Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 22 Packages Projects Releases Wiki Activity
25,709 Commits 2 Branches 0 Tags
af2d4dbbbd592b13a0c85067bbbf5164a0a79bbf
Commit Graph
4487 Commits
Author SHA1 Message Date
Victor Lyuboslavsky af2d4dbbbd Optimize IsHostConnectedToFleetMDM on the orbit check-in hot path (#44629) (#48375) 
**Related issue:** Resolves #44629

This folds the connected-to-Fleet check into `GetHostMDM` via a
`connected_to_fleet` column that mirrors the existing
`IsHostConnectedToFleetMDM` and `hostMDMSelect` conditions, and derives
the value in `GetOrbitConfig` from the `host_mdm` data it already
fetches. Result: **2 queries → 1** on the orbit check-in hot path, with
no semantic change.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Performance Improvements**
* Orbit check-ins now determine MDM connection status from existing host
MDM data, reducing database work and improving response time.
* **Bug Fixes**
* Added platform-aware connection detection so Windows, Apple, and
Android devices report MDM connectivity more accurately.
* Updated related checks and tests to keep connection status consistent
across enrollment and unenrollment changes.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-29 17:11:27 +01:00
Carlo 8cf1796a7d Support advanced options for script-only packages (#48315) 
**Related issue:** Resolves #42797

Adds support for pre-install query, post-install script, and uninstall
script on script-only packages (`.sh` and `.ps1`) across the API, UI,
and GitOps; previously these were silently stripped. The install script
remains the uploaded file's contents (file-driven) and is shown
read-only. Automatic install stays unsupported for script-only packages.

- **API** (`POST`/`PATCH /software/package`): stop stripping the fields;
validate post-install and uninstall scripts for script packages
- **GitOps**: allow
`uninstall_script`/`post_install_script`/`pre_install_query` paths
inline in the team YAML for script-only packages
- **UI**: show advanced options for `.sh`/`.ps1`; install script shown
read-only

  # Checklist for submitter

  - [x] Changes file added for user-visible changes in `changes/`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

  ## Testing

  - [x] Added/updated automated tests
  - [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Script-only packages (`.sh`/`.ps1`) now expose advanced
options—pre-install query, post-install script, and uninstall
script—consistently across the UI, REST API, and GitOps.
* Script-only packages display advanced options in the UI, and the
“Install script” editor can be made read-only where appropriate.
* **Bug Fixes**
* Preserved advanced option values for script-only packages during
upload, edits, and synchronization (including replace-file scenarios).
* Improved YAML generation and validation so supported fields are
included while unsupported ones are correctly rejected/omitted.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-29 11:59:37 -04:00
Lucas Manuel Rodriguez ef0a051482 Google Workspace IdP [2/6]: backend (cron + directory sync) (#48165) 
### 🥞 Stack (review/merge bottom-up)

1. #48164 — Activity types (FE+BE)
2. **#48165 — Backend (cron + directory sync) ⬅ this PR**
3. #48166 — Usage statistics
4. #48167 — fleetctl generate-gitops
5. #48168 — Settings UI

📄 Documentation is tracked separately in #48169 (targets
`docs-v4.89.0`).

---

## Summary

**PR 2 of 6.** Core **backend** for the Google Workspace IdP
integration:
- Directory sync client (`ee/server/googleworkspace/`) and cron job
(`server/cron/google_workspace_cron.go`) reusing the `scim_*` tables
(Google Workspace and SCIM are mutually exclusive).
- Config types + validation (`server/fleet/google_workspace.go`,
`app.go`, `integrations.go`), appconfig handling + activity emission
(`server/service/appconfig.go`), cron registration and schedule.
- SCIM is ignored while Google Workspace is configured
(`ee/server/scim/scim.go`).

> 🥞 **Stacked PR.** Base: `42915-gw-idp-vitals-1-activities` (PR 1) —
review/merge that first.

**Related issue:** Resolves #42915

# Checklist for submitter

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements).
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops.

## Testing

- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added Google Workspace integration support for syncing users, groups,
and host-related identity data.
* Added a scheduled sync that keeps directory data up to date
automatically.
* Added support for configuring Google Workspace in app settings, with
validation and masking of sensitive credentials.

* **Bug Fixes**
* Prevented SCIM provisioning from overwriting data when Google
Workspace sync is configured.
* Preserved existing Google Workspace credentials when an update omits
masked API key values.
* Added handling for deleted users and group membership changes during
sync.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-29 12:28:10 -03:00
Sharon KatzClaude Opus 4.6copilot-swe-agent[bot]
 		7f8e800003 Add private network IP blocking for outbound HTTP requests (#46463) 
**Related issue:** N/A (security hardening)

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Summary

Added network-level validation for outbound HTTP requests made by Fleet
integrations (webhooks, SSO, Jira, Zendesk, certificate authorities,
etc.) to prevent requests to unintended destinations. Includes a
configuration option for environments that require connectivity to
private network addresses.

Also fixes a pre-existing nil pointer panic in Jira retry logic and
ensures all HTTP clients use the validated transport.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

Unit and integration tests cover validation logic, boundary conditions,
and multiple configuration modes.

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
 2026-06-29 10:41:16 -04:00
Jonathan Katz ba814f4965 Fix gitops leaving temporary url for script-only package in datastore (#48370) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #47947 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed GitOps generation for script-only packages added by path so it
no longer creates invalid output files.
* Script package entries now use cleaner comments, while regular
packages still show version details.
* Placeholder `script://` installer URLs are now cleared properly and
won’t remain stored after processing.
* **Tests**
* Added coverage for script package comment formatting and for clearing
placeholder installer URLs during GitOps workflows.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-29 10:21:40 -04:00
Juan Fernandez bef74a6ff5 Add per-host reverse index for small-target live queries 
Resolves #42441

Store queries that target at most
redis.live_query_small_target_threshold hosts (default 1000) in a
per-host reverse index instead instead of a per-query bitfield indexed
by host ID.

Setting the threshold to 0 disables the reverse index (no query has <= 0
targets), serving as the kill-switch.
 2026-06-29 09:43:30 -04:00
Rahul Raghunathan 8b90422038 Update install software tooltip in setup experience (#48382) 
**Related issue:** Resolves #48368

# Before / After
- Before: "Old tooltip for Windows/Linux"
<img width="591" height="278" alt="image"
src="https://github.com/user-attachments/assets/c413c8a0-4c3b-489c-a046-c65d03452c44"
/>


- After: "Updated tooltip for Windows/Linux"
<img width="629" height="283" alt="image"
src="https://github.com/user-attachments/assets/b9e99430-5d63-470d-801e-2d4c060c112d"
/>

- for Mac and Apple-related OS stays unchanged.
<img width="583" height="273" alt="Screenshot 2026-06-28 at 5 52 50 PM"
src="https://github.com/user-attachments/assets/cac7990d-6212-4b69-9467-73d6a3f7d733"
/>



# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **Bug Fixes**
* Updated the “installed during setup” tooltip to clarify installation
order rules.
  * The tooltip now specifies ordering by software name (0–9, then A–Z).
* Added clearer policy sequencing: software without an install policy is
installed before software with a policy.
  * Android setup messaging remains unchanged.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-29 14:08:53 +01:00
Victor Lyuboslavsky a019cfb8f4 Compress windows_mdm_responses envelopes on the Windows MDM hot path (#48320) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44188 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually

## Database migrations

- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Windows MDM check-in response payloads are now stored gzip-compressed
in the database to reduce write pressure for large SyncML data.
* When fetching results, responses are automatically decompressed so the
original content is returned to clients.
* Empty payloads are preserved, and stored data is validated to ensure
only valid gzip content is accepted.
* **Database / Migration**
* Added a migration and backfill to move existing records from
uncompressed storage to the new compressed column format.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-26 22:03:01 +01:00
Jordan Montgomery a764e5d595 Parse both date formats while parsing macos profiles for verification (#48328) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45947

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

We do not know how to repro the customer issue and I spent about 6 hours
across a couple of days throwing everything I could at it so testing was
limited to macos profile verification smoke testing and unit tests to
confirm the time we see from customer logs and queries is now supported

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed an issue where macOS configuration profiles could get stuck in
“Verifying” when the reported install date uses a 12-hour time format.
* Improved parsing of locale-formatted install dates, including handling
of special spacing characters found on newer macOS versions.
* Enhanced validation so unsupported or empty install date formats
return clearer error messages.


<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-26 15:58:31 -04:00
George Karr 0f439f9593 Auto-update, pin, and rollback Fleet-maintained apps via UI and GitOps (#48293) 
**Related issue:** Resolves #38504

  **Constituent PRs (merged into this feature branch):**

- #47682 — Fleet UI: APRF Software title details page Library/Inventory
layout
- #47808 — Extend update software installer API to support FMA version
pinning
  - #47944 — Fleet UI: APRF library item accordion component
  - #48081 — Versions modal, multi-row Library, pinned state
  - #48098 — Add `pinned_version` to `edited_software` activity
  - #48123 — Auto-update FMA cron
  - #48144 — Download a newly-published FMA version when pinned to it

  # Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or
`ee/fleetd-chrome/changes`. See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

  ## Testing

  - [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates
  to one hosts's records do not affect another)

  - [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added Fleet-maintained app version pinning (Latest, exact, and major)
via a new Versions modal.
* Introduced premium auto-updates for maintained apps with pin-aware
promotion and rollback-safe caching.
  * Added expandable library version rows and a Policies modal.
* **Bug Fixes**
* Improved pin handling, cache/manifest hydration, and safer update
behavior on per-app failures and deduplication.
* **UI/UX**
* Refreshed the Software title details experience with new
accordion/list patterns, redesigned details widget/tooltips, and updated
installer presentation.
* **Documentation**
* Expanded Storybook component/page coverage and adjusted Storybook
canvas padding.
* **Tests**
* Added/updated unit and integration tests for pinning, auto-update
flows, and new modal/UI behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-26 14:42:23 -05:00
Luke Heath 2b50257de9 Bump golang.org/x/image to v0.42.0 (CVE-2026-33813) (#48345) 2026-06-26 11:24:16 -07:00
Andrew Mellor 5d58c5f5ff fix: remove as a custom MDM command text from MDM command list view (#48307) 
**Related issue:** Resolves #48297

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] QA'd all new/changed functionality manually





<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Corrected MDM command labeling in host details so only commands run
through the custom MDM command API appear as “custom MDM command.”
* Improved command details display for MDM items to show the appropriate
label instead of applying the custom label broadly.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-26 19:13:50 +01:00
Juan Fernandez cbe36a217a Fix policy selection resetting pagination to first page 
Fixes #47246

On the host details policies tab and the device user self-service
policies page, clicking a policy while on any page other than the first
reset the list back to page 1. To fix this, Memoize the data set so its
reference stays stable across re-renders that don't change the policies.
 2026-06-26 13:03:40 -04:00
Juan Fernandez 005bcdcf87 fleet-mcp: run multi-host live queries via ad-hoc campaign so observer_plus works 
Resolves #46005 

Implement flow for ad-hoc distributed query campaign streamed over the
/api/v1/fleet/results/websocket endpoint, the same way the Fleet UI and
fleetctl run live queries.
 2026-06-26 12:07:13 -04:00
Juan Fernandez 194f0cfb8f Fix SSO callback URLs doubling the subpath under a URL prefix 
Fixes #46641

When Fleet runs under a subpath, server_url already includes that
subpath, so appending url_prefix again produced a doubled ACS callback
path (e.g. https://host/subpath/subpath/api/v1/fleet/sso/callback),
breaking SAML authentication for both login and MDM end user
authentication.

Drop url_prefix from the callback URL construction so the path is
appended directly to server_url, which is the full external base URL.
Fixes the same flaw in all five ACS-construction sites: login SSO
initiate and callback, and MDM SSO initiate plus both callback branches.
 2026-06-26 10:40:55 -04:00
Juan Fernandez 8b737cc87c Fix duplicated URL prefix in transactional email links for subpath deployments 
Fixes #46642

When Fleet is deployed under a subpath, server_url already carries that
subpath, so the email link base was being built as server_url +
url_prefix, duplicating the path (e.g.
https://host/subpath/subpath/login/reset) and producing 404 links.

Use server_url directly as the link base, matching how the rest of the
codebase already treats server_url as the full external base URL.
 2026-06-26 10:40:26 -04:00
Jordan Montgomery 657ba985c3 Fix returned values on MDM command results endpoint (#48296) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

Fix tagging of hostnames on returned MDM command results so all returned
results have a hostname

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed an issue where some MDM command results could return without
hostnames.
* Improved result visibility so only hosts the caller is allowed to see
are included.
* Ensured team-scoped users see only their permitted results, while
global admins continue to see all available results.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-26 10:34:26 -04:00
Nico 040cefde93 Enable refetchOnWindowFocus and set refetchInterval to 5s when no report results are available (#48268) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48192

- Deleted `refetchOnWindowFocus: false` so that users get fresh data if
they navigate away and come back to the report results page (IMHO this
should be the behavior across all Fleet's UI).
- Set a refetch interval of 5s when no report results are available.

^ is gated to the report bringing back results (i.e. `discard_data =
false` and `logging = snapshot`).

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] QA'd all new/changed functionality manually



https://github.com/user-attachments/assets/13513f37-8634-4c22-95cc-c0b2e9128058



https://github.com/user-attachments/assets/ae30640a-d0cb-4d93-a0f3-058650895959



https://github.com/user-attachments/assets/54a46634-fbca-4a7a-a75e-36b73370c9a0





<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Report results now refresh automatically when you return to the
browser window.
* Empty report results are checked again every 5 seconds until data
appears.

* **Bug Fixes**
* Improved handling of report caching settings so refresh behavior is
skipped when caching is disabled.
* The empty-state view now stays in sync with whether report caching is
available.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-26 09:51:29 -03:00
George Karr a2af2d97a0 Adding BYOD backend changes (#47716) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** #23242

Backend changes for Apple BYOD (personal) MDM enrollment.

- Adds a `byod` enrollment path that distinguishes personal devices from
organization-owned devices.
- Persists per-host Apple MDM enrollment access rights in a new
`host_mdm_apple_enrollment_permissions` table so SCEP/ACME renewal
honours Apple's monotonic-narrowing invariant (permissions can never be
widened on profile replacement).
- Surfaces wipe/lock/clear-passcode allowed flags on host details for
manually-enrolled Apple hosts.
- Renames the personal enrollment status label to `On (manual -
personal)`.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

### Test plan

- Manual (profile) enrollment, company-owned: device receives full
access rights; wipe/lock/clear-passcode allowed.
- Manual (profile) enrollment, personal (BYOD via `byod=1`): device
receives narrowed access rights (no device lock/erase); host details
show wipe/lock/clear-passcode disabled.
- SCEP/ACME renewal for each of the above: renewed profile preserves the
original ServerURL (incl. `byod=1`) and the stored (narrowed) access
rights; Apple does not reject the replacement.
- Renewal batching: multiple company-owned hosts collapse into a single
InstallProfile command; a BYOD host gets its own command.
- Account-Driven User Enrollment (ADUE): enroll a personal device via
ADUE and confirm it is inherently restricted (Apple `UserEnrollment`
mode — no device lock/erase regardless of AccessRights), and that its
SCEP renewal succeeds and preserves the account-driven enrollment
profile.
- Deleted-then-returned device: delete a still-enrolled BYOD host in
Fleet, let it check back in, and confirm a subsequent SCEP renewal still
uses the narrowed permissions.

## Database migrations

- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added personal (BYOD) Apple MDM enrollment support across manual
profiles, OTA enrollments, and SCEP/ACME certificate renewals, with
access rights generated appropriately.
* Apple host details now surface per-device permission flags for wipe,
lock, and clear passcode when available.
* Enrollment status text now shows personal manual enrollments as “On
(manual - personal)”.
* **Bug Fixes**
* Enforced remote wipe/lock (and clear passcode) permissions correctly
for personal devices, including persistence across renewals.
* Host deletion cleanup now removes newly tracked enrollment permission
data.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-25 18:21:26 -05:00
RachelElysia 45bea9d17f Fleet UI: Activity feed outline only on keyboard focus (#48295) 2026-06-25 17:44:03 -04:00
Jonathan Katz d563ed21a1 Add activity and enable managed account fleets endpoint (#48273) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44153
- Adds mdm enabled and configured checks for the update fleet endpoint
- Adds activity creation for the update fleet endpoint + gitops apply

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **New Features**
* Added activity logs when the managed local account setting is enabled
or disabled.
* Managed local account updates now work consistently through both the
Update Fleet endpoint and GitOps.

* **Bug Fixes**
* Prevented enabling managed local account unless macOS MDM is enabled
and configured.
* No activity is created when the setting is saved without any actual
change.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-25 17:29:33 -04:00
Konstantin Sykulev c226a3feab On var change resend Android certificate templates and managed app configs (#48278) 
**Related issue:** Resolves #36681, #48042

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually

## Database migrations

- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Certificate templates and managed Android app configurations now keep
track of referenced variables.
* Variable changes can now trigger automatic re-sending of affected
profiles and app availability updates.
* **Bug Fixes**
* Resend behavior now refreshes certificate templates when related
variable values change.
* Android managed app configurations are re-queued when their variables
are updated.
* **Database**
* Added support for variable tracking on certificate templates and
Android app configurations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-25 16:27:30 -05:00
Lucas Manuel Rodriguez 608bd2764c Restrict conditional access Okta IdP asset endpoints to privileged roles (#48294) 
# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`.
- [x] Input data is properly validated (authorization policy change
only).

## Testing

- [x] Added/updated automated tests — the role matrix in
`TestConditionalAccessGetIdPSigningCertAuth` and
`TestConditionalAccessGetIdPAppleProfileAuth` now asserts observer and
observer+ are denied; `go test ./server/authz/` confirms the policy
compiles.
- [x] QA'd all new/changed functionality manually — covered by the
automated role-matrix tests for this authz-only change.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Tightened access to conditional access identity provider assets so
only higher-privilege roles can read them.
* Users with observer and observer+ roles can no longer access these
endpoints.
  * Updated validation coverage to reflect the revised access behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-25 15:57:25 -03:00
Carlo DiCelico 2f9147e685 merge main 2026-06-25 13:57:22 -04:00
Carlo DiCelico b0f2f19fbc add changes file 2026-06-25 13:13:13 -04:00
Jordan MontgomeryandCopilot Autofix powered by AI 07ebe1d836 Check if host is still on script's team before executing batch (#48244) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Scheduled batch script execution now re-checks host team membership at
execution time, skipping any hosts moved to a different team before the
batch runs.
* Added a clear “team mismatch” incompatibility outcome and ensured
incompatible hosts are not queued for execution.
* **Tests**
* Expanded script scheduling tests to cover host-to-team transfers
between scheduling and execution, including updated incompatibility
counts and per-host expectations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-06-25 12:04:34 -04:00
Sharon Katz 8756b2f86c Tighten certificate renewal validation in host identity SCEP service (#48270) 
**Related issue:** N/A (internal security hardening)

## Summary

The SCEP certificate renewal flow accepted a CSR with any CommonName as
long as the requester proved possession of the old certificate's private
key. This allowed a host to obtain a certificate for a different host's
identity during renewal.

## Reproduction

Code-level verification (no running server required):

1. Read `ee/server/service/hostidentity/scep.go` `renewalMiddleware`
(lines 142-216).
2. Confirmed that after PoP signature verification (line 191), the CSR
is passed directly to `next.SignCSRContext(ctx, m)` (line 198) with no
comparison of `m.CSR.Subject.CommonName` against
`oldCertData.CommonName`.
3. Confirmed that `UpdateHostIdentityCertHostIDBySerial` (line 205) then
binds the new cert's serial to the old cert's `host_id`, completing the
identity takeover.

## Fix

Added a CN equality check after signature verification: if the CSR's CN
does not match the original certificate's CN, the renewal is rejected
with an error.

## Testing

### Unit tests (`ee/server/service/hostidentity/scep_test.go`)

Exercises `renewalMiddleware` directly with a mock datastore:
- `mismatched CN is rejected` -- constructs a renewal CSR with
`CN=attacker-identity` against an original cert with
`CN=original-host-identity`. Verifies the middleware returns an error
containing "common name does not match" and the next signer is never
called.
- `matching CN is accepted` -- constructs a renewal CSR with the same CN
as the original cert. Verifies the middleware passes through to the next
signer successfully.

### Integration tests (local, real MySQL)

Ran `TestHostIdentity` against a local MySQL 8.0.44 instance
(`MYSQL_TEST=1 REDIS_TEST=1`). All 28 subtests pass, including:
- **Certificate renewal flows** (ECC P256 orbit, ECC P384 orbit, ECC
P384 osquery) -- renewed certs preserve the original CN, host_id
binding, and work for authenticated requests.
- **Renewal replay protection** -- reusing a revoked cert's serial for
renewal is rejected.
- **Wrong cert authentication** -- cross-host cert usage is rejected (9
subtests).
- **Real SecureHW + SCEP** -- full TPM-simulated renewal flow succeeds.
- **Failure cases** -- empty/wrong challenge, oversized CN, non-ECC
algorithm all correctly rejected.

Linter passes (`make lint-go-incremental` -- 0 issues).

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Tightened certificate renewal checks so renewal requests now fail if
the new certificate request uses a different common name than the
existing certificate.
* Renewal requests with matching common names continue to work as
expected.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-25 12:02:15 -04:00
Konstantin Sykulev 214619d935 Refactor makeAndroidAppAvailable to use staggered job queuing (#47880) 
**Related issue:** Resolves #47543

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Updated Android app availability to use staggered batch jobs instead
of processing everything at once, improving throughput and smoothing
workload.
* **New Features**
* Added batched handling that can perform per-host managed configuration
substitution when variables are present, including scheduling “pending
apply config” updates when required.
* **Configuration**
* Reduced the default Android batch size (`mdm.android_batch_size`) to
100.
* **Bug Fixes / Tests**
* Updated unit and integration tests to verify batching, staggering
timing, full host coverage, and order-independent policy application
behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-25 10:31:38 -05:00
Dante Catalfamo 1b64b6104a Fix NDES not using the same retry clearing method as SmallStep for macos (#48105) 
**Related issue:** Resolves #46291
 2026-06-25 09:32:22 -04:00
Sharon Katz 26414db4ea Restrict authorization for team membership operations (#48201) 
**Related issue:** N/A

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] Reproduced the issue and verified the fix
- [x] QA'd all new/changed functionality manually

## Summary

- Introduced a more granular authorization action for team membership
management
- Updated OPA policy and service-layer authorization accordingly
- Added comprehensive authorization test coverage

## Reproduction

Verified that with the previous authorization check, an API-only user
with team-scoped write access could call `PATCH
/api/latest/fleet/teams/{id}/users` to modify team membership without
restriction. After the fix, the operation correctly returns a 403
Forbidden for non-admin roles. Admin users retain full access to manage
team membership.

**Test**: `TestGitOpsCannotManageTeamMembers` in
`server/service/teams_test.go` explicitly exercises this scenario and
confirms the fix.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Tightened team member management so adding/removing team users now
requires a dedicated team-membership write permission (global admins and
team admins only, scoped appropriately).
* Prevented GitOps users from modifying team membership, including
self-promotion to admin.
* Updated enterprise integration expectations to return **403
Forbidden** for blocked membership change attempts.

* **Tests**
* Expanded authorization test coverage for team member write access
across roles and team scopes.
* Added coverage ensuring GitOps cannot manage team members, while valid
team admins can.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-25 10:01:15 -03:00
Jordan Montgomery c041c6c24f Fix batch script execution validations (#48243) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
  * Improved validation for batch script execution requests.
* Added an extra authorization check before a batch script can be
scheduled, helping ensure only permitted actions proceed.
* Expanded test coverage for role-based access during batch script
execution.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-25 07:25:33 -04:00
Sharon Katz d00963c330 Tighten conditional-access SCEP challenge validation (#48041) 
**Related issue:** N/A

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

## Summary

Tightens validation in the conditional-access SCEP challenge middleware
to reject enrollment requests that use a secret outside the expected
scope. Adds unit test coverage for the middleware.

## Reproduction

The `challengeMiddleware` in `ee/server/service/condaccess/scep.go`
calls `ds.VerifyEnrollSecret()` but discards the returned secret (`_,
err :=`), so it only checks that *some* valid enroll secret exists. It
does not verify the secret's scope. Any valid secret from any scope
passes the challenge.

This was confirmed with a unit test using mock secrets scoped to
different teams. Before the fix, the middleware accepted all of them
indiscriminately. The server-side profile generation
(`server/service/conditional_access_idp.go`) only ever embeds a
global-scope secret as the SCEP challenge, so only global secrets should
be accepted.

## How it was tested

1. **Unit tests (`scep_test.go`)** - table-driven test with 5 cases
exercising the `challengeMiddleware` directly:
   - Empty challenge -> rejected ("missing challenge")
   - Unknown secret -> rejected ("invalid challenge")
- Team-scoped secret (team A) -> rejected ("invalid challenge") *[new
behavior]*
- Team-scoped secret (team B) -> rejected ("invalid challenge") *[new
behavior]*
- Global secret (team_id = nil) -> accepted, signer invoked, cert
returned

2. **Ran `go test -v ./ee/server/service/condaccess/`** - all tests
pass.

3. **Ran `make lint-go-incremental`** - 0 issues.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved validation for conditional access SCEP enrollment, including
rejecting team-scoped enrollment secrets.
* Updated challenge middleware behavior to better handle enrollment
secret verification outcomes and associated error messaging.

* **Tests**
* Added comprehensive coverage for conditional access SCEP challenge
validation, including cases for missing, unknown, team-scoped, and
global enrollment secrets, plus signer invocation expectations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-24 16:53:37 -04:00
RachelElysia b5847cdc2a Fleet UI: Browser Back no longer trapped on script batch progress page (#48200) 2026-06-24 16:30:02 -04:00
Sharon Katzcopilot-swe-agent[bot]Dante Catalfamo
 		faff41e41d Fix My device page software sorting by display name (#45836) 
**Related issue:** Closes #43673 (remaining issue reported by @getvictor
after PR #44873)

## Changes

The "My device" page / host details software tab sorts software by
`software_titles.name` (often an installer filename) instead of the
custom display name. PR #44873 fixed this for the global
`/software/titles` endpoint but missed the host-specific
`ListHostSoftware` query path.

**Fix:** Add a `LEFT JOIN software_title_display_names` to the outer
query wrapper in `ListHostSoftware`, and update
`hostSoftwareAllowedOrderKeys` to use
`COALESCE(NULLIF(stdn.display_name, ''), name)` so display names are
used for sorting when set.

**1 file changed:** `server/datastore/mysql/software.go`

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Dante Catalfamo <43040593+dantecatalfamo@users.noreply.github.com>
 2026-06-24 14:16:57 -04:00
Allen Houchins d66242856f Disambiguate FMAs sharing macOS bundle IDs (#47951) 
Fix handling of Fleet-maintained apps that share a macOS bundle
identifier (e.g. Firefox and Firefox ESR). Removed the blind rename from
UpsertMaintainedApp and added ReconcileMaintainedAppSoftwareNames: a
two-pass, idempotent reconciliation that (1) renames titles tied to a
single FMA via installer links and (2) heuristically renames by bundle
identifier only when the identifier maps to exactly one FMA name.
Updated team join logic to prefer matching by installer link and fall
back to bundle identifier, changed GetFMANamesByIdentifier to omit
ambiguous identifiers, added a call to reconcile during the
maintained-apps sync, and extended the datastore interface and mock
accordingly. Added tests and a manifest check for known shared
identifiers, plus a changelog entry.

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #42445

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Bug Fixes

* Fixed an issue where macOS apps sharing a bundle identifier (e.g.,
Firefox and Firefox ESR) would incorrectly report each other as already
installed and could have their software titles unexpectedly changed.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-24 13:05:53 -05:00
Dante Catalfamo 0e3bc85acb Fix My device software list appending macos_applications param on pagination (#48145) 
**Related issue:** Resolves #39017
Related issue: Resolves #47846
 2026-06-24 13:36:24 -04:00
Scott Gress 6336443f37 Report mobile devices in "hosts online" (#47222) 2026-06-24 07:50:35 -07:00
Scott Gress 82f7405f19 Allow setting default vuln chart filters via GitOps (#47634) 2026-06-24 07:49:19 -07:00
RachelElysia 7bac963f31 Fleet UI: Add CopyButton component, fix Copied! badge in dark mode (#48124) 2026-06-24 10:19:37 -04:00
Jonathan Katz b784de80b0 Cancel software install records instead of deleting when an installer is deleted (#48127) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #47348
Does two things:
- Removes the software_installers and software_titles joins. These could
be null, but we would still want to create software install records for
these installs even if the installer or title were deleted.
- Changes every case where a host_software_installs is deleted into
setting the canceled flag to 1 on that row.

It also updates some comments. `deletePendingSoftwareInstallsForPolicy`
had a comment that said it should be called _after_ deleting a policy,
but that seems wrong and was not actually reflected in the code even
when it was originally added. It should be called _before_ deleting the
policy so that the siua.policy_id column is still available before it
gets set to null by the FK constraint. Same for
`deletePendingHostScriptExecutionsForPolicy`.

Also removes the `NOTE(mna): ...` comment, because it seems like the
code works as intended and only the comments were wrong.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Prevented a 500 error when late software installation results are
reported after the related installer has been deleted.
* Pending software install entries are now preserved as **canceled**
(instead of being deleted) during installer, policy, and batch update
flows, keeping results consistent.
* Improved correctness of intermediate failure recording and
setup-experience deletion behavior, including distinguishing
**canceled** vs **removed** installs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-24 10:00:27 -04:00
Juan Fernandez 25973b3974 Authorize query read when creating a policy from query_id 
When creating a fleet or global policy from an existing query (via
query_id) load the referenced query and authorize ActionRead on it
before its fields are copied, in both fleet policies and global
policies.
 2026-06-24 08:27:53 -04:00
Konstantin Sykulev a93c61722d Android certs support all idp vars (#48100) 
**Related issue:** Resolves #36774

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Certificate templates now support additional variables for subject
names and SANs, including host platform and identity-provider-derived
fields such as username (local part), groups, department, and full name.
* **Bug Fixes**
* Improved validation and error handling for missing host or
identity-provider data during template variable substitution.
* **Tests**
* Expanded coverage for supported/unsupported variables, correct
placeholder replacement, caching behavior, and RFC 4514 escaping in
DN-related values.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-23 16:58:40 -05:00
Steven Palmesano 1a68f206bd Improve software page tooltips (#46839) 
Resolves #46921.

Before and after screens below.
Correct wording for scripts:

<img width="343" height="148" alt="Screenshot 2026-06-04 at 11 52 36"
src="https://github.com/user-attachments/assets/2f56dc01-0eb5-4fdd-9d9a-c4055b823bc9"
/>
<img width="309" height="129" alt="Screenshot 2026-06-04 at 11 55 07"
src="https://github.com/user-attachments/assets/99347a18-1304-451a-9d0d-d12a64acb9a7"
/>

Prefer human-readable software names:

<img width="659" height="146" alt="Screenshot 2026-06-04 at 09 41 03"
src="https://github.com/user-attachments/assets/f12a4f2b-a3d3-4860-a98d-8e0bd6145131"
/>
<img width="645" height="145" alt="Screenshot 2026-06-04 at 09 41 12"
src="https://github.com/user-attachments/assets/638cfef0-afb5-41a8-a37f-a412b055d76c"
/>

<img width="614" height="133" alt="Screenshot 2026-06-04 at 11 50 51"
src="https://github.com/user-attachments/assets/24c016c2-693e-4256-b7d2-bef057df16f3"
/>
<img width="622" height="114" alt="Screenshot 2026-06-04 at 11 55 32"
src="https://github.com/user-attachments/assets/8a06f0f1-01fa-498b-908d-2e8a81f03e9f"
/>


# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **Bug Fixes**
* Improved host software empty-state tooltips with human-friendly
software/package naming (preferring display name) and context-specific
messaging.
* Corrected script vs non-script action wording: “Run” for script
packages and “Install” for non-scripts, including matching CTA and verb
text.
* Updated App Store self-service tooltip phrasing to include the app
name when available.

* **Tests**
* Adjusted tooltip expectations to match the updated placeholder and App
Store text.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-23 15:04:49 -05:00
Sharon Katz 81f2edec65 Improve fleet scope validation for software title lookups (#48034) 
## Summary

Ensures that `SoftwareTitleByID` validates fleet scope for all non-nil
`team_id` values, including zero. Previously the scope check was only
applied when `team_id > 0`.

## Reproduction

Added a unit test (`TestSoftwareTitleByIDTeamIDZero`) that sets up a
fleet-scoped user on fleet 1, then calls `SoftwareTitleByID` with
`team_id=0`. Before this change, the call succeeded. After, it correctly
returns 403.

Also confirmed that a global admin calling with `team_id=0` still
succeeds, and that all existing `TestServiceSoftwareTitlesAuth` subtests
continue to pass.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Improvements**
* Enhanced fleet scope validation for software title lookups, including
correct handling when a team scope value is set to `0`.

* **Tests**
* Added unit test coverage for software title retrieval authorization
behavior when the team scope value is `0`.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-23 14:28:15 -04:00
Allen Houchins b55d45806c Align software category name comparison with DB (#47983) 
Normalize category name comparisons to match MySQL's utf8mb4_unicode_ci
collation (case-insensitive and ignoring Unicode variation selectors) to
avoid duplicate-entry errors. Add normalizeSoftwareCategoryName and
SoftwareCategoryNamesEqual (server/fleet/software.go) and use them where
categories are deduped (ee/server/service/software_installers.go). Make
batch insert idempotent by using ON DUPLICATE KEY UPDATE in the MySQL
batch insert (server/datastore/mysql/software.go). Add tests for
name-equality behavior and idempotent batch inserts
(server/fleet/software_test.go,
server/datastore/mysql/software_test.go). This prevents collisions
between visually identical emoji forms (e.g. with/without U+FE0F) and
tolerates concurrent/default category inserts.

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #47981

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed GitOps runs failing due to software category duplicate-entry
errors when names contain certain Unicode characters (e.g., emoji
variation selectors).

* **Improvements**
* Enhanced software category deduplication to properly handle
Unicode-equivalent names.
* Made batch category insertion operations idempotent to prevent
duplicate-key errors.

* **Tests**
* Added tests for software category idempotency and Unicode character
handling.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-23 12:38:58 -05:00
Allen Houchins a972ca21b0 Add "Support" default software category (#47923) 
**Related issue:** Resolves #48064

Adds a new default self-service software category, rendered as **🛟
Support**, alongside the existing six defaults (Browsers, Communication,
Developer tools, Productivity, Security, Utilities).

## What changed

**Backend (Go)**
- `server/fleet/software.go` — added `🛟 Support` to
`DefaultSelfServiceCategoryNames` (seeds new fleets) and `"Support": "🛟
Support"` to `LegacySoftwareCategoryNames` (so GitOps/FMA manifests can
reference the non-emoji `Support`).
- New migration `20260619120000_AddSupportSoftwareCategory` — inserts
the global default (`team_id=0`) and backfills every existing fleet.
Timestamps pinned for deterministic schema dumps; `INSERT IGNORE` guards
the `(team_id, name)` unique key.
- `schema.sql` regenerated via `tools/dbutils`.
- `cmd/maintained-apps/main.go` — added `Support` to the FMA validator
allowlist.

**Frontend**
- `frontend/interfaces/software.ts` — added `"Support"` to the
`SoftwareCategory` union.
- `frontend/pages/hosts/details/cards/Software/SelfService/helpers.ts` —
added `{ label: "🛟 Support", value: "Support" }` to the fallback list.

**Docs**
- `docs/Configuration/yaml-files.md` — documented `Support` as a
supported GitOps category.

## Note on sort order
`ListSoftwareCategories` does `ORDER BY name` under
`utf8mb4_unicode_ci`, which sorts by the word after the (ignorable)
emoji. `🛟 Support` is therefore placed between `🔐 Security` and `🛠️
Utilities`.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

Verified against a dockerized MySQL:
- Migration test `TestUp_20260619120000`
- `TestSoftware/SoftwareCategoryCRUD` (order-sensitive assertion)
- `TestSelfServiceCategoriesCRUD` + `TestDeviceSelfServiceCategories`
integration tests
- `cmd/maintained-apps` tests, ee categories test, `go vet`, `make
lint-go-incremental` (0 issues)
- `tools/dbutils` schema regeneration matches

## Database migrations

- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [x] Verified the setting is documented (GitOps `categories` supported
values in `docs/Configuration/yaml-files.md`).


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Introduced the "🛟 Support" category as a new self-service software
classification option. Users can now better organize support-related
applications within their software catalog. The category is available
globally across all teams, providing improved organization and discovery
capabilities for support applications alongside utilities and other
existing software categories.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-23 09:41:08 -05:00
Juan Fernandez eb48eb37f8 Made team label membership checks more robust 
When creating a manual label, make the checks around manual host more
robust.
 2026-06-23 10:01:23 -04:00
Marko Lisica 977d8e8d73 New ToastNotification component to replace FlashMessage component (#47508) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Redesigned in-app notifications with a new toast-based UI style.
* Error messages are now dismissible and expandable to reveal detailed
server response information.
* Success and error notifications now appear consistently across the
application with improved visibility.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-23 12:26:02 +02:00
Steven Palmesano b838dd371b Display tooltips for fleets and roles on Settings > Users and My account pages (#46822) 
Resolves #46920.

When a user is assigned to multiple fleets, show a tooltip with those
fleets (similar to the User email column on the Hosts page).

<img width="317" height="201" alt="Screenshot 2026-06-04 at 10 23 32"
src="https://github.com/user-attachments/assets/7a579bc7-30fc-47cf-b3d7-3042b5348698"
/>

When a user has more than one role type, show a tooltip with the
roles/fleets for Various:

<img width="414" height="213" alt="Screenshot 2026-06-04 at 10 23 36"
src="https://github.com/user-attachments/assets/2e1e2cb1-9265-462a-a51e-a9a0b9930b8a"
/>

My account:

<img width="244" height="278" alt="Screenshot 2026-06-11 at 09 13 02"
src="https://github.com/user-attachments/assets/5a7f2621-8809-4c94-a02c-599f8137a562"
/>
<img width="323" height="293" alt="Screenshot 2026-06-11 at 09 13 06"
src="https://github.com/user-attachments/assets/2e3befd2-dc97-49ea-a02d-42a888b140b2"
/>


# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary of Updates

* **New Features**
* Added tooltip details for **Settings > Users** and **My account** to
show all fleets and role groupings when a user has multiple assignments.

* **Improvements**
* Updated admin user/invite tables to enrich displayed data for
**Fleets** and **Role**.
* “Role” now supports a special **Various** view with tooltip breakdown
by associated teams.
* **Fleets** cells now show expanded, multi-line tooltips for multi-team
users and improved grey/italic styling for special cases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-22 14:54:52 -05:00
Jonathan Katz 2b4437a566 Fix spaces in script package name causing validation failure (#47945) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44710

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed validation failures when script packages contain spaces in their
names during GitOps operations.
* Script-based installer packages are no longer incorrectly validated as
standard URLs.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-22 11:23:16 -04:00