<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38234
Minor developer experience improvement for tests using MySQL.
This is a code review follow up.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38704
Cancels upcoming activities and marks the current in-house app install
as failed, to match the existing behaviour for vpp installs.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
- During Product office hours on 2025-12-23, we learned that no one on
the call knew what the current request body format was for API endpoints
that take `multipart/form-data`
- We think the updated format is more friendly for humans who are using
curl/Postman
- We later learned that this the current format is the raw request
(formatted by a browser or curl command)
- Also update "form" to "body" in the "Parameters" table. We learned
that the form data is actually part the body. Postman's UI shows this.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#35447
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Suppressed unnecessary error logging when no CPE match is found for
software items such as VSCode extensions and JetBrains plugins,
resulting in cleaner application logs.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This was due to the fact that homebrew splits the git and gitk packages
into two. However, the nvd feed attributes cves exclusively to a "git"
package.
**Related issue:** Resolves#35191
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
This pull request introduces new department-based host labels to the IT
and Security configuration, allowing hosts to be categorized according
to the department of their end user. The main change is the addition of
seven new label definitions and their inclusion in the `default.yml`
configuration.
**Department label additions:**
* Updated `it-and-security/default.yml` to include references to seven
new department label files, enabling department-based host
categorization.
**New department label definitions:**
* Added `department-information-technology.yml` to define a label for
hosts belonging to the Information Technology department.
* Added `department-sales.yml`, `department-marketing.yml`,
`department-engineering.yml`, `department-people.yml`,
`department-finance.yml`, and `department-product-design.yml` to define
labels for hosts in Sales, Marketing, Engineering, People, Finance, and
Product Design departments, respectively.
[[1]](diffhunk://#diff-dd6b63c2483cf179831fd7b3192a75f25d9eadfcba8309737ce3406912df74eaR1-R6)
[[2]](diffhunk://#diff-aec6aaa00d0b092d0a427d819f61a4df9c00b5ba67d8438757c5f038860697f2R1-R6)
[[3]](diffhunk://#diff-060b9bf1ab3202940dadc644616890ab99bcd81e37808ec099ff29ba064687adR1-R6)
[[4]](diffhunk://#diff-ef0c2b34df74cf1cd1c32165d3c88f85b29a8d67a02e2b837f2f544e02ad2573R1-R6)
[[5]](diffhunk://#diff-f491ad729d54f56ac51eaa4576f2a2c8a077a16c4abe623198ed6f3b14d03004R1-R6)
[[6]](diffhunk://#diff-ce077a969811b6e57400a23a7d6cb3d40b8ebd6b6733ebd4f3f1fe7558f5fe2dR1-R6)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38549
Associated documentation update PR:
https://github.com/fleetdm/fleet/pull/38702
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Introduced conditional_access.cert_serial_format to choose certificate
serial number format (hex or decimal); hex is default.
* SSO certificate serial parsing now respects the configured format.
* **Bug Fixes**
* Improved parsing and error handling for certificate serial numbers
across formats.
* **Tests**
* Added unit tests for configuration validation and serial-number
parsing for both hex and decimal.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37183
Software request:
```json
{
"message": "Bad request",
"errors": [
{
"name": "base",
"reason": "Couldn't update. Label \"non-existing-label\" doesn't exist. Please remove the label from the software."
}
],
"uuid": "3a9a4da3-d7af-4ed5-8b39-73e9f465f103"
}
```
Config profile:
```json
{
"message": "Bad request",
"errors": [
{
"name": "base",
"reason": "Couldn't update. Label \"non-existent-label\" doesn't exist. Please remove the label from the configuration profile."
}
],
"uuid": "ea842e7b-d4eb-4b59-bf24-32ad66d538dd"
}
```
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#31605
I manually scanned our inlined dependencies for vulnerabilities and did
not find any relevant ones.
I added a dummy directory pointing at the source of our inlined
dependencies so that automated vuln scanning tools can scan them. I did
not include Kolide since the code was heavily adapted and only included
a few tables.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Established infrastructure for automated vulnerability scanning of
inlined third-party dependencies in Go and JavaScript environments, with
comprehensive documentation and configuration to enable scanning via
standard tools.
* **Chores**
* Updated gitignore configuration to refine dependency file tracking
across the project.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38234
This came up in activity bounded context code review.
Following existing patterns, authz testing will be in `policy_test.go`,
and integration tests will simply cover connectivity (not exhaustive
authz).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Enhanced authorization test coverage for activity operations with
improved validation scenarios.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
DONE: @noahtalerman:
- ~~Record video~~
- ~~Move October 2025 edits out into a separate PR so we can merge
ASAP~~
- ~~Once video is posted to YouTube, embed the video. Filed a
`:help-marketing` request to get help putting the video on YouTube:
https://github.com/fleetdm/confidential/issues/13908~~
This pull request makes a minor update to the Cisco Jabber version
transformer. The version reported by the transformer is incremented from
"15.2.0" to "15.2.1" to match the latest app version.
- Updated the `CiscoJabberVersionTransformer` in
`cisco_jabber_version_transformer.go` to set `app.Version` to "15.2.1"
instead of "15.2.0".
Getting the `fleetctl` binary from our script or GitHub Releases is
easier than directing users to install and manage it with Node/npm.
Also, removed the statement that the binary is for Windows and Linux,
since it works on macOS too.
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced authorization validation for certificate template batch
deletion operations, ensuring all templates belong to the specified team
before allowing deletion.
* **Tests**
* Added authorization verification tests for certificate template
deletion to prevent cross-team unauthorized access.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes#30392. Fixes Host Software API not returning execution IDs for failed install/uninstall attempts, preventing users from viewing failure details in the software library page.
Related to: https://github.com/fleetdm/confidential/issues/13527
Changes:
- Changed the name of the /articles page to "Blogs"
- Updated the blogs category to exclude guides
- Added a link to /guides to the sidebar on article category pages
Changes:
- Updated the accepted `intentSingal` values in the receive-from-clay
webhook and the createHistoricalEvent helper to match the picklist
values in Salesforce
- updated a "most recent/source channel details" value set in the
updateOrCreateContactAndAccount helper to match the picklist value in
Salesforce.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38234
Addresses Ian's suggestion from activity bounded context code review.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Updated user lookup functionality across the system to return minimal
user information instead of full user objects. Changes affect multiple
system interfaces and data access layers to optimize performance and
reduce data payload for user-related operations throughout the
application.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- We no longer have a requester field in the issue template.
- Updated the notification process for user stories pushed to the next
sprint to include the release DRI.
- Not sure if we have documented in other spot when to ping the release
DRI, but I think we should in this case as well.
Victor Lyuboslavsky