_2025-07-07_

 *  New: `Response.peekTrailers()`. When we changed `Response.trailers()` to block instead of
    throwing in 5.0.0, we inadvertently removed the ability for callers to peek the trailers
    (by catching the `IllegalStateException` if they weren't available). This new API restores that
    capability.

 *  Fix: Don't crash on `trailers()` if the response doesn't have a body. We broke [Retrofit] users

#### kube-apiserver:
- in an `--encryption-provider-config` config file, an explicit `cacheSize: 0` parameter previously silently defaulted to caching 1000 keys. In Kubernetes 1.18, this now returns a config validation error. To disable caching, you can specify a negative cacheSize value in Kubernetes 1.18+.

		// Test listing an object with uncommon delimiter
		{testBuckets[4], "", "", "guidSplunk", 1000, resultCases[35], nil, true},
		// Test listing an object with uncommon delimiter and matching prefix
		{testBuckets[4], "file1/", "", "guidSplunk", 1000, resultCases[35], nil, true},
		// Test listing at prefix with expected prefix markers
		{testBuckets[5], "dir/", "", SlashSeparator, 1, resultCases[36], nil, true},

been, leading to rare cases of infinite retries. Please upgrade to this release!

 *  Fix: don't return stale DNS entries in `DnsOverHttps`. We were caching DNS results indefinitely
    rather than the duration specified in the response's cache-control header.
 *  Fix: Verify certificate IP addresses in canonical form. When a server presents a TLS certificate

     *
     * @param document the parsed HTML document
     * @param xpath the XPath expression to evaluate
     * @return the concatenated text content from all matching nodes
     */
    protected String getMultipleNodeValue(final Document document, final String xpath) {
        XPathNodes nodeList = null;
        final StringBuilder buf = new StringBuilder(100);
        try {

there is an <i>n</i> such that the <i>n</i>th call to <code>l.Unlock</code>
is synchronized before the return from <code>l.RLock</code>,
and the matching call to <code>l.RUnlock</code> is synchronized before the return from call <i>n</i>+1 to <code>l.Lock</code>.
</p>

<p class="rule">
A successful call to <code>l.TryLock</code> (or <code>l.TryRLock</code>)

- Kube-apiserver: Added support for disabling caching of authorization webhook decisions in the `--authorization-config` file. The new fields `cacheAuthorizedRequests` and `cacheUnauthorizedRequests` could be set to `false` to prevent caching for authorized or unauthorized requests. See the https://kubernetes.io/docs/reference/access-authn-authz/authorization/#using-configuration-file-for-authorization...

		VersionID:         versionID,
		MTime:             dobj.DeleteMarkerMTime.Time,
		DeleteReplication: drs,
		Versioned:         globalBucketVersioningSys.PrefixEnabled(bucket, dobj.ObjectName),
		// Objects matching prefixes should not leave delete markers,
		// dramatically reduces namespace pollution while keeping the
		// benefits of replication, make sure to apply version suspension
		// only at bucket level instead.

* When prompting for passwords, don't echo to the terminal ([#31586](https://github.com/kubernetes/kubernetes/pull/31586), [@brendandburns](https://github.com/brendandburns))
* add group prefix matching for kubectl usage ([#32140](https://github.com/kubernetes/kubernetes/pull/32140), [@deads2k](https://github.com/deads2k))

	if poolIdx < len(z.serverPools) && setIdx < len(z.serverPools[poolIdx].sets) {
		return z.serverPools[poolIdx].sets[setIdx].getDisks(), nil
	}
	return nil, fmt.Errorf("Matching pool %s, set %s not found", humanize.Ordinal(poolIdx+1), humanize.Ordinal(setIdx+1))
}

// Return the count of disks in each pool
func (z *erasureServerPools) SetDriveCounts() []int {