deps(compose): Update crowdsecurity/crowdsec Docker tag to v1.8.1

[renovate]

This PR contains the following updates:

Package	Update	Change
crowdsecurity/crowdsec	minor	v1.7.8 → v1.8.1

---

Release Notes

crowdsecurity/crowdsec (crowdsecurity/crowdsec)

v1.8.1

Compare Source

This release fixes a false positive in the bot detection feature for Brave Browser with shields enabled.

Changes

Improvements

• add HasValidChallengeCookie() helper (#​4648) @​blotus

Bug Fixes

• lapi: return an empty slice instead of null when querying alerts (#​4653) @​blotus
• challenge: tolerate strings instead of struct in FP payload (#​4655) @​blotus

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

v1.8.0

Compare Source

Bot detection with CrowdSec WAF

This release brings a major change to the CrowdSec WAF: a bot detection feature.

If enabled, clients will be served a challenge + fingerprinting page before accessing the website.
CrowdSec will evaluate the challenge and check the fingerprint against pre-configured rules to decide whether the client looks legitimate or not.

You can find more information about this new feature in the documentation.

Other notable changes include:

• A dedicated kubernetes datasource: crowdsec will fetch logs directly from the k8s apiserver
• New HTTP helpers for the expression language, to query external services from parsers and scenarios
• Performance improvements on the decisions stream endpoint in LAPI

Security Notice

This release fixes 2 denial of service vulnerabilities in the HTTP and k8s-audit datasources:

• HTTP acquisition datasource lacks a decompressed body cap and trusts Content-Length: GHSA-g2x2-jgfg-pg7g
• Unbounded request-body read in kubernetes-audit acquisition webhook: GHSA-rh69-4vqj-9gj8

New Features

• k8s log acquisition datasource (#​4221) @​sabban
• Waf challenge mode (#​4268) @​blotus

Improvements

• challenge: detect if cookies are disabled and display an explicit error message (#​4628) @​blotus
• db: add composite index for decision dedup (#​4619) @​blotus
• Improve pow solving : optimize & increase difficulty (#​4617) @​buixor
• Bot detection unify scores (#​4608) @​buixor
• Dedup code reject submission alert generation (#​4606) @​buixor
• make RejectSubmission generate an alert (#​4602) @​buixor
• waf challenge: add threshold support (#​4593) @​blotus
• revamp 'cscli console status' to be all-in-one (#​4592) @​buixor
• [bot-detection] Fix leak of background pre-warmer goroutine (#​4589) @​buixor
• waf: allow to configure auth timeout to LAPI (#​4585) @​blotus
• Add cs_machines_heartbeat_seconds metric (#​4569) @​kushiemoon-dev
• Cscli hub list improvements (#​4567) @​buixor
• expr: add HTTP helpers (#​4533) @​blotus

Bug Fixes

• leakybuckets: make alerts own their strings (#​4643) @​blotus
• alerts: create metas only if alert was not discarded (#​4633) @​blotus
• k8s-audit: add support for max body size (#​4630) @​blotus
• Usage metrics: set a maximum payload size (#​4629) @​blotus
• lapi: use decision id as cursor for delta pull (#​4620) @​blotus
• acquis(http): Set default max body size and enforce it as well for compressed streams (#​4616) @​blotus
• acquisition: fix transformation being ignored (#​4609) @​blotus
• fpscanner: add missing fields (#​4604) @​blotus
• docs: fix broken Vagrant include link in test README (#​4594) @​latent-9
• challenge: require SSE4.1 + WX memory (#​4590) @​blotus
• WAF: supress erroneous warnings/errors when loading config / no rule has matched (#​4587) @​blotus
• Bot Detection: keep the original URL in the generated alert (#​4586) @​buixor
• fix(docker): allow spaces in ENROLL_INSTANCE_NAME (#​4582) @​sahilnyk
• apiclient: return nil response if we couldnt connect to LAPI (#​4573) @​blotus
• cscli lapi register: no error if the credentials file does not exist (#​4570) @​lopster568
• fix(docker): avoid panic on colliding nested crowdsec labels (#​4555) @​arpitjain099
• fix(syslog): don't close the shared acquisition output channel (#​4553) @​alxrxs
• waf: track id/name pairs for all subrules (#​4505) @​blotus
• apiserver: prevent from fetching JWT token from query string (#​4554) @​blotus
• fix(leakybucket): emit overflow before pouring the next event (#​4547) @​blotus
• loki: prevent duplicate log ingestion and improve timestamp handling (#​4498) @​Anulo2
• db: use proper mutex when checking if flush can happen (#​4528) @​blotus
• db: do not flush alerts with active decisions (#​4527) @​blotus
• Fix Distinct() panic on []string and other non-[]any slices (#​4543) @​Synvoya
• fix(docker): bouncer name strips wrong field from Docker secrets path (#​4490) @​tejgokani

Chore / Deps

• build(deps): bump astral-sh/setup-uv from 8.3.2 to 10.0.1 (#​4625) @​dependabot[bot]
• build(deps): bump google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 (#​4627) @​dependabot[bot]
• build(deps): bump the gomod group with 16 updates (#​4626) @​dependabot[bot]
• build(deps): bump the github-actions group with 3 updates (#​4624) @​dependabot[bot]
• add claude.md to unify contribs (#​4618) @​buixor
• build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#​4580) @​dependabot[bot]
• build(deps): bump actions/setup-python from 6.3.0 to 7.0.0 (#​4578) @​dependabot[bot]
• build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#​4577) @​dependabot[bot]
• build(deps): bump the github-actions group across 1 directory with 5 updates (#​4576) @​dependabot[bot]
• build(deps): bump the gomod group across 1 directory with 16 updates (#​4612) @​dependabot[bot]
• acquisition tests: do not rely on hardcoded timeout to finish tests (#​4610) @​blotus
• challenge: skip pre-warm in tests (#​4611) @​blotus
• challenge: update fpscanner to 1.0.8 (#​4598) @​blotus
• build(deps): bump the gomod group with 6 updates (#​4588) @​dependabot[bot]
• ci(bats): fix scenarios badge color variable name (#​4551) @​blotus
• ci(docker): inherit secrets so the docker environment secrets resolve (#​4550) @​blotus
• build: use version based on latest for dev builds (#​4583) @​blotus
• build(deps): bump the gomod group with 19 updates (#​4581) @​dependabot[bot]
• build(deps): bump github.com/quic-go/quic-go from 0.57.0 to 0.59.1 (#​4499) @​dependabot[bot]
• build(deps): bump cryptography from 46.0.6 to 48.0.1 in /build/docker/test (#​4522) @​dependabot[bot]
• build(deps-dev): bump ruff from 0.15.20 to 0.15.22 in /build/docker/test in the uv group across 1 directory (#​4559) @​dependabot[bot]
• WAF: update coraza (#​4572) @​blotus
• build(deps): bump the github-actions group across 1 directory with 3 updates (#​4558) @​dependabot[bot]
• build(deps): bump the gomod group across 1 directory with 21 updates (#​4566) @​dependabot[bot]
• bump fpscanner to v1.0.7 (#​4557) @​blotus
• update go-re2 to 1.11.0 (#​4478) @​blotus
• Unify sqlite build flag (#​4525) @​zc-devs
• fix TestCryptoObfuscationDefaultPoolSize (#​4565) @​buixor
• build(deps): bump the gomod group across 1 directory with 30 updates (#​4542) @​dependabot[bot]
• chore: delete publiccode.yml to comply with the process (#​4552) @​mazzma12
• build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#​4549) @​dependabot[bot]
• CI hardening (#​4546) @​blotus
• fix(docs): set pubblicode.yml to correct version (#​4548) @​mazzma12
• build(deps): bump cloudflare/wrangler-action from 3.15.0 to 4.0.0 (#​4541) @​dependabot[bot]
• build(deps): bump codecov/codecov-action from 6.0.0 to 7.0.0 (#​4540) @​dependabot[bot]
• build(deps-dev): bump the uv group in /build/docker/test with 2 updates (#​4537) @​dependabot[bot]
• build(deps): bump the github-actions group with 7 updates (#​4538) @​dependabot[bot]
• build(deps): bump actions/checkout from 6.0.2 to 7.0.0 (#​4539) @​dependabot[bot]
• build(deps): bump golang.org/x/net from 0.53.0 to 0.55.0 (#​4544) @​dependabot[bot]
• build(deps): bump the github-actions group across 1 directory with 11 updates (#​4524) @​dependabot[bot]
• build(deps): bump the uv group across 1 directory with 3 updates (#​4519) @​dependabot[bot]
• build(deps): bump alpine from 3.23 to 3.24 in /build/docker in the docker group across 1 directory (#​4513) @​dependabot[bot]

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

---

Configuration

📅 Schedule: (in timezone Asia/Jerusalem)

• Branch creation
  • "after 6am and before 4pm on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.