v1.7.0-rc2

Changes

• refact whitelist/allowlist: net.IP to net/netip (#3683) @mmetc
• refact: pkg/database decisions filter, queries (#3635) @mmetc

New Features

• cscli setup: new service detection and configuration (#3730) @mmetc
• feat: add swarm support to docker acquistion (#3744) @LaurenceJJones

Improvements

• cscli: print command name along with errors (#3768) @mmetc
• enhance: Add 2 time helpers for average and median (#3748) @LaurenceJJones
• usage metrics: report acquisition + parsers metrics to LAPI (#3709) @blotus
• improve datasource validation (goccy/go-yaml) (#3646) @mmetc

Bug Fixes

• fix timemachine lock (#3767) @sabban
• appsec: properly set URI in the original request object for use in hooks (#3755) @blotus

Chore / Deps

• build(deps): bump github.com/go-sql-driver/mysql from 1.6.0 to 1.9.3 (#3761) @dependabot[bot]
• build(deps): bump github.com/go-openapi/swag from 0.23.0 to 0.23.1 (#3763) @dependabot[bot]
• build(deps): bump github.com/hashicorp/go-version from 1.2.1 to 1.7.0 (#3764) @dependabot[bot]
• build(deps): bump github/codeql-action from 3.29.4 to 3.29.5 (#3765) @dependabot[bot]
• build(deps): bump github.com/alexliesenfeld/health from 0.8.0 to 0.8.1 (#3760) @dependabot[bot]
• build(deps): bump github.com/r3labs/diff/v2 from 2.14.1 to 2.15.1 (#3721) @dependabot[bot]
• build(deps): bump google.golang.org/grpc from 1.67.1 to 1.74.2 (#3750) @dependabot[bot]
• build(deps): bump github.com/go-openapi/validate from 0.20.0 to 0.24.0 (#3719) @dependabot[bot]
• build(deps): bump github.com/sanity-io/litter from 1.5.5 to 1.5.8 (#3720) @dependabot[bot]
• build(deps): bump golang.org/x/net from 0.41.0 to 0.42.0 (#3749) @dependabot[bot]
• build(deps): bump astral-sh/setup-uv from 6.4.1 to 6.4.3 (#3753) @dependabot[bot]
• build(deps): bump github/codeql-action from 3.29.2 to 3.29.4 (#3751) @dependabot[bot]
• build(deps): bump golang.org/x/mod from 0.25.0 to 0.26.0 (#3746) @dependabot[bot]

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.7.0-rc1

Changes

• refact whitelist/allowlist: net.IP to net/netip (#3683) @mmetc
• refact: pkg/database decisions filter, queries (#3635) @mmetc

Improvements

• enhance: Add 2 time helpers for average and median (#3748) @LaurenceJJones
• usage metrics: report acquisition + parsers metrics to LAPI (#3709) @blotus
• improve datasource validation (goccy/go-yaml) (#3646) @mmetc

Bug Fixes

• appsec: properly set URI in the original request object for use in hooks (#3755) @blotus

Chore / Deps

• build(deps): bump github.com/r3labs/diff/v2 from 2.14.1 to 2.15.1 (#3721) @dependabot[bot]
• build(deps): bump google.golang.org/grpc from 1.67.1 to 1.74.2 (#3750) @dependabot[bot]
• build(deps): bump github.com/go-openapi/validate from 0.20.0 to 0.24.0 (#3719) @dependabot[bot]
• build(deps): bump github.com/sanity-io/litter from 1.5.5 to 1.5.8 (#3720) @dependabot[bot]
• build(deps): bump golang.org/x/net from 0.41.0 to 0.42.0 (#3749) @dependabot[bot]
• build(deps): bump astral-sh/setup-uv from 6.4.1 to 6.4.3 (#3753) @dependabot[bot]
• build(deps): bump github/codeql-action from 3.29.2 to 3.29.4 (#3751) @dependabot[bot]
• build(deps): bump golang.org/x/mod from 0.25.0 to 0.26.0 (#3746) @dependabot[bot]

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.11

Warning

This release fixes an issue with the Windows version of CrowdSec that prevented it from shutting down properly.
Due to this issue, the service will not stop automatically when updating to this version.
You will need to manually kill the CrowdSec process in Task Manager before running the installer.

This release mainly contains small fixes:

• Fixed an issue preventing proper shutdown on Windows
• Fixed an issue when importing decisions where allowlists were not always checked

Changes

• update lint configuration (#3667) @mmetc
• context.Background() -> t.Context() (#3739) @mmetc

Bug Fixes

• fix: normalize scope within range to ensure allowlist check (#3735) @LaurenceJJones
• cscli: don't assume master hub branch if version check fails (after retrying) (#3732) @mmetc
• windows: fix service getting stuck on shutdown (#3733) @blotus

Chore / Deps

• build(deps): bump golang.org/x/text from 0.26.0 to 0.27.0 (#3741) @dependabot[bot]
• build(deps): bump astral-sh/setup-uv from 6.3.1 to 6.4.1 (#3737) @dependabot[bot]
• build(deps): bump github.com/blackfireio/osinfo from 1.0.5 to 1.1.0 (#3718) @dependabot[bot]
• build(deps): bump github.com/crowdsecurity/dlog from 0.0.0-20170105205344-4fb5f8204f26 to 0.0.2 (#3717) @dependabot[bot]
• docker: document console options (#3724) @blotus

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.10

Overview

This release mostly focuses on small bug fixes and improvements:

• WAF: fixed a resource leak in the appsec datasource when checking bouncer authentication
• Allowlists: added cscli allowlists check to check if an IP/range belongs to an allowlist
• S3 datasource: added support for SNS notifications
• HTTP datasource: added support for GET and HEAD requests to allow the log provider to confirm the datasource is working.

Full changelog is below.

Improvements

• enhance: Add allowlist check (#3684) @LaurenceJJones
• Flags for console features (#3457) @Simbiat
• HTTP datasource: allow GET/HEAD request for checking if the datasource is working (#3710) @blotus
• enhance: appsec reuse httpc optimization (#3693) @LaurenceJJones
• hubtest: resolve relative path for 'cscli', 'crowdsec' (#3651) @mmetc
• refact pkg/cwhub (#3666) @mmetc
• S3 datasource: add support for SNS format (#3716) @blotus

Changes

• refact pkg/acquisition: extract loop method (#3615) @mmetc
• refact: plugin config parsing (#3640) @mmetc
• refact: migrate net.IP -> net/netip: part 1 (#3680) @mmetc
• use github.com/cenkalti/backoff/v5 for apiclient backoff (#3662) @mmetc
• use go 1.24.4 (#3674) @mmetc
• cscli help typos (#3707) @mmetc
• move cti expr helper to pkg/cticlient (#3696) @mmetc
• refact csplugin: move ProfileAlert to models (#3671) @mmetc
• refact cmd/crowdsec: extract functions from runCrowdsec() (#3669) @mmetc
• cscli capi register: no error if online_api_credentials.yaml does not exist (#3645) @mmetc
• refact cmd/crowdsec: move plugin initialization to apiserver (#3668) @mmetc
• lint: require name on interface parameters (#3614) @mmetc
• unit tests: rename ./tests, ./test_data -> ./testdata (#3673) @mmetc

Bug Fixes

• Fix infinite loop in decisions list for some values of limit (#3695) @blotus
• fix: Reset datafiles before loading the hub on HUP (#3712) @LaurenceJJones
• fix: allowlist use content created at instead of list itself (#3703) @LaurenceJJones
• pkg/apiserver: remove incorrect log.Error (#3672) @mmetc

Chore / Deps

• dependabot: set kind/dependencies label (#3722) @blotus
• CI: update action deps (#3692) @mmetc
• update golangci-lint v2.2 and config (#3713) @mmetc
• refact: replace iplib with net/netip (#3642) @mmetc
• update hashicorp/go-plugin (#3694) @mmetc
• update github.com/jedib0t/go-pretty/ (#3705) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.10-rc1

Changes

• refact pkg/acquisition: extract loop method (#3615) @mmetc
• refact: plugin config parsing (#3640) @mmetc
• refact: migrate net.IP -> net/netip: part 1 (#3680) @mmetc
• use github.com/cenkalti/backoff/v5 for apiclient backoff (#3662) @mmetc
• use go 1.24.4 (#3674) @mmetc
• cscli help typos (#3707) @mmetc
• move cti expr helper to pkg/cticlient (#3696) @mmetc
• refact csplugin: move ProfileAlert to models (#3671) @mmetc
• refact cmd/crowdsec: extract functions from runCrowdsec() (#3669) @mmetc
• cscli capi register: no error if online_api_credentials.yaml does not exist (#3645) @mmetc
• refact cmd/crowdsec: move plugin initialization to apiserver (#3668) @mmetc
• lint: require name on interface parameters (#3614) @mmetc
• unit tests: rename ./tests, ./test_data -> ./testdata (#3673) @mmetc

Improvements

• enhance: Add allowlist check (#3684) @LaurenceJJones
• Flags for console features (#3457) @Simbiat
• HTTP datasource: allow GET/HEAD request for checking if the datasource is working (#3710) @blotus
• enhance: appsec reuse httpc optimization (#3693) @LaurenceJJones
• hubtest: resolve relative path for 'cscli', 'crowdsec' (#3651) @mmetc
• refact pkg/cwhub (#3666) @mmetc
• S3 datasource: add support for SNS format (#3716) @blotus

Bug Fixes

• Fix infinite loop in decisions list for some values of limit (#3695) @blotus
• fix: Reset datafiles before loading the hub on HUP (#3712) @LaurenceJJones
• fix: allowlist use content created at instead of list itself (#3703) @LaurenceJJones
• pkg/apiserver: remove incorrect log.Error (#3672) @mmetc

Chore / Deps

• dependabot: set kind/dependencies label (#3722) @blotus
• CI: update action deps (#3692) @mmetc
• update golangci-lint v2.2 and config (#3713) @mmetc
• refact: replace iplib with net/netip (#3642) @mmetc
• update hashicorp/go-plugin (#3694) @mmetc
• update github.com/jedib0t/go-pretty/ (#3705) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.9

Overview

Warning

Docker acquisition now requires access to the events API endpoint. If you are using a socket proxy, make sure to update its configuration.

• Improved performance for the docker datasource by using docker events instead of polling the docker API to detect new containers
• Added a new option to allow a log processor to unregister itself from LAPI on shutdown. This is especially useful in a dynamic environment (eg, kubernetes) where nodes come and go to keep a clean list of active log processors.
• When an allowlist is created (or updated), matching active decisions will be deleted automatically.
• Polling API (PAPI) will be automatically enabled or disabled when crowdsec detects the user's console plan has changed, making the initial setup easier.

Changes

• fix PAPI failure to stop on reload (#3679) @blotus
• update coraza (#3675) @blotus
• modernize: replace legacy slice/map/range idioms with stdlib (#3658) @mmetc
• CI: ensure tests don't alter the repository (#3616) @mmetc
• refact apiclient.Config: remove field Scenarios (#3622) @mmetc
• CI: release-drafter configuration: permissions, skip-changelog label (#3631) @mmetc
• refact: cleanup bats helper (#3636) @mmetc
• refact cmd/crowdsec: remove login code obsoleted by 16d0677 (#3620) @mmetc
• CI: update codecov list and fix workflow (#3617) @mmetc
• refact pkg/database: unnecessary pointers (#3611) @mmetc
• CI: update action for generating docker description (#3559) @mmetc
• refact pkg/parser: extract method, avoid calling defer in loop (#3564) @mmetc
• refact: remove unused metod DeleteDecisionsWithFilter() (#3605) @mmetc
• refact alert, decision filters: remove unnecessary pointers (#3607) @mmetc
• CI: update lint complexity thresholds (#3608) @mmetc
• refactor pkg/database/Client.createAlertChunk() (#3585) @mmetc
• refact cscli: hub item - pointer receiver for consistency (#3595) @mmetc
• CI: remove obsolete reference to directory dyn-bats (#3600) @mmetc
• refact: pkg/exprhelpers/debugger, convert switch to function dispatch (#3587) @mmetc
• lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer (#3583) @mmetc
• refact pkg/database: dry decision count (#3586) @mmetc
• refact parser Init: argument types (#3578) @mmetc
• tests: refact localtest helper, use testify.suite (#3574) @mmetc
• refact: logrus.GetLevel() -> logrus.IsLevelEnabled() (#3579) @mmetc
• test: add cold log event assert (#3577) @mmetc
• Refact pkg/database/decisions.go (#3541) @mmetc
• replace go-acc, richgo with gotestsum (#3567) @mmetc
• refact pkg/hubtest: use os.CopyFS() (#3539) @mmetc
• lint/refactor: defer, reflectvaluecompare, stylecheck (#3544) @mmetc
• CI: golangci-lint v2 (#3558) @mmetc

New Features

• allow watcher to self-delete on shutdown (#3565) @blotus
• allowlists: check during bulk decision import (#3588) @mmetc

Improvements

• PAPI: auto enable on upgrade (#3659) @blotus
• enhance: Remove docker acquis internal timer use docker events (#3598) @LaurenceJJones
• kafka: expose batching configuration (#3621) @blotus
• feat(apiclient): add token save functionality (#3639) @sabban
• enhance: return err if notification has no plugin type (#3638) @LaurenceJJones
• cscli capi status: save auth token, add tests (#3623) @mmetc
• config.yaml: make config_dir and notification_dir optional (#3606) @mmetc
• feat(apic): add ApicAuth client and token re-authentication logic (#3522) @sabban
• allowlists: automatically expire current matching decisions on update (#3601) @blotus
• improve support for parsing time durations with 'day' units (#3599) @mmetc
• cscli inspect: don't show metrics or converted rules if an item is not installed (#3602) @mmetc
• Fix monitorNewFiles for NFS + Remove dead tails from tail map (#3508) @david-garcia-garcia
• enhance: add listen_socket to http acquisition (#3499) @LaurenceJJones
• enhance: Allow the use of 'd' suffix in profiles (#3594) @LaurenceJJones
• lapi: return specific error if a unix socket path is too long for the OS (#3593) @mmetc
• do not return an error if we cannot fetch allowlists when starting the appsec (#3550) @blotus
• Support WithUserAgent in cti client (#3542) @AlteredCoder

Bug Fixes

• appsec: do not query LAPI multiple times when checking auth (#3678) @blotus
• kakfa: properly start at last offset when using a consumer group (#3629) @blotus
• cscli: handle sigint/sigterm, cancel context of ongoing http req (#3660) @mmetc
• Makefile: typo (#3628) @mmetc
• Fix spelling mistake in metrics.go (#3618) @robigan
• fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate (#3613) @sabban
• Fix cp -n (#3483) @michacassola
• CI: correct uv.lock path (#3596) @mmetc
• make CTI client available in cscli notifications (#3591) @blotus
• fix: avoid possible race condition while compiling expressions (#3582) @mmetc
• fix mysql client certificate support (#3575) @blotus
• fix: error check on postoverflow config (#3576) @mmetc
• hubtests: correct basename check in parser tests (#3557) @mmetc

Chore / Deps

• update test/README.md (#3652) @mmetc
• go.mod/sum cleanup (#3661) @mmetc
• update coraza (#3657) @blotus
• deprecate option 'daemonize' (#3648) @mmetc
• update expr to 1.17.2 (#3519) @mmetc
• CI: use go 1.24.3 (#3612) @mmetc
• build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 (#3581) @dependabot[bot]
• enable codeql for python (#3545) @mmetc
• update golangci-lint (#3590) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.9-rc5

Changes

• fix PAPI failure to stop on reload (#3679) @blotus
• update coraza (#3675) @blotus
• modernize: replace legacy slice/map/range idioms with stdlib (#3658) @mmetc
• CI: ensure tests don't alter the repository (#3616) @mmetc
• refact apiclient.Config: remove field Scenarios (#3622) @mmetc
• CI: release-drafter configuration: permissions, skip-changelog label (#3631) @mmetc
• refact: cleanup bats helper (#3636) @mmetc
• refact cmd/crowdsec: remove login code obsoleted by 16d0677 (#3620) @mmetc
• CI: update codecov list and fix workflow (#3617) @mmetc
• refact pkg/database: unnecessary pointers (#3611) @mmetc
• CI: update action for generating docker description (#3559) @mmetc
• refact pkg/parser: extract method, avoid calling defer in loop (#3564) @mmetc
• refact: remove unused metod DeleteDecisionsWithFilter() (#3605) @mmetc
• refact alert, decision filters: remove unnecessary pointers (#3607) @mmetc
• CI: update lint complexity thresholds (#3608) @mmetc
• refactor pkg/database/Client.createAlertChunk() (#3585) @mmetc
• refact cscli: hub item - pointer receiver for consistency (#3595) @mmetc
• CI: remove obsolete reference to directory dyn-bats (#3600) @mmetc
• refact: pkg/exprhelpers/debugger, convert switch to function dispatch (#3587) @mmetc
• lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer (#3583) @mmetc
• refact pkg/database: dry decision count (#3586) @mmetc
• refact parser Init: argument types (#3578) @mmetc
• tests: refact localtest helper, use testify.suite (#3574) @mmetc
• refact: logrus.GetLevel() -> logrus.IsLevelEnabled() (#3579) @mmetc
• test: add cold log event assert (#3577) @mmetc
• Refact pkg/database/decisions.go (#3541) @mmetc
• replace go-acc, richgo with gotestsum (#3567) @mmetc
• refact pkg/hubtest: use os.CopyFS() (#3539) @mmetc
• lint/refactor: defer, reflectvaluecompare, stylecheck (#3544) @mmetc
• CI: golangci-lint v2 (#3558) @mmetc

New Features

• allow watcher to self-delete on shutdown (#3565) @blotus
• allowlists: check during bulk decision import (#3588) @mmetc

Improvements

• PAPI: auto enable on upgrade (#3659) @blotus
• enhance: Remove docker acquis internal timer use docker events (#3598) @LaurenceJJones
• kafka: expose batching configuration (#3621) @blotus
• feat(apiclient): add token save functionality (#3639) @sabban
• enhance: return err if notification has no plugin type (#3638) @LaurenceJJones
• cscli capi status: save auth token, add tests (#3623) @mmetc
• config.yaml: make config_dir and notification_dir optional (#3606) @mmetc
• feat(apic): add ApicAuth client and token re-authentication logic (#3522) @sabban
• allowlists: automatically expire current matching decisions on update (#3601) @blotus
• improve support for parsing time durations with 'day' units (#3599) @mmetc
• cscli inspect: don't show metrics or converted rules if an item is not installed (#3602) @mmetc
• Fix monitorNewFiles for NFS + Remove dead tails from tail map (#3508) @david-garcia-garcia
• enhance: add listen_socket to http acquisition (#3499) @LaurenceJJones
• enhance: Allow the use of 'd' suffix in profiles (#3594) @LaurenceJJones
• lapi: return specific error if a unix socket path is too long for the OS (#3593) @mmetc
• do not return an error if we cannot fetch allowlists when starting the appsec (#3550) @blotus
• Support WithUserAgent in cti client (#3542) @AlteredCoder

Bug Fixes

• appsec: do not query LAPI multiple times when checking auth (#3678) @blotus
• kakfa: properly start at last offset when using a consumer group (#3629) @blotus
• cscli: handle sigint/sigterm, cancel context of ongoing http req (#3660) @mmetc
• Makefile: typo (#3628) @mmetc
• Fix spelling mistake in metrics.go (#3618) @robigan
• fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate (#3613) @sabban
• Fix cp -n (#3483) @michacassola
• CI: correct uv.lock path (#3596) @mmetc
• make CTI client available in cscli notifications (#3591) @blotus
• fix: avoid possible race condition while compiling expressions (#3582) @mmetc
• fix mysql client certificate support (#3575) @blotus
• fix: error check on postoverflow config (#3576) @mmetc
• hubtests: correct basename check in parser tests (#3557) @mmetc

Chore / Deps

• update test/README.md (#3652) @mmetc
• go.mod/sum cleanup (#3661) @mmetc
• update coraza (#3657) @blotus
• deprecate option 'daemonize' (#3648) @mmetc
• update expr to 1.17.2 (#3519) @mmetc
• CI: use go 1.24.3 (#3612) @mmetc
• build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 (#3581) @dependabot[bot]
• enable codeql for python (#3545) @mmetc
• update golangci-lint (#3590) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.9-rc4

Changes

• update coraza (#3675) @blotus
• modernize: replace legacy slice/map/range idioms with stdlib (#3658) @mmetc
• CI: ensure tests don't alter the repository (#3616) @mmetc
• refact apiclient.Config: remove field Scenarios (#3622) @mmetc
• CI: release-drafter configuration: permissions, skip-changelog label (#3631) @mmetc
• refact: cleanup bats helper (#3636) @mmetc
• refact cmd/crowdsec: remove login code obsoleted by 16d0677 (#3620) @mmetc
• CI: update codecov list and fix workflow (#3617) @mmetc
• refact pkg/database: unnecessary pointers (#3611) @mmetc
• CI: update action for generating docker description (#3559) @mmetc
• refact pkg/parser: extract method, avoid calling defer in loop (#3564) @mmetc
• refact: remove unused metod DeleteDecisionsWithFilter() (#3605) @mmetc
• refact alert, decision filters: remove unnecessary pointers (#3607) @mmetc
• CI: update lint complexity thresholds (#3608) @mmetc
• refactor pkg/database/Client.createAlertChunk() (#3585) @mmetc
• refact cscli: hub item - pointer receiver for consistency (#3595) @mmetc
• CI: remove obsolete reference to directory dyn-bats (#3600) @mmetc
• refact: pkg/exprhelpers/debugger, convert switch to function dispatch (#3587) @mmetc
• lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer (#3583) @mmetc
• refact pkg/database: dry decision count (#3586) @mmetc
• refact parser Init: argument types (#3578) @mmetc
• tests: refact localtest helper, use testify.suite (#3574) @mmetc
• refact: logrus.GetLevel() -> logrus.IsLevelEnabled() (#3579) @mmetc
• test: add cold log event assert (#3577) @mmetc
• Refact pkg/database/decisions.go (#3541) @mmetc
• replace go-acc, richgo with gotestsum (#3567) @mmetc
• refact pkg/hubtest: use os.CopyFS() (#3539) @mmetc
• lint/refactor: defer, reflectvaluecompare, stylecheck (#3544) @mmetc
• CI: golangci-lint v2 (#3558) @mmetc

New Features

• allow watcher to self-delete on shutdown (#3565) @blotus
• allowlists: check during bulk decision import (#3588) @mmetc

Improvements

• PAPI: auto enable on upgrade (#3659) @blotus
• enhance: Remove docker acquis internal timer use docker events (#3598) @LaurenceJJones
• kafka: expose batching configuration (#3621) @blotus
• feat(apiclient): add token save functionality (#3639) @sabban
• enhance: return err if notification has no plugin type (#3638) @LaurenceJJones
• cscli capi status: save auth token, add tests (#3623) @mmetc
• config.yaml: make config_dir and notification_dir optional (#3606) @mmetc
• feat(apic): add ApicAuth client and token re-authentication logic (#3522) @sabban
• allowlists: automatically expire current matching decisions on update (#3601) @blotus
• improve support for parsing time durations with 'day' units (#3599) @mmetc
• cscli inspect: don't show metrics or converted rules if an item is not installed (#3602) @mmetc
• Fix monitorNewFiles for NFS + Remove dead tails from tail map (#3508) @david-garcia-garcia
• enhance: add listen_socket to http acquisition (#3499) @LaurenceJJones
• enhance: Allow the use of 'd' suffix in profiles (#3594) @LaurenceJJones
• lapi: return specific error if a unix socket path is too long for the OS (#3593) @mmetc
• do not return an error if we cannot fetch allowlists when starting the appsec (#3550) @blotus
• Support WithUserAgent in cti client (#3542) @AlteredCoder

Bug Fixes

• kakfa: properly start at last offset when using a consumer group (#3629) @blotus
• cscli: handle sigint/sigterm, cancel context of ongoing http req (#3660) @mmetc
• Makefile: typo (#3628) @mmetc
• Fix spelling mistake in metrics.go (#3618) @robigan
• fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate (#3613) @sabban
• Fix cp -n (#3483) @michacassola
• CI: correct uv.lock path (#3596) @mmetc
• make CTI client available in cscli notifications (#3591) @blotus
• fix: avoid possible race condition while compiling expressions (#3582) @mmetc
• fix mysql client certificate support (#3575) @blotus
• fix: error check on postoverflow config (#3576) @mmetc
• hubtests: correct basename check in parser tests (#3557) @mmetc

Chore / Deps

• update test/README.md (#3652) @mmetc
• go.mod/sum cleanup (#3661) @mmetc
• update coraza (#3657) @blotus
• deprecate option 'daemonize' (#3648) @mmetc
• update expr to 1.17.2 (#3519) @mmetc
• CI: use go 1.24.3 (#3612) @mmetc
• build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 (#3581) @dependabot[bot]
• enable codeql for python (#3545) @mmetc
• update golangci-lint (#3590) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.9-rc3

Changes

• modernize: replace legacy slice/map/range idioms with stdlib (#3658) @mmetc
• CI: ensure tests don't alter the repository (#3616) @mmetc
• refact apiclient.Config: remove field Scenarios (#3622) @mmetc
• CI: release-drafter configuration: permissions, skip-changelog label (#3631) @mmetc
• refact: cleanup bats helper (#3636) @mmetc
• refact cmd/crowdsec: remove login code obsoleted by 16d0677 (#3620) @mmetc
• CI: update codecov list and fix workflow (#3617) @mmetc
• refact pkg/database: unnecessary pointers (#3611) @mmetc
• CI: update action for generating docker description (#3559) @mmetc
• refact pkg/parser: extract method, avoid calling defer in loop (#3564) @mmetc
• refact: remove unused metod DeleteDecisionsWithFilter() (#3605) @mmetc
• refact alert, decision filters: remove unnecessary pointers (#3607) @mmetc
• CI: update lint complexity thresholds (#3608) @mmetc
• refactor pkg/database/Client.createAlertChunk() (#3585) @mmetc
• refact cscli: hub item - pointer receiver for consistency (#3595) @mmetc
• CI: remove obsolete reference to directory dyn-bats (#3600) @mmetc
• refact: pkg/exprhelpers/debugger, convert switch to function dispatch (#3587) @mmetc
• lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer (#3583) @mmetc
• refact pkg/database: dry decision count (#3586) @mmetc
• refact parser Init: argument types (#3578) @mmetc
• tests: refact localtest helper, use testify.suite (#3574) @mmetc
• refact: logrus.GetLevel() -> logrus.IsLevelEnabled() (#3579) @mmetc
• test: add cold log event assert (#3577) @mmetc
• Refact pkg/database/decisions.go (#3541) @mmetc
• replace go-acc, richgo with gotestsum (#3567) @mmetc
• refact pkg/hubtest: use os.CopyFS() (#3539) @mmetc
• lint/refactor: defer, reflectvaluecompare, stylecheck (#3544) @mmetc
• CI: golangci-lint v2 (#3558) @mmetc

New Features

• allow watcher to self-delete on shutdown (#3565) @blotus
• allowlists: check during bulk decision import (#3588) @mmetc

Improvements

• PAPI: auto enable on upgrade (#3659) @blotus
• enhance: Remove docker acquis internal timer use docker events (#3598) @LaurenceJJones
• kafka: expose batching configuration (#3621) @blotus
• feat(apiclient): add token save functionality (#3639) @sabban
• enhance: return err if notification has no plugin type (#3638) @LaurenceJJones
• cscli capi status: save auth token, add tests (#3623) @mmetc
• config.yaml: make config_dir and notification_dir optional (#3606) @mmetc
• feat(apic): add ApicAuth client and token re-authentication logic (#3522) @sabban
• allowlists: automatically expire current matching decisions on update (#3601) @blotus
• improve support for parsing time durations with 'day' units (#3599) @mmetc
• cscli inspect: don't show metrics or converted rules if an item is not installed (#3602) @mmetc
• Fix monitorNewFiles for NFS + Remove dead tails from tail map (#3508) @david-garcia-garcia
• enhance: add listen_socket to http acquisition (#3499) @LaurenceJJones
• enhance: Allow the use of 'd' suffix in profiles (#3594) @LaurenceJJones
• lapi: return specific error if a unix socket path is too long for the OS (#3593) @mmetc
• do not return an error if we cannot fetch allowlists when starting the appsec (#3550) @blotus
• Support WithUserAgent in cti client (#3542) @AlteredCoder

Bug Fixes

• kakfa: properly start at last offset when using a consumer group (#3629) @blotus
• cscli: handle sigint/sigterm, cancel context of ongoing http req (#3660) @mmetc
• Makefile: typo (#3628) @mmetc
• Fix spelling mistake in metrics.go (#3618) @robigan
• fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate (#3613) @sabban
• Fix cp -n (#3483) @michacassola
• CI: correct uv.lock path (#3596) @mmetc
• make CTI client available in cscli notifications (#3591) @blotus
• fix: avoid possible race condition while compiling expressions (#3582) @mmetc
• fix mysql client certificate support (#3575) @blotus
• fix: error check on postoverflow config (#3576) @mmetc
• hubtests: correct basename check in parser tests (#3557) @mmetc

Chore / Deps

• update test/README.md (#3652) @mmetc
• go.mod/sum cleanup (#3661) @mmetc
• update coraza (#3657) @blotus
• deprecate option 'daemonize' (#3648) @mmetc
• update expr to 1.17.2 (#3519) @mmetc
• CI: use go 1.24.3 (#3612) @mmetc
• build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 (#3581) @dependabot[bot]
• enable codeql for python (#3545) @mmetc
• update golangci-lint (#3590) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.9-rc2

Changes

• refact apiclient.Config: remove field Scenarios (#3622) @mmetc
• CI: release-drafter configuration: permissions, skip-changelog label (#3631) @mmetc
• refact: cleanup bats helper (#3636) @mmetc
• refact cmd/crowdsec: remove login code obsoleted by 16d0677 (#3620) @mmetc
• CI: update codecov list and fix workflow (#3617) @mmetc
• refact pkg/database: unnecessary pointers (#3611) @mmetc
• CI: update action for generating docker description (#3559) @mmetc
• refact pkg/parser: extract method, avoid calling defer in loop (#3564) @mmetc
• refact: remove unused metod DeleteDecisionsWithFilter() (#3605) @mmetc
• refact alert, decision filters: remove unnecessary pointers (#3607) @mmetc
• CI: update lint complexity thresholds (#3608) @mmetc
• refactor pkg/database/Client.createAlertChunk() (#3585) @mmetc
• refact cscli: hub item - pointer receiver for consistency (#3595) @mmetc
• CI: remove obsolete reference to directory dyn-bats (#3600) @mmetc
• refact: pkg/exprhelpers/debugger, convert switch to function dispatch (#3587) @mmetc
• lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer (#3583) @mmetc
• refact pkg/database: dry decision count (#3586) @mmetc
• refact parser Init: argument types (#3578) @mmetc
• tests: refact localtest helper, use testify.suite (#3574) @mmetc
• refact: logrus.GetLevel() -> logrus.IsLevelEnabled() (#3579) @mmetc
• test: add cold log event assert (#3577) @mmetc
• Refact pkg/database/decisions.go (#3541) @mmetc
• replace go-acc, richgo with gotestsum (#3567) @mmetc
• refact pkg/hubtest: use os.CopyFS() (#3539) @mmetc
• lint/refactor: defer, reflectvaluecompare, stylecheck (#3544) @mmetc
• CI: golangci-lint v2 (#3558) @mmetc

New Features

• allowlists: check during bulk decision import (#3588) @mmetc

Improvements

• enhance: Remove docker acquis internal timer use docker events (#3598) @LaurenceJJones
• kafka: expose batching configuration (#3621) @blotus
• feat(apiclient): add token save functionality (#3639) @sabban
• enhance: return err if notification has no plugin type (#3638) @LaurenceJJones
• cscli capi status: save auth token, add tests (#3623) @mmetc
• config.yaml: make config_dir and notification_dir optional (#3606) @mmetc
• feat(apic): add ApicAuth client and token re-authentication logic (#3522) @sabban
• allowlists: automatically expire current matching decisions on update (#3601) @blotus
• improve support for parsing time durations with 'day' units (#3599) @mmetc
• cscli inspect: don't show metrics or converted rules if an item is not installed (#3602) @mmetc
• Fix monitorNewFiles for NFS + Remove dead tails from tail map (#3508) @david-garcia-garcia
• enhance: add listen_socket to http acquisition (#3499) @LaurenceJJones
• enhance: Allow the use of 'd' suffix in profiles (#3594) @LaurenceJJones
• lapi: return specific error if a unix socket path is too long for the OS (#3593) @mmetc
• do not return an error if we cannot fetch allowlists when starting the appsec (#3550) @blotus
• Support WithUserAgent in cti client (#3542) @AlteredCoder

Bug Fixes

• Makefile: typo (#3628) @mmetc
• Fix spelling mistake in metrics.go (#3618) @robigan
• fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate (#3613) @sabban
• Fix cp -n (#3483) @michacassola
• CI: correct uv.lock path (#3596) @mmetc
• make CTI client available in cscli notifications (#3591) @blotus
• fix: avoid possible race condition while compiling expressions (#3582) @mmetc
• fix mysql client certificate support (#3575) @blotus
• fix: error check on postoverflow config (#3576) @mmetc
• hubtests: correct basename check in parser tests (#3557) @mmetc

Chore / Deps

• update expr to 1.17.2 (#3519) @mmetc
• CI: use go 1.24.3 (#3612) @mmetc
• build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 (#3581) @dependabot[bot]
• enable codeql for python (#3545) @mmetc
• update golangci-lint (#3590) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.