de-Encryption-Seal-Algorithm":"DAREv2-HMAC-SHA256","content-type":"application/octet-stream"}},{"Bucket":"buck1","Name":"go_113/src/cmd/go/testdata/testcover/pkg1/a.go","UserDef":{"X-Minio-Internal-Server-Side-Encryption-Iv":"cIyYfy3yvy8cCAK3IEXd/RE8Flw=","X-Minio-Internal-Server-Side-Encryption-S3-Kms-Key-Id":"my-minio-key","X-Minio-Internal-Server-Side-Encryption-S3-Kms-Sealed-Key":"IAAfANJiZHp2gjRanVp2==","X-Minio-Internal-Server-Side-Encryption-S3-Sealed-Key":"IAAfALd3wi/44ISVEihRe8l6qdrzgTu...

  CVE-2021-29923 golang standard library "net" - Improper Input Validation of octal literals in golang 1.16.2 and below standard library "net" results in indeterminate SSRF & RFI vulnerabilities.
  Reference: https://nvd.nist.gov/vuln/detail/CVE-2021-29923 ([#104368](https://github.com/kubernetes/kubernetes/pull/104368), [@aojea](https://github.com/aojea))

- Kubelet is no longer able to recover from device manager state file older than 1.20. If the proper recommended upgrade flow is followed, there should be no issue. ([#123398](https://github.com/kubernetes/kubernetes/pull/123398), [@ffromani](https://github.com/ffromani)) [SIG Node and Testing]

### `TokenRequest` / `TokenRequestProjection` graduates to General Availability

Service account tokens bound to a pod is now a stable feature. The feature gates will be removed in 1.21 release. For more information, refer to notes below on the changelogs.

### RuntimeClass feature graduates to General Availability.

* Fixes issue where AAD token obtained by kubectl is incompatible with on-behalf-of flow and oidc. ([#86412](https://github.com/kubernetes/kubernetes/pull/86412), [@weinong](https://github.com/weinong))
    * The audience claim before this fix has "spn:" prefix. After this fix, "spn:" prefix is omitted.

- Fixed an issue blocking azure auth to prompt to device code authentication flow when refresh token expires. ([#102063](https://github.com/kubernetes/kubernetes/pull/102063), [@tdihp](https://github.com/tdihp))

	quarkus/extensions/kotlin/runtime/pom.xml
	quarkus/extensions/arc/runtime/pom.xml
	quarkus/test-framework/junit5-internal/pom.xml
quarkus/integration-tests/oidc-code-flow/pom.xml
	quarkus/extensions/oidc/runtime/pom.xml
	quarkus/extensions/smallrye-jwt-build/runtime/pom.xml
	quarkus/extensions/resteasy-classic/resteasy-jackson/runtime/pom.xml
	quarkus/extensions/micrometer/runtime/pom.xml

  - Added `resources` field to container status that reports actual resources applied to running containers.
  - Added `resize` field to pod status that describes the state of a requested pod resize.

  For details, see KEPs below. ([#102884](https://github.com/kubernetes/kubernetes/pull/102884), [@vinaykul](https://github.com/vinaykul)) [SIG API Machinery, Apps, Instrumentation, Node, Scheduling and Testing]

* The minimum supported version of Docker is now 1.11; if you are using Docker 1.10 or below, be sure to upgrade Docker before upgrading Kubernetes. ([#57845](https://github.com/kubernetes/kubernetes/pull/57845), [@yujuhong](https://github.com/yujuhong))

* Fixes issue where AAD token obtained by kubectl is incompatible with on-behalf-of flow and oidc. ([#86412](https://github.com/kubernetes/kubernetes/pull/86412), [@weinong](https://github.com/weinong))
    * The audience claim before this fix has "spn:" prefix. After this fix, "spn:" prefix is omitted.