}
            // Ensure atomic cleanup of all resources
            synchronized (this) {
                // Double-check usage count within synchronized block
                if (this.usageCount.get() != 0) {
                    return; // Another thread acquired the session
                }

                if (this.transportAcquired.compareAndSet(true, false)) {

$body.hasClass(CLASS_NAME_CONTROL_SIDEBAR_OPEN) ||\n        $body.hasClass(CLASS_NAME_CONTROL_SIDEBAR_SLIDE)\n\n    if (shouldNotHideAll) {\n      $(SELECTOR_CONTROL_SIDEBAR).not(this._config.target).hide()\n      $(this._config.target).css('display', 'block')\n    } else {\n      $(SELECTOR_CONTROL_SIDEBAR).hide()\n    }\n\n    this._fixHeight()\n    this._fixScrollHeight()\n\n    $(window).resize(() => {\n      this._fixHeight()\n      this._fixScrollHeight()\n    })\n\n    $(window).scroll(() => {\n...

- For raw block CSI volumes on Kubernetes, kubelet was incorrectly calling CSI NodeStageVolume for every single "map" (i.e. raw block "mount") operation for a volume already attached to the node. This PR ensures it is only called once per volume per node. ([#112403](https://github.com/kubernetes/kubernetes/pull/112403), ...

- Fixed bug that caused cAdvisor to incorrectly detect single-socket multi-NUMA topology. ([#99315](https://github.com/kubernetes/kubernetes/pull/99315), [@iwankgb](https://github.com/iwankgb)) [SIG Node]
- Fixed cleanup of block devices when /var/lib/kubelet is a symlink. ([#96889](https://github.com/kubernetes/kubernetes/pull/96889), [@jsafrane](https://github.com/jsafrane)) [SIG Storage]

        * Supplemental Groups
        * FSGroup - a special supplemental group
        * SELinux options
     * If a pod defines an FSGroup, that Pod’s system (emptyDir, secret, configMap,
etc) volumes and block-device volumes will be owned by the FSGroup, and each
container in the pod will run with the FSGroup as a supplemental group
  * Volumes that support SELinux labelling are now automatically relabeled with the

- For raw block CSI volumes on Kubernetes, kubelet was incorrectly calling CSI `NodeStageVolume` for every single "map" (i.e. raw block "mount") operation for a volume already attached to the node. This change modified that behavior to ensure it is only called once per volume per node. ([#112403](https://github.com/kubern...

zt({isVisible:Boolean(this._config.backdrop),isAnimated:this._isAnimated()})}_initializeFocusTrap(){return new Rt({trapElement:this._element})}_showElement(t){document.body.contains(this._element)||document.body.append(this._element),this._element.style.display="block",this._element.removeAttribute("aria-hidden"),this._element.setAttribute("aria-modal",!0),this._element.setAttribute("role","dialog"),this._element.scrollTop=0;const e=K.findOne(".modal-body",this._dialog);e&&(e.scrollTop=0),g(this._element),this....

    String RESPONSE_INLINE_MIMETYPES = "response.inline.mimetypes";

    /** The key of the configuration. e.g. text/html=X-XSS-Protection: 1; mode=block<br>
     * text/html=Content-Security-Policy: reflected-xss block<br>
     * text/html=X-Frame-Options: SAMEORIGIN<br>
     *  */
    String RESPONSE_HEADERS = "response.headers";

    /** The key of the configuration. e.g. fess.search */

				ctx := logger.SetReqInfo(ctx, reqInfo)
				peersLogOnceIf(ctx, err, client.host.String())
				return nil
			}

			for typ, data := range data {
				// zip writer only handles one concurrent write
				writeMu.Lock()
				profilingDataFound = true
				err := embedFileInZip(zipWriter, fmt.Sprintf("profile-%s-%s", client.host.String(), typ), data, 0o600)
				writeMu.Unlock()
				if err != nil {

- The `baseline` and `restricted` pod security admission levels now block setting the `host` field on probe and lifecycle handlers ([#125271](https://github.com/kubernetes/kubernetes/pull/125271), [@tssurya](https://github.com/tssurya)) [SIG Auth, Node and Testing]