0.40.0

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.40.0
docker pull public.ecr.aws/falcosecurity/falco:0.40.0
docker pull docker.io/falcosecurity/falco-driver-loader:0.40.0
docker pull docker.io/falcosecurity/falco-driver-loader:0.40.0-buster
docker pull docker.io/falcosecurity/falco:0.40.0-debian

v0.40.0

Released on 2025-01-28

Breaking Changes ⚠️

• cleanup(userspac/falco)!: drop deprecated options. [#3361] - @FedeDP

Major Changes

• new(docker): streamline docker images [#3273] - @FedeDP
• new(build): reintroduce static build [#3428] - @LucaGuerra
• new(cmake,ci): added support for using jemalloc allocator instead of glibc one and use it by default for release artifacts [#3406] - @FedeDP
• new(userspace,cmake): honor new plugins exposed suggested output formats [#3388] - @FedeDP
• new(userspace/falco): allow entirely disabling plugin hostinfo support. [#3412] - @FedeDP
• new(ci): use zig compiler instead of relying on centos7. [#3307] - @FedeDP
• new(falco): add buffer_format_base64 option, deprecate -b [#3358] - @LucaGuerra
• new(falco): add base_syscalls.all option to falco.yaml, deprecate -A [#3352] - @LucaGuerra
• new(falco): add falco_libs.snaplen option, deprecate -S / --snaplen [#3362] - @LucaGuerra

Minor Changes

• update(cmake): bump falcoctl to v0.11.0 [#3467] - @alacuku
• chore(ci): add attestation for falco [#3216] - @cpanato
• chore(ci): build Falco in RelWithDebInfo, and upload Falco debug symbols as github artifacts [#3452] - @FedeDP
• update(build): DEB and RPM package requirements for dkms and kernel-devel are now suggestions [#3450] - @jthiltges

Bug Fixes

• fix(userspace/falco): fix container_engines.cri.sockets not loading from config file [#3453] - @zayaanmoez
• fix(docker): /usr/src/'*' no longer created if $HOST_PATH/usr/src didn't exist at startup [#3434] - @shane-lawrence
• fix(docker): add brotli to the Falco image [#3399] - @LucaGuerra
• fix(userspace/engine): explicitly disallow appending/modifying a rule with different sources [#3383] - @mstemm

Non user-facing changes

• chore(falco.yaml): remove comments about cri cli arguments [#3458] - @alacuku
• fix(ci): fixed reusable_build/publish_docker workflows. [#3459] - @FedeDP
• update(cmake): update libs and driver to latest master [#3455] - @github-actions[bot]
• chore(ci): bumped actions/upload-download-artifact. [#3454] - @FedeDP
• chore(docker): drop unused libelf dep from container images [#3451] - @leogr
• chore(docs): update plugins_hostinfo config file comment. [#3449] - @FedeDP
• new(build): add RelWithDebInfo target [#3440] - @shane-lawrence
• chore(deps): Bump submodules/falcosecurity-rules from 283a62f to abf6637 [#3448] - @dependabot[bot]
• update(ci): use 4cpu-16gb arm runners [#3447] - @LucaGuerra
• update(cmake): update libs and driver to latest master [#3439] - @github-actions[bot]
• chore: avoid deprecated funcs to calculate sha256 [#3442] - @federico-sysdig
• chore(ci): enable jemalloc in musl build. [#3436] - @FedeDP
• docs(falco.yaml): correct buffered_outputs description [#3427] - @leogr
• fix(userspace/falco): use correct filtercheck_field_info. [#3426] - @FedeDP
• update(cmake): update libs and driver to latest master [#3421] - @github-actions[bot]
• fix: update the url for the docs about the concurrent queue classes [#3415] - @Issif
• update(changelog): updated changelog for 0.39.2. [#3410] - @FedeDP
• update(cmake): update libs and driver to latest master [#3392] - @github-actions[bot]
• fix(cmake,docker): avoid cpp-httplib requiring brotli. [#3400] - @FedeDP
• chore(deps): Bump submodules/falcosecurity-rules from 407e997 to 283a62f [#3391] - @dependabot[bot]
• update(cmake): bump libs to latest master. [#3389] - @FedeDP
• update(cmake): update libs and driver to latest master [#3385] - @github-actions[bot]
• Make enable()/disable() virtual so they can be overridden [#3375] - @mstemm
• fix(ci): fixed shasum computation for bump-libs CI. [#3379] - @FedeDP
• chore(ci): use redhat advised method to check rpmsign success. [#3376] - @FedeDP
• chore(deps): Bump submodules/falcosecurity-rules from e38fb3f to 407e997 [#3374] - [...

0.40.0-rc1

chore(falco.yaml): remove comments about cri cli arguments

Signed-off-by: Aldo Lacuku <[email protected]>

0.39.2

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.39.2
docker pull public.ecr.aws/falcosecurity/falco:0.39.2
docker pull docker.io/falcosecurity/falco-driver-loader:0.39.2
docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.39.2
docker pull docker.io/falcosecurity/falco-no-driver:0.39.2
docker pull docker.io/falcosecurity/falco-distroless:0.39.2

v0.39.2

Released on 2024-11-21

Minor Changes

• update(cmake): bumped falcoctl to v0.10.1. [#3408] - @FedeDP
• update(cmake): bump yaml-cpp to latest master. [#3394] - @FedeDP

Non user-facing changes

• update(ci): use arm64 CNCF runners for GH actions [#3386] - @LucaGuerra

Statistics

MERGED PRS	NUMBER
Not user-facing	1
Release note	2
Total	3

Release Manager @FedeDP

0.39.1

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.39.1
docker pull public.ecr.aws/falcosecurity/falco:0.39.1
docker pull docker.io/falcosecurity/falco-driver-loader:0.39.1
docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.39.1
docker pull docker.io/falcosecurity/falco-no-driver:0.39.1
docker pull docker.io/falcosecurity/falco-distroless:0.39.1

v0.39.1

Released on 2024-10-09

Bug Fixes

• fix(engine): allow null init_config for plugin info [#3372] - @LucaGuerra
• fix(engine): fix parsing issues in -o key={object} when the object definition contains a comma [#3363] - @LucaGuerra
• fix(userspace/falco): fix event set selection for plugin with parsing capability [#3368] - @FedeDP

Non user-facing changes

• update(changelog): updated changelog for 0.39.1. [#3373] - @FedeDP

Statistics

MERGED PRS	NUMBER
Not user-facing	1
Release note	3
Total	4

Release Manager @FedeDP

0.39.1-rc1

update(changelog): updated changelog for 0.39.1.

Signed-off-by: Federico Di Pierro <[email protected]>

0.39.0

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.39.0
docker pull public.ecr.aws/falcosecurity/falco:0.39.0
docker pull docker.io/falcosecurity/falco-driver-loader:0.39.0
docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.39.0
docker pull docker.io/falcosecurity/falco-no-driver:0.39.0
docker pull docker.io/falcosecurity/falco-distroless:0.39.0

v0.39.0

Released on 2024-10-01

Breaking Changes ⚠️

• fix(falco_metrics)!: split tags label into multiple tag_-prefixed labels [#3337] - @ekoops
• fix(falco_metrics)!: use full name for configs and rules files [#3337] - @ekoops
• update(falco_metrics)!: rearrange n_evts_cpu and n_drops_cpu Prometheus metrics to follow best practices [#3319] - @incertum
• cleanup(userspace/falco)!: drop deprecated -t,-T,-D options. [#3311] - @FedeDP

Major Changes

• feat(stats): add host_netinfo networking information stats family [#3344] - @ekoops
• new(falco): add json_include_message_property to have a message field without date and priority [#3314] - @LucaGuerra
• new(userspace/falco,userspace/engine): rule json schema validation [#3313] - @FedeDP
• new(falco): introduce append_output configuration [#3308] - @LucaGuerra
• new(userspace/falco): added --config-schema action to print config schema [#3312] - @FedeDP
• new(falco): enable CLI options with -o key={object} [#3310] - @LucaGuerra
• new(config): add container_engines config to falco.yaml [#3266] - @incertum
• new(metrics): add host_ifinfo metric [#3253] - @incertum
• new(userspace,unit_tests): validate configs against schema [#3302] - @FedeDP

Minor Changes

• update(falco): upgrade libs to 0.18.1 [#3349] - @LucaGuerra
• update(systemd): users can refer to systemd falco services with a constistent unique alias falco.service [#3332] - @ekoops
• update(cmake): bump libs to 0.18.0 and driver to 7.3.0+driver. [#3330] - @FedeDP
• chore(userspace/falco): deprecate cri related CLI options. [#3329] - @FedeDP
• update(cmake): bumped falcoctl to v0.10.0 and rules to 3.2.0 [#3327] - @FedeDP
• update(falco_metrics): change prometheus rules metric naming [#3324] - @incertum

Bug Fixes

• fix(falco): allow disable_cri_async from both CLI and config [#3353] - @LucaGuerra
• fix(engine): sync outputs before printing stats at shutdown [#3338] - @LucaGuerra
• fix(falco): allow plugin init_config map in json schema [#3335] - @LucaGuerra
• fix(userspace/falco): properly account for plugin with CAP_PARSING when computing interesting sc set [#3334] - @FedeDP

Non user-facing changes

• feat(cmake): add conditional builds for falcoctl and rules paths [#3305] - @tembleking
• cleanup(falco): ignore lint commit [#3354] - @LucaGuerra
• chore(falco): apply code formatting [#3350] - @poiana
• chore: ignore_some_files for clang format [#3351] - @Andreagit97
• sync: release 0.39.x [#3340] - @FedeDP
• fix(userspace/engine): improve rule json schema to account for source and required_plugin_versions [#3328] - @FedeDP
• cleanup(falco): use header file for json schema [#3325] - @LucaGuerra
• update(engine): modify append_output format [#3322] - @LucaGuerra
• chore: scaffolding for enabling code formatting [#3321] - @Andreagit97
• update(cmake): bump libs and driver to 0.18.0-rc1. [#3320] - @FedeDP
• fix(ci): restore master and release CI workflow permissions. [#3317] - @FedeDP
• fixed the token-permission and pinned-dependencies issue [#3299] - @harshitasao
• update(cmake): bump falcoctl to v0.10.0-rc1 [#3316] - @alacuku
• ci(insecure-api): update semgrep docker image [#3315] - @francesco-furlan
• Add demo environment instructions and docker-config files [#3295] - @bbl232
• chore(deps): Bump submodules/falcosecurity-rules from baecf18 to b6ad373 [#3301] - @dependabot[bot]
• update(cmake): bump libs and driver to latest master [#3283] - @jasondellaluce
• chore(deps): Bump submodules/falcosecurity-rules from 342b20d to baecf18 [#3298] - @dependabot[bot]
• chore(deps): Bump submodules/falcosecurity-rules from 068f0f2 to 342b20d [#3288] - @dependabot[bot]
• vote: add sgaist to OWNERS [#3264] - @sgaist
• Add Tulip Retail to adopters list [#3291] - @bbl232
• chore(deps): Bump submodules/falcosecurity-rules from 28b98b6 to 068f0f2 [#3282] - @dependabot[bot]
• chore(deps): Bump submodules/falcosecurit...

0.39.0-rc3

fix(engine): sync outputs before printing stats at shutdown

Signed-off-by: Luca Guerra <[email protected]>

0.39.0-rc2

update(cmake): bump libs to 0.18.0 and driver to 7.3.0+driver.

Signed-off-by: Federico Di Pierro <[email protected]>

0.39.0-rc1

update(cmake): bump libs and driver to 0.18.0-rc2.

Moreover, bumped falcoctl to v0.10.0 and rules to 3.2.0.

Signed-off-by: Federico Di Pierro <[email protected]>

0.38.2

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.38.2
docker pull public.ecr.aws/falcosecurity/falco:0.38.2
docker pull docker.io/falcosecurity/falco-driver-loader:0.38.2
docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.38.2
docker pull docker.io/falcosecurity/falco-no-driver:0.38.2
docker pull docker.io/falcosecurity/falco-distroless:0.38.2

v0.38.2

Released on 2024-08-19

Bug Fixes

• fix(engine): fix metrics names to better adhere to best practices [#3272] - @incertum
• fix(ci): use vault.centos.org for centos:7 CI build. [#3274] - @FedeDP

Statistics

MERGED PRS	NUMBER
Not user-facing	0
Release note	2
Total	2

Release Manager @LucaGuerra