Skip to content
TrustMyStack, home

falco

0.45.2
falcosecurity/falco

Cloud Native Runtime Security

Version of falcosecurity/falco you run

CompareView on GitHub
Maintenance
Active72 commits in 3 months · bus factor 5
License
Apache-2.0Permissive · OSI-approved
Security
8 advisories1 critical, 3 high, 1 medium, 3 low · Scorecard 7.5/10
Supported versions
No scheduleendoflife.date does not track this project

9.6k stars · 1.1k forks · 60 open issues · last release 17 days ago · data checked 5 hours ago

OverviewTourReleasesDocker imagesSecurityLogos

Breaking changes

What to check before upgrading, taken from the notes of the last 30 releases.

  • 0.45.0Sep 21, 2026

    Breaking Changes :warning:

    • feat(userspace)!: evaluate rule conditions on raw field bytes (invalid and non-printable UTF-8 sequences are now matchable with string operators, single bytes with the new \xHH escape sequence), let regex operate on sanitized input, and escape non-printable characters / replace invalid UTF-8 sequences at output encoding time; FALCO_ENGINE_VERSION bumped from 0.62.0 to 0.63.0; rules that matched the replacement character with non-regex operators must be reviewed [#3942] - @ekoops
  • 0.44.0May 26, 2026

    Breaking Changes :warning:

    • new!: add backslash escaping support to -o key-path parser for literal dots and brackets in YAML key names (e.g., -o 'my\.dotted\.key=val') [#3835] - @leogr
    • chore!: drop gRPC output and server support [#3798] - @ekoops
    • chore!: drop gVisor engine support [#3797] - @ekoops
    • chore!: drop legacy BPF probe [#3796] - @ekoops
  • 0.43.0Jan 28, 2026

    Breaking Changes :warning:

    • fix(userspace)!: show source config path only in debug builds [#3787] - @leogr
  • 0.41.0May 29, 2025

    Breaking Changes :warning:

    • cleanup(engine)!: only consider .yaml/.yml rule files [#3551] - @LucaGuerra
    • cleanup(userspace)!: deprecate print of container.info [#3543] - @FedeDP
    • cleanup(userspace/falco)!: drop deprecated in 0.40.0 CLI flags. [#3496] - @FedeDP

Release history

All releases on GitHub
Atom feed/feed/falcosecurity/falco
BadgeLatest version of falcosecurity/falco[![version](/badge/falcosecurity/falco)](/p/falcosecurity/falco)

LIBS

DRIVER

| Packages | Download |

| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |

| rpm-x86_64 | rpm |

| deb-x86_64 | deb |

| tgz-x86_64 | tgz |

| tgz-static-x86_64 | tgz-static |

| rpm-aarch64 | rpm |

| deb-aarch64 | deb |

| tgz-aarch64 | tgz |

| Images |

|---------------------------------------------------------------------------|

| docker pull docker.io/falcosecurity/falco:0.45.2 |

| docker pull public.ecr.aws/falcosecurity/falco:0.45.2 |

| docker pull docker.io/falcosecurity/falco-driver-loader:0.45.2 |

| docker pull docker.io/falcosecurity/falco-driver-loader:0.45.2-buster |

| docker pull docker.io/falcosecurity/falco:0.45.2-debian |

v0.45.2

Released on 2026-10-29

Minor Changes

  • update(cmake): bump bundled OpenSSL to 3.5.9 LTS, adopting TLS security level 2 (RSA/DSA/DH keys must be at least 2048 bits and EC keys at least 224 bits) [#4053] - @leogr

Bug Fixes

  • fix(packaging): refresh image CA trust stores for the eMudhra incident, retain the Buster loader with corrected trust, and bundle container plugin 0.7.6 and falcoctl 0.14.3 [#4051] - @leogr

Non user-facing changes

  • fix(ci): combine image indexes with buildx imagetools [#4054] - @leogr

Statistics

| MERGED PRS | NUMBER |

|-----------------|--------|

| Not user-facing | 1 |

| Release note | 2 |

| Total | 3 |

Release Manager @leogr

Full release notesCompare with previous