osquery

Databases & Data

SQL powered operating system instrumentation, monitoring, and analytics.

Latest 5.23.1 · by osqueryWebsiteosquery/osquery

Release activity

Release activity — 5 releases across 5 days in the last year. Each cell is one day; darker means more releases that day. Older weeks are hidden at this screen width.
MayJunJulAug
SundayNo releases on May 3, 2026No releases on May 10, 2026No releases on May 17, 2026No releases on May 24, 2026No releases on May 31, 2026No releases on Jun 7, 2026No releases on Jun 14, 2026No releases on Jun 21, 2026No releases on Jun 28, 2026No releases on Jul 5, 2026No releases on Jul 12, 2026No releases on Jul 19, 2026No releases on Jul 26, 2026No releases on Aug 2, 2026No releases on Aug 9, 2026No releases on Aug 16, 2026
MondayNo releases on May 4, 2026No releases on May 11, 2026No releases on May 18, 2026No releases on May 25, 2026No releases on Jun 1, 2026No releases on Jun 8, 2026No releases on Jun 15, 2026No releases on Jun 22, 2026No releases on Jun 29, 2026No releases on Jul 6, 2026No releases on Jul 13, 2026No releases on Jul 20, 2026No releases on Jul 27, 2026No releases on Aug 3, 2026No releases on Aug 10, 2026No releases on Aug 17, 2026
TuesdayNo releases on May 5, 2026No releases on May 12, 2026No releases on May 19, 2026No releases on May 26, 2026No releases on Jun 2, 2026No releases on Jun 9, 2026No releases on Jun 16, 2026No releases on Jun 23, 2026No releases on Jun 30, 2026No releases on Jul 7, 2026No releases on Jul 14, 2026No releases on Jul 21, 2026No releases on Jul 28, 2026No releases on Aug 4, 2026No releases on Aug 11, 2026No releases on Aug 18, 2026
WednesdayNo releases on May 6, 2026No releases on May 13, 2026No releases on May 20, 2026No releases on May 27, 2026No releases on Jun 3, 2026No releases on Jun 10, 2026No releases on Jun 17, 20261 release on Jun 24, 2026No releases on Jul 1, 2026No releases on Jul 8, 2026No releases on Jul 15, 2026No releases on Jul 22, 2026No releases on Jul 29, 2026No releases on Aug 5, 2026No releases on Aug 12, 2026
ThursdayNo releases on May 7, 2026No releases on May 14, 2026No releases on May 21, 2026No releases on May 28, 2026No releases on Jun 4, 2026No releases on Jun 11, 2026No releases on Jun 18, 2026No releases on Jun 25, 2026No releases on Jul 2, 2026No releases on Jul 9, 2026No releases on Jul 16, 2026No releases on Jul 23, 2026No releases on Jul 30, 2026No releases on Aug 6, 2026No releases on Aug 13, 2026
FridayNo releases on May 8, 2026No releases on May 15, 2026No releases on May 22, 2026No releases on May 29, 2026No releases on Jun 5, 2026No releases on Jun 12, 2026No releases on Jun 19, 2026No releases on Jun 26, 2026No releases on Jul 3, 2026No releases on Jul 10, 2026No releases on Jul 17, 2026No releases on Jul 24, 2026No releases on Jul 31, 2026No releases on Aug 7, 2026No releases on Aug 14, 2026
SaturdayNo releases on May 9, 2026No releases on May 16, 2026No releases on May 23, 2026No releases on May 30, 2026No releases on Jun 6, 2026No releases on Jun 13, 2026No releases on Jun 20, 2026No releases on Jun 27, 2026No releases on Jul 4, 2026No releases on Jul 11, 2026No releases on Jul 18, 2026No releases on Jul 25, 2026No releases on Aug 1, 2026No releases on Aug 8, 2026No releases on Aug 15, 2026

5 releases in the last year

Changelog

5.23.1

Latest
Fixed 3
  • Fix incorrect permissions on temporary file carve directories
  • Fix documentation for process_open_handles table
  • Fix subject2 and issuer2 columns for Windows certificates table
Security 3
  • Fix heap buffer overflow in Windows processes table
  • Fix heap buffer overflow in Windows authenticode table
  • Fix use-after-free in Linux process_file_events implementation

From osquery

This is a bug and security fix release.

What's Changed
Fixes

Full Changelog: https://github.com/osquery/osquery/compare/5.23.0...5.23.1

View originalPermalink
How 5.23.1 went

5.23.0

Added 10
  • Add process memory scanning capability to yara table
  • Split yara tables into yara_process and yara_file
  • Add Windows process_open_handles table
  • Add secureboot_certificates table for Linux
  • Extend python_packages and npm_packages to cover modern package managers
  • Add level filtering to the unified_log table
Changed 4
  • Disallow newlines in curl custom headers
  • Supplement LaunchServices with directory scanning in apps table
  • Add ROOT\default to WMI tables
  • Update expat to 2.7.4 to fix CVE-2026-25210
Fixed 5
  • Fix macOS keychain corruption when accessing non-SSV keychain files by copying to temporary files first
  • Fix incorrect example queries in table specs
  • Improve network_name detection on macOS wifi_status table
  • Fix a bug in apt_sources parsing
  • Add NOCASE and VERSION collation to various columns
Security 1
  • Fix format string vulnerability in shell.cpp disconnect_socket()

From osquery

What's Changed
Features
Build & Dependencies
Fixes
New Contributors

Full Changelog: https://github.com/osquery/osquery/compare/5.22.1...5.23.0

View originalPermalink
How 5.23.0 went

5.22.1

Added 2
  • Add support for retries in carver
  • Add machine-wide provisioned MSIX packages to programs table
Changed 6
  • Make escapeNonPrintableBytes UTF-8 aware, changing query results to render unicode bytes as corresponding characters
  • Update virtual SQL functions to support multiple constraints, allowing queries with joins or subqueries to the users table to include results for remote users
  • Preserve file metadata in carver archives
  • Update osquery-toolchain to 1.2.0 with LLVM 11.0.0 and zlib 1.2.13
  • Update Apple provisioning profile for new developer certificates
  • Update OpenSSL to 3.6.1
Fixed 7
  • Replace macOS signing certificate out of sync with provisioning profile
  • Quit carving when sending a block fails
  • Fix SMBIOS CPU count
  • Fix systemd unit to use .target instead of .service
  • Fix typo in winbaseobj.table description
  • Fix JSON handling copy vs. ref semantics
  • Fix memory leak in logon_sessions

From osquery

5.22.0 macOS binaries will not execute because the signing certificate is out of sync with the provisioning profile. 5.22.1 replaces it.

What's Changed
Features
Build & Dependencies
Fixes
New Contributors

Full Changelog: https://github.com/osquery/osquery/compare/5.21.0...5.22.1

View originalPermalink
How 5.22.1 went

5.21.0

Added 4
  • Add support for Login Items and Background Services on modern macOS
  • Add last_connected_automatic and last_connected_manual columns to wifi_networks table
  • Add new darwin certificate trust settings table
  • Add support for gzip content-encoding in HTTP client
Changed 3
  • Improve password_policy table
  • Improve file traversal performance and correctness
  • Refresh resolver state on interval to pick up DNS changes
Fixed 1
  • Fix crash when querying carves table with carves larger than 2GB

From osquery

What's Changed
New Contributors

Full Changelog: https://github.com/osquery/osquery/compare/5.20.0...5.21.0

View originalPermalink
How 5.21.0 went

5.20.0

Added 3
  • Add default path for CA certificate bundle on openSUSE
  • Support nvm on npm_packages table
  • Add scoped npm package support in npm_packages table
Changed 3
  • Exclude config views from db migration
  • Make vscode_extensions more consistently report UUID
  • Update libarchive from 3.7.9 to 3.8.1
Fixed 2
  • Don't overwrite hardware_version if it has a value
  • Fix build against libaudit >=4.1.1 by removing set_aumessage_mode call

From osquery

What's Changed
Features/Bugs
Dependencies
Documentation
New Contributors

Full Changelog: https://github.com/osquery/osquery/compare/5.19.0...5.20.0

View originalPermalink
How 5.20.0 went

5.19.0

What's Changed
Features
Bugfixes
Other
New Contributors

Full Changelog: https://github.com/osquery/osquery/compare/5.18.0...5.19.0

View originalPermalink
How 5.19.0 went

5.18.1

What's Changed
New Contributors

Full Changelog: https://github.com/osquery/osquery/compare/5.17.0...5.18.1

View originalPermalink
How 5.18.1 went

5.17.0

Git Commits

What's Changed
New Contributors

Full Changelog: https://github.com/osquery/osquery/compare/5.16.0...5.17.0

View originalPermalink
How 5.17.0 went

5.16.0

Git Commits

Representing commits from 7 contributors! Thank you all.

Table Changes
  • Fix the python_paths table to skip unnecessary code paths when filtering by directory (#8544)
  • Added python packages in user directories on python_packages (#8504)
  • Added RHEL paths for python_packages table (#8529)
  • Buffer error logs in deb_packages table (#8540)
  • Fix wifi_status to correctly gather network_name on MacOS 14+ (#8530)
  • Fix hardware model and version on Lenovo on system_info (#8534)
  • Optimize rpm_packages and rpm_package_files use of query context (#8537)
Bug Fixes
  • Fix to only deny-list scheduled queries when watchdog is enabled (#8541)
  • Switched to wmain to accept non-ascii characters from command line (#8519)
View originalPermalink
How 5.16.0 went

5.15.0

Git Commits

Representing commits from 17 contributors! Thank you all.

Table Changes
  • Add arc path to chrome_extensions on macOS (#8473)
  • Use empty columns instead of zeroes when undefined in socket_events (#8510)
  • Add support for accept to macOS table socket_events (#8508)
  • Add all-platform user-based optimized columns (#8496)
  • Add columns to es_process_events (#8506)
  • Add Darwin platform optimized miscellaneous columns (#8484)
  • Add all-platform path-based optimized columns (#8497)
  • Add Windows platform optimized columns (#8495)
  • Add hash_executable column to signature table (#8471)
  • Include VSCode Insiders extensions in vscode_extensions table (#8396)
  • Add POSIX platforms optimized columns (#8494)
  • Add Linux platform optimized columns (#8493)
  • Add all platform process based and curl optimized columns (#8498)
  • Add Darwin platform optimized system-related columns (#8483)
  • Add Darwin platform optimized path columns (#8482)
  • Fix incorrect SID in logged_in_users table on windows when username and domain/device name are the same (#8486)
  • Update the browser_firefox table to exclude "Crash Reports" and "Pending Pings" folders (#8478)
  • Move status column to extended_schema for linux socket_events (#8503)
Under the Hood improvements
  • Utils: Optimize default status message constructor (#8489)
Bug Fixes
  • Fix a leak in genAarch64PlatformInfo (#8462)
  • Fix a leak in DiskArbitrationEventPublisher::getProperty (#8463)
  • Catching generic exception in order to avoid crashing when parsing windows events logs (#8513)
  • Fix leak in windows_events by using scope_guard (#8511)
  • Fixed eBPF's parsing of parent pid (#8501)
  • Fix IO objects refcounting (#8481)
Documentation
  • Add documentation for testing macOS EndpointSecurity (#8509)
  • Add double quotes in Windows installation documentation (#8492)
  • Update expired Slack invite (#8488)
  • Update docs to correctly define conditional_to_base64 (#8460)
Build
  • build(deps): bump jinja2 from 3.1.4 to 3.1.5 (#8507)
  • Remove yara schema subdirectory (#8461)
  • Added chrono header file (#8512)
  • Replace usage of libaudit function removed in v3.0.7 (#8401)
  • Update xcode version for macos-14 from 14.3.1 to 15.4 (#8467)
  • Restrict python versions differently (#8453)
  • Update macOS test runner from 12 to 13 (#8459)
  • Add CVEs to the ignored lists (#8458)
  • Add a specific package build folder on Windows jobs (#8446)
  • Update all Github actions to a version using NodeJs 20 (#8449)
  • Reduce scheduled builds amount (#8457)
View originalPermalink
How 5.15.0 went

More in Databases & Data

View all
Elasticsearch

The distributed search and analytics engine.

Elastic
ClickHouse

ClickHouse release notes.

ClickHouse
Metabase

Business intelligence and dashboards over an existing database.

Metabase
DBeaver

DBeaver release notes.

DBeaver Corp
Appwrite

An open-source backend platform for web and mobile.

Appwrite
baserow

This is a mirror repository. Baserow has been migrated to GitHub. Issues, pull requests, code, and other activity will be available from there. https://github.com/baserow/baserow

baserow

Discussion

If you publish osquery, you can claim this product by proving you administer its repository.