# CrowdSec changelog
> A collaborative intrusion-prevention system that detects attacks and shares blocklists across its user network.
- Vendor: CrowdSec
- Category: Developer Tools
- Platforms: Windows, Linux
- Official site: https://www.crowdsec.net
- Tracked by: What's New (https://whatsnew.fyi/product/crowdsec)
- Harvested from: GitHub (crowdsecurity/crowdsec)
- Entries below: 10 (newest first)
What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.
Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.
## Releases
### v1.8.0-rc1
- Date: 2026-07-27
- Version: v1.8.0-rc1
- Original notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.8.0-rc1
- Permalink: https://whatsnew.fyi/product/crowdsec/releases/v1.8.0-rc1
- Labels: Pre-release; Platforms: Windows, Linux
- **added** — Bot detection feature for CrowdSec WAF that serves a challenge and fingerprinting page to clients, evaluating legitimacy based on challenge response and fingerprint rules
- **added** — Kubernetes log acquisition datasource to fetch logs directly from the Kubernetes API server
- **added** — HTTP helpers for the expression language to query external services from parsers and scenarios
- **added** — cs_machines_heartbeat_seconds metric
- **changed** — Improve cscli hub list functionality
- **fixed** — Allow spaces in ENROLL_INSTANCE_NAME environment variable in Docker
- **fixed** — Return nil response from API client if unable to connect to LAPI
- **fixed** — Remove error when running cscli lapi register if the credentials file does not exist
- **fixed** — Avoid panic on colliding nested crowdsec labels in Docker
- **fixed** — Prevent closing the shared acquisition output channel in syslog
- **fixed** — Track id/name pairs for all subrules in WAF
- **fixed** — Prevent fetching JWT token from query string in API server
- **fixed** — Emit overflow before pouring the next event in leaky bucket
- **fixed** — Prevent duplicate log ingestion and improve timestamp handling in Loki
- **fixed** — Use proper mutex when checking if flush can happen in database
- **fixed** — Do not flush alerts with active decisions in database
- **fixed** — Fix Distinct() panic on []string and other non-[]any slices
- **fixed** — Correct bouncer name field stripping from Docker secrets path
##### Bot detection with CrowdSec WAF
This release brings a major change to the CrowdSec WAF: a bot detection feature.
If enabled, clients will be served a challenge + fingerprinting page before accessing the website.
CrowdSec will evaluate the challenge and check the fingerprint against pre-configured rules to decide whether the client looks legitimate or not.
You can find more information about this new feature in [the documentation](https://docs.crowdsec.net/FIXME-DOC-AT-RELEASE).
Other notable changes include:
- a dedicated kubernetes datasource: crowdsec will fetch logs directly from the k8s apiserver
- new HTTP helpers for the expression language, to query external services from parsers and scenarios
##### New Features
* k8s log acquisition datasource (#4221) @sabban
* Waf challenge mode (#4268) @blotus
##### Improvements
* Add cs_machines_heartbeat_seconds metric (#4569) @kushiemoon-dev
* Cscli hub list improvements (#4567) @buixor
* expr: add HTTP helpers (#4533) @blotus
##### Bug Fixes
* fix(docker): allow spaces in ENROLL_INSTANCE_NAME (#4582) @sahilnyk
* apiclient: return nil response if we couldnt connect to LAPI (#4573) @blotus
* cscli lapi register: no error if the credentials file does not exist (#4570) @lopster568
* fix(docker): avoid panic on colliding nested crowdsec labels (#4555) @arpitjain099
* fix(syslog): don't close the shared acquisition output channel (#4553) @alxrxs
* waf: track id/name pairs for all subrules (#4505) @blotus
* apiserver: prevent from fetching JWT token from query string (#4554) @blotus
* fix(leakybucket): emit overflow before pouring the next event (#4547) @blotus
* loki: prevent duplicate log ingestion and improve timestamp handling (#4498) @Anulo2
* db: use proper mutex when checking if flush can happen (#4528) @blotus
* db: do not flush alerts with active decisions (#4527) @blotus
* Fix `Distinct()` panic on `[]string` and other non-`[]any` slices (#4543) @Synvoya
* fix(docker): bouncer name strips wrong field from Docker secrets path (#4490) @tejgokani
##### Chore / Deps
* ci(bats): fix scenarios badge color variable name (#4551) @blotus
* ci(docker): inherit secrets so the docker environment secrets resolve (#4550) @blotus
* build: use version based on latest for dev builds (#4583) @blotus
* build(deps): bump the gomod group with 19 updates (#4581) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump github.com/quic-go/quic-go from 0.57.0 to 0.59.1 (#4499) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump cryptography from 46.0.6 to 48.0.1 in /build/docker/test (#4522) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps-dev): bump ruff from 0.15.20 to 0.15.22 in /build/docker/test in the uv group across 1 directory (#4559) @[dependabot[bot]](https://github.com/apps/dependabot)
* WAF: update coraza (#4572) @blotus
* build(deps): bump the github-actions group across 1 directory with 3 updates (#4558) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump the gomod group across 1 directory with 21 updates (#4566) @[dependabot[bot]](https://github.com/apps/dependabot)
* bump fpscanner to v1.0.7 (#4557) @blotus
* update go-re2 to 1.11.0 (#4478) @blotus
* Unify sqlite build flag (#4525) @zc-devs
* fix TestCryptoObfuscationDefaultPoolSize (#4565) @buixor
* build(deps): bump the gomod group across 1 directory with 30 updates (#4542) @[dependabot[bot]](https://github.com/apps/dependabot)
* chore: delete publiccode.yml to comply with the process (#4552) @mazzma12
* build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#4549) @[dependabot[bot]](https://github.com/apps/dependabot)
* CI hardening (#4546) @blotus
* fix(docs): set pubblicode.yml to correct version (#4548) @mazzma12
* build(deps): bump cloudflare/wrangler-action from 3.15.0 to 4.0.0 (#4541) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump
_[Truncated at 4000 characters — full notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.8.0-rc1]_
### v1.7.8
- Date: 2026-05-11
- Version: v1.7.8
- Original notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.8
- Permalink: https://whatsnew.fyi/product/crowdsec/releases/v1.7.8
- Labels: Platforms: Windows, Linux
- **added** — WAF: OpenAPI schema validation
- **changed** — WAF: enforce body size limitation
- **changed** — Decision stream: move to chunked transfer by default
- **added** — cscli: add `--quick` flag to enroll command
- **changed** — Propose an alternative, cleaner configuration for appsec-config
- **fixed** — cscli metrics: don't attempt to create a DB client if there's no DB config
- **fixed** — papi: don't spam logs if chan is closed
- **fixed** — alerts: use single transaction when creating alert and all related items
- **fixed** — LAPI: enforce maximum body size for decompression
- **changed** — db: add some missing indexes
##### New Features
* WAF: OpenAPI schema validation (#4097) @blotus
##### Improvements
* WAF: enforce body size limitation (#4355) @blotus
* Decision stream: move to chunked transfer by default (#4413) @blotus
* cscli: add `--quick` flag to enroll command (#4350) @blotus
* propose an alternative, cleaner configuration for appsec-config (#4397) @buixor
##### Bug Fixes
* cscli metrics: don't attempt to create a DB client if there's no DB config (#4451) @blotus
* papi: don't spam logs if chan is closed (#4439) @blotus
* alerts: use single transaction when creating alert and all related items (#4438) @blotus
* LAPI: enforce maximum body size for decompression
##### Chore / Deps
* build(deps): bump the gomod group across 1 directory with 34 updates (#4453) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump the github-actions group with 2 updates (#4447) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump alpine from 3.21 to 3.23 in /build/docker in the docker group across 1 directory (#4441) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump the github-actions group with 7 updates (#4443) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump the uv group in /build/docker/test with 3 updates (#4442) @[dependabot[bot]](https://github.com/apps/dependabot)
* db: add some missing indexes (#4435) @blotus
* Dependencies update (#4412) @blotus
* add PAPI metrics (#4411) @blotus
* build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to 1.54.0 (#4402) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump docker/login-action from 4.0.0 to 4.1.0 (#4403) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump github.com/google/go-querystring from 1.1.0 to 1.2.0 (#4400) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump actions/setup-go from 6.3.0 to 6.4.0 (#4404) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs from 1.42.3 to 1.42.25 (#4405) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump release-drafter/release-drafter from 6.4.0 to 7.1.1 (#4381) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0 (#4388) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump schneegans/dynamic-badges-action from 1.7.0 to 1.8.0 (#4393) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0 (#4394) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump github/codeql-action from 4.33.0 to 4.35.1 (#4395) @[dependabot[bot]](https://github.com/apps/dependabot)
* update dependabot config (#4440) @blotus
* build(deps): bump requests from 2.32.5 to 2.33.0 in /build/docker/test (#4389) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump cryptography from 46.0.5 to 46.0.6 in /build/docker/test (#4391) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump pygments from 2.19.2 to 2.20.0 in /build/docker/test (#4396) @[dependabot[bot]](https://github.com/apps/dependabot)
##### Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
##### Installation
Take a look at the [installation instructions](https://doc.crowdsec.net/docs/getting_started/install_crowdsec).
### v1.7.8-rc1
- Date: 2026-05-05
- Version: v1.7.8-rc1
- Original notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.8-rc1
- Permalink: https://whatsnew.fyi/product/crowdsec/releases/v1.7.8-rc1
- Labels: Pre-release; Platforms: Windows, Linux
- **added** — WAF: OpenAPI schema validation
- **changed** — WAF: enforce body size limitation
- **changed** — Decision stream: move to chunked transfer by default
- **added** — cscli: add `--quick` flag to enroll command
- **changed** — Propose an alternative, cleaner configuration for appsec-config
- **fixed** — cscli metrics: don't attempt to create a DB client if there's no DB config
- **fixed** — papi: don't spam logs if chan is closed
- **fixed** — alerts: use single transaction when creating alert and all related items
- **changed** — db: add some missing indexes
##### New Features
* WAF: OpenAPI schema validation (#4097) @blotus
##### Improvements
* WAF: enforce body size limitation (#4355) @blotus
* Decision stream: move to chunked transfer by default (#4413) @blotus
* cscli: add `--quick` flag to enroll command (#4350) @blotus
* propose an alternative, cleaner configuration for appsec-config (#4397) @buixor
##### Bug Fixes
* cscli metrics: don't attempt to create a DB client if there's no DB config (#4451) @blotus
* papi: don't spam logs if chan is closed (#4439) @blotus
* alerts: use single transaction when creating alert and all related items (#4438) @blotus
##### Chore / Deps
* build(deps): bump the gomod group across 1 directory with 34 updates (#4453) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump the github-actions group with 2 updates (#4447) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump alpine from 3.21 to 3.23 in /build/docker in the docker group across 1 directory (#4441) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump the github-actions group with 7 updates (#4443) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump the uv group in /build/docker/test with 3 updates (#4442) @[dependabot[bot]](https://github.com/apps/dependabot)
* db: add some missing indexes (#4435) @blotus
* Dependencies update (#4412) @blotus
* add PAPI metrics (#4411) @blotus
* build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to 1.54.0 (#4402) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump docker/login-action from 4.0.0 to 4.1.0 (#4403) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump github.com/google/go-querystring from 1.1.0 to 1.2.0 (#4400) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump actions/setup-go from 6.3.0 to 6.4.0 (#4404) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs from 1.42.3 to 1.42.25 (#4405) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump release-drafter/release-drafter from 6.4.0 to 7.1.1 (#4381) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0 (#4388) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump schneegans/dynamic-badges-action from 1.7.0 to 1.8.0 (#4393) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0 (#4394) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump github/codeql-action from 4.33.0 to 4.35.1 (#4395) @[dependabot[bot]](https://github.com/apps/dependabot)
* update dependabot config (#4440) @blotus
* build(deps): bump requests from 2.32.5 to 2.33.0 in /build/docker/test (#4389) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump cryptography from 46.0.5 to 46.0.6 in /build/docker/test (#4391) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump pygments from 2.19.2 to 2.20.0 in /build/docker/test (#4396) @[dependabot[bot]](https://github.com/apps/dependabot)
##### Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
##### Installation
Take a look at the [installation instructions](https://doc.crowdsec.net/docs/getting_started/install_crowdsec).
### v1.7.7
- Date: 2026-03-30
- Version: v1.7.7
- Original notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.7
- Permalink: https://whatsnew.fyi/product/crowdsec/releases/v1.7.7
- Labels: Platforms: Windows, Linux
- **changed** — RE2 is now used by default for evaluating regexp in parsers on Linux
- **added** — WAF rules can now contain a mix of AND/OR conditions without limits
- **added** — Add new kind alert attribute to identify its source
- **added** — Add cscli allowlist import command
- **added** — Add LookupFile and FileMap expr helpers
- **changed** — Support for the HTTP_PROXY environment variable in the notification-http plugin
- **changed** — WAF exposes more transformations from coraza
- **fixed** — Fix resource leak under high load
- **fixed** — Apply allowlist items to existing decisions in batch
- **fixed** — Fix WAF tests for modsec rules generation
- **fixed** — Add file notification plugin in MSI package on Windows
- **fixed** — Fix leakroutine by calling cancel after leakroutine returns
- **fixed** — Lowercase x-ms-date header in notification-sentinel for correct HMAC
- **changed** — Support waf- alias in cscli
- **fixed** — Prevent race condition and deadlock in pkg/csplugin
- **fixed** — Set log type for caddy unit to syslog in cscli detect
- **fixed** — Format WAF output as CRS match only if anomaly score is not zero
CrowdSec 1.7.7 brings 2 major changes:
- On linux, [RE2](https://github.com/google/re2) is now used by default for evaluating regexp in parsers
- WAF rules can now contain a mix of AND/OR conditions without any limits, giving much greater flexibility when writing new rules
###### RE2 by default on linux
CrowdsSec has supported for a long time using RE2 as the regexp engine, and with this release we make it the default.
CrowdSec has always used the builtin Go regexp package, which is a Go reimplementation of the RE2 library, but with known performance limitations.
The switch to RE2 will bring significantly increased regexp performance (one of the most critical part of CrowdSec) at the cost of slightly longer regexp compilation and higher baseline memory usage.
> [!IMPORTANT]
> If you encounter any issues with the new regexp engine, you can fallback to the previous Go implementation by setting the feature flag `re2_disable_grok_support` (see [the documentation](https://docs.crowdsec.net/docs/next/configuration/feature_flags/#enabling-a-feature-flag)).
###### Other changes
Other notable changes include:
- a new `kind` attribute for alerts used to identify its source (a scenario, a WAF rule, a manual decision creation, ...)
- a new `cscli allowlist import` command
- support for the `HTTP_PROXY` environment variable in the `notification-http` plugin
- A resource leak under high load was fixed
#### Full changelog
##### New Features
* add LookupFile and FileMap expr helpers (#4372) @buixor
* waf rules: allow arbitrary mix of AND and OR conditions (#4358) @blotus
##### Improvements
* enable RE2 support by default on linux (#4386) @blotus
* cscli allowlists: add import command (#4378) @blotus
* WAF: expose more transformations from coraza (#4140) @blotus
* Add new `kind` alert attribute (#4351) @blotus
* Use environment proxy settings for notification-http (#4364) @op3
##### Bug Fixes
* allowlists: apply items to existing decisions in batch (#4095) @blotus
* waf: fix tests for modsec rules generation (#4385) @blotus
* windows: add file notification plugin in MSI package (#4367) @blotus
* leakroutine: call cancel after leakroutine returns (#4369) @blotus
* notification-sentinel: lower-case x-ms-date header for correct HMAC (#4288) @ebirn
* tests: remove temporary sqlite/plugin files from /tmp/ (#4332) @mmetc
* pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
* pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
* pkg/acquisitioncontext: minimal fix for data race in tests (#4327) @mmetc
* acquisition/file: minimal fix for data race in tests (#4326) @mmetc
* fix lint fsutil/freebsd: unnecessary conversion (#4324) @mmetc
* cscli: consistent status and usage message for unknown subcommands (#4320) @mmetc
* cscli detect: set log type for caddy unit to "syslog" (#4321) @mmetc
* CI: add published_at to version.crowdsec.net/latest (#4291) @blotus
* cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
* waf: format as CRS match only if anomaly score is not 0 (#4230) @blotus
##### Changes
* build(deps): bump cryptography from 46.0.3 to 46.0.5 in /build/docker/test (#4298) @[dependabot[bot]](https://github.com/apps/dependabot)
* support for waf- alias in cscli (#4347) @buixor
* refact pkg/dumps: reduce complexity (#4209) @mmetc
* lint: refact pkg/dumps for nilaway (#4208) @mmetc
* refact pkg/parser: redundant indirection (#4344) @mmetc
* refact pkg/parser: extract+embed NodeConfig in Node struct (#4343) @mmetc
* move calls to trace.ReportPanic() on top of goroutines (#4338) @mmetc
* pkg/csplugin: simplify notification loop; noop with empty queue (#4328) @mmetc
* pkg/parsers: light refact, remove redundant code (#4213) @mmetc
* refact cmd/crowdsec: encapsulate cache into alertBuffer (#4300) @mmetc
* cmd/notification-*: don't provide the same context twice for request (#4316) @mmetc
* don't flush 127.0.0.1 (#4315) @sabban
* clipapi
_[Truncated at 4000 characters — full notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.7]_
### v1.7.7-rc1
- Date: 2026-03-23
- Version: v1.7.7-rc1
- Original notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.7-rc1
- Permalink: https://whatsnew.fyi/product/crowdsec/releases/v1.7.7-rc1
- Labels: Pre-release; Platforms: Windows, Linux
- **added** — Add LookupFile and FileMap expr helpers
- **added** — Add LookupFile and FileMap expr helpers
- **added** — Allow arbitrary mix of AND and OR conditions in WAF rules
- **added** — Add new kind alert attribute
- **added** — Add cscli allowlists import command
- **changed** — Enable RE2 support by default on Linux
- **changed** — Expose more transformations from coraza in WAF
- **changed** — Use environment proxy settings for notification-http
- **changed** — Add support for waf- alias in cscli
- **fixed** — Apply allowlist items to existing decisions in batch
- **fixed** — Fix tests for modsec rules generation
- **fixed** — Add file notification plugin in MSI package for Windows
- **fixed** — Call cancel after leakroutine returns
- **fixed** — Lower-case x-ms-date header in notification-sentinel for correct HMAC
- **fixed** — Remove temporary sqlite and plugin files from /tmp/ in tests
- **fixed** — Fix scenario count in debug log in pkg/apiserver
- **fixed** — Prevent race condition and deadlock in pkg/csplugin
- **fixed** — Fix data race in pkg/acquisitioncontext tests
- **fixed** — Fix data race in acquisition/file tests
- **fixed** — Set log type for caddy unit to syslog in cscli detect
##### New Features
* add LookupFile and FileMap expr helpers (#4372) @buixor
* waf rules: allow arbitrary mix of AND and OR conditions (#4358) @blotus
##### Improvements
* enable RE2 support by default on linux (#4386) @blotus
* cscli allowlists: add import command (#4378) @blotus
* WAF: expose more transformations from coraza (#4140) @blotus
* Add new `kind` alert attribute (#4351) @blotus
* Use environment proxy settings for notification-http (#4364) @op3
##### Bug Fixes
* allowlists: apply items to existing decisions in batch (#4095) @blotus
* waf: fix tests for modsec rules generation (#4385) @blotus
* windows: add file notification plugin in MSI package (#4367) @blotus
* leakroutine: call cancel after leakroutine returns (#4369) @blotus
* notification-sentinel: lower-case x-ms-date header for correct HMAC (#4288) @ebirn
* tests: remove temporary sqlite/plugin files from /tmp/ (#4332) @mmetc
* pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
* pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
* pkg/acquisitioncontext: minimal fix for data race in tests (#4327) @mmetc
* acquisition/file: minimal fix for data race in tests (#4326) @mmetc
* fix lint fsutil/freebsd: unnecessary conversion (#4324) @mmetc
* cscli: consistent status and usage message for unknown subcommands (#4320) @mmetc
* cscli detect: set log type for caddy unit to "syslog" (#4321) @mmetc
* CI: add published_at to version.crowdsec.net/latest (#4291) @blotus
* cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
* waf: format as CRS match only if anomaly score is not 0 (#4230) @blotus
##### Changes
* build(deps): bump cryptography from 46.0.3 to 46.0.5 in /build/docker/test (#4298) @[dependabot[bot]](https://github.com/apps/dependabot)
* support for waf- alias in cscli (#4347) @buixor
* refact pkg/dumps: reduce complexity (#4209) @mmetc
* lint: refact pkg/dumps for nilaway (#4208) @mmetc
* refact pkg/parser: redundant indirection (#4344) @mmetc
* refact pkg/parser: extract+embed NodeConfig in Node struct (#4343) @mmetc
* move calls to trace.ReportPanic() on top of goroutines (#4338) @mmetc
* pkg/csplugin: simplify notification loop; noop with empty queue (#4328) @mmetc
* pkg/parsers: light refact, remove redundant code (#4213) @mmetc
* refact cmd/crowdsec: encapsulate cache into alertBuffer (#4300) @mmetc
* cmd/notification-*: don't provide the same context twice for request (#4316) @mmetc
* don't flush 127.0.0.1 (#4315) @sabban
* clipapi: replace tomb with errgroup (#4207) @mmetc
* refact cmd/crowdsec: remove redundant global variable (#4299) @mmetc
* refact: remove unused code in crowdsec-cli, apiserver, acquisition, database (#4304) @mmetc
* refact pkg/leakybucket: trim down redundant Leaky struct fields (#4290) @mmetc
* pkg/leakybucket: remove global bucketStore, unused parameters + tags (#4286) @mmetc
* pkg/leakybucket: remove Simulated field from Leaky, keep it in config (#4285) @mmetc
* pkg/leakybucket: extract BucketSpec from BucketFactory (#4284) @mmetc
* refact pkg/leakybucket: extract methods from LoadBucket() part 2 (#4282) @mmetc
* pkg/leakybucket: refact test loop, more explicit failures in testFile() (#4281) @mmetc
* refact pkg/leakybucket: extract methods from LoadBucket() (#4279) @mmetc
* pkg/leakybucket: replace Signal chan with explicit read/done chans (#4277) @mmetc
* pkg/leakybucket: replace waitgroups with single rwlock (#4276) @mmetc
* pkg/leakybucket: garbage collect: compare float with epsilon (#4275) @mmetc
* pkg/leakybucket: refactor tests (#4272) @mmetc
* pkg/leakybucket: replace sycn.Map with map + mutex (#4271) @mmetc
* pkg/leakybucket: replace global counter with call to bucket store (#4273) @mmetc
* pkg/leakybucket: review README.md (#4274) @mmetc
* pkg/leakybucket: encapsulate store map + add methods (#4253) @mmetc
* pkg/leakybucket: remove redundant bool var (#4252) @mmetc
* fix hub console side (#4266) @sabban
* version work
_[Truncated at 4000 characters — full notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.7-rc1]_
### v1.7.6
- Date: 2026-01-23
- Version: v1.7.6
- Original notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.6
- Permalink: https://whatsnew.fyi/product/crowdsec/releases/v1.7.6
- Labels: Platforms: Windows, Linux
- **fixed** — Fix assign overflow after parsing in cmd/crowdsec
##### Changes
##### Bug Fixes
* cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
##### Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
##### Installation
Take a look at the [installation instructions](https://doc.crowdsec.net/docs/getting_started/install_crowdsec).
### v1.7.5
- Date: 2026-01-22
- Version: v1.7.5
- Original notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.5
- Permalink: https://whatsnew.fyi/product/crowdsec/releases/v1.7.5
- Labels: Platforms: Windows, Linux
- **added** — Add ParseKVLax for flexible key-value parsing
- **added** — Support transaction id header for request tracing in appsec
- **changed** — Replace syscall with unix/windows packages where possible
- **changed** — Replace errors.Wrapf with fmt.Errorf and remove dependency on github.com/pkg/errors
- **changed** — Update golangci-lint to 2.8
- **changed** — Refactor acquisition configuration validation and tests
- **changed** — Replace global variables with injected StateDumper in pkg/leakybucket
- **changed** — Refactor notification plugins for readability and remove unnecessary pointers
- **changed** — Move directory structures debian, rpm to /build/
- **changed** — Move docker directory to /build/docker
- **changed** — Enable slicessort and stringsseq linters and modernize code
- **changed** — Build with the tag nomsgpack to reduce binary size
- **changed** — Make OneShot() context-aware for file, journalctl, and wineventlog acquisition
- **changed** — Update expr to 1.17.7
- **fixed** — Check if decision is allowlisted before adding it in papi
- **fixed** — Always reuse the stored token in CAPI
- **fixed** — Prevent duplicate send in case of transform error in pkg/acquisition
- **fixed** — Do not prepare the hub in lapi-only containers
- **fixed** — Fix build issue on freebsd and add cross platform CI build and lint target
- **fixed** — Prevent data race in appsec tests
##### Changes
* replace syscall with unix/windows packages where possible (#3032) @mmetc
* pkg/acquisition: refact configuration validation and tests (#4187) @mmetc
* pkg/acquisition: remove/restore mock datasources after usage (#4190) @mmetc
* pkg/leakybucket: replace global variables with injected StateDumper (#4197) @mmetc
* pkg/acquisition: method docs, deduplicate module names (#4192) @mmetc
* errors.Wrapf -> fmt.Errorf, remove dependency on github.com/pkg/errors (#4198) @mmetc
* update golangci-lint 2.8 (#4194) @mmetc
* notification plugins: readability / dry refact, unnecessary pointers (#4166) @mmetc
* refact acquisition/appsec: happy path (#4183) @mmetc
* pkg/acquisition/registry, move datasource registration to avoid dependency (#4189) @mmetc
* gin middleware: drop closures (#4186) @mmetc
* acquisition/journalctl: test cleanup (#4182) @mmetc
* cscli hubtest: extract method finalizeRun() (#4181) @mmetc
* refact cmd/crowdsec: remove globals ParseDump, BucketPourTrack (#4184) @mmetc
* refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
* refact pkg/leakybucket: drop closures (#4178) @mmetc
* cmd/crowdsec: rename pipeline channels (#4175) @mmetc
* move dir debian, rpm to /build/ (#4174) @mmetc
* refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
* lint: modernize - enable slicessort, stringsseq (#4162) @mmetc
* appsec: inject dependencies, avoid globals (#4148) @mmetc
* CI: move windows build scripts to ./build/windows (#4145) @mmetc
* remove obsolete readme (replaced by go generate) (#4164) @mmetc
* cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
* cmd/crowdsec: refact output.go, pour.go, parse.go (#4157) @mmetc
* refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
* drop unused method Client.IsMachineRegistered() (#4121) @mmetc
* CI: build with the tag "nomsgpack" to reduce binary size (#4151) @mmetc
* move ./docker to ./build/docker (#4130) @mmetc
* acquisition refact: context-aware OneShot(), for file + journalctl + wineventlog (#4125) @mmetc
* lint: forbidigo (no print or printf in production, prefer fprint) (#4141) @mmetc
* CI: avoid using nolint with revive (#4144) @mmetc
* Lint: add explicit per-linter settings (#4134) @mmetc
* refact pkg/acquisition: split docker.go (#4065) @mmetc
* get rid of tombs in leakybucket package (#4127) @sabban
* refact pkg/acquisition: cloudwatch configuration (#4058) @mmetc
* refact pkg/acquisition: kinesis configuration (#4059) @mmetc
* refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
* refact pkg/acquisition: http configuration (#4061) @mmetc
* refact heartbeat: context-aware method (#4126) @mmetc
* pkg/leakybucket refact: unexport, unused, explicit field names (#4123) @mmetc
* docker build: run builds on large runner (#4120) @blotus
##### Improvements
* docker datasource schema (#4206) @mmetc
* lint: enable bodyclose (ensure response bodies are closed to avoid leaks) (#4200) @mmetc
* feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007) @LaurenceJJones
* pkg/parser: avoid calling spew unless trace (#4156) @mmetc
* leakybucket: reduce error verbosity, test for misconfiguration (#4087) @mmetc
* feat(appsec): support transaction id header for request tracing (#4124) @LaurenceJJones
##### Bug Fixes
* update functional tests with time-based-bf (#4217) @mmetc
* papi: check if decision is allowlisted before adding it (#4196) @blotus
* pkg/acquisition: register mock datasource for YAML tests (#4205) @mmetc
* pkg/acquisition: prevent duplicate send in case of transform error (#4191) @mmetc
* CI fix - exit lapi during hub tests; pass container struct reference instead of slice (#4202) @mmetc
* CAPI: always reuse the stored token (#4201) @blotus
* fix #4066: don't prepare the hub in lapi-only containers (#4169) @mmetc
* fix #3991 - Acquisition config formatting in bug template (#4170) @mmetc
* fix typos in function name, comments and user-facing docs (#4154) @mmetc
* refact appsec
_[Truncated at 4000 characters — full notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.5]_
### v1.7.5-rc1
- Date: 2026-01-19
- Version: v1.7.5-rc1
- Original notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.5-rc1
- Permalink: https://whatsnew.fyi/product/crowdsec/releases/v1.7.5-rc1
- Labels: Pre-release; Platforms: Windows, Linux
- **added** — Add ParseKVLax for flexible key-value parsing
- **added** — Support transaction id header for request tracing in appsec
- **changed** — Replace syscall with unix/windows packages where possible
- **changed** — Replace errors.Wrapf with fmt.Errorf and remove dependency on github.com/pkg/errors
- **changed** — Update golangci-lint to 2.8
- **changed** — Replace global variables with injected StateDumper in pkg/leakybucket
- **changed** — Move debian and rpm directories to /build/
- **changed** — Move docker directory to /build/docker
- **changed** — Move ./mk to ./build/mk and update gmsl
- **changed** — Update expr to 1.17.7
- **changed** — Improve docker datasource schema
- **changed** — Enable bodyclose linter to ensure response bodies are closed
- **changed** — Make acquisition OneShot() method context-aware for file, journalctl, and wineventlog
- **changed** — Make heartbeat method context-aware
- **changed** — Reduce leakybucket error verbosity and test for misconfiguration
- **changed** — Avoid calling spew unless trace in pkg/parser
- **fixed** — Check if decision is allowlisted before adding it in papi
- **fixed** — Prevent duplicate send in case of transform error in pkg/acquisition
- **fixed** — Always reuse the stored token in CAPI
- **fixed** — Fix FreeBSD build issue and add cross platform CI build and lint target
##### Changes
* replace syscall with unix/windows packages where possible (#3032) @mmetc
* pkg/acquisition: refact configuration validation and tests (#4187) @mmetc
* pkg/acquisition: remove/restore mock datasources after usage (#4190) @mmetc
* pkg/leakybucket: replace global variables with injected StateDumper (#4197) @mmetc
* pkg/acquisition: method docs, deduplicate module names (#4192) @mmetc
* errors.Wrapf -> fmt.Errorf, remove dependency on github.com/pkg/errors (#4198) @mmetc
* update golangci-lint 2.8 (#4194) @mmetc
* notification plugins: readability / dry refact, unnecessary pointers (#4166) @mmetc
* refact acquisition/appsec: happy path (#4183) @mmetc
* pkg/acquisition/registry, move datasource registration to avoid dependency (#4189) @mmetc
* gin middleware: drop closures (#4186) @mmetc
* acquisition/journalctl: test cleanup (#4182) @mmetc
* cscli hubtest: extract method finalizeRun() (#4181) @mmetc
* refact cmd/crowdsec: remove globals ParseDump, BucketPourTrack (#4184) @mmetc
* refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
* refact pkg/leakybucket: drop closures (#4178) @mmetc
* cmd/crowdsec: rename pipeline channels (#4175) @mmetc
* move dir debian, rpm to /build/ (#4174) @mmetc
* refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
* lint: modernize - enable slicessort, stringsseq (#4162) @mmetc
* appsec: inject dependencies, avoid globals (#4148) @mmetc
* CI: move windows build scripts to ./build/windows (#4145) @mmetc
* remove obsolete readme (replaced by go generate) (#4164) @mmetc
* cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
* cmd/crowdsec: refact output.go, pour.go, parse.go (#4157) @mmetc
* refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
* drop unused method Client.IsMachineRegistered() (#4121) @mmetc
* CI: build with the tag "nomsgpack" to reduce binary size (#4151) @mmetc
* move ./docker to ./build/docker (#4130) @mmetc
* acquisition refact: context-aware OneShot(), for file + journalctl + wineventlog (#4125) @mmetc
* lint: forbidigo (no print or printf in production, prefer fprint) (#4141) @mmetc
* CI: avoid using nolint with revive (#4144) @mmetc
* Lint: add explicit per-linter settings (#4134) @mmetc
* refact pkg/acquisition: split docker.go (#4065) @mmetc
* get rid of tombs in leakybucket package (#4127) @sabban
* refact pkg/acquisition: cloudwatch configuration (#4058) @mmetc
* refact pkg/acquisition: kinesis configuration (#4059) @mmetc
* refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
* refact pkg/acquisition: http configuration (#4061) @mmetc
* refact heartbeat: context-aware method (#4126) @mmetc
* pkg/leakybucket refact: unexport, unused, explicit field names (#4123) @mmetc
* docker build: run builds on large runner (#4120) @blotus
##### Improvements
* docker datasource schema (#4206) @mmetc
* lint: enable bodyclose (ensure response bodies are closed to avoid leaks) (#4200) @mmetc
* feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007) @LaurenceJJones
* pkg/parser: avoid calling spew unless trace (#4156) @mmetc
* leakybucket: reduce error verbosity, test for misconfiguration (#4087) @mmetc
* feat(appsec): support transaction id header for request tracing (#4124) @LaurenceJJones
##### Bug Fixes
* papi: check if decision is allowlisted before adding it (#4196) @blotus
* pkg/acquisition: register mock datasource for YAML tests (#4205) @mmetc
* pkg/acquisition: prevent duplicate send in case of transform error (#4191) @mmetc
* CI fix - exit lapi during hub tests; pass container struct reference instead of slice (#4202) @mmetc
* CAPI: always reuse the stored token (#4201) @blotus
* fix #4066: don't prepare the hub in lapi-only containers (#4169) @mmetc
* fix #3991 - Acquisition config formatting in bug template (#4170) @mmetc
* fix typos in function name, comments and user-facing docs (#4154) @mmetc
* refact appsec tests: prevent data race (#3902) @mmetc
* fix build issue on
_[Truncated at 4000 characters — full notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.5-rc1]_
### v1.7.4
- Date: 2025-12-04
- Version: v1.7.4
- Original notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.4
- Permalink: https://whatsnew.fyi/product/crowdsec/releases/v1.7.4
- Labels: Platforms: Windows, Linux
- **added** — WAF: Add DropRequest helper to block request in hooks
- **changed** — Remove CROWDSEC_CONTAINER_ENV from docker
- **changed** — Update syslog to RestartableStreamer
- **changed** — Add log_media="syslog" option to logging configuration
- **changed** — Use backoff package to retry notifications in pkg/csplugin
- **changed** — Replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics
- **changed** — Update go-re2 to 1.10.0
- **changed** — Update coraza
- **changed** — Update go-cs-lib
- **changed** — Update docker/docker to moby/moby version docker-v29.0.0
- **changed** — Build: check make version before running Makefile
- **changed** — Build: optional pure-go sqlite driver
- **fixed** — LAPI metrics: don't use empty path as label for LAPI hits metrics
- **fixed** — Fix accessLogger setup to separate file
- **fixed** — Docker acquisition: prevent data races
- **fixed** — Fix avoidable prometheus metrics cardinality
- **fixed** — Loki acquisition: remove forgotten debug print
- **fixed** — Show certificate path in "lapi status"
- **fixed** — DecisionStream: only select required fields from the DB
##### Changes
* docker: remove CROWDSEC_CONTAINER_ENV (#4085) @mmetc
* refact cscli: define csconfig.Getter once (#4091) @mmetc
* refact load/save apic token: dependencies and sentinel errors (#4081) @mmetc
* pkg/csplugin: use backoff package to retry notifications (#3944) @mmetc
* refact pkg/database batching (#3906) @mmetc
* refact pkg/acquisition: split appsec.go (#4043) @mmetc
* refact pkg/acquisition: journalctl configuration (#4057) @mmetc
* lint revive: lower complexity threshold (#4056) @mmetc
* lint: unused parameters / 2 (#4055) @mmetc
* lint: unused parameters (#4049) @mmetc
* refact pkg/acquisition: split loki.go (#4034) @mmetc
* refact pkg/acquisition: split victorialogs.go (#4037) @mmetc
* refact pkg/acquisition: split wineventlog.go (#4036) @mmetc
* refact pkg/acquisition: split s3.go (#4035) @mmetc
* refact pkg/acquisition: split k8s_audit.go (#4033) @mmetc
* refact pkg/acquisition: split kinesis.go (#4032) @mmetc
* refact pkg/acquisition: split kafka.go (#4031) @mmetc
* refact pkg/acquisition: split cloudwatch.go (#4029) @mmetc
* refact pkg/acquisition: split http.go (#4030) @mmetc
* refactg pkg/acquisition: split file.go (#4038) @mmetc
* refact pkg/acquisition: split syslog.go (#4028) @mmetc
* papi: explicit context (#3973) @mmetc
* pkg/csplugin: remove unused function (#4019) @mmetc
* pkg/types -> new imports pt 4 (#4012) @mmetc
* pkg/types -> new imports pt 3 (#4014) @mmetc
* pkg/types -> new imports pt 2 (#4013) @mmetc
* pkg/types -> new imports pt 1 (#4011) @mmetc
* pkg/types -> pkg/{pipeline,fsutil,enrichment,logging...} (#4006) @mmetc
* CI: enable linter "protogetter" (#3995) @mmetc
* enable linters: unnecessary-format, unused-receiver (#4001) @mmetc
* refact: remove unused struct fields and params / 3; enable linter "unused" (#3334) @mmetc
##### New Features
* WAF: Add `DropRequest` helper to block request in hooks (#4016) @blotus
##### Improvements
* pkg/acquisition: update syslog to RestartableStreamer (#4040) @mmetc
* refact logging configuration; add log_media="syslog" (#4045) @mmetc
* cscli hubtest: better report docker/nuclei errors (#4052) @mmetc
* build: check make version before running Makefile (#4054) @mmetc
* pkg/acquisition: refact journalctl datasource and unified retry loop (#4023) @mmetc
* option api.server.disable_usage_metrics_export (#4021) @mmetc
* build: optional pure-go sqlite driver (#3908) @mmetc
##### Bug Fixes
* LAPI metrics: don't use empty path as label for LAPI hits metrics (#4106) @blotus
* fix accessLogger setup to separate file (#4103) @mmetc
* docker acquisition: prevent data races (#3956) @mmetc
* Fix avoidable prometheus metrics cardinality (#4080) @g00g1
* loki acquisition: remove forgotten debug print (#4062) @mmetc
* fix 2808: show certificate path in "lapi status" (#4053) @mmetc
* decisionStream: only select required fields from the DB (#4024) @blotus
##### Documentation
* docs: add public roadmap section to README.md (#4039) @mazzma12
##### Chore / Deps
* build(deps): bump github/codeql-action from 4.31.4 to 4.31.6 (#4101) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump golangci/golangci-lint-action from 9.0.0 to 9.1.0 (#4083) @[dependabot[bot]](https://github.com/apps/dependabot)
* Update go-re2 to 1.10.0 (#4020) @blotus
* waf: remove custom raw body processor and use the upstream one (#4092) @blotus
* build(deps): bump actions/setup-python from 6.0.0 to 6.1.0 (#4089) @[dependabot[bot]](https://github.com/apps/dependabot)
* update go-cs-lib (#4084) @mmetc
* update coraza (#4047) @blotus
* build(deps): bump actions/checkout from 5.0.1 to 6.0.0 (#4077) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump astral-sh/setup-uv from 7.1.3 to 7.1.4 (#4078) @[dependabot[bot]](https://github.com/apps/dependabot)
* replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932) @mmetc
* build(deps): bump ac
_[Truncated at 4000 characters — full notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.4]_
### v1.7.4-rc2
- Date: 2025-12-03
- Version: v1.7.4-rc2
- Original notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.4-rc2
- Permalink: https://whatsnew.fyi/product/crowdsec/releases/v1.7.4-rc2
- Labels: Pre-release; Platforms: Windows, Linux
- **added** — Add DropRequest helper to block request in hooks in WAF
- **changed** — Update syslog to RestartableStreamer in pkg/acquisition
- **changed** — Refactor logging configuration and add log_media="syslog" option
- **changed** — Use backoff package to retry notifications in pkg/csplugin
- **changed** — Replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics
- **changed** — Remove CROWDSEC_CONTAINER_ENV in docker
- **changed** — Update go-re2 to 1.10.0
- **changed** — Update coraza
- **changed** — Update docker/docker to moby/moby version docker-v29.0.0
- **changed** — Update go-cs-lib
- **changed** — Remove custom raw body processor and use the upstream one in WAF
- **fixed** — Fix accessLogger setup to separate file
- **fixed** — Prevent data races in docker acquisition
- **fixed** — Fix avoidable prometheus metrics cardinality
- **fixed** — Remove forgotten debug print in loki acquisition
- **fixed** — Show certificate path in lapi status command
- **fixed** — Make decisionStream only select required fields from the DB
- **added** — Add option api.server.disable_usage_metrics_export
- **changed** — Improve cscli hubtest to better report docker and nuclei errors
- **changed** — Check make version before running Makefile in build
- **changed** — Add optional pure-go sqlite driver in build
##### Changes
* docker: remove CROWDSEC_CONTAINER_ENV (#4085) @mmetc
* refact cscli: define csconfig.Getter once (#4091) @mmetc
* refact load/save apic token: dependencies and sentinel errors (#4081) @mmetc
* pkg/csplugin: use backoff package to retry notifications (#3944) @mmetc
* refact pkg/database batching (#3906) @mmetc
* refact pkg/acquisition: split appsec.go (#4043) @mmetc
* refact pkg/acquisition: journalctl configuration (#4057) @mmetc
* lint revive: lower complexity threshold (#4056) @mmetc
* lint: unused parameters / 2 (#4055) @mmetc
* lint: unused parameters (#4049) @mmetc
* refact pkg/acquisition: split loki.go (#4034) @mmetc
* refact pkg/acquisition: split victorialogs.go (#4037) @mmetc
* refact pkg/acquisition: split wineventlog.go (#4036) @mmetc
* refact pkg/acquisition: split s3.go (#4035) @mmetc
* refact pkg/acquisition: split k8s_audit.go (#4033) @mmetc
* refact pkg/acquisition: split kinesis.go (#4032) @mmetc
* refact pkg/acquisition: split kafka.go (#4031) @mmetc
* refact pkg/acquisition: split cloudwatch.go (#4029) @mmetc
* refact pkg/acquisition: split http.go (#4030) @mmetc
* refactg pkg/acquisition: split file.go (#4038) @mmetc
* refact pkg/acquisition: split syslog.go (#4028) @mmetc
* papi: explicit context (#3973) @mmetc
* pkg/csplugin: remove unused function (#4019) @mmetc
* pkg/types -> new imports pt 4 (#4012) @mmetc
* pkg/types -> new imports pt 3 (#4014) @mmetc
* pkg/types -> new imports pt 2 (#4013) @mmetc
* pkg/types -> new imports pt 1 (#4011) @mmetc
* pkg/types -> pkg/{pipeline,fsutil,enrichment,logging...} (#4006) @mmetc
* CI: enable linter "protogetter" (#3995) @mmetc
* enable linters: unnecessary-format, unused-receiver (#4001) @mmetc
* refact: remove unused struct fields and params / 3; enable linter "unused" (#3334) @mmetc
##### New Features
* WAF: Add `DropRequest` helper to block request in hooks (#4016) @blotus
##### Improvements
* pkg/acquisition: update syslog to RestartableStreamer (#4040) @mmetc
* refact logging configuration; add log_media="syslog" (#4045) @mmetc
* cscli hubtest: better report docker/nuclei errors (#4052) @mmetc
* build: check make version before running Makefile (#4054) @mmetc
* pkg/acquisition: refact journalctl datasource and unified retry loop (#4023) @mmetc
* option api.server.disable_usage_metrics_export (#4021) @mmetc
* build: optional pure-go sqlite driver (#3908) @mmetc
##### Bug Fixes
* fix accessLogger setup to separate file (#4103) @mmetc
* docker acquisition: prevent data races (#3956) @mmetc
* Fix avoidable prometheus metrics cardinality (#4080) @g00g1
* loki acquisition: remove forgotten debug print (#4062) @mmetc
* fix 2808: show certificate path in "lapi status" (#4053) @mmetc
* decisionStream: only select required fields from the DB (#4024) @blotus
##### Documentation
* docs: add public roadmap section to README.md (#4039) @mazzma12
##### Chore / Deps
* build(deps): bump github/codeql-action from 4.31.4 to 4.31.6 (#4101) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump golangci/golangci-lint-action from 9.0.0 to 9.1.0 (#4083) @[dependabot[bot]](https://github.com/apps/dependabot)
* Update go-re2 to 1.10.0 (#4020) @blotus
* waf: remove custom raw body processor and use the upstream one (#4092) @blotus
* build(deps): bump actions/setup-python from 6.0.0 to 6.1.0 (#4089) @[dependabot[bot]](https://github.com/apps/dependabot)
* update go-cs-lib (#4084) @mmetc
* update coraza (#4047) @blotus
* build(deps): bump actions/checkout from 5.0.1 to 6.0.0 (#4077) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump astral-sh/setup-uv from 7.1.3 to 7.1.4 (#4078) @[dependabot[bot]](https://github.com/apps/dependabot)
* replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932) @mmetc
* build(deps): bump actions/setup-go from 6.0.0 to 6.1.0 (#4073) @[dependabot[bot]](https://github.com/apps
_[Truncated at 4000 characters — full notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.4-rc2]_