Releases: crowdsecurity/crowdsec
v1.6.8
Changes
- build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 (#3531) @dependabot[bot]
- CI: enable linter "noctx" (#3528) @mmetc
- CI: enable linter "containedctx" (#3529) @mmetc
- only warn about capi_whitelists_path being deprecated if actually in use (#3535) @blotus
- CI: pin hub branch during functional tests (#3526) @mmetc
- empty back-merge from release branch (#3527) @mmetc
Improvements
- explicit message for malformed data URL in local items (#3537) @mmetc
- Migration script from debian/ubuntu package 1.4.6 (#3420) @mmetc
Bug Fixes
- Allowlists: fix range check in LAPI endpoint (#3538) @blotus
- revert ActionPlan info/warning to StandardLogger (#3536) @mmetc
- fix #3532 "reload causes crashing process" (#3534) @mmetc
Chore / Deps
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Installation
Take a look at the installation instructions.
v1.6.7
Changes
- build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 (#3531) @dependabot[bot]
- CI: enable linter "noctx" (#3528) @mmetc
- CI: enable linter "containedctx" (#3529) @mmetc
- only warn about capi_whitelists_path being deprecated if actually in use (#3535) @blotus
- CI: pin hub branch during functional tests (#3526) @mmetc
- empty back-merge from release branch (#3527) @mmetc
Improvements
- explicit message for malformed data URL in local items (#3537) @mmetc
- Migration script from debian/ubuntu package 1.4.6 (#3420) @mmetc
Bug Fixes
- revert ActionPlan info/warning to StandardLogger (#3536) @mmetc
- fix #3532 "reload causes crashing process" (#3534) @mmetc
Chore / Deps
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Installation
Take a look at the installation instructions.
v1.6.7-rc1
Changes
- CI: enable linter "noctx" (#3528) @mmetc
- CI: enable linter "containedctx" (#3529) @mmetc
- only warn about capi_whitelists_path being deprecated if actually in use (#3535) @blotus
- CI: pin hub branch during functional tests (#3526) @mmetc
- empty back-merge from release branch (#3527) @mmetc
Bug Fixes
- revert ActionPlan info/warning to StandardLogger (#3536) @mmetc
- fix #3532 "reload causes crashing process" (#3534) @mmetc
Chore / Deps
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Installation
Take a look at the installation instructions.
v1.6.6
Overview
This release introduces centralized allowlists: you can now manage allowlists directly from LAPI or from the console.
Those allowlists will applied by LAPI to local decisions, appsec rules and blocklists, no need to deploy specific allowlists to each machine.
You can learn more about them in our documentation.
This release also deprecates capi_whitelists_path, and we encourage users to migrate to centralized allowlists as they are more flexible.
This release also introduces various improvements:
- JA4H helper for the appsec to compute hashes for HTTP requests
- Custom CA support and mTLS authentication for PostgreSQL/MySQL
- Various fixes
New Features
- Parallel hubtest (#3509) @mmetc
- deprecate capi_whitelists_path (#3504) @blotus
- Add support for centralized allowlists (#3355) @blotus
Changes
- appsec: use CA from client credentials when connecting to LAPI (#3505) @mmetc
- lint: gocritic/httpNoBody (#3493) @mmetc
- tests: remove modeline (#3486) @mmetc
- pkg/cwhub: refact Item.State.(Downloaded | Installed) (#3476) @mmetc
- refact: context propagation (apiclient, cticlient...) (#3477) @mmetc
- CI: use go 1.24 for windows (#3479) @mmetc
- tests: switch context.Background() -> t.Context() from go 1.24 (#3473) @mmetc
- refact: avoid use of defer calls in loops (#3466) @mmetc
- CI: lint docker tests (#3443) @mmetc
- lint: gocritic/typeDefFirst (ensure type definitions come before methods) (#3404) @mmetc
- file acquisition: remove redundant logging info (#3468) @mmetc
- CI: skip unit tests with dynamic build (#3461) @mmetc
Improvements
- appsec: support custom CA for lapi (#3503) @mmetc
- enhancement: Add additional ssl options to db configuration (#3387) @LaurenceJJones
- move ParseQuery to expr helpers, add ExtractQueryParam (#3491) @buixor
- enable/disable options for console enroll - make alert context a default (#3487) @buixor
- enhance: add option to disable magic syslog RFC parsers (#3435) @LaurenceJJones
- add JA4H expr helper (#3401) @blotus
- leaky bucket: reduce log verbosity (#3472) @mmetc
Bug Fixes
- update appsec test runner (#3518) @mmetc
- close appsec transactions after processing request (#3515) @blotus
- opensuse sets OSTYPE to linux (#3514) @blotus
- do not attempt to set db log level if no db config (#3510) @blotus
- appsec: less verbose logging for allowlists and headers check (#3498) @blotus
- enhance: Flags now superceed all log levels (#3496) @LaurenceJJones
- appsec: handle SendAlert() properly for out of band matches (#3497) @blotus
- cscli: review/update argument number checking (#3490) @mmetc
- crowdsec: allow -t to work if using appsec and allowlists (#3484) @blotus
- cron: avoid spamming stdout when the hub index is updated (#3485) @mmetc
- cscli: allow non-local symlinks to have a different name than hub items (#3475) @mmetc
- cscli hub/items: always show action plan; fix --interactive in pipes (#3451) @mmetc
- silence "cscli hub update" if noop in cron jobs (#3460) @mmetc
- cscli: don't attempt to download data files when url="" (#3454) @mmetc
Chore / Deps
- use go 1.24.1 (#3501) @mmetc
- update dependencies: color, go-sqlite3, tail, slack, testify (#3474) @mmetc
- use go 1.24, enable unencrypted http2 (#3470) @mmetc
- deps: use ent 0.14.2 (#3259) @mmetc
- build(deps): bump github.com/golang/glog from 1.2.2 to 1.2.4 (#3431) @dependabot[bot]
- deps: update gin-jwt (#3430) @mmetc
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Installation
Take a look at the installation instructions.
v1.6.6-rc5
Changes
- empty back-merge from release branch (#3506) @mmetc
- appsec: use CA from client credentials when connecting to LAPI (#3505) @mmetc
- lint: gocritic/httpNoBody (#3493) @mmetc
- tests: remove modeline (#3486) @mmetc
- pkg/cwhub: refact Item.State.(Downloaded | Installed) (#3476) @mmetc
- refact: context propagation (apiclient, cticlient...) (#3477) @mmetc
- CI: use go 1.24 for windows (#3479) @mmetc
- tests: switch context.Background() -> t.Context() from go 1.24 (#3473) @mmetc
- refact: avoid use of defer calls in loops (#3466) @mmetc
- CI: lint docker tests (#3443) @mmetc
- lint: gocritic/typeDefFirst (ensure type definitions come before methods) (#3404) @mmetc
- file acquisition: remove redundant logging info (#3468) @mmetc
- CI: skip unit tests with dynamic build (#3461) @mmetc
New Features
- Parallel hubtest (#3509) @mmetc
- deprecate capi_whitelists_path (#3504) @blotus
- Add support for centralized allowlists (#3355) @blotus
Improvements
- appsec: support custom CA for lapi (#3503) @mmetc
- enhancement: Add additional ssl options to db configuration (#3387) @LaurenceJJones
- move ParseQuery to expr helpers, add ExtractQueryParam (#3491) @buixor
- enable/disable options for console enroll - make alert context a default (#3487) @buixor
- enhance: add option to disable magic syslog RFC parsers (#3435) @LaurenceJJones
- add JA4H expr helper (#3401) @blotus
- leaky bucket: reduce log verbosity (#3472) @mmetc
Bug Fixes
- update appsec test runner (#3518) @mmetc
- close appsec transactions after processing request (#3515) @blotus
- opensuse sets OSTYPE to linux (#3514) @blotus
- do not attempt to set db log level if no db config (#3510) @blotus
- appsec: less verbose logging for allowlists and headers check (#3498) @blotus
- enhance: Flags now superceed all log levels (#3496) @LaurenceJJones
- appsec: handle SendAlert() properly for out of band matches (#3497) @blotus
- cscli: review/update argument number checking (#3490) @mmetc
- crowdsec: allow -t to work if using appsec and allowlists (#3484) @blotus
- cron: avoid spamming stdout when the hub index is updated (#3485) @mmetc
- cscli: allow non-local symlinks to have a different name than hub items (#3475) @mmetc
- cscli hub/items: always show action plan; fix --interactive in pipes (#3451) @mmetc
- silence "cscli hub update" if noop in cron jobs (#3460) @mmetc
- cscli: don't attempt to download data files when url="" (#3454) @mmetc
Chore / Deps
- use go 1.24.1 (#3501) @mmetc
- update dependencies: color, go-sqlite3, tail, slack, testify (#3474) @mmetc
- use go 1.24, enable unencrypted http2 (#3470) @mmetc
- deps: use ent 0.14.2 (#3259) @mmetc
- build(deps): bump github.com/golang/glog from 1.2.2 to 1.2.4 (#3431) @dependabot[bot]
- deps: update gin-jwt (#3430) @mmetc
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Installation
Take a look at the installation instructions.
v1.6.6-rc4
Changes
- empty back-merge from release branch (#3506) @mmetc
- appsec: use CA from client credentials when connecting to LAPI (#3505) @mmetc
- lint: gocritic/httpNoBody (#3493) @mmetc
- tests: remove modeline (#3486) @mmetc
- pkg/cwhub: refact Item.State.(Downloaded | Installed) (#3476) @mmetc
- refact: context propagation (apiclient, cticlient...) (#3477) @mmetc
- CI: use go 1.24 for windows (#3479) @mmetc
- tests: switch context.Background() -> t.Context() from go 1.24 (#3473) @mmetc
- refact: avoid use of defer calls in loops (#3466) @mmetc
- CI: lint docker tests (#3443) @mmetc
- lint: gocritic/typeDefFirst (ensure type definitions come before methods) (#3404) @mmetc
- file acquisition: remove redundant logging info (#3468) @mmetc
- CI: skip unit tests with dynamic build (#3461) @mmetc
New Features
- Parallel hubtest (#3509) @mmetc
- deprecate capi_whitelists_path (#3504) @blotus
- Add support for centralized allowlists (#3355) @blotus
Improvements
- appsec: support custom CA for lapi (#3503) @mmetc
- enhancement: Add additional ssl options to db configuration (#3387) @LaurenceJJones
- move ParseQuery to expr helpers, add ExtractQueryParam (#3491) @buixor
- enable/disable options for console enroll - make alert context a default (#3487) @buixor
- enhance: add option to disable magic syslog RFC parsers (#3435) @LaurenceJJones
- add JA4H expr helper (#3401) @blotus
- leaky bucket: reduce log verbosity (#3472) @mmetc
Bug Fixes
- close appsec transactions after processing request (#3515) @blotus
- opensuse sets OSTYPE to linux (#3514) @blotus
- do not attempt to set db log level if no db config (#3510) @blotus
- appsec: less verbose logging for allowlists and headers check (#3498) @blotus
- enhance: Flags now superceed all log levels (#3496) @LaurenceJJones
- appsec: handle SendAlert() properly for out of band matches (#3497) @blotus
- cscli: review/update argument number checking (#3490) @mmetc
- crowdsec: allow -t to work if using appsec and allowlists (#3484) @blotus
- cron: avoid spamming stdout when the hub index is updated (#3485) @mmetc
- cscli: allow non-local symlinks to have a different name than hub items (#3475) @mmetc
- cscli hub/items: always show action plan; fix --interactive in pipes (#3451) @mmetc
- silence "cscli hub update" if noop in cron jobs (#3460) @mmetc
- cscli: don't attempt to download data files when url="" (#3454) @mmetc
Chore / Deps
- use go 1.24.1 (#3501) @mmetc
- update dependencies: color, go-sqlite3, tail, slack, testify (#3474) @mmetc
- use go 1.24, enable unencrypted http2 (#3470) @mmetc
- deps: use ent 0.14.2 (#3259) @mmetc
- build(deps): bump github.com/golang/glog from 1.2.2 to 1.2.4 (#3431) @dependabot[bot]
- deps: update gin-jwt (#3430) @mmetc
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Installation
Take a look at the installation instructions.
v1.6.6-rc3
Changes
- empty back-merge from release branch (#3506) @mmetc
- appsec: use CA from client credentials when connecting to LAPI (#3505) @mmetc
- lint: gocritic/httpNoBody (#3493) @mmetc
- tests: remove modeline (#3486) @mmetc
- pkg/cwhub: refact Item.State.(Downloaded | Installed) (#3476) @mmetc
- refact: context propagation (apiclient, cticlient...) (#3477) @mmetc
- CI: use go 1.24 for windows (#3479) @mmetc
- tests: switch context.Background() -> t.Context() from go 1.24 (#3473) @mmetc
- refact: avoid use of defer calls in loops (#3466) @mmetc
- CI: lint docker tests (#3443) @mmetc
- lint: gocritic/typeDefFirst (ensure type definitions come before methods) (#3404) @mmetc
- file acquisition: remove redundant logging info (#3468) @mmetc
- CI: skip unit tests with dynamic build (#3461) @mmetc
New Features
- deprecate capi_whitelists_path (#3504) @blotus
- Add support for centralized allowlists (#3355) @blotus
Improvements
- appsec: support custom CA for lapi (#3503) @mmetc
- enhancement: Add additional ssl options to db configuration (#3387) @LaurenceJJones
- move ParseQuery to expr helpers, add ExtractQueryParam (#3491) @buixor
- enable/disable options for console enroll - make alert context a default (#3487) @buixor
- enhance: add option to disable magic syslog RFC parsers (#3435) @LaurenceJJones
- add JA4H expr helper (#3401) @blotus
- leaky bucket: reduce log verbosity (#3472) @mmetc
Bug Fixes
- appsec: less verbose logging for allowlists and headers check (#3498) @blotus
- enhance: Flags now superceed all log levels (#3496) @LaurenceJJones
- appsec: handle SendAlert() properly for out of band matches (#3497) @blotus
- cscli: review/update argument number checking (#3490) @mmetc
- crowdsec: allow -t to work if using appsec and allowlists (#3484) @blotus
- cron: avoid spamming stdout when the hub index is updated (#3485) @mmetc
- cscli: allow non-local symlinks to have a different name than hub items (#3475) @mmetc
- cscli hub/items: always show action plan; fix --interactive in pipes (#3451) @mmetc
- silence "cscli hub update" if noop in cron jobs (#3460) @mmetc
- cscli: don't attempt to download data files when url="" (#3454) @mmetc
Chore / Deps
- use go 1.24.1 (#3501) @mmetc
- update dependencies: color, go-sqlite3, tail, slack, testify (#3474) @mmetc
- use go 1.24, enable unencrypted http2 (#3470) @mmetc
- deps: use ent 0.14.2 (#3259) @mmetc
- build(deps): bump github.com/golang/glog from 1.2.2 to 1.2.4 (#3431) @dependabot[bot]
- deps: update gin-jwt (#3430) @mmetc
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Installation
Take a look at the installation instructions.
v1.6.6-rc2
Changes
- tests: remove modeline (#3486) @mmetc
- pkg/cwhub: refact Item.State.(Downloaded | Installed) (#3476) @mmetc
- refact: context propagation (apiclient, cticlient...) (#3477) @mmetc
- CI: use go 1.24 for windows (#3479) @mmetc
- tests: switch context.Background() -> t.Context() from go 1.24 (#3473) @mmetc
- refact: avoid use of defer calls in loops (#3466) @mmetc
- CI: lint docker tests (#3443) @mmetc
- lint: gocritic/typeDefFirst (ensure type definitions come before methods) (#3404) @mmetc
- file acquisition: remove redundant logging info (#3468) @mmetc
- CI: skip unit tests with dynamic build (#3461) @mmetc
New Features
Improvements
- enhance: add option to disable magic syslog RFC parsers (#3435) @LaurenceJJones
- add JA4H expr helper (#3401) @blotus
- leaky bucket: reduce log verbosity (#3472) @mmetc
Bug Fixes
- crowdsec: allow -t to work if using appsec and allowlists (#3484) @blotus
- cron: avoid spamming stdout when the hub index is updated (#3485) @mmetc
- cscli: allow non-local symlinks to have a different name than hub items (#3475) @mmetc
- cscli hub/items: always show action plan; fix --interactive in pipes (#3451) @mmetc
- silence "cscli hub update" if noop in cron jobs (#3460) @mmetc
- cscli: don't attempt to download data files when url="" (#3454) @mmetc
Chore / Deps
- update dependencies: color, go-sqlite3, tail, slack, testify (#3474) @mmetc
- use go 1.24, enable unencrypted http2 (#3470) @mmetc
- deps: use ent 0.14.2 (#3259) @mmetc
- build(deps): bump github.com/golang/glog from 1.2.2 to 1.2.4 (#3431) @dependabot[bot]
- deps: update gin-jwt (#3430) @mmetc
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Installation
Take a look at the installation instructions.
v1.6.6-rc1
Changes
- pkg/cwhub: refact Item.State.(Downloaded | Installed) (#3476) @mmetc
- refact: context propagation (apiclient, cticlient...) (#3477) @mmetc
- CI: use go 1.24 for windows (#3479) @mmetc
- tests: switch context.Background() -> t.Context() from go 1.24 (#3473) @mmetc
- refact: avoid use of defer calls in loops (#3466) @mmetc
- CI: lint docker tests (#3443) @mmetc
- lint: gocritic/typeDefFirst (ensure type definitions come before methods) (#3404) @mmetc
- file acquisition: remove redundant logging info (#3468) @mmetc
- CI: skip unit tests with dynamic build (#3461) @mmetc
New Features
Improvements
Bug Fixes
- cscli: allow non-local symlinks to have a different name than hub items (#3475) @mmetc
- cscli hub/items: always show action plan; fix --interactive in pipes (#3451) @mmetc
- silence "cscli hub update" if noop in cron jobs (#3460) @mmetc
- cscli: don't attempt to download data files when url="" (#3454) @mmetc
Chore / Deps
- update dependencies: color, go-sqlite3, tail, slack, testify (#3474) @mmetc
- use go 1.24, enable unencrypted http2 (#3470) @mmetc
- deps: use ent 0.14.2 (#3259) @mmetc
- build(deps): bump github.com/golang/glog from 1.2.2 to 1.2.4 (#3431) @dependabot[bot]
- deps: update gin-jwt (#3430) @mmetc
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Installation
Take a look at the installation instructions.
v1.6.5
Overview
**This release highlights the appsec feature. Important fixes were done. **
**The cscli hub
command has been revamped.
New Features
- acquisition/victorialogs: add new datasource (#3310) @zekker6
- Add possibility to configure log format #799 (#2941) @victoredvardsson
Improvements
- don't ask user to reload systemd service when running in docker (#3434) @mmetc
- enhance: Log appsec error on writing response to remediation (#3412) @LaurenceJJones
- test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing (#3400) @mmetc
- log warning if local items have conflicting names (#3399) @mmetc
- feat(cscli): add env variable flag for dashboard setup (#3110) @quantumsheep
- expand env var when loading acquis (#3375) @blotus
- cscli: restyle table titles; autocomplete "cscli metrics show" (#3391) @mmetc
- enhancement: Hubtest respect patterndir option set via config.yaml (#3386) @LaurenceJJones
- enhancement: add logdata to appsec AccumlateTxToEvent (#3383) @LaurenceJJones
- cscli: improved hub management (#3352) @mmetc
- cscli: display expired decisions' expiration time in red (#3357) @mmetc
- loop performance optimizations / 1 (#3313) @mmetc
Changes
- wizard.sh: remove obsolete --yes option (#3450) @mmetc
- cscli: replace '--yes' option with '--interactive' (#3448) @mmetc
- CI: use alpine 3.21 for docker build (#3445) @mmetc
- merge from master (dc28ae5) for 1.6.5 (#3444) @mmetc
- run 'hub upgrade' in rpm/deb postinst, improve hub message (#3440) @mmetc
- CI: setup go from version in go.mod (#3432) @mmetc
- CI: package docker tests with uv (#3429) @mmetc
- Improve post-installation message (#3407) @blotus
- deb packaging: prevent installing crowdsec.service twice (#3415) @mmetc
- deb build: get version with dpkg-parsechangelog -S (#3405) @mmetc
- cscli: cliconfig - refactor / remove global variables and gratuitous pointer (#3414) @mmetc
- lint: enable errcheck; add allowlist and explicit checks (#3403) @mmetc
- lint: gocritic/captLocal (don't capitalize local variables) (#3402) @mmetc
- remove commands "cscli config backup/restore" (#3158) @mmetc
- CI: golangci-lint 1.63 (#3396) @mmetc
- Hubops tests (#3393) @mmetc
- cscli hub: refact/split files; add some doc/examples (#3394) @mmetc
- lint: explicit error checks (#3388) @mmetc
- pkg/cwhub - refact Downloader (#3382) @mmetc
- lint: replace type assertions and type switch on errors (#3376) @mmetc
- refactor pkg/leakybucket (#3371) @mmetc
- refact pkg/database: clean up code and error messages (#3263) @mmetc
- lint/deep-exit: avoid log.Fatal (#3367) @mmetc
- loop performance optimizations / 2 (#3364) @mmetc
- lint/deep-exit: avoid log.Fatal (#3360) @mmetc
- lint: enable more gocritic checks (#3363) @mmetc
- acquisition: add some test and warning for wrong source type (#3362) @mmetc
- support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump (#3361) @blotus
- lint: style, autofix (#3354) @mmetc
- update golangci-lint to 1.62 (#3332) @mmetc
Bug Fixes
- cscli: exclude removed commands from generated docs (#3449) @mmetc
- cscli: when prompting, use default in case of EOF instead of going for "no" (#3447) @mmetc
- ignore zero value variables for context (#3436) @blotus
- bucket: avoid crashing on malformed expression (fix #3351) (#3368) @mmetc
- fix parsing of noncompliant RFC3339 timestamps missing only a timezone (#3346) @gilbsgilbs
- fix: use CreatedAt instead of StartAt (#3427) @LaurenceJJones
- use the actual bucket name when checking for simulation mode (#3416) @blotus
- appsec: do not attempt to deduplicate native modsec rules (#3347) @buixor
- Removed updating of machine last_heartbeat based on baseMetrics in MachineUpdateBaseMetrics (#3425) @srkoster
- cscli hub: handle freebsd pre-release version numbers (#3423) @mmetc
- wizard: install systemd service file (#3418) @mmetc
- pkg/cticlient: Add missing field in SmokeItem and FireItem (#3413) @AlteredCoder
- fix: Bucket pour log error with message (#3378) @LaurenceJJones
- gin: do not use gin context after returning response (#3398) @blotus
- wizard: unattended install w/ new hubops (#3392) @mmetc
- cscli: print errors in plain text with -o json (#2973) @mmetc
- sigmahq: fix functional test (#3359) @mmetc
- appsec: missing err check when initializing out-of-band engine (#3344) @blotus
Chore / Deps
- use go 1.23.5 (#3419) @mmetc
- upgrade coraza to latest version (#3417) @blotus
- README revamp (#3408) @buixor
- remove dependency from github.com/gofrs/uuid (#3406) @mmetc
- build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 (#3381) @dependabot[bot]
- build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#3380) @dependabot[bot]
- update dependency on docker (#3175) @mmetc
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Installation
Take a look at the installation instructions.