setting the `UnauthenticatedHTTP2DOSMitigation` feature gate to `true` (it is disabled by default). An API server fronted by an L7 load balancer that already mitigates these http/2 attacks may choose not to enable the kube-apiserver mitigation to avoid disrupting load balancer → kube-apiserver connections if http/2 requests from multiple clients share the same backend connection. An API server on a private network may choose not to enable the kube-apiserver mitigation to prevent performance regressions...

* Filter published OpenAPI schema by making nullable, required fields non-required in order to avoid kubectl to wrongly reject null values. ([#85722](https://github.com/kubernetes/kubernetes/pull/85722), [@sttts](https://github.com/sttts))

	if method == "" {
		method = http.MethodPost
	}

	req, err := http.NewRequest(method, urlStr, nil)
	if err != nil {
		return nil, err
	}

	if body == nil {
		// this is added to avoid panic during io.ReadAll(req.Body).
		// th stack trace can be found here  https://github.com/minio/minio/pull/2074 .
		// This is very similar to https://github.com/golang/go/issues/7527.

  }

  @Test
  fun urlWithSpaceInHost() {
    assertFailsWith<IllegalArgumentException> {
      "http://and roid.com/".toHttpUrl()
    }
  }

  @Test
  fun urlWithSpaceInHostViaHttpProxy() {
    assertFailsWith<IllegalArgumentException> {
      "http://and roid.com/".toHttpUrl()
    }
  }

  @Test
  fun urlHostWithNul() {
    assertFailsWith<IllegalArgumentException> {

7}, crypto.SHA3_256: {2, 16, 840, 1, 101, 3, 4, 2, 8}, crypto.SHA3_384: {2, 16, 840, 1, 101, 3, 4, 2, 9}, crypto.SHA3_512: {2, 16, 840, 1, 101, 3, 4, 2, 10}, } for h, oid := range prefixes { want, err := asn1.Marshal(struct { HashAlgorithm pkix.AlgorithmIdentifier Hash []byte }{ HashAlgorithm: pkix.AlgorithmIdentifier{ Algorithm: oid, Parameters: asn1.NullRawValue, }, Hash: make([]byte, h.Size()), }) if err != nil { t.Fatal(err) } want = want[:len(want)-h.Size()] got := hashPrefixes[h.String()] if...

### Bug or Regression

- Only declare Job as finished after removing all Pod finalizers to avoid orphan Pods ([#119165](https://github.com/kubernetes/kubernetes/pull/119165), [@alculquicondor](https://github.com/alculquicondor)) [SIG Apps and Testing]

setting the `UnauthenticatedHTTP2DOSMitigation` feature gate to `true` (it is disabled by default). An API server fronted by an L7 load balancer that already mitigates these http/2 attacks may choose not to enable the kube-apiserver mitigation to avoid disrupting load balancer → kube-apiserver connections if http/2 requests from multiple clients share the same backend connection. An API server on a private network may choose not to enable the kube-apiserver mitigation to prevent performance regressions...

}

// DeletePolicy - deletes a canned policy from backend. `notifyPeers` is true
// whenever this is called via the API. It is false when called via a
// notification from another peer. This is to avoid infinite loops.
func (sys *IAMSys) DeletePolicy(ctx context.Context, policyName string, notifyPeers bool) error {
	if !sys.Initialized() {
		return errServerNotInitialized
	}

- Extend discovery GroupManager with Group lister interface ([#127524](https://github.com/kubernetes/kubernetes/pull/127524), [@mjudeikis](https://github.com/mjudeikis)) [SIG API Machinery]
- Fixed: Avoid overwriting in-pod vertical scaling updates on systemd daemon reloads when using systemd ([#124216](https://github.com/kubernetes/kubernetes/pull/124216), [@iholder101](https://github.com/iholder101)) [SIG Node]

var(--#{$prefix}btn-hover-border-color);\n    outline: 0;\n    // Avoid using mixin so we can pass custom focus shadow properly\n    @if $enable-shadows {\n      box-shadow: var(--#{$prefix}btn-box-shadow), var(--#{$prefix}btn-focus-box-shadow);\n    } @else {\n      box-shadow: var(--#{$prefix}btn-focus-box-shadow);\n    }\n  }\n\n  .btn-check:focus-visible + & {\n    border-color: var(--#{$prefix}btn-hover-border-color);\n    outline: 0;\n    // Avoid using mixin so we can pass custom focus shadow properly\n...