Merge pull request #39313 from wazuh/fix/39170-macos-logged-in-users-…

…filter-dead-process

Filter DEAD_PROCESS utmpx entries out of macOS logged-in users provider

Merge pull request #38254 from wazuh/fix/38194-aws-it-concurrent-runs…

…-4.14.8

AWS integration tests: isolate concurrent runs on the shared bucket with a per-run S3 namespace (GITHUB_RUN_ID) [4.14.8]

Merge pull request #38460 from wazuh/enhancement/38139-sccache-and-gh…

…-runners-4148

Move the 4.14.8 server workflows to GitHub-hosted runners and add sccache compilation caching

fix: point DEPS_VERSION at the bundle carrying the OpenSSL curl

Building curl with --with-openssl only changes the product if the agent build
actually compiles curl, and it does not: `make deps` pulls a precompiled
archive and the CMake short-circuits on it, which is the path
5_builderpackage_agent-windows.yml uses. Against 99-37702 the winagent kept
getting the Schannel curl built on 2026-05-19, so the flag was inert
everywhere except a local EXTERNAL_SRC_ONLY=yes build.

99-38163 is the first bundle built from this branch, so its windows curl
reports USE_OPENSSL. Verified by the default path -- no EXTERNAL_SRC_ONLY,
curl not recompiled:

  external/curl/lib/curl_config.h
    #define USE_OPENSSL 1
    /* #undef USE_SCHANNEL */

and the agent built from it reaches a TLS 1.3-only manager from Windows 10,
where the github and office365 modules still validate against the machine's
certificate stores.

fix: keep trusting the Windows certificate store

Now that the Windows agent's curl is OpenSSL-backed it has no CA bundle at
all - configure reports "ca cert bundle: no" - so every HTTPS request would
fail verification. Schannel used to read the machine's ROOT and CA stores on
its own; CURLSSLOPT_NATIVE_CA asks OpenSSL for the same ones through the
Win32 crypto API.

Applied where the agent speaks HTTPS on Windows: the https_client transport,
and wurl_http_request, which is what agentd's uninstall check and the
github, office365 and ms-graph modules go through.

An explicitly configured <ca> still stands alone - the machine's stores are
not added on top of it, or the trust set would silently widen. Looking the
bundle up is also now skipped for plain HTTP, where it was never used.