11df098d7cbcc007d7b89ace95cd34707445968c
26012
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 github-actions[bot]andlucasmrod
|
11df098d7c |
Update Orbit CA certs [automated] (#49160)
Resolves: https://github.com/fleetdm/fleet/issues/49161. Automated change from [GitHub action](https://github.com/fleetdm/fleet/actions/workflows/update-certs.yml). Claude summary: ``` ➕ Added (1) - e-Szigno TLS Root CA 2023 — new Hungarian (Microsec) root Mozilla admitted to the store. ➖ Removed (24) These match Mozilla's root-store retirements/distrusts over the Jan–Jul 2026 window. Grouped by the reason they went away: ┌────────────────────────────────────────────────────────────────┬─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ │ Theme │ Roots removed │ ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ Trustwave exiting the CA business │ Trustwave Global CA, Trustwave Global ECC P256, Trustwave Global ECC P384, SecureTrust CA, Secure Global CA │ ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ Entrust distrust (incl. Entrust-owned AffirmTrust) │ Entrust Root CA – G2, Entrust Root CA – EC1, AffirmTrust Commercial, AffirmTrust Networking, AffirmTrust Premium, AffirmTrust Premium ECC │ ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ Legacy DigiCert / QuoVadis roots retired (superseded by G2/G3) │ DigiCert Assured ID Root CA, DigiCert Global Root CA, DigiCert High Assurance EV Root CA, QuoVadis Root CA 2, QuoVadis Root CA 3 │ ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ Distrusted for compliance │ GLOBALTRUST 2020 │ ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ Other retirements │ COMODO Certification Authority, SwissSign Gold CA – G2, TeliaSonera Root CA v1, Certigna, certSIGN ROOT CA, FIRMAPROFESIONAL CA ROOT‑A WEB, GTS Root R2 │ └────────────────────────────────────────────────────────────────┴─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘ ``` Co-authored-by: lucasmrod <lucasmrod@users.noreply.github.com> |
||
|
Mike McNeil
|
e0c6411c2f |
Handbook: Update headcount (#49156)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # |
||
|
|
078fbc0f40 |
Add Targeted platforms column and platform filter to Policies page (#44125)
- @noahtalerman: For the following quick win: - https://github.com/fleetdm/fleet/issues/23737 ## Summary Adds a "Targeted platforms" column and a platform filter dropdown to the Policies page (`/policies/manage`), matching the pattern already used on the Reports page (`/queries/manage`, `ManageQueriesPage`). ### Frontend - New non-sortable **Targeted platforms** column rendered via `PlatformCell`, sourced from each policy's comma-separated `platform` field. - New platform filter dropdown (All / macOS / Windows / Linux / ChromeOS) wired as a `customControl` on the Policies table, alongside the existing automation filter. Selecting a value pushes a new URL (not a replace), resets `page` to 0, and updates the `platform` query param. - `ManagePoliciesPage` reads `location.query.platform` and threads it through to both `globalPoliciesAPI.loadAll` / `teamPoliciesAPI.loadAll` and the react-query keys, plus the count endpoints. The automation-filter and count "hide" conditions now include the platform filter so they remain visible when only a platform filter is active. - `frontend/services/entities/global_policies.ts` and `team_policies.ts` accept an optional `platform` param (with `"all"` normalized to `undefined`). - Added tests for the new column and dropdown in `PoliciesTable.tests.tsx`. ### Backend - Added `Platform string ` + `` `query:"platform,optional"` `` to `ListGlobalPoliciesRequest`, `CountGlobalPoliciesRequest`, `ListTeamPoliciesRequest`, `CountTeamPoliciesRequest`. - Extended datastore and service signatures (`ListGlobalPolicies`, `ListTeamPolicies`, `ListMergedTeamPolicies`, `CountPolicies`, `CountMergedTeamPolicies`, `ListGlobalPolicies`/`ListTeamPolicies` on the service) to accept a `platform string` arg. Mocks and all call sites updated. - Platform filtering in SQL uses a new helper `platformFilterClause`: ```sql AND (p.platforms = '' OR FIND_IN_SET(?, p.platforms)) ``` so policies targeting "all platforms" (empty `platforms` field) always match regardless of the selected filter. `FIND_IN_SET` uses a bound parameter (no injection risk). - Added a new MySQL integration test `testPoliciesPlatformFilter` covering empty-platform (match-all), per-platform filter, and team/merged paths. ### Docs - REST API docs for `GET /api/v1/fleet/global/policies`, `GET /api/v1/fleet/fleets/:id/policies`, and the corresponding `/count` endpoints now document the `platform` query param. - Added `changes/policies-targeted-platforms-filter`. ## Behavior - `platform=all` (or missing) returns all policies. - Selecting a specific platform returns policies whose `platforms` column is empty OR contains the selected token. - The dropdown only renders when the table is searchable (results exist OR any filter is active). - Changing the filter pushes a new URL and resets the page. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually Local verification: - `go build ./...` — clean - `go vet ./server/... ./cmd/... ./ee/...` — clean - `make lint-go-incremental` — 0 issues - Go service-level policy tests pass. MySQL integration tests compile but could not be run locally (no Docker); CI will exercise the new `testPoliciesPlatformFilter` test. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a "Targeted platforms" column with platform icons and an "All platforms" option. * Added a platform filter dropdown to scope policy lists; counts, last-updated, and controls adapt when a platform filter is active. Backend now honors an optional platform query parameter so filtering returns matching policies. * **Tests** * Added and updated unit and integration tests covering the new column, filter UI, and platform-filtered policy listings. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: nulmete <nicoulmete1@gmail.com> |
||
|
Allen Houchins
|
15118e4797 |
Remove AI model comparison article (#49132)
Delete the article on comparing AI models for configuration profile generation, including its body content and associated metadata tags. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
Luke Heath
|
6ed8217583 |
Fix open redirect in Vanta authorization redirect endpoint (#49077)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA (found via Aikido SAST triage) ## What changed `GET /redirect-vanta-authorization-request` is a public, unauthenticated endpoint that set signed cookies and then redirected the browser to the caller-supplied `vantaAuthorizationRequestURL` with no validation. Because the redirect target came straight from a query parameter, the endpoint could be abused as an open redirect: an attacker could craft a `https://fleetdm.com/redirect-vanta-authorization-request?...&vantaAuthorizationRequestURL=https://evil.example.com` link that bounces a victim to an arbitrary domain (phishing). The only prior gate was a `VantaConnection.findOne({vantaSourceId})` lookup, which does not bind the source ID to the redirect target and is satisfiable by anyone who has ever initiated a Vanta connection. This adds a host/scheme allowlist before redirecting. The legitimate destination is always `https://app.vanta.com/oauth/authorize?...` (constructed server-side in `create-vanta-authorization-request.js`), so the endpoint now only redirects when the parsed URL is `https:` and its host is `app.vanta.com`; otherwise it returns `badRequest`. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually Legitimate flow (redirect target `https://app.vanta.com/...`) still redirects as before; a target on any other host or a non-`https` scheme now returns `badRequest` instead of redirecting. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved safety for authorization redirects by validating the destination before sending users onward. * Redirects now only proceed when the target uses a secure connection and the approved site. * Invalid or malformed redirect links now return a clear bad-request response instead of continuing. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Noah Talerman
|
e7c2f10192 |
GitOps (YAML) reference: Remove "experimental" tags (#49142)
- Removed "experimental" for `macos_manual_agent_isntall` and `software` - There are no plans to break these. Customers are already using them in production |
||
|
Carlo
|
6cfc4a3611 |
Add GitOps support for macOS script-only packages in setup experience (#49089)
**Related issue:** Resolves #43667 # Summary Adds a `setup_experience_platforms` field to the GitOps software package spec so `.sh` script-only installers can be selected for macOS setup experience declaratively. Reconciles the cross-platform selection table on every batch apply. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added declarative `setup_experience_platforms` to software package definitions to control “setup experience” targets, including selecting script-only installers for macOS (mapped appropriately). * Batch uploads now propagate these cross-platform selections and reconcile installer cross-entries. * **Bug Fixes** * Improved platform normalization (trimming, casing, alias mapping), deduplication, and extension-specific validation. * Enhanced update behavior: omitting the field leaves existing selections unchanged; providing an empty list clears them, with correct setup/installation timing. * **Tests** * Added unit and integration coverage for normalization and batch re-apply/reconcile behavior (nil vs empty, idempotency, mixed updates, and validation failures). <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Tim Lee
|
945a4d1518 | Filter Add certificate CA dropdown to custom SCEP only (#49020) | ||
|
Magnus Jensen
|
790f457bf0 |
SAAD: GitOps for DDM assets (#49046)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48570 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. Added in a previous PR - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added end-to-end Apple DDM asset support in GitOps, including export and GitOps parsing for `macOS settings` assets. * Introduced Apple DDM asset management APIs (list/get/download/create/delete) plus a batch set operation with dry-run. * **Bug Fixes** * Improved Apple MDM/DDM reconciliation so referenced asset updates trigger re-delivery via asset-aware tokening. * Added safer validation around asset type changes and deletion conflicts when assets are still referenced. * **Tests** * Expanded unit and integration coverage for asset parsing, upload/apply behavior, reconciliation, and access control. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
aa5813e4eb |
Fix invisible hover state in dark mode (#49001)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48531 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually Checked all the places according to this list: ``` Rule 1 — modal secondary buttons (Cancel / Done / Clear all) `body.dark-mode .modal__modal_container .button--inverse:hover, …` Affects any modal opened from *inside a card* (the only modals where the card-leak made hover invisible). There are **4 such surfaces**, all reachable from the Dashboard or Self-service: 1. **Dashboard → the chart card (Hosts online / vulnerability exposure) → Settings cog → the Settings modal** — hover **Cancel** and **Clear all**. *(issue #48531)* 2. **Dashboard → Activity card → click any activity's details link** — the details modal's footer button (Done/Cancel). This is 12 different activity-detail modals (script details, software install/uninstall details, VPP install, MDM command, etc.). 3. **Dashboard on a fresh instance (fewer than 2 hosts) → "Welcome to Fleet" card → click a policy row** — the policy modal. 4. **Fleet Desktop "My device" → Self-service tab → "Install all" button** — the Install-all-in-category modal's Cancel. ## Rule 2 — button `DropdownWrapper` hover `body.dark-mode .card .dropdown-wrapper__button .react-select__control:hover` Exactly **1 place** in the whole app: 5. **Software → click a software title → title details page → the "Actions ▾" dropdown** at the top-right of the summary card. *(Admin/maintainer only — it's gated behind "can manage software".)* ## Rule 3 — `ActionsDropdown` hover `body.dark-mode .card .actions-dropdown-select__control:hover` Exactly **2 places**: 6. **Host details → Reports tab → each report card header → "Actions ▾"**. *(The confirmed repro.)* 7. **Fleet Desktop "My device" → Self-service tab → a software row → "More ▾"** dropdown. ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed dark-mode hover styling for buttons and dropdowns inside card components. * Restored the correct hover appearance for inverse buttons in modal containers. * Updated hover behavior for select-style dropdown controls so they match the card surface in dark mode. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
2b2a5991a4 |
handle client error decoding errors in ACME urls (#49137)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46282 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Malformed ACME URLs and resource identifiers now return a clear **400 Bad Request** response instead of a **500 Internal Server Error**. * Error details were improved to more accurately distinguish malformed client requests. * **Tests** * Added an integration test covering invalid ACME endpoint path IDs across resource types, verifying **400** responses with the expected malformed error type. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
9185174faa |
Re-add Crestron AirMedia (+Peripherals) Windows FMAs (#49127)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** N/A ## What changed Re-adds two Windows Fleet-maintained apps that were dropped from the letter C batch (#48969) **solely** because `www.crestron.com` returns HTTP 403 to Fleet's default Go `User-Agent`: - **Crestron AirMedia** (`Crestron.AirMedia`) - **Crestron AirMedia Peripherals** (`Crestron.AirMediaPeripherals`) Each gets an input JSON, a generated output, an `apps.json` catalog entry with description, a frontend icon component (+ `index.ts` registration), and a website icon PNG. Both are machine-scope MSIs (WiX) with upgrade-code uninstall; restored from their pre-drop state with outputs regenerated against the current winget manifests (versions unchanged: `5.11.1.164` / `1.11.1.164`, SHAs match). ## ⚠️ Depends on #49123 The 403 is fixed by #49123 (browser `User-Agent` in `DownloadInstaller`). Until #49123 merges and this branch is rebased on it, the FMA validator (`cmd/maintained-apps/validate`) will 403 downloading these installers. Merge #49123 first, then rebase/re-run CI here. ## Validation Run on a Windows validator with the #49123 UA fix in place — **both apps passed**: downloaded (confirming the UA fix unblocks `www.crestron.com`), installed, found via the exists query, and uninstalled cleanly. The `no changes in C:\Program Files` line is benign (they install elsewhere; the exists query still finds them). ## Dell Display and Peripheral Manager — investigated, dropped (not viable as an FMA) DDPM was verified and included in early revisions of this PR, then dropped. Its InstallShield (InstallScript) setup aborts with `0x80042000` in the validator's session-0 SYSTEM context across **every** documented silent switch — `/Silent`, `/S`, and `/Silent /HeadlessMode=true` all failed. Per silentinstallhq, DDPM 2.0+ requires the Windows Desktop Runtime (.NET) prerequisite installed first (extracted from the installer's own prerequisites folder), and its bundled InstallShield prerequisite chaining doesn't cooperate with a headless SYSTEM install; Dell's own community thread for this exact scenario (task sequence = SYSTEM) is unresolved. An FMA install script can't reliably extract-and-chain a runtime that may require a reboot, and DDPM only benefits hosts with Dell displays — so it's not a viable FMA. The identity work (verified DisplayName/publisher from the real installer) is recorded in the commit history if it's ever revisited. # Checklist for submitter - [ ] Changes file — N/A (FMA catalog data, consistent with prior letter batches which add no `changes/` entry). ## Testing - [x] Ran the ingester for both slugs; outputs + `apps.json` regenerated and validated as JSON. - [x] QA'd via the Windows FMA validator — both Crestron apps passed (with the #49123 UA fix present). |
||
|
Sharon Katz
|
2f0c1b338a |
Restrict SCIM endpoints to global admin only (#48858)
**Related issue:** N/A # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests ## Summary Restricts SCIM endpoint access to global admin users only. Previously, global maintainers also had access, which is broader than necessary. ### Changes - **`server/authz/policy.rego`**: Removed `maintainer` from the SCIM authorization rule, leaving only `admin`. - **`ee/server/integrationtest/scim/scim_test.go`**: Updated auth tests to verify maintainers now get 403, and that only admins can access SCIM endpoints. > **Breaking change for 4.89**: Customers using a global maintainer API token for SCIM will need to update to a global admin token before upgrading. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Restricted SCIM endpoint access to global administrators only. * **Bug Fixes** * Prevented unauthorized observer and maintainer users from accessing SCIM reads, writes, and details. * Improved authorization error tracking for denied SCIM requests (including recorded request status and details). * **Tests** * Updated SCIM authorization integration tests to reflect the tightened admin-only access rules. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sharon KatzandClaude Opus 4.6
|
dbdd3fe936 |
Handbook: add missing security practices to IT security page (#49069)
**Related issue:** N/A (documentation-only improvement) # Checklist for submitter - ~Changes file added~ (documentation-only change, no changes file needed) ## Testing - [x] QA'd all new/changed functionality manually Verified the markdown renders correctly and table alignment is consistent. ## Summary Adds three items to the IT security handbook page (`handbook/it/security.md`): - Trivy row in the SAST scanning table for container image and build artifact scanning - Paragraph noting weekly AI-assisted security scans - Paragraph in the Disclosure section documenting the private bug bounty program Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Ken Seals
|
8dde2a67e9 |
Fix open paren (#49126)
There was an open paren here in the Skip-level section <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
Allen Houchins
|
e2ca3120ee |
Add Firefox multilingual deployment guide (#49129)
New article explaining how to deploy Firefox with multiple language packs using a single Fleet-maintained app and post-install scripts for macOS and Windows. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49024 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
Jordan MontgomeryandCopilot Autofix powered by AI
|
087ce7ab56 |
Add UI for assets (#49071)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48571 # Checklist for submitter If some of the following don't apply, delete the relevant line. No changes file as this is a subtask - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a Premium-only **Assets** tab to Configuration Profiles, with JSON asset list, upload, download, copy, and delete (delete limited for technician views). * Added a Premium-only **Assets** entry to the command palette configuration controls. * Introduced a new **file-json** graphic type and enhanced user-scoped profile indicators (with iOS/iPad-specific behavior). * **Bug Fixes** * Updated navigation so the **Assets** view opens consistently from settings and the command palette. * Improved visual alignment of tooltip/icon elements in asset and scope displays. * **Tests** * Added coverage for Assets, upload/download/delete behaviors, and related UI components. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
fleet-releaseandallenhouchins
|
33ebf9f209 |
Update Fleet-maintained apps (#49125)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Updated the Drofus Windows app listing to version 2.18.11.0. * Updated the installer download link and verification information for the new release. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
SpeedRacerMcQueen
|
4cde1f6603 |
Update README.md (#49120)
fix typo in "Check LinkedIn for new activity" section |
||
|
fleet-releaseandallenhouchins
|
3c2ee6707a |
Update Fleet-maintained apps (#49122)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Updated the macOS WhatsApp package to version 26.27.21. * Updated the macOS Zed package to version 1.10.2. * Refreshed Zed’s installer link and verification checksum for the new release. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
Allen Houchins
|
b18b0c2a05 |
Add Windows FMAs (letter D): 12 apps (#49086)
**Related issue:** N/A — part of the Windows Fleet-maintained apps catalog expansion (letter D batch; follows #48872, #48881, #48950, #48969). Adds twelve new Windows Fleet-maintained apps: | App | winget package | Installer | Notes | |-----|----------------|-----------|-------| | DataSpell | `JetBrains.DataSpell` | NSIS (install4j), machine, x64 | Mirrors the DataGrip FMA pattern: `fuzzy_match_name` + `use_display_version_for_patch` (registry version is a JetBrains build number; marketing version parsed from the name). | | dnGrep | `dnGrep.dnGrep` | MSI, machine, x64 | Versioned+arch ARP name ("dnGrep 5.0.9 (x64)") → fuzzy match. | | Draftable Desktop | `Draftable.Draftable` | MSI, machine, x64 | Uses the machine-scope `DraftableDesktopSystem` MSI. **Caveat:** hard winget dependency on .NET 10 Desktop Runtime — installs fine but won't launch without it (same class as the BleachBit VCRedist dependency). | | dRofus | `dRofus.dRofus` | MSI, machine, x64 | Versioned ARP name ("dRofus 2.18") → fuzzy match. | | Devolutions Launcher | `Devolutions.Launcher` | MSI, machine, x64 | Distinct ARP identity from the existing Remote Desktop Manager FMA. | | Devolutions Workspace | `Devolutions.Workspace` | MSI, machine, x64 | Product renamed: ARP DisplayName is **"Devolutions Password Manager"** (set as `unique_identifier`). `program_publisher` overridden to "Devolutions Inc." (capital I) — verified via msiinfo; the locale-derived lowercase would not match. | | Delinea Connection Manager | `Delinea.DelineaConnectionManager` | MSI, machine, x64 | Dual-purpose MSI defaults to **per-user** (ALLUSERS=2 + MSIINSTALLPERUSER=1); custom install script forces `ALLUSERS=1 MSIINSTALLPERUSER=""`. `program_publisher` = "Delinea Inc.." (double period, as stored in the MSI). Unversioned URL → `ignore_hash`. | | DAX Studio | `DaxStudio.DaxStudio` | Inno, machine, x64 | `/ALLUSERS` for machine scope; versioned ARP name → fuzzy. | | DevPod | `LoftLabs.DevPod` | MSI, machine, x64 | Uses the WiX MSI variant (the manifest also has an NSIS per-user one). | | Directory Opus | `GPSoftware.DirectoryOpus` | Inno, machine, x64 | Standard Inno silent install/uninstall. | | DYMO ID | `DYMO.DYMOID` | InstallShield→MSI, machine, x86 | `/S /V"/qn /norestart"`; uninstall via msiexec by ProductCode. | | digiSeal Reader | `secrypt.digiSealreader` | EXE (self-extracting), machine, x86 | `installer_scope: ""` (manifest declares no scope); `-silent` install, shipped uninstaller with `-silent`. Unversioned URL → `ignore_hash`. | Considered but **not** added (recorded in the workstream tracker): - **Datadog Agent** (`Datadog.Agent`): winget PackageVersion is `7.81.0.1` but the MSI and registry report `7.81.0.0`, so the patch policy would flag every install as perpetually outdated. `use_display_version_for_patch` can't fix it (the manifest has no `AppsAndFeaturesEntries`); it needs a version-normalizing ingester ref (like `onepassword_version_shortener`). Deferred pending that helper (task spawned). - **Dell Display and Peripheral Manager** (`Dell.DisplayAndPeripheralManager`, covers both "Dell Display Manager" and "Dell Peripheral Manager"): the winget-pinned host `dl.dell.com` returns **403** to non-browser User-Agents, and Fleet's downloader sends `Go-http-client` (same failure that dropped Crestron AirMedia in letter C). The `downloads.dell.com` mirror serves the identical path to any UA, but there's no input field to override the manifest URL. Deferred pending a downloader User-Agent fix (task spawned — would also unblock Crestron). - **Dell EMC System Update** (`Dell.SystemUpdate`): registers its ARP entry under **HKCU** (per-user) under a SYSTEM install; legacy product Dell steers users away from (toward Dell Command Update, already an FMA); firmware/driver DUP bootstrapper. - **Devolutions Remote Desktop Manager Agent** (`Devolutions.RemoteDesktopManagerAgent`): legacy/superseded by "Devolutions Agent" (2026.1); winget manifest frozen at 2025.2.28.0 since Sept 2025; vendor docs page 404s. - **Dedoose** (`Dedoose.Dedoose`): per-user-only scope, x86, latest-pointer URL (CloudShow class). - **Defraggler** (`Piriform.Defraggler`): abandoned (final release 2020, no winget commits since 2023); legacy defrag tool with an unverified ARP publisher string. - **DiRoots ProSheets** (`DiRoots.ProSheets`): validated install but its Advanced Installer bootstrapper uninstall hung to the timeout and it drags bundled PDF24 Creator entries into inventory (dropped at validation). - **DroidCam Client** (`dev47apps.DroidCam`): NSIS `/S` install hung headless to the timeout (inline vc_redist); 3DxWare/Citrix headless-hang class (dropped at validation). Identities verified per app (msiinfo Property tables; installer PE/version resources; winget AppsAndFeaturesEntries; uninstall-database corroboration). Two publisher-casing mismatches (Devolutions Workspace, Delinea) were caught by direct MSI inspection and fixed with `program_publisher` before they could silently break the exists queries. SHAs verified against manifests for pinned URLs; `ignore_hash` used only where the manifest is demonstrably actively maintained. Icons via `tools/software/icons/generate-icons.sh` (the pre-existing DataSpell icon component is reused untouched). # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [ ] QA'd all new/changed functionality manually (relying on the FMA CI validator for Windows install/uninstall validation) |
||
|
Lucas Manuel Rodriguez
|
a37b483cf7 |
Add VEX exclusions for CVEs in fleetdm/wix (#49107)
Fixes: https://github.com/fleetdm/fleet/actions/runs/29075556043. New run: https://github.com/fleetdm/fleet/actions/runs/29090472465. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security** * Added vulnerability assessments for CVE-2025-70103 and CVE-2026-40355. * Documented the affected Wix-related components as not affected because the vulnerable code is not executed in the relevant workflows. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
240ae88408 |
inconsistent font size tooltip (#49121)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48229 <img width="465" height="151" alt="image" src="https://github.com/user-attachments/assets/af282c1a-af0d-4184-831d-cb7a98fc6bc8" /> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed an issue where the “Require BitLocker PIN” tooltip could render with an inconsistent font size. * Kept the Windows instructions content the same while adjusting the tooltip layout/line breaks for consistent display. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
f5531fdf1b |
Tooltips not always showing for full name (IdP) (#49116)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48125 Side effect is that we will no longer show the "Connect IdP" tooltip. https://github.com/user-attachments/assets/303836fb-a1c3-4d5e-9c2b-3fddd0dfb4d1 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Resolved an issue in the device Details → Users area where tooltips for a person’s full name and related IdP fields could fail to appear. * Tooltips now render reliably and show the correct help text when hovering the affected fields. * **Tests** * Expanded automated coverage to confirm tooltip visibility and the displayed tooltip content for the user details card. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
fleet-releaseandallenhouchins
|
030fb47754 |
Update Fleet-maintained apps (#49117)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Updates** - Updated Windows releases for AWS VPN Client (5.4.1), Brave Browser (150.1.92.139), Figma (126.6.14), Kiro (1.0.116), Microsoft Edge (150.0.4078.65), NordVPN (8.5.1.0), PDFsam Basic (6.0.3.0), Postman (12.18.5), Reqable (3.2.7), and Vivaldi (8.1.4087.48). - Updated macOS releases for Cursor, DaisyDisk, Grammarly, Notepad, Ocenaudio, PDFsam Basic, Reqable, Rocket.Chat, Session, Warp, Webex, and WeChat. - Refreshed installer links, version detection, and checksums where applicable. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
Magnus Jensen
|
05867fe955 |
Stop premium calls on Fleet free (#49118)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #47943 It no longer calls `ab_tokens` and `vpp_tokens` on fleet free <img width="1317" height="561" alt="image" src="https://github.com/user-attachments/assets/6556f91e-a7e4-487c-9961-3a22104329d3" /> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed an issue where Fleet Free accounts could trigger premium MDM calls. * Restricted premium token retrieval to eligible premium-tier accounts. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
a7010b2a4a |
SAAD: User channel + DDM assets for osquery-perf (#49108)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48573 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. In another PR - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for macOS MDM user enrollment simulation, configurable via enrollment probability. * Implemented user-scoped Declarative Device Management handling for tokens, declarations, configurations, assets, and status reporting. * Added new performance metrics for MDM user activity and DDM user activity (including tokens, items, and status outcomes). * **Bug Fixes** * Improved DDM synchronization by detecting declaration changes/removals and consolidating status updates. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
b4ce88645b |
SAAD: Support DDM assets in sync + reconciliation (#49016)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48568 second part # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Apple declarative management now supports asset-backed declarations, including device delivery of referenced DDM assets. * Added a new device-facing endpoint to fetch managed DDM assets by identifier (scoped to the device’s team). * **Bug Fixes** * Declaration/profile updates now refresh when referenced assets change (not just variables). * Device and host token/declaration matching now accounts for asset update timing to trigger redeploys reliably. * Improved validation to detect missing/invalid asset references before saving. * **Other** * Updated which configuration declaration types are blocked during user-provided validation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Tim Lee
|
9a24cb1d5d | Fix long certificate name overflow in delete certificate modal (#48948) (#49019) | ||
|
Jonathan PorterandSteven Palmesano
|
69a875d312 |
Enhance labels documentation in Fleet (#47753)
Expanded the section on labels in Fleet, detailing types, targeting, scope, and management. Added recommendations for naming conventions to avoid collisions. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #44049 --------- Co-authored-by: Steven Palmesano <3100993+spalmesano0@users.noreply.github.com> |
||
|
Andrew Mellor
|
4922289610 |
48917 Show a deleted state instead of a generic error for stale MDM command (#49012)
**Related issue:** Resolves #48917 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **Bug Fixes** * The MDM command details modal now shows **“This command has been deleted.”** instead of a generic error when a command result is removed after the host is wiped and re-enrolled. * The modal now uses additional stored activity context (like host display name and request type) to render more accurate, host-specific details for deleted commands. * **Tests** * Updated and added coverage to confirm the deleted-message UI and that the generic error text no longer appears. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Luke Heath
|
854c384247 | Update leadership table (#49049) | ||
|
fleet-releaseandallenhouchins
|
3480ac6e1b |
Update Fleet-maintained apps (#49101)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Refreshed maintained application versions and installer packages across Windows and macOS. * Updated release detection and patch-status checks for the latest builds. * Updated installer download links and integrity checksums to match new artifacts. * Includes updates for AWS CLI, BetterMouse, Brave, ChatGPT, Claude, CMake, Dropbox, Edge, Figma, Signal, Zed, and many additional applications. * Installation and removal behavior remains unchanged. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
Konstantin Sykulev
|
a6a24391d1 |
Android filter out empty enterprises (#49097)
**Related issue:** Resolves #49004 - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved Android managed-configuration resend processing by ignoring invalid empty enterprise IDs. * Prevented resend jobs from being queued when no valid enterprise ID is available. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Konstantin Sykulev
|
5727de3b3a |
Android config profiles resend on IdP changes (#49068)
**Related issue:** Resolves #49003 ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Android configuration profiles now detect and track Fleet secret/template variables during creation, including when profiles are created or updated in batches. * **Bug Fixes** * When Fleet variables related to SCIM user identity change, affected Android MDM profile resend/delivery state is reset so the updated profile is re-delivered. * Android profile behavior has been aligned across creation, listing, and delete/upsert flows to maintain consistent variable-aware associations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Noah Talerman
|
ed7508feb8 |
Remove starter-library/ (#48478)
- @noahtalerman: New Fleet instances now use the `fleetctl new` templates: https://github.com/fleetdm/fleet/pull/42768/changes - This starter library was only used for new Fleet instances and as of the changes above is no longer used <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Cleaned up the starter library configuration by removing two preconfigured team entries from the example setup. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rachael Shaw
|
ae3213eac2 |
Add step to API design process (#48782)
Update `api_endpoints.yml` if adding new API endpoints. |
||
|
Steven Palmesano
|
7dc802bcf9 |
Add Fleet Agent Installer to restoring fleetd guide (#48991)
Not sure if we want to link to an unofficial app, but this solution may be easier for some users. |
||
|
Sam Pfluger
|
863a0dca53 | Comment out incorrect contact sources (#49095) | ||
|
George Karr
|
55c1783900 |
dibble: download seed installer fixtures at runtime instead of embedding (#48823)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA — resolves high-severity code-scanning alerts in `tools/dibble` ## Problem The dibble seeder committed 14 installer fixtures under `tools/dibble/pkg/seed/data/installers/` and bundled them into the binary with `//go:embed`. The `.exe`/`.msi`/`.deb`/`.rpm` files tripped **8 high-severity "Binary-Artifacts" code-scanning alerts** on `main`. 11 of the 14 are byte-identical to fixtures already in `server/service/testdata/software-installers/`, but `go:embed` can't reference files outside the package (no `..`, no symlinks), so the copies couldn't simply point at the originals. ## Change Replace the embed with an on-demand fetch that runs **only when seeding software** (`SoftwareCustom`): - Fixtures are downloaded, **SHA-256 verified** against a pinned manifest, and cached under the user cache dir (`os.UserCacheDir()/dibble/installers`) so repeat runs stay offline. - Fixtures shared with Fleet's tests are pulled from `testdata` via `raw.githubusercontent.com` at a **pinned commit**; the 7-Zip and python-manager installers come from their **upstream URLs**. - No binaries remain committed in this module. Checksums for all sources were verified to match the previously-committed bytes exactly, and the download + verify + cache path was smoke-tested locally. ## Tradeoff `dibble software custom` now requires network access on first use (downloads are cached afterward). This only affects the software-seeding path; all other seeders are unchanged. # Checklist for submitter - [x] Input data is properly validated (downloaded fixtures are rejected unless their SHA-256 matches the pinned manifest), `SELECT *` is avoided, SQL injection is prevented, JS inline code is prevented, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops (HTTP client uses a 2-minute timeout; no retry loop). ## Testing - [x] QA'd all new/changed functionality manually (verified download, checksum verification, and cache reuse for testdata- and upstream-hosted fixtures) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Installer fixtures are now downloaded on demand and cached locally for faster repeat runs. * Expanded installer fixture coverage, including additional Windows-signed installers for improved platform support. * **Bug Fixes** * Added SHA-256 integrity verification for cached and newly downloaded installer fixtures. * Improved reliability and safety by re-downloading when cache contents don’t match and by writing downloads atomically to avoid partial files. * **Chores** * Updated indirect dependency versions related to OpenTelemetry and `golang.org/x/*`. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Steven Palmesano
|
853bb6abfe |
Add mdmclient log query to troubleshooting guide (#48959)
|
||
|
|
4a219a2c72 |
Update Fleet-maintained apps (#49055)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Updated maintained app entries so users get the latest releases for AltTab, Badgeify, BetterTouchTool, EM Client, Mendeley Reference Manager, Setapp, Signal, Tuple, Webex, WeChat, WhatsApp, and Worksheet Crafter. * Refreshed version checks and download details to match the newest available installers. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> Co-authored-by: Allen Houchins <allenhouchins@mac.com> |
||
|
Noah Talerman
|
4defd14352 |
Update product maturity assessment (#49042)
- macOS and iOS/iPadOS 🦆 complete and Android 🐥 viable by end of Q3 (aligns w/ https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit?disco=AAAB-vryWHM) - Linux is already 🦆 - macOS 🦢 loveable in Q4. Context: |
||
|
Sam Pfluger
|
8d3755fad1 |
2026 07 09 sam (#49075)
Closes https://github.com/fleetdm/confidential/issues/16219 |
||
|
Allen Houchins
|
6c18e89e68 |
Revise workshop rollout details and remove redundancy (#49076)
Updated the timeline for core workshops and electives, and removed the redundant note about certification opening in August. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
Allen Houchins
|
318c85f696 |
Add article: Make your cross-platform skills official with Fleet certification (#48945)
# Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Manually reviewed the article for style, formatting, and accuracy ## Details Adds a new article announcing Fleet's first certification program, launching in August: - Three platform credentials: Fleet-certified Apple admin, Fleet-certified Windows admin, and Fleet-certified Linux admin - Two GitOps credentials: Fleet GitOps level 1 and level 2 - The Fleet expert capstone exam, gated on holding all five core credentials - Self-paced electives rolling out through the year (Fleet on-prem/self-managed, Developing with the Fleet API) Formatted per Fleet's article structure (dek, key takeaways, CTA button, closing CTA) and content style guidelines. **Before merging:** - [x] Set `publishedOn` date in the article's meta tags (currently blank) - [x] Add a cover image if one is available for this launch - [x] Verify program details (credential names, August timing, elective list) are final |
||
|
Juan Fernandez
|
73b4bc8e6a |
Policy status automation activities bug fixes
Relates to #38670 Several fixes to the policy details page's "Automation runs" feed and the labels modal: - Empty state: when activity expiry is enabled, show the configured retention window ("Automation history is retained for N days"); otherwise show a generic "Automation history will appear here". - Details column focus: replace the deprecated `text-icon` button variant with `inverse`, and inset the keyboard-focus outline so it no longer hugs the cell text or bleed into adjacent rows. - Labels modal: render policy labels as react-router links (real anchors) instead of buttons, so they can be opened in a new tab via middle-click or cmd/ctrl-click. - Status filtering: make the installed_software and VPP (installed_app_store_app) error/success conditions null-safe complements of the displayed status, so every row shown under "All" appears under exactly one of the status filters. Derive the VPP outcome from the historical details.status (activities are terminal-only) rather than the live verification columns, which mutate over the install's lifetime. - Install output: surface the pre-install query output and post-install script output as separate sections in the activity details modal, and fall back to them in the grid preview when the install-script output is empty (e.g. a pre-install-stage failure). - Add a datastore test asserting the status filters partition the feed (all = error ⊎ success) for every activity type. |
||
|
|
a33481653d |
macos password sync feature branch (#47422)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45524 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Apple Platform SSO (PSSO) for macOS with device registration, sign-in, and public discovery (JWKS + Apple app-site association) protected by single-use nonces. * Added Apple account provisioning (Platform SSO password sync) configuration with masked client-secret handling and GitOps support. * Added a host-scoped PSSO device registration token variable for Apple MDM profile generation. * **Bug Fixes** * Fixed macOS packaging to correctly build, embed, and sign the Platform SSO extension. * Resetting device Apple MDM data now also clears stored PSSO enrollment records. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Magnus Jensen <magnus@fleetdm.com> |
||
|
|
6d2167193e |
Apple MDM: require server URL confirmation before turning off (#48595)
Adds a text input to the "Turn off MDM" confirmation modal that requires the admin to type the Fleet server URL before the Turn off button becomes enabled. Prevents accidental MDM deactivation on the wrong Fleet instance. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #42073 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved the Apple MDM disable flow by requiring the correct Fleet URL before confirming the action. * The disable confirmation modal now appears only when the needed configuration is available, reducing the chance of errors. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: CodeRabbit <noreply@coderabbit.ai> |
||
|
Lucas Manuel Rodriguez
|
21c024313a |
Upgrade nfpm package in fleetctl (#48961)
Resolves #48954. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] QA'd all new/changed functionality manually Tested a package generated with new `fleetctl` on Fedora 43, Ubuntu 25.04, and Omarchy. ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary of changes * **Bug Fixes** * Improved Linux RPM packaging consistency, including more reliable output filename normalization and correct platform metadata. * Ensured RPM metadata extraction stays aligned with the updated packaging flow. * **Tests** * Added coverage for RPM filename normalization edge cases. * Updated a CPE rule validation test expectation to match the new error-string format. * **Chores** * Upgraded packaging tooling and refreshed Go dependencies. * **Security** * Removed a previously ignored CVE entry from vulnerability scan ignore settings. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |