* TypeVariableImpl}. Otherwise it throws {@link UnsupportedOperationException}; this should only
   * apply to {@code getAnnotatedBounds()}. This does mean that users on Java who obtain an instance
   * of {@code TypeVariable} from {@link TypeResolver#resolveType} will not be able to call {@code
   * getAnnotatedBounds()} on it, but that should hopefully be rare.
   *

     *
     * Unfortunately, we don't distinguish between these two cases in our public API: Joiner.on(...)
     * and Joiner.on(...).useForNull(...) both declare the same return type: plain Joiner. To ensure
     * that users *can* pass null arguments to Joiner, we annotate it as if it always tolerates null
     * inputs, rather than as if it never tolerates them.
     *

      <activation>
        <property>
          <name>surefire.toolchain.version</name>
          <!-- the value provided by GitHub CI (which maybe we could even change, but supporting "8" seems nice for any users who try pass that value manually) -->
          <value>8</value>
        </property>
      </activation>
      <properties>
        <test.add.opens></test.add.opens>
      </properties>
    </profile>

      <activation>
        <property>
          <name>surefire.toolchain.version</name>
          <!-- the value provided by GitHub CI (which maybe we could even change, but supporting "8" seems nice for any users who try pass that value manually) -->
          <value>8</value>
        </property>
      </activation>
      <properties>
        <test.add.opens></test.add.opens>
      </properties>
    </profile>

- github.com/moby/docker-image-spec: [v1.3.1](https://github.com/moby/docker-image-spec/tree/v1.3.1)
- github.com/moby/sys/user: [v0.3.0](https://github.com/moby/sys/tree/user/v0.3.0)
- github.com/moby/sys/userns: [v0.1.0](https://github.com/moby/sys/tree/userns/v0.1.0)
- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: v1.27.0

### Changed
- cel.dev/expr: v0.15.0 → v0.18.0

* [beta] SelfSubjectRulesReview, an API that lets a user see what actions they can perform with a namespace, has been added to the authorization.k8s.io API group. This bulk query is intended to enable UIs to show/hide actions based on the end user, and for users to quickly reason about their own permissions.

* activation
* update
* deactivation
* un-installation

When a plugin is installed we may want to check the license and make users agree. We may also want to unpack the given plugin in a particular location.

   *     directly, or use a combination of {@link #throwIfUnchecked} and {@code throw new
   *     RuntimeException(e)}. But consider whether users would be better off if your API threw a
   *     different type of exception. For background on the deprecation, read <a
   *     href="https://github.com/google/guava/wiki/Why-we-deprecated-Throwables.propagate">Why we

Now, whenever a browser is creating a user with a password, the API will return the same password in the response.

In this case, it might not be a problem, because it's the same user sending the password.

But if we use the same model for another *path operation*, we could be sending our user's passwords to every client.

/// danger

   * {@code Ordering.natural()} if the left map uses the natural ordering of its elements. This
   * difference is an immutable snapshot of the state of the maps at the time this method is called.
   * It will never change, even if the maps change at a later time.
   *
   * <p>Since this method uses {@code TreeMap} instances internally, the keys of the right map must