What falcosecurity/falco shipped
Generated by FoxPlug from public activity — not affiliated with Falco.
Week of September 14, 2026
What shipped
- Released 0.45.0-rc4 with reload status exposure and Unix socket control for Falco Operator integration, allowing verification of configuration changes. Release
- Prepared 0.45.0 release with cherry-picked fixes from master including small corrections merged after rc3. Pull request #4004
- Added feature to expose reload status and Unix socket control, enabling Falco Operator to request and verify configuration reloads. Pull request #4005
- Bumped falcoctl to 0.14.2 in build and chart to preserve DKMS installations when installing cached kernel modules. Pull request #3996
- Fixed package upgrades to restore services and drivers, preventing Falco from stopping or leaving the kernel module unloadable after RPM or DEB upgrades. Pull request #3994
- Fixed unsupported syscalls warning to not appear when replaying capture files with -r flag, since event sets do not apply to captures. Pull request #4003
- Removed references to the deleted -A flag from unsupported syscalls warning and debug logs, pointing users to correct configuration methods instead. Pull request #4001
- Updated release workflow to use rn2md build compatible with GitHub App installation tokens for the release-body job. Pull request #3997
- Updated Falco chart subchart constraints to allow falcosidekick 0.14.* and falco-talon latest compatible versions. Pull request #3990
- Refactored is_capture_mode naming for clearer code semantics. Pull request #4006
Why it matters
This week involved release preparations for 0.45.0 with critical package upgrade fixes that prevent service disruption. The new reload status feature enables Falco Operator integration for safer configuration management. Several bugs affecting users during captures and upgrades were resolved.
Changelog entry
- feat(falco): expose reload status and Unix socket control for Falco Operator integration Release
- build: bump falcoctl to 0.14.2 to preserve DKMS installations Pull request #3996
- fix(packaging): restore services and drivers after RPM and DEB upgrades Pull request #3994
- fix(falco): do not warn about unsupported syscalls when replaying a capture Pull request #4003
- fix(falco): remove references to deleted -A flag from unsupported syscalls warning Pull request #4001
- ci(release): use rn2md build compatible with GitHub App installation tokens Pull request #3997
- chart: update falcosidekick and falco-talon subchart constraints Pull request #3990
0.45.0-rc4 ships with reload status exposure for Falco Operator and fixes for package upgrades. Services and drivers now restore correctly after RPM/DEB updates.
Falco 0.45.0-rc4 brings important improvements for operators and package users. The new reload status feature enables Falco Operator to verify configuration changes via Unix socket control. Critical package upgrade fixes ensure services and drivers restore correctly after RPM and DEB updates, preventing service disruptions. Additional bug fixes address capture replay warnings and improve the user experience for those managing Falco deployments.