osquery 5.17.0

Git Commits

What's Changed

• Add CHANGELOG.md entry for 5.16.0 by @lucasmrod in https://github.com/osquery/osquery/pull/8548
• Add symlink_target_path to files tables by @DocEmmetBrown in https://github.com/osquery/osquery/pull/8502
• cve: Ignore libarchive CVE-2024-26256 by @Smjert in https://github.com/osquery/osquery/pull/8546
• Fixes in windows helpers by @zwass in https://github.com/osquery/osquery/pull/8549
• Align ES functions with documented macOS versions by @SilverPlate3 in https://github.com/osquery/osquery/pull/8338
• Fix include path in logger-plugins.md by @zwass in https://github.com/osquery/osquery/pull/8550
• Fix integration test name in Windows build instructions by @zwass in https://github.com/osquery/osquery/pull/8552
• Fix event expiration to prevent losing events by @zwass in https://github.com/osquery/osquery/pull/8535
• Update shell_history table to include ash by @jbeley in https://github.com/osquery/osquery/pull/8568
• Fix dicker container table disk/write metrics, compares "op" values with ignore case by @Kislaci90 in https://github.com/osquery/osquery/pull/8566
• Escape service binary path in manage-osqueryd.ps1 by @smithclay in https://github.com/osquery/osquery/pull/8569
• Update docker_container_stats table to include memory_inactive_file and memory_total_inactive_file by @kfnorbi in https://github.com/osquery/osquery/pull/8577
• Add auto_update and app_name column to homebrew_packages table by @DocEmmetBrown in https://github.com/osquery/osquery/pull/8520
• Add support for scheduled queries to run at startup by @Micah-Kolide in https://github.com/osquery/osquery/pull/8554
• Boost 1.87 compatibility by @carlsmedstad in https://github.com/osquery/osquery/pull/8533
• Pin macos python versions in CI to fix mismatch between builder and test runner by @scottvanta in https://github.com/osquery/osquery/pull/8559
• cve: Ignore util-linux CVE-2024-28085 by @Smjert in https://github.com/osquery/osquery/pull/8579
• build(deps): bump jinja2 from 3.1.5 to 3.1.6 by @dependabot in https://github.com/osquery/osquery/pull/8563
• Fix SMC reading values by @sgress454 in https://github.com/osquery/osquery/pull/8583
• Fixes network metrics by @Kislaci90 in https://github.com/osquery/osquery/pull/8567
• Implement yara_events table for Windows by @zwass in https://github.com/osquery/osquery/pull/8580
• Fix flaky mdfind test in CI by @zwass in https://github.com/osquery/osquery/pull/8589
• libs: openssl: 3.2.1 -> 3.4.1 by @LeSuisse in https://github.com/osquery/osquery/pull/8586
• Add support for DEB822-style apt sources by @dantecatalfamo in https://github.com/osquery/osquery/pull/8556
• Add support for msix packages by @ksykulev in https://github.com/osquery/osquery/pull/8585
• Implement dns_lookup_events table on Windows by @zwass in https://github.com/osquery/osquery/pull/8553
• Added UpgradeCode to programs table by @ksykulev in https://github.com/osquery/osquery/pull/8587
• libs: expat bump from 2.6.0 to 2.7.1 by @LeSuisse in https://github.com/osquery/osquery/pull/8595
• Update ubuntu runners to 22.04 by @zwass in https://github.com/osquery/osquery/pull/8592
• Refactor ETW helpers for unicode support by @zwass in https://github.com/osquery/osquery/pull/8596
• Fix/startup items parsing by @AndreaMarangoni in https://github.com/osquery/osquery/pull/8536
• Filter the Win32_Processor query to only required fields by @jaymzjulian in https://github.com/osquery/osquery/pull/8598

New Contributors

• @DocEmmetBrown made their first contribution in https://github.com/osquery/osquery/pull/8502
• @jbeley made their first contribution in https://github.com/osquery/osquery/pull/8568
• @Kislaci90 made their first contribution in https://github.com/osquery/osquery/pull/8566
• @smithclay made their first contribution in https://github.com/osquery/osquery/pull/8569
• @kfnorbi made their first contribution in https://github.com/osquery/osquery/pull/8577
• @scottvanta made their first contribution in https://github.com/osquery/osquery/pull/8559
• @LeSuisse made their first contribution in https://github.com/osquery/osquery/pull/8586
• @dantecatalfamo made their first contribution in https://github.com/osquery/osquery/pull/8556
• @jaymzjulian made their first contribution in https://github.com/osquery/osquery/pull/8598

Full Changelog: https://github.com/osquery/osquery/compare/5.16.0...5.17.0