DFE 2.2.1

What's Changed

• fix: add a read-only sweep of suite findings by @catinspace-au in #551
• fix: align sweep stats and write a report file by @catinspace-au in #552
• fix: key each sweep finding for Slack deltas by @catinspace-au in #553
• fix: read each workflow's runs and pin CI to 3.14 by @catinspace-au in #554
• fix: tear down and reap unattended cloud test runs by @catinspace-au in #555
• fix: hand HyperDX its ClickHouse host as a URL by @catinspace-au in #556
• docs: record the dfe-hyperdx webhook URL guard as not reachable in DFE by @catinspace-au in #557
• fix: add dfe-weave, the chart-switch render diff by @catinspace-au in #559
• fix: add the fleet-wide values for thin charts by @catinspace-au in #561
• fix: add dfe-extras, the DFE-only objects beside each thin chart by @catinspace-au in #562
• fix: run one guarded AWS cycle from a workflow by @catinspace-au in #563
• fix: add dfe-ui and hyperdx thin-chart values by @catinspace-au in #564
• fix: add archiver and transform thin-chart values by @catinspace-au in #565
• fix: add receiver and loader thin-chart values by @catinspace-au in #566
• fix: add dfe-engine thin-chart values by @catinspace-au in #567
• fix: add dfe-fetcher and culvert thin-chart values by @catinspace-au in #568
• fix: four thin-chart values follow-ups by @catinspace-au in #569
• fix: receiver-mode OTLP for dfe-extras workloads by @catinspace-au in #571
• fix: give the elastic GeoIP downloader a writable path by @catinspace-au in #574
• fix: correct the culvert contract fixture by @catinspace-au in #575
• fix: refuse a project name other than dfe in dfe-extras by @catinspace-au in #576
• fix: carry the receiver's file DLQ writable path in its contract fixture by @catinspace-au in #577
• fix: add a preflight-only mode to the cloud cycle workflow by @catinspace-au in #578
• fix: say where the Kafka provider table lives, not that it moved by @catinspace-au in #579
• fix: unblock the first guarded AWS cycle by @catinspace-au in #580
• fix: declare deployment-owned config in apps.yaml by @catinspace-au in #573
• fix: move Helm and Argo CD pins for 2.2.1-rc.1 by @catinspace-au in #558
• fix: deploy layer 2 apps from OCI thin charts by @catinspace-au in #570
• fix: migrate stored overlays to thin-chart keys by @catinspace-au in #572
• fix: move the Session Manager plugin pin to 1.2.889.0 by @catinspace-au in #582
• fix: add the acceptance stage to the cloud cycle by @catinspace-au in #581
• fix: pin dfe-toolbox-base to v1.0.3 and verify the whole toolbox family by @catinspace-au in #583
• fix: preflight ignores resources EC2 has deleted by @catinspace-au in #588
• fix: publish rc and beta stack releases as prereleases by @catinspace-au in #586
• fix: let preflight pass a fresh EKS cluster whose gp3 class bootstrap creates by @catinspace-au in #590
• fix(deps): update github-actions by @renovate[bot] in #524
• fix(upgrade): unblock the in-place move off 2.2.0 by @catinspace-au in #589
• fix: watch the session-manager-plugin and stop empty stack-pin PRs by @catinspace-au in #591
• fix: redact the onboarding report and pass the fence check on a NodePort gateway by @catinspace-au in #592
• fix: run CI's tofu at the versions.yaml pin by @catinspace-au in #593
• fix: let the cycle guard see a deleted network interface as gone by @catinspace-au in #594
• fix: let the cycle guard see deleted volumes and scheduled KMS keys as gone by @catinspace-au in #596
• fix: name a ClickHouse Secret with no password in the upgrade refusal by @catinspace-au in #595
• fix: cut stack 2.2.1-rc.2 by @catinspace-au in #597
• fix: carry a stack pin to dfe-docker once its Stack Release tags it by @catinspace-au in #598
• fix: smoke suite and upgrade apply on thin charts by @catinspace-au in #599
• fix: write fresh pin evidence when a cut moves a git ref by @catinspace-au in #600
• fix: bound the cloud teardown, report unready pods by @catinspace-au in #601
• fix(stack): cut 2.2.1-rc.3 with dfe-engine v1.22.18 and dfe-hyperdx v0.3.3 by @catinspace-au in #602
• fix: mask the AWS account, bound the Argo wait by @catinspace-au in #603
• fix: upgrade apply reads every bootstrap pin, not only the moved ones by @catinspace-au in #605
• fix: upgrade rollout wait, hyperdx, helm values by @catinspace-au in #606
• fix: wire hosted IdPs and sign in through them by @catinspace-au in #608
• fix: wait for Argo to reconcile after a push or retarget by @catinspace-au in #607
• fix: remove the dead chart regeneration from the Rust rebuild by @catinspace-au in #609
• fix: close three gaps in CI triggers, Dex teardown and e2e output by @catinspace-au in #610
• fix(stack): cut 2.2.1-rc.4 with dfe-engine v1.22.19 and dfe-ui v1.7.9 by @catinspace-au in #611
• fix: render each governance action through the thin path and resolve its dials there by @catinspace-au in #612
• fix(stack): cut 2.2.1-rc.5 with dfe-engine v1.22.20, dfe-ui v1.7.10 and dfe-deploy v1.0.8 by @catinspace-au in #613
• fix: count a workload scaled to zero as ready in the readiness gate by @catinspace-au in #614
• fix: sweep members by repo topic, drop non-members by @catinspace-au in #615
• docs: accept the hyperdx api rate-limit gap at the edge by @catinspace-au in #616
• fix: default-deny public web access at an internet-facing edge by @catinspace-au in #604
• fix: align kafka grants and add cycle backend by @catinspace-au in #617
• fix: drop deleted secrets before the reaper destroy by @catinspace-au in #618
• fix: keep an upper bound when the fleet tool moves a scalo floor by @catinspace-au in #619
• fix: expect a zero-role OIDC login to be refused by @catinspace-au in #620
• ci: typecheck and self-test the e2e-ui OIDC harness by @catinspace-au in #621
• docs: an edge-admitted hand member holds its group's roles by @catinspace-au in #624
• fix: skip deleted tagging-API hits in every sweep by @catinspace-au in #625
• fix: judge a run's deleted network pieces gone by @catinspace-au in #626
• fix: read thin charts, write chart-digests on cut by @catinspace-au in #627
• fix: test the thin-chart renders, drop the 2.2.0 upgrade path by @catinspace-au in #628
• fix: remove load balancers before their controller by @catinspace-au in #629
• fix: delete the hand-written app charts by @catinspace-au in #630
• fix: wire exposure.public to the receiver LB by @catinspace-au in #631
• fix: report the core checks on every pull request by @catinspace-au in #632
• fix: close the thin-path render gaps by @catinspace-au in #634
• fix: route latest and propagation through checks by @catinspace-au in #635
• fix: admit every receiver LB port in its policy by @catinspace-au in #637
• fix(stack): cut 2.2.1-rc.6 by @catinspace-au in #638
• fix: fleet waits per member, drop dead helpers by @catinspace-au in #639
• fix: find a console field when its required marker comes first by @catinspace-au in #640
• fix: upgrade wait, telemetry guard, stale comments by @catinspace-au in #641
• fix(deps): update github-actions by @renovate[bot] in #642
• chore: comment the dismissed PASS-line alert by @catinspace-au in #643
• fix(deps): update dependency awslabs/amazon-eks-ami to v20261003 by @renovate[bot] in #525
• fix: move the dfe-toolbox family onto the 2026-10-05 trixie-slim as v1.0.4 by @catinspace-au in #644
• fix: bump the Session Manager plugin pin to 1.2.896.0 and pin dfe-toolbox-base to its v1.0.4 digest by @catinspace-au in #645
• fix: split the gateway fence into exposure groups by @catinspace-au in #647
• fix: take the cloud cycle and reaper workflows out of this repo by @catinspace-au in #636
• fix: the receiver's door follows the ingest group by @catinspace-au in #650
• fix: let a sweep take its members from infra, topics and include only by @catinspace-au in #651
• fix: refuse an ingest CIDR whose prefix length has a leading zero by @catinspace-au in #652
• fix: let the expired sweep remove the untagged groups inside an expired VPC by @catinspace-au in #653
• fix: keep Karpenter until its nodes are gone, and terminate a run's leftovers by @catinspace-au in #654
• fix: let ESO create the internal CA root, and stop failing smoke on its first-run restore by @catinspace-au in #655
• fix: read SecurityPolicy acceptance per ancestor, and require the argocd route only where it renders by @catinspace-au in #656
• fix: issue the cloud flavours' edge wildcard from the internal CA by @catinspace-au in #657
• fix: store the internal CA root as two entries by @catinspace-au in #658
• fix: count a reap as done when the sweep took the last resource by @catinspace-au in #660
• fix: admin-probe fails a dead door it should reach by @catinspace-au in #659
• fix: fail admin-probe from inside selfRanges when the Gateway has no address by @catinspace-au in #661
• fix: let the dfe-services scrape skip charts that push with replica identity by @catinspace-au in #663
• fix: count an instant EC2 fleet as gone once its instances are by @catinspace-au in #664
• fix: count a purged or closed spot request as gone by @catinspace-au in #665
• fix(stack): cut 2.2.1-rc.7 by @catinspace-au in #666
• fix: pick the source's meta schema without a Define Schema radio by @catinspace-au in #667
• fix: name the control in a source-suite step failure and fix the Table Settings doc by @catinspace-au in #668
• fix: sweep a cloud run's own tag after its destroy by @catinspace-au in #669
• fix: read source-suite rows from _json, not _raw by @catinspace-au in #670
• fix: count landed source rows by run marker by @catinspace-au in #672
• fix: stop double-scraping culvert by @catinspace-au in #671
• fix(stack): cut 2.2.1 by @catinspace-au in #673
• chore: advance latest -> 2.2.1 by @hypersec-ci-bot[bot] in #674
• fix: require every expected row to be transformed by @catinspace-au in #675
• fix(stack): withdraw 2.2.1 as GA by @catinspace-au in #677
• fix: carry the broker message size to every app by @catinspace-au in #678
• fix: make the SaaS Kafka bodies deployable from a cloud cycle by @catinspace-au in #679
• fix: pin pytest in the acceptance requirements by @catinspace-au in #680
• fix: server-side Secret writes and anonymous pulls by @catinspace-au in #681
• fix: let Karpenter clean up its launch templates by @catinspace-au in #682
• fix: size the shared pools for a converging deploy by @catinspace-au in #683
• fix: make an external ClickHouse a deployment option end to end by @catinspace-au in #684
• fix: run the create's restart in the source walk by @catinspace-au in #685
• fix: smoke and acceptance on external backends by @catinspace-au in #686
• fix: add the SaaS cloud-cycle backend overlays by @catinspace-au in #688
• fix: add the edge acceptance suite and its cycle stage by @catinspace-au in #687
• fix: keep the ClickHouse password off the smoke suite's argv by @catinspace-au in #689
• fix: refuse cloud runs missing inputs up front by @catinspace-au in #690
• fix: keep the ClickHouse password off the upgrade preflight's argv by @catinspace-au in #691
• fix: stop the sweep reporting Dependabot update runs by @catinspace-au in #692
• fix: dispatch hyperi-ci release, and list the SaaS Kafka keys in the example dial by @catinspace-au in #693
• fix: stop Renovate proposing bumps to a docstring example by @catinspace-au in #694
• docs: record the RUSTSEC-2024-0449 accepted risk by @catinspace-au in #695
• fix: wire the message size to fetcher and archiver by @catinspace-au in #696
• fix: pin EKS add-ons and capture failure evidence by @catinspace-au in #697
• fix: capture pull errors and stuck pods in the failure evidence by @catinspace-au in #698
• fix: build the failure evidence from pod JSON, not kubectl describe by @catinspace-au in #699
• fix(stack): cut 2.2.1-rc.8 by @catinspace-au in #700
• fix: let dfe-stack cut replace a withdrawn stack by @catinspace-au in #701
• fix: stop a 2.2.0 upgrade from silently moving the ingest door by @catinspace-au in #702
• fix: stop a 2.2.0 upgrade from silently closing the web plane on cloud by @catinspace-au in #703
• fix: give over-long per-config apps a bounded Helm release name by @catinspace-au in #704
• fix: bound culvert's Helm release name like the per-config apps by @catinspace-au in #705
• fix(stack): cut 2.2.1-rc.9 by @catinspace-au in #706
• fix: migrate 2.2.0 values to the thin-chart keys before the retarget by @catinspace-au in #707
• fix(stack): cut 2.2.1-rc.10 by @catinspace-au in #711
• fix: render templates without envsubst and retry destroy past leaked ENIs by @catinspace-au in #712
• chore: ignore local agent and tool working files by @catinspace-au in #713
• fix: show sweep times in a configured zone and age every Slack line by @catinspace-au in #714
• fix: suite citations, envsubst leftovers, CI flake by @catinspace-au in #716
• fix: the sweep's backlog never gates by @catinspace-au in #717
• fix: read thin-chart ConfigMaps from binaryData by @catinspace-au in #719
• fix: unblock the edge acceptance rows and teardown by @catinspace-au in #720
• fix: sweep leaked CNI ENIs before the EKS delete by @catinspace-au in #721
• fix: suite lock scan and label-wins backlog drift by @catinspace-au in #722
• fix: stable webhook cert for the AWS LB controller by @catinspace-au in #723
• fix: hold HyperDX until the ClickHouse CA is mounted by @catinspace-au in #724
• fix: declare the logreducer edge to dfe-engine by @catinspace-au in #725
• fix: pin test renders to scalo-service 2.14.13 by @catinspace-au in #726
• fix: search HyperDX with the console's cookie, not a bearer by @catinspace-au in #727
• fix: compare transform file bytes in verify, not only names by @catinspace-au in #715
• fix: let dfe-engine reach a managed Kafka broker by @catinspace-au in #728
• fix(stack): cut 2.2.1-rc.11 by @catinspace-au in #729
• fix: drop ghost security group rules in preflight by @catinspace-au in #731
• fix: capture container logs in failure evidence by @catinspace-au in #730
• fix: capture logs of Running pods that are not Ready by @catinspace-au in #734
• fix: resolve the toolbox shape and each shape's root volume by @catinspace-au in #736
• fix: lock tofu providers, skip the DFE key wait by @catinspace-au in #737
• fix(deps): update dependency iniconfig to v2.3.1 by @renovate[bot] in #708
• fix: refuse managed backends on another cloud by @catinspace-au in #733
• fix: keep every aws secret in Secrets Manager by @catinspace-au in #735
• fix: drop the region and profile defaults from the on-prem tofu by @catinspace-au in #738
• fix: lock aws 6.68.0 and confluent 2.90.0 by @catinspace-au in #739
• fix: skip broker pod checks on a managed Kafka by @catinspace-au in #740
• fix(deps): update actions/create-github-app-token action to v3.3.0 by @catinspace-au in #741
• fix: move every sizing literal in the aws tofu out to tfvars by @catinspace-au in #742
• fix: follow the newest MSK Express generation by @catinspace-au in #743
• fix: find in-cluster Redpanda brokers and share cluster_fact by @catinspace-au in #744
• fix: hold each Karpenter pool to the family the resolver picked by @catinspace-au in #745
• fix: refuse a sizing literal anywhere in the tofu tree by @catinspace-au in #746
• fix(deps): move every workflow to the ubuntu-26.04 runner image by @catinspace-au in #748
• fix: retry a rate limited registry read in the multi-arch gate by @catinspace-au in #747
• fix: reaper fills newly required tfvars on destroy by @catinspace-au in #749
• fix: lay the Gateway API CRDs before cert-manager by @catinspace-au in #750
• fix: add dfe-ops redact and share one bootstrap function helper by @catinspace-au in #751
• fix: pin the AWS node shapes to Graviton4 by @catinspace-au in #752
• fix: carve an EKS cluster's own Service range out of egress by @catinspace-au in #753
• fix: leave the EKS Service range out of the AWS egress carve-out by @catinspace-au in #755
• fix(stack): cut 2.2.1-rc.12 by @catinspace-au in #756
• fix(sizing): cap an instance_types fallback list at the two newest generations by @catinspace-au in #757
• fix(stack): refuse to edit a released stack block by @catinspace-au in #758
• fix(stack): allow the withdrawn-version re-cut and document the freeze by @catinspace-au in #759
• fix(clickhouse): keep the generated admin password immutable by @catinspace-au in #760
• fix(secrets): keep generated passwords immutable and capture ESO evidence by @catinspace-au in #762
• fix(apps): hand the loader its SASL mechanism by @catinspace-au in #763
• fix(smoke): reach ClickHouse Cloud where it runs by @catinspace-au in #764
• fix(confluent): ride out connection resets in the api key wait by @catinspace-au in #765
• fix(stack): cut 2.2.1-rc.13 with engine secrets in AWS Secrets Manager by @catinspace-au in #761
• fix(test): regenerate the engine-store golden after the loader sasl catalogue line by @catinspace-au in #767
• fix: cache proven image verdicts in the arch gate by @catinspace-au in #766
• fix: read the registry with no credential by @catinspace-au in #768
• fix: drop the ghcr login and the credential wording left after public images by @catinspace-au in #770
• fix(confluent): wait for the cluster's REST endpoint to route before keys and topics by @catinspace-au in #769
• fix: pull AWS node images through an ECR cache by @catinspace-au in #754
• fix: sweep a dead run's ECR cache repositories by @catinspace-au in #772
• fix(confluent): probe REST with the manager key by @catinspace-au in #773
• fix: gate releases on the issue label standard by @catinspace-au in #774
• fix: turn the ECR pull-through cache on for AWS by @catinspace-au in #775
• docs: name the ECR template service-linked role by @catinspace-au in #776
• docs: clear doc lint warnings by @catinspace-au in #777
• fix: expire cached ECR images by age pushed by @catinspace-au in #778
• fix: create source topics at three replicas by @catinspace-au in #779
• fix: hand transforms the Kafka SASL mechanism by @catinspace-au in #781
• fix: capture diagnostics before cycle teardown by @catinspace-au in #782
• fix: check every rendered image against the cache by @catinspace-au in #784
• fix: tie the arch and schemas gates to what ships by @catinspace-au in #785
• fix: write the app Kafka keys on Redpanda by @catinspace-au in #787
• fix(security): take CH admin off every app by @catinspace-au in #780
• fix: cut 2.2.1-rc.14 by @catinspace-au in #783
• fix: seed the arch gate with proven public.ecr.aws digests by @catinspace-au in #790
• fix: resolve node images from each provider by @catinspace-au in #789
• fix: give the argocd login test its own kubeconfig by @catinspace-au in #792
• fix: teardown order, drain bound, fence notice by @catinspace-au in #793
• fix: run Keeper embedded in single-mode ClickHouse by @catinspace-au in #791
• fix: close four cloud teardown gaps by @catinspace-au in #795
• fix: prove the loader's own Kafka commit on MSK by @catinspace-au in #796
• fix(security): hold the MSK bootstrap role to the ACL-write grants by @catinspace-au in #797
• fix: give per-config instances their app's egress by @catinspace-au in #798
• fix(security): hold cluster-mode Keeper to read-only four-letter words by @catinspace-au in #799
• fix(deps): update certifi, playwright and pluggy by @catinspace-au in #800
• fix(deps): update dependency ruff to v0.17.1 by @renovate[bot] in #801
• fix(deps): update infra-pins by @renovate[bot] in #802
• fix: skip the Copilot agent workflows in the suite sweep by @catinspace-au in #803
• fix(karpenter): per-reason disruption budgets by @catinspace-au in #805
• fix(pools): golden renders and a selector guard by @catinspace-au in #808
• fix(node-pools): pool classes behind a renderer by @catinspace-au in #811
• fix(keda): scale proof drives every pressure app by @catinspace-au in #809
• fix(diagnostics): log pods a stage removes by @catinspace-au in #812
• fix(node-pools): rename to node-pools, guard prune by @catinspace-au in #813
• fix(otel): pod part-of label on k8s_cluster series by @catinspace-au in #814
• fix: cut 2.2.1-rc.15 by @catinspace-au in #807
• fix: pools guards, teardown order and otel config by @catinspace-au in #815
• fix: cut 2.2.1-rc.16 by @catinspace-au in #816
• fix(diagnostics): keep a passing cycle's pod logs and bundle by @catinspace-au in #817
• fix: add the DFE suite docs site, built from each released stack's pins by @catinspace-au in #818
• docs: fix two anchors in VERIFICATION-TIERS by @catinspace-au in #819
• fix: cut DFE stack 2.2.1-rc.17 by @catinspace-au in #820
• fix(docs-site): move vulnerable npm dependencies to patched releases by @catinspace-au in #821
• fix(security): pin certifi 2026.10.19 in the acceptance requirements for GHSA-6q48-6c7w-9gw2 by @catinspace-au in #822
• fix: run the Kafka CLI from quay.io by @catinspace-au in #788
• fix: drop the discovery family from the engine CLI route by @catinspace-au in #823
• fix: put the AWS ClickHouse cache on its NVMe by @catinspace-au in #827
• fix: move dfe-infra onto the GA.RULES data plane by @catinspace-au in #828
• fix(security): scope FerretDB egress to hyperdx by @catinspace-au in #829
• fix: deploy the data charts at the resolved sizes by @catinspace-au in #830
• docs: record that MSK is not re-tested without approval by @catinspace-au in #832
• fix(engine): hand the receiver its bearer tokens through one Secret off AWS by @catinspace-au in #833
• fix(docs-site): a landing page and the HyperI web style by @catinspace-au in #834
• fix: drop the transform-elastic catalogue mount from the engine by @catinspace-au in #835
• fix: replace FerretDB with the DocumentDB operator by @catinspace-au in #831
• fix: cut 2.2.1-rc.18 with DocumentDB, the catalogue engine and nginx on trixie by @catinspace-au in #824
• fix: drop the catalogue binding from apps.yaml by @kazmosahebi in #836
• fix: render published charts in helm lint by @catinspace-au in #786
• fix: wire the elastic transform onto the direct transport by @catinspace-au in #837
• fix: mount the ClickHouse NVMe cache outside the data volume by @catinspace-au in #838
• fix: let the engine create the managed Kafka topics by @catinspace-au in #839
• fix: seed dfe-transform-vector idle on the docker single by @catinspace-au in #842
• docs: move the Redpanda Cloud template onto the module's provider line by @catinspace-au in #843
• fix: assert the shipper's agent and namespace survive to the stored row by @catinspace-au in #840
• fix: deploy the docs as Worker versions, leave the domain to OpenTofu by @catinspace-au in #845
• fix: auto-resolve worker-node AMIs behind release gates by @catinspace-au in #844
• fix(security): move the docs-site build tree past body-parser, serialize-javascript and undici advisories by @catinspace-au in #847
• fix: measure Karpenter AMI lag against the newest release past the cooldown by @catinspace-au in #849
• fix(deps): update stack pins for the rc.19 candidate by @catinspace-au in #848
• fix(deps): update node-dependencies by @renovate[bot] in #850
• fix(security): update the docs site's undici to 7.30.1 by @catinspace-au in #854
• fix: lint every Dockerfile with hadolint in CI by @catinspace-au in #856
• fix: pin the 2.2.1-rc.19 stack by @catinspace-au in #857
• fix: smoke-test hyperdx's real store login by @catinspace-au in #858
• fix: let hyperdx reach its DocumentDB gateway on EKS by @catinspace-au in #859
• docs: link the open-bugs views from the README by @catinspace-au in #860
• fix: cut the 2.2.1-rc.20 stack with checked toolbox downloads and no FerretDB by @catinspace-au in #861
• fix: cut the 2.2.1-rc.21 stack with engine v1.22.72 and LB controller v3.6.2 by @catinspace-au in #862
• fix(deps): update github-actions by @renovate[bot] in #863
• fix(deps): update python-dependencies by @renovate[bot] in #864
• fix: hold the Compose-idle apps to idle_when, document vector by @catinspace-au in #866
• fix: prove the receiver door in the source suite by @catinspace-au in #867
• fix: cut the 2.2.1-rc.22 stack, the final GA candidate by @catinspace-au in #868
• docs: add release rounds to the validation cycle by @catinspace-au in #869
• docs: add measured proof durations to the validation cycle by @catinspace-au in #871
• docs: say which deployment tiers are proven, and that mesh is not supported in 2.2.1 by @catinspace-au in #876
• chore(deps): hold the docs-site overrides inside their major line by @catinspace-au in #878
• fix(sweep): age a Renovate dashboard entry by its branch, not the dashboard by @catinspace-au in #879
• fix: cap receiver records at 8,000,000 bytes by @catinspace-au in #880
• fix(docs-site): show sending a first event on the Docker quickstart by @catinspace-au in #881
• fix(docs-site): show make demo on the Docker quickstart by @catinspace-au in #882
• fix: cut the 2.2.1-rc.23 stack with agentless elastic, make demo and the 8 MB door by @catinspace-au in #883
• fix(docs-site): say make demo sends over TCP by @catinspace-au in #884
• fix(sweep): retry GitHub error pages and stop gating on pending Renovate checks by @catinspace-au in #886
• fix: cut the 2.2.1 stack from rc.23 for GA by @catinspace-au in #887

New Contributors

• @hypersec-ci-bot[bot] made their first contribution in #674
• @kazmosahebi made their first contribution in #836

Full Changelog: 2.2.0...2.2.1