### Model sharing

If the multitenant design allows sharing models, make sure that tenants and
users are aware of the security risks detailed here and that they are going to
be practically running code provided by other users. Currently there are no good
ways to detect malicious models/graphs/checkpoints, so the recommended way to
mitigate the risk in this scenario is to sandbox the model execution.

### Hardware attacks

   * implementation; otherwise refreshes will be performed during unrelated cache read and write
   * operations.
   *
   * <p>Currently automatic refreshes are performed when the first stale request for an entry
   * occurs. The request triggering refresh will make a synchronous call to {@link
   * CacheLoader#reload}

    Set<Feature<?>> keySetFeatures = computeCommonDerivedCollectionFeatures(mapFeatures);

    // TODO(lowasser): make this trigger only if the map is a submap
    // currently, the KeySetGenerator won't work properly for a subset of a keyset of a submap
    keySetFeatures.add(CollectionFeature.SUBSET_VIEW);
    if (mapFeatures.contains(MapFeature.ALLOWS_NULL_KEYS)) {

                msg.decode_header(fbuf);
                stub_frag_len = msg.length - 24;

                if ((off + stub_frag_len) > stub.length) {
                    // shouldn't happen if alloc_hint is correct or greater
                    byte[] tmp = new byte[off + stub_frag_len];
                    System.arraycopy(stub, 0, tmp, 0, off);
                    stub = tmp;
                }

  # Install the necessary Python, unless it's already present
  pyenv install -s "$TFCI_PYTHON_VERSION"
  pyenv local "$TFCI_PYTHON_VERSION"
  # Do a sanity check to make sure that we using the correct Python version
  python --version
fi

# TFCI Mac VM images do not have twine installed by default so we need to
# install it manually. We use Twine in nightly builds to upload Python packages
# to PyPI.

                    + "reset() called multiple times, or subclass does not call super.reset(). "
                    + "Please see Javadocs of TokenStream class for more information about the correct consuming workflow.");
        }

        @Override
        public void close() {
        }
    };

    protected final Field inputPendingField;

    protected final Field userDictionaryField;

- The Date [functions](https://docs.aws.amazon.com/AmazonS3/latest/dev/s3-glacier-select-sql-reference-date.html) `DATE_ADD`, `DATE_DIFF`, `EXTRACT` and `UTCNOW` along with type conversion using `CAST` to the `TIMESTAMP` data type are currently supported.
- AWS S3's [reserved keywords](https://docs.aws.amazon.com/AmazonS3/latest/dev/s3-glacier-select-sql-reference-keyword-list.html) list is not yet respected.

You can have sub-dependencies and "trees" of sub-dependencies of any size and shape, and any or all of them can use `yield`.

**FastAPI** will make sure that the "exit code" in each dependency with `yield` is run in the correct order.

For example, `dependency_c` can have a dependency on `dependency_b`, and `dependency_b` on `dependency_a`:

//// tab | Python 3.9+

```Python hl_lines="6  14  22"

          .add("aString", aString)
          .add("anInt", anInt)
          .add("anEnum", anEnum)
          .toString();
    }
  }

  /** Validates that the Comparator equivalent we document is correct. */
  @J2ktIncompatible // TODO b/315311435 - J2kt cannot emulate Comparator<C>.<U>thenComparing()
  public void testComparatorEquivalent() {
    Comparator<Foo> comparatorUsingComparisonChain =
        (a, b) ->

```

This will regenerate the Go structs used for schema validation.

### Step 4. Update the generated manifests

Tests of istioctl use the auto-generated manifests to ensure that the istioctl binary has the correct version of the charts.

To regenerate the manifests, run:

```bash
$ make copy-templates update-golden
```

### Step 5. Create a PR using outputs from Steps 1 to 4