- Client-go certificate manager rotation gained the ability to preserve optional intermediate chains accompanying issued certificates ([#88744](https://github.com/kubernetes/kubernetes/pull/88744), [@jackkleeman](https://github.com/jackkleeman)) [SIG API Machinery and Auth]

Before Starlette `0.24.0`, a new instance of each middleware class would be created when a new middleware was added. That normally was not a problem, unless the middleware class expected to be created only once, with only one instance, that happened in some cases. This upgrade would solve those cases (thanks [@adriangb](https://github.com/adriangb)! Starlette PR [#2017](https://github.com/encode/starlette/pull/2017)). Now the middleware class instances are created once, right before the first request...

GODEBUG setting fips140=" + v) } } // Supported returns an error if FIPS 140-3 mode can't be enabled. func Supported() error { // Keep this in sync with fipsSupported in cmd/dist/test.go. // The purego tag changes too much of the implementation to claim the // validation still applies. if puregoEnabled { return errors.New("FIPS 140-3 mode is incompatible with the purego build tag") } // ASAN disapproves of reading swaths of global memory in fips140/check. // One option would be to expose runtime.asanunpoison...

!purego && (386 || amd64 || arm || arm64 || loong64 || ppc64 || ppc64le || riscv64 || s390x) package bigmod import ( "crypto/internal/fips140deps/cpu" "crypto/internal/impl" ) // amd64 assembly uses ADCX/ADOX/MULX if ADX is available to run two carry // chains in the flags in parallel across the whole operation, and aggressively // unrolls loops. arm64 processes four words at a time. // // It's unclear why the assembly for all other architectures, as well as for // amd64 without ADX, perform better than...