changelog.json

[
  {
    "version": "4.13.6",
    "date": "2026-09-07",
    "summary": "Fixed the company validation workflow blocking any PR that renames or removes a profile",
    "changes": [
      {
        "type": "fixed",
        "description": "The <code>Validate Company Profiles</code> workflow built its file list from <code>gh pr diff --name-only</code>, which reports both the old and new path when a PR renames a company profile. The old path no longer exists in the PR checkout, so validation died with <code>ENOENT</code> and blocked the PR over a file it had legitimately deleted — the same failure hit any PR removing a profile. The workflow now lists changed files through the API and filters out <code>removed</code> entries, so only files actually present get validated."
      }
    ]
  },
  {
    "version": "4.13.5",
    "date": "2026-09-07",
    "summary": "Dependency maintenance — cleared the Dependabot backlog and refreshed in-range minors, dropping the audit count from 9 vulnerabilities to 2",
    "changes": [
      {
        "type": "fixed",
        "description": "Merged 9 outstanding Dependabot PRs: <code>browserslist</code> 4.28.2 → 4.28.9, <code>sanitize-html</code> 2.17.6 → 2.17.7, <code>js-yaml</code> 4.3.0 → 4.3.1, <code>acorn</code> 8.15.0 → 8.18.0, <code>acorn-walk</code> 8.3.4 → 8.3.5, <code>markdown-it-emoji</code> 3.0.0 → 3.1.0, <code>morphdom</code> 2.7.7 → 2.7.8, <code>thenby</code> 1.3.4 → 1.4.1, and <code>postcss-selector-parser</code>. Between them these closed the <code>browserslist</code> and <code>js-yaml</code> high-severity advisories, the <code>sanitize-html</code> stored-XSS advisory, and the <code>postcss-selector-parser</code> AST-recursion DoS."
      },
      {
        "type": "changed",
        "description": "Refreshed the remaining in-range minor and patch updates across the tree, including <code>pagefind</code> 1.4.0 → 1.5.2, <code>tailwindcss</code> 3.4.18 → 3.4.19, <code>autoprefixer</code> 10.4.27 → 10.5.5, <code>postcss</code> 8.5.23 → 8.5.28, <code>cssnano</code> 7.1.2 → 7.1.9, <code>svgo</code> 4.0.2 → 4.1.0, <code>sharp</code> 0.35.3 → 0.35.4, <code>markdown-it</code> 14.2.0 → 14.3.1, <code>dayjs</code> 1.11.19 → 1.11.23, and <code>esbuild</code> 0.28.1 → 0.28.2. The transitive <code>nanoid</code> bump to 5.1.16 also cleared the advisory reaching the WebC plugin chain. Verified the production build, image optimization, favicon generation, and the Pagefind search index after upgrading."
      },
      {
        "type": "changed",
        "description": "The two remaining audit findings (<code>@11ty/eleventy-img</code> and its nested <code>image-size</code>) are held back deliberately — they only clear via a semver-major jump to <code>@11ty/eleventy-img</code> 7.0.0, which is being kept for a separate upgrade."
      }
    ]
  },
  {
    "version": "4.13.4",
    "date": "2026-07-27",
    "summary": "Dependency security update — closed out this week's Dependabot alerts, including a gap in the automated sharp fix",
    "changes": [
      {
        "type": "fixed",
        "description": "Added an npm <code>overrides</code> entry forcing <code>sharp</code> to 0.35.3 across the whole dependency tree. Dependabot's automated PR only bumped the top-level <code>devDependency</code>, leaving <code>@11ty/eleventy-img</code>'s nested <code>sharp@0.33.5</code> unpatched against inherited libvips CVEs (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591). Verified image optimization and favicon generation still work correctly on 0.35.3."
      },
      {
        "type": "fixed",
        "description": "Merged 8 Dependabot security PRs: <code>postcss</code> 8.5.13 → 8.5.23, <code>liquidjs</code> 10.27.0 → 10.27.2, <code>js-yaml</code> 4.2.0 → 4.3.0, <code>linkify-it</code> 5.0.1 → 5.0.2, <code>svgo</code> 4.0.1 → 4.0.2, <code>send</code> 1.2.0 → 1.2.1, <code>dotenv</code> 17.2.3 → 17.4.2, and <code>@11ty/eleventy-plugin-rss</code> 2.0.4 → 3.0.0."
      }
    ]
  },
  {
    "version": "4.13.3",
    "date": "2026-05-30",
    "summary": "Expanded the tech tag vocabulary and fixed the validation workflow for multi-file PRs",
    "changes": [
      {
        "type": "added",
        "description": "Added seven tech tags that contributors commonly want: <code>typescript</code>, <code>react</code>, <code>nodejs</code>, <code>swift</code>, <code>docker</code>, <code>kubernetes</code>, and <code>postgres</code> (PostgreSQL). Tags only appear on the <a href=\"/tags/\">browse pages</a> once a company uses them — adding the labels is a no-op until profiles opt in."
      },
      {
        "type": "changed",
        "description": "Consolidated the validator's enum lists (regions / remote policies / company sizes / technologies) to import from <code>src/_data/labels.js</code>, so future tag changes only need to happen in one place."
      },
      {
        "type": "fixed",
        "description": "Fixed the <code>Validate Company Profiles</code> workflow to handle multi-file PRs. Previously the changed-files list was substituted directly into a bash <code>for</code> loop, which crashed with a syntax error whenever a PR touched more than one company file."
      }
    ]
  },
  {
    "version": "4.13.2",
    "date": "2026-05-30",
    "summary": "Dependency security update — closed the last two open Dependabot alerts (sanitize-html XSS, ws memory disclosure)",
    "changes": [
      {
        "type": "fixed",
        "description": "Bumped <code>sanitize-html</code> 2.17.3 → 2.17.4 to close a critical XSS alert (default config passed <code>&lt;xmp&gt;</code> raw-text content through unsanitised). Only used at build time on company-blurb HTML, but worth closing out."
      },
      {
        "type": "fixed",
        "description": "Added a <code>ws</code> override pulling 8.18.3 → 8.21.0 to close a medium-severity uninitialized-memory-disclosure alert. <code>ws</code> is a transitive dep of <code>@11ty/eleventy-dev-server</code>, only active during <code>npm run start</code>."
      }
    ]
  },
  {
    "version": "4.13.1",
    "date": "2026-05-30",
    "summary": "Dependency security update — patched LiquidJS via npm override",
    "changes": [
      {
        "type": "fixed",
        "description": "Bumped <code>liquidjs</code> 10.25.7 → 10.27.0 via an npm <code>overrides</code> entry to close 6 Dependabot alerts, including a critical RCE and a high-severity ReDoS in the <code>strip_html</code> filter. As before, the affected template-engine features aren't used by this site, but worth closing out."
      }
    ]
  },
  {
    "version": "4.13.0",
    "date": "2026-05-17",
    "summary": "Two new companies — SearchApi and SEO Inc. — plus a round of dependency updates",
    "changes": [
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/searchapi/\">SearchApi</a> — fully-remote, worldwide team building a real-time SERP API for Google, Bing, Baidu, YouTube, Amazon and more"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/seo-inc/\">SEO Inc.</a> — remote-friendly U.S. digital marketing agency focused on SEO, PPC, and AI search optimization"
      },
      {
        "type": "changed",
        "description": "Dependency bumps: esbuild 0.25 → 0.28, colorjs.io 0.5 → 0.6, plus patch updates to @11ty/eleventy-fetch, postcss-colormin, and postcss-normalize-string"
      }
    ]
  },
  {
    "version": "4.12.0",
    "date": "2026-05-07",
    "summary": "New blog post — Anatomy of a Traffic Spike",
    "changes": [
      {
        "type": "added",
        "description": "Blog post: <a href=\"/blog/anatomy-of-a-traffic-spike/\">Anatomy of a Traffic Spike</a> — a walkthrough of the analytics signals that explain the recent China/Baidu traffic to the (now-removed) Yandex profile, and what the data shape was telling us"
      }
    ]
  },
  {
    "version": "4.11.2",
    "date": "2026-05-07",
    "summary": "Removed Yandex — careers site no longer offers meaningful remote roles",
    "changes": [
      {
        "type": "removed",
        "description": "Yandex — <a href=\"https://yandex.com/jobs\">yandex.com/jobs</a> no longer mentions remote work, and filtering vacancies by remote returns only a couple of support-specialist roles. Old URLs now redirect to the <a href=\"/companies/\">companies directory</a>."
      }
    ]
  },
  {
    "version": "4.11.1",
    "date": "2026-05-07",
    "summary": "Dependency security update — patched LiquidJS via Eleventy bump",
    "changes": [
      {
        "type": "fixed",
        "description": "Bumped <code>@11ty/eleventy</code> 3.1.2 → 3.1.5 and refreshed the lockfile, pulling <code>liquidjs</code> 10.25.0 → 10.25.7 to close 5 Dependabot alerts (CVEs against template-engine features that this site does not use, but worth closing out)"
      }
    ]
  },
  {
    "version": "4.11.0",
    "date": "2026-05-07",
    "summary": "New company added — OpenRouter",
    "changes": [
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/openrouter/\">OpenRouter</a>"
      }
    ]
  },
  {
    "version": "4.10.0",
    "date": "2026-05-07",
    "summary": "Featured Companies revamp — fixed set of 8 companies, shuffled per build",
    "changes": [
      {
        "type": "changed",
        "description": "<a href=\"/\">Featured Companies</a> on the homepage now shows a fixed set of 8 companies (always shown, order randomized per build) instead of rotating 8 of 12"
      }
    ]
  },
  {
    "version": "4.9.0",
    "date": "2026-05-02",
    "summary": "Site-wide link rot cleanup — removed compromised profile, fixed 200+ broken or stale URLs (closes #1983)",
    "changes": [
      {
        "type": "removed",
        "description": "Company: Eco-Mind (domain lapsed, now redirects to expireddomains.com)"
      },
      {
        "type": "fixed",
        "description": "Removed 130 broken or dead-end <code>careers_url</code> fields where the site was still live but its careers page had moved or vanished"
      },
      {
        "type": "fixed",
        "description": "Updated 70+ <code>careers_url</code> values that 301'd to a new path on the same domain (e.g. <code>/jobs</code> → <code>/careers</code>, dropped tracking parameters)"
      },
      {
        "type": "fixed",
        "description": "Upgraded 12 <code>website</code> values that redirected from <code>http://</code> to <code>https://</code> or to a renamed canonical path"
      }
    ]
  },
  {
    "version": "4.8.0",
    "date": "2026-05-02",
    "summary": "Fourteen new remote-first tech companies added across AI, devtools, infra, security, and SaaS",
    "changes": [
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/bitwarden/\">Bitwarden</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/cal-com/\">Cal.com</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/chainguard/\">Chainguard</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/hugging-face/\">Hugging Face</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/linear/\">Linear</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/oyster-hr/\">Oyster HR</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/posthog/\">PostHog</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/railway/\">Railway</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/render/\">Render</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/resend/\">Resend</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/revenuecat/\">RevenueCat</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/supabase/\">Supabase</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/tailscale/\">Tailscale</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/temporal/\">Temporal</a>"
      },
      {
        "type": "changed",
        "description": "Refreshed <a href=\"/companies/the-ghost-foundation/\">Ghost</a> profile — updated careers URL, blurb, and team size to current figures"
      }
    ]
  },
  {
    "version": "4.7.1",
    "date": "2026-05-02",
    "summary": "Removed stale Codeship entry (acquired by CloudBees in 2018)",
    "changes": [
      {
        "type": "removed",
        "description": "Codeship — codeship.com is no longer reachable; the company was acquired by <a href=\"/companies/cloudbees/\">CloudBees</a> in 2018. Old URLs now redirect to the CloudBees profile."
      }
    ]
  },
  {
    "version": "4.7.0",
    "date": "2026-05-02",
    "summary": "Ten new companies added from the issue #2040 backlog",
    "changes": [
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/brave/\">Brave</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/cloudbees/\">CloudBees</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/datarobot/\">DataRobot</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/doximity/\">Doximity</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/nozbe/\">Nozbe</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/pluralsight/\">Pluralsight</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/scribd/\">Scribd</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/time-doctor/\">Time Doctor</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/tyk/\">Tyk</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/workos/\">WorkOS</a>"
      }
    ]
  },
  {
    "version": "4.6.0",
    "date": "2026-05-02",
    "summary": "New companies, updated careers link",
    "changes": [
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/phantombuster/\">PhantomBuster</a>"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/lorum/\">Lorum</a>"
      },
      {
        "type": "changed",
        "description": "Updated careers URL for <a href=\"/companies/abiturma/\">abiturma GmbH</a>"
      }
    ]
  },
  {
    "version": "4.5.1",
    "date": "2026-05-02",
    "summary": "Removed dead scaffolding inherited from the upstream Eleventy template",
    "changes": [
      {
        "type": "removed",
        "description": "Unused GitHub API data fetcher (eliminates a network call and rate-limit flake on every build)"
      },
      {
        "type": "removed",
        "description": "Unused YouTube and PeerTube WebC components (custom-youtube, custom-youtube-link, custom-peertube, custom-peertube-link, custom-svg)"
      },
      {
        "type": "removed",
        "description": "Unused dependencies: @11ty/eleventy-fetch, lite-youtube-embed"
      }
    ]
  },
  {
    "version": "4.5.0",
    "date": "2026-03-29",
    "summary": "Carbon Ads integration, new company, dependency updates",
    "changes": [
      {
        "type": "added",
        "description": "Carbon Ads ethical advertising in a sidebar layout (production only)"
      },
      {
        "type": "added",
        "description": "Company: <a href=\"/companies/bigdata-boutique/\">BigData Boutique</a>"
      },
      {
        "type": "fixed",
        "description": "Sticky ad no longer overlays content on mobile viewports"
      },
      {
        "type": "changed",
        "description": "Updated <a href=\"/privacy/\">privacy policy</a> with Carbon Ads disclosure"
      },
      {
        "type": "changed",
        "description": "Bumped dependencies: autoprefixer, flatted, liquidjs, minimatch, picomatch, rimraf, svgo, yaml"
      }
    ]
  },
  {
    "version": "4.4.1",
    "date": "2026-02-22",
    "summary": "Date field documentation",
    "changes": [
      {
        "type": "changed",
        "description": "Updated CLAUDE.md, contributing guide, PR template, and validation workflow to document addedAt/updatedAt fields"
      }
    ]
  },
  {
    "version": "4.4.0",
    "date": "2026-02-22",
    "summary": "Accurate company dates from git history",
    "changes": [
      {
        "type": "changed",
        "description": "Backfilled accurate addedAt/updatedAt dates for all 850+ company profiles from a decade of git history"
      },
      {
        "type": "fixed",
        "description": "Build time reduced from ~29s to ~18s by storing dates in frontmatter instead of computing from git on every build"
      }
    ]
  },
  {
    "version": "4.3.2",
    "date": "2026-02-22",
    "summary": "Fairer homepage rotation",
    "changes": [
      {
        "type": "fixed",
        "description": "Replaced biased shuffle with Fisher-Yates algorithm for featured and recently added companies"
      }
    ]
  },
  {
    "version": "4.3.1",
    "date": "2026-02-22",
    "summary": "Easter egg removal",
    "changes": [
      {
        "type": "removed",
        "description": "Removed easter egg confetti component"
      }
    ]
  },
  {
    "version": "4.3.0",
    "date": "2026-02-22",
    "summary": "Memory leak fix",
    "changes": [
      {
        "type": "fixed",
        "description": "Fixed event listener memory leak in masonry grid web component"
      }
    ]
  },
  {
    "version": "4.2.0",
    "date": "2026-02-15",
    "summary": "Blog post and discoverability improvements",
    "changes": [
      {
        "type": "added",
        "description": "Blog post: Keeping Things Tidy"
      },
      {
        "type": "changed",
        "description": "Improved site discoverability over GitHub repo"
      },
      {
        "type": "changed",
        "description": "Skip PR validation for repo owner, members, and bots"
      }
    ]
  },
  {
    "version": "4.1.2",
    "date": "2026-02-06",
    "summary": "PR validation and housekeeping",
    "changes": [
      {
        "type": "added",
        "description": "Automated PR validation for company profile contributions"
      },
      {
        "type": "removed",
        "description": "Removed defunct companies for various reasons (closed, acquired, no longer relevant, etc.)"
      },
      {
        "type": "fixed",
        "description": "Fixed broken URLs across several company profiles"
      }
    ]
  },
  {
    "version": "4.1.1",
    "date": "2026-01-18",
    "summary": "Search, dates, and social sharing improvements",
    "changes": [
      {
        "type": "added",
        "description": "Pagefind-powered site search with nav dropdown and dedicated search page"
      },
      {
        "type": "added",
        "description": "Git-based dates for company profiles (added at / last updated)"
      },
      {
        "type": "added",
        "description": "Open Graph images for social sharing"
      },
      {
        "type": "changed",
        "description": "Updated company profile frontmatter and documentation"
      }
    ]
  },
  {
    "version": "4.1.0",
    "date": "2026-01-17",
    "summary": "New companies, SEO improvements, and security hardening",
    "changes": [
      {
        "type": "added",
        "description": "Company: MaintainNow"
      },
      {
        "type": "added",
        "description": "Company: Swif.ai"
      },
      {
        "type": "added",
        "description": "Company: Verve Systems"
      },
      {
        "type": "added",
        "description": "Blog post: SEO Improvements"
      },
      {
        "type": "changed",
        "description": "SEO improvements and bulk company URL fixes across all profiles"
      },
      {
        "type": "fixed",
        "description": "Security hardening (CodeQL sanitisation, template escaping)"
      },
      {
        "type": "removed",
        "description": "Cleaned up legacy files and GitHub Actions workflows"
      }
    ]
  },
  {
    "version": "4.0.0",
    "date": "2026-01-13",
    "summary": "Complete site redesign on Eleventy v3",
    "changes": [
      {
        "type": "added",
        "description": "Full site redesign with company cards, browse/filter pages, and curated homepage"
      },
      {
        "type": "added",
        "description": "Structured company profiles with region, remote policy, size, and technology tags"
      },
      {
        "type": "added",
        "description": "Blog post: The Big Redesign"
      },
      {
        "type": "changed",
        "description": "Migrated from static README-based list to Eleventy v3 static site"
      },
      {
        "type": "added",
        "description": "Legacy URL redirects and 404 tracking with Fathom Analytics"
      }
    ]
  }
]