Skip to content

0.22.0

Choose a tag to compare

View all tags
@ekoops ekoops released this 17 Oct 08:41
0.22.0
5666ef4

MIN_DRIVER_API
MIN_DRIVER_SCHEMA

v0.22.0

Released on 2025-10-17

Breaking Changes ⚠️

  • chore!: drop remaining evt.dir refs in default output fmt and tests [#2681] - @ekoops
  • feat(userspace/libsinsp)!: drop custom connect enter events handling [#2677] - @ekoops
  • feat(userspace/libsinsp/parsers)!: drop redundant connect_x code [#2673] - @ekoops
  • feat!: mark {MESOS,TRACER,K8S}_E as old and TRACER_X` as unused [#2669] - @ekoops
  • feat(userspace/libsinsp)!: filter out syscall enter events [#2667] - @ekoops
  • fix(userspace/libsinsp)!: make filtered evts handling consistent [#2666] - @ekoops
  • feat!: make PPME_SOCKET_{SEND,RECV}MMSG_X "scap converter"-managed [#2665] - @ekoops
  • feat!: drop unused events in scap converter [#2661] - @ekoops
  • feat(userspace/libsinsp)!: filter out PPME_SYSCALL_OPEN_E events [#2662] - @ekoops
  • feat!: stabilize EF_TMP_CONVERTER_MANAGED as EF_CONVERTER_MANAGED [#2659] - @ekoops
  • feat(userspace/libsinsp)!: drop unused parser's reset verdict param [#2658] - @ekoops
  • feat!: prevent event propagation to upper layers for C_ACTION_STORE [#2657] - @ekoops
  • feat!: merge CONVERSION_{COMPLETED,SKIP} into `CONVERSION_PASS [#2657] - @ekoops
  • feat!: let the scap converter drop some uneeded old enter events [#2657] - @ekoops
  • feat!: don't reserve any byte for empty parameters values [#2655] - @ekoops
  • feat!: drop scap files' enter events not eligible for scap conversion [#2653] - @ekoops
  • feat!: make PPME_SYSCALL_EXECVE{AT,_19}_E "scap converter"-managed [#2650] - @ekoops
  • feat!: make PPME_SYSCALL_OPENAT_2_{E,X} "scap converter"-manage [#2649] - @ekoops
  • feat!: make PPME_SYSCALL_OPENAT2_{E,X} "scap converter"-managed [#2649] - @ekoops
  • feat!: make PPME_SYSCALL_CREAT_{E,X} "scap converter"-managed [#2649] - @ekoops
  • feat!: make PPME_SYSCALL_OPEN_{E,X} "scap converter"-managed [#2649] - @ekoops
  • feat(driver)!: add EF_OLD_VERSION to majority of enter events [#2645] - @ekoops
  • feat!: make PPME_CONTAINER_{E,X} "scap converter"-managed [#2644] - @ekoops
  • feat!: make PPME_CONTAINER_JSON_{E,X} "scap converter"-managed [#2642] - @ekoops
  • feat!: make SCHEDSWITCH_1_{E,X} "scap converter"-managed [#2641] - @ekoops
  • feat!: make PPME_SYSCALL_PROCEXIT_{E,X} "scap converter"-managed [#2641] - @ekoops
  • feat!: make PPME_SYSCALL_NEWSELECT_{E,X} "scap converter"-managed [#2641] - @ekoops
  • feat!: make PPME_SYSCALL_OPENAT_{E,X} "scap converter"-managed [#2641] - @ekoops
  • feat!: make PPME_SYSCALL_BPF_{E,X} "scap converter"-managed [#2641] - @ekoops
  • feat!: make PPME_SYSCALL_UMOUNT_{E,X} "scap converter"-managed [#2641] - @ekoops
  • feat!: make PPME_SYSCALL_DUP_{E,X} "scap converter"-managed [#2641] - @ekoops
  • feat!: make PPME_SYSCALL_IOCTL_2_{E,X} "scap converter"-managed [#2641] - @ekoops
  • feat!: make PPME_SYSCALL_BRK_1_{E,X} "scap converter"-managed [#2641] - @ekoops
  • feat(userspace/libsinsp)!: drop deprecated mesos-related filterchecks [#2632] - @ekoops
  • feat!: drop deprecated evtin.* and tracer.* filterchecks support [#2621] - @ekoops
  • feat!: drop brk enter events gen, testing and parsing code [#2589] - @ekoops
  • feat(userspace/libsinsp)!: defer sinsp evt params null-encoding logic [#2558] - @ekoops
  • feat(userspace/libsinsp)!: remove sinsp::get_thread_ref() [#2402] - @ekoops
  • feat(userspace/libsinsp)!: make sinsp_parser::reset() const [#2403] - @ekoops
  • feat(userspace/libsinsp)!: make some sinsp_parser methods const [#2403] - @ekoops

Major Changes

  • feat(sinsp): add plugin required schema version check [#2660] - @irozzo-1A
  • feat(libsinsp): implement timed reset for proc lookup counters [#2483] - @deepskyblue86
  • new(userspace/libsinsp): add a sinsp_filtercheck_static class. [#2405] - @FedeDP

Minor Changes

  • feat!(userspace/libsinsp): remove unused sinsp ptr in tinfo factory [#2525] - @ekoops
  • build: upgrade container plugin to v0.4.0 [#2693] - @leogr
  • update: evt.dir is now deprecated [#2651] - @leogr
  • cleanup(userspace/libsinsp): drop sinsp_parser::m_tmp_events_buffer. [#2570] - @FedeDP
  • update: upgrade container plugin to v0.2.6 [#2471] - @leogr
  • update(cmake): update tbb to v2022.1.0. [#2452] - @FedeDP
  • chore(build): update container plugin to 0.2.4 [#2416] - @LucaGuerra

Bug Fixes

  • fix(userspace/libsinsp): fix extraction of the directory value [#2647] - @terror96
  • fix: check that get_fields function returnes at least one field in plugins with extraction capabilities [#2672] - @irozzo-1A
  • fix(userspace/libsinsp): avoid thread table mem leak when parsing vfork (or equivalent clone/clone3 with CLONE_VFORK) exit from caller process [#2640] - @leogr
  • fix(cmake): Properly quote zlib CFLAGs [#2577] - @bleggett

Non user-facing changes

  • update(event_processor)!: new build_threadinfo API [#2499] - @deepskyblue86
  • chore(deps): Bump actions/upload-pages-artifact from 3.0.1 to 4.0.0 [#2583] - @dependabot[bot]
  • chore(deps): Bump actions/checkout from 4.3.0 to 5.0.0 [#2582] - @dependabot[bot]
  • fix: fix event's fdinfo setting for some event types [#2688] - @ekoops
  • fix(userspace/libpman): fix log statements and attached programs accounting [#2687] - @ekoops
  • docs(release.md): specify expection for tag names [#2685] - @ekoops
  • fix(userspace/libscap/engine/savefile): fall back in case of exception [#2679] - @ekoops
  • fix: fix heap buffer overflow while reading sockaddr in connect parser [#2683] - @ekoops
  • chore(sinsp): add the plugin name in the schema version check error [#2682] - @irozzo-1A
  • chore(cmake/modules): bump container plugin to v0.4.0-rc1 [#2680] - @leogr
  • fix(cmake): rebuild globbed files only if necessary [#2676] - @therealbobo
  • fix(userspace/plugin): resolve get_required_event_schema_version() [#2678] - @ekoops
  • chore(userpsace/libpman): disable logging while searching for ksym btf [#2670] - @ekoops
  • fix(userspace/libscap): push default param as evt result in converter [#2668] - @ekoops
  • refactor: clean parser's reset logic [#2664] - @ekoops
  • fix(ebpf): do not map overlapping perf event buffers [#2663] - @gnosek
  • doc: add plugin driver event schema check proposal [#2646] - @irozzo-1A
  • fix(userspace/libscap): correctly update evt len while adding params [#2654] - @ekoops
  • chore(userspace/plugin): use RTLD_DEEPBIND for loading plugins [#2652] - @leogr
  • feat(userspace/libscap): address unexpected CONVERSION_CONTINUE [#2648] - @ekoops
  • fix(libsinsp): use proper INET6_ADDRSTRLEN buffer size for inet_ntop [#2574] - @hhoffstaette
  • update(OWNERS): add Tero Kauppinen (terror96) as reviewer [#2631] - @terror96
  • chore(ci): bump the valijson version to avoind issues with recent cmake [#2637] - @irozzo-1A
  • feat(userspace/libsinsp/examples): add memory usage stats [#2630] - @ekoops
  • fix(userspace/libsinsp): fix sinsp_evt::extract_typechar() logic [#2619] - @ekoops
  • fix(libscap): cgroupv2 path discovery with empty cgroup2 mountpoint [#2404] - @irozzo-1A
  • update(OWNERS): add Iacopo Rozzo (irozzo-1A) as reviewer [#2603] - @irozzo-1A
  • update(driver): update syscalls tables and driver report. [#2595] - @github-actions[bot]
  • chore(deps): Bump codecov/codecov-action from 5.4.3 to 5.5.0 in the actions group [#2593] - @dependabot[bot]
  • vote: update(OWNERS): add Gerald Combs (geraldcombs) to approvers [#2592] - @geraldcombs
  • ci: bump zig version from 0.14.1 to 0.15.1 [#2596] - @ekoops
  • test(libsinsp_e2e): increase context switching to reduce flakyness [#2598] - @ekoops
  • chore(ci): reduce zig download flakiness [#2597] - @irozzo-1A
  • vote(OWNERS): add Angelo Puglisi (deepskyblue86) to approvers [#2571] - @deepskyblue86
  • refactor(userspace/libsinsp): remove timestamp saving custom logic [#2568] - @ekoops
  • chore(deps): Bump actions/cache from 4.2.3 to 4.2.4 in the actions group across 1 directory [#2580] - @dependabot[bot]
  • chore(deps): Bump the actions group with 2 updates [#2579] - @dependabot[bot]
  • chore(deps): Bump actions/download-artifact from 4.3.0 to 5.0.0 [#2578] - @dependabot[bot]
  • fix(userspace/libsinsp): sinsp_filter_check_user::extract_single return-stack-address [#2575] - @deepskyblue86
  • feat(savefile): add empty parameter support [#2572] - @terror96
  • feat(savefile): added empty parameter support for PPME_SYSCALL_FCHDIR_X [#2569] - @terror96
  • update(cmake): bumped container plugin to 0.3.4. [#2567] - @FedeDP
  • cleanup(libsinsp): utilize get_exit_event_fd_location [#2566] - @terror96
  • fix(userspace/libsinsp): remove state handling for PPM_SYSCALL_LINK and PPM_SYSCALL_LINKAT [#2564] - @terror96
  • feat: make PPME_SYSCALL_VFORK_*_{E, X} versions "scap converter"-managed [#2565] - @ekoops
  • feat: make PPME_SYSCALL_FORK_*_{E, X} versions "scap converter"-managed [#2563] - @ekoops
  • feat: make PPME_SYSCALL_CLONE_*_{E, X} versions "scap converter"-managed [#2562] - @ekoops
  • fix(userspace/libsinsp): remove state handling for PPM_SYSCALL_UNLINK and PPM_SYSCALL_UNLINKAT [#2560] - @terror96
  • feat: make old PPME_SYSCALL_EXECVE_*_{E, X} versions "scap converter"-managed [#2561] - @ekoops
  • feat: make PPME_SYSCALL_EXECVEAT_X "scap converter"-managed [#2559] - @ekoops
  • fix(userspace/libscap): populate error in case of failing stat on fd [#2556] - @ekoops
  • fix(userspace/libsinsp): partially fix filterchecks for empty params [#2554] - @ekoops
  • chore: few defensive enhancements [#2557] - @leogr
  • fix(libscap): add missing fd locations for dup exit events [#2553] - @terror96
  • fix: evt.rawarg.* raw val eval for pids, uids, gids and socktuples [#2552] - @ekoops
  • fix(sinsp_suppress): Fix comm-based suppression to cascade to child processes after /proc scan [#2547] - @fremmi
  • feat: add support for creating events with empty parameters [#2550] - @ekoops
  • fix(userspace/libsinsp): remove state handling for PPM_SYSCALL_RMDIR [#2549] - @terror96
  • fix(testing): adjust gvisor testing for execve [#2548] - @terror96
  • cleanup(libsinsp): retrieve parameters from the prlimit exit events [#2545] - @terror96
  • feat(libscap): support for old PPME_SYSCALL_PTRACE_X events [#2540] - @terror96
  • feat(userspace/libscap): add capability to push empty parameters to scap-converter [#2542] - @ekoops
  • ci: switch debian:buster apt debian repository URL to snapshot URL [#2543] - @ekoops
  • fix(userspace/libsinsp): fix recv data buffer index [#2539] - @ekoops
  • chore(libsinsp): clean "detect container id" comments [#2532] - @deepskyblue86
  • fix: fix scap converter PT_UID parameters default value [#2537] - @ekoops
  • fix(userspace/libsinsp): fix threadinfo ctor params forward decl [#2536] - @ekoops
  • refactor: clean scap converter tests [#2535] - @ekoops
  • feat(libscap/libsinsp): fcntl scap conversion [#2533] - @terror96
  • table_input_adapter [#2530] - @deepskyblue86
  • test/drivers: correct s390x socketcall handling for accept [#2531] - @hbrueckner
  • feat(userspace/libsinsp/example): add -T option to print available tables [#2527] - @deepskyblue86
  • test(e2e): increase sinsp-example init waiting interval [#2526] - @ekoops
  • test(userspace/libsinsp/parsers): check fd info set by epoll_create{1} [#2502] - @ekoops
  • fix(userspace/libsinsp/example): Allow processing scaps with plugins [#2521] - @geraldcombs
  • chore(threadinfo): protected ctor_params [#2515] - @deepskyblue86
  • test(userpsace/libsinsp): add scap conversion test for splice_x [#2518] - @ekoops
  • update(cmake): bumped container plugin to 0.3.1. [#2504] - @FedeDP
  • update(cmake/modules): bump container plugin to 0.3.0 [#2481] - @ekoops
  • fix(userspace/libsinsp): remove state handling for PPM_SYSCALL_MKDIR [#2480] - @terror96
  • fix(userspace/libsinsp): avoid clearing host users and groups tables every minute [#2472] - @FedeDP
  • test: fix tests on ppc64le [#2470] - @ekoops
  • fix(driver): remove the EF_MODIFIES_STATE flag from setpgid [#2465] - @terror96
  • chore(deps): Bump requests from 2.32.2 to 2.32.4 in /test/e2e/tests [#2463] - @dependabot[bot]
  • fix(test/drivers): ignore SO_REUSEPORT setsockopt syscall error [#2462] - @ekoops
  • sinsp_evt init cleanup [#2459] - @deepskyblue86
  • doc(OWNERS): move incertum (Melissa Kilby) to emeritus_approvers [#2458] - @incertum
  • chore(libsinsp): avoid repeating getservbyname [#2457] - @irozzo-1A
  • fix(userspace/libsinsp): properly return after failed assert. [#2451] - @FedeDP
  • test(userspace/libsinsp/scap_files): add assert_num_event_types() [#2448] - @ekoops
  • vote: doc(OWNERS): add ekoops to approvers [#2442] - @ekoops
  • refactor(userspace/libsinsp/parsers): clean chdir handling logic [#2444] - @ekoops
  • ci: update bpfvalidator action [#2439] - @Andreagit97
  • cleanup(userspace/libsinsp): enable names_to_event_set to match async event names [#2396] - @FedeDP
  • chore(deps): Bump dawidd6/action-download-artifact from 9 to 10 [#2440] - @dependabot[bot]
  • fix(plugin): fix and clarify extract offsets docs/tests [#2433] - @gnosek
  • update(ci): update zig to 0.14.1. [#2424] - @FedeDP
  • fix(userspace/libscap/savefile): revert enter event freeing logic [#2438] - @ekoops
  • feat(userpace/libscap): add printing support for PT_DYN parameters [#2434] - @ekoops
  • chore(test/vm): remove localhost test/vm framework [#2437] - @incertum
  • ci: introduce bpfvalidator for modern bpf probe [#2429] - @Andreagit97
  • test(drivers/test_suites/syscall): add coverage for fd parameters [#2423] - @ekoops
  • chore: add /kind test to PR template [#2428] - @ekoops
  • test(sinsp/scap_files): add accept events conversion tests [#2418] - @ekoops
  • fix(userspace/libscap): avoid field access to possibly NULL struct [#2420] - @ekoops
  • fix(userspace/libscap): account unaligned access while printing params [#2421] - @ekoops
  • feat(userspace/libsinsp/examples): add -c and -A options in example [#2415] - @ekoops
  • refactor(libsinsp): use early return in handle_plugin_async_event() [#2400] - @ekoops
  • chore(deps): Bump codecov/codecov-action from 5.4.2 to 5.4.3 in the actions group [#2411] - @dependabot[bot]

Statistics

MERGED PRS NUMBER
Not user-facing 109
Release note 47
Total 156

Release Manager @ekoops

Contributors

ekoops
Assets 2
Loading