relates to #23128
updates mock service worker package as it was using a version of
`path-to-regexp` that had a high security vulnerability. This updated
version of msw uses a newer version of the package that does not have
this vulnerability
I had to add the `jest-fixed-dom` package to update msw as well as
update our version of typescript to 4.7
#22269
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
<!-- Note that API documentation changes are now addressed by the
product design team. -->
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
#23204
When deleting Pending hosts, using the standard `ds.DeleteHosts` method.
This seems cleaner and more scalable than trying to handle every host
table in cleanups cron.
# Checklist for submitter
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
relates to #21633
This adds an info banner for cloud customers to help them with their
Windows autoenrollment setup.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Manual QA for all new/changed functionality
#23258 (see
[comment](https://github.com/fleetdm/fleet/issues/23258#issuecomment-2443304838)
for rationale)
Validated by removing the two places that would create the directory
(early in scanVulnerabilities in cron.go, partway through download in
download.go) and ensuring the test failed (timeout after 10s).
Both dir creations happen early in the vulns cron so I was able to
drastically tighten the timing on the periodic check on this test, so
this tests completes way quicker than before as an added benefit
(automatic test parallelism notwithstanding).
The panic recovery here theoretically shouldn't be necessary, as on a
passed test the context will get cancelled while syncing the CPE sqlite,
but is included to ensure the test doesn't flake if the implementation
of the vulnerabilities cron changes such that we _would_ get a panic by
cancelling the context this early.
# Checklist for submitter
- [x] Added/updated tests
From discussions with @jahzielv.
QAing ADE flows:
1. New version of fleetd is pushed to `edge`
2. QA folks can trigger this new workflow and download the generated
`fleetd-base.pkg` and `fleetd-base-manifest.plist`.
3. Host the downloaded files (in `foobar/`) in their ngroks URLs (using
e.g. `go tools ./tools/file-server 8085 foobar/`)
4. Use Fleet's `FLEET_DEV_DOWNLOAD_FLEETDM_URL` to point the Fleet
server to their ngrok URL.
#23505
Unreleased NDES bug
Profile error was being overwritten by a subsequent DB update.
# Checklist for submitter
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
Closes: #23317
Changes:
- Changed the select input for the "What will you be using Fleet for?"
question into a radio input on the Talk to us" contact form.
From [the
changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md):
> "This release is identical to 18.2 but adds warnings for deprecated
APIs and other changes that are needed for React 19."
- [x] Manual QA for all new/changed functionality
---------
Co-authored-by: Jacob Shandling <jacob@fleetdm.com>
Changes:
- Updated the class on the query code blocks on the query details page
to make sure they have SQL syntax highlighting.
- Updated the query details page stylesheet.
Changes:
- Standard query library:
- Added three policies to the Standard query library (tagged as premium)
- Changed the `kind` of the "Identify Apple development secrets (macOS)"
query to `policy` because it is an informational query (It returns rows
of results rather than 1 or 0) and removed its `resolution` value
- Updated the build-static-content script to remove platform names from
the end of query names (e.g., (macOS)). This is done to keep the URLs
for queries the same while hiding them in the UI
- Updated the layout of the queries page to match the latest wireframes
and updated the page to only show policies
- Updated the styles and layout of the queries-details page.
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
Changes:
- Updated view-basic-documentation, view-transparency, and
view-device-management to log warnings if the Cloudflare headers we use
to determine whether or not to show the swag CTA are missing in
production
- Fixed a typo in save-questionnaire-progress
#21998
While looking through this I noticed a few other issues:
1. We seem to be inconsistent about what time we pick for OS update
deadlines. For profiles [it's noon local
time](https://github.com/fleetdm/fleet/blob/2e5bf75b6d40d65c5f05b0f58665375dbb71e650/ee/server/service/mdm.go#L1096),
while for Nudge [it appears to be 4am...server time or
UTC](https://github.com/fleetdm/fleet/blob/2e5bf75b6d40d65c5f05b0f58665375dbb71e650/server/fleet/nudge.go#L53-L57)?
#9013 also mentions "noon UTC-8/Pacific Standard Time", which is neither
of the above (and means that, if implemented as spec'd, the deadline
would shift by an hour during DST), while docs prior to this PR
mentioned 4am UTC-8. Maybe we don't care enough to fix the Nudge
behavior since macOS 14 (which no longer requires Nudge) came out over a
year ago, but we should at least agree on desired behavior for DDM and
document that (which is what I've done for iOS/iPad OS since they don't
use Nudge).
2. The [REST API
docs](https://github.com/fleetdm/fleet/blob/2e5bf75b6d40d65c5f05b0f58665375dbb71e650/docs/REST%20API/rest-api.md?plain=1#L1720-L1757)
don't seem to match the description of macOS behavior in the article;
the former indicates that OS updates pop up with increasing frequency
post-deadline, rather than having an impassible dialog. This may be
because behavior changed from Nudge to DDM, but iOS/iPadOS got
copy-pasted from the macOS REST docs and they never used Nudge. My guess
is that we should describe DDM behavior here.
Tagging in @mna as he looks to have implemented DDM OS updates so should
have some context here, and @noahtalerman to confirm desired behavior,
particularly on the deadline side.
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
This applies some consistency fixes as well (e.g. noting that Mac/Win
enforcement requires MDM). Also removed mention of MDM on iOS/iPadOS
enforcement as if an iOS/iPadOS host is enrolled, it's enrolled via MDM.
See #21998
Closes https://github.com/fleetdm/fleet/issues/23449
- updated eo-security hero text
@mikermcneil, "Easily get security data" is my favourite, but I don't
like the double compound adjective in the subheading. What do you think
about this instead?
For unreleased bug #23350, introduced because we're no longer
cascade-deleting _all_ related installs (related to #22996, #21654,
#22087)
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
Closes: https://github.com/fleetdm/confidential/issues/8642
Changes:
- Added a lighter version of the "more info" icon
- Updated the tooltips on the pricing page to be clearer about where
users need to click.
