- [Container Images](#container-images-8)
  - [Changelog since v1.31.5](#changelog-since-v1315)
  - [Important Security Information](#important-security-information-1)
    - [CVE-2025-0426: Node Denial of Service via Kubelet Checkpoint API](#cve-2025-0426-node-denial-of-service-via-kubelet-checkpoint-api)
  - [Changes by Kind](#changes-by-kind-8)
    - [Feature](#feature-5)
    - [Bug or Regression](#bug-or-regression-8)

### Other (Bug, Cleanup or Flake)

- Add delays between goroutines for vm instance update ([#88094](https://github.com/kubernetes/kubernetes/pull/88094), [@aramase](https://github.com/aramase)) [SIG Cloud Provider]
- Bump debian-base to v1.0.1 and debian-iptables to v11.0.3 ([#88882](https://github.com/kubernetes/kubernetes/pull/88882), [@tallclair](https://github.com/tallclair)) [SIG API Machinery, Cluster Lifecycle, Release and Testing]

        * live-restore not fully supported

        * no shared pid namespace support

    * Docker version 1.11.2 known issues

        * Kernel crash with Aufs storage driver on Debian Jessie ([#27885](https://github.com/kubernetes/kubernetes/pull/27885)) which can be identified by the [node problem detector](https://kubernetes.io/docs/tasks/debug-application-cluster/monitor-node-health/)

07C0..07F5    ; valid                                  # 5.0  NKO DIGIT ZERO..NKO LOW TONE APOSTROPHE
07F6..07FA    ; valid                  ;      ; NV8    # 5.0  NKO SYMBOL OO DENNEN..NKO LAJANYALAN
07FB..07FC    ; disallowed                             # NA   <reserved-07FB>..<reserved-07FC>
07FD          ; valid                                  # 11.0 NKO DANTAYALAN

began talking again.  `Dinah'll miss me very much to-night, I
should think!'  (Dinah was the cat.)  `I hope they'll remember
her saucer of milk at tea-time.  Dinah my dear!  I wish you were
down here with me!  There are no mice in the air, I'm afraid, but
you might catch a bat, and that's very like a mouse, you know.
But do cats eat bats, I wonder?'  And here Alice began to get

* Bump addon-manager to v9.0.1 ([#77282](https://github.com/kubernetes/kubernetes/pull/77282), [@MrHohn](https://github.com/MrHohn))
    * Rebase image on debian-base:v1.0.0

## Changelog since v1.33.5

## Changes by Kind

### Feature

- Kubernetes is now built using Go 1.24.9
  - update setcap and debian-base to bookworm-v1.0.6 ([#134613](https://github.com/kubernetes/kubernetes/pull/134613), [@cpanato](https://github.com/cpanato)) [SIG Architecture, Cloud Provider, Etcd, Release, Storage and Testing]

### Bug or Regression

- Kubernetes is now built using Go 1.24.7 ([#134222](https://github.com/kubernetes/kubernetes/pull/134222), [@cpanato](https://github.com/cpanato)) [SIG Release and Testing]
- Kubernetes is now built using Go 1.24.9
  - update setcap and debian-base to bookworm-v1.0.6 ([#134612](https://github.com/kubernetes/kubernetes/pull/134612), [@cpanato](https://github.com/cpanato)) [SIG Architecture, Cloud Provider, Etcd, Release, Storage and Testing]

### Bug or Regression

### Upgrades

* ⬆️ Upgrade Starlette to 0.25.0. PR [#5996](https://github.com/tiangolo/fastapi/pull/5996) by [@tiangolo](https://github.com/tiangolo).
    * This solves a vulnerability that could allow denial of service attacks by using many small multipart fields/files (parts), consuming high CPU and memory.
    * Only applications using forms (e.g. file uploads) could be affected.