# CrowdSec v1.7.5

- Product: CrowdSec (https://whatsnew.fyi/product/crowdsec)
- Vendor: CrowdSec
- Date: 2026-01-22
- Version: v1.7.5
- Original notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.5
- Permalink: https://whatsnew.fyi/product/crowdsec/releases/v1.7.5
- Labels: Platforms: Windows, Linux

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add ParseKVLax for flexible key-value parsing
- **added** — Support transaction id header for request tracing in appsec
- **changed** — Replace syscall with unix/windows packages where possible
- **changed** — Replace errors.Wrapf with fmt.Errorf and remove dependency on github.com/pkg/errors
- **changed** — Update golangci-lint to 2.8
- **changed** — Refactor acquisition configuration validation and tests
- **changed** — Replace global variables with injected StateDumper in pkg/leakybucket
- **changed** — Refactor notification plugins for readability and remove unnecessary pointers
- **changed** — Move directory structures debian, rpm to /build/
- **changed** — Move docker directory to /build/docker
- **changed** — Enable slicessort and stringsseq linters and modernize code
- **changed** — Build with the tag nomsgpack to reduce binary size
- **changed** — Make OneShot() context-aware for file, journalctl, and wineventlog acquisition
- **changed** — Update expr to 1.17.7
- **fixed** — Check if decision is allowlisted before adding it in papi
- **fixed** — Always reuse the stored token in CAPI
- **fixed** — Prevent duplicate send in case of transform error in pkg/acquisition
- **fixed** — Do not prepare the hub in lapi-only containers
- **fixed** — Fix build issue on freebsd and add cross platform CI build and lint target
- **fixed** — Prevent data race in appsec tests

##### Changes

* replace syscall with unix/windows packages where possible (#3032) @mmetc
* pkg/acquisition: refact configuration validation and tests (#4187) @mmetc
* pkg/acquisition: remove/restore mock datasources after usage (#4190) @mmetc
* pkg/leakybucket: replace global variables with injected StateDumper (#4197) @mmetc
* pkg/acquisition: method docs, deduplicate module names (#4192) @mmetc
* errors.Wrapf -> fmt.Errorf, remove dependency on github.com/pkg/errors (#4198) @mmetc
* update golangci-lint 2.8 (#4194) @mmetc
* notification plugins: readability / dry refact, unnecessary pointers (#4166) @mmetc
* refact acquisition/appsec: happy path (#4183) @mmetc
* pkg/acquisition/registry, move datasource registration to avoid dependency (#4189) @mmetc
* gin middleware: drop closures (#4186) @mmetc
* acquisition/journalctl: test cleanup (#4182) @mmetc
* cscli hubtest: extract method finalizeRun() (#4181) @mmetc
* refact cmd/crowdsec: remove globals ParseDump, BucketPourTrack (#4184) @mmetc
* refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
* refact pkg/leakybucket: drop closures (#4178) @mmetc
* cmd/crowdsec: rename pipeline channels (#4175) @mmetc
* move dir debian, rpm to /build/ (#4174) @mmetc
* refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
* lint: modernize - enable slicessort, stringsseq (#4162) @mmetc
* appsec: inject dependencies, avoid globals (#4148) @mmetc
* CI: move windows build scripts to ./build/windows (#4145) @mmetc
* remove obsolete readme (replaced by go generate) (#4164) @mmetc
* cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
* cmd/crowdsec: refact output.go, pour.go, parse.go (#4157) @mmetc
* refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
* drop unused method Client.IsMachineRegistered() (#4121) @mmetc
* CI: build with the tag "nomsgpack" to reduce binary size (#4151) @mmetc
* move ./docker to ./build/docker (#4130) @mmetc
* acquisition refact: context-aware OneShot(), for file + journalctl + wineventlog (#4125) @mmetc
* lint: forbidigo (no print or printf in production, prefer fprint) (#4141) @mmetc
* CI: avoid using nolint with revive (#4144) @mmetc
* Lint: add explicit per-linter settings (#4134) @mmetc
* refact pkg/acquisition: split docker.go (#4065) @mmetc
* get rid of tombs in leakybucket package (#4127) @sabban
* refact pkg/acquisition: cloudwatch configuration (#4058) @mmetc
* refact pkg/acquisition: kinesis configuration (#4059) @mmetc
* refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
* refact pkg/acquisition: http configuration (#4061) @mmetc
* refact heartbeat: context-aware method (#4126) @mmetc
* pkg/leakybucket refact: unexport, unused, explicit field names (#4123) @mmetc
* docker build: run builds on large runner (#4120) @blotus

##### Improvements

* docker datasource schema (#4206) @mmetc
* lint: enable bodyclose (ensure response bodies are closed to avoid leaks) (#4200) @mmetc
* feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007) @LaurenceJJones
* pkg/parser: avoid calling spew unless trace (#4156) @mmetc
* leakybucket: reduce error verbosity, test for misconfiguration (#4087) @mmetc
* feat(appsec): support transaction id header for request tracing (#4124) @LaurenceJJones

##### Bug Fixes

* update functional tests with time-based-bf (#4217) @mmetc
* papi: check if decision is allowlisted before adding it (#4196) @blotus
* pkg/acquisition: register mock datasource for YAML tests (#4205) @mmetc
* pkg/acquisition: prevent duplicate send in case of transform error (#4191) @mmetc
* CI fix - exit lapi during hub tests; pass container struct reference instead of slice (#4202) @mmetc
* CAPI: always reuse the stored token (#4201) @blotus
* fix #4066: don't prepare the hub in lapi-only containers (#4169) @mmetc
* fix #3991 - Acquisition config formatting in bug template (#4170) @mmetc
* fix typos in function name, comments and user-facing docs (#4154) @mmetc
* refact appsec

_[Truncated at 4000 characters — full notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.5]_