0.26.0

v0.26.0

Released on 2026-09-14

Breaking Changes ⚠️

• fix(cmake)!: the SOVERSION of the shared libraries (libscap, its engine libraries, and libsinsp) now includes the minor version, e.g. libscap.so.0.26 instead of libscap.so.0; downstream packagers of the shared libraries must rebuild dependents and rename runtime packages accordingly [#3099] - @AdrianBunk
• chore!: scap_get_device_by_mount_id() API signature changed [#3027] - @ekoops
• chore!: reject filter values containing NUL bytes [#3051] - @ekoops

Major Changes

• new(modern_bpf): new driver counters n_drops_auxmap_reentrancy, n_drops_auxmap_reentrancy_tail_call and n_drops_auxmap_pool_full (counted in n_drops and reported as n_preemptions in scap_stats), plus n_auxmap_migrations [#3086] - @gnosek
• feat: add support for \xHH escape sequence at filter level [#3051] - @ekoops

Minor Changes

• update: upgrade container plugin to v0.7.4 [#3102] - @leogr
• update(modern_bpf): the probe now checks for BPF atomics at load time; on kernels without them (before 5.12) the per-task auxmap claim is rewritten to a plain store and a WARNING is logged [#3086] - @gnosek
• action required: the driver API_VERSION is now 11.0.0: this userspace only accepts drivers built from 11.0.0+driver, older kmod and eBPF probes are refused [#3086] - @gnosek
• update: upgrade container plugin to v0.7.2 [#3090] - @leogr
• action required: review rules using fd.name_changed on fd-creating events (there shouldn't be any but still) [#3066] - @gnosek
• action required: is_cloned() is removed, switch to is_shared() [#3066] - @gnosek
• action required: chore!: avoid UTF-8 sanitization at ingestion and extraction level [#3051] - @ekoops
• chore: sanitize regex operator input [#3051] - @ekoops

Bug Fixes

• fix(libscap): validate malformed savefile events to prevent out-of-bounds memory access during replay/conversion [#3032] - @leogr
• fix(libsinsp): preserve valid characters around malformed UTF-8 in JSON output [#3108] - @leogr
• fix(libscap): avoid aborting capture conversion when a cached enter event does not match the exit event [#3107] - @leogr
• fix(libpman): stop repeatedly logging an ENOENT warning for the unsupported creat/open TOCTOU tracepoint on architectures where it doesn't exist (e.g. aarch64) [#3085] - @pmj-chosim
• fix(libsinsp): normalize long paths with redundant components before applying the path length limit. [#3096] - @leogr
• fix(modern_bpf): fix auxmap usage under preemptible kernels (the modern eBPF probe now keeps two auxiliary maps per CPU, doubling that memory) [#3086] - @gnosek
• fix(modern_bpf): bpf_loop the sendmmsg/recvmmsg iovec data store [#3021] - @deepskyblue86
• fix(driver): restore kernel module builds on Linux 7.3 for architectures using the fork tracepoint [#3091] - @leogr
• fix: using evt.abspath no longer overwrites fd.name and fs.path.name with the name of the dirfd [#3069] - @gnosek
• fix(libsinsp): use-after-free in the fd table cache triggered by close_range + dup2/dup3 [#3045] - @leogr
• fix(libsinsp): the filter/rule parser now enforces its recursion depth limit, so deeply nested expressions are rejected with an error [#3033] - @leogr
• fix(libsinsp): apply the big-endian evt.rawarg.* byte adjustment on all big-endian targets, not only s390x [#3003] - @Scottcjn
• fix(libsinsp): ppm_event_codes/ppm_sc_codes now resolve statically (un)satisfiable evt.num conditions (e.g. evt.num=0) to the correct event-type set instead of over-approximating to all event types [#3009] - @leogr

Non user-facing changes

• fix(driver): initialize acrret to avoid using uninitialized dev in scap_init() error path [#3104] - @pmj-chosim
• fix(userspace/libpman): the program table names the fields it initializes [#3100] - @gnosek
• chore(ci): serialize the ppc64le driver tests on the shared node [#3098] - @leogr
• feat(userspace/libscap): Add a raw block engine [#3038] - @geraldcombs
• update(userspace/libsinsp): Add a version check macro [#3078] - @geraldcombs
• fix(libsinsp) Don't needlessly assert on macOS and Windows [#3080] - @geraldcombs
• feat(sinsp): CoW individual fdinfos [#3072] - @gnosek
• fix(libscap): prevent crashes when procfs reports duplicate inodes [#3065] - @adduali1310
• refactor(sinsp): make parse/extract inputs class members [#3067] - @gnosek
• fix(libsinsp): add FL_GENERIC flag to mark source-agnostic field classes [2/2] [#3050] - @Wahid7852
• fix(userspace/libsinsp): dedupe async-queue notify fan-out in add_container_group/add_container_user [#3056] - @aroberts87
• fix(ci): install libbpf build deps for the bpfcompat lane [#3055] - @ErenAri
• docs(OWNERS): moving andreagit97 to emeritus [#3054] - @leogr
• fix(modern_bpf): ignore discarded-qualifiers error during libbpf build [#3036] - @sveith
• chore(cmake): Remove some unreachable code [#3037] - @geraldcombs
• cleanup(userspace): Fix some clang warnings on macOS [#3039] - @geraldcombs
• fix(libsinsp): avoid infinite loop on oversized /etc/group lines [#3028] - @gnosek
• ci(latest-kernel): update config name from config to config.x86_64 [#3025] - @ekoops
• cleanup(libsinsp): table cleanup final touches [#3004] - @gnosek
• fix(modern_bpf): reduce BPF instruction count in auxmap__preload_even… [#3022] - @Ravindu-Priyankara
• ci(drivers_ci): run build-scap-open-w-zig on s390x and ppc64le [#3008] - @ekoops
• ci(drivers_ci): build scap-open with zig to check glibc linked version [#3007] - @ekoops
• cleanup(libsinsp): use lambdas to access dynamic/STL fields [#2996] - @gnosek
• test(drivers): account for fifth parameter in socketcall_socketX [#2993] - @ekoops
• chore(userspace/libpman)!: avoid exposing some APIs and make function names consistent [#2990] - @ekoops
• cleanup(ci): disable filter modifiers gbenchs [#2999] - @therealbobo
• cleanup(libsinsp): read/write static table fields using lambdas [#2937] - @gnosek

Statistics

MERGED PRS	NUMBER
Not user-facing	27
Release note	38
Total	65

Release Manager @leogr