This pull request updates the environment variable configuration for
Okta metadata URLs in the `dogfood-gitops` GitHub Actions workflow.
Instead of using a single metadata URL, the workflow now distinguishes
between admin and end user metadata URLs.
Workflow configuration changes:
* Split the `DOGFOOD_OKTA_METADATA_URL` environment variable into two
separate variables: `DOGFOOD_OKTA_METADATA_URL_ADMINS` and
`DOGFOOD_OKTA_METADATA_URL_END_USERS` in the
`.github/workflows/dogfood-gitops.yml` workflow file.
Changes:
- Updated the GitOps workshop page's view action to omit events without
a venue set. (Note: this is a quick fix to resolve 500 errors on that
page, and I will create a follow up PR to display events without a venue
set)
Resolves#41534
Added GET /api/v1/fleet/hosts/{id}/reports endpoint (also accessible as
/hosts/{id}/queries) that lists the query reports associated with a
specific host.
Resolves#41863
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
Tests performed on the following OSs:
- Windows (arm64)
- macOS (Apple silicon)
- Linux (arm64)
- Linux (amd64)
Features tested on the OSs above:
- "My device".
- Restart fleetd.
- Kill fleet desktop, should re-start.
- Killing stale osqueryd processes on orbit startup.
- Checking if osquery is up and running, exit and start.
- Checking if Fleet Desktop is already running before launching it.
- orbit auto update
- Gracefully shutting down Fleet Desktop before restarting it
---
## fleetd/orbit/Fleet Desktop
- [X] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41857
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
- Tested 010 Editor on macOS
## Summary
- Adds `'Registered for a conference'` to the `intentSignal` `isIn`
array in three files:
- `website/api/helpers/salesforce/create-historical-event.js` — between
`'Signed up for Fleet event'` and `'Engaged with Fleetie at event'`
- `website/api/controllers/webhooks/receive-from-clay.js` — between
`'Signed up for Fleet event'` and `'Engaged with Fleetie at event'`
-
`website/api/helpers/salesforce/update-or-create-contact-and-account.js`
— added to the `isIn` array
- This replaces the incorrect approach in PR #41918, which added the
signal to the handbook markdown table instead of the code where intent
signals are validated.
---
Built for [Sam
Pfluger](https://fleetdm.slack.com/archives/D0AF8QFBVHB/p1773789580384389?thread_ts=1773788922.891409&cid=D0AF8QFBVHB)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com>
## Summary
- Adds the three pricing page card images (Free, Premium, Custom) to the
fleetdm.com/logos page
- Adds comic book style illustrations to the logos page, including both
base versions and captioned variants
- Images are displayed attractively in a grid with minimal text — no
stage labels or setup flow framing
### Changes
- `website/views/pages/press-kit.ejs`: Added two new sections ("Pricing
page cards" and "Comic book illustrations") following the existing page
layout pattern, with images only and minimal generic alt text
Built for
[mikermcneil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1773792420505909?thread_ts=1773792045.787089&cid=D0AFASLRHNU)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Add DOGFOOD_OKTA_METADATA_URL to the dogfood GitOps workflow environment
and update SSO configuration to use Okta. it-and-security/default.yml:
change end_user_authentication.entity_id to fleet-end-users and org SSO
entity_id to fleet-admins, set idp_name to Okta for both, remove inline
metadata values, and point metadata_url to $DOGFOOD_OKTA_METADATA_URL.
This centralizes IdP metadata retrieval via a secret URL.
## Summary
- Adds `sampfluger88` to `githubRepoMaintainersByPath` for
`website/api/controllers/webhooks/receive-from-clay.js`
- Adds `sampfluger88` to `githubRepoMaintainersByPath` for
`website/api/helpers/salesforce`
These are new entries in the maintainers mapping in
`website/config/custom.js`, ensuring that changes to the Clay webhook
controller and Salesforce helper files are auto-approved for
`sampfluger88`.
Built for [Sam
Pfluger](https://fleetdm.slack.com/archives/D0AF8QFBVHB/p1773792660524399)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com>
Updates the auto-tag-unreleased-bugs workflow to improve version
detection and handling.
## Changes Made
- **Orbit/Fleetd Version Detection**: Added support for detecting Orbit
and Fleetd versions in addition to Fleet server versions. The workflow
now checks `**Orbit version**:` and `**Fleetd version**:` fields (case
insensitive) and validates them against orbit-v* tags.
- **Optimized API Calls**: The workflow now only fetches the data it
needs:
- Fetches releases only when checking Fleet server versions
- Fetches tags only when checking Orbit/Fleetd versions
- This reduces unnecessary GitHub API calls and improves performance
- **Singular/Plural Field Support**: Updated regex patterns to match
both "version" and "versions" in issue templates (e.g., `**Fleet
version**:` and `**Fleet versions**:`). This handles variations in issue
template formatting where either singular or plural forms may be used.
- **Pagination Support**: Both `listReleases` and `listTags` API calls
now use `github.paginate()` to fetch all results instead of just the
first 100. This ensures older Orbit/Fleetd versions or Fleet versions
won't be misclassified as unreleased when they exist beyond the first
page of results.
- **Fixed 4.x Handling**: Corrected the logic for handling "4.x" version
strings (which represent all 4.x versions). The check now occurs before
the empty versions check, preventing issues reporting only "4.x" from
being incorrectly tagged as unreleased.
## Testing
- ✅ Verified regex patterns match both singular and plural forms for
Fleet, Orbit, and Fleetd version fields
- ✅ Confirmed the workflow correctly parses versions from various issue
formats
- ✅ Tested that API optimization only fetches releases or tags based on
which version types are present
- ✅ Verified pagination logic fetches all releases and tags, not just
first 100
- ✅ Tested 4.x handling logic correctly treats it as released
The changes maintain backward compatibility with existing issue formats
while adding support for Orbit/Fleetd version detection, handling
template variations, and ensuring comprehensive version checking through
pagination.
---------
Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com>
Co-authored-by: iansltx <472804+iansltx@users.noreply.github.com>
Co-authored-by: lukeheath <2495927+lukeheath@users.noreply.github.com>
## Summary
- Adds a `min-width: 500px` inline style to the "Quote" column header in
the Fleet Customer Testimonials table on the marketing-assets handbook
page.
- This makes the Quote column approximately twice as wide as it
currently renders by default, giving the longer testimonial quotes more
readable space.
- No other columns or content are changed.
Built for [Ashish
Kuthiala](https://fleetdm.slack.com/archives/D0AG9JQ53GA/p1773783685614189)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Adds a Windows Firefox update policy (`update-firefox.yml`) to detect
outdated Firefox installations vulnerable to CVE-2025-2857
- Adds Firefox as a Fleet-maintained app for Windows workstations
(`firefox/windows`) for self-service installation/update
- Registers both the policy and maintained app in `workstations.yml`
## CVE-2025-2857: Firefox Sandbox Escape on Windows
[CVE-2025-2857](https://nvd.nist.gov/vuln/detail/CVE-2025-2857) is a
**critical** sandbox escape vulnerability in Mozilla Firefox on Windows.
Following the Chrome sandbox escape (CVE-2025-2783), Firefox developers
identified a similar pattern in Firefox's IPC code where a compromised
child process could cause the parent process to return an
unintentionally powerful handle, leading to a sandbox escape.
**Affected versions:**
- Firefox < 136.0.4
- Firefox ESR < 128.8.1
- Firefox ESR < 115.21.1
**Only affects Firefox on Windows.** Other operating systems are
unaffected.
## What was changed and why
The Fleet-maintained Firefox app is already at version 148.0.2 (well
beyond the fix), and macOS workstations already had both an update
policy and software package configured. However, **Windows workstations
had no Firefox update policy or maintained app** — meaning there was no
mechanism to:
1. **Detect** Windows hosts running vulnerable Firefox versions
2. **Remediate** by offering an updated Firefox via self-service
This PR closes that gap by:
1. **`it-and-security/lib/windows/policies/update-firefox.yml`** — New
policy that queries the Windows `programs` table to flag any host with
Firefox < 148.0.2 (uses `LIKE 'Mozilla Firefox%'` and `NOT LIKE '%ESR%'`
to match standard Firefox installations, matching the pattern used in
other Windows update policies)
2. **`it-and-security/fleets/workstations.yml`** — Adds the policy
reference under Windows policies, and adds `firefox/windows` to
`fleet_maintained_apps` for self-service browser installation on x86
Windows hosts
---
Built for
[mikermcneil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1773774729891479)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: Kilo Code <kilo-bot@kilo.ai>
Changes:
- Commented out the section of the GitHub webhook that handles "release"
webhook events. The Zapier automation triggered by the webhook has been
turned off.
Added a section for Fleet customer testimonials with quotes from various
companies, highlighting their experiences and feedback on using Fleet.
This section aims to showcase the effectiveness and satisfaction of
Fleet's device management solutions.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves unreleased bug found in QA
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For: https://github.com/fleetdm/fleet/issues/39489
Changes:
- Updated the `update-one-devices-compliance-status` Microsoft proxy
endpoint to support compliance status updates for Windows devices
enrolled in Entra.
---------
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Adds Tor Browser as a Fleet-maintained app for macOS only.
## Changes
- **macOS**: Homebrew cask `tor-browser`, DMG installer, bundle
identifier `org.torproject.torbrowser`
- Icon sourced from the official Tor Project GitHub at 128x128
- Added to `apps.json` catalog in alphabetical order
**Note:** Windows support was dropped. Tor Browser for Windows uses a
portable installer that installs to `%LOCALAPPDATA%` (not `C:\Program
Files`), which is outside the scope of what Fleet's CI validator and
Windows install validation can detect. macOS-only is the correct scope
for this app.
## Test plan
- [ ] Verify `go run cmd/maintained-apps/main.go
--slug="tor-browser/darwin"` produces valid output
- [ ] Confirm icon renders correctly in the software catalog UI
- [ ] Confirm macOS install/uninstall scripts work on a test device
## Summary
Adds [Charles Proxy](https://www.charlesproxy.com/) as a
Fleet-maintained app for macOS.
Charles is an HTTP proxy, monitor, and reverse proxy that lets
developers view all HTTP and HTTPS traffic between their machine and the
internet. It's commonly used for debugging, testing, and network
analysis.
- macOS: DMG installer via Homebrew cask `charles`, bundle ID
`com.xk72.Charles`
- Windows: Not included — the WinGet package (`XK72.Charles`) uses an
`appx` installer type, which is not supported by Fleet's winget ingester
## Test plan
- [ ] Install Charles on a macOS host via Fleet self-service and confirm
it installs to `/Applications/Charles.app`
- [ ] Confirm `SELECT 1 FROM apps WHERE bundle_identifier =
'com.xk72.Charles';` returns a result after installation
- [ ] Uninstall Charles via Fleet and confirm the app is removed
- [ ] Confirm the Charles icon appears correctly in the Fleet UI
software catalog
- [ ] Run `go run cmd/maintained-apps/main.go --slug="charles/darwin"
--debug` and confirm no errors
Adds Krita (free and open-source digital painting application) as a
Fleet Maintained App for macOS and Windows.
## Changes
- **macOS**: Homebrew cask `krita`, DMG installer, bundle ID
`org.kde.krita`
- **Windows**: WinGet `KDE.Krita`, NSIS EXE installer with custom silent
install/uninstall scripts
- Icon generated from KDE official icon (128x128 PNG), added to icon
index
- Both platforms added to `apps.json` alphabetically (after Keka, before
LastPass)
## Testing
- macOS ingester ran successfully: `go run cmd/maintained-apps/main.go
--slug="krita/darwin" --debug`
- Windows ingester ran successfully: `go run cmd/maintained-apps/main.go
--slug="krita/windows" --debug`
- Output files generated: `ee/maintained-apps/outputs/krita/darwin.json`
and `windows.json`
## Related issue
Add Krita FMA
Magnus Jensen