*   The Kubelet's feature gates are now specified as a map when provided via a JSON or YAML KubeletConfiguration, rather than as a string of key-value pairs, making them less awkward for users. ([#53025](https://github.com/kubernete...

produce it from the Program, in the form of source code under the
terms of section 4, provided that you also meet all of these conditions:

    a) The work must carry prominent notices stating that you modified
    it, and giving a relevant date.

    b) The work must carry prominent notices stating that it is
    released under this License and any conditions added under section

- OIDC authentication will now fail if the username asserted based on a CEL expression config is the empty string.  Previously the request would be authenticated with the username set to the empty string. ([#123568](https://github.com/kubernetes/kubernetes/pull/123568), [@enj](https://github.com/enj))

- Fixed CEL estimated cost of `replace()` to handle a zero length replacement string correctly.
  Previously this would cause the estimated cost to be higher than it should be. ([#120097](https://github.com/kubernetes/kubernetes/pull/120097), [@jpbetz](https://github.com/jpbetz)) [SIG API Machinery]

- The client label for apiserver_request_count and apiserver_request_total now no-opts and merely records an empty string. ([#87673](https://github.com/kubernetes/kubernetes/pull/87673), [@logicalhan](https://github.com/logicalhan)) [SIG API Machinery, Instrumentation and Scalability]

### Bug or Regression

- Bump sigs.k8s.io/apiserver-network-proxy/konnectivity-client to v0.0.30, fixing goroutine leaks in kube-apiserver. ([#108439](https://github.com/kubernetes/kubernetes/pull/108439), [@andrewsykim](https://github.com/andrewsykim)) [SIG API Machinery, Auth and Cloud Provider]

- The kube-controller-manager managed signers can now have distinct signing certificates and keys.  See the help about `--cluster-signing-[signer-name]-{cert,key}-file`.  `--cluster-signing-{cert,key}-file` is still the default. ([#90822](https://github.com/kubernetes/kubernetes/pull/90822), [@deads2k](https://github.com/deads2k)) [SIG API Machinery, Apps and Auth]

### Breaking Changes


`tf.keras`:

versions. This file contains only tests that // need access to the unexported symbol testingOnlyRejection. func TestACVPRejectionKAT(t *testing.T) { testCases := []struct { name string seed string // input to ML-DSA.KeyGen_internal keyHash string // SHA2-256(pk || sk) msg string // M' input to ML-DSA.Sign_internal sigHash string // SHA2-256(sig) newPrivateKey func([]byte) (*PrivateKey, error) newPublicKey func([]byte) (*PublicKey, error) }{ // https://pages.nist.gov/ACVP/draft-celi-acvp-ml-dsa.html#table-1...

source code is governed by a BSD-style // license that can be found in the LICENSE file. //go:build ignore package main import ( "bytes" "go/format" "io" "log" "os" "os/exec" "text/template" ) var curves = []struct { Element string Prime string Prefix string FiatType string BytesLen int }{ { Element: "P224Element", Prime: "2^224 - 2^96 + 1", Prefix: "p224", FiatType: "[4]uint64", BytesLen: 28, }, // The P-256 fiat implementation is used only on 32-bit architectures, but // the uint32 fiat code is...