Note: this release changes the output schema of some parsers:
x509-cert/x509-csr/x509-crl, proc-net-packet, proc-pid-fdinfo, ssh-conf, iw-scan, ping-s, proc-pid-numa-maps, plist, and ifconfig. Please see the parsers' documentation for the updated schemas.
Note: the Windows .msi and .zip now include the python 3.14 runtime. The
executable file is now significantly smaller.
- Enhance many parsers to avoid slow parsing of long or unusual field values,
includingcef,syslog,who,iptables,nftables,mount,ss,
ping,traceroute,ifconfig, and the/procfile parsers - Enhance table parsers to use less time and memory on wide or ragged tables
- Enhance
yaml,plist, andxmlparsers to stop with an error when shared
references or DTD attribute defaults would make the output extremely large - Fix many parsers to split lines only on LF and CRLF line endings so other
line-break characters inside a field no longer split a record. This also
applies to--slurpand line slicing - Fix several parsers to split fields only on spaces and tabs, and enhance the
netrcparser to support quoted values, escapes, comments, and theuser
keyword - Fix several parsers where text inside a value could be mistaken for a new
record, section, or field (e.g.rpm-qi,pacman,cbt,http-headers) - Fix
dig,host,rpm-qi, andiftopparsers where data from one record
could carry into later records - Fix "magic" syntax and
/procfile input to pass line endings to the parser
unchanged, matchingSTDINinput - Fix streaming parsers to read
STDINas UTF-8 lines split on LF and CRLF on
all platforms. Invalid UTF-8 bytes are now shown as escapes instead of
stopping the parser, even with-qq - Fix several streaming parsers to handle CRLF line endings and blank input
when used as a python library. Library usage examples now usesplit('\n') - Fix
procparser to report an error instead of empty output for input that
is not a recognized/procfile - Fix many parsers where a header-like, keyword-like or separator-like value
changed how later lines were read (e.g.arp,host,iptables,
iwconfig,blkid,crontab,http-headers,netstat,asciitable) - Fix many parsers to keep field values exactly as printed: file names with
spaces or " -> " (ls,stat,dir), quoted or escaped values (cef,
syslog,clf,findmnt,mount,nftables), git C-quoted paths, ping
replies,ssunix sockets, andiftopport-less flows - Fix
sparse_table_parsebased parsers (df,lsblk, ...) to align columns
by display width and keep cell text intact - Fix
procparser to identify/proc/net/packeton 64-bit kernels and
/proc/net/protocolson current kernels - Fix
iostat,mpstat,pidstatand their streaming parsers to reject rows
that do not fit the header - Fix CLI to escape C1 control characters in JSON output and control
characters in warning and error messages - Fix
-Mto replace a_jc_metafield found in the parsed data - Enhance several parsers to avoid repeated scans of long input (e.g.
dmidecode,ics,crontab,cef,apachectl,netstat,asciitable) proc-net-packetnow returns a list of all rows (previously only the first
row, as an object)- Fix
x509-crlparser to convert every CRL in PEM files with more than one
CRL. The output is now a list of CRL objects (likex509-cert), even for
one CRL. This is a schema change - Fix
ssh-confparser soremoteforwardanddynamicforwardare arrays
of strings (schema change), and addrekeylimit_bytes,
rekeylimit_secondsandcontrolpersist_seconds - Fix
proc-pid-fdinfoparser to convert octalflags/settime flagsand
hex inotifywd, and to output every lock, epoll target, inotify watch and
fanotify mark. This is a breaking schema change:flagsvalues change,
lock,epollandinotifyare now lists, and fanotify marks are in a
fanotify.markslist - Fix
proc-pid-numa-mapsparser soaddressis always a string (all-digit
addresses such as00400000were converted to integers) - Add
proc-net-udpparser for/proc/net/udpand/proc/net/udp6 - Add GeneralName type keys (
*_general_names,*_type) to thex509-cert,
x509-csrandx509-crlparsers so DNS, email, URI, IP and other names can
be told apart - Fix
ifconfigparser to read BSD and macOSflagsandnd6_optionsas
hexadecimal, asifconfigprints them (e.g.flags=8843is now34883).
Linuxflagsvalues are unchanged - Fix many parsers to split lines only on LF and CRLF (all line-oriented
parsers exceptping) - Fix
iw-scanparser so a header line from one BSS no longer prefixes the
keys of the following BSS records. Keys likeconfig_methods_freqand
bss_load_signalare nowfreqandsignal_dbm - Fix
ping-sparser to use the integerresponse_bytesfield for BSD IPv6
replies and BSD error records (previously a stringbytesfield, or
sent_bytesfor IPv6 errors) - Fix
pingandping-sparsers to read the FreeBSD 13+ping -6header - Fix
ssparser so the detail lines printed by-e,-iand-mno
longer create extra records - Fix
host,df,rpm-qi,pkg-index-deb,apt-cache-showand
proc-pid-mountinfoedge cases (two SOA lines, whitespace-only rows,
repeated normalized field names,unbindableoptional field)