- Kube-apiserver: fixes a 1.27+ regression watching a single namespace via the deprecated /api/v1/watch/namespaces/$name endpoint where watch events were not delivered after the watch was established ([#126150](https://github.com/kubernetes/kubernetes/pull/126150), [@xyz-li](https://github.com/xyz-li)) [SIG API Machinery and Testing]

    <root-XML localName="document" namespaceURI="http://developer.apple.com/namespaces/sl" />
    <sub-class-of type="application/vnd.apple.iwork" />
    <glob pattern="*.pages"/>
  </mime-type>
  <mime-type type="application/vnd.apple.numbers">
    <root-XML localName="document" namespaceURI="http://developer.apple.com/namespaces/ls" />
    <sub-class-of type="application/vnd.apple.iwork" />

- Adds feature gate `KubeletInUserNamespace` which enables support for running kubelet in a user namespace.
  
  The user namespace has to be created before running kubelet.
  All the node components such as CRI need to be running in the same user namespace.
  

* PersistentVolume flexVolume sources can now reference secrets in a namespace other than the PersistentVolumeClaim's namespace. ([#56460](https://github.com/kubernetes/kubernetes/pull/56460), [@liggitt](https://github.com/liggitt))

### Windows

* fix a bug that overwhelming number of prometheus metrics are generated because $NAMESPACE is not replaced by string "{namespace}" ([#68530](https://github.com/kubernetes/kubernetes/pull/68530), [@wenjiaswe](https://github.com/wenjiaswe))

- Kube-apiserver: ensures the namespace of objects sent to admission webhooks matches the request namespace. Previously, objects without a namespace set would have the request namespace populated after mutating admission, and objects with a namespace that did not match the request namespace would be rejected after admission. ([#94637](https://github.com/kubernetes/kubernetes/pull/94637), [@liggitt](https://github.com/liggitt))...

"event","off","leverageNative","isSetup","saved","isTrigger","delegateType","stopPropagation","stopImmediatePropagation","preventDefault","trigger","isImmediatePropagationStopped","handleObjIn","eventHandle","events","t","handleObj","handlers","namespaces","origType","elemData","create","handle","triggered","dispatch","bindType","delegateCount","setup","mappedTypes","origCount","teardown","removeEvent","nativeEvent","handlerQueue","fix","delegateTarget","preDispatch","isPropagationStopped","curr...

### SIG-service-catalog
- The Originating Identity feature, which lets the broker know which user that performed an action, is now GA.
- [Namespaced Brokers](https://svc-cat.io/docs/namespaced-broker-resources/), which enable operators to install a broker into a namespace instead of the cluster level, reached GA.

import org.junit.jupiter.api.extension.ExtensionContext.Namespace
import org.junit.platform.commons.support.AnnotationSupport.findAnnotatedFields

/** Implements the policy specified by [StartStop]. */
internal class StartStopExtension :
  BeforeEachCallback,
  BeforeAllCallback {
  override fun beforeAll(context: ExtensionContext) {
    val store = context.getStore(Namespace.create(StartStop::class.java))

    val staticFields =

import jsinterop.annotations.JsPackage;

/** Web specializations for {@link Ints} methods. */
public abstract class IntsMethodsForWeb {

  @JsMethod(name = "Math.min", namespace = JsPackage.GLOBAL)
  public static native int min(int... array);

  @JsMethod(name = "Math.max", namespace = JsPackage.GLOBAL)
  public static native int max(int... array);