* requests for a TLS client certificate for any node are approved if the CSR creator has `create` permission on the `certificatesigningrequests` resource and `nodeclient` subresource in the `certificates.k8s.io` API group

    now served with tensorflow/serving, it will accept requests using 'inputs'
    and 'outputs'. Starting at 1.2, such a model will accept the keys specified
    during export. Therefore, inference requests using 'inputs' and 'outputs'
    may start to fail. To fix this, either update any inference clients to send
    requests with the actual input and output keys used by the trainer code, or

- If the user specifies an invalid timeout in the request URL, the request will be aborted with an HTTP 400.

* Resolves an issue serving aggregated APIs backed by services that respond to requests to `/` with non-2xx HTTP responses ([#79895](https://...

  - apiserver_flowcontrol_dispatch_r: R(the time of the latest request dispatch)
  - apiserver_flowcontrol_latest_s: S(the request last dispatched) = R(when that request starts executing in the virtual world)
  - apiserver_flowcontrol_next_s_bounds: min and max next S among non-empty queues

attacks may choose not to enable the kube-apiserver mitigation to avoid disrupting load balancer → kube-apiserver connections if http/2 requests from multiple clients share the same backend connection. An API server on a private network may choose not to enable the kube-apiserver mitigation to prevent performance regressions for unauthenticated clients. Authenticated requests rely on the fix in golang.org/x/net v0.17.0 alone. https://issue.k8s.io/121197 tracks further mitigation of http/2 attacks by authenticated...

- Fixes a regression in v1beta1 PodDisruptionBudget handling of `strategic merge patch`-type API requests for the `selector` field. Prior to 1.21, these requests would merge `matchLabels` content and replace `matchExpressions` content. In 1.21, patch requests touching the `selector` field started replacing the entire selector. This is consistent with server-side apply and the v1 PodDisruptionBudget behavior, but should not have...

### Breaking Changes

* 🔒️ Add `strict_content_type` checking for JSON requests. PR [#14978](https://github.com/fastapi/fastapi/pull/14978) by [@tiangolo](https://github.com/tiangolo).
    * Now FastAPI checks, by default, that JSON requests have a `Content-Type` header with a valid JSON value, like `application/json`, and rejects requests that don't.

        * requests for a TLS client certificate for any node are approved if the CSR creator has `create` permission on the `certificatesigningrequests` resource and `nodeclient` subresource in the `certificates.k8s.io` API group

der" "math/bits" ) // Counter is an SP 800-90A Rev. 1 CTR_DRBG instantiated with AES-256. // // Per Table 3, it has a security strength of 256 bits, a seed size of 384 bits, // a counter length of 128 bits, a reseed interval of 2^48 requests, and a // maximum request size of 2^19 bits (2^16 bytes, 64 KiB). // // We support a narrow range of parameters that fit the needs of our RNG: // AES-256, no derivation function, no personalization string, no prediction // resistance, and 384-bit additional input....