Docs: Changelog

Mon, 01 Jan 0001 00:00:00 +0000

Version 0.43.0-rc2

Download

Version 0.43.0-rc1

Download

Version 0.42.1

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.42.1`
`docker pull public.ecr.aws/falcosecurity/falco:0.42.1`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.42.1`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.42.1-buster`
`docker pull docker.io/falcosecurity/falco:0.42.1-debian`

v0.42.1

Released on 2025-11-06

Non user-facing changes

docs(CHANGELOG.md): update changelog for 0.42.0 release [#3730] - @leogr

Statistics

MERGED PRS	NUMBER
Not user-facing	1
Release note	0
Total	1

Release Manager @leogr

Version 0.42.0

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.42.0`
`docker pull public.ecr.aws/falcosecurity/falco:0.42.0`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.42.0`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.42.0-buster`
`docker pull docker.io/falcosecurity/falco:0.42.0-debian`

v0.42.0

Released on 2025-10-22

Major Changes

feat: add falco_libs.thread_table_auto_purging_interval_s and thread_table_auto_purging_thread_timeout_s configuration options [#3670] - @ekoops
feat: log plugin version info at loading time [#3657] - @FedeDP
feat: ability to add statically defined fields via static_fields configuration [#3557] - @FedeDP
feat(engine): emit warning when a rule containing the evt.dir field in output is encountered [#3697] - @irozzo-1A
feat(engine): emit warning when a rule containing a condition on the deprecated evt.dir field is encountered [#3690] - @irozzo-1A
new: ability to record .scap files (capture feature) [#3645] - @leogr
new(docker): includes sha on the image labels [#3658] - @jcchavezs
new(cmake,userspace,ci): add mimalloc support [#3616] - @FedeDP

Minor Changes

docs(falco.yaml): refactor config documentation [#3685] - @leogr
build: fix debian:buster apt debian repo URL in :driver-loader-buster container image [#3644] - @ekoops
build: updagrade libs to version 0.22.1 [#3705] - @irozzo-1A
build: upgrade drivers to v9.0.0+driver [#3701] - @irozzo-1A
build: upgrade cpp-httplib to v0.23.1 [#3647] - @FedeDP
update: upgrade default ruleset to v5.0.0 [#3700] - @leogr
build: upgrade falcoctl to v0.11.4 [#3694] - @leogr
chore(prometheus): deprecate enter events drop stats [#3675] - @irozzo-1A

Bug Fixes

fix(cmake): correct abseil-cpp for alpine build [#3598] - @RomanenkoDenys
fix: enable handling of multiple actions configured with syscall_event_drops.actions [#3676] - @terror96
fix: disable dry-run restarts when Falco runs with config-watching disabled [#3640] - @Proximyst

Non user-facing changes

fix(userspace/falco): correct default duration calculation [#3715] - @leogr
chore(falcoctl): update falco rules to version 5 [#3712] - @irozzo-1A
doc(OWNERS): move incertum (Melissa Kilby) to emeritus_approvers [#3605] - @incertum
update(cmake): update libs and driver to latest master [#3689] - @github-actions[bot]
chore(docker): use new ENV syntax in place of deprecated one [#3696] - @ekoops
chore(cmake/modules): update rules to 5.0.0-rc1 [#3698] - @leogr
fix(userspace/engine): fix logger date format [#3672] - @ekoops
docs(OWNERS): add ekoops(Leonardo Di Giovanna) as approver [#3688] - @ekoops
update(cmake): update libs and driver to latest master [#3665] - @github-actions[bot]
Refactor: cppcheck cleanups [#3649] - @sgaist
update(userspace/engine): update falco engine version and checksum [#3648] - @ekoops
update(cmake): update libs and driver to latest master [#3662] - @github-actions[bot]
update(cmake): update libs and driver to latest master [#3661] - @github-actions[bot]
update(cmake): update libs and driver to latest master [#3653] - @github-actions[bot]
chore(ci): disable mimalloc for master builds. [#3655] - @FedeDP
chore(deps): Bump submodules/falcosecurity-rules from 1208816 to be38001 [#3651] - @dependabot[bot]
docs(falco.yaml): avoid out-of-sync config options for container pl… [#3650] - @leogr
update(cmake): update libs and driver to latest master [#3636] - @github-actions[bot]
update(CHANGELOG.md): release 0.41.3 (cherry-pick) [#3634] - @ekoops
update(cmake): update libs and driver to latest master [#3628] - @github-actions[bot]
update(CHANGELOG.md): release 0.41.2 (cherry-pick) [#3623] - @ekoops
update(cmake): update libs and driver to latest master [#3618] - @github-actions[bot]
update(cmake): update libs and driver to latest master [#3602] - @github-actions[bot]
chore(falco.yaml): clean up plugins config leftover [#3596] - @leogr
chore(deps): Bump submodules/falcosecurity-rules from b4437c4 to 4d51b18 [#3607] - @dependabot[bot]
update(docs): cherry pick CHANGELOG. [#3600] - @FedeDP
update(cmake): update libs and driver to latest master [#3592] - @github-actions[bot]
update(docs): bumped changelog for release 0.41.0, master sync [#3586] - @FedeDP
chore(deps): Bump submodules/falcosecurity-rules from cb17833 to b4437c4 [#3578] - @dependabot[bot]

Statistics

MERGED PRS	NUMBER
Not user-facing	29
Release note	23
Total	52

Release Manager @ekoops

Version 0.42.0-rc4

Download

Version 0.42.0-rc3

Download

Version 0.42.0-rc2

Download

Version 0.42.0-rc1

Download

Version 0.41.3

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.41.3`
`docker pull public.ecr.aws/falcosecurity/falco:0.41.3`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.41.3`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.41.3-buster`
`docker pull docker.io/falcosecurity/falco:0.41.3-debian`

v0.41.3

Minor Changes

update: bump container plugin to v0.3.1 [#3629] - @FedeDP

Statistics

MERGED PRS	NUMBER
Not user-facing	0
Release note	1
Total	1

Release Manager @leogr @ekoops

Version 0.41.2

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.41.2`
`docker pull public.ecr.aws/falcosecurity/falco:0.41.2`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.41.2`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.41.2-buster`
`docker pull docker.io/falcosecurity/falco:0.41.2-debian`

v0.41.2

Released on 2025-06-17

Statistics

MERGED PRS	NUMBER
Not user-facing	0
Release note	0
Total	0

Release Manager @leogr @ekoops

Version 0.41.1

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.41.1`
`docker pull public.ecr.aws/falcosecurity/falco:0.41.1`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.41.1`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.41.1-buster`
`docker pull docker.io/falcosecurity/falco:0.41.1-debian`

v0.41.1

Released on 2025-06-05

Bug Fixes

fix(userspace/falco): when collecting metrics for stats_writer, create a libs_metrics_collector for each source [#3585] - @FedeDP
fix(userspace/falco): only enable prometheus metrics once all inspectors have been opened [#3588] - @FedeDP

Statistics

MERGED PRS	NUMBER
Not user-facing	0
Release note	2
Total	2

Release Manager @FedeDP

Version 0.41.1-rc1

Download

Version 0.41.0

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.41.0`
`docker pull public.ecr.aws/falcosecurity/falco:0.41.0`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.41.0`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.41.0-buster`
`docker pull docker.io/falcosecurity/falco:0.41.0-debian`

v0.41.0

Released on 2025-05-29

Breaking Changes :warning:

cleanup(engine)!: only consider .yaml/.yml rule files [#3551] - @LucaGuerra
cleanup(userspace)!: deprecate print of container.info [#3543] - @FedeDP
cleanup(userspace/falco)!: drop deprecated in 0.40.0 CLI flags. [#3496] - @FedeDP

Major Changes

new(falco): add json_include_output_fields option [#3527] - @LucaGuerra
new(build,userspace): switch to use container plugin [#3482] - @FedeDP
new(docker,scripts,ci): use an override config file to enable ISO 8601 output timeformat on docker images [#3488] - @FedeDP

Minor Changes

chore(build): update falcoctl to v0.11.2, rules for artifact follow to v4 [#3580] - @LucaGuerra
update(cmake): bumped falcoctl to 0.11.1 and rules to 4.0.0. [#3577] - @FedeDP
update(containers): update opencontainers labels [#3575] - @LucaGuerra
update(metrics): improve restart/hot_reload conditions inspection [#3562] - @incertum
update: empty values in exceptions won't emit a warning anymore [#3529] - @leogr
chore(falco.yaml): enable libs_logger by default with info level [#3507] - @FedeDP

Bug Fixes

fix(metrics/prometheus): gracefully handle multiple event sources, avoid erroneous duplicate metrics [#3563] - @incertum
fix(ci): properly install rpm systemd-rpm-macro package on building packages pipeline [#3521] - @FedeDP
fix(userspace/falco): init cmdline options after loading all config files [#3493] - @FedeDP
fix(cmake): add support for 16K kernel page to jemalloc [#3490] - @Darkness4
fix(userspace/falco): fix jemalloc enabled in minimal build. [#3478] - @FedeDP

Non user-facing changes

chore(deps): Bump submodules/falcosecurity-rules from 4ccf111 to cb17833 [#3572] - @dependabot[bot]
update(cmake/rules): bump to falco-rules-4.0.0-rc1 [#3567] - @leogr
cleanup(userspace/falco): drop unused libs_metrics_collector variable. [#3566] - @FedeDP
update(cmake): update libs and driver to latest master [#3564] - @github-actions[bot]
fix(build): fixed container custom_target sed command. [#3556] - @FedeDP
chore(deps): Bump submodules/falcosecurity-rules from ae6ed41 to 4ccf111 [#3555] - @dependabot[bot]
fix(cmake): fix bundled c-ares cmake issue with e.g. SLES [#3559] - @terror96
chore(deps): Bump submodules/falcosecurity-rules from 1d2c6b1 to ae6ed41 [#3553] - @dependabot[bot]
chore: revert "chore(deps): Bump submodules/falcosecurity-rules from 1d2c6b1 to 371e431" [#3552] - @FedeDP
update(cmake): update libs and driver to latest master [#3550] - @github-actions[bot]
update(cmake): update libs and driver to latest master [#3549] - @github-actions[bot]
update(adopters): added SafeDep as adopter [#3548] - @KunalSin9h
update(cmake): update libs and driver to latest master [#3547] - @github-actions[bot]
update(cmake): update libs and driver to latest master [#3541] - @github-actions[bot]
fix(userspace): fixed engine openssl dep. [#3535] - @FedeDP
fix(userspace/falco): fix outputs_http timeout [#3523] - @benierc
fix(ci): use clang-19 to build modern_ebpf skeleton. [#3537] - @FedeDP
update(cmake): update libs and driver to latest master [#3531] - @github-actions[bot]
update(cmake): update libs and driver to latest master [#3530] - @github-actions[bot]
update(cmake): update libs and driver to latest master [#3525] - @github-actions[bot]
update(cmake): update libs and driver to latest master [#3520] - @github-actions[bot]
update(cmake): update libs and driver to latest master [#3516] - @github-actions[bot]
docs(README.md): cleanups and enhancements [#3514] - @leogr
update(cmake): update libs and driver to latest master [#3511] - @github-actions[bot]
chore(deps): Bump submodules/falcosecurity-rules from 1d2c6b1 to 371e431 [#3510] - @dependabot[bot]
update(cmake): update libs and driver to latest master [#3508] - @github-actions[bot]
update(cmake): update libs and driver to latest master [#3506] - @github-actions[bot]
fix(userspace/falco): when counting -M timeout, do not account for async events [#3505] - @FedeDP
chore(deps): Bump submodules/falcosecurity-rules from d8415c1 to 1d2c6b1 [#3504] - @dependabot[bot]
docs(proposals): correct typo in example [#3499] - @leogr
fix(docker): fixed entrypoints paths with new docker context. [#3492] - @FedeDP
feat(falco/app): move actions not using config before load_config [#3483] - @ekoops
refactor(falco/app): apply early return pattern in actions code [#3484] - @ekoops
chore(deps): Bump submodules/falcosecurity-rules from abf6637 to d8415c1 [#3489] - @dependabot[bot]
Add NETWAYS Web Services to ADOPTERS.md [#3487] - @mocdaniel
chore: add back Falco static package to the release template. [#3472] - @FedeDP

Statistics

MERGED PRS	NUMBER
Not user-facing	36
Release note	17
Total	53

Release Manager @FedeDP

Version 0.41.0-rc2

Download

Version 0.41.0-rc1

Download

Version 0.40.0

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.40.0`
`docker pull public.ecr.aws/falcosecurity/falco:0.40.0`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.40.0`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.40.0-buster`
`docker pull docker.io/falcosecurity/falco:0.40.0-debian`

v0.40.0

Released on 2025-01-28

Breaking Changes :warning:

cleanup(userspac/falco)!: drop deprecated options. [#3361] - @FedeDP

Major Changes

new(docker): streamline docker images [#3273] - @FedeDP
new(build): reintroduce static build [#3428] - @LucaGuerra
new(cmake,ci): added support for using jemalloc allocator instead of glibc one and use it by default for release artifacts [#3406] - @FedeDP
new(userspace,cmake): honor new plugins exposed suggested output formats [#3388] - @FedeDP
new(userspace/falco): allow entirely disabling plugin hostinfo support. [#3412] - @FedeDP
new(ci): use zig compiler instead of relying on centos7. [#3307] - @FedeDP
new(falco): add buffer_format_base64 option, deprecate -b [#3358] - @LucaGuerra
new(falco): add base_syscalls.all option to falco.yaml, deprecate -A [#3352] - @LucaGuerra
new(falco): add falco_libs.snaplen option, deprecate -S / --snaplen [#3362] - @LucaGuerra

Minor Changes

update(cmake): bump falcoctl to v0.11.0 [#3467] - @alacuku
chore(ci): add attestation for falco [#3216] - @cpanato
chore(ci): build Falco in RelWithDebInfo, and upload Falco debug symbols as github artifacts [#3452] - @FedeDP
update(build): DEB and RPM package requirements for dkms and kernel-devel are now suggestions [#3450] - @jthiltges

Bug Fixes

fix(userspace/falco): fix container_engines.cri.sockets not loading from config file [#3453] - @zayaanmoez
fix(docker): /usr/src/'*' no longer created if $HOST_PATH/usr/src didn't exist at startup [#3434] - @shane-lawrence
fix(docker): add brotli to the Falco image [#3399] - @LucaGuerra
fix(userspace/engine): explicitly disallow appending/modifying a rule with different sources [#3383] - @mstemm

Non user-facing changes

chore(falco.yaml): remove comments about cri cli arguments [#3458] - @alacuku
fix(ci): fixed reusable_build/publish_docker workflows. [#3459] - @FedeDP
update(cmake): update libs and driver to latest master [#3455] - @github-actions[bot]
chore(ci): bumped actions/upload-download-artifact. [#3454] - @FedeDP
chore(docker): drop unused libelf dep from container images [#3451] - @leogr
chore(docs): update plugins_hostinfo config file comment. [#3449] - @FedeDP
new(build): add RelWithDebInfo target [#3440] - @shane-lawrence
chore(deps): Bump submodules/falcosecurity-rules from 283a62f to abf6637 [#3448] - @dependabot[bot]
update(ci): use 4cpu-16gb arm runners [#3447] - @LucaGuerra
update(cmake): update libs and driver to latest master [#3439] - @github-actions[bot]
chore: avoid deprecated funcs to calculate sha256 [#3442] - @federico-sysdig
chore(ci): enable jemalloc in musl build. [#3436] - @FedeDP
docs(falco.yaml): correct buffered_outputs description [#3427] - @leogr
fix(userspace/falco): use correct filtercheck_field_info. [#3426] - @FedeDP
update(cmake): update libs and driver to latest master [#3421] - @github-actions[bot]
fix: update the url for the docs about the concurrent queue classes [#3415] - @Issif
update(changelog): updated changelog for 0.39.2. [#3410] - @FedeDP
update(cmake): update libs and driver to latest master [#3392] - @github-actions[bot]
fix(cmake,docker): avoid cpp-httplib requiring brotli. [#3400] - @FedeDP
chore(deps): Bump submodules/falcosecurity-rules from 407e997 to 283a62f [#3391] - @dependabot[bot]
update(cmake): bump libs to latest master. [#3389] - @FedeDP
update(cmake): update libs and driver to latest master [#3385] - @github-actions[bot]
Make enable()/disable() virtual so they can be overridden [#3375] - @mstemm
fix(ci): fixed shasum computation for bump-libs CI. [#3379] - @FedeDP
chore(ci): use redhat advised method to check rpmsign success. [#3376] - @FedeDP
chore(deps): Bump submodules/falcosecurity-rules from e38fb3f to 407e997 [#3374] - @dependabot[bot]
Compile output clone [#3364] - @mstemm
fix(ci): fixed bump-libs workflow syntax. [#3369] - @FedeDP
new(ci): add a workflow to automatically bump libs on each monday. [#3360] - @FedeDP
chore(deps): Bump submodules/falcosecurity-rules from b6ad373 to e38fb3f [#3365] - @dependabot[bot]
cleanup(falco): reformat options::define [#3356] - @LucaGuerra

Statistics

MERGED PRS	NUMBER
Not user-facing	31
Release note	18
Total	49

Release Manager @FedeDP

Version 0.40.0-rc1

Download

Version 0.39.2

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.39.2`
`docker pull public.ecr.aws/falcosecurity/falco:0.39.2`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.39.2`
`docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.39.2`
`docker pull docker.io/falcosecurity/falco-no-driver:0.39.2`
`docker pull docker.io/falcosecurity/falco-distroless:0.39.2`

v0.39.2

Released on 2024-11-21

Minor Changes

update(cmake): bumped falcoctl to v0.10.1. [#3408] - @FedeDP
update(cmake): bump yaml-cpp to latest master. [#3394] - @FedeDP

Non user-facing changes

update(ci): use arm64 CNCF runners for GH actions [#3386] - @LucaGuerra

Statistics

MERGED PRS	NUMBER
Not user-facing	1
Release note	2
Total	3

Release Manager @FedeDP

Version 0.39.1

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.39.1`
`docker pull public.ecr.aws/falcosecurity/falco:0.39.1`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.39.1`
`docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.39.1`
`docker pull docker.io/falcosecurity/falco-no-driver:0.39.1`
`docker pull docker.io/falcosecurity/falco-distroless:0.39.1`

v0.39.1

Released on 2024-10-09

Bug Fixes

fix(engine): allow null init_config for plugin info [#3372] - @LucaGuerra
fix(engine): fix parsing issues in -o key={object} when the object definition contains a comma [#3363] - @LucaGuerra
fix(userspace/falco): fix event set selection for plugin with parsing capability [#3368] - @FedeDP

Non user-facing changes

update(changelog): updated changelog for 0.39.1. [#3373] - @FedeDP

Statistics

MERGED PRS	NUMBER
Not user-facing	1
Release note	3
Total	4

Release Manager @FedeDP

Version 0.39.1-rc1

Download

Version 0.39.0

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.39.0`
`docker pull public.ecr.aws/falcosecurity/falco:0.39.0`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.39.0`
`docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.39.0`
`docker pull docker.io/falcosecurity/falco-no-driver:0.39.0`
`docker pull docker.io/falcosecurity/falco-distroless:0.39.0`

v0.39.0

Released on 2024-10-01

Breaking Changes :warning:

fix(falco_metrics)!: split tags label into multiple tag_-prefixed labels [#3337] - @ekoops
fix(falco_metrics)!: use full name for configs and rules files [#3337] - @ekoops
update(falco_metrics)!: rearrange n_evts_cpu and n_drops_cpu Prometheus metrics to follow best practices [#3319] - @incertum
cleanup(userspace/falco)!: drop deprecated -t,-T,-D options. [#3311] - @FedeDP

Major Changes

feat(stats): add host_netinfo networking information stats family [#3344] - @ekoops
new(falco): add json_include_message_property to have a message field without date and priority [#3314] - @LucaGuerra
new(userspace/falco,userspace/engine): rule json schema validation [#3313] - @FedeDP
new(falco): introduce append_output configuration [#3308] - @LucaGuerra
new(userspace/falco): added --config-schema action to print config schema [#3312] - @FedeDP
new(falco): enable CLI options with -o key={object} [#3310] - @LucaGuerra
new(config): add container_engines config to falco.yaml [#3266] - @incertum
new(metrics): add host_ifinfo metric [#3253] - @incertum
new(userspace,unit_tests): validate configs against schema [#3302] - @FedeDP

Minor Changes

update(falco): upgrade libs to 0.18.1 [#3349] - @LucaGuerra
update(systemd): users can refer to systemd falco services with a constistent unique alias falco.service [#3332] - @ekoops
update(cmake): bump libs to 0.18.0 and driver to 7.3.0+driver. [#3330] - @FedeDP
chore(userspace/falco): deprecate cri related CLI options. [#3329] - @FedeDP
update(cmake): bumped falcoctl to v0.10.0 and rules to 3.2.0 [#3327] - @FedeDP
update(falco_metrics): change prometheus rules metric naming [#3324] - @incertum

Bug Fixes

fix(falco): allow disable_cri_async from both CLI and config [#3353] - @LucaGuerra
fix(engine): sync outputs before printing stats at shutdown [#3338] - @LucaGuerra
fix(falco): allow plugin init_config map in json schema [#3335] - @LucaGuerra
fix(userspace/falco): properly account for plugin with CAP_PARSING when computing interesting sc set [#3334] - @FedeDP

Non user-facing changes

feat(cmake): add conditional builds for falcoctl and rules paths [#3305] - @tembleking
cleanup(falco): ignore lint commit [#3354] - @LucaGuerra
chore(falco): apply code formatting [#3350] - @poiana
chore: ignore_some_files for clang format [#3351] - @Andreagit97
sync: release 0.39.x [#3340] - @FedeDP
fix(userspace/engine): improve rule json schema to account for source and required_plugin_versions [#3328] - @FedeDP
cleanup(falco): use header file for json schema [#3325] - @LucaGuerra
update(engine): modify append_output format [#3322] - @LucaGuerra
chore: scaffolding for enabling code formatting [#3321] - @Andreagit97
update(cmake): bump libs and driver to 0.18.0-rc1. [#3320] - @FedeDP
fix(ci): restore master and release CI workflow permissions. [#3317] - @FedeDP
fixed the token-permission and pinned-dependencies issue [#3299] - @harshitasao
update(cmake): bump falcoctl to v0.10.0-rc1 [#3316] - @alacuku
ci(insecure-api): update semgrep docker image [#3315] - @francesco-furlan
Add demo environment instructions and docker-config files [#3295] - @bbl232
chore(deps): Bump submodules/falcosecurity-rules from baecf18 to b6ad373 [#3301] - @dependabot[bot]
update(cmake): bump libs and driver to latest master [#3283] - @jasondellaluce
chore(deps): Bump submodules/falcosecurity-rules from 342b20d to baecf18 [#3298] - @dependabot[bot]
chore(deps): Bump submodules/falcosecurity-rules from 068f0f2 to 342b20d [#3288] - @dependabot[bot]
vote: add sgaist to OWNERS [#3264] - @sgaist
Add Tulip Retail to adopters list [#3291] - @bbl232
chore(deps): Bump submodules/falcosecurity-rules from 28b98b6 to 068f0f2 [#3282] - @dependabot[bot]
chore(deps): Bump submodules/falcosecurity-rules from c0a9bf1 to 28b98b6 [#3267] - @dependabot[bot]
Added the OpenSSF Scorecard Badge [#3250] - @harshitasao
chore(deps): Bump submodules/falcosecurity-rules from ea57e78 to c0a9bf1 [#3247] - @dependabot[bot]
update(cmake,userspace): bump libs and driver to latest master. [#3263] - @FedeDP
If rule compilation fails, return immediately [#3260] - @mstemm
new(userspace/engine): generalize indexable ruleset [#3251] - @mstemm
update(cmake): bump libs to master. [#3249] - @FedeDP
chore(deps): Bump submodules/falcosecurity-rules from df963b6 to ea57e78 [#3240] - @dependabot[bot]
chore(ci): enable dummy tests on the testing framework. [#3233] - @FedeDP
chore(deps): Bump submodules/falcosecurity-rules from 679a50a to df963b6 [#3231] - @dependabot[bot]
update(cmake): bump libs and driver to master. [#3225] - @FedeDP
chore(deps): Bump submodules/falcosecurity-rules from 9e56293 to 679a50a [#3222] - @dependabot[bot]
update(docs): update CHANGELOG for 0.38.0 (master branch) [#3224] - @LucaGuerra

Statistics

MERGED PRS	NUMBER
Not user-facing	35
Release note	22
Total	57

Release Manager @FedeDP

Version 0.39.0-rc3

Download

Version 0.39.0-rc2

Download

Version 0.39.0-rc1

Download

Version 0.38.2

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.38.2`
`docker pull public.ecr.aws/falcosecurity/falco:0.38.2`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.38.2`
`docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.38.2`
`docker pull docker.io/falcosecurity/falco-no-driver:0.38.2`
`docker pull docker.io/falcosecurity/falco-distroless:0.38.2`

v0.38.2

Released on 2024-08-19

Bug Fixes

fix(engine): fix metrics names to better adhere to best practices [#3272] - @incertum
fix(ci): use vault.centos.org for centos:7 CI build. [#3274] - @FedeDP

Statistics

MERGED PRS	NUMBER
Not user-facing	0
Release note	2
Total	2

Release Manager @LucaGuerra

Version 0.38.2-rc2

Download

Version 0.38.2-rc1

Download

Version 0.38.1

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.38.1`
`docker pull public.ecr.aws/falcosecurity/falco:0.38.1`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.38.1`
`docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.38.1`
`docker pull docker.io/falcosecurity/falco-no-driver:0.38.1`
`docker pull docker.io/falcosecurity/falco-distroless:0.38.1`

v0.38.1

Released on 2024-06-19

Major Changes

new(metrics): enable plugins metrics [#3228] - @mrgian

Minor Changes

cleanup(falco): clarify that --print variants only affect syscalls [#3238] - @LucaGuerra
update(engine): enable -p option for all sources, -pk, -pc etc only for syscall sources [#3239] - @LucaGuerra

Bug Fixes

fix(engine): enable output substitution only for syscall rules, prevent engine from exiting with validation errors when a plugin is loaded and -pc/pk is specified [#3236] - @mrgian
fix(metrics): allow each metric output channel to be selected independently [#3232] - @incertum
fix(userspace/falco): fixed falco_metrics::to_text implementation when running with plugins [#3230] - @FedeDP

Statistics

MERGED PRS	NUMBER
Not user-facing	0
Release note	6
Total	6

Release Manager @FedeDP

Version 0.38.1-rc1

Download

Version 0.38.0

Download

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
`docker pull docker.io/falcosecurity/falco:0.38.0`
`docker pull public.ecr.aws/falcosecurity/falco:0.38.0`
`docker pull docker.io/falcosecurity/falco-driver-loader:0.38.0`
`docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.38.0`
`docker pull docker.io/falcosecurity/falco-no-driver:0.38.0`
`docker pull docker.io/falcosecurity/falco-distroless:0.38.0`

v0.38.0

Released on 2024-05-30

Breaking Changes :warning:

new(scripts,docker)!: enable automatic driver selection logic in packages and docker images. Modern eBPF is now also the default driver and the highest priority one in the new driver selection logic. [#3154] - @FedeDP
cleanup(falco.yaml)!: remove some deprecated configs [#3087] - @Andreagit97
cleanup(docker)!: remove unused builder dockerfile [#3088] - @Andreagit97

Major Changes

new(webserver): a metrics endpoint has been added providing prometheus metrics. It can be optionally enabled using the new metrics.prometheus_enabled configuration option. It will only be activated if the metrics.enabled is true as well. [#3140] - @sgaist
new(metrics): add rules_counters_enabled option [#3192] - @incertum
new(build): provide signatures for .tar.gz packages [#3201] - @LucaGuerra
new(engine): add print_enabled_rules_falco_logger when log_level debug [#3189] - @incertum
new(falco): allow selecting which rules to load from the configuration file or command line [#3178] - @LucaGuerra
new(metrics): add file sha256sum metrics for loaded config and rules files [#3187] - @incertum
new(engine): throw an error when an invalid macro/list name is used [#3116] - @mrgian
new(engine): raise warning instead of error on invalid macro/list name [#3167] - @mrgian
new(userspace): support split config files [#3024] - @FedeDP
new(engine): enforce unique exceptions names [#3134] - @mrgian
new(engine): add warning when appending an exception with no values [#3133] - @mrgian
feat(metrics): coherent metrics stats model including few metrics naming changes [#3129] - @incertum
new(config): add falco_libs.thread_table_size [#3071] - @incertum
new(proposals): introduce on host anomaly detection framework [#2655] - @incertum

Minor Changes

update(cmake): bump falcoctl to v0.8.0. [#3219] - @FedeDP
update(rules): update falco-rules to 3.1.0 [#3217] - @LucaGuerra
refactor(userspace): move falco logger under falco engine [#3208] - @jasondellaluce
chore(docs): apply features adoption and deprecation proposal to config file keys [#3206] - @FedeDP
cleanup(metrics): add original rule name as label [#3205] - @incertum
update(falco): deprecate options -T, -t and -D [#3193] - @LucaGuerra
refactor: bump libs and driver, support field modifiers [#3186] - @jasondellaluce
chore(userspace/falco): deprecated old 'rules_file' config key [#3162] - @FedeDP
chore(falco): update falco libs and driver to master (Apr 8th 2024) [#3158] - @LucaGuerra
update(build): update libs to 026ffe1d8f1b25c6ccdc09afa2c02afdd3e3f672 [#3151] - @LucaGuerra
cleanup: minor adjustments to readme, add new testing section [#3072] - @incertum
refactor(userspace/engine): reduce allocations during rules loading [#3065] - @jasondellaluce
update(CI): publish wasm package as dev-wasm [#3017] - @Rohith-Raju

Bug Fixes

fix(userspace/falco): fix state initialization avoid a crash during hot reload [#3190] - @FedeDP
fix(userspace/engine): make sure exception fields are not optional in replace mode [#3108] - @jasondellaluce
fix(docker): added zstd to driver loader images [#3203] - @FedeDP
fix(engine): raise warning instead of error on not-unique exceptions names [#3159] - @mrgian
fix(engine): apply output substitutions for all sources [#3135] - @mrgian
fix(userspace/configuration): make sure that folders that would trigger permission denied are not traversed [#3127] - @sgaist
fix(engine): logical issue in exceptions condition [#3115] - @mrgian
fix(cmake): properly let falcoctl cmake module create /usr/share/falco/plugins/ folder. [#3105] - @FedeDP

Non user-facing changes

update(scripts/falcoctl): bump falco-rules version to 3 [#3128] - @alacuku
build(deps): Bump submodules/falcosecurity-rules from 59bf03b to 9e56293 [#3212] - @dependabot[bot]
chore(gha): update cosign to v3.5.0 [#3209] - @LucaGuerra
build(deps): Bump submodules/falcosecurity-rules from 29c41c4 to 59bf03b [#3207] - @dependabot[bot]
update(cmake): bumped libs to 0.17.0-rc1 and falcoctl to v0.8.0-rc6. [#3204] - @FedeDP
build(deps): Bump submodules/falcosecurity-rules from 3f668d0 to 3cac61c [#3044] - @dependabot[bot]
build(deps): Bump submodules/falcosecurity-testing from ae3950a to 7abf76f [#3094] - @dependabot[bot]
fix(ci): enforce bundled deps OFF in build-dev CI [#3118] - @FedeDP
build(deps): Bump submodules/falcosecurity-rules from 88a40c8 to 869c9a7 [#3156] - @dependabot[bot]
update(cmake): bumped falcoctl to v0.8.0-rc5. [#3199] - @FedeDP
build(deps): Bump submodules/falcosecurity-rules from 4f153f5 to 29c41c4 [#3198] - @dependabot[bot]
update(cmake): bump falcoctl to v0.8.0-rc4 [#3191] - @FedeDP
refactor: smart pointer usage [#3184] - @federico-sysdig
build(deps): Bump submodules/falcosecurity-rules from ec255e6 to 4f153f5 [#3182] - @dependabot[bot]
update(cmake): bumped libs and driver to latest master. [#3177] - @FedeDP
chore(cmake): enable modern bpf build by default. [#3180] - @FedeDP
cleanup(docs): fix typo in license blocks [#3175] - @LucaGuerra
chore(docker,scripts): set old eBPF probe as lowest priority driver. [#3173] - @FedeDP
build(deps): Bump submodules/falcosecurity-rules from 869c9a7 to ec255e6 [#3170] - @dependabot[bot]
update(app): close inspectors at teardown time [#3169] - @LucaGuerra
fix(docker): fixed docker entrypoints for driver loading. [#3168] - @FedeDP
fix(docker,scripts): do not load falcoctl driver loader when installing Falco deb package in docker images [#3166] - @FedeDP
update(ci): build both release and debug versions [#3161] - @LucaGuerra
chore(userspace/falco): watch all configs files. [#3160] - @FedeDP
fix(ci): update scorecard-action to v2.3.1 [#3153] - @LucaGuerra
cleanup(falco): consolidate falco::grpc::server in one class [#3150] - @LucaGuerra
new(build): enable ASan and UBSan builds with options and in CI [#3147] - @LucaGuerra
fix(userspace): variable / function shadowing [#3123] - @sgaist
build(deps): Bump submodules/falcosecurity-rules from fbf0a4e to 88a40c8 [#3145] - @dependabot[bot]
fix(cmake): fix USE_BUNDLED_DEPS=ON and BUILD_FALCO_UNIT_TESTS=ON [#3146] - @LucaGuerra
Add --kernelversion and --kernelrelease options to falco driver loader entrypoint [#3143] - @Sryther
build(deps): Bump submodules/falcosecurity-rules from 44addef to fbf0a4e [#3139] - @dependabot[bot]
chore: bump to latest libs commit [#3137] - @Andreagit97
refactor: Use FetchContent for integrating three bundled libs [#3107] - @federico-sysdig
build(deps): Bump submodules/falcosecurity-rules from dc7970d to 44addef [#3136] - @dependabot[bot]
build(deps): Bump submodules/falcosecurity-rules from f88b991 to dc7970d [#3126] - @dependabot[bot]
refactor(ci): Avoid using command make directly [#3101] - @federico-sysdig
docs(proposal): 20231220-features-adoption-and-deprecation.md [#2986] - @leogr
build(deps): Bump submodules/falcosecurity-rules from b499a1d to f88b991 [#3125] - @dependabot[bot]
docs(README.md): Falco Graduates within the CNCF [#3124] - @leogr
build(deps): Bump submodules/falcosecurity-rules from 497e011 to b499a1d [#3111] - @dependabot[bot]
chore(ci): bumped codeql actions. [#3114] - @FedeDP
Cleanup warnings and smart ptrs [#3112] - @federico-sysdig
new(build): add options to use bundled dependencies [#3092] - @mrgian
fix(ci): test-dev-packages-arm64 needs build-dev-packages-arm64. [#3110] - @FedeDP
refactor: bump libs and driver, and adopt unique pointers wherever possible [#3109] - @jasondellaluce
cleanup: falco_engine test fixture [#3099] - @federico-sysdig
refactor: test AtomicSignalHandler.handle_once_wait_consistency [#3100] - @federico-sysdig
Cleanup variable use [#3097] - @sgaist
cleanup(submodules): dropped testing submodule. [#3098] - @FedeDP
cleanup(ci): make use of falcosecurity/testing provided composite action [#3093] - @FedeDP
Improve const correctness [#3083] - @sgaist
Improve exception throwing [#3085] - @sgaist
fix(ci): update sync in deb and rpm scripts with acl [#3062] - @LucaGuerra
cleanup(tests): consolidate Falco engine and rule loader tests [#3066] - @LucaGuerra
cleanup: falco_engine deps and include paths [#3090] - @federico-sysdig
fix: Some compiler warnings [#3089] - @federico-sysdig
build(deps): Bump submodules/falcosecurity-rules from 0f60976 to 497e011 [#3081] - @dependabot[bot]
fix(c++): add missing explicit to single argument constructors [#3069] - @sgaist
Improve class initialization [#3074] - @sgaist
build(deps): Bump submodules/falcosecurity-rules from 6ed2036 to 0f60976 [#3078] - @dependabot[bot]
build(deps): Bump submodules/falcosecurity-rules from 1053b2d to 6ed2036 [#3067] - @dependabot[bot]
fix(c++): add missing overrides [#3064] - @sgaist
new(build): prune deb-dev and rpm-dev directories [#3056] - @LucaGuerra
refactor(userspace): align falco to gen-event class family deprecation [#3051] - @jasondellaluce
build(deps): Bump submodules/falcosecurity-rules from 3cac61c to 1053b2d [#3047] - @dependabot[bot]
fix: adopt new libsinsp logger [#3026] - @therealbobo
refactor: cleanup libs relative include paths [#2936] - @therealbobo
chore(ci): bumped rn2md to latest master. [#3046] - @FedeDP
Support alternate rules loader [#3008] - @mstemm
fix(ci): fixed release body driver version. [#3042] - @FedeDP
build(deps): Bump submodules/falcosecurity-rules from c39d31a to 3f668d0 [#3039] - @dependabot[bot]

Statistics

MERGED PRS	NUMBER
Not user-facing	72
Release note	38
Total	110

Falco – Reference

Docs: Glossary

Docs: Falco Daemon

Docs: Falco Rules

Docs: Falco Plugins

Docs: Changelog

Version 0.43.0-rc2

Download

Version 0.43.0-rc1

Download

Version 0.42.1

Download

v0.42.1

Non user-facing changes

Statistics

Release Manager @leogr

Version 0.42.0

Download

v0.42.0

Major Changes

Minor Changes

Bug Fixes

Non user-facing changes

Statistics

Release Manager @ekoops

Version 0.42.0-rc4

Download

Version 0.42.0-rc3

Download

Version 0.42.0-rc2

Download

Version 0.42.0-rc1

Download

Version 0.41.3

Download

v0.41.3

Minor Changes

Statistics

Release Manager @leogr @ekoops

Version 0.41.2

Download

v0.41.2

Statistics

Release Manager @leogr @ekoops

Version 0.41.1

Download

v0.41.1

Bug Fixes

Statistics

Release Manager @FedeDP

Version 0.41.1-rc1

Download

Version 0.41.0

Download

v0.41.0

Breaking Changes :warning:

Major Changes

Minor Changes

Bug Fixes

Non user-facing changes

Statistics

Release Manager @FedeDP

Version 0.41.0-rc2

Download

Version 0.41.0-rc1

Download

Version 0.40.0

Download

v0.40.0

Breaking Changes :warning:

Major Changes

Minor Changes

Bug Fixes

Non user-facing changes

Statistics

Release Manager @FedeDP

Version 0.40.0-rc1

Download

Version 0.39.2

Download