0.43.0-rc3

fix(userspace)!: show source config path only in debug builds

  Starting from Falco 0.40, the `falco --help` output incorrectly showed
  the source config path (e.g., /home/runner/work/falco/falco/falco.yaml)
  in release packages. This path was intended only for local development.

  The issue was introduced when RelWithDebInfo build type support was
  added (commit 6bf33ffd). The existing code checked for BUILD_TYPE_RELEASE
  to determine release behavior, but RelWithDebInfo builds defined
  BUILD_TYPE_RELWITHDEBINFO instead, causing them to fall into the
  debug code path.

  This fix introduces BUILD_TYPE_DEBUG and changes the conditionals to
  enable dev features only when CMAKE_BUILD_TYPE is explicitly "debug".
  Both Release and RelWithDebInfo builds now correctly show only
  /etc/falco/falco.yaml.

  Fixes the regression introduced in 0.40.0

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>

0.43.0-rc2

ci: disable `build-win32-package`

Chocolatey registries are currently unavailable, and this is blocking
the release process. Disable the win32 build in CI, in the release
branch, to allow to move forward.

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>

0.43.0-rc1

chore(cmake): bump libs/drivers to `0.23.1`/`9.1.0+driver`

The previously used driver version was already the `9.1.0+driver`:
simply replace the commit SHA with the release name.

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>

0.42.1

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.42.1
docker pull public.ecr.aws/falcosecurity/falco:0.42.1
docker pull docker.io/falcosecurity/falco-driver-loader:0.42.1
docker pull docker.io/falcosecurity/falco-driver-loader:0.42.1-buster
docker pull docker.io/falcosecurity/falco:0.42.1-debian

v0.42.1

Released on 2025-11-06

Non user-facing changes

• docs(CHANGELOG.md): update changelog for 0.42.0 release [#3730] - @leogr

Statistics

MERGED PRS	NUMBER
Not user-facing	1
Release note	0
Total	1

Release Manager @leogr

0.42.0

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.42.0
docker pull public.ecr.aws/falcosecurity/falco:0.42.0
docker pull docker.io/falcosecurity/falco-driver-loader:0.42.0
docker pull docker.io/falcosecurity/falco-driver-loader:0.42.0-buster
docker pull docker.io/falcosecurity/falco:0.42.0-debian

v0.42.0

Released on 2025-10-22

Major Changes

• feat: add falco_libs.thread_table_auto_purging_interval_s and thread_table_auto_purging_thread_timeout_s configuration options [#3670] - @ekoops
• feat: log plugin version info at loading time [#3657] - @FedeDP
• feat: ability to add statically defined fields via static_fields configuration [#3557] - @FedeDP
• feat(engine): emit warning when a rule containing the evt.dir field in output is encountered [#3697] - @irozzo-1A
• feat(engine): emit warning when a rule containing a condition on the deprecated evt.dir field is encountered [#3690] - @irozzo-1A
• new: ability to record .scap files (capture feature) [#3645] - @leogr
• new(docker): includes sha on the image labels [#3658] - @jcchavezs
• new(cmake,userspace,ci): add mimalloc support [#3616] - @FedeDP

Minor Changes

• docs(falco.yaml): refactor config documentation [#3685] - @leogr
• build: fix debian:buster apt debian repo URL in :driver-loader-buster container image [#3644] - @ekoops
• build: updagrade libs to version 0.22.1 [#3705] - @irozzo-1A
• build: upgrade drivers to v9.0.0+driver [#3701] - @irozzo-1A
• build: upgrade cpp-httplib to v0.23.1 [#3647] - @FedeDP
• update: upgrade default ruleset to v5.0.0 [#3700] - @leogr
• build: upgrade falcoctl to v0.11.4 [#3694] - @leogr
• chore(prometheus): deprecate enter events drop stats [#3675] - @irozzo-1A

Bug Fixes

• fix(cmake): correct abseil-cpp for alpine build [#3598] - @RomanenkoDenys
• fix: enable handling of multiple actions configured with syscall_event_drops.actions [#3676] - @terror96
• fix: disable dry-run restarts when Falco runs with config-watching disabled [#3640] - @Proximyst

Non user-facing changes

• fix(userspace/falco): correct default duration calculation [#3715] - @leogr
• chore(falcoctl): update falco rules to version 5 [#3712] - @irozzo-1A
• doc(OWNERS): move incertum (Melissa Kilby) to emeritus_approvers [#3605] - @incertum
• update(cmake): update libs and driver to latest master [#3689] - @github-actions[bot]
• chore(docker): use new ENV syntax in place of deprecated one [#3696] - @ekoops
• chore(cmake/modules): update rules to 5.0.0-rc1 [#3698] - @leogr
• fix(userspace/engine): fix logger date format [#3672] - @ekoops
• docs(OWNERS): add ekoops(Leonardo Di Giovanna) as approver [#3688] - @ekoops
• update(cmake): update libs and driver to latest master [#3665] - @github-actions[bot]
• Refactor: cppcheck cleanups [#3649] - @sgaist
• update(userspace/engine): update falco engine version and checksum [#3648] - @ekoops
• update(cmake): update libs and driver to latest master [#3662] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3661] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3653] - @github-actions[bot]
• chore(ci): disable mimalloc for master builds. [#3655] - @FedeDP
• chore(deps): Bump submodules/falcosecurity-rules from 1208816 to be38001 [#3651] - @dependabot[bot]
• docs(falco.yaml): avoid out-of-sync config options for container pl… [#3650] - @leogr
• update(cmake): update libs and driver to latest master [#3636] - @github-actions[bot]
• update(CHANGELOG.md): release 0.41.3 (cherry-pick) [#3634] - @ekoops
• update(cmake): update libs and driver to latest master [#3628] - @github-actions[bot]
• update(CHANGELOG.md): release 0.41.2 (cherry-pick) [#3623] - @ekoops
• update(cmake): update libs and driver to latest master [#3618] - @github-actions[bot]
• update(cmake): update libs and driver to latest master [#3602] - @github-actions[bot]
• chore(falco.yaml): clean up plugins config leftover [#3596] - @leogr
• chore(deps): Bump submodules/falcosecurity-rules from b4437c4 to 4d51b18 [#3607] - @dependabot[bot]
• update(docs): cherry pick CHANGELOG. [#3600] - [@fed...

0.42.0-rc4

fix(userspace/falco): correct default duration calculation

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

0.42.0-rc3

chore(build): update falco libs dependency to 0.22.1

Signed-off-by: Iacopo Rozzo <iacopo@sysdig.com>

0.42.0-rc2

chore(deps): bump libs version to 0.22.0

Signed-off-by: Iacopo Rozzo <iacopo@sysdig.com>

0.42.0-rc1

feat(engine): emit warning when a rule output uses deprecated "evt.dir"

Emit a warning when a rule uses the deprecated "evt.dir" field in output.

Signed-off-by: Iacopo Rozzo <iacopo@sysdig.com>

0.41.3

Packages	Download
rpm-x86_64
deb-x86_64
tgz-x86_64
tgz-static-x86_64
rpm-aarch64
deb-aarch64
tgz-aarch64

Images
docker pull docker.io/falcosecurity/falco:0.41.3
docker pull public.ecr.aws/falcosecurity/falco:0.41.3
docker pull docker.io/falcosecurity/falco-driver-loader:0.41.3
docker pull docker.io/falcosecurity/falco-driver-loader:0.41.3-buster
docker pull docker.io/falcosecurity/falco:0.41.3-debian

v0.41.3

Minor Changes

• update: bump container plugin to v0.3.1 [#3629] - @FedeDP

Statistics

MERGED PRS	NUMBER
Not user-facing	0
Release note	1
Total	1

Release Manager @leogr @ekoops