* Fix concurrent map access panic ([#65328](https://github.com/kubernetes/kubernetes/pull/65328), [@dashpole](https://github.com/dashpole))
    * Don't watch .mount cgroups to reduce number of inotify watches
    * Fix NVML initialization race condition
    * Fix brtfs disk metrics when using a subdirectory of a subvolume

* kube-apiserver: fixed a bug that could cause a goroutine leak if the apiserver encountered an encoding error serving a watch to a websocket watcher ([#84693](https://github.com/kubernetes/kubernetes/pull/84693), [@tedyu](https://github.com/tedyu))

                if (excludedPaths != null && excludedPaths.matcher(path).matches()) {
                    if (logger.isDebugEnabled()) {
                        logger.debug("Path {} matches the include/exclude path expression {} on {} of label.", path, excludedPaths, value);
                    }
                    return false;
                }
                if (logger.isDebugEnabled()) {

* kube-apiserver: fixed a bug that could cause a goroutine leak if the apiserver encountered an encoding error serving a watch to a websocket watcher ([#84693](https://github.com/kubernetes/kubernetes/pull/84693), [@tedyu](https://github.com/tedyu))

* Fix issue in reconstruct volume data when kubelet restarts ([#36616](https://github.com/kubernetes/kubernetes/pull/36616), [@jingxu97](https://github.com/jingxu97))
* Ensure proper serialization of updates and creates in federation test watcher ([#36613](https://github.com/kubernetes/kubernetes/pull/36613), [@mwielgus](https://github.com/mwielgus))

                value = resourceName;
            }

            if (value != null) {
                for (final Map.Entry<Pattern, String> entry : passwordMap.entrySet()) {
                    if (entry.getKey().matcher(value).matches()) {
                        return entry.getValue();
                    }
                }
            }
        }

        if (params != null && url != null) {

            final Matcher matcher = pattern.matcher(v.trim());
            if (matcher.matches()) {
                final PrunedTag tag = new PrunedTag(matcher.group(1));
                if (matcher.group(2) != null) {
                    final String attrPair = matcher.group(2).substring(1, matcher.group(2).length() - 1);

            if (obj != null) {
                value = obj.toString();
            }
            final Matcher matcher = entry.getValue().matcher(value);
            if (allRequired) {
                if (!matcher.matches()) {
                    return false;
                }
            } else if (matcher.matches()) {
                return true;
            }
        }

        return allRequired;
    }

- The watch API endpoints prefixed with `/watch` are deprecated and will be removed in a future release. These standard method for watching resources (supported since v1.0) is to use the list API endpoints with a `?watch=true` parameter. All client-go clients have used the parameter method since v1.6.0. ([#65147](https://github.com/kubernetes/kubernetes/pull/65147),...

    void oidFormat() {
        assertAll(() -> assertTrue(OID_PATTERN.matcher(SpnegoConstants.SPNEGO_MECHANISM).matches(), "Invalid OID: SPNEGO_MECHANISM"),
                () -> assertTrue(OID_PATTERN.matcher(SpnegoConstants.KERBEROS_MECHANISM).matches(), "Invalid OID: KERBEROS_MECHANISM"),
                () -> assertTrue(OID_PATTERN.matcher(SpnegoConstants.LEGACY_KERBEROS_MECHANISM).matches(),
                        "Invalid OID: LEGACY_KERBEROS_MECHANISM"),