1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/0ce4f583565410e492719a276aa34b916ad538f8|0ce4f583>

- rpm_packages: serialize librpm global state with a shared mutex (#9173) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/1dd117fe61e8077bc69bc7455e59fd530c434ad3|1dd117fe>

- guard truncated drive fields in driveLetterItem and propertyViewDrive (#9218) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/efec3e11ec2922cde661d7509822886536a8ba81|efec3e11>

- cleanup: remove deprecated space in operator""_sz (#9217) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/8d9442011e17d940db18306b47de5cccf62c377d|8d944201>

- Restore BPF tables accidentally removed in 5.24.0 (#9225) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/c3376480760b87eecf822ad9ea1b254eb56c82ae|c3376480>

- Limit decompressed JetBrains plugin metadata size (#9211) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/e67f4527eae9153753c95b5884ac8dab547824eb|e67f4527>

- Fix Linux Audit argv reconstruction (#9208) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/3b4c537fdce539367de74cbf7a7289b4f9212fe2|3b4c537f>

- sql: keep IN constraints when xFilter runs again for the same plan (#9230) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/d30bc221656d8f9879ed2a1f73c57f7554ba26a9|d30bc221>

- stop building a regex from the exe path in deletedMatchesInode (#9216) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/121077ea7050d4c4f95b17b6c66f1018dfdc07f3|121077ea>

- scheduler: record query performance when numeric monitoring is enabled (#9219) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/3cb3095c328852e2938f3c05dcd7579ecd419553|3cb3095c>

- librpm: disable shell command macro expansion (#9223) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/ec5ad88db65a8661b30415a934eba83476577505|ec5ad88d>

- startup_items: read per-user BTM archives on macOS 27 (#9198) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/8b8d3f4b8662306ab7ae00797081dd7a5383f02c|8b8d3f4b>

- check registry value size before decoding fixed-width types in queryKey (#9220) osquery/osquery

Release - 5.24.1 New release published by zwass 5.24.1 Security • Update the Mozilla CA certificate bundle (removes eMudhra certificates) (#9206) • Add

_FORTIFY_SOURCE

, CET/BTI on Linux, and explicit Windows mitigations (#9167) • Disable TLS 1.0 and 1.1 in

curl_certificate

and the OpenSSL build (#9192, #9202) • Limit decompressed JetBrains plugin metadata size (#9211) • Disable shell command macro expansion in librpm (#9223) • Fix bounds checks and traversal for package BOM paths (#9164, #9184, #9190) • Correct the prefetch validation size check (#9177) • Guard against

npos

when joining arguments in

parseProcCmdline

(#9176) • Guard against truncated drive fields (#9218) • Check registry value size before decoding fixed-width types (#9220) Bug Fixes • Restore BPF tables removed in 5.24.0 (#9225) • Fix

chrome_extensions

state for modern Chromium profiles (#9170) • Fix Linux Audit argument reconstruction (#9208) • Fix an out-of-bounds read when comparing an empty path in

PathSet

(#9188) • Fix extension-table links in shell warnings (#9186) • Fix TLS connection reuse (#9199) • Return the full result string from the

carve()

SQL function (#9191) • Add a timeout around

statfs()

to handle hung filesystems (#9175) • Keep host and instance UUIDs stable when the database is reset (#9203) • Synchronize access to the custom flag map (#9195) • Preserve

IN

constraints when

xFilter

runs again for the same plan (#9230) • Record query performance when numeric monitoring is enabled (#9219) • Register all foreign table specs with

--enable_foreign

(#9194) • Serialize librpm global state in

rpm_packages

(#9173) Documentation • Make

PacksTests.test_sharding

independent of the shard cache (#9182) • Make

gpu_info

and Sleuth Kit table specs available on Windows (#9210, #9212) • Document Docker prerequisites for Linux tests (#9172) • Fix the remote settings test walkthrough (#9161) • Assorted documentation fixes (#9185) Full Changelog: 5.24.0...5.24.1 osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/abb9fe31fc651ab4a485fa6c98369584464e8a3b|abb9fe31>

- events: fix dependency cycle with the Linux audit flags and events library (#9221) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/7ba4401ee6d6fd5cf2c5cd9010136dbef7780403|7ba4401e>

- hash the full value, not up to the first NUL, in hashSqliteValue (#9239) osquery/osquery

We've open-sourced phantomfleet, a synthetic osquery fleet in one Go binary. It enrolls simulated Linux, macOS and Windows hosts into osctrl, Fleet or any osquery TLS server, then answers distributed queries with schema-shaped rows, so you don't need osquery or real endpoints. It includes "Example Corp", a fictional 15-host estate with something to hunt for. MIT licensed, built on osctrl's fake_news (thanks, @javuto). 💻 GitHub: github.com/huntbase-io/phantomfleet Bug reports about servers or queries it gets wrong are very welcome. Slack Conversation

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by lucasmrod

<https://github.com/osquery/osquery/commit/b95ab621da28c1c43da5e6d9881f8b53c7b1bc71|b95ab621>

- package_receipts: read receipts from disk instead of PackageKit (#9235) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/7afbbcf39b712f2260a4436ab1c29a51eac673f0|7afbbcf3>

- Update ccache configurations to improve macos/Linux CI speed (#9233) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by directionless

<https://github.com/osquery/osquery/commit/ecb354f2ac14bbd798b487a5144cb996bebe8076|ecb354f2>

- tests: fix race conditions in test_json_pretty_output and test_daemon_with_watchdog (#9240) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by mike-myers-aapl

<https://github.com/osquery/osquery/commit/f5518116d36ad402edcda983401c5b388dc9c4e6|f5518116>

- stop re-parsing buffered history lines in genShellHistoryFromFile (#9241) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by michael-myers

<https://github.com/osquery/osquery/commit/99ea20493a2614eab939cbc02ebfaa114a3caecb|99ea2049>

- Fail clearly when valgrind is missing for --leaks on Linux (#9237) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by zwass

<https://github.com/osquery/osquery/commit/981c4d3831aa8a27d21052e96f50e243d8f65ede|981c4d38>

- mdfind: Stop queries before releasing them to avoid leaking mds ports (#9248) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by directionless

<https://github.com/osquery/osquery/commit/e9cb4be410d3244f9e146f360aa50496588f5d83|e9cb4be4>

- check saddr length before reading IPv4/IPv6 fields in parseSockAddr (#9253) osquery/osquery

Hi All! I'm pleased to announce Osquery 5.24.1 has been promoted to stable. Enjoy!

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by mike-myers-aapl

<https://github.com/osquery/osquery/commit/711974b7dcddb83af0bbbb972fa930ed02046adc|711974b7>

- walk the whole environ block in genProcessEnvironment (#9245) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by directionless

<https://github.com/osquery/osquery/commit/93495615cfbf9953fda7f881bbe9d9852bc4f487|93495615>

- specs: correct crashes table description; system crashes are in

kernel_panics

(#9282) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by directionless

<https://github.com/osquery/osquery/commit/dfc1042eaba52d464fee45f95cdee7010efd19fa|dfc1042e>

- tests: retry

curl_certificate

query to mitigate random network-interruption causing test failure (#9278) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by directionless

<https://github.com/osquery/osquery/commit/561decc1239e799c7b40249f19e0ad5cb264fc73|561decc1>

- tests: allow the

crypto

subsystem in

system_controls

sanity test (#9273) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by mike-myers-aapl

<https://github.com/osquery/osquery/commit/9d639c434d88502c4a6959ef2ccc989d186dc43d|9d639c43>

- stop blocking on FIFOs in extended_attributes and certificates (#9281) osquery/osquery

1 new commit pushed to

<https://github.com/osquery/osquery/tree/master|master>

by mike-myers-aapl

<https://github.com/osquery/osquery/commit/2169fcd0024b615a2d5c576b0ae9024095efa62a|2169fcd0>

- `process_open_files`: skip namespace descriptors (#9275) osquery/osquery