Resolves#50058 where links do not show the expected text in the table
description
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated disk space table documentation to improve cross-referenced
links for Windows logical drives and Linux mounts by adjusting Markdown
formatting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Fixes#47692
New macOS-only extension table returning outdated Homebrew packages
(formulae and casks) with installed and latest-available versions, for
querying out-of-date packages and driving patching policies. Runs `brew
outdated`/`brew info` as the console user; auto-update left on so
current_version stays accurate.
**Related issue:** Resolves
https://github.com/fleetdm/fleet/issues/46818 and
https://github.com/fleetdm/fleet/issues/48524.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Host lists and Host details now show human‑readable Apple hardware
marketing names (macOS, iOS, iPadOS) where available (e.g., "MacBook Pro
(16‑inch, 2021)"), replacing raw model identifiers.
* Hardware model displays fall back to the original model identifier for
non‑Apple or unmapped devices.
* **Bug Fixes / CSV**
* Exported host CSVs now align with the UI by using the marketing name
for Apple devices when available.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
osquery [5.23.1](https://github.com/osquery/osquery/releases/tag/5.23.1)
was released by osquery publicly today, this updates our schema with the
changes in it.
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated schema support for certificate `subject2` and `issuer2` fields
on Linux and macOS.
* Documentation generation and download tooling now target osquery
`5.23.1`.
* **Bug Fixes**
* Clarified the `process_open_handles` table behavior by removing
outdated default-process wording.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48006.
Adds a new field `socket_path` in both `containerd_containers` and
`containerd_mounts`. We keep the previous default when no `socket_path`
is requested in the filter; otherwise, we honor the value passed from
the incoming query.
Test case:
Ran a `make fleetd-tables-linux`, started some containers, then used
osquery:
<img width="2494" height="1408" alt="Screenshot from 2026-06-22
12-48-43"
src="https://github.com/user-attachments/assets/ed65d16c-8aa8-4fc7-890e-4f200752e6e2"
/>
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Added an optional `socket_path` column to `containerd_containers` and
`containerd_mounts`.
* Containerd queries can now target a specific socket path, and results
report the socket path used (defaulting to
`/run/containerd/containerd.sock` when not provided).
* **Documentation**
* Updated Fleet and table schemas with the new `socket_path` column and
example queries (including common k3s socket paths).
* **Tests**
* Added Linux-only coverage to verify default vs explicitly provided
`socket_path` behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Lucas Manuel Rodriguez <lucarodriguez@gmail.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46059
Added `daemon_reachable` and `error` columns to the `santa_status`
fleetd table so the table reports a row when the Santa daemon is
unreachable instead of silently returning zero rows.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Reproduced the issue:
<img width="1476" height="255" alt="Screenshot 2026-06-17 at 11 12
55 AM"
src="https://github.com/user-attachments/assets/bf7f20c2-9e77-499d-9962-0996f5c57cb1"
/>
<img width="1644" height="632" alt="Screenshot 2026-06-17 at 11 14
34 AM"
src="https://github.com/user-attachments/assets/57c790b6-ccf2-4446-90a4-164cdcbacadd"
/>
Pushed a new orbit version with the fix to the TUF server:
<img width="689" height="58" alt="Screenshot 2026-06-17 at 11 34 25 AM"
src="https://github.com/user-attachments/assets/77b70d51-856f-4957-869e-1458540154dd"
/>
Ran the query again: we now return one row instead of no rows, and
`daemon_reachable = 0` is returned. Rest of the values are null.
<img width="2542" height="545" alt="Screenshot 2026-06-17 at 11 36
37 AM"
src="https://github.com/user-attachments/assets/6d71167e-9711-4284-9142-48629edbd9be"
/>
Approved the system extension and granted full disk access:
<img width="791" height="664" alt="Screenshot 2026-06-17 at 11 38 39 AM"
src="https://github.com/user-attachments/assets/3f4f91b0-d20a-4afc-93f9-347efe823beb"
/>
<img width="733" height="643" alt="Screenshot 2026-06-17 at 11 39 20 AM"
src="https://github.com/user-attachments/assets/596d3fb8-7b0e-4532-94d6-f5c28802f343"
/>\
Verified the state changed from `[activated waiting for user]` to
`[activated enabled]` and `santactl status` did not return errors:
<img width="1429" height="708" alt="Screenshot 2026-06-17 at 11 40
02 AM"
src="https://github.com/user-attachments/assets/f9402808-0755-478c-9c95-78aa2e5c65f4"
/>
Ran queries again and verified `daemon_reachable = 1`
<img width="2525" height="548" alt="Screenshot 2026-06-17 at 11 41
33 AM"
src="https://github.com/user-attachments/assets/bf65ec55-c719-48e1-9a29-4b38aa52a882"
/>
<img width="1656" height="528" alt="Screenshot 2026-06-17 at 11 42
34 AM"
src="https://github.com/user-attachments/assets/42b51b5b-9123-4919-beeb-b847a0a99668"
/>
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added `daemon_reachable` to Santa status monitoring to clearly
indicate reachability (`1` reachable, `0` unreachable).
* Added an `error` column to expose the `santactl status` error when the
daemon is not reachable.
* **Bug Fixes**
* Updated Santa status behavior so daemon communication failures now
return exactly one row with `daemon_reachable = 0` (and `error`
populated) instead of returning no rows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
https://github.com/osquery/osquery/releases/tag/5.23.0
PS: I see that the `yara` table was dropped in 5.23.0 in favor of
`yara_file` and `yara_process`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added three new osquery query tables: `process_open_handles`
(Windows), `secureboot_certificates` (Linux), and `yara_events` for
expanded system visibility.
* Added new columns across existing tables to enhance data collection
capabilities.
* **Updates**
* Upgraded osquery to version 5.23.0.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#44202.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [X] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [X] Verified that fleetd runs on macOS, Linux and Windows
- [X] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added network quality table for macOS to monitor download and upload
speeds with results formatted in both kilobits and megabits per second
(requires macOS 12+)
* **Chores**
* Updated MacAdmins osquery extension dependency to v1.4.1
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#40138
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Installed:
```
go install golang.org/x/tools/cmd/goimports@latest
go install golang.org/x/tools/gopls@latest
go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
```
Validated:
```
osquery> SELECT * FROM go_packages;
+---------------+---------+-----------------------------------+-----------------------------------------------------+------------+----------------------------------+
| name | version | module_path | import_path | go_version | installed_path |
+---------------+---------+-----------------------------------+-----------------------------------------------------+------------+----------------------------------+
| goimports | v0.42.0 | golang.org/x/tools | golang.org/x/tools/cmd/goimports | go1.25.5 | /Users/josh/go/bin/goimports |
| golangci-lint | v1.64.8 | github.com/golangci/golangci-lint | github.com/golangci/golangci-lint/cmd/golangci-lint | go1.25.5 | /Users/josh/go/bin/golangci-lint |
| gopls | v0.21.1 | golang.org/x/tools/gopls | golang.org/x/tools/gopls | go1.25.5 | /Users/josh/go/bin/gopls |
+---------------+---------+-----------------------------------+-----------------------------------------------------+------------+----------------------------------+
```
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
---------
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#40630
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows (macOS only)
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
(should not affect updates)
Added a note that mcp_listening_tables may raise flags in EDR tools due
to unusual network activity.
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38393
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows (Linux only)
---------
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Added example SQL query to discover last connected times for WiFi
networks highlighting new columns.
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#35762
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] QA'd all new/changed functionality manually
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
Closes: https://github.com/fleetdm/fleet/issues/36620
Changes:
- Updated the website to use the osquery 5.20.0 schema when generating
osquery table documentation pages and osquery_fleet_schema.json
- Regenerated osquery_fleet_schema.json
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#35548
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually (QAed on macOS)
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] Verified that fleetd runs on macOS, Linux and Windows (Not
manually checked, but this change should not impact it)
For #33193. No changes file as this is just documentation for the table
shipping in fleetd 1.50, which has a changes file of its own.
## Testing
- [x] QA'd all new/changed functionality manually
- @noahtalerman: We decided to cut the `santa_rules` table and tweak
descriptions: https://github.com/fleetdm/fleet/pull/33825
- Looks like these doc changes got added back to `main` by accident
**Related issue:** Resolves#34330
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually (so far just macOS)
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] Verified that fleetd runs on macOS, Linux and Windows
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a built-in mcp_listening_servers table to discover MCP servers
by inspecting listening ports and probing endpoints; returns process
info, server metadata, capabilities, tools, prompts, and resources
(supports macOS, Windows, Linux).
* **Tests**
* Added comprehensive unit tests covering detection, IPv6 handling, SSE
responses, and session lifecycle.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Updated examples in system_profiler table to reflect correct JSON
extraction paths and added new example for collecting audio devices.
Enhanced the table description for clarity.
Added reference to FDA requirement along with links to enable FDA and a
pre-created mobileconfig per discussion in product office hours
(9/16/25). ~Josh 🖖🏻
The example queries that we provide for the `chrome_extensions` and
`firefox_addons` table produce a syntax error because they use CROSS
JOIN instead of INNER JOIN.
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
