Attributed metadata history

0.45.0

Packages Download rpm-x86_64 deb-x86_64 tgz-x86_64 tgz-static-x86_64 rpm-aarch64 deb-aarch64 tgz-aarch64 Images docker pull docker.io/falcosecurity/falco:0.45.0 docker pull public.ecr.aws/falcosecurity/falco:0.45.0 docker pull docker.io/falcosecurity/falco-driver-loader:0.45.0 docker pull docker.io/falcosecurity/falco-driver-loader:0.45.0-buster docker pull docker.io/falcosecurity/falco:0.45.0-debian v0.45.0 Released on 2026-09-21 Breaking Changes ⚠️ feat(userspace)!: evaluate rule conditions on raw field bytes (invalid and non-printable UTF-8 sequences are now matchable with string operators, single bytes with the new \xHH escape sequence), let regex operate on sanitized input, and escape non-printable characters / replace invalid UTF-8 sequences at output encoding time; FALCO_ENGINE_VERSION bumped from 0.62.0 to 0.63.0; rules that matched the replacement character with non-regex operators must be reviewed [#3942] - @ekoops Major Changes new(chart): add serviceAccount.labels to set custom labels on the ServiceAccount [#3946] - @Goutham-Annem feat(falco): Expose reload status through GET /reload and add optional reload control over a protected Unix socket on Linux. Preserve SIGHUP reception and pending requests across reloads. [#4005] - @c2ndev feat(userspace/falco): suggest --dry-run when --validate receives a Falco configuration file [#3947] - @AkashKumar7902 Minor Changes update(build): bump falcoctl to 0.14.2 [#3996] - @leogr update(chart): bump the falcosidekick subchart constraint to 0.14.* and the falco-talon subchart constraint to 0.4.* [#3990] - @leogr chore(userspace/falco): drop the container_engines leftovers from the configuration JSON schema; configurations still setting this key now log a schema validation warning at startup [#3924] - @ekoops Bug Fixes fix(falco): no unsupported syscalls warning is printed anymore when replaying a capture [#4003] - @leogr fix(falco): the unsupported syscalls warning now points to base_syscalls.all instead of the removed -A flag [#4001] - @leogr fix(packaging): restore Falco services and persistent kernel modules after upgrades, migrate package-default driver pins, and clean up package-created systemd state on removal [#3994] - @leogr fix(chart): always mount an emptyDir at /etc/falco/config.d, and bump the default falcoctl image to 0.14.1, the container plugin to 0.7.4, and the k8smeta plugin to 0.4.2 [#3984] - @leogr fix(chart): mount the container engine socket directories instead of the socket files, so Falco keeps working after a container runtime restart [#3978] - @leogr fix(chart): support DaemonSet revision history limits and honor an explicit zero for both DaemonSet and Deployment controllers. [#3931] - @Goutham-Annem fix(chart): do not render the falcoctl config volume when falcoctl artifact install and follow are disabled [#3894] - @immanuwell fix(engine): falco --list no longer incorrectly labels the evt field class with a specific event source [#3936] - @Wahid7852 fix(cmake): add support for 64K kernel page to jemalloc on aarch64 [#3970] - @lekanjava fix(userspace): open the pidfile with O_NOFOLLOW to prevent a symlink TOCTOU when the pidfile path is in an attacker-writable directory. The pidfile content now ends with a trailing newline [#3871] - @alexmchughdev fix(chart): correct the inverted priority level mappings in the Grafana dashboard, so severity labels match Falco's numeric priorities (0=emergency ... 7=debug) [#3932] - @Goutham-Annem fix(engine): correctly match wildcard patterns when the literal segment that follows a * appears more than once in the input (e.g. *.yaml against backup.yaml.yaml, or wildcard enable/disable of rule names whose names repeat a literal segment). [#3913] - @tejgokani fix(userspace/falco): use the absolute modprobe path instead of a PATH lookup when falling back to loading the kernel module (untrusted search path, CWE-426) [#3943] - @BoxStrikesTeam fix: serve SIGHUP-triggered h

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.