diff --git a/security/crowdsec/Makefile b/security/crowdsec/Makefile
index 879b8e063ae0..98a38280f440 100644
--- a/security/crowdsec/Makefile
+++ b/security/crowdsec/Makefile
@@ -1,180 +1,186 @@
 PORTNAME=	crowdsec
 DISTVERSIONPREFIX=	v
-DISTVERSION=	1.7.3
-PORTREVISION=	2
+DISTVERSION=	1.7.4
 CATEGORIES=	security
 
 MAINTAINER=	marco@crowdsec.net
 COMMENT=	CrowdSec lightweight and collaborative security engine
 WWW=		https://github.com/crowdsecurity/crowdsec
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 LIB_DEPENDS=	libabsl_base.so:devel/abseil \
 		libre2.so:devel/re2
 
-USES=		go:1.25,modules pkgconfig
-_COMMIT=	c8aad699
+USES=		go:modules pkgconfig
+_COMMIT=	469b374e
 _BUILD_DATE=	$$(date -u "+%F_%T")
 USE_RC_SUBR=	crowdsec
 
 GO_MODULE=	github.com/crowdsecurity/crowdsec
 GO_TARGET=	./cmd/crowdsec \
 		./cmd/crowdsec-cli \
 		./cmd/notification-email \
+		./cmd/notification-file \
 		./cmd/notification-http \
 		./cmd/notification-sentinel \
 		./cmd/notification-slack \
 		./cmd/notification-splunk
 
 GO_BUILDFLAGS=	-v -trimpath -tags netgo,osusergo,sqlite_omit_load_extension,re2_cgo \
 		-ldflags="\
 		-a -s \
 		-X github.com/crowdsecurity/go-cs-lib/version.Version=${DISTVERSIONPREFIX}${PKGVERSION} \
 		-X github.com/crowdsecurity/go-cs-lib/version.BuildDate=${_BUILD_DATE} \
 		-X github.com/crowdsecurity/go-cs-lib/version.Tag=${_COMMIT} \
 		-X ${GO_MODULE}/pkg/cwversion.Codename=alphaga \
 		-X ${GO_MODULE}/pkg/csconfig.defaultConfigDir=${PREFIX}/etc/crowdsec \
 		-X ${GO_MODULE}/pkg/csconfig.defaultDataDir=/var/db/crowdsec/data \
 		-X ${GO_MODULE}/pkg/cwversion.Libre2=C++"
 
 SUB_FILES=	pkg-deinstall pkg-install pkg-message crowdsec.cron upgrade-hub
 
 OPTIONS_DEFINE=	FIREWALL_BOUNCER
 OPTIONS_DEFAULT=
 
 FIREWALL_BOUNCER_DESC=	Depend on security/crowdsec-firewall-bouncer
 FIREWALL_BOUNCER_RUN_DEPENDS=	crowdsec-firewall-bouncer>=0.0.27:security/crowdsec-firewall-bouncer
 
 PLUGIN_DIR=	${PREFIX}/lib/crowdsec/plugins
 STAGE_PLUGINS=	${STAGEDIR}${PLUGIN_DIR}
 STAGE_BIN=	${STAGEDIR}${PREFIX}/bin
 
 post-patch:
 	@${REINPLACE_CMD} 's,/etc/crowdsec/,${ETCDIR}/,g' \
 		${WRKSRC}/config/config.yaml
 
 	@${REINPLACE_CMD} 's,/var/lib/,/var/db/,g' \
 		${WRKSRC}/config/config.yaml
 
 do-install:
 	#
 	# Binaries
 	#
 
 	${INSTALL_PROGRAM} ${WRKDIR}/bin/crowdsec ${STAGE_BIN}/
 	${INSTALL_PROGRAM} ${WRKDIR}/bin/crowdsec-cli ${STAGE_BIN}/cscli
 
 	# keep this around for compatibility
 	${LN} -s cscli ${STAGE_BIN}/crowdsec-cli
 
 	@${MKDIR} ${STAGE_PLUGINS}
 	${INSTALL_PROGRAM} ${WRKDIR}/bin/notification-email ${STAGE_PLUGINS}/
+	${INSTALL_PROGRAM} ${WRKDIR}/bin/notification-file ${STAGE_PLUGINS}/
 	${INSTALL_PROGRAM} ${WRKDIR}/bin/notification-http ${STAGE_PLUGINS}/
 	${INSTALL_PROGRAM} ${WRKDIR}/bin/notification-sentinel ${STAGE_PLUGINS}/
 	${INSTALL_PROGRAM} ${WRKDIR}/bin/notification-slack ${STAGE_PLUGINS}/
 	${INSTALL_PROGRAM} ${WRKDIR}/bin/notification-splunk ${STAGE_PLUGINS}/
 
 	#
 	# Configuration
 	#
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}
 	@(cd ${WRKSRC}/config && ${COPYTREE_SHARE} . ${STAGEDIR}${ETCDIR})
 
 	@${MV} ${STAGEDIR}${ETCDIR}/acquis.yaml \
 		${STAGEDIR}${ETCDIR}/acquis.yaml.sample
 
 	${INSTALL_DATA} ${FILESDIR}/acquis.yaml.sample \
 		${STAGEDIR}${ETCDIR}/acquis.yaml.sample
 
 	@${MV} ${STAGEDIR}${ETCDIR}/config.yaml \
 		${STAGEDIR}${ETCDIR}/config.yaml.sample
 
 	@${MV} ${STAGEDIR}${ETCDIR}/console.yaml \
 		${STAGEDIR}${ETCDIR}/console.yaml.sample
 
 	@${MV} ${STAGEDIR}${ETCDIR}/profiles.yaml \
 		${STAGEDIR}${ETCDIR}/profiles.yaml.sample
 
 	# managed by "cscli simulation"
 	@${MV} ${STAGEDIR}${ETCDIR}/simulation.yaml \
 		${STAGEDIR}${ETCDIR}/simulation.yaml.sample
 
 	#
 	# Plugin configuration
 	#
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/notifications
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/notifications/email
 	@${MV} ${WRKSRC}/cmd/notification-email/email.yaml \
 		${STAGEDIR}${ETCDIR}/notifications/email.yaml.sample
 
+	@${MKDIR} ${STAGEDIR}${ETCDIR}/notifications/file
+	@${MV} ${WRKSRC}/cmd/notification-file/file.yaml \
+		${STAGEDIR}${ETCDIR}/notifications/file.yaml.sample
+
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/notifications/http
 	@${MV} ${WRKSRC}/cmd/notification-http/http.yaml \
 		${STAGEDIR}${ETCDIR}/notifications/http.yaml.sample
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/notifications/sentinel
 	@${MV} ${WRKSRC}/cmd/notification-sentinel/sentinel.yaml \
 		${STAGEDIR}${ETCDIR}/notifications/sentinel.yaml.sample
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/notifications/slack
 	@${MV} ${WRKSRC}/cmd/notification-slack/slack.yaml \
 		${STAGEDIR}${ETCDIR}/notifications/slack.yaml.sample
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/notifications/splunk
 	@${MV} ${WRKSRC}/cmd/notification-splunk/splunk.yaml \
 		${STAGEDIR}${ETCDIR}/notifications/splunk.yaml.sample
 
 	# updated by "cscli machines" at first service start
 	@${MV} ${STAGEDIR}${ETCDIR}/local_api_credentials.yaml \
 		${STAGEDIR}${ETCDIR}/local_api_credentials.yaml.sample
 
 	# updated by "cscli capi" at first service start
 	@${MV} ${STAGEDIR}${ETCDIR}/online_api_credentials.yaml \
 		${STAGEDIR}${ETCDIR}/online_api_credentials.yaml.sample
 
 	#
 	# Data
 	#
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/hub
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/acquis.d
 	@${MKDIR} ${STAGEDIR}/var/db/crowdsec/data
 	@${MKDIR} ${STAGEDIR}/var/db/crowdsec/data/trace
 
 	#
 	# Cron
 	#
 
 	@${MKDIR} ${STAGEDIR}${PREFIX}/libexec/crowdsec
 	${INSTALL_DATA} ${WRKDIR}/upgrade-hub \
 		${STAGEDIR}${PREFIX}/libexec/crowdsec/upgrade-hub
 
 	#
 	# Cleanup
 	#
 
 	@${RM} ${STAGEDIR}${ETCDIR}/acquis_win.yaml
 	@${RM} ${STAGEDIR}${ETCDIR}/config_win_no_lapi.yaml
 	@${RM} ${STAGEDIR}${ETCDIR}/config_win.yaml
 	@${RM} ${STAGEDIR}${ETCDIR}/crowdsec.cron.daily
 	@${RM} ${STAGEDIR}${ETCDIR}/crowdsec.service
 	@${RM} ${STAGEDIR}${ETCDIR}/context.yaml
 	@${RM} ${STAGEDIR}${ETCDIR}/detect.yaml
 	@${RM} ${STAGEDIR}${ETCDIR}/dev.yaml
 	@${RM} ${STAGEDIR}${ETCDIR}/windows-dev.yaml
 	@${RM} ${STAGEDIR}${ETCDIR}/user.yaml
 	@${RMDIR} ${STAGEDIR}${ETCDIR}/notifications/email
+	@${RMDIR} ${STAGEDIR}${ETCDIR}/notifications/file
 	@${RMDIR} ${STAGEDIR}${ETCDIR}/notifications/http
 	@${RMDIR} ${STAGEDIR}${ETCDIR}/notifications/sentinel
 	@${RMDIR} ${STAGEDIR}${ETCDIR}/notifications/slack
 	@${RMDIR} ${STAGEDIR}${ETCDIR}/notifications/splunk
 
 post-install:
 	@${MKDIR} ${STAGEDIR}${PREFIX}/etc/cron.d
 	${INSTALL_DATA} ${WRKDIR}/crowdsec.cron ${STAGEDIR}${PREFIX}/etc/cron.d/crowdsec
 
 .include <bsd.port.mk>
diff --git a/security/crowdsec/distinfo b/security/crowdsec/distinfo
index 6bc97888e68a..ff9215d7e63a 100644
--- a/security/crowdsec/distinfo
+++ b/security/crowdsec/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1761254848
-SHA256 (go/security_crowdsec/crowdsec-v1.7.3/v1.7.3.mod) = c4bbd96e96bb3b6c05909402d1894201ebdff7255e525a228c9756a38576c87e
-SIZE (go/security_crowdsec/crowdsec-v1.7.3/v1.7.3.mod) = 11817
-SHA256 (go/security_crowdsec/crowdsec-v1.7.3/v1.7.3.zip) = f9c0b012fc97bcbe26948a27d7c4e80f3adf0015af26298ffaf72fd395b79c09
-SIZE (go/security_crowdsec/crowdsec-v1.7.3/v1.7.3.zip) = 1819249
+TIMESTAMP = 1764861310
+SHA256 (go/security_crowdsec/crowdsec-v1.7.4/v1.7.4.mod) = 5bd7d91fdcc5c1af241aadbe80cb8ee99c9ff1f502c34e4e6d43f3e788fa2873
+SIZE (go/security_crowdsec/crowdsec-v1.7.4/v1.7.4.mod) = 12355
+SHA256 (go/security_crowdsec/crowdsec-v1.7.4/v1.7.4.zip) = 05803ff18eff8253d109a6cb4968428274e2299f5d950f701a1416f2341aa752
+SIZE (go/security_crowdsec/crowdsec-v1.7.4/v1.7.4.zip) = 1856566
diff --git a/security/crowdsec/files/patch-pkg_fsutil_getfstype__freebsd.go b/security/crowdsec/files/patch-pkg_fsutil_getfstype__freebsd.go
new file mode 100644
index 000000000000..579dfc870371
--- /dev/null
+++ b/security/crowdsec/files/patch-pkg_fsutil_getfstype__freebsd.go
@@ -0,0 +1,10 @@
+--- pkg/fsutil/getfstype_freebsd.go.orig	2025-12-05 08:44:44 UTC
++++ pkg/fsutil/getfstype_freebsd.go
+@@ -1,6 +1,6 @@
+ //go:build freebsd
+ 
+-package types
++package fsutil
+ 
+ import (
+     "fmt"
diff --git a/security/crowdsec/pkg-plist b/security/crowdsec/pkg-plist
index d96c9de762dd..e309d3458775 100644
--- a/security/crowdsec/pkg-plist
+++ b/security/crowdsec/pkg-plist
@@ -1,55 +1,57 @@
 @mode 0755
 bin/crowdsec
 bin/cscli
 bin/crowdsec-cli
 libexec/crowdsec/upgrade-hub
 @mode 0600
 @sample %%ETCDIR%%/config.yaml.sample
 @sample %%ETCDIR%%/local_api_credentials.yaml.sample
 @sample %%ETCDIR%%/online_api_credentials.yaml.sample
 @sample %%ETCDIR%%/notifications/email.yaml.sample
+@sample %%ETCDIR%%/notifications/file.yaml.sample
 @sample %%ETCDIR%%/notifications/http.yaml.sample
 @sample %%ETCDIR%%/notifications/sentinel.yaml.sample
 @sample %%ETCDIR%%/notifications/slack.yaml.sample
 @sample %%ETCDIR%%/notifications/splunk.yaml.sample
 @mode 0644
 @sample %%ETCDIR%%/acquis.yaml.sample
 @sample %%ETCDIR%%/console.yaml.sample
 @sample %%ETCDIR%%/profiles.yaml.sample
 @sample %%ETCDIR%%/simulation.yaml.sample
 %%ETCDIR%%/patterns/aws
 %%ETCDIR%%/patterns/bacula
 %%ETCDIR%%/patterns/bro
 %%ETCDIR%%/patterns/cowrie_honeypot
 %%ETCDIR%%/patterns/exim
 %%ETCDIR%%/patterns/firewalls
 %%ETCDIR%%/patterns/haproxy
 %%ETCDIR%%/patterns/java
 %%ETCDIR%%/patterns/junos
 %%ETCDIR%%/patterns/linux-syslog
 %%ETCDIR%%/patterns/mcollective
 %%ETCDIR%%/patterns/modsecurity
 %%ETCDIR%%/patterns/mongodb
 %%ETCDIR%%/patterns/mysql
 %%ETCDIR%%/patterns/nagios
 %%ETCDIR%%/patterns/nginx
 %%ETCDIR%%/patterns/paths
 %%ETCDIR%%/patterns/postgresql
 %%ETCDIR%%/patterns/rails
 %%ETCDIR%%/patterns/redis
 %%ETCDIR%%/patterns/ruby
 %%ETCDIR%%/patterns/smb
 %%ETCDIR%%/patterns/ssh
 %%ETCDIR%%/patterns/tcpdump
 etc/cron.d/crowdsec
 @mode 0755
 lib/crowdsec/plugins/notification-email
+lib/crowdsec/plugins/notification-file
 lib/crowdsec/plugins/notification-http
 lib/crowdsec/plugins/notification-sentinel
 lib/crowdsec/plugins/notification-slack
 lib/crowdsec/plugins/notification-splunk
 @dir %%ETCDIR%%/hub
 @dir %%ETCDIR%%/acquis.d
 @dir /var/db/crowdsec
 @dir /var/db/crowdsec/data
 @dir /var/db/crowdsec/data/trace