- Memory limits could be decreased with a `NotRequired` resize restart policy. When decreasing memory limits,a best-effort check was performed to prevent limits from decreasing below usage and triggering an OOM-kill. ([#133012](https://github.com/kubernetes/kubernetes/pull/133012),...

- InPlacePodVerticalScaling: Memory limits cannot be decreased unless the memory resize restart policy is set to `RestartContainer`. Container resizePolicy is no longer mutable. ([#130183](https://github.com/kubernetes/kubernetes/pull/130183), [@tallclair](https://github.com/tallclair)) [SIG Apps and Node]

 *       than MEDIUM. And so on. These constants are set to conservative values, but even so, if
 *       there is ever any doubt, they can all be increased in one spot to rerun tests on slower
 *       platforms.
 *   <li>All threads generated must be joined inside each test case method (or {@code fail} to do

- Made legacy watch calls (`ResourceVersion` = 0 or unset) that generate init-events weigh higher in `API Priority and Fairness (APF)` seat usage. Properly accounting for their cost protects the API server from CPU overload. Users might see increased throttling of such calls as a result. ([#134601](https://github.com/kubernetes/kubernetes/pull/134601), [@shyamjvs](https://github.com/shyamjvs))

- Resolves a performance regression in default 1.31+ configurations, related to the ConsistentListFromCache feature, where rapid create / update API requests across different namespaces encounter increased latency. ([#130136](https://github.com/kubernetes/kubernetes/pull/130136), [@AwesomePatrol](https://github.com/AwesomePatrol)) [SIG API Machinery]
- The following roles have had `Watch` added to them (prefixed with `system:controller:`):

if not fixed. g.startReady = true g.start = counter } counter -= g.start // Ensure the counter is strictly increasing. if counter == math.MaxUint64 { panic("crypto/cipher: counter exhausted") } if counter < g.next { panic("crypto/cipher: counter decreased or remained the same") } g.next = counter + 1 } fips140.RecordApproved() return g.g.sealAfterIndicator(dst, nonce, plaintext, data) } func (g *GCMWithCounterNonce) Open(dst, nonce, ciphertext, data []byte) ([]byte, error) { fips140.RecordApproved()...