v1.6.5

Overview

**This release highlights the appsec feature. Important fixes were done. **

See documentation here

**The cscli hub command has been revamped.

See documentation here

New Features

• acquisition/victorialogs: add new datasource (#3310) @zekker6
• Add possibility to configure log format #799 (#2941) @victoredvardsson

Improvements

• don't ask user to reload systemd service when running in docker (#3434) @mmetc
• enhance: Log appsec error on writing response to remediation (#3412) @LaurenceJJones
• test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing (#3400) @mmetc
• log warning if local items have conflicting names (#3399) @mmetc
• feat(cscli): add env variable flag for dashboard setup (#3110) @quantumsheep
• expand env var when loading acquis (#3375) @blotus
• cscli: restyle table titles; autocomplete "cscli metrics show" (#3391) @mmetc
• enhancement: Hubtest respect patterndir option set via config.yaml (#3386) @LaurenceJJones
• enhancement: add logdata to appsec AccumlateTxToEvent (#3383) @LaurenceJJones
• cscli: improved hub management (#3352) @mmetc
• cscli: display expired decisions' expiration time in red (#3357) @mmetc
• loop performance optimizations / 1 (#3313) @mmetc

Changes

• wizard.sh: remove obsolete --yes option (#3450) @mmetc
• cscli: replace '--yes' option with '--interactive' (#3448) @mmetc
• CI: use alpine 3.21 for docker build (#3445) @mmetc
• merge from master (dc28ae5) for 1.6.5 (#3444) @mmetc
• run 'hub upgrade' in rpm/deb postinst, improve hub message (#3440) @mmetc
• CI: setup go from version in go.mod (#3432) @mmetc
• CI: package docker tests with uv (#3429) @mmetc
• Improve post-installation message (#3407) @blotus
• deb packaging: prevent installing crowdsec.service twice (#3415) @mmetc
• deb build: get version with dpkg-parsechangelog -S (#3405) @mmetc
• cscli: cliconfig - refactor / remove global variables and gratuitous pointer (#3414) @mmetc
• lint: enable errcheck; add allowlist and explicit checks (#3403) @mmetc
• lint: gocritic/captLocal (don't capitalize local variables) (#3402) @mmetc
• remove commands "cscli config backup/restore" (#3158) @mmetc
• CI: golangci-lint 1.63 (#3396) @mmetc
• Hubops tests (#3393) @mmetc
• cscli hub: refact/split files; add some doc/examples (#3394) @mmetc
• lint: explicit error checks (#3388) @mmetc
• pkg/cwhub - refact Downloader (#3382) @mmetc
• lint: replace type assertions and type switch on errors (#3376) @mmetc
• refactor pkg/leakybucket (#3371) @mmetc
• refact pkg/database: clean up code and error messages (#3263) @mmetc
• lint/deep-exit: avoid log.Fatal (#3367) @mmetc
• loop performance optimizations / 2 (#3364) @mmetc
• lint/deep-exit: avoid log.Fatal (#3360) @mmetc
• lint: enable more gocritic checks (#3363) @mmetc
• acquisition: add some test and warning for wrong source type (#3362) @mmetc
• support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump (#3361) @blotus
• lint: style, autofix (#3354) @mmetc
• update golangci-lint to 1.62 (#3332) @mmetc

Bug Fixes

• cscli: exclude removed commands from generated docs (#3449) @mmetc
• cscli: when prompting, use default in case of EOF instead of going for "no" (#3447) @mmetc
• ignore zero value variables for context (#3436) @blotus
• bucket: avoid crashing on malformed expression (fix #3351) (#3368) @mmetc
• fix parsing of noncompliant RFC3339 timestamps missing only a timezone (#3346) @gilbsgilbs
• fix: use CreatedAt instead of StartAt (#3427) @LaurenceJJones
• use the actual bucket name when checking for simulation mode (#3416) @blotus
• appsec: do not attempt to deduplicate native modsec rules (#3347) @buixor
• Removed updating of machine last_heartbeat based on baseMetrics in MachineUpdateBaseMetrics (#3425) @srkoster
• cscli hub: handle freebsd pre-release version numbers (#3423) @mmetc
• wizard: install systemd service file (#3418) @mmetc
• pkg/cticlient: Add missing field in SmokeItem and FireItem (#3413) @AlteredCoder
• fix: Bucket pour log error with message (#3378) @LaurenceJJones
• gin: do not use gin context after returning response (#3398) @blotus
• wizard: unattended install w/ new hubops (#3392) @mmetc
• cscli: print errors in plain text with -o json (#2973) @mmetc
• sigmahq: fix functional test (#3359) @mmetc
• appsec: missing err check when initializing out-of-band engine (#3344) @blotus

Chore / Deps

• use go 1.23.5 (#3419) @mmetc
• upgrade coraza to latest version (#3417) @blotus
• README revamp (#3408) @buixor
• remove dependency from github.com/gofrs/uuid (#3406) @mmetc
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 (#3381) @dependabot[bot]
• build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#3380) @dependabot[bot]
• update dependency on docker (#3175) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.5-rc8

Changes

• wizard.sh: remove obsolete --yes option (#3450) @mmetc
• cscli: replace '--yes' option with '--interactive' (#3448) @mmetc
• CI: use alpine 3.21 for docker build (#3445) @mmetc
• merge from master (dc28ae5) for 1.6.5 (#3444) @mmetc
• run 'hub upgrade' in rpm/deb postinst, improve hub message (#3440) @mmetc
• CI: setup go from version in go.mod (#3432) @mmetc
• CI: package docker tests with uv (#3429) @mmetc
• Improve post-installation message (#3407) @blotus
• deb packaging: prevent installing crowdsec.service twice (#3415) @mmetc
• deb build: get version with dpkg-parsechangelog -S (#3405) @mmetc
• cscli: cliconfig - refactor / remove global variables and gratuitous pointer (#3414) @mmetc
• lint: enable errcheck; add allowlist and explicit checks (#3403) @mmetc
• lint: gocritic/captLocal (don't capitalize local variables) (#3402) @mmetc
• remove commands "cscli config backup/restore" (#3158) @mmetc
• CI: golangci-lint 1.63 (#3396) @mmetc
• Hubops tests (#3393) @mmetc
• cscli hub: refact/split files; add some doc/examples (#3394) @mmetc
• lint: explicit error checks (#3388) @mmetc
• pkg/cwhub - refact Downloader (#3382) @mmetc
• lint: replace type assertions and type switch on errors (#3376) @mmetc
• refactor pkg/leakybucket (#3371) @mmetc
• refact pkg/database: clean up code and error messages (#3263) @mmetc
• lint/deep-exit: avoid log.Fatal (#3367) @mmetc
• loop performance optimizations / 2 (#3364) @mmetc
• lint/deep-exit: avoid log.Fatal (#3360) @mmetc
• lint: enable more gocritic checks (#3363) @mmetc
• acquisition: add some test and warning for wrong source type (#3362) @mmetc
• support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump (#3361) @blotus
• lint: style, autofix (#3354) @mmetc
• update golangci-lint to 1.62 (#3332) @mmetc

New Features

• acquisition/victorialogs: add new datasource (#3310) @zekker6
• Add possibility to configure log format #799 (#2941) @victoredvardsson

Improvements

• don't ask user to reload systemd service when running in docker (#3434) @mmetc
• enhance: Log appsec error on writing response to remediation (#3412) @LaurenceJJones
• test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing (#3400) @mmetc
• log warning if local items have conflicting names (#3399) @mmetc
• feat(cscli): add env variable flag for dashboard setup (#3110) @quantumsheep
• expand env var when loading acquis (#3375) @blotus
• cscli: restyle table titles; autocomplete "cscli metrics show" (#3391) @mmetc
• enhancement: Hubtest respect patterndir option set via config.yaml (#3386) @LaurenceJJones
• enhancement: add logdata to appsec AccumlateTxToEvent (#3383) @LaurenceJJones
• cscli: improved hub management (#3352) @mmetc
• cscli: display expired decisions' expiration time in red (#3357) @mmetc
• loop performance optimizations / 1 (#3313) @mmetc

Bug Fixes

• cscli: exclude removed commands from generated docs (#3449) @mmetc
• cscli: when prompting, use default in case of EOF instead of going for "no" (#3447) @mmetc
• ignore zero value variables for context (#3436) @blotus
• bucket: avoid crashing on malformed expression (fix #3351) (#3368) @mmetc
• fix parsing of noncompliant RFC3339 timestamps missing only a timezone (#3346) @gilbsgilbs
• fix: use CreatedAt instead of StartAt (#3427) @LaurenceJJones
• use the actual bucket name when checking for simulation mode (#3416) @blotus
• appsec: do not attempt to deduplicate native modsec rules (#3347) @buixor
• Removed updating of machine last_heartbeat based on baseMetrics in MachineUpdateBaseMetrics (#3425) @srkoster
• cscli hub: handle freebsd pre-release version numbers (#3423) @mmetc
• wizard: install systemd service file (#3418) @mmetc
• pkg/cticlient: Add missing field in SmokeItem and FireItem (#3413) @AlteredCoder
• fix: Bucket pour log error with message (#3378) @LaurenceJJones
• gin: do not use gin context after returning response (#3398) @blotus
• wizard: unattended install w/ new hubops (#3392) @mmetc
• cscli: print errors in plain text with -o json (#2973) @mmetc
• sigmahq: fix functional test (#3359) @mmetc
• appsec: missing err check when initializing out-of-band engine (#3344) @blotus

Chore / Deps

• use go 1.23.5 (#3419) @mmetc
• upgrade coraza to latest version (#3417) @blotus
• README revamp (#3408) @buixor
• remove dependency from github.com/gofrs/uuid (#3406) @mmetc
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 (#3381) @dependabot[bot]
• build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#3380) @dependabot[bot]
• update dependency on docker (#3175) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.5-rc7

Changes

• cscli: replace '--yes' option with '--interactive' (#3448) @mmetc
• CI: use alpine 3.21 for docker build (#3445) @mmetc
• merge from master (dc28ae5) for 1.6.5 (#3444) @mmetc
• run 'hub upgrade' in rpm/deb postinst, improve hub message (#3440) @mmetc
• CI: setup go from version in go.mod (#3432) @mmetc
• CI: package docker tests with uv (#3429) @mmetc
• Improve post-installation message (#3407) @blotus
• deb packaging: prevent installing crowdsec.service twice (#3415) @mmetc
• deb build: get version with dpkg-parsechangelog -S (#3405) @mmetc
• cscli: cliconfig - refactor / remove global variables and gratuitous pointer (#3414) @mmetc
• lint: enable errcheck; add allowlist and explicit checks (#3403) @mmetc
• lint: gocritic/captLocal (don't capitalize local variables) (#3402) @mmetc
• remove commands "cscli config backup/restore" (#3158) @mmetc
• CI: golangci-lint 1.63 (#3396) @mmetc
• Hubops tests (#3393) @mmetc
• cscli hub: refact/split files; add some doc/examples (#3394) @mmetc
• lint: explicit error checks (#3388) @mmetc
• pkg/cwhub - refact Downloader (#3382) @mmetc
• lint: replace type assertions and type switch on errors (#3376) @mmetc
• refactor pkg/leakybucket (#3371) @mmetc
• refact pkg/database: clean up code and error messages (#3263) @mmetc
• lint/deep-exit: avoid log.Fatal (#3367) @mmetc
• loop performance optimizations / 2 (#3364) @mmetc
• lint/deep-exit: avoid log.Fatal (#3360) @mmetc
• lint: enable more gocritic checks (#3363) @mmetc
• acquisition: add some test and warning for wrong source type (#3362) @mmetc
• support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump (#3361) @blotus
• lint: style, autofix (#3354) @mmetc
• update golangci-lint to 1.62 (#3332) @mmetc

New Features

• acquisition/victorialogs: add new datasource (#3310) @zekker6
• Add possibility to configure log format #799 (#2941) @victoredvardsson

Improvements

• don't ask user to reload systemd service when running in docker (#3434) @mmetc
• enhance: Log appsec error on writing response to remediation (#3412) @LaurenceJJones
• test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing (#3400) @mmetc
• log warning if local items have conflicting names (#3399) @mmetc
• feat(cscli): add env variable flag for dashboard setup (#3110) @quantumsheep
• expand env var when loading acquis (#3375) @blotus
• cscli: restyle table titles; autocomplete "cscli metrics show" (#3391) @mmetc
• enhancement: Hubtest respect patterndir option set via config.yaml (#3386) @LaurenceJJones
• enhancement: add logdata to appsec AccumlateTxToEvent (#3383) @LaurenceJJones
• cscli: improved hub management (#3352) @mmetc
• cscli: display expired decisions' expiration time in red (#3357) @mmetc
• loop performance optimizations / 1 (#3313) @mmetc

Bug Fixes

• cscli: when prompting, use default in case of EOF instead of going for "no" (#3447) @mmetc
• ignore zero value variables for context (#3436) @blotus
• bucket: avoid crashing on malformed expression (fix #3351) (#3368) @mmetc
• fix parsing of noncompliant RFC3339 timestamps missing only a timezone (#3346) @gilbsgilbs
• fix: use CreatedAt instead of StartAt (#3427) @LaurenceJJones
• use the actual bucket name when checking for simulation mode (#3416) @blotus
• appsec: do not attempt to deduplicate native modsec rules (#3347) @buixor
• Removed updating of machine last_heartbeat based on baseMetrics in MachineUpdateBaseMetrics (#3425) @srkoster
• cscli hub: handle freebsd pre-release version numbers (#3423) @mmetc
• wizard: install systemd service file (#3418) @mmetc
• pkg/cticlient: Add missing field in SmokeItem and FireItem (#3413) @AlteredCoder
• fix: Bucket pour log error with message (#3378) @LaurenceJJones
• gin: do not use gin context after returning response (#3398) @blotus
• wizard: unattended install w/ new hubops (#3392) @mmetc
• cscli: print errors in plain text with -o json (#2973) @mmetc
• sigmahq: fix functional test (#3359) @mmetc
• appsec: missing err check when initializing out-of-band engine (#3344) @blotus

Chore / Deps

• use go 1.23.5 (#3419) @mmetc
• upgrade coraza to latest version (#3417) @blotus
• README revamp (#3408) @buixor
• remove dependency from github.com/gofrs/uuid (#3406) @mmetc
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 (#3381) @dependabot[bot]
• build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#3380) @dependabot[bot]
• update dependency on docker (#3175) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.5-rc6

Changes

• CI: use alpine 3.21 for docker build (#3445) @mmetc
• merge from master (dc28ae5) for 1.6.5 (#3444) @mmetc
• run 'hub upgrade' in rpm/deb postinst, improve hub message (#3440) @mmetc
• CI: setup go from version in go.mod (#3432) @mmetc
• CI: package docker tests with uv (#3429) @mmetc
• Improve post-installation message (#3407) @blotus
• deb packaging: prevent installing crowdsec.service twice (#3415) @mmetc
• deb build: get version with dpkg-parsechangelog -S (#3405) @mmetc
• cscli: cliconfig - refactor / remove global variables and gratuitous pointer (#3414) @mmetc
• lint: enable errcheck; add allowlist and explicit checks (#3403) @mmetc
• lint: gocritic/captLocal (don't capitalize local variables) (#3402) @mmetc
• remove commands "cscli config backup/restore" (#3158) @mmetc
• CI: golangci-lint 1.63 (#3396) @mmetc
• Hubops tests (#3393) @mmetc
• cscli hub: refact/split files; add some doc/examples (#3394) @mmetc
• lint: explicit error checks (#3388) @mmetc
• pkg/cwhub - refact Downloader (#3382) @mmetc
• lint: replace type assertions and type switch on errors (#3376) @mmetc
• refactor pkg/leakybucket (#3371) @mmetc
• refact pkg/database: clean up code and error messages (#3263) @mmetc
• lint/deep-exit: avoid log.Fatal (#3367) @mmetc
• loop performance optimizations / 2 (#3364) @mmetc
• lint/deep-exit: avoid log.Fatal (#3360) @mmetc
• lint: enable more gocritic checks (#3363) @mmetc
• acquisition: add some test and warning for wrong source type (#3362) @mmetc
• support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump (#3361) @blotus
• lint: style, autofix (#3354) @mmetc
• update golangci-lint to 1.62 (#3332) @mmetc

New Features

• acquisition/victorialogs: add new datasource (#3310) @zekker6
• Add possibility to configure log format #799 (#2941) @victoredvardsson

Improvements

• don't ask user to reload systemd service when running in docker (#3434) @mmetc
• enhance: Log appsec error on writing response to remediation (#3412) @LaurenceJJones
• test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing (#3400) @mmetc
• log warning if local items have conflicting names (#3399) @mmetc
• feat(cscli): add env variable flag for dashboard setup (#3110) @quantumsheep
• expand env var when loading acquis (#3375) @blotus
• cscli: restyle table titles; autocomplete "cscli metrics show" (#3391) @mmetc
• enhancement: Hubtest respect patterndir option set via config.yaml (#3386) @LaurenceJJones
• enhancement: add logdata to appsec AccumlateTxToEvent (#3383) @LaurenceJJones
• cscli: improved hub management (#3352) @mmetc
• cscli: display expired decisions' expiration time in red (#3357) @mmetc
• loop performance optimizations / 1 (#3313) @mmetc

Bug Fixes

• cscli: when prompting, use default in case of EOF instead of going for "no" (#3447) @mmetc
• ignore zero value variables for context (#3436) @blotus
• bucket: avoid crashing on malformed expression (fix #3351) (#3368) @mmetc
• fix parsing of noncompliant RFC3339 timestamps missing only a timezone (#3346) @gilbsgilbs
• fix: use CreatedAt instead of StartAt (#3427) @LaurenceJJones
• use the actual bucket name when checking for simulation mode (#3416) @blotus
• appsec: do not attempt to deduplicate native modsec rules (#3347) @buixor
• Removed updating of machine last_heartbeat based on baseMetrics in MachineUpdateBaseMetrics (#3425) @srkoster
• cscli hub: handle freebsd pre-release version numbers (#3423) @mmetc
• wizard: install systemd service file (#3418) @mmetc
• pkg/cticlient: Add missing field in SmokeItem and FireItem (#3413) @AlteredCoder
• fix: Bucket pour log error with message (#3378) @LaurenceJJones
• gin: do not use gin context after returning response (#3398) @blotus
• wizard: unattended install w/ new hubops (#3392) @mmetc
• cscli: print errors in plain text with -o json (#2973) @mmetc
• sigmahq: fix functional test (#3359) @mmetc
• appsec: missing err check when initializing out-of-band engine (#3344) @blotus

Chore / Deps

• use go 1.23.5 (#3419) @mmetc
• upgrade coraza to latest version (#3417) @blotus
• README revamp (#3408) @buixor
• remove dependency from github.com/gofrs/uuid (#3406) @mmetc
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 (#3381) @dependabot[bot]
• build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#3380) @dependabot[bot]
• update dependency on docker (#3175) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.5-rc5

Changes

• CI: setup go from version in go.mod (#3432) @mmetc
• CI: package docker tests with uv (#3429) @mmetc
• Improve post-installation message (#3407) @blotus
• deb packaging: prevent installing crowdsec.service twice (#3415) @mmetc
• deb build: get version with dpkg-parsechangelog -S (#3405) @mmetc
• cscli: cliconfig - refactor / remove global variables and gratuitous pointer (#3414) @mmetc
• lint: enable errcheck; add allowlist and explicit checks (#3403) @mmetc
• lint: gocritic/captLocal (don't capitalize local variables) (#3402) @mmetc
• remove commands "cscli config backup/restore" (#3158) @mmetc
• CI: golangci-lint 1.63 (#3396) @mmetc
• Hubops tests (#3393) @mmetc
• cscli hub: refact/split files; add some doc/examples (#3394) @mmetc
• lint: explicit error checks (#3388) @mmetc
• pkg/cwhub - refact Downloader (#3382) @mmetc
• lint: replace type assertions and type switch on errors (#3376) @mmetc
• refactor pkg/leakybucket (#3371) @mmetc
• refact pkg/database: clean up code and error messages (#3263) @mmetc
• lint/deep-exit: avoid log.Fatal (#3367) @mmetc
• loop performance optimizations / 2 (#3364) @mmetc
• lint/deep-exit: avoid log.Fatal (#3360) @mmetc
• lint: enable more gocritic checks (#3363) @mmetc
• acquisition: add some test and warning for wrong source type (#3362) @mmetc
• support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump (#3361) @blotus
• lint: style, autofix (#3354) @mmetc
• update golangci-lint to 1.62 (#3332) @mmetc
• run 'hub upgrade' in rpm/deb postinst, improve hub message (#3440)

New Features

• acquisition/victorialogs: add new datasource (#3310) @zekker6
• Add possibility to configure log format #799 (#2941) @victoredvardsson

Improvements

• don't ask user to reload systemd service when running in docker (#3434) @mmetc
• enhance: Log appsec error on writing response to remediation (#3412) @LaurenceJJones
• test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing (#3400) @mmetc
• log warning if local items have conflicting names (#3399) @mmetc
• feat(cscli): add env variable flag for dashboard setup (#3110) @quantumsheep
• expand env var when loading acquis (#3375) @blotus
• cscli: restyle table titles; autocomplete "cscli metrics show" (#3391) @mmetc
• enhancement: Hubtest respect patterndir option set via config.yaml (#3386) @LaurenceJJones
• enhancement: add logdata to appsec AccumlateTxToEvent (#3383) @LaurenceJJones
• cscli: improved hub management (#3352) @mmetc
• cscli: display expired decisions' expiration time in red (#3357) @mmetc
• loop performance optimizations / 1 (#3313) @mmetc

Bug Fixes

• ignore zero value variables for context (#3436) @blotus
• bucket: avoid crashing on malformed expression (fix #3351) (#3368) @mmetc
• fix parsing of noncompliant RFC3339 timestamps missing only a timezone (#3346) @gilbsgilbs
• fix: use CreatedAt instead of StartAt (#3427) @LaurenceJJones
• use the actual bucket name when checking for simulation mode (#3416) @blotus
• appsec: do not attempt to deduplicate native modsec rules (#3347) @buixor
• Removed updating of machine last_heartbeat based on baseMetrics in MachineUpdateBaseMetrics (#3425) @srkoster
• cscli hub: handle freebsd pre-release version numbers (#3423) @mmetc
• wizard: install systemd service file (#3418) @mmetc
• pkg/cticlient: Add missing field in SmokeItem and FireItem (#3413) @AlteredCoder
• fix: Bucket pour log error with message (#3378) @LaurenceJJones
• gin: do not use gin context after returning response (#3398) @blotus
• wizard: unattended install w/ new hubops (#3392) @mmetc
• cscli: print errors in plain text with -o json (#2973) @mmetc
• sigmahq: fix functional test (#3359) @mmetc
• appsec: missing err check when initializing out-of-band engine (#3344) @blotus

Chore / Deps

• use go 1.23.5 (#3419) @mmetc
• upgrade coraza to latest version (#3417) @blotus
• README revamp (#3408) @buixor
• remove dependency from github.com/gofrs/uuid (#3406) @mmetc
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 (#3381) @dependabot[bot]
• build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#3380) @dependabot[bot]
• update dependency on docker (#3175) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.5-rc4

Changes

• CI: setup go from version in go.mod (#3432) @mmetc
• CI: package docker tests with uv (#3429) @mmetc
• Improve post-installation message (#3407) @blotus
• deb packaging: prevent installing crowdsec.service twice (#3415) @mmetc
• deb build: get version with dpkg-parsechangelog -S (#3405) @mmetc
• cscli: cliconfig - refactor / remove global variables and gratuitous pointer (#3414) @mmetc
• lint: enable errcheck; add allowlist and explicit checks (#3403) @mmetc
• lint: gocritic/captLocal (don't capitalize local variables) (#3402) @mmetc
• remove commands "cscli config backup/restore" (#3158) @mmetc
• CI: golangci-lint 1.63 (#3396) @mmetc
• Hubops tests (#3393) @mmetc
• cscli hub: refact/split files; add some doc/examples (#3394) @mmetc
• lint: explicit error checks (#3388) @mmetc
• pkg/cwhub - refact Downloader (#3382) @mmetc
• lint: replace type assertions and type switch on errors (#3376) @mmetc
• refactor pkg/leakybucket (#3371) @mmetc
• refact pkg/database: clean up code and error messages (#3263) @mmetc
• lint/deep-exit: avoid log.Fatal (#3367) @mmetc
• loop performance optimizations / 2 (#3364) @mmetc
• lint/deep-exit: avoid log.Fatal (#3360) @mmetc
• lint: enable more gocritic checks (#3363) @mmetc
• acquisition: add some test and warning for wrong source type (#3362) @mmetc
• support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump (#3361) @blotus
• lint: style, autofix (#3354) @mmetc
• update golangci-lint to 1.62 (#3332) @mmetc

New Features

• acquisition/victorialogs: add new datasource (#3310) @zekker6
• Add possibility to configure log format #799 (#2941) @victoredvardsson

Improvements

• don't ask user to reload systemd service when running in docker (#3434) @mmetc
• enhance: Log appsec error on writing response to remediation (#3412) @LaurenceJJones
• test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing (#3400) @mmetc
• log warning if local items have conflicting names (#3399) @mmetc
• feat(cscli): add env variable flag for dashboard setup (#3110) @quantumsheep
• expand env var when loading acquis (#3375) @blotus
• cscli: restyle table titles; autocomplete "cscli metrics show" (#3391) @mmetc
• enhancement: Hubtest respect patterndir option set via config.yaml (#3386) @LaurenceJJones
• enhancement: add logdata to appsec AccumlateTxToEvent (#3383) @LaurenceJJones
• cscli: improved hub management (#3352) @mmetc
• cscli: display expired decisions' expiration time in red (#3357) @mmetc
• loop performance optimizations / 1 (#3313) @mmetc

Bug Fixes

• ignore zero value variables for context (#3436) @blotus
• bucket: avoid crashing on malformed expression (fix #3351) (#3368) @mmetc
• fix parsing of noncompliant RFC3339 timestamps missing only a timezone (#3346) @gilbsgilbs
• fix: use CreatedAt instead of StartAt (#3427) @LaurenceJJones
• use the actual bucket name when checking for simulation mode (#3416) @blotus
• appsec: do not attempt to deduplicate native modsec rules (#3347) @buixor
• Removed updating of machine last_heartbeat based on baseMetrics in MachineUpdateBaseMetrics (#3425) @srkoster
• cscli hub: handle freebsd pre-release version numbers (#3423) @mmetc
• wizard: install systemd service file (#3418) @mmetc
• pkg/cticlient: Add missing field in SmokeItem and FireItem (#3413) @AlteredCoder
• fix: Bucket pour log error with message (#3378) @LaurenceJJones
• gin: do not use gin context after returning response (#3398) @blotus
• wizard: unattended install w/ new hubops (#3392) @mmetc
• cscli: print errors in plain text with -o json (#2973) @mmetc
• sigmahq: fix functional test (#3359) @mmetc
• appsec: missing err check when initializing out-of-band engine (#3344) @blotus

Chore / Deps

• use go 1.23.5 (#3419) @mmetc
• upgrade coraza to latest version (#3417) @blotus
• README revamp (#3408) @buixor
• remove dependency from github.com/gofrs/uuid (#3406) @mmetc
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 (#3381) @dependabot[bot]
• build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#3380) @dependabot[bot]
• update dependency on docker (#3175) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.5-rc3

Changes

• CI: package docker tests with uv (#3429) @mmetc
• Improve post-installation message (#3407) @blotus
• deb packaging: prevent installing crowdsec.service twice (#3415) @mmetc
• deb build: get version with dpkg-parsechangelog -S (#3405) @mmetc
• cscli: cliconfig - refactor / remove global variables and gratuitous pointer (#3414) @mmetc
• lint: enable errcheck; add allowlist and explicit checks (#3403) @mmetc
• lint: gocritic/captLocal (don't capitalize local variables) (#3402) @mmetc
• remove commands "cscli config backup/restore" (#3158) @mmetc
• CI: golangci-lint 1.63 (#3396) @mmetc
• Hubops tests (#3393) @mmetc
• cscli hub: refact/split files; add some doc/examples (#3394) @mmetc
• lint: explicit error checks (#3388) @mmetc
• pkg/cwhub - refact Downloader (#3382) @mmetc
• lint: replace type assertions and type switch on errors (#3376) @mmetc
• refactor pkg/leakybucket (#3371) @mmetc
• refact pkg/database: clean up code and error messages (#3263) @mmetc
• lint/deep-exit: avoid log.Fatal (#3367) @mmetc
• loop performance optimizations / 2 (#3364) @mmetc
• lint/deep-exit: avoid log.Fatal (#3360) @mmetc
• lint: enable more gocritic checks (#3363) @mmetc
• acquisition: add some test and warning for wrong source type (#3362) @mmetc
• support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump (#3361) @blotus
• lint: style, autofix (#3354) @mmetc
• update golangci-lint to 1.62 (#3332) @mmetc

New Features

• Add possibility to configure log format #799 (#2941) @victoredvardsson

Improvements

• enhance: Log appsec error on writing response to remediation (#3412) @LaurenceJJones
• test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing (#3400) @mmetc
• log warning if local items have conflicting names (#3399) @mmetc
• feat(cscli): add env variable flag for dashboard setup (#3110) @quantumsheep
• expand env var when loading acquis (#3375) @blotus
• cscli: restyle table titles; autocomplete "cscli metrics show" (#3391) @mmetc
• enhancement: Hubtest respect patterndir option set via config.yaml (#3386) @LaurenceJJones
• enhancement: add logdata to appsec AccumlateTxToEvent (#3383) @LaurenceJJones
• cscli: improved hub management (#3352) @mmetc
• cscli: display expired decisions' expiration time in red (#3357) @mmetc
• loop performance optimizations / 1 (#3313) @mmetc

Bug Fixes

• fix: use CreatedAt instead of StartAt (#3427) @LaurenceJJones
• use the actual bucket name when checking for simulation mode (#3416) @blotus
• appsec: do not attempt to deduplicate native modsec rules (#3347) @buixor
• Removed updating of machine last_heartbeat based on baseMetrics in MachineUpdateBaseMetrics (#3425) @srkoster
• cscli hub: handle freebsd pre-release version numbers (#3423) @mmetc
• wizard: install systemd service file (#3418) @mmetc
• pkg/cticlient: Add missing field in SmokeItem and FireItem (#3413) @AlteredCoder
• fix: Bucket pour log error with message (#3378) @LaurenceJJones
• gin: do not use gin context after returning response (#3398) @blotus
• wizard: unattended install w/ new hubops (#3392) @mmetc
• cscli: print errors in plain text with -o json (#2973) @mmetc
• sigmahq: fix functional test (#3359) @mmetc
• appsec: missing err check when initializing out-of-band engine (#3344) @blotus

Chore / Deps

• use go 1.23.5 (#3419) @mmetc
• upgrade coraza to latest version (#3417) @blotus
• README revamp (#3408) @buixor
• remove dependency from github.com/gofrs/uuid (#3406) @mmetc
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 (#3381) @dependabot[bot]
• build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#3380) @dependabot[bot]
• update dependency on docker (#3175) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.5-rc2

Changes

• Improve post-installation message (#3407) @blotus
• deb packaging: prevent installing crowdsec.service twice (#3415) @mmetc
• deb build: get version with dpkg-parsechangelog -S (#3405) @mmetc
• cscli: cliconfig - refactor / remove global variables and gratuitous pointer (#3414) @mmetc
• lint: enable errcheck; add allowlist and explicit checks (#3403) @mmetc
• lint: gocritic/captLocal (don't capitalize local variables) (#3402) @mmetc
• remove commands "cscli config backup/restore" (#3158) @mmetc
• CI: golangci-lint 1.63 (#3396) @mmetc
• Hubops tests (#3393) @mmetc
• cscli hub: refact/split files; add some doc/examples (#3394) @mmetc
• lint: explicit error checks (#3388) @mmetc
• pkg/cwhub - refact Downloader (#3382) @mmetc
• lint: replace type assertions and type switch on errors (#3376) @mmetc
• refactor pkg/leakybucket (#3371) @mmetc
• refact pkg/database: clean up code and error messages (#3263) @mmetc
• lint/deep-exit: avoid log.Fatal (#3367) @mmetc
• loop performance optimizations / 2 (#3364) @mmetc
• lint/deep-exit: avoid log.Fatal (#3360) @mmetc
• lint: enable more gocritic checks (#3363) @mmetc
• acquisition: add some test and warning for wrong source type (#3362) @mmetc
• support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump (#3361) @blotus
• lint: style, autofix (#3354) @mmetc
• update golangci-lint to 1.62 (#3332) @mmetc

New Features

• Add possibility to configure log format #799 (#2941) @victoredvardsson

Improvements

• enhance: Log appsec error on writing response to remediation (#3412) @LaurenceJJones
• test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing (#3400) @mmetc
• log warning if local items have conflicting names (#3399) @mmetc
• feat(cscli): add env variable flag for dashboard setup (#3110) @quantumsheep
• expand env var when loading acquis (#3375) @blotus
• cscli: restyle table titles; autocomplete "cscli metrics show" (#3391) @mmetc
• enhancement: Hubtest respect patterndir option set via config.yaml (#3386) @LaurenceJJones
• enhancement: add logdata to appsec AccumlateTxToEvent (#3383) @LaurenceJJones
• cscli: improved hub management (#3352) @mmetc
• cscli: display expired decisions' expiration time in red (#3357) @mmetc
• loop performance optimizations / 1 (#3313) @mmetc

Bug Fixes

• fix: use CreatedAt instead of StartAt (#3427) @LaurenceJJones
• use the actual bucket name when checking for simulation mode (#3416) @blotus
• appsec: do not attempt to deduplicate native modsec rules (#3347) @buixor
• Removed updating of machine last_heartbeat based on baseMetrics in MachineUpdateBaseMetrics (#3425) @srkoster
• cscli hub: handle freebsd pre-release version numbers (#3423) @mmetc
• wizard: install systemd service file (#3418) @mmetc
• pkg/cticlient: Add missing field in SmokeItem and FireItem (#3413) @AlteredCoder
• fix: Bucket pour log error with message (#3378) @LaurenceJJones
• gin: do not use gin context after returning response (#3398) @blotus
• wizard: unattended install w/ new hubops (#3392) @mmetc
• cscli: print errors in plain text with -o json (#2973) @mmetc
• sigmahq: fix functional test (#3359) @mmetc
• appsec: missing err check when initializing out-of-band engine (#3344) @blotus

Chore / Deps

• use go 1.23.5 (#3419) @mmetc
• upgrade coraza to latest version (#3417) @blotus
• README revamp (#3408) @buixor
• remove dependency from github.com/gofrs/uuid (#3406) @mmetc
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 (#3381) @dependabot[bot]
• build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#3380) @dependabot[bot]
• update dependency on docker (#3175) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

New Contributors

• @rnagy made their first contribution in #3191
• @laur89 made their first contribution in #3297
• @victoredvardsson made their first contribution in #2941
• @quantumsheep made their first contribution in #3110
• @srkoster made their first contribution in #3425

Full Changelog: v1.6.4...v1.6.5-rc2

v1.6.5-rc1

Changes

• wizard: install systemd service file (#3418) @mmetc
• Improve post-installation message (#3407) @blotus
• deb packaging: prevent installing crowdsec.service twice (#3415) @mmetc
• deb build: get version with dpkg-parsechangelog -S (#3405) @mmetc
• cscli: cliconfig - refactor / remove global variables and gratuitous pointer (#3414) @mmetc
• lint: enable errcheck; add allowlist and explicit checks (#3403) @mmetc
• lint: gocritic/captLocal (don't capitalize local variables) (#3402) @mmetc
• remove commands "cscli config backup/restore" (#3158) @mmetc
• CI: golangci-lint 1.63 (#3396) @mmetc
• Hubops tests (#3393) @mmetc
• cscli hub: refact/split files; add some doc/examples (#3394) @mmetc
• lint: explicit error checks (#3388) @mmetc
• pkg/cwhub - refact Downloader (#3382) @mmetc
• lint: replace type assertions and type switch on errors (#3376) @mmetc
• refactor pkg/leakybucket (#3371) @mmetc
• refact pkg/database: clean up code and error messages (#3263) @mmetc
• lint/deep-exit: avoid log.Fatal (#3367) @mmetc
• loop performance optimizations / 2 (#3364) @mmetc
• lint/deep-exit: avoid log.Fatal (#3360) @mmetc
• lint: enable more gocritic checks (#3363) @mmetc
• acquisition: add some test and warning for wrong source type (#3362) @mmetc
• support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump (#3361) @blotus
• lint: style, autofix (#3354) @mmetc
• update golangci-lint to 1.62 (#3332) @mmetc

New Features

• Add possibility to configure log format #799 (#2941) @victoredvardsson

Improvements

• enhance: Log appsec error on writing response to remediation (#3412) @LaurenceJJones
• test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing (#3400) @mmetc
• log warning if local items have conflicting names (#3399) @mmetc
• feat(cscli): add env variable flag for dashboard setup (#3110) @quantumsheep
• expand env var when loading acquis (#3375) @blotus
• cscli: restyle table titles; autocomplete "cscli metrics show" (#3391) @mmetc
• enhancement: Hubtest respect patterndir option set via config.yaml (#3386) @LaurenceJJones
• enhancement: add logdata to appsec AccumlateTxToEvent (#3383) @LaurenceJJones
• cscli: improved hub management (#3352) @mmetc
• cscli: display expired decisions' expiration time in red (#3357) @mmetc
• loop performance optimizations / 1 (#3313) @mmetc

Bug Fixes

• pkg/cticlient: Add missing field in SmokeItem and FireItem (#3413) @AlteredCoder
• fix: Bucket pour log error with message (#3378) @LaurenceJJones
• gin: do not use gin context after returning response (#3398) @blotus
• wizard: unattended install w/ new hubops (#3392) @mmetc
• cscli: print errors in plain text with -o json (#2973) @mmetc
• sigmahq: fix functional test (#3359) @mmetc
• appsec: missing err check when initializing out-of-band engine (#3344) @blotus

Chore / Deps

• remove dependency from github.com/gofrs/uuid (#3406) @mmetc
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 (#3381) @dependabot[bot]
• build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#3380) @dependabot[bot]
• update dependency on docker (#3175) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.4

Overview

HTTP datasource

This release introduce http data source that enable crowdsec to ingest logs from an http endpoint such as Datadog or Vector.

See documentation here

Alert context appsec

This release also introduces the alert context ability when using appsec.

See related doc here

Replay evtx file support

This release allows Windows CrowdSec users to replay Winevent evtx files.

Bouncers API Key sharing

Bouncers running on different machines can now share the same API key without interfering with each other. Each bouncer will appear as bouncer_name@IP in the bouncer list. (#3323)

New Features

• add HTTP datasource (#3294) @he2ss
• Alert context appsec (#3288) @buixor
• wineventlog: add support for replaying evtx files (#3278) @blotus

Improvements

• Allow bouncers to share API keys (#3323) @blotus
• Support multiple appsec configs (#3314) @buixor
• context propagation: papi, loki (#3308) @mmetc
• Add explicit configuration for signals sharing and blocklists pull (#3277) @blotus
• loki: add no_ready_check option (#3317) @blotus
• logs and user messages: use "serialize" and "parse" instead of marshal/unmarshal (#3240) @mmetc
• context propagation: cscli {capi,lapi,papi} (#3228) @mmetc
• refact pkg/database: context propagation (start) (#3226) @mmetc

Changes

• make: improve re2/wasm check (#3335) @mmetc
• fix go version for azure pipeline (#3324) @blotus
• add go minor in go.mod (#3318) @sabban
• update checks for wrapped errors (#3117) @mmetc
• refact cscli: decisions, lapi, bouncers, machines (#3306) @mmetc
• make: remove obsolete/redundant parameters (#3304) @mmetc
• remove unused code: HandleDeletedDecisions() (#3301) @mmetc
• CI: update coverage ignore list for generated code (#3262) @mmetc
• lint/revive: check tags on non-exported struct fields (#3257) @mmetc
• context propagation: don't store ctx in api controller (#3268) @mmetc
• CI: check generated code in test workflow (#3261) @mmetc
• remove dependency from pkg/cwversion to pkg/acquisition (#3242) @mmetc
• lint/nestif: reduce hubtest complexity (#3244) @mmetc
• refact: alerts query (#3216) @mmetc
• lint: enable (some) gocritic checks (#3238) @mmetc
• enable linters: copyloopvar, intrange (#3184) @mmetc
• refact acquisition: build profiles (optionally exclude datasources from final binary) (#3217) @mmetc
• refact / split APIServer.Run() method (#3215) @mmetc
• refact cscli - don't export functions if not required (#3224) @mmetc
• refact: cscli papi (#3222) @mmetc
• refact: pkg/apiclient set and use default user agent (#3219) @mmetc

Bug Fixes

• better handle error when sending usage metrics (#3333) @blotus
• fix: Use clientIP when passing coraza (#3322) @LaurenceJJones
• cron dependency for packaging (#3331) @sabban
• fix: Add a check to prevent attempting to load a directory within patterns (#3326) @LaurenceJJones
• fix: Ansible fedora 40 to use 40 (#3327) @LaurenceJJones
• make: allow build on ubuntu 24.10 (#3311) @mmetc
• enhance: Remove if log check in one instance (#3300) @LaurenceJJones
• fix: Check if resp is nil in capi metrics and continue (#3299) @LaurenceJJones
• avoid deadlock when deleting decisions if PAPI is half configured (#3283) @blotus
• CI: delegate pipenv cache management to the setup-python action (#3243) @mmetc
• Update go-re2 (#3230) @blotus
• fix #3225: info->debug for trigger bucket overflow (#3227) @mmetc
• fix appsec/tls issues by cloning http transport (#3213) @mmetc

Chore / Deps

• enhance: add fedora 41 vagrant (#3328) @LaurenceJJones
• enhance: add opensuse leap 15 vagrant (#3329) @LaurenceJJones
• readme: update bouncers link (#3297) @laur89
• require go 1.23 (#3298) @mmetc
• Update protobufs (#3276) @mmetc
• CI: generate codecov.yml before tests (#3280) @mmetc
• update test dependencies (#3267) @mmetc
• Re-generate capi models (#3260) @mmetc
• CI: update golangci-lint to v1.61, yq to 4.44.3 (#3241) @mmetc
• context propagation: OneShotAcquisition(); enable contextcheck linter (#3285) @mmetc
• context propagation: appsec, docker, kafka, k8s datasources (#3284) @mmetc
• context propagation: StreamingAcquisition() (#3274) @mmetc
• context propagation: pkg/csplugin (#3273) @mmetc
• context propagation: pkg/apiserver (#3272) @mmetc
• context propagation: apic, unit tests (#3271) @mmetc
• context propagation: pass ctx to UpdateScenario() (#3258) @mmetc
• context propagation: pkg/database/alerts (#3252) @mmetc
• context propagation: pkg/database/{lock,decision} (#3251) @mmetc
• context propagation: pkg/database/bouncers (#3249) @mmetc
• context propagation: pkg/database/machines (#3248) @mmetc
• context propagation: pkg/database/metrics (#3247) @mmetc
• context propagation: pkg/database/config (#3246) @mmetc
• context propagation: bouncer list (#3236) @mmetc
• context propagation: pkg/database/flush (#3235) @mmetc
• context propagation: pass context to NewAPIC() (#3231) @mmetc
• context propagation: explicit ctx parameter in unit tests (#3229) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.