falcosecurity/falco 0.44.0

on GitHub

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

v0.44.0

Released on 2026-05-26

Breaking Changes ⚠️

• new!: add backslash escaping support to -o key-path parser for literal dots and brackets in YAML key names (e.g., -o 'my.dotted.key=val') [#3835] - @leogr
• chore!: drop gRPC output and server support [#3798] - @ekoops
• chore!: drop gVisor engine support [#3797] - @ekoops
• chore!: drop legacy BPF probe [#3796] - @ekoops

Major Changes

• feat(engine): support string comparator modifiers (oneof/allof/anyof) [#3878] - @therealbobo
• new(config,rules): add capture_events and capture_filesize stop conditions for capture files [#3824] - @leogr
• feat: validation for unknown-key in rules [#3805] - @leogr
• feat(userspace/engine): add support for list transformer exception [#3799] - @irozzo-1A

Minor Changes

• chore(build): Add USE_TSAN option to enable Thread Sanitizer. [#3856] - @irozzo-1A
• build: enable http_output, webserver, and metrics on macOS and Win [#3827] - @leogr

Bug Fixes

• fix(docker): Restrict falco-webui service to local access only [#3838] - @qux-bbb
• fix: show condition text in warning snippet for folded scalar conditions [#3858] - @ssam18
• fix: respect buffered_outputs YAML config value [#3830] - @leogr
• fix(userspace/falco): fix race condition in watchdog [#3820] - @irozzo-1A
• fix(scripts): update RPM repository metadata before signing when re-signing all packages [#3774] - @c2ndev

Non user-facing changes

• chore(cmake): bump libs to 0.25.2 [#3900] - @ekoops
• chore: update falco rules to version 5.1.0 and add rules sub-command to scripts/update-deps-version [#3890] - @ekoops
• chore(chart): move Falco chart source to falco (1/5) [#3889] - @c2ndev
• chore(chart): move Falco chart source to falco [#3884] - @c2ndev
• chore(cmake): bump libs to 0.25.1 and drivers to 10.2.0+driver [#3888] - @ekoops
• upstream multiple http_output fixes for Win/macOS (from prempti) [#3882] - @leogr
• chore: bump container plugin version to 0.7.1 [#3886] - @ekoops
• fix(ci): reference correct input name for sanitizers flag and update systemd-rpm-macros [#3885] - @irozzo-1A
• fix(build): use Zig cross-compilation toolchain for external dependencies [#3881] - @irozzo-1A
• chore(cmake/modules): bump libs version to 0.25.0-rc2 [#3876] - @ekoops
• chore: bump container plugin version to 0.7.0 [#3877] - @ekoops
• ci(.github): replace /area CI with /area automation in PR template [#3870] - @ekoops
• update(cmake): update libs and driver to latest release candidates [#3873] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3868] - @github-actions[bot]
• chore(cmake): bump falcoctl dependency version to 0.13.0 [#3869] - @c2ndev
• fix(userspace/engine): replace invalid chars while JSON-encoding [#3866] - @ekoops
• update(cmake): update libs and driver to latest master [#3864] - @github-actions[bot]
• build(docker): replace apt-key with keyring; use gnupg instead of gnupg2 [#3844] - @parisnakitakejser
• chore(cmake): bump drivers to 10.0.0-rc2+driver [#3863] - @ekoops
• chore(scripts): add script updating libs/drivers cmake module versions [#3862] - @ekoops
• chore(cmake): bump libs/drivers to 0.24.0-rc1/10.0.0-rc1+driver [#3861] - @ekoops
• ci(reusable_test_packages): produce core dumps when falco crashes [#3859] - @ekoops
• fix(config): prevent plugin library path traversal via relative paths [#3850] - @leogr
• fix: multi thread safety issues [#3852] - @leogr
• update(cmake): update libs and driver to latest master [#3823] - @github-actions[bot]
• ci: restore minimum set of required permissions [#3841] - @ekoops
• sync: docs(CHANGELOG.md): 0.43.1 [#3854] - @leogr
• feat(userspace/falco): add support for kernel iterator metrics [#3840] - @ekoops
• docs: multi-thread falco high-level design proposal [#3751] - @irozzo-1A
• fix(cmake): configure falco.yaml from current src dir [#3821] - @therealbobo
• fix(metrics): Prevent race condition crash during metrics collection on shutdown [#3741] - @adduali1310
• update(cmake): update libs and driver to latest master [#3765] - @github-actions[bot]
• chore(falco): fix warning in webserver.h [#3816] - @irozzo-1A
• docs: fix Contributing.md outdated references [#3807] - @cluster2600
• fix(webserver): fix inconsistent include directives trying to compile the webserver on Apple [#3802] - @legobrick
• chore(build): add support for gperftools CPU profiler [#3771] - @irozzo-1A
• revert: "chore(.github): put back temporary action for GPG key rotation" [#3776] - @leogr
• docs(proposals): specify version enforcing the deprecation [#3762] - @ekoops
• docs(OWNERS): add irozzo-1A(Iacopo Rozzo) as reviewer [#3773] - @irozzo-1A

Statistics

Release Manager @ekoops