Skip to content

feat(userspace/engine): update libs ref and adapt to transformer AST changes#3799

Merged
poiana merged 3 commits intofalcosecurity:masterfrom
irozzo-1A:feat/update-libs-transformers
Mar 11, 2026
Merged

feat(userspace/engine): update libs ref and adapt to transformer AST changes#3799
poiana merged 3 commits intofalcosecurity:masterfrom
irozzo-1A:feat/update-libs-transformers

Conversation

@irozzo-1A
Copy link
Contributor

@irozzo-1A irozzo-1A commented Feb 10, 2026

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

/kind release

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area build

/area engine

/area tests

/area proposals

/area CI

What this PR does / why we need it:

  • Bump default falcosecurity/libs to latest main (8f6b914) with transformer_list_expr and field_transformer_expr (values) support
  • Add visit(transformer_list_expr*) to filter_details_resolver and filter_macro_resolver visitors
  • Fix field_transformer_expr handling to use e->values instead of e->value

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

feat(userspace/engine): add support for list transformer exception

@poiana poiana requested review from FedeDP and Kaizhe February 10, 2026 14:43
@poiana poiana added the size/S label Feb 10, 2026
@github-actions
Copy link

github-actions bot commented Feb 10, 2026

This PR may bring feature or behavior changes in the Falco engine and may require the engine version to be bumped.

Please double check userspace/engine/falco_engine_version.h file. See versioning for FALCO_ENGINE_VERSION.

/hold

@irozzo-1A irozzo-1A force-pushed the feat/update-libs-transformers branch 2 times, most recently from f9e0562 to 1f57ca0 Compare February 10, 2026 16:13
@irozzo-1A irozzo-1A force-pushed the feat/update-libs-transformers branch from 1f57ca0 to 097e28f Compare March 9, 2026 12:56
@poiana poiana added size/M and removed size/S labels Mar 9, 2026
@irozzo-1A irozzo-1A force-pushed the feat/update-libs-transformers branch from c2574be to 7cc57f4 Compare March 9, 2026 14:32
@irozzo-1A irozzo-1A marked this pull request as ready for review March 9, 2026 14:32
@poiana poiana requested a review from LucaGuerra March 9, 2026 14:33
@irozzo-1A irozzo-1A force-pushed the feat/update-libs-transformers branch 2 times, most recently from 149614b to 3ebecdd Compare March 9, 2026 15:18
ekoops
ekoops previously approved these changes Mar 9, 2026
View reviewed changes
Copy link
Contributor

@ekoops ekoops left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana poiana added the lgtm label Mar 9, 2026
@poiana
Copy link
Contributor

poiana commented Mar 9, 2026

LGTM label has been added.

DetailsGit tree hash: f4a12fc27a81c974c66cd3b81bca9617b3ca81dc

@poiana poiana added the approved label Mar 9, 2026
@ekoops ekoops added this to the 0.44.0 milestone Mar 9, 2026
leogr
leogr reviewed Mar 10, 2026
View reviewed changes
Copy link
Member

@leogr leogr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @irozzo-1A

Thanks for this.

I believe skip-if-unknown-filter is missing from the rule JSON schema (rule_json_schema.h), which contributes to 2 of the 4 failures. That's a pre-existing gap we should fix.

The other failures suggest behavioral changes in how filters are compiled and evaluated with the new libs. See my comment below.

@irozzo-1A irozzo-1A force-pushed the feat/update-libs-transformers branch from 3ebecdd to 0913d62 Compare March 11, 2026 09:14
@poiana poiana removed the lgtm label Mar 11, 2026
@poiana poiana requested a review from ekoops March 11, 2026 09:14
@irozzo-1A
feat(userspace/engine): update libs ref and adapt to transformer AST …
1e26828 
…changes

- Bump default falcosecurity/libs to latest main (8f6b914) with
  transformer_list_expr and field_transformer_expr (values) support
- Add visit(transformer_list_expr*) to filter_details_resolver and
  filter_macro_resolver visitors
- Fix field_transformer_expr handling to use e->values instead of e->value

Signed-off-by: irozzo-1A <iacopo@sysdig.com>
@irozzo-1A
fix(cmake): protect from redefine cxxopts target
0cb7a5e 
Signed-off-by: irozzo-1A <iacopo@sysdig.com>
@irozzo-1A
fix(engine): add unknown filter match in err_is_unknown_type_or_field
8153c44 
After PR falcosecurity/libs#2776 a new error
message has been introduced for unknown types.

Signed-off-by: irozzo-1A <iacopo@sysdig.com>
@irozzo-1A irozzo-1A force-pushed the feat/update-libs-transformers branch from 0913d62 to 8153c44 Compare March 11, 2026 09:43
@irozzo-1A irozzo-1A requested a review from leogr March 11, 2026 09:44
ekoops
ekoops approved these changes Mar 11, 2026
View reviewed changes
Copy link
Contributor

@ekoops ekoops left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana poiana added the lgtm label Mar 11, 2026
@poiana
Copy link
Contributor

poiana commented Mar 11, 2026

LGTM label has been added.

DetailsGit tree hash: ee64030c486f608612c3a31ee79b4d4c84c1c755

@leogr leogr mentioned this pull request Mar 11, 2026
Open
leogr
leogr approved these changes Mar 11, 2026
View reviewed changes
Copy link
Member

@leogr leogr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥳

@github-project-automation github-project-automation bot moved this from Todo to In progress in Falco Roadmap Mar 11, 2026
@poiana
Copy link
Contributor

poiana commented Mar 11, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops, irozzo-1A, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@irozzo-1A
Copy link
Contributor Author

irozzo-1A commented Mar 11, 2026

/unhold

@poiana poiana merged commit 7554de1 into falcosecurity:master Mar 11, 2026
34 checks passed
@github-project-automation github-project-automation bot moved this from In progress to Done in Falco Roadmap Mar 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@leogr leogr leogr approved these changes

@ekoops ekoops ekoops approved these changes

@FedeDP FedeDP Awaiting requested review from FedeDP

@Kaizhe Kaizhe Awaiting requested review from Kaizhe

@LucaGuerra LucaGuerra Awaiting requested review from LucaGuerra

Assignees

@leogr leogr

@ekoops ekoops

Labels

approved area/engine dco-signoff: yes kind/feature lgtm release-note size/M

Projects

Falco Roadmap
Status: Done

Milestone

0.44.0

Development

Successfully merging this pull request may close these issues.

4 participants

@irozzo-1A @poiana @leogr @ekoops