v1.8.0-rc1Pre-releaseWindowsLinux
Added 4
- Bot detection feature for CrowdSec WAF that serves a challenge and fingerprinting page to clients, evaluating legitimacy based on challenge response and fingerprint rules
- Kubernetes log acquisition datasource to fetch logs directly from the Kubernetes API server
- HTTP helpers for the expression language to query external services from parsers and scenarios
- cs_machines_heartbeat_seconds metric
Changed 1
- Improve cscli hub list functionality
Fixed 13
- Allow spaces in ENROLL_INSTANCE_NAME environment variable in Docker
- Return nil response from API client if unable to connect to LAPI
- Remove error when running cscli lapi register if the credentials file does not exist
- Avoid panic on colliding nested crowdsec labels in Docker
- Prevent closing the shared acquisition output channel in syslog
- Track id/name pairs for all subrules in WAF
- Prevent fetching JWT token from query string in API server
- Emit overflow before pouring the next event in leaky bucket
- Prevent duplicate log ingestion and improve timestamp handling in Loki
- Use proper mutex when checking if flush can happen in database
- Do not flush alerts with active decisions in database
- Fix Distinct() panic on []string and other non-[]any slices
- Correct bouncer name field stripping from Docker secrets path
Bot detection with CrowdSec WAF
This release brings a major change to the CrowdSec WAF: a bot detection feature.
If enabled, clients will be served a challenge + fingerprinting page before accessing the website. CrowdSec will evaluate the challenge and check the fingerprint against pre-configured rules to decide whether the client looks legitimate or not.
You can find more information about this new feature in the documentation.
Other notable changes include:
- a dedicated kubernetes datasource: crowdsec will fetch logs directly from the k8s apiserver
- new HTTP helpers for the expression language, to query external services from parsers and scenarios
New Features
- k8s log acquisition datasource (#4221) @sabban
- Waf challenge mode (#4268) @blotus
Improvements
- Add cs_machines_heartbeat_seconds metric (#4569) @kushiemoon-dev
- Cscli hub list improvements (#4567) @buixor
- expr: add HTTP helpers (#4533) @blotus
Bug Fixes
- fix(docker): allow spaces in ENROLL_INSTANCE_NAME (#4582) @sahilnyk
- apiclient: return nil response if we couldnt connect to LAPI (#4573) @blotus
- cscli lapi register: no error if the credentials file does not exist (#4570) @lopster568
- fix(docker): avoid panic on colliding nested crowdsec labels (#4555) @arpitjain099
- fix(syslog): don't close the shared acquisition output channel (#4553) @alxrxs
- waf: track id/name pairs for all subrules (#4505) @blotus
- apiserver: prevent from fetching JWT token from query string (#4554) @blotus
- fix(leakybucket): emit overflow before pouring the next event (#4547) @blotus
- loki: prevent duplicate log ingestion and improve timestamp handling (#4498) @Anulo2
- db: use proper mutex when checking if flush can happen (#4528) @blotus
- db: do not flush alerts with active decisions (#4527) @blotus
- Fix
Distinct()panic on[]stringand other non-[]anyslices (#4543) @Synvoya - fix(docker): bouncer name strips wrong field from Docker secrets path (#4490) @tejgokani
Chore / Deps
- ci(bats): fix scenarios badge color variable name (#4551) @blotus
- ci(docker): inherit secrets so the docker environment secrets resolve (#4550) @blotus
- build: use version based on latest for dev builds (#4583) @blotus
- build(deps): bump the gomod group with 19 updates (#4581) @dependabot[bot]
- build(deps): bump github.com/quic-go/quic-go from 0.57.0 to 0.59.1 (#4499) @dependabot[bot]
- build(deps): bump cryptography from 46.0.6 to 48.0.1 in /build/docker/test (#4522) @dependabot[bot]
- build(deps-dev): bump ruff from 0.15.20 to 0.15.22 in /build/docker/test in the uv group across 1 directory (#4559) @dependabot[bot]
- WAF: update coraza (#4572) @blotus
- build(deps): bump the github-actions group across 1 directory with 3 updates (#4558) @dependabot[bot]
- build(deps): bump the gomod group across 1 directory with 21 updates (#4566) @dependabot[bot]
- bump fpscanner to v1.0.7 (#4557) @blotus
- update go-re2 to 1.11.0 (#4478) @blotus
- Unify sqlite build flag (#4525) @zc-devs
- fix TestCryptoObfuscationDefaultPoolSize (#4565) @buixor
- build(deps): bump the gomod group across 1 directory with 30 updates (#4542) @dependabot[bot]
- chore: delete publiccode.yml to comply with the process (#4552) @mazzma12
- build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#4549) @dependabot[bot]
- CI hardening (#4546) @blotus
- fix(docs): set pubblicode.yml to correct version (#4548) @mazzma12
- build(deps): bump cloudflare/wrangler-action from 3.15.0 to 4.0.0 (#4541) @dependabot[bot]
- build(deps): bump codecov/codecov-action from 6.0.0 to 7.0.0 (#4540) @dependabot[bot]
- build(deps-dev): bump the uv group in /build/docker/test with 2 updates (#4537) @dependabot[bot]
- build(deps): bump the github-actions group with 7 updates (#4538) @dependabot[bot]
- build(deps): bump actions/checkout from 6.0.2 to 7.0.0 (#4539) @dependabot[bot]
- build(deps): bump golang.org/x/net from 0.53.0 to 0.55.0 (#4544) @dependabot[bot]
- build(deps): bump the github-actions group across 1 directory with 11 updates (#4524) @dependabot[bot]
- build(deps): bump the uv group across 1 directory with 3 updates (#4519) @dependabot[bot]
- build(deps): bump alpine from 3.23 to 3.24 in /build/docker in the docker group across 1 directory (#4513) @dependabot[bot]
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Installation
Take a look at the installation instructions.