Release - 5.24.0 New release published by zwass What's Changed • file table : lnk-related columns were not always computed on Windows by @thierryfranzetti in #8855 • Fix

process_open_handles

comments and spec by @directionless in #8853 • Remove cleanup_ec2_runners action by @zwass in #8856 • Upgrade Linux toolchain to 1.3.0 by @zwass in #8814 • Update Linux build docs for toolchain 1.3.0 by @zwass in #8868 • fix: clear errno before getmntent_r to avoid false error logs at EOF by @stefanamaerz in #8875 • Conditionally install init.d script and fix postrm cleanup by @a-cognet in #8857 • Remove older cipher suites from kTLSCiphers by @thom-bartlett in #8872 • feat: Add the column protector_types to the table bitlocker_info by @rchan-cjj in #8873 • Fix: Windows prefetch table does not report full executable path by @raaz252 in #8924 • Fix heap buffer overflow in Windows processes table (GHSA-4r78-6hg6-33gg) by @directionless in #8934 • Preserve object identifiers in Windows certificates table via subject2/issuer2 by @getvictor in #8963 • Switch authenticode getOriginalProgramName to CryptDecodeObjectEx by @directionless in #8923 • Fix Linux audit-based process_file_events cache cleanup by @zwass in #8950 • Ensure in-progress file carves are readable only by the user running osquery by @zwass in #8961 • bitlocker_info: read ProtectionStatus via GetProtectionStatus() method to avoid stale cached value by @rodchristiansen in #8931 • Update macOS CI configurations by @zwass in #8871 • Fix macOS build for Boost by @zwass in #8982 • Document macOS platform support status by @thebeaverliam in #8926 • Scan XDG Base Directory Firefox profiles in firefox_addons by @munzzyy in #8986 • Add .devin path to vscode_extensions for the Windsurf rebrand by @munzzyy in #8987 • Update GitHub Actions caching strategy by @zwass in #8866 • Update ccache configurations for CI and local development by @zwass in #8865 • Fix wrong end-iterator guard in vscode_extensions (one-past-end deref) by @munzzyy in #8990 • Add Microsoft Edge and Flatpak paths to chrome_extensions on Linux by @munzzyy in #8991 • docs: fix SECURITY.md vulnerability-reporting link (dead CONTRIBUTING anchor → GitHub advisory) by @kobihikri in #8994 • Add missing Chromium browser variants to chrome_extensions table by @FritzX6 in #8995 • Set default build options for macOS builds by @zwass in #8867 • Use pre-compiled headers to optimize clean build times by @zwass in #8843 • libs: Remove unused libexpat by @Smjert in #8997 • libs: Update openssl to 3.6.3 by @Smjert in #8998 • Fix macOS SDK auto-detection running before CMAKE_SYSTEM_NAME is set by @TemidayoA in #9005 • Fix weekday and timezone extraction in non-English locales by @hedwigz in #9009 • Fix incorrect key_strength for Windows certificates by @munzzyy in #8989 • Key the recursive-glob visited set on (device, inode) by @munzzyy in #9010 • Docs: change macOS build steps to recommend Python venv by @pascalrobert in #9031 • Windows pipes: set SQOS on named-pipe CreateFile (defense-in-depth) by @mike-myers-aapl in #8999 • Increase maximum config size from 1 MiB to 4MiB by @RebeccaMahany in #9042 • Add chrome_search_engines table exposing the default search engine by @TemidayoA in #9029 • Pare down openssl build by @zwass in #9041 • Add a pacman_packages table by @abguymon in #9035 • Fix: Do not read FIFOs when hashing files in file_events by @zwass in #9037 • Split the sudoers header on the first unescaped whitespace by @munzzyy in #9036 • Fix off-by-one bounds check in the platform_info BIOS parser by @munzzyy in #9051 • Bump GitHub Actions to latest Node 24 versions by @stefanamaerz in #9058 • Registry nocase path name by @getvictor in #9080 • tests: accept macOS 26.6 code-signing authority in SignatureTest by @mike-myers-aapl in #9103 • Etag config TLS by @rfairburn in #9033 • Widen mounts table statfs counts from uint32_t to uint64_t by @munzzyy in #9068 • Add a macports_packages table by @jrjsmrtn in #9074 • Add negotiated TLS version and cipher suite to curl_certificate by <https://github.com/FrankieAtElastic|@FrankieAt… osquery/osquery