Skip to content

Releases: falcosecurity/libs

0.23.2

08 Apr 10:59
@ekoops ekoops
0.23.2
475b142

Choose a tag to compare

View all tags
0.23.2 Latest
Latest

MIN_DRIVER_API
MIN_DRIVER_SCHEMA

v0.23.2

Released on 2026-04-08

Bug Fixes

  • fix(libsinsp): add FTR_STORAGE transformer for plugin fields in unary check expressions to prevent stale extract cache data [#2935] - @max-frank

Non user-facing changes

Statistics

MERGED PRS NUMBER
Not user-facing 1
Release note 1
Total 2

Release Manager @ekoops

Contributors

ekoops
Assets 2
Loading

0.23.1

14 Jan 11:34
@ekoops ekoops
0.23.1
44746c3

Choose a tag to compare

View all tags
0.23.1

MIN_DRIVER_API
MIN_DRIVER_SCHEMA

v0.23.1

Released on 2026-01-14

Non user-facing changes

  • ci(release-body.yml): use correct ekoops/actions-github-release commit [#2781] - @ekoops
  • chore(cmake): bump the container plugin version to 0.6.0 [#2780] - @irozzo-1A
  • fix(libsinsp): arg index default value = -1 [#2774] - @therealbobo
  • fix(userspace/libsinsp/parsers): guard against invalid cmsg_len values [#2768] - @ekoops

Statistics

MERGED PRS NUMBER
Not user-facing 4
Release note 0
Total 4

Release Manager @ekoops

Contributors

ekoops
Loading

9.1.0+driver

23 Dec 11:10
@ekoops ekoops
9.1.0+driver
ed469da

Choose a tag to compare

View all tags
9.1.0+driver

API
SCHEMA

Latest Compatible Kernel

Driver Testing Matrix amd64

KERNEL CMAKE-CONFIGURE KMOD BUILD KMOD SCAP-OPEN BPF-PROBE BUILD BPF-PROBE SCAP-OPEN MODERN-BPF SCAP-OPEN
amazonlinux2-5.10 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2-5.15 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2-5.4 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2022-5.15 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2023-6.1 🟢 🟢 🟢 🟢 🟢 🟢
archlinux-6.0 🟢 🟢 🟢 🟢 🟢 🟢
archlinux-6.7 🟢 🟢 🟢 🟢 🟢 🟢
centos-3.10 🟢 🟢 🟢 🟡 🟡 🟡
centos-4.18 🟢 🟢 🟢 🟢 🟢 🟢
centos-5.14 🟢 🟢 🟢 🟢 🟢 🟢
fedora-5.17 🟢 🟢 🟢 🟢 🟢 🟢
fedora-5.8 🟢 🟢 🟢 🟢 🟢 🟢
fedora-6.2 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-3.10 🟢 🟢 🟢 🟡 🟡 🟡
oraclelinux-4.14 🟢 🟢 🟢 🟢 🟢 🟡
oraclelinux-5.15 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-5.4 🟢 🟢 🟢 🟡 🟡 🟡
ubuntu-5.8 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-6.5 🟢 🟢 🟢 🟢 🟢 🟢

Driver Testing Matrix arm64

KERNEL CMAKE-CONFIGURE KMOD BUILD KMOD SCAP-OPEN BPF-PROBE BUILD BPF-PROBE SCAP-OPEN MODERN-BPF SCAP-OPEN
amazonlinux2-5.4 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2022-5.15 🟢 🟢 🟢 🟢 🟢 🟢
fedora-6.2 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-4.14 🟢 🟢 🟢 🟡 🟡 🟡
oraclelinux-5.15 🟢 🟢 🟢 🟡 🟡 🟢
ubuntu-6.5 🟢 🟢 🟢 🟢 🟢 🟢

v9.1.0+driver

Released on 2025-12-23

Breaking Changes ⚠️

  • feat!: default to sched_process_exec tracepoint on all architectures [#2726] - @ekoops
  • feat(driver)!: bump drivers' minimum required kernel version to 3.10 [#2722] - @ekoops

Bug Fixes

  • fix(driver): address UBSAN violation related to Flexible Array Member. [#2760] - @irozzo-1A

Non user-facing changes

  • fix(driver/bpf): fix misc issues with legacy ebpf and clang20 [#2728] - @iurly
  • feat(driver): add filename parameter to PPME_SYSCALL_EXECVE_19_X [#2735] - @ekoops
  • ci(drivers_ci): move drivers build for s390x to dedicated runner [#2725] - @ekoops
  • fix: clone CLONE_CHILD_IN_PIDNS not rendered [#2717] - @deepskyblue86
  • test(drivers/syscall_exit/execveat_x): fix comm assertion [#2702] - @ekoops

Statistics

MERGED PRS NUMBER
Not user-facing 5
Release note 3
Total 8

Release Manager @ekoops

Contributors

ekoops
Loading

0.23.0

23 Dec 10:12
@ekoops ekoops
0.23.0
ed469da

Choose a tag to compare

View all tags
0.23.0

MIN_DRIVER_API
MIN_DRIVER_SCHEMA

v0.23.0

Released on 2025-12-23

Breaking Changes ⚠️

  • cleanup(sinsp)!: remove sinsp_threadinfo::get_parent_thread [#2689] - @gnosek
  • cleanup(sinsp)!: move get_ancestor_process to the thread_manager [#2689] - @gnosek
  • cleanup(sinsp)!: move traverse_parent_state to thread_manager [#2689] - @gnosek
  • cleanup(sinsp)!: move remove_child_from_parent to thread_manager [#2689] - @gnosek
  • cleanup(sinsp)!: move get_ancestor_field_as_string to thread_manager [#2689] - @gnosek
  • cleanup(sinsp)!: remove sinsp_threadinfo->get_container_ip [#2689] - @gnosek
  • cleanup(sinsp)!: remove users/groups handling from threadinfo [#2689] - @gnosek
  • cleanup(sinsp)!: remove the last use of tinfo->get_container_id [#2689] - @gnosek

Bug Fixes

  • fix(libsinsp): expose main thread fd table [#2133] - @mrgian

Non user-facing changes

  • fix(userspace/libsinsp): prevent infinite loop in ancillary data pars… [#2764] - @fremmi
  • sync: cherry-pick for release/0.23.x [#2766] - @ekoops
  • ci(reusable_kernel_tests): bump kernel-testing action and images tag [#2762] - @ekoops
  • chore(userspace/libsinsp): remove unused update-cri-proto file [#2753] - @ekoops
  • clean(libsinsp): do not abuse std::shared_ptr for creating table entries [#2747] - @irozzo-1A
  • ci: add install-cmake composite action [#2751] - @ekoops
  • chore(libsinsp): add missing dependencies to sinsp_test_support [#2750] - @irozzo-1A
  • ci: install bpftool from released package if available [#2749] - @ekoops
  • ci: add install-bpftool composite action [#2748] - @ekoops
  • ci: use make through cmake [#2746] - @ekoops
  • ci: replace ubuntu-22.04* with ubuntu-24.04* [#2744] - @ekoops
  • clean(libsinsp): use the correct union member in extract_key<int64_t> [#2745] - @irozzo-1A
  • ci: replace ubuntu-latest with ubuntu-24.04 [#2743] - @ekoops
  • chore(libsinsp): add target to build library for sinsp integration tests [#2740] - @irozzo-1A
  • ci(perf.yml): use python venv to run gbench result comparison [#2738] - @ekoops
  • fix(userspace/libscap/engine/savefile): fix converter debug log lines [#2737] - @ekoops
  • ci(reusable_kernel_tests.yaml): switch to new kernel testing framework [#2732] - @ekoops
  • chore(sinsp): clean-up syscall latency related code [#2730] - @irozzo-1A
  • cleanup(userspace): Fix various Visual C++ warnings [#2729] - @geraldcombs
  • fix(userspace/libpman): fix bpf helper probe error handling [#2720] - @ekoops
  • userspace: Make Cflags in our .pc files more strict [#2691] - @geraldcombs
  • perf(sinsp): sinsp_thread_manager::get_field_accessor [#2705] - @deepskyblue86
  • cleanup(userspace): Use 64-bit format constants where needed [#2692] - @geraldcombs
  • cleanup(sinsp)!: clarify get_thread_ref vs find_thread [#2694] - @gnosek
  • ci(reusable_e2e_tests): install bpftool using released package [#2701] - @ekoops
  • chore: add '/kind sync` to PR template [#2700] - @ekoops
  • ci(worflows/release-body): fix latest release fetching [#2697] - @ekoops

Statistics

MERGED PRS NUMBER
Not user-facing 27
Release note 17
Total 44

Release Manager @ekoops

Contributors

ekoops
Loading

0.23.0-rc2

22 Dec 14:37
@ekoops ekoops
0.23.0-rc2
ed469da

Choose a tag to compare

View all tags
0.23.0-rc2 Pre-release
Pre-release 
fix(userspace/libsinsp): prevent infinite loop in ancillary data pars…
Loading

9.1.0-rc1+driver

19 Dec 12:54
@ekoops ekoops
9.1.0-rc1+driver
9b8a8e4

Choose a tag to compare

View all tags
9.1.0-rc1+driver Pre-release
Pre-release 
chore(libscap/engine/bpf): improve error logging

Right now if perf_event_mmap() fails, it will buffer some diagnostic
info using scap_errprintf(), spelling out which of the two mmap()
calls failed. However, upon detecting a failure, the calling function
will also call scap_errprintf() and therefore overwrite the previous log
line. This change:

a) adds the actual values passed to mmap() to the log line, so get a bit
more context

b) suppresses the subsequent scap_errprintf() invocation so to surface
the orignal log line instead.

Signed-off-by: Gerlando Falauto <gerlando.falauto@sysdig.com>
Loading

0.23.0-rc1

19 Dec 10:51
@ekoops ekoops
0.23.0-rc1
9b8a8e4

Choose a tag to compare

View all tags
0.23.0-rc1 Pre-release
Pre-release 
chore(libscap/engine/bpf): improve error logging

Right now if perf_event_mmap() fails, it will buffer some diagnostic
info using scap_errprintf(), spelling out which of the two mmap()
calls failed. However, upon detecting a failure, the calling function
will also call scap_errprintf() and therefore overwrite the previous log
line. This change:

a) adds the actual values passed to mmap() to the log line, so get a bit
more context

b) suppresses the subsequent scap_errprintf() invocation so to surface
the orignal log line instead.

Signed-off-by: Gerlando Falauto <gerlando.falauto@sysdig.com>
Loading

0.22.2

05 Nov 09:47
@leogr leogr
0.22.2
16c0267

Choose a tag to compare

View all tags
0.22.2

MIN_DRIVER_API
MIN_DRIVER_SCHEMA

v0.22.2

Released on 2025-11-05

Minor Changes

  • update: upgrade container plugin to v0.4.1 [#2710] - @leogr

Bug Fixes

  • fix(userspace/libsinsp): correct fallback for arg-less proc.* fields [#2704] - @leogr

Statistics

MERGED PRS NUMBER
Not user-facing 0
Release note 2
Total 2

Release Manager @leogr

Contributors

leogr
Loading

0.22.1

20 Oct 10:53
@ekoops ekoops
0.22.1
1a8b912

Choose a tag to compare

View all tags
0.22.1

MIN_DRIVER_API
MIN_DRIVER_SCHEMA

v0.22.1

Released on 2025-10-20

Bug Fixes

  • fix: avoid libc incompatibilities by removing RTLD_DEEPBIND when loading plugins [#2698] - @leogr

Statistics

MERGED PRS NUMBER
Not user-facing 0
Release note 1
Total 1

Release Manager @ekoops

Contributors

ekoops
Loading

9.0.0+driver

16 Oct 13:34
@ekoops ekoops
9.0.0+driver
5666ef4

Choose a tag to compare

View all tags
9.0.0+driver

API
SCHEMA

Latest Compatible Kernel

Driver Testing Matrix amd64

KERNEL CMAKE-CONFIGURE KMOD BUILD KMOD SCAP-OPEN BPF-PROBE BUILD BPF-PROBE SCAP-OPEN MODERN-BPF SCAP-OPEN
amazonlinux2-4.19 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2-5.10 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2-5.15 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2-5.4 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2022-5.15 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2023-6.1 🟢 🟢 🟢 🟢 🟢 🟢
archlinux-6.0 🟢 🟢 🟢 🟢 🟢 🟢
archlinux-6.7 🟢 🟢 🟢 🟢 🟢 🟢
centos-3.10 🟢 🟢 🟢 🟡 🟡 🟡
centos-4.18 🟢 🟢 🟢 🟢 🟢 🟢
centos-5.14 🟢 🟢 🟢 🟢 🟢 🟢
fedora-5.17 🟢 🟢 🟢 🟢 🟢 🟢
fedora-5.8 🟢 🟢 🟢 🟢 🟢 🟢
fedora-6.2 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-3.10 🟢 🟢 🟢 🟡 🟡 🟡
oraclelinux-4.14 🟢 🟢 🟢 🟢 🟢 🟡
oraclelinux-5.15 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-5.4 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-4.15 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-5.8 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-6.5 🟢 🟢 🟢 🟢 🟢 🟢

Driver Testing Matrix arm64

KERNEL CMAKE-CONFIGURE KMOD BUILD KMOD SCAP-OPEN BPF-PROBE BUILD BPF-PROBE SCAP-OPEN MODERN-BPF SCAP-OPEN
amazonlinux2-5.4 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2022-5.15 🟢 🟢 🟢 🟢 🟢 🟢
fedora-6.2 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-4.14 🟢 🟢 🟢 🟡 🟡 🟡
oraclelinux-5.15 🟢 🟢 🟢 🟢 🟢 🟢
ubuntu-6.5 🟢 🟢 🟢 🟢 🟢 🟢

v9.0.0+driver

Released on 2025-10-16

Breaking Changes ⚠️

  • feat(driver/modern_bpf)!: remove forgotten pwrite64_e prog [#2626] - @ekoops
  • feat!: add PPME_SYSCALL_CLOSE_E fd param to PPME_SYSCALL_CLOSE_X [#2475] - @ekoops
  • feat!: drop rename{,at,at2} enter evts gen, testing and parsing code [#2599] - @ekoops
  • feat!: drop splice enter events gen, testing and parsing code [#2599] - @ekoops
  • feat!: drop munmap enter events gen, testing and parsing code [#2599] - @ekoops
  • feat!: drop mmap/mmap2 enter events gen, testing and parsing code [#2599] - @ekoops
  • feat!: drop fcntl enter events gen, testing and parsing code [#2599] - @ekoops
  • feat!: drop symlink{,at} enter events gen, testing and parsing code [#2599] - @ekoops
  • feat!: drop setuid enter events gen, testing and parsing code [#2594] - @terror96
  • feat!: drop ptrace enter events gen, testing and parsing code [#2594] - @terror96
  • feat!: drop mkdir enter events gen, testing and parsing code [#2594] - @terror96
  • feat!: drop mkdirat enter events gen, testing and parsing code [#2594] - @terror96
  • feat!: drop fchdir enter events gen, testing and parsing code [#2594] - @terror96
  • feat!: drop llseek enter events gen, testing and parsing code [#2591] - @ekoops
  • feat!: drop lseek enter events gen, testing and parsing code [#2591] - @ekoops
  • feat!: drop select enter events gen, testing and parsing code [#2591] - @ekoops
  • feat!: drop poll enter events gen, testing and parsing code [#2591] - @ekoops
  • feat!: drop epoll_wait enter events gen, testing and parsing code [#2591] - @ekoops
  • feat!: drop fstat64 enter events gen, testing and parsing code [#2591] - @ekoops
  • feat!: drop lstat64 enter events gen, testing and parsing code [#2591] - @ekoops
  • feat!: drop stat64 enter events gen, testing and parsing code [#2591] - @ekoops
  • feat!: drop fstat enter events gen, testing and parsing code [#2591] - @ekoops
  • feat!: drop lstat enter events gen, testing and parsing code [#2590] - @ekoops
  • feat!: drop stat enter events gen, testing and parsing code [#2590] - @ekoops
  • feat!: drop futex enter events gen, testing and parsing code [[#2590](https:...
Read more

Contributors

ekoops
Loading