The first release candidate for Zeek 8.1 is out! This release includes the last major building block in our multi-release effort to move Zeek’s cluster communication off of Broker. Work on this release began in August and includes the switch to ZeroMQ as Zeek’s default cluster communication backend for zeekctl users, first steps to move Zeek away from the MD5 hashing algorithm, length-limiting tunables for log record writes, better escaping of nonprintable characters in JSON logs, a systemd generator for single-host Zeek cluster deployments, and the usual mix of analyzer improvements and bug fixes.
Given the significance of the switch to our new ZeroMQ backend, please make sure to review the corresponding release notes for instructions on its use, including how to revert back to Broker if necessary. Python Broker bindings will stop working when switching to ZeroMQ. Users should look at our documentation about using WebSocket connections to interact with Zeek going forward. Bindings for Python, C and C++, Node, and Rust are available here. Eventually, the goal is to move this library under the Zeek project umbrella.
On the Spicy side, Zeek 8.1 will be the first version that uses a control flow graph for optimizations. There may be some unexpected consequences with this change. If you have any Spicy parsers, now is a great time to make sure they compile and behave the same before Zeek 8.1 releases.
As always, we’ll dive into the new features in more detail once 8.1 is out. We’re planning to release Zeek 8.1 on January 12, 2026, giving the community time over the holiday break to test the release candidate. Most of the team will be back by January 5, and we’ll check in with our testing group and the broader community for feedback at that time. As always, we will prioritize stability over strict calendar dates.
As with every x.1 release, the arrival of Zeek 8.1 means we’ll stop maintaining our past LTS release, Zeek 7.0.x, so now is the time to move to Zeek 8 if you want to continue receiving updates.
If you’re running Zeek clusters in production and would like to help us test our release candidates on a regular basis, we’d very much like to hear from you. While our test suites cover much of Zeek’s functionality, we always rely on Zeek users and the testing subgroup for the final go-ahead for a release. If you’d like to join our testing subgroup, please get in touch on Slack.
In our Zeek community call, on the first Wednesday of each month, we regularly report on feature development. We encourage you to join and ask questions! These calls are also available for later viewing on our YouTube channel.