Adding changes for Fleet v4.82.0 (#40233) (#41637)

2026-03-13 09:42:29 -05:00
parent 48b023961d
commit be1df61ffb
96 changed files with 112 additions and 99 deletions
@@ -1,3 +1,109 @@
+## Fleet 4.82.0 (Mar 11, 2026)
+
+### IT Admins
+- Added support for enrolling fully managed Android hosts without a work profile.
+- Added capability to uninstall Android apps on the device (and removal from self-service in the managed Google Play store) when an app is removed from Fleet.
+- Added ability to allow or disallow end-users to bypass conditional access on a per-policy basis.
+- Added filtering by platform and add status to the Software > Add Fleet-maintained apps table.
+- Updated Android status reports to re-verify profiles that previously failed.
+- Added ability to roll back to previously added versions of Fleet-maintained apps.
+- Added new Technician role designed for help desk and IT support teams. Technicians can run scripts, view results, and install or uninstall software.
+- Added support for JIT provisioning of the Technician role via SSO SAML attributes.
+- Added automatic retries for failed software operations.
+
+### Security Engineers
+- Added ability to scan for kernel vulnerabilities on RHEL based hosts.
+- Added AWS GovCloud RDS CA certificates to the RDS MySQL TLS bundle, enabling IAM authentication for Fleet deployments connecting to RDS in AWS GovCloud regions (us-gov-east-1, us-gov-west-1).
+- Added CVE alias for python visual studio code extension.
+- Added new activity for edited enroll secrets.
+
+### Other improvements and bug fixes
+- Renamed teams and queries to fleets and reports in the UI, API, CLI, and GitOps.
+- Deprecated no-team.yml in GitOps in favor of unassigned.yml.
+- Deprecated certain API field names to reflect the renaming of "teams" to "fleets" and "queries" to "reports".
+- Updated Android MDM profiles to show up as pending on upload, the same as Apple MDM profiles.
+- Improved the speed of a database query that runs every minute to avoid database locking.
+- Added configurable body size limits for the `/api/osquery/log` and `/api/osquery/distributed/write` endpoints.
+- Updated logic to trigger vulnerability webhook when on Fleet free tier.
+- Updated storage of the auth token used in the UI.
+- Dynamically alphabetized vitals on the host details page.
+- Reworked how we handle server/worker delays to fix flaky tests.
+- Disabled "Calendar" dropdown option in Policy > Manage automations for Unassigned.
+- Added Go slog logging infrastructure and migrated a portion of the code from go-kit/log to slog.
+- Added CTA to turn on Android MDM for Android software setup experience if MDM is not configured.
+- Left-aligned "Critical" checkbox in Save policy form.
+- Improved spacing on the Controls > OS Settings page.
+- Updated to not allow editing Fleet-maintained app in the UI while GitOps mode is enabled.
+- Updated to accept the previous device authentication token for up to one rotation cycle, so the My Device page URL remains valid after token refresh.
+- Updated default macOS, iOS, and iPadOS update deadline time to 7PM (19:00) local time.
+- Updated UI to enable adding/removing multiple Microsoft Entra tenant ids.
+- Added additional logging for SCEP proxy requests and SCEP profile renewals.
+- Added warning message on gitops label rename to clarify to users that renaming a label implies a delete operation.
+- Added the ability to specify allowed Entra tenant IDs for enrollments.
+- Updated the DEP syncer to properly reassign a profile when ABM unilaterally removes it.
+- Increased the maximum script execution timeout from 1 hour (3600 seconds) to 5 hours (18000 seconds).
+- Improved error handling on AWS DB failover. Fleet will now fail health check if the primary DB is read-only, or trigger graceful shutdown when write operations encounter read-only errors.
+- Generated a server-side device token in the Okta conditional access flow when none exists or the current token is expired.
+- Moved the copy button for text areas out of the text area itself and in line with its label.
+- Removed unnecessary calls to `svc.ds.BulkSetPendingMDMHostProfiles` in `POST /api/latest/fleet/spec/fleets`.
+- Internal refactoring: moved `/api/_version_/fleet/hosts/{id:[0-9]+}/activities` endpoint and `MarkActivitiesAsStreamed` to new server/activity bounded context.
+- Added `logging.otel_logs_enabled` contributor config option to export server logs to OpenTelemetry.
+- Added automatic tagging of prerelease/post-release versions on local build based on branch name.
+- Added ability to enable/disable logs by topic.
+- Improved detection of `DISPLAY` variable in X11 sessions.
+- Updated the "Used by" column heading on the hosts page to "User email".
+- Refactored query used for deleting host_mdm_apple_profiles in bulk to use Primary keys only.
+- Added `team_id` to host details page param in URL to allow retaining team on refresh.
+- Added help text on the software details page, below the installer status table, to explain the meanings of the counts.
+- Added Country:US to new CA certs created by Fleet.
+- Added error if GitOps/batch attempts to add setup experience software when manual agent install is enabled.
+- Updated "Manage automations" button on the Queries and Policies pages to now always be visible, and disabled only when the current team has no queries of its own.
+- Updated validation rules around the creation of labels to make sure only valid platforms are used.
+- Improved host software inventory table's handling of long "Type" values.
+- Updated expiration date of the auth token cookie to match the fleet session duration.
+- Surfaced FMA version used and whether it's out of date in the UI.
+- Updated nats-server dependency to resolve dependency vulnerabilities.
+- Improved validation for host transfers.
+- Fixed matching logic on App component for pages titles.
+- Fixed adding Windows Fleet maintained apps failing when a software title with the same upgrade code already exists.
+- Fixed an issue where GitOps would not respect the value set on `update_new_hosts` for macOS updates.
+- Fixed an issue where duplicate kernels were reported in the OS versions API for RHEL-family distributions (RHEL, AlmaLinux, CentOS, Rocky, Fedora).
+- Fixed issue where Windows Jetbrains products would not report the correct version number.
+- Fixed a bug where custom software installer display names and icons were not used in the setup experience UI.
+- Fixed a bug where the list activities API endpoint would fail with a database error when there were more than 65,535 activities and no pagination parameters were specified. The maximum `per_page` for activities endpoints is now 10,000.
+- Fixed issue where MySQL IAM authentication could fail when a custom TLS CA/TLS config was set (for example GovCloud), by ensuring Fleet includes the configured TLS mode in IAM DSNs.
+- Fixed styling issues for the UI when no enroll secret is present on a fleet.
+- Fixed an issue where some UI users saw a blank gutter on the right side of parts of the UI.
+- Fixed a bug where certain macOS app names could be ingested as empty strings due to incorrect ".app" suffix removal.
+- Fixed install/uninstall tarballs package to skip recently updated status that is waiting for a change in software inventory
+- Fixed a bug where software installers could create titles with the wrong platform.
+- Fixed a bug where 2 vulnerability jobs can run in parallel if one is taking longer than 2 hours.
+- Fixed issue with hosts incorrectly reporting policy failures after policy label targets changed.
+- Fixed client-side errors being incorrectly reported as server errors in OTEL telemetry.
+- Fixed issue where the status name was wrapping at smaller viewport widths on the mdm card on the Dashboard page.
+- Fixed false negative CVE-2026-20841 on Windows Notepad.
+- Fixed false positive CVE for Nextcloud Desktop.
+- Fixed rare CPE error when software name sanitizes to empty (e.g. only special characters).
+- Fixed Android enrollment to associate hosts with SCIM users, populating full name, groups, and department in host vitals.
+- Fixed a hover style issue in the label filter close button.
+- Fixed mismatches between disk encryption summary counts vs hosts displayed.
+- Fixed truncation of certificate fields containing non-ASCII characters.
+- Fixed an issue where policy automation settings in the Other Workflows modal reverted to stale values after saving when using a MySQL read replica.
+- Fixed query results cleanup cron failing with "too many placeholders" error by filtering to only saved queries and batching the SQL IN clause.
+- Fixed DB lock contention during vulnerability cron's software cleanup that caused failures under load.
+- Fixed pagination on the host software page incorrectly disabling the "Next" button when a software title has multiple installer versions.
+- Fixed a bug where macOS systems previous enrolled in fleet wouldn't always go through setup experience after a wipe
+- Fixed stale software titles list after adding a VPP or fleet-maintained app by invalidating the query cache on success.
+- Fixed issue where Windows Jetbrains products would not report the correct version number.
+- Fixed false positive `PayloadTooLargeError` errors.
+- Fixed software appearance edits not reflected until page refresh.
+- Fixed issue where policy automation retries were potentially reading stale data from replica database.
+- Fixed label edits not reflected until page refresh.
+- Fixed report creation API returning zero timestamps for `created_at` and `updated_at` fields.
+- Fixed issue where arbitrary order_key values could be used to extract data.
+- Fixed stale software titles list after deleting a software installer.
+- Fixed query results cleanup cron failing with "too many placeholders" error by filtering to only saved queries and batching the SQL IN clause.
+
 ## Fleet 4.81.2 (Mar 06, 2026)

 ### Bug fixes
@@ -1 +0,0 @@
- Fixed information disclosure vulnerability where arbitrary order_key values could be used to extract sensitive data via sort-order correlation attacks.
@@ -1 +0,0 @@
- Improved validation for host transfers.
@@ -1 +0,0 @@
- The "Manage automations" button on the Queries and Policies pages is now always visible, and disabled only when the current team has no queries of its own.
@@ -1 +0,0 @@
- Fixed issue where Windows Jetbrains products would not report the correct version number.
@@ -1 +0,0 @@
-* Updated logic to trigger vulnerability webhook when on fleet free tier
@@ -1 +0,0 @@
-* Addded CVE alias for python visual studio code extension
@@ -1 +0,0 @@
- Disabled "Calendar" dropdown option in Policy > Manage automations for No team.
@@ -1 +0,0 @@
- Added ability to roll back to previously added versions of Fleet-maintained apps.
@@ -1 +0,0 @@
- Fleet UI: Surface FMA version used and whether it's out of date
@@ -1 +0,0 @@
- Fleet UI: Host details page includes team_id param in URL to allow retaining team on refresh
@@ -1 +0,0 @@
- added ability to scan for kernel vulnerabilities on RHEL based hosts
@@ -1 +0,0 @@
- Fixed an issue where some UI users saw a blank gutter on the right side of parts of the UI
@@ -1 +0,0 @@
- Improved spacing on the Controls > OS Settings page
@@ -1 +0,0 @@
-Fixed a bug where certain macOS app names could be ingested as empty strings due to incorrect ".app" suffix removal.
@@ -1 +0,0 @@
- Improved host software inventory table's handling of long "Type" values.
@@ -1 +0,0 @@
- Improved the speed of a database query that runs every minute, to avoid database locking
@@ -1 +0,0 @@
-Fixed a bug where 2 vulnerability jobs can run in parallel if one is taking longer than 2 hours.
@@ -1 +0,0 @@
- Moved the copy button for text areas out of the text area itself and in line with its label
@@ -1 +0,0 @@
-Updated Android MDM profiles to show up as pending on upload, the same as Apple MDM profiles.
@@ -1 +0,0 @@
-* Changed Android status reports to re-verify profiles that previously failed.
@@ -1 +0,0 @@
-Fixed a bug where the list activities API endpoint would fail with a database error when there were more than 65,535 activities and no pagination parameters were specified. The maximum `per_page` for activities endpoints is now 10,000.
@@ -1 +0,0 @@
- Added additional logging for SCEP proxy requests and SCEP profile renewals.
@@ -1 +0,0 @@
-* Added new activity for edited enroll secrets.
@@ -1 +0,0 @@
- Fixed issue with hosts incorrectly reporting policy failures after policy label targets changed.
@@ -1 +0,0 @@
-Added help text on the software details page, below the installer status table, to explain the meanings of the counts.
@@ -1 +0,0 @@
-* Fixed truncation of certificate fields containing non-ASCII characters.
@@ -1 +0,0 @@
-* Fleet UI: Add filtering by platform and add status to the Software > Add Fleet-maintained apps table
@@ -1 +0,0 @@
- Fixed a bug where custom software installer display names and icons were not used in the setup experience UI.
@@ -1,2 +0,0 @@
- Accept the previous device authentication token for up to one rotation cycle, so the My Device page URL remains valid after token refresh.
- Generate a server-side device token in the Okta conditional access flow when none exists or the current token is expired.
@@ -1 +0,0 @@
- Fleet UI: Show CTA to turn on Android MDM for Android software setup experience if MDM is not configured
@@ -1 +0,0 @@
-Internal refactoring: moved `/api/_version_/fleet/hosts/{id:[0-9]+}/activities` endpoint and `MarkActivitiesAsStreamed` to new server/activity bounded context.
@@ -1 +0,0 @@
- Fixed mismatches between disk encryption summary counts vs hosts displayed.
@@ -1 +0,0 @@
- Fixed Android enrollment to associate hosts with SCIM users, populating full name, groups, and department in host vitals.
@@ -1 +0,0 @@
-Added `logging.otel_logs_enabled` contributor config option to export server logs to OpenTelemetry.
@@ -1 +0,0 @@
-* Added new Technician role.
@@ -1 +0,0 @@
- Added Country:US to new CA certs created by Fleet.
@@ -1 +0,0 @@
- Implemented uninstall of Android apps on the device (and removal from self-service in the managed Google Play store) when an app is removed from Fleet.
@@ -1 +0,0 @@
- Updated default macOS, iOS, and iPadOS update deadline time to 7PM (19:00) local time.
@@ -1 +0,0 @@
-* Added support for enrolling fully managed Android hosts without a work profile
@@ -1 +0,0 @@
-Added Go slog logging infrastructure and migrated a portion of the code from go-kit/log to slog.
@@ -1,2 +0,0 @@
-* Fixed false positive CVE for Nextcloud Desktop.
-* Fixed rare CPE error when software name sanitizes to empty (e.g. only special characters)
@@ -1 +0,0 @@
-* Added warning message on gitops label rename to clarify to users that renaming a label implies a delete operation.
@@ -1 +0,0 @@
- Fixed an issue where policy automation settings in the Other Workflows modal reverted to stale values after saving when using a MySQL read replica.
@@ -1 +0,0 @@
-* Refactored query used for deleting host_mdm_apple_profiles in bulk to use Primary keys only.
@@ -1 +0,0 @@
- Implemented ability for Fleet users to allow or disallow end-users to bypass conditional access on a per-policy basis.
@@ -1 +0,0 @@
- Fixed an issue where GitOps would not respect the value set on `update_new_hosts` for macOS updates.
@@ -1 +0,0 @@
-* Updated validation rules around the creation of labels to make sure only valid platforms are used.
@@ -1 +0,0 @@
-Improve error handling on AWS DB failover. Fleet will now fail health check if the primary DB is read-only, or trigger graceful shutdown when write operations encounter read-only errors.
@@ -1 +0,0 @@
- Fixed some styling issues for the UI when no enroll secret is present on a fleet.
@@ -1 +0,0 @@
-* Added the ability to specify allowed Entra tenant IDs for enrollments
@@ -1 +0,0 @@
-* Fixed a hover style issue in the label filter close button
@@ -1 +0,0 @@
- Renamed teams and queries to fleets and reports in the UI.
@@ -1 +0,0 @@
- Deprecated certain API field names to reflect the renaming of "teams" to "fleets" and "queries" to "reports".
@@ -1 +0,0 @@
- Fleet UI: Do not allow editing Fleet-maintained app in the UI while GitOps mode is enabled
@@ -1 +0,0 @@
- Left-aligned "Critical" checkbox in Save policy form.
@@ -1 +0,0 @@
- Fleet UI: Fix install/uninstall tarballs package to skip recently updated status that is waiting for a change in software inventory
@@ -1 +0,0 @@
-* Added automatic tagging of prerelease/post-release versions on local build based on branch name
@@ -1 +0,0 @@
-Reworked how we handle server/worker delays to fix flaky tests.
@@ -1 +0,0 @@
-* Fixed matching logic on App component for pages titles.
@@ -1 +0,0 @@
- resolved issue where duplicate kernels were reported in the OS versions API for RHEL-family distributions (RHEL, AlmaLinux, CentOS, Rocky, Fedora)
@@ -1 +0,0 @@
-Fixed false negative CVE-2026-20841 on Windows Notepad.
@@ -1 +0,0 @@
- Dynamically alphabetized vitals on the host details page.
@@ -1 +0,0 @@
- Fixed adding Windows Fleet maintained apps failing when a software title with the same upgrade code already exists.
@@ -1 +0,0 @@
-* Updated the DEP syncer to properly reassign a profile when ABM unilaterally removes it
@@ -1 +0,0 @@
-* Removed unnecessary calls to `svc.ds.BulkSetPendingMDMHostProfiles` in `POST /api/latest/fleet/spec/fleets`.
@@ -1 +0,0 @@
- Fixed client-side errors being incorrectly reported as server errors in OTEL telemetry.
@@ -1 +0,0 @@
- Added ability to enable/disable logs by topic
@@ -1 +0,0 @@
-* Updated the "Used by" column heading on the hosts page to "User email"
@@ -1 +0,0 @@
- Deprecated no-team.yml in GitOps in favor of unassigned.yml.
@@ -1 +0,0 @@
-* Fixed query results cleanup cron failing with "too many placeholders" error by filtering to only saved queries and batching the SQL IN clause.
@@ -1 +0,0 @@
-* Fixed stale software titles list after deleting a software installer.
@@ -1 +0,0 @@
-* Fixed a bug where macOS systems previous enrolled in fleet wouldn't always go through setup experience after a wipe
@@ -1 +0,0 @@
-* Fixed label edits not reflected until page refresh.
@@ -1 +0,0 @@
-* Fixed software appearance edits not reflected until page refresh.
@@ -1,2 +0,0 @@
-* Added configurable body size limits for the `/api/osquery/log` and `/api/osquery/distributed/write` endpoints.
-* Fixed false positive `PayloadTooLargeError` errors.
@@ -1 +0,0 @@
-* Fixed issue where policy automation retries were potentially reading stale data from replica database.
@@ -1 +0,0 @@
-* Fixed pagination on the host software page incorrectly disabling the "Next" button when a software title has multiple installer versions.
@@ -1 +0,0 @@
-* Added support for JIT provisioning of the Technician role via SSO SAML attributes.
@@ -1 +0,0 @@
-* Fixed stale software titles list after adding a VPP or fleet-maintained app by invalidating the query cache on success.
@@ -1 +0,0 @@
-* Fixed DB lock contention during vulnerability cron's software cleanup that caused failures under load.
@@ -1 +0,0 @@
-* Fixed query results cleanup cron failing with "too many placeholders" error by filtering to only saved queries and batching the SQL IN clause.
@@ -1 +0,0 @@
-* Fixed report creation API returning zero timestamps for `created_at` and `updated_at` fields.
@@ -1 +0,0 @@
-* Increased the maximum script execution timeout from 1 hour (3600 seconds) to 5 hours (18000 seconds).
@@ -1 +0,0 @@
- update storage of the auth token used in the UI; move if from local storage to a cookie.
@@ -1 +0,0 @@
- fixed issue where the status name was wrapping at smaller viewport witdths on the mdm card on the Dashboard page
@@ -1 +0,0 @@
- update UI to enable adding/removing multiple Microsoft Entra tenant ids
@@ -1 +0,0 @@
- Updated expiration date of the auth token cookie to match the fleet session duration
@@ -1 +0,0 @@
-* Updated nats-server dependency to resolve dependency vulnerabilities
@@ -1 +0,0 @@
-Fixed issue where MySQL IAM authentication could fail when a custom TLS CA/TLS config was set (for example, GovCloud), by ensuring Fleet includes the configured TLS mode in IAM DSNs.
@@ -1 +0,0 @@
-* Added AWS GovCloud RDS CA certificates to the RDS MySQL TLS bundle, enabling IAM authentication for Fleet deployments connecting to RDS in AWS GovCloud regions (us-gov-east-1, us-gov-west-1).
@@ -4,11 +4,11 @@ name: fleet
 keywords:
  - fleet
  - osquery
-version: v6.8.3
+version: v6.8.5
 home: https://github.com/fleetdm/fleet
 sources:
  - https://github.com/fleetdm/fleet.git
-appVersion: v4.81.2
+appVersion: v4.82.0
 dependencies:
  - name: mysql
    condition: mysql.enabled
@@ -4,7 +4,7 @@ hostName: fleet.localhost
 replicas: 3 # The number of Fleet instances to deploy
 revisionHistoryLimit: 10 # Number of old ReplicaSets for Fleet deployment to retain for rollback (set to 0 for unlimited)
 imageRepository: fleetdm/fleet
-imageTag: v4.81.2 # Version of Fleet to deploy
+imageTag: v4.82.0 # Version of Fleet to deploy
 # imagePullSecrets is optional.
 # imagePullSecrets:
 #   - name: docker
@@ -56,7 +56,7 @@ variable "database_name" {

 variable "fleet_image" {
  description = "the name of the container image to run"
-  default     = "fleetdm/fleet:v4.81.2"
+  default     = "fleetdm/fleet:v4.82.0"
 }

 variable "software_inventory" {
@@ -68,7 +68,7 @@ variable "redis_mem" {
 }

 variable "image" {
-  default = "fleetdm/fleet:v4.81.2"
+  default = "fleetdm/fleet:v4.82.0"

 variable "software_installers_bucket_name" {
  default = "fleet-software-installers"
@@ -1,6 +1,6 @@
 {
  "name": "fleetctl",
-  "version": "v4.81.2",
+  "version": "v4.82.0",
  "description": "Installer for the fleetctl CLI tool",
  "bin": {
    "fleetctl": "./run.js"
				`@@ -1 +0,0 @@`
				`- Fixed information disclosure vulnerability where arbitrary order_key values could be used to extract sensitive data via sort-order correlation attacks.`
				`@@ -1 +0,0 @@`
				`- The "Manage automations" button on the Queries and Policies pages is now always visible, and disabled only when the current team has no queries of its own.`
				`@@ -1 +0,0 @@`
				`- Fixed issue where Windows Jetbrains products would not report the correct version number.`
				`@@ -1 +0,0 @@`
				`* Updated logic to trigger vulnerability webhook when on fleet free tier`
				`@@ -1 +0,0 @@`
				`* Addded CVE alias for python visual studio code extension`
				`@@ -1 +0,0 @@`
				`- Disabled "Calendar" dropdown option in Policy > Manage automations for No team.`
				`@@ -1 +0,0 @@`
				`- Added ability to roll back to previously added versions of Fleet-maintained apps.`
				`@@ -1 +0,0 @@`
				`- Fleet UI: Surface FMA version used and whether it's out of date`
				`@@ -1 +0,0 @@`
				`- Fleet UI: Host details page includes team_id param in URL to allow retaining team on refresh`
				`@@ -1 +0,0 @@`
				`- added ability to scan for kernel vulnerabilities on RHEL based hosts`