- Fixed CEL estimated cost of `replace()` to handle a zero length replacement string correctly.
  Previously this would cause the estimated cost to be higher than it should be. ([#120097](https://github.com/kubernetes/kubernetes/pull/120097), [@jpbetz](https://github.com/jpbetz)) [SIG API Machinery]

- The client label for apiserver_request_count and apiserver_request_total now no-opts and merely records an empty string. ([#87673](https://github.com/kubernetes/kubernetes/pull/87673), [@logicalhan](https://github.com/logicalhan)) [SIG API Machinery, Instrumentation and Scalability]

- OIDC authentication will now fail if the username asserted based on a CEL expression config is the empty string.  Previously the request would be authenticated with the username set to the empty string. ([#123568](https://github.com/kubernetes/kubernetes/pull/123568), [@enj](https://github.com/enj))

  
  The API does include a few breaking changes:
  - The "extraArgs" component construct is now a list of "name"/"value" pairs instead of a string/string map. This has been done to support duplicate args where needed.
  - The "JoinConfiguration.discovery.timeout" field has been replaced by "JoinConfiguration.timeouts.discovery".

### Bug or Regression

- Bump sigs.k8s.io/apiserver-network-proxy/konnectivity-client to v0.0.30, fixing goroutine leaks in kube-apiserver. ([#108439](https://github.com/kubernetes/kubernetes/pull/108439), [@andrewsykim](https://github.com/andrewsykim)) [SIG API Machinery, Auth and Cloud Provider]

- The kube-controller-manager managed signers can now have distinct signing certificates and keys.  See the help about `--cluster-signing-[signer-name]-{cert,key}-file`.  `--cluster-signing-{cert,key}-file` is still the default. ([#90822](https://github.com/kubernetes/kubernetes/pull/90822), [@deads2k](https://github.com/deads2k)) [SIG API Machinery, Apps and Auth]

versions. This file contains only tests that // need access to the unexported symbol testingOnlyRejection. func TestACVPRejectionKAT(t *testing.T) { testCases := []struct { name string seed string // input to ML-DSA.KeyGen_internal keyHash string // SHA2-256(pk || sk) msg string // M' input to ML-DSA.Sign_internal sigHash string // SHA2-256(sig) newPrivateKey func([]byte) (*PrivateKey, error) newPublicKey func([]byte) (*PublicKey, error) }{ // https://pages.nist.gov/ACVP/draft-celi-acvp-ml-dsa.html#table-1...

### Breaking Changes


`tf.keras`:

source code is governed by a BSD-style // license that can be found in the LICENSE file. //go:build ignore package main import ( "bytes" "go/format" "io" "log" "os" "os/exec" "text/template" ) var curves = []struct { Element string Prime string Prefix string FiatType string BytesLen int }{ { Element: "P224Element", Prime: "2^224 - 2^96 + 1", Prefix: "p224", FiatType: "[4]uint64", BytesLen: 28, }, // The P-256 fiat implementation is used only on 32-bit architectures, but // the uint32 fiat code is...