feat(falco): expose reload status and Unix socket control

Add process identity, reload generations, and readiness observation through
GET /reload for Falco Operator integration. Publish readiness after all
enabled sources start and distinguish rejected validation from application.

Add an opt-in Linux Unix socket listener. POST /reload queues a request and
returns 202 with a generation baseline; clients poll GET /reload for the
outcome. Keep POST exclusive to the Unix socket and document TCP observation
independently of reload_control.

Protect the socket with directory ownership, permissions, path checks, and
exclusive listener ownership. Validate its directory during dry-run before
stopping the active runtime, repeat checks at startup, and reject multipart
bodies. Cover status semantics, HTTP behavior, credential isolation, cleanup,
invalid directories, and real reloads with the existing C++ test suite.

Signed-off-by: c2ndev <cannarella.dev@gmail.com>

What's Changed

• Bump 4.14.8 branch by @wazuhci in #37404
• Multi SCA, Decoder and Rule fixes by @Johnng007 in #37434
• Maintain crypto_method on keystore rebuild by @jpcerrone in #37524
• Merge 4.14.7 into 4.14.8 by @vikman90 in #37679
• Fix RBAC permission bypass in GET /security/actions and /security/resources by @vikman90 in #37678
• Validate destination paths when uploading list, rule, and decoder files by @vikman90 in #37691
• Prevent cluster worker from overwriting protected master files by @vikman90 in #37694
• Improve access control on the agent active-configuration endpoint by @vikman90 in #37716
• Fix typo in SCA rules by @Miguevrgo in #37652
• Prevent race condition in Windows RSA key container initialization (randombytes) by @MarcelKemp in #37701
• Limit node expansion in yaml2json by @vikman90 in #37725
• Reorder revoke-token from API integration test by @Antoniogm03 in #37696
• Fix benchmark test_cluster_error_logs test by @jepalfer in #37425
• Correct EnableMulticast expected value in Windows LLMNR checks by @Darioortegaleyva in #37765
• Prevent spurious CRITICAL (1211) queue error during rootcheck/FIM shutdown on WPK upgrade by @Darioortegaleyva in #37715
• Add sshd-session/sshd-auth to default macOS ULS query by @Darioortegaleyva in #37769
• Remove multiple warning messages for each unathorized shared policy by @Miguevrgo in #37741
• Fix typo in SCA rules by @Miguevrgo in #37770
• Fix analysisd deadlock on AR send when the queue is not drained by @ignaciogalle12git in #37764
• Disable OpenSSL runtime CPU probing in Python daemon wrappers by @jotacarma90 in #37839
• Expose audit_uid, audit_gid and effective_uid in eBPF whodata provider by @Darioortegaleyva in #37060
• Reject upgrade commands from the agent channel in wazuh-analysisd by @vikman90 in #37745
• initializeContext thread-safe with std::call_once by @hernanvalenzuela in #37768
• Validate destination paths when deleting rule and decoder files by @vikman90 in #37838
• Use DisplayName and python.exe version for Microsoft Store packages by @Darioortegaleyva in #37441
• Fix analysisd flaky test by @jepalfer in #37754
• Update MITRE mapping in Microsoft Graph rules by @AwwalQuan in #37950
• Validate read path in CDB list file retrieval by @vikman90 in #37901
• Merge 4.14.7 into 4.14.8 by @jotacarma90 in #37971
• Fix flaky content manager component tests caused by a race in the fake server startup by @jotacarma90 in #37902
• Discard_regex values containing a space break argument parsing by @jepalfer in #37929
• Decouple authd use_password invalid test from the manager restart return code by @ignaciogalle12git in #37930
• Prevent empty string version from being stored for agents by @Antoniogm03 in #37934
• Prevent exiting Wazuh-DB worker when oversized message arrives. by @MiguelazoDS in #37850
• Classify SCA policy remoteness by activation source, not file path by @vikman90 in #37953
• Reject undersized legacy-format agent messages in wazuh-remoted by @vikman90 in #38099
• Remove WMI dependancy when installing msi packages by @rjcausarano in #38059
• Remove startup deprecation warning from agent_upgrade by @jotacarma90 in #38085
• Improve login attempt limiting under concurrent requests by @vikman90 in #38135
• Fix out-of-bounds write when generating FIM alerts in wazuh-analysisd by @vikman90 in #38145
• Enforce password validation for empty passwords in update_user by @vikman90 in #38180
• Enforce token revocation for run_as (authorization-context) API sessions by @vikman90 in #38193
• Fix wildcard matching in the installed-files check by @vikman90 in #38213
• Prevent orphaned S3 artifacts and false-positive collisions in AWS integration tests [4.14.8] by @Darioortegaleyva in #38105
• Report macOS 26 and 27 release codenames by @anromerom in #38187
• Validate CDB list paths in list-retrieval and delete cluster callables by @vikman90 in #38214
• Skip 4.x CI checks on draft pull requests by @vikman90 in #38240
• Fix remote-command configuration validation by @vikman90 in #38239
• Revert agent workflows to GitHub runners 4x by @lchico in #38223
• Perpended string "data." in field names removed from FortiAuth rules and decoders by @AwwalQuan in #38195
• Remove stale EC2-timing exclusion in syscollector-rtr by @lchico in #38271
• Validate read paths in group configuration and daemon stats retrieval by @vikman90 in #38339
• Suppress StarletteDeprecationWarning for cluster_control and all framework CLI tools by @jotacarma90 in #38412
• Move the 4.14.8 server workflows to GitHub-hosted runners and add sccache compilation caching by @jotacarma90 in #38460
• Avoid holding exec_sock_mutex while connecting to the exec queue by @jotacarma90 in #38510
• AWS integration tests: isolate concurrent runs on the shared bucket with a per-run S3 namespace (GITHUB_RUN_ID) [4.14.8] by @Darioortegaleyva in #38254
• Remove avoidable copies, double lookups and pessimizing moves in agent-side hot paths by @Miguevrgo in #38234
• Bump 4.14.8 branch by @wazuhci in #39117
• Add the 4.10.5 entry to the changelog by @jotacarma90 in #39303
• Size the FIM alert full_log buffer to the alert instead of OS_MAXSTR by @jotacarma90 in #39404
• Decode audit_gid and audit_group_name in FIM whodata alerts by @Antoniogm03 in #39416
• Change default eBPF whodata loginuid to -1 instead of 0 by @Miguevrgo in #39335
• Fix uid and gid swap when unpacking bpf_get_current_uid_gid() in FIM eBPF whodata by @Miguevrgo in #39402
• Bump 4.14.8 branch by @wazuhci in #39436

Full Changelog: v4.14.7...v4.14.8-rc2

What's Changed

• [Android] Add exit code constants and ProcessExitInfo data model by @IvanBM18 in #5453
• [Android] Implement exit info extraction and process crash parsing by @IvanBM18 in #5454
• [Android] Integrate exit code handling into process_handler by @IvanBM18 in #5455
• [Android] Refine bad build check and testcase manager execution by @IvanBM18 in #5456
• Add cscope and tags files to gitignore by @JuanMBriones in #5465
• Move testcase check from preprocess to main in variant by @PauloVLB in #5472
• [Android] Adds guardrails for non apk fuzzing by @IvanBM18 in #5470

Full Changelog: v2.40.1...v2.40.2

What's Changed

• Update module github.com/rabbitmq/amqp091-go to v1.13.0 [SECURITY] by @renovate[bot] in #5274
• Update github-actions by @renovate[bot] in #5250
• Update dependency golangci/golangci-lint to v2.13.2 by @renovate[bot] in #5251
• Make GitHub App installationId optional when scanning all installations by @kashifkhan0771 in #5275
• [INT-942] Add HumioAPIToken detector by @unsmith in #5258
• Object filtering in S3 by @shahzadhaider1 in #5286
• feat(detectors): add Resend detector by @mwoss in #5103
• Clean up use of wasilibs/go-re2 by @bradlarsen in #5273
• Low-memory Git Scanning by @mariduv in #5257
• Adding no-ignore flag to allow reporting of "ignored" secrets by @jordanTunstill in #5297
• Postgres: drop non-connection URI params before verifying by @jordanTunstill in #5296
• fix(detectors/ngrok): broaden valid bearer tokens matching by @mattbrady-1 in #5152
• ci: avoid Node 20 BuildPulse action by @dustin-decker in #5266
• Introduce a new optional detector interface that will allow us to verify credentials not in the cache by @kvnphvm in #5298
• perf(engine): lowercase prefilter chunks as ASCII in a pooled buffer by @kashifkhan0771 in #5291
• Add documentation for CircleCI source by @kashifkhan0771 in #5268
• Add filesystem source documentation by @kashifkhan0771 in #5285
• Add elasticsearch source documentation by @kashifkhan0771 in #5284
• [SCAN-177] Purge secret parts from verification cache by @casey-tran in #5318

New Contributors

• @mwoss made their first contribution in #5103
• @kvnphvm made their first contribution in #5298

Full Changelog: v3.97.4...v3.97.5

Merge pull request #39313 from wazuh/fix/39170-macos-logged-in-users-…

update(build): bump falcoctl to 0.14.2

Bump the falcoctl binary bundled in the packages and the falcoctl image
used by the chart to 0.14.2, which preserves DKMS installations when
installing cached kernel modules.

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

Tag Suricata 8.0.7 release

v4.10.5

Installer and debug symbols available from https://npcap.com/#download

• Fixed a crash encountered on some systems when upgrading, due to NDIS calling
  NPF_ReturnEx after the driver has been unloaded.

• Changed Npcap's adapter binding ComponentID from INSECURE_NPCAP to
  nmap_npcap, reflecting the change in company name from Insecure.Org, LLC to
  Nmap Software, LLC. Fixes #853.

• Updated libpcap to 1.10.7.