Changelog

What changed and when. Currently on v4.14.1.

Versioning: company additions and blog posts bump the minor version, edits and fixes bump the patch.

v4.14.1

Refreshed the contributor guidelines so all three copies match the validator

  • fixed The technology tag list was stale in all three contributor docs — the site's contributing page, CONTRIBUTING.md and .github/CONTRIBUTING.md — missing typescript, react, nodejs, swift, docker, kubernetes and postgres, which have been valid since v4.13.3. All three now match src/_data/labels.js, the source of truth the validator reads
  • fixed .github/CONTRIBUTING.md listed seven required Markdown sections when the validator only requires three (Company blurb, Remote status, How to apply). The other four are now correctly marked optional
  • added Eligibility criteria now appear in the guidelines themselves, not just the pull request template — what belongs in the directory, and what maintainers will reject. Adds a note that careers_url must point at a company's own careers page rather than a page selling its services
  • changed Company size values in CONTRIBUTING.md now show their employee ranges, matching the labels used on the site

v4.14.0

Two new companies — First Point and Meduzzen — plus the Redlio Designs rebrand to Redlio Labs

  • added Company: First Point — fully-remote product studio building consumer iOS and Android apps, AI agent tooling and blockchain infrastructure
  • added Company: Meduzzen — Ukrainian AI and machine learning development company, fully remote with EU timezone coverage
  • changed Company: Redlio Designs has rebranded to Redlio Labs. Profile refreshed by the company — new domain, working careers link (the old /career path 404s), current service list and expanded tech tags. The old profile URLs now redirect to the new one

v4.13.6

Fixed the company validation workflow blocking any PR that renames or removes a profile

  • fixed The Validate Company Profiles workflow built its file list from gh pr diff --name-only, which reports both the old and new path when a PR renames a company profile. The old path no longer exists in the PR checkout, so validation died with ENOENT and blocked the PR over a file it had legitimately deleted — the same failure hit any PR removing a profile. The workflow now lists changed files through the API and filters out removed entries, so only files actually present get validated.

v4.13.5

Dependency maintenance — cleared the Dependabot backlog and refreshed in-range minors, dropping the audit count from 9 vulnerabilities to 2

  • fixed Merged 9 outstanding Dependabot PRs: browserslist 4.28.2 → 4.28.9, sanitize-html 2.17.6 → 2.17.7, js-yaml 4.3.0 → 4.3.1, acorn 8.15.0 → 8.18.0, acorn-walk 8.3.4 → 8.3.5, markdown-it-emoji 3.0.0 → 3.1.0, morphdom 2.7.7 → 2.7.8, thenby 1.3.4 → 1.4.1, and postcss-selector-parser. Between them these closed the browserslist and js-yaml high-severity advisories, the sanitize-html stored-XSS advisory, and the postcss-selector-parser AST-recursion DoS.
  • changed Refreshed the remaining in-range minor and patch updates across the tree, including pagefind 1.4.0 → 1.5.2, tailwindcss 3.4.18 → 3.4.19, autoprefixer 10.4.27 → 10.5.5, postcss 8.5.23 → 8.5.28, cssnano 7.1.2 → 7.1.9, svgo 4.0.2 → 4.1.0, sharp 0.35.3 → 0.35.4, markdown-it 14.2.0 → 14.3.1, dayjs 1.11.19 → 1.11.23, and esbuild 0.28.1 → 0.28.2. The transitive nanoid bump to 5.1.16 also cleared the advisory reaching the WebC plugin chain. Verified the production build, image optimization, favicon generation, and the Pagefind search index after upgrading.
  • changed The two remaining audit findings (@11ty/eleventy-img and its nested image-size) are held back deliberately — they only clear via a semver-major jump to @11ty/eleventy-img 7.0.0, which is being kept for a separate upgrade.

v4.13.4

Dependency security update — closed out this week's Dependabot alerts, including a gap in the automated sharp fix

  • fixed Added an npm overrides entry forcing sharp to 0.35.3 across the whole dependency tree. Dependabot's automated PR only bumped the top-level devDependency, leaving @11ty/eleventy-img's nested sharp@0.33.5 unpatched against inherited libvips CVEs (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591). Verified image optimization and favicon generation still work correctly on 0.35.3.
  • fixed Merged 8 Dependabot security PRs: postcss 8.5.13 → 8.5.23, liquidjs 10.27.0 → 10.27.2, js-yaml 4.2.0 → 4.3.0, linkify-it 5.0.1 → 5.0.2, svgo 4.0.1 → 4.0.2, send 1.2.0 → 1.2.1, dotenv 17.2.3 → 17.4.2, and @11ty/eleventy-plugin-rss 2.0.4 → 3.0.0.

v4.13.3

Expanded the tech tag vocabulary and fixed the validation workflow for multi-file PRs

  • added Added seven tech tags that contributors commonly want: typescript, react, nodejs, swift, docker, kubernetes, and postgres (PostgreSQL). Tags only appear on the browse pages once a company uses them — adding the labels is a no-op until profiles opt in.
  • changed Consolidated the validator's enum lists (regions / remote policies / company sizes / technologies) to import from src/_data/labels.js, so future tag changes only need to happen in one place.
  • fixed Fixed the Validate Company Profiles workflow to handle multi-file PRs. Previously the changed-files list was substituted directly into a bash for loop, which crashed with a syntax error whenever a PR touched more than one company file.

v4.13.2

Dependency security update — closed the last two open Dependabot alerts (sanitize-html XSS, ws memory disclosure)

  • fixed Bumped sanitize-html 2.17.3 → 2.17.4 to close a critical XSS alert (default config passed <xmp> raw-text content through unsanitised). Only used at build time on company-blurb HTML, but worth closing out.
  • fixed Added a ws override pulling 8.18.3 → 8.21.0 to close a medium-severity uninitialized-memory-disclosure alert. ws is a transitive dep of @11ty/eleventy-dev-server, only active during npm run start.

v4.13.1

Dependency security update — patched LiquidJS via npm override

  • fixed Bumped liquidjs 10.25.7 → 10.27.0 via an npm overrides entry to close 6 Dependabot alerts, including a critical RCE and a high-severity ReDoS in the strip_html filter. As before, the affected template-engine features aren't used by this site, but worth closing out.

v4.13.0

Two new companies — SearchApi and SEO Inc. — plus a round of dependency updates

  • added Company: SearchApi — fully-remote, worldwide team building a real-time SERP API for Google, Bing, Baidu, YouTube, Amazon and more
  • added Company: SEO Inc. — remote-friendly U.S. digital marketing agency focused on SEO, PPC, and AI search optimization
  • changed Dependency bumps: esbuild 0.25 → 0.28, colorjs.io 0.5 → 0.6, plus patch updates to @11ty/eleventy-fetch, postcss-colormin, and postcss-normalize-string

v4.12.0

New blog post — Anatomy of a Traffic Spike

  • added Blog post: Anatomy of a Traffic Spike — a walkthrough of the analytics signals that explain the recent China/Baidu traffic to the (now-removed) Yandex profile, and what the data shape was telling us

v4.11.2

Removed Yandex — careers site no longer offers meaningful remote roles

  • removed Yandex — yandex.com/jobs no longer mentions remote work, and filtering vacancies by remote returns only a couple of support-specialist roles. Old URLs now redirect to the companies directory.

v4.11.1

Dependency security update — patched LiquidJS via Eleventy bump

  • fixed Bumped @11ty/eleventy 3.1.2 → 3.1.5 and refreshed the lockfile, pulling liquidjs 10.25.0 → 10.25.7 to close 5 Dependabot alerts (CVEs against template-engine features that this site does not use, but worth closing out)

v4.11.0

New company added — OpenRouter

v4.10.0

Featured Companies revamp — fixed set of 8 companies, shuffled per build

  • changed Featured Companies on the homepage now shows a fixed set of 8 companies (always shown, order randomized per build) instead of rotating 8 of 12

v4.9.0

Site-wide link rot cleanup — removed compromised profile, fixed 200+ broken or stale URLs (closes #1983)

  • removed Company: Eco-Mind (domain lapsed, now redirects to expireddomains.com)
  • fixed Removed 130 broken or dead-end careers_url fields where the site was still live but its careers page had moved or vanished
  • fixed Updated 70+ careers_url values that 301'd to a new path on the same domain (e.g. /jobs → /careers, dropped tracking parameters)
  • fixed Upgraded 12 website values that redirected from http:// to https:// or to a renamed canonical path

v4.8.0

Fourteen new remote-first tech companies added across AI, devtools, infra, security, and SaaS

v4.7.1

Removed stale Codeship entry (acquired by CloudBees in 2018)

  • removed Codeship — codeship.com is no longer reachable; the company was acquired by CloudBees in 2018. Old URLs now redirect to the CloudBees profile.

v4.5.1

Removed dead scaffolding inherited from the upstream Eleventy template

  • removed Unused GitHub API data fetcher (eliminates a network call and rate-limit flake on every build)
  • removed Unused YouTube and PeerTube WebC components (custom-youtube, custom-youtube-link, custom-peertube, custom-peertube-link, custom-svg)
  • removed Unused dependencies: @11ty/eleventy-fetch, lite-youtube-embed

v4.5.0

Carbon Ads integration, new company, dependency updates

  • added Carbon Ads ethical advertising in a sidebar layout (production only)
  • added Company: BigData Boutique
  • fixed Sticky ad no longer overlays content on mobile viewports
  • changed Updated privacy policy with Carbon Ads disclosure
  • changed Bumped dependencies: autoprefixer, flatted, liquidjs, minimatch, picomatch, rimraf, svgo, yaml

v4.4.1

Date field documentation

  • changed Updated CLAUDE.md, contributing guide, PR template, and validation workflow to document addedAt/updatedAt fields

v4.4.0

Accurate company dates from git history

  • changed Backfilled accurate addedAt/updatedAt dates for all 850+ company profiles from a decade of git history
  • fixed Build time reduced from ~29s to ~18s by storing dates in frontmatter instead of computing from git on every build

v4.3.2

Fairer homepage rotation

  • fixed Replaced biased shuffle with Fisher-Yates algorithm for featured and recently added companies

v4.3.1

Easter egg removal

  • removed Removed easter egg confetti component

v4.3.0

Memory leak fix

  • fixed Fixed event listener memory leak in masonry grid web component

v4.2.0

Blog post and discoverability improvements

  • added Blog post: Keeping Things Tidy
  • changed Improved site discoverability over GitHub repo
  • changed Skip PR validation for repo owner, members, and bots

v4.1.2

PR validation and housekeeping

  • added Automated PR validation for company profile contributions
  • removed Removed defunct companies for various reasons (closed, acquired, no longer relevant, etc.)
  • fixed Fixed broken URLs across several company profiles

v4.1.1

Search, dates, and social sharing improvements

  • added Pagefind-powered site search with nav dropdown and dedicated search page
  • added Git-based dates for company profiles (added at / last updated)
  • added Open Graph images for social sharing
  • changed Updated company profile frontmatter and documentation

v4.1.0

New companies, SEO improvements, and security hardening

  • added Company: MaintainNow
  • added Company: Swif.ai
  • added Company: Verve Systems
  • added Blog post: SEO Improvements
  • changed SEO improvements and bulk company URL fixes across all profiles
  • fixed Security hardening (CodeQL sanitisation, template escaping)
  • removed Cleaned up legacy files and GitHub Actions workflows

v4.0.0

Complete site redesign on Eleventy v3

  • added Full site redesign with company cards, browse/filter pages, and curated homepage
  • added Structured company profiles with region, remote policy, size, and technology tags
  • added Blog post: The Big Redesign
  • changed Migrated from static README-based list to Eleventy v3 static site
  • added Legacy URL redirects and 404 tracking with Fathom Analytics