1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/e17c959df5d4f267b9d7bcf65eb53c156a15a31e|e17c959d>

- Fix sizeof(pointer) vs sizeof(struct) in prefetch validation (#9177) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/c2a112c69f7be31db0af30a6293b02c2130a728d|c2a112c6>

- guard against npos when joining args in parseProcCmdline (#9176) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/b63472acdc8b2b28a2d5763376e969f5dc5c9bd3|b63472ac>

- docs: explain

--extensions_require

for

osqueryi

command-line queries (#9187) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/105b0074c5bb874aeb26839ac8d7af5463fdaa25|105b0074>

- Add vscode_extensions support for VS Code named profiles (#9200) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/f81936ac93c4dffb96366bcc704ab51e6bd8878d|f81936ac>

- rocksdb: support RocksDB 11 DB::Open API (#9201) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/d0e3472ff23d57306700ed1b059bb4868d40bb91|d0e3472f>

- mounts: bound statfs() with a timeout to survive hung filesystems (#9175) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by mike-myers-aapl

<https://github.com/osquery/osquery/commit/82d2ff427a591dfde0437289498c5a500e3a7a6d|82d2ff42>

- check block size before reading BOMPathInfo structs in genBOMPaths (#9184) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/79b680aedd3b5badae8424bdb5bacae5df0eeba5|79b680ae>

- Update Mozilla CA certificate bundle (#9206) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/2230eb7efeff6694994ab33ea6b737ae41af3361|2230eb7e>

- gpu_info: move spec out of posix/ since the table is also built on Windows (#9210) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/33c218b033cb6d61735d365a401a572720c67b9e|33c218b0>

- Fix chrome_extensions state for modern Chromium profiles (#9170) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by directionless

<https://github.com/osquery/osquery/commit/7336fdf2e92e4c66558e43dc00e78cf1826d9739|7336fdf2>

- Add Example Linux SSH investigation query pack (#9118) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by michael-myers

<https://github.com/osquery/osquery/commit/527b236370acc5f5693028776827b6664da34fc8|527b2363>

- Fix host and instance UUID changing when the database is reset (#9203) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by michael-myers

<https://github.com/osquery/osquery/commit/6120b19944d8ff89bd40072f4ff02639049f4257|6120b199>

- logger, distributed: bound memory used by unsent logs and results (#9209) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by lucasmrod

<https://github.com/osquery/osquery/commit/91898f29c56d0c1f254e649d7a3df253d180638d|91898f29>

- Move sleuthkit table specs into specs/ so they're listed as supported on Windows (#9212) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/f045b556fd09ad65bf44cdb60d6a630bc8104b3a|f045b556>

- stop descending a BOM paths node with no indices in genPackageBOM (#9190) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/115f84e867c627e102e8f3aac5d5732d5ac42a2a|115f84e8>

- Move to using Artifacts for compiler caches (#9157) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/6c9cbec21c4b08f2fd62f12de00ebf797c11b29a|6c9cbec2>

- Synchronize custom flag map access (#9195) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/0ce4f583565410e492719a276aa34b916ad538f8|0ce4f583>

- rpm_packages: serialize librpm global state with a shared mutex (#9173) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/1dd117fe61e8077bc69bc7455e59fd530c434ad3|1dd117fe>

- guard truncated drive fields in driveLetterItem and propertyViewDrive (#9218) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/efec3e11ec2922cde661d7509822886536a8ba81|efec3e11>

- cleanup: remove deprecated space in operator""_sz (#9217) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/8d9442011e17d940db18306b47de5cccf62c377d|8d944201>

- Restore BPF tables accidentally removed in 5.24.0 (#9225) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/c3376480760b87eecf822ad9ea1b254eb56c82ae|c3376480>

- Limit decompressed JetBrains plugin metadata size (#9211) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/e67f4527eae9153753c95b5884ac8dab547824eb|e67f4527>

- Fix Linux Audit argv reconstruction (#9208) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/3b4c537fdce539367de74cbf7a7289b4f9212fe2|3b4c537f>

- sql: keep IN constraints when xFilter runs again for the same plan (#9230) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/d30bc221656d8f9879ed2a1f73c57f7554ba26a9|d30bc221>

- stop building a regex from the exe path in deletedMatchesInode (#9216) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/121077ea7050d4c4f95b17b6c66f1018dfdc07f3|121077ea>

- scheduler: record query performance when numeric monitoring is enabled (#9219) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/3cb3095c328852e2938f3c05dcd7579ecd419553|3cb3095c>

- librpm: disable shell command macro expansion (#9223) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/ec5ad88db65a8661b30415a934eba83476577505|ec5ad88d>

- startup_items: read per-user BTM archives on macOS 27 (#9198) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/8b8d3f4b8662306ab7ae00797081dd7a5383f02c|8b8d3f4b>

- check registry value size before decoding fixed-width types in queryKey (#9220) osquery/osquery

Release - 5.24.1 New release published by zwass 5.24.1 Security • Update the Mozilla CA certificate bundle (removes eMudhra certificates) (#9206) • Add

_FORTIFY_SOURCE

, CET/BTI on Linux, and explicit Windows mitigations (#9167) • Disable TLS 1.0 and 1.1 in

curl_certificate

and the OpenSSL build (#9192, #9202) • Limit decompressed JetBrains plugin metadata size (#9211) • Disable shell command macro expansion in librpm (#9223) • Fix bounds checks and traversal for package BOM paths (#9164, #9184, #9190) • Correct the prefetch validation size check (#9177) • Guard against

npos

when joining arguments in

parseProcCmdline

(#9176) • Guard against truncated drive fields (#9218) • Check registry value size before decoding fixed-width types (#9220) Bug Fixes • Restore BPF tables removed in 5.24.0 (#9225) • Fix

chrome_extensions

state for modern Chromium profiles (#9170) • Fix Linux Audit argument reconstruction (#9208) • Fix an out-of-bounds read when comparing an empty path in

PathSet

(#9188) • Fix extension-table links in shell warnings (#9186) • Fix TLS connection reuse (#9199) • Return the full result string from the

carve()

SQL function (#9191) • Add a timeout around

statfs()

to handle hung filesystems (#9175) • Keep host and instance UUIDs stable when the database is reset (#9203) • Synchronize access to the custom flag map (#9195) • Preserve

IN

constraints when

xFilter

runs again for the same plan (#9230) • Record query performance when numeric monitoring is enabled (#9219) • Register all foreign table specs with

--enable_foreign

(#9194) • Serialize librpm global state in

rpm_packages

(#9173) Documentation • Make

PacksTests.test_sharding

independent of the shard cache (#9182) • Make

gpu_info

and Sleuth Kit table specs available on Windows (#9210, #9212) • Document Docker prerequisites for Linux tests (#9172) • Fix the remote settings test walkthrough (#9161) • Assorted documentation fixes (#9185) Full Changelog: 5.24.0...5.24.1 osquery/osquery