84a656fc2995ca688ebfaf603f2d2b562c1949fe
317
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 dependabot[bot]
|
f8d2660c6c |
Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.81.0 to 1.97.3 (#43204)
Bumps [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) from 1.81.0 to 1.97.3. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/90650dd22735ab68f6089ae5c39b6614286ae9ec"><code>90650dd</code></a> Release 2026-03-26</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/dd88818bee7d632a8b9da6e2c78ef92e23c94c62"><code>dd88818</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/b662c50138bd393927871b46e84ee3483377f5be"><code>b662c50</code></a> Update endpoints model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/500a9cb3522a0e71d798d7079ff5856b23c2cac1"><code>500a9cb</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/6221102f763bd65d7e403fa62c3a1e3d39e24dc6"><code>6221102</code></a> fix stale skew and delayed skew healing (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3359">#3359</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/0a39373433a121800bc68efa743a7486eb07aa3f"><code>0a39373</code></a> fix order of generated event header handlers (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3361">#3361</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/098f3898271e2eaaf8a92e38d1d928fb018805a6"><code>098f389</code></a> Only generate resolveAccountID when it's required (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3360">#3360</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/6ebab66428e97db0ee252fea042d56b1313cb9f6"><code>6ebab66</code></a> Release 2026-03-25</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/b2ec3beebb986a5e74e50d0c105119d84e1e934e"><code>b2ec3be</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/abc126f6b35bfe2f77e2505f6d04f8ceced971ee"><code>abc126f</code></a> Update API model</li> <li>Additional commits viewable in <a href="https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.81.0...service/s3/v1.97.3">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
8201ae63f1 |
Bump github.com/aws/aws-sdk-go-v2/service/kinesis from 1.35.3 to 1.43.5 (#43200)
Bumps [github.com/aws/aws-sdk-go-v2/service/kinesis](https://github.com/aws/aws-sdk-go-v2) from 1.35.3 to 1.43.5. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/f9f7a6bb124a1a7daffc65db40053d97678bd371"><code>f9f7a6b</code></a> Release 2025-07-19</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/c74fb637eb68925187407dfe105ba10d855cecd2"><code>c74fb63</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/d09b46671d6af69a0e1e808c953e5db4a0e5790c"><code>d09b466</code></a> generate aws-eusc (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3144">#3144</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/45575dd69588782d4a0944c7b3911018613d67c7"><code>45575dd</code></a> Release 2025-07-18</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/40f9e8b889dbda9e80b651bd55ea13a99d75d6cc"><code>40f9e8b</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/da30009f1debd56e812c58845b0a3ee4e6e1fb58"><code>da30009</code></a> Update endpoints model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/78fe67fa8c7f08f490e1e04bbe3ce609bfc66fe6"><code>78fe67f</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/654c62d6b16cfa75aba17f6f2feb7d91d627186a"><code>654c62d</code></a> Release 2025-07-17</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/47a74cd2a3a4464fbb1273db6ede81d2bb72bb1d"><code>47a74cd</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/bdd96b2ea29e4a7c96d0dbe1dc1a039bf85d090c"><code>bdd96b2</code></a> Update endpoints model</li> <li>Additional commits viewable in <a href="https://github.com/aws/aws-sdk-go-v2/compare/service/pi/v1.35.3...service/ivs/v1.43.5">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
98075b2734 |
Bump github.com/aws/aws-sdk-go-v2/service/lambda from 1.72.0 to 1.88.5 (#43199)
Bumps [github.com/aws/aws-sdk-go-v2/service/lambda](https://github.com/aws/aws-sdk-go-v2) from 1.72.0 to 1.88.5. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/b9b0c6553b80f99603b4f8356b88f5baf1328deb"><code>b9b0c65</code></a> Release 2025-10-16</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/e2bc8a0ec6f430876fc7de4432ea9cc89c9568f8"><code>e2bc8a0</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/8691ee380a96c49351e4b5ab8a70bc5d4d100724"><code>8691ee3</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/51e8a3fe032fc566d31b389f492ab58475a98398"><code>51e8a3f</code></a> bump to go1.23 (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3211">#3211</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/ad2d36cba7c5772b4e8e4caf96939dc41b95c65c"><code>ad2d36c</code></a> Release 2025-10-15</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/19a35d639f969ee328553e632e8cf8b83d324106"><code>19a35d6</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/35cb02fd50fb125601b9c3b33feb72f3a2bcaa56"><code>35cb02f</code></a> Update endpoints model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/f673a1b0a80e666c0128ec606ff053dace9771f1"><code>f673a1b</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/48421fd812d8592a4eb2b32d11ae07e228969012"><code>48421fd</code></a> Release 2025-10-14</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/fedcba778c21b451a91b4e4bcdd5d6c1554c6a5a"><code>fedcba7</code></a> Regenerated Clients</li> <li>Additional commits viewable in <a href="https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.72.0...service/s3/v1.88.5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
abaad3d4ca |
Bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5 (#42952)
Bumps [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) from 3.0.4 to 3.0.5. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-jose/go-jose/commit/be2f6548701d4ba561cd61c7d4a2f1289b66c273"><code>be2f654</code></a> ci: update Go versions for GHA workflows (<a href="https://redirect.github.com/go-jose/go-jose/issues/221">#221</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/02464163e1e891db85257cb8860978a1c0226016"><code>0246416</code></a> Merge commit from fork</li> <li>See full diff in <a href="https://github.com/go-jose/go-jose/compare/v3.0.4...v3.0.5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
d4f48b6f9c |
ACME MDM -> main (#42926)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** The entire ACME feature branch merge # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually --------- Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com> Co-authored-by: Martin Angers <martin.n.angers@gmail.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Gabriel Hernandez <ghernandez345@gmail.com> Co-authored-by: Sarah Gillespie <73313222+gillespi314@users.noreply.github.com> |
||
|
dependabot[bot]
|
1aef37c75c |
Bump github.com/go-git/go-git/v5 from 5.16.5 to 5.17.1 (#42670)
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.16.5 to 5.17.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.17.1</h2> <h2>What's Changed</h2> <ul> <li>build: Update module github.com/cloudflare/circl to v1.6.3 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/1930">go-git/go-git#1930</a></li> <li>[v5] plumbing: format/index, Improve v4 entry name validation by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1935">go-git/go-git#1935</a></li> <li>[v5] plumbing: format/idxfile, Fix version and fanout checks by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1937">go-git/go-git#1937</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1">https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1</a></p> <h2>v5.17.0</h2> <h2>What's Changed</h2> <ul> <li>build: Update module github.com/go-git/go-git/v5 to v5.16.5 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/1839">go-git/go-git#1839</a></li> <li>git: worktree, optimize infiles function for very large repos by <a href="https://github.com/k-anshul"><code>@k-anshul</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1853">go-git/go-git#1853</a></li> <li>git: Add strict checks for supported extensions by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1861">go-git/go-git#1861</a></li> <li>backport, git: Improve Status() speed with new index.ModTime check by <a href="https://github.com/cedric-appdirect"><code>@cedric-appdirect</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1862">go-git/go-git#1862</a></li> <li>storage: filesystem, Avoid overwriting loose obj files by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1864">go-git/go-git#1864</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.16.5...v5.17.0">https://github.com/go-git/go-git/compare/v5.16.5...v5.17.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/5e23dfd02db92644dc4a3358ceb297fce875b772"><code>5e23dfd</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1937">#1937</a> from pjbgf/idx-v5</li> <li><a href="https://github.com/go-git/go-git/commit/6b38a326816b80f64c20cc0e6113958b65c05a1c"><code>6b38a32</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1935">#1935</a> from pjbgf/index-v5</li> <li><a href="https://github.com/go-git/go-git/commit/cd757fcb856a2dcc5fff6c110320a8ff62e99513"><code>cd757fc</code></a> plumbing: format/idxfile, Fix version and fanout checks</li> <li><a href="https://github.com/go-git/go-git/commit/3ec0d70cb687ae1da5f4d18faa4229bd971a8710"><code>3ec0d70</code></a> plumbing: format/index, Fix tree extension invalidated entry parsing</li> <li><a href="https://github.com/go-git/go-git/commit/dbe10b6b425a2a4ea92a9d98e20cd68e15aede01"><code>dbe10b6</code></a> plumbing: format/index, Align V2/V3 long name and V4 prefix encoding with Git</li> <li><a href="https://github.com/go-git/go-git/commit/e9b65df44cb97faeba148b47523a362beaecddf9"><code>e9b65df</code></a> plumbing: format/index, Improve v4 entry name validation</li> <li><a href="https://github.com/go-git/go-git/commit/adad18daabddee04c5a889f0230035e74bca32c0"><code>adad18d</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1930">#1930</a> from go-git/renovate/releases/v5.x-go-github.com-clo...</li> <li><a href="https://github.com/go-git/go-git/commit/29470bd1d862c6e902996b8e8ff8eb7a0515a9be"><code>29470bd</code></a> build: Update module github.com/cloudflare/circl to v1.6.3 [SECURITY]</li> <li><a href="https://github.com/go-git/go-git/commit/bdf06885bdaa3631cf6a2017108086c6f53dcf69"><code>bdf0688</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1864">#1864</a> from pjbgf/v5-issue-55</li> <li><a href="https://github.com/go-git/go-git/commit/5290e521c8cf651bf3e8d3e37f517c7cf7aa0b19"><code>5290e52</code></a> storage: filesystem, Avoid overwriting loose obj files. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/55">#55</a></li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.16.5...v5.17.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
32f1c2026c |
Bump golang.org/x/image from 0.18.0 to 0.38.0 (#42661)
Bumps [golang.org/x/image](https://github.com/golang/image) from 0.18.0 to 0.38.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/image/commit/23ae9ed61c1d3343fb95015810f62dcbf444976e"><code>23ae9ed</code></a> tiff: cap buffer growth to prevent OOM from malicious IFD offset</li> <li><a href="https://github.com/golang/image/commit/e589e60f29d0bbbf6400e250e024f93cbc4961ee"><code>e589e60</code></a> webp: allow VP8L + VP8X(with alpha)</li> <li><a href="https://github.com/golang/image/commit/fe7d73de74b8a1ad508c93cfcb245d44579163ff"><code>fe7d73d</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/image/commit/e3d762b1d37ed96e757e3bc0bfb44f7455589df3"><code>e3d762b</code></a> all: upgrade go directive to at least 1.25.0 [generated]</li> <li><a href="https://github.com/golang/image/commit/833c6ed987962feaa3ec2624d8655421b25e2e0e"><code>833c6ed</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/image/commit/bc7fe0b43a01586e7ca7c087a2e8a625e8397dcb"><code>bc7fe0b</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/image/commit/c53c97f4ed88d55fafe963ee6e93cb357663d650"><code>c53c97f</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/image/commit/9032ff7c7b86f42b9bebdf6133191648224aecc0"><code>9032ff7</code></a> all: eliminate vet diagnostics</li> <li><a href="https://github.com/golang/image/commit/9c9d08c65c08567c997eccc8bde52fcc9369bea6"><code>9c9d08c</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/image/commit/742b1b756d98a0c48b1fcf464a0c63fa50e1aa6b"><code>742b1b7</code></a> all: fix some comments</li> <li>Additional commits viewable in <a href="https://github.com/golang/image/compare/v0.18.0...v0.38.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
82c3983939 |
Bump github.com/antchfx/xpath from 1.2.2 to 1.3.6 (#42633)
Bumps [github.com/antchfx/xpath](https://github.com/antchfx/xpath) from 1.2.2 to 1.3.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/antchfx/xpath/releases">github.com/antchfx/xpath's releases</a>.</em></p> <blockquote> <h2>v1.3.6</h2> <p>Merged PR:</p> <ul> <li><a href="https://redirect.github.com/antchfx/xpath/issues/120">#120</a>(<a href="https://github.com/mislav"><code>@mislav</code></a>) - Fix <code>last()</code> predicate on grouped expr.</li> </ul> <p>Fixed:</p> <ul> <li><a href="https://redirect.github.com/antchfx/xpath/issues/121">#121</a></li> </ul> <h2>Release v1.3.5</h2> <p>Merged PR:</p> <ul> <li><a href="https://redirect.github.com/antchfx/xpath/issues/117">#117</a>(<a href="https://github.com/mislav"><code>@mislav</code></a>）- fix <code>ancestor::</code> axes with position predicate.</li> </ul> <p>Fixed:</p> <ul> <li><a href="https://redirect.github.com/antchfx/xpath/issues/113">#113</a> - (fix <code>string()</code> function)</li> </ul> <h2>v1.3.4</h2> <p>Merged PR:</p> <ul> <li><a href="https://redirect.github.com/antchfx/xpath/issues/107">#107</a>(<a href="https://github.com/Mrflatt"><code>@Mrflatt</code></a>) - supports Regexp feature in <code>replace()</code> function</li> <li><a href="https://redirect.github.com/antchfx/xpath/issues/111">#111</a>(<a href="https://github.com/wjc4"><code>@wjc4</code></a>) - Improve <code>getHashCode</code> performance</li> </ul> <p>Fixed:</p> <ul> <li><a href="https://redirect.github.com/antchfx/xpath/issues/109">#109</a></li> </ul> <h2>v1.3.3</h2> <p>fix non-English predicate query <a href="https://redirect.github.com/antchfx/xpath/issues/106">#106</a></p> <h2>v1.3.2</h2> <p>New Features:</p> <ul> <li>Supports Unicode chars for Non-English (PR <a href="https://redirect.github.com/antchfx/xpath/issues/100">#100</a>)</li> </ul> <p>Bug Fixed:</p> <ul> <li><a href="https://redirect.github.com/antchfx/xpath/issues/101">#101</a></li> <li><a href="https://redirect.github.com/antchfx/xpath/issues/102">#102</a></li> <li><a href="https://redirect.github.com/antchfx/xpath/issues/104">#104</a></li> </ul> <h2>v1.3.1</h2> <ul> <li>Merged PR <a href="https://redirect.github.com/antchfx/xpath/issues/97">#97</a>.</li> <li>Allows node-set numeric operator <code>+</code>, <code>-</code>, <code>mod()</code>.<a href="https://github.com/antchfx/xpath/commit/4b4638b370e898a9d10709464b8cd460b7dcfd0c">https://github.com/antchfx/xpath/commit/4b4638b370e898a9d10709464b8cd460b7dcfd0c</a></li> <li><a href="https://redirect.github.com/antchfx/xpath/issues/98">#98</a>, Remove the duplicate element filter <a href="https://github.com/antchfx/xpath/commit/5481aef473ee298d297387f5b69e2768df09e0c4">https://github.com/antchfx/xpath/commit/5481aef473ee298d297387f5b69e2768df09e0c4</a></li> </ul> <h2>v1.3.0</h2> <ul> <li>fixes <a href="https://redirect.github.com/antchfx/xpath/issues/93">#93</a></li> </ul> <h3>New features:</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/antchfx/xpath/commit/afd4762cc342af56345a3fb4002a59281fcab494"><code>afd4762</code></a> fix <a href="https://redirect.github.com/antchfx/xpath/issues/121">#121</a></li> <li><a href="https://github.com/antchfx/xpath/commit/a8ced8f559cd68fc4aedfc87f21599d1190c0852"><code>a8ced8f</code></a> Merge PR <a href="https://redirect.github.com/antchfx/xpath/issues/120">#120</a></li> <li><a href="https://github.com/antchfx/xpath/commit/c92c3ebebbdd67f715161810f97ecfbcaa47921e"><code>c92c3eb</code></a> Fix last() predicate on grouped expressions</li> <li><a href="https://github.com/antchfx/xpath/commit/3cbab9750ea36cbae6f967ebbf29b9eda0e841bf"><code>3cbab97</code></a> Merge PR <a href="https://redirect.github.com/antchfx/xpath/issues/119">#119</a></li> <li><a href="https://github.com/antchfx/xpath/commit/02c01b0b4051e7edd1bf40f3d595cc9143936aaa"><code>02c01b0</code></a> Fix chained predicates on ancestor axis</li> <li><a href="https://github.com/antchfx/xpath/commit/511abd57bc74e9644fe27f4e52b559065e686e92"><code>511abd5</code></a> Merge PR <a href="https://redirect.github.com/antchfx/xpath/issues/117">#117</a></li> <li><a href="https://github.com/antchfx/xpath/commit/060b15493444a0e6c5a232022516e434818f7391"><code>060b154</code></a> Fix positional predicate for the "ancestor" axis</li> <li><a href="https://github.com/antchfx/xpath/commit/8d50c252d867285812177ffd3ff0924104ffb1eb"><code>8d50c25</code></a> fix <a href="https://redirect.github.com/antchfx/xpath/issues/112">#112</a>，<a href="https://redirect.github.com/antchfx/xpath/issues/113">#113</a></li> <li><a href="https://github.com/antchfx/xpath/commit/b9e198da9fb170a229c9c7e27d52e1a350636f4c"><code>b9e198d</code></a> Merge PR <a href="https://redirect.github.com/antchfx/xpath/issues/111">#111</a></li> <li><a href="https://github.com/antchfx/xpath/commit/fcb882bece30fe7d4d8f5069fed13f95a726e62f"><code>fcb882b</code></a> improve getHashCode by removing fmt.Sprintf</li> <li>Additional commits viewable in <a href="https://github.com/antchfx/xpath/compare/v1.2.2...v1.3.6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Lucas Manuel Rodriguez
|
d8588ed790 |
Bump macadmins version and add macos_thermal_pressure and macos_soc_power tables (#42569)
**Related issue:** Resolves #42530 - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## fleetd/orbit/Fleet Desktop - [X] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [X] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [X] Verified that fleetd runs on macOS, Linux and Windows - [X] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
dependabot[bot]
|
915feb9868 |
Bump github.com/russellhaering/goxmldsig from 1.4.0 to 1.6.0 (#42009)
Bumps [github.com/russellhaering/goxmldsig](https://github.com/russellhaering/goxmldsig) from 1.4.0 to 1.6.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/russellhaering/goxmldsig/releases">github.com/russellhaering/goxmldsig's releases</a>.</em></p> <blockquote> <h2>v1.6.0</h2> <h2>What's Changed</h2> <ul> <li><strong>Security:</strong> Fix possible signature validation bypass caused by loop variable capture in <code>validateSignature</code> (GHSA-479m-364c-43vc)</li> <li>Bump minimum Go version to 1.23</li> <li>Bump <code>github.com/beevik/etree</code> to v1.6.0</li> <li>Add fuzz tests for XML signature validation and canonicalization</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/russellhaering/goxmldsig/compare/v1.5.0...v1.6.0">https://github.com/russellhaering/goxmldsig/compare/v1.5.0...v1.6.0</a></p> <h2>v1.5.0</h2> <h2>What's Changed</h2> <ul> <li>Bump dependencies</li> <li>Update GitHub workflows</li> <li>Security hardening by <a href="https://github.com/ahacker1-securesaml"><code>@ahacker1-securesaml</code></a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/russellhaering/goxmldsig/compare/v1.4.0...v1.5.0">https://github.com/russellhaering/goxmldsig/compare/v1.4.0...v1.5.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/russellhaering/goxmldsig/commit/878c8c615feb628064040115d00e105a137fcfa7"><code>878c8c6</code></a> Apply go fix ./...</li> <li><a href="https://github.com/russellhaering/goxmldsig/commit/db3d1e31f7535d7f5debb49851b9e9a2ff08b936"><code>db3d1e3</code></a> Fix loop variable capture bug in validateSignature</li> <li><a href="https://github.com/russellhaering/goxmldsig/commit/4f576b89acf01f68983ca5cb9dcebd0b460234bc"><code>4f576b8</code></a> Bump dependencies</li> <li><a href="https://github.com/russellhaering/goxmldsig/commit/79c29ee3ed2da54553a4132b372ced83185fcf12"><code>79c29ee</code></a> Rename FuzzValidate to FuzzValidateXML to avoid name collision</li> <li><a href="https://github.com/russellhaering/goxmldsig/commit/ac7bf745b9fd3d92460ad9be3459a97b0e3bf89f"><code>ac7bf74</code></a> Add fuzz tests for XML signature validation and canonicalization</li> <li><a href="https://github.com/russellhaering/goxmldsig/commit/a5805dfad93fc67a2106a1dc6d881df83769e3eb"><code>a5805df</code></a> Bump github/codeql-action from 2.13.4 to 3.28.17 (<a href="https://redirect.github.com/russellhaering/goxmldsig/issues/155">#155</a>)</li> <li><a href="https://github.com/russellhaering/goxmldsig/commit/7dac9ec3b2a1a336d73ff091fba4131d186dfec6"><code>7dac9ec</code></a> Update GitHub Workflow</li> <li><a href="https://github.com/russellhaering/goxmldsig/commit/1bf54ca740682fac1149814344c24c722fde8238"><code>1bf54ca</code></a> Bump dependencies</li> <li><a href="https://github.com/russellhaering/goxmldsig/commit/e1c8a5b89d1d03089aa1a0ec546b33aaf80ee02f"><code>e1c8a5b</code></a> Refactor to help eliminate potential vulnerabilities:</li> <li><a href="https://github.com/russellhaering/goxmldsig/commit/2ac5490a2441a3484e030c5cfeb02ce62886c01a"><code>2ac5490</code></a> Refactor .verifyCertificate to obtain the certificate from an identifier from...</li> <li>Additional commits viewable in <a href="https://github.com/russellhaering/goxmldsig/compare/v1.4.0...v1.6.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
7d1865399e |
Bump github.com/nats-io/nats-server/v2 from 2.12.3 to 2.12.6 (#42338)
Bumps [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) from 2.12.3 to 2.12.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nats-io/nats-server/releases">github.com/nats-io/nats-server/v2's releases</a>.</em></p> <blockquote> <h2>Release v2.12.6</h2> <h2>Changelog</h2> <p>Refer to the <a href="https://docs.nats.io/release-notes/whats_new/whats_new_212">2.12 Upgrade Guide</a> for backwards compatibility notes with 2.11.x.</p> <h3>Go Version</h3> <ul> <li>1.25.8</li> </ul> <h3>Dependencies</h3> <ul> <li>golang.org/x/crypto v0.49.0 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7953">#7953</a>)</li> <li>github.com/nats-io/jwt/v2 v2.8.1 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7960">#7960</a>)</li> <li>golang.org/x/sys v0.42.0 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7923">#7923</a>)</li> <li>golang.org/x/time v0.15.0 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7923">#7923</a>)</li> </ul> <h3>CVEs</h3> <ul> <li>Fixes CVE-2026-33216, CVE-2026-33217, CVE-2026-33215 (affecting systems using MQTT)</li> <li>Fixes CVE-2026-33246 (affects systems using leafnodes and service imports)</li> <li>Fixes CVE-2026-33218 (affects systems using leafnodes)</li> <li>Fixes CVE-2026-33219 (affects systems using WebSockets)</li> <li>Fixes CVE-2026-33223, CVE-2026-33222 (affects systems using JetStream)</li> <li>Fixes CVE-2026-33248 (affects systems using mutual TLS)</li> <li>Fixes CVE-2026-33247 (affects systems providing credentials on the command line)</li> <li>Fixes CVE-2026-33249 (affects systems where client publish permissions should be restricted)</li> </ul> <h3>Improved</h3> <p>General</p> <ul> <li>Non-WebSocket leafnode connections can now be proxied using HTTP CONNECT (<a href="https://redirect.github.com/nats-io/nats-server/issues/7781">#7781</a>)</li> <li>The <code>$SYS.REQ.USER.INFO</code> response now includes the friendly nametag of the account and/or user if known (<a href="https://redirect.github.com/nats-io/nats-server/issues/7973">#7973</a>)</li> </ul> <p>JetStream</p> <ul> <li>The stream peer-remove command now accepts a peer ID as well as a server name (<a href="https://redirect.github.com/nats-io/nats-server/issues/7952">#7952</a>)</li> </ul> <p>MQTT</p> <ul> <li>Protocol compliance has been improved, including more error handling on invalid or malformed MQTT packets (<a href="https://redirect.github.com/nats-io/nats-server/issues/7933">#7933</a>)</li> </ul> <h3>Fixed</h3> <p>General</p> <ul> <li>Client connections are no longer registered after an auth callout timeout (<a href="https://redirect.github.com/nats-io/nats-server/issues/7932">#7932</a>)</li> <li>Improved handling of duplicate headers</li> <li>A correctness bug when validating relative distinguished names has been fixed</li> <li>Secrets are now redacted correctly in trace logging (<a href="https://redirect.github.com/nats-io/nats-server/issues/7942">#7942</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nats-io/nats-server/commit/0e0639058e0d2d8fce0cc34941f9897da152ab32"><code>0e06390</code></a> Release v2.12.6</li> <li><a href="https://github.com/nats-io/nats-server/commit/f593d279dadfbe8228c532ef21216a2b4b84cf4b"><code>f593d27</code></a> Cherry-picks for 2.12.6 (<a href="https://redirect.github.com/nats-io/nats-server/issues/61">#61</a>)</li> <li><a href="https://github.com/nats-io/nats-server/commit/9f904de022cb441444dc14fc5b0251b140fa1dae"><code>9f904de</code></a> [FIXED] Incomplete route pool on premature pong</li> <li><a href="https://github.com/nats-io/nats-server/commit/b5101921e22a149ea8e23e725d04bf0a85893a48"><code>b510192</code></a> [FIXED] Avoid stalling read loop on leafnode ErrMinimumVersionRequired</li> <li><a href="https://github.com/nats-io/nats-server/commit/53941c24a17589c51aff5235991e77357fec2a0c"><code>53941c2</code></a> Report the account and user name in USER.INFO request</li> <li><a href="https://github.com/nats-io/nats-server/commit/1ab002ab2b6b8057ca2897e60cf7a8b3194d3eed"><code>1ab002a</code></a> [IMPROVED] Support HTTP proxy connection from leaf nodes also for TCP</li> <li><a href="https://github.com/nats-io/nats-server/commit/8b6408239fedc487d20fb73626f77689c70c5766"><code>8b64082</code></a> Release v2.12.6-RC.3</li> <li><a href="https://github.com/nats-io/nats-server/commit/e6ab7e9541583932608965ff3d815e323b152e42"><code>e6ab7e9</code></a> Cherry-picks for 2.12.6-RC.3 (<a href="https://redirect.github.com/nats-io/nats-server/issues/59">#59</a>)</li> <li><a href="https://github.com/nats-io/nats-server/commit/9f4d96076caa4b4af2911b6391c04e35e76ea1b6"><code>9f4d960</code></a> Make the deduplication window actually work for deduplication for sourcing</li> <li><a href="https://github.com/nats-io/nats-server/commit/304e18402b566a211c9721c9f39eebba65153574"><code>304e184</code></a> Remove FIXME about auth callout nonce</li> <li>Additional commits viewable in <a href="https://github.com/nats-io/nats-server/compare/v2.12.3...v2.12.6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Scott Gress
|
91362ba2ca |
Add fleetctl new command (#41909)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41345 # Details This PR: * Adds a new `fleetctl new` command which creates a starter GitOps repo file structure * Adds support for file globs for the `configuration_profiles:` key in GitOps, to support its use in the `fleetctl new` templates. This involved moving the `BaseItem` type and `SupportsFileInclude` interface into the `fleet` package so that the `MDMProfileSpec` type could implement the interface and do glob expansion. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [X] added unit and intg tests for globbing profiles - [ ] added tests for `fleetctl new` - [X] QA'd all new/changed functionality manually - [X] `fleetctl new` with no args prompted for org name and created a new `it-and-security` folder under current folder w/ correct files - [X] `fleetctl new --dir /tmp/testnew` created correct files under `/tmp/testnew` - [X] `fleetctl new --dir /tmp/testexisting --force` with an existing `/tmp/testexisting` folder created correct files under `/tmp/testexisting` - [X] `fleetctl new --org-name=foo` created correct files under `it-and-security` without prompting for org name - [X] `paths:` in `configuration_profiles` picks up multiple matching profiles - [X] `paths:` + `path:` in `configuration_profiles` will error if the same profile is picked up twice <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added `fleetctl new` command to initialize GitOps repository structure via CLI. * Added glob pattern support for `configuration_profiles` field, enabling flexible profile selection. * **Chores** * Updated CLI dependencies to support enhanced user interactions. * Removed legacy website generator configuration files. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
dependabot[bot]
|
73c386f207 |
Bump google.golang.org/grpc from 1.78.0 to 1.79.3 (#42011)
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.78.0 to 1.79.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.79.3</h2> <h1>Security</h1> <ul> <li>server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like <code>grpc/authz</code>. Any request with a non-canonical path is now immediately rejected with an <code>Unimplemented</code> error. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8981">#8981</a>)</li> </ul> <h2>Release 1.79.2</h2> <h1>Bug Fixes</h1> <ul> <li>stats: Prevent redundant error logging in health/ORCA producers by skipping stats/tracing processing when no stats handler is configured. (<a href="https://redirect.github.com/grpc/grpc-go/pull/8874">grpc/grpc-go#8874</a>)</li> </ul> <h2>Release 1.79.1</h2> <h1>Bug Fixes</h1> <ul> <li>grpc: Remove the <code>-dev</code> suffix from the User-Agent header. (<a href="https://redirect.github.com/grpc/grpc-go/pull/8902">grpc/grpc-go#8902</a>)</li> </ul> <h2>Release 1.79.0</h2> <h1>API Changes</h1> <ul> <li>mem: Add experimental API <code>SetDefaultBufferPool</code> to change the default buffer pool. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8806">#8806</a>) <ul> <li>Special Thanks: <a href="https://github.com/vanja-p"><code>@vanja-p</code></a></li> </ul> </li> <li>experimental/stats: Update <code>MetricsRecorder</code> to require embedding the new <code>UnimplementedMetricsRecorder</code> (a no-op struct) in all implementations for forward compatibility. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8780">#8780</a>)</li> </ul> <h1>Behavior Changes</h1> <ul> <li>balancer/weightedtarget: Remove handling of <code>Addresses</code> and only handle <code>Endpoints</code> in resolver updates. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8841">#8841</a>)</li> </ul> <h1>New Features</h1> <ul> <li>experimental/stats: Add support for asynchronous gauge metrics through the new <code>AsyncMetricReporter</code> and <code>RegisterAsyncReporter</code> APIs. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8780">#8780</a>)</li> <li>pickfirst: Add support for weighted random shuffling of endpoints, as described in <a href="https://redirect.github.com/grpc/proposal/pull/535">gRFC A113</a>. <ul> <li>This is enabled by default, and can be turned off using the environment variable <code>GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING</code>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8864">#8864</a>)</li> </ul> </li> <li>xds: Implement <code>:authority</code> rewriting, as specified in <a href="https://github.com/grpc/proposal/blob/master/A81-xds-authority-rewriting.md">gRFC A81</a>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8779">#8779</a>)</li> <li>balancer/randomsubsetting: Implement the <code>random_subsetting</code> LB policy, as specified in <a href="https://github.com/grpc/proposal/blob/master/A68-random-subsetting.md">gRFC A68</a>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8650">#8650</a>) <ul> <li>Special Thanks: <a href="https://github.com/marek-szews"><code>@marek-szews</code></a></li> </ul> </li> </ul> <h1>Bug Fixes</h1> <ul> <li>credentials/tls: Fix a bug where the port was not stripped from the authority override before validation. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8726">#8726</a>) <ul> <li>Special Thanks: <a href="https://github.com/Atul1710"><code>@Atul1710</code></a></li> </ul> </li> <li>xds/priority: Fix a bug causing delayed failover to lower-priority clusters when a higher-priority cluster is stuck in <code>CONNECTING</code> state. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8813">#8813</a>)</li> <li>health: Fix a bug where health checks failed for clients using legacy compression options (<code>WithDecompressor</code> or <code>RPCDecompressor</code>). (<a href="https://redirect.github.com/grpc/grpc-go/issues/8765">#8765</a>) <ul> <li>Special Thanks: <a href="https://github.com/sanki92"><code>@sanki92</code></a></li> </ul> </li> <li>transport: Fix an issue where the HTTP/2 server could skip header size checks when terminating a stream early. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8769">#8769</a>) <ul> <li>Special Thanks: <a href="https://github.com/joybestourous"><code>@joybestourous</code></a></li> </ul> </li> <li>server: Propagate status detail headers, if available, when terminating a stream during request header processing. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8754">#8754</a>) <ul> <li>Special Thanks: <a href="https://github.com/joybestourous"><code>@joybestourous</code></a></li> </ul> </li> </ul> <h1>Performance Improvements</h1> <ul> <li>credentials/alts: Optimize read buffer alignment to reduce copies. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8791">#8791</a>)</li> <li>mem: Optimize pooling and creation of <code>buffer</code> objects. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8784">#8784</a>)</li> <li>transport: Reduce slice re-allocations by reserving slice capacity. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8797">#8797</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/dda86dbd9cecb8b35b58c73d507d81d67761205f"><code>dda86db</code></a> Change version to 1.79.3 (<a href="https://redirect.github.com/grpc/grpc-go/issues/8983">#8983</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/72186f163e75a065c39e6f7df9b6dea07fbdeff5"><code>72186f1</code></a> grpc: enforce strict path checking for incoming requests on the server (<a href="https://redirect.github.com/grpc/grpc-go/issues/8981">#8981</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/97ca3522b239edf6813e2b1106924e9d55e89d43"><code>97ca352</code></a> Changing version to 1.79.3-dev (<a href="https://redirect.github.com/grpc/grpc-go/issues/8954">#8954</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/8902ab6efea590f5b3861126559eaa26fa9783b2"><code>8902ab6</code></a> Change the version to release 1.79.2 (<a href="https://redirect.github.com/grpc/grpc-go/issues/8947">#8947</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/a9286705aa689bee321ec674323b6896284f3e02"><code>a928670</code></a> Cherry-pick <a href="https://redirect.github.com/grpc/grpc-go/issues/8874">#8874</a> to v1.79.x (<a href="https://redirect.github.com/grpc/grpc-go/issues/8904">#8904</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/06df3638c0bcee88197b1033b3ba83e1eb8bc010"><code>06df363</code></a> Change version to 1.79.2-dev (<a href="https://redirect.github.com/grpc/grpc-go/issues/8903">#8903</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/782f2de44f597af18a120527e7682a6670d84289"><code>782f2de</code></a> Change version to 1.79.1 (<a href="https://redirect.github.com/grpc/grpc-go/issues/8902">#8902</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/850eccbb2257bd2de6ac28ee88a7172ab6175629"><code>850eccb</code></a> Change version to 1.79.1-dev (<a href="https://redirect.github.com/grpc/grpc-go/issues/8851">#8851</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/765ff056b6890f6c8341894df4e9668e9bfc18ef"><code>765ff05</code></a> Change version to 1.79.0 (<a href="https://redirect.github.com/grpc/grpc-go/issues/8850">#8850</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/68804be0e78ed0365bb5a576dedc12e2168ed63e"><code>68804be</code></a> Cherry pick <a href="https://redirect.github.com/grpc/grpc-go/issues/8864">#8864</a> to v1.79.x (<a href="https://redirect.github.com/grpc/grpc-go/issues/8896">#8896</a>)</li> <li>Additional commits viewable in <a href="https://github.com/grpc/grpc-go/compare/v1.78.0...v1.79.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Victor Lyuboslavsky
|
fbc5b9d8b6 |
Updated go to 1.26.1 (#42027)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41749 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. |
||
|
Lucas Manuel Rodriguez
|
ba3746f9fa |
Fix fleetd crash in Apple M5 hardware by upgrading gopsutil (#41940)
Resolves #41863 - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] QA'd all new/changed functionality manually Tests performed on the following OSs: - Windows (arm64) - macOS (Apple silicon) - Linux (arm64) - Linux (amd64) Features tested on the OSs above: - "My device". - Restart fleetd. - Kill fleet desktop, should re-start. - Killing stale osqueryd processes on orbit startup. - Checking if osquery is up and running, exit and start. - Checking if Fleet Desktop is already running before launching it. - orbit auto update - Gracefully shutting down Fleet Desktop before restarting it --- ## fleetd/orbit/Fleet Desktop - [X] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
Scott GressandIan Littman
|
d5eee802eb |
Detect unknown keys in GitOps (phase 1) (#40963)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #40496 # Details This is the first phase of an effort to detect unknown keys in GitOps .yml files. In the regular `fleetctl gitops` case, it will fail when unknown keys are detected. This behavior can be changed with a new `--allow-unknown-keys` flag which will log the issues and continue. In this first phase we are detecting unknown keys in _most_ GitOps sections, other than the top-level `org_settings:` and `settings:` sections which have more complicated typing. I will tackle those separately as they require a bit more thought. Also ultimately I'd like us to be doing this validation in a more top-down fashion in one place, rather than spreading it across the code by doing it in each individual section, but this is a good first step. As a bonus, I invited my pal Mr. Levenshtein to the party so that we can make suggestions when unknown keys are detected, like: ``` * unknown key "queyr" in "./lib/some-report.yml"; did you mean "query"? ``` > Note: the goal is to return as many validation errors as possible to the user, so they don't have to keep running `fleetctl gitops` to get the next error. I did _not_ update any other errors to stop returning early, in an effort to keep this as low-touch as possible. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually - [X] Tested this against existing it-and-security folder and one with updated keys from https://github.com/fleetdm/fleet/pull/40959; no unknown keys detected - [X] Added unknown keys at various levels, GitOps errored with helpful messages - [X] Same as above but with `--allow-unknown-keys`; GitOps outputted helpful messages but continued. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * GitOps runs now fail when unknown or misspelled keys are present in configuration files. * New CLI flag --allow-unknown-keys lets unknown keys be treated as warnings instead of errors. * Unknown-key messages include suggested valid key names to help correct mistakes. * **Tests** * Expanded test coverage to validate unknown-key detection and the allow-as-warning option. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Ian Littman <iansltx@gmail.com> |
||
|
Scott Gress
|
2c56b89072 |
Support globs in script paths in GitOps (#40799)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #40302 # Details This PR adds support for a `paths:` key for scripts declared under `controls:` in a GitOps fleet file. If supplied, `paths:` must contain a "glob" expression (as [supported by the doublestar package](https://github.com/bmatcuk/doublestar?tab=readme-ov-file#patterns)). The existing `path:` key still works but may not contain glob expressions. When a `paths:` key is encountered, we expand it and add all matching valid (as in, `.sh` or `.ps1`) files to the set of script files to process. Subsequent PRs will add this functionality to other entities that use `path:` (such as reports and policies). # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually Tried with various combinations of `*` and `**` in gitops runs, and mixing of `path:` and `paths:` |
||
|
Victor Lyuboslavsky
|
62186cb6bd |
Final slog migration PR: test infrastructure + tools + remaining standalone files (#40727)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #40540 go-kit/log is no longer a direct dependency; moved kitlog adapter required for some 3rd party libraries into its own package # Checklist for submitter - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - Present in previous PR ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Modernized logging across the codebase: switched from legacy logging wrappers to Go's standard slog, updated adapters, tests, tools, and server components. * Threaded the new slog logger through test utilities and tooling; adjusted a small number of logging-related function/constructor signatures to accept the new logger type (minor compatibility updates). <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
dependabot[bot]
|
3cda538f37 |
Bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 (#40531)
Bumps [github.com/cloudflare/circl](https://github.com/cloudflare/circl) from 1.6.1 to 1.6.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cloudflare/circl/releases">github.com/cloudflare/circl's releases</a>.</em></p> <blockquote> <h2>CIRCL v1.6.3</h2> <p>Fix a bug on ecc/p384 scalar multiplication.</p> <h3>What's Changed</h3> <ul> <li>sign/mldsa: Check opts for nil value by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/582">cloudflare/circl#582</a></li> <li>ecc/p384: Point addition must handle point doubling case. by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/583">cloudflare/circl#583</a></li> <li>Release CIRCL v1.6.3 by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/584">cloudflare/circl#584</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/cloudflare/circl/compare/v1.6.2...v1.6.3">https://github.com/cloudflare/circl/compare/v1.6.2...v1.6.3</a></p> <h2>CIRCL v1.6.2</h2> <ul> <li>New SLH-DSA, improvements in ML-DSA for arm64.</li> <li>Tested compilation on WASM.</li> </ul> <h2>What's Changed</h2> <ul> <li>Optimize pairing product computation by moving exponentiations to G1. by <a href="https://github.com/dfaranha"><code>@dfaranha</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/547">cloudflare/circl#547</a></li> <li>sign: Adding SLH-DSA signature by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/512">cloudflare/circl#512</a></li> <li>Update code generators to CIRCL v1.6.1. by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/548">cloudflare/circl#548</a></li> <li>ML-DSA: Add preliminary Wycheproof test vectors by <a href="https://github.com/bwesterb"><code>@bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/552">cloudflare/circl#552</a></li> <li>go fmt by <a href="https://github.com/bwesterb"><code>@bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/554">cloudflare/circl#554</a></li> <li>gz-compressing test vectors, use of HexBytes and ReadGzip functions. by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/555">cloudflare/circl#555</a></li> <li>group: Removes use of elliptic Marshal and Unmarshal functions. by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/556">cloudflare/circl#556</a></li> <li>Support encoding/decoding ML-DSA private keys (as long as they contain seeds) by <a href="https://github.com/bwesterb"><code>@bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/559">cloudflare/circl#559</a></li> <li>Update to golangci-lint v2 by <a href="https://github.com/bwesterb"><code>@bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/560">cloudflare/circl#560</a></li> <li>Preparation for ARM64 Implementation of poly operations for dilithium package. by <a href="https://github.com/elementrics"><code>@elementrics</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/562">cloudflare/circl#562</a></li> <li>prepare power2Round for custom implementations in assembly by <a href="https://github.com/elementrics"><code>@elementrics</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/564">cloudflare/circl#564</a></li> <li>ARM64 implementation for poly.PackLe16 by <a href="https://github.com/elementrics"><code>@elementrics</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/563">cloudflare/circl#563</a></li> <li>add arm64 version of polyMulBy2toD by <a href="https://github.com/elementrics"><code>@elementrics</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/565">cloudflare/circl#565</a></li> <li>add arm64 version of polySub by <a href="https://github.com/elementrics"><code>@elementrics</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/566">cloudflare/circl#566</a></li> <li>group: add byteLen method for short groups and RandomScalar uses rand.Int by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/568">cloudflare/circl#568</a></li> <li>add arm64 version of poly.Add/Sub by <a href="https://github.com/elementrics"><code>@elementrics</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/572">cloudflare/circl#572</a></li> <li>group: Adding cryptobyte marshaling to scalars by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/569">cloudflare/circl#569</a></li> <li>Bumping up to Go1.25 by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/574">cloudflare/circl#574</a></li> <li>ci: Including WASM compilation. by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/577">cloudflare/circl#577</a></li> <li>Revert to using package-declared HPKE errors for shortkem instead of standard library errors by <a href="https://github.com/harshiniwho"><code>@harshiniwho</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/578">cloudflare/circl#578</a></li> <li>Release v1.6.2 by <a href="https://github.com/armfazh"><code>@armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/579">cloudflare/circl#579</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dfaranha"><code>@dfaranha</code></a> made their first contribution in <a href="https://redirect.github.com/cloudflare/circl/pull/547">cloudflare/circl#547</a></li> <li><a href="https://github.com/elementrics"><code>@elementrics</code></a> made their first contribution in <a href="https://redirect.github.com/cloudflare/circl/pull/562">cloudflare/circl#562</a></li> <li><a href="https://github.com/harshiniwho"><code>@harshiniwho</code></a> made their first contribution in <a href="https://redirect.github.com/cloudflare/circl/pull/578">cloudflare/circl#578</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/cloudflare/circl/compare/v1.6.1...v1.6.2">https://github.com/cloudflare/circl/compare/v1.6.1...v1.6.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cloudflare/circl/commit/24ae53c5d6f7fe18203adc125ba3ed76a38703e1"><code>24ae53c</code></a> Release CIRCL v1.6.3</li> <li><a href="https://github.com/cloudflare/circl/commit/581020bd4a836b8ce7bd4e414ba2884c07dbc906"><code>581020b</code></a> Rename method to oddMultiplesProjective.</li> <li><a href="https://github.com/cloudflare/circl/commit/12209a4566605692a8402594e367a5aed5148460"><code>12209a4</code></a> Removing unused cmov for jacobian points.</li> <li><a href="https://github.com/cloudflare/circl/commit/fcba359f4178645d2c9e50f29ab6966337da4b95"><code>fcba359</code></a> ecc/p384: use of complete projective formulas for scalar multiplication.</li> <li><a href="https://github.com/cloudflare/circl/commit/5e1bae8d8c2df4e717c2c5c2d5b5d60b629b2ac6"><code>5e1bae8</code></a> ecc/p384: handle point doubling in point addition with Jacobian coordinates.</li> <li><a href="https://github.com/cloudflare/circl/commit/341604685ff97e8f7440ae4b4711ba1c118c648c"><code>3416046</code></a> Check opts for nil value.</li> <li><a href="https://github.com/cloudflare/circl/commit/a763d47a6dce43d1f4f7b697d1d7810463a526f6"><code>a763d47</code></a> Release CIRCL v1.6.2</li> <li><a href="https://github.com/cloudflare/circl/commit/3c70bf9ad53b681fbe5ba6067e454a86549fee8a"><code>3c70bf9</code></a> Bump x/crypto x/sys dependencies.</li> <li><a href="https://github.com/cloudflare/circl/commit/3f0f15b2bfe67bad81a35e8aec81ae42ca78349d"><code>3f0f15b</code></a> Revert to using package-declared HPKE errors for shortkem instead of standard...</li> <li><a href="https://github.com/cloudflare/circl/commit/23491bd573cf29b6f567057a158203a2c9dfa30d"><code>23491bd</code></a> Adding generic Power2Round method.</li> <li>Additional commits viewable in <a href="https://github.com/cloudflare/circl/compare/v1.6.1...v1.6.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]andIan Littman
|
6c584e889a |
Bump github.com/nats-io/nats-server/v2 from 2.12.1 to 2.12.3 (#40406)
Bumps [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) from 2.12.1 to 2.12.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nats-io/nats-server/releases">github.com/nats-io/nats-server/v2's releases</a>.</em></p> <blockquote> <h2>Release v2.12.3</h2> <h2>Changelog</h2> <p>Refer to the <a href="https://docs.nats.io/release-notes/whats_new/whats_new_212">2.12 Upgrade Guide</a> for backwards compatibility notes with 2.11.x.</p> <h3>Go Version</h3> <ul> <li>1.25.5 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7604">#7604</a>)</li> </ul> <h3>Dependencies</h3> <ul> <li>github.com/google/go-tpm v0.9.7 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7578">#7578</a>)</li> <li>github.com/nats-io/nkeys v0.4.12 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7578">#7578</a>)</li> <li>golang.org/x/crypto v0.45.0 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7578">#7578</a>)</li> <li>github.com/klauspost/compress v1.18.2 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7604">#7604</a>)</li> <li>github.com/antithesishq/antithesis-sdk-go v0.5.0-default-no-op (<a href="https://redirect.github.com/nats-io/nats-server/issues/7604">#7604</a>)</li> <li>golang.org/x/crypto v0.46.0 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7648">#7648</a>)</li> <li>golang.org/x/sys v0.39.0 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7648">#7648</a>)</li> </ul> <h3>Added</h3> <p>General</p> <ul> <li>Added WebSocket-specific ping interval configuration with <code>ping_internal</code> in the <code>websocket</code> block (<a href="https://redirect.github.com/nats-io/nats-server/issues/7614">#7614</a>)</li> </ul> <h3>Improved</h3> <p>JetStream</p> <ul> <li>The scan for the last sourced message sequence when setting up a subject-filtered source is now considerably faster (<a href="https://redirect.github.com/nats-io/nats-server/issues/7553">#7553</a>)</li> <li>The metalayer will now stage and deduplicate recovery operations at startup, instead of rapidly applying and then undoing conflicting assignments (<a href="https://redirect.github.com/nats-io/nats-server/issues/7540">#7540</a>)</li> <li>Consumer interest checks on interest-based streams are now significantly faster when there are large gaps in interest (<a href="https://redirect.github.com/nats-io/nats-server/issues/7656">#7656</a>)</li> </ul> <p>MQTT</p> <ul> <li>Retained messages will now work correctly even when sourced from a different account and has a subject transform (<a href="https://redirect.github.com/nats-io/nats-server/issues/7636">#7636</a>)</li> </ul> <h3>Fixed</h3> <p>General</p> <ul> <li>WebSocket connections will now correctly limit the buffer size during decompression (<a href="https://redirect.github.com/nats-io/nats-server/issues/7625">#7625</a>, thanks to Pavel Kokout at Aisle Research)</li> </ul> <p>JetStream</p> <ul> <li>A protocol error caused by an invalid transform of acknowledgement reply subjects when originating from a gateway connection has been fixed (<a href="https://redirect.github.com/nats-io/nats-server/issues/7579">#7579</a>)</li> <li>The meta layer will now only respond to peer remove requests after quorum has been reached (<a href="https://redirect.github.com/nats-io/nats-server/issues/7581">#7581</a>)</li> <li>Invalid subject filters containing non-terminating full wildcard no longer produce unexpected matches (<a href="https://redirect.github.com/nats-io/nats-server/issues/7585">#7585</a>)</li> <li>A data race when creating a stream in clustered mode has been fixed (<a href="https://redirect.github.com/nats-io/nats-server/issues/7586">#7586</a>)</li> <li>Raft will no longer allow multiple membership changes to take place concurrently (<a href="https://redirect.github.com/nats-io/nats-server/issues/7565">#7565</a>, <a href="https://redirect.github.com/nats-io/nats-server/issues/7609">#7609</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nats-io/nats-server/commit/450a519adf9c53e3d86623bb423dcad5e658ae78"><code>450a519</code></a> Release v2.12.3</li> <li><a href="https://github.com/nats-io/nats-server/commit/8670ba0073be3e12300a31e0f877dd432ef4c70c"><code>8670ba0</code></a> Release v2.12.3-RC.5</li> <li><a href="https://github.com/nats-io/nats-server/commit/08bb9ee8fa0a8b6a5527ef904f887835ff8773e9"><code>08bb9ee</code></a> Cherry-picks for 2.12.3-RC.5 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7657">#7657</a>)</li> <li><a href="https://github.com/nats-io/nats-server/commit/7bd48a2f3ccbfc026bbd301e965bc0d675eedf79"><code>7bd48a2</code></a> [IMPROVED] Consumer interest check with large gap</li> <li><a href="https://github.com/nats-io/nats-server/commit/9be1774b16df2e099a1f0ff050c78d11eadeae99"><code>9be1774</code></a> [FIXED] Filestore desync during stream snapshot</li> <li><a href="https://github.com/nats-io/nats-server/commit/97f0c1a8bc74e50decc92901087c7ec1331349ff"><code>97f0c1a</code></a> Release v2.12.3-RC.4</li> <li><a href="https://github.com/nats-io/nats-server/commit/036a3fda5bdcc4026af69bfaeee13a8c9eb02936"><code>036a3fd</code></a> Cherry-picks for 2.12.3-RC.4 (<a href="https://redirect.github.com/nats-io/nats-server/issues/7652">#7652</a>)</li> <li><a href="https://github.com/nats-io/nats-server/commit/6d739faa5c78751b2cfbb4218cf55fb67f792430"><code>6d739fa</code></a> NRG: Removed leader may reappear in membership</li> <li><a href="https://github.com/nats-io/nats-server/commit/d2e57bf2e8df37cbb354141ca21cc6a7362576e2"><code>d2e57bf</code></a> [FIXED] mb.compact updates last seq/ts</li> <li><a href="https://github.com/nats-io/nats-server/commit/8e732b2dafd27a4be7d615d928cb7ffec417e337"><code>8e732b2</code></a> [FIXED] Filestore idx mismatch & 'no idx present' errors</li> <li>Additional commits viewable in <a href="https://github.com/nats-io/nats-server/compare/v2.12.1...v2.12.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ian Littman <iansltx@gmail.com> |
||
|
Josh Roskos
|
6769d8dd3a |
Bump shogo82148/rdsmysql/v2 v2.4.0 to v2.5.0 (#40103)
https://github.com/shogo82148/rdsmysql/pull/222 Adds AWS GovCloud RDS CA certificates (us-gov-east-1, us-gov-west-1) to the rdsmysql TLS bundle, improving compatibility for Fleet deployments in AWS GovCloud regions. Transitive dependency updates pulled in by rdsmysql v2.5.0: - github.com/aws/aws-sdk-go-v2 and related submodules (minor bumps) - github.com/go-sql-driver/mysql v1.9.1 -> v1.9.3 - filippo.io/edwards25519 v1.1.0 -> v1.1.1 <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves https://github.com/fleetdm/fleet/issues/40148 ## Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] QA'd all new/changed functionality manually — dependency bump only; ran full local test suite across all affected packages (`server/platform/mysql`, `server/logging`, `server/config`, `server/mail`) with no regressions. `go mod verify` passed. |
||
|
dependabot[bot]
|
2c5733a374 |
Bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#40113)
Bumps [filippo.io/edwards25519](https://github.com/FiloSottile/edwards25519) from 1.1.0 to 1.1.1. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/FiloSottile/edwards25519/commit/d1c650afb95fad0742b98d95f2eb2cf031393abb"><code>d1c650a</code></a> extra: initialize receiver in MultiScalarMult</li> <li>See full diff in <a href="https://github.com/FiloSottile/edwards25519/compare/v1.1.0...v1.1.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Lucas Manuel Rodriguez
|
e9f9d5a7d5 |
Remove github.com/apex/log dependency only used in a tool (#39822)
Realized this when developing in VSCode and typing `log.` then it auto-imported that apex/log thing, which seems we only use in a tool. |
||
|
Lucas Manuel Rodriguez
|
1085d66f6f |
Update macadmins/osquery-extensions to v1.3.2 (#39691)
Resolves #39642. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] QA'd all new/changed functionality manually ```sh fleetd 1.51.1: osquery> .schema munki_installs CREATE TABLE munki_installs(`installed_version` TEXT, `installed` TEXT, `name` TEXT, `end_time` TEXT, `display_name` TEXT); Using this branch: osquery> .schema munki_installs CREATE TABLE munki_installs(`installed_version` TEXT, `version_to_install` TEXT, `installed` TEXT, `name` TEXT, `end_time` TEXT, `display_name` TEXT); ``` ## fleetd/orbit/Fleet Desktop - [X] Verified that fleetd runs on macOS - [X] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
dependabot[bot]
|
c1e3e89b5f |
Bump github.com/go-git/go-git/v5 from 5.13.0 to 5.16.5 (#39590)
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.13.0 to 5.16.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.16.5</h2> <h2>What's Changed</h2> <ul> <li>build: Update module golang.org/x/crypto to v0.45.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/1744">go-git/go-git#1744</a></li> <li>build: Bump Go test versions to 1.23-1.25 (v5) by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1746">go-git/go-git#1746</a></li> <li>[v5] git: worktree, Don't delete local untracked files when resetting worktree by <a href="https://github.com/Ch00k"><code>@Ch00k</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1800">go-git/go-git#1800</a></li> <li>Expand packfile checks by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1836">go-git/go-git#1836</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.16.4...v5.16.5">https://github.com/go-git/go-git/compare/v5.16.4...v5.16.5</a></p> <h2>v5.16.4</h2> <h2>What's Changed</h2> <ul> <li>backport plumbing: format/idxfile, prevent panic by <a href="https://github.com/swills"><code>@swills</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1732">go-git/go-git#1732</a></li> <li>[backport] build: test, Fix build on Windows. by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1734">go-git/go-git#1734</a></li> <li>build: Update module golang.org/x/net to v0.38.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/1742">go-git/go-git#1742</a></li> <li>build: Update module github.com/cloudflare/circl to v1.6.1 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/1741">go-git/go-git#1741</a></li> <li>build: Update module github.com/go-git/go-git/v5 to v5.13.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/1743">go-git/go-git#1743</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.16.3...v5.16.4">https://github.com/go-git/go-git/compare/v5.16.3...v5.16.4</a></p> <h2>v5.16.3</h2> <h2>What's Changed</h2> <ul> <li>internal: Expand regex to fix build [5.x] by <a href="https://github.com/baloo"><code>@baloo</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1644">go-git/go-git#1644</a></li> <li>build: raise timeouts for windows CI tests and disable CIFuzz [5.x] by <a href="https://github.com/baloo"><code>@baloo</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1646">go-git/go-git#1646</a></li> <li>plumbing: support commits extra headers, support jujutsu signed commit [5.x] by <a href="https://github.com/baloo"><code>@baloo</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1633">go-git/go-git#1633</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.16.2...v5.16.3">https://github.com/go-git/go-git/compare/v5.16.2...v5.16.3</a></p> <h2>v5.16.2</h2> <h2>What's Changed</h2> <ul> <li>utils: fix diff so subpaths work for sparse checkouts, fixes 1455 to releases/v5.x by <a href="https://github.com/kane8n"><code>@kane8n</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1567">go-git/go-git#1567</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.16.1...v5.16.2">https://github.com/go-git/go-git/compare/v5.16.1...v5.16.2</a></p> <h2>v5.16.1</h2> <h2>What's Changed</h2> <ul> <li>utils: merkletrie, Fix diff on sparse-checkout index. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/1406">#1406</a> to releases/v5.x by <a href="https://github.com/kane8n"><code>@kane8n</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1561">go-git/go-git#1561</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/kane8n"><code>@kane8n</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/1561">go-git/go-git#1561</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.16.0...v5.16.1">https://github.com/go-git/go-git/compare/v5.16.0...v5.16.1</a></p> <h2>v5.16.0</h2> <h2>What's Changed</h2> <ul> <li>[v5] plumbing: support mTLS for HTTPS protocol by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1510">go-git/go-git#1510</a></li> <li>v5: plumbing: transport, Reintroduce SetHostKeyCallback. Fix <a href="https://redirect.github.com/go-git/go-git/issues/1514">#1514</a> by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1515">go-git/go-git#1515</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/48a1ae05eec4fff4dd0343744a00bf8d6a7a0b4b"><code>48a1ae0</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1836">#1836</a> from go-git/check-v5</li> <li><a href="https://github.com/go-git/go-git/commit/42bdf1f9044e2145acaed6ac4dbf1b8d257da5bd"><code>42bdf1f</code></a> storage: filesystem, Verify idx matches pack file</li> <li><a href="https://github.com/go-git/go-git/commit/4146a5653f186f90057afecb7e0addd9e623cf19"><code>4146a56</code></a> plumbing: format/idxfile, Verify idxfile's checksum</li> <li><a href="https://github.com/go-git/go-git/commit/63d78ec080cb176f8cd7bf46ce14f4ba01c1d2e5"><code>63d78ec</code></a> plumbing: format/packfile, Add new ErrMalformedPackFile</li> <li><a href="https://github.com/go-git/go-git/commit/25f1624754395a0c67839e71b34956c853f2eb3d"><code>25f1624</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1800">#1800</a> from Ch00k/no-delete-untracked-v5</li> <li><a href="https://github.com/go-git/go-git/commit/600fb139079e3c6886fcfeb20021c707e99e29b4"><code>600fb13</code></a> git: worktree, Don't delete local untracked files when resetting worktree</li> <li><a href="https://github.com/go-git/go-git/commit/390a56941510fdc19276aa298228d61889aad97a"><code>390a569</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1746">#1746</a> from pjbgf/bump-go</li> <li><a href="https://github.com/go-git/go-git/commit/61c8b859ce3366257354695e99d78fc3739b60fb"><code>61c8b85</code></a> build: Bump Go test versions to 1.23-1.25 (v5)</li> <li><a href="https://github.com/go-git/go-git/commit/e5a05ecd4fb91dc5323ec77667346ae94d84c043"><code>e5a05ec</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1744">#1744</a> from go-git/renovate/releases/v5.x-go-golang.org-x-c...</li> <li><a href="https://github.com/go-git/go-git/commit/1495930b098b5e72394ae8ccc2d9396b8aa7e013"><code>1495930</code></a> plumbing: Remove use of non-constant format strings</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.13.0...v5.16.5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Ian Littman
|
d4906dd3d6 |
Update to Go 1.25.7 (#39584)
- [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. |
||
|
Victor Lyuboslavsky
|
a10f05486f |
Added OTEL log export support (#39279)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #38607 Contributor docs update: https://github.com/fleetdm/fleet/pull/39285/changes Another contributor docs update: https://github.com/fleetdm/fleet/pull/39402/changes Also: - renamed OtelHandler to OtelTracingHandler - made "opentelemetry" be the default when tracing is enabled - updated OTEL dependencies # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [x] Setting(s) is/are explicitly excluded from GitOps <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added OpenTelemetry log export capability, enabling logs to be sent to OpenTelemetry collectors. * New configuration option `logging.otel_logs_enabled` (requires tracing to be enabled). * **Chores** * Updated OpenTelemetry dependencies to v1.40.0 with latest OTLP exporters and logging support. * Updated dependencies including gRPC (v1.78.0), Google libraries, and cryptography packages. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
7c9713d08f |
Fix panic in gRPC launcher API handler (#39409)
- [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] QA'd all new/changed functionality manually |
||
|
Zach Wasserman
|
3a0b72a329 |
Add gzip support to API handlers (#38675)
**Related issue:** Resolves #37944 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [x] Setting(s) is/are explicitly excluded from GitOps (it's a server configuration) |
||
|
Ian Littman
|
ec06952245 | Bump Alpine (to 3.23.3), Go (to 1.25.6) to resolve vulns (#38973) | ||
|
Victor Lyuboslavsky
|
07949df530 |
Improved OpenTelemetry error handling (#38757)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #38756 - Changed to NOT mark many client errors as exceptions - Instead, added client_error and server_error metrics that can be used to alert on unusual error rates # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added separate metrics for distinguishing between client and server errors, enhancing observability and monitoring capabilities. * **Bug Fixes** * Client request errors no longer incorrectly appear in error tracking as exceptions; improved accuracy of error reporting to external services. * Adjusted logging levels for authentication and enrollment operations to provide clearer diagnostics. <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Scott Gress
|
393531b624 |
Implement trusted proxies config (#38471)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Details Adds a new `FLEET_SERVER_TRUSTED_PROXIES` config, allowing more fine-grained control over how the client IP is determined for requests. Uses the [realclientip-go](https://github.com/realclientip/realclientip-go) library as the engine for parsing headers and using rules to determine the IP. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Introduced FLEET_SERVER_TRUSTED_PROXIES configuration option to specify trusted proxy IPs and hosts. The server now supports flexible client IP detection strategies that respect your proxy configuration, with support for multiple formats including single IP header names, hop counts, and IP address ranges, adapting to various infrastructure setups and deployment scenarios. <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordan Montgomery
|
e225ef5791 |
Improve Microsoft endpoint validation (#38180)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #13698 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually |
||
|
Nico
|
116c8ddb4f |
Remove valyala/fastjson and valyala/fasttemplate dependencies (#37914)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Context: https://fleetdm.slack.com/archives/C019WG4GH0A/p1767713469571139 Replaced `valyala` dependencies and now relying on `json.Unmarshal` and manual traversal of `Template` subjects, such as [this one](https://github.com/fleetdm/fleet/blob/main/server/logging/nats_test.go#L113) # Checklist for submitter ## Testing - [x] ~~Added/updated automated tests~~ I'm relying on existing tests on `nats_test.go` which already cover using a `Template` subject, namely: https://github.com/fleetdm/fleet/blob/main/server/logging/nats_test.go#L112-L132 https://github.com/fleetdm/fleet/blob/main/server/logging/nats_test.go#L194-L245 https://github.com/fleetdm/fleet/blob/main/server/logging/nats_test.go#L301-L356 - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually Ran `nats-server`, subscribed to all subjects by running `nats --server=nats://localhost:4222 subscribe ">"` and got logs from this query: <img width="675" height="411" alt="Screenshot 2026-01-06 at 4 12 52 PM" src="https://github.com/user-attachments/assets/e4e6e5d0-53ac-4b09-9810-b6032794d5f3" /> <img width="773" height="165" alt="Screenshot 2026-01-06 at 4 11 16 PM" src="https://github.com/user-attachments/assets/6f58d1f1-272b-40b3-96f5-1659c0bbb918" /> <img width="2541" height="119" alt="Screenshot 2026-01-06 at 4 11 06 PM" src="https://github.com/user-attachments/assets/2e61acac-063c-4cdd-aeee-871031600125" /> |
||
|
|
b6d19de0d9 |
Add support for publishing logs to NATS. (#36527)
**Related issue:** Resolves [34890](https://github.com/fleetdm/fleet/issues/34890) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually ## New Fleet configuration settings Looking at other log destinations, I couldn't find anything relevant in GitOps. Please let me know if I missed something, however. ## fleetd/orbit/Fleet Desktop I've tested this on both Linux and MacOS. --------- Co-authored-by: Rachael Shaw <r@rachael.wtf> Co-authored-by: nulmete <nicoulmete1@gmail.com> |
||
|
Lucas Manuel Rodriguez
|
e68a129eb9 |
Fix build warning (#37257)
Fixing the following warning: ``` $ make fleet [...] # github.com/shoenig/go-m1cpu ../../gopath/pkg/mod/github.com/shoenig/go-m1cpu@v0.1.6/cpu.go:75:17: warning: variable length array folded to constant array as an extension [-Wgnu-folding-constant] ../../gopath/pkg/mod/github.com/shoenig/go-m1cpu@v0.1.6/cpu.go:77:16: warning: variable length array folded to constant array as an extension [-Wgnu-folding-constant] ``` PS: This warning happens when building fleet because we need to decouple the client code from `server/service`... (hopefully to be done as part of https://github.com/fleetdm/fleet/issues/36087) |
||
|
Ian Littman
|
62755cbd82 |
Bump Go to 1.25.5, Alpine to 3.23.0 where relevant, bump Trivy to current version (#36848)
Fixes vulns reported in https://github.com/fleetdm/fleet/actions/runs/19999992703. We'll definitely want to at least cherry-pick this. |
||
|
Victor Lyuboslavsky
|
61c51672e4 |
Bootstrapping Android app (#36233)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #36202 Updated how Android agent starts. See README updates. # Checklist for submitter ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Periodic configuration check scheduled every 15 minutes in the Android agent * Improved Android management notification handling and app-role support * **Documentation** * Updated Android MDM deployment guide with SHA256 fingerprint instructions and build configuration snippets * **Chores** * Added WorkManager and AMAPI SDK for Android; updated Android/Go tooling and library versions * **Tests** * Added unit test coverage for the periodic config worker <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
dependabot[bot]
|
0cbf0d532a |
Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#36040)
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.41.0 to 0.45.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/crypto/commit/4e0068c0098be10d7025c99ab7c50ce454c1f0f9"><code>4e0068c</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/e79546e28b85ea53dd37afe1c4102746ef553b9c"><code>e79546e</code></a> ssh: curb GSSAPI DoS risk by limiting number of specified OIDs</li> <li><a href="https://github.com/golang/crypto/commit/f91f7a7c31bf90b39c1de895ad116a2bacc88748"><code>f91f7a7</code></a> ssh/agent: prevent panic on malformed constraint</li> <li><a href="https://github.com/golang/crypto/commit/2df4153a0311bdfea44376e0eb6ef2faefb0275b"><code>2df4153</code></a> acme/autocert: let automatic renewal work with short lifetime certs</li> <li><a href="https://github.com/golang/crypto/commit/bcf6a849efcf4702fa5172cb0998b46c3da1e989"><code>bcf6a84</code></a> acme: pass context to request</li> <li><a href="https://github.com/golang/crypto/commit/b4f2b62076abeee4e43fb59544dac565715fbf1e"><code>b4f2b62</code></a> ssh: fix error message on unsupported cipher</li> <li><a href="https://github.com/golang/crypto/commit/79ec3a51fcc7fbd2691d56155d578225ccc542e2"><code>79ec3a5</code></a> ssh: allow to bind to a hostname in remote forwarding</li> <li><a href="https://github.com/golang/crypto/commit/122a78f140d9d3303ed3261bc374bbbca149140f"><code>122a78f</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/c0531f9c34514ad5c5551e2d6ce569ca673a8afd"><code>c0531f9</code></a> all: eliminate vet diagnostics</li> <li><a href="https://github.com/golang/crypto/commit/0997000b45e3a40598272081bcad03ffd21b8adb"><code>0997000</code></a> all: fix some comments</li> <li>Additional commits viewable in <a href="https://github.com/golang/crypto/compare/v0.41.0...v0.45.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
27e6c21a88 | Bump github.com/opencontainers/selinux from 1.11.0 to 1.13.0 (#35381) | ||
|
dependabot[bot]
|
e2f527adaf |
Bump github.com/containerd/containerd from 1.7.27 to 1.7.29 (#35274)
Bumps [github.com/containerd/containerd](https://github.com/containerd/containerd) from 1.7.27 to 1.7.29. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/containerd/containerd/releases">github.com/containerd/containerd's releases</a>.</em></p> <blockquote> <h2>containerd 1.7.29</h2> <p>Welcome to the v1.7.29 release of containerd!</p> <p>The twenty-ninth patch release for containerd 1.7 contains various fixes and updates including security patches.</p> <h3>Security Updates</h3> <ul> <li> <p><strong>containerd</strong></p> <ul> <li><a href="https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w"><strong>GHSA-pwhc-rpq9-4c8w</strong></a></li> <li><a href="https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2"><strong>GHSA-m6hq-p25p-ffr2</strong></a></li> </ul> </li> <li> <p><strong>runc</strong></p> <ul> <li><a href="https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r"><strong>GHSA-qw9x-cqr3-wc7r</strong></a></li> <li><a href="https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm"><strong>GHSA-cgrx-mc8f-2prm</strong></a></li> <li><a href="https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2"><strong>GHSA-9493-h29p-rfm2</strong></a></li> </ul> </li> </ul> <h3>Highlights</h3> <h4>Image Distribution</h4> <ul> <li><strong>Update differ to handle zstd media types</strong> (<a href="https://redirect.github.com/containerd/containerd/pull/12018">#12018</a>)</li> </ul> <h4>Runtime</h4> <ul> <li><strong>Update runc binary to v1.3.3</strong> (<a href="https://redirect.github.com/containerd/containerd/pull/12480">#12480</a>)</li> <li><strong>Fix lost container logs from quickly closing io</strong> (<a href="https://redirect.github.com/containerd/containerd/pull/12375">#12375</a>)</li> </ul> <p>Please try out the release binaries and report any issues at <a href="https://github.com/containerd/containerd/issues">https://github.com/containerd/containerd/issues</a>.</p> <h3>Contributors</h3> <ul> <li>Derek McGowan</li> <li>Akihiro Suda</li> <li>Phil Estes</li> <li>Austin Vazquez</li> <li>Sebastiaan van Stijn</li> <li>ningmingxiao</li> <li>Maksym Pavlenko</li> <li>StepSecurity Bot</li> <li>wheat2018</li> </ul> <h3>Changes</h3> <!-- raw HTML omitted --> <ul> <li><a href="https://github.com/containerd/containerd/commit/442cb34bda9a6a0fed82a2ca7cade05c5c749582"><code>442cb34bd</code></a> Merge commit from fork</li> <li><a href="https://github.com/containerd/containerd/commit/0450f046e6942e513d0ebf1ef5c2aff13daa187f"><code>0450f046e</code></a> Fix directory permissions</li> <li><a href="https://github.com/containerd/containerd/commit/e5cb6ddb7a7730c24253a94d7fdb6bbe13dba6f7"><code>e5cb6ddb7</code></a> Merge commit from fork</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/containerd/containerd/commit/442cb34bda9a6a0fed82a2ca7cade05c5c749582"><code>442cb34</code></a> Merge commit from fork</li> <li><a href="https://github.com/containerd/containerd/commit/e5cb6ddb7a7730c24253a94d7fdb6bbe13dba6f7"><code>e5cb6dd</code></a> Merge commit from fork</li> <li><a href="https://github.com/containerd/containerd/commit/9772966401ad3c33a6cd824632f0c61e5049f3a5"><code>9772966</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/12486">#12486</a> from dmcgowan/prepare-v1.7.29</li> <li><a href="https://github.com/containerd/containerd/commit/1fc2daaf3ed53f4c9e76fbc5786a6f1ae3bb885f"><code>1fc2daa</code></a> Prepare release notes for v1.7.29</li> <li><a href="https://github.com/containerd/containerd/commit/93f710a528958474f95a95e54516624ef832d80f"><code>93f710a</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/12480">#12480</a> from k8s-infra-cherrypick-robot/cherry-pick-12475-t...</li> <li><a href="https://github.com/containerd/containerd/commit/68d04befab3284f1dfe2a9f5691ea5da76daace7"><code>68d04be</code></a> Merge pull request <a href="https://redirect.github.com/containerd/containerd/issues/12471">#12471</a> from austinvazquez/1_7_update_ci_go_and_images</li> <li><a href="https://github.com/containerd/containerd/commit/3f5f9f872707a743563d316e85e530193a2e30ac"><code>3f5f9f8</code></a> runc: Update runc binary to v1.3.3</li> <li><a href="https://github.com/containerd/containerd/commit/667409fb63098cb80280940ab06038114e7712da"><code>667409f</code></a> ci: bump Go 1.24.9, 1.25.3</li> <li><a href="https://github.com/containerd/containerd/commit/294f8c027b607c4450b3e52f44280581a737a73f"><code>294f8c0</code></a> Update GHA runners to use latest images for basic binaries build</li> <li><a href="https://github.com/containerd/containerd/commit/cf66b4141defb757dee0fc5653bfd0a7ba1e8fed"><code>cf66b41</code></a> Update GHA runners to use latest image for most jobs</li> <li>Additional commits viewable in <a href="https://github.com/containerd/containerd/compare/v1.7.27...v1.7.29">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Ian Littman
|
a910347683 |
Bump macadmins extension to v1.2.7, map crowdstrike_falcon table (#34553)
Fixes #33967, #33193, #35149. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [ ] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux (skipped WIndows due to runtime.GOOS gating) - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
Victor Lyuboslavsky
|
072ee68eda | Updating to Go 1.25.3 (#35082) | ||
|
Jahziel Villasana-EspinozaandRachelElysia
|
0a3c6c35d3 |
Android software ingestion (#33826)
> Closes #33581 <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked table schema to confirm autoupdate - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). --------- Co-authored-by: RachelElysia <rachel@fleetdm.com> |
||
|
Magnus Jensen
|
61347155b5 |
Error on signed configuration profiles (#33341)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #26688 I'm not sure if the IsSignedProfile check is too aggressive and can potentially shadow other problems with the file? # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Media: Gitops <img width="575" height="189" alt="Screenshot 2025-09-23 at 11 48 19" src="https://github.com/user-attachments/assets/1e7c950e-2543-4c9a-b6f0-8b546a30eb1f" /> API <img width="1318" height="169" alt="Screenshot 2025-09-23 at 12 04 22" src="https://github.com/user-attachments/assets/fc8f9171-fab9-46be-befa-dc6af82d2f7b" /> Frontend <img width="779" height="89" alt="Screenshot 2025-09-23 at 12 01 59" src="https://github.com/user-attachments/assets/78dcaf56-d344-4499-bdfa-1abb97b29b15" /> |
||
|
Victor Lyuboslavsky
|
e872f9a984 |
Update golangci-lint to v2.4.0 (#33251)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #33250 Waived most new failures. Planning to come back and fix some of them in subsequent PRs. |
||
|
Luke Heath
|
a9bf8342d2 |
Update github.com/ulikunitz/xz to v0.5.15 (#33221)
Resolve https://github.com/fleetdm/fleet/security/code-scanning/1445. |
||
|
Lucas Manuel Rodriguez
|
134c74a94b |
Add initial Arch Linux support (#33096)
For #32859. We can ignore the "Dependency review" failure in [CVE-2023-32698](https://github.com/advisories/GHSA-w7jw-q4fg-qc4c) because we already have the rules to ignore it (we are not vulnerable). I'm not updating nfpm to latest because it would require further changes on all deb/rpm generation (source code breaking changes on the golang interfaces). --- <img width="448" height="151" alt="screenshot-2025-09-11_08-38-20" src="https://github.com/user-attachments/assets/4c00b960-568a-48d9-8098-308c8ab8916f" /> <img width="391" height="73" alt="screenshot-2025-09-11_08-37-40" src="https://github.com/user-attachments/assets/dec6ea22-31f8-4930-b067-0b04b4ec2b5f" /> <img width="759" height="428" alt="Image" src="https://github.com/user-attachments/assets/0a76d070-4709-4a35-8e6e-caf869473d28" /> <img width="1178" height="634" alt="Image" src="https://github.com/user-attachments/assets/98e6fa2a-ba07-4a55-81aa-ad747f1c57b9" /> <img width="1388" height="830" alt="Image" src="https://github.com/user-attachments/assets/19d36bad-d01d-4130-b271-38bea2534833" /> <img width="933" height="930" alt="Image" src="https://github.com/user-attachments/assets/1d6a369b-65d7-46a4-98a6-e6f0b29be2c8" /> <img width="2241" height="693" alt="Image" src="https://github.com/user-attachments/assets/d8f98e97-f027-4c1c-ae5d-c4fa3b592a20" /> - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [X] QA'd all new/changed functionality manually |
||
|
Victor Lyuboslavsky
|
abc912bd03 | Updated go to 1.25.1 (#32833) | ||
|
Jonathan RudenbergandScott Gress
|
48760fec58 |
Add support for reading private_key from AWS Secrets Manager (#31134)
Adds support for reading server `private_key` from AWS Secrets Manager. Combined with #31075, this should allow removing all common sensitive secrets from the environment/config (if I missed any let me know). This works with localstack for local development (set `AWS_ENDPOINT_URL=$LOCALSTACK_URL`, `AWS_ACCESS_KEY_ID=test`, and `AWS_SECRET_ACCESS_KEY=test`). I did not include config options for `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` because they are a bad practice vs role credentials and defeat the purpose of this feature which is to remove secrets from the environment/config. # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Added/updated automated tests - [x] Manual QA for all new/changed functionality --------- Co-authored-by: Scott Gress <scott@fleetdm.com> |