diff --git a/security/crowdsec/Makefile b/security/crowdsec/Makefile
index b73a2d5e3487..4e3e5e7e7f69 100644
--- a/security/crowdsec/Makefile
+++ b/security/crowdsec/Makefile
@@ -1,174 +1,177 @@
 PORTNAME=	crowdsec
 DISTVERSIONPREFIX=	v
-DISTVERSION=	1.6.1
-PORTREVISION=	2
+DISTVERSION=	1.6.2
+# the remote tag was moved for 1.6.2, so we force another tag to avoid the version on proxy.golang.org
+DISTVERSIONSUFFIX=     -final
 CATEGORIES=	security
 
 MAINTAINER=	marco@crowdsec.net
 COMMENT=	CrowdSec lightweight and collaborative security engine
 WWW=		https://github.com/crowdsecurity/crowdsec
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 LIB_DEPENDS=	libabsl_base.so:devel/abseil \
 		libre2.so:devel/re2
 
-USES=		go:1.21,modules pkgconfig
-_COMMIT=	0746e0c0
+USES=		go:1.22,modules pkgconfig
+_COMMIT=	16bfab86
 _BUILD_DATE=	$$(date -u "+%F_%T")
 USE_RC_SUBR=	crowdsec
 
 GO_MODULE=	github.com/crowdsecurity/crowdsec
 GO_TARGET=	./cmd/crowdsec \
 		./cmd/crowdsec-cli \
 		./cmd/notification-email \
 		./cmd/notification-http \
 		./cmd/notification-sentinel \
 		./cmd/notification-slack \
 		./cmd/notification-splunk
 
 GO_BUILDFLAGS=	-v -trimpath -tags netgo,osusergo,sqlite_omit_load_extension,re2_cgo \
 		-ldflags="\
 		-a -s -w \
-		-X github.com/crowdsecurity/go-cs-lib/version.Version=${DISTVERSIONPREFIX}${DISTVERSION}-freebsd \
+		-X github.com/crowdsecurity/go-cs-lib/version.Version=${DISTVERSIONPREFIX}${DISTVERSION} \
 		-X github.com/crowdsecurity/go-cs-lib/version.BuildDate=${_BUILD_DATE} \
 		-X github.com/crowdsecurity/go-cs-lib/version.Tag=${_COMMIT} \
 		-X ${GO_MODULE}/pkg/cwversion.Codename=alphaga \
 		-X ${GO_MODULE}/pkg/csconfig.defaultConfigDir=${PREFIX}/etc/crowdsec \
 		-X ${GO_MODULE}/pkg/csconfig.defaultDataDir=/var/db/crowdsec/data \
 		-X ${GO_MODULE}/pkg/cwversion.Libre2=C++"
 
 SUB_FILES=	pkg-deinstall pkg-install pkg-message crowdsec.cron upgrade-hub
 
 OPTIONS_DEFINE=	FIREWALL_BOUNCER
 OPTIONS_DEFAULT=
 
 FIREWALL_BOUNCER_DESC=	Depend on security/crowdsec-firewall-bouncer
 FIREWALL_BOUNCER_RUN_DEPENDS=	crowdsec-firewall-bouncer>=0.0.27:security/crowdsec-firewall-bouncer
 
 PLUGIN_DIR=	${PREFIX}/lib/crowdsec/plugins
 STAGE_PLUGINS=	${STAGEDIR}${PLUGIN_DIR}
 STAGE_BIN=	${STAGEDIR}${PREFIX}/bin
 
 post-patch:
 	@${REINPLACE_CMD} 's,/etc/crowdsec/,${ETCDIR}/,g' \
 		${WRKSRC}/config/config.yaml
 
 	@${REINPLACE_CMD} 's,/var/lib/,/var/db/,g' \
 		${WRKSRC}/config/config.yaml
 
 do-install:
 	#
 	# Binaries
 	#
 
 	${INSTALL_PROGRAM} ${WRKDIR}/bin/crowdsec ${STAGE_BIN}/
 	${INSTALL_PROGRAM} ${WRKDIR}/bin/crowdsec-cli ${STAGE_BIN}/cscli
 
 	# keep this around for compatibility
 	${LN} -s cscli ${STAGE_BIN}/crowdsec-cli
 
 	@${MKDIR} ${STAGE_PLUGINS}
 	${INSTALL_PROGRAM} ${WRKDIR}/bin/notification-email ${STAGE_PLUGINS}/
 	${INSTALL_PROGRAM} ${WRKDIR}/bin/notification-http ${STAGE_PLUGINS}/
 	${INSTALL_PROGRAM} ${WRKDIR}/bin/notification-sentinel ${STAGE_PLUGINS}/
 	${INSTALL_PROGRAM} ${WRKDIR}/bin/notification-slack ${STAGE_PLUGINS}/
 	${INSTALL_PROGRAM} ${WRKDIR}/bin/notification-splunk ${STAGE_PLUGINS}/
 
 	#
 	# Configuration
 	#
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}
 	@(cd ${WRKSRC}/config && ${COPYTREE_SHARE} . ${STAGEDIR}${ETCDIR})
 
 	@${MV} ${STAGEDIR}${ETCDIR}/acquis.yaml \
 		${STAGEDIR}${ETCDIR}/acquis.yaml.sample
 
 	@${MV} ${STAGEDIR}${ETCDIR}/config.yaml \
 		${STAGEDIR}${ETCDIR}/config.yaml.sample
 
 	@${MV} ${STAGEDIR}${ETCDIR}/console.yaml \
 		${STAGEDIR}${ETCDIR}/console.yaml.sample
 
 	@${MV} ${STAGEDIR}${ETCDIR}/profiles.yaml \
 		${STAGEDIR}${ETCDIR}/profiles.yaml.sample
 
 	# managed by "cscli simulation"
 	@${MV} ${STAGEDIR}${ETCDIR}/simulation.yaml \
 		${STAGEDIR}${ETCDIR}/simulation.yaml.sample
 
 	#
 	# Plugin configuration
 	#
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/notifications
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/notifications/email
 	@${MV} ${WRKSRC}/cmd/notification-email/email.yaml \
 		${STAGEDIR}${ETCDIR}/notifications/email.yaml.sample
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/notifications/http
 	@${MV} ${WRKSRC}/cmd/notification-http/http.yaml \
 		${STAGEDIR}${ETCDIR}/notifications/http.yaml.sample
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/notifications/sentinel
 	@${MV} ${WRKSRC}/cmd/notification-sentinel/sentinel.yaml \
 		${STAGEDIR}${ETCDIR}/notifications/sentinel.yaml.sample
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/notifications/slack
 	@${MV} ${WRKSRC}/cmd/notification-slack/slack.yaml \
 		${STAGEDIR}${ETCDIR}/notifications/slack.yaml.sample
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/notifications/splunk
 	@${MV} ${WRKSRC}/cmd/notification-splunk/splunk.yaml \
 		${STAGEDIR}${ETCDIR}/notifications/splunk.yaml.sample
 
 	# updated by "cscli machines" at first service start
 	@${MV} ${STAGEDIR}${ETCDIR}/local_api_credentials.yaml \
 		${STAGEDIR}${ETCDIR}/local_api_credentials.yaml.sample
 
 	# updated by "cscli capi" at first service start
 	@${MV} ${STAGEDIR}${ETCDIR}/online_api_credentials.yaml \
 		${STAGEDIR}${ETCDIR}/online_api_credentials.yaml.sample
 
 	#
 	# Data
 	#
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/hub
+	@${MKDIR} ${STAGEDIR}${ETCDIR}/acquis.d
 	@${MKDIR} ${STAGEDIR}/var/db/crowdsec/data
+	@${MKDIR} ${STAGEDIR}/var/db/crowdsec/data/trace
 
 	#
 	# Cron
 	#
 
 	@${MKDIR} ${STAGEDIR}${PREFIX}/libexec/crowdsec
 	${INSTALL_DATA} ${WRKDIR}/upgrade-hub \
 		${STAGEDIR}${PREFIX}/libexec/crowdsec/upgrade-hub
 
 	#
 	# Cleanup
 	#
 
 	@${RM} ${STAGEDIR}${ETCDIR}/acquis_win.yaml
 	@${RM} ${STAGEDIR}${ETCDIR}/config_win_no_lapi.yaml
 	@${RM} ${STAGEDIR}${ETCDIR}/config_win.yaml
 	@${RM} ${STAGEDIR}${ETCDIR}/crowdsec.cron.daily
 	@${RM} ${STAGEDIR}${ETCDIR}/crowdsec.service
 	@${RM} ${STAGEDIR}${ETCDIR}/context.yaml
 	@${RM} ${STAGEDIR}${ETCDIR}/detect.yaml
 	@${RM} ${STAGEDIR}${ETCDIR}/dev.yaml
 	@${RM} ${STAGEDIR}${ETCDIR}/user.yaml
 	@${RMDIR} ${STAGEDIR}${ETCDIR}/notifications/email
 	@${RMDIR} ${STAGEDIR}${ETCDIR}/notifications/http
 	@${RMDIR} ${STAGEDIR}${ETCDIR}/notifications/sentinel
 	@${RMDIR} ${STAGEDIR}${ETCDIR}/notifications/slack
 	@${RMDIR} ${STAGEDIR}${ETCDIR}/notifications/splunk
 
 post-install:
 	@${MKDIR} ${STAGEDIR}${PREFIX}/etc/cron.d
 	${INSTALL_DATA} ${WRKDIR}/crowdsec.cron ${STAGEDIR}${PREFIX}/etc/cron.d/crowdsec
 
 .include <bsd.port.mk>
diff --git a/security/crowdsec/distinfo b/security/crowdsec/distinfo
index 9cb7e50d131c..fc31557d4e7f 100644
--- a/security/crowdsec/distinfo
+++ b/security/crowdsec/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1713296982
-SHA256 (go/security_crowdsec/crowdsec-v1.6.1/v1.6.1.mod) = b7957886889cef4dd7166ae8996a93d0f2f5071a8b2155c16c190388f71baeee
-SIZE (go/security_crowdsec/crowdsec-v1.6.1/v1.6.1.mod) = 10066
-SHA256 (go/security_crowdsec/crowdsec-v1.6.1/v1.6.1.zip) = fbcee972b1c5b24b4b3a278381f2bd8837ca122e302defc747a76123a8c079c9
-SIZE (go/security_crowdsec/crowdsec-v1.6.1/v1.6.1.zip) = 1483959
+TIMESTAMP = 1717420493
+SHA256 (go/security_crowdsec/crowdsec-v1.6.2-final/v1.6.2-final.mod) = 0cd8f4a237f0901164c8d80fa76c6bc7354054e867c7719c9691f4e5ae4b4a31
+SIZE (go/security_crowdsec/crowdsec-v1.6.2-final/v1.6.2-final.mod) = 10156
+SHA256 (go/security_crowdsec/crowdsec-v1.6.2-final/v1.6.2-final.zip) = e07898b78bd6ff09a1913b7cb8f69b6c3dd3c2add5b4554cc5b8084c91eb96ff
+SIZE (go/security_crowdsec/crowdsec-v1.6.2-final/v1.6.2-final.zip) = 1505724
diff --git a/security/crowdsec/files/crowdsec.in b/security/crowdsec/files/crowdsec.in
index 703a3045657d..ba0a40a19250 100644
--- a/security/crowdsec/files/crowdsec.in
+++ b/security/crowdsec/files/crowdsec.in
@@ -1,110 +1,107 @@
 #!/bin/sh
 
 # PROVIDE: crowdsec
 # BEFORE: crowdsec_firewall
 # REQUIRE: LOGIN DAEMON NETWORKING
 # KEYWORD: shutdown
 #
 # Add the following lines to /etc/rc.conf.local or /etc/rc.conf
 # to enable this service:
 #
 # crowdsec_enable (bool):	Set it to YES to enable crowdsec agent.
 #				Default is "NO".
 # crowdsec_config (str):	Set the agent config path.
 #				Default is "%%PREFIX%%/etc/crowdsec/config.yaml".
 # crowdsec_machine_name (str):	Name for the crowdsec instance when it's running its own lapi.
 #				Default is "localhost".
-# crowdsec_flags (str):	Set the extra flags to run the agent.
-#				Default is ""
 
 . /etc/rc.subr
 
 name=crowdsec
 rcvar=crowdsec_enable
 
 load_rc_config "$name"
 
 : "${crowdsec_enable:=NO}"
 : "${crowdsec_config:=%%PREFIX%%/etc/crowdsec/config.yaml}"
 : "${crowdsec_machine_name:=localhost}"
-: "${crowdsec_flags:=}"
 
 pidfile=/var/run/${name}_daemon.pid
 pidfile_crowdsec=/var/run/${name}.pid
 required_files="$crowdsec_config"
 command="/usr/sbin/daemon"
 command_crowdsec="%%PREFIX%%/bin/crowdsec"
 command_cscli="%%PREFIX%%/bin/cscli"
-command_args="-f -P ${pidfile} -p ${pidfile_crowdsec} -r -R 10 -t \"${name}\" -- ${command_crowdsec} -c ${crowdsec_config} ${crowdsec_flags}"
+command_args="-f -P ${pidfile} -p ${pidfile_crowdsec} -r -R 10 -t \"${name}\" -- ${command_crowdsec} -c ${crowdsec_config}"
 reload_cmd="${name}_reload"
 start_precmd="${name}_precmd"
 configtest_cmd="${name}_configtest"
 reload_precmd="${name}_configtest"
 restart_precmd="${name}_configtest"
 stop_precmd="${name}_stop_precmd"
 stop_postcmd="${name}_stop_postcmd"
 extra_commands="configtest reload"
 
 crowdsec_stop_precmd() {
     # take note of the pid, because sbin/daemon will remove the file
     # without waiting for crowdsec to exit
     if [ -r "$pidfile_crowdsec" ]; then
         _CROWDSECPID="$(check_pidfile "$pidfile_crowdsec" "$command_crowdsec")"
         export _CROWDSECPID
     fi
 }
 
 crowdsec_stop_postcmd() {
     # wait for process to exit before restarting, or it will find the http port in use
     if [ -n "$_CROWDSECPID" ]; then
         wait_for_pids "$_CROWDSECPID"
     fi
 }
 
 crowdsec_precmd() {
     cs_cli() {
         "$command_cscli" -c "$crowdsec_config" "$@"
     }
 
     Config() {
         cs_cli config show --key "Config.$1"
     }
 
     # Is the LAPI enabled on this node?
     if [ "$(Config API.Server.Enable)" != "false" ]; then
         # There are no machines, we create one for cscli & log processor
         if [ "$(cs_cli machines list -o json --error)" = "[]" ]; then
             echo "Registering LAPI"
             cs_cli machines add "${crowdsec_machine_name}" --auto --force --error || :
         fi
 
         CONFIG_DIR=$(Config ConfigPaths.ConfigDir)
 
         # Register to the central server to receive the community blocklist and more
         if [ ! -s "${CONFIG_DIR}/online_api_credentials.yaml" ]; then
             echo "Registering CAPI"
             cs_cli capi register || :
         fi
     fi
 
     # install the collection for the first time, or if it has been removed
     cs_cli collections inspect crowdsecurity/freebsd --no-metrics 2>/dev/null | grep ^installed | grep -q true || \
         cs_cli collections install crowdsecurity/freebsd || :
 }
 
 crowdsec_configtest() {
     echo "Performing sanity check on ${name} configuration."
     if ! "$command_crowdsec" -c "$crowdsec_config" -t -error; then
         exit 1
     fi
     echo "Configuration test OK"
 }
 
 crowdsec_reload() {
     echo "Reloading configuration"
     if [ -r "$pidfile_crowdsec" ]; then
         kill -HUP "$(check_pidfile "$pidfile_crowdsec" "${command_crowdsec}")"
     fi
 }
 
 run_rc_command "$1"
diff --git a/security/crowdsec/files/patch-pkg_csconfig_database.go b/security/crowdsec/files/patch-pkg_csconfig_database.go
deleted file mode 100644
index c34546376722..000000000000
--- a/security/crowdsec/files/patch-pkg_csconfig_database.go
+++ /dev/null
@@ -1,36 +0,0 @@
---- pkg/csconfig/database.go.orig	2024-04-24 21:31:39 UTC
-+++ pkg/csconfig/database.go
-@@ -76,26 +76,24 @@ func (c *Config) LoadDBConfig(inCli bool) error {
- 		if c.DbConfig.UseWal == nil {
- 			dbDir := filepath.Dir(c.DbConfig.DbPath)
- 			isNetwork, fsType, err := types.IsNetworkFS(dbDir)
--			if err != nil {
-+			switch {
-+			case err != nil:
- 				log.Warnf("unable to determine if database is on network filesystem: %s", err)
- 				log.Warning("You are using sqlite without WAL, this can have a performance impact. If you do not store the database in a network share, set db_config.use_wal to true. Set explicitly to false to disable this warning.")
--				return nil
--			}
--			if isNetwork {
-+			case isNetwork:
- 				log.Debugf("database is on network filesystem (%s), setting useWal to false", fsType)
- 				c.DbConfig.UseWal = ptr.Of(false)
--			} else {
-+			default:
- 				log.Debugf("database is on local filesystem (%s), setting useWal to true", fsType)
- 				c.DbConfig.UseWal = ptr.Of(true)
- 			}
- 		} else if *c.DbConfig.UseWal {
- 			dbDir := filepath.Dir(c.DbConfig.DbPath)
- 			isNetwork, fsType, err := types.IsNetworkFS(dbDir)
--			if err != nil {
-+			switch {
-+			case err != nil:
- 				log.Warnf("unable to determine if database is on network filesystem: %s", err)
--				return nil
--			}
--			if isNetwork {
-+			case isNetwork:
- 				log.Warnf("database seems to be stored on a network share (%s), but useWal is set to true. Proceed at your own risk.", fsType)
- 			}
- 		}
diff --git a/security/crowdsec/files/patch-pkg_types_getfstype.go b/security/crowdsec/files/patch-pkg_types_getfstype.go
deleted file mode 100644
index 9b9775265421..000000000000
--- a/security/crowdsec/files/patch-pkg_types_getfstype.go
+++ /dev/null
@@ -1,8 +0,0 @@
---- pkg/types/getfstype.go.orig	2024-04-24 21:23:59 UTC
-+++ pkg/types/getfstype.go
-@@ -1,4 +1,4 @@
--//go:build !windows
-+//go:build !windows && !freebsd
- 
- package types
- 
diff --git a/security/crowdsec/files/patch-pkg_types_getfstype__freebsd.go b/security/crowdsec/files/patch-pkg_types_getfstype__freebsd.go
deleted file mode 100644
index 0fe3a5157120..000000000000
--- a/security/crowdsec/files/patch-pkg_types_getfstype__freebsd.go
+++ /dev/null
@@ -1,28 +0,0 @@
---- pkg/types/getfstype_freebsd.go.orig	2024-04-24 21:25:32 UTC
-+++ pkg/types/getfstype_freebsd.go
-@@ -0,0 +1,25 @@
-+//go:build freebsd
-+
-+package types
-+
-+import (
-+    "fmt"
-+    "syscall"
-+)
-+
-+func GetFSType(path string) (string, error) {
-+	var fsStat syscall.Statfs_t
-+
-+	if err := syscall.Statfs(path, &fsStat); err != nil {
-+		return "", fmt.Errorf("failed to get filesystem type: %w", err)
-+	}
-+
-+	bs := fsStat.Fstypename
-+
-+	b := make([]byte, len(bs))
-+	for i, v := range bs {
-+		b[i] = byte(v)
-+	}
-+
-+	return string(b), nil
-+}
diff --git a/security/crowdsec/pkg-plist b/security/crowdsec/pkg-plist
index dd1afd08742f..d96c9de762dd 100644
--- a/security/crowdsec/pkg-plist
+++ b/security/crowdsec/pkg-plist
@@ -1,53 +1,55 @@
 @mode 0755
 bin/crowdsec
 bin/cscli
 bin/crowdsec-cli
 libexec/crowdsec/upgrade-hub
 @mode 0600
 @sample %%ETCDIR%%/config.yaml.sample
 @sample %%ETCDIR%%/local_api_credentials.yaml.sample
 @sample %%ETCDIR%%/online_api_credentials.yaml.sample
 @sample %%ETCDIR%%/notifications/email.yaml.sample
 @sample %%ETCDIR%%/notifications/http.yaml.sample
 @sample %%ETCDIR%%/notifications/sentinel.yaml.sample
 @sample %%ETCDIR%%/notifications/slack.yaml.sample
 @sample %%ETCDIR%%/notifications/splunk.yaml.sample
 @mode 0644
 @sample %%ETCDIR%%/acquis.yaml.sample
 @sample %%ETCDIR%%/console.yaml.sample
 @sample %%ETCDIR%%/profiles.yaml.sample
 @sample %%ETCDIR%%/simulation.yaml.sample
 %%ETCDIR%%/patterns/aws
 %%ETCDIR%%/patterns/bacula
 %%ETCDIR%%/patterns/bro
 %%ETCDIR%%/patterns/cowrie_honeypot
 %%ETCDIR%%/patterns/exim
 %%ETCDIR%%/patterns/firewalls
 %%ETCDIR%%/patterns/haproxy
 %%ETCDIR%%/patterns/java
 %%ETCDIR%%/patterns/junos
 %%ETCDIR%%/patterns/linux-syslog
 %%ETCDIR%%/patterns/mcollective
 %%ETCDIR%%/patterns/modsecurity
 %%ETCDIR%%/patterns/mongodb
 %%ETCDIR%%/patterns/mysql
 %%ETCDIR%%/patterns/nagios
 %%ETCDIR%%/patterns/nginx
 %%ETCDIR%%/patterns/paths
 %%ETCDIR%%/patterns/postgresql
 %%ETCDIR%%/patterns/rails
 %%ETCDIR%%/patterns/redis
 %%ETCDIR%%/patterns/ruby
 %%ETCDIR%%/patterns/smb
 %%ETCDIR%%/patterns/ssh
 %%ETCDIR%%/patterns/tcpdump
 etc/cron.d/crowdsec
 @mode 0755
 lib/crowdsec/plugins/notification-email
 lib/crowdsec/plugins/notification-http
 lib/crowdsec/plugins/notification-sentinel
 lib/crowdsec/plugins/notification-slack
 lib/crowdsec/plugins/notification-splunk
 @dir %%ETCDIR%%/hub
-@dir /var/db/crowdsec/data
+@dir %%ETCDIR%%/acquis.d
 @dir /var/db/crowdsec
+@dir /var/db/crowdsec/data
+@dir /var/db/crowdsec/data/trace