apply {
        this.trustedCertificates += certificate
      }

    /**
     * Add all of the host platform's trusted root certificates. This set varies by platform
     * (Android vs. Java), by platform release (Android 4.4 vs. Android 9), and with user
     * customizations.
     *
     * Most TLS clients that connect to hosts on the public Internet should call this method.

- Kubernetes is now built using Go 1.23.10 ([#132223](https://github.com/kubernetes/kubernetes/pull/132223), [@cpanato](https://github.com/cpanato)) [SIG Release and Testing]
- Kubernetes is now built using Go 1.23.9 ([#131938](https://github.com/kubernetes/kubernetes/pull/131938), [@cpanato](https://github.com/cpanato)) [SIG Release and Testing]

### Bug or Regression

OkHttpClient client = new OkHttpClient.Builder()
    .connectionSpecs(Arrays.asList(ConnectionSpec.MODERN_TLS, ConnectionSpec.COMPATIBLE_TLS))
    .build();
```

#### Http2Stream

This lock guards the internal state of each stream. As above, it is never held for blocking operations. When we need to hold an application thread to block a read, we use wait/notify on this lock. This works because the lock is released while `wait()` is waiting.

#### Http2Writer

/**
 * Listener for metrics events. Extend this class to monitor the quantity, size, and duration of
 * your application's HTTP calls.
 *
 * All start/connect/acquire events will eventually receive a matching end/release event, either
 * successful (non-null parameters), or failed (non-null throwable). The first common parameters of
 * each event pair are used to link the event in case of concurrent or repeated events e.g.

			// report encoding bugs to AWS, and use ASCII-only metadata to ensure reliable S3 API
			// compatibility.
			if needsMimeEncoding(v) {
				// see https://github.com/golang/go/blob/release-branch.go1.24/src/net/mail/message.go#L325
				if strings.ContainsAny(v, "\"#$%&'(),.:;<>@[]^`{|}~") {
					v = mime.BEncoding.Encode("UTF-8", v)
				} else {
					v = mime.QEncoding.Encode("UTF-8", v)
				}
			}

        byte[] testBuffer = new byte[1024];
        response.setBuffer(testBuffer);

        byte[] releasedBuffer = response.releaseBuffer();
        assertSame(testBuffer, releasedBuffer);

        // After release, the buffer should be null
        assertNull(response.releaseBuffer());
    }

    @Test
    @DisplayName("Test hasMoreElements inherited behavior")
    void testHasMoreElements() {

- Kubernetes is now built with go 1.23.5 ([#129962](https://github.com/kubernetes/kubernetes/pull/129962), [@cpanato](https://github.com/cpanato)) [SIG Release and Testing]

    assertThat(server.takeRequest().exchangeIndex).isEqualTo(0)
  }

  /**
   * Regression test for an edge case where closing response body in the HTTP engine doesn't release
   * the corresponding stream allocation. This test keeps those response bodies alive and reads
   * them after the redirect has completed. This forces a connection to not be reused where it would
   * be otherwise.
   *

      @RetainedLocalRef ListenableFuture<V> delegate = timeoutFuture.delegateRef;
      if (delegate == null) {
        return;
      }

      /*
       * If we're about to complete the TimeoutFuture, we want to release our reference to it.
       * Otherwise, we'll pin it (and its result) in memory until the timeout task is GCed. (The
       * need to clear our reference to the TimeoutFuture is the reason we use a *static* nested