The scheduling hints allow the scheduler to only retry scheduling a `Pod`
  that was previously rejected by the `NodeAffinity` plugin if a new `Node` or a `Node` update matches the `Pod`'s node affinity. ([#119155](https://github.com/kubernetes/kubernetes/pull/119155), [@carlory](https://github.com/carlory))
- `kubeadm`: promoted feature gate `EtcdLearnerMode` to `beta`. Learner mode for

### (No, really, you MUST read this before you upgrade)

- Kubeadm: remove the deprecated flag `--experimental-patches` for the `init|join|upgrade` commands. The flag `--patches` is no longer allowed in a mixture with the flag `--config`. Please use the kubeadm configuration for setting patches for a node using `{Init|Join}Configuration.patches`. ([#104065](https://github.com/kubernetes/kubernetes/pull/104065), [@pacoxu](https://github.com/pacoxu))

potentially exploit a vulnerability in the TensorFlow code that handles videos,
which could allow them to execute arbitrary code on the system running
TensorFlow.

It is important to keep TensorFlow up to date with the latest security patches
and follow the sandboxing guideline above to protect against these types of
vulnerabilities.

## Security properties of execution modes

TensorFlow has several execution modes, with Eager-mode being the default in v2.

## Changelog since v1.12.8

### Other notable changes

* Active watches of custom resources now terminate properly if the CRD is modified. ([#78029](https://github.com/kubernetes/kubernetes/pull/78029), [@liggitt](https://github.com/liggitt))

        // Arrange: program send() to simulate first, next, next(NO_MORE_FILES)
        List<String[]> batches = new ArrayList<>();
        batches.add(new String[] { ".", "..", "a", "b" }); // first batch, dot entries filtered
        batches.add(new String[] { "c" }); // second batch
        batches.add(new String[] {}); // last -> NO_MORE_FILES

        // send() answer that mutates the provided response

- Fix: initial delay in mounting azure disk & file ([#93052](https://github.com/kubernetes/kubernetes/pull/93052), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider and Storage]
- Fixed a performance issue applying json patches to deeply nested objects ([#93813](https://github.com/kubernetes/kubernetes/pull/93813), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, CLI, Cloud Provider and Cluster Lifecycle]

### Bug or Regression

- EndpointSlice IP validation now matches Endpoints IP validation. ([#101084](https://github.com/kubernetes/kubernetes/pull/101084), [@robscott](https://github.com/robscott)) [SIG Apps and Network]

     * Returns a filter for directories that may contain paths accepted by the given matcher.
     * The given path matcher should be an instance created by this service.
     * The path matcher returned by this method expects directory paths.
     * If that matcher returns {@code false}, then the directory will definitively not contain
     * the paths selected by the matcher given in argument to this method.

        final Pattern pattern = Pattern.compile("test");
        final Matcher matcher = pattern.matcher("test");
        final BiFunction<String, Matcher, String> pathMatcher = pathMappingHelper.createPathMatcher(matcher, "function:encodeUrl");

        String result = pathMatcher.apply("http://example.com/test path", matcher);
        assertEquals("http://example.com/test+path", result);
    }

        }
        final Matcher matcher = regexPattern.matcher(input);
        if (matcher.find()) {
            if (pathMapperFunc == null) {
                final String replacement = StringUtil.isNotBlank(getReplacement()) ? getReplacement() : StringUtil.EMPTY;
                pathMapperFunc = pathMappingHelper.createPathMatcher(matcher, replacement);
            }
            try {