v1.6.3-rc2

Changes

• docker: symlink all data files to the staging area (#3120) @mmetc
• lint: dockerfiles (#3138) @mmetc
• refactor cscli metrics: fix lines between tables, skip wrapper api (#3137) @mmetc
• usage metrics: validate maxLength for some elements (#3131) @mmetc
• remove warning "maxopenconns is 0, default to 100" (#3129) @mmetc
• revert "db: round created, updated... timestamps to 1 second" (#3127) @mmetc
• cscli machines/bouncers: dry helper code and move to cscli (#3123) @mmetc
• func tests: update curl wrapper (#3121) @mmetc
• update vagrant config for opensuse (#3119) @mmetc
• make: remove redundant go version check (#3118) @mmetc
• refactor cscli metrics: split stat types to own files (#3107) @mmetc
• cscli refactor: extract metrics to own package (#3106) @mmetc
• cscli refactor: extract table wrapper to own package (#3105) @mmetc
• db refact: drop column machines.status (#3102) @mmetc
• lint: replace "github.com/pkg/errors" in apiserver (#3097) @mmetc
• lint: import statement order (#3085) @mmetc
• lint: replace gocognit with revive (#3094) @mmetc
• lint: github.com/pkg/errors -> errors (#3091) @mmetc
• lint (intrange) (#2970) @mmetc
• lint (copyloopvar) (#2971) @mmetc
• refactor: prefer logrus.WithField over WithFields with a single param (#3087) @mmetc
• enable linter: revive (superfluous-else) (#3082) @mmetc
• cscli: refactor hubtests / extract methods run(), coverage() (#3086) @mmetc
• lint: disable redundant linters, update revive configuration and code metrics (#3081) @mmetc
• refactor pkg/parser: extract processGrok (#3080) @mmetc
• cscli: refactor "cscli setup" to avoid global variable (#3075) @mmetc
• refactor context (cscli, pkg/database) (#3071) @mmetc
• enable linter: revive (deep-exit) (#3077) @mmetc
• enable linter: revive (var-declaration) (#3069) @mmetc
• enable linter: revive (indent-error-flow) (#3068) @mmetc
• lint: replace cyclop, gocyclo with revive; basic pkg/hubtest helper (#3065) @mmetc
• pkg/cwhub: use explicit context for item install, upgrade (#3067) @mmetc
• pkg/cwhub: use explicit context for version check, index update (#3064) @mmetc
• enable linter: revive (early-return) (#3051) @mmetc
• add: missing go reference badge (#3066) @mazzma12
• lint revive(deep-exit): refactor cmd/crowdsec (#3063) @mmetc
• enable linter: revive (blank-imports) (#3062) @mmetc
• cscli: use cmp.Or from go 1.22 (#3058) @mmetc
• enable linter "stylecheck" (#3060) @mmetc
• refactor "cscli decisions" (#3061) @mmetc
• refactor pkg/database, pkg/models (#3022) @mmetc
• lint: enable revive/if-return, revive/error-strings (#3057) @mmetc
• tests: log.Fatal -> return err (#3056) @mmetc
• fix tests in 01_crowdsec.bats for packages (#3054) @sabban
• CI/bats: test remediation api via socket (#3052) @mmetc
• pkg/database: refactor & rename "soft delete" to "expire" (#3025) @mmetc
• lint: revive/useless-break (#3050) @mmetc
• enable linter: revive(bool-literal-in-expr) (#2983) @mmetc
• cscli: log.Fatal -> return err (#3049) @mmetc
• cscli: refactor alerts/console/decisions/setup (#3003) @mmetc
• CI/lint: enable some "revive" rules (#3041) @mmetc
• pkg/dumps.DumpTree: split to reduce complexity (#3001) @mmetc
• pkg/database: simplify flush agents/bouncers (#3026) @mmetc

New Features

• Lapi detailed metrics (#2858) @mmetc
• allow .index.json to embed item content (#3145) @mmetc
• bats: curl helpers to mock log processors and bouncers (#3141) @mmetc
• command "cscli metrics show bouncers" (#3126) @mmetc

Improvements

• Use the new hub api url (#3132) @sabban
• perf: retrieve unsorted metrics (#3148) @mmetc
• enhance: add crowdsec user agent to cti do request func (#3130) @LaurenceJJones
• enhance: Add default_range_remediation (#3109) @LaurenceJJones
• command cscli [machines|bouncers] inspect (#3103) @mmetc
• lapi detailed metrics: API spec + models (#3100) @mmetc
• lapi detailed metrics: db schema (#3099) @mmetc
• improved tls middleware revocation checks (#3034) @mmetc
• config: expand env variables in local_api_credentials.yaml and .yaml.local (#3093) @mmetc
• enhancement: add deprecation notice to cscli dashboard prerun (#3079) @LaurenceJJones
• enhancement: add other log levels to docker start script (#3072) @LaurenceJJones
• db,lapi: round durations and timestamps to 1 second (#3015) @mmetc
• update vagrant image for fc39, fc40 and ubuntu24.04 (#3042) @sabban
• db: mark immutable columns / remove unused (#3024) @mmetc

Bug Fixes

• docker: make sure the sqlite db is present before changing GID (#3140) @mmetc
• Store alert remediations status in DB (#3115) @blotus
• tests: increase delta for flaky float comparison (#3122) @mmetc
• typos (#3104) @mmetc
• fix "cscli [machines|bouncers] delete" autocompletion (#3101) @mmetc
• db: don't set machine heartbeat until first connection (#3019) @mmetc
• db: don't set bouncer last_pull until first connection (#3020) @mmetc
• Typos (#3084) @mmetc
• cscli: fixed some inconsistency in returning errors (#3076) @mmetc
• cscli: fix deprecation message for "context delete" (#3078) @mmetc
• fix test 01_cscli by avoiding discrepancies in cscli explain (#3059) @sabban
• add decently new version of python for centos 7 and 8 for testing (#3053) @sabban

Chore / Deps

• CI: update test dependencies (#3146) @mmetc
• update expr (#3144) @blotus
• CI: update action versions (#3143) @mmetc
• CI: use go 1.22.5 (#3128) @mmetc
• deps: use go-cs-lib 0.13 (#3136) @mmetc
• CI: use go 1.22.4 (#3095) @mmetc
• CI: update golangci-lint to 1.59; enforce canonical HTTP headers (#3074) @mmetc
• deps: use ent 0.13.1 (#3023) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.3-rc1

Changes

• lint: import statement order (#3085) @mmetc
• lint: replace gocognit with revive (#3094) @mmetc
• lint: github.com/pkg/errors -> errors (#3091) @mmetc
• lint (intrange) (#2970) @mmetc
• lint (copyloopvar) (#2971) @mmetc
• refactor: prefer logrus.WithField over WithFields with a single param (#3087) @mmetc
• enable linter: revive (superfluous-else) (#3082) @mmetc
• cscli: refactor hubtests / extract methods run(), coverage() (#3086) @mmetc
• lint: disable redundant linters, update revive configuration and code metrics (#3081) @mmetc
• refactor pkg/parser: extract processGrok (#3080) @mmetc
• cscli: refactor "cscli setup" to avoid global variable (#3075) @mmetc
• refactor context (cscli, pkg/database) (#3071) @mmetc
• enable linter: revive (deep-exit) (#3077) @mmetc
• enable linter: revive (var-declaration) (#3069) @mmetc
• enable linter: revive (indent-error-flow) (#3068) @mmetc
• lint: replace cyclop, gocyclo with revive; basic pkg/hubtest helper (#3065) @mmetc
• pkg/cwhub: use explicit context for item install, upgrade (#3067) @mmetc
• pkg/cwhub: use explicit context for version check, index update (#3064) @mmetc
• enable linter: revive (early-return) (#3051) @mmetc
• add: missing go reference badge (#3066) @mazzma12
• lint revive(deep-exit): refactor cmd/crowdsec (#3063) @mmetc
• enable linter: revive (blank-imports) (#3062) @mmetc
• cscli: use cmp.Or from go 1.22 (#3058) @mmetc
• enable linter "stylecheck" (#3060) @mmetc
• refactor "cscli decisions" (#3061) @mmetc
• refactor pkg/database, pkg/models (#3022) @mmetc
• lint: enable revive/if-return, revive/error-strings (#3057) @mmetc
• tests: log.Fatal -> return err (#3056) @mmetc
• fix tests in 01_crowdsec.bats for packages (#3054) @sabban
• CI/bats: test remediation api via socket (#3052) @mmetc
• pkg/database: refactor & rename "soft delete" to "expire" (#3025) @mmetc
• lint: revive/useless-break (#3050) @mmetc
• enable linter: revive(bool-literal-in-expr) (#2983) @mmetc
• cscli: log.Fatal -> return err (#3049) @mmetc
• cscli: refactor alerts/console/decisions/setup (#3003) @mmetc
• CI/lint: enable some "revive" rules (#3041) @mmetc
• pkg/dumps.DumpTree: split to reduce complexity (#3001) @mmetc
• pkg/database: simplify flush agents/bouncers (#3026) @mmetc

Improvements

• improved tls middleware revocation checks (#3034) @mmetc
• config: expand env variables in local_api_credentials.yaml and .yaml.local (#3093) @mmetc
• enhancement: add deprecation notice to cscli dashboard prerun (#3079) @LaurenceJJones
• enhancement: add other log levels to docker start script (#3072) @LaurenceJJones
• db,lapi: round durations and timestamps to 1 second (#3015) @mmetc
• update vagrant image for fc39, fc40 and ubuntu24.04 (#3042) @sabban
• db: mark immutable columns / remove unused (#3024) @mmetc

Bug Fixes

• db: don't set machine heartbeat until first connection (#3019) @mmetc
• db: don't set bouncer last_pull until first connection (#3020) @mmetc
• Typos (#3084) @mmetc
• cscli: fixed some inconsistency in returning errors (#3076) @mmetc
• cscli: fix deprecation message for "context delete" (#3078) @mmetc
• fix test 01_cscli by avoiding discrepancies in cscli explain (#3059) @sabban
• add a decently new version of python for centos 7 and 8 for testing (#3053) @sabban

Chore / Deps

• CI: use go 1.22.4 (#3095) @mmetc
• CI: update golangci-lint to 1.59; enforce canonical HTTP headers (#3074) @mmetc
• deps: use ent 0.13.1 (#3023) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.2

Changes

• replace log.Fatal with error return (#2996) @mmetc
• bats: clean up extra output (#3008) @mmetc
• make: remove unused targets (#2998) @mmetc
• deb,rpm: include empty directory etc/crowdsec/acquis.d (#2997) @mmetc
• CI: disable log formatting for consistency (#2989) @mmetc
• cscli: remove global dbClient (#2985) @mmetc
• enable linter "revive" (#2978) @mmetc
• minor lint/readability (#2976) @mmetc
• pkg/dumps,hubtest: use yaml.v3 (#2972) @mmetc
• cscli: avoid global vars (#2977) @mmetc
• refactor pkg/parser/node (#2953) @mmetc
• pkg/cwhub - rename methods for clarity (#2961) @mmetc
• cscli hub items: avoid global (#2960) @mmetc
• cscli config show: avoid globals, use yaml v3 (#2863) @mmetc
• pkg/database/decisiosn: remove filter parameter, which is always passed empty (#2954) @mmetc

New Features

• feat: File notification plugin (#2932) @LaurenceJJones

Improvements

• update user agent with version and platform information (#3035) @mmetc
• Appsec: properly populate event (#2943) @blotus
• enhance: container discovery via labels (#2959) @LaurenceJJones
• cscli: faster table rendering (#3027) @mmetc
• bats: no need for openssl, netcat; allow to prevent tests from running with a lock (#3016) @mmetc
• GetActiveDecisionsCount()and GetActiveDecisionsTimeLeft()expr helpers (#3013) @blotus
• fix: add sslmode check and append flag to conn string (#3009) @LaurenceJJones
• add tab completion to cscli notifications [test, inspect] (#2765) @LaurenceJJones
• add ability to configure channel, username, icon emoji/url in slack notification (#2975) @blesswinsamuel
• use go-cs-lib/downloader for data files, hub index, item YAML (#2926) @mmetc
• cscli support: collect profiling data and logs (#2987) @mmetc
• cscli: don't print timestamps (#2984) @mmetc
• feat: support stdout in cscli support dump (#2939) @LaurenceJJones
• cscli support: include stack traces (#2935) @mmetc

Bug Fixes

• check type assertion in geoip enrichers (#3040) @blotus
• jwt transport: fix retry on unauthorized from CAPI (#3006) @blotus
• appsec: respect on_success parameter in hooks (#3017) @blotus
• cti config: avoid nil deref (#3028) @mmetc
• appsec: add files and cookies related zones (#2956) @blotus
• simulation for custom scenarios (#3010) @mmetc
• version: write to stdout, add missing newline (#3012) @mmetc
• docker: conditionally update hub (#2948) @blotus
• LAPI: support CRL files with multiple PEM blocks (#3002) @mmetc
• CI: don't hang test "cscli machines prune" if the fixture is old (#2992) @mmetc
• db: review update timestamps, immutable columns (#2981) @mmetc
• add zfs magic for GetFSType (#2950) @blotus
• Truncate meta data (#2966) @buixor
• db config: don't exit setup if can't detect fs, improve detection for freebsd (#2963) @mmetc
• Revert "docker: pre-download all hub items and data, opt-in hub updat… (#2947) @blotus

Chore / Deps

• CI: improve code coverage report (#3029) @mmetc
• tests: replace "docker-compose" -> "docker compose" (#3000) @mmetc
• use go 1.22.3 (#2994) @mmetc
• update go-cs-lib to 0.0.11 (#2990) @mmetc
• update go dependencies (#2968) @mmetc
• plugins: use yaml.v3 (#2969) @mmetc
• use go 1.22 (#2826) @mmetc
• cscli: use yaml.v3 (#2965) @mmetc
• CI: upload coverage with token (#2958) @mmetc
• tests: bump yq, cfssl (#2952) @mmetc
• update linter list and descriptions (#2951) @mmetc
• enhance: add refactoring to governance (#2955) @LaurenceJJones

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.2-rc4

Changes

• replace log.Fatal with error return (#2996) @mmetc
• bats: clean up extra output (#3008) @mmetc
• make: remove unused targets (#2998) @mmetc
• deb,rpm: include empty directory etc/crowdsec/acquis.d (#2997) @mmetc
• CI: disable log formatting for consistency (#2989) @mmetc
• cscli: remove global dbClient (#2985) @mmetc
• enable linter "revive" (#2978) @mmetc
• minor lint/readability (#2976) @mmetc
• pkg/dumps,hubtest: use yaml.v3 (#2972) @mmetc
• cscli: avoid global vars (#2977) @mmetc
• Refact pkg/parser/node (#2953) @mmetc
• pkg/cwhub - rename methods for clarity (#2961) @mmetc
• cscli hub items: avoid global (#2960) @mmetc
• cscli config show: avoid globals, use yaml v3 (#2863) @mmetc
• pkg/database/decisiosn: remove filter parameter, which is always passed empty (#2954) @mmetc

New Features

• feat: File notification plugin (#2932) @LaurenceJJones

Improvements

• update user agent with version and platform information (#3035) @mmetc
• Appsec: properly populate event (#2943) @blotus
• enhance: container discovery via labels (#2959) @LaurenceJJones
• cscli: faster table rendering (#3027) @mmetc
• bats: no need for openssl, netcat; allow to prevent tests from running with a lock (#3016) @mmetc
• GetActiveDecisionsCount()and GetActiveDecisionsTimeLeft()expr helpers (#3013) @blotus
• fix: add sslmode check and append flag to conn string (#3009) @LaurenceJJones
• [cscli] Add tab completion to notifications [test, inspect] (#2765) @LaurenceJJones
• Add ability to configure channel, username, icon emoji/url in slack notification (#2975) @blesswinsamuel
• use go-cs-lib/downloader for data files, hub index, item YAML (#2926) @mmetc
• cscli support: collect profiling data and logs (#2987) @mmetc
• cscli: don't print timestamps (#2984) @mmetc
• feat: support stdout in cscli support dump (#2939) @LaurenceJJones
• cscli support: include stack traces (#2935) @mmetc

Bug Fixes

• jwt transport: fix retry on unauthorized from CAPI (#3006) @blotus
• appsec: respect on_success parameter in hooks (#3017) @blotus
• cti config: avoid nil deref (#3028) @mmetc
• appsec: add files and cookies related zones (#2956) @blotus
• simulation for custom scenarios (#3010) @mmetc
• version: write to stdout, add missing newline (#3012) @mmetc
• docker: conditionally update hub (#2948) @blotus
• LAPI: support CRL files with multiple PEM blocks (#3002) @mmetc
• CI: don't hang test "cscli machines prune" if the fixture is old (#2992) @mmetc
• db: review update timestamps, immutable columns (#2981) @mmetc
• add zfs magic for GetFSType (#2950) @blotus
• Truncate meta data (#2966) @buixor
• db config: don't exit setup if can't detect fs, improve detection for freebsd (#2963) @mmetc
• Revert "docker: pre-download all hub items and data, opt-in hub updat… (#2947) @blotus

Chore / Deps

• CI: improve code coverage report (#3029) @mmetc
• tests: replace "docker-compose" -> "docker compose" (#3000) @mmetc
• use go 1.22.3 (#2994) @mmetc
• update go-cs-lib to 0.0.11 (#2990) @mmetc
• update go dependencies (#2968) @mmetc
• plugins: use yaml.v3 (#2969) @mmetc
• use go 1.22 (#2826) @mmetc
• cscli: use yaml.v3 (#2965) @mmetc
• CI: upload coverage with token (#2958) @mmetc
• tests: bump yq, cfssl (#2952) @mmetc
• update linter list and descriptions (#2951) @mmetc
• enhance: add refactoring to governance (#2955) @LaurenceJJones

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.2-rc3

Changes

• replace log.Fatal with error return (#2996) @mmetc
• bats: clean up extra output (#3008) @mmetc
• make: remove unused targets (#2998) @mmetc
• deb,rpm: include empty directory etc/crowdsec/acquis.d (#2997) @mmetc
• CI: disable log formatting for consistency (#2989) @mmetc
• cscli: remove global dbClient (#2985) @mmetc
• enable linter "revive" (#2978) @mmetc
• minor lint/readability (#2976) @mmetc
• pkg/dumps,hubtest: use yaml.v3 (#2972) @mmetc
• cscli: avoid global vars (#2977) @mmetc
• Refact pkg/parser/node (#2953) @mmetc
• pkg/cwhub - rename methods for clarity (#2961) @mmetc
• cscli hub items: avoid global (#2960) @mmetc
• cscli config show: avoid globals, use yaml v3 (#2863) @mmetc
• pkg/database/decisiosn: remove filter parameter, which is always passed empty (#2954) @mmetc

New Features

• feat: File notification plugin (#2932) @LaurenceJJones

Improvements

• Appsec: properly populate event (#2943) @blotus
• enhance: container discovery via labels (#2959) @LaurenceJJones
• cscli: faster table rendering (#3027) @mmetc
• bats: no need for openssl, netcat; allow to prevent tests from running with a lock (#3016) @mmetc
• GetActiveDecisionsCount()and GetActiveDecisionsTimeLeft()expr helpers (#3013) @blotus
• fix: add sslmode check and append flag to conn string (#3009) @LaurenceJJones
• [cscli] Add tab completion to notifications [test, inspect] (#2765) @LaurenceJJones
• Add ability to configure channel, username, icon emoji/url in slack notification (#2975) @blesswinsamuel
• use go-cs-lib/downloader for data files, hub index, item YAML (#2926) @mmetc
• cscli support: collect profiling data and logs (#2987) @mmetc
• cscli: don't print timestamps (#2984) @mmetc
• feat: support stdout in cscli support dump (#2939) @LaurenceJJones
• cscli support: include stack traces (#2935) @mmetc

Bug Fixes

• jwt transport: fix retry on unauthorized from CAPI (#3006) @blotus
• appsec: respect on_success parameter in hooks (#3017) @blotus
• cti config: avoid nil deref (#3028) @mmetc
• appsec: add files and cookies related zones (#2956) @blotus
• simulation for custom scenarios (#3010) @mmetc
• version: write to stdout, add missing newline (#3012) @mmetc
• docker: conditionally update hub (#2948) @blotus
• LAPI: support CRL files with multiple PEM blocks (#3002) @mmetc
• CI: don't hang test "cscli machines prune" if the fixture is old (#2992) @mmetc
• db: review update timestamps, immutable columns (#2981) @mmetc
• add zfs magic for GetFSType (#2950) @blotus
• Truncate meta data (#2966) @buixor
• db config: don't exit setup if can't detect fs, improve detection for freebsd (#2963) @mmetc
• Revert "docker: pre-download all hub items and data, opt-in hub updat… (#2947) @blotus

Chore / Deps

• CI: improve code coverage report (#3029) @mmetc
• tests: replace "docker-compose" -> "docker compose" (#3000) @mmetc
• use go 1.22.3 (#2994) @mmetc
• update go-cs-lib to 0.0.11 (#2990) @mmetc
• update go dependencies (#2968) @mmetc
• plugins: use yaml.v3 (#2969) @mmetc
• use go 1.22 (#2826) @mmetc
• cscli: use yaml.v3 (#2965) @mmetc
• CI: upload coverage with token (#2958) @mmetc
• tests: bump yq, cfssl (#2952) @mmetc
• update linter list and descriptions (#2951) @mmetc
• enhance: add refactoring to governance (#2955) @LaurenceJJones

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.2-rc2

Changes

• replace log.Fatal with error return (#2996) @mmetc
• bats: clean up extra output (#3008) @mmetc
• make: remove unused targets (#2998) @mmetc
• deb,rpm: include empty directory etc/crowdsec/acquis.d (#2997) @mmetc
• CI: disable log formatting for consistency (#2989) @mmetc
• cscli: remove global dbClient (#2985) @mmetc
• enable linter "revive" (#2978) @mmetc
• minor lint/readability (#2976) @mmetc
• pkg/dumps,hubtest: use yaml.v3 (#2972) @mmetc
• cscli: avoid global vars (#2977) @mmetc
• Refact pkg/parser/node (#2953) @mmetc
• pkg/cwhub - rename methods for clarity (#2961) @mmetc
• cscli hub items: avoid global (#2960) @mmetc
• cscli config show: avoid globals, use yaml v3 (#2863) @mmetc
• pkg/database/decisiosn: remove filter parameter, which is always passed empty (#2954) @mmetc

New Features

• feat: File notification plugin (#2932) @LaurenceJJones

Improvements

• bats: no need for openssl, netcat; allow to prevent tests from running with a lock (#3016) @mmetc
• GetActiveDecisionsCount()and GetActiveDecisionsTimeLeft()expr helpers (#3013) @blotus
• fix: add sslmode check and append flag to conn string (#3009) @LaurenceJJones
• [cscli] Add tab completion to notifications [test, inspect] (#2765) @LaurenceJJones
• Add ability to configure channel, username, icon emoji/url in slack notification (#2975) @blesswinsamuel
• use go-cs-lib/downloader for data files, hub index, item YAML (#2926) @mmetc
• cscli support: collect profiling data and logs (#2987) @mmetc
• cscli: don't print timestamps (#2984) @mmetc
• feat: support stdout in cscli support dump (#2939) @LaurenceJJones
• cscli support: include stack traces (#2935) @mmetc

Bug Fixes

• appsec: add files and cookies related zones (#2956) @blotus
• simulation for custom scenarios (#3010) @mmetc
• version: write to stdout, add missing newline (#3012) @mmetc
• docker: conditionally update hub (#2948) @blotus
• LAPI: support CRL files with multiple PEM blocks (#3002) @mmetc
• CI: don't hang test "cscli machines prune" if the fixture is old (#2992) @mmetc
• db: review update timestamps, immutable columns (#2981) @mmetc
• add zfs magic for GetFSType (#2950) @blotus
• Truncate meta data (#2966) @buixor
• db config: don't exit setup if can't detect fs, improve detection for freebsd (#2963) @mmetc
• Revert "docker: pre-download all hub items and data, opt-in hub updat… (#2947) @blotus

Chore / Deps

• tests: replace "docker-compose" -> "docker compose" (#3000) @mmetc
• use go 1.22.3 (#2994) @mmetc
• update go-cs-lib to 0.0.11 (#2990) @mmetc
• update go dependencies (#2968) @mmetc
• plugins: use yaml.v3 (#2969) @mmetc
• use go 1.22 (#2826) @mmetc
• cscli: use yaml.v3 (#2965) @mmetc
• CI: upload coverage with token (#2958) @mmetc
• tests: bump yq, cfssl (#2952) @mmetc
• update linter list and descriptions (#2951) @mmetc
• enhance: add refactoring to governance (#2955) @LaurenceJJones

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.2-rc1

What's Changed

• Revert "docker: pre-download all hub items and data, opt-in hub updat… by @blotus in #2947
• enhance: add refactoring to governance by @LaurenceJJones in #2955
• update linter list and descriptions by @mmetc in #2951
• tests: bump yq, cfssl by @mmetc in #2952
• cscli support: include stack traces by @mmetc in #2935
• pkg/database/decisiosn: remove filter parameter, which is always passed empty by @mmetc in #2954
• cscli config show: avoid globals, use yaml v3 by @mmetc in #2863
• CI: upload coverage with token by @mmetc in #2958
• cscli hub items: avoid global by @mmetc in #2960
• pkg/cwhub - rename methods for clarity by @mmetc in #2961
• db config: don't exit setup if can't detect fs, improve detection for freebsd by @mmetc in #2963
• Truncate meta data by @buixor in #2966
• cscli: use yaml.v3 by @mmetc in #2965
• add zfs magic for GetFSType by @blotus in #2950
• use go 1.22 by @mmetc in #2826

Full Changelog: v1.6.1...v1.6.2-rc1

v1.6.1

Changes

• rename bouncers to remediation component in openAPI (#2936) @AlteredCoder
• docker: distribute geoip db in slim image (#2920) @mmetc

New Features

• LAPI: local api unix socket support (#2770) @mmetc

Improvements

• docker: pre-download hub items (debian image) (#2934) @mmetc
• docker: pre-download all hub items and data, opt-in hub update/upgrade (#2933) @mmetc
• add patterns_dir configuration option (#2868) @kampka
• cscli: Add user-agent to all hub requests (#2915) @mmetc
• add libinjection expr helpers (#2914) @blotus
• improve a bit cscli examples when it comes to list mgmt (#2911) @buixor
• cscli metrics: sort table order (#2908) @mmetc
• update windows pipeline (#2909) @blotus
• crowdsec: remove warning if prometheus port is taken during cold logs processing (#2857) @mmetc
• bin/crowdsec: avoid writing errors twice when log_media=stdout (#2876) @mmetc
• cron: spread server load when upgrading hub and data files (#2873) @mmetc
• lp metrics: collect datasources and console options (#2870) @mmetc
• refact pkg/apiserver (auth helpers) (#2856) @mmetc
• refact cscli (globals) (#2854) @mmetc
• add unix socket option (#2764) @LaurenceJJones
• refact pkg/apiclient (#2846) @mmetc
• refact "cscli config" (#2832) @mmetc
• Appsec unix socket (#2737) @LaurenceJJones
• cscli metrics: rename buckets -> scenarios (#2848) @mmetc
• add SetMeta and SetParsed helpers (#2845) @buixor
• implement highAvailability feature (#2506) @he2ss
• pkg/hubtest: extract methods + consistent error handling (#2756) @mmetc
• log processor: share apiclient in output goroutines (#2836) @mmetc
• bats: color formatter in CI (#2838) @mmetc
• refact "cscli console" (#2834) @mmetc
• refact "cscli notifications" (#2833) @mmetc
• refact "cscli explain" (#2835) @mmetc
• refact "cscli alerts" (#2827) @mmetc
• refact "cscli lapi" (#2825) @mmetc
• update calls to deprecated x509 methods (#2824) @mmetc
• refact cscli metric processing (#2816) @mmetc
• Dedicated whitelist metrics (#2813) @buixor
• refact "cscli" root cmd (#2811) @mmetc
• refact "cscli metrics" part 3 (#2807) @mmetc
• refact "cscli metrics" part 2 (#2806) @mmetc
• refact "cscli metrics" part 1 (#2805) @mmetc
• refact "cscli decisions"; lint (#2804) @mmetc
• refact "cscli dashboard" (#2803) @mmetc
• refact "cscli papi" (#2802) @mmetc
• refact "cscli simulation" (#2801) @mmetc
• refact "cscli " (#2782) @mmetc
• refact "cscli hub" (#2800) @mmetc
• refact "cscli alerts" (#2778) @mmetc
• refact "cscli machines" (#2777) @mmetc
• refact "cscli bouncers" (#2776) @mmetc
• CI: rename workflows, update docker build (#2798) @mmetc
• cscli: don't print use_wal warning (#2794) @mmetc
• option to override hub url template. for testers only. (#2785) @mmetc
• lint: disallow naked returns (#2771) @mmetc
• lint: enable linter "wastedassign" (#2772) @mmetc

Bug Fixes

• windows: fix data file update (remove before rename) (#2930) @mmetc
• Fix REQUEST_URI behavior (#2891 #2917) @buixor
• hub update: reload crowdsec if only data files have changed (#2912) @mmetc
• fix locking logic for HA and add list unsubscribe for PAPI (#2904) @buixor
• warn if user is using inotify to tail a symlink (#2881) @blotus
• file acquisition: don't bubble error when tailed file disappears (#2903) @mmetc
• fix rpm build (#2894) @sabban
• fix unix socket error (#2897) @LaurenceJJones
• lapi: log error "can't sinchronize with console" only if papi is enabled (#2896) @mmetc
• add cron as a suggested package for debian package (#2799) @blotus
• appsec: delete api key header before processing the request (#2890) @blotus
• acquisition : take prometheus level into account (#2885) @buixor
• Fix armhf build (#2886) @sabban
• cscli tests + fix bouncer/machine prune (#2883) @mmetc
• support both scope and scopes parameter in decisions filter (#2882) @blotus
• appsec: get the original UA from headers (#2809) @blotus
• file acquis: add mutex to protect access to the internal tail map (#2878) @blotus
• pkg/cwhub: download data assets to temporary files to avoid partial fetch (#2879) @mmetc
• auto detect if reading logs or storing sqlite db on a network share (#2241) @blotus
• cscli: hide hashed api keys (#2874) @mmetc
• fix: log stack trace while computing metrics (#2865) @mmetc
• systemd: check configuration before attempting reload (#2861) @mmetc
• appsec: split return code for bouncer and user (#2821) @blotus
• loki acquisition: set headers/basic auth if set for queryRange (#2815) @LaurenceJJones
• decouple docker image from package release (#2791) @mmetc
• update docker_start.sh (#2780) @LaurenceJJones
• fix some tests (#2775) @sabban
• armhf fix for getfstype (#2884) @sabban

Chore / Deps

• use go 1.21.9; update dependencies (#2931) @mmetc
• split & reorganize appsec tests. Add tests on existing zones (#2925) @buixor
• CI: use golangci-lint 1.57 (#2916) @mmetc
• bump github.com/docker/docker from 24.0.7+incompatible to 24.0.9+incompatible (#2913) @dependabot
• bump github.com/jackc/pgx/v4 from 4.14.1 to 4.18.2 (#2887) @dependabot
• CI: bump lint version and update configuration (#2901) @mmetc
• CI: use go 1.21.8 (#2906) @mmetc
• CI: bump github actions (#2895) @mmetc
• bump google.golang.org/protobuf from 1.31.0 to 1.33.0 (#2893) @dependabot
• bump dependencies for geoip db / lookup (#2880) @mmetc
• CI: "make generate" target; use ent 0.12.5 (#2871) @mmetc
• pkg/csconfig: use yaml.v3; deprecate yaml.v2 for new code (#2867) @mmetc
• remove dependencies on enescakir/emoji, gotest.tools (#2837) @mmetc
• re-generate ent code (#2844) @mmetc
• use go 1.21.7 (#2830) @mmetc
• update codeql action to v3 (#2822) @blotus
• CI: workflow improvements (#2792) @mmetc
• disable docker flavor test (#2783) @mmetc
• disable docker flavor test (#2781) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.1-rc4

Changes

• rename bouncers to remediation component in openAPI (#2936) @AlteredCoder
• docker: distribute geoip db in slim image (#2920) @mmetc
• armhf fix for getfstype (#2884) @sabban

New Features

• LAPI: local api unix socket support (#2770) @mmetc

Improvements

• docker: pre-download hub items (debian image) (#2934) @mmetc
• docker: pre-download all hub items and data, opt-in hub update/upgrade (#2933) @mmetc
• Add patterns_dir configuration option (#2868) @kampka
• cscli: Add user-agent to all hub requests (#2915) @mmetc
• add libinjection expr helpers (#2914) @blotus
• improve a bit cscli examples when it comes to list mgmt (#2911) @buixor
• cscli metrics: sort table order (#2908) @mmetc
• Update windows pipeline (#2909) @blotus
• crowdsec: remove warning if prometheus port is taken during cold logs processing (#2857) @mmetc
• bin/crowdsec: avoid writing errors twice when log_media=stdout (#2876) @mmetc
• cron: spread server load when upgrading hub and data files (#2873) @mmetc
• lp metrics: collect datasources and console options (#2870) @mmetc
• refact pkg/apiserver (auth helpers) (#2856) @mmetc
• refact cscli (globals) (#2854) @mmetc
• [http] Add unix socket option (#2764) @LaurenceJJones
• refact pkg/apiclient (#2846) @mmetc
• refact "cscli config" (#2832) @mmetc
• Appsec unix socket (#2737) @LaurenceJJones
• cscli metrics: rename buckets -> scenarios (#2848) @mmetc
• add SetMeta and SetParsed helpers (#2845) @buixor
• implement highAvailability feature (#2506) @he2ss
• pkg/hubtest: extract methods + consistent error handling (#2756) @mmetc
• log processor: share apiclient in output goroutines (#2836) @mmetc
• bats: color formatter in CI (#2838) @mmetc
• refact "cscli console" (#2834) @mmetc
• refact "cscli notifications" (#2833) @mmetc
• refact "cscli explain" (#2835) @mmetc
• refact "cscli alerts" (#2827) @mmetc
• refact "cscli lapi" (#2825) @mmetc
• update calls to deprecated x509 methods (#2824) @mmetc
• refact cscli metric processing (#2816) @mmetc
• dedicated whitelist metrics (#2813) @buixor
• refact "cscli" root cmd (#2811) @mmetc
• refact "cscli metrics" part 3 (#2807) @mmetc
• refact "cscli metrics" part 2 (#2806) @mmetc
• refact "cscli metrics" part 1 (#2805) @mmetc
• refact "cscli decisions"; lint (#2804) @mmetc
• refact "cscli dashboard" (#2803) @mmetc
• refact "cscli papi" (#2802) @mmetc
• refact "cscli simulation" (#2801) @mmetc
• refact "cscli " (#2782) @mmetc
• refact "cscli hub" (#2800) @mmetc
• refact "cscli alerts" (#2778) @mmetc
• refact "cscli machines" (#2777) @mmetc
• refact "cscli bouncers" (#2776) @mmetc
• CI: rename workflows, update docker build (#2798) @mmetc
• cscli: don't print use_wal warning (#2794) @mmetc
• option to override hub url template. for testers only. (#2785) @mmetc
• lint: disallow naked returns (#2771) @mmetc
• lint: enable linter "wastedassign" (#2772) @mmetc

Bug Fixes

• windows: fix data file update (remove before rename) (#2930) @mmetc
• fix REQUEST_URI behavior + fix #2891 (#2917) @buixor
• hub update: reload crowdsec if only data files have changed (#2912) @mmetc
• Fix locking logic for HA + add list unsubscribe for PAPI (#2904) @buixor
• warn if user is using inotify to tail a symlink (#2881) @blotus
• file acquisition: don't bubble error when tailed file disappears (#2903) @mmetc
• Fix rpm build (#2894) @sabban
• fix unix socket error (#2897) @LaurenceJJones
• lapi: log error "can't sinchronize with console" only if papi is enabled (#2896) @mmetc
• add cron as a suggested package for debian package (#2799) @blotus
• [appsec] delete api key header before processing the request (#2890) @blotus
• fix #2889 (#2892) @buixor
• acquisition : take prometheus level into account (#2885) @buixor
• fix armhf (#2886) @sabban
• cscli tests + fix bouncer/machine prune (#2883) @mmetc
• support both scope and scopes parameter in decisions filter (#2882) @blotus
• appsec: get the original UA from headers (#2809) @blotus
• file acquis: add mutex to protect access to the internal tail map (#2878) @blotus
• pkg/cwhub: download data assets to temporary files to avoid partial fetch (#2879) @mmetc
• auto detect if reading logs or storing sqlite db on a network share (#2241) @blotus
• cscli: hide hashed api keys (#2874) @mmetc
• fix: log stack trace while computing metrics (#2865) @mmetc
• systemd: check configuration before attempting reload (#2861) @mmetc
• appsec: split return code for bouncer and user (#2821) @blotus
• Set headers/basic auth if set for queryRange in Loki acquisition (#2815) @LaurenceJJones
• Decouple docker image from package release (#2791) @mmetc
• Update docker_start.sh (#2780) @LaurenceJJones
• fix some tests (#2775) @sabban

Chore / Deps

• use go 1.21.9; update dependencies (#2931) @mmetc
• [appsec] split & reorganize tests a bit. Add tests on existing zones (#2925) @buixor
• CI: use golangci-lint 1.57 (#2916) @mmetc
• Bump github.com/docker/docker from 24.0.7+incompatible to 24.0.9+incompatible (#2913) @dependabot
• Bump github.com/jackc/pgx/v4 from 4.14.1 to 4.18.2 (#2887) @dependabot
• CI: bump lint version and update configuration (#2901) @mmetc
• CI: use go 1.21.8 (#2906) @mmetc
• CI: bump github actions (#2895) @mmetc
• bump google.golang.org/protobuf from 1.31.0 to 1.33.0 (#2893) @dependabot
• bump dependencies for geoip db / lookup (#2880) @mmetc
• CI: "make generate" target; use ent 0.12.5 (#2871) @mmetc
• pkg/csconfig: use yaml.v3; deprecate yaml.v2 for new code (#2867) @mmetc
• remove dependencies on enescakir/emoji, gotest.tools (#2837) @mmetc
• re-generate ent code (#2844) @mmetc
• use go 1.21.7 (#2830) @mmetc
• update codeql action to v3 (#2822) @blotus
• CI: workflow improvements (#2792) @mmetc
• disable docker flavor test (#2783) @mmetc
• disable docker flavor test (#2781) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.1-rc3

Changes

• docker: distribute geoip db in slim image (#2920) @mmetc
• armhf fix for getfstype (#2884) @sabban

New Features

• LAPI: local api unix socket support (#2770) @mmetc

Improvements

• docker: pre-download hub items (debian image) (#2934) @mmetc
• docker: pre-download all hub items and data, opt-in hub update/upgrade (#2933) @mmetc
• Add patterns_dir configuration option (#2868) @kampka
• cscli: Add user-agent to all hub requests (#2915) @mmetc
• add libinjection expr helpers (#2914) @blotus
• improve a bit cscli examples when it comes to list mgmt (#2911) @buixor
• cscli metrics: sort table order (#2908) @mmetc
• Update windows pipeline (#2909) @blotus
• crowdsec: remove warning if prometheus port is taken during cold logs processing (#2857) @mmetc
• bin/crowdsec: avoid writing errors twice when log_media=stdout (#2876) @mmetc
• cron: spread server load when upgrading hub and data files (#2873) @mmetc
• lp metrics: collect datasources and console options (#2870) @mmetc
• refact pkg/apiserver (auth helpers) (#2856) @mmetc
• refact cscli (globals) (#2854) @mmetc
• [http] Add unix socket option (#2764) @LaurenceJJones
• refact pkg/apiclient (#2846) @mmetc
• refact "cscli config" (#2832) @mmetc
• Appsec unix socket (#2737) @LaurenceJJones
• cscli metrics: rename buckets -> scenarios (#2848) @mmetc
• add SetMeta and SetParsed helpers (#2845) @buixor
• implement highAvailability feature (#2506) @he2ss
• pkg/hubtest: extract methods + consistent error handling (#2756) @mmetc
• log processor: share apiclient in output goroutines (#2836) @mmetc
• bats: color formatter in CI (#2838) @mmetc
• refact "cscli console" (#2834) @mmetc
• refact "cscli notifications" (#2833) @mmetc
• refact "cscli explain" (#2835) @mmetc
• refact "cscli alerts" (#2827) @mmetc
• refact "cscli lapi" (#2825) @mmetc
• update calls to deprecated x509 methods (#2824) @mmetc
• refact cscli metric processing (#2816) @mmetc
• Dedicated whitelist metrics (#2813) @buixor
• refact "cscli" root cmd (#2811) @mmetc
• refact "cscli metrics" part 3 (#2807) @mmetc
• refact "cscli metrics" part 2 (#2806) @mmetc
• refact "cscli metrics" part 1 (#2805) @mmetc
• refact "cscli decisions"; lint (#2804) @mmetc
• refact "cscli dashboard" (#2803) @mmetc
• refact "cscli papi" (#2802) @mmetc
• refact "cscli simulation" (#2801) @mmetc
• refact "cscli " (#2782) @mmetc
• refact "cscli hub" (#2800) @mmetc
• refact "cscli alerts" (#2778) @mmetc
• refact "cscli machines" (#2777) @mmetc
• refact "cscli bouncers" (#2776) @mmetc
• CI: rename workflows, update docker build (#2798) @mmetc
• cscli: don't print use_wal warning (#2794) @mmetc
• option to override hub url template. for testers only. (#2785) @mmetc
• lint: disallow naked returns (#2771) @mmetc
• lint: enable linter "wastedassign" (#2772) @mmetc

Bug Fixes

• windows: fix data file update (remove before rename) (#2930) @mmetc
• Fix REQUEST_URI behavior + fix #2891 (#2917) @buixor
• hub update: reload crowdsec if only data files have changed (#2912) @mmetc
• Fix locking logic for HA + add list unsubscribe for PAPI (#2904) @buixor
• warn if user is using inotify to tail a symlink (#2881) @blotus
• file acquisition: don't bubble error when tailed file disappears (#2903) @mmetc
• Fix rpm build (#2894) @sabban
• fix unix socket error (#2897) @LaurenceJJones
• lapi: log error "can't sinchronize with console" only if papi is enabled (#2896) @mmetc
• add cron as a suggested package for debian package (#2799) @blotus
• [appsec] delete api key header before processing the request (#2890) @blotus
• fix #2889 (#2892) @buixor
• acquisition : take prometheus level into account (#2885) @buixor
• Fix armhf (#2886) @sabban
• cscli tests + fix bouncer/machine prune (#2883) @mmetc
• support both scope and scopes parameter in decisions filter (#2882) @blotus
• appsec: get the original UA from headers (#2809) @blotus
• file acquis: add mutex to protect access to the internal tail map (#2878) @blotus
• pkg/cwhub: download data assets to temporary files to avoid partial fetch (#2879) @mmetc
• Auto detect if reading logs or storing sqlite db on a network share (#2241) @blotus
• cscli: hide hashed api keys (#2874) @mmetc
• fix: log stack trace while computing metrics (#2865) @mmetc
• systemd: check configuration before attempting reload (#2861) @mmetc
• appsec: split return code for bouncer and user (#2821) @blotus
• [Loki] Set headers/basic auth if set for queryRange (#2815) @LaurenceJJones
• Decouple docker image from package release (#2791) @mmetc
• Update docker_start.sh (#2780) @LaurenceJJones
• fix some tests (#2775) @sabban

Chore / Deps

• use go 1.21.9; update dependencies (#2931) @mmetc
• [appsec] split & reorganize tests a bit. Add tests on existing zones (#2925) @buixor
• CI: use golangci-lint 1.57 (#2916) @mmetc
• Bump github.com/docker/docker from 24.0.7+incompatible to 24.0.9+incompatible (#2913) @dependabot
• Bump github.com/jackc/pgx/v4 from 4.14.1 to 4.18.2 (#2887) @dependabot
• CI: bump lint version and update configuration (#2901) @mmetc
• CI: use go 1.21.8 (#2906) @mmetc
• CI: bump github actions (#2895) @mmetc
• Bump google.golang.org/protobuf from 1.31.0 to 1.33.0 (#2893) @dependabot
• bump dependencies for geoip db / lookup (#2880) @mmetc
• CI: "make generate" target; use ent 0.12.5 (#2871) @mmetc
• pkg/csconfig: use yaml.v3; deprecate yaml.v2 for new code (#2867) @mmetc
• remove dependencies on enescakir/emoji, gotest.tools (#2837) @mmetc
• re-generate ent code (#2844) @mmetc
• use go 1.21.7 (#2830) @mmetc
• update codeql action to v3 (#2822) @blotus
• CI: workflow improvements (#2792) @mmetc
• disable docker flavor test (#2783) @mmetc
• disable docker flavor test (#2781) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.