rewriter.create<TF::LessOp>(loc, b_false.getType(), n_plus_y, b_rows));
    Value in_bounds = rewriter.create<ReshapeOp>(
        loc,
        tensorflow::GetTypeFromTFTensorShape(Shape({num_diags, max_diag_len}),
                                             rewriter.getIntegerType(1)),
        rewriter.create<AndOp>(loc, x_in_bounds, y_in_bounds));

    // Now combine x and y into the index data structure needed for gather.

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
- 29940
upgradeNotes:
  - title: Inbound Forwarding Configuration
    content: |
      The behavior of inbound forwarding will be modified in the near future. While this change is not enabled
      by default in Istio 1.10, it can be enabled today by configuring the `PILOT_ENABLE_INBOUND_PASSTHROUGH=true` environment
      variable in Istiod.

apiVersion: release-notes/v2
kind: bug-fix
area: security
releaseNotes:
- |
  **Improved** TLS configuration on sidecar server side inbound paths to enforce TLSv2 version along with recommended cipher suites.

area: networking
issues:
  - 26861
releaseNotes:
- |
  **Updated** the inbound Envoy cluster name format to reduce 503 errors during Service changes.

upgradeNotes:
- title: Inbound Cluster Name Format
  content: |
    The format of inbound Envoy cluster names has changed. Previously, they included the Service hostname
    and port name, such as `inbound|80|http|httpbin.default.svc.cluster.local`. This lead to issues when multiple

apiVersion: release-notes/v2
kind: bug-fix 
area: networking
releaseNotes:
- |

apiVersion: release-notes/v2
kind: bug-fix
area: networking
issue:
- 29412
releaseNotes:
- |
  **Improved** the `istioctl x workload` command to configure VMs to disable inbound `iptables` capture

kind: feature
area: traffic-management
releaseNotes:
- |
  **Removed** the `PILOT_ENABLE_INBOUND_PASSTHROUGH` setting, which has been enabled-by-default for the past 8 releases.

Ben Leggett <******@****.***> 1710179183 -0400

	check := map[string]int{}
	for i1, l1 := range l.FilterChains {
		// We still create virtual inbound listeners before merging into single inbound
		// This hack skips these ones, as they will be processed later
		if hcm := ExtractHTTPConnectionManager(t, l1); strings.HasPrefix(hcm.GetStatPrefix(), "inbound_") && l.Name != "virtualInbound" {
			continue
		}

		s := Dump(t, l1.FilterChainMatch)
		if i2, ok := check[s]; ok {

Ben Leggett <******@****.***> 1710179183 -0400