- The errors in `k8s.io/apimachinery/pkg/api/meta` now support for the `stdlibs` `errors.Is` matching, including when wrapped. ([#111808](https://github.com/kubernetes/kubernetes/pull/111808), [@alvaroaleman](https://github.com/alvaroaleman))

- Added optional `--detect-local-mode` flag to kube-proxy. Valid values are "ClusterCIDR" (default matching previous behavior) and "NodeCIDR" ([#87748](https://github.com/kubernetes/kubernetes/pull/87748), [@satyasm](https://github.com/satyasm)) [SIG Cluster Lifecycle, Network and Scheduling]

* kubectl cp now safely allows unpacking of symlinks that may point outside the destination directory ([#82384](https://github.com/kubernetes/kubernetes/pull/82384), [@tallclair](https://github.com/tallclair))
* fix azure disk naming matching issue due to case sensitive comparison ([#81720](https://github.com/kubernetes/kubernetes/pull/81720), [@andyzhangx](https://github.com/andyzhangx))

* kubeadm now detects the Docker cgroup driver and starts the kubelet with the matching driver. This eliminates a common error experienced by new users in when the Docker cgroup driver is not the same as the one set for the kubelet due to different Linux distributions setting different cgroup drivers for Docker, making it hard to start...

        etc.) may break.
    *   Code that uses full path for `get_concrete_function` to trace Keras
        symbolic inputs directly should switch to building matching
        `tf.TensorSpec`s directly and tracing the `TensorSpec` objects.
    *   Code that relies on the exact number and names of the op layers that
        TensorFlow operations were converted into may have changed.

- NONE ([#124326](https://github.com/kubernetes/kubernetes/pull/124326), [@ritazh](https://github.com/ritazh)) [SIG Auth]
- OpenAPI V2 will no longer publish aggregated apiserver OpenAPI for group-versions not matching the APIService specified group version ([#123625](https://github.com/kubernetes/kubernetes/pull/123625), [@Jefftree](https://github.com/Jefftree)) [SIG API Machinery and Testing]

## Dependencies

### Added

from FIPS 204, passing in ρ, s, and r instead of ρ'. func sampleNTT(rho []byte, s, r byte) nttElement { G := sha3.NewShake128() G.Write(rho) G.Write([]byte{s, r}) var a nttElement var j int // index into a var buf [168]byte // buffered reads from B, matching the rate of SHAKE-128 off := len(buf) // index into buf, starts in a "buffer fully consumed" state for j < n { if off >= len(buf) { G.Read(buf[:]) off = 0 } v := uint32(buf[off]) | uint32(buf[off+1])<<8 | uint32(buf[off+2])<<16 off += 3 f, err :=...

pkg regexp/syntax, const InstRune1 InstOp
pkg regexp/syntax, const InstRuneAny InstOp
pkg regexp/syntax, const InstRuneAnyNotNL InstOp
pkg regexp/syntax, const Literal Flags
pkg regexp/syntax, const MatchNL Flags
pkg regexp/syntax, const NonGreedy Flags
pkg regexp/syntax, const OneLine Flags
pkg regexp/syntax, const OpAlternate Op
pkg regexp/syntax, const OpAnyChar Op
pkg regexp/syntax, const OpAnyCharNotNL Op

pkg regexp/syntax, const InstRune1 = 8
pkg regexp/syntax, const InstRuneAny = 9
pkg regexp/syntax, const InstRuneAnyNotNL = 10
pkg regexp/syntax, const Literal = 2
pkg regexp/syntax, const MatchNL = 12
pkg regexp/syntax, const NonGreedy = 32
pkg regexp/syntax, const OneLine = 16
pkg regexp/syntax, const OpAlternate = 19
pkg regexp/syntax, const OpAnyChar = 6
pkg regexp/syntax, const OpAnyCharNotNL = 5