* Fixed flakes caused by petset tests. ([#35158](https://github.com/kubernetes/kubernetes/pull/35158), [@foxish](https://github.com/foxish))
* Add validation that detects repeated keys in the labels and annotations maps ([#34407](https://github.com/kubernetes/kubernetes/pull/34407), [@brendandburns](https://github.com/brendandburns))

    server.enqueue(
      MockResponse(code = 407),
    )
    client =
      client
        .newBuilder()
        .proxySelector(
          object : ProxySelector() {
            override fun select(uri: URI): List<Proxy> = listOf(server.proxyAddress)

            override fun connectFailed(
              uri: URI,
              socketAddress: SocketAddress,
              e: IOException,
            ) {

### Bug or Regression

- The RuntimeClass scheduler can now simplify steering Linux or Windows pods to appropriate nodes
- All Windows nodes now get the new label `node.kubernetes.io/windows-build` that reflects the Windows major, minor, and build number that are needed to match compatibility between Windows containers and Windows worker nodes.


## Deprecations and Removals

- Added validation to reject Pods using the `PodLevelResources` feature on Windows OS due to lack of support. The API server rejects Pods with Pod-level resources and a `Pod.spec.os.name` targeting Windows. Kubelet on nodes running Windows also rejects Pods with Pod-level resources at admission phase. ([#133046](https://github.com/kubernetes/kubernetes/pull/133046), [@toVersus](https://github.com/toVersus)) [SIG Apps and Node]

- KEP-3619: fine-grained supplemental groups policy is graduated to Beta. Note that kubelet now rejects pods with `.spec.securityContext.supplementalGroupsPolicy: Strict` when scheduled to the node that does not support the feature (`.status.features.supplementalGroupsPolicy: false`). ([#130210](https://github.com/kubernetes/kubernetes/pull/130210),...

        this.resolvedArtifacts = (artifacts != null) ? artifacts : Collections.emptySet();
        this.artifacts = null;
        this.artifactMap = null;
    }

    /**
     * Sets the scope filter to select the artifacts being exposed to the currently executed mojo.
     * <strong>Warning:</strong> This is an internal utility method that is only public for technical reasons, it is not

			}
			if ok {
				continue
			}
		} // in all other cases metadata is corrupt, do not read from it.

		onlineMeta[i] = FileInfo{}
		onlineDisks[i] = nil
	}

	select {
	case mrfCheck <- fi.ShallowCopy():
	case <-ctx.Done():
		return fi, onlineMeta, onlineDisks, toObjectErr(ctx.Err(), bucket, object)
	}

	return fi, onlineMeta, onlineDisks, nil
}

- The `--leader-elect*` CLI args are now honored in scheduler. ([#105915](https://github.com/kubernetes/kubernetes/pull/105915), [@Huang-Wei](https://github.com/Huang-Wei))
- The `--leader-elect*` CLI args are now honored in the scheduler. ([#105712](https://github.com/kubernetes/kubernetes/pull/105712), [@Huang-Wei](https://github.com/Huang-Wei))

- The API server now detects and fails on startup if there are conflicting issuers between JWT authenticators and service account configurations. Previously, such configurations would run but could be inconsistently effective depending on the credential. ([#123561](https://g...