RATATOSKRATATOSK
Sign in

Falco

0.43.0Security
Jan 28, 2026

CHECK 2PLAN 4OTHER 16

Falco 0.43.0 changes release-build output, deprecates several userspace interfaces, and updates package signing. It also includes dependency updates, ordinary correctness fixes, and a smaller image.

Check if affected (2)

  • breakingsource-config-path output limited to debug builds

    Applies when you use release builds.

    source-config-path output is now shown only in debug builds. Release builds no longer include this output.

  • breakingDEB and RPM package-signing key rotation

    Applies if you install DEB or RPM packages.

    The GPG key used to sign DEB and RPM packages was rotated, and existing packages were re-signed. The new key fingerprint is 478B2FBBC75F4237B731DA4365106822B35B1B1F.

Plan ahead (4)

  • deprecatedThe --gvisor-generate-config CLI option, deprecated

    Applies if you use the --gvisor-generate-config CLI option.

    The --gvisor-generate-config CLI option is deprecated in Falco 0.43.0.

  • deprecatedThe legacy eBPF probe, deprecated

    Applies if you use the legacy eBPF probe.

    The legacy eBPF probe is deprecated in Falco 0.43.0.

  • deprecatedThe gVisor engine, deprecated

    Applies if you use the gVisor engine.

    The gVisor engine is deprecated in Falco 0.43.0.

  • deprecatedgRPC, deprecated

    Applies if you use gRPC.

    gRPC is deprecated in Falco 0.43.0.

All 16 other recorded changesvalue changes 12 · fixes 3 · additions 1

value changes (12)

  • * chore(scripts/falcoctl): increase follow interval to 1 week
  • * chore(cmake): bump falcoctl dependency version to …×2
  • * chore(cmake): bump container plugin version to 0.6.1
  • * chore(cmake): bump libs/drivers to …/…×2
  • * chore(cmake): bump container plugin version to 0.6.0
  • * update(cmake): update libs and driver to latest master×2
  • * chore(cmake): bump libs to 0.23.0-rc2
  • * chore(cmake): bump libs/drivers to 0.23.0-rc1/9.1.0-rc1+driver
  • * Reduce image size

fixes (3)

  • * fix: prevent null pointer crash on popen() failure in output_program
  • * fix: correct falcoctl.yaml path in debian conffiles
  • * fix(metrics): Add null check for state.outputs in metrics collection

additions (1)

  • * chore(engine): emit warning when the deprecated evt.latency field family is used in a rule condition or output
Add Falco to your stack

A weekly email arrives when a release needs action. Like the breaking changes in this release.

Add to stack →
Official release note ↗All Falco releases →