- The kube-controller-manager's deprecated `--experimental-cluster-signing-duration` flag is now removed. Adapt your machinery to use the `--cluster-signing-duration` flag that is available since v1.19. ([#108476](https://github.com/kubernetes/kubernetes/pull/108476), [@ialidzhikov](https://github.com/ialidzhikov))

      <match value="\\section" type="string" offset="0"/>
      <match value="\\setlength" type="string" offset="0"/>
      <match value="\\documentstyle" type="string" offset="0"/>
      <match value="\\chapter" type="string" offset="0"/>
      <match value="\\documentclass" type="string" offset="0"/>
      <match value="\\relax" type="string" offset="0"/>
      <match value="\\contentsline" type="string" offset="0"/>

of m. // // It is an error if either a or m is zero, or if they are both even. func extendedGCD(a, m *Nat) (u, A *Nat, err error) { // This is the extended binary GCD algorithm described in the Handbook of // Applied Cryptography, Algorithm 14.61, adapted by BoringSSL to bound // coefficients and avoid negative numbers. For more details and proof of // correctness, see https://github.com/mit-plv/fiat-crypto/pull/333/files. // // Following the proof linked in the PR above, the changes are: // // 1....

- Enabled ratcheting validation on `status` subresources for CustomResourceDefinitions. ([#129506](https://github.com/kubernetes/kubernetes/pull/129506), [@JoelSpeed](https://github.com/JoelSpeed))
- Fix: Adopted go1.23 behavior change in mount point parsing on Windows. ([#129368](https://github.com/kubernetes/kubernetes/pull/129368), [@andyzhangx](https://github.com/andyzhangx)) [SIG Storage and Windows]

  No covered work shall be deemed part of an effective technological
measure under any applicable law fulfilling obligations under article
11 of the WIPO copyright treaty adopted on 20 December 1996, or
similar laws prohibiting or restricting circumvention of such
measures.

  When you convey a covered work, you waive any legal power to forbid

of m. // // It is an error if either a or m is zero, or if they are both even. func extendedGCD(a, m *Nat) (u, A *Nat, err error) { // This is the extended binary GCD algorithm described in the Handbook of // Applied Cryptography, Algorithm 14.61, adapted by BoringSSL to bound // coefficients and avoid negative numbers. For more details and proof of // correctness, see https://github.com/mit-plv/fiat-crypto/pull/333/files. // // Following the proof linked in the PR above, the changes are: // // 1....

### Structured Logging in Kubelet

  
  Users who maintain controllers which relied on the fact that pods with RestartPolicy=Always
  never enter the Succeeded phase may need to adapt their controllers. This is because as a consequence of 
  the change pods which use RestartPolicy=Always may end up in the Succeeded phase in two scenarios: pod