## OISF/suricata — suricata-8.0.4…suricata-8.0.5

_96 commits._

### Features
- **lua: add bounds checks for flowints and flowvars** (09c45d9)
- **rust/lua: add method for pushing bytes** (bc05d40)
- **ntp: convert reference_id to buffer and add keyword** (587e487)
- **ntp: add ntp.mode keyword** (2a9a573)
- **ntp: add ntp.stratum keyword** (545070a)
- **ntp: add ntp.version keyword** (4f427c3)
- **ntp: add transaction logging** (fd74203)
- **eve: add rule generation source to alert record** (1a09a05)
- **ftp: add rule for too many transactions** (59ebaf4)
- **conf: add comment for ftp.max-tx** (32546c9)
- **snmp: add snmp-events.rules file** (bb90304)
- **bittorrent: add bittorrent-events.rules file** (7df9862)
- **output/flush: Add EVE flushing logic** (9ca03cd)
- **detect/snmp: add snmp.trap_type keyword** (7f7ab92)
- **eve/schema: add snmp trap fields** (6c06733)
- **detect: new helper for buffer register with required progress** (efc5075)
- **etc/schema: add http_request_body** (9f82c45)
- **qa: add nfq based firewall test with live reload** (3239f6b)
- **dcerpc: support multiple PDU in one parser call** (8841254)

### Fixes
- **dnp3: fix off-by-one in array sizes** (d869f78)
- **datasets: fix path setup when load and save used with different paths** (654f5fa)
- **util/path: fix compile warning** (abf9985)
- **magic: fix compile warning** (aa08604)
- **detect/pcre: fix compile warnings** (d3a7e60)
- **detect/app-layer-protocol: fix compile warning** (16d227b)
- **decode: fix compile warning** (b089967)
- **datasets: fix compile warning** (8fc2c6b)
- **conf/yaml-loader: fix compile warning** (7424cf2)
- **smtp: fix compile warning** (0ab10e7)
- **ftp: fix compile warnings** (823c615)
- **util/logopenfile: fix compile warnings** (79d1341)
- **detect/http2: fix progress for headers** (e40775d)
- **detect/firewall: fix 'last_for_progress' logic** (8f8cd4f)
- **examples: fix run mode name in live example** (995ad5d)
- **clang-format: fix the base branch** (841f2b2)

### Backend
- **release: 8.0.5; update changelog** (5611b60)
- **detect/transforms: dotprefix can be chained** (3d371ff)
- **detect/transforms: decompress checks earlier if it is in-place** (11d1fe1)
- **detect/engine: helper to know if a transform happens in-place** (4253b82)
- **http2: better compression against decompression bombs** (9c24b5b)
- **http1: do not re-parse Content-Disposition header** (8abe0f2)
- **ikev2: remove unused field** (3a6414e)
- **http2: protection against decompression bombs** (20104d0)
- **http2: code refactoring to split big function** (6910719)
- **defrag: release tracker lock before decoding reassembled packet** (519ded6)
- **ldap: bound the number of responses** (82cf3d6)
- **dnp3: bound response reassembly** (d62b7cd)
- **dnp3: bounds reassembly** (2a4947f)
- **frames: make sure we use a lowercase buffer name** (31d3977)
- **http2: check for HTTP1 protocol during upgrade path** (75a4641)
- **lua: enforce allocation limit on first alloc** (3e064d4)
- **defrag: check tracker/packet family in compare** (97d6fa9)
- **nfs: bound file_additional_procs to 1** (c029c09)
- **nfs: bound namemap by using lru** (af37786)
- **nfs: bound requestmap and use lru** (f43d442)
- **ntp: expose logged fields to lua** (53e594e)
- **schema: map NTP fields to keywords** (1ceea76)
- **ntp: enable keywords for firewall mode** (c8d95f2)
- **ntp: create tx for all modes; log version, mode and stratum** (e2b2737)
- **ntp: remove unused event types** (21c7adf)
- **frames: do not free on log+flush packet** (902fd11)
- **stream: log flush packets in the other order** (825975d)
- **detect: do not wait for more in log_flush** (bef7217)
- **reputation: remove unused code** (69e829b)
- **ftp: don't halt the flow when raising too_many_transactions** (d45dfe4)
- **ftp: raise too_many_transactions event on overflow** (9162048)
- **detect/dcerpc: avoids FP on dcerpc.iface keyword** (ad9d979)
- **configure: move -march=native flag insertion at the end** (33ab5cc)
- **psl: update to 2.1.206** (07555b9)
- **doc/config: Update flushing description** (2841bcf)
- **output/flush: Remove flush functions/registration** (9376742)
- **output/flush: Remove pkt-based flush logic** (e1e43fd)
- **detect: (m)dns keywords even with "alert udp"** (12d4cc7)
- **detect/doh2: prefilter does not use dns engine progress** (b80d5f7)
- **eve/drop: always enable verdict in firewall mode** (e71c54a)
- **detect/snmp: let generic keyword share the same list** (e55197d)
- **detect: enable snmp keywords for firewall mode** (df625bd)
- **detect/snmp: sticky buffers at progress 1** (80c6145)
- **detect: adds helper function SCDetectHelperBufferProgressMpmRegister** (7ce6fd6)
- **rust: suppress cargo audit for RUSTSEC-2026-0097** (5d050a4)
- **detect: enable pcre and urilen for firewall mode** (de84f58)
- **websocket: check pdu opcode for reassembly** (f53a5d3)
- **http2: set response_frame_size** (c479a80)
- **log-cf-common: let mktime determine proper tz** (adbf372)
- **configure/qa-simulation: explicitly declare default** (1ce945e)
- **dcerpc: only log the tx interfaces** (831be60)
- **dcerpc: store persistently contexts** (691114e)
- **detect/geoip: do not require packet** (a4aa865)
- **dcerpc: remove bad tests** (fe1cb9d)
- **dcerpc: use bind context_id in SMB** (07c96bf)
- **dcerpc: do not error the whole flow on unhandled packet type** (8e14f48)
- **detect/icode: mark as supported for firewall mode** (d3a11d9)
- **github-ci: disable libmagic on macos** (e14d03d)
- **github-ci: update almalinux minimal build to use dist archive** (a316952)
- **github-ci: update debian/ubuntu minimal build to use dist** (3611ca8)
- **version: start development towards 8.0.5** (885a28f)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/OISF/suricata?utm_source=github-action)._