What's Changed
Features
- feat: wire PII redaction through TracerConfig and honor custom rules by @gma1k in #242
- feat: detect unprivileged AF_ALG aead binds (CVE-2026-31431 Copy-Fail) by @gma1k in #243
- feat: trace HTTP/1.x endpoints from sockets with zero instrumentation by @gma1k in #248
- feat: stitch eBPF kernel spans into the apps OpenTelemetry trace by @gma1k in #249
- feat: capture HTTPS endpoints via SSL_read/SSL_write uprobes by @gma1k in #251
- feat: capture HTTP/2 (h2c) and Go crypto/tls L7 endpoints by @gma1k in #253
- feat: harden Go crypto/tls tracing (stripped binaries, arm64) by @gma1k in #254
- feat: decode HTTP/2 HPACK in userspace, deleting the in-kernel decoder by @gma1k in #255
- feat: capture Node.js HTTPS h1 + h2 over TLS, client and server by @gma1k in #259
- feat: capture TLS L7 by resolving SSL symbols from .symtab by @gma1k in #260
- feat: attach TLS uprobes by offset via build-id debug info by @gma1k in #261
- feat: fuse L4 peer 4-tuple onto L7 events by @gma1k in #262
- feat: capture HTTP/3 (QUIC) connections and SNI from the Initial packet by @gma1k in #263
- feat: decode HTTP/3 (QUIC) L7 requests and responses for quic-go by @gma1k in #265
- feat: harden HTTP/3 L7 with DWARF offsets and traceparent capture by @gma1k in #267
- feat: capture inbound HTTP/1.x server-side via connection keying by @gma1k in #269
- feat: capture grpc-go and netty-tcnative HTTP/2 L7 over TLS by @gma1k in #272
- feat: capture rustls (Rust) TLS L7 via plaintext uprobes by @gma1k in #276
- feat: resolve rustls symbols under v0 mangling and via debug files by @gma1k in #278
- feat: harden HTTP/3 tracing with peer fusion, QUIC v2, and adapters by @gma1k in #280
- feat: decode HTTP/2 :path mid-stream and stop idle-agent whole-node OOM by @gma1k in #283
- feat: decode inbound HTTP/3 adapter headers and probe quiche crate by @gma1k in #284
- feat: synthesize L7 spans and fix span identity by @gma1k in #289
- feat: bound and sandbox untrusted container-binary parsing by @gma1k in #297
- feat: per-pod multi-pod diagnose/profiling and cmd/ fixes by @gma1k in #308
- feat: graceful L7 degradation via bpf_loop probe and low-severity fixes by @gma1k in #314
- feat: probe every distinct binary in a container for uprobes by @gma1k in #320
- feat: trace every container of a targeted pod by default by @gma1k in #323
- feat: attribute cgroup_skb events to owning process at ingest by @gma1k in #327
- feat: wire USDT tracing and full DNS answer decode into the agent by @gma1k in #333
Bug Fixes
- fix(ci): guarantee a working bpftool on hosted runners for the release BTF guard by @gma1k in #229
- fix(ci): download static bpftool by @gma1k in #231
- fix: harden HTTP/2 userspace decode egress chunking, Go reads, buffer by @gma1k in #257
- fix: export session events and evict consumed stack traces by @gma1k in #285
- fix: report HTTP latency from responses and CPU% as a windowed delta by @gma1k in #293
- fix: build arm64 BPF objects with correct arch registers by @gma1k in #298
- fix: repair cgroup v1 resource monitoring and agent credential rotation by @gma1k in #302
- fix: resolve eBPF verifier rejections in HTTP and DNS probes by @gma1k in #303
- fix: drop bpf_get_current_comm from cgroup_skb programs by @Iandenh in #304
- fix: correct multi-namespace targeting and bundle/report lifecycle by @gma1k in #307
- fix: correct protocol-edge decoding and bound diagnose/tracer memory by @gma1k in #309
- fix: harden operator session lifecycle and agent exporters by @gma1k in #311
- fix: repair diagnose report math, tracer lifecycle, and validation by @gma1k in #312
- fix: harden agent security posture, chart schema, and CI drift gates by @gma1k in #313
- fix: gate container uprobes correctly and add missing SYS_PTRACE by @gma1k in #319
- fix: gate cross-namespace tracing on target-namespace consent by @gma1k in #328
- fix: bound process_name label cardinality in all metric exporters by @gma1k in #329
- fix: harden session lifecycle and exporter endpoint validation by @gma1k in #330
- fix: strip terminal control sequences from diagnose reports and sort kallsyms in n log n by @gma1k in #331
- fix: redact session/auth headers and harden pid-reuse attribution guard by @gma1k in #332
- fix: harden fastcgi/dns/grpc L7 parsing against malformed input by @gma1k in #334
- fix: resolve container main PID and store Splunk token in a Secret by @gma1k in #335
- fix: harden session child GC, dedup, env parsing, and artifact perms by @gma1k in #336
- fix: harden graph, truncation, nil derefs, and analyzer bounds by @gma1k in #337
- fix: harden cgroup match, numeric conversions, router, and DNS report by @gma1k in #338
Tests
- test: cover quicinitial QUIC Initial parsing and agent copy-fail alert by @gma1k in #279
- test: broaden unit-test coverage across cmd and internal packages by @gma1k in #342
- test: expand unit-test coverage across cmd and internal packages by @gma1k in #345
CI / Build
Maintenance
- chore(release): release 0.13.1 by @gma1k in #230
- chore(release): release 0.13.2 by @gma1k in #232
- chore(deps): update go modules (non-major) to v1.8.0 by @renovate[bot] in #233
- chore(deps): update go modules (non-major) to v1.14.0 by @renovate[bot] in #235
- chore(deps): update go modules (non-major) by @renovate[bot] in #236
- chore(deps): update docker/dockerfile docker tag to v1.25 by @renovate[bot] in #238
- chore(deps): update github actions to v7 by @renovate[bot] in #239
- chore(deps): pin helm to v4.2.2 and free runner disk in chainsaw by @gma1k in #240
- chore(deps): update github actions to v3.0.1 by @renovate[bot] in #241
- chore(deps): update go modules (non-major) by @renovate[bot] in #244
- chore(release): release 0.13.3 by @gma1k in #234
- chore(deps): update github actions by @renovate[bot] in #246
- chore(deps): update module cloud.google.com/go/storage to v1.63.0 by @renovate[bot] in #250
- chore(deps): update module github.com/cilium/ebpf to v0.22.0 by @renovate[bot] in #252
- chore(release): release 0.13.4 by @gma1k in #247
- chore(deps): update golangci/golangci-lint-action action to v9.3.0 by @renovate[bot] in #264
- chore(deps): update go modules (non-major) by @renovate[bot] in #266
- chore(release): release 0.13.5 by @gma1k in #258
- chore(deps): update module google.golang.org/grpc to v1.82.0 by @renovate[bot] in #270
- chore(deps): update module google.golang.org/api to v0.287.0 by @renovate[bot] in #271
- chore(deps): update github actions by @renovate[bot] in #273
- chore(deps): update go modules (non-major) by @renovate[bot] in #274
- chore(deps): update github actions by @renovate[bot] in #275
- chore(release): release 0.13.6 by @gma1k in #268
- chore(deps): update docker/login-action action to v4.4.0 by @renovate[bot] in #282
- chore(release): release 0.13.7 by @gma1k in #281
- chore(deps): update module sigs.k8s.io/structured-merge-diff/v6 to v6.4.1 by @renovate[bot] in #288
- chore(deps): update go modules (non-major) by @renovate[bot] in #287
- chore(deps): update github/codeql-action action to v4.37.0 by @renovate[bot] in #295
- chore(deps): update module sigs.k8s.io/structured-merge-diff/v6 to v6.4.2 by @renovate[bot] in #294
- chore(deps): update go modules (non-major) by @renovate[bot] in #296
- chore(deps): update actions/download-artifact action to v8 by @renovate[bot] in #299
- chore(deps): update go modules (non-major) by @renovate[bot] in #300
- chore(deps): update actions/labeler action to v6.2.0 by @renovate[bot] in #301
- chore(deps): update module google.golang.org/api to v0.288.0 by @renovate[bot] in #305
- chore(deps): update oras-project/setup-oras action to v2.0.1 by @renovate[bot] in #310
- chore(release): release 0.13.8 by @gma1k in #286
- chore(deps): update module cloud.google.com/go/storage to v1.63.1 by @renovate[bot] in #315
- chore(deps): update go modules (non-major) by @renovate[bot] in #318
- chore(deps): update softprops/action-gh-release action to v3.0.2 by @renovate[bot] in #317
- chore(deps): update module google.golang.org/grpc to v1.82.1 by @renovate[bot] in #321
- chore(deps): update actions/setup-go action to v7 by @renovate[bot] in #322
- chore(deps): update github/codeql-action action to v4.37.1 by @renovate[bot] in #324
- chore(release): release 0.13.9 by @gma1k in #316
- chore(deps): update go modules (non-major) by @renovate[bot] in #325
- chore(release): release 0.13.10 by @gma1k in #326
- chore(deps): update actions/labeler action to v7 by @renovate[bot] in #341
- chore(deps): update github actions by @renovate[bot] in #339
- chore(deps): update go modules (non-major) by @renovate[bot] in #340
- chore(deps): update github/codeql-action action to v4.37.3 by @renovate[bot] in #344
- chore: trigger release 0.14.0 by @gma1k in #346
Other Changes
- verify fork sync via branches SHAs instead of cached compare by @gma1k in #245
- fix: reject TLS records in h2c frame detection to drop ciphertext noise by @gma1k in #277
- fixes two operator control-plane bugs that could silently drop a node from a trace or re-run privileged tracing Jobs forever by @gma1k in #290
- fix: make tcp_peer_stash LRU so peer fusion survives thread churn by @gma1k in #291
- fix: stop resource alerts poisoning Event.Error consumers by @gma1k in #292
New Contributors
Full Changelog: v0.13.0...v0.14.0