5.22.1
Added 2
- Add support for retries in carver
- Add machine-wide provisioned MSIX packages to programs table
Changed 6
- Make escapeNonPrintableBytes UTF-8 aware, changing query results to render unicode bytes as corresponding characters
- Update virtual SQL functions to support multiple constraints, allowing queries with joins or subqueries to the users table to include results for remote users
- Preserve file metadata in carver archives
- Update osquery-toolchain to 1.2.0 with LLVM 11.0.0 and zlib 1.2.13
- Update Apple provisioning profile for new developer certificates
- Update OpenSSL to 3.6.1
Fixed 7
- Replace macOS signing certificate out of sync with provisioning profile
- Quit carving when sending a block fails
- Fix SMBIOS CPU count
- Fix systemd unit to use .target instead of .service
- Fix typo in winbaseobj.table description
- Fix JSON handling copy vs. ref semantics
- Fix memory leak in logon_sessions
From osquery
5.22.0 macOS binaries will not execute because the signing certificate is out of sync with the provisioning profile. 5.22.1 replaces it.
What's Changed
Features
- Make escapeNonPrintableBytes UTF-8 aware by @nulmete in https://github.com/osquery/osquery/pull/8777
- Note: This changes some query results that formerly were rendered as raw unicode bytes and will now be rendered as the corresponding characters.
- Update virtual sql functions to support multiple constraints by @brian-mckinney in https://github.com/osquery/osquery/pull/8746
- This allows
SELECT * FROM vscode_extensions WHERE uid in (SELECT uid FROM users WHERE include_remote = 1)and similar queries that join or subquery to theuserstable to include results for remote users.
- This allows
- Add support for retries in carver by @zwass in https://github.com/osquery/osquery/pull/8740
- Preserve file metadata in carver archives by @zwass in https://github.com/osquery/osquery/pull/8752
- Add machine-wide provisioned MSIX packages to programs table (#8001) by @getvictor in https://github.com/osquery/osquery/pull/8772
Build & Dependencies
- Update osquery-toolchain to 1.2.0 (LLVM 11.0.0, zlib 1.2.13) by @zwass in https://github.com/osquery/osquery/pull/8773
- Update Apple provisioning profile for new developer certificates by @zwass in https://github.com/osquery/osquery/pull/8780
- build: suppress
enum-constexpr-conversionerror for boost mpl on macos by @sharvilshah in https://github.com/osquery/osquery/pull/8742 - lib: Update openssl to 3.6.1 by @sharvilshah in https://github.com/osquery/osquery/pull/8766
Fixes
- Quit carving when sending a block fails by @zwass in https://github.com/osquery/osquery/pull/8733
- Fix SMBIOS CPU count by @agiacomolli in https://github.com/osquery/osquery/pull/8737
- Fix systemd unit: use .target instead of .service by @ideologysec in https://github.com/osquery/osquery/pull/8771
- Fix typo in winbaseobj.table description by @SquidCooki2 in https://github.com/osquery/osquery/pull/8768
- Fix JSON handling copy vs. ref semantics by @zwass in https://github.com/osquery/osquery/pull/8738
- Fix memory leak in
logon_sessionsby @directionless in https://github.com/osquery/osquery/pull/8779
New Contributors
- @ideologysec made their first contribution in https://github.com/osquery/osquery/pull/8771
- @SquidCooki2 made their first contribution in https://github.com/osquery/osquery/pull/8768
- @nulmete made their first contribution in https://github.com/osquery/osquery/pull/8777
- @brian-mckinney made their first contribution in https://github.com/osquery/osquery/pull/8746
Full Changelog: https://github.com/osquery/osquery/compare/5.21.0...5.22.1