* CustomResourceDefinitions: OpenAPI v3 validation schemas containing `$ref`references are no longer permitted (valid references could not be constructed previously because property ids were not permitted either). Before upgrading, ensure CRD definitions do not include those `$ref` fields. ([#58438](https://github.com/kubernetes/kubernetes/pull/58438), [@carlory](https://github.com/carlory))

- Revert "fix: handle socket file detection on Windows" ([#127100](https://github.com/kubernetes/kubernetes/pull/127100), [@jsturtevant](https://github.com/jsturtevant)) [SIG Node]

    //  * URI is much more strict than HttpUrl or URL on what's accepted.
    //
    // HttpUrl is quite lenient with what characters it accepts. In particular, characters like '{'
    // and '"' are permitted but unlikely to occur in real-world URLs. Unfortunately we can't just
    // lock it down due to URL templating: "http://{env}.{dc}.example.com".
    UrlComponentEncodingTester.newInstance()

* If ExperimentalCriticalPodAnnotation=True flag gate is set, kubelet will ensure that pods with `scheduler.alpha.kubernetes.io/critical-pod` annotation will be admitted even under resource pressure, will not be evicted, and are reasonably protected from system OOMs. ([#41052](https://github.com/kubernetes/kubernetes/pull/41052), [@vishh](https://github.com/vishh))

* If ExperimentalCriticalPodAnnotation=True flag gate is set, kubelet will ensure that pods with `scheduler.alpha.kubernetes.io/critical-pod` annotation will be admitted even under resource pressure, will not be evicted, and are reasonably protected from system OOMs. ([#41052](https://github.com/kubernetes/kubernetes/pull/41052), [@vishh](https://github.com/vishh))

    assertThat(response.body.string()).isEqualTo("abc")
    assertThat(server.takeRequest().sequenceNumber).isEqualTo(0)

    // Note that although we have two routes available, we only use one. The retry is permitted
    // because there are routes available, but it chooses the existing connection since it isn't
    // yet considered unhealthy.
    assertThat(server.takeRequest().sequenceNumber).isEqualTo(1)
  }

		if rec := recover(); rec != nil {
			gridLogIf(ctx, fmt.Errorf("handleMessages: panic recovered: %v", rec))
			debug.PrintStack()
		}
		if debugPrint {
			fmt.Println("handleMessages: write goroutine exited")
		}
		cancel(ErrDisconnected)
		c.connChange.L.Lock()
		if atomic.CompareAndSwapUint32((*uint32)(&c.state), StateConnected, StateConnectionError) {
			c.connChange.Broadcast()
		}
		c.disconnected()

    The Panther took pie-crust, and gravy, and meat,
    While the Owl had the dish as its share of the treat.
    When the pie was all finished, the Owl, as a boon,
    Was kindly permitted to pocket the spoon:
    While the Panther received knife and fork with a growl,
    And concluded the banquet--]

  `What IS the use of repeating all that stuff,' the Mock Turtle

        .build(),
    )
    val url = server.url("/a")
    assertThat(get(url).body.string()).isEqualTo("a")
    val i: Iterator<String> = cache.urls()
    cache.evictAll()

    // The URL was evicted before hasNext() made any promises.
    assertThat(i.hasNext()).isFalse()
    assertFailsWith<NoSuchElementException> {
      i.next()
    }
  }

- Reverted a kubectl azure auth module change where oidc claim spn: prefix was omitted resulting a breaking behavior with existing Azure AD OIDC enabled api-server ([#87507](https://github.com/kubernetes/kubernetes/pull/87507), [@weinong](https://github.com/weinong)) [SIG API Machinery, Auth and Cloud Provider]