- Added remote runtime and image `Close()` method to be able to close the connection. ([#133211](https://github.com/kubernetes/kubernetes/pull/133211), [@saschagrunert](https://github.com/saschagrunert)) [SIG Node]

- Updated the feature MultiCIDRServiceAllocator to beta (disabled by default). Users need to enable the feature gate and the networking v1beta1 group to be able to use this new feature, that allows to dynamically reconfigure Service CIDR ranges. ([#125021](https://github.com/kubernetes/kubernetes/pull/125021), [@aojea](https://github.com/aojea)) [SIG API Machinery, Apps, CLI, Etcd, Instrumentation, Network...

This release contains changes that address the following vulnerabilities:

### CVE-2021-25741: Symlink Exchange Can Allow Host Filesystem Access

A security issue was discovered in Kubernetes where a user may be able to
create a container with subpath volume mounts to access files &
directories outside of the volume, including on the host filesystem.

**Affected Versions**:
  - kubelet v1.22.0 - v1.22.1

      .isEqualTo(Settings.DEFAULT_INITIAL_WINDOW_SIZE.toLong())
    assertThat(stream1.writeBytesMaximum)
      .isEqualTo(Settings.DEFAULT_INITIAL_WINDOW_SIZE.toLong())

    // Another stream should be able to send data even though 1 is blocked.
    val stream2 = connection.newStream(headerEntries("b", "banana"), true)
    val out2 = stream2.sink.buffer()
    out2.writeUtf8("foo")
    out2.flush()

            if (!exists()) {
                throw new SmbException(NtStatus.NT_STATUS_OBJECT_NAME_NOT_FOUND, null);
            }

            /*
             * Should be able to copy an entire share actually
             */
            if (this.fileLocator.getShare() == null || dest.getLocator().getShare() == null) {

        SmbComReadAndX req;
        SmbComReadAndXResponse resp;
        WriterThread w;
        int bsize;
        byte[][] b;

        /* Should be able to copy an entire share actually
         */
        if (share == null || dest.share == null) {
            throw new SmbException("Invalid operation for workgroups or servers");
        }

// https://www.iana.org/domains/root/db/abbvie.html
abbvie

// abc : Disney Enterprises, Inc.
// https://www.iana.org/domains/root/db/abc.html
abc

// able : Able Inc.
// https://www.iana.org/domains/root/db/able.html
able

// abogado : Registry Services, LLC
// https://www.iana.org/domains/root/db/abogado.html
abogado

// abudhabi : Abu Dhabi Systems and Information Centre

### CVE-2024-5321: Incorrect permissions on Windows containers logs

A security issue was discovered in Kubernetes clusters with Windows nodes
where BUILTIN\Users may be able to read container logs and NT
AUTHORITY\Authenticated Users may be able to modify container logs.

**Affected Versions**:
  - kubelet <= 1.27.15
  - kubelet <= 1.28.11
  - kubelet <= 1.29.6
  - kubelet <= 1.30.2 

when she got to the door, she found she had forgotten the
little golden key, and when she went back to the table for it,
she found she could not possibly reach it:  she could see it
quite plainly through the glass, and she tried her best to climb
up one of the legs of the table, but it was too slippery;
and when she had tired herself out with trying,
the poor little thing sat down and cried.

  /**
   * Copies all mappings from the specified table to this table. The effect is equivalent to calling
   * {@link #put} with each row key / column key / value mapping in {@code table}.
   *
   * @param table the table to add to this table
   */
  void putAll(Table<? extends R, ? extends C, ? extends V> table);

  /**
   * Removes the mapping, if any, associated with the given keys.
   *