3e166ac42b552a9617c655d91fdb7fe4f7b05b02
26724
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Carlo
|
3e166ac42b |
Fix gofmt formatting in teams_test.go (#50769)
**Related issue:** NA `main` is currently failing the `lint` job on a stray double blank line in `server/datastore/mysql/teams_test.go`: ``` server/datastore/mysql/teams_test.go:1209:1: File is not properly formatted (gofmt) ``` This is the `gofmt -w` output and nothing else — one blank line removed, no code change. # Checklist for submitter ## Testing - [ ] QA'd all new/changed functionality manually Whitespace-only change to a test file; no behaviour to QA. Verified `gofmt -l` on the file is empty and `go vet ./server/datastore/mysql/` is clean. |
||
|
kitzy
|
f656ac533a |
Update custom host vitals guide: style cleanup and Host vitals label support (#50660)
**Related issue:** N/A ## Summary Audits and updates `articles/custom-host-vitals.md` against Fleet's guide-formatting and content-style skills, and documents that custom host vitals can be used as Host vitals label criteria: - Trimmed the opening from 3 paragraphs to 2, and added a sentence pointing to the new labels use case. - Renamed "Using a custom host vital in scripts and configuration profiles" → "Reference a custom host vital in scripts and configuration profiles" to match the imperative, action-led heading style used by sibling sections. - Dissolved the standalone "Known limitations and issues" section — its items are now `> **Note:**`/`> **Warning:**` callouts placed next to the step each one actually affects, instead of collected at the bottom. The delete-protection callout now also covers Host vitals labels, not just scripts/profiles. - Removed em dashes and bolding used for emphasis rather than UI elements, per Fleet's content style guide. - New "Filter hosts by a custom host vital" section (UI + GitOps) documenting the existing Host vitals label type's support for custom host vitals, including the current exact-match-only limitation. # Checklist for submitter - [ ] QA'd all new/changed functionality manually |
||
|
Nico
|
5a1365dc41 |
40493 webhooks for host activities (#50595)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #40493 Changes already reviewed in the PRs merged to this feature branch. Only additive change was https://github.com/fleetdm/fleet/pull/50595/commits/c0934e1fee46a734f9499a4c782563d4fcc345c4 to address CodeRabbit's comments. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually https://github.com/user-attachments/assets/ea7f5157-a67a-4d83-842d-62197bd1546d ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Added host activity automations with configurable webhook destinations. * Manage automations from the Hosts page with validation, permissions, and enable/disable controls. * Added GitOps support for team and unassigned-host webhook settings. * Activity webhooks now include fleet-scoped host IDs where applicable. * Added profile UUIDs to MDM profile resend activity details. * **Bug Fixes** * Improved Windows MDM enrollment activity details by including the linked host ID when available. * Preserved existing webhook settings when omitted during updates. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
NicoandLucas Manuel Rodriguez
|
358b8c43a5 |
iOS/iPadOS: More host vitals (#50496)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #39281 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually https://github.com/user-attachments/assets/8ef7c66d-f8a6-46d5-ba17-66c1df8171b6 https://github.com/user-attachments/assets/6f67b49b-daf1-4acd-ad0f-55a7d1225a44 ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added 29 iOS/iPadOS device vitals to host details and API responses. * Added a “View all” modal for browsing complete device vitals, including subscriptions and accessibility details. * Added support for cellular technology, organization information, attestation data, and device settings. * **Privacy** * Personal/BYOD enrollments exclude expanded device-vitals fields. * Sensitive vitals are removed from device URL-authenticated responses. * **Bug Fixes** * Stale vitals are cleared when enrollment ownership changes or hosts are deleted. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> |
||
|
Lucas Manuel Rodriguez
|
3de43c84af |
Bump out-of-order migrations not included in v4.90.0 (#50690)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Two migrations merged to `main` were not included in the v4.90.0 release but have timestamps older than `20260723181411_MultipleCustomPackagesPerTitle` (the latest migration shipped in v4.90.0). Databases already on v4.90.0 would never apply them, since goose only runs migrations newer than the current (highest applied) version. Bumped both to current timestamps via `tools/bump-migration`: - `20260721090128_AddTokenInvalidToABMTokens` → `20260806154139_AddTokenInvalidToABMTokens` - `20260721160351_AddHostMDMWindowsProfilesStatus` → `20260806154150_AddHostMDMWindowsProfilesStatus` No schema or logic changes — only the file names, `Up_`/`Down_`/`TestUp_` function names, and the regenerated `schema.sql` (`migration_status_tables` versions). Verified that none of the other unreleased migrations (20260724+) depend on the schema these two create, so applying them last is safe. # Checklist for submitter If some of the following don't apply, delete the relevant line. ## Testing - [x] Added/updated automated tests (existing migration tests renamed and re-run against MySQL) ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Database Updates** - Added support for tracking whether ABM tokens are invalid. - Added Windows MDM profile status tracking and backfilled existing records. - **Maintenance** - Updated database migration identifiers and status records to ensure migrations are applied consistently. - **Tests** - Updated migration verification tests to match the revised migration identifiers. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rajendra Kadam
|
25cfac309c |
Let an edit clear a declaration's activation (#50711)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # Raised by the frontend while building the Edit modal: there was no way to clear a declaration's custom activation. An absent `activation` field meant "keep it" on a labels-only edit but "delete it" when the profile contents were replaced, so clearing wasn't expressible and an ordinary content edit silently dropped the activation. The field is now three-state: | Request | Result | |---|---| | no `activation` key | stored activation left alone | | `activation` as an empty value | removed | | `activation` as a file | replaced | Multipart has no null, so an empty value stands in for one. Note this changes one existing behaviour: replacing a profile's contents without sending an activation used to delete it, and now preserves it. Removal has to be explicit. Anything ambiguous is rejected rather than guessed at, since every ambiguous form would otherwise resolve to deleting the stored activation: | Request | Result | |---|---| | `activation` as a nonempty value | 422 — more likely a malformed upload than a request to delete | | `activation` as a zero-byte file | 422 — a failed upload shouldn't delete anything | | `activation` sent as both a file and a value | 422 — one says replace, the other says remove | The unsupported-profile check also keys on the field being present rather than on it carrying content, so clearing an activation on a Windows, Android or mobileconfig profile is rejected instead of quietly succeeding. On the datastore side, `SetOrUpdateMDMAppleDeclaration` now takes an explicit action (`MDMAppleActivationKeep` / `MDMAppleActivationApply`) instead of inferring intent from the struct. The write is a full replace, so "keep" has to be stated — otherwise preserving the activation would mean reading it back and handing it to the write, which also risked dropping its Fleet variable associations. As a side effect the OS updates cron no longer fires a DELETE for an activation it never had. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually Integration test covers all three states end to end through the multipart decoder, plus service-level tests for preserve and explicit removal. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Apple MDM declaration updates now support preserving, replacing, or explicitly removing activation settings. * Omitted activation fields leave existing settings unchanged, while empty fields remove them. * Apple OS update declarations retain activation settings by default. * **Bug Fixes** * Labels-only updates no longer unintentionally carry forward activation data. * Invalid, empty, or conflicting activation uploads now receive clear validation errors. * Unsupported profile types now reject activation updates. * **Tests** * Added coverage for activation preservation, replacement, removal, and integration scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
51d9f493ef | show user-scope icon for ios and ipados (#50715) | ||
|
|
b5940c8eca |
Bump brace-expansion in /website (#50453)
Bumps and [brace-expansion](https://github.com/juliangruber/brace-expansion). These dependencies needed to be updated together. Updates `brace-expansion` from 2.1.2 to 2.1.4 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/juliangruber/brace-expansion/commit/b25213dff0446d622f97d736420b9830ee1abc32"><code>b25213d</code></a> 2.1.4</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac"><code>1e30c93</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/878df3989e816dfb28cbe0d64de0b88738ff0ed6"><code>878df39</code></a> 2.1.3</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/c8bd93cfff4e45cb295557d2be17e1d1d4e52a11"><code>c8bd93c</code></a> npm ignore .claude</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"><code>d13ff45</code></a> fix: backport GHSA-mh99-v99m-4gvg (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/130">#130</a>)</li> <li>See full diff in <a href="https://github.com/juliangruber/brace-expansion/compare/v2.1.2...v2.1.4">compare view</a></li> </ul> </details> <br /> Updates `brace-expansion` from 1.1.16 to 1.1.18 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/juliangruber/brace-expansion/commit/b25213dff0446d622f97d736420b9830ee1abc32"><code>b25213d</code></a> 2.1.4</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac"><code>1e30c93</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/878df3989e816dfb28cbe0d64de0b88738ff0ed6"><code>878df39</code></a> 2.1.3</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/c8bd93cfff4e45cb295557d2be17e1d1d4e52a11"><code>c8bd93c</code></a> npm ignore .claude</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"><code>d13ff45</code></a> fix: backport GHSA-mh99-v99m-4gvg (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/130">#130</a>)</li> <li>See full diff in <a href="https://github.com/juliangruber/brace-expansion/compare/v2.1.2...v2.1.4">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Luke Heath <luke@fleetdm.com> Co-authored-by: Eric <eashaw@sailsjs.com> |
||
|
Allen Houchins
|
01f9e534f7 |
Fix Genesys Cloud FMA: winget dropped x86, ship x64 MSI (#50742)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually # Details The nightly maintained-apps ingestion job panicked with `failed to find installer for app` on Genesys Cloud: ``` {"time":"2026-08-07T03:17:22.787715966Z","level":"INFO","msg":"ingesting winget app","name":"Genesys Cloud"} panic: ingesting winget app: failed to find installer for app ``` ## Why Genesys.GenesysCloud **2.53.923.0** stopped publishing x86 installers upstream. Previous versions (e.g. 2.51.916.0) shipped two x86 installers (a burn `.exe` and a wix `.msi`); the latest manifest ships only a single **x64** wix MSI. Our input pinned `installer_arch: "x86"`, so the ingester filtered out the only available installer and panicked. ## What changed - `ee/maintained-apps/inputs/winget/genesys-cloud.json`: `installer_arch` `x86` → `x64` - `ee/maintained-apps/outputs/genesys-cloud/windows.json`: regenerated with `go run ./cmd/maintained-apps -slug genesys-cloud/windows` — version 2.51.916.0 → 2.53.923.0, installer URL now the x64 MSI, sha256 matches the winget manifest's `InstallerSha256` ## Notes for reviewers - Exists/patched queries are unchanged (still keyed on ARP `name = 'GenesysCloud'`, `publisher = 'Genesys Inc.'`), and install/uninstall script refs are identical since it's still a machine-scope MSI — detection and remediation carry over for existing installs. - The MSI `UpgradeCode` is unchanged upstream (`{A0E8C487-C337-441C-83AF-90364DA4B793}`), so the x64 MSI upgrades existing x86 installs in place (ProductCode is new, install dir moves from `ProgramFiles(x86)` to `ProgramFiles`). - The new manifest declares a `Microsoft.VCRedist.2015+.x64` dependency (the old x86 MSI declared the x86 variant). Fleet doesn't resolve winget dependencies; the FMA validator run on this PR will confirm whether the installer tolerates its absence. |
||
|
kitzy
|
779704de89 |
Add guide: manage Fleet during a GitOps outage (#50731)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA # Checklist for submitter - [x] Docs-only change (new guide article); no code, tests, migrations, settings, or fleetd/orbit changes. ## Summary Adds a new guide, `articles/manage-fleet-during-a-gitops-outage.md`, covering the business continuity workflow for making urgent changes in the Fleet UI when a CI provider (e.g. GitHub Actions) is down, and how to reconcile the GitOps repo afterward so the next automated run doesn't revert the fix. |
||
|
Dante Catalfamo
|
3c8df41762 |
Deduplicate Android MDM Pub/Sub deliveries and protect against reordering (#49792)
**Related issue:** Resolves #43502 |
||
|
Juan Fernandez
|
e29210e6f6 |
Software inventory & vulnerabilities: Add Adobe plugins
Resolves #45414 - Added Adobe plugins to software inventory: Fleet now detects Adobe Creative Cloud plugins (CEP and UXP extensions) on macOS and Windows hosts and lists them on the Software page and host details with the software type "Plugin (Adobe)", including version and host count. - Adobe plugins are excluded from vulnerability scanning, so no vulnerabilities are reported for them. No vulnerability data source maps an Adobe CEP or UXP extension to a CVE; Adobe files CVEs against the host application (Photoshop, Acrobat, and so on), which Fleet already scans. |
||
|
Noah Talerman
|
1e23b101ae |
API docs tweak: Run ad hoc live report by host identifier (#50722)
- There are more valid host identifiers (not just `uuid`) |
||
|
Amrit
|
c63a7083c6 |
Update README.md (#50695)
Fixing typo and rewording the Purchase a SaaS tool section. |
||
|
Victor Lyuboslavsky
|
3d186bd172 |
Clear the escrowed managed local account password on MDM re-enrollment (#50596)
Fixed unreleased bug where admin password was still shown on a wiped host after re-enrollment. Add a `deleted` column and soft-delete the row on re-enrollment, mirroring host_recovery_key_passwords. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43488 # Checklist for submitter ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Added support for safely retiring managed local account passwords during device re-enrollment. * Retired credentials are excluded from retrieval, status updates, command operations, and automatic rotation. * Successfully escrowing a password can restore a previously retired record. * **Bug Fixes** * Re-enrollment cleanup now clears stale password rotation state. * Cleanup failures stop reset or re-enrollment processing to prevent incomplete credential changes. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
melpikeandEric
|
e6f1abe5a2 |
[Route] Add route for DDM activations learn more page (#50465)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48222 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a redirect from the DDM activations information page to the relevant section of the Custom OS Settings article. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Eric <eashaw@sailsjs.com> |
||
|
Allen Houchins
|
cc9f8e4891 |
Dogfood: drop platform prefix from policy names (#50658)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA The Fleet UI now displays a policy's targeted platform, so repeating it in the policy name is redundant. This strips the leading `macOS - ` / `Windows - ` / `Linux - ` from all 84 prefixed policies in `it-and-security`. ## Collisions GitOps rejects duplicate policy names within a fleet ([`pkg/spec/gitops.go`](https://github.com/fleetdm/fleet/blob/main/pkg/spec/gitops.go#L2020)), and the Workstations fleet includes macOS, Windows, and Linux policies together. 14 stripped names would collide, so for those the platform moves to a trailing suffix instead of being dropped: | Before | After | |---|---| | `macOS - Gatekeeper enabled` | `Gatekeeper enabled` | | `Windows - Secure Boot enabled` | `Secure Boot enabled` | | `Linux - Removable storage is read-only` | `Removable storage is read-only` | | `macOS - Disk encryption enabled` | `Disk encryption enabled (macOS)` | | `Windows - Disk encryption enabled` | `Disk encryption enabled (Windows)` | | `Linux - Disk encryption enabled` | `Disk encryption enabled (Linux)` | 49 policies lose the platform entirely; 35 keep it as a suffix. The 14 suffixed names are: Disk encryption enabled, Sufficient disk space available, User .npmrc min-release-age at least 0.5 days, 1Password installed, Battery healthy, and the 9 patch policies that exist for both macOS and Windows (1Password, Google Chrome, Firefox, Slack, Zoom, Visual Studio Code, Okta Verify, Claude, Adobe Acrobat Reader). Also updates the descriptions of `macos-screen-lock-exclusions` and `windows-screen-lock-exclusions`, which quote policy names. ## Notes for the reviewer - **This is destructive on apply.** GitOps matches policies by name, so applying this deletes the 84 existing policies and creates new ones. Policy pass/fail history and host results reset. Automations defined in the policy YAML (calendar events, install/script triggers) carry over, but anything referencing these names outside the repo — saved filters, dashboards, Slack workflows — needs updating separately. - `tools/fleet-slackbot/system-prompt.js:338` still documents the `<Platform> - <Description>` convention, and the `fleetctl new` macOS template still ships a prefixed name. Both left alone intentionally — out of scope for dogfood config. - Four policy files appear unused by any fleet and were renamed only for consistency: `lib/{macos,windows}/policies/update-claude.yml` and `update-slack.yml`. Their names duplicate entries already in `patch-fleet-maintained-apps.yml` for the same platform. Worth deleting in a follow-up. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. N/A — dogfood GitOps config only, no product code changes. ## Testing - [x] QA'd all new/changed functionality manually Verified locally: - No `macOS - ` / `Windows - ` / `Linux - ` strings remain anywhere under `it-and-security/`. - Every fleet passes the same uniqueness rule GitOps enforces — Workstations resolves to 78 policies with 0 duplicate names; all other fleets unchanged. - All 73 touched/related YAML files parse. - The diff touches only `- name:` lines plus the two label descriptions. |
||
|
Harrison RavazzoloandLucas Manuel Rodriguez
|
32802c5731 |
Fix Google Calendar scheduling over Focus Time and Out of Office events (#50605)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves https://github.com/fleetdm/fleet/issues/50548 Fleet's calendar integration was scheduling maintenance events over users' **Focus Time** and **Out of Office** blocks, even when those were marked Busy. The root cause is the event query in `ListEvents` (ee/server/calendar/google_calendar.go), which only requested `"default"` event types — so `focusTime` and `outOfOffice` events were never returned and never considered during conflict detection. ## Change Added the blocking event types to the query: ```go EventTypes("default", "focusTime", "outOfOffice"). ``` # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. --------- Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> |
||
|
Jordan Montgomery
|
133e4a3832 |
Tweak manual enroll profile permissions (#50688)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Restricted access to manual MDM enrollment profiles to global or team administrators and maintainers. * Prevented unauthenticated, roleless, observer, and GitOps users from viewing enrollment profile data. * Updated authorization documentation to reflect the required permissions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Nick Blee
|
dd0c275974 |
Update deploying-okta-platform-sso-with-fleet.md (#49855)
Changes to Step 2 in both Options 1 & 2. The current documentation Click the *Endpoint Management* Tab and the proposed change is Click the *Device Access* Tab <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
Rajendra Kadam
|
a2aec82466 |
Support custom DDM activations in GitOps (#50557)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49972 Adds custom DDM activations to the GitOps workflow. A profile entry can point at an activation file with a new `activation` key, the batch endpoint validates and stores it through the same code as the single-profile upload, and `fleetctl generate-gitops` exports it back out. ```yaml controls: macos_settings: custom_settings: - path: ./lib/profiles/passcode.json activation: ./lib/activations/passcode.json ``` `activation` is only valid on a declaration (`.json`) profile, and can't be combined with `paths:` because an activation names exactly one declaration. Removing the key removes the stored activation. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Verified on an ADE-enrolled Mac: exported an existing declaration and its custom activation with `generate-gitops`, removed everything by applying a config with no profiles, then re-applied the exported files. All three declarations came back with the correct scopes, the activation attached to only its own declaration, and the predicate was reported correctly on the host. ## New Fleet configuration settings - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) |
||
|
Rajendra Kadam
|
984b09cc7f |
Serve custom DDM activations to devices (#50421)
**Related issue:** Resolves #49971 Serves the custom activations stored by #49970 to devices. Stacked on #50280. - The manifest advertises a custom activation's own identifier; the fetch serves its stored JSON with the predicate intact. Secrets and host variables are expanded at delivery, like configurations. - `activation_updated_at` folds into the token, so editing only a predicate re-syncs the host even though the declaration's content didn't change. - Management declarations are served under the manifest's `Management` section, have their own endpoint, and report status. - Predicate outcomes map per the Figma dev note: `Info.Predicate` → verified with an explanation, `Error.ActivationFailed` → failed. ### Three things to look at **Generated activations are renamed to `<declaration uuid>.activation`.** Removes the collision between an admin-chosen identifier and one Fleet generates, and collapses the fetch into a single lookup rather than match-then-trim. Note this differs from the CoS wording of "byte-for-byte identical to today". Existing hosts will see their activations renamed once. The sync token doesn't move for the rename alone — activation identifiers aren't part of it, confirmed in `MDMAppleDDMDeclarationsToken` — so it happens lazily on the next real DDM change rather than all at once. **`activation_updated_at` is not the `max()` the issue describes.** The issue asks for `max(activation uploaded_at, latest variable change)`. Variable changes stay on `variables_updated_at`; this is `GREATEST(uploaded_at, secrets_updated_at)`. Same outcome, since `EffectiveDDMToken` hashes all the timestamps together, but each signal stays independently comparable, which is what keeps the reconciler idempotent. **The token is computed in three places, not two.** SQL in `MDMAppleDDMDeclarationsToken`, Go in `EffectiveDDMToken`, and a third independent copy building the manifest-level token in `handleDeclarationItems`. All three now carry the new term in the same order. `ActivationUpdatedAtFoldsIntoToken` asserts the SQL and Go agree with it populated — they only agreed for the nil case before. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Tested on an ADE-enrolled Mac (macOS 26.5.1) against a local server: the custom activation is advertised and fetched by its own identifier, an activation-only edit re-syncs the device even though the declaration is unchanged, a true predicate enforces the policy on the host, and a false one comes back verified with the explanation. That turned up two bugs, both fixed here and both invisible to the test suite: - `MDMAppleStoreDDMStatusReport` computed the matching token with `activation_updated_at` but never selected the column, so it was always nil. Every status report was silently dropped and profiles sat in verifying forever. - Apple splits a predicate outcome across two arrays — the activation reports `Info.Predicate`, the configuration it gates reports `Error.ActivationFailed`. Reading only the configuration made a host the predicate excluded look failed. Now correlated via the activation identifier in the failure details. The test payloads for the second one are the real reports the Mac sent, not hand-written. Note for anyone testing in the UI: the OS settings tooltip for a verified profile is hardcoded to "The host applied the setting. Fleet verified." and doesn't read `detail` yet, so a predicate-excluded profile reads wrong there. Backend stores the right message; rendering it is #49973. New cases in `apple_mdm_ddm_test.go`: the token agreement above; a custom activation advertised and served with its predicate, with the generated name no longer resolving for it; a declaration without one still getting the synthesized activation; management routing plus the endpoint type guard; the three predicate status outcomes; and a host outside a declaration's scope getting an empty manifest and an error fetching the activation by name. 13 existing assertions moved from `<identifier>.activation` to `<uuid>.activation`. The `GeneratedActivationStillServedWhenNoCustomOne` case caught a real bug on its first run: the `LEFT JOIN` returns NULL for declarations without a custom activation, which `json.RawMessage` can't scan, so every non-custom activation fetch would have 500'd. That's the no-regression path. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Apple DDM management declarations and custom activation delivery. * Added host-scoped activation resolution, activation identifiers, and activation update timestamps. * Added support for activation variables, secrets, assets, and separate management and configuration endpoints. * **Bug Fixes** * Declarations are now redelivered when activation predicates change or are removed. * Improved status reporting for predicate exclusions, activation failures, and management declarations. * Improved synchronization token updates when variables, assets, or activations change. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Noah TalermanandRachael Shaw
|
f434789706 |
Remove obsolete links from REST API documentation (#50589)
Removed outdated sections from the REST API documentation. We're not consistently adding new ones like "Vulnerabilities" and I don't think the website uses these. Co-authored-by: Rachael Shaw <r@rachael.wtf> |
||
|
RachelElysia
|
790b240bee | Fleet UI: Fix stretched software table headers on empty refetch (#50613) | ||
|
kitzyandRachael Shaw
|
7d59390b5c |
Document custom host vitals support for Host vitals labels (#50661)
**Related issue:** N/A ## Summary Fleet's "Host vitals" label type already supports matching on a custom host vital's exact value (in addition to the existing IdP-based criteria), but this wasn't documented anywhere outside the custom host vitals guide (see companion PR #50660). Adds that coverage across the remaining references: - `articles/managing-labels-in-fleet.md`: the "Host vitals" label type bullet only listed the two IdP criteria; now also mentions custom host vitals, and notes the type is exact-match only. - `docs/Configuration/yaml-files.md`: - Adds a `custom_host_vital` example to the labels GitOps reference, alongside the existing IdP example. - Adds a new `## custom_host_vitals` section documenting the top-level GitOps key used to define vitals in the first place (referenced by the labels criteria above), which had no reference-doc coverage at all. Calls out that, unlike `labels`, omitting the key entirely deletes every existing custom host vital rather than leaving them intact. - `docs/REST API/rest-api.md`: - The `criteria` parameter table was missing `custom_host_vital` as a valid `vital` value and missing `custom_host_vital_id` entirely — added both. - None of the 6 registered custom host vitals endpoints (list, create, update, delete, set a host's value, and the spec/replace-all endpoint GitOps uses) had reference entries at all. Adds a full "Custom host vitals" section following the existing "Custom variables" section's format, including the same destructive replace-all behavior called out in the YAML reference above. # Checklist for submitter - [ ] QA'd all new/changed functionality manually --------- Co-authored-by: Rachael Shaw <r@rachael.wtf> |
||
|
Mike McNeil
|
e0ab271ff1 | Handbook: Add Meraki deck (#50697) | ||
|
LeAnn
|
7e22e9f811 |
Add route for manual sync guide (#50693)
**Related issue:** #50001 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a redirect from the Android manual sync learn-more page to the updated setup guide. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kitzy
|
5d8f7e26e1 |
Docs: correct GitOps mode label editing behavior and document exceptions (#50552)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #50551 Two published pages still describe pre-4.84 behavior, telling users that GitOps mode doesn't restrict label editing in the UI. Since 4.84 that's only true when the labels exception is enabled. This PR corrects both pages and documents the exceptions framework. **`docs/Configuration/yaml-files.md`** - `labels` section: rewrote the note around the two exception states. Beyond the sentence the issue flagged, the premise it rested on was also stale: the note said omitting the `labels` key leaves existing labels intact. Since #42191, `computeLabelChanges` (`cmd/fleetctl/fleetctl/gitops.go:947`) branches on `len(specifiedLabels) == 0`, so omitting the key deletes every custom label in that scope unless the labels exception is enabled. Its own tests name this behavior ("labels omitted removes all regular labels when not excepted"). The note now spells out both states and fixes a `label` / `labels` typo. - `gitops` section: added a note that exceptions can't be set in YAML. `Client.DoGitOps` strips the `exceptions` key defensively (`server/service/client.go:726`), so this was worth stating explicitly. **`articles/gitops-mode.md`** - Added an "Exceptions" section covering the three exception types, what an exception does to both the UI and `fleetctl gitops`, and the enroll secrets default. Upgrade behavior is left to the release notes. It notes that exceptions affect `fleetctl gitops` whether or not GitOps mode is on, since neither the apply-path check nor `computeLabelChanges` reads `gitops_mode_enabled`. - "Still available" no longer lists "Add and edit labels" unconditionally. It now points at the exceptions section for labels, software, and enroll secrets. Behavior the docs now match: - UI gating is `GitOpsModeTooltipWrapper` with `entityType="labels"` (`frontend/pages/labels/components/LabelForm/LabelForm.tsx:172`, `NewLabelPage.tsx:676`, `HostsFilterBlock.tsx:223`). `useGitOpsMode` treats an enabled exception as GitOps mode being off for that entity. - Apply-path enforcement is in `server/service/client.go:2219-2242` (premium only). - Defaults: `server/fleet/app.go:1216` for new installs, migration `20260323144117_AddGitOpsExceptionsToAppConfig.go` for upgrades. The backend is unchanged and was already correct. `ModifyLabel` applies no GitOps check, and the per-host label endpoints stay available regardless of GitOps mode or exception state, so this PR is docs-only. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. Not applicable: documentation-only change, no product behavior change. ## Testing - [x] QA'd all new/changed functionality manually Verified the described behavior against the UI gating, the `fleetctl gitops` apply path, and the exception defaults in code (references above). |
||
|
HemachandarandCarlo
|
3e15c17de8 |
Add FLEET_DEV_SKIP_S3_CONFIG to skip setting up S3 in dev mode (#49868)
**Related issue:** Resolves #39896 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added an option to skip local S3 configuration defaults when running the server in development mode. * Development startup can now avoid creating test S3 buckets when the option is enabled. * **Bug Fixes** * Preserved existing development S3 setup behavior when the option is not enabled. * **Tests** * Added coverage for skipped S3 setup and default development S3 configurations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Carlo <1778532+cdcme@users.noreply.github.com> |
||
|
Siddharth KhengareandRachelElysia
|
7eb8838815 |
Use EmptyState for configuration profiles empty state #49461 (#49772)
--------- Co-authored-by: RachelElysia <71795832+RachelElysia@users.noreply.github.com> |
||
|
Magnus Jensen
|
cef60cee25 |
support management in osquery-perf DDM and update stats output (#50561)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #50282 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. (Part of a bigger story) - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added support for tracking and reporting management declarations alongside other device management statuses. - Added success and error metrics for management declaration processing. - Included management declarations in synchronization, caching, and status reporting across device and user channels. - **Improvements** - Updated performance output with clearer, structured sections for host, MDM, DDM, Android, and PSSO metrics. - Added consolidated reporting for management declaration activity. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
49bf85c54d |
Windows managed local account: design feedback on the Users tab and error tooltip (#50675)
Fixes from @melpike's feedback. Keep the Windows tab visible when Windows MDM is off rather than hiding it, and disable Create hidden admin with a tooltip pointing at Windows MDM, matching how the macOS tab already behaves. - Extracted `TurnOnMdmTooltipWrapper` to reduce code duplication Reword the password-policy error fleetd reports so it reads as sentences. The whole string is generated by Fleet, not by Windows, and it is now shown to admins verbatim in the Show managed account tooltip. Left-align that tooltip. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43488 # Checklist for submitter ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Windows account setup remains visible when Windows MDM is unavailable. * Added guidance for enabling Apple or Windows MDM when required. * Managed-account error tooltips now show detailed failure information when available. * **Bug Fixes** * Prevented unavailable managed-account options from being selected. * Improved Windows account error messages and password-policy wording. * Improved visual feedback for disabled actions in dropdown menus. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
afc7f5d443 |
Remove comment on CLI capabilities (#50685)
Removed comment about CLI capabilities in Info.plist <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Removed an internal explanatory comment from the macOS application configuration. * No user-visible functionality or capability settings were changed. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Nico
|
efa8775ea7 |
Fix policy automations table dropping rows for multi-host automation runs (#50684)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #50683 The policy details page's Automation runs table showed the correct run count but rendered only one row when a single automation run covered multiple hosts (e.g. a failing-policies webhook batch): rows are (activity, host) pairs, so batch rows share an activity id, and the table's default row.id keying collapsed the duplicates. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually #### Before <img width="810" height="274" alt="Screenshot 2026-08-06 at 11 36 27 AM" src="https://github.com/user-attachments/assets/c55a54c0-5d9b-4945-b712-c2449f3a4a8c" /> #### After <img width="1467" height="510" alt="Screenshot 2026-08-06 at 11 23 41 AM" src="https://github.com/user-attachments/assets/d0e560a3-0270-49aa-989d-0812fd156813" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed policy automation activity tables so activities with the same ID are displayed as separate rows for each host. * Corrected total run counts shown for host-specific activity rows. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Dhvanit
|
a6b541d029 |
Fix error handling on the os_versions API endpoint (#49899)
**Related issue:** Resolves #49483 ## What & why The `/os_versions` API endpoint returned misleading success responses for three invalid inputs. This PR makes each return a proper error: 1. **Invalid `platform` filter** (e.g. `?platform=notrealplatform`) previously returned `count: 0` with `200 OK`, indistinguishable from "no matching OS versions." It now returns a `422` validation error listing the supported platforms (`darwin`, `windows`, `linux`, `chrome`, `ios`, `ipados`, `android` — matching the documented filter values). 2. **Unknown OS version id** (e.g. `/os_versions/99999`) previously returned `200 OK` with a null/zero-filled `os_version` object. It now returns a not-found (`404`) error. 3. **Negative `max_vulnerabilities`** (e.g. `?max_vulnerabilities=-5`) returned a message reading `must be >= 0` — Go's JSON encoder HTML-escapes `>`. The message is reworded to `max_vulnerabilities cannot be negative`, which is clearer and avoids the escaped character. ### ⚠️ Note for reviewer (fix #2) The single-version handler previously swallowed the datastore's not-found error and returned an empty result on purpose, with the comment: *"It is possible the os version exists, but the aggregation job has not run yet."* This PR removes that swallow so a missing id returns `404`. If you'd prefer to preserve the empty-result behavior for the "not yet aggregated" case, I'm happy to adjust — flagging so the change is intentional and visible. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented. ## Testing - [x] Added/updated automated tests (`TestOSVersionsErrorHandling` in `server/service/hosts_test.go`, covering all three cases). - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Unsupported OS platform filters now return a clear validation error instead of an empty-like result. * Unknown OS version IDs now return HTTP **404 Not Found** rather than a success response with null/zero fields. * `max_vulnerabilities` validation now rejects negative values with an accurate, readable message and consistent HTTP **422** responses. * Error responses for OS versions endpoints now reflect the correct status codes. * **Tests** * Updated and added coverage to assert the new error-handling and HTTP status expectations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
ec59e20971 |
Regenerate Fleet Desktop FMA manifests for v1.4.0 (#50674)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA — follow-up to #49910 ## What changed Regenerates `api/fleet-desktop.json` and `outputs/fleet-desktop/darwin.json` for Fleet Desktop v1.4.0. No cask changes. ## Why #49910 bumped `Casks/fleet-desktop.rb` to 1.4.0 but never ran `regenerate.sh` or the ingester, so the generated manifests — the files Fleet actually serves — were still on 1.3.4 and still pointed at the old `allenhouchins/fleet-desktop` GitHub release URL. That release feed is stale (it stops at v1.3.4); 1.4.0 is hosted at `download.fleetdm.com`. The `.rb` bump had no effect in production, and nothing in CI catches this kind of drift. This was found during a routine custom-tap maintenance pass. All four casks (druva-insync, fleet-desktop, xcreds, zoom-rooms) are at their latest upstream versions, so this is the only change needed: | Cask | Version | Upstream | | |---|---|---|---| | druva-insync | 8.1.3,110967 | `inSync-8.1.3r110967` | current | | fleet-desktop | 1.4.0 | 1.4.0 (1.4.1 → 404) | **manifests were stale** | | xcreds | 5.9,9148 | `tag-5.9(9148)` | current | | zoom-rooms | 7.1.5.13403 | `cdn.zoom.us/prod/7.1.5.13403/` | current | ## Notes for reviewers Verified the 1.4.0 installer against the cask stanzas before regenerating: - sha256 of the downloaded pkg matches the cask's `c920b983…` - receipt id `com.fleetdm.fleet-desktop` (from `PackageInfo`) matches both the `pkgutil:` and `quit:` stanzas - `CFBundleShortVersionString` is `1.4.0`, matching the cask version — so the `patched` query won't produce a perpetual false "Update available" - the `pkg` stanza filename `fleet_desktop-v1.4.0.pkg` matches the downloaded filename `regenerate.sh` rebuilds all four api JSONs; only fleet-desktop changed, so there was no brew schema drift to absorb on the others. The `install_script_ref` changes (`5d021f75` → `0341b271`) only because the pkg filename inside the script changed; `uninstall_script_ref` is unchanged. Unrelated, not addressed here: brew emits a deprecation warning on three casks for `depends_on macos: ">= :ventura"` (string comparison) vs `depends_on macos: :ventura`. It doesn't affect the generated JSON. # Checklist for submitter - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes This is a macOS-only FMA manifest regeneration — no Go code, no schema, no fleetd/orbit runtime changes. The remaining template sections (changes file, SQL/input validation, timeouts, automated tests, migrations, config settings, fleetd compatibility/auto-update) don't apply; prior custom-tap bumps (#49563, #50651) likewise carry no changes file. |
||
|
Carlo
|
aac22ec9bc |
Align software installer authorization (#50630)
Software title details now return installer scripts and managed app configuration only to users who can read the installer. Uninstalling software from the My device page now applies the same self-service and label scope rules as installing. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security & Permissions** * Restricted installer scripts, managed-app settings, and related configuration to authorized viewers. * Preserved package metadata while hiding sensitive installation details from unauthorized roles. * Improved access handling for requests without an assigned team or involving inaccessible fleets. * **Bug Fixes** * Updated device-initiated software removal to honor self-service eligibility and label scope. * Added clearer errors when software is unavailable for self-service or outside the device’s scope. * Prevented software titles from inaccessible fleets from appearing in results. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gray Williams
|
50e340953d |
Fixes broken links in 4.90.0 release notes (#50676)
Fixes the custom host vitals and rename hosts learn more links |
||
|
kilo-code-bot[bot]andkiloconnect[bot]
|
7dbf2d4110 |
Add export control blockquote to Trust section (#50673)
Adds an **Export control** blockquote in the `### Trust` section of `handbook/company/communications.md`, immediately after the existing Compliance blockquote. Fleet conforms to the export-control restrictions applicable to ECCN 5D992.c classification. This blockquote documents the countries and regions where Fleet does not currently do business. Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com> |
||
|
Lucas Manuel Rodriguez
|
58a7679144 |
Add support for nested Entra groups in IdP vitals (#50469)
Resolves #48886. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [X] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [X] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [X] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for nested groups in Entra IDP vitals. * SCIM groups can now include child groups and resolve membership across multiple levels. * Host filters and group-based access now account for inherited group memberships. * Added validation and duplicate prevention for nested group membership updates. * **Bug Fixes** * Corrected membership updates and removals to keep nested group relationships synchronized. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
479c4da287 |
AULD: Backend OS update cron + variable resolution (#50573)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #47715 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added automatic Apple OS update synchronization and reconciliation. * Apple devices can receive targeted minimum OS versions and enforcement deadlines. * Host details now display applicable Apple OS update requirements. * Updates are selected based on device compatibility, platform, and team configuration. * Cached update information is refreshed and stale entries are removed. * Pending targets are retried, with declarations resent when resolved. * **Bug Fixes** * Improved handling of unavailable targets and unsupported devices. * Prevented unresolved update declarations from being incorrectly marked as failed. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
melpike
|
392f62dc08 |
[Route] Add route for Linux disk encryption guide (#50191)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48654 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a redirect from the Linux disk encryption information page to the relevant enforcement guide section. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordan Montgomery
|
5813dd268b |
47865: Update exclude/include all label logic for unknown label status (#50493)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #47865 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Improved MDM profile and declaration reconciliation for Android, Apple, and Windows devices when dynamic label membership is temporarily unknown. - Existing installations are preserved while awaiting authoritative label results. - New installations are withheld until label membership is confirmed. - Confirmed label changes continue to trigger the appropriate installation or removal actions. - Improved handling of combined include and exclude label rules. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
658ebbf509 |
Frontend: Windows managed local account (#50241)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48722 Demo: https://www.youtube.com/watch?v=zm5WmJY-o4Y # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Windows support for creating and managing local administrator accounts. * Added a Windows-specific option in user setup when Windows MDM is configured. * Added managed-account actions and status visibility for Windows hosts. * Added guidance noting that this feature requires `fleetd` 1.60.0 or later. * **Improvements** * Updated local account descriptions, help text, and authentication guidance. * Improved managed-account status and password-rotation messaging. * Added clearer feedback when account creation or password escrow is pending. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gray Williams
|
89bd24ae4a |
Create ubuntu and windows healthcheck scripts (#50128)
Adds scripts for Windows and Ubuntu that checks the health of all fleetd components and collects logs and recent events into a timestamped archive for support and troubleshooting. These have been used by multiple customers now, and has simplified the collection of logs from multiple locations while including events that can assist with troubleshooting. Adding to solutions for wider use. |
||
|
Jordan Montgomery
|
600fbf461d |
Update fleet desktop FMA to v1.4.0 (#49910)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45524 Release alongside v4.90.0 release. Don't release prior FMA update of Fleet Desktop macOS to 1.4.0 https://github.com/fleetdm/fleet/actions/runs/30112916197 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Updated the Fleet Desktop Homebrew cask to version 1.4.0. * Downloads now use the official Fleet Desktop distribution URL. * Updated the project homepage reference. * **Maintenance** * Adjusted automatic update detection to use manual, release-based versioning. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
fleet-releaseandallenhouchins
|
cfe2a08269 |
Update Fleet-maintained apps (#50651)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added the latest available releases for a broad range of macOS and Windows applications, including Signal, AWS VPN Client, WebStorm, Zed, Filebeat, Loom, Ollama, and others. * Updated installer details and verification checks to support reliable installation of current versions. * **Bug Fixes** * Improved removal behavior for selected applications, including cleanup of background services, cached data, recent documents, and related components. * Updated uninstall handling for applications with changed installer identifiers. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
Luke Heath
|
e2ce259bae | Cherry-pick #49582: Adding changes for Fleet v4.90.0 (#50652) | ||
|
Noah Talerman
|
39d57caa09 | Release article: Fleet 4.90.0 (#50240) | ||
|
Rachael Shaw
|
bfa766e9b7 | v4.90.0 doc changes (#48141) |