Fixes#29216. No changes file as this is just a `docker-compose` change
so this will work with existing Fleet releases.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Manual QA for all new/changed functionality
Fixes#30229. No changes file since this is a vulns feed fix not tied to
a release.
- [x] Added/updated automated tests
- [x] Manual QA for all new/changed functionality
for #29942
# Details
This PR addresses an issue on Linux where Orbit repeatedly attempts to
launch Fleet Desktop even though no GUI user is logged in. The fix is
similar to one implemented for MacOS, where we have Orbit check for the
presence of a real user (not a system user like `gdm` or `root`) before
trying to launch the desktop app.
Part of this work involved moving some functionality from the `execuser`
package to the `user` package, to avoid duplicating functionality.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
<!-- Note that API documentation changes are now addressed by the
product design team. -->
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Manual QA for all new/changed functionality
- For Orbit and Fleet Desktop changes:
- [x] Make sure fleetd is compatible with the latest released version of
Fleet (see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)).
- [x] Orbit runs on macOS, Linux and Windows. Check if the orbit
feature/bugfix should only apply to one platform (`runtime.GOOS`).
- [x] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
The changed code is only executed on Linux, so I tested on Ubuntu,
Fedora and Debian. Also verified that it still works on MacOS and
Windows.
---------
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
<!-- Note that API documentation changes are now addressed by the
product design team. -->
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- For database migrations:
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
- [x] Added/updated automated tests
- [x] Manual QA for all new/changed functionality
Fixes#29618, #30282.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
<!-- Note that API documentation changes are now addressed by the
product design team. -->
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated automated tests
- [x] Manual QA for all new/changed functionality
Fixes#28207.
No changes file since this will go live once merged, and it affects the
vulns feed. Tests will fail for vulns on-branch since this requires a
vulns feed rebuild.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
<!-- Note that API documentation changes are now addressed by the
product design team. -->
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated automated tests
- [x] Manual QA for all new/changed functionality
To help us reproduce [this
bug](https://github.com/fleetdm/fleet/issues/30239) using dogfood.
- @noahtalerman: Only added to "Workstations (canary)" for testing. Why
not use the Fleet-maintained apps in for the "Workstations" team?
We missed to add this when we upgraded Go to 1.24.4.
Report
https://github.com/fleetdm/fleet/actions/runs/15626203997/job/44020838145
How to test (with and without the new VEX file):
```
docker scout cves --only-fixed --vex-location=./security/vex/fleet --only-vex-affected --only-severity high,critical fleetdm/fleet:v4.69.0
```
## #30198
[Video
demo](https://drive.google.com/file/d/1RBk5QNQdQvXTHJveCNkIeMXj5hWFA5Ft/view?usp=sharing)
- Implement the following logic for `teamId` in the UI when in Primo
mode:
<img width="870" alt="Screenshot 2025-06-24 at 12 47 48 PM"
src="https://github.com/user-attachments/assets/8ae81c3f-223f-4dda-954d-c42c7008de45"
/>
- Above logic is enforced - if trying to change/add/remove `team_id`,
automatically pushed to appropriate team
- Fixes originally reported issue - user in Primo mode can access
installable software (on the hidden "No team" which is now enforced):
- Software page on No team
- Update header help text
- Handle UI edge cases the above surfaces:
- Queries page on All teams (No team not supported):
<img width="1624" alt="Screenshot 2025-06-24 at 1 10 40 PM"
src="https://github.com/user-attachments/assets/84bb2ca0-b8e7-44e8-9bf5-9f8f243d5584"
/>
- Policies page on No team:
<img width="1624" alt="Screenshot 2025-06-24 at 1 10 53 PM"
src="https://github.com/user-attachments/assets/144d745f-e9b0-4933-be45-2db4fe428cfe"
/>
- update `useTeamIdParam` hook's strip query params on change team logic
to optionally also consider the current team
**Important notes**
- Software page: Software automations are only accessible via All teams,
while Add software is only accessible on a team, including No team. In
lieu of specs around this, I decided to favor Add software functionality
over Software automations functionality, aka, push to "No team" on this
page. Enabling _both_ functionalities would be a very large ticket and
need to go through a proper drafting process, since Fleet doesn't
currently support both in any state.
- Policies page:
- "Other workflows" (tickets and webhooks) is available on All Teams and
specific teams, but not on No Team, so "Other workflows" is currently
unavailable in Primo mode
- If any of the Primo customers have created policies on All Teams
already, they won't be able to manage automations on them anymore. All
Teams policies can only have ticket/webhook workflows
- [x] Changes file added for user-visible changes in `changes/`
- [x] Manual QA for all new/changed functionality
---------
Co-authored-by: Jacob Shandling <jacob@fleetdm.com>
Automated update of MIN_OSQUERY_VERSION_OPTIONS with any new osquery
release. (Note: This automatic update is the solution to issue #21431)
Co-authored-by: RachelElysia <RachelElysia@users.noreply.github.com>
Co-authored-by: Ian Littman <iansltx@gmail.com>
Changes:
- Added `articles` to the list of supported article categories in the
build-static-content script.
- Added a route for articles in the articles category.
- Updated the `view-basic-article` action to support the new `articles`
category.
> No issue, fixes broken test
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
<!-- Note that API documentation changes are now addressed by the
product design team. -->
- [x] Added/updated automated tests
Eric