The action item here is that we need to pull in this patch from YARA? We can do this with the patching plumbing build into our CMake libs. How critical is this, can someone open a PR?

It seems like that would be the fix. I'll open an issue. https://github.com/osquery/osquery/issues/6516