Commit Graph
15535 Commits
Author SHA1 Message Date
Noah Talerman 7477da389c Fleet-maintained apps: scripts are updated for you (#26352) 2025-02-14 15:27:56 -05:00
Allen Houchinsandallenhouchins 4e967dbaa4 Update macOS version number to 15.3.1 (#26355)
Co-authored-by: allenhouchins <allen@fleetdm.com>
2025-02-14 14:17:56 -06:00
Allen Houchins 2afff8242e Update dogfood-policy-updater-latest-macos.sh (#26351)
Updated script to automatically add reviewers to the pull request that
is created.
2025-02-14 14:10:34 -06:00
dependabot[bot] f90c9a1a5e Bump elliptic from 6.6.0 to 6.6.1 (#26344) 2025-02-14 13:41:02 -06:00
Noah Talerman f9dc049679 GitHub (SLSA) attestation guide (#26222)
- Add instructions for verifying Fleet, fleetd, and fleetctl
2025-02-14 13:01:39 -05:00
Jahziel Villasana-Espinoza 5e48e3d4f3 fix: add an index to mitigate vuln processing resource spikes (#26331)
> For #26178

# Checklist for submitter

## Data from testing

We tested the changes out by directly creating the index in our dogfood
env. We saw a decrease in resource usage, captured in these screenshots:

DB load (taller spike towards the left is without the index, subsequent
spikes are after the index was added)

![image
(1)](https://github.com/user-attachments/assets/141f8066-89e9-4a8e-ba7c-9fd3a09afea4)

DB load over a longer period (overnight 2025-02-12 -> 2025-02-13)

![Screenshot 2025-02-13 at 9 05
05 AM](https://github.com/user-attachments/assets/bb0c6744-537d-4aec-960b-d100c4285d00)

CPU utilization

![Screenshot 2025-02-13 at 10 25
17 AM](https://github.com/user-attachments/assets/eeea9ae5-5a10-4d50-91bc-3a806b359b39)

Memory usage

![Screenshot 2025-02-13 at 10 26
52 AM](https://github.com/user-attachments/assets/bb77cdd8-41ef-4d90-a707-70b6d2976a59)


---


If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] If database migrations are included, checked table schema to
confirm autoupdate
- [x] A detailed QA plan exists on the associated ticket (if it isn't
there, work with the product group's QA engineer to add it)
- [x] Manual QA for all new/changed functionality
2025-02-14 12:53:41 -05:00
Dante Catalfamo 7c2ac65dab Always edit script, remove details modal from script page (#26325)
#26323
2025-02-14 09:31:21 -05:00
Eric 470766c9ac Website: Update order of platform filters for Windows users (#26340)
Changes:
- Updated the platform filters on the policy-library, query-library,
vital-details, and osquery-table-details pages to list Windows first for
users who visit the website on Windows.
- Updated the default platform filter on the policy-library,
query-library, vital-details to be windows for Users who visit the
website on Windows.
2025-02-13 17:29:14 -06:00
Tim Lee c582f74fdd Release fleetd 1.39.1 (#26314) 2025-02-13 16:26:18 -07:00
Noah Talerman 181227bc3d Fleet can remove apps (#26330)
- Use "apps" instead of "software" for end users
2025-02-14 07:50:37 +09:00
Rachael Shaw 1c644caba7 Website: Add redirect for linking to policy templates from the Fleet UI (#26321)
For #26052
2025-02-13 16:44:09 -06:00
Noah Talerman d0a0bc9499 Freshen up Splunk instructions (#26336)
Based on feedback from `customer-hubble`
2025-02-13 17:15:24 -05:00
Victor Lyuboslavsky 4b007e20e1 Android scaffold (#26274)
Android scaffold code and refactorings
- Android packages intended to be decoupled from other Fleet code

Video explaining the PR: https://www.youtube.com/watch?v=cza-35Z9Wxk

# Checklist for submitter

- [x] If database migrations are included, checked table schema to
confirm autoupdate
- For database migrations:
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
- [x] Added/updated automated tests
- [x] Manual QA for all new/changed functionality
2025-02-13 14:32:19 -06:00
Luke HeathandSam Pfluger 70527f9cfb update infra why this way (#26272)
Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com>
2025-02-13 14:19:16 -06:00
Eric 4bc30f6d1f Website: update mobile nav scrolling. (#26332)
Closes: https://github.com/fleetdm/confidential/issues/9631

Changes:
- Updated styles for the website's mobile navigation menu to fix an
issue that prevented users from scrolling the menu while the "docs" menu
item was expanded.
2025-02-13 14:07:57 -06:00
Eric 10f44cffa3 Website: compress large gifs and update article image filenames (#26328)
Changes:
- Compressed large gifs to prevent the website's slug size from going
over 500mb
- Updated image filenames added in #26316 to match website naming
conventions.
2025-02-13 12:44:36 -06:00
Harrison RavazzoloandBrock Walters c35c4eb8ec Create Article: Preventing Mistakes with Gitops (#26316)
Co-authored-by: Brock Walters <153771548+nonpunctual@users.noreply.github.com>
2025-02-13 09:35:08 -08:00
Joel Hermanns ba8b94c1c0 docs: fix example response of Create Teams endpoint (#25974)
Previously the docs suggested that an array of teams is returned when
creating a new team. This is not the case.

This commit fixes the api docs and clarifies the example response.
2025-02-13 10:03:12 -06:00
Nathaniel StraussandRachael Shaw 1a7f421582 Update YAML docs to support idp_image_url (#26104)
Supported with `fleetctl gitops` but not included in the YAML docs at
https://fleetdm.com/docs/configuration/yaml-files#sso-settings.

---------

Co-authored-by: Rachael Shaw <r@rachael.wtf>
2025-02-13 06:31:43 -06:00
Jordan Montgomery 92fc34bd0d Handbook: Point broken link at correct 2FA anchor (#26317)
Noticed this broken link while browsing the handbook. Pointed it at the
2FA section under Google Workspace Security which seems to be the
intended reference
2025-02-13 00:01:51 -06:00
Sam Pfluger 7d9e9e78da Handbook/sales Send a subscription quote (#26319) 2025-02-12 23:32:32 -06:00
Tim Lee 1e3d735373 changelog for sw installers bug (#26308) 2025-02-12 14:15:10 -07:00
Jahziel Villasana-Espinoza 4c26bb289a fix: make sure going from include to exclude labels in gitops works (#26302)
> For #26290

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Added/updated automated tests
- [x] Manual QA for all new/changed functionality
2025-02-12 15:47:06 -05:00
Jahziel Villasana-Espinoza 0971021094 fix: exclude any label edge case for VPP apps (#26289)
> For #26275

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Manual QA for all new/changed functionality
- [x] Added/updated automated tests
2025-02-12 14:41:13 -05:00
RachelElysia e0306dca20 Fleet UI: Add missing custom install vpp help text (Unreleased) (#26299) 2025-02-12 14:16:52 -05:00
Dante Catalfamo b2a8b5c70e Add fix for software installers breaking with old fleet version (#26297)
#26283
2025-02-12 12:49:17 -05:00
Jahziel Villasana-Espinoza c7881be451 fix: add check to max concurrency value (#26240)
> For #26177

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated automated tests
- [x] Manual QA for all new/changed functionality
2025-02-12 12:24:35 -05:00
Ian Littman 30e5043919 Switch to a simpler, more reliable query for checking if the initial admin user has been added (#26012)
For #26011, follow-up work for #26003.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated automated tests
- [x] A detailed QA plan exists on the associated ticket (if it isn't
there, work with the product group's QA engineer to add it)
- [x] Manual QA for all new/changed functionality
2025-02-12 07:52:31 -06:00
Eric 01c95370b0 Website: Add support for promotional codes on the self-service license dispenser (#26280)
Changes:
- Added the ability to use coupons on the Fleet premium license
dispenser
- Updated the stripe webhook to support coupons on Fleet premium
subscriptions
- Updated the customer dashboard on the website to show decimal places
in subscription/host prices.
2025-02-11 17:11:53 -06:00
Martin Angers 606df3f349 Upcoming Activities feature branch (#25450) 2025-02-11 14:53:11 -05:00
Sam Pfluger e713b44501 Change equipment tracking at Fleet (#26266)
https://github.com/fleetdm/fleet/pull/26266
2025-02-11 12:34:51 -06:00
Konstantin Sykulev f352dfdb76 Updated BatchSetSoftwareInstallers to use bundle_identifier (#26252)
The software titles unique key was changed to include bundle identifier
in https://github.com/fleetdm/fleet/pull/25794. This caused an issue
when running gitops - installing a software with the same bundle
identifier but different names.

https://github.com/fleetdm/fleet/issues/26226

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated automated tests
- [x] A detailed QA plan exists on the associated ticket (if it isn't
there, work with the product group's QA engineer to add it)
- [x] Manual QA for all new/changed functionality
2025-02-11 12:23:20 -06:00
Sarah Gillespie 2dce287704 Update device user UI with improved instructions to turn on MDM (#26193) 2025-02-11 12:22:18 -06:00
Konstantin Sykulev 2b0be3771d Removing usage of semver in resolved in version resolution (#26062)
The host software version and VersionEndExcluding did not always get
parsed by semver properly. Switching to using `SmartVerCmp` from the
nvdtools code. This is much more relaxed when parsing versions.

https://github.com/fleetdm/fleet/issues/24810

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated automated tests
- [ ] A detailed QA plan exists on the associated ticket (if it isn't
there, work with the product group's QA engineer to add it)
- [x] Manual QA for all new/changed functionality
2025-02-11 12:21:42 -06:00
dependabot[bot] 954703cc7a Bump serialize-javascript from 6.0.1 to 6.0.2 (#26247)
Bumps
[serialize-javascript](https://github.com/yahoo/serialize-javascript)
from 6.0.1 to 6.0.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/yahoo/serialize-javascript/releases">serialize-javascript's
releases</a>.</em></p>
<blockquote>
<h2>v6.0.2</h2>
<ul>
<li>fix: serialize URL string contents to prevent XSS (<a
href="https://redirect.github.com/yahoo/serialize-javascript/issues/173">#173</a>)
f27d65d</li>
<li>Bump <code>@​babel/traverse</code> from 7.10.1 to 7.23.7 (<a
href="https://redirect.github.com/yahoo/serialize-javascript/issues/171">#171</a>)
02499c0</li>
<li>docs: update readme with URL support (<a
href="https://redirect.github.com/yahoo/serialize-javascript/issues/146">#146</a>)
0d88527</li>
<li>chore: update node version and lock file  e2a3a91</li>
<li>fix typo (<a
href="https://redirect.github.com/yahoo/serialize-javascript/issues/164">#164</a>)
5a1fa64</li>
</ul>
<p><a
href="https://github.com/yahoo/serialize-javascript/compare/v6.0.1...v6.0.2">https://github.com/yahoo/serialize-javascript/compare/v6.0.1...v6.0.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/yahoo/serialize-javascript/commit/b71ec23841d7cf30847d3071d9da38ee0b397fc8"><code>b71ec23</code></a>
6.0.2</li>
<li><a
href="https://github.com/yahoo/serialize-javascript/commit/f27d65d3de42affe2aac14607066c293891cec4e"><code>f27d65d</code></a>
fix: serialize URL string contents to prevent XSS (<a
href="https://redirect.github.com/yahoo/serialize-javascript/issues/173">#173</a>)</li>
<li><a
href="https://github.com/yahoo/serialize-javascript/commit/02499c0adfb40f48e1ebdcbe6fffc83b162b95e9"><code>02499c0</code></a>
Bump <code>@​babel/traverse</code> from 7.10.1 to 7.23.7 (<a
href="https://redirect.github.com/yahoo/serialize-javascript/issues/171">#171</a>)</li>
<li><a
href="https://github.com/yahoo/serialize-javascript/commit/0d885272f45069b1207189ae18a6f2726b4abaa9"><code>0d88527</code></a>
docs: update readme with URL support (<a
href="https://redirect.github.com/yahoo/serialize-javascript/issues/146">#146</a>)</li>
<li><a
href="https://github.com/yahoo/serialize-javascript/commit/e2a3a9173e6770ee92e02d95d6a8e7958dfb419d"><code>e2a3a91</code></a>
chore: update node version and lock file</li>
<li><a
href="https://github.com/yahoo/serialize-javascript/commit/5a1fa646d9cbbe0b4f13c07f01c249fb2493e20f"><code>5a1fa64</code></a>
fix typo (<a
href="https://redirect.github.com/yahoo/serialize-javascript/issues/164">#164</a>)</li>
<li>See full diff in <a
href="https://github.com/yahoo/serialize-javascript/compare/v6.0.1...v6.0.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=serialize-javascript&package-manager=npm_and_yarn&previous-version=6.0.1&new-version=6.0.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-11 11:53:52 -06:00
Dale Ribeiro cc3de47681 Add software to required keys example (#26261)
# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
- [ ] If database migrations are included, checked table schema to
confirm autoupdate
- For database migrations:
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
- [ ] Added/updated automated tests
- [ ] A detailed QA plan exists on the associated ticket (if it isn't
there, work with the product group's QA engineer to add it)
- [ ] Manual QA for all new/changed functionality
- For Orbit and Fleet Desktop changes:
- [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit
feature/bugfix should only apply to one platform (`runtime.GOOS`).
- [ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).
2025-02-11 11:52:44 -06:00
Martin Angers 240f55b9e8 Add script execs and software installs stats to osquery-perf (#26239) 2025-02-11 12:46:53 -05:00
Rachael Shaw 15bbac88ed Copy change: "platform(s)" to "platforms" (#26243)
See https://github.com/fleetdm/fleet/issues/25939
2025-02-11 10:59:33 -06:00
Noah Talerman 6e5b5085d6 YAML files: add missing example (#26101) 2025-02-11 10:59:13 -06:00
Marko Lisica 2d404fdd80 Document that Windows Tamper Protection is disabled when MDM is turned on (#26224)
Related to:
- #24767
2025-02-11 10:34:13 -05:00
Eric 360c23d75e Website: add configuration profile generator (#26244)
Changes:
- Added /os-settings, a page where users can generate configuration
profiles
- Updated the docs navigation component to have a link to the os
settings page
- Added a new action: `get-llm-generated-configuration-profile` that
generates a configuration profile in either .mobileconfig, DDM, or CSP
formats.
- Added a new website dependency: ace editor.
2025-02-11 12:33:54 +09:00
Allen Houchinsandallenhouchins ebdb4b860d Update macOS version number to 15.3.1 (#26249)
Co-authored-by: allenhouchins <allen@fleetdm.com>
2025-02-10 19:47:28 -06:00
Allen Houchins 94f620a76f Update dogfood-policy-updater-latest-macos.sh (#26248)
Updated variable names in script.
2025-02-10 19:06:33 -06:00
Robert Fairburn e241e35ea9 Remove terraform modules from the Fleet repo to reduce confusion (#26201) 2025-02-10 18:42:39 -06:00
Robert Fairburn bc5406be7e Setup dogfood to use fleet-terraform repo (#26199)
Note this has been applied from the branch and is required to merge
before applying dogfood from main going forward. This should
significantly speed up deployments from the clone speed difference.

Only the latest versions of modules have been migrated to the new repo,
so all the module versions needed updated in dogfood.
2025-02-10 18:42:14 -06:00
Robert Fairburn 94e6b972ce Change documentation to point to new terraform repo (#26200) 2025-02-10 17:42:28 -06:00
Jordan Moore d651a7ea49 Minor Documentation Updates (#26236)
I came across these changes while getting my gitops flow setup.

1. Changed `logo_url` to `org_logo_url`
2. Fixed indenting on `server_settings` so it's nested under
`org_settings`
2025-02-10 17:30:42 -06:00
Jahziel Villasana-Espinoza 5ca918cf7d fix: update docs with new vpp features (#26187)
> For #26180

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Manual QA for all new/changed functionality
2025-02-10 18:13:55 -05:00
github-actions[bot] ef1caa4499 Fleet UI: Update osquery version options (#26198) 2025-02-10 17:06:27 -06:00
Sarah Gillespie daabdb6531 Disallow user-scoped profiles for Windows MDM (#26153) 2025-02-10 14:17:04 -06:00