Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 18 Packages Projects Releases Wiki Activity
26,791 Commits 2 Branches 0 Tags
imgbot
Commit Graph
343 Commits
Author SHA1 Message Date
dependabot[bot]andLucas Manuel Rodriguez 23cc1b45e8 Bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#50787) 
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git)
from 5.19.1 to 5.19.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's
releases</a>.</em></p>
<blockquote>
<h2>v5.19.2</h2>
<h2>What's Changed</h2>
<ul>
<li>build: Update module golang.org/x/crypto to v0.52.0 [SECURITY]
(releases/v5.x) by <a
href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot]
in <a
href="https://redirect.github.com/go-git/go-git/pull/2150">go-git/go-git#2150</a></li>
<li>build: Update module github.com/go-git/go-git/v5 to v5.19.1
[SECURITY] (releases/v5.x) by <a
href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot]
in <a
href="https://redirect.github.com/go-git/go-git/pull/2141">go-git/go-git#2141</a></li>
<li>build: Update module golang.org/x/net to v0.55.0 [SECURITY]
(releases/v5.x) by <a
href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot]
in <a
href="https://redirect.github.com/go-git/go-git/pull/2152">go-git/go-git#2152</a></li>
<li>git: Worktree: Add stores index entires with backslashes on Windows
by <a href="https://github.com/joshblum"><code>@​joshblum</code></a> in
<a
href="https://redirect.github.com/go-git/go-git/pull/2262">go-git/go-git#2262</a></li>
<li>storage: dotgit, reject path traversal in reference names by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2254">go-git/go-git#2254</a></li>
<li>build: Update module golang.org/x/net to v0.56.0 [SECURITY]
(releases/v5.x) by <a
href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot]
in <a
href="https://redirect.github.com/go-git/go-git/pull/2267">go-git/go-git#2267</a></li>
<li>build: Update module golang.org/x/text to v0.39.0 [SECURITY]
(releases/v5.x) by <a
href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot]
in <a
href="https://redirect.github.com/go-git/go-git/pull/2268">go-git/go-git#2268</a></li>
<li>[v5] git: worktree, make the filesystem wrapper a symlink-safe
boundary by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a>
in <a
href="https://redirect.github.com/go-git/go-git/pull/2277">go-git/go-git#2277</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2">https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/go-git/go-git/commit/3eeb238da61eb9c7a324f3ee04f990ce89175642"><code>3eeb238</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/2277">#2277</a>
from go-git/checkout-v5</li>
<li><a
href="https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"><code>008a78f</code></a>
git: worktree, make the filesystem wrapper a symlink-safe boundary</li>
<li><a
href="https://github.com/go-git/go-git/commit/2263fb5f022dde90b1c2845f028d3e37e161f2b8"><code>2263fb5</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/2268">#2268</a>
from go-git/renovate/releases/v5.x-go-golang.org-x-t...</li>
<li><a
href="https://github.com/go-git/go-git/commit/77b76250d93ec83e2c897638d8a3847b1bfaa38d"><code>77b7625</code></a>
build: Update module golang.org/x/text to v0.39.0 [SECURITY]</li>
<li><a
href="https://github.com/go-git/go-git/commit/85ea767be2b2281693e61afe83911e12c86d6eb7"><code>85ea767</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/2267">#2267</a>
from go-git/renovate/releases/v5.x-go-golang.org-x-n...</li>
<li><a
href="https://github.com/go-git/go-git/commit/198675a07b3b8f4eb8f51bf188663a13bb0d9e1a"><code>198675a</code></a>
build: Update module golang.org/x/net to v0.56.0 [SECURITY]</li>
<li><a
href="https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7"><code>4a0e66d</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/2254">#2254</a>
from pjbgf/v5-dotgit-ref-name-containment</li>
<li><a
href="https://github.com/go-git/go-git/commit/3b306ef83bd05194a30ce820eed7ed61c3084b5f"><code>3b306ef</code></a>
storage: dotgit, align reference-name safety with refname_is_safe</li>
<li><a
href="https://github.com/go-git/go-git/commit/f3d0cc150b39ae1dc47406a5c170464286914610"><code>f3d0cc1</code></a>
storage: dotgit, reject path traversal in reference names</li>
<li><a
href="https://github.com/go-git/go-git/commit/979cfe9c561d3ced778c88d9cde6db3297e6ed1d"><code>979cfe9</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/2262">#2262</a>
from joshblum/joshblum/to-slash-v5</li>
<li>Additional commits viewable in <a
href="https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.19.1&new-version=5.19.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
 2026-08-07 14:34:00 -03:00
Luke Heath d628cb338b Bump Go and npm dependencies to resolve high-severity code scanning alerts (#50314) 2026-07-31 12:10:54 -05:00
dependabot[bot]andLucas Manuel Rodriguez 3d4cf0dfee Bump google.golang.org/grpc from 1.79.3 to 1.82.1 (#49957) 
- [X] QA'd all new/changed functionality manually

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from
1.79.3 to 1.82.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's
releases</a>.</em></p>
<blockquote>
<h2>Release 1.82.1</h2>
<h1>Security</h1>
<ul>
<li>server: Stop reading from the connection when flooded by HTTP/2
frames. The default value for this limit is 100 frames, excluding DATA
and HEADERS, and may be changed by setting environment variable
<code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li>
<li>xds/rbac: Support <code>Metadata</code> and
<code>RequestedServerName</code> permissions matcher fields. If present
in a DENY rule, previously these would be ignored and fail-open.</li>
<li>xds/rbac: Fix panic when parsing unsupported fields in
<code>NotRule</code>/<code>NotId</code> permissions.</li>
<li>xds/rbac: Support the deprecated <code>source_ip</code> principal
identifier by treating it as equivalent to
<code>direct_remote_ip</code>.</li>
</ul>
<h2>Release 1.82.0</h2>
<h1>Behavior Changes</h1>
<ul>
<li>server: Remove support for
<code>GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING</code>
environment varibale. Strict incoming RPC path validation (which has
been the default since <code>v1.79.3</code>) can no longer be disabled.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9112">#9112</a>)</li>
<li>transport: Add environment variable to change the default max header
list size from <code>16MB</code> to <code>8KB</code>. This may be
enabled by setting
<code>GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true</code>.
This will be enabled by default in a subsequent release. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9019">#9019</a>)</li>
<li>balancer: Load Balancing policy registry is now case-sensitive. Set
<code>GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false</code>
(and file an issue) to revert to case-insensitive behavior. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9017">#9017</a>)</li>
</ul>
<h1>New Features</h1>
<ul>
<li>experimental/stats: Expose a new API,
<code>NewContextWithLabelCallback</code>, to register a callback that is
invoked when telemetry labels are added. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8877">#8877</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/seth-epps"><code>@​seth-epps</code></a></li>
</ul>
</li>
<li>client: Return a portion of the response body in the error message,
when the client receives an unexpected non-gRPC HTTP response, to make
debugging easier. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/chengxilo"><code>@​chengxilo</code></a></li>
</ul>
</li>
<li>server: Add environment variable
<code>GRPC_GO_SERVER_GOROUTINE_LABELS</code> that controls setting
<code>runtime/pprof.Labels</code> on goroutines spawned by the server.
Set <code>GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true</code> to add
the <code>grpc.method</code> label on goroutines spawned to handle
incoming requests. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/dfinkel"><code>@​dfinkel</code></a></li>
</ul>
</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>xds/server: Fix a memory leak of HTTP filter instances occurring
when route configurations are updated in-place during a Route Discovery
Service (RDS) update. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9138">#9138</a>)</li>
<li>grpc: In the deprecated <code>gzip</code> Compressor (used via the
deprecated <code>WithCompressor</code> dial option), enforce the
<code>MaxRecvMsgSize</code> limit on the decompressed message buffer,
preventing excessive memory allocation from highly compressed payloads.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9114">#9114</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/evilgensec"><code>@​evilgensec</code></a></li>
</ul>
</li>
<li>stats/opentelemetry: Record retry attempts,
<code>grpc.previous-rpc-attempts</code>, at the call level and not the
attempt level. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8923">#8923</a>)</li>
<li>encoding: Ensure <code>Close()</code> is always called on readers
returned from <code>Compressor.Decompress</code> if possible. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9135">#9135</a>)</li>
<li>channelz: Fix the <code>LastMessageSentTimestamp</code> and
<code>LastMessageReceivedTimestamp</code> fields in
<code>SocketMetrics</code> to ensure they contain correct timestamp
values. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9109">#9109</a>)</li>
</ul>
<h2>Release 1.81.1</h2>
<h1>Security</h1>
<ul>
<li>xds/rbac: Fix a potential authorization bypass caused by incorrectly
falling through URI/DNS SANs to Subject Distinguished Name (DN) when
matching the authenticated principal name. With this fix, only the first
non-empty identity source will be used, as per <a
href="https://github.com/grpc/proposal/blob/master/A41-xds-rbac.md">gRFC
A41</a>. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9111">#9111</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/al4an444"><code>@​al4an444</code></a></li>
</ul>
</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>otel: Segregate client and server RPC information used for metrics
and traces, to avoid one overwriting the other. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9081">#9081</a>)</li>
</ul>
<h2>Release 1.81.0</h2>
<h1>Behavior Changes</h1>
<ul>
<li>balancer/rls: Switch gauge metrics to asynchronous emission (once
per collection cycle) to reduce telemetry noise and align with other
gRPC language implementations. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8808">#8808</a>)</li>
</ul>
<h1>Dependencies</h1>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/grpc/grpc-go/commit/ebd8f06a09426fbece97157c95c3917abff28f4e"><code>ebd8f06</code></a>
Change version to 1.82.1 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9238">#9238</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935"><code>4ea465d</code></a>
Cherry-pick commits (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9236">#9236</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/9494a2cf32a0ec9d35420af401445ef3c9f66f05"><code>9494a2c</code></a>
Change version to 1.82.1-dev (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9171">#9171</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/bd239854f0ab7f1ee63457d47f7c1d2675e1f736"><code>bd23985</code></a>
Change version to 1.82.0 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9170">#9170</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/0f3086db7a755b6af83a90809471dd7f645b345a"><code>0f3086d</code></a>
Fix minor issues not covered by PR <a
href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a>
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9147">#9147</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/fef07fbb2b94b668e8daca1f6b70433dcd36c1c8"><code>fef07fb</code></a>
internal: Split v3procservicepb import into pb and grpc for extproc (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9163">#9163</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/91dd64f4b83cb5134e279d1126ebb1ccf47d4d31"><code>91dd64f</code></a>
transport: surface subsequent data when receiving non-gRPC header (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/adc97de9521a9f377dab5e911039842dc4de23e5"><code>adc97de</code></a>
test/kokoro: add config for regional-td test (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9158">#9158</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/57c9ff14e05b535ee6995ba49bc882b287a175de"><code>57c9ff1</code></a>
xds: ensure full-string matching for RBAC Filter rules (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9148">#9148</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/b58f32d9ff07c612d64e677bd826bcbec88af9bd"><code>b58f32d</code></a>
server: Set a pprof label on new stream goroutines (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/grpc/grpc-go/compare/v1.79.3...v1.82.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.79.3&new-version=1.82.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
 2026-07-28 11:40:25 -03:00
Dante Catalfamo 0fe0e0038b Add ai_tools fleetd table (#49243) 
**Related issue:** Resolves #47619
 2026-07-16 15:59:19 -04:00
Lucas Manuel Rodriguez 60d8f51374 Move test/upgrade to tools/ to reduce security scanning noise (#49158) 
Two reasons:
- It's a testing/QA tool, so it should be under `tools/`
- Reduce security-noise because it's just an internal tool (all findings
under tools/ should be ignored).

Failing dependency review expected because of the security findings in
the docker Go packages. (Which can be fixed/updated when a patch is
issued but without urgency because this is an internal tool.)

## Testing

- [x] QA'd all new/changed functionality manually

Ran:
```
cd tools/upgrade
FLEET_VERSION_A=v4.87.1 FLEET_VERSION_B=v4.88.1 go test
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **New Features**
  * Added an end-to-end upgrade test scenario across two Fleet versions.
* Added a Docker Compose-based upgrade environment (Fleet, MySQL, Redis,
osquery) with local TLS certs/keys and osquery flags.

* **Tests**
* Added automated Fleet readiness checks and host enrollment
verification before and after upgrade.

* **Chores / Security**
* Updated the database upgrade test workflow and Go module tooling for
the new upgrade test setup.
* Adjusted secret scanning allow-rules and refreshed Go dependencies for
the upgrade module.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-13 11:17:37 -03:00
Jordan MontgomeryCopilot Autofix powered by AIMagnus Jensen
 		a33481653d macos password sync feature branch (#47422) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45524

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added Apple Platform SSO (PSSO) for macOS with device registration,
sign-in, and public discovery (JWKS + Apple app-site association)
protected by single-use nonces.
* Added Apple account provisioning (Platform SSO password sync)
configuration with masked client-secret handling and GitOps support.
* Added a host-scoped PSSO device registration token variable for Apple
MDM profile generation.
* **Bug Fixes**
* Fixed macOS packaging to correctly build, embed, and sign the Platform
SSO extension.
* Resetting device Apple MDM data now also clears stored PSSO enrollment
records.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
 2026-07-09 14:57:48 -04:00
Lucas Manuel Rodriguez 21c024313a Upgrade nfpm package in fleetctl (#48961) 
Resolves #48954.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [X] QA'd all new/changed functionality manually
Tested a package generated with new `fleetctl` on Fedora 43, Ubuntu
25.04, and Omarchy.

## fleetd/orbit/Fleet Desktop

- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary of changes

* **Bug Fixes**
* Improved Linux RPM packaging consistency, including more reliable
output filename normalization and correct platform metadata.
* Ensured RPM metadata extraction stays aligned with the updated
packaging flow.
* **Tests**
  * Added coverage for RPM filename normalization edge cases.
* Updated a CPE rule validation test expectation to match the new
error-string format.
* **Chores**
  * Upgraded packaging tooling and refreshed Go dependencies.
* **Security**
* Removed a previously ignored CVE entry from vulnerability scan ignore
settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-09 15:29:48 -03:00
Lucas Manuel Rodriguez 703dcf0b4f Update go to 1.26.5 (#48993) 
Resolves #48988.

I ran `make update-go version=1.26.5`.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [X] QA'd all new/changed functionality manually

Fleet:
<img width="301" height="102" alt="Screenshot 2026-07-09 at 8 41 49 AM"
src="https://github.com/user-attachments/assets/baf76ce7-6192-4506-a9db-52f5318939ee"
/>
fleetctl:
```
fleetctl --version
fleetctl - version orbit-v1.57.0-402-ge3d0c005dc
  branch:       48988-update-go-1.26.5
  revision:     e3d0c005dc6698c024ad47a124c99e4f264855a0
  build date:   2026-07-09
  build user:   lucas
  go version:   go1.26.5
```
Also verified orbit in Linux:
<img width="582" height="121" alt="Screenshot 2026-07-09 at 8 51 55 AM"
src="https://github.com/user-attachments/assets/65672676-8010-45a1-8c28-9f9959e72134"
/>


## fleetd/orbit/Fleet Desktop

- [X] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [X] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
  * Updated the project and all included tooling modules to Go 1.26.5.
* Refreshed build images used by desktop Linux, load testing, and
related utilities to the newer Go toolchain.
  * Updated change log entries to reflect the Go version bump.

* **Bug Fixes**
* Improved the automation that refreshes Go-pinned Docker image
references to resolve and apply correct digests, helping prevent broken
build images.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-09 11:20:45 -03:00
Luke Heath 2b50257de9 Bump golang.org/x/image to v0.42.0 (CVE-2026-33813) (#48345) 2026-06-26 11:24:16 -07:00
dependabot[bot]andLucas Manuel Rodriguez 33cbc192b2 Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 (#47959) 
Bumps
[github.com/containerd/containerd](https://github.com/containerd/containerd)
from 1.7.32 to 1.7.33.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/containerd/containerd/releases">github.com/containerd/containerd's
releases</a>.</em></p>
<blockquote>
<h2>containerd 1.7.33</h2>
<p>Welcome to the v1.7.33 release of containerd!</p>
<p>The thirty-third patch release for containerd 1.7 contains various
fixes
and updates including security patches.</p>
<h3>Security Updates</h3>
<ul>
<li>
<p><strong>containerd</strong></p>
<ul>
<li><a
href="https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp"><strong>CVE-2026-53488</strong></a></li>
<li><a
href="https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq"><strong>CVE-2026-47262</strong></a></li>
</ul>
</li>
<li>
<p><strong>go-jose</strong></p>
<ul>
<li><a
href="https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"><strong>CVE-2026-34986</strong></a></li>
</ul>
</li>
</ul>
<p>Please try out the release binaries and report any issues at
<a
href="https://github.com/containerd/containerd/issues">https://github.com/containerd/containerd/issues</a>.</p>
<h3>Contributors</h3>
<ul>
<li>Samuel Karp</li>
<li>Chris Henzie</li>
<li>Akihiro Suda</li>
<li>Akhil Mohan</li>
<li>Ben Cressey</li>
<li>Davanum Srinivas</li>
<li>Sopho Merkviladze</li>
</ul>
<h3>Changes</h3>
<!-- raw HTML omitted -->
<ul>
<li>Prepare release notes for v1.7.33 (<a
href="https://redirect.github.com/containerd/containerd/pull/13631">#13631</a>)
<ul>
<li><a
href="https://github.com/containerd/containerd/commit/7517e6737a6077dbdb5d403e693169cb8163549d"><code>7517e6737</code></a>
Prepare release notes for v1.7.33</li>
<li><a
href="https://github.com/containerd/containerd/commit/ab306518a326fe7e4c27f64a8cf62b7a0fb3e9c6"><code>ab306518a</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/containerd/containerd/commit/d34cdafdaf51e1db435f1e0898f16d0da5038557"><code>d34cdafda</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/containerd/containerd/commit/9ab2b7a894d15738f8323f69def272c29277b57f"><code>9ab2b7a89</code></a>
Bound user-database file reads in openBoundedUserFile</li>
<li><a
href="https://github.com/containerd/containerd/commit/1e9806f90d934f2e0180c279fa9f0019537f2704"><code>1e9806f90</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/containerd/containerd/commit/4d8ba4d23561c9ec21b0113ddcfc22f41792b25e"><code>4d8ba4d23</code></a>
Do not propagate reserved labels from image configs</li>
</ul>
</li>
<li>update runc binary to v1.3.6 (<a
href="https://redirect.github.com/containerd/containerd/pull/13615">#13615</a>)
<ul>
<li><a
href="https://github.com/containerd/containerd/commit/74c728c13487844c43620b14cc66dc05dca96836"><code>74c728c13</code></a>
update runc binary to v1.3.6</li>
</ul>
</li>
<li>update go to 1.26.4/1.25.11 (<a
href="https://redirect.github.com/containerd/containerd/pull/13579">#13579</a>)
<ul>
<li><a
href="https://github.com/containerd/containerd/commit/947caa4b7469fd3b71ee62d0f7410b00252f5842"><code>947caa4b7</code></a>
update go to 1.26.4/1.25.11</li>
</ul>
</li>
<li>Configure udevd children-max for root-test (<a
href="https://redirect.github.com/containerd/containerd/pull/13564">#13564</a>)
<ul>
<li><a
href="https://github.com/containerd/containerd/commit/e884e964e31c4fb61fcdc376a2fa3151ac245a65"><code>e884e964e</code></a>
Configure udevd children-max for root-test</li>
</ul>
</li>
<li>Clean up disk space in node e2e workflow (<a
href="https://redirect.github.com/containerd/containerd/pull/13552">#13552</a>)
<ul>
<li><a
href="https://github.com/containerd/containerd/commit/b9e7568888325736b12c9f50271045bc618dc9b9"><code>b9e756888</code></a>
Clean up disk space in node e2e workflow</li>
</ul>
</li>
<li>Bump go-jose/go-jose/v3 to v3.0.5 to fix GHSA-78h2-9frx-2jm8 (<a
href="https://redirect.github.com/containerd/containerd/pull/13467">#13467</a>)
<ul>
<li><a
href="https://github.com/containerd/containerd/commit/4dfc1844e8cb46a6c04a8c57211ab50e1412ccc1"><code>4dfc1844e</code></a>
Bump go-jose to v3.0.5 to address CVE-2026-34986</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/containerd/containerd/commit/e8b1a9bc270f9952197c470b8bad573b03a3a608"><code>e8b1a9b</code></a>
Merge pull request <a
href="https://redirect.github.com/containerd/containerd/issues/13631">#13631</a>
from samuelkarp/prepare-1.7.33</li>
<li><a
href="https://github.com/containerd/containerd/commit/7517e6737a6077dbdb5d403e693169cb8163549d"><code>7517e67</code></a>
Prepare release notes for v1.7.33</li>
<li><a
href="https://github.com/containerd/containerd/commit/ab306518a326fe7e4c27f64a8cf62b7a0fb3e9c6"><code>ab30651</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/containerd/containerd/commit/096289897c75f26f9b1e7a805acde329fa048a96"><code>0962898</code></a>
Merge pull request <a
href="https://redirect.github.com/containerd/containerd/issues/13615">#13615</a>
from k8s-infra-cherrypick-robot/cherry-pick-13606-t...</li>
<li><a
href="https://github.com/containerd/containerd/commit/74c728c13487844c43620b14cc66dc05dca96836"><code>74c728c</code></a>
update runc binary to v1.3.6</li>
<li><a
href="https://github.com/containerd/containerd/commit/d34cdafdaf51e1db435f1e0898f16d0da5038557"><code>d34cdaf</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/containerd/containerd/commit/1e9806f90d934f2e0180c279fa9f0019537f2704"><code>1e9806f</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/containerd/containerd/commit/9ab2b7a894d15738f8323f69def272c29277b57f"><code>9ab2b7a</code></a>
Bound user-database file reads in openBoundedUserFile</li>
<li><a
href="https://github.com/containerd/containerd/commit/d805d96d67b205a40d3c12414ec306d19ec2d848"><code>d805d96</code></a>
Merge pull request <a
href="https://redirect.github.com/containerd/containerd/issues/13579">#13579</a>
from akhilerm/1.7-go1.26.4</li>
<li><a
href="https://github.com/containerd/containerd/commit/947caa4b7469fd3b71ee62d0f7410b00252f5842"><code>947caa4</code></a>
update go to 1.26.4/1.25.11</li>
<li>Additional commits viewable in <a
href="https://github.com/containerd/containerd/compare/v1.7.32...v1.7.33">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/containerd/containerd&package-manager=go_modules&previous-version=1.7.32&new-version=1.7.33)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
 2026-06-22 09:23:41 -03:00
Jordan MontgomeryandCopilot Autofix powered by AI 3f6ce1e4bf Initial move of fleet desktop app (#47181) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46937

Moves fleet desktop standalone app from
https://github.com/allenhouchins/fleet-desktop into the monorepo

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

No changes file. Do we want to create a new changes directory and
changelog for this? Unclear

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

Downloaded build from CI, tested locally and installed via Fleet on a
mac mini. Launched and tested there - all looks good
<img width="1485" height="544" alt="Screenshot 2026-06-09 at 4 27 59 PM"
src="https://github.com/user-attachments/assets/48611808-2265-43b7-a514-afc4f578a9f8"
/>



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Launched Fleet Desktop macOS app with web-based self-service UI.
* Added fleet:// URL handling to trigger in-app actions (refetch, update
all).
  * Dock badge shows failing policies count in real time.
* Built-in token refresh, retries, and navigation error handling for
reliability.
  * MDM configuration support for enterprise deployment.
* Automated macOS packaging with code signing, notarization, and
artifact upload.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-06-15 10:18:09 -04:00
Lucas Manuel RodriguezVictor LyuboslavskyCopilot Autofix powered by AI
 		6d67565b14 Update Go to 1.26.4 (#47158) 
Resolves #47159.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] QA'd all new/changed functionality manually

## fleetd/orbit/Fleet Desktop

- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated the Go toolchain to 1.26.4 across modules, Docker build
stages, and build/configuration records to standardize the toolchain
version used for builds and tooling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-06-09 12:55:10 -03:00
Luke Heath f50fea0f42 Bump golang.org/x/crypto to v0.52.0 and golang.org/x/net to v0.55.0 (#46949) 2026-06-08 14:30:58 -05:00
dependabot[bot] 43869a1d86 Bump github.com/containerd/containerd from 1.7.29 to 1.7.32 (#46030) 2026-05-22 08:34:48 -05:00
dependabot[bot] 9115f0c4ff Bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#45815) 
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git)
from 5.19.0 to 5.19.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's
releases</a>.</em></p>
<blockquote>
<h2>v5.19.1</h2>
<h2>What's Changed</h2>
<ul>
<li>v5: plumbing: transport/ssh, Shell-quote path by <a
href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2068">go-git/go-git#2068</a></li>
<li>v5: git: submodule, Fix relative URL resolution by <a
href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2070">go-git/go-git#2070</a></li>
<li>v5: git: submodule, canonical remote for relative URLs by <a
href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2074">go-git/go-git#2074</a></li>
<li>v5: git: submodule, error on remote without URLs by <a
href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2078">go-git/go-git#2078</a></li>
<li>v5: plumbing: format/idxfile, Validate offset64 indices by <a
href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2084">go-git/go-git#2084</a></li>
<li>v5: *: Reject malformed variable-length integers by <a
href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2092">go-git/go-git#2092</a></li>
<li>v5: plumbing: format/packfile, Tighten delta validation by <a
href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2091">go-git/go-git#2091</a></li>
<li>v5: Add <code>worktreeFilesystem</code> wrapper for worktree and
hardening by <a
href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2100">go-git/go-git#2100</a></li>
<li>v5: config: validate submodule names by <a
href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2082">go-git/go-git#2082</a></li>
<li>build: Update module github.com/go-git/go-git/v5 to v5.19.0
[SECURITY] (releases/v5.x) by <a
href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot]
in <a
href="https://redirect.github.com/go-git/go-git/pull/2111">go-git/go-git#2111</a></li>
<li>v5: git: Allow MkdirAll on worktree-root paths by <a
href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2117">go-git/go-git#2117</a></li>
<li>v5: git: Stop validating symlink target paths by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2116">go-git/go-git#2116</a></li>
<li>v5: plumbing: format decoder input bounds and contracts by <a
href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2125">go-git/go-git#2125</a></li>
<li>plumbing: format/packfile, cap delta chain depth in parser by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2137">go-git/go-git#2137</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1">https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/go-git/go-git/commit/3c3be601aa6c0fd0d536c0d1e4f898b4c60e65fe"><code>3c3be60</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/2137">#2137</a>
from go-git/validate-v5</li>
<li><a
href="https://github.com/go-git/go-git/commit/3fba897bd9e84b1aec170fa708b80e297b7d6cf6"><code>3fba897</code></a>
plumbing: format/packfile, cap delta chain depth in parser</li>
<li><a
href="https://github.com/go-git/go-git/commit/a97d6601c85e017bb64c2b0f2e3169f6ef6a6709"><code>a97d660</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/2125">#2125</a>
from hiddeco/v5/format-input-bounds</li>
<li><a
href="https://github.com/go-git/go-git/commit/aeaa125c8af8e4c4c95b574c22c5633e97fc436e"><code>aeaa125</code></a>
plumbing: format/objfile, require Header before Read</li>
<li><a
href="https://github.com/go-git/go-git/commit/1f38e171218526ea254a73187a52f0648253c1b8"><code>1f38e17</code></a>
plumbing: format/packfile, bound inflate size</li>
<li><a
href="https://github.com/go-git/go-git/commit/f7545a02529e03998d6a7219140dc0e6644ad337"><code>f7545a0</code></a>
plumbing: format/idxfile, bound nr by file size</li>
<li><a
href="https://github.com/go-git/go-git/commit/170b88181f385913a457a08b68c88956fb3f8e4f"><code>170b881</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/2116">#2116</a>
from pjbgf/symlink-v5</li>
<li><a
href="https://github.com/go-git/go-git/commit/7b6d994467f06630268904aa3c441b6de7248b31"><code>7b6d994</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/2117">#2117</a>
from hiddeco/v5/worktree-fs-mkdirall-root-noop</li>
<li><a
href="https://github.com/go-git/go-git/commit/f0709b32f8fbb87c16cd63c6762d2cd515f36541"><code>f0709b3</code></a>
git: Stop validating symlink target paths</li>
<li><a
href="https://github.com/go-git/go-git/commit/776d00f11d336f26862d0f2bab987b217f3a7844"><code>776d00f</code></a>
git: Allow MkdirAll on worktree-root paths</li>
<li>Additional commits viewable in <a
href="https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.19.0&new-version=5.19.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-19 15:15:18 -03:00
Scott Gress d7fa35e417 Implement roaring bitmaps for historical data collection (#45709) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45715 

# Details

This PR refactors the way the charts module stores historical data to
use the [roaring bitmap](https://github.com/RoaringBitmap/roaring)
package instead of saving raw bitmaps. See [this
blurb](https://github.com/RoaringBitmap/roaring#how-does-roaring-compares-with-the-alternatives)
to learn how roaring compresses data, but TL;DR for our purposes it
represents a huge improvement especially for larger deployments where
host ID numbers may be very large. In testing, some data was reduced
96%.

The majority of the changes in this PR are straight swapping of types
from `[]byte` to `*roaring.Bitmap` in vars and function signatures, and
updating the internals of our bit math helpers to use roaring methods
instead of native AND and OR methods. I've tried to comment on all
functional changes.

Since the charts have been shipped already, so there will be data in the
wild in the prior "dense" format, the code still handles dense bitmaps
on _read_, but will always _write_ roaring bitmaps. The majority of the
data will therefore have turned over within 30 days on its own, but I
plan on a follow-up PR that will transform open rows when the cron runs
so that we should be guaranteed to turn over completely within 30 days.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [X] Added/updated automated tests
- Tests updated to accommodate the new format, and existing unchanged
tests act as proof against regression
- [X] QA'd all new/changed functionality manually
- Using a tool that dumps the `host_scd_data` rows data into a JSON file
(with the keys being entity_id+data and the values being host IDs on
that date), compared the data from main branch and this and confirmed
they're identical
- With a host count of ~9000, some of which have IDs of over 1,000,000,
the data storage requirements were:
     * 82,558,976 bytes for dense
     * 2,867,200 for roaring (a 96% decrease)

For unreleased bug fixes in a release candidate, one of:

- [X] Confirmed that the fix is not expected to adversely impact load
test results
  - should hugely improve
- [X] Alerted the release DRI if additional load testing is needed

## Database migrations

- [X] Checked schema for all modified table for columns that will
auto-update timestamps during migration.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Implemented roaring bitmaps in historical data collection to optimize
bitmap handling for chart data aggregation
* Added encoding support to bitmap storage schema for flexible data
representation

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-19 09:34:29 -05:00
Luke Heath f4b6b45997 Bump Go to 1.26.3 to clear stdlib CVEs (#45277) 2026-05-12 17:19:16 -05:00
dependabot[bot] 9476bc9fcd Bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 (#45146) 
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git)
from 5.18.0 to 5.19.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's
releases</a>.</em></p>
<blockquote>
<h2>v5.19.0</h2>
<h2>What's Changed</h2>
<ul>
<li>build: Update module github.com/go-git/go-git/v5 to v5.18.0
[SECURITY] (releases/v5.x) by <a
href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot]
in <a
href="https://redirect.github.com/go-git/go-git/pull/2010">go-git/go-git#2010</a></li>
<li>v5: Bump sha1cd and go-billy by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2060">go-git/go-git#2060</a></li>
<li>v5: Align object encoding with upstream by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2065">go-git/go-git#2065</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-git/go-git/compare/v5.18.0...v5.19.0">https://github.com/go-git/go-git/compare/v5.18.0...v5.19.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/go-git/go-git/commit/bc930f4cbe095a3e1d49273655f73fcef7d41a42"><code>bc930f4</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/2065">#2065</a>
from go-git/commit-v5</li>
<li><a
href="https://github.com/go-git/go-git/commit/d315264343cead712aa9eb56475c2ec96f5ecef1"><code>d315264</code></a>
plumbing: object, Reset object before decode</li>
<li><a
href="https://github.com/go-git/go-git/commit/6e1d34890a4dae8a0df738e531234bd60b7e9b66"><code>6e1d348</code></a>
plumbing: object, Align Tree handling with upstream</li>
<li><a
href="https://github.com/go-git/go-git/commit/e134ba34cf95ed0167e5b1df36a933d7bde9d02d"><code>e134ba3</code></a>
tests: Skip double checks in Git v2.11</li>
<li><a
href="https://github.com/go-git/go-git/commit/1971422f6b1bec9176061b3293306981cfff981e"><code>1971422</code></a>
tests: Add git conformance tests for signing verification</li>
<li><a
href="https://github.com/go-git/go-git/commit/a387aa8857a8fbba8e74b7f5485e9e030669ab5d"><code>a387aa8</code></a>
plumbing: object, Add ErrMalformedTag</li>
<li><a
href="https://github.com/go-git/go-git/commit/f415670d906b5c6169d1fdc64f3f9f1d33eb6f9c"><code>f415670</code></a>
plumbing: object, Decode Tag headers via a state machine</li>
<li><a
href="https://github.com/go-git/go-git/commit/5b0cd38a62e2336bb5f1a2ad0eb8ac8f9e7b740e"><code>5b0cd38</code></a>
plumbing: object, Reject multi-signature commits at Verify</li>
<li><a
href="https://github.com/go-git/go-git/commit/fe8ed6223a6079d9fd84d853362a996e7df175fb"><code>fe8ed62</code></a>
plumbing: object, Align Tag.EncodeWithoutSignature with Commit</li>
<li><a
href="https://github.com/go-git/go-git/commit/98e337d5bdc4c0536a40ab7381b2231f7e0b15cd"><code>98e337d</code></a>
plumbing: object, Add support for Tag.SignatureSHA256</li>
<li>Additional commits viewable in <a
href="https://github.com/go-git/go-git/compare/v5.18.0...v5.19.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.18.0&new-version=5.19.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-11 14:18:44 -03:00
dependabot[bot] 3292f0eb47 Bump github.com/apache/thrift from 0.22.0 to 0.23.0 (#44889) 
Bumps [github.com/apache/thrift](https://github.com/apache/thrift) from
0.22.0 to 0.23.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/apache/thrift/releases">github.com/apache/thrift's
releases</a>.</em></p>
<blockquote>
<h2>Version 0.23.0</h2>
<p>Please head over to the official release download source:
<a
href="http://thrift.apache.org/download">http://thrift.apache.org/download</a></p>
<p>The assets listed below are added by Github based on the release tag
and they will therefore not match the checkums published on the Thrift
project website.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/apache/thrift/blob/master/CHANGES.md">github.com/apache/thrift's
changelog</a>.</em></p>
<blockquote>
<h2>0.23.0</h2>
<h3>Build Process</h3>
<ul>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5877">THRIFT-5877</a>
- Add cpp cross tests</li>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5866">THRIFT-5866</a>
- Dockerfile to support Ubuntu 24.04 LTS (Noble Numbat)</li>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5909">THRIFT-5909</a>
- add Ruby in GitHub workflow</li>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5649">THRIFT-5649</a>
- add go in GitHub workflow / action</li>
</ul>
<h3>C glib</h3>
<ul>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5931">THRIFT-5931</a>
- thrift_ssl_socket_get_ssl_error() can underflow its remaining-buffer
counter and write past the stack buffer</li>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5871">THRIFT-5871</a>
- Improve MAX_MESSAGE_SIZE check and friends</li>
</ul>
<h3>C++</h3>
<ul>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5911">THRIFT-5911</a>
- Inconsistent UUID compilation for aliased types</li>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5912">THRIFT-5912</a>
- Assertion failed: <code>delta &gt; 0</code>, file
ThreadManagerTests.h, line 162</li>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5880">THRIFT-5880</a>
- C++ TSocket on an IPv6-only system fails if you use a hostname of
127.0.0.1</li>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-3268">THRIFT-3268</a>
- warning: token pasting of ',' and <code>__VA_ARGS__</code> is a GNU
extension</li>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5887">THRIFT-5887</a>
- build/cmake/ should be prepended (not appended) to
CMAKE_MODULE_PATH</li>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5878">THRIFT-5878</a>
- Add UUID support for THeaderProtocol and TProtocolTap</li>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5898">THRIFT-5898</a>
- Unable to build Thrift as a shared library on Windows</li>
</ul>
<h3>Contributed</h3>
<ul>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5920">THRIFT-5920</a>
- Remove threadsafe warnings in thrift-maven-plugin</li>
</ul>
<h3>Delphi</h3>
<ul>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5939">THRIFT-5939</a>
- Replace GUID generation with stable UUID algorithm</li>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5876">THRIFT-5876</a>
- Add Delphi WinHTTP client TLS1.3 support</li>
</ul>
<h3>Go</h3>
<ul>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5896">THRIFT-5896</a>
- Race condition in TServerSocket.Addr() method</li>
</ul>
<h3>Java</h3>
<ul>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5925">THRIFT-5925</a>
- UUID implementation in JAVA is not according to the Thrift
Specification</li>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5869">THRIFT-5869</a>
- Close the transport after TServerEventHandler deleteContext</li>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5863">THRIFT-5863</a>
- Make TServerTransport able to customize the max message size</li>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5774">THRIFT-5774</a>
- Add remote client's IP address to ServerContext in
TServerEventHandler</li>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-4280">THRIFT-4280</a>
- Add async nonblocking ssl support in java client</li>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5879">THRIFT-5879</a>
- java and kotlin cross tests fail in the GitHub action</li>
</ul>
<h3>netstd</h3>
<ul>
<li><a
href="https://issues.apache.org/jira/browse/THRIFT-5902">THRIFT-5902</a>
- Add net10 support</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/apache/thrift/commit/e4b684f5ff4f9c3a42cd7ec0a667c3d9bd7f6ac1"><code>e4b684f</code></a>
Updated CHANGES.md</li>
<li><a
href="https://github.com/apache/thrift/commit/c4cbe43fd12ab5d043af5dd08d1f59e2ba07b2e4"><code>c4cbe43</code></a>
Address vulnerabilities in Rack</li>
<li><a
href="https://github.com/apache/thrift/commit/68ac8e935ef440c3e22d0e1a30e7211b9bf1d441"><code>68ac8e9</code></a>
Enable TLS hostname verification in TNonblockingSSLSocket</li>
<li><a
href="https://github.com/apache/thrift/commit/5e4f01d737e4d3845d07dde6da43981feee0cb9a"><code>5e4f01d</code></a>
Harden Node.js WebSocket server handling</li>
<li><a
href="https://github.com/apache/thrift/commit/e242889231df48f8791372598052862c28f5be83"><code>e242889</code></a>
Add input validation to Swift protocol layer</li>
<li><a
href="https://github.com/apache/thrift/commit/4af8c7c8768cb687b182c1839a39d4beb4f35a5d"><code>4af8c7c</code></a>
Add recursion depth limit to Node.js protocol skip()</li>
<li><a
href="https://github.com/apache/thrift/commit/a30c552bd0808b7e19f35ad30212ba7a9aee8c66"><code>a30c552</code></a>
Enable TLS hostname verification in TSSLTransportFactory</li>
<li><a
href="https://github.com/apache/thrift/commit/0f8ec9c1014ed21acc324aaa421017fb164e9608"><code>0f8ec9c</code></a>
Fix parent class resolution in c_glib generated dispatch_call</li>
<li><a
href="https://github.com/apache/thrift/commit/276ec883910cd936b4f9413bf607c808a7423185"><code>276ec88</code></a>
THRIFT-5929: Fix build failure on PHP 8.5 due to removed
zend_exception_get_d...</li>
<li><a
href="https://github.com/apache/thrift/commit/17f2c13ec2b27503dd0de2720401b96787632364"><code>17f2c13</code></a>
Added missing 0.23.0 JIRA tickets to CHANGES.md</li>
<li>Additional commits viewable in <a
href="https://github.com/apache/thrift/compare/v0.22.0...v0.23.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/apache/thrift&package-manager=go_modules&previous-version=0.22.0&new-version=0.23.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-07 11:48:03 -03:00
Victor Lyuboslavsky de86536f42 Redis-backed cache for host-by-key lookups (#43936) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #43928 

This PR adds a Redis-backed cache in front of the two host-by-key
lookups on the agent auth paths.

Docs: https://github.com/fleetdm/fleet/pull/44504

## What changes

**Read path (osquery/orbit auth):**

- `LoadHostByNodeKey` and `LoadHostByOrbitNodeKey` now check Redis
before falling through to MySQL.
- Successful lookups are cached for 60s ± 10% jitter (configurable via
`FLEET_REDIS_HOST_CACHE_TTL`).
- `NotFound` results are cached for 5s as a negative entry, dampening
repeated probes for keys that
do not exist (deleted hosts whose agents are still polling, attacker
scans, retry storms).
- Concurrent lookups for the same key collapse into one DB query via
`singleflight`. The shared
query runs under a context detached from any one caller's deadline so
the leader giving up does
not abort the work for joiners. The shared query is itself bounded by a
30s timeout so a wedged
  DB call cannot pin the singleflight slot indefinitely.

**Write path (invalidations):**

- These methods now invalidate the cache after a successful inner call:
`UpdateHost`, `SerialUpdateHost`, `UpdateHostOsqueryIntervals`,
`UpdateHostRefetchRequested`,
`UpdateHostRefetchCriticalQueriesUntil`,
`UpdateHostIdentityCertHostIDBySerial`, `EnrollOsquery`,
`EnrollOrbit`, `NewHost`, `DeleteHost`, `DeleteHosts`,
`CleanupExpiredHosts`,
  `CleanupIncomingHosts`, `AddHostsToTeam`.
- `AddHostsToTeam`, `DeleteHosts`, `CleanupExpiredHosts`, and
`CleanupIncomingHosts` use a pipelined
batch invalidator so 10k-host operations stay in the millisecond range
instead of taking minutes
  of sequential round-trips.
- Inner-call errors are not invalidations: a failing write leaves cached
state intact.

**Configuration:**

- New flags `FLEET_REDIS_HOST_CACHE_ENABLED` (default `true`) and
`FLEET_REDIS_HOST_CACHE_TTL`
  (default `60s`).
- Server refuses to start if the cache is enabled with `TTL <= 0`.

**Observability:**

- Three new OTEL counters under the `fleet` meter:
  - `fleet.host_cache.lookups{result=hit|negative_hit|miss}`
  - `fleet.host_cache.errors{op=get|set|del}`
-
`fleet.host_cache.invalidations{reason=update|enroll|team|delete|cert}`
- A pre-built SigNoz dashboard ships in
`tools/signoz/host_cache_dashboard.json`.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Optional Redis-backed host lookup cache for osquery and orbit auth,
with automatic invalidation and metrics/monitoring dashboard.

* **Bug Fixes**
* Fixed host-removal batching so cache-related removals use correct
chunks.

* **Tests**
* Added comprehensive host-cache unit tests covering hits, negative
cache, invalidation, concurrency, and JSON round-trips.

* **Chores**
* New config flags to enable the cache and set TTL (default 60s ±10%
jitter).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-01 12:06:16 -05:00
Victor Lyuboslavsky 9628f49cb8 Improved the performance of Windows MDM profile reconciliation (#44075) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44052 

Improve performance by reducing the time for the synchronous API call to
update profiles or switch teams. And spreading out the application of
profiles by processing 2000 hosts every 30 seconds.

1. **Windows profile reconciliation is no longer synchronous to
bulk-set.**
Apple, Android, and Apple-declaration paths still write their pending
state inside the bulk-set transaction. The Windows path commits the
transactional inputs and lets the existing `mdm_windows_profile_manager`
cron pick the work up on its next tick. The visible effect is that
`host_mdm_windows_profiles` is no longer guaranteed to be populated by
the time bulk-set returns; it converges within one cron interval.

2. **The Windows reconciler now processes hosts in bounded batches, with
a persisted cursor.**
Previous behavior was "scan the universe of pending Windows hosts on
every tick." New behavior is a host-window query bounded by batch size
and a `host_uuid` cursor, advanced after the batch commits successfully
and persisted across ticks. A failed tick leaves the cursor untouched so
the same window is retried.

3. **Two replication races are now explicitly handled.**
- Admin-delete vs reconcile: the existence check the reconciler uses to
avoid touching a just-deleted profile reads from the primary, not a
replica.
- Insert lag in the reconciler's own listings: hosts that appear in the
cursor query but are not yet visible in the scoped listings advance the
cursor instead of jamming the loop.

4. **`updates.WindowsConfigProfile` from `BulkSetPendingMDMHostProfiles`
is now always false in production.**
The only consumer ORs it with the transactional signal from
`BatchSetMDMProfiles`, which is the accurate source. The bulk-set call
no longer attempts to compute or return that activity signal itself.

5. **Tests opt in to the old synchronous behavior via a named hook.**
Default test behavior matches production (deferred). Legacy tests whose
assertions require Windows rows immediately after bulk-set call an
explicit enable-hook and rely on `t.Cleanup` to restore.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Windows MDM profile reconciliation batching improvements enable large
team transfers and bulk profile change operations to complete faster,
with profile updates rolling out in the background without blocking host
check-ins or other MDM activity.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-04-28 15:37:43 -05:00
Lucas Manuel Rodriguez d4c0834cba Bump macadmins/osquery-extension to v1.4.1 and add network_quality ta… (#44214) 
**Related issue:** Resolves #44202.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [X] QA'd all new/changed functionality manually

## fleetd/orbit/Fleet Desktop

- [X] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [X] Verified that fleetd runs on macOS, Linux and Windows
- [X] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added network quality table for macOS to monitor download and upload
speeds with results formatted in both kilobits and megabits per second
(requires macOS 12+)

* **Chores**
  * Updated MacAdmins osquery extension dependency to v1.4.1

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-04-27 14:52:27 -03:00
dependabot[bot]andLucas Manuel Rodriguez 3af4baf691 Bump github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1 (#44089) 
Bumps [github.com/Azure/go-ntlmssp](https://github.com/Azure/go-ntlmssp)
from 0.0.0-20221128193559-754e69321358 to 0.1.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Azure/go-ntlmssp/releases">github.com/Azure/go-ntlmssp's
releases</a>.</em></p>
<blockquote>
<h2>v0.1.1</h2>
<p>Fix CVE-2026-32952: A malicious NTLM challenge message can causes an
slice out of bounds panic, which can crash any Go process using
ntlmssp.Negotiator as an HTTP transport.</p>
<h2>v0.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump minimum required version to Go 1.24 by <a
href="https://github.com/qmuntal"><code>@​qmuntal</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/53">Azure/go-ntlmssp#53</a></li>
<li>Fix OOM in NTLM negotiator by avoiding buffering of seekable request
bodies by <a
href="https://github.com/Copilot"><code>@​Copilot</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/54">Azure/go-ntlmssp#54</a></li>
<li>Don't modify the rountripped request by <a
href="https://github.com/qmuntal"><code>@​qmuntal</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/57">Azure/go-ntlmssp#57</a></li>
<li>Fix a race occurring when the wrapped Rountripper closes the request
body in another goroutine by <a
href="https://github.com/qmuntal"><code>@​qmuntal</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/58">Azure/go-ntlmssp#58</a></li>
<li>Fix a race occurring when the wrapped Rountripper reads request
fields in another goroutine by <a
href="https://github.com/qmuntal"><code>@​qmuntal</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/59">Azure/go-ntlmssp#59</a></li>
<li>Only perform basic auth if requested by the server by <a
href="https://github.com/qmuntal"><code>@​qmuntal</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/60">Azure/go-ntlmssp#60</a></li>
<li>Don't pass the original body in the client handshake request by <a
href="https://github.com/qmuntal"><code>@​qmuntal</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/61">Azure/go-ntlmssp#61</a></li>
<li>Return latest server response in case there is an error processing
the handshake by <a
href="https://github.com/qmuntal"><code>@​qmuntal</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/63">Azure/go-ntlmssp#63</a></li>
<li>Send body on client NTLM handshake by <a
href="https://github.com/qmuntal"><code>@​qmuntal</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/64">Azure/go-ntlmssp#64</a></li>
<li>Support user accounts not living in server's domain by <a
href="https://github.com/qmuntal"><code>@​qmuntal</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/65">Azure/go-ntlmssp#65</a></li>
<li>Implement NewAuthenticateMessage and deprecate ProcessChallenge by
<a href="https://github.com/qmuntal"><code>@​qmuntal</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/67">Azure/go-ntlmssp#67</a></li>
<li>Make basic authentication support opt-in by <a
href="https://github.com/qmuntal"><code>@​qmuntal</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/66">Azure/go-ntlmssp#66</a></li>
<li>Allow passing custom client domain and workstation name by <a
href="https://github.com/qmuntal"><code>@​qmuntal</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/68">Azure/go-ntlmssp#68</a></li>
<li>set NEGOTIATE_NTLM and NEGOTIATE_ALWAYS_SIGN capabilities by <a
href="https://github.com/qmuntal"><code>@​qmuntal</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/69">Azure/go-ntlmssp#69</a></li>
<li>testing: add e2e tests by <a
href="https://github.com/gdams"><code>@​gdams</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/56">Azure/go-ntlmssp#56</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/qmuntal"><code>@​qmuntal</code></a> made
their first contribution in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/53">Azure/go-ntlmssp#53</a></li>
<li><a href="https://github.com/Copilot"><code>@​Copilot</code></a> made
their first contribution in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/54">Azure/go-ntlmssp#54</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Azure/go-ntlmssp/compare/v0.0.1...v0.1.0">https://github.com/Azure/go-ntlmssp/compare/v0.0.1...v0.1.0</a></p>
<h2>v0.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Commit to Go 1.6 by <a
href="https://github.com/boumenot"><code>@​boumenot</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/5">Azure/go-ntlmssp#5</a></li>
<li>Handle http redirect by <a
href="https://github.com/nqv"><code>@​nqv</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/4">Azure/go-ntlmssp#4</a></li>
<li>drain request body for connection reuse by <a
href="https://github.com/paulmey"><code>@​paulmey</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/6">Azure/go-ntlmssp#6</a></li>
<li>Add CoC notice by <a
href="https://github.com/paulmey"><code>@​paulmey</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/7">Azure/go-ntlmssp#7</a></li>
<li>Support for auth when server responds with Www-Authenticate: NTLM by
<a href="https://github.com/lafriks"><code>@​lafriks</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/8">Azure/go-ntlmssp#8</a></li>
<li>update README with example by <a
href="https://github.com/PaluMacil"><code>@​PaluMacil</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/11">Azure/go-ntlmssp#11</a></li>
<li>add version, domain and workstation fields by <a
href="https://github.com/justdan96"><code>@​justdan96</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/13">Azure/go-ntlmssp#13</a></li>
<li>move to a current version of Go by <a
href="https://github.com/boumenot"><code>@​boumenot</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/19">Azure/go-ntlmssp#19</a></li>
<li>(BUG) Negotiation fails for servers where 'NTLMv2 session security'
i… by <a
href="https://github.com/davejohnston"><code>@​davejohnston</code></a>
in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/18">Azure/go-ntlmssp#18</a></li>
<li>Update negotiator.go by <a
href="https://github.com/mszuyev"><code>@​mszuyev</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/24">Azure/go-ntlmssp#24</a></li>
<li>Fix golint import path by <a
href="https://github.com/paulmey"><code>@​paulmey</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/25">Azure/go-ntlmssp#25</a></li>
<li>add ProcessChallengeWithHash function by <a
href="https://github.com/ropnop"><code>@​ropnop</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/27">Azure/go-ntlmssp#27</a></li>
<li>Set workstation to empty string in authenticate_message.go by <a
href="https://github.com/Catbuttes"><code>@​Catbuttes</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/30">Azure/go-ntlmssp#30</a></li>
<li>Change of the negociator working, to handle several identical header
by <a href="https://github.com/Resousse"><code>@​Resousse</code></a> in
<a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/31">Azure/go-ntlmssp#31</a></li>
<li>Support for UPN by <a
href="https://github.com/tirupatibg"><code>@​tirupatibg</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/32">Azure/go-ntlmssp#32</a></li>
<li>Adding Microsoft SECURITY.MD by <a
href="https://github.com/microsoft-github-policy-service"><code>@​microsoft-github-policy-service</code></a>[bot]
in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/39">Azure/go-ntlmssp#39</a></li>
<li>Handle 3rd return value from GetDomain by <a
href="https://github.com/opoplawski"><code>@​opoplawski</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/41">Azure/go-ntlmssp#41</a></li>
<li>initial refactor by <a
href="https://github.com/gdams"><code>@​gdams</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/48">Azure/go-ntlmssp#48</a></li>
<li>fix linter errors by <a
href="https://github.com/gdams"><code>@​gdams</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/49">Azure/go-ntlmssp#49</a></li>
<li>add dependabot/codeowners + installation instructions by <a
href="https://github.com/gdams"><code>@​gdams</code></a> in <a
href="https://redirect.github.com/Azure/go-ntlmssp/pull/50">Azure/go-ntlmssp#50</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/Azure/go-ntlmssp/commits/v0.1.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/Azure/go-ntlmssp&package-manager=go_modules&previous-version=0.0.0-20221128193559-754e69321358&new-version=0.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
 2026-04-24 13:33:45 -03:00
dependabot[bot] faa2bb1bdc Bump github.com/go-git/go-git/v5 from 5.17.1 to 5.18.0 (#43740) 
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git)
from 5.17.1 to 5.18.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's
releases</a>.</em></p>
<blockquote>
<h2>v5.18.0</h2>
<h2>What's Changed</h2>
<ul>
<li>plumbing: transport/http, Add support for followRedirects policy by
<a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2004">go-git/go-git#2004</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-git/go-git/compare/v5.17.2...v5.18.0">https://github.com/go-git/go-git/compare/v5.17.2...v5.18.0</a></p>
<h2>v5.17.2</h2>
<h2>What's Changed</h2>
<ul>
<li>build: Update module github.com/go-git/go-git/v5 to v5.17.1
[SECURITY] (releases/v5.x) by <a
href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot]
in <a
href="https://redirect.github.com/go-git/go-git/pull/1941">go-git/go-git#1941</a></li>
<li>dotgit: skip writing pack files that already exist on disk by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/1944">go-git/go-git#1944</a></li>
</ul>
<p>⚠️ This release fixes a bug (<a
href="https://redirect.github.com/go-git/go-git/issues/1942">go-git/go-git#1942</a>)
that blocked some users from upgrading to <code>v5.17.1</code>. Thanks
<a href="https://github.com/pskrbasu"><code>@​pskrbasu</code></a> for
reporting it. 🙇</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-git/go-git/compare/v5.17.1...v5.17.2">https://github.com/go-git/go-git/compare/v5.17.1...v5.17.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/go-git/go-git/commit/ea3e7ec9dfc54f577a01afb4dd601c0284604264"><code>ea3e7ec</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/2004">#2004</a>
from go-git/v5-http-hardening</li>
<li><a
href="https://github.com/go-git/go-git/commit/bcd20a9c525826081262a06a9ed9c3167abfcd53"><code>bcd20a9</code></a>
plumbing: transport/http, Add support for followRedirects policy</li>
<li><a
href="https://github.com/go-git/go-git/commit/45ae193b3a60aa8ec8a3e373f7265a7819473d5f"><code>45ae193</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/1944">#1944</a>
from go-git/fix-perms</li>
<li><a
href="https://github.com/go-git/go-git/commit/fda4f7464b597ff33d2dea1c026482a5e900037c"><code>fda4f74</code></a>
storage: filesystem/dotgit, Skip writing pack files that already exist
on disk</li>
<li><a
href="https://github.com/go-git/go-git/commit/2212dc7caeb2a389fe2129923811ef63f75a557a"><code>2212dc7</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/1941">#1941</a>
from go-git/renovate/releases/v5.x-go-github.com-go-...</li>
<li><a
href="https://github.com/go-git/go-git/commit/ebb2d7da7f5d5aebeaa0b5e13276d72d602c1ae3"><code>ebb2d7d</code></a>
build: Update module github.com/go-git/go-git/v5 to v5.17.1
[SECURITY]</li>
<li>See full diff in <a
href="https://github.com/go-git/go-git/compare/v5.17.1...v5.18.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.17.1&new-version=5.18.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-20 14:41:33 -03:00
Lucas Manuel Rodriguez 682202444c Update go to 1.26.2 and update tooling to update it (#43771) 
Golang 1.26.2 has been released. It fixes some CVEs:
https://github.com/golang/go/issues?q=milestone%3AGo1.26.2+label%3ACherryPickApproved

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated Go toolchain to 1.26.2 across the repository and build
configs.
  * Updated Docker build images to use Go 1.26.2.
* Expanded the set of tracked modules for the Go version update so
additional module files are included in automated updates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-04-20 13:40:57 -03:00
dependabot[bot] 3c1b8fc7a3 Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 (#43298) 
Bumps
[go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go)
from 1.40.0 to 1.43.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>[1.43.0/0.65.0/0.19.0] 2026-04-02</h2>
<h3>Added</h3>
<ul>
<li>Add <code>IsRandom</code> and <code>WithRandom</code> on
<code>TraceFlags</code>, and <code>IsRandom</code> on
<code>SpanContext</code> in <code>go.opentelemetry.io/otel/trace</code>
for <a
href="https://www.w3.org/TR/trace-context-2/#random-trace-id-flag">W3C
Trace Context Level 2 Random Trace ID Flag</a> support. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8012">#8012</a>)</li>
<li>Add service detection with <code>WithService</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7642">#7642</a>)</li>
<li>Add <code>DefaultWithContext</code> and
<code>EnvironmentWithContext</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code> to support plumbing
<code>context.Context</code> through default and environment detectors.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8051">#8051</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Add support for per-series start time tracking for cumulative
metrics in <code>go.opentelemetry.io/otel/sdk/metric</code>.
Set <code>OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true</code> to enable.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8060">#8060</a>)</li>
<li>Add <code>WithCardinalityLimitSelector</code> for metric reader for
configuring cardinality limits specific to the instrument kind. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7855">#7855</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Introduce the <code>EMPTY</code> Type in
<code>go.opentelemetry.io/otel/attribute</code> to reflect that an empty
value is now a valid value, with <code>INVALID</code> remaining as a
deprecated alias of <code>EMPTY</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Improve slice handling in
<code>go.opentelemetry.io/otel/attribute</code> to optimize short slice
values with fixed-size fast paths. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8039">#8039</a>)</li>
<li>Improve performance of span metric recording in
<code>go.opentelemetry.io/otel/sdk/trace</code> by returning early if
self-observability is not enabled. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8067">#8067</a>)</li>
<li>Improve formatting of metric data diffs in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8073">#8073</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>INVALID</code> in
<code>go.opentelemetry.io/otel/attribute</code>. Use <code>EMPTY</code>
instead. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Return spec-compliant <code>TraceIdRatioBased</code> description.
This is a breaking behavioral change, but it is necessary to
make the implementation <a
href="https://opentelemetry.io/docs/specs/otel/trace/sdk/#traceidratiobased">spec-compliant</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8027">#8027</a>)</li>
<li>Fix a race condition in
<code>go.opentelemetry.io/otel/sdk/metric</code> where the lastvalue
aggregation could collect the value 0 even when no zero-value
measurements were recorded. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8056">#8056</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li><code>WithHostID</code> detector in
<code>go.opentelemetry.io/otel/sdk/resource</code> to use full path for
<code>kenv</code> command on BSD. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113">#8113</a>)</li>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096">#8096</a>)</li>
</ul>
<h2>[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06</h2>
<h3>Added</h3>
<ul>
<li>Add <code>go.opentelemetry.io/otel/semconv/v1.40.0</code> package.
The package contains semantic conventions from the <code>v1.40.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.40.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.39.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7985">#7985</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/9276201a64b623606e3eaa0d61ae8ee6d62756c0"><code>9276201</code></a>
Release v1.43.0 / v0.65.0 / v0.19.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8128">#8128</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/61b8c9466c4e6b17e69b622279fe9b63fb15c89a"><code>61b8c94</code></a>
chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8131">#8131</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/97a086e82ffe01502f4c620e9c447efa229e2a23"><code>97a086e</code></a>
chore(deps): update github.com/golangci/dupl digest to c99c5cf (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8122">#8122</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/5e363de517dba6db62736b2f5cdef0e0929b4cd0"><code>5e363de</code></a>
limit response body size for OTLP HTTP exporters (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/35214b60138eac8dec97a2d2b851d8c8471680c7"><code>35214b6</code></a>
Use an absolute path when calling bsd kenv (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113">#8113</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/290024ceaf695f9cdbf29a0c6731a317d92bc361"><code>290024c</code></a>
fix(deps): update module google.golang.org/grpc to v1.80.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8121">#8121</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/e70658e098033d6bb5ec1b399de16bbb2642f6dc"><code>e70658e</code></a>
fix: support getBody in otelploghttp (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096">#8096</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/4afe468e3b4859c949a1c1e8d92684d43d86ef8a"><code>4afe468</code></a>
fix(deps): update googleapis to 9d38bb4 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8117">#8117</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/b9ca729776309e3c08fe700c131797a3b4d10634"><code>b9ca729</code></a>
chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8115">#8115</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/69472ec56cb7674d55ca2e2bcb04dea73228ab79"><code>69472ec</code></a>
chore(deps): update fossas/fossa-action action to v1.9.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8118">#8118</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.40.0...v1.43.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/otel/sdk&package-manager=go_modules&previous-version=1.40.0&new-version=1.43.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-13 15:24:04 -03:00
dependabot[bot] f8d2660c6c Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.81.0 to 1.97.3 (#43204) 
Bumps
[github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2)
from 1.81.0 to 1.97.3.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/90650dd22735ab68f6089ae5c39b6614286ae9ec"><code>90650dd</code></a>
Release 2026-03-26</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/dd88818bee7d632a8b9da6e2c78ef92e23c94c62"><code>dd88818</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/b662c50138bd393927871b46e84ee3483377f5be"><code>b662c50</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/500a9cb3522a0e71d798d7079ff5856b23c2cac1"><code>500a9cb</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/6221102f763bd65d7e403fa62c3a1e3d39e24dc6"><code>6221102</code></a>
fix stale skew and delayed skew healing (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3359">#3359</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/0a39373433a121800bc68efa743a7486eb07aa3f"><code>0a39373</code></a>
fix order of generated event header handlers (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3361">#3361</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/098f3898271e2eaaf8a92e38d1d928fb018805a6"><code>098f389</code></a>
Only generate resolveAccountID when it's required (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3360">#3360</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/6ebab66428e97db0ee252fea042d56b1313cb9f6"><code>6ebab66</code></a>
Release 2026-03-25</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/b2ec3beebb986a5e74e50d0c105119d84e1e934e"><code>b2ec3be</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/abc126f6b35bfe2f77e2505f6d04f8ceced971ee"><code>abc126f</code></a>
Update API model</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.81.0...service/s3/v1.97.3">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-08 14:55:33 -03:00
dependabot[bot] 8201ae63f1 Bump github.com/aws/aws-sdk-go-v2/service/kinesis from 1.35.3 to 1.43.5 (#43200) 
Bumps
[github.com/aws/aws-sdk-go-v2/service/kinesis](https://github.com/aws/aws-sdk-go-v2)
from 1.35.3 to 1.43.5.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/f9f7a6bb124a1a7daffc65db40053d97678bd371"><code>f9f7a6b</code></a>
Release 2025-07-19</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/c74fb637eb68925187407dfe105ba10d855cecd2"><code>c74fb63</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/d09b46671d6af69a0e1e808c953e5db4a0e5790c"><code>d09b466</code></a>
generate aws-eusc (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3144">#3144</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/45575dd69588782d4a0944c7b3911018613d67c7"><code>45575dd</code></a>
Release 2025-07-18</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/40f9e8b889dbda9e80b651bd55ea13a99d75d6cc"><code>40f9e8b</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/da30009f1debd56e812c58845b0a3ee4e6e1fb58"><code>da30009</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/78fe67fa8c7f08f490e1e04bbe3ce609bfc66fe6"><code>78fe67f</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/654c62d6b16cfa75aba17f6f2feb7d91d627186a"><code>654c62d</code></a>
Release 2025-07-17</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/47a74cd2a3a4464fbb1273db6ede81d2bb72bb1d"><code>47a74cd</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/bdd96b2ea29e4a7c96d0dbe1dc1a039bf85d090c"><code>bdd96b2</code></a>
Update endpoints model</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/service/pi/v1.35.3...service/ivs/v1.43.5">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-08 14:47:51 -03:00
dependabot[bot] 98075b2734 Bump github.com/aws/aws-sdk-go-v2/service/lambda from 1.72.0 to 1.88.5 (#43199) 
Bumps
[github.com/aws/aws-sdk-go-v2/service/lambda](https://github.com/aws/aws-sdk-go-v2)
from 1.72.0 to 1.88.5.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/b9b0c6553b80f99603b4f8356b88f5baf1328deb"><code>b9b0c65</code></a>
Release 2025-10-16</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/e2bc8a0ec6f430876fc7de4432ea9cc89c9568f8"><code>e2bc8a0</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/8691ee380a96c49351e4b5ab8a70bc5d4d100724"><code>8691ee3</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/51e8a3fe032fc566d31b389f492ab58475a98398"><code>51e8a3f</code></a>
bump to go1.23 (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3211">#3211</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/ad2d36cba7c5772b4e8e4caf96939dc41b95c65c"><code>ad2d36c</code></a>
Release 2025-10-15</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/19a35d639f969ee328553e632e8cf8b83d324106"><code>19a35d6</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/35cb02fd50fb125601b9c3b33feb72f3a2bcaa56"><code>35cb02f</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/f673a1b0a80e666c0128ec606ff053dace9771f1"><code>f673a1b</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/48421fd812d8592a4eb2b32d11ae07e228969012"><code>48421fd</code></a>
Release 2025-10-14</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/fedcba778c21b451a91b4e4bcdd5d6c1554c6a5a"><code>fedcba7</code></a>
Regenerated Clients</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.72.0...service/s3/v1.88.5">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/aws/aws-sdk-go-v2/service/lambda&package-manager=go_modules&previous-version=1.72.0&new-version=1.88.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-08 14:37:20 -03:00
dependabot[bot] abaad3d4ca Bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5 (#42952) 
Bumps
[github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) from
3.0.4 to 3.0.5.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/go-jose/go-jose/commit/be2f6548701d4ba561cd61c7d4a2f1289b66c273"><code>be2f654</code></a>
ci: update Go versions for GHA workflows (<a
href="https://redirect.github.com/go-jose/go-jose/issues/221">#221</a>)</li>
<li><a
href="https://github.com/go-jose/go-jose/commit/02464163e1e891db85257cb8860978a1c0226016"><code>0246416</code></a>
Merge commit from fork</li>
<li>See full diff in <a
href="https://github.com/go-jose/go-jose/compare/v3.0.4...v3.0.5">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-jose/go-jose/v3&package-manager=go_modules&previous-version=3.0.4&new-version=3.0.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-03 09:56:25 -03:00
Magnus JensenJordan MontgomeryMartin AngersClaude Opus 4.6Gabriel HernandezSarah Gillespie
 		d4f48b6f9c ACME MDM -> main (#42926) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** The entire ACME feature branch merge

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

---------

Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
Co-authored-by: Martin Angers <martin.n.angers@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Gabriel Hernandez <ghernandez345@gmail.com>
Co-authored-by: Sarah Gillespie <73313222+gillespi314@users.noreply.github.com>
 2026-04-02 15:56:31 -05:00
dependabot[bot] 1aef37c75c Bump github.com/go-git/go-git/v5 from 5.16.5 to 5.17.1 (#42670) 
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git)
from 5.16.5 to 5.17.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's
releases</a>.</em></p>
<blockquote>
<h2>v5.17.1</h2>
<h2>What's Changed</h2>
<ul>
<li>build: Update module github.com/cloudflare/circl to v1.6.3
[SECURITY] (releases/v5.x) by <a
href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot]
in <a
href="https://redirect.github.com/go-git/go-git/pull/1930">go-git/go-git#1930</a></li>
<li>[v5] plumbing: format/index, Improve v4 entry name validation by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/1935">go-git/go-git#1935</a></li>
<li>[v5] plumbing: format/idxfile, Fix version and fanout checks by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/1937">go-git/go-git#1937</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1">https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1</a></p>
<h2>v5.17.0</h2>
<h2>What's Changed</h2>
<ul>
<li>build: Update module github.com/go-git/go-git/v5 to v5.16.5
[SECURITY] (releases/v5.x) by <a
href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot]
in <a
href="https://redirect.github.com/go-git/go-git/pull/1839">go-git/go-git#1839</a></li>
<li>git: worktree, optimize infiles function for very large repos by <a
href="https://github.com/k-anshul"><code>@​k-anshul</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/1853">go-git/go-git#1853</a></li>
<li>git: Add strict checks for supported extensions by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/1861">go-git/go-git#1861</a></li>
<li>backport, git: Improve Status() speed with new index.ModTime check
by <a
href="https://github.com/cedric-appdirect"><code>@​cedric-appdirect</code></a>
in <a
href="https://redirect.github.com/go-git/go-git/pull/1862">go-git/go-git#1862</a></li>
<li>storage: filesystem, Avoid overwriting loose obj files by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/1864">go-git/go-git#1864</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-git/go-git/compare/v5.16.5...v5.17.0">https://github.com/go-git/go-git/compare/v5.16.5...v5.17.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/go-git/go-git/commit/5e23dfd02db92644dc4a3358ceb297fce875b772"><code>5e23dfd</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/1937">#1937</a>
from pjbgf/idx-v5</li>
<li><a
href="https://github.com/go-git/go-git/commit/6b38a326816b80f64c20cc0e6113958b65c05a1c"><code>6b38a32</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/1935">#1935</a>
from pjbgf/index-v5</li>
<li><a
href="https://github.com/go-git/go-git/commit/cd757fcb856a2dcc5fff6c110320a8ff62e99513"><code>cd757fc</code></a>
plumbing: format/idxfile, Fix version and fanout checks</li>
<li><a
href="https://github.com/go-git/go-git/commit/3ec0d70cb687ae1da5f4d18faa4229bd971a8710"><code>3ec0d70</code></a>
plumbing: format/index, Fix tree extension invalidated entry
parsing</li>
<li><a
href="https://github.com/go-git/go-git/commit/dbe10b6b425a2a4ea92a9d98e20cd68e15aede01"><code>dbe10b6</code></a>
plumbing: format/index, Align V2/V3 long name and V4 prefix encoding
with Git</li>
<li><a
href="https://github.com/go-git/go-git/commit/e9b65df44cb97faeba148b47523a362beaecddf9"><code>e9b65df</code></a>
plumbing: format/index, Improve v4 entry name validation</li>
<li><a
href="https://github.com/go-git/go-git/commit/adad18daabddee04c5a889f0230035e74bca32c0"><code>adad18d</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/1930">#1930</a>
from go-git/renovate/releases/v5.x-go-github.com-clo...</li>
<li><a
href="https://github.com/go-git/go-git/commit/29470bd1d862c6e902996b8e8ff8eb7a0515a9be"><code>29470bd</code></a>
build: Update module github.com/cloudflare/circl to v1.6.3
[SECURITY]</li>
<li><a
href="https://github.com/go-git/go-git/commit/bdf06885bdaa3631cf6a2017108086c6f53dcf69"><code>bdf0688</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/1864">#1864</a>
from pjbgf/v5-issue-55</li>
<li><a
href="https://github.com/go-git/go-git/commit/5290e521c8cf651bf3e8d3e37f517c7cf7aa0b19"><code>5290e52</code></a>
storage: filesystem, Avoid overwriting loose obj files. Fixes <a
href="https://redirect.github.com/go-git/go-git/issues/55">#55</a></li>
<li>Additional commits viewable in <a
href="https://github.com/go-git/go-git/compare/v5.16.5...v5.17.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.16.5&new-version=5.17.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-30 15:12:01 -03:00
dependabot[bot] 32f1c2026c Bump golang.org/x/image from 0.18.0 to 0.38.0 (#42661) 
Bumps [golang.org/x/image](https://github.com/golang/image) from 0.18.0
to 0.38.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/image/commit/23ae9ed61c1d3343fb95015810f62dcbf444976e"><code>23ae9ed</code></a>
tiff: cap buffer growth to prevent OOM from malicious IFD offset</li>
<li><a
href="https://github.com/golang/image/commit/e589e60f29d0bbbf6400e250e024f93cbc4961ee"><code>e589e60</code></a>
webp: allow VP8L + VP8X(with alpha)</li>
<li><a
href="https://github.com/golang/image/commit/fe7d73de74b8a1ad508c93cfcb245d44579163ff"><code>fe7d73d</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/image/commit/e3d762b1d37ed96e757e3bc0bfb44f7455589df3"><code>e3d762b</code></a>
all: upgrade go directive to at least 1.25.0 [generated]</li>
<li><a
href="https://github.com/golang/image/commit/833c6ed987962feaa3ec2624d8655421b25e2e0e"><code>833c6ed</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/image/commit/bc7fe0b43a01586e7ca7c087a2e8a625e8397dcb"><code>bc7fe0b</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/image/commit/c53c97f4ed88d55fafe963ee6e93cb357663d650"><code>c53c97f</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/image/commit/9032ff7c7b86f42b9bebdf6133191648224aecc0"><code>9032ff7</code></a>
all: eliminate vet diagnostics</li>
<li><a
href="https://github.com/golang/image/commit/9c9d08c65c08567c997eccc8bde52fcc9369bea6"><code>9c9d08c</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/image/commit/742b1b756d98a0c48b1fcf464a0c63fa50e1aa6b"><code>742b1b7</code></a>
all: fix some comments</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/image/compare/v0.18.0...v0.38.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/image&package-manager=go_modules&previous-version=0.18.0&new-version=0.38.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-30 13:33:10 -03:00
dependabot[bot] 82c3983939 Bump github.com/antchfx/xpath from 1.2.2 to 1.3.6 (#42633) 
Bumps [github.com/antchfx/xpath](https://github.com/antchfx/xpath) from
1.2.2 to 1.3.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/antchfx/xpath/releases">github.com/antchfx/xpath's
releases</a>.</em></p>
<blockquote>
<h2>v1.3.6</h2>
<p>Merged PR:</p>
<ul>
<li><a
href="https://redirect.github.com/antchfx/xpath/issues/120">#120</a>(<a
href="https://github.com/mislav"><code>@​mislav</code></a>) - Fix
<code>last()</code> predicate on grouped expr.</li>
</ul>
<p>Fixed:</p>
<ul>
<li><a
href="https://redirect.github.com/antchfx/xpath/issues/121">#121</a></li>
</ul>
<h2>Release v1.3.5</h2>
<p>Merged PR:</p>
<ul>
<li><a
href="https://redirect.github.com/antchfx/xpath/issues/117">#117</a>(<a
href="https://github.com/mislav"><code>@​mislav</code></a>）- fix
<code>ancestor::</code> axes with position predicate.</li>
</ul>
<p>Fixed:</p>
<ul>
<li><a
href="https://redirect.github.com/antchfx/xpath/issues/113">#113</a> -
(fix <code>string()</code> function)</li>
</ul>
<h2>v1.3.4</h2>
<p>Merged PR:</p>
<ul>
<li><a
href="https://redirect.github.com/antchfx/xpath/issues/107">#107</a>(<a
href="https://github.com/Mrflatt"><code>@​Mrflatt</code></a>) - supports
Regexp feature in <code>replace()</code> function</li>
<li><a
href="https://redirect.github.com/antchfx/xpath/issues/111">#111</a>(<a
href="https://github.com/wjc4"><code>@​wjc4</code></a>) - Improve
<code>getHashCode</code> performance</li>
</ul>
<p>Fixed:</p>
<ul>
<li><a
href="https://redirect.github.com/antchfx/xpath/issues/109">#109</a></li>
</ul>
<h2>v1.3.3</h2>
<p>fix non-English predicate query <a
href="https://redirect.github.com/antchfx/xpath/issues/106">#106</a></p>
<h2>v1.3.2</h2>
<p>New Features:</p>
<ul>
<li>Supports Unicode chars for Non-English (PR <a
href="https://redirect.github.com/antchfx/xpath/issues/100">#100</a>)</li>
</ul>
<p>Bug Fixed:</p>
<ul>
<li><a
href="https://redirect.github.com/antchfx/xpath/issues/101">#101</a></li>
<li><a
href="https://redirect.github.com/antchfx/xpath/issues/102">#102</a></li>
<li><a
href="https://redirect.github.com/antchfx/xpath/issues/104">#104</a></li>
</ul>
<h2>v1.3.1</h2>
<ul>
<li>Merged PR <a
href="https://redirect.github.com/antchfx/xpath/issues/97">#97</a>.</li>
<li>Allows node-set numeric operator <code>+</code>, <code>-</code>,
<code>mod()</code>.<a
href="https://github.com/antchfx/xpath/commit/4b4638b370e898a9d10709464b8cd460b7dcfd0c">https://github.com/antchfx/xpath/commit/4b4638b370e898a9d10709464b8cd460b7dcfd0c</a></li>
<li><a
href="https://redirect.github.com/antchfx/xpath/issues/98">#98</a>,
Remove the duplicate element filter <a
href="https://github.com/antchfx/xpath/commit/5481aef473ee298d297387f5b69e2768df09e0c4">https://github.com/antchfx/xpath/commit/5481aef473ee298d297387f5b69e2768df09e0c4</a></li>
</ul>
<h2>v1.3.0</h2>
<ul>
<li>fixes <a
href="https://redirect.github.com/antchfx/xpath/issues/93">#93</a></li>
</ul>
<h3>New features:</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/antchfx/xpath/commit/afd4762cc342af56345a3fb4002a59281fcab494"><code>afd4762</code></a>
fix <a
href="https://redirect.github.com/antchfx/xpath/issues/121">#121</a></li>
<li><a
href="https://github.com/antchfx/xpath/commit/a8ced8f559cd68fc4aedfc87f21599d1190c0852"><code>a8ced8f</code></a>
Merge PR <a
href="https://redirect.github.com/antchfx/xpath/issues/120">#120</a></li>
<li><a
href="https://github.com/antchfx/xpath/commit/c92c3ebebbdd67f715161810f97ecfbcaa47921e"><code>c92c3eb</code></a>
Fix last() predicate on grouped expressions</li>
<li><a
href="https://github.com/antchfx/xpath/commit/3cbab9750ea36cbae6f967ebbf29b9eda0e841bf"><code>3cbab97</code></a>
Merge PR <a
href="https://redirect.github.com/antchfx/xpath/issues/119">#119</a></li>
<li><a
href="https://github.com/antchfx/xpath/commit/02c01b0b4051e7edd1bf40f3d595cc9143936aaa"><code>02c01b0</code></a>
Fix chained predicates on ancestor axis</li>
<li><a
href="https://github.com/antchfx/xpath/commit/511abd57bc74e9644fe27f4e52b559065e686e92"><code>511abd5</code></a>
Merge PR <a
href="https://redirect.github.com/antchfx/xpath/issues/117">#117</a></li>
<li><a
href="https://github.com/antchfx/xpath/commit/060b15493444a0e6c5a232022516e434818f7391"><code>060b154</code></a>
Fix positional predicate for the &quot;ancestor&quot; axis</li>
<li><a
href="https://github.com/antchfx/xpath/commit/8d50c252d867285812177ffd3ff0924104ffb1eb"><code>8d50c25</code></a>
fix <a
href="https://redirect.github.com/antchfx/xpath/issues/112">#112</a>，<a
href="https://redirect.github.com/antchfx/xpath/issues/113">#113</a></li>
<li><a
href="https://github.com/antchfx/xpath/commit/b9e198da9fb170a229c9c7e27d52e1a350636f4c"><code>b9e198d</code></a>
Merge PR <a
href="https://redirect.github.com/antchfx/xpath/issues/111">#111</a></li>
<li><a
href="https://github.com/antchfx/xpath/commit/fcb882bece30fe7d4d8f5069fed13f95a726e62f"><code>fcb882b</code></a>
improve getHashCode by removing fmt.Sprintf</li>
<li>Additional commits viewable in <a
href="https://github.com/antchfx/xpath/compare/v1.2.2...v1.3.6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/antchfx/xpath&package-manager=go_modules&previous-version=1.2.2&new-version=1.3.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-30 10:44:31 -03:00
Lucas Manuel Rodriguez d8588ed790 Bump macadmins version and add macos_thermal_pressure and macos_soc_power tables (#42569) 
**Related issue:** Resolves #42530

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## fleetd/orbit/Fleet Desktop

- [X] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [X] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [X] Verified that fleetd runs on macOS, Linux and Windows
- [X] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
 2026-03-30 10:04:12 -03:00
dependabot[bot] 915feb9868 Bump github.com/russellhaering/goxmldsig from 1.4.0 to 1.6.0 (#42009) 
Bumps
[github.com/russellhaering/goxmldsig](https://github.com/russellhaering/goxmldsig)
from 1.4.0 to 1.6.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/russellhaering/goxmldsig/releases">github.com/russellhaering/goxmldsig's
releases</a>.</em></p>
<blockquote>
<h2>v1.6.0</h2>
<h2>What's Changed</h2>
<ul>
<li><strong>Security:</strong> Fix possible signature validation bypass
caused by loop variable capture in <code>validateSignature</code>
(GHSA-479m-364c-43vc)</li>
<li>Bump minimum Go version to 1.23</li>
<li>Bump <code>github.com/beevik/etree</code> to v1.6.0</li>
<li>Add fuzz tests for XML signature validation and
canonicalization</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/russellhaering/goxmldsig/compare/v1.5.0...v1.6.0">https://github.com/russellhaering/goxmldsig/compare/v1.5.0...v1.6.0</a></p>
<h2>v1.5.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump dependencies</li>
<li>Update GitHub workflows</li>
<li>Security hardening by <a
href="https://github.com/ahacker1-securesaml"><code>@​ahacker1-securesaml</code></a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/russellhaering/goxmldsig/compare/v1.4.0...v1.5.0">https://github.com/russellhaering/goxmldsig/compare/v1.4.0...v1.5.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/russellhaering/goxmldsig/commit/878c8c615feb628064040115d00e105a137fcfa7"><code>878c8c6</code></a>
Apply go fix ./...</li>
<li><a
href="https://github.com/russellhaering/goxmldsig/commit/db3d1e31f7535d7f5debb49851b9e9a2ff08b936"><code>db3d1e3</code></a>
Fix loop variable capture bug in validateSignature</li>
<li><a
href="https://github.com/russellhaering/goxmldsig/commit/4f576b89acf01f68983ca5cb9dcebd0b460234bc"><code>4f576b8</code></a>
Bump dependencies</li>
<li><a
href="https://github.com/russellhaering/goxmldsig/commit/79c29ee3ed2da54553a4132b372ced83185fcf12"><code>79c29ee</code></a>
Rename FuzzValidate to FuzzValidateXML to avoid name collision</li>
<li><a
href="https://github.com/russellhaering/goxmldsig/commit/ac7bf745b9fd3d92460ad9be3459a97b0e3bf89f"><code>ac7bf74</code></a>
Add fuzz tests for XML signature validation and canonicalization</li>
<li><a
href="https://github.com/russellhaering/goxmldsig/commit/a5805dfad93fc67a2106a1dc6d881df83769e3eb"><code>a5805df</code></a>
Bump github/codeql-action from 2.13.4 to 3.28.17 (<a
href="https://redirect.github.com/russellhaering/goxmldsig/issues/155">#155</a>)</li>
<li><a
href="https://github.com/russellhaering/goxmldsig/commit/7dac9ec3b2a1a336d73ff091fba4131d186dfec6"><code>7dac9ec</code></a>
Update GitHub Workflow</li>
<li><a
href="https://github.com/russellhaering/goxmldsig/commit/1bf54ca740682fac1149814344c24c722fde8238"><code>1bf54ca</code></a>
Bump dependencies</li>
<li><a
href="https://github.com/russellhaering/goxmldsig/commit/e1c8a5b89d1d03089aa1a0ec546b33aaf80ee02f"><code>e1c8a5b</code></a>
Refactor to help eliminate potential vulnerabilities:</li>
<li><a
href="https://github.com/russellhaering/goxmldsig/commit/2ac5490a2441a3484e030c5cfeb02ce62886c01a"><code>2ac5490</code></a>
Refactor .verifyCertificate to obtain the certificate from an identifier
from...</li>
<li>Additional commits viewable in <a
href="https://github.com/russellhaering/goxmldsig/compare/v1.4.0...v1.6.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/russellhaering/goxmldsig&package-manager=go_modules&previous-version=1.4.0&new-version=1.6.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-27 13:38:04 -03:00
dependabot[bot] 7d1865399e Bump github.com/nats-io/nats-server/v2 from 2.12.3 to 2.12.6 (#42338) 
Bumps
[github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server)
from 2.12.3 to 2.12.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nats-io/nats-server/releases">github.com/nats-io/nats-server/v2's
releases</a>.</em></p>
<blockquote>
<h2>Release v2.12.6</h2>
<h2>Changelog</h2>
<p>Refer to the <a
href="https://docs.nats.io/release-notes/whats_new/whats_new_212">2.12
Upgrade Guide</a> for backwards compatibility notes with 2.11.x.</p>
<h3>Go Version</h3>
<ul>
<li>1.25.8</li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>golang.org/x/crypto v0.49.0 (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7953">#7953</a>)</li>
<li>github.com/nats-io/jwt/v2 v2.8.1 (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7960">#7960</a>)</li>
<li>golang.org/x/sys v0.42.0 (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7923">#7923</a>)</li>
<li>golang.org/x/time v0.15.0 (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7923">#7923</a>)</li>
</ul>
<h3>CVEs</h3>
<ul>
<li>Fixes CVE-2026-33216, CVE-2026-33217, CVE-2026-33215 (affecting
systems using MQTT)</li>
<li>Fixes CVE-2026-33246 (affects systems using leafnodes and service
imports)</li>
<li>Fixes CVE-2026-33218 (affects systems using leafnodes)</li>
<li>Fixes CVE-2026-33219 (affects systems using WebSockets)</li>
<li>Fixes CVE-2026-33223, CVE-2026-33222 (affects systems using
JetStream)</li>
<li>Fixes CVE-2026-33248 (affects systems using mutual TLS)</li>
<li>Fixes CVE-2026-33247 (affects systems providing credentials on the
command line)</li>
<li>Fixes CVE-2026-33249 (affects systems where client publish
permissions should be restricted)</li>
</ul>
<h3>Improved</h3>
<p>General</p>
<ul>
<li>Non-WebSocket leafnode connections can now be proxied using HTTP
CONNECT (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7781">#7781</a>)</li>
<li>The <code>$SYS.REQ.USER.INFO</code> response now includes the
friendly nametag of the account and/or user if known (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7973">#7973</a>)</li>
</ul>
<p>JetStream</p>
<ul>
<li>The stream peer-remove command now accepts a peer ID as well as a
server name (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7952">#7952</a>)</li>
</ul>
<p>MQTT</p>
<ul>
<li>Protocol compliance has been improved, including more error handling
on invalid or malformed MQTT packets (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7933">#7933</a>)</li>
</ul>
<h3>Fixed</h3>
<p>General</p>
<ul>
<li>Client connections are no longer registered after an auth callout
timeout (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7932">#7932</a>)</li>
<li>Improved handling of duplicate headers</li>
<li>A correctness bug when validating relative distinguished names has
been fixed</li>
<li>Secrets are now redacted correctly in trace logging (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7942">#7942</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nats-io/nats-server/commit/0e0639058e0d2d8fce0cc34941f9897da152ab32"><code>0e06390</code></a>
Release v2.12.6</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/f593d279dadfbe8228c532ef21216a2b4b84cf4b"><code>f593d27</code></a>
Cherry-picks for 2.12.6 (<a
href="https://redirect.github.com/nats-io/nats-server/issues/61">#61</a>)</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/9f904de022cb441444dc14fc5b0251b140fa1dae"><code>9f904de</code></a>
[FIXED] Incomplete route pool on premature pong</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/b5101921e22a149ea8e23e725d04bf0a85893a48"><code>b510192</code></a>
[FIXED] Avoid stalling read loop on leafnode
ErrMinimumVersionRequired</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/53941c24a17589c51aff5235991e77357fec2a0c"><code>53941c2</code></a>
Report the account and user name in USER.INFO request</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/1ab002ab2b6b8057ca2897e60cf7a8b3194d3eed"><code>1ab002a</code></a>
[IMPROVED] Support HTTP proxy connection from leaf nodes also for
TCP</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/8b6408239fedc487d20fb73626f77689c70c5766"><code>8b64082</code></a>
Release v2.12.6-RC.3</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/e6ab7e9541583932608965ff3d815e323b152e42"><code>e6ab7e9</code></a>
Cherry-picks for 2.12.6-RC.3 (<a
href="https://redirect.github.com/nats-io/nats-server/issues/59">#59</a>)</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/9f4d96076caa4b4af2911b6391c04e35e76ea1b6"><code>9f4d960</code></a>
Make the deduplication window actually work for deduplication for
sourcing</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/304e18402b566a211c9721c9f39eebba65153574"><code>304e184</code></a>
Remove FIXME about auth callout nonce</li>
<li>Additional commits viewable in <a
href="https://github.com/nats-io/nats-server/compare/v2.12.3...v2.12.6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/nats-io/nats-server/v2&package-manager=go_modules&previous-version=2.12.3&new-version=2.12.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-25 09:45:56 -03:00
Scott Gress 91362ba2ca Add fleetctl new command (#41909) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #41345 

# Details

This PR:

* Adds a new `fleetctl new` command which creates a starter GitOps repo
file structure
* Adds support for file globs for the `configuration_profiles:` key in
GitOps, to support its use in the `fleetctl new` templates. This
involved moving the `BaseItem` type and `SupportsFileInclude` interface
into the `fleet` package so that the `MDMProfileSpec` type could
implement the interface and do glob expansion.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
  - [X] added unit and intg tests for globbing profiles
  - [ ] added tests for `fleetctl new`
- [X] QA'd all new/changed functionality manually
- [X] `fleetctl new` with no args prompted for org name and created a
new `it-and-security` folder under current folder w/ correct files
- [X] `fleetctl new --dir /tmp/testnew` created correct files under
`/tmp/testnew`
- [X] `fleetctl new --dir /tmp/testexisting --force` with an existing
`/tmp/testexisting` folder created correct files under
`/tmp/testexisting`
- [X] `fleetctl new --org-name=foo` created correct files under
`it-and-security` without prompting for org name
- [X] `paths:` in `configuration_profiles` picks up multiple matching
profiles
- [X] `paths:` + `path:` in `configuration_profiles` will error if the
same profile is picked up twice


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added `fleetctl new` command to initialize GitOps repository structure
via CLI.
* Added glob pattern support for `configuration_profiles` field,
enabling flexible profile selection.

* **Chores**
  * Updated CLI dependencies to support enhanced user interactions.
  * Removed legacy website generator configuration files.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-03-20 17:27:27 -05:00
dependabot[bot] 73c386f207 Bump google.golang.org/grpc from 1.78.0 to 1.79.3 (#42011) 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from
1.78.0 to 1.79.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's
releases</a>.</em></p>
<blockquote>
<h2>Release 1.79.3</h2>
<h1>Security</h1>
<ul>
<li>server: fix an authorization bypass where malformed :path headers
(missing the leading slash) could bypass path-based restricted
&quot;deny&quot; rules in interceptors like <code>grpc/authz</code>. Any
request with a non-canonical path is now immediately rejected with an
<code>Unimplemented</code> error. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8981">#8981</a>)</li>
</ul>
<h2>Release 1.79.2</h2>
<h1>Bug Fixes</h1>
<ul>
<li>stats: Prevent redundant error logging in health/ORCA producers by
skipping stats/tracing processing when no stats handler is configured.
(<a
href="https://redirect.github.com/grpc/grpc-go/pull/8874">grpc/grpc-go#8874</a>)</li>
</ul>
<h2>Release 1.79.1</h2>
<h1>Bug Fixes</h1>
<ul>
<li>grpc: Remove the <code>-dev</code> suffix from the User-Agent
header. (<a
href="https://redirect.github.com/grpc/grpc-go/pull/8902">grpc/grpc-go#8902</a>)</li>
</ul>
<h2>Release 1.79.0</h2>
<h1>API Changes</h1>
<ul>
<li>mem: Add experimental API <code>SetDefaultBufferPool</code> to
change the default buffer pool. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8806">#8806</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/vanja-p"><code>@​vanja-p</code></a></li>
</ul>
</li>
<li>experimental/stats: Update <code>MetricsRecorder</code> to require
embedding the new <code>UnimplementedMetricsRecorder</code> (a no-op
struct) in all implementations for forward compatibility. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8780">#8780</a>)</li>
</ul>
<h1>Behavior Changes</h1>
<ul>
<li>balancer/weightedtarget: Remove handling of <code>Addresses</code>
and only handle <code>Endpoints</code> in resolver updates. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8841">#8841</a>)</li>
</ul>
<h1>New Features</h1>
<ul>
<li>experimental/stats: Add support for asynchronous gauge metrics
through the new <code>AsyncMetricReporter</code> and
<code>RegisterAsyncReporter</code> APIs. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8780">#8780</a>)</li>
<li>pickfirst: Add support for weighted random shuffling of endpoints,
as described in <a
href="https://redirect.github.com/grpc/proposal/pull/535">gRFC A113</a>.
<ul>
<li>This is enabled by default, and can be turned off using the
environment variable
<code>GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING</code>. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8864">#8864</a>)</li>
</ul>
</li>
<li>xds: Implement <code>:authority</code> rewriting, as specified in <a
href="https://github.com/grpc/proposal/blob/master/A81-xds-authority-rewriting.md">gRFC
A81</a>. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8779">#8779</a>)</li>
<li>balancer/randomsubsetting: Implement the
<code>random_subsetting</code> LB policy, as specified in <a
href="https://github.com/grpc/proposal/blob/master/A68-random-subsetting.md">gRFC
A68</a>. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8650">#8650</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/marek-szews"><code>@​marek-szews</code></a></li>
</ul>
</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>credentials/tls: Fix a bug where the port was not stripped from the
authority override before validation. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8726">#8726</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/Atul1710"><code>@​Atul1710</code></a></li>
</ul>
</li>
<li>xds/priority: Fix a bug causing delayed failover to lower-priority
clusters when a higher-priority cluster is stuck in
<code>CONNECTING</code> state. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8813">#8813</a>)</li>
<li>health: Fix a bug where health checks failed for clients using
legacy compression options (<code>WithDecompressor</code> or
<code>RPCDecompressor</code>). (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8765">#8765</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/sanki92"><code>@​sanki92</code></a></li>
</ul>
</li>
<li>transport: Fix an issue where the HTTP/2 server could skip header
size checks when terminating a stream early. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8769">#8769</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/joybestourous"><code>@​joybestourous</code></a></li>
</ul>
</li>
<li>server: Propagate status detail headers, if available, when
terminating a stream during request header processing. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8754">#8754</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/joybestourous"><code>@​joybestourous</code></a></li>
</ul>
</li>
</ul>
<h1>Performance Improvements</h1>
<ul>
<li>credentials/alts: Optimize read buffer alignment to reduce copies.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/8791">#8791</a>)</li>
<li>mem: Optimize pooling and creation of <code>buffer</code> objects.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/8784">#8784</a>)</li>
<li>transport: Reduce slice re-allocations by reserving slice capacity.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/8797">#8797</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/grpc/grpc-go/commit/dda86dbd9cecb8b35b58c73d507d81d67761205f"><code>dda86db</code></a>
Change version to 1.79.3 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8983">#8983</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/72186f163e75a065c39e6f7df9b6dea07fbdeff5"><code>72186f1</code></a>
grpc: enforce strict path checking for incoming requests on the server
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/8981">#8981</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/97ca3522b239edf6813e2b1106924e9d55e89d43"><code>97ca352</code></a>
Changing version to 1.79.3-dev (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8954">#8954</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/8902ab6efea590f5b3861126559eaa26fa9783b2"><code>8902ab6</code></a>
Change the version to release 1.79.2 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8947">#8947</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/a9286705aa689bee321ec674323b6896284f3e02"><code>a928670</code></a>
Cherry-pick <a
href="https://redirect.github.com/grpc/grpc-go/issues/8874">#8874</a> to
v1.79.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8904">#8904</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/06df3638c0bcee88197b1033b3ba83e1eb8bc010"><code>06df363</code></a>
Change version to 1.79.2-dev (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8903">#8903</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/782f2de44f597af18a120527e7682a6670d84289"><code>782f2de</code></a>
Change version to 1.79.1 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8902">#8902</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/850eccbb2257bd2de6ac28ee88a7172ab6175629"><code>850eccb</code></a>
Change version to 1.79.1-dev (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8851">#8851</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/765ff056b6890f6c8341894df4e9668e9bfc18ef"><code>765ff05</code></a>
Change version to 1.79.0 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8850">#8850</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/68804be0e78ed0365bb5a576dedc12e2168ed63e"><code>68804be</code></a>
Cherry pick <a
href="https://redirect.github.com/grpc/grpc-go/issues/8864">#8864</a> to
v1.79.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8896">#8896</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/grpc/grpc-go/compare/v1.78.0...v1.79.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.78.0&new-version=1.79.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-19 09:32:45 -03:00
Victor Lyuboslavsky fbc5b9d8b6 Updated go to 1.26.1 (#42027) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #41749

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
 2026-03-19 07:01:00 -05:00
Lucas Manuel Rodriguez ba3746f9fa Fix fleetd crash in Apple M5 hardware by upgrading gopsutil (#41940) 
Resolves #41863

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [x] QA'd all new/changed functionality manually

Tests performed on the following OSs:
- Windows (arm64)
- macOS (Apple silicon)
- Linux (arm64)
- Linux (amd64)

Features tested on the OSs above:
- "My device".
- Restart fleetd.
- Kill fleet desktop, should re-start.
- Killing stale osqueryd processes on orbit startup.
- Checking if osquery is up and running, exit and start.
- Checking if Fleet Desktop is already running before launching it.
- orbit auto update
- Gracefully shutting down Fleet Desktop before restarting it

---

## fleetd/orbit/Fleet Desktop

- [X] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
 2026-03-18 11:21:02 -03:00
Scott GressandIan Littman d5eee802eb Detect unknown keys in GitOps (phase 1) (#40963) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #40496

# Details

This is the first phase of an effort to detect unknown keys in GitOps
.yml files. In the regular `fleetctl gitops` case, it will fail when
unknown keys are detected. This behavior can be changed with a new
`--allow-unknown-keys` flag which will log the issues and continue.

In this first phase we are detecting unknown keys in _most_ GitOps
sections, other than the top-level `org_settings:` and `settings:`
sections which have more complicated typing. I will tackle those
separately as they require a bit more thought. Also ultimately I'd like
us to be doing this validation in a more top-down fashion in one place,
rather than spreading it across the code by doing it in each individual
section, but this is a good first step.

As a bonus, I invited my pal Mr. Levenshtein to the party so that we can
make suggestions when unknown keys are detected, like:

```
 * unknown key "queyr" in "./lib/some-report.yml"; did you mean "query"?
```
> Note: the goal is to return as many validation errors as possible to
the user, so they don't have to keep running `fleetctl gitops` to get
the next error. I did _not_ update any other errors to stop returning
early, in an effort to keep this as low-touch as possible.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- [X] Tested this against existing it-and-security folder and one with
updated keys from https://github.com/fleetdm/fleet/pull/40959; no
unknown keys detected
- [X] Added unknown keys at various levels, GitOps errored with helpful
messages
- [X] Same as above but with `--allow-unknown-keys`; GitOps outputted
helpful messages but continued.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* GitOps runs now fail when unknown or misspelled keys are present in
configuration files.
* New CLI flag --allow-unknown-keys lets unknown keys be treated as
warnings instead of errors.
* Unknown-key messages include suggested valid key names to help correct
mistakes.

* **Tests**
* Expanded test coverage to validate unknown-key detection and the
allow-as-warning option.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Ian Littman <iansltx@gmail.com>
 2026-03-06 16:16:17 -06:00
Scott Gress 2c56b89072 Support globs in script paths in GitOps (#40799) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #40302

# Details

This PR adds support for a `paths:` key for scripts declared under
`controls:` in a GitOps fleet file. If supplied, `paths:` must contain a
"glob" expression (as [supported by the doublestar
package](https://github.com/bmatcuk/doublestar?tab=readme-ov-file#patterns)).
The existing `path:` key still works but may not contain glob
expressions. When a `paths:` key is encountered, we expand it and add
all matching valid (as in, `.sh` or `.ps1`) files to the set of script
files to process.

Subsequent PRs will add this functionality to other entities that use
`path:` (such as reports and policies).

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
Tried with various combinations of `*` and `**` in gitops runs, and
mixing of `path:` and `paths:`
 2026-03-02 22:18:36 -06:00
Victor Lyuboslavsky 62186cb6bd Final slog migration PR: test infrastructure + tools + remaining standalone files (#40727) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #40540 

go-kit/log is no longer a direct dependency; moved kitlog adapter
required for some 3rd party libraries into its own package

# Checklist for submitter

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
  - Present in previous PR

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Modernized logging across the codebase: switched from legacy logging
wrappers to Go's standard slog, updated adapters, tests, tools, and
server components.
* Threaded the new slog logger through test utilities and tooling;
adjusted a small number of logging-related function/constructor
signatures to accept the new logger type (minor compatibility updates).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-02-28 05:52:21 -06:00
dependabot[bot] 3cda538f37 Bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 (#40531) 
Bumps [github.com/cloudflare/circl](https://github.com/cloudflare/circl)
from 1.6.1 to 1.6.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/cloudflare/circl/releases">github.com/cloudflare/circl's
releases</a>.</em></p>
<blockquote>
<h2>CIRCL v1.6.3</h2>
<p>Fix a bug on ecc/p384 scalar multiplication.</p>
<h3>What's Changed</h3>
<ul>
<li>sign/mldsa: Check opts for nil value by <a
href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a
href="https://redirect.github.com/cloudflare/circl/pull/582">cloudflare/circl#582</a></li>
<li>ecc/p384: Point addition must handle point doubling case. by <a
href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a
href="https://redirect.github.com/cloudflare/circl/pull/583">cloudflare/circl#583</a></li>
<li>Release CIRCL v1.6.3 by <a
href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a
href="https://redirect.github.com/cloudflare/circl/pull/584">cloudflare/circl#584</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/cloudflare/circl/compare/v1.6.2...v1.6.3">https://github.com/cloudflare/circl/compare/v1.6.2...v1.6.3</a></p>
<h2>CIRCL v1.6.2</h2>
<ul>
<li>New SLH-DSA, improvements in ML-DSA for arm64.</li>
<li>Tested compilation on WASM.</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Optimize pairing product computation by moving exponentiations to
G1. by <a href="https://github.com/dfaranha"><code>@​dfaranha</code></a>
in <a
href="https://redirect.github.com/cloudflare/circl/pull/547">cloudflare/circl#547</a></li>
<li>sign: Adding SLH-DSA signature by <a
href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a
href="https://redirect.github.com/cloudflare/circl/pull/512">cloudflare/circl#512</a></li>
<li>Update code generators to CIRCL v1.6.1. by <a
href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a
href="https://redirect.github.com/cloudflare/circl/pull/548">cloudflare/circl#548</a></li>
<li>ML-DSA: Add preliminary Wycheproof test vectors by <a
href="https://github.com/bwesterb"><code>@​bwesterb</code></a> in <a
href="https://redirect.github.com/cloudflare/circl/pull/552">cloudflare/circl#552</a></li>
<li>go fmt by <a
href="https://github.com/bwesterb"><code>@​bwesterb</code></a> in <a
href="https://redirect.github.com/cloudflare/circl/pull/554">cloudflare/circl#554</a></li>
<li>gz-compressing test vectors, use of HexBytes and ReadGzip functions.
by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a
href="https://redirect.github.com/cloudflare/circl/pull/555">cloudflare/circl#555</a></li>
<li>group: Removes use of elliptic Marshal and Unmarshal functions. by
<a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a
href="https://redirect.github.com/cloudflare/circl/pull/556">cloudflare/circl#556</a></li>
<li>Support encoding/decoding ML-DSA private keys (as long as they
contain seeds) by <a
href="https://github.com/bwesterb"><code>@​bwesterb</code></a> in <a
href="https://redirect.github.com/cloudflare/circl/pull/559">cloudflare/circl#559</a></li>
<li>Update to golangci-lint v2 by <a
href="https://github.com/bwesterb"><code>@​bwesterb</code></a> in <a
href="https://redirect.github.com/cloudflare/circl/pull/560">cloudflare/circl#560</a></li>
<li>Preparation for ARM64 Implementation of poly operations for
dilithium package. by <a
href="https://github.com/elementrics"><code>@​elementrics</code></a> in
<a
href="https://redirect.github.com/cloudflare/circl/pull/562">cloudflare/circl#562</a></li>
<li>prepare power2Round for custom implementations in assembly by <a
href="https://github.com/elementrics"><code>@​elementrics</code></a> in
<a
href="https://redirect.github.com/cloudflare/circl/pull/564">cloudflare/circl#564</a></li>
<li>ARM64 implementation for poly.PackLe16 by <a
href="https://github.com/elementrics"><code>@​elementrics</code></a> in
<a
href="https://redirect.github.com/cloudflare/circl/pull/563">cloudflare/circl#563</a></li>
<li>add arm64 version of polyMulBy2toD by <a
href="https://github.com/elementrics"><code>@​elementrics</code></a> in
<a
href="https://redirect.github.com/cloudflare/circl/pull/565">cloudflare/circl#565</a></li>
<li>add arm64 version of polySub by <a
href="https://github.com/elementrics"><code>@​elementrics</code></a> in
<a
href="https://redirect.github.com/cloudflare/circl/pull/566">cloudflare/circl#566</a></li>
<li>group: add byteLen method for short groups and RandomScalar uses
rand.Int by <a
href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a
href="https://redirect.github.com/cloudflare/circl/pull/568">cloudflare/circl#568</a></li>
<li>add arm64 version of poly.Add/Sub by <a
href="https://github.com/elementrics"><code>@​elementrics</code></a> in
<a
href="https://redirect.github.com/cloudflare/circl/pull/572">cloudflare/circl#572</a></li>
<li>group: Adding cryptobyte marshaling to scalars by <a
href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a
href="https://redirect.github.com/cloudflare/circl/pull/569">cloudflare/circl#569</a></li>
<li>Bumping up to Go1.25 by <a
href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a
href="https://redirect.github.com/cloudflare/circl/pull/574">cloudflare/circl#574</a></li>
<li>ci: Including WASM compilation. by <a
href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a
href="https://redirect.github.com/cloudflare/circl/pull/577">cloudflare/circl#577</a></li>
<li>Revert to using package-declared HPKE errors for shortkem instead of
standard library errors by <a
href="https://github.com/harshiniwho"><code>@​harshiniwho</code></a> in
<a
href="https://redirect.github.com/cloudflare/circl/pull/578">cloudflare/circl#578</a></li>
<li>Release v1.6.2 by <a
href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a
href="https://redirect.github.com/cloudflare/circl/pull/579">cloudflare/circl#579</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/dfaranha"><code>@​dfaranha</code></a>
made their first contribution in <a
href="https://redirect.github.com/cloudflare/circl/pull/547">cloudflare/circl#547</a></li>
<li><a
href="https://github.com/elementrics"><code>@​elementrics</code></a>
made their first contribution in <a
href="https://redirect.github.com/cloudflare/circl/pull/562">cloudflare/circl#562</a></li>
<li><a
href="https://github.com/harshiniwho"><code>@​harshiniwho</code></a>
made their first contribution in <a
href="https://redirect.github.com/cloudflare/circl/pull/578">cloudflare/circl#578</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/cloudflare/circl/compare/v1.6.1...v1.6.2">https://github.com/cloudflare/circl/compare/v1.6.1...v1.6.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/cloudflare/circl/commit/24ae53c5d6f7fe18203adc125ba3ed76a38703e1"><code>24ae53c</code></a>
Release CIRCL v1.6.3</li>
<li><a
href="https://github.com/cloudflare/circl/commit/581020bd4a836b8ce7bd4e414ba2884c07dbc906"><code>581020b</code></a>
Rename method to oddMultiplesProjective.</li>
<li><a
href="https://github.com/cloudflare/circl/commit/12209a4566605692a8402594e367a5aed5148460"><code>12209a4</code></a>
Removing unused cmov for jacobian points.</li>
<li><a
href="https://github.com/cloudflare/circl/commit/fcba359f4178645d2c9e50f29ab6966337da4b95"><code>fcba359</code></a>
ecc/p384: use of complete projective formulas for scalar
multiplication.</li>
<li><a
href="https://github.com/cloudflare/circl/commit/5e1bae8d8c2df4e717c2c5c2d5b5d60b629b2ac6"><code>5e1bae8</code></a>
ecc/p384: handle point doubling in point addition with Jacobian
coordinates.</li>
<li><a
href="https://github.com/cloudflare/circl/commit/341604685ff97e8f7440ae4b4711ba1c118c648c"><code>3416046</code></a>
Check opts for nil value.</li>
<li><a
href="https://github.com/cloudflare/circl/commit/a763d47a6dce43d1f4f7b697d1d7810463a526f6"><code>a763d47</code></a>
Release CIRCL v1.6.2</li>
<li><a
href="https://github.com/cloudflare/circl/commit/3c70bf9ad53b681fbe5ba6067e454a86549fee8a"><code>3c70bf9</code></a>
Bump x/crypto x/sys dependencies.</li>
<li><a
href="https://github.com/cloudflare/circl/commit/3f0f15b2bfe67bad81a35e8aec81ae42ca78349d"><code>3f0f15b</code></a>
Revert to using package-declared HPKE errors for shortkem instead of
standard...</li>
<li><a
href="https://github.com/cloudflare/circl/commit/23491bd573cf29b6f567057a158203a2c9dfa30d"><code>23491bd</code></a>
Adding generic Power2Round method.</li>
<li>Additional commits viewable in <a
href="https://github.com/cloudflare/circl/compare/v1.6.1...v1.6.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/cloudflare/circl&package-manager=go_modules&previous-version=1.6.1&new-version=1.6.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-25 22:56:30 -03:00
dependabot[bot]andIan Littman 6c584e889a Bump github.com/nats-io/nats-server/v2 from 2.12.1 to 2.12.3 (#40406) 
Bumps
[github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server)
from 2.12.1 to 2.12.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nats-io/nats-server/releases">github.com/nats-io/nats-server/v2's
releases</a>.</em></p>
<blockquote>
<h2>Release v2.12.3</h2>
<h2>Changelog</h2>
<p>Refer to the <a
href="https://docs.nats.io/release-notes/whats_new/whats_new_212">2.12
Upgrade Guide</a> for backwards compatibility notes with 2.11.x.</p>
<h3>Go Version</h3>
<ul>
<li>1.25.5 (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7604">#7604</a>)</li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>github.com/google/go-tpm v0.9.7 (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7578">#7578</a>)</li>
<li>github.com/nats-io/nkeys v0.4.12 (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7578">#7578</a>)</li>
<li>golang.org/x/crypto v0.45.0 (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7578">#7578</a>)</li>
<li>github.com/klauspost/compress v1.18.2 (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7604">#7604</a>)</li>
<li>github.com/antithesishq/antithesis-sdk-go v0.5.0-default-no-op (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7604">#7604</a>)</li>
<li>golang.org/x/crypto v0.46.0 (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7648">#7648</a>)</li>
<li>golang.org/x/sys v0.39.0 (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7648">#7648</a>)</li>
</ul>
<h3>Added</h3>
<p>General</p>
<ul>
<li>Added WebSocket-specific ping interval configuration with
<code>ping_internal</code> in the <code>websocket</code> block (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7614">#7614</a>)</li>
</ul>
<h3>Improved</h3>
<p>JetStream</p>
<ul>
<li>The scan for the last sourced message sequence when setting up a
subject-filtered source is now considerably faster (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7553">#7553</a>)</li>
<li>The metalayer will now stage and deduplicate recovery operations at
startup, instead of rapidly applying and then undoing conflicting
assignments (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7540">#7540</a>)</li>
<li>Consumer interest checks on interest-based streams are now
significantly faster when there are large gaps in interest (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7656">#7656</a>)</li>
</ul>
<p>MQTT</p>
<ul>
<li>Retained messages will now work correctly even when sourced from a
different account and has a subject transform (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7636">#7636</a>)</li>
</ul>
<h3>Fixed</h3>
<p>General</p>
<ul>
<li>WebSocket connections will now correctly limit the buffer size
during decompression (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7625">#7625</a>,
thanks to Pavel Kokout at Aisle Research)</li>
</ul>
<p>JetStream</p>
<ul>
<li>A protocol error caused by an invalid transform of acknowledgement
reply subjects when originating from a gateway connection has been fixed
(<a
href="https://redirect.github.com/nats-io/nats-server/issues/7579">#7579</a>)</li>
<li>The meta layer will now only respond to peer remove requests after
quorum has been reached (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7581">#7581</a>)</li>
<li>Invalid subject filters containing non-terminating full wildcard no
longer produce unexpected matches (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7585">#7585</a>)</li>
<li>A data race when creating a stream in clustered mode has been fixed
(<a
href="https://redirect.github.com/nats-io/nats-server/issues/7586">#7586</a>)</li>
<li>Raft will no longer allow multiple membership changes to take place
concurrently (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7565">#7565</a>,
<a
href="https://redirect.github.com/nats-io/nats-server/issues/7609">#7609</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nats-io/nats-server/commit/450a519adf9c53e3d86623bb423dcad5e658ae78"><code>450a519</code></a>
Release v2.12.3</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/8670ba0073be3e12300a31e0f877dd432ef4c70c"><code>8670ba0</code></a>
Release v2.12.3-RC.5</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/08bb9ee8fa0a8b6a5527ef904f887835ff8773e9"><code>08bb9ee</code></a>
Cherry-picks for 2.12.3-RC.5 (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7657">#7657</a>)</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/7bd48a2f3ccbfc026bbd301e965bc0d675eedf79"><code>7bd48a2</code></a>
[IMPROVED] Consumer interest check with large gap</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/9be1774b16df2e099a1f0ff050c78d11eadeae99"><code>9be1774</code></a>
[FIXED] Filestore desync during stream snapshot</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/97f0c1a8bc74e50decc92901087c7ec1331349ff"><code>97f0c1a</code></a>
Release v2.12.3-RC.4</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/036a3fda5bdcc4026af69bfaeee13a8c9eb02936"><code>036a3fd</code></a>
Cherry-picks for 2.12.3-RC.4 (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7652">#7652</a>)</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/6d739faa5c78751b2cfbb4218cf55fb67f792430"><code>6d739fa</code></a>
NRG: Removed leader may reappear in membership</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/d2e57bf2e8df37cbb354141ca21cc6a7362576e2"><code>d2e57bf</code></a>
[FIXED] mb.compact updates last seq/ts</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/8e732b2dafd27a4be7d615d928cb7ffec417e337"><code>8e732b2</code></a>
[FIXED] Filestore idx mismatch &amp; 'no idx present' errors</li>
<li>Additional commits viewable in <a
href="https://github.com/nats-io/nats-server/compare/v2.12.1...v2.12.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/nats-io/nats-server/v2&package-manager=go_modules&previous-version=2.12.1&new-version=2.12.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ian Littman <iansltx@gmail.com>
 2026-02-24 12:51:48 -06:00
Josh Roskos 6769d8dd3a Bump shogo82148/rdsmysql/v2 v2.4.0 to v2.5.0 (#40103) 
https://github.com/shogo82148/rdsmysql/pull/222

Adds AWS GovCloud RDS CA certificates (us-gov-east-1, us-gov-west-1) to
the rdsmysql TLS bundle, improving compatibility for Fleet deployments
in AWS GovCloud regions.

Transitive dependency updates pulled in by rdsmysql v2.5.0:
- github.com/aws/aws-sdk-go-v2 and related submodules (minor bumps)
- github.com/go-sql-driver/mysql v1.9.1 -> v1.9.3
- filippo.io/edwards25519 v1.1.0 -> v1.1.1

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves
https://github.com/fleetdm/fleet/issues/40148

## Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [x] QA'd all new/changed functionality manually 
— dependency bump only; ran full local test suite across all affected
packages (`server/platform/mysql`, `server/logging`, `server/config`,
`server/mail`) with no regressions. `go mod verify` passed.
 2026-02-20 10:33:27 -06:00
dependabot[bot] 2c5733a374 Bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#40113) 
Bumps
[filippo.io/edwards25519](https://github.com/FiloSottile/edwards25519)
from 1.1.0 to 1.1.1.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/FiloSottile/edwards25519/commit/d1c650afb95fad0742b98d95f2eb2cf031393abb"><code>d1c650a</code></a>
extra: initialize receiver in MultiScalarMult</li>
<li>See full diff in <a
href="https://github.com/FiloSottile/edwards25519/compare/v1.1.0...v1.1.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=filippo.io/edwards25519&package-manager=go_modules&previous-version=1.1.0&new-version=1.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-19 12:06:24 -06:00
Lucas Manuel Rodriguez e9f9d5a7d5 Remove github.com/apex/log dependency only used in a tool (#39822) 
Realized this when developing in VSCode and typing `log.` then it
auto-imported that apex/log thing, which seems we only use in a tool.
 2026-02-13 11:42:35 -03:00
Lucas Manuel Rodriguez 1085d66f6f Update macadmins/osquery-extensions to v1.3.2 (#39691) 
Resolves #39642.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] QA'd all new/changed functionality manually

```sh
fleetd 1.51.1:
osquery> .schema munki_installs
CREATE TABLE munki_installs(`installed_version` TEXT, `installed` TEXT, `name` TEXT, `end_time` TEXT, `display_name` TEXT);

Using this branch:
osquery> .schema munki_installs
CREATE TABLE munki_installs(`installed_version` TEXT, `version_to_install` TEXT, `installed` TEXT, `name` TEXT, `end_time` TEXT, `display_name` TEXT);
```

## fleetd/orbit/Fleet Desktop

- [X] Verified that fleetd runs on macOS
- [X] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
 2026-02-11 15:11:28 -03:00