# CrowdSec v1.7.7-rc1

- Product: CrowdSec (https://whatsnew.fyi/product/crowdsec)
- Vendor: CrowdSec
- Date: 2026-03-23
- Version: v1.7.7-rc1
- Original notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.7-rc1
- Permalink: https://whatsnew.fyi/product/crowdsec/releases/v1.7.7-rc1
- Labels: Pre-release; Platforms: Windows, Linux

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add LookupFile and FileMap expr helpers
- **added** — Add LookupFile and FileMap expr helpers
- **added** — Allow arbitrary mix of AND and OR conditions in WAF rules
- **added** — Add new kind alert attribute
- **added** — Add cscli allowlists import command
- **changed** — Enable RE2 support by default on Linux
- **changed** — Expose more transformations from coraza in WAF
- **changed** — Use environment proxy settings for notification-http
- **changed** — Add support for waf- alias in cscli
- **fixed** — Apply allowlist items to existing decisions in batch
- **fixed** — Fix tests for modsec rules generation
- **fixed** — Add file notification plugin in MSI package for Windows
- **fixed** — Call cancel after leakroutine returns
- **fixed** — Lower-case x-ms-date header in notification-sentinel for correct HMAC
- **fixed** — Remove temporary sqlite and plugin files from /tmp/ in tests
- **fixed** — Fix scenario count in debug log in pkg/apiserver
- **fixed** — Prevent race condition and deadlock in pkg/csplugin
- **fixed** — Fix data race in pkg/acquisitioncontext tests
- **fixed** — Fix data race in acquisition/file tests
- **fixed** — Set log type for caddy unit to syslog in cscli detect

##### New Features

* add LookupFile and FileMap expr helpers (#4372) @buixor
* waf rules: allow arbitrary mix of AND and OR conditions (#4358) @blotus

##### Improvements

* enable RE2 support by default on linux (#4386) @blotus
* cscli allowlists: add import command (#4378) @blotus
* WAF: expose more transformations from coraza (#4140) @blotus
* Add new `kind` alert attribute (#4351) @blotus
* Use environment proxy settings for notification-http (#4364) @op3

##### Bug Fixes

* allowlists: apply items to existing decisions in batch (#4095) @blotus
* waf: fix tests for modsec rules generation (#4385) @blotus
* windows: add file notification plugin in MSI package (#4367) @blotus
* leakroutine: call cancel after leakroutine returns (#4369) @blotus
* notification-sentinel: lower-case x-ms-date header for correct HMAC (#4288) @ebirn
* tests: remove temporary sqlite/plugin files from /tmp/ (#4332) @mmetc
* pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
* pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
* pkg/acquisitioncontext: minimal fix for data race in tests (#4327) @mmetc
* acquisition/file: minimal fix for data race in tests (#4326) @mmetc
* fix lint fsutil/freebsd: unnecessary conversion (#4324) @mmetc
* cscli: consistent status and usage message for unknown subcommands (#4320) @mmetc
* cscli detect: set log type for caddy unit to "syslog" (#4321) @mmetc
* CI: add published_at to version.crowdsec.net/latest (#4291) @blotus
* cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
* waf: format as CRS match only if anomaly score is not 0 (#4230) @blotus

##### Changes

* build(deps): bump cryptography from 46.0.3 to 46.0.5 in /build/docker/test (#4298) @[dependabot[bot]](https://github.com/apps/dependabot)
* support for waf- alias in cscli (#4347) @buixor
* refact pkg/dumps: reduce complexity (#4209) @mmetc
* lint: refact pkg/dumps for nilaway (#4208) @mmetc
* refact pkg/parser: redundant indirection (#4344) @mmetc
* refact pkg/parser: extract+embed NodeConfig in Node struct (#4343) @mmetc
* move calls to trace.ReportPanic() on top of goroutines (#4338) @mmetc
* pkg/csplugin: simplify notification loop; noop with empty queue (#4328) @mmetc
* pkg/parsers: light refact, remove redundant code (#4213) @mmetc
* refact cmd/crowdsec: encapsulate cache into alertBuffer (#4300) @mmetc
* cmd/notification-*: don't provide the same context twice for request (#4316) @mmetc
* don't flush 127.0.0.1 (#4315) @sabban
* clipapi: replace tomb with errgroup (#4207) @mmetc
* refact cmd/crowdsec: remove redundant global variable (#4299) @mmetc
* refact: remove unused code in crowdsec-cli, apiserver, acquisition, database (#4304) @mmetc
* refact pkg/leakybucket: trim down redundant Leaky struct fields (#4290) @mmetc
* pkg/leakybucket: remove global bucketStore, unused parameters + tags (#4286) @mmetc
* pkg/leakybucket: remove Simulated field from Leaky, keep it in config (#4285) @mmetc
* pkg/leakybucket: extract BucketSpec from BucketFactory (#4284) @mmetc
* refact pkg/leakybucket: extract methods from LoadBucket() part 2 (#4282) @mmetc
* pkg/leakybucket: refact test loop, more explicit failures in testFile() (#4281) @mmetc
* refact pkg/leakybucket: extract methods from LoadBucket() (#4279) @mmetc
* pkg/leakybucket: replace Signal chan with explicit read/done chans (#4277) @mmetc
* pkg/leakybucket: replace waitgroups with single rwlock (#4276) @mmetc
* pkg/leakybucket: garbage collect: compare float with epsilon (#4275) @mmetc
* pkg/leakybucket: refactor tests (#4272) @mmetc
* pkg/leakybucket: replace sycn.Map with map + mutex (#4271) @mmetc
* pkg/leakybucket: replace global counter with call to bucket store (#4273) @mmetc
* pkg/leakybucket: review README.md (#4274) @mmetc
* pkg/leakybucket: encapsulate store map + add methods (#4253) @mmetc
* pkg/leakybucket: remove redundant bool var (#4252) @mmetc
* fix hub console side (#4266) @sabban
* version work

_[Truncated at 4000 characters — full notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.7-rc1]_