# 8.0.0-rc1

06/10/2025



* Bug #2205: Buffer confusion with fast_pattern:only;
* Documentation #2620: userguide: document tagged_packets / event_type packet
* Bug #3182: warn user on wildcard usage without quotes
* Bug #3236: missing keywords docs on some keywords when --list-keywords is called 
* Task #3334: rust: cleanup registration of C function pointers in SuricataContext
* Bug #3375: Tracking: file tracking/inspection performance issues
* Bug #3436: Suricata Socket Control crashing using command 'reopen-log-files' 
* Feature #3952: mDNS protocol implementation
* Bug #4220: failed to hit a signature with option --simulate-ips
* Feature #4226: bsize: apply as depth to patterns
* Documentation #4350: Devguide: transaction handling logic
* Documentation #4351: doc: explain the AppLayerParserTriggerRawStreamReassembly logic
* Documentation #4352: Devguide: Debugging Basics - pcap_cnt
* Bug #4482: detect: detect events not in rules, not tested (and not working?)
* Bug #4522: Rules with stream_size greater than not working
* Feature #4566:  pgsql: add subprotocol-states
* Bug #4571: Unable to trigger rule by content in case of IPv4 in IPv4 incapsulation
* Documentation #4658: Add/improve documentation for pcre substring capture logging
* Bug #4702: SYN/ACK dropped when client does not support tcp timestamps
* Documentation #4705: userguide: add sections about frame support
* Documentation #4708: devguide: Add Eve Output Plugins
* Documentation #4709: userguide: Add page about analyzing Suricata performance
* Bug #4786: xbits: no error on invalid 'expire' values
* Task #4799: af-packet: review iface up/down logic
* Bug #4815: unix socket: ftp memcap missing from socket commands
* Bug #4898: detect: Ensure detection events are logged
* Documentation #4980: doc/frames: document frame rule keyword
* Documentation #5008: userguide: add a protocol chart listing defaults
* Bug #5031: flowbits - no error on invalid options
* Documentation #5078: suricata config reload: improve documentation on behavior
* Documentation #5138: userguide: add a section for fileinfo eve type
* Documentation #5139: userguide: add a section for netflow event type
* Bug #5177: detect/engine-analyzer: rule analyzer warns about http buffers usage/replacement even when using new keyword 
* Optimization #5180: detect/alert: make sure that signatures with `drop` action are respected, even if the alert is discarded
* Feature #5203: dpdk: implement primary app for Suricata secondary mode
* Task #5256: rust: see if we can reduce number of crate deps
* Documentation #5274: devguide: document how the alert flow works
* Feature #5286: ips: allow dropping of packet/flow when alert queue exceeded
* Documentation #5449: userguide: document how suricata processes rules internally
* Task #5472: tracking: upgrading from 7 to 8
* Documentation #5513: userguide: add a chapter for IPS mode
* Documentation #5531: userguide: ensure documentation is up to date
* Documentation #5532: userguide: have a section to mention and document the various ways stream-depth can be set
* Documentation #5534: userguide: better document what TCP midstreams are for Suricata
* Documentation #5543: userguide: document which keywords accept the prefilter keyword
* Documentation #5554: userguide: document behavior for actions like PASS, DROP, REJECT, BYPASS...
* Documentation #5575: docs: bring 'reporting bugs page' into userguide and update it
* Documentation #5612: devguide: add a chapter about Suricata's exception policies
* Bug #5689: community id computed wrong for tcp and ipv4 when src_ip == dest_ip  
* Documentation #5690: userguide: document the differences between IPS and IDS mode
* Documentation #5829: userguide: add context on "why/when an exception policy is applied"
* Documentation #5830: userguide: update & improve exception policy section
* Documentation #5869: userguide: describe what are the delta stats counters
* Documentation #5891: userguide: explain different log save directory in offline mode
* Documentation #5897: devguide: add section on generating code coverage reports locally
* Documentation #5910: devguide: explain possible differences in data inspection with inline stream or not
* Documentation #5911: userguide: update & bring guide for installation on Windows to RtD
* Documentation #6022: devguide: explain how the engine identifies applayer protocols
* Documentation #6026: userguide/suricata-yaml: update image on threading
* Documentation #6030: devguide: expand Suricata Internals chapter
* Documentation #6058: doc/configuration: clarify sig_id & gid_id for global threshold
* Documentation #6069: userguide/install: move RPM distros to their own page
* Documentation #6078: eve/schema: document pgsql
* Documentation #6096: eve/app-layer: generate example eve-log for each protocol
* Documentation #6180: userguide: add troubleshooting section
* Bug #6186: Integer overflows 64 to 32 bytes
* Feature #6210: outputs: add verdict event type
* Documentation #6219: userguide: add page about different usecases
* Documentation #6252: userguide/install: move Ubuntu distros to their own page
* Documentation #6270: userguide: document usage of Suricata as a firewall
* Documentation #6284: userguide: document what's the impact of `stream.inline`
* Documentation #6369: stream: document stream.3whs_syn_flood and stream.3whs_synack_flood
* Bug #6384: rust: configure fails to persistently detect/remember cbindgen location
* Documentation #6412: devguide: API upgrade notes
* Feature #6422: dpdk: expand on DPDK allocation hints 
* Documentation #6434: eve/schema: document stats
* Documentation #6442: rtd: indicate that a page is for an outdated version
* Documentation #6450: userguide: add section about sshhash
* Documentation #6451: userguide: update 'what is suricata' section
* Documentation #6452: userguide/ftp: clarify usage around ftp and ftp.data keyword
* Documentation #6484: userguide: add keyword performance results
* Documentation #6486: userguide: explain pkt_on_wrong_thread counter
* Documentation #6495: userguide: add section on SMTP event type
* Documentation #6498: userguide/output: add section about fileinfo
* Documentation #6566: userguide: add description for missing EVE krb fields
* Task #6576: pgsql: log identifier for unknown messages?
* Documentation #6626: devguide: add instructions for MacOS setup
* Optimization #6704: CI: expand check for pcapng; also check `-nanosecond`
* Bug #6743: stream/tcp: spurious retransmission seen as invalid
* Bug #6744: tcp: fast open packet not fully handled
* Bug #6776: exception/policy: bypass flow incorrect applied?
* Documentation #6840: devguide/app-layer: section with conceptualized steps for adding parser
* Documentation #6955: devguide: update coding-style docs
* Bug #6981: dpdk: compiler warnings
* Bug #7019: snmp: probing parser returns ALPROTO_FAILED instead of ALPROTO_UNKNOWN if slice.len() < 4
* Documentation #7078: devguide: document current ffi naming style
* Documentation #7081: userguide: add unix socket option to retrieve flow info
* Optimization #7251: dcerpc: mimic gap behavior if invalid data is sent to protocol parser
* Bug #7254: dcerpc: parser does not support multiple PDUs
* Documentation #7277: doc/actions: clarify 'pass' scope variations
* Bug #7285: Websocket compression mishandling
* Optimization #7292: CI: clang-format rechecks every main-7.0.x commit
* Documentation #7329: doc: explain the priority ports setting
* Documentation #7348: userguide: explain SYSTEM and USER mode
* Bug #7420: detect-engine: warning fgets could get negative value
* Documentation #7424: devguide: document pseudo packets
* Bug #7441: config/port: Misleading message when port string is too long
* Bug #7442: telnet: frame parser inaccuracies
* Task #7461: suricata-verify: pass all tests
* Bug #7462: suricata-verify: pass when compiled with FUZZING_UNSAFE
* Bug #7479: segfault using dummy config output.eve-log.types.alert.payload-buffer-size = 0
* Bug #7546: dcerpc: parser does not take fraglen into account
* Bug #7547: dcerpc: parser uses only one header for both directions
* Feature #7566: dcerpc: applayer events for anomalous parsing results
* Bug #7568: pcap: continuous file reading fails on an empty directory
* Documentation #7580: userguide: add section for negated content
* Feature #7587: mime: add email.body_md5 keyword
* Task #7591: mime: add email.date keyword
* Feature #7593: mime: add email.message_id keyword
* Feature #7594: mime: add email.status keyword
* Feature #7597: mime: add email.url keyword
* Task #7598: mime: add email.x_mailer
* Feature #7599: mime: add email.received keyword
* Feature #7600: mime: add rule keywords
* Task #7627: events/rules: prevent ruleset loading blocks from name fixes
* Documentation #7631: userguide: document lua lib suricata.dnp3
* Task #7632: suricata-lua-sys: tag with a non-prelese version
* Bug #7634: hyperscan: coverity warnings