0.37.1

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.37.1
docker pull public.ecr.aws/falcosecurity/falco:0.37.1
docker pull docker.io/falcosecurity/falco-driver-loader:0.37.1
docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.37.1
docker pull docker.io/falcosecurity/falco-no-driver:0.37.1
docker pull docker.io/falcosecurity/falco-distroless:0.37.1

v0.37.1

Released on 2024-02-13

Major Changes

• new(docker): added option for insecure http driver download to falco and driver-loader images [#3058] - @toamto94

Minor Changes

• update(cmake): bumped falcoctl to v0.7.2 [#3076] - @FedeDP
• update(build): link libelf dynamically [#3048] - @LucaGuerra

Bug Fixes

• fix(userspace/engine): always consider all rules (even the ones below min_prio) in m_rule_stats_manager [#3060] - @FedeDP

Non user-facing changes

• sync(docs): cherrypick CHANGELOG entry for 0.37.1 [#3080] - @FedeDP
• Added http headers option for driver download in docker images [#3075] - @toamto94
• fix(build): install libstdc++ in the Wolfi image [#3053] - @LucaGuerra

Statistics

MERGED PRS	NUMBER
Not user-facing	3
Release note	4
Total	7

Release Manager @FedeDP

0.37.1-rc1

update(cmake): bump libs to 0.14.3.

Signed-off-by: Federico Di Pierro <[email protected]>

0.37.0

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.37.0
docker pull public.ecr.aws/falcosecurity/falco:0.37.0
docker pull docker.io/falcosecurity/falco-driver-loader:0.37.0
docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.37.0
docker pull docker.io/falcosecurity/falco-no-driver:0.37.0
docker pull docker.io/falcosecurity/falco-distroless:0.37.0

v0.37.0

Released on 2024-01-30

Breaking Changes ⚠️

• new!: dropped falco-driver-loader script in favor of new falcoctl driver command [#2905] - @FedeDP
• update!: bump libs to latest and deprecation of k8s metadata options and configs [#2914] - @jasondellaluce
• cleanup(falco)!: remove outputs.rate and outputs.max_burst from Falco config [#2841] - @Andreagit97
• cleanup(falco)!: remove --userspace support [#2839] - @Andreagit97

Major Changes

• new(engine): add selective overrides for Falco rules [#2981] - @LucaGuerra
• feat(userspace/falco): falco administrators can now configure the http output to compress the data sent as well as enable keep alive for the connection. Two new fields (compress_uploads and keep_alive) in the http_output block of the falco.yaml file can be used for that purpose. Both are disabled by default. [#2974] - @sgaist
• new(userspace): support env variable expansion in all yaml, even inside strings. [#2918] - @FedeDP
• new(scripts): add a way to enforce driver kind and falcoctl enablement when installing Falco from packages and dialog is not present. [#2773] - @vjjmiras
• new(falco): print system info when Falco starts [#2927] - @Andreagit97
• new: driver selection in falco.yaml [#2413] - @therealbobo
• new(build): enable compilation on win32 and macOS. [#2889] - @therealbobo
• feat(userspace/falco): falco administrators can now configure the address on which the webserver listen using the new listen_address field in the webserver block of the falco.yaml file. [#2890] - @sgaist

Minor Changes

• update(userspace/falco): add engine_version_semver key in /versions endpoint [#2899] - @loresuso
• update: default ruleset upgrade to version 3.0 [#3034] - @leogr
• update!(config): soft deprecation of drop stats counters in syscall_event_drops [#3015] - @incertum
• update(cmake): bumped falcoctl tool to v0.7.1. [#3030] - @FedeDP
• update(rule_loader): deprecate the append flag in Falco rules [#2992] - @Andreagit97
• cleanup!(cmake): drop bundled plugins in Falco [#2997] - @FedeDP
• update(config): clarify deprecation notices + list all env vars [#2988] - @incertum
• update: now the watch_config_files config option monitors file/directory moving and deletion, too [#2965] - @NitroCao
• update(userspace): enhancements in rule description feature [#2934] - @jasondellaluce
• update(userspace/falco): add libsinsp state metrics option [#2883] - @incertum
• update(doc): Add Thought Machine as adopters [#2919] - @RichardoC
• update(docs): add Wireshark/Logray as adopter [#2867] - @geraldcombs
• update: engine_version in semver representation [#2838] - @loresuso
• update(userspace/engine): modularize rule compiler, fix and enrich rule descriptions [#2817] - @jasondellaluce

Bug Fixes

• fix(userspace/metric): minor fixes in new libsinsp state metrics handling [#3033] - @incertum
• fix(userspace/engine): avoid storing escaped strings in engine defs [#3028] - @jasondellaluce
• fix(userspace/engine): cache latest rules compilation output [#2900] - @jasondellaluce
• fix(userspace/engine): solve description of macro-only rules [#2898] - @jasondellaluce
• fix(userspace/engine): fix memory leak [#2877] - @therealbobo

Non user-facing changes

• new(docs): add changelog for 0.37.0 [#3041] - @Andreagit97
• fix: nlohmann_json lib include path [#3032] - @federico-sysdig
• chore: bump falco rules [#3021] - @Andreagit97
• chore: bump Falco to libs 0.14.1 [#3020] - @Andreagit97
• chore(build): remove outdated development libs [#2946] - @federico-sysdig
• chore(falco): bump Falco to 000d576 libs commit [#2944] - @Andreagit97
• fix(gha): update rpmsign [#2856] - @LucaGuerra
• build(deps): Bump submodules/falcosecurity-rules from 424b258 to 1221b9e [#3000] - @dependabot[bot]
• build(deps): Bump submodules/falcosecurity-rules from 2ac430b to c39d31a [#3019] - @dependabot[bot]
• cleanup(falco.yaml): rename none in nodriver [#3012] - @Andreagit97
• update(config): graduate outputs_queue to stable [#3016] - [@incertum](https://github.com/incer...

0.37.0-rc3

What's Changed

• sync: release 0.37.x by @FedeDP in #3035
• update(build): update libs to 0.14.2 by @LucaGuerra in #3036

Full Changelog: 0.37.0-rc2...0.37.0-rc3

0.37.0-rc2

Images
docker pull docker.io/falcosecurity/falco:0.37.0-rc2
docker pull public.ecr.aws/falcosecurity/falco:0.37.0-rc2
docker pull docker.io/falcosecurity/falco-driver-loader:0.37.0-rc2
docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.37.0-rc2
docker pull docker.io/falcosecurity/falco-no-driver:0.37.0-rc2
docker pull docker.io/falcosecurity/falco-distroless:0.37.0-rc2

0.37.0-rc1

Images
docker pull docker.io/falcosecurity/falco:0.37.0-rc1
docker pull public.ecr.aws/falcosecurity/falco:0.37.0-rc1
docker pull docker.io/falcosecurity/falco-driver-loader:0.37.0-rc1
docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.37.0-rc1
docker pull docker.io/falcosecurity/falco-no-driver:0.37.0-rc1
docker pull docker.io/falcosecurity/falco-distroless:0.37.0-rc1

0.36.2

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.36.2
docker pull public.ecr.aws/falcosecurity/falco:0.36.2
docker pull docker.io/falcosecurity/falco-driver-loader:0.36.2
docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.36.2
docker pull docker.io/falcosecurity/falco-no-driver:0.36.2
docker pull docker.io/falcosecurity/falco-distroless:0.36.2

v0.36.2

Released on 2023-10-27

Major Changes

Minor Changes

Bug Fixes

• Bumped libs to 0.13.4

Release Manager @FedeDP

0.36.2-rc1

update(cmake): bumped libs to 0.13.3.

Signed-off-by: Federico Di Pierro <[email protected]>

0.36.1

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.36.1
docker pull public.ecr.aws/falcosecurity/falco:0.36.1
docker pull docker.io/falcosecurity/falco-driver-loader:0.36.1
docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.36.1
docker pull docker.io/falcosecurity/falco-no-driver:0.36.1
docker pull docker.io/falcosecurity/falco-distroless:0.36.1

v0.36.1

Released on 2024-01-30

Major Changes

• feat(userspace): remove experimental outputs queue recovery strategies [#2863] - @incertum

Bug Fixes

• fix(userspace/falco): timer_delete() workaround due to bug in older GLIBC [#2851] - @incertum

Non user-facing changes

• new(docs): add changelog for 0.36.1 [#2872] - @Andreagit97

Statistics

MERGED PRS	NUMBER
Not user-facing	1
Release note	2
Total	3

Release Manager @Andreagit97

0.36.1-rc1

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.36.1-rc1
docker pull public.ecr.aws/falcosecurity/falco:0.36.1-rc1
docker pull docker.io/falcosecurity/falco-driver-loader:0.36.1-rc1
docker pull docker.io/falcosecurity/falco-no-driver:0.36.1-rc1
docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.36.1-rc1
docker pull docker.io/falcosecurity/falco-distroless:0.36.1-rc1

Release Candidate for Falco 0.36.1.
To see what's included, check the corresponding milestone: https://github.com/falcosecurity/falco/milestone/35