418fd60e9ca4a2d41a0c19afba5f44bbce3f10ce
26437
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 LeAnn
|
418fd60e9c |
Clarify "Not supported" on Hosts page by adding tooltip (#49301)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #39987 - Added tooltips to the "Agent," "Last restarted," and "Status" column headers on the Hosts page explaining which platforms are supported and why. - On the Host details page, vitals with a "Not supported" value are now hidden instead of shown. - Fixed the "Last restarted" vital showing on ChromeOS hosts, where it's not actually collected. - Updated the "Last opened" tooltip on the Host details Software table to explain why it's only supported for native macOS, Windows, and Linux apps and packages. - Remove cellProps.rows.length === 1 workaround (which suppresses the tooltip whenever the table has exactly one row) by adding the correct CSS which removes the tooltip overflowing if host table is only 1 row # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added/updated explanatory tooltips for Hosts table column headers (Agent, Last restarted, Status) with clearer supported-platform wording. - Clarified “Last opened” tooltip scope to native macOS, Windows, and Linux app/package entries. - **Bug Fixes** - Removed “Last restarted” from Host details for ChromeOS hosts when the value isn’t collected. - Prevented vitals rows from rendering when their values resolve to “Not supported,” and tightened “Last restarted” platform visibility. - Fixed tooltip overflow/positioning in the single-row Host software table case. - **Tests** - Updated and expanded vitals/header coverage to match the new display rules. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Carlo
|
5250936179 |
Consistent URL/email on-blur validation across forms (#40410 follow-up) (#49932)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #40410 Follow-up to #48854, which added on-blur validation to the software vulnerability automations webhook. QA found three more forms with inconsistent validation, in two flavors: - **Validated only on save** (no on-blur feedback): Policies > Manage automations > Other workflows > Destination URL. - **Errored before any input** (validation fired on mount/enable): Settings > Users > Add/edit user > Email, and the host status webhook Destination URL (both global and fleet settings). This makes them consistent with the rest of the app: no error on open/enable → validate on blur → clear the field's error as the user edits → validate on submit. - `OtherWorkflowsModal` — added an on-blur handler for the Destination URL (guarded by the field's disabled condition). - `UserForm` — on-blur now validates only the blurred field (so blurring the autofocused Name no longer flags the empty Email/Password); submit validates all fields. - `GlobalHostStatusWebhook` — removed the `useEffect` that validated the moment the webhook was enabled; validation now runs on blur and submit. - `TeamSettings` (fleet host status webhook) — the Destination URL error is no longer surfaced on change/enable; it validates on blur and submit. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated (URL and email fields validate on blur and on submit; no errors are shown before the user interacts). ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved webhook destination URL validation across integrations, team settings, and workflow automation forms. * Validation messages now appear after leaving the URL field, rather than prematurely while enabling or editing. * Prevented saving or submitting forms with missing or invalid destination URLs. * Correctly clears validation errors once a valid URL is entered. * Improved user form validation so field-specific errors appear only for the field being reviewed, while submit continues to validate the full form. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Eric
|
8b8064e44d |
Website: update primary cta on homepage (#50071)
Changes: - Updated the primary cta on the homepage to "Try it yourself" <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Updated homepage calls to action to encourage visitors to try the product directly. * Added a “Try it yourself” option to the bottom CTA section. * Retained the “Get a demo” option as the final CTA button. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
ffc85a42ae |
Add Windows admin account config (#49863)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48720 Subtask of https://github.com/fleetdm/fleet/issues/43488 This PR only adds the Windows config, and doesn't mess with macOS configs. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added managed local account settings for Windows to app and team configuration, including GitOps support. * Exposed an explicit enabled/disabled toggle in configuration output and Fleet controls. * Added licensing and Windows MDM prerequisites for enabling the setting. * **Bug Fixes** * Managed local account enable/disable actions are now correctly persisted and declaratively applied. * Activity feed messages now display platform-specific (macOS vs Windows) wording. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel RodriguezandAllen Houchins
|
4b8a8435af |
Amend Docker Desktop patch policy SQL (#50041)
My workstation has Docker Desktop 4.84.0 (latest as of today) and was incorrectly failing the "macOS - Docker Desktop up to date" patch policy. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Improved Docker Desktop patch-status detection on macOS by excluding application paths containing `.back` anywhere in the path, avoiding incorrect patching of nested/backup bundles. - **Improvements** - Enhanced Docker Desktop install and uninstall cleanup to remove stale `Docker.app.back` artifacts and related staged in-progress update copies (including cleanup during upgrade timing). - **Tests** - Updated macOS Docker Desktop ingestion/patched check expectations to match the new `.back` path filtering behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Allen Houchins <allenhouchins@mac.com> |
||
|
Noah Talerman
|
c715d1c8e4 | 'Unpacking the why' issues live in inbox on product group boards (#50066) | ||
|
Noah Talerman
|
ef21534c3f |
Pushed stories: Notify customer success only if ~activation-blocker or ~customer promise (#49982)
- Why? https://fleetdm.slack.com/archives/C02A8BRABB5/p1785167309299099?thread_ts=1785160865.854089&cid=C02A8BRABB5 - Also move to one section in "Product groups" to de-duplicate |
||
|
Mike Thomas
|
3a81ede6cb |
Website: rename "Reporting" pricing feature for clarity (#50035)
## Summary Renames "Reporting" on /pricing to "Report on groups of devices" and updates the description for accuracy — it was easily confused with the "Reports" feature listed just above it. ## Related - fleetdm/confidential#16974 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for generating reports scoped to specific fleets of devices instead of the entire deployment. * Updated the pricing features table to reflect fleet-level reporting capabilities. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sharon KatzandLucas Manuel Rodriguez
|
24e64614aa |
Fix resource exhaustion in MSI metadata parser (#49739)
Resolves https://github.com/fleetdm/confidential/issues/16902 - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Reproduction **Attack vector:** An authenticated Fleet admin uploads a crafted `.msi` file via the software upload API. The server's MSI metadata parser (`pkg/file/msi.go` > `ExtractMSIMetadata` > `decodeStrings`) processes the file's `_StringPool` and `_StringData` streams during upload. A malicious `_StringPool` can claim arbitrarily large string sizes that trigger speculative memory allocation before the actual data is read. **Manual reproduction:** Wrote a standalone Go program that constructs the two raw byte streams the parser consumes (a 12-byte `_StringPool` claiming a 64 MB string, and an empty 0-byte `_StringData`), then measures heap allocation via `runtime.MemStats` before and after calling the vulnerable code path. **Before fix (vulnerable):** ``` Pool input size: 12 bytes StringData size: 0 bytes Claimed string size: 67108864 bytes (64 MB) Error returned: failed to read string data: EOF Heap allocated: 67117016 bytes (64.0 MB) Amplification: 12 input bytes -> 67117016 byte allocation (5593084x) ``` 12 bytes of pool input forced a 64 MB heap allocation via `buf.Grow()` before `io.CopyN` discovered there was no data to read. **After fix:** ``` Error returned: failed to read string data: EOF Heap allocated: 3072 bytes (3.0 KB) Memory amplification eliminated: true ``` Same input, 3 KB allocated instead of 64 MB. Without the speculative `buf.Grow()`, `io.CopyN` grows the buffer incrementally based on actual available data and immediately hits EOF. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Fixed a potential resource exhaustion issue when processing MSI metadata with unusually large string-size declarations. - MSI files with missing string data are now handled without excessive memory allocation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> |
||
|
Lucas Manuel Rodriguez
|
f674cf145c |
Update tools/telemetry (#50043)
Had to use `tools/telemetry` to smoke test https://github.com/fleetdm/fleet/pull/49957. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Enhancements** * Updated telemetry collection to use the standard OpenTelemetry Collector image. * Improved trace forwarding to Jaeger and added clearer diagnostic output. * Reworked span-to-metrics processing for more reliable telemetry metrics. * Updated telemetry endpoints and pipeline routing for improved connectivity. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
1f2ca668f8 |
Fix flaky test TestCheckExecRealBinary (#50057)
Fixes flaky test found in nightly run: https://github.com/fleetdm/fleet/actions/runs/30330273165. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Improved execution checks to tolerate transient busy-file errors during retries. * Strengthened validation for both healthy and corrupted binaries, ensuring tests report the intended result. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
RachelElysia
|
0585ab68d1 |
Website: Handle unexpected responses from Microsoft's compliance and Graph APIs (#50015)
## Issue #50013 ## Description The Microsoft compliance proxy controller (`website/api/controllers/microsoft-proxy/receive-redirect-from-microsoft.js`) called `JSON.parse` on response bodies from Microsoft's Partner Compliance and Graph APIs without checking for empty bodies or unexpected response shapes. When Microsoft returned an unexpected response — for example, a 2xx status with an empty body, which can happen on partial-setup tenant states or when API permissions on the enterprise app haven't been fully consented — the controller threw a raw `SyntaxError: Unexpected end of JSON input` that surfaced verbatim in the Fleet UI as the `setup_error` string, giving admins a Node.js stack trace instead of a useful message. Changes: - Added explicit empty-body checks before `JSON.parse` at both API-response parse sites, with a friendly `setup_error` message pointing at the likely causes (partial setup / missing API permissions). - On parse failure, expanded the diagnostic log to include response status code, body length, and a 200-char body snippet so we can diagnose future occurrences from server logs instead of asking admins to reproduce. - Added defensive checks on `parsedPoliciesResponse.value` and `parsedGroupResponse.value` before indexing — previously `parsedPoliciesResponse.value[0].Id` would throw `TypeError` if Microsoft returned a well-formed response missing the expected shape. **Note for reviewers:** The new `sails.log.warn` calls interpolate the runtime tenant ID (`informationAboutThisTenant.entraTenantId`) — same pattern as the existing log at line 209 that logs `fleetInstanceUrl`. Heroku logs will contain tenant IDs when these error paths fire, which is intentional so infra can grep by tenant when triaging. If we'd rather rely on request-correlation IDs and keep tenant IDs out of logs, happy to make that a follow-up. ## Screenrecording ## Testing - [ ] Sanity-checked locally by inducing an empty response body - [ ] Verified no changes to the happy-path flow - [ ] Verified existing setup_error strings that the Fleet UI checks for (admin-did-not-consent, missing-conditional-access-group) are unchanged <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved Microsoft integration setup handling when API responses are empty, invalid, or missing expected data. * Added clearer setup error messages for missing policies or the “Fleet conditional access” group. * Enhanced diagnostics to help identify response-related setup failures. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
95008e853d |
Freeze the macOS Yubikey Manager FMA (#50054)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** N/A Pins the macOS Fleet-maintained app for Yubikey Manager at its current output version, `1.2.5`, by setting `"frozen": true` on the Homebrew input. - `ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json` — added `"frozen": true` The flag is read by the ingester into the manifest ([`homebrew/ingester.go`](https://github.com/fleetdm/fleet/blob/main/ee/maintained-apps/ingesters/homebrew/ingester.go)) and then consumed in two places: - [`cmd/maintained-apps/main.go`](https://github.com/fleetdm/fleet/blob/main/cmd/maintained-apps/main.go) skips overwriting `outputs/yubico-yubikey-manager/darwin.json` when the output file already exists, so the published version, installer URL, SHA256, and patch-policy query stop moving. - [`cmd/maintained-apps/validate/main.go`](https://github.com/fleetdm/fleet/blob/main/cmd/maintained-apps/validate/main.go) skips the app entirely during validation. `frozen` is tagged `json:"-"` on the manifest struct, so it does not appear in the output JSON — that file is intentionally left untouched by this PR. The Windows FMA (`inputs/winget/yubico-yubikey-manager.json`) is deliberately **not** frozen and continues to update. ## Note for reviewers While preparing this change I found that the `yubico-yubikey-manager` cask has been **removed from homebrew-cask**: ``` https://formulae.brew.sh/api/cask/yubico-yubikey-manager.json → 404 ``` The full cask list now contains only `pallotron-yubiswitch`, `yubico-authenticator`, and `yubihsm2-sdk`, and the token is not present in `inputs/homebrew/custom-tap/` either. This matches upstream: Yubico discontinued `yubikey-manager-qt` (the 1.2.5 installer this FMA pins) in favor of Yubico Authenticator. **Freezing does not resolve that 404.** The ingester fetches cask metadata *before* the frozen flag is applied, so the scheduled "Update Fleet-maintained apps" workflow is still expected to fail for this app with: ``` panic: ingesting homebrew app: app not found in brew API ``` Fully resolving that would mean removing the macOS FMA, the way #50050 did for Nocturnal (input, output, `apps.json` entry, frontend icon + mapping, website PNG). This PR is scoped to the freeze only, per the request; the removal can be a follow-up if that is the direction we want. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually — confirmed the edited input still parses as JSON, and traced the `frozen` flag through the ingester into both the output-write skip and the validation skip. No automated tests were added; this is a single data-file flag with no new code paths. --------- Co-authored-by: Kitzy <kitzy@kitzy.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
|
210b716d20 |
Add guide: Speeding up your GitOps runs in Fleet (#46516)
## Summary - Adds a new guide article covering three strategies to reduce Fleet GitOps run times: path-based `include` references, Fleet-maintained apps (FMAs), and ETag-based conditional downloads for custom packages. - Aimed at Fleet users managing large deployments who want to optimize their CI/CD pipeline performance. ## Changes - New file: `articles/speeding-up-your-gitops-runs-in-fleet.md` --- Built for [Mike McNeil](https://fleetdm.slack.com/archives/C04K44UAPB9/p1780119889099049?thread_ts=1779840298.690529&cid=C04K44UAPB9) by [Kilo for Slack](https://kilo.ai/slack) --------- Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com> Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com> |
||
|
Jonathan Katz
|
b99e5564e9 |
GitOps schema generator and IDE integration (#49717)
### Summary: Generates a json schema for valid GitOps yaml files, to be used with [yaml-language-server](https://github.com/redhat-developer/yaml-language-server) for IDE integration. This PR includes the actual generated file, so it can be used without running the tool. All files are in `/tools/gitops-autto-complete`, so nothing else gets affected. #### What it adds: - Complete json schema that defines valid GitOps yaml files and can be integrated with [yaml-language-server](https://github.com/redhat-developer/yaml-language-server). - Auto-completion, error checking, type checking, descriptions. - Defines all keys for osquery options/flags (based on `server/fleet/agent_options_generated.go`). - Additional validation: required keys, strings that must be enclosed in quotation marks, path support. - Additional data: descriptions from code comments, notices for fields that don't reset if null or empty. #### Limitations: - Some structs and data are duplicated into the tool and will inevitebly mismatch over time, because the structs used for gitops are not sufficient for the schema generation: - Some fields use an interface/any type that so can't be used for the schema generation. - Some important details are not encoded in the type or struct tags for gitops fields at all. - Some details (like required fields) are encoded in the Validate() interface, but the IDE integration cannot run Go code. - Doesn't work with all yaml file types used for gitops (like a yaml file that specifies multiple software packages), only the default/fleet level files. This will require having a subsection of the schema for each type of file, and some way to detect what it actually is (maybe specifying the schema in the file itself). - Requires manual setup to integrate with IDE, it's not an easy to use extension currently. #### Dependencies: - `invopop/jsonschema` reflects Fleet's GitOps structs into the schema. - `santhosh-tekuri/jsonschema/v6` validates the test fixtures against that schema. - `ghodss/yaml` decodes the fixture YAML the way fleetctl does. https://github.com/user-attachments/assets/b6ffacd0-e602-41a2-b46a-7d10300c6ea5 ## Testing - [x] QA'd all new/changed functionality manually - I have been using and working on this for the past week so it's in a pretty good state, but some descriptions or keys are probably still missing. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added GitOps YAML auto-completion powered by a comprehensive JSON Schema. * Added validation for GitOps configuration structure, supported fields, data types, required combinations, and unknown keys. * Added support for external file references using `path` and `paths` in supported sections. * Added clearer guidance for deprecated fields and special field behaviors. * **Bug Fixes** * Improved detection of incorrectly typed values and invalid configuration shapes. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rajendra Kadamandmelpike
|
6e4b913a00 |
Add scripts and configuration profiles steps to downgrade guide (#50038)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA ## Description Improves the [downgrade guide](https://fleetdm.com/guides/downgrade-fleet) instead of changing product behavior, per product design's direction. The guide told users to move fleet-level **reports** and **policies** to the global level before downgrading, but omitted **scripts** and **configuration profiles**. Both are scoped per fleet and become inaccessible once fleets are deleted during the downgrade, so users lose them with no warning. Adds two sections — "Move all fleet-level scripts to Unassigned" and "Move all fleet-level configuration profiles to Unassigned" — placed before the fleet-deletion step so users move them while the fleets still exist. Unlike reports/policies (which move to the global level), scripts and configuration profiles have no global bucket — they live under a fleet or **Unassigned** — so the steps direct users to re-add them under **Unassigned**, which remains available on Fleet Free. > **Draft — pending wording pass.** The steps use "Unassigned" to match the label in the Controls dropdown. Flagging for @Mel for a wording review before this goes out. ## Testing - [ ] N/A — documentation only. # Checklist for submitter - [x] Documentation change only; no code, tests, or migrations. --------- Co-authored-by: melpike <79950145+melpike@users.noreply.github.com> |
||
|
Christopher Kemp
|
bd0883cf36 |
Update README.md (#49981)
corrected spelling error <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
kitzyandCopilot Autofix powered by AI
|
2ddb07a1f5 |
Wire content-style into the fleet-guide-formatting skill and require endmatter (#49698)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** N/A # Checklist for submitter - [x] N/A: this is a `.claude/skills` change (Claude Code tooling), not a user-visible product change. No `changes/` entry, tests, migrations, config settings, or fleetd/orbit changes apply. ## Summary Updates the `fleet-guide-formatting` skill based on review feedback from the first guide written with it (#49681). Two problems came up in that review: **The skill didn't run `content-style`.** It cross-referenced `content-style` as the place voice and grammar rules live, but phrased it as "use that skill instead," which read as someone else's job. The result was a structurally correct guide that still needed a separate style pass. `content-style` is now a required companion, called out in the frontmatter description (so it's visible at trigger time, not just after loading), in a dedicated section near the top, in both the writing and auditing workflows, and as an audit checklist item. **Endmatter wasn't being generated.** The skeleton listed endmatter as "required" but never said the skill is what writes it, so drafts came back without the `<meta>` tags and the author had to notice and add them. There's now an "Endmatter is not optional" section with per-field guidance, and a matching comment above the block in `references/template.md`. The existing don't-fabricate-the-author rule is preserved: `authorFullName`, `authorGitHubUsername`, and `publishedOn` stay as placeholders to be filled in rather than guessed. ## Also in this PR The skill files themselves didn't follow `content-style`, which is a bad look for a skill whose main change is "always run `content-style`." Ran all three files through it: - Removed ~40 em dashes (the connector-after-a-bold-label pattern), replaced with periods or colons. - Renamed two headings off `-ing` verbs per the headings rule: "Writing a new guide" to "Write a new guide," "Auditing or retrofitting an existing guide" to "Audit or retrofit an existing guide." - Fixed quote punctuation to sit outside the quotes per the handbook. This accounts for most of the `canonical-examples.md` diff. - Cut filler ("actually," "very"), added missing Oxford commas, and replaced one use of "agent" (on the avoid list) with `fleetd`. Also fixed a content bug found while editing: the "what guides never have" note about Conclusion/Summary sections had drifted out of "The skeleton" section, where it belongs. ## Testing Not applicable, no automated tests cover skill markdown. Verified by grep that the files contain no em dashes outside backticked search targets, no filler or hype words from the avoid lists, no banned terminology, and that all headings are sentence case. --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
kitzyandAllen Houchins
|
3ce3e238ed |
Add 6 Windows Fleet-maintained apps (#50016)
**Related issue:** N/A — Windows Fleet-maintained app (FMA) coverage for apps found deployed in a customer's ManageEngine SDP environment but missing from Fleet. ## What this does Adds **6** Windows Fleet-maintained apps — the subset of a larger batch that passes the FMA validator cleanly. Each has a winget-sourced input, a generated output manifest, and a catalog icon. Detection identity was verified against each app's real registry DisplayName; apps whose DisplayName carries a version suffix use fuzzy name matching, the rest match exactly. **MSI (clean, auto upgrade-code uninstall):** - **Git Extensions** — versioned ARP name (`Git Extensions 7.2.0.92`) → fuzzy match - **TightVNC**, **Yarn**, **SonicWall NetExtender** (WiX), **Zoom Outlook Plugin** — clean ARP names → exact match **EXE — NSIS (custom `/S` install + registry-lookup uninstall):** - **Spyder** — versioned ARP name (`Spyder 6`) → fuzzy match ## Notes - **Detection verification.** Every app's `unique_identifier` (registry DisplayName / osquery `programs.name`) and publisher were verified per the `new-fma` skill against winget `AppsAndFeaturesEntries`, MSI Property tables (`msiinfo`), and vendor installer scripts — not assumed. Git Extensions' MSI `ProductName` is `Git Extensions 7.2.0.92` and Spyder's ARP entry is `Spyder 6`, so both need `fuzzy_match_name`; the four exact-match apps were confirmed clean (e.g. TightVNC registers as `TightVNC`, not a versioned string). - **Validated on a real Windows host.** All six pass the FMA CI validator (install → detect → uninstall) on the SYSTEM-context Windows runner. - **Icons.** Git Extensions, SonicWall NetExtender, TightVNC, Yarn, and Zoom Outlook Plugin ship new catalog icons + website assets; Spyder reuses the existing `Spyder` icon. ## Testing - [x] FMA CI validator (install → detect → uninstall) on the SYSTEM-context Windows runner. - Generated outputs verified locally: all 6 produce valid manifests; MSI apps carry the correct UpgradeCode-based uninstall; exists/patched queries reviewed for name + publisher correctness; `go test ./ee/maintained-apps/...` passes. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added maintained Windows catalog entries for Git Extensions, SonicWall NetExtender, Spyder, TightVNC, Yarn, and Zoom Outlook Plugin, including silent install, version upgrade detection, and maintenance-ready uninstall flows. * Added new software icons for these apps and expanded icon matching so they display correctly in the catalog. * **Bug Fixes** * Improved Spyder Windows uninstall targeting and command/argument handling for more reliable removals. * **Documentation** * Refreshed Spyder supported version details to 6.1.5. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Allen Houchins <allenhouchins@mac.com> |
||
|
Noah Talerman
|
cb6f751ff2 |
"Unpacking the why" for each product group (#50052)
- Led by each product group's Product Designer |
||
|
Allen Houchins
|
aea7c4068f |
Remove Nocturnal as a macOS FMA (#50050)
**Related issue:** N/A — fixes the failing scheduled "Update Fleet-maintained apps" workflow The `nocturnal` cask was removed from homebrew-cask on 2026-07-28 ([Homebrew/homebrew-cask@517db75](https://github.com/Homebrew/homebrew-cask/commit/517db75b78)) after being deprecated on 2024-07-27 and disabled on 2025-07-27, both `because: :unmaintained` (upstream repo's last push was in 2018). The brew API now returns 404 for it, so the maintained-apps ingester panics: ``` panic: ingesting homebrew app: app not found in brew API ``` This removes Nocturnal as a Fleet-maintained app, following the same pattern as #46541 (Messenger) and #47420 (Dell Display Manager): - `ee/maintained-apps/inputs/homebrew/nocturnal.json` — Homebrew input - `ee/maintained-apps/outputs/nocturnal/darwin.json` — macOS output data - `ee/maintained-apps/outputs/apps.json` — Nocturnal entry - `frontend/pages/SoftwarePage/components/icons/Nocturnal.tsx` and its import/mapping in `index.ts` - `website/assets/images/app-icon-nocturnal-60x60@2x.png` # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually (verified `apps.json` still parses, no remaining `nocturnal` references, ESLint passes on the icons index) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Removed Apps** - Removed Nocturnal from the maintained application catalog. - Removed its installation and uninstallation support. - Removed the Nocturnal icon from software listings. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrew Mellor
|
f1228c873d |
47713 auld software update assets migration (#50036)
**Related issue:** Resolves #47713 - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for tracking available Apple OS update assets and supported devices. * Added per-host Apple OS update targets, deadlines, and resolution status. * Added configuration options for host target OS versions and deadlines. * **Database** * Updated the MySQL schema and migration seed data to include the new tables and fleet variables, and to reflect updated migration/status metadata. * **Tests** * Added migration tests to validate table creation, constraints, defaults, and upsert behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
dependabot[bot]andLucas Manuel Rodriguez
|
3d4cf0dfee |
Bump google.golang.org/grpc from 1.79.3 to 1.82.1 (#49957)
- [X] QA'd all new/changed functionality manually Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.79.3 to 1.82.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.82.1</h2> <h1>Security</h1> <ul> <li>server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable <code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li> <li>xds/rbac: Support <code>Metadata</code> and <code>RequestedServerName</code> permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.</li> <li>xds/rbac: Fix panic when parsing unsupported fields in <code>NotRule</code>/<code>NotId</code> permissions.</li> <li>xds/rbac: Support the deprecated <code>source_ip</code> principal identifier by treating it as equivalent to <code>direct_remote_ip</code>.</li> </ul> <h2>Release 1.82.0</h2> <h1>Behavior Changes</h1> <ul> <li>server: Remove support for <code>GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING</code> environment varibale. Strict incoming RPC path validation (which has been the default since <code>v1.79.3</code>) can no longer be disabled. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9112">#9112</a>)</li> <li>transport: Add environment variable to change the default max header list size from <code>16MB</code> to <code>8KB</code>. This may be enabled by setting <code>GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true</code>. This will be enabled by default in a subsequent release. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9019">#9019</a>)</li> <li>balancer: Load Balancing policy registry is now case-sensitive. Set <code>GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false</code> (and file an issue) to revert to case-insensitive behavior. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9017">#9017</a>)</li> </ul> <h1>New Features</h1> <ul> <li>experimental/stats: Expose a new API, <code>NewContextWithLabelCallback</code>, to register a callback that is invoked when telemetry labels are added. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8877">#8877</a>) <ul> <li>Special Thanks: <a href="https://github.com/seth-epps"><code>@seth-epps</code></a></li> </ul> </li> <li>client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>) <ul> <li>Special Thanks: <a href="https://github.com/chengxilo"><code>@chengxilo</code></a></li> </ul> </li> <li>server: Add environment variable <code>GRPC_GO_SERVER_GOROUTINE_LABELS</code> that controls setting <code>runtime/pprof.Labels</code> on goroutines spawned by the server. Set <code>GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true</code> to add the <code>grpc.method</code> label on goroutines spawned to handle incoming requests. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>) <ul> <li>Special Thanks: <a href="https://github.com/dfinkel"><code>@dfinkel</code></a></li> </ul> </li> </ul> <h1>Bug Fixes</h1> <ul> <li>xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9138">#9138</a>)</li> <li>grpc: In the deprecated <code>gzip</code> Compressor (used via the deprecated <code>WithCompressor</code> dial option), enforce the <code>MaxRecvMsgSize</code> limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9114">#9114</a>) <ul> <li>Special Thanks: <a href="https://github.com/evilgensec"><code>@evilgensec</code></a></li> </ul> </li> <li>stats/opentelemetry: Record retry attempts, <code>grpc.previous-rpc-attempts</code>, at the call level and not the attempt level. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8923">#8923</a>)</li> <li>encoding: Ensure <code>Close()</code> is always called on readers returned from <code>Compressor.Decompress</code> if possible. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9135">#9135</a>)</li> <li>channelz: Fix the <code>LastMessageSentTimestamp</code> and <code>LastMessageReceivedTimestamp</code> fields in <code>SocketMetrics</code> to ensure they contain correct timestamp values. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9109">#9109</a>)</li> </ul> <h2>Release 1.81.1</h2> <h1>Security</h1> <ul> <li>xds/rbac: Fix a potential authorization bypass caused by incorrectly falling through URI/DNS SANs to Subject Distinguished Name (DN) when matching the authenticated principal name. With this fix, only the first non-empty identity source will be used, as per <a href="https://github.com/grpc/proposal/blob/master/A41-xds-rbac.md">gRFC A41</a>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9111">#9111</a>) <ul> <li>Special Thanks: <a href="https://github.com/al4an444"><code>@al4an444</code></a></li> </ul> </li> </ul> <h1>Bug Fixes</h1> <ul> <li>otel: Segregate client and server RPC information used for metrics and traces, to avoid one overwriting the other. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9081">#9081</a>)</li> </ul> <h2>Release 1.81.0</h2> <h1>Behavior Changes</h1> <ul> <li>balancer/rls: Switch gauge metrics to asynchronous emission (once per collection cycle) to reduce telemetry noise and align with other gRPC language implementations. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8808">#8808</a>)</li> </ul> <h1>Dependencies</h1> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/ebd8f06a09426fbece97157c95c3917abff28f4e"><code>ebd8f06</code></a> Change version to 1.82.1 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9238">#9238</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935"><code>4ea465d</code></a> Cherry-pick commits (<a href="https://redirect.github.com/grpc/grpc-go/issues/9236">#9236</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/9494a2cf32a0ec9d35420af401445ef3c9f66f05"><code>9494a2c</code></a> Change version to 1.82.1-dev (<a href="https://redirect.github.com/grpc/grpc-go/issues/9171">#9171</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/bd239854f0ab7f1ee63457d47f7c1d2675e1f736"><code>bd23985</code></a> Change version to 1.82.0 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9170">#9170</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/0f3086db7a755b6af83a90809471dd7f645b345a"><code>0f3086d</code></a> Fix minor issues not covered by PR <a href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a> (<a href="https://redirect.github.com/grpc/grpc-go/issues/9147">#9147</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/fef07fbb2b94b668e8daca1f6b70433dcd36c1c8"><code>fef07fb</code></a> internal: Split v3procservicepb import into pb and grpc for extproc (<a href="https://redirect.github.com/grpc/grpc-go/issues/9163">#9163</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/91dd64f4b83cb5134e279d1126ebb1ccf47d4d31"><code>91dd64f</code></a> transport: surface subsequent data when receiving non-gRPC header (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/adc97de9521a9f377dab5e911039842dc4de23e5"><code>adc97de</code></a> test/kokoro: add config for regional-td test (<a href="https://redirect.github.com/grpc/grpc-go/issues/9158">#9158</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/57c9ff14e05b535ee6995ba49bc882b287a175de"><code>57c9ff1</code></a> xds: ensure full-string matching for RBAC Filter rules (<a href="https://redirect.github.com/grpc/grpc-go/issues/9148">#9148</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/b58f32d9ff07c612d64e677bd826bcbec88af9bd"><code>b58f32d</code></a> server: Set a pprof label on new stream goroutines (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)</li> <li>Additional commits viewable in <a href="https://github.com/grpc/grpc-go/compare/v1.79.3...v1.82.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> |
||
|
Rajendra Kadam
|
f2662ccaf5 |
Default setup experience account type to admin when serving team config (#50034)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49346 ## Description A fleet created before the managed local account keys existed (e.g. in 4.84.0) and never edited since has no `end_user_local_account_type` or `enable_managed_local_account` in its stored config. `GET /teams/:id` served these as `null`, so the *Setup experience → Users* card showed no account-type selection and a wrongly checked, greyed-out "Create hidden admin" box. - **`server/fleet/teams.go`** — `Team.MarshalJSON` now falls back to `"admin"` / `false` for these keys when they're unset, mirroring the existing `AppConfig.MarshalJSON` fallback that already covers the global ("No team") config. This is the one serve path that was missing the default; the save path (`TeamConfig.Value()`) already applied it, which is why only untouched pre-4.84.0 fleets were affected. Serve-time fallback only — no stored data is modified and the account-provisioning logic is untouched. > **Note for reviewers:** `Team.MarshalJSON` is also the serialization used by `fleetctl get teams` / GitOps, which had the same `null` bug. With this change those now emit `end_user_local_account_type: admin` and `enable_create_local_admin_account: false` for teams that previously showed `null` — matching what the global config already emits. The get→apply roundtrip stays idempotent because the save path already writes these defaults. Team goldens updated accordingly. ## Testing - **Automated:** `TestTeamMarshalJSONMacOSSetupDefaults` (`server/fleet`) — a team with the keys unset marshals to `"admin"` / `false`, and explicitly set values still round-trip. Updated the `fleetctl` team goldens (`TestGetTeams`, `TestApplyMacosSetup`, `TestApplyMacosSetupDeprecatedKeys`) to reflect the defaulted output. - **Manual:** simulated a 4.84.0 fleet by removing both keys from a team's stored `config` JSON. On `main` the Users card showed no selected radio and a checked, greyed hidden-admin box; on this branch the same fleet shows **Admin** selected and the box unchecked, matching what global "No team" already renders. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements). ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * macOS device setup now applies correct defaults when managed local account settings are missing from existing team configurations. * The end-user local account type now defaults to **admin** and managed local account creation defaults to **disabled** (false) unless explicitly configured. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrew Mellor
|
8e0c038eff |
47701 abm errors UI (#49896)
**Related issue:** Resolves #47701 # Checklist for submitter ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually: Not able to test token_rejected, terms and conditions or apple server error. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added an Apple Business Manager invalid-token warning banner that lists the affected organization names. * Introduced dedicated invalid-token state support so the banner can appear with the correct priority. * **Bug Fixes** * Ensured invalid-token state is cleared when no tokens are returned and consistently set on token fetch success/error. * Improved Apple/DEP status messaging and made profile-assignment rendering more resilient for non-DEP and partial-error responses. * **Style** * Adjusted banner spacing and added styling for DEP error presentation. * **Tests** * Added/expanded tests for invalid-token messaging, ABM expiry updates, and MDM status/error scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
fleet-releaseandallenhouchins
|
e3c9ed84c5 |
Update Fleet-maintained apps (#50033)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated the Windows Discord package to version 1.0.9250. * Updated the installer download reference and verification checksum. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
Lucas Manuel Rodriguez
|
c482646efe |
Fix check-doc-gen failing on main: use npm ci and drop extraneous lockfile entries (#50014)
**Related issue:** N/A — fixes the `check-doc-gen` job failing on `main` The "Check automated documentation is up-to-date" workflow has been failing on every push to `main` (and every PR that triggers it) since ~18:30 UTC 2026-07-27. The failing step, "Verify osquery table JSON schema is up-to-date," runs `cd website && npm install && sails run generate-merged-schema` and fails if `git diff` is non-empty afterward. The diff it fails on is `website/package-lock.json` itself: `sails-hook-grunt`'s published tarball ships a `node_modules` folder with packages that aren't part of its dependency graph (dev leftovers like `mocha@3.0.2` and `growl@1.9.2`). Newer npm on the CI runners records those on-disk packages in the lockfile as `"extraneous": true` entries, so any committed lockfile that omits them (e.g. after #49852 regenerated it) no longer matches what `npm install` produces — and any committed lockfile that *includes* them gets flagged by `dependency-review` for the critical `growl@1.9.2` advisory (GHSA-qh2h-chj9-jffq), even though growl is never actually installable from the dependency graph. This PR fixes the root cause instead of chasing npm's output: - **`check-doc-gen` now uses `npm ci` instead of `npm install`** — `npm ci` never rewrites `package-lock.json`, so the step's `git diff` check only catches what it's meant to catch (schema drift), and future runner npm upgrades can't reintroduce lockfile churn. - **`website/package-lock.json` regenerated with `npm install --package-lock-only`** — drops the 107 `extraneous` entries (including `growl@1.9.2`) that were committed to pacify the old `npm install`-based check. No dependency versions change; `npm ci --dry-run` validates the lockfile is in sync. # Checklist for submitter If some of the following don't apply, delete the relevant line. ## Testing - [x] QA'd all new/changed functionality manually — verified locally that `npm ci --dry-run` accepts the updated lockfile and that `growl`/`extraneous` entries are gone. Since this PR now modifies the workflow file itself, the `pull_request` path filter triggers `check-doc-gen` on this PR, verifying the `npm ci` path end-to-end in CI. 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Improved automated schema validation by using deterministic dependency installation to reduce unnecessary lockfile churn. * Refreshed the generated-schema failure message with the correct regeneration steps to follow when updates are detected. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rajendra KadamandMagnus Jensen
|
0504e5949e |
Add host_id and host_serial to Apple mdm_enrolled activity (#49969)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49777 ## Description Adds `host_id` and `host_serial` to the Apple `mdm_enrolled` activity so IT admins can build automations on top of it, and surfaces the activity on the individual host's activity timeline. - **`server/fleet/activities.go`** — added `HostID` to `ActivityTypeMDMEnrolled` and a `HostIDs()` method (mirrors the existing `ActivityTypeMDMUnenrolled` pattern), so the activity is linked to the host and appears on its timeline. - **`server/mdm/lifecycle/lifecycle.go`** — populate `host_id` for macOS/iOS/iPadOS enrollments. Account-driven user (BYOD) enrollments have no hardware serial, so they report the enrollment ID as `host_serial` too, keeping `host_serial` populated for automations regardless of enrollment type. - **Frontend** — new `MdmEnrolledActivityItem` component, registered in the host past-activity component map (and the `IHostPastActivityType` union), renders the now-host-linked `mdm_enrolled` activity on the host details **Activity** card. There's no Figma, so the copy mirrors the sibling `mdm_unenrolled` item (e.g. "Mobile device management (MDM) was turned on for this host"). `host_id` uses `omitempty`, so Windows (`microsoft_mdm.go`) enrollments keep their existing activity payload unchanged — Windows is intentionally out of scope, handled in #47874, which also owns the audit-log documentation update for the shared field. > **For reviewer:** the ADUE `host_serial = enrollment_id` behavior comes from the issue's test plan. It means `host_serial` and `enrollment_id` carry the same value for BYOD. Flagging in case Product would rather leave `host_serial` empty for ADUE and have automations read `enrollment_id`. ## Testing - **Automated:** `TestMDMEnrolledActivityHostIDAndSerial` (`server/mdm/lifecycle`) covers device enrollment (`host_serial` = hardware serial) and ADUE (`host_serial` = enrollment ID), both asserting `host_id`/`HostIDs()`. Also verified `server/datastore/mysql` `TestMDMEnrollment`, `server/activity/internal/mysql` `TestListActivities`, and `server/service` `TestMDMTokenUpdate*` pass. - **Live (simulated) manual macOS enrollment** via `osquery-perf`: the `mdm_enrolled` activity recorded `host_id` + `host_serial`, and an `activity_host_past` row linked it to the host (confirmed it shows on the host timeline). - **Frontend:** `MdmEnrolledActivityItem.tests.tsx` covers the rendered copy for macOS/iOS/Android and the actor/no-actor variants; also visually confirmed the activity renders on a host's Activity card in the running app. `yarn jest`, `eslint`, and `tsc` pass. - Updated the MDM integration tests (`integration_mdm_test.go`, `integration_mdm_dep_test.go`, `integration_vpp_install_test.go`) whose activity-detail and host-feed assertions changed now that `mdm_enrolled` carries `host_id` and appears on the host timeline (feed assertions now filter by activity type). - **Pending on-device QA (next week):** DEP/ADE macOS and account-driven user enrollment (iOS/iPadOS) on real hardware, per the issue's test plan. - Regression: Windows `mdm_enrolled` payload is unchanged (`host_id` is omitted when zero); both platforms' `mdm_unenrolled` are unaffected. # Screenshot for the frontend change <img width="706" height="382" alt="Screenshot 2026-07-28 at 11 16 57 AM" src="https://github.com/user-attachments/assets/8f57d129-f819-4399-8754-18b397a49db8" /> # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually <!-- manual macOS verified via simulator; DEP + real-device ADUE pending next week --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Added support for rendering “MDM enrolled” in the host activity feed with platform- and actor-aware messaging. * **Bug Fixes** * Updated Apple “MDM enrolled” activity details to include the correct host identifier and serial/enrollment identifiers. * Ensured host-scoped activity behavior applies only when the host is known (host id present). * **Tests** * Expanded regression and integration coverage for “MDM enrolled” activity details and feed contents, including VPP-related assertion stability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Magnus Jensen <magnus@fleetdm.com> |
||
|
|
bf3e1bab99 |
Add Apple marketing names to backend, frontend, and an osquery table (#46482)
**Related issue:** Resolves https://github.com/fleetdm/fleet/issues/46818 and https://github.com/fleetdm/fleet/issues/48524. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Host lists and Host details now show human‑readable Apple hardware marketing names (macOS, iOS, iPadOS) where available (e.g., "MacBook Pro (16‑inch, 2021)"), replacing raw model identifiers. * Hardware model displays fall back to the original model identifier for non‑Apple or unmapped devices. * **Bug Fixes / CSV** * Exported host CSVs now align with the UI by using the marketing name for Apple devices when available. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> |
||
|
fleet-releaseandallenhouchins
|
5db4146b4f |
Update Fleet-maintained apps (#50032)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Refreshed maintained application packages to their latest releases across macOS and Windows. * Updated ActiveDock, AWS CLI, BetterZip, Cursor, Docker Desktop, DuckDuckGo, EagleFiler, Figma, Firefox, Garmin Express, Hive, iMazing, Kiro CLI, Loom, LuLu, Microsoft Edge, Nessus Agent, Notepad, Ollama, PyCharm, Reqable, Spokenly, SQL Server Management Studio, Telegram, and Zed. * Updated download links and verification checksums to match the new installers. * Improved uninstall or installation behavior for select applications, including Figma, iMazing, and Ollama. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
Eric
|
53b92f9356 |
Website: Update "Talk to us" form and contact page (#50023)
Changes: - Updated the quote shown on the contact page (and disabled the unused personalization on the page) - Removed the "What will you be using Fleet for" question on the "Talk to us" form on the contact page <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Simplified the “Talk to us” form by removing the “What will you be using Fleet for?” question. * Added an organization employee-count field with required numeric validation. * Streamlined form prefilling and submission details for returning users. * Updated the testimonial section to display a consistent customer story and logo. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lewis BarajasandSam Pfluger
|
b64fdaade0 |
Add Lewis Barajas to go-to-market-operations.md (#50018)
Adding my name and GitHub handle to the Solutions Specialist list in the Go-To-Market operations page. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) --------- Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com> |
||
|
LeAnn
|
84896a5687 |
Add tooltip explaining missing Refetch button for Android hosts (#50017)
<img width="632" height="196" alt="Screenshot 2026-07-27 at 3 09 16 PM" src="https://github.com/user-attachments/assets/7bfc1440-48a4-4baf-8747-cc5e848a3a53" /> <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #50001 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added an explanatory tooltip to the “Last fetched” field for Android hosts. * The tooltip clarifies that Android hosts sync automatically and therefore do not have a “Refetch” button. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Noah Talerman
|
2726da1d62 | Why macOS managed admin accounts are only created during setup (#50008) | ||
|
Noah Talerman
|
0632216e08 |
Document monthly premium usage stats update process (#50009)
Added section on updating premium usage stats and future Grafana dashboard. |
||
|
Lucas Manuel Rodriguez
|
31286783eb |
Add exclusions for wix docker image (#49996)
Run: https://github.com/fleetdm/fleet/actions/runs/30289212899. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security** * Added vulnerability assessment metadata for CVE-2026-12912. * Clarified that the affected code is not executed by fleetctl when using the wix ecosystem. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
dbb151b598 |
Add exclusions for released fleetctl docker image (#49994)
Run: https://github.com/fleetdm/fleet/actions/runs/30288702449 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security** * Added a vulnerability assessment for CVE-2026-57433. * Documented that the affected products are not impacted because the vulnerable code is not used in the relevant execution path. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
4f87e1c8ad |
Add VEX exclusions for fleetctl docker image (#49992)
Run: https://github.com/fleetdm/fleet/actions/runs/30288436739. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security** * Added vulnerability status records for four advisories affecting fleetctl and related components. * Documented fleetctl as **not affected** because the vulnerable code paths are not used or included. * Added rationale covering WebP-only image decoding, unavailable macOS-only TIFF functionality, absence of gRPC server and xDS RBAC usage, and inapplicable Jackson parser conditions. * Included standardized advisory metadata and version information for improved security transparency. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
George Karrandtest
|
7d2bab7a2e |
Adding changes for Fleet v4.89.2 (#49702)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated the Fleet chart release metadata to version 7.0.14. * Updated the packaged application version to 4.89.2. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: test <test@test.com> |
||
|
RachelElysia
|
29f20aca31 | Fleet UI: Fix empty button boxes in batch run script modal (#49997) | ||
|
fleet-releaseandallenhouchins
|
bdd04ba838 |
Update Fleet-maintained apps (#49989)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for the latest releases of Air Explorer, Appium Inspector, BetterZip, GeoGebra Classic, Google Drive, Grammarly, Melodics, NordLayer, Opencode, Screen Studio, VoiceInk, WhatsApp, RealVNC Server, Firefox Nightly, and Zed. * **Bug Fixes** * Refreshed download links and integrity checks for updated application packages. * Improved uninstall cleanup for Elgato Control Center, Kiro, Marked, Mellel, PureVPN, Reqable, and Rize. * Improved Zed removal by closing the app before deleting its files. * Updated SourceTree package metadata to the latest available installer. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
Eric
|
766408d93b |
Website: update package.json overrides, update package-lock (#49852)
Changes: - Added an override for `body-parser@1.20.6` to the websites package.json - Updated thhe website's package-lock.json to include updated versions of `body-parser` and `brace-expansion` - Removed extraneous sails-hook-grunt dependencies from the website's package-lock by running `npm update sails-hook-grunt` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated a package version override to improve dependency consistency and reliability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
4c36caa453 |
pass validation for fleets gitops files for DDM assets (#49991)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49979 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. (Unreleased bug) - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Prevented Fleet Free from attempting to apply premium-only Apple DDM assets. * Improved macOS DDM asset reconciliation so explicitly empty settings can clear previously configured assets. * Ensured GitOps and team configurations consistently recognize and validate macOS asset settings. * Restricted DDM asset processing to Premium deployments with configured and enabled MDM. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
19efda2d1b |
Windows SCEP profiles now fail with non-printable chars (#49887)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #47492 Windows cert profile fails if challenge uses non-printable characters. <img width="987" height="329" alt="image" src="https://github.com/user-attachments/assets/04dc7c78-8e3e-41c8-823e-cb4a961a91eb" /> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **Bug Fixes** * Windows SCEP profiles now fail with a clear error when the certificate authority challenge includes characters not supported by Windows ASN.1 PrintableString. * Prevents misleading “Verified” status when no certificate is installed. * Preserves valid challenge values, including leading/trailing spaces. * Improves Windows error tooltips by showing raw certificate-install error details. * **Tests** * Added coverage for invalid/valid Windows SCEP challenge scenarios and the updated error tooltip behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rachael Shaw
|
9e680854f4 |
Guide: Clarify which policy automations are premium & fleet-level (#49993)
Also clarified language about continuous retries, and moved section about retrying on policy automation failure to a spot that made more sense. Re: [discussion](https://macadmins.slack.com/archives/C0214NELAE7/p1784951700300179) in Mac Admins Slack > #fleet |
||
|
Noah Talerman
|
958fe8b9aa |
Add macOS apps to fleet maintained apps for testing & QA (#49983)
- To verify best practice workflow for rollbacks: https://fleetdm.com/guides/fleet-maintained-apps#rollback-to-a-previous-version <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Slack, Zoom, Google Chrome, and Claude to the macOS self-service software catalog for the Testing & QA fleet. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Irena Reedy
|
c96ee75ac0 |
Update README.md (#49988)
Role updated |
||
|
Noah TalermanandAndrey Kizimenko
|
8d2a2d1647 |
Update bug triage (#49775)
- @AndreyKizimenko is DRI ## What changed Removes the `:release` label from the bug triage and release process docs (`handbook/company/product-groups.md`, `handbook/engineering/releases.md`). Bugs and stories are now added to the product group's release board directly, so `:release` was redundant board-routing: - Reproduced unreleased bugs are added to the release board directly (no `:release` label). - Updated the outside-contributor step, the unreleased-bug creation step, and the conclude-milestone step to match. - Bonus: fixed a dead `#critical-bugs` anchor in `releases.md` (repointed to `#release-testing`). ## Why we're keeping `~critical bug` and `~release blocker` The original TODO was to remove all three labels, but on review the other two carry signal that our `P0`/`P1`/`P2` priority labels don't: - **`~critical bug` (severity, for bugs):** triggers a distinct safety process — raise the alarm to the community, update the GitHub release page, cut a patch release, run a postmortem. Priority labels answer *how urgently we work* an issue; `~critical bug` answers *"are users in the wild in danger right now, so we owe them external comms + a postmortem?"* Not every `P1` is a critical bug. - **`~release blocker` (scope, for stories):** flags that a story must ship in the next release. That's orthogonal to urgency — a lower-priority story can still be committed to a milestone. Both are low-frequency, high-signal exception flags, so keeping them doesn't clutter day-to-day triage. ## Note for reviewers The conclude-milestone step now says applying `:product` moves a story back to the drafting board. If the release board's GitHub Projects automation keys off the `:release` label to add/remove items, that config should get a matching update so stories aren't stranded on the release board. --------- Co-authored-by: Andrey Kizimenko <87822796+AndreyKizimenko@users.noreply.github.com> |
||
|
Rajendra Kadam
|
17669eca02 |
Center-align setup experience app icons (#49962)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46973 > **Draft:** on-device QA (Mac/iPhone/iPad) is pending hardware, expected next week. Opening as draft for early review of the approach. ## Description FMA and custom-package app icons were misaligned on the macOS setup experience ("Setting up your device") screen — icons rendered at different sizes and their "Install …" labels didn't line up. **Root cause:** `SetupSoftwareProcessCell` forced `.software-icon__small { width: $pad-xlarge }` (32px, width only). That class lands on different elements in `SoftwareIcon`'s two render paths, so it hit them differently: - **Fleet-maintained / VPP apps (icon URL)** → the class is on the wrapper `<div>`; the 24px `<img>` inside stayed 24px, left-aligned. - **Custom packages (no URL)** → the class is on the fallback **SVG** itself, which got stretched to 32px wide. Result: different icon sizes/positions by app type → the misalignment. **Fix:** remove the width override so every app type renders `SoftwareIcon` at its consistent, vertically-centered 24px "small" size. ## Testing Verified in Storybook (added `SetupSoftwareProcessCell.stories.tsx`, `MixedAlignment` story) with real matched brand icons (Chrome, 1Password, VS Code, Zoom), a generic custom-package icon, and a URL/`<img>` icon stacked together: - **Before** (with the override): icons render at mixed 24/32px sizes; "Install …" labels don't align. <img width="1135" height="398" alt="before" src="https://github.com/user-attachments/assets/fe216ab4-0a7b-4211-b8aa-96e65e6ca3f5" /> - **After** (this change): all icons render at 24px, centered, labels aligned. <img width="1185" height="425" alt="after" src="https://github.com/user-attachments/assets/28257eb8-df6e-4168-a0bb-28dda4bb40ba" /> On-device QA to follow once hardware is available. ## Notes for reviewer - The `width: $pad-xlarge` (32px) was added in #33770, so 32px may have been the *intended* icon size. This change makes them a consistent **24px**. If a larger icon is desired, that's a follow-up done properly via a real `SoftwareIcon` size (not a width-only override) — flagging for PD input since this is `:product`-labeled. - Included a Storybook story for visual verification/regression; happy to drop it if that's not wanted here. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [ ] QA'd all new/changed functionality manually <!-- pending on-device QA --> - Added a Storybook story for visual verification (not an automated test). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved software process cell styling for more consistent icon sizing and alignment. * **Tests** * Added Storybook scenarios covering fleet-maintained apps, custom packages, uploaded icons, and mixed app layouts. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
melpike
|
af65282522 |
Align helper text with checkbox/radio labels (#49977)
Moves changes from #49920 to `main`. Originally targeting `docs-v4.91.0` — retargeted to this branch. **Related:** #49920 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved checkbox and radio button helper-text alignment so it lines up with the associated label. * Adjusted spacing between controls, labels, and helper text for a cleaner form layout. * **Documentation** * Added component examples demonstrating checkbox and radio buttons with helper text. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
