GitHub Release: crowdsecurity/crowdsec v1.8.2-rc1 (13.10.2026)

Changes

• AGENTS.md: clearer guidance on tests (#4713) @blotus


• pimp readme (#4701) @buixor

New Features

• [bot-detection] Add custom JS fingerprinting capabilities (#4657) @buixor

Improvements

• exprhelpers: LookupHost goes through the DNS cache (#4741) @twiesing


• metrics: add CAPI last pull timestamp and error counter (#4749) @NazarkinRoman


• add cscli bot subcommand (#4666) @blotus


• prometheus: add kind label to cs_alerts (#4742) @blotus


• lapi: make decisions stream page size configurable (#4733) @tommy-ng0


• Fix ValidateChallengeResponse (#4737) @buixor


• grok: only keep capture groups that can be accessed in evt.Parsed (#4736) @blotus


• grokky : preshot static strings (#4731) @buixor, @Copilot


• grokky : ParseInto (#4729) @buixor


• bot-detection: add new FlagSubmission() helper (#4727) @blotus


• appsec: add an optional category to the request score (#4715) @buixor


• apiserver: reload the TLS server certificate when its files change (#4709) @ohartwig


• fix image link (#4702) @buixor


• waf: add SkipProcessing() helper (#4667) @blotus


• [bot-detection] drop the URI from the cookie (#4656) @buixor

Bug Fixes

• waf: fix log spam when usin unix socket on freebsd (#4745) @blotus


• docker: read from now if container restarts (#4605) @blotus


• splunk-notification: add an option to configure InsecureSkipVerify (#4720) @blotus


• victorialogs: move the datasource to RestartableStreamer interface (#4738) @blotus


• metrics: remove series of deleted machines and bouncers (#4712) @somaz94


• postoverflow: run them in a goroutine to not block writers, enforce max in-flight alerts, and warn if queue is becoming too full (#4672) @blotus


• buckets: make a copy of all event maps before pouring the event to a bucket (#4481) @blotus


• fix(database): keep simulated decisions from suppressing real bans (#4679) @4erdenko, @blotus


• fix a nasty bug in transfrom where the effective uuid for a datasource (#4697) @sabban


• hubtest: add a tiebreaker based on the alert date to have a consistent order (#4699) @blotus


• challenge: optimize memory usage (#4674) @blotus


• syslog: copy buffer before handing it to the datasource (#4690) @blotus


• Expand env vars in online_api_credentials.yaml (#4677) @kushiemoon-dev

Chore / Deps

• waf: update to coraza 3.8.0 (#4724) @blotus, @buixor


• build(deps): bump the gomod group across 1 directory with 19 updates (#4730) @dependabot[bot]


• CI: skip more docker tests on windows (#4728) @blotus


• grok: embed grok library instead of having it as a dep (#4725) @blotus


• docker datasource: skip tests on windows (#4719) @blotus


• agents.md: keep comments to a reasonable level (#4716) @blotus


• build(deps): bump the github-actions group with 7 updates (#4693) @dependabot[bot]


• build(deps): bump the gomod group with 11 updates (#4694) @dependabot[bot]


• build(deps): bump github.com/go-openapi/validate from 0.26.5 to 1.0.0 (#4682) @dependabot[bot]


• build(deps): bump the gomod group with 19 updates (#4681) @dependabot[bot]


• build(deps): bump cryptography from 48.0.1 to 50.0.0 in /build/docker/test (#4591) @dependabot[bot]


• bump to go 1.27 (#4675) @blotus


• build(deps): bump the github-actions group across 1 directory with 3 updates (#4658) @dependabot[bot]


• build(deps): bump the gomod group across 1 directory with 21 updates (#4659) @dependabot[bot]

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.