# osquery 5.22.1

- Product: osquery (https://whatsnew.fyi/product/osquery)
- Vendor: osquery
- Date: 2026-02-25
- Version: 5.22.1
- Original notes: https://github.com/osquery/osquery/releases/tag/5.22.1
- Permalink: https://whatsnew.fyi/product/osquery/releases/5.22.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Replace macOS signing certificate out of sync with provisioning profile
- **changed** — Make escapeNonPrintableBytes UTF-8 aware, changing query results to render unicode bytes as corresponding characters
- **changed** — Update virtual SQL functions to support multiple constraints, allowing queries with joins or subqueries to the users table to include results for remote users
- **added** — Add support for retries in carver
- **changed** — Preserve file metadata in carver archives
- **added** — Add machine-wide provisioned MSIX packages to programs table
- **changed** — Update osquery-toolchain to 1.2.0 with LLVM 11.0.0 and zlib 1.2.13
- **changed** — Update Apple provisioning profile for new developer certificates
- **changed** — Update OpenSSL to 3.6.1
- **fixed** — Quit carving when sending a block fails
- **fixed** — Fix SMBIOS CPU count
- **fixed** — Fix systemd unit to use .target instead of .service
- **fixed** — Fix typo in winbaseobj.table description
- **fixed** — Fix JSON handling copy vs. ref semantics
- **fixed** — Fix memory leak in logon_sessions

5.22.0 macOS binaries will not execute because the signing certificate is out of sync with the provisioning profile. 5.22.1 replaces it.

##### What's Changed

###### Features

* Make escapeNonPrintableBytes UTF-8 aware by @nulmete in https://github.com/osquery/osquery/pull/8777
  * **Note:** This changes some query results that formerly were rendered as raw unicode bytes and will now be rendered as the corresponding characters.
* Update virtual sql functions to support multiple constraints by @brian-mckinney in https://github.com/osquery/osquery/pull/8746
  * This allows `SELECT * FROM vscode_extensions WHERE uid in (SELECT uid FROM users WHERE include_remote = 1)` and similar queries that join or subquery to the `users` table to include results for remote users.
* Add support for retries in carver by @zwass in https://github.com/osquery/osquery/pull/8740
* Preserve file metadata in carver archives  by @zwass in https://github.com/osquery/osquery/pull/8752
* Add machine-wide provisioned MSIX packages to programs table (#8001) by @getvictor in https://github.com/osquery/osquery/pull/8772

###### Build & Dependencies

* Update osquery-toolchain to 1.2.0 (LLVM 11.0.0, zlib 1.2.13) by @zwass in https://github.com/osquery/osquery/pull/8773
* Update Apple provisioning profile for new developer certificates by @zwass in https://github.com/osquery/osquery/pull/8780
* build: suppress `enum-constexpr-conversion` error for boost mpl on macos by @sharvilshah in https://github.com/osquery/osquery/pull/8742
* lib: Update openssl to 3.6.1 by @sharvilshah in https://github.com/osquery/osquery/pull/8766

###### Fixes

* Quit carving when sending a block fails by @zwass in https://github.com/osquery/osquery/pull/8733
* Fix SMBIOS CPU count by @agiacomolli in https://github.com/osquery/osquery/pull/8737
* Fix systemd unit: use .target instead of .service by @ideologysec in https://github.com/osquery/osquery/pull/8771
* Fix typo in winbaseobj.table description by @SquidCooki2 in https://github.com/osquery/osquery/pull/8768
* Fix JSON handling copy vs. ref semantics by @zwass in https://github.com/osquery/osquery/pull/8738
* Fix memory leak in `logon_sessions` by @directionless in https://github.com/osquery/osquery/pull/8779

##### New Contributors
* @ideologysec made their first contribution in https://github.com/osquery/osquery/pull/8771
* @SquidCooki2 made their first contribution in https://github.com/osquery/osquery/pull/8768
* @nulmete made their first contribution in https://github.com/osquery/osquery/pull/8777
* @brian-mckinney made their first contribution in https://github.com/osquery/osquery/pull/8746

**Full Changelog**: https://github.com/osquery/osquery/compare/5.21.0...5.22.1