<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#34521
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
From @iansltx: The below works because serialize-javascript v7's "BC
break" is requiring a newer version of Node, but we're well above that
version (20) already. There are no other BC breaks per release notes so
a resolution/override is safe here.
This is a transitive dependency of a dev dependency, so we don't need to
rush out a release for this change.
---
Upgrades the transitive dependency `serialize-javascript` from 6.0.2 to
7.0.3 across all package ecosystems in the repository.
## Changes
- Added yarn resolution `**/serialize-javascript: ^7.0.3` in root
`package.json`
- Added npm override `serialize-javascript: ^7.0.3` in
`ee/fleetd-chrome/package.json`
- Updated `yarn.lock` and `ee/fleetd-chrome/package-lock.json` to
resolve to version 7.0.3
The upgrade uses package manager resolution features since parent
dependencies (`webpack`, `terser-webpack-plugin`, `copy-webpack-plugin`)
still specify 6.x in their own dependencies.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Pinned serialize-javascript dependency to version ^7.0.3 in project
configurations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com>
Co-authored-by: iansltx <472804+iansltx@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38536
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- Changes file present in previous PR.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Reorganized internal activity tracking infrastructure across services
to improve code maintainability and reduce complexity.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#40302
# Details
This PR adds support for a `paths:` key for scripts declared under
`controls:` in a GitOps fleet file. If supplied, `paths:` must contain a
"glob" expression (as [supported by the doublestar
package](https://github.com/bmatcuk/doublestar?tab=readme-ov-file#patterns)).
The existing `path:` key still works but may not contain glob
expressions. When a `paths:` key is encountered, we expand it and add
all matching valid (as in, `.sh` or `.ps1`) files to the set of script
files to process.
Subsequent PRs will add this functionality to other entities that use
`path:` (such as reports and policies).
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
Tried with various combinations of `*` and `**` in gitops runs, and
mixing of `path:` and `paths:`
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#40284
Following existing codebase pattern of passing the NOW time to the
method.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
- Via manipulating DB.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Enhanced Android certificate renewal system with improved
time-handling capabilities and better testability infrastructure for
certificate template operations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: jacobshandling <61553566+jacobshandling@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38432
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Fixed intermittent test failure in `EditLabelPage › renders the
ManualLabelForm when the label is manual` caused by redundant assertions
after async queries.
## Changes
- Removed redundant `toBeInTheDocument()` assertions after
`findByText()` calls in the manual label test
- `findByText()` already asserts element presence when it resolves;
storing the result and asserting again created a race condition
**Before:**
```typescript
const host1 = await screen.findByText("Test host #1");
expect(host1).toBeInTheDocument();
```
**After:**
```typescript
await screen.findByText("Test host #1");
```
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
- [x] Added/updated automated tests
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Refactored test assertions to use implicit presence validation instead
of explicit checks, improving test code maintainability without
affecting functionality.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com>
Co-authored-by: iansltx <472804+iansltx@users.noreply.github.com>
Co-authored-by: Ian Littman <iansltx@gmail.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#40183 and #40182
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
Attempting to fix race conditions for this test:
Go tests result: failure
https://github.com/fleetdm/fleet/actions/runs/22561475775
Summary:FAIL: TestIntegrationsEnterpriseGitops (352.91s)
FAIL:
TestIntegrationsEnterpriseGitops/TestFleetDesktopSettingsBrowserAlternativeHost
(6.64s)
FAIL:
TestIntegrationsEnterpriseGitops/TestFleetDesktopSettingsBrowserAlternativeHost/invalid_value
(0.31s)
And maybe also:
Go tests result: failure
https://github.com/fleetdm/fleet/actions/runs/22561475775
Summary:FAIL: TestIntegrationsEnterprise (273.17s)
FAIL: TestIntegrationsEnterprise/TestAllSoftwareTitles (2.07s)
FAIL: TestIntegrationsEnterprise/TestAppConfigOktaConditionalAccess
(0.89s)
FAIL:
TestIntegrationsEnterprise/TestFleetDesktopSettingsAlternativeBrowserHostURL
(0.24s)
FAIL: TestIntegrationsEnterprise/TestGitOpsModeConfig (0.28s)
Go tests result: failure
https://github.com/fleetdm/fleet/actions/runs/22561475775
Summary:FAIL: TestIntegrationsMDM (506.39s)
FAIL: TestIntegrationsMDM/TestAppConfigMDMCustomSettings (0.54s)
FAIL: TestIntegrationsMDM/TestAppConfigMDMMacOSMigration (0.45s)
FAIL: TestIntegrationsMDM/TestAppConfigWindowsMDM (2.29s)
FAIL: TestIntegrationsMDM/TestAppleConfigSecretVariablesUpload (0.46s)
Per GPT:
```
Root cause
Within a single test (e.g.
TestFleetDesktopSettingsAlternativeBrowserHostURL), the test makes an
API request that returns an InvalidArgumentError. When encoding the
error response, EncodeError() does two things in sequence
(server/platform/endpointer/transport_error.go:78-88):
1. Calls ctxerr.Handle() which sends the error object to the error
store's background goroutine via a channel
2. Calls UUID() on the same error object, which lazily writes the
uuid field (server/platform/http/errors.go:55)
Meanwhile, the error store background goroutine (started once during
SetupSuite) picks up that same error object from the channel and
calls MarshalJSON() → InvalidArgumentError.Error()
(server/contexts/ctxerr/ctxerr.go:244). Since Error() was a value
receiver, Go copies the entire struct to call it, inadvertently
reading the uuid field while step 2 is writing it.
Two goroutines, same error object, no synchronization — that's the
race.
Fix
- Changed InvalidArgumentError.Error() from value receiver to pointer
receiver — eliminates the struct copy, so the uuid field is never
read concurrently with the write
- Changed InvalidArgumentError.WithStatus() to return a pointer to
invalidArgWithStatusError, since it embeds InvalidArgumentError and
needs a pointer to satisfy the error interface
- Changed profile_matcher.go to pass &invArg instead of invArg to
ctxerr.Wrap() — the only place in the codebase where
InvalidArgumentError was used as a value rather than a pointer
```
Add documentation for enabling bootstrap packages during MDM migration.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#39634
Updated the BYOD enrollment section to clarify that both profile-based
and account-driven enrollment methods are supported in Fleet, and added
a link to a guide for more information.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
Resolves#40593
This PR attempts to fix this error:
```
{"component":"http","err":"associating asset with adamID <adamId> to host <hostId>: making request to Apple VPP endpoint: making request to Apple VPP endpoint: Post \"https://vpp.itunes.apple.com/mdm/v2/assets/associate\": http: ContentLength=111 with Body length 0","host_id":<hostId>,"ip_addr":"<ip_addr>","level":"error","method":"POST","took":"20.748056032s","ts":"2026-02-25T09:53:32.10267006Z","uri":"/api/latest/fleet/device/<deviceId>/software/install/<id>","x_for_ip_addr":"<ip_addr>"}
```
Per my troubleshooting: `client.Do(req)` consumes the request body. When
retrying, the same `req` is reused but its body is not there -- so, the
retry sends `ContentLength=108` with an empty body, producing the `Body
length 0` error.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Ran the test I added without the code fix, and was able to see the exact
same error
<img width="1188" height="567" alt="Screenshot 2026-02-25 at 3 26 12 PM"
src="https://github.com/user-attachments/assets/d7bdfee7-de33-43d0-92c6-e77fa46329d6"
/>
After:
<img width="852" height="140" alt="Screenshot 2026-02-25 at 3 26 55 PM"
src="https://github.com/user-attachments/assets/e7ec3ea5-2b29-463a-9038-e5530d654a4d"
/>
Ian Littman