Velocidex/velociraptor v0.77.3 on GitHub

This release is a bug fix release and addresses the CVEs published in the 0.77.3 release cycle.

Detailed change log below (AI generated).

Artifact changes

Added Azure.Monitor.Upload, which uploads server-side artifact results to an Azure Monitor Log Analytics workspace. Takes a table name, a Data Collection Rule id, and either a client secret or a managed identity. (#4974, 2026-09-04)
Server.Utils.BackupDirectory, Server.Utils.BackupGCS and Server.Utils.BackupS3 now emit only ClientId, FlowId and the fields derived from them, rather than all columns. Downstream consumers reading a column that is no longer emitted will need updating. (#4999, 2026-09-04)
Windows.Forensics.Prefetch reads VolumeSerialNumber at offset 16 rather than 12. (#5000, 2026-09-09)
Windows.Registry.EnableUnsafeClientMailRules reads the target user's NTUser path rather than the collector's OSPath. (#5016, 2026-09-17)

The registry accessor parses MULTI_SZ values correctly. (#4972, 2026-08-12)
Flow completion now waits for the final FlowStats write. (#4982, 2026-08-25)
ArtifactName is read from the cell environment rather than passed as a parameter. (#4990, 2026-08-25)
Pool clients report the correct hostname in compressed responses. (#5003, 2026-09-08)
Filestore StatFile() reports the uncompressed file size. (#5024, 2026-09-18)
The events view in the GUI no longer breaks on artifacts whose name contains a slash, such as Server.Monitor.Health/Prometheus. (#5001, 2026-09-15)
A user's notebook view now lists notebooks shared with them, in line with the global notebook view. (#5001, 2026-09-15)
enrollments_per_second: -1 disables enrollment instead of being ignored. (#5042, 2026-09-27)
Globs with unbalanced alternatives, such as /bin/{ls, now report an error. (#5044, 2026-09-27)
Internal
Replaced the gRPC connection pool with a direct connection to the frontend. (#5022, 2026-09-18)
Closed the gRPC channel from the returned closure. (#5014, 2026-09-14)
Moved the client info manager's lock into the record locking system. (#5015, 2026-09-15)
Serialised creation of the global eBPF manager. (#5031, 2026-09-20)
Refactored the event queues, and split flow storage deletion into its own manager. (#5035, 2026-09-24, #5037, 2026-09-25)
Added client event artifacts to the artifact verifier. (#5043, 2026-09-27)