0.38.0

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.38.0
docker pull public.ecr.aws/falcosecurity/falco:0.38.0
docker pull docker.io/falcosecurity/falco-driver-loader:0.38.0
docker pull docker.io/falcosecurity/falco-driver-loader-legacy:0.38.0
docker pull docker.io/falcosecurity/falco-no-driver:0.38.0
docker pull docker.io/falcosecurity/falco-distroless:0.38.0

v0.38.0

Released on 2024-05-30

Breaking Changes ⚠️

• new(scripts,docker)!: enable automatic driver selection logic in packages and docker images. Modern eBPF is now also the default driver and the highest priority one in the new driver selection logic. [#3154] - @FedeDP
• cleanup(falco.yaml)!: remove some deprecated configs [#3087] - @Andreagit97
• cleanup(docker)!: remove unused builder dockerfile [#3088] - @Andreagit97

Major Changes

• new(webserver): a metrics endpoint has been added providing prometheus metrics. It can be optionally enabled using the new metrics.prometheus_enabled configuration option. It will only be activated if the metrics.enabled is true as well. [#3140] - @sgaist
• new(metrics): add rules_counters_enabled option [#3192] - @incertum
• new(build): provide signatures for .tar.gz packages [#3201] - @LucaGuerra
• new(engine): add print_enabled_rules_falco_logger when log_level debug [#3189] - @incertum
• new(falco): allow selecting which rules to load from the configuration file or command line [#3178] - @LucaGuerra
• new(metrics): add file sha256sum metrics for loaded config and rules files [#3187] - @incertum
• new(engine): throw an error when an invalid macro/list name is used [#3116] - @mrgian
• new(engine): raise warning instead of error on invalid macro/list name [#3167] - @mrgian
• new(userspace): support split config files [#3024] - @FedeDP
• new(engine): enforce unique exceptions names [#3134] - @mrgian
• new(engine): add warning when appending an exception with no values [#3133] - @mrgian
• feat(metrics): coherent metrics stats model including few metrics naming changes [#3129] - @incertum
• new(config): add falco_libs.thread_table_size [#3071] - @incertum
• new(proposals): introduce on host anomaly detection framework [#2655] - @incertum

Minor Changes

• update(cmake): bump falcoctl to v0.8.0. [#3219] - @FedeDP
• update(rules): update falco-rules to 3.1.0 [#3217] - @LucaGuerra
• refactor(userspace): move falco logger under falco engine [#3208] - @jasondellaluce
• chore(docs): apply features adoption and deprecation proposal to config file keys [#3206] - @FedeDP
• cleanup(metrics): add original rule name as label [#3205] - @incertum
• update(falco): deprecate options -T, -t and -D [#3193] - @LucaGuerra
• refactor: bump libs and driver, support field modifiers [#3186] - @jasondellaluce
• chore(userspace/falco): deprecated old 'rules_file' config key [#3162] - @FedeDP
• chore(falco): update falco libs and driver to master (Apr 8th 2024) [#3158] - @LucaGuerra
• update(build): update libs to 026ffe1d8f1b25c6ccdc09afa2c02afdd3e3f672 [#3151] - @LucaGuerra
• cleanup: minor adjustments to readme, add new testing section [#3072] - @incertum
• refactor(userspace/engine): reduce allocations during rules loading [#3065] - @jasondellaluce
• update(CI): publish wasm package as dev-wasm [#3017] - @Rohith-Raju

Bug Fixes

• fix(userspace/falco): fix state initialization avoid a crash during hot reload [#3190] - @FedeDP
• fix(userspace/engine): make sure exception fields are not optional in replace mode [#3108] - @jasondellaluce
• fix(docker): added zstd to driver loader images [#3203] - @FedeDP
• fix(engine): raise warning instead of error on not-unique exceptions names [#3159] - @mrgian
• fix(engine): apply output substitutions for all sources [#3135] - @mrgian
• fix(userspace/configuration): make sure that folders that would trigger permission denied are not traversed [#3127] - @sgaist
• fix(engine): logical issue in exceptions condition [#3115] - @mrgian
• fix(cmake): properly let falcoctl cmake module create /usr/share/falco/plugins/ folder. [#3105] - @FedeDP

Non user-facing changes

• update(scripts/falcoctl): bump falco-rules version to 3 [#3128] - @alacuku
• build(deps): Bump submodules/falcosecurity-rules from 59bf03b to 9e56293 [#3212] - @dependabot[bot]
• chore(gha): update cosign to v3.5.0 [#3209] - @LucaGuerra
• build(deps): Bump submodules/falcosecurity-rules from 29c41c4 to 59bf03b [#3207] - @dependabot[bot]
• update(cmake): bumped libs to 0.17.0-rc1 and falcoctl to v0.8.0-rc6. [#3204] - @FedeDP
• build(deps): Bump submodules/falcosecurity-rules from 3f668d0 to 3cac61c [#3044] - @dependabot[bot]
• build(deps): Bump submodules/falcosecurity-testing from ae3950a to 7abf76f [#3094] - @dependabot[bot]
• fix(ci): enforce bundled deps OFF in build-dev CI [#3118] - @FedeDP
• build(deps): Bump submodules/falcosecurity-rules from 88a40c8 to 869c9a7 [#3156] - @dependabot[bot]
• update(cmake): bumped falcoctl to v0.8.0-rc5. [#3199] - @FedeDP
• build(deps): Bump submodules/falcosecurity-rules from 4f153f5 to 29c41c4 [#3198] - @dependabot[bot]
• update(cmake): bump falcoctl to v0.8.0-rc4 [#3191] - @FedeDP
• refactor: smart pointer usage [#3184] - @federico-sysdig
• build(deps): Bump submodules/falcosecurity-rules from ec255e6 to 4f153f5 [#3182] - @dependabot[bot]
• update(cmake): bumped libs and driver to latest master. [#3177] - @FedeDP
• chore(cmake): enable modern bpf build by default. [#3180] - @FedeDP
• cleanup(docs): fix typo in license blocks [#3175] - @LucaGuerra
• chore(docker,scripts): set old eBPF probe as lowest priority driver. [#3173] - @FedeDP
• build(deps): Bump submodules/falcosecurity-rules from 869c9a7 to ec255e6 [#3170] - @dependabot[bot]
• update(app): close inspectors at teardown time [#3169] - @LucaGuerra
• fix(docker): fixed docker entrypoints for driver loading. [#3168] - @FedeDP
• fix(docker,scripts): do not load falcoctl driver loader when installing Falco deb package in docker images [#3166] - @FedeDP
• update(ci): build both release and debug versions [#3161] - @LucaGuerra
• chore(userspace/falco): watch all configs files. [#3160] - @FedeDP
• fix(ci): update scorecard-action to v2.3.1 [#3153] - @LucaGuerra
• cleanup(falco): consolidate falco::grpc::server in one class [#3150] - @LucaGuerra
• new(build): enable ASan and UBSan builds with options and in CI [#3147] - @LucaGuerra
• fix(userspace): variable / function shadowing [#3123] - @sgaist
• build(deps): Bump submodules/falcosecurity-rules from fbf0a4e to 88a40c8 [#3145] - @dependabot[bot]
• fix(cmake): fix USE_BUNDLED_DEPS=ON and BUILD_FALCO_UNIT_TESTS=ON [#3146] - @LucaGuerra
• Add --kernelversion and --kernelrelease options to falco driver loader entrypoint [#3143] - @Sryther
• build(deps): Bump submodules/falcosecurity-rules from 44addef to fbf0a4e [#3139] - @dependabot[bot]
• chore: bump to latest libs commit [#3137] - @Andreagit97
• refactor: Use FetchContent for integrating three bundled libs [#3107] - @federico-sysdig
• build(deps): Bump submodules/falcosecurity-rules from dc7970d to 44addef [#3136] - @dependabot[bot]
• build(deps): Bump submodules/falcosecurity-rules from f88b991 to dc7970d [#3126] - @dependabot[bot]
• refactor(ci): Avoid using command make directly [#3101] - @federico-sysdig
• docs(proposal): 20231220-features-adoption-and-deprecation.md [#2986] - @leogr
• build(deps): Bump submodules/falcosecurity-rules from b499a1d to f88b991 [#3125] - @dependabot[bot]
• docs(README.md): Falco Graduates within the CNCF [#3124] - @leogr
• build(deps): Bump submodules/falcosecurity-rules from 497e011 to b499a1d [#3111] - @dependabot[bot]
• chore(ci): bumped codeql actions. [#3114] - @FedeDP
• Cleanup warnings and smart ptrs [#3112] - @federico-sysdig
• new(build): add options to use bundled dependencies [#3092] - @mrgian
• fix(ci): test-dev-packages-arm64 needs build-dev-packages-arm64. [#3110] - @FedeDP
• refactor: bump libs and driver, and adopt unique pointers wherever possible [#3109] - @jasondellaluce
• cleanup: falco_engine test fixture [#3099] - @federico-sysdig
• refactor: test AtomicSignalHandler.handle_once_wait_consistency [#3100] - @federico-sysdig
• Cleanup variable use [#3097] - @sgaist
• cleanup(submodules): dropped testing submodule. [#3098] - @FedeDP
• cleanup(ci): make use of falcosecurity/testing provided composite action [#3093] - @FedeDP
• Improve const correctness [#3083] - @sgaist
• Improve exception throwing [#3085] - @sgaist
• fix(ci): update sync in deb and rpm scripts with acl [#3062] - @LucaGuerra
• cleanup(tests): consolidate Falco engine and rule loader tests [#3066] - @LucaGuerra
• cleanup: falco_engine deps and include paths [#3090] - @federico-sysdig
• fix: Some compiler warnings [#3089] - @federico-sysdig
• build(deps): Bump submodules/falcosecurity-rules from 0f60976 to 497e011 [#3081] - @dependabot[bot]
• fix(c++): add missing explicit to single argument constructors [#3069] - @sgaist
• Improve class initialization [#3074] - @sgaist
• build(deps): Bump submodules/falcosecurity-rules from 6ed2036 to 0f60976 [#3078] - @dependabot[bot]
• build(deps): Bump submodules/falcosecurity-rules from 1053b2d to 6ed2036 [#3067] - @dependabot[bot]
• fix(c++): add missing overrides [#3064] - @sgaist
• new(build): prune deb-dev and rpm-dev directories [#3056] - @LucaGuerra
• refactor(userspace): align falco to gen-event class family deprecation [#3051] - @jasondellaluce
• build(deps): Bump submodules/falcosecurity-rules from 3cac61c to 1053b2d [#3047] - @dependabot[bot]
• fix: adopt new libsinsp logger [#3026] - @therealbobo
• refactor: cleanup libs relative include paths [#2936] - @therealbobo
• chore(ci): bumped rn2md to latest master. [#3046] - @FedeDP
• Support alternate rules loader [#3008] - @mstemm
• fix(ci): fixed release body driver version. [#3042] - @FedeDP
• build(deps): Bump submodules/falcosecurity-rules from c39d31a to 3f668d0 [#3039] - @dependabot[bot]

Statistics

MERGED PRS	NUMBER
Not user-facing	72
Release note	38
Total	110

Release Manager @LucaGuerra