Luke Heath
@@ -1,3 +1,82 @@
|
||||
## Fleet 4.65.0 (Mar 14, 2025)
|
||||
|
||||
## Security engineering
|
||||
- Added UI for viewing certificate details on the host details and my device pages.
|
||||
- Added new features to include certificates in host vitals for macOS, iOS, and iPadOS.
|
||||
- Added the list host certificates (and list device's certificates) endpoints.
|
||||
- Improved the copy for the delete and transfer host modal to be more clear about the disk encryption key behavior.
|
||||
- Permit setting SSO metadata and metadata_url in gitops and UI.
|
||||
- Fixed an issue where the Show Query modal would truncate large queries.
|
||||
|
||||
## Vulnerability management
|
||||
- Fixed Python for Windows software version mutation to avoid panics on software ingestion in some cases.
|
||||
- Prevented an invalid `FLEET_VULNERABILITIES_MAX_CONCURRENCY` value from causing deadlocks during vulnerability processing.
|
||||
- Updated default for vulnerabilities max concurrency from 5 to 1.
|
||||
- Updated CPE generation to more closely align with CPEs use in vulnerability feeds.
|
||||
- Changed software version CVE resolved in version parsing and comparison to use custom code rather than semver.
|
||||
- Added new (as of 2025-03-07) archives page to data source for MS Mac Office vulnerability feed (applies to vulnerabilities feed rather than a specific Fleet release).
|
||||
- Fixed an issue with Fleet's processing of Python versions to ensure that the correct CPEs are checked for vulnerabilities.
|
||||
- Fixed an issue with increased resource usage during vulnerabilities processing by adding database indexes.
|
||||
- Fixed false-positives on released PowerShell versions for CVE-2025-21171 and all PowerShell versions on CVE-2023-48795.
|
||||
|
||||
## IT engineering
|
||||
- Implemented GitOps mode that locks settings in the UI that are managed by GitOps.
|
||||
- Allowed VPP apps to be automatically installed via a Fleet-created policy.
|
||||
- Added ability for users to automatically install App Store Apps without writing a policy in the Fleet UI.
|
||||
- Updated the UI for adding and editing software for a cleaner, cohesive experience.
|
||||
- Added auto-install to FMA via the API, replacing a more brittle client-side implementation.
|
||||
- Added pagination inside each of the Manage Automations modals for policies.
|
||||
- Added script execution to the new `upcoming_activities` table.
|
||||
- Added software installs to the new `upcoming_activities` table.
|
||||
- Added vpp apps installs to the new `upcoming_activities` table.
|
||||
- Updated the list upcoming activities endpoint to use the new `upcoming_activities` table as source of truth.
|
||||
- Added support to activate the next activity when one is enqueued or when one is completed.
|
||||
- Added UI to the BYOD enrollment page to support enrolling Android devices into Fleet MDM.
|
||||
- Added UI to turn on and off Android MDM.
|
||||
- Added Android MDM activities.
|
||||
> **NOTE:** Android features are currently experimental and disabled by default. To enable, set `ANDROID_FEATURE_ENABLED=1`.
|
||||
- Updated UI for device user page with improved instructions for turning on MDM.
|
||||
- Added `PATCH /api/latest/fleet/software/titles/:id/name` endpoint for cleaning up incorrect software titles for software that has a bundle ID.
|
||||
- Added a daily job that keeps the App Store app version displayed in Fleet in sync with the actual latest version.
|
||||
- Properly re-routed deleting a app on no team to no team software page insteal of all teams software page.
|
||||
- Added a DB migration to migrate existing pending activities to the new unified queue.
|
||||
- Added created_at timestamp for when a VPP app was added to a specific team.
|
||||
> **NOTE:** The database migration for the above hydrates timestamps for existing VPP app team associations based on when the associated VPP apps were first added to the database. To hydrate more accurate timestamps by pulling from VPP app add/edit activities, you can run the following query manually. It is not included in migrations as it requires full table scans of the `activities` table, which may result in long migration times.
|
||||
```sql
|
||||
UPDATE vpp_apps_teams vat
|
||||
LEFT JOIN (SELECT MAX(created_at) added_at, details->>"$.app_store_id" adam_id, details->>"$.platform" platform, details->>"$.team_id" team_id
|
||||
FROM activities WHERE activity_type = 'added_app_store_app' GROUP BY adam_id, platform, team_id) aa ON
|
||||
vat.global_or_team_id = aa.team_id AND vat.adam_id = aa.adam_id AND vat.platform = aa.platform
|
||||
LEFT JOIN (SELECT MAX(created_at) edited_at, details->>"$.app_store_id" adam_id, details->>"$.platform" platform, details->>"$.team_id" team_id
|
||||
FROM activities WHERE activity_type = 'edited_app_store_app' GROUP BY adam_id, platform, team_id) ae ON
|
||||
vat.global_or_team_id = ae.team_id AND vat.adam_id = ae.adam_id AND vat.platform = ae.platform
|
||||
SET vat.created_at = COALESCE(added_at, vat.created_at), vat.updated_at = COALESCE(edited_at, added_at, vat.updated_at);
|
||||
```
|
||||
- Fixed an issue with assigning Windows MDM profiles to large numbers (> 65k) of hosts by batching the relevant database queries.
|
||||
- Fixed policy software automation that falsely reported success in UI when updates actually failed. Users will now be properly notified of failed automation saves.
|
||||
- Fixed a bug where uploading a macOS installer could prevent the software from being inventoried.
|
||||
- Fixed a bug where target selector was present in a premature stage.
|
||||
- Fixed a bug that caused macOS App Store apps to show up in Fleet as Windows apps if the Windows ersion of the app was already in Fleet.
|
||||
- Fixed an issue where the ABM token teams were being reset when making updates to the app config.
|
||||
- Fixed parsing of relative paths for MDM profiles in gitops `no-team.yml`.
|
||||
- Fixed a bug where new `fleetd` could not install software from old fleet server.
|
||||
- Fixed issue where `fleetctl gitops` was NOT deleting macOS setup experience bootstrap package and enrollment profile. GitOps should clear all settings that are not explicitly set in YAML config files.
|
||||
|
||||
## Bug fixes and improvements
|
||||
- Set collation and character set explicitly on database tables that were missing explicit values.
|
||||
- Updated the copy printed on successful runs of `fleetctl package`.
|
||||
- Enabled redis cluster follow redierctions by default.
|
||||
- Switched to a simpler, more reliable query for checking if an initial admin user has been added.
|
||||
- Updated the styling of the "Used by" line on host details page to be easier to read and include more data in the tooltip.
|
||||
- Added constistent behavior for table overflow and not hiding badges when user names overflow table cell.
|
||||
- Updated wine to version 10.0 to improve support macOS-to-Windows installer creation on M1 chips.
|
||||
- Updated UI to always show "Manage Automations" to permitted users.
|
||||
- Fixed clicking "Show details" to open the software details modal on the My device page.
|
||||
- Fixed an issue where link protection services would prematurely redeem MFA links.
|
||||
- Fixed several links that were dropping team_id parameters resetting team to all teams.
|
||||
- Fixed password authentication getting disabled when SMTP isn't configured.
|
||||
- Fixed an issue where restarting the desktop manager on Ubuntu would cause the Fleet Desktop tray icon to disappear and not return.
|
||||
|
||||
## Fleet 4.64.2 (Mar 05, 2025)
|
||||
|
||||
### Bug fixes
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
- Enabled redis cluster follow redierctions by default
|
||||
@@ -1 +0,0 @@
|
||||
- Added new features to include certificates in host vitals for macOS, iOS, and iPadOS.
|
||||
@@ -1 +0,0 @@
|
||||
- Added pagination inside each of the Manage Automations modals for policies
|
||||
@@ -1 +0,0 @@
|
||||
* Always show "Manage Automations" to permitted users
|
||||
@@ -1,2 +0,0 @@
|
||||
Fleet UI: Added ability for users to automatically install App Store Apps without writing a policy
|
||||
Fleet UI: Updated the UI for adding and editing software for a cleaner, cohesive experience
|
||||
@@ -1 +0,0 @@
|
||||
* Allowed VPP apps to be automatically installed via a Fleet-created policy. Also added auto-install to FMA via the API, replacing a more brittle client-side implementation.
|
||||
@@ -1,16 +0,0 @@
|
||||
* Added created_at timestamp for when a VPP app was added to a specific team.
|
||||
|
||||
NOTE: The database migration for the above hydrates timestamps for existing VPP app team associations based on when the associated VPP apps were first added to the database. To hydrate more accurate timestamps by pulling from VPP app add/edit activities, you can run the following query manually:
|
||||
|
||||
```sql
|
||||
UPDATE vpp_apps_teams vat
|
||||
LEFT JOIN (SELECT MAX(created_at) added_at, details->>"$.app_store_id" adam_id, details->>"$.platform" platform, details->>"$.team_id" team_id
|
||||
FROM activities WHERE activity_type = 'added_app_store_app' GROUP BY adam_id, platform, team_id) aa ON
|
||||
vat.global_or_team_id = aa.team_id AND vat.adam_id = aa.adam_id AND vat.platform = aa.platform
|
||||
LEFT JOIN (SELECT MAX(created_at) edited_at, details->>"$.app_store_id" adam_id, details->>"$.platform" platform, details->>"$.team_id" team_id
|
||||
FROM activities WHERE activity_type = 'edited_app_store_app' GROUP BY adam_id, platform, team_id) ae ON
|
||||
vat.global_or_team_id = ae.team_id AND vat.adam_id = ae.adam_id AND vat.platform = ae.platform
|
||||
SET vat.created_at = COALESCE(added_at, vat.created_at), vat.updated_at = COALESCE(edited_at, added_at, vat.updated_at);
|
||||
```
|
||||
|
||||
The above query is not included in migrations as it requires full table scans of the `activities` table, which may take awhile.
|
||||
@@ -1 +0,0 @@
|
||||
- Updated UI for device user page with improved instructions for turning on MDM.
|
||||
@@ -1,5 +0,0 @@
|
||||
* Added script execution to the new `upcoming_activities` table.
|
||||
* Added software installs to the new `upcoming_activities` table.
|
||||
* Added vpp apps installs to the new `upcoming_activities` table.
|
||||
* Updated the list upcoming activities endpoint to use the new `upcoming_activities` table as source of truth.
|
||||
* Added support to activate the next activity when one is enqueued or when one is completed.
|
||||
@@ -1,2 +0,0 @@
|
||||
- Adds a daily job that keeps the App Store app version displayed in Fleet in sync with the actual
|
||||
latest version.
|
||||
@@ -1 +0,0 @@
|
||||
* Changed software version cve resolved in version parsing and comparison to use custom code rather than semver,
|
||||
@@ -1 +0,0 @@
|
||||
- Updated the styling of the "Used by" line on host details page to be easier to read and include more data in the tooltip
|
||||
@@ -1 +0,0 @@
|
||||
* Set collation and character set explicitly on database tables that were missing explicit values.
|
||||
@@ -1 +0,0 @@
|
||||
* Added the list host certificates (and list device's certificates) endpoints.
|
||||
@@ -1 +0,0 @@
|
||||
* Implement GitOps Mode
|
||||
@@ -1 +0,0 @@
|
||||
- Fleet UI: Fixed policy software automation that falsely reported success when updates actually failed. Users will now be properly notified of failed automation saves.
|
||||
@@ -1 +0,0 @@
|
||||
Fixed issue where `fleetctl gitops` was NOT deleting macOS setup experience bootstrap package and enrollment profile. GitOps should clear all settings that are not explicitly set in YAML config files.
|
||||
@@ -1,2 +0,0 @@
|
||||
- Fixed a bug that caused macOS App Store apps to show up in Fleet as Windows apps if the Windows
|
||||
version of the app was already in Fleet.
|
||||
@@ -1 +0,0 @@
|
||||
* Added a DB migration to migrate existing pending activities to the new unified queue.
|
||||
@@ -1 +0,0 @@
|
||||
Fixed parsing of relative paths for MDM profiles in gitops no-team.yml
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed password authentication getting disabled when SMTP isn't configured
|
||||
@@ -1 +0,0 @@
|
||||
- Updated wine to version 10.0 to improve support macOS-to-Windows installer creation on M1 chips.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed CPE generation to more closely align with CPEs use in vulnerability feeds.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed an issue where the Show Query modal would truncate large queries.
|
||||
@@ -1,2 +0,0 @@
|
||||
- Fixed an issue with Fleet's processing of Python versions to ensure that the correct CPEs are
|
||||
checked for vulnerabilities.
|
||||
@@ -1 +0,0 @@
|
||||
* Switched to a simpler, more reliable query for checking if an initial admin user has been added.
|
||||
@@ -1 +0,0 @@
|
||||
- Fleet UI: Properly re-routed deleting a app on no team to no team software page insteal of all teams software page
|
||||
@@ -1 +0,0 @@
|
||||
- Fix a bug where target selector was present in a premature stage
|
||||
@@ -1 +0,0 @@
|
||||
* Fixed false-positives on released PowerShell versions for CVE-2025-21171 and all PowerShell versions on CVE-2023-48795.
|
||||
@@ -1 +0,0 @@
|
||||
- Permit setting SSO metadata and metadata_url in gitops and UI
|
||||
@@ -1 +0,0 @@
|
||||
- Fleet UI: Constistent behavior for table overflow and not hiding badges when user names overflow table cell
|
||||
@@ -1,2 +0,0 @@
|
||||
- Prevented an invalid `FLEET_VULNERABILITIES_MAX_CONCURRENCY` value from causing deadlocks during
|
||||
vulnerability processing.
|
||||
@@ -1,2 +0,0 @@
|
||||
- Fixed an issue with increased resource usage during vulnerabilities processing by adding
|
||||
database indexes.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed a bug where new fleetd could not install software from old fleet server
|
||||
@@ -1 +0,0 @@
|
||||
* Fixed a bug where uploading a macOS installer could prevent the software from being inventoried.
|
||||
@@ -1 +0,0 @@
|
||||
- Update the copy printed on successful runs of `fleetctl package`
|
||||
@@ -1 +0,0 @@
|
||||
Drop support for macOS 13.x.
|
||||
@@ -1 +0,0 @@
|
||||
- Fleet UI: Fixed several links that were dropping team_id parameters resetting team to All teams
|
||||
@@ -1 +0,0 @@
|
||||
- My device page > Software > Software table: Fixed clicking "Show details" to open the software details modal
|
||||
@@ -1,2 +0,0 @@
|
||||
- Fixed an issue with assigning Windows MDM profiles to large numbers (> 65k) of hosts by batching
|
||||
the relevant database queries.
|
||||
@@ -1 +0,0 @@
|
||||
* Added `PATCH /api/latest/fleet/software/titles/:id/name` endpoint for cleaning up incorrect software titles for software that has a bundle ID.
|
||||
@@ -1 +0,0 @@
|
||||
* Fixed an issue where link protection services would prematurely redeem MFA links.
|
||||
@@ -1 +0,0 @@
|
||||
* Added new (as of 2025-03-07) archives page to data source for MS Mac Office vulnerability feed (applies to vulnerabilities feed rather than a specific Fleet release).
|
||||
@@ -1 +0,0 @@
|
||||
* Improved SAML validation workflow.
|
||||
@@ -1 +0,0 @@
|
||||
- fix an issue where the abm token teams were being reset when making updates to the app config.
|
||||
@@ -1 +0,0 @@
|
||||
- add UI for viewing certificate details on the host details and my device pages
|
||||
@@ -1,2 +0,0 @@
|
||||
- changed the copy for the delete and transfer host modal to be more clear about the disk encryption
|
||||
key behavior
|
||||
@@ -1 +0,0 @@
|
||||
- add UI to turn on and and off android mdm
|
||||
@@ -1 +0,0 @@
|
||||
- add android mdm activities
|
||||
@@ -1 +0,0 @@
|
||||
- add UI to the BYOD enrollment page to support enrolling android devices into fleet mdm.
|
||||
@@ -1 +0,0 @@
|
||||
* Updated default for vulnerabilities max concurrency from 5 to 1.
|
||||
@@ -4,11 +4,11 @@ name: fleet
|
||||
keywords:
|
||||
- fleet
|
||||
- osquery
|
||||
version: v6.4.3-1
|
||||
version: v6.4.4
|
||||
home: https://github.com/fleetdm/fleet
|
||||
sources:
|
||||
- https://github.com/fleetdm/fleet.git
|
||||
appVersion: v4.64.2
|
||||
appVersion: v4.65.0
|
||||
dependencies:
|
||||
- name: mysql
|
||||
condition: mysql.enabled
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
hostName: fleet.localhost
|
||||
replicas: 3 # The number of Fleet instances to deploy
|
||||
imageRepository: fleetdm/fleet
|
||||
imageTag: v4.64.2 # Version of Fleet to deploy
|
||||
imageTag: v4.65.0 # Version of Fleet to deploy
|
||||
podAnnotations: {} # Additional annotations to add to the Fleet pod
|
||||
serviceAnnotations: {} # Additional annotations to add to the Fleet service
|
||||
serviceAccountAnnotations: {} # Additional annotations to add to the Fleet service account
|
||||
|
||||
@@ -56,7 +56,7 @@ variable "database_name" {
|
||||
|
||||
variable "fleet_image" {
|
||||
description = "the name of the container image to run"
|
||||
default = "fleetdm/fleet:v4.64.2"
|
||||
default = "fleetdm/fleet:v4.65.0"
|
||||
|
||||
variable "software_inventory" {
|
||||
description = "enable/disable software inventory (default is enabled)"
|
||||
|
||||
@@ -68,7 +68,7 @@ variable "redis_mem" {
|
||||
}
|
||||
|
||||
variable "image" {
|
||||
default = "fleetdm/fleet:v4.64.2"
|
||||
default = "fleetdm/fleet:v4.65.0"
|
||||
}
|
||||
|
||||
variable "software_installers_bucket_name" {
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "fleetctl",
|
||||
"version": "v4.64.2",
|
||||
"version": "v4.65.0",
|
||||
"description": "Installer for the fleetctl CLI tool",
|
||||
"bin": {
|
||||
"fleetctl": "./run.js"
|
||||
|
||||
Reference in New Issue
Block a user