HTTP/2 server, close all but the first connection.
 *  Fix: Fail the HTTP/2 connection if first frame isn't `SETTINGS`.
 *  Fix: Forbid spaces in header names.
 *  Fix: Don't offer to do gzip if the request is partial.
 *  Fix: MockWebServer is now usable with JUnit 5. That update [broke the rules][junit_5_rules].
 *  New: Support `Expect: 100-continue` as a request header. Callers can use this header to

- The Image Locality priority function of the scheduler has been improved and is now enabled by default. With this feature enabled, nodes that have all or a partial set of images required for running a pod are preferred over other nodes, which improves pod start-up time.
- TaintNodeByCondition has been moved to Beta and is enabled by default.

1D6DA         ; mapped                 ; 03C9          # 3.1  MATHEMATICAL BOLD SMALL OMEGA
1D6DB         ; mapped                 ; 2202          # 3.1  MATHEMATICAL BOLD PARTIAL DIFFERENTIAL
1D6DC         ; mapped                 ; 03B5          # 3.1  MATHEMATICAL BOLD EPSILON SYMBOL
1D6DD         ; mapped                 ; 03B8          # 3.1  MATHEMATICAL BOLD THETA SYMBOL

    assertThat(parse("http://github.com/%%30%30").pathSegments)
      .containsExactly("%00")
  }

  @Test
  fun malformedUtf8Encoding() {
    // Replace a partial UTF-8 sequence with the Unicode replacement character.
    assertThat(parse("http://host/a/%E2%98x/c").pathSegments)
      .containsExactly("a", "\ufffdx", "c")
  }

  @Test
  fun incompleteUrlComposition() {

    """
    Takes a function or coroutine `func(request) -> response`,
    and returns an ASGI application.
    """
    f: Callable[[Request], Awaitable[Response]] = (
        func if is_async_callable(func) else functools.partial(run_in_threadpool, func)  # type:ignore
    )

    async def app(scope: Scope, receive: Receive, send: Send) -> None:
        request = Request(scope, receive, send)

  - node_cpu_usage_seconds --> node_cpu_usage_seconds_total
  - container_cpu_usage_seconds --> container_cpu_usage_seconds_total

* Handle cAdvisor partial failures ([#25933](https://github.com/kubernetes/kubernetes/pull/25933), [@timstclair](https://github.com/timstclair))

    assertCached(false, 201)
    assertCached(false, 202)
    assertCached(true, 203)
    assertCached(true, 204)
    assertCached(false, 205)
    assertCached(false, 206) // Electing to not cache partial responses
    assertCached(false, 207)
    assertCached(true, 300)
    assertCached(true, 301)
    assertCached(true, 302)
    assertCached(false, 303)
    assertCached(false, 304)
    assertCached(false, 305)

- List operations against the API now return internal server errors instead of partially complete lists when a value cannot be transformed from storage. The updated behavior is consistent with all other operations that require transforming data from storage such as watch and get. ([#69399](https://github.com/kubernetes/kubernetes/pull/69399),...

There is no mitigation from this issue.  Cluster admins should take care to secure aggregated API servers and should not grant access to mutate `APIService`s to untrusted parties.

**Affected Versions**:
  - kube-apiserver v1.25.0
  - kube-apiserver v1.24.0 - v1.24.4