What's Changed

• Bump 4.14.8 branch by @wazuhci in #37404
• Multi SCA, Decoder and Rule fixes by @Johnng007 in #37434
• Maintain crypto_method on keystore rebuild by @jpcerrone in #37524
• Merge 4.14.7 into 4.14.8 by @vikman90 in #37679
• Fix RBAC permission bypass in GET /security/actions and /security/resources by @vikman90 in #37678
• Validate destination paths when uploading list, rule, and decoder files by @vikman90 in #37691
• Prevent cluster worker from overwriting protected master files by @vikman90 in #37694
• Improve access control on the agent active-configuration endpoint by @vikman90 in #37716
• Fix typo in SCA rules by @Miguevrgo in #37652
• Prevent race condition in Windows RSA key container initialization (randombytes) by @MarcelKemp in #37701
• Limit node expansion in yaml2json by @vikman90 in #37725
• Reorder revoke-token from API integration test by @Antoniogm03 in #37696
• Fix benchmark test_cluster_error_logs test by @jepalfer in #37425
• Correct EnableMulticast expected value in Windows LLMNR checks by @Darioortegaleyva in #37765
• Prevent spurious CRITICAL (1211) queue error during rootcheck/FIM shutdown on WPK upgrade by @Darioortegaleyva in #37715
• Add sshd-session/sshd-auth to default macOS ULS query by @Darioortegaleyva in #37769
• Remove multiple warning messages for each unathorized shared policy by @Miguevrgo in #37741
• Fix typo in SCA rules by @Miguevrgo in #37770
• Fix analysisd deadlock on AR send when the queue is not drained by @ignaciogalle12git in #37764
• Disable OpenSSL runtime CPU probing in Python daemon wrappers by @jotacarma90 in #37839
• Expose audit_uid, audit_gid and effective_uid in eBPF whodata provider by @Darioortegaleyva in #37060
• Reject upgrade commands from the agent channel in wazuh-analysisd by @vikman90 in #37745
• initializeContext thread-safe with std::call_once by @hernanvalenzuela in #37768
• Validate destination paths when deleting rule and decoder files by @vikman90 in #37838
• Use DisplayName and python.exe version for Microsoft Store packages by @Darioortegaleyva in #37441
• Fix analysisd flaky test by @jepalfer in #37754
• Update MITRE mapping in Microsoft Graph rules by @AwwalQuan in #37950
• Validate read path in CDB list file retrieval by @vikman90 in #37901
• Merge 4.14.7 into 4.14.8 by @jotacarma90 in #37971
• Fix flaky content manager component tests caused by a race in the fake server startup by @jotacarma90 in #37902
• Discard_regex values containing a space break argument parsing by @jepalfer in #37929
• Decouple authd use_password invalid test from the manager restart return code by @ignaciogalle12git in #37930
• Prevent empty string version from being stored for agents by @Antoniogm03 in #37934
• Prevent exiting Wazuh-DB worker when oversized message arrives. by @MiguelazoDS in #37850
• Classify SCA policy remoteness by activation source, not file path by @vikman90 in #37953
• Reject undersized legacy-format agent messages in wazuh-remoted by @vikman90 in #38099
• Remove WMI dependancy when installing msi packages by @rjcausarano in #38059
• Remove startup deprecation warning from agent_upgrade by @jotacarma90 in #38085
• Improve login attempt limiting under concurrent requests by @vikman90 in #38135
• Fix out-of-bounds write when generating FIM alerts in wazuh-analysisd by @vikman90 in #38145
• Enforce password validation for empty passwords in update_user by @vikman90 in #38180
• Enforce token revocation for run_as (authorization-context) API sessions by @vikman90 in #38193
• Fix wildcard matching in the installed-files check by @vikman90 in #38213
• Prevent orphaned S3 artifacts and false-positive collisions in AWS integration tests [4.14.8] by @Darioortegaleyva in #38105
• Report macOS 26 and 27 release codenames by @anromerom in #38187
• Validate CDB list paths in list-retrieval and delete cluster callables by @vikman90 in #38214
• Skip 4.x CI checks on draft pull requests by @vikman90 in #38240
• Fix remote-command configuration validation by @vikman90 in #38239
• Revert agent workflows to GitHub runners 4x by @lchico in #38223
• Perpended string "data." in field names removed from FortiAuth rules and decoders by @AwwalQuan in #38195
• Remove stale EC2-timing exclusion in syscollector-rtr by @lchico in #38271
• Validate read paths in group configuration and daemon stats retrieval by @vikman90 in #38339
• Suppress StarletteDeprecationWarning for cluster_control and all framework CLI tools by @jotacarma90 in #38412
• Move the 4.14.8 server workflows to GitHub-hosted runners and add sccache compilation caching by @jotacarma90 in #38460
• Avoid holding exec_sock_mutex while connecting to the exec queue by @jotacarma90 in #38510
• AWS integration tests: isolate concurrent runs on the shared bucket with a per-run S3 namespace (GITHUB_RUN_ID) [4.14.8] by @Darioortegaleyva in #38254
• Remove avoidable copies, double lookups and pessimizing moves in agent-side hot paths by @Miguevrgo in #38234
• Bump 4.14.8 branch by @wazuhci in #39117
• Add the 4.10.5 entry to the changelog by @jotacarma90 in #39303
• Size the FIM alert full_log buffer to the alert instead of OS_MAXSTR by @jotacarma90 in #39404
• Decode audit_gid and audit_group_name in FIM whodata alerts by @Antoniogm03 in #39416
• Change default eBPF whodata loginuid to -1 instead of 0 by @Miguevrgo in #39335
• Fix uid and gid swap when unpacking bpf_get_current_uid_gid() in FIM eBPF whodata by @Miguevrgo in #39402
• Bump 4.14.8 branch by @wazuhci in #39436

Full Changelog: v4.14.7...v4.14.8-rc2

Manager

Fixed

• Hardened RSA decryption to reject malformed ciphertext blobs. (#36243)
• Improved cluster merged file parameter validation to prevent directory escape. (#38375)
• Improved tmp_file path validation in cluster DAPI. (#38376)
• Improved cluster non-merged file path validation during worker file processing. (#38377)
• Improved cluster worker file path validation. (#38378)
• Improved destination path validation when uploading CDB list, rule, and decoder files. (#38379)
• Improved cluster master validation of the files received from worker nodes. (#38380)
• Fixed a remote-command configuration validation bypass where upper- or mixed-case XML element names let command localfile and wodle blocks pass the remote_commands restriction. (#38381)

What's Changed

• Bump 4.14.8 branch by @wazuhci in #37404
• Multi SCA, Decoder and Rule fixes by @Johnng007 in #37434
• Maintain crypto_method on keystore rebuild by @jpcerrone in #37524
• Merge 4.14.7 into 4.14.8 by @vikman90 in #37679
• Fix RBAC permission bypass in GET /security/actions and /security/resources by @vikman90 in #37678
• Validate destination paths when uploading list, rule, and decoder files by @vikman90 in #37691
• Prevent cluster worker from overwriting protected master files by @vikman90 in #37694
• Improve access control on the agent active-configuration endpoint by @vikman90 in #37716
• Fix typo in SCA rules by @Miguevrgo in #37652
• Prevent race condition in Windows RSA key container initialization (randombytes) by @MarcelKemp in #37701
• Limit node expansion in yaml2json by @vikman90 in #37725
• Reorder revoke-token from API integration test by @Antoniogm03 in #37696
• Fix benchmark test_cluster_error_logs test by @jepalfer in #37425
• Correct EnableMulticast expected value in Windows LLMNR checks by @Darioortegaleyva in #37765
• Prevent spurious CRITICAL (1211) queue error during rootcheck/FIM shutdown on WPK upgrade by @Darioortegaleyva in #37715
• Add sshd-session/sshd-auth to default macOS ULS query by @Darioortegaleyva in #37769
• Remove multiple warning messages for each unathorized shared policy by @Miguevrgo in #37741
• Fix typo in SCA rules by @Miguevrgo in #37770
• Fix analysisd deadlock on AR send when the queue is not drained by @ignaciogalle12git in #37764
• Disable OpenSSL runtime CPU probing in Python daemon wrappers by @jotacarma90 in #37839
• Expose audit_uid, audit_gid and effective_uid in eBPF whodata provider by @Darioortegaleyva in #37060
• Reject upgrade commands from the agent channel in wazuh-analysisd by @vikman90 in #37745
• initializeContext thread-safe with std::call_once by @hernanvalenzuela in #37768
• Validate destination paths when deleting rule and decoder files by @vikman90 in #37838
• Use DisplayName and python.exe version for Microsoft Store packages by @Darioortegaleyva in #37441
• Fix analysisd flaky test by @jepalfer in #37754
• Update MITRE mapping in Microsoft Graph rules by @AwwalQuan in #37950
• Validate read path in CDB list file retrieval by @vikman90 in #37901
• Merge 4.14.7 into 4.14.8 by @jotacarma90 in #37971
• Fix flaky content manager component tests caused by a race in the fake server startup by @jotacarma90 in #37902
• Discard_regex values containing a space break argument parsing by @jepalfer in #37929
• Decouple authd use_password invalid test from the manager restart return code by @ignaciogalle12git in #37930
• Prevent empty string version from being stored for agents by @Antoniogm03 in #37934
• Prevent exiting Wazuh-DB worker when oversized message arrives. by @MiguelazoDS in #37850
• Classify SCA policy remoteness by activation source, not file path by @vikman90 in #37953
• Reject undersized legacy-format agent messages in wazuh-remoted by @vikman90 in #38099
• Remove WMI dependancy when installing msi packages by @rjcausarano in #38059
• Remove startup deprecation warning from agent_upgrade by @jotacarma90 in #38085
• Improve login attempt limiting under concurrent requests by @vikman90 in #38135
• Fix out-of-bounds write when generating FIM alerts in wazuh-analysisd by @vikman90 in #38145
• Enforce password validation for empty passwords in update_user by @vikman90 in #38180
• Enforce token revocation for run_as (authorization-context) API sessions by @vikman90 in #38193
• Fix wildcard matching in the installed-files check by @vikman90 in #38213
• Prevent orphaned S3 artifacts and false-positive collisions in AWS integration tests [4.14.8] by @Darioortegaleyva in #38105
• Report macOS 26 and 27 release codenames by @anromerom in #38187
• Validate CDB list paths in list-retrieval and delete cluster callables by @vikman90 in #38214
• Skip 4.x CI checks on draft pull requests by @vikman90 in #38240
• Fix remote-command configuration validation by @vikman90 in #38239
• Revert agent workflows to GitHub runners 4x by @lchico in #38223
• Perpended string "data." in field names removed from FortiAuth rules and decoders by @AwwalQuan in #38195
• Remove stale EC2-timing exclusion in syscollector-rtr by @lchico in #38271
• Validate read paths in group configuration and daemon stats retrieval by @vikman90 in #38339
• Suppress StarletteDeprecationWarning for cluster_control and all framework CLI tools by @jotacarma90 in #38412
• Move the 4.14.8 server workflows to GitHub-hosted runners and add sccache compilation caching by @jotacarma90 in #38460
• Avoid holding exec_sock_mutex while connecting to the exec queue by @jotacarma90 in #38510
• AWS integration tests: isolate concurrent runs on the shared bucket with a per-run S3 namespace (GITHUB_RUN_ID) [4.14.8] by @Darioortegaleyva in #38254
• Remove avoidable copies, double lookups and pessimizing moves in agent-side hot paths by @Miguevrgo in #38234
• Bump 4.14.8 branch by @wazuhci in #39117

Full Changelog: v4.14.7...v4.14.8-rc1

What's Changed

• fix(ci): correct S3 artifact run directory layout for 4.14.7 by @jr0me in #37377
• Lower log level of transient cluster failures by @ignaciogalle12git in #37338
• Fix github actions shell by @Miguevrgo in #37355
• SCA Policy Adjustments by @Johnng007 in #37385
• Bump 4.14.8 branch by @wazuhci in #37404
• fix(ci): grant OIDC to Coverity S3 jobs by @jr0me in #37406
• Remove unnused assignment for bpf object by @Miguevrgo in #37424
• Fix changelog workflow by @TomasTurina in #37431
• Preserve original scan_day/scan_time strings in syscheck config by @lchico in #37412
• Multi SCA, Decoder and Rule fixes by @Johnng007 in #37434
• Improve API authentication stability and resource limits by @jepalfer in #37034
• Bump 4.14.7 branch by @wazuhci in #37523
• Update CHANGELOG for v4.14.7 by @vikman90 in #37536
• Adjusted file sizes in the check files by @MarcelKemp in #37544
• Compilation error in HP-UX arch by @fcontrerasc in #37545
• Maintain crypto_method on keystore rebuild by @jpcerrone in #37524
• Merge 4.14.7 into 4.14.8 by @vikman90 in #37679
• Fix RBAC permission bypass in GET /security/actions and /security/resources by @vikman90 in #37678
• Validate destination paths when uploading list, rule, and decoder files by @vikman90 in #37691
• Prevent cluster worker from overwriting protected master files by @vikman90 in #37694
• Improve access control on the agent active-configuration endpoint by @vikman90 in #37716
• Fix typo in SCA rules by @Miguevrgo in #37652
• Prevent race condition in Windows RSA key container initialization (randombytes) by @MarcelKemp in #37701
• Limit node expansion in yaml2json by @vikman90 in #37725
• Reorder revoke-token from API integration test by @Antoniogm03 in #37696
• Fix benchmark test_cluster_error_logs test by @jepalfer in #37425
• Correct EnableMulticast expected value in Windows LLMNR checks by @Darioortegaleyva in #37765
• Prevent spurious CRITICAL (1211) queue error during rootcheck/FIM shutdown on WPK upgrade by @Darioortegaleyva in #37715
• Add sshd-session/sshd-auth to default macOS ULS query by @Darioortegaleyva in #37769
• Remove multiple warning messages for each unathorized shared policy by @Miguevrgo in #37741
• Fix typo in SCA rules by @Miguevrgo in #37770
• Restore legacy 5.0 deprecation notes and update wm_control migration by @cborla in #37829
• Fix analysisd deadlock on AR send when the queue is not drained by @ignaciogalle12git in #37764
• Disable OpenSSL runtime CPU probing in Python daemon wrappers by @jotacarma90 in #37773
• Disable OpenSSL runtime CPU probing in Python daemon wrappers by @jotacarma90 in #37839
• Expose audit_uid, audit_gid and effective_uid in eBPF whodata provider by @Darioortegaleyva in #37060
• Fix flaky Windows syscollector test by @rjcausarano in #37842
• Reject upgrade commands from the agent channel in wazuh-analysisd by @vikman90 in #37745
• initializeContext thread-safe with std::call_once by @hernanvalenzuela in #37768
• Bump 5.0.0 branch by @wazuhci in #37916
• Validate destination paths when deleting rule and decoder files by @vikman90 in #37838
• Make sure dbs are fully closed before stop() returns (sca, syscollector, agent-info) by @jpcerrone in #37841
• Use DisplayName and python.exe version for Microsoft Store packages by @Darioortegaleyva in #37441
• Fix analysisd flaky test by @jepalfer in #37754
• Migrate AWS integration tests to OIDC authentication and pre-existing VPC [5.0.0] by @Darioortegaleyva in #36796
• Migrate AWS integration tests to OIDC authentication and pre-existing VPC [4.14.7] by @Darioortegaleyva in #36798
• Update MITRE mapping in Microsoft Graph rules by @AwwalQuan in #37950
• Validate read path in CDB list file retrieval by @vikman90 in #37901
• Merge 4.14.7 into 4.14.8 by @jotacarma90 in #37971
• Provide local TZDB for integration tests by @jam300 in #37941
• Explicit use of jemalloc on daemons by @NahuFigueroa97 in #37708
• Fix flaky content manager component tests caused by a race in the fake server startup by @jotacarma90 in #37902
• Merge 4.14.8 into 5.0.0 by @jotacarma90 in #37973
• Fix WM_MAX_WAITunit comment modified (milliseconds -> microseconds) by @hernanvalenzuela in #37977
• Fix Windows agent Event-handle leak from per-cycle COM init in syscollector hotfixes collector by @nbertoldo in #37982
• Downgrade benign syscollector shutdown-timeout log by @anromerom in #37918
• Discard_regex values containing a space break argument parsing by @jepalfer in #37929
• Decouple authd use_password invalid test from the manager restart return code by @ignaciogalle12git in #37930
• Prevent empty string version from being stored for agents by @Antoniogm03 in #37934
• Fix compilation with newer GCC: missing cstdint includes in versionMatcher headers by @Antoniogm03 in #37951
• Reliably start workload daemons on install and shared-config reload by @Darioortegaleyva in #37999
• Cap engine unit-test build parallelism to prevent OOM by @jotacarma90 in #37955
• agent-info: propagate manager cluster_name change to connected agents by @MAnDumu in #37753
• fim_scan_mutex critical section extended to held through the post-transaction sync writes by @hernanvalenzuela in #37840
• Resolve Coverity findings for 5.0.0 Beta 4 - Agent by @nbertoldo in #38009
• Keep package_installed as a string through dbsync, convert to epoch only in the ECS event by @cborla in #38027
• fix default macOS group_description by @cborla in #38019
• Prevent exiting Wazuh-DB worker when oversized message arrives. by @MiguelazoDS in #37850
• Stop the deferred sync-flag update from inserting partial rows by @Miguevrgo in #38045
• Notify pause() waiters on Syscollector shutdown by @hernanvalenzuela in #38050
• Skip feed-update vulnerability scan for agents without package inventory by @jotacarma90 in #38074
• Classify SCA policy remoteness by activation source, not file path by @vikman90 in #37953
• Merge 4.14.8 into 5.0.0 by @TomasTurina in #38094
• Reject undersized legacy-format agent messages in wazuh-remoted by @vikman90 in #38099
• Remove WMI dependancy when installing msi packages by @rjcausarano in #38059
• Fix macos drain autoreleased OD objects in genAccountPolicyData by @cborla in #38118
• Initialize primitive members in parsec::Trace and base::result::Result by @Antoniogm03 in #37998
• Fix resource leaks when upgrade command params carry duplicate keys by @ignaciogalle12git in #38004
• Fix out-of-bounds read in logpar group end-token resolution (CID 558406) by @ignaciogalle12git in #37995
• Render each changelog block as a table by @jotacarma90 in #38076
• Remove startup deprecation warning from agent_upgrade by @jotacarma90 in #38085
• Exclude monotonic counters from syscollector dbsync diff/checksum by @lchico in #38057
• Improve login attempt limiting under concurrent requests by @vikman90 in #38135
• Fix out-of-bounds write when generating FIM alerts in wazuh-analysisd by @vikman90 in #38145
• Close the SCA DBSync connection on module stop by @nbertoldo in #38093
• Do not unwind wazuh-syscheck...

Manager

Removed

• Removed deprecated wazuh-dbd daemon and database_output configuration. (#37035)

Fixed

• Improved cluster payload buffer allocation strategy. (#37280)
• Improved cluster archive decompression limits. (#37119)
• Improved cluster worker file path validation. (#36998)
• Improved API authentication stability with bounded thread pools, regex timeouts and payload size limits. (#37034)
• Updated aiohttp, cryptography, PyJWT, python-multipart and starlette Python dependencies. (#37361)

Agent

Fixed

• Fixed AWS SQS subscriber wodle resolving the wrong AWS account for cross-account iam_role_arn configurations. (#36791)
• Fixed agent keepalive scheduling after a system clock rollback causing false Disconnected status. (#36338)
• Fixed eBPF FIM whodata dropping file events on older kernels such as Amazon Linux 2 and 2023. (#37014)
• Fixed eBPF FIM whodata missing file move/rename events into monitored folders. (#37023)
• Added IP address validation to the ip-customblock active response to prevent malformed input in file path operations. (#36730)
• Added a null check for inode and device fields in the FIM whodata event handler. (#37245)

Ruleset

Fixed

• Fixed multiple Debian, Ubuntu and Windows SCA checks generating incorrect results. (#37385)
• Fixed a typo in the SELinux SCA check causing false failures on CentOS 8, 9 and 10 systems configured as permissive. (#36361)
• Fixed the AlmaLinux 9 and 10 bootloader permissions SCA check regex and optional file handling. (#36396)
• Fixed the /etc/gshadow- permissions SCA check always failing due to an incorrect all condition. (#36795)
• Fixed a macOS SCA PolicyBanner check false failure by wrapping the command in sh -c for glob expansion. (#36783)

RESTful API

Fixed

• Fixed TypeError when sorting agents by version with empty version strings. (#37323)
• Improved sensitive data masking in cluster configuration endpoint. (#37039)

What's Changed

• fix: persist engine startup state for CMSync route logging by @jam300 in #37356
• Fix invalid MTU value reported for Windows network interfaces by @vikman90 in #37394
• Restore modern.bpf.o checkfiles baseline reverted by 4.14.7 merge by @lchico in #37414
• Suppress version-coordination WARNINGs on stop/unavailable module by @lchico in #37372
• Clarify security policy for pre-release versions and disclosure timeline by @vikman90 in #37423
• Bump 5.0.0 branch by @wazuhci in #37429
• wazuh-manager: Memory and copy-reduction improvements part 1 by @matigarciadev in #36979
• Improve default cores detection by @LucioDonda in #37288
• Standardize and verify Wazuh configuration documentation by @TomasTurina in #37411
• Handle rootcheck removed tags by @rovogel in #37346
• Update docs (agent) for the new password in manager by @Miguevrgo in #37420
• Backport the workflow for generating pre-release agent issues to version 5.0.0 by @MarcelKemp in #37490
• Upgrade 5.0.0 python dependencies by @jepalfer in #37361
• Change indexer user name and password by @TomasTurina in #37502
• Remove startup deprecation warning from cluster_control and agent_upgrade by @vikman90 in #37509
• Change indexer username and password to wazuh-manager by @TomasTurina in #37520
• Fix to improve fim_sync db performance. by @hernanvalenzuela in #37180
• SCA/FIM sync lifecycle: close DBs on graceful shutdown, defer coordination during first sync, and increment SCA check version on change by @jr0me in #37353
• Fix version comparison in indexer documents updates by @TomasTurina in #37498
• Propagate sync errors to each module by @jpcerrone in #37212
• Cache indexer credentials in clusterd by @TomasTurina in #37504
• Standardize CHANGELOG format and keep prior versions in the bumper by @jotacarma90 in #37513
• Warn on duplicate agent connection only when it persists by @jotacarma90 in #37493
• Backport: Lower DBSync-not-available shutdown messages to DEBUG to 5.0.0 by @anromerom in #37567
• Add retry logic to indexer templates download by @TomasTurina in #37643
• Reduce authd enrollment log severity for expected rejections by @jotacarma90 in #37540
• Reduce memory usage when downloading VDP feed by @Antoniogm03 in #37375
• Fix server-side version bump for disconnected agent metadata updates by @TomasTurina in #37647
• Re-enable AWS Inspector integration tests in 5.0.0 by @MAnDumu in #37645
• Fix sca internal limits by @rovogel in #37438
• Silence untrustworthy FIM schema-validation errors during shutdown by @Nicogp in #37688
• Fix spurious ERROR/WARNING logs during agent shutdown by @Nicogp in #37673
• Fix daemon stats for analysisd by @NahuFigueroa97 in #37525
• Resolve logging macro collisions and improve LogFn design (#37354) by @jotacarma90 in #37393
• Enable authd in manager source-install integration test step by @jotacarma90 in #37693
• Stop verify-agent-conf from falsely warning on agent-only wodle blocks, without breaking their validation by @vikman90 in #37680
• Fixing CIS 6.1.9 rule impossible permission check for /etc/group- by @hossam1522 in #35405
• Lower connection socket error log to debug level in wazuh-agentd by @MAnDumu in #37685
• Memory improvements part 2 by @NahuFigueroa97 in #37433
• Fix make clean-deps failing when src/external is missing by @vikman90 in #37724
• fix date schema validation error in scheduled metrics by @LucioDonda in #37703
• Report failure when block-ip fails to block an IP by @lchico in #37439
• Fix rename race on logcollector file status during shutdown by @Miguevrgo in #37695
• Calibrate log levels in router and vulnerability_scanner by @jotacarma90 in #37731
• Adds AR Windows binary extension fallback by @rjcausarano in #37496
• Lower httpsrv C++ standard from 20 to 17 by @jotacarma90 in #37751
• Add new indexer API roles mapping by @jepalfer in #37746
• Fix Windows block-ip firewall-enabled check misfire and ineffective route fallback by @nbertoldo in #37430
• Free rpm macro context to stop unbounded growth by @Nicogp in #37758
• Report modulesSync failure as debug during agent shutdown by @anromerom in #37689
• Report manager-not-ready sync failures as deferred by @anromerom in #37720
• wazuh-engine: Indexer connector exponential backoff by @matigarciadev in #37756
• Fix issue reference in the daemons stats changelog entry by @jotacarma90 in #37827

Full Changelog: v5.0.0-beta3...v5.0.0-beta4

What's Changed

• Improve cluster file synchronization error handling by @TomasTurina in #36129
• Update trojan signatures to avoid false positives on modern distros by @Miguevrgo in #35927
• Improve cluster merged file parameter validation by @vikman90 in #36204
• Create a backup of local_rules.xml during execution of IT analysisd tier 0 1 by @Antoniogm03 in #36201
• Improve tmp_file path validation in cluster DAPI by @vikman90 in #36246
• Revert bump main branch by @wazuhci in #36303
• Bump 4.14.7 branch by @wazuhci in #36312
• Serialize procps access to prevent modulesd crash by @cborla in #36261
• Remove obsolete configuration blocks from API upload_configuration setting by @TomasTurina in #36252
• Restore working vulnerability scanner database workflow by @jotacarma90 in #36332
• Propagate agent merged_sum after hot reload in cluster by @jotacarma90 in #36164
• Merge 4.14.7 into main by @jotacarma90 in #36331
• Authd tier 0-1 flaky tests fix by @jotacarma90 in #36342
• Review agent info logs by @Antoniogm03 in #36234
• Fix the wazuh-manager-modules crash that occurs while downloading the feed by @Antoniogm03 in #36337
• Migrate FIM DB path queries to parameterized statements by @Darioortegaleyva in #36399
• Fix AlmaLinux 9/10 bootloader permissions SCA check regex and optional file handling by @vikman90 in #36396
• Cluster file processing parameter validation by @vikman90 in #36296
• Add missing 4.10.2-4.10.5 and 4.8.2 entries to changelogs by @jotacarma90 in #36407
• Treat the absence of the hash document as expected, not an error by @juliancnn in #36355
• geo_point validation support all compatible formats by @LucioDonda in #36034
• Prevent Syscollector and SCA use-after-free on modulesd shutdown by @nbertoldo in #36359
• Add cluster security model and configuration documentation by @vikman90 in #36405
• Bump CB_SCAN_STARTED timeout and trigger ITs on wm_syscollector.c by @jr0me in #36446
• Fixed an issue in eBPF with LSM hooks and improved the health check by @MarcelKemp in #35838
• Validate cluster node name format by @vikman90 in #36460
• eBPF libraries updated by @MarcelKemp in #36467
• Bump 4.14.6 branch by @wazuhci in #36517
• Revert "Bump 4.14.6 branch" by @MARCOSD4 in #36518
• Bump 4.14.6 branch by @wazuhci in #36519
• Update changelog for 4.14.6 RC 1 by @jotacarma90 in #36562
• Fix policy evaluation errors by @fcontrerasc in #36449
• Release startup hash gate when the reload chain fails by @jr0me in #36302
• Revert "Add missing 4.10.2-4.10.5 and 4.8.2 entries to changelogs" by @MarcelKemp in #36591
• Merge merge-4.14.7-into-main into main [automated] by @wazuhci in #36624
• Restore event counter and classify received messages by @jotacarma90 in #36456
• Unify manager integration tests workflows by @ignaciogalle12git in #36235
• Remove unused Node.js 12 from arm64 deb agent builder by @Miguevrgo in #36156
• Remove unused Node.js 12 from arm deb agent builders (4.14.7) by @Miguevrgo in #36157
• SCA typo bug in SELinux SCA rule for CentOS 8/9/10 by @Miguevrgo in #36361
• Fix detect-changes glob to honour ** recursively and extract logic into a reusable action by @Nicogp in #36617
• Merge merge-4.14.6-into-4.14.7 into 4.14.7 [automated] by @wazuhci in #36623
• Reduce log noise when engine has no synchronized ruleset by @NahuFigueroa97 in #36356
• Update test modules paths by @rovogel in #36668
• Only download external deps when required by @TomasTurina in #36244
• Merge 4.14.7 into main by @jotacarma90 in #36664
• Mail forwarding and reporting 5.0 migration guide by @Ripdiegozz in #36357
• Added Ubuntu 26.04's SCA policy in the SPECS by @MarcelKemp in #36712
• Preliminary support new OSs - Ubuntu 26.04 - Add SCA content by @AwwalQuan in #36708
• Safeguards to inventory sync by @juliancnn in #36469
• Improve the method of detecting duplicates by @NahuFigueroa97 in #36344
• Fix race condition preventing inventory synchronization after agent reload by @nbertoldo in #36682
• Added API integration tests workflow by @MiguelazoDS in #36196
• Fix non-atomic write for file_status.json in logcollector by @nbertoldo in #36722
• Make agent-info shutdown waits interruptible by @lchico in #36719
• Validate IP address in ip-customblock active response by @vikman90 in #36730
• wazuh-agent remains active after uninstall on Fedora 44 / DNF5 by @Miguevrgo in #36727
• Use per-target rpath and remove redundant LD_LIBRARY_PATH/WAZUH_ENGINE_GROUP exports by @jotacarma90 in #36455
• Fix changelog chronological order and update bumper script by @Darioortegaleyva in #36729
• Monitoring a symlink without follow_symbolic_link by @Darioortegaleyva in #36081
• SCA policies migration guide from 4.x to 5.x by @jr0me in #36671
• Fix 5x wazuhdb integration tests by @ignaciogalle12git in #36713
• Downgrade transient manager-reported sync failures logs to debug by @jr0me in #36744
• Show sca timouts as Not Run by @jpcerrone in #36258
• Authd workflow creation for 5.x by @jepalfer in #36404
• Adapt remoted tests to 5.x by @Antoniogm03 in #36609
• Update unclassified event criteria by @LucioDonda in #36681
• use safeloader in yaml file loader by @LucioDonda in #36753
• Downgrade expected modulesd socket warnings/errors during agent restart to debug by @jr0me in #36755
• Documentation: Ciscat and openscap migration to SCA by @jpcerrone in #36723
• Document the deprecation of OSquery in order to use IT Hygiene in version 5.0 by @nbertoldo in #36756
• Preserve wazuh-syscheckd Full Disk Access attribution on macOS reload by @Nicogp in #36754
• Normalize severity Msg by @hernanvalenzuela in #36759
• Agent Groups 5x Migration Guide by @fcontrerasc in #36726
• Add NULL validation for optional FlatBuffer fields in inventory_sync by @vikman90 in #36773
• Fix agent keepalive scheduling after system clock rollback by @Darioortegaleyva in #36338
• Create integratord migration guide to 5.x by @Adman23 in #36750
• Syslog output (csyslogd) 5.0 migration guide by @gonzaarancibia in #36741
• Merge merge-4.14.7-into-main into main [automated] by @wazuhci in #36767
• Migration documentation: syslog input alternative by @rovogel in #36781
• Drop libcrypt dependency from Python dep by @jotacarma90 in #36782
• Change duplicated link to intented one by @Miguevrgo in #36794
• Add centralized input validation for active response framework by @vikman90 in #36745
• Fix sca check for etc/shadow by @Miguevrgo in #36795
• Align remoted metrics shipper with new field names by @jotacarma90 in #36740
• Fix wrap PolicyBanner stat in 'sh -c' so glob expands in macOS SCA check 41062 by @Nicogp in #36783
• Bump main branch by @wazuhci in #36801
• Defer module coordination while FIM first sync is in progress by @anromerom in #36762
• Revert "Bump main branch" by @MARCOSD4 in #36802
• Change log severity for recoverable and expected conditions by @hernanvalenzuela in #36...

Manager

Removed

• Removed unused SSL/TLS transport option from cluster. (#35648)

Fixed

• Improved message decompression handling in remoted. (#35773)
• Improved agent name validation to reject names starting with dot. (#35833)
• Fixed segfault in vulnerability scanner module shutdown when disabled. (#36011)
• Fixed string buffer handling in version comparison function. (#36059)
• Improved cluster file synchronization security. (#36060)
• Improved cluster file synchronization error handling on invalid task identifiers. (#36129)
• Improved cluster merged file parameter validation to prevent directory escape. (#36204)
• Improved tmp_file path validation in cluster DAPI. (#36246)
• Improved cluster non-merged file path validation during worker file processing. (#36296)
• Improved cluster node name format validation in the hello handler. (#36460)
• Fixed missing agent.host.ip in inventory documents when agent IP is empty. (#35475)
• Fixed stale agent synced status after hot reload on cluster worker nodes. (#6726)

Agent

Fixed

• Fixed agent registration not running on reinstall after apt-get remove. (#35727)
• Fixed MS-Graph integration handling for relationships containing /. (#35431)
• Fixed macOS syscollector to skip package receipts whose payload is no longer installed. (#35380)
• Fixed missing eBPF create, modify and delete events on Ubuntu 24/26 and improved FIM whodata healthcheck. (#35838)
• Hardened FIM database path lookups by migrating to parameterized SQL queries. (#36399)

RESTful API

Fixed

• Escaped control characters in API usernames in access logs. (#35866)
• Added input validation in cluster result handling and authentication. (#35757)
• Fixed current user resolution in the update-user endpoint to enforce admin protection. (#35442)

Ruleset

Fixed

• Updated rootcheck trojan signatures to avoid false positives on modern distributions (Debian 13, Ubuntu 26, Arch Linux). (#35927)

Other

Changed

• Updated cryptography, urllib3 and python-multipart Python dependencies. (#35982)
• Updated eBPF libraries: libbpf to 1.7.0 and bpftool to 7.7.0. (#36467)

Fixed

• Fixed wazuh-manager startup failure on RHEL 10 by dropping the libcrypt dependency from embedded Python. (#36782)

What's Changed

• Coding style clang format by @jotacarma90 in #35051
• Dovecot decoders don't match correctly by @hossam1522 in #35089
• Fixing CIS 35675 and 35689 rules bug by @hossam1522 in #35088
• Improve buffer handling in regex match processing by @vikman90 in #35106
• Fix empty-message failure in Windows enrollment integration test by @hernanvalenzuela in #35078
• Use daily marker for GuardDuty log collector by @anromerom in #35110
• Fix rate limit handling for /events endpoint by @javiersanchz in #35077
• Upload Size Limit Config Mismatch - Implementation by @jnasselle in #35141
• Update embedded Python and dependencies by @javiersanchz in #35135
• Escape document id in delete bulk operations by @ignaciogalle12git in #35174
• Add length validation after decompression in ReadSecMSG by @MiguelazoDS in #35193
• Fix uncontroller memory allocation in cluster by @FrancoRivero2025 in #35173
• Limit nested JSON depth in API requests - Implementation by @jnasselle in #35224
• Fix clang-format version resolution in CI by @jotacarma90 in #35180
• Align plugin decoder arguments with existing call path by @matigarciadev in #35176
• Add groups path validation by @TomasTurina in #35230
• Fix audit log cache overflow for events with many records by @vikman90 in #35285
• Update dependencies: cryptography, requests by @javiersanchz in #35331
• Fix memory allocation for long registry paths in syscheck by @Darioortegaleyva in #35287
• Fix for rootcheck not generating findings by @jpcerrone in #35297
• Bump 4.14.6 branch by @wazuhci in #35379
• Fix coverity findings in group validation paths by @TomasTurina in #35384
• Fix active config endpoint and Integration tests by @FrancoRivero2025 in #35412
• Server integration tests flaky test by @Antoniogm03 in #35353
• Skip macOS receipts that are no longer installed by @anromerom in #35380
• Revert tag references to main after v5.0.0-beta1 by @jotacarma90 in #35447
• Improve the code to hide information when a user doesn't have permission by @FrancoRivero2025 in #35307
• Validate current user in update-user endpoint by @vikman90 in #35442
• Complete wazuh server requirements docs by @TomasTurina in #35459
• Optimize error handling geoip locator by @LucioDonda in #35187
• wazuh-engine: /logtest endpoint cleanup temporary fields by @matigarciadev in #35420
• Add fast metrics module by @NahuFigueroa97 in #35142
• Bump 4.14.5 branch by @wazuhci in #35465
• Update changelog for v4.14.5-rc1 by @jotacarma90 in #35467
• Fix guardduty.py size in check files by @MarcelKemp in #35472
• Update uninstall procedure for Windows. by @rjcausarano in #35451
• Ms-graph - handle relationships that contain '/' by @jpcerrone in #35431
• Validate IP address format in host_ip field for Windows by @cborla in #35418
• Avoid using keyentries counter as index by @MiguelazoDS in #35456
• Linux test integration workflow improvements by @rovogel in #35060
• Enhancement/35084 improve it mac os by @rovogel in #35289
• Resume modules before manager sync to reduce coordination pause window by @lchico in #35357
• Check first scan termination before sync start by @anromerom in #35455
• Remove dead python code by @TomasTurina in #35533
• Include source IP in wazuh-remoted log messages by @20syldev in #35358
• Feed update re-scan revision by @ignaciogalle12git in #35271
• Backport: Fix FIM flaky integration tests by @Nicogp in #35535
• Migrate CM store-crud resources to native JSON flow by @jam300 in #35172
• wazuh-engine: Engine rename archiver module to event dumper by @matigarciadev in #35477
• Update inventory sync documentation by @TomasTurina in #35587
• Fix workflow input name: set-as-main → set_as_main in bumper workflow by @jotacarma90 in #35592
• Remove leftover code from deprecated Agent 0 by @fcontrerasc in #35195
• Synchronize Syscollector and VD queue databases during the flush process by @rjcausarano in #35518
• Add manager architecture documentation by @TomasTurina in #35607
• Early populate metadata after handshake by @fcontrerasc in #35387
• Fix script injection vulnerabilities in CI workflows by @jpcerrone in #35480
• (4x) Fix script injection vulnerabilities in CI workflows by @jpcerrone in #35598
• Update manager index names to sync by @juliancnn in #35527
• Suppress unexpected stateless events after SCA initial scan by @jr0me in #35432
• Dynamic getWazuhHome by @jepalfer in #35232
• Improve fast metrics interface managment and test by @NahuFigueroa97 in #35540
• Engine - Add Filter Sync by @NahuFigueroa97 in #35613
• Persist VD first-sync state in table_metadata by @anromerom in #35590
• Merge branch '4.14.5' into '4.14.6' by @jotacarma90 in #35655
• Normalize stateless check fields by @AnDumu in #35404
• Fix token validation race condition after revoke by @javiersanchz in #35218
• unify sandbox and trace into a single static parameter in policy creation by @LucioDonda in #35541
• Flush feed RocksDB memtable before marking feed ready on download completion by @Nicogp in #35639
• Remove unused SSL/TLS transport option from cluster by @vikman90 in #35648
• Fix WUA hotfix collection regression in Windows Agent v5.0.0 by @nbertoldo in #35662
• Handle stop signal during vulnerability feed download by @fcontrerasc in #35657
• Bump main branch by @wazuhci in #35699
• Revert "Merge pull request #35699 from wazuh/enhancement/wqa35624-bum… by @TomasTurina in #35700
• Emit WCS-aligned JSON for agent-start and buffer-status events by @lchico in #35671
• Support revert bump by @TomasTurina in #35660
• wazuh-engine: add retention policies for streamlog module by @matigarciadev in #35565
• Support revert bump by @jotacarma90 in #35714
• Merge 4.14.6 into main by @TomasTurina in #35705
• Fix rootcheck and security API IT by @TomasTurina in #35722
• Improve Active Response Custom Script Documentation by @nbertoldo in #35723
• Update GDPR control mappings in SCA rulesets by @Johnng007 in #35711
• Fix flaky API IT by @TomasTurina in #35724
• Fix agents API IT by @TomasTurina in #35746
• wazuh-engine: Improve graceful shutdown (fast shudown) by @juliancnn in #35585
• Remove legacy unclassified category by @jam300 in #35542
• Fix SCA YAML size drift + missing workflow path triggers by @jr0me in #35748
• Add cluster validations by @TomasTurina in #35757
• Prevent agent.host.ip from being silently dropped when agent IP is empty by @jotacarma90 in #35475
• Apply register_configure_agent.sh on reinstall after apt-get remove by @Miguevrgo in #35727
• Directory layout improvement by @jepalfer in #35622
• Improve message handling robustness in wazuh-remoted by @vikman90 in #35773
• Fix stale generated headers after clean by @jr0me in #35777
• Fix agent 5x sends trailing null byte 0 in messages by @jr0me in #35658
• Impro...

Manager

Changed

• Masked authd.pass in configuration API responses for users without update permissions. (#34128)

Fixed

• Fixed analysisd plugin decoder argument alignment. (#35222)
• Fixed path traversal in authd via agent group name validation. (#35258)
• Hardened cluster deserialization by restricting callable decoding to Wazuh modules and improving error handling. (#35256)
• Fixed DAPI callable resolution to restrict invocations to exposed resources only. (#35256)
• Fixed admin protection in update user endpoint. (#35469)
• Fixed protected settings checks when multiple <ossec_config> blocks are present. (#34690)
• Restricted cluster file transfer write paths. (#34659)
• Improved cluster file synchronization path handling by adding safe path joins. (#35008)
• Fixed Vulnerability Detector offset DB update to occur only after processing (backport from 4.12.0). (#31901)

Agent

Added

• Added detection of the -a never,task Audit rule in FIM whodata for Linux. (#34661)

Changed

• Changed sync primitive disposal to stop and soften teardown failures. (#34680)

Fixed

• Fixed Windows FIM Registry scan crash on non-null-terminated values. (#34679)

Other

Changed

• Updated curl dependency to 8.12.1. (#34687)
• Updated starlette dependency to 0.49.1. (#33383)
• Upgraded Python embedded interpreter to 3.10.19. (#32790)