0.44.1

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.44.1
docker pull public.ecr.aws/falcosecurity/falco:0.44.1
docker pull docker.io/falcosecurity/falco-driver-loader:0.44.1
docker pull docker.io/falcosecurity/falco-driver-loader:0.44.1-buster
docker pull docker.io/falcosecurity/falco:0.44.1-debian

v0.44.1

Released on 2026-06-11

Major Changes

• feat(userspace/falco): add support for disabling BPF iterators [#3879] - @ekoops

Bug Fixes

• fix: fix multiple issues related to BPF iterators (solved by bumping libs to 0.25.4) [#3879] - @ekoops

Statistics

MERGED PRS	NUMBER
Not user-facing	0
Release note	1
Total	1

Release Manager @ekoops

0.44.1-rc1

feat(userspace/falco): add support for disabling BPF iterators

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>

0.44.0

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.44.0
docker pull public.ecr.aws/falcosecurity/falco:0.44.0
docker pull docker.io/falcosecurity/falco-driver-loader:0.44.0
docker pull docker.io/falcosecurity/falco-driver-loader:0.44.0-buster
docker pull docker.io/falcosecurity/falco:0.44.0-debian

v0.44.0

Released on 2026-05-26

Breaking Changes ⚠️

• new!: add backslash escaping support to -o key-path parser for literal dots and brackets in YAML key names (e.g., -o 'my.dotted.key=val') [#3835] - @leogr
• chore!: drop gRPC output and server support [#3798] - @ekoops
• chore!: drop gVisor engine support [#3797] - @ekoops
• chore!: drop legacy BPF probe [#3796] - @ekoops

Major Changes

• feat(engine): support string comparator modifiers (oneof/allof/anyof) [#3878] - @therealbobo
• new(config,rules): add capture_events and capture_filesize stop conditions for capture files [#3824] - @leogr
• feat: validation for unknown-key in rules [#3805] - @leogr
• feat(userspace/engine): add support for list transformer exception [#3799] - @irozzo-1A

Minor Changes

• chore(build): Add USE_TSAN option to enable Thread Sanitizer. [#3856] - @irozzo-1A
• build: enable http_output, webserver, and metrics on macOS and Win [#3827] - @leogr

Bug Fixes

• fix(docker): Restrict falco-webui service to local access only [#3838] - @qux-bbb
• fix: show condition text in warning snippet for folded scalar conditions [#3858] - @ssam18
• fix: respect buffered_outputs YAML config value [#3830] - @leogr
• fix(userspace/falco): fix race condition in watchdog [#3820] - @irozzo-1A
• fix(scripts): update RPM repository metadata before signing when re-signing all packages [#3774] - @c2ndev

Non user-facing changes

• chore(cmake): bump libs to 0.25.2 [#3900] - @ekoops
• chore: update falco rules to version 5.1.0 and add rules sub-command to scripts/update-deps-version [#3890] - @ekoops
• chore(chart): move Falco chart source to falco (1/5) [#3889] - @c2ndev
• chore(chart): move Falco chart source to falco [#3884] - @c2ndev
• chore(cmake): bump libs to 0.25.1 and drivers to 10.2.0+driver [#3888] - @ekoops
• upstream multiple http_output fixes for Win/macOS (from prempti) [#3882] - @leogr
• chore: bump container plugin version to 0.7.1 [#3886] - @ekoops
• fix(ci): reference correct input name for sanitizers flag and update systemd-rpm-macros [#3885] - @irozzo-1A
• fix(build): use Zig cross-compilation toolchain for external dependencies [#3881] - @irozzo-1A
• chore(cmake/modules): bump libs version to 0.25.0-rc2 [#3876] - @ekoops
• chore: bump container plugin version to 0.7.0 [#3877] - @ekoops
• ci(.github): replace /area CI with /area automation in PR template [#3870] - @ekoops
• update(cmake): update libs and driver to latest release candidates [#3873] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3868] - @github-actions[bot]
• chore(cmake): bump falcoctl dependency version to 0.13.0 [#3869] - @c2ndev
• fix(userspace/engine): replace invalid chars while JSON-encoding [#3866] - @ekoops
• update(cmake): update libs and driver to latest master [#3864] - @github-actions[bot]
• build(docker): replace apt-key with keyring; use gnupg instead of gnupg2 [#3844] - @parisnakitakejser
• chore(cmake): bump drivers to 10.0.0-rc2+driver [#3863] - @ekoops
• chore(scripts): add script updating libs/drivers cmake module versions [#3862] - @ekoops
• chore(cmake): bump libs/drivers to 0.24.0-rc1/10.0.0-rc1+driver [#3861] - @ekoops
• ci(reusable_test_packages): produce core dumps when falco crashes [#3859] - @ekoops
• fix(config): prevent plugin library path traversal via relative paths [#3850] - @leogr
• fix: multi thread safety issues [#3852] - @leogr
• update(cmake): update libs and driver to latest master [#3823] - @github-actions[bot]
• ci: restore minimum set of required permissions [#3841] - @ekoops
• sync: docs(CHANGELOG.md): 0.43.1 [#3854] - @leogr
• feat(userspace/falco): add support for kernel iterator metrics [#3840] - @ekoops
• docs: multi-thread falco high-level design proposal [#3751] - @irozzo-1A
• fix(cmake): configure falco.yaml from current src dir [#3821] - [@therealbobo](http...

0.44.0-rc2

chore(cmake): bump libs to `0.25.2`

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>

0.44.0-rc1

feat(engine): support string comparator modifiers

Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>

0.43.1

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.43.1
docker pull public.ecr.aws/falcosecurity/falco:0.43.1
docker pull docker.io/falcosecurity/falco-driver-loader:0.43.1
docker pull docker.io/falcosecurity/falco-driver-loader:0.43.1-buster
docker pull docker.io/falcosecurity/falco:0.43.1-debian

v0.43.1

Released on 2026-04-09

Minor Changes

• build: bump libs version to 0.23.2 and container plugin version to 0.6.4 [#3851] - @leogr

Statistics

MERGED PRS	NUMBER
Not user-facing	0
Release note	1
Total	1

Release Manager @leogr

0.43.0

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.43.0
docker pull public.ecr.aws/falcosecurity/falco:0.43.0
docker pull docker.io/falcosecurity/falco-driver-loader:0.43.0
docker pull docker.io/falcosecurity/falco-driver-loader:0.43.0-buster
docker pull docker.io/falcosecurity/falco:0.43.0-debian

v0.43.0

Released on 2026-01-28

Breaking Changes ⚠️

• fix(userspace)!: show source config path only in debug builds [#3787] - @leogr

Minor Changes

• chore: [NOTICE] The GPG key used to sign DEB/RPM packages has been rotated, and all existing packages have been re-signed. New key fingerprint: 478B2FBBC75F4237B731DA4365106822B35B1B1F [#3753] - @leogr
• chore(userspace): deprecate --gvisor-generate-config CLI option [#3784] - @ekoops
• docs: add deprecation notice for legacy eBPF in pkg install dialog [#3786] - @ekoops
• chore(scripts/falcoctl): increase follow interval to 1 week [#3757] - @leogr
• docs: add deprecation notice for legacy eBPF, gVisor and gRPC usage [#3763] - @ekoops
• chore(userspace): deprecate legacy eBPF probe, gVisor engine and gRPC [#3763] - @ekoops
• chore(engine): emit warning when the deprecated evt.latency field family is used in a rule condition or output [#3744] - @irozzo-1A

Bug Fixes

• fix: prevent null pointer crash on popen() failure in output_program [#3722] - @vietcgi
• fix: correct falcoctl.yaml path in debian conffiles [#3745] - @leogr

Non user-facing changes

• revert: chore(.github): temporary action for GPG key rotation [#3766] - @leogr
• chore(cmake): bump falcoctl dependency version to 0.12.2 [#3790] - @ekoops
• chore(cmake): bump falcoctl dependency version to 0.12.1 [#3777] - @ekoops
• chore(cmake): bump container plugin version to 0.6.1 [#3780] - @ekoops
• fix(userspace/engine): missing closing quote in deprecated field warning [#3779] - @leogr
• chore(.github): Put back gpg key rotation workflow [#3772] - @irozzo-1A
• chore(cmake): bump libs/drivers to 0.23.1/9.1.0+driver [#3769] - @ekoops
• chore(cmake): bump container plugin version to 0.6.0 [#3768] - @irozzo-1A
• docs(proposals): add proposal for legacy probe, gVisor engine and gRPC output deprecation [#3755] - @ekoops
• chore(cmake): bump libs/drivers to 0.23.0/9.1.0+driver [#3760] - @ekoops
• update(cmake): update libs and driver to latest master [#3754] - @github-actions[bot]
• fix(metrics): Add null check for state.outputs in metrics collection [#3740] - @adduali1310
• chore(cmake): bump libs to 0.23.0-rc2 [#3759] - @ekoops
• chore(cmake): bump libs/drivers to 0.23.0-rc1/9.1.0-rc1+driver [#3758] - @ekoops
• fix(ci): revert changes to mitigate rate-limitar change [#3752] - @irozzo-1A
• update(cmake): update libs and driver to latest master [#3723] - @github-actions[bot]
• Reduce image size [#3746] - @jfcoz
• docs(RELEASE.md): specify target branch association upon release creation [#3717] - @ekoops
• docs(RELEASE.md): fix rn2md cmd generating changelogs [#3709] - @ekoops
• docs(RELEASE.md): fix PRs filtering expr for checking release notes [#3708] - @ekoops
• docs(RELEASE.md): fix PRs filtering expression text [#3707] - @ekoops

Statistics

MERGED PRS	NUMBER
Not user-facing	21
Release note	11
Total	32

Release Manager @ekoops

0.43.0-rc3

fix(userspace)!: show source config path only in debug builds

  Starting from Falco 0.40, the `falco --help` output incorrectly showed
  the source config path (e.g., /home/runner/work/falco/falco/falco.yaml)
  in release packages. This path was intended only for local development.

  The issue was introduced when RelWithDebInfo build type support was
  added (commit 6bf33ffd). The existing code checked for BUILD_TYPE_RELEASE
  to determine release behavior, but RelWithDebInfo builds defined
  BUILD_TYPE_RELWITHDEBINFO instead, causing them to fall into the
  debug code path.

  This fix introduces BUILD_TYPE_DEBUG and changes the conditionals to
  enable dev features only when CMAKE_BUILD_TYPE is explicitly "debug".
  Both Release and RelWithDebInfo builds now correctly show only
  /etc/falco/falco.yaml.

  Fixes the regression introduced in 0.40.0

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>

0.43.0-rc2

ci: disable `build-win32-package`

Chocolatey registries are currently unavailable, and this is blocking
the release process. Disable the win32 build in CI, in the release
branch, to allow to move forward.

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>

0.43.0-rc1

chore(cmake): bump libs/drivers to `0.23.1`/`9.1.0+driver`

The previously used driver version was already the `9.1.0+driver`:
simply replace the commit SHA with the release name.

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>