**Related issue:** Resolves#47699
## Testing
- [x] QA'd all new/changed functionality manually
## What & why
Entra conditional access is becoming available to self-hosted Fleet
Premium instances, which don't have the shared `MS-API-KEY` that
cloud-managed customers use. This makes the `microsoft-proxy/*`
endpoints reachable without that key by dropping the `is-cloud-customer`
policy gate (and the now-unused shared-secret config comments / policy
file).
A replacement auth mechanism for the proxy is tracked separately in
#47702.
> Split out of #49414 so the website change can ship independently.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Security / Access Control**
* Updated Microsoft proxy access handling to bypass the prior
cloud-customer check for matching requests.
* **Configuration**
* Removed unused cloud-customer compliance proxy shared-secret settings.
* **Bug Fixes**
* Improved compliance partner tenant creation by detecting existing
tenants using the provided Entra tenant ID and corrected the success
message text.
* **Data Model**
* Removed uniqueness enforcement for stored fleet instance URLs to
prevent avoidable conflicts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
osquery [5.23.1](https://github.com/osquery/osquery/releases/tag/5.23.1)
was released by osquery publicly today, this updates our schema with the
changes in it.
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated schema support for certificate `subject2` and `issuer2` fields
on Linux and macOS.
* Documentation generation and download tooling now target osquery
`5.23.1`.
* **Bug Fixes**
* Clarified the `process_open_handles` table behavior by removing
outdated default-process wording.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated GitHub review automation configuration, modifying approver
assignments for the handbook/marketing section and updating contributor
access for the website/views section.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Added `rachaelshaw` as a maintainer for
`server/api_endpoints/api_endpoints.yml`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated internal maintainer configuration for API endpoints file
management.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This didn't override the need for a @go codeowner review since they own
the directory it's in, so moved it to CODEOWNERS
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated internal development configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: https://github.com/fleetdm/confidential/issues/16057
Changes:
- Added `email-application-submitted`, an email template that is used to
reply to users who fill out the "Apply" form
- Updated the `deliver-application-submission` action to return an
`invalidEmailDomain` response if a user's email address is on the
bannedEmailDomainsForContactFormSubmissions list, and to send a "Thank
you for applying to Fleet" email to the user who submitted the form.
- Stubbed a new custom config variable: `applicationReplyEmailAddress`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Applicants receive a "Thanks for applying to Fleet" confirmation email
with a personalized greeting and ~7-day expectation.
* Added an application-submitted email template and preview using the
email layout.
* **Improvements**
* Added a hidden honeypot field to the application form; submissions
with it filled are silently discarded.
* Added email-domain validation with a specific form error and clearer
error rendering.
* Redirected jobs to the internal handbook open-positions section.
* **Chores**
* Added a commented placeholder for an application reply email setting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
https://github.com/osquery/osquery/releases/tag/5.23.0
PS: I see that the `yara` table was dropped in 5.23.0 in favor of
`yara_file` and `yara_process`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added three new osquery query tables: `process_open_handles`
(Windows), `secureboot_certificates` (Linux), and `yara_events` for
expanded system visibility.
* Added new columns across existing tables to enhance data collection
capabilities.
* **Updates**
* Upgraded osquery to version 5.23.0.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes: https://github.com/fleetdm/fleet/issues/44066
Changes:
- updated the `update-or-create-contact-and-account` helper to:
- Save potential duplicate contacts with placeholder name values (`?
?`).
- Use the firstName and lastName values returned by the get-enriched
helper if a name is not provided.
- Update contacts with placeholder name values if a name is provided.
- Removed a domain from the lists of banned email domains.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enhanced Salesforce contact creation with automatic name derivation
from enrichment data.
* Improved duplicate detection allowing new contacts to be created with
flexible matching rules.
* Automatic replacement of placeholder names with verified data during
contact updates.
* **Chores**
* Updated email domain blocklists configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated email domain restrictions across multiple submission and
validation processes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Updated the input validation and added an invalidEmailDomain exit to
the deliver-deal-registration-submission and
deliver-partner-registration-submission actions
- Updated the input validation in the
deliver-whitepaper-download-request and deliver-webinar-access-request
actions
- Added error messages to the forms on the partners page for the added
exits
- Updated the `bannedEmailDomainsForCSRSigning` and
`bannedEmailDomainsForWebsiteSubmissions` config values
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Blocked submissions from restricted email domains with a clear error
response and a prompt to use a work email.
* **Bug Fixes**
* Strengthened email-format and required-field validation across
registration and request forms.
* Restricted partner registration type options to accepted values.
* **Chores**
* Added a domain to the denylist used for website submissions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated documentation ownership and auto-approval permissions for the
company communications handbook section to reflect current team
structure.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Added the `ee/fleet-agent-downloader` directory to the
`githubRepoDRIByPath` and `githubRepoMaintainersByPath` config values to
the website's custom configuration, and removed
`ee/bulk-operations-dashboard` (which was removed in the PR that added
that directory).
## Summary
- Adds `sampfluger88` to `githubRepoMaintainersByPath` for
`website/api/controllers/webhooks/receive-from-clay.js`
- Adds `sampfluger88` to `githubRepoMaintainersByPath` for
`website/api/helpers/salesforce`
These are new entries in the maintainers mapping in
`website/config/custom.js`, ensuring that changes to the Clay webhook
controller and Salesforce helper files are auto-approved for
`sampfluger88`.
Built for [Sam
Pfluger](https://fleetdm.slack.com/archives/D0AF8QFBVHB/p1773792660524399)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com>
## Summary
Closes#41466
- Adds Anthropic Claude API support to the `prompt.js` AI helper,
detecting `claude-*` model names and routing to the Anthropic Messages
API (`https://api.anthropic.com/v1/messages`) with proper authentication
headers
- Switches both LLM calls in the query generator
(`get-llm-generated-sql.js`) from OpenAI models
(`gpt-4o-mini-2024-07-18` for schema filtration, `o3-mini-2025-01-31`
for SQL generation) to `claude-sonnet-4-6-20260218`
- Adds `anthropicSecret` config placeholder in `custom.js` (set via
`sails_custom__anthropicSecret` env var in production)
- Updates the query generator UI to reference "Anthropic" instead of
"OpenAI"
### Changes
| File | What changed |
|------|-------------|
| `website/api/helpers/ai/prompt.js` | Added Anthropic API branch
alongside existing OpenAI logic; system prompts use Anthropic's
top-level `system` parameter |
| `website/api/controllers/query-generator/get-llm-generated-sql.js` |
Both model references changed to `claude-sonnet-4-6-20260218` |
| `website/config/custom.js` | Added `anthropicSecret` config
placeholder |
| `website/views/pages/admin/query-generator.ejs` | Updated copy from
"OpenAI" to "Anthropic" |
### Deployment notes
The `sails_custom__anthropicSecret` environment variable must be set
with an Anthropic API key before deploying this change.
---
Built for
[mikermcneil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1773278374183489?thread_ts=1773271495.702919&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
Changes:
- Added a landing page that has links to upcoming citops workshops, and
a link to a form where users can request a GitOps workshop.
- Updated the contact page to display a GitOps workshop request form for
users who are linked to it from the GitOps workshop landing page.
- Added `deliver-gitops-workshop-request`, an action that sends details
of GitOps workshop request submissions to Salesforce.
- Added a new helper that creates campaign member objects in Salesforce.
- Added two new config variables used to get event details from the
Eventbrite API.
Removed 'sampfluger88' from '.github/workflows' code owners and added
code owner assignments for various issue templates, specifying
responsible users for each template.
Moved several handbook path ownerships from CODEOWNERS to custom.js and
added corresponding entries in custom.js. Updated reviewer lists for
CODEOWNERS and custom.js files to include 'ireedy'. Adjusted ownership
for specific handbook sections to reflect current maintainers.
For https://github.com/fleetdm/fleet/issues/37261
Changes:
- Added a new database model: `FleetInstanceUsingVpp`
- Added `/api/vpp/v1/register`: An API endpoint that validates provided
Fleet license keys, creates a database record for the proxy
registration, and returns a generated secret used to authenticate
requests to the other VPP proxy endpoint
- Added `/api/vpp/v1/metadata/:storeRegion`: An API endpoint that
forwards requests to the
`https://api.ent.apple.com/v1/catalog/${storeRegion}/stoken-authenticated-apps`
Apple API with a token generated using Fleet's Apple developer
credentials.
---------
Co-authored-by: Ian Littman <iansltx@gmail.com>
Closes: https://github.com/fleetdm/fleet/issues/36620
Changes:
- Updated the website to use the osquery 5.20.0 schema when generating
osquery table documentation pages and osquery_fleet_schema.json
- Regenerated osquery_fleet_schema.json
- Simplify steps. Why? Fewer handoffs / approvals
- #g-software EM reviews all PRs within 3 business days
- Commit to automated tests. No need to do manual testing because the CI
already installs the app and checks, via osquery, if the
install/uninstalls worked
- Remove issue template
Why now?
- https://github.com/fleetdm/confidential/issues/12844
---------
Co-authored-by: Martin Angers <martin.n.angers@gmail.com>
Co-authored-by: George Karr <georgekarrv@users.noreply.github.com>
Related to: https://github.com/fleetdm/confidential/issues/10999
Changes:
- added domains to the list of personal email domains that cannot be
used to submit forms on the Fleet website, and sorted the list
alphabetically.
Closes: #33798Closes: #35223
Related to: https://github.com/fleetdm/fleet/issues/34618
Related to: https://github.com/fleetdm/fleet/issues/34611
Changes:
- Updated the `manage-fleet-premium-trial-instances` script to:
- Send a request to the Github API to trigger a workflow to create a DNS
and SES configuration for new Render trial instances, and send a request
to trigger a workflow to delete the DNS and SES configuration when trial
instances expire
- Use a new prompt to generate unique slugs for new Render trial
instances
- Configure SES on new Fleet Premium trial instances
- Prefix licenses generated for Fleet Premium trial instances with
'Render-trial-`
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#33848
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- New Features
- Added support for the Security & Compliance project within the GitHub
integration, enabling tracking and visibility alongside existing
projects.
- Refactor
- Streamlined project mapping logic to improve consistency when
processing updates from GitHub; behavior for existing projects remains
unchanged.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Noah Talerman
