1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/da7f435f52b454e54cb8e11e0a17c9352d9ebe3b|da7f435f>

- Find SSH keys in subdirectories (#9128) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/f22ad8b496c6e1707838a1badd21970a0c7e2507|f22ad8b4>

- Remove install cmake step in CI (#9129) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/7a5bf9c88ee00b331febc244c659eeeddd079d2c|7a5bf9c8>

- check license is an object before member lookup in npm_packages (#9126) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/51126c8653d83000011035bfb073b6ae34b04c66|51126c86>

- Add flatpak_packages table (#9054) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/d9db97e3a86cf3e3ed4b3f8abbb8c4175b107855|d9db97e3>

- Add

gpu_info

table for Linux, macOS, and Windows (#9065) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/9a7a144c9183634dd50af32e7b080c37613e6708|9a7a144c>

- Clean up and set max sizes for CI (s)ccache (#9133) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/1fe7df6429fc65e6db895f084111ca1d98738314|1fe7df64>

- Add vscode_extensions support for Antigravity and code-server (#9052) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/f28a15cfd5067a66cfc225282d07ad3f4825a55f|f28a15cf>

- check token count before reading the process name in kernel_panics (#9131) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/ee03ffba924def28b42279eef41a8fbcb00d3b82|ee03ffba>

- Add ai_agent_skills table (#9044) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/a35391812665dc9f26a903a2943f4b1e454d7ad0|a3539181>

- Fix apt_sources silently dropping deb822 repos with Enabled: yes (#8928) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/5c25ce99468505237036232dc41b12f89ff7a07d|5c25ce99>

- Discover Safari extensions under Application Support for safari_extensions (#9034) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/60ed0c3254131f521422d1b5e27381a19dbce8d2|60ed0c32>

- libs: openssl: 3.6.3 -> 3.6.5 (#9158) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/cb29368c78f67af416abc309cd32dd9231c352d7|cb29368c>

- Fix battery table on macOS 27.2 (#9130) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/301bd89f5f3cbeac4ff88f95fd2daa710f215bae|301bd89f>

- Fix crash in

cups_jobs

when

cupsGetJobs

fails (#9159) osquery/osquery

https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source this would generate more findings than oss-fuzz

If a core maintainer agrees, it is free to submit a PR to sign up

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/e6e6a3cdc92662e95afe8becd81bc7082a27328d|e6e6a3cd>

- docs: correct scheduled-result JSON examples (#9160) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/97446ba20fc055b87ed138ffc3dbabb52cf53093|97446ba2>

- registry: don't hold the registry lock across extension removal (#9163) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/2c333df27d580eec639ed621abf74705fa56687c|2c333df2>

- Add

gpu_metrics

table (#9030) osquery/osquery

Release - 5.24.0 New release published by zwass What's Changed • file table : lnk-related columns were not always computed on Windows by @thierryfranzetti in #8855 • Fix

process_open_handles

comments and spec by @directionless in #8853 • Remove cleanup_ec2_runners action by @zwass in #8856 • Upgrade Linux toolchain to 1.3.0 by @zwass in #8814 • Update Linux build docs for toolchain 1.3.0 by @zwass in #8868 • fix: clear errno before getmntent_r to avoid false error logs at EOF by @stefanamaerz in #8875 • Conditionally install init.d script and fix postrm cleanup by @a-cognet in #8857 • Remove older cipher suites from kTLSCiphers by @thom-bartlett in #8872 • feat: Add the column protector_types to the table bitlocker_info by @rchan-cjj in #8873 • Fix: Windows prefetch table does not report full executable path by @raaz252 in #8924 • Fix heap buffer overflow in Windows processes table (GHSA-4r78-6hg6-33gg) by @directionless in #8934 • Preserve object identifiers in Windows certificates table via subject2/issuer2 by @getvictor in #8963 • Switch authenticode getOriginalProgramName to CryptDecodeObjectEx by @directionless in #8923 • Fix Linux audit-based process_file_events cache cleanup by @zwass in #8950 • Ensure in-progress file carves are readable only by the user running osquery by @zwass in #8961 • bitlocker_info: read ProtectionStatus via GetProtectionStatus() method to avoid stale cached value by @rodchristiansen in #8931 • Update macOS CI configurations by @zwass in #8871 • Fix macOS build for Boost by @zwass in #8982 • Document macOS platform support status by @thebeaverliam in #8926 • Scan XDG Base Directory Firefox profiles in firefox_addons by @munzzyy in #8986 • Add .devin path to vscode_extensions for the Windsurf rebrand by @munzzyy in #8987 • Update GitHub Actions caching strategy by @zwass in #8866 • Update ccache configurations for CI and local development by @zwass in #8865 • Fix wrong end-iterator guard in vscode_extensions (one-past-end deref) by @munzzyy in #8990 • Add Microsoft Edge and Flatpak paths to chrome_extensions on Linux by @munzzyy in #8991 • docs: fix SECURITY.md vulnerability-reporting link (dead CONTRIBUTING anchor → GitHub advisory) by @kobihikri in #8994 • Add missing Chromium browser variants to chrome_extensions table by @FritzX6 in #8995 • Set default build options for macOS builds by @zwass in #8867 • Use pre-compiled headers to optimize clean build times by @zwass in #8843 • libs: Remove unused libexpat by @Smjert in #8997 • libs: Update openssl to 3.6.3 by @Smjert in #8998 • Fix macOS SDK auto-detection running before CMAKE_SYSTEM_NAME is set by @TemidayoA in #9005 • Fix weekday and timezone extraction in non-English locales by @hedwigz in #9009 • Fix incorrect key_strength for Windows certificates by @munzzyy in #8989 • Key the recursive-glob visited set on (device, inode) by @munzzyy in #9010 • Docs: change macOS build steps to recommend Python venv by @pascalrobert in #9031 • Windows pipes: set SQOS on named-pipe CreateFile (defense-in-depth) by @mike-myers-aapl in #8999 • Increase maximum config size from 1 MiB to 4MiB by @RebeccaMahany in #9042 • Add chrome_search_engines table exposing the default search engine by @TemidayoA in #9029 • Pare down openssl build by @zwass in #9041 • Add a pacman_packages table by @abguymon in #9035 • Fix: Do not read FIFOs when hashing files in file_events by @zwass in #9037 • Split the sudoers header on the first unescaped whitespace by @munzzyy in #9036 • Fix off-by-one bounds check in the platform_info BIOS parser by @munzzyy in #9051 • Bump GitHub Actions to latest Node 24 versions by @stefanamaerz in #9058 • Registry nocase path name by @getvictor in #9080 • tests: accept macOS 26.6 code-signing authority in SignatureTest by @mike-myers-aapl in #9103 • Etag config TLS by @rfairburn in #9033 • Widen mounts table statfs counts from uint32_t to uint64_t by @munzzyy in #9068 • Add a macports_packages table by @jrjsmrtn in #9074 • Add negotiated TLS version and cipher suite to curl_certificate by <https://github.com/FrankieAtElastic|@FrankieAt… osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/909a441866f84d26ba7a563f4dcfc655efff9feb|909a4418>

- docs: fix the remote settings test walkthrough (#9161) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/390c347286ec759b630c24d1dd12e6988661900e|390c3472>

- Add sshd_config table (#9132) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/dc4585516a9cdb27fcb406f3938bc751050fc32c|dc458551>

- tests: make PacksTests.test_sharding independent of the shard cache (#9182) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/02fc50fb4139dc6cab8760fdf506d8b0b15501ba|02fc50fb>

- libs: make OpenSSL tests optional and stop building RocksDB test utils (#9168) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/a30ce45ca54e5db2e7799c6f943bfcf26504b795|a30ce45c>

- account for BOMPaths header in bounds check in BOM::getPaths (#9164) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/dd05a7ff99eb454bb734cdaf217d817d4ea47eb8|dd05a7ff>

- processes: add LSM security label column (Linux) (#9165) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/a90d8e9f5e17566d7f098ff4ce38a78585c12f49|a90d8e9f>

- os_version: collect CPE_NAME from /etc/os-release on Linux (#9166) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/be923ba7c3ef933480ebed59742c835cff80ad12|be923ba7>

- build: add _FORTIFY_SOURCE, CET/BTI (Linux), and explicit Windows mitigations (#9167) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/2a8f4547998d8d7ec4d3a513305967a6b3085ac1|2a8f4547>

- npm_packages: extend license parsing test coverage (#9171) osquery/osquery

Hi everyone, in the past week, I have created a number of PRs to upstream the changes we make in the osquery fork we use at my job. Thanks @zwass for being on top of things and help review and merge. I finally created 3 more PRs that may be controversial: • reverting optimization in RPM table github.com/osquery/osquery/pull/9178 , it was terrible on our performance • reverting readfile github.com/osquery/osquery/pull/9179 for the same reason, it made reading through /proc too expensive • adding containerd tables for linux github.com/osquery/osquery/pull/9180 with a dependency on grpc. Please check them out, I am interested in your take on these.