From 06c192fc02599556aaa092727dfc011b1f9bead5 Mon Sep 17 00:00:00 2001
From: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com>
Date: Fri, 20 Feb 2026 13:26:16 -0600
Subject: [PATCH] Fix orbit panic when auto-updates disabled (#40202)

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #40200

QA done as part of https://github.com/fleetdm/fleet/pull/40142 PR

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [x] QA'd all new/changed functionality manually

## fleetd/orbit/Fleet Desktop

- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
---
 orbit/changes/40200-auto-update-panic |  1 +
 orbit/cmd/orbit/orbit.go              | 12 +++++++++---
 2 files changed, 10 insertions(+), 3 deletions(-)
 create mode 100644 orbit/changes/40200-auto-update-panic

diff --git a/orbit/changes/40200-auto-update-panic b/orbit/changes/40200-auto-update-panic
new file mode 100644
index 0000000000..a93e5ed488
--- /dev/null
+++ b/orbit/changes/40200-auto-update-panic
@@ -0,0 +1 @@
+* Fix orbit panic when auto-updates disabled
diff --git a/orbit/cmd/orbit/orbit.go b/orbit/cmd/orbit/orbit.go
index e075c8f024..a0902c6648 100644
--- a/orbit/cmd/orbit/orbit.go
+++ b/orbit/cmd/orbit/orbit.go
@@ -604,6 +604,7 @@ func main() {
 		// it fetches osqueryd once as part of initialization.
 		var updater *update.Updater
 		var updateRunner *update.Runner
+		var osqueryVersion string
 		if !c.Bool("disable-updates") || c.Bool("dev-mode") {
 			updater, err := update.NewUpdater(opt)
 			if err != nil {
@@ -645,6 +646,7 @@ func main() {
 				if err == nil && version != "" {
 					log.Info().Msgf("Found osquery version: %s", version)
 					updateRunner.OsqueryVersion = version
+					osqueryVersion = version
 				}
 			}
 
@@ -694,6 +696,10 @@ func main() {
 			if err != nil {
 				log.Fatal().Err(err).Msgf("locate %s", constant.OsqueryTUFTargetName)
 			}
+			if v, err := update.GetVersion(osquerydPath); err == nil && v != "" {
+				log.Info().Msgf("Found osquery version: %s", v)
+				osqueryVersion = v
+			}
 			if c.Bool("fleet-desktop") {
 				if runtime.GOOS == "darwin" {
 					desktopPath, err = updater.DirLocalPath(constant.DesktopTUFTargetName)
@@ -924,7 +930,7 @@ func main() {
 			}
 
 			options = append(options,
-				osquery.WithFlags(osquery.FleetFlags(updateRunner.OsqueryVersion, parsedURL)),
+				osquery.WithFlags(osquery.FleetFlags(osqueryVersion, parsedURL)),
 				osquery.WithFlags([]string{"--tls_server_certs", certPath}),
 			)
 		} else if fleetURL != "https://" {
@@ -938,7 +944,7 @@ func main() {
 			}
 
 			options = append(options,
-				osquery.WithFlags(osquery.FleetFlags(updateRunner.OsqueryVersion, parsedURL)),
+				osquery.WithFlags(osquery.FleetFlags(osqueryVersion, parsedURL)),
 			)
 
 			if certPath = c.String("fleet-certificate"); certPath != "" {
@@ -1090,7 +1096,7 @@ func main() {
 			hostIdentityCertificatePath = hostIdentityCredentials.CertificatePath
 
 			options = append(options,
-				osquery.WithFlags(osquery.FleetFlags(updateRunner.OsqueryVersion, proxy.ParsedURL)),
+				osquery.WithFlags(osquery.FleetFlags(osqueryVersion, proxy.ParsedURL)),
 
 				// This is overriding the previous set of --tls_server_certs in osquery.FleetFlags above.
 				osquery.WithFlags([]string{"--tls_server_certs", proxy.CertificatePath}),