chore(main): release 0.45.0

[github-actions]

Here's what's new in Charon

0.45.0 (2026-10-12)

Features

• add an action to install missing CrowdSec hub items (d5d7f08)
• keep the current notification values when importing a blanked CrowdSec configuration (a2e6e26)
• list installed CrowdSec hub items in exports and offer to install missing ones after an import (#1561) (179732f)
• offer to install missing hub items after a CrowdSec import (50a7519)
• record the installed hub items in a CrowdSec export (8743577)
• security: protect sensitive values in CrowdSec exports (31405b9)
• security: protect sensitive values in CrowdSec exports (#1565) (d680d46)
• show which imported CrowdSec notification files still need values (902b39f)

Bug Fixes

• accept archive entries that merely start with two dots (c8bed1f)
• add the missing translation keys on the CrowdSec config page (8764187)
• apply curated CrowdSec presets server-side and report failures (#1513) (3a76804)
• apply curated CrowdSec presets via cscli and record failures (7247ab0)
• blank more notification-shaped files in CrowdSec exports (ddcf5a4)
• build the CrowdSec export safely before sending it (f9184d1)
• check the CrowdSec diagnostics paths against the data folder properly (4c3e7c1), closes #1541
• check the CrowdSec diagnostics paths against the data folder properly (#1563) (d0de01b)
• correct CrowdSec console enrollment form defaults and error feedback (8102cc2)
• create CrowdSec config subdirectories with owner-only permissions (7b6d079)
• deps: update github.com/moby/sys/user dependency to version v0.4.1 to address CVE-2026-61801 (8d59c14)
• deps: update github.com/moby/sys/user dependency to version v0.4.1 to address CVE-2026-61801 (0e4f830)
• docker: bump pgx/v5 to v5.9.2 for CVE-2026-41889 (c5699d4)
• docker: restore the x/mod pin dropped in the x/crypto bump (4d61701)
• docker: update pgx/v5 to v5.11.0 (1057ce5)
• exclude crowdsec database from curated preset backup and rollback (873a87a)
• fail the image build if CrowdSec reports no version and make the hub branch deterministic (d16b431)
• harden CrowdSec editor, responses and hub URL checks; deterministic CrowdSec specs (#1535) (6376038)
• harden CrowdSec preset apply and hub data persistence (#1525) (113f646)
• harden how the CrowdSec export opens files and bounds its size (a4b8cc8)
• harden the CrowdSec import and restore, and finish the page translations (#1562) (cf06bd9)
• inject the CrowdSec version into the bundled binaries (82a8cbc)
• keep a CrowdSec import from disturbing the running system's own state (5e04e26)
• keep CrowdSec imports from disturbing live state and build exports safely (#1549) (78f6eef)
• keep golang.org/x/net at the pinned version in the Caddy and CrowdSec builds (b5ea937)
• keep the current CrowdSec files an imported archive does not contain (dd26c1c)
• match protected CrowdSec paths regardless of letter case (769c813)
• offer only .tar.gz in the CrowdSec import and translate Check Now (270f85a)
• only treat absent CrowdSec hub data files as missing (a629601)
• persist CrowdSec hub data files across container recreation (26b3435)
• preserve the CrowdSec data directory during hub apply and import (eef257b)
• recognise a missing CrowdSec hub item from cscli output and report an unreadable install list (f7ba572)
• refuse a CrowdSec import whose configuration is not in the folder CrowdSec reads (ce81a1b)
• reload CrowdSec through the managed process after preset and whitelist changes (787d9a6)
• remove the client-side CrowdSec preset write fallback (030855b)
• resolve backend lint findings in CrowdSec backup code (734f35b)
• return fixed messages from CrowdSec status and diagnostics endpoints (670e262)
• sanitize CrowdSec file handler log fields (d92898d)
• security: harden CrowdSec configuration file handling (5e7bc1d)
• security: harden CrowdSec editor access (b6dd527)
• security: harden file handling in the CrowdSec apply and import paths (14cf82c)
• security: patch a vulnerable dependency in the bundled helper binary (aae5d58)
• security: pin zlib to an exact version in the runtime image (18e4ec2)
• security: tighten handling of sensitive values in diagnostics (0b6be81)
• security: tighten handling of sensitive values in diagnostics (#1571) (301acb7)
• show CrowdSec backups by name (081ff47)
• show which CrowdSec files an import kept (2e87577)
• slim down the CrowdSec configuration export (5ef90f4)
• slim down the CrowdSec export, validate imports by parsing, and fix import UI text (#1542) (504f64a)
• stop compressing the CrowdSec config export twice (2f4bb5d)
• stop CrowdSec configuration changes from waiting after the request is cancelled (3c13375)
• stop reporting curated preset success the server did not confirm (9404e4d)
• translate the CrowdSec export and import messages (efda2b9)
• translate the remaining CrowdSec configuration page messages (6c0697d)
• validate CrowdSec archive entry names with a standard local-path check (19092d9)
• validate CrowdSec archive entry names with a standard local-path check (#1536) (0aa34bd)
• validate CrowdSec configuration files by parsing them (0858c32)
• validate notification references in a CrowdSec import (b768017)

---

Merge this PR to cut the release.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

✅ Supply Chain Verification Results

✅ PASSED

📦 SBOM Summary

• Components: 1870

🔍 Vulnerability Scan

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	0
🟢 Low	0
Total	0

📎 Artifacts

• SBOM (CycloneDX JSON) and Grype results available in workflow artifacts

---

_{Generated by Supply Chain Verification workflow • View Details}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

🤖 Created releases:

• v0.45.0

🌻