falcosecurity/falco 0.45.0

on GitHub

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

v0.45.0

Released on 2026-09-21

Breaking Changes ⚠️

• feat(userspace)!: evaluate rule conditions on raw field bytes (invalid and non-printable UTF-8 sequences are now matchable with string operators, single bytes with the new \xHH escape sequence), let regex operate on sanitized input, and escape non-printable characters / replace invalid UTF-8 sequences at output encoding time; FALCO_ENGINE_VERSION bumped from 0.62.0 to 0.63.0; rules that matched the replacement character with non-regex operators must be reviewed [#3942] - @ekoops

Major Changes

• new(chart): add serviceAccount.labels to set custom labels on the ServiceAccount [#3946] - @Goutham-Annem
• feat(falco): Expose reload status through GET /reload and add optional reload control over a protected Unix socket on Linux. Preserve SIGHUP reception and pending requests across reloads. [#4005] - @c2ndev
• feat(userspace/falco): suggest --dry-run when --validate receives a Falco configuration file [#3947] - @AkashKumar7902

Minor Changes

• update(build): bump falcoctl to 0.14.2 [#3996] - @leogr
• update(chart): bump the falcosidekick subchart constraint to 0.14.* and the falco-talon subchart constraint to 0.4.* [#3990] - @leogr
• chore(userspace/falco): drop the container_engines leftovers from the configuration JSON schema; configurations still setting this key now log a schema validation warning at startup [#3924] - @ekoops

Bug Fixes

• fix(falco): no unsupported syscalls warning is printed anymore when replaying a capture [#4003] - @leogr
• fix(falco): the unsupported syscalls warning now points to base_syscalls.all instead of the removed -A flag [#4001] - @leogr
• fix(packaging): restore Falco services and persistent kernel modules after upgrades, migrate package-default driver pins, and clean up package-created systemd state on removal [#3994] - @leogr
• fix(chart): always mount an emptyDir at /etc/falco/config.d, and bump the default falcoctl image to 0.14.1, the container plugin to 0.7.4, and the k8smeta plugin to 0.4.2 [#3984] - @leogr
• fix(chart): mount the container engine socket directories instead of the socket files, so Falco keeps working after a container runtime restart [#3978] - @leogr
• fix(chart): support DaemonSet revision history limits and honor an explicit zero for both DaemonSet and Deployment controllers. [#3931] - @Goutham-Annem
• fix(chart): do not render the falcoctl config volume when falcoctl artifact install and follow are disabled [#3894] - @immanuwell
• fix(engine): falco --list no longer incorrectly labels the evt field class with a specific event source [#3936] - @Wahid7852
• fix(cmake): add support for 64K kernel page to jemalloc on aarch64 [#3970] - @lekanjava
• fix(userspace): open the pidfile with O_NOFOLLOW to prevent a symlink TOCTOU when the pidfile path is in an attacker-writable directory. The pidfile content now ends with a trailing newline [#3871] - @alexmchughdev
• fix(chart): correct the inverted priority level mappings in the Grafana dashboard, so severity labels match Falco's numeric priorities (0=emergency ... 7=debug) [#3932] - @Goutham-Annem
• fix(engine): correctly match wildcard patterns when the literal segment that follows a * appears more than once in the input (e.g. *.yaml against backup.yaml.yaml, or wildcard enable/disable of rule names whose names repeat a literal segment). [#3913] - @tejgokani
• fix(userspace/falco): use the absolute modprobe path instead of a PATH lookup when falling back to loading the kernel module (untrusted search path, CWE-426) [#3943] - @BoxStrikesTeam
• fix: serve SIGHUP-triggered hot restart when watch_config_files is disabled [#3939] - @c2ndev
• fix(engine): do not emit the LOAD_NO_EVTTYPE warning for rules with statically unsatisfiable conditions (e.g. the never_true placeholder idiom) [#3918] - @leogr

Non user-facing changes

• test(engine): add unit tests for multi-value transformer AST visitors [#3860] - @therealbobo
• Update owner from andreagit97 to andreaterzolo [#3965] - @andreaterzolo
• refactor: rename is_capture_mode [#4006] - @sgaist
• ci(release): use a rn2md build that accepts the new GitHub token format [#3997] - @leogr
• chore(cmake): bump libs to 0.26.0 and drivers to 11.0.0+driver [#3992] - @github-actions[bot]
• chore(cmake): bump libs to 0.26.0-rc2, falcoctl to 0.14.1, and the container plugin to 0.7.4 [#3985] - @leogr
• fix(ci): bump setup-crane to v0.7 to retry crane download errors [#3983] - @leogr
• fix(chart): restore v9.1.0 release metadata [#3977] - @leogr
• docs(chart): clarify mTLS scope for k8saudit [#3976] - @leogr
• docs(OWNERS): add c2ndev as reviewer [#3980] - @c2ndev
• chore(cmake): bump libs/drivers to 0.26.0-rc1/11.0.0-rc1+driver [#3971] - @github-actions[bot]
• chore(ci): update the Scorecard workflow actions [#3974] - @leogr
• chore(cmake): update falco rules to version 5.2.0 [#3973] - @leogr
• chore(cmake): bump falcoctl to 0.14.0 and container plugin to 0.7.2 [#3972] - @leogr
• test(engine): cover rejection of empty appended rules [#3935] - @Jvlegod
• fix(engine): add empty string guards in logger [#3937] - @archy-rock3t-cloud
• update(cmake): update libs and driver to latest master [#3948] - @github-actions[bot]
• Add Pollinate to ADOPTERS.md [#3933] - @rr16-chemeng
• update(cmake): update libs and driver to latest master [#3957] - @github-actions[bot]
• ci: add e2e tests leveraging the event-generator [#3950] - @ekoops
• test: add event-generator test suite for e2e-testing [#3949] - @ekoops
• docs(OWNERS): moving andreagit97 to emeritus [#3944] - @leogr
• chore(chart): define source chart release workflow [#3898] - @c2ndev

Statistics

Release Manager @leogr