- [`KT-66172`](https://youtrack.jetbrains.com/issue/KT-66172) K2: Improve memory consumption of `KtPsiSourceElement`
- [`KT-50860`](https://youtrack.jetbrains.com/issue/KT-50860) Combination of array set convention and plusAssign works exponentially
- [`KT-62798`](https://youtrack.jetbrains.com/issue/KT-62798) 'in' range checks are not intrinsified in kotlin-stdlib

feature gate to `true` (it is disabled by default). An API server fronted by an L7 load balancer that already mitigates these http/2 attacks may choose not to enable the kube-apiserver mitigation to avoid disrupting load balancer → kube-apiserver connections if http/2 requests from multiple clients share the same backend connection. An API server on a private network may choose not to enable the kube-apiserver mitigation to prevent performance regressions for unauthenticated clients. Authenticated requests...

feature gate to `true` (it is disabled by default). An API server fronted by an L7 load balancer that already mitigates these http/2 attacks may choose not to enable the kube-apiserver mitigation to avoid disrupting load balancer → kube-apiserver connections if http/2 requests from multiple clients share the same backend connection. An API server on a private network may choose not to enable the kube-apiserver mitigation to prevent performance regressions for unauthenticated clients. Authenticated requests...

- The Kubernetes API server now correctly detects and closes existing TLS connections when its client certificate file for kubelet authentication has been rotated. ([#115315](https://github.com/kubernetes/kubernetes/pull/115315), [@enj](https://github.com/enj)) [SIG API Machinery, Auth, Node and Testing]

### Other (Cleanup or Flake)

feature gate to `false` (it is enabled by default). An API server fronted by an L7 load balancer that already mitigates these http/2 attacks may choose to disable the kube-apiserver mitigation to avoid disrupting load balancer -> kube-apiserver connections if http/2 requests from multiple clients share the same backend connection. An API server on a private network may opt to disable the kube-apiserver mitigation to prevent performance regressions for unauthenticated clients. Authenticated requests...

				t.Errorf("Expected no validate errors but got %v", errors)
			}
			if conversionCount != 1 {
				t.Errorf("Expected 1 conversion to be performed by cel context during schema traversal but observed %d conversions", conversionCount)
			}
		})
	}
}

func TestPerCRDEstimatedCost(t *testing.T) {
	tests := []struct {
		name              string
		costs             []uint64

      SrcOpT op, typename SrcOpT::Adaptor adaptor,
      ConversionPatternRewriter &rewriter) const override {
    DstOpT mhlo_op;
    Location loc = op.getLoc();

    // To handle quant type conversions, use the converted operands' element
    // types and original source op's shapes and encoding to get converted op's
    // result types. This is only done for the While op for now.

### Fixes

* 🐛 Allow exit code for dependencies with `yield` to always execute, by removing capacity limiter for them, to e.g. allow closing DB connections without deadlocks. PR [#5122](https://github.com/tiangolo/fastapi/pull/5122) by [@adriangb](https://github.com/adriangb).

// Resource names must be not more than 63 characters, consisting of upper- or lower-case alphanumeric characters,
// with the -, _, and . characters allowed anywhere, except the first or last character.
// The default convention, matching that for annotations, is to use lower-case names, with dashes, rather than
// camel case, separating compound words.

	Cni   *CNIUsageConfig             `protobuf:"bytes,55,opt,name=cni,proto3" json:"cni,omitempty"`
	Taint *PilotTaintControllerConfig `protobuf:"bytes,57,opt,name=taint,proto3" json:"taint,omitempty"`
	// If set, `istiod` will allow connections from trusted node proxy ztunnels
	// in the provided namespace.
	TrustedZtunnelNamespace string `protobuf:"bytes,59,opt,name=trustedZtunnelNamespace,proto3" json:"trustedZtunnelNamespace,omitempty"`
}