Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 6 Packages Projects Releases Wiki Activity
26,040 Commits 2 Branches 0 Tags
9f8caea025317e8a26b64e68698ebfffc8cceecd
Commit Graph
26040 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
RachelElysia 7cb7a162b0 Fleet UI: Policy details page labels/automations use TruncatedTextList (#48977) 2026-07-08 15:25:46 -07:00
Victor Lyuboslavsky 0a3d73a732 Updated osquery perf for #45550 (#48935) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45550 

# Checklist for submitter

- [x] QA'd all new/changed functionality manually



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Enhanced Windows MDM SCEP certificate simulation to track issued
certificate specs per host during check-ins.

* **Bug Fixes**
* Certificate data generation is now stably ordered and consistent
across refreshes.
* SCEP certificate processing now ignores failed installs (no
certificate) and records only valid issued cert details.

* **Testing**
* A small subset of simulated agents may withhold one SCEP certificate
to exercise verification edge cases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-08 21:55:13 +01:00
kitzy 087e67644d Fix misspelled bootstrap-package article filename (#48833) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** NA

# Checklist for submitter

- [x] QA'd all new/changed functionality manually

## Summary

- Renamed `articles/manage-boostrap-package-with-gitops.md` to
`articles/manage-bootstrap-package-with-gitops.md` to fix the "boostrap"
typo (article title/content were already spelled correctly).
- Added a 301 redirect in `website/config/routes.js` from the old
misspelled URL (`/guides/manage-boostrap-package-with-gitops`) to the
corrected URL (`/guides/manage-bootstrap-package-with-gitops`).
- Updated the two internal links that pointed at the misspelled URL, in
`articles/enroll-macbook-neo-at-scale-with-fleet-zero-touch.md` and
`handbook/marketing/marketing-assets.md`.

## Testing

- [x] QA'd all new/changed functionality manually — verified the
redirect rule matches the existing pattern used for other renamed
`/guides/*` pages in `website/config/routes.js`.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Added a redirect for a misspelled guides URL so visitors are sent to
the correct page automatically.
* Improved navigation reliability for the affected guide link without
changing any other routes.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-08 16:48:08 -04:00
Allen Houchins f24af180c0 Add Windows FMAs (letter C): 13 apps (#48969) 
**Related issue:** N/A — part of the Windows Fleet-maintained apps
catalog expansion (letter C batch; follows #48872, #48881, #48950).

Adds seventeen new Windows Fleet-maintained apps:

| App | winget package | Installer | Notes |
|-----|----------------|-----------|-------|
| Advanced Installer | `Caphyon.AdvancedInstaller` | MSI, machine, x64 |
Versioned ARP name ("Advanced Installer 23.8") → fuzzy match. |
| Certify The Web | `CertifyTheWeb.CertifySSLManager` | Inno, machine,
x64 | ARP name is "Certify Certificate Manager version 7.1.0.0" (product
renamed at v7) → fuzzy on "Certify Certificate Manager". |
| Chatbox | `Bin-Huang.Chatbox` | NSIS (electron-builder), machine, x64
| `/allusers /S`; custom exists query excludes the separate Chatbox
Community Edition; uninstall matches `Chatbox [0-9]*`. |
| Citrix Workspace | `Citrix.Workspace` | Vendor bootstrapper EXE,
machine, x86 universal | ARP name "Citrix Workspace \<YYMM\>" → fuzzy.
Uninstall runs the registered TrolleyExpress with `/uninstall /cleanup
/silent`; 3010 treated as success. See "not added" for the LTSR caveat.
|
| CPU-Z | `CPUID.CPU-Z` | Inno, machine | `installer_locale` pinned to
en-US (manifest also carries zh-CN); `/ALLUSERS` added to Inno switches;
versioned ARP name → fuzzy. |
| CodeMeter Runtime Kit | `Wibu-Systems.CodeMeterRuntimeKit` | Vendor
bootstrapper embedding MSI, x64 | `installer_scope: ""` (manifest
declares no scope; embedded MSI is per-machine). Install `/q /nosplash
/ComponentArgs "*":"/quiet /norestart"`; uninstall via msiexec by ARP
name prefix. Identity verified by carving the embedded MSI. |
| ClipboardFusion | `BinaryFortress.ClipboardFusion` | Inno, machine,
x64 | ARP name carries a locale-dependent "(64-bit)" suffix → fuzzy
pattern `ClipboardFusion%`; `/LAUNCHAFTER=0` prevents post-install
launch. |
| CloudShow | `BinaryFortress.CloudShow` | Inno, machine, x64 | Same
Binary Fortress framework; ARP name "CloudShow Launcher (64-bit)" is
framework-inferred (no third-party corroboration exists) — the CI
validator is the confirmation. |
| ClockAssist | `ClockAssist.ClockAssist` | MSI, machine, x64 |
Latest-pointer URL but actively maintained manifest (bot replaces the
single version dir ~6-weekly) → `ignore_hash`. |
| Crestron AirMedia | `Crestron.AirMedia` | MSI, machine, x86 | ARP name
is "Crestron AirMedia Machine-Wide Installer" (Teams-style per-user
stamping); identity from msiinfo. |
| Crestron AirMedia Peripherals | `Crestron.AirMediaPeripherals` | MSI,
machine, x64 | Clean MSI. LaunchCondition fails install (1603) on hosts
with a pending reboot — noted. |
| CrisisGo | `CrisisGo.CrisisGo` | InstallShield Basic MSI, machine, x86
| Custom install script passes `ISSETUPDRIVEN=1` to defuse the "must run
setup.exe" guard (vendor ships this bare MSI for network deployment;
winget sandbox validates it). |
| Cyberduck CLI | `Iterate.CyberduckCLI` | MSI, machine, x64 | Clean WiX
MSI. winget lags the vendor by ~4 releases, but pinned URLs stay live,
so installs work — just not bleeding-edge. |
| Cisco Webex Recorder and Player | `Cisco.WebexRecorderAndPlayer` |
InstallShield MSI, machine, x86 | Legacy WRF player but actively updated
by Cisco (8 winget bumps in 10 months); latest-pointer URL →
`ignore_hash`. |
| Creative Force Kelvin | `CreativeForce.Kelvin` | WiX MSI, machine, x64
| Manifest offers per-user NSIS, machine NSIS, and MSI — the MSI is
selected (unversioned ARP name "Kelvin"). |
| Creative Force Triad | `CreativeForce.Triad` | NSIS
(electron-builder), machine, x64 | `/allusers /S`; versioned ARP name →
fuzzy. |
| Cube Browser | `RystadEnergy.CubeBrowser` | WiX burn bundle, machine,
x64 | Bundle Arp manifest carved from the installer ("Cube Browser (64
bit)"); dual-mode uninstall (prefers bundle entry, msiexec fallback)
since bundle + chained MSI may both register the same name. |

Considered but **not** added (recorded in the workstream tracker):
- **Citrix Workspace app LTSR** (`Citrix.Workspace.LTSR`): the LTSR and
current tracks register the **identical** ARP key
(`CitrixOnlinePluginPackWeb`) and the same "Citrix Workspace \<YYMM\>"
DisplayName with no LTSR marker — the only discriminator is a registry
value outside the programs table, so Fleet inventory cannot tell the
tracks apart. An LTSR FMA would cross-match current-release installs
(and vice versa). **Consequence for the shipped Citrix Workspace FMA:**
hosts running LTSR will match it and may show "update available" toward
the current release — flagged here for reviewer judgment.
- **Charles** (`XK72.Charles`): all winget 5.x manifests are per-user
MSIX only. The vendor ships a machine-scope MSI for 5.2 but it isn't
indexed in winget; revisit if the manifest adds it.
- **Calibrite Profiler** (`Calibrite.PROFILER`): abandoned winget
manifest — one version dir ever while the vendor is five releases and a
major version ahead.
- **Cloud Drive Mapper** (`IAMCloud.CloudDriveMapperV3`): latest-pointer
URL whose manifest SHA is already stale, and the MSI sets
`ARPSYSTEMCOMPONENT=1`, hiding the ARP entry from inventory entirely.
- **CloudCompare** (`CloudCompare.CloudCompare`): registry
DisplayVersion (and the winget PackageVersion itself) embed a
parenthetical date — "2.13.2 (07-06-2024)" — which breaks version
comparison; manifest also stale.
- **Classic Shell** (`IvoSoft.ClassicShell`): development ended in 2017;
superseded by Open-Shell. (CutePDF Writer was already deferred in the
letter A batch.)

Identities verified per app (msiinfo Property tables; burn bundle Arp
manifests carved from installers; AppxManifest/electron-builder sources;
uninstall-database corroboration). SHAs verified against manifests for
pinned URLs; `ignore_hash` used only where the manifest is demonstrably
actively maintained. Icons via `tools/software/icons/generate-icons.sh`;
the pre-existing CitrixWorkspace icon component is reused untouched.

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [ ] QA'd all new/changed functionality manually (relying on the FMA CI
validator for Windows install/uninstall validation)
 2026-07-08 15:13:21 -05:00
Lucas Manuel Rodriguez 4449830add Fix lint for linux only code (#48962) 
- [X] QA'd all new/changed functionality manually

Fixes:
```
make lint-go
[...]
orbit/pkg/luks/snapd_client.go:21:7: const snapdSocketPath is unused (unused)
const snapdSocketPath = "/run/snapd.socket"
      ^
orbit/pkg/luks/snapd_client.go:46:6: func newSnapdClient is unused (unused)
func newSnapdClient() *snapdClient {
     ^
orbit/pkg/luks/snapd_fde.go:62:6: func newSnapdSocketFDE is unused (unused)
func newSnapdSocketFDE() *snapdSocketFDE {
     ^
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved Linux-specific handling for recovery-key and snapd
interactions.
* Added fallback behavior when an existing keyslot causes a conflict, so
recovery-key setup can still complete successfully.
  * Better surfaces error messages from failed snapd requests.

* **Tests**
* Added Linux-only tests covering synchronous and asynchronous snapd
request flows.
* Added coverage for recovery-key creation, polling, fallback
replacement, and error responses.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-08 15:59:35 -03:00
Nico 4c6aa754e0 Time ago timestamps: use days instead of months when under 90 days (#48964) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46965

Relative "time ago" timestamps switched to months at ~30 days, so a
timestamp 45 days ago read "about 2 months ago" (even 89 days showed "3
months ago"). This centralizes the day/month cutoff in a new `timeAgo`
helper and routes existing call sites through it, so anything under 90
days is shown in days.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Relative “time ago” timestamps now keep values in **days** for items
under **90 days**, switching to **months** later for more accurate
wording.
* Improved consistency of relative time labels across status modals,
activity feeds, host details, and management screens (including “last
updated,” “uploaded,” and “added” text).
* **Tests**
* Added/updated coverage for the shared relative-time cutoff and
formatting behavior to prevent regressions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-08 15:07:48 -03:00
Jonathan Katz 6d1938b914 Fix test setting flag that caused further tests to fail (#48947) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #
Moves `TestInstallAllSelfServiceSoftware` from the enterprise
integration suite (`TestIntegrationsEnterprise`) to the MDM integration
suite (`TestIntegrationsMDM`), because setting the
`MDM.EnabledAndConfigured` flag in the enterprise suite was leaking into
and failing other tests (`TestLinuxDiskEncryption`, `TestTeamEndpoints`,
`TestTeamSpecs`, `TestMDMNotConfiguredEndpoints`,
`TestVPPAppsWithoutMDM`,
`TestOrbitSetupExperienceStatusChecksAuthBeforeMDM`).


# Checklist for submitter

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually
- checking this to avoid a CI failure, but there is nothing to actually
manually check

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
* Expanded integration coverage for self-service software installs
across team, label, category, and multi-host scenarios.
* Added checks for install ordering, idempotency, queue consistency, and
concurrent requests.
* Included coverage for VPP-backed apps and mixed install queues to
better validate real-world behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-08 13:11:01 -04:00
Nico 5b2a1b9de0 fleet-mcp: use /fleets endpoints instead of legacy /teams (#48791) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Relates to #43544

The Fleet MCP calls the legacy `/api/v1/fleet/teams` routes for fleet
and policy lookups. Fleet's current API endpoints catalog only lists the
renamed `/fleets` routes, so an endpoint-restricted api-only user cannot
be granted `/teams` and those calls return 403. This switches the MCP to
the `/fleets` paths, which return the same response shape, so fleet
resolution and per-fleet policy compliance work under a least-privilege
token. Verified against a running Fleet.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Team-related Fleet data now loads from the correct service endpoints,
improving policy and compliance views.
* Policy listings and policy detail checks for teams should now return
the expected results.
  * Updated test coverage to match the revised Fleet route behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-08 13:50:39 -03:00
Luke HeathClaude Fable 5Lucas Manuel Rodriguez
 		003ab766d3 Filter cross-team memberships from user list responses (#48890) 
From Lucas:
- [X] QA'd all new/changed functionality manually

## Summary

A team-scoped admin listing users of a team they administer (`GET
/api/latest/fleet/users?team_id=A`) received the full team membership —
team IDs, names, and roles — of any user also shared with other teams,
disclosing teams the requester has no role in.

The single-user `GET /users/{id}` endpoint already blocks this: its
authorization requires the requester to administer *every* team the
target belongs to. The list endpoint authorizes against a synthetic
single-team object (correct, so team admins can manage their members),
but then returned each user's complete team list as loaded by the
datastore.

This filters each returned user's teams down to the requester's scope at
the response layer. Requesters with any global role are unchanged
(they're authorized to see all teams).

## Why the response layer, not `Service.User`

`ModifyUser` and the password-reset flow reuse `Service.User` and read
`user.Teams` to compute write diffs. Filtering there would silently drop
team memberships on edits, so the filter is applied in
`listUsersEndpoint` only.

`GET /users/{id}` is intentionally not changed — it is not exploitable
(authz already requires admin-of-all-the-target's-teams), and its
legitimate readers should keep seeing the full team list.

## Testing

- `TestListUsersFiltersTeamsToRequesterScope` — team-1 admin listing
team 1 sees only team 1 for a user shared with {1,2}.
- `TestListUsersGlobalRequesterSeesAllTeams` — global admin sees all
teams.
- Existing `TestUserAuth` / `TestAuthorizeUser` pass unchanged (no authz
regression).

Fixes fleetdm/confidential#16691

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Fixed user listing so returned team membership details are scoped to
the requesting user’s permissions, including fleet-scoped context.
* Team-scoped requesters now only see memberships for teams they’re
allowed to view; global-role requesters still see all memberships.
* When scoped viewer context is missing, team membership details are no
longer included in the response.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
 2026-07-08 13:43:14 -03:00
Steven Palmesano c759f92f14 Include mobile hosts by default in "Hosts online" chart (#48769) 
**Related issue:** Resolves #47661

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.


## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features / Improvements**
* The “Hosts online” chart now includes mobile platforms
(iOS/iPadOS/Android) by default, alongside desktop platforms.

* **Bug Fixes**
* Initial load no longer shows a default “Filtered” badge; the chart
reflects the full default platform selection.

* **Documentation**
* Updated the “Hosts online” tooltip to clarify how locked iOS/iPadOS,
lid-closed Mac, and locked Android states affect the online count.

* **Tests**
* Updated chart card tests to match the new default platform behavior
and initial chart request parameters.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-08 11:38:26 -05:00
Allen Houchins 360789913a Add icon for Okta Advanced Server Access macOS FMA (#48956) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->

The Okta Advanced Server Access macOS Fleet-maintained app had no icon —
the Fleet UI fell back to the generic package icon, and the fleetdm.com
software catalog used the fallback icon.

The icon was extracted from the vendor's `ScaleFT.app` bundle inside
`ScaleFT-1.108.0.pkg` (downloaded from the URL in
`ee/maintained-apps/outputs/okta-advanced-server-access/darwin.json`;
SHA-256 verified against the manifest) and generated with
`tools/software/icons/generate-icons.sh`:

- `frontend/pages/SoftwarePage/components/icons/ScaleFt.tsx`: new icon
component.
- `frontend/pages/SoftwarePage/components/icons/index.ts`: two map
entries — `"okta advanced server access"` (matches the FMA list name)
and `"scaleft"` (matches host inventory, since the app's `CFBundleName`
is `ScaleFT` and there is no `CFBundleDisplayName`).
-
`website/assets/images/app-icon-okta-advanced-server-access-60x60@2x.png`:
128×128 PNG for the fleetdm.com software catalog (filename follows the
`app-icon-<slug>` convention used by `build-static-content.js`).

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Added a new software icon for ScaleFT/Okta Advanced Server Access.
* The icon now appears automatically when those software names are
recognized in the app.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-08 11:30:00 -05:00
Rahul Raghunathan c92b848919 Return to previous page when the last policy on a page is deleted (#48683) 
**Related issue:** Resolves #48641

## Description

Deleting the only policy on a paginated page (e.g., 21 policies, with 1
on page 2) left the user stranded on a now-empty page showing the "No
policies" empty state. The policies list now steps back to the previous
page when a delete empties the current page.

**Before:** delete last policy on page 2 → empty state.
**After:** delete last policy on page 2 → list returns to page 1.

### Screen recording demonstrating the fix


https://github.com/user-attachments/assets/ae106a50-7f9b-4080-a19c-53e0c60fff48


# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Server-side paginated tables now recover from empty states after
deleting the last row on a page by redirecting to the last page that
still has data.
* Improved empty-state pagination handling for out-of-range pages,
loading states, and cases where the total row count is known (including
zero), avoiding unnecessary or repeated navigation.
* Simplified the empty-state pagination UI to render only the empty
component.
* **Tests**
* Expanded regression test coverage for server-side pagination edge
cases and page-correction behavior to prevent future regressions.
* **Style**
* Removed unused empty/previous-button styling rules in the table
container.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-08 13:14:14 -03:00
Tim Lee 496d4f5e24 Controls > OS settings > Certificates: View certificates (#48460) 2026-07-08 09:59:20 -06:00
Allen Houchins 2708df6f40 Add Windows FMAs (letter B): 5 apps (#48950) 
**Related issue:** N/A — part of the Windows Fleet-maintained apps
catalog expansion (letter B batch; follows #48872 and #48881).

Adds six new Windows Fleet-maintained apps:

| App | winget package | Installer | Notes |
|-----|----------------|-----------|-------|
| BandiView | `Bandisoft.BandiView` | EXE (NSIS-style), machine, x64 |
Unversioned InstallerUrl → `ignore_hash` (URL verified to serve the
binary reliably without Referer tricks). DisplayName "BandiView" stable
across releases. |
| BleachBit | `BleachBit.BleachBit` | EXE (NsisMultiUser), machine, x86
| Install script passes the case-sensitive `/allusers /S` — without
`/allusers` the NsisMultiUser installer's scope is ambiguous. winget
declares a VCRedist 2010 x86 dependency Fleet can't satisfy; noted as a
caveat. |
| Bulk Crap Uninstaller | `Klocman.BulkCrapUninstaller` | EXE (Inno),
machine, x86 | ARP DisplayName is versioned ("BCUninstaller 6.2.0.0")
and never matches the friendly name, so `unique_identifier`
"BCUninstaller" + `fuzzy_match_name`. Registry version is 4-part vs
winget's "6.2" — `version_compare` pads, verified consistent. |
| BrowserStackLocal | `BrowserStack.BrowserStackLocal` | MSI (WiX),
machine, x64 | Clean MSI (ALLUSERS=1, identity verified via msiinfo).
Unversioned InstallerUrl → `ignore_hash`. |
| Burp Suite Professional | `PortSwigger.BurpSuite.Professional` | EXE
(install4j), machine, x64 | Mirrors the existing Burp Suite Community
FMA: `-q -Dinstall4j.suppressUnattendedReboot=true` plus the
load-bearing `-dir` into Program Files (install4j defaults to per-user
otherwise). DisplayName is versioned **without** "Edition" ("Burp Suite
Professional 2026.3.3"), unlike Community — fuzzy pattern `Burp Suite
Professional %` can't collide with Community's. |
| Bytello Share | `Bytello.BytelloShare` | EXE (NSIS), machine, x86 |
Uses the nullsoft `agent=d` variant whose ARP identity ("Bytello Share"
/ publisher "Bytello Share") matches real-world inventory; the zip
variant registers a different name ("BytelloShare") and its nested-MSI
path is version-pinned and already stale. Vendor URL is a latest-pointer
already ahead of winget → `ignore_hash`. **Note:** the input says
`installer_type: "msi"` — the ingester classifies this nullsoft entry as
msi because its URL has no file extension (vendor-type → URL-extension →
machine-scope fallback chain in `ingester.go`); the custom scripts
handle the actual NSIS exe. |

Considered but **not** added (recorded in the workstream tracker):
- **Bambu Studio** (`Bambulab.Bambustudio`): the uninstaller shows a
keep-user-data confirmation dialog even with `/S` (deployment guides
work around it with Send-Keys, impossible in a SYSTEM session) — same
failure class that disqualified Adobe AIR in the letter A batch.
- **Bridge Designer** (`StephenRessler.BridgeDesigner`): installer URL
404s (file removed from SourceForge) and the desktop product was
discontinued July 1, 2026 in favor of a browser-based edition.
- **BurnAware Free** (`Burnaware.BurnAwareFree`): the vendor deletes
each old release URL — the winget-pinned installer already redirects to
their homepage, so pinned downloads break every release cycle.

Registry identities were verified per app (msiinfo Property tables for
MSIs; vendor installer sources, winget AppsAndFeaturesEntries, and
uninstall-database corroboration for EXEs). Installer SHAs verified
against manifests where URLs are version-pinned; unversioned URLs use
`ignore_hash` per the TeamViewer/Chrome precedent. Icons generated via
`tools/software/icons/generate-icons.sh`.

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [ ] QA'd all new/changed functionality manually (relying on the FMA CI
validator for Windows install/uninstall validation)
 2026-07-08 10:53:02 -05:00
Allen Houchins 08c22ebe58 Install Okta Verify on Windows workstations via Fleet-maintained app (#48952) 
**Related issue:** N/A (dogfood GitOps change)

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] QA'd all new/changed functionality manually (YAML validated; will
verify install + patch policy on a Windows workstation after the GitOps
run applies)

## Details

Adds Okta Verify to Windows devices on the Workstations team following
the same pattern used for it on macOS, including the patch policy:

- Replaces the custom-package Okta Verify install
(`$DOGFOOD_OKTA_VERIFY_WINDOWS_URL` + custom install/uninstall scripts)
with the `okta-verify/windows` Fleet-maintained app — `self_service:
true`, `setup_experience: true`, category Security, scoped to "x86-based
Windows hosts" (the FMA installer is x86-only).
- Adds a "Windows - Okta Verify up to date" patch policy with
`install_software: true` for automatic remediation, mirroring the macOS
policy.
- Adds the "x86 Windows hosts with Okta Verify installed" label that
scopes the patch policy to hosts that already have the app.
- Cleanup: deletes the now-orphaned custom package YAML and
`okta_verify_*.ps1` scripts. Follow-up (not in this PR — requires
`workflow` scope): remove the now-unused
`DOGFOOD_OKTA_VERIFY_WINDOWS_URL` env line from
`.github/workflows/dogfood-gitops.yml` and delete the GitHub secret.
Harmless in the meantime — the env var is exported but nothing consumes
it.

Hosts that installed Okta Verify from the old custom package are picked
up by the new label, and the patch policy will auto-update them to the
FMA version (currently 6.10.2.0) if they fall behind.
 2026-07-08 10:41:49 -05:00
Victor Lyuboslavskyandmelpike cb09b42985 User must be logged in for Windows MDM enrollment (#48932) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46302

---------

Co-authored-by: melpike <79950145+melpike@users.noreply.github.com>
 2026-07-08 16:14:11 +01:00
Mike McNeil 9587374d20 Website: Add convenience redirect for typos: Update routes.js (#48831) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added a new redirect so visits to `/gitops-workshops` now go to
`/workshops`.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-08 10:01:23 -05:00
fleet-releaseandallenhouchins 2a1f513565 Update Fleet-maintained apps (#48936) 
Automated ingestion of latest Fleet-maintained app data.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Updated several app packages to newer releases, including Adobe DNG
Converter, BitBox, Capto, Cursor, Dropshare, Fastmail, GitKraken,
GoLand, Google Chrome, Gemini, Krisp, Melodics, Notion, PhpStorm,
Postman, Readest, RightFont, Rive, RubyMine, Sequel Ace, TablePlus,
Unity Hub, Viscosity, Visual Studio Code, WebStorm, Windows App, and
Worksheet Crafter.
* Improved some macOS install/uninstall flows to better handle apps that
are already running and to clean up leftover preference files.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
 2026-07-08 09:15:40 -05:00
Lucas Manuel Rodriguez 646ebd09e3 Remove Zorin from platform for labels (#48937) 
Fixing `Zorin OS` incorrectly showing up as platform option for labels.

Coming soon we'll have a "Linux" platform for labels
(https://github.com/fleetdm/fleet/issues/44088).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Removed **Zorin OS** from the platform dropdown, so it is no longer
available as a selectable option.


<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-08 10:49:54 -03:00
Victor Lyuboslavsky 19aac451e1 Fix Windows CSP bypass issue (#48843) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48752 

Stacked PR. Needs 48349-windows-modify branch to merge first.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed a Windows MDM loophole where scope-less or differently formatted
`LocURI` values could bypass Fleet restrictions.
* Strengthened detection and enforcement for reserved Windows targets,
including OS updates, remote wipe premium gating, and BitLocker
restrictions.
* Improved `LocURI` handling to be resilient to whitespace and alternate
formatting, including more consistent SCEP profile processing.

* **Tests**
* Added regression coverage for reserved `LocURI` matching, OS-update
targeting, and premium detection for wipe commands (including scope-less
cases).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-08 14:38:10 +01:00
Mike ThomasandEric b6e0cac4ae Website retire old success stories (#48921) 
Retires old success stories and redirects `/success-stories` to
`/customers`.

@eashaw, is there anything else / different that needs to be done to
retire these old pages? I suspect there will still be some article
category artifacts hanging around.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Updated story-related redirects so visitors are sent to the customers
page instead of older story URLs.
* Fixed deprecated device-management “fleet user story” links to land on
the customers page.
* Adjusted article page metadata and category resolution so the “success
stories” category no longer uses the previous titles/descriptions or
friendly-name mapping.
* **Chores**
* Updated static-content build rules for allowed category values and
adjusted how certain category URL prefixes are generated.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Eric <eashaw@sailsjs.com>
 2026-07-08 07:29:30 -05:00
CarloandCopilot Autofix powered by AI 9463a46c32 Fix Windows software ingest lock contention by matching titles on upgrade_code (#48902) 
**Related issue:** Resolves #48875

  # Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

  ## Testing

  - [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
  - [x] QA'd all new/changed functionality manually

  For unreleased bug fixes in a release candidate, one of:

- [x] Confirmed that the fix is not expected to adversely impact load
test results

**Functional:** `TestSoftwareTitleUpgradeCodeDriftMatch` (added here): a
host reporting a Windows program whose name has drifted from the stored
title but shares its `upgrade_code` must resolve to the existing title.
Fails on pre-fix code, passes with the fix.

**Load:** 25 concurrent hosts × 4 rounds, each reporting 50 drifted
programs (sharing the stored `upgrade_code`s) through
`UpdateHostSoftware`; doomed inserts counted via the MySQL general log:

  | concurrent-burst metric | without fix | with fix |
  |---|---|---|
  | doomed `INSERT IGNORE INTO software_titles` | 175 | 0 |
  | `Innodb_row_lock_waits` (Δ) | 715 | 0 |
  | burst wall time | ~4.9 s | ~0.2 s (~25× faster) |

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **Bug Fixes**
* Improved matching for Windows software programs when the displayed
name changes but the upgrade code remains the same.
* More reliably reuses existing software titles during ingest, reducing
duplicate title entries.
* Added a regression test to confirm upgrade-code matches take priority
and unknown upgrade codes don’t create false matches.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-07-08 08:00:05 -04:00
Steven Palmesano e37017ce0c Replace duplicate code with existing getDisplayedSoftwareName helper (#48311) 
Follow-up to
https://github.com/fleetdm/fleet/pull/46839#discussion_r3475389665.

Related to #46921.

# Checklist for submitter

## Testing

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved how software names are shown in install status views, so the
displayed name now better matches the preferred label.
* Added support for host online status when determining install status
display and tooltip text, improving the accuracy of status messaging.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-08 06:51:50 -05:00
Magnus Jensen ace8cf046b SAAD: DDM Asset table migration (#48866) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48566 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. Coming in bigger backend story.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added support for tracking Apple declaration assets, including a new
asset record and a link table for associating assets with declarations.
* Added a new timestamp on declarations to reflect the latest asset
update time.

* **Bug Fixes**
* Strengthened database constraints to prevent duplicate asset entries
and enforce valid asset/declaration references.
* Improved delete behavior so referenced declarations clean up related
links automatically.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-08 09:17:33 +02:00
fleet-releaseandallenhouchins 31a6bb8734 Update Fleet-maintained apps (#48920) 
Automated ingestion of latest Fleet-maintained app data.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Refreshed installer metadata for many maintained apps on macOS and
Windows, including AdGuard, Firefox, Docker Desktop, Notion, Zotero, and
others.
* Updated version checks, download links, and package hashes so the
latest app releases are recognized and installed correctly.
  * Improved cleanup behavior for a few apps’ removal flows.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
 2026-07-07 20:50:18 -05:00
Eric 21c11220a7 Website: cache workshop details in platform record (#48882) 
Closes: https://github.com/fleetdm/fleet/issues/48142

Changes:
- Added two new attributes to the website's platform record:
`workshopDetails`, an array containing formatted event details to be
used on the /workshops page, and `workshopDetailsLastUpdatedAt`, a JS
timestamp representing when workshop event details were last retrieved
from the EventBrite API
- Update the website's bootstrap configuration to create a platform
record
- Updated the view action for the workshops page to load workshop event
details from the database if they were updated less than two hours ago.
 2026-07-07 17:31:08 -05:00
kitzy 0e2a0f2d05 Revise contributor roles and maintainer information (#48834) 
Handbook update
 2026-07-07 22:51:29 +01:00
Eric 189e7a87e2 Website: remove duplicate/unused form-data from the website's package-lock (#48908) 
Changes:
- Removed the top-level `node-modules/form-data` dependency from the
website's package-lock.json.
 2026-07-07 15:35:05 -05:00
Dante Catalfamo 4351f4cee5 escrow snapd TPM-backed FDE recovery keys from orbit (#48452) 
**Related issue:** Resolves #44428
 2026-07-07 16:25:20 -04:00
Dante Catalfamo 57dc28991a Add resolved-in-version override for CVE-2025-63389 on Ollama (#48525) 
**Related issue:** Resolves #44800
 2026-07-07 16:24:41 -04:00
RachelElysia 0b9ca60e73 Fleet UI: Restore download button for script-only packages (#48909) 2026-07-07 13:20:19 -07:00
RachelElysia c21d5fad09 Fleet UI: 'Latest' pin only shows on Fleet-maintained apps (#48871) 2026-07-07 13:18:11 -07:00
Carlo dfe0f1c871 Fix App Store picker 403 for non-admin roles (#48856) 
**Related issue:** Resolves #46057

Authorize `GetVPPTokens` against `VPPApp` instead of admin-only
`AppleCSR`, so maintainer/technician roles no longer get a 403 that
broke the App Store picker.

  # Checklist for submitter

  - [x] Changes file added for user-visible changes in `changes/`.

  ## Testing

  - [x] Added/updated automated tests
  - [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Fixed the “Add software > App Store” picker so maintainer and
technician roles no longer encounter access errors when browsing VPP
tokens.
* Improved VPP token visibility for team-scoped users by restricting
listings to teams they can read, while including “all teams” tokens and
excluding unassigned/unauthorized ones.
* Ensured users without appropriate access receive the correct
authorization response instead of broader token listings.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-07 16:15:58 -04:00
Jonathan Katz 7b950c64a6 Add duplicate patch policy check to GitOps (#48896) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46193 

Adds a client-side check for duplicate patch policies, similar to the
existing policy name and label duplicate checks.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually
Adding two patch policies for the same fma slug results in this error:
```
Error: 1 error occurred:
	* Couldn't add multiple policies with type "patch" for "fleet_maintained_app_slug": "google-chrome/darwin".
```


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added validation to GitOps application checks to prevent multiple
patch policies from targeting the same app slug.
* Improved error reporting when patch policy slugs are duplicated or
missing from the configured app list.

* **Bug Fixes**
* Prevented duplicate patch policies from being silently accepted,
reducing the risk of one policy overwriting another.
* Existing valid combinations, such as different patch slugs or certain
mixed policy types, continue to work as expected.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-07 16:08:23 -04:00
Allen Houchins 0b929a1ff1 Add Windows FMAs (letter A): 14 apps (#48881) 
This pull request adds support for several new Windows applications to
the maintained apps catalog, primarily by introducing new JSON manifest
files for each app and, in some cases, associated PowerShell
install/uninstall scripts. These additions expand the catalog's coverage
of productivity, developer, utility, and communication tools, and
include detailed installation and uninstallation logic for certain apps.

**New application manifests:**

* Added JSON manifests for a variety of applications, including but not
limited to: Adobe AIR, Agent Ransack, AIMP, Air Explorer, alfaview,
Allway Sync, Amazon Corretto (versions 8, 11, 17), Amazon Redshift ODBC
Driver, AnyBurn, AnyDesk, AVS Image Converter, AVS Media Player, AWS
Session Manager Plugin, Azure Functions Core Tools, CutePDF Writer, and
iTunes. Each manifest specifies installation parameters, categories, and
(where applicable) custom install/uninstall scripts.
[[1]](diffhunk://#diff-891e1b685eea289f7535f5cb3e80299b2d53d22f1ecb4123a6db873b4715d5d3R1-R13)
[[2]](diffhunk://#diff-33d1963698285631553094360f1dab939589c853b20b13046aeed9c36b484120R1-R12)
[[3]](diffhunk://#diff-48b51963ae1bc8ce2e6d2aa494c7db8df854a0a6f392df70528dc80efb0d4341R1-R12)
[[4]](diffhunk://#diff-8177fe092e9e1cc91dd1582d1e4c01b05176d36dbad36ca16397a681aef7c4a5R1-R13)
[[5]](diffhunk://#diff-c1fd695df858d34d29653fb1db79c04123bbfcf432726f9356d893c7bc4e4b16R1-R11)
[[6]](diffhunk://#diff-4024c71281805493b749ec7aa95819583015483d652481954a3dd4d2ba3803e4R1-R10)
[[7]](diffhunk://#diff-8ab1198cecc28b2b9b77a8668355fd505524a59d414eb7623e9676794c03511eR1-R11)
[[8]](diffhunk://#diff-d8534d1ac84c02c1f87dae2798feae0d03fdb332d19a03fd780c9664c337ce41R1-R11)
[[9]](diffhunk://#diff-375f7eb8d9daf96d4952a5f834a4ba5fa272c034ff808b3f21dbd33cf57b7b7eR1-R10)
[[10]](diffhunk://#diff-0710c7d70ff8eb04379932f0ffd0b754626381372ef6a747858eb7b51c230723R1-R10)
[[11]](diffhunk://#diff-ce4007e90efa1fdfff5c1ca96c8dded2108642a522f30baddcefd9327c23c980R1-R13)
[[12]](diffhunk://#diff-9a7ba8c0afb32ab31c2950a4a95847fa1293411416302cd6698dc2bcb519fbfdR1-R13)
[[13]](diffhunk://#diff-02ae7cdbe54f1736023e830b66036c6f32e5eec642d888f51c6dcfbbb0bf12d0R1-R14)
[[14]](diffhunk://#diff-4d3d9fbb9e19bdf5269ff241fc1549a17b9045a04b0358c988fb81ceb03512e1R1-R14)
[[15]](diffhunk://#diff-c22a0370648cd85f36926d2412d10cb46d3f3da4a623ad4595c115496ac6cd41R1-R13)
[[16]](diffhunk://#diff-5dfe747ae19dfa1572611d72dc109a8cbfe8b379410c4154627e9d1c699670d1R1-R12)
[[17]](diffhunk://#diff-4afa6cde8c52e27d865f759ab7f2aabf5f60522cb8bfe120637a4a954194a237R1-R13)
[[18]](diffhunk://#diff-d5ad3e810b587a379fdb2722806be5a0c47eebefad540077db86d356cfd30e17R1-R12)

**Custom installation and uninstallation scripts:**

* Added PowerShell scripts for silent installation and uninstallation of
Adobe AIR, including logic to extract and execute the correct uninstall
command from the Windows registry, ensuring a clean and unattended
removal process.
[[1]](diffhunk://#diff-75bb214bff0533824521c36d0f6ff369ac7848554824f5f44faadc7c7c3225ffR1-R30)
[[2]](diffhunk://#diff-e10832f9465648bd3c3055d3ab2bde1d4cb3170db6ede0de0b0dc347ab3077f3R1-R58)

These changes improve the breadth and automation capabilities of the
maintained apps catalog, especially for environments that require silent
and reliable software deployment and removal.…esk, iTunes, Azure
Functions Core Tools

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
 2026-07-07 15:00:01 -05:00
Jordan Moore 8e62177d3a Add Okta Verify Windows FMA (#48889) 
**Related issue:** N/A

## Summary

- Add Okta Verify as a Windows Fleet-maintained app using the
`Okta.OktaVerify` winget package.
- Add custom install/uninstall scripts for the machine-scope WiX Burn
installer.
- Generate the Windows output manifest and add the Windows catalog entry
to `apps.json`.

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented, and untrusted data interpolated into shell
scripts/commands is validated against shell metacharacters.

## Testing

- [x] QA'd all new/changed functionality manually
- Installed and uninstalled Okta Verify on a Windows host successfully.

Validated with:

- `python3 -m json.tool
ee/maintained-apps/inputs/winget/okta-verify.json`
- `python3 -m json.tool
ee/maintained-apps/outputs/okta-verify/windows.json`
- `python3 -m json.tool ee/maintained-apps/outputs/apps.json`
- `go test ./cmd/maintained-apps/... ./ee/maintained-apps/...`
- `GOOS=windows go build -o
/private/tmp/fleet-maintained-apps-validate.exe
./cmd/maintained-apps/validate/`

Additional verification:

- Verified the winget manifest for `Okta.OktaVerify` version `6.10.2.0`.
- Downloaded the Okta Verify installer and confirmed its SHA-256 matches
winget:
  `065c6ad3ffc8551a29459d6cae4d06cd95a083ef716c18eb2e1215720a6b400a`.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added support for installing and uninstalling **Okta Verify** on
Windows.
  * Included app metadata so it appears in the maintained apps catalog.

* **Bug Fixes**
* Added safer install/uninstall handling, including silent execution,
better exit-code handling, and fallback cleanup when standard uninstall
entries are missing.
* Improved detection of existing installations and out-of-date versions.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-07 14:59:25 -05:00
Allen Houchins ceeaf9eea2 Add Windows FMAs (digit batch): 3DF Zephyr Free, 4K Video Downloader+ (#48872) 
**Related issue:** N/A — part of the Windows Fleet-maintained apps
catalog expansion.

Adds two new Windows Fleet-maintained apps (the "digit" batch of the
Windows FMA workstream):

| App | winget package | Installer | Notes |
|-----|----------------|-----------|-------|
| 4K Video Downloader+ | `OpenMedia.4KVideoDownloaderPlus` | EXE (WiX
burn bundle), machine scope, x64 | Bundle registration extracted from
the installer: ARP `DisplayName` "4K Video Downloader+", `Publisher`
"InterPromo GMBH" (differs from the winget locale publisher "Open Media
LLC", so `program_publisher` is set). Registers TWO ARP entries with the
same DisplayName (the bundle and its chained MSI). The uninstall script
prefers the bundle entry and normalizes msiexec args when only the MSI
entry is present (validator-confirmed). Exact DisplayName matching keeps
it from touching the non-plus product. |
| 3DF Zephyr Free | `3Dflow.3DFZephyr.Free` | EXE (Inno Setup), machine
scope, x64 | Registry DisplayName is versioned ("3DF Zephyr Free version
8.038"), so the input uses `fuzzy_match_name: true`. The paid edition
registers as "3DF Zephyr version X" (no "Free") and is not matched.
Standard Inno silent switches. |

Also considered from this batch but **not** added:
- **4K Video Downloader** (`OpenMedia.4KVideoDownloader`, the classic
4.x app): verified and validated successfully, but intentionally dropped
— it's in maintenance mode and 4K Video Downloader+ is the actively
developed successor, so we're offering only the + app.
- **3DxWare 10** (`3Dconnexion.3DxWare.10`): the vendor bootstrapper
hung for 10 minutes and exited 1 with no output in the validator's
headless SYSTEM session (driver install), so it was dropped after the
first validation run.
- **3CX Desktop App** (`3CX.Softphone`): MSIX with an unversioned
`InstallerUrl` (`.../3CX.msix`) — the file at that URL is already a
newer build (20.0.1162.0) than the manifest's pinned version/SHA
(20.0.1102.0), so installs would fail hash validation. Can be revisited
with `ignore_hash` plus Windows-App-style MSIX provisioning scripts.

Installer SHAs in the outputs were verified against the winget
manifests. Icons generated via `tools/software/icons/generate-icons.sh`;
icon component names were adjusted to valid JS identifiers
(`ThreeDfZephyrFree`, `FourKVideoDownloaderPlus`) following the
`ZeroOneZeroEditor`/`FourK*` precedent.

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [ ] QA'd all new/changed functionality manually (relying on the FMA CI
validator for Windows install/uninstall validation)
 2026-07-07 13:58:29 -05:00
Juan Fernandez 156302adb4 Fix policy automation activities missing from host activity feed 
Closes #48616

Adds missing policy automation activities to host's details page.
 2026-07-07 14:35:07 -04:00
Victor Lyuboslavsky 4608e82481 Added anonymous usage statistics reporting the number of macOS and Windows hosts enrolled in Fleet's MDM (#48840) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48685

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
- Tested `ShouldSendStatistics` method manually against our DB, which
covers all our changes.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **New Features**
* Added anonymous usage statistics for the number of macOS and Windows
hosts currently enrolled in Fleet’s MDM.

* **Bug Fixes**
* Improved statistics accuracy by counting only actually enrolled,
non-server macOS and Windows hosts that are using Fleet’s MDM.

* **Tests**
* Updated and extended statistics tests to verify the new enrollment
counts are computed and reported correctly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-07 19:22:31 +01:00
RachelElysia 2d64dccd79 Fleet UI: Fix ManageSoftwareAutomationsModal test type errors (#48878) 2026-07-07 10:38:07 -07:00
Jordan Montgomery 4c79d6bddd Add user-scoped declaration support (#48796) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added support for Apple declarative management declarations on both
System and User channels.
* User-scoped declarations are now delivered, reconciled, and
acknowledged independently from device-scoped declarations.
* **Bug Fixes**
* Prevented scope-mixing so declaration items and status updates no
longer affect the wrong channel.
* Tightened reconciliation behavior for scope changes and missing user
channels.
* **Tests**
* Expanded coverage for channel isolation, payload scope
parsing/validation, and correct delivery payload behavior (including
stripping the payload-scope field from delivered JSON).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-07 13:15:14 -04:00
Jordan MontgomeryandCopilot Autofix powered by AI 3b7c88fb87 Fix dupe profile enqueue bug (#48652) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48633

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Prevented duplicate profile enqueueing for hosts that share the same
hardware UUID.
* Reconcile processing now consistently picks the highest matching host
record when duplicates exist.
* Duplicate enrollment IDs are now filtered out before queueing,
reducing repeated work and avoiding queue conflicts.

* **Tests**
* Added regression coverage for duplicate-host and duplicate-enqueue
reconcile scenarios.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-07-07 13:08:26 -04:00
kilo-code-bot[bot]Rachael ShawLucas Manuel Rodriguezkiloconnect[bot]melpikeMarko LisicaMike Thomas
 		28f4da083b [Docs] Add end user account type section to setup experience guide (#44855) 
## Summary

- Adds a new "End user account type" section to
`articles/setup-experience.md` explaining:
- What standard vs. admin accounts can/cannot do on macOS, Windows, and
Linux
- What the OS default account type is on each platform (macOS: admin,
Windows: admin, Linux: standard)
- How Fleet's `end_user_local_account_type` MDM setting lets admins
enforce standard or admin account types on enrolled hosts

Closes #41781

Built for [Mel
Pike](https://fleetdm.slack.com/archives/D0AKX7DJFCN/p1778087024445999?thread_ts=1777299502.461149&cid=D0AKX7DJFCN)
by [Kilo for Slack](https://kilo.ai/slack)

---------

Co-authored-by: Rachael Shaw <r@rachael.wtf>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: melpike <79950145+melpike@users.noreply.github.com>
Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com>
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
 2026-07-07 10:53:21 -06:00
George Karr af51636bda tools: bump x/net and x/crypto to clear high-severity CVE alerts (#48822) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** NA — resolves high-severity code-scanning alerts in
`tools/`

Bumps the outdated `golang.org/x/net` and `golang.org/x/crypto` indirect
dependencies in the four `tools/` Go modules to clear 39 high-severity
code-scanning (SCA) alerts on `main`. Target versions match the root
Fleet
module.

| Module | x/net | x/crypto |
| --- | --- | --- |
| `tools/dibble` | v0.53.0 → **v0.55.0** | v0.50.0 → **v0.52.0** |
| `tools/hangar` | v0.53.0 → **v0.55.0** | v0.50.0 → **v0.52.0** |
| `tools/terraform` | v0.48.0 → **v0.55.0** | v0.46.0 → **v0.52.0** |
| `tools/github-manage` | v0.38.0 → **v0.55.0** | — |

CVEs cleared:
- **x/net v0.55.0**: CVE-2026-25681, -27136, -33814, -39821, -42502
- **x/crypto v0.52.0**: CVE-2026-39827, -39828, -39829, -39830, -39832,
-39835, -42508, -46595, -46597

All four modules `go mod verify` clean and build. Dependency-only change
to
internal dev tooling — no product code, no user-visible behavior.

> The remaining 8 high-severity alerts in `tools/` are OpenSSF Scorecard
> "Binary-Artifacts" findings for embedded dibble seed installers; those
are
> tracked separately and not addressed here.

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated several bundled Go dependencies across internal tooling to
newer versions.
* This includes refreshes to common networking, cryptography, text, and
system packages, plus one added telemetry-related dependency.
  * No user-facing features or behavior changes were introduced.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-07 11:25:01 -05:00
Steven Palmesano 5f3ea66ca0 Enable "Turn off MDM" button for offline macOS devices (#46651) 
The original implementation (#8206) explicitly disabled this for offline
hosts until MDM command queueing was supported. That work has since been
completed, so offline macOS hosts now behave the same as iOS/iPadOS: the
unenroll command is queued and delivered when the device comes back
online.

**Related issue:** Resolves #25217

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.


## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* The "Turn off MDM" action is now enabled for offline macOS hosts.
Unenroll commands can be queued while a device is offline and will be
delivered automatically when it reconnects, matching the behavior for
iOS and iPadOS.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-07 11:20:45 -05:00
Steven Palmesano 1d1be298a9 Add /enroll URL for macOS in Add hosts modal (#47528) 
**Related issue:** Resolves #38874

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.


## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added macOS enrollment details in the “Add hosts” flow, including a
clearer choice between **Personal (BYOD)** and **Company-owned**
devices.
* Shows a copyable macOS enrollment URL when MDM is configured, updating
the URL based on the selected device type.
* Keeps the macOS setup experience aligned with the enrollment method,
including packaging guidance when MDM isn’t enabled.
* **Tests**
* Added coverage for macOS enrollment URL rendering and device-type
switching in the “Add hosts” modal.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-07 11:18:45 -05:00
Carlo d85dd50166 Add onURLBlur handler for InputField (#48854) 
**Related issue:** Resolves #40410

  # Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`. See
[Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated (webhook Destination URL is now
validated on blur, matching the other URL fields in the app).

  ## Testing

  - [x] QA'd all new/changed functionality manually


[qa-40410.webm](https://github.com/user-attachments/assets/eefdddf0-a6dd-47d0-b819-89e9ac99c6f1)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved “Destination URL” validation by checking the URL when the
field loses focus and surfacing invalid webhook URLs immediately.
* Validation and error display are now suppressed when vulnerability
automations are disabled or when GitOps mode is enabled, preventing
confusing blur-time errors.
* **Tests**
* Added automated coverage for blur-time URL validation, including
typing/clearing behavior, valid vs empty states, and GitOps mode
scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-07 11:52:35 -04:00
Victor Lyuboslavsky da59512037 Updated osquery-perf for certs (#48499) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #31294 

osquery-perf changes only

# Checklist for submitter

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **New Features**
* Added a certificate inventory simulation to the performance tool,
including stable shared certificates and per-host generated
certificates.
* Enhanced macOS and Windows rendering to better match expected
certificate query output (including user vs machine scope formatting).

* **Bug Fixes**
* Improved per-host certificate cache behavior with realistic
refresh/churn.
* Added support for duplicated certificate identities across different
scopes.

* **Chores**
* Updated linting configuration to suppress gosec findings for the new
certificate simulation workload.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-07 16:30:11 +01:00
Victor Lyuboslavsky 8f3624cf0a Fixed Windows profile modify batch (#48474) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48349, as well as a few other minor issues
found during dev (such as canonical LocURI, ensuring we delete the CSP
version actually on the device, etc.).

Load tested the fix.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

## Database migrations

- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Windows profile edits and deletions now handle large environments more
reliably, with faster processing and no size-based timeouts.
* Removed profile content is now cleaned up asynchronously, improving
the responsiveness of profile changes.
* **Bug Fixes**
* Fixed Windows profile edits so removed settings are deleted correctly
even when profiles are updated instead of fully removed.
* Improved matching for Windows configuration targets, making cleanup
more consistent across profile versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-07 16:29:53 +01:00
Victor Lyuboslavsky 3fa0f42a85 Move fleetd Windows MDM changelog entry to orbit/changes (#48837) 
The #48760 fix is an orbit/fleetd change, so its changelog entry belongs
under orbit/changes/ rather than the server changes/ directory.

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48760
 2026-07-07 16:29:37 +01:00