CrowdSec: baixar versions anteriors

This release fixes a false positive in the bot detection feature for Brave Browser with shields enabled.

## Changes

## Improvements

• add HasValidChallengeCookie() helper (#4648) @blotus

## Bug Fixes

• lapi：return an empty slice instead of null when querying alerts (#4653) @blotus
• challenge：tolerate strings instead of struct in FP payload (#4655) @blotus

## Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from <a href="https://www.maxmind.com">https://www.maxmind.com</a>.

## Installation

Take a look at the [installation instructions](https://doc.crowdsec.net/docs/getting_started/install_crowdsec).

## Bot detection with CrowdSec WAF

This release brings a major change to the CrowdSec WAF：a bot detection feature.

If enabled, clients will be served a challenge + fingerprinting page before accessing the website.
CrowdSec will evaluate the challenge and check the fingerprint against pre-configured rules to decide whether the client looks legitimate or not.

You can find more information about this new feature in [the documentation](https://docs.crowdsec.net/docs/next/appsec/bot_detection/intro).

Other notable changes include:
• A dedicated kubernetes datasource：crowdsec will fetch logs directly from the k8s apiserver
• New HTTP helpers for the expression language, to query external services from parsers and scenarios
• Performance improvements on the decisions stream endpoint in LAPI

## Security Notice

This release fixes 2 denial of service vulnerabilities in the HTTP and k8s-audit datasources:
• HTTP acquisition datasource lacks a decompressed body cap and trusts Content-Length：[GHSA-g2x2-jgfg-pg7g](https://github.com/crowdsecurity/crowdsec/security/advisories/GHSA-g2x2-jgfg-pg7g)
• Unbounded request-body read in kubernetes-audit acquisition webhook：[GHSA-rh69-4vqj-9gj8](https://github.com/crowdsecurity/crowdsec/security/advisories/GHSA-rh69-4vqj-9gj8)

## New Features

• k8s log acquisition datasource (#4221) @sabban
• Waf challenge mode (#4268) @blotus

## Improvements

• challenge：detect if cookies are disabled and display an explicit error message (#4628) @blotus
• db：add composite index for decision dedup (#4619) @blotus
• Improve pow solving : optimize & increase difficulty (#4617) @buixor
• Bot detection unify scores (#4608) @buixor
• Dedup code reject submission alert generation (#4606) @buixor
• make `RejectSubmission` generate an alert (#4602) @buixor
• waf challenge：add threshold support (#4593) @blotus
• revamp 'cscli console status' to be all-in-one (#4592) @buixor
• [bot-detection] Fix leak of background pre-warmer goroutine (#4589) @buixor
• waf：allow to configure auth timeout to LAPI (#4585) @blotus
• Add cs_machines_heartbeat_seconds metric (#4569) @kushiemoon-dev
• Cscli hub list improvements (#4567) @buixor
• expr：add HTTP helpers (#4533) @blotus

## Bug Fixes

• leakybuckets：make alerts own their strings (#4643) @blotus
• alerts：create metas only if alert was not discarded (#4633) @blotus
• k8s-audit：add support for max body size (#4630) @blotus
• Usage metrics：set a maximum payload size (#4629) @blotus
• lapi：use decision id as cursor for delta pull (#4620) @blotus
• acquis(http)：Set default max body size and enforce it as well for compressed streams (#4616) @blotus
• acquisition：fix transformation being ignored (#4609) @blotus
• fpscanner：add missing fields (#4604) @blotus
• docs：fix broken Vagrant include link in test README (#4594) @latent-9
• challenge：require SSE4.1 + WX memory (#4590) @blotus
• WAF：supress erroneous warnings/errors when loading config / no rule has matched (#4587) @blotus
• Bot Detection：keep the original URL in the generated alert (#4586) @buixor
• fix(docker)：allow spaces in ENROLL_INSTANCE_NAME (#4582) @sahilnyk
• apiclient：return nil response if we couldnt connect to LAPI (#4573) @blotus
• cscli lapi register：no error if the credentials file does not exist (#4570) @lopster568
• fix(docker)：avoid panic on colliding nested crowdsec labels (#4555) @arpitjain099
• fix(syslog)：don't close the shared acquisition output channel (#4553) @alxrxs
• waf：track id/name pairs for all subrules (#4505) @blotus
• apiserver：prevent from fetching JWT token from query string (#4554) @blotus
• fix(leakybucket)：emit overflow before pouring the next event (#4547) @blotus
• loki：prevent duplicate log ingestion and improve timestamp handling (#4498) @Anulo2
• db：use proper mutex when checking if flush can happen (#4528) @blotus
• db：do not flush alerts with active decisions (#4527) @blotus
• Fix `Distinct()` panic on `[]string` and other non-`[]any` slices (#4543) @Synvoya
• fix(docker)：bouncer na

New Features
- WAF: OpenAPI schema validation (#4097) @blotus
Improvements
- WAF: enforce body size limitation (#4355) @blotus
- Decision stream: move to chunked transfer by default (#4413) @blotus
- cscli: add --quick flag to enroll command (#4350) @blotus
- propose an alternative, cleaner configuration for appsec-config (#4397) @buixor
Bug Fixes
- cscli metrics: don't attempt to create a DB client if there's no DB config (#4451) @blotus
- papi: don't spam logs if chan is closed (#4439) @blotus
- alerts: use single transaction when creating alert and all related items (#4438) @blotus
- LAPI: enforce maximum body size for decompression
Chore / Deps
- build(deps): bump the gomod group across 1 directory with 34 updates (#4453) @dependabot[bot]
- build(deps): bump the github-actions group with 2 updates (#4447) @dependabot[bot]
- build(deps): bump alpine from 3.21 to 3.23 in /build/docker in the docker group across 1 directory (#4441) @dependabot[bot]
- build(deps): bump the github-actions group with 7 updates (#4443) @dependabot[bot]
- build(deps): bump the uv group in /build/docker/test with 3 updates (#4442) @dependabot[bot]
- db: add some missing indexes (#4435) @blotus
- Dependencies update (#4412) @blotus
- add PAPI metrics (#4411) @blotus
- build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to 1.54.0 (#4402) @dependabot[bot]
- build(deps): bump docker/login-action from 4.0.0 to 4.1.0 (#4403) @dependabot[bot]
- build(deps): bump github.com/google/go-querystring from 1.1.0 to 1.2.0 (#4400) @dependabot[bot]
- build(deps): bump actions/setup-go from 6.3.0 to 6.4.0 (#4404) @dependabot[bot]
- build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs from 1.42.3 to 1.42.25 (#4405) @dependabot[bot]
- build(deps): bump release-drafter/release-drafter from 6.4.0 to 7.1.1 (#4381) @dependabot[bot]
- build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0 (#4388) @dependabot[bot]
- build(deps): bump schneegans/dynamic-badges-action from 1.7.0 to 1.8.0 (#4393) @dependabot[bot]
- build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0 (#4394) @dependabot[bot]
- build(deps): bump github/codeql-action from 4.33.0 to 4.35.1 (#4395) @dependabot[bot]
- update dependabot config (#4440) @blotus
- build(deps): bump requests from 2.32.5 to 2.33.0 in /build/docker/test (#4389) @dependabot[bot]
- build(deps): bump cryptography from 46.0.5 to 46.0.6 in /build/docker/test (#4391) @dependabot[bot]
- build(deps): bump pygments from 2.19.2 to 2.20.0 in /build/docker/test (#4396) @dependabot[bot]
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Installation
Take a look at the installation instructions.

CrowdSec 1.7.7 brings 2 major changes:
- On linux, RE2 is now used by default for evaluating regexp in parsers
- WAF rules can now contain a mix of AND/OR conditions without any limits, giving much greater flexibility when writing new rules
RE2 by default on linux
CrowdsSec has supported for a long time using RE2 as the regexp engine, and with this release we make it the default.
CrowdSec has always used the builtin Go regexp package, which is a Go reimplementation of the RE2 library, but with known performance limitations.
The switch to RE2 will bring significantly increased regexp performance (one of the most critical part of CrowdSec) at the cost of slightly longer regexp compilation and higher baseline memory usage.
Important
If you encounter any issues with the new regexp engine, you can fallback to the previous Go implementation by setting the feature flag re2_disable_grok_support (see the documentation).
Other changes
Other notable changes include:
- a new kind attribute for alerts used to identify its source (a scenario, a WAF rule, a manual decision creation, ...)
- a new cscli allowlist import command
- support for the HTTP_PROXY environment variable in the notification-http plugin
- A resource leak under high load was fixed
Full changelog
New Features
- add LookupFile and FileMap expr helpers (#4372) @buixor
- waf rules: allow arbitrary mix of AND and OR conditions (#4358) @blotus
Improvements
- enable RE2 support by default on linux (#4386) @blotus
- cscli allowlists: add import command (#4378) @blotus
- WAF: expose more transformations from coraza (#4140) @blotus
- Add new kind alert attribute (#4351) @blotus
- Use environment proxy settings for notification-http (#4364) @op3
Bug Fixes
- allowlists: apply items to existing decisions in batch (#4095) @blotus
- waf: fix tests for modsec rules generation (#4385) @blotus
- windows: add file notification plugin in MSI package (#4367) @blotus
- leakroutine: call cancel after leakroutine returns (#4369) @blotus
- notification-sentinel: lower-case x-ms-date header for correct HMAC (#4288) @ebirn
- tests: remove temporary sqlite/plugin files from /tmp/ (#4332) @mmetc
- pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
- pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
- pkg/acquisitioncontext: minimal fix for data race in tests (#4327) @mmetc
- acquisition/file: minimal fix for data race in tests (#4326) @mmetc
- fix lint fsutil/freebsd: unnecessary conversion (#4324) @mmetc
- cscli: consistent status and usage message for unknown subcommands (#4320) @mmetc
- cscli detect: set log type for caddy unit to "syslog" (#4321) @mmetc
- CI: add published_at to version.crowdsec.net/latest (#4291) @blotus
- cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
- waf: format as CRS match only if anomaly score is not 0 (#4230) @blotus
Changes
- build(deps): bump cryptography from 46.0.3 to 46.0.5 in /build/docker/test (#4298) @dependabot[bot]
- support for waf- alias in cscli (#4347) @buixor
- refact pkg/dumps: reduce complexity (#4209) @mmetc
- lint: refact pkg/dumps for nilaway (#4208) @mmetc
- refact pkg/parser: redundant indirection (#4344) @mmetc
- refact pkg/parser: extract+embed NodeConfig in Node struct (#4343) @mmetc
- move calls to trace.ReportPanic() on top of goroutines (#4338) @mmetc
- pkg/csplugin: simplify notification loop; noop with empty queue (#4328) @mmetc
- pkg/parsers: light refact, remove redundant code (#4213) @mmetc
- refact cmd/crowdsec: encapsulate cache into alertBuffer (#4300) @mmetc
- cmd/notification-*: don't provide the same context twice for request (#4316) @mmetc
- don't flush 127.0.0.1 (#4315) @sabban
- clipapi: replace tomb with errgroup (#4207) @mmetc
- refact cmd/crowdsec: remove redundant global variable (#4299) @mmetc
- refact: remove unused code in crowdsec-cli, apiserver, acquisition, database (#4304) @mmetc
- refact pkg/leakybucket: trim down redundant Leaky struct fields (#4290) @mmetc
- pkg/leakybucket: remove 

Changes
Bug Fixes
- cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Installation
Take a look at the installation instructions.

Changes
- replace syscall with unix/windows packages where possible (#3032) @mmetc
- pkg/acquisition: refact configuration validation and tests (#4187) @mmetc
- pkg/acquisition: remove/restore mock datasources after usage (#4190) @mmetc
- pkg/leakybucket: replace global variables with injected StateDumper (#4197) @mmetc
- pkg/acquisition: method docs, deduplicate module names (#4192) @mmetc
- errors.Wrapf -> fmt.Errorf, remove dependency on github.com/pkg/errors (#4198) @mmetc
- update golangci-lint 2.8 (#4194) @mmetc
- notification plugins: readability / dry refact, unnecessary pointers (#4166) @mmetc
- refact acquisition/appsec: happy path (#4183) @mmetc
- pkg/acquisition/registry, move datasource registration to avoid dependency (#4189) @mmetc
- gin middleware: drop closures (#4186) @mmetc
- acquisition/journalctl: test cleanup (#4182) @mmetc
- cscli hubtest: extract method finalizeRun() (#4181) @mmetc
- refact cmd/crowdsec: remove globals ParseDump, BucketPourTrack (#4184) @mmetc
- refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
- refact pkg/leakybucket: drop closures (#4178) @mmetc
- cmd/crowdsec: rename pipeline channels (#4175) @mmetc
- move dir debian, rpm to /build/ (#4174) @mmetc
- refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
- lint: modernize - enable slicessort, stringsseq (#4162) @mmetc
- appsec: inject dependencies, avoid globals (#4148) @mmetc
- CI: move windows build scripts to ./build/windows (#4145) @mmetc
- remove obsolete readme (replaced by go generate) (#4164) @mmetc
- cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
- cmd/crowdsec: refact output.go, pour.go, parse.go (#4157) @mmetc
- refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
- drop unused method Client.IsMachineRegistered() (#4121) @mmetc
- CI: build with the tag "nomsgpack" to reduce binary size (#4151) @mmetc
- move ./docker to ./build/docker (#4130) @mmetc
- acquisition refact: context-aware OneShot(), for file + journalctl + wineventlog (#4125) @mmetc
- lint: forbidigo (no print or printf in production, prefer fprint) (#4141) @mmetc
- CI: avoid using nolint with revive (#4144) @mmetc
- Lint: add explicit per-linter settings (#4134) @mmetc
- refact pkg/acquisition: split docker.go (#4065) @mmetc
- get rid of tombs in leakybucket package (#4127) @sabban
- refact pkg/acquisition: cloudwatch configuration (#4058) @mmetc
- refact pkg/acquisition: kinesis configuration (#4059) @mmetc
- refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
- refact pkg/acquisition: http configuration (#4061) @mmetc
- refact heartbeat: context-aware method (#4126) @mmetc
- pkg/leakybucket refact: unexport, unused, explicit field names (#4123) @mmetc
- docker build: run builds on large runner (#4120) @blotus
Improvements
- docker datasource schema (#4206) @mmetc
- lint: enable bodyclose (ensure response bodies are closed to avoid leaks) (#4200) @mmetc
- feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007) @LaurenceJJones
- pkg/parser: avoid calling spew unless trace (#4156) @mmetc
- leakybucket: reduce error verbosity, test for misconfiguration (#4087) @mmetc
- feat(appsec): support transaction id header for request tracing (#4124) @LaurenceJJones
Bug Fixes
- update functional tests with time-based-bf (#4217) @mmetc
- papi: check if decision is allowlisted before adding it (#4196) @blotus
- pkg/acquisition: register mock datasource for YAML tests (#4205) @mmetc
- pkg/acquisition: prevent duplicate send in case of transform error (#4191) @mmetc
- CI fix - exit lapi during hub tests; pass container struct reference instead of slice (#4202) @mmetc
- CAPI: always reuse the stored token (#4201) @blotus
- fix #4066: don't prepare the hub in lapi-only containers (#4169) @mmetc
- fix #3991 - Acquisition config formatting in bug template (#4170) @mmetc
- fix typos in function name, comments and user-facing docs (#4154) @mmetc
- refact appsec tests: prevent data race (#3902) @mmetc
- fix build issue on freebsd, add cross platform

Changes
- docker: remove CROWDSEC_CONTAINER_ENV (#4085) @mmetc
- refact cscli: define csconfig.Getter once (#4091) @mmetc
- refact load/save apic token: dependencies and sentinel errors (#4081) @mmetc
- pkg/csplugin: use backoff package to retry notifications (#3944) @mmetc
- refact pkg/database batching (#3906) @mmetc
- refact pkg/acquisition: split appsec.go (#4043) @mmetc
- refact pkg/acquisition: journalctl configuration (#4057) @mmetc
- lint revive: lower complexity threshold (#4056) @mmetc
- lint: unused parameters / 2 (#4055) @mmetc
- lint: unused parameters (#4049) @mmetc
- refact pkg/acquisition: split loki.go (#4034) @mmetc
- refact pkg/acquisition: split victorialogs.go (#4037) @mmetc
- refact pkg/acquisition: split wineventlog.go (#4036) @mmetc
- refact pkg/acquisition: split s3.go (#4035) @mmetc
- refact pkg/acquisition: split k8s_audit.go (#4033) @mmetc
- refact pkg/acquisition: split kinesis.go (#4032) @mmetc
- refact pkg/acquisition: split kafka.go (#4031) @mmetc
- refact pkg/acquisition: split cloudwatch.go (#4029) @mmetc
- refact pkg/acquisition: split http.go (#4030) @mmetc
- refactg pkg/acquisition: split file.go (#4038) @mmetc
- refact pkg/acquisition: split syslog.go (#4028) @mmetc
- papi: explicit context (#3973) @mmetc
- pkg/csplugin: remove unused function (#4019) @mmetc
- pkg/types -> new imports pt 4 (#4012) @mmetc
- pkg/types -> new imports pt 3 (#4014) @mmetc
- pkg/types -> new imports pt 2 (#4013) @mmetc
- pkg/types -> new imports pt 1 (#4011) @mmetc
- pkg/types -> pkg/{pipeline,fsutil,enrichment,logging...} (#4006) @mmetc
- CI: enable linter "protogetter" (#3995) @mmetc
- enable linters: unnecessary-format, unused-receiver (#4001) @mmetc
- refact: remove unused struct fields and params / 3; enable linter "unused" (#3334) @mmetc
New Features
- WAF: Add DropRequest helper to block request in hooks (#4016) @blotus
Improvements
- pkg/acquisition: update syslog to RestartableStreamer (#4040) @mmetc
- refact logging configuration; add log_media="syslog" (#4045) @mmetc
- cscli hubtest: better report docker/nuclei errors (#4052) @mmetc
- build: check make version before running Makefile (#4054) @mmetc
- pkg/acquisition: refact journalctl datasource and unified retry loop (#4023) @mmetc
- option api.server.disable_usage_metrics_export (#4021) @mmetc
- build: optional pure-go sqlite driver (#3908) @mmetc
Bug Fixes
- LAPI metrics: don't use empty path as label for LAPI hits metrics (#4106) @blotus
- fix accessLogger setup to separate file (#4103) @mmetc
- docker acquisition: prevent data races (#3956) @mmetc
- Fix avoidable prometheus metrics cardinality (#4080) @g00g1
- loki acquisition: remove forgotten debug print (#4062) @mmetc
- fix 2808: show certificate path in "lapi status" (#4053) @mmetc
- decisionStream: only select required fields from the DB (#4024) @blotus
Documentation
- docs: add public roadmap section to README.md (#4039) @mazzma12
Chore / Deps
- build(deps): bump github/codeql-action from 4.31.4 to 4.31.6 (#4101) @dependabot[bot]
- build(deps): bump golangci/golangci-lint-action from 9.0.0 to 9.1.0 (#4083) @dependabot[bot]
- Update go-re2 to 1.10.0 (#4020) @blotus
- waf: remove custom raw body processor and use the upstream one (#4092) @blotus
- build(deps): bump actions/setup-python from 6.0.0 to 6.1.0 (#4089) @dependabot[bot]
- update go-cs-lib (#4084) @mmetc
- update coraza (#4047) @blotus
- build(deps): bump actions/checkout from 5.0.1 to 6.0.0 (#4077) @dependabot[bot]
- build(deps): bump astral-sh/setup-uv from 7.1.3 to 7.1.4 (#4078) @dependabot[bot]
- replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932) @mmetc
- build(deps): bump actions/setup-go from 6.0.0 to 6.1.0 (#4073) @dependabot[bot]
- build(deps): bump github/codeql-action from 4.31.3 to 4.31.4 (#4069) @dependabot[bot]
- build(deps): bump actions/checkout from 5.0.0 to 5.0.1 (#4064) @dependabot[bot]
- update docker/docker to moby/moby (version docker-v29.0.0) (#4048) @mmetc
- build(

Changes
- move hubupdate.sh to libexec (#4000) @mmetc
- rpm: install hubupdate with full path (#4002) @mmetc
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Installation
Take a look at the installation instructions.

Changes
- hub update: add systemd timer and service (#3977)
- rpm: package hubupdate.sh (#3979)
- rpm: immediately activate systemd timer (#3985)
- Windows: Revert to windows 2022 to fix build (#3986)
- deb: remove cron file (#3987)
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Installation
Take a look at the installation instructions.

Changes
- acquisition: set S3 anon creds during tests, prevent deadlock (#3961) @mmetc
- refact: don't call defer in loops, enable linter (#3907) @mmetc
- refact: remove unused struct fields / 2 (#3946) @mmetc
- refact: remove unused struct fields (#3633) @mmetc
- refact pkg/parser: fmt, split grok.go (#3922) @mmetc
- refact pkg/parser: extract RuntimeGrokPattern (#3916) @mmetc
- refact pkg/parser: ExtraField / Static (#3913) @mmetc
- lint: fix nilaway warnings (part 11) (#3910) @mmetc
- lint: errcheck (#3912) @mmetc
- refact: net.Listen -> listenConfig.Listen(), remove context.TODO()/Background() (#3776) @mmetc
- refact pkg/acquisition: split DataSource interface (#3900) @mmetc
- refact: net.Dial() -> Dialer.DialContext() (#3670) @mmetc
- lint: errcheck, nolintlint, intrange (#3904) @mmetc
- lint: fix nilaway warnings (part 5) (#3863) @mmetc
- lint: fix nilaway warnings (part 10) (#3875) @mmetc
- lint: fix nilaway warnings (part 7) (#3865) @mmetc
- lint: fix nilaway warnings (part 6) (#3864) @mmetc
- refact cmd/crowdsec, pkg/apiserver: extract methods (#3743) @mmetc
- lint: fix nilaway warnings (part 9) (#3868) @mmetc
- refact pkg/parser: small optimizations (#3891) @mmetc
- refact simulation: redundant use of pointers; log (stderr) -> print (stdout) (#3889) @mmetc
- refact pkg/parser: extract method processLeaves (#3886) @mmetc
- refact: exec.Command() -> exec.CommandContext() (#3826) @mmetc
- lint: fix nilaway warnings (part 2) (#3854) @mmetc
- refact pkg/parser: extract method (#3849) @mmetc
- lint: fix nilaway warnings (part 8) (#3866) @mmetc
- lint: nosprintfhostport, ifelsechain (#3838) @mmetc
- lint: fix nilaway warnings (part 1) (#3853) @mmetc
- packaging: clean up redundant debian/install, debian/rules (#3781) @mmetc
- rpm: declare ghost file permissions (#3828) @mmetc
Improvements
- cscli hubtest --appsec : Bail when we cannot invoke nuclei (#3798) @buixor
- update kinesis datasource to aws sdk v2 (#3846) @mmetc
- update cloudwatch datasource to sdk v2 (#3847) @mmetc
- waf: store target FQDN in alert meta (#3947) @blotus
- waf: allow glob when including seclang files (#3948) @blotus
- enhance: add timeout resilience to Docker acquisition (socket proxy errors) (#3873) @LaurenceJJones
- update test_env.sh (#3829) @mmetc
- make: support CROWDSEC_API_DEV_ENV (#3931) @mmetc
- metrics: report platform family to console / 2 (#3938) @mmetc
- cscli setup: detect auditd (#3917) @mmetc
- update s3 datasource to aws sdk v2 (#3844) @mmetc
- output: push alerts from a goroutine (#3905) @blotus
- cscli support dump: collect system information with gopsutil (#3879) @mmetc
- replace cron script with systemd timer (#3842) @mmetc
- waf: add fromFile match type (#3880) @blotus
- Improve logging for file acquisition (#3778) @david-garcia-garcia
Bug Fixes
- cscli: fix hubtest coverage (#3969) @mmetc
- k8s_audit: fix flaky windows test (#3940) @mmetc
- cloudwatch: fix flaxy test (#3941) @mmetc
- CI: fix flaky cold logs test (#3942) @mmetc
- fix: service name typo (#3920) @mmetc
- apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911) @mmetc
- pkg/database: enable upsert feature flag, use it for config items (#3895) @mmetc
- lint: fix nilaway warnings (part 3), prevent data race (#3855) @mmetc
- journalctl acquisition: fix #3890 (#3893) @mmetc
- refact pkg/parser: review formatting verbs, logs (#3887) @mmetc
- fix: set cache defaults for parser stash (#3883) @mmetc
- [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884) @blotus
- waf: return if we cannot create the TCP listener (#3882) @blotus
- lint: fix nilaway warnings (part 4), prevent data race (#3857) @mmetc
Chore / Deps
- build(deps): bump astral-sh/setup-uv from 6.8.0 to 7.0.0 (#3960) @dependabot[bot]
- build(deps): bump github/codeql-action from 3.30.6 to 4.30.7 (#3958) @dependabot[bot]
- build(deps): bump github/codeql-action from 3.30.5 to 3.30.6 (#3943) @dependabot[bot]
- build(deps): b

The 1.7.0 release of crowdsec brings some major changes to how services are auto-detected during installation, and to the metrics shared by the log processors to LAPI.
The new detection system, cscli setup, is much more flexible and powerful:
- Supports Linux, BSD and Windows (at the time, auto-detection is only performed at install time for deb and RPM packages)
- More services are detected out of the box
- A custom detection configuration can be provided during installation to detect custom services and generate custom acquisition configs (eg, when not using default log paths)
- The auto-detection can be skipped if the configuration is managed with tools like Ansible
Learn more about it in our documentation.
The Log Processors now send metrics about the acquisition (number of lines read and parsed per datasource) and the parsers (number of events parsed, unparsed, or whitelisted) to LAPI.
Those metrics are shown when running cscli machines inspect XXX.
In the future, they will also be displayed in the console and used to detect potentially misconfigured or misbehaving installations.
Other notable changes include:
- Support for swarm in the docker datasource
- Better CRS integration in the WAF (this will continue to be improved over time)
- New expr helpers to compute the average and median time between events
Warning
Starting with this release, when crowdsec is run in a docker (or podman) container, a volume must be provided /var/lib/crowdsec/data/, otherwise the container will refuse to start.
This requirement does not apply to Kubernetes.
Note
As previously documented here, the cscli dashboard command has been removed.
If you are still using the metabase dashboard, we recommend you migrate to https://app.crowdsec.net
Changes
- use go 1.24.6 (#3835) @mmetc
- CI: update actions; drop version comments (#3823) @mmetc
- install scripts: echo -e -> echo (we're not requiring bash anymore) (#3799) @mmetc
- move detect.yaml to /var/lib/crowdsec/data (#3797) @mmetc
- restore wizard.sh --unattended (#3790) @mmetc
- cleanup wizard.sh (#3786) @mmetc
- remove the cscli_setup feature flag (#3784) @mmetc
- add detect.yaml in rpm files section (#3773) @sabban
- refact whitelist/allowlist: net.IP to net/netip (#3683) @mmetc
- refact: pkg/database decisions filter, queries (#3635) @mmetc
New Features
- cscli: remove "dashboard" command (#3004) @mmetc
- clean up buckets serialization code (#3777) @sabban
- cscli setup: new service detection and configuration (#3730) @mmetc
- feat: add swarm support to docker acquistion (#3744) @LaurenceJJones
Improvements
- WAF: Improve user-experience with CRS and modsecurity rules (#3827) @blotus
- cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UN… (#3822) @mmetc
- cscli setup: improve service detection and datasource validation (#3812) @mmetc
- cscli setup: skip missing items, fix collection name (#3794) @mmetc
- Improve the output of appsec cscli hubtest (#3791) @buixor
- cscli setup improvements (#3789) @mmetc
- cscli: print command name along with errors (#3768) @mmetc
- enhance: Add 2 time helpers for average and median (#3748) @LaurenceJJones
- usage metrics: report acquisition + parsers metrics to LAPI (#3709) @blotus
- improve datasource validation (goccy/go-yaml) (#3646) @mmetc
Bug Fixes
- fix "cscli alerts list -s " for alerts with no decisions (#3830) @mmetc
- unify the output format of start_at and stop_at (#3819) @buixor
- pkg/cwhub: fix relative symlink resolution (#3824) @mmetc
- fix: Postint check also if api.server.enable is false (#3802) @LaurenceJJones
- detect.yaml: always acquire ssh logs from file if present (#3825) @mmetc
- detect.yaml: avoid double acquisition on deb (#3821) @mmetc
- review config/detect.yaml (#3820) @mmetc
- fix rpm detect.yaml (#3814) @sabban
- CI: remove config/detect.yaml reference from rpm (#3813) @mmetc
- fix rpm dovecot detection (#3796) @sabban
- Increase hub download timeout to 10 minutes (#3785) @mmetc
- docker: enforce volume use for /v

Warning
This release fixes an issue with the Windows version of CrowdSec that prevented it from shutting down properly.
Due to this issue, the service will not stop automatically when updating to this version.
You will need to manually kill the CrowdSec process in Task Manager before running the installer.
This release mainly contains small fixes:
- Fixed an issue preventing proper shutdown on Windows
- Fixed an issue when importing decisions where allowlists were not always checked
Changes
- update lint configuration (#3667) @mmetc
- context.Background() -> t.Context() (#3739) @mmetc
Bug Fixes
- fix: normalize scope within range to ensure allowlist check (#3735) @LaurenceJJones
- cscli: don't assume master hub branch if version check fails (after retrying) (#3732) @mmetc
- windows: fix service getting stuck on shutdown (#3733) @blotus
Chore / Deps
- build(deps): bump golang.org/x/text from 0.26.0 to 0.27.0 (#3741) @dependabot[bot]
- build(deps): bump astral-sh/setup-uv from 6.3.1 to 6.4.1 (#3737) @dependabot[bot]
- build(deps): bump github.com/blackfireio/osinfo from 1.0.5 to 1.1.0 (#3718) @dependabot[bot]
- build(deps): bump github.com/crowdsecurity/dlog from 0.0.0-20170105205344-4fb5f8204f26 to 0.0.2 (#3717) @dependabot[bot]
- docker: document console options (#3724) @blotus
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Installation
Take a look at the installation instructions.

Overview
This release mostly focuses on small bug fixes and improvements:
- WAF: fixed a resource leak in the appsec datasource when checking bouncer authentication
- Allowlists: added cscli allowlists check to check if an IP/range belongs to an allowlist
- S3 datasource: added support for SNS notifications
- HTTP datasource: added support for GET and HEAD requests to allow the log provider to confirm the datasource is working.
Full changelog is below.
Improvements
- enhance: Add allowlist check (#3684) @LaurenceJJones
- Flags for console features (#3457) @Simbiat
- HTTP datasource: allow GET/HEAD request for checking if the datasource is working (#3710) @blotus
- enhance: appsec reuse httpc optimization (#3693) @LaurenceJJones
- hubtest: resolve relative path for 'cscli', 'crowdsec' (#3651) @mmetc
- refact pkg/cwhub (#3666) @mmetc
- S3 datasource: add support for SNS format (#3716) @blotus
Changes
- refact pkg/acquisition: extract loop method (#3615) @mmetc
- refact: plugin config parsing (#3640) @mmetc
- refact: migrate net.IP -> net/netip: part 1 (#3680) @mmetc
- use github.com/cenkalti/backoff/v5 for apiclient backoff (#3662) @mmetc
- use go 1.24.4 (#3674) @mmetc
- cscli help typos (#3707) @mmetc
- move cti expr helper to pkg/cticlient (#3696) @mmetc
- refact csplugin: move ProfileAlert to models (#3671) @mmetc
- refact cmd/crowdsec: extract functions from runCrowdsec() (#3669) @mmetc
- cscli capi register: no error if online_api_credentials.yaml does not exist (#3645) @mmetc
- refact cmd/crowdsec: move plugin initialization to apiserver (#3668) @mmetc
- lint: require name on interface parameters (#3614) @mmetc
- unit tests: rename ./tests, ./test_data -> ./testdata (#3673) @mmetc
Bug Fixes
- Fix infinite loop in decisions list for some values of limit (#3695) @blotus
- fix: Reset datafiles before loading the hub on HUP (#3712) @LaurenceJJones
- fix: allowlist use content created at instead of list itself (#3703) @LaurenceJJones
- pkg/apiserver: remove incorrect log.Error (#3672) @mmetc
Chore / Deps
- dependabot: set kind/dependencies label (#3722) @blotus
- CI: update action deps (#3692) @mmetc
- update golangci-lint v2.2 and config (#3713) @mmetc
- refact: replace iplib with net/netip (#3642) @mmetc
- update hashicorp/go-plugin (#3694) @mmetc
- update github.com/jedib0t/go-pretty/ (#3705) @mmetc
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Installation
Take a look at the installation instructions.

Overview
Warning
Docker acquisition now requires access to the events API endpoint. If you are using a socket proxy, make sure to update its configuration.
- Improved performance for the docker datasource by using docker events instead of polling the docker API to detect new containers
- Added a new option to allow a log processor to unregister itself from LAPI on shutdown. This is especially useful in a dynamic environment (eg, kubernetes) where nodes come and go to keep a clean list of active log processors.
- When an allowlist is created (or updated), matching active decisions will be deleted automatically.
- Polling API (PAPI) will be automatically enabled or disabled when crowdsec detects the user's console plan has changed, making the initial setup easier.
Changes
- fix PAPI failure to stop on reload (#3679) @blotus
- update coraza (#3675) @blotus
- modernize: replace legacy slice/map/range idioms with stdlib (#3658) @mmetc
- CI: ensure tests don't alter the repository (#3616) @mmetc
- refact apiclient.Config: remove field Scenarios (#3622) @mmetc
- CI: release-drafter configuration: permissions, skip-changelog label (#3631) @mmetc
- refact: cleanup bats helper (#3636) @mmetc
- refact cmd/crowdsec: remove login code obsoleted by 16d0677 (#3620) @mmetc
- CI: update codecov list and fix workflow (#3617) @mmetc
- refact pkg/database: unnecessary pointers (#3611) @mmetc
- CI: update action for generating docker description (#3559) @mmetc
- refact pkg/parser: extract method, avoid calling defer in loop (#3564) @mmetc
- refact: remove unused metod DeleteDecisionsWithFilter() (#3605) @mmetc
- refact alert, decision filters: remove unnecessary pointers (#3607) @mmetc
- CI: update lint complexity thresholds (#3608) @mmetc
- refactor pkg/database/Client.createAlertChunk() (#3585) @mmetc
- refact cscli: hub item - pointer receiver for consistency (#3595) @mmetc
- CI: remove obsolete reference to directory dyn-bats (#3600) @mmetc
- refact: pkg/exprhelpers/debugger, convert switch to function dispatch (#3587) @mmetc
- lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer (#3583) @mmetc
- refact pkg/database: dry decision count (#3586) @mmetc
- refact parser Init: argument types (#3578) @mmetc
- tests: refact localtest helper, use testify.suite (#3574) @mmetc
- refact: logrus.GetLevel() -> logrus.IsLevelEnabled() (#3579) @mmetc
- test: add cold log event assert (#3577) @mmetc
- Refact pkg/database/decisions.go (#3541) @mmetc
- replace go-acc, richgo with gotestsum (#3567) @mmetc
- refact pkg/hubtest: use os.CopyFS() (#3539) @mmetc
- lint/refactor: defer, reflectvaluecompare, stylecheck (#3544) @mmetc
- CI: golangci-lint v2 (#3558) @mmetc
New Features
- allow watcher to self-delete on shutdown (#3565) @blotus
- allowlists: check during bulk decision import (#3588) @mmetc
Improvements
- PAPI: auto enable on upgrade (#3659) @blotus
- enhance: Remove docker acquis internal timer use docker events (#3598) @LaurenceJJones
- kafka: expose batching configuration (#3621) @blotus
- feat(apiclient): add token save functionality (#3639) @sabban
- enhance: return err if notification has no plugin type (#3638) @LaurenceJJones
- cscli capi status: save auth token, add tests (#3623) @mmetc
- config.yaml: make config_dir and notification_dir optional (#3606) @mmetc
- feat(apic): add ApicAuth client and token re-authentication logic (#3522) @sabban
- allowlists: automatically expire current matching decisions on update (#3601) @blotus
- improve support for parsing time durations with 'day' units (#3599) @mmetc
- cscli inspect: don't show metrics or converted rules if an item is not installed (#3602) @mmetc
- Fix monitorNewFiles for NFS + Remove dead tails from tail map (#3508) @david-garcia-garcia
- enhance: add listen_socket to http acquisition (#3499) @LaurenceJJones
- enhance: Allow the use of 'd' suffix in profiles (#3594) @LaurenceJJones
- lapi: return specific error if a unix socket path is too long for the OS (#3593) @mmetc
- do not 

Changes
- build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 (#3531) @dependabot[bot]
- CI: enable linter "noctx" (#3528) @mmetc
- CI: enable linter "containedctx" (#3529) @mmetc
- only warn about capi_whitelists_path being deprecated if actually in use (#3535) @blotus
- CI: pin hub branch during functional tests (#3526) @mmetc
- empty back-merge from release branch (#3527) @mmetc
Improvements
- explicit message for malformed data URL in local items (#3537) @mmetc
- Migration script from debian/ubuntu package 1.4.6 (#3420) @mmetc
Bug Fixes
- Allowlists: fix range check in LAPI endpoint (#3538) @blotus
- revert ActionPlan info/warning to StandardLogger (#3536) @mmetc
- fix #3532 "reload causes crashing process" (#3534) @mmetc
Chore / Deps
- use replace for coraza instead of renaming the entire package (#3530) @blotus
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Installation
Take a look at the installation instructions.

Overview
**This release highlights the appsec feature. Important fixes were done. **
See documentation here
**The cscli hub command has been revamped.
See documentation here
New Features
- acquisition/victorialogs: add new datasource (#3310) @zekker6
- Add possibility to configure log format #799 (#2941) @victoredvardsson
Improvements
- don't ask user to reload systemd service when running in docker (#3434) @mmetc
- enhance: Log appsec error on writing response to remediation (#3412) @LaurenceJJones
- test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing (#3400) @mmetc
- log warning if local items have conflicting names (#3399) @mmetc
- feat(cscli): add env variable flag for dashboard setup (#3110) @quantumsheep
- expand env var when loading acquis (#3375) @blotus
- cscli: restyle table titles; autocomplete "cscli metrics show" (#3391) @mmetc
- enhancement: Hubtest respect patterndir option set via config.yaml (#3386) @LaurenceJJones
- enhancement: add logdata to appsec AccumlateTxToEvent (#3383) @LaurenceJJones
- cscli: improved hub management (#3352) @mmetc
- cscli: display expired decisions' expiration time in red (#3357) @mmetc
- loop performance optimizations / 1 (#3313) @mmetc
Changes
- wizard.sh: remove obsolete --yes option (#3450) @mmetc
- cscli: replace '--yes' option with '--interactive' (#3448) @mmetc
- CI: use alpine 3.21 for docker build (#3445) @mmetc
- merge from master (dc28ae5) for 1.6.5 (#3444) @mmetc
- run 'hub upgrade' in rpm/deb postinst, improve hub message (#3440) @mmetc
- CI: setup go from version in go.mod (#3432) @mmetc
- CI: package docker tests with uv (#3429) @mmetc
- Improve post-installation message (#3407) @blotus
- deb packaging: prevent installing crowdsec.service twice (#3415) @mmetc
- deb build: get version with dpkg-parsechangelog -S (#3405) @mmetc
- cscli: cliconfig - refactor / remove global variables and gratuitous pointer (#3414) @mmetc
- lint: enable errcheck; add allowlist and explicit checks (#3403) @mmetc
- lint: gocritic/captLocal (don't capitalize local variables) (#3402) @mmetc
- remove commands "cscli config backup/restore" (#3158) @mmetc
- CI: golangci-lint 1.63 (#3396) @mmetc
- Hubops tests (#3393) @mmetc
- cscli hub: refact/split files; add some doc/examples (#3394) @mmetc
- lint: explicit error checks (#3388) @mmetc
- pkg/cwhub - refact Downloader (#3382) @mmetc
- lint: replace type assertions and type switch on errors (#3376) @mmetc
- refactor pkg/leakybucket (#3371) @mmetc
- refact pkg/database: clean up code and error messages (#3263) @mmetc
- lint/deep-exit: avoid log.Fatal (#3367) @mmetc
- loop performance optimizations / 2 (#3364) @mmetc
- lint/deep-exit: avoid log.Fatal (#3360) @mmetc
- lint: enable more gocritic checks (#3363) @mmetc
- acquisition: add some test and warning for wrong source type (#3362) @mmetc
- support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump (#3361) @blotus
- lint: style, autofix (#3354) @mmetc
- update golangci-lint to 1.62 (#3332) @mmetc
Bug Fixes
- cscli: exclude removed commands from generated docs (#3449) @mmetc
- cscli: when prompting, use default in case of EOF instead of going for "no" (#3447) @mmetc
- ignore zero value variables for context (#3436) @blotus
- bucket: avoid crashing on malformed expression (fix #3351) (#3368) @mmetc
- fix parsing of noncompliant RFC3339 timestamps missing only a timezone (#3346) @gilbsgilbs
- fix: use CreatedAt instead of StartAt (#3427) @LaurenceJJones
- use the actual bucket name when checking for simulation mode (#3416) @blotus
- appsec: do not attempt to deduplicate native modsec rules (#3347) @buixor
- Removed updating of machine last_heartbeat based on baseMetrics in MachineUpdateBaseMetrics (#3425) @srkoster
- cscli hub: handle freebsd pre-release version numbers (#3423) @mmetc
- wizard: install systemd service file (#3418) @mmetc
- pkg/cticlient: Add missing field in SmokeItem and FireItem (#3413) @AlteredCoder
- fix: Bucket pour log error

Overview
HTTP datasource
This release introduce http data source that enable crowdsec to ingest logs from an http endpoint such as Datadog or Vector.
See documentation here
Alert context appsec
This release also introduces the alert context ability when using appsec.
See related doc here
Replay evtx file support
This release allows Windows CrowdSec users to replay Winevent evtx files.
Bouncers API Key sharing
Bouncers running on different machines can now share the same API key without interfering with each other. Each bouncer will appear as bouncer_name@IP in the bouncer list. (#3323)
New Features
- add HTTP datasource (#3294) @he2ss
- Alert context appsec (#3288) @buixor
- wineventlog: add support for replaying evtx files (#3278) @blotus
Improvements
- Allow bouncers to share API keys (#3323) @blotus
- Support multiple appsec configs (#3314) @buixor
- context propagation: papi, loki (#3308) @mmetc
- Add explicit configuration for signals sharing and blocklists pull (#3277) @blotus
- loki: add no_ready_check option (#3317) @blotus
- logs and user messages: use "serialize" and "parse" instead of marshal/unmarshal (#3240) @mmetc
- context propagation: cscli {capi,lapi,papi} (#3228) @mmetc
- refact pkg/database: context propagation (start) (#3226) @mmetc
Changes
- make: improve re2/wasm check (#3335) @mmetc
- fix go version for azure pipeline (#3324) @blotus
- add go minor in go.mod (#3318) @sabban
- update checks for wrapped errors (#3117) @mmetc
- refact cscli: decisions, lapi, bouncers, machines (#3306) @mmetc
- make: remove obsolete/redundant parameters (#3304) @mmetc
- remove unused code: HandleDeletedDecisions() (#3301) @mmetc
- CI: update coverage ignore list for generated code (#3262) @mmetc
- lint/revive: check tags on non-exported struct fields (#3257) @mmetc
- context propagation: don't store ctx in api controller (#3268) @mmetc
- CI: check generated code in test workflow (#3261) @mmetc
- remove dependency from pkg/cwversion to pkg/acquisition (#3242) @mmetc
- lint/nestif: reduce hubtest complexity (#3244) @mmetc
- refact: alerts query (#3216) @mmetc
- lint: enable (some) gocritic checks (#3238) @mmetc
- enable linters: copyloopvar, intrange (#3184) @mmetc
- refact acquisition: build profiles (optionally exclude datasources from final binary) (#3217) @mmetc
- refact / split APIServer.Run() method (#3215) @mmetc
- refact cscli - don't export functions if not required (#3224) @mmetc
- refact: cscli papi (#3222) @mmetc
- refact: pkg/apiclient set and use default user agent (#3219) @mmetc
Bug Fixes
- better handle error when sending usage metrics (#3333) @blotus
- fix: Use clientIP when passing coraza (#3322) @LaurenceJJones
- cron dependency for packaging (#3331) @sabban
- fix: Add a check to prevent attempting to load a directory within patterns (#3326) @LaurenceJJones
- fix: Ansible fedora 40 to use 40 (#3327) @LaurenceJJones
- make: allow build on ubuntu 24.10 (#3311) @mmetc
- enhance: Remove if log check in one instance (#3300) @LaurenceJJones
- fix: Check if resp is nil in capi metrics and continue (#3299) @LaurenceJJones
- avoid deadlock when deleting decisions if PAPI is half configured (#3283) @blotus
- CI: delegate pipenv cache management to the setup-python action (#3243) @mmetc
- Update go-re2 (#3230) @blotus
- fix #3225: info->debug for trigger bucket overflow (#3227) @mmetc
- fix appsec/tls issues by cloning http transport (#3213) @mmetc
Chore / Deps
- enhance: add fedora 41 vagrant (#3328) @LaurenceJJones
- enhance: add opensuse leap 15 vagrant (#3329) @LaurenceJJones
- readme: update bouncers link (#3297) @laur89
- require go 1.23 (#3298) @mmetc
- Update protobufs (#3276) @mmetc
- CI: generate codecov.yml before tests (#3280) @mmetc
- update test dependencies (#3267) @mmetc
- Re-generate capi models (#3260) @mmetc
- CI: update golangci-lint to v1.61, yq to 4.44.3 (#3241) @mmetc
- context propagation: OneShotAcquisition(); enable contextcheck linter (#3285) @mmetc
- context propagation: appsec, docker, kafk

Changes
- replace log.Fatal with error return (#2996) @mmetc
- bats: clean up extra output (#3008) @mmetc
- make: remove unused targets (#2998) @mmetc
- deb,rpm: include empty directory etc/crowdsec/acquis.d (#2997) @mmetc
- CI: disable log formatting for consistency (#2989) @mmetc
- cscli: remove global dbClient (#2985) @mmetc
- enable linter "revive" (#2978) @mmetc
- minor lint/readability (#2976) @mmetc
- pkg/dumps,hubtest: use yaml.v3 (#2972) @mmetc
- cscli: avoid global vars (#2977) @mmetc
- refactor pkg/parser/node (#2953) @mmetc
- pkg/cwhub - rename methods for clarity (#2961) @mmetc
- cscli hub items: avoid global (#2960) @mmetc
- cscli config show: avoid globals, use yaml v3 (#2863) @mmetc
- pkg/database/decisions: remove filter parameter, which is always passed empty (#2954) @mmetc
New Features
- new File notification plugin (#2932) @LaurenceJJones
Improvements
- update user agent with version and platform information (#3035) @mmetc
- appsec: properly populate event (#2943) @blotus
- enhance: container discovery via labels (#2959) @LaurenceJJones
- cscli: faster table rendering (#3027) @mmetc
- bats: no need for openssl, netcat; allow to prevent tests from running with a lock (#3016) @mmetc
- GetActiveDecisionsCount() and GetActiveDecisionsTimeLeft()expr helpers (#3013) @blotus
- fix: add sslmode check and append flag to conn string (#3009) @LaurenceJJones
- Add tab completion to cscli notifications [test, inspect] (#2765) @LaurenceJJones
- Add ability to configure channel, username, icon emoji/url in slack notification (#2975) @blesswinsamuel
- use go-cs-lib/downloader for data files, hub index, item YAML (#2926) @mmetc
- cscli support: collect profiling data and logs (#2987) @mmetc
- cscli: don't print timestamps (#2984) @mmetc
- support stdout in cscli support dump (#2939) @LaurenceJJones
- cscli support: include stack traces (#2935) @mmetc
Bug Fixes
- jwt transport: fix retry on unauthorized from CAPI (#3006) @blotus
- appsec: respect on_success parameter in hooks (#3017) @blotus
- cti config: avoid nil deref (#3028) @mmetc
- appsec: add files and cookies related zones (#2956) @blotus
- simulation for custom scenarios (#3010) @mmetc
- version: write to stdout, add missing newline (#3012) @mmetc
- docker: conditionally update hub (#2948) @blotus
- LAPI: support CRL files with multiple PEM blocks (#3002) @mmetc
- CI: don't hang test "cscli machines prune" if the fixture is old (#2992) @mmetc
- db: review update timestamps, immutable columns (#2981) @mmetc
- add zfs magic for GetFSType (#2950) @blotus
- Truncate meta data (#2966) @buixor
- db config: don't exit setup if can't detect fs, improve detection for freebsd (#2963) @mmetc
- Revert "docker: pre-download all hub items and data, opt-in hub updat… (#2947) @blotus
Chore / Deps
- CI: improve code coverage report (#3029) @mmetc
- tests: replace "docker-compose" -> "docker compose" (#3000) @mmetc
- use go 1.22.3 (#2994) @mmetc
- update go-cs-lib to 0.0.11 (#2990) @mmetc
- update go dependencies (#2968) @mmetc
- plugins: use yaml.v3 (#2969) @mmetc
- use go 1.22 (#2826) @mmetc
- cscli: use yaml.v3 (#2965) @mmetc
- CI: upload coverage with token (#2958) @mmetc
- tests: bump yq, cfssl (#2952) @mmetc
- update linter list and descriptions (#2951) @mmetc
- enhance: add refactoring to governance (#2955) @LaurenceJJones
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.Installation
Take a look at the installation instructions.

Changes
- rename bouncers to remediation component in openAPI (#2936) @AlteredCoder
- docker: distribute geoip db in slim image (#2920) @mmetc
New Features
- LAPI: local api unix socket support (#2770) @mmetc
Improvements
- docker: pre-download hub items (debian image) (#2934) @mmetc
- docker: pre-download all hub items and data, opt-in hub update/upgrade (#2933) @mmetc
- add patterns_dir configuration option (#2868) @kampka
- cscli: Add user-agent to all hub requests (#2915) @mmetc
- add libinjection expr helpers (#2914) @blotus
- improve a bit cscli examples when it comes to list mgmt (#2911) @buixor
- cscli metrics: sort table order (#2908) @mmetc
- update windows pipeline (#2909) @blotus
- crowdsec: remove warning if prometheus port is taken during cold logs processing (#2857) @mmetc
- bin/crowdsec: avoid writing errors twice when log_media=stdout (#2876) @mmetc
- cron: spread server load when upgrading hub and data files (#2873) @mmetc
- lp metrics: collect datasources and console options (#2870) @mmetc
- refact pkg/apiserver (auth helpers) (#2856) @mmetc
- refact cscli (globals) (#2854) @mmetc
- add unix socket option (#2764) @LaurenceJJones
- refact pkg/apiclient (#2846) @mmetc
- refact "cscli config" (#2832) @mmetc
- Appsec unix socket (#2737) @LaurenceJJones
- cscli metrics: rename buckets -> scenarios (#2848) @mmetc
- add SetMeta and SetParsed helpers (#2845) @buixor
- implement highAvailability feature (#2506) @he2ss
- pkg/hubtest: extract methods + consistent error handling (#2756) @mmetc
- log processor: share apiclient in output goroutines (#2836) @mmetc
- bats: color formatter in CI (#2838) @mmetc
- refact "cscli console" (#2834) @mmetc
- refact "cscli notifications" (#2833) @mmetc
- refact "cscli explain" (#2835) @mmetc
- refact "cscli alerts" (#2827) @mmetc
- refact "cscli lapi" (#2825) @mmetc
- update calls to deprecated x509 methods (#2824) @mmetc
- refact cscli metric processing (#2816) @mmetc
- Dedicated whitelist metrics (#2813) @buixor
- refact "cscli" root cmd (#2811) @mmetc
- refact "cscli metrics" part 3 (#2807) @mmetc
- refact "cscli metrics" part 2 (#2806) @mmetc
- refact "cscli metrics" part 1 (#2805) @mmetc
- refact "cscli decisions"; lint (#2804) @mmetc
- refact "cscli dashboard" (#2803) @mmetc
- refact "cscli papi" (#2802) @mmetc
- refact "cscli simulation" (#2801) @mmetc
- refact "cscli " (#2782) @mmetc
- refact "cscli hub" (#2800) @mmetc
- refact "cscli alerts" (#2778) @mmetc
- refact "cscli machines" (#2777) @mmetc
- refact "cscli bouncers" (#2776) @mmetc
- CI: rename workflows, update docker build (#2798) @mmetc
- cscli: don't print use_wal warning (#2794) @mmetc
- option to override hub url template. for testers only. (#2785) @mmetc
- lint: disallow naked returns (#2771) @mmetc
- lint: enable linter "wastedassign" (#2772) @mmetc
Bug Fixes
- windows: fix data file update (remove before rename) (#2930) @mmetc
- Fix REQUEST_URI behavior (#2891 #2917) @buixor
- hub update: reload crowdsec if only data files have changed (#2912) @mmetc
- fix locking logic for HA and add list unsubscribe for PAPI (#2904) @buixor
- warn if user is using inotify to tail a symlink (#2881) @blotus
- file acquisition: don't bubble error when tailed file disappears (#2903) @mmetc
- fix rpm build (#2894) @sabban
- fix unix socket error (#2897) @LaurenceJJones
- lapi: log error "can't sinchronize with console" only if papi is enabled (#2896) @mmetc
- add cron as a suggested package for debian package (#2799) @blotus
- appsec: delete api key header before processing the request (#2890) @blotus
- acquisition : take prometheus level into account (#2885) @buixor
- Fix armhf build (#2886) @sabban
- cscli tests + fix bouncer/machine prune (#2883) @mmetc
- support both scope and scopes parameter in decisions filter (#2882) @blotus
- appsec: get the original UA from headers (#2809) @blotus
- file acquis: add mutex to protect access to the internal tail map (#2878) @blotus
- pkg/cwhub: download data assets to temporary files to a

Improvements
- generate asserts for evt.Unmarshaled in hubtest (#2214) @blotus
- Log info capi whitelists (#2220) @LaurenceJJones
- support capi_whitelists.yaml (#2224) @mmetc
Bug Fixes
- Update KV ignore whitespace before and after = (#2236) @LaurenceJJones
- fix lock when dumping the parsing state in explain mode (#2234) @blotus
- test cleanup: remove /tmp/crowdsec_tests* directories (#2232) @mmetc
- merge system cert pool with own certs (#2226) @mmetc
Chore / Deps
- decouple bouncer dependencies: use go-cs-lib/pkg/ptr (#2228) @mmetc
- decouple bouncer dependencies: use go-cs-lib in test code (#2229) @mmetc
- makefiles: de-duplicate, simplify and remove unused code (#2222) @mmetc
- decouple bouncer dependencies: use go-cs-lib/pkg/ptr in apiclient (#2227) @mmetc
- decouple bouncer dependencies: use go-cs-lib/pkg/* (#2216) @mmetc

Bug Fixes
- fallback to master for hub index download if it does not exist (#2210) @blotus
- Don't allow to customize the installation directory on windows (#2208) @blotus
- fix incorrect version strip (#2206) @blotus
Chore / Deps
- Use go 1.20.4 (#2209) @mmetc
- gitignore: allow shipping wasm libs with vendored files (#2207) @mmetc