# osquery changelog

> SQL powered operating system instrumentation, monitoring, and analytics.

- Vendor: osquery
- Category: Databases & Data
- Official site: https://osquery.io/
- Tracked by: What's New (https://whatsnew.fyi/product/osquery)
- Harvested from: GitHub (osquery/osquery)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### 5.23.1

- Date: 2026-06-24
- Version: 5.23.1
- Original notes: https://github.com/osquery/osquery/releases/tag/5.23.1
- Permalink: https://whatsnew.fyi/product/osquery/releases/5.23.1

- **security** — Fix heap buffer overflow in Windows processes table
- **security** — Fix heap buffer overflow in Windows authenticode table
- **security** — Fix use-after-free in Linux process_file_events implementation
- **fixed** — Fix incorrect permissions on temporary file carve directories
- **fixed** — Fix documentation for process_open_handles table
- **fixed** — Fix subject2 and issuer2 columns for Windows certificates table

This is a bug and security fix release.

##### What's Changed

###### Fixes

* Fix heap buffer overflow in Windows `processes` table by @seph in https://github.com/osquery/osquery/pull/8934
* Fix heap buffer overflow in Windows `authenticode` table by @seph in https://github.com/osquery/osquery/pull/8923
* Fix use-after-free in Linux `process_file_events implementation` by @zwass in https://github.com/osquery/osquery/pull/8950
* Fix incorrect permissions on temporary file carve directories by @zwass in https://github.com/osquery/osquery/pull/8961
* Fix documentation for `process_open_handles` table by @seph in https://github.com/osquery/osquery/pull/8853
* Fix `subject2` and `issuer2` columns for Windows `certificates` table by @getvictor in https://github.com/osquery/osquery/pull/8963

**Full Changelog**: https://github.com/osquery/osquery/compare/5.23.0...5.23.1

### 5.23.0

- Date: 2026-04-25
- Version: 5.23.0
- Original notes: https://github.com/osquery/osquery/releases/tag/5.23.0
- Permalink: https://whatsnew.fyi/product/osquery/releases/5.23.0

- **added** — Add process memory scanning capability to yara table
- **added** — Split yara tables into yara_process and yara_file
- **added** — Add Windows process_open_handles table
- **added** — Add secureboot_certificates table for Linux
- **added** — Extend python_packages and npm_packages to cover modern package managers
- **added** — Add level filtering to the unified_log table
- **added** — Add command line flags for query input and output
- **added** — Add new header-based authentication mechanism for remote APIs
- **added** — Add recursion to npm_packages
- **added** — Make profile.py performance thresholds configurable via CLI flags
- **changed** — Disallow newlines in curl custom headers
- **changed** — Supplement LaunchServices with directory scanning in apps table
- **changed** — Add ROOT\default to WMI tables
- **changed** — Update expat to 2.7.4 to fix CVE-2026-25210
- **fixed** — Fix macOS keychain corruption when accessing non-SSV keychain files by copying to temporary files first
- **fixed** — Fix incorrect example queries in table specs
- **fixed** — Improve network_name detection on macOS wifi_status table
- **fixed** — Fix a bug in apt_sources parsing
- **fixed** — Add NOCASE and VERSION collation to various columns
- **security** — Fix format string vulnerability in shell.cpp disconnect_socket()

##### What's Changed

###### Features

* Add process memory scanning capability to `yara` table by @brian-mckinney in https://github.com/osquery/osquery/pull/8782
* Split yara tables into `yara_process` and `yara_file` by @brian-mckinney in https://github.com/osquery/osquery/pull/8835
* Add Windows `process_open_handles` table by @brian-mckinney in https://github.com/osquery/osquery/pull/8795
* Add `secureboot_certificates` table for Linux by @zwass in https://github.com/osquery/osquery/pull/8844
* Extend `python_packages` and `npm_packages` to cover modern package managers by @ariary in https://github.com/osquery/osquery/pull/8801
* Add level filtering to the `unified_log` table by @directionless in https://github.com/osquery/osquery/pull/8788
* Disallow newlines in `curl` custom headers by @directionless in https://github.com/osquery/osquery/pull/8787
* Supplement LaunchServices with directory scanning in `apps` table (#8789) by @getvictor in https://github.com/osquery/osquery/pull/8790
* Command line flags for query input and output by @directionless in https://github.com/osquery/osquery/pull/8786
* New header-based authentication mechanism for remote APIs by @juan-fdz-hawa in https://github.com/osquery/osquery/pull/8805
* Add recursion to `npm_packages` by @directionless in https://github.com/osquery/osquery/pull/8809
* Make profile.py performance thresholds configurable via CLI flags by @stefanamaerz in https://github.com/osquery/osquery/pull/8841
* Add `ROOT\default` to WMI tables by @directionless in https://github.com/osquery/osquery/pull/8810

###### Build & Dependencies

* Update expat to 2.7.4 to fix CVE-2026-25210 by @Sampriti2803 in https://github.com/osquery/osquery/pull/8794
* Fix GCC 15 compatibility by @carlsmedstad in https://github.com/osquery/osquery/pull/8837

###### Fixes

* Fix macOS keychain corruption when accessing non-SSV keychain files by copying to temporary files first by @lucasmrod in https://github.com/osquery/osquery/pull/8840
* Fix incorrect example queries in table specs by @edwardsb in https://github.com/osquery/osquery/pull/8791
* Improve `network_name` detection on macOS `wifi_status` table by @lucasmrod in https://github.com/osquery/osquery/pull/8781
* Fix a bug in `apt_sources` parsing by @directionless in https://github.com/osquery/osquery/pull/8785
* Add `NOCASE` and `VERSION` collation to various columns by @directionless in https://github.com/osquery/osquery/pull/8813
* Increase the limit on systemd unit iteration by @directionless in https://github.com/osquery/osquery/pull/8802
* Fix format string vulnerability in shell.cpp disconnect_socket() by @directionless in https://github.com/osquery/osquery/pull/8824
* Fix saving file times in file carves by @zwass in https://github.com/osquery/osquery/pull/8819
* Fix empty results from `office_mru` table by @thierryfranzetti in https://github.com/osquery/osquery/pull/8838
* Fix multiple security vulnerabilities in smc_keys.cpp by @directionless in https://github.com/osquery/osquery/pull/8820
* Fix `gatekeeper` table on macOS 15+ by @thierryfranzetti in https://github.com/osquery/osquery/pull/8831
* Fix container bounds checking vulnerabilities by @directionless in https://github.com/osquery/osquery/pull/8825
* Reduce noisy logs from `chrome_extensions` by @lucasmrod in https://github.com/osquery/osquery/pull/8792

##### New Contributors
* @edwardsb made their first contribution in https://github.com/osquery/osquery/pull/8791
* @Sampriti2803 made their first contribution in https://github.com/osquery/osquery/pull/8794
* @ariary made their first contribution in https://github.com/osquery/osquery/pull/8801
* @juan-fdz-hawa made their first contribution in https://github.com/osquery/osquery/pull/8805
* @thierryfranzetti made their first contribution in https://github.com/osquery/osquery/pull/8838
* @stefanamaerz made their first contribution in https://github.com/osquery/osquery/pull/8841

**Full C

_[Truncated at 4000 characters — full notes: https://github.com/osquery/osquery/releases/tag/5.23.0]_

### 5.22.1

- Date: 2026-02-25
- Version: 5.22.1
- Original notes: https://github.com/osquery/osquery/releases/tag/5.22.1
- Permalink: https://whatsnew.fyi/product/osquery/releases/5.22.1

- **fixed** — Replace macOS signing certificate out of sync with provisioning profile
- **changed** — Make escapeNonPrintableBytes UTF-8 aware, changing query results to render unicode bytes as corresponding characters
- **changed** — Update virtual SQL functions to support multiple constraints, allowing queries with joins or subqueries to the users table to include results for remote users
- **added** — Add support for retries in carver
- **changed** — Preserve file metadata in carver archives
- **added** — Add machine-wide provisioned MSIX packages to programs table
- **changed** — Update osquery-toolchain to 1.2.0 with LLVM 11.0.0 and zlib 1.2.13
- **changed** — Update Apple provisioning profile for new developer certificates
- **changed** — Update OpenSSL to 3.6.1
- **fixed** — Quit carving when sending a block fails
- **fixed** — Fix SMBIOS CPU count
- **fixed** — Fix systemd unit to use .target instead of .service
- **fixed** — Fix typo in winbaseobj.table description
- **fixed** — Fix JSON handling copy vs. ref semantics
- **fixed** — Fix memory leak in logon_sessions

5.22.0 macOS binaries will not execute because the signing certificate is out of sync with the provisioning profile. 5.22.1 replaces it.

##### What's Changed

###### Features

* Make escapeNonPrintableBytes UTF-8 aware by @nulmete in https://github.com/osquery/osquery/pull/8777
  * **Note:** This changes some query results that formerly were rendered as raw unicode bytes and will now be rendered as the corresponding characters.
* Update virtual sql functions to support multiple constraints by @brian-mckinney in https://github.com/osquery/osquery/pull/8746
  * This allows `SELECT * FROM vscode_extensions WHERE uid in (SELECT uid FROM users WHERE include_remote = 1)` and similar queries that join or subquery to the `users` table to include results for remote users.
* Add support for retries in carver by @zwass in https://github.com/osquery/osquery/pull/8740
* Preserve file metadata in carver archives  by @zwass in https://github.com/osquery/osquery/pull/8752
* Add machine-wide provisioned MSIX packages to programs table (#8001) by @getvictor in https://github.com/osquery/osquery/pull/8772

###### Build & Dependencies

* Update osquery-toolchain to 1.2.0 (LLVM 11.0.0, zlib 1.2.13) by @zwass in https://github.com/osquery/osquery/pull/8773
* Update Apple provisioning profile for new developer certificates by @zwass in https://github.com/osquery/osquery/pull/8780
* build: suppress `enum-constexpr-conversion` error for boost mpl on macos by @sharvilshah in https://github.com/osquery/osquery/pull/8742
* lib: Update openssl to 3.6.1 by @sharvilshah in https://github.com/osquery/osquery/pull/8766

###### Fixes

* Quit carving when sending a block fails by @zwass in https://github.com/osquery/osquery/pull/8733
* Fix SMBIOS CPU count by @agiacomolli in https://github.com/osquery/osquery/pull/8737
* Fix systemd unit: use .target instead of .service by @ideologysec in https://github.com/osquery/osquery/pull/8771
* Fix typo in winbaseobj.table description by @SquidCooki2 in https://github.com/osquery/osquery/pull/8768
* Fix JSON handling copy vs. ref semantics by @zwass in https://github.com/osquery/osquery/pull/8738
* Fix memory leak in `logon_sessions` by @directionless in https://github.com/osquery/osquery/pull/8779

##### New Contributors
* @ideologysec made their first contribution in https://github.com/osquery/osquery/pull/8771
* @SquidCooki2 made their first contribution in https://github.com/osquery/osquery/pull/8768
* @nulmete made their first contribution in https://github.com/osquery/osquery/pull/8777
* @brian-mckinney made their first contribution in https://github.com/osquery/osquery/pull/8746

**Full Changelog**: https://github.com/osquery/osquery/compare/5.21.0...5.22.1

### 5.21.0

- Date: 2025-12-18
- Version: 5.21.0
- Original notes: https://github.com/osquery/osquery/releases/tag/5.21.0
- Permalink: https://whatsnew.fyi/product/osquery/releases/5.21.0

- **changed** — Improve password_policy table
- **changed** — Improve file traversal performance and correctness
- **added** — Add support for Login Items and Background Services on modern macOS
- **added** — Add last_connected_automatic and last_connected_manual columns to wifi_networks table
- **changed** — Refresh resolver state on interval to pick up DNS changes
- **added** — Add new darwin certificate trust settings table
- **fixed** — Fix crash when querying carves table with carves larger than 2GB
- **added** — Add support for gzip content-encoding in HTTP client

##### What's Changed
* Improvements to password_policy table by @zwass in https://github.com/osquery/osquery/pull/8705
* Improve file traversal performance and correctness by @Krechals in https://github.com/osquery/osquery/pull/8704
* Add support for Login Items and Background Services on modern macOS by @zwass in https://github.com/osquery/osquery/pull/8726
* Add last_connected_automatic and last_connected_manual to wifi_networks table by @zwass in https://github.com/osquery/osquery/pull/8728
* Refresh resolver state on interval to pick up DNS changes  by @zwass in https://github.com/osquery/osquery/pull/8716
* Add new darwin certificate trust settings table by @Micah-Kolide in https://github.com/osquery/osquery/pull/8715
* Fix crash when querying carves table with carves larger than 2GB by @ksykulev in https://github.com/osquery/osquery/pull/8732
* Add support for gzip content-encoding in HTTP client  by @zwass in https://github.com/osquery/osquery/pull/8731

##### New Contributors
* @Krechals made their first contribution in https://github.com/osquery/osquery/pull/8704

**Full Changelog**: https://github.com/osquery/osquery/compare/5.20.0...5.21.0

### 5.20.0

- Date: 2025-10-23
- Version: 5.20.0
- Original notes: https://github.com/osquery/osquery/releases/tag/5.20.0
- Permalink: https://whatsnew.fyi/product/osquery/releases/5.20.0

- **added** — Add default path for CA certificate bundle on openSUSE
- **changed** — Exclude config views from db migration
- **changed** — Make vscode_extensions more consistently report UUID
- **fixed** — Don't overwrite hardware_version if it has a value
- **added** — Support nvm on npm_packages table
- **added** — Add scoped npm package support in npm_packages table
- **fixed** — Fix build against libaudit >=4.1.1 by removing set_aumessage_mode call
- **changed** — Update libarchive from 3.7.9 to 3.8.1

##### What's Changed
###### Features/Bugs
* Add default path for CA certificate bundle on openSUSE by @iko1 in https://github.com/osquery/osquery/pull/8687
* Exclude config views from db migration by @Micah-Kolide in https://github.com/osquery/osquery/pull/8678
* Make `vscode_extensions` more consistently report UUID by @zwass in https://github.com/osquery/osquery/pull/8693
* Don't overwrite `hardware_version` if it has a value by @sbrito85 in https://github.com/osquery/osquery/pull/8690
* Support `nvm` on `npm_packages` table by @dantecatalfamo in https://github.com/osquery/osquery/pull/8694
* Add scoped npm package support in `npm_packages` table by @lichao127 in https://github.com/osquery/osquery/pull/8686

###### Dependencies
* Fix build against libaudit >=4.1.1 by removing set_aumessage_mode call by @Blarse in https://github.com/osquery/osquery/pull/8676
* libs: libarchive: 3.7.9 -> 3.8.1 by @LeSuisse in https://github.com/osquery/osquery/pull/8642

###### Documentation
* Fix SQL examples for system_profiler table by @zwass in https://github.com/osquery/osquery/pull/8699
* Add more informative descriptions for `mounts.blocks_free` and `mounts.blocks_available` by @jacobshandling in https://github.com/osquery/osquery/pull/8701
* Update `dns_resolvers` documentation to point to `interface_details` on Windows by @zwass in https://github.com/osquery/osquery/pull/8682

##### New Contributors
* @frankgraziano made their first contribution in https://github.com/osquery/osquery/pull/8681
* @Blarse made their first contribution in https://github.com/osquery/osquery/pull/8676
* @jacobshandling made their first contribution in https://github.com/osquery/osquery/pull/8701

**Full Changelog**: https://github.com/osquery/osquery/compare/5.19.0...5.20.0

### 5.19.0

- Date: 2025-08-13
- Version: 5.19.0
- Original notes: https://github.com/osquery/osquery/releases/tag/5.19.0
- Permalink: https://whatsnew.fyi/product/osquery/releases/5.19.0

- **added** — Add table deb_package_files
- **added** — Add system_profiler table for macOS
- **added** — Add version collate to os_version table's version column
- **added** — Add entitlements column to macOS signature table
- **added** — Add support for VSCode forks in vscode_extensions
- **fixed** — Fix NSInvalidArgumentException when querying connected_displays
- **fixed** — Fix inconsistent counter resets due to Config::purge()
- **changed** — Update linux block_device and disk_encryption source data to simple sysfs implementation
- **fixed** — Fix ATC for open Firefox databases
- **changed** — Update yara from 4.2.3 to 4.5.4
- **changed** — Upgrade zlib to 1.3.1
- **fixed** — Fix build for XCode SDK 16.4

##### What's Changed

###### Features
* Add table `deb_package_files` by @zwass in https://github.com/osquery/osquery/pull/8657
* Add `system_profiler` table for macOS by @zwass in https://github.com/osquery/osquery/pull/8645
* Add version collate to `os_version` table's `version` column by @Micah-Kolide in https://github.com/osquery/osquery/pull/8659
* Add `entitlements` column to macOS `signature` table by @zwass in https://github.com/osquery/osquery/pull/8666
* Add support for VSCode forks in `vscode_extensions` by @zwass in https://github.com/osquery/osquery/pull/8664

###### Bugfixes
* Fix `NSInvalidArgumentException` when querying `connected_displays` by @Synse in https://github.com/osquery/osquery/pull/8628
* Fix inconsistent counter resets due to `Config::purge()` by @skurpad7 in https://github.com/osquery/osquery/pull/8635
* Update linux `block_device` and `disk_encryption` source data to simple sysfs implementation by @Micah-Kolide in https://github.com/osquery/osquery/pull/8182
* Fix ATC for open Firefox databases by @zwass in https://github.com/osquery/osquery/pull/8631

###### Other
* libs: yara: 4.2.3 -> 4.5.4 by @LeSuisse in https://github.com/osquery/osquery/pull/8643
* Upgrading zlib to 1.3.1 by @ksykulev in https://github.com/osquery/osquery/pull/8625
* Fix build for XCode SDK 16.4 by @lucasmrod in https://github.com/osquery/osquery/pull/8640
* Update build instructions for workaround for XCode SDK > 16.3 by @lucasmrod in https://github.com/osquery/osquery/pull/8650
* Add Cursor AI editor configurations by @zwass in https://github.com/osquery/osquery/pull/8656
* Further improvement to Cursor rules by @zwass in https://github.com/osquery/osquery/pull/8662
* Update Windows build instructions by @zwass in https://github.com/osquery/osquery/pull/8661

##### New Contributors
* @Synse made their first contribution in https://github.com/osquery/osquery/pull/8628
* @skurpad7 made their first contribution in https://github.com/osquery/osquery/pull/8635

**Full Changelog**: https://github.com/osquery/osquery/compare/5.18.0...5.19.0

### 5.18.1

- Date: 2025-06-24
- Version: 5.18.1
- Original notes: https://github.com/osquery/osquery/releases/tag/5.18.1
- Permalink: https://whatsnew.fyi/product/osquery/releases/5.18.1

- **fixed** — Fix parsing of Windows shortcut (.lnk) files in file table
- **fixed** — Fix Prefetch table for Windows 11
- **fixed** — Fix hardware UUID caching
- **added** — Add detection for ARM CPUs when running in x86 emulation
- **changed** — Reduce log noise for hash table
- **added** — Add jetbrains_plugins table
- **added** — Add recent_files table on Windows
- **changed** — Update googletest
- **changed** — Update libarchive from 3.6.2 to 3.7.9
- **changed** — Print stderr if exists in performance analysis

##### What's Changed

* [Performance Analysis] print stderr if exists by @lichao127 in https://github.com/osquery/osquery/pull/8600
* libs: Update googletest by @Smjert in https://github.com/osquery/osquery/pull/8604
* Fix parsing of Windows shortcut (.lnk) files in file table by @zwass in https://github.com/osquery/osquery/pull/8601
* Fix Prefetch table for Windows 11 by @zwass in https://github.com/osquery/osquery/pull/8615
* libs: libarchive: 3.6.2 -> 3.7.9 by @LeSuisse in https://github.com/osquery/osquery/pull/8605
* Fix hardware UUID caching by @sgress454 in https://github.com/osquery/osquery/pull/8616
* Add detection for ARM CPUs when running in x86 emulation by @dantecatalfamo in https://github.com/osquery/osquery/pull/8572
* Reduce log noise for `hash` table by @lucasmrod in https://github.com/osquery/osquery/pull/8626
* Fix SQL example syntax in SQL introduction docs by @piotrgiedziun in https://github.com/osquery/osquery/pull/8620
* Added jetbrains_plugins table by @ksykulev in https://github.com/osquery/osquery/pull/8623
* Add recent_files table on Windows by @zwass in https://github.com/osquery/osquery/pull/8603

##### New Contributors
* @piotrgiedziun made their first contribution in https://github.com/osquery/osquery/pull/8620

**Full Changelog**: https://github.com/osquery/osquery/compare/5.17.0...5.18.1

### 5.17.0

- Date: 2025-04-16
- Version: 5.17.0
- Original notes: https://github.com/osquery/osquery/releases/tag/5.17.0
- Permalink: https://whatsnew.fyi/product/osquery/releases/5.17.0

- **added** — Add symlink_target_path column to files table
- **added** — Update shell_history table to include ash
- **added** — Add auto_update and app_name columns to homebrew_packages table
- **added** — Add support for scheduled queries to run at startup
- **added** — Add support for DEB822-style apt sources
- **added** — Add support for msix packages
- **added** — Implement yara_events table for Windows
- **added** — Implement dns_lookup_events table on Windows
- **added** — Add UpgradeCode column to programs table
- **changed** — Update docker_container_stats table to include memory_inactive_file and memory_total_inactive_file columns
- **changed** — Boost 1.87 compatibility
- **changed** — Update OpenSSL from 3.2.1 to 3.4.1
- **changed** — Update expat from 2.6.0 to 2.7.1
- **changed** — Refactor ETW helpers for unicode support
- **fixed** — Fix windows helpers
- **fixed** — Fix event expiration to prevent losing events
- **fixed** — Fix docker container table disk/write metrics by comparing op values with ignore case
- **fixed** — Escape service binary path in manage-osqueryd.ps1
- **fixed** — Fix SMC reading values
- **fixed** — Fix network metrics

##### [5.17.0](https://github.com/osquery/osquery/releases/tag/5.17.0)

[Git Commits](https://github.com/osquery/osquery/compare/5.16.0...5.17.0)

##### What's Changed
* Add `CHANGELOG.md` entry for 5.16.0 by @lucasmrod in https://github.com/osquery/osquery/pull/8548
* Add `symlink_target_path` to `files` tables by @DocEmmetBrown in https://github.com/osquery/osquery/pull/8502
* cve: Ignore libarchive CVE-2024-26256 by @Smjert in https://github.com/osquery/osquery/pull/8546
* Fixes in windows helpers by @zwass in https://github.com/osquery/osquery/pull/8549
* Align ES functions with documented macOS versions by @SilverPlate3 in https://github.com/osquery/osquery/pull/8338
* Fix include path in logger-plugins.md by @zwass in https://github.com/osquery/osquery/pull/8550
* Fix integration test name in Windows build instructions by @zwass in https://github.com/osquery/osquery/pull/8552
* Fix event expiration to prevent losing events by @zwass in https://github.com/osquery/osquery/pull/8535
* Update `shell_history` table to include ash by @jbeley in https://github.com/osquery/osquery/pull/8568
* Fix dicker container table disk/write metrics, compares "op" values with ignore case by @Kislaci90 in https://github.com/osquery/osquery/pull/8566
* Escape service binary path in manage-osqueryd.ps1  by @smithclay in https://github.com/osquery/osquery/pull/8569
* Update `docker_container_stats` table to include memory_inactive_file and memory_total_inactive_file by @kfnorbi in https://github.com/osquery/osquery/pull/8577
* Add `auto_update` and `app_name` column to `homebrew_packages` table by @DocEmmetBrown in https://github.com/osquery/osquery/pull/8520
* Add support for scheduled queries to run at startup by @Micah-Kolide in https://github.com/osquery/osquery/pull/8554
* Boost 1.87 compatibility by @carlsmedstad in https://github.com/osquery/osquery/pull/8533
* Pin macos python versions in CI to fix mismatch between builder and test runner by @scottvanta in https://github.com/osquery/osquery/pull/8559
* cve: Ignore util-linux CVE-2024-28085 by @Smjert in https://github.com/osquery/osquery/pull/8579
* build(deps): bump jinja2 from 3.1.5 to 3.1.6 by @dependabot in https://github.com/osquery/osquery/pull/8563
* Fix SMC reading values by @sgress454 in https://github.com/osquery/osquery/pull/8583
* Fixes network metrics by @Kislaci90 in https://github.com/osquery/osquery/pull/8567
* Implement yara_events table for Windows by @zwass in https://github.com/osquery/osquery/pull/8580
* Fix flaky mdfind test in CI by @zwass in https://github.com/osquery/osquery/pull/8589
* libs: openssl: 3.2.1 -> 3.4.1 by @LeSuisse in https://github.com/osquery/osquery/pull/8586
* Add support for DEB822-style apt sources by @dantecatalfamo in https://github.com/osquery/osquery/pull/8556
* Add support for msix packages by @ksykulev in https://github.com/osquery/osquery/pull/8585
* Implement dns_lookup_events table on Windows by @zwass in https://github.com/osquery/osquery/pull/8553
* Added UpgradeCode to programs table by @ksykulev in https://github.com/osquery/osquery/pull/8587
* libs: expat bump from 2.6.0 to 2.7.1 by @LeSuisse in https://github.com/osquery/osquery/pull/8595
* Update ubuntu runners to 22.04 by @zwass in https://github.com/osquery/osquery/pull/8592
* Refactor ETW helpers for unicode support by @zwass in https://github.com/osquery/osquery/pull/8596
* Fix/startup items parsing by @AndreaMarangoni in https://github.com/osquery/osquery/pull/8536
* Filter the Win32_Processor query to only required fields by @jaymzjulian in https://github.com/osquery/osquery/pull/8598

##### New Contributors
* @DocEmmetBrown made their first contribution in https://github.com/osquery/osquery/pull/8502
* @jbeley made their first contribution in https://github.com/osquery/osquery/pull/8568
* @Kislaci90 made their first contribution in https://github.com/osquery/osquery/pull/8566
* @smithclay made their first contribution in https:/

_[Truncated at 4000 characters — full notes: https://github.com/osquery/osquery/releases/tag/5.17.0]_

### 5.16.0

- Date: 2025-02-09
- Version: 5.16.0
- Original notes: https://github.com/osquery/osquery/releases/tag/5.16.0
- Permalink: https://whatsnew.fyi/product/osquery/releases/5.16.0

- **fixed** — Fix the python_paths table to skip unnecessary code paths when filtering by directory
- **added** — Add python packages in user directories on python_packages table
- **added** — Add RHEL paths for python_packages table
- **changed** — Buffer error logs in deb_packages table
- **fixed** — Fix wifi_status to correctly gather network_name on MacOS 14+
- **fixed** — Fix hardware model and version on Lenovo on system_info
- **changed** — Optimize rpm_packages and rpm_package_files use of query context
- **fixed** — Fix to only deny-list scheduled queries when watchdog is enabled
- **fixed** — Switch to wmain to accept non-ascii characters from command line

##### [5.16.0](https://github.com/osquery/osquery/releases/tag/5.16.0)

[Git Commits](https://github.com/osquery/osquery/compare/5.15.0...5.16.0)

Representing commits from 7 contributors! Thank you all.

###### Table Changes

- Fix the `python_paths` table to skip unnecessary code paths when filtering by `directory` ([#8544](https://github.com/osquery/osquery/pull/8544))
- Added python packages in user directories on `python_packages` ([#8504](https://github.com/osquery/osquery/pull/8504))
- Added RHEL paths for `python_packages` table ([#8529](https://github.com/osquery/osquery/pull/8529))
- Buffer error logs in `deb_packages` table ([#8540](https://github.com/osquery/osquery/pull/8540))
- Fix `wifi_status` to correctly gather `network_name` on MacOS 14+ ([#8530](https://github.com/osquery/osquery/pull/8530))
- Fix hardware model and version on Lenovo on `system_info` ([#8534](https://github.com/osquery/osquery/pull/8534))
- Optimize `rpm_packages` and `rpm_package_files` use of query context ([#8537](https://github.com/osquery/osquery/pull/8537))

###### Bug Fixes

- Fix to only deny-list scheduled queries when watchdog is enabled ([#8541](https://github.com/osquery/osquery/pull/8541))
- Switched to `wmain` to accept non-ascii characters from command line ([#8519](https://github.com/osquery/osquery/pull/8519))

### 5.15.0

- Date: 2024-12-30
- Version: 5.15.0
- Original notes: https://github.com/osquery/osquery/releases/tag/5.15.0
- Permalink: https://whatsnew.fyi/product/osquery/releases/5.15.0

- **added** — Add arc path to chrome_extensions table on macOS
- **added** — Add support for accept to macOS table socket_events
- **added** — Add all-platform user-based optimized columns
- **added** — Add columns to es_process_events
- **added** — Add Darwin platform optimized miscellaneous columns
- **added** — Add all-platform path-based optimized columns
- **added** — Add Windows platform optimized columns
- **added** — Add hash_executable column to signature table
- **added** — Include VSCode Insiders extensions in vscode_extensions table
- **added** — Add POSIX platforms optimized columns
- **added** — Add Linux platform optimized columns
- **added** — Add all platform process based and curl optimized columns
- **added** — Add Darwin platform optimized system-related columns
- **added** — Add Darwin platform optimized path columns
- **changed** — Use empty columns instead of zeroes when undefined in socket_events
- **changed** — Update the browser_firefox table to exclude Crash Reports and Pending Pings folders
- **changed** — Move status column to extended_schema for linux socket_events
- **fixed** — Fix incorrect SID in logged_in_users table on windows when username and domain/device name are the same
- **fixed** — Fix a leak in genAarch64PlatformInfo

<a name="5.15.0"></a>
##### [5.15.0](https://github.com/osquery/osquery/releases/tag/5.15.0)

[Git Commits](https://github.com/osquery/osquery/compare/5.14.1...5.15.0)

Representing commits from 17 contributors! Thank you all.

###### Table Changes

- Add arc path to `chrome_extensions` on macOS ([#8473](https://github.com/osquery/osquery/pull/8473))
- Use empty columns instead of zeroes when undefined in `socket_events` ([#8510](https://github.com/osquery/osquery/pull/8510))
- Add support for accept to macOS table `socket_events` ([#8508](https://github.com/osquery/osquery/pull/8508))
- Add all-platform user-based optimized columns ([#8496](https://github.com/osquery/osquery/pull/8496))
- Add columns to `es_process_events` ([#8506](https://github.com/osquery/osquery/pull/8506))
- Add Darwin platform optimized miscellaneous columns ([#8484](https://github.com/osquery/osquery/pull/8484))
- Add all-platform path-based optimized columns ([#8497](https://github.com/osquery/osquery/pull/8497))
- Add Windows platform optimized columns ([#8495](https://github.com/osquery/osquery/pull/8495))
- Add `hash_executable` column to `signature` table ([#8471](https://github.com/osquery/osquery/pull/8471))
- Include VSCode Insiders extensions in `vscode_extensions` table ([#8396](https://github.com/osquery/osquery/pull/8396))
- Add POSIX platforms optimized columns ([#8494](https://github.com/osquery/osquery/pull/8494))
- Add Linux platform optimized columns ([#8493](https://github.com/osquery/osquery/pull/8493))
- Add all platform process based and curl optimized columns ([#8498](https://github.com/osquery/osquery/pull/8498))
- Add Darwin platform optimized system-related columns ([#8483](https://github.com/osquery/osquery/pull/8483))
- Add Darwin platform optimized path columns ([#8482](https://github.com/osquery/osquery/pull/8482))
- Fix incorrect SID in `logged_in_users` table on windows when username and domain/device name are the same ([#8486](https://github.com/osquery/osquery/pull/8486))
- Update the `browser_firefox` table to exclude "Crash Reports" and "Pending Pings" folders ([#8478](https://github.com/osquery/osquery/pull/8478))
- Move status column to `extended_schema` for linux `socket_events` ([#8503](https://github.com/osquery/osquery/pull/8503))

###### Under the Hood improvements

- Utils: Optimize default status message constructor ([#8489](https://github.com/osquery/osquery/pull/8489))

###### Bug Fixes

- Fix a leak in `genAarch64PlatformInfo` ([#8462](https://github.com/osquery/osquery/pull/8462))
- Fix a leak in `DiskArbitrationEventPublisher::getProperty` ([#8463](https://github.com/osquery/osquery/pull/8463))
- Catching generic exception in order to avoid crashing when parsing windows events logs ([#8513](https://github.com/osquery/osquery/pull/8513))
- Fix leak in `windows_events` by using `scope_guard` ([#8511](https://github.com/osquery/osquery/pull/8511))
- Fixed eBPF's parsing of parent pid ([#8501](https://github.com/osquery/osquery/pull/8501))
- Fix IO objects refcounting ([#8481](https://github.com/osquery/osquery/pull/8481))

###### Documentation

- Add documentation for testing macOS EndpointSecurity ([#8509](https://github.com/osquery/osquery/pull/8509))
- Add double quotes in Windows installation documentation ([#8492](https://github.com/osquery/osquery/pull/8492))
- Update expired Slack invite ([#8488](https://github.com/osquery/osquery/pull/8488))
- Update docs to correctly define `conditional_to_base64` ([#8460](https://github.com/osquery/osquery/pull/8460))

###### Build

- build(deps): bump jinja2 from 3.1.4 to 3.1.5 ([#8507](https://github.com/osquery/osquery/pull/8507))
- Remove yara schema subdirectory ([#8461](https://github.com/osquery/osquery/pull/8461))
- Added chrono header file ([#8512](https://github.com/osquery/osquery/pull/8512))
- Replace usage of libaudit function removed in v3.0.7 ([#8401](https://github.com/osquery/osquery/pull/8401))

_[Truncated at 4000 characters — full notes: https://github.com/osquery/osquery/releases/tag/5.15.0]_