# osquery 5.17.0

- Product: osquery (https://whatsnew.fyi/product/osquery)
- Vendor: osquery
- Date: 2025-04-16
- Version: 5.17.0
- Original notes: https://github.com/osquery/osquery/releases/tag/5.17.0
- Permalink: https://whatsnew.fyi/product/osquery/releases/5.17.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add symlink_target_path column to files table
- **added** — Update shell_history table to include ash
- **added** — Add auto_update and app_name columns to homebrew_packages table
- **added** — Add support for scheduled queries to run at startup
- **added** — Add support for DEB822-style apt sources
- **added** — Add support for msix packages
- **added** — Implement yara_events table for Windows
- **added** — Implement dns_lookup_events table on Windows
- **added** — Add UpgradeCode column to programs table
- **changed** — Update docker_container_stats table to include memory_inactive_file and memory_total_inactive_file columns
- **changed** — Boost 1.87 compatibility
- **changed** — Update OpenSSL from 3.2.1 to 3.4.1
- **changed** — Update expat from 2.6.0 to 2.7.1
- **changed** — Refactor ETW helpers for unicode support
- **fixed** — Fix windows helpers
- **fixed** — Fix event expiration to prevent losing events
- **fixed** — Fix docker container table disk/write metrics by comparing op values with ignore case
- **fixed** — Escape service binary path in manage-osqueryd.ps1
- **fixed** — Fix SMC reading values
- **fixed** — Fix network metrics

##### [5.17.0](https://github.com/osquery/osquery/releases/tag/5.17.0)

[Git Commits](https://github.com/osquery/osquery/compare/5.16.0...5.17.0)

##### What's Changed
* Add `CHANGELOG.md` entry for 5.16.0 by @lucasmrod in https://github.com/osquery/osquery/pull/8548
* Add `symlink_target_path` to `files` tables by @DocEmmetBrown in https://github.com/osquery/osquery/pull/8502
* cve: Ignore libarchive CVE-2024-26256 by @Smjert in https://github.com/osquery/osquery/pull/8546
* Fixes in windows helpers by @zwass in https://github.com/osquery/osquery/pull/8549
* Align ES functions with documented macOS versions by @SilverPlate3 in https://github.com/osquery/osquery/pull/8338
* Fix include path in logger-plugins.md by @zwass in https://github.com/osquery/osquery/pull/8550
* Fix integration test name in Windows build instructions by @zwass in https://github.com/osquery/osquery/pull/8552
* Fix event expiration to prevent losing events by @zwass in https://github.com/osquery/osquery/pull/8535
* Update `shell_history` table to include ash by @jbeley in https://github.com/osquery/osquery/pull/8568
* Fix dicker container table disk/write metrics, compares "op" values with ignore case by @Kislaci90 in https://github.com/osquery/osquery/pull/8566
* Escape service binary path in manage-osqueryd.ps1  by @smithclay in https://github.com/osquery/osquery/pull/8569
* Update `docker_container_stats` table to include memory_inactive_file and memory_total_inactive_file by @kfnorbi in https://github.com/osquery/osquery/pull/8577
* Add `auto_update` and `app_name` column to `homebrew_packages` table by @DocEmmetBrown in https://github.com/osquery/osquery/pull/8520
* Add support for scheduled queries to run at startup by @Micah-Kolide in https://github.com/osquery/osquery/pull/8554
* Boost 1.87 compatibility by @carlsmedstad in https://github.com/osquery/osquery/pull/8533
* Pin macos python versions in CI to fix mismatch between builder and test runner by @scottvanta in https://github.com/osquery/osquery/pull/8559
* cve: Ignore util-linux CVE-2024-28085 by @Smjert in https://github.com/osquery/osquery/pull/8579
* build(deps): bump jinja2 from 3.1.5 to 3.1.6 by @dependabot in https://github.com/osquery/osquery/pull/8563
* Fix SMC reading values by @sgress454 in https://github.com/osquery/osquery/pull/8583
* Fixes network metrics by @Kislaci90 in https://github.com/osquery/osquery/pull/8567
* Implement yara_events table for Windows by @zwass in https://github.com/osquery/osquery/pull/8580
* Fix flaky mdfind test in CI by @zwass in https://github.com/osquery/osquery/pull/8589
* libs: openssl: 3.2.1 -> 3.4.1 by @LeSuisse in https://github.com/osquery/osquery/pull/8586
* Add support for DEB822-style apt sources by @dantecatalfamo in https://github.com/osquery/osquery/pull/8556
* Add support for msix packages by @ksykulev in https://github.com/osquery/osquery/pull/8585
* Implement dns_lookup_events table on Windows by @zwass in https://github.com/osquery/osquery/pull/8553
* Added UpgradeCode to programs table by @ksykulev in https://github.com/osquery/osquery/pull/8587
* libs: expat bump from 2.6.0 to 2.7.1 by @LeSuisse in https://github.com/osquery/osquery/pull/8595
* Update ubuntu runners to 22.04 by @zwass in https://github.com/osquery/osquery/pull/8592
* Refactor ETW helpers for unicode support by @zwass in https://github.com/osquery/osquery/pull/8596
* Fix/startup items parsing by @AndreaMarangoni in https://github.com/osquery/osquery/pull/8536
* Filter the Win32_Processor query to only required fields by @jaymzjulian in https://github.com/osquery/osquery/pull/8598

##### New Contributors
* @DocEmmetBrown made their first contribution in https://github.com/osquery/osquery/pull/8502
* @jbeley made their first contribution in https://github.com/osquery/osquery/pull/8568
* @Kislaci90 made their first contribution in https://github.com/osquery/osquery/pull/8566
* @smithclay made their first contribution in https:/

_[Truncated at 4000 characters — full notes: https://github.com/osquery/osquery/releases/tag/5.17.0]_