v1.6.4

Overview

HTTP datasource

This release introduce http data source that enable crowdsec to ingest logs from an http endpoint such as Datadog or Vector.

See documentation here

Alert context appsec

This release also introduces the alert context ability when using appsec.

See related doc here

Replay evtx file support

This release allows Windows CrowdSec users to replay Winevent evtx files.

Bouncers API Key sharing

Bouncers running on different machines can now share the same API key without interfering with each other. Each bouncer will appear as bouncer_name@IP in the bouncer list. (#3323)

New Features

• add HTTP datasource (#3294) @he2ss
• Alert context appsec (#3288) @buixor
• wineventlog: add support for replaying evtx files (#3278) @blotus

Improvements

• Allow bouncers to share API keys (#3323) @blotus
• Support multiple appsec configs (#3314) @buixor
• context propagation: papi, loki (#3308) @mmetc
• Add explicit configuration for signals sharing and blocklists pull (#3277) @blotus
• loki: add no_ready_check option (#3317) @blotus
• logs and user messages: use "serialize" and "parse" instead of marshal/unmarshal (#3240) @mmetc
• context propagation: cscli {capi,lapi,papi} (#3228) @mmetc
• refact pkg/database: context propagation (start) (#3226) @mmetc

Changes

• make: improve re2/wasm check (#3335) @mmetc
• fix go version for azure pipeline (#3324) @blotus
• add go minor in go.mod (#3318) @sabban
• update checks for wrapped errors (#3117) @mmetc
• refact cscli: decisions, lapi, bouncers, machines (#3306) @mmetc
• make: remove obsolete/redundant parameters (#3304) @mmetc
• remove unused code: HandleDeletedDecisions() (#3301) @mmetc
• CI: update coverage ignore list for generated code (#3262) @mmetc
• lint/revive: check tags on non-exported struct fields (#3257) @mmetc
• context propagation: don't store ctx in api controller (#3268) @mmetc
• CI: check generated code in test workflow (#3261) @mmetc
• remove dependency from pkg/cwversion to pkg/acquisition (#3242) @mmetc
• lint/nestif: reduce hubtest complexity (#3244) @mmetc
• refact: alerts query (#3216) @mmetc
• lint: enable (some) gocritic checks (#3238) @mmetc
• enable linters: copyloopvar, intrange (#3184) @mmetc
• refact acquisition: build profiles (optionally exclude datasources from final binary) (#3217) @mmetc
• refact / split APIServer.Run() method (#3215) @mmetc
• refact cscli - don't export functions if not required (#3224) @mmetc
• refact: cscli papi (#3222) @mmetc
• refact: pkg/apiclient set and use default user agent (#3219) @mmetc

Bug Fixes

• better handle error when sending usage metrics (#3333) @blotus
• fix: Use clientIP when passing coraza (#3322) @LaurenceJJones
• cron dependency for packaging (#3331) @sabban
• fix: Add a check to prevent attempting to load a directory within patterns (#3326) @LaurenceJJones
• fix: Ansible fedora 40 to use 40 (#3327) @LaurenceJJones
• make: allow build on ubuntu 24.10 (#3311) @mmetc
• enhance: Remove if log check in one instance (#3300) @LaurenceJJones
• fix: Check if resp is nil in capi metrics and continue (#3299) @LaurenceJJones
• avoid deadlock when deleting decisions if PAPI is half configured (#3283) @blotus
• CI: delegate pipenv cache management to the setup-python action (#3243) @mmetc
• Update go-re2 (#3230) @blotus
• fix #3225: info->debug for trigger bucket overflow (#3227) @mmetc
• fix appsec/tls issues by cloning http transport (#3213) @mmetc

Chore / Deps

• enhance: add fedora 41 vagrant (#3328) @LaurenceJJones
• enhance: add opensuse leap 15 vagrant (#3329) @LaurenceJJones
• readme: update bouncers link (#3297) @laur89
• require go 1.23 (#3298) @mmetc
• Update protobufs (#3276) @mmetc
• CI: generate codecov.yml before tests (#3280) @mmetc
• update test dependencies (#3267) @mmetc
• Re-generate capi models (#3260) @mmetc
• CI: update golangci-lint to v1.61, yq to 4.44.3 (#3241) @mmetc
• context propagation: OneShotAcquisition(); enable contextcheck linter (#3285) @mmetc
• context propagation: appsec, docker, kafka, k8s datasources (#3284) @mmetc
• context propagation: StreamingAcquisition() (#3274) @mmetc
• context propagation: pkg/csplugin (#3273) @mmetc
• context propagation: pkg/apiserver (#3272) @mmetc
• context propagation: apic, unit tests (#3271) @mmetc
• context propagation: pass ctx to UpdateScenario() (#3258) @mmetc
• context propagation: pkg/database/alerts (#3252) @mmetc
• context propagation: pkg/database/{lock,decision} (#3251) @mmetc
• context propagation: pkg/database/bouncers (#3249) @mmetc
• context propagation: pkg/database/machines (#3248) @mmetc
• context propagation: pkg/database/metrics (#3247) @mmetc
• context propagation: pkg/database/config (#3246) @mmetc
• context propagation: bouncer list (#3236) @mmetc
• context propagation: pkg/database/flush (#3235) @mmetc
• context propagation: pass context to NewAPIC() (#3231) @mmetc
• context propagation: explicit ctx parameter in unit tests (#3229) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.4-rc4

Changes

• make: improve re2/wasm check (#3335) @mmetc
• fix go version for azure pipeline (#3324) @blotus
• add go minor in go.mod (#3318) @sabban
• update checks for wrapped errors (#3117) @mmetc
• refact cscli: decisions, lapi, bouncers, machines (#3306) @mmetc
• make: remove obsolete/redundant parameters (#3304) @mmetc
• remove unused code: HandleDeletedDecisions() (#3301) @mmetc
• CI: update coverage ignore list for generated code (#3262) @mmetc
• lint/revive: check tags on non-exported struct fields (#3257) @mmetc
• context propagation: don't store ctx in api controller (#3268) @mmetc
• CI: check generated code in test workflow (#3261) @mmetc
• remove dependency from pkg/cwversion to pkg/acquisition (#3242) @mmetc
• lint/nestif: reduce hubtest complexity (#3244) @mmetc
• refact: alerts query (#3216) @mmetc
• lint: enable (some) gocritic checks (#3238) @mmetc
• enable linters: copyloopvar, intrange (#3184) @mmetc
• refact acquisition: build profiles (optionally exclude datasources from final binary) (#3217) @mmetc
• refact / split APIServer.Run() method (#3215) @mmetc
• refact cscli - don't export functions if not required (#3224) @mmetc
• refact: cscli papi (#3222) @mmetc
• refact: pkg/apiclient set and use default user agent (#3219) @mmetc

New Features

• add HTTP datasource (#3294) @he2ss
• Alert context appsec (#3288) @buixor
• wineventlog: add support for replaying evtx files (#3278) @blotus

Improvements

• Allow bouncers to share API keys (#3323) @blotus
• Support multiple appsec configs (#3314) @buixor
• context propagation: papi, loki (#3308) @mmetc
• Add explicit configuration for signals sharing and blocklists pull (#3277) @blotus
• loki: add no_ready_check option (#3317) @blotus
• context propagation: OneShotAcquisition(); enable contextcheck linter (#3285) @mmetc
• context propagation: appsec, docker, kafka, k8s datasources (#3284) @mmetc
• context propagation: StreamingAcquisition() (#3274) @mmetc
• context propagation: pkg/csplugin (#3273) @mmetc
• context propagation: pkg/apiserver (#3272) @mmetc
• context propagation: apic, unit tests (#3271) @mmetc
• context propagation: pass ctx to UpdateScenario() (#3258) @mmetc
• context propagation: pkg/database/alerts (#3252) @mmetc
• context propagation: pkg/database/{lock,decision} (#3251) @mmetc
• context propagation: pkg/database/bouncers (#3249) @mmetc
• context propagation: pkg/database/machines (#3248) @mmetc
• context propagation: pkg/database/metrics (#3247) @mmetc
• context propagation: pkg/database/config (#3246) @mmetc
• context propagation: bouncer list (#3236) @mmetc
• context propagation: pkg/database/flush (#3235) @mmetc
• context propagation: pass context to NewAPIC() (#3231) @mmetc
• context propagation: explicit ctx parameter in unit tests (#3229) @mmetc
• logs and user messages: use "serialize" and "parse" instead of marshal/unmarshal (#3240) @mmetc
• context propagation: cscli {capi,lapi,papi} (#3228) @mmetc
• refact pkg/database: context propagation (start) (#3226) @mmetc

Bug Fixes

• better handle error when sending usage metrics (#3333) @blotus
• fix: Use clientIP when passing coraza (#3322) @LaurenceJJones
• cron dependency for packaging (#3331) @sabban
• fix: Add a check to prevent attempting to load a directory within patterns (#3326) @LaurenceJJones
• fix: Ansible fedora 40 to use 40 (#3327) @LaurenceJJones
• make: allow build on ubuntu 24.10 (#3311) @mmetc
• enhance: Remove if log check in one instance (#3300) @LaurenceJJones
• fix: Check if resp is nil in capi metrics and continue (#3299) @LaurenceJJones
• avoid deadlock when deleting decisions if PAPI is half configured (#3283) @blotus
• CI: delegate pipenv cache management to the setup-python action (#3243) @mmetc
• Update go-re2 (#3230) @blotus
• fix #3225: info->debug for trigger bucket overflow (#3227) @mmetc
• fix appsec/tls issues by cloning http transport (#3213) @mmetc

Chore / Deps

• enhance: add fedora 41 vagrant (#3328) @LaurenceJJones
• enhance: add opensuse leap 15 vagrant (#3329) @LaurenceJJones
• readme: update bouncers link (#3297) @laur89
• require go 1.23 (#3298) @mmetc
• Update protobufs (#3276) @mmetc
• CI: generate codecov.yml before tests (#3280) @mmetc
• update test dependencies (#3267) @mmetc
• Re-generate capi models (#3260) @mmetc
• CI: update golangci-lint to v1.61, yq to 4.44.3 (#3241) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.4-rc3

Changes

• fix go version for azure pipeline (#3324) @blotus
• add go minor in go.mod (#3318) @sabban
• update checks for wrapped errors (#3117) @mmetc
• refact cscli: decisions, lapi, bouncers, machines (#3306) @mmetc
• make: remove obsolete/redundant parameters (#3304) @mmetc
• remove unused code: HandleDeletedDecisions() (#3301) @mmetc
• CI: update coverage ignore list for generated code (#3262) @mmetc
• lint/revive: check tags on non-exported struct fields (#3257) @mmetc
• context propagation: don't store ctx in api controller (#3268) @mmetc
• CI: check generated code in test workflow (#3261) @mmetc
• remove dependency from pkg/cwversion to pkg/acquisition (#3242) @mmetc
• lint/nestif: reduce hubtest complexity (#3244) @mmetc
• refact: alerts query (#3216) @mmetc
• lint: enable (some) gocritic checks (#3238) @mmetc
• enable linters: copyloopvar, intrange (#3184) @mmetc
• refact acquisition: build profiles (optionally exclude datasources from final binary) (#3217) @mmetc
• refact / split APIServer.Run() method (#3215) @mmetc
• refact cscli - don't export functions if not required (#3224) @mmetc
• refact: cscli papi (#3222) @mmetc
• refact: pkg/apiclient set and use default user agent (#3219) @mmetc

New Features

• add HTTP datasource (#3294) @he2ss
• Alert context appsec (#3288) @buixor
• wineventlog: add support for replaying evtx files (#3278) @blotus

Improvements

• Add explicit configuration for signals sharing and blocklists pull (#3277) @blotus
• loki: add no_ready_check option (#3317) @blotus
• context propagation: OneShotAcquisition(); enable contextcheck linter (#3285) @mmetc
• context propagation: appsec, docker, kafka, k8s datasources (#3284) @mmetc
• context propagation: StreamingAcquisition() (#3274) @mmetc
• context propagation: pkg/csplugin (#3273) @mmetc
• context propagation: pkg/apiserver (#3272) @mmetc
• context propagation: apic, unit tests (#3271) @mmetc
• context propagation: pass ctx to UpdateScenario() (#3258) @mmetc
• context propagation: pkg/database/alerts (#3252) @mmetc
• context propagation: pkg/database/{lock,decision} (#3251) @mmetc
• context propagation: pkg/database/bouncers (#3249) @mmetc
• context propagation: pkg/database/machines (#3248) @mmetc
• context propagation: pkg/database/metrics (#3247) @mmetc
• context propagation: pkg/database/config (#3246) @mmetc
• context propagation: bouncer list (#3236) @mmetc
• context propagation: pkg/database/flush (#3235) @mmetc
• context propagation: pass context to NewAPIC() (#3231) @mmetc
• context propagation: explicit ctx parameter in unit tests (#3229) @mmetc
• logs and user messages: use "serialize" and "parse" instead of marshal/unmarshal (#3240) @mmetc
• context propagation: cscli {capi,lapi,papi} (#3228) @mmetc
• refact pkg/database: context propagation (start) (#3226) @mmetc

Bug Fixes

• cron dependency for packaging (#3331) @sabban
• fix: Add a check to prevent attempting to load a directory within patterns (#3326) @LaurenceJJones
• fix: Ansible fedora 40 to use 40 (#3327) @LaurenceJJones
• make: allow build on ubuntu 24.10 (#3311) @mmetc
• enhance: Remove if log check in one instance (#3300) @LaurenceJJones
• fix: Check if resp is nil in capi metrics and continue (#3299) @LaurenceJJones
• avoid deadlock when deleting decisions if PAPI is half configured (#3283) @blotus
• CI: delegate pipenv cache management to the setup-python action (#3243) @mmetc
• Update go-re2 (#3230) @blotus
• fix #3225: info->debug for trigger bucket overflow (#3227) @mmetc
• fix appsec/tls issues by cloning http transport (#3213) @mmetc

Chore / Deps

• enhance: add fedora 41 vagrant (#3328) @LaurenceJJones
• enhance: add opensuse leap 15 vagrant (#3329) @LaurenceJJones
• readme: update bouncers link (#3297) @laur89
• require go 1.23 (#3298) @mmetc
• Update protobufs (#3276) @mmetc
• CI: generate codecov.yml before tests (#3280) @mmetc
• update test dependencies (#3267) @mmetc
• Re-generate capi models (#3260) @mmetc
• CI: update golangci-lint to v1.61, yq to 4.44.3 (#3241) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.4-rc2

Changes

• fix go version for azure pipeline (#3324) @blotus
• add go minor in go.mod (#3318) @sabban
• update checks for wrapped errors (#3117) @mmetc
• refact cscli: decisions, lapi, bouncers, machines (#3306) @mmetc
• make: remove obsolete/redundant parameters (#3304) @mmetc
• remove unused code: HandleDeletedDecisions() (#3301) @mmetc
• CI: update coverage ignore list for generated code (#3262) @mmetc
• lint/revive: check tags on non-exported struct fields (#3257) @mmetc
• context propagation: don't store ctx in api controller (#3268) @mmetc
• CI: check generated code in test workflow (#3261) @mmetc
• remove dependency from pkg/cwversion to pkg/acquisition (#3242) @mmetc
• lint/nestif: reduce hubtest complexity (#3244) @mmetc
• refact: alerts query (#3216) @mmetc
• lint: enable (some) gocritic checks (#3238) @mmetc
• enable linters: copyloopvar, intrange (#3184) @mmetc
• refact acquisition: build profiles (optionally exclude datasources from final binary) (#3217) @mmetc
• refact / split APIServer.Run() method (#3215) @mmetc
• refact cscli - don't export functions if not required (#3224) @mmetc
• refact: cscli papi (#3222) @mmetc
• refact: pkg/apiclient set and use default user agent (#3219) @mmetc

New Features

• add HTTP datasource (#3294) @he2ss
• Alert context appsec (#3288) @buixor
• wineventlog: add support for replaying evtx files (#3278) @blotus

Improvements

• Add explicit configuration for signals sharing and blocklists pull (#3277) @blotus
• loki: add no_ready_check option (#3317) @blotus
• context propagation: OneShotAcquisition(); enable contextcheck linter (#3285) @mmetc
• context propagation: appsec, docker, kafka, k8s datasources (#3284) @mmetc
• context propagation: StreamingAcquisition() (#3274) @mmetc
• context propagation: pkg/csplugin (#3273) @mmetc
• context propagation: pkg/apiserver (#3272) @mmetc
• context propagation: apic, unit tests (#3271) @mmetc
• context propagation: pass ctx to UpdateScenario() (#3258) @mmetc
• context propagation: pkg/database/alerts (#3252) @mmetc
• context propagation: pkg/database/{lock,decision} (#3251) @mmetc
• context propagation: pkg/database/bouncers (#3249) @mmetc
• context propagation: pkg/database/machines (#3248) @mmetc
• context propagation: pkg/database/metrics (#3247) @mmetc
• context propagation: pkg/database/config (#3246) @mmetc
• context propagation: bouncer list (#3236) @mmetc
• context propagation: pkg/database/flush (#3235) @mmetc
• context propagation: pass context to NewAPIC() (#3231) @mmetc
• context propagation: explicit ctx parameter in unit tests (#3229) @mmetc
• logs and user messages: use "serialize" and "parse" instead of marshal/unmarshal (#3240) @mmetc
• context propagation: cscli {capi,lapi,papi} (#3228) @mmetc
• refact pkg/database: context propagation (start) (#3226) @mmetc

Bug Fixes

• make: allow build on ubuntu 24.10 (#3311) @mmetc
• enhance: Remove if log check in one instance (#3300) @LaurenceJJones
• fix: Check if resp is nil in capi metrics and continue (#3299) @LaurenceJJones
• avoid deadlock when deleting decisions if PAPI is half configured (#3283) @blotus
• CI: delegate pipenv cache management to the setup-python action (#3243) @mmetc
• Update go-re2 (#3230) @blotus
• fix #3225: info->debug for trigger bucket overflow (#3227) @mmetc
• fix appsec/tls issues by cloning http transport (#3213) @mmetc

Chore / Deps

• readme: update bouncers link (#3297) @laur89
• require go 1.23 (#3298) @mmetc
• Update protobufs (#3276) @mmetc
• CI: generate codecov.yml before tests (#3280) @mmetc
• update test dependencies (#3267) @mmetc
• Re-generate capi models (#3260) @mmetc
• CI: update golangci-lint to v1.61, yq to 4.44.3 (#3241) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.4-rc1

Changes

• update checks for wrapped errors (#3117) @mmetc
• refact cscli: decisions, lapi, bouncers, machines (#3306) @mmetc
• make: remove obsolete/redundant parameters (#3304) @mmetc
• remove unused code: HandleDeletedDecisions() (#3301) @mmetc
• CI: update coverage ignore list for generated code (#3262) @mmetc
• lint/revive: check tags on non-exported struct fields (#3257) @mmetc
• context propagation: don't store ctx in api controller (#3268) @mmetc
• CI: check generated code in test workflow (#3261) @mmetc
• remove dependency from pkg/cwversion to pkg/acquisition (#3242) @mmetc
• lint/nestif: reduce hubtest complexity (#3244) @mmetc
• refact: alerts query (#3216) @mmetc
• lint: enable (some) gocritic checks (#3238) @mmetc
• enable linters: copyloopvar, intrange (#3184) @mmetc
• refact acquisition: build profiles (optionally exclude datasources from final binary) (#3217) @mmetc
• refact / split APIServer.Run() method (#3215) @mmetc
• refact cscli - don't export functions if not required (#3224) @mmetc
• refact: cscli papi (#3222) @mmetc
• refact: pkg/apiclient set and use default user agent (#3219) @mmetc

New Features

• add HTTP datasource (#3294) @he2ss
• Alert context appsec (#3288) @buixor
• wineventlog: add support for replaying evtx files (#3278) @blotus

Improvements

• Add explicit configuration for signals sharing and blocklists pull (#3277) @blotus
• loki: add no_ready_check option (#3317) @blotus
• context propagation: OneShotAcquisition(); enable contextcheck linter (#3285) @mmetc
• context propagation: appsec, docker, kafka, k8s datasources (#3284) @mmetc
• context propagation: StreamingAcquisition() (#3274) @mmetc
• context propagation: pkg/csplugin (#3273) @mmetc
• context propagation: pkg/apiserver (#3272) @mmetc
• context propagation: apic, unit tests (#3271) @mmetc
• context propagation: pass ctx to UpdateScenario() (#3258) @mmetc
• context propagation: pkg/database/alerts (#3252) @mmetc
• context propagation: pkg/database/{lock,decision} (#3251) @mmetc
• context propagation: pkg/database/bouncers (#3249) @mmetc
• context propagation: pkg/database/machines (#3248) @mmetc
• context propagation: pkg/database/metrics (#3247) @mmetc
• context propagation: pkg/database/config (#3246) @mmetc
• context propagation: bouncer list (#3236) @mmetc
• context propagation: pkg/database/flush (#3235) @mmetc
• context propagation: pass context to NewAPIC() (#3231) @mmetc
• context propagation: explicit ctx parameter in unit tests (#3229) @mmetc
• logs and user messages: use "serialize" and "parse" instead of marshal/unmarshal (#3240) @mmetc
• context propagation: cscli {capi,lapi,papi} (#3228) @mmetc
• refact pkg/database: context propagation (start) (#3226) @mmetc

Bug Fixes

• make: allow build on ubuntu 24.10 (#3311) @mmetc
• enhance: Remove if log check in one instance (#3300) @LaurenceJJones
• fix: Check if resp is nil in capi metrics and continue (#3299) @LaurenceJJones
• avoid deadlock when deleting decisions if PAPI is half configured (#3283) @blotus
• CI: delegate pipenv cache management to the setup-python action (#3243) @mmetc
• Update go-re2 (#3230) @blotus
• fix #3225: info->debug for trigger bucket overflow (#3227) @mmetc
• fix appsec/tls issues by cloning http transport (#3213) @mmetc

Chore / Deps

• readme: update bouncers link (#3297) @laur89
• require go 1.23 (#3298) @mmetc
• Update protobufs (#3276) @mmetc
• CI: generate codecov.yml before tests (#3280) @mmetc
• update test dependencies (#3267) @mmetc
• Re-generate capi models (#3260) @mmetc
• CI: update golangci-lint to v1.61, yq to 4.44.3 (#3241) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.3

Overview

Remediation Components Stats

This release introduces the ability for remediation components to provide metrics about their efficiency, such as the amount of blocked packets/bytes (fw bouncer) or http requests (web based bouncers). Those metrics can be seen in the console (via instance card) and cscli metrics show bouncers. Currently only firewall-bouncer (0.0.30) supports it, we are working on Nginx and HaProxy remediation components.

See documentation here

Instance & Remediation Components details

To help people managing larger setups, machines and remediation components now provide more information to the Local API, such as underlying OS. This shows in cscli machines list and cscli bouncers|machines inspect.

See documentation here

Kube/Docker improvments

Various bugfixes and QoL improvements have been made towards kube and docker support, notably to make AppSec usage easier in those environments.

See documentation here

Hub API

We replacing the existing Hub with an API and 1.6.3 is the first version to rely on it. The goal is to be able to introduce new item types easily (ie. acquisition file, notification templates etc.) as well as be able to merge some massive collections (such as sigma releases) that were held back.

New Features

• Lapi detailed metrics (#2858) @mmetc
• command "cscli metrics show bouncers" (#3126) @mmetc

Improvements

• Allow auto registration of machines in LAPI (#3202) @blotus
• allow .index.json to embed item content (#3145) @mmetc
• cscli hub update: option --with-content to keep embedded items in index; use it in docker (#3192) @mmetc
• implement GetFSType on openbsd with the correct statfs struct member (#3191) @rnagy
• pkg/cwhub: cache control / send etag header from file contents, check with HEAD req (#3187) @mmetc
• cscli: add option --ignore-missing to "bouncers delete", "machines delete" (#3177) @mmetc
• enhancement: Remove useragent set by RC (#3167) @LaurenceJJones
• command "cscli doc --target /path/to/dir" (#3169) @mmetc
• Allow QueryCAPIStatus to return as well enrollment status (#3159) @buixor
• Use the new hub api url (#3132) @sabban
• perf: retrieve unsorted metrics (#3148) @mmetc
• enhance: add crowdsec user agent to cti do request func (#3130) @LaurenceJJones
• enhance: Add default_range_remediation (#3109) @LaurenceJJones
• command cscli [machines|bouncers] inspect (#3103) @mmetc
• lapi detailed metrics: API spec + models (#3100) @mmetc
• lapi detailed metrics: db schema (#3099) @mmetc
• improved tls middleware revocation checks (#3034) @mmetc
• config: expand env variables in local_api_credentials.yaml and .yaml.local (#3093) @mmetc
• enhancement: add deprecation notice to cscli dashboard prerun (#3079) @LaurenceJJones
• enhancement: add other log levels to docker start script (#3072) @LaurenceJJones
• db,lapi: round durations and timestamps to 1 second (#3015) @mmetc
• update vagrant image for fc39, fc40 and ubuntu24.04 (#3042) @sabban
• db: mark immutable columns / remove unused (#3024) @mmetc

Changes

• bats: curl helpers to mock log processors and bouncers (#3141) @mmetc
• docker: symlink all data files to the staging area (#3120) @mmetc
• refact cscli metrics: fix lines between tables, skip wrapper api (#3137) @mmetc
• usage metrics: validate maxLength for some elements (#3131) @mmetc
• remove warning "maxopenconns is 0, default to 100" (#3129) @mmetc
• revert "db: round created, updated... timestamps to 1 second" (#3127) @mmetc
• cscli machines/bouncers: dry helper code and move to cscli (#3123) @mmetc
• func tests: update curl wrapper (#3121) @mmetc
• update vagrant config for opensuse (#3119) @mmetc
• make: remove redundant go version check (#3118) @mmetc
• refact cscli metrics: split stat types to own files (#3107) @mmetc
• cscli refact: extract metrics to own package (#3106) @mmetc
• cscli refact: extract table wrapper to own package (#3105) @mmetc
• db refact: drop column machines.status (#3102) @mmetc
• refactor: prefer logrus.WithField over WithFields with a single param (#3087) @mmetc
• cscli: refactor hubtests / extract methods run(), coverage() (#3086) @mmetc
• refactor pkg/parser: extract processGrok (#3080) @mmetc
• cscli: refactor "cscli setup" to avoid global variable (#3075) @mmetc
• refactor context (cscli, pkg/database) (#3071) @mmetc
• pkg/cwhub: use explicit context for item install, upgrade (#3067) @mmetc
• pkg/cwhub: use explicit context for version check, index update (#3064) @mmetc
• add: missing go reference badge (#3066) @mazzma12
• cscli: use cmp.Or from go 1.22 (#3058) @mmetc
• refactor "cscli decisions" (#3061) @mmetc
• refactor pkg/database, pkg/models (#3022) @mmetc
• tests: log.Fatal -> return err (#3056) @mmetc
• fix tests in 01_crowdsec.bats for packages (#3054) @sabban
• CI/bats: test remediation api via socket (#3052) @mmetc
• pkg/database: refactor & rename "soft delete" to "expire" (#3025) @mmetc
• cscli: log.Fatal -> return err (#3049) @mmetc
• cscli: refactor alerts/console/decisions/setup (#3003) @mmetc
• pkg/dumps.DumpTree: split to reduce complexity (#3001) @mmetc
• pkg/database: simplify flush agents/bouncers (#3026) @mmetc

Bug Fixes

• fix appsec/tls issues by cloning http transport (#3213) @mmetc
• cscli dashboard: exit earlier on docker (#3210) @mmetc
• hide geoip related warnings (#3179) @blotus
• add missing ApiKeyAuthorizer to decisions swagger endpoint (#3178) @a-mnich
• prevent nil deref when loading cti config (#3176) @mmetc
• metrics: avoid nil deref with inactive bouncers or malformed response (#3170) @mmetc
• cscli metrics: explicit message "no bouncer metrics found" (#3155) @mmetc
• cscli/hub: don't return error if some file can't be recognized (#3150) @mmetc
• docker: make sure the sqlite db is present before changing GID (#3140) @mmetc
• Store alert remediations status in DB (#3115) @blotus
• tests: increase delta for flaky float comparison (#3122) @mmetc
• typos (#3104) @mmetc
• fix "cscli [machines|bouncers] delete" autocompletion (#3101) @mmetc
• db: don't set machine heartbeat until first connection (#3019) @mmetc
• db: don't set bouncer last_pull until first connection (#3020) @mmetc
• Typos (#3084) @mmetc
• cscli: fixed some inconsistency in returning errors (#3076) @mmetc
• cscli: fix deprecation message for "context delete" (#3078) @mmetc
• fix test 01_cscli by avoiding discrepancies in cscli explain (#3059) @sabban
• add decently new version of python for centos 7 and 8 for testing (#3053) @sabban

Chore / Deps

• update grokky and deps (#3206) @blotus
• CI: use go 1.22.6 (#3171) @mmetc
• CI: update test dependencies (#3146) @mmetc
• update expr (#3144) @blotus
• CI: update action versions (#3143) @mmetc
• CI: use go 1.22.5 (#3128) @mmetc
• deps: use go-cs-lib 0.13 (#3136) @mmetc
• CI: use go 1.22.4 (#3095) @mmetc
• CI: update golangci-lint to 1.59; enforce canonical HTTP headers (#3074) @mmetc
• deps: use ent 0.13.1 (#3023) @mmetc
• lint: dockerfiles (#3138) @mmetc
• lint: replace "github.com/pkg/errors" in apiserver (#3097) @mmetc
• lint: import statement order (#3085) @mmetc
• lint: replace gocognit with revive (#3094) @mmetc
• lint: github.com/pkg/errors -> errors (#3091) @mmetc
• lint (intrange) (#2970) @mmetc
• lint (copyloopvar) (#2971) @mmetc
• CI/lint: enable some "revive" rules (#3041) @mmetc
• lint: revive/useless-break (#3050) @mmetc
• enable linter: revive(bool-literal-in-expr) (#2983) @mmetc
• enable linter: revive (deep-exit) (#3077) @mmetc
• enable linter: revive (var-declaration) (#3069) @mmetc
• enable linter: revive (indent-error-flow) (#3068) @mmetc
• enable linter "stylecheck" (#3060) @mmetc
• lint revive(deep-exit): refactor cmd/crowdsec (#3063) @mmetc
• enable linter: revive (blank-imports) (#3062) @mmetc
• enable linter: revive (early-return) (#3051) @mmetc
• lint: enable revive/if-return, revive/error-strings (#3057) @mmetc
• lint: disable redundant linters, update revive configuration and code metrics (#3081) @mmetc
• lint: replace cyclop, gocyclo with revive; basic pkg/hubtest helper (#3065) @mmetc
• enable linter: revive (superfluous-else) (#3082) @mmetc
• reduce log verbosity, minor CI fixes, lint (#3157) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.3-rc7

Changes

• reduce log verbosity, minor CI fixes, lint (#3157) @mmetc
• docker: symlink all data files to the staging area (#3120) @mmetc
• lint: dockerfiles (#3138) @mmetc
• refact cscli metrics: fix lines between tables, skip wrapper api (#3137) @mmetc
• usage metrics: validate maxLength for some elements (#3131) @mmetc
• remove warning "maxopenconns is 0, default to 100" (#3129) @mmetc
• revert "db: round created, updated... timestamps to 1 second" (#3127) @mmetc
• cscli machines/bouncers: dry helper code and move to cscli (#3123) @mmetc
• func tests: update curl wrapper (#3121) @mmetc
• update vagrant config for opensuse (#3119) @mmetc
• make: remove redundant go version check (#3118) @mmetc
• refact cscli metrics: split stat types to own files (#3107) @mmetc
• cscli refact: extract metrics to own package (#3106) @mmetc
• cscli refact: extract table wrapper to own package (#3105) @mmetc
• db refact: drop column machines.status (#3102) @mmetc
• lint: replace "github.com/pkg/errors" in apiserver (#3097) @mmetc
• lint: import statement order (#3085) @mmetc
• lint: replace gocognit with revive (#3094) @mmetc
• lint: github.com/pkg/errors -> errors (#3091) @mmetc
• lint (intrange) (#2970) @mmetc
• lint (copyloopvar) (#2971) @mmetc
• refactor: prefer logrus.WithField over WithFields with a single param (#3087) @mmetc
• enable linter: revive (superfluous-else) (#3082) @mmetc
• cscli: refactor hubtests / extract methods run(), coverage() (#3086) @mmetc
• lint: disable redundant linters, update revive configuration and code metrics (#3081) @mmetc
• refactor pkg/parser: extract processGrok (#3080) @mmetc
• cscli: refactor "cscli setup" to avoid global variable (#3075) @mmetc
• refactor context (cscli, pkg/database) (#3071) @mmetc
• enable linter: revive (deep-exit) (#3077) @mmetc
• enable linter: revive (var-declaration) (#3069) @mmetc
• enable linter: revive (indent-error-flow) (#3068) @mmetc
• lint: replace cyclop, gocyclo with revive; basic pkg/hubtest helper (#3065) @mmetc
• pkg/cwhub: use explicit context for item install, upgrade (#3067) @mmetc
• pkg/cwhub: use explicit context for version check, index update (#3064) @mmetc
• enable linter: revive (early-return) (#3051) @mmetc
• add: missing go reference badge (#3066) @mazzma12
• lint revive(deep-exit): refactor cmd/crowdsec (#3063) @mmetc
• enable linter: revive (blank-imports) (#3062) @mmetc
• cscli: use cmp.Or from go 1.22 (#3058) @mmetc
• enable linter "stylecheck" (#3060) @mmetc
• refactor "cscli decisions" (#3061) @mmetc
• refactor pkg/database, pkg/models (#3022) @mmetc
• lint: enable revive/if-return, revive/error-strings (#3057) @mmetc
• tests: log.Fatal -> return err (#3056) @mmetc
• fix tests in 01_crowdsec.bats for packages (#3054) @sabban
• CI/bats: test remediation api via socket (#3052) @mmetc
• pkg/database: refactor & rename "soft delete" to "expire" (#3025) @mmetc
• lint: revive/useless-break (#3050) @mmetc
• enable linter: revive(bool-literal-in-expr) (#2983) @mmetc
• cscli: log.Fatal -> return err (#3049) @mmetc
• cscli: refactor alerts/console/decisions/setup (#3003) @mmetc
• CI/lint: enable some "revive" rules (#3041) @mmetc
• pkg/dumps.DumpTree: split to reduce complexity (#3001) @mmetc
• pkg/database: simplify flush agents/bouncers (#3026) @mmetc

New Features

• Lapi detailed metrics (#2858) @mmetc
• allow .index.json to embed item content (#3145) @mmetc
• bats: curl helpers to mock log processors and bouncers (#3141) @mmetc
• command "cscli metrics show bouncers" (#3126) @mmetc

Improvements

• Allow auto registration of machines in LAPI (#3202) @blotus
• cscli hub update: option --with-content to keep embedded items in index; use it in docker (#3192) @mmetc
• implement GetFSType on openbsd with the correct statfs struct member (#3191) @rnagy
• pkg/cwhub: cache control / send etag header from file contents, check with HEAD req (#3187) @mmetc
• cscli: add option --ignore-missing to "bouncers delete", "machines delete" (#3177) @mmetc
• enhancement: Remove useragent set by RC (#3167) @LaurenceJJones
• command "cscli doc --target /path/to/dir" (#3169) @mmetc
• fix #1742 : Allow QueryCAPIStatus to return as well enrollment status (#3159) @buixor
• Use the new hub api url (#3132) @sabban
• perf: retrieve unsorted metrics (#3148) @mmetc
• enhance: add crowdsec user agent to cti do request func (#3130) @LaurenceJJones
• enhance: Add default_range_remediation (#3109) @LaurenceJJones
• command cscli [machines|bouncers] inspect (#3103) @mmetc
• lapi detailed metrics: API spec + models (#3100) @mmetc
• lapi detailed metrics: db schema (#3099) @mmetc
• improved tls middleware revocation checks (#3034) @mmetc
• config: expand env variables in local_api_credentials.yaml and .yaml.local (#3093) @mmetc
• enhancement: add deprecation notice to cscli dashboard prerun (#3079) @LaurenceJJones
• enhancement: add other log levels to docker start script (#3072) @LaurenceJJones
• db,lapi: round durations and timestamps to 1 second (#3015) @mmetc
• update vagrant image for fc39, fc40 and ubuntu24.04 (#3042) @sabban
• db: mark immutable columns / remove unused (#3024) @mmetc

Bug Fixes

• fix appsec/tls issues by cloning http transport (#3213) @mmetc
• cscli dashboard: exit earlier on docker (#3210) @mmetc
• hide geoip related warnings (#3179) @blotus
• add missing ApiKeyAuthorizer to decisions swagger endpoint (#3178) @a-mnich
• prevent nil deref when loading cti config (#3176) @mmetc
• metrics: avoid nil deref with inactive bouncers or malformed response (#3170) @mmetc
• cscli metrics: explicit message "no bouncer metrics found" (#3155) @mmetc
• cscli/hub: don't return error if some file can't be recognized (#3150) @mmetc
• docker: make sure the sqlite db is present before changing GID (#3140) @mmetc
• Store alert remediations status in DB (#3115) @blotus
• tests: increase delta for flaky float comparison (#3122) @mmetc
• typos (#3104) @mmetc
• fix "cscli [machines|bouncers] delete" autocompletion (#3101) @mmetc
• db: don't set machine heartbeat until first connection (#3019) @mmetc
• db: don't set bouncer last_pull until first connection (#3020) @mmetc
• Typos (#3084) @mmetc
• cscli: fixed some inconsistency in returning errors (#3076) @mmetc
• cscli: fix deprecation message for "context delete" (#3078) @mmetc
• fix test 01_cscli by avoiding discrepancies in cscli explain (#3059) @sabban
• add decently new version of python for centos 7 and 8 for testing (#3053) @sabban

Chore / Deps

• update grokky and deps (#3206) @blotus
• CI: use go 1.22.6 (#3171) @mmetc
• CI: update test dependencies (#3146) @mmetc
• update expr (#3144) @blotus
• CI: update action versions (#3143) @mmetc
• CI: use go 1.22.5 (#3128) @mmetc
• deps: use go-cs-lib 0.13 (#3136) @mmetc
• CI: use go 1.22.4 (#3095) @mmetc
• CI: update golangci-lint to 1.59; enforce canonical HTTP headers (#3074) @mmetc
• deps: use ent 0.13.1 (#3023) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.3-rc6

Changes

• cscli refact: package clialert, clidecision (#3203) @mmetc
• refact: reduce code nesting (acquisition/file, tests) (#3200) @mmetc
• cscli refact: package cliitem (#3204) @mmetc
• cscli refact: package cli{support, machine, bouncer} (#3199) @mmetc
• cscli refact: package 'clihub' (#3198) @mmetc
• cscli refact: extract packages ask, clientinfo (#3197) @mmetc
• cscli refact: package 'clihubtest' (#3174) @mmetc
• cscli refact: notifications, simulation, papi, setup (#3190) @mmetc
• cscli refact: package 'clicapi', 'clilapi' (#3185) @mmetc
• pkg/cwhub: simpler accessor methods (#3165) @mmetc
• cscli refact: package 'cliexplain' (#3151) @mmetc
• cscli refact: package 'cliconsole' (#3149) @mmetc
• refact (nestif): reduce complexity of pkg/leakybucket (#3139) @mmetc
• CI: go - don't pin minor version (always use latest) (#3181) @mmetc
• CI: use golangci-lint 1.60 (#3180) @mmetc
• reduce log verbosity, minor CI fixes, lint (#3157) @mmetc
• docker: symlink all data files to the staging area (#3120) @mmetc
• lint: dockerfiles (#3138) @mmetc
• refact cscli metrics: fix lines between tables, skip wrapper api (#3137) @mmetc
• usage metrics: validate maxLength for some elements (#3131) @mmetc
• remove warning "maxopenconns is 0, default to 100" (#3129) @mmetc
• revert "db: round created, updated... timestamps to 1 second" (#3127) @mmetc
• cscli machines/bouncers: dry helper code and move to cscli (#3123) @mmetc
• func tests: update curl wrapper (#3121) @mmetc
• update vagrant config for opensuse (#3119) @mmetc
• make: remove redundant go version check (#3118) @mmetc
• refact cscli metrics: split stat types to own files (#3107) @mmetc
• cscli refact: extract metrics to own package (#3106) @mmetc
• cscli refact: extract table wrapper to own package (#3105) @mmetc
• db refact: drop column machines.status (#3102) @mmetc
• lint: replace "github.com/pkg/errors" in apiserver (#3097) @mmetc
• lint: import statement order (#3085) @mmetc
• lint: replace gocognit with revive (#3094) @mmetc
• lint: github.com/pkg/errors -> errors (#3091) @mmetc
• lint (intrange) (#2970) @mmetc
• lint (copyloopvar) (#2971) @mmetc
• refactor: prefer logrus.WithField over WithFields with a single param (#3087) @mmetc
• enable linter: revive (superfluous-else) (#3082) @mmetc
• cscli: refactor hubtests / extract methods run(), coverage() (#3086) @mmetc
• lint: disable redundant linters, update revive configuration and code metrics (#3081) @mmetc
• refactor pkg/parser: extract processGrok (#3080) @mmetc
• cscli: refactor "cscli setup" to avoid global variable (#3075) @mmetc
• refactor context (cscli, pkg/database) (#3071) @mmetc
• enable linter: revive (deep-exit) (#3077) @mmetc
• enable linter: revive (var-declaration) (#3069) @mmetc
• enable linter: revive (indent-error-flow) (#3068) @mmetc
• lint: replace cyclop, gocyclo with revive; basic pkg/hubtest helper (#3065) @mmetc
• pkg/cwhub: use explicit context for item install, upgrade (#3067) @mmetc
• pkg/cwhub: use explicit context for version check, index update (#3064) @mmetc
• enable linter: revive (early-return) (#3051) @mmetc
• add: missing go reference badge (#3066) @mazzma12
• lint revive(deep-exit): refactor cmd/crowdsec (#3063) @mmetc
• enable linter: revive (blank-imports) (#3062) @mmetc
• cscli: use cmp.Or from go 1.22 (#3058) @mmetc
• enable linter "stylecheck" (#3060) @mmetc
• refactor "cscli decisions" (#3061) @mmetc
• refactor pkg/database, pkg/models (#3022) @mmetc
• lint: enable revive/if-return, revive/error-strings (#3057) @mmetc
• tests: log.Fatal -> return err (#3056) @mmetc
• fix tests in 01_crowdsec.bats for packages (#3054) @sabban
• CI/bats: test remediation api via socket (#3052) @mmetc
• pkg/database: refactor & rename "soft delete" to "expire" (#3025) @mmetc
• lint: revive/useless-break (#3050) @mmetc
• enable linter: revive(bool-literal-in-expr) (#2983) @mmetc
• cscli: log.Fatal -> return err (#3049) @mmetc
• cscli: refactor alerts/console/decisions/setup (#3003) @mmetc
• CI/lint: enable some "revive" rules (#3041) @mmetc
• pkg/dumps.DumpTree: split to reduce complexity (#3001) @mmetc
• pkg/database: simplify flush agents/bouncers (#3026) @mmetc

New Features

• Lapi detailed metrics (#2858) @mmetc
• allow .index.json to embed item content (#3145) @mmetc
• bats: curl helpers to mock log processors and bouncers (#3141) @mmetc
• command "cscli metrics show bouncers" (#3126) @mmetc

Improvements

• enhance: add additional explain options to hubtest (#3162) @LaurenceJJones
• Allow auto registration of machines in LAPI (#3202) @blotus
• enhance: return an error if cscli dashboard is run within a container (#3207) @LaurenceJJones
• cscli hub update: option --with-content to keep embedded items in index; use it in docker (#3192) @mmetc
• implement GetFSType on openbsd with the correct statfs struct member (#3191) @rnagy
• pkg/cwhub: cache control / send etag header from file contents, check with HEAD req (#3187) @mmetc
• pkg/cwhub: improve support for k8s config maps with custom items (#3154) @mmetc
• cscli: add option --ignore-missing to "bouncers delete", "machines delete" (#3177) @mmetc
• enhancement: Remove useragent set by RC (#3167) @LaurenceJJones
• command "cscli doc --target /path/to/dir" (#3169) @mmetc
• fix #1742 : Allow QueryCAPIStatus to return as well enrollment status (#3159) @buixor
• Use the new hub api url (#3132) @sabban
• perf: retrieve unsorted metrics (#3148) @mmetc
• enhance: add crowdsec user agent to cti do request func (#3130) @LaurenceJJones
• enhance: Add default_range_remediation (#3109) @LaurenceJJones
• command cscli [machines|bouncers] inspect (#3103) @mmetc
• lapi detailed metrics: API spec + models (#3100) @mmetc
• lapi detailed metrics: db schema (#3099) @mmetc
• improved tls middleware revocation checks (#3034) @mmetc
• config: expand env variables in local_api_credentials.yaml and .yaml.local (#3093) @mmetc
• enhancement: add deprecation notice to cscli dashboard prerun (#3079) @LaurenceJJones
• enhancement: add other log levels to docker start script (#3072) @LaurenceJJones
• db,lapi: round durations and timestamps to 1 second (#3015) @mmetc
• update vagrant image for fc39, fc40 and ubuntu24.04 (#3042) @sabban
• db: mark immutable columns / remove unused (#3024) @mmetc

Bug Fixes

• cscli dashboard: exit earlier on docker (#3210) @mmetc
• hide geoip related warnings (#3179) @blotus
• add missing ApiKeyAuthorizer to decisions swagger endpoint (#3178) @a-mnich
• prevent nil deref when loading cti config (#3176) @mmetc
• metrics: avoid nil deref with inactive bouncers or malformed response (#3170) @mmetc
• cscli metrics: explicit message "no bouncer metrics found" (#3155) @mmetc
• cscli/hub: don't return error if some file can't be recognized (#3150) @mmetc
• docker: make sure the sqlite db is present before changing GID (#3140) @mmetc
• Store alert remediations status in DB (#3115) @blotus
• tests: increase delta for flaky float comparison (#3122) @mmetc
• typos (#3104) @mmetc
• fix "cscli [machines|bouncers] delete" autocompletion (#3101) @mmetc
• db: don't set machine heartbeat until first connection (#3019) @mmetc
• db: don't set bouncer last_pull until first connection (#3020) @mmetc
• Typos (#3084) @mmetc
• cscli: fixed some inconsistency in returning errors (#3076) @mmetc
• cscli: fix deprecation message for "context delete" (#3078) @mmetc
• fix test 01_cscli by avoiding discrepancies in cscli explain (#3059) @sabban
• add decently new version of python for centos 7 and 8 for testing (#3053) @sabban

Chore / Deps

• update grokky and deps (#3206) @blotus
• CI: use go 1.22.6 (#3171) @mmetc
• CI: update test dependencies (#3146) @mmetc
• update expr (#3144) @blotus
• CI: update action versions (#3143) @mmetc
• CI: use go 1.22.5 (#3128) @mmetc
• deps: use go-cs-lib 0.13 (#3136) @mmetc
• CI: use go 1.22.4 (#3095) @mmetc
• CI: update golangci-lint to 1.59; enforce canonical HTTP headers (#3074) @mmetc
• deps: use ent 0.13.1 (#3023) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.3-rc5

Changes

• cscli refact: package 'clihubtest' (#3174) @mmetc
• cscli refact: notifications, simulation, papi, setup (#3190) @mmetc
• cscli refact: package 'clicapi', 'clilapi' (#3185) @mmetc
• pkg/cwhub: simpler accessor methods (#3165) @mmetc
• cscli refact: package 'cliexplain' (#3151) @mmetc
• cscli refact: package 'cliconsole' (#3149) @mmetc
• refact (nestif): reduce complexity of pkg/leakybucket (#3139) @mmetc
• CI: go - don't pin minor version (always use latest) (#3181) @mmetc
• CI: use golangci-lint 1.60 (#3180) @mmetc
• reduce log verbosity, minor CI fixes, lint (#3157) @mmetc
• docker: symlink all data files to the staging area (#3120) @mmetc
• lint: dockerfiles (#3138) @mmetc
• refact cscli metrics: fix lines between tables, skip wrapper api (#3137) @mmetc
• usage metrics: validate maxLength for some elements (#3131) @mmetc
• remove warning "maxopenconns is 0, default to 100" (#3129) @mmetc
• revert "db: round created, updated... timestamps to 1 second" (#3127) @mmetc
• cscli machines/bouncers: dry helper code and move to cscli (#3123) @mmetc
• func tests: update curl wrapper (#3121) @mmetc
• update vagrant config for opensuse (#3119) @mmetc
• make: remove redundant go version check (#3118) @mmetc
• refact cscli metrics: split stat types to own files (#3107) @mmetc
• cscli refact: extract metrics to own package (#3106) @mmetc
• cscli refact: extract table wrapper to own package (#3105) @mmetc
• db refact: drop column machines.status (#3102) @mmetc
• lint: replace "github.com/pkg/errors" in apiserver (#3097) @mmetc
• lint: import statement order (#3085) @mmetc
• lint: replace gocognit with revive (#3094) @mmetc
• lint: github.com/pkg/errors -> errors (#3091) @mmetc
• lint (intrange) (#2970) @mmetc
• lint (copyloopvar) (#2971) @mmetc
• refactor: prefer logrus.WithField over WithFields with a single param (#3087) @mmetc
• enable linter: revive (superfluous-else) (#3082) @mmetc
• cscli: refactor hubtests / extract methods run(), coverage() (#3086) @mmetc
• lint: disable redundant linters, update revive configuration and code metrics (#3081) @mmetc
• refactor pkg/parser: extract processGrok (#3080) @mmetc
• cscli: refactor "cscli setup" to avoid global variable (#3075) @mmetc
• refactor context (cscli, pkg/database) (#3071) @mmetc
• enable linter: revive (deep-exit) (#3077) @mmetc
• enable linter: revive (var-declaration) (#3069) @mmetc
• enable linter: revive (indent-error-flow) (#3068) @mmetc
• lint: replace cyclop, gocyclo with revive; basic pkg/hubtest helper (#3065) @mmetc
• pkg/cwhub: use explicit context for item install, upgrade (#3067) @mmetc
• pkg/cwhub: use explicit context for version check, index update (#3064) @mmetc
• enable linter: revive (early-return) (#3051) @mmetc
• add: missing go reference badge (#3066) @mazzma12
• lint revive(deep-exit): refactor cmd/crowdsec (#3063) @mmetc
• enable linter: revive (blank-imports) (#3062) @mmetc
• cscli: use cmp.Or from go 1.22 (#3058) @mmetc
• enable linter "stylecheck" (#3060) @mmetc
• refactor "cscli decisions" (#3061) @mmetc
• refactor pkg/database, pkg/models (#3022) @mmetc
• lint: enable revive/if-return, revive/error-strings (#3057) @mmetc
• tests: log.Fatal -> return err (#3056) @mmetc
• fix tests in 01_crowdsec.bats for packages (#3054) @sabban
• CI/bats: test remediation api via socket (#3052) @mmetc
• pkg/database: refactor & rename "soft delete" to "expire" (#3025) @mmetc
• lint: revive/useless-break (#3050) @mmetc
• enable linter: revive(bool-literal-in-expr) (#2983) @mmetc
• cscli: log.Fatal -> return err (#3049) @mmetc
• cscli: refactor alerts/console/decisions/setup (#3003) @mmetc
• CI/lint: enable some "revive" rules (#3041) @mmetc
• pkg/dumps.DumpTree: split to reduce complexity (#3001) @mmetc
• pkg/database: simplify flush agents/bouncers (#3026) @mmetc

New Features

• Lapi detailed metrics (#2858) @mmetc
• allow .index.json to embed item content (#3145) @mmetc
• bats: curl helpers to mock log processors and bouncers (#3141) @mmetc
• command "cscli metrics show bouncers" (#3126) @mmetc

Improvements

• cscli hub update: option --with-content to keep embedded items in index; use it in docker (#3192) @mmetc
• implement GetFSType on openbsd with the correct statfs struct member (#3191) @rnagy
• pkg/cwhub: cache control / send etag header from file contents, check with HEAD req (#3187) @mmetc
• pkg/cwhub: improve support for k8s config maps with custom items (#3154) @mmetc
• cscli: add option --ignore-missing to "bouncers delete", "machines delete" (#3177) @mmetc
• enhancement: Remove useragent set by RC (#3167) @LaurenceJJones
• command "cscli doc --target /path/to/dir" (#3169) @mmetc
• fix #1742 : Allow QueryCAPIStatus to return as well enrollment status (#3159) @buixor
• Use the new hub api url (#3132) @sabban
• perf: retrieve unsorted metrics (#3148) @mmetc
• enhance: add crowdsec user agent to cti do request func (#3130) @LaurenceJJones
• enhance: Add default_range_remediation (#3109) @LaurenceJJones
• command cscli [machines|bouncers] inspect (#3103) @mmetc
• lapi detailed metrics: API spec + models (#3100) @mmetc
• lapi detailed metrics: db schema (#3099) @mmetc
• improved tls middleware revocation checks (#3034) @mmetc
• config: expand env variables in local_api_credentials.yaml and .yaml.local (#3093) @mmetc
• enhancement: add deprecation notice to cscli dashboard prerun (#3079) @LaurenceJJones
• enhancement: add other log levels to docker start script (#3072) @LaurenceJJones
• db,lapi: round durations and timestamps to 1 second (#3015) @mmetc
• update vagrant image for fc39, fc40 and ubuntu24.04 (#3042) @sabban
• db: mark immutable columns / remove unused (#3024) @mmetc

Bug Fixes

• hide geoip related warnings (#3179) @blotus
• add missing ApiKeyAuthorizer to decisions swagger endpoint (#3178) @a-mnich
• prevent nil deref when loading cti config (#3176) @mmetc
• metrics: avoid nil deref with inactive bouncers or malformed response (#3170) @mmetc
• cscli metrics: explicit message "no bouncer metrics found" (#3155) @mmetc
• cscli/hub: don't return error if some file can't be recognized (#3150) @mmetc
• docker: make sure the sqlite db is present before changing GID (#3140) @mmetc
• Store alert remediations status in DB (#3115) @blotus
• tests: increase delta for flaky float comparison (#3122) @mmetc
• typos (#3104) @mmetc
• fix "cscli [machines|bouncers] delete" autocompletion (#3101) @mmetc
• db: don't set machine heartbeat until first connection (#3019) @mmetc
• db: don't set bouncer last_pull until first connection (#3020) @mmetc
• Typos (#3084) @mmetc
• cscli: fixed some inconsistency in returning errors (#3076) @mmetc
• cscli: fix deprecation message for "context delete" (#3078) @mmetc
• fix test 01_cscli by avoiding discrepancies in cscli explain (#3059) @sabban
• add decently new version of python for centos 7 and 8 for testing (#3053) @sabban

Chore / Deps

• CI: use go 1.22.6 (#3171) @mmetc
• CI: update test dependencies (#3146) @mmetc
• update expr (#3144) @blotus
• CI: update action versions (#3143) @mmetc
• CI: use go 1.22.5 (#3128) @mmetc
• deps: use go-cs-lib 0.13 (#3136) @mmetc
• CI: use go 1.22.4 (#3095) @mmetc
• CI: update golangci-lint to 1.59; enforce canonical HTTP headers (#3074) @mmetc
• deps: use ent 0.13.1 (#3023) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.6.3-rc4

Changes

• reduce log verbosity, minor CI fixes, lint (#3157) @mmetc
• docker: symlink all data files to the staging area (#3120) @mmetc
• lint: dockerfiles (#3138) @mmetc
• refact cscli metrics: fix lines between tables, skip wrapper api (#3137) @mmetc
• usage metrics: validate maxLength for some elements (#3131) @mmetc
• remove warning "maxopenconns is 0, default to 100" (#3129) @mmetc
• revert "db: round created, updated... timestamps to 1 second" (#3127) @mmetc
• cscli machines/bouncers: dry helper code and move to cscli (#3123) @mmetc
• func tests: update curl wrapper (#3121) @mmetc
• update vagrant config for opensuse (#3119) @mmetc
• make: remove redundant go version check (#3118) @mmetc
• refact cscli metrics: split stat types to own files (#3107) @mmetc
• cscli refact: extract metrics to own package (#3106) @mmetc
• cscli refact: extract table wrapper to own package (#3105) @mmetc
• db refact: drop column machines.status (#3102) @mmetc
• lint: replace "github.com/pkg/errors" in apiserver (#3097) @mmetc
• lint: import statement order (#3085) @mmetc
• lint: replace gocognit with revive (#3094) @mmetc
• lint: github.com/pkg/errors -> errors (#3091) @mmetc
• lint (intrange) (#2970) @mmetc
• lint (copyloopvar) (#2971) @mmetc
• refactor: prefer logrus.WithField over WithFields with a single param (#3087) @mmetc
• enable linter: revive (superfluous-else) (#3082) @mmetc
• cscli: refactor hubtests / extract methods run(), coverage() (#3086) @mmetc
• lint: disable redundant linters, update revive configuration and code metrics (#3081) @mmetc
• refactor pkg/parser: extract processGrok (#3080) @mmetc
• cscli: refactor "cscli setup" to avoid global variable (#3075) @mmetc
• refactor context (cscli, pkg/database) (#3071) @mmetc
• enable linter: revive (deep-exit) (#3077) @mmetc
• enable linter: revive (var-declaration) (#3069) @mmetc
• enable linter: revive (indent-error-flow) (#3068) @mmetc
• lint: replace cyclop, gocyclo with revive; basic pkg/hubtest helper (#3065) @mmetc
• pkg/cwhub: use explicit context for item install, upgrade (#3067) @mmetc
• pkg/cwhub: use explicit context for version check, index update (#3064) @mmetc
• enable linter: revive (early-return) (#3051) @mmetc
• add: missing go reference badge (#3066) @mazzma12
• lint revive(deep-exit): refactor cmd/crowdsec (#3063) @mmetc
• enable linter: revive (blank-imports) (#3062) @mmetc
• cscli: use cmp.Or from go 1.22 (#3058) @mmetc
• enable linter "stylecheck" (#3060) @mmetc
• refactor "cscli decisions" (#3061) @mmetc
• refactor pkg/database, pkg/models (#3022) @mmetc
• lint: enable revive/if-return, revive/error-strings (#3057) @mmetc
• tests: log.Fatal -> return err (#3056) @mmetc
• fix tests in 01_crowdsec.bats for packages (#3054) @sabban
• CI/bats: test remediation api via socket (#3052) @mmetc
• pkg/database: refactor & rename "soft delete" to "expire" (#3025) @mmetc
• lint: revive/useless-break (#3050) @mmetc
• enable linter: revive(bool-literal-in-expr) (#2983) @mmetc
• cscli: log.Fatal -> return err (#3049) @mmetc
• cscli: refactor alerts/console/decisions/setup (#3003) @mmetc
• CI/lint: enable some "revive" rules (#3041) @mmetc
• pkg/dumps.DumpTree: split to reduce complexity (#3001) @mmetc
• pkg/database: simplify flush agents/bouncers (#3026) @mmetc

New Features

• Lapi detailed metrics (#2858) @mmetc
• allow .index.json to embed item content (#3145) @mmetc
• bats: curl helpers to mock log processors and bouncers (#3141) @mmetc
• command "cscli metrics show bouncers" (#3126) @mmetc

Improvements

• cscli: add option --ignore-missing to "bouncers delete", "machines delete" (#3177) @mmetc
• enhancement: Remove useragent set by RC (#3167) @LaurenceJJones
• command "cscli doc --target /path/to/dir" (#3169) @mmetc
• fix #1742 : Allow QueryCAPIStatus to return as well enrollment status (#3159) @buixor
• Use the new hub api url (#3132) @sabban
• perf: retrieve unsorted metrics (#3148) @mmetc
• enhance: add crowdsec user agent to cti do request func (#3130) @LaurenceJJones
• enhance: Add default_range_remediation (#3109) @LaurenceJJones
• command cscli [machines|bouncers] inspect (#3103) @mmetc
• lapi detailed metrics: API spec + models (#3100) @mmetc
• lapi detailed metrics: db schema (#3099) @mmetc
• improved tls middleware revocation checks (#3034) @mmetc
• config: expand env variables in local_api_credentials.yaml and .yaml.local (#3093) @mmetc
• enhancement: add deprecation notice to cscli dashboard prerun (#3079) @LaurenceJJones
• enhancement: add other log levels to docker start script (#3072) @LaurenceJJones
• db,lapi: round durations and timestamps to 1 second (#3015) @mmetc
• update vagrant image for fc39, fc40 and ubuntu24.04 (#3042) @sabban
• db: mark immutable columns / remove unused (#3024) @mmetc

Bug Fixes

• hide geoip related warnings (#3179) @blotus
• add missing ApiKeyAuthorizer to decisions swagger endpoint (#3178) @a-mnich
• prevent nil deref when loading cti config (#3176) @mmetc
• metrics: avoid nil deref with inactive bouncers or malformed response (#3170) @mmetc
• cscli metrics: explicit message "no bouncer metrics found" (#3155) @mmetc
• cscli/hub: don't return error if some file can't be recognized (#3150) @mmetc
• docker: make sure the sqlite db is present before changing GID (#3140) @mmetc
• Store alert remediations status in DB (#3115) @blotus
• tests: increase delta for flaky float comparison (#3122) @mmetc
• typos (#3104) @mmetc
• fix "cscli [machines|bouncers] delete" autocompletion (#3101) @mmetc
• db: don't set machine heartbeat until first connection (#3019) @mmetc
• db: don't set bouncer last_pull until first connection (#3020) @mmetc
• Typos (#3084) @mmetc
• cscli: fixed some inconsistency in returning errors (#3076) @mmetc
• cscli: fix deprecation message for "context delete" (#3078) @mmetc
• fix test 01_cscli by avoiding discrepancies in cscli explain (#3059) @sabban
• add decently new version of python for centos 7 and 8 for testing (#3053) @sabban

Chore / Deps

• CI: use go 1.22.6 (#3171) @mmetc
• CI: update test dependencies (#3146) @mmetc
• update expr (#3144) @blotus
• CI: update action versions (#3143) @mmetc
• CI: use go 1.22.5 (#3128) @mmetc
• deps: use go-cs-lib 0.13 (#3136) @mmetc
• CI: use go 1.22.4 (#3095) @mmetc
• CI: update golangci-lint to 1.59; enforce canonical HTTP headers (#3074) @mmetc
• deps: use ent 0.13.1 (#3023) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.