I almost forgot, I would also get this one in actually: https://github.com/osquery/osquery/pull/7654. I have the config file for macOS to push to it; this was causing another moderate CVE to be found by scanners (although osquery is not affected), and I'm ready to approve it as soon as I get the config file in.