DFE 2.2.2 Richie Benaud

This is DFE 2.2.2 Richie Benaud.

What's Changed

• chore: advance latest -> 2.2.1 by @hypersec-ci-bot[bot] in #889
• docs: drop the unproven-route cautions and the card lead line by @catinspace-au in #890
• fix(deps): update dependency wrangler to v4.153.0 by @renovate[bot] in #885
• docs: state where parsing happens and that raw capture is off by default by @catinspace-au in #888
• fix: refuse mesh, always run source cleanup, pin the acceptance engine checkout by @catinspace-au in #891
• fix(docs-site): HyperI look, hound logo, and a theme switch every surface follows by @catinspace-au in #892
• fix: acceptance leaves no trace, default config carries no test keys, key secrets stay narrow by @catinspace-au in #893
• docs: drop process wording from the MSK verification note by @catinspace-au in #895
• fix(docs-site): unpublish internal pages and 2.2.0 by @catinspace-au in #894
• docs: rewrite the landing page and quickstarts by @catinspace-au in #896
• fix(local): deploy on-prem with no secrets store when the tier needs none by @catinspace-au in #897
• fix(docs-site): order the sidebar by reader journey by @catinspace-au in #898
• docs: rewrite the on-prem and AWS deploy guides for the deployer by @catinspace-au in #899
• fix(docs-site): add a docs voice gate by @catinspace-au in #900
• docs: add the Operate landing and the users and OIDC page by @catinspace-au in #901
• fix: stop telling operators to retire the admin from the setup wizard by @catinspace-au in #902
• docs: take the historical receiver metrics plan off the docs site by @catinspace-au in #903
• fix: run scripts/tests in parallel under pytest-xdist by @catinspace-au in #904
• fix: make the observe step's picker wait injectable by @catinspace-au in #907
• fix: run the clickhouse and argocd tests in CI by @catinspace-au in #908
• fix: read the source suite's reporting verdict after the feed by @catinspace-au in #909
• docs: add an Operate / Sources page for the source catalogue by @catinspace-au in #910
• fix: adopt an operator installed from its upstream manifest by @catinspace-au in #911
• fix: take the CI test pins to their latest by @catinspace-au in #912
• fix: the collector scrapes a managed Kafka over TLS, and kafka.provider names only the broker DFE deploys by @catinspace-au in #915
• fix: watch the pinned signing keys and the gen-8 hold before they bite by @catinspace-au in #916
• fix: dfe-fleet and dfe-suite run in a worktree named anything by @catinspace-au in #917
• fix: bootstrap fails when it cannot patch the Argo webhook secret, and a smoke test proves a push reaches Argo by @catinspace-au in #919
• fix: dfe-ops upgrade apply and rollback can push to the bundled Forgejo deploy repo by @catinspace-au in #920
• fix: the engine may hard-refresh the Argo Applications it changed by @catinspace-au in #923
• fix: the HyperDX auth smoke test signs in to the engine and runs its token round trip by @catinspace-au in #922
• fix: the OTel collector dials ClickHouse over TLS on 9440 and verifies the server by @catinspace-au in #921
• fix: teardown leaves cert-manager and external-secrets that bootstrap adopted by @catinspace-au in #918
• fix: hold the deploy layer to the OTLP endpoint as the only log-format knob by @catinspace-au in #925
• fix: the integration smoke test asserts each deployed DFE service pushes its own metrics by @catinspace-au in #926
• docs: move the deploy-repo, stack versioning and node scaling pages from dfe-docs by @catinspace-au in #927
• fix: give the hunt runner the alert destinations the API writes, and egress to send to them by @catinspace-au in #928
• fix: name the ClickHouse library dfe-clickhouse-rs in the suite by @catinspace-au in #931
• fix: stop an image pin, a namespace label and an acceptance row passing while the deploy is wrong by @catinspace-au in #933
• fix: respell a root page link to the member page each docs build carries by @catinspace-au in #934
• docs: manual document updates -- README hero by @catinspace-au in #935
• fix(aws): retain persistent data and fix Kafka and MSK scaling by @catinspace-au in #936
• fix(security): bump follow-redirects and joi in the docs-site lockfile by @catinspace-au in #939
• fix(aws): tighten cost checks and resource cleanup by @catinspace-au in #942
• fix(otel): read provider logs into the otel database by @catinspace-au in #947
• fix(otel): reject runs when the boundary blocks provider logs by @catinspace-au in #949
• fix(stack): cut 2.2.2-rc.1 from 2.2.1 by @catinspace-au in #950
• fix(stack): pin dfe-deploy v1.0.13 in 2.2.2-rc.1 by @catinspace-au in #974
• fix(dfe-suite): rebuild a producer's consumers concurrently by @catinspace-au in #968
• fix(docs): open the architecture page on what dfe-infra does by @catinspace-au in #970
• fix(stack): name the dfe-deploy step on every cut and gate failure by @catinspace-au in #975
• fix(toolbox): build each toolbox arch on a native runner by @catinspace-au in #976
• fix(upgrade): sync apps skipped by auto-sync after spec changes by @catinspace-au in #977
• fix(aws): write the public zone's delegation into a same-account parent by @catinspace-au in #978
• fix(upgrade): stop on a schema lock whose quorum part is lost and print the DROP by @catinspace-au in #980
• fix(teardown): empty run buckets in parallel before tofu destroy by @catinspace-au in #984
• fix(upgrade): say the schema lock DROP needs an engine at v1.22.85 or later by @catinspace-au in #985
• fix(init): write aws-sm as the secrets backend on an AWS dial by @catinspace-au in #988
• fix(bootstrap): allow blank endpoints for in-cluster deploys by @catinspace-au in #989
• fix(docs-site): docs pins, PR previews and copy in YAML by @catinspace-au in #940
• docs(site): lead with website messaging and add platform history by @catinspace-au in #983
• fix(docs): give every docs section a page at its root by @catinspace-au in #967
• docs(design): document work at the cheapest layer by @catinspace-au in #973
• docs(architecture): explain why the hot path is purpose-built Rust by @catinspace-au in #966
• fix(docs): serve the docs site as markdown an AI agent can read by @catinspace-au in #969
• fix(docs): drop link to unpublished ingest-cost.md by @catinspace-au in #992
• fix(security): move docusaurus-plugin-llms to fixed minimatch and yaml by @catinspace-au in #993
• fix(docs): add page descriptions and JSON-LD by @catinspace-au in #971
• fix(docs): call the search component dfe-hyperdx in the technical docs by @catinspace-au in #991
• fix(acceptance): allow multiple ingest networks by @catinspace-au in #990
• fix(docs): build the Docker quickstart from dfe-docker's release by @catinspace-au in #994
• fix(stack): cut 2.2.2-rc.2 by @catinspace-au in #987
• fix(stack): pin deploy and toolbox versions in 2.2.2-rc.2 by @catinspace-au in #995
• fix(upgrade): rename the dfe-hyperdx overlay and replay an unpushed stage by @catinspace-au in #996
• fix(stack): cut 2.2.2-rc.3 with dfe-ui v1.7.40 and dfe-hyperdx v0.3.22 by @catinspace-au in #997
• fix(keda): end pressure hold when desiredReplicas passes the floor by @catinspace-au in #998
• fix(acceptance): hand the flows suite an in-cluster alert sink by @catinspace-au in #1000
• fix(sweep): check each workflow's newest CI run by @catinspace-au in #953
• fix(fleet): let rebuild-rs take the PR's CI as its gate by @catinspace-au in #954
• fix(stack): cut 2.2.2-rc.4 with secrets-store alert destinations by @catinspace-au in #999
• fix(tofu): move provider config blocks out of versions.tf by @catinspace-au in #1005
• fix(renovate): skip digest refresh on a released stack by @catinspace-au in #1006
• fix(stack): cut 2.2.2 by @catinspace-au in #1009
• chore: advance latest -> 2.2.2 by @hypersec-ci-bot[bot] in #1010
• fix(deps): update github-actions by @renovate[bot] in #959
• fix(deps): update python-dependencies by @renovate[bot] in #963
• fix(deps): update node-dependencies by @renovate[bot] in #961
• fix(deps): update dependency node to v26 by @renovate[bot] in #945
• fix(upgrade): move the stack name when an rc's GA pins nothing new by @catinspace-au in #1011
• fix(docs): say an air-gapped install usually needs services help by @catinspace-au in #1008
• fix(stack): let refresh-digests back off a rate-limited registry by @catinspace-au in #1013
• fix(docs): hide install commands on landing Docker and Demo tabs by @catinspace-au in #1012
• fix(docs): say "Effective from day one" on the landing by @catinspace-au in #1015
• docs(portability): mark swappable components with a "swappable" diagram class by @catinspace-au in #1016
• docs(kafka): rewrite the Redpanda page for an operator by @catinspace-au in #1018
• fix(kafka): label the cluster secret with its Kafka provider by @catinspace-au in #1020
• docs(transforms): add a Splunk transforms teaser by @catinspace-au in #1019
• fix(upgrade): refuse an upgrade path the target stack never tested by @catinspace-au in #1023
• docs(manual): match the pages to 2.2.2 by @catinspace-au in #1026
• fix(docs): build the gate's main baseline at the PR's member commits by @catinspace-au in #1025
• fix(docs): keep four developer pages off the docs site by @catinspace-au in #1028
• fix(ci): pass --next-refs to main's docs build unconditionally by @catinspace-au in #1029
• fix(docs): keep hyperi.io's navy band on the landing hero by @catinspace-au in #1024
• fix(docs): generate the KEDA scaling table from the chart renders by @catinspace-au in #1027
• fix(docs): let the docs gate fail any build on a register word by @catinspace-au in #1017
• fix(docs): upgrades page covers verified paths only by @catinspace-au in #1030
• fix(docs): keep docker-run install lines off the quickstart pages by @catinspace-au in #1031
• docs(msk): drop "genuine" from the operations doc by @catinspace-au in #1034
• fix(docs): use body text colour for mermaid edge labels by @catinspace-au in #1032
• fix(docs): let the docs gate's --fail-on read only the builds named by @catinspace-au in #1033
• fix(docs): keep the fetcher's testing page off the docs site by @catinspace-au in #1035
• fix(docs): shorten demo comment and name the login command by @catinspace-au in #1036
• fix(ci): use the merge commit's first parent as the docs baseline by @catinspace-au in #1037
• fix(docs): show the members' docs fixes on 2.2.2 by @catinspace-au in #1022
• fix(docs): show the KEDA table one row per app by @catinspace-au in #1038
• fix(ci): fail main's docs run on a register word in /next/ or 2.2.2 by @catinspace-au in #1039
• fix(docs): show the per-app KEDA table and vector heading on 2.2.2 by @catinspace-au in #1040
• fix(stack): cut 2.2.2-rc.5 with one shared fetcher on Docker by @catinspace-au in #1041
• fix(stack): cut 2.2.2-rc.6 with the one-line Docker install by @catinspace-au in #1042
• fix(stack): re-cut 2.2.2 on the rc.6 pins by @catinspace-au in #1043

Full Changelog: 2.2.1...2.2.2