## Changes * docker: remove CROWDSEC_CONTAINER_ENV (#4085) @mmetc * refact cscli: define csconfig.Getter once (#4091) @mmetc * refact load/save apic token: dependencies and sentinel errors (#4081) @mmetc * pkg/csplugin: use backoff package to retry notifications (#3944) @mmetc * refact pkg/database batching (#3906) @mmetc * refact pkg/acquisition: split appsec.go (#4043) @mmetc * refact pkg/acquisition: journalctl configuration (#4057) @mmetc * lint revive: lower complexity threshold (#4056) @mmetc * lint: unused parameters / 2 (#4055) @mmetc * lint: unused parameters (#4049) @mmetc * refact pkg/acquisition: split loki.go (#4034) @mmetc * refact pkg/acquisition: split victorialogs.go (#4037) @mmetc * refact pkg/acquisition: split wineventlog.go (#4036) @mmetc * refact pkg/acquisition: split s3.go (#4035) @mmetc * refact pkg/acquisition: split k8s_audit.go (#4033) @mmetc * refact pkg/acquisition: split kinesis.go (#4032) @mmetc * refact pkg/acquisition: split kafka.go (#4031) @mmetc * refact pkg/acquisition: split cloudwatch.go (#4029) @mmetc * refact pkg/acquisition: split http.go (#4030) @mmetc * refactg pkg/acquisition: split file.go (#4038) @mmetc * refact pkg/acquisition: split syslog.go (#4028) @mmetc * papi: explicit context (#3973) @mmetc * pkg/csplugin: remove unused function (#4019) @mmetc * pkg/types -> new imports pt 4 (#4012) @mmetc * pkg/types -> new imports pt 3 (#4014) @mmetc * pkg/types -> new imports pt 2 (#4013) @mmetc * pkg/types -> new imports pt 1 (#4011) @mmetc * pkg/types -> pkg/{pipeline,fsutil,enrichment,logging...} (#4006) @mmetc * CI: enable linter "protogetter" (#3995) @mmetc * enable linters: unnecessary-format, unused-receiver (#4001) @mmetc * refact: remove unused struct fields and params / 3; enable linter "unused" (#3334) @mmetc ## New Features * WAF: Add `DropRequest` helper to block request in hooks (#4016) @blotus ## Improvements * pkg/acquisition: update syslog to RestartableStreamer (#4040) @mmetc * refact logging configuration; add log_media="syslog" (#4045) @mmetc * cscli hubtest: better report docker/nuclei errors (#4052) @mmetc * build: check make version before running Makefile (#4054) @mmetc * pkg/acquisition: refact journalctl datasource and unified retry loop (#4023) @mmetc * option api.server.disable_usage_metrics_export (#4021) @mmetc * build: optional pure-go sqlite driver (#3908) @mmetc ## Bug Fixes * fix accessLogger setup to separate file (#4103) @mmetc * docker acquisition: prevent data races (#3956) @mmetc * Fix avoidable prometheus metrics cardinality (#4080) @g00g1 * loki acquisition: remove forgotten debug print (#4062) @mmetc * fix 2808: show certificate path in "lapi status" (#4053) @mmetc * decisionStream: only select required fields from the DB (#4024) @blotus ## Documentation * docs: add public roadmap section to README.md (#4039) @mazzma12 ## Chore / Deps * build(deps): bump github/codeql-action from 4.31.4 to 4.31.6 (#4101) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump golangci/golangci-lint-action from 9.0.0 to 9.1.0 (#4083) @[dependabot[bot]](https://github.com/apps/dependabot) * Update go-re2 to 1.10.0 (#4020) @blotus * waf: remove custom raw body processor and use the upstream one (#4092) @blotus * build(deps): bump actions/setup-python from 6.0.0 to 6.1.0 (#4089) @[dependabot[bot]](https://github.com/apps/dependabot) * update go-cs-lib (#4084) @mmetc * update coraza (#4047) @blotus * build(deps): bump actions/checkout from 5.0.1 to 6.0.0 (#4077) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump astral-sh/setup-uv from 7.1.3 to 7.1.4 (#4078) @[dependabot[bot]](https://github.com/apps/dependabot) * replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932) @mmetc * build(deps): bump actions/setup-go from 6.0.0 to 6.1.0 (#4073) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github/codeql-action from 4.31.3 to 4.31.4 (#4069) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump actions/checkout from 5.0.0 to 5.0.1 (#4064) @[dependabot[bot]](https://github.com/apps/dependabot) * update docker/docker to moby/moby (version docker-v29.0.0) (#4048) @mmetc * build(deps): bump github/codeql-action from 4.31.0 to 4.31.3 (#4051) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump astral-sh/setup-uv from 7.1.2 to 7.1.3 (#4042) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.0.0 (#4041) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#4025) @[dependabot[bot]](https://github.com/apps/dependabot) * CI: update golangci-lint to 2.6.1 (#4026) @mmetc * waf: extract temp state from AppsecRuntimeConfig (#3952) @blotus * build(deps): bump astral-sh/setup-uv from 7.1.1 to 7.1.2 (#4009) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github/codeql-action from 4.30.9 to 4.31.0 (#4008) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#4010) @[dependabot[bot]](https://github.com/apps/dependabot) ## Geolite2 notice This product includes GeoLite2 data created by MaxMind, available from <a href="https://www.maxmind.com">https://www.maxmind.com</a>. ## Installation Take a look at the [installation instructions](https://doc.crowdsec.net/docs/getting_started/install_crowdsec).

## Changes * refact pkg/parser: ExtraField / Static (#3913) @mmetc * lint: fix nilaway warnings (part 11) (#3910) @mmetc * lint: errcheck (#3912) @mmetc * refact: net.Listen -> listenConfig.Listen(), remove context.TODO()/Background() (#3776) @mmetc * refact pkg/acquisition: split DataSource interface (#3900) @mmetc * refact: net.Dial() -> Dialer.DialContext() (#3670) @mmetc * lint: errcheck, nolintlint, intrange (#3904) @mmetc * lint: fix nilaway warnings (part 5) (#3863) @mmetc * lint: fix nilaway warnings (part 10) (#3875) @mmetc * lint: fix nilaway warnings (part 7) (#3865) @mmetc * lint: fix nilaway warnings (part 6) (#3864) @mmetc * refact cmd/crowdsec, pkg/apiserver: extract methods (#3743) @mmetc * lint: fix nilaway warnings (part 9) (#3868) @mmetc * refact pkg/parser: small optimizations (#3891) @mmetc * refact simulation: redundant use of pointers; log (stderr) -> print (stdout) (#3889) @mmetc * refact pkg/parser: extract method processLeaves (#3886) @mmetc * refact: exec.Command() -> exec.CommandContext() (#3826) @mmetc * lint: fix nilaway warnings (part 2) (#3854) @mmetc * refact pkg/parser: extract method (#3849) @mmetc * lint: fix nilaway warnings (part 8) (#3866) @mmetc * lint: nosprintfhostport, ifelsechain (#3838) @mmetc * lint: fix nilaway warnings (part 1) (#3853) @mmetc * packaging: clean up redundant debian/install, debian/rules (#3781) @mmetc * rpm: declare ghost file permissions (#3828) @mmetc ## Improvements * cscli setup: detect auditd (#3917) @mmetc * update s3 datasource to aws sdk v2 (#3844) @mmetc * output: push alerts from a goroutine (#3905) @blotus * cscli support dump: collect system information with gopsutil (#3879) @mmetc * replace cron script with systemd timer (#3842) @mmetc * waf: add fromFile match type (#3880) @blotus * Improve logging for file acquisition (#3778) @david-garcia-garcia ## Bug Fixes * apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911) @mmetc * pkg/database: enable upsert feature flag, use it for config items (#3895) @mmetc * lint: fix nilaway warnings (part 3), prevent data race (#3855) @mmetc * journalctl acquisition: fix #3890 (#3893) @mmetc * refact pkg/parser: review formatting verbs, logs (#3887) @mmetc * fix: set cache defaults for parser stash (#3883) @mmetc * [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884) @blotus * waf: return if we cannot create the TCP listener (#3882) @blotus * lint: fix nilaway warnings (part 4), prevent data race (#3857) @mmetc ## Chore / Deps * update golang.org/x/time, use fork instead of vendoring (#3892) @mmetc * pprof: enable block/mutex profiling with a feature flag (#3898) @blotus * build(deps): bump astral-sh/setup-uv from 6.6.1 to 6.7.0 (#3894) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#3885) @[dependabot[bot]](https://github.com/apps/dependabot) * CI: update and pin to commit actions/setup-python v6.0 (#3861) @mmetc * update fsnotify/fsnotify to 1.9.0 (#3874) @mmetc * update deps: testify, cobra (#3876) @mmetc * build(deps): bump github/codeql-action from 3.30.1 to 3.30.2 (#3877) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/appleboy/gin-jwt/v2 from 2.10.1 to 2.10.3 (#3772) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/go-openapi/errors from 0.22.0 to 0.22.2 (#3858) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#3859) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#3860) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 (#3841) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#3852) @[dependabot[bot]](https://github.com/apps/dependabot) * use go 1.25.0 (#3839) @mmetc ## Geolite2 notice This product includes GeoLite2 data created by MaxMind, available from <a href="https://www.maxmind.com">https://www.maxmind.com</a>. ## Installation Take a look at the [installation instructions](https://doc.crowdsec.net/docs/getting_started/install_crowdsec).

## Changes * use go 1.24.6 (#3835) @mmetc * CI: update actions; drop version comments (#3823) @mmetc * install scripts: echo -e -> echo (we're not requiring bash anymore) (#3799) @mmetc * move detect.yaml to /var/lib/crowdsec/data (#3797) @mmetc * restore wizard.sh --unattended (#3790) @mmetc * cleanup wizard.sh (#3786) @mmetc * remove the cscli_setup feature flag (#3784) @mmetc * add detect.yaml in rpm files section (#3773) @sabban * refact whitelist/allowlist: net.IP to net/netip (#3683) @mmetc * refact: pkg/database decisions filter, queries (#3635) @mmetc ## New Features * cscli: remove "dashboard" command (#3004) @mmetc * clean up buckets serialization code (#3777) @sabban * cscli setup: new service detection and configuration (#3730) @mmetc * feat: add swarm support to docker acquistion (#3744) @LaurenceJJones ## Improvements * WAF: Improve user-experience with CRS and modsecurity rules (#3827) @blotus * cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UN… (#3822) @mmetc * cscli setup: improve service detection and datasource validation (#3812) @mmetc * cscli setup: skip missing items, fix collection name (#3794) @mmetc * Improve the output of appsec `cscli hubtest` (#3791) @buixor * cscli setup improvements (#3789) @mmetc * cscli: print command name along with errors (#3768) @mmetc * enhance: Add 2 time helpers for average and median (#3748) @LaurenceJJones * usage metrics: report acquisition + parsers metrics to LAPI (#3709) @blotus * improve datasource validation (goccy/go-yaml) (#3646) @mmetc ## Bug Fixes * fix "cscli alerts list -s <scenario>" for alerts with no decisions (#3830) @mmetc * unify the output format of start_at and stop_at (#3819) @buixor * pkg/cwhub: fix relative symlink resolution (#3824) @mmetc * fix: Postint check also if api.server.enable is false (#3802) @LaurenceJJones * detect.yaml: always acquire ssh logs from file if present (#3825) @mmetc * detect.yaml: avoid double acquisition on deb (#3821) @mmetc * review config/detect.yaml (#3820) @mmetc * fix rpm detect.yaml (#3814) @sabban * CI: remove config/detect.yaml reference from rpm (#3813) @mmetc * fix rpm dovecot detection (#3796) @sabban * Increase hub download timeout to 10 minutes (#3785) @mmetc * docker: enforce volume use for /var/lib/crowdsec/data/ (#3757) @blotus * setup: add detect.yaml to windows install (#3775) @blotus * fix timemachine lock (#3767) @sabban * appsec: properly set URI in the original request object for use in hooks (#3755) @blotus ## Chore / Deps * build(deps): bump codecov/codecov-action from 5.4.3 to 5.5.0 (#3816) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github/codeql-action from 3.29.7 to 3.29.11 (#3818) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/crowdsecurity/machineid from 1.0.2 to 1.0.3 (#3769) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump docker/login-action from 3.4.0 to 3.5.0 (#3783) @[dependabot[bot]](https://github.com/apps/dependabot) * update dependencies, use go 1.24.5 (#3774) @mmetc * build(deps): bump github.com/go-sql-driver/mysql from 1.6.0 to 1.9.3 (#3761) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/go-openapi/swag from 0.23.0 to 0.23.1 (#3763) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/hashicorp/go-version from 1.2.1 to 1.7.0 (#3764) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github/codeql-action from 3.29.4 to 3.29.5 (#3765) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/alexliesenfeld/health from 0.8.0 to 0.8.1 (#3760) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/r3labs/diff/v2 from 2.14.1 to 2.15.1 (#3721) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump google.golang.org/grpc from 1.67.1 to 1.74.2 (#3750) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/go-openapi/validate from 0.20.0 to 0.24.0 (#3719) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/sanity-io/litter from 1.5.5 to 1.5.8 (#3720) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump golang.org/x/net from 0.41.0 to 0.42.0 (#3749) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump astral-sh/setup-uv from 6.4.1 to 6.4.3 (#3753) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github/codeql-action from 3.29.2 to 3.29.4 (#3751) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump golang.org/x/mod from 0.25.0 to 0.26.0 (#3746) @[dependabot[bot]](https://github.com/apps/dependabot) ## Geolite2 notice This product includes GeoLite2 data created by MaxMind, available from <a href="https://www.maxmind.com">https://www.maxmind.com</a>. ## Installation Take a look at the [installation instructions](https://doc.crowdsec.net/docs/getting_started/install_crowdsec).

## Changes * install scripts: echo -e -> echo (we're not requiring bash anymore) (#3799) @mmetc * move detect.yaml to /var/lib/crowdsec/data (#3797) @mmetc * restore wizard.sh --unattended (#3790) @mmetc * cleanup wizard.sh (#3786) @mmetc * remove the cscli_setup feature flag (#3784) @mmetc * add detect.yaml in rpm files section (#3773) @sabban * refact whitelist/allowlist: net.IP to net/netip (#3683) @mmetc * refact: pkg/database decisions filter, queries (#3635) @mmetc ## New Features * cscli: remove "dashboard" command (#3004) @mmetc * clean up buckets serialization code (#3777) @sabban * cscli setup: new service detection and configuration (#3730) @mmetc * feat: add swarm support to docker acquistion (#3744) @LaurenceJJones ## Improvements * cscli setup: improve service detection and datasource validation (#3812) @mmetc * cscli setup: skip missing items, fix collection name (#3794) @mmetc * Improve the output of appsec `cscli hubtest` (#3791) @buixor * cscli setup improvements (#3789) @mmetc * cscli: print command name along with errors (#3768) @mmetc * enhance: Add 2 time helpers for average and median (#3748) @LaurenceJJones * usage metrics: report acquisition + parsers metrics to LAPI (#3709) @blotus * improve datasource validation (goccy/go-yaml) (#3646) @mmetc ## Bug Fixes * detect.yaml: avoid double acquisition on deb (#3821) @mmetc * review config/detect.yaml (#3820) @mmetc * fix rpm detect.yaml (#3814) @sabban * CI: remove config/detect.yaml reference from rpm (#3813) @mmetc * fix rpm dovecot detection (#3796) @sabban * Increase hub download timeout to 10 minutes (#3785) @mmetc * docker: enforce volume use for /var/lib/crowdsec/data/ (#3757) @blotus * setup: add detect.yaml to windows install (#3775) @blotus * fix timemachine lock (#3767) @sabban * appsec: properly set URI in the original request object for use in hooks (#3755) @blotus ## Chore / Deps * build(deps): bump github.com/crowdsecurity/machineid from 1.0.2 to 1.0.3 (#3769) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump docker/login-action from 3.4.0 to 3.5.0 (#3783) @[dependabot[bot]](https://github.com/apps/dependabot) * update dependencies, use go 1.24.5 (#3774) @mmetc * build(deps): bump github.com/go-sql-driver/mysql from 1.6.0 to 1.9.3 (#3761) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/go-openapi/swag from 0.23.0 to 0.23.1 (#3763) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/hashicorp/go-version from 1.2.1 to 1.7.0 (#3764) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github/codeql-action from 3.29.4 to 3.29.5 (#3765) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/alexliesenfeld/health from 0.8.0 to 0.8.1 (#3760) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/r3labs/diff/v2 from 2.14.1 to 2.15.1 (#3721) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump google.golang.org/grpc from 1.67.1 to 1.74.2 (#3750) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/go-openapi/validate from 0.20.0 to 0.24.0 (#3719) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/sanity-io/litter from 1.5.5 to 1.5.8 (#3720) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump golang.org/x/net from 0.41.0 to 0.42.0 (#3749) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump astral-sh/setup-uv from 6.4.1 to 6.4.3 (#3753) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github/codeql-action from 3.29.2 to 3.29.4 (#3751) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump golang.org/x/mod from 0.25.0 to 0.26.0 (#3746) @[dependabot[bot]](https://github.com/apps/dependabot) ## Geolite2 notice This product includes GeoLite2 data created by MaxMind, available from <a href="https://www.maxmind.com">https://www.maxmind.com</a>. ## Installation Take a look at the [installation instructions](https://doc.crowdsec.net/docs/getting_started/install_crowdsec).

## Changes * install scripts: echo -e -> echo (we're not requiring bash anymore) (#3799) @mmetc * move detect.yaml to /var/lib/crowdsec/data (#3797) @mmetc * restore wizard.sh --unattended (#3790) @mmetc * cleanup wizard.sh (#3786) @mmetc * remove the cscli_setup feature flag (#3784) @mmetc * add detect.yaml in rpm files section (#3773) @sabban * refact whitelist/allowlist: net.IP to net/netip (#3683) @mmetc * refact: pkg/database decisions filter, queries (#3635) @mmetc ## New Features * cscli: remove "dashboard" command (#3004) @mmetc * clean up buckets serialization code (#3777) @sabban * cscli setup: new service detection and configuration (#3730) @mmetc * feat: add swarm support to docker acquistion (#3744) @LaurenceJJones ## Improvements * cscli setup: improve service detection and datasource validation (#3812) @mmetc * cscli setup: skip missing items, fix collection name (#3794) @mmetc * Improve the output of appsec `cscli hubtest` (#3791) @buixor * cscli setup improvements (#3789) @mmetc * cscli: print command name along with errors (#3768) @mmetc * enhance: Add 2 time helpers for average and median (#3748) @LaurenceJJones * usage metrics: report acquisition + parsers metrics to LAPI (#3709) @blotus * improve datasource validation (goccy/go-yaml) (#3646) @mmetc ## Bug Fixes * fix rpm detect.yaml (#3814) @sabban * CI: remove config/detect.yaml reference from rpm (#3813) @mmetc * fix rpm dovecot detection (#3796) @sabban * Increase hub download timeout to 10 minutes (#3785) @mmetc * docker: enforce volume use for /var/lib/crowdsec/data/ (#3757) @blotus * setup: add detect.yaml to windows install (#3775) @blotus * fix timemachine lock (#3767) @sabban * appsec: properly set URI in the original request object for use in hooks (#3755) @blotus ## Chore / Deps * build(deps): bump github.com/crowdsecurity/machineid from 1.0.2 to 1.0.3 (#3769) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump docker/login-action from 3.4.0 to 3.5.0 (#3783) @[dependabot[bot]](https://github.com/apps/dependabot) * update dependencies, use go 1.24.5 (#3774) @mmetc * build(deps): bump github.com/go-sql-driver/mysql from 1.6.0 to 1.9.3 (#3761) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/go-openapi/swag from 0.23.0 to 0.23.1 (#3763) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/hashicorp/go-version from 1.2.1 to 1.7.0 (#3764) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github/codeql-action from 3.29.4 to 3.29.5 (#3765) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/alexliesenfeld/health from 0.8.0 to 0.8.1 (#3760) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/r3labs/diff/v2 from 2.14.1 to 2.15.1 (#3721) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump google.golang.org/grpc from 1.67.1 to 1.74.2 (#3750) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/go-openapi/validate from 0.20.0 to 0.24.0 (#3719) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/sanity-io/litter from 1.5.5 to 1.5.8 (#3720) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump golang.org/x/net from 0.41.0 to 0.42.0 (#3749) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump astral-sh/setup-uv from 6.4.1 to 6.4.3 (#3753) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github/codeql-action from 3.29.2 to 3.29.4 (#3751) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump golang.org/x/mod from 0.25.0 to 0.26.0 (#3746) @[dependabot[bot]](https://github.com/apps/dependabot) ## Geolite2 notice This product includes GeoLite2 data created by MaxMind, available from <a href="https://www.maxmind.com">https://www.maxmind.com</a>. ## Installation Take a look at the [installation instructions](https://doc.crowdsec.net/docs/getting_started/install_crowdsec).

## Changes * restore wizard.sh --unattended (#3790) @mmetc * cleanup wizard.sh (#3786) @mmetc * remove the cscli_setup feature flag (#3784) @mmetc * add detect.yaml in rpm files section (#3773) @sabban * refact whitelist/allowlist: net.IP to net/netip (#3683) @mmetc * refact: pkg/database decisions filter, queries (#3635) @mmetc ## New Features * cscli: remove "dashboard" command (#3004) @mmetc * clean up buckets serialization code (#3777) @sabban * cscli setup: new service detection and configuration (#3730) @mmetc * feat: add swarm support to docker acquistion (#3744) @LaurenceJJones ## Improvements * Improve the output of appsec `cscli hubtest` (#3791) @buixor * cscli setup improvements (#3789) @mmetc * cscli: print command name along with errors (#3768) @mmetc * enhance: Add 2 time helpers for average and median (#3748) @LaurenceJJones * usage metrics: report acquisition + parsers metrics to LAPI (#3709) @blotus * improve datasource validation (goccy/go-yaml) (#3646) @mmetc ## Bug Fixes * Increase hub download timeout to 10 minutes (#3785) @mmetc * docker: enforce volume use for /var/lib/crowdsec/data/ (#3757) @blotus * setup: add detect.yaml to windows install (#3775) @blotus * fix timemachine lock (#3767) @sabban * appsec: properly set URI in the original request object for use in hooks (#3755) @blotus ## Chore / Deps * update dependencies, use go 1.24.5 (#3774) @mmetc * build(deps): bump github.com/go-sql-driver/mysql from 1.6.0 to 1.9.3 (#3761) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/go-openapi/swag from 0.23.0 to 0.23.1 (#3763) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/hashicorp/go-version from 1.2.1 to 1.7.0 (#3764) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github/codeql-action from 3.29.4 to 3.29.5 (#3765) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/alexliesenfeld/health from 0.8.0 to 0.8.1 (#3760) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/r3labs/diff/v2 from 2.14.1 to 2.15.1 (#3721) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump google.golang.org/grpc from 1.67.1 to 1.74.2 (#3750) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/go-openapi/validate from 0.20.0 to 0.24.0 (#3719) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github.com/sanity-io/litter from 1.5.5 to 1.5.8 (#3720) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump golang.org/x/net from 0.41.0 to 0.42.0 (#3749) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump astral-sh/setup-uv from 6.4.1 to 6.4.3 (#3753) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump github/codeql-action from 3.29.2 to 3.29.4 (#3751) @[dependabot[bot]](https://github.com/apps/dependabot) * build(deps): bump golang.org/x/mod from 0.25.0 to 0.26.0 (#3746) @[dependabot[bot]](https://github.com/apps/dependabot) ## Geolite2 notice This product includes GeoLite2 data created by MaxMind, available from <a href="https://www.maxmind.com">https://www.maxmind.com</a>. ## Installation Take a look at the [installation instructions](https://doc.crowdsec.net/docs/getting_started/install_crowdsec).

## Improvements * enhance: Add allowlist check (#3684) @LaurenceJJones * Flags for console features (#3457) @Simbiat * HTTP datasource: allow GET/HEAD request for checking if the datasource is working (#3710) @blotus * enhance: appsec reuse httpc optimization (#3693) @LaurenceJJones * hubtest: resolve relative path for 'cscli', 'crowdsec' (#3651) @mmetc * refact pkg/cwhub (#3666) @mmetc * S3 datasource: add support for SNS format (#3716) @blotus ## Changes * refact pkg/acquisition: extract loop method (#3615) @mmetc * refact: plugin config parsing (#3640) @mmetc * refact: migrate net.IP -> net/netip: part 1 (#3680) @mmetc * use github.com/cenkalti/backoff/v5 for apiclient backoff (#3662) @mmetc * use go 1.24.4 (#3674) @mmetc * cscli help typos (#3707) @mmetc * move cti expr helper to pkg/cticlient (#3696) @mmetc * refact csplugin: move ProfileAlert to models (#3671) @mmetc * refact cmd/crowdsec: extract functions from runCrowdsec() (#3669) @mmetc * cscli capi register: no error if online_api_credentials.yaml does not exist (#3645) @mmetc * refact cmd/crowdsec: move plugin initialization to apiserver (#3668) @mmetc * lint: require name on interface parameters (#3614) @mmetc * unit tests: rename ./tests, ./test_data -> ./testdata (#3673) @mmetc ## Bug Fixes * Fix infinite loop in decisions list for some values of limit (#3695) @blotus * fix: Reset datafiles before loading the hub on HUP (#3712) @LaurenceJJones * fix: allowlist use content created at instead of list itself (#3703) @LaurenceJJones * pkg/apiserver: remove incorrect log.Error (#3672) @mmetc ## Chore / Deps * dependabot: set kind/dependencies label (#3722) @blotus * CI: update action deps (#3692) @mmetc * update golangci-lint v2.2 and config (#3713) @mmetc * refact: replace iplib with net/netip (#3642) @mmetc * update hashicorp/go-plugin (#3694) @mmetc * update github.com/jedib0t/go-pretty/ (#3705) @mmetc ## Geolite2 notice This product includes GeoLite2 data created by MaxMind, available from <a href="https://www.maxmind.com">https://www.maxmind.com</a>. ## Installation Take a look at the [installation instructions](https://doc.crowdsec.net/docs/getting_started/install_crowdsec).

## Overview > [!WARNING] > Docker acquisition now requires access to the events API endpoint. If you are using a socket proxy, make sure to update its configuration. - Improved performance for the docker datasource by using docker events instead of polling the docker API to detect new containers - Added a new option to allow a log processor to unregister itself from LAPI on shutdown. This is especially useful in a dynamic environment (eg, kubernetes) where nodes come and go to keep a clean list of active log processors. - When an allowlist is created (or updated), matching active decisions will be deleted automatically. - Polling API (PAPI) will be automatically enabled or disabled when crowdsec detects the user's console plan has changed, making the initial setup easier. ## Changes * fix PAPI failure to stop on reload (#3679) @blotus * update coraza (#3675) @blotus * modernize: replace legacy slice/map/range idioms with stdlib (#3658) @mmetc * CI: ensure tests don't alter the repository (#3616) @mmetc * refact apiclient.Config: remove field Scenarios (#3622) @mmetc * CI: release-drafter configuration: permissions, skip-changelog label (#3631) @mmetc * refact: cleanup bats helper (#3636) @mmetc * refact cmd/crowdsec: remove login code obsoleted by 16d06779 (#3620) @mmetc * CI: update codecov list and fix workflow (#3617) @mmetc * refact pkg/database: unnecessary pointers (#3611) @mmetc * CI: update action for generating docker description (#3559) @mmetc * refact pkg/parser: extract method, avoid calling defer in loop (#3564) @mmetc * refact: remove unused metod DeleteDecisionsWithFilter() (#3605) @mmetc * refact alert, decision filters: remove unnecessary pointers (#3607) @mmetc * CI: update lint complexity thresholds (#3608) @mmetc * refactor pkg/database/Client.createAlertChunk() (#3585) @mmetc * refact cscli: hub item - pointer receiver for consistency (#3595) @mmetc * CI: remove obsolete reference to directory dyn-bats (#3600) @mmetc * refact: pkg/exprhelpers/debugger, convert switch to function dispatch (#3587) @mmetc * lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer (#3583) @mmetc * refact pkg/database: dry decision count (#3586) @mmetc * refact parser Init: argument types (#3578) @mmetc * tests: refact localtest helper, use testify.suite (#3574) @mmetc * refact: logrus.GetLevel() -> logrus.IsLevelEnabled() (#3579) @mmetc * test: add cold log event assert (#3577) @mmetc * Refact pkg/database/decisions.go (#3541) @mmetc * replace go-acc, richgo with gotestsum (#3567) @mmetc * refact pkg/hubtest: use os.CopyFS() (#3539) @mmetc * lint/refactor: defer, reflectvaluecompare, stylecheck (#3544) @mmetc * CI: golangci-lint v2 (#3558) @mmetc ## New Features * allow watcher to self-delete on shutdown (#3565) @blotus * allowlists: check during bulk decision import (#3588) @mmetc ## Improvements * PAPI: auto enable on upgrade (#3659) @blotus * enhance: Remove docker acquis internal timer use docker events (#3598) @LaurenceJJones * kafka: expose batching configuration (#3621) @blotus * feat(apiclient): add token save functionality (#3639) @sabban * enhance: return err if notification has no plugin type (#3638) @LaurenceJJones * cscli capi status: save auth token, add tests (#3623) @mmetc * config.yaml: make config_dir and notification_dir optional (#3606) @mmetc * feat(apic): add ApicAuth client and token re-authentication logic (#3522) @sabban * allowlists: automatically expire current matching decisions on update (#3601) @blotus * improve support for parsing time durations with 'day' units (#3599) @mmetc * cscli inspect: don't show metrics or converted rules if an item is not installed (#3602) @mmetc * Fix monitorNewFiles for NFS + Remove dead tails from tail map (#3508) @david-garcia-garcia * enhance: add listen_socket to http acquisition (#3499) @LaurenceJJones * enhance: Allow the use of 'd' suffix in profiles (#3594) @LaurenceJJones * lapi: return specific error if a unix socket path is too long for the OS (#3593) @mmetc * do not return an error if we cannot fetch allowlists when starting the appsec (#3550) @blotus * Support WithUserAgent in cti client (#3542) @AlteredCoder ## Bug Fixes * appsec: do not query LAPI multiple times when checking auth (#3678) @blotus * kakfa: properly start at last offset when using a consumer group (#3629) @blotus * cscli: handle sigint/sigterm, cancel context of ongoing http req (#3660) @mmetc * Makefile: typo (#3628) @mmetc * Fix spelling mistake in metrics.go (#3618) @robigan * fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate (#3613) @sabban * Fix cp -n (#3483) @michacassola * CI: correct uv.lock path (#3596) @mmetc * make CTI client available in cscli notifications (#3591) @blotus * fix: avoid possible race condition while compiling expressions (#3582) @mmetc * fix mysql client certificate support (#3575) @blotus * fix: error check on postoverflow config (#3576) @mmetc * hubtests: correct basename check in parser tests (#3557) @mmetc ## Chore / Deps * update test/README.md (#3652) @mmetc * go.mod/sum cleanup (#3661) @mmetc * update coraza (#3657) @blotus * deprecate option 'daemonize' (#3648) @mmetc * update expr to 1.17.2 (#3519) @mmetc * CI: use go 1.24.3 (#3612) @mmetc * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 (#3581) @[dependabot[bot]](https://github.com/apps/dependabot) * enable codeql for python (#3545) @mmetc * update golangci-lint (#3590) @mmetc ## Geolite2 notice This product includes GeoLite2 data created by MaxMind, available from <a href="https://www.maxmind.com">https://www.maxmind.com</a>. ## Installation Take a look at the [installation instructions](https://doc.crowdsec.net/docs/getting_started/install_crowdsec).