- kube-apiserver: `--service-account-max-token-expiration` can now be used in combination with an external token signer `--service-account-signing-endpoint`, as long as the `--service-account-max-token-expiration` is not longer than the external token signer's max expiration. ([#129816](https://github.com/kubernetes/kubernetes/pull/129816), [@sambdavidson](https:/...

	if err != nil {
		t.Fatalf("Expected parsing to succeed but failed with %v", err)
	}
	for _, rule := range lc.Rules {
		if rule.ID == "" {
			t.Fatalf("Expected all rules to have a unique id assigned %#v", rule)
		}
	}
}

func TestFilterAndSetPredictionHeaders(t *testing.T) {
	lc := Lifecycle{
		Rules: []Rule{
			{
				ID:     "rule-1",
				Status: "Enabled",

  The GNU Affero General Public License is a free, copyleft license for
software and other kinds of works, specifically designed to ensure
cooperation with the community in the case of network server software.

  The licenses for most software and other practical works are designed
to take away your freedom to share and change the works.  By contrast,
our General Public Licenses are intended to guarantee your freedom to

- Updated the control plane's trust anchor publisher to create and manage a new ClusterTrustBundle object, associated with the `kubernetes.io/kube-apiserver-serving` X.509 certificate signer. This ClusterTrustBundle contains a PEM bundle in its payload that you can use to verify kube-apiserver serving certificates. ([#127326](https://github.com/kubernetes/kubernetes/pull/127326), [@stlaz](https://github.com/stlaz)) [SIG API Machinery,...

 * <a href="http://www.unicode.org/glossary/#supplementary_code_point">supplementary Unicode code
 * points</a> in the range {@code 0x10000} to {@code 0x10FFFF} which includes the majority of
 * assigned characters, including important CJK characters and emoji.
 *
 * <p>Supplementary characters are <a
 * href="https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/lang/Character.html#supplementary">encoded

- Aligned `kubectl label` output message to include 'modified' when labels are both added and removed ([#134849](https://github.com/kubernetes/kubernetes/pull/134849), [@tchap](https://github.com/tchap)) [SIG CLI]

	if err := DB.Preload("Company").First(&got, user.ID).Error; err != nil {
		t.Fatalf("failed preload company: %v", err)
	}
	if got.Company.ID == 0 || got.Company.Name != "Belongs-To-Co" {
		t.Fatalf("expected Company assigned, got %+v", got.Company)
	}
}

// Mixed fields + association: update Age and create a pet together
func TestClauseAssociationSetUpdateMixedFieldAndAssociation(t *testing.T) {
	ctx := context.Background()

 * <a href="http://www.unicode.org/glossary/#supplementary_code_point">supplementary Unicode code
 * points</a> in the range {@code 0x10000} to {@code 0x10FFFF} which includes the majority of
 * assigned characters, including important CJK characters and emoji.
 *
 * <p>Supplementary characters are <a
 * href="https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/lang/Character.html#supplementary">encoded

- The certificate signer no longer accepts ca.key passwords via the `CFSSL_CA_PK_PASSWORD` environment variable. This capability was not prompted by user request, never advertised, and recommended against in the security audit. ([#84677](https://github.com/kubernetes/kub...

    assertThat(url.queryParameterNames).isEqualTo(setOf("a+=& b"))
    assertThat(url.queryParameterValues("a+=& b")).isEqualTo(listOf("c+=& d"))
    assertThat(url.querySize).isEqualTo(1)
    // Ambiguous! (Though working as designed.)
    assertThat(url.query).isEqualTo("a+=& b=c+=& d")
    assertThat(url.encodedQuery).isEqualTo("a%2B%3D%26%20b=c%2B%3D%26%20d")
  }

  @Test
  fun composeQueryWithEncodedComponents() {