- Pod Affinity/AntiAffinity label selectors are now validated in the pod affinity score plugin ([#93758](https://github.com/kubernetes/kubernetes/pull/93758), [@damemi](https://github.com/damemi)) [SIG Scheduling]

*   Fixes an FPE in TFLite pooling operations
    ([CVE-2021-37684](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37684))
*   Fixes an infinite loop in TFLite
    ([CVE-2021-37686](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37686))
*   Fixes a heap OOB in TFLite
    ([CVE-2021-37685](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37685))

independent-inquiry.uk
independent-panel.uk
independent-review.uk
inderoy.no
inderøy.no
indigena.bo
industria.bo
industries
ine.kyoto.jp
inf.br
inf.cu
inf.mk
inf.ua
infiniti
info
info.at
info.az
info.bb
info.bj
info.bo
info.cx
info.ec
info.et
info.fj
info.gu
info.ht
info.hu
info.in
info.ke
info.ki
info.la

- Kubelet: Fix fs quota monitoring on volumes ([#116794](https://github.com/kubernetes/kubernetes/pull/116794), [@pacoxu](https://github.com/pacoxu)) [SIG Storage]

### Other (Cleanup or Flake)

- New default scheduling plugins order reduces scheduling and preemption latency when taints and node affinity are used ([#95539](https://github.com/kubernetes/kubernetes/pull/95539), [@soulxu](https://github.com/soulxu)) [SIG Scheduling]

- The Kubernetes API server merged selectors built from `matchLabelKeys` into the `labelSelector` of `topologySpreadConstraints`, aligning Pod Topology Spread behavior with Inter-Pod Affinity. To prevent breaking existing Pods using `matchLabelKeys`, this scheduler behavior was preserved until v1.34. Upgrades from v1.32 to v1.34 should be done incrementally (v1.32 → v1.33 → v1.34), ensuring Pods created at v1.32 with `matchLabelKeys`...

  These hints allow the scheduler to retry scheduling a Pod
  that was previously rejected by the InterPodAffinity plugin if there are changes (create, delete, or update) to a related Pod or a node that matches the pod affinity criteria. ([#122471](https://github.com/kubernetes/kubernetes/pull/122471), [@nayihz](https://github.com/nayihz)) [SIG Scheduling and Testing]

independent-inquiry.uk
independent-panel.uk
independent-review.uk
inderoy.no
inderøy.no
indigena.bo
industria.bo
industries
ine.kyoto.jp
inf.br
inf.cu
inf.mk
inf.ua
infiniti
info
info.at
info.az
info.bb
info.bj
info.bo
info.cx
info.ec
info.et
info.fj
info.gu
info.ht
info.hu
info.in
info.ke
info.ki
info.la

- Kube-scheduler: fixes a 1.27.14 regression that can lead to a scheduler crash when processing pods with affinity that doesn't match a real/valid node ([#125043](https://github.com/kubernetes/kubernetes/pull/125043), [@AxeZhan](https://github.com/AxeZhan)) [SIG Scheduling and Testing]

## Dependencies

### Added

- CRI: Added a field to support CPU affinity on Windows. ([#124285](https://github.com/kubernetes/kubernetes/pull/124285), [@kiashok](https://github.com/kiashok)) [SIG Node and Windows]