falcosecurity/falco 0.42.0

on GitHub

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

v0.42.0

Released on 2025-10-22

Major Changes

• feat: add falco_libs.thread_table_auto_purging_interval_s and thread_table_auto_purging_thread_timeout_s configuration options [#3670] - @ekoops
• feat: log plugin version info at loading time [#3657] - @FedeDP
• feat: ability to add statically defined fields via static_fields configuration [#3557] - @FedeDP
• feat(engine): emit warning when a rule containing the evt.dir field in output is encountered [#3697] - @irozzo-1A
• feat(engine): emit warning when a rule containing a condition on the deprecated evt.dir field is encountered [#3690] - @irozzo-1A
• new: ability to record .scap files (capture feature) [#3645] - @leogr
• new(docker): includes sha on the image labels [#3658] - @jcchavezs
• new(cmake,userspace,ci): add mimalloc support [#3616] - @FedeDP

Minor Changes

• docs(falco.yaml): refactor config documentation [#3685] - @leogr
• build: fix debian:buster apt debian repo URL in :driver-loader-buster container image [#3644] - @ekoops
• build: updagrade libs to version 0.22.1 [#3705] - @irozzo-1A
• build: upgrade drivers to v9.0.0+driver [#3701] - @irozzo-1A
• build: upgrade cpp-httplib to v0.23.1 [#3647] - @FedeDP
• update: upgrade default ruleset to v5.0.0 [#3700] - @leogr
• build: upgrade falcoctl to v0.11.4 [#3694] - @leogr
• chore(prometheus): deprecate enter events drop stats [#3675] - @irozzo-1A

Bug Fixes

• fix(cmake): correct abseil-cpp for alpine build [#3598] - @RomanenkoDenys
• fix: enable handling of multiple actions configured with syscall_event_drops.actions [#3676] - @terror96
• fix: disable dry-run restarts when Falco runs with config-watching disabled [#3640] - @Proximyst

Non user-facing changes

• fix(userspace/falco): correct default duration calculation [#3715] - @leogr
• chore(falcoctl): update falco rules to version 5 [#3712] - @irozzo-1A
• doc(OWNERS): move incertum (Melissa Kilby) to emeritus_approvers [#3605] - @incertum
• update(cmake): update libs and driver to latest master [#3689] - @github-actions[bot]
• chore(docker): use new ENV syntax in place of deprecated one [#3696] - @ekoops
• chore(cmake/modules): update rules to 5.0.0-rc1 [#3698] - @leogr
• fix(userspace/engine): fix logger date format [#3672] - @ekoops
• docs(OWNERS): add ekoops(Leonardo Di Giovanna) as approver [#3688] - @ekoops
• update(cmake): update libs and driver to latest master [#3665] - @github-actions[bot]
• Refactor: cppcheck cleanups [#3649] - @sgaist
• update(userspace/engine): update falco engine version and checksum [#3648] - @ekoops
• update(cmake): update libs and driver to latest master [#3662] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3661] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3653] - @github-actions[bot]
• chore(ci): disable mimalloc for master builds. [#3655] - @FedeDP
• chore(deps): Bump submodules/falcosecurity-rules from 1208816 to be38001 [#3651] - @dependabot[bot]
• docs(falco.yaml): avoid out-of-sync config options for container pl… [#3650] - @leogr
• update(cmake): update libs and driver to latest master [#3636] - @github-actions[bot]
• update(CHANGELOG.md): release 0.41.3 (cherry-pick) [#3634] - @ekoops
• update(cmake): update libs and driver to latest master [#3628] - @github-actions[bot]
• update(CHANGELOG.md): release 0.41.2 (cherry-pick) [#3623] - @ekoops
• update(cmake): update libs and driver to latest master [#3618] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3602] - @github-actions[bot]
• chore(falco.yaml): clean up plugins config leftover [#3596] - @leogr
• chore(deps): Bump submodules/falcosecurity-rules from b4437c4 to 4d51b18 [#3607] - @dependabot[bot]
• update(docs): cherry pick CHANGELOG. [#3600] - @FedeDP
• update(cmake): update libs and driver to latest master [#3592] - @github-actions[bot]
• update(docs): bumped changelog for release 0.41.0, master sync [#3586] - @FedeDP
• chore(deps): Bump submodules/falcosecurity-rules from cb17833 to b4437c4 [#3578] - @dependabot[bot]

Statistics

Release Manager @ekoops