0.43.0

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.43.0
docker pull public.ecr.aws/falcosecurity/falco:0.43.0
docker pull docker.io/falcosecurity/falco-driver-loader:0.43.0
docker pull docker.io/falcosecurity/falco-driver-loader:0.43.0-buster
docker pull docker.io/falcosecurity/falco:0.43.0-debian

v0.43.0

Released on 2026-01-28

Breaking Changes ⚠️

• fix(userspace)!: show source config path only in debug builds [#3787] - @leogr

Minor Changes

• chore: [NOTICE] The GPG key used to sign DEB/RPM packages has been rotated, and all existing packages have been re-signed. New key fingerprint: 478B2FBBC75F4237B731DA4365106822B35B1B1F [#3753] - @leogr
• chore(userspace): deprecate --gvisor-generate-config CLI option [#3784] - @ekoops
• docs: add deprecation notice for legacy eBPF in pkg install dialog [#3786] - @ekoops
• chore(scripts/falcoctl): increase follow interval to 1 week [#3757] - @leogr
• docs: add deprecation notice for legacy eBPF, gVisor and gRPC usage [#3763] - @ekoops
• chore(userspace): deprecate legacy eBPF probe, gVisor engine and gRPC [#3763] - @ekoops
• chore(engine): emit warning when the deprecated evt.latency field family is used in a rule condition or output [#3744] - @irozzo-1A

Bug Fixes

• fix: prevent null pointer crash on popen() failure in output_program [#3722] - @vietcgi
• fix: correct falcoctl.yaml path in debian conffiles [#3745] - @leogr

Non user-facing changes

• revert: chore(.github): temporary action for GPG key rotation [#3766] - @leogr
• chore(cmake): bump falcoctl dependency version to 0.12.2 [#3790] - @ekoops
• chore(cmake): bump falcoctl dependency version to 0.12.1 [#3777] - @ekoops
• chore(cmake): bump container plugin version to 0.6.1 [#3780] - @ekoops
• fix(userspace/engine): missing closing quote in deprecated field warning [#3779] - @leogr
• chore(.github): Put back gpg key rotation workflow [#3772] - @irozzo-1A
• chore(cmake): bump libs/drivers to 0.23.1/9.1.0+driver [#3769] - @ekoops
• chore(cmake): bump container plugin version to 0.6.0 [#3768] - @irozzo-1A
• docs(proposals): add proposal for legacy probe, gVisor engine and gRPC output deprecation [#3755] - @ekoops
• chore(cmake): bump libs/drivers to 0.23.0/9.1.0+driver [#3760] - @ekoops
• update(cmake): update libs and driver to latest master [#3754] - @github-actions[bot]
• fix(metrics): Add null check for state.outputs in metrics collection [#3740] - @adduali1310
• chore(cmake): bump libs to 0.23.0-rc2 [#3759] - @ekoops
• chore(cmake): bump libs/drivers to 0.23.0-rc1/9.1.0-rc1+driver [#3758] - @ekoops
• fix(ci): revert changes to mitigate rate-limitar change [#3752] - @irozzo-1A
• update(cmake): update libs and driver to latest master [#3723] - @github-actions[bot]
• Reduce image size [#3746] - @jfcoz
• docs(RELEASE.md): specify target branch association upon release creation [#3717] - @ekoops
• docs(RELEASE.md): fix rn2md cmd generating changelogs [#3709] - @ekoops
• docs(RELEASE.md): fix PRs filtering expr for checking release notes [#3708] - @ekoops
• docs(RELEASE.md): fix PRs filtering expression text [#3707] - @ekoops

Statistics

MERGED PRS	NUMBER
Not user-facing	21
Release note	11
Total	32

Release Manager @ekoops

0.43.0-rc3

fix(userspace)!: show source config path only in debug builds

  Starting from Falco 0.40, the `falco --help` output incorrectly showed
  the source config path (e.g., /home/runner/work/falco/falco/falco.yaml)
  in release packages. This path was intended only for local development.

  The issue was introduced when RelWithDebInfo build type support was
  added (commit 6bf33ffd). The existing code checked for BUILD_TYPE_RELEASE
  to determine release behavior, but RelWithDebInfo builds defined
  BUILD_TYPE_RELWITHDEBINFO instead, causing them to fall into the
  debug code path.

  This fix introduces BUILD_TYPE_DEBUG and changes the conditionals to
  enable dev features only when CMAKE_BUILD_TYPE is explicitly "debug".
  Both Release and RelWithDebInfo builds now correctly show only
  /etc/falco/falco.yaml.

  Fixes the regression introduced in 0.40.0

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>

0.43.0-rc2

ci: disable `build-win32-package`

Chocolatey registries are currently unavailable, and this is blocking
the release process. Disable the win32 build in CI, in the release
branch, to allow to move forward.

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>

0.43.0-rc1

chore(cmake): bump libs/drivers to `0.23.1`/`9.1.0+driver`

The previously used driver version was already the `9.1.0+driver`:
simply replace the commit SHA with the release name.

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>

0.42.1

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.42.1
docker pull public.ecr.aws/falcosecurity/falco:0.42.1
docker pull docker.io/falcosecurity/falco-driver-loader:0.42.1
docker pull docker.io/falcosecurity/falco-driver-loader:0.42.1-buster
docker pull docker.io/falcosecurity/falco:0.42.1-debian

v0.42.1

Released on 2025-11-06

Non user-facing changes

• docs(CHANGELOG.md): update changelog for 0.42.0 release [#3730] - @leogr

Statistics

MERGED PRS	NUMBER
Not user-facing	1
Release note	0
Total	1

Release Manager @leogr

0.42.0

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.42.0
docker pull public.ecr.aws/falcosecurity/falco:0.42.0
docker pull docker.io/falcosecurity/falco-driver-loader:0.42.0
docker pull docker.io/falcosecurity/falco-driver-loader:0.42.0-buster
docker pull docker.io/falcosecurity/falco:0.42.0-debian

v0.42.0

Released on 2025-10-22

Major Changes

• feat: add falco_libs.thread_table_auto_purging_interval_s and thread_table_auto_purging_thread_timeout_s configuration options [#3670] - @ekoops
• feat: log plugin version info at loading time [#3657] - @FedeDP
• feat: ability to add statically defined fields via static_fields configuration [#3557] - @FedeDP
• feat(engine): emit warning when a rule containing the evt.dir field in output is encountered [#3697] - @irozzo-1A
• feat(engine): emit warning when a rule containing a condition on the deprecated evt.dir field is encountered [#3690] - @irozzo-1A
• new: ability to record .scap files (capture feature) [#3645] - @leogr
• new(docker): includes sha on the image labels [#3658] - @jcchavezs
• new(cmake,userspace,ci): add mimalloc support [#3616] - @FedeDP

Minor Changes

• docs(falco.yaml): refactor config documentation [#3685] - @leogr
• build: fix debian:buster apt debian repo URL in :driver-loader-buster container image [#3644] - @ekoops
• build: updagrade libs to version 0.22.1 [#3705] - @irozzo-1A
• build: upgrade drivers to v9.0.0+driver [#3701] - @irozzo-1A
• build: upgrade cpp-httplib to v0.23.1 [#3647] - @FedeDP
• update: upgrade default ruleset to v5.0.0 [#3700] - @leogr
• build: upgrade falcoctl to v0.11.4 [#3694] - @leogr
• chore(prometheus): deprecate enter events drop stats [#3675] - @irozzo-1A

Bug Fixes

• fix(cmake): correct abseil-cpp for alpine build [#3598] - @RomanenkoDenys
• fix: enable handling of multiple actions configured with syscall_event_drops.actions [#3676] - @terror96
• fix: disable dry-run restarts when Falco runs with config-watching disabled [#3640] - @Proximyst

Non user-facing changes

• fix(userspace/falco): correct default duration calculation [#3715] - @leogr
• chore(falcoctl): update falco rules to version 5 [#3712] - @irozzo-1A
• doc(OWNERS): move incertum (Melissa Kilby) to emeritus_approvers [#3605] - @incertum
• update(cmake): update libs and driver to latest master [#3689] - @github-actions[bot]
• chore(docker): use new ENV syntax in place of deprecated one [#3696] - @ekoops
• chore(cmake/modules): update rules to 5.0.0-rc1 [#3698] - @leogr
• fix(userspace/engine): fix logger date format [#3672] - @ekoops
• docs(OWNERS): add ekoops(Leonardo Di Giovanna) as approver [#3688] - @ekoops
• update(cmake): update libs and driver to latest master [#3665] - @github-actions[bot]
• Refactor: cppcheck cleanups [#3649] - @sgaist
• update(userspace/engine): update falco engine version and checksum [#3648] - @ekoops
• update(cmake): update libs and driver to latest master [#3662] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3661] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3653] - @github-actions[bot]
• chore(ci): disable mimalloc for master builds. [#3655] - @FedeDP
• chore(deps): Bump submodules/falcosecurity-rules from 1208816 to be38001 [#3651] - @dependabot[bot]
• docs(falco.yaml): avoid out-of-sync config options for container pl… [#3650] - @leogr
• update(cmake): update libs and driver to latest master [#3636] - @github-actions[bot]
• update(CHANGELOG.md): release 0.41.3 (cherry-pick) [#3634] - @ekoops
• update(cmake): update libs and driver to latest master [#3628] - @github-actions[bot]
• update(CHANGELOG.md): release 0.41.2 (cherry-pick) [#3623] - @ekoops
• update(cmake): update libs and driver to latest master [#3618] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3602] - @github-actions[bot]
• chore(falco.yaml): clean up plugins config leftover [#3596] - @leogr
• chore(deps): Bump submodules/falcosecurity-rules from b4437c4 to 4d51b18 [#3607] - @dependabot[bot]
• update(docs): cherry pick CHANGELOG. [#3600] - [@fed...

0.42.0-rc4

fix(userspace/falco): correct default duration calculation

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

0.42.0-rc3

chore(build): update falco libs dependency to 0.22.1

Signed-off-by: Iacopo Rozzo <iacopo@sysdig.com>

0.42.0-rc2

chore(deps): bump libs version to 0.22.0

Signed-off-by: Iacopo Rozzo <iacopo@sysdig.com>

0.42.0-rc1

feat(engine): emit warning when a rule output uses deprecated "evt.dir"

Emit a warning when a rule uses the deprecated "evt.dir" field in output.

Signed-off-by: Iacopo Rozzo <iacopo@sysdig.com>