Merge branch 'main' into Stage1_2215_assetintegrationRFC

.backportrc.json

@@ -2,6 +2,7 @@
   "upstream": "elastic/ecs",
   "branches": [
     { "name": "main", "checked": true },
+    "8.11",
     "8.10",
     "8.9",
     "8.8",

.github/workflows/docs-preview-comment.yml

@@ -15,7 +15,7 @@ jobs:
         with:
           script: |
             const pr = context.payload.pull_request;
-            const comment = `Documentation changes preview: https://${context.repo.repo}_${pr.number}.docs-preview.app.elstc.co/diff`;
+            const comment = `Documentation changes preview: https://${context.repo.repo}_bk_${pr.number}.docs-preview.app.elstc.co/diff`;
 
             github.rest.issues.createComment({
               issue_number: context.issue.number,

CHANGELOG.md

@@ -3,6 +3,41 @@
 # CHANGELOG
 All notable changes to this project will be documented in this file based on the [Keep a Changelog](http://keepachangelog.com/) Standard. This project adheres to [Semantic Versioning](http://semver.org/).
 
+## [8.11.0](https://github.com/elastic/ecs/compare/v8.10.0...v8.11.0)
+
+### Schema Changes
+
+#### Bugfixes
+
+* Remove `expected_values` from `threat.*.indicator.name` fields. #2281
+
+### Tooling and Artifact Changes
+
+#### Bugfixes
+
+* Respect reusable.top_level in Beats generator #2278
+
+## [8.10.0](https://github.com/elastic/ecs/compare/v8.9.0...v8.10.0)
+
+### Schema Changes
+
+#### Added
+
+* Added `container.security_context.privileged` to indicated whether a container was started in privileged mode. #2219, #2225, #2246
+* Added `process.thread.capabilities.permitted` to contain the current thread's possible capabilities. #2245
+* Added `process.thread.capabilities.effective` to contain the current thread's effective capabilities. #2245
+
+#### Improvements
+
+* Permit `ignore_above` if explicitly set on a `flattened` field. #2248
+
+### Tooling and Artifact Changes
+
+#### Improvements
+
+* Improved documentation formatting to better follow the contributing guide. #2226
+* Bump `gitpython` dependency from 3.1.30 to 3.1.35 for security fixes. #2251, #2264, #2265
+
 ## [8.9.0](https://github.com/elastic/ecs/compare/v8.8.0...v8.9.0)
 
 ### Schema Changes

CHANGELOG.next.md

@@ -16,6 +16,10 @@ Thanks, you're awesome :-) -->
 
 #### Added
 
+* Added `volume.*` as beta field set. #2269
+* Advanced `process.env_vars` to GA. #2315
+* Advanced `process.io` and `process.tty` fields to GA. #2317
+
 #### Improvements
 
 #### Deprecated
@@ -32,23 +36,6 @@ Thanks, you're awesome :-) -->
 
 #### Deprecated
 
-## 8.10.0 (Feature Freeze)
-
-### Schema Changes
-
-#### Added
-* Added `container.security_context.privileged` to indicated whether a container was started in privileged mode. #2219, #2225, #2246
-* Added `process.thread.capabilities.permitted` to contain the current thread's possible capabilities. #2245
-* Added `process.thread.capabilities.effective` to contain the current thread's effective capabilities. #2245
-
-#### Improvements
-* Permit `ignore_above` if explicitly set on a `flattened` field. #2248
-
-### Tooling and Artifact Changes
-
-#### Improvements
-* Improved documentation formatting to better follow the contributing guide. #2226
-
 <!-- All empty sections:
 
 ## Unreleased

CONTRIBUTING.md

@@ -99,19 +99,10 @@ Please follow these guidelines when submitting Issues:
 
 ## Feature freezes and branching
 
-ECS follows a two-stage feature freeze approach using the concepts of Soft Feature Freezes (SFF) and Hard Feature Freezes (HFF).
+For an upcoming release, ECS uses a feature freeze (FF) approach. A release branch is cut from `main` for an upcoming
+release. When a branch is frozen, changes are limited to bug fixes or doc updates.
 
-Once a branch enters SFF, only minor and low-impact features can be added. The ECS team will rely on the “scope of impact” assessment in the ECS RFC process to help assess the potential impact of a proposed change.
-
-When a branch enters HFF, from that point onward all new features of any size must be contributed to the next ECS version.
-
-For people contributing to the ECS repo, this change means there are two branches at any given time that are accepting at least some sort of feature changes. Here's an example using ECS 8.1:
-
-| Branch | Version | Change scope |
-| ------ | ------- | ------------ |
-| `main`  | 8.2    | Any enhancements or otherwise |
-| `8.1`   | 8.1    | SFF: Can have low impact enhancements |
-| `8.0`   | 8.0    | HFF: Only bug fixes, tooling, docs, etc |
+Any schema changes or tooling updates will be merged into `main` for the next ECS version.
 
 ### Changelogs
 
@@ -222,6 +213,12 @@ The [schemas](schemas) directory contains the files which define the Elastic Com
 
 Users consuming ECS to generate something for other use cases should use the `generated/ecs/*.yml` files. More detail can be found [here](generated/README.md).
 
+### Subset Files
+
+The [schemas/subsets](schemas/subsets/) directory contains the configuration to control advanced field nesting use cases.
+The config is used with the `--subset` option to control which field sets or specific fields appear in the final generated
+artifacts.
+
 ## Additional Resources
 
 * [ECS Guidelines and Best Practices](https://www.elastic.co/guide/en/ecs/current/ecs-guidelines.html)