From 34be38ad5495a3c8dcbaed9865e35e71954f2dc5 Mon Sep 17 00:00:00 2001
From: suvenka <suvenka+odspmdb@microsoft.com>
Date: Mon, 9 Mar 2026 14:04:00 -0700
Subject: [PATCH 1/2] Update NuGet package version to 4.4.7

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 Microsoft.O365.Security.Native.ETW/AssemblyInfo.cpp | 2 +-
 O365.Security.Native.ETW.Debug.nuspec               | 2 +-
 O365.Security.Native.ETW.nuspec                     | 2 +-
 krabsetw.nuspec                                     | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Microsoft.O365.Security.Native.ETW/AssemblyInfo.cpp b/Microsoft.O365.Security.Native.ETW/AssemblyInfo.cpp
index 3eaa987..72520c5 100644
--- a/Microsoft.O365.Security.Native.ETW/AssemblyInfo.cpp
+++ b/Microsoft.O365.Security.Native.ETW/AssemblyInfo.cpp
@@ -32,7 +32,7 @@ using namespace System::Security::Permissions;
 // You can specify all the value or you can default the Revision and Build Numbers
 // by using the '*' as shown below:
 
-[assembly:AssemblyVersionAttribute("4.4.6.0")];
+[assembly:AssemblyVersionAttribute("4.4.7.0")];
 
 [assembly:ComVisible(false)];
 
diff --git a/O365.Security.Native.ETW.Debug.nuspec b/O365.Security.Native.ETW.Debug.nuspec
index c9a558a..a3e91ac 100644
--- a/O365.Security.Native.ETW.Debug.nuspec
+++ b/O365.Security.Native.ETW.Debug.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2011/08/nuspec.xsd">
     <metadata>
         <id>Microsoft.O365.Security.Native.ETW.Debug</id>
-        <version>4.4.6</version>
+        <version>4.4.7</version>
         <title>Microsoft.O365.Security.Native.ETW Debug - managed wrappers for krabsetw</title>
         <authors>Microsoft</authors>
         <owners>Microsoft</owners>
diff --git a/O365.Security.Native.ETW.nuspec b/O365.Security.Native.ETW.nuspec
index a4cbdd2..d121273 100644
--- a/O365.Security.Native.ETW.nuspec
+++ b/O365.Security.Native.ETW.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2011/08/nuspec.xsd">
     <metadata>
         <id>Microsoft.O365.Security.Native.ETW</id>
-        <version>4.4.6</version>
+        <version>4.4.7</version>
         <title>Microsoft.O365.Security.Native.ETW - managed wrappers for krabsetw</title>
         <authors>Microsoft</authors>
         <owners>Microsoft</owners>
diff --git a/krabsetw.nuspec b/krabsetw.nuspec
index 35462a3..5ba55f0 100644
--- a/krabsetw.nuspec
+++ b/krabsetw.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2011/08/nuspec.xsd">
     <metadata>
         <id>Microsoft.O365.Security.Krabsetw</id>
-        <version>4.4.6</version>
+        <version>4.4.7</version>
         <title>Krabs ETW Wrappers</title>
         <authors>Microsoft</authors>
         <owners>Microsoft</owners>

From 78e6e9d39bfc735eeb3f441fbc926148097b7282 Mon Sep 17 00:00:00 2001
From: suvenka <suvenka+odspmdb@microsoft.com>
Date: Mon, 9 Mar 2026 14:13:28 -0700
Subject: [PATCH 2/2] Update release notes for version 4.4.7

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 O365.Security.Native.ETW.Debug.nuspec | 5 ++---
 O365.Security.Native.ETW.nuspec       | 5 ++---
 krabsetw.nuspec                       | 5 ++---
 3 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/O365.Security.Native.ETW.Debug.nuspec b/O365.Security.Native.ETW.Debug.nuspec
index a3e91ac..c8c67de 100644
--- a/O365.Security.Native.ETW.Debug.nuspec
+++ b/O365.Security.Native.ETW.Debug.nuspec
@@ -12,9 +12,8 @@
         <description>Microsoft.O365.Security.Native.ETW Debug is a managed wrapper around the krabsetw ETW library. This is the Debug build.</description>
         <summary>Microsoft.O365.Security.Native.ETW Debug is a managed wrapper around the krabsetw ETW library. This is the Debug build.</summary>
         <releaseNotes>
-            Version 4.4.6:
-              - Add constructor for schema from EVENT_RECORD and PTRACE_EVENT_INFO
-              - Update for .NET Core 8
+            Version 4.4.7:
+              - Add process_start_key() to read ProcessStartKey from extended data
         </releaseNotes>
         <copyright>© Microsoft Corporation. All rights reserved.</copyright>
         <language />
diff --git a/O365.Security.Native.ETW.nuspec b/O365.Security.Native.ETW.nuspec
index d121273..52abb38 100644
--- a/O365.Security.Native.ETW.nuspec
+++ b/O365.Security.Native.ETW.nuspec
@@ -12,9 +12,8 @@
         <description>Microsoft.O365.Security.Native.ETW is a managed wrapper around the krabsetw ETW library.</description>
         <summary>Microsoft.O365.Security.Native.ETW is a managed wrapper around the krabsetw ETW library.</summary>
         <releaseNotes>
-            Version 4.4.6:
-              - Add constructor for schema from EVENT_RECORD and PTRACE_EVENT_INFO
-              - Update for .NET Core 8
+            Version 4.4.7:
+              - Add process_start_key() to read ProcessStartKey from extended data
         </releaseNotes>
         <copyright>© Microsoft Corporation. All rights reserved.</copyright>
         <language />
diff --git a/krabsetw.nuspec b/krabsetw.nuspec
index 5ba55f0..086f45c 100644
--- a/krabsetw.nuspec
+++ b/krabsetw.nuspec
@@ -12,9 +12,8 @@
         <description>Krabs ETW provides a modern C++ wrapper around the low-level ETW trace consumption functions</description>
         <summary>Krabs ETW provides a modern C++ wrapper around the low-level ETW trace consumption functions</summary>
         <releaseNotes>
-            Version 4.4.6:
-              - Add constructor for schema from EVENT_RECORD and PTRACE_EVENT_INFO
-              - Update for .NET Core 8
+            Version 4.4.7:
+              - Add process_start_key() to read ProcessStartKey from extended data
         </releaseNotes>
         <copyright>© Microsoft Corporation. All rights reserved.</copyright>
         <language />