- If using cgroups v2, then the cgroup aware OOM killer will be enabled for container cgroups via  `memory.oom.group` .  This causes processes within the cgroup to be treated as a unit and killed simultaneously in the event of an OOM kill on any process in the cgroup. ([#117793](https://github.com/kubernetes/kubernetes/pull/117793), [@tzneal](https://github.com/tzneal)) [SIG Apps, Node and Testing]

pkg os, method (*LinkError) Error() string
pkg os, method (*PathError) Error() string
pkg os, method (*Process) Kill() error
pkg os, method (*Process) Release() error
pkg os, method (*Process) Signal(Signal) error
pkg os, method (*Process) Wait() (*ProcessState, error)
pkg os, method (*ProcessState) Exited() bool
pkg os, method (*ProcessState) Pid() int

- GCE/Windows: When the service cannot be stopped Stackdriver logging processes are now force killed ([#77378](https://github.com/kubernetes/kubernetes/pull/77378), [@yujuhong](https://github.com/yujuhong))

- Substantially simplified building Kubernetes by making the process run a pre-built container image directly without running `rsyncd`. ([#134510](https://github.com/kubernetes/kubernetes/pull/134510), [@BenTheElder](https://github.com/BenTheElder)) [SIG Release and Testing]

INFO:     Will watch for changes in these directories: ['/home/user/code/awesomeapp']
INFO:     Uvicorn running on http://127.0.0.1:8000 (Press CTRL+C to quit)
INFO:     Started reloader process [2248755] using WatchFiles
INFO:     Started server process [2248757]
INFO:     Waiting for application startup.
INFO:     Application startup complete.
```

### Refactors

- Updating kubelet permissions check for Windows nodes to see if process is elevated instead of checking if process owner is in Administrators group ([#111078](https://github.com/kubernetes/kubernetes/pull/111078), [@marosset](https://github.com/marosset)) [SIG Node and Windows]

## Dependencies

### Added

    (b) any new file in Source Code Form that contains any Covered
        Software.

1.11. "Patent Claims" of a Contributor
    means any patent claim(s), including without limitation, method,
    process, and apparatus claims, in any patent Licensable by such
    Contributor that would be infringed, but for the grant of the
    License, by the making, using, selling, offering for sale, having

12,2,LR // BEQLR MOVD R9, R6 CMP R6, $8 BLE small // Case for 8 <= n < 64 bytes // Process 32 bytes if available xor32: CMP R6, $32 BLT xor16 ADD $16, R8, R9 LXVD2X (R4)(R8), VS32 LXVD2X (R4)(R9), VS33 LXVD2X (R5)(R8), VS34 LXVD2X (R5)(R9), VS35 XXLXOR VS32, VS34, VS32 XXLXOR VS33, VS35, VS33 STXVD2X VS32, (R3)(R8) STXVD2X VS33, (R3)(R9) ADD $32, R8 ADD $-32, R6 CMP R6, $8 BLE small // Case for 8 <= n < 32 bytes // Process 16 bytes if available xor16: CMP R6, $16 BLT xor8 LXVD2X (R4)(R8), VS32 LXVD2X...

12,2,LR // BEQLR MOVD R9, R6 CMP R6, $8 BLE small // Case for 8 <= n < 64 bytes // Process 32 bytes if available xor32: CMP R6, $32 BLT xor16 ADD $16, R8, R9 LXVD2X (R4)(R8), VS32 LXVD2X (R4)(R9), VS33 LXVD2X (R5)(R8), VS34 LXVD2X (R5)(R9), VS35 XXLXOR VS32, VS34, VS32 XXLXOR VS33, VS35, VS33 STXVD2X VS32, (R3)(R8) STXVD2X VS33, (R3)(R9) ADD $32, R8 ADD $-32, R6 CMP R6, $8 BLE small // Case for 8 <= n < 32 bytes // Process 16 bytes if available xor16: CMP R6, $16 BLT xor8 LXVD2X (R4)(R8), VS32 LXVD2X...

  - kubelet v1.28.1
  - kubelet v1.27.5
  - kubelet v1.26.8
  - kubelet v1.25.13
  - kubelet v1.24.17

This vulnerability was discovered by James Sturtevant @jsturtevant and Mark Rossetti @marosset during the process of fixing CVE-2023-3676 (that original CVE was reported by Tomer Peled @tomerpeled92)