Changelog

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

v0.45.2

Released on 2026-10-29

Minor Changes

• update(cmake): bump bundled OpenSSL to 3.5.9 LTS, adopting TLS security level 2 (RSA/DSA/DH keys must be at least 2048 bits and EC keys at least 224 bits) [#4053] - @leogr

Bug Fixes

• fix(packaging): refresh image CA trust stores for the eMudhra incident, retain the Buster loader with corrected trust, and bundle container plugin 0.7.6 and falcoctl 0.14.3 [#4051] - @leogr

Non user-facing changes

• fix(ci): combine image indexes with buildx imagetools [#4054] - @leogr

Statistics

Release Manager @leogr

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

v0.45.1

Released on 2026-10-19

Bug Fixes

• fix(packaging): the deb and rpm packages no longer stay half-configured on kernels that cannot run modern eBPF (for example Ubuntu 20.04 with kernel 5.4) [#4037] - @ManuelFCastillo
• fix(userspace/falco): file_output with keep_alive: true no longer stops writing after a failed write (e.g. a full filesystem); the failure is logged and the file is reopened on the next alert [#4036] - @cristianchiriac
• fix(metrics): prevent a race that could crash Falco when Prometheus metrics are scraped while events are being processed [#4022] - @Rayan-and-beyond
• fix(deps): update libs to 0.26.1 and driver to 11.0.1+driver [#4032] - @leogr
• fix(chart): update the default container plugin to 0.7.5. [#4027] - @leogr
• fix(build): update the bundled container plugin to 0.7.5, including the listener shutdown fix for reloads [#4024] - @leogr
• fix(userspace): avoid exiting when files in watched directories disappear during reload setup [#4018] - @c2ndev

Non user-facing changes

• chore(build): pin libs and driver release candidates [#4026] - @leogr

Statistics

Release Manager @leogr

Download

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

v0.45.0

Released on 2026-09-21

Breaking Changes :warning:

• feat(userspace)!: evaluate rule conditions on raw field bytes (invalid and non-printable UTF-8 sequences are now matchable with string operators, single bytes with the new \xHH escape sequence), let regex operate on sanitized input, and escape non-printable characters / replace invalid UTF-8 sequences at output encoding time; FALCO_ENGINE_VERSION bumped from 0.62.0 to 0.63.0; rules that matched the replacement character with non-regex operators must be reviewed [#3942] - @ekoops

Major Changes

• new(chart): add serviceAccount.labels to set custom labels on the ServiceAccount [#3946] - @Goutham-Annem
• feat(falco): Expose reload status through GET /reload and add optional reload control over a protected Unix socket on Linux. Preserve SIGHUP reception and pending requests across reloads. [#4005] - @c2ndev
• feat(userspace/falco): suggest --dry-run when --validate receives a Falco configuration file [#3947] - @AkashKumar7902

Minor Changes

• update(build): bump falcoctl to 0.14.2 [#3996] - @leogr
• update(chart): bump the falcosidekick subchart constraint to 0.14.* and the falco-talon subchart constraint to 0.4.* [#3990] - @leogr
• chore(userspace/falco): drop the container_engines leftovers from the configuration JSON schema; configurations still setting this key now log a schema validation warning at startup [#3924] - @ekoops

Bug Fixes

• fix(falco): no unsupported syscalls warning is printed anymore when replaying a capture [#4003] - @leogr
• fix(falco): the unsupported syscalls warning now points to base_syscalls.all instead of the removed -A flag [#4001] - @leogr
• fix(packaging): restore Falco services and persistent kernel modules after upgrades, migrate package-default driver pins, and clean up package-created systemd state on removal [#3994] - @leogr
• fix(chart): always mount an emptyDir at /etc/falco/config.d, and bump the default falcoctl image to 0.14.1, the container plugin to 0.7.4, and the k8smeta plugin to 0.4.2 [#3984] - @leogr
• fix(chart): mount the container engine socket directories instead of the socket files, so Falco keeps working after a container runtime restart [#3978] - @leogr
• fix(chart): support DaemonSet revision history limits and honor an explicit zero for both DaemonSet and Deployment controllers. [#3931] - @Goutham-Annem
• fix(chart): do not render the falcoctl config volume when falcoctl artifact install and follow are disabled [#3894] - @immanuwell
• fix(engine): falco --list no longer incorrectly labels the evt field class with a specific event source [#3936] - @Wahid7852
• fix(cmake): add support for 64K kernel page to jemalloc on aarch64 [#3970] - @lekanjava
• fix(userspace): open the pidfile with O_NOFOLLOW to prevent a symlink TOCTOU when the pidfile path is in an attacker-writable directory. The pidfile content now ends with a trailing newline [#3871] - @alexmchughdev
• fix(chart): correct the inverted priority level mappings in the Grafana dashboard, so severity labels match Falco's numeric priorities (0=emergency ... 7=debug) [#3932] - @Goutham-Annem
• fix(engine): correctly match wildcard patterns when the literal segment that follows a * appears more than once in the input (e.g. *.yaml against backup.yaml.yaml, or wildcard enable/disable of rule names whose names repeat a literal segment). [#3913] - @tejgokani
• fix(userspace/falco): use the absolute modprobe path instead of a PATH lookup when falling back to loading the kernel module (untrusted search path, CWE-426) [#3943] - @BoxStrikesTeam
• fix: serve SIGHUP-triggered hot restart when watch_config_files is disabled [#3939] - @c2ndev
• fix(engine): do not emit the LOAD_NO_EVTTYPE warning for rules with statically unsatisfiable conditions (e.g. the never_true placeholder idiom) [#3918] - @leogr

Non user-facing changes

• test(engine): add unit tests for multi-value transformer AST visitors [#3860] - @therealbobo
• Update owner from andreagit97 to andreaterzolo [#3965] - @andreaterzolo
• refactor: rename is_capture_mode [#4006] - @sgaist
• ci(release): use a rn2md build that accepts the new GitHub token format [#3997] - @leogr
• chore(cmake): bump libs to 0.26.0 and drivers to 11.0.0+driver [#3992] - @github-actions[bot]
• chore(cmake): bump libs to 0.26.0-rc2, falcoctl to 0.14.1, and the container plugin to 0.7.4 [#3985] - @leogr
• fix(ci): bump setup-crane to v0.7 to retry crane download errors [#3983] - @leogr
• fix(chart): restore v9.1.0 release metadata [#3977] - @leogr
• docs(chart): clarify mTLS scope for k8saudit [#3976] - @leogr
• docs(OWNERS): add c2ndev as reviewer [#3980] - @c2ndev
• chore(cmake): bump libs/drivers to 0.26.0-rc1/11.0.0-rc1+driver [#3971] - @github-actions[bot]
• chore(ci): update the Scorecard workflow actions [#3974] - @leogr
• chore(cmake): update falco rules to version 5.2.0 [#3973] - @leogr
• chore(cmake): bump falcoctl to 0.14.0 and container plugin to 0.7.2 [#3972] - @leogr
• test(engine): cover rejection of empty appended rules [#3935] - @Jvlegod
• fix(engine): add empty string guards in logger [#3937] - @archy-rock3t-cloud
• update(cmake): update libs and driver to latest master [#3948] - @github-actions[bot]
• Add Pollinate to ADOPTERS.md [#3933] - @rr16-chemeng
• update(cmake): update libs and driver to latest master [#3957] - @github-actions[bot]
• ci: add e2e tests leveraging the event-generator [#3950] - @ekoops
• test: add event-generator test suite for e2e-testing [#3949] - @ekoops
• docs(OWNERS): moving andreagit97 to emeritus [#3944] - @leogr
• chore(chart): define source chart release workflow [#3898] - @c2ndev

Statistics

Release Manager @leogr

Download

Download

Download

Download

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

v0.44.1

Released on 2026-06-11

Major Changes

• feat(userspace/falco): add support for disabling BPF iterators [#3879] - @ekoops

Bug Fixes

• fix: fix multiple issues related to BPF iterators (solved by bumping libs to 0.25.4) [#3879] - @ekoops

Statistics

Release Manager @ekoops

Download

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

v0.44.0

Released on 2026-05-26

Breaking Changes :warning:

• new!: add backslash escaping support to -o key-path parser for literal dots and brackets in YAML key names (e.g., -o 'my.dotted.key=val') [#3835] - @leogr
• chore!: drop gRPC output and server support [#3798] - @ekoops
• chore!: drop gVisor engine support [#3797] - @ekoops
• chore!: drop legacy BPF probe [#3796] - @ekoops

Major Changes

• feat(engine): support string comparator modifiers (oneof/allof/anyof) [#3878] - @therealbobo
• new(config,rules): add capture_events and capture_filesize stop conditions for capture files [#3824] - @leogr
• feat: validation for unknown-key in rules [#3805] - @leogr
• feat(userspace/engine): add support for list transformer exception [#3799] - @irozzo-1A

Minor Changes

• chore(build): Add USE_TSAN option to enable Thread Sanitizer. [#3856] - @irozzo-1A
• build: enable http_output, webserver, and metrics on macOS and Win [#3827] - @leogr

Bug Fixes

• fix(docker): Restrict falco-webui service to local access only [#3838] - @qux-bbb
• fix: show condition text in warning snippet for folded scalar conditions [#3858] - @ssam18
• fix: respect buffered_outputs YAML config value [#3830] - @leogr
• fix(userspace/falco): fix race condition in watchdog [#3820] - @irozzo-1A
• fix(scripts): update RPM repository metadata before signing when re-signing all packages [#3774] - @c2ndev

Non user-facing changes

• chore(cmake): bump libs to 0.25.2 [#3900] - @ekoops
• chore: update falco rules to version 5.1.0 and add rules sub-command to scripts/update-deps-version [#3890] - @ekoops
• chore(chart): move Falco chart source to falco (1/5) [#3889] - @c2ndev
• chore(chart): move Falco chart source to falco [#3884] - @c2ndev
• chore(cmake): bump libs to 0.25.1 and drivers to 10.2.0+driver [#3888] - @ekoops
• upstream multiple http_output fixes for Win/macOS (from prempti) [#3882] - @leogr
• chore: bump container plugin version to 0.7.1 [#3886] - @ekoops
• fix(ci): reference correct input name for sanitizers flag and update systemd-rpm-macros [#3885] - @irozzo-1A
• fix(build): use Zig cross-compilation toolchain for external dependencies [#3881] - @irozzo-1A
• chore(cmake/modules): bump libs version to 0.25.0-rc2 [#3876] - @ekoops
• chore: bump container plugin version to 0.7.0 [#3877] - @ekoops
• ci(.github): replace /area CI with /area automation in PR template [#3870] - @ekoops
• update(cmake): update libs and driver to latest release candidates [#3873] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3868] - @github-actions[bot]
• chore(cmake): bump falcoctl dependency version to 0.13.0 [#3869] - @c2ndev
• fix(userspace/engine): replace invalid chars while JSON-encoding [#3866] - @ekoops
• update(cmake): update libs and driver to latest master [#3864] - @github-actions[bot]
• build(docker): replace apt-key with keyring; use gnupg instead of gnupg2 [#3844] - @parisnakitakejser
• chore(cmake): bump drivers to 10.0.0-rc2+driver [#3863] - @ekoops
• chore(scripts): add script updating libs/drivers cmake module versions [#3862] - @ekoops
• chore(cmake): bump libs/drivers to 0.24.0-rc1/10.0.0-rc1+driver [#3861] - @ekoops
• ci(reusable_test_packages): produce core dumps when falco crashes [#3859] - @ekoops
• fix(config): prevent plugin library path traversal via relative paths [#3850] - @leogr
• fix: multi thread safety issues [#3852] - @leogr
• update(cmake): update libs and driver to latest master [#3823] - @github-actions[bot]
• ci: restore minimum set of required permissions [#3841] - @ekoops
• sync: docs(CHANGELOG.md): 0.43.1 [#3854] - @leogr
• feat(userspace/falco): add support for kernel iterator metrics [#3840] - @ekoops
• docs: multi-thread falco high-level design proposal [#3751] - @irozzo-1A
• fix(cmake): configure falco.yaml from current src dir [#3821] - @therealbobo
• fix(metrics): Prevent race condition crash during metrics collection on shutdown [#3741] - @adduali1310
• update(cmake): update libs and driver to latest master [#3765] - @github-actions[bot]
• chore(falco): fix warning in webserver.h [#3816] - @irozzo-1A
• docs: fix Contributing.md outdated references [#3807] - @cluster2600
• fix(webserver): fix inconsistent include directives trying to compile the webserver on Apple [#3802] - @legobrick
• chore(build): add support for gperftools CPU profiler [#3771] - @irozzo-1A
• revert: "chore(.github): put back temporary action for GPG key rotation" [#3776] - @leogr
• docs(proposals): specify version enforcing the deprecation [#3762] - @ekoops
• docs(OWNERS): add irozzo-1A(Iacopo Rozzo) as reviewer [#3773] - @irozzo-1A

Statistics

Release Manager @ekoops

Download

Download

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

v0.43.1

Released on 2026-04-09

Minor Changes

• build: bump libs version to 0.23.2 and container plugin version to 0.6.4 [#3851] - @leogr

Statistics

Release Manager @leogr

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

v0.43.0

Released on 2026-01-28

Breaking Changes :warning:

• fix(userspace)!: show source config path only in debug builds [#3787] - @leogr

Minor Changes

• chore: [NOTICE] The GPG key used to sign DEB/RPM packages has been rotated, and all existing packages have been re-signed. New key fingerprint: 478B2FBBC75F4237B731DA4365106822B35B1B1F [#3753] - @leogr
• chore(userspace): deprecate --gvisor-generate-config CLI option [#3784] - @ekoops
• docs: add deprecation notice for legacy eBPF in pkg install dialog [#3786] - @ekoops
• chore(scripts/falcoctl): increase follow interval to 1 week [#3757] - @leogr
• docs: add deprecation notice for legacy eBPF, gVisor and gRPC usage [#3763] - @ekoops
• chore(userspace): deprecate legacy eBPF probe, gVisor engine and gRPC [#3763] - @ekoops
• chore(engine): emit warning when the deprecated evt.latency field family is used in a rule condition or output [#3744] - @irozzo-1A

Bug Fixes

• fix: prevent null pointer crash on popen() failure in output_program [#3722] - @vietcgi
• fix: correct falcoctl.yaml path in debian conffiles [#3745] - @leogr

Non user-facing changes

• revert: chore(.github): temporary action for GPG key rotation [#3766] - @leogr
• chore(cmake): bump falcoctl dependency version to 0.12.2 [#3790] - @ekoops
• chore(cmake): bump falcoctl dependency version to 0.12.1 [#3777] - @ekoops
• chore(cmake): bump container plugin version to 0.6.1 [#3780] - @ekoops
• fix(userspace/engine): missing closing quote in deprecated field warning [#3779] - @leogr
• chore(.github): Put back gpg key rotation workflow [#3772] - @irozzo-1A
• chore(cmake): bump libs/drivers to 0.23.1/9.1.0+driver [#3769] - @ekoops
• chore(cmake): bump container plugin version to 0.6.0 [#3768] - @irozzo-1A
• docs(proposals): add proposal for legacy probe, gVisor engine and gRPC output deprecation [#3755] - @ekoops
• chore(cmake): bump libs/drivers to 0.23.0/9.1.0+driver [#3760] - @ekoops
• update(cmake): update libs and driver to latest master [#3754] - @github-actions[bot]
• fix(metrics): Add null check for state.outputs in metrics collection [#3740] - @adduali1310
• chore(cmake): bump libs to 0.23.0-rc2 [#3759] - @ekoops
• chore(cmake): bump libs/drivers to 0.23.0-rc1/9.1.0-rc1+driver [#3758] - @ekoops
• fix(ci): revert changes to mitigate rate-limitar change [#3752] - @irozzo-1A
• update(cmake): update libs and driver to latest master [#3723] - @github-actions[bot]
• Reduce image size [#3746] - @jfcoz
• docs(RELEASE.md): specify target branch association upon release creation [#3717] - @ekoops
• docs(RELEASE.md): fix rn2md cmd generating changelogs [#3709] - @ekoops
• docs(RELEASE.md): fix PRs filtering expr for checking release notes [#3708] - @ekoops
• docs(RELEASE.md): fix PRs filtering expression text [#3707] - @ekoops

Statistics

Release Manager @ekoops

Download

Download

Download

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

v0.42.1

Released on 2025-11-06

Non user-facing changes

• docs(CHANGELOG.md): update changelog for 0.42.0 release [#3730] - @leogr

Statistics

Release Manager @leogr

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

v0.42.0

Released on 2025-10-22

Major Changes

• feat: add falco_libs.thread_table_auto_purging_interval_s and thread_table_auto_purging_thread_timeout_s configuration options [#3670] - @ekoops
• feat: log plugin version info at loading time [#3657] - @FedeDP
• feat: ability to add statically defined fields via static_fields configuration [#3557] - @FedeDP
• feat(engine): emit warning when a rule containing the evt.dir field in output is encountered [#3697] - @irozzo-1A
• feat(engine): emit warning when a rule containing a condition on the deprecated evt.dir field is encountered [#3690] - @irozzo-1A
• new: ability to record .scap files (capture feature) [#3645] - @leogr
• new(docker): includes sha on the image labels [#3658] - @jcchavezs
• new(cmake,userspace,ci): add mimalloc support [#3616] - @FedeDP

Minor Changes

• docs(falco.yaml): refactor config documentation [#3685] - @leogr
• build: fix debian:buster apt debian repo URL in :driver-loader-buster container image [#3644] - @ekoops
• build: updagrade libs to version 0.22.1 [#3705] - @irozzo-1A
• build: upgrade drivers to v9.0.0+driver [#3701] - @irozzo-1A
• build: upgrade cpp-httplib to v0.23.1 [#3647] - @FedeDP
• update: upgrade default ruleset to v5.0.0 [#3700] - @leogr
• build: upgrade falcoctl to v0.11.4 [#3694] - @leogr
• chore(prometheus): deprecate enter events drop stats [#3675] - @irozzo-1A

Bug Fixes

• fix(cmake): correct abseil-cpp for alpine build [#3598] - @RomanenkoDenys
• fix: enable handling of multiple actions configured with syscall_event_drops.actions [#3676] - @terror96
• fix: disable dry-run restarts when Falco runs with config-watching disabled [#3640] - @Proximyst

Non user-facing changes

• fix(userspace/falco): correct default duration calculation [#3715] - @leogr
• chore(falcoctl): update falco rules to version 5 [#3712] - @irozzo-1A
• doc(OWNERS): move incertum (Melissa Kilby) to emeritus_approvers [#3605] - @incertum
• update(cmake): update libs and driver to latest master [#3689] - @github-actions[bot]
• chore(docker): use new ENV syntax in place of deprecated one [#3696] - @ekoops
• chore(cmake/modules): update rules to 5.0.0-rc1 [#3698] - @leogr
• fix(userspace/engine): fix logger date format [#3672] - @ekoops
• docs(OWNERS): add ekoops(Leonardo Di Giovanna) as approver [#3688] - @ekoops
• update(cmake): update libs and driver to latest master [#3665] - @github-actions[bot]
• Refactor: cppcheck cleanups [#3649] - @sgaist
• update(userspace/engine): update falco engine version and checksum [#3648] - @ekoops
• update(cmake): update libs and driver to latest master [#3662] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3661] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3653] - @github-actions[bot]
• chore(ci): disable mimalloc for master builds. [#3655] - @FedeDP
• chore(deps): Bump submodules/falcosecurity-rules from 1208816 to be38001 [#3651] - @dependabot[bot]
• docs(falco.yaml): avoid out-of-sync config options for container pl… [#3650] - @leogr
• update(cmake): update libs and driver to latest master [#3636] - @github-actions[bot]
• update(CHANGELOG.md): release 0.41.3 (cherry-pick) [#3634] - @ekoops
• update(cmake): update libs and driver to latest master [#3628] - @github-actions[bot]
• update(CHANGELOG.md): release 0.41.2 (cherry-pick) [#3623] - @ekoops
• update(cmake): update libs and driver to latest master [#3618] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3602] - @github-actions[bot]
• chore(falco.yaml): clean up plugins config leftover [#3596] - @leogr
• chore(deps): Bump submodules/falcosecurity-rules from b4437c4 to 4d51b18 [#3607] - @dependabot[bot]
• update(docs): cherry pick CHANGELOG. [#3600] - @FedeDP
• update(cmake): update libs and driver to latest master [#3592] - @github-actions[bot]
• update(docs): bumped changelog for release 0.41.0, master sync [#3586] - @FedeDP
• chore(deps): Bump submodules/falcosecurity-rules from cb17833 to b4437c4 [#3578] - @dependabot[bot]

Statistics

Release Manager @ekoops

Download

Download

Download

Download

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

v0.41.3

Minor Changes

• update: bump container plugin to v0.3.1 [#3629] - @FedeDP

Statistics

Release Manager @leogr @ekoops

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

v0.41.2

Released on 2025-06-17

Statistics

Release Manager @leogr @ekoops

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

v0.41.1

Released on 2025-06-05

Bug Fixes

• fix(userspace/falco): when collecting metrics for stats_writer, create a libs_metrics_collector for each source [#3585] - @FedeDP
• fix(userspace/falco): only enable prometheus metrics once all inspectors have been opened [#3588] - @FedeDP

Statistics

Release Manager @FedeDP

Download

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

v0.41.0

Released on 2025-05-29

Breaking Changes :warning:

• cleanup(engine)!: only consider .yaml/.yml rule files [#3551] - @LucaGuerra
• cleanup(userspace)!: deprecate print of container.info [#3543] - @FedeDP
• cleanup(userspace/falco)!: drop deprecated in 0.40.0 CLI flags. [#3496] - @FedeDP

Major Changes

• new(falco): add json_include_output_fields option [#3527] - @LucaGuerra
• new(build,userspace): switch to use container plugin [#3482] - @FedeDP
• new(docker,scripts,ci): use an override config file to enable ISO 8601 output timeformat on docker images [#3488] - @FedeDP

Minor Changes

• chore(build): update falcoctl to v0.11.2, rules for artifact follow to v4 [#3580] - @LucaGuerra
• update(cmake): bumped falcoctl to 0.11.1 and rules to 4.0.0. [#3577] - @FedeDP
• update(containers): update opencontainers labels [#3575] - @LucaGuerra
• update(metrics): improve restart/hot_reload conditions inspection [#3562] - @incertum
• update: empty values in exceptions won't emit a warning anymore [#3529] - @leogr
• chore(falco.yaml): enable libs_logger by default with info level [#3507] - @FedeDP

Bug Fixes

• fix(metrics/prometheus): gracefully handle multiple event sources, avoid erroneous duplicate metrics [#3563] - @incertum
• fix(ci): properly install rpm systemd-rpm-macro package on building packages pipeline [#3521] - @FedeDP
• fix(userspace/falco): init cmdline options after loading all config files [#3493] - @FedeDP
• fix(cmake): add support for 16K kernel page to jemalloc [#3490] - @Darkness4
• fix(userspace/falco): fix jemalloc enabled in minimal build. [#3478] - @FedeDP

Non user-facing changes

• chore(deps): Bump submodules/falcosecurity-rules from 4ccf111 to cb17833 [#3572] - @dependabot[bot]
• update(cmake/rules): bump to falco-rules-4.0.0-rc1 [#3567] - @leogr
• cleanup(userspace/falco): drop unused libs_metrics_collector variable. [#3566] - @FedeDP
• update(cmake): update libs and driver to latest master [#3564] - @github-actions[bot]
• fix(build): fixed container custom_target sed command. [#3556] - @FedeDP
• chore(deps): Bump submodules/falcosecurity-rules from ae6ed41 to 4ccf111 [#3555] - @dependabot[bot]
• fix(cmake): fix bundled c-ares cmake issue with e.g. SLES [#3559] - @terror96
• chore(deps): Bump submodules/falcosecurity-rules from 1d2c6b1 to ae6ed41 [#3553] - @dependabot[bot]
• chore: revert "chore(deps): Bump submodules/falcosecurity-rules from 1d2c6b1 to 371e431" [#3552] - @FedeDP
• update(cmake): update libs and driver to latest master [#3550] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3549] - @github-actions[bot]
• update(adopters): added SafeDep as adopter [#3548] - @KunalSin9h
• update(cmake): update libs and driver to latest master [#3547] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3541] - @github-actions[bot]
• fix(userspace): fixed engine openssl dep. [#3535] - @FedeDP
• fix(userspace/falco): fix outputs_http timeout [#3523] - @benierc
• fix(ci): use clang-19 to build modern_ebpf skeleton. [#3537] - @FedeDP
• update(cmake): update libs and driver to latest master [#3531] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3530] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3525] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3520] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3516] - @github-actions[bot]
• docs(README.md): cleanups and enhancements [#3514] - @leogr
• update(cmake): update libs and driver to latest master [#3511] - @github-actions[bot]
• chore(deps): Bump submodules/falcosecurity-rules from 1d2c6b1 to 371e431 [#3510] - @dependabot[bot]
• update(cmake): update libs and driver to latest master [#3508] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3506] - @github-actions[bot]
• fix(userspace/falco): when counting -M timeout, do not account for async events [#3505] - @FedeDP
• chore(deps): Bump submodules/falcosecurity-rules from d8415c1 to 1d2c6b1 [#3504] - @dependabot[bot]
• docs(proposals): correct typo in example [#3499] - @leogr
• fix(docker): fixed entrypoints paths with new docker context. [#3492] - @FedeDP
• feat(falco/app): move actions not using config before load_config [#3483] - @ekoops
• refactor(falco/app): apply early return pattern in actions code [#3484] - @ekoops
• chore(deps): Bump submodules/falcosecurity-rules from abf6637 to d8415c1 [#3489] - @dependabot[bot]
• Add NETWAYS Web Services to ADOPTERS.md [#3487] - @mocdaniel
• chore: add back Falco static package to the release template. [#3472] - @FedeDP

Statistics

Release Manager @FedeDP

Download