Zeek 9.0 Development Update
Zeek 9.0, our next long-term support (LTS) release, is just around the corner! Here’s a quick look at what’s been keeping us busy in the lead-up to the release, and what you can expect over the next few weeks.
As always, our priority for our next LTS release is stability and maturity of features. For 9.0, this means we’ve rounded out much of the work that landed in 8.1 and 8.2 around our new ZeroMQ cluster communications backend, Zeek’s WebSocket support for integration with third-party applications, a new UDP-based packet source to consume encapsulated traffic, and support for systemd as a Zeek cluster process manager. Behind the scenes, we’ve also completed a migration of our CI setup to CircleCI and Github, since our former provider, CirrusCI, shut down in June.
Most importantly, much of our work since 8.2 has revolved around LLM-driven security scans of Zeek’s codebase. We’ll say a lot more about this shortly, but in addition to a number of individual contributions from the community we’ve been fortunate to receive agentic scan results from four dedicated analysis efforts: our own (powered by OpenAI’s Trusted Access for Cyber program via Corelight), OpenAI’s Patch the Planet initiative via Trail of Bits, Anthropic’s coordinated vulnerability disclosure program via ADA Logics, and the Canadian Communications Security Establishment. We’ve been heartened by the fact that the volume of findings has been mostly manageable for our team — a testament, we believe, to the breadth and depth of our existing code quality measures.
Accordingly, both 9.0 and our upcoming patch releases include a large number of security fixes and we encourage users to upgrade once they come out. We’re planning to release 8.0.10 and 8.2.2 patch releases on August 19, when we’ll also create the Zeek 9.0 release branch and the first Zeek 9.0 release candidate. At that point we’ll look to the Zeek community and the testing subgroup for feedback on the RCs, and if all goes well, we’ll release Zeek 9.0 on Monday, August 31.
As always, we’ll continue to maintain the past LTS series, 8.0.x, until the release of Zeek 9.1 in approximately 4 months.
In our Zeek community call, on the first Wednesday of each month, we regularly report on feature development. We encourage you to join and ask questions! These calls are also available for later viewing on our YouTube channel.