Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 18 Packages Projects Releases Wiki Activity
26,427 Commits 2 Branches 0 Tags
1f2ca668f85b29f8abc787e81d0c3b13053577d3
Commit Graph
26427 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Lucas Manuel Rodriguez 1f2ca668f8 Fix flaky test TestCheckExecRealBinary (#50057) 
Fixes flaky test found in nightly run:
https://github.com/fleetdm/fleet/actions/runs/30330273165.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
* Improved execution checks to tolerate transient busy-file errors
during retries.
* Strengthened validation for both healthy and corrupted binaries,
ensuring tests report the intended result.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-28 13:16:13 -03:00
RachelElysia 0585ab68d1 Website: Handle unexpected responses from Microsoft's compliance and Graph APIs (#50015) 
## Issue

#50013

## Description

The Microsoft compliance proxy controller
(`website/api/controllers/microsoft-proxy/receive-redirect-from-microsoft.js`)
called `JSON.parse` on response bodies from Microsoft's Partner
Compliance and Graph APIs without checking for empty bodies or
unexpected response shapes. When Microsoft returned an unexpected
response — for example, a 2xx status with an empty body, which can
happen on partial-setup tenant states or when API permissions on the
enterprise app haven't been fully consented — the controller threw a raw
`SyntaxError: Unexpected end of JSON input` that surfaced verbatim in
the Fleet UI as the `setup_error` string, giving admins a Node.js stack
trace instead of a useful message.

Changes:
- Added explicit empty-body checks before `JSON.parse` at both
API-response parse sites, with a friendly `setup_error` message pointing
at the likely causes (partial setup / missing API permissions).
- On parse failure, expanded the diagnostic log to include response
status code, body length, and a 200-char body snippet so we can diagnose
future occurrences from server logs instead of asking admins to
reproduce.
- Added defensive checks on `parsedPoliciesResponse.value` and
`parsedGroupResponse.value` before indexing — previously
`parsedPoliciesResponse.value[0].Id` would throw `TypeError` if
Microsoft returned a well-formed response missing the expected shape.

**Note for reviewers:** The new `sails.log.warn` calls interpolate the
runtime tenant ID (`informationAboutThisTenant.entraTenantId`) — same
pattern as the existing log at line 209 that logs `fleetInstanceUrl`.
Heroku logs will contain tenant IDs when these error paths fire, which
is intentional so infra can grep by tenant when triaging. If we'd rather
rely on request-correlation IDs and keep tenant IDs out of logs, happy
to make that a follow-up.

## Screenrecording


## Testing
- [ ] Sanity-checked locally by inducing an empty response body
- [ ] Verified no changes to the happy-path flow
- [ ] Verified existing setup_error strings that the Fleet UI checks for
(admin-did-not-consent, missing-conditional-access-group) are unchanged

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved Microsoft integration setup handling when API responses are
empty, invalid, or missing expected data.
* Added clearer setup error messages for missing policies or the “Fleet
conditional access” group.
* Enhanced diagnostics to help identify response-related setup failures.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-28 11:04:08 -05:00
Allen HouchinsKitzyCopilot Autofix powered by AI
 		95008e853d Freeze the macOS Yubikey Manager FMA (#50054) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** N/A

Pins the macOS Fleet-maintained app for Yubikey Manager at its current
output version, `1.2.5`, by setting `"frozen": true` on the Homebrew
input.

- `ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json` —
added `"frozen": true`

The flag is read by the ingester into the manifest
([`homebrew/ingester.go`](https://github.com/fleetdm/fleet/blob/main/ee/maintained-apps/ingesters/homebrew/ingester.go))
and then consumed in two places:

-
[`cmd/maintained-apps/main.go`](https://github.com/fleetdm/fleet/blob/main/cmd/maintained-apps/main.go)
skips overwriting `outputs/yubico-yubikey-manager/darwin.json` when the
output file already exists, so the published version, installer URL,
SHA256, and patch-policy query stop moving.
-
[`cmd/maintained-apps/validate/main.go`](https://github.com/fleetdm/fleet/blob/main/cmd/maintained-apps/validate/main.go)
skips the app entirely during validation.

`frozen` is tagged `json:"-"` on the manifest struct, so it does not
appear in the output JSON — that file is intentionally left untouched by
this PR.

The Windows FMA (`inputs/winget/yubico-yubikey-manager.json`) is
deliberately **not** frozen and continues to update.

## Note for reviewers

While preparing this change I found that the `yubico-yubikey-manager`
cask has been **removed from homebrew-cask**:

```
https://formulae.brew.sh/api/cask/yubico-yubikey-manager.json → 404
```

The full cask list now contains only `pallotron-yubiswitch`,
`yubico-authenticator`, and `yubihsm2-sdk`, and the token is not present
in `inputs/homebrew/custom-tap/` either. This matches upstream: Yubico
discontinued `yubikey-manager-qt` (the 1.2.5 installer this FMA pins) in
favor of Yubico Authenticator.

**Freezing does not resolve that 404.** The ingester fetches cask
metadata *before* the frozen flag is applied, so the scheduled "Update
Fleet-maintained apps" workflow is still expected to fail for this app
with:

```
panic: ingesting homebrew app: app not found in brew API
```

Fully resolving that would mean removing the macOS FMA, the way #50050
did for Nocturnal (input, output, `apps.json` entry, frontend icon +
mapping, website PNG). This PR is scoped to the freeze only, per the
request; the removal can be a follow-up if that is the direction we
want.

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] QA'd all new/changed functionality manually — confirmed the edited
input still parses as JSON, and traced the `frozen` flag through the
ingester into both the output-write skip and the validation skip. No
automated tests were added; this is a single data-file flag with no new
code paths.

---------

Co-authored-by: Kitzy <kitzy@kitzy.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-07-28 10:57:18 -05:00
kilo-code-bot[bot]kiloconnect[bot]Mike Thomas
 		210b716d20 Add guide: Speeding up your GitOps runs in Fleet (#46516) 
## Summary

- Adds a new guide article covering three strategies to reduce Fleet
GitOps run times: path-based `include` references, Fleet-maintained apps
(FMAs), and ETag-based conditional downloads for custom packages.
- Aimed at Fleet users managing large deployments who want to optimize
their CI/CD pipeline performance.

## Changes

- New file: `articles/speeding-up-your-gitops-runs-in-fleet.md`

---

Built for [Mike
McNeil](https://fleetdm.slack.com/archives/C04K44UAPB9/p1780119889099049?thread_ts=1779840298.690529&cid=C04K44UAPB9)
by [Kilo for Slack](https://kilo.ai/slack)

---------

Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
 2026-07-28 16:51:06 +01:00
Jonathan Katz b99e5564e9 GitOps schema generator and IDE integration (#49717) 
### Summary:
Generates a json schema for valid GitOps yaml files, to be used with
[yaml-language-server](https://github.com/redhat-developer/yaml-language-server)
for IDE integration.

This PR includes the actual generated file, so it can be used without
running the tool. All files are in `/tools/gitops-autto-complete`, so
nothing else gets affected.

#### What it adds:
- Complete json schema that defines valid GitOps yaml files and can be
integrated with
[yaml-language-server](https://github.com/redhat-developer/yaml-language-server).
- Auto-completion, error checking, type checking, descriptions.
- Defines all keys for osquery options/flags (based on
`server/fleet/agent_options_generated.go`).
- Additional validation: required keys, strings that must be enclosed in
quotation marks, path support.
- Additional data: descriptions from code comments, notices for fields
that don't reset if null or empty.

#### Limitations:
- Some structs and data are duplicated into the tool and will inevitebly
mismatch over time, because the structs used for gitops are not
sufficient for the schema generation:
- Some fields use an interface/any type that so can't be used for the
schema generation.
- Some important details are not encoded in the type or struct tags for
gitops fields at all.
- Some details (like required fields) are encoded in the Validate()
interface, but the IDE integration cannot run Go code.
- Doesn't work with all yaml file types used for gitops (like a yaml
file that specifies multiple software packages), only the default/fleet
level files. This will require having a subsection of the schema for
each type of file, and some way to detect what it actually is (maybe
specifying the schema in the file itself).
- Requires manual setup to integrate with IDE, it's not an easy to use
extension currently.

#### Dependencies:
- `invopop/jsonschema` reflects Fleet's GitOps structs into the schema.
- `santhosh-tekuri/jsonschema/v6` validates the test fixtures against
that schema.
- `ghodss/yaml` decodes the fixture YAML the way fleetctl does.
 


https://github.com/user-attachments/assets/b6ffacd0-e602-41a2-b46a-7d10300c6ea5



## Testing

- [x] QA'd all new/changed functionality manually
- I have been using and working on this for the past week so it's in a
pretty good state, but some descriptions or keys are probably still
missing.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added GitOps YAML auto-completion powered by a comprehensive JSON
Schema.
* Added validation for GitOps configuration structure, supported fields,
data types, required combinations, and unknown keys.
* Added support for external file references using `path` and `paths` in
supported sections.
* Added clearer guidance for deprecated fields and special field
behaviors.
* **Bug Fixes**
* Improved detection of incorrectly typed values and invalid
configuration shapes.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-28 11:50:50 -04:00
Rajendra Kadamandmelpike 6e4b913a00 Add scripts and configuration profiles steps to downgrade guide (#50038) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** NA

## Description

Improves the [downgrade
guide](https://fleetdm.com/guides/downgrade-fleet) instead of changing
product behavior, per product design's direction.

The guide told users to move fleet-level **reports** and **policies** to
the global level before downgrading, but omitted **scripts** and
**configuration profiles**. Both are scoped per fleet and become
inaccessible once fleets are deleted during the downgrade, so users lose
them with no warning.

Adds two sections — "Move all fleet-level scripts to Unassigned" and
"Move all fleet-level configuration profiles to Unassigned" — placed
before the fleet-deletion step so users move them while the fleets still
exist. Unlike reports/policies (which move to the global level), scripts
and configuration profiles have no global bucket — they live under a
fleet or **Unassigned** — so the steps direct users to re-add them under
**Unassigned**, which remains available on Fleet Free.

> **Draft — pending wording pass.** The steps use "Unassigned" to match
the label in the Controls dropdown. Flagging for @Mel for a wording
review before this goes out.

## Testing

- [ ] N/A — documentation only.

# Checklist for submitter

- [x] Documentation change only; no code, tests, or migrations.

---------

Co-authored-by: melpike <79950145+melpike@users.noreply.github.com>
 2026-07-28 21:05:26 +05:30
Christopher Kemp bd0883cf36 Update README.md (#49981) 
corrected spelling error

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
 2026-07-28 16:31:16 +01:00
kitzyandCopilot Autofix powered by AI 2ddb07a1f5 Wire content-style into the fleet-guide-formatting skill and require endmatter (#49698) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** N/A

# Checklist for submitter

- [x] N/A: this is a `.claude/skills` change (Claude Code tooling), not
a user-visible product change. No `changes/` entry, tests, migrations,
config settings, or fleetd/orbit changes apply.

## Summary

Updates the `fleet-guide-formatting` skill based on review feedback from
the first guide written with it (#49681).

Two problems came up in that review:

**The skill didn't run `content-style`.** It cross-referenced
`content-style` as the place voice and grammar rules live, but phrased
it as "use that skill instead," which read as someone else's job. The
result was a structurally correct guide that still needed a separate
style pass. `content-style` is now a required companion, called out in
the frontmatter description (so it's visible at trigger time, not just
after loading), in a dedicated section near the top, in both the writing
and auditing workflows, and as an audit checklist item.

**Endmatter wasn't being generated.** The skeleton listed endmatter as
"required" but never said the skill is what writes it, so drafts came
back without the `<meta>` tags and the author had to notice and add
them. There's now an "Endmatter is not optional" section with per-field
guidance, and a matching comment above the block in
`references/template.md`. The existing don't-fabricate-the-author rule
is preserved: `authorFullName`, `authorGitHubUsername`, and
`publishedOn` stay as placeholders to be filled in rather than guessed.

## Also in this PR

The skill files themselves didn't follow `content-style`, which is a bad
look for a skill whose main change is "always run `content-style`." Ran
all three files through it:

- Removed ~40 em dashes (the connector-after-a-bold-label pattern),
replaced with periods or colons.
- Renamed two headings off `-ing` verbs per the headings rule: "Writing
a new guide" to "Write a new guide," "Auditing or retrofitting an
existing guide" to "Audit or retrofit an existing guide."
- Fixed quote punctuation to sit outside the quotes per the handbook.
This accounts for most of the `canonical-examples.md` diff.
- Cut filler ("actually," "very"), added missing Oxford commas, and
replaced one use of "agent" (on the avoid list) with `fleetd`.

Also fixed a content bug found while editing: the "what guides never
have" note about Conclusion/Summary sections had drifted out of "The
skeleton" section, where it belongs.

## Testing

Not applicable, no automated tests cover skill markdown. Verified by
grep that the files contain no em dashes outside backticked search
targets, no filler or hype words from the avoid lists, no banned
terminology, and that all headings are sentence case.

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-07-28 11:22:27 -04:00
kitzyandAllen Houchins 3ce3e238ed Add 6 Windows Fleet-maintained apps (#50016) 
**Related issue:** N/A — Windows Fleet-maintained app (FMA) coverage for
apps found deployed in a customer's ManageEngine SDP environment but
missing from Fleet.

## What this does

Adds **6** Windows Fleet-maintained apps — the subset of a larger batch
that passes the FMA validator cleanly. Each has a winget-sourced input,
a generated output manifest, and a catalog icon. Detection identity was
verified against each app's real registry DisplayName; apps whose
DisplayName carries a version suffix use fuzzy name matching, the rest
match exactly.

**MSI (clean, auto upgrade-code uninstall):**
- **Git Extensions** — versioned ARP name (`Git Extensions 7.2.0.92`) →
fuzzy match
- **TightVNC**, **Yarn**, **SonicWall NetExtender** (WiX), **Zoom
Outlook Plugin** — clean ARP names → exact match

**EXE — NSIS (custom `/S` install + registry-lookup uninstall):**
- **Spyder** — versioned ARP name (`Spyder 6`) → fuzzy match

## Notes

- **Detection verification.** Every app's `unique_identifier` (registry
DisplayName / osquery `programs.name`) and publisher were verified per
the `new-fma` skill against winget `AppsAndFeaturesEntries`, MSI
Property tables (`msiinfo`), and vendor installer scripts — not assumed.
Git Extensions' MSI `ProductName` is `Git Extensions 7.2.0.92` and
Spyder's ARP entry is `Spyder 6`, so both need `fuzzy_match_name`; the
four exact-match apps were confirmed clean (e.g. TightVNC registers as
`TightVNC`, not a versioned string).
- **Validated on a real Windows host.** All six pass the FMA CI
validator (install → detect → uninstall) on the SYSTEM-context Windows
runner.
- **Icons.** Git Extensions, SonicWall NetExtender, TightVNC, Yarn, and
Zoom Outlook Plugin ship new catalog icons + website assets; Spyder
reuses the existing `Spyder` icon.

## Testing

- [x] FMA CI validator (install → detect → uninstall) on the
SYSTEM-context Windows runner.
- Generated outputs verified locally: all 6 produce valid manifests; MSI
apps carry the correct UpgradeCode-based uninstall; exists/patched
queries reviewed for name + publisher correctness; `go test
./ee/maintained-apps/...` passes.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added maintained Windows catalog entries for Git Extensions, SonicWall
NetExtender, Spyder, TightVNC, Yarn, and Zoom Outlook Plugin, including
silent install, version upgrade detection, and maintenance-ready
uninstall flows.
* Added new software icons for these apps and expanded icon matching so
they display correctly in the catalog.
* **Bug Fixes**
* Improved Spyder Windows uninstall targeting and command/argument
handling for more reliable removals.
* **Documentation**
  * Refreshed Spyder supported version details to 6.1.5.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Allen Houchins <allenhouchins@mac.com>
 2026-07-28 10:14:53 -05:00
Noah Talerman cb6f751ff2 "Unpacking the why" for each product group (#50052) 
- Led by each product group's Product Designer
 2026-07-28 08:04:18 -07:00
Allen Houchins aea7c4068f Remove Nocturnal as a macOS FMA (#50050) 
**Related issue:** N/A — fixes the failing scheduled "Update
Fleet-maintained apps" workflow

The `nocturnal` cask was removed from homebrew-cask on 2026-07-28
([Homebrew/homebrew-cask@517db75](https://github.com/Homebrew/homebrew-cask/commit/517db75b78))
after being deprecated on 2024-07-27 and disabled on 2025-07-27, both
`because: :unmaintained` (upstream repo's last push was in 2018). The
brew API now returns 404 for it, so the maintained-apps ingester panics:

```
panic: ingesting homebrew app: app not found in brew API
```

This removes Nocturnal as a Fleet-maintained app, following the same
pattern as #46541 (Messenger) and #47420 (Dell Display Manager):

- `ee/maintained-apps/inputs/homebrew/nocturnal.json` — Homebrew input
- `ee/maintained-apps/outputs/nocturnal/darwin.json` — macOS output data
- `ee/maintained-apps/outputs/apps.json` — Nocturnal entry
- `frontend/pages/SoftwarePage/components/icons/Nocturnal.tsx` and its
import/mapping in `index.ts`
- `website/assets/images/app-icon-nocturnal-60x60@2x.png`

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] QA'd all new/changed functionality manually (verified `apps.json`
still parses, no remaining `nocturnal` references, ESLint passes on the
icons index)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Removed Apps**
  - Removed Nocturnal from the maintained application catalog.
  - Removed its installation and uninstallation support.
  - Removed the Nocturnal icon from software listings.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-28 09:53:17 -05:00
Andrew Mellor f1228c873d 47713 auld software update assets migration (#50036) 
**Related issue:** Resolves #47713

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually

## Database migrations

- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added support for tracking available Apple OS update assets and
supported devices.
* Added per-host Apple OS update targets, deadlines, and resolution
status.
* Added configuration options for host target OS versions and deadlines.

* **Database**
* Updated the MySQL schema and migration seed data to include the new
tables and fleet variables, and to reflect updated migration/status
metadata.

* **Tests**
* Added migration tests to validate table creation, constraints,
defaults, and upsert behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-28 15:42:04 +01:00
dependabot[bot]andLucas Manuel Rodriguez 3d4cf0dfee Bump google.golang.org/grpc from 1.79.3 to 1.82.1 (#49957) 
- [X] QA'd all new/changed functionality manually

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from
1.79.3 to 1.82.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's
releases</a>.</em></p>
<blockquote>
<h2>Release 1.82.1</h2>
<h1>Security</h1>
<ul>
<li>server: Stop reading from the connection when flooded by HTTP/2
frames. The default value for this limit is 100 frames, excluding DATA
and HEADERS, and may be changed by setting environment variable
<code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li>
<li>xds/rbac: Support <code>Metadata</code> and
<code>RequestedServerName</code> permissions matcher fields. If present
in a DENY rule, previously these would be ignored and fail-open.</li>
<li>xds/rbac: Fix panic when parsing unsupported fields in
<code>NotRule</code>/<code>NotId</code> permissions.</li>
<li>xds/rbac: Support the deprecated <code>source_ip</code> principal
identifier by treating it as equivalent to
<code>direct_remote_ip</code>.</li>
</ul>
<h2>Release 1.82.0</h2>
<h1>Behavior Changes</h1>
<ul>
<li>server: Remove support for
<code>GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING</code>
environment varibale. Strict incoming RPC path validation (which has
been the default since <code>v1.79.3</code>) can no longer be disabled.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9112">#9112</a>)</li>
<li>transport: Add environment variable to change the default max header
list size from <code>16MB</code> to <code>8KB</code>. This may be
enabled by setting
<code>GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true</code>.
This will be enabled by default in a subsequent release. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9019">#9019</a>)</li>
<li>balancer: Load Balancing policy registry is now case-sensitive. Set
<code>GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false</code>
(and file an issue) to revert to case-insensitive behavior. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9017">#9017</a>)</li>
</ul>
<h1>New Features</h1>
<ul>
<li>experimental/stats: Expose a new API,
<code>NewContextWithLabelCallback</code>, to register a callback that is
invoked when telemetry labels are added. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8877">#8877</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/seth-epps"><code>@​seth-epps</code></a></li>
</ul>
</li>
<li>client: Return a portion of the response body in the error message,
when the client receives an unexpected non-gRPC HTTP response, to make
debugging easier. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/chengxilo"><code>@​chengxilo</code></a></li>
</ul>
</li>
<li>server: Add environment variable
<code>GRPC_GO_SERVER_GOROUTINE_LABELS</code> that controls setting
<code>runtime/pprof.Labels</code> on goroutines spawned by the server.
Set <code>GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true</code> to add
the <code>grpc.method</code> label on goroutines spawned to handle
incoming requests. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/dfinkel"><code>@​dfinkel</code></a></li>
</ul>
</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>xds/server: Fix a memory leak of HTTP filter instances occurring
when route configurations are updated in-place during a Route Discovery
Service (RDS) update. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9138">#9138</a>)</li>
<li>grpc: In the deprecated <code>gzip</code> Compressor (used via the
deprecated <code>WithCompressor</code> dial option), enforce the
<code>MaxRecvMsgSize</code> limit on the decompressed message buffer,
preventing excessive memory allocation from highly compressed payloads.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9114">#9114</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/evilgensec"><code>@​evilgensec</code></a></li>
</ul>
</li>
<li>stats/opentelemetry: Record retry attempts,
<code>grpc.previous-rpc-attempts</code>, at the call level and not the
attempt level. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8923">#8923</a>)</li>
<li>encoding: Ensure <code>Close()</code> is always called on readers
returned from <code>Compressor.Decompress</code> if possible. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9135">#9135</a>)</li>
<li>channelz: Fix the <code>LastMessageSentTimestamp</code> and
<code>LastMessageReceivedTimestamp</code> fields in
<code>SocketMetrics</code> to ensure they contain correct timestamp
values. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9109">#9109</a>)</li>
</ul>
<h2>Release 1.81.1</h2>
<h1>Security</h1>
<ul>
<li>xds/rbac: Fix a potential authorization bypass caused by incorrectly
falling through URI/DNS SANs to Subject Distinguished Name (DN) when
matching the authenticated principal name. With this fix, only the first
non-empty identity source will be used, as per <a
href="https://github.com/grpc/proposal/blob/master/A41-xds-rbac.md">gRFC
A41</a>. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9111">#9111</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/al4an444"><code>@​al4an444</code></a></li>
</ul>
</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>otel: Segregate client and server RPC information used for metrics
and traces, to avoid one overwriting the other. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9081">#9081</a>)</li>
</ul>
<h2>Release 1.81.0</h2>
<h1>Behavior Changes</h1>
<ul>
<li>balancer/rls: Switch gauge metrics to asynchronous emission (once
per collection cycle) to reduce telemetry noise and align with other
gRPC language implementations. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8808">#8808</a>)</li>
</ul>
<h1>Dependencies</h1>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/grpc/grpc-go/commit/ebd8f06a09426fbece97157c95c3917abff28f4e"><code>ebd8f06</code></a>
Change version to 1.82.1 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9238">#9238</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935"><code>4ea465d</code></a>
Cherry-pick commits (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9236">#9236</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/9494a2cf32a0ec9d35420af401445ef3c9f66f05"><code>9494a2c</code></a>
Change version to 1.82.1-dev (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9171">#9171</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/bd239854f0ab7f1ee63457d47f7c1d2675e1f736"><code>bd23985</code></a>
Change version to 1.82.0 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9170">#9170</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/0f3086db7a755b6af83a90809471dd7f645b345a"><code>0f3086d</code></a>
Fix minor issues not covered by PR <a
href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a>
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9147">#9147</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/fef07fbb2b94b668e8daca1f6b70433dcd36c1c8"><code>fef07fb</code></a>
internal: Split v3procservicepb import into pb and grpc for extproc (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9163">#9163</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/91dd64f4b83cb5134e279d1126ebb1ccf47d4d31"><code>91dd64f</code></a>
transport: surface subsequent data when receiving non-gRPC header (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/adc97de9521a9f377dab5e911039842dc4de23e5"><code>adc97de</code></a>
test/kokoro: add config for regional-td test (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9158">#9158</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/57c9ff14e05b535ee6995ba49bc882b287a175de"><code>57c9ff1</code></a>
xds: ensure full-string matching for RBAC Filter rules (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9148">#9148</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/b58f32d9ff07c612d64e677bd826bcbec88af9bd"><code>b58f32d</code></a>
server: Set a pprof label on new stream goroutines (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/grpc/grpc-go/compare/v1.79.3...v1.82.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.79.3&new-version=1.82.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
 2026-07-28 11:40:25 -03:00
Rajendra Kadam f2662ccaf5 Default setup experience account type to admin when serving team config (#50034) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #49346

## Description

A fleet created before the managed local account keys existed (e.g. in
4.84.0) and never edited since has no `end_user_local_account_type` or
`enable_managed_local_account` in its stored config. `GET /teams/:id`
served these as `null`, so the *Setup experience → Users* card showed no
account-type selection and a wrongly checked, greyed-out "Create hidden
admin" box.

- **`server/fleet/teams.go`** — `Team.MarshalJSON` now falls back to
`"admin"` / `false` for these keys when they're unset, mirroring the
existing `AppConfig.MarshalJSON` fallback that already covers the global
("No team") config. This is the one serve path that was missing the
default; the save path (`TeamConfig.Value()`) already applied it, which
is why only untouched pre-4.84.0 fleets were affected.

Serve-time fallback only — no stored data is modified and the
account-provisioning logic is untouched.

> **Note for reviewers:** `Team.MarshalJSON` is also the serialization
used by `fleetctl get teams` / GitOps, which had the same `null` bug.
With this change those now emit `end_user_local_account_type: admin` and
`enable_create_local_admin_account: false` for teams that previously
showed `null` — matching what the global config already emits. The
get→apply roundtrip stays idempotent because the save path already
writes these defaults. Team goldens updated accordingly.

## Testing

- **Automated:** `TestTeamMarshalJSONMacOSSetupDefaults`
(`server/fleet`) — a team with the keys unset marshals to `"admin"` /
`false`, and explicitly set values still round-trip. Updated the
`fleetctl` team goldens (`TestGetTeams`, `TestApplyMacosSetup`,
`TestApplyMacosSetupDeprecatedKeys`) to reflect the defaulted output.
- **Manual:** simulated a 4.84.0 fleet by removing both keys from a
team's stored `config` JSON. On `main` the Users card showed no selected
radio and a checked, greyed hidden-admin box; on this branch the same
fleet shows **Admin** selected and the box unchecked, matching what
global "No team" already renders.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements).

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* macOS device setup now applies correct defaults when managed local
account settings are missing from existing team configurations.
* The end-user local account type now defaults to **admin** and managed
local account creation defaults to **disabled** (false) unless
explicitly configured.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-28 20:04:41 +05:30
Andrew Mellor 8e0c038eff 47701 abm errors UI (#49896) 
**Related issue:** Resolves #47701

# Checklist for submitter

## Testing

- [x] Added/updated automated tests

- [ ] QA'd all new/changed functionality manually: Not able to test
token_rejected, terms and conditions or apple server error.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added an Apple Business Manager invalid-token warning banner that
lists the affected organization names.
* Introduced dedicated invalid-token state support so the banner can
appear with the correct priority.
* **Bug Fixes**
* Ensured invalid-token state is cleared when no tokens are returned and
consistently set on token fetch success/error.
* Improved Apple/DEP status messaging and made profile-assignment
rendering more resilient for non-DEP and partial-error responses.
* **Style**
* Adjusted banner spacing and added styling for DEP error presentation.
* **Tests**
* Added/expanded tests for invalid-token messaging, ABM expiry updates,
and MDM status/error scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-28 15:01:48 +01:00
fleet-releaseandallenhouchins e3c9ed84c5 Update Fleet-maintained apps (#50033) 
Automated ingestion of latest Fleet-maintained app data.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
  * Updated the Windows Discord package to version 1.0.9250.
  * Updated the installer download reference and verification checksum.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
 2026-07-28 08:58:53 -05:00
Lucas Manuel Rodriguez c482646efe Fix check-doc-gen failing on main: use npm ci and drop extraneous lockfile entries (#50014) 
**Related issue:** N/A — fixes the `check-doc-gen` job failing on `main`

The "Check automated documentation is up-to-date" workflow has been
failing on every push to `main` (and every PR that triggers it) since
~18:30 UTC 2026-07-27. The failing step, "Verify osquery table JSON
schema is up-to-date," runs `cd website && npm install && sails run
generate-merged-schema` and fails if `git diff` is non-empty afterward.

The diff it fails on is `website/package-lock.json` itself:
`sails-hook-grunt`'s published tarball ships a `node_modules` folder
with packages that aren't part of its dependency graph (dev leftovers
like `mocha@3.0.2` and `growl@1.9.2`). Newer npm on the CI runners
records those on-disk packages in the lockfile as `"extraneous": true`
entries, so any committed lockfile that omits them (e.g. after #49852
regenerated it) no longer matches what `npm install` produces — and any
committed lockfile that *includes* them gets flagged by
`dependency-review` for the critical `growl@1.9.2` advisory
(GHSA-qh2h-chj9-jffq), even though growl is never actually installable
from the dependency graph.

This PR fixes the root cause instead of chasing npm's output:

- **`check-doc-gen` now uses `npm ci` instead of `npm install`** — `npm
ci` never rewrites `package-lock.json`, so the step's `git diff` check
only catches what it's meant to catch (schema drift), and future runner
npm upgrades can't reintroduce lockfile churn.
- **`website/package-lock.json` regenerated with `npm install
--package-lock-only`** — drops the 107 `extraneous` entries (including
`growl@1.9.2`) that were committed to pacify the old `npm install`-based
check. No dependency versions change; `npm ci --dry-run` validates the
lockfile is in sync.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

## Testing

- [x] QA'd all new/changed functionality manually — verified locally
that `npm ci --dry-run` accepts the updated lockfile and that
`growl`/`extraneous` entries are gone. Since this PR now modifies the
workflow file itself, the `pull_request` path filter triggers
`check-doc-gen` on this PR, verifying the `npm ci` path end-to-end in
CI.

🤖 Generated with [Claude Code](https://claude.com/claude-code)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Improved automated schema validation by using deterministic dependency
installation to reduce unnecessary lockfile churn.
* Refreshed the generated-schema failure message with the correct
regeneration steps to follow when updates are detected.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-28 10:41:07 -03:00
Rajendra KadamandMagnus Jensen 0504e5949e Add host_id and host_serial to Apple mdm_enrolled activity (#49969) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #49777

## Description

Adds `host_id` and `host_serial` to the Apple `mdm_enrolled` activity so
IT admins can build automations on top of it, and surfaces the activity
on the individual host's activity timeline.

- **`server/fleet/activities.go`** — added `HostID` to
`ActivityTypeMDMEnrolled` and a `HostIDs()` method (mirrors the existing
`ActivityTypeMDMUnenrolled` pattern), so the activity is linked to the
host and appears on its timeline.
- **`server/mdm/lifecycle/lifecycle.go`** — populate `host_id` for
macOS/iOS/iPadOS enrollments. Account-driven user (BYOD) enrollments
have no hardware serial, so they report the enrollment ID as
`host_serial` too, keeping `host_serial` populated for automations
regardless of enrollment type.
- **Frontend** — new `MdmEnrolledActivityItem` component, registered in
the host past-activity component map (and the `IHostPastActivityType`
union), renders the now-host-linked `mdm_enrolled` activity on the host
details **Activity** card. There's no Figma, so the copy mirrors the
sibling `mdm_unenrolled` item (e.g. "Mobile device management (MDM) was
turned on for this host").

`host_id` uses `omitempty`, so Windows (`microsoft_mdm.go`) enrollments
keep their existing activity payload unchanged — Windows is
intentionally out of scope, handled in #47874, which also owns the
audit-log documentation update for the shared field.

> **For reviewer:** the ADUE `host_serial = enrollment_id` behavior
comes from the issue's test plan. It means `host_serial` and
`enrollment_id` carry the same value for BYOD. Flagging in case Product
would rather leave `host_serial` empty for ADUE and have automations
read `enrollment_id`.

## Testing

- **Automated:** `TestMDMEnrolledActivityHostIDAndSerial`
(`server/mdm/lifecycle`) covers device enrollment (`host_serial` =
hardware serial) and ADUE (`host_serial` = enrollment ID), both
asserting `host_id`/`HostIDs()`. Also verified `server/datastore/mysql`
`TestMDMEnrollment`, `server/activity/internal/mysql`
`TestListActivities`, and `server/service` `TestMDMTokenUpdate*` pass.
- **Live (simulated) manual macOS enrollment** via `osquery-perf`: the
`mdm_enrolled` activity recorded `host_id` + `host_serial`, and an
`activity_host_past` row linked it to the host (confirmed it shows on
the host timeline).
- **Frontend:** `MdmEnrolledActivityItem.tests.tsx` covers the rendered
copy for macOS/iOS/Android and the actor/no-actor variants; also
visually confirmed the activity renders on a host's Activity card in the
running app. `yarn jest`, `eslint`, and `tsc` pass.
- Updated the MDM integration tests (`integration_mdm_test.go`,
`integration_mdm_dep_test.go`, `integration_vpp_install_test.go`) whose
activity-detail and host-feed assertions changed now that `mdm_enrolled`
carries `host_id` and appears on the host timeline (feed assertions now
filter by activity type).
- **Pending on-device QA (next week):** DEP/ADE macOS and account-driven
user enrollment (iOS/iPadOS) on real hardware, per the issue's test
plan.
- Regression: Windows `mdm_enrolled` payload is unchanged (`host_id` is
omitted when zero); both platforms' `mdm_unenrolled` are unaffected.

# Screenshot for the frontend change

<img width="706" height="382" alt="Screenshot 2026-07-28 at 11 16 57 AM"
src="https://github.com/user-attachments/assets/8f57d129-f819-4399-8754-18b397a49db8"
/>

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually <!-- manual macOS
verified via simulator; DEP + real-device ADUE pending next week -->


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **New Features**
* Added support for rendering “MDM enrolled” in the host activity feed
with platform- and actor-aware messaging.

* **Bug Fixes**
* Updated Apple “MDM enrolled” activity details to include the correct
host identifier and serial/enrollment identifiers.
* Ensured host-scoped activity behavior applies only when the host is
known (host id present).

* **Tests**
* Expanded regression and integration coverage for “MDM enrolled”
activity details and feed contents, including VPP-related assertion
stability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
 2026-07-28 14:27:42 +05:30
Steven PalmesanoCopilot Autofix powered by AILucas Manuel Rodriguez
 		bf3e1bab99 Add Apple marketing names to backend, frontend, and an osquery table (#46482) 
**Related issue:** Resolves
https://github.com/fleetdm/fleet/issues/46818 and
https://github.com/fleetdm/fleet/issues/48524.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

## fleetd/orbit/Fleet Desktop

- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Host lists and Host details now show human‑readable Apple hardware
marketing names (macOS, iOS, iPadOS) where available (e.g., "MacBook Pro
(16‑inch, 2021)"), replacing raw model identifiers.
* Hardware model displays fall back to the original model identifier for
non‑Apple or unmapped devices.

* **Bug Fixes / CSV**
* Exported host CSVs now align with the UI by using the marketing name
for Apple devices when available.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
 2026-07-27 22:26:30 -03:00
fleet-releaseandallenhouchins 5db4146b4f Update Fleet-maintained apps (#50032) 
Automated ingestion of latest Fleet-maintained app data.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Updates**
* Refreshed maintained application packages to their latest releases
across macOS and Windows.
* Updated ActiveDock, AWS CLI, BetterZip, Cursor, Docker Desktop,
DuckDuckGo, EagleFiler, Figma, Firefox, Garmin Express, Hive, iMazing,
Kiro CLI, Loom, LuLu, Microsoft Edge, Nessus Agent, Notepad, Ollama,
PyCharm, Reqable, Spokenly, SQL Server Management Studio, Telegram, and
Zed.
* Updated download links and verification checksums to match the new
installers.
* Improved uninstall or installation behavior for select applications,
including Figma, iMazing, and Ollama.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
 2026-07-27 20:23:54 -05:00
Eric 53b92f9356 Website: Update "Talk to us" form and contact page (#50023) 
Changes:
- Updated the quote shown on the contact page (and disabled the unused
personalization on the page)
- Removed the "What will you be using Fleet for" question on the "Talk
to us" form on the contact page

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Improvements**
* Simplified the “Talk to us” form by removing the “What will you be
using Fleet for?” question.
* Added an organization employee-count field with required numeric
validation.
* Streamlined form prefilling and submission details for returning
users.
* Updated the testimonial section to display a consistent customer story
and logo.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-27 19:11:21 -05:00
Lewis BarajasandSam Pfluger b64fdaade0 Add Lewis Barajas to go-to-market-operations.md (#50018) 
Adding my name and GitHub handle to the Solutions Specialist list in the
Go-To-Market operations page.

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))

---------

Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com>
 2026-07-27 17:41:02 -05:00
LeAnn 84896a5687 Add tooltip explaining missing Refetch button for Android hosts (#50017) 
<img width="632" height="196" alt="Screenshot 2026-07-27 at 3 09 16 PM"
src="https://github.com/user-attachments/assets/7bfc1440-48a4-4baf-8747-cc5e848a3a53"
/>

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #50001

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added an explanatory tooltip to the “Last fetched” field for Android
hosts.
* The tooltip clarifies that Android hosts sync automatically and
therefore do not have a “Refetch” button.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-27 15:39:22 -07:00
Noah Talerman 2726da1d62 Why macOS managed admin accounts are only created during setup (#50008) 2026-07-27 15:05:01 -07:00
Noah Talerman 0632216e08 Document monthly premium usage stats update process (#50009) 
Added section on updating premium usage stats and future Grafana
dashboard.
 2026-07-27 14:36:12 -07:00
Lucas Manuel Rodriguez 31286783eb Add exclusions for wix docker image (#49996) 
Run: https://github.com/fleetdm/fleet/actions/runs/30289212899.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Security**
  * Added vulnerability assessment metadata for CVE-2026-12912.
* Clarified that the affected code is not executed by fleetctl when
using the wix ecosystem.


<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-27 17:58:35 -03:00
Lucas Manuel Rodriguez dbb151b598 Add exclusions for released fleetctl docker image (#49994) 
Run: https://github.com/fleetdm/fleet/actions/runs/30288702449

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Security**
  * Added a vulnerability assessment for CVE-2026-57433.
* Documented that the affected products are not impacted because the
vulnerable code is not used in the relevant execution path.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-27 17:58:10 -03:00
Lucas Manuel Rodriguez 4f87e1c8ad Add VEX exclusions for fleetctl docker image (#49992) 
Run: https://github.com/fleetdm/fleet/actions/runs/30288436739.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Security**
* Added vulnerability status records for four advisories affecting
fleetctl and related components.
* Documented fleetctl as **not affected** because the vulnerable code
paths are not used or included.
* Added rationale covering WebP-only image decoding, unavailable
macOS-only TIFF functionality, absence of gRPC server and xDS RBAC
usage, and inapplicable Jackson parser conditions.
* Included standardized advisory metadata and version information for
improved security transparency.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-27 17:57:42 -03:00
George Karrandtest 7d2bab7a2e Adding changes for Fleet v4.89.2 (#49702) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
  * Updated the Fleet chart release metadata to version 7.0.14.
  * Updated the packaged application version to 4.89.2.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: test <test@test.com>
 2026-07-27 15:15:04 -05:00
RachelElysia 29f20aca31 Fleet UI: Fix empty button boxes in batch run script modal (#49997) 2026-07-27 13:07:01 -07:00
fleet-releaseandallenhouchins bdd04ba838 Update Fleet-maintained apps (#49989) 
Automated ingestion of latest Fleet-maintained app data.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added support for the latest releases of Air Explorer, Appium
Inspector, BetterZip, GeoGebra Classic, Google Drive, Grammarly,
Melodics, NordLayer, Opencode, Screen Studio, VoiceInk, WhatsApp,
RealVNC Server, Firefox Nightly, and Zed.
* **Bug Fixes**
* Refreshed download links and integrity checks for updated application
packages.
* Improved uninstall cleanup for Elgato Control Center, Kiro, Marked,
Mellel, PureVPN, Reqable, and Rize.
  * Improved Zed removal by closing the app before deleting its files.
* Updated SourceTree package metadata to the latest available installer.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
 2026-07-27 13:47:19 -05:00
Eric 766408d93b Website: update package.json overrides, update package-lock (#49852) 
Changes:
- Added an override for `body-parser@1.20.6` to the websites
package.json
- Updated thhe website's package-lock.json to include updated versions
of `body-parser` and `brace-expansion`
- Removed extraneous sails-hook-grunt dependencies from the website's
package-lock by running `npm update sails-hook-grunt`

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated a package version override to improve dependency consistency
and reliability.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-27 13:41:22 -05:00
Magnus Jensen 4c36caa453 pass validation for fleets gitops files for DDM assets (#49991) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #49979 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. (Unreleased bug)

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [x] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Prevented Fleet Free from attempting to apply premium-only Apple DDM
assets.
* Improved macOS DDM asset reconciliation so explicitly empty settings
can clear previously configured assets.
* Ensured GitOps and team configurations consistently recognize and
validate macOS asset settings.
* Restricted DDM asset processing to Premium deployments with configured
and enabled MDM.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-27 20:23:54 +02:00
Victor Lyuboslavsky 19efda2d1b Windows SCEP profiles now fail with non-printable chars (#49887) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #47492 

Windows cert profile fails if challenge uses non-printable characters.
<img width="987" height="329" alt="image"
src="https://github.com/user-attachments/assets/04dc7c78-8e3e-41c8-823e-cb4a961a91eb"
/>


# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **Bug Fixes**
* Windows SCEP profiles now fail with a clear error when the certificate
authority challenge includes characters not supported by Windows ASN.1
PrintableString.
* Prevents misleading “Verified” status when no certificate is
installed.
  * Preserves valid challenge values, including leading/trailing spaces.
* Improves Windows error tooltips by showing raw certificate-install
error details.

* **Tests**
* Added coverage for invalid/valid Windows SCEP challenge scenarios and
the updated error tooltip behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-27 12:49:14 -05:00
Rachael Shaw 9e680854f4 Guide: Clarify which policy automations are premium & fleet-level (#49993) 
Also clarified language about continuous retries, and moved section
about retrying on policy automation failure to a spot that made more
sense.

Re:
[discussion](https://macadmins.slack.com/archives/C0214NELAE7/p1784951700300179)
in Mac Admins Slack > #fleet
 2026-07-27 10:30:41 -07:00
Noah Talerman 958fe8b9aa Add macOS apps to fleet maintained apps for testing & QA (#49983) 
- To verify best practice workflow for rollbacks:
https://fleetdm.com/guides/fleet-maintained-apps#rollback-to-a-previous-version


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added Slack, Zoom, Google Chrome, and Claude to the macOS self-service
software catalog for the Testing & QA fleet.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-27 12:16:01 -05:00
Irena Reedy c96ee75ac0 Update README.md (#49988) 
Role updated
 2026-07-27 17:59:23 +01:00
Noah TalermanandAndrey Kizimenko 8d2a2d1647 Update bug triage (#49775) 
- @AndreyKizimenko is DRI

## What changed

Removes the `:release` label from the bug triage and release process
docs (`handbook/company/product-groups.md`,
`handbook/engineering/releases.md`). Bugs and stories are now added to
the product group's release board directly, so `:release` was redundant
board-routing:

- Reproduced unreleased bugs are added to the release board directly (no
`:release` label).
- Updated the outside-contributor step, the unreleased-bug creation
step, and the conclude-milestone step to match.
- Bonus: fixed a dead `#critical-bugs` anchor in `releases.md`
(repointed to `#release-testing`).

## Why we're keeping `~critical bug` and `~release blocker`

The original TODO was to remove all three labels, but on review the
other two carry signal that our `P0`/`P1`/`P2` priority labels don't:

- **`~critical bug` (severity, for bugs):** triggers a distinct safety
process — raise the alarm to the community, update the GitHub release
page, cut a patch release, run a postmortem. Priority labels answer *how
urgently we work* an issue; `~critical bug` answers *"are users in the
wild in danger right now, so we owe them external comms + a
postmortem?"* Not every `P1` is a critical bug.
- **`~release blocker` (scope, for stories):** flags that a story must
ship in the next release. That's orthogonal to urgency — a
lower-priority story can still be committed to a milestone.

Both are low-frequency, high-signal exception flags, so keeping them
doesn't clutter day-to-day triage.

## Note for reviewers

The conclude-milestone step now says applying `:product` moves a story
back to the drafting board. If the release board's GitHub Projects
automation keys off the `:release` label to add/remove items, that
config should get a matching update so stories aren't stranded on the
release board.

---------

Co-authored-by: Andrey Kizimenko <87822796+AndreyKizimenko@users.noreply.github.com>
 2026-07-27 11:09:19 -05:00
Rajendra Kadam 17669eca02 Center-align setup experience app icons (#49962) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46973

> **Draft:** on-device QA (Mac/iPhone/iPad) is pending hardware,
expected next week. Opening as draft for early review of the approach.

## Description

FMA and custom-package app icons were misaligned on the macOS setup
experience ("Setting up your device") screen — icons rendered at
different sizes and their "Install …" labels didn't line up.

**Root cause:** `SetupSoftwareProcessCell` forced `.software-icon__small
{ width: $pad-xlarge }` (32px, width only). That class lands on
different elements in `SoftwareIcon`'s two render paths, so it hit them
differently:
- **Fleet-maintained / VPP apps (icon URL)** → the class is on the
wrapper `<div>`; the 24px `<img>` inside stayed 24px, left-aligned.
- **Custom packages (no URL)** → the class is on the fallback **SVG**
itself, which got stretched to 32px wide.

Result: different icon sizes/positions by app type → the misalignment.

**Fix:** remove the width override so every app type renders
`SoftwareIcon` at its consistent, vertically-centered 24px "small" size.

## Testing

Verified in Storybook (added `SetupSoftwareProcessCell.stories.tsx`,
`MixedAlignment` story) with real matched brand icons (Chrome,
1Password, VS Code, Zoom), a generic custom-package icon, and a
URL/`<img>` icon stacked together:
- **Before** (with the override): icons render at mixed 24/32px sizes;
"Install …" labels don't align.

<img width="1135" height="398" alt="before"
src="https://github.com/user-attachments/assets/fe216ab4-0a7b-4211-b8aa-96e65e6ca3f5"
/>

- **After** (this change): all icons render at 24px, centered, labels
aligned.

<img width="1185" height="425" alt="after"
src="https://github.com/user-attachments/assets/28257eb8-df6e-4168-a0bb-28dda4bb40ba"
/>


On-device QA to follow once hardware is available.

## Notes for reviewer
- The `width: $pad-xlarge` (32px) was added in #33770, so 32px may have
been the *intended* icon size. This change makes them a consistent
**24px**. If a larger icon is desired, that's a follow-up done properly
via a real `SoftwareIcon` size (not a width-only override) — flagging
for PD input since this is `:product`-labeled.
- Included a Storybook story for visual verification/regression; happy
to drop it if that's not wanted here.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [ ] QA'd all new/changed functionality manually <!-- pending on-device
QA -->
- Added a Storybook story for visual verification (not an automated
test).


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved software process cell styling for more consistent icon sizing
and alignment.

* **Tests**
* Added Storybook scenarios covering fleet-maintained apps, custom
packages, uploaded icons, and mixed app layouts.


<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-27 19:42:22 +05:30
melpike af65282522 Align helper text with checkbox/radio labels (#49977) 
Moves changes from #49920 to `main`.

Originally targeting `docs-v4.91.0` — retargeted to this branch.

**Related:** #49920

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved checkbox and radio button helper-text alignment so it lines
up with the associated label.
* Adjusted spacing between controls, labels, and helper text for a
cleaner form layout.

* **Documentation**
* Added component examples demonstrating checkbox and radio buttons with
helper text.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-27 08:07:54 -06:00
melpike 0786a5c514 [Route] Add route for IDP account sync information (#49975) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45524 


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Added a redirect from the IDP account sync information page to the
Apple account provisioning deployment guide.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-27 07:44:20 -06:00
melpikeandEric ea1c1e9646 Add route for Windows default fleet information (#49898) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #41787

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a convenient link for learning how to set a default Fleet for
new Windows hosts.
* The link now redirects to the relevant Windows MDM setup guidance,
specifically for setting a default fleet for new hosts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Eric <eashaw@sailsjs.com>
 2026-07-27 07:27:32 -06:00
Andrew Mellor d06a4c222c 47700 abm token invalid errors (#49770) 
**Related issue:** Resolves #47700

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [x] Added/updated automated tests

- [ ] QA'd all new/changed functionality manually. **_Not able to do for
all code paths yet_**



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added `token_invalid` for Apple Business Manager tokens, automatically
tracked based on Apple responses.
* Enhanced host DEP assignment API responses with a structured
`dep_device_error` field to classify why device details couldn’t be
retrieved.
* **Bug Fixes**
* Improved error handling for DEP device lookup, distinguishing
invalid/rejected tokens, expired terms, not-found devices, server/API
errors, and unavailable/unspecified failures.
* Added regression and unit test coverage for ABM token invalidation and
DEP device error classification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-27 10:35:27 +01:00
Jordan Montgomery 89f67544b4 Add support for fleet vars in scripts(controls scripts, software scripts/script-only packages and setup experience scripts) (#49781) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #49511  and #46837 as a whole

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added support for Fleet built-in variables in host scripts, software
installer scripts, setup-experience scripts, and maintained-app
installer scripts.
* Variables are resolved per host at execution time; saved content
remains unexpanded.
* **Bug Fixes**
* Requests now validate Fleet variables up-front, with clear
script-specific error messages for unsupported variables.
* Added improved messaging when variable resolution fails during
execution.
* Enforced Fleet Premium licensing for script/installer flows that use
Fleet variables.
* **Documentation**
* Documented supported variables and Premium requirements, including
usage examples.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-27 11:24:42 +02:00
fleet-releaseandallenhouchins 9add93bcdb Update Fleet-maintained apps (#49954) 
Automated ingestion of latest Fleet-maintained app data.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Updates**
  * Updated Mellel for macOS to version 6.7.1.
  * Updated OnlySwitch for macOS to version 2.7.2.
  * Updated Reqable to version 3.2.15 on macOS and Windows.
  * Updated Visual Studio Code for Windows to version 1.130.0.
  * Refreshed installer links and verification data for each release.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
 2026-07-26 21:43:01 -05:00
fleet-releaseandallenhouchins 9472107594 Update Fleet-maintained apps (#49952) 
Automated ingestion of latest Fleet-maintained app data.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Updates**
  - Updated AnyDesk for macOS to version 9.7.3.
  - Updated Elgato Control Center for macOS to version 1.9.
  - Updated Firefox Nightly on macOS and Windows to newer builds.
- Updated Marked, Notepad, PureVPN, Rize, Syncovery, and Zettlr for
macOS.
  - Updated Zettlr for Windows to version 4.7.0.
- Refreshed download links and verification checksums for applicable
installers.
- Updated installed-version detection so devices correctly recognize the
latest releases.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
 2026-07-26 16:04:27 -05:00
fleet-releaseandallenhouchins 5cd8edbfb5 Update Fleet-maintained apps (#49946) 
Automated ingestion of latest Fleet-maintained app data.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Updated macOS and Windows installation metadata for Kiro, including
version 1.0.228 installers and checksums.
  * Updated macOS installation metadata for Notepad to version 1.5.8.
  * Updated Firefox Nightly macOS installer metadata to a newer build.

* **Bug Fixes**
* Improved uninstall cleanup for Antigravity IDE, DevKnife, Dot,
IsThereNet, Jellyfin, QLMarkdown, and RetroArch by correcting cleanup
targets and Trash handling.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
 2026-07-26 07:34:58 -05:00
Allen Houchins f0cb2f99a3 Use snapshot logging for Windows 11 hardware readiness report (#49943) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** NA

Switches the dogfood "Collect Windows 11 hardware readiness" report from
`logging: differential` to `logging: snapshot`, so each run reports the
full current state of every host rather than only rows that changed
since the last run.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

## Testing

- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Updated Windows 11 hardware readiness reports to use snapshot logging,
ensuring each report captures a complete current-state view.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-25 22:01:50 -05:00
fleet-releaseandallenhouchins 77d4c647df Update Fleet-maintained apps (#49942) 
Automated ingestion of latest Fleet-maintained app data.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Updates**
  * Updated the Franz macOS app to version 6.5.2.
  * Updated the Ollama Windows app to version 0.32.4.
* Refreshed download links and verification checksums for both
applications.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
 2026-07-25 21:00:14 -05:00
fleet-releaseandallenhouchins 44a3b8d3d7 Update Fleet-maintained apps (#49940) 
Automated ingestion of latest Fleet-maintained app data.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added the latest available releases for numerous maintained apps
across macOS and Windows, including ClickUp, OBS Studio, WeChat, Ollama,
Arc, GoLand, and others.
* Updated download packages and verification data so installations use
the correct release artifacts.
* **Bug Fixes**
  * Improved upgrade detection for updated app versions.
* Refined cleanup behavior for CapCut and Pastebot during
uninstallation.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
 2026-07-25 16:50:36 -05:00