Wazuh v5.0.0 Beta 3

What's Changed

• Improve cluster file synchronization error handling by @TomasTurina in #36129
• Update trojan signatures to avoid false positives on modern distros by @Miguevrgo in #35927
• Improve cluster merged file parameter validation by @vikman90 in #36204
• Create a backup of local_rules.xml during execution of IT analysisd tier 0 1 by @Antoniogm03 in #36201
• Improve tmp_file path validation in cluster DAPI by @vikman90 in #36246
• Revert bump main branch by @wazuhci in #36303
• Bump 4.14.7 branch by @wazuhci in #36312
• Serialize procps access to prevent modulesd crash by @cborla in #36261
• Remove obsolete configuration blocks from API upload_configuration setting by @TomasTurina in #36252
• Restore working vulnerability scanner database workflow by @jotacarma90 in #36332
• Propagate agent merged_sum after hot reload in cluster by @jotacarma90 in #36164
• Merge 4.14.7 into main by @jotacarma90 in #36331
• Authd tier 0-1 flaky tests fix by @jotacarma90 in #36342
• Review agent info logs by @Antoniogm03 in #36234
• Fix the wazuh-manager-modules crash that occurs while downloading the feed by @Antoniogm03 in #36337
• Migrate FIM DB path queries to parameterized statements by @Darioortegaleyva in #36399
• Fix AlmaLinux 9/10 bootloader permissions SCA check regex and optional file handling by @vikman90 in #36396
• Cluster file processing parameter validation by @vikman90 in #36296
• Add missing 4.10.2-4.10.5 and 4.8.2 entries to changelogs by @jotacarma90 in #36407
• Treat the absence of the hash document as expected, not an error by @juliancnn in #36355
• geo_point validation support all compatible formats by @LucioDonda in #36034
• Prevent Syscollector and SCA use-after-free on modulesd shutdown by @nbertoldo in #36359
• Add cluster security model and configuration documentation by @vikman90 in #36405
• Bump CB_SCAN_STARTED timeout and trigger ITs on wm_syscollector.c by @jr0me in #36446
• Fixed an issue in eBPF with LSM hooks and improved the health check by @MarcelKemp in #35838
• Validate cluster node name format by @vikman90 in #36460
• eBPF libraries updated by @MarcelKemp in #36467
• Bump 4.14.6 branch by @wazuhci in #36517
• Revert "Bump 4.14.6 branch" by @MARCOSD4 in #36518
• Bump 4.14.6 branch by @wazuhci in #36519
• Update changelog for 4.14.6 RC 1 by @jotacarma90 in #36562
• Fix policy evaluation errors by @fcontrerasc in #36449
• Release startup hash gate when the reload chain fails by @jr0me in #36302
• Revert "Add missing 4.10.2-4.10.5 and 4.8.2 entries to changelogs" by @MarcelKemp in #36591
• Merge merge-4.14.7-into-main into main [automated] by @wazuhci in #36624
• Restore event counter and classify received messages by @jotacarma90 in #36456
• Unify manager integration tests workflows by @ignaciogalle12git in #36235
• Remove unused Node.js 12 from arm64 deb agent builder by @Miguevrgo in #36156
• Remove unused Node.js 12 from arm deb agent builders (4.14.7) by @Miguevrgo in #36157
• SCA typo bug in SELinux SCA rule for CentOS 8/9/10 by @Miguevrgo in #36361
• Fix detect-changes glob to honour ** recursively and extract logic into a reusable action by @Nicogp in #36617
• Merge merge-4.14.6-into-4.14.7 into 4.14.7 [automated] by @wazuhci in #36623
• Reduce log noise when engine has no synchronized ruleset by @NahuFigueroa97 in #36356
• Update test modules paths by @rovogel in #36668
• Only download external deps when required by @TomasTurina in #36244
• Merge 4.14.7 into main by @jotacarma90 in #36664
• Mail forwarding and reporting 5.0 migration guide by @Ripdiegozz in #36357
• Added Ubuntu 26.04's SCA policy in the SPECS by @MarcelKemp in #36712
• Preliminary support new OSs - Ubuntu 26.04 - Add SCA content by @AwwalQuan in #36708
• Safeguards to inventory sync by @juliancnn in #36469
• Improve the method of detecting duplicates by @NahuFigueroa97 in #36344
• Fix race condition preventing inventory synchronization after agent reload by @nbertoldo in #36682
• Added API integration tests workflow by @MiguelazoDS in #36196
• Fix non-atomic write for file_status.json in logcollector by @nbertoldo in #36722
• Make agent-info shutdown waits interruptible by @lchico in #36719
• Validate IP address in ip-customblock active response by @vikman90 in #36730
• wazuh-agent remains active after uninstall on Fedora 44 / DNF5 by @Miguevrgo in #36727
• Use per-target rpath and remove redundant LD_LIBRARY_PATH/WAZUH_ENGINE_GROUP exports by @jotacarma90 in #36455
• Fix changelog chronological order and update bumper script by @Darioortegaleyva in #36729
• Monitoring a symlink without follow_symbolic_link by @Darioortegaleyva in #36081
• SCA policies migration guide from 4.x to 5.x by @jr0me in #36671
• Fix 5x wazuhdb integration tests by @ignaciogalle12git in #36713
• Downgrade transient manager-reported sync failures logs to debug by @jr0me in #36744
• Show sca timouts as Not Run by @jpcerrone in #36258
• Authd workflow creation for 5.x by @jepalfer in #36404
• Adapt remoted tests to 5.x by @Antoniogm03 in #36609
• Update unclassified event criteria by @LucioDonda in #36681
• use safeloader in yaml file loader by @LucioDonda in #36753
• Downgrade expected modulesd socket warnings/errors during agent restart to debug by @jr0me in #36755
• Documentation: Ciscat and openscap migration to SCA by @jpcerrone in #36723
• Document the deprecation of OSquery in order to use IT Hygiene in version 5.0 by @nbertoldo in #36756
• Preserve wazuh-syscheckd Full Disk Access attribution on macOS reload by @Nicogp in #36754
• Normalize severity Msg by @hernanvalenzuela in #36759
• Agent Groups 5x Migration Guide by @fcontrerasc in #36726
• Add NULL validation for optional FlatBuffer fields in inventory_sync by @vikman90 in #36773
• Fix agent keepalive scheduling after system clock rollback by @Darioortegaleyva in #36338
• Create integratord migration guide to 5.x by @Adman23 in #36750
• Syslog output (csyslogd) 5.0 migration guide by @gonzaarancibia in #36741
• Merge merge-4.14.7-into-main into main [automated] by @wazuhci in #36767
• Migration documentation: syslog input alternative by @rovogel in #36781
• Drop libcrypt dependency from Python dep by @jotacarma90 in #36782
• Change duplicated link to intented one by @Miguevrgo in #36794
• Add centralized input validation for active response framework by @vikman90 in #36745
• Fix sca check for etc/shadow by @Miguevrgo in #36795
• Align remoted metrics shipper with new field names by @jotacarma90 in #36740
• Fix wrap PolicyBanner stat in 'sh -c' so glob expands in macOS SCA check 41062 by @Nicogp in #36783
• Bump main branch by @wazuhci in #36801
• Defer module coordination while FIM first sync is in progress by @anromerom in #36762
• Revert "Bump main branch" by @MARCOSD4 in #36802
• Change log severity for recoverable and expected conditions by @hernanvalenzuela in #36786
• Prevent data race in schema validator factory concurrent initialization by @Nicogp in #36789
• Schema generation for dotted and nested field mappings by @jam300 in #36473
• Engine support null values in schema validation by @LucioDonda in #36470
• docs: add Active Response 4.x to 5.x migration guide by @jcorredor-spec in #36402
• Use env mappings for variable passing in builderpackage workflows by @Miguevrgo in #36738
• Adds 4.x to 5.x migration documentation. by @rjcausarano in #36785
• Fix AWS cross-account SQS queue URL when using iam_role_arn by @fcontrerasc in #36791
• Fix enrollment key validation and improve input handling by @vikman90 in #36807
• Lower agent_sync_protocol and module sync log levels to reduce false-alarm noise by @Nicogp in #36817
• Add unit tests for utils, aws_tools, DockerListener, gcloud and azure modules by @AnDumu in #36761
• Normalize numeric inode to string events (6960) by @hernanvalenzuela in #36837
• Prevent indexer consumer wait during shutdown by @jotacarma90 in #36836
• Update manager 5x documentation by @ignaciogalle12git in #36833
• Add bump-issue-link support to bumper workflow by @jotacarma90 in #36868
• Add guide for migrating manager coordinator from 4.x to 5.x by @jepalfer in #36829
• Add Wazuh Manager Configuration documentation from 4.x to 5.x by @Antoniogm03 in #36779
• Add documentation to migrate filebeat to indexer connector by @Antoniogm03 in #36866
• wazuh-manager: Benchmark and footprint by @juliancnn in #36145
• Update manager upgrade block message by @jotacarma90 in #36987
• 5.x PR workflows improvements by @ignaciogalle12git in #36766
• Add Manager 5.0 release notes and breaking changes by @ignaciogalle12git in #36850
• ci(gha): migrate server/manager workflows to AWS CodeBuild runners [main] by @jotacarma90 in #37012
• chore: update vulnerable Python framework dependencies by @jotacarma90 in #37024
• Add Manager 5.0 wazuh-manager.conf configuration reference by @jotacarma90 in #36999
• Add virustotal migration guide by @jepalfer in #37013
• Add VD migration documentation by @ignaciogalle12git in #37008
• Add documentation for wpk upgrade by @Antoniogm03 in #37015
• Migrate agent build workflows to AWS CodeBuild runners by @Nicogp in #37028
• XML Decoders migration to YAML by @jepalfer in #36959
• CDB to KVDB migration guide by @jepalfer in #36996
• Documentation of Agentless migration to 5.x by @Antoniogm03 in #37025
• Fix manager reload/restart silently fails by @ignaciogalle12git in #36962
• Randomize key generation for installation by @jepalfer in #36861
• Retry vulnerability feed validation failures promptly by @jotacarma90 in #36874
• Bump 5.0.0 branch by @wazuhci in #37040
• Fix agent permanently stuck when TCP connection is silently half-closed by @nbertoldo in #36790
• ci(gha): migrate server/manager workflows to AWS CodeBuild runners [4.14.6] by @jotacarma90 in #37010
• ci(gha): migrate server/manager workflows to AWS CodeBuild runners [4.14.7] by @jotacarma90 in #37011
• fix: correct blob URL refs for release branch by @jotacarma90 in #37046
• Use restricted wazuh-server user for Manager Indexer authentication by @jotacarma90 in #37061
• fix(packages): use wazuh-manager-control in manager init.d scripts by @jotacarma90 in #37059
• fix: Update the unclassified event doc by @juliancnn in #37126
• Skip vanished /proc entries during ports scan by @Nicogp in #36859
• Fix RBAC permission check to verify allow effect in update_config rules by @vikman90 in #37076
• Add destination confinement to worker non-merged and extra file sync paths by @jotacarma90 in #36998
• Patch cluster authentication by @ignaciogalle12git in #37039
• Lower stale-session indexer log to debug by @jotacarma90 in #37150
• Limit recursion depth in XML parser by @vikman90 in #37147
• Add status endpoint by @NahuFigueroa97 in #37022
• Add log collectors reference docs by @AnDumu in #37057
• Run the Windows MSI package test on the AWS CodeBuild runner by @nbertoldo in #37165
• Remove merged.mg hash cache to fix stale syscollector flush by @hernanvalenzuela in #37048
• Enrich MITRE fields with id and names by @fcontrerasc in #37054
• Reduce indexer connection warning noise by @jam300 in #37021
• Remove deprecated wazuh-dbd daemon by @vikman90 in #37035
• Bound decompressed size when processing sync archives by @jotacarma90 in #37119
• Bump 4.14.6 branch by @wazuhci in #37176
• Add libcrypt fix (#36782) to 4.14.6 changelog by @jotacarma90 in #37178
• Delay IndexerDownloader connection warnings until 3 failed attempts by @jotacarma90 in #37177
• Add parameterized target selection to Coverity scan workflow by @lchico in #37171
• Align remoted tier 2 CodeBuild setup by @jotacarma90 in #37155
• Add rules migration guide by @Jorgesnchz in #36305
• Migrate agent Linux/Windows test workflows to AWS CodeBuild runners by @Nicogp in #37051
• Silence spurious keepalive warnings on the Windows agent by @nbertoldo in #37187
• wazuh-engine: Improve log messages and logger by @juliancnn in #36995
• Set default indexer connector credentials by @TomasTurina in #37192
• Fix incorrect snprintf size calculation in winevtchannel decoder by @vikman90 in #37198
• Align VD feed-download log levels with indexer consumer state by @jotacarma90 in #37199
• Recognize renamed indexer consumer status in engine sync by @jotacarma90 in #37204
• Merge 4.14.6 into 4.14.7 by @jotacarma90 in #37210
• Token replacement to avoid permission errors by @MarcelKemp in #37237
• Merge 4.14.7 into 5.0.0 by @jotacarma90 in #37211
• Eliminate TOCTOU races in healthcheck file operations by @rjcausarano in #37160
• Sca file policy block standardization by @Johnng007 in #37179
• Bind agent index selection and scope deletes by cluster by @jotacarma90 in #37154
• Add Null Check for Inode and Dev Fields in FIM Whodata Event Handler by @vikman90 in #37245
• Docs/6764 logcollector whats new 5.0 by @AnDumu in #37056
• Repair RPM builder toolchain downloads by @jr0me in #37130
• Add cluster name validation by @TomasTurina in #37238
• Add cluster readiness endpoint by @NahuFigueroa97 in #37129
• Defer cluster payload buffer allocation until data is received by @jepalfer in #37280
• Indexer connector bulk size and flush interval configurable by @LucioDonda in #37158
• Enable shared-password enrollment by default by @ignaciogalle12git in #37151
• Fix unit test workflow paths and report handling by @jotacarma90 in #37317
• Migrate agent + server CI artifacts to S3 — 4.14.7 (#5300, #5298) by @jr0me in #37186
• Handle eol amazon inspector classic by @rovogel in #37194
• Fix wazuh-modulesd missing after macOS agent restart by @cborla in #37020
• Fix test_worker failing unit test by @jepalfer in #37314
• Improve log messages by @Antoniogm03 in #36876
• Improve changelog format by @jotacarma90 in #37332
• Lower log level of transient cluster IPC failures (#37277, #37276) by @jotacarma90 in #37326
• Fix TypeError when sorting agents by version with empty version strings by @TomasTurina in #37323
• Migrate agent + server CI artifacts to S3 — 5.0.0 (#5300, #5298) by @jr0me in #37185
• Validate asset resource names before policy promotion by @jam300 in #37172
• Revert wazuh-server indexer credentials and propagate log context in indexer connector by @jotacarma90 in #37333
• Add VD readiness status HTTP endpoint by @jotacarma90 in #37213
• Use github.workspace for wodles report paths by @Nicogp in #37342
• Skip FIM whodata cases on the tier-2 Linux job (CodeBuild) by @Nicogp in #37291
• Migrate 4.x Windows test runners to AWS CodeBuild by @Nicogp in #37193
• Lower log level of transient queue send failures in modulesd by @lchico in #37345
• Add changelog check workflow by @TomasTurina in #37343
• Add changelog check workflow for 5.0.0 by @TomasTurina in #37351
• Retry OS_SendUnix on ENOBUFS to stop dropping binary sync messages on macOS by @nbertoldo in #37349
• change: Allow null root_decoder as alias of empty string on policy cr… by @juliancnn in #37347
• Fix eBPF FIM whodata for Amazon Linux by @Miguevrgo in #37014
• Merge 4.14.6 into 4.14.7 by @jotacarma90 in #37358
• Bump 5.0.0 branch by @wazuhci in #37371
• Merge 4.14.7 into 5.0.0 by @jotacarma90 in #37360
• Migrate remaining CI artifacts to S3 for the 5.0.0 branch (#3502) by @jr0me in #37350

New Contributors

• @MARCOSD4 made their first contribution in #36518
• @Ripdiegozz made their first contribution in #36357
• @Adman23 made their first contribution in #36750
• @jcorredor-spec made their first contribution in #36402

Full Changelog: v5.0.0-beta2...v5.0.0-beta3