* --alpha-endpoint-reconciler-type=(master-count, lease, none) (default
    * "master-count"). The original reconciler is 'master-count'. The 'lease'
    * reconciler uses the storageapi and a TTL to keep alive an endpoint within the
    * `kube-apiserver-endpoint` storage namespace. The 'none' reconciler is a noop
    * reconciler that does not do anything. This is useful for self-hosted

### Other (Cleanup or Flake)

- NONE
  NONE ([#136634](https://github.com/kubernetes/kubernetes/pull/136634), [@dims](https://github.com/dims)) [SIG Network and Testing]

## Dependencies

### Added
_Nothing has changed._

### Changed

* Default mount propagation has changed from "HostToContainer" ("rslave" in Linux terminology) to "None" ("private") to match the behavior in 1.9 and earlier releases. "HostToContainer" as a default caused regressions in some pods. ([#62462](https://github.com/kubernetes/kubernetes/pull/62462), [@jsafrane](https://github.com/jsafrane))

### Other (Cleanup or Flake)

- NONE
  NONE ([#136637](https://github.com/kubernetes/kubernetes/pull/136637), [@dims](https://github.com/dims)) [SIG Network and Testing]

## Dependencies

### Added
_Nothing has changed._

### Changed

### Other (Cleanup or Flake)

- Kubernetes is now built with Go 1.24.12 ([#136440](https://github.com/kubernetes/kubernetes/pull/136440), [@BenTheElder](https://github.com/BenTheElder)) [SIG Release]
- NONE
  NONE ([#136635](https://github.com/kubernetes/kubernetes/pull/136635), [@dims](https://github.com/dims)) [SIG Network and Testing]

## Dependencies

### Added
_Nothing has changed._

### Changed

### Uncategorized

- NONE
  NONE ([#127462](https://github.com/kubernetes/kubernetes/pull/127462), [@dims](https://github.com/dims)) [SIG Node and Testing]

## Dependencies

### Added
_Nothing has changed._

### Changed

### Other (Cleanup or Flake)

- NONE ([#130012](https://github.com/kubernetes/kubernetes/pull/130012), [@tallclair](https://github.com/tallclair)) [SIG Node]

## Dependencies

### Added
_Nothing has changed._

### Changed

- NONE ([#126127](https://github.com/kubernetes/kubernetes/pull/126127), [@cji](https://github.com/cji)) [SIG Node and Windows]

## Dependencies

### Added
_Nothing has changed._

### Changed

#### kubectl:
- the boolean and unset values for the --dry-run flag are deprecated and a value --dry-run=server|client|none will be required in a future version. ([#87580](https://github.com/kubernetes/kubernetes/pull/87580), [@julianvmodesto](https://github.com/julianvmodesto)) [SIG CLI]

**CVSS Rating:** Medium (5.9) [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N)

## Changes by Kind

### API Change

- NONE ([#129603](https://github.com/kubernetes/kubernetes/pull/129603), [@aravindhp](https://github.com/aravindhp)) [SIG API Machinery and Node]

### Feature