This release contains changes that address the following vulnerabilities:

### CVE-2023-2728: Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin

    private static final MonotonicClock CLOCK = new MonotonicClock();

    private final long startNanos;
    private final Instant startInstant;

    /**
     * Private constructor to enforce singleton pattern.
     * Initializes the clock with the current system time and nanoTime.
     */
    private MonotonicClock() {
        this.startNanos = System.nanoTime();

      }
      for (futureTask in futureTasks) {
        if (futureTask is AwaitIdleTask) {
          return futureTask.latch
        }
      }

      // Don't delegate to schedule() because that enforces shutdown rules.
      val newTask = AwaitIdleTask()
      if (scheduleAndDecide(newTask, 0L, recurrence = false)) {
        taskRunner.kickCoordinator(this)
      }
      return newTask.latch
    }
  }

         * remotely resolved snapshot artifact gets passed into pathOf(). So producing a proper local artifact path
         * using DefaultRepositoryLayout requires us to enforce usage of the artifact's base version. This
         * transformation however contradicts the other use case of precisely obeying the repository's layout. The below

  }

  @Override
  protected Map<Class<? extends @NonNull B>, B> delegate() {
    return delegate;
  }

  /**
   * Wraps the {@code setValue} implementation of an {@code Entry} to enforce the class constraint.
   */
  private static <B extends @Nullable Object> Entry<Class<? extends @NonNull B>, B> checkedEntry(
      Entry<Class<? extends @NonNull B>, B> entry) {

    // contract.
    // This is somewhat annoying, but turns out to be very fast in practice. Alternatively, we could
    // drop the contract on the method that enforces this queue like behavior since depending on it
    // is likely to be a bug anyway.

    // N.B. All writes to the list and the next pointers must have happened before the above

                            + "Resolution will not be reattempted until the update interval of "
                            + repository.getId() + " has elapsed or updates are forced. Original error: " + error);

                } else {
                    throw new ResourceDoesNotExistException(
                            "Failure to resolve " + remotePath + " from " + repository.getUrl()

    /**
     * Indicates whether Maven should force a check for updated snapshots on remote repositories.
     *
     * @return an {@link Optional} containing true if snapshot updates should be forced, false if not, or empty if not specified
     */
    @Nonnull
    Optional<Boolean> updateSnapshots();

    /**
     * Returns the list of profiles to activate.
     *

 * **Binary compatibility** is the ability to compile a program against OkHttp 3.x, and then to run
   it against OkHttp 4.x. We’re using the excellent [japicmp][japicmp] library via its
   [Gradle plugin][japicmp_gradle] to enforce binary compatibility.

 * **Java source compatibility** is the ability to upgrade Java uses of OkHttp 3.x to 4.x without
   changing `.java` files.

 * When {@code --plugins} option is enabled (or by default), upgrades plugins known to fail with Maven 4:
 * <ul>
 *   <li><strong>maven-exec-plugin</strong>: Upgrades to version 3.2.0 or higher</li>
 *   <li><strong>maven-enforcer-plugin</strong>: Upgrades to version 3.0.0 or higher</li>
 *   <li><strong>flatten-maven-plugin</strong>: Upgrades to version 1.2.7 or higher</li>
 *   <li><strong>maven-shade-plugin</strong>: Upgrades to version 3.5.0 or higher</li>