osquery: vanhemmat versiot ja versiohistoria

What's Changed
- file table : lnk-related columns were not always computed on Windows by @thierryfranzetti in #8855
- Fix process_open_handles comments and spec by @directionless in #8853
- Remove cleanup_ec2_runners action by @zwass in #8856
- Upgrade Linux toolchain to 1.3.0 by @zwass in #8814
- Update Linux build docs for toolchain 1.3.0 by @zwass in #8868
- fix: clear errno before getmntent_r to avoid false error logs at EOF by @stefanamaerz in #8875
- Conditionally install init.d script and fix postrm cleanup by @a-cognet in #8857
- Remove older cipher suites from kTLSCiphers by @thom-bartlett in #8872
- feat: Add the column protector_types to the table bitlocker_info by @rchan-cjj in #8873
- Fix: Windows prefetch table does not report full executable path by @raaz252 in #8924
- Fix heap buffer overflow in Windows processes table (GHSA-4r78-6hg6-33gg) by @directionless in #8934
- Preserve object identifiers in Windows certificates table via subject2/issuer2 by @getvictor in #8963
- Switch authenticode getOriginalProgramName to CryptDecodeObjectEx by @directionless in #8923
- Fix Linux audit-based process_file_events cache cleanup by @zwass in #8950
- Ensure in-progress file carves are readable only by the user running osquery by @zwass in #8961
- bitlocker_info: read ProtectionStatus via GetProtectionStatus() method to avoid stale cached value by @rodchristiansen in #8931
- Update macOS CI configurations by @zwass in #8871
- Fix macOS build for Boost by @zwass in #8982
- Document macOS platform support status by @thebeaverliam in #8926
- Scan XDG Base Directory Firefox profiles in firefox_addons by @munzzyy in #8986
- Add .devin path to vscode_extensions for the Windsurf rebrand by @munzzyy in #8987
- Update GitHub Actions caching strategy by @zwass in #8866
- Update ccache configurations for CI and local development by @zwass in #8865
- Fix wrong end-iterator guard in vscode_extensions (one-past-end deref) by @munzzyy in #8990
- Add Microsoft Edge and Flatpak paths to chrome_extensions on Linux by @munzzyy in #8991
- docs: fix SECURITY.md vulnerability-reporting link (dead CONTRIBUTING anchor → GitHub advisory) by @kobihikri in #8994
- Add missing Chromium browser variants to chrome_extensions table by @FritzX6 in #8995
- Set default build options for macOS builds by @zwass in #8867
- Use pre-compiled headers to optimize clean build times by @zwass in #8843
- libs: Remove unused libexpat by @Smjert in #8997
- libs: Update openssl to 3.6.3 by @Smjert in #8998
- Fix macOS SDK auto-detection running before CMAKE_SYSTEM_NAME is set by @TemidayoA in #9005
- Fix weekday and timezone extraction in non-English locales by @hedwigz in #9009
- Fix incorrect key_strength for Windows certificates by @munzzyy in #8989
- Key the recursive-glob visited set on (device, inode) by @munzzyy in #9010
- Docs: change macOS build steps to recommend Python venv by @pascalrobert in #9031
- Windows pipes: set SQOS on named-pipe CreateFile (defense-in-depth) by @mike-myers-aapl in #8999
- Increase maximum config size from 1 MiB to 4MiB by @RebeccaMahany in #9042
- Add chrome_search_engines table exposing the default search engine by @TemidayoA in #9029
- Pare down openssl build by @zwass in #9041
- Add a pacman_packages table by @abguymon in #9035
- Fix: Do not read FIFOs when hashing files in file_events by @zwass in #9037
- Split the sudoers header on the first unescaped whitespace by @munzzyy in #9036
- Fix off-by-one bounds check in the platform_info BIOS parser by @munzzyy in #9051
- Bump GitHub Actions to latest Node 24 versions by @stefanamaerz in #9058
- Registry nocase path name by @getvictor in #9080
- tests: accept macOS 26.6 code-signing authority in SignatureTest by @mike-myers-aapl in #9103
- Etag config TLS by @rfairburn in #9033
- Widen mounts table statfs counts from uint32_t to uint64_t by @munzzyy in #9068
- Add a macports_packages table by @jrjsmrtn in #9074
- Add negotiated TLS version and cipher suite to curl_certificate by @F

This is a bug and security fix release.
What's Changed
Fixes
- Fix heap buffer overflow in Windows processes table by @seph in #8934
- Fix heap buffer overflow in Windows authenticode table by @seph in #8923
- Fix use-after-free in Linux process_file_events implementation by @zwass in #8950
- Fix incorrect permissions on temporary file carve directories by @zwass in #8961
- Fix documentation for process_open_handles table by @seph in #8853
- Fix subject2 and issuer2 columns for Windows certificates table by @getvictor in #8963
Full Changelog: 5.23.0...5.23.1

What's Changed
Features
- Add process memory scanning capability to yara table by @brian-mckinney in #8782
- Split yara tables into yara_process and yara_file by @brian-mckinney in #8835
- Add Windows process_open_handles table by @brian-mckinney in #8795
- Add secureboot_certificates table for Linux by @zwass in #8844
- Extend python_packages and npm_packages to cover modern package managers by @ariary in #8801
- Add level filtering to the unified_log table by @directionless in #8788
- Disallow newlines in curl custom headers by @directionless in #8787
- Supplement LaunchServices with directory scanning in apps table (#8789) by @getvictor in #8790
- Command line flags for query input and output by @directionless in #8786
- New header-based authentication mechanism for remote APIs by @juan-fdz-hawa in #8805
- Add recursion to npm_packages by @directionless in #8809
- Make profile.py performance thresholds configurable via CLI flags by @stefanamaerz in #8841
- Add ROOT\default to WMI tables by @directionless in #8810
Build & Dependencies
- Update expat to 2.7.4 to fix CVE-2026-25210 by @Sampriti2803 in #8794
- Fix GCC 15 compatibility by @carlsmedstad in #8837
Fixes
- Fix macOS keychain corruption when accessing non-SSV keychain files by copying to temporary files first by @lucasmrod in #8840
- Fix incorrect example queries in table specs by @edwardsb in #8791
- Improve network_name detection on macOS wifi_status table by @lucasmrod in #8781
- Fix a bug in apt_sources parsing by @directionless in #8785
- Add NOCASE and VERSION collation to various columns by @directionless in #8813
- Increase the limit on systemd unit iteration by @directionless in #8802
- Fix format string vulnerability in shell.cpp disconnect_socket() by @directionless in #8824
- Fix saving file times in file carves by @zwass in #8819
- Fix empty results from office_mru table by @thierryfranzetti in #8838
- Fix multiple security vulnerabilities in smc_keys.cpp by @directionless in #8820
- Fix gatekeeper table on macOS 15+ by @thierryfranzetti in #8831
- Fix container bounds checking vulnerabilities by @directionless in #8825
- Reduce noisy logs from chrome_extensions by @lucasmrod in #8792
New Contributors
- @edwardsb made their first contribution in #8791
- @Sampriti2803 made their first contribution in #8794
- @ariary made their first contribution in #8801
- @juan-fdz-hawa made their first contribution in #8805
- @thierryfranzetti made their first contribution in #8838
- @stefanamaerz made their first contribution in #8841
Full Changelog: 5.22.1...5.23.0

5.22.0 macOS binaries will not execute because the signing certificate is out of sync with the provisioning profile. 5.22.1 replaces it.
What's Changed
Features
- Make escapeNonPrintableBytes UTF-8 aware by @nulmete in #8777
- Note: This changes some query results that formerly were rendered as raw unicode bytes and will now be rendered as the corresponding characters.
- Update virtual sql functions to support multiple constraints by @brian-mckinney in #8746
- This allows SELECT * FROM vscode_extensions WHERE uid in (SELECT uid FROM users WHERE include_remote = 1) and similar queries that join or subquery to the users table to include results for remote users.
- Add support for retries in carver by @zwass in #8740
- Preserve file metadata in carver archives by @zwass in #8752
- Add machine-wide provisioned MSIX packages to programs table (#8001) by @getvictor in #8772
Build & Dependencies
- Update osquery-toolchain to 1.2.0 (LLVM 11.0.0, zlib 1.2.13) by @zwass in #8773
- Update Apple provisioning profile for new developer certificates by @zwass in #8780
- build: suppress enum-constexpr-conversion error for boost mpl on macos by @sharvilshah in #8742
- lib: Update openssl to 3.6.1 by @sharvilshah in #8766
Fixes
- Quit carving when sending a block fails by @zwass in #8733
- Fix SMBIOS CPU count by @agiacomolli in #8737
- Fix systemd unit: use .target instead of .service by @ideologysec in #8771
- Fix typo in winbaseobj.table description by @SquidCooki2 in #8768
- Fix JSON handling copy vs. ref semantics by @zwass in #8738
- Fix memory leak in logon_sessions by @directionless in #8779
New Contributors
- @ideologysec made their first contribution in #8771
- @SquidCooki2 made their first contribution in #8768
- @nulmete made their first contribution in #8777
- @brian-mckinney made their first contribution in #8746
Full Changelog: 5.21.0...5.22.1

What's Changed
- Improvements to password_policy table by @zwass in #8705
- Improve file traversal performance and correctness by @Krechals in #8704
- Add support for Login Items and Background Services on modern macOS by @zwass in #8726
- Add last_connected_automatic and last_connected_manual to wifi_networks table by @zwass in #8728
- Refresh resolver state on interval to pick up DNS changes by @zwass in #8716
- Add new darwin certificate trust settings table by @Micah-Kolide in #8715
- Fix crash when querying carves table with carves larger than 2GB by @ksykulev in #8732
- Add support for gzip content-encoding in HTTP client by @zwass in #8731
New Contributors
- @Krechals made their first contribution in #8704
Full Changelog: 5.20.0...5.21.0

What's Changed
Features/Bugs
- Add default path for CA certificate bundle on openSUSE by @iko1 in #8687
- Exclude config views from db migration by @Micah-Kolide in #8678
- Make vscode_extensions more consistently report UUID by @zwass in #8693
- Don't overwrite hardware_version if it has a value by @sbrito85 in #8690
- Support nvm on npm_packages table by @dantecatalfamo in #8694
- Add scoped npm package support in npm_packages table by @lichao127 in #8686
Dependencies
- Fix build against libaudit >=4.1.1 by removing set_aumessage_mode call by @Blarse in #8676
- libs: libarchive: 3.7.9 -> 3.8.1 by @LeSuisse in #8642
Documentation
- Fix SQL examples for system_profiler table by @zwass in #8699
- Add more informative descriptions for mounts.blocks_free and mounts.blocks_available by @jacobshandling in #8701
- Update dns_resolvers documentation to point to interface_details on Windows by @zwass in #8682
New Contributors
- @frankgraziano made their first contribution in #8681
- @Blarse made their first contribution in #8676
- @jacobshandling made their first contribution in #8701
Full Changelog: 5.19.0...5.20.0

What's Changed
Features
- Add table deb_package_files by @zwass in #8657
- Add system_profiler table for macOS by @zwass in #8645
- Add version collate to os_version table's version column by @Micah-Kolide in #8659
- Add entitlements column to macOS signature table by @zwass in #8666
- Add support for VSCode forks in vscode_extensions by @zwass in #8664
Bugfixes
- Fix NSInvalidArgumentException when querying connected_displays by @Synse in #8628
- Fix inconsistent counter resets due to Config::purge() by @skurpad7 in #8635
- Update linux block_device and disk_encryption source data to simple sysfs implementation by @Micah-Kolide in #8182
- Fix ATC for open Firefox databases by @zwass in #8631
Other
- libs: yara: 4.2.3 -> 4.5.4 by @LeSuisse in #8643
- Upgrading zlib to 1.3.1 by @ksykulev in #8625
- Fix build for XCode SDK 16.4 by @lucasmrod in #8640
- Update build instructions for workaround for XCode SDK > 16.3 by @lucasmrod in #8650
- Add Cursor AI editor configurations by @zwass in #8656
- Further improvement to Cursor rules by @zwass in #8662
- Update Windows build instructions by @zwass in #8661
New Contributors
- @Synse made their first contribution in #8628
- @skurpad7 made their first contribution in #8635
Full Changelog: 5.18.0...5.19.0

Revert "Update Windows runner version in hosted_runners.yml (#8618)" (#8633)

5.17.0
Git Commits
What's Changed
- Add CHANGELOG.md entry for 5.16.0 by @lucasmrod in #8548
- Add symlink_target_path to files tables by @DocEmmetBrown in #8502
- cve: Ignore libarchive CVE-2024-26256 by @Smjert in #8546
- Fixes in windows helpers by @zwass in #8549
- Align ES functions with documented macOS versions by @SilverPlate3 in #8338
- Fix include path in logger-plugins.md by @zwass in #8550
- Fix integration test name in Windows build instructions by @zwass in #8552
- Fix event expiration to prevent losing events by @zwass in #8535
- Update shell_history table to include ash by @jbeley in #8568
- Fix dicker container table disk/write metrics, compares "op" values with ignore case by @Kislaci90 in #8566
- Escape service binary path in manage-osqueryd.ps1 by @smithclay in #8569
- Update docker_container_stats table to include memory_inactive_file and memory_total_inactive_file by @kfnorbi in #8577
- Add auto_update and app_name column to homebrew_packages table by @DocEmmetBrown in #8520
- Add support for scheduled queries to run at startup by @Micah-Kolide in #8554
- Boost 1.87 compatibility by @carlsmedstad in #8533
- Pin macos python versions in CI to fix mismatch between builder and test runner by @scottvanta in #8559
- cve: Ignore util-linux CVE-2024-28085 by @Smjert in #8579
- build(deps): bump jinja2 from 3.1.5 to 3.1.6 by @dependabot in #8563
- Fix SMC reading values by @sgress454 in #8583
- Fixes network metrics by @Kislaci90 in #8567
- Implement yara_events table for Windows by @zwass in #8580
- Fix flaky mdfind test in CI by @zwass in #8589
- libs: openssl: 3.2.1 -> 3.4.1 by @LeSuisse in #8586
- Add support for DEB822-style apt sources by @dantecatalfamo in #8556
- Add support for msix packages by @ksykulev in #8585
- Implement dns_lookup_events table on Windows by @zwass in #8553
- Added UpgradeCode to programs table by @ksykulev in #8587
- libs: expat bump from 2.6.0 to 2.7.1 by @LeSuisse in #8595
- Update ubuntu runners to 22.04 by @zwass in #8592
- Refactor ETW helpers for unicode support by @zwass in #8596
- Fix/startup items parsing by @AndreaMarangoni in #8536
- Filter the Win32_Processor query to only required fields by @jaymzjulian in #8598
New Contributors
- @DocEmmetBrown made their first contribution in #8502
- @jbeley made their first contribution in #8568
- @Kislaci90 made their first contribution in #8566
- @smithclay made their first contribution in #8569
- @kfnorbi made their first contribution in #8577
- @scottvanta made their first contribution in #8559
- @LeSuisse made their first contribution in #8586
- @dantecatalfamo made their first contribution in #8556
- @jaymzjulian made their first contribution in #8598
Full Changelog: 5.16.0...5.17.0

5.16.0
Git Commits
Representing commits from 7 contributors! Thank you all.
Table Changes
- Fix the python_paths table to skip unnecessary code paths when filtering by directory (#8544)
- Added python packages in user directories on python_packages (#8504)
- Added RHEL paths for python_packages table (#8529)
- Buffer error logs in deb_packages table (#8540)
- Fix wifi_status to correctly gather network_name on MacOS 14+ (#8530)
- Fix hardware model and version on Lenovo on system_info (#8534)
- Optimize rpm_packages and rpm_package_files use of query context (#8537)
Bug Fixes
- Fix to only deny-list scheduled queries when watchdog is enabled (#8541)
- Switched to wmain to accept non-ascii characters from command line (#8519)

Table Changes

- Add firmware_type column to platform_info on macOS (#7727)
- Add additional vendor support for the windows wmi_bios_info table (#7631)
- Fix docker_container_processes on macOS (#7746)
- Fix process_file_events subscriber being incorrectly initialized (#7759)
- Fix secureboot on windows by acquire the necessary process privileges (#7743)
- Improve macOS mdfind -- Reduce table overhead and support interruption (#7738)
- Remove binary column from firefox_addons table (#7735)
- Remove is_running column from macOS running_apps table (#7774)

Under the Hood improvements

- Add notes field to the schema and associated json (#7747)
- Add extended platforms to the schema and associated json (#7760)
- Fix a leak and improve users and groups APIs on Windows (#7755)
- Have --tls_dump output body to stderr (#7715)
- Improvements to osquery AWS logic (#7714)
- Remove leftover FreeBSD related code and documentation (#7739)

Documentation

- CHANGELOG 5.5.1 (#7737)
- Correct the description on how to configure and use Yara signature urls (#7769)
- Document difference between yara and yara_events (#7744)
- Link to the slack archives (#7786)
- Update docs: _changes tables are not evented (#7762)

Build

- Delete temporary CTest files (#7782)
- Fix table tests for macOS running_apps (#7775)
- Fix table tests for windows platform_info (#7742)
- Migrate jobs from ubuntu-18.04 to ubuntu-20.04 (#7745)
- Remove unused find_packages modules and submodule (#7771)