What falcosecurity/falco shipped
Written by FoxPlug from public releases; not affiliated with Falco. An automatic summary of the public release, pull request and commit data of github.com/falcosecurity/falco. Falco did not write it and does not use or endorse FoxPlug. Every line links to the public change it describes.
Get a weekly update like this for your product, free
Week of September 21, 2026
What shipped
- Falco 0.45.0 released with packages available for rpm, deb, and tgz formats across
x86_64and aarch64 architectures, plus Docker images. Release - Falco Helm chart version 9.2.0 released to support Falco 0.45.0. Pull request #4012
- Fixed userspace to recover properly when files are removed before watch setup completes. Pull request #4018
- Falco 0.45.0 changelogs added to CHANGELOG.md on master branch. Pull request #4013
- Falco 0.45.0 changelogs generated and added to CHANGELOG.md. Pull request #4011
- Helm check workflow permissions restricted to read-only access instead of inheriting repository write permissions. Pull request #4008
Why it matters
Falco 0.45.0 is now available across multiple platforms and package formats. The release includes bug fixes for file handling in userspace and improved security practices in CI workflows. Users can deploy the new version using their preferred package manager or container platform.
Changelog entry
- 0.45.0 released Release
- fix(userspace): recover from files removed before watch setup Pull request #4018
- fix(ci): restrict Helm check token permissions Pull request #4008
- chart: release 9.2.0 for Falco 0.45.0 Pull request #4012
Falco 0.45.0 is out. Download packages for rpm, deb, and tgz on x86_64 and aarch64, or pull Docker images. Helm chart 9.2.0 available.
Falco 0.45.0 is now available. This release includes packages for rpm, deb, and tgz formats across x86_64 and aarch64 architectures, Docker images, and the Helm chart version 9.2.0. The release features a fix for userspace file handling and improved security in CI workflows.
Week of September 14, 2026
What shipped
- Released 0.45.0-rc4 with reload status exposure and Unix socket control for Falco Operator integration, allowing verification of configuration changes. Release
- Prepared 0.45.0 release with cherry-picked fixes from master including small corrections merged after rc3. Pull request #4004
- Added feature to expose reload status and Unix socket control, enabling Falco Operator to request and verify configuration reloads. Pull request #4005
- Bumped falcoctl to 0.14.2 in build and chart to preserve DKMS installations when installing cached kernel modules. Pull request #3996
- Fixed package upgrades to restore services and drivers, preventing Falco from stopping or leaving the kernel module unloadable after RPM or DEB upgrades. Pull request #3994
- Fixed unsupported syscalls warning to not appear when replaying capture files with -r flag, since event sets do not apply to captures. Pull request #4003
- Removed references to the deleted -A flag from unsupported syscalls warning and debug logs, pointing users to correct configuration methods instead. Pull request #4001
- Updated release workflow to use rn2md build compatible with GitHub App installation tokens for the release-body job. Pull request #3997
- Updated Falco chart subchart constraints to allow falcosidekick 0.14.* and falco-talon latest compatible versions. Pull request #3990
- Refactored
is_capture_modenaming for clearer code semantics. Pull request #4006
Why it matters
This week involved release preparations for 0.45.0 with critical package upgrade fixes that prevent service disruption. The new reload status feature enables Falco Operator integration for safer configuration management. Several bugs affecting users during captures and upgrades were resolved.
Changelog entry
- feat(falco): expose reload status and Unix socket control for Falco Operator integration Release
- build: bump falcoctl to 0.14.2 to preserve DKMS installations Pull request #3996
- fix(packaging): restore services and drivers after RPM and DEB upgrades Pull request #3994
- fix(falco): do not warn about unsupported syscalls when replaying a capture Pull request #4003
- fix(falco): remove references to deleted -A flag from unsupported syscalls warning Pull request #4001
- ci(release): use rn2md build compatible with GitHub App installation tokens Pull request #3997
- chart: update falcosidekick and falco-talon subchart constraints Pull request #3990
0.45.0-rc4 ships with reload status exposure for Falco Operator and fixes for package upgrades. Services and drivers now restore correctly after RPM/DEB updates.
Falco 0.45.0-rc4 brings important improvements for operators and package users. The new reload status feature enables Falco Operator to verify configuration changes via Unix socket control. Critical package upgrade fixes ensure services and drivers restore correctly after RPM and DEB updates, preventing service disruptions. Additional bug fixes address capture replay warnings and improve the user experience for those managing Falco deployments.