229 Commits
Author SHA1 Message Date
dependabot[bot] 4448913812 Bump dompurify from 3.4.12 to 3.4.13 (#50791) 2026-08-07 15:55:59 -05:00
dependabot[bot] 12754cc48d Bump js-yaml from 4.3.0 to 4.3.1 (#50745) 2026-08-07 09:59:11 -05:00
dependabot[bot] f9b9fefed1 Bump fast-uri from 3.1.4 to 3.1.5 (#50501) 2026-08-04 13:03:58 -05:00
dependabot[bot] 237a6d3040 Bump postcss from 8.5.18 to 8.5.23 (#50452) 2026-08-03 12:49:32 -05:00
dependabot[bot] 23a1d4746e Bump brace-expansion from 1.1.16 to 1.1.18 (#50379) 2026-08-03 12:46:41 -05:00
dependabot[bot] 04467c2683 Bump brace-expansion from 1.1.13 to 1.1.16 (#49908) 2026-07-30 07:56:10 -05:00
dependabot[bot] e14dcd759a Bump postcss from 8.5.10 to 8.5.18 (#49905) 2026-07-30 07:55:51 -05:00
dependabot[bot] 171c4d9de5 Bump fast-uri from 3.1.2 to 3.1.4 (#49801) 2026-07-30 07:55:28 -05:00
dependabot[bot] f34f4c6430 Bump immutable from 5.1.5 to 5.1.9 (#49800) 2026-07-30 07:55:03 -05:00
dependabot[bot] 2eccdea09b Bump js-yaml from 4.2.0 to 4.3.0 (#49799) 2026-07-30 07:51:18 -05:00
dependabot[bot] 0d0fa9cf91 Bump dompurify from 3.4.11 to 3.4.12 (#49798) 2026-07-30 07:50:58 -05:00
dependabot[bot] 2d3ecb59f3 Bump axios from 1.16.1 to 1.18.0 (#49600) 2026-07-30 07:48:33 -05:00
Carlo 5aac3d6952 Dedupe transitive uuid to 14.0.0 (#49566) 2026-07-20 10:48:29 -06:00
dependabot[bot] f59cf2fc4f Bump websocket-driver from 0.7.4 to 0.7.5 (#49384) 2026-07-16 12:30:06 -07:00
dependabot[bot] 754a1422ef Bump ws from 8.19.0 to 8.21.0 (#49028) 2026-07-13 14:14:43 -07:00
Luke Heath 667b37138c Bump axios and form-data to resolve Dependabot CVE alerts (#48465) 2026-07-06 13:19:35 -07:00
Marko Lisica 977d8e8d73 New ToastNotification component to replace FlashMessage component (#47508)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Redesigned in-app notifications with a new toast-based UI style.
* Error messages are now dismissible and expandable to reveal detailed
server response information.
* Success and error notifications now appear consistently across the
application with improved visibility.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-06-23 12:26:02 +02:00
dependabot[bot] abb6c7b2a2 Bump dompurify from 3.4.9 to 3.4.11 (#47910) 2026-06-20 08:04:41 -07:00
dependabot[bot] 656af8fd28 Bump js-yaml from 3.14.2 to 4.2.0 (#47708) 2026-06-20 07:59:38 -07:00
dependabot[bot] d488f68c1b Bump form-data from 4.0.5 to 4.0.6 (#47710) 2026-06-17 09:12:00 -07:00
dependabot[bot] 8825c128b5 Bump dompurify from 3.4.2 to 3.4.9 (#47709) 2026-06-17 09:11:40 -07:00
Luke Heath 23370ced56 Bump @slack/bolt, axios, and dompurify (SCA fixes) (#46278) 2026-05-29 14:29:46 -05:00
dependabot[bot] 38c136960a Bump axios from 1.15.2 to 1.16.0 (#46459) 2026-05-29 12:49:19 -05:00
RachelElysia 7c3355295a Fleet UI: "Fleet spotlight" (Command palette menu) (#43756) 2026-05-28 09:25:54 -04:00
dependabot[bot] a7ea9e91ae Bump qs from 6.14.2 to 6.15.2 (#46092) 2026-05-22 14:48:08 -05:00
Luke Heath 5c6b61a991 Bump js-cookie, uuid, and axios to fix high-severity CVEs (#46053) 2026-05-22 10:37:30 -05:00
dependabot[bot] cf458374ff Bump js-cookie from 3.0.5 to 3.0.7 (#46024) 2026-05-22 09:58:15 -05:00
Luke Heath c0f5e520d3 Security: triage May 2026 code scanning alerts (#45740) 2026-05-20 09:12:34 -05:00
Scott Gress 4f8737efda bump node-sql-parser fork (#45472)
Resolves #33759 

Bumps Fleet's `@sgress454/node-sql-parser` to the version that includes
https://github.com/sgress454/node-sql-parser/pull/8, with fixes for
#33759.
2026-05-14 10:48:15 -04:00
dependabot[bot] 8150d99e21 Bump @babel/plugin-transform-modules-systemjs from 7.29.0 to 7.29.4 (#45084) 2026-05-08 16:59:45 -05:00
dependabot[bot] 3ec0990b0b Bump fast-uri from 3.1.0 to 3.1.2 (#45063) 2026-05-08 16:41:55 -05:00
dependabot[bot] 7e410c7f12 Bump axios from 1.15.0 to 1.15.2 (#44744) 2026-05-06 14:36:10 -05:00
Scott Gress 9609f0ad4b Upgrade fork-ts-checker-webpack-plugin (#44304)
Resolves #44301

This PR updates the `fork-ts-checker-webpack-plugin` to resolve the
errors we were seeing when running it. Since it now runs cleanly, it
identified a few typescript errors that need to be resolved at the same
time:

* `<EmptyState>` no longer takes a `graphicName` param since it's been
redesigned in #43896
* `<PoliciesCard>` was reworked in #43411 and no longer takes `router`.

I verified that this compiles cleanly in `make generate` and `make
generate-dev`.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Refactor**
* Simplified component properties and prop handling across host details,
packs, and queries pages.
* Refined empty-state configuration in packs management and queries
tables.

* **Chores**
* Updated development build tool dependency from version 6.5.0 to 9.1.0
for TypeScript type-checking integration.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-28 13:16:32 -05:00
dependabot[bot] c1b5b62410 Bump postcss from 8.5.6 to 8.5.10 (#44137) 2026-04-24 14:57:53 -05:00
Scott Gress 207c3058c5 Add dashboard charts frontend (#43878)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** For #43769

# Details

This PR adds "Hosts active" and "Hosts enrolled" charts to the
dashboard.

New components:

* **ChartCard.tsx**: encapsulates a visualization-agnostic chart, for
data provided by the new `/charts` endpoint created in
https://github.com/fleetdm/fleet/pull/43910
* **ChartFilterModal.tsx**: modal for setting filters on a chart.
Currently supports filtering by label, platform and individual host.
* **CheckerboardViz.tsx**: a checkerboard visualization for use in
ChartCard. Capable of charting 1, 7, 14 or 30 days at a time, although
only 30 day charts are used right now. Bespoke rendering using SVG,
since recharts scatterchart was harder to wrangle than it was worth.
* **LineChartViz.tsx**: a line-chart visualization using Recharts
* **HostsEnrolledCard.tsx**: a bar chart of enrolled hosts using
Recharts

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- With backend provided by https://github.com/fleetdm/fleet/pull/43910:
<img width="1426" height="428" alt="image"
src="https://github.com/user-attachments/assets/0f53b9d1-c87b-4225-a175-2d40af5afe41"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Dashboard now shows interactive "Hosts active" (line/heatmap) and
"Hosts enrolled" (bar) charts with metric selection, filter modal
(labels/platforms/hosts), legends, tooltips, and responsive layout.
* **Tests**
* Added comprehensive tests covering chart rendering, checkerboard
heatmap, and no-data states.
* **Chores**
  * Added charting library dependency to support visualizations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-23 19:36:11 -05:00
dependabot[bot] c3d89fa844 Bump uuid from 8.3.2 to 14.0.0 (#44032) 2026-04-23 12:24:42 -05:00
dependabot[bot] 198e736a30 Bump dompurify from 3.3.2 to 3.4.0 (#43655) 2026-04-17 12:44:14 -05:00
dependabot[bot] f814d46320 Bump follow-redirects from 1.15.11 to 1.16.0 (#43562) 2026-04-15 08:51:21 -05:00
dependabot[bot] 98dc201fd9 Bump axios from 1.13.5 to 1.15.0 (#43373) 2026-04-10 14:02:15 -05:00
Ian Littman f829170923 Update to TypeScript 6.0 (#43141)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [ ] QA'd all new/changed functionality manually
2026-04-09 08:28:59 -05:00
dependabot[bot] f14fc8352d Bump lodash from 4.17.23 to 4.18.1 (#42917) 2026-04-02 13:48:09 -05:00
dependabot[bot] 01cf93b71f Bump flatted from 3.3.3 to 3.4.2 (#42119) 2026-04-02 13:44:55 -05:00
dependabot[bot] 6f9e4ce214 Bump brace-expansion from 1.1.12 to 1.1.13 (#42557) 2026-03-30 10:54:35 -05:00
jacobshandling 293b4342a4 Remove husky-based pre-commit formatting (#42582)
Undoes https://github.com/fleetdm/fleet/pull/42470, which overwrites
local git hook configuration
2026-03-27 13:21:06 -07:00
jacobshandlingandCopilot ee822eb207 Run prettier formatting on commit for frontend code (#42470)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* Configured pre-commit hooks to automatically format code before
commits are made.
* Integrated code formatting tooling into the development workflow for
JavaScript, TypeScript, and JSX files in the frontend.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

- [x] Manual testing
- [x] Confirmed decent speed on a MBP M5 48g RAM
https://www.loom.com/share/0c803cbcca7f46579f44be9ec06e787e

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-03-26 12:41:13 -07:00
dependabot[bot] 8642bc52ef Bump dompurify from 3.2.4 to 3.3.2 (#41068)
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.2.4 to
3.3.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/cure53/DOMPurify/releases">dompurify's
releases</a>.</em></p>
<blockquote>
<h2>DOMPurify 3.3.2</h2>
<ul>
<li>Fixed a possible bypass caused by jsdom's faulty raw-text tag
parsing, thanks multiple reporters</li>
<li>Fixed a prototype pollution issue when working with custom elements,
thanks <a
href="https://github.com/christos-eth"><code>@​christos-eth</code></a></li>
<li>Fixed a lenient config parsing in <code>_isValidAttribute</code>,
thanks <a
href="https://github.com/christos-eth"><code>@​christos-eth</code></a></li>
<li>Bumped and removed several dependencies, thanks <a
href="https://github.com/Rotzbua"><code>@​Rotzbua</code></a></li>
<li>Fixed the test suite after bumping dependencies, thanks <a
href="https://github.com/Rotzbua"><code>@​Rotzbua</code></a></li>
</ul>
<h2>DOMPurify 3.3.1</h2>
<ul>
<li>Updated <code>ADD_FORBID_CONTENTS</code> setting to extend default
list, thanks <a
href="https://github.com/MariusRumpf"><code>@​MariusRumpf</code></a></li>
<li>Updated the ESM import syntax to be more correct, thanks <a
href="https://github.com/binhpv"><code>@​binhpv</code></a></li>
</ul>
<h2>DOMPurify 3.3.0</h2>
<ul>
<li>Added the SVG <code>mask-type</code> attribute to default
allow-list, thanks <a
href="https://github.com/prasadrajandran"><code>@​prasadrajandran</code></a></li>
<li>Added support for <code>ADD_ATTR</code> and <code>ADD_TAGS</code> to
accept functions, thanks <a
href="https://github.com/nelstrom"><code>@​nelstrom</code></a></li>
<li>Fixed an issue with the <code>slot</code> element being in both SVG
and HTML allow-list, thanks <a
href="https://github.com/Wim-Valgaeren"><code>@​Wim-Valgaeren</code></a></li>
</ul>
<h2>DOMPurify 3.2.7</h2>
<ul>
<li>Added new attributes and elements to default allow-list, thanks <a
href="https://github.com/elrion018"><code>@​elrion018</code></a></li>
<li>Added <code>tagName</code> parameter to custom element
<code>attributeNameCheck</code>, thanks <a
href="https://github.com/nelstrom"><code>@​nelstrom</code></a></li>
<li>Added better check for animated <code>href</code> attributes, thanks
<a href="https://github.com/llamakko"><code>@​llamakko</code></a></li>
<li>Updated and improved the bundled types, thanks <a
href="https://github.com/ssi02014"><code>@​ssi02014</code></a></li>
<li>Updated several tests to better align with new browser encoding
behaviors</li>
<li>Improved the handling of potentially risky content inside CDATA
elements, thanks <a
href="https://github.com/securityMB"><code>@​securityMB</code></a> &amp;
<a href="https://github.com/terjanq"><code>@​terjanq</code></a></li>
<li>Improved the regular expression for raw-text elements to cover
textareas, thanks <a
href="https://github.com/securityMB"><code>@​securityMB</code></a> &amp;
<a href="https://github.com/terjanq"><code>@​terjanq</code></a></li>
</ul>
<h2>DOMPurify 3.2.6</h2>
<ul>
<li>Fixed several typos and removed clutter from our documentation,
thanks <a
href="https://github.com/Rotzbua"><code>@​Rotzbua</code></a></li>
<li>Added <code>matrix:</code> as an allowed URI scheme, thanks <a
href="https://github.com/kleinesfilmroellchen"><code>@​kleinesfilmroellchen</code></a></li>
<li>Added better config hardening against prototype pollution, thanks <a
href="https://github.com/EffectRenan"><code>@​EffectRenan</code></a></li>
<li>Added better handling of attribute removal, thanks <a
href="https://github.com/michalnieruchalski-tiugo"><code>@​michalnieruchalski-tiugo</code></a></li>
<li>Added better configuration for aggressive mXSS scrubbing behavior,
thanks <a
href="https://github.com/BryanValverdeU"><code>@​BryanValverdeU</code></a></li>
<li>Removed the script that caused the fake entry <a
href="https://security.snyk.io/vuln/SNYK-JS-DOMPURIFY-10176060">CVE-2025-48050</a></li>
</ul>
<h2>DOMPurify 3.2.5</h2>
<ul>
<li>Added a check to the mXSS detection regex to be more strict, thanks
<a
href="https://github.com/masatokinugawa"><code>@​masatokinugawa</code></a></li>
<li>Added ESM type imports in source, removes patch function, thanks <a
href="https://github.com/donmccurdy"><code>@​donmccurdy</code></a></li>
<li>Added script to verify various TypeScript configurations, thanks <a
href="https://github.com/reduckted"><code>@​reduckted</code></a></li>
<li>Added more modern browsers to the Karma launchers list</li>
<li>Added Node 23.x to tested runtimes, removed Node 17.x</li>
<li>Fixed the generation of source maps, thanks <a
href="https://github.com/reduckted"><code>@​reduckted</code></a></li>
<li>Fixed an unexpected behavior with <code>ALLOWED_URI_REGEXP</code>
using the 'g' flag, thanks <a
href="https://github.com/hhk-png"><code>@​hhk-png</code></a></li>
<li>Fixed a few typos in the README file</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/cure53/DOMPurify/commit/5e56114cb24079ce52dbc51f76e494b77afa5153"><code>5e56114</code></a>
Getting 3.x branch ready for 3.3.2 release (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1208">#1208</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/e8c95f4a27aa8b041f92b59ab7685a94f7be6208"><code>e8c95f4</code></a>
fix: Fixed the broken package-lock.json</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/9636037c145b769dad0b52da8313301cbf867f46"><code>9636037</code></a>
Update package-lock.json</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/5cad4cecf2e647ac66eed25bc02a2415f00dbc8b"><code>5cad4ce</code></a>
Getting 3.x branch ready for 3.3.2 releas (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1205">#1205</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/6fc446a589ab3d1d72ae2a5b71167ba38dbd3096"><code>6fc446a</code></a>
Merge pull request <a
href="https://redirect.github.com/cure53/DOMPurify/issues/1175">#1175</a>
from cure53/main</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/3b3bf917d2b39460de6d130acebdc9243cf3e6ae"><code>3b3bf91</code></a>
Merge branch 'main' of github.com:cure53/DOMPurify</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/9863f4195bae6048de9eb2802219218c6904066c"><code>9863f41</code></a>
chore: Preparing 3.3.1 release</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/b4e02954dc4172c3944a755f3e99fbb76be64f7b"><code>b4e0295</code></a>
chore: Preparing 3.3.0 release</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/077746bb2cfb77836dfb628dca7ffc7ced8a5356"><code>077746b</code></a>
build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1170">#1170</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/4de68bba9aba43dc3bba9348df603b64fc06d591"><code>4de68bb</code></a>
build(deps): bump actions/checkout from 5 to 6 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1171">#1171</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/cure53/DOMPurify/compare/3.2.4...3.3.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=dompurify&package-manager=npm_and_yarn&previous-version=3.2.4&new-version=3.3.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-06 14:00:21 -06:00
dependabot[bot] ff5cb60b3f Bump immutable from 5.1.4 to 5.1.5 (#41020)
Bumps [immutable](https://github.com/immutable-js/immutable-js) from
5.1.4 to 5.1.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/immutable-js/immutable-js/releases">immutable's
releases</a>.</em></p>
<blockquote>
<h2>v5.1.5</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix Improperly Controlled Modification of Object Prototype
Attributes ('Prototype Pollution') in immutable</li>
<li>Upgrade devtools and use immutable version by <a
href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2158">immutable-js/immutable-js#2158</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/immutable-js/immutable-js/compare/v5.1.4...v5.1.5">https://github.com/immutable-js/immutable-js/compare/v5.1.4...v5.1.5</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md">immutable's
changelog</a>.</em></p>
<blockquote>
<h2>5.1.5</h2>
<ul>
<li>Fix Improperly Controlled Modification of Object Prototype
Attributes ('Prototype Pollution') in immutable</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/b37b85568632227751ddc8a16034cacc0f42b652"><code>b37b855</code></a>
5.1.5</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/16b3313fdf2c5f579f10799e22869f6909abf945"><code>16b3313</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/fd2ef4977ee654c5bf26368dbf2f983c8d679bd6"><code>fd2ef49</code></a>
fix new proto key injection</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/6734b7b2af7e9dadf517eb9473cc64d2dfe2e301"><code>6734b7b</code></a>
fix Prototype Pollution in mergeDeep, toJS, etc.</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/6f772de1e44dcde14128e48d19081a7a077f2162"><code>6f772de</code></a>
Merge pull request <a
href="https://redirect.github.com/immutable-js/immutable-js/issues/2175">#2175</a>
from immutable-js/dependabot/npm_and_yarn/rollup-4.59.0</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/5f3dc61fd0e231654f04a850b8764e7e864c54b3"><code>5f3dc61</code></a>
Bump rollup from 4.34.8 to 4.59.0</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/049a594410962c13dfd0f2d0bf0ef2154271079e"><code>049a594</code></a>
Merge pull request <a
href="https://redirect.github.com/immutable-js/immutable-js/issues/2173">#2173</a>
from immutable-js/dependabot/npm_and_yarn/lodash-4.1...</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/2481a77331122eea4ace8afd4842042c6ae7510c"><code>2481a77</code></a>
Merge pull request <a
href="https://redirect.github.com/immutable-js/immutable-js/issues/2172">#2172</a>
from mrazauskas/update-tstyche</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/eb047790b44dac8e5ace49529a5c9928edfc8e12"><code>eb04779</code></a>
Bump lodash from 4.17.21 to 4.17.23</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/b973bf3b6242c9966143169825e1e14248c07c31"><code>b973bf3</code></a>
format</li>
<li>Additional commits viewable in <a
href="https://github.com/immutable-js/immutable-js/compare/v5.1.4...v5.1.5">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=immutable&package-manager=npm_and_yarn&previous-version=5.1.4&new-version=5.1.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-04 23:43:16 -06:00
Ian Littman 7e73c89e5e Bump Storybook to resolve dependency vulns (#40863) 2026-03-03 11:30:21 -06:00
Claudeandiansltx cba11a8750 Upgrade serialize-javascript to 7.0.3 (#40781)
From @iansltx: The below works because serialize-javascript v7's "BC
break" is requiring a newer version of Node, but we're well above that
version (20) already. There are no other BC breaks per release notes so
a resolution/override is safe here.

This is a transitive dependency of a dev dependency, so we don't need to
rush out a release for this change.

---

Upgrades the transitive dependency `serialize-javascript` from 6.0.2 to
7.0.3 across all package ecosystems in the repository.

## Changes

- Added yarn resolution `**/serialize-javascript: ^7.0.3` in root
`package.json`
- Added npm override `serialize-javascript: ^7.0.3` in
`ee/fleetd-chrome/package.json`
- Updated `yarn.lock` and `ee/fleetd-chrome/package-lock.json` to
resolve to version 7.0.3

The upgrade uses package manager resolution features since parent
dependencies (`webpack`, `terser-webpack-plugin`, `copy-webpack-plugin`)
still specify 6.x in their own dependencies.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Pinned serialize-javascript dependency to version ^7.0.3 in project
configurations.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com>
Co-authored-by: iansltx <472804+iansltx@users.noreply.github.com>
2026-03-03 10:51:41 -06:00
Gabriel Hernandez a0c5102903 update auth token storage (#40504)
**Related issue:** Resolves #14401

# Checklist for submitter

this updates the mechanism of storing the auth token for a user that is
used for making requests and validating a user session. We change the
storage from local storage to a cookie. This allow a bit more security
and prepares for a future change where we will allow the browser to
handle setting and passing the auth token in the request.


- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] QA'd all new/changed functionality manually
2026-02-26 17:05:13 +00:00