v1.6.6-rc3

Changes

• empty back-merge from release branch (#3506) @mmetc
• appsec: use CA from client credentials when connecting to LAPI (#3505) @mmetc
• lint: gocritic/httpNoBody (#3493) @mmetc
• tests: remove modeline (#3486) @mmetc
• pkg/cwhub: refact Item.State.(Downloaded | Installed) (#3476) @mmetc
• refact: context propagation (apiclient, cticlient...) (#3477) @mmetc
• CI: use go 1.24 for windows (#3479) @mmetc
• tests: switch context.Background() -> t.Context() from go 1.24 (#3473) @mmetc
• refact: avoid use of defer calls in loops (#3466) @mmetc
• CI: lint docker tests (#3443) @mmetc
• lint: gocritic/typeDefFirst (ensure type definitions come before methods) (#3404) @mmetc
• file acquisition: remove redundant logging info (#3468) @mmetc
• CI: skip unit tests with dynamic build (#3461) @mmetc

New Features

• deprecate capi_whitelists_path (#3504) @blotus
• Add support for centralized allowlists (#3355) @blotus

Improvements

• appsec: support custom CA for lapi (#3503) @mmetc
• enhancement: Add additional ssl options to db configuration (#3387) @LaurenceJJones
• move ParseQuery to expr helpers, add ExtractQueryParam (#3491) @buixor
• enable/disable options for console enroll - make alert context a default (#3487) @buixor
• enhance: add option to disable magic syslog RFC parsers (#3435) @LaurenceJJones
• add JA4H expr helper (#3401) @blotus
• leaky bucket: reduce log verbosity (#3472) @mmetc

Bug Fixes

• appsec: less verbose logging for allowlists and headers check (#3498) @blotus
• enhance: Flags now superceed all log levels (#3496) @LaurenceJJones
• appsec: handle SendAlert() properly for out of band matches (#3497) @blotus
• cscli: review/update argument number checking (#3490) @mmetc
• crowdsec: allow -t to work if using appsec and allowlists (#3484) @blotus
• cron: avoid spamming stdout when the hub index is updated (#3485) @mmetc
• cscli: allow non-local symlinks to have a different name than hub items (#3475) @mmetc
• cscli hub/items: always show action plan; fix --interactive in pipes (#3451) @mmetc
• silence "cscli hub update" if noop in cron jobs (#3460) @mmetc
• cscli: don't attempt to download data files when url="" (#3454) @mmetc

Chore / Deps

• use go 1.24.1 (#3501) @mmetc
• update dependencies: color, go-sqlite3, tail, slack, testify (#3474) @mmetc
• use go 1.24, enable unencrypted http2 (#3470) @mmetc
• deps: use ent 0.14.2 (#3259) @mmetc
• build(deps): bump github.com/golang/glog from 1.2.2 to 1.2.4 (#3431) @dependabot[bot]
• deps: update gin-jwt (#3430) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.6-rc2

Changes

• tests: remove modeline (#3486) @mmetc
• pkg/cwhub: refact Item.State.(Downloaded | Installed) (#3476) @mmetc
• refact: context propagation (apiclient, cticlient...) (#3477) @mmetc
• CI: use go 1.24 for windows (#3479) @mmetc
• tests: switch context.Background() -> t.Context() from go 1.24 (#3473) @mmetc
• refact: avoid use of defer calls in loops (#3466) @mmetc
• CI: lint docker tests (#3443) @mmetc
• lint: gocritic/typeDefFirst (ensure type definitions come before methods) (#3404) @mmetc
• file acquisition: remove redundant logging info (#3468) @mmetc
• CI: skip unit tests with dynamic build (#3461) @mmetc

New Features

• Add support for centralized allowlists (#3355) @blotus

Improvements

• enhance: add option to disable magic syslog RFC parsers (#3435) @LaurenceJJones
• add JA4H expr helper (#3401) @blotus
• leaky bucket: reduce log verbosity (#3472) @mmetc

Bug Fixes

• crowdsec: allow -t to work if using appsec and allowlists (#3484) @blotus
• cron: avoid spamming stdout when the hub index is updated (#3485) @mmetc
• cscli: allow non-local symlinks to have a different name than hub items (#3475) @mmetc
• cscli hub/items: always show action plan; fix --interactive in pipes (#3451) @mmetc
• silence "cscli hub update" if noop in cron jobs (#3460) @mmetc
• cscli: don't attempt to download data files when url="" (#3454) @mmetc

Chore / Deps

• update dependencies: color, go-sqlite3, tail, slack, testify (#3474) @mmetc
• use go 1.24, enable unencrypted http2 (#3470) @mmetc
• deps: use ent 0.14.2 (#3259) @mmetc
• build(deps): bump github.com/golang/glog from 1.2.2 to 1.2.4 (#3431) @dependabot[bot]
• deps: update gin-jwt (#3430) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.6-rc1

Changes

• pkg/cwhub: refact Item.State.(Downloaded | Installed) (#3476) @mmetc
• refact: context propagation (apiclient, cticlient...) (#3477) @mmetc
• CI: use go 1.24 for windows (#3479) @mmetc
• tests: switch context.Background() -> t.Context() from go 1.24 (#3473) @mmetc
• refact: avoid use of defer calls in loops (#3466) @mmetc
• CI: lint docker tests (#3443) @mmetc
• lint: gocritic/typeDefFirst (ensure type definitions come before methods) (#3404) @mmetc
• file acquisition: remove redundant logging info (#3468) @mmetc
• CI: skip unit tests with dynamic build (#3461) @mmetc

New Features

• Add support for centralized allowlists (#3355) @blotus

Improvements

• add JA4H expr helper (#3401) @blotus
• leaky bucket: reduce log verbosity (#3472) @mmetc

Bug Fixes

• cscli: allow non-local symlinks to have a different name than hub items (#3475) @mmetc
• cscli hub/items: always show action plan; fix --interactive in pipes (#3451) @mmetc
• silence "cscli hub update" if noop in cron jobs (#3460) @mmetc
• cscli: don't attempt to download data files when url="" (#3454) @mmetc

Chore / Deps

• update dependencies: color, go-sqlite3, tail, slack, testify (#3474) @mmetc
• use go 1.24, enable unencrypted http2 (#3470) @mmetc
• deps: use ent 0.14.2 (#3259) @mmetc
• build(deps): bump github.com/golang/glog from 1.2.2 to 1.2.4 (#3431) @dependabot[bot]
• deps: update gin-jwt (#3430) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.5

Overview

**This release highlights the appsec feature. Important fixes were done. **

See documentation here

**The cscli hub command has been revamped.

See documentation here

New Features

• acquisition/victorialogs: add new datasource (#3310) @zekker6
• Add possibility to configure log format #799 (#2941) @victoredvardsson

Improvements

• don't ask user to reload systemd service when running in docker (#3434) @mmetc
• enhance: Log appsec error on writing response to remediation (#3412) @LaurenceJJones
• test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing (#3400) @mmetc
• log warning if local items have conflicting names (#3399) @mmetc
• feat(cscli): add env variable flag for dashboard setup (#3110) @quantumsheep
• expand env var when loading acquis (#3375) @blotus
• cscli: restyle table titles; autocomplete "cscli metrics show" (#3391) @mmetc
• enhancement: Hubtest respect patterndir option set via config.yaml (#3386) @LaurenceJJones
• enhancement: add logdata to appsec AccumlateTxToEvent (#3383) @LaurenceJJones
• cscli: improved hub management (#3352) @mmetc
• cscli: display expired decisions' expiration time in red (#3357) @mmetc
• loop performance optimizations / 1 (#3313) @mmetc

Changes

• wizard.sh: remove obsolete --yes option (#3450) @mmetc
• cscli: replace '--yes' option with '--interactive' (#3448) @mmetc
• CI: use alpine 3.21 for docker build (#3445) @mmetc
• merge from master (dc28ae5) for 1.6.5 (#3444) @mmetc
• run 'hub upgrade' in rpm/deb postinst, improve hub message (#3440) @mmetc
• CI: setup go from version in go.mod (#3432) @mmetc
• CI: package docker tests with uv (#3429) @mmetc
• Improve post-installation message (#3407) @blotus
• deb packaging: prevent installing crowdsec.service twice (#3415) @mmetc
• deb build: get version with dpkg-parsechangelog -S (#3405) @mmetc
• cscli: cliconfig - refactor / remove global variables and gratuitous pointer (#3414) @mmetc
• lint: enable errcheck; add allowlist and explicit checks (#3403) @mmetc
• lint: gocritic/captLocal (don't capitalize local variables) (#3402) @mmetc
• remove commands "cscli config backup/restore" (#3158) @mmetc
• CI: golangci-lint 1.63 (#3396) @mmetc
• Hubops tests (#3393) @mmetc
• cscli hub: refact/split files; add some doc/examples (#3394) @mmetc
• lint: explicit error checks (#3388) @mmetc
• pkg/cwhub - refact Downloader (#3382) @mmetc
• lint: replace type assertions and type switch on errors (#3376) @mmetc
• refactor pkg/leakybucket (#3371) @mmetc
• refact pkg/database: clean up code and error messages (#3263) @mmetc
• lint/deep-exit: avoid log.Fatal (#3367) @mmetc
• loop performance optimizations / 2 (#3364) @mmetc
• lint/deep-exit: avoid log.Fatal (#3360) @mmetc
• lint: enable more gocritic checks (#3363) @mmetc
• acquisition: add some test and warning for wrong source type (#3362) @mmetc
• support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump (#3361) @blotus
• lint: style, autofix (#3354) @mmetc
• update golangci-lint to 1.62 (#3332) @mmetc

Bug Fixes

• cscli: exclude removed commands from generated docs (#3449) @mmetc
• cscli: when prompting, use default in case of EOF instead of going for "no" (#3447) @mmetc
• ignore zero value variables for context (#3436) @blotus
• bucket: avoid crashing on malformed expression (fix #3351) (#3368) @mmetc
• fix parsing of noncompliant RFC3339 timestamps missing only a timezone (#3346) @gilbsgilbs
• fix: use CreatedAt instead of StartAt (#3427) @LaurenceJJones
• use the actual bucket name when checking for simulation mode (#3416) @blotus
• appsec: do not attempt to deduplicate native modsec rules (#3347) @buixor
• Removed updating of machine last_heartbeat based on baseMetrics in MachineUpdateBaseMetrics (#3425) @srkoster
• cscli hub: handle freebsd pre-release version numbers (#3423) @mmetc
• wizard: install systemd service file (#3418) @mmetc
• pkg/cticlient: Add missing field in SmokeItem and FireItem (#3413) @AlteredCoder
• fix: Bucket pour log error with message (#3378) @LaurenceJJones
• gin: do not use gin context after returning response (#3398) @blotus
• wizard: unattended install w/ new hubops (#3392) @mmetc
• cscli: print errors in plain text with -o json (#2973) @mmetc
• sigmahq: fix functional test (#3359) @mmetc
• appsec: missing err check when initializing out-of-band engine (#3344) @blotus

Chore / Deps

• use go 1.23.5 (#3419) @mmetc
• upgrade coraza to latest version (#3417) @blotus
• README revamp (#3408) @buixor
• remove dependency from github.com/gofrs/uuid (#3406) @mmetc
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 (#3381) @dependabot[bot]
• build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#3380) @dependabot[bot]
• update dependency on docker (#3175) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.5-rc8

Changes

• wizard.sh: remove obsolete --yes option (#3450) @mmetc
• cscli: replace '--yes' option with '--interactive' (#3448) @mmetc
• CI: use alpine 3.21 for docker build (#3445) @mmetc
• merge from master (dc28ae5) for 1.6.5 (#3444) @mmetc
• run 'hub upgrade' in rpm/deb postinst, improve hub message (#3440) @mmetc
• CI: setup go from version in go.mod (#3432) @mmetc
• CI: package docker tests with uv (#3429) @mmetc
• Improve post-installation message (#3407) @blotus
• deb packaging: prevent installing crowdsec.service twice (#3415) @mmetc
• deb build: get version with dpkg-parsechangelog -S (#3405) @mmetc
• cscli: cliconfig - refactor / remove global variables and gratuitous pointer (#3414) @mmetc
• lint: enable errcheck; add allowlist and explicit checks (#3403) @mmetc
• lint: gocritic/captLocal (don't capitalize local variables) (#3402) @mmetc
• remove commands "cscli config backup/restore" (#3158) @mmetc
• CI: golangci-lint 1.63 (#3396) @mmetc
• Hubops tests (#3393) @mmetc
• cscli hub: refact/split files; add some doc/examples (#3394) @mmetc
• lint: explicit error checks (#3388) @mmetc
• pkg/cwhub - refact Downloader (#3382) @mmetc
• lint: replace type assertions and type switch on errors (#3376) @mmetc
• refactor pkg/leakybucket (#3371) @mmetc
• refact pkg/database: clean up code and error messages (#3263) @mmetc
• lint/deep-exit: avoid log.Fatal (#3367) @mmetc
• loop performance optimizations / 2 (#3364) @mmetc
• lint/deep-exit: avoid log.Fatal (#3360) @mmetc
• lint: enable more gocritic checks (#3363) @mmetc
• acquisition: add some test and warning for wrong source type (#3362) @mmetc
• support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump (#3361) @blotus
• lint: style, autofix (#3354) @mmetc
• update golangci-lint to 1.62 (#3332) @mmetc

New Features

• acquisition/victorialogs: add new datasource (#3310) @zekker6
• Add possibility to configure log format #799 (#2941) @victoredvardsson

Improvements

• don't ask user to reload systemd service when running in docker (#3434) @mmetc
• enhance: Log appsec error on writing response to remediation (#3412) @LaurenceJJones
• test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing (#3400) @mmetc
• log warning if local items have conflicting names (#3399) @mmetc
• feat(cscli): add env variable flag for dashboard setup (#3110) @quantumsheep
• expand env var when loading acquis (#3375) @blotus
• cscli: restyle table titles; autocomplete "cscli metrics show" (#3391) @mmetc
• enhancement: Hubtest respect patterndir option set via config.yaml (#3386) @LaurenceJJones
• enhancement: add logdata to appsec AccumlateTxToEvent (#3383) @LaurenceJJones
• cscli: improved hub management (#3352) @mmetc
• cscli: display expired decisions' expiration time in red (#3357) @mmetc
• loop performance optimizations / 1 (#3313) @mmetc

Bug Fixes

• cscli: exclude removed commands from generated docs (#3449) @mmetc
• cscli: when prompting, use default in case of EOF instead of going for "no" (#3447) @mmetc
• ignore zero value variables for context (#3436) @blotus
• bucket: avoid crashing on malformed expression (fix #3351) (#3368) @mmetc
• fix parsing of noncompliant RFC3339 timestamps missing only a timezone (#3346) @gilbsgilbs
• fix: use CreatedAt instead of StartAt (#3427) @LaurenceJJones
• use the actual bucket name when checking for simulation mode (#3416) @blotus
• appsec: do not attempt to deduplicate native modsec rules (#3347) @buixor
• Removed updating of machine last_heartbeat based on baseMetrics in MachineUpdateBaseMetrics (#3425) @srkoster
• cscli hub: handle freebsd pre-release version numbers (#3423) @mmetc
• wizard: install systemd service file (#3418) @mmetc
• pkg/cticlient: Add missing field in SmokeItem and FireItem (#3413) @AlteredCoder
• fix: Bucket pour log error with message (#3378) @LaurenceJJones
• gin: do not use gin context after returning response (#3398) @blotus
• wizard: unattended install w/ new hubops (#3392) @mmetc
• cscli: print errors in plain text with -o json (#2973) @mmetc
• sigmahq: fix functional test (#3359) @mmetc
• appsec: missing err check when initializing out-of-band engine (#3344) @blotus

Chore / Deps

• use go 1.23.5 (#3419) @mmetc
• upgrade coraza to latest version (#3417) @blotus
• README revamp (#3408) @buixor
• remove dependency from github.com/gofrs/uuid (#3406) @mmetc
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 (#3381) @dependabot[bot]
• build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#3380) @dependabot[bot]
• update dependency on docker (#3175) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.5-rc7

Changes

• cscli: replace '--yes' option with '--interactive' (#3448) @mmetc
• CI: use alpine 3.21 for docker build (#3445) @mmetc
• merge from master (dc28ae5) for 1.6.5 (#3444) @mmetc
• run 'hub upgrade' in rpm/deb postinst, improve hub message (#3440) @mmetc
• CI: setup go from version in go.mod (#3432) @mmetc
• CI: package docker tests with uv (#3429) @mmetc
• Improve post-installation message (#3407) @blotus
• deb packaging: prevent installing crowdsec.service twice (#3415) @mmetc
• deb build: get version with dpkg-parsechangelog -S (#3405) @mmetc
• cscli: cliconfig - refactor / remove global variables and gratuitous pointer (#3414) @mmetc
• lint: enable errcheck; add allowlist and explicit checks (#3403) @mmetc
• lint: gocritic/captLocal (don't capitalize local variables) (#3402) @mmetc
• remove commands "cscli config backup/restore" (#3158) @mmetc
• CI: golangci-lint 1.63 (#3396) @mmetc
• Hubops tests (#3393) @mmetc
• cscli hub: refact/split files; add some doc/examples (#3394) @mmetc
• lint: explicit error checks (#3388) @mmetc
• pkg/cwhub - refact Downloader (#3382) @mmetc
• lint: replace type assertions and type switch on errors (#3376) @mmetc
• refactor pkg/leakybucket (#3371) @mmetc
• refact pkg/database: clean up code and error messages (#3263) @mmetc
• lint/deep-exit: avoid log.Fatal (#3367) @mmetc
• loop performance optimizations / 2 (#3364) @mmetc
• lint/deep-exit: avoid log.Fatal (#3360) @mmetc
• lint: enable more gocritic checks (#3363) @mmetc
• acquisition: add some test and warning for wrong source type (#3362) @mmetc
• support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump (#3361) @blotus
• lint: style, autofix (#3354) @mmetc
• update golangci-lint to 1.62 (#3332) @mmetc

New Features

• acquisition/victorialogs: add new datasource (#3310) @zekker6
• Add possibility to configure log format #799 (#2941) @victoredvardsson

Improvements

• don't ask user to reload systemd service when running in docker (#3434) @mmetc
• enhance: Log appsec error on writing response to remediation (#3412) @LaurenceJJones
• test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing (#3400) @mmetc
• log warning if local items have conflicting names (#3399) @mmetc
• feat(cscli): add env variable flag for dashboard setup (#3110) @quantumsheep
• expand env var when loading acquis (#3375) @blotus
• cscli: restyle table titles; autocomplete "cscli metrics show" (#3391) @mmetc
• enhancement: Hubtest respect patterndir option set via config.yaml (#3386) @LaurenceJJones
• enhancement: add logdata to appsec AccumlateTxToEvent (#3383) @LaurenceJJones
• cscli: improved hub management (#3352) @mmetc
• cscli: display expired decisions' expiration time in red (#3357) @mmetc
• loop performance optimizations / 1 (#3313) @mmetc

Bug Fixes

• cscli: when prompting, use default in case of EOF instead of going for "no" (#3447) @mmetc
• ignore zero value variables for context (#3436) @blotus
• bucket: avoid crashing on malformed expression (fix #3351) (#3368) @mmetc
• fix parsing of noncompliant RFC3339 timestamps missing only a timezone (#3346) @gilbsgilbs
• fix: use CreatedAt instead of StartAt (#3427) @LaurenceJJones
• use the actual bucket name when checking for simulation mode (#3416) @blotus
• appsec: do not attempt to deduplicate native modsec rules (#3347) @buixor
• Removed updating of machine last_heartbeat based on baseMetrics in MachineUpdateBaseMetrics (#3425) @srkoster
• cscli hub: handle freebsd pre-release version numbers (#3423) @mmetc
• wizard: install systemd service file (#3418) @mmetc
• pkg/cticlient: Add missing field in SmokeItem and FireItem (#3413) @AlteredCoder
• fix: Bucket pour log error with message (#3378) @LaurenceJJones
• gin: do not use gin context after returning response (#3398) @blotus
• wizard: unattended install w/ new hubops (#3392) @mmetc
• cscli: print errors in plain text with -o json (#2973) @mmetc
• sigmahq: fix functional test (#3359) @mmetc
• appsec: missing err check when initializing out-of-band engine (#3344) @blotus

Chore / Deps

• use go 1.23.5 (#3419) @mmetc
• upgrade coraza to latest version (#3417) @blotus
• README revamp (#3408) @buixor
• remove dependency from github.com/gofrs/uuid (#3406) @mmetc
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 (#3381) @dependabot[bot]
• build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#3380) @dependabot[bot]
• update dependency on docker (#3175) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.5-rc6

Changes

• CI: use alpine 3.21 for docker build (#3445) @mmetc
• merge from master (dc28ae5) for 1.6.5 (#3444) @mmetc
• run 'hub upgrade' in rpm/deb postinst, improve hub message (#3440) @mmetc
• CI: setup go from version in go.mod (#3432) @mmetc
• CI: package docker tests with uv (#3429) @mmetc
• Improve post-installation message (#3407) @blotus
• deb packaging: prevent installing crowdsec.service twice (#3415) @mmetc
• deb build: get version with dpkg-parsechangelog -S (#3405) @mmetc
• cscli: cliconfig - refactor / remove global variables and gratuitous pointer (#3414) @mmetc
• lint: enable errcheck; add allowlist and explicit checks (#3403) @mmetc
• lint: gocritic/captLocal (don't capitalize local variables) (#3402) @mmetc
• remove commands "cscli config backup/restore" (#3158) @mmetc
• CI: golangci-lint 1.63 (#3396) @mmetc
• Hubops tests (#3393) @mmetc
• cscli hub: refact/split files; add some doc/examples (#3394) @mmetc
• lint: explicit error checks (#3388) @mmetc
• pkg/cwhub - refact Downloader (#3382) @mmetc
• lint: replace type assertions and type switch on errors (#3376) @mmetc
• refactor pkg/leakybucket (#3371) @mmetc
• refact pkg/database: clean up code and error messages (#3263) @mmetc
• lint/deep-exit: avoid log.Fatal (#3367) @mmetc
• loop performance optimizations / 2 (#3364) @mmetc
• lint/deep-exit: avoid log.Fatal (#3360) @mmetc
• lint: enable more gocritic checks (#3363) @mmetc
• acquisition: add some test and warning for wrong source type (#3362) @mmetc
• support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump (#3361) @blotus
• lint: style, autofix (#3354) @mmetc
• update golangci-lint to 1.62 (#3332) @mmetc

New Features

• acquisition/victorialogs: add new datasource (#3310) @zekker6
• Add possibility to configure log format #799 (#2941) @victoredvardsson

Improvements

• don't ask user to reload systemd service when running in docker (#3434) @mmetc
• enhance: Log appsec error on writing response to remediation (#3412) @LaurenceJJones
• test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing (#3400) @mmetc
• log warning if local items have conflicting names (#3399) @mmetc
• feat(cscli): add env variable flag for dashboard setup (#3110) @quantumsheep
• expand env var when loading acquis (#3375) @blotus
• cscli: restyle table titles; autocomplete "cscli metrics show" (#3391) @mmetc
• enhancement: Hubtest respect patterndir option set via config.yaml (#3386) @LaurenceJJones
• enhancement: add logdata to appsec AccumlateTxToEvent (#3383) @LaurenceJJones
• cscli: improved hub management (#3352) @mmetc
• cscli: display expired decisions' expiration time in red (#3357) @mmetc
• loop performance optimizations / 1 (#3313) @mmetc

Bug Fixes

• cscli: when prompting, use default in case of EOF instead of going for "no" (#3447) @mmetc
• ignore zero value variables for context (#3436) @blotus
• bucket: avoid crashing on malformed expression (fix #3351) (#3368) @mmetc
• fix parsing of noncompliant RFC3339 timestamps missing only a timezone (#3346) @gilbsgilbs
• fix: use CreatedAt instead of StartAt (#3427) @LaurenceJJones
• use the actual bucket name when checking for simulation mode (#3416) @blotus
• appsec: do not attempt to deduplicate native modsec rules (#3347) @buixor
• Removed updating of machine last_heartbeat based on baseMetrics in MachineUpdateBaseMetrics (#3425) @srkoster
• cscli hub: handle freebsd pre-release version numbers (#3423) @mmetc
• wizard: install systemd service file (#3418) @mmetc
• pkg/cticlient: Add missing field in SmokeItem and FireItem (#3413) @AlteredCoder
• fix: Bucket pour log error with message (#3378) @LaurenceJJones
• gin: do not use gin context after returning response (#3398) @blotus
• wizard: unattended install w/ new hubops (#3392) @mmetc
• cscli: print errors in plain text with -o json (#2973) @mmetc
• sigmahq: fix functional test (#3359) @mmetc
• appsec: missing err check when initializing out-of-band engine (#3344) @blotus

Chore / Deps

• use go 1.23.5 (#3419) @mmetc
• upgrade coraza to latest version (#3417) @blotus
• README revamp (#3408) @buixor
• remove dependency from github.com/gofrs/uuid (#3406) @mmetc
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 (#3381) @dependabot[bot]
• build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#3380) @dependabot[bot]
• update dependency on docker (#3175) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.5-rc5

Changes

• CI: setup go from version in go.mod (#3432) @mmetc
• CI: package docker tests with uv (#3429) @mmetc
• Improve post-installation message (#3407) @blotus
• deb packaging: prevent installing crowdsec.service twice (#3415) @mmetc
• deb build: get version with dpkg-parsechangelog -S (#3405) @mmetc
• cscli: cliconfig - refactor / remove global variables and gratuitous pointer (#3414) @mmetc
• lint: enable errcheck; add allowlist and explicit checks (#3403) @mmetc
• lint: gocritic/captLocal (don't capitalize local variables) (#3402) @mmetc
• remove commands "cscli config backup/restore" (#3158) @mmetc
• CI: golangci-lint 1.63 (#3396) @mmetc
• Hubops tests (#3393) @mmetc
• cscli hub: refact/split files; add some doc/examples (#3394) @mmetc
• lint: explicit error checks (#3388) @mmetc
• pkg/cwhub - refact Downloader (#3382) @mmetc
• lint: replace type assertions and type switch on errors (#3376) @mmetc
• refactor pkg/leakybucket (#3371) @mmetc
• refact pkg/database: clean up code and error messages (#3263) @mmetc
• lint/deep-exit: avoid log.Fatal (#3367) @mmetc
• loop performance optimizations / 2 (#3364) @mmetc
• lint/deep-exit: avoid log.Fatal (#3360) @mmetc
• lint: enable more gocritic checks (#3363) @mmetc
• acquisition: add some test and warning for wrong source type (#3362) @mmetc
• support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump (#3361) @blotus
• lint: style, autofix (#3354) @mmetc
• update golangci-lint to 1.62 (#3332) @mmetc
• run 'hub upgrade' in rpm/deb postinst, improve hub message (#3440)

New Features

• acquisition/victorialogs: add new datasource (#3310) @zekker6
• Add possibility to configure log format #799 (#2941) @victoredvardsson

Improvements

• don't ask user to reload systemd service when running in docker (#3434) @mmetc
• enhance: Log appsec error on writing response to remediation (#3412) @LaurenceJJones
• test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing (#3400) @mmetc
• log warning if local items have conflicting names (#3399) @mmetc
• feat(cscli): add env variable flag for dashboard setup (#3110) @quantumsheep
• expand env var when loading acquis (#3375) @blotus
• cscli: restyle table titles; autocomplete "cscli metrics show" (#3391) @mmetc
• enhancement: Hubtest respect patterndir option set via config.yaml (#3386) @LaurenceJJones
• enhancement: add logdata to appsec AccumlateTxToEvent (#3383) @LaurenceJJones
• cscli: improved hub management (#3352) @mmetc
• cscli: display expired decisions' expiration time in red (#3357) @mmetc
• loop performance optimizations / 1 (#3313) @mmetc

Bug Fixes

• ignore zero value variables for context (#3436) @blotus
• bucket: avoid crashing on malformed expression (fix #3351) (#3368) @mmetc
• fix parsing of noncompliant RFC3339 timestamps missing only a timezone (#3346) @gilbsgilbs
• fix: use CreatedAt instead of StartAt (#3427) @LaurenceJJones
• use the actual bucket name when checking for simulation mode (#3416) @blotus
• appsec: do not attempt to deduplicate native modsec rules (#3347) @buixor
• Removed updating of machine last_heartbeat based on baseMetrics in MachineUpdateBaseMetrics (#3425) @srkoster
• cscli hub: handle freebsd pre-release version numbers (#3423) @mmetc
• wizard: install systemd service file (#3418) @mmetc
• pkg/cticlient: Add missing field in SmokeItem and FireItem (#3413) @AlteredCoder
• fix: Bucket pour log error with message (#3378) @LaurenceJJones
• gin: do not use gin context after returning response (#3398) @blotus
• wizard: unattended install w/ new hubops (#3392) @mmetc
• cscli: print errors in plain text with -o json (#2973) @mmetc
• sigmahq: fix functional test (#3359) @mmetc
• appsec: missing err check when initializing out-of-band engine (#3344) @blotus

Chore / Deps

• use go 1.23.5 (#3419) @mmetc
• upgrade coraza to latest version (#3417) @blotus
• README revamp (#3408) @buixor
• remove dependency from github.com/gofrs/uuid (#3406) @mmetc
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 (#3381) @dependabot[bot]
• build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#3380) @dependabot[bot]
• update dependency on docker (#3175) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.5-rc4

Changes

• CI: setup go from version in go.mod (#3432) @mmetc
• CI: package docker tests with uv (#3429) @mmetc
• Improve post-installation message (#3407) @blotus
• deb packaging: prevent installing crowdsec.service twice (#3415) @mmetc
• deb build: get version with dpkg-parsechangelog -S (#3405) @mmetc
• cscli: cliconfig - refactor / remove global variables and gratuitous pointer (#3414) @mmetc
• lint: enable errcheck; add allowlist and explicit checks (#3403) @mmetc
• lint: gocritic/captLocal (don't capitalize local variables) (#3402) @mmetc
• remove commands "cscli config backup/restore" (#3158) @mmetc
• CI: golangci-lint 1.63 (#3396) @mmetc
• Hubops tests (#3393) @mmetc
• cscli hub: refact/split files; add some doc/examples (#3394) @mmetc
• lint: explicit error checks (#3388) @mmetc
• pkg/cwhub - refact Downloader (#3382) @mmetc
• lint: replace type assertions and type switch on errors (#3376) @mmetc
• refactor pkg/leakybucket (#3371) @mmetc
• refact pkg/database: clean up code and error messages (#3263) @mmetc
• lint/deep-exit: avoid log.Fatal (#3367) @mmetc
• loop performance optimizations / 2 (#3364) @mmetc
• lint/deep-exit: avoid log.Fatal (#3360) @mmetc
• lint: enable more gocritic checks (#3363) @mmetc
• acquisition: add some test and warning for wrong source type (#3362) @mmetc
• support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump (#3361) @blotus
• lint: style, autofix (#3354) @mmetc
• update golangci-lint to 1.62 (#3332) @mmetc

New Features

• acquisition/victorialogs: add new datasource (#3310) @zekker6
• Add possibility to configure log format #799 (#2941) @victoredvardsson

Improvements

• don't ask user to reload systemd service when running in docker (#3434) @mmetc
• enhance: Log appsec error on writing response to remediation (#3412) @LaurenceJJones
• test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing (#3400) @mmetc
• log warning if local items have conflicting names (#3399) @mmetc
• feat(cscli): add env variable flag for dashboard setup (#3110) @quantumsheep
• expand env var when loading acquis (#3375) @blotus
• cscli: restyle table titles; autocomplete "cscli metrics show" (#3391) @mmetc
• enhancement: Hubtest respect patterndir option set via config.yaml (#3386) @LaurenceJJones
• enhancement: add logdata to appsec AccumlateTxToEvent (#3383) @LaurenceJJones
• cscli: improved hub management (#3352) @mmetc
• cscli: display expired decisions' expiration time in red (#3357) @mmetc
• loop performance optimizations / 1 (#3313) @mmetc

Bug Fixes

• ignore zero value variables for context (#3436) @blotus
• bucket: avoid crashing on malformed expression (fix #3351) (#3368) @mmetc
• fix parsing of noncompliant RFC3339 timestamps missing only a timezone (#3346) @gilbsgilbs
• fix: use CreatedAt instead of StartAt (#3427) @LaurenceJJones
• use the actual bucket name when checking for simulation mode (#3416) @blotus
• appsec: do not attempt to deduplicate native modsec rules (#3347) @buixor
• Removed updating of machine last_heartbeat based on baseMetrics in MachineUpdateBaseMetrics (#3425) @srkoster
• cscli hub: handle freebsd pre-release version numbers (#3423) @mmetc
• wizard: install systemd service file (#3418) @mmetc
• pkg/cticlient: Add missing field in SmokeItem and FireItem (#3413) @AlteredCoder
• fix: Bucket pour log error with message (#3378) @LaurenceJJones
• gin: do not use gin context after returning response (#3398) @blotus
• wizard: unattended install w/ new hubops (#3392) @mmetc
• cscli: print errors in plain text with -o json (#2973) @mmetc
• sigmahq: fix functional test (#3359) @mmetc
• appsec: missing err check when initializing out-of-band engine (#3344) @blotus

Chore / Deps

• use go 1.23.5 (#3419) @mmetc
• upgrade coraza to latest version (#3417) @blotus
• README revamp (#3408) @buixor
• remove dependency from github.com/gofrs/uuid (#3406) @mmetc
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 (#3381) @dependabot[bot]
• build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#3380) @dependabot[bot]
• update dependency on docker (#3175) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.5-rc3

Changes

• CI: package docker tests with uv (#3429) @mmetc
• Improve post-installation message (#3407) @blotus
• deb packaging: prevent installing crowdsec.service twice (#3415) @mmetc
• deb build: get version with dpkg-parsechangelog -S (#3405) @mmetc
• cscli: cliconfig - refactor / remove global variables and gratuitous pointer (#3414) @mmetc
• lint: enable errcheck; add allowlist and explicit checks (#3403) @mmetc
• lint: gocritic/captLocal (don't capitalize local variables) (#3402) @mmetc
• remove commands "cscli config backup/restore" (#3158) @mmetc
• CI: golangci-lint 1.63 (#3396) @mmetc
• Hubops tests (#3393) @mmetc
• cscli hub: refact/split files; add some doc/examples (#3394) @mmetc
• lint: explicit error checks (#3388) @mmetc
• pkg/cwhub - refact Downloader (#3382) @mmetc
• lint: replace type assertions and type switch on errors (#3376) @mmetc
• refactor pkg/leakybucket (#3371) @mmetc
• refact pkg/database: clean up code and error messages (#3263) @mmetc
• lint/deep-exit: avoid log.Fatal (#3367) @mmetc
• loop performance optimizations / 2 (#3364) @mmetc
• lint/deep-exit: avoid log.Fatal (#3360) @mmetc
• lint: enable more gocritic checks (#3363) @mmetc
• acquisition: add some test and warning for wrong source type (#3362) @mmetc
• support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump (#3361) @blotus
• lint: style, autofix (#3354) @mmetc
• update golangci-lint to 1.62 (#3332) @mmetc

New Features

• Add possibility to configure log format #799 (#2941) @victoredvardsson

Improvements

• enhance: Log appsec error on writing response to remediation (#3412) @LaurenceJJones
• test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing (#3400) @mmetc
• log warning if local items have conflicting names (#3399) @mmetc
• feat(cscli): add env variable flag for dashboard setup (#3110) @quantumsheep
• expand env var when loading acquis (#3375) @blotus
• cscli: restyle table titles; autocomplete "cscli metrics show" (#3391) @mmetc
• enhancement: Hubtest respect patterndir option set via config.yaml (#3386) @LaurenceJJones
• enhancement: add logdata to appsec AccumlateTxToEvent (#3383) @LaurenceJJones
• cscli: improved hub management (#3352) @mmetc
• cscli: display expired decisions' expiration time in red (#3357) @mmetc
• loop performance optimizations / 1 (#3313) @mmetc

Bug Fixes

• fix: use CreatedAt instead of StartAt (#3427) @LaurenceJJones
• use the actual bucket name when checking for simulation mode (#3416) @blotus
• appsec: do not attempt to deduplicate native modsec rules (#3347) @buixor
• Removed updating of machine last_heartbeat based on baseMetrics in MachineUpdateBaseMetrics (#3425) @srkoster
• cscli hub: handle freebsd pre-release version numbers (#3423) @mmetc
• wizard: install systemd service file (#3418) @mmetc
• pkg/cticlient: Add missing field in SmokeItem and FireItem (#3413) @AlteredCoder
• fix: Bucket pour log error with message (#3378) @LaurenceJJones
• gin: do not use gin context after returning response (#3398) @blotus
• wizard: unattended install w/ new hubops (#3392) @mmetc
• cscli: print errors in plain text with -o json (#2973) @mmetc
• sigmahq: fix functional test (#3359) @mmetc
• appsec: missing err check when initializing out-of-band engine (#3344) @blotus

Chore / Deps

• use go 1.23.5 (#3419) @mmetc
• upgrade coraza to latest version (#3417) @blotus
• README revamp (#3408) @buixor
• remove dependency from github.com/gofrs/uuid (#3406) @mmetc
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 (#3381) @dependabot[bot]
• build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#3380) @dependabot[bot]
• update dependency on docker (#3175) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.