fleet

Author	SHA1	Message	Date
dependabot[bot]andLucas Manuel Rodriguez	23cc1b45e8	Bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#50787 ) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.19.1 to 5.19.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.19.2</h2> <h2>What's Changed</h2> <ul> <li>build: Update module golang.org/x/crypto to v0.52.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2150">go-git/go-git#2150</a></li> <li>build: Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2141">go-git/go-git#2141</a></li> <li>build: Update module golang.org/x/net to v0.55.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2152">go-git/go-git#2152</a></li> <li>git: Worktree: Add stores index entires with backslashes on Windows by <a href="https://github.com/joshblum"><code>@joshblum</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2262">go-git/go-git#2262</a></li> <li>storage: dotgit, reject path traversal in reference names by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2254">go-git/go-git#2254</a></li> <li>build: Update module golang.org/x/net to v0.56.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2267">go-git/go-git#2267</a></li> <li>build: Update module golang.org/x/text to v0.39.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2268">go-git/go-git#2268</a></li> <li>[v5] git: worktree, make the filesystem wrapper a symlink-safe boundary by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2277">go-git/go-git#2277</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2">https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/3eeb238da61eb9c7a324f3ee04f990ce89175642"><code>3eeb238</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2277">#2277</a> from go-git/checkout-v5</li> <li><a href="https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"><code>008a78f</code></a> git: worktree, make the filesystem wrapper a symlink-safe boundary</li> <li><a href="https://github.com/go-git/go-git/commit/2263fb5f022dde90b1c2845f028d3e37e161f2b8"><code>2263fb5</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2268">#2268</a> from go-git/renovate/releases/v5.x-go-golang.org-x-t...</li> <li><a href="https://github.com/go-git/go-git/commit/77b76250d93ec83e2c897638d8a3847b1bfaa38d"><code>77b7625</code></a> build: Update module golang.org/x/text to v0.39.0 [SECURITY]</li> <li><a href="https://github.com/go-git/go-git/commit/85ea767be2b2281693e61afe83911e12c86d6eb7"><code>85ea767</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2267">#2267</a> from go-git/renovate/releases/v5.x-go-golang.org-x-n...</li> <li><a href="https://github.com/go-git/go-git/commit/198675a07b3b8f4eb8f51bf188663a13bb0d9e1a"><code>198675a</code></a> build: Update module golang.org/x/net to v0.56.0 [SECURITY]</li> <li><a href="https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7"><code>4a0e66d</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2254">#2254</a> from pjbgf/v5-dotgit-ref-name-containment</li> <li><a href="https://github.com/go-git/go-git/commit/3b306ef83bd05194a30ce820eed7ed61c3084b5f"><code>3b306ef</code></a> storage: dotgit, align reference-name safety with refname_is_safe</li> <li><a href="https://github.com/go-git/go-git/commit/f3d0cc150b39ae1dc47406a5c170464286914610"><code>f3d0cc1</code></a> storage: dotgit, reject path traversal in reference names</li> <li><a href="https://github.com/go-git/go-git/commit/979cfe9c561d3ced778c88d9cde6db3297e6ed1d"><code>979cfe9</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2262">#2262</a> from joshblum/joshblum/to-slash-v5</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.19.1&new-version=5.19.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>	2026-08-07 14:34:00 -03:00
Luke Heath	d628cb338b	Bump Go and npm dependencies to resolve high-severity code scanning alerts (#50314 )	2026-07-31 12:10:54 -05:00
dependabot[bot]andLucas Manuel Rodriguez	3d4cf0dfee	Bump google.golang.org/grpc from 1.79.3 to 1.82.1 (#49957 ) - [X] QA'd all new/changed functionality manually Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.79.3 to 1.82.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.82.1</h2> <h1>Security</h1> <ul> <li>server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable <code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li> <li>xds/rbac: Support <code>Metadata</code> and <code>RequestedServerName</code> permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.</li> <li>xds/rbac: Fix panic when parsing unsupported fields in <code>NotRule</code>/<code>NotId</code> permissions.</li> <li>xds/rbac: Support the deprecated <code>source_ip</code> principal identifier by treating it as equivalent to <code>direct_remote_ip</code>.</li> </ul> <h2>Release 1.82.0</h2> <h1>Behavior Changes</h1> <ul> <li>server: Remove support for <code>GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING</code> environment varibale. Strict incoming RPC path validation (which has been the default since <code>v1.79.3</code>) can no longer be disabled. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9112">#9112</a>)</li> <li>transport: Add environment variable to change the default max header list size from <code>16MB</code> to <code>8KB</code>. This may be enabled by setting <code>GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true</code>. This will be enabled by default in a subsequent release. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9019">#9019</a>)</li> <li>balancer: Load Balancing policy registry is now case-sensitive. Set <code>GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false</code> (and file an issue) to revert to case-insensitive behavior. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9017">#9017</a>)</li> </ul> <h1>New Features</h1> <ul> <li>experimental/stats: Expose a new API, <code>NewContextWithLabelCallback</code>, to register a callback that is invoked when telemetry labels are added. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8877">#8877</a>) <ul> <li>Special Thanks: <a href="https://github.com/seth-epps"><code>@seth-epps</code></a></li> </ul> </li> <li>client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>) <ul> <li>Special Thanks: <a href="https://github.com/chengxilo"><code>@chengxilo</code></a></li> </ul> </li> <li>server: Add environment variable <code>GRPC_GO_SERVER_GOROUTINE_LABELS</code> that controls setting <code>runtime/pprof.Labels</code> on goroutines spawned by the server. Set <code>GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true</code> to add the <code>grpc.method</code> label on goroutines spawned to handle incoming requests. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>) <ul> <li>Special Thanks: <a href="https://github.com/dfinkel"><code>@dfinkel</code></a></li> </ul> </li> </ul> <h1>Bug Fixes</h1> <ul> <li>xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9138">#9138</a>)</li> <li>grpc: In the deprecated <code>gzip</code> Compressor (used via the deprecated <code>WithCompressor</code> dial option), enforce the <code>MaxRecvMsgSize</code> limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9114">#9114</a>) <ul> <li>Special Thanks: <a href="https://github.com/evilgensec"><code>@evilgensec</code></a></li> </ul> </li> <li>stats/opentelemetry: Record retry attempts, <code>grpc.previous-rpc-attempts</code>, at the call level and not the attempt level. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8923">#8923</a>)</li> <li>encoding: Ensure <code>Close()</code> is always called on readers returned from <code>Compressor.Decompress</code> if possible. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9135">#9135</a>)</li> <li>channelz: Fix the <code>LastMessageSentTimestamp</code> and <code>LastMessageReceivedTimestamp</code> fields in <code>SocketMetrics</code> to ensure they contain correct timestamp values. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9109">#9109</a>)</li> </ul> <h2>Release 1.81.1</h2> <h1>Security</h1> <ul> <li>xds/rbac: Fix a potential authorization bypass caused by incorrectly falling through URI/DNS SANs to Subject Distinguished Name (DN) when matching the authenticated principal name. With this fix, only the first non-empty identity source will be used, as per <a href="https://github.com/grpc/proposal/blob/master/A41-xds-rbac.md">gRFC A41</a>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9111">#9111</a>) <ul> <li>Special Thanks: <a href="https://github.com/al4an444"><code>@al4an444</code></a></li> </ul> </li> </ul> <h1>Bug Fixes</h1> <ul> <li>otel: Segregate client and server RPC information used for metrics and traces, to avoid one overwriting the other. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9081">#9081</a>)</li> </ul> <h2>Release 1.81.0</h2> <h1>Behavior Changes</h1> <ul> <li>balancer/rls: Switch gauge metrics to asynchronous emission (once per collection cycle) to reduce telemetry noise and align with other gRPC language implementations. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8808">#8808</a>)</li> </ul> <h1>Dependencies</h1> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/ebd8f06a09426fbece97157c95c3917abff28f4e"><code>ebd8f06</code></a> Change version to 1.82.1 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9238">#9238</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935"><code>4ea465d</code></a> Cherry-pick commits (<a href="https://redirect.github.com/grpc/grpc-go/issues/9236">#9236</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/9494a2cf32a0ec9d35420af401445ef3c9f66f05"><code>9494a2c</code></a> Change version to 1.82.1-dev (<a href="https://redirect.github.com/grpc/grpc-go/issues/9171">#9171</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/bd239854f0ab7f1ee63457d47f7c1d2675e1f736"><code>bd23985</code></a> Change version to 1.82.0 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9170">#9170</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/0f3086db7a755b6af83a90809471dd7f645b345a"><code>0f3086d</code></a> Fix minor issues not covered by PR <a href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a> (<a href="https://redirect.github.com/grpc/grpc-go/issues/9147">#9147</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/fef07fbb2b94b668e8daca1f6b70433dcd36c1c8"><code>fef07fb</code></a> internal: Split v3procservicepb import into pb and grpc for extproc (<a href="https://redirect.github.com/grpc/grpc-go/issues/9163">#9163</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/91dd64f4b83cb5134e279d1126ebb1ccf47d4d31"><code>91dd64f</code></a> transport: surface subsequent data when receiving non-gRPC header (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/adc97de9521a9f377dab5e911039842dc4de23e5"><code>adc97de</code></a> test/kokoro: add config for regional-td test (<a href="https://redirect.github.com/grpc/grpc-go/issues/9158">#9158</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/57c9ff14e05b535ee6995ba49bc882b287a175de"><code>57c9ff1</code></a> xds: ensure full-string matching for RBAC Filter rules (<a href="https://redirect.github.com/grpc/grpc-go/issues/9148">#9148</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/b58f32d9ff07c612d64e677bd826bcbec88af9bd"><code>b58f32d</code></a> server: Set a pprof label on new stream goroutines (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)</li> <li>Additional commits viewable in <a href="https://github.com/grpc/grpc-go/compare/v1.79.3...v1.82.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.79.3&new-version=1.82.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>	2026-07-28 11:40:25 -03:00
Lucas Manuel Rodriguez	60d8f51374	Move `test/upgrade` to `tools/` to reduce security scanning noise (#49158 ) Two reasons: - It's a testing/QA tool, so it should be under `tools/` - Reduce security-noise because it's just an internal tool (all findings under tools/ should be ignored). Failing dependency review expected because of the security findings in the docker Go packages. (Which can be fixed/updated when a patch is issued but without urgency because this is an internal tool.) ## Testing - [x] QA'd all new/changed functionality manually Ran: ``` cd tools/upgrade FLEET_VERSION_A=v4.87.1 FLEET_VERSION_B=v4.88.1 go test ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * New Features * Added an end-to-end upgrade test scenario across two Fleet versions. * Added a Docker Compose-based upgrade environment (Fleet, MySQL, Redis, osquery) with local TLS certs/keys and osquery flags. * Tests * Added automated Fleet readiness checks and host enrollment verification before and after upgrade. * Chores / Security * Updated the database upgrade test workflow and Go module tooling for the new upgrade test setup. * Adjusted secret scanning allow-rules and refreshed Go dependencies for the upgrade module. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-13 11:17:37 -03:00
Lucas Manuel Rodriguez	21c024313a	Upgrade `nfpm` package in `fleetctl` (#48961 ) Resolves #48954. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] QA'd all new/changed functionality manually Tested a package generated with new `fleetctl` on Fedora 43, Ubuntu 25.04, and Omarchy. ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary of changes * Bug Fixes * Improved Linux RPM packaging consistency, including more reliable output filename normalization and correct platform metadata. * Ensured RPM metadata extraction stays aligned with the updated packaging flow. * Tests * Added coverage for RPM filename normalization edge cases. * Updated a CPE rule validation test expectation to match the new error-string format. * Chores * Upgraded packaging tooling and refreshed Go dependencies. * Security * Removed a previously ignored CVE entry from vulnerability scan ignore settings. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-09 15:29:48 -03:00
Luke Heath	2b50257de9	Bump golang.org/x/image to v0.42.0 (CVE-2026-33813) (#48345 )	2026-06-26 11:24:16 -07:00
dependabot[bot]andLucas Manuel Rodriguez	33cbc192b2	Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 (#47959 ) Bumps [github.com/containerd/containerd](https://github.com/containerd/containerd) from 1.7.32 to 1.7.33. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/containerd/containerd/releases">github.com/containerd/containerd's releases</a>.</em></p> <blockquote> <h2>containerd 1.7.33</h2> <p>Welcome to the v1.7.33 release of containerd!</p> <p>The thirty-third patch release for containerd 1.7 contains various fixes and updates including security patches.</p> <h3>Security Updates</h3> <ul> <li> <p><strong>containerd</strong></p> <ul> <li><a href="https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp"><strong>CVE-2026-53488</strong></a></li> <li><a href="https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq"><strong>CVE-2026-47262</strong></a></li> </ul> </li> <li> <p><strong>go-jose</strong></p> <ul> <li><a href="https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"><strong>CVE-2026-34986</strong></a></li> </ul> </li> </ul> <p>Please try out the release binaries and report any issues at <a href="https://github.com/containerd/containerd/issues">https://github.com/containerd/containerd/issues</a>.</p> <h3>Contributors</h3> <ul> <li>Samuel Karp</li> <li>Chris Henzie</li> <li>Akihiro Suda</li> <li>Akhil Mohan</li> <li>Ben Cressey</li> <li>Davanum Srinivas</li> <li>Sopho Merkviladze</li> </ul> <h3>Changes</h3> <!-- raw HTML omitted --> <ul> <li>Prepare release notes for v1.7.33 (<a href="https://redirect.github.com/containerd/containerd/pull/13631">#13631</a>) <ul> <li><a href="https://github.com/containerd/containerd/commit/7517e6737a6077dbdb5d403e693169cb8163549d"><code>7517e6737</code></a> Prepare release notes for v1.7.33</li> <li><a href="https://github.com/containerd/containerd/commit/ab306518a326fe7e4c27f64a8cf62b7a0fb3e9c6"><code>ab306518a</code></a> Merge commit from fork</li> <li><a href="https://github.com/containerd/containerd/commit/d34cdafdaf51e1db435f1e0898f16d0da5038557"><code>d34cdafda</code></a> Merge commit from fork</li> <li><a href="https://github.com/containerd/containerd/commit/9ab2b7a894d15738f8323f69def272c29277b57f"><code>9ab2b7a89</code></a> Bound user-database file reads in openBoundedUserFile</li> <li><a href="https://github.com/containerd/containerd/commit/1e9806f90d934f2e0180c279fa9f0019537f2704"><code>1e9806f90</code></a> Merge commit from fork</li> <li><a href="https://github.com/containerd/containerd/commit/4d8ba4d23561c9ec21b0113ddcfc22f41792b25e"><code>4d8ba4d23</code></a> Do not propagate reserved labels from image configs</li> </ul> </li> <li>update runc binary to v1.3.6 (<a href="https://redirect.github.com/containerd/containerd/pull/13615">#13615</a>) <ul> <li><a href="https://github.com/containerd/containerd/commit/74c728c13487844c43620b14cc66dc05dca96836"><code>74c728c13</code></a> update runc binary to v1.3.6</li> </ul> </li> <li>update go to 1.26.4/1.25.11 (<a href="https://redirect.github.com/containerd/containerd/pull/13579">#13579</a>) <ul> <li><a href="https://github.com/containerd/containerd/commit/947caa4b7469fd3b71ee62d0f7410b00252f5842"><code>947caa4b7</code></a> update go to 1.26.4/1.25.11</li> </ul> </li> <li>Configure udevd children-max for root-test (<a href="https://redirect.github.com/containerd/containerd/pull/13564">#13564</a>) <ul> <li><a href="https://github.com/containerd/containerd/commit/e884e964e31c4fb61fcdc376a2fa3151ac245a65"><code>e884e964e</code></a> Configure udevd children-max for root-test</li> </ul> </li> <li>Clean up disk space in node e2e workflow (<a href="https://redirect.github.com/containerd/containerd/pull/13552">#13552</a>) <ul> <li><a href="https://github.com/containerd/containerd/commit/b9e7568888325736b12c9f50271045bc618dc9b9"><code>b9e756888</code></a> Clean up disk space in node e2e workflow</li> </ul> </li> <li>Bump go-jose/go-jose/v3 to v3.0.5 to fix GHSA-78h2-9frx-2jm8 (<a href="https://redirect.github.com/containerd/containerd/pull/13467">#13467</a>) <ul> <li><a href="https://github.com/containerd/containerd/commit/4dfc1844e8cb46a6c04a8c57211ab50e1412ccc1"><code>4dfc1844e</code></a> Bump go-jose to v3.0.5 to address CVE-2026-34986</li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/containerd/containerd/commit/e8b1a9bc270f9952197c470b8bad573b03a3a608"><code>e8b1a9b</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/13631">#13631</a> from samuelkarp/prepare-1.7.33</li> <li><a href="https://github.com/containerd/containerd/commit/7517e6737a6077dbdb5d403e693169cb8163549d"><code>7517e67</code></a> Prepare release notes for v1.7.33</li> <li><a href="https://github.com/containerd/containerd/commit/ab306518a326fe7e4c27f64a8cf62b7a0fb3e9c6"><code>ab30651</code></a> Merge commit from fork</li> <li><a href="https://github.com/containerd/containerd/commit/096289897c75f26f9b1e7a805acde329fa048a96"><code>0962898</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/13615">#13615</a> from k8s-infra-cherrypick-robot/cherry-pick-13606-t...</li> <li><a href="https://github.com/containerd/containerd/commit/74c728c13487844c43620b14cc66dc05dca96836"><code>74c728c</code></a> update runc binary to v1.3.6</li> <li><a href="https://github.com/containerd/containerd/commit/d34cdafdaf51e1db435f1e0898f16d0da5038557"><code>d34cdaf</code></a> Merge commit from fork</li> <li><a href="https://github.com/containerd/containerd/commit/1e9806f90d934f2e0180c279fa9f0019537f2704"><code>1e9806f</code></a> Merge commit from fork</li> <li><a href="https://github.com/containerd/containerd/commit/9ab2b7a894d15738f8323f69def272c29277b57f"><code>9ab2b7a</code></a> Bound user-database file reads in openBoundedUserFile</li> <li><a href="https://github.com/containerd/containerd/commit/d805d96d67b205a40d3c12414ec306d19ec2d848"><code>d805d96</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/13579">#13579</a> from akhilerm/1.7-go1.26.4</li> <li><a href="https://github.com/containerd/containerd/commit/947caa4b7469fd3b71ee62d0f7410b00252f5842"><code>947caa4</code></a> update go to 1.26.4/1.25.11</li> <li>Additional commits viewable in <a href="https://github.com/containerd/containerd/compare/v1.7.32...v1.7.33">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/containerd/containerd&package-manager=go_modules&previous-version=1.7.32&new-version=1.7.33)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>	2026-06-22 09:23:41 -03:00
Luke Heath	f50fea0f42	Bump golang.org/x/crypto to v0.52.0 and golang.org/x/net to v0.55.0 (#46949 )	2026-06-08 14:30:58 -05:00
dependabot[bot]	43869a1d86	Bump github.com/containerd/containerd from 1.7.29 to 1.7.32 (#46030 )	2026-05-22 08:34:48 -05:00
dependabot[bot]	9115f0c4ff	Bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#45815 ) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.19.0 to 5.19.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.19.1</h2> <h2>What's Changed</h2> <ul> <li>v5: plumbing: transport/ssh, Shell-quote path by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2068">go-git/go-git#2068</a></li> <li>v5: git: submodule, Fix relative URL resolution by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2070">go-git/go-git#2070</a></li> <li>v5: git: submodule, canonical remote for relative URLs by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2074">go-git/go-git#2074</a></li> <li>v5: git: submodule, error on remote without URLs by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2078">go-git/go-git#2078</a></li> <li>v5: plumbing: format/idxfile, Validate offset64 indices by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2084">go-git/go-git#2084</a></li> <li>v5: *: Reject malformed variable-length integers by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2092">go-git/go-git#2092</a></li> <li>v5: plumbing: format/packfile, Tighten delta validation by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2091">go-git/go-git#2091</a></li> <li>v5: Add <code>worktreeFilesystem</code> wrapper for worktree and hardening by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2100">go-git/go-git#2100</a></li> <li>v5: config: validate submodule names by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2082">go-git/go-git#2082</a></li> <li>build: Update module github.com/go-git/go-git/v5 to v5.19.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2111">go-git/go-git#2111</a></li> <li>v5: git: Allow MkdirAll on worktree-root paths by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2117">go-git/go-git#2117</a></li> <li>v5: git: Stop validating symlink target paths by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2116">go-git/go-git#2116</a></li> <li>v5: plumbing: format decoder input bounds and contracts by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2125">go-git/go-git#2125</a></li> <li>plumbing: format/packfile, cap delta chain depth in parser by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2137">go-git/go-git#2137</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1">https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/3c3be601aa6c0fd0d536c0d1e4f898b4c60e65fe"><code>3c3be60</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2137">#2137</a> from go-git/validate-v5</li> <li><a href="https://github.com/go-git/go-git/commit/3fba897bd9e84b1aec170fa708b80e297b7d6cf6"><code>3fba897</code></a> plumbing: format/packfile, cap delta chain depth in parser</li> <li><a href="https://github.com/go-git/go-git/commit/a97d6601c85e017bb64c2b0f2e3169f6ef6a6709"><code>a97d660</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2125">#2125</a> from hiddeco/v5/format-input-bounds</li> <li><a href="https://github.com/go-git/go-git/commit/aeaa125c8af8e4c4c95b574c22c5633e97fc436e"><code>aeaa125</code></a> plumbing: format/objfile, require Header before Read</li> <li><a href="https://github.com/go-git/go-git/commit/1f38e171218526ea254a73187a52f0648253c1b8"><code>1f38e17</code></a> plumbing: format/packfile, bound inflate size</li> <li><a href="https://github.com/go-git/go-git/commit/f7545a02529e03998d6a7219140dc0e6644ad337"><code>f7545a0</code></a> plumbing: format/idxfile, bound nr by file size</li> <li><a href="https://github.com/go-git/go-git/commit/170b88181f385913a457a08b68c88956fb3f8e4f"><code>170b881</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2116">#2116</a> from pjbgf/symlink-v5</li> <li><a href="https://github.com/go-git/go-git/commit/7b6d994467f06630268904aa3c441b6de7248b31"><code>7b6d994</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2117">#2117</a> from hiddeco/v5/worktree-fs-mkdirall-root-noop</li> <li><a href="https://github.com/go-git/go-git/commit/f0709b32f8fbb87c16cd63c6762d2cd515f36541"><code>f0709b3</code></a> git: Stop validating symlink target paths</li> <li><a href="https://github.com/go-git/go-git/commit/776d00f11d336f26862d0f2bab987b217f3a7844"><code>776d00f</code></a> git: Allow MkdirAll on worktree-root paths</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.19.0&new-version=5.19.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-19 15:15:18 -03:00
Scott Gress	d7fa35e417	Implement roaring bitmaps for historical data collection (#45709 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #45715 # Details This PR refactors the way the charts module stores historical data to use the [roaring bitmap](https://github.com/RoaringBitmap/roaring) package instead of saving raw bitmaps. See [this blurb](https://github.com/RoaringBitmap/roaring#how-does-roaring-compares-with-the-alternatives) to learn how roaring compresses data, but TL;DR for our purposes it represents a huge improvement especially for larger deployments where host ID numbers may be very large. In testing, some data was reduced 96%. The majority of the changes in this PR are straight swapping of types from `[]byte` to `roaring.Bitmap` in vars and function signatures, and updating the internals of our bit math helpers to use roaring methods instead of native AND and OR methods. I've tried to comment on all functional changes. Since the charts have been shipped already, so there will be data in the wild in the prior "dense" format, the code still handles dense bitmaps on _read_, but will always _write_ roaring bitmaps. The majority of the data will therefore have turned over within 30 days on its own, but I plan on a follow-up PR that will transform open rows when the cron runs so that we should be guaranteed to turn over completely within 30 days. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [X] Added/updated automated tests - Tests updated to accommodate the new format, and existing unchanged tests act as proof against regression - [X] QA'd all new/changed functionality manually - Using a tool that dumps the `host_scd_data` rows data into a JSON file (with the keys being entity_id+data and the values being host IDs on that date), compared the data from main branch and this and confirmed they're identical - With a host count of ~9000, some of which have IDs of over 1,000,000, the data storage requirements were: * 82,558,976 bytes for dense * 2,867,200 for roaring (a 96% decrease) For unreleased bug fixes in a release candidate, one of: - [X] Confirmed that the fix is not expected to adversely impact load test results - should hugely improve - [X] Alerted the release DRI if additional load testing is needed ## Database migrations - [X] Checked schema for all modified table for columns that will auto-update timestamps during migration. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Implemented roaring bitmaps in historical data collection to optimize bitmap handling for chart data aggregation * Added encoding support to bitmap storage schema for flexible data representation <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-19 09:34:29 -05:00
dependabot[bot]	9476bc9fcd	Bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 (#45146 ) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.18.0 to 5.19.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.19.0</h2> <h2>What's Changed</h2> <ul> <li>build: Update module github.com/go-git/go-git/v5 to v5.18.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2010">go-git/go-git#2010</a></li> <li>v5: Bump sha1cd and go-billy by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2060">go-git/go-git#2060</a></li> <li>v5: Align object encoding with upstream by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2065">go-git/go-git#2065</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.18.0...v5.19.0">https://github.com/go-git/go-git/compare/v5.18.0...v5.19.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/bc930f4cbe095a3e1d49273655f73fcef7d41a42"><code>bc930f4</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2065">#2065</a> from go-git/commit-v5</li> <li><a href="https://github.com/go-git/go-git/commit/d315264343cead712aa9eb56475c2ec96f5ecef1"><code>d315264</code></a> plumbing: object, Reset object before decode</li> <li><a href="https://github.com/go-git/go-git/commit/6e1d34890a4dae8a0df738e531234bd60b7e9b66"><code>6e1d348</code></a> plumbing: object, Align Tree handling with upstream</li> <li><a href="https://github.com/go-git/go-git/commit/e134ba34cf95ed0167e5b1df36a933d7bde9d02d"><code>e134ba3</code></a> tests: Skip double checks in Git v2.11</li> <li><a href="https://github.com/go-git/go-git/commit/1971422f6b1bec9176061b3293306981cfff981e"><code>1971422</code></a> tests: Add git conformance tests for signing verification</li> <li><a href="https://github.com/go-git/go-git/commit/a387aa8857a8fbba8e74b7f5485e9e030669ab5d"><code>a387aa8</code></a> plumbing: object, Add ErrMalformedTag</li> <li><a href="https://github.com/go-git/go-git/commit/f415670d906b5c6169d1fdc64f3f9f1d33eb6f9c"><code>f415670</code></a> plumbing: object, Decode Tag headers via a state machine</li> <li><a href="https://github.com/go-git/go-git/commit/5b0cd38a62e2336bb5f1a2ad0eb8ac8f9e7b740e"><code>5b0cd38</code></a> plumbing: object, Reject multi-signature commits at Verify</li> <li><a href="https://github.com/go-git/go-git/commit/fe8ed6223a6079d9fd84d853362a996e7df175fb"><code>fe8ed62</code></a> plumbing: object, Align Tag.EncodeWithoutSignature with Commit</li> <li><a href="https://github.com/go-git/go-git/commit/98e337d5bdc4c0536a40ab7381b2231f7e0b15cd"><code>98e337d</code></a> plumbing: object, Add support for Tag.SignatureSHA256</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.18.0...v5.19.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.18.0&new-version=5.19.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-11 14:18:44 -03:00
dependabot[bot]	3292f0eb47	Bump github.com/apache/thrift from 0.22.0 to 0.23.0 (#44889 ) Bumps [github.com/apache/thrift](https://github.com/apache/thrift) from 0.22.0 to 0.23.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/thrift/releases">github.com/apache/thrift's releases</a>.</em></p> <blockquote> <h2>Version 0.23.0</h2> <p>Please head over to the official release download source: <a href="http://thrift.apache.org/download">http://thrift.apache.org/download</a></p> <p>The assets listed below are added by Github based on the release tag and they will therefore not match the checkums published on the Thrift project website.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/apache/thrift/blob/master/CHANGES.md">github.com/apache/thrift's changelog</a>.</em></p> <blockquote> <h2>0.23.0</h2> <h3>Build Process</h3> <ul> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5877">THRIFT-5877</a> - Add cpp cross tests</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5866">THRIFT-5866</a> - Dockerfile to support Ubuntu 24.04 LTS (Noble Numbat)</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5909">THRIFT-5909</a> - add Ruby in GitHub workflow</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5649">THRIFT-5649</a> - add go in GitHub workflow / action</li> </ul> <h3>C glib</h3> <ul> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5931">THRIFT-5931</a> - thrift_ssl_socket_get_ssl_error() can underflow its remaining-buffer counter and write past the stack buffer</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5871">THRIFT-5871</a> - Improve MAX_MESSAGE_SIZE check and friends</li> </ul> <h3>C++</h3> <ul> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5911">THRIFT-5911</a> - Inconsistent UUID compilation for aliased types</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5912">THRIFT-5912</a> - Assertion failed: <code>delta > 0</code>, file ThreadManagerTests.h, line 162</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5880">THRIFT-5880</a> - C++ TSocket on an IPv6-only system fails if you use a hostname of 127.0.0.1</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-3268">THRIFT-3268</a> - warning: token pasting of ',' and <code>__VA_ARGS__</code> is a GNU extension</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5887">THRIFT-5887</a> - build/cmake/ should be prepended (not appended) to CMAKE_MODULE_PATH</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5878">THRIFT-5878</a> - Add UUID support for THeaderProtocol and TProtocolTap</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5898">THRIFT-5898</a> - Unable to build Thrift as a shared library on Windows</li> </ul> <h3>Contributed</h3> <ul> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5920">THRIFT-5920</a> - Remove threadsafe warnings in thrift-maven-plugin</li> </ul> <h3>Delphi</h3> <ul> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5939">THRIFT-5939</a> - Replace GUID generation with stable UUID algorithm</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5876">THRIFT-5876</a> - Add Delphi WinHTTP client TLS1.3 support</li> </ul> <h3>Go</h3> <ul> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5896">THRIFT-5896</a> - Race condition in TServerSocket.Addr() method</li> </ul> <h3>Java</h3> <ul> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5925">THRIFT-5925</a> - UUID implementation in JAVA is not according to the Thrift Specification</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5869">THRIFT-5869</a> - Close the transport after TServerEventHandler deleteContext</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5863">THRIFT-5863</a> - Make TServerTransport able to customize the max message size</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5774">THRIFT-5774</a> - Add remote client's IP address to ServerContext in TServerEventHandler</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-4280">THRIFT-4280</a> - Add async nonblocking ssl support in java client</li> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5879">THRIFT-5879</a> - java and kotlin cross tests fail in the GitHub action</li> </ul> <h3>netstd</h3> <ul> <li><a href="https://issues.apache.org/jira/browse/THRIFT-5902">THRIFT-5902</a> - Add net10 support</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/thrift/commit/e4b684f5ff4f9c3a42cd7ec0a667c3d9bd7f6ac1"><code>e4b684f</code></a> Updated CHANGES.md</li> <li><a href="https://github.com/apache/thrift/commit/c4cbe43fd12ab5d043af5dd08d1f59e2ba07b2e4"><code>c4cbe43</code></a> Address vulnerabilities in Rack</li> <li><a href="https://github.com/apache/thrift/commit/68ac8e935ef440c3e22d0e1a30e7211b9bf1d441"><code>68ac8e9</code></a> Enable TLS hostname verification in TNonblockingSSLSocket</li> <li><a href="https://github.com/apache/thrift/commit/5e4f01d737e4d3845d07dde6da43981feee0cb9a"><code>5e4f01d</code></a> Harden Node.js WebSocket server handling</li> <li><a href="https://github.com/apache/thrift/commit/e242889231df48f8791372598052862c28f5be83"><code>e242889</code></a> Add input validation to Swift protocol layer</li> <li><a href="https://github.com/apache/thrift/commit/4af8c7c8768cb687b182c1839a39d4beb4f35a5d"><code>4af8c7c</code></a> Add recursion depth limit to Node.js protocol skip()</li> <li><a href="https://github.com/apache/thrift/commit/a30c552bd0808b7e19f35ad30212ba7a9aee8c66"><code>a30c552</code></a> Enable TLS hostname verification in TSSLTransportFactory</li> <li><a href="https://github.com/apache/thrift/commit/0f8ec9c1014ed21acc324aaa421017fb164e9608"><code>0f8ec9c</code></a> Fix parent class resolution in c_glib generated dispatch_call</li> <li><a href="https://github.com/apache/thrift/commit/276ec883910cd936b4f9413bf607c808a7423185"><code>276ec88</code></a> THRIFT-5929: Fix build failure on PHP 8.5 due to removed zend_exception_get_d...</li> <li><a href="https://github.com/apache/thrift/commit/17f2c13ec2b27503dd0de2720401b96787632364"><code>17f2c13</code></a> Added missing 0.23.0 JIRA tickets to CHANGES.md</li> <li>Additional commits viewable in <a href="https://github.com/apache/thrift/compare/v0.22.0...v0.23.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/apache/thrift&package-manager=go_modules&previous-version=0.22.0&new-version=0.23.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-07 11:48:03 -03:00
Victor Lyuboslavsky	de86536f42	Redis-backed cache for host-by-key lookups (#43936 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #43928 This PR adds a Redis-backed cache in front of the two host-by-key lookups on the agent auth paths. Docs: https://github.com/fleetdm/fleet/pull/44504 ## What changes Read path (osquery/orbit auth): - `LoadHostByNodeKey` and `LoadHostByOrbitNodeKey` now check Redis before falling through to MySQL. - Successful lookups are cached for 60s ± 10% jitter (configurable via `FLEET_REDIS_HOST_CACHE_TTL`). - `NotFound` results are cached for 5s as a negative entry, dampening repeated probes for keys that do not exist (deleted hosts whose agents are still polling, attacker scans, retry storms). - Concurrent lookups for the same key collapse into one DB query via `singleflight`. The shared query runs under a context detached from any one caller's deadline so the leader giving up does not abort the work for joiners. The shared query is itself bounded by a 30s timeout so a wedged DB call cannot pin the singleflight slot indefinitely. Write path (invalidations): - These methods now invalidate the cache after a successful inner call: `UpdateHost`, `SerialUpdateHost`, `UpdateHostOsqueryIntervals`, `UpdateHostRefetchRequested`, `UpdateHostRefetchCriticalQueriesUntil`, `UpdateHostIdentityCertHostIDBySerial`, `EnrollOsquery`, `EnrollOrbit`, `NewHost`, `DeleteHost`, `DeleteHosts`, `CleanupExpiredHosts`, `CleanupIncomingHosts`, `AddHostsToTeam`. - `AddHostsToTeam`, `DeleteHosts`, `CleanupExpiredHosts`, and `CleanupIncomingHosts` use a pipelined batch invalidator so 10k-host operations stay in the millisecond range instead of taking minutes of sequential round-trips. - Inner-call errors are not invalidations: a failing write leaves cached state intact. Configuration: - New flags `FLEET_REDIS_HOST_CACHE_ENABLED` (default `true`) and `FLEET_REDIS_HOST_CACHE_TTL` (default `60s`). - Server refuses to start if the cache is enabled with `TTL <= 0`. Observability: - Three new OTEL counters under the `fleet` meter: - `fleet.host_cache.lookups{result=hit\|negative_hit\|miss}` - `fleet.host_cache.errors{op=get\|set\|del}` - `fleet.host_cache.invalidations{reason=update\|enroll\|team\|delete\|cert}` - A pre-built SigNoz dashboard ships in `tools/signoz/host_cache_dashboard.json`. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Optional Redis-backed host lookup cache for osquery and orbit auth, with automatic invalidation and metrics/monitoring dashboard. * Bug Fixes * Fixed host-removal batching so cache-related removals use correct chunks. * Tests * Added comprehensive host-cache unit tests covering hits, negative cache, invalidation, concurrency, and JSON round-trips. * Chores * New config flags to enable the cache and set TTL (default 60s ±10% jitter). <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-01 12:06:16 -05:00
Victor Lyuboslavsky	9628f49cb8	Improved the performance of Windows MDM profile reconciliation (#44075 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #44052 Improve performance by reducing the time for the synchronous API call to update profiles or switch teams. And spreading out the application of profiles by processing 2000 hosts every 30 seconds. 1. Windows profile reconciliation is no longer synchronous to bulk-set. Apple, Android, and Apple-declaration paths still write their pending state inside the bulk-set transaction. The Windows path commits the transactional inputs and lets the existing `mdm_windows_profile_manager` cron pick the work up on its next tick. The visible effect is that `host_mdm_windows_profiles` is no longer guaranteed to be populated by the time bulk-set returns; it converges within one cron interval. 2. The Windows reconciler now processes hosts in bounded batches, with a persisted cursor. Previous behavior was "scan the universe of pending Windows hosts on every tick." New behavior is a host-window query bounded by batch size and a `host_uuid` cursor, advanced after the batch commits successfully and persisted across ticks. A failed tick leaves the cursor untouched so the same window is retried. 3. Two replication races are now explicitly handled. - Admin-delete vs reconcile: the existence check the reconciler uses to avoid touching a just-deleted profile reads from the primary, not a replica. - Insert lag in the reconciler's own listings: hosts that appear in the cursor query but are not yet visible in the scoped listings advance the cursor instead of jamming the loop. 4. `updates.WindowsConfigProfile` from `BulkSetPendingMDMHostProfiles` is now always false in production. The only consumer ORs it with the transactional signal from `BatchSetMDMProfiles`, which is the accurate source. The bulk-set call no longer attempts to compute or return that activity signal itself. 5. Tests opt in to the old synchronous behavior via a named hook. Default test behavior matches production (deferred). Legacy tests whose assertions require Windows rows immediately after bulk-set call an explicit enable-hook and rely on `t.Cleanup` to restore. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Windows MDM profile reconciliation batching improvements enable large team transfers and bulk profile change operations to complete faster, with profile updates rolling out in the background without blocking host check-ins or other MDM activity. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-04-28 15:37:43 -05:00
Lucas Manuel Rodriguez	d4c0834cba	Bump macadmins/osquery-extension to v1.4.1 and add network_quality ta… (#44214 ) Related issue: Resolves #44202. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [X] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [X] Verified that fleetd runs on macOS, Linux and Windows - [X] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added network quality table for macOS to monitor download and upload speeds with results formatted in both kilobits and megabits per second (requires macOS 12+) * Chores * Updated MacAdmins osquery extension dependency to v1.4.1 <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-04-27 14:52:27 -03:00
dependabot[bot]andLucas Manuel Rodriguez	3af4baf691	Bump github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1 (#44089 ) Bumps [github.com/Azure/go-ntlmssp](https://github.com/Azure/go-ntlmssp) from 0.0.0-20221128193559-754e69321358 to 0.1.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Azure/go-ntlmssp/releases">github.com/Azure/go-ntlmssp's releases</a>.</em></p> <blockquote> <h2>v0.1.1</h2> <p>Fix CVE-2026-32952: A malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using ntlmssp.Negotiator as an HTTP transport.</p> <h2>v0.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump minimum required version to Go 1.24 by <a href="https://github.com/qmuntal"><code>@qmuntal</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/53">Azure/go-ntlmssp#53</a></li> <li>Fix OOM in NTLM negotiator by avoiding buffering of seekable request bodies by <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/54">Azure/go-ntlmssp#54</a></li> <li>Don't modify the rountripped request by <a href="https://github.com/qmuntal"><code>@qmuntal</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/57">Azure/go-ntlmssp#57</a></li> <li>Fix a race occurring when the wrapped Rountripper closes the request body in another goroutine by <a href="https://github.com/qmuntal"><code>@qmuntal</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/58">Azure/go-ntlmssp#58</a></li> <li>Fix a race occurring when the wrapped Rountripper reads request fields in another goroutine by <a href="https://github.com/qmuntal"><code>@qmuntal</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/59">Azure/go-ntlmssp#59</a></li> <li>Only perform basic auth if requested by the server by <a href="https://github.com/qmuntal"><code>@qmuntal</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/60">Azure/go-ntlmssp#60</a></li> <li>Don't pass the original body in the client handshake request by <a href="https://github.com/qmuntal"><code>@qmuntal</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/61">Azure/go-ntlmssp#61</a></li> <li>Return latest server response in case there is an error processing the handshake by <a href="https://github.com/qmuntal"><code>@qmuntal</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/63">Azure/go-ntlmssp#63</a></li> <li>Send body on client NTLM handshake by <a href="https://github.com/qmuntal"><code>@qmuntal</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/64">Azure/go-ntlmssp#64</a></li> <li>Support user accounts not living in server's domain by <a href="https://github.com/qmuntal"><code>@qmuntal</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/65">Azure/go-ntlmssp#65</a></li> <li>Implement NewAuthenticateMessage and deprecate ProcessChallenge by <a href="https://github.com/qmuntal"><code>@qmuntal</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/67">Azure/go-ntlmssp#67</a></li> <li>Make basic authentication support opt-in by <a href="https://github.com/qmuntal"><code>@qmuntal</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/66">Azure/go-ntlmssp#66</a></li> <li>Allow passing custom client domain and workstation name by <a href="https://github.com/qmuntal"><code>@qmuntal</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/68">Azure/go-ntlmssp#68</a></li> <li>set NEGOTIATE_NTLM and NEGOTIATE_ALWAYS_SIGN capabilities by <a href="https://github.com/qmuntal"><code>@qmuntal</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/69">Azure/go-ntlmssp#69</a></li> <li>testing: add e2e tests by <a href="https://github.com/gdams"><code>@gdams</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/56">Azure/go-ntlmssp#56</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/qmuntal"><code>@qmuntal</code></a> made their first contribution in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/53">Azure/go-ntlmssp#53</a></li> <li><a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/54">Azure/go-ntlmssp#54</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Azure/go-ntlmssp/compare/v0.0.1...v0.1.0">https://github.com/Azure/go-ntlmssp/compare/v0.0.1...v0.1.0</a></p> <h2>v0.0.1</h2> <h2>What's Changed</h2> <ul> <li>Commit to Go 1.6 by <a href="https://github.com/boumenot"><code>@boumenot</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/5">Azure/go-ntlmssp#5</a></li> <li>Handle http redirect by <a href="https://github.com/nqv"><code>@nqv</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/4">Azure/go-ntlmssp#4</a></li> <li>drain request body for connection reuse by <a href="https://github.com/paulmey"><code>@paulmey</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/6">Azure/go-ntlmssp#6</a></li> <li>Add CoC notice by <a href="https://github.com/paulmey"><code>@paulmey</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/7">Azure/go-ntlmssp#7</a></li> <li>Support for auth when server responds with Www-Authenticate: NTLM by <a href="https://github.com/lafriks"><code>@lafriks</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/8">Azure/go-ntlmssp#8</a></li> <li>update README with example by <a href="https://github.com/PaluMacil"><code>@PaluMacil</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/11">Azure/go-ntlmssp#11</a></li> <li>add version, domain and workstation fields by <a href="https://github.com/justdan96"><code>@justdan96</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/13">Azure/go-ntlmssp#13</a></li> <li>move to a current version of Go by <a href="https://github.com/boumenot"><code>@boumenot</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/19">Azure/go-ntlmssp#19</a></li> <li>(BUG) Negotiation fails for servers where 'NTLMv2 session security' i… by <a href="https://github.com/davejohnston"><code>@davejohnston</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/18">Azure/go-ntlmssp#18</a></li> <li>Update negotiator.go by <a href="https://github.com/mszuyev"><code>@mszuyev</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/24">Azure/go-ntlmssp#24</a></li> <li>Fix golint import path by <a href="https://github.com/paulmey"><code>@paulmey</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/25">Azure/go-ntlmssp#25</a></li> <li>add ProcessChallengeWithHash function by <a href="https://github.com/ropnop"><code>@ropnop</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/27">Azure/go-ntlmssp#27</a></li> <li>Set workstation to empty string in authenticate_message.go by <a href="https://github.com/Catbuttes"><code>@Catbuttes</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/30">Azure/go-ntlmssp#30</a></li> <li>Change of the negociator working, to handle several identical header by <a href="https://github.com/Resousse"><code>@Resousse</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/31">Azure/go-ntlmssp#31</a></li> <li>Support for UPN by <a href="https://github.com/tirupatibg"><code>@tirupatibg</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/32">Azure/go-ntlmssp#32</a></li> <li>Adding Microsoft SECURITY.MD by <a href="https://github.com/microsoft-github-policy-service"><code>@microsoft-github-policy-service</code></a>[bot] in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/39">Azure/go-ntlmssp#39</a></li> <li>Handle 3rd return value from GetDomain by <a href="https://github.com/opoplawski"><code>@opoplawski</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/41">Azure/go-ntlmssp#41</a></li> <li>initial refactor by <a href="https://github.com/gdams"><code>@gdams</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/48">Azure/go-ntlmssp#48</a></li> <li>fix linter errors by <a href="https://github.com/gdams"><code>@gdams</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/49">Azure/go-ntlmssp#49</a></li> <li>add dependabot/codeowners + installation instructions by <a href="https://github.com/gdams"><code>@gdams</code></a> in <a href="https://redirect.github.com/Azure/go-ntlmssp/pull/50">Azure/go-ntlmssp#50</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/Azure/go-ntlmssp/commits/v0.1.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/Azure/go-ntlmssp&package-manager=go_modules&previous-version=0.0.0-20221128193559-754e69321358&new-version=0.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>	2026-04-24 13:33:45 -03:00
dependabot[bot]	faa2bb1bdc	Bump github.com/go-git/go-git/v5 from 5.17.1 to 5.18.0 (#43740 ) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.17.1 to 5.18.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.18.0</h2> <h2>What's Changed</h2> <ul> <li>plumbing: transport/http, Add support for followRedirects policy by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2004">go-git/go-git#2004</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.17.2...v5.18.0">https://github.com/go-git/go-git/compare/v5.17.2...v5.18.0</a></p> <h2>v5.17.2</h2> <h2>What's Changed</h2> <ul> <li>build: Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/1941">go-git/go-git#1941</a></li> <li>dotgit: skip writing pack files that already exist on disk by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1944">go-git/go-git#1944</a></li> </ul> <p>⚠️ This release fixes a bug (<a href="https://redirect.github.com/go-git/go-git/issues/1942">go-git/go-git#1942</a>) that blocked some users from upgrading to <code>v5.17.1</code>. Thanks <a href="https://github.com/pskrbasu"><code>@pskrbasu</code></a> for reporting it. 🙇</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.17.1...v5.17.2">https://github.com/go-git/go-git/compare/v5.17.1...v5.17.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/ea3e7ec9dfc54f577a01afb4dd601c0284604264"><code>ea3e7ec</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2004">#2004</a> from go-git/v5-http-hardening</li> <li><a href="https://github.com/go-git/go-git/commit/bcd20a9c525826081262a06a9ed9c3167abfcd53"><code>bcd20a9</code></a> plumbing: transport/http, Add support for followRedirects policy</li> <li><a href="https://github.com/go-git/go-git/commit/45ae193b3a60aa8ec8a3e373f7265a7819473d5f"><code>45ae193</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1944">#1944</a> from go-git/fix-perms</li> <li><a href="https://github.com/go-git/go-git/commit/fda4f7464b597ff33d2dea1c026482a5e900037c"><code>fda4f74</code></a> storage: filesystem/dotgit, Skip writing pack files that already exist on disk</li> <li><a href="https://github.com/go-git/go-git/commit/2212dc7caeb2a389fe2129923811ef63f75a557a"><code>2212dc7</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1941">#1941</a> from go-git/renovate/releases/v5.x-go-github.com-go-...</li> <li><a href="https://github.com/go-git/go-git/commit/ebb2d7da7f5d5aebeaa0b5e13276d72d602c1ae3"><code>ebb2d7d</code></a> build: Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY]</li> <li>See full diff in <a href="https://github.com/go-git/go-git/compare/v5.17.1...v5.18.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.17.1&new-version=5.18.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-20 14:41:33 -03:00
dependabot[bot]	3c1b8fc7a3	Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 (#43298 ) Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.40.0 to 1.43.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/sdk's changelog</a>.</em></p> <blockquote> <h2>[1.43.0/0.65.0/0.19.0] 2026-04-02</h2> <h3>Added</h3> <ul> <li>Add <code>IsRandom</code> and <code>WithRandom</code> on <code>TraceFlags</code>, and <code>IsRandom</code> on <code>SpanContext</code> in <code>go.opentelemetry.io/otel/trace</code> for <a href="https://www.w3.org/TR/trace-context-2/#random-trace-id-flag">W3C Trace Context Level 2 Random Trace ID Flag</a> support. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8012">#8012</a>)</li> <li>Add service detection with <code>WithService</code> in <code>go.opentelemetry.io/otel/sdk/resource</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7642">#7642</a>)</li> <li>Add <code>DefaultWithContext</code> and <code>EnvironmentWithContext</code> in <code>go.opentelemetry.io/otel/sdk/resource</code> to support plumbing <code>context.Context</code> through default and environment detectors. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8051">#8051</a>)</li> <li>Support attributes with empty value (<code>attribute.EMPTY</code>) in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li> <li>Support attributes with empty value (<code>attribute.EMPTY</code>) in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li> <li>Support attributes with empty value (<code>attribute.EMPTY</code>) in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li> <li>Support attributes with empty value (<code>attribute.EMPTY</code>) in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li> <li>Support attributes with empty value (<code>attribute.EMPTY</code>) in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li> <li>Support attributes with empty value (<code>attribute.EMPTY</code>) in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li> <li>Support attributes with empty value (<code>attribute.EMPTY</code>) in <code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li> <li>Add support for per-series start time tracking for cumulative metrics in <code>go.opentelemetry.io/otel/sdk/metric</code>. Set <code>OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true</code> to enable. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8060">#8060</a>)</li> <li>Add <code>WithCardinalityLimitSelector</code> for metric reader for configuring cardinality limits specific to the instrument kind. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7855">#7855</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Introduce the <code>EMPTY</code> Type in <code>go.opentelemetry.io/otel/attribute</code> to reflect that an empty value is now a valid value, with <code>INVALID</code> remaining as a deprecated alias of <code>EMPTY</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li> <li>Improve slice handling in <code>go.opentelemetry.io/otel/attribute</code> to optimize short slice values with fixed-size fast paths. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8039">#8039</a>)</li> <li>Improve performance of span metric recording in <code>go.opentelemetry.io/otel/sdk/trace</code> by returning early if self-observability is not enabled. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8067">#8067</a>)</li> <li>Improve formatting of metric data diffs in <code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8073">#8073</a>)</li> </ul> <h3>Deprecated</h3> <ul> <li>Deprecate <code>INVALID</code> in <code>go.opentelemetry.io/otel/attribute</code>. Use <code>EMPTY</code> instead. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Return spec-compliant <code>TraceIdRatioBased</code> description. This is a breaking behavioral change, but it is necessary to make the implementation <a href="https://opentelemetry.io/docs/specs/otel/trace/sdk/#traceidratiobased">spec-compliant</a>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8027">#8027</a>)</li> <li>Fix a race condition in <code>go.opentelemetry.io/otel/sdk/metric</code> where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8056">#8056</a>)</li> <li>Limit HTTP response body to 4 MiB in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code> to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li> <li>Limit HTTP response body to 4 MiB in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code> to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li> <li>Limit HTTP response body to 4 MiB in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code> to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li> <li><code>WithHostID</code> detector in <code>go.opentelemetry.io/otel/sdk/resource</code> to use full path for <code>kenv</code> command on BSD. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113">#8113</a>)</li> <li>Fix missing <code>request.GetBody</code> in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code> to correctly handle HTTP2 GOAWAY frame. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096">#8096</a>)</li> </ul> <h2>[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06</h2> <h3>Added</h3> <ul> <li>Add <code>go.opentelemetry.io/otel/semconv/v1.40.0</code> package. The package contains semantic conventions from the <code>v1.40.0</code> version of the OpenTelemetry Semantic Conventions. See the <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.40.0/MIGRATION.md">migration documentation</a> for information on how to upgrade from <code>go.opentelemetry.io/otel/semconv/v1.39.0</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7985">#7985</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9276201a64b623606e3eaa0d61ae8ee6d62756c0"><code>9276201</code></a> Release v1.43.0 / v0.65.0 / v0.19.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8128">#8128</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/61b8c9466c4e6b17e69b622279fe9b63fb15c89a"><code>61b8c94</code></a> chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8131">#8131</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/97a086e82ffe01502f4c620e9c447efa229e2a23"><code>97a086e</code></a> chore(deps): update github.com/golangci/dupl digest to c99c5cf (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8122">#8122</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/5e363de517dba6db62736b2f5cdef0e0929b4cd0"><code>5e363de</code></a> limit response body size for OTLP HTTP exporters (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/35214b60138eac8dec97a2d2b851d8c8471680c7"><code>35214b6</code></a> Use an absolute path when calling bsd kenv (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113">#8113</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/290024ceaf695f9cdbf29a0c6731a317d92bc361"><code>290024c</code></a> fix(deps): update module google.golang.org/grpc to v1.80.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8121">#8121</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/e70658e098033d6bb5ec1b399de16bbb2642f6dc"><code>e70658e</code></a> fix: support getBody in otelploghttp (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096">#8096</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/4afe468e3b4859c949a1c1e8d92684d43d86ef8a"><code>4afe468</code></a> fix(deps): update googleapis to 9d38bb4 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8117">#8117</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/b9ca729776309e3c08fe700c131797a3b4d10634"><code>b9ca729</code></a> chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8115">#8115</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/69472ec56cb7674d55ca2e2bcb04dea73228ab79"><code>69472ec</code></a> chore(deps): update fossas/fossa-action action to v1.9.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8118">#8118</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.40.0...v1.43.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/otel/sdk&package-manager=go_modules&previous-version=1.40.0&new-version=1.43.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-13 15:24:04 -03:00
dependabot[bot]	f8d2660c6c	Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.81.0 to 1.97.3 (#43204 ) Bumps [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) from 1.81.0 to 1.97.3. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/90650dd22735ab68f6089ae5c39b6614286ae9ec"><code>90650dd</code></a> Release 2026-03-26</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/dd88818bee7d632a8b9da6e2c78ef92e23c94c62"><code>dd88818</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/b662c50138bd393927871b46e84ee3483377f5be"><code>b662c50</code></a> Update endpoints model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/500a9cb3522a0e71d798d7079ff5856b23c2cac1"><code>500a9cb</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/6221102f763bd65d7e403fa62c3a1e3d39e24dc6"><code>6221102</code></a> fix stale skew and delayed skew healing (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3359">#3359</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/0a39373433a121800bc68efa743a7486eb07aa3f"><code>0a39373</code></a> fix order of generated event header handlers (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3361">#3361</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/098f3898271e2eaaf8a92e38d1d928fb018805a6"><code>098f389</code></a> Only generate resolveAccountID when it's required (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3360">#3360</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/6ebab66428e97db0ee252fea042d56b1313cb9f6"><code>6ebab66</code></a> Release 2026-03-25</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/b2ec3beebb986a5e74e50d0c105119d84e1e934e"><code>b2ec3be</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/abc126f6b35bfe2f77e2505f6d04f8ceced971ee"><code>abc126f</code></a> Update API model</li> <li>Additional commits viewable in <a href="https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.81.0...service/s3/v1.97.3">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-08 14:55:33 -03:00
dependabot[bot]	8201ae63f1	Bump github.com/aws/aws-sdk-go-v2/service/kinesis from 1.35.3 to 1.43.5 (#43200 ) Bumps [github.com/aws/aws-sdk-go-v2/service/kinesis](https://github.com/aws/aws-sdk-go-v2) from 1.35.3 to 1.43.5. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/f9f7a6bb124a1a7daffc65db40053d97678bd371"><code>f9f7a6b</code></a> Release 2025-07-19</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/c74fb637eb68925187407dfe105ba10d855cecd2"><code>c74fb63</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/d09b46671d6af69a0e1e808c953e5db4a0e5790c"><code>d09b466</code></a> generate aws-eusc (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3144">#3144</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/45575dd69588782d4a0944c7b3911018613d67c7"><code>45575dd</code></a> Release 2025-07-18</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/40f9e8b889dbda9e80b651bd55ea13a99d75d6cc"><code>40f9e8b</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/da30009f1debd56e812c58845b0a3ee4e6e1fb58"><code>da30009</code></a> Update endpoints model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/78fe67fa8c7f08f490e1e04bbe3ce609bfc66fe6"><code>78fe67f</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/654c62d6b16cfa75aba17f6f2feb7d91d627186a"><code>654c62d</code></a> Release 2025-07-17</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/47a74cd2a3a4464fbb1273db6ede81d2bb72bb1d"><code>47a74cd</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/bdd96b2ea29e4a7c96d0dbe1dc1a039bf85d090c"><code>bdd96b2</code></a> Update endpoints model</li> <li>Additional commits viewable in <a href="https://github.com/aws/aws-sdk-go-v2/compare/service/pi/v1.35.3...service/ivs/v1.43.5">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-08 14:47:51 -03:00
dependabot[bot]	98075b2734	Bump github.com/aws/aws-sdk-go-v2/service/lambda from 1.72.0 to 1.88.5 (#43199 ) Bumps [github.com/aws/aws-sdk-go-v2/service/lambda](https://github.com/aws/aws-sdk-go-v2) from 1.72.0 to 1.88.5. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/b9b0c6553b80f99603b4f8356b88f5baf1328deb"><code>b9b0c65</code></a> Release 2025-10-16</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/e2bc8a0ec6f430876fc7de4432ea9cc89c9568f8"><code>e2bc8a0</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/8691ee380a96c49351e4b5ab8a70bc5d4d100724"><code>8691ee3</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/51e8a3fe032fc566d31b389f492ab58475a98398"><code>51e8a3f</code></a> bump to go1.23 (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3211">#3211</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/ad2d36cba7c5772b4e8e4caf96939dc41b95c65c"><code>ad2d36c</code></a> Release 2025-10-15</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/19a35d639f969ee328553e632e8cf8b83d324106"><code>19a35d6</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/35cb02fd50fb125601b9c3b33feb72f3a2bcaa56"><code>35cb02f</code></a> Update endpoints model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/f673a1b0a80e666c0128ec606ff053dace9771f1"><code>f673a1b</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/48421fd812d8592a4eb2b32d11ae07e228969012"><code>48421fd</code></a> Release 2025-10-14</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/fedcba778c21b451a91b4e4bcdd5d6c1554c6a5a"><code>fedcba7</code></a> Regenerated Clients</li> <li>Additional commits viewable in <a href="https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.72.0...service/s3/v1.88.5">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/aws/aws-sdk-go-v2/service/lambda&package-manager=go_modules&previous-version=1.72.0&new-version=1.88.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-08 14:37:20 -03:00
dependabot[bot]	abaad3d4ca	Bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5 (#42952 ) Bumps [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) from 3.0.4 to 3.0.5. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-jose/go-jose/commit/be2f6548701d4ba561cd61c7d4a2f1289b66c273"><code>be2f654</code></a> ci: update Go versions for GHA workflows (<a href="https://redirect.github.com/go-jose/go-jose/issues/221">#221</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/02464163e1e891db85257cb8860978a1c0226016"><code>0246416</code></a> Merge commit from fork</li> <li>See full diff in <a href="https://github.com/go-jose/go-jose/compare/v3.0.4...v3.0.5">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-jose/go-jose/v3&package-manager=go_modules&previous-version=3.0.4&new-version=3.0.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-03 09:56:25 -03:00
Magnus Jensen Jordan Montgomery Martin Angers Claude Opus 4.6 Gabriel Hernandez Sarah Gillespie	d4f48b6f9c	ACME MDM -> main (#42926 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: The entire ACME feature branch merge # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually --------- Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com> Co-authored-by: Martin Angers <martin.n.angers@gmail.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Gabriel Hernandez <ghernandez345@gmail.com> Co-authored-by: Sarah Gillespie <73313222+gillespi314@users.noreply.github.com>	2026-04-02 15:56:31 -05:00
dependabot[bot]	1aef37c75c	Bump github.com/go-git/go-git/v5 from 5.16.5 to 5.17.1 (#42670 ) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.16.5 to 5.17.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.17.1</h2> <h2>What's Changed</h2> <ul> <li>build: Update module github.com/cloudflare/circl to v1.6.3 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/1930">go-git/go-git#1930</a></li> <li>[v5] plumbing: format/index, Improve v4 entry name validation by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1935">go-git/go-git#1935</a></li> <li>[v5] plumbing: format/idxfile, Fix version and fanout checks by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1937">go-git/go-git#1937</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1">https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1</a></p> <h2>v5.17.0</h2> <h2>What's Changed</h2> <ul> <li>build: Update module github.com/go-git/go-git/v5 to v5.16.5 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/1839">go-git/go-git#1839</a></li> <li>git: worktree, optimize infiles function for very large repos by <a href="https://github.com/k-anshul"><code>@k-anshul</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1853">go-git/go-git#1853</a></li> <li>git: Add strict checks for supported extensions by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1861">go-git/go-git#1861</a></li> <li>backport, git: Improve Status() speed with new index.ModTime check by <a href="https://github.com/cedric-appdirect"><code>@cedric-appdirect</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1862">go-git/go-git#1862</a></li> <li>storage: filesystem, Avoid overwriting loose obj files by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1864">go-git/go-git#1864</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.16.5...v5.17.0">https://github.com/go-git/go-git/compare/v5.16.5...v5.17.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/5e23dfd02db92644dc4a3358ceb297fce875b772"><code>5e23dfd</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1937">#1937</a> from pjbgf/idx-v5</li> <li><a href="https://github.com/go-git/go-git/commit/6b38a326816b80f64c20cc0e6113958b65c05a1c"><code>6b38a32</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1935">#1935</a> from pjbgf/index-v5</li> <li><a href="https://github.com/go-git/go-git/commit/cd757fcb856a2dcc5fff6c110320a8ff62e99513"><code>cd757fc</code></a> plumbing: format/idxfile, Fix version and fanout checks</li> <li><a href="https://github.com/go-git/go-git/commit/3ec0d70cb687ae1da5f4d18faa4229bd971a8710"><code>3ec0d70</code></a> plumbing: format/index, Fix tree extension invalidated entry parsing</li> <li><a href="https://github.com/go-git/go-git/commit/dbe10b6b425a2a4ea92a9d98e20cd68e15aede01"><code>dbe10b6</code></a> plumbing: format/index, Align V2/V3 long name and V4 prefix encoding with Git</li> <li><a href="https://github.com/go-git/go-git/commit/e9b65df44cb97faeba148b47523a362beaecddf9"><code>e9b65df</code></a> plumbing: format/index, Improve v4 entry name validation</li> <li><a href="https://github.com/go-git/go-git/commit/adad18daabddee04c5a889f0230035e74bca32c0"><code>adad18d</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1930">#1930</a> from go-git/renovate/releases/v5.x-go-github.com-clo...</li> <li><a href="https://github.com/go-git/go-git/commit/29470bd1d862c6e902996b8e8ff8eb7a0515a9be"><code>29470bd</code></a> build: Update module github.com/cloudflare/circl to v1.6.3 [SECURITY]</li> <li><a href="https://github.com/go-git/go-git/commit/bdf06885bdaa3631cf6a2017108086c6f53dcf69"><code>bdf0688</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1864">#1864</a> from pjbgf/v5-issue-55</li> <li><a href="https://github.com/go-git/go-git/commit/5290e521c8cf651bf3e8d3e37f517c7cf7aa0b19"><code>5290e52</code></a> storage: filesystem, Avoid overwriting loose obj files. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/55">#55</a></li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.16.5...v5.17.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.16.5&new-version=5.17.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-30 15:12:01 -03:00
dependabot[bot]	32f1c2026c	Bump golang.org/x/image from 0.18.0 to 0.38.0 (#42661 ) Bumps [golang.org/x/image](https://github.com/golang/image) from 0.18.0 to 0.38.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/image/commit/23ae9ed61c1d3343fb95015810f62dcbf444976e"><code>23ae9ed</code></a> tiff: cap buffer growth to prevent OOM from malicious IFD offset</li> <li><a href="https://github.com/golang/image/commit/e589e60f29d0bbbf6400e250e024f93cbc4961ee"><code>e589e60</code></a> webp: allow VP8L + VP8X(with alpha)</li> <li><a href="https://github.com/golang/image/commit/fe7d73de74b8a1ad508c93cfcb245d44579163ff"><code>fe7d73d</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/image/commit/e3d762b1d37ed96e757e3bc0bfb44f7455589df3"><code>e3d762b</code></a> all: upgrade go directive to at least 1.25.0 [generated]</li> <li><a href="https://github.com/golang/image/commit/833c6ed987962feaa3ec2624d8655421b25e2e0e"><code>833c6ed</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/image/commit/bc7fe0b43a01586e7ca7c087a2e8a625e8397dcb"><code>bc7fe0b</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/image/commit/c53c97f4ed88d55fafe963ee6e93cb357663d650"><code>c53c97f</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/image/commit/9032ff7c7b86f42b9bebdf6133191648224aecc0"><code>9032ff7</code></a> all: eliminate vet diagnostics</li> <li><a href="https://github.com/golang/image/commit/9c9d08c65c08567c997eccc8bde52fcc9369bea6"><code>9c9d08c</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/image/commit/742b1b756d98a0c48b1fcf464a0c63fa50e1aa6b"><code>742b1b7</code></a> all: fix some comments</li> <li>Additional commits viewable in <a href="https://github.com/golang/image/compare/v0.18.0...v0.38.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/image&package-manager=go_modules&previous-version=0.18.0&new-version=0.38.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-30 13:33:10 -03:00
dependabot[bot]	82c3983939	Bump github.com/antchfx/xpath from 1.2.2 to 1.3.6 (#42633 ) Bumps [github.com/antchfx/xpath](https://github.com/antchfx/xpath) from 1.2.2 to 1.3.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/antchfx/xpath/releases">github.com/antchfx/xpath's releases</a>.</em></p> <blockquote> <h2>v1.3.6</h2> <p>Merged PR:</p> <ul> <li><a href="https://redirect.github.com/antchfx/xpath/issues/120">#120</a>(<a href="https://github.com/mislav"><code>@mislav</code></a>) - Fix <code>last()</code> predicate on grouped expr.</li> </ul> <p>Fixed:</p> <ul> <li><a href="https://redirect.github.com/antchfx/xpath/issues/121">#121</a></li> </ul> <h2>Release v1.3.5</h2> <p>Merged PR:</p> <ul> <li><a href="https://redirect.github.com/antchfx/xpath/issues/117">#117</a>(<a href="https://github.com/mislav"><code>@mislav</code></a>）- fix <code>ancestor::</code> axes with position predicate.</li> </ul> <p>Fixed:</p> <ul> <li><a href="https://redirect.github.com/antchfx/xpath/issues/113">#113</a> - (fix <code>string()</code> function)</li> </ul> <h2>v1.3.4</h2> <p>Merged PR:</p> <ul> <li><a href="https://redirect.github.com/antchfx/xpath/issues/107">#107</a>(<a href="https://github.com/Mrflatt"><code>@Mrflatt</code></a>) - supports Regexp feature in <code>replace()</code> function</li> <li><a href="https://redirect.github.com/antchfx/xpath/issues/111">#111</a>(<a href="https://github.com/wjc4"><code>@wjc4</code></a>) - Improve <code>getHashCode</code> performance</li> </ul> <p>Fixed:</p> <ul> <li><a href="https://redirect.github.com/antchfx/xpath/issues/109">#109</a></li> </ul> <h2>v1.3.3</h2> <p>fix non-English predicate query <a href="https://redirect.github.com/antchfx/xpath/issues/106">#106</a></p> <h2>v1.3.2</h2> <p>New Features:</p> <ul> <li>Supports Unicode chars for Non-English (PR <a href="https://redirect.github.com/antchfx/xpath/issues/100">#100</a>)</li> </ul> <p>Bug Fixed:</p> <ul> <li><a href="https://redirect.github.com/antchfx/xpath/issues/101">#101</a></li> <li><a href="https://redirect.github.com/antchfx/xpath/issues/102">#102</a></li> <li><a href="https://redirect.github.com/antchfx/xpath/issues/104">#104</a></li> </ul> <h2>v1.3.1</h2> <ul> <li>Merged PR <a href="https://redirect.github.com/antchfx/xpath/issues/97">#97</a>.</li> <li>Allows node-set numeric operator <code>+</code>, <code>-</code>, <code>mod()</code>.<a href="https://github.com/antchfx/xpath/commit/4b4638b370e898a9d10709464b8cd460b7dcfd0c">https://github.com/antchfx/xpath/commit/4b4638b370e898a9d10709464b8cd460b7dcfd0c</a></li> <li><a href="https://redirect.github.com/antchfx/xpath/issues/98">#98</a>, Remove the duplicate element filter <a href="https://github.com/antchfx/xpath/commit/5481aef473ee298d297387f5b69e2768df09e0c4">https://github.com/antchfx/xpath/commit/5481aef473ee298d297387f5b69e2768df09e0c4</a></li> </ul> <h2>v1.3.0</h2> <ul> <li>fixes <a href="https://redirect.github.com/antchfx/xpath/issues/93">#93</a></li> </ul> <h3>New features:</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/antchfx/xpath/commit/afd4762cc342af56345a3fb4002a59281fcab494"><code>afd4762</code></a> fix <a href="https://redirect.github.com/antchfx/xpath/issues/121">#121</a></li> <li><a href="https://github.com/antchfx/xpath/commit/a8ced8f559cd68fc4aedfc87f21599d1190c0852"><code>a8ced8f</code></a> Merge PR <a href="https://redirect.github.com/antchfx/xpath/issues/120">#120</a></li> <li><a href="https://github.com/antchfx/xpath/commit/c92c3ebebbdd67f715161810f97ecfbcaa47921e"><code>c92c3eb</code></a> Fix last() predicate on grouped expressions</li> <li><a href="https://github.com/antchfx/xpath/commit/3cbab9750ea36cbae6f967ebbf29b9eda0e841bf"><code>3cbab97</code></a> Merge PR <a href="https://redirect.github.com/antchfx/xpath/issues/119">#119</a></li> <li><a href="https://github.com/antchfx/xpath/commit/02c01b0b4051e7edd1bf40f3d595cc9143936aaa"><code>02c01b0</code></a> Fix chained predicates on ancestor axis</li> <li><a href="https://github.com/antchfx/xpath/commit/511abd57bc74e9644fe27f4e52b559065e686e92"><code>511abd5</code></a> Merge PR <a href="https://redirect.github.com/antchfx/xpath/issues/117">#117</a></li> <li><a href="https://github.com/antchfx/xpath/commit/060b15493444a0e6c5a232022516e434818f7391"><code>060b154</code></a> Fix positional predicate for the "ancestor" axis</li> <li><a href="https://github.com/antchfx/xpath/commit/8d50c252d867285812177ffd3ff0924104ffb1eb"><code>8d50c25</code></a> fix <a href="https://redirect.github.com/antchfx/xpath/issues/112">#112</a>，<a href="https://redirect.github.com/antchfx/xpath/issues/113">#113</a></li> <li><a href="https://github.com/antchfx/xpath/commit/b9e198da9fb170a229c9c7e27d52e1a350636f4c"><code>b9e198d</code></a> Merge PR <a href="https://redirect.github.com/antchfx/xpath/issues/111">#111</a></li> <li><a href="https://github.com/antchfx/xpath/commit/fcb882bece30fe7d4d8f5069fed13f95a726e62f"><code>fcb882b</code></a> improve getHashCode by removing fmt.Sprintf</li> <li>Additional commits viewable in <a href="https://github.com/antchfx/xpath/compare/v1.2.2...v1.3.6">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/antchfx/xpath&package-manager=go_modules&previous-version=1.2.2&new-version=1.3.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-30 10:44:31 -03:00
Lucas Manuel Rodriguez	d8588ed790	Bump macadmins version and add `macos_thermal_pressure` and `macos_soc_power` tables (#42569 ) Related issue: Resolves #42530 - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## fleetd/orbit/Fleet Desktop - [X] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [X] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [X] Verified that fleetd runs on macOS, Linux and Windows - [X] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))	2026-03-30 10:04:12 -03:00
dependabot[bot]	915feb9868	Bump github.com/russellhaering/goxmldsig from 1.4.0 to 1.6.0 (#42009 ) Bumps [github.com/russellhaering/goxmldsig](https://github.com/russellhaering/goxmldsig) from 1.4.0 to 1.6.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/russellhaering/goxmldsig/releases">github.com/russellhaering/goxmldsig's releases</a>.</em></p> <blockquote> <h2>v1.6.0</h2> <h2>What's Changed</h2> <ul> <li><strong>Security:</strong> Fix possible signature validation bypass caused by loop variable capture in <code>validateSignature</code> (GHSA-479m-364c-43vc)</li> <li>Bump minimum Go version to 1.23</li> <li>Bump <code>github.com/beevik/etree</code> to v1.6.0</li> <li>Add fuzz tests for XML signature validation and canonicalization</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/russellhaering/goxmldsig/compare/v1.5.0...v1.6.0">https://github.com/russellhaering/goxmldsig/compare/v1.5.0...v1.6.0</a></p> <h2>v1.5.0</h2> <h2>What's Changed</h2> <ul> <li>Bump dependencies</li> <li>Update GitHub workflows</li> <li>Security hardening by <a href="https://github.com/ahacker1-securesaml"><code>@ahacker1-securesaml</code></a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/russellhaering/goxmldsig/compare/v1.4.0...v1.5.0">https://github.com/russellhaering/goxmldsig/compare/v1.4.0...v1.5.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/russellhaering/goxmldsig/commit/878c8c615feb628064040115d00e105a137fcfa7"><code>878c8c6</code></a> Apply go fix ./...</li> <li><a href="https://github.com/russellhaering/goxmldsig/commit/db3d1e31f7535d7f5debb49851b9e9a2ff08b936"><code>db3d1e3</code></a> Fix loop variable capture bug in validateSignature</li> <li><a href="https://github.com/russellhaering/goxmldsig/commit/4f576b89acf01f68983ca5cb9dcebd0b460234bc"><code>4f576b8</code></a> Bump dependencies</li> <li><a href="https://github.com/russellhaering/goxmldsig/commit/79c29ee3ed2da54553a4132b372ced83185fcf12"><code>79c29ee</code></a> Rename FuzzValidate to FuzzValidateXML to avoid name collision</li> <li><a href="https://github.com/russellhaering/goxmldsig/commit/ac7bf745b9fd3d92460ad9be3459a97b0e3bf89f"><code>ac7bf74</code></a> Add fuzz tests for XML signature validation and canonicalization</li> <li><a href="https://github.com/russellhaering/goxmldsig/commit/a5805dfad93fc67a2106a1dc6d881df83769e3eb"><code>a5805df</code></a> Bump github/codeql-action from 2.13.4 to 3.28.17 (<a href="https://redirect.github.com/russellhaering/goxmldsig/issues/155">#155</a>)</li> <li><a href="https://github.com/russellhaering/goxmldsig/commit/7dac9ec3b2a1a336d73ff091fba4131d186dfec6"><code>7dac9ec</code></a> Update GitHub Workflow</li> <li><a href="https://github.com/russellhaering/goxmldsig/commit/1bf54ca740682fac1149814344c24c722fde8238"><code>1bf54ca</code></a> Bump dependencies</li> <li><a href="https://github.com/russellhaering/goxmldsig/commit/e1c8a5b89d1d03089aa1a0ec546b33aaf80ee02f"><code>e1c8a5b</code></a> Refactor to help eliminate potential vulnerabilities:</li> <li><a href="https://github.com/russellhaering/goxmldsig/commit/2ac5490a2441a3484e030c5cfeb02ce62886c01a"><code>2ac5490</code></a> Refactor .verifyCertificate to obtain the certificate from an identifier from...</li> <li>Additional commits viewable in <a href="https://github.com/russellhaering/goxmldsig/compare/v1.4.0...v1.6.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/russellhaering/goxmldsig&package-manager=go_modules&previous-version=1.4.0&new-version=1.6.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-27 13:38:04 -03:00
dependabot[bot]	7d1865399e	Bump github.com/nats-io/nats-server/v2 from 2.12.3 to 2.12.6 (#42338 ) Bumps [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) from 2.12.3 to 2.12.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nats-io/nats-server/releases">github.com/nats-io/nats-server/v2's releases</a>.</em></p> <blockquote> <h2>Release v2.12.6</h2> <h2>Changelog</h2> <p>Refer to the <a href="https://docs.nats.io/release-notes/whats_new/whats_new_212">2.12 Upgrade Guide</a> for backwards compatibility notes with 2.11.x.</p> <h3>Go Version</h3> <ul> <li>1.25.8</li> </ul> <h3>Dependencies</h3> <ul> <li>golang.org/x/crypto v0.49.0 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7953">#7953</a>)</li> <li>github.com/nats-io/jwt/v2 v2.8.1 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7960">#7960</a>)</li> <li>golang.org/x/sys v0.42.0 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7923">#7923</a>)</li> <li>golang.org/x/time v0.15.0 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7923">#7923</a>)</li> </ul> <h3>CVEs</h3> <ul> <li>Fixes CVE-2026-33216, CVE-2026-33217, CVE-2026-33215 (affecting systems using MQTT)</li> <li>Fixes CVE-2026-33246 (affects systems using leafnodes and service imports)</li> <li>Fixes CVE-2026-33218 (affects systems using leafnodes)</li> <li>Fixes CVE-2026-33219 (affects systems using WebSockets)</li> <li>Fixes CVE-2026-33223, CVE-2026-33222 (affects systems using JetStream)</li> <li>Fixes CVE-2026-33248 (affects systems using mutual TLS)</li> <li>Fixes CVE-2026-33247 (affects systems providing credentials on the command line)</li> <li>Fixes CVE-2026-33249 (affects systems where client publish permissions should be restricted)</li> </ul> <h3>Improved</h3> <p>General</p> <ul> <li>Non-WebSocket leafnode connections can now be proxied using HTTP CONNECT (<a href="https://redirect.github.com/nats-io/nats-server/issues/7781">#7781</a>)</li> <li>The <code>$SYS.REQ.USER.INFO</code> response now includes the friendly nametag of the account and/or user if known (<a href="https://redirect.github.com/nats-io/nats-server/issues/7973">#7973</a>)</li> </ul> <p>JetStream</p> <ul> <li>The stream peer-remove command now accepts a peer ID as well as a server name (<a href="https://redirect.github.com/nats-io/nats-server/issues/7952">#7952</a>)</li> </ul> <p>MQTT</p> <ul> <li>Protocol compliance has been improved, including more error handling on invalid or malformed MQTT packets (<a href="https://redirect.github.com/nats-io/nats-server/issues/7933">#7933</a>)</li> </ul> <h3>Fixed</h3> <p>General</p> <ul> <li>Client connections are no longer registered after an auth callout timeout (<a href="https://redirect.github.com/nats-io/nats-server/issues/7932">#7932</a>)</li> <li>Improved handling of duplicate headers</li> <li>A correctness bug when validating relative distinguished names has been fixed</li> <li>Secrets are now redacted correctly in trace logging (<a href="https://redirect.github.com/nats-io/nats-server/issues/7942">#7942</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nats-io/nats-server/commit/0e0639058e0d2d8fce0cc34941f9897da152ab32"><code>0e06390</code></a> Release v2.12.6</li> <li><a href="https://github.com/nats-io/nats-server/commit/f593d279dadfbe8228c532ef21216a2b4b84cf4b"><code>f593d27</code></a> Cherry-picks for 2.12.6 (<a href="https://redirect.github.com/nats-io/nats-server/issues/61">#61</a>)</li> <li><a href="https://github.com/nats-io/nats-server/commit/9f904de022cb441444dc14fc5b0251b140fa1dae"><code>9f904de</code></a> [FIXED] Incomplete route pool on premature pong</li> <li><a href="https://github.com/nats-io/nats-server/commit/b5101921e22a149ea8e23e725d04bf0a85893a48"><code>b510192</code></a> [FIXED] Avoid stalling read loop on leafnode ErrMinimumVersionRequired</li> <li><a href="https://github.com/nats-io/nats-server/commit/53941c24a17589c51aff5235991e77357fec2a0c"><code>53941c2</code></a> Report the account and user name in USER.INFO request</li> <li><a href="https://github.com/nats-io/nats-server/commit/1ab002ab2b6b8057ca2897e60cf7a8b3194d3eed"><code>1ab002a</code></a> [IMPROVED] Support HTTP proxy connection from leaf nodes also for TCP</li> <li><a href="https://github.com/nats-io/nats-server/commit/8b6408239fedc487d20fb73626f77689c70c5766"><code>8b64082</code></a> Release v2.12.6-RC.3</li> <li><a href="https://github.com/nats-io/nats-server/commit/e6ab7e9541583932608965ff3d815e323b152e42"><code>e6ab7e9</code></a> Cherry-picks for 2.12.6-RC.3 (<a href="https://redirect.github.com/nats-io/nats-server/issues/59">#59</a>)</li> <li><a href="https://github.com/nats-io/nats-server/commit/9f4d96076caa4b4af2911b6391c04e35e76ea1b6"><code>9f4d960</code></a> Make the deduplication window actually work for deduplication for sourcing</li> <li><a href="https://github.com/nats-io/nats-server/commit/304e18402b566a211c9721c9f39eebba65153574"><code>304e184</code></a> Remove FIXME about auth callout nonce</li> <li>Additional commits viewable in <a href="https://github.com/nats-io/nats-server/compare/v2.12.3...v2.12.6">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/nats-io/nats-server/v2&package-manager=go_modules&previous-version=2.12.3&new-version=2.12.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-25 09:45:56 -03:00
Scott Gress	91362ba2ca	Add fleetctl new command (#41909 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #41345 # Details This PR: * Adds a new `fleetctl new` command which creates a starter GitOps repo file structure * Adds support for file globs for the `configuration_profiles:` key in GitOps, to support its use in the `fleetctl new` templates. This involved moving the `BaseItem` type and `SupportsFileInclude` interface into the `fleet` package so that the `MDMProfileSpec` type could implement the interface and do glob expansion. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [X] added unit and intg tests for globbing profiles - [ ] added tests for `fleetctl new` - [X] QA'd all new/changed functionality manually - [X] `fleetctl new` with no args prompted for org name and created a new `it-and-security` folder under current folder w/ correct files - [X] `fleetctl new --dir /tmp/testnew` created correct files under `/tmp/testnew` - [X] `fleetctl new --dir /tmp/testexisting --force` with an existing `/tmp/testexisting` folder created correct files under `/tmp/testexisting` - [X] `fleetctl new --org-name=foo` created correct files under `it-and-security` without prompting for org name - [X] `paths:` in `configuration_profiles` picks up multiple matching profiles - [X] `paths:` + `path:` in `configuration_profiles` will error if the same profile is picked up twice <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added `fleetctl new` command to initialize GitOps repository structure via CLI. * Added glob pattern support for `configuration_profiles` field, enabling flexible profile selection. * Chores * Updated CLI dependencies to support enhanced user interactions. * Removed legacy website generator configuration files. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-03-20 17:27:27 -05:00
dependabot[bot]	73c386f207	Bump google.golang.org/grpc from 1.78.0 to 1.79.3 (#42011 ) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.78.0 to 1.79.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.79.3</h2> <h1>Security</h1> <ul> <li>server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like <code>grpc/authz</code>. Any request with a non-canonical path is now immediately rejected with an <code>Unimplemented</code> error. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8981">#8981</a>)</li> </ul> <h2>Release 1.79.2</h2> <h1>Bug Fixes</h1> <ul> <li>stats: Prevent redundant error logging in health/ORCA producers by skipping stats/tracing processing when no stats handler is configured. (<a href="https://redirect.github.com/grpc/grpc-go/pull/8874">grpc/grpc-go#8874</a>)</li> </ul> <h2>Release 1.79.1</h2> <h1>Bug Fixes</h1> <ul> <li>grpc: Remove the <code>-dev</code> suffix from the User-Agent header. (<a href="https://redirect.github.com/grpc/grpc-go/pull/8902">grpc/grpc-go#8902</a>)</li> </ul> <h2>Release 1.79.0</h2> <h1>API Changes</h1> <ul> <li>mem: Add experimental API <code>SetDefaultBufferPool</code> to change the default buffer pool. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8806">#8806</a>) <ul> <li>Special Thanks: <a href="https://github.com/vanja-p"><code>@vanja-p</code></a></li> </ul> </li> <li>experimental/stats: Update <code>MetricsRecorder</code> to require embedding the new <code>UnimplementedMetricsRecorder</code> (a no-op struct) in all implementations for forward compatibility. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8780">#8780</a>)</li> </ul> <h1>Behavior Changes</h1> <ul> <li>balancer/weightedtarget: Remove handling of <code>Addresses</code> and only handle <code>Endpoints</code> in resolver updates. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8841">#8841</a>)</li> </ul> <h1>New Features</h1> <ul> <li>experimental/stats: Add support for asynchronous gauge metrics through the new <code>AsyncMetricReporter</code> and <code>RegisterAsyncReporter</code> APIs. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8780">#8780</a>)</li> <li>pickfirst: Add support for weighted random shuffling of endpoints, as described in <a href="https://redirect.github.com/grpc/proposal/pull/535">gRFC A113</a>. <ul> <li>This is enabled by default, and can be turned off using the environment variable <code>GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING</code>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8864">#8864</a>)</li> </ul> </li> <li>xds: Implement <code>:authority</code> rewriting, as specified in <a href="https://github.com/grpc/proposal/blob/master/A81-xds-authority-rewriting.md">gRFC A81</a>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8779">#8779</a>)</li> <li>balancer/randomsubsetting: Implement the <code>random_subsetting</code> LB policy, as specified in <a href="https://github.com/grpc/proposal/blob/master/A68-random-subsetting.md">gRFC A68</a>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8650">#8650</a>) <ul> <li>Special Thanks: <a href="https://github.com/marek-szews"><code>@marek-szews</code></a></li> </ul> </li> </ul> <h1>Bug Fixes</h1> <ul> <li>credentials/tls: Fix a bug where the port was not stripped from the authority override before validation. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8726">#8726</a>) <ul> <li>Special Thanks: <a href="https://github.com/Atul1710"><code>@Atul1710</code></a></li> </ul> </li> <li>xds/priority: Fix a bug causing delayed failover to lower-priority clusters when a higher-priority cluster is stuck in <code>CONNECTING</code> state. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8813">#8813</a>)</li> <li>health: Fix a bug where health checks failed for clients using legacy compression options (<code>WithDecompressor</code> or <code>RPCDecompressor</code>). (<a href="https://redirect.github.com/grpc/grpc-go/issues/8765">#8765</a>) <ul> <li>Special Thanks: <a href="https://github.com/sanki92"><code>@sanki92</code></a></li> </ul> </li> <li>transport: Fix an issue where the HTTP/2 server could skip header size checks when terminating a stream early. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8769">#8769</a>) <ul> <li>Special Thanks: <a href="https://github.com/joybestourous"><code>@joybestourous</code></a></li> </ul> </li> <li>server: Propagate status detail headers, if available, when terminating a stream during request header processing. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8754">#8754</a>) <ul> <li>Special Thanks: <a href="https://github.com/joybestourous"><code>@joybestourous</code></a></li> </ul> </li> </ul> <h1>Performance Improvements</h1> <ul> <li>credentials/alts: Optimize read buffer alignment to reduce copies. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8791">#8791</a>)</li> <li>mem: Optimize pooling and creation of <code>buffer</code> objects. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8784">#8784</a>)</li> <li>transport: Reduce slice re-allocations by reserving slice capacity. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8797">#8797</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/dda86dbd9cecb8b35b58c73d507d81d67761205f"><code>dda86db</code></a> Change version to 1.79.3 (<a href="https://redirect.github.com/grpc/grpc-go/issues/8983">#8983</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/72186f163e75a065c39e6f7df9b6dea07fbdeff5"><code>72186f1</code></a> grpc: enforce strict path checking for incoming requests on the server (<a href="https://redirect.github.com/grpc/grpc-go/issues/8981">#8981</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/97ca3522b239edf6813e2b1106924e9d55e89d43"><code>97ca352</code></a> Changing version to 1.79.3-dev (<a href="https://redirect.github.com/grpc/grpc-go/issues/8954">#8954</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/8902ab6efea590f5b3861126559eaa26fa9783b2"><code>8902ab6</code></a> Change the version to release 1.79.2 (<a href="https://redirect.github.com/grpc/grpc-go/issues/8947">#8947</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/a9286705aa689bee321ec674323b6896284f3e02"><code>a928670</code></a> Cherry-pick <a href="https://redirect.github.com/grpc/grpc-go/issues/8874">#8874</a> to v1.79.x (<a href="https://redirect.github.com/grpc/grpc-go/issues/8904">#8904</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/06df3638c0bcee88197b1033b3ba83e1eb8bc010"><code>06df363</code></a> Change version to 1.79.2-dev (<a href="https://redirect.github.com/grpc/grpc-go/issues/8903">#8903</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/782f2de44f597af18a120527e7682a6670d84289"><code>782f2de</code></a> Change version to 1.79.1 (<a href="https://redirect.github.com/grpc/grpc-go/issues/8902">#8902</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/850eccbb2257bd2de6ac28ee88a7172ab6175629"><code>850eccb</code></a> Change version to 1.79.1-dev (<a href="https://redirect.github.com/grpc/grpc-go/issues/8851">#8851</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/765ff056b6890f6c8341894df4e9668e9bfc18ef"><code>765ff05</code></a> Change version to 1.79.0 (<a href="https://redirect.github.com/grpc/grpc-go/issues/8850">#8850</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/68804be0e78ed0365bb5a576dedc12e2168ed63e"><code>68804be</code></a> Cherry pick <a href="https://redirect.github.com/grpc/grpc-go/issues/8864">#8864</a> to v1.79.x (<a href="https://redirect.github.com/grpc/grpc-go/issues/8896">#8896</a>)</li> <li>Additional commits viewable in <a href="https://github.com/grpc/grpc-go/compare/v1.78.0...v1.79.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.78.0&new-version=1.79.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-19 09:32:45 -03:00
Lucas Manuel Rodriguez	ba3746f9fa	Fix fleetd crash in Apple M5 hardware by upgrading gopsutil (#41940 ) Resolves #41863 - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] QA'd all new/changed functionality manually Tests performed on the following OSs: - Windows (arm64) - macOS (Apple silicon) - Linux (arm64) - Linux (amd64) Features tested on the OSs above: - "My device". - Restart fleetd. - Kill fleet desktop, should re-start. - Killing stale osqueryd processes on orbit startup. - Checking if osquery is up and running, exit and start. - Checking if Fleet Desktop is already running before launching it. - orbit auto update - Gracefully shutting down Fleet Desktop before restarting it --- ## fleetd/orbit/Fleet Desktop - [X] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))	2026-03-18 11:21:02 -03:00
Scott Gress	2c56b89072	Support globs in script paths in GitOps (#40799 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #40302 # Details This PR adds support for a `paths:` key for scripts declared under `controls:` in a GitOps fleet file. If supplied, `paths:` must contain a "glob" expression (as [supported by the doublestar package](https://github.com/bmatcuk/doublestar?tab=readme-ov-file#patterns)). The existing `path:` key still works but may not contain glob expressions. When a `paths:` key is encountered, we expand it and add all matching valid (as in, `.sh` or `.ps1`) files to the set of script files to process. Subsequent PRs will add this functionality to other entities that use `path:` (such as reports and policies). # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually Tried with various combinations of `` and `*` in gitops runs, and mixing of `path:` and `paths:`	2026-03-02 22:18:36 -06:00
dependabot[bot]	3cda538f37	Bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 (#40531 ) Bumps [github.com/cloudflare/circl](https://github.com/cloudflare/circl) from 1.6.1 to 1.6.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cloudflare/circl/releases">github.com/cloudflare/circl's releases</a>.</em></p> <blockquote> <h2>CIRCL v1.6.3</h2> <p>Fix a bug on ecc/p384 scalar multiplication.</p> <h3>What's Changed</h3> <ul> <li>sign/mldsa: Check opts for nil value by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/582">cloudflare/circl#582</a></li> <li>ecc/p384: Point addition must handle point doubling case. by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/583">cloudflare/circl#583</a></li> <li>Release CIRCL v1.6.3 by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/584">cloudflare/circl#584</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/cloudflare/circl/compare/v1.6.2...v1.6.3">https://github.com/cloudflare/circl/compare/v1.6.2...v1.6.3</a></p> <h2>CIRCL v1.6.2</h2> <ul> <li>New SLH-DSA, improvements in ML-DSA for arm64.</li> <li>Tested compilation on WASM.</li> </ul> <h2>What's Changed</h2> <ul> <li>Optimize pairing product computation by moving exponentiations to G1. by <a href="https://github.com/dfaranha"><code>@dfaranha</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/547">cloudflare/circl#547</a></li> <li>sign: Adding SLH-DSA signature by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/512">cloudflare/circl#512</a></li> <li>Update code generators to CIRCL v1.6.1. by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/548">cloudflare/circl#548</a></li> <li>ML-DSA: Add preliminary Wycheproof test vectors by <a href="https://github.com/bwesterb"><code>@bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/552">cloudflare/circl#552</a></li> <li>go fmt by <a href="https://github.com/bwesterb"><code>@bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/554">cloudflare/circl#554</a></li> <li>gz-compressing test vectors, use of HexBytes and ReadGzip functions. by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/555">cloudflare/circl#555</a></li> <li>group: Removes use of elliptic Marshal and Unmarshal functions. by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/556">cloudflare/circl#556</a></li> <li>Support encoding/decoding ML-DSA private keys (as long as they contain seeds) by <a href="https://github.com/bwesterb"><code>@bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/559">cloudflare/circl#559</a></li> <li>Update to golangci-lint v2 by <a href="https://github.com/bwesterb"><code>@bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/560">cloudflare/circl#560</a></li> <li>Preparation for ARM64 Implementation of poly operations for dilithium package. by <a href="https://github.com/elementrics"><code>@elementrics</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/562">cloudflare/circl#562</a></li> <li>prepare power2Round for custom implementations in assembly by <a href="https://github.com/elementrics"><code>@elementrics</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/564">cloudflare/circl#564</a></li> <li>ARM64 implementation for poly.PackLe16 by <a href="https://github.com/elementrics"><code>@elementrics</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/563">cloudflare/circl#563</a></li> <li>add arm64 version of polyMulBy2toD by <a href="https://github.com/elementrics"><code>@elementrics</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/565">cloudflare/circl#565</a></li> <li>add arm64 version of polySub by <a href="https://github.com/elementrics"><code>@elementrics</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/566">cloudflare/circl#566</a></li> <li>group: add byteLen method for short groups and RandomScalar uses rand.Int by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/568">cloudflare/circl#568</a></li> <li>add arm64 version of poly.Add/Sub by <a href="https://github.com/elementrics"><code>@elementrics</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/572">cloudflare/circl#572</a></li> <li>group: Adding cryptobyte marshaling to scalars by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/569">cloudflare/circl#569</a></li> <li>Bumping up to Go1.25 by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/574">cloudflare/circl#574</a></li> <li>ci: Including WASM compilation. by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/577">cloudflare/circl#577</a></li> <li>Revert to using package-declared HPKE errors for shortkem instead of standard library errors by <a href="https://github.com/harshiniwho"><code>@harshiniwho</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/578">cloudflare/circl#578</a></li> <li>Release v1.6.2 by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/579">cloudflare/circl#579</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dfaranha"><code>@dfaranha</code></a> made their first contribution in <a href="https://redirect.github.com/cloudflare/circl/pull/547">cloudflare/circl#547</a></li> <li><a href="https://github.com/elementrics"><code>@elementrics</code></a> made their first contribution in <a href="https://redirect.github.com/cloudflare/circl/pull/562">cloudflare/circl#562</a></li> <li><a href="https://github.com/harshiniwho"><code>@harshiniwho</code></a> made their first contribution in <a href="https://redirect.github.com/cloudflare/circl/pull/578">cloudflare/circl#578</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/cloudflare/circl/compare/v1.6.1...v1.6.2">https://github.com/cloudflare/circl/compare/v1.6.1...v1.6.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cloudflare/circl/commit/24ae53c5d6f7fe18203adc125ba3ed76a38703e1"><code>24ae53c</code></a> Release CIRCL v1.6.3</li> <li><a href="https://github.com/cloudflare/circl/commit/581020bd4a836b8ce7bd4e414ba2884c07dbc906"><code>581020b</code></a> Rename method to oddMultiplesProjective.</li> <li><a href="https://github.com/cloudflare/circl/commit/12209a4566605692a8402594e367a5aed5148460"><code>12209a4</code></a> Removing unused cmov for jacobian points.</li> <li><a href="https://github.com/cloudflare/circl/commit/fcba359f4178645d2c9e50f29ab6966337da4b95"><code>fcba359</code></a> ecc/p384: use of complete projective formulas for scalar multiplication.</li> <li><a href="https://github.com/cloudflare/circl/commit/5e1bae8d8c2df4e717c2c5c2d5b5d60b629b2ac6"><code>5e1bae8</code></a> ecc/p384: handle point doubling in point addition with Jacobian coordinates.</li> <li><a href="https://github.com/cloudflare/circl/commit/341604685ff97e8f7440ae4b4711ba1c118c648c"><code>3416046</code></a> Check opts for nil value.</li> <li><a href="https://github.com/cloudflare/circl/commit/a763d47a6dce43d1f4f7b697d1d7810463a526f6"><code>a763d47</code></a> Release CIRCL v1.6.2</li> <li><a href="https://github.com/cloudflare/circl/commit/3c70bf9ad53b681fbe5ba6067e454a86549fee8a"><code>3c70bf9</code></a> Bump x/crypto x/sys dependencies.</li> <li><a href="https://github.com/cloudflare/circl/commit/3f0f15b2bfe67bad81a35e8aec81ae42ca78349d"><code>3f0f15b</code></a> Revert to using package-declared HPKE errors for shortkem instead of standard...</li> <li><a href="https://github.com/cloudflare/circl/commit/23491bd573cf29b6f567057a158203a2c9dfa30d"><code>23491bd</code></a> Adding generic Power2Round method.</li> <li>Additional commits viewable in <a href="https://github.com/cloudflare/circl/compare/v1.6.1...v1.6.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/cloudflare/circl&package-manager=go_modules&previous-version=1.6.1&new-version=1.6.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-02-25 22:56:30 -03:00
dependabot[bot]andIan Littman	6c584e889a	Bump github.com/nats-io/nats-server/v2 from 2.12.1 to 2.12.3 (#40406 ) Bumps [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) from 2.12.1 to 2.12.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nats-io/nats-server/releases">github.com/nats-io/nats-server/v2's releases</a>.</em></p> <blockquote> <h2>Release v2.12.3</h2> <h2>Changelog</h2> <p>Refer to the <a href="https://docs.nats.io/release-notes/whats_new/whats_new_212">2.12 Upgrade Guide</a> for backwards compatibility notes with 2.11.x.</p> <h3>Go Version</h3> <ul> <li>1.25.5 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7604">#7604</a>)</li> </ul> <h3>Dependencies</h3> <ul> <li>github.com/google/go-tpm v0.9.7 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7578">#7578</a>)</li> <li>github.com/nats-io/nkeys v0.4.12 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7578">#7578</a>)</li> <li>golang.org/x/crypto v0.45.0 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7578">#7578</a>)</li> <li>github.com/klauspost/compress v1.18.2 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7604">#7604</a>)</li> <li>github.com/antithesishq/antithesis-sdk-go v0.5.0-default-no-op (<a href="https://redirect.github.com/nats-io/nats-server/issues/7604">#7604</a>)</li> <li>golang.org/x/crypto v0.46.0 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7648">#7648</a>)</li> <li>golang.org/x/sys v0.39.0 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7648">#7648</a>)</li> </ul> <h3>Added</h3> <p>General</p> <ul> <li>Added WebSocket-specific ping interval configuration with <code>ping_internal</code> in the <code>websocket</code> block (<a href="https://redirect.github.com/nats-io/nats-server/issues/7614">#7614</a>)</li> </ul> <h3>Improved</h3> <p>JetStream</p> <ul> <li>The scan for the last sourced message sequence when setting up a subject-filtered source is now considerably faster (<a href="https://redirect.github.com/nats-io/nats-server/issues/7553">#7553</a>)</li> <li>The metalayer will now stage and deduplicate recovery operations at startup, instead of rapidly applying and then undoing conflicting assignments (<a href="https://redirect.github.com/nats-io/nats-server/issues/7540">#7540</a>)</li> <li>Consumer interest checks on interest-based streams are now significantly faster when there are large gaps in interest (<a href="https://redirect.github.com/nats-io/nats-server/issues/7656">#7656</a>)</li> </ul> <p>MQTT</p> <ul> <li>Retained messages will now work correctly even when sourced from a different account and has a subject transform (<a href="https://redirect.github.com/nats-io/nats-server/issues/7636">#7636</a>)</li> </ul> <h3>Fixed</h3> <p>General</p> <ul> <li>WebSocket connections will now correctly limit the buffer size during decompression (<a href="https://redirect.github.com/nats-io/nats-server/issues/7625">#7625</a>, thanks to Pavel Kokout at Aisle Research)</li> </ul> <p>JetStream</p> <ul> <li>A protocol error caused by an invalid transform of acknowledgement reply subjects when originating from a gateway connection has been fixed (<a href="https://redirect.github.com/nats-io/nats-server/issues/7579">#7579</a>)</li> <li>The meta layer will now only respond to peer remove requests after quorum has been reached (<a href="https://redirect.github.com/nats-io/nats-server/issues/7581">#7581</a>)</li> <li>Invalid subject filters containing non-terminating full wildcard no longer produce unexpected matches (<a href="https://redirect.github.com/nats-io/nats-server/issues/7585">#7585</a>)</li> <li>A data race when creating a stream in clustered mode has been fixed (<a href="https://redirect.github.com/nats-io/nats-server/issues/7586">#7586</a>)</li> <li>Raft will no longer allow multiple membership changes to take place concurrently (<a href="https://redirect.github.com/nats-io/nats-server/issues/7565">#7565</a>, <a href="https://redirect.github.com/nats-io/nats-server/issues/7609">#7609</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nats-io/nats-server/commit/450a519adf9c53e3d86623bb423dcad5e658ae78"><code>450a519</code></a> Release v2.12.3</li> <li><a href="https://github.com/nats-io/nats-server/commit/8670ba0073be3e12300a31e0f877dd432ef4c70c"><code>8670ba0</code></a> Release v2.12.3-RC.5</li> <li><a href="https://github.com/nats-io/nats-server/commit/08bb9ee8fa0a8b6a5527ef904f887835ff8773e9"><code>08bb9ee</code></a> Cherry-picks for 2.12.3-RC.5 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7657">#7657</a>)</li> <li><a href="https://github.com/nats-io/nats-server/commit/7bd48a2f3ccbfc026bbd301e965bc0d675eedf79"><code>7bd48a2</code></a> [IMPROVED] Consumer interest check with large gap</li> <li><a href="https://github.com/nats-io/nats-server/commit/9be1774b16df2e099a1f0ff050c78d11eadeae99"><code>9be1774</code></a> [FIXED] Filestore desync during stream snapshot</li> <li><a href="https://github.com/nats-io/nats-server/commit/97f0c1a8bc74e50decc92901087c7ec1331349ff"><code>97f0c1a</code></a> Release v2.12.3-RC.4</li> <li><a href="https://github.com/nats-io/nats-server/commit/036a3fda5bdcc4026af69bfaeee13a8c9eb02936"><code>036a3fd</code></a> Cherry-picks for 2.12.3-RC.4 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7652">#7652</a>)</li> <li><a href="https://github.com/nats-io/nats-server/commit/6d739faa5c78751b2cfbb4218cf55fb67f792430"><code>6d739fa</code></a> NRG: Removed leader may reappear in membership</li> <li><a href="https://github.com/nats-io/nats-server/commit/d2e57bf2e8df37cbb354141ca21cc6a7362576e2"><code>d2e57bf</code></a> [FIXED] mb.compact updates last seq/ts</li> <li><a href="https://github.com/nats-io/nats-server/commit/8e732b2dafd27a4be7d615d928cb7ffec417e337"><code>8e732b2</code></a> [FIXED] Filestore idx mismatch & 'no idx present' errors</li> <li>Additional commits viewable in <a href="https://github.com/nats-io/nats-server/compare/v2.12.1...v2.12.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/nats-io/nats-server/v2&package-manager=go_modules&previous-version=2.12.1&new-version=2.12.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ian Littman <iansltx@gmail.com>	2026-02-24 12:51:48 -06:00
Josh Roskos	6769d8dd3a	Bump shogo82148/rdsmysql/v2 v2.4.0 to v2.5.0 (#40103 ) https://github.com/shogo82148/rdsmysql/pull/222 Adds AWS GovCloud RDS CA certificates (us-gov-east-1, us-gov-west-1) to the rdsmysql TLS bundle, improving compatibility for Fleet deployments in AWS GovCloud regions. Transitive dependency updates pulled in by rdsmysql v2.5.0: - github.com/aws/aws-sdk-go-v2 and related submodules (minor bumps) - github.com/go-sql-driver/mysql v1.9.1 -> v1.9.3 - filippo.io/edwards25519 v1.1.0 -> v1.1.1 <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves https://github.com/fleetdm/fleet/issues/40148 ## Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] QA'd all new/changed functionality manually — dependency bump only; ran full local test suite across all affected packages (`server/platform/mysql`, `server/logging`, `server/config`, `server/mail`) with no regressions. `go mod verify` passed.	2026-02-20 10:33:27 -06:00
dependabot[bot]	2c5733a374	Bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#40113 ) Bumps [filippo.io/edwards25519](https://github.com/FiloSottile/edwards25519) from 1.1.0 to 1.1.1. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/FiloSottile/edwards25519/commit/d1c650afb95fad0742b98d95f2eb2cf031393abb"><code>d1c650a</code></a> extra: initialize receiver in MultiScalarMult</li> <li>See full diff in <a href="https://github.com/FiloSottile/edwards25519/compare/v1.1.0...v1.1.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=filippo.io/edwards25519&package-manager=go_modules&previous-version=1.1.0&new-version=1.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-02-19 12:06:24 -06:00
Lucas Manuel Rodriguez	e9f9d5a7d5	Remove github.com/apex/log dependency only used in a tool (#39822 ) Realized this when developing in VSCode and typing `log.` then it auto-imported that apex/log thing, which seems we only use in a tool.	2026-02-13 11:42:35 -03:00
Lucas Manuel Rodriguez	1085d66f6f	Update `macadmins/osquery-extensions` to v1.3.2 (#39691 ) Resolves #39642. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] QA'd all new/changed functionality manually ```sh fleetd 1.51.1: osquery> .schema munki_installs CREATE TABLE munki_installs(`installed_version` TEXT, `installed` TEXT, `name` TEXT, `end_time` TEXT, `display_name` TEXT); Using this branch: osquery> .schema munki_installs CREATE TABLE munki_installs(`installed_version` TEXT, `version_to_install` TEXT, `installed` TEXT, `name` TEXT, `end_time` TEXT, `display_name` TEXT); ``` ## fleetd/orbit/Fleet Desktop - [X] Verified that fleetd runs on macOS - [X] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))	2026-02-11 15:11:28 -03:00
dependabot[bot]	c1e3e89b5f	Bump github.com/go-git/go-git/v5 from 5.13.0 to 5.16.5 (#39590 ) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.13.0 to 5.16.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.16.5</h2> <h2>What's Changed</h2> <ul> <li>build: Update module golang.org/x/crypto to v0.45.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/1744">go-git/go-git#1744</a></li> <li>build: Bump Go test versions to 1.23-1.25 (v5) by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1746">go-git/go-git#1746</a></li> <li>[v5] git: worktree, Don't delete local untracked files when resetting worktree by <a href="https://github.com/Ch00k"><code>@Ch00k</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1800">go-git/go-git#1800</a></li> <li>Expand packfile checks by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1836">go-git/go-git#1836</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.16.4...v5.16.5">https://github.com/go-git/go-git/compare/v5.16.4...v5.16.5</a></p> <h2>v5.16.4</h2> <h2>What's Changed</h2> <ul> <li>backport plumbing: format/idxfile, prevent panic by <a href="https://github.com/swills"><code>@swills</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1732">go-git/go-git#1732</a></li> <li>[backport] build: test, Fix build on Windows. by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1734">go-git/go-git#1734</a></li> <li>build: Update module golang.org/x/net to v0.38.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/1742">go-git/go-git#1742</a></li> <li>build: Update module github.com/cloudflare/circl to v1.6.1 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/1741">go-git/go-git#1741</a></li> <li>build: Update module github.com/go-git/go-git/v5 to v5.13.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/1743">go-git/go-git#1743</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.16.3...v5.16.4">https://github.com/go-git/go-git/compare/v5.16.3...v5.16.4</a></p> <h2>v5.16.3</h2> <h2>What's Changed</h2> <ul> <li>internal: Expand regex to fix build [5.x] by <a href="https://github.com/baloo"><code>@baloo</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1644">go-git/go-git#1644</a></li> <li>build: raise timeouts for windows CI tests and disable CIFuzz [5.x] by <a href="https://github.com/baloo"><code>@baloo</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1646">go-git/go-git#1646</a></li> <li>plumbing: support commits extra headers, support jujutsu signed commit [5.x] by <a href="https://github.com/baloo"><code>@baloo</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1633">go-git/go-git#1633</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.16.2...v5.16.3">https://github.com/go-git/go-git/compare/v5.16.2...v5.16.3</a></p> <h2>v5.16.2</h2> <h2>What's Changed</h2> <ul> <li>utils: fix diff so subpaths work for sparse checkouts, fixes 1455 to releases/v5.x by <a href="https://github.com/kane8n"><code>@kane8n</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1567">go-git/go-git#1567</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.16.1...v5.16.2">https://github.com/go-git/go-git/compare/v5.16.1...v5.16.2</a></p> <h2>v5.16.1</h2> <h2>What's Changed</h2> <ul> <li>utils: merkletrie, Fix diff on sparse-checkout index. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/1406">#1406</a> to releases/v5.x by <a href="https://github.com/kane8n"><code>@kane8n</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1561">go-git/go-git#1561</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/kane8n"><code>@kane8n</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/1561">go-git/go-git#1561</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.16.0...v5.16.1">https://github.com/go-git/go-git/compare/v5.16.0...v5.16.1</a></p> <h2>v5.16.0</h2> <h2>What's Changed</h2> <ul> <li>[v5] plumbing: support mTLS for HTTPS protocol by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1510">go-git/go-git#1510</a></li> <li>v5: plumbing: transport, Reintroduce SetHostKeyCallback. Fix <a href="https://redirect.github.com/go-git/go-git/issues/1514">#1514</a> by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1515">go-git/go-git#1515</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/48a1ae05eec4fff4dd0343744a00bf8d6a7a0b4b"><code>48a1ae0</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1836">#1836</a> from go-git/check-v5</li> <li><a href="https://github.com/go-git/go-git/commit/42bdf1f9044e2145acaed6ac4dbf1b8d257da5bd"><code>42bdf1f</code></a> storage: filesystem, Verify idx matches pack file</li> <li><a href="https://github.com/go-git/go-git/commit/4146a5653f186f90057afecb7e0addd9e623cf19"><code>4146a56</code></a> plumbing: format/idxfile, Verify idxfile's checksum</li> <li><a href="https://github.com/go-git/go-git/commit/63d78ec080cb176f8cd7bf46ce14f4ba01c1d2e5"><code>63d78ec</code></a> plumbing: format/packfile, Add new ErrMalformedPackFile</li> <li><a href="https://github.com/go-git/go-git/commit/25f1624754395a0c67839e71b34956c853f2eb3d"><code>25f1624</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1800">#1800</a> from Ch00k/no-delete-untracked-v5</li> <li><a href="https://github.com/go-git/go-git/commit/600fb139079e3c6886fcfeb20021c707e99e29b4"><code>600fb13</code></a> git: worktree, Don't delete local untracked files when resetting worktree</li> <li><a href="https://github.com/go-git/go-git/commit/390a56941510fdc19276aa298228d61889aad97a"><code>390a569</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1746">#1746</a> from pjbgf/bump-go</li> <li><a href="https://github.com/go-git/go-git/commit/61c8b859ce3366257354695e99d78fc3739b60fb"><code>61c8b85</code></a> build: Bump Go test versions to 1.23-1.25 (v5)</li> <li><a href="https://github.com/go-git/go-git/commit/e5a05ecd4fb91dc5323ec77667346ae94d84c043"><code>e5a05ec</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1744">#1744</a> from go-git/renovate/releases/v5.x-go-golang.org-x-c...</li> <li><a href="https://github.com/go-git/go-git/commit/1495930b098b5e72394ae8ccc2d9396b8aa7e013"><code>1495930</code></a> plumbing: Remove use of non-constant format strings</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.13.0...v5.16.5">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.13.0&new-version=5.16.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-02-09 19:12:31 -06:00
Victor Lyuboslavsky	a10f05486f	Added OTEL log export support (#39279 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #38607 Contributor docs update: https://github.com/fleetdm/fleet/pull/39285/changes Another contributor docs update: https://github.com/fleetdm/fleet/pull/39402/changes Also: - renamed OtelHandler to OtelTracingHandler - made "opentelemetry" be the default when tracing is enabled - updated OTEL dependencies # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [x] Setting(s) is/are explicitly excluded from GitOps <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added OpenTelemetry log export capability, enabling logs to be sent to OpenTelemetry collectors. * New configuration option `logging.otel_logs_enabled` (requires tracing to be enabled). * Chores * Updated OpenTelemetry dependencies to v1.40.0 with latest OTLP exporters and logging support. * Updated dependencies including gRPC (v1.78.0), Google libraries, and cryptography packages. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-02-06 18:57:28 -06:00
Lucas Manuel Rodriguez	7c9713d08f	Fix panic in gRPC launcher API handler (#39409 ) - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] QA'd all new/changed functionality manually	2026-02-06 09:31:14 -03:00
Zach Wasserman	3a0b72a329	Add gzip support to API handlers (#38675 ) Related issue: Resolves #37944 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [x] Setting(s) is/are explicitly excluded from GitOps (it's a server configuration)	2026-01-29 08:21:18 -03:00
Victor Lyuboslavsky	07949df530	Improved OpenTelemetry error handling (#38757 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #38756 - Changed to NOT mark many client errors as exceptions - Instead, added client_error and server_error metrics that can be used to alert on unusual error rates # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added separate metrics for distinguishing between client and server errors, enhancing observability and monitoring capabilities. * Bug Fixes * Client request errors no longer incorrectly appear in error tracking as exceptions; improved accuracy of error reporting to external services. * Adjusted logging levels for authentication and enrollment operations to provide clearer diagnostics. <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-01-26 17:07:32 -06:00
Scott Gress	393531b624	Implement trusted proxies config (#38471 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves # # Details Adds a new `FLEET_SERVER_TRUSTED_PROXIES` config, allowing more fine-grained control over how the client IP is determined for requests. Uses the [realclientip-go](https://github.com/realclientip/realclientip-go) library as the engine for parsing headers and using rules to determine the IP. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Introduced FLEET_SERVER_TRUSTED_PROXIES configuration option to specify trusted proxy IPs and hosts. The server now supports flexible client IP detection strategies that respect your proxy configuration, with support for multiple formats including single IP header names, hop counts, and IP address ranges, adapting to various infrastructure setups and deployment scenarios. <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-01-19 22:13:37 -06:00
Jordan Montgomery	e225ef5791	Improve Microsoft endpoint validation (#38180 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #13698 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually	2026-01-12 15:28:45 -05:00
Nico	116c8ddb4f	Remove valyala/fastjson and valyala/fasttemplate dependencies (#37914 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Context: https://fleetdm.slack.com/archives/C019WG4GH0A/p1767713469571139 Replaced `valyala` dependencies and now relying on `json.Unmarshal` and manual traversal of `Template` subjects, such as [this one](https://github.com/fleetdm/fleet/blob/main/server/logging/nats_test.go#L113) # Checklist for submitter ## Testing - [x] ~~Added/updated automated tests~~ I'm relying on existing tests on `nats_test.go` which already cover using a `Template` subject, namely: https://github.com/fleetdm/fleet/blob/main/server/logging/nats_test.go#L112-L132 https://github.com/fleetdm/fleet/blob/main/server/logging/nats_test.go#L194-L245 https://github.com/fleetdm/fleet/blob/main/server/logging/nats_test.go#L301-L356 - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually Ran `nats-server`, subscribed to all subjects by running `nats --server=nats://localhost:4222 subscribe ">"` and got logs from this query: <img width="675" height="411" alt="Screenshot 2026-01-06 at 4 12 52 PM" src="https://github.com/user-attachments/assets/e4e6e5d0-53ac-4b09-9810-b6032794d5f3" /> <img width="773" height="165" alt="Screenshot 2026-01-06 at 4 11 16 PM" src="https://github.com/user-attachments/assets/6f58d1f1-272b-40b3-96f5-1659c0bbb918" /> <img width="2541" height="119" alt="Screenshot 2026-01-06 at 4 11 06 PM" src="https://github.com/user-attachments/assets/2e61acac-063c-4cdd-aeee-871031600125" />	2026-01-06 16:58:51 -03:00
Eric Busto Rachael Shaw nulmete	b6d19de0d9	Add support for publishing logs to NATS. (#36527 ) Related issue: Resolves [34890](https://github.com/fleetdm/fleet/issues/34890) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually ## New Fleet configuration settings Looking at other log destinations, I couldn't find anything relevant in GitOps. Please let me know if I missed something, however. ## fleetd/orbit/Fleet Desktop I've tested this on both Linux and MacOS. --------- Co-authored-by: Rachael Shaw <r@rachael.wtf> Co-authored-by: nulmete <nicoulmete1@gmail.com>	2026-01-06 09:10:32 -03:00
Lucas Manuel Rodriguez	e68a129eb9	Fix build warning (#37257 ) Fixing the following warning: ``` $ make fleet [...] # github.com/shoenig/go-m1cpu ../../gopath/pkg/mod/github.com/shoenig/go-m1cpu@v0.1.6/cpu.go:75:17: warning: variable length array folded to constant array as an extension [-Wgnu-folding-constant] ../../gopath/pkg/mod/github.com/shoenig/go-m1cpu@v0.1.6/cpu.go:77:16: warning: variable length array folded to constant array as an extension [-Wgnu-folding-constant] ``` PS: This warning happens when building fleet because we need to decouple the client code from `server/service`... (hopefully to be done as part of https://github.com/fleetdm/fleet/issues/36087)	2025-12-15 12:08:31 -03:00

1 2 3 4 5 ...