What's Changed
- file table : lnk-related columns were not always computed on Windows by @thierryfranzetti in https://github.com/osquery/osquery/pull/8855
- Fix
process_open_handlescomments and spec by @directionless in https://github.com/osquery/osquery/pull/8853 - Remove cleanup_ec2_runners action by @zwass in https://github.com/osquery/osquery/pull/8856
- Upgrade Linux toolchain to 1.3.0 by @zwass in https://github.com/osquery/osquery/pull/8814
- Update Linux build docs for toolchain 1.3.0 by @zwass in https://github.com/osquery/osquery/pull/8868
- fix: clear errno before getmntent_r to avoid false error logs at EOF by @stefanamaerz in https://github.com/osquery/osquery/pull/8875
- Conditionally install init.d script and fix postrm cleanup by @a-cognet in https://github.com/osquery/osquery/pull/8857
- Remove older cipher suites from kTLSCiphers by @thom-bartlett in https://github.com/osquery/osquery/pull/8872
- feat: Add the column protector_types to the table bitlocker_info by @rchan-cjj in https://github.com/osquery/osquery/pull/8873
- Fix: Windows prefetch table does not report full executable path by @raaz252 in https://github.com/osquery/osquery/pull/8924
- Fix heap buffer overflow in Windows processes table (GHSA-4r78-6hg6-33gg) by @directionless in https://github.com/osquery/osquery/pull/8934
- Preserve object identifiers in Windows certificates table via subject2/issuer2 by @getvictor in https://github.com/osquery/osquery/pull/8963
- Switch authenticode getOriginalProgramName to CryptDecodeObjectEx by @directionless in https://github.com/osquery/osquery/pull/8923
- Fix Linux audit-based process_file_events cache cleanup by @zwass in https://github.com/osquery/osquery/pull/8950
- Ensure in-progress file carves are readable only by the user running osquery by @zwass in https://github.com/osquery/osquery/pull/8961
- bitlocker_info: read ProtectionStatus via GetProtectionStatus() method to avoid stale cached value by @rodchristiansen in https://github.com/osquery/osquery/pull/8931
- Update macOS CI configurations by @zwass in https://github.com/osquery/osquery/pull/8871
- Fix macOS build for Boost by @zwass in https://github.com/osquery/osquery/pull/8982
- Document macOS platform support status by @thebeaverliam in https://github.com/osquery/osquery/pull/8926
- Scan XDG Base Directory Firefox profiles in firefox_addons by @munzzyy in https://github.com/osquery/osquery/pull/8986
- Add .devin path to vscode_extensions for the Windsurf rebrand by @munzzyy in https://github.com/osquery/osquery/pull/8987
- Update GitHub Actions caching strategy by @zwass in https://github.com/osquery/osquery/pull/8866
- Update ccache configurations for CI and local development by @zwass in https://github.com/osquery/osquery/pull/8865
- Fix wrong end-iterator guard in vscode_extensions (one-past-end deref) by @munzzyy in https://github.com/osquery/osquery/pull/8990
- Add Microsoft Edge and Flatpak paths to chrome_extensions on Linux by @munzzyy in https://github.com/osquery/osquery/pull/8991
- docs: fix SECURITY.md vulnerability-reporting link (dead CONTRIBUTING anchor → GitHub advisory) by @kobihikri in https://github.com/osquery/osquery/pull/8994
- Add missing Chromium browser variants to chrome_extensions table by @FritzX6 in https://github.com/osquery/osquery/pull/8995
- Set default build options for macOS builds by @zwass in https://github.com/osquery/osquery/pull/8867
- Use pre-compiled headers to optimize clean build times by @zwass in https://github.com/osquery/osquery/pull/8843
- libs: Remove unused libexpat by @Smjert in https://github.com/osquery/osquery/pull/8997
- libs: Update openssl to 3.6.3 by @Smjert in https://github.com/osquery/osquery/pull/8998
- Fix macOS SDK auto-detection running before CMAKE_SYSTEM_NAME is set by @TemidayoA in https://github.com/osquery/osquery/pull/9005
- Fix weekday and timezone extraction in non-English locales by @hedwigz in https://github.com/osquery/osquery/pull/9009
- Fix incorrect key_strength for Windows certificates by @munzzyy in https://github.com/osquery/osquery/pull/8989
- Key the recursive-glob visited set on (device, inode) by @munzzyy in https://github.com/osquery/osquery/pull/9010
- Docs: change macOS build steps to recommend Python venv by @pascalrobert in https://github.com/osquery/osquery/pull/9031
- Windows pipes: set SQOS on named-pipe CreateFile (defense-in-depth) by @mike-myers-aapl in https://github.com/osquery/osquery/pull/8999
- Increase maximum config size from 1 MiB to 4MiB by @RebeccaMahany in https://github.com/osquery/osquery/pull/9042
- Add chrome_search_engines table exposing the default search engine by @TemidayoA in https://github.com/osquery/osquery/pull/9029
- Pare down openssl build by @zwass in https://github.com/osquery/osquery/pull/9041
- Add a pacman_packages table by @abguymon in https://github.com/osquery/osquery/pull/9035
- Fix: Do not read FIFOs when hashing files in file_events by @zwass in https://github.com/osquery/osquery/pull/9037
- Split the sudoers header on the first unescaped whitespace by @munzzyy in https://github.com/osquery/osquery/pull/9036
- Fix off-by-one bounds check in the platform_info BIOS parser by @munzzyy in https://github.com/osquery/osquery/pull/9051
- Bump GitHub Actions to latest Node 24 versions by @stefanamaerz in https://github.com/osquery/osquery/pull/9058
- Registry nocase path name by @getvictor in https://github.com/osquery/osquery/pull/9080
- tests: accept macOS 26.6 code-signing authority in SignatureTest by @mike-myers-aapl in https://github.com/osquery/osquery/pull/9103
- Etag config TLS by @rfairburn in https://github.com/osquery/osquery/pull/9033
- Widen mounts table statfs counts from uint32_t to uint64_t by @munzzyy in https://github.com/osquery/osquery/pull/9068
- Add a macports_packages table by @jrjsmrtn in https://github.com/osquery/osquery/pull/9074
- Add negotiated TLS version and cipher suite to curl_certificate by @FrankieAtElastic in https://github.com/osquery/osquery/pull/9071
- Use effective permissions for Linux SMBIOS discovery by @s-bernard in https://github.com/osquery/osquery/pull/9073
- Scan Homebrew and MacPorts prefixes in suid_bin by @jrjsmrtn in https://github.com/osquery/osquery/pull/9075
- Scan the MacPorts prefix in npm_packages and python_packages by @jrjsmrtn in https://github.com/osquery/osquery/pull/9076
- Fix memory leak in the darwin processes table by @iko1 in https://github.com/osquery/osquery/pull/9101
- libs: zlib: 1.3.1 -> 1.3.2 by @mike-myers-aapl in https://github.com/osquery/osquery/pull/9096
- libs: sleuthkit: 4.11.0 -> 4.15.0 by @mike-myers-aapl in https://github.com/osquery/osquery/pull/9097
- CMake: fall back to full submodule clone when shallow update fails by @mike-myers-aapl in https://github.com/osquery/osquery/pull/9108
- Add snap_packages table and yaml-cpp dependency by @zwass in https://github.com/osquery/osquery/pull/9053
- libs: thrift: 0.17.0 -> 0.24.0 by @mike-myers-aapl in https://github.com/osquery/osquery/pull/9098
- Allow overriding osqueryd's TLS User-Agent prefix by @mike-myers-aapl in https://github.com/osquery/osquery/pull/9111
- Enable homebrew_packages on Linux by @Hanabi9248 in https://github.com/osquery/osquery/pull/9106
- libs: librdkafka: 1.8.0 -> 2.15.1 by @lyoung-confluent in https://github.com/osquery/osquery/pull/9112
- libs: libarchive: 3.8.1 -> 3.8.9 by @mike-myers-aapl in https://github.com/osquery/osquery/pull/9095
- Add reserved keywords build-time check for new tables by @lucasmrod in https://github.com/osquery/osquery/pull/9117
- Security issue ignores by @mike-myers-aapl in https://github.com/osquery/osquery/pull/9094
- Enable snappy compression support for the Kafka logger on Windows by @lyoung-confluent in https://github.com/osquery/osquery/pull/9116
- smbios fix for aarch64 by @heywoodlh in https://github.com/osquery/osquery/pull/9120
- Refactor to make macOS CI more efficient by @zwass in https://github.com/osquery/osquery/pull/9110
- Merge tests to reduce link time and artifact sizes in build by @zwass in https://github.com/osquery/osquery/pull/9122
- Strip dead code and local symbols from osquery binaries by @lucasmrod in https://github.com/osquery/osquery/pull/9125
- Remove CI disk cleanups by @zwass in https://github.com/osquery/osquery/pull/8996
- Add fallback for system_info.cpu_brand for Windows ARM by @danielhoward314 in https://github.com/osquery/osquery/pull/9048
- Find SSH keys in subdirectories by @opfpqgoon in https://github.com/osquery/osquery/pull/9128
- Remove install cmake step in CI by @zwass in https://github.com/osquery/osquery/pull/9129
- check license is an object before member lookup in npm_packages by @Sahana2524 in https://github.com/osquery/osquery/pull/9126
- Add flatpak_packages table by @zwass in https://github.com/osquery/osquery/pull/9054
- Add
gpu_infotable for Linux, macOS, and Windows by @javuto in https://github.com/osquery/osquery/pull/9065 - Clean up and set max sizes for CI (s)ccache by @zwass in https://github.com/osquery/osquery/pull/9133
- Add vscode_extensions support for Antigravity and code-server by @zwass in https://github.com/osquery/osquery/pull/9052
- check token count before reading the process name in kernel_panics by @Sahana2524 in https://github.com/osquery/osquery/pull/9131
- Add ai_agent_skills table by @quietrouter in https://github.com/osquery/osquery/pull/9044
- Fix apt_sources silently dropping deb822 repos with Enabled: yes by @stefanamaerz in https://github.com/osquery/osquery/pull/8928
- Discover Safari extensions under Application Support for safari_extensions by @cacaosteve in https://github.com/osquery/osquery/pull/9034
- libs: openssl: 3.6.3 -> 3.6.5 by @mike-myers-aapl in https://github.com/osquery/osquery/pull/9158
- Fix battery table on macOS 27.2 by @zwass in https://github.com/osquery/osquery/pull/9130
- Fix crash in
cups_jobswhencupsGetJobsfails by @mike-myers-aapl in https://github.com/osquery/osquery/pull/9159 - docs: correct scheduled-result JSON examples by @1sgtpepper in https://github.com/osquery/osquery/pull/9160
- registry: don't hold the registry lock across extension removal by @a-cognet in https://github.com/osquery/osquery/pull/9163
- Add
gpu_metricstable by @zwass in https://github.com/osquery/osquery/pull/9030
New Contributors
- @thom-bartlett made their first contribution in https://github.com/osquery/osquery/pull/8872
- @rchan-cjj made their first contribution in https://github.com/osquery/osquery/pull/8873
- @raaz252 made their first contribution in https://github.com/osquery/osquery/pull/8924
- @rodchristiansen made their first contribution in https://github.com/osquery/osquery/pull/8931
- @thebeaverliam made their first contribution in https://github.com/osquery/osquery/pull/8926
- @munzzyy made their first contribution in https://github.com/osquery/osquery/pull/8986
- @kobihikri made their first contribution in https://github.com/osquery/osquery/pull/8994
- @TemidayoA made their first contribution in https://github.com/osquery/osquery/pull/9005
- @hedwigz made their first contribution in https://github.com/osquery/osquery/pull/9009
- @pascalrobert made their first contribution in https://github.com/osquery/osquery/pull/9031
- @mike-myers-aapl made their first contribution in https://github.com/osquery/osquery/pull/8999
- @RebeccaMahany made their first contribution in https://github.com/osquery/osquery/pull/9042
- @abguymon made their first contribution in https://github.com/osquery/osquery/pull/9035
- @rfairburn made their first contribution in https://github.com/osquery/osquery/pull/9033
- @jrjsmrtn made their first contribution in https://github.com/osquery/osquery/pull/9074
- @FrankieAtElastic made their first contribution in https://github.com/osquery/osquery/pull/9071
- @s-bernard made their first contribution in https://github.com/osquery/osquery/pull/9073
- @Hanabi9248 made their first contribution in https://github.com/osquery/osquery/pull/9106
- @lyoung-confluent made their first contribution in https://github.com/osquery/osquery/pull/9112
- @heywoodlh made their first contribution in https://github.com/osquery/osquery/pull/9120
- @danielhoward314 made their first contribution in https://github.com/osquery/osquery/pull/9048
- @opfpqgoon made their first contribution in https://github.com/osquery/osquery/pull/9128
- @Sahana2524 made their first contribution in https://github.com/osquery/osquery/pull/9126
- @quietrouter made their first contribution in https://github.com/osquery/osquery/pull/9044
- @cacaosteve made their first contribution in https://github.com/osquery/osquery/pull/9034
- @1sgtpepper made their first contribution in https://github.com/osquery/osquery/pull/9160
Full Changelog: https://github.com/osquery/osquery/compare/5.23.1...5.24.0
