Baike.dev
Log in
Back to tool/Back to issues
#3967·falco

[TRACKING] Falco `0.45.0` release

Author: leogrCreated Sep 2, 2026Updated Sep 18, 2026
Labelskind/documentation

Falco 0.45.0 Release

Will keep this issue updated with the current status and progress.

Date

Target release date: September 21st 2026

Release Steps

The process is described in this document.

External dependencies

N.B. Driver tag (decision of Sep 4): 0.26.0 ships with 11.0.0+driver, since the auxmap fix bumps driver/API_VERSION to 11.0.0 (full DBG rebuild, SCAP_MINIMUM_DRIVER_API_VERSION moves to 11.0.0). driver/SCHEMA_VERSION is at 4.5.2 (Sep 7).

N.B. Falco overrides CONTAINER_VERSION in its own CMakeLists.txt, so both pins (libs and falco) have to be bumped.

N.B. The github.com/docker/docker advisories (GHSA-rg2x-37c3-w2rh, GHSA-x86f-5xw2-fm2r, GHSA-vp62-88p7-qqf5, GHSA-pxq6-2prw-chj9) have no patched version and are daemon-side only; falcoctl and the container plugin import the client side only, so they were dismissed as not reachable. Not blocking.

Manual Testing Action Items

  • Running Falco on Kubernetes with the official Helm Charts (rc3 with chart 9.2.0-rc1 on k3s: install, upgrade, uninstall, collector and runtime restarts, Sep 15)
  • Running Falco on Kubernetes with the official operator (rc3 with operator 0.4.1 and chart 0.3.1, Sep 15)
  • Running Falco from RPM and DEB artifacts
    • rc2: DEB on Debian 11 (glibc 2.31) and RPM on Rocky 8 (glibc 2.28), plugin init and rules dry run fine (Sep 11); same on rc3 (Sep 15)
    • service startup, reboot and drivers (rc3: DEB on Ubuntu 24.04 and RPM on Rocky 9, install, upgrade from 0.44.1, reboots, kmod and modern eBPF, uninstall, Sep 15)
  • Running Falco in a container with the official images (rc2 image, container guide and Docker quickstart, Sep 11; rc3 image, Sep 15)
  • Running/fuzzing Falco with multiple event sources active in parallel (rc2: syscalls, k8saudit and container for 20 minutes, no drops, Sep 11; rc3: 5 minutes, no drops, Sep 15)
  • Running/fuzzing Falco with variable syscall buffer dimension (rc2: 1, 8 and 32 MiB buffers plus invalid presets, Sep 11; same on rc3, Sep 15)
  • Running Falco in all officially-supported architectures (x86_64, ARM64)
    • x86_64 (rc2, Sep 11; rc3, Sep 15)
    • ARM64
  • Running Falco with the supported drivers (kmod, modern eBPF, scap files)
    • modern eBPF and scap files (rc2, Sep 11; rc3, Sep 15)
    • kmod (rc3 via DKMS on Ubuntu 24.04 and Rocky 9, Sep 15)
  • Test Falco with event generator (rc2 and rc3, event-generator 0.13.0, Sep 11 and Sep 15)
  • Test that plugins are correctly loaded (rc2: container and k8saudit, from the image and the packages, Sep 11; rc3: same plus k8smeta on Kubernetes, Sep 15)
  • Test memory and CPU usage (with Valgrind and other tools)
    • 20-minute run on rc2: CPU and RSS stable, no drops (Sep 11); 5-minute run on rc3, stable (Sep 15)
    • Valgrind on rc3: validation, replay and error paths, no leaks; one uninitialized field in the savefile FD reader, not blocking https://github.com/falcosecurity/libs/issues/3114 (Sep 16)
  • Test latest version of driver loader (falcoctl 0.14.2 in the rc3 packages and the falco-driver-loader:0.45.0-rc3 image, Sep 15)
  • Test that k8smeta plugin works as expected (0.4.2 on rc3: pod fields, collector and runtime restarts, Sep 15)
  • Test that all Falco CLI options work as expected (rc2, Sep 11; rc3, Sep 15)
  • Check that Falco log messages are correct and consistent
  • Test that Falco ruleset loading and validation works as expected (rc2, Sep 11; rc3, Sep 15)
  • Test the new invalid UTF-8 sequence handling https://github.com/falcosecurity/falco/commit/65273dae

Action Items

Source: falcosecurity/falco

View original on GitHubView discussion on GitHub