# Blog: Introducing Falco 0.43.0

DevFeed: [Blog: Introducing Falco 0.43.0](<https://devfeed.tech/articles/blog-introducing-falco-0-43-0-32493.md>)

Original publisher: [Read original article](<https://falco.org/blog/falco-0-43-0/>)

Published: 2026-01-26T00:00:00Z

Content type: release

Language: en

Sources: [Falco - Falco](<https://devfeed.tech/sources/falco-falco.md>), [Falco - The Falco blog](<https://devfeed.tech/sources/falco-the-falco-blog.md>)

Topics: [Falco](<https://devfeed.tech/topics/falco.md>), [eBPF](<https://devfeed.tech/topics/ebpf.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [Maintainability](<https://devfeed.tech/topics/maintainability.md>)

Tags: [ebpf](<https://devfeed.tech/tags/ebpf.md>), [falco](<https://devfeed.tech/tags/falco.md>), [improvements](<https://devfeed.tech/tags/improvements.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [legacy](<https://devfeed.tech/tags/legacy.md>), [maintainability](<https://devfeed.tech/tags/maintainability.md>), [race-condition](<https://devfeed.tech/tags/race-condition.md>), [release](<https://devfeed.tech/tags/release.md>), [version](<https://devfeed.tech/tags/version.md>)

## AI overview

Falco 0.43.0 is a stabilization release that consolidates changes from 0.42.0, adds deprecations, and fixes issues across Falcoctl, plugins, and libraries. It includes updates to Falco libraries and drivers, signature verification fixes, plugin fixes, and the reintroduction of the evt.arg.filename field. The release deprecates the legacy eBPF probe and gVisor engine while directing users toward modern alternatives.

## Source excerpt

Dear Falco Community, we are happy to announce the release of Falco 0.43.0 today! This is a stabilization release that consolidates the changes introduced in 0.42.0, including the drop-enter initiative and the capture recording feature. It also introduces several deprecations to improve maintainability and fixes minor issues across falcoctl, plugins, and libs. During this release cycle, we merged: 31 PRs on Falco, including 11 release note-worthy changes 48 PRs on Falco libs, including 17 release note-worthy changes 8 PRs on Falco drivers, including 3 release note-worthy changes We upgraded libs to version 0.23.1 and drivers to 9.1.0+driver. Thank you to our maintainers and contributors. This would not have been possible without your support and dedication! To learn everything about the changes, read on! What's new? TL;DR Deprecations GPG key rotation Container plugin improvements Falcoctl tweaks and improvements Key fixes: evt.arg.filename field reintroduction Falcoctl signature verification fixes overflow and NULL pointer dereferences fixes for the container plugin, shipped with plugins/container/0.6.1 race condition fix for the k8smeta plugin, shipped with plugins/k8smeta/0.4.1 This release also comes with breaking changes that you should be aware of before upgrading. Latest updates Deprecations In Falco 0.43.0, we are announcing the deprecation of three significant components to streamline the project, reduce maintenance burden, and focus on modern, more efficient alternatives. All these components are stable, and considering that the deprecation is first enforced in this version, they could be removed at any future version starting from 0.44.0. Legacy eBPF probe deprecation The "legacy" eBPF probe (configured via engine.kind=ebpf) was the original eBPF implementation in Falco. It required compiling a specific probe for each kernel version, often necessitating the dynamic usage of the falco-driver-loader or pre-built drivers. The Modern eBPF probe (engine.kind=m