4e6591e09dc7c043b58d418fa367ef1833528511
26763
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Dante Catalfamo
|
4e6591e09d |
Reconcile stuck Android MDM commands via AMAPI operations.get (#50177)
**Related issue:** Resolves #46145 |
||
|
Rahul RaghunathanandRachelElysia
|
f292c7def4 |
Add sortable 'Added to Fleet' column to hosts table (#50098)
**Related issue:** Resolves #50083 # Screenshot demonstrating the fix - Hosts page: <img width="1473" height="335" alt="image" src="https://github.com/user-attachments/assets/2f88ad6e-a514-4304-ac80-f56678e6be47" /> - Edit columns modal: <img width="798" height="707" alt="image" src="https://github.com/user-attachments/assets/0a79e8f3-1b21-4f84-bd04-726f44b9a0fa" /> ## Note on sort direction The new "Added to Fleet" column renders as a "days ago" duration (same formatter as Last seen / Last fetched / Last restarted). To keep behavior consistent across all four time-ago columns on the hosts table, this PR applies the sort-direction inversion originally introduced for `last_restarted_at` in #14878 (fix for #13160) to all of them: - `seen_time` (Last seen) - `detail_updated_at` (Last fetched) - `last_restarted_at` (Last restarted) — unchanged behavior - `last_enrolled_at` (Added to Fleet) — new Arrow-down on any of these columns now sorts by the visible duration (biggest "days ago" first / oldest date first), rather than by the raw underlying timestamp. This is a user-facing behavior change on Last seen and Last fetched — please re-QA sort order on those two columns alongside the new one. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] QA'd all new/changed functionality manually <!-- Attach: Edit columns modal showing the new "Added to Fleet" column option, and the Hosts page with the column enabled --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added an **Added to Fleet** column to the hosts table. * Displays when each host last enrolled with Fleet, with an explanatory tooltip. * The column is hidden by default and can be enabled through table settings. * Supports ascending and descending sorting. * **Bug Fixes** * Corrected descending sorting for **Last seen** and **Last fetched** to reflect the displayed host age. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: RachelElysia <71795832+RachelElysia@users.noreply.github.com> |
||
|
George Karr
|
d96ceb2c51 |
Add patch when closed policies (#50726)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #39962 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - N/A - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added “Patch when closed” deployment policies to update software only when the application is not running. * Added deployment controls for force install, patching, and manual, forced, or closed-app patch options. * Fleet-maintained apps now automatically detect whether the application is open. * GitOps configurations support patch-when-closed settings with validation. * **UI Improvements** * Added clear activity and installation messages when updates are skipped because an app is open. * Replaced the Patch action with a unified Deploy workflow. * **Bug Fixes** * Prevented skipped updates from being incorrectly retried as failed installations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
dependabot[bot]andLucas Manuel Rodriguez
|
23cc1b45e8 |
Bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#50787)
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.19.1 to 5.19.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.19.2</h2> <h2>What's Changed</h2> <ul> <li>build: Update module golang.org/x/crypto to v0.52.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2150">go-git/go-git#2150</a></li> <li>build: Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2141">go-git/go-git#2141</a></li> <li>build: Update module golang.org/x/net to v0.55.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2152">go-git/go-git#2152</a></li> <li>git: Worktree: Add stores index entires with backslashes on Windows by <a href="https://github.com/joshblum"><code>@joshblum</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2262">go-git/go-git#2262</a></li> <li>storage: dotgit, reject path traversal in reference names by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2254">go-git/go-git#2254</a></li> <li>build: Update module golang.org/x/net to v0.56.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2267">go-git/go-git#2267</a></li> <li>build: Update module golang.org/x/text to v0.39.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2268">go-git/go-git#2268</a></li> <li>[v5] git: worktree, make the filesystem wrapper a symlink-safe boundary by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2277">go-git/go-git#2277</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2">https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/3eeb238da61eb9c7a324f3ee04f990ce89175642"><code>3eeb238</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2277">#2277</a> from go-git/checkout-v5</li> <li><a href="https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"><code>008a78f</code></a> git: worktree, make the filesystem wrapper a symlink-safe boundary</li> <li><a href="https://github.com/go-git/go-git/commit/2263fb5f022dde90b1c2845f028d3e37e161f2b8"><code>2263fb5</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2268">#2268</a> from go-git/renovate/releases/v5.x-go-golang.org-x-t...</li> <li><a href="https://github.com/go-git/go-git/commit/77b76250d93ec83e2c897638d8a3847b1bfaa38d"><code>77b7625</code></a> build: Update module golang.org/x/text to v0.39.0 [SECURITY]</li> <li><a href="https://github.com/go-git/go-git/commit/85ea767be2b2281693e61afe83911e12c86d6eb7"><code>85ea767</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2267">#2267</a> from go-git/renovate/releases/v5.x-go-golang.org-x-n...</li> <li><a href="https://github.com/go-git/go-git/commit/198675a07b3b8f4eb8f51bf188663a13bb0d9e1a"><code>198675a</code></a> build: Update module golang.org/x/net to v0.56.0 [SECURITY]</li> <li><a href="https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7"><code>4a0e66d</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2254">#2254</a> from pjbgf/v5-dotgit-ref-name-containment</li> <li><a href="https://github.com/go-git/go-git/commit/3b306ef83bd05194a30ce820eed7ed61c3084b5f"><code>3b306ef</code></a> storage: dotgit, align reference-name safety with refname_is_safe</li> <li><a href="https://github.com/go-git/go-git/commit/f3d0cc150b39ae1dc47406a5c170464286914610"><code>f3d0cc1</code></a> storage: dotgit, reject path traversal in reference names</li> <li><a href="https://github.com/go-git/go-git/commit/979cfe9c561d3ced778c88d9cde6db3297e6ed1d"><code>979cfe9</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2262">#2262</a> from joshblum/joshblum/to-slash-v5</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> |
||
|
RachelElysia
|
ddbc65a4f6 |
Self-service: "Install all" respects the search query (#50751)
## Issue Resolves #50528. ## Description On the My device > Self-service page, with a category selected and a search query typed, the "Install all" button previously ignored the search: it counted (and queued) every uninstalled item in the category, including software the search had filtered out. This PR scopes the button — count *and* install target — to the visible subset: - **Backend:** `POST /device/{token}/software/install_all` now accepts a `query` param. It's threaded through `SelfServiceInstallAllSoftwareTitles` → `GetSoftwareTitlesForInstallAll` → `opts.ListOptions.MatchQuery` on `ListHostSoftware`, reusing the same LIKE-on-`software_titles.name` semantics as the self-service list endpoint. - **Frontend:** new `filterSoftwareByQuery` helper layers on top of the category filter to drive `uninstalledCount` / `hasInProgress` and the value sent to install_all. Empty queries are stripped so the API isn't called with `?query=`. `display_name` matching is deliberately out of scope — the search filter across BE list, desktop table, and mobile filter is all raw-`name`-only today, so broadening install_all alone would re-introduce a similar mismatch. Filed as a follow-up: #50750. ## Screen recording In recording: - (FE fix) showing that the UI is filtering out install all count to be only what's on the screen - (BE fix) showing that the call to the API only queues up the install all for the installers shown on the screen when clicked https://github.com/user-attachments/assets/aaae3d29-dccf-484d-910f-67ca335bf0e8 ## Testing - FE unit tests: `filterSoftwareByQuery` helper, `SelfServiceCard` count-with-query + POST-with-query, `InstallAllInCategoryButton` prop forwarding. - BE unit test: EE service forwards the match query to the datastore. - BE datastore test: query, category+query, empty-match cases. - BE integration test: new "scopes to the query parameter when provided" subtest in `TestInstallAllSelfServiceSoftware`. - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * “Install all” now respects the active self-service search query. * Counts, progress indicators, and installation requests now reflect only software matching the current search and category filters. * Empty or whitespace-only searches continue to include all software in the selected category. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrew MellorandJordan Montgomery
|
eb4acf4d1e |
47717 auld UI latest os version (#50571)
**Related issue:** Resolves #47717 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. _Front end only_ ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Apple OS update targeting options for no enforcement, a custom minimum version, or the latest available version. * Added configurable whole-day deadlines for macOS, iOS, and iPadOS updates. * Added platform-specific target controls, validation, and automatic new-host updates for latest-version targeting. * Displayed minimum versions, pending status, and update deadlines in host details and activity feeds. * Clarified Windows deadlines as days after release. * **Style** * Improved layout and spacing for Apple and Windows update forms. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com> |
||
|
Allen Houchins
|
4d55e96f9f |
Add Microsoft Store apps in Windows self-service article and guide (#50637)
**Related issue:** NA Adds an article and companion guide on putting **Microsoft Store apps** into Windows self-service using winget and `.ps1` script-only packages. | File | Category | URL | |---|---|---| | `build-your-own-windows-self-service-with-winget-and-script-only-packages.md` | `articles` | `/articles/build-your-own-windows-self-service-with-winget-and-script-only-packages` | | `build-your-own-windows-self-service-with-winget-and-script-only-packages-guide.md` | `guides` | `/guides/build-your-own-windows-self-service-with-winget-and-script-only-packages-guide` | ## What changed and why Fleet 4.89.0 added an uninstall script, pre-install query, and post-install script to script-only packages. On Linux that was enough to build a [self-service catalog on apt and dnf](https://fleetdm.com/articles/build-your-own-linux-self-service-with-script-only-packages). These are the Windows counterparts, scoped specifically to Store apps. The per-app work is two lines: ```powershell winget install --id <StoreId> --source msstore --accept-package-agreements --accept-source-agreements --disable-interactivity winget uninstall --id <StoreId> --accept-source-agreements --disable-interactivity ``` Everything else in each script is boilerplate, and the generator emits it. ## The constraint both pieces are built around Fleet's agent runs Windows scripts as SYSTEM (`orbit/pkg/scripts/exec_windows.go:17`), and Store apps cannot be installed that way: - The `msstore` source rejects device-wide installs outright: "Device wide install for msstore type is not supported under admin context" ([winget-cli#3553](https://github.com/microsoft/winget-cli/issues/3553)). Store packages are per-user by design. - winget's CLI is [not supported in the system context](https://learn.microsoft.com/en-us/windows/package-manager/winget/troubleshooting) at all, because App Installer is an MSIX package that cannot be registered for `NT AUTHORITY\SYSTEM`. - Running winget in the system context is still [an open feature request](https://github.com/microsoft/winget-pkgs/issues/346975). So the scripts run winget inside the logged-on user's session via a short-lived scheduled task, mirroring the pattern already used by Fleet's own per-user Windows maintained apps (`ee/maintained-apps/inputs/winget/scripts/figma_install.ps1`). ## Two things worth a reviewer's attention Both are corrections that fall out of the Store focus, and both would have produced silently wrong content: 1. **Verification uses `Get-AppxPackage -AllUsers`, not the registry.** Store apps never register in the HKLM uninstall keys, so a registry check fails on a perfectly good install. This is called out explicitly in the guide's Troubleshoot section, since it's a natural wrong instinct if you've built tiles for ordinary Windows installers. 2. **`winget install --scope machine` is documented as a trap, not a shortcut.** For a Store package it [installs under the SYSTEM account](https://github.com/microsoft/winget-cli/issues/4748) instead of provisioning the app, which reports success and leaves users with nothing. The scheduled task's exit code also doesn't propagate back to the calling script, so the install reports success whenever the task ran. Both pieces treat the post-install verification as mandatory rather than optional because of this. ## Machine-wide path For apps that must exist for every user, the content documents `winget download` plus `Add-AppxProvisionedPackage`, which does work as SYSTEM, along with its two costs: license download [requires Entra ID authentication](https://learn.microsoft.com/en-us/windows/package-manager/winget/download) by a Global Administrator, User Administrator, or License Administrator, and you now have a file to host, so it wants a Fleet custom package rather than a script-only one. ## Notes for reviewers - **Content only.** No Go, frontend, migration, or config changes, so no changes file is needed and the code-focused template sections below are removed as the template instructs. - **The PowerShell has not been executed.** There is no `pwsh` on the authoring machine. The generator's here-string escaping was traced by hand but not run. Worth one execution on a real Windows host before publish. - **`Microsoft.CompanyPortal` / `9WZDNCRFJ3PZ`** are used as the worked example. Both identifiers are now verified (PackageFamilyName `Microsoft.CompanyPortal_8wekyb3d8bbwe`), and the guide still tells readers to derive both themselves. - **A verification pass was run over every claim** (Fleet docs, Microsoft Learn, winget-cli issues). It caught one real bug: `winget uninstall` with no flags can hang on an msstore source-agreement prompt ([winget-cli#1736](https://github.com/microsoft/winget-cli/issues/1736)), invisible inside the scheduled task. All uninstalls now carry `--accept-source-agreements`, both directions carry `--disable-interactivity`, and the explorer.exe owner lookup takes the first result so multiple explorer processes can't break `Register-ScheduledTask`. - **`articleImageUrl` is intentionally absent** from the article. The build treats it as optional, but the Linux article has one, so a `1200x627@2x.png` in `website/assets/images/articles/` plus the meta tag would bring it to parity. The guide has none, matching the Linux guide. - **`publishedOn` is `2026-08-05`** on both. Update if these are being scheduled. Checked against the build's enforced constraints (`website/scripts/build-static-content.js`): valid `category`, `articleTitle` matches each H1 exactly, descriptions are 133 and 125 characters (limit 150), `publishedOn` matches the required ISO pattern, no `@fleetdm.com` addresses. `check-pr-template` does not run on this PR, since it only triggers on `frontend/**`, `**/*.go`, `go.mod`, and `go.sum`. # Checklist for submitter ## Testing - [ ] QA'd all new/changed functionality manually Not applicable to content-only changes. Verified instead by running the website build's own validation rules against both files, and by sourcing every technical claim to Microsoft Learn, `winget-cli` issues, or Fleet's docs and code. The PowerShell samples are unexecuted, as noted above. |
||
|
kitzy
|
c24db01d37 |
Add guide: deploy Visual Studio on Windows with Fleet (#50740)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #50653 Companion to #50717, which adds Visual Studio 2022 Community, Professional, and Enterprise as Windows Fleet-maintained apps. Opened as a draft because it documents behavior that PR introduces. Adding the FMA and letting it run is not enough on its own. The unattended Visual Studio bootstrapper installs the core IDE shell with no workloads, so a host ends up with an IDE nobody can build with. Everything that follows from that came out of getting #50717 through CI, so this guide captures it rather than leaving each admin to rediscover it. The guide covers: - What the default install actually produces, and why the core-only result is the right default rather than a shortfall - Pinning workloads for a fleet by overriding `install_script`, with `--add` or an exported `.vsconfig` - Letting developers select their own workloads via `AllowStandardUserControl`, paired with `HideAvailableTab` so they can't install other Visual Studio SKUs - Verify and troubleshoot sections for the failure modes seen during #50717 Two constraints worth flagging for reviewers, both documented in the guide: - Fleet stops install scripts after one hour (`MaxHostSoftwareInstallExecutionTime`), and the multi-GB payload downloads inside that window. Pinning a large workload set can exceed it on a slow connection. - Standard users can't run the Visual Studio Installer with `--quiet` or `--passive` regardless of policy. That's Microsoft's constraint, not Fleet's, and it's why per-user selection goes through the installer UI rather than through Fleet. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. Not applicable: documentation only, no user-visible product change. ## Testing - [x] QA'd all new/changed functionality manually Documentation only, so there is no code to test. What was verified: - Guide structure and prose checked against the `fleet-guide-formatting` and `content-style` conventions: sentence-case task-led H1, prerequisites, inline `>` callouts next to the steps they affect, verify and troubleshoot sections, no summary coda, complete endmatter with the description under the 150-character build limit. - Confirmed `GET /guides/*` in `website/config/routes.js` is a wildcard handler, so this guide needs no route entry. - The GitOps keys used (`fleet_maintained_apps`, `install_script.path`, `post_install_script.path`) were checked against `docs/Configuration/yaml-files.md`, and the UI path against existing guides. - Registry keys, policy values, and installer switches were taken from Microsoft's documentation, linked inline in the guide. **Not verified, and worth a reviewer's eye:** the `AllowStandardUserControl` flow has not been exercised end to end on a real host with a standard (non-administrator) user. The policy behavior comes from Microsoft's docs rather than from a test. `publishedOn` is set to the date this was drafted. Update it before publishing. |
||
|
|
c510e5b6e2 |
Add tooltip explaining no Refetch button for Android hosts on Host details page (#50666)
Follow up PR for the following quick win based on feedback here: - https://github.com/fleetdm/fleet/issues/50001 <img width="899" height="217" alt="Screenshot 2026-08-06 at 10 32 24 AM" src="https://github.com/user-attachments/assets/462df6ae-ec09-433d-831b-9a0e3c242081" /> - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Android host details now display a disabled **Refetch** button with an explanatory tooltip. * The tooltip explains automatic synchronization and links to manual Android synchronization instructions in a new tab. * The **Last fetched** information is displayed directly without an additional tooltip. * **Documentation** * Updated Android host documentation to reflect the disabled Refetch control and manual synchronization guidance. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: LeAnn Gove <leann@fleetdm.com> Co-authored-by: LeAnn <97471894+Leanngove@users.noreply.github.com> |
||
|
Allen Houchins
|
051d12718c |
Add JetBrains ReSharper as a Windows Fleet-maintained app (#50659)
**Related issue:** Resolves #50567 Adds JetBrains ReSharper as a Windows Fleet-maintained app (winget `JetBrains.ReSharper`, version `2026.2.0.2`). ReSharper is a Visual Studio extension rather than a standalone app, so it does not follow the pattern of the other JetBrains FMAs (Rider, PhpStorm, DataGrip, etc.), which are plain NSIS installers that take `/S`. Reviewers should read the risks below before approving — a couple of things can only be confirmed from a validator run. ## What's here - `ee/maintained-apps/inputs/winget/resharper.json` - `ee/maintained-apps/inputs/winget/scripts/resharper_install.ps1` / `resharper_uninstall.ps1` - Generated `ee/maintained-apps/outputs/resharper/windows.json` + `apps.json` entry - Icon (`Resharper.tsx`, website PNG, alphabetical `index.ts` entries), generated from JetBrains' own brand asset ## Decisions that differ from the other JetBrains FMAs **`use_display_version_for_patch` is omitted.** Every other JetBrains winget input sets it, but the ReSharper manifest has no `AppsAndFeaturesEntries`, so the ingester hard-errors with `use_display_version_for_patch is set but no DisplayVersion found in winget manifest`. The patch policy therefore compares against winget's `2026.2.0.2`. **Custom `exists_query` instead of `fuzzy_match_name`.** The prefix is loose enough to match a possible per-VS-instance suffix, and excludes the separate ReSharper C++ and ReSharper SDK products: ```sql SELECT 1 FROM programs WHERE name LIKE 'JetBrains ReSharper%' AND name NOT LIKE 'JetBrains ReSharper C++%' AND name NOT LIKE 'JetBrains ReSharper SDK%' AND publisher = 'JetBrains s.r.o.'; ``` **Install script detects Visual Studio.** It builds `/VsVersion` from the instances `vswhere` reports and runs the installer with `/Silent=True /PerMachine=True /SkipEtwService=True`: - `/PerMachine=True` — the installer otherwise targets `%LocalAppData%`, which under Fleet's SYSTEM context would land in the SYSTEM profile instead of the developer's. The path is not configurable ([RSRP-428991](https://youtrack.jetbrains.com/issue/RSRP-428991)). - `/SkipEtwService=True` — JetBrains documents that `EtwHostService.msi` always raises a UAC prompt, so a fully silent install of every component is not possible ([SUPPORT-A-3189](https://youtrack.jetbrains.com/articles/SUPPORT-A-3189)). - It then waits for the uninstall registry entry (what osquery reads), because the web bootstrapper can outlive its own exit code, and logs the resulting ARP entries. **Uninstall removes every matching entry**, since ReSharper registers one per Visual Studio instance, using the defensive `UninstallString` parser and appending `/Silent=True` rather than the NSIS `/S`. Switches come from [JetBrains' silent install/uninstall article](https://resharper-support.jetbrains.com/hc/en-us/articles/207241485-How-to-use-silent-install-and-silent-uninstall-of-ReSharper-via-Command-Line), not guesswork. ## `unique_identifier` is provisional `program_publisher` is verified — `JetBrains s.r.o.` is hard-coded next to the ARP value names (`DisplayName`, `DisplayVersion`, `UninstallString`, `Publisher`) in `JetBrains.Platform.Installer.exe`, extracted from the installer. The **DisplayName is not verifiable offline.** The winget URL is a two-stage web bootstrapper: the 69 MB `.web.exe` contains `JetBrains.Platform.Installer.Bootstrap.exe`, which downloads the JetBrains dotUltimate installer, which downloads the product packages. The ARP entry is written by that downloaded stage under `Software\Microsoft\Windows\CurrentVersion\Uninstall\{GUID}`, with `DisplayName` taken from a per-VS-host `PresentableName`. So `JetBrains ReSharper` is a best-supported guess. It can be confirmed from a validator run: `cmd/maintained-apps/validate/windows.go` searches `programs` with a loose `LOWER(name) LIKE '%…%'` on both the catalog name and `unique_identifier`, and logs `Found app: '<DisplayName>' … Version: <ver>` after running `MutateSoftwareOnIngestion`. That reveals both the true DisplayName and the post-mutation version. The install script prints the same information. **Expect a follow-up commit correcting `unique_identifier` (and possibly the exists query) once that log lands.** ## Risks 1. **Payload is not pinned.** The SHA covers only the 69 MB bootstrapper; roughly 1.7 GB is fetched from `download.jetbrains.com` at install time. JetBrains publishes only a `windowsWeb` download for ReSharper, so there is no offline installer to point at. Install duration may exceed script timeouts. 2. **Requires Visual Studio.** With no VS present the installer has nothing to install, so the script exits 1 with a clear message. `windows-latest` runners ship Visual Studio 2022 Enterprise, so validation should be able to install. 3. **`/PerMachine=True` conflicts with pre-existing per-user installs.** JetBrains states machine-wide mode "is not compatible with existing installations in user profiles"; one must be removed first. 4. **`/SkipEtwService=True` omits the ETW host service**, so dotTrace/dotMemory profiling integration is incomplete. This is the documented tradeoff for an unattended install. 5. **Version reconciliation unconfirmed.** If the DisplayName ends in a marketing version, the JetBrains name-based version mutation fires and the validator's prefix check passes; a VS-suffixed name would instead fall back to the registry `DisplayVersion`. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] `go test ./ee/maintained-apps/...` passes; both output JSON files parse; generated SHA matches the winget manifest. - [ ] QA'd all new/changed functionality manually — **not done.** Install/uninstall need a Windows host with Visual Studio; relying on the FMA Windows validator, which is also how `unique_identifier` gets confirmed. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added ReSharper to the maintained Windows applications catalog. * Added support for silent machine-wide installation and uninstallation. * Added Visual Studio compatibility checks and installation failure reporting. * Added a ReSharper icon for display in the software catalog. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
616f9ab108 |
Update scripts in Fleet-maintained apps (#50756)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Updates** - Refreshed macOS and Windows installer metadata for numerous maintained applications, including AltTab, Arc, Calibre, ChatGPT, Chrome, Kiro, Loom, Postman, Prisma Access Browser, RustRover, and others. - Updated release versions, download links, version detection, and integrity checks. - **Bug Fixes** - Improved Evernote removal verification on Windows. - Enhanced Krita and Proton Drive macOS cleanup, including related support files and background services. - **Configuration** - Webex is now marked as frozen. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> Co-authored-by: Allen Houchins <allenhouchins@mac.com> |
||
|
Terry Kwok
|
d6d9d98d08 |
Fix typo in Marketing Email field description (#50783)
Fix typo in Marketing Email field description <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
Magnus Jensen
|
c905e69228 |
improve validation error messages for custom activations (#50753)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves nothing, just something I caught while doing test plan and PR review. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. part of a bigger story. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved validation messages for custom activations. * Clarified that standard configurations must reference exactly one configuration profile. * Added a documentation link for the single-profile reference requirement. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
dd3fda3f3c |
always update Apple enrollment type correctly (#50689)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45217 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Fixed Apple device re-enrollment so enrollment types and statuses update correctly when switching between manual, automated, and personal enrollment. - Improved handling of Apple Business Manager assignment changes during enrollment. - Preserved existing third-party MDM information while updating enrollment details. - Correctly records devices installed through automated enrollment and keeps enrollment state consistent across check-ins, restores, and over-the-air enrollment. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
dependabot[bot]
|
d9a2445832 |
Bump socket.io-parser from 4.2.6 to 4.2.7 in /website (#50504)
Bumps [socket.io-parser](https://github.com/socketio/socket.io) from 4.2.6 to 4.2.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/socketio/socket.io/releases">socket.io-parser's releases</a>.</em></p> <blockquote> <h2>socket.io-parser@4.2.7</h2> <h3>Bug Fixes</h3> <ul> <li>honor toJSON() when deconstructing a binary packet (<a href="https://redirect.github.com/socketio/socket.io/issues/5518">#5518</a>) (<a href="https://github.com/socketio/socket.io/commit/57f111439513809c633f2554be2f3104e4ad432c">57f1114</a>)</li> <li>reject binary packets with zero attachments (<a href="https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4">7c6ef57</a>)</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/spokodev"><code>@spokodev</code></a> made their first contribution in <a href="https://redirect.github.com/socketio/socket.io/pull/5518">socketio/socket.io#5518</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/socketio/socket.io/commit/4054894738817f5a2125e6e6b18e79d92c75ab33"><code>4054894</code></a> chore(release): socket.io-parser@4.2.7</li> <li><a href="https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4"><code>7c6ef57</code></a> fix(parser): reject binary packets with zero attachments</li> <li><a href="https://github.com/socketio/socket.io/commit/57f111439513809c633f2554be2f3104e4ad432c"><code>57f1114</code></a> fix(parser): honor toJSON() when deconstructing a binary packet (<a href="https://redirect.github.com/socketio/socket.io/issues/5518">#5518</a>)</li> <li><a href="https://github.com/socketio/socket.io/commit/8d2e4f7b8671ed2c4fa1fca9ec6f68e5cf82266e"><code>8d2e4f7</code></a> docs(security): add CVE-2026-59724 and CVE-2026-59725</li> <li><a href="https://github.com/socketio/socket.io/commit/d2d753fed4435015c2d83fe62e676b44e07fa3f7"><code>d2d753f</code></a> refactor(sio): align client file matching in Node.js HTTP server</li> <li><a href="https://github.com/socketio/socket.io/commit/dfb5ab3b6a2f00d1ecb226939022ea56e5701124"><code>dfb5ab3</code></a> fix(sio): prevent uWebSockets.js from serving missing client files</li> <li><a href="https://github.com/socketio/socket.io/commit/dcbd96154352dd84c189b41e5c0ec0df4b7fe6a5"><code>dcbd961</code></a> perf(eio): optimize polling request body buffering</li> <li><a href="https://github.com/socketio/socket.io/commit/6bb2e7f5fb7c548f0776328b4a19719723e27efd"><code>6bb2e7f</code></a> refactor(sio): internalize base64id dependency</li> <li><a href="https://github.com/socketio/socket.io/commit/a80711a8c3b11a3e75a84de567ac4d84820f4714"><code>a80711a</code></a> refactor(eio): internalize base64id dependency</li> <li><a href="https://github.com/socketio/socket.io/commit/8bead0f4c6fba027996bb9eab02f05120f35513d"><code>8bead0f</code></a> chore: upgrade to TypeScript 6</li> <li>Additional commits viewable in <a href="https://github.com/socketio/socket.io/compare/socket.io-parser@4.2.6...socket.io-parser@4.2.7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Eric
|
f145c778b8 |
Website: log number of android enterprise requests in the past minute (#50780)
Related to: https://github.com/fleetdm/fleet/issues/49212 Changes: - Updated the custom hook to create `sails.androidProxyApiRequestCount`, and to log and reset the value every minute - Updated android proxy endpoints to increment `sails.androidProxyApiRequestCount` every time a request to the Android management API is sent <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Monitoring** * Added comprehensive tracking for Android Management API requests across enrollment, enterprise, device, application, policy, and command operations. * Added periodic request-count logging and automatic resets when Android Enterprise credentials are configured. * Improved reporting alignment with minute-based API limits while keeping logs quiet during periods without requests. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali Riaz
|
fc35085cf3 |
Update go-to-market-operations.md fix the spelling visable to visible (#50767)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
Allen HouchinsandClaude
|
9b5e9775ce |
Unfreeze XnConvert (macOS) (#50700)
Automated unfreeze probe. Removes `"frozen": true` and regenerates the output manifest so test-fma-macos-pr-only can validate `xnconvert/darwin` at its current upstream version. Frozen since: not recoverable from this checkout (squashed/shallow history — every input file is attributed to the same import commit) Version: 1.112.0 -> 1.115.0 Draft until validation reports. Merge only if the FMA checks are green and the validate shard actually ran for this slug. --- _Generated by [Claude Code](https://claude.ai/code/session_01Hx5UA4Dhqh2UUCX8h6k6Vv)_ Co-authored-by: Claude <noreply@anthropic.com> |
||
|
kitzyandAllen Houchins
|
5db78a63e3 |
Add Visual Studio 2022 (Community/Professional/Enterprise) as Windows FMAs (#50717)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #50653 Adds **Visual Studio 2022 Community, Professional, and Enterprise** as Windows Fleet-maintained apps. customer-universitas needs all three editions. ## What's here - Three input files, one per edition, each pointing at its own winget package (`Microsoft.VisualStudio.2022.{Community,Professional,Enterprise}`, all at `17.14.37`). - A shared install script (`visual_studio_2022_install.ps1`) — the downloaded file is a ~4 MB bootstrapper, not the IDE. The real multi-GB payload downloads from Microsoft *during* the install script, so install time depends on the host's network speed and counts against Fleet's 1-hour software-install timeout. `--wait` is required or the bootstrapper forks the real install to a background process and returns almost immediately. - Three uninstall scripts (one per edition) that resolve the install path via `vswhere.exe -products Microsoft.VisualStudio.Product.<Edition>` and call `vs_installer.exe uninstall --installPath <path> --quiet --norestart --wait`, since VS has no normal `UninstallString`. - Both scripts map winget's documented `3010`/`1641` (reboot pending/initiated) to a successful exit, and fail clearly on `1001`/`1618` (another VS Installer operation already running). - Default install ships the bare IDE shell (no `--add` workloads) — matches plain `winget install` behavior, per the issue's own conclusion that this needs no special-casing. - Icons: no scriptable source (no Windows host to extract the real per-edition `.exe` icon, and Microsoft's own download pages don't expose one) turned up distinct Community/Professional/Enterprise badge art, so all three currently use the same public Visual Studio mark ([Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Visual_Studio_Icon_2022.svg), marked public domain). **Flagging for #g-software Product Designer** to swap in the real per-edition badges if we have them. ## What I could not verify (no Windows host in this environment) - `unique_identifier`/publisher (`Visual Studio Community/Professional/Enterprise 2022`, publisher `Microsoft Corporation`) are taken from the winget locale manifest, not confirmed against a live registry entry. - The version-string quirk the issue calls out: winget's `AppsAndFeaturesEntries.DisplayVersion` is `"17.14.37 (July 2026)"`, not a clean version. I deliberately did **not** set `use_display_version_for_patch` — feeding that non-numeric string in as the patch target would break `version_compare` ordering across future version bumps (see the comment in `ingester.go`). Instead the patch policy compares against the plain winget `PackageVersion` (`17.14.37`), same as most winget FMAs. This should hold up if `version_compare` reads leading numeric-dot segments and ignores the trailing text, but I can't confirm that against real `programs.version` output without a host. - Whether `vs_installer.exe` actually honors `--wait` for `uninstall` the way the bootstrapper does for `install` — Microsoft's own docs say `--wait` "can only be passed into the bootstrapper; the installer (setup.exe) doesn't support it," which is in tension with the exact command this issue asked for and what I've seen used in the wild. Worth watching in validation logs. - End-to-end install timing on a normal (non-datacenter) connection, within the 1-hour timeout. # Checklist for submitter - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. <!-- Not added — no precedent for a changes file on FMA-addition PRs (e.g. #50553, TeamViewer Host). --> - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] `apps.json` is valid JSON with descriptions filled in for all three editions - [x] Generator output reviewed: exists/patched queries, SHA256 (matches the live winget manifest), installer URLs - [x] `go build`/`go test ./ee/maintained-apps/...` pass; no shared ingester/validator code changed - [ ] FMA validator: install → detect → uninstall on a Windows host — **pending, needs a Windows host** - [ ] QA'd all new/changed functionality manually — **pending, same reason** ## FMA-specific (from issue #50653's acceptance criteria) - [x] Edition scope decided and recorded on the issue (all three: Community, Professional, Enterprise) - [x] Input added under `ee/maintained-apps/inputs/winget/` - [x] Custom install script handles `3010`/`1641` as success and fails clearly on `1618`/`1001` - [x] Custom uninstall script resolves the install path via `vswhere` and calls `vs_installer.exe uninstall` - [ ] Identity fields verified against a real installed host — **not yet, see above** - [ ] Patch policy verified against actual `programs.version` — **not yet, see above** - [ ] Install verified end to end within the 1-hour timeout on a normal-speed connection — **not yet** - [ ] Passes the FMA validator: install → detect → uninstall — **not yet** - [x] Icon exists (shared placeholder mark across all three editions — flagged for PD) No shared/ingester/validator code changed. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added Visual Studio 2022 Community, Professional, and Enterprise editions to the software catalog. - Added support for installing and uninstalling each edition with quiet execution, installation detection, error handling, and reboot handling. - Added version 17.14.37 metadata and update detection. - Added Visual Studio branding and edition-specific icons throughout the software interface. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Allen Houchins <allenhouchins@mac.com> |
||
|
dependabot[bot]
|
12754cc48d | Bump js-yaml from 4.3.0 to 4.3.1 (#50745) | ||
|
dependabot[bot]
|
b2ef218213 | Bump js-yaml from 4.3.0 to 4.3.1 in /tools/fleet-slackbot (#50746) | ||
|
Carlo DiCelico
|
66875070df | trigger CI | ||
|
Carlo
|
3e166ac42b |
Fix gofmt formatting in teams_test.go (#50769)
**Related issue:** NA `main` is currently failing the `lint` job on a stray double blank line in `server/datastore/mysql/teams_test.go`: ``` server/datastore/mysql/teams_test.go:1209:1: File is not properly formatted (gofmt) ``` This is the `gofmt -w` output and nothing else — one blank line removed, no code change. # Checklist for submitter ## Testing - [ ] QA'd all new/changed functionality manually Whitespace-only change to a test file; no behaviour to QA. Verified `gofmt -l` on the file is empty and `go vet ./server/datastore/mysql/` is clean. |
||
|
Jonathan Katz
|
4addc81ad2 | Fix gofmt in teams_test.go after merge | ||
|
Jonathan Katz
|
6ef4ba3910 | Merge remote-tracking branch 'origin/main' into feat/39962-patch-when-closed | ||
|
kitzy
|
f656ac533a |
Update custom host vitals guide: style cleanup and Host vitals label support (#50660)
**Related issue:** N/A ## Summary Audits and updates `articles/custom-host-vitals.md` against Fleet's guide-formatting and content-style skills, and documents that custom host vitals can be used as Host vitals label criteria: - Trimmed the opening from 3 paragraphs to 2, and added a sentence pointing to the new labels use case. - Renamed "Using a custom host vital in scripts and configuration profiles" → "Reference a custom host vital in scripts and configuration profiles" to match the imperative, action-led heading style used by sibling sections. - Dissolved the standalone "Known limitations and issues" section — its items are now `> **Note:**`/`> **Warning:**` callouts placed next to the step each one actually affects, instead of collected at the bottom. The delete-protection callout now also covers Host vitals labels, not just scripts/profiles. - Removed em dashes and bolding used for emphasis rather than UI elements, per Fleet's content style guide. - New "Filter hosts by a custom host vital" section (UI + GitOps) documenting the existing Host vitals label type's support for custom host vitals, including the current exact-match-only limitation. # Checklist for submitter - [ ] QA'd all new/changed functionality manually |
||
|
Nico
|
5a1365dc41 |
40493 webhooks for host activities (#50595)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #40493 Changes already reviewed in the PRs merged to this feature branch. Only additive change was https://github.com/fleetdm/fleet/pull/50595/commits/c0934e1fee46a734f9499a4c782563d4fcc345c4 to address CodeRabbit's comments. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually https://github.com/user-attachments/assets/ea7f5157-a67a-4d83-842d-62197bd1546d ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Added host activity automations with configurable webhook destinations. * Manage automations from the Hosts page with validation, permissions, and enable/disable controls. * Added GitOps support for team and unassigned-host webhook settings. * Activity webhooks now include fleet-scoped host IDs where applicable. * Added profile UUIDs to MDM profile resend activity details. * **Bug Fixes** * Improved Windows MDM enrollment activity details by including the linked host ID when available. * Preserved existing webhook settings when omitted during updates. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
NicoandLucas Manuel Rodriguez
|
358b8c43a5 |
iOS/iPadOS: More host vitals (#50496)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #39281 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually https://github.com/user-attachments/assets/8ef7c66d-f8a6-46d5-ba17-66c1df8171b6 https://github.com/user-attachments/assets/6f67b49b-daf1-4acd-ad0f-55a7d1225a44 ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added 29 iOS/iPadOS device vitals to host details and API responses. * Added a “View all” modal for browsing complete device vitals, including subscriptions and accessibility details. * Added support for cellular technology, organization information, attestation data, and device settings. * **Privacy** * Personal/BYOD enrollments exclude expanded device-vitals fields. * Sensitive vitals are removed from device URL-authenticated responses. * **Bug Fixes** * Stale vitals are cleared when enrollment ownership changes or hosts are deleted. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> |
||
|
Lucas Manuel Rodriguez
|
3de43c84af |
Bump out-of-order migrations not included in v4.90.0 (#50690)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Two migrations merged to `main` were not included in the v4.90.0 release but have timestamps older than `20260723181411_MultipleCustomPackagesPerTitle` (the latest migration shipped in v4.90.0). Databases already on v4.90.0 would never apply them, since goose only runs migrations newer than the current (highest applied) version. Bumped both to current timestamps via `tools/bump-migration`: - `20260721090128_AddTokenInvalidToABMTokens` → `20260806154139_AddTokenInvalidToABMTokens` - `20260721160351_AddHostMDMWindowsProfilesStatus` → `20260806154150_AddHostMDMWindowsProfilesStatus` No schema or logic changes — only the file names, `Up_`/`Down_`/`TestUp_` function names, and the regenerated `schema.sql` (`migration_status_tables` versions). Verified that none of the other unreleased migrations (20260724+) depend on the schema these two create, so applying them last is safe. # Checklist for submitter If some of the following don't apply, delete the relevant line. ## Testing - [x] Added/updated automated tests (existing migration tests renamed and re-run against MySQL) ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Database Updates** - Added support for tracking whether ABM tokens are invalid. - Added Windows MDM profile status tracking and backfilled existing records. - **Maintenance** - Updated database migration identifiers and status records to ensure migrations are applied consistently. - **Tests** - Updated migration verification tests to match the revised migration identifiers. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rajendra Kadam
|
25cfac309c |
Let an edit clear a declaration's activation (#50711)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # Raised by the frontend while building the Edit modal: there was no way to clear a declaration's custom activation. An absent `activation` field meant "keep it" on a labels-only edit but "delete it" when the profile contents were replaced, so clearing wasn't expressible and an ordinary content edit silently dropped the activation. The field is now three-state: | Request | Result | |---|---| | no `activation` key | stored activation left alone | | `activation` as an empty value | removed | | `activation` as a file | replaced | Multipart has no null, so an empty value stands in for one. Note this changes one existing behaviour: replacing a profile's contents without sending an activation used to delete it, and now preserves it. Removal has to be explicit. Anything ambiguous is rejected rather than guessed at, since every ambiguous form would otherwise resolve to deleting the stored activation: | Request | Result | |---|---| | `activation` as a nonempty value | 422 — more likely a malformed upload than a request to delete | | `activation` as a zero-byte file | 422 — a failed upload shouldn't delete anything | | `activation` sent as both a file and a value | 422 — one says replace, the other says remove | The unsupported-profile check also keys on the field being present rather than on it carrying content, so clearing an activation on a Windows, Android or mobileconfig profile is rejected instead of quietly succeeding. On the datastore side, `SetOrUpdateMDMAppleDeclaration` now takes an explicit action (`MDMAppleActivationKeep` / `MDMAppleActivationApply`) instead of inferring intent from the struct. The write is a full replace, so "keep" has to be stated — otherwise preserving the activation would mean reading it back and handing it to the write, which also risked dropping its Fleet variable associations. As a side effect the OS updates cron no longer fires a DELETE for an activation it never had. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually Integration test covers all three states end to end through the multipart decoder, plus service-level tests for preserve and explicit removal. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Apple MDM declaration updates now support preserving, replacing, or explicitly removing activation settings. * Omitted activation fields leave existing settings unchanged, while empty fields remove them. * Apple OS update declarations retain activation settings by default. * **Bug Fixes** * Labels-only updates no longer unintentionally carry forward activation data. * Invalid, empty, or conflicting activation uploads now receive clear validation errors. * Unsupported profile types now reject activation updates. * **Tests** * Added coverage for activation preservation, replacement, removal, and integration scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
51d9f493ef | show user-scope icon for ios and ipados (#50715) | ||
|
|
b5940c8eca |
Bump brace-expansion in /website (#50453)
Bumps and [brace-expansion](https://github.com/juliangruber/brace-expansion). These dependencies needed to be updated together. Updates `brace-expansion` from 2.1.2 to 2.1.4 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/juliangruber/brace-expansion/commit/b25213dff0446d622f97d736420b9830ee1abc32"><code>b25213d</code></a> 2.1.4</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac"><code>1e30c93</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/878df3989e816dfb28cbe0d64de0b88738ff0ed6"><code>878df39</code></a> 2.1.3</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/c8bd93cfff4e45cb295557d2be17e1d1d4e52a11"><code>c8bd93c</code></a> npm ignore .claude</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"><code>d13ff45</code></a> fix: backport GHSA-mh99-v99m-4gvg (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/130">#130</a>)</li> <li>See full diff in <a href="https://github.com/juliangruber/brace-expansion/compare/v2.1.2...v2.1.4">compare view</a></li> </ul> </details> <br /> Updates `brace-expansion` from 1.1.16 to 1.1.18 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/juliangruber/brace-expansion/commit/b25213dff0446d622f97d736420b9830ee1abc32"><code>b25213d</code></a> 2.1.4</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac"><code>1e30c93</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/878df3989e816dfb28cbe0d64de0b88738ff0ed6"><code>878df39</code></a> 2.1.3</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/c8bd93cfff4e45cb295557d2be17e1d1d4e52a11"><code>c8bd93c</code></a> npm ignore .claude</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"><code>d13ff45</code></a> fix: backport GHSA-mh99-v99m-4gvg (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/130">#130</a>)</li> <li>See full diff in <a href="https://github.com/juliangruber/brace-expansion/compare/v2.1.2...v2.1.4">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Luke Heath <luke@fleetdm.com> Co-authored-by: Eric <eashaw@sailsjs.com> |
||
|
Allen Houchins
|
01f9e534f7 |
Fix Genesys Cloud FMA: winget dropped x86, ship x64 MSI (#50742)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually # Details The nightly maintained-apps ingestion job panicked with `failed to find installer for app` on Genesys Cloud: ``` {"time":"2026-08-07T03:17:22.787715966Z","level":"INFO","msg":"ingesting winget app","name":"Genesys Cloud"} panic: ingesting winget app: failed to find installer for app ``` ## Why Genesys.GenesysCloud **2.53.923.0** stopped publishing x86 installers upstream. Previous versions (e.g. 2.51.916.0) shipped two x86 installers (a burn `.exe` and a wix `.msi`); the latest manifest ships only a single **x64** wix MSI. Our input pinned `installer_arch: "x86"`, so the ingester filtered out the only available installer and panicked. ## What changed - `ee/maintained-apps/inputs/winget/genesys-cloud.json`: `installer_arch` `x86` → `x64` - `ee/maintained-apps/outputs/genesys-cloud/windows.json`: regenerated with `go run ./cmd/maintained-apps -slug genesys-cloud/windows` — version 2.51.916.0 → 2.53.923.0, installer URL now the x64 MSI, sha256 matches the winget manifest's `InstallerSha256` ## Notes for reviewers - Exists/patched queries are unchanged (still keyed on ARP `name = 'GenesysCloud'`, `publisher = 'Genesys Inc.'`), and install/uninstall script refs are identical since it's still a machine-scope MSI — detection and remediation carry over for existing installs. - The MSI `UpgradeCode` is unchanged upstream (`{A0E8C487-C337-441C-83AF-90364DA4B793}`), so the x64 MSI upgrades existing x86 installs in place (ProductCode is new, install dir moves from `ProgramFiles(x86)` to `ProgramFiles`). - The new manifest declares a `Microsoft.VCRedist.2015+.x64` dependency (the old x86 MSI declared the x86 variant). Fleet doesn't resolve winget dependencies; the FMA validator run on this PR will confirm whether the installer tolerates its absence. |
||
|
kitzy
|
779704de89 |
Add guide: manage Fleet during a GitOps outage (#50731)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA # Checklist for submitter - [x] Docs-only change (new guide article); no code, tests, migrations, settings, or fleetd/orbit changes. ## Summary Adds a new guide, `articles/manage-fleet-during-a-gitops-outage.md`, covering the business continuity workflow for making urgent changes in the Fleet UI when a CI provider (e.g. GitHub Actions) is down, and how to reconcile the GitOps repo afterward so the next automated run doesn't revert the fix. |
||
|
Dante Catalfamo
|
3c8df41762 |
Deduplicate Android MDM Pub/Sub deliveries and protect against reordering (#49792)
**Related issue:** Resolves #43502 |
||
|
Juan Fernandez
|
e29210e6f6 |
Software inventory & vulnerabilities: Add Adobe plugins
Resolves #45414 - Added Adobe plugins to software inventory: Fleet now detects Adobe Creative Cloud plugins (CEP and UXP extensions) on macOS and Windows hosts and lists them on the Software page and host details with the software type "Plugin (Adobe)", including version and host count. - Adobe plugins are excluded from vulnerability scanning, so no vulnerabilities are reported for them. No vulnerability data source maps an Adobe CEP or UXP extension to a CVE; Adobe files CVEs against the host application (Photoshop, Acrobat, and so on), which Fleet already scans. |
||
|
Noah Talerman
|
1e23b101ae |
API docs tweak: Run ad hoc live report by host identifier (#50722)
- There are more valid host identifiers (not just `uuid`) |
||
|
Amrit
|
c63a7083c6 |
Update README.md (#50695)
Fixing typo and rewording the Purchase a SaaS tool section. |
||
|
Victor Lyuboslavsky
|
3d186bd172 |
Clear the escrowed managed local account password on MDM re-enrollment (#50596)
Fixed unreleased bug where admin password was still shown on a wiped host after re-enrollment. Add a `deleted` column and soft-delete the row on re-enrollment, mirroring host_recovery_key_passwords. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43488 # Checklist for submitter ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Added support for safely retiring managed local account passwords during device re-enrollment. * Retired credentials are excluded from retrieval, status updates, command operations, and automatic rotation. * Successfully escrowing a password can restore a previously retired record. * **Bug Fixes** * Re-enrollment cleanup now clears stale password rotation state. * Cleanup failures stop reset or re-enrollment processing to prevent incomplete credential changes. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
melpikeandEric
|
e6f1abe5a2 |
[Route] Add route for DDM activations learn more page (#50465)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48222 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a redirect from the DDM activations information page to the relevant section of the Custom OS Settings article. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Eric <eashaw@sailsjs.com> |
||
|
Allen Houchins
|
cc9f8e4891 |
Dogfood: drop platform prefix from policy names (#50658)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA The Fleet UI now displays a policy's targeted platform, so repeating it in the policy name is redundant. This strips the leading `macOS - ` / `Windows - ` / `Linux - ` from all 84 prefixed policies in `it-and-security`. ## Collisions GitOps rejects duplicate policy names within a fleet ([`pkg/spec/gitops.go`](https://github.com/fleetdm/fleet/blob/main/pkg/spec/gitops.go#L2020)), and the Workstations fleet includes macOS, Windows, and Linux policies together. 14 stripped names would collide, so for those the platform moves to a trailing suffix instead of being dropped: | Before | After | |---|---| | `macOS - Gatekeeper enabled` | `Gatekeeper enabled` | | `Windows - Secure Boot enabled` | `Secure Boot enabled` | | `Linux - Removable storage is read-only` | `Removable storage is read-only` | | `macOS - Disk encryption enabled` | `Disk encryption enabled (macOS)` | | `Windows - Disk encryption enabled` | `Disk encryption enabled (Windows)` | | `Linux - Disk encryption enabled` | `Disk encryption enabled (Linux)` | 49 policies lose the platform entirely; 35 keep it as a suffix. The 14 suffixed names are: Disk encryption enabled, Sufficient disk space available, User .npmrc min-release-age at least 0.5 days, 1Password installed, Battery healthy, and the 9 patch policies that exist for both macOS and Windows (1Password, Google Chrome, Firefox, Slack, Zoom, Visual Studio Code, Okta Verify, Claude, Adobe Acrobat Reader). Also updates the descriptions of `macos-screen-lock-exclusions` and `windows-screen-lock-exclusions`, which quote policy names. ## Notes for the reviewer - **This is destructive on apply.** GitOps matches policies by name, so applying this deletes the 84 existing policies and creates new ones. Policy pass/fail history and host results reset. Automations defined in the policy YAML (calendar events, install/script triggers) carry over, but anything referencing these names outside the repo — saved filters, dashboards, Slack workflows — needs updating separately. - `tools/fleet-slackbot/system-prompt.js:338` still documents the `<Platform> - <Description>` convention, and the `fleetctl new` macOS template still ships a prefixed name. Both left alone intentionally — out of scope for dogfood config. - Four policy files appear unused by any fleet and were renamed only for consistency: `lib/{macos,windows}/policies/update-claude.yml` and `update-slack.yml`. Their names duplicate entries already in `patch-fleet-maintained-apps.yml` for the same platform. Worth deleting in a follow-up. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. N/A — dogfood GitOps config only, no product code changes. ## Testing - [x] QA'd all new/changed functionality manually Verified locally: - No `macOS - ` / `Windows - ` / `Linux - ` strings remain anywhere under `it-and-security/`. - Every fleet passes the same uniqueness rule GitOps enforces — Workstations resolves to 78 policies with 0 duplicate names; all other fleets unchanged. - All 73 touched/related YAML files parse. - The diff touches only `- name:` lines plus the two label descriptions. |
||
|
Jonathan Katz
|
1f86654e8f |
Patch when closed: default continuous automation off for Force patch (#50691)
- Sets continuous automations to off by default in the Deploy modal and Edit policy page <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Continuous automation settings now behave consistently when creating or editing Force patch policies. - Manual patching disables continuous automation, while closed patching enables it. - Other patch selections preserve the current automation setting. - Saving existing policies now correctly retains the configured automation state. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Harrison RavazzoloandLucas Manuel Rodriguez
|
32802c5731 |
Fix Google Calendar scheduling over Focus Time and Out of Office events (#50605)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves https://github.com/fleetdm/fleet/issues/50548 Fleet's calendar integration was scheduling maintenance events over users' **Focus Time** and **Out of Office** blocks, even when those were marked Busy. The root cause is the event query in `ListEvents` (ee/server/calendar/google_calendar.go), which only requested `"default"` event types — so `focusTime` and `outOfOffice` events were never returned and never considered during conflict detection. ## Change Added the blocking event types to the query: ```go EventTypes("default", "focusTime", "outOfOffice"). ``` # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. --------- Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> |
||
|
Jordan Montgomery
|
133e4a3832 |
Tweak manual enroll profile permissions (#50688)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Restricted access to manual MDM enrollment profiles to global or team administrators and maintainers. * Prevented unauthenticated, roleless, observer, and GitOps users from viewing enrollment profile data. * Updated authorization documentation to reflect the required permissions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Nick Blee
|
dd0c275974 |
Update deploying-okta-platform-sso-with-fleet.md (#49855)
Changes to Step 2 in both Options 1 & 2. The current documentation Click the *Endpoint Management* Tab and the proposed change is Click the *Device Access* Tab <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
Rajendra Kadam
|
a2aec82466 |
Support custom DDM activations in GitOps (#50557)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49972 Adds custom DDM activations to the GitOps workflow. A profile entry can point at an activation file with a new `activation` key, the batch endpoint validates and stores it through the same code as the single-profile upload, and `fleetctl generate-gitops` exports it back out. ```yaml controls: macos_settings: custom_settings: - path: ./lib/profiles/passcode.json activation: ./lib/activations/passcode.json ``` `activation` is only valid on a declaration (`.json`) profile, and can't be combined with `paths:` because an activation names exactly one declaration. Removing the key removes the stored activation. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Verified on an ADE-enrolled Mac: exported an existing declaration and its custom activation with `generate-gitops`, removed everything by applying a config with no profiles, then re-applied the exported files. All three declarations came back with the correct scopes, the activation attached to only its own declaration, and the predicate was reported correctly on the host. ## New Fleet configuration settings - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) |
||
|
Rajendra Kadam
|
984b09cc7f |
Serve custom DDM activations to devices (#50421)
**Related issue:** Resolves #49971 Serves the custom activations stored by #49970 to devices. Stacked on #50280. - The manifest advertises a custom activation's own identifier; the fetch serves its stored JSON with the predicate intact. Secrets and host variables are expanded at delivery, like configurations. - `activation_updated_at` folds into the token, so editing only a predicate re-syncs the host even though the declaration's content didn't change. - Management declarations are served under the manifest's `Management` section, have their own endpoint, and report status. - Predicate outcomes map per the Figma dev note: `Info.Predicate` → verified with an explanation, `Error.ActivationFailed` → failed. ### Three things to look at **Generated activations are renamed to `<declaration uuid>.activation`.** Removes the collision between an admin-chosen identifier and one Fleet generates, and collapses the fetch into a single lookup rather than match-then-trim. Note this differs from the CoS wording of "byte-for-byte identical to today". Existing hosts will see their activations renamed once. The sync token doesn't move for the rename alone — activation identifiers aren't part of it, confirmed in `MDMAppleDDMDeclarationsToken` — so it happens lazily on the next real DDM change rather than all at once. **`activation_updated_at` is not the `max()` the issue describes.** The issue asks for `max(activation uploaded_at, latest variable change)`. Variable changes stay on `variables_updated_at`; this is `GREATEST(uploaded_at, secrets_updated_at)`. Same outcome, since `EffectiveDDMToken` hashes all the timestamps together, but each signal stays independently comparable, which is what keeps the reconciler idempotent. **The token is computed in three places, not two.** SQL in `MDMAppleDDMDeclarationsToken`, Go in `EffectiveDDMToken`, and a third independent copy building the manifest-level token in `handleDeclarationItems`. All three now carry the new term in the same order. `ActivationUpdatedAtFoldsIntoToken` asserts the SQL and Go agree with it populated — they only agreed for the nil case before. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Tested on an ADE-enrolled Mac (macOS 26.5.1) against a local server: the custom activation is advertised and fetched by its own identifier, an activation-only edit re-syncs the device even though the declaration is unchanged, a true predicate enforces the policy on the host, and a false one comes back verified with the explanation. That turned up two bugs, both fixed here and both invisible to the test suite: - `MDMAppleStoreDDMStatusReport` computed the matching token with `activation_updated_at` but never selected the column, so it was always nil. Every status report was silently dropped and profiles sat in verifying forever. - Apple splits a predicate outcome across two arrays — the activation reports `Info.Predicate`, the configuration it gates reports `Error.ActivationFailed`. Reading only the configuration made a host the predicate excluded look failed. Now correlated via the activation identifier in the failure details. The test payloads for the second one are the real reports the Mac sent, not hand-written. Note for anyone testing in the UI: the OS settings tooltip for a verified profile is hardcoded to "The host applied the setting. Fleet verified." and doesn't read `detail` yet, so a predicate-excluded profile reads wrong there. Backend stores the right message; rendering it is #49973. New cases in `apple_mdm_ddm_test.go`: the token agreement above; a custom activation advertised and served with its predicate, with the generated name no longer resolving for it; a declaration without one still getting the synthesized activation; management routing plus the endpoint type guard; the three predicate status outcomes; and a host outside a declaration's scope getting an empty manifest and an error fetching the activation by name. 13 existing assertions moved from `<identifier>.activation` to `<uuid>.activation`. The `GeneratedActivationStillServedWhenNoCustomOne` case caught a real bug on its first run: the `LEFT JOIN` returns NULL for declarations without a custom activation, which `json.RawMessage` can't scan, so every non-custom activation fetch would have 500'd. That's the no-regression path. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Apple DDM management declarations and custom activation delivery. * Added host-scoped activation resolution, activation identifiers, and activation update timestamps. * Added support for activation variables, secrets, assets, and separate management and configuration endpoints. * **Bug Fixes** * Declarations are now redelivered when activation predicates change or are removed. * Improved status reporting for predicate exclusions, activation failures, and management declarations. * Improved synchronization token updates when variables, assets, or activations change. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Noah TalermanandRachael Shaw
|
f434789706 |
Remove obsolete links from REST API documentation (#50589)
Removed outdated sections from the REST API documentation. We're not consistently adding new ones like "Vulnerabilities" and I don't think the website uses these. Co-authored-by: Rachael Shaw <r@rachael.wtf> |
||
|
RachelElysia
|
790b240bee | Fleet UI: Fix stretched software table headers on empty refetch (#50613) | ||
|
kitzyandRachael Shaw
|
7d59390b5c |
Document custom host vitals support for Host vitals labels (#50661)
**Related issue:** N/A ## Summary Fleet's "Host vitals" label type already supports matching on a custom host vital's exact value (in addition to the existing IdP-based criteria), but this wasn't documented anywhere outside the custom host vitals guide (see companion PR #50660). Adds that coverage across the remaining references: - `articles/managing-labels-in-fleet.md`: the "Host vitals" label type bullet only listed the two IdP criteria; now also mentions custom host vitals, and notes the type is exact-match only. - `docs/Configuration/yaml-files.md`: - Adds a `custom_host_vital` example to the labels GitOps reference, alongside the existing IdP example. - Adds a new `## custom_host_vitals` section documenting the top-level GitOps key used to define vitals in the first place (referenced by the labels criteria above), which had no reference-doc coverage at all. Calls out that, unlike `labels`, omitting the key entirely deletes every existing custom host vital rather than leaving them intact. - `docs/REST API/rest-api.md`: - The `criteria` parameter table was missing `custom_host_vital` as a valid `vital` value and missing `custom_host_vital_id` entirely — added both. - None of the 6 registered custom host vitals endpoints (list, create, update, delete, set a host's value, and the spec/replace-all endpoint GitOps uses) had reference entries at all. Adds a full "Custom host vitals" section following the existing "Custom variables" section's format, including the same destructive replace-all behavior called out in the YAML reference above. # Checklist for submitter - [ ] QA'd all new/changed functionality manually --------- Co-authored-by: Rachael Shaw <r@rachael.wtf> |
