* kubectl: Fix bug that showed terminated/evicted pods even without `--show-all`. ([#48786](https://github.com/kubernetes/kubernetes/pull/48786), [@janetkuo](https://github.com/janetkuo))
* Never prevent deletion of resources as part of namespace lifecycle ([#48733](https://github.com/kubernetes/kubernetes/pull/48733), [@liggitt](https://github.com/liggitt))

    public static final String LABELS_LANG = "{labels.lang}";

    /** The key of the message: Outputs */
    public static final String LABELS_OUTPUTS = "{labels.outputs}";

    /** The key of the message: Part-of-speech */
    public static final String LABELS_POS = "{labels.pos}";

    /** The key of the message: Delete old job logs */
    public static final String LABELS_PURGE_JOB_LOG_DAY = "{labels.purgeJobLogDay}";

- In order to enable dual-stack support within kubeadm and kubernetes components, as part of the init config file, the user should set feature-gate `IPv6DualStack=true` in the ClusterConfiguration. Additionally, for each worker node, the user should set the feature-gate for kubelet using either `nodeRegistration.kubeletExtraArgs` or `KUBELET_EXTRA_ARGS`....

        </field>
        <field xdoc.separator="blank">
          <name>subprojects</name>
          <version>4.1.0+</version>
          <description>The subprojects (formerly called modules) to build as a part of this
            project. Each subproject listed is a relative path to the directory containing the subproject.
            To be consistent with the way default URLs are calculated from parent, it is recommended

          val result = queueDispatcher.dispatch(request)
          requestCount++
          if (requestCount == 1) {
            // Before handling call1's CONNECT we do all of call2. This part re-entrant!
            try {
              val call2 =
                client.newCall(
                  Request
                    .Builder()
                    .url("https://android.com/call2")

**Fixed Versions**:
  - kube-apiserver v1.25.4
  - kube-apiserver v1.24.8
  - kube-apiserver v1.23.14
  - kube-apiserver v1.22.16

This vulnerability was reported by Richard Turnbull of NCC Group as part of the Kubernetes Audit


**CVSS Rating:** Medium (6.5) [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

		b.WriteString("abc")
		tw.check(t, "", "")
		b.WriteString("123456789012345")      // long string, non-empty buffer
		tw.check(t, "abc12345", "6789012345") // use Write and then WriteString since the remaining part is still longer than BufSize
	}
	{
		tw := &teststringwriter{}
		b := NewWriterSize(tw, BufSize)
		b.Write([]byte("abc")) // same as above, but use Write instead of WriteString
		tw.check(t, "", "")

## Urgent Upgrade Notes
### (No, really, you MUST read this before you upgrade)
#### Cluster Lifecycle
- Kubeadm: add a new `kubelet-finalize` phase as part of the `init` workflow and an experimental sub-phase to enable automatic kubelet client certificate rotation on primary control-plane nodes.

* Introducing ScheduledJobs as described in [the proposal](docs/proposals/scheduledjob.md) as part of `batch/v2alpha1` version (experimental feature). ([#24970](https://github.com/kubernetes/kubernetes/pull/24970), [@soltysh](https://github.com/soltysh))

- The `system:aws-cloud-provider` cluster role, deprecated in v1.13, is no longer auto-created. Deployments using the AWS cloud provider should grant required permissions to the `aws-cloud-provider` service account in the `kube-system` namespace as part of deployment.  ([#66635](https://github.com/kubernetes/kubernetes/pull/66635), [@wgliang](https://github.com/wgliang))

#### Azure