## OISF/suricata — suricata-8.0.3…suricata-8.0.4

_92 commits._

### Features
- **krb5: use app-layer incomplete support** (1193019)
- **ldap: add rules file to dist** (f12cf35)
- **ldap: add ldap.rules file** (870a09c)
- **detect/tls: add null check for tls.alpn keyword** (632acbe)
- **github-ci: add debug validation to almalinux 10 build** (4da6323)
- **conf: add time parsing conf function** (f701a67)
- **dpdk: add live run test suite** (e2eec59)
- **doc: add more public datasets** (f2def20)
- **doc/userguide: add missing ipopts values** (de64874)
- **detect/ipopts: add qs and rtralt options** (95facc3)
- **build-scopes: add QA_SIMULATION mode** (f7cb04b)
- **af-xdp: add missing unlock in error path** (d836d44)
- **doc/userguide: add link to differences-from-snort** (1b504d0)
- **doc/userguide: add example with non-zero offset for relative isdataat** (f83b169)
- **detect/transforms: add zlib_deflate transform** (254ba73)
- **detect/transforms: add gunzip transform** (609a289)
- **userguide/Makefile: don't add "install" to EXTRA_DIST** (49a418d)
- **devguide: add chapter about exception policies** (c8e2301)
- **util-spm-hs: add missing deallocator** (324149f)
- **util-spm-hs: add missing deallocator** (e1cd34f)
- **tls-log: add common fn to create string from arr** (b93b5c4)

### Fixes
- **Revert "dpdk: fix mempool sizing to always yield 2^n -1"** (2a764b4)
- **app-layer: fix uint overflow in debug assertion** (77387c1)
- **ndpi: fix logging of pcap_cnt** (3264677)
- **smtp/mime: fix urls finding in buffering case** (aa12b19)
- **dpdk: fix mempool sizing to always yield 2^n -1** (0c54932)
- **doc: fix dcerpc.opnum documentation** (046ee16)
- **doc/userguide: fix table showing example payload** (8dd1653)
- **npdi: fix null pointer deref in detect keywords** (e0ad703)
- **userguide: fix Deprecations, warn about syslog** (fbd2832)
- **krb5: fix TCP record parsing** (592b294)
- **doc/userguide: fix within-distance pointer graphics in payload-keywords doc** (a25eded)
- **util/log: fix log file rotation** (e148527)
- **rust: fix unnecessary_unwrap warnings** (f5c8a8f)
- **firewall: fix rules not loading w/o commandline opts** (9c0162c)
- **datasets: fix compile warnings** (9c5fda1)

### Backend
- **release: 8.0.4; update changelog** (6af634b)
- **dpdk: update mempool size tests** (7e92018)
- **detect/http2: use ThreadCtx for all headers keywords** (6484a01)
- **detect/http2: use ThreadCtx for http.request_header** (029cc96)
- **detect/http2: use ThreadCtx for http.header.raw** (7b77edf)
- **detect/http2: use ThreadCtx for http.header** (c0efcf5)
- **detect/http2: use ThreadCtx for http.header_names** (94e5b1c)
- **stream/reassembly: improve progress tracking for GAP cases** (640d03b)
- **ldap: abandon request does not wait for a response** (7635d88)
- **http2: bound number of http2 frames per tx** (2d5172a)
- **smtp/mime: avoid quadratic complexity in mime_smtp_find_url_strings** (7a670e9)
- **examples/lib/live: a lib example with live capture** (44e7557)
- **examples/lib/cplusplus: simplfy, make more like the simple example** (5eae299)
- **examples/lib/custom: use own custom run mode** (b7447b1)
- **hs: prune stale MPM cache files** (e0f2cdf)
- **detect-engine: make mpm & spm part of MT stub ctx** (4604266)
- **hs: touch cache files on use to signal activity** (4261f5e)
- **path: signal last use of the file (touch)** (763f883)
- **misc: time unit parsing function** (1d7e582)
- **hs: change hash in the cache name to SHA256** (bb2a605)
- **hs: reduce cache filename size to max file limit** (a733a6b)
- **hs: update the file description** (828f674)
- **psl: update to 2.1.197** (7a67024)
- **plugins/ndpi: guard against NULL f->storage in all callbacks** (5ed352d)
- **ndpi: minor optimization** (6e6e12e)
- **dpdk: adjust burst size to mempool size** (7c24721)
- **firewall: don't overwrite with ips mode** (0140496)
- **doc/stream: explain absent reassembly.depth means unlimited** (354d0b2)
- **doc: be more precise for decompress transforms** (984c69b)
- **detect/transforms: update gunzip / zlib_deflate syntax** (2a113d4)
- **dpdk: scale mempool size to the number of bond members** (4e00922)
- **dpdk: honor cache size setting** (f054446)
- **ldap: set invalid_data event** (46954cd)
- **exceptions: s/DEBUG/QA_SIMULATION build flag** (f6093b6)
- **detect/iprep: mark as supported for firewall mode** (87ab1a6)
- **affinity: address coverity warning** (3a808bf)
- **doc/userguide: explain isdataat absolute vs relative difference** (abd08a2)
- **stream/tcp: flag 1st seen pkt w stream established** (e62460c)
- **rust/cargo: ignore RUSTSEC-2026-0009 for time crate** (7c082f0)
- **decode/ipv6: flag invalid pkt w/ wrong ip ver event** (84970da)
- **dpdk: collect port stats before device stop** (ddadef5)
- **hyperscan: move error logging for hs_compile** (e7e510d)
- **lua: don't attempt to garbage collect a null value** (0dd2ea7)
- **http1: marks tx as updated when setting an event** (fec6350)
- **detect/base64_data: reset buffer offset** (c86cefc)
- **doc/userguide: endswith can be mixed with offset/distance/within** (d782b43)
- **nfs: log read/write/rename whatever the nfs version** (c6d9b57)
- **tls/subjectaltname: use byte arr instead of string** (89ce3f2)
- **tls/sni: use byte array instead of string** (d50b125)
- **tls/serial: use byte array instead of string** (cba7fff)
- **tls/issuerdn: use byte array instead of string** (8abb0d1)
- **tls/subject: use byte array instead of string** (3f735e6)
- **rust/htp: formatting fixup** (0ae6ee2)
- **version: start development towards 8.0.4** (563066a)

### Docs
- **docs: use correct suricata version mentions** (626f6ef)

### Chore
- **ci: update rust version to 1.93** (34c93ef)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/OISF/suricata?utm_source=github-action)._