Quick doc that should help how DEP sync works (We also have the general
entry) and then how to reset, and a call out that it's okay to do even
for larger deployments.
Fixes#45763
The recent bump of github.com/Azure/go-ntlmssp to v0.1.1 changed the
Negotiator to send an unauthenticated probe before NTLM. NTLM is
connection-bound on IIS, and the extra round-trip breaks the handshake
on NDES setups behind reverse proxies, Okta Access, or a WAF.
Add Duo Desktop to maintained apps: create Homebrew and Winget input
entries, add apps.json catalog entries, and add outputs for macOS and
Windows with installer metadata (version 7.17.x), installer URLs,
checksums, install/uninstall script refs, and upgrade code. Also add
frontend icon component and PNG asset, and register the icon in the
icons index so the app shows up in the Software page.
I see no reason to use macOS for this job (given how unreliable and slow
macOS runners are).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* CI workflow runner switched to ubuntu-latest.
* Internal tooling updated to download and prepare the osqueryd binary
for macOS and Linux.
* macOS agent configuration expanded with additional options for
keychain access and file-monitoring behavior.
---
Note: No end-user visible features or breaking changes in this release.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45816?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What's the issue I'm trying to solve here?
1. So I have a PR (say branch name `pr-foobar`).
2. The PR will do a docker publish (say docker image with tag
`fleetdm/fleet:pr-foobar`).
3. Load test environment deployed with such docker image tag
(`fleetdm/fleet:pr-foobar`).
4. I go to My account > and see Fleet has version
`0.0.0-SNAPSHOT-<SOME-SHA>` (0.0.0-SNAPSHOT is expected because it's a
branch). Example in screenshot below.
5. I do `git fetch origin && git show <SOME-SHA>` to know exactly what's
deployed.
6. Turns out `<SOME-SHA>` is some SHA known to Github, but not in the
fleet's git repository.
Problem: I really want to tie what's running with an actual commit SHA.
And this PR solves that for these load tests that use branches.
<img width="298" height="809" alt="Screenshot 2026-05-19 at 12 57 05 PM"
src="https://github.com/user-attachments/assets/d46fa037-1de5-4cf0-b768-6ec9dbe33620"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated CI/CD workflow checkout behavior so pull-request-triggered
runs use the PR head commit, ensuring the correct code is checked out
and improving build/test reliability and snapshot accuracy.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45814?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This is an independent contribution made by an individual developer.
This work is not associated with any hackathon, competition, or
coordinated PR campaign.
## Summary
Fixes a typo in a comment in `server/mdm/nanomdm/mdm/command.go` where
"occured" should be "occurred" in the `ErrorChain` type documentation.
## Root Cause
The comment on line 14 of `command.go` describing the `ErrorChain` type
uses the misspelling "occured" instead of the correct spelling
"occurred".
## Fix
Changed "occured" to "occurred" in the type documentation comment.
## Changes
- `server/mdm/nanomdm/mdm/command.go`: 1 line changed (`+1 -1`)
## Testing
- The change modifies only a comment string; no functional behavior is
affected.
- `go build ./...` passes with no regressions.
- The `ErrorChain` type documentation now uses the correct spelling. ✅
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Fixed spelling in internal comments.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45871?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This is an independent contribution.
## Summary
Corrects a spelling error in a code comment in
`frontend/utilities/osquery_tables.ts`.
## Changes
- `frontend/utilities/osquery_tables.ts`: 1 character changed (`+1 -1`)
## Root Cause
The comment reads "Typecasting explicity here" — a misspelling of
"explicitly".
## Testing
- Comment-only change — no functional impact
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Corrected a spelling error in code comments for improved clarity.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45820?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request refactors how patch policy SQL queries are generated
and validated, with the main goal of simplifying and correcting the
construction of `NOT EXISTS` queries for version checks. The changes
ensure that the generated queries are more accurate, especially in cases
involving SQL `OR` conditions and platform-specific version columns. The
update also adapts related test cases to match the new query structure.
**Patch policy query generation improvements:**
* Refactored the SQL generation logic in `GenerateQueryForManifest` to
append the `version_compare` clause directly inside the original `WHERE`
clause, rather than wrapping the entire query in extra parentheses. This
results in simpler, more standard SQL queries.
* Added logic to detect `OR` conditions in the `WHERE` clause and wrap
them in parentheses to ensure correct SQL precedence when appending the
`AND version_compare(...)` clause.
* Improved selection of the version column (e.g.,
`bundle_short_version`, `version`, or `file_version`) based on platform
and table name, ensuring correct queries for both macOS and Windows
policies.
**Test updates:**
* Updated all relevant test cases in `patch_policy_test.go` to expect
the new, simplified query format, removing the extra parentheses and
validating correct handling of SQL with `OR` and platform-specific
columns.
[[1]](diffhunk://#diff-a770c8e2c3066123079c660322e318014a7c4870429e091a6e48d4acb222c340L23-R23)
[[2]](diffhunk://#diff-a770c8e2c3066123079c660322e318014a7c4870429e091a6e48d4acb222c340L32-R32)
[[3]](diffhunk://#diff-a770c8e2c3066123079c660322e318014a7c4870429e091a6e48d4acb222c340L41-R41)
[[4]](diffhunk://#diff-a770c8e2c3066123079c660322e318014a7c4870429e091a6e48d4acb222c340L50-R61)
* Adjusted a Homebrew ingester test to match the new query formatting,
ensuring consistency across the codebase.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45720
# Details
When requesting CVE chart data, we were making a call to get the set of
tracked CVEs to filter the data by. Currently we're only _collecting_
data for the tracked CVEs, so there's no reason to make this call at
all.
When we add more filtering options and start collecting more data, we'll
need a call like this again, and will likely need to start caching the
results. Otherwise it's a multi-second cost per query on large
deployments.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- removed some outdated tests
- replaced with a test that checks that when an entity filter returns no
items (an empty, rather than nil slice) we get empty buckets returned
rather than getting data for all entities. This is a regression test for
when we add filtering back.
- [X] QA'd all new/changed functionality manually
- validated that chart still loads and shows the same data.
- tried it on a load test env and saw dramatic API request time
improvement
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Optimized CVE chart data retrieval by eliminating redundant queries,
reducing unnecessary database operations and improving performance.
* Fixed entity ID filtering logic to correctly handle edge cases and
prevent unintended filter interactions across metrics.
* **Tests**
* Added test coverage for chart data queries with empty entity filters.
* Improved test isolation to ensure metric-specific filtering behavior
is properly separated.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45813?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- @noahtalerman: For the following story:
- https://github.com/fleetdm/fleet/issues/43557
## Summary
- Adds `bundle_identifier` as a top-level field on
`HostSoftwareWithInstaller` struct, which is the response type for all
host software API endpoints (`GET /api/v1/fleet/hosts/{id}/software`,
`GET /api/v1/fleet/device/{token}/software`, etc.)
- The value is sourced directly from `software_titles.bundle_identifier`
via the SQL query, so it is always present even when
`installed_versions` is empty (e.g., software that has never been
installed on a host)
- Falls back to `installed_versions[0].bundle_identifier` if the
title-level value is not available
- The field is retained inside `installed_versions` for full backwards
compatibility
## Changes
### `server/fleet/software_installer.go`
- Added `BundleIdentifier string` field with
`json:"bundle_identifier,omitempty" db:"-"` tag to
`HostSoftwareWithInstaller` struct
### `server/datastore/mysql/software.go`
- Added `TitleBundleIdentifier` field to internal `hostSoftware` struct
mapped to `title_bundle_identifier` DB column
- Added `software_titles.bundle_identifier AS title_bundle_identifier`
to all four SQL query branches:
- Software installers SELECT
- VPP apps SELECT
- In-house apps SELECT
- Available-for-install SELECT (`stmtAvailable`)
- Added `software_titles.bundle_identifier` to GROUP BY clauses for
software installers and VPP apps
- In the return path, populates `BundleIdentifier` from
`TitleBundleIdentifier` (with fallback to first installed version)
### `server/datastore/mysql/software_test.go`
- Added `BundleIdentifier` assertion to both `compareResults` helper
functions (macOS/Linux and iOS/iPadOS test suites)
- Added explicit top-level `BundleIdentifier` assertions in
`testListHostSoftwareWithVPPApps` where the installed version bundle
identifier is already verified
## Example response shape
```json
{
"id": 121,
"name": "Google Chrome.app",
"bundle_identifier": "com.google.Chrome",
"icon_url": null,
"software_package": { ... },
"app_store_app": null,
"source": "apps",
"status": "failed_install",
"installed_versions": [
{
"version": "121.0",
"bundle_identifier": "com.google.Chrome",
...
}
]
}
```
Built for
[ntalerman](https://fleetdm.slack.com/archives/D0AEA6U4SM9/p1774036621198819?thread_ts=1774035719.384099&cid=D0AEA6U4SM9)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Kilo Code <kilo@kilo.ai>
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Co-authored-by: jkatz01 <yehonatankatz@gmail.com>
**Related issue:** Resolves#42288
# Summary
This PR adds support for configuring an optional SES sender domain.
When the SES email backend is enabled, Fleet can now use a configured
sender domain for the `From` address instead of always deriving the
domain from `server.server_url`. If the setting is not provided, Fleet
keeps the existing behavior.
# Impact
This gives self-hosted operators a server-side SES configuration option
for email sending without changing UI-managed SMTP settings.
# Root cause
The SES sender path only generated `do-not-reply@<server host>` from the
Fleet server URL, so there was no way to override the sender domain
through server configuration.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Added/updated automated tests
- [x] Setting(s) is/are explicitly excluded from GitOps
## Testing
- [x] `go test -tags full,fts5,netgo ./server/mail -run
'Test_(getFromSES|sesSender_SendEmail)$'`
- [x] `go test -tags full,fts5,netgo ./server/config -run
'TestConfig(SESSenderDomain|Roundtrip)$'`
- [x] `go test -tags full,fts5,netgo ./server/service -run
'TestService_EmailConfig$'`
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added optional SES sender domain configuration. Users can specify a
custom domain for the email "From" address via config or environment
variable; when unset it falls back to the server hostname.
* **Tests**
* Added and expanded tests to verify sender-domain precedence,
From-header generation, and related error cases.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/43811?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Dan Gordon
