Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 6 Packages Projects Releases Wiki Activity
26,040 Commits 2 Branches 0 Tags
9f8caea025317e8a26b64e68698ebfffc8cceecd
Commit Graph
26040 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Rahul Raghunathan 9f8caea025 Fix tables losing row selection on window focus (#48742) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48542

## Description

The `QueryClient` was created with `new QueryClient()` and no default
options, so every query inherited React Query's default
`refetchOnWindowFocus: true`. On pages like `/policies` and `/users`,
queries are refetched every time the browser window regains focus. Those
focus refetches re-rendered the table with fresh data, tripping
react-table's `autoResetSelectedRows` and `autoResetPage` (both default
`true`), so the table appeared to "reload," clearing the user's row
selection and jumping back to the first page when they clicked away and
back.


## Screen recording demonstrating the fix


https://github.com/user-attachments/assets/eabf30a5-65d3-420d-a8d3-5a529fa06089


# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Prevented users and policies tables from unexpectedly reloading when
switching back to the browser window.
* Preserved table state such as selected rows and current pagination
instead of resetting to the first page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-13 13:10:33 -03:00
Eric 53ecfe030d Website: remove script tag in header (#49207) 
Changes:
- Removed an analytics script tag from the website's header

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
  * Removed the Snitcher verification and tracking integration.
* Updated analytics-related labeling to reflect the revised tracking
setup.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-13 10:34:50 -05:00
Noah Talerman b535023fb6 Custom Android apps guide (#49206) 
- Google is removing support for `.apk` packages and moving everyone to
`.aab`:
https://www.androidenterprise.dev/s/article/Private-App-Hosting-APK-Changes
 2026-07-13 17:31:51 +02:00
Marko Lisica fb3932f37a Update CustomLink styles (#48838) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #35328

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved link hover and `:focus-visible` underline/outline behavior
for more consistent accessibility across tables, buttons, and modals.
  * Fixed script name hover underline clipping in the run script modal.
* **Style**
* Refreshed `CustomLink` styling with an emphasized variant and improved
underline behavior, plus updated related link/table/button styling for a
unified look.
* Updated “Connect Fleet” info-banner messaging and CTAs for calendar
and conditional access automations; refreshed “No scripts available”
empty state.
* **Tests**
  * Updated modal tests to match revised link text and accessible names.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-13 17:07:39 +02:00
Allen Houchins 7ac8c659e0 Add Windows FMAs (letter E): 13 apps (#49186) 
**Related issue:** N/A — part of the Windows Fleet-maintained apps
catalog expansion (letter E batch; follows #48872, #48881, #48950,
#48969, #49086).

Adds eleven new Windows Fleet-maintained apps:

| App | winget package | Installer | Notes |
|-----|----------------|-----------|-------|
| Eclipse Temurin JDK 8 | `EclipseAdoptium.Temurin.8.JDK` | MSI (WiX),
machine, x64 | Per-major pin. |
| Eclipse Temurin JDK 11 | `EclipseAdoptium.Temurin.11.JDK` | MSI (WiX),
machine, x64 | Per-major pin. |
| Eclipse Temurin JDK 17 | `EclipseAdoptium.Temurin.17.JDK` | MSI (WiX),
machine, x64 | Per-major pin. |
| Eclipse Temurin JDK 21 | `EclipseAdoptium.Temurin.21.JDK` | MSI (WiX),
machine, x64 | Per-major pin. |
| Eclipse Temurin JRE 8 | `EclipseAdoptium.Temurin.8.JRE` | MSI (WiX),
machine, x64 | Per-major pin. |
| Eclipse Temurin JRE 11 | `EclipseAdoptium.Temurin.11.JRE` | MSI (WiX),
machine, x64 | Per-major pin. |
| Eclipse Temurin JRE 17 | `EclipseAdoptium.Temurin.17.JRE` | MSI (WiX),
machine, x64 | Per-major pin. |
| Eclipse Temurin JRE 21 | `EclipseAdoptium.Temurin.21.JRE` | MSI (WiX),
machine, x64 | Per-major pin. |
| exacqVision Client | `ExacqTechnologies.exacqVisionClient` | MSI,
machine, x64 | Clean MSI; ARP name `exacqVision Client (x64)`. |
| Egnyte WebEdit | `Egnyte.EgnyteWebEdit` | MSI, machine, x86 | Distinct
product from the existing Egnyte Desktop FMA (separate
ProductCode/UpgradeCode/ARP name). |
| Elevate UC | `Serverdata.ElevateUC` | MSI, machine, x64 | Intermedia
UC client. Unversioned latest-pointer URL with ~monthly cadence →
`ignore_hash`. |

**Eclipse Temurin (8 apps).** All are clean machine-scope WiX MSIs from
Eclipse Adoptium. The ARP DisplayName embeds the full patch version —
`Eclipse Temurin JDK with Hotspot 17.0.19+10 (x64)` — and JDK/JRE of the
same major share a version prefix, so each major is pinned with an
`exists_query` that combines the JDK-vs-JRE name prefix, the publisher,
and a major version filter, e.g.:
```
SELECT 1 FROM programs WHERE name LIKE 'Eclipse Temurin JDK%' AND publisher = 'Eclipse Adoptium' AND version LIKE '17.%';
```
The `JDK`/`JRE` token in the name prefix keeps a JDK install from
matching the JRE FMA and vice-versa; the `version LIKE '<major>.%'`
keeps each major distinct. This mirrors the existing Amazon Corretto
per-major FMAs. Identities (DisplayName, publisher `Eclipse Adoptium`,
4-part ProductVersion) were verified via `msiinfo` on the real x64 MSIs.

Considered but **not** added (recorded in the workstream tracker):
- **ESET Endpoint Antivirus** (`ESET.EndpointAntivirus`) and **ESET
Endpoint Security** (`ESET.EndpointSecurity`): the install succeeds
headless without a license, but uninstall is Self-Defense (HIPS)
protected — it requires a reboot to complete and is widely documented to
fail unattended (needing the ESET Uninstaller Tool in Safe Mode), so a
reliable silent SYSTEM-context removal can't be guaranteed. They're also
managed enterprise agents meant for central ESET PROTECT deployment
(standalone installs land unactivated and disable Windows Defender).

Still to verify (not in this PR): EndNote, Enpass, Evernote, and
UltraISO — their verification pass was interrupted and will be handled
separately.

Identities verified via `msiinfo` Property tables. SHAs verified against
manifests for pinned URLs; `ignore_hash` used only for Elevate UC's
actively-maintained latest-pointer URL. Icons via
`tools/software/icons/generate-icons.sh`.

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [ ] QA'd all new/changed functionality manually (relying on the FMA CI
validator for Windows install/uninstall validation)
 2026-07-13 09:59:17 -05:00
fleet-releaseandallenhouchins bb32bc7786 Update Fleet-maintained apps (#49203) 
Automated ingestion of latest Fleet-maintained app data.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Updates**
* Updated maintained app releases for Claude, Electrum, GOG Galaxy, IBM
Notifier, MacWhisper, Tuple, Typeface, WebCatalog, and WhatsApp.
* Added the latest Windows and macOS installer versions, download links,
and verified checksums.
* Updated GOG Galaxy’s macOS installation reference for the new release.
* Improved release detection so installed applications can be accurately
compared with the latest available versions.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
 2026-07-13 09:58:36 -05:00
Josh Roskos 9539535321 Supress install all for all/undefined software category (#48999) 
**Related issue:** Resolves #49013

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Hid the **Install all** button on the unfiltered **All** software
view.
  * Kept **Install all** available when a specific category is selected.
* Updated install-all behavior so the correct category is used when
launching installs.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-13 10:51:12 -04:00
Allen Houchins a55d3e3e3a Run Windows FMA test workflows on ARM64 runner (#47598) 
Switch the Windows Fleet-maintained app test workflows from
windows-latest to windows-11-arm so ARM-native FMAs can be validated.
Existing x86/x64 FMAs continue to install and run via Windows 11 on
ARM's Prism emulation, and detection is registry-based so it stays
architecture-agnostic.

Also make the osquery download architecture-aware: pick the native arm64
build on ARM64 runners and fall back to x86_64 otherwise, so osqueryi
runs natively rather than under emulation.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
* Expanded test coverage to include Windows 11 ARM64 architecture. The
application is now validated on ARM-based systems in addition to
traditional x86_64 platforms.
* Updated test infrastructure to automatically detect system
architecture and download corresponding dependencies, ensuring proper
validation across both ARM64 and x86_64 Windows configurations.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-13 09:45:13 -05:00
Allen Houchins 13a80c4bc8 Auto-install 1Password patches on Workstations (#48585) 
**Related issue:** N/A — dogfood GitOps configuration change

# What & why

Changes the 1Password patch automation on the **💻 Workstations** fleet
from calendar-event-driven remediation to **forced install**, on both
macOS and Windows.

For both `1password/darwin` and `1password/windows` patch policies in
`it-and-security/`:
- `install_software: false` → `install_software: true`
- Removed `calendar_events_enabled: true`
- Updated the `resolution` text to drop the "scheduled maintenance
window / check your calendar" language, matching the wording used by the
other IT-managed forced-install policies (Okta Verify, Adobe Acrobat,
etc.).

When a host now fails either 1Password patch policy, Fleet automatically
installs the latest Fleet-maintained 1Password with no end-user calendar
interaction. The fleet's `google_calendar` integration is left in place
since other policies (e.g. Firefox) still use calendar events.

# Checklist for submitter

- [x] QA'd all new/changed functionality manually (GitOps config only;
no code change)

Note: This is a dogfood GitOps config change only — no user-visible
product change, no code, no migrations, no new settings.
 2026-07-13 09:28:23 -05:00
Allen Houchins 99cd91a32c Fuzzy-match Zoom Workplace program name in Windows FMA install and patch query (#49188) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** N/A

## Summary

The Windows Zoom Fleet-maintained app's `exists`/`patched` queries used
an exact match on `programs.name = 'Zoom Workplace (X64)'`. Real-world
Zoom installs frequently register under a different name:

- Winget's own package name for `Zoom.Zoom` is `Zoom Workplace` (no arch
suffix).
- Zoom ships a separate, per-user, self-updating installer
(`Zoom.Zoom.EXE`, ProductCode `ZoomUMX`) that many end users get via
Zoom's in-app auto-updater, which registers differently than the
MSI-based entry Fleet's FMA targets (see
[microsoft/winget-pkgs#151467](https://github.com/microsoft/winget-pkgs/issues/151467)).
- ARM64 builds exist and would register as e.g. `Zoom Workplace
(ARM64)`.

Since the `patched` query is generated directly from the `exists` query,
any host with Zoom installed under one of these other names was
invisible to the patch policy — it would never show as needing (or
having received) an update.

- `ee/maintained-apps/inputs/winget/zoom.json`: added
`"fuzzy_match_name": "Zoom Workplace%"` (following the existing
precedent used by ~97 other Windows FMAs, e.g. `cinc.json`'s custom
fuzzy pattern).
- `ee/maintained-apps/outputs/zoom/windows.json`: regenerated via `go
run cmd/maintained-apps/main.go --slug="zoom/windows" --debug`. Only the
`exists`/`patched` query strings changed (now `name LIKE 'Zoom
Workplace%'` instead of `name = 'Zoom Workplace (X64)'`); version,
install/uninstall scripts, and refs are untouched.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`

## Testing

- [x] Verified the regenerated output only changes the exists/patched
query strings (`git diff`)
- [ ] QA'd all new/changed functionality manually (needs a live Windows
host with Zoom installed under a non-`(X64)` name to fully confirm)
 2026-07-13 09:24:53 -05:00
fleet-releaseallenhouchinsAllen Houchins
 		66a8791247 Update Fleet-maintained apps (#49196) 
Automated ingestion of latest Fleet-maintained app data.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Refreshed maintained-app listings across macOS and Windows with
updated versions and downloads (e.g., Postman, DataGrip, OneDrive, Zed,
CMake, Proton VPN, and more).
  * Updated ChatGPT macOS installer format to use ZIP artifacts.
* **Bug Fixes**
* Improved uninstall/upgrade handling for ChatGPT and Gemini, including
safer app quitting/relaunch and more targeted cleanup.
* Enhanced Weasis Windows uninstall to remove all related MSI products
discovered via upgrade codes.
* Refreshed installer integrity checks for DBeaver Enterprise and
DBeaver Ultimate.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
 2026-07-13 09:22:39 -05:00
Lucas Manuel Rodriguez 60d8f51374 Move test/upgrade to tools/ to reduce security scanning noise (#49158) 
Two reasons:
- It's a testing/QA tool, so it should be under `tools/`
- Reduce security-noise because it's just an internal tool (all findings
under tools/ should be ignored).

Failing dependency review expected because of the security findings in
the docker Go packages. (Which can be fixed/updated when a patch is
issued but without urgency because this is an internal tool.)

## Testing

- [x] QA'd all new/changed functionality manually

Ran:
```
cd tools/upgrade
FLEET_VERSION_A=v4.87.1 FLEET_VERSION_B=v4.88.1 go test
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **New Features**
  * Added an end-to-end upgrade test scenario across two Fleet versions.
* Added a Docker Compose-based upgrade environment (Fleet, MySQL, Redis,
osquery) with local TLS certs/keys and osquery flags.

* **Tests**
* Added automated Fleet readiness checks and host enrollment
verification before and after upgrade.

* **Chores / Security**
* Updated the database upgrade test workflow and Go module tooling for
the new upgrade test setup.
* Adjusted secret scanning allow-rules and refreshed Go dependencies for
the upgrade module.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-13 11:17:37 -03:00
Allen Houchins 29bef37837 Add macOS app filter to My device software (#48637) 
Expose the existing "Applications" / "Full inventory" software filter on
the Fleet Desktop My device Software tab for macOS hosts. The filter now
defaults to Applications for macOS, sends `macos_applications` to the
device software API, and keeps that query param during pagination.
Updated table tests cover rendering and URL behavior on My device and
non-macOS hosts.

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48636

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added the **Applications / Full inventory** software filter to the
**My device > Software** tab for macOS devices.
* The selected filter is now preserved when navigating through software
results.

* **Bug Fixes**
* Corrected software filtering behavior across device pages and
platforms.
* Prevented the macOS filter parameter from being added for non-macOS
devices.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-13 09:08:26 -05:00
Juan Fernandez f4ee5c6da9 Skip live-query reverse-index read when no reverse queries are active 
Relates to #42441

Small-target live queries are stored in a per-host reverse index
(livequery:host:{hostID}) that QueriesForHost reads once per checkin via
SMEMBERS. That read was issued unconditionally on every host checkin —
even when no active query used the reverse model — so every checkin
probed a per-host key that did not exist and acquired an extra Redis
connection.
 2026-07-13 09:53:37 -04:00
Sharon KatzandClaude Opus 4.6 a1531e6752 Fix CPE matching for python3-prefixed packages on Ubuntu/Debian (#48599) 
Closes #43328

## Summary

- On Ubuntu/Debian/RHEL, `pythonPackageFilter` in osquery.go prepends
`python3-` to Python package names (e.g., `geopandas` becomes
`python3-geopandas`) to match OVAL definitions
- However, the CPE database uses the bare package name (e.g.,
`geopandas`, not `python3-geopandas`), so CPE matching fails and no
vulnerabilities are reported
- This fix adds the stripped name (without `python3-` prefix) as an
additional product variation during CPE lookup, so both
`python3-geopandas` and `geopandas` are tried
- The original prefixed name is preserved so packages genuinely named
`python3-*` on PyPI (e.g., `python3-openid`, `python3-saml`) still match
correctly on non-Ubuntu platforms

## How I reproduced

Used the `nvdvuln` tool to simulate CPE matching:

**Before fix** (on main branch):
```
$ go run --tags=fts5 tools/nvd/nvdvuln/nvdvuln.go \
    --software_name python3-geopandas \
    --software_source python_packages \
    --software_version 1.0.1
Translating software to CPE...
Unable to match a CPE for the software...
```

**After fix:**
```
$ go run --tags=fts5 tools/nvd/nvdvuln/nvdvuln.go \
    --software_name python3-geopandas \
    --software_source python_packages \
    --software_version 1.0.1
Translating software to CPE...
Matched CPE: 0: cpe:2.3:a:geopandas:geopandas:1.0.1:*:*:*:*:python:*:*
Translating CPEs to CVEs...
CVEs found for python3-geopandas (1.0.1): CVE-2025-69662
```

Also verified with `python3-django` (version 3.2.12) -- correctly finds
CVE-2024-24680 and other CVEs.

## How I tested

- Unit tests: added test cases for `productVariations` covering:
- `python3-geopandas` (source: `python_packages`) -> produces both
`python3-geopandas` and `geopandas` variations
- `python3-django` (source: `python_packages`) -> produces both
`python3-django` and `django` variations
- `requests` (source: `python_packages`, no prefix) -> no extra
variations added
- Manual: ran `nvdvuln` tool for both packages from the issue, confirmed
CPE match and CVE detection
- Lint: `make lint-go-incremental` passes clean


🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved vulnerability detection for Python packages on Ubuntu/Debian
by handling package names with or without the `python3-` prefix.
* Added additional matching variations derived from sanitized names,
ensuring both full and stripped forms are considered.
* Ensured existing non-Python package matching behavior remains
unchanged.
* **Tests**
* Expanded NVD sanitization and product variation test coverage for
`python_packages` scenarios (including cases with and without the
`python3-` prefix).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-07-13 09:46:49 -04:00
Isabell Reedy 65caf18c69 Update CODEOWNERS (#49194) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated review requirements for security and compliance documentation
paths.
  * Updated review requirements for the `.claude` configuration path.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-13 13:27:21 +01:00
George Karr be8877fa43 Handbook: remove Ian Littman from product-groups.md (#49138) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** NA

Removes Ian Littman from the MDM product group's Software Engineer
roster in
`handbook/company/product-groups.md`.
 2026-07-13 13:22:30 +01:00
kilo-code-bot[bot] 2299f02954 Add Sales Territory Assignments section to Sales handbook (#49155) 2026-07-11 15:58:08 -05:00
Allen Houchins 6280699eb0 Update block-and-monitor-edr-freeze-on-macos-with-santa-and-fleet.md (#49176) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
 2026-07-10 22:50:26 -05:00
fleet-releaseandallenhouchins 61d1ba61f9 Update Fleet-maintained apps (#49174) 
Automated ingestion of latest Fleet-maintained app data.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Updates**
* Updated managed app installers and release metadata for the latest
versions of Arc, Beekeeper Studio, Claude, CleanMyMac, Clop, Dropbox,
Google Credential Provider, Hive, Kiro CLI, PDFsam Basic, RewriteBar,
Santa, Super Productivity, Superwhisper, and Warp.
* Updated installer download links and verification checksums to support
the new releases.
* Refreshed Dropbox uninstall handling and Santa’s installation package
for improved upgrade support.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
 2026-07-10 20:21:11 -05:00
George Karr a1b764a341 Adding changes for Fleet v4.88.1 (#49038) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Released a new Fleet chart and application version.
  * Updated deployment defaults to use the latest Fleet container image.

* **Tests**
* Adjusted release-candidate branch expectations to match the new
version.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-10 18:33:40 -05:00
Jordan MontgomeryCopilot Autofix powered by AIMagnus Jensen
 		c5575e9d9a Add PSSO end to end integration tests (#48589) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #47171

Added integration tests for the fleet-psso feature and added PSSO
functionality to our MDM test client - idea being it is so tightly
integrated into the MDM side of things on the Apple side AND we ideall
want osquery-perf to be able to exercise it(coming in the next PR)

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added Apple Platform SSO (PSSO) support for device registration,
password login, key requests, and key exchange.
* Added a simulator/test device for exercising the full PSSO workflow
end-to-end.
* Made PSSO AASA development app IDs configurable and enhanced macOS
PSSO activity in performance testing (with new counters).
  * Improved local macOS Desktop packaging/signing configurability.

* **Bug Fixes**
* Strengthened PSSO token/crypto handling, including algorithm pinning,
key ID canonicalization, encrypted assertion `typ` validation, and
replay protection.

* **Tests**
* Added extensive crypto interoperability tests (including Apple
known-answer vectors) plus new end-to-end integration coverage.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
 2026-07-10 18:51:33 -04:00
+3
Tim LeeRachael ShawMarko Lisicakilo-code-bot[bot]kiloconnect[bot]melpikeNoah TalermanJordan MontgomeryJonathan KatzVictor LyuboslavskyMagnus JensenRachelElysiaScott Gress
 		c9803c2a8f Docs: non-proxied cert renewal (#45695) 
**Related issue:** Resolves #44348

**Base branch:** `docs-v4.86.0` (not `main`) per the docs release
process.

## What this PR does

Updates four customer-facing guides and adds a release-notes entry for
Phase 2's opt-in cert renewal feature (shipped via #45696). Frames the
marker as an opt-in enhancement: profiles without it continue to work as
in 4.85; profiles with it activate auto-renewal.

| Guide | Change |
|-------|--------|
| `connect-end-user-to-wifi-with-certificate.md` | Migrated 11 legacy
`\$FLEET_VAR_SCEP_RENEWAL_ID` refs to the preferred name; added
back-compat callout. |
| `okta-conditional-access-integration.md` | Removed "Automatic renewal
coming soon" line; added one-time upgrade-redeploy callout for existing
customers. |
| `enable-okta-verify-on-macOS-with-configuration-profile.md` | Added
marker to example profile OU; added opt-in note and CA-side
OU-preservation verification step. Coordinated with the earlier
example-profile update from #43293 already on `docs-v4.86.0`. |
| `enable-okta-verify-on-windows-using-a-scep-configuration-profile.md`
| Replaced manual-redeployment narrative with auto-renewal guidance.
Kept the policy-based expiry-monitoring SQL as an optional safeguard. |

Release-notes entry (`changes/40639-non-proxied-cert-renewal`)
consolidates Phase 2 customer-visible behavior in three bullets.

## Dependencies

The Conditional Access guide's "new setups: no extra action needed"
framing assumes #45662 (the Fleet-side template marker addition) has
landed — it has, merged into the feature branch and onward into main via
#45696.

# Checklist for submitter

- [x] Changes file added for user-visible changes

## Testing

- [x] Doc review only — no code changes

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Automatic certificate renewal is now supported for SCEP and ACME
certificates from external certificate authorities, enabled by default
for new deployments with an opt-in path for existing customers
* macOS devices with ACME-bearing configuration profiles will now
surface hardware-bound certificates in device vitals

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Rachael Shaw <r@rachael.wtf>
Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com>
Co-authored-by: kilo-code-bot[bot] <240665456+kilo-code-bot[bot]@users.noreply.github.com>
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: melpike <79950145+melpike@users.noreply.github.com>
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
Co-authored-by: Jonathan Katz <44128041+jkatz01@users.noreply.github.com>
Co-authored-by: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com>
Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
Co-authored-by: RachelElysia <71795832+RachelElysia@users.noreply.github.com>
Co-authored-by: Scott Gress <scottmgress@gmail.com>
 2026-07-10 17:37:50 -05:00
Andrey Kizimenko 6430e6132f Add 4.89.0 baseline and migration loadtest results (#49168) 
## Summary

Adds the **4.89.0** load test metrics artifacts, following the existing
`tools/loadtest/metrics/runs/` conventions.

### Baseline — `runs/baseline/489loadtest/`
18h run on a fresh RC instance (no data).
- `489loadtest-2026-07-10-210313Z-18h.json` / `.md`

### Migration — `runs/migration/487to489mig/`
4.87 → 4.89 migration, before vs. after.
- `487to489mig-2026-07-10-162812Z-1h.{json,md}` — pre-migration (1h
window)
- `487to489mig-2026-07-10-192738Z-130m.{json,md}` — post-migration (130m
window)

## Results

| Run | Fleet errors | ALB 5xx | Abnormal stops | Threshold checks |
|-----|:---:|:---:|:---:|---|
| Baseline (18h) | 0 | 0 | 0 | RDS Writer Deadlocks avg 0.13
(occasional, retried) |
| Migration pre (1h) | 0 | 0 | 0 | ✅ all within thresholds |
| Migration post (130m) | 0 | 0 | 0 | RDS Writer Deadlocks avg 0.08
(occasional, retried) |

The only flag is a near-zero average of occasional RDS writer deadlocks
(MySQL retries these); everything else is within expected range and
holds steady across the migration. Full per-metric comparison
(`compare-metrics.sh`) is posted on the release QA issue.

Data only — no code changes.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
  * Added baseline and migration load-test performance reports.
* Included infrastructure, database, Redis, load balancer, network,
container health, error, and SQL performance metrics.
* Added reports covering multiple test durations and migration intervals
for improved performance analysis.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-10 17:00:36 -05:00
Andrew MellorandJordan Montgomery 2eb1cba2dd 46959 Add Account Provisioning settings to UI for FPSSO configuration (#47655) 
**Related issue:** Resolves #46959

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually


## New Fleet configuration settings

- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added Apple account provisioning configuration UI in integrations
settings with token URL, client ID, and client secret fields.
  * Added activity tracking for Apple account provisioning changes.

* **Documentation**
* Renamed integration settings labels for clarity: "Ticketing",
"Calendar events", "Certificate enrollment", "User mapping",
"Authentication (SSO)", and "Host status alerts".

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
 2026-07-10 16:19:47 -04:00
Jordan Montgomery 91971a3637 Add better index to nano_enrollment_queue (#48865) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48883

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Improved performance for retrieving the next Apple MDM command, making
queue lookups faster and more reliable.
* Added a new database index to better support ordering and selection of
pending commands.
* **Tests**
* Added coverage to verify the new indexing behavior is applied
correctly during database updates.
* **Chores**
* Updated database schema and migration records to include the new
index.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-10 15:51:14 -04:00
Steven Palmesano 4ac41f9681 Update macOS version DDM guide to avoid failures (#47999) 
@kitzy Thank you for writing this up! Heads up that I updated the
queries. Fleet does not automatically deliver the profile to applicable
devices, so the user must specify a query that doesn't include devices
at or above the required version.
 2026-07-10 15:42:23 -04:00
Mike McNeil 2d2b6e4683 Handbook: Update leadership.md (#49162) 2026-07-10 15:34:24 -04:00
github-actions[bot]andlucasmrod 11df098d7c Update Orbit CA certs [automated] (#49160) 
Resolves: https://github.com/fleetdm/fleet/issues/49161.

Automated change from [GitHub
action](https://github.com/fleetdm/fleet/actions/workflows/update-certs.yml).

Claude summary:
```
 ➕ Added (1)

  - e-Szigno TLS Root CA 2023 — new Hungarian (Microsec) root Mozilla admitted to the store.

  ➖ Removed (24)

  These match Mozilla's root-store retirements/distrusts over the Jan–Jul 2026 window. Grouped by the reason they went away:

  ┌────────────────────────────────────────────────────────────────┬─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
  │                             Theme                              │                                                                      Roots removed                                                                      │
  ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ Trustwave exiting the CA business                              │ Trustwave Global CA, Trustwave Global ECC P256, Trustwave Global ECC P384, SecureTrust CA, Secure Global CA                                             │
  ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ Entrust distrust (incl. Entrust-owned AffirmTrust)             │ Entrust Root CA – G2, Entrust Root CA – EC1, AffirmTrust Commercial, AffirmTrust Networking, AffirmTrust Premium, AffirmTrust Premium ECC               │
  ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ Legacy DigiCert / QuoVadis roots retired (superseded by G2/G3) │ DigiCert Assured ID Root CA, DigiCert Global Root CA, DigiCert High Assurance EV Root CA, QuoVadis Root CA 2, QuoVadis Root CA 3                        │
  ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ Distrusted for compliance                                      │ GLOBALTRUST 2020                                                                                                                                        │
  ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ Other retirements                                              │ COMODO Certification Authority, SwissSign Gold CA – G2, TeliaSonera Root CA v1, Certigna, certSIGN ROOT CA, FIRMAPROFESIONAL CA ROOT‑A WEB, GTS Root R2 │
  └────────────────────────────────────────────────────────────────┴─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
```

Co-authored-by: lucasmrod <lucasmrod@users.noreply.github.com>
 2026-07-10 16:27:44 -03:00
Mike McNeil e0c6411c2f Handbook: Update headcount (#49156) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #
 2026-07-10 14:36:13 -04:00
Allen HouchinsCopilotcopilot-swe-agent[bot]Cursornulmete
 		078fbc0f40 Add Targeted platforms column and platform filter to Policies page (#44125) 
- @noahtalerman: For the following quick win:
  - https://github.com/fleetdm/fleet/issues/23737

## Summary

Adds a "Targeted platforms" column and a platform filter dropdown to the
Policies page (`/policies/manage`), matching the pattern already used on
the Reports page (`/queries/manage`, `ManageQueriesPage`).

### Frontend
- New non-sortable **Targeted platforms** column rendered via
`PlatformCell`, sourced from each policy's comma-separated `platform`
field.
- New platform filter dropdown (All / macOS / Windows / Linux /
ChromeOS) wired as a `customControl` on the Policies table, alongside
the existing automation filter. Selecting a value pushes a new URL (not
a replace), resets `page` to 0, and updates the `platform` query param.
- `ManagePoliciesPage` reads `location.query.platform` and threads it
through to both `globalPoliciesAPI.loadAll` / `teamPoliciesAPI.loadAll`
and the react-query keys, plus the count endpoints. The
automation-filter and count "hide" conditions now include the platform
filter so they remain visible when only a platform filter is active.
- `frontend/services/entities/global_policies.ts` and `team_policies.ts`
accept an optional `platform` param (with `"all"` normalized to
`undefined`).
- Added tests for the new column and dropdown in
`PoliciesTable.tests.tsx`.

### Backend
- Added `Platform string ` + `` `query:"platform,optional"` `` to
`ListGlobalPoliciesRequest`, `CountGlobalPoliciesRequest`,
`ListTeamPoliciesRequest`, `CountTeamPoliciesRequest`.
- Extended datastore and service signatures (`ListGlobalPolicies`,
`ListTeamPolicies`, `ListMergedTeamPolicies`, `CountPolicies`,
`CountMergedTeamPolicies`, `ListGlobalPolicies`/`ListTeamPolicies` on
the service) to accept a `platform string` arg. Mocks and all call sites
updated.
- Platform filtering in SQL uses a new helper `platformFilterClause`:
  ```sql
  AND (p.platforms = '' OR FIND_IN_SET(?, p.platforms))
  ```
so policies targeting "all platforms" (empty `platforms` field) always
match regardless of the selected filter. `FIND_IN_SET` uses a bound
parameter (no injection risk).
- Added a new MySQL integration test `testPoliciesPlatformFilter`
covering empty-platform (match-all), per-platform filter, and
team/merged paths.

### Docs
- REST API docs for `GET /api/v1/fleet/global/policies`, `GET
/api/v1/fleet/fleets/:id/policies`, and the corresponding `/count`
endpoints now document the `platform` query param.
- Added `changes/policies-targeted-platforms-filter`.

## Behavior

- `platform=all` (or missing) returns all policies.
- Selecting a specific platform returns policies whose `platforms`
column is empty OR contains the selected token.
- The dropdown only renders when the table is searchable (results exist
OR any filter is active).
- Changing the filter pushes a new URL and resets the page.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually

Local verification:
- `go build ./...` — clean
- `go vet ./server/... ./cmd/... ./ee/...` — clean
- `make lint-go-incremental` — 0 issues
- Go service-level policy tests pass. MySQL integration tests compile
but could not be run locally (no Docker); CI will exercise the new
`testPoliciesPlatformFilter` test.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a "Targeted platforms" column with platform icons and an "All
platforms" option.
* Added a platform filter dropdown to scope policy lists; counts,
last-updated, and controls adapt when a platform filter is active.
Backend now honors an optional platform query parameter so filtering
returns matching policies.

* **Tests**
* Added and updated unit and integration tests covering the new column,
filter UI, and platform-filtered policy listings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: nulmete <nicoulmete1@gmail.com>
 2026-07-10 13:32:16 -05:00
Allen Houchins 15118e4797 Remove AI model comparison article (#49132) 
Delete the article on comparing AI models for configuration profile
generation, including its body content and associated metadata tags.

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
 2026-07-10 10:56:40 -07:00
Luke Heath 6ed8217583 Fix open redirect in Vanta authorization redirect endpoint (#49077) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** NA (found via Aikido SAST triage)

## What changed

`GET /redirect-vanta-authorization-request` is a public, unauthenticated
endpoint that set signed cookies and then redirected the browser to the
caller-supplied `vantaAuthorizationRequestURL` with no validation.
Because the redirect target came straight from a query parameter, the
endpoint could be abused as an open redirect: an attacker could craft a
`https://fleetdm.com/redirect-vanta-authorization-request?...&vantaAuthorizationRequestURL=https://evil.example.com`
link that bounces a victim to an arbitrary domain (phishing). The only
prior gate was a `VantaConnection.findOne({vantaSourceId})` lookup,
which does not bind the source ID to the redirect target and is
satisfiable by anyone who has ever initiated a Vanta connection.

This adds a host/scheme allowlist before redirecting. The legitimate
destination is always `https://app.vanta.com/oauth/authorize?...`
(constructed server-side in `create-vanta-authorization-request.js`), so
the endpoint now only redirects when the parsed URL is `https:` and its
host is `app.vanta.com`; otherwise it returns `badRequest`.

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] QA'd all new/changed functionality manually

Legitimate flow (redirect target `https://app.vanta.com/...`) still
redirects as before; a target on any other host or a non-`https` scheme
now returns `badRequest` instead of redirecting.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved safety for authorization redirects by validating the
destination before sending users onward.
* Redirects now only proceed when the target uses a secure connection
and the approved site.
* Invalid or malformed redirect links now return a clear bad-request
response instead of continuing.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-10 12:54:57 -05:00
Noah Talerman e7c2f10192 GitOps (YAML) reference: Remove "experimental" tags (#49142) 
- Removed "experimental" for `macos_manual_agent_isntall` and `software`
- There are no plans to break these. Customers are already using them in
production
 2026-07-10 12:54:15 -05:00
Carlo 6cfc4a3611 Add GitOps support for macOS script-only packages in setup experience (#49089) 
**Related issue:** Resolves #43667

  # Summary

Adds a `setup_experience_platforms` field to the GitOps software package
spec so `.sh` script-only installers can be selected for macOS setup
experience declaratively. Reconciles the cross-platform selection table
on every batch apply.

  # Checklist for submitter

  If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

  ## Testing

  - [x] Added/updated automated tests

  - [x] QA'd all new/changed functionality manually

  ## New Fleet configuration settings

- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added declarative `setup_experience_platforms` to software package
definitions to control “setup experience” targets, including selecting
script-only installers for macOS (mapped appropriately).
* Batch uploads now propagate these cross-platform selections and
reconcile installer cross-entries.

* **Bug Fixes**
* Improved platform normalization (trimming, casing, alias mapping),
deduplication, and extension-specific validation.
* Enhanced update behavior: omitting the field leaves existing
selections unchanged; providing an empty list clears them, with correct
setup/installation timing.

* **Tests**
* Added unit and integration coverage for normalization and batch
re-apply/reconcile behavior (nil vs empty, idempotency, mixed updates,
and validation failures).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-10 13:52:48 -04:00
Tim Lee 945a4d1518 Filter Add certificate CA dropdown to custom SCEP only (#49020) 2026-07-10 11:14:28 -06:00
Magnus Jensen 790f457bf0 SAAD: GitOps for DDM assets (#49046) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48570

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. Added in a previous PR

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added end-to-end Apple DDM asset support in GitOps, including export
and GitOps parsing for `macOS settings` assets.
* Introduced Apple DDM asset management APIs
(list/get/download/create/delete) plus a batch set operation with
dry-run.
* **Bug Fixes**
* Improved Apple MDM/DDM reconciliation so referenced asset updates
trigger re-delivery via asset-aware tokening.
* Added safer validation around asset type changes and deletion
conflicts when assets are still referenced.
* **Tests**
* Expanded unit and integration coverage for asset parsing, upload/apply
behavior, reconciliation, and access control.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-10 12:56:26 -04:00
Jonathan Katz aa5813e4eb Fix invisible hover state in dark mode (#49001) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48531

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually
Checked all the places according to this list:
```
Rule 1 — modal secondary buttons (Cancel / Done / Clear all)
`body.dark-mode .modal__modal_container .button--inverse:hover, …`
Affects any modal opened from *inside a card* (the only modals where the card-leak made hover invisible). There are **4 such surfaces**, all reachable from the Dashboard or Self-service:

1. **Dashboard → the chart card (Hosts online / vulnerability exposure) → Settings cog → the Settings modal** — hover **Cancel** and **Clear all**. *(issue #48531)*
2. **Dashboard → Activity card → click any activity's details link** — the details modal's footer button (Done/Cancel). This is 12 different activity-detail modals (script details, software install/uninstall details, VPP install, MDM command, etc.).
3. **Dashboard on a fresh instance (fewer than 2 hosts) → "Welcome to Fleet" card → click a policy row** — the policy modal.
4. **Fleet Desktop "My device" → Self-service tab → "Install all" button** — the Install-all-in-category modal's Cancel.

## Rule 2 — button `DropdownWrapper` hover
`body.dark-mode .card .dropdown-wrapper__button .react-select__control:hover`
Exactly **1 place** in the whole app:

5. **Software → click a software title → title details page → the "Actions ▾" dropdown** at the top-right of the summary card. *(Admin/maintainer only — it's gated behind "can manage software".)*

## Rule 3 — `ActionsDropdown` hover
`body.dark-mode .card .actions-dropdown-select__control:hover`
Exactly **2 places**:

6. **Host details → Reports tab → each report card header → "Actions ▾"**. *(The confirmed repro.)*
7. **Fleet Desktop "My device" → Self-service tab → a software row → "More ▾"** dropdown.
```


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed dark-mode hover styling for buttons and dropdowns inside card
components.
* Restored the correct hover appearance for inverse buttons in modal
containers.
* Updated hover behavior for select-style dropdown controls so they
match the card surface in dark mode.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-10 12:48:12 -04:00
Magnus Jensen 2b2a5991a4 handle client error decoding errors in ACME urls (#49137) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46282

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Malformed ACME URLs and resource identifiers now return a clear **400
Bad Request** response instead of a **500 Internal Server Error**.
* Error details were improved to more accurately distinguish malformed
client requests.
* **Tests**
* Added an integration test covering invalid ACME endpoint path IDs
across resource types, verifying **400** responses with the expected
malformed error type.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-10 12:31:17 -04:00
Allen Houchins 9185174faa Re-add Crestron AirMedia (+Peripherals) Windows FMAs (#49127) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** N/A

## What changed

Re-adds two Windows Fleet-maintained apps that were dropped from the
letter C batch (#48969) **solely** because `www.crestron.com` returns
HTTP 403 to Fleet's default Go `User-Agent`:

- **Crestron AirMedia** (`Crestron.AirMedia`)
- **Crestron AirMedia Peripherals** (`Crestron.AirMediaPeripherals`)

Each gets an input JSON, a generated output, an `apps.json` catalog
entry with description, a frontend icon component (+ `index.ts`
registration), and a website icon PNG. Both are machine-scope MSIs (WiX)
with upgrade-code uninstall; restored from their pre-drop state with
outputs regenerated against the current winget manifests (versions
unchanged: `5.11.1.164` / `1.11.1.164`, SHAs match).

## ⚠️ Depends on #49123

The 403 is fixed by #49123 (browser `User-Agent` in
`DownloadInstaller`). Until #49123 merges and this branch is rebased on
it, the FMA validator (`cmd/maintained-apps/validate`) will 403
downloading these installers. Merge #49123 first, then rebase/re-run CI
here.

## Validation

Run on a Windows validator with the #49123 UA fix in place — **both apps
passed**: downloaded (confirming the UA fix unblocks
`www.crestron.com`), installed, found via the exists query, and
uninstalled cleanly. The `no changes in C:\Program Files` line is benign
(they install elsewhere; the exists query still finds them).

## Dell Display and Peripheral Manager — investigated, dropped (not
viable as an FMA)

DDPM was verified and included in early revisions of this PR, then
dropped. Its InstallShield (InstallScript) setup aborts with
`0x80042000` in the validator's session-0 SYSTEM context across
**every** documented silent switch — `/Silent`, `/S`, and `/Silent
/HeadlessMode=true` all failed. Per silentinstallhq, DDPM 2.0+ requires
the Windows Desktop Runtime (.NET) prerequisite installed first
(extracted from the installer's own prerequisites folder), and its
bundled InstallShield prerequisite chaining doesn't cooperate with a
headless SYSTEM install; Dell's own community thread for this exact
scenario (task sequence = SYSTEM) is unresolved. An FMA install script
can't reliably extract-and-chain a runtime that may require a reboot,
and DDPM only benefits hosts with Dell displays — so it's not a viable
FMA. The identity work (verified DisplayName/publisher from the real
installer) is recorded in the commit history if it's ever revisited.

# Checklist for submitter

- [ ] Changes file — N/A (FMA catalog data, consistent with prior letter
batches which add no `changes/` entry).

## Testing

- [x] Ran the ingester for both slugs; outputs + `apps.json` regenerated
and validated as JSON.
- [x] QA'd via the Windows FMA validator — both Crestron apps passed
(with the #49123 UA fix present).
 2026-07-10 10:59:02 -05:00
Sharon Katz 2f0c1b338a Restrict SCIM endpoints to global admin only (#48858) 
**Related issue:** N/A

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests

## Summary

Restricts SCIM endpoint access to global admin users only. Previously,
global maintainers also had access, which is broader than necessary.

### Changes
- **`server/authz/policy.rego`**: Removed `maintainer` from the SCIM
authorization rule, leaving only `admin`.
- **`ee/server/integrationtest/scim/scim_test.go`**: Updated auth tests
to verify maintainers now get 403, and that only admins can access SCIM
endpoints.

> **Breaking change for 4.89**: Customers using a global maintainer API
token for SCIM will need to update to a global admin token before
upgrading.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Restricted SCIM endpoint access to global administrators only.

* **Bug Fixes**
* Prevented unauthorized observer and maintainer users from accessing
SCIM reads, writes, and details.
* Improved authorization error tracking for denied SCIM requests
(including recorded request status and details).

* **Tests**
* Updated SCIM authorization integration tests to reflect the tightened
admin-only access rules.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-10 11:53:48 -04:00
Sharon KatzandClaude Opus 4.6 dbdd3fe936 Handbook: add missing security practices to IT security page (#49069) 
**Related issue:** N/A (documentation-only improvement)

# Checklist for submitter

- ~Changes file added~ (documentation-only change, no changes file
needed)

## Testing

- [x] QA'd all new/changed functionality manually

Verified the markdown renders correctly and table alignment is
consistent.

## Summary

Adds three items to the IT security handbook page
(`handbook/it/security.md`):

- Trivy row in the SAST scanning table for container image and build
artifact scanning
- Paragraph noting weekly AI-assisted security scans
- Paragraph in the Disclosure section documenting the private bug bounty
program

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-07-10 10:39:08 -05:00
Ken Seals 8dde2a67e9 Fix open paren (#49126) 
There was an open paren here in the Skip-level section

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
 2026-07-10 16:24:56 +01:00
Allen Houchins e2ca3120ee Add Firefox multilingual deployment guide (#49129) 
New article explaining how to deploy Firefox with multiple language
packs using a single Fleet-maintained app and post-install scripts for
macOS and Windows.

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #49024

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
 2026-07-10 09:30:44 -05:00
Jordan MontgomeryandCopilot Autofix powered by AI 087ce7ab56 Add UI for assets (#49071) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48571 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

No changes file as this is a subtask
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a Premium-only **Assets** tab to Configuration Profiles, with
JSON asset list, upload, download, copy, and delete (delete limited for
technician views).
* Added a Premium-only **Assets** entry to the command palette
configuration controls.
* Introduced a new **file-json** graphic type and enhanced user-scoped
profile indicators (with iOS/iPad-specific behavior).
* **Bug Fixes**
* Updated navigation so the **Assets** view opens consistently from
settings and the command palette.
* Improved visual alignment of tooltip/icon elements in asset and scope
displays.
* **Tests**
* Added coverage for Assets, upload/download/delete behaviors, and
related UI components.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-07-10 16:29:35 +02:00
fleet-releaseandallenhouchins 33ebf9f209 Update Fleet-maintained apps (#49125) 
Automated ingestion of latest Fleet-maintained app data.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Updates**
  * Updated the Drofus Windows app listing to version 2.18.11.0.
* Updated the installer download link and verification information for
the new release.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
 2026-07-10 09:08:57 -05:00
SpeedRacerMcQueen 4cde1f6603 Update README.md (#49120) 
fix typo in "Check LinkedIn for new activity" section
 2026-07-10 09:05:05 -05:00
fleet-releaseandallenhouchins 3c2ee6707a Update Fleet-maintained apps (#49122) 
Automated ingestion of latest Fleet-maintained app data.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Updates**
  * Updated the macOS WhatsApp package to version 26.27.21.
  * Updated the macOS Zed package to version 1.10.2.
* Refreshed Zed’s installer link and verification checksum for the new
release.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
 2026-07-10 08:58:06 -05:00
Allen Houchins b18b0c2a05 Add Windows FMAs (letter D): 12 apps (#49086) 
**Related issue:** N/A — part of the Windows Fleet-maintained apps
catalog expansion (letter D batch; follows #48872, #48881, #48950,
#48969).

Adds twelve new Windows Fleet-maintained apps:

| App | winget package | Installer | Notes |
|-----|----------------|-----------|-------|
| DataSpell | `JetBrains.DataSpell` | NSIS (install4j), machine, x64 |
Mirrors the DataGrip FMA pattern: `fuzzy_match_name` +
`use_display_version_for_patch` (registry version is a JetBrains build
number; marketing version parsed from the name). |
| dnGrep | `dnGrep.dnGrep` | MSI, machine, x64 | Versioned+arch ARP name
("dnGrep 5.0.9 (x64)") → fuzzy match. |
| Draftable Desktop | `Draftable.Draftable` | MSI, machine, x64 | Uses
the machine-scope `DraftableDesktopSystem` MSI. **Caveat:** hard winget
dependency on .NET 10 Desktop Runtime — installs fine but won't launch
without it (same class as the BleachBit VCRedist dependency). |
| dRofus | `dRofus.dRofus` | MSI, machine, x64 | Versioned ARP name
("dRofus 2.18") → fuzzy match. |
| Devolutions Launcher | `Devolutions.Launcher` | MSI, machine, x64 |
Distinct ARP identity from the existing Remote Desktop Manager FMA. |
| Devolutions Workspace | `Devolutions.Workspace` | MSI, machine, x64 |
Product renamed: ARP DisplayName is **"Devolutions Password Manager"**
(set as `unique_identifier`). `program_publisher` overridden to
"Devolutions Inc." (capital I) — verified via msiinfo; the
locale-derived lowercase would not match. |
| Delinea Connection Manager | `Delinea.DelineaConnectionManager` | MSI,
machine, x64 | Dual-purpose MSI defaults to **per-user** (ALLUSERS=2 +
MSIINSTALLPERUSER=1); custom install script forces `ALLUSERS=1
MSIINSTALLPERUSER=""`. `program_publisher` = "Delinea Inc.." (double
period, as stored in the MSI). Unversioned URL → `ignore_hash`. |
| DAX Studio | `DaxStudio.DaxStudio` | Inno, machine, x64 | `/ALLUSERS`
for machine scope; versioned ARP name → fuzzy. |
| DevPod | `LoftLabs.DevPod` | MSI, machine, x64 | Uses the WiX MSI
variant (the manifest also has an NSIS per-user one). |
| Directory Opus | `GPSoftware.DirectoryOpus` | Inno, machine, x64 |
Standard Inno silent install/uninstall. |
| DYMO ID | `DYMO.DYMOID` | InstallShield→MSI, machine, x86 | `/S /V"/qn
/norestart"`; uninstall via msiexec by ProductCode. |
| digiSeal Reader | `secrypt.digiSealreader` | EXE (self-extracting),
machine, x86 | `installer_scope: ""` (manifest declares no scope);
`-silent` install, shipped uninstaller with `-silent`. Unversioned URL →
`ignore_hash`. |

Considered but **not** added (recorded in the workstream tracker):
- **Datadog Agent** (`Datadog.Agent`): winget PackageVersion is
`7.81.0.1` but the MSI and registry report `7.81.0.0`, so the patch
policy would flag every install as perpetually outdated.
`use_display_version_for_patch` can't fix it (the manifest has no
`AppsAndFeaturesEntries`); it needs a version-normalizing ingester ref
(like `onepassword_version_shortener`). Deferred pending that helper
(task spawned).
- **Dell Display and Peripheral Manager**
(`Dell.DisplayAndPeripheralManager`, covers both "Dell Display Manager"
and "Dell Peripheral Manager"): the winget-pinned host `dl.dell.com`
returns **403** to non-browser User-Agents, and Fleet's downloader sends
`Go-http-client` (same failure that dropped Crestron AirMedia in letter
C). The `downloads.dell.com` mirror serves the identical path to any UA,
but there's no input field to override the manifest URL. Deferred
pending a downloader User-Agent fix (task spawned — would also unblock
Crestron).
- **Dell EMC System Update** (`Dell.SystemUpdate`): registers its ARP
entry under **HKCU** (per-user) under a SYSTEM install; legacy product
Dell steers users away from (toward Dell Command Update, already an
FMA); firmware/driver DUP bootstrapper.
- **Devolutions Remote Desktop Manager Agent**
(`Devolutions.RemoteDesktopManagerAgent`): legacy/superseded by
"Devolutions Agent" (2026.1); winget manifest frozen at 2025.2.28.0
since Sept 2025; vendor docs page 404s.
- **Dedoose** (`Dedoose.Dedoose`): per-user-only scope, x86,
latest-pointer URL (CloudShow class).
- **Defraggler** (`Piriform.Defraggler`): abandoned (final release 2020,
no winget commits since 2023); legacy defrag tool with an unverified ARP
publisher string.
- **DiRoots ProSheets** (`DiRoots.ProSheets`): validated install but its
Advanced Installer bootstrapper uninstall hung to the timeout and it
drags bundled PDF24 Creator entries into inventory (dropped at
validation).
- **DroidCam Client** (`dev47apps.DroidCam`): NSIS `/S` install hung
headless to the timeout (inline vc_redist); 3DxWare/Citrix headless-hang
class (dropped at validation).

Identities verified per app (msiinfo Property tables; installer
PE/version resources; winget AppsAndFeaturesEntries; uninstall-database
corroboration). Two publisher-casing mismatches (Devolutions Workspace,
Delinea) were caught by direct MSI inspection and fixed with
`program_publisher` before they could silently break the exists queries.
SHAs verified against manifests for pinned URLs; `ignore_hash` used only
where the manifest is demonstrably actively maintained. Icons via
`tools/software/icons/generate-icons.sh` (the pre-existing DataSpell
icon component is reused untouched).

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [ ] QA'd all new/changed functionality manually (relying on the FMA CI
validator for Windows install/uninstall validation)
 2026-07-10 08:54:58 -05:00
Lucas Manuel Rodriguez a37b483cf7 Add VEX exclusions for CVEs in fleetdm/wix (#49107) 
Fixes: https://github.com/fleetdm/fleet/actions/runs/29075556043.

New run: https://github.com/fleetdm/fleet/actions/runs/29090472465.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Security**
* Added vulnerability assessments for CVE-2025-70103 and CVE-2026-40355.
* Documented the affected Wix-related components as not affected because
the vulnerable code is not executed in the relevant workflows.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-10 10:47:06 -03:00