# CrowdSec v1.7.7

- Product: CrowdSec (https://whatsnew.fyi/product/crowdsec)
- Vendor: CrowdSec
- Date: 2026-03-30
- Version: v1.7.7
- Original notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.7
- Permalink: https://whatsnew.fyi/product/crowdsec/releases/v1.7.7
- Labels: Platforms: Windows, Linux

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **changed** — RE2 is now used by default for evaluating regexp in parsers on Linux
- **added** — WAF rules can now contain a mix of AND/OR conditions without limits
- **added** — Add new kind alert attribute to identify its source
- **added** — Add cscli allowlist import command
- **added** — Add LookupFile and FileMap expr helpers
- **changed** — Support for the HTTP_PROXY environment variable in the notification-http plugin
- **changed** — WAF exposes more transformations from coraza
- **fixed** — Fix resource leak under high load
- **fixed** — Apply allowlist items to existing decisions in batch
- **fixed** — Fix WAF tests for modsec rules generation
- **fixed** — Add file notification plugin in MSI package on Windows
- **fixed** — Fix leakroutine by calling cancel after leakroutine returns
- **fixed** — Lowercase x-ms-date header in notification-sentinel for correct HMAC
- **changed** — Support waf- alias in cscli
- **fixed** — Prevent race condition and deadlock in pkg/csplugin
- **fixed** — Set log type for caddy unit to syslog in cscli detect
- **fixed** — Format WAF output as CRS match only if anomaly score is not zero

CrowdSec 1.7.7 brings 2 major changes:

- On linux, [RE2](https://github.com/google/re2) is now used by default for evaluating regexp in parsers
- WAF rules can now contain a mix of AND/OR conditions without any limits, giving much greater flexibility when writing new rules

###### RE2 by default on linux

CrowdsSec has supported for a long time using RE2 as the regexp engine, and with this release we make it the default.

CrowdSec has always used the builtin Go regexp package, which is a Go reimplementation of the RE2 library, but with known performance limitations.

The switch to RE2 will bring significantly increased regexp performance (one of the most critical part of CrowdSec) at the cost of slightly longer regexp compilation and higher baseline memory usage.

> [!IMPORTANT]
> If you encounter any issues with the new regexp engine, you can fallback to the previous Go implementation by setting the feature flag `re2_disable_grok_support` (see [the documentation](https://docs.crowdsec.net/docs/next/configuration/feature_flags/#enabling-a-feature-flag)).

###### Other changes

Other notable changes include:

- a new `kind` attribute for alerts used to identify its source (a scenario, a WAF rule, a manual decision creation, ...)
- a new `cscli allowlist import` command
- support for the `HTTP_PROXY` environment variable in the `notification-http` plugin
- A resource leak under high load was fixed

#### Full changelog

##### New Features

* add LookupFile and FileMap expr helpers (#4372) @buixor
* waf rules: allow arbitrary mix of AND and OR conditions (#4358) @blotus

##### Improvements

* enable RE2 support by default on linux (#4386) @blotus
* cscli allowlists: add import command (#4378) @blotus
* WAF: expose more transformations from coraza (#4140) @blotus
* Add new `kind` alert attribute (#4351) @blotus
* Use environment proxy settings for notification-http (#4364) @op3

##### Bug Fixes

* allowlists: apply items to existing decisions in batch (#4095) @blotus
* waf: fix tests for modsec rules generation (#4385) @blotus
* windows: add file notification plugin in MSI package (#4367) @blotus
* leakroutine: call cancel after leakroutine returns (#4369) @blotus
* notification-sentinel: lower-case x-ms-date header for correct HMAC (#4288) @ebirn
* tests: remove temporary sqlite/plugin files from /tmp/ (#4332) @mmetc
* pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
* pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
* pkg/acquisitioncontext: minimal fix for data race in tests (#4327) @mmetc
* acquisition/file: minimal fix for data race in tests (#4326) @mmetc
* fix lint fsutil/freebsd: unnecessary conversion (#4324) @mmetc
* cscli: consistent status and usage message for unknown subcommands (#4320) @mmetc
* cscli detect: set log type for caddy unit to "syslog" (#4321) @mmetc
* CI: add published_at to version.crowdsec.net/latest (#4291) @blotus
* cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
* waf: format as CRS match only if anomaly score is not 0 (#4230) @blotus

##### Changes

* build(deps): bump cryptography from 46.0.3 to 46.0.5 in /build/docker/test (#4298) @[dependabot[bot]](https://github.com/apps/dependabot)
* support for waf- alias in cscli (#4347) @buixor
* refact pkg/dumps: reduce complexity (#4209) @mmetc
* lint: refact pkg/dumps for nilaway (#4208) @mmetc
* refact pkg/parser: redundant indirection (#4344) @mmetc
* refact pkg/parser: extract+embed NodeConfig in Node struct (#4343) @mmetc
* move calls to trace.ReportPanic() on top of goroutines (#4338) @mmetc
* pkg/csplugin: simplify notification loop; noop with empty queue (#4328) @mmetc
* pkg/parsers: light refact, remove redundant code (#4213) @mmetc
* refact cmd/crowdsec: encapsulate cache into alertBuffer (#4300) @mmetc
* cmd/notification-*: don't provide the same context twice for request (#4316) @mmetc
* don't flush 127.0.0.1 (#4315) @sabban
* clipapi

_[Truncated at 4000 characters — full notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.7]_