6d004b98bcd25d646d195b992d8d1ea14ddb3d05
2643
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Carlo
|
cbf2be25ed |
Fix host software label scope after FMA replacement (#46649)
Resolves #43863 |
||
|
Magnus Jensen
|
a4d1cfab1f |
CSUD: Add validation for OS Update profiles and OS updates being configured (#46545)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45282 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Deploy custom OS update configuration profiles for Apple (macOS/iOS/iPadOS) and Windows; tracks and enforces one custom OS‑update profile per scope. * **Improvements** * Prevent changing OS update settings when a custom profile exists; returns guidance to remove the custom profile first. * Batch upload now detects OS‑update payloads and enforces license requirements. * UI error handling surfaces API-specific messages. * FileVault control separated from OS updates and gated behind a configurable flag/license. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor LyuboslavskyandKonstantin Sykulev
|
ea5b15699e |
windows_mdm: link enrollment row via DevDetail at first management session (#46268)
Closes the race after Windows BYOD MDM enrollment (Settings > Access work or school > Connect) where mdm_windows_enrollments.host_uuid stayed empty for ~10s while osquery's distributed-read cycle ran directIngestMDMDeviceID Windows. During that gap any server-side lookup keyed on host UUID via MDMWindowsGetEnrolledDeviceWithHostUUID returned NotFound. processIncomingMDMCmds now inspects unlinked enrollments on every management session: it parses any incoming Results for ./DevDetail/Ext/Microsoft/SMBIOSSerialNumber, looks up the Windows host by hardware_serial, and updates host_uuid. If still unlinked after processing the incoming message, it appends a Get for that LocURI to the response so the device replies on the next round-trip. The Get is idempotent and reinjected each session until linkage succeeds. The post-link UPN/SCIM/DEP bookkeeping previously inlined in directIngestMDMDeviceIDWindows is extracted into a shared helper (osquery_utils.LinkWindowsHostMDMEnrollment) so both the new SyncML path and the osquery direct-ingest backstop run it exactly once per linkage. New datastore method WindowsHostLiteByHardwareSerial does a Windows-only serial lookup and returns NotFound when two Windows hosts share a serial, so we never mis-link on virtualization-shared SMBIOS values. For Autopilot and Entra-during-OOBE the host record does not exist until fleetd installs later in ESP, so the osquery backstop and the name-based fallback in setup_experience.go remain in place for those flows. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45380 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Immediately link Windows BYOD MDM enrollments to host records during the first management session when a device serial is present, and prompt the device to resend serial info if missing. * Detect and ignore placeholder/ambiguous hardware serials to avoid incorrect host linking. * Reduce noisy warnings for internal-sync command IDs. * **Bug Fixes** * Resolve a race causing Windows MDM enrollments to remain unlinked for several seconds. * **Tests** * Added coverage for serial-based linkage, retry behavior, placeholder detection, and internal-command ID handling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Konstantin Sykulev <konst@sykulev.com> |
||
|
Victor Lyuboslavsky
|
0858580ff5 |
Refactored ListHostSoftware and ModifyAppConfig for nilaway (#46555)
Refactored `ListHostSoftware` and `ModifyAppConfig` into smaller helpers so nilaway can analyze them for nil-pointer dereferences <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46554 Refactoring. No functional changes. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Improved host software listing by consolidating assembly, merging, deduplication, and out-of-scope filtering into dedicated helpers for more reliable and maintainable results. * Streamlined app configuration updates by extracting conditional-access (Okta) validation into a focused helper, improving validation consistency and error reporting. * **Chores** * Updated static analysis configuration: bumped a pinned plugin version and removed a suppression rule that hid certain internal lint messages. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
00d340291c |
Mark ptr methods as deprecated (#46626)
Mostly to prevent AIs from picking them instead of using new (because then the linters in CI complain). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Deprecated internal pointer helper functions in favor of Go's standard pointer allocation syntax. Updated test files throughout the codebase to use the standard approach for consistency and maintainability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rajendra kadam
|
38d13b135c |
Skip policy_membership writes for unchanged values (#44191)
Implements the optimization described in [#44191](https://github.com/fleetdm/fleet/issues/44191): inside `RecordPolicyQueryExecutions`, fetch the existing `policy_membership` rows for the incoming policies and narrow the UPSERT batch to only the rows whose stored value differs from incoming. Steady-state rows are skipped entirely. The added SELECT is a small indexed lookup on `(host_id, policy_id)`; the savings are on the writer side, which is the loadtest bottleneck. |
||
|
Juan Fernandez
|
923d1a2e3d |
Fix FK constraint failure in RecordPolicyQueryExecutions when policy deleted mid-flight (#46587)
Fixes #40362 Use INSERT IGNORE in the sync path so that a policy deleted between distributed query dispatch and result ingestion is silently skipped, matching AsyncBatchInsertPolicyMembership which already handles this race with the same approach. |
||
|
Victor Lyuboslavsky
|
1072c852e8 |
Added support for validating Microsoft Entra v2 access tokens (#46416)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46388 Video demo: https://www.youtube.com/watch?v=t3yuGh0kwP8 Docs PR: https://github.com/fleetdm/fleet/pull/46483 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. ## New Fleet configuration settings If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * UI to add/remove Entra application (client) IDs for Windows automatic enrollment; add/delete modals and list management. * **Enhancements** * Activity feed entries for added/removed Entra client IDs. * Entra client ID allowlist surfaced in GitOps and persisted config; client IDs normalized (trim/lowercase) and de-duplicated. * **Documentation** * Note: from July 1, 2026 new on‑prem Windows MDM apps receive Entra v2 tokens with aud = client ID; v1 tokens remain supported. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sharon Katz
|
7fb464abc4 |
Clean up policy query to use parameter binding for platform filter (#46604)
## Summary
- Refactored the conditional access policy query to use `CONCAT('%', ?,
'%')` with a bound parameter instead of string concatenation for the
platform `LIKE` clause, consistent with how other queries in this file
handle string filters.
## Test plan
- [ ] Verify conditional access policy lookup still returns correct
results for macOS/Windows hosts.
- [ ] Confirm no regression in policy filtering behavior.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved platform filtering in conditional access policy queries to
enhance query reliability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
Juan Fernandez
|
66667c3248 |
Fix S3 carve cleanup never running and panic on empty carves (#43045) (#46462)
Resolves #43045 Fixed a bug where the carve cleanup cron job called the MySQL implementation instead of the S3-aware implementation on S3-configured deployments, meaning expired carves were never marked as expired in S3. Also fixed a panic in S3 carve cleanup that occurred when there were no non-expired carves. |
||
|
Victor LyuboslavskyandLucas Manuel Rodriguez
|
8a28b83b00 |
Redis host cache optimizations (#46458)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46338 Changes load tested (osquery load test). <img width="1532" height="282" alt="image" src="https://github.com/user-attachments/assets/9eb38629-918e-4e05-bc0b-e2ae22e8b148" /> <img width="1414" height="937" alt="image" src="https://github.com/user-attachments/assets/1b90afd3-087c-452e-939f-b495df3e59c8" /> # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Performance Improvements** * Extended host cache retention period from 60 seconds to 180 seconds to improve overall cache efficiency and hit rates. * Optimized host cache invalidation strategy to eliminate unnecessary reverse-index lookups, significantly reducing database reader load and Redis CPU consumption. * **Tests** * Added test coverage for host update cache invalidation edge cases to ensure proper behavior. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46458?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> |
||
|
Magnus Jensen
|
e09da91b95 |
CSUD: add migration to track update profiles (#46433)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45281 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. Will be added in the backend work PR - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Added backend tracking to consolidate Apple and Windows software update settings into a single, consistent store with uniqueness and cascade-delete safeguards. * Backfilled existing qualifying Apple and Windows update configurations into the new tracking store. * **Tests** * Added tests validating correct population, constraint enforcement, and cascade-delete behavior. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46433?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
4c7f9f497c |
Remove apple profile and decl from bulk set pending (#46321)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Follow up work as discovery made on the Apple reconciler changes. One more follow up PR will come with a clean up of all old and unused code. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Updated integration tests to use batched reconciliation workflows instead of direct database manipulation. * Improved test determinism by explicitly awaiting async profile-schedule triggers before state assertions. * Enhanced test failure diagnostics with more detailed profile comparison messages. * **Chores** * Marked internal reconciliation methods for future deletion with TODO annotations. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46321?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus JensenandClaude
|
b42a154cf6 |
Optimize Apple profile reconciler approach by moving logic to code (#45573)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Closes #46153 This PR is big, but I found it worth it to include in the same PR to keep the mental change context in one place. This PR moves away from our previous version of a big SQL computing the desired state and label membership with big union branches. It does so by switching the model up completely, first: - We batch read hosts (current hardcoded is 5k), and we always iterate 5k hosts and then decide if they have changes, so that means a tick (30s) could read 5k hosts that DOES NOT require changes, but that is computed in code after, rather than relying on a big SQL to do it (twice). - We then for those hosts, bulk fetch label memberships, their related team profiles and current rows. This performs much better as we can lookup everything we need by primary key or super fast indexed columns, simple fetch all these calls. - Then once gathered the information we move to the code to determine if the operation is install, remove, NO-OP (Desired state calculation), then we check the label membership to further determine it's final action. - We then move to what we did before, which is queue the correct command etc. It comes with some slight caveats, which is we now load a lot more data into memory (but before we could spike worse), so when loadtesting we watched CPU/Memory utilization, which never seemed to spike as the datasets are kept as small as possible. _Cleanup will come in a follow-up PR where we remove all the old code._ # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [X] Added/updated automated tests - [ ] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Performance** * Optimized Apple profile and DDM (Declarations) reconciliation engine with batched processing for significantly improved performance in environments with large numbers of Apple-enrolled hosts. * Implemented cursor-based pagination for more efficient reconciliation across large fleets. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45573?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
Konstantin Sykulev
|
87bb4090a8 |
Android profile content checksums (#46276)
**Related issue:** Resolves #43456 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Android MDM profiles now include content checksums; devices are re-synced only when profile content changes, reducing unnecessary deliveries. * **Migrations** * Database schema updated to add and backfill checksum fields for Android configuration and host profiles. * **Tests** * Added and updated tests to validate checksum generation, backfill, and behavior in profile delivery scenarios. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46276?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
65708f9398 |
Android commands (frontend + more backend) (#46174)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41683 Updated frontend for Android commands along with additional changes in the backend. Did full QA testing with test plan. # Checklist for submitter - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Android MDM: added Clear passcode action, Unenroll behavior, and refined BYO vs COBO action visibility and confirmations. * Optimistic pending states and Android-specific success/error messages in Lock/Wipe/Clear flows; modals require confirmations for Android. * **Bug Fixes** * More robust clearing of stale Android device actions during re-enrollment and Pub/Sub flows to keep UI state accurate. * **Tests** * Expanded Android MDM tests for action visibility, pending states, and end-to-end state transitions. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46174?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sharon Katz
|
1ab42218a8 |
Fix GET /software/versions 422 too many placeholders without per_page (#45737)
Closes #43030 ## Summary - Batches title IDs in `getDisplayNamesByTeamAndTitleIds` (chunks of 32,000) to avoid exceeding MySQL's 65,535 prepared statement placeholder limit - Uses the existing `BatchProcessSimple` utility, matching the pattern already used in `software_titles.go` ## Root cause When `GET /api/v1/fleet/software/versions` is called without a `per_page` parameter, `DefaultPerPage` (1,000,000) is used. `ListSoftware` collects all `titleIDs` from the paginated results and passes them to `getDisplayNamesByTeamAndTitleIds`, which builds an `IN (?)` clause that exceeds MySQL's 65,535 placeholder limit. ## Manual testing 1. Started a local Fleet server with MySQL via `docker compose up` and `fleet serve --dev` 2. Seeded the database with 70,000 software titles, software entries, and software_host_counts records 3. **Before the fix**: `GET /api/latest/fleet/software/versions` (no `per_page`) returned HTTP 422 with `"Prepared statement contains too many placeholders"` 4. **After the fix**: the same request returns HTTP 200 with all 70,000 results 5. `GET /api/latest/fleet/software/versions?per_page=20` continued to work correctly in both cases ## Test plan - [x] Manual reproduction and verification (see above) - [x] `make lint-go-incremental` passes - [x] `go build ./server/datastore/mysql/...` compiles cleanly - [ ] CI passes <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed `GET /api/v1/fleet/software/versions` endpoint to prevent errors when returning results from large software inventories. * **Tests** * Added test coverage for high-volume display name queries. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45737?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
9b65497b78 |
Bump migrations due to cherry pick into 4.86.0 (#46384)
Resolves the following issue: 4.86.0 had: ``` ... 20260527215817_AddHostCertificatesOriginDeletedAtIndex.go ``` main had: ``` ... 20260522195236_AddMDMAndroidCommands.go 20260522195237_AddContinuousAutomationsEnabledToPolicies.go 20260527215817_AddHostCertificatesOriginDeletedAtIndex.go ``` So we have to move `AddMDMAndroidCommands` and `AddContinuousAutomationsEnabledToPolicies` to be after `AddHostCertificatesOriginDeletedAtIndex`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Android remote command support for Mobile Device Management. * Introduced a "continuous automations" toggle for security policies to enable automated enforcement and responses. * **Chores** * Updated database schema/migration state to include the new Android commands table and policy field. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46384?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordan Montgomery
|
c70f6796a0 |
Add cert rollover tool, update Filevault key decryption for rollover process (#46226)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46226 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Add CA certificate rollover CLI to renew MDM CA certs with an extend-years option while preserving the private key and certificate properties. * **Improvements** * Decryption logic updated to accept previously-rolled CA certificates so escrowed disk-encryption keys can be decrypted after rollover. * **Tests** * Expanded tests and mocks to cover rollover and decryption scenarios. * **Chores** * Updated ignore rules and added a changelog entry for the rollover process. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46226?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Dante Catalfamo
|
2c47cee122 |
Fix FileVault key escrow on ADE-enrolled Macs (#45928)
After ADE enrollment with enable_disk_encryption: true, hosts reported
as unencrypted with the disk-encryption policy failing and no recovery
key escrowed until the user logged out/in or restarted.
## Root cause
Fleet's shared macOS disk-encryption probe was:
```
SELECT 1 FROM disk_encryption
WHERE user_uuid IS NOT "" AND filevault_status = 'on' LIMIT 1
```
On the osquery disk_encryption table, filevault_status and user_uuid
are populated from independent sources: filevault_status from
`fdesetup status`, user_uuid from `diskutil apfs listCryptoUsers`
(the UUID of a user with SecureToken authority to unlock the volume).
In the post-ADE window, even with ForceEnableInSetupAssistant=true,
SecureToken propagation can lag — filevault_status='on' but
user_uuid='' for a brief period that resolves on a session event.
When the predicate failed, the query returned 0 rows and three
downstream behaviors broke in lockstep:
- host_disks.encrypted flipped to false ("unencrypted")
- the built-in "Full disk encryption enabled (macOS)" policy failed
- mdm_disk_encryption_key_file_*_darwin returned encrypted=0,
gating the PRK ingest and leaving the recovery key un-escrowed
The predicate originated in groob's standard query library entry
from 2021 as a strict compliance check ("is the host actually
protected, with a user able to unlock it?"). When the disk-encryption
status feature shipped in Nov 2022 (PR #8526, issue #3906), the
same string was reused verbatim and later extracted into
usesMacOSDiskEncryptionQuery — never revisited for whether the
SecureToken gate made sense outside the compliance-policy context.
**Related issue:** Resolves #45369
|
||
|
Carlo
|
c9ae421a00 |
Emit failed VPP/in-house install activity, release reserved license (#46332)
Resolves #45851, #45854 |
||
|
Lucas Manuel Rodriguez
|
a1d91464ea |
Fix issue with permissions in host activity list for fleet-users (#46362)
**Related issue:** Resolves #46009. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Resolved an authorization issue preventing users from viewing past host activities on hosts that contained user-initiated operations such as lock, wipe, run script, or install software. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46362?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Tim Lee
|
132d5e3515 | Clear MDM-delivered certs when a host leaves MDM (#46289) | ||
|
Jonathan Katz
|
f79508580b |
Make software installer edits not cancel setup experience installs (#46236)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #42744 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually - Tested setup experience on a macOS virtual machine, see below. This is what happens after the change: - Editing pkg while setup experience is running, whether the package is pending or currently running, doesn't cancel anything. Installs were successful. - Editing pkg while queueing a normal install caused it to cancel with no record. - Deleting while an installer is running causes the row to disappear immediately in the setup experience UI, HSI row removed. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Editing a software installer no longer cancels in-progress setup-experience installs; running setup-experience flows are preserved when installer scripts are updated. * Deleting an installer still removes its associated pending setup-experience entries and related pending host-install records. * GitOps batch updates: editing installers in a batch preserves running setup experiences; omitting an installer from a batch deletes only that installer’s pending entries. * **Tests** * Added/updated integration tests validating edit/delete behavior during setup experience. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46236?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Tim Lee
|
819e3d372f | host_certificates: downgrade mdm rows to osquery on rediscovery (#45531) | ||
|
Victor Lyuboslavsky
|
33889ec177 | Fixed stale pending MDM profiles reappearing (#46111) | ||
|
Lucas Manuel Rodriguez
|
5b2427d187 |
Add backend changes for continuous automations on policies (#45999)
Resolves #45149 and #45150. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [X] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [X] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [X] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [X] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [X] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added team policy setting continuous_automations_enabled (default: false) to re-run software/script automations on every failing evaluation; exposed in APIs and GitOps YAML. Disallowed for "All fleets" and requires a premium license. * **Tests** * Added integration tests for CRUD, GitOps, and re-queuing behavior validating continuous automations. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45999?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Konstantin SykulevandCopilot Autofix powered by AI
|
0a8e9fc328 |
Added more tests around orbit-enroll creates a duplicate host entries (#46230)
**Related issue:** Resolves #41802 related to https://github.com/fleetdm/fleet/issues/46001 ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Expanded automated test coverage for Android host enrollment, parameterizing platform and enrollment state to validate behavior across scenarios. * Added cases covering reversed enrollment order to ensure a single host record per device UUID and idempotent enrollment behavior. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46230?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Victor Lyuboslavsky
|
e790260b85 |
Android commands backend (#46031)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41683 Support for Android lock, wipe, and clear passcode commands. Behavior is slightly different between BYOD and CODO. The fleetdm.com proxy isn't wired up, so they only work with direct Google connection. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Clear-passcode CLI plus Android Lock and Wipe commands (Wipe restricted to company-owned devices). * BYO unenroll now removes only the work profile, preserving personal data. * Commands issued with a 10-year duration; UI/CLI show Android-specific messaging and command IDs. * **Improvements** * Host MDM pages reflect command lifecycle transitions (pending → acknowledged or error with code/message) via Pub/Sub updates. * **Documentation** * Updated docs for Android MDM commands, ownership rules, and command duration. * **Tests** * New unit and integration tests for Android MDM flows. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46031?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
George Karr
|
f2fca57c44 |
Renumber 4.86 migrations after the 4.85.1 cherry-pick (#46079) (#46097)
## Summary Fixes #46079. Migration `20260518194422_AddEncodingTypeToHostSCDData` was cherry-picked into the 4.85.1 patch release. Customers upgrading from 4.85.1 → 4.86.0 then saw `WARNING: Your Fleet database is missing required migrations` for 11 migrations that landed on `main` with earlier timestamps but never shipped in 4.85.1. This PR renumbers those 11 migrations to run after `20260518194422` and regenerates `schema.sql`: | Old timestamp | New timestamp | Name | |---|---|---| | 20260427134220 | 20260522195224 | AddPreserveHostActivitiesOnReenrollmentToAppConfig | | 20260428125634 | 20260522195225 | AddManagedLocalAccountRotationColumns | | 20260429180725 | 20260522195226 | CreateTableAppConfigurations | | 20260430103635 | 20260522195227 | AddRequireAllToPolicyAndQueryLabels | | 20260506132626 | 20260522195229 | AddVPPCountryCode | | 20260506171058 | 20260522195230 | AddSubjectAlternativeNameToCertificateTemplates | | 20260512143542 | 20260522195231 | AddOrbitDebugUntilToHosts | | 20260512173249 | 20260522195232 | CreateTableVPPClientUsers | | 20260512173250 | 20260522195233 | AddManagedAppleIDToHostMDM | | 20260518124441 | 20260522195234 | AllowNullTypeOnHostMDMManagedCertificates | | 20260518150028 | 20260522195235 | AddOriginToHostCertificates | This will be cherry-picked into `rc-minor-fleet-v4.86.0` once merged. ## Test plan - [x] `go build ./...` passes - [x] All 11 migrations run cleanly in order during `make dump-test-schema` - [x] No references to the old timestamps remain in the repo - [ ] Spin up 4.85.1, run migrations, then run the 4.86.0 binary built from this branch and confirm no `missing required migrations` warning <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Reorganized database migration sequencing to ensure consistent schema updates during deployment. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46097?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
5d9b102a1b |
45190 patch policy wrong installer (#46087)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # Adds a missing `is_active=1` check to get the actual active installer for the software automation's installer. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually - I tested by pinning the version of the app to the older one, then unpinning and back and checked that the policy is associated to the correct installer with the query below. - I did not manually test updating to a new FMA version. It's possible to do that easily by creating a new branch with a newer version and referring FLEET_DEV_MAINTAINED_APPS_BASE_URL to it. ``` SELECT si.id, si.team_id, si.title_id, si.filename, si.version, si.storage_id, si.uploaded_at, si.updated_at, si.url, si.fleet_maintained_app_id, si.install_during_setup, si.is_active, si.patch_query, si.http_etag, p.patch_software_title_id, p.software_installer_id, p.query FROM software_installers si LEFT JOIN policies p on si.id = p.software_installer_id WHERE filename LIKE "%<app name>%" AND platform = "darwin" AND global_or_team_id = <team id>; ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Patch policies using software install automations now correctly prioritize active installers, ensuring deployment uses the latest appropriate version rather than inactive or outdated alternatives. * **Tests** * Added test scenarios to validate policy installer version selection and active status during automation evaluation. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46087?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rajendra kadamandJordan Montgomery
|
3ccf17f8ac |
Remove nano_view_queue from unscoped MDM commands list query (#45674)
Drops `nano_view_queue` from the Apple branch of the unscoped commands list and joins the underlying `nano_*` tables directly. The view's definition bakes in `ORDER BY q.priority DESC, q.created_at`, which MySQL re-materializes on every query — the outer `LIMIT` can't push past it, so each unscoped list call pays the full sort cost over the post-join row set regardless of page size. This is the same join shape the host-scoped path already uses (see `listMDMCommandsByHostIdentifier`), so I followed that pattern. Column output is identical to what the view was producing, which is why no test updates were needed — all the existing `TestListMDMCommands*` cases pass without modification. Scope of this PR is just the hot caller. The view itself isn't touched. The issue notes other call sites (`vpp.go`, `apple_mdm.go`) still go through it, and that dropping the `ORDER BY` from the view's definition would be the durable fix. Both feel like separate PRs — the audit work for other call sites is non-trivial, and modifying the view risks silently breaking any consumer that relied on its implicit ordering. Happy to follow up on either. Refs #44509. # Checklist for submitter - [x] Input is properly validated (no new user input paths; same parameterized query shape) - Tests: existing `TestListMDMCommands*` coverage exercises this path and passes unchanged. No new tests added — see rationale above. - Changes file: not applicable, internal query refactor with no user-visible behavior change. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Bug Fixes * Updated Mobile Device Management command status reporting to ensure accurate status and timestamp information. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45674?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com> |
||
|
Victor Lyuboslavsky
|
3f6f138530 |
Fix duplicate Android host on orbit-enroll when Apple MDM is off (#46008)
The Fleet Android Agent's orbit-enroll did not match the existing AMAPI-created host record on Fleet instances with Apple MDM disabled, creating a duplicate hosts row alongside the AMAPI-enrolled one. The Android-specific UUID match clause in matchHostDuringEnrollment was gated by isMDMEnabled, which only reflects Apple MDM status. Gate the clause on platform="android" instead. The Fleet Android Agent always sends this since PR #43809, and the SELECT itself filters platform=android, so the clause is Android-safe by construction and no longer depends on the Apple-MDM flag. The serial-match clause keeps its existing isMDMEnabled gate. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46001 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Updated tests - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Prevents duplicate host records when enrolling Android devices on instances with Apple MDM disabled. * Improves enrollment host-matching so devices are identified by their platform, reducing misattributed or duplicate hosts during enrollment. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46008?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguezandcoderabbitai[bot]
|
aeac57bd04 |
Fix to populate host_emails during Linux/Windows SSO enrollment (#45951)
Resolves #45066. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed user email/device mapping for Windows and Linux hosts enrolling via end-user authentication (browser-based and EUA-token flows). Host listings and device mapping now reliably show the IdP email after enrollment, improving device identification and inventory accuracy. * **Tests** * Expanded integration tests to validate end-to-end enrollment and device mapping across platforms. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45951?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> |
||
|
Sharon Katz
|
8bb59b71cb |
Fix List certificate templates API docs: parameter name is fleet_id, not fleet (#45969) (#45978)
Closes #45969 ## Summary The `List certificate templates` API endpoint returned `null` for certificates because the **API docs documented the wrong query parameter name**. The docs said `fleet` but the code accepts `fleet_id` (or the deprecated `team_id`). Customers following the docs used `?fleet=11`, which was silently ignored, causing the endpoint to default to team 0 (unassigned) -- which typically has no certificates. - **Docs fix**: Changed the parameter name from `fleet` (string) to `fleet_id` (integer) in the REST API docs, matching how all other list endpoints document this parameter. - **API quality fix**: Initialize the `templates` slice in `GetCertificateTemplatesByTeamID` so that when no templates exist, the JSON response returns `"certificates": []` instead of `"certificates": null`. ## Root cause In `docs/REST API/rest-api.md`, the "List certificate templates" endpoint documented the query parameter as `fleet` (string), but the request struct accepts `fleet_id` or `team_id`: ```go type listCertificateTemplatesRequest struct { TeamID uint `query:"team_id,optional" renameto:"fleet_id"` } ``` When the customer used `?fleet=11` (as documented), the parameter was unrecognized and silently ignored. The endpoint defaulted to `team_id=0` (unassigned), which had no certificates. The nil Go slice then serialized to JSON `null`. Credit to Andrey Kizimenko for identifying the docs mismatch. ## Changes - `docs/REST API/rest-api.md` -- Fix parameter name from `fleet` (string) to `fleet_id` (integer) - `server/datastore/mysql/certificate_templates.go:174` -- Initialize slice to avoid `null` in JSON - `server/datastore/mysql/certificate_templates_test.go:489` -- Add `require.NotNil` regression test ## Testing All tests run locally against a real MySQL (Docker) and Redis instance: | Test suite | Command | Result | |---|---|---| | Datastore integration (all certificate tests) | `MYSQL_TEST=1 go test -run TestCertificates ./server/datastore/mysql/...` | 11 suites, 33 subtests, all PASS | | Service unit tests | `go test -run "TestCreateCertificateTemplate\|TestApplyCertificateTemplateSpecs\|..."` | 4 suites, all PASS | | Enterprise integration (full HTTP) | `MYSQL_TEST=1 REDIS_TEST=1 go test -run "TestIntegrationsEnterprise/TestCertificatesSpecs"` | PASS | | Enterprise integration (team delete) | `MYSQL_TEST=1 REDIS_TEST=1 go test -run "TestIntegrationsEnterprise/TestDeleteTeamCertificateTemplates"` | PASS | | Static analysis | `go build`, `go vet` | Clean | Andrey's reproduction confirmed via screenshots: - `?fleet_id=11` returns certificates correctly - `?fleet=11` (the documented param) returns `null` -- the bug - No param returns results when "unassigned" team has certificates ## QA steps 1. Follow the API docs to list certificate templates using `?fleet_id=<id>` 2. Verify the response contains `"certificates": [...]` with the correct data 3. Call without `fleet_id` and verify `"certificates": []` (not `null`) for a team with no templates <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed the "List certificate templates" API documentation with the correct query parameter name, enabling proper filtering of results. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45978?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
6becc62393 |
Add bundle_identifier to top-level host software API response (#42188)
- @noahtalerman: For the following story: - https://github.com/fleetdm/fleet/issues/43557 ## Summary - Adds `bundle_identifier` as a top-level field on `HostSoftwareWithInstaller` struct, which is the response type for all host software API endpoints (`GET /api/v1/fleet/hosts/{id}/software`, `GET /api/v1/fleet/device/{token}/software`, etc.) - The value is sourced directly from `software_titles.bundle_identifier` via the SQL query, so it is always present even when `installed_versions` is empty (e.g., software that has never been installed on a host) - Falls back to `installed_versions[0].bundle_identifier` if the title-level value is not available - The field is retained inside `installed_versions` for full backwards compatibility ## Changes ### `server/fleet/software_installer.go` - Added `BundleIdentifier string` field with `json:"bundle_identifier,omitempty" db:"-"` tag to `HostSoftwareWithInstaller` struct ### `server/datastore/mysql/software.go` - Added `TitleBundleIdentifier` field to internal `hostSoftware` struct mapped to `title_bundle_identifier` DB column - Added `software_titles.bundle_identifier AS title_bundle_identifier` to all four SQL query branches: - Software installers SELECT - VPP apps SELECT - In-house apps SELECT - Available-for-install SELECT (`stmtAvailable`) - Added `software_titles.bundle_identifier` to GROUP BY clauses for software installers and VPP apps - In the return path, populates `BundleIdentifier` from `TitleBundleIdentifier` (with fallback to first installed version) ### `server/datastore/mysql/software_test.go` - Added `BundleIdentifier` assertion to both `compareResults` helper functions (macOS/Linux and iOS/iPadOS test suites) - Added explicit top-level `BundleIdentifier` assertions in `testListHostSoftwareWithVPPApps` where the installed version bundle identifier is already verified ## Example response shape ```json { "id": 121, "name": "Google Chrome.app", "bundle_identifier": "com.google.Chrome", "icon_url": null, "software_package": { ... }, "app_store_app": null, "source": "apps", "status": "failed_install", "installed_versions": [ { "version": "121.0", "bundle_identifier": "com.google.Chrome", ... } ] } ``` Built for [ntalerman](https://fleetdm.slack.com/archives/D0AEA6U4SM9/p1774036621198819?thread_ts=1774035719.384099&cid=D0AEA6U4SM9) by [Kilo for Slack](https://kilo.ai/features/slack-integration) --------- Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com> Co-authored-by: Kilo Code <kilo@kilo.ai> Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Co-authored-by: jkatz01 <yehonatankatz@gmail.com> |
||
|
Scott Gress
|
d7fa35e417 |
Implement roaring bitmaps for historical data collection (#45709)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45715 # Details This PR refactors the way the charts module stores historical data to use the [roaring bitmap](https://github.com/RoaringBitmap/roaring) package instead of saving raw bitmaps. See [this blurb](https://github.com/RoaringBitmap/roaring#how-does-roaring-compares-with-the-alternatives) to learn how roaring compresses data, but TL;DR for our purposes it represents a huge improvement especially for larger deployments where host ID numbers may be very large. In testing, some data was reduced 96%. The majority of the changes in this PR are straight swapping of types from `[]byte` to `*roaring.Bitmap` in vars and function signatures, and updating the internals of our bit math helpers to use roaring methods instead of native AND and OR methods. I've tried to comment on all functional changes. Since the charts have been shipped already, so there will be data in the wild in the prior "dense" format, the code still handles dense bitmaps on _read_, but will always _write_ roaring bitmaps. The majority of the data will therefore have turned over within 30 days on its own, but I plan on a follow-up PR that will transform open rows when the cron runs so that we should be guaranteed to turn over completely within 30 days. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [X] Added/updated automated tests - Tests updated to accommodate the new format, and existing unchanged tests act as proof against regression - [X] QA'd all new/changed functionality manually - Using a tool that dumps the `host_scd_data` rows data into a JSON file (with the keys being entity_id+data and the values being host IDs on that date), compared the data from main branch and this and confirmed they're identical - With a host count of ~9000, some of which have IDs of over 1,000,000, the data storage requirements were: * 82,558,976 bytes for dense * 2,867,200 for roaring (a 96% decrease) For unreleased bug fixes in a release candidate, one of: - [X] Confirmed that the fix is not expected to adversely impact load test results - should hugely improve - [X] Alerted the release DRI if additional load testing is needed ## Database migrations - [X] Checked schema for all modified table for columns that will auto-update timestamps during migration. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Implemented roaring bitmaps in historical data collection to optimize bitmap handling for chart data aggregation * Added encoding support to bitmap storage schema for flexible data representation <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
George KarrandCopilot Autofix powered by AI
|
4d0534a48d |
Adding my device link on host details page with backend logic to generate it if needed (#45659)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43895 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Self-service install/uninstall activities now render in passive voice, omit an actor name, and include a “(self-service)” marker across feeds * Global admins see a "My device" button on host user cards that opens the end‑user device page in a new tab; the link is refreshed/generated as needed * Device page and browser tab header show the end‑user's name when available (fallback: "My device") * **Tests** * Added/updated coverage for self‑service activity rendering and the "My device" flow <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45659?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Tim Lee
|
bbfbea8de2 | Cert renewal for non-proxied SCEP and ACME (Phase 1 + Phase 2) (#45696) | ||
|
Lucas Manuel Rodriguez
|
9e7781a004 |
Update enrolling activities and preserve osquery display name (#45697)
Resolves #36417. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually ## Manual tests performed ✅ MDM enrollment first, then fleetd enrollment (checked both activities match serial and display name is preserved). ✅ fleetd enrollment first, then MDM enrollment (checked both activities match serial and display name is preserved). <img width="520" height="383" alt="activities_mdm_macos_enrollment" src="https://github.com/user-attachments/assets/35c74612-ad80-4245-bfd9-20a3dc5e78bb" /> ✅ Enrolled ABM iPad. <img width="599" height="65" alt="Screenshot 2026-05-18 at 10 57 23 AM" src="https://github.com/user-attachments/assets/b7ad552b-82af-4606-a860-361eedb97483" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Enrollment activities now show device serial numbers alongside host display names, avoid duplicating the serial if already included, and fall back to serial/generic messaging when no display name is available. * Fleet enrollment entries no longer show an actor prefix, matching other enrollment activity items. * **Bug Fixes** * Display names set by prior fleetd enrollment are preserved and no longer overwritten during MDM enrollment. * **Tests** * Added and relaxed activity-feed tests covering enrollment message variants. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45697?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor LyuboslavskyandLuke Heath
|
19de907416 |
Windows setup experience: UI and BYOD fixes (#45331)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #38785 - UI changes per Figma and latest product guidelines - Do not cancel setup experience during BYOD (when critical software install fails) - Allow a host to rerun setup experience even if it has been in Fleet for over 24 hours - This fixes a bug where a host is wiped but not deleted from Fleet, and then it doesn't run setup experience. # Checklist for submitter ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Improved Windows re-enrollment detection to better handle BYOD scenarios, preventing unintended cancellation of pending setup steps for recently re-enrolled devices. * Added a fallback lookup for unlinked Windows enrollments to improve enrollment matching. * **Bug Fixes** * Clarified cancellation activity messages to note when users are asked to restart after install failures. * Updated Windows install copy and tooltips based on enrollment status. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45331) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Luke Heath <luke@fleetdm.com> |
||
|
George Karr
|
9416a81124 |
gkarr 44008 setup experience (#45202)
- **Adding vpp users table** - **Adding ManagedAppleID to HostMDM tables to pull when installing vpp apps to a BYOD user enrolled device** - **Adding user create vpp apis** - **Updating install application to support user enrolled devices** - **Handling already installed gracefully** - **Adding provision user logic** - **Adding logic to associate assets on install** - **Add license managemnt logic** - **Adding self service ui** - **Adding setup experience support** - **Adding setup experience flow** - **Fix issue with fleet's docker image in k8s environments (#44373)** - **Changing how the appleid is captured to use idp mdm users** <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Account-based User Enrollment (iOS/iPadOS) supports VPP and in‑house .ipa installs, including self‑service installs. * Enrollment now applies the selected Setup experience automatically for user‑enrolled hosts. * Installs and license associations are scoped to account user associations (user‑scoped installs). * **Bug Fixes** * Improved error messaging for license/association failures (including per‑user device cap cases). * Mobile UI: self‑service now shows user‑enrolled iOS/iPadOS apps. * “Already installed” install results are treated as acknowledged successes. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45202) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
11a862729c |
Return 404's for not found resources in some batch script endpoints (#45348)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43027 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Endpoints for fleet script batch executions now return HTTP 404 for nonexistent batch execution resources. * **Tests** * Added tests to verify 404 behavior for missing batch execution resources and related error handling. * **Tools** * Added a command-line load-test seeding/teardown utility to create and remove configuration profiles and related test data. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45348) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
3b476704d1 |
Create maintainedappstest package (to prevent testing code in production binaries) (#45494)
Resolves #45220 (one of several PRs) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Added a dedicated maintained-apps test helper and updated integration tests to use it, consolidating sync test setup and improving reliability of maintained-apps scenarios. * Updated several tests to use improved test utilities and helper variants for SQL test helpers and request fixtures. * **Chores** * Adjusted CI lint checks to exclude the new test helper location from specific env-var override validations. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45494) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
4f59f39c9f |
VPP/in-house app managed configuration bug fixes and integration test (#45452)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43973 Fixes a few bugs regarding managed app configurations. Includes a few cherry-picks for commits that were supposed to be merged, but got overwritten by subsequent PRs that didn't get pushed properly while working with the github stack. Also includes some more integration test cases. # Checklist for submitter If some of the following don't apply, delete the relevant line. ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Improved error handling for VPP managed app configurations that reference unresolvable Fleet variables. * **Bug Fixes** * Fixed cleanup of VPP app configuration data during team deletion. * In-house app configurations now apply only to their specific installer instead of sibling installers. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45452) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordan MontgomeryandCopilot Autofix powered by AI
|
bee5edaa0b |
Add server-side orbit debug logging enablement - currently only configurable as a duration-after-enrollment setting (#45367)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43997 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Configure Orbit to enable debug logging for a limited window on agent enrollment; enrolled hosts receive debug/verbose behavior while the window is active and it is reflected in agent config. * **Chores** * Added database column to record per-host debug-until timestamps and datastore support to extend it safely. * **Tests** * Added integration and unit tests covering validation, enrollment stamping, config generation, and runtime debug toggling. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45367) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Sharon Katz
|
903e3a3f45 |
Sort software titles by display name instead of installer filename (#44873)
Closes #43673 ## Changes Sorts the `/software/titles` endpoint by display name (when set) instead of the internal `software_titles.name` (often an installer filename). **3 changes in `server/datastore/mysql/software_titles.go`:** 1. **Order key mapping** (line 24): `"name"` sort key now maps to `COALESCE(NULLIF(stdn.display_name, ''), st.name)` — uses display name when set, falls back to `st.name`. `NULLIF` ensures cleared display names (empty string) are treated as unset. 2. **Secondary sort** (line 579): Same `COALESCE(NULLIF(...))` expression for tie-breaking when sorting by a non-name column. 3. **LEFT JOIN** (line 635): Joins `software_title_display_names` so the COALESCE expressions can resolve. ## Testing ### Manual testing Inserted test software titles with display names that sort differently from installer filenames. Confirmed: - Before fix: sorted by internal `st.name` (installer filename) - After fix: sorted by display name, with fallback to `st.name` when no display name is set - Verified with `order_direction=asc`, `desc`, and secondary sort via `hosts_count` ### Unit tests `server/datastore/mysql/software_titles_sort_test.go` — 5 subtests (no MySQL required): - Order key mapping uses `NULLIF` for empty display names - Secondary sort uses `NULLIF` for empty display names - Primary name sort doesn't add redundant secondary name sort - SQL template includes `display_names` join - Empty display name falls back to `st.name` in sort expression SQL fixture (`select_software_titles_sql_fixture.gz`) regenerated to match updated queries. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Software titles listing now sorts by team-specific display names when present, falling back to default names; tie-breaking and overall sort behavior refined for more consistent ordering. * **Tests** * Added tests validating display-name sorting, correct fallback for empty names, secondary sort behavior, and generated query structure to ensure consistent results. [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44873) <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Konstantin Sykulev
|
714ca9af16 |
windows mdm profile bulk insert (#45401)
**Related issue:** Resolves #44804 This does not bulk every sql command, for simplicity. It does not bulk profiles with variables in them, those containing $FLEET_VAR_* placeholders. These still use individual command INSERTs per host. Remove commands are also not bulk-inserted because each removal requires computing activeLocURIs which varies per profile and can result in nil commands that should be skipped. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Reconciler now pre-builds and bulk-inserts Windows MDM commands for non-variable install profiles, reducing repeated writes and improving batching/enqueue efficiency. * Streamlined enqueue + host-profile upsert flow to handle pre-inserted commands and batch host processing. * **Tests** * Added tests for bulk command insertion, duplicate-command handling, and end-to-end enqueue/upsert behavior. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45401) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
77a29167ae |
Fixed Android hosts being auto-deleted by host expiry (#45471)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45258 The change to zero time is conventionally consistent with the rest of the codebase, and produces zero observable behavior differences anywhere I could find except for the cleanup SQL (which is the bug being fixed). Decided not to do a migration since we do not expect hosts to actually stick around with the `1970-01-02` value, and we have not heard about this issue from customers. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Resolved an issue where hosts were being automatically deleted and re-enrolled repeatedly when host expiry cleanup was enabled. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45471) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
057e1615b4 |
Move mysql/testing_utils.go to a separate mysql/mysqltest package (#45406)
Resolves #45220 (one of several PRs to achieve removing "testing" package as dependency in production binary) ## Testing - [x] QA'd all new/changed functionality manually. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Switched many tests to use a dedicated MySQL test helper package and consolidated test-only utilities for datastore setup, cleanup, ad‑hoc SQL, certificate generation, and activity/aggregation helpers. * Added expanded test utilities for replication, DB connections and test data seeding to improve integration-test reliability. * **Chores** * No production behavior or user-facing APIs were changed. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45406) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
