pkg syscall (darwin-arm64), const IPV6_MAX_MEMBERSHIPS = 4095
pkg syscall (darwin-arm64), const IPV6_MAX_MEMBERSHIPS ideal-int
pkg syscall (darwin-arm64), const IPV6_MAX_SOCK_SRC_FILTER = 128
pkg syscall (darwin-arm64), const IPV6_MAX_SOCK_SRC_FILTER ideal-int
pkg syscall (darwin-arm64), const IPV6_MIN_MEMBERSHIPS = 31
pkg syscall (darwin-arm64), const IPV6_MIN_MEMBERSHIPS ideal-int
pkg syscall (darwin-arm64), const IPV6_MMTU = 1280

  // uid contains the uid of the user that created the CertificateSigningRequest.
  // Populated by the API server on creation and immutable.
  // +optional
  optional string uid = 3;

  // groups contains group membership of the user that created the CertificateSigningRequest.
  // Populated by the API server on creation and immutable.
  // +listType=atomic
  // +optional
  repeated string groups = 4;

pkg syscall (freebsd-arm64), const INPCK = 16
pkg syscall (freebsd-arm64), const INPCK ideal-int
pkg syscall (freebsd-arm64), const IP_ADD_MEMBERSHIP = 12
pkg syscall (freebsd-arm64), const IP_ADD_SOURCE_MEMBERSHIP = 70
pkg syscall (freebsd-arm64), const IP_ADD_SOURCE_MEMBERSHIP ideal-int
pkg syscall (freebsd-arm64), const IP_BINDANY = 24
pkg syscall (freebsd-arm64), const IP_BINDANY ideal-int

- find accounts (user DNs) that have been removed; any active STS credentials or MinIO service accounts belonging to these users are purged.

- find accounts whose group memberships have changed; access policies available to a credential are updated to reflect the change, i.e. they will lose any privileges associated with a group they are removed from, and gain any privileges associated with a group they are added to.

the group can be found at [Early Disclosure Membership].

## Security Bulletins

Information about previous Istio vulnerabilities can be found on the
[Security Bulletins] page.

[Support Announcements]: https://istio.io/news/support/
[Istio Security Vulnerabilities]: https://istio.io/about/security-vulnerabilities/
[Security Bulletins]: https://istio.io/news/security/

pkg syscall (linux-386-cgo), const IP_DROP_MEMBERSHIP = 36
pkg syscall (linux-386-cgo), const IP_DROP_SOURCE_MEMBERSHIP = 40
pkg syscall (linux-386-cgo), const IP_FREEBIND = 15
pkg syscall (linux-386-cgo), const IP_HDRINCL = 3
pkg syscall (linux-386-cgo), const IP_IPSEC_POLICY = 16
pkg syscall (linux-386-cgo), const IP_MAXPACKET = 65535
pkg syscall (linux-386-cgo), const IP_MAX_MEMBERSHIPS = 20

pkg syscall (freebsd-riscv64), const IPV6_MAX_MEMBERSHIPS = 4095 #53466
pkg syscall (freebsd-riscv64), const IPV6_MAX_MEMBERSHIPS ideal-int #53466
pkg syscall (freebsd-riscv64), const IPV6_MAX_SOCK_SRC_FILTER = 128 #53466
pkg syscall (freebsd-riscv64), const IPV6_MAX_SOCK_SRC_FILTER ideal-int #53466
pkg syscall (freebsd-riscv64), const IPV6_MIN_MEMBERSHIPS = 31 #53466

This PR exposes a second, independent pruning alpha powered by a new standard named `ApplySets`. An `ApplySet` is a server-side object (by default, a Secret; ConfigMaps are also allowed) that kubectl can use to accurately and efficiently track set membership across `apply` operations. The format used for `ApplySet` is set out in  [KEP 3659](https://github.com/kubernetes/enhancements/issues/3659) as a low-level specification.  Other tools in the ecosystem can also build on this specification for improved...

  // to the container's primary GID, the fsGroup (if specified), and group memberships
  // defined in the container image for the uid of the container process. If unspecified,
  // no additional groups are added to any container. Note that group memberships
  // defined in the container image for the uid of the container process are still effective,

* fix kubelet event recording for selected events. ([#46246](https://github.com/kubernetes/kubernetes/pull/46246),...