What falcosecurity/falco shipped
Written by FoxPlug from the repository's own releases; not affiliated with Falco. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/falcosecurity/falco; Falco did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 26, 2026
What shipped
- Falco 0.45.2 was released, with rpm, deb and tgz packages for
x86_64and aarch64 plus container and driver loader images. Release - Chart 9.2.2 was prepared for Falco 0.45.2 with Falcoctl 0.14.3, container plugin 0.7.6 and an optional Falcosidekick image of 2.35.1, still disabled by default. Pull request #4058
- The bundled OpenSSL was bumped from 3.1.4 to 3.5.9 LTS for Falco 0.45.2. Pull request #4053
- Packaging was refreshed for TLS trust, bumping the bundled container plugin to 0.7.6 and falcoctl to 0.14.3 with verified archive hashes. Pull request #4051
- Image indexes are now combined with buildx imagetools, fixing publication on master that stopped after pushing architecture tags. Pull request #4054
- The packaging, OpenSSL and CI fixes were synced to release/0.45.x for 0.45.2. Pull request #4052
- Docker Hub OIDC authentication was backported to release/0.45.x for 0.45.2 image publishing. Pull request #4055
- The 0.45.2 changelog was added to CHANGELOG.md on the release branch. Pull request #4056
- Chart metadata on master was synced to the published 9.2.1 chart, with Falco 0.45.1, the k8s-metacollector 0.3.* constraint and the 9.2.0 and 9.2.1 changelog entries. Pull request #4045
Why it matters
This week centers on the 0.45.2 release: new packages and images, an updated chart, a refreshed bundled OpenSSL and packaging changes for TLS trust. Users on the release branch also get Docker Hub OIDC publishing, and image publication on master is fixed so multi-architecture images build again.
Changelog entry
- Released Falco 0.45.2 with packages and images. Release
- Prepared chart 9.2.2 for Falco 0.45.2, Falcoctl 0.14.3 and container plugin 0.7.6. Pull request #4058
- Bumped bundled OpenSSL from 3.1.4 to 3.5.9 LTS. Pull request #4053
- Refreshed TLS trust and bundled Go components in packaging. Pull request #4051
- Combined image indexes with buildx imagetools to fix master image publication. Pull request #4054
- Synced packaging, OpenSSL and CI fixes to release/0.45.x. Pull request #4052
- Backported Docker Hub OIDC authentication for 0.45.2. Pull request #4055
- Added the 0.45.2 changelog to CHANGELOG.md. Pull request #4056
- Synced chart metadata on master to the published 9.2.1 chart. Pull request #4045
Falco 0.45.2 is out with rpm, deb and tgz packages and updated images. Chart 9.2.2 is prepared for it, bundled OpenSSL moves to 3.5.9 LTS, and image publication on master is fixed.
Falco 0.45.2 is released with rpm, deb and tgz packages for x86_64 and aarch64, plus container and driver loader images. Chart 9.2.2 is prepared for this release, bringing Falcoctl 0.14.3, container plugin 0.7.6 and an optional Falcosidekick image that stays disabled by default. This week also bumps the bundled OpenSSL from 3.1.4 to 3.5.9 LTS, refreshes packaging for TLS trust with verified archive hashes, backports Docker Hub OIDC authentication for release image publishing, and fixes master image publication with buildx imagetools. The 0.45.2 changelog is in CHANGELOG.md.
Week of October 19, 2026
What shipped
- Falco 0.45.1 was released with RPM, DEB and tgz packages for
x86_64and aarch64 plus container images for falco and falco-driver-loader. Release - Chart 9.2.1 was prepared for Falco 0.45.1 and container plugin 0.7.5. Pull request #4039
- File output recovery and package installation fixes were backported to release/0.45.x and added to the 0.45.1 changelog. Pull request #4038
- File output now recovers from a failed write instead of leaving the output stream unchecked after a write error. Pull request #4036
- The deb postinst and rpm post no longer abort when the kernel cannot run modern eBPF. Pull request #4037
- The chart now mounts /host/proc read-only whenever the driver loader does not run. Pull request #4029
- The procfs and ServiceMonitor chart fixes were backported to release/0.45.x before chart 9.2.1 is published, and ServiceMonitor now requires metrics.enabled=true. Pull request #4043
Why it matters
This week delivered Falco 0.45.1 and the matching chart 9.2.1, so users on the 0.45 line have a new release with packaged fixes. Two of those fixes affect common setups directly: file output can recover from a failed write, and Debian and RPM installs no longer abort on kernels that cannot run modern eBPF. Chart users also get a read-only /host/proc mount when the driver loader does not run, and ServiceMonitor now requires metrics to be enabled.
Changelog entry
- Released Falco 0.45.1 with RPM, DEB and tgz packages for
x86_64and aarch64 and container images for falco and falco-driver-loader. Release - Prepared chart 9.2.1 for Falco 0.45.1 and container plugin 0.7.5. Pull request #4039
- Backported file output recovery and package installation fixes to release/0.45.x and updated the 0.45.1 changelog. Pull request #4038
- Fixed file output to recover from a failed write. Pull request #4036
- Fixed packaging so the deb postinst and rpm post do not abort when the kernel cannot run modern eBPF. Pull request #4037
- Changed the chart to mount /host/proc read-only when the driver loader does not run. Pull request #4029
- Backported the procfs and ServiceMonitor chart fixes and made ServiceMonitor require metrics.enabled=true. Pull request #4043
Falco 0.45.1 is out with RPM, DEB and tgz packages plus container images. It includes file output recovery from failed writes and packaging fixes so postinst and post no longer abort on kernels that cannot run modern eBPF. Chart 9.2.1 follows, including a read-only /host/proc mou
Falco 0.45.1 is released, with RPM, DEB and tgz packages for x86_64 and aarch64 and container images for falco and falco-driver-loader. The release includes two fixes backported to the 0.45 line: file output now recovers from a failed write, and the deb postinst and rpm post no longer abort when the kernel cannot run modern eBPF. Chart 9.2.1 is prepared for Falco 0.45.1 and container plugin 0.7.5, and backports the chart fixes so the Falco container mounts /host/proc read-only whenever the driver loader does not run; ServiceMonitor now requires metrics.enabled=true.
Week of October 12, 2026
What shipped
- Prometheus metrics collection for inspector state now runs on the event-processing thread, fixing a race between the metrics snapshot and the thread table. Pull request #4022
- The chart now renders a ServiceMonitor only when metrics are enabled, so serviceMonitor.create no longer produces a monitor that matches no Service. Pull request #4030
- Final pins replace the release candidate pins with libs 0.26.1 and driver 11.0.1+driver for Falco 0.45.1, and the libs update brings the JSON delta-time fix added after RC1. Pull request #4032
- The final libs 0.26.1 and driver 11.0.1+driver pins were cherry-picked onto release/0.45.x. Pull request #4033
- The Prometheus metrics crash fix was cherry-picked into release/0.45.x as part of the 0.45.1 sync. Pull request #4031
- The 0.45.1 changelog was added, with all six source pull requests checked against the release branch. Pull request #4034
- CI now uses a Docker Hub OIDC connection. Pull request #3966
Why it matters
This week moves Falco 0.45.1 toward release with its changelog and final library and driver pins, including a JSON delta-time fix from libs. It also fixes a metrics crash caused by inspecting state from worker threads and stops the chart from rendering a ServiceMonitor when metrics are disabled.
Changelog entry
- Snapshot inspector metrics on the event thread to fix a race in Prometheus metrics collection. Pull request #4022
- Render the chart ServiceMonitor only when metrics are enabled. Pull request #4030
- Pin libs 0.26.1 and driver 11.0.1+driver for Falco 0.45.1. Pull request #4032
- Sync final libs and driver pins to release/0.45.x. Pull request #4033
- Cherry-pick the Prometheus metrics crash fix into release/0.45.x. Pull request #4031
- Add the Falco 0.45.1 changelog. Pull request #4034
- Use a Docker Hub OIDC connection in CI. Pull request #3966
Falco 0.45.1 prep is in: changelog added, final runtime pins synced, and the Prometheus metrics crash fix cherry-picked to the release branch. Also this week: the chart renders ServiceMonitor only when metrics are on, and CI moves to Docker Hub OIDC.
Work toward Falco 0.45.1 continued this week. The changelog was added and checked against the release branch, and the final libs 0.26.1 and driver 11.0.1+driver pins were synced to release/0.45.x; the libs update also brings a JSON delta-time fix added after RC1. The Prometheus metrics crash fix was cherry-picked into the release branch. Separately, inspector-backed metrics collection now runs on the event-processing thread, which removes a race with the thread table. The Helm chart now renders a ServiceMonitor only when metrics are enabled, so the default configuration no longer produces a monitor that matches no Service. CI also moved to a Docker Hub OIDC connection.
Week of September 21, 2026
What shipped
- Falco 0.45.0 released with packages available for rpm, deb, and tgz formats across
x86_64and aarch64 architectures, plus Docker images. Release - Falco Helm chart version 9.2.0 released to support Falco 0.45.0. Pull request #4012
- Fixed userspace to recover properly when files are removed before watch setup completes. Pull request #4018
- Falco 0.45.0 changelogs added to CHANGELOG.md on master branch. Pull request #4013
- Falco 0.45.0 changelogs generated and added to CHANGELOG.md. Pull request #4011
- Helm check workflow permissions restricted to read-only access instead of inheriting repository write permissions. Pull request #4008
Why it matters
Falco 0.45.0 is now available across multiple platforms and package formats. The release includes bug fixes for file handling in userspace and improved security practices in CI workflows. Users can deploy the new version using their preferred package manager or container platform.
Changelog entry
- 0.45.0 released Release
- Fix(userspace): recover from files removed before watch setup Pull request #4018
- Fix(ci): restrict Helm check token permissions Pull request #4008
- Chart: release 9.2.0 for Falco 0.45.0 Pull request #4012
Falco 0.45.0 is out. Download packages for rpm, deb, and tgz on x86_64 and aarch64, or pull Docker images. Helm chart 9.2.0 available.
Falco 0.45.0 is now available. This release includes packages for rpm, deb, and tgz formats across x86_64 and aarch64 architectures, Docker images, and the Helm chart version 9.2.0. The release features a fix for userspace file handling and improved security in CI workflows.
Week of September 14, 2026
What shipped
- Released 0.45.0-rc4 with reload status exposure and Unix socket control for Falco Operator integration, allowing verification of configuration changes. Release
- Prepared 0.45.0 release with cherry-picked fixes from master including small corrections merged after rc3. Pull request #4004
- Added feature to expose reload status and Unix socket control, enabling Falco Operator to request and verify configuration reloads. Pull request #4005
- Bumped falcoctl to 0.14.2 in build and chart to preserve DKMS installations when installing cached kernel modules. Pull request #3996
- Fixed package upgrades to restore services and drivers, preventing Falco from stopping or leaving the kernel module unloadable after RPM or DEB upgrades. Pull request #3994
- Fixed unsupported syscalls warning to not appear when replaying capture files with -r flag, since event sets do not apply to captures. Pull request #4003
- Removed references to the deleted -A flag from unsupported syscalls warning and debug logs, pointing users to correct configuration methods instead. Pull request #4001
- Updated release workflow to use rn2md build compatible with GitHub App installation tokens for the release-body job. Pull request #3997
- Updated Falco chart subchart constraints to allow falcosidekick 0.14.* and falco-talon latest compatible versions. Pull request #3990
- Refactored
is_capture_modenaming for clearer code semantics. Pull request #4006
Why it matters
This week involved release preparations for 0.45.0 with critical package upgrade fixes that prevent service disruption. The new reload status feature enables Falco Operator integration for safer configuration management. Several bugs affecting users during captures and upgrades were resolved.
Changelog entry
- Feat(falco): expose reload status and Unix socket control for Falco Operator integration Release
- Build: bump falcoctl to 0.14.2 to preserve DKMS installations Pull request #3996
- Fix(packaging): restore services and drivers after RPM and DEB upgrades Pull request #3994
- Fix(falco): do not warn about unsupported syscalls when replaying a capture Pull request #4003
- Fix(falco): remove references to deleted -A flag from unsupported syscalls warning Pull request #4001
- Ci(release): use rn2md build compatible with GitHub App installation tokens Pull request #3997
- Chart: update falcosidekick and falco-talon subchart constraints Pull request #3990
0.45.0-rc4 ships with reload status exposure for Falco Operator and fixes for package upgrades. Services and drivers now restore correctly after RPM/DEB updates.
Falco 0.45.0-rc4 brings important improvements for operators and package users. The new reload status feature enables Falco Operator to verify configuration changes via Unix socket control. Critical package upgrade fixes ensure services and drivers restore correctly after RPM and DEB updates, preventing service disruptions. Additional bug fixes address capture replay warnings and improve the user experience for those managing Falco deployments.