v3.10.240.1

What's Changed

• Harden Windows command-line builds: VS2026/v145 support, CI failure propagation (#981), and docs by bmehta001 in #1458
• Add noexcept to non-throwing methods (+ noexcept move ops and LogSessionData parse hardening) by Matthew Koscumb (@mkoscumb) in #1179
• Decorator: move CsProtocol::Value temporaries into ext maps instead of copying by bmehta001 in #1498
• Fix iOS SQLite recreate by cleaning up companion journal/WAL files by bmehta001 in #1484
• Fix null EventProperties.getType() on Android (initialize eventType) by bmehta001 in #1483
• Build native desktop SDK in MSVC conformance mode (/permissive-) by bmehta001 in #1480
• Devirtualize storage hot path: mark MemoryStorage/OfflineStorageHandler final + TU-local statics by bmehta001 in #1488
• Skip MultipleLogManagersTests on iOS (fixes 60-min simulator CI hang) by bmehta001 in #1500
• Low-severity hardening: CSPRNG UUIDs (POSIX) and null-safe zlib error logs by bmehta001 in #1493
• Harden runtime task execution and offline-storage edge cases by bmehta001 in #1495
• Make public headers safe for consumers building with -Werror by bmehta001 in #1501
• Reduce binary footprint and support embedding the SDK as a CMake subproject by bmehta001 in #1499
• Fix crash: replace malformed UTF-8 instead of throwing in PayloadDecoder by Lakshmi Manaswi Karra (@lkarra2) in #1512
• Roll forward lib/modules to get past state with broken normalization by Derek Morris (@Penguinwizzard) in #1509
• Default Android vcpkg builds to Java HTTP by bmehta001 in #1510
• Create the offline event cache with owner-only (0600) permissions by bmehta001 in #1506
• Cap curl HTTP response body size to prevent memory-amplification DoS by bmehta001 in #1507
• Fix version.js JScript runtime error under Windows Script Host (cscript) by bmehta001 in #1505
• Cap HTTP response body size across WinInet, WinRt, and Apple transports by bmehta001 in #1508
• Add a public-header CI gate matching stricter warning flags by bmehta001 in #1503
• Stabilize timing-sensitive tests by bmehta001 in #1513
• Pin GitHub Actions to full-length commit SHAs by Microsoft Open Source Security Bot (@OssSecurityBot) in #1517
• Preserve sub-millisecond event timestamp precision by bmehta001 in #1516
• Fix macOS/iOS test GoogleTest includes by bmehta001 in #1518
• Modernize CMake embedding and self-contained dependencies by bmehta001 in #1511
• Fix JNI string lifetime/null-safety, Windows cancel-drain race, and UWP version parse by bmehta001 in #1494
• Guard POSIX pipe cleanup when popen fails by bmehta001 in #1523
• [Android] Restore MAE SDK configuration cache by bmehta001 in #1526
• Swift Package Manager distribution via prebuilt xcframework (iOS, macOS, Mac Catalyst, visionOS) by bmehta001 in #1486
• Fix unsafe resource lifetimes found by repository audit by bmehta001 in #1524
• [Android] Harden JNI resource ownership by bmehta001 in #1525
• Prepare for new release - 3.10.240.1 by bmehta001 in #1527

New Contributors

• Microsoft Open Source Security Bot (@OssSecurityBot) made their first contribution in #1517

Full Changelog: v3.10.173.1...v3.10.240.1

v3.10.173.1

What's Changed

• Expose setOsVersion/setOsBuild on Obj-C ODWSemanticContext (resolves #1093) by bmehta001 in #1482
• Raise CMake floor to 3.15...3.31 and use find_package(SQLite3) (subsumes #1084) by bmehta001 in #1478
• Parameterize offline-storage deletes and harden kill-switch response handling by bmehta001 in #1467
• Rename demangle to mat_demangle to avoid boost name conflict by bmehta001 in #1479
• Surface per-batch record count (param2) in HTTP response debug events by mogiligarimidi23 in #1487
• Fix GUID_t::operator< to be a valid strict-weak-ordering by bmehta001 in #1490
• Fix inverted oneds_memcpy_s result in CompactBinaryProtocolReader::ReadBlob by bmehta001 in #1492
• New flag to scrub IP addresses by Max Golovanov (@maxgolov) and bmehta001 in #1161
• vcpkg port: release-bump workflow, overlay port bump, and consumer binary-footprint reductions by bmehta001 in #1475
• Prepare for new release - 3.10.173.1 by bmehta001 in #1489

Full Changelog: v3.10.161.1...v3.10.173.1

v3.10.161.1

What's Changed

• Update lib/modules submodule to c637015fb by Lakshmi Manaswi Karra (@lkarra2) in #1461
• Rearchitect vcpkg port for official submission by bmehta001 in #1466
• fix: guard HAVE_MAT_LIVEEVENTINSPECTOR/PRIVACYGUARD against redefinition by bmehta001 in #1473
• Fix -Wextra-semi errors in LogManagerBase.hpp by bmehta001 in #1471
• Bump Android externalNativeBuild CMake 3.10.2 -> 3.22.1 by bmehta001 in #1468
• Prepare for new release - 3.10.161.1 by bmehta001 in #1474

New Contributors

• Lakshmi Manaswi Karra (@lkarra2) made their first contribution in #1461

Full Changelog: v3.10.159.1...v3.10.161.1

v3.10.159.1

Highlights

⚠️ Behavior change — Windows OS build version (#1441)

On Windows desktop, DeviceInfo.OsBuild / ext.os.ver is now always a numeric major.minor.build[.ubr] value (e.g. 10.0.26100.4061), sourced from RtlGetVersion() plus the registry UBR. Previously it could be a BuildLabEx-style string (e.g. 26100.1.amd64fre.ge_release.240331-1435).
Action required: dashboards / Kusto queries that parsed the old BuildLabEx form (splitting on ., extracting branch/flavor/date) must be updated. Queries already expecting the four-part numeric form now receive correct, servicing-aware values. (Fixes #1407.)

🔐 Security — vendored dependency updates

• SQLite 3.34.1 → 3.53.1 (#1457) clears a series of public CVEs: CVE-2022-35737, CVE-2023-7104, CVE-2024-0232, CVE-2025-6965, CVE-2025-70873, CVE-2025-7709. Affects builds using the vendored SQLite (e.g. Windows); Android (Room) and consumers using platform/vcpkg SQLite are unaffected.
• Vendored zlib → 1.3.2 (#1443).

⚙️ ABI / source compatibility (#1452)

IOfflineStorage gains a new non-pure virtual GetRemainingRecordCountForShutdown() (default returns GetRecordCount()). Third-party storage implementations remain source-compatible but must be recompiled against this SDK version because the vtable grows.

🆕 New — EVT_DROPPED reason codes (#1452)

EVT_DROPPED dispatches now carry a drop-reason code in DebugEvent.param2, and two values were appended to EventDroppedReason (DROPPED_REASON_TEARDOWN_TIMEOUT, DROPPED_REASON_LATENCY_DISABLED_BY_PROFILE). Purely additive — param2 is 0 for callers that have not been updated.

🍎 Apple — reachability via NWPathMonitor (#1431)

Apple network detection now uses NWPathMonitor, fixing the iOS 18 reachability crash (#1370). The internal ODWReachability helper and the vendored Tony Million Reachability snapshot were removed. On runtimes older than iOS 12 / macOS 10.14, network type/cost is reported as Unknown. build-ios.sh now defaults to iOS 12.0.

🔧 Other notable changes

• libcurl HTTP client now uses poll() instead of select() (#1426), removing the 1024 file-descriptor hard limit in high-FD processes.
• Removed the forced ATL dependency on Windows (#1453).

---

What's Changed

• [HttpClient][Curl] Use poll api to avoid select 1024 FD hard limit by Luciano Almeida (@lucianopa-msft) in #1426
• Fix CI workflows, compiler flags, and flaky tests by bmehta001 in #1415
• Remove dead headers by bmehta001 in #1427
• Make LLVM install optional in setup-buildtools by bmehta001 in #1433
• Restore documentation website build by bmehta001 in #1435
• Document skipSqliteInitAndShutdown for offline storage by bmehta001 in #1432
• Validate custom build props inputs before starting builds by bmehta001 in #1434
• Deploy documentation to GitHub Pages by bmehta001 in #1436
• [Docs] update community meeting status by Tom Tan (@ThomsonTan) in #1440
• Normalize vendored zlib to upstream 1.2.11 by bmehta001 in #1442
• Update vendored zlib to 1.3.2 by bmehta001 in #1443
• Remove stale MSBuild project entries by bmehta001 in #1444
• CodeQL SM02383: js/incomplete-sanitization by pablo-msft in #1455
• Remove ATL by pablo-msft in #1453
• nlohmann to 3.12.0 by pablo-msft in #1454
• ci: least-privilege permissions for all workflows + harden spellcheck install by bmehta001 in #1451
• Reduce C++ CodeQL build scope by bmehta001 in #1448
• Fix Windows desktop OS build version reporting by bmehta001 in #1441
• Use NWPathMonitor for Apple reachability by bmehta001 in #1431
• Stabilize iOS SQLite reservation timeout test by @Copilot in #1449
• sqlite: upgrade vendored snapshot 3.34.1 -> 3.53.1 (CVE fixes) by bmehta001 in #1457
• Added EVT_DROPPED reason codes via param2 by mogiligarimidi23 in #1452
• Fix cancelAllRequests drain race and spin by bmehta001 in #1460
• Remove stale MSBuild references by bmehta001 in #1463
• Extend iOS workflow timeout by bmehta001 in #1465
• Apply focused CMake build cleanup by bmehta001 in #1462
• Make Curl CA path ownership safe by bmehta001 in #1464
• Prepare for new release - 3.10.159.1 by bmehta001 in #1469

New Contributors

• bmehta001 made their first contribution in #1415
• pablo-msft made their first contribution in #1455
• mogiligarimidi23 made their first contribution in #1452

Full Changelog: v3.10.100.1...v3.10.159.1

v3.10.100.1

What's Changed

• Update room version to 2.8.4 by Alex Gavrishev (@anod) in #1394
• Fix JNI stale local ref in OfflineStorage_Room record iteration loops by Hansel Ip (@hanselip) in #1417
• fix(android): add PayloadDecoder.cpp to CMake build sources by Ieshaan Saxena (@ieshaan12) in #1421
• disable built-in SDK stats events by default to reduce OneCollector load by Tom Tan (@ThomsonTan) in #1422
• Enable configurable SSL certificate verification for libcurl HTTP client by Tom Tan (@ThomsonTan) in #1423
• Prepare for new release - 3.10.100.1 by Tom Tan (@ThomsonTan) in #1424

New Contributors

• Ieshaan Saxena (@ieshaan12) made their first contribution in #1421

Full Changelog: v3.10.40.1...v3.10.100.1

3.10.40.1

What's Changed

• Fix crash when HttpResponseDecoder receives non-JSON response by Hansel Ip (@hanselip) in #1405
• [Build] Add flag to build-win.ps1 that allows to build Release.static target by Luciano Almeida (@lucianopa-msft) in #1408
• Add BypassSitePathChecks config to all platform wrappers by nhpaine in #1411

New Contributors

• Hansel Ip (@hanselip) made their first contribution in #1405

Full Changelog: v3.10.23.1...v3.10.40.1

3.10.23.1

What's Changed

• Adding support for putting the warning string at index of problem by nhpaine in

Full Changelog: 3.10.20...v3.10.23.1

3.10.20.1

What's Changed

• Update CodeQL to v4 by Tom Tan (@ThomsonTan) in #1397
• Update modules by Alex Gavrishev (@anod) in #1401
• sync submodule by FrankM ODSP (@frank-msodsp) in #1402
• updating version 3.10.20 by FrankM ODSP (@frank-msodsp) in #1404

Full Changelog: v3.10.5.1...3.10.20

v3.10.5.1

What's Changed

• Wrap all ODWReachability in the iOS 12+ else block by Tommy Meisel (@thomasameisel) in #1398
• Prepare for new release - 3.10.5.1 by Lalit Kumar Bhasin (@lalitb) in #1399
• Add weak_ptr to NetworkInformation in SetupNetDetect by Tommy Meisel (@thomasameisel) in #1400

Full Changelog: v3.9.324.1...v3.10.5.1

v3.9.324.1

What's Changed

• update version, sync modules by FrankM ODSP (@frank-msodsp) in #1393

Full Changelog: v3.9.318.1...v3.9.324.1