Changelog

November 2026

• drop unused React import from the swizzled BlogArchivePage
• repair skipped heading levels and retire the heading-order baseline
• Merge pull request #2070 from cncf/quality/a11y-heading-order-gate
• Merge pull request #2071 from mrbobbytables/ci/shorten-critical-path
• Merge pull request #2068 from mrbobbytables/events/kubecon-na-2025-copresented
• Merge pull request #2067 from mrbobbytables/events/kubecon-eu-2025
• Merge pull request #1976 from mrbobbytables/architecture/china-merchants-bank
• publish the singular unit for a one-day median
• add KubeCon + CloudNativeCon North America 2025 end user sessions
• strip the Sched speaker suffix from titles it misses
• centre a single-point metrics series in its plot area
• render concluded conference schedules as the final record
• correct the minimatch footprint and bind the moderate register to the lockfile
• merge the Mercedes Benz AG landscape record into the award winner

October 2026

• floor glob at ^14.0.2 to clear GHSA-3g3m-2fjr-6pw4
• add KubeCon + CloudNativeCon Europe 2026 end user sessions
• drop stray word from the CONTRIBUTING Justfile section
• add KubeCon India 2026 end user sessions from Sched
• widen KubeCon China 2026 sessions to the CNCF End User definition
• add KubeCon + CloudNativeCon Japan 2026 with its end user sessions
• add KubeCon China 2026 and render end user talks per conference
• record GHSA-g3hv-75wg-m249 (minimatch) as an accepted moderate advisory
• add abstracts and slides/recording links to the talk schedule
• publish End User Talk times with the event's UTC offset
• drop events from the sidebar-less sections in CONTRIBUTING style rules
• derive the events section from per-event pages (ADR 0012)
• pin the tag and card sort to English collation
• name bootc, KServe, Litmus, external-secrets and Argo CD as CNCF publishes them
• one label per vertical in the industry and tag filters
• confirm in-range fixes before failing on them
• list the Argo project once in the project filter
• raise the follow-redirects and joi override floors to clear high advisories
• list the finance vertical once in the industry filter
• give the Colopl and ZEISS architectures industry labels
• sort catalog filter options by collation, not code point
• regenerate members.json after the catalog ExternalDNS fix
• qualify AGENTS.md gate claims for the ADR 0011 focused path
• describe the advisory and browser gates as full-validation only
• Merge pull request #2005 from nokia/add-tug-details
• link the CNCF Slack invite from the Research User Group page
• align User Groups sidebar with hub order
• validate committed architecture totals
• add Research User Group
• redirect architecture.cncf.io to the catalogue
• count only published architectures in the submissions series
• list ExternalDNS once in the catalog project filter
• give four reference architecture cards complete, markdown-free summaries
• keep catalog logos readable in dark mode
• Count distinct members and show no-data medians on /resources/metrics
• count each reference architecture once in the submissions timeline
• Fix slack channel for public sector UG
• make architecture page front matter the catalog source
• Sort reference architectures by recently updated by default
• Colocate each reference architecture with its images
• refresh Walmart member profile link
• state the 2 MB member-logo limit and initials fallback
• one spelling per catalog tag
• sum captures per script before converting them
• dates, catalog sort, and tag search chips
• drop stale weekly mutation run reference
• keep committed logo overrides across a metrics refresh
• import SNCF on-premise Kubernetes reference architecture
• show Allianz Direct and Swisscom logos on catalog cards
• refresh Swisscom Kubernetes Service from upstream 8af07d6
• import Capital One OpenTelemetry reference architecture
• refuse oversized member logos at mirror time
• record the overrides floor convention from #1941
• organize user group pages into directories
• make the markdownlint-cli js-yaml override a floor, not an exact pin
• name the daily audit re-check and the audit-fix automation PR
• refresh metrics-lane collectors only on content change
• accept YAML comments in docs/ frontmatter
• say metrics refresh weekly, matching refresh-metrics.yml
• install unreviewed audit-fix versions with --ignore-scripts
• record content-only data refresh as ADR 0009 and align the people freshness validator and wording
• reduce Subaru member logo size
• describe the data-URL half of check:links in CONTRIBUTING
• scan every published page for WCAG violations and repaint code tokens to AA
• check the outbound URLs the site renders from data/
• Run the metrics refresh weekly and include case studies and talks
• Leave UTF-8 encoding labels alone in the SVG mirror
• Normalize Illustrator DTD entities before the SVG mirror gate
• watch the Platform Engineering group upstream in the community status panel
• pin Alolita Sharma's website to the apex host via the curated roster
• refresh the two manually-collected datasets
• drop stray empty bullet from the reproduced ug-governance page
• hide the Edit this page link on the generated changelog
• name the Public Sector User Group's actual Slack channel
• correct Telecom User Group Slack channel and note meeting hiatus
• alt text for architecture diagrams, dedupe Flipkart lead-in, gate MD045 in the validator
• [quality] show the full TAB roster on the community page
• align homepage End User Group list with the site catalog
• open ProjectsBorn tiles in a new tab with noreferrer
• index the User Groups hub under its real title in site search
• raise serialize-javascript override floor and pin fast-uri
• pin body-parser and undici to clear high advisories
• Remove the launch success-metrics collector and its 90-day check-in
• Generate trailing-slash URLs so canonical and sitemap name the served page
• Remove agent work feeds and check agent PRs for a Remit line
• correct the full mutation-run duration in CONTRIBUTING.md
• refresh post-cutover metrics baseline
• tally landscape category and maturity counts on null-prototype objects
• bump ip-address to 10.7.4 to clear ReDoS advisory GHSA-rxp7-6hxx-x8q5
• Add ADR 0008: scope agent findings to user-observable change
• Remove roadmap and milestones planning documents
• record the DNS cutover to endusers.cncf.io as complete
• retire LAUNCH.md
• link milestone 11 to the blog review tracker
• run validate:end-user-talks in the just build recipe
• retry and bound the npm audit call behind check:audit
• keep the GitHub token off curl argv in the gh fallback
• point platform-engineering group links at the group's real homes
• preserve build, browser capture, and reporter coverage provenance
• gate Stryker break threshold to the pull_request lane
• scan the admonition preprocessor rewrite in the publish-time MDX gate
• scan the unwrapped form in the publish-time MDX active-content gate
• switch SVG and MDX active-content gates to allowlists
• send a complete CSP and Permissions-Policy on every page
• scope end-to-end coverage findings to user-reachable states
• correct the Justfile recipes' superset claim for the Netlify build
• treat mdx-code-block fences as active content in both MDX gates
• fall back to curl-based REST in pr-queue-hygiene when gh is absent
• gate form submission targets in SVGs and deny form-action on assets
• bump follow-redirects to 1.16.1 and launch-editor to 2.14.2 (lockfile only)
• record validate:end-user-talks in CONTRIBUTING data model
• deny unnamed fetch directives in the asset-scoped CSP
• resolve duplicate link definitions first-wins in the MDX gate
• build the initials() monogram by code point, not UTF-16 code unit
• route MetricsDashboard generatedAt through the shared formatDate guard
• refresh community group status only when content changes
• name composite actions in SECURITY.md's CodeQL scan scope
• narrow test-only merge class and agent remit per ADR 0006
• trim names in initials() so padded names keep a two-letter monogram
• member card trigger accessible name conforms to WCAG 2.5.3
• retire line-number citations in test prose and narrow test-only agent work
• render the end-user-talk slot timezone from the data file
• use camelCase SVG attributes in the footer icons
• cover .github/actions in the Dependabot github-actions entry
• mark milestone 10 Done, re-verified 2026-10-16 gate
• correct metrics page route in data model table
• point stale /awards references at /community/awards
• add TAB roster section and link Get involved to community page
• mark milestone 9 Done and cite how #1313 closed
• carry forward last-known group status on inconclusive link recheck
• Move Metrics under Resources
• deduplicate member sourceAttribution URLs
• name the Refresh metrics workflow on the metrics page
• send Strict-Transport-Security on every response
• Restructure the community landing page
• fix retired recipe and job names in Justfile section
• Restructure community navigation
• Remove the cncf/architecture content sync job
• drop stale GH-Pages-era changelog fallback caveat from ROADMAP.md
• reject calendar-impossible ISO timestamps in checkIsoTimestamp
• Move submission guidance to its own architectures page
• fail check:audit when an allowlisted advisory becomes fixable
• re-scan the SVG stripActiveContent returns
• correct hive App name and note closed #120 in App permission-gap section
• cite the real blocker for the inbound-link cross-linking row
• deny script and object on directly-opened asset responses
• name the Netlify build as the deploy lane
• send the security response headers a meta policy cannot
• generate robots.txt from the site origin instead of a committed copy
• Retire the GitHub Pages deploy workflow (PR 2 of 2)
• Host the site on Netlify (PR 1 of 2)
• stop fabricating cncf.io project URLs for cards without a verified link
• cite open DNS-cutover tracker #1433 and hold inbound-link drafts until cutover
• point DNS-cutover citations at #1433, not the closed ownership issue #46
• render every data/ date in UTC through the shared formatDate
• hold rendered award links to a host allow-list
• retire stale refresh-cadence prose and complete the data model table
• draft inbound-link requests for contribute.cncf.io and cncf.io
• bring adr/ under the markdown gates; repair ADR 0002 link; mark ADR 0004 Accepted (#1461, #1459)
• signpost contribute.cncf.io and cncf.io; tick feedback-loop roadmap item (#1407, #1408)
• add content-issue template and a generated public changelog
• set rel=noreferrer on same-tab off-origin anchors
• document the /events end-user-talks data source in CONTRIBUTING
• correct stale #122 premises in community data validator comments
• keep stale community-groups report when every upstream check fails
• set a same-origin Referrer Policy for the whole document
• add KubeCon NA 2026 end user talks schedule
• streamline architecture layout and add submission skill
• record floor measurements on node 22.23.3
• note CodeQL also analyses Actions workflows
• match the element allowlist case-sensitively and reject string style attributes
• correct harness coverage floors and pin them in the parity test
• pin Features to exact versions and keep them refreshed
• document running the end-to-end suite without root
• hold sources.landscape.collectedAt to the snapshot
• point milestone 9 at a live tracker for the launch post
• fail the audit gate when an allowlisted advisory goes stale
• name manifest-src in the meta CSP so a manifest cannot load off-origin
• write the error report to stderr synchronously
• record that the region union never credits sibling-build guard arms
• replace the dated countdown with an undated readiness checklist
• warn on a symlinked top-level architecture directory instead of dropping it silently
• record the e2e-coverage-report.mjs region ceiling beside the harness floor
• name font-src in the meta CSP so a font cannot load off-origin
• reduce a script-capable image destination to alt text
• reject remote image destinations in imported MDX pages

Older changes: see the commit history.