Changelog

October 2026

• send the security response headers a meta policy cannot
• generate robots.txt from the site origin instead of a committed copy
• Retire the GitHub Pages deploy workflow (PR 2 of 2)
• Host the site on Netlify (PR 1 of 2)
• stop fabricating cncf.io project URLs for cards without a verified link
• cite open DNS-cutover tracker #1433 and hold inbound-link drafts until cutover
• point DNS-cutover citations at #1433, not the closed ownership issue #46
• render every data/ date in UTC through the shared formatDate
• hold rendered award links to a host allow-list
• retire stale refresh-cadence prose and complete the data model table
• draft inbound-link requests for contribute.cncf.io and cncf.io
• bring adr/ under the markdown gates; repair ADR 0002 link; mark ADR 0004 Accepted (#1461, #1459)
• signpost contribute.cncf.io and cncf.io; tick feedback-loop roadmap item (#1407, #1408)
• add content-issue template and a generated public changelog
• set rel=noreferrer on same-tab off-origin anchors
• document the /events end-user-talks data source in CONTRIBUTING
• correct stale #122 premises in community data validator comments
• keep stale community-groups report when every upstream check fails
• set a same-origin Referrer Policy for the whole document
• add KubeCon NA 2026 end user talks schedule
• streamline architecture layout and add submission skill
• record floor measurements on node 22.23.3
• note CodeQL also analyses Actions workflows
• match the element allowlist case-sensitively and reject string style attributes
• correct harness coverage floors and pin them in the parity test
• pin Features to exact versions and keep them refreshed
• document running the end-to-end suite without root
• hold sources.landscape.collectedAt to the snapshot
• point milestone 9 at a live tracker for the launch post
• fail the audit gate when an allowlisted advisory goes stale
• name manifest-src in the meta CSP so a manifest cannot load off-origin
• write the error report to stderr synchronously
• record that the region union never credits sibling-build guard arms
• replace the dated countdown with an undated readiness checklist
• warn on a symlinked top-level architecture directory instead of dropping it silently
• record the e2e-coverage-report.mjs region ceiling beside the harness floor
• name font-src in the meta CSP so a font cannot load off-origin
• reduce a script-capable image destination to alt text
• reject remote image destinations in imported MDX pages
• treat a slashless http: value as a remote authority
• gate symlinked directories under docs/architectures/
• confine script and style loads to this origin in the meta CSP
• parser-based SVG/MDX scanning, replacing per-bypass regex patches
• Fold zero regions contradicted by a silent artifact of their own script
• document the architecture content-security rules submitters hit in CI
• sync LAUNCH.md verification dates and coverage-gate numbers
• document check:audit gate in CI-failure guidance
• fold e2e regions whose spans cross across artifacts
• detect image-set() and comment-hidden CSS remote references
• reject every markup-bearing data: media type in activeScheme
• demote every host-bearing image reference in cleanMarkdown
• fail the audit gate closed when npm audit never ran
• survive script URLs and map references that defeat percent-decoding
• override shell-quote to the patched 1.11+ line
• refresh stale launch, roadmap and agent-facing statements
• decode CSS escapes before the remote-reference gate
• override tinypool, smol-toml, postcss-selector-parser, katex to patched versions
• refuse to mirror artwork through a symlinked destination
• stop MDX code-span scan at a block boundary
• pin handleFromUrl to the github.com host when indexing cncf/people
• gate mirrored artwork SVGs on findRemoteReferences()
• require https for mirrored cncf/artwork URLs
• scan <style> CSS past a CDATA-hidden </style>
• treat backslash authority prefixes as remote references
• scan multi-line inline code spans in generated MDX
• apply the published http-cache-semantics patch and correct SECURITY.md
• measure and gate e2e region coverage
• make DOCTYPE stripping quote-aware and fail closed
• fail the e2e coverage report when a src file was never measured
• gate the e2e coverage job on a 100% source-line floor
• gate XML processing instructions and mis-decoded encodings in SVGs
• see through internal DTD entities and strip the whole DOCTYPE
• record the two unpatched npm advisories behind the 34 audit findings
• verify the SVG bytes the asset validator's --fix writes
• resolve audit findings in profile links, validator regions, and link-check quoting
• gate and prune .mdx architecture pages, not just .md
• meet WCAG AA contrast for GroupLinkStatus drift warning
• verify SVG bytes after the post-strip cleanup edits
• fix three doc drifts (Justfile section, metrics refresh wording, coverage thresholds)
• stop the TAB roster hover lift from clipping the profile dialog
• pin the artwork URL allow-list to upstream branch refs
• remove unreachable ?? '' fallback in svg-active-content
• remove unreachable merge branch in mdx-escape treeCodeRanges
• guard validate-members landscape reconciliation against null members
• gate the contents of exempted static/ directories
• floor basic-ftp at 6.2.1 to clear GHSA-c475-qrg2-pj4r
• classify MDX code spans with the grammar the site compiles
• strip SVG active content to a fixed point and verify the result
• complete the source-backed End User Directory
• neutralize MDX autolinks and refresh launch evidence
• batch accessibility, members CI, metrics SSR, and lint dependency fixes
• name frame-src, media-src and connect-src in the meta CSP
• bump brace-expansion, markdown-it and fast-uri for DoS advisories
• validate data/members.json logo and URL fields
• scan url() targets in SVG presentation attributes
• take MDX escape code ranges from the parser, not a fence regex

September 2026

• document in-repo reference architecture submission flow
• update launch readiness gate for refresh-community-people
• remove unreachable falsy guard in renderSection
• remove unreachable entity fallback in unescapeMdx
• match the SVG extension case-insensitively in the asset gate
• gate subdirectories of the shallow static/img walk
• escape MDX syntax in reference-architecture submissions
• gate static/ root files through the published-asset security gate
• detect remote SVG subresources loaded via src, link href and bare-string @import
• reject imported architecture ids that claim a repo-authored page
• repair architecture-submission.yml so the architecture-ready label actually triggers it
• enforce regenerate-format-validate-test ordering in automation workflows
• automate reference architecture submission via issue template
• document all five npm run check sub-checks
• document the end-to-end test suite
• document the coverage gate CI actually enforces
• document validate:projects-born
• correct AGENTS.md hosting claim to match README
• fail loudly on an ungated static/ subdirectory
• remove two unreachable defensive sub-expressions
• remove unreachable non-shallow arm from collect-metrics clone()
• [sec-check] fix: confine images to the hosts the import gate allows
• format generated architecture data before opening a PR
• skip refresh-community-people write/PR when nothing changed
• index docs at the route docs are actually served on (#769)
• reject 4-space/tab-indented fence openers as fences (#689)
• gate remote resource references in imported SVG diagrams
• gate every published architecture page, not just cataloged ones
• install from the lockfile on the documented setup path
• consolidated hardening of data validators and URL gates
• bring ROADMAP.md, LAUNCH.md, and resources/index.md current
• Add a minimal Playwright e2e smoke suite against real build output
• Restore JSX/theme component coverage via sourcemap remapping
• report region coverage alongside line coverage
• delete the unreachable github() helper
• close a fence-info-string bypass in blankCodeSpans (#613 follow-up)
• gate every published static SVG for active content
• close active-content sanitizer bypasses (#611, #540)
• word-wrap the title column instead of overflowing
• skip catalog rewrite when reports are unchanged
• fix stale tracking refs in readiness gate table
• close SVG sanitizer bypasses for prefixed elements and srcdoc
• emit project-card JSX attributes as expressions
• [sec-check] fix: reject a symlinked architecture asset root
• use real case study title and sort newest first
• Add description and publish date to case studies table
• resolve baseUrl for internal anchors on resources, practitioners, and events pages
• schedule daily radar reports sync
• remove kicker from compact ProjectsBorn strip
• replace hero image with high quality photo from Flickr
• reject userinfo-disguised https URLs
• add Lint repository CI check step to Making changes
• fix CONTRIBUTING.md Justfile/CI sync claim
• update GOVERNANCE.md pr-queue-hygiene status (closes #555)
• fix stale refresh-metrics.yml row in readiness gate
• normalize character references before the scheme test
• resolve upstream org names without the prototype chain
• lstat-guard the images/ directory root against symlinks
• gate rendered link targets by parsing, not prefix test
• refresh authoring guide, README, SECURITY.md; prune prettierignore
• null-prototype profile bases and radar-reports fallback coverage
• symlink guards for imported assets, extension gate for mirrored artwork
• point deploy SITE_URL at the cncf.github.io origin
• make npm run check pass on a clean checkout and gate lint in CI
• [quality] test: report coverage of fixture-sandbox runs
• stop hot-linking third-party project logos
• [sec-check] fix: reject active content in imported architecture SVGs
• [sec-check] fix: gate imported architecture pages on active MDX content
• rewire check:links off missing Makefile and drop orphan typecheck script
• point robots.txt Sitemap directive at live deploy origin
• update CONTRIBUTING.md just build validator list to match Justfile
• remove stale pdf.yml row from LAUNCH.md launch-readiness gate
• separate role placeholder from company in profile dialog
• name validate:button-contrast command in ui-standards.md
• fix stale scheduled-refresh claim in resources/index.md
• guard array iteration in validators after Array.isArray checks
• gate case-study link targets on a cncf.io host allow-list
• resolve award link targets through the URL parser
• restore clean-checkout npm run check:format (61-file prettier drift)
• document Resources section in README and CONTRIBUTING
• sync README site map with post-restructure Community layout
• clear stale pr-queue-hygiene conflict marker and paginate comments
• pin collect-launch-metrics pagination to the first request's origin
• gate profile image URLs on https and an allowed host
• collapse multi-line JSX <p> elements to prevent invalid nested <p>
• exclude /search and /skills/* from sitemap.xml
• advertise sitemap.xml in robots.txt
• re-fix markdownlint and cspell regressions on main
• correct case-studies/radar-reports refresh claims to manual process
• document data/community-groups.json in contribution table
• fix stale sidebar section enumerations in CONTRIBUTING.md and AGENTS.md
• link AGENTS.md to CONTRIBUTING.md for CI-enforced requirements
• mark completed ROADMAP items as done
• document Justfile shortcuts and align them with CI validation
• only honor pr-queue-hygiene conflict markers from the job's own bot
• restructure Community section to match contribute.cncf.io
• enrich profiles from cncf/people instead of the GitHub API
• pin AwardsTimeline and ReferenceArchitectures dates to UTC
• use fileURLToPath for repo root resolution in scripts
• define launch success metrics baseline + 90-day targets
• add freshness signal for TAB/member data currency
• drop end-user hyphen and clarify private community access
• allowlist mirrored architecture asset file types
• [quality] test: cover scripts/import-architectures.mjs offline

Older changes: see the commit history.