Skip to content

chore: release v0.25.0 #623

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mostafa merged 1 commit into from
Oct 19, 2026
Merged

chore: release v0.25.0 #623

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,17 @@ All notable changes to RSigma are documented in this file. Each entry correspond

## [Unreleased]

## [0.25.0] - 2026-10-19

**TL;DR**
RSigma v0.25.0 is the "secure defaults and trustworthy results" release: three security advisories are fixed, the daemon and MCP server refuse unsafe exposure unless told otherwise, rules match exactly what they say, and correlation state, alert pipelines, and sinks hold up under reloads, restarts, caps, and delivery failures.
* Security: OTLP/HTTP gzip bodies are capped at 4 MiB after decompression ([GHSA-vwg6-4q3h-8pvq](https://github.com/timescale/rsigma/security/advisories/GHSA-vwg6-4q3h-8pvq), #597), the MCP server refuses unconfined writes and unconfined HTTP serving ([GHSA-33jj-q567-34gj](https://github.com/timescale/rsigma/security/advisories/GHSA-33jj-q567-34gj), #598), and event values are escaped in enricher and webhook templates ([GHSA-3fh4-8r8j-8xw3](https://github.com/timescale/rsigma/security/advisories/GHSA-3fh4-8r8j-8xw3), #599). Every build now refuses to serve an unauthenticated daemon API on a non-loopback address (#601), `rustls` picks up four RUSTSEC fixes (#577), and OTLP log decoding is fuzzed (#617).
* Matching correctness: integer literals above 2^53 match exactly (#610), boolean keywords match the word (#609), partly case-insensitive regex pairs match the original text again (#608), time-part modifiers accept space-separated fractional timestamps (#611), match detail reports only the selections that decide the match (#612), `0 of` selectors are rejected (#562), and `value_percentile` thresholds apply (#621).
* State and delivery: hot-reload no longer rolls back correlation state (#604), state saves are one consistent, atomic cut (#606), restore and alert-pipeline reload enforce the dedup and incident caps (#605), entity-graph grouping no longer leaks join keys or drops live incidents (#603), the inhibit store is capped (#616), alerts dropped without a DLQ sink are logged (#615), OTLP sink exports time out (#600), and file and Unix socket sink retries no longer repeat lines (#621).
* Diagnostics, API, and performance: parse warnings are reported apart from parse errors (#566), lint and the parser agree on modifiers and conditions (#565), pipeline errors get their own variant (#561), embedders can plug in custom logsource extractors (#578, based on work by John Sonnenschein in #500), `engine eval -o` writes results to a file (#576), match detail costs one evaluation pass (#613), percentile and median checks no longer sort the window (#619), and engines no longer retain rule HIR by default (#620).
* Breaking: a non-loopback daemon API needs authentication or `--allow-unauthenticated`; `mcp serve --http` needs `--rules-dir` or `--allow-unconfined-paths`; event values in enricher and webhook URLs are encoded as one component each; `HIR_SCHEMA_VERSION` is 4 and `save_hir` requires HIR retention; `SigmaCollection::diagnostics` replaces `errors`; `EvalError` gains `Pipeline` and is `#[non_exhaustive]`; `EventFilter` takes the parsed line by value; numeric matchers and backend methods use `NumericLiteral`; `incompatible_modifiers` is a lint error; and `cel` 0.15 changes how some extract expressions evaluate. See the migration notes in the entries below.
* Platform and docs: `--no-default-features` builds compile again (#560), the docs are checked against the code on every pull request (#558, #559), the PostgreSQL backend's JSONB and correlation code moves into dedicated modules with byte-identical SQL (#567, #568), the `test` backend is compared against pySigma 2.0.1 (#564), and dependencies are updated, including the docs site's `sharp` security fix (#556, #563, #577).

### `value_percentile` thresholds apply, sink retries stop repeating lines, and smaller eval and runtime fixes (#621)

`value_percentile` correlations ignored their condition: the percentile was computed and the correlation fired whenever the window held a finite value, so a rule with `lte: 50` fired on a window whose percentile was 50.5. The predicates now apply to the percentile as they do for the other numeric aggregates.
Expand Down Expand Up @@ -200,6 +211,8 @@ The docs site publishes the config JSON Schema at `/rsigma.schema.json`, the URL

Rolls up the compatible Dependabot PRs that opened after #550, with `Cargo.lock` regenerated against current `main`. Rust: `rmcp` 3.3.0 to 3.5.0 (#555), which renames the deprecated `ServerInfo` alias to `ServerConfig` in the MCP server handler, and `tokio-rustls` 0.26.5 to 0.26.6 (#554). CI: `taiki-e/install-action` v2.87.21 to v2.87.22, repinned by commit SHA (#553). VS Code: `@types/vscode` 1.138.0 to 1.140.0 (#552). Held back: `yamlpath` 1.30.1 (#495) and `yamlpatch` 1.30.1 (#494) require rustc 1.97 through `tree-sitter-iter`, above the 1.96.0 MSRV; `tikv-jemallocator` 0.7.0 (#425) remains excluded after the measured musl daemon throughput regression.

[v0.24.0...v0.25.0](https://github.com/timescale/rsigma/compare/v0.24.0...v0.25.0)

## [0.24.0] - 2026-10-05

**TL;DR**
Expand Down Expand Up @@ -3406,6 +3419,7 @@ First release of rsigma -- a Sigma detection toolkit in Rust. Ships a parser, ev

Initial crates.io publish. Reserved the `rsigma` crate name with a minimal CLI binary (parser + evaluator only, no linter/LSP/pipelines/correlation). Superseded the same day by v0.2.0, which is the first feature-complete release.

[0.25.0]: https://github.com/timescale/rsigma/releases/tag/v0.25.0
[0.24.0]: https://github.com/timescale/rsigma/releases/tag/v0.24.0
[0.23.0]: https://github.com/timescale/rsigma/releases/tag/v0.23.0
[0.22.0]: https://github.com/timescale/rsigma/releases/tag/v0.22.0
Expand Down
18 changes: 9 additions & 9 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ members = [
exclude = ["fuzz", "ci/wasm-smoke"]

[workspace.package]
version = "0.24.0"
version = "0.25.0"
edition = "2024"
rust-version = "1.96.0"
license = "MIT"
Expand Down
6 changes: 3 additions & 3 deletions ci/wasm-smoke/Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 6 additions & 6 deletions crates/rsigma-cli/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,12 +64,12 @@ stix-enrich = [
]

[dependencies]
rsigma-parser = { path = "../rsigma-parser", version = "0.24.0" }
rsigma-eval = { path = "../rsigma-eval", version = "0.24.0", features = ["parallel"] }
rsigma-convert = { path = "../rsigma-convert", version = "0.24.0", features = ["sigma-cli"] }
rsigma-runtime = { path = "../rsigma-runtime", version = "0.24.0", optional = true }
rsigma-mcp = { path = "../rsigma-mcp", version = "0.24.0", optional = true }
rstix = { path = "../rstix", version = "0.24.0", optional = true }
rsigma-parser = { path = "../rsigma-parser", version = "0.25.0" }
rsigma-eval = { path = "../rsigma-eval", version = "0.25.0", features = ["parallel"] }
rsigma-convert = { path = "../rsigma-convert", version = "0.25.0", features = ["sigma-cli"] }
rsigma-runtime = { path = "../rsigma-runtime", version = "0.25.0", optional = true }
rsigma-mcp = { path = "../rsigma-mcp", version = "0.25.0", optional = true }
rstix = { path = "../rstix", version = "0.25.0", optional = true }
clap = { version = "4", features = ["derive", "env"] }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
Expand Down
6 changes: 3 additions & 3 deletions crates/rsigma-convert/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,9 @@ default = []
sigma-cli = []

[dependencies]
rsigma-parser = { path = "../rsigma-parser", version = "0.24.0" }
rsigma-eval = { path = "../rsigma-eval", version = "0.24.0" }
rsigma-ir = { path = "../rsigma-ir", version = "0.24.0", default-features = false }
rsigma-parser = { path = "../rsigma-parser", version = "0.25.0" }
rsigma-eval = { path = "../rsigma-eval", version = "0.25.0" }
rsigma-ir = { path = "../rsigma-ir", version = "0.25.0", default-features = false }
thiserror = "2"
serde_json = "1"
yaml_serde = "0.10"
Expand Down
4 changes: 2 additions & 2 deletions crates/rsigma-eval/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,8 @@ parallel = ["rayon"]
daachorse-index = ["dep:daachorse"]

[dependencies]
rsigma-parser = { path = "../rsigma-parser", version = "0.24.0", default-features = false }
rsigma-ir = { path = "../rsigma-ir", version = "0.24.0", default-features = false }
rsigma-parser = { path = "../rsigma-parser", version = "0.25.0", default-features = false }
rsigma-ir = { path = "../rsigma-ir", version = "0.25.0", default-features = false }
serde = { version = "1", features = ["derive", "rc"] }
serde_json = "1"
yaml_serde = "0.10"
Expand Down
2 changes: 1 addition & 1 deletion crates/rsigma-ir/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ homepage.workspace = true

[dependencies]
base64 = "0.23"
rsigma-parser = { path = "../rsigma-parser", version = "0.24.0", default-features = false }
rsigma-parser = { path = "../rsigma-parser", version = "0.25.0", default-features = false }
ciborium = "0.2"
serde = { version = "1", features = ["derive"] }
serde_json = "1"
Expand Down
4 changes: 2 additions & 2 deletions crates/rsigma-lsp/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,8 @@ name = "rsigma-lsp"
path = "src/main.rs"

[dependencies]
rsigma-parser = { path = "../rsigma-parser", version = "0.24.0" }
rsigma-eval = { path = "../rsigma-eval", version = "0.24.0" }
rsigma-parser = { path = "../rsigma-parser", version = "0.25.0" }
rsigma-eval = { path = "../rsigma-eval", version = "0.25.0" }
tower-lsp-server = "0.23"
tokio = { version = "1", features = ["rt-multi-thread", "macros", "io-std", "time", "sync"] }
log = "0.4"
Expand Down
8 changes: 4 additions & 4 deletions crates/rsigma-mcp/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,10 +16,10 @@ default = []
http = ["dep:axum", "rmcp/transport-streamable-http-server"]

[dependencies]
rsigma-parser = { path = "../rsigma-parser", version = "0.24.0" }
rsigma-eval = { path = "../rsigma-eval", version = "0.24.0" }
rsigma-convert = { path = "../rsigma-convert", version = "0.24.0", features = ["sigma-cli"] }
rsigma-runtime = { path = "../rsigma-runtime", version = "0.24.0" }
rsigma-parser = { path = "../rsigma-parser", version = "0.25.0" }
rsigma-eval = { path = "../rsigma-eval", version = "0.25.0" }
rsigma-convert = { path = "../rsigma-convert", version = "0.25.0", features = ["sigma-cli"] }
rsigma-runtime = { path = "../rsigma-runtime", version = "0.25.0" }
rmcp = { version = "3.0", features = ["server", "macros", "transport-io"] }
schemars = "1"
serde = { version = "1", features = ["derive"] }
Expand Down
6 changes: 3 additions & 3 deletions crates/rsigma-runtime/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ daachorse-index = ["rsigma-eval/daachorse-index"]
stix-enrich = ["dep:rstix", "rstix/store", "rstix/store-fs"]

[dependencies]
rsigma-parser = { path = "../rsigma-parser", version = "0.24.0" }
rstix = { path = "../rstix", version = "0.24.0", optional = true, default-features = false, features = ["serde"] }
rsigma-eval = { path = "../rsigma-eval", version = "0.24.0", features = ["parallel"] }
rsigma-parser = { path = "../rsigma-parser", version = "0.25.0" }
rstix = { path = "../rstix", version = "0.25.0", optional = true, default-features = false, features = ["serde"] }
rsigma-eval = { path = "../rsigma-eval", version = "0.25.0", features = ["parallel"] }
tokio = { version = "1", features = ["rt-multi-thread", "sync", "macros", "io-util", "io-std", "process", "fs"] }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
Expand Down
2 changes: 1 addition & 1 deletion crates/rsigma-runtime/tests/golden/ocsf/correlation.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@
"product": {
"name": "rsigma",
"vendor_name": "rsigma",
"version": "0.24.0"
"version": "0.25.0"
},
"uid": "00000000-0000-4000-8000-000000000002",
"version": "1.1.0"
Expand Down
2 changes: 1 addition & 1 deletion crates/rsigma-runtime/tests/golden/ocsf/detection.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@
"product": {
"name": "rsigma",
"vendor_name": "rsigma",
"version": "0.24.0"
"version": "0.25.0"
},
"uid": "00000000-0000-4000-8000-000000000002",
"version": "1.1.0"
Expand Down
2 changes: 1 addition & 1 deletion crates/rsigma-runtime/tests/golden/ocsf/incident_open.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
"product": {
"name": "rsigma",
"vendor_name": "rsigma",
"version": "0.24.0"
"version": "0.25.0"
},
"uid": "00000000-0000-4000-8000-000000000001",
"version": "1.1.0"
Expand Down
2 changes: 1 addition & 1 deletion crates/rsigma-runtime/tests/golden/ocsf/incident_resolved.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
"product": {
"name": "rsigma",
"vendor_name": "rsigma",
"version": "0.24.0"
"version": "0.25.0"
},
"uid": "00000000-0000-4000-8000-000000000001",
"version": "1.1.0"
Expand Down
2 changes: 1 addition & 1 deletion crates/rsigma-runtime/tests/golden/ocsf/risk_incident.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@
"product": {
"name": "rsigma",
"vendor_name": "rsigma",
"version": "0.24.0"
"version": "0.25.0"
},
"uid": "00000000-0000-4000-8000-000000000001",
"version": "1.1.0"
Expand Down
6 changes: 3 additions & 3 deletions crates/rstix/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,11 +19,11 @@ Six optional Cargo features extend the default `serde` bundle model (each implie

```toml
[dependencies]
rstix = "0.24.0"
rstix = "0.25.0"
# Pattern Engine + Validation Pipeline:
# rstix = { version = "0.24.0", features = ["pattern", "validate"] }
# rstix = { version = "0.25.0", features = ["pattern", "validate"] }
# Graph, marking, store (combine as needed):
# rstix = { version = "0.24.0", features = ["graph", "marking", "store"] }
# rstix = { version = "0.25.0", features = ["graph", "marking", "store"] }
```

This library is part of [rsigma].
Expand Down
Loading
Loading