Shipped · DevOps and infrastructure

What crowdsecurity/crowdsec shipped

The public repository of Crowdsec · github.com/crowdsecurity/crowdsec

Written by FoxPlug from the repository's own releases; not affiliated with Crowdsec. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/crowdsecurity/crowdsec; Crowdsec did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.

Get a weekly update like this for your product, free

Or Use it as a GitHub Action

See the update FoxPlug writes for crowdsec, free

Week of October 19, 2026

What shipped

Why it matters

This week adds controls that operators can apply directly: rate limiting in the WAF pre_eval, cookie attribute configuration for bot detection challenges, and a metric that shows which features an instance has enabled. It also fixes the file datasource dropping lines during bursty writes and repairs tests for the new WAF helper.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

V1.8.2-rc2 is out. WAF now has a RateLimit() helper for pre_eval, bot detection can set SameSite=None with Partitioned and Secure, a new cs_features metric shows which features an instance runs, and file acquisition no longer drops lines on bursty writes.

Post for LinkedIn

V1.8.2-rc2 is available. The WAF adds a RateLimit() helper for pre_eval, taking a limiter name and a window like 5/m and returning 429 when the client IP goes over it. Bot detection has a new challenge.cookie_same_site option accepting lax or none, and none also sets the Partitioned and Secure flags. A new cs_features Prometheus metric records whether LAPI, CAPI, PAPI, WAF and bot detection are enabled on an instance, using 0 for disabled and 1 for enabled. The file acquisition datasource no longer sends half-written lines or skips the lines after them, and the tests for the WAF helper were fixed after a merge without rebase.

Week of October 12, 2026

What shipped

Why it matters

This week adds controls for keeping the local API responsive when many bouncers pull decision streams at once, and gives WAF out-of-band processing its own workers so request latency does not include both stages under load. It also lets profiles escalate ban length per scenario instead of counting an IP's decisions across all scenarios, and brings consistent local-time timestamps to cscli output.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week: a new config key to cap concurrent decision stream requests, dedicated WAF workers for out-of-band rules, GetDecisionsSinceCountByScenario for per-scenario ban escalation, local-time timestamps in cscli, coraza 3.8.0, and v1.8.2-rc1.

Post for LinkedIn

This week's changes for crowdsec: the decisions stream endpoint can be limited with a new config key, api.server.decisions_stream.max_concurrent_requests, sitting next to the page size setting. WAF out-of-band rules now run on dedicated workers, so the worker that handled in-band rules stays available for new requests under load. A new expression helper, GetDecisionsSinceCountByScenario, counts decisions per scenario so profiles can escalate ban length per scenario instead of across all scenarios at once. cscli now displays human-readable timestamps in local time across alerts, bouncers, machines, allowlists and metrics. Also: WAF updated to coraza 3.8.0, a fix for log spam with unix sockets on FreeBSD, two remaining runtime Fatalf calls removed, fpscanner using fork, and the v1.8.2-rc1 re

Week of October 5, 2026

What shipped

Changelog entry

Week of September 28, 2026

What shipped

Why it matters

This week addresses performance, reliability, and operational concerns. Asynchronous postoverflow processing eliminates pipeline blocking from slow I/O operations, while TLS certificate reloading removes the need for restarts in containerized environments. Bug fixes prevent decision stream corruption and datasource mismatches.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

New release: postoverflow async processing eliminates pipeline blocking, TLS certs reload without restart, metrics cleanup, bug fixes for decisions and datasources.

Post for LinkedIn

This week's release focuses on performance and operations: postoverflow nodes now run asynchronously to prevent pipeline blocking from slow operations, TLS certificates auto-reload for Kubernetes deployments, deleted machine/bouncer metrics are cleaned up, and we fixed regressions in the decision stream and datasource handling.

More from crowdsecurity/crowdsec on GitHub

Merged pull requests

Weeks with too little public activity are left out rather than filled in. Last updated 2026-10-27.

Is this your repo? Ask us to remove this page.