- Fixed the kubelet to honor the `userNamespaces.idsPerPod` configuration, which was previously ignored. ([#133373](https://github.com/kubernetes/kubernetes/pull/133373), [@AkihiroSuda](https://github.com/AkihiroSuda)) [SIG Node and Testing]
- Fixed the replacement tag in APIs so it no longer acted as a selector for storage version. ([#135197](https://github.com/kubernetes/kubernetes/pull/135197), [@Jefftree](https://github.com/Jefftree))

    void testGetDomainSid() throws SmbException {
        // Create a mock RPC SID to simulate a user SID
        rpc.sid_t rpcSid = new rpc.sid_t();
        rpcSid.revision = 1;
        rpcSid.sub_authority_count = 5; // Fixed: should be 5 for domain SID with RID
        rpcSid.identifier_authority = new byte[] { 0, 0, 0, 0, 0, 5 };
        rpcSid.sub_authority = new int[] { 21, 123, 456, 789, 1000 };

   * with {@code FeatureSpecificTestSuiteBuilder.suppressing()} until <a
   * href="https://bugs.openjdk.org/browse/JDK-6409434">JDK-6409434</a> is fixed. It's unclear
   * whether nulls were to be permitted or forbidden, but presumably the eventual fix will be to
   * permit them, as it seems more likely that code would depend on that behavior than on the other.

   * with {@code FeatureSpecificTestSuiteBuilder.suppressing()} until <a
   * href="https://bugs.openjdk.org/browse/JDK-6409434">JDK-6409434</a> is fixed. It's unclear
   * whether nulls were to be permitted or forbidden, but presumably the eventual fix will be to
   * permit them, as it seems more likely that code would depend on that behavior than on the other.

- Fixed a panic issue related to kubectl revision history kubernetes/kubectl#1724 ([#130503](https://github.com/kubernetes/kubernetes/pull/130503), [@tahacodes](https://github.com/tahacodes)) [SIG CLI]
- Fixed a possible deadlock in the watch client that could happen if the watch was not stopped. ([#131266](https://github.com/kubernetes/kubernetes/pull/131266), [@karlkfi](https://github.com/karlkfi)) [SIG API Machinery]

        ValidateNegotiateInfoRequest request =
                new ValidateNegotiateInfoRequest(DEFAULT_CAPABILITIES, defaultClientGuid, DEFAULT_SECURITY_MODE, defaultDialects);

        // Expected size: 24 (fixed) + 2 * number of dialects
        int expectedSize = 24 + 2 * defaultDialects.length;
        assertEquals(expectedSize, request.size());
    }

    @Test
    @DisplayName("Test size calculation with single dialect")

    }

    /**
     * Fixes a string created with Windows-specific mapping rules.
     *
     * @param source
     *            String created with Windows-specific mapping rules
     * @return The fixed string
     */
    public static String fromWindowsMapping(final String source) {
        if (isEmpty(source)) {
            return source;
        }
        final char[] array = source.toCharArray();

- Fixed a possible memory leak in the QueueingHint (alpha feature). ([#126962](https://github.com/kubernetes/kubernetes/pull/126962), [@sanposhiho](https://github.com/sanposhiho))
- Fixed a potential memory leak in QueueingHint (alpha feature). ([#127016](https://github.com/kubernetes/kubernetes/pull/127016), [@sanposhiho](https://github.com/sanposhiho))

        @Override
        int writeBodyWireFormat(byte[] dst, int dstIndex) {
            // For testing purposes, we can return a fixed length or mock behavior
            return 0;
        }

        @Override
        int readBodyWireFormat(byte[] src, int srcIndex) {
            // For testing purposes, we can return a fixed length or mock behavior
            return 0;
        }

        @Override

- Fixed a bug in kube-proxy nftables mode (GA as of 1.33) that fails to determine if traffic originates from a local source on the node. The issue was caused by using the wrong meta `iif` instead of `iifname` for name based matches. ([#134099](https://github.com/kubernetes/kubernetes/pull/134099), [@aroradaman](https://github.com/aroradaman)) [SIG Network]