# CrowdSec v1.8.0-rc1

- Product: CrowdSec (https://whatsnew.fyi/product/crowdsec)
- Vendor: CrowdSec
- Date: 2026-07-27
- Version: v1.8.0-rc1
- Original notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.8.0-rc1
- Permalink: https://whatsnew.fyi/product/crowdsec/releases/v1.8.0-rc1
- Labels: Pre-release; Platforms: Windows, Linux

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Bot detection feature for CrowdSec WAF that serves a challenge and fingerprinting page to clients, evaluating legitimacy based on challenge response and fingerprint rules
- **added** — Kubernetes log acquisition datasource to fetch logs directly from the Kubernetes API server
- **added** — HTTP helpers for the expression language to query external services from parsers and scenarios
- **added** — cs_machines_heartbeat_seconds metric
- **changed** — Improve cscli hub list functionality
- **fixed** — Allow spaces in ENROLL_INSTANCE_NAME environment variable in Docker
- **fixed** — Return nil response from API client if unable to connect to LAPI
- **fixed** — Remove error when running cscli lapi register if the credentials file does not exist
- **fixed** — Avoid panic on colliding nested crowdsec labels in Docker
- **fixed** — Prevent closing the shared acquisition output channel in syslog
- **fixed** — Track id/name pairs for all subrules in WAF
- **fixed** — Prevent fetching JWT token from query string in API server
- **fixed** — Emit overflow before pouring the next event in leaky bucket
- **fixed** — Prevent duplicate log ingestion and improve timestamp handling in Loki
- **fixed** — Use proper mutex when checking if flush can happen in database
- **fixed** — Do not flush alerts with active decisions in database
- **fixed** — Fix Distinct() panic on []string and other non-[]any slices
- **fixed** — Correct bouncer name field stripping from Docker secrets path

##### Bot detection with CrowdSec WAF

This release brings a major change to the CrowdSec WAF: a bot detection feature.

If enabled, clients will be served a challenge + fingerprinting page before accessing the website.
CrowdSec will evaluate the challenge and check the fingerprint against pre-configured rules to decide whether the client looks legitimate or not.

You can find more information about this new feature in [the documentation](https://docs.crowdsec.net/FIXME-DOC-AT-RELEASE).

Other notable changes include:
 - a dedicated kubernetes datasource: crowdsec will fetch logs directly from the k8s apiserver
 - new HTTP helpers for the expression language, to query external services from parsers and scenarios

##### New Features

* k8s log acquisition datasource (#4221) @sabban
* Waf challenge mode (#4268) @blotus

##### Improvements

* Add cs_machines_heartbeat_seconds metric (#4569) @kushiemoon-dev
* Cscli hub list improvements (#4567) @buixor
* expr: add HTTP helpers (#4533) @blotus

##### Bug Fixes

* fix(docker): allow spaces in ENROLL_INSTANCE_NAME (#4582) @sahilnyk
* apiclient: return nil response if we couldnt connect to LAPI (#4573) @blotus
* cscli lapi register: no error if the credentials file does not exist (#4570) @lopster568
* fix(docker): avoid panic on colliding nested crowdsec labels (#4555) @arpitjain099
* fix(syslog): don't close the shared acquisition output channel (#4553) @alxrxs
* waf: track id/name pairs for all subrules (#4505) @blotus
* apiserver: prevent from fetching JWT token from query string (#4554) @blotus
* fix(leakybucket): emit overflow before pouring the next event (#4547) @blotus
* loki: prevent duplicate log ingestion and improve timestamp handling (#4498) @Anulo2
* db: use proper mutex when checking if flush can happen (#4528) @blotus
* db: do not flush alerts with active decisions (#4527) @blotus
* Fix `Distinct()` panic on `[]string` and other non-`[]any` slices (#4543) @Synvoya
* fix(docker): bouncer name strips wrong field from Docker secrets path (#4490) @tejgokani

##### Chore / Deps

* ci(bats): fix scenarios badge color variable name (#4551) @blotus
* ci(docker): inherit secrets so the docker environment secrets resolve (#4550) @blotus
* build: use version based on latest for dev builds (#4583) @blotus
* build(deps): bump the gomod group with 19 updates (#4581) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump github.com/quic-go/quic-go from 0.57.0 to 0.59.1 (#4499) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump cryptography from 46.0.6 to 48.0.1 in /build/docker/test (#4522) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps-dev): bump ruff from 0.15.20 to 0.15.22 in /build/docker/test in the uv group across 1 directory (#4559) @[dependabot[bot]](https://github.com/apps/dependabot)
* WAF: update coraza (#4572) @blotus
* build(deps): bump the github-actions group across 1 directory with 3 updates (#4558) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump the gomod group across 1 directory with 21 updates (#4566) @[dependabot[bot]](https://github.com/apps/dependabot)
* bump fpscanner to v1.0.7 (#4557) @blotus
* update go-re2 to 1.11.0 (#4478) @blotus
* Unify sqlite build flag (#4525) @zc-devs
* fix TestCryptoObfuscationDefaultPoolSize (#4565) @buixor
* build(deps): bump the gomod group across 1 directory with 30 updates (#4542) @[dependabot[bot]](https://github.com/apps/dependabot)
* chore: delete publiccode.yml to comply with the process (#4552) @mazzma12
* build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#4549) @[dependabot[bot]](https://github.com/apps/dependabot)
* CI hardening (#4546) @blotus
* fix(docs): set pubblicode.yml to correct version (#4548) @mazzma12
* build(deps): bump cloudflare/wrangler-action from 3.15.0 to 4.0.0 (#4541) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump

_[Truncated at 4000 characters — full notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.8.0-rc1]_