* [Forbid Extra Query Parameters](https://fastapi.tiangolo.com/tutorial/query-param-models/#forbid-extra-query-parameters)
* [Forbid Extra Headers](https://fastapi.tiangolo.com/tutorial/header-param-models/#forbid-extra-headers)
* [Forbid Extra Cookies](https://fastapi.tiangolo.com/tutorial/cookie-param-models/#forbid-extra-cookies)

### Features

    HTTP/2 server, close all but the first connection.
 *  Fix: Fail the HTTP/2 connection if first frame isn't `SETTINGS`.
 *  Fix: Forbid spaces in header names.
 *  Fix: Don't offer to do gzip if the request is partial.
 *  Fix: MockWebServer is now usable with JUnit 5. That update [broke the rules][junit_5_rules].

  * Authorization sets `authorization.k8s.io/decision` and `authorization.k8s.io/reason` annotations with the authorization decision ("allow" or "forbid") and a human-readable description of why the decision was made (for example, RBAC includes the name of the role/binding/subject which allowed a request).

        builder.addHeader("WWW-Authenticate: Basic realm=\"protected area\"")
      }

      HttpURLConnection.HTTP_NO_CONTENT, HttpURLConnection.HTTP_RESET -> {
        builder.body("") // We forbid bodies for 204 and 205.
      }
    }
    server.enqueue(builder.build())
    if (responseCode == HttpURLConnection.HTTP_CLIENT_TIMEOUT) {

    )
    executeSynchronously(Request(server.url("/")))
    assertThat(server.takeRequest().exchangeIndex).isEqualTo(0)
    assertThat(server.takeRequest().exchangeIndex).isEqualTo(1)
  }

  /** We forbid non-ASCII characters in outgoing request headers, but accept UTF-8.  */
  @Test
  fun responseHeaderParsingIsLenient() {
    val headersBuilder = Headers.Builder()
    headersBuilder.add("Content-Length", "0")

  the garbage collector starts to manage it.


#### Monitoring/Prometheus

- Fix etcd_object_counts metric reported by kube-apiserver ([#94773](https://github.com/kubernetes/kubernetes/pull/94773), [@tkashem](https://github.com/tkashem)) [SIG API Machinery]
- Fix incorrectly reported verbs for kube-apiserver metrics for CRD objects ([#93523](https://github.com/kubernetes/kubernetes/pull/93523), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery and Instrumentation]

           rules:
           - apiGroups: [""]
             resources: ["events"]
             verbs:
             - create
             - patch
             - update
           - apiGroups: [""]
             resources: ["secrets"]
             verbs:
             - get
             - create
         - apiVersion: rbac.authorization.k8s.io/v1
           kind: ClusterRoleBinding

- Adopted a new implementation of watch caches for **list** verbs, using a btree data structure. The new implementation is active by default; you can opt out by disabling the `BtreeWatchCache` feature gate. ([#128415](https://github.com/kubernetes/kubernetes/pull/128415), [@serathius](https://github.com/serathius))...

circumvention of technological measures to the extent such circumvention
is effected by exercising rights under this License with respect to
the covered work, and you disclaim any intention to limit operation or
modification of the work as a means of enforcing, against the work's
users, your or third parties' legal rights to forbid circumvention of
technological measures.