26791 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
ImgBotApp	b54e502802	[ImgBot] Optimize images ... *Total -- 959.95kb -> 938.88kb (2.2%) /assets/images/osquery-certificate.svg -- 8.48kb -> 6.30kb (25.77%) /assets/images/sign-up-pencil.svg -- 2.36kb -> 1.79kb (24.21%) /assets/images/key.svg -- 1.40kb -> 1.17kb (16.34%) /assets/images/swoop-arrow.svg -- 1.65kb -> 1.39kb (15.98%) /website/assets/images/icon-checkmark-circle.svg -- 0.47kb -> 0.43kb (8.06%) /server/fleet/testdata/icons/org_logo_css.svg -- 3.16kb -> 3.07kb (2.97%) /website/assets/images/background-report-cta-top.svg -- 2.57kb -> 2.51kb (2.17%) /website/assets/images/background-report-cta-bottom.svg -- 2.59kb -> 2.54kb (2.15%) /website/assets/fonts/fontawesome-webfont.svg -- 433.96kb -> 425.36kb (1.98%) /ee/vulnerability-dashboard/assets/fonts/fontawesome-webfont.svg -- 433.96kb -> 425.36kb (1.98%) /website/assets/images/call-to-action-banner-background.svg -- 1.79kb -> 1.76kb (1.53%) /website/assets/images/EpicGames_White_Solid_RGB.svg -- 5.87kb -> 5.81kb (0.95%) /website/assets/images/EpicGames_Black_Solid_RGB.svg -- 5.69kb -> 5.64kb (0.86%) /assets/images/fleet-logo.svg -- 1.17kb -> 1.16kb (0.67%) /orbit/cmd/desktop/fleet-logo.svg -- 1.17kb -> 1.16kb (0.67%) /website/assets/images/press-kit/fleet-logo-mark.svg -- 1.18kb -> 1.17kb (0.66%) /website/assets/images/state-of-device-management-hero-background.svg -- 7.38kb -> 7.35kb (0.49%) /assets/images/fleet-logo-text-black.svg -- 4.82kb -> 4.79kb (0.49%) /assets/images/fleet-logo-text-white.svg -- 5.01kb -> 4.99kb (0.47%) /assets/images/schedule.svg -- 23.31kb -> 23.22kb (0.42%) /website/assets/images/github-mark-24x24.svg -- 1.30kb -> 1.29kb (0.38%) /assets/images/check.svg -- 0.27kb -> 0.27kb (0.36%) /website/assets/images/press-kit/fleet-logo-white.svg -- 4.93kb -> 4.92kb (0.32%) /website/assets/images/press-kit/fleet-logo-dark.svg -- 4.94kb -> 4.93kb (0.24%) /assets/images/laptop-plus.svg -- 0.50kb -> 0.50kb (0.19%) Signed-off-by: ImgBotApp <ImgBotHelp@gmail.com>	2026-08-08 02:10:54 +00:00
Leon Xu	0fce6b2de3	Merge branch 'fleetdm:main' into main	2026-08-07 19:01:14 -07:00
George Karr	bc537a37d3	Support GCS presigned downloads for large packages on GCP (#50479) ... **Related issue:** Resolves #49553 ## Summary When `s3_software_installers_signed_url` is enabled, Fleet returns a GCS SigV4 presigned URL for software installer, in-house app, and bootstrap package downloads, so clients fetch directly from GCS instead of streaming through the Fleet server. This unblocks packages over 50MB on GCP Cloud Run over HTTP1, while keeping live query working. Startup validation requires a GCS endpoint and HMAC credentials, and rejects combining the option with GCS IAM auth. Builds on community PR #47729 with review fixes. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ### Manual testing steps - [x] Confirm GCS parses our presigned URL format. A live GET with a wrong secret returned `SignatureDoesNotMatch`, so GCS reached signature validation. - [x] Full round-trip against live GCS with real HMAC credentials: upload, presign, and download. GCS returned HTTP 200 with the exact bytes. - [x] On a GCS-backed premium instance, installed a package on a host. Orbit received a `storage.googleapis.com` presigned URL and the host downloaded the package straight from the bucket. ## New Fleet configuration settings - [x] Setting(s) is/are explicitly excluded from GitOps <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Added support for delivering software installers, in-house apps, and bootstrap packages through Google Cloud Storage presigned URLs. * Downloads can be served directly from cloud storage instead of through the Fleet server. * **Improvements** * Added validation for supported endpoints and authentication settings. * Improved URL generation across supported signing methods. * Downloads fall back to Fleet URLs when signing cannot be completed. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-07 16:27:50 -05:00
Allen Houchins	9a2d7f28b2	Renamed "Solutions Consultant, Channel" to "Solutions Consultant" (#50793) ... Edited job listing for a Solutions Consultant role in the IT & Enablement department, detailing responsibilities and experience required. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Activated the Solutions Consultant position listing in the company careers section. - Published the existing responsibilities and qualifications for candidates to review. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-07 22:13:17 +01:00
Lucas Manuel Rodriguez	f654fe963c	Add ADR for ETag in osquery config requests (#50579)	2026-08-07 16:02:38 -05:00
dependabot[bot]	4448913812	Bump dompurify from 3.4.12 to 3.4.13 (#50791)	2026-08-07 15:55:59 -05:00
Luke Heath	49d67c1ec2	Fix concurrency groups in push-triggered workflows so superseded runs cancel (#50807)	2026-08-07 15:55:37 -05:00
Lucas Manuel Rodriguez	d0f7032313	Add VEX exclusions for fleetdm/wix (#50809) ... Fixes: https://github.com/fleetdm/fleet/actions/runs/31153554311. New run: https://github.com/fleetdm/fleet/actions/runs/31214011778. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security** * Added vulnerability assessments for four CVEs affecting Debian `libaom3`. * Added assessments for five CVEs affecting Debian `libheif` packages. * Documented that the application is not affected because AV1, HEIF, and AVIF media processing is not part of MSI package generation. * Classified the vulnerable code as outside the application’s execution path. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-07 17:49:55 -03:00
Victor Lyuboslavsky	19e53dfa55	Fixed team-level BitLocker PIN enforcement never reaching Windows hosts (#50730) ... <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #50729 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed Windows team-level BitLocker PIN enforcement when Apple MDM is not configured. * Windows devices now receive the required PIN setup prompts and management commands when their team requires them. * Global BitLocker PIN settings no longer incorrectly affect devices in teams without that requirement. * **Documentation** * Added a changelog entry describing the BitLocker PIN enforcement fix. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-07 15:47:51 -05:00
Eric	9f69abc181	Update actions/checkout step in Website related GitHub workflows (#50810) ... Changes: - Updated the version of actions/checkout used in website-related GitHub workflows and added `filter: blob:none` to improve the speed of the checkout step. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated automated build and test workflows to use the latest checkout action. * Improved workflow checkout efficiency with blobless repository downloads. * Preserved existing credential and full-history checkout behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-07 15:18:45 -05:00
Juan Fernandez	9cb3a5e206	Check trusted location before from_webstore in chromiumSideloaded ... Resolves #50706 chromiumSideloaded returned true as soon as from_webstore was 0, never reaching the trusted-location check. First-party browser components are installed by the browser itself and so always report from_webstore:false, which made the location exemption unreachable and flagged components like Edge Copilot Bridge as sideloaded_unverified. Check location for Internal/Component first. The existing collector fixture asserted the buggy behaviour and is updated to a genuinely sideloaded location, with a first-party component case added.	2026-08-07 15:39:47 -04:00
Luke Heath	fc97ff2e61	Fix website deploy race: concurrency group never matched on push events (#50806)	2026-08-07 14:30:51 -05:00
Dante Catalfamo	4e6591e09d	Reconcile stuck Android MDM commands via AMAPI operations.get (#50177) ... **Related issue:** Resolves #46145	2026-08-07 15:21:58 -04:00
Rahul RaghunathanandRachelElysia	f292c7def4	Add sortable 'Added to Fleet' column to hosts table (#50098) ... **Related issue:** Resolves #50083 # Screenshot demonstrating the fix - Hosts page: <img width="1473" height="335" alt="image" src="https://github.com/user-attachments/assets/2f88ad6e-a514-4304-ac80-f56678e6be47" /> - Edit columns modal: <img width="798" height="707" alt="image" src="https://github.com/user-attachments/assets/0a79e8f3-1b21-4f84-bd04-726f44b9a0fa" /> ## Note on sort direction The new "Added to Fleet" column renders as a "days ago" duration (same formatter as Last seen / Last fetched / Last restarted). To keep behavior consistent across all four time-ago columns on the hosts table, this PR applies the sort-direction inversion originally introduced for `last_restarted_at` in #14878 (fix for #13160) to all of them: - `seen_time` (Last seen) - `detail_updated_at` (Last fetched) - `last_restarted_at` (Last restarted) — unchanged behavior - `last_enrolled_at` (Added to Fleet) — new Arrow-down on any of these columns now sorts by the visible duration (biggest "days ago" first / oldest date first), rather than by the raw underlying timestamp. This is a user-facing behavior change on Last seen and Last fetched — please re-QA sort order on those two columns alongside the new one. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] QA'd all new/changed functionality manually <!-- Attach: Edit columns modal showing the new "Added to Fleet" column option, and the Hosts page with the column enabled --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added an **Added to Fleet** column to the hosts table. * Displays when each host last enrolled with Fleet, with an explanatory tooltip. * The column is hidden by default and can be enabled through table settings. * Supports ascending and descending sorting. * **Bug Fixes** * Corrected descending sorting for **Last seen** and **Last fetched** to reflect the displayed host age. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: RachelElysia <71795832+RachelElysia@users.noreply.github.com>	2026-08-07 13:38:41 -04:00
George Karr	d96ceb2c51	Add patch when closed policies (#50726) ... <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #39962 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - N/A - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added “Patch when closed” deployment policies to update software only when the application is not running. * Added deployment controls for force install, patching, and manual, forced, or closed-app patch options. * Fleet-maintained apps now automatically detect whether the application is open. * GitOps configurations support patch-when-closed settings with validation. * **UI Improvements** * Added clear activity and installation messages when updates are skipped because an app is open. * Replaced the Patch action with a unified Deploy workflow. * **Bug Fixes** * Prevented skipped updates from being incorrectly retried as failed installations. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-07 12:37:20 -05:00
dependabot[bot]andLucas Manuel Rodriguez	23cc1b45e8	Bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#50787) ... Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.19.1 to 5.19.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.19.2</h2> <h2>What's Changed</h2> <ul> <li>build: Update module golang.org/x/crypto to v0.52.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2150">go-git/go-git#2150</a></li> <li>build: Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2141">go-git/go-git#2141</a></li> <li>build: Update module golang.org/x/net to v0.55.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2152">go-git/go-git#2152</a></li> <li>git: Worktree: Add stores index entires with backslashes on Windows by <a href="https://github.com/joshblum"><code>@​joshblum</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2262">go-git/go-git#2262</a></li> <li>storage: dotgit, reject path traversal in reference names by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2254">go-git/go-git#2254</a></li> <li>build: Update module golang.org/x/net to v0.56.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2267">go-git/go-git#2267</a></li> <li>build: Update module golang.org/x/text to v0.39.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2268">go-git/go-git#2268</a></li> <li>[v5] git: worktree, make the filesystem wrapper a symlink-safe boundary by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2277">go-git/go-git#2277</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2">https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/3eeb238da61eb9c7a324f3ee04f990ce89175642"><code>3eeb238</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2277">#2277</a> from go-git/checkout-v5</li> <li><a href="https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"><code>008a78f</code></a> git: worktree, make the filesystem wrapper a symlink-safe boundary</li> <li><a href="https://github.com/go-git/go-git/commit/2263fb5f022dde90b1c2845f028d3e37e161f2b8"><code>2263fb5</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2268">#2268</a> from go-git/renovate/releases/v5.x-go-golang.org-x-t...</li> <li><a href="https://github.com/go-git/go-git/commit/77b76250d93ec83e2c897638d8a3847b1bfaa38d"><code>77b7625</code></a> build: Update module golang.org/x/text to v0.39.0 [SECURITY]</li> <li><a href="https://github.com/go-git/go-git/commit/85ea767be2b2281693e61afe83911e12c86d6eb7"><code>85ea767</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2267">#2267</a> from go-git/renovate/releases/v5.x-go-golang.org-x-n...</li> <li><a href="https://github.com/go-git/go-git/commit/198675a07b3b8f4eb8f51bf188663a13bb0d9e1a"><code>198675a</code></a> build: Update module golang.org/x/net to v0.56.0 [SECURITY]</li> <li><a href="https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7"><code>4a0e66d</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2254">#2254</a> from pjbgf/v5-dotgit-ref-name-containment</li> <li><a href="https://github.com/go-git/go-git/commit/3b306ef83bd05194a30ce820eed7ed61c3084b5f"><code>3b306ef</code></a> storage: dotgit, align reference-name safety with refname_is_safe</li> <li><a href="https://github.com/go-git/go-git/commit/f3d0cc150b39ae1dc47406a5c170464286914610"><code>f3d0cc1</code></a> storage: dotgit, reject path traversal in reference names</li> <li><a href="https://github.com/go-git/go-git/commit/979cfe9c561d3ced778c88d9cde6db3297e6ed1d"><code>979cfe9</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2262">#2262</a> from joshblum/joshblum/to-slash-v5</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>	2026-08-07 14:34:00 -03:00
RachelElysia	ddbc65a4f6	Self-service: "Install all" respects the search query (#50751) ... ## Issue Resolves #50528. ## Description On the My device > Self-service page, with a category selected and a search query typed, the "Install all" button previously ignored the search: it counted (and queued) every uninstalled item in the category, including software the search had filtered out. This PR scopes the button — count *and* install target — to the visible subset: - **Backend:** `POST /device/{token}/software/install_all` now accepts a `query` param. It's threaded through `SelfServiceInstallAllSoftwareTitles` → `GetSoftwareTitlesForInstallAll` → `opts.ListOptions.MatchQuery` on `ListHostSoftware`, reusing the same LIKE-on-`software_titles.name` semantics as the self-service list endpoint. - **Frontend:** new `filterSoftwareByQuery` helper layers on top of the category filter to drive `uninstalledCount` / `hasInProgress` and the value sent to install_all. Empty queries are stripped so the API isn't called with `?query=`. `display_name` matching is deliberately out of scope — the search filter across BE list, desktop table, and mobile filter is all raw-`name`-only today, so broadening install_all alone would re-introduce a similar mismatch. Filed as a follow-up: #50750. ## Screen recording In recording: - (FE fix) showing that the UI is filtering out install all count to be only what's on the screen - (BE fix) showing that the call to the API only queues up the install all for the installers shown on the screen when clicked https://github.com/user-attachments/assets/aaae3d29-dccf-484d-910f-67ca335bf0e8 ## Testing - FE unit tests: `filterSoftwareByQuery` helper, `SelfServiceCard` count-with-query + POST-with-query, `InstallAllInCategoryButton` prop forwarding. - BE unit test: EE service forwards the match query to the datastore. - BE datastore test: query, category+query, empty-match cases. - BE integration test: new "scopes to the query parameter when provided" subtest in `TestInstallAllSelfServiceSoftware`. - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * “Install all” now respects the active self-service search query. * Counts, progress indicators, and installation requests now reflect only software matching the current search and category filters. * Empty or whitespace-only searches continue to include all software in the selected category. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-07 13:31:31 -04:00
Carlo	8705b8def0	Merge branch 'main' into feat-49553-gcp-large-packages	2026-08-07 13:28:39 -04:00
Andrew MellorandJordan Montgomery	eb4acf4d1e	47717 auld UI latest os version (#50571) ... **Related issue:** Resolves #47717 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. _Front end only_ ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Apple OS update targeting options for no enforcement, a custom minimum version, or the latest available version. * Added configurable whole-day deadlines for macOS, iOS, and iPadOS updates. * Added platform-specific target controls, validation, and automatic new-host updates for latest-version targeting. * Displayed minimum versions, pending status, and update deadlines in host details and activity feeds. * Clarified Windows deadlines as days after release. * **Style** * Improved layout and spacing for Apple and Windows update forms. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>	2026-08-07 18:25:37 +01:00
Allen Houchins	4d55e96f9f	Add Microsoft Store apps in Windows self-service article and guide (#50637) ... **Related issue:** NA Adds an article and companion guide on putting **Microsoft Store apps** into Windows self-service using winget and `.ps1` script-only packages. | File | Category | URL | |---|---|---| | `build-your-own-windows-self-service-with-winget-and-script-only-packages.md` | `articles` | `/articles/build-your-own-windows-self-service-with-winget-and-script-only-packages` | | `build-your-own-windows-self-service-with-winget-and-script-only-packages-guide.md` | `guides` | `/guides/build-your-own-windows-self-service-with-winget-and-script-only-packages-guide` | ## What changed and why Fleet 4.89.0 added an uninstall script, pre-install query, and post-install script to script-only packages. On Linux that was enough to build a [self-service catalog on apt and dnf](https://fleetdm.com/articles/build-your-own-linux-self-service-with-script-only-packages). These are the Windows counterparts, scoped specifically to Store apps. The per-app work is two lines: ```powershell winget install --id <StoreId> --source msstore --accept-package-agreements --accept-source-agreements --disable-interactivity winget uninstall --id <StoreId> --accept-source-agreements --disable-interactivity ``` Everything else in each script is boilerplate, and the generator emits it. ## The constraint both pieces are built around Fleet's agent runs Windows scripts as SYSTEM (`orbit/pkg/scripts/exec_windows.go:17`), and Store apps cannot be installed that way: - The `msstore` source rejects device-wide installs outright: "Device wide install for msstore type is not supported under admin context" ([winget-cli#3553](https://github.com/microsoft/winget-cli/issues/3553)). Store packages are per-user by design. - winget's CLI is [not supported in the system context](https://learn.microsoft.com/en-us/windows/package-manager/winget/troubleshooting) at all, because App Installer is an MSIX package that cannot be registered for `NT AUTHORITY\SYSTEM`. - Running winget in the system context is still [an open feature request](https://github.com/microsoft/winget-pkgs/issues/346975). So the scripts run winget inside the logged-on user's session via a short-lived scheduled task, mirroring the pattern already used by Fleet's own per-user Windows maintained apps (`ee/maintained-apps/inputs/winget/scripts/figma_install.ps1`). ## Two things worth a reviewer's attention Both are corrections that fall out of the Store focus, and both would have produced silently wrong content: 1. **Verification uses `Get-AppxPackage -AllUsers`, not the registry.** Store apps never register in the HKLM uninstall keys, so a registry check fails on a perfectly good install. This is called out explicitly in the guide's Troubleshoot section, since it's a natural wrong instinct if you've built tiles for ordinary Windows installers. 2. **`winget install --scope machine` is documented as a trap, not a shortcut.** For a Store package it [installs under the SYSTEM account](https://github.com/microsoft/winget-cli/issues/4748) instead of provisioning the app, which reports success and leaves users with nothing. The scheduled task's exit code also doesn't propagate back to the calling script, so the install reports success whenever the task ran. Both pieces treat the post-install verification as mandatory rather than optional because of this. ## Machine-wide path For apps that must exist for every user, the content documents `winget download` plus `Add-AppxProvisionedPackage`, which does work as SYSTEM, along with its two costs: license download [requires Entra ID authentication](https://learn.microsoft.com/en-us/windows/package-manager/winget/download) by a Global Administrator, User Administrator, or License Administrator, and you now have a file to host, so it wants a Fleet custom package rather than a script-only one. ## Notes for reviewers - **Content only.** No Go, frontend, migration, or config changes, so no changes file is needed and the code-focused template sections below are removed as the template instructs. - **The PowerShell has not been executed.** There is no `pwsh` on the authoring machine. The generator's here-string escaping was traced by hand but not run. Worth one execution on a real Windows host before publish. - **`Microsoft.CompanyPortal` / `9WZDNCRFJ3PZ`** are used as the worked example. Both identifiers are now verified (PackageFamilyName `Microsoft.CompanyPortal_8wekyb3d8bbwe`), and the guide still tells readers to derive both themselves. - **A verification pass was run over every claim** (Fleet docs, Microsoft Learn, winget-cli issues). It caught one real bug: `winget uninstall` with no flags can hang on an msstore source-agreement prompt ([winget-cli#1736](https://github.com/microsoft/winget-cli/issues/1736)), invisible inside the scheduled task. All uninstalls now carry `--accept-source-agreements`, both directions carry `--disable-interactivity`, and the explorer.exe owner lookup takes the first result so multiple explorer processes can't break `Register-ScheduledTask`. - **`articleImageUrl` is intentionally absent** from the article. The build treats it as optional, but the Linux article has one, so a `1200x627@2x.png` in `website/assets/images/articles/` plus the meta tag would bring it to parity. The guide has none, matching the Linux guide. - **`publishedOn` is `2026-08-05`** on both. Update if these are being scheduled. Checked against the build's enforced constraints (`website/scripts/build-static-content.js`): valid `category`, `articleTitle` matches each H1 exactly, descriptions are 133 and 125 characters (limit 150), `publishedOn` matches the required ISO pattern, no `@fleetdm.com` addresses. `check-pr-template` does not run on this PR, since it only triggers on `frontend/**`, `**/*.go`, `go.mod`, and `go.sum`. # Checklist for submitter ## Testing - [ ] QA'd all new/changed functionality manually Not applicable to content-only changes. Verified instead by running the website build's own validation rules against both files, and by sourcing every technical claim to Microsoft Learn, `winget-cli` issues, or Fleet's docs and code. The PowerShell samples are unexecuted, as noted above.	2026-08-07 12:19:48 -05:00
kitzy	c24db01d37	Add guide: deploy Visual Studio on Windows with Fleet (#50740) ... <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #50653 Companion to #50717, which adds Visual Studio 2022 Community, Professional, and Enterprise as Windows Fleet-maintained apps. Opened as a draft because it documents behavior that PR introduces. Adding the FMA and letting it run is not enough on its own. The unattended Visual Studio bootstrapper installs the core IDE shell with no workloads, so a host ends up with an IDE nobody can build with. Everything that follows from that came out of getting #50717 through CI, so this guide captures it rather than leaving each admin to rediscover it. The guide covers: - What the default install actually produces, and why the core-only result is the right default rather than a shortfall - Pinning workloads for a fleet by overriding `install_script`, with `--add` or an exported `.vsconfig` - Letting developers select their own workloads via `AllowStandardUserControl`, paired with `HideAvailableTab` so they can't install other Visual Studio SKUs - Verify and troubleshoot sections for the failure modes seen during #50717 Two constraints worth flagging for reviewers, both documented in the guide: - Fleet stops install scripts after one hour (`MaxHostSoftwareInstallExecutionTime`), and the multi-GB payload downloads inside that window. Pinning a large workload set can exceed it on a slow connection. - Standard users can't run the Visual Studio Installer with `--quiet` or `--passive` regardless of policy. That's Microsoft's constraint, not Fleet's, and it's why per-user selection goes through the installer UI rather than through Fleet. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. Not applicable: documentation only, no user-visible product change. ## Testing - [x] QA'd all new/changed functionality manually Documentation only, so there is no code to test. What was verified: - Guide structure and prose checked against the `fleet-guide-formatting` and `content-style` conventions: sentence-case task-led H1, prerequisites, inline `>` callouts next to the steps they affect, verify and troubleshoot sections, no summary coda, complete endmatter with the description under the 150-character build limit. - Confirmed `GET /guides/*` in `website/config/routes.js` is a wildcard handler, so this guide needs no route entry. - The GitOps keys used (`fleet_maintained_apps`, `install_script.path`, `post_install_script.path`) were checked against `docs/Configuration/yaml-files.md`, and the UI path against existing guides. - Registry keys, policy values, and installer switches were taken from Microsoft's documentation, linked inline in the guide. **Not verified, and worth a reviewer's eye:** the `AllowStandardUserControl` flow has not been exercised end to end on a real host with a standard (non-administrator) user. The policy behavior comes from Microsoft's docs rather than from a test. `publishedOn` is set to the date this was drafted. Update it before publishing.	2026-08-07 12:18:38 -05:00
3 people	c510e5b6e2	Add tooltip explaining no Refetch button for Android hosts on Host details page (#50666) ... Follow up PR for the following quick win based on feedback here: - https://github.com/fleetdm/fleet/issues/50001 <img width="899" height="217" alt="Screenshot 2026-08-06 at 10 32 24 AM" src="https://github.com/user-attachments/assets/462df6ae-ec09-433d-831b-9a0e3c242081" /> - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Android host details now display a disabled **Refetch** button with an explanatory tooltip. * The tooltip explains automatic synchronization and links to manual Android synchronization instructions in a new tab. * The **Last fetched** information is displayed directly without an additional tooltip. * **Documentation** * Updated Android host documentation to reflect the disabled Refetch control and manual synchronization guidance. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: LeAnn Gove <leann@fleetdm.com> Co-authored-by: LeAnn <97471894+Leanngove@users.noreply.github.com>	2026-08-07 10:18:24 -07:00
Allen Houchins	051d12718c	Add JetBrains ReSharper as a Windows Fleet-maintained app (#50659) ... **Related issue:** Resolves #50567 Adds JetBrains ReSharper as a Windows Fleet-maintained app (winget `JetBrains.ReSharper`, version `2026.2.0.2`). ReSharper is a Visual Studio extension rather than a standalone app, so it does not follow the pattern of the other JetBrains FMAs (Rider, PhpStorm, DataGrip, etc.), which are plain NSIS installers that take `/S`. Reviewers should read the risks below before approving — a couple of things can only be confirmed from a validator run. ## What's here - `ee/maintained-apps/inputs/winget/resharper.json` - `ee/maintained-apps/inputs/winget/scripts/resharper_install.ps1` / `resharper_uninstall.ps1` - Generated `ee/maintained-apps/outputs/resharper/windows.json` + `apps.json` entry - Icon (`Resharper.tsx`, website PNG, alphabetical `index.ts` entries), generated from JetBrains' own brand asset ## Decisions that differ from the other JetBrains FMAs **`use_display_version_for_patch` is omitted.** Every other JetBrains winget input sets it, but the ReSharper manifest has no `AppsAndFeaturesEntries`, so the ingester hard-errors with `use_display_version_for_patch is set but no DisplayVersion found in winget manifest`. The patch policy therefore compares against winget's `2026.2.0.2`. **Custom `exists_query` instead of `fuzzy_match_name`.** The prefix is loose enough to match a possible per-VS-instance suffix, and excludes the separate ReSharper C++ and ReSharper SDK products: ```sql SELECT 1 FROM programs WHERE name LIKE 'JetBrains ReSharper%' AND name NOT LIKE 'JetBrains ReSharper C++%' AND name NOT LIKE 'JetBrains ReSharper SDK%' AND publisher = 'JetBrains s.r.o.'; ``` **Install script detects Visual Studio.** It builds `/VsVersion` from the instances `vswhere` reports and runs the installer with `/Silent=True /PerMachine=True /SkipEtwService=True`: - `/PerMachine=True` — the installer otherwise targets `%LocalAppData%`, which under Fleet's SYSTEM context would land in the SYSTEM profile instead of the developer's. The path is not configurable ([RSRP-428991](https://youtrack.jetbrains.com/issue/RSRP-428991)). - `/SkipEtwService=True` — JetBrains documents that `EtwHostService.msi` always raises a UAC prompt, so a fully silent install of every component is not possible ([SUPPORT-A-3189](https://youtrack.jetbrains.com/articles/SUPPORT-A-3189)). - It then waits for the uninstall registry entry (what osquery reads), because the web bootstrapper can outlive its own exit code, and logs the resulting ARP entries. **Uninstall removes every matching entry**, since ReSharper registers one per Visual Studio instance, using the defensive `UninstallString` parser and appending `/Silent=True` rather than the NSIS `/S`. Switches come from [JetBrains' silent install/uninstall article](https://resharper-support.jetbrains.com/hc/en-us/articles/207241485-How-to-use-silent-install-and-silent-uninstall-of-ReSharper-via-Command-Line), not guesswork. ## `unique_identifier` is provisional `program_publisher` is verified — `JetBrains s.r.o.` is hard-coded next to the ARP value names (`DisplayName`, `DisplayVersion`, `UninstallString`, `Publisher`) in `JetBrains.Platform.Installer.exe`, extracted from the installer. The **DisplayName is not verifiable offline.** The winget URL is a two-stage web bootstrapper: the 69 MB `.web.exe` contains `JetBrains.Platform.Installer.Bootstrap.exe`, which downloads the JetBrains dotUltimate installer, which downloads the product packages. The ARP entry is written by that downloaded stage under `Software\Microsoft\Windows\CurrentVersion\Uninstall\{GUID}`, with `DisplayName` taken from a per-VS-host `PresentableName`. So `JetBrains ReSharper` is a best-supported guess. It can be confirmed from a validator run: `cmd/maintained-apps/validate/windows.go` searches `programs` with a loose `LOWER(name) LIKE '%…%'` on both the catalog name and `unique_identifier`, and logs `Found app: '<DisplayName>' … Version: <ver>` after running `MutateSoftwareOnIngestion`. That reveals both the true DisplayName and the post-mutation version. The install script prints the same information. **Expect a follow-up commit correcting `unique_identifier` (and possibly the exists query) once that log lands.** ## Risks 1. **Payload is not pinned.** The SHA covers only the 69 MB bootstrapper; roughly 1.7 GB is fetched from `download.jetbrains.com` at install time. JetBrains publishes only a `windowsWeb` download for ReSharper, so there is no offline installer to point at. Install duration may exceed script timeouts. 2. **Requires Visual Studio.** With no VS present the installer has nothing to install, so the script exits 1 with a clear message. `windows-latest` runners ship Visual Studio 2022 Enterprise, so validation should be able to install. 3. **`/PerMachine=True` conflicts with pre-existing per-user installs.** JetBrains states machine-wide mode "is not compatible with existing installations in user profiles"; one must be removed first. 4. **`/SkipEtwService=True` omits the ETW host service**, so dotTrace/dotMemory profiling integration is incomplete. This is the documented tradeoff for an unattended install. 5. **Version reconciliation unconfirmed.** If the DisplayName ends in a marketing version, the JetBrains name-based version mutation fires and the validator's prefix check passes; a VS-suffixed name would instead fall back to the registry `DisplayVersion`. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] `go test ./ee/maintained-apps/...` passes; both output JSON files parse; generated SHA matches the winget manifest. - [ ] QA'd all new/changed functionality manually — **not done.** Install/uninstall need a Windows host with Visual Studio; relying on the FMA Windows validator, which is also how `unique_identifier` gets confirmed. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added ReSharper to the maintained Windows applications catalog. * Added support for silent machine-wide installation and uninstallation. * Added Visual Studio compatibility checks and installation failure reporting. * Added a ReSharper icon for display in the software catalog. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-07 12:16:17 -05:00
3 people	616f9ab108	Update scripts in Fleet-maintained apps (#50756) ... Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Updates** - Refreshed macOS and Windows installer metadata for numerous maintained applications, including AltTab, Arc, Calibre, ChatGPT, Chrome, Kiro, Loom, Postman, Prisma Access Browser, RustRover, and others. - Updated release versions, download links, version detection, and integrity checks. - **Bug Fixes** - Improved Evernote removal verification on Windows. - Enhanced Krita and Proton Drive macOS cleanup, including related support files and background services. - **Configuration** - Webex is now marked as frozen. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> Co-authored-by: Allen Houchins <allenhouchins@mac.com>	2026-08-07 12:15:59 -05:00
Terry Kwok	d6d9d98d08	Fix typo in Marketing Email field description (#50783) ... Fix typo in Marketing Email field description <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))	2026-08-07 12:14:52 -05:00
Magnus Jensen	c905e69228	improve validation error messages for custom activations (#50753) ... <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves nothing, just something I caught while doing test plan and PR review. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. part of a bigger story. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved validation messages for custom activations. * Clarified that standard configurations must reference exactly one configuration profile. * Added a documentation link for the single-profile reference requirement. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-07 19:03:07 +02:00
Magnus Jensen	dd3fda3f3c	always update Apple enrollment type correctly (#50689) ... <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45217 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Fixed Apple device re-enrollment so enrollment types and statuses update correctly when switching between manual, automated, and personal enrollment. - Improved handling of Apple Business Manager assignment changes during enrollment. - Preserved existing third-party MDM information while updating enrollment details. - Correctly records devices installed through automated enrollment and keeps enrollment state consistent across check-ins, restores, and over-the-air enrollment. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-07 19:01:45 +02:00
dependabot[bot]	d9a2445832	Bump socket.io-parser from 4.2.6 to 4.2.7 in /website (#50504) ... Bumps [socket.io-parser](https://github.com/socketio/socket.io) from 4.2.6 to 4.2.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/socketio/socket.io/releases">socket.io-parser's releases</a>.</em></p> <blockquote> <h2>socket.io-parser@4.2.7</h2> <h3>Bug Fixes</h3> <ul> <li>honor toJSON() when deconstructing a binary packet (<a href="https://redirect.github.com/socketio/socket.io/issues/5518">#5518</a>) (<a href="https://github.com/socketio/socket.io/commit/57f111439513809c633f2554be2f3104e4ad432c">57f1114</a>)</li> <li>reject binary packets with zero attachments (<a href="https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4">7c6ef57</a>)</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/spokodev"><code>@​spokodev</code></a> made their first contribution in <a href="https://redirect.github.com/socketio/socket.io/pull/5518">socketio/socket.io#5518</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/socketio/socket.io/commit/4054894738817f5a2125e6e6b18e79d92c75ab33"><code>4054894</code></a> chore(release): socket.io-parser@4.2.7</li> <li><a href="https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4"><code>7c6ef57</code></a> fix(parser): reject binary packets with zero attachments</li> <li><a href="https://github.com/socketio/socket.io/commit/57f111439513809c633f2554be2f3104e4ad432c"><code>57f1114</code></a> fix(parser): honor toJSON() when deconstructing a binary packet (<a href="https://redirect.github.com/socketio/socket.io/issues/5518">#5518</a>)</li> <li><a href="https://github.com/socketio/socket.io/commit/8d2e4f7b8671ed2c4fa1fca9ec6f68e5cf82266e"><code>8d2e4f7</code></a> docs(security): add CVE-2026-59724 and CVE-2026-59725</li> <li><a href="https://github.com/socketio/socket.io/commit/d2d753fed4435015c2d83fe62e676b44e07fa3f7"><code>d2d753f</code></a> refactor(sio): align client file matching in Node.js HTTP server</li> <li><a href="https://github.com/socketio/socket.io/commit/dfb5ab3b6a2f00d1ecb226939022ea56e5701124"><code>dfb5ab3</code></a> fix(sio): prevent uWebSockets.js from serving missing client files</li> <li><a href="https://github.com/socketio/socket.io/commit/dcbd96154352dd84c189b41e5c0ec0df4b7fe6a5"><code>dcbd961</code></a> perf(eio): optimize polling request body buffering</li> <li><a href="https://github.com/socketio/socket.io/commit/6bb2e7f5fb7c548f0776328b4a19719723e27efd"><code>6bb2e7f</code></a> refactor(sio): internalize base64id dependency</li> <li><a href="https://github.com/socketio/socket.io/commit/a80711a8c3b11a3e75a84de567ac4d84820f4714"><code>a80711a</code></a> refactor(eio): internalize base64id dependency</li> <li><a href="https://github.com/socketio/socket.io/commit/8bead0f4c6fba027996bb9eab02f05120f35513d"><code>8bead0f</code></a> chore: upgrade to TypeScript 6</li> <li>Additional commits viewable in <a href="https://github.com/socketio/socket.io/compare/socket.io-parser@4.2.6...socket.io-parser@4.2.7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-07 11:59:28 -05:00
Eric	f145c778b8	Website: log number of android enterprise requests in the past minute (#50780) ... Related to: https://github.com/fleetdm/fleet/issues/49212 Changes: - Updated the custom hook to create `sails.androidProxyApiRequestCount`, and to log and reset the value every minute - Updated android proxy endpoints to increment `sails.androidProxyApiRequestCount` every time a request to the Android management API is sent <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Monitoring** * Added comprehensive tracking for Android Management API requests across enrollment, enterprise, device, application, policy, and command operations. * Added periodic request-count logging and automatic resets when Android Enterprise credentials are configured. * Improved reporting alignment with minute-based API limits while keeping logs quiet during periods without requests. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-07 11:58:35 -05:00
Ali Riaz	fc35085cf3	Update go-to-market-operations.md fix the spelling visable to visible (#50767) ... <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))	2026-08-07 17:16:11 +01:00
Allen HouchinsandClaude	9b5e9775ce	Unfreeze XnConvert (macOS) (#50700) ... Automated unfreeze probe. Removes `"frozen": true` and regenerates the output manifest so test-fma-macos-pr-only can validate `xnconvert/darwin` at its current upstream version. Frozen since: not recoverable from this checkout (squashed/shallow history — every input file is attributed to the same import commit) Version: 1.112.0 -> 1.115.0 Draft until validation reports. Merge only if the FMA checks are green and the validate shard actually ran for this slug. --- _Generated by [Claude Code](https://claude.ai/code/session_01Hx5UA4Dhqh2UUCX8h6k6Vv)_ Co-authored-by: Claude <noreply@anthropic.com>	2026-08-07 11:00:36 -05:00
kitzyandAllen Houchins	5db78a63e3	Add Visual Studio 2022 (Community/Professional/Enterprise) as Windows FMAs (#50717) ... <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #50653 Adds **Visual Studio 2022 Community, Professional, and Enterprise** as Windows Fleet-maintained apps. customer-universitas needs all three editions. ## What's here - Three input files, one per edition, each pointing at its own winget package (`Microsoft.VisualStudio.2022.{Community,Professional,Enterprise}`, all at `17.14.37`). - A shared install script (`visual_studio_2022_install.ps1`) — the downloaded file is a ~4 MB bootstrapper, not the IDE. The real multi-GB payload downloads from Microsoft *during* the install script, so install time depends on the host's network speed and counts against Fleet's 1-hour software-install timeout. `--wait` is required or the bootstrapper forks the real install to a background process and returns almost immediately. - Three uninstall scripts (one per edition) that resolve the install path via `vswhere.exe -products Microsoft.VisualStudio.Product.<Edition>` and call `vs_installer.exe uninstall --installPath <path> --quiet --norestart --wait`, since VS has no normal `UninstallString`. - Both scripts map winget's documented `3010`/`1641` (reboot pending/initiated) to a successful exit, and fail clearly on `1001`/`1618` (another VS Installer operation already running). - Default install ships the bare IDE shell (no `--add` workloads) — matches plain `winget install` behavior, per the issue's own conclusion that this needs no special-casing. - Icons: no scriptable source (no Windows host to extract the real per-edition `.exe` icon, and Microsoft's own download pages don't expose one) turned up distinct Community/Professional/Enterprise badge art, so all three currently use the same public Visual Studio mark ([Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Visual_Studio_Icon_2022.svg), marked public domain). **Flagging for #g-software Product Designer** to swap in the real per-edition badges if we have them. ## What I could not verify (no Windows host in this environment) - `unique_identifier`/publisher (`Visual Studio Community/Professional/Enterprise 2022`, publisher `Microsoft Corporation`) are taken from the winget locale manifest, not confirmed against a live registry entry. - The version-string quirk the issue calls out: winget's `AppsAndFeaturesEntries.DisplayVersion` is `"17.14.37 (July 2026)"`, not a clean version. I deliberately did **not** set `use_display_version_for_patch` — feeding that non-numeric string in as the patch target would break `version_compare` ordering across future version bumps (see the comment in `ingester.go`). Instead the patch policy compares against the plain winget `PackageVersion` (`17.14.37`), same as most winget FMAs. This should hold up if `version_compare` reads leading numeric-dot segments and ignores the trailing text, but I can't confirm that against real `programs.version` output without a host. - Whether `vs_installer.exe` actually honors `--wait` for `uninstall` the way the bootstrapper does for `install` — Microsoft's own docs say `--wait` "can only be passed into the bootstrapper; the installer (setup.exe) doesn't support it," which is in tension with the exact command this issue asked for and what I've seen used in the wild. Worth watching in validation logs. - End-to-end install timing on a normal (non-datacenter) connection, within the 1-hour timeout. # Checklist for submitter - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. <!-- Not added — no precedent for a changes file on FMA-addition PRs (e.g. #50553, TeamViewer Host). --> - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] `apps.json` is valid JSON with descriptions filled in for all three editions - [x] Generator output reviewed: exists/patched queries, SHA256 (matches the live winget manifest), installer URLs - [x] `go build`/`go test ./ee/maintained-apps/...` pass; no shared ingester/validator code changed - [ ] FMA validator: install → detect → uninstall on a Windows host — **pending, needs a Windows host** - [ ] QA'd all new/changed functionality manually — **pending, same reason** ## FMA-specific (from issue #50653's acceptance criteria) - [x] Edition scope decided and recorded on the issue (all three: Community, Professional, Enterprise) - [x] Input added under `ee/maintained-apps/inputs/winget/` - [x] Custom install script handles `3010`/`1641` as success and fails clearly on `1618`/`1001` - [x] Custom uninstall script resolves the install path via `vswhere` and calls `vs_installer.exe uninstall` - [ ] Identity fields verified against a real installed host — **not yet, see above** - [ ] Patch policy verified against actual `programs.version` — **not yet, see above** - [ ] Install verified end to end within the 1-hour timeout on a normal-speed connection — **not yet** - [ ] Passes the FMA validator: install → detect → uninstall — **not yet** - [x] Icon exists (shared placeholder mark across all three editions — flagged for PD) No shared/ingester/validator code changed. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added Visual Studio 2022 Community, Professional, and Enterprise editions to the software catalog. - Added support for installing and uninstalling each edition with quiet execution, installation detection, error handling, and reboot handling. - Added version 17.14.37 metadata and update detection. - Added Visual Studio branding and edition-specific icons throughout the software interface. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Allen Houchins <allenhouchins@mac.com>	2026-08-07 10:59:27 -05:00
dependabot[bot]	12754cc48d	Bump js-yaml from 4.3.0 to 4.3.1 (#50745)	2026-08-07 09:59:11 -05:00
dependabot[bot]	b2ef218213	Bump js-yaml from 4.3.0 to 4.3.1 in /tools/fleet-slackbot (#50746)	2026-08-07 09:58:47 -05:00
Carlo DiCelico	66875070df	trigger CI	2026-08-07 10:58:21 -04:00
Carlo	3e166ac42b	Fix gofmt formatting in teams_test.go (#50769) ... **Related issue:** NA `main` is currently failing the `lint` job on a stray double blank line in `server/datastore/mysql/teams_test.go`: ``` server/datastore/mysql/teams_test.go:1209:1: File is not properly formatted (gofmt) ``` This is the `gofmt -w` output and nothing else — one blank line removed, no code change. # Checklist for submitter ## Testing - [ ] QA'd all new/changed functionality manually Whitespace-only change to a test file; no behaviour to QA. Verified `gofmt -l` on the file is empty and `go vet ./server/datastore/mysql/` is clean.	2026-08-07 11:51:12 -03:00
Jonathan Katz	4addc81ad2	Fix gofmt in teams_test.go after merge	2026-08-07 10:46:07 -04:00
Jonathan Katz	6ef4ba3910	Merge remote-tracking branch 'origin/main' into feat/39962-patch-when-closed	2026-08-07 10:12:53 -04:00
kitzy	f656ac533a	Update custom host vitals guide: style cleanup and Host vitals label support (#50660) ... **Related issue:** N/A ## Summary Audits and updates `articles/custom-host-vitals.md` against Fleet's guide-formatting and content-style skills, and documents that custom host vitals can be used as Host vitals label criteria: - Trimmed the opening from 3 paragraphs to 2, and added a sentence pointing to the new labels use case. - Renamed "Using a custom host vital in scripts and configuration profiles" → "Reference a custom host vital in scripts and configuration profiles" to match the imperative, action-led heading style used by sibling sections. - Dissolved the standalone "Known limitations and issues" section — its items are now `> **Note:**`/`> **Warning:**` callouts placed next to the step each one actually affects, instead of collected at the bottom. The delete-protection callout now also covers Host vitals labels, not just scripts/profiles. - Removed em dashes and bolding used for emphasis rather than UI elements, per Fleet's content style guide. - New "Filter hosts by a custom host vital" section (UI + GitOps) documenting the existing Host vitals label type's support for custom host vitals, including the current exact-match-only limitation. # Checklist for submitter - [ ] QA'd all new/changed functionality manually	2026-08-07 08:58:59 -05:00
Carlo DiCelico	d05146eedc	trigger CI	2026-08-07 09:45:18 -04:00
Nico	5a1365dc41	40493 webhooks for host activities (#50595) ... <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #40493 Changes already reviewed in the PRs merged to this feature branch. Only additive change was https://github.com/fleetdm/fleet/pull/50595/commits/c0934e1fee46a734f9499a4c782563d4fcc345c4 to address CodeRabbit's comments. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually https://github.com/user-attachments/assets/ea7f5157-a67a-4d83-842d-62197bd1546d ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Added host activity automations with configurable webhook destinations. * Manage automations from the Hosts page with validation, permissions, and enable/disable controls. * Added GitOps support for team and unassigned-host webhook settings. * Activity webhooks now include fleet-scoped host IDs where applicable. * Added profile UUIDs to MDM profile resend activity details. * **Bug Fixes** * Improved Windows MDM enrollment activity details by including the linked host ID when available. * Preserved existing webhook settings when omitted during updates. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-07 09:49:24 -03:00
NicoandLucas Manuel Rodriguez	358b8c43a5	iOS/iPadOS: More host vitals (#50496) ... <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #39281 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually https://github.com/user-attachments/assets/8ef7c66d-f8a6-46d5-ba17-66c1df8171b6 https://github.com/user-attachments/assets/6f67b49b-daf1-4acd-ad0f-55a7d1225a44 ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added 29 iOS/iPadOS device vitals to host details and API responses. * Added a “View all” modal for browsing complete device vitals, including subscriptions and accessibility details. * Added support for cellular technology, organization information, attestation data, and device settings. * **Privacy** * Personal/BYOD enrollments exclude expanded device-vitals fields. * Sensitive vitals are removed from device URL-authenticated responses. * **Bug Fixes** * Stale vitals are cleared when enrollment ownership changes or hosts are deleted. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>	2026-08-07 09:49:14 -03:00
Lucas Manuel Rodriguez	3de43c84af	Bump out-of-order migrations not included in v4.90.0 (#50690) ... <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Two migrations merged to `main` were not included in the v4.90.0 release but have timestamps older than `20260723181411_MultipleCustomPackagesPerTitle` (the latest migration shipped in v4.90.0). Databases already on v4.90.0 would never apply them, since goose only runs migrations newer than the current (highest applied) version. Bumped both to current timestamps via `tools/bump-migration`: - `20260721090128_AddTokenInvalidToABMTokens` → `20260806154139_AddTokenInvalidToABMTokens` - `20260721160351_AddHostMDMWindowsProfilesStatus` → `20260806154150_AddHostMDMWindowsProfilesStatus` No schema or logic changes — only the file names, `Up_`/`Down_`/`TestUp_` function names, and the regenerated `schema.sql` (`migration_status_tables` versions). Verified that none of the other unreleased migrations (20260724+) depend on the schema these two create, so applying them last is safe. # Checklist for submitter If some of the following don't apply, delete the relevant line. ## Testing - [x] Added/updated automated tests (existing migration tests renamed and re-run against MySQL) ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Database Updates** - Added support for tracking whether ABM tokens are invalid. - Added Windows MDM profile status tracking and backfilled existing records. - **Maintenance** - Updated database migration identifiers and status records to ensure migrations are applied consistently. - **Tests** - Updated migration verification tests to match the revised migration identifiers. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-07 08:40:19 -03:00
Rajendra Kadam	25cfac309c	Let an edit clear a declaration's activation (#50711) ... <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # Raised by the frontend while building the Edit modal: there was no way to clear a declaration's custom activation. An absent `activation` field meant "keep it" on a labels-only edit but "delete it" when the profile contents were replaced, so clearing wasn't expressible and an ordinary content edit silently dropped the activation. The field is now three-state: | Request | Result | |---|---| | no `activation` key | stored activation left alone | | `activation` as an empty value | removed | | `activation` as a file | replaced | Multipart has no null, so an empty value stands in for one. Note this changes one existing behaviour: replacing a profile's contents without sending an activation used to delete it, and now preserves it. Removal has to be explicit. Anything ambiguous is rejected rather than guessed at, since every ambiguous form would otherwise resolve to deleting the stored activation: | Request | Result | |---|---| | `activation` as a nonempty value | 422 — more likely a malformed upload than a request to delete | | `activation` as a zero-byte file | 422 — a failed upload shouldn't delete anything | | `activation` sent as both a file and a value | 422 — one says replace, the other says remove | The unsupported-profile check also keys on the field being present rather than on it carrying content, so clearing an activation on a Windows, Android or mobileconfig profile is rejected instead of quietly succeeding. On the datastore side, `SetOrUpdateMDMAppleDeclaration` now takes an explicit action (`MDMAppleActivationKeep` / `MDMAppleActivationApply`) instead of inferring intent from the struct. The write is a full replace, so "keep" has to be stated — otherwise preserving the activation would mean reading it back and handing it to the write, which also risked dropping its Fleet variable associations. As a side effect the OS updates cron no longer fires a DELETE for an activation it never had. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually Integration test covers all three states end to end through the multipart decoder, plus service-level tests for preserve and explicit removal. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Apple MDM declaration updates now support preserving, replacing, or explicitly removing activation settings. * Omitted activation fields leave existing settings unchanged, while empty fields remove them. * Apple OS update declarations retain activation settings by default. * **Bug Fixes** * Labels-only updates no longer unintentionally carry forward activation data. * Invalid, empty, or conflicting activation uploads now receive clear validation errors. * Unsupported profile types now reject activation updates. * **Tests** * Added coverage for activation preservation, replacement, removal, and integration scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-07 15:36:31 +05:30
Magnus Jensen	51d9f493ef	show user-scope icon for ios and ipados (#50715)	2026-08-07 10:00:23 +02:00
3 people	b5940c8eca	Bump brace-expansion in /website (#50453) ... Bumps and [brace-expansion](https://github.com/juliangruber/brace-expansion). These dependencies needed to be updated together. Updates `brace-expansion` from 2.1.2 to 2.1.4 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/juliangruber/brace-expansion/commit/b25213dff0446d622f97d736420b9830ee1abc32"><code>b25213d</code></a> 2.1.4</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac"><code>1e30c93</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/878df3989e816dfb28cbe0d64de0b88738ff0ed6"><code>878df39</code></a> 2.1.3</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/c8bd93cfff4e45cb295557d2be17e1d1d4e52a11"><code>c8bd93c</code></a> npm ignore .claude</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"><code>d13ff45</code></a> fix: backport GHSA-mh99-v99m-4gvg (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/130">#130</a>)</li> <li>See full diff in <a href="https://github.com/juliangruber/brace-expansion/compare/v2.1.2...v2.1.4">compare view</a></li> </ul> </details> <br /> Updates `brace-expansion` from 1.1.16 to 1.1.18 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/juliangruber/brace-expansion/commit/b25213dff0446d622f97d736420b9830ee1abc32"><code>b25213d</code></a> 2.1.4</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac"><code>1e30c93</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/878df3989e816dfb28cbe0d64de0b88738ff0ed6"><code>878df39</code></a> 2.1.3</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/c8bd93cfff4e45cb295557d2be17e1d1d4e52a11"><code>c8bd93c</code></a> npm ignore .claude</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"><code>d13ff45</code></a> fix: backport GHSA-mh99-v99m-4gvg (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/130">#130</a>)</li> <li>See full diff in <a href="https://github.com/juliangruber/brace-expansion/compare/v2.1.2...v2.1.4">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Luke Heath <luke@fleetdm.com> Co-authored-by: Eric <eashaw@sailsjs.com>	2026-08-06 22:54:40 -05:00
Allen Houchins	01f9e534f7	Fix Genesys Cloud FMA: winget dropped x86, ship x64 MSI (#50742) ... <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually # Details The nightly maintained-apps ingestion job panicked with `failed to find installer for app` on Genesys Cloud: ``` {"time":"2026-08-07T03:17:22.787715966Z","level":"INFO","msg":"ingesting winget app","name":"Genesys Cloud"} panic: ingesting winget app: failed to find installer for app ``` ## Why Genesys.GenesysCloud **2.53.923.0** stopped publishing x86 installers upstream. Previous versions (e.g. 2.51.916.0) shipped two x86 installers (a burn `.exe` and a wix `.msi`); the latest manifest ships only a single **x64** wix MSI. Our input pinned `installer_arch: "x86"`, so the ingester filtered out the only available installer and panicked. ## What changed - `ee/maintained-apps/inputs/winget/genesys-cloud.json`: `installer_arch` `x86` → `x64` - `ee/maintained-apps/outputs/genesys-cloud/windows.json`: regenerated with `go run ./cmd/maintained-apps -slug genesys-cloud/windows` — version 2.51.916.0 → 2.53.923.0, installer URL now the x64 MSI, sha256 matches the winget manifest's `InstallerSha256` ## Notes for reviewers - Exists/patched queries are unchanged (still keyed on ARP `name = 'GenesysCloud'`, `publisher = 'Genesys Inc.'`), and install/uninstall script refs are identical since it's still a machine-scope MSI — detection and remediation carry over for existing installs. - The MSI `UpgradeCode` is unchanged upstream (`{A0E8C487-C337-441C-83AF-90364DA4B793}`), so the x64 MSI upgrades existing x86 installs in place (ProductCode is new, install dir moves from `ProgramFiles(x86)` to `ProgramFiles`). - The new manifest declares a `Microsoft.VCRedist.2015+.x64` dependency (the old x86 MSI declared the x86 variant). Fleet doesn't resolve winget dependencies; the FMA validator run on this PR will confirm whether the installer tolerates its absence.	2026-08-06 22:33:07 -05:00
Leon Xu	4d9a175962	doc: created docker-publish workflow and the source file as well	2026-08-06 20:31:30 -07:00
kitzy	779704de89	Add guide: manage Fleet during a GitOps outage (#50731) ... <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA # Checklist for submitter - [x] Docs-only change (new guide article); no code, tests, migrations, settings, or fleetd/orbit changes. ## Summary Adds a new guide, `articles/manage-fleet-during-a-gitops-outage.md`, covering the business continuity workflow for making urgent changes in the Fleet UI when a CI provider (e.g. GitHub Actions) is down, and how to reconcile the GitOps repo afterward so the next automated run doesn't revert the fix.	2026-08-06 22:21:36 -05:00
Leon Xu	5ecbf8c937	file: remove docker-hub-publish file as it is no longer being used	2026-08-06 20:18:12 -07:00