34064973b87329f809648d78cbc098bd2edf9d04
26046
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Lucas Manuel Rodriguez
|
34064973b8 |
Add VEX exclusions for WiX (#49193)
Fixes: https://github.com/fleetdm/fleet/actions/runs/29230539238 New run: https://github.com/fleetdm/fleet/actions/runs/29248404917 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security** * Added vulnerability assessment records for CVE-2026-5773 and CVE-2026-6276. * Documented that the affected libcurl component is not used in the relevant installer-generation execution path. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
3ec1b9e10e |
Change 'should never' to 'must never' in README (#49222)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
Dante Catalfamo
|
93fa75ec45 |
Update Windows 10 CIS benchmark policies to v4.0.0 (#48986)
**Related issue:** Resolves |
||
|
Konstantin Sykulev
|
9f111d2a24 |
Android managed config insert job with empty err vs null err (#49213)
**Related issue:** Resolves #49210 # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved reliability when queuing managed configuration resend jobs by ensuring newly created jobs start with a consistent empty error state. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Zay Hanlon
|
7c5ce5a226 |
Update README with access and data usage guidelines for cloud (ISO) (#49217)
Added guidelines for accessing managed cloud customer environments and handling production data. |
||
|
Eric
|
56782e2b61 |
Website: move analytics script tag (#49214)
Changes: - Moved the clay analytics script tag in the website's `<head>` to the end of the `<body>` tag <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated production analytics configuration. * Adjusted the placement of an analytics initialization script to support more consistent tracking behavior. * Refined internal analytics labeling without changing the visible website experience. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rahul Raghunathan
|
9f8caea025 |
Fix tables losing row selection on window focus (#48742)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48542 ## Description The `QueryClient` was created with `new QueryClient()` and no default options, so every query inherited React Query's default `refetchOnWindowFocus: true`. On pages like `/policies` and `/users`, queries are refetched every time the browser window regains focus. Those focus refetches re-rendered the table with fresh data, tripping react-table's `autoResetSelectedRows` and `autoResetPage` (both default `true`), so the table appeared to "reload," clearing the user's row selection and jumping back to the first page when they clicked away and back. ## Screen recording demonstrating the fix https://github.com/user-attachments/assets/eabf30a5-65d3-420d-a8d3-5a529fa06089 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Prevented users and policies tables from unexpectedly reloading when switching back to the browser window. * Preserved table state such as selected rows and current pagination instead of resetting to the first page. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Eric
|
53ecfe030d |
Website: remove script tag in header (#49207)
Changes: - Removed an analytics script tag from the website's header <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Removed the Snitcher verification and tracking integration. * Updated analytics-related labeling to reflect the revised tracking setup. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Noah Talerman
|
b535023fb6 |
Custom Android apps guide (#49206)
- Google is removing support for `.apk` packages and moving everyone to `.aab`: https://www.androidenterprise.dev/s/article/Private-App-Hosting-APK-Changes |
||
|
Marko Lisica
|
fb3932f37a |
Update CustomLink styles (#48838)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #35328 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved link hover and `:focus-visible` underline/outline behavior for more consistent accessibility across tables, buttons, and modals. * Fixed script name hover underline clipping in the run script modal. * **Style** * Refreshed `CustomLink` styling with an emphasized variant and improved underline behavior, plus updated related link/table/button styling for a unified look. * Updated “Connect Fleet” info-banner messaging and CTAs for calendar and conditional access automations; refreshed “No scripts available” empty state. * **Tests** * Updated modal tests to match revised link text and accessible names. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
7ac8c659e0 |
Add Windows FMAs (letter E): 13 apps (#49186)
**Related issue:** N/A — part of the Windows Fleet-maintained apps catalog expansion (letter E batch; follows #48872, #48881, #48950, #48969, #49086). Adds eleven new Windows Fleet-maintained apps: | App | winget package | Installer | Notes | |-----|----------------|-----------|-------| | Eclipse Temurin JDK 8 | `EclipseAdoptium.Temurin.8.JDK` | MSI (WiX), machine, x64 | Per-major pin. | | Eclipse Temurin JDK 11 | `EclipseAdoptium.Temurin.11.JDK` | MSI (WiX), machine, x64 | Per-major pin. | | Eclipse Temurin JDK 17 | `EclipseAdoptium.Temurin.17.JDK` | MSI (WiX), machine, x64 | Per-major pin. | | Eclipse Temurin JDK 21 | `EclipseAdoptium.Temurin.21.JDK` | MSI (WiX), machine, x64 | Per-major pin. | | Eclipse Temurin JRE 8 | `EclipseAdoptium.Temurin.8.JRE` | MSI (WiX), machine, x64 | Per-major pin. | | Eclipse Temurin JRE 11 | `EclipseAdoptium.Temurin.11.JRE` | MSI (WiX), machine, x64 | Per-major pin. | | Eclipse Temurin JRE 17 | `EclipseAdoptium.Temurin.17.JRE` | MSI (WiX), machine, x64 | Per-major pin. | | Eclipse Temurin JRE 21 | `EclipseAdoptium.Temurin.21.JRE` | MSI (WiX), machine, x64 | Per-major pin. | | exacqVision Client | `ExacqTechnologies.exacqVisionClient` | MSI, machine, x64 | Clean MSI; ARP name `exacqVision Client (x64)`. | | Egnyte WebEdit | `Egnyte.EgnyteWebEdit` | MSI, machine, x86 | Distinct product from the existing Egnyte Desktop FMA (separate ProductCode/UpgradeCode/ARP name). | | Elevate UC | `Serverdata.ElevateUC` | MSI, machine, x64 | Intermedia UC client. Unversioned latest-pointer URL with ~monthly cadence → `ignore_hash`. | **Eclipse Temurin (8 apps).** All are clean machine-scope WiX MSIs from Eclipse Adoptium. The ARP DisplayName embeds the full patch version — `Eclipse Temurin JDK with Hotspot 17.0.19+10 (x64)` — and JDK/JRE of the same major share a version prefix, so each major is pinned with an `exists_query` that combines the JDK-vs-JRE name prefix, the publisher, and a major version filter, e.g.: ``` SELECT 1 FROM programs WHERE name LIKE 'Eclipse Temurin JDK%' AND publisher = 'Eclipse Adoptium' AND version LIKE '17.%'; ``` The `JDK`/`JRE` token in the name prefix keeps a JDK install from matching the JRE FMA and vice-versa; the `version LIKE '<major>.%'` keeps each major distinct. This mirrors the existing Amazon Corretto per-major FMAs. Identities (DisplayName, publisher `Eclipse Adoptium`, 4-part ProductVersion) were verified via `msiinfo` on the real x64 MSIs. Considered but **not** added (recorded in the workstream tracker): - **ESET Endpoint Antivirus** (`ESET.EndpointAntivirus`) and **ESET Endpoint Security** (`ESET.EndpointSecurity`): the install succeeds headless without a license, but uninstall is Self-Defense (HIPS) protected — it requires a reboot to complete and is widely documented to fail unattended (needing the ESET Uninstaller Tool in Safe Mode), so a reliable silent SYSTEM-context removal can't be guaranteed. They're also managed enterprise agents meant for central ESET PROTECT deployment (standalone installs land unactivated and disable Windows Defender). Still to verify (not in this PR): EndNote, Enpass, Evernote, and UltraISO — their verification pass was interrupted and will be handled separately. Identities verified via `msiinfo` Property tables. SHAs verified against manifests for pinned URLs; `ignore_hash` used only for Elevate UC's actively-maintained latest-pointer URL. Icons via `tools/software/icons/generate-icons.sh`. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [ ] QA'd all new/changed functionality manually (relying on the FMA CI validator for Windows install/uninstall validation) |
||
|
fleet-releaseandallenhouchins
|
bb32bc7786 |
Update Fleet-maintained apps (#49203)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Updated maintained app releases for Claude, Electrum, GOG Galaxy, IBM Notifier, MacWhisper, Tuple, Typeface, WebCatalog, and WhatsApp. * Added the latest Windows and macOS installer versions, download links, and verified checksums. * Updated GOG Galaxy’s macOS installation reference for the new release. * Improved release detection so installed applications can be accurately compared with the latest available versions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
Josh Roskos
|
9539535321 |
Supress install all for all/undefined software category (#48999)
**Related issue:** Resolves #49013 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Hid the **Install all** button on the unfiltered **All** software view. * Kept **Install all** available when a specific category is selected. * Updated install-all behavior so the correct category is used when launching installs. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
a55d3e3e3a |
Run Windows FMA test workflows on ARM64 runner (#47598)
Switch the Windows Fleet-maintained app test workflows from windows-latest to windows-11-arm so ARM-native FMAs can be validated. Existing x86/x64 FMAs continue to install and run via Windows 11 on ARM's Prism emulation, and detection is registry-based so it stays architecture-agnostic. Also make the osquery download architecture-aware: pick the native arm64 build on ARM64 runners and fall back to x86_64 otherwise, so osqueryi runs natively rather than under emulation. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Expanded test coverage to include Windows 11 ARM64 architecture. The application is now validated on ARM-based systems in addition to traditional x86_64 platforms. * Updated test infrastructure to automatically detect system architecture and download corresponding dependencies, ensuring proper validation across both ARM64 and x86_64 Windows configurations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
13a80c4bc8 |
Auto-install 1Password patches on Workstations (#48585)
**Related issue:** N/A — dogfood GitOps configuration change
# What & why
Changes the 1Password patch automation on the **💻 Workstations** fleet
from calendar-event-driven remediation to **forced install**, on both
macOS and Windows.
For both `1password/darwin` and `1password/windows` patch policies in
`it-and-security/`:
- `install_software: false` → `install_software: true`
- Removed `calendar_events_enabled: true`
- Updated the `resolution` text to drop the "scheduled maintenance
window / check your calendar" language, matching the wording used by the
other IT-managed forced-install policies (Okta Verify, Adobe Acrobat,
etc.).
When a host now fails either 1Password patch policy, Fleet automatically
installs the latest Fleet-maintained 1Password with no end-user calendar
interaction. The fleet's `google_calendar` integration is left in place
since other policies (e.g. Firefox) still use calendar events.
# Checklist for submitter
- [x] QA'd all new/changed functionality manually (GitOps config only;
no code change)
Note: This is a dogfood GitOps config change only — no user-visible
product change, no code, no migrations, no new settings.
|
||
|
Allen Houchins
|
99cd91a32c |
Fuzzy-match Zoom Workplace program name in Windows FMA install and patch query (#49188)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** N/A ## Summary The Windows Zoom Fleet-maintained app's `exists`/`patched` queries used an exact match on `programs.name = 'Zoom Workplace (X64)'`. Real-world Zoom installs frequently register under a different name: - Winget's own package name for `Zoom.Zoom` is `Zoom Workplace` (no arch suffix). - Zoom ships a separate, per-user, self-updating installer (`Zoom.Zoom.EXE`, ProductCode `ZoomUMX`) that many end users get via Zoom's in-app auto-updater, which registers differently than the MSI-based entry Fleet's FMA targets (see [microsoft/winget-pkgs#151467](https://github.com/microsoft/winget-pkgs/issues/151467)). - ARM64 builds exist and would register as e.g. `Zoom Workplace (ARM64)`. Since the `patched` query is generated directly from the `exists` query, any host with Zoom installed under one of these other names was invisible to the patch policy — it would never show as needing (or having received) an update. - `ee/maintained-apps/inputs/winget/zoom.json`: added `"fuzzy_match_name": "Zoom Workplace%"` (following the existing precedent used by ~97 other Windows FMAs, e.g. `cinc.json`'s custom fuzzy pattern). - `ee/maintained-apps/outputs/zoom/windows.json`: regenerated via `go run cmd/maintained-apps/main.go --slug="zoom/windows" --debug`. Only the `exists`/`patched` query strings changed (now `name LIKE 'Zoom Workplace%'` instead of `name = 'Zoom Workplace (X64)'`); version, install/uninstall scripts, and refs are untouched. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/` ## Testing - [x] Verified the regenerated output only changes the exists/patched query strings (`git diff`) - [ ] QA'd all new/changed functionality manually (needs a live Windows host with Zoom installed under a non-`(X64)` name to fully confirm) |
||
|
|
66a8791247 |
Update Fleet-maintained apps (#49196)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Refreshed maintained-app listings across macOS and Windows with updated versions and downloads (e.g., Postman, DataGrip, OneDrive, Zed, CMake, Proton VPN, and more). * Updated ChatGPT macOS installer format to use ZIP artifacts. * **Bug Fixes** * Improved uninstall/upgrade handling for ChatGPT and Gemini, including safer app quitting/relaunch and more targeted cleanup. * Enhanced Weasis Windows uninstall to remove all related MSI products discovered via upgrade codes. * Refreshed installer integrity checks for DBeaver Enterprise and DBeaver Ultimate. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> Co-authored-by: Allen Houchins <allenhouchins@mac.com> |
||
|
Lucas Manuel Rodriguez
|
60d8f51374 |
Move test/upgrade to tools/ to reduce security scanning noise (#49158)
Two reasons: - It's a testing/QA tool, so it should be under `tools/` - Reduce security-noise because it's just an internal tool (all findings under tools/ should be ignored). Failing dependency review expected because of the security findings in the docker Go packages. (Which can be fixed/updated when a patch is issued but without urgency because this is an internal tool.) ## Testing - [x] QA'd all new/changed functionality manually Ran: ``` cd tools/upgrade FLEET_VERSION_A=v4.87.1 FLEET_VERSION_B=v4.88.1 go test ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Added an end-to-end upgrade test scenario across two Fleet versions. * Added a Docker Compose-based upgrade environment (Fleet, MySQL, Redis, osquery) with local TLS certs/keys and osquery flags. * **Tests** * Added automated Fleet readiness checks and host enrollment verification before and after upgrade. * **Chores / Security** * Updated the database upgrade test workflow and Go module tooling for the new upgrade test setup. * Adjusted secret scanning allow-rules and refreshed Go dependencies for the upgrade module. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
29bef37837 |
Add macOS app filter to My device software (#48637)
Expose the existing "Applications" / "Full inventory" software filter on the Fleet Desktop My device Software tab for macOS hosts. The filter now defaults to Applications for macOS, sends `macos_applications` to the device software API, and keeps that query param during pagination. Updated table tests cover rendering and URL behavior on My device and non-macOS hosts. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48636 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added the **Applications / Full inventory** software filter to the **My device > Software** tab for macOS devices. * The selected filter is now preserved when navigating through software results. * **Bug Fixes** * Corrected software filtering behavior across device pages and platforms. * Prevented the macOS filter parameter from being added for non-macOS devices. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Juan Fernandez
|
f4ee5c6da9 |
Skip live-query reverse-index read when no reverse queries are active
Relates to #42441 Small-target live queries are stored in a per-host reverse index (livequery:host:{hostID}) that QueriesForHost reads once per checkin via SMEMBERS. That read was issued unconditionally on every host checkin — even when no active query used the reverse model — so every checkin probed a per-host key that did not exist and acquired an extra Redis connection. |
||
|
Sharon KatzandClaude Opus 4.6
|
a1531e6752 |
Fix CPE matching for python3-prefixed packages on Ubuntu/Debian (#48599)
Closes #43328 ## Summary - On Ubuntu/Debian/RHEL, `pythonPackageFilter` in osquery.go prepends `python3-` to Python package names (e.g., `geopandas` becomes `python3-geopandas`) to match OVAL definitions - However, the CPE database uses the bare package name (e.g., `geopandas`, not `python3-geopandas`), so CPE matching fails and no vulnerabilities are reported - This fix adds the stripped name (without `python3-` prefix) as an additional product variation during CPE lookup, so both `python3-geopandas` and `geopandas` are tried - The original prefixed name is preserved so packages genuinely named `python3-*` on PyPI (e.g., `python3-openid`, `python3-saml`) still match correctly on non-Ubuntu platforms ## How I reproduced Used the `nvdvuln` tool to simulate CPE matching: **Before fix** (on main branch): ``` $ go run --tags=fts5 tools/nvd/nvdvuln/nvdvuln.go \ --software_name python3-geopandas \ --software_source python_packages \ --software_version 1.0.1 Translating software to CPE... Unable to match a CPE for the software... ``` **After fix:** ``` $ go run --tags=fts5 tools/nvd/nvdvuln/nvdvuln.go \ --software_name python3-geopandas \ --software_source python_packages \ --software_version 1.0.1 Translating software to CPE... Matched CPE: 0: cpe:2.3:a:geopandas:geopandas:1.0.1:*:*:*:*:python:*:* Translating CPEs to CVEs... CVEs found for python3-geopandas (1.0.1): CVE-2025-69662 ``` Also verified with `python3-django` (version 3.2.12) -- correctly finds CVE-2024-24680 and other CVEs. ## How I tested - Unit tests: added test cases for `productVariations` covering: - `python3-geopandas` (source: `python_packages`) -> produces both `python3-geopandas` and `geopandas` variations - `python3-django` (source: `python_packages`) -> produces both `python3-django` and `django` variations - `requests` (source: `python_packages`, no prefix) -> no extra variations added - Manual: ran `nvdvuln` tool for both packages from the issue, confirmed CPE match and CVE detection - Lint: `make lint-go-incremental` passes clean 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved vulnerability detection for Python packages on Ubuntu/Debian by handling package names with or without the `python3-` prefix. * Added additional matching variations derived from sanitized names, ensuring both full and stripped forms are considered. * Ensured existing non-Python package matching behavior remains unchanged. * **Tests** * Expanded NVD sanitization and product variation test coverage for `python_packages` scenarios (including cases with and without the `python3-` prefix). <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Isabell Reedy
|
65caf18c69 |
Update CODEOWNERS (#49194)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated review requirements for security and compliance documentation paths. * Updated review requirements for the `.claude` configuration path. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
George Karr
|
be8877fa43 |
Handbook: remove Ian Littman from product-groups.md (#49138)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA Removes Ian Littman from the MDM product group's Software Engineer roster in `handbook/company/product-groups.md`. |
||
|
kilo-code-bot[bot]
|
2299f02954 | Add Sales Territory Assignments section to Sales handbook (#49155) | ||
|
Allen Houchins
|
6280699eb0 |
Update block-and-monitor-edr-freeze-on-macos-with-santa-and-fleet.md (#49176)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
fleet-releaseandallenhouchins
|
61d1ba61f9 |
Update Fleet-maintained apps (#49174)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Updated managed app installers and release metadata for the latest versions of Arc, Beekeeper Studio, Claude, CleanMyMac, Clop, Dropbox, Google Credential Provider, Hive, Kiro CLI, PDFsam Basic, RewriteBar, Santa, Super Productivity, Superwhisper, and Warp. * Updated installer download links and verification checksums to support the new releases. * Refreshed Dropbox uninstall handling and Santa’s installation package for improved upgrade support. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
George Karr
|
a1b764a341 |
Adding changes for Fleet v4.88.1 (#49038)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Released a new Fleet chart and application version. * Updated deployment defaults to use the latest Fleet container image. * **Tests** * Adjusted release-candidate branch expectations to match the new version. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
c5575e9d9a |
Add PSSO end to end integration tests (#48589)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #47171 Added integration tests for the fleet-psso feature and added PSSO functionality to our MDM test client - idea being it is so tightly integrated into the MDM side of things on the Apple side AND we ideall want osquery-perf to be able to exercise it(coming in the next PR) # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Apple Platform SSO (PSSO) support for device registration, password login, key requests, and key exchange. * Added a simulator/test device for exercising the full PSSO workflow end-to-end. * Made PSSO AASA development app IDs configurable and enhanced macOS PSSO activity in performance testing (with new counters). * Improved local macOS Desktop packaging/signing configurability. * **Bug Fixes** * Strengthened PSSO token/crypto handling, including algorithm pinning, key ID canonicalization, encrypted assertion `typ` validation, and replay protection. * **Tests** * Added extensive crypto interoperability tests (including Apple known-answer vectors) plus new end-to-end integration coverage. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Magnus Jensen <magnus@fleetdm.com> |
||
|
+3
|
c9803c2a8f |
Docs: non-proxied cert renewal (#45695)
**Related issue:** Resolves #44348 **Base branch:** `docs-v4.86.0` (not `main`) per the docs release process. ## What this PR does Updates four customer-facing guides and adds a release-notes entry for Phase 2's opt-in cert renewal feature (shipped via #45696). Frames the marker as an opt-in enhancement: profiles without it continue to work as in 4.85; profiles with it activate auto-renewal. | Guide | Change | |-------|--------| | `connect-end-user-to-wifi-with-certificate.md` | Migrated 11 legacy `\$FLEET_VAR_SCEP_RENEWAL_ID` refs to the preferred name; added back-compat callout. | | `okta-conditional-access-integration.md` | Removed "Automatic renewal coming soon" line; added one-time upgrade-redeploy callout for existing customers. | | `enable-okta-verify-on-macOS-with-configuration-profile.md` | Added marker to example profile OU; added opt-in note and CA-side OU-preservation verification step. Coordinated with the earlier example-profile update from #43293 already on `docs-v4.86.0`. | | `enable-okta-verify-on-windows-using-a-scep-configuration-profile.md` | Replaced manual-redeployment narrative with auto-renewal guidance. Kept the policy-based expiry-monitoring SQL as an optional safeguard. | Release-notes entry (`changes/40639-non-proxied-cert-renewal`) consolidates Phase 2 customer-visible behavior in three bullets. ## Dependencies The Conditional Access guide's "new setups: no extra action needed" framing assumes #45662 (the Fleet-side template marker addition) has landed — it has, merged into the feature branch and onward into main via #45696. # Checklist for submitter - [x] Changes file added for user-visible changes ## Testing - [x] Doc review only — no code changes <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Automatic certificate renewal is now supported for SCEP and ACME certificates from external certificate authorities, enabled by default for new deployments with an opt-in path for existing customers * macOS devices with ACME-bearing configuration profiles will now surface hardware-bound certificates in device vitals <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Rachael Shaw <r@rachael.wtf> Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com> Co-authored-by: kilo-code-bot[bot] <240665456+kilo-code-bot[bot]@users.noreply.github.com> Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com> Co-authored-by: melpike <79950145+melpike@users.noreply.github.com> Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com> Co-authored-by: Jonathan Katz <44128041+jkatz01@users.noreply.github.com> Co-authored-by: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com> Co-authored-by: Magnus Jensen <magnus@fleetdm.com> Co-authored-by: RachelElysia <71795832+RachelElysia@users.noreply.github.com> Co-authored-by: Scott Gress <scottmgress@gmail.com> |
||
|
Andrey Kizimenko
|
6430e6132f |
Add 4.89.0 baseline and migration loadtest results (#49168)
## Summary
Adds the **4.89.0** load test metrics artifacts, following the existing
`tools/loadtest/metrics/runs/` conventions.
### Baseline — `runs/baseline/489loadtest/`
18h run on a fresh RC instance (no data).
- `489loadtest-2026-07-10-210313Z-18h.json` / `.md`
### Migration — `runs/migration/487to489mig/`
4.87 → 4.89 migration, before vs. after.
- `487to489mig-2026-07-10-162812Z-1h.{json,md}` — pre-migration (1h
window)
- `487to489mig-2026-07-10-192738Z-130m.{json,md}` — post-migration (130m
window)
## Results
| Run | Fleet errors | ALB 5xx | Abnormal stops | Threshold checks |
|-----|:---:|:---:|:---:|---|
| Baseline (18h) | 0 | 0 | 0 | RDS Writer Deadlocks avg 0.13
(occasional, retried) |
| Migration pre (1h) | 0 | 0 | 0 | ✅ all within thresholds |
| Migration post (130m) | 0 | 0 | 0 | RDS Writer Deadlocks avg 0.08
(occasional, retried) |
The only flag is a near-zero average of occasional RDS writer deadlocks
(MySQL retries these); everything else is within expected range and
holds steady across the migration. Full per-metric comparison
(`compare-metrics.sh`) is posted on the release QA issue.
Data only — no code changes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added baseline and migration load-test performance reports.
* Included infrastructure, database, Redis, load balancer, network,
container health, error, and SQL performance metrics.
* Added reports covering multiple test durations and migration intervals
for improved performance analysis.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
Andrew MellorandJordan Montgomery
|
2eb1cba2dd |
46959 Add Account Provisioning settings to UI for FPSSO configuration (#47655)
**Related issue:** Resolves #46959 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Apple account provisioning configuration UI in integrations settings with token URL, client ID, and client secret fields. * Added activity tracking for Apple account provisioning changes. * **Documentation** * Renamed integration settings labels for clarity: "Ticketing", "Calendar events", "Certificate enrollment", "User mapping", "Authentication (SSO)", and "Host status alerts". <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com> |
||
|
Jordan Montgomery
|
91971a3637 |
Add better index to nano_enrollment_queue (#48865)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48883 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Improved performance for retrieving the next Apple MDM command, making queue lookups faster and more reliable. * Added a new database index to better support ordering and selection of pending commands. * **Tests** * Added coverage to verify the new indexing behavior is applied correctly during database updates. * **Chores** * Updated database schema and migration records to include the new index. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Steven Palmesano
|
4ac41f9681 |
Update macOS version DDM guide to avoid failures (#47999)
@kitzy Thank you for writing this up! Heads up that I updated the queries. Fleet does not automatically deliver the profile to applicable devices, so the user must specify a query that doesn't include devices at or above the required version. |
||
|
Mike McNeil
|
2d2b6e4683 | Handbook: Update leadership.md (#49162) | ||
|
github-actions[bot]andlucasmrod
|
11df098d7c |
Update Orbit CA certs [automated] (#49160)
Resolves: https://github.com/fleetdm/fleet/issues/49161. Automated change from [GitHub action](https://github.com/fleetdm/fleet/actions/workflows/update-certs.yml). Claude summary: ``` ➕ Added (1) - e-Szigno TLS Root CA 2023 — new Hungarian (Microsec) root Mozilla admitted to the store. ➖ Removed (24) These match Mozilla's root-store retirements/distrusts over the Jan–Jul 2026 window. Grouped by the reason they went away: ┌────────────────────────────────────────────────────────────────┬─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ │ Theme │ Roots removed │ ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ Trustwave exiting the CA business │ Trustwave Global CA, Trustwave Global ECC P256, Trustwave Global ECC P384, SecureTrust CA, Secure Global CA │ ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ Entrust distrust (incl. Entrust-owned AffirmTrust) │ Entrust Root CA – G2, Entrust Root CA – EC1, AffirmTrust Commercial, AffirmTrust Networking, AffirmTrust Premium, AffirmTrust Premium ECC │ ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ Legacy DigiCert / QuoVadis roots retired (superseded by G2/G3) │ DigiCert Assured ID Root CA, DigiCert Global Root CA, DigiCert High Assurance EV Root CA, QuoVadis Root CA 2, QuoVadis Root CA 3 │ ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ Distrusted for compliance │ GLOBALTRUST 2020 │ ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ Other retirements │ COMODO Certification Authority, SwissSign Gold CA – G2, TeliaSonera Root CA v1, Certigna, certSIGN ROOT CA, FIRMAPROFESIONAL CA ROOT‑A WEB, GTS Root R2 │ └────────────────────────────────────────────────────────────────┴─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘ ``` Co-authored-by: lucasmrod <lucasmrod@users.noreply.github.com> |
||
|
Mike McNeil
|
e0c6411c2f |
Handbook: Update headcount (#49156)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # |
||
|
|
078fbc0f40 |
Add Targeted platforms column and platform filter to Policies page (#44125)
- @noahtalerman: For the following quick win: - https://github.com/fleetdm/fleet/issues/23737 ## Summary Adds a "Targeted platforms" column and a platform filter dropdown to the Policies page (`/policies/manage`), matching the pattern already used on the Reports page (`/queries/manage`, `ManageQueriesPage`). ### Frontend - New non-sortable **Targeted platforms** column rendered via `PlatformCell`, sourced from each policy's comma-separated `platform` field. - New platform filter dropdown (All / macOS / Windows / Linux / ChromeOS) wired as a `customControl` on the Policies table, alongside the existing automation filter. Selecting a value pushes a new URL (not a replace), resets `page` to 0, and updates the `platform` query param. - `ManagePoliciesPage` reads `location.query.platform` and threads it through to both `globalPoliciesAPI.loadAll` / `teamPoliciesAPI.loadAll` and the react-query keys, plus the count endpoints. The automation-filter and count "hide" conditions now include the platform filter so they remain visible when only a platform filter is active. - `frontend/services/entities/global_policies.ts` and `team_policies.ts` accept an optional `platform` param (with `"all"` normalized to `undefined`). - Added tests for the new column and dropdown in `PoliciesTable.tests.tsx`. ### Backend - Added `Platform string ` + `` `query:"platform,optional"` `` to `ListGlobalPoliciesRequest`, `CountGlobalPoliciesRequest`, `ListTeamPoliciesRequest`, `CountTeamPoliciesRequest`. - Extended datastore and service signatures (`ListGlobalPolicies`, `ListTeamPolicies`, `ListMergedTeamPolicies`, `CountPolicies`, `CountMergedTeamPolicies`, `ListGlobalPolicies`/`ListTeamPolicies` on the service) to accept a `platform string` arg. Mocks and all call sites updated. - Platform filtering in SQL uses a new helper `platformFilterClause`: ```sql AND (p.platforms = '' OR FIND_IN_SET(?, p.platforms)) ``` so policies targeting "all platforms" (empty `platforms` field) always match regardless of the selected filter. `FIND_IN_SET` uses a bound parameter (no injection risk). - Added a new MySQL integration test `testPoliciesPlatformFilter` covering empty-platform (match-all), per-platform filter, and team/merged paths. ### Docs - REST API docs for `GET /api/v1/fleet/global/policies`, `GET /api/v1/fleet/fleets/:id/policies`, and the corresponding `/count` endpoints now document the `platform` query param. - Added `changes/policies-targeted-platforms-filter`. ## Behavior - `platform=all` (or missing) returns all policies. - Selecting a specific platform returns policies whose `platforms` column is empty OR contains the selected token. - The dropdown only renders when the table is searchable (results exist OR any filter is active). - Changing the filter pushes a new URL and resets the page. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually Local verification: - `go build ./...` — clean - `go vet ./server/... ./cmd/... ./ee/...` — clean - `make lint-go-incremental` — 0 issues - Go service-level policy tests pass. MySQL integration tests compile but could not be run locally (no Docker); CI will exercise the new `testPoliciesPlatformFilter` test. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a "Targeted platforms" column with platform icons and an "All platforms" option. * Added a platform filter dropdown to scope policy lists; counts, last-updated, and controls adapt when a platform filter is active. Backend now honors an optional platform query parameter so filtering returns matching policies. * **Tests** * Added and updated unit and integration tests covering the new column, filter UI, and platform-filtered policy listings. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: nulmete <nicoulmete1@gmail.com> |
||
|
Allen Houchins
|
15118e4797 |
Remove AI model comparison article (#49132)
Delete the article on comparing AI models for configuration profile generation, including its body content and associated metadata tags. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
Luke Heath
|
6ed8217583 |
Fix open redirect in Vanta authorization redirect endpoint (#49077)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA (found via Aikido SAST triage) ## What changed `GET /redirect-vanta-authorization-request` is a public, unauthenticated endpoint that set signed cookies and then redirected the browser to the caller-supplied `vantaAuthorizationRequestURL` with no validation. Because the redirect target came straight from a query parameter, the endpoint could be abused as an open redirect: an attacker could craft a `https://fleetdm.com/redirect-vanta-authorization-request?...&vantaAuthorizationRequestURL=https://evil.example.com` link that bounces a victim to an arbitrary domain (phishing). The only prior gate was a `VantaConnection.findOne({vantaSourceId})` lookup, which does not bind the source ID to the redirect target and is satisfiable by anyone who has ever initiated a Vanta connection. This adds a host/scheme allowlist before redirecting. The legitimate destination is always `https://app.vanta.com/oauth/authorize?...` (constructed server-side in `create-vanta-authorization-request.js`), so the endpoint now only redirects when the parsed URL is `https:` and its host is `app.vanta.com`; otherwise it returns `badRequest`. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually Legitimate flow (redirect target `https://app.vanta.com/...`) still redirects as before; a target on any other host or a non-`https` scheme now returns `badRequest` instead of redirecting. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved safety for authorization redirects by validating the destination before sending users onward. * Redirects now only proceed when the target uses a secure connection and the approved site. * Invalid or malformed redirect links now return a clear bad-request response instead of continuing. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Noah Talerman
|
e7c2f10192 |
GitOps (YAML) reference: Remove "experimental" tags (#49142)
- Removed "experimental" for `macos_manual_agent_isntall` and `software` - There are no plans to break these. Customers are already using them in production |
||
|
Carlo
|
6cfc4a3611 |
Add GitOps support for macOS script-only packages in setup experience (#49089)
**Related issue:** Resolves #43667 # Summary Adds a `setup_experience_platforms` field to the GitOps software package spec so `.sh` script-only installers can be selected for macOS setup experience declaratively. Reconciles the cross-platform selection table on every batch apply. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added declarative `setup_experience_platforms` to software package definitions to control “setup experience” targets, including selecting script-only installers for macOS (mapped appropriately). * Batch uploads now propagate these cross-platform selections and reconcile installer cross-entries. * **Bug Fixes** * Improved platform normalization (trimming, casing, alias mapping), deduplication, and extension-specific validation. * Enhanced update behavior: omitting the field leaves existing selections unchanged; providing an empty list clears them, with correct setup/installation timing. * **Tests** * Added unit and integration coverage for normalization and batch re-apply/reconcile behavior (nil vs empty, idempotency, mixed updates, and validation failures). <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Tim Lee
|
945a4d1518 | Filter Add certificate CA dropdown to custom SCEP only (#49020) | ||
|
Magnus Jensen
|
790f457bf0 |
SAAD: GitOps for DDM assets (#49046)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48570 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. Added in a previous PR - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added end-to-end Apple DDM asset support in GitOps, including export and GitOps parsing for `macOS settings` assets. * Introduced Apple DDM asset management APIs (list/get/download/create/delete) plus a batch set operation with dry-run. * **Bug Fixes** * Improved Apple MDM/DDM reconciliation so referenced asset updates trigger re-delivery via asset-aware tokening. * Added safer validation around asset type changes and deletion conflicts when assets are still referenced. * **Tests** * Expanded unit and integration coverage for asset parsing, upload/apply behavior, reconciliation, and access control. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
aa5813e4eb |
Fix invisible hover state in dark mode (#49001)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48531 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually Checked all the places according to this list: ``` Rule 1 — modal secondary buttons (Cancel / Done / Clear all) `body.dark-mode .modal__modal_container .button--inverse:hover, …` Affects any modal opened from *inside a card* (the only modals where the card-leak made hover invisible). There are **4 such surfaces**, all reachable from the Dashboard or Self-service: 1. **Dashboard → the chart card (Hosts online / vulnerability exposure) → Settings cog → the Settings modal** — hover **Cancel** and **Clear all**. *(issue #48531)* 2. **Dashboard → Activity card → click any activity's details link** — the details modal's footer button (Done/Cancel). This is 12 different activity-detail modals (script details, software install/uninstall details, VPP install, MDM command, etc.). 3. **Dashboard on a fresh instance (fewer than 2 hosts) → "Welcome to Fleet" card → click a policy row** — the policy modal. 4. **Fleet Desktop "My device" → Self-service tab → "Install all" button** — the Install-all-in-category modal's Cancel. ## Rule 2 — button `DropdownWrapper` hover `body.dark-mode .card .dropdown-wrapper__button .react-select__control:hover` Exactly **1 place** in the whole app: 5. **Software → click a software title → title details page → the "Actions ▾" dropdown** at the top-right of the summary card. *(Admin/maintainer only — it's gated behind "can manage software".)* ## Rule 3 — `ActionsDropdown` hover `body.dark-mode .card .actions-dropdown-select__control:hover` Exactly **2 places**: 6. **Host details → Reports tab → each report card header → "Actions ▾"**. *(The confirmed repro.)* 7. **Fleet Desktop "My device" → Self-service tab → a software row → "More ▾"** dropdown. ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed dark-mode hover styling for buttons and dropdowns inside card components. * Restored the correct hover appearance for inverse buttons in modal containers. * Updated hover behavior for select-style dropdown controls so they match the card surface in dark mode. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
2b2a5991a4 |
handle client error decoding errors in ACME urls (#49137)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46282 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Malformed ACME URLs and resource identifiers now return a clear **400 Bad Request** response instead of a **500 Internal Server Error**. * Error details were improved to more accurately distinguish malformed client requests. * **Tests** * Added an integration test covering invalid ACME endpoint path IDs across resource types, verifying **400** responses with the expected malformed error type. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
9185174faa |
Re-add Crestron AirMedia (+Peripherals) Windows FMAs (#49127)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** N/A ## What changed Re-adds two Windows Fleet-maintained apps that were dropped from the letter C batch (#48969) **solely** because `www.crestron.com` returns HTTP 403 to Fleet's default Go `User-Agent`: - **Crestron AirMedia** (`Crestron.AirMedia`) - **Crestron AirMedia Peripherals** (`Crestron.AirMediaPeripherals`) Each gets an input JSON, a generated output, an `apps.json` catalog entry with description, a frontend icon component (+ `index.ts` registration), and a website icon PNG. Both are machine-scope MSIs (WiX) with upgrade-code uninstall; restored from their pre-drop state with outputs regenerated against the current winget manifests (versions unchanged: `5.11.1.164` / `1.11.1.164`, SHAs match). ## ⚠️ Depends on #49123 The 403 is fixed by #49123 (browser `User-Agent` in `DownloadInstaller`). Until #49123 merges and this branch is rebased on it, the FMA validator (`cmd/maintained-apps/validate`) will 403 downloading these installers. Merge #49123 first, then rebase/re-run CI here. ## Validation Run on a Windows validator with the #49123 UA fix in place — **both apps passed**: downloaded (confirming the UA fix unblocks `www.crestron.com`), installed, found via the exists query, and uninstalled cleanly. The `no changes in C:\Program Files` line is benign (they install elsewhere; the exists query still finds them). ## Dell Display and Peripheral Manager — investigated, dropped (not viable as an FMA) DDPM was verified and included in early revisions of this PR, then dropped. Its InstallShield (InstallScript) setup aborts with `0x80042000` in the validator's session-0 SYSTEM context across **every** documented silent switch — `/Silent`, `/S`, and `/Silent /HeadlessMode=true` all failed. Per silentinstallhq, DDPM 2.0+ requires the Windows Desktop Runtime (.NET) prerequisite installed first (extracted from the installer's own prerequisites folder), and its bundled InstallShield prerequisite chaining doesn't cooperate with a headless SYSTEM install; Dell's own community thread for this exact scenario (task sequence = SYSTEM) is unresolved. An FMA install script can't reliably extract-and-chain a runtime that may require a reboot, and DDPM only benefits hosts with Dell displays — so it's not a viable FMA. The identity work (verified DisplayName/publisher from the real installer) is recorded in the commit history if it's ever revisited. # Checklist for submitter - [ ] Changes file — N/A (FMA catalog data, consistent with prior letter batches which add no `changes/` entry). ## Testing - [x] Ran the ingester for both slugs; outputs + `apps.json` regenerated and validated as JSON. - [x] QA'd via the Windows FMA validator — both Crestron apps passed (with the #49123 UA fix present). |
||
|
Sharon Katz
|
2f0c1b338a |
Restrict SCIM endpoints to global admin only (#48858)
**Related issue:** N/A # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests ## Summary Restricts SCIM endpoint access to global admin users only. Previously, global maintainers also had access, which is broader than necessary. ### Changes - **`server/authz/policy.rego`**: Removed `maintainer` from the SCIM authorization rule, leaving only `admin`. - **`ee/server/integrationtest/scim/scim_test.go`**: Updated auth tests to verify maintainers now get 403, and that only admins can access SCIM endpoints. > **Breaking change for 4.89**: Customers using a global maintainer API token for SCIM will need to update to a global admin token before upgrading. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Restricted SCIM endpoint access to global administrators only. * **Bug Fixes** * Prevented unauthorized observer and maintainer users from accessing SCIM reads, writes, and details. * Improved authorization error tracking for denied SCIM requests (including recorded request status and details). * **Tests** * Updated SCIM authorization integration tests to reflect the tightened admin-only access rules. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sharon KatzandClaude Opus 4.6
|
dbdd3fe936 |
Handbook: add missing security practices to IT security page (#49069)
**Related issue:** N/A (documentation-only improvement) # Checklist for submitter - ~Changes file added~ (documentation-only change, no changes file needed) ## Testing - [x] QA'd all new/changed functionality manually Verified the markdown renders correctly and table alignment is consistent. ## Summary Adds three items to the IT security handbook page (`handbook/it/security.md`): - Trivy row in the SAST scanning table for container image and build artifact scanning - Paragraph noting weekly AI-assisted security scans - Paragraph in the Disclosure section documenting the private bug bounty program Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Ken Seals
|
8dde2a67e9 |
Fix open paren (#49126)
There was an open paren here in the Skip-level section <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
Allen Houchins
|
e2ca3120ee |
Add Firefox multilingual deployment guide (#49129)
New article explaining how to deploy Firefox with multiple language packs using a single Fleet-maintained app and post-install scripts for macOS and Windows. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49024 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |