crowdsec

Version 1.8.2

• Brings custom JS fingerprinting capabilities to the bot detection feature, allowing both users and us to distribute detection rules directly via the hub.
• Brings rate limiting feature to the WAF.
• Brings performance improvements to the Security Engine, optimizing both memory copy behaviors and relying on static analysis to avoid processing unnecessary regular expressions.
• Brings performance improvements to the WAF, optimizing out-of-band rules processing.
• Brings performance improvements to the Bot Detection, optimizing memory usage.

New Features & Major improvements

• [WAF] Add RateLimiting feature (#4721) @blotus
• [bot-detection] Add custom JS fingerprinting capabilities (#4657) @buixor
• [bot-detection] Add cscli bot subcommand (#4666) @blotus
• [WAF] Improve out-of-band rules performances (#4722) @blotus
• [Security Engine] Run postoverflows in a separate goroutine to avoid blocking on slow enrichments (#4672) @blotus
• [bot-detection] Improve memory usage (#4674) @blotus
• [Security Engine] Various performance improvements to regular expression processing (#4736) (#4731) (#4729) @blotus @buixor

Improvements

• Add cs_features metric (#4770) @blotus
• bot detection: add an option to set SameSite=None + Partitioned flag on cookie (#4764) @blotus
• exprhelpers: add GetDecisionsSinceCountByScenario (#4756) @tommy-ng0
• lapi: optionally limit concurrent decision stream requests (#4747) @tommy-ng0
• exprhelpers: LookupHost goes through the DNS cache (#4741) @twiesing
• metrics: add CAPI last pull timestamp and error counter (#4749) @NazarkinRoman
• prometheus: add kind label to cs_alerts (#4742) @blotus
• lapi: make decisions stream page size configurable (#4733) @tommy-ng0
• Fix ValidateChallengeResponse (#4737) @buixor
• bot-detection: add new FlagSubmission() helper (#4727) @blotus
• appsec: add an optional category to the request score (#4715) @buixor
• apiserver: reload the TLS server certificate when its files change (#4709) @ohartwig
• fix image link (#4702) @buixor
• waf: add SkipProcessing() helper (#4667) @blotus
• [bot-detection] drop the URI from the cookie (#4656) @buixor

Bug Fixes

• acquisition/file: don't send half-written lines, or skip the lines after them (#4678) @n1koo, @blotus, @claude
• fix(cscli): display human-readable timestamps in local time (#4759) @sep2
• remove runtime Fatalf calls (#4760) @blotus
• waf: fix log spam when usin unix socket on freebsd (#4745) @blotus
• docker: read from now if container restarts (#4605) @blotus
• splunk-notification: add an option to configure InsecureSkipVerify (#4720) @blotus
• victorialogs: move the datasource to RestartableStreamer interface (#4738) @blotus
• metrics: remove series of deleted machines and bouncers (#4712) @somaz94
• buckets: make a copy of all event maps before pouring the event to a bucket (#4481) @blotus
• fix(database): keep simulated decisions from suppressing real bans (#4679) @4erdenko, @blotus
• fix a nasty bug in transfrom where the effective uuid for a datasource (#4697) @sabban
• hubtest: add a tiebreaker based on the alert date to have a consistent order (#4699) @blotus
• syslog: copy buffer before handing it to the datasource (#4690) @blotus
• Expand env vars in online_api_credentials.yaml (#4677) @kushiemoon-dev

Chore / Deps

• build(deps): bump the gomod group with 5 updates (#4778) [@dependabot[bot]](https://github.com/apps/dependabot)
• build(deps): bump the github-actions group with 2 updates (#4777) [@dependabot[bot]](https://github.com/apps/dependabot)
• build(deps): bump certifi from 2026.1.4 to 2026.10.19 in /build/docker/test (#4780) [@dependabot[bot]](https://github.com/apps/dependabot)
• build(deps): bump the github-actions group across 1 directory with 8 updates (#4766) [@dependabot[bot]](https://github.com/apps/dependabot)
• build(deps): bump the gomod group with 16 updates (#4767) [@dependabot[bot]](https://github.com/apps/dependabot)
• build(deps): bump the gomod group with 8 updates (#4753) [@dependabot[bot]](https://github.com/apps/dependabot)
• fpscanner: use fork (#4761) @blotus
• waf: update to coraza 3.8.0 (#4724) @blotus, @buixor
• build(deps): bump the gomod group across 1 directory with 19 updates (#4730) [@dependabot[bot]](https://github.com/apps/dependabot)
• CI: skip more docker tests on windows (#4728) @blotus
• grok: embed grok library instead of having it as a dep (#4725) @blotus
• docker datasource: skip tests on windows (#4719) @blotus
• agents.md: keep comments to a reasonable level (#4716) @blotus
• build(deps): bump the github-actions group with 7 updates (#4693) [@dependabot[bot]](https://github.com/apps/dependabot)