# CrowdSec v1.8.0-rc2

- Product: CrowdSec (https://whatsnew.fyi/product/crowdsec)
- Vendor: CrowdSec
- Date: 2026-08-25
- Version: v1.8.0-rc2
- Original notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.8.0-rc2
- Permalink: https://whatsnew.fyi/product/crowdsec/releases/v1.8.0-rc2
- Labels: Pre-release; Platforms: Windows, Linux

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add Kubernetes log acquisition datasource to fetch logs directly from the k8s apiserver
- **added** — Add bot detection feature to CrowdSec WAF with challenge and fingerprinting page
- **added** — Add HTTP helpers for the expression language to query external services from parsers and scenarios
- **added** — Add cs_machines_heartbeat_seconds metric
- **changed** — Challenge mode now detects if cookies are disabled and displays an explicit error message
- **changed** — Add composite index for decision dedup in database
- **changed** — Optimize proof-of-work solving and increase difficulty
- **changed** — Unify bot detection scores
- **changed** — WAF challenge mode now supports threshold configuration
- **changed** — Revamp cscli console status to be all-in-one
- **changed** — Allow configuration of auth timeout to LAPI in WAF
- **changed** — Improve cscli hub list
- **changed** — Update fpscanner to 1.0.8
- **changed** — Update coraza in WAF
- **fixed** — Fix leak of background pre-warmer goroutine in bot detection
- **fixed** — Add support for max body size in k8s-audit
- **fixed** — Set a maximum payload size for usage metrics
- **fixed** — Use decision id as cursor for delta pull in LAPI
- **fixed** — Set default max body size and enforce it for compressed streams in HTTP acquisition
- **fixed** — Fix transformation being ignored in acquisition

##### Bot detection with CrowdSec WAF

This release brings a major change to the CrowdSec WAF: a bot detection feature.

If enabled, clients will be served a challenge + fingerprinting page before accessing the website.
CrowdSec will evaluate the challenge and check the fingerprint against pre-configured rules to decide whether the client looks legitimate or not.

You can find more information about this new feature in [the documentation](https://docs.crowdsec.net/FIXME-DOC-AT-RELEASE).

Other notable changes include:
 - a dedicated kubernetes datasource: crowdsec will fetch logs directly from the k8s apiserver
 - new HTTP helpers for the expression language, to query external services from parsers and scenarios

##### New Features

* k8s log acquisition datasource (#4221) @sabban
* Waf challenge mode (#4268) @blotus

##### Improvements

* challenge: detect if cookies are disabled and display an explicit error message (#4628) @blotus
* db: add composite index for decision dedup (#4619) @blotus
* Improve pow solving : optimize & increase difficulty (#4617) @buixor
* Bot detection unify scores (#4608) @buixor
* Dedup code reject submission alert generation (#4606) @buixor
* make `RejectSubmission` generate an alert (#4602) @buixor
* waf challenge: add threshold support (#4593) @blotus
* revamp 'cscli console status' to be all-in-one (#4592) @buixor
* [bot-detection] Fix leak of background pre-warmer goroutine (#4589) @buixor
* waf: allow to configure auth timeout to LAPI (#4585) @blotus
* Add cs_machines_heartbeat_seconds metric (#4569) @kushiemoon-dev
* Cscli hub list improvements (#4567) @buixor
* expr: add HTTP helpers (#4533) @blotus

##### Bug Fixes

* k8s-audit: add support for max body size (#4630) @blotus
* Usage metrics: set a maximum payload size (#4629) @blotus
* lapi: use decision id as cursor for delta pull (#4620) @blotus
* acquis(http): Set default max body size and enforce it as well for compressed streams (#4616) @blotus
* acquisition: fix transformation being ignored (#4609) @blotus
* fpscanner: add missing fields (#4604) @blotus
* docs: fix broken Vagrant include link in test README (#4594) @latent-9
* challenge: require SSE4.1 + WX memory (#4590) @blotus
* WAF: supress erroneous warnings/errors when loading config / no rule has matched (#4587) @blotus
* Bot Detection: keep the original URL in the generated alert (#4586) @buixor
* fix(docker): allow spaces in ENROLL_INSTANCE_NAME (#4582) @sahilnyk
* apiclient: return nil response if we couldnt connect to LAPI (#4573) @blotus
* cscli lapi register: no error if the credentials file does not exist (#4570) @lopster568
* fix(docker): avoid panic on colliding nested crowdsec labels (#4555) @arpitjain099
* fix(syslog): don't close the shared acquisition output channel (#4553) @alxrxs
* waf: track id/name pairs for all subrules (#4505) @blotus
* apiserver: prevent from fetching JWT token from query string (#4554) @blotus
* fix(leakybucket): emit overflow before pouring the next event (#4547) @blotus
* loki: prevent duplicate log ingestion and improve timestamp handling (#4498) @Anulo2
* db: use proper mutex when checking if flush can happen (#4528) @blotus
* db: do not flush alerts with active decisions (#4527) @blotus
* Fix `Distinct()` panic on `[]string` and other non-`[]any` slices (#4543) @Synvoya
* fix(docker): bouncer name strips wrong field from Docker secrets path (#4490) @tejgokani

##### Chore / Deps

* build(deps): bump astral-sh/setup-uv from 8.3.2 to 10.0.1 (#4625) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 (#4627) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump the gomod group with 16 updates (#4626) @[dependabot[bot]](https://github.com/apps/dependabot)
* build(deps): bump the github-actions group with 3 updates (#4624) @[dependabot[bot]](https://gith

_[Truncated at 4000 characters — full notes: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.8.0-rc2]_