# Falco 0.45.0

> Security · 2026-09-21

A behavior-changing release with new reload and chart capabilities, operator-facing fixes, dependency updates, and security fixes. Rule evaluation semantics change for raw field bytes, and existing rules that depend on replacement-character matching may need review.

## Action needed
- **[security]** Symlink-safe `pidfile` opening
  - Falco opens the `pidfile` with `O_NOFOLLOW`. This prevents a symlink TOCTOU when the `pidfile` path is in an attacker-writable directory.
- **[security]** Absolute `modprobe` path for kernel module loading
  - Falco uses the absolute `modprobe` path instead of a `PATH` lookup when it falls back to loading the kernel module. This addresses the untrusted search path issue identified as `CWE-426`.
- **[breaking]** Rule evaluation on raw field bytes
  - Falco now evaluates rule conditions on raw field bytes. Invalid and non-printable UTF-8 sequences can match string operators, single bytes can use the new `\xHH` escape sequence, `regex` operates on sanitized input, and non-printable or invalid characters are escaped or replaced at output encoding time. `FALCO_ENGINE_VERSION` changes from `0.62.0` to `0.63.0`, so rules that matched the replacement character with non-regex operators need review.

## Plan ahead
- **[deprecated]** `container_engines` configuration schema removal
  - The `container_engines` leftovers are removed from the Falco configuration JSON schema. Configurations that still set `container_engines` log a schema validation warning at startup.

## Other recorded changes
- 20 (defect_corrected 13, value_changed 4, added 2, constraint_changed 1)

[Full analysis](https://ratatosk.io/en/releases/falco/0.45.0)

[Original release notes](https://github.com/falcosecurity/falco/releases/tag/0.45.0)