- github.com/coredns/corefile-migration: [v1.0.24 → v1.0.25](https://github.com/coredns/corefile-migration/compare/v1.0.24...v1.0.25)
- github.com/coreos/go-oidc: [v2.2.1+incompatible → v2.3.0+incompatible](https://github.com/coreos/go-oidc/compare/v2.2.1...v2.3.0)
- github.com/cyphar/filepath-securejoin: [v0.3.4 → v0.4.1](https://github.com/cyphar/filepath-securejoin/compare/v0.3.4...v0.4.1)

- OIDC authentication will now fail if the username asserted based on a CEL expression config is the empty string.  Previously the request would be authenticated with the username set to the empty string. ([#123568](https://github.com/kubernetes/kubernetes/pull/123568),...

- github.com/coredns/caddy: [v1.1.0 → v1.1.1](https://github.com/coredns/caddy/compare/v1.1.0...v1.1.1)
- github.com/coreos/go-oidc: [v2.1.0+incompatible → v2.2.1+incompatible](https://github.com/coreos/go-oidc/compare/v2.1.0...v2.2.1)
- github.com/coreos/go-semver: [v0.3.0 → v0.3.1](https://github.com/coreos/go-semver/compare/v0.3.0...v0.3.1)

- fluentd-gcp is unchanged at v3.2.0 since Kubernetes 1.13 ([#70954](https://github.com/kubernetes/kubernetes/pull/70954))
- OIDC authentication is unchanged at coreos/go-oidc v2 since Kubernetes 1.10 ([#58544](https://github.com/kubernetes/kubernetes/pull/58544))
- Calico is unchanged at v3.3.1 since Kubernetes 1.13 ([#70932](https://github.com/kubernetes/kubernetes/pull/70932))

- Resolves an issue with the "ServiceAccountIssuerDiscovery should support OIDC discovery" conformance test failing on clusters which are configured with issuers outside the cluster ([#101725](https://github.com/kubernetes/kubernetes/pull/101725), [@mtaufen](https://github.com/mtaufen)) [SIG Auth and Testing]

- fluentd-gcp has been updated to v3.2.0 ([#70954](https://github.com/kubernetes/kubernetes/pull/70954))
- OIDC authentication is unchanged at coreos/go-oidc v2 since Kubernetes 1.10 ([#58544](https://github.com/kubernetes/kubernetes/pull/58544))
- Calico was updated to v3.3.1 ([#70932](https://github.com/kubernetes/kubernetes/pull/70932))

#ñ]°” “Ž‡Së¸| À®Û]rß ={ï ê4tÔ±#Â&ÅònüA©L eR ³.D µ {ÏG±ÜãG+ò ¨ ¨ =KnduÂUwgf*}`XGF ïJ6æȪ%¼®Ä(ÆÔ1! WðCçOG.¯«è¼ ¡Cž{* ØKìÿJ#z©ÿ,q]Á ë÷KD[9 ½ÈO, Ø Þ«ó‹’Ÿ9§B‰¹þÇÝül0 ê–‰y¹Æõ4ôH¤£Î*Ø ðYcÖ(é ·@½ ´íO¤@×Ü7¤ãÌæ¸ø ®ù&û 3R[F2é ^1-VÆ«ë CŸ7âêÂv ]ÃßmšTb rÞH?ÐÇ’˜ˆ#á%òïÐF‹ âêþ :3LÝœóKìh ô ­ä Õ*ʬ% ŽðÑDë k§K‡ýU oRÁ k2s:’PRºï%§ >’ô @…½s ‹Îµ2Ûf&õ ‚«+e Öô݉´ ƒÜ[ H d-<%,A¸ ˆ¯2ñ²ÄÊõ짦cïÞ\kSbSÛGxz™qëÄ •â›#®Šfy÷ŸémøYw´vw vßA÷ï ²í ]|*ŠõÑÅ Ÿ€ þ6Å™#C ~ÖëŒð%g å Dª?w \Ô%e‹3Òe'¯ó rIK î.ª¤œ $ ® Ø ðIh„×£‰æ¦Ž§ ˜ 0Q ¦öÖè?^ÌfI²,4#Üaî\P...

- Ingress glbc is unchanged from 1.10: v1.0.0 ([#61302](https://github.com/kubernetes/kubernetes/pull/61302))
- OIDC authentication is unchanged from 1.10: coreos/go-oidc v2 ([#58544](https://github.com/kubernetes/kubernetes/pull/58544))
- Calico is unchanged from 1.10: v2.6.7 ([#59130](https://github.com/kubernetes/kubernetes/pull/59130))

meSelector","expectedNodeName","pattern","operator","check","result","what","_argument","simple","forward","ofType","_context","xml","outerCache","nodeIndex","start","parent","useCache","diff","firstChild","lastChild","pseudo","args","setFilters","idx","matched","not","matcher","compile","unmatched","has","lang","elemLang","hash","location","root","focus","activeElement","err","safeActiveElement","hasFocus","href","tabIndex","enabled","checked","selected","selectedIndex","empty","nextSibling","h...

- Kube-apiserver: Fixed OIDC discovery document publishing when external service account token signing was enabled. ([#131493](https://github.com/kubernetes/kubernetes/pull/131493), [@hoskeri](https://github.com/hoskeri)) [SIG API Machinery, Auth and Testing]