Lataa CrowdSec 1.8.0

## Bot detection with CrowdSec WAF

This release brings a major change to the CrowdSec WAF：a bot detection feature.

If enabled, clients will be served a challenge + fingerprinting page before accessing the website.
CrowdSec will evaluate the challenge and check the fingerprint against pre-configured rules to decide whether the client looks legitimate or not.

You can find more information about this new feature in [the documentation](https://docs.crowdsec.net/docs/next/appsec/bot_detection/intro).

Other notable changes include:
• A dedicated kubernetes datasource：crowdsec will fetch logs directly from the k8s apiserver
• New HTTP helpers for the expression language, to query external services from parsers and scenarios
• Performance improvements on the decisions stream endpoint in LAPI

## Security Notice

This release fixes 2 denial of service vulnerabilities in the HTTP and k8s-audit datasources:
• HTTP acquisition datasource lacks a decompressed body cap and trusts Content-Length：[GHSA-g2x2-jgfg-pg7g](https://github.com/crowdsecurity/crowdsec/security/advisories/GHSA-g2x2-jgfg-pg7g)
• Unbounded request-body read in kubernetes-audit acquisition webhook：[GHSA-rh69-4vqj-9gj8](https://github.com/crowdsecurity/crowdsec/security/advisories/GHSA-rh69-4vqj-9gj8)

## New Features

• k8s log acquisition datasource (#4221) @sabban
• Waf challenge mode (#4268) @blotus

## Improvements

• challenge：detect if cookies are disabled and display an explicit error message (#4628) @blotus
• db：add composite index for decision dedup (#4619) @blotus
• Improve pow solving : optimize & increase difficulty (#4617) @buixor
• Bot detection unify scores (#4608) @buixor
• Dedup code reject submission alert generation (#4606) @buixor
• make `RejectSubmission` generate an alert (#4602) @buixor
• waf challenge：add threshold support (#4593) @blotus
• revamp 'cscli console status' to be all-in-one (#4592) @buixor
• [bot-detection] Fix leak of background pre-warmer goroutine (#4589) @buixor
• waf：allow to configure auth timeout to LAPI (#4585) @blotus
• Add cs_machines_heartbeat_seconds metric (#4569) @kushiemoon-dev
• Cscli hub list improvements (#4567) @buixor
• expr：add HTTP helpers (#4533) @blotus

## Bug Fixes

• leakybuckets：make alerts own their strings (#4643) @blotus
• alerts：create metas only if alert was not discarded (#4633) @blotus
• k8s-audit：add support for max body size (#4630) @blotus
• Usage metrics：set a maximum payload size (#4629) @blotus
• lapi：use decision id as cursor for delta pull (#4620) @blotus
• acquis(http)：Set default max body size and enforce it as well for compressed streams (#4616) @blotus
• acquisition：fix transformation being ignored (#4609) @blotus
• fpscanner：add missing fields (#4604) @blotus
• docs：fix broken Vagrant include link in test README (#4594) @latent-9
• challenge：require SSE4.1 + WX memory (#4590) @blotus
• WAF：supress erroneous warnings/errors when loading config / no rule has matched (#4587) @blotus
• Bot Detection：keep the original URL in the generated alert (#4586) @buixor
• fix(docker)：allow spaces in ENROLL_INSTANCE_NAME (#4582) @sahilnyk
• apiclient：return nil response if we couldnt connect to LAPI (#4573) @blotus
• cscli lapi register：no error if the credentials file does not exist (#4570) @lopster568
• fix(docker)：avoid panic on colliding nested crowdsec labels (#4555) @arpitjain099
• fix(syslog)：don't close the shared acquisition output channel (#4553) @alxrxs
• waf：track id/name pairs for all subrules (#4505) @blotus
• apiserver：prevent from fetching JWT token from query string (#4554) @blotus
• fix(leakybucket)：emit overflow before pouring the next event (#4547) @blotus
• loki：prevent duplicate log ingestion and improve timestamp handling (#4498) @Anulo2
• db：use proper mutex when checking if flush can happen (#4528) @blotus
• db：do not flush alerts with active decisions (#4527) @blotus
• Fix `Distinct()` panic on `[]string` and other non-`[]any` slices (#4543) @Synvoya
• fix(docker)：bouncer name strips wrong field from Docker secrets path (#4490) @tejgokani

## Chore / Deps

• build(deps)：bump astral-sh/setup-uv from 8.3.2 to 10.0.1 (#4625) @[dependabot[bot]](https://github.com/apps/dependabot)
• build(deps)：bump google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 (#4627) @[dependabot[bot]](https://github.com/apps/dependabot)
• build(deps)：bump the gomod group with 16 updates (#4626) @[dependabot[bot]](https://github.com/apps/dependabot)
• build(deps)：bump the github-actions group with 3 updates (#4624) @[dependabot[bot]](https://github.com/apps/dependabot)
• add claude.md to unify contribs (#4618) @buixor
• build(deps)：bump actions/setup-go from 6.5.0 to 7.0.0 (#4580) @[dependabot[bot]](https://github.com/apps/dependabot)
• build(deps)：bump actions/setup-python from 6.3.0 to 7.0.0 (#4578) @[dependabot[bot]](https://github.com/apps/dependabot)
• build(deps)：bump actions/setup-node from 6.4.0 to 7.0.0 (#4577) @[dependabot[bot]](https://github.com/apps/dependabot)
• build(deps)：bump the github-actions group across 1 directory with 5 updates (#4576) @[dependabot[bot]](https://github.com/apps/dependabot)
• build(deps)：bump the gomod group across 1 directory with 16 updates (#4612) @[dependabot[bot]](https://github.com/apps/dependabot)
• acquisition tests：do not rely on hardcoded timeout to finish tests (#4610) @blotus
• challenge：skip pre-warm in tests (#4611) @blotus
• challenge：update fpscanner to 1.0.8 (#4598) @blotus
• build(deps)：bump the gomod group with 6 updates (#4588) @[dependabot[bot]](https://github.com/apps/dependabot)
• ci(bats)：fix scenarios badge color variable name (#4551) @blotus
• ci(docker)：inherit secrets so the docker environment secrets resolve (#4550) @blotus
• build：use version based on latest for dev builds (#4583) @blotus
• build(deps)：bump the gomod group with 19 updates (#4581) @[dependabot[bot]](https://github.com/apps/dependabot)
• build(deps)：bump github.com/quic-go/quic-go from 0.57.0 to 0.59.1 (#4499) @[dependabot[bot]](https://github.com/apps/dependabot)
• build(deps)：bump cryptography from 46.0.6 to 48.0.1 in /build/docker/test (#4522) @[dependabot[bot]](https://github.com/apps/dependabot)
• build(deps-dev)：bump ruff from 0.15.20 to 0.15.22 in /build/docker/test in the uv group across 1 directory (#4559) @[dependabot[bot]](https://github.com/apps/dependabot)
• WAF：update coraza (#4572) @blotus
• build(deps)：bump the github-actions group across 1 directory with 3 updates (#4558) @[dependabot[bot]](https://github.com/apps/dependabot)
• build(deps)：bump the gomod group across 1 directory with 21 updates (#4566) @[dependabot[bot]](https://github.com/apps/dependabot)
• bump fpscanner to v1.0.7 (#4557) @blotus
• update go-re2 to 1.11.0 (#4478) @blotus
• Unify sqlite build flag (#4525) @zc-devs
• fix TestCryptoObfuscationDefaultPoolSize (#4565) @buixor
• build(deps)：bump the gomod group across 1 directory with 30 updates (#4542) @[dependabot[bot]](https://github.com/apps/dependabot)
• chore：delete publiccode.yml to comply with the process (#4552) @mazzma12
• build(deps)：bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#4549) @[dependabot[bot]](https://github.com/apps/dependabot)
• CI hardening (#4546) @blotus
• fix(docs)：set pubblicode.yml to correct version (#4548) @mazzma12
• build(deps)：bump cloudflare/wrangler-action from 3.15.0 to 4.0.0 (#4541) @[dependabot[bot]](https://github.com/apps/dependabot)
• build(deps)：bump codecov/codecov-action from 6.0.0 to 7.0.0 (#4540) @[dependabot[bot]](https://github.com/apps/dependabot)
• build(deps-dev)：bump the uv group in /build/docker/test with 2 updates (#4537) @[dependabot[bot]](https://github.com/apps/dependabot)
• build(deps)：bump the github-actions group with 7 updates (#4538) @[dependabot[bot]](https://github.com/apps/dependabot)
• build(deps)：bump actions/checkout from 6.0.2 to 7.0.0 (#4539) @[dependabot[bot]](https://github.com/apps/dependabot)
• build(deps)：bump golang.org/x/net from 0.53.0 to 0.55.0 (#4544) @[dependabot[bot]](https://github.com/apps/dependabot)
• build(deps)：bump the github-actions group across 1 directory with 11 updates (#4524) @[dependabot[bot]](https://github.com/apps/dependabot)
• build(deps)：bump the uv group across 1 directory with 3 updates (#4519) @[dependabot[bot]](https://github.com/apps/dependabot)
• build(deps)：bump alpine from 3.23 to 3.24 in /build/docker in the docker group across 1 directory (#4513) @[dependabot[bot]](https://github.com/apps/dependabot)

## Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from <a href="https://www.maxmind.com">https://www.maxmind.com</a>.

## Installation

Take a look at the [installation instructions](https://doc.crowdsec.net/docs/getting_started/install_crowdsec).