mostafa · 2026-07-01T09:42:25Z

Summary

Release v0.18.0. Bumps the workspace from 0.17.0 to 0.18.0 (workspace package version plus all inter-crate path pins across the dependent crates), syncs both Cargo.lock and fuzz/Cargo.lock, and finalizes CHANGELOG.md by promoting the [Unreleased] block to [0.18.0] - 2026-07-01 with a TL;DR, a v0.17.0...v0.18.0 compare link, and the release reference link.

Headline framing: the "post-engine alerting and detection lifecycle" release. The daemon grows an Alertmanager-style processing stage and an entity risk layer, the toolkit gains the triage, hygiene, and ADS pieces that close the detection lifecycle, content-based schema and logsource routing lands, a data-aware diagnostics toolkit ships, and rstix completes its STIX 2.1 data model and gains a pattern engine.

Post-engine alert processing: an alert pipeline adds deduplication, silencing, inhibition, and incident grouping to the daemon sink path (Alert pipeline: silencing, inhibition, dedup, grouping, persistence #255); risk-based alerting scores entities and emits a risk-incident layer (Risk-based alerting: per-entity risk scoring and a risk-incident layer #264); the webhook sink can HMAC-sign every request (Sign webhook requests with HMAC #266).
Detection lifecycle: a triage feedback loop turns analyst dispositions into a live per-rule false-positive ratio (Add triage feedback loop: analyst dispositions and a per-rule false-positive ratio #263); a rule hygiene report surfaces retirement and clean-up candidates (feat: add rsigma rule hygiene retirement report #262); optional ADS metadata gains linter enforcement and an authoring command (feat: ADS detection-strategy metadata and lint #261).
Schema and logsource routing: content-based schema recognition (feat: schema-aware log source recognition (classification and reporting) #245) and per-schema pipeline routing (feat: schema-aware log source recognition and routing #246), plus opt-in conflict-based logsource pruning in the evaluator (feat: logsource-aware evaluation (conflict-based pruning) #249).
Diagnostics: an explain-and-introspect toolkit adds detection explain, pipeline transform diff, and correlation window introspection (feat: explain and introspect toolkit #270).
Daemon transport: Unix domain socket support for the input source, output sink, and API listener (feat: unix domain socket support for the daemon (input, output, API listener) #273).
rstix (threat-intel library, not yet independently releasable): completes the STIX 2.1 data model and serialization (feat(rstix): add STIX cyber-observable (SCO) objects #248, docs(rstix): SCO per-field rustdoc (#250) #254, feat(rstix): STIX 2.1 SDOs, bundle parse, and reference validation #265, feat(rstix): complete Data Model + Serialization with semantic validation #268) and adds a pattern engine that parses and type-checks STIX patterning Levels 1-3 (feat(rstix): Pattern Engine: lexer, Level 1–3 parser, and type-checker #272).
Fixes, security, and dependencies: jq halt/halt_error can no longer terminate the process (fix(fuzz): build cargo-fuzz on nightly and repair two fuzz targets #247); a transitive anyhow bump clears RUSTSEC-2026-0190 (fix(deps): bump anyhow to 1.0.103 for RUSTSEC-2026-0190 #271); a rolled-up dependency bump (chore(deps): batch dependency updates #257); and the CI/CD guide documents rsigma-action (docs: document the rsigma-action CI gate #260).

The fuzz lockfile change is larger than usual because fuzz/Cargo.lock had drifted behind the webhook-signing and rstix transitive dependencies that rsigma-runtime now pulls in; the bump resyncs it so it resolves under --locked.

Full release notes: see the new [0.18.0] section in CHANGELOG.md.

Test plan

cargo fmt --all -- --check
cargo metadata --locked for the workspace and fuzz/ (lockfile/manifest consistency)
cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
cargo test --workspace --all-features --locked (3001 passed, 85 suites)
mkdocs build --strict
cargo audit (one pre-allowed encoding unmaintained warning via evtx)
cargo deny check (advisories, bans, licenses, sources ok)

Post-merge

After merge, tag v0.18.0 on main and create the GitHub Release using the [0.18.0] body verbatim. The publish.yml, release-binaries.yml, and docker.yml workflows fire on release: published.

Bump the workspace and all inter-crate version pins from 0.17.0 to 0.18.0, sync the workspace and fuzz lockfiles, and finalize the CHANGELOG by promoting the [Unreleased] section to [0.18.0] with a TL;DR summary and a release reference link. The fuzz lockfile also picks up the webhook-signing and rstix transitive dependencies it had drifted behind, so it resolves under --locked again.

…angelog

mostafa added 2 commits July 1, 2026 11:40

docs: credit @SecurityEnthusiast for the rstix work in the v0.18.0 ch…

187da63

…angelog

mostafa merged commit e06e745 into main Jul 1, 2026
16 checks passed

mostafa deleted the chore/release-v0.18.0 branch July 1, 2026 10:27

Navigation Menu

Uh oh!

chore: release v0.18.0 - #275