client Binaries](#client-binaries-1)

* 🐛 Fix support for prefix on APIRouter WebSockets. PR [#2640](https://github.com/tiangolo/fastapi/pull/2640) by [@Kludex](https://github.com/Kludex).

### Upgrades

* ⬆️ Update ujson ranges for CVE-2021-45958. PR [#4804](https://github.com/tiangolo/fastapi/pull/4804) by [@tiangolo](https://github.com/tiangolo).

- Added the latest GCE pinhole firewall feature, which introduces `destination-ranges` in the ingress `firewall-rules`. It restricts access to the backend IPs by allowing traffic through `ILB` or `NetLB` only. This change does **NOT** change the existing `ILB` or `NetLB` behavior. ([#109510](https://github.com/kubernetes/kubernetes/pull/109510),...

- Kube-controller-manager: volume plugins can be restricted from contacting local and loopback addresses by setting `--volume-host-allow-local-loopback=false`, or from contacting specific CIDR ranges by setting `--volume-host-cidr-denylist` (for example, `--volume-host-cidr-denylist=127.0.0.1/28,feed::/16`) ([#91785](https://github.com/kubernetes/kubernetes/pull/91785), [@mattcary](https://github.com/mattcary)) [SIG API Machinery, Apps, Auth,...

<!-- BEGIN MUNGE: GENERATED_TOC -->
- [v1.12.10](#v11210)
  - [Downloads for v1.12.10](#downloads-for-v11210)
    - [Client Binaries](#client-binaries)
    - [Server Binaries](#server-binaries)
    - [Node Binaries](#node-binaries)
  - [Changelog since v1.12.9](#changelog-since-v1129)
    - [Other notable changes](#other-notable-changes)
- [v1.12.9](#v1129)
  - [Downloads for v1.12.9](#downloads-for-v1129)
    - [Client Binaries](#client-binaries-1)

<!-- BEGIN MUNGE: GENERATED_TOC -->

- [v1.16.15](#v11615)
  - [Downloads for v1.16.15](#downloads-for-v11615)
    - [Source Code](#source-code)
    - [Client binaries](#client-binaries)
    - [Server binaries](#server-binaries)
    - [Node binaries](#node-binaries)
  - [Changelog since v1.16.14](#changelog-since-v11614)
  - [Changes by Kind](#changes-by-kind)
    - [Bug or Regression](#bug-or-regression)
  - [Dependencies](#dependencies)

<!-- BEGIN MUNGE: GENERATED_TOC -->

- [v1.26.15](#v12615)
  - [Downloads for v1.26.15](#downloads-for-v12615)
    - [Source Code](#source-code)
    - [Client Binaries](#client-binaries)
    - [Server Binaries](#server-binaries)
    - [Node Binaries](#node-binaries)
    - [Container Images](#container-images)
  - [Changelog since v1.26.14](#changelog-since-v12614)
  - [Changes by Kind](#changes-by-kind)
    - [Feature](#feature)