v3.10.159.1

Highlights

⚠️ Behavior change — Windows OS build version (#1441)

On Windows desktop, DeviceInfo.OsBuild / ext.os.ver is now always a numeric major.minor.build[.ubr] value (e.g. 10.0.26100.4061), sourced from RtlGetVersion() plus the registry UBR. Previously it could be a BuildLabEx-style string (e.g. 26100.1.amd64fre.ge_release.240331-1435).
Action required: dashboards / Kusto queries that parsed the old BuildLabEx form (splitting on ., extracting branch/flavor/date) must be updated. Queries already expecting the four-part numeric form now receive correct, servicing-aware values. (Fixes #1407.)

🔐 Security — vendored dependency updates

• SQLite 3.34.1 → 3.53.1 (#1457) clears a series of public CVEs: CVE-2022-35737, CVE-2023-7104, CVE-2024-0232, CVE-2025-6965, CVE-2025-70873, CVE-2025-7709. Affects builds using the vendored SQLite (e.g. Windows); Android (Room) and consumers using platform/vcpkg SQLite are unaffected.
• Vendored zlib → 1.3.2 (#1443).

⚙️ ABI / source compatibility (#1452)

IOfflineStorage gains a new non-pure virtual GetRemainingRecordCountForShutdown() (default returns GetRecordCount()). Third-party storage implementations remain source-compatible but must be recompiled against this SDK version because the vtable grows.

🆕 New — EVT_DROPPED reason codes (#1452)

EVT_DROPPED dispatches now carry a drop-reason code in DebugEvent.param2, and two values were appended to EventDroppedReason (DROPPED_REASON_TEARDOWN_TIMEOUT, DROPPED_REASON_LATENCY_DISABLED_BY_PROFILE). Purely additive — param2 is 0 for callers that have not been updated.

🍎 Apple — reachability via NWPathMonitor (#1431)

Apple network detection now uses NWPathMonitor, fixing the iOS 18 reachability crash (#1370). The internal ODWReachability helper and the vendored Tony Million Reachability snapshot were removed. On runtimes older than iOS 12 / macOS 10.14, network type/cost is reported as Unknown. build-ios.sh now defaults to iOS 12.0.

🔧 Other notable changes

• libcurl HTTP client now uses poll() instead of select() (#1426), removing the 1024 file-descriptor hard limit in high-FD processes.
• Removed the forced ATL dependency on Windows (#1453).

---

What's Changed

• [HttpClient][Curl] Use poll api to avoid select 1024 FD hard limit by @lucianopa-msft in #1426
• Fix CI workflows, compiler flags, and flaky tests by @bmehta001 in #1415
• Remove dead headers by @bmehta001 in #1427
• Make LLVM install optional in setup-buildtools by @bmehta001 in #1433
• Restore documentation website build by @bmehta001 in #1435
• Document skipSqliteInitAndShutdown for offline storage by @bmehta001 in #1432
• Validate custom build props inputs before starting builds by @bmehta001 in #1434
• Deploy documentation to GitHub Pages by @bmehta001 in #1436
• [Docs] update community meeting status by @ThomsonTan in #1440
• Normalize vendored zlib to upstream 1.2.11 by @bmehta001 in #1442
• Update vendored zlib to 1.3.2 by @bmehta001 in #1443
• Remove stale MSBuild project entries by @bmehta001 in #1444
• CodeQL SM02383: js/incomplete-sanitization by @pablo-msft in #1455
• Remove ATL by @pablo-msft in #1453
• nlohmann to 3.12.0 by @pablo-msft in #1454
• ci: least-privilege permissions for all workflows + harden spellcheck install by @bmehta001 in #1451
• Reduce C++ CodeQL build scope by @bmehta001 in #1448
• Fix Windows desktop OS build version reporting by @bmehta001 in #1441
• Use NWPathMonitor for Apple reachability by @bmehta001 in #1431
• Stabilize iOS SQLite reservation timeout test by @Copilot in #1449
• sqlite: upgrade vendored snapshot 3.34.1 -> 3.53.1 (CVE fixes) by @bmehta001 in #1457
• Added EVT_DROPPED reason codes via param2 by @mogiligarimidi23 in #1452
• Fix cancelAllRequests drain race and spin by @bmehta001 in #1460
• Remove stale MSBuild references by @bmehta001 in #1463
• Extend iOS workflow timeout by @bmehta001 in #1465
• Apply focused CMake build cleanup by @bmehta001 in #1462
• Make Curl CA path ownership safe by @bmehta001 in #1464
• Prepare for new release - 3.10.159.1 by @bmehta001 in #1469

New Contributors

• @bmehta001 made their first contribution in #1415
• @pablo-msft made their first contribution in #1455
• @mogiligarimidi23 made their first contribution in #1452

Full Changelog: v3.10.100.1...v3.10.159.1

v3.10.100.1

What's Changed

• Update room version to 2.8.4 by @anod in #1394
• Fix JNI stale local ref in OfflineStorage_Room record iteration loops by @hanselip in #1417
• fix(android): add PayloadDecoder.cpp to CMake build sources by @ieshaan12 in #1421
• disable built-in SDK stats events by default to reduce OneCollector load by @ThomsonTan in #1422
• Enable configurable SSL certificate verification for libcurl HTTP client by @ThomsonTan in #1423
• Prepare for new release - 3.10.100.1 by @ThomsonTan in #1424

New Contributors

• @ieshaan12 made their first contribution in #1421

Full Changelog: v3.10.40.1...v3.10.100.1

3.10.40.1

What's Changed

• Fix crash when HttpResponseDecoder receives non-JSON response by @hanselip in #1405
• [Build] Add flag to build-win.ps1 that allows to build Release.static target by @lucianopa-msft in #1408
• Add BypassSitePathChecks config to all platform wrappers by @nhpaine in #1411

New Contributors

• @hanselip made their first contribution in #1405

Full Changelog: v3.10.23.1...v3.10.40.1

3.10.23.1

What's Changed

• Adding support for putting the warning string at index of problem by @nhpaine in

Full Changelog: 3.10.20...v3.10.23.1

3.10.20.1

What's Changed

• Update CodeQL to v4 by @ThomsonTan in #1397
• Update modules by @anod in #1401
• sync submodule by @frank-msodsp in #1402
• updating version 3.10.20 by @frank-msodsp in #1404

Full Changelog: v3.10.5.1...3.10.20

v3.10.5.1

What's Changed

• Wrap all ODWReachability in the iOS 12+ else block by @thomasameisel in #1398
• Prepare for new release - 3.10.5.1 by @lalitb in #1399
• Add weak_ptr to NetworkInformation in SetupNetDetect by @thomasameisel in #1400

Full Changelog: v3.9.324.1...v3.10.5.1

v3.9.324.1

What's Changed

• update version, sync modules by @frank-msodsp in #1393

Full Changelog: v3.9.318.1...v3.9.324.1

v3.9.318.1

What's Changed

• Adding sanitizer allow lists by @nhpaine in #1386

New Contributors

• @nhpaine made their first contribution in #1386

Full Changelog: v3.9.309.1...v3.9.318.1

v3.9.309.1

What's Changed

• update version sync modules by @frank-msodsp in #1388
• Frank/update3.9.309 by @frank-msodsp in #1389

Full Changelog: v3.9.267.1...v3.9.309.1

v3.9.267.1

What's Changed

• Remove extra semicolons (#1331) by @ninadpahunems in #1345
• Increase test time for event upload by @ThomsonTan in #1343
• fix sanitizer android by @frank-msodsp in #1374
• updating version by @frank-msodsp in #1375
• fix extra semi by @frank-msodsp in #1376
• added additional config properties by @frank-msodsp in #1377
• Delete unreachable code in CMakeLists.txt by @ThomsonTan in #1328
• add san to log manager by @frank-msodsp in #1379
• Including payload decoder into CMakeList.txt for the library by @lucianopa-msft in #1382
• update version for mobile by @frank-msodsp in #1383
• reattach lib/modules to master by @frank-msodsp in #1384

New Contributors

• @ninadpahunems made their first contribution in #1345
• @lucianopa-msft made their first contribution in #1382

Full Changelog: v3.9.212.1...v3.9.267.1