- Kube-apiserver: fixes a potential crash serving CustomResourceDefinitions that combine an invalid schema and CEL validation rules. ([#126167](https://github.com/kubernetes/kubernetes/pull/126167), [@cici37](https://github.com/cici37)) [SIG API Machinery and Testing]

  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 ../../../../../../../maven-plugin-parameter-documenter/target/generated-site/xsd/paramdoc-1.0.0.xsd ">
  <expressions>
    <expression>
      <syntax>settings.offline</syntax>
      <configuration>
        <![CDATA[
    <offline>true</offline>
    ]]></configuration>
      <description>
        <![CDATA[

curious dream, dear, certainly:  but now run in to your tea; it's
getting late.'  So Alice got up and ran off, thinking while she
ran, as well she might, what a wonderful dream it had been.

  But her sister sat still just as she left her, leaning her
head on her hand, watching the setting sun, and thinking of
little Alice and all her wonderful Adventures, till she too began

- Resolves a spurious "Unknown discovery response content-type" error in client-go discovery requests by tolerating extra content-type parameters in API responses ([#117638](https://github.com/kubernetes/kubernetes/pull/117638), [@seans3](https://github.com/seans3)) [SIG API Machinery]

* Fixes a bug in openapi published for custom resources using x-kubernetes-preserve-unknown-fields extensions, so that kubectl will allow sending unknown fields for that portion of the object. ([#79636](https://github.com/kubernetes/kubernetes/pull/79636), [@liggitt](https://github.com/liggitt))

    public static final String LABELS_AUTH_REALM = "{labels.authRealm}";

    /** The key of the message: Status */
    public static final String LABELS_AVAILABLE = "{labels.available}";

    /** The key of the message: Created By */
    public static final String LABELS_CREATED_BY = "{labels.createdBy}";

    /** The key of the message: Created Time */
    public static final String LABELS_CREATED_TIME = "{labels.createdTime}";

- Enforced kubelet to request serving certificates only once it has at least one IP address in the `.status.addresses` of its associated Node object. This avoids requesting DNS-only serving certificates before externally set addresses are in place. Until 1.33, the previous behavior can be opted back into by setting the deprecated `AllowDNSOnlyNodeCSR` feature gate to true in the kubelet. ([#125813](https://github.com/ku...

Yuri Schimke <******@****.***> 1713104645 +0100

* kubeadm: enable secure serving for the kube-scheduler ([#80951](https://github.com/kubernetes/kubernetes/pull/80951), [@neolit123](https://github.com/neolit123))

<module>
<source path="">
  <!-- Hack to keep collect from hiding collect.testing supersource: -->
  <exclude name="**/testing/**"/>
</source>

<!--
    We used to set this only for packages that had manual supersource. That
    worked everywhere that I know of except for one place: when running the GWT
    util.concurrent tests under Guava.

    The problem is that GWT responds poorly to two .gwt.xml files in the same
    Java package; see